xmrig | 8306985efa9e1df79d4f1651a907d4aad9f462c1e36130fd3cd77122f033df57

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
Size

1.8MB
MD5

0465fc0f0cefb5e2e2d5bebb2d2ef8a2
SHA1

866e685b73ebbd69f93422cc32c48ec039b507a2
SHA256

8306985efa9e1df79d4f1651a907d4aad9f462c1e36130fd3cd77122f033df57
SHA512

7e1de901855b6fdc9cb96284a9a7194a8ad8f43a29d0f93b7305d7dcf6cb03e1f09c5645de3384d3a13aad80cce134de2a825eb1c5dc114532240d201e651294
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl8Q:NABa

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/2420-81-0x00007FF72A0F0000-0x00007FF72A4E2000-memory.dmp	xmrig
behavioral2/memory/1456-86-0x00007FF7DC780000-0x00007FF7DCB72000-memory.dmp	xmrig
behavioral2/memory/4428-112-0x00007FF686DE0000-0x00007FF6871D2000-memory.dmp	xmrig
behavioral2/memory/3364-440-0x00007FF671BB0000-0x00007FF671FA2000-memory.dmp	xmrig
behavioral2/memory/3964-441-0x00007FF62DAD0000-0x00007FF62DEC2000-memory.dmp	xmrig
behavioral2/memory/4140-442-0x00007FF74EDF0000-0x00007FF74F1E2000-memory.dmp	xmrig
behavioral2/memory/4724-443-0x00007FF7CD580000-0x00007FF7CD972000-memory.dmp	xmrig
behavioral2/memory/2684-444-0x00007FF6658C0000-0x00007FF665CB2000-memory.dmp	xmrig
behavioral2/memory/2908-445-0x00007FF76FF10000-0x00007FF770302000-memory.dmp	xmrig
behavioral2/memory/1752-446-0x00007FF6F5D90000-0x00007FF6F6182000-memory.dmp	xmrig
behavioral2/memory/2172-462-0x00007FF6F2350000-0x00007FF6F2742000-memory.dmp	xmrig
behavioral2/memory/5092-104-0x00007FF7562E0000-0x00007FF7566D2000-memory.dmp	xmrig
behavioral2/memory/3912-100-0x00007FF68FBB0000-0x00007FF68FFA2000-memory.dmp	xmrig
behavioral2/memory/1704-99-0x00007FF7AAED0000-0x00007FF7AB2C2000-memory.dmp	xmrig
behavioral2/memory/4404-90-0x00007FF6EBF20000-0x00007FF6EC312000-memory.dmp	xmrig
behavioral2/memory/2736-89-0x00007FF6E87C0000-0x00007FF6E8BB2000-memory.dmp	xmrig
behavioral2/memory/3076-41-0x00007FF60C790000-0x00007FF60CB82000-memory.dmp	xmrig
behavioral2/memory/1872-30-0x00007FF703CE0000-0x00007FF7040D2000-memory.dmp	xmrig
behavioral2/memory/2268-24-0x00007FF7E3FF0000-0x00007FF7E43E2000-memory.dmp	xmrig
behavioral2/memory/2012-1975-0x00007FF759B00000-0x00007FF759EF2000-memory.dmp	xmrig
behavioral2/memory/1460-1977-0x00007FF670740000-0x00007FF670B32000-memory.dmp	xmrig
behavioral2/memory/2268-2023-0x00007FF7E3FF0000-0x00007FF7E43E2000-memory.dmp	xmrig
behavioral2/memory/1872-2025-0x00007FF703CE0000-0x00007FF7040D2000-memory.dmp	xmrig
behavioral2/memory/1456-2047-0x00007FF7DC780000-0x00007FF7DCB72000-memory.dmp	xmrig
behavioral2/memory/3076-2049-0x00007FF60C790000-0x00007FF60CB82000-memory.dmp	xmrig
behavioral2/memory/1460-2060-0x00007FF670740000-0x00007FF670B32000-memory.dmp	xmrig
behavioral2/memory/2736-2061-0x00007FF6E87C0000-0x00007FF6E8BB2000-memory.dmp	xmrig
behavioral2/memory/1704-2063-0x00007FF7AAED0000-0x00007FF7AB2C2000-memory.dmp	xmrig
behavioral2/memory/4428-2058-0x00007FF686DE0000-0x00007FF6871D2000-memory.dmp	xmrig
behavioral2/memory/2012-2054-0x00007FF759B00000-0x00007FF759EF2000-memory.dmp	xmrig
behavioral2/memory/4404-2056-0x00007FF6EBF20000-0x00007FF6EC312000-memory.dmp	xmrig
behavioral2/memory/2420-2052-0x00007FF72A0F0000-0x00007FF72A4E2000-memory.dmp	xmrig
behavioral2/memory/4724-2078-0x00007FF7CD580000-0x00007FF7CD972000-memory.dmp	xmrig
behavioral2/memory/2172-2079-0x00007FF6F2350000-0x00007FF6F2742000-memory.dmp	xmrig
behavioral2/memory/2684-2081-0x00007FF6658C0000-0x00007FF665CB2000-memory.dmp	xmrig
behavioral2/memory/3364-2076-0x00007FF671BB0000-0x00007FF671FA2000-memory.dmp	xmrig
behavioral2/memory/5092-2071-0x00007FF7562E0000-0x00007FF7566D2000-memory.dmp	xmrig
behavioral2/memory/4140-2068-0x00007FF74EDF0000-0x00007FF74F1E2000-memory.dmp	xmrig
behavioral2/memory/1752-2066-0x00007FF6F5D90000-0x00007FF6F6182000-memory.dmp	xmrig
behavioral2/memory/3912-2074-0x00007FF68FBB0000-0x00007FF68FFA2000-memory.dmp	xmrig
behavioral2/memory/3964-2070-0x00007FF62DAD0000-0x00007FF62DEC2000-memory.dmp	xmrig
behavioral2/memory/2908-2084-0x00007FF76FF10000-0x00007FF770302000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3116	powershell.exe
5	3116	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2268	SWTjjCa.exe
1872	YjyXnEl.exe
3076	vnNpOAh.exe
2420	pXYrkRz.exe
2012	nGwslMr.exe
1456	uUCCbHc.exe
2736	DqPDkuf.exe
1460	xEEUVyi.exe
4404	VsLrfnN.exe
4428	sPbSZKL.exe
1704	OjIduWy.exe
3912	uYFevza.exe
3364	eVTYseq.exe
5092	WSojszE.exe
3964	guIGEaq.exe
4140	VbmzYAW.exe
1752	PeFsjAb.exe
2172	tvWVTxu.exe
4724	xjahjsk.exe
2684	zPFvWvv.exe
2908	dmblteZ.exe
1096	inmFKtN.exe
4520	raGfWHg.exe
4620	lWuienA.exe
1340	FONjGRp.exe
4792	bDinfTT.exe
1668	BqEEWGG.exe
884	sGMxAok.exe
1860	soIFGtZ.exe
2044	rPYjrHw.exe
3908	bIrnvFb.exe
3948	jUGntmG.exe
928	lVleAnj.exe
3864	PlYEWGB.exe
4700	OoohGKT.exe
4268	EwCiUCf.exe
1636	vMnCvTb.exe
3632	RIDLhUL.exe
232	uMCeayA.exe
4628	mDtVZxH.exe
228	rKiXlDO.exe
1280	gYRWpEo.exe
4612	iwZHHJG.exe
4932	DIqRZxc.exe
4600	saEmzoS.exe
2672	dzwUYkk.exe
2272	YtycJkt.exe
4264	gEJLuEn.exe
4452	mWVPgtg.exe
1720	gdkLKfQ.exe
1428	RNdnMHE.exe
4136	qGCXIiz.exe
4624	PjPbEgR.exe
3868	wYlmLOv.exe
492	oVgDuYf.exe
2072	KxGYLJG.exe
536	cbWNxsO.exe
1768	cfUjAPb.exe
4904	eqVWMbF.exe
2168	yBLrSBa.exe
3432	GtloJzT.exe
2292	ciTFOkq.exe
1832	bMPpQTy.exe
2576	fMPUBNZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2196-0-0x00007FF63D340000-0x00007FF63D732000-memory.dmp	upx
behavioral2/files/0x0009000000023403-5.dat	upx
behavioral2/files/0x000700000002340b-7.dat	upx
behavioral2/files/0x0008000000023407-8.dat	upx
behavioral2/files/0x000700000002340e-33.dat	upx
behavioral2/files/0x000700000002340f-39.dat	upx
behavioral2/files/0x0007000000023410-65.dat	upx
behavioral2/files/0x0007000000023412-73.dat	upx
behavioral2/memory/2420-81-0x00007FF72A0F0000-0x00007FF72A4E2000-memory.dmp	upx
behavioral2/memory/1456-86-0x00007FF7DC780000-0x00007FF7DCB72000-memory.dmp	upx
behavioral2/files/0x0008000000023415-92.dat	upx
behavioral2/files/0x0008000000023414-101.dat	upx
behavioral2/memory/4428-112-0x00007FF686DE0000-0x00007FF6871D2000-memory.dmp	upx
behavioral2/files/0x000700000002341f-149.dat	upx
behavioral2/files/0x0007000000023425-173.dat	upx
behavioral2/files/0x0007000000023428-188.dat	upx
behavioral2/memory/3364-440-0x00007FF671BB0000-0x00007FF671FA2000-memory.dmp	upx
behavioral2/memory/3964-441-0x00007FF62DAD0000-0x00007FF62DEC2000-memory.dmp	upx
behavioral2/memory/4140-442-0x00007FF74EDF0000-0x00007FF74F1E2000-memory.dmp	upx
behavioral2/memory/4724-443-0x00007FF7CD580000-0x00007FF7CD972000-memory.dmp	upx
behavioral2/memory/2684-444-0x00007FF6658C0000-0x00007FF665CB2000-memory.dmp	upx
behavioral2/memory/2908-445-0x00007FF76FF10000-0x00007FF770302000-memory.dmp	upx
behavioral2/memory/1752-446-0x00007FF6F5D90000-0x00007FF6F6182000-memory.dmp	upx
behavioral2/memory/2172-462-0x00007FF6F2350000-0x00007FF6F2742000-memory.dmp	upx
behavioral2/files/0x0007000000023426-186.dat	upx
behavioral2/files/0x0007000000023427-183.dat	upx
behavioral2/files/0x0007000000023424-176.dat	upx
behavioral2/files/0x0007000000023423-171.dat	upx
behavioral2/files/0x0007000000023422-164.dat	upx
behavioral2/files/0x0007000000023421-159.dat	upx
behavioral2/files/0x0007000000023420-153.dat	upx
behavioral2/files/0x000700000002341e-144.dat	upx
behavioral2/files/0x000700000002341d-138.dat	upx
behavioral2/files/0x000700000002341c-134.dat	upx
behavioral2/files/0x000700000002341b-129.dat	upx
behavioral2/files/0x000700000002341a-121.dat	upx
behavioral2/files/0x0008000000023408-119.dat	upx
behavioral2/files/0x0007000000023419-117.dat	upx
behavioral2/files/0x0007000000023418-105.dat	upx
behavioral2/memory/5092-104-0x00007FF7562E0000-0x00007FF7566D2000-memory.dmp	upx
behavioral2/memory/3912-100-0x00007FF68FBB0000-0x00007FF68FFA2000-memory.dmp	upx
behavioral2/memory/1704-99-0x00007FF7AAED0000-0x00007FF7AB2C2000-memory.dmp	upx
behavioral2/files/0x0007000000023417-94.dat	upx
behavioral2/memory/4404-90-0x00007FF6EBF20000-0x00007FF6EC312000-memory.dmp	upx
behavioral2/memory/2736-89-0x00007FF6E87C0000-0x00007FF6E8BB2000-memory.dmp	upx
behavioral2/files/0x0007000000023416-78.dat	upx
behavioral2/files/0x0007000000023413-76.dat	upx
behavioral2/memory/1460-52-0x00007FF670740000-0x00007FF670B32000-memory.dmp	upx
behavioral2/memory/2012-51-0x00007FF759B00000-0x00007FF759EF2000-memory.dmp	upx
behavioral2/files/0x000700000002340c-44.dat	upx
behavioral2/files/0x0007000000023411-43.dat	upx
behavioral2/memory/3076-41-0x00007FF60C790000-0x00007FF60CB82000-memory.dmp	upx
behavioral2/files/0x000700000002340d-46.dat	upx
behavioral2/memory/1872-30-0x00007FF703CE0000-0x00007FF7040D2000-memory.dmp	upx
behavioral2/memory/2268-24-0x00007FF7E3FF0000-0x00007FF7E43E2000-memory.dmp	upx
behavioral2/memory/2012-1975-0x00007FF759B00000-0x00007FF759EF2000-memory.dmp	upx
behavioral2/memory/1460-1977-0x00007FF670740000-0x00007FF670B32000-memory.dmp	upx
behavioral2/memory/2268-2023-0x00007FF7E3FF0000-0x00007FF7E43E2000-memory.dmp	upx
behavioral2/memory/1872-2025-0x00007FF703CE0000-0x00007FF7040D2000-memory.dmp	upx
behavioral2/memory/1456-2047-0x00007FF7DC780000-0x00007FF7DCB72000-memory.dmp	upx
behavioral2/memory/3076-2049-0x00007FF60C790000-0x00007FF60CB82000-memory.dmp	upx
behavioral2/memory/1460-2060-0x00007FF670740000-0x00007FF670B32000-memory.dmp	upx
behavioral2/memory/2736-2061-0x00007FF6E87C0000-0x00007FF6E8BB2000-memory.dmp	upx
behavioral2/memory/1704-2063-0x00007FF7AAED0000-0x00007FF7AB2C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FtoxLAi.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\loMlAQu.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\ttCDnWL.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\vdUFuYb.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\MwUYZzG.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\oVgDuYf.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\akncxFH.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\mIbOThL.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\vdiPQiJ.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\EhzZRBl.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\HWyEJCJ.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\WcZCBzZ.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\fkaWwub.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\zfWigty.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\hqBUNlX.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\wFjRRrR.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\cqMhSmD.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\MdQDxXO.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\VUZanEZ.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\UJwFsao.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\yOHPIOV.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\AJVGCvm.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\fOGfmns.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\JanLJws.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\FyygnZS.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\XxtwLuF.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\QXYZGBR.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\KUTBerv.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\vPpWRvS.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\qkdzXnE.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\hSXpydl.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\iSZdNLP.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\XBtbCop.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\zFQjaro.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\bQzpseB.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\fRVkYcH.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\epErSQD.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\ExVMJqf.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\VbmzYAW.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\SPmzEDy.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\ymkHTpb.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\wRUHUvv.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\ErgTxNG.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\XNoMdGG.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\slRkrrJ.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\IoioQyv.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\hEKNIhy.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\qNJORjr.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\XmhSaYl.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\cfUjAPb.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\eNXIGnQ.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\XWWbaWy.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\pwtdVCF.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\PeFsjAb.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\gEJLuEn.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\jqYYAyI.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\vuCZUIq.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\OBUiZeV.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\kXfJIHb.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\eGrpHEV.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\YjnWZZH.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\eVTYseq.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\EfOvHRs.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\oURrPcg.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3116	powershell.exe
3116	powershell.exe
3116	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
Token: SeDebugPrivilege	3116	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 3116	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	85
PID 2196 wrote to memory of 3116	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	85
PID 2196 wrote to memory of 2268	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	86
PID 2196 wrote to memory of 2268	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	86
PID 2196 wrote to memory of 1872	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	87
PID 2196 wrote to memory of 1872	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	87
PID 2196 wrote to memory of 3076	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	88
PID 2196 wrote to memory of 3076	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	88
PID 2196 wrote to memory of 2420	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	89
PID 2196 wrote to memory of 2420	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	89
PID 2196 wrote to memory of 2012	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	90
PID 2196 wrote to memory of 2012	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	90
PID 2196 wrote to memory of 1456	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	91
PID 2196 wrote to memory of 1456	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	91
PID 2196 wrote to memory of 2736	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	92
PID 2196 wrote to memory of 2736	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	92
PID 2196 wrote to memory of 1460	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	93
PID 2196 wrote to memory of 1460	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	93
PID 2196 wrote to memory of 4404	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	94
PID 2196 wrote to memory of 4404	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	94
PID 2196 wrote to memory of 4428	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	95
PID 2196 wrote to memory of 4428	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	95
PID 2196 wrote to memory of 1704	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	96
PID 2196 wrote to memory of 1704	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	96
PID 2196 wrote to memory of 3912	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	97
PID 2196 wrote to memory of 3912	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	97
PID 2196 wrote to memory of 3364	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	98
PID 2196 wrote to memory of 3364	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	98
PID 2196 wrote to memory of 5092	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	99
PID 2196 wrote to memory of 5092	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	99
PID 2196 wrote to memory of 3964	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	100
PID 2196 wrote to memory of 3964	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	100
PID 2196 wrote to memory of 4140	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	101
PID 2196 wrote to memory of 4140	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	101
PID 2196 wrote to memory of 1752	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	102
PID 2196 wrote to memory of 1752	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	102
PID 2196 wrote to memory of 2172	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	103
PID 2196 wrote to memory of 2172	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	103
PID 2196 wrote to memory of 4724	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	104
PID 2196 wrote to memory of 4724	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	104
PID 2196 wrote to memory of 2684	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	105
PID 2196 wrote to memory of 2684	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	105
PID 2196 wrote to memory of 2908	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	106
PID 2196 wrote to memory of 2908	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	106
PID 2196 wrote to memory of 1096	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	107
PID 2196 wrote to memory of 1096	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	107
PID 2196 wrote to memory of 4520	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	108
PID 2196 wrote to memory of 4520	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	108
PID 2196 wrote to memory of 4620	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	109
PID 2196 wrote to memory of 4620	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	109
PID 2196 wrote to memory of 1340	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	110
PID 2196 wrote to memory of 1340	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	110
PID 2196 wrote to memory of 4792	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	111
PID 2196 wrote to memory of 4792	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	111
PID 2196 wrote to memory of 1668	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	112
PID 2196 wrote to memory of 1668	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	112
PID 2196 wrote to memory of 884	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	113
PID 2196 wrote to memory of 884	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	113
PID 2196 wrote to memory of 1860	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	114
PID 2196 wrote to memory of 1860	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	114
PID 2196 wrote to memory of 2044	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	115
PID 2196 wrote to memory of 2044	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	115
PID 2196 wrote to memory of 3908	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	116
PID 2196 wrote to memory of 3908	2196	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3116" "2960" "2900" "2964" "0" "0" "2968" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:1244
- C:\Windows\System\SWTjjCa.exe
  C:\Windows\System\SWTjjCa.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\YjyXnEl.exe
  C:\Windows\System\YjyXnEl.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\vnNpOAh.exe
  C:\Windows\System\vnNpOAh.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\pXYrkRz.exe
  C:\Windows\System\pXYrkRz.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\nGwslMr.exe
  C:\Windows\System\nGwslMr.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\uUCCbHc.exe
  C:\Windows\System\uUCCbHc.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\DqPDkuf.exe
  C:\Windows\System\DqPDkuf.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\xEEUVyi.exe
  C:\Windows\System\xEEUVyi.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\VsLrfnN.exe
  C:\Windows\System\VsLrfnN.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\sPbSZKL.exe
  C:\Windows\System\sPbSZKL.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\OjIduWy.exe
  C:\Windows\System\OjIduWy.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\uYFevza.exe
  C:\Windows\System\uYFevza.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\eVTYseq.exe
  C:\Windows\System\eVTYseq.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\WSojszE.exe
  C:\Windows\System\WSojszE.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\guIGEaq.exe
  C:\Windows\System\guIGEaq.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\VbmzYAW.exe
  C:\Windows\System\VbmzYAW.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\PeFsjAb.exe
  C:\Windows\System\PeFsjAb.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\tvWVTxu.exe
  C:\Windows\System\tvWVTxu.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\xjahjsk.exe
  C:\Windows\System\xjahjsk.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\zPFvWvv.exe
  C:\Windows\System\zPFvWvv.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\dmblteZ.exe
  C:\Windows\System\dmblteZ.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\inmFKtN.exe
  C:\Windows\System\inmFKtN.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\raGfWHg.exe
  C:\Windows\System\raGfWHg.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\lWuienA.exe
  C:\Windows\System\lWuienA.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\FONjGRp.exe
  C:\Windows\System\FONjGRp.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\bDinfTT.exe
  C:\Windows\System\bDinfTT.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\BqEEWGG.exe
  C:\Windows\System\BqEEWGG.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\sGMxAok.exe
  C:\Windows\System\sGMxAok.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\soIFGtZ.exe
  C:\Windows\System\soIFGtZ.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\rPYjrHw.exe
  C:\Windows\System\rPYjrHw.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\bIrnvFb.exe
  C:\Windows\System\bIrnvFb.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\jUGntmG.exe
  C:\Windows\System\jUGntmG.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\lVleAnj.exe
  C:\Windows\System\lVleAnj.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\PlYEWGB.exe
  C:\Windows\System\PlYEWGB.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\OoohGKT.exe
  C:\Windows\System\OoohGKT.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\EwCiUCf.exe
  C:\Windows\System\EwCiUCf.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\vMnCvTb.exe
  C:\Windows\System\vMnCvTb.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\RIDLhUL.exe
  C:\Windows\System\RIDLhUL.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\uMCeayA.exe
  C:\Windows\System\uMCeayA.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\mDtVZxH.exe
  C:\Windows\System\mDtVZxH.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\rKiXlDO.exe
  C:\Windows\System\rKiXlDO.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\gYRWpEo.exe
  C:\Windows\System\gYRWpEo.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\iwZHHJG.exe
  C:\Windows\System\iwZHHJG.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\DIqRZxc.exe
  C:\Windows\System\DIqRZxc.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\saEmzoS.exe
  C:\Windows\System\saEmzoS.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\dzwUYkk.exe
  C:\Windows\System\dzwUYkk.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\YtycJkt.exe
  C:\Windows\System\YtycJkt.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\gEJLuEn.exe
  C:\Windows\System\gEJLuEn.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\mWVPgtg.exe
  C:\Windows\System\mWVPgtg.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\gdkLKfQ.exe
  C:\Windows\System\gdkLKfQ.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\RNdnMHE.exe
  C:\Windows\System\RNdnMHE.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\qGCXIiz.exe
  C:\Windows\System\qGCXIiz.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\PjPbEgR.exe
  C:\Windows\System\PjPbEgR.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\wYlmLOv.exe
  C:\Windows\System\wYlmLOv.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\oVgDuYf.exe
  C:\Windows\System\oVgDuYf.exe
  2⤵
  - Executes dropped EXE
  PID:492
- C:\Windows\System\KxGYLJG.exe
  C:\Windows\System\KxGYLJG.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\cbWNxsO.exe
  C:\Windows\System\cbWNxsO.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\cfUjAPb.exe
  C:\Windows\System\cfUjAPb.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\eqVWMbF.exe
  C:\Windows\System\eqVWMbF.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\yBLrSBa.exe
  C:\Windows\System\yBLrSBa.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\GtloJzT.exe
  C:\Windows\System\GtloJzT.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\ciTFOkq.exe
  C:\Windows\System\ciTFOkq.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\bMPpQTy.exe
  C:\Windows\System\bMPpQTy.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\fMPUBNZ.exe
  C:\Windows\System\fMPUBNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\QXYZGBR.exe
  C:\Windows\System\QXYZGBR.exe
  2⤵
  PID:368
- C:\Windows\System\bnjcCgy.exe
  C:\Windows\System\bnjcCgy.exe
  2⤵
  PID:1332
- C:\Windows\System\uajsLlV.exe
  C:\Windows\System\uajsLlV.exe
  2⤵
  PID:4940
- C:\Windows\System\qPcKGxz.exe
  C:\Windows\System\qPcKGxz.exe
  2⤵
  PID:4276
- C:\Windows\System\EhhJpeo.exe
  C:\Windows\System\EhhJpeo.exe
  2⤵
  PID:2164
- C:\Windows\System\DigJzSq.exe
  C:\Windows\System\DigJzSq.exe
  2⤵
  PID:2964
- C:\Windows\System\MXYBYPk.exe
  C:\Windows\System\MXYBYPk.exe
  2⤵
  PID:3856
- C:\Windows\System\lFrHBxd.exe
  C:\Windows\System\lFrHBxd.exe
  2⤵
  PID:4684
- C:\Windows\System\zHehKGl.exe
  C:\Windows\System\zHehKGl.exe
  2⤵
  PID:4828
- C:\Windows\System\Kkprbqz.exe
  C:\Windows\System\Kkprbqz.exe
  2⤵
  PID:3464
- C:\Windows\System\eSxnsWz.exe
  C:\Windows\System\eSxnsWz.exe
  2⤵
  PID:5144
- C:\Windows\System\AlWoPEh.exe
  C:\Windows\System\AlWoPEh.exe
  2⤵
  PID:5172
- C:\Windows\System\IoioQyv.exe
  C:\Windows\System\IoioQyv.exe
  2⤵
  PID:5200
- C:\Windows\System\ZcEAqzy.exe
  C:\Windows\System\ZcEAqzy.exe
  2⤵
  PID:5228
- C:\Windows\System\DsutZeq.exe
  C:\Windows\System\DsutZeq.exe
  2⤵
  PID:5256
- C:\Windows\System\EfOvHRs.exe
  C:\Windows\System\EfOvHRs.exe
  2⤵
  PID:5284
- C:\Windows\System\DLfVUhb.exe
  C:\Windows\System\DLfVUhb.exe
  2⤵
  PID:5312
- C:\Windows\System\mVwDQex.exe
  C:\Windows\System\mVwDQex.exe
  2⤵
  PID:5340
- C:\Windows\System\sHLHNkv.exe
  C:\Windows\System\sHLHNkv.exe
  2⤵
  PID:5368
- C:\Windows\System\XBwDUsy.exe
  C:\Windows\System\XBwDUsy.exe
  2⤵
  PID:5396
- C:\Windows\System\HmFGeXz.exe
  C:\Windows\System\HmFGeXz.exe
  2⤵
  PID:5424
- C:\Windows\System\cNVGIfc.exe
  C:\Windows\System\cNVGIfc.exe
  2⤵
  PID:5452
- C:\Windows\System\esgtVfr.exe
  C:\Windows\System\esgtVfr.exe
  2⤵
  PID:5480
- C:\Windows\System\rJKdQrh.exe
  C:\Windows\System\rJKdQrh.exe
  2⤵
  PID:5508
- C:\Windows\System\SByHYXP.exe
  C:\Windows\System\SByHYXP.exe
  2⤵
  PID:5540
- C:\Windows\System\EkmORND.exe
  C:\Windows\System\EkmORND.exe
  2⤵
  PID:5568
- C:\Windows\System\kYbcVdV.exe
  C:\Windows\System\kYbcVdV.exe
  2⤵
  PID:5596
- C:\Windows\System\Jsyyihl.exe
  C:\Windows\System\Jsyyihl.exe
  2⤵
  PID:5624
- C:\Windows\System\UJwFsao.exe
  C:\Windows\System\UJwFsao.exe
  2⤵
  PID:5652
- C:\Windows\System\gmlfhaE.exe
  C:\Windows\System\gmlfhaE.exe
  2⤵
  PID:5680
- C:\Windows\System\bymkjXk.exe
  C:\Windows\System\bymkjXk.exe
  2⤵
  PID:5708
- C:\Windows\System\XpeTOHg.exe
  C:\Windows\System\XpeTOHg.exe
  2⤵
  PID:5736
- C:\Windows\System\MfBKhMm.exe
  C:\Windows\System\MfBKhMm.exe
  2⤵
  PID:5764
- C:\Windows\System\rLZUvij.exe
  C:\Windows\System\rLZUvij.exe
  2⤵
  PID:5792
- C:\Windows\System\fOGfmns.exe
  C:\Windows\System\fOGfmns.exe
  2⤵
  PID:5820
- C:\Windows\System\yKmYsJM.exe
  C:\Windows\System\yKmYsJM.exe
  2⤵
  PID:5852
- C:\Windows\System\ljecTvo.exe
  C:\Windows\System\ljecTvo.exe
  2⤵
  PID:5880
- C:\Windows\System\yDEYaCF.exe
  C:\Windows\System\yDEYaCF.exe
  2⤵
  PID:5912
- C:\Windows\System\pFkYijz.exe
  C:\Windows\System\pFkYijz.exe
  2⤵
  PID:5940
- C:\Windows\System\fiMnckr.exe
  C:\Windows\System\fiMnckr.exe
  2⤵
  PID:5972
- C:\Windows\System\ILTMEnU.exe
  C:\Windows\System\ILTMEnU.exe
  2⤵
  PID:6000
- C:\Windows\System\yaSIUZc.exe
  C:\Windows\System\yaSIUZc.exe
  2⤵
  PID:6032
- C:\Windows\System\yEwDuja.exe
  C:\Windows\System\yEwDuja.exe
  2⤵
  PID:6056
- C:\Windows\System\EpondfV.exe
  C:\Windows\System\EpondfV.exe
  2⤵
  PID:6084
- C:\Windows\System\EbkpyEZ.exe
  C:\Windows\System\EbkpyEZ.exe
  2⤵
  PID:6112
- C:\Windows\System\LwkVGEd.exe
  C:\Windows\System\LwkVGEd.exe
  2⤵
  PID:6140
- C:\Windows\System\bQzpseB.exe
  C:\Windows\System\bQzpseB.exe
  2⤵
  PID:2320
- C:\Windows\System\GorUfTk.exe
  C:\Windows\System\GorUfTk.exe
  2⤵
  PID:4688
- C:\Windows\System\ToWGfgo.exe
  C:\Windows\System\ToWGfgo.exe
  2⤵
  PID:5076
- C:\Windows\System\aWaoufk.exe
  C:\Windows\System\aWaoufk.exe
  2⤵
  PID:5132
- C:\Windows\System\GzzQlud.exe
  C:\Windows\System\GzzQlud.exe
  2⤵
  PID:5188
- C:\Windows\System\vNAtEpO.exe
  C:\Windows\System\vNAtEpO.exe
  2⤵
  PID:5240
- C:\Windows\System\KUTBerv.exe
  C:\Windows\System\KUTBerv.exe
  2⤵
  PID:4960
- C:\Windows\System\HyqiTnn.exe
  C:\Windows\System\HyqiTnn.exe
  2⤵
  PID:5440
- C:\Windows\System\CnwUllg.exe
  C:\Windows\System\CnwUllg.exe
  2⤵
  PID:1268
- C:\Windows\System\VGWDINI.exe
  C:\Windows\System\VGWDINI.exe
  2⤵
  PID:5584
- C:\Windows\System\jyJxeDn.exe
  C:\Windows\System\jyJxeDn.exe
  2⤵
  PID:5616
- C:\Windows\System\xATjqDu.exe
  C:\Windows\System\xATjqDu.exe
  2⤵
  PID:5668
- C:\Windows\System\JtybvPL.exe
  C:\Windows\System\JtybvPL.exe
  2⤵
  PID:5720
- C:\Windows\System\lfKMEOx.exe
  C:\Windows\System\lfKMEOx.exe
  2⤵
  PID:5752
- C:\Windows\System\sMVPWrn.exe
  C:\Windows\System\sMVPWrn.exe
  2⤵
  PID:5812
- C:\Windows\System\UcmxDIZ.exe
  C:\Windows\System\UcmxDIZ.exe
  2⤵
  PID:3572
- C:\Windows\System\DHxoenT.exe
  C:\Windows\System\DHxoenT.exe
  2⤵
  PID:5992
- C:\Windows\System\KGFhXQv.exe
  C:\Windows\System\KGFhXQv.exe
  2⤵
  PID:6040
- C:\Windows\System\JGfklFo.exe
  C:\Windows\System\JGfklFo.exe
  2⤵
  PID:6100
- C:\Windows\System\NhgDOTB.exe
  C:\Windows\System\NhgDOTB.exe
  2⤵
  PID:1604
- C:\Windows\System\BqCFKxv.exe
  C:\Windows\System\BqCFKxv.exe
  2⤵
  PID:532
- C:\Windows\System\JPjSAvE.exe
  C:\Windows\System\JPjSAvE.exe
  2⤵
  PID:4524
- C:\Windows\System\eNXIGnQ.exe
  C:\Windows\System\eNXIGnQ.exe
  2⤵
  PID:3056
- C:\Windows\System\yqoJyEJ.exe
  C:\Windows\System\yqoJyEJ.exe
  2⤵
  PID:5268
- C:\Windows\System\ShzrMAd.exe
  C:\Windows\System\ShzrMAd.exe
  2⤵
  PID:5352
- C:\Windows\System\IHLdPgv.exe
  C:\Windows\System\IHLdPgv.exe
  2⤵
  PID:4416
- C:\Windows\System\WcZCBzZ.exe
  C:\Windows\System\WcZCBzZ.exe
  2⤵
  PID:4040
- C:\Windows\System\ICcanuW.exe
  C:\Windows\System\ICcanuW.exe
  2⤵
  PID:1548
- C:\Windows\System\ijmAFGm.exe
  C:\Windows\System\ijmAFGm.exe
  2⤵
  PID:2580
- C:\Windows\System\IWJeSmA.exe
  C:\Windows\System\IWJeSmA.exe
  2⤵
  PID:576
- C:\Windows\System\RvVVVmX.exe
  C:\Windows\System\RvVVVmX.exe
  2⤵
  PID:4092
- C:\Windows\System\WtOhdIp.exe
  C:\Windows\System\WtOhdIp.exe
  2⤵
  PID:4908
- C:\Windows\System\rYmsCmK.exe
  C:\Windows\System\rYmsCmK.exe
  2⤵
  PID:5436
- C:\Windows\System\mvmmIWd.exe
  C:\Windows\System\mvmmIWd.exe
  2⤵
  PID:5556
- C:\Windows\System\RSrRpvo.exe
  C:\Windows\System\RSrRpvo.exe
  2⤵
  PID:5612
- C:\Windows\System\CheGPCO.exe
  C:\Windows\System\CheGPCO.exe
  2⤵
  PID:5748
- C:\Windows\System\KvBikGV.exe
  C:\Windows\System\KvBikGV.exe
  2⤵
  PID:5956
- C:\Windows\System\NDxHKCN.exe
  C:\Windows\System\NDxHKCN.exe
  2⤵
  PID:3884
- C:\Windows\System\iDXwxgY.exe
  C:\Windows\System\iDXwxgY.exe
  2⤵
  PID:1756
- C:\Windows\System\ktJoVCn.exe
  C:\Windows\System\ktJoVCn.exe
  2⤵
  PID:4108
- C:\Windows\System\XCZGjEa.exe
  C:\Windows\System\XCZGjEa.exe
  2⤵
  PID:1056
- C:\Windows\System\UFKTRyA.exe
  C:\Windows\System\UFKTRyA.exe
  2⤵
  PID:2912
- C:\Windows\System\UQOzRbe.exe
  C:\Windows\System\UQOzRbe.exe
  2⤵
  PID:1888
- C:\Windows\System\lNrXcLc.exe
  C:\Windows\System\lNrXcLc.exe
  2⤵
  PID:2828
- C:\Windows\System\fkaWwub.exe
  C:\Windows\System\fkaWwub.exe
  2⤵
  PID:2316
- C:\Windows\System\vazcYGb.exe
  C:\Windows\System\vazcYGb.exe
  2⤵
  PID:3064
- C:\Windows\System\LPVPsWN.exe
  C:\Windows\System\LPVPsWN.exe
  2⤵
  PID:2288
- C:\Windows\System\AMpfOaN.exe
  C:\Windows\System\AMpfOaN.exe
  2⤵
  PID:4796
- C:\Windows\System\oiDdqRG.exe
  C:\Windows\System\oiDdqRG.exe
  2⤵
  PID:3384
- C:\Windows\System\OzrJEHS.exe
  C:\Windows\System\OzrJEHS.exe
  2⤵
  PID:708
- C:\Windows\System\JcoTOaq.exe
  C:\Windows\System\JcoTOaq.exe
  2⤵
  PID:6148
- C:\Windows\System\rnHeehc.exe
  C:\Windows\System\rnHeehc.exe
  2⤵
  PID:6164
- C:\Windows\System\YwpbArr.exe
  C:\Windows\System\YwpbArr.exe
  2⤵
  PID:6184
- C:\Windows\System\FDEOoVM.exe
  C:\Windows\System\FDEOoVM.exe
  2⤵
  PID:6204
- C:\Windows\System\akncxFH.exe
  C:\Windows\System\akncxFH.exe
  2⤵
  PID:6224
- C:\Windows\System\BtXCgCE.exe
  C:\Windows\System\BtXCgCE.exe
  2⤵
  PID:6248
- C:\Windows\System\LOxGSOq.exe
  C:\Windows\System\LOxGSOq.exe
  2⤵
  PID:6268
- C:\Windows\System\UXgwNae.exe
  C:\Windows\System\UXgwNae.exe
  2⤵
  PID:6296
- C:\Windows\System\mIbOThL.exe
  C:\Windows\System\mIbOThL.exe
  2⤵
  PID:6348
- C:\Windows\System\rZftxSC.exe
  C:\Windows\System\rZftxSC.exe
  2⤵
  PID:6380
- C:\Windows\System\KJbETkZ.exe
  C:\Windows\System\KJbETkZ.exe
  2⤵
  PID:6400
- C:\Windows\System\zBVBwlj.exe
  C:\Windows\System\zBVBwlj.exe
  2⤵
  PID:6420
- C:\Windows\System\nJAVeTe.exe
  C:\Windows\System\nJAVeTe.exe
  2⤵
  PID:6484
- C:\Windows\System\ylMnwGi.exe
  C:\Windows\System\ylMnwGi.exe
  2⤵
  PID:6500
- C:\Windows\System\MCjWrui.exe
  C:\Windows\System\MCjWrui.exe
  2⤵
  PID:6532
- C:\Windows\System\IhuklNI.exe
  C:\Windows\System\IhuklNI.exe
  2⤵
  PID:6556
- C:\Windows\System\tNFAyBx.exe
  C:\Windows\System\tNFAyBx.exe
  2⤵
  PID:6572
- C:\Windows\System\YchKfjP.exe
  C:\Windows\System\YchKfjP.exe
  2⤵
  PID:6596
- C:\Windows\System\SWFrXJE.exe
  C:\Windows\System\SWFrXJE.exe
  2⤵
  PID:6624
- C:\Windows\System\ywczEiW.exe
  C:\Windows\System\ywczEiW.exe
  2⤵
  PID:6648
- C:\Windows\System\EyjJZBL.exe
  C:\Windows\System\EyjJZBL.exe
  2⤵
  PID:6672
- C:\Windows\System\PYaVOZH.exe
  C:\Windows\System\PYaVOZH.exe
  2⤵
  PID:6748
- C:\Windows\System\NpHKPWW.exe
  C:\Windows\System\NpHKPWW.exe
  2⤵
  PID:6768
- C:\Windows\System\EtDYbEI.exe
  C:\Windows\System\EtDYbEI.exe
  2⤵
  PID:6788
- C:\Windows\System\sziZQAY.exe
  C:\Windows\System\sziZQAY.exe
  2⤵
  PID:6808
- C:\Windows\System\RKKBzNz.exe
  C:\Windows\System\RKKBzNz.exe
  2⤵
  PID:6836
- C:\Windows\System\XZPuUut.exe
  C:\Windows\System\XZPuUut.exe
  2⤵
  PID:6852
- C:\Windows\System\WEEFOIF.exe
  C:\Windows\System\WEEFOIF.exe
  2⤵
  PID:6880
- C:\Windows\System\SlOMtnO.exe
  C:\Windows\System\SlOMtnO.exe
  2⤵
  PID:6904
- C:\Windows\System\CenVQJw.exe
  C:\Windows\System\CenVQJw.exe
  2⤵
  PID:6944
- C:\Windows\System\SddPXdl.exe
  C:\Windows\System\SddPXdl.exe
  2⤵
  PID:6972
- C:\Windows\System\JYrQyZs.exe
  C:\Windows\System\JYrQyZs.exe
  2⤵
  PID:6992
- C:\Windows\System\LNZLUxY.exe
  C:\Windows\System\LNZLUxY.exe
  2⤵
  PID:7032
- C:\Windows\System\CHWMgWU.exe
  C:\Windows\System\CHWMgWU.exe
  2⤵
  PID:7064
- C:\Windows\System\LPxkjwU.exe
  C:\Windows\System\LPxkjwU.exe
  2⤵
  PID:7108
- C:\Windows\System\lakSllt.exe
  C:\Windows\System\lakSllt.exe
  2⤵
  PID:7132
- C:\Windows\System\vPpWRvS.exe
  C:\Windows\System\vPpWRvS.exe
  2⤵
  PID:7160
- C:\Windows\System\eSKQmqA.exe
  C:\Windows\System\eSKQmqA.exe
  2⤵
  PID:4924
- C:\Windows\System\alRpPLv.exe
  C:\Windows\System\alRpPLv.exe
  2⤵
  PID:6240
- C:\Windows\System\XuvoWyL.exe
  C:\Windows\System\XuvoWyL.exe
  2⤵
  PID:6292
- C:\Windows\System\MZWzjNK.exe
  C:\Windows\System\MZWzjNK.exe
  2⤵
  PID:6360
- C:\Windows\System\JanLJws.exe
  C:\Windows\System\JanLJws.exe
  2⤵
  PID:6392
- C:\Windows\System\qIwTeRA.exe
  C:\Windows\System\qIwTeRA.exe
  2⤵
  PID:6508
- C:\Windows\System\BaDohdM.exe
  C:\Windows\System\BaDohdM.exe
  2⤵
  PID:6584
- C:\Windows\System\mQGtxEu.exe
  C:\Windows\System\mQGtxEu.exe
  2⤵
  PID:6612
- C:\Windows\System\YNbGems.exe
  C:\Windows\System\YNbGems.exe
  2⤵
  PID:6696
- C:\Windows\System\oURrPcg.exe
  C:\Windows\System\oURrPcg.exe
  2⤵
  PID:6720
- C:\Windows\System\wJfvjho.exe
  C:\Windows\System\wJfvjho.exe
  2⤵
  PID:6804
- C:\Windows\System\oxZWOCl.exe
  C:\Windows\System\oxZWOCl.exe
  2⤵
  PID:6860
- C:\Windows\System\FyygnZS.exe
  C:\Windows\System\FyygnZS.exe
  2⤵
  PID:6920
- C:\Windows\System\NULQlcB.exe
  C:\Windows\System\NULQlcB.exe
  2⤵
  PID:7016
- C:\Windows\System\lLxXoZe.exe
  C:\Windows\System\lLxXoZe.exe
  2⤵
  PID:7076
- C:\Windows\System\kylxZsT.exe
  C:\Windows\System\kylxZsT.exe
  2⤵
  PID:7124
- C:\Windows\System\tYdRibo.exe
  C:\Windows\System\tYdRibo.exe
  2⤵
  PID:6180
- C:\Windows\System\trdzhie.exe
  C:\Windows\System\trdzhie.exe
  2⤵
  PID:6236
- C:\Windows\System\YfzTaBG.exe
  C:\Windows\System\YfzTaBG.exe
  2⤵
  PID:6540
- C:\Windows\System\ABVoiUJ.exe
  C:\Windows\System\ABVoiUJ.exe
  2⤵
  PID:6636
- C:\Windows\System\FMBJRPp.exe
  C:\Windows\System\FMBJRPp.exe
  2⤵
  PID:6868
- C:\Windows\System\GJqDxrc.exe
  C:\Windows\System\GJqDxrc.exe
  2⤵
  PID:7004
- C:\Windows\System\iKaJOoZ.exe
  C:\Windows\System\iKaJOoZ.exe
  2⤵
  PID:7060
- C:\Windows\System\XWWbaWy.exe
  C:\Windows\System\XWWbaWy.exe
  2⤵
  PID:6232
- C:\Windows\System\VNEkTzK.exe
  C:\Windows\System\VNEkTzK.exe
  2⤵
  PID:6692
- C:\Windows\System\TODqRhV.exe
  C:\Windows\System\TODqRhV.exe
  2⤵
  PID:6728
- C:\Windows\System\pVYeoeB.exe
  C:\Windows\System\pVYeoeB.exe
  2⤵
  PID:6988
- C:\Windows\System\MFtvOei.exe
  C:\Windows\System\MFtvOei.exe
  2⤵
  PID:7116
- C:\Windows\System\joKKPrI.exe
  C:\Windows\System\joKKPrI.exe
  2⤵
  PID:7172
- C:\Windows\System\UsMtXRh.exe
  C:\Windows\System\UsMtXRh.exe
  2⤵
  PID:7196
- C:\Windows\System\CvsUQny.exe
  C:\Windows\System\CvsUQny.exe
  2⤵
  PID:7212
- C:\Windows\System\bKHKFbV.exe
  C:\Windows\System\bKHKFbV.exe
  2⤵
  PID:7236
- C:\Windows\System\OWZrIvn.exe
  C:\Windows\System\OWZrIvn.exe
  2⤵
  PID:7288
- C:\Windows\System\CxwxZhz.exe
  C:\Windows\System\CxwxZhz.exe
  2⤵
  PID:7316
- C:\Windows\System\MBsWnzL.exe
  C:\Windows\System\MBsWnzL.exe
  2⤵
  PID:7348
- C:\Windows\System\rEpbtzf.exe
  C:\Windows\System\rEpbtzf.exe
  2⤵
  PID:7380
- C:\Windows\System\NVtXLjg.exe
  C:\Windows\System\NVtXLjg.exe
  2⤵
  PID:7400
- C:\Windows\System\BfgMucy.exe
  C:\Windows\System\BfgMucy.exe
  2⤵
  PID:7440
- C:\Windows\System\DZkbiBt.exe
  C:\Windows\System\DZkbiBt.exe
  2⤵
  PID:7460
- C:\Windows\System\SYIkJtK.exe
  C:\Windows\System\SYIkJtK.exe
  2⤵
  PID:7488
- C:\Windows\System\oVuQqwY.exe
  C:\Windows\System\oVuQqwY.exe
  2⤵
  PID:7520
- C:\Windows\System\LfFziqY.exe
  C:\Windows\System\LfFziqY.exe
  2⤵
  PID:7552
- C:\Windows\System\KrdecqC.exe
  C:\Windows\System\KrdecqC.exe
  2⤵
  PID:7584
- C:\Windows\System\pdjbcWf.exe
  C:\Windows\System\pdjbcWf.exe
  2⤵
  PID:7624
- C:\Windows\System\FLhbCqg.exe
  C:\Windows\System\FLhbCqg.exe
  2⤵
  PID:7656
- C:\Windows\System\Omvzime.exe
  C:\Windows\System\Omvzime.exe
  2⤵
  PID:7688
- C:\Windows\System\yvrFPbz.exe
  C:\Windows\System\yvrFPbz.exe
  2⤵
  PID:7716
- C:\Windows\System\qpQCCDV.exe
  C:\Windows\System\qpQCCDV.exe
  2⤵
  PID:7744
- C:\Windows\System\xRBRhwz.exe
  C:\Windows\System\xRBRhwz.exe
  2⤵
  PID:7760
- C:\Windows\System\nFYPRZM.exe
  C:\Windows\System\nFYPRZM.exe
  2⤵
  PID:7796
- C:\Windows\System\yFwnvOv.exe
  C:\Windows\System\yFwnvOv.exe
  2⤵
  PID:7816
- C:\Windows\System\vMGyVdS.exe
  C:\Windows\System\vMGyVdS.exe
  2⤵
  PID:7848
- C:\Windows\System\NCmlsXn.exe
  C:\Windows\System\NCmlsXn.exe
  2⤵
  PID:7868
- C:\Windows\System\KDqMKxp.exe
  C:\Windows\System\KDqMKxp.exe
  2⤵
  PID:7896
- C:\Windows\System\YglLXHm.exe
  C:\Windows\System\YglLXHm.exe
  2⤵
  PID:7912
- C:\Windows\System\qOIrqyw.exe
  C:\Windows\System\qOIrqyw.exe
  2⤵
  PID:7964
- C:\Windows\System\GKDCdek.exe
  C:\Windows\System\GKDCdek.exe
  2⤵
  PID:7988
- C:\Windows\System\lWcnfXk.exe
  C:\Windows\System\lWcnfXk.exe
  2⤵
  PID:8008
- C:\Windows\System\cLPSbCn.exe
  C:\Windows\System\cLPSbCn.exe
  2⤵
  PID:8032
- C:\Windows\System\WPxBOPZ.exe
  C:\Windows\System\WPxBOPZ.exe
  2⤵
  PID:8052
- C:\Windows\System\ETJYXjZ.exe
  C:\Windows\System\ETJYXjZ.exe
  2⤵
  PID:8072
- C:\Windows\System\pikaBqf.exe
  C:\Windows\System\pikaBqf.exe
  2⤵
  PID:8116
- C:\Windows\System\bUIyLdr.exe
  C:\Windows\System\bUIyLdr.exe
  2⤵
  PID:8156
- C:\Windows\System\LFkFBWb.exe
  C:\Windows\System\LFkFBWb.exe
  2⤵
  PID:8176
- C:\Windows\System\PhAAoln.exe
  C:\Windows\System\PhAAoln.exe
  2⤵
  PID:7224
- C:\Windows\System\YEuISTa.exe
  C:\Windows\System\YEuISTa.exe
  2⤵
  PID:7204
- C:\Windows\System\JaXyPTq.exe
  C:\Windows\System\JaXyPTq.exe
  2⤵
  PID:7180
- C:\Windows\System\nAtldHg.exe
  C:\Windows\System\nAtldHg.exe
  2⤵
  PID:7260
- C:\Windows\System\yOHPIOV.exe
  C:\Windows\System\yOHPIOV.exe
  2⤵
  PID:7308
- C:\Windows\System\xnKsOzU.exe
  C:\Windows\System\xnKsOzU.exe
  2⤵
  PID:1876
- C:\Windows\System\sdLyPlN.exe
  C:\Windows\System\sdLyPlN.exe
  2⤵
  PID:7512
- C:\Windows\System\HSfXWub.exe
  C:\Windows\System\HSfXWub.exe
  2⤵
  PID:7636
- C:\Windows\System\cQCMYNc.exe
  C:\Windows\System\cQCMYNc.exe
  2⤵
  PID:7644
- C:\Windows\System\fbnqYLO.exe
  C:\Windows\System\fbnqYLO.exe
  2⤵
  PID:7736
- C:\Windows\System\SHcuPgW.exe
  C:\Windows\System\SHcuPgW.exe
  2⤵
  PID:7812
- C:\Windows\System\ZPDTmGz.exe
  C:\Windows\System\ZPDTmGz.exe
  2⤵
  PID:7920
- C:\Windows\System\kgGcMEZ.exe
  C:\Windows\System\kgGcMEZ.exe
  2⤵
  PID:7892
- C:\Windows\System\jDiMnmo.exe
  C:\Windows\System\jDiMnmo.exe
  2⤵
  PID:7972
- C:\Windows\System\KTjDBZP.exe
  C:\Windows\System\KTjDBZP.exe
  2⤵
  PID:8020
- C:\Windows\System\hOoEPad.exe
  C:\Windows\System\hOoEPad.exe
  2⤵
  PID:8096
- C:\Windows\System\kDDDvIk.exe
  C:\Windows\System\kDDDvIk.exe
  2⤵
  PID:2888
- C:\Windows\System\BzfBnmP.exe
  C:\Windows\System\BzfBnmP.exe
  2⤵
  PID:8168
- C:\Windows\System\BNJltvS.exe
  C:\Windows\System\BNJltvS.exe
  2⤵
  PID:5408
- C:\Windows\System\ppKEXCV.exe
  C:\Windows\System\ppKEXCV.exe
  2⤵
  PID:7396
- C:\Windows\System\JILuMqU.exe
  C:\Windows\System\JILuMqU.exe
  2⤵
  PID:7572
- C:\Windows\System\kXfJIHb.exe
  C:\Windows\System\kXfJIHb.exe
  2⤵
  PID:7704
- C:\Windows\System\fqkKjso.exe
  C:\Windows\System\fqkKjso.exe
  2⤵
  PID:7828
- C:\Windows\System\VWUVJIY.exe
  C:\Windows\System\VWUVJIY.exe
  2⤵
  PID:7908
- C:\Windows\System\XxtwLuF.exe
  C:\Windows\System\XxtwLuF.exe
  2⤵
  PID:8184
- C:\Windows\System\whdoTTE.exe
  C:\Windows\System\whdoTTE.exe
  2⤵
  PID:7388
- C:\Windows\System\fhtImok.exe
  C:\Windows\System\fhtImok.exe
  2⤵
  PID:7612
- C:\Windows\System\EodIWqj.exe
  C:\Windows\System\EodIWqj.exe
  2⤵
  PID:6776
- C:\Windows\System\ezdxZku.exe
  C:\Windows\System\ezdxZku.exe
  2⤵
  PID:7540
- C:\Windows\System\AhwqkPy.exe
  C:\Windows\System\AhwqkPy.exe
  2⤵
  PID:8048
- C:\Windows\System\dnzerlg.exe
  C:\Windows\System\dnzerlg.exe
  2⤵
  PID:8216
- C:\Windows\System\AJVGCvm.exe
  C:\Windows\System\AJVGCvm.exe
  2⤵
  PID:8236
- C:\Windows\System\Ruetlxz.exe
  C:\Windows\System\Ruetlxz.exe
  2⤵
  PID:8264
- C:\Windows\System\ukePjaA.exe
  C:\Windows\System\ukePjaA.exe
  2⤵
  PID:8280
- C:\Windows\System\xDdDysz.exe
  C:\Windows\System\xDdDysz.exe
  2⤵
  PID:8304
- C:\Windows\System\UUiFiar.exe
  C:\Windows\System\UUiFiar.exe
  2⤵
  PID:8328
- C:\Windows\System\FCLfDqb.exe
  C:\Windows\System\FCLfDqb.exe
  2⤵
  PID:8352
- C:\Windows\System\EbgmGEG.exe
  C:\Windows\System\EbgmGEG.exe
  2⤵
  PID:8372
- C:\Windows\System\AXNuEWY.exe
  C:\Windows\System\AXNuEWY.exe
  2⤵
  PID:8404
- C:\Windows\System\FJBlITF.exe
  C:\Windows\System\FJBlITF.exe
  2⤵
  PID:8432
- C:\Windows\System\iEPtnQq.exe
  C:\Windows\System\iEPtnQq.exe
  2⤵
  PID:8508
- C:\Windows\System\DIqMtDS.exe
  C:\Windows\System\DIqMtDS.exe
  2⤵
  PID:8524
- C:\Windows\System\QeRatmQ.exe
  C:\Windows\System\QeRatmQ.exe
  2⤵
  PID:8552
- C:\Windows\System\nVUSSph.exe
  C:\Windows\System\nVUSSph.exe
  2⤵
  PID:8572
- C:\Windows\System\iAdCGkw.exe
  C:\Windows\System\iAdCGkw.exe
  2⤵
  PID:8624
- C:\Windows\System\SPmzEDy.exe
  C:\Windows\System\SPmzEDy.exe
  2⤵
  PID:8644
- C:\Windows\System\solDqeI.exe
  C:\Windows\System\solDqeI.exe
  2⤵
  PID:8692
- C:\Windows\System\PpWOxju.exe
  C:\Windows\System\PpWOxju.exe
  2⤵
  PID:8716
- C:\Windows\System\phasXcQ.exe
  C:\Windows\System\phasXcQ.exe
  2⤵
  PID:8736
- C:\Windows\System\iNTFzxn.exe
  C:\Windows\System\iNTFzxn.exe
  2⤵
  PID:8756
- C:\Windows\System\oiKQFDV.exe
  C:\Windows\System\oiKQFDV.exe
  2⤵
  PID:8784
- C:\Windows\System\ngtbtkg.exe
  C:\Windows\System\ngtbtkg.exe
  2⤵
  PID:8804
- C:\Windows\System\tCzboAh.exe
  C:\Windows\System\tCzboAh.exe
  2⤵
  PID:8828
- C:\Windows\System\EpBLJqT.exe
  C:\Windows\System\EpBLJqT.exe
  2⤵
  PID:8848
- C:\Windows\System\gMocxLD.exe
  C:\Windows\System\gMocxLD.exe
  2⤵
  PID:8900
- C:\Windows\System\zBiJsgk.exe
  C:\Windows\System\zBiJsgk.exe
  2⤵
  PID:8928
- C:\Windows\System\vKpeBGM.exe
  C:\Windows\System\vKpeBGM.exe
  2⤵
  PID:8948
- C:\Windows\System\DGimELT.exe
  C:\Windows\System\DGimELT.exe
  2⤵
  PID:8968
- C:\Windows\System\yEDiZqp.exe
  C:\Windows\System\yEDiZqp.exe
  2⤵
  PID:8996
- C:\Windows\System\vIZEgba.exe
  C:\Windows\System\vIZEgba.exe
  2⤵
  PID:9048
- C:\Windows\System\tgYtgkY.exe
  C:\Windows\System\tgYtgkY.exe
  2⤵
  PID:9068
- C:\Windows\System\bFNeEQp.exe
  C:\Windows\System\bFNeEQp.exe
  2⤵
  PID:9088
- C:\Windows\System\vdiPQiJ.exe
  C:\Windows\System\vdiPQiJ.exe
  2⤵
  PID:9108
- C:\Windows\System\IBMaoQb.exe
  C:\Windows\System\IBMaoQb.exe
  2⤵
  PID:9132
- C:\Windows\System\ymkHTpb.exe
  C:\Windows\System\ymkHTpb.exe
  2⤵
  PID:9152
- C:\Windows\System\sWVjMEZ.exe
  C:\Windows\System\sWVjMEZ.exe
  2⤵
  PID:9172
- C:\Windows\System\XERFlbr.exe
  C:\Windows\System\XERFlbr.exe
  2⤵
  PID:9192
- C:\Windows\System\DbQbmXX.exe
  C:\Windows\System\DbQbmXX.exe
  2⤵
  PID:7500
- C:\Windows\System\jQkgdvU.exe
  C:\Windows\System\jQkgdvU.exe
  2⤵
  PID:8232
- C:\Windows\System\wXpXHsU.exe
  C:\Windows\System\wXpXHsU.exe
  2⤵
  PID:8320
- C:\Windows\System\EvehRbe.exe
  C:\Windows\System\EvehRbe.exe
  2⤵
  PID:8396
- C:\Windows\System\wRUHUvv.exe
  C:\Windows\System\wRUHUvv.exe
  2⤵
  PID:8448
- C:\Windows\System\mfcNVlB.exe
  C:\Windows\System\mfcNVlB.exe
  2⤵
  PID:8504
- C:\Windows\System\AxHiEvY.exe
  C:\Windows\System\AxHiEvY.exe
  2⤵
  PID:8672
- C:\Windows\System\HjqHpVr.exe
  C:\Windows\System\HjqHpVr.exe
  2⤵
  PID:8780
- C:\Windows\System\DAboiLp.exe
  C:\Windows\System\DAboiLp.exe
  2⤵
  PID:8836
- C:\Windows\System\zfWigty.exe
  C:\Windows\System\zfWigty.exe
  2⤵
  PID:8936
- C:\Windows\System\wKZeDai.exe
  C:\Windows\System\wKZeDai.exe
  2⤵
  PID:9016
- C:\Windows\System\hucHqSM.exe
  C:\Windows\System\hucHqSM.exe
  2⤵
  PID:9044
- C:\Windows\System\TTsxixp.exe
  C:\Windows\System\TTsxixp.exe
  2⤵
  PID:9200
- C:\Windows\System\hUHlrLO.exe
  C:\Windows\System\hUHlrLO.exe
  2⤵
  PID:8364
- C:\Windows\System\TKIPwWE.exe
  C:\Windows\System\TKIPwWE.exe
  2⤵
  PID:8564
- C:\Windows\System\lRwOOYR.exe
  C:\Windows\System\lRwOOYR.exe
  2⤵
  PID:8964
- C:\Windows\System\gdqpvSe.exe
  C:\Windows\System\gdqpvSe.exe
  2⤵
  PID:9084
- C:\Windows\System\hEKNIhy.exe
  C:\Windows\System\hEKNIhy.exe
  2⤵
  PID:9164
- C:\Windows\System\OyYuBOd.exe
  C:\Windows\System\OyYuBOd.exe
  2⤵
  PID:8480
- C:\Windows\System\qZlkAVr.exe
  C:\Windows\System\qZlkAVr.exe
  2⤵
  PID:8960
- C:\Windows\System\IfvqeGW.exe
  C:\Windows\System\IfvqeGW.exe
  2⤵
  PID:8252
- C:\Windows\System\PlMoPNj.exe
  C:\Windows\System\PlMoPNj.exe
  2⤵
  PID:8316
- C:\Windows\System\mCahhFf.exe
  C:\Windows\System\mCahhFf.exe
  2⤵
  PID:8812
- C:\Windows\System\GqHBJeB.exe
  C:\Windows\System\GqHBJeB.exe
  2⤵
  PID:8288
- C:\Windows\System\azMJuoV.exe
  C:\Windows\System\azMJuoV.exe
  2⤵
  PID:8300
- C:\Windows\System\oWkxlgz.exe
  C:\Windows\System\oWkxlgz.exe
  2⤵
  PID:9036
- C:\Windows\System\jHZNewq.exe
  C:\Windows\System\jHZNewq.exe
  2⤵
  PID:9232
- C:\Windows\System\hqBUNlX.exe
  C:\Windows\System\hqBUNlX.exe
  2⤵
  PID:9248
- C:\Windows\System\wFjRRrR.exe
  C:\Windows\System\wFjRRrR.exe
  2⤵
  PID:9284
- C:\Windows\System\hulzRYc.exe
  C:\Windows\System\hulzRYc.exe
  2⤵
  PID:9304
- C:\Windows\System\kavSujd.exe
  C:\Windows\System\kavSujd.exe
  2⤵
  PID:9328
- C:\Windows\System\kTSuQTi.exe
  C:\Windows\System\kTSuQTi.exe
  2⤵
  PID:9348
- C:\Windows\System\QGCSkDU.exe
  C:\Windows\System\QGCSkDU.exe
  2⤵
  PID:9368
- C:\Windows\System\eAOuhMq.exe
  C:\Windows\System\eAOuhMq.exe
  2⤵
  PID:9392
- C:\Windows\System\XLmjEbt.exe
  C:\Windows\System\XLmjEbt.exe
  2⤵
  PID:9412
- C:\Windows\System\MduoeQg.exe
  C:\Windows\System\MduoeQg.exe
  2⤵
  PID:9444
- C:\Windows\System\Tqbkane.exe
  C:\Windows\System\Tqbkane.exe
  2⤵
  PID:9480
- C:\Windows\System\XOqzUhR.exe
  C:\Windows\System\XOqzUhR.exe
  2⤵
  PID:9508
- C:\Windows\System\UPWabyl.exe
  C:\Windows\System\UPWabyl.exe
  2⤵
  PID:9540
- C:\Windows\System\lfJxohf.exe
  C:\Windows\System\lfJxohf.exe
  2⤵
  PID:9560
- C:\Windows\System\CHnlIBP.exe
  C:\Windows\System\CHnlIBP.exe
  2⤵
  PID:9604
- C:\Windows\System\fxijVNO.exe
  C:\Windows\System\fxijVNO.exe
  2⤵
  PID:9620
- C:\Windows\System\adGEfzt.exe
  C:\Windows\System\adGEfzt.exe
  2⤵
  PID:9644
- C:\Windows\System\UApCMyy.exe
  C:\Windows\System\UApCMyy.exe
  2⤵
  PID:9696
- C:\Windows\System\AvIgZvW.exe
  C:\Windows\System\AvIgZvW.exe
  2⤵
  PID:9732
- C:\Windows\System\DMWEOdm.exe
  C:\Windows\System\DMWEOdm.exe
  2⤵
  PID:9756
- C:\Windows\System\yohjgev.exe
  C:\Windows\System\yohjgev.exe
  2⤵
  PID:9780
- C:\Windows\System\CZtnRgS.exe
  C:\Windows\System\CZtnRgS.exe
  2⤵
  PID:9796
- C:\Windows\System\tfKDSAH.exe
  C:\Windows\System\tfKDSAH.exe
  2⤵
  PID:9872
- C:\Windows\System\ErgTxNG.exe
  C:\Windows\System\ErgTxNG.exe
  2⤵
  PID:9892
- C:\Windows\System\llsRfuM.exe
  C:\Windows\System\llsRfuM.exe
  2⤵
  PID:9916
- C:\Windows\System\ueCmtsp.exe
  C:\Windows\System\ueCmtsp.exe
  2⤵
  PID:9936
- C:\Windows\System\zpVYwZT.exe
  C:\Windows\System\zpVYwZT.exe
  2⤵
  PID:9952
- C:\Windows\System\mhGbFup.exe
  C:\Windows\System\mhGbFup.exe
  2⤵
  PID:9976
- C:\Windows\System\mtqWsQf.exe
  C:\Windows\System\mtqWsQf.exe
  2⤵
  PID:9996
- C:\Windows\System\MFrzVtB.exe
  C:\Windows\System\MFrzVtB.exe
  2⤵
  PID:10028
- C:\Windows\System\GtjDRHM.exe
  C:\Windows\System\GtjDRHM.exe
  2⤵
  PID:10048
- C:\Windows\System\FtoxLAi.exe
  C:\Windows\System\FtoxLAi.exe
  2⤵
  PID:10072
- C:\Windows\System\UOebyYO.exe
  C:\Windows\System\UOebyYO.exe
  2⤵
  PID:10096
- C:\Windows\System\shbfstY.exe
  C:\Windows\System\shbfstY.exe
  2⤵
  PID:10116
- C:\Windows\System\oGQiLhO.exe
  C:\Windows\System\oGQiLhO.exe
  2⤵
  PID:10184
- C:\Windows\System\rrmLVjQ.exe
  C:\Windows\System\rrmLVjQ.exe
  2⤵
  PID:10212
- C:\Windows\System\NMzhbnt.exe
  C:\Windows\System\NMzhbnt.exe
  2⤵
  PID:10232
- C:\Windows\System\ZejDtiT.exe
  C:\Windows\System\ZejDtiT.exe
  2⤵
  PID:9376
- C:\Windows\System\axZorxS.exe
  C:\Windows\System\axZorxS.exe
  2⤵
  PID:9384
- C:\Windows\System\zXFsXTi.exe
  C:\Windows\System\zXFsXTi.exe
  2⤵
  PID:9424
- C:\Windows\System\iEpYqgV.exe
  C:\Windows\System\iEpYqgV.exe
  2⤵
  PID:9584
- C:\Windows\System\eAEcPxg.exe
  C:\Windows\System\eAEcPxg.exe
  2⤵
  PID:9612
- C:\Windows\System\YJyxIHx.exe
  C:\Windows\System\YJyxIHx.exe
  2⤵
  PID:9688
- C:\Windows\System\hxxnyXK.exe
  C:\Windows\System\hxxnyXK.exe
  2⤵
  PID:9820
- C:\Windows\System\LieFUwz.exe
  C:\Windows\System\LieFUwz.exe
  2⤵
  PID:9728
- C:\Windows\System\owJzlKa.exe
  C:\Windows\System\owJzlKa.exe
  2⤵
  PID:9772
- C:\Windows\System\MkFttGU.exe
  C:\Windows\System\MkFttGU.exe
  2⤵
  PID:9860
- C:\Windows\System\mfjuVaq.exe
  C:\Windows\System\mfjuVaq.exe
  2⤵
  PID:9932
- C:\Windows\System\mDNrxVD.exe
  C:\Windows\System\mDNrxVD.exe
  2⤵
  PID:10020
- C:\Windows\System\uPMXSpP.exe
  C:\Windows\System\uPMXSpP.exe
  2⤵
  PID:10056
- C:\Windows\System\jhNQXSk.exe
  C:\Windows\System\jhNQXSk.exe
  2⤵
  PID:8348
- C:\Windows\System\rFKfznY.exe
  C:\Windows\System\rFKfznY.exe
  2⤵
  PID:10200
- C:\Windows\System\nRzMhoS.exe
  C:\Windows\System\nRzMhoS.exe
  2⤵
  PID:9364
- C:\Windows\System\UyXAZHb.exe
  C:\Windows\System\UyXAZHb.exe
  2⤵
  PID:9388
- C:\Windows\System\VXduAGn.exe
  C:\Windows\System\VXduAGn.exe
  2⤵
  PID:9684
- C:\Windows\System\widfqzy.exe
  C:\Windows\System\widfqzy.exe
  2⤵
  PID:9840
- C:\Windows\System\zeOtDwV.exe
  C:\Windows\System\zeOtDwV.exe
  2⤵
  PID:10068
- C:\Windows\System\DnIFFiP.exe
  C:\Windows\System\DnIFFiP.exe
  2⤵
  PID:9168
- C:\Windows\System\iSytBrS.exe
  C:\Windows\System\iSytBrS.exe
  2⤵
  PID:9244
- C:\Windows\System\VXKNvar.exe
  C:\Windows\System\VXKNvar.exe
  2⤵
  PID:9556
- C:\Windows\System\WXmLrgE.exe
  C:\Windows\System\WXmLrgE.exe
  2⤵
  PID:10040
- C:\Windows\System\rRmoOGx.exe
  C:\Windows\System\rRmoOGx.exe
  2⤵
  PID:9592
- C:\Windows\System\qNJORjr.exe
  C:\Windows\System\qNJORjr.exe
  2⤵
  PID:9476
- C:\Windows\System\DuxsObS.exe
  C:\Windows\System\DuxsObS.exe
  2⤵
  PID:10268
- C:\Windows\System\eeuVGAc.exe
  C:\Windows\System\eeuVGAc.exe
  2⤵
  PID:10288
- C:\Windows\System\zfpfoeG.exe
  C:\Windows\System\zfpfoeG.exe
  2⤵
  PID:10312
- C:\Windows\System\PiJqqey.exe
  C:\Windows\System\PiJqqey.exe
  2⤵
  PID:10352
- C:\Windows\System\agzFxUZ.exe
  C:\Windows\System\agzFxUZ.exe
  2⤵
  PID:10372
- C:\Windows\System\oHaFTiD.exe
  C:\Windows\System\oHaFTiD.exe
  2⤵
  PID:10392
- C:\Windows\System\EBpqzGD.exe
  C:\Windows\System\EBpqzGD.exe
  2⤵
  PID:10428
- C:\Windows\System\RLsMxRR.exe
  C:\Windows\System\RLsMxRR.exe
  2⤵
  PID:10448
- C:\Windows\System\yHavYGP.exe
  C:\Windows\System\yHavYGP.exe
  2⤵
  PID:10484
- C:\Windows\System\loMlAQu.exe
  C:\Windows\System\loMlAQu.exe
  2⤵
  PID:10500
- C:\Windows\System\IypLMfU.exe
  C:\Windows\System\IypLMfU.exe
  2⤵
  PID:10520
- C:\Windows\System\JJGVVbB.exe
  C:\Windows\System\JJGVVbB.exe
  2⤵
  PID:10552
- C:\Windows\System\trgQtPc.exe
  C:\Windows\System\trgQtPc.exe
  2⤵
  PID:10600
- C:\Windows\System\jqYYAyI.exe
  C:\Windows\System\jqYYAyI.exe
  2⤵
  PID:10632
- C:\Windows\System\FMStoUK.exe
  C:\Windows\System\FMStoUK.exe
  2⤵
  PID:10652
- C:\Windows\System\TtFYduH.exe
  C:\Windows\System\TtFYduH.exe
  2⤵
  PID:10688
- C:\Windows\System\HMjbopv.exe
  C:\Windows\System\HMjbopv.exe
  2⤵
  PID:10716
- C:\Windows\System\ttCDnWL.exe
  C:\Windows\System\ttCDnWL.exe
  2⤵
  PID:10756
- C:\Windows\System\FEAkuLl.exe
  C:\Windows\System\FEAkuLl.exe
  2⤵
  PID:10780
- C:\Windows\System\RtPlrJs.exe
  C:\Windows\System\RtPlrJs.exe
  2⤵
  PID:10800
- C:\Windows\System\OPoEXMM.exe
  C:\Windows\System\OPoEXMM.exe
  2⤵
  PID:10828
- C:\Windows\System\ApWsxwj.exe
  C:\Windows\System\ApWsxwj.exe
  2⤵
  PID:10856
- C:\Windows\System\DMssOHR.exe
  C:\Windows\System\DMssOHR.exe
  2⤵
  PID:10892
- C:\Windows\System\URmYlNv.exe
  C:\Windows\System\URmYlNv.exe
  2⤵
  PID:10924
- C:\Windows\System\vuCZUIq.exe
  C:\Windows\System\vuCZUIq.exe
  2⤵
  PID:10948
- C:\Windows\System\biVRGKQ.exe
  C:\Windows\System\biVRGKQ.exe
  2⤵
  PID:10968
- C:\Windows\System\hcHPann.exe
  C:\Windows\System\hcHPann.exe
  2⤵
  PID:11016
- C:\Windows\System\HSxSdmc.exe
  C:\Windows\System\HSxSdmc.exe
  2⤵
  PID:11040
- C:\Windows\System\vDmLsjb.exe
  C:\Windows\System\vDmLsjb.exe
  2⤵
  PID:11060
- C:\Windows\System\OsRJPyI.exe
  C:\Windows\System\OsRJPyI.exe
  2⤵
  PID:11080
- C:\Windows\System\qkdzXnE.exe
  C:\Windows\System\qkdzXnE.exe
  2⤵
  PID:11112
- C:\Windows\System\CADWuUy.exe
  C:\Windows\System\CADWuUy.exe
  2⤵
  PID:11132
- C:\Windows\System\tEdPnDv.exe
  C:\Windows\System\tEdPnDv.exe
  2⤵
  PID:11156
- C:\Windows\System\trzvZoy.exe
  C:\Windows\System\trzvZoy.exe
  2⤵
  PID:11180
- C:\Windows\System\fwrrQUk.exe
  C:\Windows\System\fwrrQUk.exe
  2⤵
  PID:11220
- C:\Windows\System\HbhsVGT.exe
  C:\Windows\System\HbhsVGT.exe
  2⤵
  PID:11236
- C:\Windows\System\GorfGmC.exe
  C:\Windows\System\GorfGmC.exe
  2⤵
  PID:11260
- C:\Windows\System\PFoQkeZ.exe
  C:\Windows\System\PFoQkeZ.exe
  2⤵
  PID:10256
- C:\Windows\System\yqtjrQS.exe
  C:\Windows\System\yqtjrQS.exe
  2⤵
  PID:10328
- C:\Windows\System\lKESULa.exe
  C:\Windows\System\lKESULa.exe
  2⤵
  PID:10404
- C:\Windows\System\vSnqUGC.exe
  C:\Windows\System\vSnqUGC.exe
  2⤵
  PID:10424
- C:\Windows\System\keWkqka.exe
  C:\Windows\System\keWkqka.exe
  2⤵
  PID:10492
- C:\Windows\System\mtwSgJb.exe
  C:\Windows\System\mtwSgJb.exe
  2⤵
  PID:10608
- C:\Windows\System\ECZdCmy.exe
  C:\Windows\System\ECZdCmy.exe
  2⤵
  PID:9740
- C:\Windows\System\mJoguJE.exe
  C:\Windows\System\mJoguJE.exe
  2⤵
  PID:10840
- C:\Windows\System\nbEZXmz.exe
  C:\Windows\System\nbEZXmz.exe
  2⤵
  PID:10868
- C:\Windows\System\JWZMeKc.exe
  C:\Windows\System\JWZMeKc.exe
  2⤵
  PID:10932
- C:\Windows\System\ZTCGIWn.exe
  C:\Windows\System\ZTCGIWn.exe
  2⤵
  PID:11012
- C:\Windows\System\YkpZPFA.exe
  C:\Windows\System\YkpZPFA.exe
  2⤵
  PID:11052
- C:\Windows\System\aVqJQMy.exe
  C:\Windows\System\aVqJQMy.exe
  2⤵
  PID:11104
- C:\Windows\System\olukWoJ.exe
  C:\Windows\System\olukWoJ.exe
  2⤵
  PID:11192
- C:\Windows\System\MIqSmmy.exe
  C:\Windows\System\MIqSmmy.exe
  2⤵
  PID:11252
- C:\Windows\System\vdUFuYb.exe
  C:\Windows\System\vdUFuYb.exe
  2⤵
  PID:10388
- C:\Windows\System\IaKmaSV.exe
  C:\Windows\System\IaKmaSV.exe
  2⤵
  PID:10368
- C:\Windows\System\TciYFbP.exe
  C:\Windows\System\TciYFbP.exe
  2⤵
  PID:10592
- C:\Windows\System\vFiDjoB.exe
  C:\Windows\System\vFiDjoB.exe
  2⤵
  PID:10736
- C:\Windows\System\XmhSaYl.exe
  C:\Windows\System\XmhSaYl.exe
  2⤵
  PID:10852
- C:\Windows\System\ojQxXJc.exe
  C:\Windows\System\ojQxXJc.exe
  2⤵
  PID:10964
- C:\Windows\System\hYyLldc.exe
  C:\Windows\System\hYyLldc.exe
  2⤵
  PID:11092
- C:\Windows\System\jxyFxXR.exe
  C:\Windows\System\jxyFxXR.exe
  2⤵
  PID:11200
- C:\Windows\System\oJjmuQP.exe
  C:\Windows\System\oJjmuQP.exe
  2⤵
  PID:10528
- C:\Windows\System\HvkhgRo.exe
  C:\Windows\System\HvkhgRo.exe
  2⤵
  PID:10808
- C:\Windows\System\xAaBJav.exe
  C:\Windows\System\xAaBJav.exe
  2⤵
  PID:11284
- C:\Windows\System\baVcknd.exe
  C:\Windows\System\baVcknd.exe
  2⤵
  PID:11356
- C:\Windows\System\pwtdVCF.exe
  C:\Windows\System\pwtdVCF.exe
  2⤵
  PID:11396
- C:\Windows\System\xeYsAsA.exe
  C:\Windows\System\xeYsAsA.exe
  2⤵
  PID:11416
- C:\Windows\System\TcQdlLi.exe
  C:\Windows\System\TcQdlLi.exe
  2⤵
  PID:11464
- C:\Windows\System\fRVkYcH.exe
  C:\Windows\System\fRVkYcH.exe
  2⤵
  PID:11484
- C:\Windows\System\FKLboxf.exe
  C:\Windows\System\FKLboxf.exe
  2⤵
  PID:11500
- C:\Windows\System\eEwopCK.exe
  C:\Windows\System\eEwopCK.exe
  2⤵
  PID:11520
- C:\Windows\System\vfMRHMn.exe
  C:\Windows\System\vfMRHMn.exe
  2⤵
  PID:11544
- C:\Windows\System\DgpGxrD.exe
  C:\Windows\System\DgpGxrD.exe
  2⤵
  PID:11564
- C:\Windows\System\OUiqdir.exe
  C:\Windows\System\OUiqdir.exe
  2⤵
  PID:11604
- C:\Windows\System\bzzltZp.exe
  C:\Windows\System\bzzltZp.exe
  2⤵
  PID:11632
- C:\Windows\System\riamZTt.exe
  C:\Windows\System\riamZTt.exe
  2⤵
  PID:11668
- C:\Windows\System\bZJplNc.exe
  C:\Windows\System\bZJplNc.exe
  2⤵
  PID:11716
- C:\Windows\System\NLxKtGg.exe
  C:\Windows\System\NLxKtGg.exe
  2⤵
  PID:11736
- C:\Windows\System\woNBNqE.exe
  C:\Windows\System\woNBNqE.exe
  2⤵
  PID:11760
- C:\Windows\System\ivQQmFz.exe
  C:\Windows\System\ivQQmFz.exe
  2⤵
  PID:11776
- C:\Windows\System\SFdLOIO.exe
  C:\Windows\System\SFdLOIO.exe
  2⤵
  PID:11820
- C:\Windows\System\XcVESIf.exe
  C:\Windows\System\XcVESIf.exe
  2⤵
  PID:11840
- C:\Windows\System\DdvJBAH.exe
  C:\Windows\System\DdvJBAH.exe
  2⤵
  PID:11860
- C:\Windows\System\cGWDsZI.exe
  C:\Windows\System\cGWDsZI.exe
  2⤵
  PID:11880
- C:\Windows\System\xZmjvDB.exe
  C:\Windows\System\xZmjvDB.exe
  2⤵
  PID:11924
- C:\Windows\System\SwKAdbP.exe
  C:\Windows\System\SwKAdbP.exe
  2⤵
  PID:11964
- C:\Windows\System\YaSSJrU.exe
  C:\Windows\System\YaSSJrU.exe
  2⤵
  PID:11984
- C:\Windows\System\AFYUFKq.exe
  C:\Windows\System\AFYUFKq.exe
  2⤵
  PID:12004
- C:\Windows\System\NXUZVDT.exe
  C:\Windows\System\NXUZVDT.exe
  2⤵
  PID:12032
- C:\Windows\System\OWolsqA.exe
  C:\Windows\System\OWolsqA.exe
  2⤵
  PID:12064
- C:\Windows\System\wUBPStC.exe
  C:\Windows\System\wUBPStC.exe
  2⤵
  PID:12096
- C:\Windows\System\ihWdWCO.exe
  C:\Windows\System\ihWdWCO.exe
  2⤵
  PID:12120
- C:\Windows\System\DUReQxw.exe
  C:\Windows\System\DUReQxw.exe
  2⤵
  PID:12140
- C:\Windows\System\FQwwTVZ.exe
  C:\Windows\System\FQwwTVZ.exe
  2⤵
  PID:12164
- C:\Windows\System\hSXpydl.exe
  C:\Windows\System\hSXpydl.exe
  2⤵
  PID:12184
- C:\Windows\System\DgyNDcG.exe
  C:\Windows\System\DgyNDcG.exe
  2⤵
  PID:12204
- C:\Windows\System\EemmrTJ.exe
  C:\Windows\System\EemmrTJ.exe
  2⤵
  PID:12232
- C:\Windows\System\JAyzJBD.exe
  C:\Windows\System\JAyzJBD.exe
  2⤵
  PID:12248
- C:\Windows\System\iSZdNLP.exe
  C:\Windows\System\iSZdNLP.exe
  2⤵
  PID:10680
- C:\Windows\System\fXxAQQA.exe
  C:\Windows\System\fXxAQQA.exe
  2⤵
  PID:11172
- C:\Windows\System\OCfgoZa.exe
  C:\Windows\System\OCfgoZa.exe
  2⤵
  PID:11300
- C:\Windows\System\uPPjPtU.exe
  C:\Windows\System\uPPjPtU.exe
  2⤵
  PID:11392
- C:\Windows\System\PornCei.exe
  C:\Windows\System\PornCei.exe
  2⤵
  PID:11408
- C:\Windows\System\vnkZjNf.exe
  C:\Windows\System\vnkZjNf.exe
  2⤵
  PID:11508
- C:\Windows\System\jCaYoeS.exe
  C:\Windows\System\jCaYoeS.exe
  2⤵
  PID:11588
- C:\Windows\System\SzKuNYd.exe
  C:\Windows\System\SzKuNYd.exe
  2⤵
  PID:11644
- C:\Windows\System\iNXRgix.exe
  C:\Windows\System\iNXRgix.exe
  2⤵
  PID:11664
- C:\Windows\System\HoPlZuu.exe
  C:\Windows\System\HoPlZuu.exe
  2⤵
  PID:11768
- C:\Windows\System\DlQsycS.exe
  C:\Windows\System\DlQsycS.exe
  2⤵
  PID:11888
- C:\Windows\System\pxqSWtW.exe
  C:\Windows\System\pxqSWtW.exe
  2⤵
  PID:11872
- C:\Windows\System\cqMhSmD.exe
  C:\Windows\System\cqMhSmD.exe
  2⤵
  PID:11956
- C:\Windows\System\lRFMNxM.exe
  C:\Windows\System\lRFMNxM.exe
  2⤵
  PID:11996
- C:\Windows\System\JJefOCE.exe
  C:\Windows\System\JJefOCE.exe
  2⤵
  PID:12088
- C:\Windows\System\pbjFUEd.exe
  C:\Windows\System\pbjFUEd.exe
  2⤵
  PID:12132
- C:\Windows\System\TUbmJNf.exe
  C:\Windows\System\TUbmJNf.exe
  2⤵
  PID:12156
- C:\Windows\System\EhzZRBl.exe
  C:\Windows\System\EhzZRBl.exe
  2⤵
  PID:12212
- C:\Windows\System\gQoZOty.exe
  C:\Windows\System\gQoZOty.exe
  2⤵
  PID:10976
- C:\Windows\System\kghzqKe.exe
  C:\Windows\System\kghzqKe.exe
  2⤵
  PID:11556
- C:\Windows\System\OLKIqOA.exe
  C:\Windows\System\OLKIqOA.exe
  2⤵
  PID:11752
- C:\Windows\System\WffTbte.exe
  C:\Windows\System\WffTbte.exe
  2⤵
  PID:11916
- C:\Windows\System\zaSIayE.exe
  C:\Windows\System\zaSIayE.exe
  2⤵
  PID:11932
- C:\Windows\System\RKCHfoT.exe
  C:\Windows\System\RKCHfoT.exe
  2⤵
  PID:12116
- C:\Windows\System\JuQZUhm.exe
  C:\Windows\System\JuQZUhm.exe
  2⤵
  PID:10440
- C:\Windows\System\EJjtRBx.exe
  C:\Windows\System\EJjtRBx.exe
  2⤵
  PID:11592
- C:\Windows\System\JSrMPKG.exe
  C:\Windows\System\JSrMPKG.exe
  2⤵
  PID:11836
- C:\Windows\System\NlbrNrH.exe
  C:\Windows\System\NlbrNrH.exe
  2⤵
  PID:11532
- C:\Windows\System\LrFOVCq.exe
  C:\Windows\System\LrFOVCq.exe
  2⤵
  PID:11980
- C:\Windows\System\WwiMZBY.exe
  C:\Windows\System\WwiMZBY.exe
  2⤵
  PID:12332
- C:\Windows\System\eGrpHEV.exe
  C:\Windows\System\eGrpHEV.exe
  2⤵
  PID:12352
- C:\Windows\System\yCrYGjF.exe
  C:\Windows\System\yCrYGjF.exe
  2⤵
  PID:12368
- C:\Windows\System\gzTVDqX.exe
  C:\Windows\System\gzTVDqX.exe
  2⤵
  PID:12392
- C:\Windows\System\McKwTCb.exe
  C:\Windows\System\McKwTCb.exe
  2⤵
  PID:12408
- C:\Windows\System\mQodUBC.exe
  C:\Windows\System\mQodUBC.exe
  2⤵
  PID:12428
- C:\Windows\System\mfLFPjp.exe
  C:\Windows\System\mfLFPjp.exe
  2⤵
  PID:12452
- C:\Windows\System\VjojODl.exe
  C:\Windows\System\VjojODl.exe
  2⤵
  PID:12468
- C:\Windows\System\aKrCFha.exe
  C:\Windows\System\aKrCFha.exe
  2⤵
  PID:12540
- C:\Windows\System\MwUYZzG.exe
  C:\Windows\System\MwUYZzG.exe
  2⤵
  PID:12576
- C:\Windows\System\hZvyIqN.exe
  C:\Windows\System\hZvyIqN.exe
  2⤵
  PID:12600
- C:\Windows\System\RjqIoVY.exe
  C:\Windows\System\RjqIoVY.exe
  2⤵
  PID:12620
- C:\Windows\System\fxCJCVu.exe
  C:\Windows\System\fxCJCVu.exe
  2⤵
  PID:12668
- C:\Windows\System\sKMOPPV.exe
  C:\Windows\System\sKMOPPV.exe
  2⤵
  PID:12688
- C:\Windows\System\SvowlOp.exe
  C:\Windows\System\SvowlOp.exe
  2⤵
  PID:12708
- C:\Windows\System\XBtbCop.exe
  C:\Windows\System\XBtbCop.exe
  2⤵
  PID:12752
- C:\Windows\System\iaSUqSr.exe
  C:\Windows\System\iaSUqSr.exe
  2⤵
  PID:12768
- C:\Windows\System\epErSQD.exe
  C:\Windows\System\epErSQD.exe
  2⤵
  PID:12808
- C:\Windows\System\XNoMdGG.exe
  C:\Windows\System\XNoMdGG.exe
  2⤵
  PID:12832
- C:\Windows\System\yfNwxdW.exe
  C:\Windows\System\yfNwxdW.exe
  2⤵
  PID:12852
- C:\Windows\System\JQCJKQU.exe
  C:\Windows\System\JQCJKQU.exe
  2⤵
  PID:12892
- C:\Windows\System\lCKrwsl.exe
  C:\Windows\System\lCKrwsl.exe
  2⤵
  PID:12916
- C:\Windows\System\dVBUqoP.exe
  C:\Windows\System\dVBUqoP.exe
  2⤵
  PID:12936
- C:\Windows\System\KrUFlPd.exe
  C:\Windows\System\KrUFlPd.exe
  2⤵
  PID:12956
- C:\Windows\System\FutpGzL.exe
  C:\Windows\System\FutpGzL.exe
  2⤵
  PID:12984
- C:\Windows\System\EDBiweI.exe
  C:\Windows\System\EDBiweI.exe
  2⤵
  PID:13000
- C:\Windows\System\kSLwasd.exe
  C:\Windows\System\kSLwasd.exe
  2⤵
  PID:13028
- C:\Windows\System\ATLnRqD.exe
  C:\Windows\System\ATLnRqD.exe
  2⤵
  PID:13108
- C:\Windows\System\MdQDxXO.exe
  C:\Windows\System\MdQDxXO.exe
  2⤵
  PID:13124
- C:\Windows\System\OTKwRkv.exe
  C:\Windows\System\OTKwRkv.exe
  2⤵
  PID:13148
- C:\Windows\System\hcppORk.exe
  C:\Windows\System\hcppORk.exe
  2⤵
  PID:13168
- C:\Windows\System\JyrlNxX.exe
  C:\Windows\System\JyrlNxX.exe
  2⤵
  PID:13188
- C:\Windows\System\UppFARS.exe
  C:\Windows\System\UppFARS.exe
  2⤵
  PID:13216
- C:\Windows\System\cosNvyF.exe
  C:\Windows\System\cosNvyF.exe
  2⤵
  PID:13260
- C:\Windows\System\RiYdsOF.exe
  C:\Windows\System\RiYdsOF.exe
  2⤵
  PID:13280
- C:\Windows\System\SWMhHtY.exe
  C:\Windows\System\SWMhHtY.exe
  2⤵
  PID:13300
- C:\Windows\System\tYetTCB.exe
  C:\Windows\System\tYetTCB.exe
  2⤵
  PID:12320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_imxmksto.mjd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BIwQDsm.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\BqEEWGG.exe

Filesize
1.8MB

MD5
e1ede76039afd2c334d1077f211ab04b

SHA1
82652239c7ba3e01413d91743fd2404c7005f042

SHA256
072fa6d6423ed2bdf9c740eacdec8d27c9d6b1dca25511cc9d600cd85a7f9298

SHA512
678c9e8e5fe3fb328fad9abc9148633ab7d62e85c570d6934afac4e5ed2c77b0b22e2a95a6156b67234afa57549cb6d41e102e61403bb106c2d6c999a3b354b5

Download Submit
C:\Windows\System\DqPDkuf.exe

Filesize
1.8MB

MD5
f2ea5eb12bee417a51940c035aaef051

SHA1
c5c8764bbd8701331d2ed566dcb826e9045e4b87

SHA256
d6a837d5aabe5d861202a0e8cf419ff8e7cb45d1ddad87d497c47ac3fda92c7a

SHA512
8935e38c1fe60e686a224f63c6bb160c1628d1d7a1588f1bf6fd19022f41b7870368dea16ddba27a9ea9ab4d901031bd35bf75a957a58ce443afcdaffec02ae0

Download Submit
C:\Windows\System\FONjGRp.exe

Filesize
1.8MB

MD5
f0454560ac6ea626b776c794584dc4b6

SHA1
16eef6f0c8d6075b48919bbd81583cab32c9c55c

SHA256
cd9dcccca6b668830b1fba77f3ca1ca0f92dae0eb9847b261778cfa6b9e3738e

SHA512
50ac05009733bda127557545efd2922fb73b07fd2de05157941d871e8fa1e4b601ff54cc544bcbf0a3179cec660336b4d739f2f002732b820ba692e8da68aaeb

Download Submit
C:\Windows\System\OjIduWy.exe

Filesize
1.8MB

MD5
21b7f205b396f1ca47423acbf2f74aeb

SHA1
07d2fb40b690cc1f38fd9382472cb67a1ac97900

SHA256
d5e47fe47cc4144287f4f843085ba60d74b28339b69060a69c3fbce9c62b55b5

SHA512
085ed9c85a3886eaed1d8d853e799c754bbd9199c437c9d0cc978377a29f44f028c9c3d4c0703c00105ece09e461bcc13e899beba62307013c0b8bb697dfa271

Download Submit
C:\Windows\System\PeFsjAb.exe

Filesize
1.8MB

MD5
72a17e0700c6d19fd1da83f19d503208

SHA1
0ca1b7694c641ad4db4715155babc4dfc7553001

SHA256
f3d60962c54282a2f6af2046e0af233ff3b1f6bdccce382f35a37a0e53822b02

SHA512
7e1558d56569238cf662e77306a5609e867bed2e2f09a7cada9443749585ae5c40b901f07c00182ae47325e79422ea8137c583c7646c514e30a22f2c1864acbb

Download Submit
C:\Windows\System\SWTjjCa.exe

Filesize
1.8MB

MD5
fce5459d75f2c4484475ec669e579d95

SHA1
3c3a3c4f1c2c17b984e5eae152dadda94a2e3334

SHA256
c8e7d7baadb359868c22ea875a51cfc025fe60a4e728110c2a99d8be30bb5ff8

SHA512
d4f60389b7805daf33fcfa912706aa4e40391b4761915f2c78326cf9e3d54337fdfaa9a52ac815f615084b4bf54ef25162a715da7d3556b4b9f0443addf24b7a

Download Submit
C:\Windows\System\VbmzYAW.exe

Filesize
1.8MB

MD5
3e3b95cb2899a1fe07ca2eeb567b2ce2

SHA1
57b88a48596c737b6835b3b8bad7ccfcd65cb0d2

SHA256
d4999bddf9084ca4dd1ba37b424ed6a5233d788e1fd300fea3fbeec37e7bed91

SHA512
146426b947b39bcb8c84efbd5033142a033b8b328d9427850f7af28554b2edf9736284ce2a53d1163d7f70f1d4e45356c3f1fea326fa20f0b1c901e791c7cacb

Download Submit
C:\Windows\System\VsLrfnN.exe

Filesize
1.8MB

MD5
41e919805739bdb4e74eb7035c8aacc5

SHA1
3289a8054a4b8110b70a08f4d986f0bd1f410f8e

SHA256
875a34d728284ed8c017d1f2ecbd84a2862267a632b44ca0b011f371e7be69b7

SHA512
6d81edace8121258cb7c5c86b115b533322bde27bc937fde472ac4be6014effab00222f35a7630977373b18837b470d47084ccba93a5d315b59b9d59b73750c5

Download Submit
C:\Windows\System\WSojszE.exe

Filesize
1.8MB

MD5
660521f37f28365db3480bb8fe367583

SHA1
eb3a426da4826079a4019bf6f9025c349ca9517d

SHA256
68151ee07bebb34d8472a51c3dbc288b0feeabfc882dd641d5defef513a45605

SHA512
c5ddfa562a66ef5493203abdb5530256e32a17533481487713f1a8421122252d5d05f3191bc4f68d7c4ab0331504408d5833adb80ae115629bdbcb51ea9ce12c

Download Submit
C:\Windows\System\YjyXnEl.exe

Filesize
1.8MB

MD5
c282032d024bc1019af8641c34d256ac

SHA1
3afa5ad5a79f63bcbbacb489fa00ed1293a9bde9

SHA256
d5f6cb97a0b7d90b36930d254a4813f9c041267b82e20e8c97fc7046a5d7c08b

SHA512
4f663fe6e3c5f3e25c1cf6e1d5b5630a7b4e611f3d16c019b630c21490e474e51f09bbfb51be53f083cefeb68d0fc6d7c108abb980599828a89697f52bf06238

Download Submit
C:\Windows\System\bDinfTT.exe

Filesize
1.8MB

MD5
eab63e21ecca7d476a88a268d5cfa63d

SHA1
43a646be08b4b15c324c1762c700ce246cb1c357

SHA256
8093ec839c736249b5733c453207856fac5638adf5d14064f6f5f28885d1f97f

SHA512
8c9570ffe79f94f7647b21715a8218381d5a1dd0d8670231a27571d00865f00f36ba47e5fee7052440e66d0eea211f98d22abf7a86ed1d7cdfc76c207ebaf423

Download Submit
C:\Windows\System\bIrnvFb.exe

Filesize
1.8MB

MD5
4552c91eac142d44245d6572803f3bd5

SHA1
652511305edf04e77aa801847832b36339d6e2f7

SHA256
9db58f47c03e63b75627c3f7e2798509a6a2b3b6e2a5c725c9a4058bdad17a7a

SHA512
544d7f89b024f91248cdb0f480b916209d0632147b22ff4b502612d686d451372b26a9d5c6d20c0465d0e288dd0f2f6f162b34409298d80346e02a7b77167fbb

Download Submit
C:\Windows\System\dmblteZ.exe

Filesize
1.8MB

MD5
84c26d864050b6cf27b3b52321d32a23

SHA1
3717d4188ca3fa38853caf766c9a147a8b62b842

SHA256
b2e5aa32310e5bca639d45187ed523d82e9449bf9afb39192d3097c2b715a006

SHA512
082d815164a3031de543d1979257ee407fde802c7ba78f95ca2f73b12a332a9fb922afda741de36b52b2be73f0665d9ec6ed6f67d9771a8084a066d709ed6caf

Download Submit
C:\Windows\System\eVTYseq.exe

Filesize
1.8MB

MD5
56d60b4e6100150d0dfa1a553f15677a

SHA1
db2bcc13b500898656afe9b42fe51608ee9d577e

SHA256
5c9346e3a44e3e0a3d3ed3482b6308c4bcb97047f5673376b6a006d139103683

SHA512
794991e60ab41e25b21771b6ab5696a0f32cf7281108b65469e1d9ca2e9f9cf47ff4cdaa0f5a23a250ab41caba942406081a46693fb1f65eb50161ab50e10d4d

Download Submit
C:\Windows\System\guIGEaq.exe

Filesize
1.8MB

MD5
4d9c14eabb6fdd7b0a81d27ed0403ec2

SHA1
2ab2af132e4a614edf0f5df2a4479e2c3d3d9ba1

SHA256
15aef347830b83aaaf37fd4c3ca3f7be7f02f8baf356465cdc96e31c4e0ecce4

SHA512
d0e9a43c552fea5c1086b36b83df76bc98fc7bc0eb0637e5f6a1cd68d3fd0e54b7e24a1d2b4877d70d0d2092078617737cc7ddf57c0e92f2078d55db1268ec3e

Download Submit
C:\Windows\System\inmFKtN.exe

Filesize
1.8MB

MD5
a8f9d623b28a83b15bd2a6c11e23546f

SHA1
8c49600c0f6c967ad18c66452d1783f23f9f45de

SHA256
e2c2b21e711733ce82527bca8178c674e40e1b96771b3eb4799ee833161f8f64

SHA512
de5187d26ac1e7c8d00f621ccc51facfa72e8bf57c772418dbac8c57fda9b64b6f1946d153d6f0d5f8ad3dad652b075dcb6ecdacab759ec787b356d542180286

Download Submit
C:\Windows\System\jUGntmG.exe

Filesize
1.8MB

MD5
b0afc57bfcbaa04fea98e9abffa57a91

SHA1
eaa5ca2c73e2683f92ad883046295c84711aa3e8

SHA256
3f6760625912b9f96072d92dc1a197f22a087bc67862a23236e7c67bd66ef1fc

SHA512
4a2eadb8f858cccd980beca652943520e926c7f2f4543958fbc2f9ef9594e97988bff3f57a02a3445229c730cfac5d9b573dc62ac006ce7461ec057efa71687f

Download Submit
C:\Windows\System\lVleAnj.exe

Filesize
1.8MB

MD5
4cd1a5255e7abf8db07f56bc661b2379

SHA1
a40a8e41958eeb69d5d79a3ee781b3b328720c45

SHA256
8295c77c1810b5f49a08e01c10cc4a12854b8272925c3ed209e3c63bceea2449

SHA512
29220e45ed2b57204b56110e7572ef759211abd367d808e665d0da19129c03b978da5985b967b51e00e26e390a9b5d760b0130a06b1a9b9c224d8563d466a064

Download Submit
C:\Windows\System\lWuienA.exe

Filesize
1.8MB

MD5
cb151a40c0ed37765fdd36e1a62e3b3d

SHA1
a43d675f5756ac8d0ad028f81847820c621f7563

SHA256
46f4af635227750eef5bad0e8aec4845bc06a5c540624554e834746d7bb20130

SHA512
a1ea0a7c51cb5b9c2c2abf3dd6b914cb29295cd67b3c3296414d41250321c0a69e5f98a84f69529900db8ab16876883b4b71c2c27328f48aeeda14a0354dc926

Download Submit
C:\Windows\System\nGwslMr.exe

Filesize
1.8MB

MD5
fdceafa4ee5ad88c2bbdb4b8912d14c3

SHA1
5ebd8b314a96a2c7ba3ba21aa467ecaa4af452cc

SHA256
d1b709f9d5144a3ec715671a5e634c4c2fedbedcb952ccc4154e4325240f6510

SHA512
46727b3cb07be60f6ee488459992ffe18b963ca816703253b5a79df4aa5032322877d2ce6d45ea287a37aed2728a7771f661e3044398858803648740747cefa2

Download Submit
C:\Windows\System\pXYrkRz.exe

Filesize
1.8MB

MD5
0f9ab23da702baf1c4ec78e6fd725097

SHA1
f6d29603da63f0c4a13dd9911becc67b76cf338d

SHA256
b07502076347ed45ad6738580ff7f059befd822d4d896df4028b214863d16253

SHA512
c0045f6c772eb69c04a57314256eb0861bef7aca2df627ab544beff97d0cea18734bed40525f7b3176dc1e44b2fe76568415d62236f26ecf66a3bdef3ee8a420

Download Submit
C:\Windows\System\rPYjrHw.exe

Filesize
1.8MB

MD5
585168b8aaeb19a62e29172e808f15e0

SHA1
2a1de74ef62ec0754089b5a1511e92d7a03c1ad6

SHA256
b9f612703e3fb5babeec27b1644cb70ab1fc6ef9026392cc604ecb7e0a6162a8

SHA512
fb2fa95fba30d9058ddefb4a3e456558e78178391071e712b6424b7c9e10bd3dad4a53d600cbd65a1cd4bf4a70212b5129c01da858d974b90475fb3d65e08ea1

Download Submit
C:\Windows\System\raGfWHg.exe

Filesize
1.8MB

MD5
5b7190f5372a6df879565fe1f2542c0a

SHA1
b730c09a1e670d033cca127cccc23aad86f76fcd

SHA256
7b1ac9289697ab5e7d9801f0d05a59f1049744da92befd92e920adf5c56bf2fa

SHA512
eeaee1a59552f2ba83063e649d9f8018f231b9a1bf13b46b15bd7d5640236795870299fd4ffd702ac097e9f1ebb23eb7d6fe7c0b2da831ce7c9654b0d34b15f8

Download Submit
C:\Windows\System\sGMxAok.exe

Filesize
1.8MB

MD5
7b7935c95ed37885a8f50183cd808ab3

SHA1
1add4d61dd4b5be915f980843e2b671f6d20431e

SHA256
280cbc9e0f2dfe4c783e34a3faf1e73208443c08cdd77a9b7d9864feec500a79

SHA512
fc6e02680de2069aff223ecee917dde8429317f7b66756af78df2f11c5848d3c0c63d52466f8a95b2667370362206d7bb63e33a004aa38c1706fe40a0807aa3f

Download Submit
C:\Windows\System\sPbSZKL.exe

Filesize
1.8MB

MD5
19c45a9fe5814c706782ce7fe59e695e

SHA1
e4f1109a6e183e29c39b6548dd64469b279a3f03

SHA256
fb1df9ce15ab3a574e3a785befd9a9f4317459ed8a1239262d09d60eef2b62e1

SHA512
3f54ab91ad3ac07d9f281204e83f6814a93e16743574f6c1142953542e6846eecac1e1162dd108a524ee3f5acb861969399ffe8d6663e25491ed1901c953d208

Download Submit
C:\Windows\System\soIFGtZ.exe

Filesize
1.8MB

MD5
c7aca6761e38c2b2db9a721d4244acc4

SHA1
ea10f2bcf94412cbd1736935d26060a501d9de08

SHA256
1a0ae43bf5cf1d3fbc6bda9ab6d6204123de840201a4797fd33deee30b55a59f

SHA512
c00e44a9f583e63c028d8459f453e201e1fdd1005dc487217a5c4832c17b01cec4e18179337ea467cdb571dcdd77e19ce0af502c58b89b4fd47a42fea7c1b896

Download Submit
C:\Windows\System\tvWVTxu.exe

Filesize
1.8MB

MD5
1916a8d12adf6198876db8620bee0d03

SHA1
f939f42ad886987bffb60fb73f3ea57839156881

SHA256
ff6e84750b962a268d6f7cd9902dfd5e07740b069224a023d809770f04143e08

SHA512
2019481ddb9af4960748f8b89e4b82972f4000c43e113cad418656b6761ee0ae49650a7629a777f1df0c78e8aab6b130b6e7c9906d522bd75b9ffabd81cf2128

Download Submit
C:\Windows\System\uUCCbHc.exe

Filesize
1.8MB

MD5
ef9a98117119e4f460e8f0307a8660bf

SHA1
ec999cb618637c861e5543a621a91fd5483ea226

SHA256
e80017f9440510909fb77facaa8d3dc6020d982a6f5633c7f04b9c2801ad55e8

SHA512
bc66220b31735f2119a7ed6e373fb59096e74d1c6c6c04f1b71270bef61f2a989a6a8f4670ff107dae921acbfe46b0f66d4620a612ac837fd6dfb127fb2bec43

Download Submit
C:\Windows\System\uYFevza.exe

Filesize
1.8MB

MD5
f47e6f2abd5b4be7c03df5fb691c94ea

SHA1
2397067be457a423e32c82cd26c174e378321b5f

SHA256
65a602b926e4eea6b3818cf989a4a0658973aa03f8de5252915b511100b0117b

SHA512
70b6eb6293e7bdbfddea350de7e52656a49895c70044265297bf6a1d26692825f7a7f7dd453f497c75b92ef27691bffb5327b24c1e43e7a9bf8d324a998af15e

Download Submit
C:\Windows\System\vnNpOAh.exe

Filesize
1.8MB

MD5
224d14cb0af8f51ad611d370f323710b

SHA1
87189e001e0a2b269d90a5d885d8552c37d8b367

SHA256
75193ee6e6710dcfb6d506cd2bd7498ea600194bf0b900baf82e8ec4df6d9253

SHA512
048a5a33355dbd4176c0d26f4076ac903165aa70a7d6ceba471faf08819846925fd69f7c9e87ac52da223008fa62969bbe2c0294b1b262ef7e4bb4b4869e9f4a

Download Submit
C:\Windows\System\xEEUVyi.exe

Filesize
1.8MB

MD5
9cc5049f4c6af164773e284779db80df

SHA1
925a753c8c5a144e0bafcc2628d5cbb4871f76c3

SHA256
81bf0613463396c890b02a23acd5fada580afa6d3270f7e067b900fe78333f50

SHA512
ec39a7c422d758b8478e0ce3ad536c22bd208612a7a9841271583977c906bcdb4346f3cef93ade663af021fad105f8103363ddbd548856543150c29e7e5e7aa7

Download Submit
C:\Windows\System\xjahjsk.exe

Filesize
1.8MB

MD5
487980b6ecc74edabc281115481fd478

SHA1
529781ee252be1dbf911fa1455b9f9b34c08ee05

SHA256
4e750798afc6194b8c74af376809bfedca5eaec2af26b931c566f3d17304e2fa

SHA512
5648b338a9d22824402e4651873bb414d7b695eb3d88bd52a60a84e2e3a13cd1803d109181c5d5ef39f8e0548686f64229afc76520f1462f54254b72c33c2b06

Download Submit
C:\Windows\System\zPFvWvv.exe

Filesize
1.8MB

MD5
271349ed6409289f5f717efa2bbe6923

SHA1
ab3a6a254f3894a8f94b812acf24c6c028289371

SHA256
21c5bf0450998e5c4ef51c48a8ebd13b2914f48a7f19b8d5363e2a94438122b4

SHA512
1a4e7d846607777d02f68b96d1811fe8c5c2f00d3089c040e3960dc5f60b3c6d25b3ea26d0e04c477ed8dbbca4938f3430682205a93b0fcbadfec4b0adefb36f

Download Submit
memory/1456-86-0x00007FF7DC780000-0x00007FF7DCB72000-memory.dmp

Filesize
3.9MB

Download
memory/1456-2047-0x00007FF7DC780000-0x00007FF7DCB72000-memory.dmp

Filesize
3.9MB

Download
memory/1460-52-0x00007FF670740000-0x00007FF670B32000-memory.dmp

Filesize
3.9MB

Download
memory/1460-1977-0x00007FF670740000-0x00007FF670B32000-memory.dmp

Filesize
3.9MB

Download
memory/1460-2060-0x00007FF670740000-0x00007FF670B32000-memory.dmp

Filesize
3.9MB

Download
memory/1704-2063-0x00007FF7AAED0000-0x00007FF7AB2C2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-99-0x00007FF7AAED0000-0x00007FF7AB2C2000-memory.dmp

Filesize
3.9MB

Download
memory/1752-2066-0x00007FF6F5D90000-0x00007FF6F6182000-memory.dmp

Filesize
3.9MB

Download
memory/1752-446-0x00007FF6F5D90000-0x00007FF6F6182000-memory.dmp

Filesize
3.9MB

Download
memory/1872-2025-0x00007FF703CE0000-0x00007FF7040D2000-memory.dmp

Filesize
3.9MB

Download
memory/1872-30-0x00007FF703CE0000-0x00007FF7040D2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-51-0x00007FF759B00000-0x00007FF759EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-2054-0x00007FF759B00000-0x00007FF759EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-1975-0x00007FF759B00000-0x00007FF759EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-2079-0x00007FF6F2350000-0x00007FF6F2742000-memory.dmp

Filesize
3.9MB

Download
memory/2172-462-0x00007FF6F2350000-0x00007FF6F2742000-memory.dmp

Filesize
3.9MB

Download
memory/2196-0-0x00007FF63D340000-0x00007FF63D732000-memory.dmp

Filesize
3.9MB

Download
memory/2196-1-0x00000269CC5E0000-0x00000269CC5F0000-memory.dmp

Filesize
64KB

Download
memory/2268-24-0x00007FF7E3FF0000-0x00007FF7E43E2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-2023-0x00007FF7E3FF0000-0x00007FF7E43E2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-2052-0x00007FF72A0F0000-0x00007FF72A4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-81-0x00007FF72A0F0000-0x00007FF72A4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-2081-0x00007FF6658C0000-0x00007FF665CB2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-444-0x00007FF6658C0000-0x00007FF665CB2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-89-0x00007FF6E87C0000-0x00007FF6E8BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-2061-0x00007FF6E87C0000-0x00007FF6E8BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-445-0x00007FF76FF10000-0x00007FF770302000-memory.dmp

Filesize
3.9MB

Download
memory/2908-2084-0x00007FF76FF10000-0x00007FF770302000-memory.dmp

Filesize
3.9MB

Download
memory/3076-41-0x00007FF60C790000-0x00007FF60CB82000-memory.dmp

Filesize
3.9MB

Download
memory/3076-2049-0x00007FF60C790000-0x00007FF60CB82000-memory.dmp

Filesize
3.9MB

Download
memory/3116-1974-0x00007FFC54370000-0x00007FFC54E31000-memory.dmp

Filesize
10.8MB

Download
memory/3116-14-0x00007FFC54370000-0x00007FFC54E31000-memory.dmp

Filesize
10.8MB

Download
memory/3116-1976-0x0000020B917A0000-0x0000020B917B0000-memory.dmp

Filesize
64KB

Download
memory/3116-19-0x0000020B917A0000-0x0000020B917B0000-memory.dmp

Filesize
64KB

Download
memory/3116-2006-0x0000020B917A0000-0x0000020B917B0000-memory.dmp

Filesize
64KB

Download
memory/3116-2018-0x00007FFC54370000-0x00007FFC54E31000-memory.dmp

Filesize
10.8MB

Download
memory/3116-75-0x0000020BABC80000-0x0000020BABCA2000-memory.dmp

Filesize
136KB

Download
memory/3116-383-0x0000020BAC7F0000-0x0000020BACF96000-memory.dmp

Filesize
7.6MB

Download
memory/3364-440-0x00007FF671BB0000-0x00007FF671FA2000-memory.dmp

Filesize
3.9MB

Download
memory/3364-2076-0x00007FF671BB0000-0x00007FF671FA2000-memory.dmp

Filesize
3.9MB

Download
memory/3912-100-0x00007FF68FBB0000-0x00007FF68FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/3912-2074-0x00007FF68FBB0000-0x00007FF68FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/3964-441-0x00007FF62DAD0000-0x00007FF62DEC2000-memory.dmp

Filesize
3.9MB

Download
memory/3964-2070-0x00007FF62DAD0000-0x00007FF62DEC2000-memory.dmp

Filesize
3.9MB

Download
memory/4140-442-0x00007FF74EDF0000-0x00007FF74F1E2000-memory.dmp

Filesize
3.9MB

Download
memory/4140-2068-0x00007FF74EDF0000-0x00007FF74F1E2000-memory.dmp

Filesize
3.9MB

Download
memory/4404-90-0x00007FF6EBF20000-0x00007FF6EC312000-memory.dmp

Filesize
3.9MB

Download
memory/4404-2056-0x00007FF6EBF20000-0x00007FF6EC312000-memory.dmp

Filesize
3.9MB

Download
memory/4428-112-0x00007FF686DE0000-0x00007FF6871D2000-memory.dmp

Filesize
3.9MB

Download
memory/4428-2058-0x00007FF686DE0000-0x00007FF6871D2000-memory.dmp

Filesize
3.9MB

Download
memory/4724-443-0x00007FF7CD580000-0x00007FF7CD972000-memory.dmp

Filesize
3.9MB

Download
memory/4724-2078-0x00007FF7CD580000-0x00007FF7CD972000-memory.dmp

Filesize
3.9MB

Download
memory/5092-104-0x00007FF7562E0000-0x00007FF7566D2000-memory.dmp

Filesize
3.9MB

Download
memory/5092-2071-0x00007FF7562E0000-0x00007FF7566D2000-memory.dmp

Filesize
3.9MB

Download