xmrig | e2ec00b8eab9f6ad6b7f9aa60433e279221f66f19bd3cff173509ab8f15de524

Analysis

max time kernel
40s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
Size 2.3MB
Sample240429-ekf8sshg6v
SHA256 e2ec00b8eab9f6ad6b7f9aa60433e279221f66f19bd3cff173509ab8f15de524
MD5 06c56a6d346186f50aa7dc813c26dedb
SHA1 9b6482eb5194012964f0d246df25eaf1a8d475d0
SHA512 3d53442edaffcd90be88a61d5c2c3f1202f1785921dc0de6f7d38352dba3b7918a312e24aa44ca6b2956ed81283d939b0c32de2e9a12daf28b7c7a8fa0825cc6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDs:NAB3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral2/memory/536-83-0x00007FF741040000-0x00007FF741432000-memory.dmp	xmrig
behavioral2/memory/5060-96-0x00007FF6FF8D0000-0x00007FF6FFCC2000-memory.dmp	xmrig
behavioral2/memory/3068-100-0x00007FF7EB4C0000-0x00007FF7EB8B2000-memory.dmp	xmrig
behavioral2/memory/2900-103-0x00007FF7426C0000-0x00007FF742AB2000-memory.dmp	xmrig
behavioral2/memory/5024-108-0x00007FF6A7990000-0x00007FF6A7D82000-memory.dmp	xmrig
behavioral2/memory/2024-107-0x00007FF7753D0000-0x00007FF7757C2000-memory.dmp	xmrig
behavioral2/memory/2376-106-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp	xmrig
behavioral2/memory/2288-102-0x00007FF61C900000-0x00007FF61CCF2000-memory.dmp	xmrig
behavioral2/memory/3976-90-0x00007FF7780F0000-0x00007FF7784E2000-memory.dmp	xmrig
behavioral2/memory/4084-84-0x00007FF75C290000-0x00007FF75C682000-memory.dmp	xmrig
behavioral2/memory/3648-77-0x00007FF6DF010000-0x00007FF6DF402000-memory.dmp	xmrig
behavioral2/memory/2152-47-0x00007FF7CCA80000-0x00007FF7CCE72000-memory.dmp	xmrig
behavioral2/memory/2780-40-0x00007FF6DE030000-0x00007FF6DE422000-memory.dmp	xmrig
behavioral2/memory/1552-32-0x00007FF6E3700000-0x00007FF6E3AF2000-memory.dmp	xmrig
behavioral2/memory/1708-149-0x00007FF7B20E0000-0x00007FF7B24D2000-memory.dmp	xmrig
behavioral2/memory/3856-145-0x00007FF74E2D0000-0x00007FF74E6C2000-memory.dmp	xmrig
behavioral2/memory/3532-121-0x00007FF661C70000-0x00007FF662062000-memory.dmp	xmrig
behavioral2/memory/2268-2477-0x00007FF605B00000-0x00007FF605EF2000-memory.dmp	xmrig
behavioral2/memory/2376-3341-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp	xmrig
behavioral2/memory/3416-3780-0x00007FF78EF40000-0x00007FF78F332000-memory.dmp	xmrig
behavioral2/memory/948-3782-0x00007FF777330000-0x00007FF777722000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3976	KeNJeOI.exe
1552	UPVjmYW.exe
2780	prfWXsp.exe
2152	HFpSkue.exe
5060	AWPlgzL.exe
2268	hBQblYO.exe
3648	sEkyfPZ.exe
3068	TKZxSbq.exe
536	zPTptnV.exe
2288	fJOANME.exe
2900	RTyzDMk.exe
2376	JQFxqTd.exe
4084	GXoRxNt.exe
2024	rdxvFpy.exe
5024	DWVYdzD.exe
3416	MXZLQoh.exe
3532	GUxuMGI.exe
3856	iRjLwsg.exe
4892	UOfNoqo.exe
948	xwZSUrD.exe
1708	uUvdPeF.exe
2700	pGCaKhV.exe
4380	iyjyWfS.exe
3964	lFJAfyl.exe
1856	DDaeSoD.exe
3288	GIjXrPK.exe
4220	BPpdZNh.exe
4404	dUEVdKH.exe
3996	vBrVnPc.exe
5016	SFmlUTD.exe
976	rbIXzof.exe
4608	tOkmeAs.exe
3916	YBtHlJc.exe
4056	jPXrLUv.exe
3212	mkTQZbr.exe
2252	tsWeNUS.exe
1764	dGbfnXj.exe
4048	nVSzdyI.exe
2732	bzKMLhQ.exe
2084	mELRmvn.exe
4320	CGbozbk.exe
4764	iaEsKtR.exe
3960	dMbgFfM.exe
4000	lhtoLlh.exe
1020	Zvfzwmo.exe
3244	lAgASuD.exe
2828	iWAynMK.exe
4836	EklWUyI.exe
1108	cCHZULw.exe
3560	MTjXLDs.exe
1444	BnFRlQj.exe
1600	RBDyzyb.exe
2412	jFzzwTG.exe
1176	Ikjjnsj.exe
1416	txtKuao.exe
4788	FVMihWI.exe
1332	POEVCkW.exe
4828	fVuoKye.exe
4624	LMTINTY.exe
532	GubyXwc.exe
4176	zCCubMC.exe
372	zaajEyc.exe
1784	CZeuiqT.exe
4492	fXmsiGE.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3772-0-0x00007FF61C4E0000-0x00007FF61C8D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb6-11.dat	upx
behavioral2/files/0x000a000000023bb5-10.dat	upx
behavioral2/files/0x000a000000023bb8-21.dat	upx
behavioral2/files/0x000a000000023bbc-48.dat	upx
behavioral2/files/0x0031000000023bbd-53.dat	upx
behavioral2/memory/536-83-0x00007FF741040000-0x00007FF741432000-memory.dmp	upx
behavioral2/files/0x0031000000023bbe-86.dat	upx
behavioral2/memory/5060-96-0x00007FF6FF8D0000-0x00007FF6FFCC2000-memory.dmp	upx
behavioral2/memory/3068-100-0x00007FF7EB4C0000-0x00007FF7EB8B2000-memory.dmp	upx
behavioral2/memory/2900-103-0x00007FF7426C0000-0x00007FF742AB2000-memory.dmp	upx
behavioral2/memory/5024-108-0x00007FF6A7990000-0x00007FF6A7D82000-memory.dmp	upx
behavioral2/files/0x000c000000023bb1-110.dat	upx
behavioral2/memory/3416-109-0x00007FF78EF40000-0x00007FF78F332000-memory.dmp	upx
behavioral2/memory/2024-107-0x00007FF7753D0000-0x00007FF7757C2000-memory.dmp	upx
behavioral2/memory/2376-106-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp	upx
behavioral2/memory/2288-102-0x00007FF61C900000-0x00007FF61CCF2000-memory.dmp	upx
behavioral2/files/0x000b000000023bc1-101.dat	upx
behavioral2/files/0x000a000000023bc3-97.dat	upx
behavioral2/files/0x0031000000023bbf-92.dat	upx
behavioral2/memory/3976-90-0x00007FF7780F0000-0x00007FF7784E2000-memory.dmp	upx
behavioral2/memory/4084-84-0x00007FF75C290000-0x00007FF75C682000-memory.dmp	upx
behavioral2/files/0x000a000000023bc2-80.dat	upx
behavioral2/memory/3648-77-0x00007FF6DF010000-0x00007FF6DF402000-memory.dmp	upx
behavioral2/memory/2268-57-0x00007FF605B00000-0x00007FF605EF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-51.dat	upx
behavioral2/memory/2152-47-0x00007FF7CCA80000-0x00007FF7CCE72000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-46.dat	upx
behavioral2/files/0x000a000000023bb7-44.dat	upx
behavioral2/memory/2780-40-0x00007FF6DE030000-0x00007FF6DE422000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-34.dat	upx
behavioral2/memory/1552-32-0x00007FF6E3700000-0x00007FF6E3AF2000-memory.dmp	upx
behavioral2/files/0x000c000000023ba4-20.dat	upx
behavioral2/files/0x000a000000023bc4-114.dat	upx
behavioral2/files/0x000a000000023bc5-122.dat	upx
behavioral2/files/0x000a000000023bc6-126.dat	upx
behavioral2/memory/4892-130-0x00007FF7EC480000-0x00007FF7EC872000-memory.dmp	upx
behavioral2/files/0x000a000000023bc7-142.dat	upx
behavioral2/files/0x000a000000023bc9-144.dat	upx
behavioral2/files/0x000a000000023bc8-156.dat	upx
behavioral2/files/0x000a000000023bcd-167.dat	upx
behavioral2/files/0x000a000000023bce-172.dat	upx
behavioral2/files/0x000a000000023bd1-187.dat	upx
behavioral2/files/0x000a000000023bd3-197.dat	upx
behavioral2/files/0x000a000000023bd2-192.dat	upx
behavioral2/files/0x000a000000023bd0-190.dat	upx
behavioral2/files/0x000a000000023bcf-185.dat	upx
behavioral2/files/0x000a000000023bcc-170.dat	upx
behavioral2/files/0x000a000000023bcb-161.dat	upx
behavioral2/files/0x000a000000023bca-160.dat	upx
behavioral2/memory/1708-149-0x00007FF7B20E0000-0x00007FF7B24D2000-memory.dmp	upx
behavioral2/memory/3856-145-0x00007FF74E2D0000-0x00007FF74E6C2000-memory.dmp	upx
behavioral2/memory/948-136-0x00007FF777330000-0x00007FF777722000-memory.dmp	upx
behavioral2/files/0x000b000000023bc0-135.dat	upx
behavioral2/memory/3532-121-0x00007FF661C70000-0x00007FF662062000-memory.dmp	upx
behavioral2/memory/2268-2477-0x00007FF605B00000-0x00007FF605EF2000-memory.dmp	upx
behavioral2/memory/2376-3341-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp	upx
behavioral2/memory/3416-3780-0x00007FF78EF40000-0x00007FF78F332000-memory.dmp	upx
behavioral2/memory/948-3782-0x00007FF777330000-0x00007FF777722000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WIhAGoS.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\IWgxCUe.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\XzKwUoz.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\rvJUbmz.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\YBNslPV.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\wBgtVMf.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\oCQuNPT.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\ZMPdzuH.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\gIpiCJZ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\bssapdJ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\PrceEXt.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\mrhXeyl.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\xauHseG.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\Qgglger.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\OtMmWay.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\HrpyAky.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\mZqBhQw.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\OFzdRXo.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\eLyuqCR.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\dWiujmS.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\llQMPJP.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\RUBavkq.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\rdxvFpy.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\MocEgnp.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\jYdrrYc.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\RZFUqOT.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\jsdoDMQ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\OEpylKS.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\ZYxuOEa.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\EjAvPxz.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\RlXSunN.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\GYdFULT.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\IomHuGg.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\iAqlhNK.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\rtCPBpX.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\uYxBYGC.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\CkqkHJQ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\KlratbE.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\clsmZAb.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\dORdpSu.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\DZrUMsH.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\EvcKKvq.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\GtUwAVU.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\oSQZgGe.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\diPvUOU.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\oRmGTRe.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\BfvKqBc.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\SDpKlSZ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\lBcSosm.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\KfMuhrO.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\asRJcgO.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\iPLbiOj.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\IoKRxgp.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\FpFZVPK.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\YYnBIrw.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\BDzlnBW.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\QIahNHd.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\gElkvsj.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\QzssVrP.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\KjTVVku.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\OshTpKK.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\IJyBFui.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\tVVgHiY.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\sqBUzQp.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4372	powershell.exe
4372	powershell.exe
4372	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeLockMemoryPrivilege	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 4372	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	84
PID 3772 wrote to memory of 4372	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	84
PID 3772 wrote to memory of 3976	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	85
PID 3772 wrote to memory of 3976	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	85
PID 3772 wrote to memory of 1552	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	86
PID 3772 wrote to memory of 1552	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	86
PID 3772 wrote to memory of 2780	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	87
PID 3772 wrote to memory of 2780	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	87
PID 3772 wrote to memory of 5060	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	88
PID 3772 wrote to memory of 5060	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	88
PID 3772 wrote to memory of 2152	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	89
PID 3772 wrote to memory of 2152	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	89
PID 3772 wrote to memory of 2268	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	90
PID 3772 wrote to memory of 2268	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	90
PID 3772 wrote to memory of 3648	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	91
PID 3772 wrote to memory of 3648	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	91
PID 3772 wrote to memory of 3068	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	92
PID 3772 wrote to memory of 3068	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	92
PID 3772 wrote to memory of 536	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	93
PID 3772 wrote to memory of 536	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	93
PID 3772 wrote to memory of 2288	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	94
PID 3772 wrote to memory of 2288	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	94
PID 3772 wrote to memory of 2900	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	95
PID 3772 wrote to memory of 2900	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	95
PID 3772 wrote to memory of 2376	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	96
PID 3772 wrote to memory of 2376	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	96
PID 3772 wrote to memory of 4084	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	97
PID 3772 wrote to memory of 4084	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	97
PID 3772 wrote to memory of 2024	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	98
PID 3772 wrote to memory of 2024	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	98
PID 3772 wrote to memory of 5024	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	99
PID 3772 wrote to memory of 5024	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	99
PID 3772 wrote to memory of 3416	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	100
PID 3772 wrote to memory of 3416	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	100
PID 3772 wrote to memory of 3532	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	101
PID 3772 wrote to memory of 3532	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	101
PID 3772 wrote to memory of 4892	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	102
PID 3772 wrote to memory of 4892	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	102
PID 3772 wrote to memory of 3856	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	103
PID 3772 wrote to memory of 3856	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	103
PID 3772 wrote to memory of 948	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	104
PID 3772 wrote to memory of 948	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	104
PID 3772 wrote to memory of 1708	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	105
PID 3772 wrote to memory of 1708	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	105
PID 3772 wrote to memory of 2700	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	106
PID 3772 wrote to memory of 2700	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	106
PID 3772 wrote to memory of 4380	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	107
PID 3772 wrote to memory of 4380	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	107
PID 3772 wrote to memory of 3964	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	108
PID 3772 wrote to memory of 3964	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	108
PID 3772 wrote to memory of 1856	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	109
PID 3772 wrote to memory of 1856	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	109
PID 3772 wrote to memory of 3288	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	110
PID 3772 wrote to memory of 3288	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	110
PID 3772 wrote to memory of 4220	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	111
PID 3772 wrote to memory of 4220	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	111
PID 3772 wrote to memory of 4404	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	112
PID 3772 wrote to memory of 4404	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	112
PID 3772 wrote to memory of 3996	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	113
PID 3772 wrote to memory of 3996	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	113
PID 3772 wrote to memory of 5016	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	114
PID 3772 wrote to memory of 5016	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	114
PID 3772 wrote to memory of 976	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	115
PID 3772 wrote to memory of 976	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4372
- C:\Windows\System\KeNJeOI.exe
  C:\Windows\System\KeNJeOI.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\UPVjmYW.exe
  C:\Windows\System\UPVjmYW.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\prfWXsp.exe
  C:\Windows\System\prfWXsp.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\AWPlgzL.exe
  C:\Windows\System\AWPlgzL.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\HFpSkue.exe
  C:\Windows\System\HFpSkue.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\hBQblYO.exe
  C:\Windows\System\hBQblYO.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\sEkyfPZ.exe
  C:\Windows\System\sEkyfPZ.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\TKZxSbq.exe
  C:\Windows\System\TKZxSbq.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\zPTptnV.exe
  C:\Windows\System\zPTptnV.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\fJOANME.exe
  C:\Windows\System\fJOANME.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\RTyzDMk.exe
  C:\Windows\System\RTyzDMk.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\JQFxqTd.exe
  C:\Windows\System\JQFxqTd.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\GXoRxNt.exe
  C:\Windows\System\GXoRxNt.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\rdxvFpy.exe
  C:\Windows\System\rdxvFpy.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\DWVYdzD.exe
  C:\Windows\System\DWVYdzD.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\MXZLQoh.exe
  C:\Windows\System\MXZLQoh.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\GUxuMGI.exe
  C:\Windows\System\GUxuMGI.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\UOfNoqo.exe
  C:\Windows\System\UOfNoqo.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\iRjLwsg.exe
  C:\Windows\System\iRjLwsg.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\xwZSUrD.exe
  C:\Windows\System\xwZSUrD.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\uUvdPeF.exe
  C:\Windows\System\uUvdPeF.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\pGCaKhV.exe
  C:\Windows\System\pGCaKhV.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\iyjyWfS.exe
  C:\Windows\System\iyjyWfS.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\lFJAfyl.exe
  C:\Windows\System\lFJAfyl.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\DDaeSoD.exe
  C:\Windows\System\DDaeSoD.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\GIjXrPK.exe
  C:\Windows\System\GIjXrPK.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\BPpdZNh.exe
  C:\Windows\System\BPpdZNh.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\dUEVdKH.exe
  C:\Windows\System\dUEVdKH.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\vBrVnPc.exe
  C:\Windows\System\vBrVnPc.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\SFmlUTD.exe
  C:\Windows\System\SFmlUTD.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\rbIXzof.exe
  C:\Windows\System\rbIXzof.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\tOkmeAs.exe
  C:\Windows\System\tOkmeAs.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\YBtHlJc.exe
  C:\Windows\System\YBtHlJc.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\jPXrLUv.exe
  C:\Windows\System\jPXrLUv.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\mkTQZbr.exe
  C:\Windows\System\mkTQZbr.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\tsWeNUS.exe
  C:\Windows\System\tsWeNUS.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\dGbfnXj.exe
  C:\Windows\System\dGbfnXj.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\nVSzdyI.exe
  C:\Windows\System\nVSzdyI.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\bzKMLhQ.exe
  C:\Windows\System\bzKMLhQ.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\mELRmvn.exe
  C:\Windows\System\mELRmvn.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\CGbozbk.exe
  C:\Windows\System\CGbozbk.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\iaEsKtR.exe
  C:\Windows\System\iaEsKtR.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\dMbgFfM.exe
  C:\Windows\System\dMbgFfM.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\lhtoLlh.exe
  C:\Windows\System\lhtoLlh.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\Zvfzwmo.exe
  C:\Windows\System\Zvfzwmo.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\lAgASuD.exe
  C:\Windows\System\lAgASuD.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\iWAynMK.exe
  C:\Windows\System\iWAynMK.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\EklWUyI.exe
  C:\Windows\System\EklWUyI.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\cCHZULw.exe
  C:\Windows\System\cCHZULw.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\MTjXLDs.exe
  C:\Windows\System\MTjXLDs.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\BnFRlQj.exe
  C:\Windows\System\BnFRlQj.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\RBDyzyb.exe
  C:\Windows\System\RBDyzyb.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\jFzzwTG.exe
  C:\Windows\System\jFzzwTG.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\Ikjjnsj.exe
  C:\Windows\System\Ikjjnsj.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\txtKuao.exe
  C:\Windows\System\txtKuao.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\FVMihWI.exe
  C:\Windows\System\FVMihWI.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\POEVCkW.exe
  C:\Windows\System\POEVCkW.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\fVuoKye.exe
  C:\Windows\System\fVuoKye.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\LMTINTY.exe
  C:\Windows\System\LMTINTY.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\GubyXwc.exe
  C:\Windows\System\GubyXwc.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\zCCubMC.exe
  C:\Windows\System\zCCubMC.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\zaajEyc.exe
  C:\Windows\System\zaajEyc.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\CZeuiqT.exe
  C:\Windows\System\CZeuiqT.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\fXmsiGE.exe
  C:\Windows\System\fXmsiGE.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\wCCdToG.exe
  C:\Windows\System\wCCdToG.exe
  2⤵
  PID:4480
- C:\Windows\System\JGAMcjn.exe
  C:\Windows\System\JGAMcjn.exe
  2⤵
  PID:4468
- C:\Windows\System\JvWxnLo.exe
  C:\Windows\System\JvWxnLo.exe
  2⤵
  PID:1036
- C:\Windows\System\GrKzZsz.exe
  C:\Windows\System\GrKzZsz.exe
  2⤵
  PID:3896
- C:\Windows\System\GUyscRt.exe
  C:\Windows\System\GUyscRt.exe
  2⤵
  PID:3484
- C:\Windows\System\HifXgfP.exe
  C:\Windows\System\HifXgfP.exe
  2⤵
  PID:3636
- C:\Windows\System\ojVBJBU.exe
  C:\Windows\System\ojVBJBU.exe
  2⤵
  PID:5040
- C:\Windows\System\iwRsvbo.exe
  C:\Windows\System\iwRsvbo.exe
  2⤵
  PID:2740
- C:\Windows\System\VGlYGHB.exe
  C:\Windows\System\VGlYGHB.exe
  2⤵
  PID:5092
- C:\Windows\System\dCYGkga.exe
  C:\Windows\System\dCYGkga.exe
  2⤵
  PID:364
- C:\Windows\System\DYRHOXO.exe
  C:\Windows\System\DYRHOXO.exe
  2⤵
  PID:1816
- C:\Windows\System\pHCUWpx.exe
  C:\Windows\System\pHCUWpx.exe
  2⤵
  PID:1328
- C:\Windows\System\aKkrGHa.exe
  C:\Windows\System\aKkrGHa.exe
  2⤵
  PID:1776
- C:\Windows\System\REbNztU.exe
  C:\Windows\System\REbNztU.exe
  2⤵
  PID:4924
- C:\Windows\System\mlIZdpW.exe
  C:\Windows\System\mlIZdpW.exe
  2⤵
  PID:4036
- C:\Windows\System\zULsNvj.exe
  C:\Windows\System\zULsNvj.exe
  2⤵
  PID:3108
- C:\Windows\System\SuxWZFN.exe
  C:\Windows\System\SuxWZFN.exe
  2⤵
  PID:3596
- C:\Windows\System\xdGUXgp.exe
  C:\Windows\System\xdGUXgp.exe
  2⤵
  PID:2408
- C:\Windows\System\ofjbDrx.exe
  C:\Windows\System\ofjbDrx.exe
  2⤵
  PID:1472
- C:\Windows\System\lNVvfGM.exe
  C:\Windows\System\lNVvfGM.exe
  2⤵
  PID:2544
- C:\Windows\System\omKBePr.exe
  C:\Windows\System\omKBePr.exe
  2⤵
  PID:3616
- C:\Windows\System\PVTVVYx.exe
  C:\Windows\System\PVTVVYx.exe
  2⤵
  PID:3736
- C:\Windows\System\vQfKZKZ.exe
  C:\Windows\System\vQfKZKZ.exe
  2⤵
  PID:4336
- C:\Windows\System\QvVRppO.exe
  C:\Windows\System\QvVRppO.exe
  2⤵
  PID:2156
- C:\Windows\System\JZTCwOz.exe
  C:\Windows\System\JZTCwOz.exe
  2⤵
  PID:2628
- C:\Windows\System\BHBdQjc.exe
  C:\Windows\System\BHBdQjc.exe
  2⤵
  PID:968
- C:\Windows\System\lOUpmbn.exe
  C:\Windows\System\lOUpmbn.exe
  2⤵
  PID:5136
- C:\Windows\System\CqogZJb.exe
  C:\Windows\System\CqogZJb.exe
  2⤵
  PID:5160
- C:\Windows\System\cdVSoIk.exe
  C:\Windows\System\cdVSoIk.exe
  2⤵
  PID:5188
- C:\Windows\System\EnHALEx.exe
  C:\Windows\System\EnHALEx.exe
  2⤵
  PID:5216
- C:\Windows\System\FIpIkzK.exe
  C:\Windows\System\FIpIkzK.exe
  2⤵
  PID:5244
- C:\Windows\System\XCVJTBd.exe
  C:\Windows\System\XCVJTBd.exe
  2⤵
  PID:5276
- C:\Windows\System\SrutEvX.exe
  C:\Windows\System\SrutEvX.exe
  2⤵
  PID:5308
- C:\Windows\System\axrfdru.exe
  C:\Windows\System\axrfdru.exe
  2⤵
  PID:5340
- C:\Windows\System\kaSDJpE.exe
  C:\Windows\System\kaSDJpE.exe
  2⤵
  PID:5368
- C:\Windows\System\kyMjQzr.exe
  C:\Windows\System\kyMjQzr.exe
  2⤵
  PID:5400
- C:\Windows\System\QpCyTvh.exe
  C:\Windows\System\QpCyTvh.exe
  2⤵
  PID:5428
- C:\Windows\System\aoopCgQ.exe
  C:\Windows\System\aoopCgQ.exe
  2⤵
  PID:5452
- C:\Windows\System\KqIPhQB.exe
  C:\Windows\System\KqIPhQB.exe
  2⤵
  PID:5476
- C:\Windows\System\zljbmqi.exe
  C:\Windows\System\zljbmqi.exe
  2⤵
  PID:5516
- C:\Windows\System\noOoIYS.exe
  C:\Windows\System\noOoIYS.exe
  2⤵
  PID:5552
- C:\Windows\System\ATovDWD.exe
  C:\Windows\System\ATovDWD.exe
  2⤵
  PID:5568
- C:\Windows\System\wOEdpgR.exe
  C:\Windows\System\wOEdpgR.exe
  2⤵
  PID:5584
- C:\Windows\System\kEHCKQj.exe
  C:\Windows\System\kEHCKQj.exe
  2⤵
  PID:5612
- C:\Windows\System\TxHkXbK.exe
  C:\Windows\System\TxHkXbK.exe
  2⤵
  PID:5632
- C:\Windows\System\FKkDsPw.exe
  C:\Windows\System\FKkDsPw.exe
  2⤵
  PID:5648
- C:\Windows\System\iAqlhNK.exe
  C:\Windows\System\iAqlhNK.exe
  2⤵
  PID:5688
- C:\Windows\System\DdtgTKt.exe
  C:\Windows\System\DdtgTKt.exe
  2⤵
  PID:5712
- C:\Windows\System\VpjjKNa.exe
  C:\Windows\System\VpjjKNa.exe
  2⤵
  PID:5740
- C:\Windows\System\PZCBZEP.exe
  C:\Windows\System\PZCBZEP.exe
  2⤵
  PID:5756
- C:\Windows\System\hQVcnmV.exe
  C:\Windows\System\hQVcnmV.exe
  2⤵
  PID:5776
- C:\Windows\System\hzSxYvJ.exe
  C:\Windows\System\hzSxYvJ.exe
  2⤵
  PID:5804
- C:\Windows\System\RAkYcdk.exe
  C:\Windows\System\RAkYcdk.exe
  2⤵
  PID:5832
- C:\Windows\System\CQbxYpb.exe
  C:\Windows\System\CQbxYpb.exe
  2⤵
  PID:5908
- C:\Windows\System\hOLaUvZ.exe
  C:\Windows\System\hOLaUvZ.exe
  2⤵
  PID:5924
- C:\Windows\System\CRcGVJb.exe
  C:\Windows\System\CRcGVJb.exe
  2⤵
  PID:5948
- C:\Windows\System\UkjlcGx.exe
  C:\Windows\System\UkjlcGx.exe
  2⤵
  PID:5992
- C:\Windows\System\msieUoY.exe
  C:\Windows\System\msieUoY.exe
  2⤵
  PID:6016
- C:\Windows\System\efAMXzt.exe
  C:\Windows\System\efAMXzt.exe
  2⤵
  PID:6036
- C:\Windows\System\ZAsNrzC.exe
  C:\Windows\System\ZAsNrzC.exe
  2⤵
  PID:6064
- C:\Windows\System\xhplbUz.exe
  C:\Windows\System\xhplbUz.exe
  2⤵
  PID:6084
- C:\Windows\System\wTRbsAM.exe
  C:\Windows\System\wTRbsAM.exe
  2⤵
  PID:6108
- C:\Windows\System\eQShxHW.exe
  C:\Windows\System\eQShxHW.exe
  2⤵
  PID:6136
- C:\Windows\System\pQsrHgY.exe
  C:\Windows\System\pQsrHgY.exe
  2⤵
  PID:116
- C:\Windows\System\jxzoroF.exe
  C:\Windows\System\jxzoroF.exe
  2⤵
  PID:1608
- C:\Windows\System\OWIDtlf.exe
  C:\Windows\System\OWIDtlf.exe
  2⤵
  PID:5124
- C:\Windows\System\ZYxuOEa.exe
  C:\Windows\System\ZYxuOEa.exe
  2⤵
  PID:836
- C:\Windows\System\KbkuahU.exe
  C:\Windows\System\KbkuahU.exe
  2⤵
  PID:5236
- C:\Windows\System\MZbJtOn.exe
  C:\Windows\System\MZbJtOn.exe
  2⤵
  PID:1464
- C:\Windows\System\TugWDfw.exe
  C:\Windows\System\TugWDfw.exe
  2⤵
  PID:2264
- C:\Windows\System\StEIjlY.exe
  C:\Windows\System\StEIjlY.exe
  2⤵
  PID:4680
- C:\Windows\System\tLeByut.exe
  C:\Windows\System\tLeByut.exe
  2⤵
  PID:5416
- C:\Windows\System\okVHfBz.exe
  C:\Windows\System\okVHfBz.exe
  2⤵
  PID:3460
- C:\Windows\System\WRvGOfH.exe
  C:\Windows\System\WRvGOfH.exe
  2⤵
  PID:5500
- C:\Windows\System\iGFUnFa.exe
  C:\Windows\System\iGFUnFa.exe
  2⤵
  PID:3096
- C:\Windows\System\XphyVAe.exe
  C:\Windows\System\XphyVAe.exe
  2⤵
  PID:5576
- C:\Windows\System\ufgfAVN.exe
  C:\Windows\System\ufgfAVN.exe
  2⤵
  PID:5644
- C:\Windows\System\QJfElqS.exe
  C:\Windows\System\QJfElqS.exe
  2⤵
  PID:5684
- C:\Windows\System\TxZKyxS.exe
  C:\Windows\System\TxZKyxS.exe
  2⤵
  PID:5696
- C:\Windows\System\qbSDRgX.exe
  C:\Windows\System\qbSDRgX.exe
  2⤵
  PID:5812
- C:\Windows\System\VrQlBqD.exe
  C:\Windows\System\VrQlBqD.exe
  2⤵
  PID:5860
- C:\Windows\System\yqhOgwl.exe
  C:\Windows\System\yqhOgwl.exe
  2⤵
  PID:5916
- C:\Windows\System\OyAtklJ.exe
  C:\Windows\System\OyAtklJ.exe
  2⤵
  PID:6076
- C:\Windows\System\ydfIBFK.exe
  C:\Windows\System\ydfIBFK.exe
  2⤵
  PID:6120
- C:\Windows\System\yWJDWOs.exe
  C:\Windows\System\yWJDWOs.exe
  2⤵
  PID:6124
- C:\Windows\System\mHXZPUx.exe
  C:\Windows\System\mHXZPUx.exe
  2⤵
  PID:5212
- C:\Windows\System\Kyeannk.exe
  C:\Windows\System\Kyeannk.exe
  2⤵
  PID:5352
- C:\Windows\System\DCxNkmW.exe
  C:\Windows\System\DCxNkmW.exe
  2⤵
  PID:5564
- C:\Windows\System\heXeKhl.exe
  C:\Windows\System\heXeKhl.exe
  2⤵
  PID:5540
- C:\Windows\System\cbMgzxt.exe
  C:\Windows\System\cbMgzxt.exe
  2⤵
  PID:5772
- C:\Windows\System\cJLSAtw.exe
  C:\Windows\System\cJLSAtw.exe
  2⤵
  PID:5792
- C:\Windows\System\MfXDBlg.exe
  C:\Windows\System\MfXDBlg.exe
  2⤵
  PID:6012
- C:\Windows\System\HiZwfsr.exe
  C:\Windows\System\HiZwfsr.exe
  2⤵
  PID:2336
- C:\Windows\System\MHPgSeA.exe
  C:\Windows\System\MHPgSeA.exe
  2⤵
  PID:648
- C:\Windows\System\pVpJADF.exe
  C:\Windows\System\pVpJADF.exe
  2⤵
  PID:4760
- C:\Windows\System\FANWeMs.exe
  C:\Windows\System\FANWeMs.exe
  2⤵
  PID:5468
- C:\Windows\System\CAJOOlO.exe
  C:\Windows\System\CAJOOlO.exe
  2⤵
  PID:5604
- C:\Windows\System\lwQdAsr.exe
  C:\Windows\System\lwQdAsr.exe
  2⤵
  PID:6044
- C:\Windows\System\haOzyuv.exe
  C:\Windows\System\haOzyuv.exe
  2⤵
  PID:6156
- C:\Windows\System\tABkDrE.exe
  C:\Windows\System\tABkDrE.exe
  2⤵
  PID:6184
- C:\Windows\System\PKyARGO.exe
  C:\Windows\System\PKyARGO.exe
  2⤵
  PID:6244
- C:\Windows\System\vBRHCKi.exe
  C:\Windows\System\vBRHCKi.exe
  2⤵
  PID:6260
- C:\Windows\System\LwUWuYz.exe
  C:\Windows\System\LwUWuYz.exe
  2⤵
  PID:6320
- C:\Windows\System\kyAjPhI.exe
  C:\Windows\System\kyAjPhI.exe
  2⤵
  PID:6340
- C:\Windows\System\lCwrNeW.exe
  C:\Windows\System\lCwrNeW.exe
  2⤵
  PID:6368
- C:\Windows\System\JqtIJri.exe
  C:\Windows\System\JqtIJri.exe
  2⤵
  PID:6388
- C:\Windows\System\Bxuwbfc.exe
  C:\Windows\System\Bxuwbfc.exe
  2⤵
  PID:6432
- C:\Windows\System\UCDcFTi.exe
  C:\Windows\System\UCDcFTi.exe
  2⤵
  PID:6452
- C:\Windows\System\VgTAdMi.exe
  C:\Windows\System\VgTAdMi.exe
  2⤵
  PID:6480
- C:\Windows\System\jjFxWoc.exe
  C:\Windows\System\jjFxWoc.exe
  2⤵
  PID:6504
- C:\Windows\System\nMDcPPK.exe
  C:\Windows\System\nMDcPPK.exe
  2⤵
  PID:6524
- C:\Windows\System\KAadHdx.exe
  C:\Windows\System\KAadHdx.exe
  2⤵
  PID:6568
- C:\Windows\System\xUhoUcY.exe
  C:\Windows\System\xUhoUcY.exe
  2⤵
  PID:6588
- C:\Windows\System\ywRClgU.exe
  C:\Windows\System\ywRClgU.exe
  2⤵
  PID:6612
- C:\Windows\System\wqXFKMq.exe
  C:\Windows\System\wqXFKMq.exe
  2⤵
  PID:6632
- C:\Windows\System\YNQwQRg.exe
  C:\Windows\System\YNQwQRg.exe
  2⤵
  PID:6684
- C:\Windows\System\rQNzFuf.exe
  C:\Windows\System\rQNzFuf.exe
  2⤵
  PID:6704
- C:\Windows\System\eEWCUsL.exe
  C:\Windows\System\eEWCUsL.exe
  2⤵
  PID:6732
- C:\Windows\System\anjingb.exe
  C:\Windows\System\anjingb.exe
  2⤵
  PID:6752
- C:\Windows\System\TPgdrGY.exe
  C:\Windows\System\TPgdrGY.exe
  2⤵
  PID:6804
- C:\Windows\System\LItVKeR.exe
  C:\Windows\System\LItVKeR.exe
  2⤵
  PID:6832
- C:\Windows\System\YoXzoIo.exe
  C:\Windows\System\YoXzoIo.exe
  2⤵
  PID:6864
- C:\Windows\System\VoeryTt.exe
  C:\Windows\System\VoeryTt.exe
  2⤵
  PID:6884
- C:\Windows\System\aMYFGQi.exe
  C:\Windows\System\aMYFGQi.exe
  2⤵
  PID:6904
- C:\Windows\System\DVBLdHb.exe
  C:\Windows\System\DVBLdHb.exe
  2⤵
  PID:6940
- C:\Windows\System\arqiyLR.exe
  C:\Windows\System\arqiyLR.exe
  2⤵
  PID:6980
- C:\Windows\System\ODyYXii.exe
  C:\Windows\System\ODyYXii.exe
  2⤵
  PID:7008
- C:\Windows\System\feMtvhK.exe
  C:\Windows\System\feMtvhK.exe
  2⤵
  PID:7036
- C:\Windows\System\rYGUbRV.exe
  C:\Windows\System\rYGUbRV.exe
  2⤵
  PID:7068
- C:\Windows\System\zYpsvKV.exe
  C:\Windows\System\zYpsvKV.exe
  2⤵
  PID:7088
- C:\Windows\System\BmqyKBL.exe
  C:\Windows\System\BmqyKBL.exe
  2⤵
  PID:7108
- C:\Windows\System\rCIRGsu.exe
  C:\Windows\System\rCIRGsu.exe
  2⤵
  PID:7132
- C:\Windows\System\TehgXHb.exe
  C:\Windows\System\TehgXHb.exe
  2⤵
  PID:5720
- C:\Windows\System\ZNYatpq.exe
  C:\Windows\System\ZNYatpq.exe
  2⤵
  PID:5208
- C:\Windows\System\yvKPApM.exe
  C:\Windows\System\yvKPApM.exe
  2⤵
  PID:5496
- C:\Windows\System\EvDcaMQ.exe
  C:\Windows\System\EvDcaMQ.exe
  2⤵
  PID:6256
- C:\Windows\System\NVNrXYw.exe
  C:\Windows\System\NVNrXYw.exe
  2⤵
  PID:6280
- C:\Windows\System\sQKwNdK.exe
  C:\Windows\System\sQKwNdK.exe
  2⤵
  PID:6356
- C:\Windows\System\LGtgxmU.exe
  C:\Windows\System\LGtgxmU.exe
  2⤵
  PID:6364
- C:\Windows\System\HurgrAQ.exe
  C:\Windows\System\HurgrAQ.exe
  2⤵
  PID:6448
- C:\Windows\System\yNZlExK.exe
  C:\Windows\System\yNZlExK.exe
  2⤵
  PID:6536
- C:\Windows\System\xSaibkh.exe
  C:\Windows\System\xSaibkh.exe
  2⤵
  PID:6580
- C:\Windows\System\pXJrGmD.exe
  C:\Windows\System\pXJrGmD.exe
  2⤵
  PID:6720
- C:\Windows\System\ZuFJKNz.exe
  C:\Windows\System\ZuFJKNz.exe
  2⤵
  PID:6764
- C:\Windows\System\dcmBQru.exe
  C:\Windows\System\dcmBQru.exe
  2⤵
  PID:6824
- C:\Windows\System\jwVBzQb.exe
  C:\Windows\System\jwVBzQb.exe
  2⤵
  PID:6856
- C:\Windows\System\XehZObX.exe
  C:\Windows\System\XehZObX.exe
  2⤵
  PID:6956
- C:\Windows\System\xzkhQmJ.exe
  C:\Windows\System\xzkhQmJ.exe
  2⤵
  PID:7020
- C:\Windows\System\Hflfwwb.exe
  C:\Windows\System\Hflfwwb.exe
  2⤵
  PID:7116
- C:\Windows\System\LwOdJaa.exe
  C:\Windows\System\LwOdJaa.exe
  2⤵
  PID:7100
- C:\Windows\System\mqjGGZZ.exe
  C:\Windows\System\mqjGGZZ.exe
  2⤵
  PID:7164
- C:\Windows\System\ZLVGZHl.exe
  C:\Windows\System\ZLVGZHl.exe
  2⤵
  PID:6224
- C:\Windows\System\bumHwJz.exe
  C:\Windows\System\bumHwJz.exe
  2⤵
  PID:6332
- C:\Windows\System\aTzODbl.exe
  C:\Windows\System\aTzODbl.exe
  2⤵
  PID:6384
- C:\Windows\System\mesScKn.exe
  C:\Windows\System\mesScKn.exe
  2⤵
  PID:6628
- C:\Windows\System\wfAucnK.exe
  C:\Windows\System\wfAucnK.exe
  2⤵
  PID:6924
- C:\Windows\System\LMZVkPw.exe
  C:\Windows\System\LMZVkPw.exe
  2⤵
  PID:6272
- C:\Windows\System\pHezhun.exe
  C:\Windows\System\pHezhun.exe
  2⤵
  PID:6624
- C:\Windows\System\KJcOgYV.exe
  C:\Windows\System\KJcOgYV.exe
  2⤵
  PID:3628
- C:\Windows\System\rqnlinG.exe
  C:\Windows\System\rqnlinG.exe
  2⤵
  PID:7080
- C:\Windows\System\fgcEPdG.exe
  C:\Windows\System\fgcEPdG.exe
  2⤵
  PID:6724
- C:\Windows\System\oMZVZxH.exe
  C:\Windows\System\oMZVZxH.exe
  2⤵
  PID:7148
- C:\Windows\System\LqDqZCh.exe
  C:\Windows\System\LqDqZCh.exe
  2⤵
  PID:7196
- C:\Windows\System\rFVSlMu.exe
  C:\Windows\System\rFVSlMu.exe
  2⤵
  PID:7224
- C:\Windows\System\BQmkksu.exe
  C:\Windows\System\BQmkksu.exe
  2⤵
  PID:7248
- C:\Windows\System\BOkZOaQ.exe
  C:\Windows\System\BOkZOaQ.exe
  2⤵
  PID:7272
- C:\Windows\System\GdnWLRS.exe
  C:\Windows\System\GdnWLRS.exe
  2⤵
  PID:7296
- C:\Windows\System\opWNbOg.exe
  C:\Windows\System\opWNbOg.exe
  2⤵
  PID:7312
- C:\Windows\System\teMaGaa.exe
  C:\Windows\System\teMaGaa.exe
  2⤵
  PID:7376
- C:\Windows\System\SyunBDN.exe
  C:\Windows\System\SyunBDN.exe
  2⤵
  PID:7396
- C:\Windows\System\DlRZumm.exe
  C:\Windows\System\DlRZumm.exe
  2⤵
  PID:7416
- C:\Windows\System\WymezIS.exe
  C:\Windows\System\WymezIS.exe
  2⤵
  PID:7436
- C:\Windows\System\mpgBwwB.exe
  C:\Windows\System\mpgBwwB.exe
  2⤵
  PID:7508
- C:\Windows\System\vDlcUjC.exe
  C:\Windows\System\vDlcUjC.exe
  2⤵
  PID:7524
- C:\Windows\System\WUGHZqT.exe
  C:\Windows\System\WUGHZqT.exe
  2⤵
  PID:7548
- C:\Windows\System\gUQAlgE.exe
  C:\Windows\System\gUQAlgE.exe
  2⤵
  PID:7568
- C:\Windows\System\GuqKCzP.exe
  C:\Windows\System\GuqKCzP.exe
  2⤵
  PID:7588
- C:\Windows\System\YFygqET.exe
  C:\Windows\System\YFygqET.exe
  2⤵
  PID:7604
- C:\Windows\System\rBYwLRN.exe
  C:\Windows\System\rBYwLRN.exe
  2⤵
  PID:7644
- C:\Windows\System\rRELYZL.exe
  C:\Windows\System\rRELYZL.exe
  2⤵
  PID:7668
- C:\Windows\System\oSQZgGe.exe
  C:\Windows\System\oSQZgGe.exe
  2⤵
  PID:7696
- C:\Windows\System\EaAosFw.exe
  C:\Windows\System\EaAosFw.exe
  2⤵
  PID:7736
- C:\Windows\System\Vfaudza.exe
  C:\Windows\System\Vfaudza.exe
  2⤵
  PID:7764
- C:\Windows\System\nCxNjug.exe
  C:\Windows\System\nCxNjug.exe
  2⤵
  PID:7800
- C:\Windows\System\XnNqHXV.exe
  C:\Windows\System\XnNqHXV.exe
  2⤵
  PID:7816
- C:\Windows\System\ChBRdsD.exe
  C:\Windows\System\ChBRdsD.exe
  2⤵
  PID:7836
- C:\Windows\System\XpVLShQ.exe
  C:\Windows\System\XpVLShQ.exe
  2⤵
  PID:7880
- C:\Windows\System\NYPAeui.exe
  C:\Windows\System\NYPAeui.exe
  2⤵
  PID:7904
- C:\Windows\System\wRdTYmm.exe
  C:\Windows\System\wRdTYmm.exe
  2⤵
  PID:7936
- C:\Windows\System\WSKGdji.exe
  C:\Windows\System\WSKGdji.exe
  2⤵
  PID:7984
- C:\Windows\System\lcjnANa.exe
  C:\Windows\System\lcjnANa.exe
  2⤵
  PID:8000
- C:\Windows\System\pVTuUJb.exe
  C:\Windows\System\pVTuUJb.exe
  2⤵
  PID:8020
- C:\Windows\System\KdnrSjN.exe
  C:\Windows\System\KdnrSjN.exe
  2⤵
  PID:8044
- C:\Windows\System\LbbYryL.exe
  C:\Windows\System\LbbYryL.exe
  2⤵
  PID:8064
- C:\Windows\System\sJvrzxG.exe
  C:\Windows\System\sJvrzxG.exe
  2⤵
  PID:8084
- C:\Windows\System\SgfZKoU.exe
  C:\Windows\System\SgfZKoU.exe
  2⤵
  PID:8152
- C:\Windows\System\NBUQkvD.exe
  C:\Windows\System\NBUQkvD.exe
  2⤵
  PID:8168
- C:\Windows\System\gnOCeDo.exe
  C:\Windows\System\gnOCeDo.exe
  2⤵
  PID:5392
- C:\Windows\System\HQiuhnB.exe
  C:\Windows\System\HQiuhnB.exe
  2⤵
  PID:7220
- C:\Windows\System\KIVxlZx.exe
  C:\Windows\System\KIVxlZx.exe
  2⤵
  PID:7280
- C:\Windows\System\UFWOUAn.exe
  C:\Windows\System\UFWOUAn.exe
  2⤵
  PID:7392
- C:\Windows\System\BdVNmnv.exe
  C:\Windows\System\BdVNmnv.exe
  2⤵
  PID:7424
- C:\Windows\System\BCePxzi.exe
  C:\Windows\System\BCePxzi.exe
  2⤵
  PID:7496
- C:\Windows\System\EfHLZxy.exe
  C:\Windows\System\EfHLZxy.exe
  2⤵
  PID:7536
- C:\Windows\System\BEWeqgr.exe
  C:\Windows\System\BEWeqgr.exe
  2⤵
  PID:7640
- C:\Windows\System\saolQvp.exe
  C:\Windows\System\saolQvp.exe
  2⤵
  PID:7716
- C:\Windows\System\EcTUFDM.exe
  C:\Windows\System\EcTUFDM.exe
  2⤵
  PID:7772
- C:\Windows\System\jDxNsRw.exe
  C:\Windows\System\jDxNsRw.exe
  2⤵
  PID:2220
- C:\Windows\System\HrSgUZZ.exe
  C:\Windows\System\HrSgUZZ.exe
  2⤵
  PID:7872
- C:\Windows\System\vLafTHk.exe
  C:\Windows\System\vLafTHk.exe
  2⤵
  PID:7916
- C:\Windows\System\EcDvaXE.exe
  C:\Windows\System\EcDvaXE.exe
  2⤵
  PID:7960
- C:\Windows\System\GKnepgl.exe
  C:\Windows\System\GKnepgl.exe
  2⤵
  PID:8028
- C:\Windows\System\sRuNUWN.exe
  C:\Windows\System\sRuNUWN.exe
  2⤵
  PID:8132
- C:\Windows\System\xsfJDAX.exe
  C:\Windows\System\xsfJDAX.exe
  2⤵
  PID:8164
- C:\Windows\System\HNjGvEm.exe
  C:\Windows\System\HNjGvEm.exe
  2⤵
  PID:8188
- C:\Windows\System\gAPCQnT.exe
  C:\Windows\System\gAPCQnT.exe
  2⤵
  PID:7240
- C:\Windows\System\yRAzxjd.exe
  C:\Windows\System\yRAzxjd.exe
  2⤵
  PID:7756
- C:\Windows\System\cVPOxIv.exe
  C:\Windows\System\cVPOxIv.exe
  2⤵
  PID:7832
- C:\Windows\System\wEpHlPV.exe
  C:\Windows\System\wEpHlPV.exe
  2⤵
  PID:7896
- C:\Windows\System\NSECXJQ.exe
  C:\Windows\System\NSECXJQ.exe
  2⤵
  PID:8092
- C:\Windows\System\icFsilU.exe
  C:\Windows\System\icFsilU.exe
  2⤵
  PID:7188
- C:\Windows\System\oaDXvuj.exe
  C:\Windows\System\oaDXvuj.exe
  2⤵
  PID:7580
- C:\Windows\System\hkpnvuV.exe
  C:\Windows\System\hkpnvuV.exe
  2⤵
  PID:7448
- C:\Windows\System\UGZqUwG.exe
  C:\Windows\System\UGZqUwG.exe
  2⤵
  PID:996
- C:\Windows\System\SnJKQhu.exe
  C:\Windows\System\SnJKQhu.exe
  2⤵
  PID:8116
- C:\Windows\System\ihHHMgB.exe
  C:\Windows\System\ihHHMgB.exe
  2⤵
  PID:7712
- C:\Windows\System\MUIbdBO.exe
  C:\Windows\System\MUIbdBO.exe
  2⤵
  PID:8200
- C:\Windows\System\fsvDvaR.exe
  C:\Windows\System\fsvDvaR.exe
  2⤵
  PID:8228
- C:\Windows\System\CYTKBat.exe
  C:\Windows\System\CYTKBat.exe
  2⤵
  PID:8252
- C:\Windows\System\pWiHOXa.exe
  C:\Windows\System\pWiHOXa.exe
  2⤵
  PID:8272
- C:\Windows\System\OWlVQot.exe
  C:\Windows\System\OWlVQot.exe
  2⤵
  PID:8296
- C:\Windows\System\gAVVEfH.exe
  C:\Windows\System\gAVVEfH.exe
  2⤵
  PID:8336
- C:\Windows\System\TiXqFLr.exe
  C:\Windows\System\TiXqFLr.exe
  2⤵
  PID:8372
- C:\Windows\System\zDApPxC.exe
  C:\Windows\System\zDApPxC.exe
  2⤵
  PID:8388
- C:\Windows\System\QCwxPUf.exe
  C:\Windows\System\QCwxPUf.exe
  2⤵
  PID:8416
- C:\Windows\System\yCsdRVr.exe
  C:\Windows\System\yCsdRVr.exe
  2⤵
  PID:8436
- C:\Windows\System\rvKwMDT.exe
  C:\Windows\System\rvKwMDT.exe
  2⤵
  PID:8464
- C:\Windows\System\wXYCNXk.exe
  C:\Windows\System\wXYCNXk.exe
  2⤵
  PID:8528
- C:\Windows\System\zTQeemF.exe
  C:\Windows\System\zTQeemF.exe
  2⤵
  PID:8544
- C:\Windows\System\yBaUclh.exe
  C:\Windows\System\yBaUclh.exe
  2⤵
  PID:8564
- C:\Windows\System\wDesvoX.exe
  C:\Windows\System\wDesvoX.exe
  2⤵
  PID:8588
- C:\Windows\System\WCHtJSR.exe
  C:\Windows\System\WCHtJSR.exe
  2⤵
  PID:8608
- C:\Windows\System\WhrJeFk.exe
  C:\Windows\System\WhrJeFk.exe
  2⤵
  PID:8636
- C:\Windows\System\FRimcpj.exe
  C:\Windows\System\FRimcpj.exe
  2⤵
  PID:8672
- C:\Windows\System\woTMoFL.exe
  C:\Windows\System\woTMoFL.exe
  2⤵
  PID:8716
- C:\Windows\System\ToZyrCC.exe
  C:\Windows\System\ToZyrCC.exe
  2⤵
  PID:8744
- C:\Windows\System\VKLbOux.exe
  C:\Windows\System\VKLbOux.exe
  2⤵
  PID:8772
- C:\Windows\System\LCaUomb.exe
  C:\Windows\System\LCaUomb.exe
  2⤵
  PID:8792
- C:\Windows\System\tmXWMhK.exe
  C:\Windows\System\tmXWMhK.exe
  2⤵
  PID:8816
- C:\Windows\System\gIzqEil.exe
  C:\Windows\System\gIzqEil.exe
  2⤵
  PID:8840
- C:\Windows\System\tHECxnh.exe
  C:\Windows\System\tHECxnh.exe
  2⤵
  PID:8868
- C:\Windows\System\pTcQElC.exe
  C:\Windows\System\pTcQElC.exe
  2⤵
  PID:8896
- C:\Windows\System\xLqJNAX.exe
  C:\Windows\System\xLqJNAX.exe
  2⤵
  PID:8916
- C:\Windows\System\cVRCLUI.exe
  C:\Windows\System\cVRCLUI.exe
  2⤵
  PID:8944
- C:\Windows\System\FFgWKii.exe
  C:\Windows\System\FFgWKii.exe
  2⤵
  PID:8964
- C:\Windows\System\atMobYn.exe
  C:\Windows\System\atMobYn.exe
  2⤵
  PID:8988
- C:\Windows\System\eWvTpPm.exe
  C:\Windows\System\eWvTpPm.exe
  2⤵
  PID:9036
- C:\Windows\System\PPxRUVW.exe
  C:\Windows\System\PPxRUVW.exe
  2⤵
  PID:9076
- C:\Windows\System\OScrvHI.exe
  C:\Windows\System\OScrvHI.exe
  2⤵
  PID:9100
- C:\Windows\System\figUGkX.exe
  C:\Windows\System\figUGkX.exe
  2⤵
  PID:9120
- C:\Windows\System\qlTXNaU.exe
  C:\Windows\System\qlTXNaU.exe
  2⤵
  PID:9144
- C:\Windows\System\YlXyEjP.exe
  C:\Windows\System\YlXyEjP.exe
  2⤵
  PID:9164
- C:\Windows\System\OEpylKS.exe
  C:\Windows\System\OEpylKS.exe
  2⤵
  PID:2580
- C:\Windows\System\DKwJIFa.exe
  C:\Windows\System\DKwJIFa.exe
  2⤵
  PID:8196
- C:\Windows\System\wRTKHle.exe
  C:\Windows\System\wRTKHle.exe
  2⤵
  PID:8244
- C:\Windows\System\VWuTUPM.exe
  C:\Windows\System\VWuTUPM.exe
  2⤵
  PID:8332
- C:\Windows\System\BoLrfGq.exe
  C:\Windows\System\BoLrfGq.exe
  2⤵
  PID:8404
- C:\Windows\System\mmORbbJ.exe
  C:\Windows\System\mmORbbJ.exe
  2⤵
  PID:8480
- C:\Windows\System\ccYodLO.exe
  C:\Windows\System\ccYodLO.exe
  2⤵
  PID:8492
- C:\Windows\System\QlkYeXN.exe
  C:\Windows\System\QlkYeXN.exe
  2⤵
  PID:8556
- C:\Windows\System\idktsmy.exe
  C:\Windows\System\idktsmy.exe
  2⤵
  PID:8628
- C:\Windows\System\pEmWMYx.exe
  C:\Windows\System\pEmWMYx.exe
  2⤵
  PID:8712
- C:\Windows\System\KeRIPNZ.exe
  C:\Windows\System\KeRIPNZ.exe
  2⤵
  PID:8764
- C:\Windows\System\fLHfJJL.exe
  C:\Windows\System\fLHfJJL.exe
  2⤵
  PID:7676
- C:\Windows\System\tXyzAHg.exe
  C:\Windows\System\tXyzAHg.exe
  2⤵
  PID:8856
- C:\Windows\System\YHZLDrZ.exe
  C:\Windows\System\YHZLDrZ.exe
  2⤵
  PID:8904
- C:\Windows\System\xQHixPJ.exe
  C:\Windows\System\xQHixPJ.exe
  2⤵
  PID:8976
- C:\Windows\System\dHfZEod.exe
  C:\Windows\System\dHfZEod.exe
  2⤵
  PID:9072
- C:\Windows\System\bkijVVn.exe
  C:\Windows\System\bkijVVn.exe
  2⤵
  PID:9136
- C:\Windows\System\VrNMweb.exe
  C:\Windows\System\VrNMweb.exe
  2⤵
  PID:9140
- C:\Windows\System\iHHwZxA.exe
  C:\Windows\System\iHHwZxA.exe
  2⤵
  PID:8224
- C:\Windows\System\CYUbdBs.exe
  C:\Windows\System\CYUbdBs.exe
  2⤵
  PID:8280
- C:\Windows\System\SHeXgyl.exe
  C:\Windows\System\SHeXgyl.exe
  2⤵
  PID:8524
- C:\Windows\System\oVTZmxb.exe
  C:\Windows\System\oVTZmxb.exe
  2⤵
  PID:8644
- C:\Windows\System\dsWRuez.exe
  C:\Windows\System\dsWRuez.exe
  2⤵
  PID:8736
- C:\Windows\System\lsHLBEr.exe
  C:\Windows\System\lsHLBEr.exe
  2⤵
  PID:8952
- C:\Windows\System\WTFAXtK.exe
  C:\Windows\System\WTFAXtK.exe
  2⤵
  PID:9092
- C:\Windows\System\VXAGAlS.exe
  C:\Windows\System\VXAGAlS.exe
  2⤵
  PID:8316
- C:\Windows\System\zCQQxXP.exe
  C:\Windows\System\zCQQxXP.exe
  2⤵
  PID:8808
- C:\Windows\System\bDdckjW.exe
  C:\Windows\System\bDdckjW.exe
  2⤵
  PID:9028
- C:\Windows\System\ArKlzkh.exe
  C:\Windows\System\ArKlzkh.exe
  2⤵
  PID:544
- C:\Windows\System\dHnEYqo.exe
  C:\Windows\System\dHnEYqo.exe
  2⤵
  PID:8688
- C:\Windows\System\kgEpIqy.exe
  C:\Windows\System\kgEpIqy.exe
  2⤵
  PID:8876
- C:\Windows\System\yBnhlNG.exe
  C:\Windows\System\yBnhlNG.exe
  2⤵
  PID:2664
- C:\Windows\System\vpyEUfN.exe
  C:\Windows\System\vpyEUfN.exe
  2⤵
  PID:9240
- C:\Windows\System\ENMPaDl.exe
  C:\Windows\System\ENMPaDl.exe
  2⤵
  PID:9264
- C:\Windows\System\exFFdIg.exe
  C:\Windows\System\exFFdIg.exe
  2⤵
  PID:9328
- C:\Windows\System\DCXQyPp.exe
  C:\Windows\System\DCXQyPp.exe
  2⤵
  PID:9360
- C:\Windows\System\ZQDOChi.exe
  C:\Windows\System\ZQDOChi.exe
  2⤵
  PID:9388
- C:\Windows\System\ENMYjwE.exe
  C:\Windows\System\ENMYjwE.exe
  2⤵
  PID:9420
- C:\Windows\System\XZAeydP.exe
  C:\Windows\System\XZAeydP.exe
  2⤵
  PID:9452
- C:\Windows\System\DKKduQO.exe
  C:\Windows\System\DKKduQO.exe
  2⤵
  PID:9472
- C:\Windows\System\VlsBTQr.exe
  C:\Windows\System\VlsBTQr.exe
  2⤵
  PID:9488
- C:\Windows\System\QzVTNOx.exe
  C:\Windows\System\QzVTNOx.exe
  2⤵
  PID:9536
- C:\Windows\System\QzIisLP.exe
  C:\Windows\System\QzIisLP.exe
  2⤵
  PID:9568
- C:\Windows\System\oFYkeoi.exe
  C:\Windows\System\oFYkeoi.exe
  2⤵
  PID:9596
- C:\Windows\System\tKSVflt.exe
  C:\Windows\System\tKSVflt.exe
  2⤵
  PID:9636
- C:\Windows\System\fXAyLDH.exe
  C:\Windows\System\fXAyLDH.exe
  2⤵
  PID:9660
- C:\Windows\System\dozCafj.exe
  C:\Windows\System\dozCafj.exe
  2⤵
  PID:9680
- C:\Windows\System\QpIsikl.exe
  C:\Windows\System\QpIsikl.exe
  2⤵
  PID:9708
- C:\Windows\System\AMfjDXZ.exe
  C:\Windows\System\AMfjDXZ.exe
  2⤵
  PID:9732
- C:\Windows\System\KnlxzxF.exe
  C:\Windows\System\KnlxzxF.exe
  2⤵
  PID:9760
- C:\Windows\System\xsknFkY.exe
  C:\Windows\System\xsknFkY.exe
  2⤵
  PID:9780
- C:\Windows\System\xbGdNMV.exe
  C:\Windows\System\xbGdNMV.exe
  2⤵
  PID:9800
- C:\Windows\System\HrEDool.exe
  C:\Windows\System\HrEDool.exe
  2⤵
  PID:9828
- C:\Windows\System\HIgTbRn.exe
  C:\Windows\System\HIgTbRn.exe
  2⤵
  PID:9880
- C:\Windows\System\BCThElD.exe
  C:\Windows\System\BCThElD.exe
  2⤵
  PID:9904
- C:\Windows\System\TCeKlSL.exe
  C:\Windows\System\TCeKlSL.exe
  2⤵
  PID:9944
- C:\Windows\System\aZfhKUg.exe
  C:\Windows\System\aZfhKUg.exe
  2⤵
  PID:9964
- C:\Windows\System\WjVgjju.exe
  C:\Windows\System\WjVgjju.exe
  2⤵
  PID:10000
- C:\Windows\System\TeSzcTr.exe
  C:\Windows\System\TeSzcTr.exe
  2⤵
  PID:10016
- C:\Windows\System\PPTMPHF.exe
  C:\Windows\System\PPTMPHF.exe
  2⤵
  PID:10036
- C:\Windows\System\FfSdvZE.exe
  C:\Windows\System\FfSdvZE.exe
  2⤵
  PID:10060
- C:\Windows\System\JCkXRiP.exe
  C:\Windows\System\JCkXRiP.exe
  2⤵
  PID:10132
- C:\Windows\System\XqnIRoB.exe
  C:\Windows\System\XqnIRoB.exe
  2⤵
  PID:10160
- C:\Windows\System\vmjOdzv.exe
  C:\Windows\System\vmjOdzv.exe
  2⤵
  PID:10176
- C:\Windows\System\eaTllqU.exe
  C:\Windows\System\eaTllqU.exe
  2⤵
  PID:10208
- C:\Windows\System\VJXOyBt.exe
  C:\Windows\System\VJXOyBt.exe
  2⤵
  PID:10224
- C:\Windows\System\uXlJDAK.exe
  C:\Windows\System\uXlJDAK.exe
  2⤵
  PID:8268
- C:\Windows\System\xVbYQDD.exe
  C:\Windows\System\xVbYQDD.exe
  2⤵
  PID:9276
- C:\Windows\System\KbVZqdM.exe
  C:\Windows\System\KbVZqdM.exe
  2⤵
  PID:9344
- C:\Windows\System\PhUcIXk.exe
  C:\Windows\System\PhUcIXk.exe
  2⤵
  PID:9416
- C:\Windows\System\uWTVmFX.exe
  C:\Windows\System\uWTVmFX.exe
  2⤵
  PID:9460
- C:\Windows\System\SsbDCRm.exe
  C:\Windows\System\SsbDCRm.exe
  2⤵
  PID:9528
- C:\Windows\System\VMsKHOo.exe
  C:\Windows\System\VMsKHOo.exe
  2⤵
  PID:9584
- C:\Windows\System\HTbSqeY.exe
  C:\Windows\System\HTbSqeY.exe
  2⤵
  PID:9632
- C:\Windows\System\jXWghOV.exe
  C:\Windows\System\jXWghOV.exe
  2⤵
  PID:9676
- C:\Windows\System\GIpVMGF.exe
  C:\Windows\System\GIpVMGF.exe
  2⤵
  PID:9748
- C:\Windows\System\dWiujmS.exe
  C:\Windows\System\dWiujmS.exe
  2⤵
  PID:9796
- C:\Windows\System\MzWRMkp.exe
  C:\Windows\System\MzWRMkp.exe
  2⤵
  PID:9896
- C:\Windows\System\JQJMESQ.exe
  C:\Windows\System\JQJMESQ.exe
  2⤵
  PID:9976
- C:\Windows\System\rpdxNpc.exe
  C:\Windows\System\rpdxNpc.exe
  2⤵
  PID:10056
- C:\Windows\System\QGnPquS.exe
  C:\Windows\System\QGnPquS.exe
  2⤵
  PID:10120
- C:\Windows\System\SGDYWNB.exe
  C:\Windows\System\SGDYWNB.exe
  2⤵
  PID:10192
- C:\Windows\System\lwmoKIA.exe
  C:\Windows\System\lwmoKIA.exe
  2⤵
  PID:10204
- C:\Windows\System\fANozgo.exe
  C:\Windows\System\fANozgo.exe
  2⤵
  PID:9336
- C:\Windows\System\IzYVZol.exe
  C:\Windows\System\IzYVZol.exe
  2⤵
  PID:9560
- C:\Windows\System\FOcBUhj.exe
  C:\Windows\System\FOcBUhj.exe
  2⤵
  PID:9616
- C:\Windows\System\nWYYvXk.exe
  C:\Windows\System\nWYYvXk.exe
  2⤵
  PID:9696
- C:\Windows\System\PVFDLHc.exe
  C:\Windows\System\PVFDLHc.exe
  2⤵
  PID:9744
- C:\Windows\System\UsnpVNX.exe
  C:\Windows\System\UsnpVNX.exe
  2⤵
  PID:9988
- C:\Windows\System\GxTDtRH.exe
  C:\Windows\System\GxTDtRH.exe
  2⤵
  PID:10172
- C:\Windows\System\eLyuqCR.exe
  C:\Windows\System\eLyuqCR.exe
  2⤵
  PID:9296
- C:\Windows\System\xDMaGlO.exe
  C:\Windows\System\xDMaGlO.exe
  2⤵
  PID:2688
- C:\Windows\System\wrhCPlf.exe
  C:\Windows\System\wrhCPlf.exe
  2⤵
  PID:9656
- C:\Windows\System\IFzuhGU.exe
  C:\Windows\System\IFzuhGU.exe
  2⤵
  PID:10220
- C:\Windows\System\VpqUMeK.exe
  C:\Windows\System\VpqUMeK.exe
  2⤵
  PID:10272
- C:\Windows\System\RvGXzou.exe
  C:\Windows\System\RvGXzou.exe
  2⤵
  PID:10292
- C:\Windows\System\PQhMcYN.exe
  C:\Windows\System\PQhMcYN.exe
  2⤵
  PID:10316
- C:\Windows\System\PDzgGCJ.exe
  C:\Windows\System\PDzgGCJ.exe
  2⤵
  PID:10360
- C:\Windows\System\frZVgLC.exe
  C:\Windows\System\frZVgLC.exe
  2⤵
  PID:10384
- C:\Windows\System\DBuufsg.exe
  C:\Windows\System\DBuufsg.exe
  2⤵
  PID:10412
- C:\Windows\System\tYIZiRI.exe
  C:\Windows\System\tYIZiRI.exe
  2⤵
  PID:10428
- C:\Windows\System\jQbKEYx.exe
  C:\Windows\System\jQbKEYx.exe
  2⤵
  PID:10456
- C:\Windows\System\sRPZmmi.exe
  C:\Windows\System\sRPZmmi.exe
  2⤵
  PID:10484
- C:\Windows\System\QPSMiii.exe
  C:\Windows\System\QPSMiii.exe
  2⤵
  PID:10504
- C:\Windows\System\tmvYgCZ.exe
  C:\Windows\System\tmvYgCZ.exe
  2⤵
  PID:10528
- C:\Windows\System\mXAwwRH.exe
  C:\Windows\System\mXAwwRH.exe
  2⤵
  PID:10560
- C:\Windows\System\mOlEEeU.exe
  C:\Windows\System\mOlEEeU.exe
  2⤵
  PID:10584
- C:\Windows\System\xFCpUBx.exe
  C:\Windows\System\xFCpUBx.exe
  2⤵
  PID:10608
- C:\Windows\System\TItSdzc.exe
  C:\Windows\System\TItSdzc.exe
  2⤵
  PID:10628
- C:\Windows\System\ghsZeuo.exe
  C:\Windows\System\ghsZeuo.exe
  2⤵
  PID:10656
- C:\Windows\System\JdPJOsZ.exe
  C:\Windows\System\JdPJOsZ.exe
  2⤵
  PID:10680
- C:\Windows\System\WRGTBcI.exe
  C:\Windows\System\WRGTBcI.exe
  2⤵
  PID:10748
- C:\Windows\System\DtSQERS.exe
  C:\Windows\System\DtSQERS.exe
  2⤵
  PID:10768
- C:\Windows\System\RJIwXnF.exe
  C:\Windows\System\RJIwXnF.exe
  2⤵
  PID:10796
- C:\Windows\System\StsARcy.exe
  C:\Windows\System\StsARcy.exe
  2⤵
  PID:10824
- C:\Windows\System\CMdSvtE.exe
  C:\Windows\System\CMdSvtE.exe
  2⤵
  PID:10852
- C:\Windows\System\owUqmUc.exe
  C:\Windows\System\owUqmUc.exe
  2⤵
  PID:10876
- C:\Windows\System\qdbTVel.exe
  C:\Windows\System\qdbTVel.exe
  2⤵
  PID:10912
- C:\Windows\System\RGVXAtZ.exe
  C:\Windows\System\RGVXAtZ.exe
  2⤵
  PID:10940
- C:\Windows\System\ojSKSKn.exe
  C:\Windows\System\ojSKSKn.exe
  2⤵
  PID:10960
- C:\Windows\System\tgdwXul.exe
  C:\Windows\System\tgdwXul.exe
  2⤵
  PID:10980
- C:\Windows\System\LuWLdcP.exe
  C:\Windows\System\LuWLdcP.exe
  2⤵
  PID:11008
- C:\Windows\System\atAfrNV.exe
  C:\Windows\System\atAfrNV.exe
  2⤵
  PID:11028
- C:\Windows\System\euHGYJm.exe
  C:\Windows\System\euHGYJm.exe
  2⤵
  PID:11052
- C:\Windows\System\zWhFGDk.exe
  C:\Windows\System\zWhFGDk.exe
  2⤵
  PID:11080
- C:\Windows\System\duvnAqD.exe
  C:\Windows\System\duvnAqD.exe
  2⤵
  PID:11100
- C:\Windows\System\kMvHCZg.exe
  C:\Windows\System\kMvHCZg.exe
  2⤵
  PID:11128
- C:\Windows\System\etujlBn.exe
  C:\Windows\System\etujlBn.exe
  2⤵
  PID:11148
- C:\Windows\System\BVLhhAD.exe
  C:\Windows\System\BVLhhAD.exe
  2⤵
  PID:11200
- C:\Windows\System\iKDJRDa.exe
  C:\Windows\System\iKDJRDa.exe
  2⤵
  PID:11228
- C:\Windows\System\Gdrhyfi.exe
  C:\Windows\System\Gdrhyfi.exe
  2⤵
  PID:11252
- C:\Windows\System\FJQWmxA.exe
  C:\Windows\System\FJQWmxA.exe
  2⤵
  PID:10288
- C:\Windows\System\KvQiHLZ.exe
  C:\Windows\System\KvQiHLZ.exe
  2⤵
  PID:10440
- C:\Windows\System\FiEHRTg.exe
  C:\Windows\System\FiEHRTg.exe
  2⤵
  PID:10520
- C:\Windows\System\AceDJtP.exe
  C:\Windows\System\AceDJtP.exe
  2⤵
  PID:10644
- C:\Windows\System\xdMiKIE.exe
  C:\Windows\System\xdMiKIE.exe
  2⤵
  PID:10792
- C:\Windows\System\NjOjubH.exe
  C:\Windows\System\NjOjubH.exe
  2⤵
  PID:10900
- C:\Windows\System\QbFAFHu.exe
  C:\Windows\System\QbFAFHu.exe
  2⤵
  PID:11020
- C:\Windows\System\dQmggjq.exe
  C:\Windows\System\dQmggjq.exe
  2⤵
  PID:11096
- C:\Windows\System\FKjthjK.exe
  C:\Windows\System\FKjthjK.exe
  2⤵
  PID:11144
- C:\Windows\System\lviKIoj.exe
  C:\Windows\System\lviKIoj.exe
  2⤵
  PID:11260
- C:\Windows\System\RetyJpP.exe
  C:\Windows\System\RetyJpP.exe
  2⤵
  PID:10356
- C:\Windows\System\ItcJBlm.exe
  C:\Windows\System\ItcJBlm.exe
  2⤵
  PID:11216
- C:\Windows\System\arKpVjk.exe
  C:\Windows\System\arKpVjk.exe
  2⤵
  PID:10300
- C:\Windows\System\OrvEKJR.exe
  C:\Windows\System\OrvEKJR.exe
  2⤵
  PID:10380
- C:\Windows\System\jHSqReP.exe
  C:\Windows\System\jHSqReP.exe
  2⤵
  PID:10516
- C:\Windows\System\dhfJCRl.exe
  C:\Windows\System\dhfJCRl.exe
  2⤵
  PID:10616
- C:\Windows\System\PiriyCu.exe
  C:\Windows\System\PiriyCu.exe
  2⤵
  PID:10716
- C:\Windows\System\NsjhDaT.exe
  C:\Windows\System\NsjhDaT.exe
  2⤵
  PID:11024
- C:\Windows\System\jLoJiDD.exe
  C:\Windows\System\jLoJiDD.exe
  2⤵
  PID:10976
- C:\Windows\System\xUbBeGE.exe
  C:\Windows\System\xUbBeGE.exe
  2⤵
  PID:11240
- C:\Windows\System\vlSXIfW.exe
  C:\Windows\System\vlSXIfW.exe
  2⤵
  PID:10376
- C:\Windows\System\koAfUrG.exe
  C:\Windows\System\koAfUrG.exe
  2⤵
  PID:10576
- C:\Windows\System\SkLXAMY.exe
  C:\Windows\System\SkLXAMY.exe
  2⤵
  PID:10664
- C:\Windows\System\eEPQmez.exe
  C:\Windows\System\eEPQmez.exe
  2⤵
  PID:10424
- C:\Windows\System\KzXHZOg.exe
  C:\Windows\System\KzXHZOg.exe
  2⤵
  PID:10244
- C:\Windows\System\Qgglger.exe
  C:\Windows\System\Qgglger.exe
  2⤵
  PID:10476
- C:\Windows\System\dftTSgs.exe
  C:\Windows\System\dftTSgs.exe
  2⤵
  PID:11280
- C:\Windows\System\GcNYKVU.exe
  C:\Windows\System\GcNYKVU.exe
  2⤵
  PID:11300
- C:\Windows\System\acHRaBq.exe
  C:\Windows\System\acHRaBq.exe
  2⤵
  PID:11348
- C:\Windows\System\QlyPAGW.exe
  C:\Windows\System\QlyPAGW.exe
  2⤵
  PID:11368
- C:\Windows\System\mugacAg.exe
  C:\Windows\System\mugacAg.exe
  2⤵
  PID:11384
- C:\Windows\System\dcgRrTN.exe
  C:\Windows\System\dcgRrTN.exe
  2⤵
  PID:11404
- C:\Windows\System\beehBBp.exe
  C:\Windows\System\beehBBp.exe
  2⤵
  PID:11424
- C:\Windows\System\doxTHRh.exe
  C:\Windows\System\doxTHRh.exe
  2⤵
  PID:11500
- C:\Windows\System\gJJpJZo.exe
  C:\Windows\System\gJJpJZo.exe
  2⤵
  PID:11520
- C:\Windows\System\cSnjfSH.exe
  C:\Windows\System\cSnjfSH.exe
  2⤵
  PID:11556
- C:\Windows\System\igZPGBl.exe
  C:\Windows\System\igZPGBl.exe
  2⤵
  PID:11572
- C:\Windows\System\KWVsEGN.exe
  C:\Windows\System\KWVsEGN.exe
  2⤵
  PID:11592
- C:\Windows\System\DPlbEQY.exe
  C:\Windows\System\DPlbEQY.exe
  2⤵
  PID:11628
- C:\Windows\System\tVcSMud.exe
  C:\Windows\System\tVcSMud.exe
  2⤵
  PID:11664
- C:\Windows\System\eFZswIz.exe
  C:\Windows\System\eFZswIz.exe
  2⤵
  PID:11696
- C:\Windows\System\xzGiQAa.exe
  C:\Windows\System\xzGiQAa.exe
  2⤵
  PID:11720
- C:\Windows\System\eyuRMei.exe
  C:\Windows\System\eyuRMei.exe
  2⤵
  PID:11764
- C:\Windows\System\wyQzXRe.exe
  C:\Windows\System\wyQzXRe.exe
  2⤵
  PID:11784
- C:\Windows\System\WoSZfAL.exe
  C:\Windows\System\WoSZfAL.exe
  2⤵
  PID:11804
- C:\Windows\System\pmvYZMj.exe
  C:\Windows\System\pmvYZMj.exe
  2⤵
  PID:11848
- C:\Windows\System\kwrJyQT.exe
  C:\Windows\System\kwrJyQT.exe
  2⤵
  PID:11868
- C:\Windows\System\RdfJZpF.exe
  C:\Windows\System\RdfJZpF.exe
  2⤵
  PID:11900
- C:\Windows\System\jGpWHNO.exe
  C:\Windows\System\jGpWHNO.exe
  2⤵
  PID:11920
- C:\Windows\System\VRRzlPh.exe
  C:\Windows\System\VRRzlPh.exe
  2⤵
  PID:11952
- C:\Windows\System\vhkTjAg.exe
  C:\Windows\System\vhkTjAg.exe
  2⤵
  PID:11976
- C:\Windows\System\BQQHqon.exe
  C:\Windows\System\BQQHqon.exe
  2⤵
  PID:12004
- C:\Windows\System\rykunaH.exe
  C:\Windows\System\rykunaH.exe
  2⤵
  PID:12044
- C:\Windows\System\GCBUzqA.exe
  C:\Windows\System\GCBUzqA.exe
  2⤵
  PID:12064
- C:\Windows\System\XldzJxW.exe
  C:\Windows\System\XldzJxW.exe
  2⤵
  PID:12088
- C:\Windows\System\zjUDwbL.exe
  C:\Windows\System\zjUDwbL.exe
  2⤵
  PID:12112
- C:\Windows\System\MJSqGtZ.exe
  C:\Windows\System\MJSqGtZ.exe
  2⤵
  PID:12128
- C:\Windows\System\spdjSzl.exe
  C:\Windows\System\spdjSzl.exe
  2⤵
  PID:12172
- C:\Windows\System\XowjSqU.exe
  C:\Windows\System\XowjSqU.exe
  2⤵
  PID:12192
- C:\Windows\System\tjYFZRm.exe
  C:\Windows\System\tjYFZRm.exe
  2⤵
  PID:12236
- C:\Windows\System\Ekfvhww.exe
  C:\Windows\System\Ekfvhww.exe
  2⤵
  PID:12256
- C:\Windows\System\gyyAgmS.exe
  C:\Windows\System\gyyAgmS.exe
  2⤵
  PID:11060
- C:\Windows\System\mwwjNBz.exe
  C:\Windows\System\mwwjNBz.exe
  2⤵
  PID:11328
- C:\Windows\System\bKHtgfT.exe
  C:\Windows\System\bKHtgfT.exe
  2⤵
  PID:11380
- C:\Windows\System\RyvTdft.exe
  C:\Windows\System\RyvTdft.exe
  2⤵
  PID:11416
- C:\Windows\System\ywnJSUh.exe
  C:\Windows\System\ywnJSUh.exe
  2⤵
  PID:11488
- C:\Windows\System\ozPaKth.exe
  C:\Windows\System\ozPaKth.exe
  2⤵
  PID:11532
- C:\Windows\System\ujyUBxi.exe
  C:\Windows\System\ujyUBxi.exe
  2⤵
  PID:11564
- C:\Windows\System\GZgRSrq.exe
  C:\Windows\System\GZgRSrq.exe
  2⤵
  PID:2388
- C:\Windows\System\IdbRUif.exe
  C:\Windows\System\IdbRUif.exe
  2⤵
  PID:4004
- C:\Windows\System\FgPkrwW.exe
  C:\Windows\System\FgPkrwW.exe
  2⤵
  PID:3432
- C:\Windows\System\ekpsOaA.exe
  C:\Windows\System\ekpsOaA.exe
  2⤵
  PID:11740
- C:\Windows\System\ESHzwWR.exe
  C:\Windows\System\ESHzwWR.exe
  2⤵
  PID:11688
- C:\Windows\System\hhqBKtG.exe
  C:\Windows\System\hhqBKtG.exe
  2⤵
  PID:11800
- C:\Windows\System\gpXoNYt.exe
  C:\Windows\System\gpXoNYt.exe
  2⤵
  PID:11860
- C:\Windows\System\AgbvHvC.exe
  C:\Windows\System\AgbvHvC.exe
  2⤵
  PID:11892
- C:\Windows\System\vjqiNKc.exe
  C:\Windows\System\vjqiNKc.exe
  2⤵
  PID:11988
- C:\Windows\System\unORjYQ.exe
  C:\Windows\System\unORjYQ.exe
  2⤵
  PID:12020
- C:\Windows\System\YtqCSne.exe
  C:\Windows\System\YtqCSne.exe
  2⤵
  PID:12156
- C:\Windows\System\DknaVXW.exe
  C:\Windows\System\DknaVXW.exe
  2⤵
  PID:12228
- C:\Windows\System\QgZiWQX.exe
  C:\Windows\System\QgZiWQX.exe
  2⤵
  PID:12268
- C:\Windows\System\ZDzvPzL.exe
  C:\Windows\System\ZDzvPzL.exe
  2⤵
  PID:11356
- C:\Windows\System\DOSVrag.exe
  C:\Windows\System\DOSVrag.exe
  2⤵
  PID:11444
- C:\Windows\System\mcSgTBC.exe
  C:\Windows\System\mcSgTBC.exe
  2⤵
  PID:11208
- C:\Windows\System\EoufFQo.exe
  C:\Windows\System\EoufFQo.exe
  2⤵
  PID:224
- C:\Windows\System\uYAEyBk.exe
  C:\Windows\System\uYAEyBk.exe
  2⤵
  PID:4236
- C:\Windows\System\pBwAcan.exe
  C:\Windows\System\pBwAcan.exe
  2⤵
  PID:11832
- C:\Windows\System\rDumqsS.exe
  C:\Windows\System\rDumqsS.exe
  2⤵
  PID:11964
- C:\Windows\System\SZMWvex.exe
  C:\Windows\System\SZMWvex.exe
  2⤵
  PID:12080
- C:\Windows\System\TGQXjeu.exe
  C:\Windows\System\TGQXjeu.exe
  2⤵
  PID:12100
- C:\Windows\System\HXJVWzN.exe
  C:\Windows\System\HXJVWzN.exe
  2⤵
  PID:11296
- C:\Windows\System\KINuiCJ.exe
  C:\Windows\System\KINuiCJ.exe
  2⤵
  PID:11472
- C:\Windows\System\oNAUQeL.exe
  C:\Windows\System\oNAUQeL.exe
  2⤵
  PID:11708
- C:\Windows\System\CWGzjpw.exe
  C:\Windows\System\CWGzjpw.exe
  2⤵
  PID:11276
- C:\Windows\System\QyFTkKK.exe
  C:\Windows\System\QyFTkKK.exe
  2⤵
  PID:11540
- C:\Windows\System\BBdtaYc.exe
  C:\Windows\System\BBdtaYc.exe
  2⤵
  PID:11968
- C:\Windows\System\unnvJQE.exe
  C:\Windows\System\unnvJQE.exe
  2⤵
  PID:11776
- C:\Windows\System\tGqrfTI.exe
  C:\Windows\System\tGqrfTI.exe
  2⤵
  PID:12308
- C:\Windows\System\eVVkpXP.exe
  C:\Windows\System\eVVkpXP.exe
  2⤵
  PID:12340
- C:\Windows\System\bkDbyyD.exe
  C:\Windows\System\bkDbyyD.exe
  2⤵
  PID:12364
- C:\Windows\System\qEuzSmu.exe
  C:\Windows\System\qEuzSmu.exe
  2⤵
  PID:12408
- C:\Windows\System\FmRfMrl.exe
  C:\Windows\System\FmRfMrl.exe
  2⤵
  PID:12440
- C:\Windows\System\PFFAeic.exe
  C:\Windows\System\PFFAeic.exe
  2⤵
  PID:12460
- C:\Windows\System\GqGIQAH.exe
  C:\Windows\System\GqGIQAH.exe
  2⤵
  PID:12480
- C:\Windows\System\iXUSVrk.exe
  C:\Windows\System\iXUSVrk.exe
  2⤵
  PID:12532
- C:\Windows\System\awnUSVT.exe
  C:\Windows\System\awnUSVT.exe
  2⤵
  PID:12552
- C:\Windows\System\umcFKXk.exe
  C:\Windows\System\umcFKXk.exe
  2⤵
  PID:12580
- C:\Windows\System\PFdXeNy.exe
  C:\Windows\System\PFdXeNy.exe
  2⤵
  PID:12604
- C:\Windows\System\cqhYNKk.exe
  C:\Windows\System\cqhYNKk.exe
  2⤵
  PID:12624
- C:\Windows\System\odTBxht.exe
  C:\Windows\System\odTBxht.exe
  2⤵
  PID:12648
- C:\Windows\System\zVXEVUA.exe
  C:\Windows\System\zVXEVUA.exe
  2⤵
  PID:12684
- C:\Windows\System\JUUSgjc.exe
  C:\Windows\System\JUUSgjc.exe
  2⤵
  PID:12716
- C:\Windows\System\LlGrQQm.exe
  C:\Windows\System\LlGrQQm.exe
  2⤵
  PID:12744
- C:\Windows\System\Wwneext.exe
  C:\Windows\System\Wwneext.exe
  2⤵
  PID:12796
- C:\Windows\System\eRoTYkH.exe
  C:\Windows\System\eRoTYkH.exe
  2⤵
  PID:12816
- C:\Windows\System\MmrVRGi.exe
  C:\Windows\System\MmrVRGi.exe
  2⤵
  PID:12840
- C:\Windows\System\DNBiwcT.exe
  C:\Windows\System\DNBiwcT.exe
  2⤵
  PID:12868
- C:\Windows\System\BfgPnwr.exe
  C:\Windows\System\BfgPnwr.exe
  2⤵
  PID:12900
- C:\Windows\System\ayMeyhZ.exe
  C:\Windows\System\ayMeyhZ.exe
  2⤵
  PID:12932
- C:\Windows\System\icDIubv.exe
  C:\Windows\System\icDIubv.exe
  2⤵
  PID:12952
- C:\Windows\System\bNLsuBw.exe
  C:\Windows\System\bNLsuBw.exe
  2⤵
  PID:12992
- C:\Windows\System\OyNPUea.exe
  C:\Windows\System\OyNPUea.exe
  2⤵
  PID:13020
- C:\Windows\System\CqgaQbl.exe
  C:\Windows\System\CqgaQbl.exe
  2⤵
  PID:13040
- C:\Windows\System\Vnmslgi.exe
  C:\Windows\System\Vnmslgi.exe
  2⤵
  PID:13060
- C:\Windows\System\fmeYVYl.exe
  C:\Windows\System\fmeYVYl.exe
  2⤵
  PID:13088
- C:\Windows\System\SWHwTaK.exe
  C:\Windows\System\SWHwTaK.exe
  2⤵
  PID:13120
- C:\Windows\System\XOBLfeS.exe
  C:\Windows\System\XOBLfeS.exe
  2⤵
  PID:13140
- C:\Windows\System\OyeFrZs.exe
  C:\Windows\System\OyeFrZs.exe
  2⤵
  PID:13164
- C:\Windows\System\okOqukD.exe
  C:\Windows\System\okOqukD.exe
  2⤵
  PID:13184
- C:\Windows\System\tyvJiow.exe
  C:\Windows\System\tyvJiow.exe
  2⤵
  PID:13224
- C:\Windows\System\prEhGIm.exe
  C:\Windows\System\prEhGIm.exe
  2⤵
  PID:13268
- C:\Windows\System\jcnrDQv.exe
  C:\Windows\System\jcnrDQv.exe
  2⤵
  PID:13288
- C:\Windows\System\dNjkqwp.exe
  C:\Windows\System\dNjkqwp.exe
  2⤵
  PID:13304
- C:\Windows\System\jmvCVVX.exe
  C:\Windows\System\jmvCVVX.exe
  2⤵
  PID:12304
- C:\Windows\System\lGaPxvV.exe
  C:\Windows\System\lGaPxvV.exe
  2⤵
  PID:12396
- C:\Windows\System\XjXZTeO.exe
  C:\Windows\System\XjXZTeO.exe
  2⤵
  PID:12516
- C:\Windows\System\KimEsdD.exe
  C:\Windows\System\KimEsdD.exe
  2⤵
  PID:12548
- C:\Windows\System\sgbeqJc.exe
  C:\Windows\System\sgbeqJc.exe
  2⤵
  PID:12616
- C:\Windows\System\gPEqFrD.exe
  C:\Windows\System\gPEqFrD.exe
  2⤵
  PID:12644
- C:\Windows\System\bnPYHtN.exe
  C:\Windows\System\bnPYHtN.exe
  2⤵
  PID:12760
- C:\Windows\System\afwyRnU.exe
  C:\Windows\System\afwyRnU.exe
  2⤵
  PID:12812
- C:\Windows\System\KPeXAku.exe
  C:\Windows\System\KPeXAku.exe
  2⤵
  PID:13016
- C:\Windows\System\PchnqnT.exe
  C:\Windows\System\PchnqnT.exe
  2⤵
  PID:12968
- C:\Windows\System\rCBuoHG.exe
  C:\Windows\System\rCBuoHG.exe
  2⤵
  PID:13028
- C:\Windows\System\GCzCejp.exe
  C:\Windows\System\GCzCejp.exe
  2⤵
  PID:3184
- C:\Windows\System\AsMPGzq.exe
  C:\Windows\System\AsMPGzq.exe
  2⤵
  PID:13220
- C:\Windows\System\PdFmqsh.exe
  C:\Windows\System\PdFmqsh.exe
  2⤵
  PID:12476
- C:\Windows\System\iuMpxIs.exe
  C:\Windows\System\iuMpxIs.exe
  2⤵
  PID:12540
- C:\Windows\System\ewOmKJj.exe
  C:\Windows\System\ewOmKJj.exe
  2⤵
  PID:12512
- C:\Windows\System\AHLAeRU.exe
  C:\Windows\System\AHLAeRU.exe
  2⤵
  PID:12636
- C:\Windows\System\dYixPyx.exe
  C:\Windows\System\dYixPyx.exe
  2⤵
  PID:13284
- C:\Windows\System\ZflJpqD.exe
  C:\Windows\System\ZflJpqD.exe
  2⤵
  PID:12924
- C:\Windows\System\WgnsNTu.exe
  C:\Windows\System\WgnsNTu.exe
  2⤵
  PID:12788
- C:\Windows\System\EUCFbqq.exe
  C:\Windows\System\EUCFbqq.exe
  2⤵
  PID:12560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_hxrhh2tk.jls.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hxrhh2tk.jls.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AWPlgzL.exe

Path C:\Windows\System\AWPlgzL.exe
Size 2.3MB
SHA256 7a9a67305267b853d5a8425e412d518b89ff5bcacefc30f54d761d62f56d3a8e
MD5 35a73e3806b0210a6c0241c7904cf385
SHA1 be535516fea1c830fdc416b7bf255c6880ef689f
SHA512 ce148423a7f34545a4ca4d46467eb0529c031d339f9615157177816ceab94ec9e0e74a9c7d5fc142c260d9db02e2b950d41d299cd82b3f5d64e3f666a5b4d1ea
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDe:NABD
MD5 SHA1 SHA512 SSDEEP

Submit Download

BPpdZNh.exe

Path C:\Windows\System\BPpdZNh.exe
Size 2.3MB
SHA256 d1b2537410bb346f818572263878cfc63c34ee9203c7457b28b2f77bf909b4c1
MD5 c6781e1ee4ba84b3c843234b4e1a950e
SHA1 7e45e92c6beddba74ee9ca6522cc23188429d7ff
SHA512 e804dabe80f28ef6b8fce553dcd2609a4d84aaccc6ee8ef1cc1bfdd4e56034b3e0826718cde6790933022a8f89910de9d6270cd094bcb5145ced9d0336c80f59
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD4:NABv
MD5 SHA1 SHA512 SSDEEP

Submit Download

DDaeSoD.exe

Path C:\Windows\System\DDaeSoD.exe
Size 2.3MB
SHA256 fcc95569498bd6e5997dd1ebc9c983294eb935d0959407f0a85988d874f87a26
MD5 e4392aa88c1918c5f061388edfa57bb4
SHA1 eaa2e7dc98db51e9dde7e093007f464ab11cb47e
SHA512 7bf6a598421086127e915151302e18232d21e6ad42efcd6c2ffb652ad1a3c81ef6e6103ee647c54bcc9fc03f5ee571465692fe892c707e9961bf53f88b83ea3a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDV:NABy
MD5 SHA1 SHA512 SSDEEP

Submit Download

DWVYdzD.exe

Path C:\Windows\System\DWVYdzD.exe
Size 2.3MB
SHA256 a85673876ca57cf0884f0fa55ca9ea7e2ba7c6477eba9ea5d2b7075fd3a96f56
MD5 8a3ed622995a77b625f91fe069a995d0
SHA1 85acae907c23d9bcb97e1b8e52eda40624a3fcfb
SHA512 7175eb75c4a8beca4ee6c2ce697d49642b1a8bda5d9f239edae9ed7e9546abcb8ac5d31d37f13b6c96f7e956e39b89af4ca5304f0d404453837d1b43d10811ec
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDw:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

GIjXrPK.exe

Path C:\Windows\System\GIjXrPK.exe
Size 2.3MB
SHA256 d259c8b066d19924d9514a7adddf25ac850b63d3672a2195db446da5e0cb6d14
MD5 62d405fbc9762aed2cc694ac211d56c0
SHA1 61e312b8c08e4597726a07ef5f5cddd1cba5c2d3
SHA512 f625a073313d1552c18d8d480465a70c1d6d00560cd2c3e67556e839e3449faab34e9706c5cc4308a57209ac14e0c29e376b861d3604770e23f2aa0b6ab187a6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDX:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

GUxuMGI.exe

Path C:\Windows\System\GUxuMGI.exe
Size 2.3MB
SHA256 234d82387191016741c5a88bc66f4e1994f6deed61f4560febdc03adff22f61c
MD5 7ba64ebb4823a4b7e1236f9d0b5a8bf2
SHA1 5ba9aac825f3ed3a215a3bddea2bfc68430388d9
SHA512 55ebcccbd0555b48da7a91e9fbc176af5f15eaef87d7145fe93cbeb64aa8493c9519610a6cfa8397e630faca0ca4490908ac9d5c36abd07537703eadf2c24fbc
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD49:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

GXoRxNt.exe

Path C:\Windows\System\GXoRxNt.exe
Size 2.3MB
SHA256 4f6db605c4cb6cd3370af9bb0ac21c1030c6cf17095e364ad0fe5223b4b0e1a0
MD5 fe88704b9c5e3cc247e32fd9a9b65b9b
SHA1 b14e97c7b0c3ca88be74ff5aea5c2420acad29ab
SHA512 cf4e44d8482aa93d1bd928326224c24a3b13c77858179ba831f856696fc3a1d124f5f1a09fba3dcdfeec4287224a878ce2399577f5f8aee51419f9bdd97245ce
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDa:NABl
MD5 SHA1 SHA512 SSDEEP

Submit Download

HFpSkue.exe

Path C:\Windows\System\HFpSkue.exe
Size 2.3MB
SHA256 2b66bce671f4ba60ba8f1b91524ce7a7871aed4a7343a3407988dfb2f0da1fda
MD5 d6d7abe4a2d176e005e21bcfbe00dd4d
SHA1 cf98d37951e3a63780bae7c6751cdb80c82acc66
SHA512 6ed47de7671b38538392dd817711b10d8fe6d513bb8101ca22ca23b341affa738f35c4343f418efc665c858742f064ba9b02eb76a721951c4e013db165960f1b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDo:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

JQFxqTd.exe

Path C:\Windows\System\JQFxqTd.exe
Size 2.3MB
SHA256 b02cfe71ced27022404b256fff8816bd48961183bea0e97d402c749348faf48c
MD5 4b00595b32a52643aad1e12a54d0dd59
SHA1 e927b593b25a6b4b85929624872c5226a3bdd233
SHA512 53387932f428141773d4aa5e9b5a4215e4573ffd4eeaf1b53bde4c4657aa530d6aa5faf9c15258fad74ad4727b6f95943dc00ee73c106a5c0c4fb2e1d53df771
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDp:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

KeNJeOI.exe

Path C:\Windows\System\KeNJeOI.exe
Size 2.3MB
SHA256 512e92a34e706fd18305638c7360381ff0e6d7264fd2c60daca86ab212165bba
MD5 a084619239cae6eb4b3b701595b5480b
SHA1 de4777a227c0236771ce3194cf8db8f07495c552
SHA512 2ed0cdf4f8bb7efbc8d48b41aed962cb1b7890ed0724ea01c2804c0fce413d98b1e4f3b7897cc466435920de368b1cf2ab9d11ad0fb0a6e2cbd418d6c03493dc
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDL:NAB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

MXZLQoh.exe

Path C:\Windows\System\MXZLQoh.exe
Size 2.3MB
SHA256 5103c7271cac802586fa7e06c665697e018a33ce422ab218fa0b2b7c294e5743
MD5 dc861948a74ae2b66d42542a98199360
SHA1 a1858a836bf062d1877b0c9f6cbad1f5a354bdbb
SHA512 c51990496050b867b15ad06f1eda9a0bf6db32c11862cb44cf5eb54152a70738e79c27848e3c32a2c1b14da2d48328a321734192b0f51ee7b4e9f8599a3fc63e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDC:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

RTyzDMk.exe

Path C:\Windows\System\RTyzDMk.exe
Size 2.3MB
SHA256 a162711e4e337f7352a85400a71c41d3e9476efd13142b3b192ea50e3fdea7e0
MD5 81dc43ce163cac6e66a939530778314d
SHA1 e76da35a392442bd7230baea5ab2928f358c067f
SHA512 5d604bac42420954bf5cc133e317c5483606f93786e22993dd471252023d51092bd1addfdd66b7c6fa0b04762b9c622b27c50870145e3005758b473f96353c9c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDy:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SFmlUTD.exe

Path C:\Windows\System\SFmlUTD.exe
Size 2.3MB
SHA256 e23b5924bd13d97765a7409c8434bbd41d216a00bccca1148f1fbd79afb8e32b
MD5 c90541538b947572c7b144ee19a73bb4
SHA1 2889770c707bf4ea528258cb5c88de43752cc85f
SHA512 2df19a49bb87305fc05e403fc381ed727c4aacf00432053ef9f07aef8ac8c38ada1b42a0c002a88a507ec34076658810a846f912880fb33ec1497a9134fc22f3
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDg:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

TKZxSbq.exe

Path C:\Windows\System\TKZxSbq.exe
Size 2.3MB
SHA256 7bc94032f0f1c9af4e2d27e2fa193b752b866b95928b378567fe469552fc3207
MD5 37f304007ea43654a4597f1a6d13bffe
SHA1 66e60ff0e83fe264673524abc3dd5e02a397e3c6
SHA512 dca459d065d94427a9d8e87f9a706adebee0ea597c253f6e6df006fe0c5768ec6eb20324832cb494c1c3a213fa1b6432510a2d3c5f593d4f7139d7654b3a4b2d
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDs:NAB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

UOfNoqo.exe

Path C:\Windows\System\UOfNoqo.exe
Size 2.3MB
SHA256 dfe4a41fafc1b5fb9bf112351715d497765fdb958e1d0524d7a965256bf7368d
MD5 708125b3efd911046d8da23eaa5c0bf7
SHA1 2514740d4bc97a1d262b81917e5e8274d66f3c4a
SHA512 6847cc19cdcf453c7209ff0c07edc04eed75b5fd1098586ddbe51e809d9d8a133772ab712b206842231b86a25e17d9b4dec80ab9499e131c0b700482ec30463a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDU:NABF
MD5 SHA1 SHA512 SSDEEP

Submit Download

UPVjmYW.exe

Path C:\Windows\System\UPVjmYW.exe
Size 2.3MB
SHA256 4fb9863df29ca40b74b54b0c2c4612dd54603a739ba3c27997289faf03be0a86
MD5 ec2a7a18435f9a6b326a2a3c2855e0b1
SHA1 756b21c2794b8e68399391987a1a204438c9377a
SHA512 325030bfb8af89d8b60f83f280c16e0b690cc59e39be3e2cb94098046ba91f32b9a6f8c0923f5757b7636c9d7ba52604c60fc8e3f1dd08a03e62abcf18d75c01
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDI:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

YBtHlJc.exe

Path C:\Windows\System\YBtHlJc.exe
Size 2.3MB
SHA256 4c9a2983cdfe173ac0a0b5ab4081726b5bb0928202c100d52ec1b6da46e1c982
MD5 db992806d1b64ade9931e88bf9d70bab
SHA1 8e2f1eb16a2d1e11ec578657c4047eaa65659302
SHA512 b13733a97070f5c05eeb292adebc0b7f236adfb082fe615e593a72b7e6ebd597a28ec8aca79cbbc4cccf39dc156f972d8f69e92b3d4debf924c6da4a9a63fdae
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDa:NABV
MD5 SHA1 SHA512 SSDEEP

Submit Download

dUEVdKH.exe

Path C:\Windows\System\dUEVdKH.exe
Size 2.3MB
SHA256 4f2bd9db53e89b147965f896682d1a5718dea694b65152f7d67ad7e5c22e89e5
MD5 ad59c8d0aad366c1dc9259e509d60fb2
SHA1 e143a803a616f70101d539dc7da442631fe07150
SHA512 c291c0d32fdb13e1859e26909c22baa4aa15280f33dee608c2fd386d20c025ad237bc7f02beadb3e69eaa445ebdd36d3adc17c3304ef4c6f54ac281652c2864c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD1:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ekLIJCU.exe

Path C:\Windows\System\ekLIJCU.exe
Size 8B
SHA256 3a8d52b801fd1c8bd120153342611f7386eb5ce0ad255d57304ec96ec9b31a84
MD5 92dce7fd7ec69f225baee909f1f20d27
SHA1 0fe748b20df273698767537e59de10e23a351a61
SHA512 1e58e425b780ebf633a365e2d3edf8bb342f5bfe09e8d802b0d4dd60a53770b35758c32e598b9a4f78c23d6a0841ec0499f88be809f17838167d0c02b8f0c743
MD5 SHA1 SHA512

Submit Download

fJOANME.exe

Path C:\Windows\System\fJOANME.exe
Size 2.3MB
SHA256 ec7585f534cae25d5e956d37a84f0e423eab12e97137fc263873f4feb1034cac
MD5 321d9867e4912a534197bdc84c03c4de
SHA1 b1b7a3925fe78cb2a45be57e7f0c56a213afa0b7
SHA512 f15c1da11bc815abb245969f9a0cd4a376b20d684c35da536ed4bf19deee7e968aead8127a35e785925cbb40deaeb87071b63982e2f26195130ca8b2dda579d7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDn:NABO
MD5 SHA1 SHA512 SSDEEP

Submit Download

hBQblYO.exe

Path C:\Windows\System\hBQblYO.exe
Size 2.3MB
SHA256 286874fc0098634325531e4f35ba08d62f05b4d288e21c2ebfa0dfd0c018b162
MD5 231cb89d439a372a0623efea48bef7aa
SHA1 900012590468e2093a176161c91a0cd99503ef98
SHA512 840e7878d848ac32aa02eaae86db945a95577e18752a5dc39d266df9347159ca0d12b2f7be9a3e44d745597a9cf41d4f0ac4da9ec40b0ccaf92e3cd5d25702e4
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDB:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

iRjLwsg.exe

Path C:\Windows\System\iRjLwsg.exe
Size 2.3MB
SHA256 62eb78ffcdac2c8b2bbc8cec83c0eb906900fa0476c45d9f2be81d468a275096
MD5 febe8ff04e15ad69e8d0ffff300aeb3b
SHA1 ea70a7cc7c662a423f0197f3e86e39eb4710ed94
SHA512 de4271f40dd522f073c44aa38bc2e47b2a880d3d640fb87aa483328335f7296327e99d10d15fd6c2d7db3641cae85ee8828ed246e4d92d37f3f611bdb154d311
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDe:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

iyjyWfS.exe

Path C:\Windows\System\iyjyWfS.exe
Size 2.3MB
SHA256 2cc5702ce70290f372a36e260d9f27e72760544606c111614b1f5383fb921d07
MD5 d8fe07c523c18b72bbcb7ab33a2a2451
SHA1 1ce9f726d368b1aed07f7596eda05e666b92a1a0
SHA512 8913ef204850b441c18d5c1c38c34c65b1a4da2612a420410562ada9c1f14aaf1717c26338a737a954abc697a0e8f7a0b8c625dfdbdaf869a83791430e02ba59
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDB:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

lFJAfyl.exe

Path C:\Windows\System\lFJAfyl.exe
Size 2.3MB
SHA256 7cbc90f4d4292e7b04dc799e83e4179b64284c1157baf43948f8c4f5482f1add
MD5 5fcc9b933f56364c795c2a3073cf255b
SHA1 f423e850e20cc993a70cffd35b93f140d1f088ff
SHA512 26c4629ca0f152f107d6e5731ea8517c3b6b83cae4b08db5b96a0395774239ade2fd46270255092a8493accd0c4d5c9051eec1f06abf307b0ae0b3d097957651
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDh:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

pGCaKhV.exe

Path C:\Windows\System\pGCaKhV.exe
Size 2.3MB
SHA256 2443ea3d0151995c4536d7e5aee1a362256f646521417328f8c624b8b3a959c0
MD5 32fd41e3258621b6ebf65484bf8b40f5
SHA1 58bd575e25a63ee5c5ffa147978eeb17ec62d6cb
SHA512 c211f53fd718923e9a1bef1d50b0a49c40a7c811f8172c24db65b44490f8d3bdc5caff29cf6640c5fd7108f7281d6c21913aa2235ef1886a4e6281b5b09463b1
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD7:NABO
MD5 SHA1 SHA512 SSDEEP

Submit Download

prfWXsp.exe

Path C:\Windows\System\prfWXsp.exe
Size 2.3MB
SHA256 682726b3a60fa2c927db3b7efac8961d9d172be88676555dec18e89f6dcd3ec9
MD5 f5e45c7e93b37b6c68c5155a074d2685
SHA1 3c96cbfc7350307140bea01b6141a8ff45f9a3a4
SHA512 c7342d4fcf57722c59e2ed6ed95ab3a610cf2f87a03c672b571af7897c7daf7a7b183317a827511bd0b86ab36ada6ebc11248eda677ecb2403245efe054eb095
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDI:NABj
MD5 SHA1 SHA512 SSDEEP

Submit Download

rbIXzof.exe

Path C:\Windows\System\rbIXzof.exe
Size 2.3MB
SHA256 92c94dbd8b0b2749fc145abce6e00ffaebd037e9d992555825802cd77f2750b6
MD5 37d1c2bc8353a8999fcf79e3e068192e
SHA1 d7c46dd3012274ecf9e2f228f201e74f52481147
SHA512 c00953f4849e5f38cc6b0a5f30e249939ab71a279617cfa5308dd28577d1e530e14ea9f35ee6712f1a95949a21655e5370842e273e9c5c563b5e6df29e632aaf
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDj:NAB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdxvFpy.exe

Path C:\Windows\System\rdxvFpy.exe
Size 2.3MB
SHA256 076e304f08db854188aa76db55b2eb71493d290b14639fb18db3c3cd15c3f077
MD5 700b6606041753ca74b9aa65ceb57375
SHA1 c3cb6de1eea7b7b4d59fce6db62c36606555649e
SHA512 03a9ee82ec3bba3ff2e63499a923c1659150d708ff7ac292e9fa6f227892ed16d5a7a2ea577ce271621205b3b8010db4b74c5689f3f29487b6627533fd334486
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD7:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

sEkyfPZ.exe

Path C:\Windows\System\sEkyfPZ.exe
Size 2.3MB
SHA256 7da1126a14bb0a01a2870d4161a247a7ab0303e1363aca43bf84ee8b58469dd7
MD5 b9191d520fd0d7f52e16201797f52356
SHA1 3025b6089eda2e73d37d1b248300ac76e4fb9a09
SHA512 413f1a56c4ac88de3cbe7c0e5f37686ec8ac04f50d372aa0fa1c59aa896b8ac9658dafe4c5690bd9067b487de920654b96bb753aedf84d7fc78062b10d4b89cf
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDz:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

tOkmeAs.exe

Path C:\Windows\System\tOkmeAs.exe
Size 2.3MB
SHA256 5e2c832d419ace8b67628618184aed8b35185023c4016ed2e750d16753bc57c2
MD5 4ec3fa3095cb77bcf68b4ca48bcaad20
SHA1 5aa013c0ee0939cf41b0e96ad71445abb1a95fd9
SHA512 10a587320dbd14d2ec51acaa0e45f78d2b8bfa05996ed730b45a5020a495da14af8bfa4eb433568d41377de285a88d899fd1d23ebbc6976c4949844e0effc0d0
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDD:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

uUvdPeF.exe

Path C:\Windows\System\uUvdPeF.exe
Size 2.3MB
SHA256 673c3c46269c91b038d18688591e9af6be8a0ce4d351613fabce72beaf066831
MD5 68762eeb082a801683a35055ad7721d4
SHA1 c4dcaff861e5e37568ccbaa3bc94ab93af9272f2
SHA512 df990d51009b673e8f451f551ca562f13dd0edb454b3b1ca9f28782d9255a281fe6d005ad8498b12e5cb1418ded2117f088400c703bda84f539928c4e213d90f
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD9:NABq
MD5 SHA1 SHA512 SSDEEP

Submit Download

vBrVnPc.exe

Path C:\Windows\System\vBrVnPc.exe
Size 2.3MB
SHA256 fd062c678957d31077cdd6d78c1610c20f6f9992ed4caf2287d56c949ddf733a
MD5 3141f430dc0b9256326d2c76b2421a47
SHA1 700db89c2de563ebec5c3d8d765ad372d9e76186
SHA512 066b54f8fcc1da4cacf70d5cf02afbe99cdba1a6531e83af5134e167dd773695022f07cee1e41fd6b5a4b619bef58f2e496c5035a23429f1c4128866c68d55d4
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDi:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

xwZSUrD.exe

Path C:\Windows\System\xwZSUrD.exe
Size 2.3MB
SHA256 48b85d542aa019da29811a58e5e4234be8546a5b155863eaa215e9859b432de7
MD5 025ebfcb55ad2ce1018a7877fcd56a20
SHA1 e871c4523fbb069d8c034296d7d9cf4f752257ce
SHA512 9b3b100a8f15d53b7ea66dcad05897b60326574c4555d4966bd136ee079f91a2b8fd64265b1bb4e3a2bf3988dadb1f1d33093d8f2881f00bf4018b8969bf2f24
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD5:NAB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

zPTptnV.exe

Path C:\Windows\System\zPTptnV.exe
Size 2.3MB
SHA256 594773a2a4d260198f153c405b28f16457a1a6cde071f75f049c338572dd980e
MD5 ac208e8646fccdad5febe4ca045b6234
SHA1 d7644723316f7366fc181bf6eeb08dc3345d9f06
SHA512 9a66a559518f80b86838768d45b55ba09d4f0e4edd45988a29c755e6d1c101c794c65dc404d5bff3df5172fa9d71b7085ff676a8b15f2992d53592a83a9bd537
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDl:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/536-83-0x00007FF741040000-0x00007FF741432000-memory.dmp

Download

memory/948-3782-0x00007FF777330000-0x00007FF777722000-memory.dmp

Download

memory/948-136-0x00007FF777330000-0x00007FF777722000-memory.dmp

Download

memory/1552-32-0x00007FF6E3700000-0x00007FF6E3AF2000-memory.dmp

Download

memory/1708-149-0x00007FF7B20E0000-0x00007FF7B24D2000-memory.dmp

Download

memory/2024-107-0x00007FF7753D0000-0x00007FF7757C2000-memory.dmp

Download

memory/2152-47-0x00007FF7CCA80000-0x00007FF7CCE72000-memory.dmp

Download

memory/2268-2477-0x00007FF605B00000-0x00007FF605EF2000-memory.dmp

Download

memory/2268-57-0x00007FF605B00000-0x00007FF605EF2000-memory.dmp

Download

memory/2288-102-0x00007FF61C900000-0x00007FF61CCF2000-memory.dmp

Download

memory/2376-106-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp

Download

memory/2376-3341-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp

Download

memory/2780-40-0x00007FF6DE030000-0x00007FF6DE422000-memory.dmp

Download

memory/2900-103-0x00007FF7426C0000-0x00007FF742AB2000-memory.dmp

Download

memory/3068-100-0x00007FF7EB4C0000-0x00007FF7EB8B2000-memory.dmp

Download

memory/3416-109-0x00007FF78EF40000-0x00007FF78F332000-memory.dmp

Download

memory/3416-3780-0x00007FF78EF40000-0x00007FF78F332000-memory.dmp

Download

memory/3532-121-0x00007FF661C70000-0x00007FF662062000-memory.dmp

Download

memory/3648-77-0x00007FF6DF010000-0x00007FF6DF402000-memory.dmp

Download

memory/3772-0-0x00007FF61C4E0000-0x00007FF61C8D2000-memory.dmp

Download

memory/3772-1-0x000001C7F6340000-0x000001C7F6350000-memory.dmp

Download

memory/3856-145-0x00007FF74E2D0000-0x00007FF74E6C2000-memory.dmp

Download

memory/3976-90-0x00007FF7780F0000-0x00007FF7784E2000-memory.dmp

Download

memory/4084-84-0x00007FF75C290000-0x00007FF75C682000-memory.dmp

Download

memory/4372-66-0x000002EAFDA10000-0x000002EAFDA32000-memory.dmp

Download

memory/4372-1634-0x00007FFA894D0000-0x00007FFA89F91000-memory.dmp

Download

memory/4372-24-0x00007FFA894D0000-0x00007FFA89F91000-memory.dmp

Download

memory/4372-25-0x000002EAFDA90000-0x000002EAFDAA0000-memory.dmp

Download

memory/4372-26-0x000002EAFDA90000-0x000002EAFDAA0000-memory.dmp

Download

memory/4892-130-0x00007FF7EC480000-0x00007FF7EC872000-memory.dmp

Download

memory/5024-108-0x00007FF6A7990000-0x00007FF6A7D82000-memory.dmp

Download

memory/5060-96-0x00007FF6FF8D0000-0x00007FF6FFCC2000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads