xmrig | c3c90945082d5f32258260cf87ef5965e2ffe6782bff0852cae9be332f3c6594

Analysis

max time kernel
109s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
Size

2.2MB
MD5

07a6c3ddd28bed0c5b9e297869d576f4
SHA1

437ac6ce635d2341d41dc067904da0997b05d4d1
SHA256

c3c90945082d5f32258260cf87ef5965e2ffe6782bff0852cae9be332f3c6594
SHA512

c67024f34d28e7e102ea48f22b43f88fbfb0049311b212bd02123b54404dbe03ed710800c5da26aa89db012bfc998c76048311057f6f98b84cd5bc21538e777d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfg:NABp

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1220-76-0x00007FF6F7440000-0x00007FF6F7832000-memory.dmp	xmrig
behavioral2/memory/3700-82-0x00007FF6896A0000-0x00007FF689A92000-memory.dmp	xmrig
behavioral2/memory/1428-422-0x00007FF625740000-0x00007FF625B32000-memory.dmp	xmrig
behavioral2/memory/4260-423-0x00007FF7385D0000-0x00007FF7389C2000-memory.dmp	xmrig
behavioral2/memory/3064-424-0x00007FF78CCB0000-0x00007FF78D0A2000-memory.dmp	xmrig
behavioral2/memory/4068-425-0x00007FF7ECF00000-0x00007FF7ED2F2000-memory.dmp	xmrig
behavioral2/memory/2716-426-0x00007FF7A9680000-0x00007FF7A9A72000-memory.dmp	xmrig
behavioral2/memory/3364-473-0x00007FF714600000-0x00007FF7149F2000-memory.dmp	xmrig
behavioral2/memory/3172-470-0x00007FF7196F0000-0x00007FF719AE2000-memory.dmp	xmrig
behavioral2/memory/1612-458-0x00007FF60FE00000-0x00007FF6101F2000-memory.dmp	xmrig
behavioral2/memory/2828-439-0x00007FF6253F0000-0x00007FF6257E2000-memory.dmp	xmrig
behavioral2/memory/1020-79-0x00007FF6D50F0000-0x00007FF6D54E2000-memory.dmp	xmrig
behavioral2/memory/2132-77-0x00007FF68A020000-0x00007FF68A412000-memory.dmp	xmrig
behavioral2/memory/904-70-0x00007FF7035D0000-0x00007FF7039C2000-memory.dmp	xmrig
behavioral2/memory/5016-57-0x00007FF765F90000-0x00007FF766382000-memory.dmp	xmrig
behavioral2/memory/2968-47-0x00007FF77D6F0000-0x00007FF77DAE2000-memory.dmp	xmrig
behavioral2/memory/2996-11-0x00007FF6885E0000-0x00007FF6889D2000-memory.dmp	xmrig
behavioral2/memory/3788-2567-0x00007FF71ACB0000-0x00007FF71B0A2000-memory.dmp	xmrig
behavioral2/memory/4988-2569-0x00007FF7FDD00000-0x00007FF7FE0F2000-memory.dmp	xmrig
behavioral2/memory/3700-2570-0x00007FF6896A0000-0x00007FF689A92000-memory.dmp	xmrig
behavioral2/memory/3012-2571-0x00007FF7DCA50000-0x00007FF7DCE42000-memory.dmp	xmrig
behavioral2/memory/4452-2612-0x00007FF63C990000-0x00007FF63CD82000-memory.dmp	xmrig
behavioral2/memory/2996-2615-0x00007FF6885E0000-0x00007FF6889D2000-memory.dmp	xmrig
behavioral2/memory/904-2617-0x00007FF7035D0000-0x00007FF7039C2000-memory.dmp	xmrig
behavioral2/memory/1220-2619-0x00007FF6F7440000-0x00007FF6F7832000-memory.dmp	xmrig
behavioral2/memory/2968-2621-0x00007FF77D6F0000-0x00007FF77DAE2000-memory.dmp	xmrig
behavioral2/memory/5016-2623-0x00007FF765F90000-0x00007FF766382000-memory.dmp	xmrig
behavioral2/memory/2132-2625-0x00007FF68A020000-0x00007FF68A412000-memory.dmp	xmrig
behavioral2/memory/4988-2627-0x00007FF7FDD00000-0x00007FF7FE0F2000-memory.dmp	xmrig
behavioral2/memory/1020-2629-0x00007FF6D50F0000-0x00007FF6D54E2000-memory.dmp	xmrig
behavioral2/memory/1428-2635-0x00007FF625740000-0x00007FF625B32000-memory.dmp	xmrig
behavioral2/memory/3364-2669-0x00007FF714600000-0x00007FF7149F2000-memory.dmp	xmrig
behavioral2/memory/3064-2673-0x00007FF78CCB0000-0x00007FF78D0A2000-memory.dmp	xmrig
behavioral2/memory/4068-2681-0x00007FF7ECF00000-0x00007FF7ED2F2000-memory.dmp	xmrig
behavioral2/memory/2828-2683-0x00007FF6253F0000-0x00007FF6257E2000-memory.dmp	xmrig
behavioral2/memory/1612-2685-0x00007FF60FE00000-0x00007FF6101F2000-memory.dmp	xmrig
behavioral2/memory/3172-2687-0x00007FF7196F0000-0x00007FF719AE2000-memory.dmp	xmrig
behavioral2/memory/2716-2679-0x00007FF7A9680000-0x00007FF7A9A72000-memory.dmp	xmrig
behavioral2/memory/4260-2672-0x00007FF7385D0000-0x00007FF7389C2000-memory.dmp	xmrig
behavioral2/memory/3012-2664-0x00007FF7DCA50000-0x00007FF7DCE42000-memory.dmp	xmrig
behavioral2/memory/3700-2654-0x00007FF6896A0000-0x00007FF689A92000-memory.dmp	xmrig
behavioral2/memory/3788-2633-0x00007FF71ACB0000-0x00007FF71B0A2000-memory.dmp	xmrig
behavioral2/memory/4452-2632-0x00007FF63C990000-0x00007FF63CD82000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	392	powershell.exe
5	392	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2996	pyzCBay.exe
904	wEVnnEC.exe
1220	HyKAxEm.exe
2968	peYgMxB.exe
5016	WpeGzUm.exe
2132	pJIaFUt.exe
3788	RRxpcBd.exe
4988	XKQfOVe.exe
1020	YAQeQXF.exe
3700	KofNfaM.exe
4452	qtLtFmW.exe
3012	TsWdTzA.exe
1428	ysjHaWA.exe
3364	RZAzUlA.exe
4260	wFdGxDS.exe
3064	QlQBgxJ.exe
4068	OQGZTlF.exe
2716	tqIQpwr.exe
2828	nIyiBZK.exe
1612	XiySQuP.exe
3172	meKSiFT.exe
2908	OEFYgFb.exe
2640	UDcyuYs.exe
3980	BdjaJoP.exe
5012	QOAZESl.exe
1208	NSwckdR.exe
4796	PvnIsBR.exe
2028	XqqbzEK.exe
4456	pSqRazX.exe
3052	ItKxozV.exe
1988	eHLKqTl.exe
4928	iBbkefB.exe
5060	crzTUit.exe
4584	tOyrtpf.exe
2156	KHANcRw.exe
3432	hNmCegK.exe
4396	gGqLcJA.exe
4632	jPYVxDW.exe
2840	QxDcjyP.exe
2800	ZHTTYaz.exe
1236	aDJpUJd.exe
5076	JoeXZOL.exe
3120	zBFsgfv.exe
4332	xnbAnVQ.exe
4316	HHcZfbi.exe
4648	zZCrfSF.exe
3916	PhWBcMQ.exe
4252	lbUsDMZ.exe
3248	TeLcOiK.exe
764	vsNrMoJ.exe
2056	VLYUHqr.exe
2572	JzeTfeQ.exe
2760	rrvjGKM.exe
1148	hchWZMP.exe
3264	HotHJaY.exe
492	wvdRZZN.exe
4620	jByZiPA.exe
5036	mpXBggt.exe
3092	BWhJxsc.exe
3908	WooWgJa.exe
4288	WZZqRAN.exe
552	ZrIUaQK.exe
1280	KYUfvkW.exe
220	JyrGYpo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2592-0-0x00007FF624F80000-0x00007FF625372000-memory.dmp	upx
behavioral2/files/0x0009000000023403-5.dat	upx
behavioral2/files/0x000800000002340a-10.dat	upx
behavioral2/files/0x000700000002340b-15.dat	upx
behavioral2/files/0x000700000002340c-30.dat	upx
behavioral2/memory/3788-62-0x00007FF71ACB0000-0x00007FF71B0A2000-memory.dmp	upx
behavioral2/files/0x0007000000023412-67.dat	upx
behavioral2/memory/1220-76-0x00007FF6F7440000-0x00007FF6F7832000-memory.dmp	upx
behavioral2/files/0x0007000000023414-78.dat	upx
behavioral2/memory/3700-82-0x00007FF6896A0000-0x00007FF689A92000-memory.dmp	upx
behavioral2/files/0x0007000000023417-109.dat	upx
behavioral2/files/0x0007000000023419-119.dat	upx
behavioral2/files/0x000700000002341d-133.dat	upx
behavioral2/files/0x000700000002341e-146.dat	upx
behavioral2/files/0x0007000000023423-171.dat	upx
behavioral2/files/0x0007000000023425-181.dat	upx
behavioral2/memory/1428-422-0x00007FF625740000-0x00007FF625B32000-memory.dmp	upx
behavioral2/memory/4260-423-0x00007FF7385D0000-0x00007FF7389C2000-memory.dmp	upx
behavioral2/memory/3064-424-0x00007FF78CCB0000-0x00007FF78D0A2000-memory.dmp	upx
behavioral2/memory/4068-425-0x00007FF7ECF00000-0x00007FF7ED2F2000-memory.dmp	upx
behavioral2/memory/2716-426-0x00007FF7A9680000-0x00007FF7A9A72000-memory.dmp	upx
behavioral2/memory/3364-473-0x00007FF714600000-0x00007FF7149F2000-memory.dmp	upx
behavioral2/memory/3172-470-0x00007FF7196F0000-0x00007FF719AE2000-memory.dmp	upx
behavioral2/memory/1612-458-0x00007FF60FE00000-0x00007FF6101F2000-memory.dmp	upx
behavioral2/memory/2828-439-0x00007FF6253F0000-0x00007FF6257E2000-memory.dmp	upx
behavioral2/files/0x0007000000023428-188.dat	upx
behavioral2/files/0x0007000000023426-186.dat	upx
behavioral2/files/0x0007000000023427-183.dat	upx
behavioral2/files/0x0007000000023424-176.dat	upx
behavioral2/files/0x0007000000023422-166.dat	upx
behavioral2/files/0x0007000000023421-161.dat	upx
behavioral2/files/0x0007000000023420-156.dat	upx
behavioral2/files/0x000700000002341f-151.dat	upx
behavioral2/files/0x000700000002341c-136.dat	upx
behavioral2/files/0x000700000002341b-131.dat	upx
behavioral2/files/0x000700000002341a-124.dat	upx
behavioral2/files/0x0007000000023418-113.dat	upx
behavioral2/files/0x0008000000023408-104.dat	upx
behavioral2/files/0x0007000000023416-98.dat	upx
behavioral2/files/0x0007000000023415-92.dat	upx
behavioral2/memory/3012-87-0x00007FF7DCA50000-0x00007FF7DCE42000-memory.dmp	upx
behavioral2/files/0x0007000000023413-85.dat	upx
behavioral2/memory/4452-83-0x00007FF63C990000-0x00007FF63CD82000-memory.dmp	upx
behavioral2/memory/1020-79-0x00007FF6D50F0000-0x00007FF6D54E2000-memory.dmp	upx
behavioral2/memory/2132-77-0x00007FF68A020000-0x00007FF68A412000-memory.dmp	upx
behavioral2/files/0x000800000002340d-73.dat	upx
behavioral2/memory/904-70-0x00007FF7035D0000-0x00007FF7039C2000-memory.dmp	upx
behavioral2/files/0x0007000000023410-64.dat	upx
behavioral2/memory/4988-63-0x00007FF7FDD00000-0x00007FF7FE0F2000-memory.dmp	upx
behavioral2/files/0x0007000000023411-60.dat	upx
behavioral2/memory/5016-57-0x00007FF765F90000-0x00007FF766382000-memory.dmp	upx
behavioral2/files/0x000800000002340e-52.dat	upx
behavioral2/memory/2968-47-0x00007FF77D6F0000-0x00007FF77DAE2000-memory.dmp	upx
behavioral2/files/0x000700000002340f-37.dat	upx
behavioral2/memory/2996-11-0x00007FF6885E0000-0x00007FF6889D2000-memory.dmp	upx
behavioral2/memory/3788-2567-0x00007FF71ACB0000-0x00007FF71B0A2000-memory.dmp	upx
behavioral2/memory/4988-2569-0x00007FF7FDD00000-0x00007FF7FE0F2000-memory.dmp	upx
behavioral2/memory/3700-2570-0x00007FF6896A0000-0x00007FF689A92000-memory.dmp	upx
behavioral2/memory/3012-2571-0x00007FF7DCA50000-0x00007FF7DCE42000-memory.dmp	upx
behavioral2/memory/4452-2612-0x00007FF63C990000-0x00007FF63CD82000-memory.dmp	upx
behavioral2/memory/2996-2615-0x00007FF6885E0000-0x00007FF6889D2000-memory.dmp	upx
behavioral2/memory/904-2617-0x00007FF7035D0000-0x00007FF7039C2000-memory.dmp	upx
behavioral2/memory/1220-2619-0x00007FF6F7440000-0x00007FF6F7832000-memory.dmp	upx
behavioral2/memory/2968-2621-0x00007FF77D6F0000-0x00007FF77DAE2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xxMnHMg.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\RhPElCY.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\bofPEUC.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\XxrwbYa.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\lDpYOeh.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\kinDwTJ.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\lTKLgfS.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\pqwtlkI.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\XflomUz.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\FUQFXYw.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\rzGFisu.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\tRuNFAq.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\fZaJRIG.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\LVmkZIM.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\fXxgqcx.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\ODfQYCd.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\YvLBJTl.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\YXLIFnX.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\vHsqNOn.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\HuTDnuD.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\rOHPoho.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\tOyrtpf.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\AXnUDhP.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\PXpbaFd.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\suHIPsZ.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\LbcinCZ.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\otEiAnb.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\IwYBJhG.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\UkKcrGN.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\YBndxRI.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\aRlKFcv.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\aoetvAV.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\SQGygNb.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\BrjKkjm.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\NssRJRp.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\shgIyYB.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\XQFnDJs.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\NaKSAVF.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\QxDcjyP.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\MRZPkHm.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\WLbtEbL.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\AWecRUv.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\JqFTfma.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\ecEcvpT.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\vVCoSNE.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\lLKSElU.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\DQNHulz.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\CDZyhnQ.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\rbFaAaQ.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\VTFSwFt.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\UygwSHF.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\KvKcaXb.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\iiWlRia.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\CVewebA.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\NlMqyvd.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\AnYpGJg.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\iSjUYPD.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\JzeTfeQ.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\OvVLZBp.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\GhHMOBr.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\KGAHTib.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\vjHfJAb.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\gvjMgug.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
File created	C:\Windows\System\utbLhgn.exe	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
392	powershell.exe
392	powershell.exe
392	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
Token: SeDebugPrivilege	392	powershell.exe
Token: SeLockMemoryPrivilege	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 392	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	85
PID 2592 wrote to memory of 392	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	85
PID 2592 wrote to memory of 2996	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	86
PID 2592 wrote to memory of 2996	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	86
PID 2592 wrote to memory of 904	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	87
PID 2592 wrote to memory of 904	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	87
PID 2592 wrote to memory of 1220	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	88
PID 2592 wrote to memory of 1220	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	88
PID 2592 wrote to memory of 2968	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	89
PID 2592 wrote to memory of 2968	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	89
PID 2592 wrote to memory of 5016	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	90
PID 2592 wrote to memory of 5016	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	90
PID 2592 wrote to memory of 2132	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	91
PID 2592 wrote to memory of 2132	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	91
PID 2592 wrote to memory of 3788	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	92
PID 2592 wrote to memory of 3788	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	92
PID 2592 wrote to memory of 4988	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	93
PID 2592 wrote to memory of 4988	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	93
PID 2592 wrote to memory of 1020	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	94
PID 2592 wrote to memory of 1020	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	94
PID 2592 wrote to memory of 3700	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	95
PID 2592 wrote to memory of 3700	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	95
PID 2592 wrote to memory of 4452	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	96
PID 2592 wrote to memory of 4452	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	96
PID 2592 wrote to memory of 3012	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	97
PID 2592 wrote to memory of 3012	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	97
PID 2592 wrote to memory of 1428	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	98
PID 2592 wrote to memory of 1428	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	98
PID 2592 wrote to memory of 3364	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	99
PID 2592 wrote to memory of 3364	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	99
PID 2592 wrote to memory of 4260	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	100
PID 2592 wrote to memory of 4260	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	100
PID 2592 wrote to memory of 3064	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	101
PID 2592 wrote to memory of 3064	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	101
PID 2592 wrote to memory of 4068	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	102
PID 2592 wrote to memory of 4068	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	102
PID 2592 wrote to memory of 2716	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	103
PID 2592 wrote to memory of 2716	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	103
PID 2592 wrote to memory of 2828	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	104
PID 2592 wrote to memory of 2828	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	104
PID 2592 wrote to memory of 1612	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	105
PID 2592 wrote to memory of 1612	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	105
PID 2592 wrote to memory of 3172	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	106
PID 2592 wrote to memory of 3172	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	106
PID 2592 wrote to memory of 2908	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	107
PID 2592 wrote to memory of 2908	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	107
PID 2592 wrote to memory of 2640	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	108
PID 2592 wrote to memory of 2640	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	108
PID 2592 wrote to memory of 3980	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	109
PID 2592 wrote to memory of 3980	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	109
PID 2592 wrote to memory of 5012	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	110
PID 2592 wrote to memory of 5012	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	110
PID 2592 wrote to memory of 1208	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	111
PID 2592 wrote to memory of 1208	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	111
PID 2592 wrote to memory of 4796	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	112
PID 2592 wrote to memory of 4796	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	112
PID 2592 wrote to memory of 2028	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	113
PID 2592 wrote to memory of 2028	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	113
PID 2592 wrote to memory of 4456	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	114
PID 2592 wrote to memory of 4456	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	114
PID 2592 wrote to memory of 3052	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	115
PID 2592 wrote to memory of 3052	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	115
PID 2592 wrote to memory of 1988	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	116
PID 2592 wrote to memory of 1988	2592	07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07a6c3ddd28bed0c5b9e297869d576f4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:392
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "392" "3012" "2952" "3016" "0" "0" "3020" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12524
- C:\Windows\System\pyzCBay.exe
  C:\Windows\System\pyzCBay.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\wEVnnEC.exe
  C:\Windows\System\wEVnnEC.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\HyKAxEm.exe
  C:\Windows\System\HyKAxEm.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\peYgMxB.exe
  C:\Windows\System\peYgMxB.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\WpeGzUm.exe
  C:\Windows\System\WpeGzUm.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\pJIaFUt.exe
  C:\Windows\System\pJIaFUt.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\RRxpcBd.exe
  C:\Windows\System\RRxpcBd.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\XKQfOVe.exe
  C:\Windows\System\XKQfOVe.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\YAQeQXF.exe
  C:\Windows\System\YAQeQXF.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\KofNfaM.exe
  C:\Windows\System\KofNfaM.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\qtLtFmW.exe
  C:\Windows\System\qtLtFmW.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\TsWdTzA.exe
  C:\Windows\System\TsWdTzA.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\ysjHaWA.exe
  C:\Windows\System\ysjHaWA.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\RZAzUlA.exe
  C:\Windows\System\RZAzUlA.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\wFdGxDS.exe
  C:\Windows\System\wFdGxDS.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\QlQBgxJ.exe
  C:\Windows\System\QlQBgxJ.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\OQGZTlF.exe
  C:\Windows\System\OQGZTlF.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\tqIQpwr.exe
  C:\Windows\System\tqIQpwr.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\nIyiBZK.exe
  C:\Windows\System\nIyiBZK.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\XiySQuP.exe
  C:\Windows\System\XiySQuP.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\meKSiFT.exe
  C:\Windows\System\meKSiFT.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\OEFYgFb.exe
  C:\Windows\System\OEFYgFb.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\UDcyuYs.exe
  C:\Windows\System\UDcyuYs.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\BdjaJoP.exe
  C:\Windows\System\BdjaJoP.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\QOAZESl.exe
  C:\Windows\System\QOAZESl.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\NSwckdR.exe
  C:\Windows\System\NSwckdR.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\PvnIsBR.exe
  C:\Windows\System\PvnIsBR.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\XqqbzEK.exe
  C:\Windows\System\XqqbzEK.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\pSqRazX.exe
  C:\Windows\System\pSqRazX.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\ItKxozV.exe
  C:\Windows\System\ItKxozV.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\eHLKqTl.exe
  C:\Windows\System\eHLKqTl.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\iBbkefB.exe
  C:\Windows\System\iBbkefB.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\crzTUit.exe
  C:\Windows\System\crzTUit.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\tOyrtpf.exe
  C:\Windows\System\tOyrtpf.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\KHANcRw.exe
  C:\Windows\System\KHANcRw.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\hNmCegK.exe
  C:\Windows\System\hNmCegK.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\gGqLcJA.exe
  C:\Windows\System\gGqLcJA.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\jPYVxDW.exe
  C:\Windows\System\jPYVxDW.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\QxDcjyP.exe
  C:\Windows\System\QxDcjyP.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\ZHTTYaz.exe
  C:\Windows\System\ZHTTYaz.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\aDJpUJd.exe
  C:\Windows\System\aDJpUJd.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\JoeXZOL.exe
  C:\Windows\System\JoeXZOL.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\zBFsgfv.exe
  C:\Windows\System\zBFsgfv.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\xnbAnVQ.exe
  C:\Windows\System\xnbAnVQ.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\HHcZfbi.exe
  C:\Windows\System\HHcZfbi.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\zZCrfSF.exe
  C:\Windows\System\zZCrfSF.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\PhWBcMQ.exe
  C:\Windows\System\PhWBcMQ.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\lbUsDMZ.exe
  C:\Windows\System\lbUsDMZ.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\TeLcOiK.exe
  C:\Windows\System\TeLcOiK.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\vsNrMoJ.exe
  C:\Windows\System\vsNrMoJ.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\VLYUHqr.exe
  C:\Windows\System\VLYUHqr.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\JzeTfeQ.exe
  C:\Windows\System\JzeTfeQ.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\rrvjGKM.exe
  C:\Windows\System\rrvjGKM.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\hchWZMP.exe
  C:\Windows\System\hchWZMP.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\HotHJaY.exe
  C:\Windows\System\HotHJaY.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\wvdRZZN.exe
  C:\Windows\System\wvdRZZN.exe
  2⤵
  - Executes dropped EXE
  PID:492
- C:\Windows\System\jByZiPA.exe
  C:\Windows\System\jByZiPA.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\mpXBggt.exe
  C:\Windows\System\mpXBggt.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\BWhJxsc.exe
  C:\Windows\System\BWhJxsc.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\WooWgJa.exe
  C:\Windows\System\WooWgJa.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\WZZqRAN.exe
  C:\Windows\System\WZZqRAN.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\ZrIUaQK.exe
  C:\Windows\System\ZrIUaQK.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\KYUfvkW.exe
  C:\Windows\System\KYUfvkW.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\JyrGYpo.exe
  C:\Windows\System\JyrGYpo.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\rzGFisu.exe
  C:\Windows\System\rzGFisu.exe
  2⤵
  PID:4336
- C:\Windows\System\CpqOPWv.exe
  C:\Windows\System\CpqOPWv.exe
  2⤵
  PID:2420
- C:\Windows\System\JqFTfma.exe
  C:\Windows\System\JqFTfma.exe
  2⤵
  PID:2736
- C:\Windows\System\wwLNnQi.exe
  C:\Windows\System\wwLNnQi.exe
  2⤵
  PID:3936
- C:\Windows\System\lnkooap.exe
  C:\Windows\System\lnkooap.exe
  2⤵
  PID:2232
- C:\Windows\System\ZdydUMa.exe
  C:\Windows\System\ZdydUMa.exe
  2⤵
  PID:4380
- C:\Windows\System\JPWzpvP.exe
  C:\Windows\System\JPWzpvP.exe
  2⤵
  PID:4368
- C:\Windows\System\ZlXuMix.exe
  C:\Windows\System\ZlXuMix.exe
  2⤵
  PID:3044
- C:\Windows\System\zvyGdep.exe
  C:\Windows\System\zvyGdep.exe
  2⤵
  PID:2276
- C:\Windows\System\oHdGsjZ.exe
  C:\Windows\System\oHdGsjZ.exe
  2⤵
  PID:2844
- C:\Windows\System\GOwqanL.exe
  C:\Windows\System\GOwqanL.exe
  2⤵
  PID:5132
- C:\Windows\System\FDybJHL.exe
  C:\Windows\System\FDybJHL.exe
  2⤵
  PID:5156
- C:\Windows\System\LnrGMMS.exe
  C:\Windows\System\LnrGMMS.exe
  2⤵
  PID:5180
- C:\Windows\System\BygXylZ.exe
  C:\Windows\System\BygXylZ.exe
  2⤵
  PID:5208
- C:\Windows\System\fmDHZJr.exe
  C:\Windows\System\fmDHZJr.exe
  2⤵
  PID:5236
- C:\Windows\System\ynDoroa.exe
  C:\Windows\System\ynDoroa.exe
  2⤵
  PID:5264
- C:\Windows\System\EuoHMCc.exe
  C:\Windows\System\EuoHMCc.exe
  2⤵
  PID:5292
- C:\Windows\System\fWdsFut.exe
  C:\Windows\System\fWdsFut.exe
  2⤵
  PID:5320
- C:\Windows\System\PJvImKR.exe
  C:\Windows\System\PJvImKR.exe
  2⤵
  PID:5348
- C:\Windows\System\cOffJii.exe
  C:\Windows\System\cOffJii.exe
  2⤵
  PID:5376
- C:\Windows\System\suHIPsZ.exe
  C:\Windows\System\suHIPsZ.exe
  2⤵
  PID:5404
- C:\Windows\System\eYeLDAs.exe
  C:\Windows\System\eYeLDAs.exe
  2⤵
  PID:5432
- C:\Windows\System\eWNXELD.exe
  C:\Windows\System\eWNXELD.exe
  2⤵
  PID:5460
- C:\Windows\System\LvmZUrq.exe
  C:\Windows\System\LvmZUrq.exe
  2⤵
  PID:5488
- C:\Windows\System\oWSdPRu.exe
  C:\Windows\System\oWSdPRu.exe
  2⤵
  PID:5516
- C:\Windows\System\aoTYnRn.exe
  C:\Windows\System\aoTYnRn.exe
  2⤵
  PID:5544
- C:\Windows\System\wMdXfVr.exe
  C:\Windows\System\wMdXfVr.exe
  2⤵
  PID:5576
- C:\Windows\System\JXFcOkt.exe
  C:\Windows\System\JXFcOkt.exe
  2⤵
  PID:5640
- C:\Windows\System\WbRsqip.exe
  C:\Windows\System\WbRsqip.exe
  2⤵
  PID:5656
- C:\Windows\System\gTqsMzy.exe
  C:\Windows\System\gTqsMzy.exe
  2⤵
  PID:5672
- C:\Windows\System\ilECuvy.exe
  C:\Windows\System\ilECuvy.exe
  2⤵
  PID:5700
- C:\Windows\System\fEZXVmN.exe
  C:\Windows\System\fEZXVmN.exe
  2⤵
  PID:5724
- C:\Windows\System\JyLNLwO.exe
  C:\Windows\System\JyLNLwO.exe
  2⤵
  PID:5744
- C:\Windows\System\azFSUzz.exe
  C:\Windows\System\azFSUzz.exe
  2⤵
  PID:5772
- C:\Windows\System\XflomUz.exe
  C:\Windows\System\XflomUz.exe
  2⤵
  PID:5800
- C:\Windows\System\aRGOLqM.exe
  C:\Windows\System\aRGOLqM.exe
  2⤵
  PID:5828
- C:\Windows\System\QiYbnew.exe
  C:\Windows\System\QiYbnew.exe
  2⤵
  PID:5852
- C:\Windows\System\ZxLMWPZ.exe
  C:\Windows\System\ZxLMWPZ.exe
  2⤵
  PID:5880
- C:\Windows\System\dfmzgyZ.exe
  C:\Windows\System\dfmzgyZ.exe
  2⤵
  PID:5912
- C:\Windows\System\tXsaqUE.exe
  C:\Windows\System\tXsaqUE.exe
  2⤵
  PID:5940
- C:\Windows\System\hTFmPuZ.exe
  C:\Windows\System\hTFmPuZ.exe
  2⤵
  PID:5972
- C:\Windows\System\JAkvQGM.exe
  C:\Windows\System\JAkvQGM.exe
  2⤵
  PID:6004
- C:\Windows\System\IPJjTHY.exe
  C:\Windows\System\IPJjTHY.exe
  2⤵
  PID:6032
- C:\Windows\System\KPtGdWn.exe
  C:\Windows\System\KPtGdWn.exe
  2⤵
  PID:6064
- C:\Windows\System\DNoHxBu.exe
  C:\Windows\System\DNoHxBu.exe
  2⤵
  PID:6088
- C:\Windows\System\DCEEewh.exe
  C:\Windows\System\DCEEewh.exe
  2⤵
  PID:6116
- C:\Windows\System\dZDdTNm.exe
  C:\Windows\System\dZDdTNm.exe
  2⤵
  PID:3300
- C:\Windows\System\AXnUDhP.exe
  C:\Windows\System\AXnUDhP.exe
  2⤵
  PID:2880
- C:\Windows\System\TOtNevn.exe
  C:\Windows\System\TOtNevn.exe
  2⤵
  PID:2976
- C:\Windows\System\xszwEPW.exe
  C:\Windows\System\xszwEPW.exe
  2⤵
  PID:5164
- C:\Windows\System\wLPqsEA.exe
  C:\Windows\System\wLPqsEA.exe
  2⤵
  PID:5196
- C:\Windows\System\kCfTcNo.exe
  C:\Windows\System\kCfTcNo.exe
  2⤵
  PID:5256
- C:\Windows\System\StvXITy.exe
  C:\Windows\System\StvXITy.exe
  2⤵
  PID:5332
- C:\Windows\System\fSfvKLh.exe
  C:\Windows\System\fSfvKLh.exe
  2⤵
  PID:5368
- C:\Windows\System\xUIeseW.exe
  C:\Windows\System\xUIeseW.exe
  2⤵
  PID:5416
- C:\Windows\System\VJxlosC.exe
  C:\Windows\System\VJxlosC.exe
  2⤵
  PID:5448
- C:\Windows\System\rCiWSoB.exe
  C:\Windows\System\rCiWSoB.exe
  2⤵
  PID:5504
- C:\Windows\System\cItrcGX.exe
  C:\Windows\System\cItrcGX.exe
  2⤵
  PID:5556
- C:\Windows\System\rQONmbX.exe
  C:\Windows\System\rQONmbX.exe
  2⤵
  PID:5592
- C:\Windows\System\cCigsBR.exe
  C:\Windows\System\cCigsBR.exe
  2⤵
  PID:5632
- C:\Windows\System\eWhdkDC.exe
  C:\Windows\System\eWhdkDC.exe
  2⤵
  PID:5736
- C:\Windows\System\tlelnCL.exe
  C:\Windows\System\tlelnCL.exe
  2⤵
  PID:5788
- C:\Windows\System\gZtqBwk.exe
  C:\Windows\System\gZtqBwk.exe
  2⤵
  PID:5816
- C:\Windows\System\zwsudfN.exe
  C:\Windows\System\zwsudfN.exe
  2⤵
  PID:5848
- C:\Windows\System\dByvAig.exe
  C:\Windows\System\dByvAig.exe
  2⤵
  PID:5908
- C:\Windows\System\GWyeKYu.exe
  C:\Windows\System\GWyeKYu.exe
  2⤵
  PID:6000
- C:\Windows\System\YBndxRI.exe
  C:\Windows\System\YBndxRI.exe
  2⤵
  PID:4088
- C:\Windows\System\PbLEPSK.exe
  C:\Windows\System\PbLEPSK.exe
  2⤵
  PID:3728
- C:\Windows\System\CpFucSt.exe
  C:\Windows\System\CpFucSt.exe
  2⤵
  PID:4624
- C:\Windows\System\MRZPkHm.exe
  C:\Windows\System\MRZPkHm.exe
  2⤵
  PID:3180
- C:\Windows\System\aSLLrxg.exe
  C:\Windows\System\aSLLrxg.exe
  2⤵
  PID:892
- C:\Windows\System\gMBYusQ.exe
  C:\Windows\System\gMBYusQ.exe
  2⤵
  PID:692
- C:\Windows\System\KXclVNM.exe
  C:\Windows\System\KXclVNM.exe
  2⤵
  PID:1036
- C:\Windows\System\Vxekgmb.exe
  C:\Windows\System\Vxekgmb.exe
  2⤵
  PID:3308
- C:\Windows\System\UpAHCuY.exe
  C:\Windows\System\UpAHCuY.exe
  2⤵
  PID:5596
- C:\Windows\System\ewCqkOo.exe
  C:\Windows\System\ewCqkOo.exe
  2⤵
  PID:5480
- C:\Windows\System\RkABGal.exe
  C:\Windows\System\RkABGal.exe
  2⤵
  PID:5400
- C:\Windows\System\gLcQfJJ.exe
  C:\Windows\System\gLcQfJJ.exe
  2⤵
  PID:5568
- C:\Windows\System\XVYyWKO.exe
  C:\Windows\System\XVYyWKO.exe
  2⤵
  PID:5844
- C:\Windows\System\aRlKFcv.exe
  C:\Windows\System\aRlKFcv.exe
  2⤵
  PID:5968
- C:\Windows\System\eIHfqDK.exe
  C:\Windows\System\eIHfqDK.exe
  2⤵
  PID:6080
- C:\Windows\System\bFxdVWD.exe
  C:\Windows\System\bFxdVWD.exe
  2⤵
  PID:3772
- C:\Windows\System\RRfGvEo.exe
  C:\Windows\System\RRfGvEo.exe
  2⤵
  PID:5020
- C:\Windows\System\IXoDwlX.exe
  C:\Windows\System\IXoDwlX.exe
  2⤵
  PID:4960
- C:\Windows\System\ZyiavwY.exe
  C:\Windows\System\ZyiavwY.exe
  2⤵
  PID:1768
- C:\Windows\System\ZdNHTaj.exe
  C:\Windows\System\ZdNHTaj.exe
  2⤵
  PID:3948
- C:\Windows\System\oWzHMsB.exe
  C:\Windows\System\oWzHMsB.exe
  2⤵
  PID:5444
- C:\Windows\System\yAzlXqx.exe
  C:\Windows\System\yAzlXqx.exe
  2⤵
  PID:5308
- C:\Windows\System\kgInAnF.exe
  C:\Windows\System\kgInAnF.exe
  2⤵
  PID:2100
- C:\Windows\System\shcMBKh.exe
  C:\Windows\System\shcMBKh.exe
  2⤵
  PID:3596
- C:\Windows\System\zPSRauq.exe
  C:\Windows\System\zPSRauq.exe
  2⤵
  PID:2296
- C:\Windows\System\fxKrGKQ.exe
  C:\Windows\System\fxKrGKQ.exe
  2⤵
  PID:5684
- C:\Windows\System\YUGwACQ.exe
  C:\Windows\System\YUGwACQ.exe
  2⤵
  PID:3636
- C:\Windows\System\ouTilSq.exe
  C:\Windows\System\ouTilSq.exe
  2⤵
  PID:2112
- C:\Windows\System\VQBYQvd.exe
  C:\Windows\System\VQBYQvd.exe
  2⤵
  PID:656
- C:\Windows\System\SjVxzWC.exe
  C:\Windows\System\SjVxzWC.exe
  2⤵
  PID:1508
- C:\Windows\System\xzbKQxa.exe
  C:\Windows\System\xzbKQxa.exe
  2⤵
  PID:1392
- C:\Windows\System\IfmevtA.exe
  C:\Windows\System\IfmevtA.exe
  2⤵
  PID:3664
- C:\Windows\System\dZsHMXL.exe
  C:\Windows\System\dZsHMXL.exe
  2⤵
  PID:4420
- C:\Windows\System\GffoXcN.exe
  C:\Windows\System\GffoXcN.exe
  2⤵
  PID:6164
- C:\Windows\System\ypIjNFg.exe
  C:\Windows\System\ypIjNFg.exe
  2⤵
  PID:6188
- C:\Windows\System\WdOItVq.exe
  C:\Windows\System\WdOItVq.exe
  2⤵
  PID:6212
- C:\Windows\System\hPmUvJV.exe
  C:\Windows\System\hPmUvJV.exe
  2⤵
  PID:6236
- C:\Windows\System\LxzNfTR.exe
  C:\Windows\System\LxzNfTR.exe
  2⤵
  PID:6260
- C:\Windows\System\fcCOrOv.exe
  C:\Windows\System\fcCOrOv.exe
  2⤵
  PID:6288
- C:\Windows\System\KIzmmzG.exe
  C:\Windows\System\KIzmmzG.exe
  2⤵
  PID:6304
- C:\Windows\System\esxBxZm.exe
  C:\Windows\System\esxBxZm.exe
  2⤵
  PID:6336
- C:\Windows\System\nEPbhOw.exe
  C:\Windows\System\nEPbhOw.exe
  2⤵
  PID:6392
- C:\Windows\System\wODCjMP.exe
  C:\Windows\System\wODCjMP.exe
  2⤵
  PID:6416
- C:\Windows\System\aELzLsA.exe
  C:\Windows\System\aELzLsA.exe
  2⤵
  PID:6444
- C:\Windows\System\yfdLvSf.exe
  C:\Windows\System\yfdLvSf.exe
  2⤵
  PID:6488
- C:\Windows\System\oFUNYcg.exe
  C:\Windows\System\oFUNYcg.exe
  2⤵
  PID:6508
- C:\Windows\System\XnwIoWa.exe
  C:\Windows\System\XnwIoWa.exe
  2⤵
  PID:6528
- C:\Windows\System\nrwskzn.exe
  C:\Windows\System\nrwskzn.exe
  2⤵
  PID:6556
- C:\Windows\System\sOfokzi.exe
  C:\Windows\System\sOfokzi.exe
  2⤵
  PID:6584
- C:\Windows\System\eKtORwP.exe
  C:\Windows\System\eKtORwP.exe
  2⤵
  PID:6624
- C:\Windows\System\PqGzSiJ.exe
  C:\Windows\System\PqGzSiJ.exe
  2⤵
  PID:6648
- C:\Windows\System\wCCmKUK.exe
  C:\Windows\System\wCCmKUK.exe
  2⤵
  PID:6668
- C:\Windows\System\GtAvYZL.exe
  C:\Windows\System\GtAvYZL.exe
  2⤵
  PID:6696
- C:\Windows\System\ziYhKQP.exe
  C:\Windows\System\ziYhKQP.exe
  2⤵
  PID:6720
- C:\Windows\System\KYDloXc.exe
  C:\Windows\System\KYDloXc.exe
  2⤵
  PID:6744
- C:\Windows\System\enpkEKq.exe
  C:\Windows\System\enpkEKq.exe
  2⤵
  PID:6760
- C:\Windows\System\LVqOyOm.exe
  C:\Windows\System\LVqOyOm.exe
  2⤵
  PID:6784
- C:\Windows\System\iYkAZlq.exe
  C:\Windows\System\iYkAZlq.exe
  2⤵
  PID:6812
- C:\Windows\System\gxMpfvr.exe
  C:\Windows\System\gxMpfvr.exe
  2⤵
  PID:6840
- C:\Windows\System\VJVnlnv.exe
  C:\Windows\System\VJVnlnv.exe
  2⤵
  PID:6864
- C:\Windows\System\NiuzOkE.exe
  C:\Windows\System\NiuzOkE.exe
  2⤵
  PID:6924
- C:\Windows\System\vwkfdBW.exe
  C:\Windows\System\vwkfdBW.exe
  2⤵
  PID:6952
- C:\Windows\System\PhOuwut.exe
  C:\Windows\System\PhOuwut.exe
  2⤵
  PID:6980
- C:\Windows\System\jChtZjF.exe
  C:\Windows\System\jChtZjF.exe
  2⤵
  PID:7000
- C:\Windows\System\NjDgWKK.exe
  C:\Windows\System\NjDgWKK.exe
  2⤵
  PID:7020
- C:\Windows\System\BTgpBHA.exe
  C:\Windows\System\BTgpBHA.exe
  2⤵
  PID:7048
- C:\Windows\System\pWsIkHt.exe
  C:\Windows\System\pWsIkHt.exe
  2⤵
  PID:7112
- C:\Windows\System\DnhjORA.exe
  C:\Windows\System\DnhjORA.exe
  2⤵
  PID:7132
- C:\Windows\System\WCeNTSg.exe
  C:\Windows\System\WCeNTSg.exe
  2⤵
  PID:7156
- C:\Windows\System\EdZfrDb.exe
  C:\Windows\System\EdZfrDb.exe
  2⤵
  PID:6176
- C:\Windows\System\AoCZGTu.exe
  C:\Windows\System\AoCZGTu.exe
  2⤵
  PID:3904
- C:\Windows\System\bZhComl.exe
  C:\Windows\System\bZhComl.exe
  2⤵
  PID:6252
- C:\Windows\System\HEHTmay.exe
  C:\Windows\System\HEHTmay.exe
  2⤵
  PID:6348
- C:\Windows\System\WyCwcLR.exe
  C:\Windows\System\WyCwcLR.exe
  2⤵
  PID:6404
- C:\Windows\System\NNpgoGR.exe
  C:\Windows\System\NNpgoGR.exe
  2⤵
  PID:5892
- C:\Windows\System\zqZoYvz.exe
  C:\Windows\System\zqZoYvz.exe
  2⤵
  PID:6564
- C:\Windows\System\RhPElCY.exe
  C:\Windows\System\RhPElCY.exe
  2⤵
  PID:6580
- C:\Windows\System\Hlqcvdp.exe
  C:\Windows\System\Hlqcvdp.exe
  2⤵
  PID:6632
- C:\Windows\System\sUqlfGz.exe
  C:\Windows\System\sUqlfGz.exe
  2⤵
  PID:6676
- C:\Windows\System\RsDxdzz.exe
  C:\Windows\System\RsDxdzz.exe
  2⤵
  PID:6704
- C:\Windows\System\IPtQTYA.exe
  C:\Windows\System\IPtQTYA.exe
  2⤵
  PID:6768
- C:\Windows\System\BayIMmT.exe
  C:\Windows\System\BayIMmT.exe
  2⤵
  PID:6856
- C:\Windows\System\eppxbFr.exe
  C:\Windows\System\eppxbFr.exe
  2⤵
  PID:6972
- C:\Windows\System\wLYFxHt.exe
  C:\Windows\System\wLYFxHt.exe
  2⤵
  PID:7068
- C:\Windows\System\JAVhJFN.exe
  C:\Windows\System\JAVhJFN.exe
  2⤵
  PID:7104
- C:\Windows\System\rVTZhCB.exe
  C:\Windows\System\rVTZhCB.exe
  2⤵
  PID:7148
- C:\Windows\System\PmbbSRX.exe
  C:\Windows\System\PmbbSRX.exe
  2⤵
  PID:6200
- C:\Windows\System\ryEMDgd.exe
  C:\Windows\System\ryEMDgd.exe
  2⤵
  PID:6424
- C:\Windows\System\EdxYsUa.exe
  C:\Windows\System\EdxYsUa.exe
  2⤵
  PID:6548
- C:\Windows\System\pgaYsMV.exe
  C:\Windows\System\pgaYsMV.exe
  2⤵
  PID:6780
- C:\Windows\System\BPzIfDc.exe
  C:\Windows\System\BPzIfDc.exe
  2⤵
  PID:6804
- C:\Windows\System\UusRMMR.exe
  C:\Windows\System\UusRMMR.exe
  2⤵
  PID:6920
- C:\Windows\System\DcarzWX.exe
  C:\Windows\System\DcarzWX.exe
  2⤵
  PID:7016
- C:\Windows\System\myUHGkD.exe
  C:\Windows\System\myUHGkD.exe
  2⤵
  PID:4272
- C:\Windows\System\gNPQLpY.exe
  C:\Windows\System\gNPQLpY.exe
  2⤵
  PID:6384
- C:\Windows\System\huWhWNi.exe
  C:\Windows\System\huWhWNi.exe
  2⤵
  PID:6684
- C:\Windows\System\IvOWxIH.exe
  C:\Windows\System\IvOWxIH.exe
  2⤵
  PID:7080
- C:\Windows\System\zSowUEd.exe
  C:\Windows\System\zSowUEd.exe
  2⤵
  PID:7176
- C:\Windows\System\VYTYrMY.exe
  C:\Windows\System\VYTYrMY.exe
  2⤵
  PID:7200
- C:\Windows\System\jRWLmDC.exe
  C:\Windows\System\jRWLmDC.exe
  2⤵
  PID:7216
- C:\Windows\System\hnmfwsc.exe
  C:\Windows\System\hnmfwsc.exe
  2⤵
  PID:7264
- C:\Windows\System\HOcLxLP.exe
  C:\Windows\System\HOcLxLP.exe
  2⤵
  PID:7296
- C:\Windows\System\VhTjxOQ.exe
  C:\Windows\System\VhTjxOQ.exe
  2⤵
  PID:7312
- C:\Windows\System\ZGuezSQ.exe
  C:\Windows\System\ZGuezSQ.exe
  2⤵
  PID:7332
- C:\Windows\System\OMvMnHV.exe
  C:\Windows\System\OMvMnHV.exe
  2⤵
  PID:7356
- C:\Windows\System\neyNaxP.exe
  C:\Windows\System\neyNaxP.exe
  2⤵
  PID:7376
- C:\Windows\System\mmlVBEF.exe
  C:\Windows\System\mmlVBEF.exe
  2⤵
  PID:7416
- C:\Windows\System\FEzguIa.exe
  C:\Windows\System\FEzguIa.exe
  2⤵
  PID:7440
- C:\Windows\System\GxwsAiz.exe
  C:\Windows\System\GxwsAiz.exe
  2⤵
  PID:7484
- C:\Windows\System\WLbtEbL.exe
  C:\Windows\System\WLbtEbL.exe
  2⤵
  PID:7524
- C:\Windows\System\yGQpHxg.exe
  C:\Windows\System\yGQpHxg.exe
  2⤵
  PID:7552
- C:\Windows\System\YNnFLcU.exe
  C:\Windows\System\YNnFLcU.exe
  2⤵
  PID:7572
- C:\Windows\System\mYDOsHw.exe
  C:\Windows\System\mYDOsHw.exe
  2⤵
  PID:7588
- C:\Windows\System\AvzDxtY.exe
  C:\Windows\System\AvzDxtY.exe
  2⤵
  PID:7608
- C:\Windows\System\yubXgOJ.exe
  C:\Windows\System\yubXgOJ.exe
  2⤵
  PID:7652
- C:\Windows\System\leukvNO.exe
  C:\Windows\System\leukvNO.exe
  2⤵
  PID:7700
- C:\Windows\System\jvtRDwH.exe
  C:\Windows\System\jvtRDwH.exe
  2⤵
  PID:7724
- C:\Windows\System\XipUEtC.exe
  C:\Windows\System\XipUEtC.exe
  2⤵
  PID:7744
- C:\Windows\System\OzYWzup.exe
  C:\Windows\System\OzYWzup.exe
  2⤵
  PID:7792
- C:\Windows\System\fRlCgal.exe
  C:\Windows\System\fRlCgal.exe
  2⤵
  PID:7820
- C:\Windows\System\FNwzivF.exe
  C:\Windows\System\FNwzivF.exe
  2⤵
  PID:7840
- C:\Windows\System\bofPEUC.exe
  C:\Windows\System\bofPEUC.exe
  2⤵
  PID:7860
- C:\Windows\System\HpaxhlJ.exe
  C:\Windows\System\HpaxhlJ.exe
  2⤵
  PID:7888
- C:\Windows\System\pmxINmt.exe
  C:\Windows\System\pmxINmt.exe
  2⤵
  PID:7936
- C:\Windows\System\ZpgKYyA.exe
  C:\Windows\System\ZpgKYyA.exe
  2⤵
  PID:7956
- C:\Windows\System\EAiLRND.exe
  C:\Windows\System\EAiLRND.exe
  2⤵
  PID:7988
- C:\Windows\System\UJvgyuh.exe
  C:\Windows\System\UJvgyuh.exe
  2⤵
  PID:8008
- C:\Windows\System\aoetvAV.exe
  C:\Windows\System\aoetvAV.exe
  2⤵
  PID:8028
- C:\Windows\System\TUiUnjA.exe
  C:\Windows\System\TUiUnjA.exe
  2⤵
  PID:8068
- C:\Windows\System\TYtgZTx.exe
  C:\Windows\System\TYtgZTx.exe
  2⤵
  PID:8096
- C:\Windows\System\hWGiUdh.exe
  C:\Windows\System\hWGiUdh.exe
  2⤵
  PID:8120
- C:\Windows\System\euuVhrO.exe
  C:\Windows\System\euuVhrO.exe
  2⤵
  PID:8160
- C:\Windows\System\ybYxEaq.exe
  C:\Windows\System\ybYxEaq.exe
  2⤵
  PID:8184
- C:\Windows\System\mqcCYoQ.exe
  C:\Windows\System\mqcCYoQ.exe
  2⤵
  PID:6800
- C:\Windows\System\GfqEcHi.exe
  C:\Windows\System\GfqEcHi.exe
  2⤵
  PID:7028
- C:\Windows\System\rBHwojf.exe
  C:\Windows\System\rBHwojf.exe
  2⤵
  PID:7260
- C:\Windows\System\QWMIiAh.exe
  C:\Windows\System\QWMIiAh.exe
  2⤵
  PID:7256
- C:\Windows\System\ykbEmkY.exe
  C:\Windows\System\ykbEmkY.exe
  2⤵
  PID:7364
- C:\Windows\System\vlEzlLF.exe
  C:\Windows\System\vlEzlLF.exe
  2⤵
  PID:7452
- C:\Windows\System\CuHaAxo.exe
  C:\Windows\System\CuHaAxo.exe
  2⤵
  PID:7504
- C:\Windows\System\wCKHVNd.exe
  C:\Windows\System\wCKHVNd.exe
  2⤵
  PID:7564
- C:\Windows\System\dBVnBnY.exe
  C:\Windows\System\dBVnBnY.exe
  2⤵
  PID:7584
- C:\Windows\System\tRuNFAq.exe
  C:\Windows\System\tRuNFAq.exe
  2⤵
  PID:7688
- C:\Windows\System\opkuAIz.exe
  C:\Windows\System\opkuAIz.exe
  2⤵
  PID:7640
- C:\Windows\System\BdWyzUd.exe
  C:\Windows\System\BdWyzUd.exe
  2⤵
  PID:7828
- C:\Windows\System\RlMsezN.exe
  C:\Windows\System\RlMsezN.exe
  2⤵
  PID:7852
- C:\Windows\System\iHRjGDb.exe
  C:\Windows\System\iHRjGDb.exe
  2⤵
  PID:7996
- C:\Windows\System\TzjmRfK.exe
  C:\Windows\System\TzjmRfK.exe
  2⤵
  PID:8080
- C:\Windows\System\lCQxEFY.exe
  C:\Windows\System\lCQxEFY.exe
  2⤵
  PID:8140
- C:\Windows\System\idicnEB.exe
  C:\Windows\System\idicnEB.exe
  2⤵
  PID:8156
- C:\Windows\System\emqlmdQ.exe
  C:\Windows\System\emqlmdQ.exe
  2⤵
  PID:7212
- C:\Windows\System\RyzIwzk.exe
  C:\Windows\System\RyzIwzk.exe
  2⤵
  PID:7248
- C:\Windows\System\WTnfJUS.exe
  C:\Windows\System\WTnfJUS.exe
  2⤵
  PID:7372
- C:\Windows\System\aEcgYoU.exe
  C:\Windows\System\aEcgYoU.exe
  2⤵
  PID:7624
- C:\Windows\System\PGlAJNs.exe
  C:\Windows\System\PGlAJNs.exe
  2⤵
  PID:7736
- C:\Windows\System\gfuPpVT.exe
  C:\Windows\System\gfuPpVT.exe
  2⤵
  PID:7916
- C:\Windows\System\mKUNAQz.exe
  C:\Windows\System\mKUNAQz.exe
  2⤵
  PID:8092
- C:\Windows\System\EPmyrWB.exe
  C:\Windows\System\EPmyrWB.exe
  2⤵
  PID:7480
- C:\Windows\System\bQxlPVV.exe
  C:\Windows\System\bQxlPVV.exe
  2⤵
  PID:8060
- C:\Windows\System\KstpYPo.exe
  C:\Windows\System\KstpYPo.exe
  2⤵
  PID:6960
- C:\Windows\System\ZbSBKqI.exe
  C:\Windows\System\ZbSBKqI.exe
  2⤵
  PID:8064
- C:\Windows\System\TyxuywT.exe
  C:\Windows\System\TyxuywT.exe
  2⤵
  PID:8204
- C:\Windows\System\aqoAsYV.exe
  C:\Windows\System\aqoAsYV.exe
  2⤵
  PID:8224
- C:\Windows\System\cbLQYsc.exe
  C:\Windows\System\cbLQYsc.exe
  2⤵
  PID:8288
- C:\Windows\System\ZVDMSZp.exe
  C:\Windows\System\ZVDMSZp.exe
  2⤵
  PID:8308
- C:\Windows\System\UaBiJfS.exe
  C:\Windows\System\UaBiJfS.exe
  2⤵
  PID:8328
- C:\Windows\System\DYoDEon.exe
  C:\Windows\System\DYoDEon.exe
  2⤵
  PID:8344
- C:\Windows\System\CvDqxJH.exe
  C:\Windows\System\CvDqxJH.exe
  2⤵
  PID:8368
- C:\Windows\System\YMrfUfg.exe
  C:\Windows\System\YMrfUfg.exe
  2⤵
  PID:8392
- C:\Windows\System\TFqKpIp.exe
  C:\Windows\System\TFqKpIp.exe
  2⤵
  PID:8420
- C:\Windows\System\zdekCOg.exe
  C:\Windows\System\zdekCOg.exe
  2⤵
  PID:8448
- C:\Windows\System\rUHPysa.exe
  C:\Windows\System\rUHPysa.exe
  2⤵
  PID:8464
- C:\Windows\System\qBEGcwh.exe
  C:\Windows\System\qBEGcwh.exe
  2⤵
  PID:8492
- C:\Windows\System\FNxGDQe.exe
  C:\Windows\System\FNxGDQe.exe
  2⤵
  PID:8512
- C:\Windows\System\RFMQoXU.exe
  C:\Windows\System\RFMQoXU.exe
  2⤵
  PID:8624
- C:\Windows\System\SKCWefn.exe
  C:\Windows\System\SKCWefn.exe
  2⤵
  PID:8684
- C:\Windows\System\CONogsj.exe
  C:\Windows\System\CONogsj.exe
  2⤵
  PID:8700
- C:\Windows\System\GZStGWT.exe
  C:\Windows\System\GZStGWT.exe
  2⤵
  PID:8716
- C:\Windows\System\yeLIRSh.exe
  C:\Windows\System\yeLIRSh.exe
  2⤵
  PID:8760
- C:\Windows\System\WAxrxlc.exe
  C:\Windows\System\WAxrxlc.exe
  2⤵
  PID:8780
- C:\Windows\System\fGqaeBd.exe
  C:\Windows\System\fGqaeBd.exe
  2⤵
  PID:8800
- C:\Windows\System\cFRQifo.exe
  C:\Windows\System\cFRQifo.exe
  2⤵
  PID:8824
- C:\Windows\System\IPaNAxR.exe
  C:\Windows\System\IPaNAxR.exe
  2⤵
  PID:8844
- C:\Windows\System\RnGsXQS.exe
  C:\Windows\System\RnGsXQS.exe
  2⤵
  PID:8860
- C:\Windows\System\QgJQNdW.exe
  C:\Windows\System\QgJQNdW.exe
  2⤵
  PID:8876
- C:\Windows\System\QIvnwLd.exe
  C:\Windows\System\QIvnwLd.exe
  2⤵
  PID:8892
- C:\Windows\System\QbKavjk.exe
  C:\Windows\System\QbKavjk.exe
  2⤵
  PID:8912
- C:\Windows\System\MzVCvFi.exe
  C:\Windows\System\MzVCvFi.exe
  2⤵
  PID:8928
- C:\Windows\System\FpHKgUN.exe
  C:\Windows\System\FpHKgUN.exe
  2⤵
  PID:8956
- C:\Windows\System\zvDgIiR.exe
  C:\Windows\System\zvDgIiR.exe
  2⤵
  PID:8976
- C:\Windows\System\hLUklJT.exe
  C:\Windows\System\hLUklJT.exe
  2⤵
  PID:9052
- C:\Windows\System\iiWlRia.exe
  C:\Windows\System\iiWlRia.exe
  2⤵
  PID:9080
- C:\Windows\System\PsAfMlP.exe
  C:\Windows\System\PsAfMlP.exe
  2⤵
  PID:9160
- C:\Windows\System\FbgymHI.exe
  C:\Windows\System\FbgymHI.exe
  2⤵
  PID:9196
- C:\Windows\System\uKXxvkv.exe
  C:\Windows\System\uKXxvkv.exe
  2⤵
  PID:8244
- C:\Windows\System\hWHFSHZ.exe
  C:\Windows\System\hWHFSHZ.exe
  2⤵
  PID:8324
- C:\Windows\System\xykQDFr.exe
  C:\Windows\System\xykQDFr.exe
  2⤵
  PID:8440
- C:\Windows\System\eKGlhtV.exe
  C:\Windows\System\eKGlhtV.exe
  2⤵
  PID:8508
- C:\Windows\System\MmuJYbQ.exe
  C:\Windows\System\MmuJYbQ.exe
  2⤵
  PID:8524
- C:\Windows\System\ZgfKHNf.exe
  C:\Windows\System\ZgfKHNf.exe
  2⤵
  PID:8572
- C:\Windows\System\HbkNiaV.exe
  C:\Windows\System\HbkNiaV.exe
  2⤵
  PID:8604
- C:\Windows\System\ecRdqcN.exe
  C:\Windows\System\ecRdqcN.exe
  2⤵
  PID:8532
- C:\Windows\System\OISuKZB.exe
  C:\Windows\System\OISuKZB.exe
  2⤵
  PID:8676
- C:\Windows\System\QfuPclP.exe
  C:\Windows\System\QfuPclP.exe
  2⤵
  PID:8776
- C:\Windows\System\apJEzbR.exe
  C:\Windows\System\apJEzbR.exe
  2⤵
  PID:8840
- C:\Windows\System\yvyeGOw.exe
  C:\Windows\System\yvyeGOw.exe
  2⤵
  PID:8920
- C:\Windows\System\qmvnVaU.exe
  C:\Windows\System\qmvnVaU.exe
  2⤵
  PID:8788
- C:\Windows\System\duYbHbH.exe
  C:\Windows\System\duYbHbH.exe
  2⤵
  PID:9000
- C:\Windows\System\Ymhozie.exe
  C:\Windows\System\Ymhozie.exe
  2⤵
  PID:8972
- C:\Windows\System\sWsymkW.exe
  C:\Windows\System\sWsymkW.exe
  2⤵
  PID:9060
- C:\Windows\System\XkFFRPP.exe
  C:\Windows\System\XkFFRPP.exe
  2⤵
  PID:9156
- C:\Windows\System\lPIZnCa.exe
  C:\Windows\System\lPIZnCa.exe
  2⤵
  PID:8232
- C:\Windows\System\JGDPhAe.exe
  C:\Windows\System\JGDPhAe.exe
  2⤵
  PID:8428
- C:\Windows\System\mjroZDD.exe
  C:\Windows\System\mjroZDD.exe
  2⤵
  PID:8436
- C:\Windows\System\lLKSElU.exe
  C:\Windows\System\lLKSElU.exe
  2⤵
  PID:8616
- C:\Windows\System\sVwIJEh.exe
  C:\Windows\System\sVwIJEh.exe
  2⤵
  PID:8584
- C:\Windows\System\SMgOLkW.exe
  C:\Windows\System\SMgOLkW.exe
  2⤵
  PID:8768
- C:\Windows\System\fZaJRIG.exe
  C:\Windows\System\fZaJRIG.exe
  2⤵
  PID:8936
- C:\Windows\System\yfXpHMV.exe
  C:\Windows\System\yfXpHMV.exe
  2⤵
  PID:8220
- C:\Windows\System\nOZOnqH.exe
  C:\Windows\System\nOZOnqH.exe
  2⤵
  PID:8588
- C:\Windows\System\QIHJqxG.exe
  C:\Windows\System\QIHJqxG.exe
  2⤵
  PID:8696
- C:\Windows\System\AjOJcac.exe
  C:\Windows\System\AjOJcac.exe
  2⤵
  PID:8868
- C:\Windows\System\CVewebA.exe
  C:\Windows\System\CVewebA.exe
  2⤵
  PID:8836
- C:\Windows\System\aKuFKJv.exe
  C:\Windows\System\aKuFKJv.exe
  2⤵
  PID:8360
- C:\Windows\System\kThpeFq.exe
  C:\Windows\System\kThpeFq.exe
  2⤵
  PID:9220
- C:\Windows\System\aXMCyLw.exe
  C:\Windows\System\aXMCyLw.exe
  2⤵
  PID:9268
- C:\Windows\System\lvwQtCf.exe
  C:\Windows\System\lvwQtCf.exe
  2⤵
  PID:9288
- C:\Windows\System\AFNUEIF.exe
  C:\Windows\System\AFNUEIF.exe
  2⤵
  PID:9312
- C:\Windows\System\wgxgOOS.exe
  C:\Windows\System\wgxgOOS.exe
  2⤵
  PID:9328
- C:\Windows\System\KiLtSBp.exe
  C:\Windows\System\KiLtSBp.exe
  2⤵
  PID:9348
- C:\Windows\System\ZgythtZ.exe
  C:\Windows\System\ZgythtZ.exe
  2⤵
  PID:9380
- C:\Windows\System\YEDHaen.exe
  C:\Windows\System\YEDHaen.exe
  2⤵
  PID:9424
- C:\Windows\System\sWGKGQo.exe
  C:\Windows\System\sWGKGQo.exe
  2⤵
  PID:9452
- C:\Windows\System\bOCpiFa.exe
  C:\Windows\System\bOCpiFa.exe
  2⤵
  PID:9472
- C:\Windows\System\dYdImkb.exe
  C:\Windows\System\dYdImkb.exe
  2⤵
  PID:9500
- C:\Windows\System\BWEcUiQ.exe
  C:\Windows\System\BWEcUiQ.exe
  2⤵
  PID:9536
- C:\Windows\System\KekiIqp.exe
  C:\Windows\System\KekiIqp.exe
  2⤵
  PID:9552
- C:\Windows\System\idirmKK.exe
  C:\Windows\System\idirmKK.exe
  2⤵
  PID:9584
- C:\Windows\System\kZeqeof.exe
  C:\Windows\System\kZeqeof.exe
  2⤵
  PID:9612
- C:\Windows\System\amfjxel.exe
  C:\Windows\System\amfjxel.exe
  2⤵
  PID:9644
- C:\Windows\System\PiaLcKf.exe
  C:\Windows\System\PiaLcKf.exe
  2⤵
  PID:9668
- C:\Windows\System\HEZGctW.exe
  C:\Windows\System\HEZGctW.exe
  2⤵
  PID:9696
- C:\Windows\System\EwyEKsq.exe
  C:\Windows\System\EwyEKsq.exe
  2⤵
  PID:9736
- C:\Windows\System\inClRsl.exe
  C:\Windows\System\inClRsl.exe
  2⤵
  PID:9760
- C:\Windows\System\nqsdgey.exe
  C:\Windows\System\nqsdgey.exe
  2⤵
  PID:9784
- C:\Windows\System\rbbkXvg.exe
  C:\Windows\System\rbbkXvg.exe
  2⤵
  PID:9804
- C:\Windows\System\PUUPaaI.exe
  C:\Windows\System\PUUPaaI.exe
  2⤵
  PID:9824
- C:\Windows\System\RTTXiLG.exe
  C:\Windows\System\RTTXiLG.exe
  2⤵
  PID:9852
- C:\Windows\System\RqNpJZb.exe
  C:\Windows\System\RqNpJZb.exe
  2⤵
  PID:9880
- C:\Windows\System\lCEyKQD.exe
  C:\Windows\System\lCEyKQD.exe
  2⤵
  PID:9904
- C:\Windows\System\KMAOZbj.exe
  C:\Windows\System\KMAOZbj.exe
  2⤵
  PID:9924
- C:\Windows\System\jOyzSnd.exe
  C:\Windows\System\jOyzSnd.exe
  2⤵
  PID:9960
- C:\Windows\System\BuOSFAG.exe
  C:\Windows\System\BuOSFAG.exe
  2⤵
  PID:9980
- C:\Windows\System\ctHpblY.exe
  C:\Windows\System\ctHpblY.exe
  2⤵
  PID:10004
- C:\Windows\System\ayDKSXA.exe
  C:\Windows\System\ayDKSXA.exe
  2⤵
  PID:10020
- C:\Windows\System\onglSQv.exe
  C:\Windows\System\onglSQv.exe
  2⤵
  PID:10088
- C:\Windows\System\lQVKEhH.exe
  C:\Windows\System\lQVKEhH.exe
  2⤵
  PID:10128
- C:\Windows\System\aCuVppG.exe
  C:\Windows\System\aCuVppG.exe
  2⤵
  PID:10152
- C:\Windows\System\KImfKEt.exe
  C:\Windows\System\KImfKEt.exe
  2⤵
  PID:10172
- C:\Windows\System\LcVERvo.exe
  C:\Windows\System\LcVERvo.exe
  2⤵
  PID:10208
- C:\Windows\System\MFEoAQS.exe
  C:\Windows\System\MFEoAQS.exe
  2⤵
  PID:10232
- C:\Windows\System\MhyEBMz.exe
  C:\Windows\System\MhyEBMz.exe
  2⤵
  PID:9256
- C:\Windows\System\FvCUSOm.exe
  C:\Windows\System\FvCUSOm.exe
  2⤵
  PID:9340
- C:\Windows\System\AWecRUv.exe
  C:\Windows\System\AWecRUv.exe
  2⤵
  PID:9400
- C:\Windows\System\DPOWRtl.exe
  C:\Windows\System\DPOWRtl.exe
  2⤵
  PID:9468
- C:\Windows\System\KdoRkzN.exe
  C:\Windows\System\KdoRkzN.exe
  2⤵
  PID:9488
- C:\Windows\System\vmeFSoj.exe
  C:\Windows\System\vmeFSoj.exe
  2⤵
  PID:9600
- C:\Windows\System\mlVVvBN.exe
  C:\Windows\System\mlVVvBN.exe
  2⤵
  PID:9652
- C:\Windows\System\UEiULlf.exe
  C:\Windows\System\UEiULlf.exe
  2⤵
  PID:9724
- C:\Windows\System\nRCEfDM.exe
  C:\Windows\System\nRCEfDM.exe
  2⤵
  PID:9776
- C:\Windows\System\WmksyLk.exe
  C:\Windows\System\WmksyLk.exe
  2⤵
  PID:9820
- C:\Windows\System\IeqQdzd.exe
  C:\Windows\System\IeqQdzd.exe
  2⤵
  PID:9916
- C:\Windows\System\kCfvSdo.exe
  C:\Windows\System\kCfvSdo.exe
  2⤵
  PID:9972
- C:\Windows\System\QofOwDS.exe
  C:\Windows\System\QofOwDS.exe
  2⤵
  PID:10000
- C:\Windows\System\KwbAoHl.exe
  C:\Windows\System\KwbAoHl.exe
  2⤵
  PID:10084
- C:\Windows\System\HptdWpM.exe
  C:\Windows\System\HptdWpM.exe
  2⤵
  PID:10144
- C:\Windows\System\ZLIfreO.exe
  C:\Windows\System\ZLIfreO.exe
  2⤵
  PID:9248
- C:\Windows\System\UVqguDs.exe
  C:\Windows\System\UVqguDs.exe
  2⤵
  PID:9372
- C:\Windows\System\XxrwbYa.exe
  C:\Windows\System\XxrwbYa.exe
  2⤵
  PID:9512
- C:\Windows\System\EOEkeZW.exe
  C:\Windows\System\EOEkeZW.exe
  2⤵
  PID:9744
- C:\Windows\System\ovvtzWD.exe
  C:\Windows\System\ovvtzWD.exe
  2⤵
  PID:9956
- C:\Windows\System\PHolELX.exe
  C:\Windows\System\PHolELX.exe
  2⤵
  PID:9952
- C:\Windows\System\DwvhkMK.exe
  C:\Windows\System\DwvhkMK.exe
  2⤵
  PID:10168
- C:\Windows\System\hlEYryR.exe
  C:\Windows\System\hlEYryR.exe
  2⤵
  PID:9228
- C:\Windows\System\lIPXLhw.exe
  C:\Windows\System\lIPXLhw.exe
  2⤵
  PID:9632
- C:\Windows\System\dLxsxTn.exe
  C:\Windows\System\dLxsxTn.exe
  2⤵
  PID:9356
- C:\Windows\System\UmlBBoG.exe
  C:\Windows\System\UmlBBoG.exe
  2⤵
  PID:10252
- C:\Windows\System\TauNbsm.exe
  C:\Windows\System\TauNbsm.exe
  2⤵
  PID:10272
- C:\Windows\System\tCTkipA.exe
  C:\Windows\System\tCTkipA.exe
  2⤵
  PID:10300
- C:\Windows\System\JJrFUFv.exe
  C:\Windows\System\JJrFUFv.exe
  2⤵
  PID:10340
- C:\Windows\System\pPPduFt.exe
  C:\Windows\System\pPPduFt.exe
  2⤵
  PID:10364
- C:\Windows\System\wVfFBUh.exe
  C:\Windows\System\wVfFBUh.exe
  2⤵
  PID:10392
- C:\Windows\System\fcbOwaE.exe
  C:\Windows\System\fcbOwaE.exe
  2⤵
  PID:10412
- C:\Windows\System\epNwWtp.exe
  C:\Windows\System\epNwWtp.exe
  2⤵
  PID:10436
- C:\Windows\System\WmVlASK.exe
  C:\Windows\System\WmVlASK.exe
  2⤵
  PID:10452
- C:\Windows\System\gcxrqHf.exe
  C:\Windows\System\gcxrqHf.exe
  2⤵
  PID:10508
- C:\Windows\System\RMcOvac.exe
  C:\Windows\System\RMcOvac.exe
  2⤵
  PID:10528
- C:\Windows\System\ynveoiW.exe
  C:\Windows\System\ynveoiW.exe
  2⤵
  PID:10548
- C:\Windows\System\UmOvPoK.exe
  C:\Windows\System\UmOvPoK.exe
  2⤵
  PID:10568
- C:\Windows\System\jJFQLbm.exe
  C:\Windows\System\jJFQLbm.exe
  2⤵
  PID:10604
- C:\Windows\System\ekMhfrZ.exe
  C:\Windows\System\ekMhfrZ.exe
  2⤵
  PID:10628
- C:\Windows\System\tICbRdu.exe
  C:\Windows\System\tICbRdu.exe
  2⤵
  PID:10648
- C:\Windows\System\CLzFnZR.exe
  C:\Windows\System\CLzFnZR.exe
  2⤵
  PID:10668
- C:\Windows\System\ntiEvLV.exe
  C:\Windows\System\ntiEvLV.exe
  2⤵
  PID:10692
- C:\Windows\System\iuxhLyj.exe
  C:\Windows\System\iuxhLyj.exe
  2⤵
  PID:10712
- C:\Windows\System\slONwEn.exe
  C:\Windows\System\slONwEn.exe
  2⤵
  PID:10776
- C:\Windows\System\AqfVTfz.exe
  C:\Windows\System\AqfVTfz.exe
  2⤵
  PID:10820
- C:\Windows\System\mXjlLiI.exe
  C:\Windows\System\mXjlLiI.exe
  2⤵
  PID:10840
- C:\Windows\System\bTevHZN.exe
  C:\Windows\System\bTevHZN.exe
  2⤵
  PID:10864
- C:\Windows\System\AtUlAbc.exe
  C:\Windows\System\AtUlAbc.exe
  2⤵
  PID:10888
- C:\Windows\System\lbbCGON.exe
  C:\Windows\System\lbbCGON.exe
  2⤵
  PID:10908
- C:\Windows\System\uzGNNLw.exe
  C:\Windows\System\uzGNNLw.exe
  2⤵
  PID:10956
- C:\Windows\System\jTUXHlo.exe
  C:\Windows\System\jTUXHlo.exe
  2⤵
  PID:10976
- C:\Windows\System\ZRluGkH.exe
  C:\Windows\System\ZRluGkH.exe
  2⤵
  PID:11000
- C:\Windows\System\uUSmSYT.exe
  C:\Windows\System\uUSmSYT.exe
  2⤵
  PID:11024
- C:\Windows\System\SikeHVz.exe
  C:\Windows\System\SikeHVz.exe
  2⤵
  PID:11064
- C:\Windows\System\JxGrgUV.exe
  C:\Windows\System\JxGrgUV.exe
  2⤵
  PID:11084
- C:\Windows\System\iipOSIU.exe
  C:\Windows\System\iipOSIU.exe
  2⤵
  PID:11108
- C:\Windows\System\aZheMcf.exe
  C:\Windows\System\aZheMcf.exe
  2⤵
  PID:11148
- C:\Windows\System\ojqpUkQ.exe
  C:\Windows\System\ojqpUkQ.exe
  2⤵
  PID:11176
- C:\Windows\System\MSAOgyn.exe
  C:\Windows\System\MSAOgyn.exe
  2⤵
  PID:11196
- C:\Windows\System\zfVbaHv.exe
  C:\Windows\System\zfVbaHv.exe
  2⤵
  PID:11216
- C:\Windows\System\HWYCIJU.exe
  C:\Windows\System\HWYCIJU.exe
  2⤵
  PID:11248
- C:\Windows\System\RSPIxuh.exe
  C:\Windows\System\RSPIxuh.exe
  2⤵
  PID:10280
- C:\Windows\System\LSwzitc.exe
  C:\Windows\System\LSwzitc.exe
  2⤵
  PID:10312
- C:\Windows\System\fMhvVot.exe
  C:\Windows\System\fMhvVot.exe
  2⤵
  PID:10376
- C:\Windows\System\mRHFCRW.exe
  C:\Windows\System\mRHFCRW.exe
  2⤵
  PID:10428
- C:\Windows\System\NAIPYMX.exe
  C:\Windows\System\NAIPYMX.exe
  2⤵
  PID:10496
- C:\Windows\System\JSvUTSK.exe
  C:\Windows\System\JSvUTSK.exe
  2⤵
  PID:10596
- C:\Windows\System\NznUbeQ.exe
  C:\Windows\System\NznUbeQ.exe
  2⤵
  PID:10620
- C:\Windows\System\dTdxbIp.exe
  C:\Windows\System\dTdxbIp.exe
  2⤵
  PID:10684
- C:\Windows\System\LQYlPwy.exe
  C:\Windows\System\LQYlPwy.exe
  2⤵
  PID:10752
- C:\Windows\System\JJfCsdk.exe
  C:\Windows\System\JJfCsdk.exe
  2⤵
  PID:10828
- C:\Windows\System\filnoxY.exe
  C:\Windows\System\filnoxY.exe
  2⤵
  PID:10860
- C:\Windows\System\TeOuhuv.exe
  C:\Windows\System\TeOuhuv.exe
  2⤵
  PID:10928
- C:\Windows\System\wtDRLlH.exe
  C:\Windows\System\wtDRLlH.exe
  2⤵
  PID:11016
- C:\Windows\System\NWAZtJj.exe
  C:\Windows\System\NWAZtJj.exe
  2⤵
  PID:11104
- C:\Windows\System\KXkgLBE.exe
  C:\Windows\System\KXkgLBE.exe
  2⤵
  PID:11156
- C:\Windows\System\GbHXiFy.exe
  C:\Windows\System\GbHXiFy.exe
  2⤵
  PID:11172
- C:\Windows\System\NTCUWux.exe
  C:\Windows\System\NTCUWux.exe
  2⤵
  PID:10420
- C:\Windows\System\xQwtLLB.exe
  C:\Windows\System\xQwtLLB.exe
  2⤵
  PID:10484
- C:\Windows\System\radpXUH.exe
  C:\Windows\System\radpXUH.exe
  2⤵
  PID:10660
- C:\Windows\System\lEIRoee.exe
  C:\Windows\System\lEIRoee.exe
  2⤵
  PID:10772
- C:\Windows\System\yzydSgI.exe
  C:\Windows\System\yzydSgI.exe
  2⤵
  PID:10968
- C:\Windows\System\beslctt.exe
  C:\Windows\System\beslctt.exe
  2⤵
  PID:10996
- C:\Windows\System\DLEGkxy.exe
  C:\Windows\System\DLEGkxy.exe
  2⤵
  PID:10332
- C:\Windows\System\CcxWBeZ.exe
  C:\Windows\System\CcxWBeZ.exe
  2⤵
  PID:10448
- C:\Windows\System\YGUcVUf.exe
  C:\Windows\System\YGUcVUf.exe
  2⤵
  PID:10808
- C:\Windows\System\XBzQYJA.exe
  C:\Windows\System\XBzQYJA.exe
  2⤵
  PID:11184
- C:\Windows\System\IeKPalL.exe
  C:\Windows\System\IeKPalL.exe
  2⤵
  PID:11272
- C:\Windows\System\ecEcvpT.exe
  C:\Windows\System\ecEcvpT.exe
  2⤵
  PID:11292
- C:\Windows\System\NGwVgZi.exe
  C:\Windows\System\NGwVgZi.exe
  2⤵
  PID:11320
- C:\Windows\System\rsnMSKy.exe
  C:\Windows\System\rsnMSKy.exe
  2⤵
  PID:11344
- C:\Windows\System\skeGYeh.exe
  C:\Windows\System\skeGYeh.exe
  2⤵
  PID:11364
- C:\Windows\System\zeAeCdA.exe
  C:\Windows\System\zeAeCdA.exe
  2⤵
  PID:11392
- C:\Windows\System\QulBIif.exe
  C:\Windows\System\QulBIif.exe
  2⤵
  PID:11420
- C:\Windows\System\NJmFjpm.exe
  C:\Windows\System\NJmFjpm.exe
  2⤵
  PID:11460
- C:\Windows\System\UedsSNW.exe
  C:\Windows\System\UedsSNW.exe
  2⤵
  PID:11488
- C:\Windows\System\WMtfYqt.exe
  C:\Windows\System\WMtfYqt.exe
  2⤵
  PID:11508
- C:\Windows\System\GeODCuc.exe
  C:\Windows\System\GeODCuc.exe
  2⤵
  PID:11528
- C:\Windows\System\XAkRHFZ.exe
  C:\Windows\System\XAkRHFZ.exe
  2⤵
  PID:11548
- C:\Windows\System\tCUtwCM.exe
  C:\Windows\System\tCUtwCM.exe
  2⤵
  PID:11568
- C:\Windows\System\KufvyMH.exe
  C:\Windows\System\KufvyMH.exe
  2⤵
  PID:11588
- C:\Windows\System\goXBckm.exe
  C:\Windows\System\goXBckm.exe
  2⤵
  PID:11616
- C:\Windows\System\NvdWDTn.exe
  C:\Windows\System\NvdWDTn.exe
  2⤵
  PID:11632
- C:\Windows\System\pOAwwlL.exe
  C:\Windows\System\pOAwwlL.exe
  2⤵
  PID:11696
- C:\Windows\System\QeGPYEy.exe
  C:\Windows\System\QeGPYEy.exe
  2⤵
  PID:11724
- C:\Windows\System\uYgNJVt.exe
  C:\Windows\System\uYgNJVt.exe
  2⤵
  PID:11756
- C:\Windows\System\KVDoleI.exe
  C:\Windows\System\KVDoleI.exe
  2⤵
  PID:11784
- C:\Windows\System\xSyDmKL.exe
  C:\Windows\System\xSyDmKL.exe
  2⤵
  PID:11812
- C:\Windows\System\xPjqzLK.exe
  C:\Windows\System\xPjqzLK.exe
  2⤵
  PID:11832
- C:\Windows\System\xZJXnze.exe
  C:\Windows\System\xZJXnze.exe
  2⤵
  PID:11880
- C:\Windows\System\fuBObAg.exe
  C:\Windows\System\fuBObAg.exe
  2⤵
  PID:11912
- C:\Windows\System\SaQBptN.exe
  C:\Windows\System\SaQBptN.exe
  2⤵
  PID:11940
- C:\Windows\System\ODfQYCd.exe
  C:\Windows\System\ODfQYCd.exe
  2⤵
  PID:11964
- C:\Windows\System\VlwjHcC.exe
  C:\Windows\System\VlwjHcC.exe
  2⤵
  PID:12004
- C:\Windows\System\rwpUGOf.exe
  C:\Windows\System\rwpUGOf.exe
  2⤵
  PID:12024
- C:\Windows\System\FVepfwG.exe
  C:\Windows\System\FVepfwG.exe
  2⤵
  PID:12048
- C:\Windows\System\MEqfbuz.exe
  C:\Windows\System\MEqfbuz.exe
  2⤵
  PID:12072
- C:\Windows\System\AbmPhBw.exe
  C:\Windows\System\AbmPhBw.exe
  2⤵
  PID:12100
- C:\Windows\System\AEKmcvn.exe
  C:\Windows\System\AEKmcvn.exe
  2⤵
  PID:12116
- C:\Windows\System\JKCfRAE.exe
  C:\Windows\System\JKCfRAE.exe
  2⤵
  PID:12136
- C:\Windows\System\muxgQst.exe
  C:\Windows\System\muxgQst.exe
  2⤵
  PID:12156
- C:\Windows\System\iOxJAlr.exe
  C:\Windows\System\iOxJAlr.exe
  2⤵
  PID:12180
- C:\Windows\System\xIFhYfE.exe
  C:\Windows\System\xIFhYfE.exe
  2⤵
  PID:12224
- C:\Windows\System\YdBewMu.exe
  C:\Windows\System\YdBewMu.exe
  2⤵
  PID:12264
- C:\Windows\System\NyRtajf.exe
  C:\Windows\System\NyRtajf.exe
  2⤵
  PID:10708
- C:\Windows\System\ipiHrIl.exe
  C:\Windows\System\ipiHrIl.exe
  2⤵
  PID:11312
- C:\Windows\System\lDpYOeh.exe
  C:\Windows\System\lDpYOeh.exe
  2⤵
  PID:11360
- C:\Windows\System\nNSaMBs.exe
  C:\Windows\System\nNSaMBs.exe
  2⤵
  PID:11448
- C:\Windows\System\rkBgXys.exe
  C:\Windows\System\rkBgXys.exe
  2⤵
  PID:11524
- C:\Windows\System\XMcBiaY.exe
  C:\Windows\System\XMcBiaY.exe
  2⤵
  PID:11560
- C:\Windows\System\gMLxWUz.exe
  C:\Windows\System\gMLxWUz.exe
  2⤵
  PID:11612
- C:\Windows\System\YvDgkjV.exe
  C:\Windows\System\YvDgkjV.exe
  2⤵
  PID:11672
- C:\Windows\System\lvDIOhj.exe
  C:\Windows\System\lvDIOhj.exe
  2⤵
  PID:11720
- C:\Windows\System\sppIRGx.exe
  C:\Windows\System\sppIRGx.exe
  2⤵
  PID:11828
- C:\Windows\System\eewGvtP.exe
  C:\Windows\System\eewGvtP.exe
  2⤵
  PID:11876
- C:\Windows\System\kinDwTJ.exe
  C:\Windows\System\kinDwTJ.exe
  2⤵
  PID:11932
- C:\Windows\System\OvVLZBp.exe
  C:\Windows\System\OvVLZBp.exe
  2⤵
  PID:11984
- C:\Windows\System\KHirVjp.exe
  C:\Windows\System\KHirVjp.exe
  2⤵
  PID:12036
- C:\Windows\System\hQXQLmy.exe
  C:\Windows\System\hQXQLmy.exe
  2⤵
  PID:12092
- C:\Windows\System\RfVRLTJ.exe
  C:\Windows\System\RfVRLTJ.exe
  2⤵
  PID:12256
- C:\Windows\System\caCCADd.exe
  C:\Windows\System\caCCADd.exe
  2⤵
  PID:11284
- C:\Windows\System\uXcxdPE.exe
  C:\Windows\System\uXcxdPE.exe
  2⤵
  PID:11400
- C:\Windows\System\QEWpQQa.exe
  C:\Windows\System\QEWpQQa.exe
  2⤵
  PID:1052
- C:\Windows\System\QGKVPiO.exe
  C:\Windows\System\QGKVPiO.exe
  2⤵
  PID:11516
- C:\Windows\System\CMOvmXG.exe
  C:\Windows\System\CMOvmXG.exe
  2⤵
  PID:11584
- C:\Windows\System\SQXFGcu.exe
  C:\Windows\System\SQXFGcu.exe
  2⤵
  PID:11716
- C:\Windows\System\cElMQJQ.exe
  C:\Windows\System\cElMQJQ.exe
  2⤵
  PID:11992
- C:\Windows\System\LbcinCZ.exe
  C:\Windows\System\LbcinCZ.exe
  2⤵
  PID:12060
- C:\Windows\System\rHHGWYj.exe
  C:\Windows\System\rHHGWYj.exe
  2⤵
  PID:4872
- C:\Windows\System\uDVGsWm.exe
  C:\Windows\System\uDVGsWm.exe
  2⤵
  PID:11556
- C:\Windows\System\UDPKEPP.exe
  C:\Windows\System\UDPKEPP.exe
  2⤵
  PID:11856
- C:\Windows\System\RjvGakj.exe
  C:\Windows\System\RjvGakj.exe
  2⤵
  PID:12124
- C:\Windows\System\YYExZBS.exe
  C:\Windows\System\YYExZBS.exe
  2⤵
  PID:11736
- C:\Windows\System\lldlNmv.exe
  C:\Windows\System\lldlNmv.exe
  2⤵
  PID:12320
- C:\Windows\System\LZuPlJi.exe
  C:\Windows\System\LZuPlJi.exe
  2⤵
  PID:12344
- C:\Windows\System\uNTpxLW.exe
  C:\Windows\System\uNTpxLW.exe
  2⤵
  PID:12372
- C:\Windows\System\SYgDOOg.exe
  C:\Windows\System\SYgDOOg.exe
  2⤵
  PID:12392
- C:\Windows\System\jYleZHE.exe
  C:\Windows\System\jYleZHE.exe
  2⤵
  PID:12412
- C:\Windows\System\DgmfITC.exe
  C:\Windows\System\DgmfITC.exe
  2⤵
  PID:12456
- C:\Windows\System\EzITlWX.exe
  C:\Windows\System\EzITlWX.exe
  2⤵
  PID:12476
- C:\Windows\System\DQNHulz.exe
  C:\Windows\System\DQNHulz.exe
  2⤵
  PID:12504
- C:\Windows\System\RwioKKd.exe
  C:\Windows\System\RwioKKd.exe
  2⤵
  PID:12544
- C:\Windows\System\jEbcbOj.exe
  C:\Windows\System\jEbcbOj.exe
  2⤵
  PID:12560
- C:\Windows\System\QyivORl.exe
  C:\Windows\System\QyivORl.exe
  2⤵
  PID:12580
- C:\Windows\System\pOWGuSH.exe
  C:\Windows\System\pOWGuSH.exe
  2⤵
  PID:12604
- C:\Windows\System\ttOdrHU.exe
  C:\Windows\System\ttOdrHU.exe
  2⤵
  PID:12628
- C:\Windows\System\MvjFxnY.exe
  C:\Windows\System\MvjFxnY.exe
  2⤵
  PID:12664
- C:\Windows\System\joleCng.exe
  C:\Windows\System\joleCng.exe
  2⤵
  PID:12692
- C:\Windows\System\GKknAyZ.exe
  C:\Windows\System\GKknAyZ.exe
  2⤵
  PID:12712
- C:\Windows\System\nFVKLgm.exe
  C:\Windows\System\nFVKLgm.exe
  2⤵
  PID:12756
- C:\Windows\System\FTcXbQd.exe
  C:\Windows\System\FTcXbQd.exe
  2⤵
  PID:12776
- C:\Windows\System\NlMqyvd.exe
  C:\Windows\System\NlMqyvd.exe
  2⤵
  PID:12800
- C:\Windows\System\UDxHzVY.exe
  C:\Windows\System\UDxHzVY.exe
  2⤵
  PID:12820
- C:\Windows\System\YTwLgHv.exe
  C:\Windows\System\YTwLgHv.exe
  2⤵
  PID:12868
- C:\Windows\System\RZhzJqw.exe
  C:\Windows\System\RZhzJqw.exe
  2⤵
  PID:12884
- C:\Windows\System\KBCZFLq.exe
  C:\Windows\System\KBCZFLq.exe
  2⤵
  PID:12912
- C:\Windows\System\sTDPvss.exe
  C:\Windows\System\sTDPvss.exe
  2⤵
  PID:12952
- C:\Windows\System\uzYyIqI.exe
  C:\Windows\System\uzYyIqI.exe
  2⤵
  PID:12992
- C:\Windows\System\BEcNUtJ.exe
  C:\Windows\System\BEcNUtJ.exe
  2⤵
  PID:13016
- C:\Windows\System\NmEairD.exe
  C:\Windows\System\NmEairD.exe
  2⤵
  PID:13036
- C:\Windows\System\DOcsfdc.exe
  C:\Windows\System\DOcsfdc.exe
  2⤵
  PID:13068
- C:\Windows\System\WmdixoX.exe
  C:\Windows\System\WmdixoX.exe
  2⤵
  PID:13092
- C:\Windows\System\GhHMOBr.exe
  C:\Windows\System\GhHMOBr.exe
  2⤵
  PID:13124
- C:\Windows\System\HpVQqKd.exe
  C:\Windows\System\HpVQqKd.exe
  2⤵
  PID:13144
- C:\Windows\System\RxZQmfa.exe
  C:\Windows\System\RxZQmfa.exe
  2⤵
  PID:13188
- C:\Windows\System\ZpUeRkq.exe
  C:\Windows\System\ZpUeRkq.exe
  2⤵
  PID:13216
- C:\Windows\System\YhdRnKC.exe
  C:\Windows\System\YhdRnKC.exe
  2⤵
  PID:13232
- C:\Windows\System\EICkUjY.exe
  C:\Windows\System\EICkUjY.exe
  2⤵
  PID:13248
- C:\Windows\System\OCckEfP.exe
  C:\Windows\System\OCckEfP.exe
  2⤵
  PID:13292
- C:\Windows\System\nGpfCNj.exe
  C:\Windows\System\nGpfCNj.exe
  2⤵
  PID:12300
- C:\Windows\System\kFFzeVR.exe
  C:\Windows\System\kFFzeVR.exe
  2⤵
  PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mgbd0wab.dro.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BdjaJoP.exe

Filesize
2.2MB

MD5
9ebeb226b817022c4ced74fb94b8ccc7

SHA1
3a6e54713a633696de6d2ca7af0ccb473b535152

SHA256
439e872f4ba13aa6b05580158b092d09ba6445303ba782b2acddc64793c5af07

SHA512
0c4756436e2788d130173d0232bd1ce63350f244029432ea0abcdde51b35443d3dbed0fc31a625a2d1c607566413b9df7514a11c94b5329f84efdf9a7f07fd3f

Download Submit
C:\Windows\System\HyKAxEm.exe

Filesize
2.2MB

MD5
0bd15f790558a167650e7d9b118480e2

SHA1
6757da79a8093e187e9986c29f5a518b2bac9b1d

SHA256
e32a3b71d596f28354c13d1b52a51702d44b90c79dc6e5afcfe0894322362a72

SHA512
5cc9f8636d32529a06716bbfac4666f629009f2214cd88c49eeb8df0bf090ae42523caba9736ede2c58408e4be1c0aa0c1c3fabb513740ed76d753e6776d08f4

Download Submit
C:\Windows\System\ItKxozV.exe

Filesize
2.2MB

MD5
ff20da58fee168cdf1defec073df416e

SHA1
8a0764554e9640ba5054d7c736c0df04c06108c8

SHA256
ccf1bb04af73daa1135b5c9f7e15676fa6d881be2e9f9dfb095738b4327c87c4

SHA512
df761e1d75a614bc7f4659d45947022954dea2400334717dc744c5f9a9196e65aae1c7f27bf1d02e7131a5e1b14d071b7b93f45a8f12035a8b942c06a3c0896a

Download Submit
C:\Windows\System\KofNfaM.exe

Filesize
2.2MB

MD5
ca990ba7cd74b2932d8b64af91184fb4

SHA1
c1bf3e8ae8ea18530591d758ad51b95b383d8620

SHA256
841dedcecec59a30bab65e4c656b22aadad2190ed024c7e395eccba67d40cbc7

SHA512
4f6b6b891b0c6866ab3c9cff6d4c3c48169b3892475601ddcdc15426cd3e8c753015755ee7ca4537ec7fc1ae2bd562e3b3f703d68a13d98f9b3c22d2c4726432

Download Submit
C:\Windows\System\NSwckdR.exe

Filesize
2.2MB

MD5
741edb6504e720eb6af6a9074389b82a

SHA1
13813139eee0b934171ad15b2d382ea4392cfee9

SHA256
0c8226bc5fbf450044c29f9dadd22a1ad65192748132b2fe09d20d7e5cb1aff6

SHA512
4e68b38fdb4464e89125152fce36a19dad914491d13a1da48f8419f570e390d8a454139659220c420a9e7cc3064970a538b63021f6f82e3489d67610022d1b11

Download Submit
C:\Windows\System\OEFYgFb.exe

Filesize
2.2MB

MD5
9006a5843c699a73da7bd9642ca91495

SHA1
070a1cac6dd9270eca80238e180dba52c7fded45

SHA256
61deea45de86420b6b3e5970e0e5a8ece08f99db0e8ec67b9bb00df91c47b761

SHA512
8aad133c6a653d20a38eee3aaa77548b40cdb1f4dd36dd554ba7ec4fe8c52f8db42dd9665d2093b009f813d8313072aca37a3da9067fde9dbdf7f2af05fe4d5a

Download Submit
C:\Windows\System\OQGZTlF.exe

Filesize
2.2MB

MD5
403b6268c45b57665a3c2b1f9643b677

SHA1
08fe083c8e5f1b1da8e6ed428857f8a867409129

SHA256
3dad8f6dba26461fb6cd00ba4fbd561db147f0c79b1c348a08c130e381ad9689

SHA512
35df72ba4e4d03cfb85eb56b45ce1933b1809b3697d29428663d6621edcc84b747cb7f56a373df6e938116516a098b90fc10c4f2649635a5af81308e3fcef562

Download Submit
C:\Windows\System\PvnIsBR.exe

Filesize
2.2MB

MD5
f83a9b1bcee1ca6a33715536e8d06aa7

SHA1
a9e1d8491afa9324b7d3302bdedd7ca0e353ced1

SHA256
a8d7d5be0b0bc26797e665bcb9c8bcd22ee472e24f53a13dcbf5fb6168e549b9

SHA512
90dd80c99b969bf4e49ebd63a1d464a2942a53ba09122e08938680adbba85da59d6efd96d6bb9bd5426d3eb1c60a9deae1d122530cf002dde912c6b0e290cbdf

Download Submit
C:\Windows\System\QOAZESl.exe

Filesize
2.2MB

MD5
91c1409ed7b2c6fab6e75f1108375c81

SHA1
891cfa7e588789ca6cf2cb5b10da6a4c64215f9d

SHA256
21ebdf2f27220bb1019cfa18f7755d9539624a1761aa842cb60e38981052949d

SHA512
9ca883cbb027e4654967416f459ad9d9d2d41c9a7fcdacbcfd021d43041886131eb1be276d14da1124239aa49e16dda4ced1c8f3115ccfbf7bb8cf6586ea5527

Download Submit
C:\Windows\System\QlQBgxJ.exe

Filesize
2.2MB

MD5
60bdd9d72e0e74d76d644b46e10f94fa

SHA1
c2477e9ca0df7f550ce4172d642c634e3979a772

SHA256
10640d11b8515e4611cd3664a959d8d1180277cd98c87466ba3c549857c23eb5

SHA512
d9d79a676f94c76186f6ac0bfe557b8b938bd3e2ec10cbf83d0f027ea0bee27efd344177be43bd7afc414a9377698b104128950f84121a9c9cc158fc48755bfd

Download Submit
C:\Windows\System\RRxpcBd.exe

Filesize
2.2MB

MD5
a72ceb592370aff237a5ed552b4a6180

SHA1
6818f9e7966424d3e74c4e308b1a4303eaf4bb48

SHA256
ece63434947ae45ba04778c6818290a862584e9bc20e8ddf1823d44ee69f45ac

SHA512
3d93a9cce763ccaf9bc1c65ae345421aeee77b2bff787eae3a1504c6b4df4020418416d60ba1a284f2adb42a3bf222de544a8070eef28cf1baeb362be68f995e

Download Submit
C:\Windows\System\RZAzUlA.exe

Filesize
2.2MB

MD5
cb2c5b98564d55e5fe79f68c52e37778

SHA1
ecc1a8047e57da4755827131b22e61b2e000afad

SHA256
9f9f6bf20926048a298d133918d7dc54d13c9b5ac472eeb9fb8462e92fa3d0d2

SHA512
d8405f2f672393ba1087879befc495e7748bea41d52ece7505d6869314b0214f857051e40c85312a591bde2a7d7ccea015c9d4d3ea6719bed8b52a84694de7b3

Download Submit
C:\Windows\System\TsWdTzA.exe

Filesize
2.2MB

MD5
0ff498211f26ea57b43c211af74252e2

SHA1
1af4c2bf88875b4a22831a3e4404e8529051e70b

SHA256
74288fca4d86054d13611231ad1c6fc7d68266c2fd284870298abaa1a1a427db

SHA512
1d9f832105435ce8da51f0575a22a02346845d9d51b09ddbf2a45bd2cb344f1e7c2efbae9bbd033a288c754590e120e006f4597937f60ccb86343d179ad1a64e

Download Submit
C:\Windows\System\UDcyuYs.exe

Filesize
2.2MB

MD5
9825633511e0218760b3493a7835d493

SHA1
9b71128f17a5cfa18916d6939179f9101ed0cb05

SHA256
b36f23905e555433d6c15f5c66d49c19f120d10f9db739d21df9190939737bbb

SHA512
4e4b6c7f790ee0a94d8b465bf032a0dfe30ec619f591e1c8ddad17f576835df5e65aeae4bee9e5df1a210526b1b391e5c1a5c471d8852cac9087b6154b8ca079

Download Submit
C:\Windows\System\WpeGzUm.exe

Filesize
2.2MB

MD5
34a781ca17afb35b801f8c03a51a1308

SHA1
855011e4fdf1e4165f39bc02e7d74f96f3a6ab43

SHA256
77fae0f5042492fc90ed32a055a67b922050949aa2e027410dacec409fb6caa4

SHA512
17958437cfdfd6d20888c1d891d8c2844095830894f65b694e12de061fd11c129e30a4272251f7e588369bd80fd29af92aa80e3c886eac71592c13b6b39646b6

Download Submit
C:\Windows\System\XKQfOVe.exe

Filesize
2.2MB

MD5
16fb7d4f1a29a0c2492440f6f647ad0e

SHA1
43b544dfed9a32d8112242b2a9fb62774f282d22

SHA256
d9fe0cbd3e8d38ee73c4fb413606d6143131d8f914e9c67ce8d0be5869d61233

SHA512
955e929959b9be70aab90c78a2cc545e7b445c082383a663107014b055d355364d1a3bff2038de02ddfd8999af66d02474ac18d57359ac13acef011adfc565af

Download Submit
C:\Windows\System\XiySQuP.exe

Filesize
2.2MB

MD5
2464294fc88748d1959ef31ff43794f8

SHA1
898968bd3a363b7812b653303699711bfe40509c

SHA256
716406773d23a26f6713b220d34b8e433ebf16938d46baa6435343dfb9d77973

SHA512
f6f35fecc1deadacdb5fa1c7c6a05006f8e898432b48dc323a0665a4ba7e6df8f411d499b9a88ce639c61011238d17274f97a2c9521c3c54e755d14947482dd5

Download Submit
C:\Windows\System\XqqbzEK.exe

Filesize
2.2MB

MD5
a3ba741f3ebffa3a92055b856b0402e9

SHA1
9e3f599be2abe8f7cb3a471f2a58b3b13a19ec9f

SHA256
d2387b9f70bbbff2eff83df2aaa4a094af6dbde17f1d705dab9a741b8b52cfa1

SHA512
0765c5732539a53c3390d88b248496b437ca3dadb5520c3ce6931ca85d65b287abade9eac95794ba0405c745e02f17eaedf6b1392afcc68654e714cce6748346

Download Submit
C:\Windows\System\YAQeQXF.exe

Filesize
2.2MB

MD5
661d0190c5bef6a0c1b1fe1790f8d1d5

SHA1
b73fd964838a5fa755d67cf381b69be66fe9cab3

SHA256
b3f8566041e91eb54c3ae1b98ca51e260ef053c9e664f9a6b3a81f8286beeada

SHA512
b40991fa5ed3aa62df5822dc21d1ed97c55963fc7766f7f2c5aca3b62cd9634beb8963bb34a7ecacabd8e1b167a07de7d0452d6f52ecc44ca02b5295c4da872d

Download Submit
C:\Windows\System\crzTUit.exe

Filesize
2.2MB

MD5
17e347c98d2496b7cb10ae5d2bead4ee

SHA1
bafe600de795d6ddced098fcffeea081c5985fdd

SHA256
54953ac36097ac65731d2e81d849c96bdc5f00e875062dcff631ac42ce917dcf

SHA512
3520a5483b803590bb0169309fbb108c624de7db4aa13512a6efd749a43bf890f5706f5e19a2e966a5d7591a747fedc6262759d538821114840334fa1e3ade66

Download Submit
C:\Windows\System\eHLKqTl.exe

Filesize
2.2MB

MD5
ba5d281e19ee776b97c8f7603cd171c6

SHA1
591362a14bf785535fbc7650a66db8ddad7ddbd3

SHA256
8b75aba6cf21feec0d9cd94d27d671a16b9ccc58c9ad8edf9127624c9acdb7f2

SHA512
800946c8e7d5af793ee8cf18f038a734a9c0aff4eb12facd49e2ed8ebf1b1b9f4630e862f71f0f54390a002f129407f771d4ced7d97fa677c49f50310cfbaa86

Download Submit
C:\Windows\System\iBbkefB.exe

Filesize
2.2MB

MD5
046073c18c3dd3b8f03e4398d130d48d

SHA1
29739178a211681dbcd024f395063ff34f3b3269

SHA256
bf87432c8f1aab67d1abc328672ef686c2917766ba38f5460e983de900627285

SHA512
f98e0c89871c3b88220f0d265b97ffcae0473dac62fccf22cfe3fcc5b63c3c4777ab4e268b150dab17c87072ce97d815c278ee7b1dd0fe5c5e0e09ec1c62675e

Download Submit
C:\Windows\System\kZIQeCE.exe

Filesize
8B

MD5
1855a32bc20d82a1da2b5edf8967f4e6

SHA1
25928e56f89ec28b56047592b93000c1d36e2a23

SHA256
197265335822dae03e837ac88a16d32bf68b201da4bc921af00edba259c1267c

SHA512
6ba43273aa11ef21001bd21641b2cb12d306e904aaff29ff56a8c7b3eadaaec0f04afabf47cd7eb2a1a7b9c79f098b4d11d9a442d2048486e96355d7914a5e67

Download Submit
C:\Windows\System\meKSiFT.exe

Filesize
2.2MB

MD5
c90cc450eb387481b2a8ab30ccda1ddc

SHA1
a37000b65caeca6d98ca15b504f24317101f8088

SHA256
063586dea30ac9adfee9cb65a64fcff4408cfb78f627eb2e301de2097ca4f18b

SHA512
8452ab07a7a23bc4c0926ff24708486ab61c01558c9f4609c6c787ffba8a2cfdbb6b5d5e749c08dea5e65898410520fd7f2407a65c2fa8e083330904688d632b

Download Submit
C:\Windows\System\nIyiBZK.exe

Filesize
2.2MB

MD5
79cd099d288cf1f7a3b14d27c6fc0884

SHA1
d6af2e09a606ca173bb4527f7216c7f33aa38dbf

SHA256
4bc4917a34178dd4e20fb18c321b5870ffc621b11a4440ba9b1095d319b944ac

SHA512
07b9f4958c83ceadace1b01bbfa3921e5facba96ad7707773e5cfa96bca2f79893568a833cc15ed0ca13dfc2dad15c5e43cd2189907cb991aa4ed9a8bcc0f0db

Download Submit
C:\Windows\System\pJIaFUt.exe

Filesize
2.2MB

MD5
63865519af157ebf08c7f3b99c2cb247

SHA1
f4e56a79e94b9723f37c658039e1b1355d8203c2

SHA256
aab2ed74fc53a33b5dd700ae4c73cbb1a87dff433e25901ad32aefd0d4467f46

SHA512
0230855e45b424466a9333f8e98747d3b629a1f7542a8a50d1140e70945edac103668ccaf7e2a70c210b0f1b4de67d8b95bb166a1f90510a6add8fb9e0e587cb

Download Submit
C:\Windows\System\pSqRazX.exe

Filesize
2.2MB

MD5
74165deace9c8412075fb1628a2ea98b

SHA1
a8cebb434cd0e58973fa653dd04403c86d83d609

SHA256
dafad82b3fc1a6cbeb599ef68c2da6460f1cdea090da4226d9bfc3462439063a

SHA512
cabb7ff72f0d19bea42aea4f0477002a2486d08549fd0d246f0da6d1a43fd24f51b4a623295038cc523e046e39e2627ece315ac315cdbc05a4d4aefcf7bd3ac7

Download Submit
C:\Windows\System\peYgMxB.exe

Filesize
2.2MB

MD5
a8303b67aaaf00313009cc7e6fb2b94c

SHA1
336ad0629480e03bd37a006401277093943382b7

SHA256
6702953bd0ae32fea686cd5d3b374e8923fec701fc306368101af7c497c31464

SHA512
03b8cd43c4e6c9e58a248490f080cd84a6acf1f4f9eea62ed72e9a8dab01eb366b5ca843343da19bb145a632bf780aa9425dd77db19602e6f43d42c424accccc

Download Submit
C:\Windows\System\pyzCBay.exe

Filesize
2.2MB

MD5
ed2f336b28b4c5ec55358b8a8b10062e

SHA1
5baa875aa05a390fa366bcf1625e85bb241a27c5

SHA256
0445736b0b664d81aacd9ca4a0b2cc8c1857be49d6372b705b181f71c8e5028a

SHA512
447ddf056bdb04a8c70031ece0c379b23701d41367ebd544e5d297192feeac9590c01e94cb24af66a931067267d37b802a1c271cf47dfee3f6112fdb56ef5683

Download Submit
C:\Windows\System\qtLtFmW.exe

Filesize
2.2MB

MD5
52b3fa801f011fbd804ef936b467b771

SHA1
b940c54db938536566639903886abb9a4f469f91

SHA256
2caf077045336f5e5fa6f3c71d647bc9c119ba36a7912db483ad06beafa21aed

SHA512
92100093fc64f1a7bc554db24158a0660a9a47ebf250d185bec408bf35f5940ca8b61a887ad9ece4d019b6dac1359be6e69a65d5b5d8c764bcf03e25940160d6

Download Submit
C:\Windows\System\tqIQpwr.exe

Filesize
2.2MB

MD5
24e202c36c118ef72ff867fabbab9d95

SHA1
d5f000683c65c25afd5b47e75af2d58263774414

SHA256
49aed5ae586103a705952ac9313eb0c5778f37510d202a132e8d9c956bde00c4

SHA512
84e1efaecb43f6de22eadfdfce30bbdb17a28b1e1c22d52b2cd640758e4f3617c9a98e744728fa16c53379a05e9a7bef7e4cfbfda8441d2bcaddc2543e199b6c

Download Submit
C:\Windows\System\wEVnnEC.exe

Filesize
2.2MB

MD5
d743857b7ac75c844f2e2ec1f83679d7

SHA1
df4de9ff5a1726dcf931ddb739ec772afbd97227

SHA256
34b94e5bc49b6296ed3b9fe5f9609fdf08802c47693732966b2e677940c4832c

SHA512
57ff41bf6b747c26f9dec21cdf4e01a1c1d917b80e055c6144dd18de88d34f08c9a02afe262bc000886b2546a2a417934f5f0b3ee896579615cf88dbe94dc69b

Download Submit
C:\Windows\System\wFdGxDS.exe

Filesize
2.2MB

MD5
ce2e14379755ab094939fcc486b9e09b

SHA1
935c5205e4a3717bc2ef620436b81d4f18e647c1

SHA256
ea330a9051a9174a90cafd66847d35a799df4784091270464aea67b595939f16

SHA512
d868f149e9e585fcfbdf0afd9af5e7c73cdecd5ce43508a0dcd43050351e75af196ac1c94de361e0f1dbd5039ca1e91e2e698ed9de012ec6834b6fbeee12645b

Download Submit
C:\Windows\System\ysjHaWA.exe

Filesize
2.2MB

MD5
8c442a1cc0007a5f17aeef0a18a0b46f

SHA1
060f7bc54d3804716b97d520365b6b3188835154

SHA256
3950cc0da87b3085bd938d53d5d98e2a5f5941093fbda94db9c55a1bfff90ffc

SHA512
e8929a53780b2b4f503b480ab28d461f975d401013b9e11301c53cae6af1895d2ccc5bc4b1aad8678d0227ce183593fbb3ee21cb06f30a8f18474ef412ba00e4

Download Submit
memory/392-2578-0x00007FFC54370000-0x00007FFC54E31000-memory.dmp

Filesize
10.8MB

Download
memory/392-44-0x000001FD74F60000-0x000001FD74F70000-memory.dmp

Filesize
64KB

Download
memory/392-33-0x00007FFC54370000-0x00007FFC54E31000-memory.dmp

Filesize
10.8MB

Download
memory/392-43-0x000001FD74F60000-0x000001FD74F70000-memory.dmp

Filesize
64KB

Download
memory/392-392-0x000001FD77D90000-0x000001FD78536000-memory.dmp

Filesize
7.6MB

Download
memory/392-2566-0x00007FFC54370000-0x00007FFC54E31000-memory.dmp

Filesize
10.8MB

Download
memory/392-40-0x000001FD74F00000-0x000001FD74F22000-memory.dmp

Filesize
136KB

Download
memory/392-2568-0x000001FD74F60000-0x000001FD74F70000-memory.dmp

Filesize
64KB

Download
memory/904-2617-0x00007FF7035D0000-0x00007FF7039C2000-memory.dmp

Filesize
3.9MB

Download
memory/904-70-0x00007FF7035D0000-0x00007FF7039C2000-memory.dmp

Filesize
3.9MB

Download
memory/1020-79-0x00007FF6D50F0000-0x00007FF6D54E2000-memory.dmp

Filesize
3.9MB

Download
memory/1020-2629-0x00007FF6D50F0000-0x00007FF6D54E2000-memory.dmp

Filesize
3.9MB

Download
memory/1220-2619-0x00007FF6F7440000-0x00007FF6F7832000-memory.dmp

Filesize
3.9MB

Download
memory/1220-76-0x00007FF6F7440000-0x00007FF6F7832000-memory.dmp

Filesize
3.9MB

Download
memory/1428-422-0x00007FF625740000-0x00007FF625B32000-memory.dmp

Filesize
3.9MB

Download
memory/1428-2635-0x00007FF625740000-0x00007FF625B32000-memory.dmp

Filesize
3.9MB

Download
memory/1612-2685-0x00007FF60FE00000-0x00007FF6101F2000-memory.dmp

Filesize
3.9MB

Download
memory/1612-458-0x00007FF60FE00000-0x00007FF6101F2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-2625-0x00007FF68A020000-0x00007FF68A412000-memory.dmp

Filesize
3.9MB

Download
memory/2132-77-0x00007FF68A020000-0x00007FF68A412000-memory.dmp

Filesize
3.9MB

Download
memory/2592-1-0x00000208AA670000-0x00000208AA680000-memory.dmp

Filesize
64KB

Download
memory/2592-0-0x00007FF624F80000-0x00007FF625372000-memory.dmp

Filesize
3.9MB

Download
memory/2716-426-0x00007FF7A9680000-0x00007FF7A9A72000-memory.dmp

Filesize
3.9MB

Download
memory/2716-2679-0x00007FF7A9680000-0x00007FF7A9A72000-memory.dmp

Filesize
3.9MB

Download
memory/2828-2683-0x00007FF6253F0000-0x00007FF6257E2000-memory.dmp

Filesize
3.9MB

Download
memory/2828-439-0x00007FF6253F0000-0x00007FF6257E2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-47-0x00007FF77D6F0000-0x00007FF77DAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-2621-0x00007FF77D6F0000-0x00007FF77DAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-2615-0x00007FF6885E0000-0x00007FF6889D2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-11-0x00007FF6885E0000-0x00007FF6889D2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-2571-0x00007FF7DCA50000-0x00007FF7DCE42000-memory.dmp

Filesize
3.9MB

Download
memory/3012-2664-0x00007FF7DCA50000-0x00007FF7DCE42000-memory.dmp

Filesize
3.9MB

Download
memory/3012-87-0x00007FF7DCA50000-0x00007FF7DCE42000-memory.dmp

Filesize
3.9MB

Download
memory/3064-424-0x00007FF78CCB0000-0x00007FF78D0A2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-2673-0x00007FF78CCB0000-0x00007FF78D0A2000-memory.dmp

Filesize
3.9MB

Download
memory/3172-470-0x00007FF7196F0000-0x00007FF719AE2000-memory.dmp

Filesize
3.9MB

Download
memory/3172-2687-0x00007FF7196F0000-0x00007FF719AE2000-memory.dmp

Filesize
3.9MB

Download
memory/3364-2669-0x00007FF714600000-0x00007FF7149F2000-memory.dmp

Filesize
3.9MB

Download
memory/3364-473-0x00007FF714600000-0x00007FF7149F2000-memory.dmp

Filesize
3.9MB

Download
memory/3700-82-0x00007FF6896A0000-0x00007FF689A92000-memory.dmp

Filesize
3.9MB

Download
memory/3700-2570-0x00007FF6896A0000-0x00007FF689A92000-memory.dmp

Filesize
3.9MB

Download
memory/3700-2654-0x00007FF6896A0000-0x00007FF689A92000-memory.dmp

Filesize
3.9MB

Download
memory/3788-2633-0x00007FF71ACB0000-0x00007FF71B0A2000-memory.dmp

Filesize
3.9MB

Download
memory/3788-62-0x00007FF71ACB0000-0x00007FF71B0A2000-memory.dmp

Filesize
3.9MB

Download
memory/3788-2567-0x00007FF71ACB0000-0x00007FF71B0A2000-memory.dmp

Filesize
3.9MB

Download
memory/4068-425-0x00007FF7ECF00000-0x00007FF7ED2F2000-memory.dmp

Filesize
3.9MB

Download
memory/4068-2681-0x00007FF7ECF00000-0x00007FF7ED2F2000-memory.dmp

Filesize
3.9MB

Download
memory/4260-423-0x00007FF7385D0000-0x00007FF7389C2000-memory.dmp

Filesize
3.9MB

Download
memory/4260-2672-0x00007FF7385D0000-0x00007FF7389C2000-memory.dmp

Filesize
3.9MB

Download
memory/4452-83-0x00007FF63C990000-0x00007FF63CD82000-memory.dmp

Filesize
3.9MB

Download
memory/4452-2612-0x00007FF63C990000-0x00007FF63CD82000-memory.dmp

Filesize
3.9MB

Download
memory/4452-2632-0x00007FF63C990000-0x00007FF63CD82000-memory.dmp

Filesize
3.9MB

Download
memory/4988-2569-0x00007FF7FDD00000-0x00007FF7FE0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-2627-0x00007FF7FDD00000-0x00007FF7FE0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-63-0x00007FF7FDD00000-0x00007FF7FE0F2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-2623-0x00007FF765F90000-0x00007FF766382000-memory.dmp

Filesize
3.9MB

Download
memory/5016-57-0x00007FF765F90000-0x00007FF766382000-memory.dmp

Filesize
3.9MB

Download