xmrig | 9dc8d35c6fd562a912357acc38e5a55a306606ca690b7e5f2ea309165b5312aa

Analysis

max time kernel
124s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
Size

1.7MB
MD5

0ac435a3af8d413325ac48e93c6a306b
SHA1

44040c2cc5e32c0b59c337a7b52507b5b688d216
SHA256

9dc8d35c6fd562a912357acc38e5a55a306606ca690b7e5f2ea309165b5312aa
SHA512

d4ee238d66c589995263858eb09ae3bed8183353be1d87f474ebf2c8e4b690e1b8b9f03d1a67a5f75ba3ad117dd80c723a49f52e5853d80ad1c07ab6af7fea34
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SGkMKP4:NABj

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4332-28-0x00007FF755110000-0x00007FF755502000-memory.dmp	xmrig
behavioral2/memory/4348-60-0x00007FF65A730000-0x00007FF65AB22000-memory.dmp	xmrig
behavioral2/memory/4936-62-0x00007FF612480000-0x00007FF612872000-memory.dmp	xmrig
behavioral2/memory/2572-109-0x00007FF7C5890000-0x00007FF7C5C82000-memory.dmp	xmrig
behavioral2/memory/3548-148-0x00007FF677B60000-0x00007FF677F52000-memory.dmp	xmrig
behavioral2/memory/3940-158-0x00007FF7BC9A0000-0x00007FF7BCD92000-memory.dmp	xmrig
behavioral2/memory/984-155-0x00007FF6ED640000-0x00007FF6EDA32000-memory.dmp	xmrig
behavioral2/memory/1384-151-0x00007FF603A90000-0x00007FF603E82000-memory.dmp	xmrig
behavioral2/memory/4272-146-0x00007FF69FF70000-0x00007FF6A0362000-memory.dmp	xmrig
behavioral2/memory/1988-141-0x00007FF6C90A0000-0x00007FF6C9492000-memory.dmp	xmrig
behavioral2/memory/1464-96-0x00007FF797850000-0x00007FF797C42000-memory.dmp	xmrig
behavioral2/memory/2544-84-0x00007FF760110000-0x00007FF760502000-memory.dmp	xmrig
behavioral2/memory/4716-65-0x00007FF71C730000-0x00007FF71CB22000-memory.dmp	xmrig
behavioral2/memory/1956-76-0x00007FF7EDE00000-0x00007FF7EE1F2000-memory.dmp	xmrig
behavioral2/memory/3452-1996-0x00007FF7810D0000-0x00007FF7814C2000-memory.dmp	xmrig
behavioral2/memory/3684-1995-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp	xmrig
behavioral2/memory/2536-2008-0x00007FF74D2C0000-0x00007FF74D6B2000-memory.dmp	xmrig
behavioral2/memory/3028-2021-0x00007FF64EC00000-0x00007FF64EFF2000-memory.dmp	xmrig
behavioral2/memory/2248-2022-0x00007FF7A1B80000-0x00007FF7A1F72000-memory.dmp	xmrig
behavioral2/memory/1392-2036-0x00007FF627310000-0x00007FF627702000-memory.dmp	xmrig
behavioral2/memory/2012-2037-0x00007FF7B06F0000-0x00007FF7B0AE2000-memory.dmp	xmrig
behavioral2/memory/3684-2039-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp	xmrig
behavioral2/memory/4332-2041-0x00007FF755110000-0x00007FF755502000-memory.dmp	xmrig
behavioral2/memory/2544-2060-0x00007FF760110000-0x00007FF760502000-memory.dmp	xmrig
behavioral2/memory/2536-2065-0x00007FF74D2C0000-0x00007FF74D6B2000-memory.dmp	xmrig
behavioral2/memory/1956-2070-0x00007FF7EDE00000-0x00007FF7EE1F2000-memory.dmp	xmrig
behavioral2/memory/3452-2064-0x00007FF7810D0000-0x00007FF7814C2000-memory.dmp	xmrig
behavioral2/memory/4348-2072-0x00007FF65A730000-0x00007FF65AB22000-memory.dmp	xmrig
behavioral2/memory/4716-2079-0x00007FF71C730000-0x00007FF71CB22000-memory.dmp	xmrig
behavioral2/memory/2572-2080-0x00007FF7C5890000-0x00007FF7C5C82000-memory.dmp	xmrig
behavioral2/memory/4936-2077-0x00007FF612480000-0x00007FF612872000-memory.dmp	xmrig
behavioral2/memory/1464-2075-0x00007FF797850000-0x00007FF797C42000-memory.dmp	xmrig
behavioral2/memory/4272-2082-0x00007FF69FF70000-0x00007FF6A0362000-memory.dmp	xmrig
behavioral2/memory/3548-2084-0x00007FF677B60000-0x00007FF677F52000-memory.dmp	xmrig
behavioral2/memory/1384-2086-0x00007FF603A90000-0x00007FF603E82000-memory.dmp	xmrig
behavioral2/memory/2012-2089-0x00007FF7B06F0000-0x00007FF7B0AE2000-memory.dmp	xmrig
behavioral2/memory/3028-2092-0x00007FF64EC00000-0x00007FF64EFF2000-memory.dmp	xmrig
behavioral2/memory/1988-2094-0x00007FF6C90A0000-0x00007FF6C9492000-memory.dmp	xmrig
behavioral2/memory/1392-2090-0x00007FF627310000-0x00007FF627702000-memory.dmp	xmrig
behavioral2/memory/3940-2101-0x00007FF7BC9A0000-0x00007FF7BCD92000-memory.dmp	xmrig
behavioral2/memory/984-2102-0x00007FF6ED640000-0x00007FF6EDA32000-memory.dmp	xmrig
behavioral2/memory/2248-2098-0x00007FF7A1B80000-0x00007FF7A1F72000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	2844	powershell.exe
10	2844	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3684	GerKiPX.exe
3452	AkBthQs.exe
4332	gAZXlVo.exe
2536	tFcyGOP.exe
1956	lHpeOIf.exe
2544	QNRXIFs.exe
4348	FSwrfLC.exe
4936	XvtAFWs.exe
4716	AILDyZA.exe
1464	zOgAMym.exe
2572	XsaUPnq.exe
4272	YbuSnsZ.exe
3548	XEVcMel.exe
1384	JzYbLHE.exe
3028	KzQGHVE.exe
1392	mYVgfAP.exe
2012	LLAjuTO.exe
2248	qhLWDMe.exe
1988	igLVQZd.exe
984	Uhnrpnk.exe
3940	oJfkgpZ.exe
3900	TTRYfvW.exe
764	FBBEVhm.exe
512	vUpqNqd.exe
4412	OEktBCM.exe
2584	oYqhaeI.exe
5000	VqwovNM.exe
4600	RFcAHPF.exe
3432	XyvqHLO.exe
3372	mNcxhja.exe
2996	QfQtIOH.exe
3184	bIosoyu.exe
2668	qxVHFSs.exe
208	OKPZcXF.exe
3444	QSTQeSJ.exe
3556	DanzFfh.exe
4268	pMVMOCr.exe
4768	SNlYGIN.exe
4292	bKdkVXT.exe
1960	KFoqOJd.exe
4168	WpzIUxz.exe
1412	FsbkqHV.exe
4940	XlwGhwb.exe
3800	WbHearM.exe
5024	WwPqfsR.exe
2200	JrOaIpe.exe
348	sbuUmAQ.exe
532	TqJQlvq.exe
1648	rEpVhTo.exe
1832	gExIQPO.exe
2796	KMLSWyZ.exe
4368	YhXyYPs.exe
3304	nkDxLoH.exe
1548	RaISdEk.exe
4904	rueZDJM.exe
4052	GsxidMx.exe
2600	LMGcZIm.exe
3576	PpMnJYs.exe
1476	TAhsCOy.exe
4132	GUnGQIX.exe
3032	pzCRlZU.exe
3604	XxSfnVh.exe
4488	ueSQnqg.exe
2716	fUorQeb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2268-0-0x00007FF71A380000-0x00007FF71A772000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-7.dat	upx
behavioral2/files/0x000b000000023ba0-5.dat	upx
behavioral2/memory/3684-10-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp	upx
behavioral2/files/0x000a000000023ba4-13.dat	upx
behavioral2/memory/2536-23-0x00007FF74D2C0000-0x00007FF74D6B2000-memory.dmp	upx
behavioral2/memory/4332-28-0x00007FF755110000-0x00007FF755502000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-30.dat	upx
behavioral2/files/0x000a000000023ba7-24.dat	upx
behavioral2/memory/3452-22-0x00007FF7810D0000-0x00007FF7814C2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-21.dat	upx
behavioral2/files/0x000a000000023ba9-47.dat	upx
behavioral2/files/0x000a000000023bac-57.dat	upx
behavioral2/files/0x000a000000023bab-53.dat	upx
behavioral2/files/0x000a000000023baa-51.dat	upx
behavioral2/files/0x000a000000023bad-61.dat	upx
behavioral2/memory/4348-60-0x00007FF65A730000-0x00007FF65AB22000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-66.dat	upx
behavioral2/memory/4936-62-0x00007FF612480000-0x00007FF612872000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-112.dat	upx
behavioral2/memory/2572-109-0x00007FF7C5890000-0x00007FF7C5C82000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-119.dat	upx
behavioral2/files/0x000c000000023ba1-123.dat	upx
behavioral2/files/0x0031000000023bb5-132.dat	upx
behavioral2/files/0x000a000000023bb7-136.dat	upx
behavioral2/memory/3548-148-0x00007FF677B60000-0x00007FF677F52000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-156.dat	upx
behavioral2/files/0x000a000000023bbb-163.dat	upx
behavioral2/files/0x000a000000023bbd-173.dat	upx
behavioral2/files/0x000a000000023bc0-186.dat	upx
behavioral2/files/0x000a000000023bc2-196.dat	upx
behavioral2/files/0x000a000000023bc1-191.dat	upx
behavioral2/files/0x000a000000023bbf-187.dat	upx
behavioral2/files/0x000a000000023bbe-182.dat	upx
behavioral2/files/0x000a000000023bbc-171.dat	upx
behavioral2/files/0x000a000000023bba-159.dat	upx
behavioral2/memory/3940-158-0x00007FF7BC9A0000-0x00007FF7BCD92000-memory.dmp	upx
behavioral2/memory/984-155-0x00007FF6ED640000-0x00007FF6EDA32000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-153.dat	upx
behavioral2/memory/1384-151-0x00007FF603A90000-0x00007FF603E82000-memory.dmp	upx
behavioral2/memory/4272-146-0x00007FF69FF70000-0x00007FF6A0362000-memory.dmp	upx
behavioral2/memory/1988-141-0x00007FF6C90A0000-0x00007FF6C9492000-memory.dmp	upx
behavioral2/memory/2248-135-0x00007FF7A1B80000-0x00007FF7A1F72000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-134.dat	upx
behavioral2/files/0x000b000000023bb0-128.dat	upx
behavioral2/files/0x0031000000023bb4-120.dat	upx
behavioral2/memory/2012-121-0x00007FF7B06F0000-0x00007FF7B0AE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-127.dat	upx
behavioral2/memory/1392-118-0x00007FF627310000-0x00007FF627702000-memory.dmp	upx
behavioral2/memory/3028-117-0x00007FF64EC00000-0x00007FF64EFF2000-memory.dmp	upx
behavioral2/memory/1464-96-0x00007FF797850000-0x00007FF797C42000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-91.dat	upx
behavioral2/memory/2544-84-0x00007FF760110000-0x00007FF760502000-memory.dmp	upx
behavioral2/memory/4716-65-0x00007FF71C730000-0x00007FF71CB22000-memory.dmp	upx
behavioral2/memory/1956-76-0x00007FF7EDE00000-0x00007FF7EE1F2000-memory.dmp	upx
behavioral2/memory/3452-1996-0x00007FF7810D0000-0x00007FF7814C2000-memory.dmp	upx
behavioral2/memory/3684-1995-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp	upx
behavioral2/memory/2536-2008-0x00007FF74D2C0000-0x00007FF74D6B2000-memory.dmp	upx
behavioral2/memory/3028-2021-0x00007FF64EC00000-0x00007FF64EFF2000-memory.dmp	upx
behavioral2/memory/2248-2022-0x00007FF7A1B80000-0x00007FF7A1F72000-memory.dmp	upx
behavioral2/memory/1392-2036-0x00007FF627310000-0x00007FF627702000-memory.dmp	upx
behavioral2/memory/2012-2037-0x00007FF7B06F0000-0x00007FF7B0AE2000-memory.dmp	upx
behavioral2/memory/3684-2039-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp	upx
behavioral2/memory/4332-2041-0x00007FF755110000-0x00007FF755502000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oYqhaeI.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\DeORMQa.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\YjHuZkQ.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\iavTcHH.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\hcvtFMW.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\CdNNRZw.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\YzaUAri.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\ZlNfHKP.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\OPvCbDn.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\MfbWGLf.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\PiQhpUi.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\CGXqStA.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\MnCKfzM.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\dlhHsYT.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\YXwtiju.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\LLAjuTO.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\sVlfyRB.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\yudAmTU.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\gjqceLV.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\uRzxdAB.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\vQHzyUi.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\VuiGpCh.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\GNpqBWt.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\AsJBTkF.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\pVpHEjU.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\eBZCsDy.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\HXFvOeo.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\hKstWFJ.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\WBklDeo.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\OHVSSEX.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\mUCJOKL.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\xXmdhcU.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\fyQetCi.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\rEpVhTo.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\IVWjRur.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\qUEVEie.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\waxyrBl.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\AKzOxPS.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\JFyZzch.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\XlwGhwb.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\POrvggE.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\yUicpwB.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\tFcyGOP.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\MPquILh.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\zCPlCbN.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\VXVclsN.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\RvMSTaD.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\lnaxtHA.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\leLxHjN.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\YGMJwus.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\xjmZrhh.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\BkVGlgB.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\HLGjckF.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\aVAkDMi.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\XvtAFWs.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\wdxTcrI.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\QLvFMUS.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\XFqTwhd.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\TEuTcin.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\Txxriax.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\FrLnDwn.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\EwAJjbW.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\HVSozgs.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\nhJkWis.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2844	powershell.exe
2844	powershell.exe
2844	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeLockMemoryPrivilege	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2844	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	85
PID 2268 wrote to memory of 2844	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	85
PID 2268 wrote to memory of 3684	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	86
PID 2268 wrote to memory of 3684	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	86
PID 2268 wrote to memory of 3452	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	87
PID 2268 wrote to memory of 3452	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	87
PID 2268 wrote to memory of 4332	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	88
PID 2268 wrote to memory of 4332	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	88
PID 2268 wrote to memory of 2536	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	89
PID 2268 wrote to memory of 2536	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	89
PID 2268 wrote to memory of 1956	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	90
PID 2268 wrote to memory of 1956	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	90
PID 2268 wrote to memory of 2544	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	91
PID 2268 wrote to memory of 2544	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	91
PID 2268 wrote to memory of 4348	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	92
PID 2268 wrote to memory of 4348	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	92
PID 2268 wrote to memory of 4936	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	93
PID 2268 wrote to memory of 4936	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	93
PID 2268 wrote to memory of 4716	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	94
PID 2268 wrote to memory of 4716	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	94
PID 2268 wrote to memory of 1464	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	95
PID 2268 wrote to memory of 1464	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	95
PID 2268 wrote to memory of 2572	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	96
PID 2268 wrote to memory of 2572	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	96
PID 2268 wrote to memory of 4272	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	97
PID 2268 wrote to memory of 4272	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	97
PID 2268 wrote to memory of 3548	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	98
PID 2268 wrote to memory of 3548	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	98
PID 2268 wrote to memory of 1384	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	99
PID 2268 wrote to memory of 1384	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	99
PID 2268 wrote to memory of 3028	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	100
PID 2268 wrote to memory of 3028	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	100
PID 2268 wrote to memory of 1392	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	101
PID 2268 wrote to memory of 1392	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	101
PID 2268 wrote to memory of 2012	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	102
PID 2268 wrote to memory of 2012	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	102
PID 2268 wrote to memory of 2248	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	103
PID 2268 wrote to memory of 2248	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	103
PID 2268 wrote to memory of 1988	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	104
PID 2268 wrote to memory of 1988	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	104
PID 2268 wrote to memory of 984	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	105
PID 2268 wrote to memory of 984	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	105
PID 2268 wrote to memory of 3940	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	106
PID 2268 wrote to memory of 3940	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	106
PID 2268 wrote to memory of 3900	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	107
PID 2268 wrote to memory of 3900	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	107
PID 2268 wrote to memory of 764	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	108
PID 2268 wrote to memory of 764	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	108
PID 2268 wrote to memory of 512	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	109
PID 2268 wrote to memory of 512	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	109
PID 2268 wrote to memory of 4412	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	110
PID 2268 wrote to memory of 4412	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	110
PID 2268 wrote to memory of 2584	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	111
PID 2268 wrote to memory of 2584	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	111
PID 2268 wrote to memory of 5000	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	112
PID 2268 wrote to memory of 5000	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	112
PID 2268 wrote to memory of 4600	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	113
PID 2268 wrote to memory of 4600	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	113
PID 2268 wrote to memory of 3432	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	114
PID 2268 wrote to memory of 3432	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	114
PID 2268 wrote to memory of 3372	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	115
PID 2268 wrote to memory of 3372	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	115
PID 2268 wrote to memory of 2996	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	116
PID 2268 wrote to memory of 2996	2268	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2844" "2948" "2872" "2952" "0" "0" "2956" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13900
- C:\Windows\System\GerKiPX.exe
  C:\Windows\System\GerKiPX.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\AkBthQs.exe
  C:\Windows\System\AkBthQs.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\gAZXlVo.exe
  C:\Windows\System\gAZXlVo.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\tFcyGOP.exe
  C:\Windows\System\tFcyGOP.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\lHpeOIf.exe
  C:\Windows\System\lHpeOIf.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\QNRXIFs.exe
  C:\Windows\System\QNRXIFs.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\FSwrfLC.exe
  C:\Windows\System\FSwrfLC.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\XvtAFWs.exe
  C:\Windows\System\XvtAFWs.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\AILDyZA.exe
  C:\Windows\System\AILDyZA.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\zOgAMym.exe
  C:\Windows\System\zOgAMym.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\XsaUPnq.exe
  C:\Windows\System\XsaUPnq.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\YbuSnsZ.exe
  C:\Windows\System\YbuSnsZ.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\XEVcMel.exe
  C:\Windows\System\XEVcMel.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\JzYbLHE.exe
  C:\Windows\System\JzYbLHE.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\KzQGHVE.exe
  C:\Windows\System\KzQGHVE.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\mYVgfAP.exe
  C:\Windows\System\mYVgfAP.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\LLAjuTO.exe
  C:\Windows\System\LLAjuTO.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\qhLWDMe.exe
  C:\Windows\System\qhLWDMe.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\igLVQZd.exe
  C:\Windows\System\igLVQZd.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\Uhnrpnk.exe
  C:\Windows\System\Uhnrpnk.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\oJfkgpZ.exe
  C:\Windows\System\oJfkgpZ.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\TTRYfvW.exe
  C:\Windows\System\TTRYfvW.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\FBBEVhm.exe
  C:\Windows\System\FBBEVhm.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\vUpqNqd.exe
  C:\Windows\System\vUpqNqd.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\OEktBCM.exe
  C:\Windows\System\OEktBCM.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\oYqhaeI.exe
  C:\Windows\System\oYqhaeI.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\VqwovNM.exe
  C:\Windows\System\VqwovNM.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\RFcAHPF.exe
  C:\Windows\System\RFcAHPF.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\XyvqHLO.exe
  C:\Windows\System\XyvqHLO.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\mNcxhja.exe
  C:\Windows\System\mNcxhja.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\QfQtIOH.exe
  C:\Windows\System\QfQtIOH.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\bIosoyu.exe
  C:\Windows\System\bIosoyu.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\qxVHFSs.exe
  C:\Windows\System\qxVHFSs.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\OKPZcXF.exe
  C:\Windows\System\OKPZcXF.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\QSTQeSJ.exe
  C:\Windows\System\QSTQeSJ.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\DanzFfh.exe
  C:\Windows\System\DanzFfh.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\pMVMOCr.exe
  C:\Windows\System\pMVMOCr.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\SNlYGIN.exe
  C:\Windows\System\SNlYGIN.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\bKdkVXT.exe
  C:\Windows\System\bKdkVXT.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\KFoqOJd.exe
  C:\Windows\System\KFoqOJd.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\WpzIUxz.exe
  C:\Windows\System\WpzIUxz.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\FsbkqHV.exe
  C:\Windows\System\FsbkqHV.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\XlwGhwb.exe
  C:\Windows\System\XlwGhwb.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\WbHearM.exe
  C:\Windows\System\WbHearM.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\WwPqfsR.exe
  C:\Windows\System\WwPqfsR.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\JrOaIpe.exe
  C:\Windows\System\JrOaIpe.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\sbuUmAQ.exe
  C:\Windows\System\sbuUmAQ.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\TqJQlvq.exe
  C:\Windows\System\TqJQlvq.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\rEpVhTo.exe
  C:\Windows\System\rEpVhTo.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\gExIQPO.exe
  C:\Windows\System\gExIQPO.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\KMLSWyZ.exe
  C:\Windows\System\KMLSWyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\YhXyYPs.exe
  C:\Windows\System\YhXyYPs.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\nkDxLoH.exe
  C:\Windows\System\nkDxLoH.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\RaISdEk.exe
  C:\Windows\System\RaISdEk.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\rueZDJM.exe
  C:\Windows\System\rueZDJM.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\GsxidMx.exe
  C:\Windows\System\GsxidMx.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\LMGcZIm.exe
  C:\Windows\System\LMGcZIm.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\PpMnJYs.exe
  C:\Windows\System\PpMnJYs.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\TAhsCOy.exe
  C:\Windows\System\TAhsCOy.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\GUnGQIX.exe
  C:\Windows\System\GUnGQIX.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\pzCRlZU.exe
  C:\Windows\System\pzCRlZU.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\XxSfnVh.exe
  C:\Windows\System\XxSfnVh.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\ueSQnqg.exe
  C:\Windows\System\ueSQnqg.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\fUorQeb.exe
  C:\Windows\System\fUorQeb.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\gznLUps.exe
  C:\Windows\System\gznLUps.exe
  2⤵
  PID:4640
- C:\Windows\System\sDbZRLM.exe
  C:\Windows\System\sDbZRLM.exe
  2⤵
  PID:5092
- C:\Windows\System\MfbWGLf.exe
  C:\Windows\System\MfbWGLf.exe
  2⤵
  PID:1592
- C:\Windows\System\MhGnkvq.exe
  C:\Windows\System\MhGnkvq.exe
  2⤵
  PID:3116
- C:\Windows\System\ECDsVWk.exe
  C:\Windows\System\ECDsVWk.exe
  2⤵
  PID:2132
- C:\Windows\System\CMdZdHp.exe
  C:\Windows\System\CMdZdHp.exe
  2⤵
  PID:1312
- C:\Windows\System\pbBjSpJ.exe
  C:\Windows\System\pbBjSpJ.exe
  2⤵
  PID:2732
- C:\Windows\System\YAkLTxm.exe
  C:\Windows\System\YAkLTxm.exe
  2⤵
  PID:4572
- C:\Windows\System\XhJJshJ.exe
  C:\Windows\System\XhJJshJ.exe
  2⤵
  PID:4928
- C:\Windows\System\voKOTdO.exe
  C:\Windows\System\voKOTdO.exe
  2⤵
  PID:1608
- C:\Windows\System\WMXXsrx.exe
  C:\Windows\System\WMXXsrx.exe
  2⤵
  PID:3368
- C:\Windows\System\sxbRIdb.exe
  C:\Windows\System\sxbRIdb.exe
  2⤵
  PID:5140
- C:\Windows\System\AbUEMKa.exe
  C:\Windows\System\AbUEMKa.exe
  2⤵
  PID:5172
- C:\Windows\System\XWFRrnI.exe
  C:\Windows\System\XWFRrnI.exe
  2⤵
  PID:5204
- C:\Windows\System\RHBYgQw.exe
  C:\Windows\System\RHBYgQw.exe
  2⤵
  PID:5228
- C:\Windows\System\RtkQnrb.exe
  C:\Windows\System\RtkQnrb.exe
  2⤵
  PID:5260
- C:\Windows\System\XDwJBtb.exe
  C:\Windows\System\XDwJBtb.exe
  2⤵
  PID:5284
- C:\Windows\System\ntwUmAs.exe
  C:\Windows\System\ntwUmAs.exe
  2⤵
  PID:5300
- C:\Windows\System\VGDwYqr.exe
  C:\Windows\System\VGDwYqr.exe
  2⤵
  PID:5324
- C:\Windows\System\XnNbeXI.exe
  C:\Windows\System\XnNbeXI.exe
  2⤵
  PID:5360
- C:\Windows\System\TDrvWLL.exe
  C:\Windows\System\TDrvWLL.exe
  2⤵
  PID:5388
- C:\Windows\System\IVWjRur.exe
  C:\Windows\System\IVWjRur.exe
  2⤵
  PID:5428
- C:\Windows\System\JqIOSQm.exe
  C:\Windows\System\JqIOSQm.exe
  2⤵
  PID:5452
- C:\Windows\System\mKzTnqx.exe
  C:\Windows\System\mKzTnqx.exe
  2⤵
  PID:5480
- C:\Windows\System\FSbpJLp.exe
  C:\Windows\System\FSbpJLp.exe
  2⤵
  PID:5504
- C:\Windows\System\ezgleYz.exe
  C:\Windows\System\ezgleYz.exe
  2⤵
  PID:5536
- C:\Windows\System\nruNdva.exe
  C:\Windows\System\nruNdva.exe
  2⤵
  PID:5568
- C:\Windows\System\VkGdOZw.exe
  C:\Windows\System\VkGdOZw.exe
  2⤵
  PID:5596
- C:\Windows\System\lNSDUch.exe
  C:\Windows\System\lNSDUch.exe
  2⤵
  PID:5624
- C:\Windows\System\cUftQMC.exe
  C:\Windows\System\cUftQMC.exe
  2⤵
  PID:5648
- C:\Windows\System\qLHwmFb.exe
  C:\Windows\System\qLHwmFb.exe
  2⤵
  PID:5680
- C:\Windows\System\OrKpSmf.exe
  C:\Windows\System\OrKpSmf.exe
  2⤵
  PID:5704
- C:\Windows\System\jnEcbqK.exe
  C:\Windows\System\jnEcbqK.exe
  2⤵
  PID:5736
- C:\Windows\System\uziKVxD.exe
  C:\Windows\System\uziKVxD.exe
  2⤵
  PID:5764
- C:\Windows\System\gYWlVIe.exe
  C:\Windows\System\gYWlVIe.exe
  2⤵
  PID:5792
- C:\Windows\System\qjiTbfp.exe
  C:\Windows\System\qjiTbfp.exe
  2⤵
  PID:5820
- C:\Windows\System\CAOQVqU.exe
  C:\Windows\System\CAOQVqU.exe
  2⤵
  PID:5848
- C:\Windows\System\cdBCspL.exe
  C:\Windows\System\cdBCspL.exe
  2⤵
  PID:5876
- C:\Windows\System\hKstWFJ.exe
  C:\Windows\System\hKstWFJ.exe
  2⤵
  PID:5900
- C:\Windows\System\gRjaVfN.exe
  C:\Windows\System\gRjaVfN.exe
  2⤵
  PID:5928
- C:\Windows\System\LhXcJZe.exe
  C:\Windows\System\LhXcJZe.exe
  2⤵
  PID:5956
- C:\Windows\System\DPEolgR.exe
  C:\Windows\System\DPEolgR.exe
  2⤵
  PID:5988
- C:\Windows\System\VhkPdau.exe
  C:\Windows\System\VhkPdau.exe
  2⤵
  PID:6032
- C:\Windows\System\Txxriax.exe
  C:\Windows\System\Txxriax.exe
  2⤵
  PID:6052
- C:\Windows\System\LVkKxjv.exe
  C:\Windows\System\LVkKxjv.exe
  2⤵
  PID:6080
- C:\Windows\System\pIRGvFR.exe
  C:\Windows\System\pIRGvFR.exe
  2⤵
  PID:6096
- C:\Windows\System\XUbHgxV.exe
  C:\Windows\System\XUbHgxV.exe
  2⤵
  PID:6124
- C:\Windows\System\wjjbUQK.exe
  C:\Windows\System\wjjbUQK.exe
  2⤵
  PID:4996
- C:\Windows\System\cehmELi.exe
  C:\Windows\System\cehmELi.exe
  2⤵
  PID:4448
- C:\Windows\System\NKAeVmV.exe
  C:\Windows\System\NKAeVmV.exe
  2⤵
  PID:2980
- C:\Windows\System\mUwVvaZ.exe
  C:\Windows\System\mUwVvaZ.exe
  2⤵
  PID:2284
- C:\Windows\System\DYhJihJ.exe
  C:\Windows\System\DYhJihJ.exe
  2⤵
  PID:5164
- C:\Windows\System\MPquILh.exe
  C:\Windows\System\MPquILh.exe
  2⤵
  PID:5224
- C:\Windows\System\yNZRsMu.exe
  C:\Windows\System\yNZRsMu.exe
  2⤵
  PID:5292
- C:\Windows\System\FrLnDwn.exe
  C:\Windows\System\FrLnDwn.exe
  2⤵
  PID:5348
- C:\Windows\System\NIzEsbT.exe
  C:\Windows\System\NIzEsbT.exe
  2⤵
  PID:5376
- C:\Windows\System\QBcGMVa.exe
  C:\Windows\System\QBcGMVa.exe
  2⤵
  PID:4508
- C:\Windows\System\UINqMGz.exe
  C:\Windows\System\UINqMGz.exe
  2⤵
  PID:5576
- C:\Windows\System\QZqzTlk.exe
  C:\Windows\System\QZqzTlk.exe
  2⤵
  PID:3700
- C:\Windows\System\zCPlCbN.exe
  C:\Windows\System\zCPlCbN.exe
  2⤵
  PID:5640
- C:\Windows\System\QImDrVg.exe
  C:\Windows\System\QImDrVg.exe
  2⤵
  PID:5688
- C:\Windows\System\TsTNcSs.exe
  C:\Windows\System\TsTNcSs.exe
  2⤵
  PID:5720
- C:\Windows\System\UCYoGHd.exe
  C:\Windows\System\UCYoGHd.exe
  2⤵
  PID:5756
- C:\Windows\System\lMlqKXs.exe
  C:\Windows\System\lMlqKXs.exe
  2⤵
  PID:5812
- C:\Windows\System\pOSMbuj.exe
  C:\Windows\System\pOSMbuj.exe
  2⤵
  PID:5840
- C:\Windows\System\kvnjIsz.exe
  C:\Windows\System\kvnjIsz.exe
  2⤵
  PID:5884
- C:\Windows\System\FIPoHoy.exe
  C:\Windows\System\FIPoHoy.exe
  2⤵
  PID:5920
- C:\Windows\System\CACrSdP.exe
  C:\Windows\System\CACrSdP.exe
  2⤵
  PID:2172
- C:\Windows\System\vHSgaot.exe
  C:\Windows\System\vHSgaot.exe
  2⤵
  PID:6004
- C:\Windows\System\UZVyTuI.exe
  C:\Windows\System\UZVyTuI.exe
  2⤵
  PID:6064
- C:\Windows\System\JXqVeUK.exe
  C:\Windows\System\JXqVeUK.exe
  2⤵
  PID:6088
- C:\Windows\System\nfoHEjc.exe
  C:\Windows\System\nfoHEjc.exe
  2⤵
  PID:6112
- C:\Windows\System\pVCnHyn.exe
  C:\Windows\System\pVCnHyn.exe
  2⤵
  PID:1712
- C:\Windows\System\gOZhSIO.exe
  C:\Windows\System\gOZhSIO.exe
  2⤵
  PID:3204
- C:\Windows\System\HELTojc.exe
  C:\Windows\System\HELTojc.exe
  2⤵
  PID:2708
- C:\Windows\System\fuTovwE.exe
  C:\Windows\System\fuTovwE.exe
  2⤵
  PID:5156
- C:\Windows\System\DeORMQa.exe
  C:\Windows\System\DeORMQa.exe
  2⤵
  PID:3084
- C:\Windows\System\pCqHpEu.exe
  C:\Windows\System\pCqHpEu.exe
  2⤵
  PID:5248
- C:\Windows\System\cRLaerr.exe
  C:\Windows\System\cRLaerr.exe
  2⤵
  PID:5316
- C:\Windows\System\NJlCNKT.exe
  C:\Windows\System\NJlCNKT.exe
  2⤵
  PID:2760
- C:\Windows\System\nlwKOnx.exe
  C:\Windows\System\nlwKOnx.exe
  2⤵
  PID:5464
- C:\Windows\System\ltsPFON.exe
  C:\Windows\System\ltsPFON.exe
  2⤵
  PID:1504
- C:\Windows\System\hoxpeFe.exe
  C:\Windows\System\hoxpeFe.exe
  2⤵
  PID:5752
- C:\Windows\System\WXPyULz.exe
  C:\Windows\System\WXPyULz.exe
  2⤵
  PID:5212
- C:\Windows\System\OHJPqsN.exe
  C:\Windows\System\OHJPqsN.exe
  2⤵
  PID:3984
- C:\Windows\System\QqnChwd.exe
  C:\Windows\System\QqnChwd.exe
  2⤵
  PID:2008
- C:\Windows\System\YjHuZkQ.exe
  C:\Windows\System\YjHuZkQ.exe
  2⤵
  PID:5492
- C:\Windows\System\VhatoVJ.exe
  C:\Windows\System\VhatoVJ.exe
  2⤵
  PID:5136
- C:\Windows\System\LWvFLlc.exe
  C:\Windows\System\LWvFLlc.exe
  2⤵
  PID:64
- C:\Windows\System\tfYfREb.exe
  C:\Windows\System\tfYfREb.exe
  2⤵
  PID:5060
- C:\Windows\System\iUSXdUg.exe
  C:\Windows\System\iUSXdUg.exe
  2⤵
  PID:3624
- C:\Windows\System\YhdmHRd.exe
  C:\Windows\System\YhdmHRd.exe
  2⤵
  PID:5440
- C:\Windows\System\xhHqPrb.exe
  C:\Windows\System\xhHqPrb.exe
  2⤵
  PID:4800
- C:\Windows\System\WNqNwSs.exe
  C:\Windows\System\WNqNwSs.exe
  2⤵
  PID:6172
- C:\Windows\System\sVlfyRB.exe
  C:\Windows\System\sVlfyRB.exe
  2⤵
  PID:6212
- C:\Windows\System\nniPngN.exe
  C:\Windows\System\nniPngN.exe
  2⤵
  PID:6240
- C:\Windows\System\svAIaqe.exe
  C:\Windows\System\svAIaqe.exe
  2⤵
  PID:6256
- C:\Windows\System\HObQJqY.exe
  C:\Windows\System\HObQJqY.exe
  2⤵
  PID:6276
- C:\Windows\System\iavTcHH.exe
  C:\Windows\System\iavTcHH.exe
  2⤵
  PID:6296
- C:\Windows\System\cPdvmHE.exe
  C:\Windows\System\cPdvmHE.exe
  2⤵
  PID:6312
- C:\Windows\System\gAVzKoZ.exe
  C:\Windows\System\gAVzKoZ.exe
  2⤵
  PID:6336
- C:\Windows\System\pAtLnaw.exe
  C:\Windows\System\pAtLnaw.exe
  2⤵
  PID:6360
- C:\Windows\System\uRzxdAB.exe
  C:\Windows\System\uRzxdAB.exe
  2⤵
  PID:6424
- C:\Windows\System\PeBbwMx.exe
  C:\Windows\System\PeBbwMx.exe
  2⤵
  PID:6444
- C:\Windows\System\bkSjjag.exe
  C:\Windows\System\bkSjjag.exe
  2⤵
  PID:6468
- C:\Windows\System\WOSGKUF.exe
  C:\Windows\System\WOSGKUF.exe
  2⤵
  PID:6488
- C:\Windows\System\QiDWIyJ.exe
  C:\Windows\System\QiDWIyJ.exe
  2⤵
  PID:6512
- C:\Windows\System\MhwMHUw.exe
  C:\Windows\System\MhwMHUw.exe
  2⤵
  PID:6528
- C:\Windows\System\ufXVCtC.exe
  C:\Windows\System\ufXVCtC.exe
  2⤵
  PID:6548
- C:\Windows\System\sEtCQyy.exe
  C:\Windows\System\sEtCQyy.exe
  2⤵
  PID:6584
- C:\Windows\System\FPtwvPZ.exe
  C:\Windows\System\FPtwvPZ.exe
  2⤵
  PID:6600
- C:\Windows\System\vQHzyUi.exe
  C:\Windows\System\vQHzyUi.exe
  2⤵
  PID:6628
- C:\Windows\System\DShINLh.exe
  C:\Windows\System\DShINLh.exe
  2⤵
  PID:6656
- C:\Windows\System\HQYudPN.exe
  C:\Windows\System\HQYudPN.exe
  2⤵
  PID:6728
- C:\Windows\System\eVHrrNC.exe
  C:\Windows\System\eVHrrNC.exe
  2⤵
  PID:6744
- C:\Windows\System\imXkIzR.exe
  C:\Windows\System\imXkIzR.exe
  2⤵
  PID:6776
- C:\Windows\System\OHTZEts.exe
  C:\Windows\System\OHTZEts.exe
  2⤵
  PID:6796
- C:\Windows\System\CrusQGh.exe
  C:\Windows\System\CrusQGh.exe
  2⤵
  PID:6816
- C:\Windows\System\mjIKUks.exe
  C:\Windows\System\mjIKUks.exe
  2⤵
  PID:6852
- C:\Windows\System\OZgPbxN.exe
  C:\Windows\System\OZgPbxN.exe
  2⤵
  PID:6896
- C:\Windows\System\wdxTcrI.exe
  C:\Windows\System\wdxTcrI.exe
  2⤵
  PID:6964
- C:\Windows\System\lUQSnIW.exe
  C:\Windows\System\lUQSnIW.exe
  2⤵
  PID:6984
- C:\Windows\System\RjhtTHP.exe
  C:\Windows\System\RjhtTHP.exe
  2⤵
  PID:7004
- C:\Windows\System\PbMgJjJ.exe
  C:\Windows\System\PbMgJjJ.exe
  2⤵
  PID:7032
- C:\Windows\System\ImIzITN.exe
  C:\Windows\System\ImIzITN.exe
  2⤵
  PID:7052
- C:\Windows\System\NIMDPwN.exe
  C:\Windows\System\NIMDPwN.exe
  2⤵
  PID:7104
- C:\Windows\System\lNjWKdI.exe
  C:\Windows\System\lNjWKdI.exe
  2⤵
  PID:7132
- C:\Windows\System\AAEjmPp.exe
  C:\Windows\System\AAEjmPp.exe
  2⤵
  PID:7148
- C:\Windows\System\NLhsPFY.exe
  C:\Windows\System\NLhsPFY.exe
  2⤵
  PID:3292
- C:\Windows\System\qHZKSgD.exe
  C:\Windows\System\qHZKSgD.exe
  2⤵
  PID:6156
- C:\Windows\System\fUOXjvl.exe
  C:\Windows\System\fUOXjvl.exe
  2⤵
  PID:6264
- C:\Windows\System\nFBDWUr.exe
  C:\Windows\System\nFBDWUr.exe
  2⤵
  PID:6204
- C:\Windows\System\EwAJjbW.exe
  C:\Windows\System\EwAJjbW.exe
  2⤵
  PID:6328
- C:\Windows\System\gVJQvll.exe
  C:\Windows\System\gVJQvll.exe
  2⤵
  PID:6464
- C:\Windows\System\DxYkHXi.exe
  C:\Windows\System\DxYkHXi.exe
  2⤵
  PID:6384
- C:\Windows\System\ueuyNzG.exe
  C:\Windows\System\ueuyNzG.exe
  2⤵
  PID:6592
- C:\Windows\System\TbkMwbM.exe
  C:\Windows\System\TbkMwbM.exe
  2⤵
  PID:6612
- C:\Windows\System\OWbhjdf.exe
  C:\Windows\System\OWbhjdf.exe
  2⤵
  PID:6404
- C:\Windows\System\BVgZKUr.exe
  C:\Windows\System\BVgZKUr.exe
  2⤵
  PID:6644
- C:\Windows\System\ZmIjarK.exe
  C:\Windows\System\ZmIjarK.exe
  2⤵
  PID:6788
- C:\Windows\System\KvqlbqH.exe
  C:\Windows\System\KvqlbqH.exe
  2⤵
  PID:6720
- C:\Windows\System\xSYFUJC.exe
  C:\Windows\System\xSYFUJC.exe
  2⤵
  PID:6760
- C:\Windows\System\yudAmTU.exe
  C:\Windows\System\yudAmTU.exe
  2⤵
  PID:6936
- C:\Windows\System\mflZHDM.exe
  C:\Windows\System\mflZHDM.exe
  2⤵
  PID:6972
- C:\Windows\System\GnhnzdO.exe
  C:\Windows\System\GnhnzdO.exe
  2⤵
  PID:7124
- C:\Windows\System\UptrqaH.exe
  C:\Windows\System\UptrqaH.exe
  2⤵
  PID:3488
- C:\Windows\System\GHhrUDh.exe
  C:\Windows\System\GHhrUDh.exe
  2⤵
  PID:6200
- C:\Windows\System\FCZpboY.exe
  C:\Windows\System\FCZpboY.exe
  2⤵
  PID:6596
- C:\Windows\System\DzxAibk.exe
  C:\Windows\System\DzxAibk.exe
  2⤵
  PID:6784
- C:\Windows\System\HRUgBAu.exe
  C:\Windows\System\HRUgBAu.exe
  2⤵
  PID:6824
- C:\Windows\System\POrvggE.exe
  C:\Windows\System\POrvggE.exe
  2⤵
  PID:6996
- C:\Windows\System\qUEVEie.exe
  C:\Windows\System\qUEVEie.exe
  2⤵
  PID:7016
- C:\Windows\System\NJPgJwp.exe
  C:\Windows\System\NJPgJwp.exe
  2⤵
  PID:7072
- C:\Windows\System\doqiraO.exe
  C:\Windows\System\doqiraO.exe
  2⤵
  PID:6524
- C:\Windows\System\yKQwlDz.exe
  C:\Windows\System\yKQwlDz.exe
  2⤵
  PID:6764
- C:\Windows\System\BxsDVto.exe
  C:\Windows\System\BxsDVto.exe
  2⤵
  PID:7176
- C:\Windows\System\itqKypi.exe
  C:\Windows\System\itqKypi.exe
  2⤵
  PID:7192
- C:\Windows\System\mRVwxhA.exe
  C:\Windows\System\mRVwxhA.exe
  2⤵
  PID:7224
- C:\Windows\System\dBAuvNm.exe
  C:\Windows\System\dBAuvNm.exe
  2⤵
  PID:7248
- C:\Windows\System\AjEGUEO.exe
  C:\Windows\System\AjEGUEO.exe
  2⤵
  PID:7268
- C:\Windows\System\QmHwzHg.exe
  C:\Windows\System\QmHwzHg.exe
  2⤵
  PID:7312
- C:\Windows\System\dwOIxRy.exe
  C:\Windows\System\dwOIxRy.exe
  2⤵
  PID:7336
- C:\Windows\System\MpzDNew.exe
  C:\Windows\System\MpzDNew.exe
  2⤵
  PID:7352
- C:\Windows\System\hCkvKsE.exe
  C:\Windows\System\hCkvKsE.exe
  2⤵
  PID:7384
- C:\Windows\System\ztNzqJL.exe
  C:\Windows\System\ztNzqJL.exe
  2⤵
  PID:7404
- C:\Windows\System\RdBMrTO.exe
  C:\Windows\System\RdBMrTO.exe
  2⤵
  PID:7432
- C:\Windows\System\WHzqsXD.exe
  C:\Windows\System\WHzqsXD.exe
  2⤵
  PID:7500
- C:\Windows\System\vnQPWMK.exe
  C:\Windows\System\vnQPWMK.exe
  2⤵
  PID:7548
- C:\Windows\System\aiGWmQA.exe
  C:\Windows\System\aiGWmQA.exe
  2⤵
  PID:7568
- C:\Windows\System\fRDWneC.exe
  C:\Windows\System\fRDWneC.exe
  2⤵
  PID:7588
- C:\Windows\System\ZzDzTRN.exe
  C:\Windows\System\ZzDzTRN.exe
  2⤵
  PID:7620
- C:\Windows\System\fAfJVsl.exe
  C:\Windows\System\fAfJVsl.exe
  2⤵
  PID:7668
- C:\Windows\System\WBklDeo.exe
  C:\Windows\System\WBklDeo.exe
  2⤵
  PID:7684
- C:\Windows\System\GzkBBwl.exe
  C:\Windows\System\GzkBBwl.exe
  2⤵
  PID:7708
- C:\Windows\System\fuKWPpr.exe
  C:\Windows\System\fuKWPpr.exe
  2⤵
  PID:7736
- C:\Windows\System\jqydzqb.exe
  C:\Windows\System\jqydzqb.exe
  2⤵
  PID:7760
- C:\Windows\System\aYCNjwH.exe
  C:\Windows\System\aYCNjwH.exe
  2⤵
  PID:7780
- C:\Windows\System\ffXnYTJ.exe
  C:\Windows\System\ffXnYTJ.exe
  2⤵
  PID:7804
- C:\Windows\System\IiYGmqT.exe
  C:\Windows\System\IiYGmqT.exe
  2⤵
  PID:7832
- C:\Windows\System\nPFDjSr.exe
  C:\Windows\System\nPFDjSr.exe
  2⤵
  PID:7884
- C:\Windows\System\tnftrqm.exe
  C:\Windows\System\tnftrqm.exe
  2⤵
  PID:7904
- C:\Windows\System\pQDqxAn.exe
  C:\Windows\System\pQDqxAn.exe
  2⤵
  PID:7928
- C:\Windows\System\SFqYOon.exe
  C:\Windows\System\SFqYOon.exe
  2⤵
  PID:7948
- C:\Windows\System\LKXHoCv.exe
  C:\Windows\System\LKXHoCv.exe
  2⤵
  PID:7972
- C:\Windows\System\qrnAemA.exe
  C:\Windows\System\qrnAemA.exe
  2⤵
  PID:8012
- C:\Windows\System\wJxgdoS.exe
  C:\Windows\System\wJxgdoS.exe
  2⤵
  PID:8032
- C:\Windows\System\ARaoXMV.exe
  C:\Windows\System\ARaoXMV.exe
  2⤵
  PID:8064
- C:\Windows\System\OHVSSEX.exe
  C:\Windows\System\OHVSSEX.exe
  2⤵
  PID:8112
- C:\Windows\System\eRNopdF.exe
  C:\Windows\System\eRNopdF.exe
  2⤵
  PID:8136
- C:\Windows\System\Iwuoabd.exe
  C:\Windows\System\Iwuoabd.exe
  2⤵
  PID:8168
- C:\Windows\System\FbJRUvC.exe
  C:\Windows\System\FbJRUvC.exe
  2⤵
  PID:6164
- C:\Windows\System\sVxheNX.exe
  C:\Windows\System\sVxheNX.exe
  2⤵
  PID:7188
- C:\Windows\System\MwVggwj.exe
  C:\Windows\System\MwVggwj.exe
  2⤵
  PID:7220
- C:\Windows\System\ZlNfHKP.exe
  C:\Windows\System\ZlNfHKP.exe
  2⤵
  PID:7368
- C:\Windows\System\upXLehI.exe
  C:\Windows\System\upXLehI.exe
  2⤵
  PID:7396
- C:\Windows\System\kVgjiQU.exe
  C:\Windows\System\kVgjiQU.exe
  2⤵
  PID:7424
- C:\Windows\System\pxoYXSL.exe
  C:\Windows\System\pxoYXSL.exe
  2⤵
  PID:7480
- C:\Windows\System\MzVlXNp.exe
  C:\Windows\System\MzVlXNp.exe
  2⤵
  PID:7460
- C:\Windows\System\FrxOReX.exe
  C:\Windows\System\FrxOReX.exe
  2⤵
  PID:7556
- C:\Windows\System\rdbqMqI.exe
  C:\Windows\System\rdbqMqI.exe
  2⤵
  PID:7676
- C:\Windows\System\HAmBFBj.exe
  C:\Windows\System\HAmBFBj.exe
  2⤵
  PID:7728
- C:\Windows\System\hZCIMgH.exe
  C:\Windows\System\hZCIMgH.exe
  2⤵
  PID:7828
- C:\Windows\System\UDQcMJq.exe
  C:\Windows\System\UDQcMJq.exe
  2⤵
  PID:7880
- C:\Windows\System\OQxVbbf.exe
  C:\Windows\System\OQxVbbf.exe
  2⤵
  PID:7924
- C:\Windows\System\jsolCeX.exe
  C:\Windows\System\jsolCeX.exe
  2⤵
  PID:7964
- C:\Windows\System\JodmTDz.exe
  C:\Windows\System\JodmTDz.exe
  2⤵
  PID:8072
- C:\Windows\System\nmGdKwf.exe
  C:\Windows\System\nmGdKwf.exe
  2⤵
  PID:8096
- C:\Windows\System\xxSKzOg.exe
  C:\Windows\System\xxSKzOg.exe
  2⤵
  PID:8156
- C:\Windows\System\VXVclsN.exe
  C:\Windows\System\VXVclsN.exe
  2⤵
  PID:6320
- C:\Windows\System\AXxOHaN.exe
  C:\Windows\System\AXxOHaN.exe
  2⤵
  PID:7216
- C:\Windows\System\QGLPcrY.exe
  C:\Windows\System\QGLPcrY.exe
  2⤵
  PID:7608
- C:\Windows\System\mgMHrmj.exe
  C:\Windows\System\mgMHrmj.exe
  2⤵
  PID:7512
- C:\Windows\System\hgsDJte.exe
  C:\Windows\System\hgsDJte.exe
  2⤵
  PID:7616
- C:\Windows\System\eHhCjoF.exe
  C:\Windows\System\eHhCjoF.exe
  2⤵
  PID:7856
- C:\Windows\System\ssGfNte.exe
  C:\Windows\System\ssGfNte.exe
  2⤵
  PID:7920
- C:\Windows\System\EUMKbRO.exe
  C:\Windows\System\EUMKbRO.exe
  2⤵
  PID:8044
- C:\Windows\System\pvXHtLR.exe
  C:\Windows\System\pvXHtLR.exe
  2⤵
  PID:8132
- C:\Windows\System\XpOeMYm.exe
  C:\Windows\System\XpOeMYm.exe
  2⤵
  PID:7416
- C:\Windows\System\DNMWAZp.exe
  C:\Windows\System\DNMWAZp.exe
  2⤵
  PID:7580
- C:\Windows\System\SELXgaN.exe
  C:\Windows\System\SELXgaN.exe
  2⤵
  PID:7860
- C:\Windows\System\YGMJwus.exe
  C:\Windows\System\YGMJwus.exe
  2⤵
  PID:8232
- C:\Windows\System\CcJfzwH.exe
  C:\Windows\System\CcJfzwH.exe
  2⤵
  PID:8272
- C:\Windows\System\McjEVxg.exe
  C:\Windows\System\McjEVxg.exe
  2⤵
  PID:8296
- C:\Windows\System\nxMsDQI.exe
  C:\Windows\System\nxMsDQI.exe
  2⤵
  PID:8324
- C:\Windows\System\vwvHtAh.exe
  C:\Windows\System\vwvHtAh.exe
  2⤵
  PID:8344
- C:\Windows\System\NoXyPzI.exe
  C:\Windows\System\NoXyPzI.exe
  2⤵
  PID:8368
- C:\Windows\System\gFVUFTR.exe
  C:\Windows\System\gFVUFTR.exe
  2⤵
  PID:8392
- C:\Windows\System\RvMSTaD.exe
  C:\Windows\System\RvMSTaD.exe
  2⤵
  PID:8412
- C:\Windows\System\bXIMiJg.exe
  C:\Windows\System\bXIMiJg.exe
  2⤵
  PID:8432
- C:\Windows\System\JlFRsWq.exe
  C:\Windows\System\JlFRsWq.exe
  2⤵
  PID:8488
- C:\Windows\System\lnaxtHA.exe
  C:\Windows\System\lnaxtHA.exe
  2⤵
  PID:8508
- C:\Windows\System\wlGHXGi.exe
  C:\Windows\System\wlGHXGi.exe
  2⤵
  PID:8548
- C:\Windows\System\QauRSiO.exe
  C:\Windows\System\QauRSiO.exe
  2⤵
  PID:8572
- C:\Windows\System\hCuPcnD.exe
  C:\Windows\System\hCuPcnD.exe
  2⤵
  PID:8620
- C:\Windows\System\uFWJsfE.exe
  C:\Windows\System\uFWJsfE.exe
  2⤵
  PID:8644
- C:\Windows\System\OtGJMIh.exe
  C:\Windows\System\OtGJMIh.exe
  2⤵
  PID:8664
- C:\Windows\System\ndymjhL.exe
  C:\Windows\System\ndymjhL.exe
  2⤵
  PID:8680
- C:\Windows\System\HQDAnum.exe
  C:\Windows\System\HQDAnum.exe
  2⤵
  PID:8708
- C:\Windows\System\njUTEkH.exe
  C:\Windows\System\njUTEkH.exe
  2⤵
  PID:8736
- C:\Windows\System\IQSpfHT.exe
  C:\Windows\System\IQSpfHT.exe
  2⤵
  PID:8764
- C:\Windows\System\XCrJmKP.exe
  C:\Windows\System\XCrJmKP.exe
  2⤵
  PID:8816
- C:\Windows\System\njISnSJ.exe
  C:\Windows\System\njISnSJ.exe
  2⤵
  PID:8848
- C:\Windows\System\jnXfAOA.exe
  C:\Windows\System\jnXfAOA.exe
  2⤵
  PID:8864
- C:\Windows\System\gqIBMKz.exe
  C:\Windows\System\gqIBMKz.exe
  2⤵
  PID:8900
- C:\Windows\System\OgQbuxA.exe
  C:\Windows\System\OgQbuxA.exe
  2⤵
  PID:8920
- C:\Windows\System\THFsEGb.exe
  C:\Windows\System\THFsEGb.exe
  2⤵
  PID:8940
- C:\Windows\System\ROLyNNE.exe
  C:\Windows\System\ROLyNNE.exe
  2⤵
  PID:8960
- C:\Windows\System\xholxZS.exe
  C:\Windows\System\xholxZS.exe
  2⤵
  PID:8988
- C:\Windows\System\QYVZsRX.exe
  C:\Windows\System\QYVZsRX.exe
  2⤵
  PID:9004
- C:\Windows\System\IvBwOaC.exe
  C:\Windows\System\IvBwOaC.exe
  2⤵
  PID:9044
- C:\Windows\System\cdypRLX.exe
  C:\Windows\System\cdypRLX.exe
  2⤵
  PID:9064
- C:\Windows\System\BROEjJD.exe
  C:\Windows\System\BROEjJD.exe
  2⤵
  PID:9088
- C:\Windows\System\kgfXAZm.exe
  C:\Windows\System\kgfXAZm.exe
  2⤵
  PID:9108
- C:\Windows\System\VWvBvWO.exe
  C:\Windows\System\VWvBvWO.exe
  2⤵
  PID:9176
- C:\Windows\System\FwgfSiJ.exe
  C:\Windows\System\FwgfSiJ.exe
  2⤵
  PID:9200
- C:\Windows\System\dSEWNJJ.exe
  C:\Windows\System\dSEWNJJ.exe
  2⤵
  PID:7348
- C:\Windows\System\bvJXGnt.exe
  C:\Windows\System\bvJXGnt.exe
  2⤵
  PID:8312
- C:\Windows\System\dKwhTsj.exe
  C:\Windows\System\dKwhTsj.exe
  2⤵
  PID:8380
- C:\Windows\System\yrBRUhn.exe
  C:\Windows\System\yrBRUhn.exe
  2⤵
  PID:8424
- C:\Windows\System\PIXGMLg.exe
  C:\Windows\System\PIXGMLg.exe
  2⤵
  PID:8404
- C:\Windows\System\gjqceLV.exe
  C:\Windows\System\gjqceLV.exe
  2⤵
  PID:8516
- C:\Windows\System\XRCxxKu.exe
  C:\Windows\System\XRCxxKu.exe
  2⤵
  PID:8544
- C:\Windows\System\mmbQxrD.exe
  C:\Windows\System\mmbQxrD.exe
  2⤵
  PID:8580
- C:\Windows\System\cONPfIT.exe
  C:\Windows\System\cONPfIT.exe
  2⤵
  PID:8640
- C:\Windows\System\HAIaIPM.exe
  C:\Windows\System\HAIaIPM.exe
  2⤵
  PID:8728
- C:\Windows\System\aGskXvk.exe
  C:\Windows\System\aGskXvk.exe
  2⤵
  PID:8812
- C:\Windows\System\QluOqsq.exe
  C:\Windows\System\QluOqsq.exe
  2⤵
  PID:8892
- C:\Windows\System\egPDZzB.exe
  C:\Windows\System\egPDZzB.exe
  2⤵
  PID:8996
- C:\Windows\System\opEcfoU.exe
  C:\Windows\System\opEcfoU.exe
  2⤵
  PID:8956
- C:\Windows\System\cQnDcxH.exe
  C:\Windows\System\cQnDcxH.exe
  2⤵
  PID:9072
- C:\Windows\System\rcUqIFA.exe
  C:\Windows\System\rcUqIFA.exe
  2⤵
  PID:9144
- C:\Windows\System\xjmZrhh.exe
  C:\Windows\System\xjmZrhh.exe
  2⤵
  PID:8336
- C:\Windows\System\eNCYloW.exe
  C:\Windows\System\eNCYloW.exe
  2⤵
  PID:8360
- C:\Windows\System\RgPFjDr.exe
  C:\Windows\System\RgPFjDr.exe
  2⤵
  PID:8588
- C:\Windows\System\wSDdkyb.exe
  C:\Windows\System\wSDdkyb.exe
  2⤵
  PID:8732
- C:\Windows\System\aMaWsco.exe
  C:\Windows\System\aMaWsco.exe
  2⤵
  PID:8876
- C:\Windows\System\MdkUDil.exe
  C:\Windows\System\MdkUDil.exe
  2⤵
  PID:8932
- C:\Windows\System\kkSfCJS.exe
  C:\Windows\System\kkSfCJS.exe
  2⤵
  PID:9104
- C:\Windows\System\VwqOGyK.exe
  C:\Windows\System\VwqOGyK.exe
  2⤵
  PID:8420
- C:\Windows\System\fgbNuQO.exe
  C:\Windows\System\fgbNuQO.exe
  2⤵
  PID:9260
- C:\Windows\System\ITKWmuG.exe
  C:\Windows\System\ITKWmuG.exe
  2⤵
  PID:9328
- C:\Windows\System\ROFBNrK.exe
  C:\Windows\System\ROFBNrK.exe
  2⤵
  PID:9344
- C:\Windows\System\mUCJOKL.exe
  C:\Windows\System\mUCJOKL.exe
  2⤵
  PID:9360
- C:\Windows\System\ahbvAEY.exe
  C:\Windows\System\ahbvAEY.exe
  2⤵
  PID:9376
- C:\Windows\System\LgvgxdT.exe
  C:\Windows\System\LgvgxdT.exe
  2⤵
  PID:9392
- C:\Windows\System\gBFGGzL.exe
  C:\Windows\System\gBFGGzL.exe
  2⤵
  PID:9408
- C:\Windows\System\riGJIfl.exe
  C:\Windows\System\riGJIfl.exe
  2⤵
  PID:9428
- C:\Windows\System\vaKHBZm.exe
  C:\Windows\System\vaKHBZm.exe
  2⤵
  PID:9444
- C:\Windows\System\RcXjEeL.exe
  C:\Windows\System\RcXjEeL.exe
  2⤵
  PID:9464
- C:\Windows\System\hcvtFMW.exe
  C:\Windows\System\hcvtFMW.exe
  2⤵
  PID:9480
- C:\Windows\System\FdErRzK.exe
  C:\Windows\System\FdErRzK.exe
  2⤵
  PID:9496
- C:\Windows\System\ALvheQH.exe
  C:\Windows\System\ALvheQH.exe
  2⤵
  PID:9512
- C:\Windows\System\cyVslfK.exe
  C:\Windows\System\cyVslfK.exe
  2⤵
  PID:9532
- C:\Windows\System\PriWulx.exe
  C:\Windows\System\PriWulx.exe
  2⤵
  PID:9592
- C:\Windows\System\AGSZfEv.exe
  C:\Windows\System\AGSZfEv.exe
  2⤵
  PID:9616
- C:\Windows\System\vQxyXjK.exe
  C:\Windows\System\vQxyXjK.exe
  2⤵
  PID:9680
- C:\Windows\System\hNmHvpC.exe
  C:\Windows\System\hNmHvpC.exe
  2⤵
  PID:9704
- C:\Windows\System\cXrWvXD.exe
  C:\Windows\System\cXrWvXD.exe
  2⤵
  PID:9772
- C:\Windows\System\RErRJnI.exe
  C:\Windows\System\RErRJnI.exe
  2⤵
  PID:9844
- C:\Windows\System\ktelocv.exe
  C:\Windows\System\ktelocv.exe
  2⤵
  PID:9864
- C:\Windows\System\VwAKKrG.exe
  C:\Windows\System\VwAKKrG.exe
  2⤵
  PID:9896
- C:\Windows\System\IAHfjxt.exe
  C:\Windows\System\IAHfjxt.exe
  2⤵
  PID:9916
- C:\Windows\System\PiaMnPh.exe
  C:\Windows\System\PiaMnPh.exe
  2⤵
  PID:9956
- C:\Windows\System\mTtOurM.exe
  C:\Windows\System\mTtOurM.exe
  2⤵
  PID:9980
- C:\Windows\System\ACfpiQB.exe
  C:\Windows\System\ACfpiQB.exe
  2⤵
  PID:10004
- C:\Windows\System\BTzDsXV.exe
  C:\Windows\System\BTzDsXV.exe
  2⤵
  PID:10032
- C:\Windows\System\PiQhpUi.exe
  C:\Windows\System\PiQhpUi.exe
  2⤵
  PID:10052
- C:\Windows\System\YLKXaWh.exe
  C:\Windows\System\YLKXaWh.exe
  2⤵
  PID:10076
- C:\Windows\System\gCUbPXr.exe
  C:\Windows\System\gCUbPXr.exe
  2⤵
  PID:10120
- C:\Windows\System\EeeVHpR.exe
  C:\Windows\System\EeeVHpR.exe
  2⤵
  PID:10136
- C:\Windows\System\MlVvJPT.exe
  C:\Windows\System\MlVvJPT.exe
  2⤵
  PID:10160
- C:\Windows\System\FnvhFek.exe
  C:\Windows\System\FnvhFek.exe
  2⤵
  PID:10180
- C:\Windows\System\tMPNodn.exe
  C:\Windows\System\tMPNodn.exe
  2⤵
  PID:10204
- C:\Windows\System\OpipaHO.exe
  C:\Windows\System\OpipaHO.exe
  2⤵
  PID:10220
- C:\Windows\System\NgHvKhW.exe
  C:\Windows\System\NgHvKhW.exe
  2⤵
  PID:8792
- C:\Windows\System\euEqiKp.exe
  C:\Windows\System\euEqiKp.exe
  2⤵
  PID:7204
- C:\Windows\System\PkAAvvT.exe
  C:\Windows\System\PkAAvvT.exe
  2⤵
  PID:9224
- C:\Windows\System\RSJmxmu.exe
  C:\Windows\System\RSJmxmu.exe
  2⤵
  PID:9336
- C:\Windows\System\jfHMOiH.exe
  C:\Windows\System\jfHMOiH.exe
  2⤵
  PID:9292
- C:\Windows\System\UYNbDAu.exe
  C:\Windows\System\UYNbDAu.exe
  2⤵
  PID:9316
- C:\Windows\System\BkVGlgB.exe
  C:\Windows\System\BkVGlgB.exe
  2⤵
  PID:9436
- C:\Windows\System\GVgdunb.exe
  C:\Windows\System\GVgdunb.exe
  2⤵
  PID:9644
- C:\Windows\System\LayVtoe.exe
  C:\Windows\System\LayVtoe.exe
  2⤵
  PID:9528
- C:\Windows\System\etnVHkJ.exe
  C:\Windows\System\etnVHkJ.exe
  2⤵
  PID:9580
- C:\Windows\System\YqGyhii.exe
  C:\Windows\System\YqGyhii.exe
  2⤵
  PID:9764
- C:\Windows\System\ZMSOgrG.exe
  C:\Windows\System\ZMSOgrG.exe
  2⤵
  PID:9820
- C:\Windows\System\asgVtEI.exe
  C:\Windows\System\asgVtEI.exe
  2⤵
  PID:9836
- C:\Windows\System\HLGjckF.exe
  C:\Windows\System\HLGjckF.exe
  2⤵
  PID:9928
- C:\Windows\System\CiGysqr.exe
  C:\Windows\System\CiGysqr.exe
  2⤵
  PID:10020
- C:\Windows\System\jXYpaMZ.exe
  C:\Windows\System\jXYpaMZ.exe
  2⤵
  PID:10048
- C:\Windows\System\tMeUmxV.exe
  C:\Windows\System\tMeUmxV.exe
  2⤵
  PID:10144
- C:\Windows\System\CAohXUS.exe
  C:\Windows\System\CAohXUS.exe
  2⤵
  PID:10228
- C:\Windows\System\vLugHOt.exe
  C:\Windows\System\vLugHOt.exe
  2⤵
  PID:10216
- C:\Windows\System\uYYHXUy.exe
  C:\Windows\System\uYYHXUy.exe
  2⤵
  PID:9296
- C:\Windows\System\GVSDbnT.exe
  C:\Windows\System\GVSDbnT.exe
  2⤵
  PID:9368
- C:\Windows\System\VXMZyOS.exe
  C:\Windows\System\VXMZyOS.exe
  2⤵
  PID:9244
- C:\Windows\System\SGPkKFV.exe
  C:\Windows\System\SGPkKFV.exe
  2⤵
  PID:9688
- C:\Windows\System\LbvPWkF.exe
  C:\Windows\System\LbvPWkF.exe
  2⤵
  PID:9856
- C:\Windows\System\BnCUrQD.exe
  C:\Windows\System\BnCUrQD.exe
  2⤵
  PID:10068
- C:\Windows\System\efdLWOL.exe
  C:\Windows\System\efdLWOL.exe
  2⤵
  PID:10000
- C:\Windows\System\YfDDMNr.exe
  C:\Windows\System\YfDDMNr.exe
  2⤵
  PID:9628
- C:\Windows\System\sswwuWt.exe
  C:\Windows\System\sswwuWt.exe
  2⤵
  PID:9236
- C:\Windows\System\xXmdhcU.exe
  C:\Windows\System\xXmdhcU.exe
  2⤵
  PID:9924
- C:\Windows\System\bhHmjxf.exe
  C:\Windows\System\bhHmjxf.exe
  2⤵
  PID:10192
- C:\Windows\System\jiTIcWi.exe
  C:\Windows\System\jiTIcWi.exe
  2⤵
  PID:9504
- C:\Windows\System\ZNhxpme.exe
  C:\Windows\System\ZNhxpme.exe
  2⤵
  PID:9288
- C:\Windows\System\NsrqHNW.exe
  C:\Windows\System\NsrqHNW.exe
  2⤵
  PID:10264
- C:\Windows\System\VuiGpCh.exe
  C:\Windows\System\VuiGpCh.exe
  2⤵
  PID:10304
- C:\Windows\System\vOdWNLm.exe
  C:\Windows\System\vOdWNLm.exe
  2⤵
  PID:10320
- C:\Windows\System\aVAkDMi.exe
  C:\Windows\System\aVAkDMi.exe
  2⤵
  PID:10340
- C:\Windows\System\VrNDgFw.exe
  C:\Windows\System\VrNDgFw.exe
  2⤵
  PID:10360
- C:\Windows\System\IRWzjGP.exe
  C:\Windows\System\IRWzjGP.exe
  2⤵
  PID:10400
- C:\Windows\System\ebjeDdE.exe
  C:\Windows\System\ebjeDdE.exe
  2⤵
  PID:10416
- C:\Windows\System\fcMamvQ.exe
  C:\Windows\System\fcMamvQ.exe
  2⤵
  PID:10452
- C:\Windows\System\yaWcMJb.exe
  C:\Windows\System\yaWcMJb.exe
  2⤵
  PID:10472
- C:\Windows\System\emfEhHe.exe
  C:\Windows\System\emfEhHe.exe
  2⤵
  PID:10528
- C:\Windows\System\HBJYDcz.exe
  C:\Windows\System\HBJYDcz.exe
  2⤵
  PID:10544
- C:\Windows\System\RUeOJoW.exe
  C:\Windows\System\RUeOJoW.exe
  2⤵
  PID:10564
- C:\Windows\System\RMqwChM.exe
  C:\Windows\System\RMqwChM.exe
  2⤵
  PID:10584
- C:\Windows\System\OPvCbDn.exe
  C:\Windows\System\OPvCbDn.exe
  2⤵
  PID:10620
- C:\Windows\System\RqaCyEk.exe
  C:\Windows\System\RqaCyEk.exe
  2⤵
  PID:10636
- C:\Windows\System\IoqGxRw.exe
  C:\Windows\System\IoqGxRw.exe
  2⤵
  PID:10664
- C:\Windows\System\dLmjxKT.exe
  C:\Windows\System\dLmjxKT.exe
  2⤵
  PID:10712
- C:\Windows\System\ZQNgaFb.exe
  C:\Windows\System\ZQNgaFb.exe
  2⤵
  PID:10740
- C:\Windows\System\BJzOsgd.exe
  C:\Windows\System\BJzOsgd.exe
  2⤵
  PID:10764
- C:\Windows\System\QLvFMUS.exe
  C:\Windows\System\QLvFMUS.exe
  2⤵
  PID:10792
- C:\Windows\System\aMQQKza.exe
  C:\Windows\System\aMQQKza.exe
  2⤵
  PID:10820
- C:\Windows\System\muORBlx.exe
  C:\Windows\System\muORBlx.exe
  2⤵
  PID:10848
- C:\Windows\System\gYMljKS.exe
  C:\Windows\System\gYMljKS.exe
  2⤵
  PID:10868
- C:\Windows\System\kswtRvh.exe
  C:\Windows\System\kswtRvh.exe
  2⤵
  PID:10888
- C:\Windows\System\AxUFyhn.exe
  C:\Windows\System\AxUFyhn.exe
  2⤵
  PID:10956
- C:\Windows\System\bAxBAQq.exe
  C:\Windows\System\bAxBAQq.exe
  2⤵
  PID:10972
- C:\Windows\System\SUKwUcl.exe
  C:\Windows\System\SUKwUcl.exe
  2⤵
  PID:10992
- C:\Windows\System\UecqMpW.exe
  C:\Windows\System\UecqMpW.exe
  2⤵
  PID:11020
- C:\Windows\System\BYDkiqI.exe
  C:\Windows\System\BYDkiqI.exe
  2⤵
  PID:11044
- C:\Windows\System\SrRPMjj.exe
  C:\Windows\System\SrRPMjj.exe
  2⤵
  PID:11064
- C:\Windows\System\piVdIOK.exe
  C:\Windows\System\piVdIOK.exe
  2⤵
  PID:11088
- C:\Windows\System\ADiMpny.exe
  C:\Windows\System\ADiMpny.exe
  2⤵
  PID:11108
- C:\Windows\System\HRSnveE.exe
  C:\Windows\System\HRSnveE.exe
  2⤵
  PID:11144
- C:\Windows\System\nBNvVNh.exe
  C:\Windows\System\nBNvVNh.exe
  2⤵
  PID:11176
- C:\Windows\System\MReaJIU.exe
  C:\Windows\System\MReaJIU.exe
  2⤵
  PID:11204
- C:\Windows\System\cdfuUXk.exe
  C:\Windows\System\cdfuUXk.exe
  2⤵
  PID:11232
- C:\Windows\System\ZRyyfCj.exe
  C:\Windows\System\ZRyyfCj.exe
  2⤵
  PID:11248
- C:\Windows\System\QPxXFmA.exe
  C:\Windows\System\QPxXFmA.exe
  2⤵
  PID:10128
- C:\Windows\System\BohJuhS.exe
  C:\Windows\System\BohJuhS.exe
  2⤵
  PID:10288
- C:\Windows\System\YozHYCf.exe
  C:\Windows\System\YozHYCf.exe
  2⤵
  PID:10380
- C:\Windows\System\GNpqBWt.exe
  C:\Windows\System\GNpqBWt.exe
  2⤵
  PID:10500
- C:\Windows\System\cdjnjdd.exe
  C:\Windows\System\cdjnjdd.exe
  2⤵
  PID:10580
- C:\Windows\System\dCBOuZU.exe
  C:\Windows\System\dCBOuZU.exe
  2⤵
  PID:10608
- C:\Windows\System\CTSOzVY.exe
  C:\Windows\System\CTSOzVY.exe
  2⤵
  PID:10648
- C:\Windows\System\ptGertk.exe
  C:\Windows\System\ptGertk.exe
  2⤵
  PID:10720
- C:\Windows\System\XcdQhDo.exe
  C:\Windows\System\XcdQhDo.exe
  2⤵
  PID:10776
- C:\Windows\System\sCIWZKZ.exe
  C:\Windows\System\sCIWZKZ.exe
  2⤵
  PID:10836
- C:\Windows\System\eZecErS.exe
  C:\Windows\System\eZecErS.exe
  2⤵
  PID:10940
- C:\Windows\System\vsoZlal.exe
  C:\Windows\System\vsoZlal.exe
  2⤵
  PID:10964
- C:\Windows\System\waxyrBl.exe
  C:\Windows\System\waxyrBl.exe
  2⤵
  PID:11060
- C:\Windows\System\nyqVLFi.exe
  C:\Windows\System\nyqVLFi.exe
  2⤵
  PID:11160
- C:\Windows\System\jmysuYO.exe
  C:\Windows\System\jmysuYO.exe
  2⤵
  PID:11192
- C:\Windows\System\JcEnThl.exe
  C:\Windows\System\JcEnThl.exe
  2⤵
  PID:9232
- C:\Windows\System\PmoPEJr.exe
  C:\Windows\System\PmoPEJr.exe
  2⤵
  PID:10332
- C:\Windows\System\GOgwDeX.exe
  C:\Windows\System\GOgwDeX.exe
  2⤵
  PID:10536
- C:\Windows\System\DOhKgbL.exe
  C:\Windows\System\DOhKgbL.exe
  2⤵
  PID:10560
- C:\Windows\System\CwGZhMe.exe
  C:\Windows\System\CwGZhMe.exe
  2⤵
  PID:10700
- C:\Windows\System\wtLBFaB.exe
  C:\Windows\System\wtLBFaB.exe
  2⤵
  PID:10928
- C:\Windows\System\mlYXMLe.exe
  C:\Windows\System\mlYXMLe.exe
  2⤵
  PID:11212
- C:\Windows\System\omhJXRP.exe
  C:\Windows\System\omhJXRP.exe
  2⤵
  PID:10440
- C:\Windows\System\QwFQBjI.exe
  C:\Windows\System\QwFQBjI.exe
  2⤵
  PID:10628
- C:\Windows\System\wbBwMsw.exe
  C:\Windows\System\wbBwMsw.exe
  2⤵
  PID:8532
- C:\Windows\System\hHfeXfg.exe
  C:\Windows\System\hHfeXfg.exe
  2⤵
  PID:10632
- C:\Windows\System\ikgqPLO.exe
  C:\Windows\System\ikgqPLO.exe
  2⤵
  PID:11220
- C:\Windows\System\CZOdDDt.exe
  C:\Windows\System\CZOdDDt.exe
  2⤵
  PID:11288
- C:\Windows\System\AsJBTkF.exe
  C:\Windows\System\AsJBTkF.exe
  2⤵
  PID:11328
- C:\Windows\System\ENVFhnt.exe
  C:\Windows\System\ENVFhnt.exe
  2⤵
  PID:11360
- C:\Windows\System\fkcmYML.exe
  C:\Windows\System\fkcmYML.exe
  2⤵
  PID:11380
- C:\Windows\System\aOocdPB.exe
  C:\Windows\System\aOocdPB.exe
  2⤵
  PID:11404
- C:\Windows\System\qsVuwRl.exe
  C:\Windows\System\qsVuwRl.exe
  2⤵
  PID:11428
- C:\Windows\System\uEPQRcj.exe
  C:\Windows\System\uEPQRcj.exe
  2⤵
  PID:11444
- C:\Windows\System\JWEtqIr.exe
  C:\Windows\System\JWEtqIr.exe
  2⤵
  PID:11468
- C:\Windows\System\JvHOpWF.exe
  C:\Windows\System\JvHOpWF.exe
  2⤵
  PID:11488
- C:\Windows\System\ITvqurD.exe
  C:\Windows\System\ITvqurD.exe
  2⤵
  PID:11528
- C:\Windows\System\OgOXTQZ.exe
  C:\Windows\System\OgOXTQZ.exe
  2⤵
  PID:11576
- C:\Windows\System\RYbxmVx.exe
  C:\Windows\System\RYbxmVx.exe
  2⤵
  PID:11596
- C:\Windows\System\mseDGza.exe
  C:\Windows\System\mseDGza.exe
  2⤵
  PID:11624
- C:\Windows\System\PzDAxpA.exe
  C:\Windows\System\PzDAxpA.exe
  2⤵
  PID:11640
- C:\Windows\System\FOHbtkd.exe
  C:\Windows\System\FOHbtkd.exe
  2⤵
  PID:11680
- C:\Windows\System\VGPgbqJ.exe
  C:\Windows\System\VGPgbqJ.exe
  2⤵
  PID:11704
- C:\Windows\System\Vzvmgwr.exe
  C:\Windows\System\Vzvmgwr.exe
  2⤵
  PID:11728
- C:\Windows\System\pVpHEjU.exe
  C:\Windows\System\pVpHEjU.exe
  2⤵
  PID:11764
- C:\Windows\System\NqgBhrI.exe
  C:\Windows\System\NqgBhrI.exe
  2⤵
  PID:11780
- C:\Windows\System\uAnrhQx.exe
  C:\Windows\System\uAnrhQx.exe
  2⤵
  PID:11800
- C:\Windows\System\HVSozgs.exe
  C:\Windows\System\HVSozgs.exe
  2⤵
  PID:11828
- C:\Windows\System\KTxauaa.exe
  C:\Windows\System\KTxauaa.exe
  2⤵
  PID:11868
- C:\Windows\System\nhJkWis.exe
  C:\Windows\System\nhJkWis.exe
  2⤵
  PID:11896
- C:\Windows\System\ExXtFZp.exe
  C:\Windows\System\ExXtFZp.exe
  2⤵
  PID:11920
- C:\Windows\System\DMxvtRo.exe
  C:\Windows\System\DMxvtRo.exe
  2⤵
  PID:11952
- C:\Windows\System\VTkaYZk.exe
  C:\Windows\System\VTkaYZk.exe
  2⤵
  PID:11972
- C:\Windows\System\aXOXEzM.exe
  C:\Windows\System\aXOXEzM.exe
  2⤵
  PID:12016
- C:\Windows\System\UFBKlFw.exe
  C:\Windows\System\UFBKlFw.exe
  2⤵
  PID:12036
- C:\Windows\System\CdNNRZw.exe
  C:\Windows\System\CdNNRZw.exe
  2⤵
  PID:12076
- C:\Windows\System\zXsaWyG.exe
  C:\Windows\System\zXsaWyG.exe
  2⤵
  PID:12104
- C:\Windows\System\FGsZGPf.exe
  C:\Windows\System\FGsZGPf.exe
  2⤵
  PID:12136
- C:\Windows\System\javIDOi.exe
  C:\Windows\System\javIDOi.exe
  2⤵
  PID:12152
- C:\Windows\System\OqUBTFv.exe
  C:\Windows\System\OqUBTFv.exe
  2⤵
  PID:12184
- C:\Windows\System\fffAOYM.exe
  C:\Windows\System\fffAOYM.exe
  2⤵
  PID:12204
- C:\Windows\System\OCjmuwt.exe
  C:\Windows\System\OCjmuwt.exe
  2⤵
  PID:12228
- C:\Windows\System\HXxGAYo.exe
  C:\Windows\System\HXxGAYo.exe
  2⤵
  PID:12248
- C:\Windows\System\ypBecDx.exe
  C:\Windows\System\ypBecDx.exe
  2⤵
  PID:12276
- C:\Windows\System\MTeohby.exe
  C:\Windows\System\MTeohby.exe
  2⤵
  PID:11280
- C:\Windows\System\JfBrMeu.exe
  C:\Windows\System\JfBrMeu.exe
  2⤵
  PID:11420
- C:\Windows\System\nXvGmfH.exe
  C:\Windows\System\nXvGmfH.exe
  2⤵
  PID:11452
- C:\Windows\System\pFiWdGh.exe
  C:\Windows\System\pFiWdGh.exe
  2⤵
  PID:11540
- C:\Windows\System\BceFtzH.exe
  C:\Windows\System\BceFtzH.exe
  2⤵
  PID:11632
- C:\Windows\System\jiJDniW.exe
  C:\Windows\System\jiJDniW.exe
  2⤵
  PID:4248
- C:\Windows\System\Wbrtwnw.exe
  C:\Windows\System\Wbrtwnw.exe
  2⤵
  PID:11724
- C:\Windows\System\gpUzajW.exe
  C:\Windows\System\gpUzajW.exe
  2⤵
  PID:11796
- C:\Windows\System\EmeCZlf.exe
  C:\Windows\System\EmeCZlf.exe
  2⤵
  PID:11876
- C:\Windows\System\peexTig.exe
  C:\Windows\System\peexTig.exe
  2⤵
  PID:11892
- C:\Windows\System\xDLZxFX.exe
  C:\Windows\System\xDLZxFX.exe
  2⤵
  PID:11928
- C:\Windows\System\XEQjctF.exe
  C:\Windows\System\XEQjctF.exe
  2⤵
  PID:12056
- C:\Windows\System\WTzrdrq.exe
  C:\Windows\System\WTzrdrq.exe
  2⤵
  PID:12084
- C:\Windows\System\cFJZNoT.exe
  C:\Windows\System\cFJZNoT.exe
  2⤵
  PID:12180
- C:\Windows\System\MeQLuMI.exe
  C:\Windows\System\MeQLuMI.exe
  2⤵
  PID:12212
- C:\Windows\System\yeKnEIc.exe
  C:\Windows\System\yeKnEIc.exe
  2⤵
  PID:11300
- C:\Windows\System\ObOHRHs.exe
  C:\Windows\System\ObOHRHs.exe
  2⤵
  PID:11440
- C:\Windows\System\ddpLWPi.exe
  C:\Windows\System\ddpLWPi.exe
  2⤵
  PID:11564
- C:\Windows\System\XWVXuFS.exe
  C:\Windows\System\XWVXuFS.exe
  2⤵
  PID:11660
- C:\Windows\System\lSxruPq.exe
  C:\Windows\System\lSxruPq.exe
  2⤵
  PID:10952
- C:\Windows\System\WReCOmo.exe
  C:\Windows\System\WReCOmo.exe
  2⤵
  PID:11932
- C:\Windows\System\khXVjkd.exe
  C:\Windows\System\khXVjkd.exe
  2⤵
  PID:2264
- C:\Windows\System\vCjaGDe.exe
  C:\Windows\System\vCjaGDe.exe
  2⤵
  PID:12160
- C:\Windows\System\OklrWqn.exe
  C:\Windows\System\OklrWqn.exe
  2⤵
  PID:11372
- C:\Windows\System\bleoESF.exe
  C:\Windows\System\bleoESF.exe
  2⤵
  PID:11400
- C:\Windows\System\BrDPEZQ.exe
  C:\Windows\System\BrDPEZQ.exe
  2⤵
  PID:11776
- C:\Windows\System\cfRBRnq.exe
  C:\Windows\System\cfRBRnq.exe
  2⤵
  PID:4216
- C:\Windows\System\zSSVmMo.exe
  C:\Windows\System\zSSVmMo.exe
  2⤵
  PID:12244
- C:\Windows\System\tmtwjIm.exe
  C:\Windows\System\tmtwjIm.exe
  2⤵
  PID:11228
- C:\Windows\System\mUryriI.exe
  C:\Windows\System\mUryriI.exe
  2⤵
  PID:12312
- C:\Windows\System\HBAobWu.exe
  C:\Windows\System\HBAobWu.exe
  2⤵
  PID:12328
- C:\Windows\System\PIbBwyc.exe
  C:\Windows\System\PIbBwyc.exe
  2⤵
  PID:12384
- C:\Windows\System\ODleQbr.exe
  C:\Windows\System\ODleQbr.exe
  2⤵
  PID:12428
- C:\Windows\System\iNDuPYk.exe
  C:\Windows\System\iNDuPYk.exe
  2⤵
  PID:12472
- C:\Windows\System\RQiVRtF.exe
  C:\Windows\System\RQiVRtF.exe
  2⤵
  PID:12496
- C:\Windows\System\ihZWGCi.exe
  C:\Windows\System\ihZWGCi.exe
  2⤵
  PID:12520
- C:\Windows\System\YzaUAri.exe
  C:\Windows\System\YzaUAri.exe
  2⤵
  PID:12576
- C:\Windows\System\vJlvgCH.exe
  C:\Windows\System\vJlvgCH.exe
  2⤵
  PID:12632
- C:\Windows\System\VKIhbFK.exe
  C:\Windows\System\VKIhbFK.exe
  2⤵
  PID:12656
- C:\Windows\System\KjWNouP.exe
  C:\Windows\System\KjWNouP.exe
  2⤵
  PID:12680
- C:\Windows\System\EDhniyB.exe
  C:\Windows\System\EDhniyB.exe
  2⤵
  PID:12700
- C:\Windows\System\XBPkuhr.exe
  C:\Windows\System\XBPkuhr.exe
  2⤵
  PID:12716
- C:\Windows\System\XVywgxO.exe
  C:\Windows\System\XVywgxO.exe
  2⤵
  PID:12740
- C:\Windows\System\zjGnOAL.exe
  C:\Windows\System\zjGnOAL.exe
  2⤵
  PID:12784
- C:\Windows\System\odAJsWV.exe
  C:\Windows\System\odAJsWV.exe
  2⤵
  PID:12808
- C:\Windows\System\PwAthdT.exe
  C:\Windows\System\PwAthdT.exe
  2⤵
  PID:12852
- C:\Windows\System\swzMIBL.exe
  C:\Windows\System\swzMIBL.exe
  2⤵
  PID:12892
- C:\Windows\System\IwRoYNp.exe
  C:\Windows\System\IwRoYNp.exe
  2⤵
  PID:12924
- C:\Windows\System\gXSkDhn.exe
  C:\Windows\System\gXSkDhn.exe
  2⤵
  PID:12948
- C:\Windows\System\upyHFSU.exe
  C:\Windows\System\upyHFSU.exe
  2⤵
  PID:12972
- C:\Windows\System\VTQvnOd.exe
  C:\Windows\System\VTQvnOd.exe
  2⤵
  PID:12992
- C:\Windows\System\eBZCsDy.exe
  C:\Windows\System\eBZCsDy.exe
  2⤵
  PID:13020
- C:\Windows\System\DIjDpsR.exe
  C:\Windows\System\DIjDpsR.exe
  2⤵
  PID:13052
- C:\Windows\System\jjALiNn.exe
  C:\Windows\System\jjALiNn.exe
  2⤵
  PID:13072
- C:\Windows\System\erjfYal.exe
  C:\Windows\System\erjfYal.exe
  2⤵
  PID:13092
- C:\Windows\System\BszpMEp.exe
  C:\Windows\System\BszpMEp.exe
  2⤵
  PID:13112
- C:\Windows\System\efqPELl.exe
  C:\Windows\System\efqPELl.exe
  2⤵
  PID:13132
- C:\Windows\System\nieItFm.exe
  C:\Windows\System\nieItFm.exe
  2⤵
  PID:13200
- C:\Windows\System\AKzOxPS.exe
  C:\Windows\System\AKzOxPS.exe
  2⤵
  PID:13224
- C:\Windows\System\OjQQmzW.exe
  C:\Windows\System\OjQQmzW.exe
  2⤵
  PID:13244
- C:\Windows\System\eYcxwsw.exe
  C:\Windows\System\eYcxwsw.exe
  2⤵
  PID:13268
- C:\Windows\System\FUmTeHu.exe
  C:\Windows\System\FUmTeHu.exe
  2⤵
  PID:13288
- C:\Windows\System\RILVZaC.exe
  C:\Windows\System\RILVZaC.exe
  2⤵
  PID:13308
- C:\Windows\System\RoRjDBZ.exe
  C:\Windows\System\RoRjDBZ.exe
  2⤵
  PID:12068
- C:\Windows\System\CyiXgGl.exe
  C:\Windows\System\CyiXgGl.exe
  2⤵
  PID:12344
- C:\Windows\System\XlBuYRi.exe
  C:\Windows\System\XlBuYRi.exe
  2⤵
  PID:12540
- C:\Windows\System\doRQafG.exe
  C:\Windows\System\doRQafG.exe
  2⤵
  PID:12600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rimpsnqd.xut.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AILDyZA.exe

Filesize
1.7MB

MD5
88b696f7f6ee5a12fcb5ba84c66382c7

SHA1
ab9dc4f5c58e5ee13a8638e046930932fe31a4bc

SHA256
ddc8c1e016da462a7d22d5c82e63be6cb36548199554d1133b6b5ecb99b26624

SHA512
ba588ab887b5fe8935d2eee2d92e8a965404110a65cf039b956455b04e38f4e6727c0c9e236f8d6a90c7d0cf598ce8dd126571b35238ba2bd8aaecd131f71987

Download Submit
C:\Windows\System\AkBthQs.exe

Filesize
1.7MB

MD5
7899f77133f6a5953517e9de78459d5c

SHA1
94d4a6e6a0c3a89f837ada8a17d5593f829e143f

SHA256
7818aaeb68e823a1270565038e12437556237b181a38740abe56a6d391a394fa

SHA512
a8fac995b3ba7447ef74773eb96134eeda1f0b2f9f0f978cbeaa157abd52cdd8f127a9e36bb682f0869786f892a3dc08f5a030805cf96fee9258dc2de9b80b99

Download Submit
C:\Windows\System\FBBEVhm.exe

Filesize
1.7MB

MD5
df2a06f72a2b84921df52fae094ec1ff

SHA1
b7740a4eb6b0a86eb8ef34b1e3beeb19683c39b6

SHA256
49e91dc61c208d10731b8fb454a38caa33faf53d3d378e4897169ff9424f6a39

SHA512
1b88d5834688abb95f7f444ab41aa893612603e765bd29a7268d048d6d22a6b9319472e3494a50a02ecfc5df805a9c15014c0a6a4689f517be0935d5bae21424

Download Submit
C:\Windows\System\FSwrfLC.exe

Filesize
1.7MB

MD5
ec047135871c89b94023bdeb3cf9896f

SHA1
2d6cb90b5864492fb4f0ead273ac2a00e69adb47

SHA256
ecb2a706b4d881dc4d26dc786a6a4d780a283f66de290ad08aecd0e4e5045603

SHA512
3ebba78bd1d4150bd04bcabb794e5b6c916a11a4aae31badb552111a188e247185f1df00c26ef3f1c50689b47fe5d380e152ccb347191ac90454bd61f66ff9af

Download Submit
C:\Windows\System\GerKiPX.exe

Filesize
1.7MB

MD5
b8c0a646ae4423f1c41f77cb869364de

SHA1
ce1f551c65c44f13ac712e1eee19d95aa5be0e93

SHA256
5b37026fc2468bdac132807a5d3b6e115016b94c19bfcc30d84b3c81626e5369

SHA512
20a8d661e89c64ac27ab6e1c7fc858a9880e240c4c294ef1b18bd2da8ceb0a728bc44f328d5d32990da44e4c669e3f84660f3b57cdd5c36e50cfd35cbc5f4cb7

Download Submit
C:\Windows\System\JzYbLHE.exe

Filesize
1.7MB

MD5
8fbc833b36c70d11c76fc80df4ac9a47

SHA1
f1cb4dc6c9450c7cbfbea99da2e87d17b90ba75e

SHA256
4a90e4f2195dbea314941ec99bd019a3fe8aec51f4f4276318e80ee9168a787d

SHA512
576a457acab122ec637592d72726026518137872480e6c7c050801b080ca6165cde7423784e6a95019979c165d3a649acbd2b52eec2ab5f68c0e2e17b1837216

Download Submit
C:\Windows\System\KzQGHVE.exe

Filesize
1.7MB

MD5
d8d408c33e2eec86f9a69651741bbc7e

SHA1
b2184fe1a9de7fc94cfa5910e392d468469b209d

SHA256
3adaa0629a4e4432b7743a1a17f6ecae3ee9e3b2ec7162d5bb960aa8186f9a63

SHA512
327055736ed5951ca8945c6f46d998a2ff7bd4c61593ff43e2b325becd6662c9ca9fdc5e2d4c0856eb6589268af7e0eff8b01c151fd7812d0d9085354c1d9b77

Download Submit
C:\Windows\System\LLAjuTO.exe

Filesize
1.7MB

MD5
b05accd4b4da9785da82dc638130e4b0

SHA1
1a840baf1d5a35d27dd4b571827bdc7e18c82e0b

SHA256
1c9cf989205bca6f4bbb55a4960f00b7b16fb1f3bcd1d4d5c954f625368e50de

SHA512
f992dc9367b4c8a75d61eb0abf73cb4c79e9ca5699a695c8620dd3f9e75bbba6bfee275bb6d1b6931a6a4c0a662a811e4b2316c038f5bc2cb47ba6c92e98354a

Download Submit
C:\Windows\System\OEktBCM.exe

Filesize
1.7MB

MD5
00af9f950059bc98d5f4fcd4cf7a76a2

SHA1
7fa9fdcadfa2084babaed746ba2c139ce827f2ba

SHA256
8194adabb4530c21afa8890d8dca1933683c7839207eac93772f9aa60a15a8c1

SHA512
99123a00500e3791dd7bac744380a81ba5ad3e5bdacf968adf03238b71da70d4bf1d74a7a3da9d3583aef7c9a2a2ab595c7762bfb2071765d9610453d687ded0

Download Submit
C:\Windows\System\QNRXIFs.exe

Filesize
1.7MB

MD5
ab22c55d97e5b402c17914eafdb7709e

SHA1
faf4ef13dae62fda447a81566ec316e1c46989c6

SHA256
7943686faf6be598f0c7d4c0c0e3195f774700e398a5451643885be1477e9fca

SHA512
184e1b2da0e335ed4a00cbd3e944f21f074d373d6628a03d00a7c96c4d1db955f672c1c141aa0d67c9b4e5d9be132d9d2c8cb2d18fff87b56743492a7610ff19

Download Submit
C:\Windows\System\QfQtIOH.exe

Filesize
1.7MB

MD5
cd49e433a739dfc249f4230a8d534c81

SHA1
21596dd1244035441c93e762348993d20296faf6

SHA256
091489f2fcc94f05c6b9a47cbb2a91062cd498e472f6ec934c55965bb6e3caf8

SHA512
19faf11aacaf1b38b00dcf7c24e963ce7a64893fb1962534d8fac36123ccca06d0f25bf5f9dab245332bcae8dc8dbecd9290606c14f28ecab2162501fe0ecfa3

Download Submit
C:\Windows\System\RFcAHPF.exe

Filesize
1.7MB

MD5
a66c254d1cfe4f03ac927a457d92013b

SHA1
a02c7035bbf3472c55c8c77fa15482c71aa72030

SHA256
d010776012554e5dc5e77413056e837ac293ed958019dc5faf0ef32958e83af2

SHA512
25ebec8afcb855580c8d843b2c462c9883b4a7bd80a3e5fb0097d883b8ca62fec94a73270003a58de7fd03e03ecc6b91945b7285166f95894837e150cd5f7600

Download Submit
C:\Windows\System\TTRYfvW.exe

Filesize
1.7MB

MD5
da667e9bea6d9ffa49ebc50ca093e0c7

SHA1
7dae96f0a85d29c73348ff9991ae2369648da4c1

SHA256
9519c377ed6996de4cd1a6d4b7aa8092cb8bb278065c14017d51ff326d9dfeb3

SHA512
12a2a0b8bdd0e4aae462276832c9fd7d7490aea92ce1df888d18d43a5acdce48912743db743d1f3fffcdda987692257312b58c192cf6ff7dc7c0fd8003c612d0

Download Submit
C:\Windows\System\Uhnrpnk.exe

Filesize
1.7MB

MD5
27609ceed732fb06c7924605110fa829

SHA1
4ff62b2de94f7c08a0e64ba51e85164a2a1ecbd3

SHA256
57b3d76572ffd9fbb22c4d4fe2f72f9bd1b37060a24d1f5b8fbce462307c7bee

SHA512
1a3b0a45b1f270e5f042e332fbccad598977d1bab8c36d180990d07fd1da95f814188cb72712825239034e173d89a2da48125c33446bc07550843ce6339eb536

Download Submit
C:\Windows\System\VqwovNM.exe

Filesize
1.7MB

MD5
9a274870bb162a022b4d526d6dd43476

SHA1
20a6be1a805f03274167b46d704caac61fffeeef

SHA256
e0bbe04df0f0e2914576a42ee3f0e440c4cb9ed2f0fe44ab4db19a82419172dc

SHA512
3faf9512aa3aa8c2f02aeb94f0579966d1895fc16a358f6b27ccdbd52a45264c489bda544cd926f8196654b8c8030b7f414431809fddcb302736457d8eeeab81

Download Submit
C:\Windows\System\WgEYxby.exe

Filesize
8B

MD5
ceac4b67859cd8c846e623078a67cd44

SHA1
8b1664c63ff543d7901c6400c5a60fefe2b139da

SHA256
759f3aed0600afe0cd4ed1782014e2c156e24c124c14ca43951b0c3e32a1ea00

SHA512
4ea5d722fa26488261521de29bfeab95d6d45288c5f5221d1237cd7092cf27802822a392f7f0730657b9c54ca378c47b733cb95b1fe69df18af73b455d8f477a

Download Submit
C:\Windows\System\XEVcMel.exe

Filesize
1.7MB

MD5
1c1666e0bc976f2ac4421bd9cd7fbbc4

SHA1
edbc1c24d6f30111c8953deea2087afda50f366c

SHA256
7f98625768047c8bae9a35f71b3212bf4ba6ceb7d27fc2925df73e815c807da8

SHA512
5d78a271680b1be44b50bf776b4cf84f6c4337a7be3bb1490416e05df11310683b247bd1b8f8bc7e5c8d6a8e845384e43bcf5f9625102cdc56af908361306972

Download Submit
C:\Windows\System\XsaUPnq.exe

Filesize
1.7MB

MD5
a3a18255cc1bb78055ff584442b425e5

SHA1
0c0bb36a465e4cd7b545fc0ba7cdbcf5c94bf4aa

SHA256
a1c0f74e15bbc594cb7a2fab1345cf6ce661dbfa0c2e6e4ab9d630a70f6c6515

SHA512
4274aa731098c807c61c39b773595160d3bb6b55098502a8aa057f7e6ecba8d0c743ac045291d7508afa17fd1ba74ebe82fab0d3f82ec91b6e34f58e830e0fc8

Download Submit
C:\Windows\System\XvtAFWs.exe

Filesize
1.7MB

MD5
a5893950380d8b1f30435b766a917a35

SHA1
397a3c68e150295d8217a6576d82514f160efe47

SHA256
099b601a70dcf7b89a250e68d31df77bcb3fde7bfb2c9382625e65fb38cfdd2e

SHA512
4bf9a6ece09097db8cd6bfc670e47e9b4be40cfdf8e74beab32b7dd302176eb37e96b7257b0be605d1bb3f66c264228c5dc419f021d30b79bd0b8bf2df82923b

Download Submit
C:\Windows\System\XyvqHLO.exe

Filesize
1.7MB

MD5
e785cc42358c825876ae859c3580f7fa

SHA1
8ab45b214a9dd94ff2b949aa2835739d157fe1b8

SHA256
3872f1521354190fc0ec27e12bdeaed6d39a7f623cc242ecc2f00b421e3c0002

SHA512
d56b19ab0c997cd87883ef69353c4407b8dfe58b52f242ecd02663d182fb5994a2515aa89831862144e11463b1fc0a1db402fd82c8c132c23b861aeb9d435ecd

Download Submit
C:\Windows\System\YbuSnsZ.exe

Filesize
1.7MB

MD5
fc0c5895379c3c2b016092ec011ec4a5

SHA1
571cf6070975bd1de6425860ea77d1483935f477

SHA256
23e497a1758c62bf39744fe42c9021dd399e34b79d7a6832577d00c4b637fb2a

SHA512
7882d4ff5d6e148b1dae3978faa6a8792980e84d4d0bc67ac3ea450742123ae6ba288cee466ec9535f3b6563d8dffe7639103dba5310305a7e8461f6266308e7

Download Submit
C:\Windows\System\bIosoyu.exe

Filesize
1.7MB

MD5
1c6eecf50a657f3d98dcb7a072bc6493

SHA1
2f30fa0fe2a93a2e0dc8783e1dda272be5ad6457

SHA256
f6c6fcf857fd5bf565e9e56e32e8a858212a2f71184df78da42c31bb11f10d99

SHA512
9e98c58dfd6b27e90e83fdee93062777cec53ecf5e0dac64fb3d4ae35bbfe22b75013908028846ed3d1e8760336b4c6818972b4f2515a9f0f017343d0ccfc0ce

Download Submit
C:\Windows\System\gAZXlVo.exe

Filesize
1.7MB

MD5
f044a8e7225726f85caa154928690332

SHA1
620e9be33300950b547ed0d9a63e7f128ca2bbea

SHA256
6767ef96077b52094084c34111643f88062f137ffecccf7b7905d91db64ecda0

SHA512
ef18f6b45d555b11b5ad0accb0bf388e05840b76687b9f1de58880d0f2a7bbd69727cba0e07ca3de5ff84aba38e3fb560e4a14399b3508a0390186f4c88c6335

Download Submit
C:\Windows\System\igLVQZd.exe

Filesize
1.7MB

MD5
4c2cc5a15203365fd608ace05c533451

SHA1
6f591a65222dadbc02616b7a34009e3c800e9420

SHA256
5ced61be1fc1c29935b951d8fd515233d05e138c28b57e38163a9a0a2d6a2591

SHA512
03a270d4c5fb16a6bc1f0ea77a65787fb9d05a036d6660c37a9a0907623da4caecd20dff102b74706fa452ad560c113e174612bcfa0f63d0f704eacab979bacd

Download Submit
C:\Windows\System\lHpeOIf.exe

Filesize
1.7MB

MD5
8aa31683cd9ef7e73c7e72bbdc923a6d

SHA1
8ba2d59c91dabf3e23a50ec212140d8ad03a6449

SHA256
ec25b4e8bd3d07cd9a50521d44850d5430c843b22deed7eebc2ca100f0546b57

SHA512
5ec0aed7496806e2a89c87e7832b25ceef072a15c276f4bf43153e1372969864efee61345c986322226000e3880156234403893e8968127ed12962042580fc2f

Download Submit
C:\Windows\System\mNcxhja.exe

Filesize
1.7MB

MD5
b0009659426f49600ae126b971372822

SHA1
4e1379c2c57114d87684c18589cf6a814484a5ba

SHA256
c7cee7f59cc55f0406411167b008bf905fe1934432f99c3f75c36fe90f1b94e3

SHA512
6a903ed2110180fdbf4d9325e3e43d1dc498bfa31021d18c91ad4013034dfd116c2e2f0c962ef9eff43e7023eca38cf884f7b6993054dc33e89e4745519704c6

Download Submit
C:\Windows\System\mYVgfAP.exe

Filesize
1.7MB

MD5
3ed3adc5941beff1be65863b085cd752

SHA1
e665b0fe0eea129a5e613a83c0ccbb54c5de8520

SHA256
23bf5c6e772a92d66b20eb67c5809eb7a455023f6d2b81811e849f81c83b5635

SHA512
d56193c492f497613f138ad88dcd6dea5b2f896a58566bb06d80b5e4d5944797ab5c4990010f4d38c358887b753ac9ff507e374893968f5d2e01bd0fb7437419

Download Submit
C:\Windows\System\oJfkgpZ.exe

Filesize
1.7MB

MD5
18f65e356c18814661188e3c36c020ec

SHA1
47a8cac001444b15c63e9e33aad332d651247090

SHA256
a91ae5d334964280ac3fb9b87160a0801d620b18d6c99f71982f57c66666821d

SHA512
d7305c7a5107ce8691c7a9441a9047c466a35b402e5ff36f14937b96ac5a27e62a223ee95bdcc960c0c7d76905018617190456638f1e3b42d5e1339bcd61b421

Download Submit
C:\Windows\System\oYqhaeI.exe

Filesize
1.7MB

MD5
ccb35a5bfe45c0f036cdad265a0b77d0

SHA1
cc153bde5c11f268164474894ea5194ded2cdda9

SHA256
2b555166aec3462c661ca9a8104d5fd04e0625609aab118e926bed6955b6781b

SHA512
db040d14a4c7f7a764d520881d117fd8b1786e9f6ceceec339d151bf098ec5a839b8649abe7c3ae229e43d02f873b2c0ec26adfd65e760d4c64adf50cc46af6f

Download Submit
C:\Windows\System\qhLWDMe.exe

Filesize
1.7MB

MD5
c980620852b59d759c104aed4f955bfd

SHA1
f8a6b6c89c04b39bacd61007e2b1a87775ac37e6

SHA256
aa30b98cfedff7d15368bf8599c9f4bb20e408c460cb2f1c1f6bd3fb9c449381

SHA512
20a157edd787ad76c88e324e9c33df15252f813b9e640af3ecf35d4732ce920d01db74d7ce58ca8621d86abf2c009df81875d27cc1756bdf528630706ab6989d

Download Submit
C:\Windows\System\qxVHFSs.exe

Filesize
1.7MB

MD5
6701c0606f96128ae555362eb1cd6d1b

SHA1
e40d750db2a41cec3c68140c3bd056a8c2556039

SHA256
596c3cbc00ffb9c9e46da63f9d7aaa9b833835b10067e5a458eed89bb2978a88

SHA512
b0a45923bd7bce66e09edb27d740ec2992d13e3ef0efd7be45346d667752c4bca972e88c3e02d2e28d4f7687fc58d4221b98ac24e7f1fae43fa2014d9b76e5a5

Download Submit
C:\Windows\System\tFcyGOP.exe

Filesize
1.7MB

MD5
6ca3e081ac10a80c75075d330c1a087e

SHA1
c373434ee0dda7b0f2b00fd901148cb69eec160f

SHA256
1e4f903b31386e2fcad3bfddd6a9e07bfa3817fcfe6309243e758a64e5173fe3

SHA512
27bacd974f352625fb87e970f541754115f377c6cd90d4fb0198f2261e299878d7dd1c64c4a74a6c52344a05610fc1581d8a7f27ea98f46320d1868859e1ac09

Download Submit
C:\Windows\System\vUpqNqd.exe

Filesize
1.7MB

MD5
0c1d1fd97e7273ce7897c90c52752101

SHA1
6d4e64ff6f1e4c88a635a200f5aa45b5545df9b9

SHA256
47208734973e448803b62e17e617c5f2c991e7af8bb8c81e57f58c313b71ccc2

SHA512
526c26d8bdb0a0fb31fee9dcb7d7bc15cc0235fd01f8f5e2ae04ca41cc9b30c6a7cd1d81155d79eec469e7dbca9aa9dab27b1bcd28dff60406fa50efb3924f46

Download Submit
C:\Windows\System\zOgAMym.exe

Filesize
1.7MB

MD5
a662bc76f651691ce340472a8591b807

SHA1
6f71d807ae02f30a75be34c0252cc9b2a66a34d7

SHA256
4267fba3e8837cac3dbb15a9cf3bf27b286878af93975eab0d6bda265dc240fc

SHA512
51498f12ebee79025a022951e77d8a3c316f864e27741df5e48f30f56526f728b660e5c7eeadddbdeeaecd9b0a512b9ad36029cc0546583f18cae45ca09f1027

Download Submit
memory/984-155-0x00007FF6ED640000-0x00007FF6EDA32000-memory.dmp

Filesize
3.9MB

Download
memory/984-2102-0x00007FF6ED640000-0x00007FF6EDA32000-memory.dmp

Filesize
3.9MB

Download
memory/1384-2086-0x00007FF603A90000-0x00007FF603E82000-memory.dmp

Filesize
3.9MB

Download
memory/1384-151-0x00007FF603A90000-0x00007FF603E82000-memory.dmp

Filesize
3.9MB

Download
memory/1392-2036-0x00007FF627310000-0x00007FF627702000-memory.dmp

Filesize
3.9MB

Download
memory/1392-118-0x00007FF627310000-0x00007FF627702000-memory.dmp

Filesize
3.9MB

Download
memory/1392-2090-0x00007FF627310000-0x00007FF627702000-memory.dmp

Filesize
3.9MB

Download
memory/1464-2075-0x00007FF797850000-0x00007FF797C42000-memory.dmp

Filesize
3.9MB

Download
memory/1464-96-0x00007FF797850000-0x00007FF797C42000-memory.dmp

Filesize
3.9MB

Download
memory/1956-2070-0x00007FF7EDE00000-0x00007FF7EE1F2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-76-0x00007FF7EDE00000-0x00007FF7EE1F2000-memory.dmp

Filesize
3.9MB

Download
memory/1988-141-0x00007FF6C90A0000-0x00007FF6C9492000-memory.dmp

Filesize
3.9MB

Download
memory/1988-2094-0x00007FF6C90A0000-0x00007FF6C9492000-memory.dmp

Filesize
3.9MB

Download
memory/2012-2037-0x00007FF7B06F0000-0x00007FF7B0AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-121-0x00007FF7B06F0000-0x00007FF7B0AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-2089-0x00007FF7B06F0000-0x00007FF7B0AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-135-0x00007FF7A1B80000-0x00007FF7A1F72000-memory.dmp

Filesize
3.9MB

Download
memory/2248-2098-0x00007FF7A1B80000-0x00007FF7A1F72000-memory.dmp

Filesize
3.9MB

Download
memory/2248-2022-0x00007FF7A1B80000-0x00007FF7A1F72000-memory.dmp

Filesize
3.9MB

Download
memory/2268-1-0x0000019B58A30000-0x0000019B58A40000-memory.dmp

Filesize
64KB

Download
memory/2268-0-0x00007FF71A380000-0x00007FF71A772000-memory.dmp

Filesize
3.9MB

Download
memory/2536-23-0x00007FF74D2C0000-0x00007FF74D6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-2065-0x00007FF74D2C0000-0x00007FF74D6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-2008-0x00007FF74D2C0000-0x00007FF74D6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-84-0x00007FF760110000-0x00007FF760502000-memory.dmp

Filesize
3.9MB

Download
memory/2544-2060-0x00007FF760110000-0x00007FF760502000-memory.dmp

Filesize
3.9MB

Download
memory/2572-2080-0x00007FF7C5890000-0x00007FF7C5C82000-memory.dmp

Filesize
3.9MB

Download
memory/2572-109-0x00007FF7C5890000-0x00007FF7C5C82000-memory.dmp

Filesize
3.9MB

Download
memory/2844-2032-0x00007FFF05FD0000-0x00007FFF06A91000-memory.dmp

Filesize
10.8MB

Download
memory/2844-83-0x000001CAFCCB0000-0x000001CAFCCD2000-memory.dmp

Filesize
136KB

Download
memory/2844-343-0x000001CAFD830000-0x000001CAFDFD6000-memory.dmp

Filesize
7.6MB

Download
memory/2844-2010-0x00007FFF05FD0000-0x00007FFF06A91000-memory.dmp

Filesize
10.8MB

Download
memory/2844-2020-0x000001CAFAB30000-0x000001CAFAB40000-memory.dmp

Filesize
64KB

Download
memory/2844-2019-0x000001CAFAB30000-0x000001CAFAB40000-memory.dmp

Filesize
64KB

Download
memory/2844-54-0x000001CAFAB30000-0x000001CAFAB40000-memory.dmp

Filesize
64KB

Download
memory/2844-46-0x00007FFF05FD0000-0x00007FFF06A91000-memory.dmp

Filesize
10.8MB

Download
memory/2844-55-0x000001CAFAB30000-0x000001CAFAB40000-memory.dmp

Filesize
64KB

Download
memory/3028-2021-0x00007FF64EC00000-0x00007FF64EFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-2092-0x00007FF64EC00000-0x00007FF64EFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-117-0x00007FF64EC00000-0x00007FF64EFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-22-0x00007FF7810D0000-0x00007FF7814C2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-2064-0x00007FF7810D0000-0x00007FF7814C2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-1996-0x00007FF7810D0000-0x00007FF7814C2000-memory.dmp

Filesize
3.9MB

Download
memory/3548-148-0x00007FF677B60000-0x00007FF677F52000-memory.dmp

Filesize
3.9MB

Download
memory/3548-2084-0x00007FF677B60000-0x00007FF677F52000-memory.dmp

Filesize
3.9MB

Download
memory/3684-2039-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp

Filesize
3.9MB

Download
memory/3684-1995-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp

Filesize
3.9MB

Download
memory/3684-10-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp

Filesize
3.9MB

Download
memory/3940-158-0x00007FF7BC9A0000-0x00007FF7BCD92000-memory.dmp

Filesize
3.9MB

Download
memory/3940-2101-0x00007FF7BC9A0000-0x00007FF7BCD92000-memory.dmp

Filesize
3.9MB

Download
memory/4272-146-0x00007FF69FF70000-0x00007FF6A0362000-memory.dmp

Filesize
3.9MB

Download
memory/4272-2082-0x00007FF69FF70000-0x00007FF6A0362000-memory.dmp

Filesize
3.9MB

Download
memory/4332-28-0x00007FF755110000-0x00007FF755502000-memory.dmp

Filesize
3.9MB

Download
memory/4332-2041-0x00007FF755110000-0x00007FF755502000-memory.dmp

Filesize
3.9MB

Download
memory/4348-2072-0x00007FF65A730000-0x00007FF65AB22000-memory.dmp

Filesize
3.9MB

Download
memory/4348-60-0x00007FF65A730000-0x00007FF65AB22000-memory.dmp

Filesize
3.9MB

Download
memory/4716-65-0x00007FF71C730000-0x00007FF71CB22000-memory.dmp

Filesize
3.9MB

Download
memory/4716-2079-0x00007FF71C730000-0x00007FF71CB22000-memory.dmp

Filesize
3.9MB

Download
memory/4936-2077-0x00007FF612480000-0x00007FF612872000-memory.dmp

Filesize
3.9MB

Download
memory/4936-62-0x00007FF612480000-0x00007FF612872000-memory.dmp

Filesize
3.9MB

Download