xmrig | 91982211d7d464ff1a6d2c43a8305cbf1fdb47a8adc9c778f6f1af79fb36329e

Analysis

max time kernel
104s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
Size

1.4MB
MD5

0fa21f6a6d4923af4c7ebeb5a11af97b
SHA1

f4b0c33716de5fd1d955f789eb7e1a44dd4f7daa
SHA256

91982211d7d464ff1a6d2c43a8305cbf1fdb47a8adc9c778f6f1af79fb36329e
SHA512

44ae037f9b0224729dcb2bd8e93238b9e80b09e1d962c750a3ebe66d23d25739596d3c4f09e92654ada7e179bcbc08012ea429ff3842018273de7a9a55f63ca6
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwlZCg7:Lz071uv4BPMkibTIA5CJM

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/2928-29-0x00007FF721070000-0x00007FF721462000-memory.dmp	xmrig
behavioral2/memory/3152-44-0x00007FF729EA0000-0x00007FF72A292000-memory.dmp	xmrig
behavioral2/memory/916-51-0x00007FF786A60000-0x00007FF786E52000-memory.dmp	xmrig
behavioral2/memory/4332-63-0x00007FF7C7D80000-0x00007FF7C8172000-memory.dmp	xmrig
behavioral2/memory/5060-84-0x00007FF75C2D0000-0x00007FF75C6C2000-memory.dmp	xmrig
behavioral2/memory/3520-83-0x00007FF7A6C40000-0x00007FF7A7032000-memory.dmp	xmrig
behavioral2/memory/2368-49-0x00007FF770C40000-0x00007FF771032000-memory.dmp	xmrig
behavioral2/memory/2864-27-0x00007FF60CB10000-0x00007FF60CF02000-memory.dmp	xmrig
behavioral2/memory/1668-151-0x00007FF670DD0000-0x00007FF6711C2000-memory.dmp	xmrig
behavioral2/memory/2976-163-0x00007FF6F0140000-0x00007FF6F0532000-memory.dmp	xmrig
behavioral2/memory/4416-146-0x00007FF7819E0000-0x00007FF781DD2000-memory.dmp	xmrig
behavioral2/memory/1128-140-0x00007FF6D4460000-0x00007FF6D4852000-memory.dmp	xmrig
behavioral2/memory/3192-139-0x00007FF7838E0000-0x00007FF783CD2000-memory.dmp	xmrig
behavioral2/memory/2280-133-0x00007FF78A720000-0x00007FF78AB12000-memory.dmp	xmrig
behavioral2/memory/4092-127-0x00007FF6F5340000-0x00007FF6F5732000-memory.dmp	xmrig
behavioral2/memory/4840-126-0x00007FF796760000-0x00007FF796B52000-memory.dmp	xmrig
behavioral2/memory/3248-118-0x00007FF658390000-0x00007FF658782000-memory.dmp	xmrig
behavioral2/memory/1420-99-0x00007FF778810000-0x00007FF778C02000-memory.dmp	xmrig
behavioral2/memory/3980-1371-0x00007FF791750000-0x00007FF791B42000-memory.dmp	xmrig
behavioral2/memory/2916-2004-0x00007FF7D7700000-0x00007FF7D7AF2000-memory.dmp	xmrig
behavioral2/memory/2268-2009-0x00007FF739A40000-0x00007FF739E32000-memory.dmp	xmrig
behavioral2/memory/3152-3320-0x00007FF729EA0000-0x00007FF72A292000-memory.dmp	xmrig
behavioral2/memory/2864-3322-0x00007FF60CB10000-0x00007FF60CF02000-memory.dmp	xmrig
behavioral2/memory/2928-3325-0x00007FF721070000-0x00007FF721462000-memory.dmp	xmrig
behavioral2/memory/2368-3326-0x00007FF770C40000-0x00007FF771032000-memory.dmp	xmrig
behavioral2/memory/916-3328-0x00007FF786A60000-0x00007FF786E52000-memory.dmp	xmrig
behavioral2/memory/3520-3334-0x00007FF7A6C40000-0x00007FF7A7032000-memory.dmp	xmrig
behavioral2/memory/4332-3332-0x00007FF7C7D80000-0x00007FF7C8172000-memory.dmp	xmrig
behavioral2/memory/2916-3331-0x00007FF7D7700000-0x00007FF7D7AF2000-memory.dmp	xmrig
behavioral2/memory/2268-3336-0x00007FF739A40000-0x00007FF739E32000-memory.dmp	xmrig
behavioral2/memory/3280-3339-0x00007FF72A8C0000-0x00007FF72ACB2000-memory.dmp	xmrig
behavioral2/memory/2424-3342-0x00007FF772010000-0x00007FF772402000-memory.dmp	xmrig
behavioral2/memory/5060-3341-0x00007FF75C2D0000-0x00007FF75C6C2000-memory.dmp	xmrig
behavioral2/memory/1420-3344-0x00007FF778810000-0x00007FF778C02000-memory.dmp	xmrig
behavioral2/memory/3248-3346-0x00007FF658390000-0x00007FF658782000-memory.dmp	xmrig
behavioral2/memory/4840-3348-0x00007FF796760000-0x00007FF796B52000-memory.dmp	xmrig
behavioral2/memory/4092-3350-0x00007FF6F5340000-0x00007FF6F5732000-memory.dmp	xmrig
behavioral2/memory/2280-3356-0x00007FF78A720000-0x00007FF78AB12000-memory.dmp	xmrig
behavioral2/memory/3192-3354-0x00007FF7838E0000-0x00007FF783CD2000-memory.dmp	xmrig
behavioral2/memory/4416-3358-0x00007FF7819E0000-0x00007FF781DD2000-memory.dmp	xmrig
behavioral2/memory/1128-3353-0x00007FF6D4460000-0x00007FF6D4852000-memory.dmp	xmrig
behavioral2/memory/464-3365-0x00007FF7A38B0000-0x00007FF7A3CA2000-memory.dmp	xmrig
behavioral2/memory/2976-3373-0x00007FF6F0140000-0x00007FF6F0532000-memory.dmp	xmrig
behavioral2/memory/3736-3367-0x00007FF7923A0000-0x00007FF792792000-memory.dmp	xmrig
behavioral2/memory/1668-3363-0x00007FF670DD0000-0x00007FF6711C2000-memory.dmp	xmrig

Blocklisted process makes network request 9 IoCs

flow	pid	Process
3	1080	powershell.exe
5	1080	powershell.exe
9	1080	powershell.exe
10	1080	powershell.exe
12	1080	powershell.exe
13	1080	powershell.exe
15	1080	powershell.exe
19	1080	powershell.exe
20	1080	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1080	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3152	gRdYiGG.exe
2864	dzWRXAN.exe
2928	bCyAWSQ.exe
2368	YpTxFvm.exe
916	aiSjrrz.exe
4332	BJxhSdR.exe
2916	XYXHJVt.exe
2268	ghNDtbo.exe
3520	VsLVVhe.exe
5060	JvibCph.exe
2424	LmaTEmf.exe
3280	zegxSyt.exe
1420	GWzHtru.exe
3248	tYSgwKs.exe
4840	OZQhxzb.exe
3192	JRDcvXS.exe
4092	qVKofDH.exe
2280	KQnbRdc.exe
1128	FWkmPDx.exe
4416	ocToYLQ.exe
1668	hFmhSbW.exe
2976	LigcyjJ.exe
3736	kIeYYJU.exe
464	nxspQVP.exe
432	IPsIDDG.exe
772	PZRxGAa.exe
912	vZwwWCm.exe
4832	bVsxiBD.exe
3900	fHfQKYr.exe
2436	TEJNxoD.exe
4160	urOVyyd.exe
1232	ZMSSKfz.exe
4580	cllMdMS.exe
4440	tpVVELo.exe
1324	faeDgZn.exe
4912	XLIDXOO.exe
4372	CaFRreh.exe
3176	yaZqOYC.exe
4140	iVGULRD.exe
1240	wsVQZba.exe
4080	rhRUSCU.exe
3148	bYTNGqF.exe
3564	GvbbiGV.exe
4232	QwBvKnx.exe
2372	HQJOYCe.exe
4028	oRdiynO.exe
3740	XdsHZrG.exe
4660	BKqjMEB.exe
1372	qIIcRHK.exe
4692	OjEIxYi.exe
948	pxcqVYI.exe
1884	EOxMiuL.exe
1588	PAOBBzX.exe
2784	RhLIjnD.exe
1764	LQpMXjl.exe
3136	HOnLnYF.exe
4596	pZCFFSp.exe
4948	jcLsnqA.exe
5144	sVqZJCi.exe
5168	PjIzgkU.exe
5200	DWUTfHC.exe
5228	mXIlSlJ.exe
5256	BMyUjth.exe
5280	MsDLedd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3980-0-0x00007FF791750000-0x00007FF791B42000-memory.dmp	upx
behavioral2/files/0x0006000000023305-6.dat	upx
behavioral2/files/0x0007000000023471-10.dat	upx
behavioral2/files/0x0008000000023470-11.dat	upx
behavioral2/files/0x0007000000023473-26.dat	upx
behavioral2/memory/2928-29-0x00007FF721070000-0x00007FF721462000-memory.dmp	upx
behavioral2/memory/3152-44-0x00007FF729EA0000-0x00007FF72A292000-memory.dmp	upx
behavioral2/memory/916-51-0x00007FF786A60000-0x00007FF786E52000-memory.dmp	upx
behavioral2/files/0x0007000000023478-59.dat	upx
behavioral2/memory/4332-63-0x00007FF7C7D80000-0x00007FF7C8172000-memory.dmp	upx
behavioral2/files/0x0008000000023475-70.dat	upx
behavioral2/memory/2268-76-0x00007FF739A40000-0x00007FF739E32000-memory.dmp	upx
behavioral2/files/0x0007000000023479-81.dat	upx
behavioral2/files/0x000700000002347a-85.dat	upx
behavioral2/memory/5060-84-0x00007FF75C2D0000-0x00007FF75C6C2000-memory.dmp	upx
behavioral2/memory/3520-83-0x00007FF7A6C40000-0x00007FF7A7032000-memory.dmp	upx
behavioral2/files/0x0008000000023476-79.dat	upx
behavioral2/memory/3280-78-0x00007FF72A8C0000-0x00007FF72ACB2000-memory.dmp	upx
behavioral2/memory/2424-77-0x00007FF772010000-0x00007FF772402000-memory.dmp	upx
behavioral2/files/0x0007000000023477-64.dat	upx
behavioral2/memory/2916-55-0x00007FF7D7700000-0x00007FF7D7AF2000-memory.dmp	upx
behavioral2/files/0x0007000000023474-54.dat	upx
behavioral2/memory/2368-49-0x00007FF770C40000-0x00007FF771032000-memory.dmp	upx
behavioral2/memory/2864-27-0x00007FF60CB10000-0x00007FF60CF02000-memory.dmp	upx
behavioral2/files/0x0007000000023472-28.dat	upx
behavioral2/files/0x000700000002347b-92.dat	upx
behavioral2/files/0x000700000002347c-100.dat	upx
behavioral2/files/0x000700000002347f-114.dat	upx
behavioral2/files/0x0007000000023480-121.dat	upx
behavioral2/files/0x0007000000023482-136.dat	upx
behavioral2/files/0x0007000000023484-147.dat	upx
behavioral2/memory/1668-151-0x00007FF670DD0000-0x00007FF6711C2000-memory.dmp	upx
behavioral2/files/0x0007000000023486-160.dat	upx
behavioral2/files/0x000700000002348b-187.dat	upx
behavioral2/files/0x000700000002348c-200.dat	upx
behavioral2/files/0x000700000002348e-202.dat	upx
behavioral2/files/0x000700000002348d-197.dat	upx
behavioral2/files/0x000700000002348a-190.dat	upx
behavioral2/files/0x0007000000023489-185.dat	upx
behavioral2/files/0x0007000000023488-180.dat	upx
behavioral2/files/0x0007000000023487-172.dat	upx
behavioral2/memory/464-169-0x00007FF7A38B0000-0x00007FF7A3CA2000-memory.dmp	upx
behavioral2/files/0x0007000000023485-165.dat	upx
behavioral2/memory/2976-163-0x00007FF6F0140000-0x00007FF6F0532000-memory.dmp	upx
behavioral2/files/0x0007000000023483-157.dat	upx
behavioral2/memory/3736-155-0x00007FF7923A0000-0x00007FF792792000-memory.dmp	upx
behavioral2/memory/4416-146-0x00007FF7819E0000-0x00007FF781DD2000-memory.dmp	upx
behavioral2/memory/1128-140-0x00007FF6D4460000-0x00007FF6D4852000-memory.dmp	upx
behavioral2/memory/3192-139-0x00007FF7838E0000-0x00007FF783CD2000-memory.dmp	upx
behavioral2/files/0x0007000000023481-135.dat	upx
behavioral2/memory/2280-133-0x00007FF78A720000-0x00007FF78AB12000-memory.dmp	upx
behavioral2/memory/4092-127-0x00007FF6F5340000-0x00007FF6F5732000-memory.dmp	upx
behavioral2/memory/4840-126-0x00007FF796760000-0x00007FF796B52000-memory.dmp	upx
behavioral2/files/0x000700000002347d-119.dat	upx
behavioral2/memory/3248-118-0x00007FF658390000-0x00007FF658782000-memory.dmp	upx
behavioral2/files/0x000700000002347e-115.dat	upx
behavioral2/files/0x000800000002346e-106.dat	upx
behavioral2/memory/1420-99-0x00007FF778810000-0x00007FF778C02000-memory.dmp	upx
behavioral2/memory/3980-1371-0x00007FF791750000-0x00007FF791B42000-memory.dmp	upx
behavioral2/memory/2916-2004-0x00007FF7D7700000-0x00007FF7D7AF2000-memory.dmp	upx
behavioral2/memory/2268-2009-0x00007FF739A40000-0x00007FF739E32000-memory.dmp	upx
behavioral2/memory/3152-3320-0x00007FF729EA0000-0x00007FF72A292000-memory.dmp	upx
behavioral2/memory/2864-3322-0x00007FF60CB10000-0x00007FF60CF02000-memory.dmp	upx
behavioral2/memory/2928-3325-0x00007FF721070000-0x00007FF721462000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NjiBeVA.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\aHhpaHU.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\bpDXrgD.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\BEiUmkt.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\DxHwNVn.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\JRVslqZ.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\huoKsgR.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\gZFmAZA.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\HmfpxSB.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\wuezAmB.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\OufNqqN.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\cNriLgv.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\WtjcXnN.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\EoqfUFy.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\TqUJhOT.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\WKKLtyf.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\WUcmrDM.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\gnaPwXj.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\QkQRaWn.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\qnjeonH.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\uBHevio.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\XGWjxZh.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\ltQabid.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\BkhOvxg.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\qWJnDWL.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\tgLJpER.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\seaYJmS.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\blVztAX.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\pFGHdLA.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\cllMdMS.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\rYhuqDl.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\jtWoeAa.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\qKVLBIB.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\bLJJnZt.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\VDTJhap.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\TfoxhGr.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\nqiVyuv.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\hLivDKi.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\fQYiIap.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\DTPVHPU.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\lYFbexb.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\cPayoKa.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\ztKFiBj.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\HzXqPLq.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\UYAnaYP.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\BCTlpdz.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\rIqmdEY.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\jSbMOlU.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\GSXSBWn.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\baBAExB.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\yXMnFGK.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\NCLcFrI.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\bndpCWP.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\lNshGnU.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\WxBFbok.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\SChGCqk.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\hZJnhmy.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\FjSLfCs.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\oEeTLOi.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\VmMlSIb.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\wqWRSqI.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\ErhGaGg.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\MqjdKqY.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\aqPmVJs.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1080	powershell.exe
1080	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeLockMemoryPrivilege	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 1080	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	84
PID 3980 wrote to memory of 1080	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	84
PID 3980 wrote to memory of 3152	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	85
PID 3980 wrote to memory of 3152	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	85
PID 3980 wrote to memory of 2864	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	86
PID 3980 wrote to memory of 2864	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	86
PID 3980 wrote to memory of 2928	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	87
PID 3980 wrote to memory of 2928	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	87
PID 3980 wrote to memory of 2368	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	88
PID 3980 wrote to memory of 2368	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	88
PID 3980 wrote to memory of 916	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	89
PID 3980 wrote to memory of 916	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	89
PID 3980 wrote to memory of 4332	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	90
PID 3980 wrote to memory of 4332	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	90
PID 3980 wrote to memory of 2916	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	91
PID 3980 wrote to memory of 2916	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	91
PID 3980 wrote to memory of 2268	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	92
PID 3980 wrote to memory of 2268	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	92
PID 3980 wrote to memory of 3520	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	93
PID 3980 wrote to memory of 3520	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	93
PID 3980 wrote to memory of 5060	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	94
PID 3980 wrote to memory of 5060	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	94
PID 3980 wrote to memory of 2424	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	95
PID 3980 wrote to memory of 2424	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	95
PID 3980 wrote to memory of 3280	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	96
PID 3980 wrote to memory of 3280	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	96
PID 3980 wrote to memory of 1420	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	97
PID 3980 wrote to memory of 1420	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	97
PID 3980 wrote to memory of 4840	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	98
PID 3980 wrote to memory of 4840	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	98
PID 3980 wrote to memory of 3248	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	99
PID 3980 wrote to memory of 3248	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	99
PID 3980 wrote to memory of 3192	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	100
PID 3980 wrote to memory of 3192	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	100
PID 3980 wrote to memory of 4092	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	101
PID 3980 wrote to memory of 4092	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	101
PID 3980 wrote to memory of 2280	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	102
PID 3980 wrote to memory of 2280	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	102
PID 3980 wrote to memory of 1128	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	103
PID 3980 wrote to memory of 1128	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	103
PID 3980 wrote to memory of 4416	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	104
PID 3980 wrote to memory of 4416	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	104
PID 3980 wrote to memory of 1668	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	105
PID 3980 wrote to memory of 1668	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	105
PID 3980 wrote to memory of 3736	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	106
PID 3980 wrote to memory of 3736	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	106
PID 3980 wrote to memory of 2976	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	107
PID 3980 wrote to memory of 2976	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	107
PID 3980 wrote to memory of 464	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	108
PID 3980 wrote to memory of 464	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	108
PID 3980 wrote to memory of 432	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	109
PID 3980 wrote to memory of 432	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	109
PID 3980 wrote to memory of 772	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	110
PID 3980 wrote to memory of 772	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	110
PID 3980 wrote to memory of 912	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	111
PID 3980 wrote to memory of 912	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	111
PID 3980 wrote to memory of 4832	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	112
PID 3980 wrote to memory of 4832	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	112
PID 3980 wrote to memory of 3900	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	113
PID 3980 wrote to memory of 3900	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	113
PID 3980 wrote to memory of 2436	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	114
PID 3980 wrote to memory of 2436	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	114
PID 3980 wrote to memory of 4160	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	115
PID 3980 wrote to memory of 4160	3980	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1080
- C:\Windows\System\gRdYiGG.exe
  C:\Windows\System\gRdYiGG.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\dzWRXAN.exe
  C:\Windows\System\dzWRXAN.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\bCyAWSQ.exe
  C:\Windows\System\bCyAWSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\YpTxFvm.exe
  C:\Windows\System\YpTxFvm.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\aiSjrrz.exe
  C:\Windows\System\aiSjrrz.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\BJxhSdR.exe
  C:\Windows\System\BJxhSdR.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\XYXHJVt.exe
  C:\Windows\System\XYXHJVt.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\ghNDtbo.exe
  C:\Windows\System\ghNDtbo.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\VsLVVhe.exe
  C:\Windows\System\VsLVVhe.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\JvibCph.exe
  C:\Windows\System\JvibCph.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\LmaTEmf.exe
  C:\Windows\System\LmaTEmf.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\zegxSyt.exe
  C:\Windows\System\zegxSyt.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\GWzHtru.exe
  C:\Windows\System\GWzHtru.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\OZQhxzb.exe
  C:\Windows\System\OZQhxzb.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\tYSgwKs.exe
  C:\Windows\System\tYSgwKs.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\JRDcvXS.exe
  C:\Windows\System\JRDcvXS.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\qVKofDH.exe
  C:\Windows\System\qVKofDH.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\KQnbRdc.exe
  C:\Windows\System\KQnbRdc.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\FWkmPDx.exe
  C:\Windows\System\FWkmPDx.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\ocToYLQ.exe
  C:\Windows\System\ocToYLQ.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\hFmhSbW.exe
  C:\Windows\System\hFmhSbW.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\kIeYYJU.exe
  C:\Windows\System\kIeYYJU.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\LigcyjJ.exe
  C:\Windows\System\LigcyjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\nxspQVP.exe
  C:\Windows\System\nxspQVP.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\IPsIDDG.exe
  C:\Windows\System\IPsIDDG.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\PZRxGAa.exe
  C:\Windows\System\PZRxGAa.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\vZwwWCm.exe
  C:\Windows\System\vZwwWCm.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\bVsxiBD.exe
  C:\Windows\System\bVsxiBD.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\fHfQKYr.exe
  C:\Windows\System\fHfQKYr.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\TEJNxoD.exe
  C:\Windows\System\TEJNxoD.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\urOVyyd.exe
  C:\Windows\System\urOVyyd.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\ZMSSKfz.exe
  C:\Windows\System\ZMSSKfz.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\cllMdMS.exe
  C:\Windows\System\cllMdMS.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\tpVVELo.exe
  C:\Windows\System\tpVVELo.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\faeDgZn.exe
  C:\Windows\System\faeDgZn.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\XLIDXOO.exe
  C:\Windows\System\XLIDXOO.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\CaFRreh.exe
  C:\Windows\System\CaFRreh.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\yaZqOYC.exe
  C:\Windows\System\yaZqOYC.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\iVGULRD.exe
  C:\Windows\System\iVGULRD.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\wsVQZba.exe
  C:\Windows\System\wsVQZba.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\rhRUSCU.exe
  C:\Windows\System\rhRUSCU.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\bYTNGqF.exe
  C:\Windows\System\bYTNGqF.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\GvbbiGV.exe
  C:\Windows\System\GvbbiGV.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\QwBvKnx.exe
  C:\Windows\System\QwBvKnx.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\HQJOYCe.exe
  C:\Windows\System\HQJOYCe.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\oRdiynO.exe
  C:\Windows\System\oRdiynO.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\XdsHZrG.exe
  C:\Windows\System\XdsHZrG.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\BKqjMEB.exe
  C:\Windows\System\BKqjMEB.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\qIIcRHK.exe
  C:\Windows\System\qIIcRHK.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\OjEIxYi.exe
  C:\Windows\System\OjEIxYi.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\pxcqVYI.exe
  C:\Windows\System\pxcqVYI.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\EOxMiuL.exe
  C:\Windows\System\EOxMiuL.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\PAOBBzX.exe
  C:\Windows\System\PAOBBzX.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\RhLIjnD.exe
  C:\Windows\System\RhLIjnD.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\LQpMXjl.exe
  C:\Windows\System\LQpMXjl.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\HOnLnYF.exe
  C:\Windows\System\HOnLnYF.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\pZCFFSp.exe
  C:\Windows\System\pZCFFSp.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\jcLsnqA.exe
  C:\Windows\System\jcLsnqA.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\sVqZJCi.exe
  C:\Windows\System\sVqZJCi.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\PjIzgkU.exe
  C:\Windows\System\PjIzgkU.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\DWUTfHC.exe
  C:\Windows\System\DWUTfHC.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\mXIlSlJ.exe
  C:\Windows\System\mXIlSlJ.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System\BMyUjth.exe
  C:\Windows\System\BMyUjth.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\MsDLedd.exe
  C:\Windows\System\MsDLedd.exe
  2⤵
  - Executes dropped EXE
  PID:5280
- C:\Windows\System\JYduwnI.exe
  C:\Windows\System\JYduwnI.exe
  2⤵
  PID:5312
- C:\Windows\System\pfyQDXI.exe
  C:\Windows\System\pfyQDXI.exe
  2⤵
  PID:5340
- C:\Windows\System\XqlAEhG.exe
  C:\Windows\System\XqlAEhG.exe
  2⤵
  PID:5368
- C:\Windows\System\aJPvRHf.exe
  C:\Windows\System\aJPvRHf.exe
  2⤵
  PID:5396
- C:\Windows\System\wBxbNNz.exe
  C:\Windows\System\wBxbNNz.exe
  2⤵
  PID:5424
- C:\Windows\System\woYAttV.exe
  C:\Windows\System\woYAttV.exe
  2⤵
  PID:5460
- C:\Windows\System\KMQqgQt.exe
  C:\Windows\System\KMQqgQt.exe
  2⤵
  PID:5488
- C:\Windows\System\rqutGmL.exe
  C:\Windows\System\rqutGmL.exe
  2⤵
  PID:5516
- C:\Windows\System\XIvvrFR.exe
  C:\Windows\System\XIvvrFR.exe
  2⤵
  PID:5564
- C:\Windows\System\FjPamme.exe
  C:\Windows\System\FjPamme.exe
  2⤵
  PID:5592
- C:\Windows\System\XUdEdNb.exe
  C:\Windows\System\XUdEdNb.exe
  2⤵
  PID:5616
- C:\Windows\System\OtUkNXj.exe
  C:\Windows\System\OtUkNXj.exe
  2⤵
  PID:5640
- C:\Windows\System\jSdkZnX.exe
  C:\Windows\System\jSdkZnX.exe
  2⤵
  PID:5664
- C:\Windows\System\cwjWDZH.exe
  C:\Windows\System\cwjWDZH.exe
  2⤵
  PID:5692
- C:\Windows\System\yHhmIfX.exe
  C:\Windows\System\yHhmIfX.exe
  2⤵
  PID:5716
- C:\Windows\System\lpLelvx.exe
  C:\Windows\System\lpLelvx.exe
  2⤵
  PID:5744
- C:\Windows\System\yFvslNQ.exe
  C:\Windows\System\yFvslNQ.exe
  2⤵
  PID:5772
- C:\Windows\System\YqyIxio.exe
  C:\Windows\System\YqyIxio.exe
  2⤵
  PID:5800
- C:\Windows\System\gbkCDXy.exe
  C:\Windows\System\gbkCDXy.exe
  2⤵
  PID:5852
- C:\Windows\System\KftSWrV.exe
  C:\Windows\System\KftSWrV.exe
  2⤵
  PID:5880
- C:\Windows\System\fleXKWe.exe
  C:\Windows\System\fleXKWe.exe
  2⤵
  PID:5908
- C:\Windows\System\tYypozT.exe
  C:\Windows\System\tYypozT.exe
  2⤵
  PID:5948
- C:\Windows\System\tsvvaYd.exe
  C:\Windows\System\tsvvaYd.exe
  2⤵
  PID:5980
- C:\Windows\System\OcMSsOg.exe
  C:\Windows\System\OcMSsOg.exe
  2⤵
  PID:6012
- C:\Windows\System\uBqCbGt.exe
  C:\Windows\System\uBqCbGt.exe
  2⤵
  PID:6044
- C:\Windows\System\mzewqMN.exe
  C:\Windows\System\mzewqMN.exe
  2⤵
  PID:6072
- C:\Windows\System\tSDZPcg.exe
  C:\Windows\System\tSDZPcg.exe
  2⤵
  PID:6104
- C:\Windows\System\JOJIzpQ.exe
  C:\Windows\System\JOJIzpQ.exe
  2⤵
  PID:6160
- C:\Windows\System\FkNvAuB.exe
  C:\Windows\System\FkNvAuB.exe
  2⤵
  PID:6188
- C:\Windows\System\JRNutJk.exe
  C:\Windows\System\JRNutJk.exe
  2⤵
  PID:6240
- C:\Windows\System\CoqkbkD.exe
  C:\Windows\System\CoqkbkD.exe
  2⤵
  PID:6272
- C:\Windows\System\WscyOgq.exe
  C:\Windows\System\WscyOgq.exe
  2⤵
  PID:6316
- C:\Windows\System\wURpeSE.exe
  C:\Windows\System\wURpeSE.exe
  2⤵
  PID:6348
- C:\Windows\System\tGNkFgo.exe
  C:\Windows\System\tGNkFgo.exe
  2⤵
  PID:6376
- C:\Windows\System\HolafzF.exe
  C:\Windows\System\HolafzF.exe
  2⤵
  PID:6404
- C:\Windows\System\HjzQujy.exe
  C:\Windows\System\HjzQujy.exe
  2⤵
  PID:6452
- C:\Windows\System\ulJywYE.exe
  C:\Windows\System\ulJywYE.exe
  2⤵
  PID:6480
- C:\Windows\System\rZvDUtW.exe
  C:\Windows\System\rZvDUtW.exe
  2⤵
  PID:6508
- C:\Windows\System\xDQRfTB.exe
  C:\Windows\System\xDQRfTB.exe
  2⤵
  PID:6560
- C:\Windows\System\DXmSjom.exe
  C:\Windows\System\DXmSjom.exe
  2⤵
  PID:6588
- C:\Windows\System\RUiLJmp.exe
  C:\Windows\System\RUiLJmp.exe
  2⤵
  PID:6616
- C:\Windows\System\tXehFMV.exe
  C:\Windows\System\tXehFMV.exe
  2⤵
  PID:6668
- C:\Windows\System\okgOOtg.exe
  C:\Windows\System\okgOOtg.exe
  2⤵
  PID:6696
- C:\Windows\System\DhCKLzF.exe
  C:\Windows\System\DhCKLzF.exe
  2⤵
  PID:6724
- C:\Windows\System\DUwHsRE.exe
  C:\Windows\System\DUwHsRE.exe
  2⤵
  PID:6776
- C:\Windows\System\avFhidg.exe
  C:\Windows\System\avFhidg.exe
  2⤵
  PID:6804
- C:\Windows\System\LwKjBFp.exe
  C:\Windows\System\LwKjBFp.exe
  2⤵
  PID:6844
- C:\Windows\System\LSkbZsf.exe
  C:\Windows\System\LSkbZsf.exe
  2⤵
  PID:6884
- C:\Windows\System\QgzgLPj.exe
  C:\Windows\System\QgzgLPj.exe
  2⤵
  PID:6964
- C:\Windows\System\rSDQFfU.exe
  C:\Windows\System\rSDQFfU.exe
  2⤵
  PID:6992
- C:\Windows\System\wfrKxWf.exe
  C:\Windows\System\wfrKxWf.exe
  2⤵
  PID:7016
- C:\Windows\System\cavQgOw.exe
  C:\Windows\System\cavQgOw.exe
  2⤵
  PID:6656
- C:\Windows\System\jUZwLzH.exe
  C:\Windows\System\jUZwLzH.exe
  2⤵
  PID:6068
- C:\Windows\System\YVSYixa.exe
  C:\Windows\System\YVSYixa.exe
  2⤵
  PID:1032
- C:\Windows\System\JFJMRDv.exe
  C:\Windows\System\JFJMRDv.exe
  2⤵
  PID:6008
- C:\Windows\System\WuvLLUz.exe
  C:\Windows\System\WuvLLUz.exe
  2⤵
  PID:5968
- C:\Windows\System\LFkPrty.exe
  C:\Windows\System\LFkPrty.exe
  2⤵
  PID:5900
- C:\Windows\System\PuWcyuG.exe
  C:\Windows\System\PuWcyuG.exe
  2⤵
  PID:5828
- C:\Windows\System\DxHwNVn.exe
  C:\Windows\System\DxHwNVn.exe
  2⤵
  PID:5812
- C:\Windows\System\haWaTbv.exe
  C:\Windows\System\haWaTbv.exe
  2⤵
  PID:5768
- C:\Windows\System\ZMJrOsC.exe
  C:\Windows\System\ZMJrOsC.exe
  2⤵
  PID:5608
- C:\Windows\System\wmFXIxj.exe
  C:\Windows\System\wmFXIxj.exe
  2⤵
  PID:5576
- C:\Windows\System\LoRuMkn.exe
  C:\Windows\System\LoRuMkn.exe
  2⤵
  PID:5532
- C:\Windows\System\aUzFgrj.exe
  C:\Windows\System\aUzFgrj.exe
  2⤵
  PID:5436
- C:\Windows\System\sMvShOy.exe
  C:\Windows\System\sMvShOy.exe
  2⤵
  PID:5384
- C:\Windows\System\RZRxZaQ.exe
  C:\Windows\System\RZRxZaQ.exe
  2⤵
  PID:5352
- C:\Windows\System\LCfrcJx.exe
  C:\Windows\System\LCfrcJx.exe
  2⤵
  PID:1504
- C:\Windows\System\plhmbtf.exe
  C:\Windows\System\plhmbtf.exe
  2⤵
  PID:5248
- C:\Windows\System\OfnykjB.exe
  C:\Windows\System\OfnykjB.exe
  2⤵
  PID:5212
- C:\Windows\System\HTOMoHh.exe
  C:\Windows\System\HTOMoHh.exe
  2⤵
  PID:5140
- C:\Windows\System\VpDnGZN.exe
  C:\Windows\System\VpDnGZN.exe
  2⤵
  PID:3940
- C:\Windows\System\JKvnQlQ.exe
  C:\Windows\System\JKvnQlQ.exe
  2⤵
  PID:4928
- C:\Windows\System\WdZDoZk.exe
  C:\Windows\System\WdZDoZk.exe
  2⤵
  PID:3560
- C:\Windows\System\JRQAnzR.exe
  C:\Windows\System\JRQAnzR.exe
  2⤵
  PID:3532
- C:\Windows\System\fMMhEJZ.exe
  C:\Windows\System\fMMhEJZ.exe
  2⤵
  PID:508
- C:\Windows\System\xcCBXio.exe
  C:\Windows\System\xcCBXio.exe
  2⤵
  PID:1996
- C:\Windows\System\DQorpgV.exe
  C:\Windows\System\DQorpgV.exe
  2⤵
  PID:2252
- C:\Windows\System\rfgetzw.exe
  C:\Windows\System\rfgetzw.exe
  2⤵
  PID:4792
- C:\Windows\System\MnudsGD.exe
  C:\Windows\System\MnudsGD.exe
  2⤵
  PID:4488
- C:\Windows\System\RYvnUzG.exe
  C:\Windows\System\RYvnUzG.exe
  2⤵
  PID:4516
- C:\Windows\System\uFdrPnR.exe
  C:\Windows\System\uFdrPnR.exe
  2⤵
  PID:2120
- C:\Windows\System\oGcdOMC.exe
  C:\Windows\System\oGcdOMC.exe
  2⤵
  PID:6736
- C:\Windows\System\fiveLbp.exe
  C:\Windows\System\fiveLbp.exe
  2⤵
  PID:6768
- C:\Windows\System\KuSezxz.exe
  C:\Windows\System\KuSezxz.exe
  2⤵
  PID:6824
- C:\Windows\System\wEjwfZZ.exe
  C:\Windows\System\wEjwfZZ.exe
  2⤵
  PID:6792
- C:\Windows\System\OEkwTbe.exe
  C:\Windows\System\OEkwTbe.exe
  2⤵
  PID:6880
- C:\Windows\System\fXsTZgB.exe
  C:\Windows\System\fXsTZgB.exe
  2⤵
  PID:6932
- C:\Windows\System\dxYDdLO.exe
  C:\Windows\System\dxYDdLO.exe
  2⤵
  PID:7036
- C:\Windows\System\EQVVSwI.exe
  C:\Windows\System\EQVVSwI.exe
  2⤵
  PID:7064
- C:\Windows\System\PUPeUdz.exe
  C:\Windows\System\PUPeUdz.exe
  2⤵
  PID:7096
- C:\Windows\System\ehSayDo.exe
  C:\Windows\System\ehSayDo.exe
  2⤵
  PID:7148
- C:\Windows\System\DEknrLd.exe
  C:\Windows\System\DEknrLd.exe
  2⤵
  PID:7164
- C:\Windows\System\GvyKQpd.exe
  C:\Windows\System\GvyKQpd.exe
  2⤵
  PID:6644
- C:\Windows\System\DGbNBNw.exe
  C:\Windows\System\DGbNBNw.exe
  2⤵
  PID:6604
- C:\Windows\System\qJnywBp.exe
  C:\Windows\System\qJnywBp.exe
  2⤵
  PID:6552
- C:\Windows\System\NICdkKQ.exe
  C:\Windows\System\NICdkKQ.exe
  2⤵
  PID:6540
- C:\Windows\System\toyoDzi.exe
  C:\Windows\System\toyoDzi.exe
  2⤵
  PID:6520
- C:\Windows\System\RyAJsul.exe
  C:\Windows\System\RyAJsul.exe
  2⤵
  PID:6328
- C:\Windows\System\fcjhbRW.exe
  C:\Windows\System\fcjhbRW.exe
  2⤵
  PID:6428
- C:\Windows\System\NvMNgLj.exe
  C:\Windows\System\NvMNgLj.exe
  2⤵
  PID:4472
- C:\Windows\System\BOazZCB.exe
  C:\Windows\System\BOazZCB.exe
  2⤵
  PID:6432
- C:\Windows\System\VFAfqdG.exe
  C:\Windows\System\VFAfqdG.exe
  2⤵
  PID:6100
- C:\Windows\System\FGgKbUv.exe
  C:\Windows\System\FGgKbUv.exe
  2⤵
  PID:2264
- C:\Windows\System\AnYjRZA.exe
  C:\Windows\System\AnYjRZA.exe
  2⤵
  PID:6088
- C:\Windows\System\FfNEsBi.exe
  C:\Windows\System\FfNEsBi.exe
  2⤵
  PID:6392
- C:\Windows\System\GFJRhBL.exe
  C:\Windows\System\GFJRhBL.exe
  2⤵
  PID:5904
- C:\Windows\System\NkFEnZJ.exe
  C:\Windows\System\NkFEnZJ.exe
  2⤵
  PID:5844
- C:\Windows\System\ruMMWBM.exe
  C:\Windows\System\ruMMWBM.exe
  2⤵
  PID:5708
- C:\Windows\System\rIqmdEY.exe
  C:\Windows\System\rIqmdEY.exe
  2⤵
  PID:5500
- C:\Windows\System\WhjZhSK.exe
  C:\Windows\System\WhjZhSK.exe
  2⤵
  PID:5328
- C:\Windows\System\YUPJBFd.exe
  C:\Windows\System\YUPJBFd.exe
  2⤵
  PID:5388
- C:\Windows\System\gPauylz.exe
  C:\Windows\System\gPauylz.exe
  2⤵
  PID:5188
- C:\Windows\System\ktphgNA.exe
  C:\Windows\System\ktphgNA.exe
  2⤵
  PID:3400
- C:\Windows\System\fYKRPXD.exe
  C:\Windows\System\fYKRPXD.exe
  2⤵
  PID:3668
- C:\Windows\System\aTDSagP.exe
  C:\Windows\System\aTDSagP.exe
  2⤵
  PID:412
- C:\Windows\System\mJDjMGO.exe
  C:\Windows\System\mJDjMGO.exe
  2⤵
  PID:4632
- C:\Windows\System\qCTvDew.exe
  C:\Windows\System\qCTvDew.exe
  2⤵
  PID:3300
- C:\Windows\System\UuEaVXu.exe
  C:\Windows\System\UuEaVXu.exe
  2⤵
  PID:4708
- C:\Windows\System\sSHdmLF.exe
  C:\Windows\System\sSHdmLF.exe
  2⤵
  PID:3952
- C:\Windows\System\gwHgpAn.exe
  C:\Windows\System\gwHgpAn.exe
  2⤵
  PID:1944
- C:\Windows\System\qWJnDWL.exe
  C:\Windows\System\qWJnDWL.exe
  2⤵
  PID:6860
- C:\Windows\System\CmBEbfT.exe
  C:\Windows\System\CmBEbfT.exe
  2⤵
  PID:7080
- C:\Windows\System\SfkeuUv.exe
  C:\Windows\System\SfkeuUv.exe
  2⤵
  PID:1136
- C:\Windows\System\gaqrwsz.exe
  C:\Windows\System\gaqrwsz.exe
  2⤵
  PID:7144
- C:\Windows\System\tpqFzRj.exe
  C:\Windows\System\tpqFzRj.exe
  2⤵
  PID:6648
- C:\Windows\System\PWwHMUy.exe
  C:\Windows\System\PWwHMUy.exe
  2⤵
  PID:6420
- C:\Windows\System\uVlaIyC.exe
  C:\Windows\System\uVlaIyC.exe
  2⤵
  PID:6468
- C:\Windows\System\bHvqAJE.exe
  C:\Windows\System\bHvqAJE.exe
  2⤵
  PID:6476
- C:\Windows\System\jMAjJQE.exe
  C:\Windows\System\jMAjJQE.exe
  2⤵
  PID:4356
- C:\Windows\System\wrmncfD.exe
  C:\Windows\System\wrmncfD.exe
  2⤵
  PID:5684
- C:\Windows\System\KEeFMGX.exe
  C:\Windows\System\KEeFMGX.exe
  2⤵
  PID:5584
- C:\Windows\System\ZiGnkes.exe
  C:\Windows\System\ZiGnkes.exe
  2⤵
  PID:1652
- C:\Windows\System\acGREus.exe
  C:\Windows\System\acGREus.exe
  2⤵
  PID:5220
- C:\Windows\System\gvealEi.exe
  C:\Windows\System\gvealEi.exe
  2⤵
  PID:1356
- C:\Windows\System\dOYOqNO.exe
  C:\Windows\System\dOYOqNO.exe
  2⤵
  PID:6952
- C:\Windows\System\OQMwPtn.exe
  C:\Windows\System\OQMwPtn.exe
  2⤵
  PID:4700
- C:\Windows\System\qKqwEKf.exe
  C:\Windows\System\qKqwEKf.exe
  2⤵
  PID:3220
- C:\Windows\System\ImBxaVz.exe
  C:\Windows\System\ImBxaVz.exe
  2⤵
  PID:6796
- C:\Windows\System\xbzFjld.exe
  C:\Windows\System\xbzFjld.exe
  2⤵
  PID:6904
- C:\Windows\System\OkRXYod.exe
  C:\Windows\System\OkRXYod.exe
  2⤵
  PID:6660
- C:\Windows\System\uoGvnVy.exe
  C:\Windows\System\uoGvnVy.exe
  2⤵
  PID:6548
- C:\Windows\System\wbGHWyo.exe
  C:\Windows\System\wbGHWyo.exe
  2⤵
  PID:6448
- C:\Windows\System\LUJdfQS.exe
  C:\Windows\System\LUJdfQS.exe
  2⤵
  PID:6024
- C:\Windows\System\IJHEExV.exe
  C:\Windows\System\IJHEExV.exe
  2⤵
  PID:5788
- C:\Windows\System\cPayoKa.exe
  C:\Windows\System\cPayoKa.exe
  2⤵
  PID:1184
- C:\Windows\System\IxslYea.exe
  C:\Windows\System\IxslYea.exe
  2⤵
  PID:2860
- C:\Windows\System\szTVFUT.exe
  C:\Windows\System\szTVFUT.exe
  2⤵
  PID:2632
- C:\Windows\System\qHJjXRp.exe
  C:\Windows\System\qHJjXRp.exe
  2⤵
  PID:6608
- C:\Windows\System\oJflqxF.exe
  C:\Windows\System\oJflqxF.exe
  2⤵
  PID:6504
- C:\Windows\System\hNVkpSx.exe
  C:\Windows\System\hNVkpSx.exe
  2⤵
  PID:6212
- C:\Windows\System\HKKVMPJ.exe
  C:\Windows\System\HKKVMPJ.exe
  2⤵
  PID:5296
- C:\Windows\System\vhBjsFf.exe
  C:\Windows\System\vhBjsFf.exe
  2⤵
  PID:4976
- C:\Windows\System\QEzKsMf.exe
  C:\Windows\System\QEzKsMf.exe
  2⤵
  PID:7112
- C:\Windows\System\QzdznaX.exe
  C:\Windows\System\QzdznaX.exe
  2⤵
  PID:2684
- C:\Windows\System\uvWSlbX.exe
  C:\Windows\System\uvWSlbX.exe
  2⤵
  PID:1140
- C:\Windows\System\DqpJuvb.exe
  C:\Windows\System\DqpJuvb.exe
  2⤵
  PID:7172
- C:\Windows\System\GmDsFgc.exe
  C:\Windows\System\GmDsFgc.exe
  2⤵
  PID:7192
- C:\Windows\System\vFABnjM.exe
  C:\Windows\System\vFABnjM.exe
  2⤵
  PID:7216
- C:\Windows\System\UGfRoIU.exe
  C:\Windows\System\UGfRoIU.exe
  2⤵
  PID:7232
- C:\Windows\System\gZAYOoc.exe
  C:\Windows\System\gZAYOoc.exe
  2⤵
  PID:7260
- C:\Windows\System\nYdIWyM.exe
  C:\Windows\System\nYdIWyM.exe
  2⤵
  PID:7292
- C:\Windows\System\bUNiPFd.exe
  C:\Windows\System\bUNiPFd.exe
  2⤵
  PID:7356
- C:\Windows\System\RPqLYsB.exe
  C:\Windows\System\RPqLYsB.exe
  2⤵
  PID:7372
- C:\Windows\System\vBbZVFL.exe
  C:\Windows\System\vBbZVFL.exe
  2⤵
  PID:7396
- C:\Windows\System\HSWEDVE.exe
  C:\Windows\System\HSWEDVE.exe
  2⤵
  PID:7416
- C:\Windows\System\wpjXXAD.exe
  C:\Windows\System\wpjXXAD.exe
  2⤵
  PID:7444
- C:\Windows\System\qRPCNTp.exe
  C:\Windows\System\qRPCNTp.exe
  2⤵
  PID:7504
- C:\Windows\System\BHRVJwE.exe
  C:\Windows\System\BHRVJwE.exe
  2⤵
  PID:7524
- C:\Windows\System\qiHySqP.exe
  C:\Windows\System\qiHySqP.exe
  2⤵
  PID:7544
- C:\Windows\System\jVwYyIb.exe
  C:\Windows\System\jVwYyIb.exe
  2⤵
  PID:7572
- C:\Windows\System\ZOfWVqk.exe
  C:\Windows\System\ZOfWVqk.exe
  2⤵
  PID:7596
- C:\Windows\System\IBtPpLP.exe
  C:\Windows\System\IBtPpLP.exe
  2⤵
  PID:7652
- C:\Windows\System\qSUmnzZ.exe
  C:\Windows\System\qSUmnzZ.exe
  2⤵
  PID:7668
- C:\Windows\System\LrDPrBp.exe
  C:\Windows\System\LrDPrBp.exe
  2⤵
  PID:7692
- C:\Windows\System\uVlcfss.exe
  C:\Windows\System\uVlcfss.exe
  2⤵
  PID:7712
- C:\Windows\System\gYsVZzl.exe
  C:\Windows\System\gYsVZzl.exe
  2⤵
  PID:7732
- C:\Windows\System\cuNvFOF.exe
  C:\Windows\System\cuNvFOF.exe
  2⤵
  PID:7800
- C:\Windows\System\OwtBmQQ.exe
  C:\Windows\System\OwtBmQQ.exe
  2⤵
  PID:7820
- C:\Windows\System\ESfpsAR.exe
  C:\Windows\System\ESfpsAR.exe
  2⤵
  PID:7856
- C:\Windows\System\FKgaAUf.exe
  C:\Windows\System\FKgaAUf.exe
  2⤵
  PID:7876
- C:\Windows\System\EiiqgrH.exe
  C:\Windows\System\EiiqgrH.exe
  2⤵
  PID:7904
- C:\Windows\System\aTrJrjR.exe
  C:\Windows\System\aTrJrjR.exe
  2⤵
  PID:7932
- C:\Windows\System\ADfrWpY.exe
  C:\Windows\System\ADfrWpY.exe
  2⤵
  PID:7960
- C:\Windows\System\SZwgEko.exe
  C:\Windows\System\SZwgEko.exe
  2⤵
  PID:7976
- C:\Windows\System\CwoRHWc.exe
  C:\Windows\System\CwoRHWc.exe
  2⤵
  PID:8000
- C:\Windows\System\IcVvAdm.exe
  C:\Windows\System\IcVvAdm.exe
  2⤵
  PID:8020
- C:\Windows\System\gwCMwzs.exe
  C:\Windows\System\gwCMwzs.exe
  2⤵
  PID:8040
- C:\Windows\System\AuZNQgi.exe
  C:\Windows\System\AuZNQgi.exe
  2⤵
  PID:8084
- C:\Windows\System\JNwbEer.exe
  C:\Windows\System\JNwbEer.exe
  2⤵
  PID:8104
- C:\Windows\System\vXmQIOY.exe
  C:\Windows\System\vXmQIOY.exe
  2⤵
  PID:8148
- C:\Windows\System\bvgofjA.exe
  C:\Windows\System\bvgofjA.exe
  2⤵
  PID:8176
- C:\Windows\System\zYvntkb.exe
  C:\Windows\System\zYvntkb.exe
  2⤵
  PID:860
- C:\Windows\System\EoqfUFy.exe
  C:\Windows\System\EoqfUFy.exe
  2⤵
  PID:7184
- C:\Windows\System\mOWYJYo.exe
  C:\Windows\System\mOWYJYo.exe
  2⤵
  PID:7280
- C:\Windows\System\IoIEKML.exe
  C:\Windows\System\IoIEKML.exe
  2⤵
  PID:7380
- C:\Windows\System\DEkJdBR.exe
  C:\Windows\System\DEkJdBR.exe
  2⤵
  PID:7352
- C:\Windows\System\GroLddy.exe
  C:\Windows\System\GroLddy.exe
  2⤵
  PID:7440
- C:\Windows\System\tLQyWoG.exe
  C:\Windows\System\tLQyWoG.exe
  2⤵
  PID:7476
- C:\Windows\System\fTUCuca.exe
  C:\Windows\System\fTUCuca.exe
  2⤵
  PID:7540
- C:\Windows\System\yMiFPGw.exe
  C:\Windows\System\yMiFPGw.exe
  2⤵
  PID:7636
- C:\Windows\System\EcIXQbz.exe
  C:\Windows\System\EcIXQbz.exe
  2⤵
  PID:7708
- C:\Windows\System\CdDTdcW.exe
  C:\Windows\System\CdDTdcW.exe
  2⤵
  PID:7724
- C:\Windows\System\DRXJsSn.exe
  C:\Windows\System\DRXJsSn.exe
  2⤵
  PID:7752
- C:\Windows\System\zkzLMVD.exe
  C:\Windows\System\zkzLMVD.exe
  2⤵
  PID:7780
- C:\Windows\System\dIUqejF.exe
  C:\Windows\System\dIUqejF.exe
  2⤵
  PID:7852
- C:\Windows\System\tgLJpER.exe
  C:\Windows\System\tgLJpER.exe
  2⤵
  PID:7916
- C:\Windows\System\wtHvhgO.exe
  C:\Windows\System\wtHvhgO.exe
  2⤵
  PID:8016
- C:\Windows\System\qRnlBzD.exe
  C:\Windows\System\qRnlBzD.exe
  2⤵
  PID:8032
- C:\Windows\System\bEVAoNv.exe
  C:\Windows\System\bEVAoNv.exe
  2⤵
  PID:8140
- C:\Windows\System\GWzFkRx.exe
  C:\Windows\System\GWzFkRx.exe
  2⤵
  PID:2008
- C:\Windows\System\ZPjlcqC.exe
  C:\Windows\System\ZPjlcqC.exe
  2⤵
  PID:7208
- C:\Windows\System\cIGVLZS.exe
  C:\Windows\System\cIGVLZS.exe
  2⤵
  PID:7316
- C:\Windows\System\MFkVJeX.exe
  C:\Windows\System\MFkVJeX.exe
  2⤵
  PID:5088
- C:\Windows\System\xjneCLV.exe
  C:\Windows\System\xjneCLV.exe
  2⤵
  PID:7784
- C:\Windows\System\QejYqIB.exe
  C:\Windows\System\QejYqIB.exe
  2⤵
  PID:7872
- C:\Windows\System\sXJfrAS.exe
  C:\Windows\System\sXJfrAS.exe
  2⤵
  PID:8160
- C:\Windows\System\NQXQRvn.exe
  C:\Windows\System\NQXQRvn.exe
  2⤵
  PID:7480
- C:\Windows\System\wNWsDoB.exe
  C:\Windows\System\wNWsDoB.exe
  2⤵
  PID:7988
- C:\Windows\System\ibxuOTf.exe
  C:\Windows\System\ibxuOTf.exe
  2⤵
  PID:7452
- C:\Windows\System\AwxIAPg.exe
  C:\Windows\System\AwxIAPg.exe
  2⤵
  PID:1508
- C:\Windows\System\tfRbzwk.exe
  C:\Windows\System\tfRbzwk.exe
  2⤵
  PID:8204
- C:\Windows\System\swSXgMZ.exe
  C:\Windows\System\swSXgMZ.exe
  2⤵
  PID:8236
- C:\Windows\System\LgJxfGb.exe
  C:\Windows\System\LgJxfGb.exe
  2⤵
  PID:8260
- C:\Windows\System\OizzxDO.exe
  C:\Windows\System\OizzxDO.exe
  2⤵
  PID:8280
- C:\Windows\System\aNjChoW.exe
  C:\Windows\System\aNjChoW.exe
  2⤵
  PID:8308
- C:\Windows\System\AJRTQIL.exe
  C:\Windows\System\AJRTQIL.exe
  2⤵
  PID:8324
- C:\Windows\System\yRlyuIG.exe
  C:\Windows\System\yRlyuIG.exe
  2⤵
  PID:8348
- C:\Windows\System\fTtCBSo.exe
  C:\Windows\System\fTtCBSo.exe
  2⤵
  PID:8388
- C:\Windows\System\EgbozRd.exe
  C:\Windows\System\EgbozRd.exe
  2⤵
  PID:8408
- C:\Windows\System\wqMmwxr.exe
  C:\Windows\System\wqMmwxr.exe
  2⤵
  PID:8444
- C:\Windows\System\MdLbGZA.exe
  C:\Windows\System\MdLbGZA.exe
  2⤵
  PID:8472
- C:\Windows\System\xVPqijP.exe
  C:\Windows\System\xVPqijP.exe
  2⤵
  PID:8516
- C:\Windows\System\AHuWDJR.exe
  C:\Windows\System\AHuWDJR.exe
  2⤵
  PID:8592
- C:\Windows\System\GvYQUDq.exe
  C:\Windows\System\GvYQUDq.exe
  2⤵
  PID:8612
- C:\Windows\System\wLkUkTp.exe
  C:\Windows\System\wLkUkTp.exe
  2⤵
  PID:8628
- C:\Windows\System\CfwvTHz.exe
  C:\Windows\System\CfwvTHz.exe
  2⤵
  PID:8664
- C:\Windows\System\cXXJTPG.exe
  C:\Windows\System\cXXJTPG.exe
  2⤵
  PID:8680
- C:\Windows\System\RmlyYec.exe
  C:\Windows\System\RmlyYec.exe
  2⤵
  PID:8700
- C:\Windows\System\pSyJxyM.exe
  C:\Windows\System\pSyJxyM.exe
  2⤵
  PID:8720
- C:\Windows\System\kDqEUBu.exe
  C:\Windows\System\kDqEUBu.exe
  2⤵
  PID:8748
- C:\Windows\System\RJPAJmK.exe
  C:\Windows\System\RJPAJmK.exe
  2⤵
  PID:8776
- C:\Windows\System\wbgpKqw.exe
  C:\Windows\System\wbgpKqw.exe
  2⤵
  PID:8800
- C:\Windows\System\MMPIoYO.exe
  C:\Windows\System\MMPIoYO.exe
  2⤵
  PID:8820
- C:\Windows\System\djQIzgx.exe
  C:\Windows\System\djQIzgx.exe
  2⤵
  PID:8888
- C:\Windows\System\xuVYRMZ.exe
  C:\Windows\System\xuVYRMZ.exe
  2⤵
  PID:8912
- C:\Windows\System\MVBWsOw.exe
  C:\Windows\System\MVBWsOw.exe
  2⤵
  PID:8940
- C:\Windows\System\eVREaeq.exe
  C:\Windows\System\eVREaeq.exe
  2⤵
  PID:8964
- C:\Windows\System\eJEYwNY.exe
  C:\Windows\System\eJEYwNY.exe
  2⤵
  PID:8984
- C:\Windows\System\LbZUSMC.exe
  C:\Windows\System\LbZUSMC.exe
  2⤵
  PID:9012
- C:\Windows\System\OSoWGDj.exe
  C:\Windows\System\OSoWGDj.exe
  2⤵
  PID:9028
- C:\Windows\System\tgMOMoc.exe
  C:\Windows\System\tgMOMoc.exe
  2⤵
  PID:9060
- C:\Windows\System\WTJJwDq.exe
  C:\Windows\System\WTJJwDq.exe
  2⤵
  PID:9088
- C:\Windows\System\vbptvJQ.exe
  C:\Windows\System\vbptvJQ.exe
  2⤵
  PID:9124
- C:\Windows\System\Bohbnmf.exe
  C:\Windows\System\Bohbnmf.exe
  2⤵
  PID:9140
- C:\Windows\System\AalnCqr.exe
  C:\Windows\System\AalnCqr.exe
  2⤵
  PID:9200
- C:\Windows\System\bcfIXzo.exe
  C:\Windows\System\bcfIXzo.exe
  2⤵
  PID:4668
- C:\Windows\System\iqfrqIs.exe
  C:\Windows\System\iqfrqIs.exe
  2⤵
  PID:7896
- C:\Windows\System\ztKFiBj.exe
  C:\Windows\System\ztKFiBj.exe
  2⤵
  PID:8248
- C:\Windows\System\VDTJhap.exe
  C:\Windows\System\VDTJhap.exe
  2⤵
  PID:8332
- C:\Windows\System\RiZxpsF.exe
  C:\Windows\System\RiZxpsF.exe
  2⤵
  PID:8372
- C:\Windows\System\xtvmDpj.exe
  C:\Windows\System\xtvmDpj.exe
  2⤵
  PID:8376
- C:\Windows\System\YFQXtWq.exe
  C:\Windows\System\YFQXtWq.exe
  2⤵
  PID:8436
- C:\Windows\System\uyZoxhy.exe
  C:\Windows\System\uyZoxhy.exe
  2⤵
  PID:8512
- C:\Windows\System\WQvOJfE.exe
  C:\Windows\System\WQvOJfE.exe
  2⤵
  PID:8644
- C:\Windows\System\brpoGSO.exe
  C:\Windows\System\brpoGSO.exe
  2⤵
  PID:8712
- C:\Windows\System\bboTewT.exe
  C:\Windows\System\bboTewT.exe
  2⤵
  PID:8728
- C:\Windows\System\AdroNzD.exe
  C:\Windows\System\AdroNzD.exe
  2⤵
  PID:8788
- C:\Windows\System\mWXYsYg.exe
  C:\Windows\System\mWXYsYg.exe
  2⤵
  PID:8856
- C:\Windows\System\aibhCtK.exe
  C:\Windows\System\aibhCtK.exe
  2⤵
  PID:9152
- C:\Windows\System\EOqRUdW.exe
  C:\Windows\System\EOqRUdW.exe
  2⤵
  PID:3840
- C:\Windows\System\xymvqzO.exe
  C:\Windows\System\xymvqzO.exe
  2⤵
  PID:8268
- C:\Windows\System\PjgWvGO.exe
  C:\Windows\System\PjgWvGO.exe
  2⤵
  PID:8464
- C:\Windows\System\HrOPnSd.exe
  C:\Windows\System\HrOPnSd.exe
  2⤵
  PID:8452
- C:\Windows\System\YyCdspN.exe
  C:\Windows\System\YyCdspN.exe
  2⤵
  PID:8620
- C:\Windows\System\FuDbYck.exe
  C:\Windows\System\FuDbYck.exe
  2⤵
  PID:8716
- C:\Windows\System\yNNOFmg.exe
  C:\Windows\System\yNNOFmg.exe
  2⤵
  PID:8812
- C:\Windows\System\zgNFpTc.exe
  C:\Windows\System\zgNFpTc.exe
  2⤵
  PID:9184
- C:\Windows\System\adYWPLg.exe
  C:\Windows\System\adYWPLg.exe
  2⤵
  PID:9044
- C:\Windows\System\eCquXMG.exe
  C:\Windows\System\eCquXMG.exe
  2⤵
  PID:8216
- C:\Windows\System\coyLwcb.exe
  C:\Windows\System\coyLwcb.exe
  2⤵
  PID:8696
- C:\Windows\System\GlGQpZS.exe
  C:\Windows\System\GlGQpZS.exe
  2⤵
  PID:4532
- C:\Windows\System\LCENcWV.exe
  C:\Windows\System\LCENcWV.exe
  2⤵
  PID:8200
- C:\Windows\System\gKRJAbW.exe
  C:\Windows\System\gKRJAbW.exe
  2⤵
  PID:8936
- C:\Windows\System\ucSJdlG.exe
  C:\Windows\System\ucSJdlG.exe
  2⤵
  PID:3224
- C:\Windows\System\riKwjFj.exe
  C:\Windows\System\riKwjFj.exe
  2⤵
  PID:9236
- C:\Windows\System\afbnxgu.exe
  C:\Windows\System\afbnxgu.exe
  2⤵
  PID:9256
- C:\Windows\System\bnBPErV.exe
  C:\Windows\System\bnBPErV.exe
  2⤵
  PID:9276
- C:\Windows\System\KZplGPy.exe
  C:\Windows\System\KZplGPy.exe
  2⤵
  PID:9304
- C:\Windows\System\CTmurBM.exe
  C:\Windows\System\CTmurBM.exe
  2⤵
  PID:9328
- C:\Windows\System\BFFoysb.exe
  C:\Windows\System\BFFoysb.exe
  2⤵
  PID:9384
- C:\Windows\System\DGgnGVF.exe
  C:\Windows\System\DGgnGVF.exe
  2⤵
  PID:9408
- C:\Windows\System\ApUlwGl.exe
  C:\Windows\System\ApUlwGl.exe
  2⤵
  PID:9428
- C:\Windows\System\xmAcwaw.exe
  C:\Windows\System\xmAcwaw.exe
  2⤵
  PID:9448
- C:\Windows\System\NHLKnsI.exe
  C:\Windows\System\NHLKnsI.exe
  2⤵
  PID:9468
- C:\Windows\System\rGORDWa.exe
  C:\Windows\System\rGORDWa.exe
  2⤵
  PID:9520
- C:\Windows\System\IhgmAnw.exe
  C:\Windows\System\IhgmAnw.exe
  2⤵
  PID:9540
- C:\Windows\System\nAkEbMf.exe
  C:\Windows\System\nAkEbMf.exe
  2⤵
  PID:9560
- C:\Windows\System\pRXqnCr.exe
  C:\Windows\System\pRXqnCr.exe
  2⤵
  PID:9588
- C:\Windows\System\OnyOskA.exe
  C:\Windows\System\OnyOskA.exe
  2⤵
  PID:9624
- C:\Windows\System\KfZRURe.exe
  C:\Windows\System\KfZRURe.exe
  2⤵
  PID:9648
- C:\Windows\System\FGlHMQE.exe
  C:\Windows\System\FGlHMQE.exe
  2⤵
  PID:9700
- C:\Windows\System\VahzNqG.exe
  C:\Windows\System\VahzNqG.exe
  2⤵
  PID:9716
- C:\Windows\System\pEcIyOv.exe
  C:\Windows\System\pEcIyOv.exe
  2⤵
  PID:9736
- C:\Windows\System\vdJWJEk.exe
  C:\Windows\System\vdJWJEk.exe
  2⤵
  PID:9760
- C:\Windows\System\kXfaDYn.exe
  C:\Windows\System\kXfaDYn.exe
  2⤵
  PID:9792
- C:\Windows\System\KsYoLwx.exe
  C:\Windows\System\KsYoLwx.exe
  2⤵
  PID:9824
- C:\Windows\System\fMPjhYV.exe
  C:\Windows\System\fMPjhYV.exe
  2⤵
  PID:9848
- C:\Windows\System\XpDXRXb.exe
  C:\Windows\System\XpDXRXb.exe
  2⤵
  PID:9864
- C:\Windows\System\hIICQFx.exe
  C:\Windows\System\hIICQFx.exe
  2⤵
  PID:9908
- C:\Windows\System\MIARkDQ.exe
  C:\Windows\System\MIARkDQ.exe
  2⤵
  PID:9928
- C:\Windows\System\UwJuYVV.exe
  C:\Windows\System\UwJuYVV.exe
  2⤵
  PID:9948
- C:\Windows\System\GzFPqzv.exe
  C:\Windows\System\GzFPqzv.exe
  2⤵
  PID:9972
- C:\Windows\System\iOQlLRk.exe
  C:\Windows\System\iOQlLRk.exe
  2⤵
  PID:9992
- C:\Windows\System\KOQxGeG.exe
  C:\Windows\System\KOQxGeG.exe
  2⤵
  PID:10012
- C:\Windows\System\hudHMFR.exe
  C:\Windows\System\hudHMFR.exe
  2⤵
  PID:10068
- C:\Windows\System\hxgjzIB.exe
  C:\Windows\System\hxgjzIB.exe
  2⤵
  PID:10116
- C:\Windows\System\dMvvTcs.exe
  C:\Windows\System\dMvvTcs.exe
  2⤵
  PID:10140
- C:\Windows\System\fCTjilO.exe
  C:\Windows\System\fCTjilO.exe
  2⤵
  PID:10160
- C:\Windows\System\mhpcLMi.exe
  C:\Windows\System\mhpcLMi.exe
  2⤵
  PID:10188
- C:\Windows\System\ZSoQmfX.exe
  C:\Windows\System\ZSoQmfX.exe
  2⤵
  PID:10204
- C:\Windows\System\gsCekiD.exe
  C:\Windows\System\gsCekiD.exe
  2⤵
  PID:10232
- C:\Windows\System\fGqNsLg.exe
  C:\Windows\System\fGqNsLg.exe
  2⤵
  PID:1192
- C:\Windows\System\ZhaTBNW.exe
  C:\Windows\System\ZhaTBNW.exe
  2⤵
  PID:9296
- C:\Windows\System\hNXKote.exe
  C:\Windows\System\hNXKote.exe
  2⤵
  PID:9404
- C:\Windows\System\PGqDWSV.exe
  C:\Windows\System\PGqDWSV.exe
  2⤵
  PID:9392
- C:\Windows\System\cCyykzj.exe
  C:\Windows\System\cCyykzj.exe
  2⤵
  PID:9496
- C:\Windows\System\qVNXLRL.exe
  C:\Windows\System\qVNXLRL.exe
  2⤵
  PID:9684
- C:\Windows\System\QiZCrBO.exe
  C:\Windows\System\QiZCrBO.exe
  2⤵
  PID:9708
- C:\Windows\System\eysOwbm.exe
  C:\Windows\System\eysOwbm.exe
  2⤵
  PID:9732
- C:\Windows\System\EAesgvr.exe
  C:\Windows\System\EAesgvr.exe
  2⤵
  PID:9832
- C:\Windows\System\EIigQqx.exe
  C:\Windows\System\EIigQqx.exe
  2⤵
  PID:9840
- C:\Windows\System\GrWvCKG.exe
  C:\Windows\System\GrWvCKG.exe
  2⤵
  PID:9936
- C:\Windows\System\rWeELQW.exe
  C:\Windows\System\rWeELQW.exe
  2⤵
  PID:9984
- C:\Windows\System\UwMLKlW.exe
  C:\Windows\System\UwMLKlW.exe
  2⤵
  PID:10044
- C:\Windows\System\wwUUzct.exe
  C:\Windows\System\wwUUzct.exe
  2⤵
  PID:10112
- C:\Windows\System\DcEWjJI.exe
  C:\Windows\System\DcEWjJI.exe
  2⤵
  PID:10196
- C:\Windows\System\seaYJmS.exe
  C:\Windows\System\seaYJmS.exe
  2⤵
  PID:4260
- C:\Windows\System\JdFUuFs.exe
  C:\Windows\System\JdFUuFs.exe
  2⤵
  PID:9268
- C:\Windows\System\kofmZLY.exe
  C:\Windows\System\kofmZLY.exe
  2⤵
  PID:9660
- C:\Windows\System\mveQTbi.exe
  C:\Windows\System\mveQTbi.exe
  2⤵
  PID:9656
- C:\Windows\System\oVeZntD.exe
  C:\Windows\System\oVeZntD.exe
  2⤵
  PID:9884
- C:\Windows\System\MYzvGqA.exe
  C:\Windows\System\MYzvGqA.exe
  2⤵
  PID:9964
- C:\Windows\System\dnwprfu.exe
  C:\Windows\System\dnwprfu.exe
  2⤵
  PID:10228
- C:\Windows\System\wDSqqkO.exe
  C:\Windows\System\wDSqqkO.exe
  2⤵
  PID:9816
- C:\Windows\System\BueCENi.exe
  C:\Windows\System\BueCENi.exe
  2⤵
  PID:9756
- C:\Windows\System\xRJuWKf.exe
  C:\Windows\System\xRJuWKf.exe
  2⤵
  PID:10056
- C:\Windows\System\qzlELQb.exe
  C:\Windows\System\qzlELQb.exe
  2⤵
  PID:10244
- C:\Windows\System\pkSPxJI.exe
  C:\Windows\System\pkSPxJI.exe
  2⤵
  PID:10272
- C:\Windows\System\ptsSfOU.exe
  C:\Windows\System\ptsSfOU.exe
  2⤵
  PID:10292
- C:\Windows\System\hsiQJyL.exe
  C:\Windows\System\hsiQJyL.exe
  2⤵
  PID:10336
- C:\Windows\System\cDnvOyk.exe
  C:\Windows\System\cDnvOyk.exe
  2⤵
  PID:10368
- C:\Windows\System\SbQDcwM.exe
  C:\Windows\System\SbQDcwM.exe
  2⤵
  PID:10396
- C:\Windows\System\QJIjQwH.exe
  C:\Windows\System\QJIjQwH.exe
  2⤵
  PID:10416
- C:\Windows\System\BnCwloR.exe
  C:\Windows\System\BnCwloR.exe
  2⤵
  PID:10452
- C:\Windows\System\HpvJCWj.exe
  C:\Windows\System\HpvJCWj.exe
  2⤵
  PID:10468
- C:\Windows\System\OhiBnAK.exe
  C:\Windows\System\OhiBnAK.exe
  2⤵
  PID:10492
- C:\Windows\System\sGxslHZ.exe
  C:\Windows\System\sGxslHZ.exe
  2⤵
  PID:10544
- C:\Windows\System\ctAoZbE.exe
  C:\Windows\System\ctAoZbE.exe
  2⤵
  PID:10576
- C:\Windows\System\UzHSPRF.exe
  C:\Windows\System\UzHSPRF.exe
  2⤵
  PID:10620
- C:\Windows\System\KQGGbDy.exe
  C:\Windows\System\KQGGbDy.exe
  2⤵
  PID:10648
- C:\Windows\System\QBkbOEU.exe
  C:\Windows\System\QBkbOEU.exe
  2⤵
  PID:10668
- C:\Windows\System\TAPFgfh.exe
  C:\Windows\System\TAPFgfh.exe
  2⤵
  PID:10692
- C:\Windows\System\QRwHxbJ.exe
  C:\Windows\System\QRwHxbJ.exe
  2⤵
  PID:10732
- C:\Windows\System\ybdtYDq.exe
  C:\Windows\System\ybdtYDq.exe
  2⤵
  PID:10760
- C:\Windows\System\BYQqxlA.exe
  C:\Windows\System\BYQqxlA.exe
  2⤵
  PID:10776
- C:\Windows\System\RvXOYVZ.exe
  C:\Windows\System\RvXOYVZ.exe
  2⤵
  PID:10828
- C:\Windows\System\yrdUtND.exe
  C:\Windows\System\yrdUtND.exe
  2⤵
  PID:10844
- C:\Windows\System\UhLwDIx.exe
  C:\Windows\System\UhLwDIx.exe
  2⤵
  PID:10864
- C:\Windows\System\ojqtJxR.exe
  C:\Windows\System\ojqtJxR.exe
  2⤵
  PID:10880
- C:\Windows\System\ekjgSGN.exe
  C:\Windows\System\ekjgSGN.exe
  2⤵
  PID:10908
- C:\Windows\System\WPTpyhl.exe
  C:\Windows\System\WPTpyhl.exe
  2⤵
  PID:10936
- C:\Windows\System\RPLorRB.exe
  C:\Windows\System\RPLorRB.exe
  2⤵
  PID:10996
- C:\Windows\System\IArPUvL.exe
  C:\Windows\System\IArPUvL.exe
  2⤵
  PID:11012
- C:\Windows\System\MHyZTrf.exe
  C:\Windows\System\MHyZTrf.exe
  2⤵
  PID:11032
- C:\Windows\System\InTyCfb.exe
  C:\Windows\System\InTyCfb.exe
  2⤵
  PID:11048
- C:\Windows\System\RQqyUeP.exe
  C:\Windows\System\RQqyUeP.exe
  2⤵
  PID:11072
- C:\Windows\System\ZmGHEsN.exe
  C:\Windows\System\ZmGHEsN.exe
  2⤵
  PID:11116
- C:\Windows\System\aIIbfdX.exe
  C:\Windows\System\aIIbfdX.exe
  2⤵
  PID:11156
- C:\Windows\System\AzvwWaF.exe
  C:\Windows\System\AzvwWaF.exe
  2⤵
  PID:11184
- C:\Windows\System\ETVmBwt.exe
  C:\Windows\System\ETVmBwt.exe
  2⤵
  PID:11204
- C:\Windows\System\aMVIYHy.exe
  C:\Windows\System\aMVIYHy.exe
  2⤵
  PID:11236
- C:\Windows\System\bNjBHLx.exe
  C:\Windows\System\bNjBHLx.exe
  2⤵
  PID:9616
- C:\Windows\System\ydOvkpl.exe
  C:\Windows\System\ydOvkpl.exe
  2⤵
  PID:9940
- C:\Windows\System\CrAcqok.exe
  C:\Windows\System\CrAcqok.exe
  2⤵
  PID:10108
- C:\Windows\System\gmKaEnR.exe
  C:\Windows\System\gmKaEnR.exe
  2⤵
  PID:10288
- C:\Windows\System\mdHhsSn.exe
  C:\Windows\System\mdHhsSn.exe
  2⤵
  PID:10320
- C:\Windows\System\YOJoaYM.exe
  C:\Windows\System\YOJoaYM.exe
  2⤵
  PID:10444
- C:\Windows\System\hhUJKob.exe
  C:\Windows\System\hhUJKob.exe
  2⤵
  PID:10484
- C:\Windows\System\cVZNWEZ.exe
  C:\Windows\System\cVZNWEZ.exe
  2⤵
  PID:10604
- C:\Windows\System\tNCDibM.exe
  C:\Windows\System\tNCDibM.exe
  2⤵
  PID:10632
- C:\Windows\System\jUHQFII.exe
  C:\Windows\System\jUHQFII.exe
  2⤵
  PID:10708
- C:\Windows\System\qCjurYt.exe
  C:\Windows\System\qCjurYt.exe
  2⤵
  PID:10852
- C:\Windows\System\PicCNvC.exe
  C:\Windows\System\PicCNvC.exe
  2⤵
  PID:10872
- C:\Windows\System\PbPEvgN.exe
  C:\Windows\System\PbPEvgN.exe
  2⤵
  PID:10980
- C:\Windows\System\HmarIUR.exe
  C:\Windows\System\HmarIUR.exe
  2⤵
  PID:11020
- C:\Windows\System\vuugofQ.exe
  C:\Windows\System\vuugofQ.exe
  2⤵
  PID:11060
- C:\Windows\System\baAGVUr.exe
  C:\Windows\System\baAGVUr.exe
  2⤵
  PID:11108
- C:\Windows\System\FOfnjfz.exe
  C:\Windows\System\FOfnjfz.exe
  2⤵
  PID:11176
- C:\Windows\System\MbkTOVR.exe
  C:\Windows\System\MbkTOVR.exe
  2⤵
  PID:11256
- C:\Windows\System\iABprNY.exe
  C:\Windows\System\iABprNY.exe
  2⤵
  PID:10252
- C:\Windows\System\yevKDgs.exe
  C:\Windows\System\yevKDgs.exe
  2⤵
  PID:10448
- C:\Windows\System\pWdzhOd.exe
  C:\Windows\System\pWdzhOd.exe
  2⤵
  PID:10664
- C:\Windows\System\aEXwQXq.exe
  C:\Windows\System\aEXwQXq.exe
  2⤵
  PID:10676
- C:\Windows\System\zCZfkiw.exe
  C:\Windows\System\zCZfkiw.exe
  2⤵
  PID:10924
- C:\Windows\System\JtjMpck.exe
  C:\Windows\System\JtjMpck.exe
  2⤵
  PID:10988
- C:\Windows\System\EIfmZvP.exe
  C:\Windows\System\EIfmZvP.exe
  2⤵
  PID:9784
- C:\Windows\System\ZJHtyMz.exe
  C:\Windows\System\ZJHtyMz.exe
  2⤵
  PID:10724
- C:\Windows\System\OiTdklw.exe
  C:\Windows\System\OiTdklw.exe
  2⤵
  PID:10904
- C:\Windows\System\CYkpDsi.exe
  C:\Windows\System\CYkpDsi.exe
  2⤵
  PID:10592
- C:\Windows\System\GzbKtxD.exe
  C:\Windows\System\GzbKtxD.exe
  2⤵
  PID:11136
- C:\Windows\System\DYVLwCp.exe
  C:\Windows\System\DYVLwCp.exe
  2⤵
  PID:11280
- C:\Windows\System\eMkvNIq.exe
  C:\Windows\System\eMkvNIq.exe
  2⤵
  PID:11304
- C:\Windows\System\VyWzRQy.exe
  C:\Windows\System\VyWzRQy.exe
  2⤵
  PID:11352
- C:\Windows\System\hRWvErQ.exe
  C:\Windows\System\hRWvErQ.exe
  2⤵
  PID:11368
- C:\Windows\System\OXMweYT.exe
  C:\Windows\System\OXMweYT.exe
  2⤵
  PID:11392
- C:\Windows\System\drmdWpU.exe
  C:\Windows\System\drmdWpU.exe
  2⤵
  PID:11408
- C:\Windows\System\ukMqMCh.exe
  C:\Windows\System\ukMqMCh.exe
  2⤵
  PID:11428
- C:\Windows\System\rYWAVdG.exe
  C:\Windows\System\rYWAVdG.exe
  2⤵
  PID:11448
- C:\Windows\System\qTWaYTy.exe
  C:\Windows\System\qTWaYTy.exe
  2⤵
  PID:11468
- C:\Windows\System\GRGTgFP.exe
  C:\Windows\System\GRGTgFP.exe
  2⤵
  PID:11508
- C:\Windows\System\PYenotF.exe
  C:\Windows\System\PYenotF.exe
  2⤵
  PID:11524
- C:\Windows\System\TsoDPoV.exe
  C:\Windows\System\TsoDPoV.exe
  2⤵
  PID:11540
- C:\Windows\System\NJdnSXc.exe
  C:\Windows\System\NJdnSXc.exe
  2⤵
  PID:11596
- C:\Windows\System\jewePkf.exe
  C:\Windows\System\jewePkf.exe
  2⤵
  PID:11612
- C:\Windows\System\trercwW.exe
  C:\Windows\System\trercwW.exe
  2⤵
  PID:11640
- C:\Windows\System\QTPjNcq.exe
  C:\Windows\System\QTPjNcq.exe
  2⤵
  PID:11676
- C:\Windows\System\wuezAmB.exe
  C:\Windows\System\wuezAmB.exe
  2⤵
  PID:11692
- C:\Windows\System\oEeTLOi.exe
  C:\Windows\System\oEeTLOi.exe
  2⤵
  PID:11752
- C:\Windows\System\oobAcvK.exe
  C:\Windows\System\oobAcvK.exe
  2⤵
  PID:11780
- C:\Windows\System\awMOfzo.exe
  C:\Windows\System\awMOfzo.exe
  2⤵
  PID:11808
- C:\Windows\System\dOYqMPr.exe
  C:\Windows\System\dOYqMPr.exe
  2⤵
  PID:11856
- C:\Windows\System\FceCuMk.exe
  C:\Windows\System\FceCuMk.exe
  2⤵
  PID:11884
- C:\Windows\System\ljOimZv.exe
  C:\Windows\System\ljOimZv.exe
  2⤵
  PID:11904
- C:\Windows\System\aLLOJNj.exe
  C:\Windows\System\aLLOJNj.exe
  2⤵
  PID:11924
- C:\Windows\System\EoHnxXI.exe
  C:\Windows\System\EoHnxXI.exe
  2⤵
  PID:11944
- C:\Windows\System\MmVWXiL.exe
  C:\Windows\System\MmVWXiL.exe
  2⤵
  PID:11972
- C:\Windows\System\fbSQSuq.exe
  C:\Windows\System\fbSQSuq.exe
  2⤵
  PID:12024
- C:\Windows\System\aDmiBxD.exe
  C:\Windows\System\aDmiBxD.exe
  2⤵
  PID:12052
- C:\Windows\System\ZzkXSbC.exe
  C:\Windows\System\ZzkXSbC.exe
  2⤵
  PID:12068
- C:\Windows\System\jonNjxl.exe
  C:\Windows\System\jonNjxl.exe
  2⤵
  PID:12096
- C:\Windows\System\uudLYfX.exe
  C:\Windows\System\uudLYfX.exe
  2⤵
  PID:12124
- C:\Windows\System\ptvJctK.exe
  C:\Windows\System\ptvJctK.exe
  2⤵
  PID:12152
- C:\Windows\System\GGBFJUz.exe
  C:\Windows\System\GGBFJUz.exe
  2⤵
  PID:12216
- C:\Windows\System\NOEDGyF.exe
  C:\Windows\System\NOEDGyF.exe
  2⤵
  PID:12232
- C:\Windows\System\mCXJyTC.exe
  C:\Windows\System\mCXJyTC.exe
  2⤵
  PID:12248
- C:\Windows\System\MktZfrA.exe
  C:\Windows\System\MktZfrA.exe
  2⤵
  PID:12268
- C:\Windows\System\zVBnskg.exe
  C:\Windows\System\zVBnskg.exe
  2⤵
  PID:10476
- C:\Windows\System\fepXUOQ.exe
  C:\Windows\System\fepXUOQ.exe
  2⤵
  PID:11344
- C:\Windows\System\OJhbUCk.exe
  C:\Windows\System\OJhbUCk.exe
  2⤵
  PID:11404
- C:\Windows\System\xYrlNBl.exe
  C:\Windows\System\xYrlNBl.exe
  2⤵
  PID:11400
- C:\Windows\System\jBZJQAV.exe
  C:\Windows\System\jBZJQAV.exe
  2⤵
  PID:11444
- C:\Windows\System\DFHGzmZ.exe
  C:\Windows\System\DFHGzmZ.exe
  2⤵
  PID:11504
- C:\Windows\System\sPoOYKg.exe
  C:\Windows\System\sPoOYKg.exe
  2⤵
  PID:11556
- C:\Windows\System\LMlVHZA.exe
  C:\Windows\System\LMlVHZA.exe
  2⤵
  PID:11604
- C:\Windows\System\hsTvNlo.exe
  C:\Windows\System\hsTvNlo.exe
  2⤵
  PID:11620
- C:\Windows\System\HVpCnvj.exe
  C:\Windows\System\HVpCnvj.exe
  2⤵
  PID:11800
- C:\Windows\System\hKfDAyW.exe
  C:\Windows\System\hKfDAyW.exe
  2⤵
  PID:11836
- C:\Windows\System\dJNIfNF.exe
  C:\Windows\System\dJNIfNF.exe
  2⤵
  PID:1604
- C:\Windows\System\VCqFFEY.exe
  C:\Windows\System\VCqFFEY.exe
  2⤵
  PID:3004
- C:\Windows\System\FJMKhiu.exe
  C:\Windows\System\FJMKhiu.exe
  2⤵
  PID:11916
- C:\Windows\System\qwPvdAG.exe
  C:\Windows\System\qwPvdAG.exe
  2⤵
  PID:11996
- C:\Windows\System\batEPUw.exe
  C:\Windows\System\batEPUw.exe
  2⤵
  PID:12016
- C:\Windows\System\VziUpTN.exe
  C:\Windows\System\VziUpTN.exe
  2⤵
  PID:12060
- C:\Windows\System\dOqlBZy.exe
  C:\Windows\System\dOqlBZy.exe
  2⤵
  PID:12136
- C:\Windows\System\aiXCjtx.exe
  C:\Windows\System\aiXCjtx.exe
  2⤵
  PID:12164
- C:\Windows\System\UGdhRYb.exe
  C:\Windows\System\UGdhRYb.exe
  2⤵
  PID:12244
- C:\Windows\System\HzXqPLq.exe
  C:\Windows\System\HzXqPLq.exe
  2⤵
  PID:11588
- C:\Windows\System\BRjZIgq.exe
  C:\Windows\System\BRjZIgq.exe
  2⤵
  PID:11748
- C:\Windows\System\ZnMjJrr.exe
  C:\Windows\System\ZnMjJrr.exe
  2⤵
  PID:3112
- C:\Windows\System\cAmWnbb.exe
  C:\Windows\System\cAmWnbb.exe
  2⤵
  PID:11936
- C:\Windows\System\vztPIoY.exe
  C:\Windows\System\vztPIoY.exe
  2⤵
  PID:12036
- C:\Windows\System\MucTJSz.exe
  C:\Windows\System\MucTJSz.exe
  2⤵
  PID:740
- C:\Windows\System\TbFCVRm.exe
  C:\Windows\System\TbFCVRm.exe
  2⤵
  PID:4436
- C:\Windows\System\OsteVGl.exe
  C:\Windows\System\OsteVGl.exe
  2⤵
  PID:12292
- C:\Windows\System\PSZNRBb.exe
  C:\Windows\System\PSZNRBb.exe
  2⤵
  PID:12308
- C:\Windows\System\XBUBjGM.exe
  C:\Windows\System\XBUBjGM.exe
  2⤵
  PID:12324
- C:\Windows\System\ZpEHreL.exe
  C:\Windows\System\ZpEHreL.exe
  2⤵
  PID:12344
- C:\Windows\System\KOxnKad.exe
  C:\Windows\System\KOxnKad.exe
  2⤵
  PID:12364
- C:\Windows\System\lHGEpkq.exe
  C:\Windows\System\lHGEpkq.exe
  2⤵
  PID:12444
- C:\Windows\System\QOZuGGv.exe
  C:\Windows\System\QOZuGGv.exe
  2⤵
  PID:12480
- C:\Windows\System\WDumoLw.exe
  C:\Windows\System\WDumoLw.exe
  2⤵
  PID:12496
- C:\Windows\System\tkjnHbg.exe
  C:\Windows\System\tkjnHbg.exe
  2⤵
  PID:12512
- C:\Windows\System\ErhGaGg.exe
  C:\Windows\System\ErhGaGg.exe
  2⤵
  PID:12532
- C:\Windows\System\SpcLtoA.exe
  C:\Windows\System\SpcLtoA.exe
  2⤵
  PID:12620
- C:\Windows\System\FtbSErC.exe
  C:\Windows\System\FtbSErC.exe
  2⤵
  PID:12644
- C:\Windows\System\kjZcXTy.exe
  C:\Windows\System\kjZcXTy.exe
  2⤵
  PID:12660
- C:\Windows\System\sDmzUva.exe
  C:\Windows\System\sDmzUva.exe
  2⤵
  PID:12680
- C:\Windows\System\YTShYZa.exe
  C:\Windows\System\YTShYZa.exe
  2⤵
  PID:12700
- C:\Windows\System\MqqWeCs.exe
  C:\Windows\System\MqqWeCs.exe
  2⤵
  PID:12812
- C:\Windows\System\MQfYkJZ.exe
  C:\Windows\System\MQfYkJZ.exe
  2⤵
  PID:12828
- C:\Windows\System\clUYstH.exe
  C:\Windows\System\clUYstH.exe
  2⤵
  PID:12884
- C:\Windows\System\PNVmVZS.exe
  C:\Windows\System\PNVmVZS.exe
  2⤵
  PID:12912
- C:\Windows\System\fDyRASz.exe
  C:\Windows\System\fDyRASz.exe
  2⤵
  PID:12960
- C:\Windows\System\xRSQNnH.exe
  C:\Windows\System\xRSQNnH.exe
  2⤵
  PID:12996
- C:\Windows\System\cSptnjA.exe
  C:\Windows\System\cSptnjA.exe
  2⤵
  PID:13028
- C:\Windows\System\ltdzuVd.exe
  C:\Windows\System\ltdzuVd.exe
  2⤵
  PID:13052
- C:\Windows\System\aHhpaHU.exe
  C:\Windows\System\aHhpaHU.exe
  2⤵
  PID:13088
- C:\Windows\System\VsyVmJb.exe
  C:\Windows\System\VsyVmJb.exe
  2⤵
  PID:13104
- C:\Windows\System\cIHUlKq.exe
  C:\Windows\System\cIHUlKq.exe
  2⤵
  PID:13132
- C:\Windows\System\hSCeihq.exe
  C:\Windows\System\hSCeihq.exe
  2⤵
  PID:13156
- C:\Windows\System\xBpZIGJ.exe
  C:\Windows\System\xBpZIGJ.exe
  2⤵
  PID:13172
- C:\Windows\System\BHcCzvf.exe
  C:\Windows\System\BHcCzvf.exe
  2⤵
  PID:13196
- C:\Windows\System\jgOCKjB.exe
  C:\Windows\System\jgOCKjB.exe
  2⤵
  PID:13240
- C:\Windows\System\UawvMcq.exe
  C:\Windows\System\UawvMcq.exe
  2⤵
  PID:13256
- C:\Windows\System\cDDdEol.exe
  C:\Windows\System\cDDdEol.exe
  2⤵
  PID:13284
- C:\Windows\System\LxjrTaM.exe
  C:\Windows\System\LxjrTaM.exe
  2⤵
  PID:13308
- C:\Windows\System\kMHVdjX.exe
  C:\Windows\System\kMHVdjX.exe
  2⤵
  PID:11684
- C:\Windows\System\PCpdSwx.exe
  C:\Windows\System\PCpdSwx.exe
  2⤵
  PID:12040
- C:\Windows\System\pPtFlIY.exe
  C:\Windows\System\pPtFlIY.exe
  2⤵
  PID:12316
- C:\Windows\System\xoxGXWz.exe
  C:\Windows\System\xoxGXWz.exe
  2⤵
  PID:11592
- C:\Windows\System\jMXCYTi.exe
  C:\Windows\System\jMXCYTi.exe
  2⤵
  PID:12760
- C:\Windows\System\RWdpSuQ.exe
  C:\Windows\System\RWdpSuQ.exe
  2⤵
  PID:12552
- C:\Windows\System\hDBcJEM.exe
  C:\Windows\System\hDBcJEM.exe
  2⤵
  PID:12932
- C:\Windows\System\qftMeYM.exe
  C:\Windows\System\qftMeYM.exe
  2⤵
  PID:12948
- C:\Windows\System\HrkYKtT.exe
  C:\Windows\System\HrkYKtT.exe
  2⤵
  PID:13100
- C:\Windows\System\mixNMiH.exe
  C:\Windows\System\mixNMiH.exe
  2⤵
  PID:13164
- C:\Windows\System\PdNkVHs.exe
  C:\Windows\System\PdNkVHs.exe
  2⤵
  PID:13168
- C:\Windows\System\OtwanFn.exe
  C:\Windows\System\OtwanFn.exe
  2⤵
  PID:13220
- C:\Windows\System\rYHthuI.exe
  C:\Windows\System\rYHthuI.exe
  2⤵
  PID:13208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WOBB13N1\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0vk4t10m.1dv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BJxhSdR.exe

Filesize
1.4MB

MD5
fe5aa38623b02e8b3462cfe52bca5c67

SHA1
11845de9f3f9f8d3a1dcae8d152f079b2c7ac5bb

SHA256
24e3902d240f97830a640d712812259aaeada1abad6299da903254bb5b84d544

SHA512
f415599cd7a81a31c1c6796b803fa639d1efeaabdb15e886ecc68665118e8ffc7f7eb3102a75d49bd2ea3ef2a77b4066b600c6a8fe9214e39d98263ae68de539

Download Submit
C:\Windows\System\FWkmPDx.exe

Filesize
1.4MB

MD5
6b4f55cbb7cd66e510d0fc364b02c17d

SHA1
c57c484d5e5924f4f2831e37843bd88c86fc9eea

SHA256
5cf0d8390e15609917c69923a4843b9e60470cff4351bfee4dd0be54dcfd582a

SHA512
3dc09a5d19c95403b6d8664b676a7edc18bdac83c92491bbb405e5fc0be291815f6b0e79c2a85295d62ed4ed8eb076e11b2e66d2d1a038cd46159ddbf5fcf807

Download Submit
C:\Windows\System\GWzHtru.exe

Filesize
1.4MB

MD5
e1a22f22f131ec667eb94b33a57ac5ce

SHA1
78b078131fb822c0a053ec5c85545ac939483f68

SHA256
ef937c6b32b42c80fbeb2d9a0db4f5a4c5d8566a90cdc1c4ef6538d1d7896764

SHA512
d6ccd1803c27c180ebf48ab36380a855e0c3404fa4153469167d82f4fff7fc601d5993fa63cc2ea4f6f2aedf212da2aada4c65ecf02140f47e2d9c92a77378d6

Download Submit
C:\Windows\System\IPsIDDG.exe

Filesize
1.4MB

MD5
5f5b2355b6400ec1015c1e7c37f247bf

SHA1
7a12e62ef97a7bf7fde1b5c7d4d7c85439faed1a

SHA256
57d1effab2443170279591742fe5c85fb89aca9043de09a247a44c1d1ec38e05

SHA512
337c833d74333b838acc5c182399d63f88a7fb5ee1a95fca29178d70326a7cbdcd3d7bc917d80cc75d18e68a770f2f46d6fdb55a6e4c7052a4895a4268a22524

Download Submit
C:\Windows\System\JRDcvXS.exe

Filesize
1.4MB

MD5
ac5edc7fa86ac1bf6cd894197e5a2a7d

SHA1
b08186c1a8db513184bbac4ef198d22116b8bdaf

SHA256
fc9371458b1860ae1e7659f89e3c7fd32c3586f618a2f0ba1b329207f92c78e6

SHA512
ff867d633707d1e0df34d32f6d97c8cfbaec639989eff997d5919dbddc7e9135e673584079d106ce8313069351d9652ba6a56da90caa21e11926644c825c1cc5

Download Submit
C:\Windows\System\JvibCph.exe

Filesize
1.4MB

MD5
63cc949e1f811c9f68c5aeeae73893cd

SHA1
7ee4144c91ad93edcc4a5fe17aa764620feaeb37

SHA256
d09516512563d72e357855c7fb2a22e99d826f7b219b82828c2fb017bae5df19

SHA512
293da7ae2b5e08ccc8f3d540fa704b534138db4b781bf8189d4c2b18cb8a7000095539694ab229b68eed4603893d472634deb76dffd4ccbf85021b5a6f3b7cea

Download Submit
C:\Windows\System\KQnbRdc.exe

Filesize
1.4MB

MD5
d2671407dc0c5c2b3c1e46b9cc9092c5

SHA1
cb930fdb91ba376c8ed6ab7442fe66de20ab9fbf

SHA256
804a864a9144539b085978eceb64bdfb3b14958ab8d0782578c9b03536cd4b88

SHA512
2e3fb48bb18d5fab0f270333efa3c86e6bbcc285b737e2969186ec56d07e1218e2b66bb53ed6c0c33bf3d34cbe6055d6033083bc9ac2d3ed9ad69f6f2689ea18

Download Submit
C:\Windows\System\LigcyjJ.exe

Filesize
1.4MB

MD5
f69f2b3a0e4773a16be966d77be283fe

SHA1
34983a4830ba96ab9c080ddf36223c06b2dee4ac

SHA256
4163d6abd72c06d17236ed1457e590855b5169dee1342d9d52cceedf3164ad49

SHA512
35d4bb37fce95fbac2adbe301251e142080b399fe779fc2b560428653e4adb4213102b81f20fc9935d4dae04fb0d01b2a0557652ee072215683aedb2ae19fa6c

Download Submit
C:\Windows\System\LmaTEmf.exe

Filesize
1.4MB

MD5
0c8d71d5b4c784fcc75df9db077d75bc

SHA1
ef150b5797caec5ef31c1f58a61751bfa028f2fd

SHA256
8a7979748651eccd448e1bdf3a048bff106587ee4af50212936061924fa06f21

SHA512
0360b0b36ca5c4bc0f13589b0941d8736f45dcb6fce308330f29baca5d73baaa5fb411d3586c1efb9aeaefe890ce8a02d60f7efb2546b74cdf38cff176081b08

Download Submit
C:\Windows\System\MnsgAVf.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\System\OZQhxzb.exe

Filesize
1.4MB

MD5
fab1d3855d8a2ba2e8d1bfe088f1108a

SHA1
e2c1a26c978ab6e853a23c2b6935cde0de0e52c0

SHA256
768b8d7bc5b13c7fec50bfdb73f4b81a3558190208eff3cbd2a4b93916e8253c

SHA512
625116ea6239ffa53589c9928fb942a034556f768131a37b478cedb0ad63695e2d6cd302b0ef26e086cc06c2bd074603102737378990fb06902c0e43aa225046

Download Submit
C:\Windows\System\PZRxGAa.exe

Filesize
1.4MB

MD5
fe2a499fe0fb58c21ae50ce72aff285e

SHA1
8dec195b33f195bd2be4a5f5aa6b0c50f63f47df

SHA256
08a152e28812904a78bb76d849f38bfe38faf9403c0ac02575e506dc2806dbf4

SHA512
aeefdc2a7ef28e187f38b5fe2189dc2f0fdfd99dc2cc47b291c6b737635e659d7d555f0b2eef7bb05acfc6ab99bf467056780dda6933ce5ca3831895ace8fd84

Download Submit
C:\Windows\System\TEJNxoD.exe

Filesize
1.4MB

MD5
6eea663576984b86e0daadd23ff4cb26

SHA1
9b669e624bc59d445ce6918462d91db76833e076

SHA256
8f9bc49e0b1b48910b8bb2def67c7df57e697bd23733b875f1c2da43c047b88d

SHA512
7681296ca9ecac374ef7dddc3aa6d33af12d11811a4a772818186f4a594464ffea4f56a82006f3b6b25f56851f719e16b3ddcdb6e38fcb7011950478c6c5a756

Download Submit
C:\Windows\System\VsLVVhe.exe

Filesize
1.4MB

MD5
80b7b54b9eb2483b19da979c761fdae0

SHA1
a8781a3830fb2eb628eaa5a5daec6204e13413f1

SHA256
063ad5c236e3e4289e1e8e70432057c1fe9e81bf802ff372b23d9c42968dc4e7

SHA512
f3f223925a241a7ef6d371fa4b66430e1c4bc78d39d55317841eb5fc7affad6b92bb697d2436a322272504072b50ce268805cdc3a0175c3c4c7d30c106f4e882

Download Submit
C:\Windows\System\XYXHJVt.exe

Filesize
1.4MB

MD5
507f29b1653fe855ace6da712e2599a1

SHA1
f4aff4f130649951afe8f43c4fdf79d659ea035e

SHA256
1bde51eef3e8013061d983dd6b236b4282088700cd6218c49a3351fe50cb4411

SHA512
40e7b13eee9115dfb556a8eeedeae61a93dd93b23a157e977a17f25ca7f138cf7648f519baafe0d41458eb4d39de166dc03b68c4cf092595e846781c82246843

Download Submit
C:\Windows\System\YpTxFvm.exe

Filesize
1.4MB

MD5
3154591310499e803c71bdddc2d3bb51

SHA1
c378a9f56837f615e4b5234e00ee1847ebfd8395

SHA256
5287f1ca064032d07c32750752fca4e354b08c596ca6fd0147fecbe4cbd21581

SHA512
1237f339a9e0d9eff99b6467490af6baf2cfb89dbd79fa3907b89cceb5b7b7fee5c8ae49aa6a98dec9d6d81304d25037d0f63674023d7c4d8858485744c7c0e7

Download Submit
C:\Windows\System\ZMSSKfz.exe

Filesize
1.4MB

MD5
cdefaf47a19ae9c5f14b125230493217

SHA1
102e9982f539e94355db4d613708aa9e1625343b

SHA256
b9a89ff3355719355fdb9f2de2ec614e36e3aafa9c35311c3e7250bfe0c6efee

SHA512
78977c12f9ed7b70593617c4e71d8129378b902e9f88fb282f8825d1628aa1e3629a6735393a8504176c3fdec980bd782370543d10350efa23589813480bc791

Download Submit
C:\Windows\System\aiSjrrz.exe

Filesize
1.4MB

MD5
78d80d00e9ec9f159516ccca2fdf4f93

SHA1
c69e6b99d966bbe2e9ca5531dbfc4b34cfd67684

SHA256
1039cca7d8e33495ecfa6066610b333acdbf55387e5b92bd2aa2a3b07bce873f

SHA512
878d7dac9bb5cab0c406cda4de9f659e3725a822738d07ee82b2e7d3a6c929b02eb21df88caacfed2b41f415c771957feb3c5faba4171274389aee952822edff

Download Submit
C:\Windows\System\bCyAWSQ.exe

Filesize
1.4MB

MD5
ca4e079243d8b574136922b6fdd45e88

SHA1
fa5ba01a82d193bf944f7f3c1297f2cb73af59a4

SHA256
cf532373613a24cf89bb3d64371e120a0e8fb705642ffa83cdbea19785a8a32a

SHA512
ffd93f3f0fa5646ffe7135a75bd7a705658281e31fde84ae8e32d7eb65e1671a64dfa4e7425e574237ffdcadb3edbfaceff4c4bb72f8250af71785d067f934ef

Download Submit
C:\Windows\System\bVsxiBD.exe

Filesize
1.4MB

MD5
c6f1a18e78dd1ace433d7b75d226b799

SHA1
4e26640fa3b77eda4f84a8d6bd2a24fa01e4b09a

SHA256
19af941b0c126bdb60fa2a6f605513f3748c13481d67c7e830483f052f6071a8

SHA512
4becd65110c4b02f02734d684ba958b45bb1ad8ebc340e60abc17ca58bdd74ad7c6c96f06edf6aa5ae0debfdedf3ea7ac0d30ee597bc55be88c9d3a25a9f494c

Download Submit
C:\Windows\System\cllMdMS.exe

Filesize
1.4MB

MD5
ceb4e51b25722f0fe578e5552b66272d

SHA1
9d8cc1eaa834183ef7666a6d672ff31d45aac603

SHA256
9fbc59d939307c2611247d178407d7faf81536713b543581c29d1d366b996f0a

SHA512
08cca2d760b1a93484aa92c8a200aaf889ead62c111e44dd085e2ad9e6410aa97491de6521dd7eae675a6ab78a6fd2569eaec85a61aae80b25db298487ab8a1e

Download Submit
C:\Windows\System\dzWRXAN.exe

Filesize
1.4MB

MD5
492ac4c3309cb93fe4296d559ad94719

SHA1
a6d3052ff5efb64f9ecbcf9c852fbb8a141968b7

SHA256
08856913d17bb33dab53b99a84444bbef1373815a0d117d196e4a89b1e73062d

SHA512
6e7db9aae46cab426035fe70b20ba70aa7113a61b496d50ea7f2aac3be80553046dc00c39346790beed77b9fd2d0c8d45f57a323b98b9c77a1702bb3a207035b

Download Submit
C:\Windows\System\fHfQKYr.exe

Filesize
1.4MB

MD5
0f14ace1f143ad02b00d55ca915a269d

SHA1
202c1915b691eec0759d1110110d5440bde0b72c

SHA256
03b3bd3ae9d2d9269341d1ba96023c1cb5f1b572de6cfe1458af84cef5cb2064

SHA512
b8d3e45b9a3178610bf2bee2cd32b901d7b9aad22bf1685426fa8bc1266cff5e17743f8e70da5b7f82ff238ac55d6c34b23bcc01e27844dc9828114add851d6a

Download Submit
C:\Windows\System\gRdYiGG.exe

Filesize
1.4MB

MD5
6b5a234441bb55c4ded8209bc662520a

SHA1
e669f4f1ff82e01bb795dececca3aa2e48fb4895

SHA256
f18ba27c3ee9748532183e46189f60b0825fba9f0b9d0f8991220556683e3b02

SHA512
925381770936fa34e02f52bed22948df683db0cd04ffcbf07d4f939129c221e4c53df26d82f5d944d9f2ac5baa64067368789dd9ad8615bd7314fedcb94b905a

Download Submit
C:\Windows\System\ghNDtbo.exe

Filesize
1.4MB

MD5
db93a3770b7a1e7196447e6dd1a2fc0a

SHA1
23e7d5eac876e0027637208611606d81701c7856

SHA256
f756a4d7a99da2f31b3414842a0b4977895f13962979f1e1d45f804ee62de241

SHA512
510b8e00ffd1204b0845ec24749cb1d8ba3957e27b14d425b00640b02a4798a12469aaf70d37d0f44138470d30ebabfc77e82b5825ead2d96cbc62ba1bdfc7da

Download Submit
C:\Windows\System\hFmhSbW.exe

Filesize
1.4MB

MD5
e3cba1c38f2aaf1c573317878fc47dd5

SHA1
67e7229371671af68decb92dcd027d095fd88d03

SHA256
d7da8addbcbd53212928be58ec50a2956e66748e737b9c68cd9eb0e1781a3fdd

SHA512
fc7ba3cb6451caefb30d31d48a4d0257306ab9e464b73852e2bdf42f362b1234878a44ff55ebcf2b8228bf2691962665fbc60531a56c4efe716ea362f57fd630

Download Submit
C:\Windows\System\kIeYYJU.exe

Filesize
1.4MB

MD5
70821fb5e4a0886168cf71696e0a2260

SHA1
346cd3ee0c337ff8ccdced0181641d0464f08128

SHA256
6f57670eabdf6fab1b1a6f00133e90a59da563d2b6483127d207dda3dea63c1e

SHA512
7b117a3c6f115bfcfd5eb058b1bb7cc33f502b73c739555bf674c8ea959470eab5bc0e5a3bb6bcbc6f0c9afc99820b9075ac9e0e132d826def67d6259bfb348a

Download Submit
C:\Windows\System\nxspQVP.exe

Filesize
1.4MB

MD5
61be6a562d732dea3dcb1bf997bdbcf4

SHA1
c337dcc66ed45af877b833d02393a4f5cdffe05b

SHA256
ff254a5307c9faf2e81a935606e5ba128cd5276cba45429e02e0bb4876d9793d

SHA512
663de973fe3cfef7c057d1f029109447b3b20ef747204bafae9b2ff4a0379e20e9389f1ba0bcc30da5eaf52a03dccca046c9d415a053db0b48d5bf296326d0d0

Download Submit
C:\Windows\System\ocToYLQ.exe

Filesize
1.4MB

MD5
30a53a2fee5ac8cc3c7643097ad47dc1

SHA1
ee23a1da6d76dc73bccced446cb104649b9acb7b

SHA256
fbe89580741482abf60d2fd348084a8b248030ba1eb2ed6885d44b81b45c3cbd

SHA512
c3725f096009c1d21ca3be342005bebdeebafef0248d0b7cc20bb6254273bc206bcf3712fa85855f789c9b28e9e8b141a25ec39bf3d94b1be5efca45b3cc75cd

Download Submit
C:\Windows\System\qVKofDH.exe

Filesize
1.4MB

MD5
4bf442f0d3be88cd0ed0dbe4a2a30927

SHA1
e19a0acfbd749b8e76e93e384b5b44b9b2cab1c7

SHA256
8614ec7283decaa8aa030ec8039f98dcdc9b8a48116aeb0dd48fff0d8824062e

SHA512
ec7dd1fac98e5a0747a65f7badbd28e0c3920dd119df55b3c163bf2eec6832486186f31c7ce38027cff4dad62419fae9031b3b106af16543f605ffa49b51ab01

Download Submit
C:\Windows\System\tYSgwKs.exe

Filesize
1.4MB

MD5
8bb138ee71bb5afd2e6889f6b643294c

SHA1
edc7b1ba1a305178f0f20e6bee5d9cac06ee46e3

SHA256
ac62fc02d1c88dfda4c5f947bad2eb962fdc08c359eee2fc1f97a80f82b6b6a9

SHA512
12c048cda436ebe4db1d2d80f9d33c5595d705c1463beae79675295ef726397a6a771717b5295b43c0e4d992b17f627b8f0ab0faf227c8ab1e6b3671d20f3898

Download Submit
C:\Windows\System\urOVyyd.exe

Filesize
1.4MB

MD5
ec161382a80f1cc0c4a994b041f8c578

SHA1
674c6a0dde3502b50a30bcd37a82d3e8a0d92664

SHA256
3aa07cf40f03f1144387a3f59e33b95249af304bedbb328174232ef8b79e91db

SHA512
c60647da5c62364346b57ba6dd7f9b1c9b54eddbbb2e672d525661c44df9dff3c035d829da61a6572aa9aa37122cab7bc6c50bc3544931e122bb8af031cb3895

Download Submit
C:\Windows\System\vZwwWCm.exe

Filesize
1.4MB

MD5
a7040da8a32742407d7cfcee975dd5d5

SHA1
63d0643cd2d4fc42d4e5b55264aec697ff3fb118

SHA256
c51d0c4aa1731f10005da869e24114bf7ccaed9748b0b7be1f91492f77c35aee

SHA512
d177b58e29e92394261a64a9b40d27f9f25f6f842f4a61b9549cde0c0a1f6b44e8f87923175d5fcf7b2f0a6293f8b468d34485b34e1d64a1b42fb8a691affa36

Download Submit
C:\Windows\System\zegxSyt.exe

Filesize
1.4MB

MD5
0d68d34fa31802136d8a257f81d619a8

SHA1
eedeff86340a3d4e2e3007932f1d33ff0b4820bd

SHA256
b340a8123313dc8f160bd1bb953b452416664be710abcec42ae02a95f17ad246

SHA512
677bbe1611f535da238efd219c5c66e3dddc2b1d5efe5ea86ba7a59fc39bd8539bcfb16cdef0d9358ce193c824181aaba679023207a5848c7f25e85fb9e72700

Download Submit
memory/464-169-0x00007FF7A38B0000-0x00007FF7A3CA2000-memory.dmp

Filesize
3.9MB

Download
memory/464-3365-0x00007FF7A38B0000-0x00007FF7A3CA2000-memory.dmp

Filesize
3.9MB

Download
memory/916-51-0x00007FF786A60000-0x00007FF786E52000-memory.dmp

Filesize
3.9MB

Download
memory/916-3328-0x00007FF786A60000-0x00007FF786E52000-memory.dmp

Filesize
3.9MB

Download
memory/1080-1383-0x00007FFA6A4B0000-0x00007FFA6AF71000-memory.dmp

Filesize
10.8MB

Download
memory/1080-1973-0x00007FFA6A4B3000-0x00007FFA6A4B5000-memory.dmp

Filesize
8KB

Download
memory/1080-19-0x00007FFA6A4B0000-0x00007FFA6AF71000-memory.dmp

Filesize
10.8MB

Download
memory/1080-5-0x00007FFA6A4B3000-0x00007FFA6A4B5000-memory.dmp

Filesize
8KB

Download
memory/1080-21-0x00007FFA6A4B0000-0x00007FFA6AF71000-memory.dmp

Filesize
10.8MB

Download
memory/1080-87-0x000002582E480000-0x000002582EC26000-memory.dmp

Filesize
7.6MB

Download
memory/1080-40-0x0000025815500000-0x0000025815522000-memory.dmp

Filesize
136KB

Download
memory/1128-3353-0x00007FF6D4460000-0x00007FF6D4852000-memory.dmp

Filesize
3.9MB

Download
memory/1128-140-0x00007FF6D4460000-0x00007FF6D4852000-memory.dmp

Filesize
3.9MB

Download
memory/1420-99-0x00007FF778810000-0x00007FF778C02000-memory.dmp

Filesize
3.9MB

Download
memory/1420-3344-0x00007FF778810000-0x00007FF778C02000-memory.dmp

Filesize
3.9MB

Download
memory/1668-3363-0x00007FF670DD0000-0x00007FF6711C2000-memory.dmp

Filesize
3.9MB

Download
memory/1668-151-0x00007FF670DD0000-0x00007FF6711C2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-3336-0x00007FF739A40000-0x00007FF739E32000-memory.dmp

Filesize
3.9MB

Download
memory/2268-2009-0x00007FF739A40000-0x00007FF739E32000-memory.dmp

Filesize
3.9MB

Download
memory/2268-76-0x00007FF739A40000-0x00007FF739E32000-memory.dmp

Filesize
3.9MB

Download
memory/2280-133-0x00007FF78A720000-0x00007FF78AB12000-memory.dmp

Filesize
3.9MB

Download
memory/2280-3356-0x00007FF78A720000-0x00007FF78AB12000-memory.dmp

Filesize
3.9MB

Download
memory/2368-49-0x00007FF770C40000-0x00007FF771032000-memory.dmp

Filesize
3.9MB

Download
memory/2368-3326-0x00007FF770C40000-0x00007FF771032000-memory.dmp

Filesize
3.9MB

Download
memory/2424-77-0x00007FF772010000-0x00007FF772402000-memory.dmp

Filesize
3.9MB

Download
memory/2424-3342-0x00007FF772010000-0x00007FF772402000-memory.dmp

Filesize
3.9MB

Download
memory/2864-27-0x00007FF60CB10000-0x00007FF60CF02000-memory.dmp

Filesize
3.9MB

Download
memory/2864-3322-0x00007FF60CB10000-0x00007FF60CF02000-memory.dmp

Filesize
3.9MB

Download
memory/2916-3331-0x00007FF7D7700000-0x00007FF7D7AF2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-2004-0x00007FF7D7700000-0x00007FF7D7AF2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-55-0x00007FF7D7700000-0x00007FF7D7AF2000-memory.dmp

Filesize
3.9MB

Download
memory/2928-29-0x00007FF721070000-0x00007FF721462000-memory.dmp

Filesize
3.9MB

Download
memory/2928-3325-0x00007FF721070000-0x00007FF721462000-memory.dmp

Filesize
3.9MB

Download
memory/2976-3373-0x00007FF6F0140000-0x00007FF6F0532000-memory.dmp

Filesize
3.9MB

Download
memory/2976-163-0x00007FF6F0140000-0x00007FF6F0532000-memory.dmp

Filesize
3.9MB

Download
memory/3152-44-0x00007FF729EA0000-0x00007FF72A292000-memory.dmp

Filesize
3.9MB

Download
memory/3152-3320-0x00007FF729EA0000-0x00007FF72A292000-memory.dmp

Filesize
3.9MB

Download
memory/3192-3354-0x00007FF7838E0000-0x00007FF783CD2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-139-0x00007FF7838E0000-0x00007FF783CD2000-memory.dmp

Filesize
3.9MB

Download
memory/3248-3346-0x00007FF658390000-0x00007FF658782000-memory.dmp

Filesize
3.9MB

Download
memory/3248-118-0x00007FF658390000-0x00007FF658782000-memory.dmp

Filesize
3.9MB

Download
memory/3280-78-0x00007FF72A8C0000-0x00007FF72ACB2000-memory.dmp

Filesize
3.9MB

Download
memory/3280-3339-0x00007FF72A8C0000-0x00007FF72ACB2000-memory.dmp

Filesize
3.9MB

Download
memory/3520-3334-0x00007FF7A6C40000-0x00007FF7A7032000-memory.dmp

Filesize
3.9MB

Download
memory/3520-83-0x00007FF7A6C40000-0x00007FF7A7032000-memory.dmp

Filesize
3.9MB

Download
memory/3736-155-0x00007FF7923A0000-0x00007FF792792000-memory.dmp

Filesize
3.9MB

Download
memory/3736-3367-0x00007FF7923A0000-0x00007FF792792000-memory.dmp

Filesize
3.9MB

Download
memory/3980-1-0x000002DB72AA0000-0x000002DB72AB0000-memory.dmp

Filesize
64KB

Download
memory/3980-0-0x00007FF791750000-0x00007FF791B42000-memory.dmp

Filesize
3.9MB

Download
memory/3980-1371-0x00007FF791750000-0x00007FF791B42000-memory.dmp

Filesize
3.9MB

Download
memory/4092-127-0x00007FF6F5340000-0x00007FF6F5732000-memory.dmp

Filesize
3.9MB

Download
memory/4092-3350-0x00007FF6F5340000-0x00007FF6F5732000-memory.dmp

Filesize
3.9MB

Download
memory/4332-3332-0x00007FF7C7D80000-0x00007FF7C8172000-memory.dmp

Filesize
3.9MB

Download
memory/4332-63-0x00007FF7C7D80000-0x00007FF7C8172000-memory.dmp

Filesize
3.9MB

Download
memory/4416-146-0x00007FF7819E0000-0x00007FF781DD2000-memory.dmp

Filesize
3.9MB

Download
memory/4416-3358-0x00007FF7819E0000-0x00007FF781DD2000-memory.dmp

Filesize
3.9MB

Download
memory/4840-3348-0x00007FF796760000-0x00007FF796B52000-memory.dmp

Filesize
3.9MB

Download
memory/4840-126-0x00007FF796760000-0x00007FF796B52000-memory.dmp

Filesize
3.9MB

Download
memory/5060-84-0x00007FF75C2D0000-0x00007FF75C6C2000-memory.dmp

Filesize
3.9MB

Download
memory/5060-3341-0x00007FF75C2D0000-0x00007FF75C6C2000-memory.dmp

Filesize
3.9MB

Download