xmrig | 94d2e14ba7653b9cafa62dbccc9bc71edb5eab298870eab575e6a20810efdb36

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
Size 2.2MB
Sample240503-hd7nysbc92
SHA256 94d2e14ba7653b9cafa62dbccc9bc71edb5eab298870eab575e6a20810efdb36
MD5 0fe4d3b007fe17b20efe4fb4025035d3
SHA1 5842479aa87807438b9267759c77b7ecd41111e1
SHA512 ebb6f8553d7de2f6c8127d17d99a298b59ee0b2d300a95132b19a207f0b3a703c4278a7e17c8471f26a0cf88a84c2bee2f68720f7f10e647d6165f7e34890dcf
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfK:NABL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/1924-39-0x00007FF62A260000-0x00007FF62A652000-memory.dmp	xmrig
behavioral2/memory/5064-83-0x00007FF770C30000-0x00007FF771022000-memory.dmp	xmrig
behavioral2/memory/3192-167-0x00007FF7B61A0000-0x00007FF7B6592000-memory.dmp	xmrig
behavioral2/memory/3096-107-0x00007FF75DC10000-0x00007FF75E002000-memory.dmp	xmrig
behavioral2/memory/1012-98-0x00007FF621C50000-0x00007FF622042000-memory.dmp	xmrig
behavioral2/memory/4676-97-0x00007FF61C500000-0x00007FF61C8F2000-memory.dmp	xmrig
behavioral2/memory/2456-94-0x00007FF6826C0000-0x00007FF682AB2000-memory.dmp	xmrig
behavioral2/memory/3616-92-0x00007FF6F7AB0000-0x00007FF6F7EA2000-memory.dmp	xmrig
behavioral2/memory/3568-85-0x00007FF70AD10000-0x00007FF70B102000-memory.dmp	xmrig
behavioral2/memory/3612-84-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp	xmrig
behavioral2/memory/2320-70-0x00007FF75D630000-0x00007FF75DA22000-memory.dmp	xmrig
behavioral2/memory/5060-63-0x00007FF670C40000-0x00007FF671032000-memory.dmp	xmrig
behavioral2/memory/2752-57-0x00007FF7E79B0000-0x00007FF7E7DA2000-memory.dmp	xmrig
behavioral2/memory/384-33-0x00007FF760430000-0x00007FF760822000-memory.dmp	xmrig
behavioral2/memory/4432-2927-0x00007FF650540000-0x00007FF650932000-memory.dmp	xmrig
behavioral2/memory/924-2928-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp	xmrig
behavioral2/memory/224-2929-0x00007FF670360000-0x00007FF670752000-memory.dmp	xmrig
behavioral2/memory/1948-2930-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp	xmrig
behavioral2/memory/1620-2931-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp	xmrig
behavioral2/memory/1452-2932-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp	xmrig
behavioral2/memory/2320-2934-0x00007FF75D630000-0x00007FF75DA22000-memory.dmp	xmrig
behavioral2/memory/3568-2936-0x00007FF70AD10000-0x00007FF70B102000-memory.dmp	xmrig
behavioral2/memory/1012-2938-0x00007FF621C50000-0x00007FF622042000-memory.dmp	xmrig
behavioral2/memory/3616-2940-0x00007FF6F7AB0000-0x00007FF6F7EA2000-memory.dmp	xmrig
behavioral2/memory/4676-2943-0x00007FF61C500000-0x00007FF61C8F2000-memory.dmp	xmrig
behavioral2/memory/2456-2944-0x00007FF6826C0000-0x00007FF682AB2000-memory.dmp	xmrig
behavioral2/memory/3096-2946-0x00007FF75DC10000-0x00007FF75E002000-memory.dmp	xmrig
behavioral2/memory/540-2948-0x00007FF68C600000-0x00007FF68C9F2000-memory.dmp	xmrig
behavioral2/memory/4432-2952-0x00007FF650540000-0x00007FF650932000-memory.dmp	xmrig
behavioral2/memory/4716-2951-0x00007FF6AFBA0000-0x00007FF6AFF92000-memory.dmp	xmrig
behavioral2/memory/924-2955-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp	xmrig
behavioral2/memory/224-2958-0x00007FF670360000-0x00007FF670752000-memory.dmp	xmrig
behavioral2/memory/1948-2956-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp	xmrig
behavioral2/memory/1452-2965-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp	xmrig
behavioral2/memory/4084-2966-0x00007FF7FE470000-0x00007FF7FE862000-memory.dmp	xmrig
behavioral2/memory/3192-2963-0x00007FF7B61A0000-0x00007FF7B6592000-memory.dmp	xmrig
behavioral2/memory/1620-2960-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	3904	powershell.exe
10	3904	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3904	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4412	fHtOxQN.exe
5064	rejZTMH.exe
384	TbaJgow.exe
1924	EYiQZDJ.exe
2752	GLcUkto.exe
5060	lBXDwhQ.exe
3612	pKpwMur.exe
2320	chmNPnl.exe
3568	dfOgFCD.exe
3616	MVgAaFM.exe
1012	xKdyqDF.exe
2456	xqhVDGP.exe
4676	RPYsVxd.exe
3096	WWKMlVa.exe
540	HHUslmU.exe
4716	ftVterq.exe
4432	BURPkgT.exe
924	yWlQDTZ.exe
224	cTqaqqh.exe
1948	MXPwaJj.exe
1620	duueKAr.exe
1452	JxGQddN.exe
4084	DZnYFBp.exe
3192	NPrXYab.exe
2380	ItFOkkM.exe
4620	GXNSpvX.exe
3772	UDZzSVc.exe
3652	icZLekI.exe
1852	cUWAkdW.exe
3500	CcdXIkf.exe
4992	qzFTANz.exe
4276	ZnUjFHt.exe
3524	zcmViPg.exe
4644	ABDavOX.exe
1960	kGrBevN.exe
2500	cEaMSkc.exe
2020	rTRBdFo.exe
2904	MaHubCc.exe
3104	vmgrWsr.exe
4420	CHRMyOX.exe
4388	lOysyFn.exe
3344	dAVKMOW.exe
1368	SFZFpoY.exe
3436	PVJegxF.exe
3228	GlsfxfB.exe
2084	TRtSnHC.exe
3232	Ymxxhlg.exe
516	NzXknza.exe
2712	WKeUDYo.exe
1476	hVgBzdX.exe
4072	aBZAtCF.exe
4668	WBWGEKP.exe
888	evvdtkc.exe
1260	ptVRmWL.exe
2520	njaHWhR.exe
4888	xZhHCSa.exe
3988	rAHRygZ.exe
5116	oDEhpCh.exe
3432	rrLqPXn.exe
3300	IPmDwEf.exe
2584	DPcbULH.exe
2364	pGXFNJS.exe
1672	riNGrhx.exe
3872	FLIMdda.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3656-0-0x00007FF659540000-0x00007FF659932000-memory.dmp	upx
behavioral2/files/0x000b000000023b91-5.dat	upx
behavioral2/files/0x000a000000023b97-19.dat	upx
behavioral2/files/0x000a000000023b98-24.dat	upx
behavioral2/files/0x000a000000023b96-27.dat	upx
behavioral2/files/0x000a000000023b99-35.dat	upx
behavioral2/memory/1924-39-0x00007FF62A260000-0x00007FF62A652000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-43.dat	upx
behavioral2/files/0x000a000000023ba0-73.dat	upx
behavioral2/files/0x000a000000023ba1-80.dat	upx
behavioral2/memory/5064-83-0x00007FF770C30000-0x00007FF771022000-memory.dmp	upx
behavioral2/files/0x000b000000023b9f-86.dat	upx
behavioral2/files/0x000a000000023ba2-93.dat	upx
behavioral2/files/0x000b000000023b9e-104.dat	upx
behavioral2/files/0x000a000000023ba3-121.dat	upx
behavioral2/files/0x000a000000023ba6-129.dat	upx
behavioral2/memory/1620-149-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-156.dat	upx
behavioral2/files/0x000a000000023bb3-200.dat	upx
behavioral2/files/0x000a000000023bb1-198.dat	upx
behavioral2/files/0x000a000000023bb2-195.dat	upx
behavioral2/files/0x000a000000023bb0-193.dat	upx
behavioral2/files/0x000a000000023baf-188.dat	upx
behavioral2/files/0x000a000000023bae-183.dat	upx
behavioral2/files/0x000a000000023bad-178.dat	upx
behavioral2/files/0x000a000000023bac-173.dat	upx
behavioral2/files/0x000a000000023bab-168.dat	upx
behavioral2/memory/3192-167-0x00007FF7B61A0000-0x00007FF7B6592000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-162.dat	upx
behavioral2/memory/4084-161-0x00007FF7FE470000-0x00007FF7FE862000-memory.dmp	upx
behavioral2/memory/1452-155-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-150.dat	upx
behavioral2/files/0x000a000000023ba7-144.dat	upx
behavioral2/memory/1948-143-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp	upx
behavioral2/memory/224-137-0x00007FF670360000-0x00007FF670752000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-132.dat	upx
behavioral2/files/0x000a000000023ba4-127.dat	upx
behavioral2/memory/924-126-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp	upx
behavioral2/memory/4432-120-0x00007FF650540000-0x00007FF650932000-memory.dmp	upx
behavioral2/memory/4716-114-0x00007FF6AFBA0000-0x00007FF6AFF92000-memory.dmp	upx
behavioral2/memory/540-113-0x00007FF68C600000-0x00007FF68C9F2000-memory.dmp	upx
behavioral2/files/0x000b000000023b92-108.dat	upx
behavioral2/memory/3096-107-0x00007FF75DC10000-0x00007FF75E002000-memory.dmp	upx
behavioral2/memory/1012-98-0x00007FF621C50000-0x00007FF622042000-memory.dmp	upx
behavioral2/memory/4676-97-0x00007FF61C500000-0x00007FF61C8F2000-memory.dmp	upx
behavioral2/memory/2456-94-0x00007FF6826C0000-0x00007FF682AB2000-memory.dmp	upx
behavioral2/memory/3616-92-0x00007FF6F7AB0000-0x00007FF6F7EA2000-memory.dmp	upx
behavioral2/memory/3568-85-0x00007FF70AD10000-0x00007FF70B102000-memory.dmp	upx
behavioral2/memory/3612-84-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-81.dat	upx
behavioral2/memory/2320-70-0x00007FF75D630000-0x00007FF75DA22000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-67.dat	upx
behavioral2/memory/5060-63-0x00007FF670C40000-0x00007FF671032000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-59.dat	upx
behavioral2/memory/2752-57-0x00007FF7E79B0000-0x00007FF7E7DA2000-memory.dmp	upx
behavioral2/memory/384-33-0x00007FF760430000-0x00007FF760822000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-32.dat	upx
behavioral2/memory/4412-6-0x00007FF6009B0000-0x00007FF600DA2000-memory.dmp	upx
behavioral2/memory/4432-2927-0x00007FF650540000-0x00007FF650932000-memory.dmp	upx
behavioral2/memory/924-2928-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp	upx
behavioral2/memory/224-2929-0x00007FF670360000-0x00007FF670752000-memory.dmp	upx
behavioral2/memory/1948-2930-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp	upx
behavioral2/memory/1620-2931-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp	upx
behavioral2/memory/1452-2932-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vNPMvuE.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\dVbFmzs.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\XsajVVx.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\swvZkXx.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\RUBZEHY.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\nitjlcU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\zdhhasp.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\EFhxowE.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\PgvPJYX.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\cPfMiXz.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\oPtdYJV.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\BeZNWcF.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\MXKgBgU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\WYgNWPx.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\aNHNwIa.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\ZUQWalu.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\DIdLJKz.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\fBbiRBq.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\uFJKqEW.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\qzFTANz.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\svCSYkD.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\BsFrllU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\GYvCvHW.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\rnlfJOl.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\xTdzIga.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\XbRgrTT.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\JxGQddN.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\qqDimKb.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\XjCMNmb.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\kIyoQfw.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\dxQRMIa.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\OTVTAGl.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\pLozGLD.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\OWqkzLJ.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\VvsvDhh.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\UNkSZPX.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\wMPPjPJ.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\ryEbxcV.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\NjXyCyf.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\vlYQgGU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\PTwHVpg.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\NMswFwk.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\BJYtiVs.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\RkXAsrM.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\aoputIV.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\kTrGyei.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\icZLekI.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\ZwqAION.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\fVwzBps.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\BkCzKwh.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\eGVGYJq.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\LIRGqAz.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\fOVOVYA.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\YxQuxMY.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\ekyhcfs.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\EKYQTOi.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\IJoCJPO.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\xhbjeaU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\lgLnekJ.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\gGPCimP.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\dEkBJQU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\klSCtMt.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\OrHtYLl.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\hotkkyJ.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3904	powershell.exe
3904	powershell.exe
3904	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeLockMemoryPrivilege	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 3904	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	84
PID 3656 wrote to memory of 3904	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	84
PID 3656 wrote to memory of 4412	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	85
PID 3656 wrote to memory of 4412	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	85
PID 3656 wrote to memory of 5064	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	86
PID 3656 wrote to memory of 5064	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	86
PID 3656 wrote to memory of 2752	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	87
PID 3656 wrote to memory of 2752	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	87
PID 3656 wrote to memory of 384	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	88
PID 3656 wrote to memory of 384	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	88
PID 3656 wrote to memory of 1924	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	89
PID 3656 wrote to memory of 1924	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	89
PID 3656 wrote to memory of 5060	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	90
PID 3656 wrote to memory of 5060	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	90
PID 3656 wrote to memory of 3612	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	91
PID 3656 wrote to memory of 3612	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	91
PID 3656 wrote to memory of 2320	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	92
PID 3656 wrote to memory of 2320	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	92
PID 3656 wrote to memory of 3568	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	93
PID 3656 wrote to memory of 3568	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	93
PID 3656 wrote to memory of 3616	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	94
PID 3656 wrote to memory of 3616	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	94
PID 3656 wrote to memory of 1012	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	95
PID 3656 wrote to memory of 1012	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	95
PID 3656 wrote to memory of 2456	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	96
PID 3656 wrote to memory of 2456	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	96
PID 3656 wrote to memory of 4676	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	97
PID 3656 wrote to memory of 4676	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	97
PID 3656 wrote to memory of 3096	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	98
PID 3656 wrote to memory of 3096	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	98
PID 3656 wrote to memory of 540	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	99
PID 3656 wrote to memory of 540	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	99
PID 3656 wrote to memory of 4716	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	100
PID 3656 wrote to memory of 4716	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	100
PID 3656 wrote to memory of 4432	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	101
PID 3656 wrote to memory of 4432	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	101
PID 3656 wrote to memory of 924	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	102
PID 3656 wrote to memory of 924	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	102
PID 3656 wrote to memory of 224	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	103
PID 3656 wrote to memory of 224	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	103
PID 3656 wrote to memory of 1948	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	104
PID 3656 wrote to memory of 1948	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	104
PID 3656 wrote to memory of 1620	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	105
PID 3656 wrote to memory of 1620	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	105
PID 3656 wrote to memory of 1452	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	106
PID 3656 wrote to memory of 1452	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	106
PID 3656 wrote to memory of 4084	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	107
PID 3656 wrote to memory of 4084	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	107
PID 3656 wrote to memory of 3192	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	108
PID 3656 wrote to memory of 3192	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	108
PID 3656 wrote to memory of 2380	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	109
PID 3656 wrote to memory of 2380	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	109
PID 3656 wrote to memory of 4620	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	110
PID 3656 wrote to memory of 4620	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	110
PID 3656 wrote to memory of 3772	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	111
PID 3656 wrote to memory of 3772	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	111
PID 3656 wrote to memory of 3652	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	112
PID 3656 wrote to memory of 3652	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	112
PID 3656 wrote to memory of 1852	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	113
PID 3656 wrote to memory of 1852	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	113
PID 3656 wrote to memory of 3500	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	114
PID 3656 wrote to memory of 3500	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	114
PID 3656 wrote to memory of 4992	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	115
PID 3656 wrote to memory of 4992	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3904
- C:\Windows\System\fHtOxQN.exe
  C:\Windows\System\fHtOxQN.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\rejZTMH.exe
  C:\Windows\System\rejZTMH.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\GLcUkto.exe
  C:\Windows\System\GLcUkto.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\TbaJgow.exe
  C:\Windows\System\TbaJgow.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\EYiQZDJ.exe
  C:\Windows\System\EYiQZDJ.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\lBXDwhQ.exe
  C:\Windows\System\lBXDwhQ.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\pKpwMur.exe
  C:\Windows\System\pKpwMur.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\chmNPnl.exe
  C:\Windows\System\chmNPnl.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\dfOgFCD.exe
  C:\Windows\System\dfOgFCD.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\MVgAaFM.exe
  C:\Windows\System\MVgAaFM.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\xKdyqDF.exe
  C:\Windows\System\xKdyqDF.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\xqhVDGP.exe
  C:\Windows\System\xqhVDGP.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\RPYsVxd.exe
  C:\Windows\System\RPYsVxd.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\WWKMlVa.exe
  C:\Windows\System\WWKMlVa.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\HHUslmU.exe
  C:\Windows\System\HHUslmU.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\ftVterq.exe
  C:\Windows\System\ftVterq.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\BURPkgT.exe
  C:\Windows\System\BURPkgT.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\yWlQDTZ.exe
  C:\Windows\System\yWlQDTZ.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\cTqaqqh.exe
  C:\Windows\System\cTqaqqh.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\MXPwaJj.exe
  C:\Windows\System\MXPwaJj.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\duueKAr.exe
  C:\Windows\System\duueKAr.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\JxGQddN.exe
  C:\Windows\System\JxGQddN.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\DZnYFBp.exe
  C:\Windows\System\DZnYFBp.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\NPrXYab.exe
  C:\Windows\System\NPrXYab.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\ItFOkkM.exe
  C:\Windows\System\ItFOkkM.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\GXNSpvX.exe
  C:\Windows\System\GXNSpvX.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\UDZzSVc.exe
  C:\Windows\System\UDZzSVc.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\icZLekI.exe
  C:\Windows\System\icZLekI.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\cUWAkdW.exe
  C:\Windows\System\cUWAkdW.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\CcdXIkf.exe
  C:\Windows\System\CcdXIkf.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\qzFTANz.exe
  C:\Windows\System\qzFTANz.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\ZnUjFHt.exe
  C:\Windows\System\ZnUjFHt.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\zcmViPg.exe
  C:\Windows\System\zcmViPg.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\ABDavOX.exe
  C:\Windows\System\ABDavOX.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\kGrBevN.exe
  C:\Windows\System\kGrBevN.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\cEaMSkc.exe
  C:\Windows\System\cEaMSkc.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\rTRBdFo.exe
  C:\Windows\System\rTRBdFo.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\MaHubCc.exe
  C:\Windows\System\MaHubCc.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\vmgrWsr.exe
  C:\Windows\System\vmgrWsr.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\CHRMyOX.exe
  C:\Windows\System\CHRMyOX.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\lOysyFn.exe
  C:\Windows\System\lOysyFn.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\dAVKMOW.exe
  C:\Windows\System\dAVKMOW.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\SFZFpoY.exe
  C:\Windows\System\SFZFpoY.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\PVJegxF.exe
  C:\Windows\System\PVJegxF.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\GlsfxfB.exe
  C:\Windows\System\GlsfxfB.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\TRtSnHC.exe
  C:\Windows\System\TRtSnHC.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\Ymxxhlg.exe
  C:\Windows\System\Ymxxhlg.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\NzXknza.exe
  C:\Windows\System\NzXknza.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\WKeUDYo.exe
  C:\Windows\System\WKeUDYo.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\hVgBzdX.exe
  C:\Windows\System\hVgBzdX.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\aBZAtCF.exe
  C:\Windows\System\aBZAtCF.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\WBWGEKP.exe
  C:\Windows\System\WBWGEKP.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\evvdtkc.exe
  C:\Windows\System\evvdtkc.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\ptVRmWL.exe
  C:\Windows\System\ptVRmWL.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\njaHWhR.exe
  C:\Windows\System\njaHWhR.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\xZhHCSa.exe
  C:\Windows\System\xZhHCSa.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\rAHRygZ.exe
  C:\Windows\System\rAHRygZ.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\oDEhpCh.exe
  C:\Windows\System\oDEhpCh.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\rrLqPXn.exe
  C:\Windows\System\rrLqPXn.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\IPmDwEf.exe
  C:\Windows\System\IPmDwEf.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\DPcbULH.exe
  C:\Windows\System\DPcbULH.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\pGXFNJS.exe
  C:\Windows\System\pGXFNJS.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\riNGrhx.exe
  C:\Windows\System\riNGrhx.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\FLIMdda.exe
  C:\Windows\System\FLIMdda.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\HvDRxMt.exe
  C:\Windows\System\HvDRxMt.exe
  2⤵
  PID:1372
- C:\Windows\System\vmKhTud.exe
  C:\Windows\System\vmKhTud.exe
  2⤵
  PID:3484
- C:\Windows\System\hoUftfX.exe
  C:\Windows\System\hoUftfX.exe
  2⤵
  PID:4320
- C:\Windows\System\cbpHeOv.exe
  C:\Windows\System\cbpHeOv.exe
  2⤵
  PID:5152
- C:\Windows\System\svCSYkD.exe
  C:\Windows\System\svCSYkD.exe
  2⤵
  PID:5176
- C:\Windows\System\qAvdUNF.exe
  C:\Windows\System\qAvdUNF.exe
  2⤵
  PID:5204
- C:\Windows\System\UiTstfZ.exe
  C:\Windows\System\UiTstfZ.exe
  2⤵
  PID:5236
- C:\Windows\System\Ywgbvun.exe
  C:\Windows\System\Ywgbvun.exe
  2⤵
  PID:5264
- C:\Windows\System\pLozGLD.exe
  C:\Windows\System\pLozGLD.exe
  2⤵
  PID:5288
- C:\Windows\System\cKmyIzN.exe
  C:\Windows\System\cKmyIzN.exe
  2⤵
  PID:5316
- C:\Windows\System\hdzAwLL.exe
  C:\Windows\System\hdzAwLL.exe
  2⤵
  PID:5344
- C:\Windows\System\JsALWxR.exe
  C:\Windows\System\JsALWxR.exe
  2⤵
  PID:5372
- C:\Windows\System\pOSYtPV.exe
  C:\Windows\System\pOSYtPV.exe
  2⤵
  PID:5400
- C:\Windows\System\ZPVFMMJ.exe
  C:\Windows\System\ZPVFMMJ.exe
  2⤵
  PID:5432
- C:\Windows\System\JVwtFtA.exe
  C:\Windows\System\JVwtFtA.exe
  2⤵
  PID:5460
- C:\Windows\System\NgkeBaf.exe
  C:\Windows\System\NgkeBaf.exe
  2⤵
  PID:5492
- C:\Windows\System\RGJAzzO.exe
  C:\Windows\System\RGJAzzO.exe
  2⤵
  PID:5516
- C:\Windows\System\YRkOhkw.exe
  C:\Windows\System\YRkOhkw.exe
  2⤵
  PID:5544
- C:\Windows\System\IOYxqlI.exe
  C:\Windows\System\IOYxqlI.exe
  2⤵
  PID:5572
- C:\Windows\System\nfoGCjA.exe
  C:\Windows\System\nfoGCjA.exe
  2⤵
  PID:5600
- C:\Windows\System\rPwZSTe.exe
  C:\Windows\System\rPwZSTe.exe
  2⤵
  PID:5628
- C:\Windows\System\OWqkzLJ.exe
  C:\Windows\System\OWqkzLJ.exe
  2⤵
  PID:5656
- C:\Windows\System\UwbnNZI.exe
  C:\Windows\System\UwbnNZI.exe
  2⤵
  PID:5684
- C:\Windows\System\nJtoRdb.exe
  C:\Windows\System\nJtoRdb.exe
  2⤵
  PID:5712
- C:\Windows\System\JERowlA.exe
  C:\Windows\System\JERowlA.exe
  2⤵
  PID:5744
- C:\Windows\System\nrkjKCC.exe
  C:\Windows\System\nrkjKCC.exe
  2⤵
  PID:5796
- C:\Windows\System\QaYEflo.exe
  C:\Windows\System\QaYEflo.exe
  2⤵
  PID:5820
- C:\Windows\System\bxJEyfe.exe
  C:\Windows\System\bxJEyfe.exe
  2⤵
  PID:5836
- C:\Windows\System\qqDimKb.exe
  C:\Windows\System\qqDimKb.exe
  2⤵
  PID:5860
- C:\Windows\System\DxBrbXi.exe
  C:\Windows\System\DxBrbXi.exe
  2⤵
  PID:5892
- C:\Windows\System\gDqezbK.exe
  C:\Windows\System\gDqezbK.exe
  2⤵
  PID:5920
- C:\Windows\System\xsdZFVr.exe
  C:\Windows\System\xsdZFVr.exe
  2⤵
  PID:5944
- C:\Windows\System\CCYOhjU.exe
  C:\Windows\System\CCYOhjU.exe
  2⤵
  PID:5976
- C:\Windows\System\HNnUENz.exe
  C:\Windows\System\HNnUENz.exe
  2⤵
  PID:5996
- C:\Windows\System\HYfSICC.exe
  C:\Windows\System\HYfSICC.exe
  2⤵
  PID:6024
- C:\Windows\System\PTwHVpg.exe
  C:\Windows\System\PTwHVpg.exe
  2⤵
  PID:6048
- C:\Windows\System\VvsvDhh.exe
  C:\Windows\System\VvsvDhh.exe
  2⤵
  PID:6080
- C:\Windows\System\QjKWeNZ.exe
  C:\Windows\System\QjKWeNZ.exe
  2⤵
  PID:6108
- C:\Windows\System\UeMmVzo.exe
  C:\Windows\System\UeMmVzo.exe
  2⤵
  PID:6132
- C:\Windows\System\NCENCuW.exe
  C:\Windows\System\NCENCuW.exe
  2⤵
  PID:2420
- C:\Windows\System\xOrGhvJ.exe
  C:\Windows\System\xOrGhvJ.exe
  2⤵
  PID:1128
- C:\Windows\System\bmnYSwG.exe
  C:\Windows\System\bmnYSwG.exe
  2⤵
  PID:4508
- C:\Windows\System\IqLrmLl.exe
  C:\Windows\System\IqLrmLl.exe
  2⤵
  PID:4188
- C:\Windows\System\gLBMKCG.exe
  C:\Windows\System\gLBMKCG.exe
  2⤵
  PID:1644
- C:\Windows\System\qdrCeuS.exe
  C:\Windows\System\qdrCeuS.exe
  2⤵
  PID:5160
- C:\Windows\System\okyHFPg.exe
  C:\Windows\System\okyHFPg.exe
  2⤵
  PID:5216
- C:\Windows\System\YDRQZEA.exe
  C:\Windows\System\YDRQZEA.exe
  2⤵
  PID:5284
- C:\Windows\System\xrRpBRL.exe
  C:\Windows\System\xrRpBRL.exe
  2⤵
  PID:5360
- C:\Windows\System\WaNmqHg.exe
  C:\Windows\System\WaNmqHg.exe
  2⤵
  PID:5420
- C:\Windows\System\bkHydHo.exe
  C:\Windows\System\bkHydHo.exe
  2⤵
  PID:5500
- C:\Windows\System\aPbldeZ.exe
  C:\Windows\System\aPbldeZ.exe
  2⤵
  PID:5564
- C:\Windows\System\EpnMkkl.exe
  C:\Windows\System\EpnMkkl.exe
  2⤵
  PID:5616
- C:\Windows\System\uVtAoyT.exe
  C:\Windows\System\uVtAoyT.exe
  2⤵
  PID:5696
- C:\Windows\System\pZtOMAI.exe
  C:\Windows\System\pZtOMAI.exe
  2⤵
  PID:5760
- C:\Windows\System\FbMNEkC.exe
  C:\Windows\System\FbMNEkC.exe
  2⤵
  PID:5828
- C:\Windows\System\wrLmQWj.exe
  C:\Windows\System\wrLmQWj.exe
  2⤵
  PID:5880
- C:\Windows\System\GAdmsmT.exe
  C:\Windows\System\GAdmsmT.exe
  2⤵
  PID:5936
- C:\Windows\System\iBeihvI.exe
  C:\Windows\System\iBeihvI.exe
  2⤵
  PID:6008
- C:\Windows\System\ZAgUPWm.exe
  C:\Windows\System\ZAgUPWm.exe
  2⤵
  PID:6068
- C:\Windows\System\TlcASgA.exe
  C:\Windows\System\TlcASgA.exe
  2⤵
  PID:6124
- C:\Windows\System\iRikfdq.exe
  C:\Windows\System\iRikfdq.exe
  2⤵
  PID:3928
- C:\Windows\System\oIVdfqY.exe
  C:\Windows\System\oIVdfqY.exe
  2⤵
  PID:4416
- C:\Windows\System\klerJLF.exe
  C:\Windows\System\klerJLF.exe
  2⤵
  PID:428
- C:\Windows\System\DScFcqM.exe
  C:\Windows\System\DScFcqM.exe
  2⤵
  PID:5256
- C:\Windows\System\tApfowq.exe
  C:\Windows\System\tApfowq.exe
  2⤵
  PID:5356
- C:\Windows\System\qBehpCa.exe
  C:\Windows\System\qBehpCa.exe
  2⤵
  PID:5532
- C:\Windows\System\EltDPjN.exe
  C:\Windows\System\EltDPjN.exe
  2⤵
  PID:5648
- C:\Windows\System\KhTHlPg.exe
  C:\Windows\System\KhTHlPg.exe
  2⤵
  PID:5764
- C:\Windows\System\QlIkaOQ.exe
  C:\Windows\System\QlIkaOQ.exe
  2⤵
  PID:5912
- C:\Windows\System\topHfsH.exe
  C:\Windows\System\topHfsH.exe
  2⤵
  PID:6040
- C:\Windows\System\aPQPBMw.exe
  C:\Windows\System\aPQPBMw.exe
  2⤵
  PID:5048
- C:\Windows\System\DbYjEDM.exe
  C:\Windows\System\DbYjEDM.exe
  2⤵
  PID:5244
- C:\Windows\System\vgOMfTn.exe
  C:\Windows\System\vgOMfTn.exe
  2⤵
  PID:5328
- C:\Windows\System\xWaIBDo.exe
  C:\Windows\System\xWaIBDo.exe
  2⤵
  PID:6148
- C:\Windows\System\VUPXowr.exe
  C:\Windows\System\VUPXowr.exe
  2⤵
  PID:6180
- C:\Windows\System\nLFAWoU.exe
  C:\Windows\System\nLFAWoU.exe
  2⤵
  PID:6204
- C:\Windows\System\NRVVPyj.exe
  C:\Windows\System\NRVVPyj.exe
  2⤵
  PID:6232
- C:\Windows\System\UbfZAmK.exe
  C:\Windows\System\UbfZAmK.exe
  2⤵
  PID:6260
- C:\Windows\System\lAvlVnl.exe
  C:\Windows\System\lAvlVnl.exe
  2⤵
  PID:6288
- C:\Windows\System\EiMaDjo.exe
  C:\Windows\System\EiMaDjo.exe
  2⤵
  PID:6316
- C:\Windows\System\rtrLdWO.exe
  C:\Windows\System\rtrLdWO.exe
  2⤵
  PID:6344
- C:\Windows\System\vPnloHH.exe
  C:\Windows\System\vPnloHH.exe
  2⤵
  PID:6372
- C:\Windows\System\UoCggea.exe
  C:\Windows\System\UoCggea.exe
  2⤵
  PID:6400
- C:\Windows\System\oqBVatS.exe
  C:\Windows\System\oqBVatS.exe
  2⤵
  PID:6428
- C:\Windows\System\djctksY.exe
  C:\Windows\System\djctksY.exe
  2⤵
  PID:6452
- C:\Windows\System\CAubtRb.exe
  C:\Windows\System\CAubtRb.exe
  2⤵
  PID:6480
- C:\Windows\System\PgGMqiX.exe
  C:\Windows\System\PgGMqiX.exe
  2⤵
  PID:6508
- C:\Windows\System\myPCQJV.exe
  C:\Windows\System\myPCQJV.exe
  2⤵
  PID:6540
- C:\Windows\System\BsFrllU.exe
  C:\Windows\System\BsFrllU.exe
  2⤵
  PID:6564
- C:\Windows\System\zXklFaR.exe
  C:\Windows\System\zXklFaR.exe
  2⤵
  PID:6596
- C:\Windows\System\UNkSZPX.exe
  C:\Windows\System\UNkSZPX.exe
  2⤵
  PID:6620
- C:\Windows\System\XXYkZZK.exe
  C:\Windows\System\XXYkZZK.exe
  2⤵
  PID:6652
- C:\Windows\System\xkOdqlX.exe
  C:\Windows\System\xkOdqlX.exe
  2⤵
  PID:6676
- C:\Windows\System\bchinBH.exe
  C:\Windows\System\bchinBH.exe
  2⤵
  PID:6704
- C:\Windows\System\gQaoCxG.exe
  C:\Windows\System\gQaoCxG.exe
  2⤵
  PID:6732
- C:\Windows\System\eIYOHAV.exe
  C:\Windows\System\eIYOHAV.exe
  2⤵
  PID:6764
- C:\Windows\System\fOhhJDl.exe
  C:\Windows\System\fOhhJDl.exe
  2⤵
  PID:6788
- C:\Windows\System\yssDHFF.exe
  C:\Windows\System\yssDHFF.exe
  2⤵
  PID:6820
- C:\Windows\System\nBVAHmK.exe
  C:\Windows\System\nBVAHmK.exe
  2⤵
  PID:6848
- C:\Windows\System\hotkkyJ.exe
  C:\Windows\System\hotkkyJ.exe
  2⤵
  PID:6876
- C:\Windows\System\TMkOoui.exe
  C:\Windows\System\TMkOoui.exe
  2⤵
  PID:6900
- C:\Windows\System\WqYEWIc.exe
  C:\Windows\System\WqYEWIc.exe
  2⤵
  PID:6932
- C:\Windows\System\vMzMLFZ.exe
  C:\Windows\System\vMzMLFZ.exe
  2⤵
  PID:6960
- C:\Windows\System\RcwTVMA.exe
  C:\Windows\System\RcwTVMA.exe
  2⤵
  PID:6988
- C:\Windows\System\EgCrkZI.exe
  C:\Windows\System\EgCrkZI.exe
  2⤵
  PID:7016
- C:\Windows\System\aEtCpOt.exe
  C:\Windows\System\aEtCpOt.exe
  2⤵
  PID:7044
- C:\Windows\System\uatmOTN.exe
  C:\Windows\System\uatmOTN.exe
  2⤵
  PID:7068
- C:\Windows\System\zjYxfik.exe
  C:\Windows\System\zjYxfik.exe
  2⤵
  PID:7100
- C:\Windows\System\mcGNZmV.exe
  C:\Windows\System\mcGNZmV.exe
  2⤵
  PID:7124
- C:\Windows\System\PkJCnYj.exe
  C:\Windows\System\PkJCnYj.exe
  2⤵
  PID:7152
- C:\Windows\System\vAYZROp.exe
  C:\Windows\System\vAYZROp.exe
  2⤵
  PID:5672
- C:\Windows\System\Kgrqehb.exe
  C:\Windows\System\Kgrqehb.exe
  2⤵
  PID:5972
- C:\Windows\System\LgnzQJY.exe
  C:\Windows\System\LgnzQJY.exe
  2⤵
  PID:1456
- C:\Windows\System\ebsfeTh.exe
  C:\Windows\System\ebsfeTh.exe
  2⤵
  PID:5476
- C:\Windows\System\CtKLgLF.exe
  C:\Windows\System\CtKLgLF.exe
  2⤵
  PID:6196
- C:\Windows\System\BaklgSP.exe
  C:\Windows\System\BaklgSP.exe
  2⤵
  PID:6252
- C:\Windows\System\ynzQVVI.exe
  C:\Windows\System\ynzQVVI.exe
  2⤵
  PID:6308
- C:\Windows\System\snArDuu.exe
  C:\Windows\System\snArDuu.exe
  2⤵
  PID:6364
- C:\Windows\System\qMJBTys.exe
  C:\Windows\System\qMJBTys.exe
  2⤵
  PID:6420
- C:\Windows\System\msWqcXw.exe
  C:\Windows\System\msWqcXw.exe
  2⤵
  PID:1940
- C:\Windows\System\qZXtnIK.exe
  C:\Windows\System\qZXtnIK.exe
  2⤵
  PID:1436
- C:\Windows\System\BCsovei.exe
  C:\Windows\System\BCsovei.exe
  2⤵
  PID:2916
- C:\Windows\System\DVfCFHl.exe
  C:\Windows\System\DVfCFHl.exe
  2⤵
  PID:6668
- C:\Windows\System\MEZrkFm.exe
  C:\Windows\System\MEZrkFm.exe
  2⤵
  PID:6696
- C:\Windows\System\tveJcdY.exe
  C:\Windows\System\tveJcdY.exe
  2⤵
  PID:6752
- C:\Windows\System\sMPmpCn.exe
  C:\Windows\System\sMPmpCn.exe
  2⤵
  PID:6832
- C:\Windows\System\AZemJIh.exe
  C:\Windows\System\AZemJIh.exe
  2⤵
  PID:6920
- C:\Windows\System\JgpoJQt.exe
  C:\Windows\System\JgpoJQt.exe
  2⤵
  PID:6952
- C:\Windows\System\tqFLMIY.exe
  C:\Windows\System\tqFLMIY.exe
  2⤵
  PID:7000
- C:\Windows\System\FRwOxDq.exe
  C:\Windows\System\FRwOxDq.exe
  2⤵
  PID:7028
- C:\Windows\System\HqLzTAb.exe
  C:\Windows\System\HqLzTAb.exe
  2⤵
  PID:7060
- C:\Windows\System\LhbycLR.exe
  C:\Windows\System\LhbycLR.exe
  2⤵
  PID:920
- C:\Windows\System\QfuDdSI.exe
  C:\Windows\System\QfuDdSI.exe
  2⤵
  PID:3360
- C:\Windows\System\qKDHnDD.exe
  C:\Windows\System\qKDHnDD.exe
  2⤵
  PID:7120
- C:\Windows\System\CNMAucY.exe
  C:\Windows\System\CNMAucY.exe
  2⤵
  PID:5556
- C:\Windows\System\fFAikFw.exe
  C:\Windows\System\fFAikFw.exe
  2⤵
  PID:6120
- C:\Windows\System\zuHkkLY.exe
  C:\Windows\System\zuHkkLY.exe
  2⤵
  PID:6176
- C:\Windows\System\VxrrTFv.exe
  C:\Windows\System\VxrrTFv.exe
  2⤵
  PID:432
- C:\Windows\System\JSQyLbv.exe
  C:\Windows\System\JSQyLbv.exe
  2⤵
  PID:6448
- C:\Windows\System\voaMKmN.exe
  C:\Windows\System\voaMKmN.exe
  2⤵
  PID:3108
- C:\Windows\System\JgiSUjV.exe
  C:\Windows\System\JgiSUjV.exe
  2⤵
  PID:2924
- C:\Windows\System\wkEYowL.exe
  C:\Windows\System\wkEYowL.exe
  2⤵
  PID:2276
- C:\Windows\System\nseUZWm.exe
  C:\Windows\System\nseUZWm.exe
  2⤵
  PID:1172
- C:\Windows\System\SoSbqZk.exe
  C:\Windows\System\SoSbqZk.exe
  2⤵
  PID:628
- C:\Windows\System\cShRscL.exe
  C:\Windows\System\cShRscL.exe
  2⤵
  PID:6640
- C:\Windows\System\hmYgaPN.exe
  C:\Windows\System\hmYgaPN.exe
  2⤵
  PID:6840
- C:\Windows\System\AmZpgNj.exe
  C:\Windows\System\AmZpgNj.exe
  2⤵
  PID:4876
- C:\Windows\System\HmIwGnk.exe
  C:\Windows\System\HmIwGnk.exe
  2⤵
  PID:7032
- C:\Windows\System\DnJhMqG.exe
  C:\Windows\System\DnJhMqG.exe
  2⤵
  PID:756
- C:\Windows\System\wVMdIvt.exe
  C:\Windows\System\wVMdIvt.exe
  2⤵
  PID:7084
- C:\Windows\System\drYkPOA.exe
  C:\Windows\System\drYkPOA.exe
  2⤵
  PID:5416
- C:\Windows\System\hMXUZrf.exe
  C:\Windows\System\hMXUZrf.exe
  2⤵
  PID:6332
- C:\Windows\System\ayLySEe.exe
  C:\Windows\System\ayLySEe.exe
  2⤵
  PID:1488
- C:\Windows\System\QfljyEW.exe
  C:\Windows\System\QfljyEW.exe
  2⤵
  PID:5000
- C:\Windows\System\AsFAKeN.exe
  C:\Windows\System\AsFAKeN.exe
  2⤵
  PID:4372
- C:\Windows\System\dESXRTX.exe
  C:\Windows\System\dESXRTX.exe
  2⤵
  PID:6664
- C:\Windows\System\MmWkwVr.exe
  C:\Windows\System\MmWkwVr.exe
  2⤵
  PID:2572
- C:\Windows\System\wMPPjPJ.exe
  C:\Windows\System\wMPPjPJ.exe
  2⤵
  PID:5188
- C:\Windows\System\DTVoVmT.exe
  C:\Windows\System\DTVoVmT.exe
  2⤵
  PID:6472
- C:\Windows\System\aATtXZC.exe
  C:\Windows\System\aATtXZC.exe
  2⤵
  PID:5856
- C:\Windows\System\WQNCpGk.exe
  C:\Windows\System\WQNCpGk.exe
  2⤵
  PID:7172
- C:\Windows\System\OzuHcfD.exe
  C:\Windows\System\OzuHcfD.exe
  2⤵
  PID:7196
- C:\Windows\System\yBwCpgB.exe
  C:\Windows\System\yBwCpgB.exe
  2⤵
  PID:7216
- C:\Windows\System\weCoTCU.exe
  C:\Windows\System\weCoTCU.exe
  2⤵
  PID:7252
- C:\Windows\System\pTZtade.exe
  C:\Windows\System\pTZtade.exe
  2⤵
  PID:7268
- C:\Windows\System\ubymSTY.exe
  C:\Windows\System\ubymSTY.exe
  2⤵
  PID:7300
- C:\Windows\System\AHZQGnU.exe
  C:\Windows\System\AHZQGnU.exe
  2⤵
  PID:7348
- C:\Windows\System\hitpyLG.exe
  C:\Windows\System\hitpyLG.exe
  2⤵
  PID:7372
- C:\Windows\System\RjkOTjg.exe
  C:\Windows\System\RjkOTjg.exe
  2⤵
  PID:7396
- C:\Windows\System\gdUGXDL.exe
  C:\Windows\System\gdUGXDL.exe
  2⤵
  PID:7420
- C:\Windows\System\oHlyPBg.exe
  C:\Windows\System\oHlyPBg.exe
  2⤵
  PID:7440
- C:\Windows\System\pdKoxPb.exe
  C:\Windows\System\pdKoxPb.exe
  2⤵
  PID:7484
- C:\Windows\System\iqPQrQl.exe
  C:\Windows\System\iqPQrQl.exe
  2⤵
  PID:7500
- C:\Windows\System\Vqsssbz.exe
  C:\Windows\System\Vqsssbz.exe
  2⤵
  PID:7548
- C:\Windows\System\YQyqVtU.exe
  C:\Windows\System\YQyqVtU.exe
  2⤵
  PID:7568
- C:\Windows\System\arLbFSL.exe
  C:\Windows\System\arLbFSL.exe
  2⤵
  PID:7592
- C:\Windows\System\LcAevfK.exe
  C:\Windows\System\LcAevfK.exe
  2⤵
  PID:7616
- C:\Windows\System\cdRYJMk.exe
  C:\Windows\System\cdRYJMk.exe
  2⤵
  PID:7636
- C:\Windows\System\HCKBmew.exe
  C:\Windows\System\HCKBmew.exe
  2⤵
  PID:7660
- C:\Windows\System\ftXlsfe.exe
  C:\Windows\System\ftXlsfe.exe
  2⤵
  PID:7692
- C:\Windows\System\CRKsQON.exe
  C:\Windows\System\CRKsQON.exe
  2⤵
  PID:7712
- C:\Windows\System\ZWaqdEt.exe
  C:\Windows\System\ZWaqdEt.exe
  2⤵
  PID:7744
- C:\Windows\System\cncwSIf.exe
  C:\Windows\System\cncwSIf.exe
  2⤵
  PID:7792
- C:\Windows\System\BxiafWn.exe
  C:\Windows\System\BxiafWn.exe
  2⤵
  PID:7816
- C:\Windows\System\VcPbSxD.exe
  C:\Windows\System\VcPbSxD.exe
  2⤵
  PID:7864
- C:\Windows\System\QAEGQrv.exe
  C:\Windows\System\QAEGQrv.exe
  2⤵
  PID:7892
- C:\Windows\System\xNXxpRP.exe
  C:\Windows\System\xNXxpRP.exe
  2⤵
  PID:7912
- C:\Windows\System\KClNRRu.exe
  C:\Windows\System\KClNRRu.exe
  2⤵
  PID:7932
- C:\Windows\System\cBKbvCJ.exe
  C:\Windows\System\cBKbvCJ.exe
  2⤵
  PID:7960
- C:\Windows\System\LVPfbhY.exe
  C:\Windows\System\LVPfbhY.exe
  2⤵
  PID:7980
- C:\Windows\System\ZrJAIVb.exe
  C:\Windows\System\ZrJAIVb.exe
  2⤵
  PID:8004
- C:\Windows\System\cWTesoe.exe
  C:\Windows\System\cWTesoe.exe
  2⤵
  PID:8028
- C:\Windows\System\TWVyQTn.exe
  C:\Windows\System\TWVyQTn.exe
  2⤵
  PID:8056
- C:\Windows\System\ZwqAION.exe
  C:\Windows\System\ZwqAION.exe
  2⤵
  PID:8084
- C:\Windows\System\jKezCmb.exe
  C:\Windows\System\jKezCmb.exe
  2⤵
  PID:8100
- C:\Windows\System\SSfkbbc.exe
  C:\Windows\System\SSfkbbc.exe
  2⤵
  PID:8116
- C:\Windows\System\Alqzrow.exe
  C:\Windows\System\Alqzrow.exe
  2⤵
  PID:8172
- C:\Windows\System\apEtuBD.exe
  C:\Windows\System\apEtuBD.exe
  2⤵
  PID:7208
- C:\Windows\System\oSocTju.exe
  C:\Windows\System\oSocTju.exe
  2⤵
  PID:7192
- C:\Windows\System\fzqvmBv.exe
  C:\Windows\System\fzqvmBv.exe
  2⤵
  PID:7280
- C:\Windows\System\BKnaROv.exe
  C:\Windows\System\BKnaROv.exe
  2⤵
  PID:7380
- C:\Windows\System\yYJSAwF.exe
  C:\Windows\System\yYJSAwF.exe
  2⤵
  PID:7432
- C:\Windows\System\JorqkMe.exe
  C:\Windows\System\JorqkMe.exe
  2⤵
  PID:7540
- C:\Windows\System\xDJPBAK.exe
  C:\Windows\System\xDJPBAK.exe
  2⤵
  PID:7576
- C:\Windows\System\JGzEaqB.exe
  C:\Windows\System\JGzEaqB.exe
  2⤵
  PID:7632
- C:\Windows\System\KyYBcie.exe
  C:\Windows\System\KyYBcie.exe
  2⤵
  PID:7752
- C:\Windows\System\LvoyBLJ.exe
  C:\Windows\System\LvoyBLJ.exe
  2⤵
  PID:7784
- C:\Windows\System\lWsJseT.exe
  C:\Windows\System\lWsJseT.exe
  2⤵
  PID:7780
- C:\Windows\System\TxdBnai.exe
  C:\Windows\System\TxdBnai.exe
  2⤵
  PID:7900
- C:\Windows\System\cfasqui.exe
  C:\Windows\System\cfasqui.exe
  2⤵
  PID:7976
- C:\Windows\System\xfypqdv.exe
  C:\Windows\System\xfypqdv.exe
  2⤵
  PID:8064
- C:\Windows\System\EvjlKkp.exe
  C:\Windows\System\EvjlKkp.exe
  2⤵
  PID:8020
- C:\Windows\System\BqDqKSC.exe
  C:\Windows\System\BqDqKSC.exe
  2⤵
  PID:8164
- C:\Windows\System\zGGFrYt.exe
  C:\Windows\System\zGGFrYt.exe
  2⤵
  PID:7296
- C:\Windows\System\gGxzAhe.exe
  C:\Windows\System\gGxzAhe.exe
  2⤵
  PID:7516
- C:\Windows\System\kZoagDE.exe
  C:\Windows\System\kZoagDE.exe
  2⤵
  PID:7736
- C:\Windows\System\OWFLDPd.exe
  C:\Windows\System\OWFLDPd.exe
  2⤵
  PID:7668
- C:\Windows\System\hiQhdYf.exe
  C:\Windows\System\hiQhdYf.exe
  2⤵
  PID:7928
- C:\Windows\System\sKIfmLH.exe
  C:\Windows\System\sKIfmLH.exe
  2⤵
  PID:8012
- C:\Windows\System\oCIINRo.exe
  C:\Windows\System\oCIINRo.exe
  2⤵
  PID:8112
- C:\Windows\System\jfqQsTB.exe
  C:\Windows\System\jfqQsTB.exe
  2⤵
  PID:7852
- C:\Windows\System\UqNvjNE.exe
  C:\Windows\System\UqNvjNE.exe
  2⤵
  PID:8068
- C:\Windows\System\TIcnEzt.exe
  C:\Windows\System\TIcnEzt.exe
  2⤵
  PID:7360
- C:\Windows\System\bQcUNQG.exe
  C:\Windows\System\bQcUNQG.exe
  2⤵
  PID:8224
- C:\Windows\System\PnZLxhM.exe
  C:\Windows\System\PnZLxhM.exe
  2⤵
  PID:8252
- C:\Windows\System\GeNvEfY.exe
  C:\Windows\System\GeNvEfY.exe
  2⤵
  PID:8272
- C:\Windows\System\JxUFQvD.exe
  C:\Windows\System\JxUFQvD.exe
  2⤵
  PID:8292
- C:\Windows\System\CSRrKOr.exe
  C:\Windows\System\CSRrKOr.exe
  2⤵
  PID:8320
- C:\Windows\System\YnjdfZV.exe
  C:\Windows\System\YnjdfZV.exe
  2⤵
  PID:8368
- C:\Windows\System\ddyyZBY.exe
  C:\Windows\System\ddyyZBY.exe
  2⤵
  PID:8384
- C:\Windows\System\DYqLBRY.exe
  C:\Windows\System\DYqLBRY.exe
  2⤵
  PID:8404
- C:\Windows\System\VkzEgwu.exe
  C:\Windows\System\VkzEgwu.exe
  2⤵
  PID:8440
- C:\Windows\System\RUKwGch.exe
  C:\Windows\System\RUKwGch.exe
  2⤵
  PID:8468
- C:\Windows\System\LGBZzVd.exe
  C:\Windows\System\LGBZzVd.exe
  2⤵
  PID:8488
- C:\Windows\System\CTKqDkf.exe
  C:\Windows\System\CTKqDkf.exe
  2⤵
  PID:8512
- C:\Windows\System\wtnyjOz.exe
  C:\Windows\System\wtnyjOz.exe
  2⤵
  PID:8536
- C:\Windows\System\mkpBLzz.exe
  C:\Windows\System\mkpBLzz.exe
  2⤵
  PID:8560
- C:\Windows\System\oRtoWPU.exe
  C:\Windows\System\oRtoWPU.exe
  2⤵
  PID:8604
- C:\Windows\System\npfgWaP.exe
  C:\Windows\System\npfgWaP.exe
  2⤵
  PID:8628
- C:\Windows\System\HbZyVNy.exe
  C:\Windows\System\HbZyVNy.exe
  2⤵
  PID:8652
- C:\Windows\System\AuUoilt.exe
  C:\Windows\System\AuUoilt.exe
  2⤵
  PID:8672
- C:\Windows\System\junvZrv.exe
  C:\Windows\System\junvZrv.exe
  2⤵
  PID:8692
- C:\Windows\System\DnPUJTW.exe
  C:\Windows\System\DnPUJTW.exe
  2⤵
  PID:8716
- C:\Windows\System\HpNksgf.exe
  C:\Windows\System\HpNksgf.exe
  2⤵
  PID:8736
- C:\Windows\System\fLDdBNV.exe
  C:\Windows\System\fLDdBNV.exe
  2⤵
  PID:8768
- C:\Windows\System\ErQTcNt.exe
  C:\Windows\System\ErQTcNt.exe
  2⤵
  PID:8812
- C:\Windows\System\NsvCBZA.exe
  C:\Windows\System\NsvCBZA.exe
  2⤵
  PID:8856
- C:\Windows\System\cGMEPGx.exe
  C:\Windows\System\cGMEPGx.exe
  2⤵
  PID:8876
- C:\Windows\System\yMyvFGk.exe
  C:\Windows\System\yMyvFGk.exe
  2⤵
  PID:8912
- C:\Windows\System\vhhdiyv.exe
  C:\Windows\System\vhhdiyv.exe
  2⤵
  PID:8940
- C:\Windows\System\HdQcMMs.exe
  C:\Windows\System\HdQcMMs.exe
  2⤵
  PID:8968
- C:\Windows\System\bUMFnpG.exe
  C:\Windows\System\bUMFnpG.exe
  2⤵
  PID:9000
- C:\Windows\System\raThoBh.exe
  C:\Windows\System\raThoBh.exe
  2⤵
  PID:9032
- C:\Windows\System\kXqitdx.exe
  C:\Windows\System\kXqitdx.exe
  2⤵
  PID:9052
- C:\Windows\System\JOHcTCp.exe
  C:\Windows\System\JOHcTCp.exe
  2⤵
  PID:9080
- C:\Windows\System\rLPiapx.exe
  C:\Windows\System\rLPiapx.exe
  2⤵
  PID:9124
- C:\Windows\System\PAQEwNf.exe
  C:\Windows\System\PAQEwNf.exe
  2⤵
  PID:9148
- C:\Windows\System\UKyGYuP.exe
  C:\Windows\System\UKyGYuP.exe
  2⤵
  PID:9164
- C:\Windows\System\GSrAPyL.exe
  C:\Windows\System\GSrAPyL.exe
  2⤵
  PID:9184
- C:\Windows\System\GAnADDM.exe
  C:\Windows\System\GAnADDM.exe
  2⤵
  PID:9212
- C:\Windows\System\NaKDPjH.exe
  C:\Windows\System\NaKDPjH.exe
  2⤵
  PID:8200
- C:\Windows\System\nzMPaDU.exe
  C:\Windows\System\nzMPaDU.exe
  2⤵
  PID:8268
- C:\Windows\System\UUPbEHU.exe
  C:\Windows\System\UUPbEHU.exe
  2⤵
  PID:8376
- C:\Windows\System\HhQsCXp.exe
  C:\Windows\System\HhQsCXp.exe
  2⤵
  PID:8480
- C:\Windows\System\hMCfCJm.exe
  C:\Windows\System\hMCfCJm.exe
  2⤵
  PID:8508
- C:\Windows\System\brwTzRS.exe
  C:\Windows\System\brwTzRS.exe
  2⤵
  PID:8600
- C:\Windows\System\FmGDqST.exe
  C:\Windows\System\FmGDqST.exe
  2⤵
  PID:8640
- C:\Windows\System\qzMUxid.exe
  C:\Windows\System\qzMUxid.exe
  2⤵
  PID:8700
- C:\Windows\System\tweuvyN.exe
  C:\Windows\System\tweuvyN.exe
  2⤵
  PID:8688
- C:\Windows\System\ryrFkvK.exe
  C:\Windows\System\ryrFkvK.exe
  2⤵
  PID:8840
- C:\Windows\System\dfgqydt.exe
  C:\Windows\System\dfgqydt.exe
  2⤵
  PID:8884
- C:\Windows\System\IzoMAzC.exe
  C:\Windows\System\IzoMAzC.exe
  2⤵
  PID:8952
- C:\Windows\System\zdhhasp.exe
  C:\Windows\System\zdhhasp.exe
  2⤵
  PID:8988
- C:\Windows\System\CJZcIRy.exe
  C:\Windows\System\CJZcIRy.exe
  2⤵
  PID:9044
- C:\Windows\System\twADSmj.exe
  C:\Windows\System\twADSmj.exe
  2⤵
  PID:9136
- C:\Windows\System\QqVhiZO.exe
  C:\Windows\System\QqVhiZO.exe
  2⤵
  PID:9156
- C:\Windows\System\QSKLOgl.exe
  C:\Windows\System\QSKLOgl.exe
  2⤵
  PID:8232
- C:\Windows\System\ReLwWtd.exe
  C:\Windows\System\ReLwWtd.exe
  2⤵
  PID:8412
- C:\Windows\System\KYWsxwV.exe
  C:\Windows\System\KYWsxwV.exe
  2⤵
  PID:8592
- C:\Windows\System\LtyaicD.exe
  C:\Windows\System\LtyaicD.exe
  2⤵
  PID:8728
- C:\Windows\System\sDertqt.exe
  C:\Windows\System\sDertqt.exe
  2⤵
  PID:9016
- C:\Windows\System\SMbVHpf.exe
  C:\Windows\System\SMbVHpf.exe
  2⤵
  PID:9176
- C:\Windows\System\NbTvHSc.exe
  C:\Windows\System\NbTvHSc.exe
  2⤵
  PID:8264
- C:\Windows\System\yyksNrU.exe
  C:\Windows\System\yyksNrU.exe
  2⤵
  PID:8456
- C:\Windows\System\PoUtmrL.exe
  C:\Windows\System\PoUtmrL.exe
  2⤵
  PID:9076
- C:\Windows\System\SRCljeg.exe
  C:\Windows\System\SRCljeg.exe
  2⤵
  PID:8524
- C:\Windows\System\GGBVEfA.exe
  C:\Windows\System\GGBVEfA.exe
  2⤵
  PID:9220
- C:\Windows\System\XXykyox.exe
  C:\Windows\System\XXykyox.exe
  2⤵
  PID:9240
- C:\Windows\System\SnPldMM.exe
  C:\Windows\System\SnPldMM.exe
  2⤵
  PID:9280
- C:\Windows\System\tZVjpcQ.exe
  C:\Windows\System\tZVjpcQ.exe
  2⤵
  PID:9300
- C:\Windows\System\xBxFuMU.exe
  C:\Windows\System\xBxFuMU.exe
  2⤵
  PID:9316
- C:\Windows\System\SAAhBOL.exe
  C:\Windows\System\SAAhBOL.exe
  2⤵
  PID:9340
- C:\Windows\System\OCvlmXo.exe
  C:\Windows\System\OCvlmXo.exe
  2⤵
  PID:9360
- C:\Windows\System\pxeQFPe.exe
  C:\Windows\System\pxeQFPe.exe
  2⤵
  PID:9416
- C:\Windows\System\cbCpMCu.exe
  C:\Windows\System\cbCpMCu.exe
  2⤵
  PID:9448
- C:\Windows\System\lWGMJby.exe
  C:\Windows\System\lWGMJby.exe
  2⤵
  PID:9468
- C:\Windows\System\OLXstNr.exe
  C:\Windows\System\OLXstNr.exe
  2⤵
  PID:9488
- C:\Windows\System\KPXKtcR.exe
  C:\Windows\System\KPXKtcR.exe
  2⤵
  PID:9536
- C:\Windows\System\lqXPlJg.exe
  C:\Windows\System\lqXPlJg.exe
  2⤵
  PID:9556
- C:\Windows\System\qOcKdeJ.exe
  C:\Windows\System\qOcKdeJ.exe
  2⤵
  PID:9584
- C:\Windows\System\mOtBosU.exe
  C:\Windows\System\mOtBosU.exe
  2⤵
  PID:9608
- C:\Windows\System\yeiHFiW.exe
  C:\Windows\System\yeiHFiW.exe
  2⤵
  PID:9656
- C:\Windows\System\xIvGKIc.exe
  C:\Windows\System\xIvGKIc.exe
  2⤵
  PID:9696
- C:\Windows\System\QGToEdD.exe
  C:\Windows\System\QGToEdD.exe
  2⤵
  PID:9712
- C:\Windows\System\cNUoVHB.exe
  C:\Windows\System\cNUoVHB.exe
  2⤵
  PID:9728
- C:\Windows\System\agbVYIc.exe
  C:\Windows\System\agbVYIc.exe
  2⤵
  PID:9744
- C:\Windows\System\oIpcWKL.exe
  C:\Windows\System\oIpcWKL.exe
  2⤵
  PID:9784
- C:\Windows\System\uXLNIxd.exe
  C:\Windows\System\uXLNIxd.exe
  2⤵
  PID:9868
- C:\Windows\System\jcIfxaw.exe
  C:\Windows\System\jcIfxaw.exe
  2⤵
  PID:9904
- C:\Windows\System\xVIDHFO.exe
  C:\Windows\System\xVIDHFO.exe
  2⤵
  PID:9928
- C:\Windows\System\UONjMKp.exe
  C:\Windows\System\UONjMKp.exe
  2⤵
  PID:9960
- C:\Windows\System\niDNhAv.exe
  C:\Windows\System\niDNhAv.exe
  2⤵
  PID:9980
- C:\Windows\System\QeteNzm.exe
  C:\Windows\System\QeteNzm.exe
  2⤵
  PID:10020
- C:\Windows\System\mFrFfmK.exe
  C:\Windows\System\mFrFfmK.exe
  2⤵
  PID:10044
- C:\Windows\System\FMOkwSp.exe
  C:\Windows\System\FMOkwSp.exe
  2⤵
  PID:10068
- C:\Windows\System\SlCUJEU.exe
  C:\Windows\System\SlCUJEU.exe
  2⤵
  PID:10092
- C:\Windows\System\mGWsTGY.exe
  C:\Windows\System\mGWsTGY.exe
  2⤵
  PID:10120
- C:\Windows\System\TQlcPUU.exe
  C:\Windows\System\TQlcPUU.exe
  2⤵
  PID:10156
- C:\Windows\System\fjALGyB.exe
  C:\Windows\System\fjALGyB.exe
  2⤵
  PID:10176
- C:\Windows\System\xQrGZss.exe
  C:\Windows\System\xQrGZss.exe
  2⤵
  PID:10224
- C:\Windows\System\tcCgYoo.exe
  C:\Windows\System\tcCgYoo.exe
  2⤵
  PID:8140
- C:\Windows\System\AZnFGEZ.exe
  C:\Windows\System\AZnFGEZ.exe
  2⤵
  PID:9268
- C:\Windows\System\WyAqyUS.exe
  C:\Windows\System\WyAqyUS.exe
  2⤵
  PID:9324
- C:\Windows\System\BdpmGLd.exe
  C:\Windows\System\BdpmGLd.exe
  2⤵
  PID:9332
- C:\Windows\System\dDYYhAo.exe
  C:\Windows\System\dDYYhAo.exe
  2⤵
  PID:9392
- C:\Windows\System\TxriuJL.exe
  C:\Windows\System\TxriuJL.exe
  2⤵
  PID:9456
- C:\Windows\System\XrIICCM.exe
  C:\Windows\System\XrIICCM.exe
  2⤵
  PID:9552
- C:\Windows\System\PywyIPq.exe
  C:\Windows\System\PywyIPq.exe
  2⤵
  PID:9652
- C:\Windows\System\bvEvnDz.exe
  C:\Windows\System\bvEvnDz.exe
  2⤵
  PID:9592
- C:\Windows\System\AGQvcru.exe
  C:\Windows\System\AGQvcru.exe
  2⤵
  PID:9708
- C:\Windows\System\hbugTiM.exe
  C:\Windows\System\hbugTiM.exe
  2⤵
  PID:9644
- C:\Windows\System\gtScFXh.exe
  C:\Windows\System\gtScFXh.exe
  2⤵
  PID:9808
- C:\Windows\System\VqKSqQU.exe
  C:\Windows\System\VqKSqQU.exe
  2⤵
  PID:9920
- C:\Windows\System\pseTAMi.exe
  C:\Windows\System\pseTAMi.exe
  2⤵
  PID:10000
- C:\Windows\System\qUQkOiy.exe
  C:\Windows\System\qUQkOiy.exe
  2⤵
  PID:10036
- C:\Windows\System\HAprqrb.exe
  C:\Windows\System\HAprqrb.exe
  2⤵
  PID:10084
- C:\Windows\System\KvcmlZC.exe
  C:\Windows\System\KvcmlZC.exe
  2⤵
  PID:10144
- C:\Windows\System\heVGgvR.exe
  C:\Windows\System\heVGgvR.exe
  2⤵
  PID:8660
- C:\Windows\System\iIiZByF.exe
  C:\Windows\System\iIiZByF.exe
  2⤵
  PID:9356
- C:\Windows\System\VXibiNc.exe
  C:\Windows\System\VXibiNc.exe
  2⤵
  PID:9404
- C:\Windows\System\ekyhcfs.exe
  C:\Windows\System\ekyhcfs.exe
  2⤵
  PID:9528
- C:\Windows\System\NHrmliL.exe
  C:\Windows\System\NHrmliL.exe
  2⤵
  PID:9548
- C:\Windows\System\iPBrSXB.exe
  C:\Windows\System\iPBrSXB.exe
  2⤵
  PID:10008
- C:\Windows\System\iBZiRzO.exe
  C:\Windows\System\iBZiRzO.exe
  2⤵
  PID:9900
- C:\Windows\System\USCpatK.exe
  C:\Windows\System\USCpatK.exe
  2⤵
  PID:9988
- C:\Windows\System\jXkBKgm.exe
  C:\Windows\System\jXkBKgm.exe
  2⤵
  PID:10148
- C:\Windows\System\pIkzKWP.exe
  C:\Windows\System\pIkzKWP.exe
  2⤵
  PID:9288
- C:\Windows\System\nzAqpAc.exe
  C:\Windows\System\nzAqpAc.exe
  2⤵
  PID:10220
- C:\Windows\System\etXSfQX.exe
  C:\Windows\System\etXSfQX.exe
  2⤵
  PID:9352
- C:\Windows\System\aOymjrl.exe
  C:\Windows\System\aOymjrl.exe
  2⤵
  PID:9824
- C:\Windows\System\buSBPDh.exe
  C:\Windows\System\buSBPDh.exe
  2⤵
  PID:10264
- C:\Windows\System\oytcQFn.exe
  C:\Windows\System\oytcQFn.exe
  2⤵
  PID:10284
- C:\Windows\System\UmVvxei.exe
  C:\Windows\System\UmVvxei.exe
  2⤵
  PID:10308
- C:\Windows\System\FHLxFPz.exe
  C:\Windows\System\FHLxFPz.exe
  2⤵
  PID:10332
- C:\Windows\System\MNfRibB.exe
  C:\Windows\System\MNfRibB.exe
  2⤵
  PID:10352
- C:\Windows\System\UzqFhBl.exe
  C:\Windows\System\UzqFhBl.exe
  2⤵
  PID:10376
- C:\Windows\System\lNzPXvR.exe
  C:\Windows\System\lNzPXvR.exe
  2⤵
  PID:10412
- C:\Windows\System\EPtVhtZ.exe
  C:\Windows\System\EPtVhtZ.exe
  2⤵
  PID:10440
- C:\Windows\System\YgKqgyM.exe
  C:\Windows\System\YgKqgyM.exe
  2⤵
  PID:10468
- C:\Windows\System\hnvMMrB.exe
  C:\Windows\System\hnvMMrB.exe
  2⤵
  PID:10516
- C:\Windows\System\JrLPFxi.exe
  C:\Windows\System\JrLPFxi.exe
  2⤵
  PID:10556
- C:\Windows\System\pTNvdSd.exe
  C:\Windows\System\pTNvdSd.exe
  2⤵
  PID:10572
- C:\Windows\System\fRmVVkN.exe
  C:\Windows\System\fRmVVkN.exe
  2⤵
  PID:10592
- C:\Windows\System\lcDZfZP.exe
  C:\Windows\System\lcDZfZP.exe
  2⤵
  PID:10616
- C:\Windows\System\ifxvcfd.exe
  C:\Windows\System\ifxvcfd.exe
  2⤵
  PID:10636
- C:\Windows\System\VkeJnxe.exe
  C:\Windows\System\VkeJnxe.exe
  2⤵
  PID:10660
- C:\Windows\System\cYPCjQV.exe
  C:\Windows\System\cYPCjQV.exe
  2⤵
  PID:10684
- C:\Windows\System\NNeoakM.exe
  C:\Windows\System\NNeoakM.exe
  2⤵
  PID:10716
- C:\Windows\System\yRuPwUD.exe
  C:\Windows\System\yRuPwUD.exe
  2⤵
  PID:10736
- C:\Windows\System\kZUdCqZ.exe
  C:\Windows\System\kZUdCqZ.exe
  2⤵
  PID:10764
- C:\Windows\System\AlUUGez.exe
  C:\Windows\System\AlUUGez.exe
  2⤵
  PID:10808
- C:\Windows\System\yjToMRQ.exe
  C:\Windows\System\yjToMRQ.exe
  2⤵
  PID:10832
- C:\Windows\System\oYDZGQO.exe
  C:\Windows\System\oYDZGQO.exe
  2⤵
  PID:10872
- C:\Windows\System\UZYmumY.exe
  C:\Windows\System\UZYmumY.exe
  2⤵
  PID:10892
- C:\Windows\System\pauunLQ.exe
  C:\Windows\System\pauunLQ.exe
  2⤵
  PID:10940
- C:\Windows\System\WSyTuYv.exe
  C:\Windows\System\WSyTuYv.exe
  2⤵
  PID:10968
- C:\Windows\System\NOSUUHG.exe
  C:\Windows\System\NOSUUHG.exe
  2⤵
  PID:10988
- C:\Windows\System\xlGddrd.exe
  C:\Windows\System\xlGddrd.exe
  2⤵
  PID:11024
- C:\Windows\System\gzNNalU.exe
  C:\Windows\System\gzNNalU.exe
  2⤵
  PID:11072
- C:\Windows\System\DfrCgnv.exe
  C:\Windows\System\DfrCgnv.exe
  2⤵
  PID:11092
- C:\Windows\System\ibtspoS.exe
  C:\Windows\System\ibtspoS.exe
  2⤵
  PID:11112
- C:\Windows\System\kOPYZuw.exe
  C:\Windows\System\kOPYZuw.exe
  2⤵
  PID:11140
- C:\Windows\System\bGYpGiK.exe
  C:\Windows\System\bGYpGiK.exe
  2⤵
  PID:11164
- C:\Windows\System\AhlinQm.exe
  C:\Windows\System\AhlinQm.exe
  2⤵
  PID:11180
- C:\Windows\System\exMvcaL.exe
  C:\Windows\System\exMvcaL.exe
  2⤵
  PID:11236
- C:\Windows\System\kixprgK.exe
  C:\Windows\System\kixprgK.exe
  2⤵
  PID:10248
- C:\Windows\System\hpndjYw.exe
  C:\Windows\System\hpndjYw.exe
  2⤵
  PID:10280
- C:\Windows\System\XjCMNmb.exe
  C:\Windows\System\XjCMNmb.exe
  2⤵
  PID:10324
- C:\Windows\System\aXfdlTx.exe
  C:\Windows\System\aXfdlTx.exe
  2⤵
  PID:10368
- C:\Windows\System\gOChGKi.exe
  C:\Windows\System\gOChGKi.exe
  2⤵
  PID:10436
- C:\Windows\System\TcNnfcN.exe
  C:\Windows\System\TcNnfcN.exe
  2⤵
  PID:10512
- C:\Windows\System\rLhZowr.exe
  C:\Windows\System\rLhZowr.exe
  2⤵
  PID:10588
- C:\Windows\System\QsiFtSB.exe
  C:\Windows\System\QsiFtSB.exe
  2⤵
  PID:10676
- C:\Windows\System\pAihrva.exe
  C:\Windows\System\pAihrva.exe
  2⤵
  PID:10696
- C:\Windows\System\WEEWuPh.exe
  C:\Windows\System\WEEWuPh.exe
  2⤵
  PID:10704
- C:\Windows\System\twnmCMO.exe
  C:\Windows\System\twnmCMO.exe
  2⤵
  PID:10888
- C:\Windows\System\yPTRHwa.exe
  C:\Windows\System\yPTRHwa.exe
  2⤵
  PID:10924
- C:\Windows\System\SfbYhAd.exe
  C:\Windows\System\SfbYhAd.exe
  2⤵
  PID:4472
- C:\Windows\System\svDKjvx.exe
  C:\Windows\System\svDKjvx.exe
  2⤵
  PID:11020
- C:\Windows\System\aQnTaEg.exe
  C:\Windows\System\aQnTaEg.exe
  2⤵
  PID:11080
- C:\Windows\System\bjGHYmg.exe
  C:\Windows\System\bjGHYmg.exe
  2⤵
  PID:11148
- C:\Windows\System\kPqLOmA.exe
  C:\Windows\System\kPqLOmA.exe
  2⤵
  PID:9704
- C:\Windows\System\fVOPtqf.exe
  C:\Windows\System\fVOPtqf.exe
  2⤵
  PID:10420
- C:\Windows\System\xKyszlH.exe
  C:\Windows\System\xKyszlH.exe
  2⤵
  PID:10496
- C:\Windows\System\VzvMFEN.exe
  C:\Windows\System\VzvMFEN.exe
  2⤵
  PID:10672
- C:\Windows\System\ICOysCy.exe
  C:\Windows\System\ICOysCy.exe
  2⤵
  PID:10732
- C:\Windows\System\ITEOsKG.exe
  C:\Windows\System\ITEOsKG.exe
  2⤵
  PID:10860
- C:\Windows\System\hluGrHp.exe
  C:\Windows\System\hluGrHp.exe
  2⤵
  PID:11056
- C:\Windows\System\WmdqjLM.exe
  C:\Windows\System\WmdqjLM.exe
  2⤵
  PID:11208
- C:\Windows\System\EFhxowE.exe
  C:\Windows\System\EFhxowE.exe
  2⤵
  PID:10504
- C:\Windows\System\ORWoYQa.exe
  C:\Windows\System\ORWoYQa.exe
  2⤵
  PID:10744
- C:\Windows\System\ZafAdFx.exe
  C:\Windows\System\ZafAdFx.exe
  2⤵
  PID:10856
- C:\Windows\System\NpnIdrv.exe
  C:\Windows\System\NpnIdrv.exe
  2⤵
  PID:10300
- C:\Windows\System\NNCeEjv.exe
  C:\Windows\System\NNCeEjv.exe
  2⤵
  PID:10820
- C:\Windows\System\SnekLXe.exe
  C:\Windows\System\SnekLXe.exe
  2⤵
  PID:11312
- C:\Windows\System\JAxVNVU.exe
  C:\Windows\System\JAxVNVU.exe
  2⤵
  PID:11332
- C:\Windows\System\DVSrBox.exe
  C:\Windows\System\DVSrBox.exe
  2⤵
  PID:11356
- C:\Windows\System\NMJTyHV.exe
  C:\Windows\System\NMJTyHV.exe
  2⤵
  PID:11372
- C:\Windows\System\cceeEDE.exe
  C:\Windows\System\cceeEDE.exe
  2⤵
  PID:11392
- C:\Windows\System\MszvUwQ.exe
  C:\Windows\System\MszvUwQ.exe
  2⤵
  PID:11440
- C:\Windows\System\UzVUmUV.exe
  C:\Windows\System\UzVUmUV.exe
  2⤵
  PID:11456
- C:\Windows\System\UeThdCi.exe
  C:\Windows\System\UeThdCi.exe
  2⤵
  PID:11476
- C:\Windows\System\JWMxnDn.exe
  C:\Windows\System\JWMxnDn.exe
  2⤵
  PID:11500
- C:\Windows\System\pbAQGZb.exe
  C:\Windows\System\pbAQGZb.exe
  2⤵
  PID:11540
- C:\Windows\System\zJVpUdv.exe
  C:\Windows\System\zJVpUdv.exe
  2⤵
  PID:11564
- C:\Windows\System\cfZZPlg.exe
  C:\Windows\System\cfZZPlg.exe
  2⤵
  PID:11596
- C:\Windows\System\aErzXsc.exe
  C:\Windows\System\aErzXsc.exe
  2⤵
  PID:11616
- C:\Windows\System\DBWPljH.exe
  C:\Windows\System\DBWPljH.exe
  2⤵
  PID:11640
- C:\Windows\System\jcGFajY.exe
  C:\Windows\System\jcGFajY.exe
  2⤵
  PID:11672
- C:\Windows\System\zspBFvG.exe
  C:\Windows\System\zspBFvG.exe
  2⤵
  PID:11688
- C:\Windows\System\iOukzFc.exe
  C:\Windows\System\iOukzFc.exe
  2⤵
  PID:11712
- C:\Windows\System\mHvwJnh.exe
  C:\Windows\System\mHvwJnh.exe
  2⤵
  PID:11736
- C:\Windows\System\SMchLNl.exe
  C:\Windows\System\SMchLNl.exe
  2⤵
  PID:11756
- C:\Windows\System\fVRJdSx.exe
  C:\Windows\System\fVRJdSx.exe
  2⤵
  PID:11780
- C:\Windows\System\ZNJBfra.exe
  C:\Windows\System\ZNJBfra.exe
  2⤵
  PID:11844
- C:\Windows\System\RUTrRNw.exe
  C:\Windows\System\RUTrRNw.exe
  2⤵
  PID:11892
- C:\Windows\System\ZQDYiQX.exe
  C:\Windows\System\ZQDYiQX.exe
  2⤵
  PID:11920
- C:\Windows\System\RKeodyo.exe
  C:\Windows\System\RKeodyo.exe
  2⤵
  PID:11960
- C:\Windows\System\sHfTvnD.exe
  C:\Windows\System\sHfTvnD.exe
  2⤵
  PID:11984
- C:\Windows\System\eGDilJT.exe
  C:\Windows\System\eGDilJT.exe
  2⤵
  PID:12000
- C:\Windows\System\gDbgYbz.exe
  C:\Windows\System\gDbgYbz.exe
  2⤵
  PID:12024
- C:\Windows\System\kBuayvG.exe
  C:\Windows\System\kBuayvG.exe
  2⤵
  PID:12056
- C:\Windows\System\mWOCPai.exe
  C:\Windows\System\mWOCPai.exe
  2⤵
  PID:12096
- C:\Windows\System\TDXrOlf.exe
  C:\Windows\System\TDXrOlf.exe
  2⤵
  PID:12124
- C:\Windows\System\VDKcwbn.exe
  C:\Windows\System\VDKcwbn.exe
  2⤵
  PID:12144
- C:\Windows\System\cFsvkNI.exe
  C:\Windows\System\cFsvkNI.exe
  2⤵
  PID:12172
- C:\Windows\System\VGcpetQ.exe
  C:\Windows\System\VGcpetQ.exe
  2⤵
  PID:12200
- C:\Windows\System\vNDcvnG.exe
  C:\Windows\System\vNDcvnG.exe
  2⤵
  PID:12248
- C:\Windows\System\YkQokzS.exe
  C:\Windows\System\YkQokzS.exe
  2⤵
  PID:12272
- C:\Windows\System\kEMJmhl.exe
  C:\Windows\System\kEMJmhl.exe
  2⤵
  PID:10584
- C:\Windows\System\RonACBR.exe
  C:\Windows\System\RonACBR.exe
  2⤵
  PID:11300
- C:\Windows\System\SvvEJZy.exe
  C:\Windows\System\SvvEJZy.exe
  2⤵
  PID:11400
- C:\Windows\System\nTzInXh.exe
  C:\Windows\System\nTzInXh.exe
  2⤵
  PID:11420
- C:\Windows\System\EsfCGzD.exe
  C:\Windows\System\EsfCGzD.exe
  2⤵
  PID:11484
- C:\Windows\System\SjBOMSn.exe
  C:\Windows\System\SjBOMSn.exe
  2⤵
  PID:11468
- C:\Windows\System\jDkQWuu.exe
  C:\Windows\System\jDkQWuu.exe
  2⤵
  PID:11556
- C:\Windows\System\afauaEU.exe
  C:\Windows\System\afauaEU.exe
  2⤵
  PID:11604
- C:\Windows\System\fVwzBps.exe
  C:\Windows\System\fVwzBps.exe
  2⤵
  PID:636
- C:\Windows\System\vNPMvuE.exe
  C:\Windows\System\vNPMvuE.exe
  2⤵
  PID:11724
- C:\Windows\System\UVbvuUY.exe
  C:\Windows\System\UVbvuUY.exe
  2⤵
  PID:4572
- C:\Windows\System\iMlayBD.exe
  C:\Windows\System\iMlayBD.exe
  2⤵
  PID:11876
- C:\Windows\System\NMswFwk.exe
  C:\Windows\System\NMswFwk.exe
  2⤵
  PID:3376
- C:\Windows\System\hIyWELk.exe
  C:\Windows\System\hIyWELk.exe
  2⤵
  PID:11952
- C:\Windows\System\FVuvpmH.exe
  C:\Windows\System\FVuvpmH.exe
  2⤵
  PID:12040
- C:\Windows\System\GYvCvHW.exe
  C:\Windows\System\GYvCvHW.exe
  2⤵
  PID:12120
- C:\Windows\System\PPhOyCB.exe
  C:\Windows\System\PPhOyCB.exe
  2⤵
  PID:12168
- C:\Windows\System\QgcPIRo.exe
  C:\Windows\System\QgcPIRo.exe
  2⤵
  PID:12164
- C:\Windows\System\TqZUHZQ.exe
  C:\Windows\System\TqZUHZQ.exe
  2⤵
  PID:12260
- C:\Windows\System\ItGrAjS.exe
  C:\Windows\System\ItGrAjS.exe
  2⤵
  PID:2588
- C:\Windows\System\EKYQTOi.exe
  C:\Windows\System\EKYQTOi.exe
  2⤵
  PID:4712
- C:\Windows\System\stqjdsY.exe
  C:\Windows\System\stqjdsY.exe
  2⤵
  PID:11652
- C:\Windows\System\QQPsvhy.exe
  C:\Windows\System\QQPsvhy.exe
  2⤵
  PID:11744
- C:\Windows\System\ywbitJL.exe
  C:\Windows\System\ywbitJL.exe
  2⤵
  PID:11840
- C:\Windows\System\VegrIyt.exe
  C:\Windows\System\VegrIyt.exe
  2⤵
  PID:12020
- C:\Windows\System\KSluwXo.exe
  C:\Windows\System\KSluwXo.exe
  2⤵
  PID:12012
- C:\Windows\System\pORfCln.exe
  C:\Windows\System\pORfCln.exe
  2⤵
  PID:12140
- C:\Windows\System\BwBDSAK.exe
  C:\Windows\System\BwBDSAK.exe
  2⤵
  PID:5112
- C:\Windows\System\lmQEEbL.exe
  C:\Windows\System\lmQEEbL.exe
  2⤵
  PID:11588
- C:\Windows\System\XvxejuZ.exe
  C:\Windows\System\XvxejuZ.exe
  2⤵
  PID:11508
- C:\Windows\System\juHGkaF.exe
  C:\Windows\System\juHGkaF.exe
  2⤵
  PID:4968
- C:\Windows\System\RzyCZVm.exe
  C:\Windows\System\RzyCZVm.exe
  2⤵
  PID:12320
- C:\Windows\System\hWxxmRm.exe
  C:\Windows\System\hWxxmRm.exe
  2⤵
  PID:12340
- C:\Windows\System\YnKzcpT.exe
  C:\Windows\System\YnKzcpT.exe
  2⤵
  PID:12356
- C:\Windows\System\Pzrpwnj.exe
  C:\Windows\System\Pzrpwnj.exe
  2⤵
  PID:12376
- C:\Windows\System\ntrPjHd.exe
  C:\Windows\System\ntrPjHd.exe
  2⤵
  PID:12400
- C:\Windows\System\zrEsqKz.exe
  C:\Windows\System\zrEsqKz.exe
  2⤵
  PID:12428
- C:\Windows\System\ZpiiPTk.exe
  C:\Windows\System\ZpiiPTk.exe
  2⤵
  PID:12444
- C:\Windows\System\GPDqVMA.exe
  C:\Windows\System\GPDqVMA.exe
  2⤵
  PID:12472
- C:\Windows\System\jskpgds.exe
  C:\Windows\System\jskpgds.exe
  2⤵
  PID:12492
- C:\Windows\System\IXqHPZG.exe
  C:\Windows\System\IXqHPZG.exe
  2⤵
  PID:12540
- C:\Windows\System\Qfsever.exe
  C:\Windows\System\Qfsever.exe
  2⤵
  PID:12560
- C:\Windows\System\rTbLQOv.exe
  C:\Windows\System\rTbLQOv.exe
  2⤵
  PID:12580
- C:\Windows\System\wpNobFf.exe
  C:\Windows\System\wpNobFf.exe
  2⤵
  PID:12612
- C:\Windows\System\TefYMtI.exe
  C:\Windows\System\TefYMtI.exe
  2⤵
  PID:12632
- C:\Windows\System\NqzeAVA.exe
  C:\Windows\System\NqzeAVA.exe
  2⤵
  PID:12668
- C:\Windows\System\jRcFSxI.exe
  C:\Windows\System\jRcFSxI.exe
  2⤵
  PID:12712
- C:\Windows\System\cTwxXRM.exe
  C:\Windows\System\cTwxXRM.exe
  2⤵
  PID:12740
- C:\Windows\System\jtMSKbM.exe
  C:\Windows\System\jtMSKbM.exe
  2⤵
  PID:12760
- C:\Windows\System\uUOLfDd.exe
  C:\Windows\System\uUOLfDd.exe
  2⤵
  PID:12780
- C:\Windows\System\qLqUexh.exe
  C:\Windows\System\qLqUexh.exe
  2⤵
  PID:12804
- C:\Windows\System\yAckXtn.exe
  C:\Windows\System\yAckXtn.exe
  2⤵
  PID:12824
- C:\Windows\System\dOkkZeY.exe
  C:\Windows\System\dOkkZeY.exe
  2⤵
  PID:12860
- C:\Windows\System\lKOwiXI.exe
  C:\Windows\System\lKOwiXI.exe
  2⤵
  PID:12916
- C:\Windows\System\ZZBKSAO.exe
  C:\Windows\System\ZZBKSAO.exe
  2⤵
  PID:12960
- C:\Windows\System\uWnvfjh.exe
  C:\Windows\System\uWnvfjh.exe
  2⤵
  PID:12980
- C:\Windows\System\PgvPJYX.exe
  C:\Windows\System\PgvPJYX.exe
  2⤵
  PID:13008
- C:\Windows\System\IvYikdO.exe
  C:\Windows\System\IvYikdO.exe
  2⤵
  PID:13236
- C:\Windows\System\oNBPwCd.exe
  C:\Windows\System\oNBPwCd.exe
  2⤵
  PID:13252
- C:\Windows\System\TolPQzZ.exe
  C:\Windows\System\TolPQzZ.exe
  2⤵
  PID:13268
- C:\Windows\System\YAWIfnR.exe
  C:\Windows\System\YAWIfnR.exe
  2⤵
  PID:13300
- C:\Windows\System\thutNff.exe
  C:\Windows\System\thutNff.exe
  2⤵
  PID:12104
- C:\Windows\System\VLOwkVr.exe
  C:\Windows\System\VLOwkVr.exe
  2⤵
  PID:12348
- C:\Windows\System\OqKbgZT.exe
  C:\Windows\System\OqKbgZT.exe
  2⤵
  PID:12332
- C:\Windows\System\yNemRdD.exe
  C:\Windows\System\yNemRdD.exe
  2⤵
  PID:12384
- C:\Windows\System\lVNauic.exe
  C:\Windows\System\lVNauic.exe
  2⤵
  PID:13112
- C:\Windows\System\UBVxckZ.exe
  C:\Windows\System\UBVxckZ.exe
  2⤵
  PID:12468
- C:\Windows\System\FnLTAAC.exe
  C:\Windows\System\FnLTAAC.exe
  2⤵
  PID:12480
- C:\Windows\System\QhhcJOI.exe
  C:\Windows\System\QhhcJOI.exe
  2⤵
  PID:12552
- C:\Windows\System\hBriREE.exe
  C:\Windows\System\hBriREE.exe
  2⤵
  PID:12556
- C:\Windows\System\FzQLgpf.exe
  C:\Windows\System\FzQLgpf.exe
  2⤵
  PID:12624
- C:\Windows\System\YxgGPaq.exe
  C:\Windows\System\YxgGPaq.exe
  2⤵
  PID:12660
- C:\Windows\System\dkHiUMI.exe
  C:\Windows\System\dkHiUMI.exe
  2⤵
  PID:12700
- C:\Windows\System\YqJTyav.exe
  C:\Windows\System\YqJTyav.exe
  2⤵
  PID:12752
- C:\Windows\System\BhgncbV.exe
  C:\Windows\System\BhgncbV.exe
  2⤵
  PID:3624
- C:\Windows\System\bijQmXZ.exe
  C:\Windows\System\bijQmXZ.exe
  2⤵
  PID:12728
- C:\Windows\System\MJYjVsp.exe
  C:\Windows\System\MJYjVsp.exe
  2⤵
  PID:12820
- C:\Windows\System\hrqHAvw.exe
  C:\Windows\System\hrqHAvw.exe
  2⤵
  PID:12816
- C:\Windows\System\dMdLKwD.exe
  C:\Windows\System\dMdLKwD.exe
  2⤵
  PID:12972
- C:\Windows\System\atzjqBR.exe
  C:\Windows\System\atzjqBR.exe
  2⤵
  PID:12652
- C:\Windows\System\JAyxWTu.exe
  C:\Windows\System\JAyxWTu.exe
  2⤵
  PID:13108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_5yyqwfi1.z4u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5yyqwfi1.z4u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BURPkgT.exe

Path C:\Windows\System\BURPkgT.exe
Size 2.2MB
SHA256 02c25bdf60ec0d67492c9ead264de4b5ce31cc42940ce5fa3ce21a78d3a329cd
MD5 1cbeeb4d624d86a2dc22db7887f6ac03
SHA1 fd5b7b7b5e58766c9e7fcac76858e6518e4fdf5f
SHA512 bfd3bbac0e428ebeb3a7a7fed9ec1c70421912c60fb1135b868c6bc5372681457b631b2b68bfc616031c357fdcb6d51f0f0e25252311f74e0b574b9792dbac1e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfiN:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

CcdXIkf.exe

Path C:\Windows\System\CcdXIkf.exe
Size 2.2MB
SHA256 d8b209274dee9db001a09b6a4f52d1896090b69984e702d6ac7fdb2acc6506f1
MD5 5122abf5678d94b2efec900e854d430d
SHA1 02ae358908bac51588247780ead1733b6a60af1a
SHA512 a6b3c22efccbc737132e1e4cd6b0b3baa54fb4c314eb07e6f0fd67da384679fb9d89557094e5922758a033919454124f21e9aed0c687f173a5855b3d36d74419
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfR:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

DZnYFBp.exe

Path C:\Windows\System\DZnYFBp.exe
Size 2.2MB
SHA256 9393908347639e3f89b6bd2ee49a47add73f3c607f59c6c4e489edc0f51f3c0b
MD5 ed7c6936c9c60e40e91e6db2f05335c9
SHA1 4635ed3a4d02054877263967927ac378b6312fb0
SHA512 42e3aa8e493cfb851a33aa9eb998df78a993cba8fab98d0a830a9ed4bfaf788842f289621de3367ee294b5c7e67b630ee6a56116f9512f461d935a55778a9a95
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfq:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

EYiQZDJ.exe

Path C:\Windows\System\EYiQZDJ.exe
Size 2.2MB
SHA256 7d089a72fc26973f16baab240ab333e288307a9784736e7df24642e4a758b464
MD5 0d46e8509e501e88e51e90279c3abe58
SHA1 c9de81f19724a7dfa0120bc9750976d90debb892
SHA512 45801cd7aba48f272e8c1b0d5808e4835a8a32f4bf3ef79d7148cb14431ce01485ae4048637115bd854e7802733c673bd544723326a8ef3ab26bd1e333e662e6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfO:NABr
MD5 SHA1 SHA512 SSDEEP

Submit Download

GLcUkto.exe

Path C:\Windows\System\GLcUkto.exe
Size 2.2MB
SHA256 1ce46b6f94ab7b14502e3214ed00593ce9be213e1469ed896310cf5ba81aa79f
MD5 d6c2e1aba662665f54674f0c3d99b529
SHA1 773f4e5643efad23f8e91f2862a58ac3046e9351
SHA512 f334632253b6107a6322e924004a0467109e7e15de9dfdbc7a1823d15f9c42efc6867e6de638677148c5e8a4d29672bbc8e32571348b3988cc1d8875b25531d7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfc:NABR
MD5 SHA1 SHA512 SSDEEP

Submit Download

GXNSpvX.exe

Path C:\Windows\System\GXNSpvX.exe
Size 2.2MB
SHA256 794049314bb76a235d6924ac9b035166ab4d20b702743b69311d5b8fee51dfdc
MD5 10646a06dbac1515c3976f87aaeaa181
SHA1 098bd4f7dc989ecb6f392d8ec98af491ea530e39
SHA512 35c4078c4cec1ac0719e78bcf65b885f91d356a6fcd30b2ddf02c35ebb1654a77dd819bef34bdac74e39120ff212a5fd6ccbc39e73130b72090ac0f18f68c04b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfn:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

HHUslmU.exe

Path C:\Windows\System\HHUslmU.exe
Size 2.2MB
SHA256 1c9268dca34194eae0c376beafa63a9ae07287c951e9055722cbacf91eed2ac9
MD5 d3fb5397b230358828b5da4927c894c9
SHA1 e24fb6469b1f206188ec2b020156d0a26bb41e4a
SHA512 4ff4d951947db09909fd19f2e0af2ade0142026d4a0dae836a91d0276b2298cab88b333dad8253c0da277c81c6c246cb346ad03cb75554eeeccb8dd06461823e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfM:NABl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ItFOkkM.exe

Path C:\Windows\System\ItFOkkM.exe
Size 2.2MB
SHA256 a35775764c942d499b1b7e1ab918fc5013949cbe15fe9788e50544065d3a2c26
MD5 2d820e6dbc4399518f1f2f943e4b97c1
SHA1 9c3c5ea0cdac173468c363e314e9381d915015fc
SHA512 b956edd2724b17737575b1ad244c47e06800d23dc66c2195a44f018b13060aaad3dc36b91b8ff55c30a2126697b4e4f1531b6277eb483e8252470f93d5ab7aad
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf8:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

JxGQddN.exe

Path C:\Windows\System\JxGQddN.exe
Size 2.2MB
SHA256 46d48d7d216aefe5bea053debc4262df5ba6b109b0bee9fd9edee4b3e66773fc
MD5 9e4ce8a686dc88f6cbf71ccbb3aa0042
SHA1 05672851b69e983a74dc3cc689cea6371ce31ebc
SHA512 463682f7fea29afec417ae5ce75327fdb51fd0415e56ccc824f76f1af8ba02f5504e1c0fba1b820465c156fa76e73c295e2b51be878bb7a0dd216b6206e65f08
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfv:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

MVgAaFM.exe

Path C:\Windows\System\MVgAaFM.exe
Size 2.2MB
SHA256 3e439bf67460f8da911cf7bbb0702754bfbb1eea0c9c90cce6c7eb72ccd2a7fb
MD5 0449122fd8b41328d9ecb62d93420822
SHA1 468da13e6cdfa38eae7be62fa439260f57ce5971
SHA512 28a1bf2b7023d8406ca6d93c2ceff1584fb2cd0d9130e1df5c51649f52876cea5dec7f3467175a9de5dd53a98d3af3916b004fb07c75db25ae5046d433ce887a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfb:NABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

MXPwaJj.exe

Path C:\Windows\System\MXPwaJj.exe
Size 2.2MB
SHA256 178deff0760a841759934de0868d2638b78a236cfa6d608819c6ccf84b2fb41e
MD5 ea30d2931cc632f97796f593b9cd0a70
SHA1 a523e3b0fc57efc99b9500b7714b09d190b8a4ff
SHA512 5f715eccc67ceec214043e4403acb138092e600d52f43f81d78b98dc98fe812f1715db8f018769211905bfb705b5233efe76da096c06631cc023be64aa286fa8
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfi:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

NPrXYab.exe

Path C:\Windows\System\NPrXYab.exe
Size 2.2MB
SHA256 f82813a1dc2f715e3e59656831f62b81fa6319344cc436787d5902f65ea789b9
MD5 1ca9ed82aa4750eda462f60b4ff26be9
SHA1 ca13ff235e02c031fb077503df7c668ec9285b4e
SHA512 08b394a1032a2c59192bb22ad5a9c343bf0d80ae92ab2e2437f53927eb54301ab157badcdfcf52966a4207e748e2eed99b57a30c4fff5fa52812c82dce1c7175
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfr:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

RPYsVxd.exe

Path C:\Windows\System\RPYsVxd.exe
Size 2.2MB
SHA256 a7cbc09c2b530dc4a66bfd9b090cb551366f93f1862c6f358b5c22e9d6a50d4c
MD5 7ebc3e9944cc6e59bdf26dc41d59f638
SHA1 5efdbe08a3529bd0b3275c4334c28795977aaf7b
SHA512 60e5c3593baafec4efe7fd02335b2a2af2e5bd6414b18f1ca632627db6b9dbbdc41098502525b35d21a5e40a757c2c65be580e973a884266d1e1b8480609f80a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfa:NABj
MD5 SHA1 SHA512 SSDEEP

Submit Download

TbaJgow.exe

Path C:\Windows\System\TbaJgow.exe
Size 2.2MB
SHA256 4424c63fafd8334c1a129051cfafdca576ee39f7b6071270648901ad541fa815
MD5 971cb3dd829997a61da184be77f2497d
SHA1 6605dc38755e049807ddf0edf3a91f83c30a70a4
SHA512 2f7259b0ff8c477923cef52123c4e2c3791c9b5e51e85e359c62a37f0d9cbe318763796c2aa1de2edebaee0c333d8ef8e863f701cd01c591b2d9b516d36f1422
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfc:NABX
MD5 SHA1 SHA512 SSDEEP

Submit Download

UDZzSVc.exe

Path C:\Windows\System\UDZzSVc.exe
Size 2.2MB
SHA256 43cc43d472bab1364ced0cad7760665a6136275661ee37bfe89a3cbeee64f375
MD5 9cbcdeb3347d6ba5a293d1737c05701c
SHA1 a1dc8212ab58849eacaa4fcbb380b308c5603762
SHA512 a02accbc9eda8bf71671fa5b86e8dcc8bb83af657f3231e713873c82895ac28a5eca91ac24e26fa9614e6339ae60155ec39734a1ef866b5f1f6c649c854b5b6f
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfh:NABY
MD5 SHA1 SHA512 SSDEEP

Submit Download

WWKMlVa.exe

Path C:\Windows\System\WWKMlVa.exe
Size 2.2MB
SHA256 40ecc44c0126af4d63c3acd4ccb6a477d2415118bc6cc55acd3f49c041c35f9b
MD5 556f1df89233d19e43acc1ba219af5ba
SHA1 49229252b6013a881004fb7744034d11dddeb469
SHA512 d84306e93adae066afb9b54c4c8a3be3277a3612e2acb83320a47e4c5705b274bbd3c0843cf6c09e3b4a246a6c1600ccb7452330cd2d0cc655c9ef0494aac9f0
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfu:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZnUjFHt.exe

Path C:\Windows\System\ZnUjFHt.exe
Size 2.2MB
SHA256 80d21657b4c734a7b7f570a22bb12ea493f5864765c7a2be94884fb2f506f98f
MD5 4816c0839c9ed7b58aef900130e9ac1b
SHA1 52c3f34d829686028e07050dd3cdf4344866b5dd
SHA512 e31cea4d6c0035a65ae24cc852e91849f0293084c68145e96eb8f2e4c3a644e8ff5ccbe3c3babca31a798a03aa532c48accdad413c7217a29e776133a0b2e182
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf+:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

cTqaqqh.exe

Path C:\Windows\System\cTqaqqh.exe
Size 2.2MB
SHA256 34957427f5c7fa667d9a8f3a7faa4968f7173e33c91411b14a3d1ff235fca456
MD5 5a753090b1b0dc74cb9076be16ceb15f
SHA1 b4ab1ffb0de6c4935aa4e34927b9a710abdf50f8
SHA512 26868a271813f08e21d4f0ad0267052bfce7966809a57b7599d660e52ed818258433fb2650fcce8defd8a20aff4544f9e5a4b18db122104e1797b73a88141968
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfG:NABP
MD5 SHA1 SHA512 SSDEEP

Submit Download

cUWAkdW.exe

Path C:\Windows\System\cUWAkdW.exe
Size 2.2MB
SHA256 bfc0453e35aa245b1d79d9550c636701a23ebe3326c5a953922f90b941b57a2c
MD5 1d225ac7eba505a0794d7a1bc062fd11
SHA1 6def8753e36ef86bf1fb7070bbfb9b587d25cec6
SHA512 7bd8a346878fd539dccaf23f8fa0785458b9369872feef2539e4bd449e7bc12a8e4a4c3263290f2c03dc1b7551683e2bb3aba1656275cd6020ff5d3119c2ea6a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfX:NABq
MD5 SHA1 SHA512 SSDEEP

Submit Download

chmNPnl.exe

Path C:\Windows\System\chmNPnl.exe
Size 2.2MB
SHA256 f6d5d7bd71ad10e02c7c5d5fb5f69fc4410a677c1bb01968743979a067b0110a
MD5 a853b7b59f05db5510ba1ec4838d8f1d
SHA1 2493a09a97159c6f6b3b401c5d9f42ec42c7b91d
SHA512 db58404e3e73006a8a62ab73583e4ad4aeee07318a71a4dbefe884c4e03375eaa21bdad4b2749b845594bdb3873d420552eb95315dd2164386482f80f169cd24
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf9:NABW
MD5 SHA1 SHA512 SSDEEP

Submit Download

dfOgFCD.exe

Path C:\Windows\System\dfOgFCD.exe
Size 2.2MB
SHA256 dde408a33411c381ea2f4aef7b5bdce89ee84d9e9ea0200f8230ee3efd3aee27
MD5 cd8d71d4ed6c9fc37f1a28106feaf34e
SHA1 2fb254901d5449fa6519e1d0895a5ca73841b3e7
SHA512 33dbedc586f22a816568d0f4969350e809d331a031a201b11c3c7cfb905d0f8bc2ff5c9068258e298e9124ea5bc2c55aa6aefca59d3f9828c746139da6a65db4
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfd:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

duueKAr.exe

Path C:\Windows\System\duueKAr.exe
Size 2.2MB
SHA256 c8b82c8eef36f2920f89be55d89017b83ed1b37aa17a64d812daaea5fa56c263
MD5 47098510940f37cb3e6b90fae663f576
SHA1 7ff29886125067f77bad9d5722160f9edc66273c
SHA512 e52bced6729350f43eedc97d7f31e0868dc0834b233aa295f92681a73d00aa2b4169a257348ed5fee6ed34338eef583ab0cb565e014c80b71bc9be4edc70cda8
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfx:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

fHtOxQN.exe

Path C:\Windows\System\fHtOxQN.exe
Size 2.2MB
SHA256 5c656797b34529c78894423810cfd902c7db5aace9e2582ee37f3abfe7237ce6
MD5 cd4ec8b20e6f25862df9963615c575e2
SHA1 934c8336540736f359033ed590eb8d25772c13ae
SHA512 173753c145236bfdeacae5e8de62cba4a2357c31ddcbdb21f987627f915b54f627af584ab78a1123a1b69790e0ccbdc40e6adce340170093592d8621f053c272
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfE:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftVterq.exe

Path C:\Windows\System\ftVterq.exe
Size 2.2MB
SHA256 df5acd7ab07d77f0194cc9d28e9d72fdb00f1a6515c3b8ff58135188b26b58d5
MD5 7f97790c6c50b62552ec76cf0db4246d
SHA1 9523962f9d2bbbe32cd67ba19e11faafa6417a8a
SHA512 7478f37da4a4535ca967ff93b380be6940447797f04c0335e636bbbe066afe51bbde972f61f3b452b995dd45072428e6314d3cce312ebf4a9130fb0720c1d692
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf1:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

icZLekI.exe

Path C:\Windows\System\icZLekI.exe
Size 2.2MB
SHA256 ab29605ddc6777c7a4b0be1f25ec050af9692dd927563a3a6a9abc0b6c9290fd
MD5 99f44db5e9c8339f88715ab9e1c9e008
SHA1 dae7e82fdc592f62107089fbb0e4d38036fb41fa
SHA512 b49872d4f51bb9b5def156e27c89a2d481507030c666e9a2e597da46f0cd2ec086fdc12d02a55db78ca9d5672cacbf2de21a7f704d10d63424a7af0eceb7f73b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfT:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lBXDwhQ.exe

Path C:\Windows\System\lBXDwhQ.exe
Size 2.2MB
SHA256 d4441ad68a44d0cf49ade5253f8089d45afb9a255768b935aad3dab4ba774e58
MD5 9fb4c0197876f68157917114b6ad8970
SHA1 2f5e55d49d04b25bdd5dc77685d9185ec59caa06
SHA512 6dabfb8f6c38b3e7b4634e6bb1935add558341154b408d509fbc0b8fd3a620634836cf396ae9590f300d7be907a967ca0e49e873c06e12fbadc1e67a77b6830f
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfp:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

pKpwMur.exe

Path C:\Windows\System\pKpwMur.exe
Size 2.2MB
SHA256 60a895db9dce1478f75fe79960af733d3eb8228a4bafca6bc947c36e88ea334f
MD5 6db3f98f778d840b416ceb4bb4079a5c
SHA1 f5896844caf178140b37eb05c6cf7a91bcd1a1d4
SHA512 f849405bf4acf263a5676ac8e17bb35af0922d296715ed5ce8ba86ef71828bad65e9daaa11a3896e4723d3cfe657c53ad9fe789422b38823c1fca2b307d09277
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfh:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzFTANz.exe

Path C:\Windows\System\qzFTANz.exe
Size 2.2MB
SHA256 7641471672688e74c36cec9fbfec74970892235cd1dd0c27aae01e83e95e0d18
MD5 44c2d1cc1de26aa7e1a8d919c84eba3d
SHA1 f91e4dda5c36ee6cbad9b8da3a09baad1628245c
SHA512 aa583d354a3e86c51b1190cc95a90c5b0b573dc0b4e31bb928afa00e36086ec0f3f7565aea90b084e669789c7c1cb6fad6617fde321e45a62f07133ffff9b096
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfM:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

rejZTMH.exe

Path C:\Windows\System\rejZTMH.exe
Size 2.2MB
SHA256 32176967d08b53538ef6292b8f614de27eb73bbe04115839c54b7e542dd26017
MD5 e9bd48bd604733a369e0fed0d66b85df
SHA1 96c049920fe4d9bfaa6ddb05f4dee0bbfaed3535
SHA512 10a312ad39d460902ffcaf67905c461c36e6c3d46b3ce8dbc4ccc3cf5f89b7d931f7269551a3d4b5be898d302f6d882ba990dbff209156840f0721c012e1825f
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfy:NABx
MD5 SHA1 SHA512 SSDEEP

Submit Download

xKdyqDF.exe

Path C:\Windows\System\xKdyqDF.exe
Size 2.2MB
SHA256 a05b2d6b468ece1180a367c6bb7b219f1e19b66b521623cd4239f6fefa4e69cd
MD5 94439486d3249fa63dffda24637e16f6
SHA1 2db540715fa2b379b58c793e23c46589ed8f6301
SHA512 aeff6a449de05c7b0f3c50ec5f3c8c9341bcea23c956c51f48d63e4f32d501a4fbf67ff0b4a5b40633dbe39d35e8031cd5f93804e37f35dbd126b83fa7a69c26
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf7:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

xqhVDGP.exe

Path C:\Windows\System\xqhVDGP.exe
Size 2.2MB
SHA256 1f6be0aa96c69560ab361ba5a7b6279b0cdc3e223459735eba8f551a9119edf9
MD5 f6a52bc47111e6f76fb3bd45f270d673
SHA1 e6a2efb974b14c84a057f68266b7016947faab87
SHA512 e15b295e0966b4d3311f5a3b462427117c735fa62aef462e5d07b7466e24ffde5c1ec102e09a13100e04db698325701f3b7939147e71d45bf0f8ed2c8766e079
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf/D:NABY
MD5 SHA1 SHA512 SSDEEP

Submit Download

yWlQDTZ.exe

Path C:\Windows\System\yWlQDTZ.exe
Size 2.2MB
SHA256 b7b55a484397189be8edca279ff0b5ec701750cc4955032582a67ef2841926c4
MD5 5dc6c225823197c3d47e308fc3399bb8
SHA1 e7b4b446caa96ac50516ebdf0a5cc0674e9c7a42
SHA512 72d0128b42ceb5acaf62179b3e43dfd256356aded135487d87b5d9a5ba954468e506475351339b27f99c9d29fc09d398d6a2cbae270b955ec2e94cc3aa008946
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfX:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

zcmViPg.exe

Path C:\Windows\System\zcmViPg.exe
Size 2.2MB
SHA256 1dad4d4d5208cd268192d89e922222ad39469fc0730f5a977ed0f3f8ae46303c
MD5 10b0a9a3c1b4ac7d4ce4e60d5761ee66
SHA1 d918a46483b79c0fae31c8724f0cb709b64e18db
SHA512 66af9ca6d73277abb81958a0cf7abbd8b96449fe2571bc9ea5999fbbd24a7428e4338883a6f3198be00bbb75671248c4576a769ba5c2d128c8626d37a3fd79be
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfW:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-2929-0x00007FF670360000-0x00007FF670752000-memory.dmp

Download

memory/224-137-0x00007FF670360000-0x00007FF670752000-memory.dmp

Download

memory/224-2958-0x00007FF670360000-0x00007FF670752000-memory.dmp

Download

memory/384-33-0x00007FF760430000-0x00007FF760822000-memory.dmp

Download

memory/540-2948-0x00007FF68C600000-0x00007FF68C9F2000-memory.dmp

Download

memory/540-113-0x00007FF68C600000-0x00007FF68C9F2000-memory.dmp

Download

memory/924-2928-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp

Download

memory/924-126-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp

Download

memory/924-2955-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp

Download

memory/1012-2938-0x00007FF621C50000-0x00007FF622042000-memory.dmp

Download

memory/1012-98-0x00007FF621C50000-0x00007FF622042000-memory.dmp

Download

memory/1452-2965-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp

Download

memory/1452-2932-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp

Download

memory/1452-155-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp

Download

memory/1620-2931-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp

Download

memory/1620-149-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp

Download

memory/1620-2960-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp

Download

memory/1924-39-0x00007FF62A260000-0x00007FF62A652000-memory.dmp

Download

memory/1948-2930-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp

Download

memory/1948-143-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp

Download

memory/1948-2956-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp

Download

memory/2320-70-0x00007FF75D630000-0x00007FF75DA22000-memory.dmp

Download

memory/2320-2934-0x00007FF75D630000-0x00007FF75DA22000-memory.dmp

Download

memory/2456-2944-0x00007FF6826C0000-0x00007FF682AB2000-memory.dmp

Download

memory/2456-94-0x00007FF6826C0000-0x00007FF682AB2000-memory.dmp

Download

memory/2752-57-0x00007FF7E79B0000-0x00007FF7E7DA2000-memory.dmp

Download

memory/3096-2946-0x00007FF75DC10000-0x00007FF75E002000-memory.dmp

Download

memory/3096-107-0x00007FF75DC10000-0x00007FF75E002000-memory.dmp

Download

memory/3192-167-0x00007FF7B61A0000-0x00007FF7B6592000-memory.dmp

Download

memory/3192-2963-0x00007FF7B61A0000-0x00007FF7B6592000-memory.dmp

Download

memory/3568-85-0x00007FF70AD10000-0x00007FF70B102000-memory.dmp

Download

memory/3568-2936-0x00007FF70AD10000-0x00007FF70B102000-memory.dmp

Download

memory/3612-84-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp

Download

memory/3616-2940-0x00007FF6F7AB0000-0x00007FF6F7EA2000-memory.dmp

Download

memory/3616-92-0x00007FF6F7AB0000-0x00007FF6F7EA2000-memory.dmp

Download

memory/3656-1-0x000001EF64380000-0x000001EF64390000-memory.dmp

Download

memory/3656-0-0x00007FF659540000-0x00007FF659932000-memory.dmp

Download

memory/3904-77-0x00007FFE2B310000-0x00007FFE2BDD1000-memory.dmp

Download

memory/3904-8-0x00007FFE2B313000-0x00007FFE2B315000-memory.dmp

Download

memory/3904-30-0x00007FFE2B310000-0x00007FFE2BDD1000-memory.dmp

Download

memory/3904-423-0x00000218EE550000-0x00000218EECF6000-memory.dmp

Download

memory/3904-58-0x00000218ED910000-0x00000218ED932000-memory.dmp

Download

memory/4084-2966-0x00007FF7FE470000-0x00007FF7FE862000-memory.dmp

Download

memory/4084-161-0x00007FF7FE470000-0x00007FF7FE862000-memory.dmp

Download

memory/4412-6-0x00007FF6009B0000-0x00007FF600DA2000-memory.dmp

Download

memory/4432-2927-0x00007FF650540000-0x00007FF650932000-memory.dmp

Download

memory/4432-2952-0x00007FF650540000-0x00007FF650932000-memory.dmp

Download

memory/4432-120-0x00007FF650540000-0x00007FF650932000-memory.dmp

Download

memory/4676-2943-0x00007FF61C500000-0x00007FF61C8F2000-memory.dmp

Download

memory/4676-97-0x00007FF61C500000-0x00007FF61C8F2000-memory.dmp

Download

memory/4716-2951-0x00007FF6AFBA0000-0x00007FF6AFF92000-memory.dmp

Download

memory/4716-114-0x00007FF6AFBA0000-0x00007FF6AFF92000-memory.dmp

Download

memory/5060-63-0x00007FF670C40000-0x00007FF671032000-memory.dmp

Download

memory/5064-83-0x00007FF770C30000-0x00007FF771022000-memory.dmp

Download