xmrig | 5c7a2b24b54e6a1a64340648c4a0213666e62369b816c2031a84feae954f1233

Analysis

max time kernel
92s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
Size

2.0MB
MD5

18415e676f0e0386866b883fbd1a4acd
SHA1

e2be1a8fb28940949c7a5eb0f5a24c3f9227b68a
SHA256

5c7a2b24b54e6a1a64340648c4a0213666e62369b816c2031a84feae954f1233
SHA512

3937e4158e2f613a82a092b62ddcd350b5ce6f64db91c5bd672e40a2264deda4a4b3c3f83ba12475e4253bd3e6033a1ee3fb7a74331f558f132a2a4374cdc1c7
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafm4i:NAB7

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/5732-54-0x00007FF70B4F0000-0x00007FF70B8E2000-memory.dmp	xmrig
behavioral2/memory/4880-46-0x00007FF7CF860000-0x00007FF7CFC52000-memory.dmp	xmrig
behavioral2/memory/4784-43-0x00007FF7F84B0000-0x00007FF7F88A2000-memory.dmp	xmrig
behavioral2/memory/4956-40-0x00007FF743850000-0x00007FF743C42000-memory.dmp	xmrig
behavioral2/memory/3528-88-0x00007FF7677B0000-0x00007FF767BA2000-memory.dmp	xmrig
behavioral2/memory/1876-103-0x00007FF6CD280000-0x00007FF6CD672000-memory.dmp	xmrig
behavioral2/memory/2584-104-0x00007FF620E50000-0x00007FF621242000-memory.dmp	xmrig
behavioral2/memory/1564-550-0x00007FF776B60000-0x00007FF776F52000-memory.dmp	xmrig
behavioral2/memory/4136-551-0x00007FF7A3B40000-0x00007FF7A3F32000-memory.dmp	xmrig
behavioral2/memory/2000-552-0x00007FF7FD560000-0x00007FF7FD952000-memory.dmp	xmrig
behavioral2/memory/3836-554-0x00007FF66F8D0000-0x00007FF66FCC2000-memory.dmp	xmrig
behavioral2/memory/1992-555-0x00007FF7DB420000-0x00007FF7DB812000-memory.dmp	xmrig
behavioral2/memory/3216-557-0x00007FF74A1D0000-0x00007FF74A5C2000-memory.dmp	xmrig
behavioral2/memory/3768-558-0x00007FF7600D0000-0x00007FF7604C2000-memory.dmp	xmrig
behavioral2/memory/1628-556-0x00007FF61C3A0000-0x00007FF61C792000-memory.dmp	xmrig
behavioral2/memory/3472-553-0x00007FF683EF0000-0x00007FF6842E2000-memory.dmp	xmrig
behavioral2/memory/1844-100-0x00007FF78A8F0000-0x00007FF78ACE2000-memory.dmp	xmrig
behavioral2/memory/744-99-0x00007FF7ACA00000-0x00007FF7ACDF2000-memory.dmp	xmrig
behavioral2/memory/3008-96-0x00007FF675210000-0x00007FF675602000-memory.dmp	xmrig
behavioral2/memory/736-92-0x00007FF78A100000-0x00007FF78A4F2000-memory.dmp	xmrig
behavioral2/memory/4088-89-0x00007FF6A5920000-0x00007FF6A5D12000-memory.dmp	xmrig
behavioral2/memory/5248-87-0x00007FF70D5D0000-0x00007FF70D9C2000-memory.dmp	xmrig
behavioral2/memory/1536-83-0x00007FF70E520000-0x00007FF70E912000-memory.dmp	xmrig
behavioral2/memory/3488-2689-0x00007FF6E5000000-0x00007FF6E53F2000-memory.dmp	xmrig
behavioral2/memory/736-2700-0x00007FF78A100000-0x00007FF78A4F2000-memory.dmp	xmrig
behavioral2/memory/4956-2702-0x00007FF743850000-0x00007FF743C42000-memory.dmp	xmrig
behavioral2/memory/4880-2705-0x00007FF7CF860000-0x00007FF7CFC52000-memory.dmp	xmrig
behavioral2/memory/4784-2706-0x00007FF7F84B0000-0x00007FF7F88A2000-memory.dmp	xmrig
behavioral2/memory/5732-2708-0x00007FF70B4F0000-0x00007FF70B8E2000-memory.dmp	xmrig
behavioral2/memory/1536-2710-0x00007FF70E520000-0x00007FF70E912000-memory.dmp	xmrig
behavioral2/memory/4088-2714-0x00007FF6A5920000-0x00007FF6A5D12000-memory.dmp	xmrig
behavioral2/memory/5248-2713-0x00007FF70D5D0000-0x00007FF70D9C2000-memory.dmp	xmrig
behavioral2/memory/3488-2716-0x00007FF6E5000000-0x00007FF6E53F2000-memory.dmp	xmrig
behavioral2/memory/744-2723-0x00007FF7ACA00000-0x00007FF7ACDF2000-memory.dmp	xmrig
behavioral2/memory/3528-2727-0x00007FF7677B0000-0x00007FF767BA2000-memory.dmp	xmrig
behavioral2/memory/1844-2728-0x00007FF78A8F0000-0x00007FF78ACE2000-memory.dmp	xmrig
behavioral2/memory/2584-2725-0x00007FF620E50000-0x00007FF621242000-memory.dmp	xmrig
behavioral2/memory/1876-2719-0x00007FF6CD280000-0x00007FF6CD672000-memory.dmp	xmrig
behavioral2/memory/3008-2721-0x00007FF675210000-0x00007FF675602000-memory.dmp	xmrig
behavioral2/memory/1564-2730-0x00007FF776B60000-0x00007FF776F52000-memory.dmp	xmrig
behavioral2/memory/3768-2740-0x00007FF7600D0000-0x00007FF7604C2000-memory.dmp	xmrig
behavioral2/memory/3216-2741-0x00007FF74A1D0000-0x00007FF74A5C2000-memory.dmp	xmrig
behavioral2/memory/2000-2747-0x00007FF7FD560000-0x00007FF7FD952000-memory.dmp	xmrig
behavioral2/memory/3472-2746-0x00007FF683EF0000-0x00007FF6842E2000-memory.dmp	xmrig
behavioral2/memory/3836-2744-0x00007FF66F8D0000-0x00007FF66FCC2000-memory.dmp	xmrig
behavioral2/memory/1992-2736-0x00007FF7DB420000-0x00007FF7DB812000-memory.dmp	xmrig
behavioral2/memory/1628-2734-0x00007FF61C3A0000-0x00007FF61C792000-memory.dmp	xmrig
behavioral2/memory/4136-2738-0x00007FF7A3B40000-0x00007FF7A3F32000-memory.dmp	xmrig
behavioral2/memory/736-2968-0x00007FF78A100000-0x00007FF78A4F2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	4248	powershell.exe
11	4248	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4248	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4956	jQsBJzT.exe
4784	vbmvZxb.exe
4880	DnHAsAA.exe
5732	rLftcvI.exe
1536	cyrrQpy.exe
5248	OsaqkCV.exe
3488	ghrsqjE.exe
3528	tFJtiaR.exe
4088	gtcKiim.exe
744	IxXnqut.exe
736	kvUqoUZ.exe
3008	wOVwYQb.exe
1844	FwhNmJe.exe
1876	IJcTizf.exe
2584	TdNfnCy.exe
1564	JLQEtPU.exe
4136	vtsIthW.exe
2000	RcMaIEM.exe
3472	slNTlSN.exe
3836	vFgPjwn.exe
1992	GPULmtK.exe
1628	SiBaafZ.exe
3216	afaFzgs.exe
3768	QoFDyjr.exe
1156	ZiMRefs.exe
5384	mlJlCNR.exe
5372	ygHRbmV.exe
1624	AdDrFLz.exe
4644	ZmMguYN.exe
1448	ghgGYmC.exe
3324	Mstyjhh.exe
4620	KMRJmVa.exe
1620	CkHKVeD.exe
4588	tHOkrky.exe
6024	gokUPLe.exe
4824	QAMxvyX.exe
4648	mpQxZFL.exe
6036	Xsfitxq.exe
4916	gSUJSVK.exe
5296	dlhMFJL.exe
5544	EJbpHrv.exe
5408	bjpYMcR.exe
2016	pnDaelk.exe
6068	dDNPbVk.exe
3236	PSaywgr.exe
5288	jjfSoWE.exe
6140	PFMwTcn.exe
5664	PafeYhF.exe
4828	bnWRaif.exe
3484	xnzopuA.exe
884	XtVaQQp.exe
5148	tFdLteV.exe
2896	RtasVAs.exe
3888	QYRppwL.exe
4972	QpLMiyI.exe
1816	RqEPUFr.exe
2064	kdIUEXV.exe
6064	aCvgSNM.exe
6060	ISLumew.exe
3296	PlVqlKA.exe
2700	wRmCXJo.exe
3340	nnsXABa.exe
3328	VNzqtRM.exe
4328	xaiLEHr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1104-0-0x00007FF6381C0000-0x00007FF6385B2000-memory.dmp	upx
behavioral2/files/0x000c000000023b34-6.dat	upx
behavioral2/files/0x000a000000023b96-9.dat	upx
behavioral2/files/0x000a000000023b97-18.dat	upx
behavioral2/files/0x000a000000023b98-19.dat	upx
behavioral2/files/0x000b000000023b9b-45.dat	upx
behavioral2/files/0x000a000000023b9d-53.dat	upx
behavioral2/files/0x000a000000023b9e-58.dat	upx
behavioral2/files/0x000a000000023b9c-56.dat	upx
behavioral2/memory/5732-54-0x00007FF70B4F0000-0x00007FF70B8E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-49.dat	upx
behavioral2/memory/4880-46-0x00007FF7CF860000-0x00007FF7CFC52000-memory.dmp	upx
behavioral2/memory/4784-43-0x00007FF7F84B0000-0x00007FF7F88A2000-memory.dmp	upx
behavioral2/memory/4956-40-0x00007FF743850000-0x00007FF743C42000-memory.dmp	upx
behavioral2/files/0x000b000000023b9a-79.dat	upx
behavioral2/files/0x000a000000023ba0-84.dat	upx
behavioral2/memory/3528-88-0x00007FF7677B0000-0x00007FF767BA2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba2-94.dat	upx
behavioral2/files/0x000a000000023ba1-97.dat	upx
behavioral2/memory/1876-103-0x00007FF6CD280000-0x00007FF6CD672000-memory.dmp	upx
behavioral2/memory/2584-104-0x00007FF620E50000-0x00007FF621242000-memory.dmp	upx
behavioral2/files/0x000b000000023b93-108.dat	upx
behavioral2/files/0x000a000000023ba6-122.dat	upx
behavioral2/files/0x000a000000023ba8-132.dat	upx
behavioral2/files/0x000a000000023bac-158.dat	upx
behavioral2/files/0x000a000000023bb0-175.dat	upx
behavioral2/memory/1564-550-0x00007FF776B60000-0x00007FF776F52000-memory.dmp	upx
behavioral2/memory/4136-551-0x00007FF7A3B40000-0x00007FF7A3F32000-memory.dmp	upx
behavioral2/memory/2000-552-0x00007FF7FD560000-0x00007FF7FD952000-memory.dmp	upx
behavioral2/memory/3836-554-0x00007FF66F8D0000-0x00007FF66FCC2000-memory.dmp	upx
behavioral2/memory/1992-555-0x00007FF7DB420000-0x00007FF7DB812000-memory.dmp	upx
behavioral2/memory/3216-557-0x00007FF74A1D0000-0x00007FF74A5C2000-memory.dmp	upx
behavioral2/memory/3768-558-0x00007FF7600D0000-0x00007FF7604C2000-memory.dmp	upx
behavioral2/memory/1628-556-0x00007FF61C3A0000-0x00007FF61C792000-memory.dmp	upx
behavioral2/memory/3472-553-0x00007FF683EF0000-0x00007FF6842E2000-memory.dmp	upx
behavioral2/files/0x0031000000023bb4-190.dat	upx
behavioral2/files/0x000a000000023bb3-187.dat	upx
behavioral2/files/0x000a000000023bb2-185.dat	upx
behavioral2/files/0x000a000000023bb1-181.dat	upx
behavioral2/files/0x000a000000023baf-171.dat	upx
behavioral2/files/0x000a000000023bae-165.dat	upx
behavioral2/files/0x000a000000023bad-161.dat	upx
behavioral2/files/0x000a000000023bab-153.dat	upx
behavioral2/files/0x000a000000023baa-148.dat	upx
behavioral2/files/0x000a000000023ba9-143.dat	upx
behavioral2/files/0x000a000000023ba7-130.dat	upx
behavioral2/files/0x000a000000023ba5-120.dat	upx
behavioral2/files/0x000a000000023ba4-116.dat	upx
behavioral2/files/0x000a000000023ba3-101.dat	upx
behavioral2/memory/1844-100-0x00007FF78A8F0000-0x00007FF78ACE2000-memory.dmp	upx
behavioral2/memory/744-99-0x00007FF7ACA00000-0x00007FF7ACDF2000-memory.dmp	upx
behavioral2/memory/3008-96-0x00007FF675210000-0x00007FF675602000-memory.dmp	upx
behavioral2/memory/736-92-0x00007FF78A100000-0x00007FF78A4F2000-memory.dmp	upx
behavioral2/memory/4088-89-0x00007FF6A5920000-0x00007FF6A5D12000-memory.dmp	upx
behavioral2/memory/5248-87-0x00007FF70D5D0000-0x00007FF70D9C2000-memory.dmp	upx
behavioral2/memory/1536-83-0x00007FF70E520000-0x00007FF70E912000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-70.dat	upx
behavioral2/memory/3488-64-0x00007FF6E5000000-0x00007FF6E53F2000-memory.dmp	upx
behavioral2/memory/3488-2689-0x00007FF6E5000000-0x00007FF6E53F2000-memory.dmp	upx
behavioral2/memory/736-2700-0x00007FF78A100000-0x00007FF78A4F2000-memory.dmp	upx
behavioral2/memory/4956-2702-0x00007FF743850000-0x00007FF743C42000-memory.dmp	upx
behavioral2/memory/4880-2705-0x00007FF7CF860000-0x00007FF7CFC52000-memory.dmp	upx
behavioral2/memory/4784-2706-0x00007FF7F84B0000-0x00007FF7F88A2000-memory.dmp	upx
behavioral2/memory/5732-2708-0x00007FF70B4F0000-0x00007FF70B8E2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tdPXXtg.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\WyvtyPX.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\xdbFAgB.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\HxxmfvG.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\BMixtfK.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\pQemYQZ.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\pBdOtOQ.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\VClqLdt.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\JLkZzZp.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\dtzIUOS.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\AiXWzhl.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\XHVSnGg.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\JuRCzqn.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\FFpYXWy.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\uTdYcOz.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\sZGypca.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\fMwkyOL.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\DHUcGRo.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\WBKMzTU.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\pMjuouy.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\NOqFytw.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\ilBzFBg.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\JsuKvIh.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\eAcEwzL.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\tYVTTrm.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\WgzOHsS.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\oHOHmAg.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\MTrehOK.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\ZLRAEeT.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\KremVpY.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\cBbbtOL.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\DMuVvMN.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\lIPbTgO.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\jJFayxR.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\FXXaFCF.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\Xsfitxq.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\dMDeXbU.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\oFbTKEy.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\RAHFOGl.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\APGsqYO.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\hwFBSUd.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\zcZRPIL.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\ifMhPHk.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\TdNfnCy.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\RMZoBVu.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\LqHmKRW.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\YjNDfhx.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\YfnjsPm.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\wRmCXJo.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\FNUddDB.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\GPFfvZs.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\YNNPZwU.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\PBtyFmN.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\uzqxYbP.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\mNVScUT.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\zJscIhA.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\cdcVuAZ.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\SihsISq.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\jdoshtI.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\wOVwYQb.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\JVSxlmj.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\SSnNtyP.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\zTNePDP.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\hihLehf.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4248	powershell.exe
4248	powershell.exe
4248	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeLockMemoryPrivilege	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4248	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	84
PID 1104 wrote to memory of 4248	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	84
PID 1104 wrote to memory of 4956	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	85
PID 1104 wrote to memory of 4956	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	85
PID 1104 wrote to memory of 4784	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	86
PID 1104 wrote to memory of 4784	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	86
PID 1104 wrote to memory of 4880	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	87
PID 1104 wrote to memory of 4880	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	87
PID 1104 wrote to memory of 5732	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	88
PID 1104 wrote to memory of 5732	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	88
PID 1104 wrote to memory of 1536	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	89
PID 1104 wrote to memory of 1536	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	89
PID 1104 wrote to memory of 5248	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	90
PID 1104 wrote to memory of 5248	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	90
PID 1104 wrote to memory of 3488	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	91
PID 1104 wrote to memory of 3488	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	91
PID 1104 wrote to memory of 3528	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	92
PID 1104 wrote to memory of 3528	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	92
PID 1104 wrote to memory of 4088	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	93
PID 1104 wrote to memory of 4088	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	93
PID 1104 wrote to memory of 744	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	94
PID 1104 wrote to memory of 744	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	94
PID 1104 wrote to memory of 736	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	95
PID 1104 wrote to memory of 736	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	95
PID 1104 wrote to memory of 3008	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	96
PID 1104 wrote to memory of 3008	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	96
PID 1104 wrote to memory of 1844	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	97
PID 1104 wrote to memory of 1844	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	97
PID 1104 wrote to memory of 1876	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	98
PID 1104 wrote to memory of 1876	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	98
PID 1104 wrote to memory of 2584	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	99
PID 1104 wrote to memory of 2584	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	99
PID 1104 wrote to memory of 1564	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	100
PID 1104 wrote to memory of 1564	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	100
PID 1104 wrote to memory of 4136	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	101
PID 1104 wrote to memory of 4136	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	101
PID 1104 wrote to memory of 2000	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	102
PID 1104 wrote to memory of 2000	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	102
PID 1104 wrote to memory of 3472	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	103
PID 1104 wrote to memory of 3472	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	103
PID 1104 wrote to memory of 3836	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	104
PID 1104 wrote to memory of 3836	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	104
PID 1104 wrote to memory of 1992	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	105
PID 1104 wrote to memory of 1992	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	105
PID 1104 wrote to memory of 1628	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	106
PID 1104 wrote to memory of 1628	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	106
PID 1104 wrote to memory of 3216	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	107
PID 1104 wrote to memory of 3216	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	107
PID 1104 wrote to memory of 3768	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	108
PID 1104 wrote to memory of 3768	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	108
PID 1104 wrote to memory of 1156	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	109
PID 1104 wrote to memory of 1156	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	109
PID 1104 wrote to memory of 5384	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	110
PID 1104 wrote to memory of 5384	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	110
PID 1104 wrote to memory of 5372	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	111
PID 1104 wrote to memory of 5372	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	111
PID 1104 wrote to memory of 1624	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	112
PID 1104 wrote to memory of 1624	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	112
PID 1104 wrote to memory of 4644	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	113
PID 1104 wrote to memory of 4644	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	113
PID 1104 wrote to memory of 1448	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	114
PID 1104 wrote to memory of 1448	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	114
PID 1104 wrote to memory of 3324	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	115
PID 1104 wrote to memory of 3324	1104	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\System\jQsBJzT.exe
  C:\Windows\System\jQsBJzT.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\vbmvZxb.exe
  C:\Windows\System\vbmvZxb.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\DnHAsAA.exe
  C:\Windows\System\DnHAsAA.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\rLftcvI.exe
  C:\Windows\System\rLftcvI.exe
  2⤵
  - Executes dropped EXE
  PID:5732
- C:\Windows\System\cyrrQpy.exe
  C:\Windows\System\cyrrQpy.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\OsaqkCV.exe
  C:\Windows\System\OsaqkCV.exe
  2⤵
  - Executes dropped EXE
  PID:5248
- C:\Windows\System\ghrsqjE.exe
  C:\Windows\System\ghrsqjE.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\tFJtiaR.exe
  C:\Windows\System\tFJtiaR.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\gtcKiim.exe
  C:\Windows\System\gtcKiim.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\IxXnqut.exe
  C:\Windows\System\IxXnqut.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\kvUqoUZ.exe
  C:\Windows\System\kvUqoUZ.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\wOVwYQb.exe
  C:\Windows\System\wOVwYQb.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\FwhNmJe.exe
  C:\Windows\System\FwhNmJe.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\IJcTizf.exe
  C:\Windows\System\IJcTizf.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\TdNfnCy.exe
  C:\Windows\System\TdNfnCy.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\JLQEtPU.exe
  C:\Windows\System\JLQEtPU.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\vtsIthW.exe
  C:\Windows\System\vtsIthW.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\RcMaIEM.exe
  C:\Windows\System\RcMaIEM.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\slNTlSN.exe
  C:\Windows\System\slNTlSN.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\vFgPjwn.exe
  C:\Windows\System\vFgPjwn.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\GPULmtK.exe
  C:\Windows\System\GPULmtK.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\SiBaafZ.exe
  C:\Windows\System\SiBaafZ.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\afaFzgs.exe
  C:\Windows\System\afaFzgs.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\QoFDyjr.exe
  C:\Windows\System\QoFDyjr.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\ZiMRefs.exe
  C:\Windows\System\ZiMRefs.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\mlJlCNR.exe
  C:\Windows\System\mlJlCNR.exe
  2⤵
  - Executes dropped EXE
  PID:5384
- C:\Windows\System\ygHRbmV.exe
  C:\Windows\System\ygHRbmV.exe
  2⤵
  - Executes dropped EXE
  PID:5372
- C:\Windows\System\AdDrFLz.exe
  C:\Windows\System\AdDrFLz.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\ZmMguYN.exe
  C:\Windows\System\ZmMguYN.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\ghgGYmC.exe
  C:\Windows\System\ghgGYmC.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\Mstyjhh.exe
  C:\Windows\System\Mstyjhh.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\KMRJmVa.exe
  C:\Windows\System\KMRJmVa.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\CkHKVeD.exe
  C:\Windows\System\CkHKVeD.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\tHOkrky.exe
  C:\Windows\System\tHOkrky.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\gokUPLe.exe
  C:\Windows\System\gokUPLe.exe
  2⤵
  - Executes dropped EXE
  PID:6024
- C:\Windows\System\QAMxvyX.exe
  C:\Windows\System\QAMxvyX.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\mpQxZFL.exe
  C:\Windows\System\mpQxZFL.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\Xsfitxq.exe
  C:\Windows\System\Xsfitxq.exe
  2⤵
  - Executes dropped EXE
  PID:6036
- C:\Windows\System\gSUJSVK.exe
  C:\Windows\System\gSUJSVK.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\dlhMFJL.exe
  C:\Windows\System\dlhMFJL.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System\EJbpHrv.exe
  C:\Windows\System\EJbpHrv.exe
  2⤵
  - Executes dropped EXE
  PID:5544
- C:\Windows\System\bjpYMcR.exe
  C:\Windows\System\bjpYMcR.exe
  2⤵
  - Executes dropped EXE
  PID:5408
- C:\Windows\System\pnDaelk.exe
  C:\Windows\System\pnDaelk.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\dDNPbVk.exe
  C:\Windows\System\dDNPbVk.exe
  2⤵
  - Executes dropped EXE
  PID:6068
- C:\Windows\System\PSaywgr.exe
  C:\Windows\System\PSaywgr.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\jjfSoWE.exe
  C:\Windows\System\jjfSoWE.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\PFMwTcn.exe
  C:\Windows\System\PFMwTcn.exe
  2⤵
  - Executes dropped EXE
  PID:6140
- C:\Windows\System\PafeYhF.exe
  C:\Windows\System\PafeYhF.exe
  2⤵
  - Executes dropped EXE
  PID:5664
- C:\Windows\System\bnWRaif.exe
  C:\Windows\System\bnWRaif.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\xnzopuA.exe
  C:\Windows\System\xnzopuA.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\XtVaQQp.exe
  C:\Windows\System\XtVaQQp.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\tFdLteV.exe
  C:\Windows\System\tFdLteV.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\RtasVAs.exe
  C:\Windows\System\RtasVAs.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\QYRppwL.exe
  C:\Windows\System\QYRppwL.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\QpLMiyI.exe
  C:\Windows\System\QpLMiyI.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\RqEPUFr.exe
  C:\Windows\System\RqEPUFr.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\kdIUEXV.exe
  C:\Windows\System\kdIUEXV.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\aCvgSNM.exe
  C:\Windows\System\aCvgSNM.exe
  2⤵
  - Executes dropped EXE
  PID:6064
- C:\Windows\System\ISLumew.exe
  C:\Windows\System\ISLumew.exe
  2⤵
  - Executes dropped EXE
  PID:6060
- C:\Windows\System\PlVqlKA.exe
  C:\Windows\System\PlVqlKA.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\wRmCXJo.exe
  C:\Windows\System\wRmCXJo.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\nnsXABa.exe
  C:\Windows\System\nnsXABa.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\VNzqtRM.exe
  C:\Windows\System\VNzqtRM.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\xaiLEHr.exe
  C:\Windows\System\xaiLEHr.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\AdtDtCw.exe
  C:\Windows\System\AdtDtCw.exe
  2⤵
  PID:4276
- C:\Windows\System\DpUloNl.exe
  C:\Windows\System\DpUloNl.exe
  2⤵
  PID:5660
- C:\Windows\System\pjfZVvz.exe
  C:\Windows\System\pjfZVvz.exe
  2⤵
  PID:1232
- C:\Windows\System\PdjNOeD.exe
  C:\Windows\System\PdjNOeD.exe
  2⤵
  PID:1944
- C:\Windows\System\RbEGUBj.exe
  C:\Windows\System\RbEGUBj.exe
  2⤵
  PID:4820
- C:\Windows\System\fxnqOdQ.exe
  C:\Windows\System\fxnqOdQ.exe
  2⤵
  PID:4512
- C:\Windows\System\GfjpfyU.exe
  C:\Windows\System\GfjpfyU.exe
  2⤵
  PID:2204
- C:\Windows\System\TDhENTf.exe
  C:\Windows\System\TDhENTf.exe
  2⤵
  PID:860
- C:\Windows\System\UzFdTeW.exe
  C:\Windows\System\UzFdTeW.exe
  2⤵
  PID:4676
- C:\Windows\System\EwBbvsl.exe
  C:\Windows\System\EwBbvsl.exe
  2⤵
  PID:4396
- C:\Windows\System\ufuAzfq.exe
  C:\Windows\System\ufuAzfq.exe
  2⤵
  PID:4400
- C:\Windows\System\jQcNWyA.exe
  C:\Windows\System\jQcNWyA.exe
  2⤵
  PID:4288
- C:\Windows\System\tAsQiYX.exe
  C:\Windows\System\tAsQiYX.exe
  2⤵
  PID:1540
- C:\Windows\System\Uivqsbz.exe
  C:\Windows\System\Uivqsbz.exe
  2⤵
  PID:1396
- C:\Windows\System\bQnDXQv.exe
  C:\Windows\System\bQnDXQv.exe
  2⤵
  PID:4528
- C:\Windows\System\WGpajKm.exe
  C:\Windows\System\WGpajKm.exe
  2⤵
  PID:3268
- C:\Windows\System\TYhynWt.exe
  C:\Windows\System\TYhynWt.exe
  2⤵
  PID:5280
- C:\Windows\System\zcZRPIL.exe
  C:\Windows\System\zcZRPIL.exe
  2⤵
  PID:5608
- C:\Windows\System\OJhPluH.exe
  C:\Windows\System\OJhPluH.exe
  2⤵
  PID:2028
- C:\Windows\System\MPusWrq.exe
  C:\Windows\System\MPusWrq.exe
  2⤵
  PID:1556
- C:\Windows\System\TdqOJKL.exe
  C:\Windows\System\TdqOJKL.exe
  2⤵
  PID:5440
- C:\Windows\System\DMuVvMN.exe
  C:\Windows\System\DMuVvMN.exe
  2⤵
  PID:4348
- C:\Windows\System\dAvsXFH.exe
  C:\Windows\System\dAvsXFH.exe
  2⤵
  PID:5104
- C:\Windows\System\AtUTtMq.exe
  C:\Windows\System\AtUTtMq.exe
  2⤵
  PID:3136
- C:\Windows\System\RneFxfj.exe
  C:\Windows\System\RneFxfj.exe
  2⤵
  PID:1680
- C:\Windows\System\yXScMPT.exe
  C:\Windows\System\yXScMPT.exe
  2⤵
  PID:4080
- C:\Windows\System\cOFJngk.exe
  C:\Windows\System\cOFJngk.exe
  2⤵
  PID:3336
- C:\Windows\System\XVeiHgX.exe
  C:\Windows\System\XVeiHgX.exe
  2⤵
  PID:6004
- C:\Windows\System\DHUcGRo.exe
  C:\Windows\System\DHUcGRo.exe
  2⤵
  PID:5944
- C:\Windows\System\sNBvtMG.exe
  C:\Windows\System\sNBvtMG.exe
  2⤵
  PID:3368
- C:\Windows\System\QLXqhdx.exe
  C:\Windows\System\QLXqhdx.exe
  2⤵
  PID:3200
- C:\Windows\System\ERAjcxk.exe
  C:\Windows\System\ERAjcxk.exe
  2⤵
  PID:1900
- C:\Windows\System\QSiLTKK.exe
  C:\Windows\System\QSiLTKK.exe
  2⤵
  PID:4260
- C:\Windows\System\LjvCtAT.exe
  C:\Windows\System\LjvCtAT.exe
  2⤵
  PID:6084
- C:\Windows\System\AiXWzhl.exe
  C:\Windows\System\AiXWzhl.exe
  2⤵
  PID:5392
- C:\Windows\System\BrFQPuM.exe
  C:\Windows\System\BrFQPuM.exe
  2⤵
  PID:212
- C:\Windows\System\LKFmFhu.exe
  C:\Windows\System\LKFmFhu.exe
  2⤵
  PID:2436
- C:\Windows\System\CuFFFyf.exe
  C:\Windows\System\CuFFFyf.exe
  2⤵
  PID:1552
- C:\Windows\System\eAcEwzL.exe
  C:\Windows\System\eAcEwzL.exe
  2⤵
  PID:2968
- C:\Windows\System\RhtnfpV.exe
  C:\Windows\System\RhtnfpV.exe
  2⤵
  PID:1736
- C:\Windows\System\szodonf.exe
  C:\Windows\System\szodonf.exe
  2⤵
  PID:5760
- C:\Windows\System\ISrEWbi.exe
  C:\Windows\System\ISrEWbi.exe
  2⤵
  PID:2704
- C:\Windows\System\kuKGKRv.exe
  C:\Windows\System\kuKGKRv.exe
  2⤵
  PID:3932
- C:\Windows\System\jvcyCjR.exe
  C:\Windows\System\jvcyCjR.exe
  2⤵
  PID:5192
- C:\Windows\System\MbrinhA.exe
  C:\Windows\System\MbrinhA.exe
  2⤵
  PID:4516
- C:\Windows\System\OTufGWo.exe
  C:\Windows\System\OTufGWo.exe
  2⤵
  PID:2328
- C:\Windows\System\YYgEZEX.exe
  C:\Windows\System\YYgEZEX.exe
  2⤵
  PID:1828
- C:\Windows\System\HhVnftp.exe
  C:\Windows\System\HhVnftp.exe
  2⤵
  PID:1236
- C:\Windows\System\oHtWmtd.exe
  C:\Windows\System\oHtWmtd.exe
  2⤵
  PID:5136
- C:\Windows\System\lIPbTgO.exe
  C:\Windows\System\lIPbTgO.exe
  2⤵
  PID:376
- C:\Windows\System\brpyDmz.exe
  C:\Windows\System\brpyDmz.exe
  2⤵
  PID:4068
- C:\Windows\System\MwYwViK.exe
  C:\Windows\System\MwYwViK.exe
  2⤵
  PID:1544
- C:\Windows\System\jTxuiGC.exe
  C:\Windows\System\jTxuiGC.exe
  2⤵
  PID:5704
- C:\Windows\System\eLDMLfP.exe
  C:\Windows\System\eLDMLfP.exe
  2⤵
  PID:5616
- C:\Windows\System\ORHUeLc.exe
  C:\Windows\System\ORHUeLc.exe
  2⤵
  PID:2276
- C:\Windows\System\IYRLKUG.exe
  C:\Windows\System\IYRLKUG.exe
  2⤵
  PID:3096
- C:\Windows\System\gVihjew.exe
  C:\Windows\System\gVihjew.exe
  2⤵
  PID:3080
- C:\Windows\System\isBmNoU.exe
  C:\Windows\System\isBmNoU.exe
  2⤵
  PID:5992
- C:\Windows\System\ZIuhgBN.exe
  C:\Windows\System\ZIuhgBN.exe
  2⤵
  PID:6052
- C:\Windows\System\OzsLCHl.exe
  C:\Windows\System\OzsLCHl.exe
  2⤵
  PID:5628
- C:\Windows\System\AYaPHsd.exe
  C:\Windows\System\AYaPHsd.exe
  2⤵
  PID:1376
- C:\Windows\System\XKTZZIa.exe
  C:\Windows\System\XKTZZIa.exe
  2⤵
  PID:1196
- C:\Windows\System\OqamhHO.exe
  C:\Windows\System\OqamhHO.exe
  2⤵
  PID:4804
- C:\Windows\System\bHqfHor.exe
  C:\Windows\System\bHqfHor.exe
  2⤵
  PID:5144
- C:\Windows\System\CwyLpou.exe
  C:\Windows\System\CwyLpou.exe
  2⤵
  PID:5212
- C:\Windows\System\XmoLxfR.exe
  C:\Windows\System\XmoLxfR.exe
  2⤵
  PID:5356
- C:\Windows\System\wStzNca.exe
  C:\Windows\System\wStzNca.exe
  2⤵
  PID:3808
- C:\Windows\System\JGtSwku.exe
  C:\Windows\System\JGtSwku.exe
  2⤵
  PID:2004
- C:\Windows\System\FoXGJeP.exe
  C:\Windows\System\FoXGJeP.exe
  2⤵
  PID:4908
- C:\Windows\System\fInLozP.exe
  C:\Windows\System\fInLozP.exe
  2⤵
  PID:5160
- C:\Windows\System\XYzlAwS.exe
  C:\Windows\System\XYzlAwS.exe
  2⤵
  PID:2232
- C:\Windows\System\OZLkirl.exe
  C:\Windows\System\OZLkirl.exe
  2⤵
  PID:3972
- C:\Windows\System\OLGuciL.exe
  C:\Windows\System\OLGuciL.exe
  2⤵
  PID:4920
- C:\Windows\System\dDExiQs.exe
  C:\Windows\System\dDExiQs.exe
  2⤵
  PID:4968
- C:\Windows\System\BuKrgHC.exe
  C:\Windows\System\BuKrgHC.exe
  2⤵
  PID:5308
- C:\Windows\System\ADxmlEG.exe
  C:\Windows\System\ADxmlEG.exe
  2⤵
  PID:5740
- C:\Windows\System\xfnHowU.exe
  C:\Windows\System\xfnHowU.exe
  2⤵
  PID:6168
- C:\Windows\System\zxSQaWo.exe
  C:\Windows\System\zxSQaWo.exe
  2⤵
  PID:6200
- C:\Windows\System\iztiPeB.exe
  C:\Windows\System\iztiPeB.exe
  2⤵
  PID:6228
- C:\Windows\System\fVDYQXk.exe
  C:\Windows\System\fVDYQXk.exe
  2⤵
  PID:6256
- C:\Windows\System\qAqTlep.exe
  C:\Windows\System\qAqTlep.exe
  2⤵
  PID:6288
- C:\Windows\System\OHnwNcc.exe
  C:\Windows\System\OHnwNcc.exe
  2⤵
  PID:6320
- C:\Windows\System\UgzwrzN.exe
  C:\Windows\System\UgzwrzN.exe
  2⤵
  PID:6340
- C:\Windows\System\oTuhYRF.exe
  C:\Windows\System\oTuhYRF.exe
  2⤵
  PID:6364
- C:\Windows\System\JzmqyZz.exe
  C:\Windows\System\JzmqyZz.exe
  2⤵
  PID:6396
- C:\Windows\System\qImszQf.exe
  C:\Windows\System\qImszQf.exe
  2⤵
  PID:6424
- C:\Windows\System\ifMhPHk.exe
  C:\Windows\System\ifMhPHk.exe
  2⤵
  PID:6452
- C:\Windows\System\dggMfBd.exe
  C:\Windows\System\dggMfBd.exe
  2⤵
  PID:6480
- C:\Windows\System\cBYEZCr.exe
  C:\Windows\System\cBYEZCr.exe
  2⤵
  PID:6508
- C:\Windows\System\epEnduH.exe
  C:\Windows\System\epEnduH.exe
  2⤵
  PID:6620
- C:\Windows\System\NQsGJkO.exe
  C:\Windows\System\NQsGJkO.exe
  2⤵
  PID:6648
- C:\Windows\System\QntYkNs.exe
  C:\Windows\System\QntYkNs.exe
  2⤵
  PID:6676
- C:\Windows\System\tAeUJvt.exe
  C:\Windows\System\tAeUJvt.exe
  2⤵
  PID:6704
- C:\Windows\System\TeEeeja.exe
  C:\Windows\System\TeEeeja.exe
  2⤵
  PID:6732
- C:\Windows\System\ihImnxh.exe
  C:\Windows\System\ihImnxh.exe
  2⤵
  PID:6760
- C:\Windows\System\dksKEkx.exe
  C:\Windows\System\dksKEkx.exe
  2⤵
  PID:6784
- C:\Windows\System\juJSxmW.exe
  C:\Windows\System\juJSxmW.exe
  2⤵
  PID:6816
- C:\Windows\System\FuKERFX.exe
  C:\Windows\System\FuKERFX.exe
  2⤵
  PID:6844
- C:\Windows\System\gXnkysb.exe
  C:\Windows\System\gXnkysb.exe
  2⤵
  PID:6908
- C:\Windows\System\LVVdTLu.exe
  C:\Windows\System\LVVdTLu.exe
  2⤵
  PID:6928
- C:\Windows\System\oSAIoIj.exe
  C:\Windows\System\oSAIoIj.exe
  2⤵
  PID:6956
- C:\Windows\System\zZXeBSl.exe
  C:\Windows\System\zZXeBSl.exe
  2⤵
  PID:6976
- C:\Windows\System\evHdJpZ.exe
  C:\Windows\System\evHdJpZ.exe
  2⤵
  PID:7004
- C:\Windows\System\iVVXqHa.exe
  C:\Windows\System\iVVXqHa.exe
  2⤵
  PID:7036
- C:\Windows\System\ZdsPBzs.exe
  C:\Windows\System\ZdsPBzs.exe
  2⤵
  PID:7060
- C:\Windows\System\hleneUC.exe
  C:\Windows\System\hleneUC.exe
  2⤵
  PID:7080
- C:\Windows\System\KRrzIVE.exe
  C:\Windows\System\KRrzIVE.exe
  2⤵
  PID:7104
- C:\Windows\System\KuJowcn.exe
  C:\Windows\System\KuJowcn.exe
  2⤵
  PID:7156
- C:\Windows\System\eftVFIA.exe
  C:\Windows\System\eftVFIA.exe
  2⤵
  PID:548
- C:\Windows\System\LpdiARq.exe
  C:\Windows\System\LpdiARq.exe
  2⤵
  PID:4504
- C:\Windows\System\QJqKnQv.exe
  C:\Windows\System\QJqKnQv.exe
  2⤵
  PID:5412
- C:\Windows\System\QgUTYXL.exe
  C:\Windows\System\QgUTYXL.exe
  2⤵
  PID:3552
- C:\Windows\System\ILzaiLs.exe
  C:\Windows\System\ILzaiLs.exe
  2⤵
  PID:5536
- C:\Windows\System\VJrjIwH.exe
  C:\Windows\System\VJrjIwH.exe
  2⤵
  PID:6192
- C:\Windows\System\gFxYEmI.exe
  C:\Windows\System\gFxYEmI.exe
  2⤵
  PID:6240
- C:\Windows\System\IARvybA.exe
  C:\Windows\System\IARvybA.exe
  2⤵
  PID:464
- C:\Windows\System\tIhsEeE.exe
  C:\Windows\System\tIhsEeE.exe
  2⤵
  PID:6280
- C:\Windows\System\DgZpeNr.exe
  C:\Windows\System\DgZpeNr.exe
  2⤵
  PID:1484
- C:\Windows\System\iLTTzgK.exe
  C:\Windows\System\iLTTzgK.exe
  2⤵
  PID:828
- C:\Windows\System\axgkSck.exe
  C:\Windows\System\axgkSck.exe
  2⤵
  PID:1148
- C:\Windows\System\SGbanlR.exe
  C:\Windows\System\SGbanlR.exe
  2⤵
  PID:6416
- C:\Windows\System\uiHgzJO.exe
  C:\Windows\System\uiHgzJO.exe
  2⤵
  PID:5196
- C:\Windows\System\DKVAbdI.exe
  C:\Windows\System\DKVAbdI.exe
  2⤵
  PID:6552
- C:\Windows\System\uAGqAQP.exe
  C:\Windows\System\uAGqAQP.exe
  2⤵
  PID:2944
- C:\Windows\System\waGIduC.exe
  C:\Windows\System\waGIduC.exe
  2⤵
  PID:6636
- C:\Windows\System\NWySSib.exe
  C:\Windows\System\NWySSib.exe
  2⤵
  PID:6688
- C:\Windows\System\IoNNldB.exe
  C:\Windows\System\IoNNldB.exe
  2⤵
  PID:6752
- C:\Windows\System\QmOIrbt.exe
  C:\Windows\System\QmOIrbt.exe
  2⤵
  PID:6804
- C:\Windows\System\TYWxVuh.exe
  C:\Windows\System\TYWxVuh.exe
  2⤵
  PID:4788
- C:\Windows\System\HjNWNLp.exe
  C:\Windows\System\HjNWNLp.exe
  2⤵
  PID:4776
- C:\Windows\System\WFjZqmg.exe
  C:\Windows\System\WFjZqmg.exe
  2⤵
  PID:2592
- C:\Windows\System\VgzzDCj.exe
  C:\Windows\System\VgzzDCj.exe
  2⤵
  PID:6916
- C:\Windows\System\mEyyNxK.exe
  C:\Windows\System\mEyyNxK.exe
  2⤵
  PID:6996
- C:\Windows\System\RsWoXWs.exe
  C:\Windows\System\RsWoXWs.exe
  2⤵
  PID:7032
- C:\Windows\System\OGujGCA.exe
  C:\Windows\System\OGujGCA.exe
  2⤵
  PID:7092
- C:\Windows\System\djKIFTK.exe
  C:\Windows\System\djKIFTK.exe
  2⤵
  PID:7140
- C:\Windows\System\PRRiByB.exe
  C:\Windows\System\PRRiByB.exe
  2⤵
  PID:3300
- C:\Windows\System\eBfvPKK.exe
  C:\Windows\System\eBfvPKK.exe
  2⤵
  PID:6248
- C:\Windows\System\osACvUS.exe
  C:\Windows\System\osACvUS.exe
  2⤵
  PID:4896
- C:\Windows\System\rgmVoFh.exe
  C:\Windows\System\rgmVoFh.exe
  2⤵
  PID:6220
- C:\Windows\System\dlgDIhL.exe
  C:\Windows\System\dlgDIhL.exe
  2⤵
  PID:6412
- C:\Windows\System\TqLswxH.exe
  C:\Windows\System\TqLswxH.exe
  2⤵
  PID:3752
- C:\Windows\System\KpdPPkp.exe
  C:\Windows\System\KpdPPkp.exe
  2⤵
  PID:6472
- C:\Windows\System\EgvfmJc.exe
  C:\Windows\System\EgvfmJc.exe
  2⤵
  PID:6616
- C:\Windows\System\KphrLOq.exe
  C:\Windows\System\KphrLOq.exe
  2⤵
  PID:6772
- C:\Windows\System\gezYAal.exe
  C:\Windows\System\gezYAal.exe
  2⤵
  PID:6604
- C:\Windows\System\bMGhfNF.exe
  C:\Windows\System\bMGhfNF.exe
  2⤵
  PID:6864
- C:\Windows\System\hAqYWvW.exe
  C:\Windows\System\hAqYWvW.exe
  2⤵
  PID:6160
- C:\Windows\System\eYOPiiB.exe
  C:\Windows\System\eYOPiiB.exe
  2⤵
  PID:920
- C:\Windows\System\AuIxblO.exe
  C:\Windows\System\AuIxblO.exe
  2⤵
  PID:6496
- C:\Windows\System\eYHxEMG.exe
  C:\Windows\System\eYHxEMG.exe
  2⤵
  PID:5780
- C:\Windows\System\xYmRiFG.exe
  C:\Windows\System\xYmRiFG.exe
  2⤵
  PID:7020
- C:\Windows\System\FioWdAA.exe
  C:\Windows\System\FioWdAA.exe
  2⤵
  PID:1128
- C:\Windows\System\OSbbvgX.exe
  C:\Windows\System\OSbbvgX.exe
  2⤵
  PID:6580
- C:\Windows\System\LJdzWxr.exe
  C:\Windows\System\LJdzWxr.exe
  2⤵
  PID:7188
- C:\Windows\System\TWCtitf.exe
  C:\Windows\System\TWCtitf.exe
  2⤵
  PID:7220
- C:\Windows\System\PEJJOzy.exe
  C:\Windows\System\PEJJOzy.exe
  2⤵
  PID:7240
- C:\Windows\System\MxmUTJY.exe
  C:\Windows\System\MxmUTJY.exe
  2⤵
  PID:7260
- C:\Windows\System\SPgEtNj.exe
  C:\Windows\System\SPgEtNj.exe
  2⤵
  PID:7304
- C:\Windows\System\PQURabJ.exe
  C:\Windows\System\PQURabJ.exe
  2⤵
  PID:7328
- C:\Windows\System\NDCADSQ.exe
  C:\Windows\System\NDCADSQ.exe
  2⤵
  PID:7344
- C:\Windows\System\rcNbQXz.exe
  C:\Windows\System\rcNbQXz.exe
  2⤵
  PID:7360
- C:\Windows\System\VgBmqxE.exe
  C:\Windows\System\VgBmqxE.exe
  2⤵
  PID:7396
- C:\Windows\System\MPAkQzl.exe
  C:\Windows\System\MPAkQzl.exe
  2⤵
  PID:7452
- C:\Windows\System\onkHlMM.exe
  C:\Windows\System\onkHlMM.exe
  2⤵
  PID:7468
- C:\Windows\System\dyTViaY.exe
  C:\Windows\System\dyTViaY.exe
  2⤵
  PID:7488
- C:\Windows\System\nYywDvo.exe
  C:\Windows\System\nYywDvo.exe
  2⤵
  PID:7512
- C:\Windows\System\uQXHEjj.exe
  C:\Windows\System\uQXHEjj.exe
  2⤵
  PID:7552
- C:\Windows\System\MarFeOr.exe
  C:\Windows\System\MarFeOr.exe
  2⤵
  PID:7576
- C:\Windows\System\mbXogjS.exe
  C:\Windows\System\mbXogjS.exe
  2⤵
  PID:7600
- C:\Windows\System\JrtoMsl.exe
  C:\Windows\System\JrtoMsl.exe
  2⤵
  PID:7620
- C:\Windows\System\kpxEvKr.exe
  C:\Windows\System\kpxEvKr.exe
  2⤵
  PID:7664
- C:\Windows\System\UElOEAz.exe
  C:\Windows\System\UElOEAz.exe
  2⤵
  PID:7684
- C:\Windows\System\mUyneIN.exe
  C:\Windows\System\mUyneIN.exe
  2⤵
  PID:7712
- C:\Windows\System\NPoSifp.exe
  C:\Windows\System\NPoSifp.exe
  2⤵
  PID:7744
- C:\Windows\System\NKwVEqt.exe
  C:\Windows\System\NKwVEqt.exe
  2⤵
  PID:7768
- C:\Windows\System\lCYNbwL.exe
  C:\Windows\System\lCYNbwL.exe
  2⤵
  PID:7796
- C:\Windows\System\dJpLzVo.exe
  C:\Windows\System\dJpLzVo.exe
  2⤵
  PID:7820
- C:\Windows\System\wWDBTYc.exe
  C:\Windows\System\wWDBTYc.exe
  2⤵
  PID:7836
- C:\Windows\System\KWPOWDg.exe
  C:\Windows\System\KWPOWDg.exe
  2⤵
  PID:7856
- C:\Windows\System\CNSyMgc.exe
  C:\Windows\System\CNSyMgc.exe
  2⤵
  PID:7880
- C:\Windows\System\pSxGEXw.exe
  C:\Windows\System\pSxGEXw.exe
  2⤵
  PID:7900
- C:\Windows\System\NuusnRo.exe
  C:\Windows\System\NuusnRo.exe
  2⤵
  PID:7924
- C:\Windows\System\VjMqRiF.exe
  C:\Windows\System\VjMqRiF.exe
  2⤵
  PID:7948
- C:\Windows\System\ZZbcLvj.exe
  C:\Windows\System\ZZbcLvj.exe
  2⤵
  PID:8000
- C:\Windows\System\KXHmbXn.exe
  C:\Windows\System\KXHmbXn.exe
  2⤵
  PID:8044
- C:\Windows\System\NXiwZbz.exe
  C:\Windows\System\NXiwZbz.exe
  2⤵
  PID:8084
- C:\Windows\System\cSjUiIZ.exe
  C:\Windows\System\cSjUiIZ.exe
  2⤵
  PID:8104
- C:\Windows\System\cNkllEC.exe
  C:\Windows\System\cNkllEC.exe
  2⤵
  PID:8136
- C:\Windows\System\Jgsiwft.exe
  C:\Windows\System\Jgsiwft.exe
  2⤵
  PID:8156
- C:\Windows\System\dzDKCut.exe
  C:\Windows\System\dzDKCut.exe
  2⤵
  PID:8176
- C:\Windows\System\eKTFCgX.exe
  C:\Windows\System\eKTFCgX.exe
  2⤵
  PID:6748
- C:\Windows\System\WylnmHd.exe
  C:\Windows\System\WylnmHd.exe
  2⤵
  PID:7204
- C:\Windows\System\sbflmxE.exe
  C:\Windows\System\sbflmxE.exe
  2⤵
  PID:7284
- C:\Windows\System\hILsOyN.exe
  C:\Windows\System\hILsOyN.exe
  2⤵
  PID:7376
- C:\Windows\System\zbMSdol.exe
  C:\Windows\System\zbMSdol.exe
  2⤵
  PID:7480
- C:\Windows\System\boHbbmE.exe
  C:\Windows\System\boHbbmE.exe
  2⤵
  PID:7012
- C:\Windows\System\hWEvVMW.exe
  C:\Windows\System\hWEvVMW.exe
  2⤵
  PID:7568
- C:\Windows\System\jxXMbIM.exe
  C:\Windows\System\jxXMbIM.exe
  2⤵
  PID:7612
- C:\Windows\System\fsHlxua.exe
  C:\Windows\System\fsHlxua.exe
  2⤵
  PID:7676
- C:\Windows\System\FgAwSxH.exe
  C:\Windows\System\FgAwSxH.exe
  2⤵
  PID:7776
- C:\Windows\System\DscuGiT.exe
  C:\Windows\System\DscuGiT.exe
  2⤵
  PID:7848
- C:\Windows\System\qyaOAsE.exe
  C:\Windows\System\qyaOAsE.exe
  2⤵
  PID:7980
- C:\Windows\System\IOayGmJ.exe
  C:\Windows\System\IOayGmJ.exe
  2⤵
  PID:7896
- C:\Windows\System\pzWovUW.exe
  C:\Windows\System\pzWovUW.exe
  2⤵
  PID:7992
- C:\Windows\System\VsUbiYK.exe
  C:\Windows\System\VsUbiYK.exe
  2⤵
  PID:8040
- C:\Windows\System\RcsLzRx.exe
  C:\Windows\System\RcsLzRx.exe
  2⤵
  PID:8168
- C:\Windows\System\NmfDaRP.exe
  C:\Windows\System\NmfDaRP.exe
  2⤵
  PID:7184
- C:\Windows\System\sBgFpZA.exe
  C:\Windows\System\sBgFpZA.exe
  2⤵
  PID:7316
- C:\Windows\System\aULoOSM.exe
  C:\Windows\System\aULoOSM.exe
  2⤵
  PID:7652
- C:\Windows\System\hCysJeZ.exe
  C:\Windows\System\hCysJeZ.exe
  2⤵
  PID:7724
- C:\Windows\System\MbQRdVM.exe
  C:\Windows\System\MbQRdVM.exe
  2⤵
  PID:7832
- C:\Windows\System\cxMEnwb.exe
  C:\Windows\System\cxMEnwb.exe
  2⤵
  PID:8008
- C:\Windows\System\DdyEkwq.exe
  C:\Windows\System\DdyEkwq.exe
  2⤵
  PID:8064
- C:\Windows\System\rBOctIA.exe
  C:\Windows\System\rBOctIA.exe
  2⤵
  PID:7252
- C:\Windows\System\ifcPPGj.exe
  C:\Windows\System\ifcPPGj.exe
  2⤵
  PID:7544
- C:\Windows\System\MTrehOK.exe
  C:\Windows\System\MTrehOK.exe
  2⤵
  PID:6660
- C:\Windows\System\CcnEUSW.exe
  C:\Windows\System\CcnEUSW.exe
  2⤵
  PID:8144
- C:\Windows\System\FOWRcYo.exe
  C:\Windows\System\FOWRcYo.exe
  2⤵
  PID:7484
- C:\Windows\System\JjfwQhi.exe
  C:\Windows\System\JjfwQhi.exe
  2⤵
  PID:8228
- C:\Windows\System\JgqbJxZ.exe
  C:\Windows\System\JgqbJxZ.exe
  2⤵
  PID:8252
- C:\Windows\System\TacZMKL.exe
  C:\Windows\System\TacZMKL.exe
  2⤵
  PID:8276
- C:\Windows\System\sAEJUYN.exe
  C:\Windows\System\sAEJUYN.exe
  2⤵
  PID:8316
- C:\Windows\System\OvWFOtM.exe
  C:\Windows\System\OvWFOtM.exe
  2⤵
  PID:8360
- C:\Windows\System\BBjBBdv.exe
  C:\Windows\System\BBjBBdv.exe
  2⤵
  PID:8380
- C:\Windows\System\RvinYQh.exe
  C:\Windows\System\RvinYQh.exe
  2⤵
  PID:8424
- C:\Windows\System\tRrmtoV.exe
  C:\Windows\System\tRrmtoV.exe
  2⤵
  PID:8444
- C:\Windows\System\fcvvAze.exe
  C:\Windows\System\fcvvAze.exe
  2⤵
  PID:8488
- C:\Windows\System\BupGshE.exe
  C:\Windows\System\BupGshE.exe
  2⤵
  PID:8512
- C:\Windows\System\yhrceSo.exe
  C:\Windows\System\yhrceSo.exe
  2⤵
  PID:8532
- C:\Windows\System\AeffsVk.exe
  C:\Windows\System\AeffsVk.exe
  2⤵
  PID:8560
- C:\Windows\System\vfmFkYi.exe
  C:\Windows\System\vfmFkYi.exe
  2⤵
  PID:8584
- C:\Windows\System\Sspsvhu.exe
  C:\Windows\System\Sspsvhu.exe
  2⤵
  PID:8608
- C:\Windows\System\DhsFZjZ.exe
  C:\Windows\System\DhsFZjZ.exe
  2⤵
  PID:8628
- C:\Windows\System\oFbTKEy.exe
  C:\Windows\System\oFbTKEy.exe
  2⤵
  PID:8648
- C:\Windows\System\QXpXuPw.exe
  C:\Windows\System\QXpXuPw.exe
  2⤵
  PID:8668
- C:\Windows\System\vsdXVSJ.exe
  C:\Windows\System\vsdXVSJ.exe
  2⤵
  PID:8688
- C:\Windows\System\INOUwKa.exe
  C:\Windows\System\INOUwKa.exe
  2⤵
  PID:8720
- C:\Windows\System\JftWgqI.exe
  C:\Windows\System\JftWgqI.exe
  2⤵
  PID:8772
- C:\Windows\System\GghvpLi.exe
  C:\Windows\System\GghvpLi.exe
  2⤵
  PID:8824
- C:\Windows\System\oWVqrZo.exe
  C:\Windows\System\oWVqrZo.exe
  2⤵
  PID:8844
- C:\Windows\System\SSUIzvL.exe
  C:\Windows\System\SSUIzvL.exe
  2⤵
  PID:8864
- C:\Windows\System\tapUEHo.exe
  C:\Windows\System\tapUEHo.exe
  2⤵
  PID:8884
- C:\Windows\System\zaLLbCY.exe
  C:\Windows\System\zaLLbCY.exe
  2⤵
  PID:8912
- C:\Windows\System\wqRybXI.exe
  C:\Windows\System\wqRybXI.exe
  2⤵
  PID:8936
- C:\Windows\System\qagtztz.exe
  C:\Windows\System\qagtztz.exe
  2⤵
  PID:8956
- C:\Windows\System\hzZQsJH.exe
  C:\Windows\System\hzZQsJH.exe
  2⤵
  PID:8980
- C:\Windows\System\IHVAOap.exe
  C:\Windows\System\IHVAOap.exe
  2⤵
  PID:9012
- C:\Windows\System\HJyOwhN.exe
  C:\Windows\System\HJyOwhN.exe
  2⤵
  PID:9056
- C:\Windows\System\CQMBBiY.exe
  C:\Windows\System\CQMBBiY.exe
  2⤵
  PID:9080
- C:\Windows\System\fAssoft.exe
  C:\Windows\System\fAssoft.exe
  2⤵
  PID:9096
- C:\Windows\System\xCbZIcy.exe
  C:\Windows\System\xCbZIcy.exe
  2⤵
  PID:9136
- C:\Windows\System\NLnnXFi.exe
  C:\Windows\System\NLnnXFi.exe
  2⤵
  PID:9184
- C:\Windows\System\fLdYlNR.exe
  C:\Windows\System\fLdYlNR.exe
  2⤵
  PID:9200
- C:\Windows\System\hhTKOPD.exe
  C:\Windows\System\hhTKOPD.exe
  2⤵
  PID:7864
- C:\Windows\System\lpCMDWw.exe
  C:\Windows\System\lpCMDWw.exe
  2⤵
  PID:8236
- C:\Windows\System\nFPzSsu.exe
  C:\Windows\System\nFPzSsu.exe
  2⤵
  PID:8296
- C:\Windows\System\kPGZFUu.exe
  C:\Windows\System\kPGZFUu.exe
  2⤵
  PID:8352
- C:\Windows\System\zjswbQx.exe
  C:\Windows\System\zjswbQx.exe
  2⤵
  PID:8400
- C:\Windows\System\bkUrAyc.exe
  C:\Windows\System\bkUrAyc.exe
  2⤵
  PID:8440
- C:\Windows\System\QsscDtC.exe
  C:\Windows\System\QsscDtC.exe
  2⤵
  PID:8484
- C:\Windows\System\TFdIMJE.exe
  C:\Windows\System\TFdIMJE.exe
  2⤵
  PID:8528
- C:\Windows\System\qmYIVdA.exe
  C:\Windows\System\qmYIVdA.exe
  2⤵
  PID:8624
- C:\Windows\System\OpgWpik.exe
  C:\Windows\System\OpgWpik.exe
  2⤵
  PID:8640
- C:\Windows\System\WxCxbQk.exe
  C:\Windows\System\WxCxbQk.exe
  2⤵
  PID:8800
- C:\Windows\System\hBSZQHn.exe
  C:\Windows\System\hBSZQHn.exe
  2⤵
  PID:8860
- C:\Windows\System\hQBGDNC.exe
  C:\Windows\System\hQBGDNC.exe
  2⤵
  PID:8972
- C:\Windows\System\nmJGxDT.exe
  C:\Windows\System\nmJGxDT.exe
  2⤵
  PID:9008
- C:\Windows\System\dhNRfBk.exe
  C:\Windows\System\dhNRfBk.exe
  2⤵
  PID:9040
- C:\Windows\System\CsAdhmn.exe
  C:\Windows\System\CsAdhmn.exe
  2⤵
  PID:9192
- C:\Windows\System\NUTuISf.exe
  C:\Windows\System\NUTuISf.exe
  2⤵
  PID:8224
- C:\Windows\System\KEpTRzW.exe
  C:\Windows\System\KEpTRzW.exe
  2⤵
  PID:8372
- C:\Windows\System\hdCdwAI.exe
  C:\Windows\System\hdCdwAI.exe
  2⤵
  PID:8660
- C:\Windows\System\RaIuSAL.exe
  C:\Windows\System\RaIuSAL.exe
  2⤵
  PID:8524
- C:\Windows\System\cxcmBUs.exe
  C:\Windows\System\cxcmBUs.exe
  2⤵
  PID:8744
- C:\Windows\System\OMWCQDk.exe
  C:\Windows\System\OMWCQDk.exe
  2⤵
  PID:9064
- C:\Windows\System\ypPFzIc.exe
  C:\Windows\System\ypPFzIc.exe
  2⤵
  PID:9196
- C:\Windows\System\lqbXBUf.exe
  C:\Windows\System\lqbXBUf.exe
  2⤵
  PID:8272
- C:\Windows\System\jhDVxIg.exe
  C:\Windows\System\jhDVxIg.exe
  2⤵
  PID:8480
- C:\Windows\System\jBUencP.exe
  C:\Windows\System\jBUencP.exe
  2⤵
  PID:8568
- C:\Windows\System\ZzyZyIh.exe
  C:\Windows\System\ZzyZyIh.exe
  2⤵
  PID:9172
- C:\Windows\System\qgBObbg.exe
  C:\Windows\System\qgBObbg.exe
  2⤵
  PID:9248
- C:\Windows\System\fTdkpwj.exe
  C:\Windows\System\fTdkpwj.exe
  2⤵
  PID:9276
- C:\Windows\System\RGbKaFH.exe
  C:\Windows\System\RGbKaFH.exe
  2⤵
  PID:9292
- C:\Windows\System\vQTKyAk.exe
  C:\Windows\System\vQTKyAk.exe
  2⤵
  PID:9312
- C:\Windows\System\YUthWfn.exe
  C:\Windows\System\YUthWfn.exe
  2⤵
  PID:9356
- C:\Windows\System\kaSwuvV.exe
  C:\Windows\System\kaSwuvV.exe
  2⤵
  PID:9376
- C:\Windows\System\wSZlMcC.exe
  C:\Windows\System\wSZlMcC.exe
  2⤵
  PID:9404
- C:\Windows\System\nZWAoQe.exe
  C:\Windows\System\nZWAoQe.exe
  2⤵
  PID:9428
- C:\Windows\System\sVQPiGH.exe
  C:\Windows\System\sVQPiGH.exe
  2⤵
  PID:9452
- C:\Windows\System\eujCZEI.exe
  C:\Windows\System\eujCZEI.exe
  2⤵
  PID:9472
- C:\Windows\System\ZaowpSH.exe
  C:\Windows\System\ZaowpSH.exe
  2⤵
  PID:9516
- C:\Windows\System\WukaNoK.exe
  C:\Windows\System\WukaNoK.exe
  2⤵
  PID:9544
- C:\Windows\System\GpKpPpu.exe
  C:\Windows\System\GpKpPpu.exe
  2⤵
  PID:9572
- C:\Windows\System\SCfcWSh.exe
  C:\Windows\System\SCfcWSh.exe
  2⤵
  PID:9600
- C:\Windows\System\MZOuyvB.exe
  C:\Windows\System\MZOuyvB.exe
  2⤵
  PID:9616
- C:\Windows\System\VETPlYn.exe
  C:\Windows\System\VETPlYn.exe
  2⤵
  PID:9668
- C:\Windows\System\cbXyHZm.exe
  C:\Windows\System\cbXyHZm.exe
  2⤵
  PID:9752
- C:\Windows\System\PvrxuqJ.exe
  C:\Windows\System\PvrxuqJ.exe
  2⤵
  PID:9768
- C:\Windows\System\PVQIdXW.exe
  C:\Windows\System\PVQIdXW.exe
  2⤵
  PID:9784
- C:\Windows\System\BzvsxOX.exe
  C:\Windows\System\BzvsxOX.exe
  2⤵
  PID:9800
- C:\Windows\System\XsaXrYb.exe
  C:\Windows\System\XsaXrYb.exe
  2⤵
  PID:9816
- C:\Windows\System\qsqQvhc.exe
  C:\Windows\System\qsqQvhc.exe
  2⤵
  PID:9832
- C:\Windows\System\EWftRtf.exe
  C:\Windows\System\EWftRtf.exe
  2⤵
  PID:9884
- C:\Windows\System\OHASceq.exe
  C:\Windows\System\OHASceq.exe
  2⤵
  PID:9920
- C:\Windows\System\mmMJjoV.exe
  C:\Windows\System\mmMJjoV.exe
  2⤵
  PID:9960
- C:\Windows\System\OSxPIoy.exe
  C:\Windows\System\OSxPIoy.exe
  2⤵
  PID:9976
- C:\Windows\System\mwmmHSe.exe
  C:\Windows\System\mwmmHSe.exe
  2⤵
  PID:10036
- C:\Windows\System\SOUifDK.exe
  C:\Windows\System\SOUifDK.exe
  2⤵
  PID:10068
- C:\Windows\System\oYHyFej.exe
  C:\Windows\System\oYHyFej.exe
  2⤵
  PID:10088
- C:\Windows\System\sxmHFJg.exe
  C:\Windows\System\sxmHFJg.exe
  2⤵
  PID:10108
- C:\Windows\System\nMHfQwY.exe
  C:\Windows\System\nMHfQwY.exe
  2⤵
  PID:10156
- C:\Windows\System\wXAugnt.exe
  C:\Windows\System\wXAugnt.exe
  2⤵
  PID:10200
- C:\Windows\System\vwuZVsj.exe
  C:\Windows\System\vwuZVsj.exe
  2⤵
  PID:10224
- C:\Windows\System\FcQNuwC.exe
  C:\Windows\System\FcQNuwC.exe
  2⤵
  PID:9236
- C:\Windows\System\QHzoObj.exe
  C:\Windows\System\QHzoObj.exe
  2⤵
  PID:9304
- C:\Windows\System\dMDeXbU.exe
  C:\Windows\System\dMDeXbU.exe
  2⤵
  PID:9400
- C:\Windows\System\zEycjih.exe
  C:\Windows\System\zEycjih.exe
  2⤵
  PID:9496
- C:\Windows\System\mDPxrot.exe
  C:\Windows\System\mDPxrot.exe
  2⤵
  PID:9536
- C:\Windows\System\XHVSnGg.exe
  C:\Windows\System\XHVSnGg.exe
  2⤵
  PID:9612
- C:\Windows\System\SWQBjds.exe
  C:\Windows\System\SWQBjds.exe
  2⤵
  PID:9648
- C:\Windows\System\tfCOrVP.exe
  C:\Windows\System\tfCOrVP.exe
  2⤵
  PID:9728
- C:\Windows\System\WBKMzTU.exe
  C:\Windows\System\WBKMzTU.exe
  2⤵
  PID:9776
- C:\Windows\System\lDLXbbI.exe
  C:\Windows\System\lDLXbbI.exe
  2⤵
  PID:9872
- C:\Windows\System\hLrSpBe.exe
  C:\Windows\System\hLrSpBe.exe
  2⤵
  PID:9928
- C:\Windows\System\XGasHKM.exe
  C:\Windows\System\XGasHKM.exe
  2⤵
  PID:9688
- C:\Windows\System\bVgyHyi.exe
  C:\Windows\System\bVgyHyi.exe
  2⤵
  PID:9700
- C:\Windows\System\xRfgSIH.exe
  C:\Windows\System\xRfgSIH.exe
  2⤵
  PID:9780
- C:\Windows\System\YMDVQGx.exe
  C:\Windows\System\YMDVQGx.exe
  2⤵
  PID:10048
- C:\Windows\System\qPKJvaf.exe
  C:\Windows\System\qPKJvaf.exe
  2⤵
  PID:10012
- C:\Windows\System\kBmDAfL.exe
  C:\Windows\System\kBmDAfL.exe
  2⤵
  PID:9968
- C:\Windows\System\AUUJYzR.exe
  C:\Windows\System\AUUJYzR.exe
  2⤵
  PID:10096
- C:\Windows\System\yvpTKEh.exe
  C:\Windows\System\yvpTKEh.exe
  2⤵
  PID:8832
- C:\Windows\System\tNTtPIB.exe
  C:\Windows\System\tNTtPIB.exe
  2⤵
  PID:9300
- C:\Windows\System\EfBjwzd.exe
  C:\Windows\System\EfBjwzd.exe
  2⤵
  PID:9564
- C:\Windows\System\HeQQuiA.exe
  C:\Windows\System\HeQQuiA.exe
  2⤵
  PID:9720
- C:\Windows\System\AMDpafk.exe
  C:\Windows\System\AMDpafk.exe
  2⤵
  PID:9900
- C:\Windows\System\XITXIHp.exe
  C:\Windows\System\XITXIHp.exe
  2⤵
  PID:9812
- C:\Windows\System\XriODLm.exe
  C:\Windows\System\XriODLm.exe
  2⤵
  PID:10028
- C:\Windows\System\iarZWYM.exe
  C:\Windows\System\iarZWYM.exe
  2⤵
  PID:10004
- C:\Windows\System\gBDTUBx.exe
  C:\Windows\System\gBDTUBx.exe
  2⤵
  PID:10216
- C:\Windows\System\gYcMFfh.exe
  C:\Windows\System\gYcMFfh.exe
  2⤵
  PID:10080
- C:\Windows\System\lewRCsR.exe
  C:\Windows\System\lewRCsR.exe
  2⤵
  PID:9336
- C:\Windows\System\AowtNAh.exe
  C:\Windows\System\AowtNAh.exe
  2⤵
  PID:9896
- C:\Windows\System\gXYaiBK.exe
  C:\Windows\System\gXYaiBK.exe
  2⤵
  PID:9904
- C:\Windows\System\DJPAINF.exe
  C:\Windows\System\DJPAINF.exe
  2⤵
  PID:1428
- C:\Windows\System\JTFfIyW.exe
  C:\Windows\System\JTFfIyW.exe
  2⤵
  PID:10064
- C:\Windows\System\CmGaUAd.exe
  C:\Windows\System\CmGaUAd.exe
  2⤵
  PID:3360
- C:\Windows\System\mzClxRC.exe
  C:\Windows\System\mzClxRC.exe
  2⤵
  PID:10272
- C:\Windows\System\vgBjbUE.exe
  C:\Windows\System\vgBjbUE.exe
  2⤵
  PID:10332
- C:\Windows\System\ylPaVOO.exe
  C:\Windows\System\ylPaVOO.exe
  2⤵
  PID:10368
- C:\Windows\System\GJBzcds.exe
  C:\Windows\System\GJBzcds.exe
  2⤵
  PID:10388
- C:\Windows\System\zTNePDP.exe
  C:\Windows\System\zTNePDP.exe
  2⤵
  PID:10428
- C:\Windows\System\nWKMLpo.exe
  C:\Windows\System\nWKMLpo.exe
  2⤵
  PID:10448
- C:\Windows\System\rFfKEef.exe
  C:\Windows\System\rFfKEef.exe
  2⤵
  PID:10472
- C:\Windows\System\wFRrOZW.exe
  C:\Windows\System\wFRrOZW.exe
  2⤵
  PID:10492
- C:\Windows\System\fBjicBA.exe
  C:\Windows\System\fBjicBA.exe
  2⤵
  PID:10564
- C:\Windows\System\vfQEgoQ.exe
  C:\Windows\System\vfQEgoQ.exe
  2⤵
  PID:10584
- C:\Windows\System\yojjcTH.exe
  C:\Windows\System\yojjcTH.exe
  2⤵
  PID:10612
- C:\Windows\System\VrbdvAa.exe
  C:\Windows\System\VrbdvAa.exe
  2⤵
  PID:10644
- C:\Windows\System\HtPEWqh.exe
  C:\Windows\System\HtPEWqh.exe
  2⤵
  PID:10672
- C:\Windows\System\CkXpQNz.exe
  C:\Windows\System\CkXpQNz.exe
  2⤵
  PID:10688
- C:\Windows\System\aYQxBZX.exe
  C:\Windows\System\aYQxBZX.exe
  2⤵
  PID:10716
- C:\Windows\System\nmpdkHl.exe
  C:\Windows\System\nmpdkHl.exe
  2⤵
  PID:10764
- C:\Windows\System\TDNbTTA.exe
  C:\Windows\System\TDNbTTA.exe
  2⤵
  PID:10788
- C:\Windows\System\dYUEOqZ.exe
  C:\Windows\System\dYUEOqZ.exe
  2⤵
  PID:10808
- C:\Windows\System\yrlkVIR.exe
  C:\Windows\System\yrlkVIR.exe
  2⤵
  PID:10828
- C:\Windows\System\VfzALRO.exe
  C:\Windows\System\VfzALRO.exe
  2⤵
  PID:10852
- C:\Windows\System\CbjxIPN.exe
  C:\Windows\System\CbjxIPN.exe
  2⤵
  PID:10872
- C:\Windows\System\jZpzwKL.exe
  C:\Windows\System\jZpzwKL.exe
  2⤵
  PID:10896
- C:\Windows\System\nSGzROL.exe
  C:\Windows\System\nSGzROL.exe
  2⤵
  PID:10920
- C:\Windows\System\DvglkIF.exe
  C:\Windows\System\DvglkIF.exe
  2⤵
  PID:10952
- C:\Windows\System\BCxiehU.exe
  C:\Windows\System\BCxiehU.exe
  2⤵
  PID:10968
- C:\Windows\System\xHNaIHX.exe
  C:\Windows\System\xHNaIHX.exe
  2⤵
  PID:11012
- C:\Windows\System\FxCQCBp.exe
  C:\Windows\System\FxCQCBp.exe
  2⤵
  PID:11040
- C:\Windows\System\ucTbhfH.exe
  C:\Windows\System\ucTbhfH.exe
  2⤵
  PID:11064
- C:\Windows\System\evFxAQq.exe
  C:\Windows\System\evFxAQq.exe
  2⤵
  PID:11084
- C:\Windows\System\HxxmfvG.exe
  C:\Windows\System\HxxmfvG.exe
  2⤵
  PID:11112
- C:\Windows\System\TssemXG.exe
  C:\Windows\System\TssemXG.exe
  2⤵
  PID:11140
- C:\Windows\System\JWtFAmN.exe
  C:\Windows\System\JWtFAmN.exe
  2⤵
  PID:11168
- C:\Windows\System\dZIWdfB.exe
  C:\Windows\System\dZIWdfB.exe
  2⤵
  PID:11192
- C:\Windows\System\ZLRAEeT.exe
  C:\Windows\System\ZLRAEeT.exe
  2⤵
  PID:11212
- C:\Windows\System\pQemYQZ.exe
  C:\Windows\System\pQemYQZ.exe
  2⤵
  PID:11236
- C:\Windows\System\JKOmUrH.exe
  C:\Windows\System\JKOmUrH.exe
  2⤵
  PID:10044
- C:\Windows\System\fNZvsZT.exe
  C:\Windows\System\fNZvsZT.exe
  2⤵
  PID:10280
- C:\Windows\System\VWorLfg.exe
  C:\Windows\System\VWorLfg.exe
  2⤵
  PID:10328
- C:\Windows\System\RnmBRnK.exe
  C:\Windows\System\RnmBRnK.exe
  2⤵
  PID:10408
- C:\Windows\System\BEJKigx.exe
  C:\Windows\System\BEJKigx.exe
  2⤵
  PID:10516
- C:\Windows\System\aqzFJua.exe
  C:\Windows\System\aqzFJua.exe
  2⤵
  PID:10596
- C:\Windows\System\JVpLWvl.exe
  C:\Windows\System\JVpLWvl.exe
  2⤵
  PID:10696
- C:\Windows\System\uegPRLF.exe
  C:\Windows\System\uegPRLF.exe
  2⤵
  PID:10708
- C:\Windows\System\sZSrlXs.exe
  C:\Windows\System\sZSrlXs.exe
  2⤵
  PID:10744
- C:\Windows\System\FwrPmQT.exe
  C:\Windows\System\FwrPmQT.exe
  2⤵
  PID:10820
- C:\Windows\System\HkyOBKR.exe
  C:\Windows\System\HkyOBKR.exe
  2⤵
  PID:10908
- C:\Windows\System\LCbNgrG.exe
  C:\Windows\System\LCbNgrG.exe
  2⤵
  PID:10888
- C:\Windows\System\bjNvbDV.exe
  C:\Windows\System\bjNvbDV.exe
  2⤵
  PID:10964
- C:\Windows\System\WgzOHsS.exe
  C:\Windows\System\WgzOHsS.exe
  2⤵
  PID:10152
- C:\Windows\System\tcVkKSM.exe
  C:\Windows\System\tcVkKSM.exe
  2⤵
  PID:11072
- C:\Windows\System\hGCfBfl.exe
  C:\Windows\System\hGCfBfl.exe
  2⤵
  PID:11136
- C:\Windows\System\tHgCFbh.exe
  C:\Windows\System\tHgCFbh.exe
  2⤵
  PID:11244
- C:\Windows\System\IAjvdpO.exe
  C:\Windows\System\IAjvdpO.exe
  2⤵
  PID:9692
- C:\Windows\System\mpfKhky.exe
  C:\Windows\System\mpfKhky.exe
  2⤵
  PID:10512
- C:\Windows\System\mNVScUT.exe
  C:\Windows\System\mNVScUT.exe
  2⤵
  PID:10632
- C:\Windows\System\MGvCNgm.exe
  C:\Windows\System\MGvCNgm.exe
  2⤵
  PID:10960
- C:\Windows\System\zhFmUIg.exe
  C:\Windows\System\zhFmUIg.exe
  2⤵
  PID:11104
- C:\Windows\System\GkrzeiV.exe
  C:\Windows\System\GkrzeiV.exe
  2⤵
  PID:10416
- C:\Windows\System\wJwALII.exe
  C:\Windows\System\wJwALII.exe
  2⤵
  PID:11220
- C:\Windows\System\JVSxlmj.exe
  C:\Windows\System\JVSxlmj.exe
  2⤵
  PID:10848
- C:\Windows\System\JuRCzqn.exe
  C:\Windows\System\JuRCzqn.exe
  2⤵
  PID:10796
- C:\Windows\System\PBHzYFt.exe
  C:\Windows\System\PBHzYFt.exe
  2⤵
  PID:11160
- C:\Windows\System\HfWHhOb.exe
  C:\Windows\System\HfWHhOb.exe
  2⤵
  PID:11272
- C:\Windows\System\aEERSjA.exe
  C:\Windows\System\aEERSjA.exe
  2⤵
  PID:11300
- C:\Windows\System\AGtQDMH.exe
  C:\Windows\System\AGtQDMH.exe
  2⤵
  PID:11324
- C:\Windows\System\YtXLlVq.exe
  C:\Windows\System\YtXLlVq.exe
  2⤵
  PID:11344
- C:\Windows\System\XzMaQcI.exe
  C:\Windows\System\XzMaQcI.exe
  2⤵
  PID:11380
- C:\Windows\System\ljXkCTd.exe
  C:\Windows\System\ljXkCTd.exe
  2⤵
  PID:11400
- C:\Windows\System\SzLbRRF.exe
  C:\Windows\System\SzLbRRF.exe
  2⤵
  PID:11436
- C:\Windows\System\RzSimSA.exe
  C:\Windows\System\RzSimSA.exe
  2⤵
  PID:11456
- C:\Windows\System\EBlnRuB.exe
  C:\Windows\System\EBlnRuB.exe
  2⤵
  PID:11496
- C:\Windows\System\pTFBPHa.exe
  C:\Windows\System\pTFBPHa.exe
  2⤵
  PID:11524
- C:\Windows\System\JPHvhka.exe
  C:\Windows\System\JPHvhka.exe
  2⤵
  PID:11548
- C:\Windows\System\KvBqhvE.exe
  C:\Windows\System\KvBqhvE.exe
  2⤵
  PID:11564
- C:\Windows\System\sTiByTD.exe
  C:\Windows\System\sTiByTD.exe
  2⤵
  PID:11588
- C:\Windows\System\TxJQZeb.exe
  C:\Windows\System\TxJQZeb.exe
  2⤵
  PID:11656
- C:\Windows\System\bQLbzsM.exe
  C:\Windows\System\bQLbzsM.exe
  2⤵
  PID:11672
- C:\Windows\System\DhvoXuX.exe
  C:\Windows\System\DhvoXuX.exe
  2⤵
  PID:11688
- C:\Windows\System\pcutlCh.exe
  C:\Windows\System\pcutlCh.exe
  2⤵
  PID:11704
- C:\Windows\System\hIujTnt.exe
  C:\Windows\System\hIujTnt.exe
  2⤵
  PID:11728
- C:\Windows\System\uCZyLKT.exe
  C:\Windows\System\uCZyLKT.exe
  2⤵
  PID:11756
- C:\Windows\System\NeKFoLJ.exe
  C:\Windows\System\NeKFoLJ.exe
  2⤵
  PID:11828
- C:\Windows\System\IADMQuA.exe
  C:\Windows\System\IADMQuA.exe
  2⤵
  PID:11852
- C:\Windows\System\iYzEbDk.exe
  C:\Windows\System\iYzEbDk.exe
  2⤵
  PID:11876
- C:\Windows\System\AMtiRDO.exe
  C:\Windows\System\AMtiRDO.exe
  2⤵
  PID:11908
- C:\Windows\System\EUHOHZQ.exe
  C:\Windows\System\EUHOHZQ.exe
  2⤵
  PID:11936
- C:\Windows\System\YasDAKY.exe
  C:\Windows\System\YasDAKY.exe
  2⤵
  PID:11960
- C:\Windows\System\tvKtpPR.exe
  C:\Windows\System\tvKtpPR.exe
  2⤵
  PID:11976
- C:\Windows\System\fCjgbpl.exe
  C:\Windows\System\fCjgbpl.exe
  2⤵
  PID:12012
- C:\Windows\System\QYKFLfh.exe
  C:\Windows\System\QYKFLfh.exe
  2⤵
  PID:12060
- C:\Windows\System\szGEXcw.exe
  C:\Windows\System\szGEXcw.exe
  2⤵
  PID:12076
- C:\Windows\System\WcnjMrA.exe
  C:\Windows\System\WcnjMrA.exe
  2⤵
  PID:12096
- C:\Windows\System\WkOyVEN.exe
  C:\Windows\System\WkOyVEN.exe
  2⤵
  PID:12112
- C:\Windows\System\IQpvzLc.exe
  C:\Windows\System\IQpvzLc.exe
  2⤵
  PID:12140
- C:\Windows\System\JYBAkXF.exe
  C:\Windows\System\JYBAkXF.exe
  2⤵
  PID:12176
- C:\Windows\System\QDDGyJk.exe
  C:\Windows\System\QDDGyJk.exe
  2⤵
  PID:12212
- C:\Windows\System\iWSCCsy.exe
  C:\Windows\System\iWSCCsy.exe
  2⤵
  PID:12228
- C:\Windows\System\ZXIpyrC.exe
  C:\Windows\System\ZXIpyrC.exe
  2⤵
  PID:12252
- C:\Windows\System\rWNyIYp.exe
  C:\Windows\System\rWNyIYp.exe
  2⤵
  PID:12272
- C:\Windows\System\kfYWTTp.exe
  C:\Windows\System\kfYWTTp.exe
  2⤵
  PID:11308
- C:\Windows\System\TlEvUhU.exe
  C:\Windows\System\TlEvUhU.exe
  2⤵
  PID:11296
- C:\Windows\System\ONOlBDr.exe
  C:\Windows\System\ONOlBDr.exe
  2⤵
  PID:11356
- C:\Windows\System\cwqqVyU.exe
  C:\Windows\System\cwqqVyU.exe
  2⤵
  PID:11488
- C:\Windows\System\AmvsVgg.exe
  C:\Windows\System\AmvsVgg.exe
  2⤵
  PID:4876
- C:\Windows\System\zJscIhA.exe
  C:\Windows\System\zJscIhA.exe
  2⤵
  PID:11576
- C:\Windows\System\OBANxMk.exe
  C:\Windows\System\OBANxMk.exe
  2⤵
  PID:11644
- C:\Windows\System\UAuKHjV.exe
  C:\Windows\System\UAuKHjV.exe
  2⤵
  PID:11748
- C:\Windows\System\cUjPzxc.exe
  C:\Windows\System\cUjPzxc.exe
  2⤵
  PID:11844
- C:\Windows\System\wCqEbWy.exe
  C:\Windows\System\wCqEbWy.exe
  2⤵
  PID:11884
- C:\Windows\System\xFXnJgz.exe
  C:\Windows\System\xFXnJgz.exe
  2⤵
  PID:11956
- C:\Windows\System\XDCHVpm.exe
  C:\Windows\System\XDCHVpm.exe
  2⤵
  PID:12004
- C:\Windows\System\tYVTTrm.exe
  C:\Windows\System\tYVTTrm.exe
  2⤵
  PID:12120
- C:\Windows\System\noRduyN.exe
  C:\Windows\System\noRduyN.exe
  2⤵
  PID:12088
- C:\Windows\System\AlTadLM.exe
  C:\Windows\System\AlTadLM.exe
  2⤵
  PID:12124
- C:\Windows\System\gMGuCfK.exe
  C:\Windows\System\gMGuCfK.exe
  2⤵
  PID:11292
- C:\Windows\System\OgVMiVN.exe
  C:\Windows\System\OgVMiVN.exe
  2⤵
  PID:12264
- C:\Windows\System\fOfvQzJ.exe
  C:\Windows\System\fOfvQzJ.exe
  2⤵
  PID:5048
- C:\Windows\System\RyAhHKr.exe
  C:\Windows\System\RyAhHKr.exe
  2⤵
  PID:11428
- C:\Windows\System\FiGuzHD.exe
  C:\Windows\System\FiGuzHD.exe
  2⤵
  PID:10508
- C:\Windows\System\gLKOkxQ.exe
  C:\Windows\System\gLKOkxQ.exe
  2⤵
  PID:11680
- C:\Windows\System\pUbyuRG.exe
  C:\Windows\System\pUbyuRG.exe
  2⤵
  PID:11952
- C:\Windows\System\aKBxzgZ.exe
  C:\Windows\System\aKBxzgZ.exe
  2⤵
  PID:5476
- C:\Windows\System\feLdwTD.exe
  C:\Windows\System\feLdwTD.exe
  2⤵
  PID:4028
- C:\Windows\System\TDBVvGp.exe
  C:\Windows\System\TDBVvGp.exe
  2⤵
  PID:12196
- C:\Windows\System\pCtVfru.exe
  C:\Windows\System\pCtVfru.exe
  2⤵
  PID:12284
- C:\Windows\System\MUnGJux.exe
  C:\Windows\System\MUnGJux.exe
  2⤵
  PID:12108
- C:\Windows\System\lHojsPg.exe
  C:\Windows\System\lHojsPg.exe
  2⤵
  PID:12128
- C:\Windows\System\wfNzUxk.exe
  C:\Windows\System\wfNzUxk.exe
  2⤵
  PID:11412
- C:\Windows\System\rReZeYH.exe
  C:\Windows\System\rReZeYH.exe
  2⤵
  PID:448
- C:\Windows\System\QAyqTJu.exe
  C:\Windows\System\QAyqTJu.exe
  2⤵
  PID:11476
- C:\Windows\System\pmMGaOI.exe
  C:\Windows\System\pmMGaOI.exe
  2⤵
  PID:5224
- C:\Windows\System\rgtXPDE.exe
  C:\Windows\System\rgtXPDE.exe
  2⤵
  PID:12304
- C:\Windows\System\SAEiYLo.exe
  C:\Windows\System\SAEiYLo.exe
  2⤵
  PID:12336
- C:\Windows\System\gAcgPlL.exe
  C:\Windows\System\gAcgPlL.exe
  2⤵
  PID:12356
- C:\Windows\System\VIQxcLG.exe
  C:\Windows\System\VIQxcLG.exe
  2⤵
  PID:12388
- C:\Windows\System\BxfKYaL.exe
  C:\Windows\System\BxfKYaL.exe
  2⤵
  PID:12404
- C:\Windows\System\Wapxtwe.exe
  C:\Windows\System\Wapxtwe.exe
  2⤵
  PID:12424
- C:\Windows\System\ckFfihh.exe
  C:\Windows\System\ckFfihh.exe
  2⤵
  PID:12444
- C:\Windows\System\FQASUbj.exe
  C:\Windows\System\FQASUbj.exe
  2⤵
  PID:12500
- C:\Windows\System\gHkDWeb.exe
  C:\Windows\System\gHkDWeb.exe
  2⤵
  PID:12532
- C:\Windows\System\pBdOtOQ.exe
  C:\Windows\System\pBdOtOQ.exe
  2⤵
  PID:12580
- C:\Windows\System\NWJzIUf.exe
  C:\Windows\System\NWJzIUf.exe
  2⤵
  PID:12604
- C:\Windows\System\cFuZwxd.exe
  C:\Windows\System\cFuZwxd.exe
  2⤵
  PID:12636
- C:\Windows\System\iomZSay.exe
  C:\Windows\System\iomZSay.exe
  2⤵
  PID:12720
- C:\Windows\System\BMixtfK.exe
  C:\Windows\System\BMixtfK.exe
  2⤵
  PID:12748
- C:\Windows\System\TSHIzMa.exe
  C:\Windows\System\TSHIzMa.exe
  2⤵
  PID:12804
- C:\Windows\System\wihWXDr.exe
  C:\Windows\System\wihWXDr.exe
  2⤵
  PID:12880
- C:\Windows\System\khZVhSK.exe
  C:\Windows\System\khZVhSK.exe
  2⤵
  PID:12896
- C:\Windows\System\kaqCOKH.exe
  C:\Windows\System\kaqCOKH.exe
  2⤵
  PID:12928
- C:\Windows\System\ZzLWsnH.exe
  C:\Windows\System\ZzLWsnH.exe
  2⤵
  PID:12948
- C:\Windows\System\htLQSXs.exe
  C:\Windows\System\htLQSXs.exe
  2⤵
  PID:12980
- C:\Windows\System\LqnBjdy.exe
  C:\Windows\System\LqnBjdy.exe
  2⤵
  PID:12996
- C:\Windows\System\RNZBiXV.exe
  C:\Windows\System\RNZBiXV.exe
  2⤵
  PID:13016
- C:\Windows\System\lSarODQ.exe
  C:\Windows\System\lSarODQ.exe
  2⤵
  PID:13036
- C:\Windows\System\NKpOQzM.exe
  C:\Windows\System\NKpOQzM.exe
  2⤵
  PID:13060
- C:\Windows\System\JfxEZVV.exe
  C:\Windows\System\JfxEZVV.exe
  2⤵
  PID:13120
- C:\Windows\System\NvRWKFY.exe
  C:\Windows\System\NvRWKFY.exe
  2⤵
  PID:13144
- C:\Windows\System\KremVpY.exe
  C:\Windows\System\KremVpY.exe
  2⤵
  PID:13276
- C:\Windows\System\JLvSsEZ.exe
  C:\Windows\System\JLvSsEZ.exe
  2⤵
  PID:13300
- C:\Windows\System\aQdDEMP.exe
  C:\Windows\System\aQdDEMP.exe
  2⤵
  PID:12416
- C:\Windows\System\VQUlbSv.exe
  C:\Windows\System\VQUlbSv.exe
  2⤵
  PID:12440
- C:\Windows\System\HXrlkfq.exe
  C:\Windows\System\HXrlkfq.exe
  2⤵
  PID:12856
- C:\Windows\System\ZjipGyI.exe
  C:\Windows\System\ZjipGyI.exe
  2⤵
  PID:12892
- C:\Windows\System\mUzDIzr.exe
  C:\Windows\System\mUzDIzr.exe
  2⤵
  PID:12836
- C:\Windows\System\gWRlddc.exe
  C:\Windows\System\gWRlddc.exe
  2⤵
  PID:12852
- C:\Windows\System\TRgxQaM.exe
  C:\Windows\System\TRgxQaM.exe
  2⤵
  PID:12864
- C:\Windows\System\WyvtyPX.exe
  C:\Windows\System\WyvtyPX.exe
  2⤵
  PID:11268
- C:\Windows\System\GZzlQdE.exe
  C:\Windows\System\GZzlQdE.exe
  2⤵
  PID:13032
- C:\Windows\System\UrdlyyP.exe
  C:\Windows\System\UrdlyyP.exe
  2⤵
  PID:13172
- C:\Windows\System\XjEotXc.exe
  C:\Windows\System\XjEotXc.exe
  2⤵
  PID:13200
- C:\Windows\System\ajDrYxd.exe
  C:\Windows\System\ajDrYxd.exe
  2⤵
  PID:13236
- C:\Windows\System\ikILHvD.exe
  C:\Windows\System\ikILHvD.exe
  2⤵
  PID:13232
- C:\Windows\System\SVAZbQB.exe
  C:\Windows\System\SVAZbQB.exe
  2⤵
  PID:13264
- C:\Windows\System\GhOtfOd.exe
  C:\Windows\System\GhOtfOd.exe
  2⤵
  PID:13296
- C:\Windows\System\tdukxQo.exe
  C:\Windows\System\tdukxQo.exe
  2⤵
  PID:12352
- C:\Windows\System\rtltEBM.exe
  C:\Windows\System\rtltEBM.exe
  2⤵
  PID:12412
- C:\Windows\System\bSvGios.exe
  C:\Windows\System\bSvGios.exe
  2⤵
  PID:12472
- C:\Windows\System\DEvMXMx.exe
  C:\Windows\System\DEvMXMx.exe
  2⤵
  PID:3900
- C:\Windows\System\VhpXLRr.exe
  C:\Windows\System\VhpXLRr.exe
  2⤵
  PID:12676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aycjazg2.c0t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AdDrFLz.exe

Filesize
2.0MB

MD5
cef5913c6ce6c9a2c54feb208e27fbbe

SHA1
885fff15a65c9f5bb52b943f1711e9cf38bcf777

SHA256
a136a4b2ac23fcd2994a8c24d6c90735e1279b24ea139497fc1749d311ea6b40

SHA512
971d0cb5226e5075edac8775d1b1896eb0dbdbdcb3d7b73f3cfa41d2ec6d07c3e26df944c76c43770509b75d0252433764ced891f28c821c5324fbf1fed0de6c

Download Submit
C:\Windows\System\CkHKVeD.exe

Filesize
2.0MB

MD5
f0efafe8f970fab26b457e9b54bee150

SHA1
d5b2096d8ca03b4493ddabe28946d07bf8407d7e

SHA256
070933341bdf72e7fc88f07b8fc457e1789aaa8371a942465beffaed6a92d0c8

SHA512
a64982144e261f91feee3576db12b0da44b52b13f15d521d53f7bdd5cf32ee79e23cc4067f3532645439ae90f3922242392f563840f00df54f787ee8cba5af18

Download Submit
C:\Windows\System\DnHAsAA.exe

Filesize
2.0MB

MD5
be8ec3b300c2d2777af33378b635fef1

SHA1
99aab4870eb0622c6069f8dd7be3f6452b6ff9c9

SHA256
9d2c87b7303b65b12b008eb43e2a9ee059c2fa9cc5b0a0d4e57296788dd841fc

SHA512
bdc31aca6e82330036623acfcedc668fd4181c922a7b6ad754566dad1f9de8e7de94c82bb8674eb728e8e56528eba1ce01b3e3521a69cbefe8bd0b20e080c3a4

Download Submit
C:\Windows\System\FwhNmJe.exe

Filesize
2.0MB

MD5
b8f064c7df661c37c506a12d8b5959f5

SHA1
c11994f366201eed3ce64205314398b6e7544ab9

SHA256
555f0e5082c6a6653d3da8e3698c4ae9db1e86599e61c82412a36ef84116510a

SHA512
f4d04a9dfb35be9749583418711081bc79dee19fbd8c317c4ad356463599861ee0745ed765d214b4f314dd941a16d49f57cc8ea34b6166bbcb7cbc8c7da09043

Download Submit
C:\Windows\System\GPULmtK.exe

Filesize
2.0MB

MD5
0af011537f9ef725c80b183ceb4973c4

SHA1
c8154aeaf494e29b8e0ed52dda8e7a006b0fd836

SHA256
9236520b3e960305ead02f1080a3629779b31d15ca83a4e49efdaa8175ab5241

SHA512
5f39f99c829807911b0c123c29861444d3bd11b67ae7294479bd65b9335b7e66aadf3b66e0df26b7b2b6bbd9635442ce055ac51d8d82245b4a7c1877a786dd7f

Download Submit
C:\Windows\System\IJcTizf.exe

Filesize
2.0MB

MD5
81b6eaaa249a81f8c4221354efa8c26b

SHA1
26817769f6983687252b1b8528561c3d187d25b0

SHA256
acd43bf0ac236b55b35402e756cc2f49cb3e2ab6e64928500871df0c97bafca1

SHA512
c8ecd1098bb77a2121102bae4b25165cd312ec6e0d95827da581c13e435e20b8911ea8c0d385612baca9487fbf477a0a02260839a9a6b46c5b162fbf3dc83763

Download Submit
C:\Windows\System\IxXnqut.exe

Filesize
2.0MB

MD5
c8f395ef9d079df877434a8eb59b6abc

SHA1
56ca381df82473918f3600a79bd9795bc0f2f64a

SHA256
297b171365aea4455a1b0acc6dd931bb678136c1819b08f54c96702fc590bb5b

SHA512
4b73524918a1c5f1237346663b883674b0fa28fc02dc17c0a66da9584d4fac513110e6b7a5523f9e7b0cb9e4c43bac5ecb64fd54c9cd7509688acbf459591ba0

Download Submit
C:\Windows\System\JLQEtPU.exe

Filesize
2.0MB

MD5
ee761d427af34abccd04fb02c07c46ca

SHA1
c9b38033f31e5aa53537d1a65e0ade53c9efe443

SHA256
3cff0c049bcebfea0c19440d64a75d0c8fba651819832cb977b286602ddd3eb0

SHA512
ae80fae19d842aef736c9326f9eab0499e2b71a6dea6b65ef7686cca8886bf6dc396dd178bac61fc0d07bc7283d0a95628eb7711853bfe5956375a7656796ab6

Download Submit
C:\Windows\System\JaanseO.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\System\KMRJmVa.exe

Filesize
2.0MB

MD5
d4771f9d17d0a90170eebdc7019a9575

SHA1
67de89bc22d66b356ab11a8dd8182a504b2cbb0f

SHA256
b6b693d272cf046a0f42a9a4741b9ec2a4ab8fcbad220dfb6c6d933bfcfef165

SHA512
6a17307cf6bc81fd1dc9cd67c6e6338878d405e1a8d40e8fc61b1c6e61c493c86d413cd74cc2ac197be76b7046e523c482ef8eb78215defa8b90d247370d4805

Download Submit
C:\Windows\System\Mstyjhh.exe

Filesize
2.0MB

MD5
d374bd778e4f7a4185c9a5e75e05dabd

SHA1
e7cb2c91d39b37daf32a50ebc60624253135c1ad

SHA256
47e2f5d205d2d9002929c830a9fbbd61ec569732181316ca1fd2f204fa1b5fce

SHA512
64fcd880e7467c80df1e57c1d8c3ab648944d3f363e91596a5abf5fde3f243a66e782b75a5fa641ef049dffeaf1207899bbe5f882a2c854565054911d822a21a

Download Submit
C:\Windows\System\OsaqkCV.exe

Filesize
2.0MB

MD5
e34d19788319cae46d35db8d127a0e79

SHA1
694019c218342793efaaa6f8abb491ef516eacdc

SHA256
02ba8ad76638c3dcf42699741c3a25f87649eaa83569c720deabf0d1f2fdb419

SHA512
c7bb464fc2b31176b6e6aafaab877686e4a199ae4b1fb7648e8fa1b6fe368ecb7cd175d29f96d1dec905e0294b294fe3abc085207600662b0959410119a95e0b

Download Submit
C:\Windows\System\QoFDyjr.exe

Filesize
2.0MB

MD5
1f5ad2c6c82e4c7e070a993ede3a0fd0

SHA1
79137681a042b3ada12970321db6e430f12251fe

SHA256
c006307ba697348c0f7d6ea4d929795fd979de0da23586c35ed778710d9fecc4

SHA512
a6911388e3f92d72e69c3a3936951c45a5149220f46090a9e1b2577643df266d4cfaf6a6ff6b6b948b48661de641ef82c7c082b51ce9dabd3461422720e14ea5

Download Submit
C:\Windows\System\RcMaIEM.exe

Filesize
2.0MB

MD5
254625d225ed538395b58834d7c5749a

SHA1
3527d5b8e59341e034e99dfaf96e84587ab9c98b

SHA256
4a925c72b5896160f6031649a581b0ecb7fb370aaf870bfecdd7c8d32cd162cd

SHA512
51ff812ff91e3a1c806095723e5b0320efbec362882690cc66dd2437c1874e6e78c0b2456fc833680000c827af50367c8f9b56ddf00f8e48bdb9dd394cb96560

Download Submit
C:\Windows\System\SiBaafZ.exe

Filesize
2.0MB

MD5
f6675739385f5092f891ebc7fb215f33

SHA1
af8e87d5ffbbb15b110ef03c9efc8b7f65f9482a

SHA256
d132b1689506fae0d4653af8cf78070e4588d24828d5b8cee1775c81afcdd9ec

SHA512
047c6f7874beaf6e5ab74fda07d7015dc985d0c506241909f5d0960e00f9b4a648cda10922c6bc1a42257336df407eaf6e0fee8957ba592cad57a03ce7533d90

Download Submit
C:\Windows\System\TdNfnCy.exe

Filesize
2.0MB

MD5
e8daeaea4da531fb8a95007dbd9128bc

SHA1
41a548ef51f731dbf48666d8a9211a98bdceaa80

SHA256
1c5dba8f3c37697b293ad0807bdc4400a710a95b4430eb2b50e245812c06f110

SHA512
b6c7fcf876b38648ed6b39b047962a8b985eddcfffe0284d668490a8a07740df9229fcb8b7077d6aba535868eadfa2745feacaf31d8448e151c08de42cf4f081

Download Submit
C:\Windows\System\ZiMRefs.exe

Filesize
2.0MB

MD5
584f89cb35ec2df4b30c7d9ea96f28bc

SHA1
8b2d9874a9fabe2a881ee5579d091d08b5ae5f56

SHA256
66ab5a0ec3478aacf802f1ae9cd89b0c9c6f27f9e6f6c1722c3b9e8698dddbfa

SHA512
4c47060660c0e0692a7d132dbe892d9ebc8922f5acf2a79e3cba12c22e8d8064274be3fed665d7cd2211d6c544848e238f80e42e2c86fc418e33dcc60a76618f

Download Submit
C:\Windows\System\ZmMguYN.exe

Filesize
2.0MB

MD5
3af23ce95c2c39f006533ac01b466a65

SHA1
4ca70eddd526cf27471488063c2e5ac2e7fcbaa6

SHA256
383991bad5920e55d3303eeb8ba95e1fd6643d9cece78d51790ff54b1e193e70

SHA512
6f736532f2b68deb69be5372ce18ab1a288ca379b7d0bcdd25a08f4e82b087f625991e6566e077498e592d0c31171e499a91a079952c2a0000a13d5aadbc3517

Download Submit
C:\Windows\System\afaFzgs.exe

Filesize
2.0MB

MD5
44e9ea267579dd4041ebc4ef6dd64266

SHA1
a977de599010b017694c15804780ee375c84f865

SHA256
409f8dbe07f78990fb78db94525c193d229f215863a2428cf0e1bdb70a9aa54d

SHA512
72ec3cb706f6687698c603f818c58cb293324e6407ffef4f68b75e2b88347615f1416d7ab751b5e9d006daa72aa2cb4dda77f08513845a96862e976133dc54b1

Download Submit
C:\Windows\System\cyrrQpy.exe

Filesize
2.0MB

MD5
d7d64cf79521e3601190f46adf6b186a

SHA1
09f58797fdd8863cf397e07e385b828a697cf9ac

SHA256
47d2fb5f0ab27338c84b3565b740546fcb24579f410c1a1753122d09a4ae2eb7

SHA512
6db16e5b86286c20e44cfda6da7d2cad1ad8fcb7a483468b5271265422605627cd1ce88353f0c7a990b7925c6d20bbf72bdc3fff35826c90ea9237487b02f9a5

Download Submit
C:\Windows\System\ghgGYmC.exe

Filesize
2.0MB

MD5
a0019be78bc4b43a3f9603b6dc203542

SHA1
a7b7bf9791002593e266b0aa31436e599403822f

SHA256
6736c15f1f816d7fe73c9f5cba56b45bedf5e0432762889482fd5744dbc6a5b6

SHA512
5f3b94b18932338c69d500d9d38d28bb6ad3423ed7c679212d71f9feece5721cb17d90154d1174f263a0bccc7a6df23c697b7cf80280bcfb53f058677ce4f6c1

Download Submit
C:\Windows\System\ghrsqjE.exe

Filesize
2.0MB

MD5
905038a04ccf2c4cf3a70402adcfa97e

SHA1
ef758c7d69da272c6348a27c9b60576d307efe28

SHA256
94a5dd9800abaa178bfd277591a28c7071048194112d6fb7723a0b98c7957a22

SHA512
bd43d220a4d999dec65bc0a073bb76294b06e57b32ddc1d750956d8c741b5b6cb5a3b3ff253d4303a2f81243896a355daa65171d9402f700baea7b96fe872c47

Download Submit
C:\Windows\System\gtcKiim.exe

Filesize
2.0MB

MD5
29cba72f985389a195df434927c05959

SHA1
a818f4e99e0f2232821849ae3c64128762beca99

SHA256
2f5890b7a198e6236a54479878f5edb78fc969ec1c4850c3a8a5c8cf0a898826

SHA512
6793bf48ad7139013ef35543a8eb9c82c8f57f46031668afc7ee8d162611d979219d5fafe2f34bd7fa3059d6bfaffce6b6c8ae8ae9dbcf303086e79bdfe0d39a

Download Submit
C:\Windows\System\jQsBJzT.exe

Filesize
2.0MB

MD5
d4016bdbe1d2acf3fdbb1225041430eb

SHA1
04ae5f62011fc1f69ef52b3afafe598501e4dec9

SHA256
ae3911151ef33fcc8a3620a1cf06ba3d5bd5697c9c3ab1406a52b4b285241ecf

SHA512
8acd6cee943ecf3d8ad63ab0910066a53042e615f5c239bb1fcf1cc8db47c2669341c9af2532b1f460f590cd8696e2de4ebe82f3eb45643bd3d37e1c8655db5d

Download Submit
C:\Windows\System\kvUqoUZ.exe

Filesize
2.0MB

MD5
004b9d2a2157f4f6a066eb96be03bf67

SHA1
118f645c23e4991c78540376b2ce9ef6e40be03d

SHA256
afe94e34c3727069ced7419a5cf3bf50e41ae32417e77057c1b0e9ef73cbad95

SHA512
9bb70804766d38b705c0919d03a624b835ddcb78c6e45155825202f860d077368568f12e9dddda7d2b33334f6cb326b0265035184f16480c72b3556a13d2523a

Download Submit
C:\Windows\System\mlJlCNR.exe

Filesize
2.0MB

MD5
f43b3405781da54a2bf65edeb6cdc231

SHA1
22b0ca919b9604c1858575b5b93c91bef30329d1

SHA256
c44e752eec147f052952e5b036e1158f601e2952ffe294986883d55786e26284

SHA512
f39dbc35982ebb85f005b5a9249a3d1edb7e61ed355814c5ee36a6daac3a868b30a31bdaa045e3e8b0a6be221ee08259f73b3cfb666dda3cb6bd458c390b4a3d

Download Submit
C:\Windows\System\rLftcvI.exe

Filesize
2.0MB

MD5
e9680fd3ea8d66a938f76e25186216fe

SHA1
e7ae06384a6ca672a887e6378985e89e02a35b95

SHA256
344d8ce974f9749cfb1e0c15f0ba728677619e44c2d88eef54a0c7973fa34c48

SHA512
c3f7bc09a4a5729810ccb05808d37990210ef83b01ee8bbb944ac27661b20bba5121dff89b26d10e6b7f370bcbaf521d055198f749f91fc8f24e974d3e651145

Download Submit
C:\Windows\System\slNTlSN.exe

Filesize
2.0MB

MD5
b946905962b793b7ca7786e0dee78a05

SHA1
a2a46d3941e15e7e60b87f856c284574323572d0

SHA256
3f027a71a74adc38448b8c74f9aa2d787296f3759b54241449c287c354db9a92

SHA512
885225a2bb80b8b713b621c02dde7738ae1a2cec149e5bad95805eaf48ada8d293c0d3fc2e32ad52e25b08c2702c54695f378621f37e578d19540b186e7dcff7

Download Submit
C:\Windows\System\tFJtiaR.exe

Filesize
2.0MB

MD5
1041f26bfb52e8d75f8c5123aeb458d6

SHA1
5bcf9d3558a28ccf4354ea771c88fe3735f33bca

SHA256
a7484879fc00563cf364cb761489c7f2ad3a29f72172079040640ec0900a05a3

SHA512
029a046c1834990574d701b411308862204042febe071a50aa9fa3123eb79b0bdd072994301b1439dedeefe6a65ed3da6ecb4d10a255ca3812837b4a9e01ac3b

Download Submit
C:\Windows\System\vFgPjwn.exe

Filesize
2.0MB

MD5
baddfcabdb6e0c52dfe2cb27d7a697bc

SHA1
e7b1567895e8195107e63fe346128b5e9386ab60

SHA256
4c0f55f84b9974dade9ef25a0e2615dd478cd66b68270d0642d1ba339d018bc8

SHA512
b4f6349ce7f4153125bcac2543653979ab864bfc9dcf245c2e0f362dfb85728c78eeba87d981c661cbdc57f0facf1d85b63845a3dc45e442b3f27a3fe6280c5b

Download Submit
C:\Windows\System\vbmvZxb.exe

Filesize
2.0MB

MD5
f00f75ca9fca33998a9c2184896ea138

SHA1
d5691b106b7421979b015b55e113e679b1d91246

SHA256
e3bbaab1146c26034a6b83e65cafe453929546f1667fa812d21de60da11fec84

SHA512
1e4c2f48a47079b2c2e7762833639b9627cf8b8f79c39adfe6db146bd085d68e97a401b96a5ecd0855078aff3b3b1811aa008de66aab300d7ab9c1e228af5a86

Download Submit
C:\Windows\System\vtsIthW.exe

Filesize
2.0MB

MD5
ef428f9756ac00481862dd70c31f2943

SHA1
0e229802655d304856468cd4dfd0e0d8939252bd

SHA256
015edd47aebc8b12cf31f85332edd1de0524ba9fbbe66907e049acf0069a833d

SHA512
84195b76e363db5a291fa221ca046f33abc72da0a92bcccd6d8f2b3592183d043458e5ecf37ec5e9d5b875ac828cf9d5759f3c9216d0604604fc62ef2ceb09d5

Download Submit
C:\Windows\System\wOVwYQb.exe

Filesize
2.0MB

MD5
8ad9b23b5c97029ba9b4018357ef8b11

SHA1
52294a265774cf0022f4b984056026fb10ce9c16

SHA256
9d4e400fa5309a06bc1babec5b475b81a0f67227b2b4257497bb7f937698507a

SHA512
90ef1cc603de780f52a8088a82b0a106e82493f39da9072dd7784b38d658d51fcbe00042d3da61f5867c87c8dda592569e4661d4896cdd084a49a14bd9e9dcd5

Download Submit
C:\Windows\System\ygHRbmV.exe

Filesize
2.0MB

MD5
ba9a58884089551849f43752af4d8003

SHA1
522c67ee54cf2d9c6a646f59307e7e87ee5da4ab

SHA256
87910fbbf1c2182f329a58e160a8f9605c254ac5571749de00e7fb66a9c75c91

SHA512
47fcb6b5c69b22eb987956ed1925d1f49c3dbc683b189b48faa741507b29fb5073fc246257a6ba755ba32edb2aaa07e5a5d5b5307cb501d84a2d3c401312f352

Download Submit
memory/736-92-0x00007FF78A100000-0x00007FF78A4F2000-memory.dmp

Filesize
3.9MB

Download
memory/736-2968-0x00007FF78A100000-0x00007FF78A4F2000-memory.dmp

Filesize
3.9MB

Download
memory/736-2700-0x00007FF78A100000-0x00007FF78A4F2000-memory.dmp

Filesize
3.9MB

Download
memory/744-99-0x00007FF7ACA00000-0x00007FF7ACDF2000-memory.dmp

Filesize
3.9MB

Download
memory/744-2723-0x00007FF7ACA00000-0x00007FF7ACDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1104-0-0x00007FF6381C0000-0x00007FF6385B2000-memory.dmp

Filesize
3.9MB

Download
memory/1104-1-0x00000140CDE20000-0x00000140CDE30000-memory.dmp

Filesize
64KB

Download
memory/1536-83-0x00007FF70E520000-0x00007FF70E912000-memory.dmp

Filesize
3.9MB

Download
memory/1536-2710-0x00007FF70E520000-0x00007FF70E912000-memory.dmp

Filesize
3.9MB

Download
memory/1564-550-0x00007FF776B60000-0x00007FF776F52000-memory.dmp

Filesize
3.9MB

Download
memory/1564-2730-0x00007FF776B60000-0x00007FF776F52000-memory.dmp

Filesize
3.9MB

Download
memory/1628-556-0x00007FF61C3A0000-0x00007FF61C792000-memory.dmp

Filesize
3.9MB

Download
memory/1628-2734-0x00007FF61C3A0000-0x00007FF61C792000-memory.dmp

Filesize
3.9MB

Download
memory/1844-100-0x00007FF78A8F0000-0x00007FF78ACE2000-memory.dmp

Filesize
3.9MB

Download
memory/1844-2728-0x00007FF78A8F0000-0x00007FF78ACE2000-memory.dmp

Filesize
3.9MB

Download
memory/1876-103-0x00007FF6CD280000-0x00007FF6CD672000-memory.dmp

Filesize
3.9MB

Download
memory/1876-2719-0x00007FF6CD280000-0x00007FF6CD672000-memory.dmp

Filesize
3.9MB

Download
memory/1992-555-0x00007FF7DB420000-0x00007FF7DB812000-memory.dmp

Filesize
3.9MB

Download
memory/1992-2736-0x00007FF7DB420000-0x00007FF7DB812000-memory.dmp

Filesize
3.9MB

Download
memory/2000-552-0x00007FF7FD560000-0x00007FF7FD952000-memory.dmp

Filesize
3.9MB

Download
memory/2000-2747-0x00007FF7FD560000-0x00007FF7FD952000-memory.dmp

Filesize
3.9MB

Download
memory/2584-104-0x00007FF620E50000-0x00007FF621242000-memory.dmp

Filesize
3.9MB

Download
memory/2584-2725-0x00007FF620E50000-0x00007FF621242000-memory.dmp

Filesize
3.9MB

Download
memory/3008-2721-0x00007FF675210000-0x00007FF675602000-memory.dmp

Filesize
3.9MB

Download
memory/3008-96-0x00007FF675210000-0x00007FF675602000-memory.dmp

Filesize
3.9MB

Download
memory/3216-2741-0x00007FF74A1D0000-0x00007FF74A5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-557-0x00007FF74A1D0000-0x00007FF74A5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3472-2746-0x00007FF683EF0000-0x00007FF6842E2000-memory.dmp

Filesize
3.9MB

Download
memory/3472-553-0x00007FF683EF0000-0x00007FF6842E2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-64-0x00007FF6E5000000-0x00007FF6E53F2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-2689-0x00007FF6E5000000-0x00007FF6E53F2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-2716-0x00007FF6E5000000-0x00007FF6E53F2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-88-0x00007FF7677B0000-0x00007FF767BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-2727-0x00007FF7677B0000-0x00007FF767BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3768-2740-0x00007FF7600D0000-0x00007FF7604C2000-memory.dmp

Filesize
3.9MB

Download
memory/3768-558-0x00007FF7600D0000-0x00007FF7604C2000-memory.dmp

Filesize
3.9MB

Download
memory/3836-554-0x00007FF66F8D0000-0x00007FF66FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/3836-2744-0x00007FF66F8D0000-0x00007FF66FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/4088-89-0x00007FF6A5920000-0x00007FF6A5D12000-memory.dmp

Filesize
3.9MB

Download
memory/4088-2714-0x00007FF6A5920000-0x00007FF6A5D12000-memory.dmp

Filesize
3.9MB

Download
memory/4136-551-0x00007FF7A3B40000-0x00007FF7A3F32000-memory.dmp

Filesize
3.9MB

Download
memory/4136-2738-0x00007FF7A3B40000-0x00007FF7A3F32000-memory.dmp

Filesize
3.9MB

Download
memory/4248-36-0x00007FFF9C3A0000-0x00007FFF9CE61000-memory.dmp

Filesize
10.8MB

Download
memory/4248-5-0x00007FFF9C3A3000-0x00007FFF9C3A5000-memory.dmp

Filesize
8KB

Download
memory/4248-78-0x00007FFF9C3A0000-0x00007FFF9CE61000-memory.dmp

Filesize
10.8MB

Download
memory/4248-254-0x0000020530DA0000-0x0000020531546000-memory.dmp

Filesize
7.6MB

Download
memory/4248-31-0x00000205301D0000-0x00000205301F2000-memory.dmp

Filesize
136KB

Download
memory/4784-2706-0x00007FF7F84B0000-0x00007FF7F88A2000-memory.dmp

Filesize
3.9MB

Download
memory/4784-43-0x00007FF7F84B0000-0x00007FF7F88A2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-2705-0x00007FF7CF860000-0x00007FF7CFC52000-memory.dmp

Filesize
3.9MB

Download
memory/4880-46-0x00007FF7CF860000-0x00007FF7CFC52000-memory.dmp

Filesize
3.9MB

Download
memory/4956-40-0x00007FF743850000-0x00007FF743C42000-memory.dmp

Filesize
3.9MB

Download
memory/4956-2702-0x00007FF743850000-0x00007FF743C42000-memory.dmp

Filesize
3.9MB

Download
memory/5248-2713-0x00007FF70D5D0000-0x00007FF70D9C2000-memory.dmp

Filesize
3.9MB

Download
memory/5248-87-0x00007FF70D5D0000-0x00007FF70D9C2000-memory.dmp

Filesize
3.9MB

Download
memory/5732-54-0x00007FF70B4F0000-0x00007FF70B8E2000-memory.dmp

Filesize
3.9MB

Download
memory/5732-2708-0x00007FF70B4F0000-0x00007FF70B8E2000-memory.dmp

Filesize
3.9MB

Download