xmrig | abb70333be24929181b3a7e7012dbae0858fd7cf2fe31151959f53d8ecf8c103

Analysis

max time kernel
124s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
Size

1.4MB
MD5

224fbcdd51eeca33257c200d6f3cce3e
SHA1

7d0d0ee3177754ae47ffc9627ceb1de9544a8bfa
SHA256

abb70333be24929181b3a7e7012dbae0858fd7cf2fe31151959f53d8ecf8c103
SHA512

39cba9620147ce10569b2cac620f137f09f847d3ad8c1760d636f21dd726d1dfad36a6d95e4f0a07756a0763084269fe03b726265e0b2470fb7b1928647fddf7
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/Vx+wa:Lz071uv4BPMkibTIA5CJQwa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/1476-56-0x00007FF63FA60000-0x00007FF63FE52000-memory.dmp	xmrig
behavioral2/memory/4716-146-0x00007FF611840000-0x00007FF611C32000-memory.dmp	xmrig
behavioral2/memory/3088-162-0x00007FF6ABC30000-0x00007FF6AC022000-memory.dmp	xmrig
behavioral2/memory/4972-175-0x00007FF7F4B00000-0x00007FF7F4EF2000-memory.dmp	xmrig
behavioral2/memory/4780-211-0x00007FF66EBF0000-0x00007FF66EFE2000-memory.dmp	xmrig
behavioral2/memory/452-207-0x00007FF78FB50000-0x00007FF78FF42000-memory.dmp	xmrig
behavioral2/memory/4424-203-0x00007FF6DEE50000-0x00007FF6DF242000-memory.dmp	xmrig
behavioral2/memory/4832-199-0x00007FF6C4A30000-0x00007FF6C4E22000-memory.dmp	xmrig
behavioral2/memory/1656-193-0x00007FF696DC0000-0x00007FF6971B2000-memory.dmp	xmrig
behavioral2/memory/2076-187-0x00007FF6EE450000-0x00007FF6EE842000-memory.dmp	xmrig
behavioral2/memory/2248-181-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp	xmrig
behavioral2/memory/4536-168-0x00007FF737E00000-0x00007FF7381F2000-memory.dmp	xmrig
behavioral2/memory/4540-158-0x00007FF790B10000-0x00007FF790F02000-memory.dmp	xmrig
behavioral2/memory/4272-152-0x00007FF694110000-0x00007FF694502000-memory.dmp	xmrig
behavioral2/memory/1624-136-0x00007FF68BCE0000-0x00007FF68C0D2000-memory.dmp	xmrig
behavioral2/memory/2588-128-0x00007FF71F370000-0x00007FF71F762000-memory.dmp	xmrig
behavioral2/memory/4284-118-0x00007FF79B710000-0x00007FF79BB02000-memory.dmp	xmrig
behavioral2/memory/4544-97-0x00007FF651580000-0x00007FF651972000-memory.dmp	xmrig
behavioral2/memory/736-2015-0x00007FF631BD0000-0x00007FF631FC2000-memory.dmp	xmrig
behavioral2/memory/1564-2017-0x00007FF690020000-0x00007FF690412000-memory.dmp	xmrig
behavioral2/memory/2932-2016-0x00007FF7C2D50000-0x00007FF7C3142000-memory.dmp	xmrig
behavioral2/memory/3812-2019-0x00007FF638490000-0x00007FF638882000-memory.dmp	xmrig
behavioral2/memory/4544-2021-0x00007FF651580000-0x00007FF651972000-memory.dmp	xmrig
behavioral2/memory/928-2020-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp	xmrig
behavioral2/memory/2816-2018-0x00007FF65AE90000-0x00007FF65B282000-memory.dmp	xmrig
behavioral2/memory/736-2046-0x00007FF631BD0000-0x00007FF631FC2000-memory.dmp	xmrig
behavioral2/memory/4536-2045-0x00007FF737E00000-0x00007FF7381F2000-memory.dmp	xmrig
behavioral2/memory/1564-2053-0x00007FF690020000-0x00007FF690412000-memory.dmp	xmrig
behavioral2/memory/2932-2054-0x00007FF7C2D50000-0x00007FF7C3142000-memory.dmp	xmrig
behavioral2/memory/1476-2050-0x00007FF63FA60000-0x00007FF63FE52000-memory.dmp	xmrig
behavioral2/memory/2816-2049-0x00007FF65AE90000-0x00007FF65B282000-memory.dmp	xmrig
behavioral2/memory/2076-2063-0x00007FF6EE450000-0x00007FF6EE842000-memory.dmp	xmrig
behavioral2/memory/4972-2064-0x00007FF7F4B00000-0x00007FF7F4EF2000-memory.dmp	xmrig
behavioral2/memory/2248-2066-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp	xmrig
behavioral2/memory/4544-2068-0x00007FF651580000-0x00007FF651972000-memory.dmp	xmrig
behavioral2/memory/3812-2061-0x00007FF638490000-0x00007FF638882000-memory.dmp	xmrig
behavioral2/memory/928-2058-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp	xmrig
behavioral2/memory/4284-2057-0x00007FF79B710000-0x00007FF79BB02000-memory.dmp	xmrig
behavioral2/memory/4272-2087-0x00007FF694110000-0x00007FF694502000-memory.dmp	xmrig
behavioral2/memory/452-2088-0x00007FF78FB50000-0x00007FF78FF42000-memory.dmp	xmrig
behavioral2/memory/4424-2091-0x00007FF6DEE50000-0x00007FF6DF242000-memory.dmp	xmrig
behavioral2/memory/2588-2090-0x00007FF71F370000-0x00007FF71F762000-memory.dmp	xmrig
behavioral2/memory/4780-2085-0x00007FF66EBF0000-0x00007FF66EFE2000-memory.dmp	xmrig
behavioral2/memory/3088-2083-0x00007FF6ABC30000-0x00007FF6AC022000-memory.dmp	xmrig
behavioral2/memory/1624-2077-0x00007FF68BCE0000-0x00007FF68C0D2000-memory.dmp	xmrig
behavioral2/memory/4716-2073-0x00007FF611840000-0x00007FF611C32000-memory.dmp	xmrig
behavioral2/memory/4540-2071-0x00007FF790B10000-0x00007FF790F02000-memory.dmp	xmrig
behavioral2/memory/1656-2081-0x00007FF696DC0000-0x00007FF6971B2000-memory.dmp	xmrig
behavioral2/memory/4832-2075-0x00007FF6C4A30000-0x00007FF6C4E22000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	376	powershell.exe
11	376	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
376	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
736	IhfeqFB.exe
4536	sSlNyTj.exe
2932	GOFpJoR.exe
1564	gVIOmRZ.exe
2816	rxxepoX.exe
1476	YQPYJpg.exe
4972	qSITzFv.exe
2248	PRFrzDl.exe
3812	VSpsnuL.exe
928	PgpoqeE.exe
2076	ulwLNBM.exe
4544	hNnxMrU.exe
4284	mELBTvo.exe
1656	avdMJln.exe
2588	vczFaXg.exe
4832	OziuLTq.exe
1624	zhuOCBu.exe
4716	OsPcmWP.exe
4272	vKZwAoH.exe
4424	TGgrPpX.exe
4540	tPjuMEU.exe
452	FMlhcGs.exe
3088	rdhjODh.exe
4780	tYjXLxN.exe
3720	Iwbovkx.exe
2524	mwAgFXp.exe
864	EKOeRdG.exe
2672	PtmjMVg.exe
1264	GGzOjjw.exe
3220	vwJWlcP.exe
4012	PiKIQox.exe
2512	yGSeUCc.exe
4444	jOwXfhv.exe
4208	fEBrjOL.exe
4884	duAVCRZ.exe
4296	KoqZEuP.exe
3312	SfefyUu.exe
888	qMDggQn.exe
4356	cVmqncU.exe
4344	CNsLDvL.exe
3048	NFAYrbb.exe
4464	OfgWorN.exe
3076	aNekkbJ.exe
4852	eYXAJBs.exe
2760	iXMtcKc.exe
4572	axiIhmf.exe
3084	WpxiVQo.exe
4088	hfQOGSY.exe
3824	Lxefpby.exe
4032	wzhqosm.exe
2736	dQMZSNf.exe
4756	afarTdQ.exe
4808	DLRybiQ.exe
2528	gMIitXm.exe
436	LZbDjrB.exe
2888	MwMGnNn.exe
3940	YCyNqih.exe
4556	sfaUIaB.exe
4324	myzCtRa.exe
2696	TphxJHD.exe
3108	UKSWzpv.exe
3828	JYCWdmL.exe
4020	DzeqIDH.exe
956	VcRFpgy.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3492-0-0x00007FF62C5A0000-0x00007FF62C992000-memory.dmp	upx
behavioral2/files/0x000b000000023b8b-5.dat	upx
behavioral2/files/0x000a000000023b8f-8.dat	upx
behavioral2/files/0x000a000000023b90-7.dat	upx
behavioral2/memory/736-15-0x00007FF631BD0000-0x00007FF631FC2000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-47.dat	upx
behavioral2/memory/1476-56-0x00007FF63FA60000-0x00007FF63FE52000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-73.dat	upx
behavioral2/files/0x000a000000023b9a-89.dat	upx
behavioral2/files/0x000a000000023b9b-100.dat	upx
behavioral2/files/0x000a000000023ba5-120.dat	upx
behavioral2/files/0x000a000000023ba6-129.dat	upx
behavioral2/memory/4716-146-0x00007FF611840000-0x00007FF611C32000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-153.dat	upx
behavioral2/memory/3088-162-0x00007FF6ABC30000-0x00007FF6AC022000-memory.dmp	upx
behavioral2/memory/4972-175-0x00007FF7F4B00000-0x00007FF7F4EF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-184.dat	upx
behavioral2/files/0x000a000000023bad-196.dat	upx
behavioral2/memory/4780-211-0x00007FF66EBF0000-0x00007FF66EFE2000-memory.dmp	upx
behavioral2/memory/452-207-0x00007FF78FB50000-0x00007FF78FF42000-memory.dmp	upx
behavioral2/memory/4424-203-0x00007FF6DEE50000-0x00007FF6DF242000-memory.dmp	upx
behavioral2/memory/4832-199-0x00007FF6C4A30000-0x00007FF6C4E22000-memory.dmp	upx
behavioral2/memory/1656-193-0x00007FF696DC0000-0x00007FF6971B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-190.dat	upx
behavioral2/files/0x000a000000023baa-188.dat	upx
behavioral2/memory/2076-187-0x00007FF6EE450000-0x00007FF6EE842000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-182.dat	upx
behavioral2/memory/2248-181-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp	upx
behavioral2/files/0x000b000000023ba3-176.dat	upx
behavioral2/files/0x000b000000023ba4-170.dat	upx
behavioral2/memory/4536-168-0x00007FF737E00000-0x00007FF7381F2000-memory.dmp	upx
behavioral2/memory/4540-158-0x00007FF790B10000-0x00007FF790F02000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-156.dat	upx
behavioral2/memory/4272-152-0x00007FF694110000-0x00007FF694502000-memory.dmp	upx
behavioral2/files/0x000b000000023b8c-137.dat	upx
behavioral2/memory/1624-136-0x00007FF68BCE0000-0x00007FF68C0D2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba2-134.dat	upx
behavioral2/memory/2588-128-0x00007FF71F370000-0x00007FF71F762000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-126.dat	upx
behavioral2/files/0x000a000000023b9f-125.dat	upx
behavioral2/files/0x000a000000023b9e-124.dat	upx
behavioral2/files/0x000a000000023b9d-123.dat	upx
behavioral2/memory/4284-118-0x00007FF79B710000-0x00007FF79BB02000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-114.dat	upx
behavioral2/files/0x000a000000023ba1-112.dat	upx
behavioral2/memory/4544-97-0x00007FF651580000-0x00007FF651972000-memory.dmp	upx
behavioral2/memory/928-87-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp	upx
behavioral2/memory/3812-71-0x00007FF638490000-0x00007FF638882000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-68.dat	upx
behavioral2/files/0x000a000000023b97-64.dat	upx
behavioral2/files/0x000a000000023b94-58.dat	upx
behavioral2/files/0x000a000000023b96-55.dat	upx
behavioral2/memory/2816-50-0x00007FF65AE90000-0x00007FF65B282000-memory.dmp	upx
behavioral2/files/0x000a000000023b92-41.dat	upx
behavioral2/memory/1564-39-0x00007FF690020000-0x00007FF690412000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-35.dat	upx
behavioral2/memory/2932-27-0x00007FF7C2D50000-0x00007FF7C3142000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-26.dat	upx
behavioral2/memory/736-2015-0x00007FF631BD0000-0x00007FF631FC2000-memory.dmp	upx
behavioral2/memory/1564-2017-0x00007FF690020000-0x00007FF690412000-memory.dmp	upx
behavioral2/memory/2932-2016-0x00007FF7C2D50000-0x00007FF7C3142000-memory.dmp	upx
behavioral2/memory/3812-2019-0x00007FF638490000-0x00007FF638882000-memory.dmp	upx
behavioral2/memory/4544-2021-0x00007FF651580000-0x00007FF651972000-memory.dmp	upx
behavioral2/memory/928-2020-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BfkLYiZ.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\PtpMzfr.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\yOwmmjp.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\KehFjBs.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\ctuDoQI.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\Yaxdjvy.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\xkhscjb.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\tZvVtEe.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\rWODece.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\sTjxoIN.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\IJmWUVE.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\bAiVMdq.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\jAbuxFy.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\FEwYSBF.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\oTEYOml.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\QzCRYfX.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\BcHjsVt.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\xkfHNHK.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\yuxWaSN.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\OHPIzyg.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\RQnQWrO.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\RMUQQHH.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\LABUlgm.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\KhMwOTK.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\MTUlskh.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\aNRSQbj.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\UKSWzpv.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\MxRSsie.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\emfiYkb.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\zBWrYyv.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\dxZOigy.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\TcqmSxh.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\fecxxSY.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\HOVVcVD.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\rlsBSup.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\ZTqudIN.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\kGtBJwX.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\laDSAbz.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\QxNdmoY.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\GAJuLsm.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\ZyVolrY.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\keGjazg.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\oSRnVpc.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\qwEtBaJ.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\CpdPuiw.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\HyHVRiq.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\VJROxAH.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\rxxepoX.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\ulwLNBM.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\hfQOGSY.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\VaGhxUo.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\DKFrhEw.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\awREQxp.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\xIVzobp.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\SZUABGR.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\JgpXASH.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\VZYYDrf.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\CTwKISR.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\UAFzVMX.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\eyrWUSH.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\YTVrJZP.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\SVsiNTl.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\FOGbaXL.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
File created	C:\Windows\System\NNBOuNp.exe	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
376	powershell.exe
376	powershell.exe
376	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeLockMemoryPrivilege	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 376	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	84
PID 3492 wrote to memory of 376	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	84
PID 3492 wrote to memory of 736	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	85
PID 3492 wrote to memory of 736	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	85
PID 3492 wrote to memory of 4536	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	86
PID 3492 wrote to memory of 4536	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	86
PID 3492 wrote to memory of 2932	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	87
PID 3492 wrote to memory of 2932	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	87
PID 3492 wrote to memory of 1564	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	88
PID 3492 wrote to memory of 1564	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	88
PID 3492 wrote to memory of 2816	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	89
PID 3492 wrote to memory of 2816	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	89
PID 3492 wrote to memory of 1476	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	90
PID 3492 wrote to memory of 1476	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	90
PID 3492 wrote to memory of 2248	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	91
PID 3492 wrote to memory of 2248	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	91
PID 3492 wrote to memory of 3812	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	92
PID 3492 wrote to memory of 3812	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	92
PID 3492 wrote to memory of 4972	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	93
PID 3492 wrote to memory of 4972	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	93
PID 3492 wrote to memory of 928	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	94
PID 3492 wrote to memory of 928	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	94
PID 3492 wrote to memory of 2076	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	95
PID 3492 wrote to memory of 2076	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	95
PID 3492 wrote to memory of 4284	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	96
PID 3492 wrote to memory of 4284	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	96
PID 3492 wrote to memory of 4544	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	97
PID 3492 wrote to memory of 4544	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	97
PID 3492 wrote to memory of 1656	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	98
PID 3492 wrote to memory of 1656	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	98
PID 3492 wrote to memory of 2588	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	99
PID 3492 wrote to memory of 2588	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	99
PID 3492 wrote to memory of 4832	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	100
PID 3492 wrote to memory of 4832	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	100
PID 3492 wrote to memory of 1624	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	101
PID 3492 wrote to memory of 1624	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	101
PID 3492 wrote to memory of 4716	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	102
PID 3492 wrote to memory of 4716	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	102
PID 3492 wrote to memory of 4272	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	103
PID 3492 wrote to memory of 4272	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	103
PID 3492 wrote to memory of 4424	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	104
PID 3492 wrote to memory of 4424	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	104
PID 3492 wrote to memory of 4540	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	105
PID 3492 wrote to memory of 4540	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	105
PID 3492 wrote to memory of 452	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	106
PID 3492 wrote to memory of 452	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	106
PID 3492 wrote to memory of 3088	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	107
PID 3492 wrote to memory of 3088	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	107
PID 3492 wrote to memory of 4780	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	108
PID 3492 wrote to memory of 4780	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	108
PID 3492 wrote to memory of 3720	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	109
PID 3492 wrote to memory of 3720	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	109
PID 3492 wrote to memory of 2524	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	110
PID 3492 wrote to memory of 2524	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	110
PID 3492 wrote to memory of 864	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	111
PID 3492 wrote to memory of 864	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	111
PID 3492 wrote to memory of 2672	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	112
PID 3492 wrote to memory of 2672	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	112
PID 3492 wrote to memory of 1264	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	113
PID 3492 wrote to memory of 1264	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	113
PID 3492 wrote to memory of 3220	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	114
PID 3492 wrote to memory of 3220	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	114
PID 3492 wrote to memory of 4012	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	115
PID 3492 wrote to memory of 4012	3492	224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\224fbcdd51eeca33257c200d6f3cce3e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:376
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "376" "2936" "2872" "2940" "0" "0" "2944" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13532
- C:\Windows\System\IhfeqFB.exe
  C:\Windows\System\IhfeqFB.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\sSlNyTj.exe
  C:\Windows\System\sSlNyTj.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\GOFpJoR.exe
  C:\Windows\System\GOFpJoR.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\gVIOmRZ.exe
  C:\Windows\System\gVIOmRZ.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\rxxepoX.exe
  C:\Windows\System\rxxepoX.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\YQPYJpg.exe
  C:\Windows\System\YQPYJpg.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\PRFrzDl.exe
  C:\Windows\System\PRFrzDl.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\VSpsnuL.exe
  C:\Windows\System\VSpsnuL.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\qSITzFv.exe
  C:\Windows\System\qSITzFv.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\PgpoqeE.exe
  C:\Windows\System\PgpoqeE.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\ulwLNBM.exe
  C:\Windows\System\ulwLNBM.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\mELBTvo.exe
  C:\Windows\System\mELBTvo.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\hNnxMrU.exe
  C:\Windows\System\hNnxMrU.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\avdMJln.exe
  C:\Windows\System\avdMJln.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\vczFaXg.exe
  C:\Windows\System\vczFaXg.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\OziuLTq.exe
  C:\Windows\System\OziuLTq.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\zhuOCBu.exe
  C:\Windows\System\zhuOCBu.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\OsPcmWP.exe
  C:\Windows\System\OsPcmWP.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\vKZwAoH.exe
  C:\Windows\System\vKZwAoH.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\TGgrPpX.exe
  C:\Windows\System\TGgrPpX.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\tPjuMEU.exe
  C:\Windows\System\tPjuMEU.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\FMlhcGs.exe
  C:\Windows\System\FMlhcGs.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\rdhjODh.exe
  C:\Windows\System\rdhjODh.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\tYjXLxN.exe
  C:\Windows\System\tYjXLxN.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\Iwbovkx.exe
  C:\Windows\System\Iwbovkx.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\mwAgFXp.exe
  C:\Windows\System\mwAgFXp.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\EKOeRdG.exe
  C:\Windows\System\EKOeRdG.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\PtmjMVg.exe
  C:\Windows\System\PtmjMVg.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\GGzOjjw.exe
  C:\Windows\System\GGzOjjw.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\vwJWlcP.exe
  C:\Windows\System\vwJWlcP.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\PiKIQox.exe
  C:\Windows\System\PiKIQox.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\yGSeUCc.exe
  C:\Windows\System\yGSeUCc.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\jOwXfhv.exe
  C:\Windows\System\jOwXfhv.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\fEBrjOL.exe
  C:\Windows\System\fEBrjOL.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\duAVCRZ.exe
  C:\Windows\System\duAVCRZ.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\KoqZEuP.exe
  C:\Windows\System\KoqZEuP.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\SfefyUu.exe
  C:\Windows\System\SfefyUu.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\qMDggQn.exe
  C:\Windows\System\qMDggQn.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\cVmqncU.exe
  C:\Windows\System\cVmqncU.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\CNsLDvL.exe
  C:\Windows\System\CNsLDvL.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\NFAYrbb.exe
  C:\Windows\System\NFAYrbb.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\OfgWorN.exe
  C:\Windows\System\OfgWorN.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\aNekkbJ.exe
  C:\Windows\System\aNekkbJ.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\eYXAJBs.exe
  C:\Windows\System\eYXAJBs.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\iXMtcKc.exe
  C:\Windows\System\iXMtcKc.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\axiIhmf.exe
  C:\Windows\System\axiIhmf.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\WpxiVQo.exe
  C:\Windows\System\WpxiVQo.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\hfQOGSY.exe
  C:\Windows\System\hfQOGSY.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\Lxefpby.exe
  C:\Windows\System\Lxefpby.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\wzhqosm.exe
  C:\Windows\System\wzhqosm.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\dQMZSNf.exe
  C:\Windows\System\dQMZSNf.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\afarTdQ.exe
  C:\Windows\System\afarTdQ.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\DLRybiQ.exe
  C:\Windows\System\DLRybiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\gMIitXm.exe
  C:\Windows\System\gMIitXm.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\LZbDjrB.exe
  C:\Windows\System\LZbDjrB.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\MwMGnNn.exe
  C:\Windows\System\MwMGnNn.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\YCyNqih.exe
  C:\Windows\System\YCyNqih.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\sfaUIaB.exe
  C:\Windows\System\sfaUIaB.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\myzCtRa.exe
  C:\Windows\System\myzCtRa.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\TphxJHD.exe
  C:\Windows\System\TphxJHD.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\UKSWzpv.exe
  C:\Windows\System\UKSWzpv.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\JYCWdmL.exe
  C:\Windows\System\JYCWdmL.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\DzeqIDH.exe
  C:\Windows\System\DzeqIDH.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\VcRFpgy.exe
  C:\Windows\System\VcRFpgy.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\jAbuxFy.exe
  C:\Windows\System\jAbuxFy.exe
  2⤵
  PID:8
- C:\Windows\System\IqfdjcG.exe
  C:\Windows\System\IqfdjcG.exe
  2⤵
  PID:544
- C:\Windows\System\NvWydpz.exe
  C:\Windows\System\NvWydpz.exe
  2⤵
  PID:5152
- C:\Windows\System\dJthGgc.exe
  C:\Windows\System\dJthGgc.exe
  2⤵
  PID:5180
- C:\Windows\System\FeEbkRH.exe
  C:\Windows\System\FeEbkRH.exe
  2⤵
  PID:5208
- C:\Windows\System\mqyKAUF.exe
  C:\Windows\System\mqyKAUF.exe
  2⤵
  PID:5236
- C:\Windows\System\RVgyxVo.exe
  C:\Windows\System\RVgyxVo.exe
  2⤵
  PID:5264
- C:\Windows\System\jSXUXZP.exe
  C:\Windows\System\jSXUXZP.exe
  2⤵
  PID:5292
- C:\Windows\System\HrzMKib.exe
  C:\Windows\System\HrzMKib.exe
  2⤵
  PID:5320
- C:\Windows\System\PAupRVK.exe
  C:\Windows\System\PAupRVK.exe
  2⤵
  PID:5352
- C:\Windows\System\CxRAALb.exe
  C:\Windows\System\CxRAALb.exe
  2⤵
  PID:5380
- C:\Windows\System\CqstUDe.exe
  C:\Windows\System\CqstUDe.exe
  2⤵
  PID:5408
- C:\Windows\System\TpGBNgH.exe
  C:\Windows\System\TpGBNgH.exe
  2⤵
  PID:5432
- C:\Windows\System\wXavfEd.exe
  C:\Windows\System\wXavfEd.exe
  2⤵
  PID:5464
- C:\Windows\System\VFqjOYI.exe
  C:\Windows\System\VFqjOYI.exe
  2⤵
  PID:5492
- C:\Windows\System\KhykURV.exe
  C:\Windows\System\KhykURV.exe
  2⤵
  PID:5520
- C:\Windows\System\Yaxdjvy.exe
  C:\Windows\System\Yaxdjvy.exe
  2⤵
  PID:5548
- C:\Windows\System\MRFmKjK.exe
  C:\Windows\System\MRFmKjK.exe
  2⤵
  PID:5576
- C:\Windows\System\CGfVAfk.exe
  C:\Windows\System\CGfVAfk.exe
  2⤵
  PID:5604
- C:\Windows\System\UvnjPgT.exe
  C:\Windows\System\UvnjPgT.exe
  2⤵
  PID:5632
- C:\Windows\System\rNtYxoH.exe
  C:\Windows\System\rNtYxoH.exe
  2⤵
  PID:5656
- C:\Windows\System\xxrqZmQ.exe
  C:\Windows\System\xxrqZmQ.exe
  2⤵
  PID:5688
- C:\Windows\System\cdcqfEp.exe
  C:\Windows\System\cdcqfEp.exe
  2⤵
  PID:5716
- C:\Windows\System\FpYVSEt.exe
  C:\Windows\System\FpYVSEt.exe
  2⤵
  PID:5740
- C:\Windows\System\QdayVkZ.exe
  C:\Windows\System\QdayVkZ.exe
  2⤵
  PID:5772
- C:\Windows\System\NCNnEzf.exe
  C:\Windows\System\NCNnEzf.exe
  2⤵
  PID:5800
- C:\Windows\System\jZMyAtS.exe
  C:\Windows\System\jZMyAtS.exe
  2⤵
  PID:5828
- C:\Windows\System\tobzoDO.exe
  C:\Windows\System\tobzoDO.exe
  2⤵
  PID:5852
- C:\Windows\System\eYRlnQT.exe
  C:\Windows\System\eYRlnQT.exe
  2⤵
  PID:5884
- C:\Windows\System\khJZSRd.exe
  C:\Windows\System\khJZSRd.exe
  2⤵
  PID:5912
- C:\Windows\System\wqoqGDE.exe
  C:\Windows\System\wqoqGDE.exe
  2⤵
  PID:5940
- C:\Windows\System\wlFhXHF.exe
  C:\Windows\System\wlFhXHF.exe
  2⤵
  PID:5968
- C:\Windows\System\QAIQMWh.exe
  C:\Windows\System\QAIQMWh.exe
  2⤵
  PID:5996
- C:\Windows\System\pdcpkpo.exe
  C:\Windows\System\pdcpkpo.exe
  2⤵
  PID:6020
- C:\Windows\System\WQGgqcN.exe
  C:\Windows\System\WQGgqcN.exe
  2⤵
  PID:6052
- C:\Windows\System\pIjomvD.exe
  C:\Windows\System\pIjomvD.exe
  2⤵
  PID:6080
- C:\Windows\System\DLsAOQG.exe
  C:\Windows\System\DLsAOQG.exe
  2⤵
  PID:6108
- C:\Windows\System\ZTqudIN.exe
  C:\Windows\System\ZTqudIN.exe
  2⤵
  PID:6136
- C:\Windows\System\WmzTWlO.exe
  C:\Windows\System\WmzTWlO.exe
  2⤵
  PID:3840
- C:\Windows\System\SyXFDAZ.exe
  C:\Windows\System\SyXFDAZ.exe
  2⤵
  PID:1852
- C:\Windows\System\KhMwOTK.exe
  C:\Windows\System\KhMwOTK.exe
  2⤵
  PID:5096
- C:\Windows\System\eyrWUSH.exe
  C:\Windows\System\eyrWUSH.exe
  2⤵
  PID:1632
- C:\Windows\System\OFKwpOH.exe
  C:\Windows\System\OFKwpOH.exe
  2⤵
  PID:4740
- C:\Windows\System\qBqnXgJ.exe
  C:\Windows\System\qBqnXgJ.exe
  2⤵
  PID:5176
- C:\Windows\System\BcHjsVt.exe
  C:\Windows\System\BcHjsVt.exe
  2⤵
  PID:5224
- C:\Windows\System\AAIZbXo.exe
  C:\Windows\System\AAIZbXo.exe
  2⤵
  PID:4788
- C:\Windows\System\KaMEvGV.exe
  C:\Windows\System\KaMEvGV.exe
  2⤵
  PID:3460
- C:\Windows\System\ycQghUK.exe
  C:\Windows\System\ycQghUK.exe
  2⤵
  PID:5396
- C:\Windows\System\FGFDASn.exe
  C:\Windows\System\FGFDASn.exe
  2⤵
  PID:5452
- C:\Windows\System\MecdDLL.exe
  C:\Windows\System\MecdDLL.exe
  2⤵
  PID:5484
- C:\Windows\System\CZTzqrp.exe
  C:\Windows\System\CZTzqrp.exe
  2⤵
  PID:5560
- C:\Windows\System\FEwYSBF.exe
  C:\Windows\System\FEwYSBF.exe
  2⤵
  PID:5616
- C:\Windows\System\GciURqm.exe
  C:\Windows\System\GciURqm.exe
  2⤵
  PID:5676
- C:\Windows\System\ASRcsQD.exe
  C:\Windows\System\ASRcsQD.exe
  2⤵
  PID:1460
- C:\Windows\System\jbIlRDY.exe
  C:\Windows\System\jbIlRDY.exe
  2⤵
  PID:5760
- C:\Windows\System\KuHJuCW.exe
  C:\Windows\System\KuHJuCW.exe
  2⤵
  PID:5840
- C:\Windows\System\DaylUNL.exe
  C:\Windows\System\DaylUNL.exe
  2⤵
  PID:5868
- C:\Windows\System\zBWrYyv.exe
  C:\Windows\System\zBWrYyv.exe
  2⤵
  PID:5928
- C:\Windows\System\CJkxdFu.exe
  C:\Windows\System\CJkxdFu.exe
  2⤵
  PID:5984
- C:\Windows\System\lmcICZx.exe
  C:\Windows\System\lmcICZx.exe
  2⤵
  PID:6012
- C:\Windows\System\CMxGOtf.exe
  C:\Windows\System\CMxGOtf.exe
  2⤵
  PID:5112
- C:\Windows\System\OKQcOKp.exe
  C:\Windows\System\OKQcOKp.exe
  2⤵
  PID:3540
- C:\Windows\System\RTkQdTY.exe
  C:\Windows\System\RTkQdTY.exe
  2⤵
  PID:4856
- C:\Windows\System\rFKMeJb.exe
  C:\Windows\System\rFKMeJb.exe
  2⤵
  PID:2624
- C:\Windows\System\WanHoUZ.exe
  C:\Windows\System\WanHoUZ.exe
  2⤵
  PID:5196
- C:\Windows\System\MAjxGBN.exe
  C:\Windows\System\MAjxGBN.exe
  2⤵
  PID:5280
- C:\Windows\System\MxRSsie.exe
  C:\Windows\System\MxRSsie.exe
  2⤵
  PID:5368
- C:\Windows\System\NxKmvGU.exe
  C:\Windows\System\NxKmvGU.exe
  2⤵
  PID:3236
- C:\Windows\System\uZyABiW.exe
  C:\Windows\System\uZyABiW.exe
  2⤵
  PID:5536
- C:\Windows\System\qtttnxf.exe
  C:\Windows\System\qtttnxf.exe
  2⤵
  PID:5040
- C:\Windows\System\bdrObpG.exe
  C:\Windows\System\bdrObpG.exe
  2⤵
  PID:5708
- C:\Windows\System\AUvkiMD.exe
  C:\Windows\System\AUvkiMD.exe
  2⤵
  PID:3196
- C:\Windows\System\CFxeZxg.exe
  C:\Windows\System\CFxeZxg.exe
  2⤵
  PID:3764
- C:\Windows\System\zmgtuzg.exe
  C:\Windows\System\zmgtuzg.exe
  2⤵
  PID:5816
- C:\Windows\System\HYMgySW.exe
  C:\Windows\System\HYMgySW.exe
  2⤵
  PID:5904
- C:\Windows\System\lhtKqhG.exe
  C:\Windows\System\lhtKqhG.exe
  2⤵
  PID:2288
- C:\Windows\System\NzilNlq.exe
  C:\Windows\System\NzilNlq.exe
  2⤵
  PID:5980
- C:\Windows\System\ZkZrNQF.exe
  C:\Windows\System\ZkZrNQF.exe
  2⤵
  PID:3352
- C:\Windows\System\yWRqHDK.exe
  C:\Windows\System\yWRqHDK.exe
  2⤵
  PID:1912
- C:\Windows\System\fxUGxXn.exe
  C:\Windows\System\fxUGxXn.exe
  2⤵
  PID:4084
- C:\Windows\System\groBIPF.exe
  C:\Windows\System\groBIPF.exe
  2⤵
  PID:5140
- C:\Windows\System\rocfwss.exe
  C:\Windows\System\rocfwss.exe
  2⤵
  PID:5428
- C:\Windows\System\msgYnDE.exe
  C:\Windows\System\msgYnDE.exe
  2⤵
  PID:1496
- C:\Windows\System\IsFJwFQ.exe
  C:\Windows\System\IsFJwFQ.exe
  2⤵
  PID:4820
- C:\Windows\System\GAJuLsm.exe
  C:\Windows\System\GAJuLsm.exe
  2⤵
  PID:2612
- C:\Windows\System\HyEpnpi.exe
  C:\Windows\System\HyEpnpi.exe
  2⤵
  PID:1368
- C:\Windows\System\ANjzBfn.exe
  C:\Windows\System\ANjzBfn.exe
  2⤵
  PID:5364
- C:\Windows\System\tYMeLbd.exe
  C:\Windows\System\tYMeLbd.exe
  2⤵
  PID:4064
- C:\Windows\System\KbbRHRH.exe
  C:\Windows\System\KbbRHRH.exe
  2⤵
  PID:4376
- C:\Windows\System\ZLYyJze.exe
  C:\Windows\System\ZLYyJze.exe
  2⤵
  PID:4940
- C:\Windows\System\zWTFNNB.exe
  C:\Windows\System\zWTFNNB.exe
  2⤵
  PID:5308
- C:\Windows\System\PrnAxUP.exe
  C:\Windows\System\PrnAxUP.exe
  2⤵
  PID:5736
- C:\Windows\System\uvhytqB.exe
  C:\Windows\System\uvhytqB.exe
  2⤵
  PID:6148
- C:\Windows\System\fJhlXga.exe
  C:\Windows\System\fJhlXga.exe
  2⤵
  PID:6168
- C:\Windows\System\GOaEFLe.exe
  C:\Windows\System\GOaEFLe.exe
  2⤵
  PID:6212
- C:\Windows\System\yBtrlxP.exe
  C:\Windows\System\yBtrlxP.exe
  2⤵
  PID:6232
- C:\Windows\System\kavlKyI.exe
  C:\Windows\System\kavlKyI.exe
  2⤵
  PID:6252
- C:\Windows\System\wIxOyMc.exe
  C:\Windows\System\wIxOyMc.exe
  2⤵
  PID:6272
- C:\Windows\System\ALudPId.exe
  C:\Windows\System\ALudPId.exe
  2⤵
  PID:6308
- C:\Windows\System\SIUBZGr.exe
  C:\Windows\System\SIUBZGr.exe
  2⤵
  PID:6340
- C:\Windows\System\SZUABGR.exe
  C:\Windows\System\SZUABGR.exe
  2⤵
  PID:6364
- C:\Windows\System\nFxqbSc.exe
  C:\Windows\System\nFxqbSc.exe
  2⤵
  PID:6380
- C:\Windows\System\vAIdZtS.exe
  C:\Windows\System\vAIdZtS.exe
  2⤵
  PID:6400
- C:\Windows\System\KdkqVxv.exe
  C:\Windows\System\KdkqVxv.exe
  2⤵
  PID:6416
- C:\Windows\System\VUgBphC.exe
  C:\Windows\System\VUgBphC.exe
  2⤵
  PID:6456
- C:\Windows\System\TcZarho.exe
  C:\Windows\System\TcZarho.exe
  2⤵
  PID:6488
- C:\Windows\System\zKDIksW.exe
  C:\Windows\System\zKDIksW.exe
  2⤵
  PID:6512
- C:\Windows\System\oSRnVpc.exe
  C:\Windows\System\oSRnVpc.exe
  2⤵
  PID:6532
- C:\Windows\System\afkQDUa.exe
  C:\Windows\System\afkQDUa.exe
  2⤵
  PID:6552
- C:\Windows\System\IyeAdnO.exe
  C:\Windows\System\IyeAdnO.exe
  2⤵
  PID:6572
- C:\Windows\System\RPTcCOj.exe
  C:\Windows\System\RPTcCOj.exe
  2⤵
  PID:6592
- C:\Windows\System\vPEiTLo.exe
  C:\Windows\System\vPEiTLo.exe
  2⤵
  PID:6640
- C:\Windows\System\OIXAojm.exe
  C:\Windows\System\OIXAojm.exe
  2⤵
  PID:6720
- C:\Windows\System\JWYQMSn.exe
  C:\Windows\System\JWYQMSn.exe
  2⤵
  PID:6768
- C:\Windows\System\UcMFUgz.exe
  C:\Windows\System\UcMFUgz.exe
  2⤵
  PID:6784
- C:\Windows\System\VhdSxUX.exe
  C:\Windows\System\VhdSxUX.exe
  2⤵
  PID:6808
- C:\Windows\System\FGgxhux.exe
  C:\Windows\System\FGgxhux.exe
  2⤵
  PID:6836
- C:\Windows\System\wbffckq.exe
  C:\Windows\System\wbffckq.exe
  2⤵
  PID:6864
- C:\Windows\System\vJlgHZt.exe
  C:\Windows\System\vJlgHZt.exe
  2⤵
  PID:6912
- C:\Windows\System\YnrUuXP.exe
  C:\Windows\System\YnrUuXP.exe
  2⤵
  PID:6952
- C:\Windows\System\lFWGiak.exe
  C:\Windows\System\lFWGiak.exe
  2⤵
  PID:6968
- C:\Windows\System\DFsdLia.exe
  C:\Windows\System\DFsdLia.exe
  2⤵
  PID:7004
- C:\Windows\System\ypGrkBx.exe
  C:\Windows\System\ypGrkBx.exe
  2⤵
  PID:7020
- C:\Windows\System\mDuYHwU.exe
  C:\Windows\System\mDuYHwU.exe
  2⤵
  PID:7040
- C:\Windows\System\NdxBsQY.exe
  C:\Windows\System\NdxBsQY.exe
  2⤵
  PID:7060
- C:\Windows\System\VxaqAos.exe
  C:\Windows\System\VxaqAos.exe
  2⤵
  PID:7088
- C:\Windows\System\tLWPGsK.exe
  C:\Windows\System\tLWPGsK.exe
  2⤵
  PID:7124
- C:\Windows\System\eFFqlDw.exe
  C:\Windows\System\eFFqlDw.exe
  2⤵
  PID:7140
- C:\Windows\System\yYKpwEe.exe
  C:\Windows\System\yYKpwEe.exe
  2⤵
  PID:6160
- C:\Windows\System\JgpXASH.exe
  C:\Windows\System\JgpXASH.exe
  2⤵
  PID:2644
- C:\Windows\System\kGtBJwX.exe
  C:\Windows\System\kGtBJwX.exe
  2⤵
  PID:6200
- C:\Windows\System\HJDfcmJ.exe
  C:\Windows\System\HJDfcmJ.exe
  2⤵
  PID:6224
- C:\Windows\System\JOhbdfZ.exe
  C:\Windows\System\JOhbdfZ.exe
  2⤵
  PID:6336
- C:\Windows\System\RfbOUEH.exe
  C:\Windows\System\RfbOUEH.exe
  2⤵
  PID:6372
- C:\Windows\System\DZpfPQl.exe
  C:\Windows\System\DZpfPQl.exe
  2⤵
  PID:6412
- C:\Windows\System\TYpLPDf.exe
  C:\Windows\System\TYpLPDf.exe
  2⤵
  PID:6472
- C:\Windows\System\laDSAbz.exe
  C:\Windows\System\laDSAbz.exe
  2⤵
  PID:6564
- C:\Windows\System\oTEYOml.exe
  C:\Windows\System\oTEYOml.exe
  2⤵
  PID:6632
- C:\Windows\System\EsofLNQ.exe
  C:\Windows\System\EsofLNQ.exe
  2⤵
  PID:6656
- C:\Windows\System\LYdMwRo.exe
  C:\Windows\System\LYdMwRo.exe
  2⤵
  PID:6796
- C:\Windows\System\MrAsvzE.exe
  C:\Windows\System\MrAsvzE.exe
  2⤵
  PID:6844
- C:\Windows\System\xkhscjb.exe
  C:\Windows\System\xkhscjb.exe
  2⤵
  PID:6904
- C:\Windows\System\CcAfQsl.exe
  C:\Windows\System\CcAfQsl.exe
  2⤵
  PID:6960
- C:\Windows\System\NPsLwWN.exe
  C:\Windows\System\NPsLwWN.exe
  2⤵
  PID:6988
- C:\Windows\System\HcmfeSR.exe
  C:\Windows\System\HcmfeSR.exe
  2⤵
  PID:7036
- C:\Windows\System\vGVjdBz.exe
  C:\Windows\System\vGVjdBz.exe
  2⤵
  PID:7052
- C:\Windows\System\CcmntSj.exe
  C:\Windows\System\CcmntSj.exe
  2⤵
  PID:7136
- C:\Windows\System\WyKMRVX.exe
  C:\Windows\System\WyKMRVX.exe
  2⤵
  PID:6156
- C:\Windows\System\WemKJcE.exe
  C:\Windows\System\WemKJcE.exe
  2⤵
  PID:5012
- C:\Windows\System\HUBJxRh.exe
  C:\Windows\System\HUBJxRh.exe
  2⤵
  PID:6348
- C:\Windows\System\DNFYDIC.exe
  C:\Windows\System\DNFYDIC.exe
  2⤵
  PID:6396
- C:\Windows\System\pGhvfGB.exe
  C:\Windows\System\pGhvfGB.exe
  2⤵
  PID:3452
- C:\Windows\System\fQZFeBe.exe
  C:\Windows\System\fQZFeBe.exe
  2⤵
  PID:6628
- C:\Windows\System\ZyVolrY.exe
  C:\Windows\System\ZyVolrY.exe
  2⤵
  PID:6780
- C:\Windows\System\LpcflEM.exe
  C:\Windows\System\LpcflEM.exe
  2⤵
  PID:6948
- C:\Windows\System\fGQrfmh.exe
  C:\Windows\System\fGQrfmh.exe
  2⤵
  PID:6924
- C:\Windows\System\PNeyuDv.exe
  C:\Windows\System\PNeyuDv.exe
  2⤵
  PID:4996
- C:\Windows\System\Guoeltw.exe
  C:\Windows\System\Guoeltw.exe
  2⤵
  PID:7212
- C:\Windows\System\UaUYIKI.exe
  C:\Windows\System\UaUYIKI.exe
  2⤵
  PID:7228
- C:\Windows\System\ZIzZGCL.exe
  C:\Windows\System\ZIzZGCL.exe
  2⤵
  PID:7252
- C:\Windows\System\icDQcEC.exe
  C:\Windows\System\icDQcEC.exe
  2⤵
  PID:7320
- C:\Windows\System\gVHCATo.exe
  C:\Windows\System\gVHCATo.exe
  2⤵
  PID:7408
- C:\Windows\System\mpfavnd.exe
  C:\Windows\System\mpfavnd.exe
  2⤵
  PID:7436
- C:\Windows\System\uloHwbS.exe
  C:\Windows\System\uloHwbS.exe
  2⤵
  PID:7456
- C:\Windows\System\keGjazg.exe
  C:\Windows\System\keGjazg.exe
  2⤵
  PID:7500
- C:\Windows\System\kvPvFCd.exe
  C:\Windows\System\kvPvFCd.exe
  2⤵
  PID:7532
- C:\Windows\System\fecxxSY.exe
  C:\Windows\System\fecxxSY.exe
  2⤵
  PID:7552
- C:\Windows\System\TieGhKk.exe
  C:\Windows\System\TieGhKk.exe
  2⤵
  PID:7576
- C:\Windows\System\KAILSao.exe
  C:\Windows\System\KAILSao.exe
  2⤵
  PID:7616
- C:\Windows\System\MTUlskh.exe
  C:\Windows\System\MTUlskh.exe
  2⤵
  PID:7660
- C:\Windows\System\FOGbaXL.exe
  C:\Windows\System\FOGbaXL.exe
  2⤵
  PID:7688
- C:\Windows\System\pHzYYkF.exe
  C:\Windows\System\pHzYYkF.exe
  2⤵
  PID:7704
- C:\Windows\System\bcvUZQO.exe
  C:\Windows\System\bcvUZQO.exe
  2⤵
  PID:7732
- C:\Windows\System\rZLTpIP.exe
  C:\Windows\System\rZLTpIP.exe
  2⤵
  PID:7748
- C:\Windows\System\moxFRcT.exe
  C:\Windows\System\moxFRcT.exe
  2⤵
  PID:7772
- C:\Windows\System\JUDyPNG.exe
  C:\Windows\System\JUDyPNG.exe
  2⤵
  PID:7792
- C:\Windows\System\aNRSQbj.exe
  C:\Windows\System\aNRSQbj.exe
  2⤵
  PID:7812
- C:\Windows\System\nwCqcxb.exe
  C:\Windows\System\nwCqcxb.exe
  2⤵
  PID:7836
- C:\Windows\System\GyPxZml.exe
  C:\Windows\System\GyPxZml.exe
  2⤵
  PID:7852
- C:\Windows\System\hmDpYAb.exe
  C:\Windows\System\hmDpYAb.exe
  2⤵
  PID:7876
- C:\Windows\System\prkhoeb.exe
  C:\Windows\System\prkhoeb.exe
  2⤵
  PID:7896
- C:\Windows\System\yQkXpSy.exe
  C:\Windows\System\yQkXpSy.exe
  2⤵
  PID:7980
- C:\Windows\System\FvZQWNf.exe
  C:\Windows\System\FvZQWNf.exe
  2⤵
  PID:8000
- C:\Windows\System\HJVGiBd.exe
  C:\Windows\System\HJVGiBd.exe
  2⤵
  PID:8036
- C:\Windows\System\ZxlpCUK.exe
  C:\Windows\System\ZxlpCUK.exe
  2⤵
  PID:8056
- C:\Windows\System\jXrPcin.exe
  C:\Windows\System\jXrPcin.exe
  2⤵
  PID:8080
- C:\Windows\System\bbNhBMr.exe
  C:\Windows\System\bbNhBMr.exe
  2⤵
  PID:8124
- C:\Windows\System\qwEtBaJ.exe
  C:\Windows\System\qwEtBaJ.exe
  2⤵
  PID:8160
- C:\Windows\System\gsXLQfw.exe
  C:\Windows\System\gsXLQfw.exe
  2⤵
  PID:8184
- C:\Windows\System\ekfqnVF.exe
  C:\Windows\System\ekfqnVF.exe
  2⤵
  PID:5276
- C:\Windows\System\XnfDXoB.exe
  C:\Windows\System\XnfDXoB.exe
  2⤵
  PID:6688
- C:\Windows\System\hOGbzot.exe
  C:\Windows\System\hOGbzot.exe
  2⤵
  PID:6480
- C:\Windows\System\WHhJZro.exe
  C:\Windows\System\WHhJZro.exe
  2⤵
  PID:6976
- C:\Windows\System\XKUNdjh.exe
  C:\Windows\System\XKUNdjh.exe
  2⤵
  PID:7236
- C:\Windows\System\FVXosWV.exe
  C:\Windows\System\FVXosWV.exe
  2⤵
  PID:7248
- C:\Windows\System\JyvaqkR.exe
  C:\Windows\System\JyvaqkR.exe
  2⤵
  PID:7428
- C:\Windows\System\sFBuHIg.exe
  C:\Windows\System\sFBuHIg.exe
  2⤵
  PID:7392
- C:\Windows\System\rWhDApd.exe
  C:\Windows\System\rWhDApd.exe
  2⤵
  PID:7496
- C:\Windows\System\eFolzhF.exe
  C:\Windows\System\eFolzhF.exe
  2⤵
  PID:7572
- C:\Windows\System\uyAJjvW.exe
  C:\Windows\System\uyAJjvW.exe
  2⤵
  PID:7680
- C:\Windows\System\CUALVGw.exe
  C:\Windows\System\CUALVGw.exe
  2⤵
  PID:7760
- C:\Windows\System\ClOPxpp.exe
  C:\Windows\System\ClOPxpp.exe
  2⤵
  PID:7888
- C:\Windows\System\yvmCGkh.exe
  C:\Windows\System\yvmCGkh.exe
  2⤵
  PID:7860
- C:\Windows\System\XbhMwPr.exe
  C:\Windows\System\XbhMwPr.exe
  2⤵
  PID:7948
- C:\Windows\System\HKERoky.exe
  C:\Windows\System\HKERoky.exe
  2⤵
  PID:7968
- C:\Windows\System\LpYevwq.exe
  C:\Windows\System\LpYevwq.exe
  2⤵
  PID:8116
- C:\Windows\System\YhOwmHy.exe
  C:\Windows\System\YhOwmHy.exe
  2⤵
  PID:8072
- C:\Windows\System\YTVrJZP.exe
  C:\Windows\System\YTVrJZP.exe
  2⤵
  PID:8168
- C:\Windows\System\AaIlxOW.exe
  C:\Windows\System\AaIlxOW.exe
  2⤵
  PID:4404
- C:\Windows\System\uucHUGY.exe
  C:\Windows\System\uucHUGY.exe
  2⤵
  PID:2788
- C:\Windows\System\CGpVtiT.exe
  C:\Windows\System\CGpVtiT.exe
  2⤵
  PID:7336
- C:\Windows\System\OHPIzyg.exe
  C:\Windows\System\OHPIzyg.exe
  2⤵
  PID:7560
- C:\Windows\System\OaJFNYl.exe
  C:\Windows\System\OaJFNYl.exe
  2⤵
  PID:7656
- C:\Windows\System\DReuIsD.exe
  C:\Windows\System\DReuIsD.exe
  2⤵
  PID:7844
- C:\Windows\System\BBDeKjn.exe
  C:\Windows\System\BBDeKjn.exe
  2⤵
  PID:7944
- C:\Windows\System\rhbayqM.exe
  C:\Windows\System\rhbayqM.exe
  2⤵
  PID:8032
- C:\Windows\System\nGySuLv.exe
  C:\Windows\System\nGySuLv.exe
  2⤵
  PID:7104
- C:\Windows\System\yfLZznZ.exe
  C:\Windows\System\yfLZznZ.exe
  2⤵
  PID:7508
- C:\Windows\System\QiiJIsT.exe
  C:\Windows\System\QiiJIsT.exe
  2⤵
  PID:7528
- C:\Windows\System\KJwjpPk.exe
  C:\Windows\System\KJwjpPk.exe
  2⤵
  PID:7744
- C:\Windows\System\NNBOuNp.exe
  C:\Windows\System\NNBOuNp.exe
  2⤵
  PID:8220
- C:\Windows\System\vPjksYT.exe
  C:\Windows\System\vPjksYT.exe
  2⤵
  PID:8260
- C:\Windows\System\wrNlQeR.exe
  C:\Windows\System\wrNlQeR.exe
  2⤵
  PID:8276
- C:\Windows\System\tArqVwk.exe
  C:\Windows\System\tArqVwk.exe
  2⤵
  PID:8300
- C:\Windows\System\KbyMTvg.exe
  C:\Windows\System\KbyMTvg.exe
  2⤵
  PID:8324
- C:\Windows\System\YIHxwOM.exe
  C:\Windows\System\YIHxwOM.exe
  2⤵
  PID:8344
- C:\Windows\System\VJiWOXA.exe
  C:\Windows\System\VJiWOXA.exe
  2⤵
  PID:8400
- C:\Windows\System\UJgSJSq.exe
  C:\Windows\System\UJgSJSq.exe
  2⤵
  PID:8416
- C:\Windows\System\kwOBVcS.exe
  C:\Windows\System\kwOBVcS.exe
  2⤵
  PID:8460
- C:\Windows\System\HOVVcVD.exe
  C:\Windows\System\HOVVcVD.exe
  2⤵
  PID:8504
- C:\Windows\System\ZFIKtqQ.exe
  C:\Windows\System\ZFIKtqQ.exe
  2⤵
  PID:8528
- C:\Windows\System\UtOutsl.exe
  C:\Windows\System\UtOutsl.exe
  2⤵
  PID:8544
- C:\Windows\System\bsvauAH.exe
  C:\Windows\System\bsvauAH.exe
  2⤵
  PID:8568
- C:\Windows\System\SVsiNTl.exe
  C:\Windows\System\SVsiNTl.exe
  2⤵
  PID:8588
- C:\Windows\System\PYXlWGN.exe
  C:\Windows\System\PYXlWGN.exe
  2⤵
  PID:8640
- C:\Windows\System\MhtmHFv.exe
  C:\Windows\System\MhtmHFv.exe
  2⤵
  PID:8676
- C:\Windows\System\xkfHNHK.exe
  C:\Windows\System\xkfHNHK.exe
  2⤵
  PID:8692
- C:\Windows\System\ZUEAMUp.exe
  C:\Windows\System\ZUEAMUp.exe
  2⤵
  PID:8724
- C:\Windows\System\NqzrZYx.exe
  C:\Windows\System\NqzrZYx.exe
  2⤵
  PID:8740
- C:\Windows\System\cbnyeAr.exe
  C:\Windows\System\cbnyeAr.exe
  2⤵
  PID:8780
- C:\Windows\System\ADrtZIR.exe
  C:\Windows\System\ADrtZIR.exe
  2⤵
  PID:8812
- C:\Windows\System\VZKjbgf.exe
  C:\Windows\System\VZKjbgf.exe
  2⤵
  PID:8836
- C:\Windows\System\tZvVtEe.exe
  C:\Windows\System\tZvVtEe.exe
  2⤵
  PID:8860
- C:\Windows\System\foMWdnB.exe
  C:\Windows\System\foMWdnB.exe
  2⤵
  PID:8876
- C:\Windows\System\RSiQtuw.exe
  C:\Windows\System\RSiQtuw.exe
  2⤵
  PID:8896
- C:\Windows\System\yyBJCVE.exe
  C:\Windows\System\yyBJCVE.exe
  2⤵
  PID:8916
- C:\Windows\System\GmZRhDn.exe
  C:\Windows\System\GmZRhDn.exe
  2⤵
  PID:8936
- C:\Windows\System\LCwzoGK.exe
  C:\Windows\System\LCwzoGK.exe
  2⤵
  PID:8984
- C:\Windows\System\gVYkClW.exe
  C:\Windows\System\gVYkClW.exe
  2⤵
  PID:9016
- C:\Windows\System\BfkLYiZ.exe
  C:\Windows\System\BfkLYiZ.exe
  2⤵
  PID:9068
- C:\Windows\System\kjSyCxi.exe
  C:\Windows\System\kjSyCxi.exe
  2⤵
  PID:9108
- C:\Windows\System\odWcMhX.exe
  C:\Windows\System\odWcMhX.exe
  2⤵
  PID:9140
- C:\Windows\System\ghTsTDg.exe
  C:\Windows\System\ghTsTDg.exe
  2⤵
  PID:9160
- C:\Windows\System\nrwDGvL.exe
  C:\Windows\System\nrwDGvL.exe
  2⤵
  PID:9176
- C:\Windows\System\xwNtqyT.exe
  C:\Windows\System\xwNtqyT.exe
  2⤵
  PID:9204
- C:\Windows\System\tuJIceB.exe
  C:\Windows\System\tuJIceB.exe
  2⤵
  PID:8064
- C:\Windows\System\AREVqgz.exe
  C:\Windows\System\AREVqgz.exe
  2⤵
  PID:7700
- C:\Windows\System\yuBtkQq.exe
  C:\Windows\System\yuBtkQq.exe
  2⤵
  PID:8236
- C:\Windows\System\SOHleXa.exe
  C:\Windows\System\SOHleXa.exe
  2⤵
  PID:8268
- C:\Windows\System\ceHJEQu.exe
  C:\Windows\System\ceHJEQu.exe
  2⤵
  PID:8368
- C:\Windows\System\YPjgQCP.exe
  C:\Windows\System\YPjgQCP.exe
  2⤵
  PID:8408
- C:\Windows\System\fMmaOhc.exe
  C:\Windows\System\fMmaOhc.exe
  2⤵
  PID:8480
- C:\Windows\System\PtpMzfr.exe
  C:\Windows\System\PtpMzfr.exe
  2⤵
  PID:8540
- C:\Windows\System\yuxWaSN.exe
  C:\Windows\System\yuxWaSN.exe
  2⤵
  PID:8648
- C:\Windows\System\xSdpWHy.exe
  C:\Windows\System\xSdpWHy.exe
  2⤵
  PID:8672
- C:\Windows\System\seNcrIa.exe
  C:\Windows\System\seNcrIa.exe
  2⤵
  PID:8732
- C:\Windows\System\kIOLYXi.exe
  C:\Windows\System\kIOLYXi.exe
  2⤵
  PID:8772
- C:\Windows\System\aHtMzLQ.exe
  C:\Windows\System\aHtMzLQ.exe
  2⤵
  PID:8924
- C:\Windows\System\bGdCgew.exe
  C:\Windows\System\bGdCgew.exe
  2⤵
  PID:9032
- C:\Windows\System\YanxgDH.exe
  C:\Windows\System\YanxgDH.exe
  2⤵
  PID:9088
- C:\Windows\System\VLAToQp.exe
  C:\Windows\System\VLAToQp.exe
  2⤵
  PID:9184
- C:\Windows\System\nlMueHI.exe
  C:\Windows\System\nlMueHI.exe
  2⤵
  PID:9136
- C:\Windows\System\rfmZwol.exe
  C:\Windows\System\rfmZwol.exe
  2⤵
  PID:9172
- C:\Windows\System\rfkNWje.exe
  C:\Windows\System\rfkNWje.exe
  2⤵
  PID:8048
- C:\Windows\System\kTujEGa.exe
  C:\Windows\System\kTujEGa.exe
  2⤵
  PID:8316
- C:\Windows\System\qNAVZaC.exe
  C:\Windows\System\qNAVZaC.exe
  2⤵
  PID:8440
- C:\Windows\System\XomcIlT.exe
  C:\Windows\System\XomcIlT.exe
  2⤵
  PID:8632
- C:\Windows\System\JbbQTJZ.exe
  C:\Windows\System\JbbQTJZ.exe
  2⤵
  PID:8580
- C:\Windows\System\dxZOigy.exe
  C:\Windows\System\dxZOigy.exe
  2⤵
  PID:8796
- C:\Windows\System\hTMBrFj.exe
  C:\Windows\System\hTMBrFj.exe
  2⤵
  PID:9044
- C:\Windows\System\RQnQWrO.exe
  C:\Windows\System\RQnQWrO.exe
  2⤵
  PID:7280
- C:\Windows\System\rWTFsny.exe
  C:\Windows\System\rWTFsny.exe
  2⤵
  PID:8932
- C:\Windows\System\KeGtCtB.exe
  C:\Windows\System\KeGtCtB.exe
  2⤵
  PID:8820
- C:\Windows\System\vovYINO.exe
  C:\Windows\System\vovYINO.exe
  2⤵
  PID:8776
- C:\Windows\System\XDmJgyf.exe
  C:\Windows\System\XDmJgyf.exe
  2⤵
  PID:9244
- C:\Windows\System\OYeHTRF.exe
  C:\Windows\System\OYeHTRF.exe
  2⤵
  PID:9264
- C:\Windows\System\KfivJNb.exe
  C:\Windows\System\KfivJNb.exe
  2⤵
  PID:9284
- C:\Windows\System\FjQqPmw.exe
  C:\Windows\System\FjQqPmw.exe
  2⤵
  PID:9308
- C:\Windows\System\yCMhadF.exe
  C:\Windows\System\yCMhadF.exe
  2⤵
  PID:9348
- C:\Windows\System\MtJLDhs.exe
  C:\Windows\System\MtJLDhs.exe
  2⤵
  PID:9368
- C:\Windows\System\QzCRYfX.exe
  C:\Windows\System\QzCRYfX.exe
  2⤵
  PID:9388
- C:\Windows\System\ZaMHVHk.exe
  C:\Windows\System\ZaMHVHk.exe
  2⤵
  PID:9412
- C:\Windows\System\odbzsVl.exe
  C:\Windows\System\odbzsVl.exe
  2⤵
  PID:9472
- C:\Windows\System\AVSRYJU.exe
  C:\Windows\System\AVSRYJU.exe
  2⤵
  PID:9496
- C:\Windows\System\CbHAWkN.exe
  C:\Windows\System\CbHAWkN.exe
  2⤵
  PID:9512
- C:\Windows\System\aqEUbhq.exe
  C:\Windows\System\aqEUbhq.exe
  2⤵
  PID:9540
- C:\Windows\System\VkqCQsQ.exe
  C:\Windows\System\VkqCQsQ.exe
  2⤵
  PID:9560
- C:\Windows\System\tRWvXWK.exe
  C:\Windows\System\tRWvXWK.exe
  2⤵
  PID:9596
- C:\Windows\System\ecayNhO.exe
  C:\Windows\System\ecayNhO.exe
  2⤵
  PID:9612
- C:\Windows\System\KaulXse.exe
  C:\Windows\System\KaulXse.exe
  2⤵
  PID:9656
- C:\Windows\System\rhlmoPt.exe
  C:\Windows\System\rhlmoPt.exe
  2⤵
  PID:9672
- C:\Windows\System\xvRJpCg.exe
  C:\Windows\System\xvRJpCg.exe
  2⤵
  PID:9696
- C:\Windows\System\InpfmXt.exe
  C:\Windows\System\InpfmXt.exe
  2⤵
  PID:9772
- C:\Windows\System\HxsoYnA.exe
  C:\Windows\System\HxsoYnA.exe
  2⤵
  PID:9792
- C:\Windows\System\ZgVBnzV.exe
  C:\Windows\System\ZgVBnzV.exe
  2⤵
  PID:9812
- C:\Windows\System\AMLHxrO.exe
  C:\Windows\System\AMLHxrO.exe
  2⤵
  PID:9828
- C:\Windows\System\BbdTXJH.exe
  C:\Windows\System\BbdTXJH.exe
  2⤵
  PID:9844
- C:\Windows\System\vtJjNAU.exe
  C:\Windows\System\vtJjNAU.exe
  2⤵
  PID:9860
- C:\Windows\System\HLuiZLF.exe
  C:\Windows\System\HLuiZLF.exe
  2⤵
  PID:9876
- C:\Windows\System\eoBPIPr.exe
  C:\Windows\System\eoBPIPr.exe
  2⤵
  PID:9892
- C:\Windows\System\tAszZrU.exe
  C:\Windows\System\tAszZrU.exe
  2⤵
  PID:9908
- C:\Windows\System\DVFwkcr.exe
  C:\Windows\System\DVFwkcr.exe
  2⤵
  PID:9924
- C:\Windows\System\FdjByAn.exe
  C:\Windows\System\FdjByAn.exe
  2⤵
  PID:9940
- C:\Windows\System\KxjPyyS.exe
  C:\Windows\System\KxjPyyS.exe
  2⤵
  PID:9956
- C:\Windows\System\KClaAlU.exe
  C:\Windows\System\KClaAlU.exe
  2⤵
  PID:9984
- C:\Windows\System\IzLXLDf.exe
  C:\Windows\System\IzLXLDf.exe
  2⤵
  PID:10028
- C:\Windows\System\hYskVHv.exe
  C:\Windows\System\hYskVHv.exe
  2⤵
  PID:10060
- C:\Windows\System\lyQBRHX.exe
  C:\Windows\System\lyQBRHX.exe
  2⤵
  PID:10084
- C:\Windows\System\plVfZxm.exe
  C:\Windows\System\plVfZxm.exe
  2⤵
  PID:10108
- C:\Windows\System\Rcxvvst.exe
  C:\Windows\System\Rcxvvst.exe
  2⤵
  PID:10132
- C:\Windows\System\UIejwDF.exe
  C:\Windows\System\UIejwDF.exe
  2⤵
  PID:8868
- C:\Windows\System\tgANyKM.exe
  C:\Windows\System\tgANyKM.exe
  2⤵
  PID:9228
- C:\Windows\System\YZIGLZv.exe
  C:\Windows\System\YZIGLZv.exe
  2⤵
  PID:9332
- C:\Windows\System\yHzmfHs.exe
  C:\Windows\System\yHzmfHs.exe
  2⤵
  PID:9356
- C:\Windows\System\kiPJsDB.exe
  C:\Windows\System\kiPJsDB.exe
  2⤵
  PID:9724
- C:\Windows\System\CTwKISR.exe
  C:\Windows\System\CTwKISR.exe
  2⤵
  PID:9968
- C:\Windows\System\DKzVosf.exe
  C:\Windows\System\DKzVosf.exe
  2⤵
  PID:9996
- C:\Windows\System\aRHKHKU.exe
  C:\Windows\System\aRHKHKU.exe
  2⤵
  PID:10044
- C:\Windows\System\jcRPIDC.exe
  C:\Windows\System\jcRPIDC.exe
  2⤵
  PID:9836
- C:\Windows\System\XNmcDnN.exe
  C:\Windows\System\XNmcDnN.exe
  2⤵
  PID:9916
- C:\Windows\System\EPzkYmj.exe
  C:\Windows\System\EPzkYmj.exe
  2⤵
  PID:9936
- C:\Windows\System\DasCMNW.exe
  C:\Windows\System\DasCMNW.exe
  2⤵
  PID:10176
- C:\Windows\System\QZseOYV.exe
  C:\Windows\System\QZseOYV.exe
  2⤵
  PID:9852
- C:\Windows\System\wDdJFQJ.exe
  C:\Windows\System\wDdJFQJ.exe
  2⤵
  PID:6620
- C:\Windows\System\VUanvXF.exe
  C:\Windows\System\VUanvXF.exe
  2⤵
  PID:9340
- C:\Windows\System\uOQEtiB.exe
  C:\Windows\System\uOQEtiB.exe
  2⤵
  PID:10096
- C:\Windows\System\NVbCApe.exe
  C:\Windows\System\NVbCApe.exe
  2⤵
  PID:10236
- C:\Windows\System\kfOPjVv.exe
  C:\Windows\System\kfOPjVv.exe
  2⤵
  PID:9784
- C:\Windows\System\CpdPuiw.exe
  C:\Windows\System\CpdPuiw.exe
  2⤵
  PID:10120
- C:\Windows\System\IuBPNgS.exe
  C:\Windows\System\IuBPNgS.exe
  2⤵
  PID:9740
- C:\Windows\System\MYwCxVI.exe
  C:\Windows\System\MYwCxVI.exe
  2⤵
  PID:9920
- C:\Windows\System\NJfHkMe.exe
  C:\Windows\System\NJfHkMe.exe
  2⤵
  PID:9904
- C:\Windows\System\rWODece.exe
  C:\Windows\System\rWODece.exe
  2⤵
  PID:10144
- C:\Windows\System\HfqPzpF.exe
  C:\Windows\System\HfqPzpF.exe
  2⤵
  PID:10036
- C:\Windows\System\CCDfHJq.exe
  C:\Windows\System\CCDfHJq.exe
  2⤵
  PID:10224
- C:\Windows\System\RMUQQHH.exe
  C:\Windows\System\RMUQQHH.exe
  2⤵
  PID:10168
- C:\Windows\System\gUkYiBm.exe
  C:\Windows\System\gUkYiBm.exe
  2⤵
  PID:10080
- C:\Windows\System\DAyOEaQ.exe
  C:\Windows\System\DAyOEaQ.exe
  2⤵
  PID:10244
- C:\Windows\System\GPgTxMc.exe
  C:\Windows\System\GPgTxMc.exe
  2⤵
  PID:10312
- C:\Windows\System\QtEArZn.exe
  C:\Windows\System\QtEArZn.exe
  2⤵
  PID:10336
- C:\Windows\System\sgyeWOD.exe
  C:\Windows\System\sgyeWOD.exe
  2⤵
  PID:10356
- C:\Windows\System\CoXNIwQ.exe
  C:\Windows\System\CoXNIwQ.exe
  2⤵
  PID:10372
- C:\Windows\System\jQubrRX.exe
  C:\Windows\System\jQubrRX.exe
  2⤵
  PID:10396
- C:\Windows\System\OQhgMRv.exe
  C:\Windows\System\OQhgMRv.exe
  2⤵
  PID:10420
- C:\Windows\System\wPlHMDx.exe
  C:\Windows\System\wPlHMDx.exe
  2⤵
  PID:10436
- C:\Windows\System\pmocbjz.exe
  C:\Windows\System\pmocbjz.exe
  2⤵
  PID:10484
- C:\Windows\System\wXBbNbi.exe
  C:\Windows\System\wXBbNbi.exe
  2⤵
  PID:10504
- C:\Windows\System\sTjxoIN.exe
  C:\Windows\System\sTjxoIN.exe
  2⤵
  PID:10536
- C:\Windows\System\xNTHDMr.exe
  C:\Windows\System\xNTHDMr.exe
  2⤵
  PID:10552
- C:\Windows\System\JyvCXnW.exe
  C:\Windows\System\JyvCXnW.exe
  2⤵
  PID:10592
- C:\Windows\System\fgkcCHP.exe
  C:\Windows\System\fgkcCHP.exe
  2⤵
  PID:10628
- C:\Windows\System\ErWzhhV.exe
  C:\Windows\System\ErWzhhV.exe
  2⤵
  PID:10648
- C:\Windows\System\ZGaODdr.exe
  C:\Windows\System\ZGaODdr.exe
  2⤵
  PID:10668
- C:\Windows\System\jTvNImI.exe
  C:\Windows\System\jTvNImI.exe
  2⤵
  PID:10688
- C:\Windows\System\qtJUqvU.exe
  C:\Windows\System\qtJUqvU.exe
  2⤵
  PID:10712
- C:\Windows\System\UGhMmyi.exe
  C:\Windows\System\UGhMmyi.exe
  2⤵
  PID:10752
- C:\Windows\System\FNKboDO.exe
  C:\Windows\System\FNKboDO.exe
  2⤵
  PID:10804
- C:\Windows\System\kszacaZ.exe
  C:\Windows\System\kszacaZ.exe
  2⤵
  PID:10824
- C:\Windows\System\pyCXNZz.exe
  C:\Windows\System\pyCXNZz.exe
  2⤵
  PID:10848
- C:\Windows\System\MZKWBbt.exe
  C:\Windows\System\MZKWBbt.exe
  2⤵
  PID:10888
- C:\Windows\System\BeJRsDj.exe
  C:\Windows\System\BeJRsDj.exe
  2⤵
  PID:10908
- C:\Windows\System\rXZerXN.exe
  C:\Windows\System\rXZerXN.exe
  2⤵
  PID:10928
- C:\Windows\System\wyDDUTW.exe
  C:\Windows\System\wyDDUTW.exe
  2⤵
  PID:10952
- C:\Windows\System\AehrODZ.exe
  C:\Windows\System\AehrODZ.exe
  2⤵
  PID:11016
- C:\Windows\System\TaHemuX.exe
  C:\Windows\System\TaHemuX.exe
  2⤵
  PID:11032
- C:\Windows\System\wygTAZj.exe
  C:\Windows\System\wygTAZj.exe
  2⤵
  PID:11060
- C:\Windows\System\yptXPtS.exe
  C:\Windows\System\yptXPtS.exe
  2⤵
  PID:11076
- C:\Windows\System\xinSDCy.exe
  C:\Windows\System\xinSDCy.exe
  2⤵
  PID:11100
- C:\Windows\System\lbypehp.exe
  C:\Windows\System\lbypehp.exe
  2⤵
  PID:11136
- C:\Windows\System\oEkYXDN.exe
  C:\Windows\System\oEkYXDN.exe
  2⤵
  PID:11164
- C:\Windows\System\WVgoBzK.exe
  C:\Windows\System\WVgoBzK.exe
  2⤵
  PID:11208
- C:\Windows\System\HFZICuB.exe
  C:\Windows\System\HFZICuB.exe
  2⤵
  PID:11232
- C:\Windows\System\jpxPEzK.exe
  C:\Windows\System\jpxPEzK.exe
  2⤵
  PID:11248
- C:\Windows\System\TAGWBiA.exe
  C:\Windows\System\TAGWBiA.exe
  2⤵
  PID:10012
- C:\Windows\System\nPwpico.exe
  C:\Windows\System\nPwpico.exe
  2⤵
  PID:9552
- C:\Windows\System\otUszLZ.exe
  C:\Windows\System\otUszLZ.exe
  2⤵
  PID:10308
- C:\Windows\System\mWHlXXr.exe
  C:\Windows\System\mWHlXXr.exe
  2⤵
  PID:10324
- C:\Windows\System\nAuYjPw.exe
  C:\Windows\System\nAuYjPw.exe
  2⤵
  PID:10412
- C:\Windows\System\BMZpuZu.exe
  C:\Windows\System\BMZpuZu.exe
  2⤵
  PID:10548
- C:\Windows\System\PKVPGOg.exe
  C:\Windows\System\PKVPGOg.exe
  2⤵
  PID:10612
- C:\Windows\System\yOwmmjp.exe
  C:\Windows\System\yOwmmjp.exe
  2⤵
  PID:10620
- C:\Windows\System\jhgJveW.exe
  C:\Windows\System\jhgJveW.exe
  2⤵
  PID:10680
- C:\Windows\System\weBUGxf.exe
  C:\Windows\System\weBUGxf.exe
  2⤵
  PID:10776
- C:\Windows\System\nyZYGjV.exe
  C:\Windows\System\nyZYGjV.exe
  2⤵
  PID:10800
- C:\Windows\System\jYekfVo.exe
  C:\Windows\System\jYekfVo.exe
  2⤵
  PID:10984
- C:\Windows\System\HyHVRiq.exe
  C:\Windows\System\HyHVRiq.exe
  2⤵
  PID:10996
- C:\Windows\System\pJUaXty.exe
  C:\Windows\System\pJUaXty.exe
  2⤵
  PID:11068
- C:\Windows\System\GgbyWfx.exe
  C:\Windows\System\GgbyWfx.exe
  2⤵
  PID:11120
- C:\Windows\System\fefUTlX.exe
  C:\Windows\System\fefUTlX.exe
  2⤵
  PID:11176
- C:\Windows\System\TcqmSxh.exe
  C:\Windows\System\TcqmSxh.exe
  2⤵
  PID:11240
- C:\Windows\System\aTQAFIw.exe
  C:\Windows\System\aTQAFIw.exe
  2⤵
  PID:10456
- C:\Windows\System\KRmsWuk.exe
  C:\Windows\System\KRmsWuk.exe
  2⤵
  PID:10348
- C:\Windows\System\cGdOOKH.exe
  C:\Windows\System\cGdOOKH.exe
  2⤵
  PID:10588
- C:\Windows\System\Iwtyocc.exe
  C:\Windows\System\Iwtyocc.exe
  2⤵
  PID:10524
- C:\Windows\System\CWQDFas.exe
  C:\Windows\System\CWQDFas.exe
  2⤵
  PID:10748
- C:\Windows\System\JffLopY.exe
  C:\Windows\System\JffLopY.exe
  2⤵
  PID:10916
- C:\Windows\System\NmTZnhU.exe
  C:\Windows\System\NmTZnhU.exe
  2⤵
  PID:11128
- C:\Windows\System\OxRoCFn.exe
  C:\Windows\System\OxRoCFn.exe
  2⤵
  PID:11096
- C:\Windows\System\REXPABY.exe
  C:\Windows\System\REXPABY.exe
  2⤵
  PID:9448
- C:\Windows\System\ULnXDjs.exe
  C:\Windows\System\ULnXDjs.exe
  2⤵
  PID:11048
- C:\Windows\System\vLXjYVc.exe
  C:\Windows\System\vLXjYVc.exe
  2⤵
  PID:11244
- C:\Windows\System\yXJdUpd.exe
  C:\Windows\System\yXJdUpd.exe
  2⤵
  PID:11276
- C:\Windows\System\tFosFKR.exe
  C:\Windows\System\tFosFKR.exe
  2⤵
  PID:11296
- C:\Windows\System\BCGFQfQ.exe
  C:\Windows\System\BCGFQfQ.exe
  2⤵
  PID:11324
- C:\Windows\System\IJmWUVE.exe
  C:\Windows\System\IJmWUVE.exe
  2⤵
  PID:11344
- C:\Windows\System\vvDHfSj.exe
  C:\Windows\System\vvDHfSj.exe
  2⤵
  PID:11380
- C:\Windows\System\wjQefsv.exe
  C:\Windows\System\wjQefsv.exe
  2⤵
  PID:11420
- C:\Windows\System\seWJYoR.exe
  C:\Windows\System\seWJYoR.exe
  2⤵
  PID:11460
- C:\Windows\System\VZYYDrf.exe
  C:\Windows\System\VZYYDrf.exe
  2⤵
  PID:11476
- C:\Windows\System\jTrLpgw.exe
  C:\Windows\System\jTrLpgw.exe
  2⤵
  PID:11504
- C:\Windows\System\mQGXgBI.exe
  C:\Windows\System\mQGXgBI.exe
  2⤵
  PID:11528
- C:\Windows\System\XiYvZAB.exe
  C:\Windows\System\XiYvZAB.exe
  2⤵
  PID:11560
- C:\Windows\System\jEZDpaY.exe
  C:\Windows\System\jEZDpaY.exe
  2⤵
  PID:11592
- C:\Windows\System\VHAPnxS.exe
  C:\Windows\System\VHAPnxS.exe
  2⤵
  PID:11624
- C:\Windows\System\vwGjkUj.exe
  C:\Windows\System\vwGjkUj.exe
  2⤵
  PID:11652
- C:\Windows\System\cToKNMl.exe
  C:\Windows\System\cToKNMl.exe
  2⤵
  PID:11680
- C:\Windows\System\emfiYkb.exe
  C:\Windows\System\emfiYkb.exe
  2⤵
  PID:11708
- C:\Windows\System\ipYCtFq.exe
  C:\Windows\System\ipYCtFq.exe
  2⤵
  PID:11768
- C:\Windows\System\uSKoaTz.exe
  C:\Windows\System\uSKoaTz.exe
  2⤵
  PID:11784
- C:\Windows\System\Rttwwll.exe
  C:\Windows\System\Rttwwll.exe
  2⤵
  PID:11804
- C:\Windows\System\cPLxRCZ.exe
  C:\Windows\System\cPLxRCZ.exe
  2⤵
  PID:11828
- C:\Windows\System\EagPjNx.exe
  C:\Windows\System\EagPjNx.exe
  2⤵
  PID:11848
- C:\Windows\System\bAiVMdq.exe
  C:\Windows\System\bAiVMdq.exe
  2⤵
  PID:11872
- C:\Windows\System\MkyATTc.exe
  C:\Windows\System\MkyATTc.exe
  2⤵
  PID:11916
- C:\Windows\System\icKGjuX.exe
  C:\Windows\System\icKGjuX.exe
  2⤵
  PID:11940
- C:\Windows\System\VJROxAH.exe
  C:\Windows\System\VJROxAH.exe
  2⤵
  PID:11960
- C:\Windows\System\LABUlgm.exe
  C:\Windows\System\LABUlgm.exe
  2⤵
  PID:11988
- C:\Windows\System\cYYwqmT.exe
  C:\Windows\System\cYYwqmT.exe
  2⤵
  PID:12028
- C:\Windows\System\oNSCnKU.exe
  C:\Windows\System\oNSCnKU.exe
  2⤵
  PID:12052
- C:\Windows\System\ipEytvr.exe
  C:\Windows\System\ipEytvr.exe
  2⤵
  PID:12072
- C:\Windows\System\oVbhxdT.exe
  C:\Windows\System\oVbhxdT.exe
  2⤵
  PID:12112
- C:\Windows\System\cIdwHjn.exe
  C:\Windows\System\cIdwHjn.exe
  2⤵
  PID:12132
- C:\Windows\System\ohEHuNe.exe
  C:\Windows\System\ohEHuNe.exe
  2⤵
  PID:12156
- C:\Windows\System\KehFjBs.exe
  C:\Windows\System\KehFjBs.exe
  2⤵
  PID:12176
- C:\Windows\System\XsUiMXY.exe
  C:\Windows\System\XsUiMXY.exe
  2⤵
  PID:12196
- C:\Windows\System\ToMMOXI.exe
  C:\Windows\System\ToMMOXI.exe
  2⤵
  PID:12216
- C:\Windows\System\pyFgwEs.exe
  C:\Windows\System\pyFgwEs.exe
  2⤵
  PID:12236
- C:\Windows\System\ouBfZwT.exe
  C:\Windows\System\ouBfZwT.exe
  2⤵
  PID:11272
- C:\Windows\System\VaGhxUo.exe
  C:\Windows\System\VaGhxUo.exe
  2⤵
  PID:11364
- C:\Windows\System\lHiSiFp.exe
  C:\Windows\System\lHiSiFp.exe
  2⤵
  PID:11336
- C:\Windows\System\hZQspCP.exe
  C:\Windows\System\hZQspCP.exe
  2⤵
  PID:11376
- C:\Windows\System\vVlPXWK.exe
  C:\Windows\System\vVlPXWK.exe
  2⤵
  PID:11472
- C:\Windows\System\ekcgzrw.exe
  C:\Windows\System\ekcgzrw.exe
  2⤵
  PID:11524
- C:\Windows\System\QxNdmoY.exe
  C:\Windows\System\QxNdmoY.exe
  2⤵
  PID:11612
- C:\Windows\System\zXcVloQ.exe
  C:\Windows\System\zXcVloQ.exe
  2⤵
  PID:11724
- C:\Windows\System\BMxHqFQ.exe
  C:\Windows\System\BMxHqFQ.exe
  2⤵
  PID:10940
- C:\Windows\System\AIlphoK.exe
  C:\Windows\System\AIlphoK.exe
  2⤵
  PID:11844
- C:\Windows\System\jNJTHOw.exe
  C:\Windows\System\jNJTHOw.exe
  2⤵
  PID:11900
- C:\Windows\System\sIibhZo.exe
  C:\Windows\System\sIibhZo.exe
  2⤵
  PID:11952
- C:\Windows\System\BFqNGEY.exe
  C:\Windows\System\BFqNGEY.exe
  2⤵
  PID:11976
- C:\Windows\System\bgiEnTi.exe
  C:\Windows\System\bgiEnTi.exe
  2⤵
  PID:12064
- C:\Windows\System\yBdJQwz.exe
  C:\Windows\System\yBdJQwz.exe
  2⤵
  PID:12108
- C:\Windows\System\EUACHhf.exe
  C:\Windows\System\EUACHhf.exe
  2⤵
  PID:12144
- C:\Windows\System\cZyimxV.exe
  C:\Windows\System\cZyimxV.exe
  2⤵
  PID:12212
- C:\Windows\System\ylwjGRw.exe
  C:\Windows\System\ylwjGRw.exe
  2⤵
  PID:12232
- C:\Windows\System\JtfwEQE.exe
  C:\Windows\System\JtfwEQE.exe
  2⤵
  PID:11288
- C:\Windows\System\HhPRZGE.exe
  C:\Windows\System\HhPRZGE.exe
  2⤵
  PID:11332
- C:\Windows\System\XaJWpWj.exe
  C:\Windows\System\XaJWpWj.exe
  2⤵
  PID:11516
- C:\Windows\System\pWSHoHE.exe
  C:\Windows\System\pWSHoHE.exe
  2⤵
  PID:11756
- C:\Windows\System\qhyIWtX.exe
  C:\Windows\System\qhyIWtX.exe
  2⤵
  PID:11856
- C:\Windows\System\hfMcJNH.exe
  C:\Windows\System\hfMcJNH.exe
  2⤵
  PID:12060
- C:\Windows\System\uVKkbZJ.exe
  C:\Windows\System\uVKkbZJ.exe
  2⤵
  PID:11760
- C:\Windows\System\HXvluUr.exe
  C:\Windows\System\HXvluUr.exe
  2⤵
  PID:12008
- C:\Windows\System\fxswoYI.exe
  C:\Windows\System\fxswoYI.exe
  2⤵
  PID:12304
- C:\Windows\System\rlsBSup.exe
  C:\Windows\System\rlsBSup.exe
  2⤵
  PID:12332
- C:\Windows\System\rTINNGf.exe
  C:\Windows\System\rTINNGf.exe
  2⤵
  PID:12352
- C:\Windows\System\lptkrsN.exe
  C:\Windows\System\lptkrsN.exe
  2⤵
  PID:12384
- C:\Windows\System\gLQoJeG.exe
  C:\Windows\System\gLQoJeG.exe
  2⤵
  PID:12400
- C:\Windows\System\uiKoeiX.exe
  C:\Windows\System\uiKoeiX.exe
  2⤵
  PID:12420
- C:\Windows\System\CspEhAS.exe
  C:\Windows\System\CspEhAS.exe
  2⤵
  PID:12444
- C:\Windows\System\DKFrhEw.exe
  C:\Windows\System\DKFrhEw.exe
  2⤵
  PID:12464
- C:\Windows\System\GBEMeoA.exe
  C:\Windows\System\GBEMeoA.exe
  2⤵
  PID:12496
- C:\Windows\System\mOGtcjB.exe
  C:\Windows\System\mOGtcjB.exe
  2⤵
  PID:12520
- C:\Windows\System\kgRWbQH.exe
  C:\Windows\System\kgRWbQH.exe
  2⤵
  PID:12536
- C:\Windows\System\nHkFvTx.exe
  C:\Windows\System\nHkFvTx.exe
  2⤵
  PID:12560
- C:\Windows\System\BhYNjHi.exe
  C:\Windows\System\BhYNjHi.exe
  2⤵
  PID:12580
- C:\Windows\System\XzMIMiB.exe
  C:\Windows\System\XzMIMiB.exe
  2⤵
  PID:12604
- C:\Windows\System\czDCILi.exe
  C:\Windows\System\czDCILi.exe
  2⤵
  PID:12624
- C:\Windows\System\ikrGrDx.exe
  C:\Windows\System\ikrGrDx.exe
  2⤵
  PID:12640
- C:\Windows\System\MlflQwQ.exe
  C:\Windows\System\MlflQwQ.exe
  2⤵
  PID:12700
- C:\Windows\System\SxnQDUf.exe
  C:\Windows\System\SxnQDUf.exe
  2⤵
  PID:12736
- C:\Windows\System\oDIhjfL.exe
  C:\Windows\System\oDIhjfL.exe
  2⤵
  PID:12756
- C:\Windows\System\WOhANDJ.exe
  C:\Windows\System\WOhANDJ.exe
  2⤵
  PID:12820
- C:\Windows\System\pcUhaJR.exe
  C:\Windows\System\pcUhaJR.exe
  2⤵
  PID:12840
- C:\Windows\System\KdMfsuR.exe
  C:\Windows\System\KdMfsuR.exe
  2⤵
  PID:12860
- C:\Windows\System\hhrDUAB.exe
  C:\Windows\System\hhrDUAB.exe
  2⤵
  PID:12880
- C:\Windows\System\IeDFETn.exe
  C:\Windows\System\IeDFETn.exe
  2⤵
  PID:12912
- C:\Windows\System\VNAWwKm.exe
  C:\Windows\System\VNAWwKm.exe
  2⤵
  PID:12932
- C:\Windows\System\UAFzVMX.exe
  C:\Windows\System\UAFzVMX.exe
  2⤵
  PID:12948
- C:\Windows\System\ZHofoLH.exe
  C:\Windows\System\ZHofoLH.exe
  2⤵
  PID:12964
- C:\Windows\System\STWTJRC.exe
  C:\Windows\System\STWTJRC.exe
  2⤵
  PID:12980
- C:\Windows\System\PmsKlyo.exe
  C:\Windows\System\PmsKlyo.exe
  2⤵
  PID:13068
- C:\Windows\System\DoAgdlG.exe
  C:\Windows\System\DoAgdlG.exe
  2⤵
  PID:13100
- C:\Windows\System\EGGjaVO.exe
  C:\Windows\System\EGGjaVO.exe
  2⤵
  PID:13144
- C:\Windows\System\apESzat.exe
  C:\Windows\System\apESzat.exe
  2⤵
  PID:13160
- C:\Windows\System\bxwpBvH.exe
  C:\Windows\System\bxwpBvH.exe
  2⤵
  PID:13188
- C:\Windows\System\oykkoWT.exe
  C:\Windows\System\oykkoWT.exe
  2⤵
  PID:13208
- C:\Windows\System\awREQxp.exe
  C:\Windows\System\awREQxp.exe
  2⤵
  PID:13232
- C:\Windows\System\OtiwNTD.exe
  C:\Windows\System\OtiwNTD.exe
  2⤵
  PID:13252
- C:\Windows\System\CvIiUSF.exe
  C:\Windows\System\CvIiUSF.exe
  2⤵
  PID:13304
- C:\Windows\System\gTxKhCw.exe
  C:\Windows\System\gTxKhCw.exe
  2⤵
  PID:12296
- C:\Windows\System\zaWosei.exe
  C:\Windows\System\zaWosei.exe
  2⤵
  PID:12344
- C:\Windows\System\OBruNpf.exe
  C:\Windows\System\OBruNpf.exe
  2⤵
  PID:12392
- C:\Windows\System\xIVzobp.exe
  C:\Windows\System\xIVzobp.exe
  2⤵
  PID:12436
- C:\Windows\System\trimigm.exe
  C:\Windows\System\trimigm.exe
  2⤵
  PID:12488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0gewe1y.k0w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EKOeRdG.exe

Filesize
1.4MB

MD5
4abfe08b4ea425022b6ed839a9781dd4

SHA1
6ae54b8ef57cbcc7ab4fbbe91ab309ac4b20ea9a

SHA256
4427a7a26eb5daee7abf01ebdde254c040f0a57ac183711e8470068b5d15bd9d

SHA512
0fa6ed3a2ab40fdd4c0a6d890e5d83dc8929d3d98bd80a57e6e53ba57487a12e6a663fda04c41bc648637427106bd4382f5fc0c68c3cd48dec7fb30b5938995b

Download Submit
C:\Windows\System\FMlhcGs.exe

Filesize
1.4MB

MD5
ea6156e2108307e8ba382649e9995d13

SHA1
d02c86988e181bc8d34864ce477d4bd369d8a1ae

SHA256
d8c153e12e130ae4bf36fa116a198730b88e6779e50939cbf539b5ff8dcc8a06

SHA512
ee6a145357ba21759d29a8f64f7dd7a09f79b5aaf7217227cf4cd601c7b0d9ccd435486de742b1273b58c6451389229509ddfda3714ca3bce7c5aec0a462e550

Download Submit
C:\Windows\System\GGzOjjw.exe

Filesize
1.4MB

MD5
6d6c91eb15298081ce914ff9791137a9

SHA1
e6c9639117377174dfe34b952a3cdcc223716c6e

SHA256
2a66f1459f07513f341dd4e994ccc621473508943e21f2802bfa92e3b248d0e4

SHA512
59a089e659639429aaba448a530d01f5d10b9863e6d98da43445cb37c350861bca1c34cd822d7098e5a2edae6fda00ca919c3b5a03b1221bf1f71de4fc683ee7

Download Submit
C:\Windows\System\GOFpJoR.exe

Filesize
1.4MB

MD5
80231b6d38815e0535fa3982d90aa033

SHA1
8e5b247142b394053fe0ef8c95ae22de0fe4984c

SHA256
f149406919890a2aa0e7d17bce8f51bee6c94cb02cecd93abae074da90f07c45

SHA512
90488f3b20fdb7adb53d0259b487ad68a2c720cd264aa45caaa32b63157afd92c27634eb3d5e83f1f50a38a6ce98c9f9f5180d471676ba54066cd23057761948

Download Submit
C:\Windows\System\IhfeqFB.exe

Filesize
1.4MB

MD5
9cbad2f05bdf3d5e27965ea109ab72e5

SHA1
47869cbbc892123268b22db972f5b01886067c24

SHA256
0f9aecd8d1ba5e58fbfc1fecbcb457732bc777f3a3dd536d391b29763dd542db

SHA512
6067e5ade5a46d135f64a639879236a6658a1320f628197c81955667bcd576c1a2630ce2f88da8e171af13468ef3fc5b9101cb6721ebb04fb3083c0b97a15e12

Download Submit
C:\Windows\System\Iwbovkx.exe

Filesize
1.4MB

MD5
cb4883cf3bfa90bd896df9cb7550aa69

SHA1
e84984f2a0c2d10edf04b9d4a38139fb8cbf3ecd

SHA256
66a8d40adcaab40e1f2723cc2411bb58b4284710831d6b933e8563669b1a7b1e

SHA512
ab5999f9cd8eb5d3dae1a1b914c236174a9cd43c62803d4acfb9f5858c1e1d4d17211f401a597e0ae7e9fbe34712bb456371fcc309b0e41cfa5e475365fb9b32

Download Submit
C:\Windows\System\OsPcmWP.exe

Filesize
1.4MB

MD5
31121829ac58684a6bd82ecd3e7c68d6

SHA1
c860bf27a66164a45281b390e9ef30a96b9b8ec4

SHA256
3b2bfc09354af25a8d3c2ef67028768c6051502dcc21f0d7bfcb30483826c68a

SHA512
4a4a4bacaa749bd5bd5579d6945762187cc079ed0a332719ccb5bb598a36728cafa62e4b9920f02f6606d4ef914cdeae654c3c93b9539353ccf028f5a5a9f12b

Download Submit
C:\Windows\System\OziuLTq.exe

Filesize
1.4MB

MD5
c56d50460ad8847c89410b8e8639d60c

SHA1
9bbeb0c7a92a21a7ff4ac87f2684fa977e729653

SHA256
24d03f63f1879d8f0cb7b6008a373f0083499c376a8391a4ae048b977fca144a

SHA512
0e7ecb2c500b6e42ba543d632a252cf9c36463086d3ced725b70df9cce8e5165b4a6106b4f43f6ed3ca32b81a1c0167f90bc93e51d604a3047a7e37227386662

Download Submit
C:\Windows\System\PRFrzDl.exe

Filesize
1.4MB

MD5
ef3240c39c63d3314c2ee60f4190c239

SHA1
6efe6d6df3e345504025dee9487f2bdce13c80a8

SHA256
c5f1a342b46abdf736877762b347dce601cd85a5343833d01dbd6339447a2c71

SHA512
3c52fb5efeb5fb6183ecebf298975841d8d22a6bfaa490545efe6690f660153ef62ea88c3ecc68c83b9444c0816c9087e085e1c7e71e8338e803cfedd3fd3fbf

Download Submit
C:\Windows\System\PgpoqeE.exe

Filesize
1.4MB

MD5
8a9cc9bc9bd7c0786724551416821922

SHA1
c9e99c0614b9013df1d17e8bdebdd1ffb63dda9f

SHA256
4a9c7ed9850317ecd904fa63c2ebed72c9e39654683096f55d1349fdb069d39e

SHA512
7a124af18981cb31d707c721b1207224661d17abb9d6c0a8e4449f43dcf364050aff2fed260eceb0c115b24e72b750a9b5dffbd064e2f529289562a57c5bfbc7

Download Submit
C:\Windows\System\PiKIQox.exe

Filesize
1.4MB

MD5
f75675c8b116436f565ddca6a704d588

SHA1
11b721109276a5d35828dc37bcb4a8cbba733197

SHA256
753e8d767c14d0cb987d356f833a74a18730ed1e7f23e9b6dcc82f1effd68223

SHA512
f093a91ec896700245ad642b95503517fc488a524fa7d97f07a85048112c03431d00ce2e62d54f0a3f5b41db8ef8b65dba9f2d2444f96f439a43fc73b2c6605e

Download Submit
C:\Windows\System\PtmjMVg.exe

Filesize
1.4MB

MD5
21e137fbb580710c766d723eca4f7004

SHA1
1a487cd5bb4d2aa1ff9c3a8fd6bdeb799a6b0613

SHA256
e996bebfd6245d2487ba14ae5a44ffd37ef8025e55c1b0e212184f0ffe485b31

SHA512
d0240723b7946db7e10394f09d978860d72f239ea0336c95d1d67aebf1342412e8c801e46544c90ce916e29c7a0815b1b74da56358f9e72a46eafd4049b2601c

Download Submit
C:\Windows\System\TGgrPpX.exe

Filesize
1.4MB

MD5
31abdc38499ad9fcfae88676a1bb9257

SHA1
a486b569cf2d8f6be2c49d70647b7dc4ff93bf56

SHA256
655a5b38a8c879e7aafc4e5e16e9dd8ce9aa7e0b1d9c5aeb3d14567b2d539387

SHA512
eca59d6bf6f6de9ad8d1a40a44db4ab0574631c9a110e4586e38a48afcc447cde5e0eb0027c7e52bec974e84add64f350b409de58249f89572d1294e1ad0cb61

Download Submit
C:\Windows\System\VMpVZvI.exe

Filesize
8B

MD5
2d0c2c2eeafda1eefbc846623106a651

SHA1
ebe1d12cc7355840b98bff551fa1e9b6ea05149b

SHA256
315fe12e8506c9a5679018a241c22762f38597a85e3d6906984d2cd8e0eb0749

SHA512
4747f2fca75d2722dc6b7850f1cf2e05f5ebac7e64d54a9f03247ac705b6e7fd5e4086e67fbc0da577c026e6cfc06192b9232b3f0c023c488535fb6f948376dc

Download Submit
C:\Windows\System\VSpsnuL.exe

Filesize
1.4MB

MD5
fc4d35de4c61913c169df1d519399b43

SHA1
2ec357366bae0d17357a9743f9056a44de142c29

SHA256
a9872c3036428157b770504bed13c74063c426065b6f8c788b9ec4bc77ec4887

SHA512
2e71fe5432de7fe8320021a92ee87e91c75521e4e10c15f3ccd6e674423cc54c2df2f009cd46a828acb316aa747477cbb515d00f113052c9f2286ad6328f8752

Download Submit
C:\Windows\System\YQPYJpg.exe

Filesize
1.4MB

MD5
330a47bfa11e9e3eaf39662aadaed61e

SHA1
0e47d0dc11ecf867db968911f1c960ce1b0c9ab2

SHA256
7f7d4f5f723cdd0d5d5abea19c9ad2d12a92a5a494f65b21a6e2bde32b8fd2a7

SHA512
0895e400cbde8b4b545493b69eb92cd2c68f37aee99d93bfafe317033d747d4c81094c41d57bc31ccd6f014635d45b5e076aef287b67a67c1838eeb2904a5193

Download Submit
C:\Windows\System\avdMJln.exe

Filesize
1.4MB

MD5
d992540ca01a8f58bb14f11581529b5b

SHA1
036a80412f906e39e2919c1da738ba13ead61863

SHA256
5f2c6e42af15d17686eda5de76c7e95300ee32f67bb6068c59c8eb74fdca78a7

SHA512
0b9c368b19335e9f70bec03d08d0c18d2bf598cf902df794ff65c80df2963a8e1b2a1e04c081744972c11fe339c51fadbb66a51f300c0c30a915f66a6f070eb7

Download Submit
C:\Windows\System\gVIOmRZ.exe

Filesize
1.4MB

MD5
f432febfe701c0bdc122a6e91731108c

SHA1
384463153bc48c2200a5f4ac294a37243c130551

SHA256
32d3c52b3e48d05d1b9e7de2b20e0240e095a2723bda90944424e97d2d5e7270

SHA512
2d531d2e6d732c9720a9c8031d853e6b3a5735aacdf8061c56e359f51db82d9a8aae9ff19e1a6919e27927930bd6f612a2bbb1459583019307f73c0d2eba297e

Download Submit
C:\Windows\System\hNnxMrU.exe

Filesize
1.4MB

MD5
a0ff245636a429e047bb54d64e6528ae

SHA1
527223b0de14b861ac880df321ebcf28df1448ec

SHA256
b13e850fabcef85599cbfb93006b65bee79bcb272bdd303267003e8bd1250c4a

SHA512
65ed203c925364116120ebfb5ac219ee379c491bdc047ed7ab2d0cd4c05652ed6ecb50c803e7a536b6582b4d1e71bde1407dc2ecb7e93e16944ae88d610564de

Download Submit
C:\Windows\System\jOwXfhv.exe

Filesize
1.4MB

MD5
e54c92e00c18359a5620800c6fd15c9b

SHA1
ea858114829c9b52c4e2fea6eca6a96af08177ab

SHA256
268a5cb89eccbf21b657218aadb471c890fa1f9bf59e57c53a215f974a93ca32

SHA512
811474ee3ef519c29892af9f0a50884ad29040878bbecc29a8ff19b7bb8c0e2feb69f364e48fa295277bb976ddf5b4aac41a90a4c8faa7d9e0b183e798cf05b4

Download Submit
C:\Windows\System\mELBTvo.exe

Filesize
1.4MB

MD5
eb5474085dd1b59b60034ef6c5a52aab

SHA1
ae8fbdc26bd3dbf979e556129fbe18c0aaf14282

SHA256
0b166bd9b178c992659dcf56074ffe635716d93ac5550ca91757fe5e9a8b9afa

SHA512
049a1ce1bb3d427fb2fefbcd418331da65c52ad9e4963416e3f303f58e11315e9197e7e278d81f58a87392dc80c27b233d33b36cfb62522066107c0af7067a43

Download Submit
C:\Windows\System\mwAgFXp.exe

Filesize
1.4MB

MD5
75688e134fd07a032ba99c661732e40d

SHA1
c461d2f6e0a13c4b523925880bb44ba3e18fdecf

SHA256
b81fa5b9986ef68dd5eb9fc5f142d4772bef7c8de6078c24f2f846918296f708

SHA512
662163bf47b01b6ddfeeb8088243e775959c42442c07d41a4e9670e7876171228017f56b9d783da884925fdbb08a6fa583d1b6ef2437d84b4ca44a38aa32a1a7

Download Submit
C:\Windows\System\qSITzFv.exe

Filesize
1.4MB

MD5
b96b7a1f31c56ff80fd3b93eb0c62f57

SHA1
cbbac3e1e9d445cba25aa3c4168fc0eb0aca2db5

SHA256
3fb75fcd632473dec350ae0c7569cfe8e4607fc46762909fbbe2deb7756016a1

SHA512
e33b1e08535d181caf62806299d20a3348e98adfa375803f8bcf40c2518d7b550d45ce25917edc7656c7699fad825814c7666850ecfc7a927de18091530b71fd

Download Submit
C:\Windows\System\rdhjODh.exe

Filesize
1.4MB

MD5
4b5205ffec2775b040a126c2c90ef8bf

SHA1
754d37d1fe17e572e77fd0cded7b0593cbbd1801

SHA256
aa6e64f0a1ce9aa5fbd4a50793d5592a50a438a10cc128ab548be4179bcdcbab

SHA512
933d29b924f84db0157c16411159fce07eca84980de4d1f003e3f1b9c2b7f02af8e1205a537f640dd47747f0ee25b60d649d804ddca1008220db5572762f396d

Download Submit
C:\Windows\System\rxxepoX.exe

Filesize
1.4MB

MD5
2482175d6d4ca59fb7af9368c6ad0460

SHA1
1f80f85e1751779f66c349125f6e74a866f84d7f

SHA256
55fa5b004abaef24813dd5cdc0ad7cedb27d761253b6c21596c73106f7084bad

SHA512
381af94b2ec24969af0dc75b847d9b447381089d32b5c52562082e87a75cad031f640d748d137be3046ec347567713616c1893a4ba088e6deff65f5c6722c59e

Download Submit
C:\Windows\System\sSlNyTj.exe

Filesize
1.4MB

MD5
5a73e93d6f596379848613445f1242e4

SHA1
a3a5e64e17073fd4f70ba7871fd09d39b3d066ee

SHA256
161eab4931df0ac4a5f4839212ed517d9c94a757f14b17253d143ee4bc8d45f7

SHA512
6adb913a077411fae386524207c0da4f02f1c11eb1b43e8e7ffc1768b04de9c1134963af4f801bd70759e1fdb18fa8d8c0b6f59f8884b48a94c8e2708da501f6

Download Submit
C:\Windows\System\tPjuMEU.exe

Filesize
1.4MB

MD5
4789f3ab748386f1c7e3ef7a9cde3643

SHA1
e4e543a157920da014b9c4c509062f43738df7e5

SHA256
ecb24fb610ee023e4c546ec9ca5289255f1b0b8c0d33855a83b37345d3091d95

SHA512
95d2879efb76b621cfdf33d111c19713028333de0a4026fb93d0e83fc8271f72c3196c22837c99a6a014791d3d6d29d0bc26e8b51f3a9353ab0cf5cb9c624a64

Download Submit
C:\Windows\System\tYjXLxN.exe

Filesize
1.4MB

MD5
6a9564592e1384d9832732c80f1c60bd

SHA1
ce3c5636b8625a45dce21d6b396ae903d4878ce0

SHA256
dc42502fc0531702b86ae5192687c3868383aabf6a425e10e2ba5b4e84ad72f9

SHA512
200562c35e701f08584423eaeb5d80c8de7678a510b4522162955f420e63095796002c7682ef8da73818f07cb26e798cdb568935e2c307b4d05bcfcf33f12ac3

Download Submit
C:\Windows\System\ulwLNBM.exe

Filesize
1.4MB

MD5
8982aacf3d859ac29f7ff80c922e7887

SHA1
f1e92d56e3d050dea7a60ad86307a8624ff1d35a

SHA256
352d9394a1448052c6e08d3e84dd0fe6f52f934121a7da8b988d06a730f1c3f8

SHA512
f82f4166963dd060bb1ce3d726f426e38345911d854a63abe5d1f94a1979fba82d72b38b9331c3859c17b5dd0ed102bf091d8ac654d8c6bf94addd7141644480

Download Submit
C:\Windows\System\vKZwAoH.exe

Filesize
1.4MB

MD5
f84304fdded2a851bdb0e1d742e9cf24

SHA1
db94fe23560b3a31df29a08b7e7ec5d3b5d8bb4c

SHA256
4bb5fbbc4de0cd5b782a4933126cb4f81722b96a591783d3e1cd8fd5a09a7109

SHA512
d2ab8ea25bcb300ecb22d39b8d5b7eace9056c291de56dd97448755bc508a1dec402f2d818d6a759fe74f5627efbb3dba600081f9aca1de04e8dcd5ff0f91c7e

Download Submit
C:\Windows\System\vczFaXg.exe

Filesize
1.4MB

MD5
3ec1c23eb026b5f3d17879c606399732

SHA1
7a0c5f60dc633c26814af5abb18caf9462621b58

SHA256
4abe7ecae5934b5db73ebf7220a64199879afd1cdd1217f7decfcaec4e3c6d7e

SHA512
696f1f9878858e37179cb1e0b21775423805b0715c4d6376b9959495ad1d5ae2e0dbbad92b025bac60e98ff55bbc6813996eb60243602cf6cd16fba9292c7ebe

Download Submit
C:\Windows\System\vwJWlcP.exe

Filesize
1.4MB

MD5
d35011f28bebc125db2b18cad2b17dad

SHA1
79cfb61792eb8e6fa8f683b972f5a45daff668d2

SHA256
5871392f300c8025dd27746fe0b01127f9027a9a44891796100fb2ef22f52875

SHA512
d822c3a807f7dfa126310d41459d793141a8c69b52ef592223e976811c1eeeddc4b8d1dfe033631636d85e540e279badb58e9acc4808878482a89a1162280947

Download Submit
C:\Windows\System\yGSeUCc.exe

Filesize
1.4MB

MD5
e8211d12acd812c922b226f6e6150082

SHA1
48d755c089dffd74d6e7fa2ff0359ca4ba892425

SHA256
f6aae81709c72bfbde3c3dfdb1085621f844317c2234de9436bbbefb454fb7b2

SHA512
0eadc7b96b81e8cd72f3c6754990b58d4bd83ac24d40e1a53cc2313b095366e87bbc5e8519592b88bd9edfa32494e5d44e38aeaf0be13c4379a899117056f86d

Download Submit
C:\Windows\System\zhuOCBu.exe

Filesize
1.4MB

MD5
053cd38d192f321eb7f99338a0be7317

SHA1
259a9893bf2b1465328106809a0ea217436741b0

SHA256
a869200c24239b98f3caf8f8a3b0414f54d5be207031d6ce91f69f3f82fa30de

SHA512
0a22ca965d6947864fbd6aaea44ea57a5427456ae5d0e8d7b1351afac1e97e044530be91ecb57daaceb4703b96bdf9edb325bc051607a946e0e722089b03da1a

Download Submit
memory/376-43-0x0000019C1DB70000-0x0000019C1DB80000-memory.dmp

Filesize
64KB

Download
memory/376-169-0x00007FFA18F43000-0x00007FFA18F45000-memory.dmp

Filesize
8KB

Download
memory/376-522-0x0000019C1F050000-0x0000019C1F7F6000-memory.dmp

Filesize
7.6MB

Download
memory/376-109-0x0000019C1DB00000-0x0000019C1DB22000-memory.dmp

Filesize
136KB

Download
memory/376-42-0x0000019C1DB70000-0x0000019C1DB80000-memory.dmp

Filesize
64KB

Download
memory/452-207-0x00007FF78FB50000-0x00007FF78FF42000-memory.dmp

Filesize
3.9MB

Download
memory/452-2088-0x00007FF78FB50000-0x00007FF78FF42000-memory.dmp

Filesize
3.9MB

Download
memory/736-15-0x00007FF631BD0000-0x00007FF631FC2000-memory.dmp

Filesize
3.9MB

Download
memory/736-2046-0x00007FF631BD0000-0x00007FF631FC2000-memory.dmp

Filesize
3.9MB

Download
memory/736-2015-0x00007FF631BD0000-0x00007FF631FC2000-memory.dmp

Filesize
3.9MB

Download
memory/928-2020-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp

Filesize
3.9MB

Download
memory/928-2058-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp

Filesize
3.9MB

Download
memory/928-87-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1476-2050-0x00007FF63FA60000-0x00007FF63FE52000-memory.dmp

Filesize
3.9MB

Download
memory/1476-56-0x00007FF63FA60000-0x00007FF63FE52000-memory.dmp

Filesize
3.9MB

Download
memory/1564-2017-0x00007FF690020000-0x00007FF690412000-memory.dmp

Filesize
3.9MB

Download
memory/1564-39-0x00007FF690020000-0x00007FF690412000-memory.dmp

Filesize
3.9MB

Download
memory/1564-2053-0x00007FF690020000-0x00007FF690412000-memory.dmp

Filesize
3.9MB

Download
memory/1624-2077-0x00007FF68BCE0000-0x00007FF68C0D2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-136-0x00007FF68BCE0000-0x00007FF68C0D2000-memory.dmp

Filesize
3.9MB

Download
memory/1656-2081-0x00007FF696DC0000-0x00007FF6971B2000-memory.dmp

Filesize
3.9MB

Download
memory/1656-193-0x00007FF696DC0000-0x00007FF6971B2000-memory.dmp

Filesize
3.9MB

Download
memory/2076-187-0x00007FF6EE450000-0x00007FF6EE842000-memory.dmp

Filesize
3.9MB

Download
memory/2076-2063-0x00007FF6EE450000-0x00007FF6EE842000-memory.dmp

Filesize
3.9MB

Download
memory/2248-181-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-2066-0x00007FF7815B0000-0x00007FF7819A2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-2090-0x00007FF71F370000-0x00007FF71F762000-memory.dmp

Filesize
3.9MB

Download
memory/2588-128-0x00007FF71F370000-0x00007FF71F762000-memory.dmp

Filesize
3.9MB

Download
memory/2816-2049-0x00007FF65AE90000-0x00007FF65B282000-memory.dmp

Filesize
3.9MB

Download
memory/2816-50-0x00007FF65AE90000-0x00007FF65B282000-memory.dmp

Filesize
3.9MB

Download
memory/2816-2018-0x00007FF65AE90000-0x00007FF65B282000-memory.dmp

Filesize
3.9MB

Download
memory/2932-27-0x00007FF7C2D50000-0x00007FF7C3142000-memory.dmp

Filesize
3.9MB

Download
memory/2932-2016-0x00007FF7C2D50000-0x00007FF7C3142000-memory.dmp

Filesize
3.9MB

Download
memory/2932-2054-0x00007FF7C2D50000-0x00007FF7C3142000-memory.dmp

Filesize
3.9MB

Download
memory/3088-162-0x00007FF6ABC30000-0x00007FF6AC022000-memory.dmp

Filesize
3.9MB

Download
memory/3088-2083-0x00007FF6ABC30000-0x00007FF6AC022000-memory.dmp

Filesize
3.9MB

Download
memory/3492-1-0x00000185CE050000-0x00000185CE060000-memory.dmp

Filesize
64KB

Download
memory/3492-0-0x00007FF62C5A0000-0x00007FF62C992000-memory.dmp

Filesize
3.9MB

Download
memory/3812-2019-0x00007FF638490000-0x00007FF638882000-memory.dmp

Filesize
3.9MB

Download
memory/3812-2061-0x00007FF638490000-0x00007FF638882000-memory.dmp

Filesize
3.9MB

Download
memory/3812-71-0x00007FF638490000-0x00007FF638882000-memory.dmp

Filesize
3.9MB

Download
memory/4272-2087-0x00007FF694110000-0x00007FF694502000-memory.dmp

Filesize
3.9MB

Download
memory/4272-152-0x00007FF694110000-0x00007FF694502000-memory.dmp

Filesize
3.9MB

Download
memory/4284-2057-0x00007FF79B710000-0x00007FF79BB02000-memory.dmp

Filesize
3.9MB

Download
memory/4284-118-0x00007FF79B710000-0x00007FF79BB02000-memory.dmp

Filesize
3.9MB

Download
memory/4424-2091-0x00007FF6DEE50000-0x00007FF6DF242000-memory.dmp

Filesize
3.9MB

Download
memory/4424-203-0x00007FF6DEE50000-0x00007FF6DF242000-memory.dmp

Filesize
3.9MB

Download
memory/4536-2045-0x00007FF737E00000-0x00007FF7381F2000-memory.dmp

Filesize
3.9MB

Download
memory/4536-168-0x00007FF737E00000-0x00007FF7381F2000-memory.dmp

Filesize
3.9MB

Download
memory/4540-2071-0x00007FF790B10000-0x00007FF790F02000-memory.dmp

Filesize
3.9MB

Download
memory/4540-158-0x00007FF790B10000-0x00007FF790F02000-memory.dmp

Filesize
3.9MB

Download
memory/4544-2021-0x00007FF651580000-0x00007FF651972000-memory.dmp

Filesize
3.9MB

Download
memory/4544-2068-0x00007FF651580000-0x00007FF651972000-memory.dmp

Filesize
3.9MB

Download
memory/4544-97-0x00007FF651580000-0x00007FF651972000-memory.dmp

Filesize
3.9MB

Download
memory/4716-2073-0x00007FF611840000-0x00007FF611C32000-memory.dmp

Filesize
3.9MB

Download
memory/4716-146-0x00007FF611840000-0x00007FF611C32000-memory.dmp

Filesize
3.9MB

Download
memory/4780-211-0x00007FF66EBF0000-0x00007FF66EFE2000-memory.dmp

Filesize
3.9MB

Download
memory/4780-2085-0x00007FF66EBF0000-0x00007FF66EFE2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-199-0x00007FF6C4A30000-0x00007FF6C4E22000-memory.dmp

Filesize
3.9MB

Download
memory/4832-2075-0x00007FF6C4A30000-0x00007FF6C4E22000-memory.dmp

Filesize
3.9MB

Download
memory/4972-2064-0x00007FF7F4B00000-0x00007FF7F4EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-175-0x00007FF7F4B00000-0x00007FF7F4EF2000-memory.dmp

Filesize
3.9MB

Download