xmrig | ae88666e6d854bb575b7b2f1aab05ecbc90ab26e462cace1b5fee3614973dc83

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
Size

1.9MB
MD5

2dc27560dbe5b34d24d1950c6ddd9011
SHA1

86e5eb340d7c69b549d8fc9ae41cf72cf48fc85c
SHA256

ae88666e6d854bb575b7b2f1aab05ecbc90ab26e462cace1b5fee3614973dc83
SHA512

3a691bcc03e5cfaa98c8addb1e27957dd2e7dc257ecdff5f0b6cebd1e07e638a2462270358713933724d3b8410906592665896f3cedc90950d54e3338be38d54
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafr:NAB0

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/2800-260-0x00007FF7461C0000-0x00007FF7465B2000-memory.dmp	xmrig
behavioral2/memory/1632-282-0x00007FF60DCF0000-0x00007FF60E0E2000-memory.dmp	xmrig
behavioral2/memory/4360-340-0x00007FF62F510000-0x00007FF62F902000-memory.dmp	xmrig
behavioral2/memory/4680-380-0x00007FF77C3B0000-0x00007FF77C7A2000-memory.dmp	xmrig
behavioral2/memory/3876-390-0x00007FF731ED0000-0x00007FF7322C2000-memory.dmp	xmrig
behavioral2/memory/3344-393-0x00007FF7F2AC0000-0x00007FF7F2EB2000-memory.dmp	xmrig
behavioral2/memory/3760-394-0x00007FF6FF5D0000-0x00007FF6FF9C2000-memory.dmp	xmrig
behavioral2/memory/2860-392-0x00007FF7948C0000-0x00007FF794CB2000-memory.dmp	xmrig
behavioral2/memory/2172-389-0x00007FF7A44F0000-0x00007FF7A48E2000-memory.dmp	xmrig
behavioral2/memory/1032-388-0x00007FF60BD50000-0x00007FF60C142000-memory.dmp	xmrig
behavioral2/memory/2012-387-0x00007FF72C390000-0x00007FF72C782000-memory.dmp	xmrig
behavioral2/memory/1344-386-0x00007FF7B7880000-0x00007FF7B7C72000-memory.dmp	xmrig
behavioral2/memory/4776-385-0x00007FF6B7F00000-0x00007FF6B82F2000-memory.dmp	xmrig
behavioral2/memory/1360-346-0x00007FF6B4730000-0x00007FF6B4B22000-memory.dmp	xmrig
behavioral2/memory/1624-312-0x00007FF7A8920000-0x00007FF7A8D12000-memory.dmp	xmrig
behavioral2/memory/1276-303-0x00007FF78D5E0000-0x00007FF78D9D2000-memory.dmp	xmrig
behavioral2/memory/4456-233-0x00007FF736610000-0x00007FF736A02000-memory.dmp	xmrig
behavioral2/memory/4124-221-0x00007FF78CAE0000-0x00007FF78CED2000-memory.dmp	xmrig
behavioral2/memory/224-196-0x00007FF662A40000-0x00007FF662E32000-memory.dmp	xmrig
behavioral2/memory/4704-195-0x00007FF7FBBF0000-0x00007FF7FBFE2000-memory.dmp	xmrig
behavioral2/memory/4080-165-0x00007FF700E60000-0x00007FF701252000-memory.dmp	xmrig
behavioral2/memory/3596-143-0x00007FF734650000-0x00007FF734A42000-memory.dmp	xmrig
behavioral2/memory/3480-32-0x00007FF72E1B0000-0x00007FF72E5A2000-memory.dmp	xmrig
behavioral2/memory/2132-24-0x00007FF623AF0000-0x00007FF623EE2000-memory.dmp	xmrig
behavioral2/memory/2132-3028-0x00007FF623AF0000-0x00007FF623EE2000-memory.dmp	xmrig
behavioral2/memory/3480-3030-0x00007FF72E1B0000-0x00007FF72E5A2000-memory.dmp	xmrig
behavioral2/memory/4124-3032-0x00007FF78CAE0000-0x00007FF78CED2000-memory.dmp	xmrig
behavioral2/memory/3596-3035-0x00007FF734650000-0x00007FF734A42000-memory.dmp	xmrig
behavioral2/memory/4080-3036-0x00007FF700E60000-0x00007FF701252000-memory.dmp	xmrig
behavioral2/memory/224-3038-0x00007FF662A40000-0x00007FF662E32000-memory.dmp	xmrig
behavioral2/memory/2800-3040-0x00007FF7461C0000-0x00007FF7465B2000-memory.dmp	xmrig
behavioral2/memory/1632-3051-0x00007FF60DCF0000-0x00007FF60E0E2000-memory.dmp	xmrig
behavioral2/memory/1360-3048-0x00007FF6B4730000-0x00007FF6B4B22000-memory.dmp	xmrig
behavioral2/memory/4704-3063-0x00007FF7FBBF0000-0x00007FF7FBFE2000-memory.dmp	xmrig
behavioral2/memory/2860-3064-0x00007FF7948C0000-0x00007FF794CB2000-memory.dmp	xmrig
behavioral2/memory/2172-3070-0x00007FF7A44F0000-0x00007FF7A48E2000-memory.dmp	xmrig
behavioral2/memory/3760-3073-0x00007FF6FF5D0000-0x00007FF6FF9C2000-memory.dmp	xmrig
behavioral2/memory/1032-3068-0x00007FF60BD50000-0x00007FF60C142000-memory.dmp	xmrig
behavioral2/memory/1624-3066-0x00007FF7A8920000-0x00007FF7A8D12000-memory.dmp	xmrig
behavioral2/memory/4360-3059-0x00007FF62F510000-0x00007FF62F902000-memory.dmp	xmrig
behavioral2/memory/4680-3056-0x00007FF77C3B0000-0x00007FF77C7A2000-memory.dmp	xmrig
behavioral2/memory/4456-3055-0x00007FF736610000-0x00007FF736A02000-memory.dmp	xmrig
behavioral2/memory/1276-3052-0x00007FF78D5E0000-0x00007FF78D9D2000-memory.dmp	xmrig
behavioral2/memory/3344-3062-0x00007FF7F2AC0000-0x00007FF7F2EB2000-memory.dmp	xmrig
behavioral2/memory/4776-3047-0x00007FF6B7F00000-0x00007FF6B82F2000-memory.dmp	xmrig
behavioral2/memory/1344-3044-0x00007FF7B7880000-0x00007FF7B7C72000-memory.dmp	xmrig
behavioral2/memory/2012-3043-0x00007FF72C390000-0x00007FF72C782000-memory.dmp	xmrig
behavioral2/memory/3876-3076-0x00007FF731ED0000-0x00007FF7322C2000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	3196	powershell.exe
5	3196	powershell.exe
7	3196	powershell.exe
8	3196	powershell.exe
10	3196	powershell.exe
11	3196	powershell.exe
13	3196	powershell.exe
18	3196	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3196	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2132	xoyJKOS.exe
3480	CWpxYcs.exe
3596	aGzQQEk.exe
4080	JvJxTFp.exe
2860	FLDbqWu.exe
4704	zHxgFiQ.exe
224	LtEHlsu.exe
4124	MnzWLKq.exe
3344	vTwJRns.exe
4456	xkdobBQ.exe
2800	wfVgolO.exe
1632	BDjrwBs.exe
1276	XKAneDJ.exe
1624	OCqWIux.exe
4360	twPgYfU.exe
1360	KCJwrSR.exe
4680	ZocKmwi.exe
4776	yKsqivh.exe
1344	XJuqknT.exe
2012	oObRefT.exe
1032	yfLjXQL.exe
2172	WvpXtmz.exe
3876	QEsvgPu.exe
3760	PpeaiXU.exe
4040	ruBUitp.exe
1264	LDSNQir.exe
1796	fpOBBHV.exe
1348	ufSuaMc.exe
1600	NUDIfaT.exe
3028	fIktiqw.exe
1948	oiEDpUo.exe
2984	FAdFjyh.exe
664	ZwfnWaa.exe
3100	axopuyZ.exe
624	vPleMVt.exe
4180	NBkeuZD.exe
5004	lMhsAdl.exe
3428	mitzLXA.exe
2692	YTHkeSa.exe
2044	DWTXXJk.exe
1648	cgAcypG.exe
1092	UGJKOWR.exe
3948	vJHoOic.exe
3036	sdRJbNQ.exe
5056	pwAseQJ.exe
3508	EfbQQDp.exe
1896	KZYfKWI.exe
548	BpVfiGt.exe
3548	aZSyOnj.exe
1244	fTttnOF.exe
3600	gUYZxpt.exe
2016	ocmSsIb.exe
4352	LhTjJOU.exe
1456	hYOFVPR.exe
4316	BHioLrG.exe
1188	DrkzmfT.exe
848	DpOFXyp.exe
2724	kmIdCga.exe
3572	kGzkPxR.exe
4540	oRzWMHI.exe
1724	wUNYunG.exe
1808	TXGMIfi.exe
2412	OEVoQBe.exe
1756	ACSAlxI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4396-0-0x00007FF74C330000-0x00007FF74C722000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-5.dat	upx
behavioral2/files/0x0007000000023403-30.dat	upx
behavioral2/files/0x0007000000023405-54.dat	upx
behavioral2/files/0x000700000002340b-77.dat	upx
behavioral2/files/0x0007000000023412-152.dat	upx
behavioral2/memory/2800-260-0x00007FF7461C0000-0x00007FF7465B2000-memory.dmp	upx
behavioral2/memory/1632-282-0x00007FF60DCF0000-0x00007FF60E0E2000-memory.dmp	upx
behavioral2/memory/4360-340-0x00007FF62F510000-0x00007FF62F902000-memory.dmp	upx
behavioral2/memory/4680-380-0x00007FF77C3B0000-0x00007FF77C7A2000-memory.dmp	upx
behavioral2/memory/3876-390-0x00007FF731ED0000-0x00007FF7322C2000-memory.dmp	upx
behavioral2/memory/3344-393-0x00007FF7F2AC0000-0x00007FF7F2EB2000-memory.dmp	upx
behavioral2/memory/3760-394-0x00007FF6FF5D0000-0x00007FF6FF9C2000-memory.dmp	upx
behavioral2/memory/2860-392-0x00007FF7948C0000-0x00007FF794CB2000-memory.dmp	upx
behavioral2/memory/2172-389-0x00007FF7A44F0000-0x00007FF7A48E2000-memory.dmp	upx
behavioral2/memory/1032-388-0x00007FF60BD50000-0x00007FF60C142000-memory.dmp	upx
behavioral2/memory/2012-387-0x00007FF72C390000-0x00007FF72C782000-memory.dmp	upx
behavioral2/memory/1344-386-0x00007FF7B7880000-0x00007FF7B7C72000-memory.dmp	upx
behavioral2/memory/4776-385-0x00007FF6B7F00000-0x00007FF6B82F2000-memory.dmp	upx
behavioral2/memory/1360-346-0x00007FF6B4730000-0x00007FF6B4B22000-memory.dmp	upx
behavioral2/memory/1624-312-0x00007FF7A8920000-0x00007FF7A8D12000-memory.dmp	upx
behavioral2/memory/1276-303-0x00007FF78D5E0000-0x00007FF78D9D2000-memory.dmp	upx
behavioral2/memory/4456-233-0x00007FF736610000-0x00007FF736A02000-memory.dmp	upx
behavioral2/memory/4124-221-0x00007FF78CAE0000-0x00007FF78CED2000-memory.dmp	upx
behavioral2/memory/224-196-0x00007FF662A40000-0x00007FF662E32000-memory.dmp	upx
behavioral2/memory/4704-195-0x00007FF7FBBF0000-0x00007FF7FBFE2000-memory.dmp	upx
behavioral2/files/0x0007000000023419-189.dat	upx
behavioral2/files/0x0007000000023420-186.dat	upx
behavioral2/files/0x0007000000023417-182.dat	upx
behavioral2/files/0x00080000000233fc-179.dat	upx
behavioral2/files/0x0007000000023416-171.dat	upx
behavioral2/files/0x0007000000023415-169.dat	upx
behavioral2/files/0x0007000000023414-167.dat	upx
behavioral2/memory/4080-165-0x00007FF700E60000-0x00007FF701252000-memory.dmp	upx
behavioral2/files/0x0007000000023411-150.dat	upx
behavioral2/files/0x000700000002341e-149.dat	upx
behavioral2/files/0x000700000002341d-146.dat	upx
behavioral2/files/0x000700000002341c-145.dat	upx
behavioral2/files/0x000700000002341b-144.dat	upx
behavioral2/memory/3596-143-0x00007FF734650000-0x00007FF734A42000-memory.dmp	upx
behavioral2/files/0x000700000002341a-142.dat	upx
behavioral2/files/0x0007000000023418-140.dat	upx
behavioral2/files/0x0007000000023413-157.dat	upx
behavioral2/files/0x0007000000023410-130.dat	upx
behavioral2/files/0x000700000002340f-126.dat	upx
behavioral2/files/0x000700000002340e-122.dat	upx
behavioral2/files/0x000700000002340a-147.dat	upx
behavioral2/files/0x0007000000023408-120.dat	upx
behavioral2/files/0x0007000000023406-112.dat	upx
behavioral2/files/0x000700000002340d-106.dat	upx
behavioral2/files/0x000700000002340c-101.dat	upx
behavioral2/files/0x0007000000023402-91.dat	upx
behavioral2/files/0x0007000000023409-70.dat	upx
behavioral2/files/0x0007000000023407-65.dat	upx
behavioral2/files/0x00070000000233ff-50.dat	upx
behavioral2/files/0x0007000000023401-45.dat	upx
behavioral2/files/0x0007000000023400-37.dat	upx
behavioral2/files/0x0007000000023404-34.dat	upx
behavioral2/memory/3480-32-0x00007FF72E1B0000-0x00007FF72E5A2000-memory.dmp	upx
behavioral2/memory/2132-24-0x00007FF623AF0000-0x00007FF623EE2000-memory.dmp	upx
behavioral2/files/0x00080000000233fb-19.dat	upx
behavioral2/memory/2132-3028-0x00007FF623AF0000-0x00007FF623EE2000-memory.dmp	upx
behavioral2/memory/3480-3030-0x00007FF72E1B0000-0x00007FF72E5A2000-memory.dmp	upx
behavioral2/memory/4124-3032-0x00007FF78CAE0000-0x00007FF78CED2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wzlVXyW.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\HYzipUZ.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\gTfyWmX.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\FTEPcye.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\RlxySoh.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\owcGxlv.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\MFkjGIu.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\efekazB.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\MsVjRMi.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\hhpBgCg.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\mINPXcE.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\ImuKxYI.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\ylmbziq.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\QnLnoDB.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\sfYrVLr.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\hVfCTJZ.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\DlDjWTX.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\ooFIEeD.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\qpVphYt.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\JbxheGr.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\VQkjaFB.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\vUkrZeh.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\ruBUitp.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\WjXwXHe.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\KByDPOa.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\gYwBybA.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\uKmMzZy.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\sTpEEyq.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\IlsKhOw.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\HZnBVuW.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\KwdzuBm.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\pCIsiYe.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\iYnuiVE.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\uRMFHBJ.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\ajXrlis.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\oMHiCoQ.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\meVgkkL.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\ZtSkXzY.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\iRrvuPJ.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\DAvrxfq.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\JDAmrZf.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\rEJOhWa.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\xFkEWfK.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\ZPSBlPP.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\fTttnOF.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\PZDPCeK.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\WkyFSrp.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\MfpOXtK.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\kHKuDgW.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\obScqPU.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\WKCFbMp.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\HcfWzoJ.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\EwBZGtS.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\HDtOBWm.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\eJyOacu.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\oVlawsH.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\qUWNFOt.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\RCcqnOt.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\HmFVgJA.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\UXVDDIe.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\VigexDk.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\HhkYgVL.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\SXMGLVU.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\fzMOkfL.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3196	powershell.exe
3196	powershell.exe
3196	powershell.exe
3196	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeLockMemoryPrivilege	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 3196	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	83
PID 4396 wrote to memory of 3196	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	83
PID 4396 wrote to memory of 2132	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	84
PID 4396 wrote to memory of 2132	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	84
PID 4396 wrote to memory of 3480	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	85
PID 4396 wrote to memory of 3480	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	85
PID 4396 wrote to memory of 2860	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	86
PID 4396 wrote to memory of 2860	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	86
PID 4396 wrote to memory of 3596	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	87
PID 4396 wrote to memory of 3596	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	87
PID 4396 wrote to memory of 4080	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	88
PID 4396 wrote to memory of 4080	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	88
PID 4396 wrote to memory of 4704	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	89
PID 4396 wrote to memory of 4704	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	89
PID 4396 wrote to memory of 224	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	90
PID 4396 wrote to memory of 224	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	90
PID 4396 wrote to memory of 4124	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	91
PID 4396 wrote to memory of 4124	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	91
PID 4396 wrote to memory of 3344	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	92
PID 4396 wrote to memory of 3344	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	92
PID 4396 wrote to memory of 4456	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	93
PID 4396 wrote to memory of 4456	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	93
PID 4396 wrote to memory of 2800	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	94
PID 4396 wrote to memory of 2800	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	94
PID 4396 wrote to memory of 1632	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	95
PID 4396 wrote to memory of 1632	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	95
PID 4396 wrote to memory of 1276	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	96
PID 4396 wrote to memory of 1276	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	96
PID 4396 wrote to memory of 1624	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	97
PID 4396 wrote to memory of 1624	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	97
PID 4396 wrote to memory of 4360	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	98
PID 4396 wrote to memory of 4360	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	98
PID 4396 wrote to memory of 1360	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	99
PID 4396 wrote to memory of 1360	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	99
PID 4396 wrote to memory of 4680	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	100
PID 4396 wrote to memory of 4680	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	100
PID 4396 wrote to memory of 4776	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	101
PID 4396 wrote to memory of 4776	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	101
PID 4396 wrote to memory of 1344	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	102
PID 4396 wrote to memory of 1344	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	102
PID 4396 wrote to memory of 2012	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	103
PID 4396 wrote to memory of 2012	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	103
PID 4396 wrote to memory of 1032	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	104
PID 4396 wrote to memory of 1032	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	104
PID 4396 wrote to memory of 2172	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	105
PID 4396 wrote to memory of 2172	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	105
PID 4396 wrote to memory of 3876	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	106
PID 4396 wrote to memory of 3876	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	106
PID 4396 wrote to memory of 3760	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	107
PID 4396 wrote to memory of 3760	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	107
PID 4396 wrote to memory of 4040	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	108
PID 4396 wrote to memory of 4040	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	108
PID 4396 wrote to memory of 1264	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	109
PID 4396 wrote to memory of 1264	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	109
PID 4396 wrote to memory of 1796	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	110
PID 4396 wrote to memory of 1796	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	110
PID 4396 wrote to memory of 1348	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	111
PID 4396 wrote to memory of 1348	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	111
PID 4396 wrote to memory of 1600	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	112
PID 4396 wrote to memory of 1600	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	112
PID 4396 wrote to memory of 3028	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	113
PID 4396 wrote to memory of 3028	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	113
PID 4396 wrote to memory of 1948	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	114
PID 4396 wrote to memory of 1948	4396	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\System\xoyJKOS.exe
  C:\Windows\System\xoyJKOS.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\CWpxYcs.exe
  C:\Windows\System\CWpxYcs.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\FLDbqWu.exe
  C:\Windows\System\FLDbqWu.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\aGzQQEk.exe
  C:\Windows\System\aGzQQEk.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\JvJxTFp.exe
  C:\Windows\System\JvJxTFp.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\zHxgFiQ.exe
  C:\Windows\System\zHxgFiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\LtEHlsu.exe
  C:\Windows\System\LtEHlsu.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\MnzWLKq.exe
  C:\Windows\System\MnzWLKq.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\vTwJRns.exe
  C:\Windows\System\vTwJRns.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\xkdobBQ.exe
  C:\Windows\System\xkdobBQ.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\wfVgolO.exe
  C:\Windows\System\wfVgolO.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\BDjrwBs.exe
  C:\Windows\System\BDjrwBs.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\XKAneDJ.exe
  C:\Windows\System\XKAneDJ.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\OCqWIux.exe
  C:\Windows\System\OCqWIux.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\twPgYfU.exe
  C:\Windows\System\twPgYfU.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\KCJwrSR.exe
  C:\Windows\System\KCJwrSR.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ZocKmwi.exe
  C:\Windows\System\ZocKmwi.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\yKsqivh.exe
  C:\Windows\System\yKsqivh.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\XJuqknT.exe
  C:\Windows\System\XJuqknT.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\oObRefT.exe
  C:\Windows\System\oObRefT.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\yfLjXQL.exe
  C:\Windows\System\yfLjXQL.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\WvpXtmz.exe
  C:\Windows\System\WvpXtmz.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\QEsvgPu.exe
  C:\Windows\System\QEsvgPu.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\PpeaiXU.exe
  C:\Windows\System\PpeaiXU.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\ruBUitp.exe
  C:\Windows\System\ruBUitp.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\LDSNQir.exe
  C:\Windows\System\LDSNQir.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\fpOBBHV.exe
  C:\Windows\System\fpOBBHV.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\ufSuaMc.exe
  C:\Windows\System\ufSuaMc.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\NUDIfaT.exe
  C:\Windows\System\NUDIfaT.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\fIktiqw.exe
  C:\Windows\System\fIktiqw.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\oiEDpUo.exe
  C:\Windows\System\oiEDpUo.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\FAdFjyh.exe
  C:\Windows\System\FAdFjyh.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\ZwfnWaa.exe
  C:\Windows\System\ZwfnWaa.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\axopuyZ.exe
  C:\Windows\System\axopuyZ.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\UGJKOWR.exe
  C:\Windows\System\UGJKOWR.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\vPleMVt.exe
  C:\Windows\System\vPleMVt.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\NBkeuZD.exe
  C:\Windows\System\NBkeuZD.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\lMhsAdl.exe
  C:\Windows\System\lMhsAdl.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\mitzLXA.exe
  C:\Windows\System\mitzLXA.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\YTHkeSa.exe
  C:\Windows\System\YTHkeSa.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\DWTXXJk.exe
  C:\Windows\System\DWTXXJk.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\cgAcypG.exe
  C:\Windows\System\cgAcypG.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\vJHoOic.exe
  C:\Windows\System\vJHoOic.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\sdRJbNQ.exe
  C:\Windows\System\sdRJbNQ.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\pwAseQJ.exe
  C:\Windows\System\pwAseQJ.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\EfbQQDp.exe
  C:\Windows\System\EfbQQDp.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\KZYfKWI.exe
  C:\Windows\System\KZYfKWI.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\BpVfiGt.exe
  C:\Windows\System\BpVfiGt.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\aZSyOnj.exe
  C:\Windows\System\aZSyOnj.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\fTttnOF.exe
  C:\Windows\System\fTttnOF.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\gUYZxpt.exe
  C:\Windows\System\gUYZxpt.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\ocmSsIb.exe
  C:\Windows\System\ocmSsIb.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\LhTjJOU.exe
  C:\Windows\System\LhTjJOU.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\hYOFVPR.exe
  C:\Windows\System\hYOFVPR.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\BHioLrG.exe
  C:\Windows\System\BHioLrG.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\DrkzmfT.exe
  C:\Windows\System\DrkzmfT.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\DpOFXyp.exe
  C:\Windows\System\DpOFXyp.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\kmIdCga.exe
  C:\Windows\System\kmIdCga.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\kGzkPxR.exe
  C:\Windows\System\kGzkPxR.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\oRzWMHI.exe
  C:\Windows\System\oRzWMHI.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\wUNYunG.exe
  C:\Windows\System\wUNYunG.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\TXGMIfi.exe
  C:\Windows\System\TXGMIfi.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\OEVoQBe.exe
  C:\Windows\System\OEVoQBe.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ACSAlxI.exe
  C:\Windows\System\ACSAlxI.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\AVSKTob.exe
  C:\Windows\System\AVSKTob.exe
  2⤵
  PID:4820
- C:\Windows\System\MibLIGN.exe
  C:\Windows\System\MibLIGN.exe
  2⤵
  PID:2808
- C:\Windows\System\yThYvkf.exe
  C:\Windows\System\yThYvkf.exe
  2⤵
  PID:4792
- C:\Windows\System\kNpFiwP.exe
  C:\Windows\System\kNpFiwP.exe
  2⤵
  PID:4484
- C:\Windows\System\GYrMgdY.exe
  C:\Windows\System\GYrMgdY.exe
  2⤵
  PID:952
- C:\Windows\System\OuMOBYC.exe
  C:\Windows\System\OuMOBYC.exe
  2⤵
  PID:3220
- C:\Windows\System\XvXAmbS.exe
  C:\Windows\System\XvXAmbS.exe
  2⤵
  PID:4856
- C:\Windows\System\fNiGAdD.exe
  C:\Windows\System\fNiGAdD.exe
  2⤵
  PID:5068
- C:\Windows\System\YmkggNy.exe
  C:\Windows\System\YmkggNy.exe
  2⤵
  PID:3412
- C:\Windows\System\ZPwJglL.exe
  C:\Windows\System\ZPwJglL.exe
  2⤵
  PID:1480
- C:\Windows\System\mQXxJAM.exe
  C:\Windows\System\mQXxJAM.exe
  2⤵
  PID:2648
- C:\Windows\System\pqwrzCb.exe
  C:\Windows\System\pqwrzCb.exe
  2⤵
  PID:3740
- C:\Windows\System\hvYEuyQ.exe
  C:\Windows\System\hvYEuyQ.exe
  2⤵
  PID:2892
- C:\Windows\System\npXRgHa.exe
  C:\Windows\System\npXRgHa.exe
  2⤵
  PID:3068
- C:\Windows\System\lVAJpoK.exe
  C:\Windows\System\lVAJpoK.exe
  2⤵
  PID:5124
- C:\Windows\System\jPWtamh.exe
  C:\Windows\System\jPWtamh.exe
  2⤵
  PID:5140
- C:\Windows\System\ADsaORY.exe
  C:\Windows\System\ADsaORY.exe
  2⤵
  PID:5312
- C:\Windows\System\UfogscG.exe
  C:\Windows\System\UfogscG.exe
  2⤵
  PID:5328
- C:\Windows\System\VhIkxOx.exe
  C:\Windows\System\VhIkxOx.exe
  2⤵
  PID:5344
- C:\Windows\System\xYpDGzd.exe
  C:\Windows\System\xYpDGzd.exe
  2⤵
  PID:5360
- C:\Windows\System\mqBERmd.exe
  C:\Windows\System\mqBERmd.exe
  2⤵
  PID:5376
- C:\Windows\System\iYnnYee.exe
  C:\Windows\System\iYnnYee.exe
  2⤵
  PID:5392
- C:\Windows\System\eoDQRtc.exe
  C:\Windows\System\eoDQRtc.exe
  2⤵
  PID:5408
- C:\Windows\System\FVfNBEw.exe
  C:\Windows\System\FVfNBEw.exe
  2⤵
  PID:5424
- C:\Windows\System\mIpLtfp.exe
  C:\Windows\System\mIpLtfp.exe
  2⤵
  PID:5440
- C:\Windows\System\TRHWMuj.exe
  C:\Windows\System\TRHWMuj.exe
  2⤵
  PID:5456
- C:\Windows\System\lpiyqRE.exe
  C:\Windows\System\lpiyqRE.exe
  2⤵
  PID:5472
- C:\Windows\System\HYzipUZ.exe
  C:\Windows\System\HYzipUZ.exe
  2⤵
  PID:5488
- C:\Windows\System\KsZpwLS.exe
  C:\Windows\System\KsZpwLS.exe
  2⤵
  PID:5504
- C:\Windows\System\GOVcfmU.exe
  C:\Windows\System\GOVcfmU.exe
  2⤵
  PID:5524
- C:\Windows\System\xJLfNrI.exe
  C:\Windows\System\xJLfNrI.exe
  2⤵
  PID:5540
- C:\Windows\System\MtzNXIw.exe
  C:\Windows\System\MtzNXIw.exe
  2⤵
  PID:5636
- C:\Windows\System\zHDDgjM.exe
  C:\Windows\System\zHDDgjM.exe
  2⤵
  PID:5660
- C:\Windows\System\lnzkPLI.exe
  C:\Windows\System\lnzkPLI.exe
  2⤵
  PID:5684
- C:\Windows\System\qEwUhQM.exe
  C:\Windows\System\qEwUhQM.exe
  2⤵
  PID:5704
- C:\Windows\System\swDOGEt.exe
  C:\Windows\System\swDOGEt.exe
  2⤵
  PID:5728
- C:\Windows\System\BDlLemT.exe
  C:\Windows\System\BDlLemT.exe
  2⤵
  PID:5748
- C:\Windows\System\UVwRdtP.exe
  C:\Windows\System\UVwRdtP.exe
  2⤵
  PID:5768
- C:\Windows\System\gTfyWmX.exe
  C:\Windows\System\gTfyWmX.exe
  2⤵
  PID:5792
- C:\Windows\System\zaEgUTR.exe
  C:\Windows\System\zaEgUTR.exe
  2⤵
  PID:5812
- C:\Windows\System\ScwMsMd.exe
  C:\Windows\System\ScwMsMd.exe
  2⤵
  PID:5828
- C:\Windows\System\efekazB.exe
  C:\Windows\System\efekazB.exe
  2⤵
  PID:860
- C:\Windows\System\nyTwXOq.exe
  C:\Windows\System\nyTwXOq.exe
  2⤵
  PID:3972
- C:\Windows\System\JyXDwTG.exe
  C:\Windows\System\JyXDwTG.exe
  2⤵
  PID:3112
- C:\Windows\System\XzJrXKL.exe
  C:\Windows\System\XzJrXKL.exe
  2⤵
  PID:1596
- C:\Windows\System\KiSwvkN.exe
  C:\Windows\System\KiSwvkN.exe
  2⤵
  PID:1760
- C:\Windows\System\qcoAHpj.exe
  C:\Windows\System\qcoAHpj.exe
  2⤵
  PID:1036
- C:\Windows\System\hmVvNYh.exe
  C:\Windows\System\hmVvNYh.exe
  2⤵
  PID:536
- C:\Windows\System\tNqOvOX.exe
  C:\Windows\System\tNqOvOX.exe
  2⤵
  PID:1560
- C:\Windows\System\tLVffmo.exe
  C:\Windows\System\tLVffmo.exe
  2⤵
  PID:5720
- C:\Windows\System\XiKwAHi.exe
  C:\Windows\System\XiKwAHi.exe
  2⤵
  PID:5784
- C:\Windows\System\ooFIEeD.exe
  C:\Windows\System\ooFIEeD.exe
  2⤵
  PID:5880
- C:\Windows\System\ZcQbuCK.exe
  C:\Windows\System\ZcQbuCK.exe
  2⤵
  PID:4176
- C:\Windows\System\RScRwVN.exe
  C:\Windows\System\RScRwVN.exe
  2⤵
  PID:2200
- C:\Windows\System\NDzffSw.exe
  C:\Windows\System\NDzffSw.exe
  2⤵
  PID:3704
- C:\Windows\System\KUmOeHd.exe
  C:\Windows\System\KUmOeHd.exe
  2⤵
  PID:1960
- C:\Windows\System\EeMelEU.exe
  C:\Windows\System\EeMelEU.exe
  2⤵
  PID:1996
- C:\Windows\System\asZxJpa.exe
  C:\Windows\System\asZxJpa.exe
  2⤵
  PID:4640
- C:\Windows\System\teLseMQ.exe
  C:\Windows\System\teLseMQ.exe
  2⤵
  PID:2572
- C:\Windows\System\bRxEaQh.exe
  C:\Windows\System\bRxEaQh.exe
  2⤵
  PID:5148
- C:\Windows\System\FGbOxkM.exe
  C:\Windows\System\FGbOxkM.exe
  2⤵
  PID:5204
- C:\Windows\System\XRdITId.exe
  C:\Windows\System\XRdITId.exe
  2⤵
  PID:2304
- C:\Windows\System\DgskVqy.exe
  C:\Windows\System\DgskVqy.exe
  2⤵
  PID:3016
- C:\Windows\System\OpjnxYr.exe
  C:\Windows\System\OpjnxYr.exe
  2⤵
  PID:3324
- C:\Windows\System\iRrvuPJ.exe
  C:\Windows\System\iRrvuPJ.exe
  2⤵
  PID:532
- C:\Windows\System\YtffzaL.exe
  C:\Windows\System\YtffzaL.exe
  2⤵
  PID:512
- C:\Windows\System\UbAyMBg.exe
  C:\Windows\System\UbAyMBg.exe
  2⤵
  PID:4220
- C:\Windows\System\BzfxBMU.exe
  C:\Windows\System\BzfxBMU.exe
  2⤵
  PID:5552
- C:\Windows\System\NuaMIcb.exe
  C:\Windows\System\NuaMIcb.exe
  2⤵
  PID:5464
- C:\Windows\System\hoyDWnF.exe
  C:\Windows\System\hoyDWnF.exe
  2⤵
  PID:5484
- C:\Windows\System\fDHcIyw.exe
  C:\Windows\System\fDHcIyw.exe
  2⤵
  PID:5868
- C:\Windows\System\rLUfEaU.exe
  C:\Windows\System\rLUfEaU.exe
  2⤵
  PID:5960
- C:\Windows\System\cEUbzkJ.exe
  C:\Windows\System\cEUbzkJ.exe
  2⤵
  PID:5588
- C:\Windows\System\GytnTXP.exe
  C:\Windows\System\GytnTXP.exe
  2⤵
  PID:5620
- C:\Windows\System\BFTQScm.exe
  C:\Windows\System\BFTQScm.exe
  2⤵
  PID:5628
- C:\Windows\System\gLgbuwV.exe
  C:\Windows\System\gLgbuwV.exe
  2⤵
  PID:5824
- C:\Windows\System\LlyTRYo.exe
  C:\Windows\System\LlyTRYo.exe
  2⤵
  PID:5680
- C:\Windows\System\KsMLdYy.exe
  C:\Windows\System\KsMLdYy.exe
  2⤵
  PID:1512
- C:\Windows\System\dhciOZH.exe
  C:\Windows\System\dhciOZH.exe
  2⤵
  PID:4436
- C:\Windows\System\aAywhwl.exe
  C:\Windows\System\aAywhwl.exe
  2⤵
  PID:2904
- C:\Windows\System\jRzdgqo.exe
  C:\Windows\System\jRzdgqo.exe
  2⤵
  PID:4952
- C:\Windows\System\CxeHgXc.exe
  C:\Windows\System\CxeHgXc.exe
  2⤵
  PID:5336
- C:\Windows\System\IlzQVYk.exe
  C:\Windows\System\IlzQVYk.exe
  2⤵
  PID:4860
- C:\Windows\System\VSYYKQO.exe
  C:\Windows\System\VSYYKQO.exe
  2⤵
  PID:5512
- C:\Windows\System\QIZeFjQ.exe
  C:\Windows\System\QIZeFjQ.exe
  2⤵
  PID:6060
- C:\Windows\System\abJnVzD.exe
  C:\Windows\System\abJnVzD.exe
  2⤵
  PID:5672
- C:\Windows\System\womlMUQ.exe
  C:\Windows\System\womlMUQ.exe
  2⤵
  PID:5764
- C:\Windows\System\ERqODvt.exe
  C:\Windows\System\ERqODvt.exe
  2⤵
  PID:6168
- C:\Windows\System\scUihFT.exe
  C:\Windows\System\scUihFT.exe
  2⤵
  PID:6184
- C:\Windows\System\ErChmcv.exe
  C:\Windows\System\ErChmcv.exe
  2⤵
  PID:6204
- C:\Windows\System\QypdptD.exe
  C:\Windows\System\QypdptD.exe
  2⤵
  PID:6220
- C:\Windows\System\sIfONSR.exe
  C:\Windows\System\sIfONSR.exe
  2⤵
  PID:6240
- C:\Windows\System\MsVjRMi.exe
  C:\Windows\System\MsVjRMi.exe
  2⤵
  PID:6260
- C:\Windows\System\vzeORui.exe
  C:\Windows\System\vzeORui.exe
  2⤵
  PID:6284
- C:\Windows\System\lXbnqae.exe
  C:\Windows\System\lXbnqae.exe
  2⤵
  PID:6312
- C:\Windows\System\dsjquIX.exe
  C:\Windows\System\dsjquIX.exe
  2⤵
  PID:6340
- C:\Windows\System\xQYorhY.exe
  C:\Windows\System\xQYorhY.exe
  2⤵
  PID:6380
- C:\Windows\System\VlBdkzM.exe
  C:\Windows\System\VlBdkzM.exe
  2⤵
  PID:6416
- C:\Windows\System\MnZDrYn.exe
  C:\Windows\System\MnZDrYn.exe
  2⤵
  PID:6436
- C:\Windows\System\VjhOuvQ.exe
  C:\Windows\System\VjhOuvQ.exe
  2⤵
  PID:6456
- C:\Windows\System\fBHupfm.exe
  C:\Windows\System\fBHupfm.exe
  2⤵
  PID:6476
- C:\Windows\System\KkDKmGw.exe
  C:\Windows\System\KkDKmGw.exe
  2⤵
  PID:6500
- C:\Windows\System\hfYoLaQ.exe
  C:\Windows\System\hfYoLaQ.exe
  2⤵
  PID:6516
- C:\Windows\System\zLmOmQY.exe
  C:\Windows\System\zLmOmQY.exe
  2⤵
  PID:6544
- C:\Windows\System\LhixCLP.exe
  C:\Windows\System\LhixCLP.exe
  2⤵
  PID:6564
- C:\Windows\System\dvOWyXg.exe
  C:\Windows\System\dvOWyXg.exe
  2⤵
  PID:6584
- C:\Windows\System\JQOCIgQ.exe
  C:\Windows\System\JQOCIgQ.exe
  2⤵
  PID:6604
- C:\Windows\System\mzCNeJD.exe
  C:\Windows\System\mzCNeJD.exe
  2⤵
  PID:6636
- C:\Windows\System\CQlXIbY.exe
  C:\Windows\System\CQlXIbY.exe
  2⤵
  PID:6668
- C:\Windows\System\jflgbuP.exe
  C:\Windows\System\jflgbuP.exe
  2⤵
  PID:6696
- C:\Windows\System\NNFVWZp.exe
  C:\Windows\System\NNFVWZp.exe
  2⤵
  PID:6732
- C:\Windows\System\yocxLvZ.exe
  C:\Windows\System\yocxLvZ.exe
  2⤵
  PID:6752
- C:\Windows\System\zotNJCE.exe
  C:\Windows\System\zotNJCE.exe
  2⤵
  PID:6772
- C:\Windows\System\cHcoVMY.exe
  C:\Windows\System\cHcoVMY.exe
  2⤵
  PID:6792
- C:\Windows\System\zsLheUX.exe
  C:\Windows\System\zsLheUX.exe
  2⤵
  PID:6816
- C:\Windows\System\QbcYopx.exe
  C:\Windows\System\QbcYopx.exe
  2⤵
  PID:6836
- C:\Windows\System\RfrVyAF.exe
  C:\Windows\System\RfrVyAF.exe
  2⤵
  PID:6856
- C:\Windows\System\EqKMZcf.exe
  C:\Windows\System\EqKMZcf.exe
  2⤵
  PID:6880
- C:\Windows\System\bKdmEpL.exe
  C:\Windows\System\bKdmEpL.exe
  2⤵
  PID:6896
- C:\Windows\System\BrSglyI.exe
  C:\Windows\System\BrSglyI.exe
  2⤵
  PID:6912
- C:\Windows\System\DNGSjeF.exe
  C:\Windows\System\DNGSjeF.exe
  2⤵
  PID:6944
- C:\Windows\System\qDnvvtn.exe
  C:\Windows\System\qDnvvtn.exe
  2⤵
  PID:6968
- C:\Windows\System\jjcmxWf.exe
  C:\Windows\System\jjcmxWf.exe
  2⤵
  PID:6988
- C:\Windows\System\dIYyElU.exe
  C:\Windows\System\dIYyElU.exe
  2⤵
  PID:7012
- C:\Windows\System\QJYBXLJ.exe
  C:\Windows\System\QJYBXLJ.exe
  2⤵
  PID:5196
- C:\Windows\System\Gxokblm.exe
  C:\Windows\System\Gxokblm.exe
  2⤵
  PID:640
- C:\Windows\System\zLInywt.exe
  C:\Windows\System\zLInywt.exe
  2⤵
  PID:5736
- C:\Windows\System\WXarHtC.exe
  C:\Windows\System\WXarHtC.exe
  2⤵
  PID:5696
- C:\Windows\System\HnAzhvP.exe
  C:\Windows\System\HnAzhvP.exe
  2⤵
  PID:4048
- C:\Windows\System\oimdReA.exe
  C:\Windows\System\oimdReA.exe
  2⤵
  PID:2872
- C:\Windows\System\fsPTbht.exe
  C:\Windows\System\fsPTbht.exe
  2⤵
  PID:1340
- C:\Windows\System\xfNhBKQ.exe
  C:\Windows\System\xfNhBKQ.exe
  2⤵
  PID:5480
- C:\Windows\System\FsIuPGn.exe
  C:\Windows\System\FsIuPGn.exe
  2⤵
  PID:3568
- C:\Windows\System\vAxzcuv.exe
  C:\Windows\System\vAxzcuv.exe
  2⤵
  PID:6332
- C:\Windows\System\ReStcmf.exe
  C:\Windows\System\ReStcmf.exe
  2⤵
  PID:6352
- C:\Windows\System\gGbSnJM.exe
  C:\Windows\System\gGbSnJM.exe
  2⤵
  PID:6400
- C:\Windows\System\MQUZYMj.exe
  C:\Windows\System\MQUZYMj.exe
  2⤵
  PID:6428
- C:\Windows\System\Pukbmha.exe
  C:\Windows\System\Pukbmha.exe
  2⤵
  PID:6508
- C:\Windows\System\ZvRMZAg.exe
  C:\Windows\System\ZvRMZAg.exe
  2⤵
  PID:6532
- C:\Windows\System\aGxfHTc.exe
  C:\Windows\System\aGxfHTc.exe
  2⤵
  PID:5972
- C:\Windows\System\PAbkjsI.exe
  C:\Windows\System\PAbkjsI.exe
  2⤵
  PID:6572
- C:\Windows\System\twlhYCz.exe
  C:\Windows\System\twlhYCz.exe
  2⤵
  PID:6612
- C:\Windows\System\rgJDNzJ.exe
  C:\Windows\System\rgJDNzJ.exe
  2⤵
  PID:6684
- C:\Windows\System\iKrViNp.exe
  C:\Windows\System\iKrViNp.exe
  2⤵
  PID:6468
- C:\Windows\System\RdjxXUL.exe
  C:\Windows\System\RdjxXUL.exe
  2⤵
  PID:6268
- C:\Windows\System\akqhclN.exe
  C:\Windows\System\akqhclN.exe
  2⤵
  PID:6600
- C:\Windows\System\pCFWFAj.exe
  C:\Windows\System\pCFWFAj.exe
  2⤵
  PID:6920
- C:\Windows\System\ECvZrqm.exe
  C:\Windows\System\ECvZrqm.exe
  2⤵
  PID:6980
- C:\Windows\System\mIDORTG.exe
  C:\Windows\System\mIDORTG.exe
  2⤵
  PID:6808
- C:\Windows\System\glfOClW.exe
  C:\Windows\System\glfOClW.exe
  2⤵
  PID:7100
- C:\Windows\System\YNaVsvP.exe
  C:\Windows\System\YNaVsvP.exe
  2⤵
  PID:6876
- C:\Windows\System\RuTocGG.exe
  C:\Windows\System\RuTocGG.exe
  2⤵
  PID:6892
- C:\Windows\System\tfksqYb.exe
  C:\Windows\System\tfksqYb.exe
  2⤵
  PID:6996
- C:\Windows\System\SXMGLVU.exe
  C:\Windows\System\SXMGLVU.exe
  2⤵
  PID:6760
- C:\Windows\System\RnxarEO.exe
  C:\Windows\System\RnxarEO.exe
  2⤵
  PID:7056
- C:\Windows\System\XOUZjnA.exe
  C:\Windows\System\XOUZjnA.exe
  2⤵
  PID:7124
- C:\Windows\System\cFvAdyK.exe
  C:\Windows\System\cFvAdyK.exe
  2⤵
  PID:6296
- C:\Windows\System\sSrnfHR.exe
  C:\Windows\System\sSrnfHR.exe
  2⤵
  PID:6372
- C:\Windows\System\BPyKIKi.exe
  C:\Windows\System\BPyKIKi.exe
  2⤵
  PID:4504
- C:\Windows\System\gHFyInb.exe
  C:\Windows\System\gHFyInb.exe
  2⤵
  PID:6680
- C:\Windows\System\SwlQPDS.exe
  C:\Windows\System\SwlQPDS.exe
  2⤵
  PID:6256
- C:\Windows\System\GLcwzCE.exe
  C:\Windows\System\GLcwzCE.exe
  2⤵
  PID:7068
- C:\Windows\System\cGExAsu.exe
  C:\Windows\System\cGExAsu.exe
  2⤵
  PID:7200
- C:\Windows\System\FZfiGul.exe
  C:\Windows\System\FZfiGul.exe
  2⤵
  PID:7220
- C:\Windows\System\FTEPcye.exe
  C:\Windows\System\FTEPcye.exe
  2⤵
  PID:7244
- C:\Windows\System\vZOuFEj.exe
  C:\Windows\System\vZOuFEj.exe
  2⤵
  PID:7264
- C:\Windows\System\hhxWpXb.exe
  C:\Windows\System\hhxWpXb.exe
  2⤵
  PID:7284
- C:\Windows\System\tozmXaS.exe
  C:\Windows\System\tozmXaS.exe
  2⤵
  PID:7312
- C:\Windows\System\gYwBybA.exe
  C:\Windows\System\gYwBybA.exe
  2⤵
  PID:7332
- C:\Windows\System\pXABAdw.exe
  C:\Windows\System\pXABAdw.exe
  2⤵
  PID:7352
- C:\Windows\System\TXMxTBC.exe
  C:\Windows\System\TXMxTBC.exe
  2⤵
  PID:7372
- C:\Windows\System\RlxySoh.exe
  C:\Windows\System\RlxySoh.exe
  2⤵
  PID:7396
- C:\Windows\System\LxqAnjW.exe
  C:\Windows\System\LxqAnjW.exe
  2⤵
  PID:7416
- C:\Windows\System\EfcIkNU.exe
  C:\Windows\System\EfcIkNU.exe
  2⤵
  PID:7436
- C:\Windows\System\TFFZRNY.exe
  C:\Windows\System\TFFZRNY.exe
  2⤵
  PID:7464
- C:\Windows\System\JOBYcal.exe
  C:\Windows\System\JOBYcal.exe
  2⤵
  PID:7484
- C:\Windows\System\pNNUZew.exe
  C:\Windows\System\pNNUZew.exe
  2⤵
  PID:7512
- C:\Windows\System\oEyWWiY.exe
  C:\Windows\System\oEyWWiY.exe
  2⤵
  PID:7532
- C:\Windows\System\MghgqAM.exe
  C:\Windows\System\MghgqAM.exe
  2⤵
  PID:7556
- C:\Windows\System\vIvRyBx.exe
  C:\Windows\System\vIvRyBx.exe
  2⤵
  PID:7584
- C:\Windows\System\eLwcKUL.exe
  C:\Windows\System\eLwcKUL.exe
  2⤵
  PID:7616
- C:\Windows\System\qWkcPIv.exe
  C:\Windows\System\qWkcPIv.exe
  2⤵
  PID:7644
- C:\Windows\System\RziAecs.exe
  C:\Windows\System\RziAecs.exe
  2⤵
  PID:7888
- C:\Windows\System\SegfUrv.exe
  C:\Windows\System\SegfUrv.exe
  2⤵
  PID:7912
- C:\Windows\System\eMQPHhN.exe
  C:\Windows\System\eMQPHhN.exe
  2⤵
  PID:7932
- C:\Windows\System\fzMOkfL.exe
  C:\Windows\System\fzMOkfL.exe
  2⤵
  PID:7968
- C:\Windows\System\uFkSzGW.exe
  C:\Windows\System\uFkSzGW.exe
  2⤵
  PID:7996
- C:\Windows\System\KObzkQZ.exe
  C:\Windows\System\KObzkQZ.exe
  2⤵
  PID:8016
- C:\Windows\System\owcGxlv.exe
  C:\Windows\System\owcGxlv.exe
  2⤵
  PID:8040
- C:\Windows\System\UvLfZed.exe
  C:\Windows\System\UvLfZed.exe
  2⤵
  PID:8064
- C:\Windows\System\CILLBSe.exe
  C:\Windows\System\CILLBSe.exe
  2⤵
  PID:8088
- C:\Windows\System\XLflVZt.exe
  C:\Windows\System\XLflVZt.exe
  2⤵
  PID:8112
- C:\Windows\System\MFkjGIu.exe
  C:\Windows\System\MFkjGIu.exe
  2⤵
  PID:8144
- C:\Windows\System\SCLtGIG.exe
  C:\Windows\System\SCLtGIG.exe
  2⤵
  PID:8168
- C:\Windows\System\LZHJycm.exe
  C:\Windows\System\LZHJycm.exe
  2⤵
  PID:7120
- C:\Windows\System\xXLcOEq.exe
  C:\Windows\System\xXLcOEq.exe
  2⤵
  PID:7136
- C:\Windows\System\HPrBVCO.exe
  C:\Windows\System\HPrBVCO.exe
  2⤵
  PID:6744
- C:\Windows\System\oXJLUav.exe
  C:\Windows\System\oXJLUav.exe
  2⤵
  PID:6216
- C:\Windows\System\bQeVkjN.exe
  C:\Windows\System\bQeVkjN.exe
  2⤵
  PID:1388
- C:\Windows\System\CZRSKfG.exe
  C:\Windows\System\CZRSKfG.exe
  2⤵
  PID:5916
- C:\Windows\System\WTgcfMS.exe
  C:\Windows\System\WTgcfMS.exe
  2⤵
  PID:6616
- C:\Windows\System\SnlpshS.exe
  C:\Windows\System\SnlpshS.exe
  2⤵
  PID:6936
- C:\Windows\System\bCqiwye.exe
  C:\Windows\System\bCqiwye.exe
  2⤵
  PID:7236
- C:\Windows\System\XsiOZKy.exe
  C:\Windows\System\XsiOZKy.exe
  2⤵
  PID:6632
- C:\Windows\System\UTefQzE.exe
  C:\Windows\System\UTefQzE.exe
  2⤵
  PID:7412
- C:\Windows\System\HobeThq.exe
  C:\Windows\System\HobeThq.exe
  2⤵
  PID:7508
- C:\Windows\System\hdqDJmK.exe
  C:\Windows\System\hdqDJmK.exe
  2⤵
  PID:6864
- C:\Windows\System\fdzTHdh.exe
  C:\Windows\System\fdzTHdh.exe
  2⤵
  PID:7064
- C:\Windows\System\rUvTrvQ.exe
  C:\Windows\System\rUvTrvQ.exe
  2⤵
  PID:7428
- C:\Windows\System\rfITrGz.exe
  C:\Windows\System\rfITrGz.exe
  2⤵
  PID:7672
- C:\Windows\System\vEgNTYW.exe
  C:\Windows\System\vEgNTYW.exe
  2⤵
  PID:7348
- C:\Windows\System\PReBCoT.exe
  C:\Windows\System\PReBCoT.exe
  2⤵
  PID:6360
- C:\Windows\System\JoLUQsF.exe
  C:\Windows\System\JoLUQsF.exe
  2⤵
  PID:7540
- C:\Windows\System\KthtZfX.exe
  C:\Windows\System\KthtZfX.exe
  2⤵
  PID:7208
- C:\Windows\System\rWBRQPv.exe
  C:\Windows\System\rWBRQPv.exe
  2⤵
  PID:7828
- C:\Windows\System\qvWYdaX.exe
  C:\Windows\System\qvWYdaX.exe
  2⤵
  PID:7852
- C:\Windows\System\CshaxfB.exe
  C:\Windows\System\CshaxfB.exe
  2⤵
  PID:7564
- C:\Windows\System\dHIIwNM.exe
  C:\Windows\System\dHIIwNM.exe
  2⤵
  PID:7452
- C:\Windows\System\SpwoZOW.exe
  C:\Windows\System\SpwoZOW.exe
  2⤵
  PID:7320
- C:\Windows\System\Wvdwhis.exe
  C:\Windows\System\Wvdwhis.exe
  2⤵
  PID:7908
- C:\Windows\System\ISDREAC.exe
  C:\Windows\System\ISDREAC.exe
  2⤵
  PID:7696
- C:\Windows\System\oURUjNP.exe
  C:\Windows\System\oURUjNP.exe
  2⤵
  PID:8132
- C:\Windows\System\faGJgHc.exe
  C:\Windows\System\faGJgHc.exe
  2⤵
  PID:7764
- C:\Windows\System\HLBquwq.exe
  C:\Windows\System\HLBquwq.exe
  2⤵
  PID:6712
- C:\Windows\System\CeGUgSS.exe
  C:\Windows\System\CeGUgSS.exe
  2⤵
  PID:8204
- C:\Windows\System\obScqPU.exe
  C:\Windows\System\obScqPU.exe
  2⤵
  PID:8228
- C:\Windows\System\FKmnJlF.exe
  C:\Windows\System\FKmnJlF.exe
  2⤵
  PID:8252
- C:\Windows\System\QBJtIaT.exe
  C:\Windows\System\QBJtIaT.exe
  2⤵
  PID:8272
- C:\Windows\System\JzPxGHF.exe
  C:\Windows\System\JzPxGHF.exe
  2⤵
  PID:8292
- C:\Windows\System\wdBWpmk.exe
  C:\Windows\System\wdBWpmk.exe
  2⤵
  PID:8336
- C:\Windows\System\EuTQwAU.exe
  C:\Windows\System\EuTQwAU.exe
  2⤵
  PID:8360
- C:\Windows\System\fVGrvYa.exe
  C:\Windows\System\fVGrvYa.exe
  2⤵
  PID:8384
- C:\Windows\System\ZXntugm.exe
  C:\Windows\System\ZXntugm.exe
  2⤵
  PID:8400
- C:\Windows\System\HJoFdPk.exe
  C:\Windows\System\HJoFdPk.exe
  2⤵
  PID:8420
- C:\Windows\System\fuvlRcQ.exe
  C:\Windows\System\fuvlRcQ.exe
  2⤵
  PID:8444
- C:\Windows\System\kbQzeMK.exe
  C:\Windows\System\kbQzeMK.exe
  2⤵
  PID:8468
- C:\Windows\System\sCeXyxc.exe
  C:\Windows\System\sCeXyxc.exe
  2⤵
  PID:8488
- C:\Windows\System\omgHCAK.exe
  C:\Windows\System\omgHCAK.exe
  2⤵
  PID:8508
- C:\Windows\System\RoSFqqO.exe
  C:\Windows\System\RoSFqqO.exe
  2⤵
  PID:8528
- C:\Windows\System\oNvWAXt.exe
  C:\Windows\System\oNvWAXt.exe
  2⤵
  PID:8548
- C:\Windows\System\KWBvBbm.exe
  C:\Windows\System\KWBvBbm.exe
  2⤵
  PID:8576
- C:\Windows\System\dZpFfqk.exe
  C:\Windows\System\dZpFfqk.exe
  2⤵
  PID:8596
- C:\Windows\System\ybioiXx.exe
  C:\Windows\System\ybioiXx.exe
  2⤵
  PID:8636
- C:\Windows\System\EUGxptf.exe
  C:\Windows\System\EUGxptf.exe
  2⤵
  PID:8652
- C:\Windows\System\UrMAcrK.exe
  C:\Windows\System\UrMAcrK.exe
  2⤵
  PID:8676
- C:\Windows\System\wzPWmQa.exe
  C:\Windows\System\wzPWmQa.exe
  2⤵
  PID:8700
- C:\Windows\System\WGkxSxo.exe
  C:\Windows\System\WGkxSxo.exe
  2⤵
  PID:8724
- C:\Windows\System\cKpjOTm.exe
  C:\Windows\System\cKpjOTm.exe
  2⤵
  PID:8740
- C:\Windows\System\AYGXkVu.exe
  C:\Windows\System\AYGXkVu.exe
  2⤵
  PID:8764
- C:\Windows\System\gTfjUYM.exe
  C:\Windows\System\gTfjUYM.exe
  2⤵
  PID:8784
- C:\Windows\System\iDCHUJi.exe
  C:\Windows\System\iDCHUJi.exe
  2⤵
  PID:8804
- C:\Windows\System\vCmIBeM.exe
  C:\Windows\System\vCmIBeM.exe
  2⤵
  PID:8824
- C:\Windows\System\MAVlBSR.exe
  C:\Windows\System\MAVlBSR.exe
  2⤵
  PID:8848
- C:\Windows\System\WZvajAq.exe
  C:\Windows\System\WZvajAq.exe
  2⤵
  PID:8868
- C:\Windows\System\UtbOtlp.exe
  C:\Windows\System\UtbOtlp.exe
  2⤵
  PID:8900
- C:\Windows\System\UrHlCsN.exe
  C:\Windows\System\UrHlCsN.exe
  2⤵
  PID:8916
- C:\Windows\System\jBVPUBH.exe
  C:\Windows\System\jBVPUBH.exe
  2⤵
  PID:8936
- C:\Windows\System\sQqqLwQ.exe
  C:\Windows\System\sQqqLwQ.exe
  2⤵
  PID:8976
- C:\Windows\System\FXNMwpv.exe
  C:\Windows\System\FXNMwpv.exe
  2⤵
  PID:8996
- C:\Windows\System\fERLEaK.exe
  C:\Windows\System\fERLEaK.exe
  2⤵
  PID:9012
- C:\Windows\System\NytiKJW.exe
  C:\Windows\System\NytiKJW.exe
  2⤵
  PID:9032
- C:\Windows\System\AAAfMrF.exe
  C:\Windows\System\AAAfMrF.exe
  2⤵
  PID:9052
- C:\Windows\System\osRwyBa.exe
  C:\Windows\System\osRwyBa.exe
  2⤵
  PID:9072
- C:\Windows\System\pNlkbIH.exe
  C:\Windows\System\pNlkbIH.exe
  2⤵
  PID:9092
- C:\Windows\System\owYRCpc.exe
  C:\Windows\System\owYRCpc.exe
  2⤵
  PID:9116
- C:\Windows\System\aMtFdLl.exe
  C:\Windows\System\aMtFdLl.exe
  2⤵
  PID:9140
- C:\Windows\System\dysiaLV.exe
  C:\Windows\System\dysiaLV.exe
  2⤵
  PID:9164
- C:\Windows\System\HZnBVuW.exe
  C:\Windows\System\HZnBVuW.exe
  2⤵
  PID:9180
- C:\Windows\System\XbHvNMk.exe
  C:\Windows\System\XbHvNMk.exe
  2⤵
  PID:9204
- C:\Windows\System\lGwfkUo.exe
  C:\Windows\System\lGwfkUo.exe
  2⤵
  PID:6280
- C:\Windows\System\CRPTyRM.exe
  C:\Windows\System\CRPTyRM.exe
  2⤵
  PID:6252
- C:\Windows\System\RYZvSvR.exe
  C:\Windows\System\RYZvSvR.exe
  2⤵
  PID:7640
- C:\Windows\System\ruLKIGi.exe
  C:\Windows\System\ruLKIGi.exe
  2⤵
  PID:3940
- C:\Windows\System\ZOMwhNd.exe
  C:\Windows\System\ZOMwhNd.exe
  2⤵
  PID:7976
- C:\Windows\System\JWCWRJa.exe
  C:\Windows\System\JWCWRJa.exe
  2⤵
  PID:8060
- C:\Windows\System\YqBNhKG.exe
  C:\Windows\System\YqBNhKG.exe
  2⤵
  PID:7704
- C:\Windows\System\ONqIORg.exe
  C:\Windows\System\ONqIORg.exe
  2⤵
  PID:7504
- C:\Windows\System\bYoosNX.exe
  C:\Windows\System\bYoosNX.exe
  2⤵
  PID:7272
- C:\Windows\System\OQdxyIK.exe
  C:\Windows\System\OQdxyIK.exe
  2⤵
  PID:4248
- C:\Windows\System\YxIBkSg.exe
  C:\Windows\System\YxIBkSg.exe
  2⤵
  PID:8248
- C:\Windows\System\lQtEcnm.exe
  C:\Windows\System\lQtEcnm.exe
  2⤵
  PID:7260
- C:\Windows\System\ZXmIYbp.exe
  C:\Windows\System\ZXmIYbp.exe
  2⤵
  PID:7036
- C:\Windows\System\VThYCWZ.exe
  C:\Windows\System\VThYCWZ.exe
  2⤵
  PID:6984
- C:\Windows\System\EPWXgpq.exe
  C:\Windows\System\EPWXgpq.exe
  2⤵
  PID:8312
- C:\Windows\System\xwxpqcG.exe
  C:\Windows\System\xwxpqcG.exe
  2⤵
  PID:6868
- C:\Windows\System\HBeBogD.exe
  C:\Windows\System\HBeBogD.exe
  2⤵
  PID:7092
- C:\Windows\System\BoCoohg.exe
  C:\Windows\System\BoCoohg.exe
  2⤵
  PID:8416
- C:\Windows\System\TvYhWEJ.exe
  C:\Windows\System\TvYhWEJ.exe
  2⤵
  PID:8456
- C:\Windows\System\dLfLOxY.exe
  C:\Windows\System\dLfLOxY.exe
  2⤵
  PID:7864
- C:\Windows\System\jjKisLQ.exe
  C:\Windows\System\jjKisLQ.exe
  2⤵
  PID:8572
- C:\Windows\System\bGNMceY.exe
  C:\Windows\System\bGNMceY.exe
  2⤵
  PID:8104
- C:\Windows\System\eYjofjk.exe
  C:\Windows\System\eYjofjk.exe
  2⤵
  PID:6784
- C:\Windows\System\SuLRKcl.exe
  C:\Windows\System\SuLRKcl.exe
  2⤵
  PID:8836
- C:\Windows\System\gAhaFBb.exe
  C:\Windows\System\gAhaFBb.exe
  2⤵
  PID:4036
- C:\Windows\System\GSNFRmf.exe
  C:\Windows\System\GSNFRmf.exe
  2⤵
  PID:8932
- C:\Windows\System\XfPeGAl.exe
  C:\Windows\System\XfPeGAl.exe
  2⤵
  PID:9224
- C:\Windows\System\cLBBopH.exe
  C:\Windows\System\cLBBopH.exe
  2⤵
  PID:9240
- C:\Windows\System\pifAqrz.exe
  C:\Windows\System\pifAqrz.exe
  2⤵
  PID:9268
- C:\Windows\System\sCQMLKX.exe
  C:\Windows\System\sCQMLKX.exe
  2⤵
  PID:9292
- C:\Windows\System\qnbfIMN.exe
  C:\Windows\System\qnbfIMN.exe
  2⤵
  PID:9312
- C:\Windows\System\PYwckSG.exe
  C:\Windows\System\PYwckSG.exe
  2⤵
  PID:9340
- C:\Windows\System\uPYClXH.exe
  C:\Windows\System\uPYClXH.exe
  2⤵
  PID:9364
- C:\Windows\System\ddnpnQh.exe
  C:\Windows\System\ddnpnQh.exe
  2⤵
  PID:9384
- C:\Windows\System\ZlAIXqy.exe
  C:\Windows\System\ZlAIXqy.exe
  2⤵
  PID:9400
- C:\Windows\System\aclJDQa.exe
  C:\Windows\System\aclJDQa.exe
  2⤵
  PID:9420
- C:\Windows\System\AzSfDUM.exe
  C:\Windows\System\AzSfDUM.exe
  2⤵
  PID:9440
- C:\Windows\System\poByuAb.exe
  C:\Windows\System\poByuAb.exe
  2⤵
  PID:9460
- C:\Windows\System\FTtFxbs.exe
  C:\Windows\System\FTtFxbs.exe
  2⤵
  PID:9484
- C:\Windows\System\XgVziBt.exe
  C:\Windows\System\XgVziBt.exe
  2⤵
  PID:9512
- C:\Windows\System\EwBZGtS.exe
  C:\Windows\System\EwBZGtS.exe
  2⤵
  PID:9532
- C:\Windows\System\KwdzuBm.exe
  C:\Windows\System\KwdzuBm.exe
  2⤵
  PID:9552
- C:\Windows\System\vmnxHOF.exe
  C:\Windows\System\vmnxHOF.exe
  2⤵
  PID:9572
- C:\Windows\System\dQpOiRZ.exe
  C:\Windows\System\dQpOiRZ.exe
  2⤵
  PID:9600
- C:\Windows\System\jIAqvDN.exe
  C:\Windows\System\jIAqvDN.exe
  2⤵
  PID:9620
- C:\Windows\System\byuxBXd.exe
  C:\Windows\System\byuxBXd.exe
  2⤵
  PID:9644
- C:\Windows\System\alhAHyW.exe
  C:\Windows\System\alhAHyW.exe
  2⤵
  PID:9664
- C:\Windows\System\zUMhFyT.exe
  C:\Windows\System\zUMhFyT.exe
  2⤵
  PID:9688
- C:\Windows\System\qNndXrZ.exe
  C:\Windows\System\qNndXrZ.exe
  2⤵
  PID:9708
- C:\Windows\System\hQfsOdX.exe
  C:\Windows\System\hQfsOdX.exe
  2⤵
  PID:9728
- C:\Windows\System\HEcKqJw.exe
  C:\Windows\System\HEcKqJw.exe
  2⤵
  PID:9748
- C:\Windows\System\yrSivjW.exe
  C:\Windows\System\yrSivjW.exe
  2⤵
  PID:9772
- C:\Windows\System\MKWAOXG.exe
  C:\Windows\System\MKWAOXG.exe
  2⤵
  PID:9792
- C:\Windows\System\veNqZxU.exe
  C:\Windows\System\veNqZxU.exe
  2⤵
  PID:9816
- C:\Windows\System\xFvywdw.exe
  C:\Windows\System\xFvywdw.exe
  2⤵
  PID:9840
- C:\Windows\System\oXBxmfa.exe
  C:\Windows\System\oXBxmfa.exe
  2⤵
  PID:9860
- C:\Windows\System\DkvGdAl.exe
  C:\Windows\System\DkvGdAl.exe
  2⤵
  PID:9884
- C:\Windows\System\rnJgFXw.exe
  C:\Windows\System\rnJgFXw.exe
  2⤵
  PID:9912
- C:\Windows\System\JlfYoYQ.exe
  C:\Windows\System\JlfYoYQ.exe
  2⤵
  PID:9936
- C:\Windows\System\RcNjCfA.exe
  C:\Windows\System\RcNjCfA.exe
  2⤵
  PID:9956
- C:\Windows\System\rCamhZd.exe
  C:\Windows\System\rCamhZd.exe
  2⤵
  PID:10152
- C:\Windows\System\hqcbXub.exe
  C:\Windows\System\hqcbXub.exe
  2⤵
  PID:10204
- C:\Windows\System\HhsjZLw.exe
  C:\Windows\System\HhsjZLw.exe
  2⤵
  PID:10224
- C:\Windows\System\yHtEsxY.exe
  C:\Windows\System\yHtEsxY.exe
  2⤵
  PID:9004
- C:\Windows\System\lKSnOgr.exe
  C:\Windows\System\lKSnOgr.exe
  2⤵
  PID:9112
- C:\Windows\System\CjQaQpR.exe
  C:\Windows\System\CjQaQpR.exe
  2⤵
  PID:8604
- C:\Windows\System\QwFlVYa.exe
  C:\Windows\System\QwFlVYa.exe
  2⤵
  PID:8024
- C:\Windows\System\CGfwKib.exe
  C:\Windows\System\CGfwKib.exe
  2⤵
  PID:372
- C:\Windows\System\gTTyHnf.exe
  C:\Windows\System\gTTyHnf.exe
  2⤵
  PID:7520
- C:\Windows\System\tdWJxeZ.exe
  C:\Windows\System\tdWJxeZ.exe
  2⤵
  PID:8664
- C:\Windows\System\wvFNauI.exe
  C:\Windows\System\wvFNauI.exe
  2⤵
  PID:8224
- C:\Windows\System\sSqtbQu.exe
  C:\Windows\System\sSqtbQu.exe
  2⤵
  PID:8732
- C:\Windows\System\jKaSJwx.exe
  C:\Windows\System\jKaSJwx.exe
  2⤵
  PID:6176
- C:\Windows\System\zilcmJD.exe
  C:\Windows\System\zilcmJD.exe
  2⤵
  PID:8308
- C:\Windows\System\IoToCwO.exe
  C:\Windows\System\IoToCwO.exe
  2⤵
  PID:8280
- C:\Windows\System\InBtJEE.exe
  C:\Windows\System\InBtJEE.exe
  2⤵
  PID:8356
- C:\Windows\System\HwSqbki.exe
  C:\Windows\System\HwSqbki.exe
  2⤵
  PID:8392
- C:\Windows\System\laImqNx.exe
  C:\Windows\System\laImqNx.exe
  2⤵
  PID:8952
- C:\Windows\System\NNfNNpP.exe
  C:\Windows\System\NNfNNpP.exe
  2⤵
  PID:9248
- C:\Windows\System\sjSefnC.exe
  C:\Windows\System\sjSefnC.exe
  2⤵
  PID:9348
- C:\Windows\System\twUCurO.exe
  C:\Windows\System\twUCurO.exe
  2⤵
  PID:7460
- C:\Windows\System\NsKudfS.exe
  C:\Windows\System\NsKudfS.exe
  2⤵
  PID:9304
- C:\Windows\System\ZYAROzR.exe
  C:\Windows\System\ZYAROzR.exe
  2⤵
  PID:9408
- C:\Windows\System\fLAOuBJ.exe
  C:\Windows\System\fLAOuBJ.exe
  2⤵
  PID:8668
- C:\Windows\System\bXQlRVI.exe
  C:\Windows\System\bXQlRVI.exe
  2⤵
  PID:9060
- C:\Windows\System\ynXindM.exe
  C:\Windows\System\ynXindM.exe
  2⤵
  PID:8524
- C:\Windows\System\zGdmfpr.exe
  C:\Windows\System\zGdmfpr.exe
  2⤵
  PID:8540
- C:\Windows\System\EXSnySZ.exe
  C:\Windows\System\EXSnySZ.exe
  2⤵
  PID:9608
- C:\Windows\System\GFQxzYU.exe
  C:\Windows\System\GFQxzYU.exe
  2⤵
  PID:7568
- C:\Windows\System\HESLqww.exe
  C:\Windows\System\HESLqww.exe
  2⤵
  PID:9672
- C:\Windows\System\UiKyAjI.exe
  C:\Windows\System\UiKyAjI.exe
  2⤵
  PID:9720
- C:\Windows\System\WjXwXHe.exe
  C:\Windows\System\WjXwXHe.exe
  2⤵
  PID:9828
- C:\Windows\System\xVfIdpD.exe
  C:\Windows\System\xVfIdpD.exe
  2⤵
  PID:9856
- C:\Windows\System\iywEHni.exe
  C:\Windows\System\iywEHni.exe
  2⤵
  PID:10244
- C:\Windows\System\uKmMzZy.exe
  C:\Windows\System\uKmMzZy.exe
  2⤵
  PID:10272
- C:\Windows\System\fPozZNQ.exe
  C:\Windows\System\fPozZNQ.exe
  2⤵
  PID:10292
- C:\Windows\System\ovXIyra.exe
  C:\Windows\System\ovXIyra.exe
  2⤵
  PID:10328
- C:\Windows\System\BtYEuOv.exe
  C:\Windows\System\BtYEuOv.exe
  2⤵
  PID:10360
- C:\Windows\System\jVvlZZa.exe
  C:\Windows\System\jVvlZZa.exe
  2⤵
  PID:10380
- C:\Windows\System\ZypLSTI.exe
  C:\Windows\System\ZypLSTI.exe
  2⤵
  PID:10412
- C:\Windows\System\kmmGBpY.exe
  C:\Windows\System\kmmGBpY.exe
  2⤵
  PID:10428
- C:\Windows\System\uxyxIzI.exe
  C:\Windows\System\uxyxIzI.exe
  2⤵
  PID:10464
- C:\Windows\System\BVwwPse.exe
  C:\Windows\System\BVwwPse.exe
  2⤵
  PID:10484
- C:\Windows\System\nihHCac.exe
  C:\Windows\System\nihHCac.exe
  2⤵
  PID:10504
- C:\Windows\System\QnLnoDB.exe
  C:\Windows\System\QnLnoDB.exe
  2⤵
  PID:10532
- C:\Windows\System\BhXYMzW.exe
  C:\Windows\System\BhXYMzW.exe
  2⤵
  PID:10564
- C:\Windows\System\rTQFjnp.exe
  C:\Windows\System\rTQFjnp.exe
  2⤵
  PID:10592
- C:\Windows\System\RKHpZij.exe
  C:\Windows\System\RKHpZij.exe
  2⤵
  PID:10640
- C:\Windows\System\PZDPCeK.exe
  C:\Windows\System\PZDPCeK.exe
  2⤵
  PID:10664
- C:\Windows\System\VlsGIvZ.exe
  C:\Windows\System\VlsGIvZ.exe
  2⤵
  PID:10684
- C:\Windows\System\ZWUgmeR.exe
  C:\Windows\System\ZWUgmeR.exe
  2⤵
  PID:10708
- C:\Windows\System\GZmbQga.exe
  C:\Windows\System\GZmbQga.exe
  2⤵
  PID:10732
- C:\Windows\System\SHSLHrq.exe
  C:\Windows\System\SHSLHrq.exe
  2⤵
  PID:10752
- C:\Windows\System\uVLugqG.exe
  C:\Windows\System\uVLugqG.exe
  2⤵
  PID:10772
- C:\Windows\System\PxANlxM.exe
  C:\Windows\System\PxANlxM.exe
  2⤵
  PID:10800
- C:\Windows\System\kIAtHlg.exe
  C:\Windows\System\kIAtHlg.exe
  2⤵
  PID:10816
- C:\Windows\System\xpiRxFE.exe
  C:\Windows\System\xpiRxFE.exe
  2⤵
  PID:10840
- C:\Windows\System\HlgkxDy.exe
  C:\Windows\System\HlgkxDy.exe
  2⤵
  PID:10864
- C:\Windows\System\WkZwwpc.exe
  C:\Windows\System\WkZwwpc.exe
  2⤵
  PID:10884
- C:\Windows\System\ZvfyuDS.exe
  C:\Windows\System\ZvfyuDS.exe
  2⤵
  PID:10904
- C:\Windows\System\BrTJQVb.exe
  C:\Windows\System\BrTJQVb.exe
  2⤵
  PID:10924
- C:\Windows\System\qhdCRtM.exe
  C:\Windows\System\qhdCRtM.exe
  2⤵
  PID:10948
- C:\Windows\System\nmDJQSp.exe
  C:\Windows\System\nmDJQSp.exe
  2⤵
  PID:10964
- C:\Windows\System\drZszpO.exe
  C:\Windows\System\drZszpO.exe
  2⤵
  PID:10980
- C:\Windows\System\KdCFkId.exe
  C:\Windows\System\KdCFkId.exe
  2⤵
  PID:11000
- C:\Windows\System\pmfaTYK.exe
  C:\Windows\System\pmfaTYK.exe
  2⤵
  PID:11016
- C:\Windows\System\FHpZuMo.exe
  C:\Windows\System\FHpZuMo.exe
  2⤵
  PID:11040
- C:\Windows\System\GArgHLU.exe
  C:\Windows\System\GArgHLU.exe
  2⤵
  PID:11064
- C:\Windows\System\oisgNRN.exe
  C:\Windows\System\oisgNRN.exe
  2⤵
  PID:11088
- C:\Windows\System\hhpBgCg.exe
  C:\Windows\System\hhpBgCg.exe
  2⤵
  PID:11104
- C:\Windows\System\owPofMf.exe
  C:\Windows\System\owPofMf.exe
  2⤵
  PID:11128
- C:\Windows\System\lpIyKCC.exe
  C:\Windows\System\lpIyKCC.exe
  2⤵
  PID:11152
- C:\Windows\System\AsveLDe.exe
  C:\Windows\System\AsveLDe.exe
  2⤵
  PID:11176
- C:\Windows\System\mgAhxVc.exe
  C:\Windows\System\mgAhxVc.exe
  2⤵
  PID:11200
- C:\Windows\System\cNIwQCL.exe
  C:\Windows\System\cNIwQCL.exe
  2⤵
  PID:11220
- C:\Windows\System\rwVczKl.exe
  C:\Windows\System\rwVczKl.exe
  2⤵
  PID:11236
- C:\Windows\System\mKhkDEI.exe
  C:\Windows\System\mKhkDEI.exe
  2⤵
  PID:11256
- C:\Windows\System\sCJWazG.exe
  C:\Windows\System\sCJWazG.exe
  2⤵
  PID:7656
- C:\Windows\System\ZLpZgNb.exe
  C:\Windows\System\ZLpZgNb.exe
  2⤵
  PID:10012
- C:\Windows\System\VgieDdZ.exe
  C:\Windows\System\VgieDdZ.exe
  2⤵
  PID:6472
- C:\Windows\System\RysRZEL.exe
  C:\Windows\System\RysRZEL.exe
  2⤵
  PID:2688
- C:\Windows\System\diZRJXV.exe
  C:\Windows\System\diZRJXV.exe
  2⤵
  PID:8968
- C:\Windows\System\yhEzTtV.exe
  C:\Windows\System\yhEzTtV.exe
  2⤵
  PID:9040
- C:\Windows\System\MiIlDgO.exe
  C:\Windows\System\MiIlDgO.exe
  2⤵
  PID:8956
- C:\Windows\System\ueKSSzu.exe
  C:\Windows\System\ueKSSzu.exe
  2⤵
  PID:8460
- C:\Windows\System\JryYUBD.exe
  C:\Windows\System\JryYUBD.exe
  2⤵
  PID:3928
- C:\Windows\System\jirWhop.exe
  C:\Windows\System\jirWhop.exe
  2⤵
  PID:9548
- C:\Windows\System\UOxNuik.exe
  C:\Windows\System\UOxNuik.exe
  2⤵
  PID:5064
- C:\Windows\System\NoUjdKs.exe
  C:\Windows\System\NoUjdKs.exe
  2⤵
  PID:9148
- C:\Windows\System\qhKVYjD.exe
  C:\Windows\System\qhKVYjD.exe
  2⤵
  PID:9632
- C:\Windows\System\geAMQTA.exe
  C:\Windows\System\geAMQTA.exe
  2⤵
  PID:9684
- C:\Windows\System\voPGpoJ.exe
  C:\Windows\System\voPGpoJ.exe
  2⤵
  PID:8556
- C:\Windows\System\YpIPTcf.exe
  C:\Windows\System\YpIPTcf.exe
  2⤵
  PID:8896
- C:\Windows\System\UNIjdrI.exe
  C:\Windows\System\UNIjdrI.exe
  2⤵
  PID:9476
- C:\Windows\System\SqbMOws.exe
  C:\Windows\System\SqbMOws.exe
  2⤵
  PID:7596
- C:\Windows\System\odyPjlL.exe
  C:\Windows\System\odyPjlL.exe
  2⤵
  PID:10852
- C:\Windows\System\mkuNEGn.exe
  C:\Windows\System\mkuNEGn.exe
  2⤵
  PID:8504
- C:\Windows\System\FnZxTCA.exe
  C:\Windows\System\FnZxTCA.exe
  2⤵
  PID:9920
- C:\Windows\System\irBDfON.exe
  C:\Windows\System\irBDfON.exe
  2⤵
  PID:11268
- C:\Windows\System\QrufpHP.exe
  C:\Windows\System\QrufpHP.exe
  2⤵
  PID:11312
- C:\Windows\System\BmLqrAW.exe
  C:\Windows\System\BmLqrAW.exe
  2⤵
  PID:11336
- C:\Windows\System\vjuTSlP.exe
  C:\Windows\System\vjuTSlP.exe
  2⤵
  PID:11360
- C:\Windows\System\uGUDjyD.exe
  C:\Windows\System\uGUDjyD.exe
  2⤵
  PID:11384
- C:\Windows\System\XmysilE.exe
  C:\Windows\System\XmysilE.exe
  2⤵
  PID:11408
- C:\Windows\System\YRsWfNk.exe
  C:\Windows\System\YRsWfNk.exe
  2⤵
  PID:11432
- C:\Windows\System\HDtOBWm.exe
  C:\Windows\System\HDtOBWm.exe
  2⤵
  PID:11460
- C:\Windows\System\ENkjRGX.exe
  C:\Windows\System\ENkjRGX.exe
  2⤵
  PID:11476
- C:\Windows\System\VsmUKtD.exe
  C:\Windows\System\VsmUKtD.exe
  2⤵
  PID:11504
- C:\Windows\System\uUORONG.exe
  C:\Windows\System\uUORONG.exe
  2⤵
  PID:11544
- C:\Windows\System\EVBordE.exe
  C:\Windows\System\EVBordE.exe
  2⤵
  PID:11572
- C:\Windows\System\JFSrSPo.exe
  C:\Windows\System\JFSrSPo.exe
  2⤵
  PID:11596
- C:\Windows\System\UKOMRgm.exe
  C:\Windows\System\UKOMRgm.exe
  2⤵
  PID:11616
- C:\Windows\System\szcJfWX.exe
  C:\Windows\System\szcJfWX.exe
  2⤵
  PID:11636
- C:\Windows\System\plksHOZ.exe
  C:\Windows\System\plksHOZ.exe
  2⤵
  PID:11660
- C:\Windows\System\TSTIvmX.exe
  C:\Windows\System\TSTIvmX.exe
  2⤵
  PID:11692
- C:\Windows\System\mLmXKoY.exe
  C:\Windows\System\mLmXKoY.exe
  2⤵
  PID:11724
- C:\Windows\System\VJmpJzt.exe
  C:\Windows\System\VJmpJzt.exe
  2⤵
  PID:11744
- C:\Windows\System\ZRIYHbU.exe
  C:\Windows\System\ZRIYHbU.exe
  2⤵
  PID:11764
- C:\Windows\System\VjhlUAv.exe
  C:\Windows\System\VjhlUAv.exe
  2⤵
  PID:11788
- C:\Windows\System\JwVjMUY.exe
  C:\Windows\System\JwVjMUY.exe
  2⤵
  PID:11808
- C:\Windows\System\rsPLiVL.exe
  C:\Windows\System\rsPLiVL.exe
  2⤵
  PID:11828
- C:\Windows\System\EddtkEL.exe
  C:\Windows\System\EddtkEL.exe
  2⤵
  PID:11848
- C:\Windows\System\mBESyCq.exe
  C:\Windows\System\mBESyCq.exe
  2⤵
  PID:11868
- C:\Windows\System\TJDXMmy.exe
  C:\Windows\System\TJDXMmy.exe
  2⤵
  PID:11892
- C:\Windows\System\fwmYAok.exe
  C:\Windows\System\fwmYAok.exe
  2⤵
  PID:11920
- C:\Windows\System\ctRFmtT.exe
  C:\Windows\System\ctRFmtT.exe
  2⤵
  PID:11940
- C:\Windows\System\iUdsfSX.exe
  C:\Windows\System\iUdsfSX.exe
  2⤵
  PID:11960
- C:\Windows\System\oMCMGAy.exe
  C:\Windows\System\oMCMGAy.exe
  2⤵
  PID:11984
- C:\Windows\System\NIfBWDl.exe
  C:\Windows\System\NIfBWDl.exe
  2⤵
  PID:12008
- C:\Windows\System\rwsWHwF.exe
  C:\Windows\System\rwsWHwF.exe
  2⤵
  PID:12032
- C:\Windows\System\PkevpZi.exe
  C:\Windows\System\PkevpZi.exe
  2⤵
  PID:12068
- C:\Windows\System\YySdsZY.exe
  C:\Windows\System\YySdsZY.exe
  2⤵
  PID:12092
- C:\Windows\System\jjWTxip.exe
  C:\Windows\System\jjWTxip.exe
  2⤵
  PID:10636
- C:\Windows\System\IYmIQPJ.exe
  C:\Windows\System\IYmIQPJ.exe
  2⤵
  PID:10692
- C:\Windows\System\KVrVkWL.exe
  C:\Windows\System\KVrVkWL.exe
  2⤵
  PID:10824
- C:\Windows\System\LCcPerQ.exe
  C:\Windows\System\LCcPerQ.exe
  2⤵
  PID:9108
- C:\Windows\System\lJyXiSk.exe
  C:\Windows\System\lJyXiSk.exe
  2⤵
  PID:10996
- C:\Windows\System\YhYfUCE.exe
  C:\Windows\System\YhYfUCE.exe
  2⤵
  PID:11048
- C:\Windows\System\XvEXfmB.exe
  C:\Windows\System\XvEXfmB.exe
  2⤵
  PID:11212
- C:\Windows\System\WbFMTzB.exe
  C:\Windows\System\WbFMTzB.exe
  2⤵
  PID:9544
- C:\Windows\System\UtnBOpO.exe
  C:\Windows\System\UtnBOpO.exe
  2⤵
  PID:10216
- C:\Windows\System\sBRxPhT.exe
  C:\Windows\System\sBRxPhT.exe
  2⤵
  PID:10676
- C:\Windows\System\rrNDRUJ.exe
  C:\Windows\System\rrNDRUJ.exe
  2⤵
  PID:7928
- C:\Windows\System\OYCHGjU.exe
  C:\Windows\System\OYCHGjU.exe
  2⤵
  PID:10176
- C:\Windows\System\lFwWqiA.exe
  C:\Windows\System\lFwWqiA.exe
  2⤵
  PID:11320
- C:\Windows\System\XbYyvzF.exe
  C:\Windows\System\XbYyvzF.exe
  2⤵
  PID:11368
- C:\Windows\System\RxZYWee.exe
  C:\Windows\System\RxZYWee.exe
  2⤵
  PID:11440
- C:\Windows\System\tSBBvUf.exe
  C:\Windows\System\tSBBvUf.exe
  2⤵
  PID:8816
- C:\Windows\System\mbURebY.exe
  C:\Windows\System\mbURebY.exe
  2⤵
  PID:11232
- C:\Windows\System\cQfWwlF.exe
  C:\Windows\System\cQfWwlF.exe
  2⤵
  PID:11836
- C:\Windows\System\HQgxqAE.exe
  C:\Windows\System\HQgxqAE.exe
  2⤵
  PID:10280
- C:\Windows\System\RjHbYDg.exe
  C:\Windows\System\RjHbYDg.exe
  2⤵
  PID:10440
- C:\Windows\System\fOOhkCo.exe
  C:\Windows\System\fOOhkCo.exe
  2⤵
  PID:11936
- C:\Windows\System\sfYrVLr.exe
  C:\Windows\System\sfYrVLr.exe
  2⤵
  PID:12004
- C:\Windows\System\bxWWeWE.exe
  C:\Windows\System\bxWWeWE.exe
  2⤵
  PID:10540
- C:\Windows\System\HGDzjot.exe
  C:\Windows\System\HGDzjot.exe
  2⤵
  PID:8696
- C:\Windows\System\dMzGvhl.exe
  C:\Windows\System\dMzGvhl.exe
  2⤵
  PID:11552
- C:\Windows\System\cRCfYPh.exe
  C:\Windows\System\cRCfYPh.exe
  2⤵
  PID:11716
- C:\Windows\System\BqyIiEf.exe
  C:\Windows\System\BqyIiEf.exe
  2⤵
  PID:11784
- C:\Windows\System\kZFpIUr.exe
  C:\Windows\System\kZFpIUr.exe
  2⤵
  PID:12300
- C:\Windows\System\MHSwiWL.exe
  C:\Windows\System\MHSwiWL.exe
  2⤵
  PID:12324
- C:\Windows\System\aQNIScb.exe
  C:\Windows\System\aQNIScb.exe
  2⤵
  PID:12348
- C:\Windows\System\abMzElG.exe
  C:\Windows\System\abMzElG.exe
  2⤵
  PID:12368
- C:\Windows\System\avmdkAl.exe
  C:\Windows\System\avmdkAl.exe
  2⤵
  PID:12392
- C:\Windows\System\tLfASCJ.exe
  C:\Windows\System\tLfASCJ.exe
  2⤵
  PID:12420
- C:\Windows\System\FEDlHst.exe
  C:\Windows\System\FEDlHst.exe
  2⤵
  PID:12444
- C:\Windows\System\ubwqQJA.exe
  C:\Windows\System\ubwqQJA.exe
  2⤵
  PID:12476
- C:\Windows\System\TTObRPG.exe
  C:\Windows\System\TTObRPG.exe
  2⤵
  PID:12760
- C:\Windows\System\BODsJPG.exe
  C:\Windows\System\BODsJPG.exe
  2⤵
  PID:13112
- C:\Windows\System\KwDMLtH.exe
  C:\Windows\System\KwDMLtH.exe
  2⤵
  PID:11612
- C:\Windows\System\TJFdJfl.exe
  C:\Windows\System\TJFdJfl.exe
  2⤵
  PID:5324
- C:\Windows\System\DAvrxfq.exe
  C:\Windows\System\DAvrxfq.exe
  2⤵
  PID:12364
- C:\Windows\System\NXeCxqr.exe
  C:\Windows\System\NXeCxqr.exe
  2⤵
  PID:12432
- C:\Windows\System\JoJcojR.exe
  C:\Windows\System\JoJcojR.exe
  2⤵
  PID:12464
- C:\Windows\System\ofTETuI.exe
  C:\Windows\System\ofTETuI.exe
  2⤵
  PID:12340
- C:\Windows\System\ilXbsxD.exe
  C:\Windows\System\ilXbsxD.exe
  2⤵
  PID:11416
- C:\Windows\System\IHkRiFt.exe
  C:\Windows\System\IHkRiFt.exe
  2⤵
  PID:7340
- C:\Windows\System\fTYhVYO.exe
  C:\Windows\System\fTYhVYO.exe
  2⤵
  PID:4924
- C:\Windows\System\IJbaTYS.exe
  C:\Windows\System\IJbaTYS.exe
  2⤵
  PID:12708
- C:\Windows\System\TEyQfio.exe
  C:\Windows\System\TEyQfio.exe
  2⤵
  PID:12676
- C:\Windows\System\GjirPtX.exe
  C:\Windows\System\GjirPtX.exe
  2⤵
  PID:10496
- C:\Windows\System\YFdGmfV.exe
  C:\Windows\System\YFdGmfV.exe
  2⤵
  PID:11492
- C:\Windows\System\lpxIQTc.exe
  C:\Windows\System\lpxIQTc.exe
  2⤵
  PID:11772
- C:\Windows\System\IHTbCyT.exe
  C:\Windows\System\IHTbCyT.exe
  2⤵
  PID:11488
- C:\Windows\System\WMIQQrZ.exe
  C:\Windows\System\WMIQQrZ.exe
  2⤵
  PID:1356
- C:\Windows\System\LpcgUyH.exe
  C:\Windows\System\LpcgUyH.exe
  2⤵
  PID:12508
- C:\Windows\System\yMRJtkh.exe
  C:\Windows\System\yMRJtkh.exe
  2⤵
  PID:13064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gpruvpac.r3t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BDjrwBs.exe

Filesize
1.9MB

MD5
47c8e6ed569426c063b828eeba1dd445

SHA1
da95a85f40bd3db0fa9b5bad86bcb734588e19d6

SHA256
4a5ff4eac51a62de9cb9788ca0d0ee783d0c018c1c00317c6e5692c3dcf7f60a

SHA512
d06e6e6d7313d80505e08790ba01b6e63ca2d5b4c052145bfdcfbd3a29064c3924aac7e83cc8681048046e2b2c918a9ca336a79ac7298f7c827ee0caf7e9ebe7

Download Submit
C:\Windows\System\CWpxYcs.exe

Filesize
1.9MB

MD5
982f64a835e6f3e8d4fa3f4d288b083b

SHA1
2b9843ee012ac4acaeab75e7cea944e7b378304c

SHA256
4e33a3eb24a09b6760ea1d2e5e9ca58b503687b117b34820b7ae78d3f5434b49

SHA512
9947996f16cf8da1c10d2bccdaea8b9a11f1343ef014b3384a92b383235ca95bc3721ea0752b9f75e117ee507681f5af1e2fe89c5b1911cbed71a9e53cade889

Download Submit
C:\Windows\System\FAdFjyh.exe

Filesize
1.9MB

MD5
0aca911a95d4a90a20877414c675f0ec

SHA1
10a9e90c252e8bc4adf8aa6db8e356fc594a207a

SHA256
e58161f4a6da8fcd3c2dd3aec7aeb1e5d34e3b013137407571d7eee3f61beb83

SHA512
ef834b086743e8c52983a933307edaa017fe222de736e5adc46938d5b4202417405bb9bef691a28dbdc473f6e06dbb6c3d9ac6da272d033465cf323684016ecf

Download Submit
C:\Windows\System\FLDbqWu.exe

Filesize
1.9MB

MD5
86df681139922cbfce2f417a28761027

SHA1
08254d83304b446c6beb6cf805e842b85e5bcd7f

SHA256
94adf082186491c6d15b80a6ed6a56428f4509fc2e3f7c2f603fecf90321614e

SHA512
aa6602497d658e302424fb6af143bf9a23bc7f83b639b1870a76804389d215c661f4786bfbd59f94d1f8f11d48737c5cfa7535fbec985b2c4c22579c4547f1a6

Download Submit
C:\Windows\System\JvJxTFp.exe

Filesize
1.9MB

MD5
ec6b8b1c36d052607502eb9543a728a6

SHA1
213e02e5317184710a56e4c161424f564aee6c3b

SHA256
078ba636c0e15386e176cbb7ba47530c5d33b34bdfaf38e860c6deb3cc3b9fea

SHA512
c98595bd265ab2379b001e302dda7530f6d8af1fb9ecca78519f4a6a5a76ce28308f206a25d77d141a18faee28a62dcbb37b2acb40024870f496a423dc400033

Download Submit
C:\Windows\System\KCJwrSR.exe

Filesize
1.9MB

MD5
1ca9fcc0dc9d7b40b5d1b38329d5a717

SHA1
115749899dbcea1d8e84dd2f31dac56011bdb221

SHA256
f05fe0ef8d9027a2daf609f58f851b9af71c5c93c181b0e2fe3bd3928b8cf480

SHA512
6a70060c0d4f8b486d27b12c51e85a6b18477f45aa19706bb04be40f38d8f59d0051449132ab3a4160052232fdc4f3cf1f65e273cd937e2ca9da812f2d0d51b8

Download Submit
C:\Windows\System\LDSNQir.exe

Filesize
1.9MB

MD5
65bd23808f3b337c5349cb2b5a991cb6

SHA1
2d7454cae258923064d6a8d4925e9072410f4f5b

SHA256
13fb509a296a486710023c4aca032fd8747b2e6b616da8412f94000f194fe53f

SHA512
bb8898b9c54473dc738539e8398428ee654ef58ebf7c65f9d8c039d5a08543c0b68763a126f80b9d9a1c7f6a1f3d5f0334a000b6b31b14a15b2a59b64e9b7342

Download Submit
C:\Windows\System\LtEHlsu.exe

Filesize
1.9MB

MD5
2f5be0feb267b7712fbd21d368768079

SHA1
83cc805a5f0103169df75eac2e19ae7c5c4beb19

SHA256
6e56b0123c12e0f339206c73a6df620fc4bc1e5d148b6968f2c190418e919d18

SHA512
3fcdb59655073a0b2a478e3cba54ecda57476c06359edc19a05632ad6be6f1f5dec71cd1ac241408ef17613d8946d915dca9b82cab97928688a471f3c1ae67ef

Download Submit
C:\Windows\System\MnzWLKq.exe

Filesize
1.9MB

MD5
3453685c1fc9410efd42bccd841ecfe7

SHA1
5a89a8bf5640aba18c88bae4be743f75bd002d4a

SHA256
0b573067056eee776e727dbf6ca770343fc97afde3135e3c601d2a1d4f91ed1a

SHA512
7257b47b00840609c4bd7b96fd4b77c605d736aac550f1cffc695ba36350214a2cfba4415be4a29ec3e374dd7e518c6abe398a0df4398b1f5fd3154e247848ae

Download Submit
C:\Windows\System\NBkeuZD.exe

Filesize
1.9MB

MD5
c881f73aadf75b1f665edc0c5df031ad

SHA1
ac2e70401d32eb201ecd486dad469db6ab58c46b

SHA256
5a6fab539e437be26dbe2de899888b1b8621f17c87cb709e68a6bd74bae576b9

SHA512
11fe84b7949685a2147937758de55c7cc666aa062b6d3ace533d19204059ad7bf946a93886450962acc08bbf60ce0ccc0467dd10d77503e4b82af796d56d75db

Download Submit
C:\Windows\System\NUDIfaT.exe

Filesize
1.9MB

MD5
6e678c0729f2bef6e3cf80fe97cbae37

SHA1
3a62846d1a873d7a595adaaf966240b40ca06816

SHA256
999ad4006c084b8c786441a7f6e3f3ac41b65bd7747e15b85ebb74a200894650

SHA512
fccb891d62a39f2b1a92fc903f924b638e0633b55dc2de23124d00a21a3134c5598b047b5fb0c0bb9eed4951d01c86b95334b8a42e7215ee7a1f2789b8f06133

Download Submit
C:\Windows\System\OCqWIux.exe

Filesize
1.9MB

MD5
dfe70119e9497e49dc7acf0c64a2d03c

SHA1
8a939d9be63881d9f72027e2eb433cc188c56ace

SHA256
701dad2f334402d0877ec31e600a4d585bc50f3db061a9cbb26843da3c69f222

SHA512
e5c90c00c80904634e2422f4b315a8065c4e8a08953d2fe485bda1732409156bd9d389b0e0d24d56fb7fa1f0b1d3db53962d1b72c19551d8082afb01f56463e9

Download Submit
C:\Windows\System\PpeaiXU.exe

Filesize
1.9MB

MD5
0e254f1f33373411c7bc74078d8e3121

SHA1
54d57d18be3a14a54120b1f69667e9878e2092c7

SHA256
953d41564f49db87b386cbf3e7292033993fa362d2b3f16c3bcca977eae38e98

SHA512
6d626283f2483b6a343a92d6ccca9190e84142b0ae2b83cd171d0addfb63c317257b8526fe1656377d7355c98464040f71816771e810181bfd335a0ebccf29d8

Download Submit
C:\Windows\System\QEsvgPu.exe

Filesize
1.9MB

MD5
efd9d40fcfd017e76c09834269add27d

SHA1
2c9f4620b6915b071282c9de3178f013670f7554

SHA256
41e4db3e1b4adb2d3de831bfb357ac94d2bed9cb396ba819ee82814bed280982

SHA512
9af39885e847dbe90202a196569d7741d64924b498fe06666faf90d85316223fc0de43d8850323f5c57e0ee37f3095f5754ecd43fd829c992c21364ac7e950d2

Download Submit
C:\Windows\System\WvpXtmz.exe

Filesize
1.9MB

MD5
2c862c7cebdb4f3f06a71331c1194b34

SHA1
2283e77932fe4bf5ccf8938cc33c0501c228e025

SHA256
65160c0329004b41e282bcc413382cceabcc36a67326a29f5682652ceb7d3c4d

SHA512
f9b2946cd28d7525c4d265557435b1553144de34c2853a6791a3dfd3e88986305a30519b9f9ea0011f7887bc4d65fb9a78141ea4bce45e1b661913b535fdc951

Download Submit
C:\Windows\System\XJuqknT.exe

Filesize
1.9MB

MD5
12ce033df832cd253f4862c264ad42d5

SHA1
ba281f7986be3984b4e041fcd79fb9e84b14fed9

SHA256
50764fb3a3369e04dd24d6fcb7443ead0107fdc9f9230b695ae971968263a7f0

SHA512
f973e66366faf72d13d4dd6c2a8249d18c473d0d2ba89a88db789786a5c83734720e017e63a059ba9d4b7df4e4f622807038813e4088b10c3b59c94506c46b43

Download Submit
C:\Windows\System\XKAneDJ.exe

Filesize
1.9MB

MD5
90d3bee51df10bf090a41bf8a65c3aed

SHA1
2e37eb41c2ff521f47fd07d3d84aab1185976a1f

SHA256
b1d20c9a63de8ad6d5932751f6de0ecef62a705c732456d8e3130a8e0213d0fd

SHA512
b8390f00cfacea0bd0e70f8af5075e7c5d28a1fb3a44ad3ae1ef6a617ad60938d1e7ff6e44fee86b447bec9907c0c0cf27496cc9812eea905f60fa997a697ef6

Download Submit
C:\Windows\System\ZocKmwi.exe

Filesize
1.9MB

MD5
c74985cb2148e5ceb345bd3c96dfbfe8

SHA1
fa2c392304bafa956ff1489d52bb7ece6131efeb

SHA256
f4f9c207cf1dabe2b648eb807ebb625d1acd732eeb4c57be58d20609f0bcd735

SHA512
e2fe565bb2e76f668178675f52f1a9277d380bb2faf9bfa4ab5bd335fa584ef060c20a7167c991cec65c5f3593e5e3a166f72423a41e4cf41a36690ad5b8e10c

Download Submit
C:\Windows\System\ZwfnWaa.exe

Filesize
1.9MB

MD5
9423895513043ac97d16d512f0d26c52

SHA1
ac36b2e3cd6d154dc2b57d12f28d9a64dcdc53ed

SHA256
73e37ace07457283697a84fe58f9be1dd51a058213a3c4df86a2c98f68a5df13

SHA512
5ef7336921943883fefe0073e16da5e45aef9f821150ad870ed7d610da8115ca753b00ce778050bf2987da23cef5bda93f935fa32a6e207c4bc486ae89be7f1f

Download Submit
C:\Windows\System\aGzQQEk.exe

Filesize
1.9MB

MD5
610e286e3bbcac629a0c99c14f88ecad

SHA1
49bf8545f77bbd60c658072dfdc6c5c6243fe2b9

SHA256
734112082f0e121e7a975faa4e2411a9bf54c0b2cfed20f2ba8c971298924b32

SHA512
548371891779052c61bd61d14732ce9f57a028f3a8005e3362619c22d768ca0697438e74b1d3c8fe4e72615dac518d285256887f3742f8fdb7a4b9bb8007f7f6

Download Submit
C:\Windows\System\axopuyZ.exe

Filesize
1.9MB

MD5
b1f42aaac5f4a2de50926f98c2603baf

SHA1
0e2ed56fb429ce8d47a3014ee6ff1346ea2d93dc

SHA256
900f08af33339df59b89527105ab6551bc23566f7c5a7f4276f751b6b62f8c33

SHA512
05ef2e7d7dc319a3ad63ba81aec1c32309e84dc7a5ab4434fbcdb9161c8d90c05b5536fbfd081b52fd2a2ce0e60df77fb4947d327e8ff2971e5c8fed9cb83270

Download Submit
C:\Windows\System\bHmXglv.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\System\fIktiqw.exe

Filesize
1.9MB

MD5
cc5b9d4d8a61d85c8295083190c0e511

SHA1
16e4d1177c791c77af8751a70de76f2f144ca795

SHA256
70a3019c07740c2840377c29b566dda61c8db83482ceb8e5257a8dbc98e925ca

SHA512
64373b3d59a8dafc5bc9749e7f0862e2f0bfaa6b25de7d1ca631a20e75310de11360f4084ca274818543d84bdd20b4256509e468d03c7b2f1dea607d75bfd6e5

Download Submit
C:\Windows\System\fpOBBHV.exe

Filesize
1.9MB

MD5
bece3ad4eedf605e85d5d443be5c553b

SHA1
41a8100620d171f02bc5d0a217274861a64d245c

SHA256
09933dc338ab1d4e36a5f203cc87f2766371c7d619d452d5b62c2e0c0249b160

SHA512
5c550b11a37c6a334bcd96d696b158ab27ff92eaa0ae4c55c5d98eb73de51d645083d6419573d820dc1d429be4fc845eb88b52cdac70ec8cdd7d63447138a032

Download Submit
C:\Windows\System\oObRefT.exe

Filesize
1.9MB

MD5
b76091fe5f16abd51e89a5332a26cd6d

SHA1
7dd31ca5e529f5895003b1024d2e47abf5f8207f

SHA256
6481f4a3813cfacb8816b5093cc14135af19e922f9e5d006859486d8b1951bf0

SHA512
738a47a9ef9713f4c0e44ae03e523d08041f147cf8e4c77eaf0890caf5efc26397b8bd5e1dc35094c304c66cca6495418f5708779a99205650fb79e67925282a

Download Submit
C:\Windows\System\oiEDpUo.exe

Filesize
1.9MB

MD5
bf58221f4b8c6494e8de0efef84c6139

SHA1
3c3bf505fa5d20a721ff299819c68ff7ce115203

SHA256
61faecde9fdcbcc46ff49ba1205d2f4a308155de8062092482dd73e0dd7c596a

SHA512
14b2e200d87b972416477da4537fc0d38804a6f5609e08c54a80b4db3b4cb9a392deed39456b84a1a158295baaee34da3cc577a6addf39564ec0a8bc7357f324

Download Submit
C:\Windows\System\ruBUitp.exe

Filesize
1.9MB

MD5
acb88b12e82c56324ed50342fe548e97

SHA1
a3000a366f6b1de77203eed9ccaa12ae2f242f93

SHA256
4995e198673b35f65cc83b24ab6beff59c2c2b8b6d91b513e81b0b05c7c6b437

SHA512
958e2ea98abc0b4b65b0dcf579b18710e2b492c76bc2ebf6c68d0533ff910ba036e5b316c0d50bd556b2836f2063dd4009559795a709f09b9d2b301ea9479977

Download Submit
C:\Windows\System\twPgYfU.exe

Filesize
1.9MB

MD5
f9434a361a97e7f92a7c0507a0606320

SHA1
00e08c1ab645b718abedec5fd029de4167583c79

SHA256
13921987798297a0a9fb8bf81a80a1129020fbbd81727bcf47172e476fe89a49

SHA512
349b6da321f03daa69f07166eb104cbdd605550c227b56858d5f41c468c63be54da01bd8f70623e0d079c9706ca5d7ba87e818e3d3d5bde0665f26b0bfafdfcc

Download Submit
C:\Windows\System\ufSuaMc.exe

Filesize
1.9MB

MD5
132b060388ab9075f5a440f19ee81fcf

SHA1
c56a2cb329cd91648ba8e272e04a4249e70e4a26

SHA256
315d37c05d1d408ad05c915f07e140f59de1272cc3b7f95e5d2fbd56e50fdedc

SHA512
dcff313884e10f9e82f09e8f2084bb005d8161fe0e185d1b3f2f2e010df552816f2a9557fbce761fa04af573915a5051ce87bb3f400595c820556c865ff6ba08

Download Submit
C:\Windows\System\vPleMVt.exe

Filesize
1.9MB

MD5
249c87f9c02a7b5d53e86ddf2cabb79f

SHA1
af40e2c65b9d73da2785070d1dfaf0a82aa4636e

SHA256
ff8d1674f6ea898ab925ba358f8a705694b85d70826ad17224d9208af23cac1c

SHA512
5b095e2337acf7f7835cf42200f603f02d04dff3d608b2091ccf9edd74b20630f2ed94651771dbe96abd2ada6e4fd7d85037faf10dccbe0873352cf242ddc2f0

Download Submit
C:\Windows\System\vTwJRns.exe

Filesize
1.9MB

MD5
6efb185ac25352cfdb22258c372c700e

SHA1
db0a82d6f4dcf4066f778e0fea794c80799c206a

SHA256
c8d981d1fd7b69d96346db3090b63a018c977ae188074e0fadb92acacac1d9ff

SHA512
db1d86d8557f336548664487bafc227006c91021b5135d03d5574eba8385e2b3594bc4382a82f54cf06f323de9def01c563947435f84364f834d57bfa302365a

Download Submit
C:\Windows\System\wfVgolO.exe

Filesize
1.9MB

MD5
9d71d5ce0b7d85d9cd3af20d19c91268

SHA1
1f867c3ad2921fb2666e903a6775529caa2cb74d

SHA256
867a1aeef173bd5eccdfc544aba2bc9cda7a408c5ce2413d11381247c02070f5

SHA512
5de35061422ebddbbedcc3c6ca58ea9427b037e537615ee3161c493455604771e385fb9cadc6beb5ca2743a85e3102b9bbd3dce583b65e033010e3669c175021

Download Submit
C:\Windows\System\xkdobBQ.exe

Filesize
1.9MB

MD5
bd8ba88c950b32866791d0f39e27ff61

SHA1
c4442c3a956ed6869fabb2f269d295a1175e7eac

SHA256
579293ff8db4401e6cef839f109ed688090d01de41ac0faf81dda574d9b89ac2

SHA512
27516a99d6626dca49e76e59c5a04763711b358972989f04f9fc767340f7aa5bdde2a702e48778ed7aeeea6521b744fd96fc05994a0fbb8d14a6d755fb204c38

Download Submit
C:\Windows\System\xoyJKOS.exe

Filesize
1.9MB

MD5
0d5a5c14c0034ded626ddd6b476d407e

SHA1
a0bf889a4845d0b8b0dc1ccc7af0033183e7cc07

SHA256
63ee96ff3d44f12e90d002634a8d6ca53a2846803fbff8f176d57c6cbeef6731

SHA512
e6a415e42a8e77243699957080e8bf17f9789b802bea143309dd2e1adf4601ac799fe3680431ca7d45f9a4ca1e7f43380613768ef6159064fcc9ee45c5b71e7a

Download Submit
C:\Windows\System\yKsqivh.exe

Filesize
1.9MB

MD5
4afeefcfd3d5d1f8cdac8b3662e07ec7

SHA1
4c36d0076f49e178b49f2a5d83f77bb0497eda98

SHA256
9e51bdde36e2e954ebcc37f9935f79101aeffe664de09d8c6fa085650256928e

SHA512
ba66108e181642be4b6dde6e99db96f8bb8053f249026936d3c485f8550e110cba6454a212703f401e0ee18a4a6f3b294e0a394dc1bd1b4e632162942ddc7408

Download Submit
C:\Windows\System\yfLjXQL.exe

Filesize
1.9MB

MD5
f050b954931b1d4f18282c981d9c6241

SHA1
d9c135fcf85be25efa6722ec2662c81d0facff1b

SHA256
8e40e13436ed3bfe2293c0784cede000620aa7ef42ec35d9aff53ee88b421ca3

SHA512
fcb1bcb3299916f19c0e35854fdc8d384a4c23c2e28235ea8fc5514bbe9d28f4c4fd78828dafa5e1ba4481e3604992fb06e068948bf188b3ec84d0b970b057ca

Download Submit
C:\Windows\System\zHxgFiQ.exe

Filesize
1.9MB

MD5
84230106f1f2c228ad4b71ffe2487d63

SHA1
4cf041af4a51845d3ea5f73d2237e3ffde495015

SHA256
8a27218467263642143d29bb27c89728d6997c1523f7c368f2847940f049f5ff

SHA512
bb252d5984f84735d900a337916643a54bccce19d6e419c47f8a3fcfe854eacaddebee2cbb8aa1a9e68b4772cd4cfcd6490b69097ea9396a85c59888df04f4a3

Download Submit
memory/224-3038-0x00007FF662A40000-0x00007FF662E32000-memory.dmp

Filesize
3.9MB

Download
memory/224-196-0x00007FF662A40000-0x00007FF662E32000-memory.dmp

Filesize
3.9MB

Download
memory/1032-388-0x00007FF60BD50000-0x00007FF60C142000-memory.dmp

Filesize
3.9MB

Download
memory/1032-3068-0x00007FF60BD50000-0x00007FF60C142000-memory.dmp

Filesize
3.9MB

Download
memory/1276-3052-0x00007FF78D5E0000-0x00007FF78D9D2000-memory.dmp

Filesize
3.9MB

Download
memory/1276-303-0x00007FF78D5E0000-0x00007FF78D9D2000-memory.dmp

Filesize
3.9MB

Download
memory/1344-386-0x00007FF7B7880000-0x00007FF7B7C72000-memory.dmp

Filesize
3.9MB

Download
memory/1344-3044-0x00007FF7B7880000-0x00007FF7B7C72000-memory.dmp

Filesize
3.9MB

Download
memory/1360-3048-0x00007FF6B4730000-0x00007FF6B4B22000-memory.dmp

Filesize
3.9MB

Download
memory/1360-346-0x00007FF6B4730000-0x00007FF6B4B22000-memory.dmp

Filesize
3.9MB

Download
memory/1624-312-0x00007FF7A8920000-0x00007FF7A8D12000-memory.dmp

Filesize
3.9MB

Download
memory/1624-3066-0x00007FF7A8920000-0x00007FF7A8D12000-memory.dmp

Filesize
3.9MB

Download
memory/1632-282-0x00007FF60DCF0000-0x00007FF60E0E2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-3051-0x00007FF60DCF0000-0x00007FF60E0E2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-387-0x00007FF72C390000-0x00007FF72C782000-memory.dmp

Filesize
3.9MB

Download
memory/2012-3043-0x00007FF72C390000-0x00007FF72C782000-memory.dmp

Filesize
3.9MB

Download
memory/2132-3028-0x00007FF623AF0000-0x00007FF623EE2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-24-0x00007FF623AF0000-0x00007FF623EE2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-389-0x00007FF7A44F0000-0x00007FF7A48E2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-3070-0x00007FF7A44F0000-0x00007FF7A48E2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-3040-0x00007FF7461C0000-0x00007FF7465B2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-260-0x00007FF7461C0000-0x00007FF7465B2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-392-0x00007FF7948C0000-0x00007FF794CB2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-3064-0x00007FF7948C0000-0x00007FF794CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3196-117-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

Filesize
10.8MB

Download
memory/3196-3268-0x00007FFFEFE53000-0x00007FFFEFE55000-memory.dmp

Filesize
8KB

Download
memory/3196-442-0x0000023EC3440000-0x0000023EC3BE6000-memory.dmp

Filesize
7.6MB

Download
memory/3196-3274-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

Filesize
10.8MB

Download
memory/3196-3257-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

Filesize
10.8MB

Download
memory/3196-40-0x00007FFFEFE53000-0x00007FFFEFE55000-memory.dmp

Filesize
8KB

Download
memory/3196-215-0x0000023EC27C0000-0x0000023EC27E2000-memory.dmp

Filesize
136KB

Download
memory/3196-391-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

Filesize
10.8MB

Download
memory/3344-393-0x00007FF7F2AC0000-0x00007FF7F2EB2000-memory.dmp

Filesize
3.9MB

Download
memory/3344-3062-0x00007FF7F2AC0000-0x00007FF7F2EB2000-memory.dmp

Filesize
3.9MB

Download
memory/3480-32-0x00007FF72E1B0000-0x00007FF72E5A2000-memory.dmp

Filesize
3.9MB

Download
memory/3480-3030-0x00007FF72E1B0000-0x00007FF72E5A2000-memory.dmp

Filesize
3.9MB

Download
memory/3596-3035-0x00007FF734650000-0x00007FF734A42000-memory.dmp

Filesize
3.9MB

Download
memory/3596-143-0x00007FF734650000-0x00007FF734A42000-memory.dmp

Filesize
3.9MB

Download
memory/3760-394-0x00007FF6FF5D0000-0x00007FF6FF9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3760-3073-0x00007FF6FF5D0000-0x00007FF6FF9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-3076-0x00007FF731ED0000-0x00007FF7322C2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-390-0x00007FF731ED0000-0x00007FF7322C2000-memory.dmp

Filesize
3.9MB

Download
memory/4080-165-0x00007FF700E60000-0x00007FF701252000-memory.dmp

Filesize
3.9MB

Download
memory/4080-3036-0x00007FF700E60000-0x00007FF701252000-memory.dmp

Filesize
3.9MB

Download
memory/4124-3032-0x00007FF78CAE0000-0x00007FF78CED2000-memory.dmp

Filesize
3.9MB

Download
memory/4124-221-0x00007FF78CAE0000-0x00007FF78CED2000-memory.dmp

Filesize
3.9MB

Download
memory/4360-3059-0x00007FF62F510000-0x00007FF62F902000-memory.dmp

Filesize
3.9MB

Download
memory/4360-340-0x00007FF62F510000-0x00007FF62F902000-memory.dmp

Filesize
3.9MB

Download
memory/4396-1-0x00000263C1640000-0x00000263C1650000-memory.dmp

Filesize
64KB

Download
memory/4396-0-0x00007FF74C330000-0x00007FF74C722000-memory.dmp

Filesize
3.9MB

Download
memory/4456-3055-0x00007FF736610000-0x00007FF736A02000-memory.dmp

Filesize
3.9MB

Download
memory/4456-233-0x00007FF736610000-0x00007FF736A02000-memory.dmp

Filesize
3.9MB

Download
memory/4680-3056-0x00007FF77C3B0000-0x00007FF77C7A2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-380-0x00007FF77C3B0000-0x00007FF77C7A2000-memory.dmp

Filesize
3.9MB

Download
memory/4704-195-0x00007FF7FBBF0000-0x00007FF7FBFE2000-memory.dmp

Filesize
3.9MB

Download
memory/4704-3063-0x00007FF7FBBF0000-0x00007FF7FBFE2000-memory.dmp

Filesize
3.9MB

Download
memory/4776-3047-0x00007FF6B7F00000-0x00007FF6B82F2000-memory.dmp

Filesize
3.9MB

Download
memory/4776-385-0x00007FF6B7F00000-0x00007FF6B82F2000-memory.dmp

Filesize
3.9MB

Download