xmrig | eef964dc8af017eb3df1f9a018a0880261c4d90832c356bf6a62324791e01727

Analysis

max time kernel
125s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
Size 2.1MB
Sample240522-q4s79ade75
SHA256 eef964dc8af017eb3df1f9a018a0880261c4d90832c356bf6a62324791e01727
MD5 6779e21ada0724037ace4e0da96b8501
SHA1 a15d3a7d4de3291bc89d8fcff541706956ab7c2f
SHA512 296e52de67bb0e29d6dc43294d7fbddbba58a8a6b3cf01f88d6a940548d2bc2c2c28e12c1c5f1515ae999ba7ef8ab6a58d17f222d0164f4ca4370e5285d90113
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEZ:NABa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3124-41-0x00007FF7D4460000-0x00007FF7D4852000-memory.dmp	xmrig
behavioral2/memory/3736-36-0x00007FF662080000-0x00007FF662472000-memory.dmp	xmrig
behavioral2/memory/3168-35-0x00007FF6A8060000-0x00007FF6A8452000-memory.dmp	xmrig
behavioral2/memory/808-94-0x00007FF692AC0000-0x00007FF692EB2000-memory.dmp	xmrig
behavioral2/memory/3432-96-0x00007FF735830000-0x00007FF735C22000-memory.dmp	xmrig
behavioral2/memory/4060-99-0x00007FF63D480000-0x00007FF63D872000-memory.dmp	xmrig
behavioral2/memory/1424-95-0x00007FF7B6AB0000-0x00007FF7B6EA2000-memory.dmp	xmrig
behavioral2/memory/4956-92-0x00007FF6DAFF0000-0x00007FF6DB3E2000-memory.dmp	xmrig
behavioral2/memory/408-78-0x00007FF775AD0000-0x00007FF775EC2000-memory.dmp	xmrig
behavioral2/memory/2896-71-0x00007FF6668D0000-0x00007FF666CC2000-memory.dmp	xmrig
behavioral2/memory/372-58-0x00007FF7BFA80000-0x00007FF7BFE72000-memory.dmp	xmrig
behavioral2/memory/1280-1110-0x00007FF7AA5A0000-0x00007FF7AA992000-memory.dmp	xmrig
behavioral2/memory/228-129-0x00007FF726FD0000-0x00007FF7273C2000-memory.dmp	xmrig
behavioral2/memory/5064-2041-0x00007FF75D470000-0x00007FF75D862000-memory.dmp	xmrig
behavioral2/memory/4136-2043-0x00007FF7C7010000-0x00007FF7C7402000-memory.dmp	xmrig
behavioral2/memory/4064-2042-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp	xmrig
behavioral2/memory/3536-2279-0x00007FF68FF30000-0x00007FF690322000-memory.dmp	xmrig
behavioral2/memory/4608-2280-0x00007FF678460000-0x00007FF678852000-memory.dmp	xmrig
behavioral2/memory/404-2294-0x00007FF73DB80000-0x00007FF73DF72000-memory.dmp	xmrig
behavioral2/memory/3872-2309-0x00007FF7C2000000-0x00007FF7C23F2000-memory.dmp	xmrig
behavioral2/memory/1064-2313-0x00007FF7DB900000-0x00007FF7DBCF2000-memory.dmp	xmrig
behavioral2/memory/4692-2312-0x00007FF641960000-0x00007FF641D52000-memory.dmp	xmrig
behavioral2/memory/1604-2316-0x00007FF6EB0A0000-0x00007FF6EB492000-memory.dmp	xmrig
behavioral2/memory/4856-2317-0x00007FF62B9D0000-0x00007FF62BDC2000-memory.dmp	xmrig
behavioral2/memory/4816-2318-0x00007FF645880000-0x00007FF645C72000-memory.dmp	xmrig
behavioral2/memory/3168-2327-0x00007FF6A8060000-0x00007FF6A8452000-memory.dmp	xmrig
behavioral2/memory/3736-2329-0x00007FF662080000-0x00007FF662472000-memory.dmp	xmrig
behavioral2/memory/3124-2331-0x00007FF7D4460000-0x00007FF7D4852000-memory.dmp	xmrig
behavioral2/memory/372-2333-0x00007FF7BFA80000-0x00007FF7BFE72000-memory.dmp	xmrig
behavioral2/memory/2896-2335-0x00007FF6668D0000-0x00007FF666CC2000-memory.dmp	xmrig
behavioral2/memory/808-2337-0x00007FF692AC0000-0x00007FF692EB2000-memory.dmp	xmrig
behavioral2/memory/1424-2344-0x00007FF7B6AB0000-0x00007FF7B6EA2000-memory.dmp	xmrig
behavioral2/memory/3432-2347-0x00007FF735830000-0x00007FF735C22000-memory.dmp	xmrig
behavioral2/memory/5064-2346-0x00007FF75D470000-0x00007FF75D862000-memory.dmp	xmrig
behavioral2/memory/4956-2341-0x00007FF6DAFF0000-0x00007FF6DB3E2000-memory.dmp	xmrig
behavioral2/memory/408-2340-0x00007FF775AD0000-0x00007FF775EC2000-memory.dmp	xmrig
behavioral2/memory/4136-2353-0x00007FF7C7010000-0x00007FF7C7402000-memory.dmp	xmrig
behavioral2/memory/4060-2352-0x00007FF63D480000-0x00007FF63D872000-memory.dmp	xmrig
behavioral2/memory/4064-2350-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp	xmrig
behavioral2/memory/3536-2355-0x00007FF68FF30000-0x00007FF690322000-memory.dmp	xmrig
behavioral2/memory/228-2357-0x00007FF726FD0000-0x00007FF7273C2000-memory.dmp	xmrig
behavioral2/memory/404-2359-0x00007FF73DB80000-0x00007FF73DF72000-memory.dmp	xmrig
behavioral2/memory/4608-2361-0x00007FF678460000-0x00007FF678852000-memory.dmp	xmrig
behavioral2/memory/3872-2363-0x00007FF7C2000000-0x00007FF7C23F2000-memory.dmp	xmrig
behavioral2/memory/4692-2365-0x00007FF641960000-0x00007FF641D52000-memory.dmp	xmrig
behavioral2/memory/1064-2401-0x00007FF7DB900000-0x00007FF7DBCF2000-memory.dmp	xmrig
behavioral2/memory/4816-2404-0x00007FF645880000-0x00007FF645C72000-memory.dmp	xmrig
behavioral2/memory/4856-2403-0x00007FF62B9D0000-0x00007FF62BDC2000-memory.dmp	xmrig
behavioral2/memory/1604-2399-0x00007FF6EB0A0000-0x00007FF6EB492000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
6	872	powershell.exe
8	872	powershell.exe
25	872	powershell.exe
26	872	powershell.exe
27	872	powershell.exe
41	872	powershell.exe
42	872	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
872	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3168	IQFfCth.exe
3736	jsGJPoJ.exe
3124	dRthmix.exe
372	VFePrpe.exe
4956	wsVwhZx.exe
2896	IlXXiFS.exe
808	UWrullI.exe
408	yHJffaT.exe
1424	onNIwkp.exe
3432	nLlrHaS.exe
5064	CQeSpfA.exe
4064	LQWCntI.exe
4136	LaBKhzw.exe
4060	ydKZEUK.exe
3536	TVUgmGi.exe
404	jLuZyni.exe
4608	BHZkard.exe
228	srKygpS.exe
4692	rYtkDvr.exe
3872	xqNueVZ.exe
4856	uoFQlRv.exe
1604	HMHAgcj.exe
1064	GyZTFQx.exe
4816	QkVyFyb.exe
3852	ycDwHFp.exe
1552	SKObWWE.exe
2792	RsYOGdF.exe
4668	glmuLZG.exe
2284	DSvJLfo.exe
3084	pQBnhmq.exe
2852	LUoxmgL.exe
2012	geEXswD.exe
4840	gxqIXbk.exe
4248	mHJgwgC.exe
2924	lgeqSIa.exe
3008	ScvXigm.exe
1756	kZNzntD.exe
4088	QoHGlYR.exe
4452	xznFXir.exe
1224	kdtEmjx.exe
2344	ZTZAJFH.exe
1924	DtBLSHv.exe
4140	ReeOOlu.exe
3900	leFjYMA.exe
4824	VPXMlkt.exe
4504	GhwdndH.exe
1364	bDwRWIN.exe
4260	txGCBbC.exe
4364	ngcQWFK.exe
748	udqXNOw.exe
2472	XMkfgGK.exe
2908	tCciNBj.exe
5148	EPwuAGi.exe
5172	jODivET.exe
5200	qPcxKLr.exe
5224	GXCOoej.exe
5252	xMxRYbM.exe
5284	vnLqjoH.exe
5312	OeoYgEa.exe
5340	RMqnZkd.exe
5368	nmllLwd.exe
5392	QexJLhA.exe
5424	JZSlpyC.exe
5448	cFxuvpP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1280-0-0x00007FF7AA5A0000-0x00007FF7AA992000-memory.dmp	upx
behavioral2/files/0x000800000002342f-6.dat	upx
behavioral2/files/0x0007000000023433-10.dat	upx
behavioral2/files/0x0007000000023434-15.dat	upx
behavioral2/files/0x0007000000023437-43.dat	upx
behavioral2/files/0x0008000000023439-46.dat	upx
behavioral2/files/0x0007000000023436-42.dat	upx
behavioral2/memory/3124-41-0x00007FF7D4460000-0x00007FF7D4852000-memory.dmp	upx
behavioral2/memory/3736-36-0x00007FF662080000-0x00007FF662472000-memory.dmp	upx
behavioral2/memory/3168-35-0x00007FF6A8060000-0x00007FF6A8452000-memory.dmp	upx
behavioral2/files/0x0007000000023435-34.dat	upx
behavioral2/files/0x000700000002343a-56.dat	upx
behavioral2/files/0x000700000002343e-77.dat	upx
behavioral2/files/0x000700000002343d-82.dat	upx
behavioral2/memory/808-94-0x00007FF692AC0000-0x00007FF692EB2000-memory.dmp	upx
behavioral2/memory/3432-96-0x00007FF735830000-0x00007FF735C22000-memory.dmp	upx
behavioral2/memory/4060-99-0x00007FF63D480000-0x00007FF63D872000-memory.dmp	upx
behavioral2/files/0x000700000002343f-97.dat	upx
behavioral2/memory/1424-95-0x00007FF7B6AB0000-0x00007FF7B6EA2000-memory.dmp	upx
behavioral2/memory/4956-92-0x00007FF6DAFF0000-0x00007FF6DB3E2000-memory.dmp	upx
behavioral2/memory/4136-91-0x00007FF7C7010000-0x00007FF7C7402000-memory.dmp	upx
behavioral2/memory/4064-87-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp	upx
behavioral2/memory/5064-86-0x00007FF75D470000-0x00007FF75D862000-memory.dmp	upx
behavioral2/files/0x000700000002343c-80.dat	upx
behavioral2/files/0x0008000000023438-79.dat	upx
behavioral2/memory/408-78-0x00007FF775AD0000-0x00007FF775EC2000-memory.dmp	upx
behavioral2/memory/2896-71-0x00007FF6668D0000-0x00007FF666CC2000-memory.dmp	upx
behavioral2/files/0x000700000002343b-62.dat	upx
behavioral2/memory/372-58-0x00007FF7BFA80000-0x00007FF7BFE72000-memory.dmp	upx
behavioral2/files/0x0007000000023440-105.dat	upx
behavioral2/memory/3536-110-0x00007FF68FF30000-0x00007FF690322000-memory.dmp	upx
behavioral2/files/0x0007000000023443-122.dat	upx
behavioral2/files/0x0007000000023441-127.dat	upx
behavioral2/memory/3872-132-0x00007FF7C2000000-0x00007FF7C23F2000-memory.dmp	upx
behavioral2/files/0x0007000000023445-153.dat	upx
behavioral2/files/0x0007000000023448-158.dat	upx
behavioral2/files/0x000700000002344a-169.dat	upx
behavioral2/files/0x000700000002344b-178.dat	upx
behavioral2/files/0x000700000002344e-189.dat	upx
behavioral2/files/0x000700000002344f-198.dat	upx
behavioral2/memory/1280-1110-0x00007FF7AA5A0000-0x00007FF7AA992000-memory.dmp	upx
behavioral2/files/0x0007000000023451-202.dat	upx
behavioral2/files/0x0007000000023450-197.dat	upx
behavioral2/files/0x000700000002344d-187.dat	upx
behavioral2/files/0x000700000002344c-183.dat	upx
behavioral2/memory/4816-168-0x00007FF645880000-0x00007FF645C72000-memory.dmp	upx
behavioral2/files/0x0007000000023449-162.dat	upx
behavioral2/memory/4856-161-0x00007FF62B9D0000-0x00007FF62BDC2000-memory.dmp	upx
behavioral2/files/0x0007000000023447-157.dat	upx
behavioral2/memory/1064-154-0x00007FF7DB900000-0x00007FF7DBCF2000-memory.dmp	upx
behavioral2/memory/1604-151-0x00007FF6EB0A0000-0x00007FF6EB492000-memory.dmp	upx
behavioral2/files/0x0007000000023446-148.dat	upx
behavioral2/memory/4692-143-0x00007FF641960000-0x00007FF641D52000-memory.dmp	upx
behavioral2/files/0x0007000000023444-133.dat	upx
behavioral2/memory/228-129-0x00007FF726FD0000-0x00007FF7273C2000-memory.dmp	upx
behavioral2/memory/404-128-0x00007FF73DB80000-0x00007FF73DF72000-memory.dmp	upx
behavioral2/files/0x0008000000023430-125.dat	upx
behavioral2/files/0x0007000000023442-117.dat	upx
behavioral2/memory/4608-113-0x00007FF678460000-0x00007FF678852000-memory.dmp	upx
behavioral2/memory/5064-2041-0x00007FF75D470000-0x00007FF75D862000-memory.dmp	upx
behavioral2/memory/4136-2043-0x00007FF7C7010000-0x00007FF7C7402000-memory.dmp	upx
behavioral2/memory/4064-2042-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp	upx
behavioral2/memory/3536-2279-0x00007FF68FF30000-0x00007FF690322000-memory.dmp	upx
behavioral2/memory/4608-2280-0x00007FF678460000-0x00007FF678852000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aJotVhr.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\TPzgCkS.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\mOIZehH.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\XoHgvoM.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\KrvelaE.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\zIwPVNJ.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\BuFqGIK.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\siyrtHN.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\Asjhrbo.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\DeehaVH.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\LiABZgZ.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\KnTVMHB.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\ICWcdPp.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\wKqJqPk.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\ilsdDBV.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\glmuLZG.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\paJjnUi.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\lgvGUqM.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\VUjQqrL.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\uphbAVa.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\wsVwhZx.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\sslRxlO.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\pbzUigx.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\FDfuajn.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\BkkkAuO.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\kiMoFqH.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\HQzhUfA.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\tPCLodL.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\AqONdCJ.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\ALXtQfi.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\ydKZEUK.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\TgDCjBZ.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\WAcSwvv.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\JrEKRiQ.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\ZzBLTgg.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\kyqPnpJ.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\vwNmlqi.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\XzVlvwp.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\MpiUAMZ.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\KHjhAqu.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\bRYcifD.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\qDGMgVr.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\izDGooX.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\CMZsBSn.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\ljraKLJ.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\gMYShzB.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\VlfAUZO.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\oSnFZCy.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\fhEDISy.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\xsGmZii.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\jLuZyni.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\FWlYMaT.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\EdBMkDl.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\zWLtytV.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\HovOojk.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\FTrkAyV.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\zWlIkXX.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\EQYvUaV.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\YvhihRQ.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\ZvJjREj.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\xKvlIjo.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\ebJIZgl.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\whKzQQF.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
File created	C:\Windows\System\Bazaavr.exe	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
872	powershell.exe
872	powershell.exe
872	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeLockMemoryPrivilege	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 872	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	83
PID 1280 wrote to memory of 872	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	83
PID 1280 wrote to memory of 3168	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	84
PID 1280 wrote to memory of 3168	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	84
PID 1280 wrote to memory of 3736	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	85
PID 1280 wrote to memory of 3736	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	85
PID 1280 wrote to memory of 3124	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	86
PID 1280 wrote to memory of 3124	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	86
PID 1280 wrote to memory of 372	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	87
PID 1280 wrote to memory of 372	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	87
PID 1280 wrote to memory of 4956	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	88
PID 1280 wrote to memory of 4956	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	88
PID 1280 wrote to memory of 2896	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	89
PID 1280 wrote to memory of 2896	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	89
PID 1280 wrote to memory of 808	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	90
PID 1280 wrote to memory of 808	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	90
PID 1280 wrote to memory of 408	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	91
PID 1280 wrote to memory of 408	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	91
PID 1280 wrote to memory of 1424	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	92
PID 1280 wrote to memory of 1424	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	92
PID 1280 wrote to memory of 3432	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	93
PID 1280 wrote to memory of 3432	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	93
PID 1280 wrote to memory of 5064	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	94
PID 1280 wrote to memory of 5064	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	94
PID 1280 wrote to memory of 4064	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	95
PID 1280 wrote to memory of 4064	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	95
PID 1280 wrote to memory of 4136	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	96
PID 1280 wrote to memory of 4136	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	96
PID 1280 wrote to memory of 4060	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	97
PID 1280 wrote to memory of 4060	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	97
PID 1280 wrote to memory of 3536	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	98
PID 1280 wrote to memory of 3536	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	98
PID 1280 wrote to memory of 404	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	99
PID 1280 wrote to memory of 404	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	99
PID 1280 wrote to memory of 4608	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	100
PID 1280 wrote to memory of 4608	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	100
PID 1280 wrote to memory of 228	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	101
PID 1280 wrote to memory of 228	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	101
PID 1280 wrote to memory of 4692	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	102
PID 1280 wrote to memory of 4692	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	102
PID 1280 wrote to memory of 3872	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	103
PID 1280 wrote to memory of 3872	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	103
PID 1280 wrote to memory of 3852	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	104
PID 1280 wrote to memory of 3852	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	104
PID 1280 wrote to memory of 4856	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	105
PID 1280 wrote to memory of 4856	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	105
PID 1280 wrote to memory of 1604	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	106
PID 1280 wrote to memory of 1604	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	106
PID 1280 wrote to memory of 1064	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	107
PID 1280 wrote to memory of 1064	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	107
PID 1280 wrote to memory of 4816	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	108
PID 1280 wrote to memory of 4816	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	108
PID 1280 wrote to memory of 1552	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	109
PID 1280 wrote to memory of 1552	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	109
PID 1280 wrote to memory of 2792	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	110
PID 1280 wrote to memory of 2792	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	110
PID 1280 wrote to memory of 4668	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	111
PID 1280 wrote to memory of 4668	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	111
PID 1280 wrote to memory of 2284	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	112
PID 1280 wrote to memory of 2284	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	112
PID 1280 wrote to memory of 3084	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	113
PID 1280 wrote to memory of 3084	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	113
PID 1280 wrote to memory of 2852	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	114
PID 1280 wrote to memory of 2852	1280	6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6779e21ada0724037ace4e0da96b8501_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\System\IQFfCth.exe
  C:\Windows\System\IQFfCth.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\jsGJPoJ.exe
  C:\Windows\System\jsGJPoJ.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\dRthmix.exe
  C:\Windows\System\dRthmix.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\VFePrpe.exe
  C:\Windows\System\VFePrpe.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\wsVwhZx.exe
  C:\Windows\System\wsVwhZx.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\IlXXiFS.exe
  C:\Windows\System\IlXXiFS.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\UWrullI.exe
  C:\Windows\System\UWrullI.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\yHJffaT.exe
  C:\Windows\System\yHJffaT.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\onNIwkp.exe
  C:\Windows\System\onNIwkp.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\nLlrHaS.exe
  C:\Windows\System\nLlrHaS.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\CQeSpfA.exe
  C:\Windows\System\CQeSpfA.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\LQWCntI.exe
  C:\Windows\System\LQWCntI.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\LaBKhzw.exe
  C:\Windows\System\LaBKhzw.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\ydKZEUK.exe
  C:\Windows\System\ydKZEUK.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\TVUgmGi.exe
  C:\Windows\System\TVUgmGi.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\jLuZyni.exe
  C:\Windows\System\jLuZyni.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\BHZkard.exe
  C:\Windows\System\BHZkard.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\srKygpS.exe
  C:\Windows\System\srKygpS.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\rYtkDvr.exe
  C:\Windows\System\rYtkDvr.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\xqNueVZ.exe
  C:\Windows\System\xqNueVZ.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\ycDwHFp.exe
  C:\Windows\System\ycDwHFp.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\uoFQlRv.exe
  C:\Windows\System\uoFQlRv.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\HMHAgcj.exe
  C:\Windows\System\HMHAgcj.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\GyZTFQx.exe
  C:\Windows\System\GyZTFQx.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\QkVyFyb.exe
  C:\Windows\System\QkVyFyb.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\SKObWWE.exe
  C:\Windows\System\SKObWWE.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\RsYOGdF.exe
  C:\Windows\System\RsYOGdF.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\glmuLZG.exe
  C:\Windows\System\glmuLZG.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\DSvJLfo.exe
  C:\Windows\System\DSvJLfo.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\pQBnhmq.exe
  C:\Windows\System\pQBnhmq.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\LUoxmgL.exe
  C:\Windows\System\LUoxmgL.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\geEXswD.exe
  C:\Windows\System\geEXswD.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\gxqIXbk.exe
  C:\Windows\System\gxqIXbk.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\mHJgwgC.exe
  C:\Windows\System\mHJgwgC.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\lgeqSIa.exe
  C:\Windows\System\lgeqSIa.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\ScvXigm.exe
  C:\Windows\System\ScvXigm.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\kZNzntD.exe
  C:\Windows\System\kZNzntD.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\QoHGlYR.exe
  C:\Windows\System\QoHGlYR.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\xznFXir.exe
  C:\Windows\System\xznFXir.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\kdtEmjx.exe
  C:\Windows\System\kdtEmjx.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\ZTZAJFH.exe
  C:\Windows\System\ZTZAJFH.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\DtBLSHv.exe
  C:\Windows\System\DtBLSHv.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\ReeOOlu.exe
  C:\Windows\System\ReeOOlu.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\leFjYMA.exe
  C:\Windows\System\leFjYMA.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\VPXMlkt.exe
  C:\Windows\System\VPXMlkt.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\GhwdndH.exe
  C:\Windows\System\GhwdndH.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\bDwRWIN.exe
  C:\Windows\System\bDwRWIN.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\txGCBbC.exe
  C:\Windows\System\txGCBbC.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\ngcQWFK.exe
  C:\Windows\System\ngcQWFK.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\udqXNOw.exe
  C:\Windows\System\udqXNOw.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\XMkfgGK.exe
  C:\Windows\System\XMkfgGK.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\tCciNBj.exe
  C:\Windows\System\tCciNBj.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\EPwuAGi.exe
  C:\Windows\System\EPwuAGi.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\jODivET.exe
  C:\Windows\System\jODivET.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\qPcxKLr.exe
  C:\Windows\System\qPcxKLr.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\GXCOoej.exe
  C:\Windows\System\GXCOoej.exe
  2⤵
  - Executes dropped EXE
  PID:5224
- C:\Windows\System\xMxRYbM.exe
  C:\Windows\System\xMxRYbM.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\vnLqjoH.exe
  C:\Windows\System\vnLqjoH.exe
  2⤵
  - Executes dropped EXE
  PID:5284
- C:\Windows\System\OeoYgEa.exe
  C:\Windows\System\OeoYgEa.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\RMqnZkd.exe
  C:\Windows\System\RMqnZkd.exe
  2⤵
  - Executes dropped EXE
  PID:5340
- C:\Windows\System\nmllLwd.exe
  C:\Windows\System\nmllLwd.exe
  2⤵
  - Executes dropped EXE
  PID:5368
- C:\Windows\System\QexJLhA.exe
  C:\Windows\System\QexJLhA.exe
  2⤵
  - Executes dropped EXE
  PID:5392
- C:\Windows\System\JZSlpyC.exe
  C:\Windows\System\JZSlpyC.exe
  2⤵
  - Executes dropped EXE
  PID:5424
- C:\Windows\System\cFxuvpP.exe
  C:\Windows\System\cFxuvpP.exe
  2⤵
  - Executes dropped EXE
  PID:5448
- C:\Windows\System\gmLHvtC.exe
  C:\Windows\System\gmLHvtC.exe
  2⤵
  PID:5476
- C:\Windows\System\QJuHDhg.exe
  C:\Windows\System\QJuHDhg.exe
  2⤵
  PID:5504
- C:\Windows\System\gvSjgmV.exe
  C:\Windows\System\gvSjgmV.exe
  2⤵
  PID:5536
- C:\Windows\System\TgDCjBZ.exe
  C:\Windows\System\TgDCjBZ.exe
  2⤵
  PID:5564
- C:\Windows\System\NiLVBQl.exe
  C:\Windows\System\NiLVBQl.exe
  2⤵
  PID:5592
- C:\Windows\System\TPzgCkS.exe
  C:\Windows\System\TPzgCkS.exe
  2⤵
  PID:5620
- C:\Windows\System\pzxzWjr.exe
  C:\Windows\System\pzxzWjr.exe
  2⤵
  PID:5648
- C:\Windows\System\aoKjgkL.exe
  C:\Windows\System\aoKjgkL.exe
  2⤵
  PID:5672
- C:\Windows\System\oEykGIM.exe
  C:\Windows\System\oEykGIM.exe
  2⤵
  PID:5708
- C:\Windows\System\aUWtOPm.exe
  C:\Windows\System\aUWtOPm.exe
  2⤵
  PID:5732
- C:\Windows\System\iPARKUU.exe
  C:\Windows\System\iPARKUU.exe
  2⤵
  PID:5760
- C:\Windows\System\hEYnvmd.exe
  C:\Windows\System\hEYnvmd.exe
  2⤵
  PID:5788
- C:\Windows\System\ZIkBaaQ.exe
  C:\Windows\System\ZIkBaaQ.exe
  2⤵
  PID:5812
- C:\Windows\System\AiHetrL.exe
  C:\Windows\System\AiHetrL.exe
  2⤵
  PID:5844
- C:\Windows\System\afmYDJZ.exe
  C:\Windows\System\afmYDJZ.exe
  2⤵
  PID:5872
- C:\Windows\System\CHmTDVF.exe
  C:\Windows\System\CHmTDVF.exe
  2⤵
  PID:5900
- C:\Windows\System\WOBMGQb.exe
  C:\Windows\System\WOBMGQb.exe
  2⤵
  PID:5928
- C:\Windows\System\tCWtqhw.exe
  C:\Windows\System\tCWtqhw.exe
  2⤵
  PID:5956
- C:\Windows\System\PCUwNTo.exe
  C:\Windows\System\PCUwNTo.exe
  2⤵
  PID:5980
- C:\Windows\System\yodzTwO.exe
  C:\Windows\System\yodzTwO.exe
  2⤵
  PID:6008
- C:\Windows\System\aPgwcBi.exe
  C:\Windows\System\aPgwcBi.exe
  2⤵
  PID:6040
- C:\Windows\System\yHTdZer.exe
  C:\Windows\System\yHTdZer.exe
  2⤵
  PID:6068
- C:\Windows\System\OTzuCYO.exe
  C:\Windows\System\OTzuCYO.exe
  2⤵
  PID:6092
- C:\Windows\System\RkGwYhr.exe
  C:\Windows\System\RkGwYhr.exe
  2⤵
  PID:6120
- C:\Windows\System\OfYvwgb.exe
  C:\Windows\System\OfYvwgb.exe
  2⤵
  PID:5276
- C:\Windows\System\xNorgOb.exe
  C:\Windows\System\xNorgOb.exe
  2⤵
  PID:5244
- C:\Windows\System\BqLXlGt.exe
  C:\Windows\System\BqLXlGt.exe
  2⤵
  PID:5168
- C:\Windows\System\bXPUHhv.exe
  C:\Windows\System\bXPUHhv.exe
  2⤵
  PID:424
- C:\Windows\System\QVxeqQh.exe
  C:\Windows\System\QVxeqQh.exe
  2⤵
  PID:448
- C:\Windows\System\xuFdODw.exe
  C:\Windows\System\xuFdODw.exe
  2⤵
  PID:5008
- C:\Windows\System\vfkxuVN.exe
  C:\Windows\System\vfkxuVN.exe
  2⤵
  PID:4892
- C:\Windows\System\OnLMCCy.exe
  C:\Windows\System\OnLMCCy.exe
  2⤵
  PID:3804
- C:\Windows\System\YbVqNTr.exe
  C:\Windows\System\YbVqNTr.exe
  2⤵
  PID:4908
- C:\Windows\System\xhOaOLk.exe
  C:\Windows\System\xhOaOLk.exe
  2⤵
  PID:4164
- C:\Windows\System\ZvNoned.exe
  C:\Windows\System\ZvNoned.exe
  2⤵
  PID:3352
- C:\Windows\System\IsMkypb.exe
  C:\Windows\System\IsMkypb.exe
  2⤵
  PID:4380
- C:\Windows\System\YCnZnUg.exe
  C:\Windows\System\YCnZnUg.exe
  2⤵
  PID:2356
- C:\Windows\System\mOIZehH.exe
  C:\Windows\System\mOIZehH.exe
  2⤵
  PID:2640
- C:\Windows\System\vSbmTfV.exe
  C:\Windows\System\vSbmTfV.exe
  2⤵
  PID:640
- C:\Windows\System\ZqDnlkw.exe
  C:\Windows\System\ZqDnlkw.exe
  2⤵
  PID:3420
- C:\Windows\System\YKYtrzS.exe
  C:\Windows\System\YKYtrzS.exe
  2⤵
  PID:3208
- C:\Windows\System\BsGmAkX.exe
  C:\Windows\System\BsGmAkX.exe
  2⤵
  PID:5388
- C:\Windows\System\MUEWOjz.exe
  C:\Windows\System\MUEWOjz.exe
  2⤵
  PID:5436
- C:\Windows\System\Asjhrbo.exe
  C:\Windows\System\Asjhrbo.exe
  2⤵
  PID:5492
- C:\Windows\System\jGPrclg.exe
  C:\Windows\System\jGPrclg.exe
  2⤵
  PID:5520
- C:\Windows\System\aMsereD.exe
  C:\Windows\System\aMsereD.exe
  2⤵
  PID:5640
- C:\Windows\System\ClDjMgd.exe
  C:\Windows\System\ClDjMgd.exe
  2⤵
  PID:5724
- C:\Windows\System\XzVlvwp.exe
  C:\Windows\System\XzVlvwp.exe
  2⤵
  PID:5804
- C:\Windows\System\AOgqfPh.exe
  C:\Windows\System\AOgqfPh.exe
  2⤵
  PID:5860
- C:\Windows\System\kJbNtvA.exe
  C:\Windows\System\kJbNtvA.exe
  2⤵
  PID:5944
- C:\Windows\System\ELRnwwd.exe
  C:\Windows\System\ELRnwwd.exe
  2⤵
  PID:5996
- C:\Windows\System\SARpatq.exe
  C:\Windows\System\SARpatq.exe
  2⤵
  PID:6052
- C:\Windows\System\TkoXRFo.exe
  C:\Windows\System\TkoXRFo.exe
  2⤵
  PID:6088
- C:\Windows\System\iiRmEOA.exe
  C:\Windows\System\iiRmEOA.exe
  2⤵
  PID:5332
- C:\Windows\System\PEvzLqW.exe
  C:\Windows\System\PEvzLqW.exe
  2⤵
  PID:1516
- C:\Windows\System\vCwZyAk.exe
  C:\Windows\System\vCwZyAk.exe
  2⤵
  PID:3940
- C:\Windows\System\iFboigo.exe
  C:\Windows\System\iFboigo.exe
  2⤵
  PID:3960
- C:\Windows\System\ZlUqtwP.exe
  C:\Windows\System\ZlUqtwP.exe
  2⤵
  PID:4408
- C:\Windows\System\drjykRK.exe
  C:\Windows\System\drjykRK.exe
  2⤵
  PID:5188
- C:\Windows\System\bkuGNPS.exe
  C:\Windows\System\bkuGNPS.exe
  2⤵
  PID:4804
- C:\Windows\System\ZWZNwKh.exe
  C:\Windows\System\ZWZNwKh.exe
  2⤵
  PID:3548
- C:\Windows\System\BiEjPcF.exe
  C:\Windows\System\BiEjPcF.exe
  2⤵
  PID:1644
- C:\Windows\System\NQqbmcS.exe
  C:\Windows\System\NQqbmcS.exe
  2⤵
  PID:3472
- C:\Windows\System\RwrBhzj.exe
  C:\Windows\System\RwrBhzj.exe
  2⤵
  PID:4844
- C:\Windows\System\EQrsCyr.exe
  C:\Windows\System\EQrsCyr.exe
  2⤵
  PID:760
- C:\Windows\System\wcdYHWY.exe
  C:\Windows\System\wcdYHWY.exe
  2⤵
  PID:2372
- C:\Windows\System\hPvQiuC.exe
  C:\Windows\System\hPvQiuC.exe
  2⤵
  PID:4360
- C:\Windows\System\ZrNtAGU.exe
  C:\Windows\System\ZrNtAGU.exe
  2⤵
  PID:3532
- C:\Windows\System\dyMfFrb.exe
  C:\Windows\System\dyMfFrb.exe
  2⤵
  PID:1524
- C:\Windows\System\JVoKVeq.exe
  C:\Windows\System\JVoKVeq.exe
  2⤵
  PID:5576
- C:\Windows\System\tkEsGOZ.exe
  C:\Windows\System\tkEsGOZ.exe
  2⤵
  PID:5776
- C:\Windows\System\lvtBtuw.exe
  C:\Windows\System\lvtBtuw.exe
  2⤵
  PID:5856
- C:\Windows\System\AVsqTUv.exe
  C:\Windows\System\AVsqTUv.exe
  2⤵
  PID:5916
- C:\Windows\System\LyqBdHD.exe
  C:\Windows\System\LyqBdHD.exe
  2⤵
  PID:5972
- C:\Windows\System\IQCeSZh.exe
  C:\Windows\System\IQCeSZh.exe
  2⤵
  PID:1268
- C:\Windows\System\LQQpdgt.exe
  C:\Windows\System\LQQpdgt.exe
  2⤵
  PID:1940
- C:\Windows\System\kgJcjlx.exe
  C:\Windows\System\kgJcjlx.exe
  2⤵
  PID:1828
- C:\Windows\System\peOvRCn.exe
  C:\Windows\System\peOvRCn.exe
  2⤵
  PID:1560
- C:\Windows\System\lceYiCu.exe
  C:\Windows\System\lceYiCu.exe
  2⤵
  PID:4880
- C:\Windows\System\sVJkwyg.exe
  C:\Windows\System\sVJkwyg.exe
  2⤵
  PID:4928
- C:\Windows\System\oBtldnf.exe
  C:\Windows\System\oBtldnf.exe
  2⤵
  PID:2536
- C:\Windows\System\MyArEMf.exe
  C:\Windows\System\MyArEMf.exe
  2⤵
  PID:5912
- C:\Windows\System\atCILXd.exe
  C:\Windows\System\atCILXd.exe
  2⤵
  PID:6024
- C:\Windows\System\DeehaVH.exe
  C:\Windows\System\DeehaVH.exe
  2⤵
  PID:2328
- C:\Windows\System\MzAnhQt.exe
  C:\Windows\System\MzAnhQt.exe
  2⤵
  PID:5268
- C:\Windows\System\paJjnUi.exe
  C:\Windows\System\paJjnUi.exe
  2⤵
  PID:5384
- C:\Windows\System\xOglvex.exe
  C:\Windows\System\xOglvex.exe
  2⤵
  PID:3800
- C:\Windows\System\PotWghK.exe
  C:\Windows\System\PotWghK.exe
  2⤵
  PID:536
- C:\Windows\System\VGguhvS.exe
  C:\Windows\System\VGguhvS.exe
  2⤵
  PID:5828
- C:\Windows\System\bRqcSCA.exe
  C:\Windows\System\bRqcSCA.exe
  2⤵
  PID:4036
- C:\Windows\System\EdCmhhR.exe
  C:\Windows\System\EdCmhhR.exe
  2⤵
  PID:6160
- C:\Windows\System\LNOvyOk.exe
  C:\Windows\System\LNOvyOk.exe
  2⤵
  PID:6180
- C:\Windows\System\PyORNIg.exe
  C:\Windows\System\PyORNIg.exe
  2⤵
  PID:6208
- C:\Windows\System\FtuzOpM.exe
  C:\Windows\System\FtuzOpM.exe
  2⤵
  PID:6228
- C:\Windows\System\XtwRZHC.exe
  C:\Windows\System\XtwRZHC.exe
  2⤵
  PID:6280
- C:\Windows\System\qlVRdwf.exe
  C:\Windows\System\qlVRdwf.exe
  2⤵
  PID:6300
- C:\Windows\System\sslRxlO.exe
  C:\Windows\System\sslRxlO.exe
  2⤵
  PID:6336
- C:\Windows\System\BAGqYKz.exe
  C:\Windows\System\BAGqYKz.exe
  2⤵
  PID:6368
- C:\Windows\System\XoHgvoM.exe
  C:\Windows\System\XoHgvoM.exe
  2⤵
  PID:6420
- C:\Windows\System\izDGooX.exe
  C:\Windows\System\izDGooX.exe
  2⤵
  PID:6460
- C:\Windows\System\DRbxLey.exe
  C:\Windows\System\DRbxLey.exe
  2⤵
  PID:6496
- C:\Windows\System\ZoVlavc.exe
  C:\Windows\System\ZoVlavc.exe
  2⤵
  PID:6532
- C:\Windows\System\uoIEeBX.exe
  C:\Windows\System\uoIEeBX.exe
  2⤵
  PID:6552
- C:\Windows\System\UyMVQoP.exe
  C:\Windows\System\UyMVQoP.exe
  2⤵
  PID:6572
- C:\Windows\System\WhpHWTk.exe
  C:\Windows\System\WhpHWTk.exe
  2⤵
  PID:6616
- C:\Windows\System\htqkXVx.exe
  C:\Windows\System\htqkXVx.exe
  2⤵
  PID:6644
- C:\Windows\System\dcSReTx.exe
  C:\Windows\System\dcSReTx.exe
  2⤵
  PID:6676
- C:\Windows\System\YilrcdH.exe
  C:\Windows\System\YilrcdH.exe
  2⤵
  PID:6700
- C:\Windows\System\UuuokVf.exe
  C:\Windows\System\UuuokVf.exe
  2⤵
  PID:6728
- C:\Windows\System\mutASgL.exe
  C:\Windows\System\mutASgL.exe
  2⤵
  PID:6768
- C:\Windows\System\NKvmgCo.exe
  C:\Windows\System\NKvmgCo.exe
  2⤵
  PID:6792
- C:\Windows\System\EQYvUaV.exe
  C:\Windows\System\EQYvUaV.exe
  2⤵
  PID:6816
- C:\Windows\System\dpthTiz.exe
  C:\Windows\System\dpthTiz.exe
  2⤵
  PID:6840
- C:\Windows\System\EeTCFgt.exe
  C:\Windows\System\EeTCFgt.exe
  2⤵
  PID:6864
- C:\Windows\System\YvhihRQ.exe
  C:\Windows\System\YvhihRQ.exe
  2⤵
  PID:6904
- C:\Windows\System\jqmpGPM.exe
  C:\Windows\System\jqmpGPM.exe
  2⤵
  PID:6932
- C:\Windows\System\ALsnucg.exe
  C:\Windows\System\ALsnucg.exe
  2⤵
  PID:6952
- C:\Windows\System\uUgSfll.exe
  C:\Windows\System\uUgSfll.exe
  2⤵
  PID:6976
- C:\Windows\System\wwfGGHw.exe
  C:\Windows\System\wwfGGHw.exe
  2⤵
  PID:7016
- C:\Windows\System\qnBnzye.exe
  C:\Windows\System\qnBnzye.exe
  2⤵
  PID:7036
- C:\Windows\System\mqJmSev.exe
  C:\Windows\System\mqJmSev.exe
  2⤵
  PID:7060
- C:\Windows\System\ylRVXvQ.exe
  C:\Windows\System\ylRVXvQ.exe
  2⤵
  PID:7080
- C:\Windows\System\GVZKrAX.exe
  C:\Windows\System\GVZKrAX.exe
  2⤵
  PID:7124
- C:\Windows\System\pfDFzmG.exe
  C:\Windows\System\pfDFzmG.exe
  2⤵
  PID:7152
- C:\Windows\System\SsMjJVT.exe
  C:\Windows\System\SsMjJVT.exe
  2⤵
  PID:2080
- C:\Windows\System\PmDaCxi.exe
  C:\Windows\System\PmDaCxi.exe
  2⤵
  PID:5632
- C:\Windows\System\ljraKLJ.exe
  C:\Windows\System\ljraKLJ.exe
  2⤵
  PID:6240
- C:\Windows\System\wBwLYVY.exe
  C:\Windows\System\wBwLYVY.exe
  2⤵
  PID:6220
- C:\Windows\System\sdXtPxv.exe
  C:\Windows\System\sdXtPxv.exe
  2⤵
  PID:6308
- C:\Windows\System\tFrwTTW.exe
  C:\Windows\System\tFrwTTW.exe
  2⤵
  PID:6348
- C:\Windows\System\IFyXtiQ.exe
  C:\Windows\System\IFyXtiQ.exe
  2⤵
  PID:6452
- C:\Windows\System\TaRBXhB.exe
  C:\Windows\System\TaRBXhB.exe
  2⤵
  PID:6472
- C:\Windows\System\jLZxxtp.exe
  C:\Windows\System\jLZxxtp.exe
  2⤵
  PID:6544
- C:\Windows\System\AnLsmdZ.exe
  C:\Windows\System\AnLsmdZ.exe
  2⤵
  PID:6592
- C:\Windows\System\WAcSwvv.exe
  C:\Windows\System\WAcSwvv.exe
  2⤵
  PID:6636
- C:\Windows\System\NDQmGEe.exe
  C:\Windows\System\NDQmGEe.exe
  2⤵
  PID:6692
- C:\Windows\System\xOzwNnY.exe
  C:\Windows\System\xOzwNnY.exe
  2⤵
  PID:4960
- C:\Windows\System\qeSkgsZ.exe
  C:\Windows\System\qeSkgsZ.exe
  2⤵
  PID:6724
- C:\Windows\System\MzbKLSA.exe
  C:\Windows\System\MzbKLSA.exe
  2⤵
  PID:6884
- C:\Windows\System\ZvJjREj.exe
  C:\Windows\System\ZvJjREj.exe
  2⤵
  PID:6960
- C:\Windows\System\SdlVxLO.exe
  C:\Windows\System\SdlVxLO.exe
  2⤵
  PID:6996
- C:\Windows\System\fiyJGQX.exe
  C:\Windows\System\fiyJGQX.exe
  2⤵
  PID:7044
- C:\Windows\System\QmSVvUL.exe
  C:\Windows\System\QmSVvUL.exe
  2⤵
  PID:7108
- C:\Windows\System\DoHPebN.exe
  C:\Windows\System\DoHPebN.exe
  2⤵
  PID:7144
- C:\Windows\System\FDfuajn.exe
  C:\Windows\System\FDfuajn.exe
  2⤵
  PID:3816
- C:\Windows\System\lAObueu.exe
  C:\Windows\System\lAObueu.exe
  2⤵
  PID:6292
- C:\Windows\System\WmcOZSX.exe
  C:\Windows\System\WmcOZSX.exe
  2⤵
  PID:6720
- C:\Windows\System\NoBPrAu.exe
  C:\Windows\System\NoBPrAu.exe
  2⤵
  PID:6788
- C:\Windows\System\URnUWvg.exe
  C:\Windows\System\URnUWvg.exe
  2⤵
  PID:7008
- C:\Windows\System\BpZtQdF.exe
  C:\Windows\System\BpZtQdF.exe
  2⤵
  PID:7104
- C:\Windows\System\XMiAFBP.exe
  C:\Windows\System\XMiAFBP.exe
  2⤵
  PID:6296
- C:\Windows\System\PGIkXEe.exe
  C:\Windows\System\PGIkXEe.exe
  2⤵
  PID:6480
- C:\Windows\System\PYxZkop.exe
  C:\Windows\System\PYxZkop.exe
  2⤵
  PID:3584
- C:\Windows\System\ageJgFh.exe
  C:\Windows\System\ageJgFh.exe
  2⤵
  PID:6152
- C:\Windows\System\YWEHgVL.exe
  C:\Windows\System\YWEHgVL.exe
  2⤵
  PID:6848
- C:\Windows\System\TPRPHko.exe
  C:\Windows\System\TPRPHko.exe
  2⤵
  PID:6920
- C:\Windows\System\MpCfpkI.exe
  C:\Windows\System\MpCfpkI.exe
  2⤵
  PID:7200
- C:\Windows\System\BCwHEdN.exe
  C:\Windows\System\BCwHEdN.exe
  2⤵
  PID:7220
- C:\Windows\System\DwKWKXP.exe
  C:\Windows\System\DwKWKXP.exe
  2⤵
  PID:7252
- C:\Windows\System\EMZkXCd.exe
  C:\Windows\System\EMZkXCd.exe
  2⤵
  PID:7280
- C:\Windows\System\VFGkoBH.exe
  C:\Windows\System\VFGkoBH.exe
  2⤵
  PID:7324
- C:\Windows\System\AqOOHVL.exe
  C:\Windows\System\AqOOHVL.exe
  2⤵
  PID:7348
- C:\Windows\System\XSdvfNh.exe
  C:\Windows\System\XSdvfNh.exe
  2⤵
  PID:7376
- C:\Windows\System\oRLwFwL.exe
  C:\Windows\System\oRLwFwL.exe
  2⤵
  PID:7400
- C:\Windows\System\QNPofkl.exe
  C:\Windows\System\QNPofkl.exe
  2⤵
  PID:7416
- C:\Windows\System\TiYaYfc.exe
  C:\Windows\System\TiYaYfc.exe
  2⤵
  PID:7444
- C:\Windows\System\FijHHtI.exe
  C:\Windows\System\FijHHtI.exe
  2⤵
  PID:7488
- C:\Windows\System\CvFtzDI.exe
  C:\Windows\System\CvFtzDI.exe
  2⤵
  PID:7512
- C:\Windows\System\NLehcAV.exe
  C:\Windows\System\NLehcAV.exe
  2⤵
  PID:7544
- C:\Windows\System\XIRAWNM.exe
  C:\Windows\System\XIRAWNM.exe
  2⤵
  PID:7560
- C:\Windows\System\EFquXMI.exe
  C:\Windows\System\EFquXMI.exe
  2⤵
  PID:7584
- C:\Windows\System\AXBRkgu.exe
  C:\Windows\System\AXBRkgu.exe
  2⤵
  PID:7628
- C:\Windows\System\fEMlXVb.exe
  C:\Windows\System\fEMlXVb.exe
  2⤵
  PID:7656
- C:\Windows\System\CzgrWhS.exe
  C:\Windows\System\CzgrWhS.exe
  2⤵
  PID:7684
- C:\Windows\System\MPwijJn.exe
  C:\Windows\System\MPwijJn.exe
  2⤵
  PID:7704
- C:\Windows\System\myWIeqa.exe
  C:\Windows\System\myWIeqa.exe
  2⤵
  PID:7728
- C:\Windows\System\rPrVdnw.exe
  C:\Windows\System\rPrVdnw.exe
  2⤵
  PID:7752
- C:\Windows\System\OFCmaIj.exe
  C:\Windows\System\OFCmaIj.exe
  2⤵
  PID:7776
- C:\Windows\System\BZszFmR.exe
  C:\Windows\System\BZszFmR.exe
  2⤵
  PID:7796
- C:\Windows\System\ooZGgzd.exe
  C:\Windows\System\ooZGgzd.exe
  2⤵
  PID:7836
- C:\Windows\System\EYDhMnA.exe
  C:\Windows\System\EYDhMnA.exe
  2⤵
  PID:7872
- C:\Windows\System\mnAWpHN.exe
  C:\Windows\System\mnAWpHN.exe
  2⤵
  PID:7908
- C:\Windows\System\AMYSfZG.exe
  C:\Windows\System\AMYSfZG.exe
  2⤵
  PID:7936
- C:\Windows\System\DVhwokd.exe
  C:\Windows\System\DVhwokd.exe
  2⤵
  PID:7956
- C:\Windows\System\TyhyQNd.exe
  C:\Windows\System\TyhyQNd.exe
  2⤵
  PID:7976
- C:\Windows\System\taVTtqC.exe
  C:\Windows\System\taVTtqC.exe
  2⤵
  PID:8004
- C:\Windows\System\SNeRPop.exe
  C:\Windows\System\SNeRPop.exe
  2⤵
  PID:8048
- C:\Windows\System\rbZZnYJ.exe
  C:\Windows\System\rbZZnYJ.exe
  2⤵
  PID:8068
- C:\Windows\System\QctADvd.exe
  C:\Windows\System\QctADvd.exe
  2⤵
  PID:8092
- C:\Windows\System\NuItzwx.exe
  C:\Windows\System\NuItzwx.exe
  2⤵
  PID:8120
- C:\Windows\System\dVlKUjQ.exe
  C:\Windows\System\dVlKUjQ.exe
  2⤵
  PID:8144
- C:\Windows\System\tzZHSne.exe
  C:\Windows\System\tzZHSne.exe
  2⤵
  PID:8188
- C:\Windows\System\tWBbWZe.exe
  C:\Windows\System\tWBbWZe.exe
  2⤵
  PID:7212
- C:\Windows\System\tvoHQvd.exe
  C:\Windows\System\tvoHQvd.exe
  2⤵
  PID:7272
- C:\Windows\System\hUNlnlv.exe
  C:\Windows\System\hUNlnlv.exe
  2⤵
  PID:7340
- C:\Windows\System\FYVmtqK.exe
  C:\Windows\System\FYVmtqK.exe
  2⤵
  PID:7408
- C:\Windows\System\HiIZFeo.exe
  C:\Windows\System\HiIZFeo.exe
  2⤵
  PID:7476
- C:\Windows\System\nkqrdBW.exe
  C:\Windows\System\nkqrdBW.exe
  2⤵
  PID:7528
- C:\Windows\System\TElNkKD.exe
  C:\Windows\System\TElNkKD.exe
  2⤵
  PID:7604
- C:\Windows\System\MNSFbth.exe
  C:\Windows\System\MNSFbth.exe
  2⤵
  PID:7676
- C:\Windows\System\SePyCvt.exe
  C:\Windows\System\SePyCvt.exe
  2⤵
  PID:7748
- C:\Windows\System\oolpLwN.exe
  C:\Windows\System\oolpLwN.exe
  2⤵
  PID:7832
- C:\Windows\System\uHLhomU.exe
  C:\Windows\System\uHLhomU.exe
  2⤵
  PID:7880
- C:\Windows\System\DKYmEaq.exe
  C:\Windows\System\DKYmEaq.exe
  2⤵
  PID:7948
- C:\Windows\System\OkhAWxl.exe
  C:\Windows\System\OkhAWxl.exe
  2⤵
  PID:7996
- C:\Windows\System\BmTcKjJ.exe
  C:\Windows\System\BmTcKjJ.exe
  2⤵
  PID:8104
- C:\Windows\System\XXcrfNb.exe
  C:\Windows\System\XXcrfNb.exe
  2⤵
  PID:8136
- C:\Windows\System\JpAlPEm.exe
  C:\Windows\System\JpAlPEm.exe
  2⤵
  PID:7184
- C:\Windows\System\HBCcJZe.exe
  C:\Windows\System\HBCcJZe.exe
  2⤵
  PID:7356
- C:\Windows\System\kQXiRpv.exe
  C:\Windows\System\kQXiRpv.exe
  2⤵
  PID:7464
- C:\Windows\System\JJxuEhL.exe
  C:\Windows\System\JJxuEhL.exe
  2⤵
  PID:7636
- C:\Windows\System\eFcCOoV.exe
  C:\Windows\System\eFcCOoV.exe
  2⤵
  PID:7972
- C:\Windows\System\vUCvTCp.exe
  C:\Windows\System\vUCvTCp.exe
  2⤵
  PID:8164
- C:\Windows\System\JDiIqrW.exe
  C:\Windows\System\JDiIqrW.exe
  2⤵
  PID:7924
- C:\Windows\System\ydSEVOU.exe
  C:\Windows\System\ydSEVOU.exe
  2⤵
  PID:7696
- C:\Windows\System\ZxmIKUo.exe
  C:\Windows\System\ZxmIKUo.exe
  2⤵
  PID:8084
- C:\Windows\System\CichKim.exe
  C:\Windows\System\CichKim.exe
  2⤵
  PID:7772
- C:\Windows\System\sYdICkY.exe
  C:\Windows\System\sYdICkY.exe
  2⤵
  PID:7932
- C:\Windows\System\LxgHEse.exe
  C:\Windows\System\LxgHEse.exe
  2⤵
  PID:8200
- C:\Windows\System\wMlbCNG.exe
  C:\Windows\System\wMlbCNG.exe
  2⤵
  PID:8232
- C:\Windows\System\whKzQQF.exe
  C:\Windows\System\whKzQQF.exe
  2⤵
  PID:8248
- C:\Windows\System\lgvGUqM.exe
  C:\Windows\System\lgvGUqM.exe
  2⤵
  PID:8292
- C:\Windows\System\bBxAVEH.exe
  C:\Windows\System\bBxAVEH.exe
  2⤵
  PID:8316
- C:\Windows\System\YVNJiQE.exe
  C:\Windows\System\YVNJiQE.exe
  2⤵
  PID:8340
- C:\Windows\System\ZyckASr.exe
  C:\Windows\System\ZyckASr.exe
  2⤵
  PID:8364
- C:\Windows\System\NZQjhnE.exe
  C:\Windows\System\NZQjhnE.exe
  2⤵
  PID:8384
- C:\Windows\System\FWlYMaT.exe
  C:\Windows\System\FWlYMaT.exe
  2⤵
  PID:8412
- C:\Windows\System\jUHrXBh.exe
  C:\Windows\System\jUHrXBh.exe
  2⤵
  PID:8432
- C:\Windows\System\nnaNExt.exe
  C:\Windows\System\nnaNExt.exe
  2⤵
  PID:8456
- C:\Windows\System\OHZrMgH.exe
  C:\Windows\System\OHZrMgH.exe
  2⤵
  PID:8476
- C:\Windows\System\UMLWaeM.exe
  C:\Windows\System\UMLWaeM.exe
  2⤵
  PID:8496
- C:\Windows\System\WthbDSC.exe
  C:\Windows\System\WthbDSC.exe
  2⤵
  PID:8544
- C:\Windows\System\EdBMkDl.exe
  C:\Windows\System\EdBMkDl.exe
  2⤵
  PID:8596
- C:\Windows\System\fVsvCZU.exe
  C:\Windows\System\fVsvCZU.exe
  2⤵
  PID:8624
- C:\Windows\System\RMKmsAw.exe
  C:\Windows\System\RMKmsAw.exe
  2⤵
  PID:8648
- C:\Windows\System\pUWNWcX.exe
  C:\Windows\System\pUWNWcX.exe
  2⤵
  PID:8672
- C:\Windows\System\UExQzZQ.exe
  C:\Windows\System\UExQzZQ.exe
  2⤵
  PID:8700
- C:\Windows\System\WRPqxik.exe
  C:\Windows\System\WRPqxik.exe
  2⤵
  PID:8724
- C:\Windows\System\gACirqQ.exe
  C:\Windows\System\gACirqQ.exe
  2⤵
  PID:8764
- C:\Windows\System\vhKbbjt.exe
  C:\Windows\System\vhKbbjt.exe
  2⤵
  PID:8792
- C:\Windows\System\pBTZZaA.exe
  C:\Windows\System\pBTZZaA.exe
  2⤵
  PID:8820
- C:\Windows\System\rlgwaoH.exe
  C:\Windows\System\rlgwaoH.exe
  2⤵
  PID:8840
- C:\Windows\System\tIuPOXI.exe
  C:\Windows\System\tIuPOXI.exe
  2⤵
  PID:8868
- C:\Windows\System\uNGXQAm.exe
  C:\Windows\System\uNGXQAm.exe
  2⤵
  PID:8884
- C:\Windows\System\hKxuVKF.exe
  C:\Windows\System\hKxuVKF.exe
  2⤵
  PID:8904
- C:\Windows\System\JRuMABA.exe
  C:\Windows\System\JRuMABA.exe
  2⤵
  PID:8940
- C:\Windows\System\VTGWDRS.exe
  C:\Windows\System\VTGWDRS.exe
  2⤵
  PID:8964
- C:\Windows\System\uRVvWNR.exe
  C:\Windows\System\uRVvWNR.exe
  2⤵
  PID:9008
- C:\Windows\System\AeKeNmi.exe
  C:\Windows\System\AeKeNmi.exe
  2⤵
  PID:9044
- C:\Windows\System\ihsAfFu.exe
  C:\Windows\System\ihsAfFu.exe
  2⤵
  PID:9072
- C:\Windows\System\gKebXXJ.exe
  C:\Windows\System\gKebXXJ.exe
  2⤵
  PID:9092
- C:\Windows\System\ppgFFLb.exe
  C:\Windows\System\ppgFFLb.exe
  2⤵
  PID:9112
- C:\Windows\System\MpiUAMZ.exe
  C:\Windows\System\MpiUAMZ.exe
  2⤵
  PID:9140
- C:\Windows\System\nBGeeQo.exe
  C:\Windows\System\nBGeeQo.exe
  2⤵
  PID:9184
- C:\Windows\System\BSpuMSh.exe
  C:\Windows\System\BSpuMSh.exe
  2⤵
  PID:9204
- C:\Windows\System\sTgCRAu.exe
  C:\Windows\System\sTgCRAu.exe
  2⤵
  PID:8196
- C:\Windows\System\xKvlIjo.exe
  C:\Windows\System\xKvlIjo.exe
  2⤵
  PID:8284
- C:\Windows\System\vrskUHQ.exe
  C:\Windows\System\vrskUHQ.exe
  2⤵
  PID:8336
- C:\Windows\System\cpzmyQE.exe
  C:\Windows\System\cpzmyQE.exe
  2⤵
  PID:8380
- C:\Windows\System\QzqzkFa.exe
  C:\Windows\System\QzqzkFa.exe
  2⤵
  PID:8508
- C:\Windows\System\pbzUigx.exe
  C:\Windows\System\pbzUigx.exe
  2⤵
  PID:8540
- C:\Windows\System\lZviqrD.exe
  C:\Windows\System\lZviqrD.exe
  2⤵
  PID:8584
- C:\Windows\System\ULAFauS.exe
  C:\Windows\System\ULAFauS.exe
  2⤵
  PID:8660
- C:\Windows\System\AEYPlSK.exe
  C:\Windows\System\AEYPlSK.exe
  2⤵
  PID:8772
- C:\Windows\System\LiABZgZ.exe
  C:\Windows\System\LiABZgZ.exe
  2⤵
  PID:8836
- C:\Windows\System\XbiVWrG.exe
  C:\Windows\System\XbiVWrG.exe
  2⤵
  PID:8896
- C:\Windows\System\uVmqAqw.exe
  C:\Windows\System\uVmqAqw.exe
  2⤵
  PID:8952
- C:\Windows\System\ZlLVNCT.exe
  C:\Windows\System\ZlLVNCT.exe
  2⤵
  PID:9036
- C:\Windows\System\QZQrgOd.exe
  C:\Windows\System\QZQrgOd.exe
  2⤵
  PID:9172
- C:\Windows\System\LhZLzvS.exe
  C:\Windows\System\LhZLzvS.exe
  2⤵
  PID:8276
- C:\Windows\System\KHjhAqu.exe
  C:\Windows\System\KHjhAqu.exe
  2⤵
  PID:8356
- C:\Windows\System\BXMWpgZ.exe
  C:\Windows\System\BXMWpgZ.exe
  2⤵
  PID:8452
- C:\Windows\System\QCmDOZj.exe
  C:\Windows\System\QCmDOZj.exe
  2⤵
  PID:8632
- C:\Windows\System\uFXofqp.exe
  C:\Windows\System\uFXofqp.exe
  2⤵
  PID:8732
- C:\Windows\System\ipsaXEk.exe
  C:\Windows\System\ipsaXEk.exe
  2⤵
  PID:8864
- C:\Windows\System\MmtNbyv.exe
  C:\Windows\System\MmtNbyv.exe
  2⤵
  PID:8960
- C:\Windows\System\rxvOZkf.exe
  C:\Windows\System\rxvOZkf.exe
  2⤵
  PID:9108
- C:\Windows\System\YxEoLiz.exe
  C:\Windows\System\YxEoLiz.exe
  2⤵
  PID:8376
- C:\Windows\System\dXLRkZo.exe
  C:\Windows\System\dXLRkZo.exe
  2⤵
  PID:8828
- C:\Windows\System\Bazaavr.exe
  C:\Windows\System\Bazaavr.exe
  2⤵
  PID:1932
- C:\Windows\System\pkHlNej.exe
  C:\Windows\System\pkHlNej.exe
  2⤵
  PID:9084
- C:\Windows\System\otgOEKM.exe
  C:\Windows\System\otgOEKM.exe
  2⤵
  PID:9220
- C:\Windows\System\ENoucDK.exe
  C:\Windows\System\ENoucDK.exe
  2⤵
  PID:9236
- C:\Windows\System\ksTbsyg.exe
  C:\Windows\System\ksTbsyg.exe
  2⤵
  PID:9256
- C:\Windows\System\VDUGQko.exe
  C:\Windows\System\VDUGQko.exe
  2⤵
  PID:9312
- C:\Windows\System\ddYvmtW.exe
  C:\Windows\System\ddYvmtW.exe
  2⤵
  PID:9332
- C:\Windows\System\AfxDOUm.exe
  C:\Windows\System\AfxDOUm.exe
  2⤵
  PID:9360
- C:\Windows\System\igVmNpo.exe
  C:\Windows\System\igVmNpo.exe
  2⤵
  PID:9384
- C:\Windows\System\eTLFWhn.exe
  C:\Windows\System\eTLFWhn.exe
  2⤵
  PID:9408
- C:\Windows\System\MFeYUgi.exe
  C:\Windows\System\MFeYUgi.exe
  2⤵
  PID:9428
- C:\Windows\System\BkkkAuO.exe
  C:\Windows\System\BkkkAuO.exe
  2⤵
  PID:9452
- C:\Windows\System\ZNdqMNz.exe
  C:\Windows\System\ZNdqMNz.exe
  2⤵
  PID:9476
- C:\Windows\System\EidlgKC.exe
  C:\Windows\System\EidlgKC.exe
  2⤵
  PID:9496
- C:\Windows\System\xoWxmPG.exe
  C:\Windows\System\xoWxmPG.exe
  2⤵
  PID:9548
- C:\Windows\System\nlUybGr.exe
  C:\Windows\System\nlUybGr.exe
  2⤵
  PID:9568
- C:\Windows\System\zWLtytV.exe
  C:\Windows\System\zWLtytV.exe
  2⤵
  PID:9592
- C:\Windows\System\PjobiTc.exe
  C:\Windows\System\PjobiTc.exe
  2⤵
  PID:9616
- C:\Windows\System\ebJIZgl.exe
  C:\Windows\System\ebJIZgl.exe
  2⤵
  PID:9636
- C:\Windows\System\sBchFoV.exe
  C:\Windows\System\sBchFoV.exe
  2⤵
  PID:9680
- C:\Windows\System\ddDdhfY.exe
  C:\Windows\System\ddDdhfY.exe
  2⤵
  PID:9700
- C:\Windows\System\bGdFmYr.exe
  C:\Windows\System\bGdFmYr.exe
  2⤵
  PID:9724
- C:\Windows\System\uiQZpap.exe
  C:\Windows\System\uiQZpap.exe
  2⤵
  PID:9768
- C:\Windows\System\LxhuyNN.exe
  C:\Windows\System\LxhuyNN.exe
  2⤵
  PID:9812
- C:\Windows\System\OaiZBno.exe
  C:\Windows\System\OaiZBno.exe
  2⤵
  PID:9852
- C:\Windows\System\qCjWLuo.exe
  C:\Windows\System\qCjWLuo.exe
  2⤵
  PID:9872
- C:\Windows\System\VnmxXEH.exe
  C:\Windows\System\VnmxXEH.exe
  2⤵
  PID:9908
- C:\Windows\System\LpvGqUD.exe
  C:\Windows\System\LpvGqUD.exe
  2⤵
  PID:9928
- C:\Windows\System\XCHBHzt.exe
  C:\Windows\System\XCHBHzt.exe
  2⤵
  PID:9952
- C:\Windows\System\hiNyigo.exe
  C:\Windows\System\hiNyigo.exe
  2⤵
  PID:9976
- C:\Windows\System\VCUCKyq.exe
  C:\Windows\System\VCUCKyq.exe
  2⤵
  PID:9996
- C:\Windows\System\vPtLxjK.exe
  C:\Windows\System\vPtLxjK.exe
  2⤵
  PID:10016
- C:\Windows\System\bPXJTaq.exe
  C:\Windows\System\bPXJTaq.exe
  2⤵
  PID:10036
- C:\Windows\System\JtcKXRS.exe
  C:\Windows\System\JtcKXRS.exe
  2⤵
  PID:10056
- C:\Windows\System\ZdWnlje.exe
  C:\Windows\System\ZdWnlje.exe
  2⤵
  PID:10080
- C:\Windows\System\ftSvzZu.exe
  C:\Windows\System\ftSvzZu.exe
  2⤵
  PID:10100
- C:\Windows\System\gMYShzB.exe
  C:\Windows\System\gMYShzB.exe
  2⤵
  PID:10120
- C:\Windows\System\HMumyWy.exe
  C:\Windows\System\HMumyWy.exe
  2⤵
  PID:10144
- C:\Windows\System\lMhibuS.exe
  C:\Windows\System\lMhibuS.exe
  2⤵
  PID:10168
- C:\Windows\System\uMFzuuB.exe
  C:\Windows\System\uMFzuuB.exe
  2⤵
  PID:10192
- C:\Windows\System\VlfAUZO.exe
  C:\Windows\System\VlfAUZO.exe
  2⤵
  PID:9232
- C:\Windows\System\unvcozh.exe
  C:\Windows\System\unvcozh.exe
  2⤵
  PID:9356
- C:\Windows\System\PgvLNLN.exe
  C:\Windows\System\PgvLNLN.exe
  2⤵
  PID:9460
- C:\Windows\System\hTgpEyN.exe
  C:\Windows\System\hTgpEyN.exe
  2⤵
  PID:9472
- C:\Windows\System\moNxKRO.exe
  C:\Windows\System\moNxKRO.exe
  2⤵
  PID:9560
- C:\Windows\System\lhARatL.exe
  C:\Windows\System\lhARatL.exe
  2⤵
  PID:9544
- C:\Windows\System\YKpqhTT.exe
  C:\Windows\System\YKpqhTT.exe
  2⤵
  PID:9632
- C:\Windows\System\BeDhigV.exe
  C:\Windows\System\BeDhigV.exe
  2⤵
  PID:9720
- C:\Windows\System\bRYcifD.exe
  C:\Windows\System\bRYcifD.exe
  2⤵
  PID:9796
- C:\Windows\System\IRepSTL.exe
  C:\Windows\System\IRepSTL.exe
  2⤵
  PID:9836
- C:\Windows\System\VUjQqrL.exe
  C:\Windows\System\VUjQqrL.exe
  2⤵
  PID:9944
- C:\Windows\System\skwKFJK.exe
  C:\Windows\System\skwKFJK.exe
  2⤵
  PID:9984
- C:\Windows\System\wbjaMzr.exe
  C:\Windows\System\wbjaMzr.exe
  2⤵
  PID:10048
- C:\Windows\System\YjOsKfu.exe
  C:\Windows\System\YjOsKfu.exe
  2⤵
  PID:10096
- C:\Windows\System\ebETLij.exe
  C:\Windows\System\ebETLij.exe
  2⤵
  PID:10152
- C:\Windows\System\SsyMUyI.exe
  C:\Windows\System\SsyMUyI.exe
  2⤵
  PID:10200
- C:\Windows\System\evUlLgx.exe
  C:\Windows\System\evUlLgx.exe
  2⤵
  PID:9348
- C:\Windows\System\KrvelaE.exe
  C:\Windows\System\KrvelaE.exe
  2⤵
  PID:9468
- C:\Windows\System\NEWMeYM.exe
  C:\Windows\System\NEWMeYM.exe
  2⤵
  PID:9584
- C:\Windows\System\dzHcZKV.exe
  C:\Windows\System\dzHcZKV.exe
  2⤵
  PID:9784
- C:\Windows\System\xDLxLdE.exe
  C:\Windows\System\xDLxLdE.exe
  2⤵
  PID:9892
- C:\Windows\System\OMcHeem.exe
  C:\Windows\System\OMcHeem.exe
  2⤵
  PID:9968
- C:\Windows\System\EKLEOUj.exe
  C:\Windows\System\EKLEOUj.exe
  2⤵
  PID:10136
- C:\Windows\System\JrEKRiQ.exe
  C:\Windows\System\JrEKRiQ.exe
  2⤵
  PID:9372
- C:\Windows\System\MwLAFhv.exe
  C:\Windows\System\MwLAFhv.exe
  2⤵
  PID:9448
- C:\Windows\System\QZkOrYC.exe
  C:\Windows\System\QZkOrYC.exe
  2⤵
  PID:9832
- C:\Windows\System\GhyaPMd.exe
  C:\Windows\System\GhyaPMd.exe
  2⤵
  PID:9804
- C:\Windows\System\rfPUABv.exe
  C:\Windows\System\rfPUABv.exe
  2⤵
  PID:9268
- C:\Windows\System\IgaxXqF.exe
  C:\Windows\System\IgaxXqF.exe
  2⤵
  PID:10244
- C:\Windows\System\RvmrUzT.exe
  C:\Windows\System\RvmrUzT.exe
  2⤵
  PID:10268
- C:\Windows\System\RVRQeCD.exe
  C:\Windows\System\RVRQeCD.exe
  2⤵
  PID:10288
- C:\Windows\System\kQGKpFI.exe
  C:\Windows\System\kQGKpFI.exe
  2⤵
  PID:10380
- C:\Windows\System\KtToASd.exe
  C:\Windows\System\KtToASd.exe
  2⤵
  PID:10420
- C:\Windows\System\nnDWTKW.exe
  C:\Windows\System\nnDWTKW.exe
  2⤵
  PID:10448
- C:\Windows\System\lzfyvil.exe
  C:\Windows\System\lzfyvil.exe
  2⤵
  PID:10480
- C:\Windows\System\gnjyxum.exe
  C:\Windows\System\gnjyxum.exe
  2⤵
  PID:10504
- C:\Windows\System\MTgLjGv.exe
  C:\Windows\System\MTgLjGv.exe
  2⤵
  PID:10524
- C:\Windows\System\TjeMNno.exe
  C:\Windows\System\TjeMNno.exe
  2⤵
  PID:10548
- C:\Windows\System\kQMzaEb.exe
  C:\Windows\System\kQMzaEb.exe
  2⤵
  PID:10564
- C:\Windows\System\yCOiOuF.exe
  C:\Windows\System\yCOiOuF.exe
  2⤵
  PID:10600
- C:\Windows\System\fkdluQp.exe
  C:\Windows\System\fkdluQp.exe
  2⤵
  PID:10628
- C:\Windows\System\KwlzWlH.exe
  C:\Windows\System\KwlzWlH.exe
  2⤵
  PID:10672
- C:\Windows\System\zuOkhnM.exe
  C:\Windows\System\zuOkhnM.exe
  2⤵
  PID:10688
- C:\Windows\System\qziuizk.exe
  C:\Windows\System\qziuizk.exe
  2⤵
  PID:10704
- C:\Windows\System\RlGFDSw.exe
  C:\Windows\System\RlGFDSw.exe
  2⤵
  PID:10764
- C:\Windows\System\gJdemvL.exe
  C:\Windows\System\gJdemvL.exe
  2⤵
  PID:10784
- C:\Windows\System\aCaZYnh.exe
  C:\Windows\System\aCaZYnh.exe
  2⤵
  PID:10808
- C:\Windows\System\WpWHPxJ.exe
  C:\Windows\System\WpWHPxJ.exe
  2⤵
  PID:10836
- C:\Windows\System\jBderXI.exe
  C:\Windows\System\jBderXI.exe
  2⤵
  PID:10856
- C:\Windows\System\YTRDLgW.exe
  C:\Windows\System\YTRDLgW.exe
  2⤵
  PID:10880
- C:\Windows\System\KnTVMHB.exe
  C:\Windows\System\KnTVMHB.exe
  2⤵
  PID:10900
- C:\Windows\System\DQYjvcb.exe
  C:\Windows\System\DQYjvcb.exe
  2⤵
  PID:10944
- C:\Windows\System\lepzLvX.exe
  C:\Windows\System\lepzLvX.exe
  2⤵
  PID:10980
- C:\Windows\System\qDGMgVr.exe
  C:\Windows\System\qDGMgVr.exe
  2⤵
  PID:11012
- C:\Windows\System\ZMUcSIk.exe
  C:\Windows\System\ZMUcSIk.exe
  2⤵
  PID:11040
- C:\Windows\System\gtNZMah.exe
  C:\Windows\System\gtNZMah.exe
  2⤵
  PID:11072
- C:\Windows\System\vaVWdek.exe
  C:\Windows\System\vaVWdek.exe
  2⤵
  PID:11092
- C:\Windows\System\awLgYKN.exe
  C:\Windows\System\awLgYKN.exe
  2⤵
  PID:11132
- C:\Windows\System\WrzoYlQ.exe
  C:\Windows\System\WrzoYlQ.exe
  2⤵
  PID:11148
- C:\Windows\System\RyUaLYP.exe
  C:\Windows\System\RyUaLYP.exe
  2⤵
  PID:11172
- C:\Windows\System\eitcMKK.exe
  C:\Windows\System\eitcMKK.exe
  2⤵
  PID:11204
- C:\Windows\System\cgqTMug.exe
  C:\Windows\System\cgqTMug.exe
  2⤵
  PID:11232
- C:\Windows\System\wylgTZD.exe
  C:\Windows\System\wylgTZD.exe
  2⤵
  PID:9612
- C:\Windows\System\WdDoucR.exe
  C:\Windows\System\WdDoucR.exe
  2⤵
  PID:10276
- C:\Windows\System\pAVsLOQ.exe
  C:\Windows\System\pAVsLOQ.exe
  2⤵
  PID:10348
- C:\Windows\System\brwTpUi.exe
  C:\Windows\System\brwTpUi.exe
  2⤵
  PID:10068
- C:\Windows\System\FjJtxuv.exe
  C:\Windows\System\FjJtxuv.exe
  2⤵
  PID:10376
- C:\Windows\System\ZzBLTgg.exe
  C:\Windows\System\ZzBLTgg.exe
  2⤵
  PID:10432
- C:\Windows\System\VBcUinw.exe
  C:\Windows\System\VBcUinw.exe
  2⤵
  PID:10516
- C:\Windows\System\XBZVflm.exe
  C:\Windows\System\XBZVflm.exe
  2⤵
  PID:10576
- C:\Windows\System\wKUzWdS.exe
  C:\Windows\System\wKUzWdS.exe
  2⤵
  PID:10680
- C:\Windows\System\ntUGIsa.exe
  C:\Windows\System\ntUGIsa.exe
  2⤵
  PID:10732
- C:\Windows\System\kwrPkfS.exe
  C:\Windows\System\kwrPkfS.exe
  2⤵
  PID:10780
- C:\Windows\System\BkxOFsB.exe
  C:\Windows\System\BkxOFsB.exe
  2⤵
  PID:10896
- C:\Windows\System\oSnFZCy.exe
  C:\Windows\System\oSnFZCy.exe
  2⤵
  PID:10940
- C:\Windows\System\BpCMzlV.exe
  C:\Windows\System\BpCMzlV.exe
  2⤵
  PID:11000
- C:\Windows\System\uphbAVa.exe
  C:\Windows\System\uphbAVa.exe
  2⤵
  PID:11084
- C:\Windows\System\GDvXgwk.exe
  C:\Windows\System\GDvXgwk.exe
  2⤵
  PID:11116
- C:\Windows\System\kiMoFqH.exe
  C:\Windows\System\kiMoFqH.exe
  2⤵
  PID:11200
- C:\Windows\System\djXwyfS.exe
  C:\Windows\System\djXwyfS.exe
  2⤵
  PID:10260
- C:\Windows\System\epWjxHq.exe
  C:\Windows\System\epWjxHq.exe
  2⤵
  PID:10400
- C:\Windows\System\MAxquxV.exe
  C:\Windows\System\MAxquxV.exe
  2⤵
  PID:10540
- C:\Windows\System\zIwPVNJ.exe
  C:\Windows\System\zIwPVNJ.exe
  2⤵
  PID:10824
- C:\Windows\System\untIQYQ.exe
  C:\Windows\System\untIQYQ.exe
  2⤵
  PID:10820
- C:\Windows\System\HHyGsHI.exe
  C:\Windows\System\HHyGsHI.exe
  2⤵
  PID:10976
- C:\Windows\System\rEjusPy.exe
  C:\Windows\System\rEjusPy.exe
  2⤵
  PID:11164
- C:\Windows\System\JPLJyHC.exe
  C:\Windows\System\JPLJyHC.exe
  2⤵
  PID:11252
- C:\Windows\System\YoXYDoy.exe
  C:\Windows\System\YoXYDoy.exe
  2⤵
  PID:10388
- C:\Windows\System\gViohvL.exe
  C:\Windows\System\gViohvL.exe
  2⤵
  PID:10660
- C:\Windows\System\nSpgfnR.exe
  C:\Windows\System\nSpgfnR.exe
  2⤵
  PID:10284
- C:\Windows\System\neLJlCP.exe
  C:\Windows\System\neLJlCP.exe
  2⤵
  PID:10712
- C:\Windows\System\AiJQokG.exe
  C:\Windows\System\AiJQokG.exe
  2⤵
  PID:11284
- C:\Windows\System\dMuPInO.exe
  C:\Windows\System\dMuPInO.exe
  2⤵
  PID:11316
- C:\Windows\System\PIeUQFU.exe
  C:\Windows\System\PIeUQFU.exe
  2⤵
  PID:11336
- C:\Windows\System\tuYypQk.exe
  C:\Windows\System\tuYypQk.exe
  2⤵
  PID:11352
- C:\Windows\System\ltQySTJ.exe
  C:\Windows\System\ltQySTJ.exe
  2⤵
  PID:11396
- C:\Windows\System\BHkCbig.exe
  C:\Windows\System\BHkCbig.exe
  2⤵
  PID:11428
- C:\Windows\System\AydMWkw.exe
  C:\Windows\System\AydMWkw.exe
  2⤵
  PID:11448
- C:\Windows\System\QDPYpTy.exe
  C:\Windows\System\QDPYpTy.exe
  2⤵
  PID:11464
- C:\Windows\System\wIJcaOD.exe
  C:\Windows\System\wIJcaOD.exe
  2⤵
  PID:11508
- C:\Windows\System\DQBwYUj.exe
  C:\Windows\System\DQBwYUj.exe
  2⤵
  PID:11532
- C:\Windows\System\sOilpnc.exe
  C:\Windows\System\sOilpnc.exe
  2⤵
  PID:11548
- C:\Windows\System\LAkexyY.exe
  C:\Windows\System\LAkexyY.exe
  2⤵
  PID:11568
- C:\Windows\System\aGNLMVG.exe
  C:\Windows\System\aGNLMVG.exe
  2⤵
  PID:11588
- C:\Windows\System\xzmfqKa.exe
  C:\Windows\System\xzmfqKa.exe
  2⤵
  PID:11612
- C:\Windows\System\lNTIIlE.exe
  C:\Windows\System\lNTIIlE.exe
  2⤵
  PID:11636
- C:\Windows\System\BQlrgGz.exe
  C:\Windows\System\BQlrgGz.exe
  2⤵
  PID:11656
- C:\Windows\System\ZDDqPmj.exe
  C:\Windows\System\ZDDqPmj.exe
  2⤵
  PID:11692
- C:\Windows\System\elXaPsz.exe
  C:\Windows\System\elXaPsz.exe
  2⤵
  PID:11708
- C:\Windows\System\fVXkqGI.exe
  C:\Windows\System\fVXkqGI.exe
  2⤵
  PID:11728
- C:\Windows\System\fqBKhKU.exe
  C:\Windows\System\fqBKhKU.exe
  2⤵
  PID:11748
- C:\Windows\System\usTNNDX.exe
  C:\Windows\System\usTNNDX.exe
  2⤵
  PID:11780
- C:\Windows\System\yifBlue.exe
  C:\Windows\System\yifBlue.exe
  2⤵
  PID:11804
- C:\Windows\System\yrUtVgE.exe
  C:\Windows\System\yrUtVgE.exe
  2⤵
  PID:11828
- C:\Windows\System\xkWPVGg.exe
  C:\Windows\System\xkWPVGg.exe
  2⤵
  PID:11864
- C:\Windows\System\FEXLkrx.exe
  C:\Windows\System\FEXLkrx.exe
  2⤵
  PID:11908
- C:\Windows\System\zGZihlx.exe
  C:\Windows\System\zGZihlx.exe
  2⤵
  PID:11972
- C:\Windows\System\GeNFSHs.exe
  C:\Windows\System\GeNFSHs.exe
  2⤵
  PID:12012
- C:\Windows\System\eZoXYsE.exe
  C:\Windows\System\eZoXYsE.exe
  2⤵
  PID:12040
- C:\Windows\System\lMbfSrH.exe
  C:\Windows\System\lMbfSrH.exe
  2⤵
  PID:12072
- C:\Windows\System\oLyBPqQ.exe
  C:\Windows\System\oLyBPqQ.exe
  2⤵
  PID:12092
- C:\Windows\System\DfDCXcj.exe
  C:\Windows\System\DfDCXcj.exe
  2⤵
  PID:12120
- C:\Windows\System\lfoNbre.exe
  C:\Windows\System\lfoNbre.exe
  2⤵
  PID:12180
- C:\Windows\System\doKzfZi.exe
  C:\Windows\System\doKzfZi.exe
  2⤵
  PID:12196
- C:\Windows\System\ZYjOAet.exe
  C:\Windows\System\ZYjOAet.exe
  2⤵
  PID:12212
- C:\Windows\System\yaUWWfP.exe
  C:\Windows\System\yaUWWfP.exe
  2⤵
  PID:12240
- C:\Windows\System\msiacPv.exe
  C:\Windows\System\msiacPv.exe
  2⤵
  PID:12256
- C:\Windows\System\LtCuRbr.exe
  C:\Windows\System\LtCuRbr.exe
  2⤵
  PID:11392
- C:\Windows\System\KlhHSGX.exe
  C:\Windows\System\KlhHSGX.exe
  2⤵
  PID:11436
- C:\Windows\System\ICWcdPp.exe
  C:\Windows\System\ICWcdPp.exe
  2⤵
  PID:11480
- C:\Windows\System\NYXyuJm.exe
  C:\Windows\System\NYXyuJm.exe
  2⤵
  PID:11496
- C:\Windows\System\mtcQChM.exe
  C:\Windows\System\mtcQChM.exe
  2⤵
  PID:11632
- C:\Windows\System\UydvQqh.exe
  C:\Windows\System\UydvQqh.exe
  2⤵
  PID:11736
- C:\Windows\System\vOREkBW.exe
  C:\Windows\System\vOREkBW.exe
  2⤵
  PID:11820
- C:\Windows\System\TGwZWwg.exe
  C:\Windows\System\TGwZWwg.exe
  2⤵
  PID:11740
- C:\Windows\System\kDNrVtv.exe
  C:\Windows\System\kDNrVtv.exe
  2⤵
  PID:11848
- C:\Windows\System\fkidiTe.exe
  C:\Windows\System\fkidiTe.exe
  2⤵
  PID:11852
- C:\Windows\System\GLefjHj.exe
  C:\Windows\System\GLefjHj.exe
  2⤵
  PID:11980
- C:\Windows\System\mSrVhkW.exe
  C:\Windows\System\mSrVhkW.exe
  2⤵
  PID:12052
- C:\Windows\System\Lgaxkru.exe
  C:\Windows\System\Lgaxkru.exe
  2⤵
  PID:12088
- C:\Windows\System\FTrkAyV.exe
  C:\Windows\System\FTrkAyV.exe
  2⤵
  PID:12136
- C:\Windows\System\zIfNetg.exe
  C:\Windows\System\zIfNetg.exe
  2⤵
  PID:12224
- C:\Windows\System\usCdxja.exe
  C:\Windows\System\usCdxja.exe
  2⤵
  PID:12176
- C:\Windows\System\VbOEeGu.exe
  C:\Windows\System\VbOEeGu.exe
  2⤵
  PID:11308
- C:\Windows\System\sAQbrWw.exe
  C:\Windows\System\sAQbrWw.exe
  2⤵
  PID:11652
- C:\Windows\System\iBFSNVg.exe
  C:\Windows\System\iBFSNVg.exe
  2⤵
  PID:11792
- C:\Windows\System\HCJRcqS.exe
  C:\Windows\System\HCJRcqS.exe
  2⤵
  PID:11876
- C:\Windows\System\pgyjfGM.exe
  C:\Windows\System\pgyjfGM.exe
  2⤵
  PID:12164
- C:\Windows\System\tPCLodL.exe
  C:\Windows\System\tPCLodL.exe
  2⤵
  PID:12116
- C:\Windows\System\NaKhqgA.exe
  C:\Windows\System\NaKhqgA.exe
  2⤵
  PID:11504
- C:\Windows\System\pcAXVDY.exe
  C:\Windows\System\pcAXVDY.exe
  2⤵
  PID:11744
- C:\Windows\System\HovOojk.exe
  C:\Windows\System\HovOojk.exe
  2⤵
  PID:11996
- C:\Windows\System\TiIyVRi.exe
  C:\Windows\System\TiIyVRi.exe
  2⤵
  PID:12172
- C:\Windows\System\mXEuZor.exe
  C:\Windows\System\mXEuZor.exe
  2⤵
  PID:11672
- C:\Windows\System\NgbHkEi.exe
  C:\Windows\System\NgbHkEi.exe
  2⤵
  PID:11608
- C:\Windows\System\Pjrbotd.exe
  C:\Windows\System\Pjrbotd.exe
  2⤵
  PID:12304
- C:\Windows\System\aoOWYSh.exe
  C:\Windows\System\aoOWYSh.exe
  2⤵
  PID:12344
- C:\Windows\System\vPWCEsd.exe
  C:\Windows\System\vPWCEsd.exe
  2⤵
  PID:12368
- C:\Windows\System\CaTUlsY.exe
  C:\Windows\System\CaTUlsY.exe
  2⤵
  PID:12384
- C:\Windows\System\BZwqOLZ.exe
  C:\Windows\System\BZwqOLZ.exe
  2⤵
  PID:12404
- C:\Windows\System\ZCdeWSz.exe
  C:\Windows\System\ZCdeWSz.exe
  2⤵
  PID:12424
- C:\Windows\System\dygrPwZ.exe
  C:\Windows\System\dygrPwZ.exe
  2⤵
  PID:12448
- C:\Windows\System\lZqQUfg.exe
  C:\Windows\System\lZqQUfg.exe
  2⤵
  PID:12464
- C:\Windows\System\PCOXHSW.exe
  C:\Windows\System\PCOXHSW.exe
  2⤵
  PID:12492
- C:\Windows\System\JNOBvcK.exe
  C:\Windows\System\JNOBvcK.exe
  2⤵
  PID:12520
- C:\Windows\System\wKqJqPk.exe
  C:\Windows\System\wKqJqPk.exe
  2⤵
  PID:12568
- C:\Windows\System\WgQuhOw.exe
  C:\Windows\System\WgQuhOw.exe
  2⤵
  PID:12584
- C:\Windows\System\BfJdTpy.exe
  C:\Windows\System\BfJdTpy.exe
  2⤵
  PID:12620
- C:\Windows\System\BEeAdIh.exe
  C:\Windows\System\BEeAdIh.exe
  2⤵
  PID:12636
- C:\Windows\System\AqONdCJ.exe
  C:\Windows\System\AqONdCJ.exe
  2⤵
  PID:12672
- C:\Windows\System\OHMIwYY.exe
  C:\Windows\System\OHMIwYY.exe
  2⤵
  PID:12696
- C:\Windows\System\roPsktE.exe
  C:\Windows\System\roPsktE.exe
  2⤵
  PID:12724
- C:\Windows\System\rUcUJPh.exe
  C:\Windows\System\rUcUJPh.exe
  2⤵
  PID:12792
- C:\Windows\System\ZfFCikx.exe
  C:\Windows\System\ZfFCikx.exe
  2⤵
  PID:12812
- C:\Windows\System\HWhosyj.exe
  C:\Windows\System\HWhosyj.exe
  2⤵
  PID:12836
- C:\Windows\System\eryIuDZ.exe
  C:\Windows\System\eryIuDZ.exe
  2⤵
  PID:12876
- C:\Windows\System\rwNPHdx.exe
  C:\Windows\System\rwNPHdx.exe
  2⤵
  PID:12900
- C:\Windows\System\cEEQiRF.exe
  C:\Windows\System\cEEQiRF.exe
  2⤵
  PID:12928
- C:\Windows\System\ertoSws.exe
  C:\Windows\System\ertoSws.exe
  2⤵
  PID:12952
- C:\Windows\System\FCKpFzD.exe
  C:\Windows\System\FCKpFzD.exe
  2⤵
  PID:12972
- C:\Windows\System\BuFqGIK.exe
  C:\Windows\System\BuFqGIK.exe
  2⤵
  PID:13000
- C:\Windows\System\ALXtQfi.exe
  C:\Windows\System\ALXtQfi.exe
  2⤵
  PID:13024
- C:\Windows\System\yFarIxw.exe
  C:\Windows\System\yFarIxw.exe
  2⤵
  PID:13056
- C:\Windows\System\zihKKBQ.exe
  C:\Windows\System\zihKKBQ.exe
  2⤵
  PID:13084
- C:\Windows\System\wWdXBWJ.exe
  C:\Windows\System\wWdXBWJ.exe
  2⤵
  PID:13112
- C:\Windows\System\BdYIgjx.exe
  C:\Windows\System\BdYIgjx.exe
  2⤵
  PID:13144
- C:\Windows\System\CobzJkS.exe
  C:\Windows\System\CobzJkS.exe
  2⤵
  PID:13176
- C:\Windows\System\EcDLMHO.exe
  C:\Windows\System\EcDLMHO.exe
  2⤵
  PID:13196
- C:\Windows\System\rVfZLXY.exe
  C:\Windows\System\rVfZLXY.exe
  2⤵
  PID:13224
- C:\Windows\System\zWlIkXX.exe
  C:\Windows\System\zWlIkXX.exe
  2⤵
  PID:13248
- C:\Windows\System\dSwQMFC.exe
  C:\Windows\System\dSwQMFC.exe
  2⤵
  PID:13268
- C:\Windows\System\sVKhJER.exe
  C:\Windows\System\sVKhJER.exe
  2⤵
  PID:13308
- C:\Windows\System\mXJYRCL.exe
  C:\Windows\System\mXJYRCL.exe
  2⤵
  PID:12380
- C:\Windows\System\JNRBrIM.exe
  C:\Windows\System\JNRBrIM.exe
  2⤵
  PID:12392
- C:\Windows\System\YiUSfjm.exe
  C:\Windows\System\YiUSfjm.exe
  2⤵
  PID:12460
- C:\Windows\System\WcqDNjB.exe
  C:\Windows\System\WcqDNjB.exe
  2⤵
  PID:12556
- C:\Windows\System\LjbCQje.exe
  C:\Windows\System\LjbCQje.exe
  2⤵
  PID:12628
- C:\Windows\System\aJotVhr.exe
  C:\Windows\System\aJotVhr.exe
  2⤵
  PID:12680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ynxgjvo2.vd1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ynxgjvo2.vd1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BHZkard.exe

Path C:\Windows\System\BHZkard.exe
Size 2.1MB
SHA256 c4c6259a63bf8bd6ee41b40299f099c7b505089248264a7828e70e2398215ad9
MD5 5274f32f21c609478836bdce5b78f379
SHA1 3c3fd2bee529b91b842ad0e2d7947bb7437f3dd7
SHA512 55e46a62f44bd60036d4a323677b0daeefbe37d682b8a45535bba0e795013cf8d361a996bae152e78e7fcc5b1d8b9d39c683f323edbb4996c130907eb9a5df4d
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEJ:NABe
MD5 SHA1 SHA512 SSDEEP

Submit Download

CQeSpfA.exe

Path C:\Windows\System\CQeSpfA.exe
Size 2.1MB
SHA256 8394b09aa254c3d650427a4dbcb2b545327ee6756050199102b8b81c1a304ed7
MD5 99ad694874045ca6579aa26420d8ff87
SHA1 b9fae9b0f0e0b279ea262cfd2a565d4d6b54eeb0
SHA512 28004ee392fe5a4de24d8deb6063814845cd7b47abdc6a85ab8bc1e375881c6ea7665d84a775e29f17d424fa62f0d8a27f07f19a1c11c2c2b5663c3dfcc9c74a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEg:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

DSvJLfo.exe

Path C:\Windows\System\DSvJLfo.exe
Size 2.2MB
SHA256 0afffc1d1af6ea8d47f23ba9ff53062dd20ab72e9f8064bacb6fe9562d79a97e
MD5 10f6f876eb2ec9efc8f7ad0b484e9272
SHA1 96cea3832a0893c33e5e591a0f9b811bb0985c26
SHA512 f1b48d0ec0582a529a5bb94ede1dd17cccf84fb2e0ec17a68a61756e13a409f2af14d12209160d917b6bdb371806d0371ec25fa99cb5420ca86eaca7bda7d738
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEB:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

GyZTFQx.exe

Path C:\Windows\System\GyZTFQx.exe
Size 2.1MB
SHA256 5e442d4a0722c796bd04aa1742db21cc1839801e838171d5bd3574f18917e2b3
MD5 8c9af4cc03eff9adf12c2ebb2ff358c8
SHA1 be64fce264f95c66f384b5c8c873a62c99df7509
SHA512 fc1f3c98360f48b050b7c061c76663437cd4b1000db432b1c0fadfe7f17f6c42b4cfa0296aafbcfd4c74606e01fee3c007313bd19dfc568cd777e61b3559f553
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEO:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

HMHAgcj.exe

Path C:\Windows\System\HMHAgcj.exe
Size 2.1MB
SHA256 9ee1edd6a32ac92d78e768613600e3242f8354d2cdaef9194b03e4146c2b84bf
MD5 b7cf48b0c531069e648183420543a443
SHA1 f1b352f36d1f28e220bdbdecab67a5199c7a7d0e
SHA512 b9da14f196f1046a213c3c1f4644ba19a5799b5c77fa5e0cfb357447036aeeba8d0cf0b4ed52b4954702ddc4d9765bf19f2a804ab060db0ba1b9096cc17c9458
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEG:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

IQFfCth.exe

Path C:\Windows\System\IQFfCth.exe
Size 2.1MB
SHA256 c95e18a306308d068c405c1103f6faf91802f0f7fac7e0b7a2a4a654cf8b5f28
MD5 5e4957edade8b386ec4e7ed3af7d1a9c
SHA1 a94e4a0ddd902ec0661baeede274e961ead08a02
SHA512 fcad47f749602708369232f1492cb8c26f73fb6c8647ecc3c7c781c27cd05933345a4483d23044063fa5a74d0ae6e780c8fe2cc68fbda5c76606f5d5134e485c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEc:NABH
MD5 SHA1 SHA512 SSDEEP

Submit Download

IlXXiFS.exe

Path C:\Windows\System\IlXXiFS.exe
Size 2.1MB
SHA256 3e7f1211f2650fd0b4d1bbf005d90554c909b647e774b348ca24e9a4674f5bdd
MD5 f398391663753b46aba70cbfbf5467a9
SHA1 01cecfa7322e2cda237380832648a006c0ce27cc
SHA512 e52ef63257cd4ae82c38377889b877eba380f5f7494f57b6a7a98b7306507b43e2101d934dc6a98664886a4476186e7ebbf82be507187921d1dbeefd3cd4b338
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEx:NABY
MD5 SHA1 SHA512 SSDEEP

Submit Download

LQWCntI.exe

Path C:\Windows\System\LQWCntI.exe
Size 2.1MB
SHA256 ec5d19ff562e25d9e53d15a3bc19d327d84aecb22fff10663097d2c75c52a862
MD5 b65b664c257b8df631d08c8d6e5b07d3
SHA1 6bb44603de66339dcddb154c50da0f386aa06292
SHA512 53b3a49b79c19de0ebe303cac05a108002242fe9c8b21dd3df13f01850a2863fab39b94a3807efd3a884a2e8e46435d2603ae2aeab0330f5a4dbca29088e260e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEa:NABr
MD5 SHA1 SHA512 SSDEEP

Submit Download

LUoxmgL.exe

Path C:\Windows\System\LUoxmgL.exe
Size 2.2MB
SHA256 392f4ea75315f3e51f79a9b819d720cc332466b2fe939f92db5069d3ccde40fc
MD5 0d9be099e2cb43622835fb4a50700c3b
SHA1 2e00e7f7a91d182221e422cbb5be36002d7e5c80
SHA512 fc14842350df582b8f36596c9f2a54326d4f75e2e88bf7a92466c305efeef9b8caab16d6c24c7e4e34bf795c8b074840228e78c3740a1d9aebcd7fc82164403c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEG:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

LaBKhzw.exe

Path C:\Windows\System\LaBKhzw.exe
Size 2.1MB
SHA256 72043db43b8b5b4ead934de3df2f1b2a8d077947ff9c23c509e975c0a2d7ef13
MD5 2bc42a7aa6f8323ffb453d7b6e86cb40
SHA1 3ff148d84907698f65a97e1253708ef98d30ecee
SHA512 cb8f05aad7bc519ac2f2190c9be8f8c3cd97459653ac83aad78630ec801182e370dbc79731e8c23089f3c309fa5c51c62a066298a17534f6623ed158c5e131b5
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEU:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

QkVyFyb.exe

Path C:\Windows\System\QkVyFyb.exe
Size 2.1MB
SHA256 129516ef979af121689974a0ec544a0912a799d781c89b361695fae92ebd96a8
MD5 c8bae5bcca1edefe219ac0c460470ad3
SHA1 fc2ba91174c6c0eba0a23eb0e6329300910f0e29
SHA512 5bfa11cbf8fda1bd688bda95ca7ef34f210e921910aeac57aade6f99927e3cd4d1bc2c2e361ccfc95dcc3acb0134bddcf9907bf9e62a1ed31dfb763d942f882a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEq:NABR
MD5 SHA1 SHA512 SSDEEP

Submit Download

RsYOGdF.exe

Path C:\Windows\System\RsYOGdF.exe
Size 2.1MB
SHA256 98930052227f47b91785175314012f13c0b8c58f78f5cd3c7e29c4cac6844c5e
MD5 b794692e3462c843711f64bb17b7f317
SHA1 184e8bf3532ac8e5b706c8dcff6926b66fcb4c2a
SHA512 a95893afa0913eb091bd1c78e3f17ff16949418706632c0e1b3154c53c34640177ba01af3ca0a2981404fb8df25a54ddad9c409288f6439c7e618ad4eb2c28a2
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEX:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SKObWWE.exe

Path C:\Windows\System\SKObWWE.exe
Size 2.1MB
SHA256 0c74f925a530ee200fd650271787f828f4275b4eb2d7798938eb1c2741623e5e
MD5 352d76c8441685c72f42101d3f3661b0
SHA1 6bf810ba2eb0f6d7c6c1927411660a1e3b8f1cfe
SHA512 322538ecdbc7eb88d9221ee30e12dec34a01c68a1f2f930e9a183797a4a06bd4e5323c6eee84f196246a708d8f5f28e21c0b087135014bc99b959d3bc39e325b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEA:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

TVUgmGi.exe

Path C:\Windows\System\TVUgmGi.exe
Size 2.1MB
SHA256 fd7e1154dd5e2b3b785be7629e11aa6e3b1dfe74cd555b71fa74051f400f4e6c
MD5 f48e5894267b2713e576518363d8e2fe
SHA1 41d9ff37221eb46d93b153b05c8d1c80bbcb0a68
SHA512 022a6165e75eba1d88408690341cf50541f3b4623dd38deb3779183787be071e69246e1755eca3842ccc3c93ee4e48169678bb60d0b1bd368234352b428df022
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEJ:NABW
MD5 SHA1 SHA512 SSDEEP

Submit Download

UWrullI.exe

Path C:\Windows\System\UWrullI.exe
Size 2.1MB
SHA256 cc4a37003ac40023dec5a46ff199f1e39570f64d3a317f0b0e5d8c968628ade5
MD5 14d0c6f22b9174d4fe7d0f30829d5bce
SHA1 4fa554284afa01a801c4151f0ae5bdbe0b82c4ea
SHA512 0ff112b1f66815d3bdf42eef9c49737de0b991d080df66f664855eb2d9e8fa493dd1ec94d2cf76fc57f968fef266e25bdeaefa470b6145f3c935b30f6c8d8427
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEh:NABK
MD5 SHA1 SHA512 SSDEEP

Submit Download

VFePrpe.exe

Path C:\Windows\System\VFePrpe.exe
Size 2.1MB
SHA256 f3e6fe42073a3b88ffa301ef4b810883b7fa7ed23741256f247bf973829b2e96
MD5 f7f5a9f4578b009b6a6747c927515d5f
SHA1 88a620002a2ac8373563e633cd5f09ee7121cc2d
SHA512 bd89e7b40aff120e5b0a91529c82ca939f587519a6b746b3b26973362a8297e118a80e86d7d06c5b8e61880106022397b5a8fa7d1825a4e852f2220e557f0298
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEX:NABC
MD5 SHA1 SHA512 SSDEEP

Submit Download

dRthmix.exe

Path C:\Windows\System\dRthmix.exe
Size 2.1MB
SHA256 3d7e5952da69e3297986afcbc9d3c9b5c38372ee6359969bf1c8df17003cab4e
MD5 8a0a27fe86f32029efdde8eebacca4bb
SHA1 98470fc9b8a328abe5ee7374ca70fc70cf6a82ef
SHA512 759ca09751dcdeb800acee26fad250e192751ce827dd15fa9fa0fa066df2365f61bbd62d259153a4cddd2b7554090ede71144a1ce8709cb80e748caafdfc4951
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuE2:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

geEXswD.exe

Path C:\Windows\System\geEXswD.exe
Size 2.2MB
SHA256 6c1fdfe3610d0a0bc28c4f252cf8e9b08fef95fe9fc84ea10e644374c9677e17
MD5 0c815391db7c04a36751ab8edce70194
SHA1 8666615ce464b8c3ba9b966307810130ce2e02c3
SHA512 f5ebc1a88008ff98fe64f82ef77c48d876a56f05549a59e2c6ed2c4462acc16c7b7753117490ebfbeeddbf7c5b811cb80f05a720245a120d435ed72e6b507ba2
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuE8:NABR
MD5 SHA1 SHA512 SSDEEP

Submit Download

glmuLZG.exe

Path C:\Windows\System\glmuLZG.exe
Size 2.2MB
SHA256 514bfe2fa708a1894a5cbe4a3593b9fc0aae8b1c938d57878ffb2434e98e89f5
MD5 a185c07fc102304a92f48ac1d165a3b7
SHA1 36a13e4fa51d78c93c6ec3844313d8a0f3f84b4a
SHA512 9501eb6e3138e33f79d1f6ae1e3755023564b088af9eb17bb10b394d156f2cc6061a138ebd7236c4ad0c33b361d898f5fe2a43fa8a100baf3c589b11fa12a6c5
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEp:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

gxqIXbk.exe

Path C:\Windows\System\gxqIXbk.exe
Size 2.2MB
SHA256 534ea5ef75183c2e4c1b1f3dc15ac3b17c49251e11e82125672c4425eac3ca65
MD5 d650dcfc694c5a1a81f24701139a282a
SHA1 8837206621ab2466cf450eb50196108f413faa0b
SHA512 756e366e9da8ecdc041ec6249640ec646a472c8f3d5f641db661091de217528a391d7cb4435af7be281d180ec4019a3deafaac26ad283af232debb2aab2bd488
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuE6:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jLuZyni.exe

Path C:\Windows\System\jLuZyni.exe
Size 2.1MB
SHA256 811ae3506aea981075514357df1225e1c6d5c4a2d9d5531615922e43743d6b64
MD5 e238f874ee83e3bd91c97aba6e9039f3
SHA1 0eb795273a2b08b21b6571e59bfad02717e4492c
SHA512 eed2788538041ac1809fc3fa304b313b1220d547eea41a9dfd7c8b322f9fffc00d06dfbcac73afdbd1cf14df130f3da41e0269d8ab3934705aaa859a5a5fe32a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEC:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsGJPoJ.exe

Path C:\Windows\System\jsGJPoJ.exe
Size 2.1MB
SHA256 55e3f683b8830549fbf60a0d35c6219b640bce35ae129b733b3f8d5c0cd7a934
MD5 08269aadd5ebe588ad0e794a002f0e2f
SHA1 c6cbd56fb99642a3b64e0904d70e00dd5a3c460b
SHA512 426b516b67a47faf072913a779e8fa71432a04301bce7d847f74c97fad674adaef66d298013b4adf66be6a29f4bff88704835f3b8499193e365423808c815eaf
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEc:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nLlrHaS.exe

Path C:\Windows\System\nLlrHaS.exe
Size 2.1MB
SHA256 958c5e6af4e5611a3ecafb8797c0ac63d0f1313fc4498ddded9c620720752159
MD5 31ae21420325e1671ed16ae9ffcc69af
SHA1 037fa369f7b65e944117a4fdfa1df3cf25602075
SHA512 ad33c0f4ce89b33abfd386fde757ad2467f132148260365243df1a43ee4410b33abf6879f11092ae23d82013534f15dc6862625d401082b019822c93af9fa2cf
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuE1:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

onNIwkp.exe

Path C:\Windows\System\onNIwkp.exe
Size 2.1MB
SHA256 438dafad503dbd966d6c627936031d8aede14f3e4bffc82b1e9c78fec737d1d9
MD5 b5218fb9cd86549aec817148e1037761
SHA1 33bc59a52bbd061a8018be7b9ce847b04b9fe369
SHA512 349585ec497364a3be3293d0b45ce4b713c522f539a1e120b210571182a0a7148b44eebe36e412063d1c2411153dcb5d3480da95235aab1de7baa079a3a9f653
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEi:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

pQBnhmq.exe

Path C:\Windows\System\pQBnhmq.exe
Size 2.2MB
SHA256 2f4b538def7db9f8b3e40c722988a7f476e62d099d81aaa552064433e6967870
MD5 4c310df3728c4fb349486345c27a8270
SHA1 bdae44bb7b0336d7197cd213dc2bb33c0b65b65e
SHA512 5f5546dedb2b4769a2e25e4ef36896d70827e34e3350902fa906b7a7c533fd97cf05ffe81a8950e817b20dcfa06ea664db24761f29a98d36b6d90ce18afeb46d
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEb:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

rYtkDvr.exe

Path C:\Windows\System\rYtkDvr.exe
Size 2.1MB
SHA256 e02ff1c4d199e89ceb32818aea9698a33815824a1b593397e3e7253e3ddefe33
MD5 497adad910ee891d6fa5ae7dbe95d68e
SHA1 a7f46048945a20b8eba55fde33e967817a4eff12
SHA512 e1cc9c1c6dd6dd415912358742eca44049e0c0584a250f109b001913208c9e8878d4cbac71590d95932e576b473aff48de50a2e9ef07ba505a5e813a201f73f1
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEk:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

srKygpS.exe

Path C:\Windows\System\srKygpS.exe
Size 2.1MB
SHA256 a3f60c8cd2681a763055cb8d67adf228049bd820787e7e71437aced67d1a7389
MD5 f2ac7fa1615ed977cf94d939450ecf47
SHA1 c8b20d252b72529ca76ce8f9ec9db0f53740933e
SHA512 375546284a2b58dc460ff039809d7d73b2f926931455d21b38803b7e76de2c08b11bade3a9c8ec0f3d816cf094127f3dc98b3d53201e1763b054c74310603ecf
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuE+:NABj
MD5 SHA1 SHA512 SSDEEP

Submit Download

uoFQlRv.exe

Path C:\Windows\System\uoFQlRv.exe
Size 2.1MB
SHA256 ac6af235905ddff1fe134d20a68708629e7395b1a0226fc054b84c63baeb55c7
MD5 ecc2a3a127eb331a47579b79e3f8e8e5
SHA1 1df44ec58bda603dd22906e8458033b3f287f84e
SHA512 2b641437422268c360e8af8cb605acafd6736479aa4dbe9f33ee8cccd1e61c5a0e65e7d2f9f80c6100ab4be0b81d4109468dffa60fa75be0a22ef2f2f0abfabc
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEE:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsVwhZx.exe

Path C:\Windows\System\wsVwhZx.exe
Size 2.1MB
SHA256 8acfeeb9da4f9e82c16fbf361a1f1a7b3a4cde3fd02c6cc849c86ef490994dcf
MD5 2a053814b09ca96e15bf80ddcf7f5aed
SHA1 fb31340a8d9934bdae18f7acda53887ebc8f01c7
SHA512 f240e1f647532bf328ace40a17920be01e8bbcf793539706c8b1f714a034ea82666fedcbeeba0854e3862006e6412a6cbb930aa972fdb9fde443bc1209c0870c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEm:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

xqNueVZ.exe

Path C:\Windows\System\xqNueVZ.exe
Size 2.1MB
SHA256 df49deee4352864452266d53d2059c182270ff5d765f3a7704036ff4edf59fc3
MD5 65922a62c847cee255a83421f6154ecc
SHA1 b1355204b53009e6653df7c1e9767a73018ffc01
SHA512 edacb46d4b4a32d8eca024e3ab1d58b648567a0f44adc3760b0e86bd5f849fe80481d9798328ac30041fae3b76c16560ad584559f03167494bc11a6d88ab1995
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuE1:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

yHJffaT.exe

Path C:\Windows\System\yHJffaT.exe
Size 2.1MB
SHA256 7c835d2aa950057e47ebc8d34295ceb8ef46d842f32f9d7a8935fcaf03d371b8
MD5 b5e808ced48383d3205aec46d66d422b
SHA1 3a6de0055ce34096d9c4d3bdcde112847bddb4a0
SHA512 541fd471ba1e03f1a75d7924333f4ea81107a6ba326e0b3365ba33138dbe2bedbdcee831c65be360df35466b7cc5d4e4167352d269f594627da2f61aa80667ce
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuE2:NABX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ycDwHFp.exe

Path C:\Windows\System\ycDwHFp.exe
Size 2.1MB
SHA256 6b15f4b589c8b18a9af9377491034bb2d128db0c76a1c1051fb0b52cfd6df4cc
MD5 4dfff04e920860b8ac0123b6274ffdc8
SHA1 5fd20d45a579a69d6588d1b24f57e8ca8eb0be68
SHA512 c75a4932f613364bfe46437848584f5e3d702b23b5232894f9c919e2b129400cac904ccf8af639754adad1246abacfd5b714d24d708ebf1ab9381f3a839beac3
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuEn:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ydKZEUK.exe

Path C:\Windows\System\ydKZEUK.exe
Size 2.1MB
SHA256 bc2c7f0186ccecfa31b5901b2e1814383594b0a98b2b8113a546219684788f04
MD5 1ba5acd2e713ca1d2b0cf1b3cd3a00f0
SHA1 3fc8789efd5819fc8d3868255e080cc17302815f
SHA512 b0339baf28fc9ac7a310ff58f15b13b42b8eb09b12f772be8c3db33a2a5287074dd6536996300c9b425c20aaad269717a09f98f7a380cf8bb92cacda9ebe45f6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrPuE/:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-2357-0x00007FF726FD0000-0x00007FF7273C2000-memory.dmp

Download

memory/228-129-0x00007FF726FD0000-0x00007FF7273C2000-memory.dmp

Download

memory/372-58-0x00007FF7BFA80000-0x00007FF7BFE72000-memory.dmp

Download

memory/372-2333-0x00007FF7BFA80000-0x00007FF7BFE72000-memory.dmp

Download

memory/404-2359-0x00007FF73DB80000-0x00007FF73DF72000-memory.dmp

Download

memory/404-128-0x00007FF73DB80000-0x00007FF73DF72000-memory.dmp

Download

memory/404-2294-0x00007FF73DB80000-0x00007FF73DF72000-memory.dmp

Download

memory/408-78-0x00007FF775AD0000-0x00007FF775EC2000-memory.dmp

Download

memory/408-2340-0x00007FF775AD0000-0x00007FF775EC2000-memory.dmp

Download

memory/808-94-0x00007FF692AC0000-0x00007FF692EB2000-memory.dmp

Download

memory/808-2337-0x00007FF692AC0000-0x00007FF692EB2000-memory.dmp

Download

memory/872-102-0x0000026A78F00000-0x0000026A796A6000-memory.dmp

Download

memory/872-37-0x0000026A783B0000-0x0000026A783D2000-memory.dmp

Download

memory/872-51-0x00007FFFFD8A0000-0x00007FFFFE361000-memory.dmp

Download

memory/872-5-0x00007FFFFD8A3000-0x00007FFFFD8A5000-memory.dmp

Download

memory/872-1661-0x00007FFFFD8A0000-0x00007FFFFE361000-memory.dmp

Download

memory/872-2022-0x00007FFFFD8A3000-0x00007FFFFD8A5000-memory.dmp

Download

memory/872-19-0x00007FFFFD8A0000-0x00007FFFFE361000-memory.dmp

Download

memory/872-2024-0x00007FFFFD8A0000-0x00007FFFFE361000-memory.dmp

Download

memory/1064-154-0x00007FF7DB900000-0x00007FF7DBCF2000-memory.dmp

Download

memory/1064-2313-0x00007FF7DB900000-0x00007FF7DBCF2000-memory.dmp

Download

memory/1064-2401-0x00007FF7DB900000-0x00007FF7DBCF2000-memory.dmp

Download

memory/1280-1110-0x00007FF7AA5A0000-0x00007FF7AA992000-memory.dmp

Download

memory/1280-0-0x00007FF7AA5A0000-0x00007FF7AA992000-memory.dmp

Download

memory/1280-1-0x000001631F2E0000-0x000001631F2F0000-memory.dmp

Download

memory/1424-95-0x00007FF7B6AB0000-0x00007FF7B6EA2000-memory.dmp

Download

memory/1424-2344-0x00007FF7B6AB0000-0x00007FF7B6EA2000-memory.dmp

Download

memory/1604-151-0x00007FF6EB0A0000-0x00007FF6EB492000-memory.dmp

Download

memory/1604-2399-0x00007FF6EB0A0000-0x00007FF6EB492000-memory.dmp

Download

memory/1604-2316-0x00007FF6EB0A0000-0x00007FF6EB492000-memory.dmp

Download

memory/2896-2335-0x00007FF6668D0000-0x00007FF666CC2000-memory.dmp

Download

memory/2896-71-0x00007FF6668D0000-0x00007FF666CC2000-memory.dmp

Download

memory/3124-2331-0x00007FF7D4460000-0x00007FF7D4852000-memory.dmp

Download

memory/3124-41-0x00007FF7D4460000-0x00007FF7D4852000-memory.dmp

Download

memory/3168-35-0x00007FF6A8060000-0x00007FF6A8452000-memory.dmp

Download

memory/3168-2327-0x00007FF6A8060000-0x00007FF6A8452000-memory.dmp

Download

memory/3432-2347-0x00007FF735830000-0x00007FF735C22000-memory.dmp

Download

memory/3432-96-0x00007FF735830000-0x00007FF735C22000-memory.dmp

Download

memory/3536-2279-0x00007FF68FF30000-0x00007FF690322000-memory.dmp

Download

memory/3536-110-0x00007FF68FF30000-0x00007FF690322000-memory.dmp

Download

memory/3536-2355-0x00007FF68FF30000-0x00007FF690322000-memory.dmp

Download

memory/3736-36-0x00007FF662080000-0x00007FF662472000-memory.dmp

Download

memory/3736-2329-0x00007FF662080000-0x00007FF662472000-memory.dmp

Download

memory/3872-2309-0x00007FF7C2000000-0x00007FF7C23F2000-memory.dmp

Download

memory/3872-2363-0x00007FF7C2000000-0x00007FF7C23F2000-memory.dmp

Download

memory/3872-132-0x00007FF7C2000000-0x00007FF7C23F2000-memory.dmp

Download

memory/4060-99-0x00007FF63D480000-0x00007FF63D872000-memory.dmp

Download

memory/4060-2352-0x00007FF63D480000-0x00007FF63D872000-memory.dmp

Download

memory/4064-87-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp

Download

memory/4064-2042-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp

Download

memory/4064-2350-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp

Download

memory/4136-91-0x00007FF7C7010000-0x00007FF7C7402000-memory.dmp

Download

memory/4136-2353-0x00007FF7C7010000-0x00007FF7C7402000-memory.dmp

Download

memory/4136-2043-0x00007FF7C7010000-0x00007FF7C7402000-memory.dmp

Download

memory/4608-113-0x00007FF678460000-0x00007FF678852000-memory.dmp

Download

memory/4608-2280-0x00007FF678460000-0x00007FF678852000-memory.dmp

Download

memory/4608-2361-0x00007FF678460000-0x00007FF678852000-memory.dmp

Download

memory/4692-2312-0x00007FF641960000-0x00007FF641D52000-memory.dmp

Download

memory/4692-2365-0x00007FF641960000-0x00007FF641D52000-memory.dmp

Download

memory/4692-143-0x00007FF641960000-0x00007FF641D52000-memory.dmp

Download

memory/4816-2318-0x00007FF645880000-0x00007FF645C72000-memory.dmp

Download

memory/4816-2404-0x00007FF645880000-0x00007FF645C72000-memory.dmp

Download

memory/4816-168-0x00007FF645880000-0x00007FF645C72000-memory.dmp

Download

memory/4856-2403-0x00007FF62B9D0000-0x00007FF62BDC2000-memory.dmp

Download

memory/4856-2317-0x00007FF62B9D0000-0x00007FF62BDC2000-memory.dmp

Download

memory/4856-161-0x00007FF62B9D0000-0x00007FF62BDC2000-memory.dmp

Download

memory/4956-2341-0x00007FF6DAFF0000-0x00007FF6DB3E2000-memory.dmp

Download

memory/4956-92-0x00007FF6DAFF0000-0x00007FF6DB3E2000-memory.dmp

Download

memory/5064-86-0x00007FF75D470000-0x00007FF75D862000-memory.dmp

Download

memory/5064-2041-0x00007FF75D470000-0x00007FF75D862000-memory.dmp

Download

memory/5064-2346-0x00007FF75D470000-0x00007FF75D862000-memory.dmp

Download