xmrig | 4e4ec006a90c5afb3dc949f6e21b083d1102ef2f321a53b1cc3f302b1c6c4998

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
Size

2.1MB
MD5

da05225b8c59f8e539912c0e0f329c21
SHA1

91da96c414dfd5285e8a5caa44b843e651b24a31
SHA256

4e4ec006a90c5afb3dc949f6e21b083d1102ef2f321a53b1cc3f302b1c6c4998
SHA512

35987d1a8c93e13fa9283f28913c1ad8141a44a915663928d9da6630ee295ad90f40ee93231da76efa6f578ef9867fd66fefa52dd55dcef085efaa4ea224d214
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMNF:NABX

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2144-71-0x00007FF7A9500000-0x00007FF7A98F2000-memory.dmp	xmrig
behavioral2/memory/776-102-0x00007FF73C230000-0x00007FF73C622000-memory.dmp	xmrig
behavioral2/memory/4192-152-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp	xmrig
behavioral2/memory/376-177-0x00007FF7C72C0000-0x00007FF7C76B2000-memory.dmp	xmrig
behavioral2/memory/4560-171-0x00007FF7DEE70000-0x00007FF7DF262000-memory.dmp	xmrig
behavioral2/memory/4764-165-0x00007FF7F1A50000-0x00007FF7F1E42000-memory.dmp	xmrig
behavioral2/memory/2720-159-0x00007FF670780000-0x00007FF670B72000-memory.dmp	xmrig
behavioral2/memory/2176-158-0x00007FF607290000-0x00007FF607682000-memory.dmp	xmrig
behavioral2/memory/2072-146-0x00007FF744980000-0x00007FF744D72000-memory.dmp	xmrig
behavioral2/memory/400-140-0x00007FF63B490000-0x00007FF63B882000-memory.dmp	xmrig
behavioral2/memory/1928-134-0x00007FF73FAC0000-0x00007FF73FEB2000-memory.dmp	xmrig
behavioral2/memory/1484-133-0x00007FF77C020000-0x00007FF77C412000-memory.dmp	xmrig
behavioral2/memory/2240-127-0x00007FF60CD10000-0x00007FF60D102000-memory.dmp	xmrig
behavioral2/memory/1532-121-0x00007FF7D8490000-0x00007FF7D8882000-memory.dmp	xmrig
behavioral2/memory/2584-115-0x00007FF6F0FD0000-0x00007FF6F13C2000-memory.dmp	xmrig
behavioral2/memory/920-111-0x00007FF678CB0000-0x00007FF6790A2000-memory.dmp	xmrig
behavioral2/memory/996-103-0x00007FF620630000-0x00007FF620A22000-memory.dmp	xmrig
behavioral2/memory/1428-98-0x00007FF712240000-0x00007FF712632000-memory.dmp	xmrig
behavioral2/memory/3284-90-0x00007FF733760000-0x00007FF733B52000-memory.dmp	xmrig
behavioral2/memory/2908-84-0x00007FF7C2F10000-0x00007FF7C3302000-memory.dmp	xmrig
behavioral2/memory/4820-83-0x00007FF7C2860000-0x00007FF7C2C52000-memory.dmp	xmrig
behavioral2/memory/4188-78-0x00007FF797D60000-0x00007FF798152000-memory.dmp	xmrig
behavioral2/memory/3252-66-0x00007FF685DC0000-0x00007FF6861B2000-memory.dmp	xmrig
behavioral2/memory/4672-57-0x00007FF726720000-0x00007FF726B12000-memory.dmp	xmrig
behavioral2/memory/2232-1093-0x00007FF718FB0000-0x00007FF7193A2000-memory.dmp	xmrig
behavioral2/memory/996-2445-0x00007FF620630000-0x00007FF620A22000-memory.dmp	xmrig
behavioral2/memory/4672-2447-0x00007FF726720000-0x00007FF726B12000-memory.dmp	xmrig
behavioral2/memory/2144-2465-0x00007FF7A9500000-0x00007FF7A98F2000-memory.dmp	xmrig
behavioral2/memory/3252-2467-0x00007FF685DC0000-0x00007FF6861B2000-memory.dmp	xmrig
behavioral2/memory/4188-2470-0x00007FF797D60000-0x00007FF798152000-memory.dmp	xmrig
behavioral2/memory/2908-2471-0x00007FF7C2F10000-0x00007FF7C3302000-memory.dmp	xmrig
behavioral2/memory/4820-2475-0x00007FF7C2860000-0x00007FF7C2C52000-memory.dmp	xmrig
behavioral2/memory/3284-2474-0x00007FF733760000-0x00007FF733B52000-memory.dmp	xmrig
behavioral2/memory/2584-2477-0x00007FF6F0FD0000-0x00007FF6F13C2000-memory.dmp	xmrig
behavioral2/memory/1428-2488-0x00007FF712240000-0x00007FF712632000-memory.dmp	xmrig
behavioral2/memory/776-2510-0x00007FF73C230000-0x00007FF73C622000-memory.dmp	xmrig
behavioral2/memory/2072-2513-0x00007FF744980000-0x00007FF744D72000-memory.dmp	xmrig
behavioral2/memory/400-2515-0x00007FF63B490000-0x00007FF63B882000-memory.dmp	xmrig
behavioral2/memory/4192-2517-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp	xmrig
behavioral2/memory/920-2511-0x00007FF678CB0000-0x00007FF6790A2000-memory.dmp	xmrig
behavioral2/memory/1532-2508-0x00007FF7D8490000-0x00007FF7D8882000-memory.dmp	xmrig
behavioral2/memory/2240-2506-0x00007FF60CD10000-0x00007FF60D102000-memory.dmp	xmrig
behavioral2/memory/1928-2500-0x00007FF73FAC0000-0x00007FF73FEB2000-memory.dmp	xmrig
behavioral2/memory/1484-2504-0x00007FF77C020000-0x00007FF77C412000-memory.dmp	xmrig
behavioral2/memory/4764-2560-0x00007FF7F1A50000-0x00007FF7F1E42000-memory.dmp	xmrig
behavioral2/memory/2176-2544-0x00007FF607290000-0x00007FF607682000-memory.dmp	xmrig
behavioral2/memory/2720-2542-0x00007FF670780000-0x00007FF670B72000-memory.dmp	xmrig
behavioral2/memory/376-2540-0x00007FF7C72C0000-0x00007FF7C76B2000-memory.dmp	xmrig
behavioral2/memory/4560-2538-0x00007FF7DEE70000-0x00007FF7DF262000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	1140	powershell.exe
10	1140	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1140	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
996	LNOqiEb.exe
4672	hBZCBTo.exe
3252	KFRFVLI.exe
2144	oexmxmn.exe
4188	JdxJarX.exe
920	nOCUSIp.exe
4820	kNRJEgl.exe
2908	IGyNQNs.exe
3284	KEQJTgy.exe
2584	ANzvHBc.exe
1428	xoqeung.exe
1532	kmcWaiC.exe
776	clfQsUG.exe
2240	hjwLeFI.exe
1484	PtISHWa.exe
1928	UcWLlDo.exe
2072	BbyzNjy.exe
400	AJuqTpc.exe
4192	HiAQcbX.exe
2176	IUGEijL.exe
2720	DqCfkov.exe
4764	QOmisdy.exe
4560	pGTbCDg.exe
376	dUmvQTW.exe
3068	SpAqLMV.exe
220	ktANVWu.exe
3672	dVUVdLZ.exe
1924	OSdXBMm.exe
1076	UcQvLLd.exe
1680	bGpupBD.exe
3040	eJufleO.exe
4920	fOSPtSh.exe
4148	qqgsajf.exe
2708	ZelATjD.exe
2120	VkEBtzP.exe
4596	GfcifOZ.exe
1312	FEqcroi.exe
1932	bjAHoHo.exe
2732	YzPSNHw.exe
2156	pcyeglx.exe
2024	LxdHHJG.exe
4980	jsjYyYH.exe
1756	udKQSRE.exe
3628	fEicitV.exe
3400	oTgMtjQ.exe
1948	vvfATXv.exe
1276	IReqRus.exe
1328	rJMimuH.exe
944	rSZkWMb.exe
2984	osXaKzf.exe
3044	HkBgTXK.exe
628	WtTJdHk.exe
432	yIMpXRN.exe
868	fqNBfeO.exe
1404	iMCCZPA.exe
4136	uwHiaqn.exe
5108	pBcRuEh.exe
2912	WTUpcgz.exe
4588	BpjRZJH.exe
2056	KyDxIKw.exe
372	lsKhppq.exe
2740	BGyJzsX.exe
1884	GMtiQkZ.exe
4928	yHsuDhb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2232-0-0x00007FF718FB0000-0x00007FF7193A2000-memory.dmp	upx
behavioral2/files/0x00090000000234ca-6.dat	upx
behavioral2/files/0x00070000000234d2-9.dat	upx
behavioral2/files/0x00080000000234d5-31.dat	upx
behavioral2/files/0x00070000000234d6-38.dat	upx
behavioral2/files/0x00070000000234d9-51.dat	upx
behavioral2/files/0x00080000000234d4-53.dat	upx
behavioral2/files/0x00070000000234da-64.dat	upx
behavioral2/memory/2144-71-0x00007FF7A9500000-0x00007FF7A98F2000-memory.dmp	upx
behavioral2/files/0x00070000000234db-81.dat	upx
behavioral2/files/0x00070000000234de-91.dat	upx
behavioral2/files/0x00070000000234dc-93.dat	upx
behavioral2/memory/776-102-0x00007FF73C230000-0x00007FF73C622000-memory.dmp	upx
behavioral2/files/0x00070000000234e3-135.dat	upx
behavioral2/memory/4192-152-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp	upx
behavioral2/files/0x00070000000234e9-172.dat	upx
behavioral2/files/0x00070000000234ec-188.dat	upx
behavioral2/files/0x00070000000234f0-200.dat	upx
behavioral2/files/0x00070000000234ee-198.dat	upx
behavioral2/files/0x00070000000234ef-195.dat	upx
behavioral2/files/0x00070000000234ed-193.dat	upx
behavioral2/files/0x00070000000234eb-183.dat	upx
behavioral2/files/0x00070000000234ea-178.dat	upx
behavioral2/memory/376-177-0x00007FF7C72C0000-0x00007FF7C76B2000-memory.dmp	upx
behavioral2/memory/4560-171-0x00007FF7DEE70000-0x00007FF7DF262000-memory.dmp	upx
behavioral2/files/0x00070000000234e8-166.dat	upx
behavioral2/memory/4764-165-0x00007FF7F1A50000-0x00007FF7F1E42000-memory.dmp	upx
behavioral2/files/0x00070000000234e7-160.dat	upx
behavioral2/memory/2720-159-0x00007FF670780000-0x00007FF670B72000-memory.dmp	upx
behavioral2/memory/2176-158-0x00007FF607290000-0x00007FF607682000-memory.dmp	upx
behavioral2/files/0x00070000000234e6-153.dat	upx
behavioral2/files/0x00070000000234e5-147.dat	upx
behavioral2/memory/2072-146-0x00007FF744980000-0x00007FF744D72000-memory.dmp	upx
behavioral2/files/0x00070000000234e4-141.dat	upx
behavioral2/memory/400-140-0x00007FF63B490000-0x00007FF63B882000-memory.dmp	upx
behavioral2/memory/1928-134-0x00007FF73FAC0000-0x00007FF73FEB2000-memory.dmp	upx
behavioral2/memory/1484-133-0x00007FF77C020000-0x00007FF77C412000-memory.dmp	upx
behavioral2/files/0x00070000000234e2-128.dat	upx
behavioral2/memory/2240-127-0x00007FF60CD10000-0x00007FF60D102000-memory.dmp	upx
behavioral2/files/0x00070000000234e1-122.dat	upx
behavioral2/memory/1532-121-0x00007FF7D8490000-0x00007FF7D8882000-memory.dmp	upx
behavioral2/files/0x00070000000234e0-116.dat	upx
behavioral2/memory/2584-115-0x00007FF6F0FD0000-0x00007FF6F13C2000-memory.dmp	upx
behavioral2/memory/920-111-0x00007FF678CB0000-0x00007FF6790A2000-memory.dmp	upx
behavioral2/files/0x00090000000234cb-107.dat	upx
behavioral2/files/0x00070000000234df-105.dat	upx
behavioral2/memory/996-103-0x00007FF620630000-0x00007FF620A22000-memory.dmp	upx
behavioral2/memory/1428-98-0x00007FF712240000-0x00007FF712632000-memory.dmp	upx
behavioral2/memory/3284-90-0x00007FF733760000-0x00007FF733B52000-memory.dmp	upx
behavioral2/memory/2908-84-0x00007FF7C2F10000-0x00007FF7C3302000-memory.dmp	upx
behavioral2/memory/4820-83-0x00007FF7C2860000-0x00007FF7C2C52000-memory.dmp	upx
behavioral2/files/0x00070000000234dd-88.dat	upx
behavioral2/memory/4188-78-0x00007FF797D60000-0x00007FF798152000-memory.dmp	upx
behavioral2/memory/3252-66-0x00007FF685DC0000-0x00007FF6861B2000-memory.dmp	upx
behavioral2/files/0x00070000000234d7-68.dat	upx
behavioral2/files/0x00070000000234d8-58.dat	upx
behavioral2/memory/4672-57-0x00007FF726720000-0x00007FF726B12000-memory.dmp	upx
behavioral2/files/0x00070000000234d3-32.dat	upx
behavioral2/memory/2232-1093-0x00007FF718FB0000-0x00007FF7193A2000-memory.dmp	upx
behavioral2/memory/996-2445-0x00007FF620630000-0x00007FF620A22000-memory.dmp	upx
behavioral2/memory/4672-2447-0x00007FF726720000-0x00007FF726B12000-memory.dmp	upx
behavioral2/memory/2144-2465-0x00007FF7A9500000-0x00007FF7A98F2000-memory.dmp	upx
behavioral2/memory/3252-2467-0x00007FF685DC0000-0x00007FF6861B2000-memory.dmp	upx
behavioral2/memory/4188-2470-0x00007FF797D60000-0x00007FF798152000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MnIOzRl.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\QSxDqOy.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\dERyoyQ.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\KbyFgkB.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\VswkZPa.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\ygOPmdT.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\ANzvHBc.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\uNMOAdI.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\etZnlvA.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\QlvWZIm.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\gHKyrhA.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\XWEhAJX.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\ecEheNa.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\wdpSJFo.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\kDbgRmU.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\tSMWKrH.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\SebWaLz.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\gHFUAtD.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\jTItTly.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\oTlUTmI.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\jblUepy.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\PTkZvmU.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\Ljsnciz.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\CgPwyjW.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\pcyeglx.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\OnJisXC.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\WGeRKUV.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\LLgKwSn.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\SsyTvMm.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\RTuIxwN.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\hUjeWha.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\krspEvG.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\KhYyndB.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\dhYfuAE.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\CEfiJHo.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\SnNtgdP.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\spnbwVn.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\BmskrPw.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\kRAHeIu.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\mUzwDsz.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\SPiviEZ.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\otyoCig.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\WfcLcDO.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\nSEAQuk.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\vQgjkBI.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\ZKsrOYU.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\RERaJWy.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\nRFvoyV.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\alNJhAs.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\SJOmGkd.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\rEffKqh.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\teQLrnP.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\aDWxDuZ.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\XhZgIcF.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\UqNDPBX.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\byYljhu.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\MqAlSKP.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\McNKmap.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\ZYCDjMg.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\DqCfkov.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\VkEBtzP.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\HkBgTXK.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\FjetxbP.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
File created	C:\Windows\System\LmFhwPm.exe	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1140	powershell.exe
1140	powershell.exe
1140	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
Token: SeDebugPrivilege	1140	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1140	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	83
PID 2232 wrote to memory of 1140	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	83
PID 2232 wrote to memory of 996	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	85
PID 2232 wrote to memory of 996	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	85
PID 2232 wrote to memory of 4672	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	86
PID 2232 wrote to memory of 4672	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	86
PID 2232 wrote to memory of 3252	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	87
PID 2232 wrote to memory of 3252	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	87
PID 2232 wrote to memory of 2144	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	88
PID 2232 wrote to memory of 2144	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	88
PID 2232 wrote to memory of 4188	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	89
PID 2232 wrote to memory of 4188	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	89
PID 2232 wrote to memory of 920	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	90
PID 2232 wrote to memory of 920	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	90
PID 2232 wrote to memory of 4820	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	91
PID 2232 wrote to memory of 4820	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	91
PID 2232 wrote to memory of 2908	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	92
PID 2232 wrote to memory of 2908	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	92
PID 2232 wrote to memory of 3284	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	93
PID 2232 wrote to memory of 3284	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	93
PID 2232 wrote to memory of 2584	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	94
PID 2232 wrote to memory of 2584	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	94
PID 2232 wrote to memory of 1428	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	95
PID 2232 wrote to memory of 1428	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	95
PID 2232 wrote to memory of 1532	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	96
PID 2232 wrote to memory of 1532	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	96
PID 2232 wrote to memory of 776	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	97
PID 2232 wrote to memory of 776	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	97
PID 2232 wrote to memory of 2240	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	98
PID 2232 wrote to memory of 2240	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	98
PID 2232 wrote to memory of 1484	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	99
PID 2232 wrote to memory of 1484	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	99
PID 2232 wrote to memory of 1928	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	100
PID 2232 wrote to memory of 1928	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	100
PID 2232 wrote to memory of 2072	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	101
PID 2232 wrote to memory of 2072	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	101
PID 2232 wrote to memory of 400	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	102
PID 2232 wrote to memory of 400	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	102
PID 2232 wrote to memory of 4192	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	103
PID 2232 wrote to memory of 4192	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	103
PID 2232 wrote to memory of 2176	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	104
PID 2232 wrote to memory of 2176	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	104
PID 2232 wrote to memory of 2720	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	105
PID 2232 wrote to memory of 2720	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	105
PID 2232 wrote to memory of 4764	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	106
PID 2232 wrote to memory of 4764	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	106
PID 2232 wrote to memory of 4560	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	107
PID 2232 wrote to memory of 4560	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	107
PID 2232 wrote to memory of 376	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	108
PID 2232 wrote to memory of 376	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	108
PID 2232 wrote to memory of 3068	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	109
PID 2232 wrote to memory of 3068	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	109
PID 2232 wrote to memory of 220	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	110
PID 2232 wrote to memory of 220	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	110
PID 2232 wrote to memory of 3672	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	111
PID 2232 wrote to memory of 3672	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	111
PID 2232 wrote to memory of 1924	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	112
PID 2232 wrote to memory of 1924	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	112
PID 2232 wrote to memory of 1076	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	113
PID 2232 wrote to memory of 1076	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	113
PID 2232 wrote to memory of 1680	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	114
PID 2232 wrote to memory of 1680	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	114
PID 2232 wrote to memory of 3040	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	115
PID 2232 wrote to memory of 3040	2232	da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\da05225b8c59f8e539912c0e0f329c21_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1140" "2980" "2892" "2984" "0" "0" "2988" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13488
- C:\Windows\System\LNOqiEb.exe
  C:\Windows\System\LNOqiEb.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\hBZCBTo.exe
  C:\Windows\System\hBZCBTo.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\KFRFVLI.exe
  C:\Windows\System\KFRFVLI.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\oexmxmn.exe
  C:\Windows\System\oexmxmn.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\JdxJarX.exe
  C:\Windows\System\JdxJarX.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\nOCUSIp.exe
  C:\Windows\System\nOCUSIp.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\kNRJEgl.exe
  C:\Windows\System\kNRJEgl.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\IGyNQNs.exe
  C:\Windows\System\IGyNQNs.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\KEQJTgy.exe
  C:\Windows\System\KEQJTgy.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\ANzvHBc.exe
  C:\Windows\System\ANzvHBc.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\xoqeung.exe
  C:\Windows\System\xoqeung.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\kmcWaiC.exe
  C:\Windows\System\kmcWaiC.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\clfQsUG.exe
  C:\Windows\System\clfQsUG.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\hjwLeFI.exe
  C:\Windows\System\hjwLeFI.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\PtISHWa.exe
  C:\Windows\System\PtISHWa.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\UcWLlDo.exe
  C:\Windows\System\UcWLlDo.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\BbyzNjy.exe
  C:\Windows\System\BbyzNjy.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\AJuqTpc.exe
  C:\Windows\System\AJuqTpc.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\HiAQcbX.exe
  C:\Windows\System\HiAQcbX.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\IUGEijL.exe
  C:\Windows\System\IUGEijL.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\DqCfkov.exe
  C:\Windows\System\DqCfkov.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\QOmisdy.exe
  C:\Windows\System\QOmisdy.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\pGTbCDg.exe
  C:\Windows\System\pGTbCDg.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\dUmvQTW.exe
  C:\Windows\System\dUmvQTW.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\SpAqLMV.exe
  C:\Windows\System\SpAqLMV.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\ktANVWu.exe
  C:\Windows\System\ktANVWu.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\dVUVdLZ.exe
  C:\Windows\System\dVUVdLZ.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\OSdXBMm.exe
  C:\Windows\System\OSdXBMm.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\UcQvLLd.exe
  C:\Windows\System\UcQvLLd.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\bGpupBD.exe
  C:\Windows\System\bGpupBD.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\eJufleO.exe
  C:\Windows\System\eJufleO.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\fOSPtSh.exe
  C:\Windows\System\fOSPtSh.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\qqgsajf.exe
  C:\Windows\System\qqgsajf.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\ZelATjD.exe
  C:\Windows\System\ZelATjD.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\VkEBtzP.exe
  C:\Windows\System\VkEBtzP.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\GfcifOZ.exe
  C:\Windows\System\GfcifOZ.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\FEqcroi.exe
  C:\Windows\System\FEqcroi.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\bjAHoHo.exe
  C:\Windows\System\bjAHoHo.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\YzPSNHw.exe
  C:\Windows\System\YzPSNHw.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\pcyeglx.exe
  C:\Windows\System\pcyeglx.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\LxdHHJG.exe
  C:\Windows\System\LxdHHJG.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\jsjYyYH.exe
  C:\Windows\System\jsjYyYH.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\udKQSRE.exe
  C:\Windows\System\udKQSRE.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\fEicitV.exe
  C:\Windows\System\fEicitV.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\oTgMtjQ.exe
  C:\Windows\System\oTgMtjQ.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\vvfATXv.exe
  C:\Windows\System\vvfATXv.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\IReqRus.exe
  C:\Windows\System\IReqRus.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\rJMimuH.exe
  C:\Windows\System\rJMimuH.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\rSZkWMb.exe
  C:\Windows\System\rSZkWMb.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\osXaKzf.exe
  C:\Windows\System\osXaKzf.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\HkBgTXK.exe
  C:\Windows\System\HkBgTXK.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\WtTJdHk.exe
  C:\Windows\System\WtTJdHk.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\yIMpXRN.exe
  C:\Windows\System\yIMpXRN.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\fqNBfeO.exe
  C:\Windows\System\fqNBfeO.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\iMCCZPA.exe
  C:\Windows\System\iMCCZPA.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\uwHiaqn.exe
  C:\Windows\System\uwHiaqn.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\pBcRuEh.exe
  C:\Windows\System\pBcRuEh.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\WTUpcgz.exe
  C:\Windows\System\WTUpcgz.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\BpjRZJH.exe
  C:\Windows\System\BpjRZJH.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\KyDxIKw.exe
  C:\Windows\System\KyDxIKw.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\lsKhppq.exe
  C:\Windows\System\lsKhppq.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\BGyJzsX.exe
  C:\Windows\System\BGyJzsX.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\GMtiQkZ.exe
  C:\Windows\System\GMtiQkZ.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\yHsuDhb.exe
  C:\Windows\System\yHsuDhb.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\QUWeVjW.exe
  C:\Windows\System\QUWeVjW.exe
  2⤵
  PID:64
- C:\Windows\System\HwvTxxL.exe
  C:\Windows\System\HwvTxxL.exe
  2⤵
  PID:4892
- C:\Windows\System\eMVWJtD.exe
  C:\Windows\System\eMVWJtD.exe
  2⤵
  PID:2384
- C:\Windows\System\vSHbvYC.exe
  C:\Windows\System\vSHbvYC.exe
  2⤵
  PID:4544
- C:\Windows\System\VDxfQqJ.exe
  C:\Windows\System\VDxfQqJ.exe
  2⤵
  PID:3104
- C:\Windows\System\CuVXMDN.exe
  C:\Windows\System\CuVXMDN.exe
  2⤵
  PID:640
- C:\Windows\System\PhHjLAB.exe
  C:\Windows\System\PhHjLAB.exe
  2⤵
  PID:4540
- C:\Windows\System\xxSOihB.exe
  C:\Windows\System\xxSOihB.exe
  2⤵
  PID:3564
- C:\Windows\System\VNifuBf.exe
  C:\Windows\System\VNifuBf.exe
  2⤵
  PID:4668
- C:\Windows\System\ZyjMrCv.exe
  C:\Windows\System\ZyjMrCv.exe
  2⤵
  PID:3300
- C:\Windows\System\IbDBSsX.exe
  C:\Windows\System\IbDBSsX.exe
  2⤵
  PID:1868
- C:\Windows\System\QyoJDwy.exe
  C:\Windows\System\QyoJDwy.exe
  2⤵
  PID:4332
- C:\Windows\System\CqzOaxu.exe
  C:\Windows\System\CqzOaxu.exe
  2⤵
  PID:5124
- C:\Windows\System\ltXrbUB.exe
  C:\Windows\System\ltXrbUB.exe
  2⤵
  PID:5152
- C:\Windows\System\ChSsDqi.exe
  C:\Windows\System\ChSsDqi.exe
  2⤵
  PID:5180
- C:\Windows\System\GgufdZj.exe
  C:\Windows\System\GgufdZj.exe
  2⤵
  PID:5208
- C:\Windows\System\SMOwopR.exe
  C:\Windows\System\SMOwopR.exe
  2⤵
  PID:5236
- C:\Windows\System\lfYxMuk.exe
  C:\Windows\System\lfYxMuk.exe
  2⤵
  PID:5264
- C:\Windows\System\IaieonF.exe
  C:\Windows\System\IaieonF.exe
  2⤵
  PID:5292
- C:\Windows\System\FlCABfQ.exe
  C:\Windows\System\FlCABfQ.exe
  2⤵
  PID:5316
- C:\Windows\System\xZxiHxI.exe
  C:\Windows\System\xZxiHxI.exe
  2⤵
  PID:5348
- C:\Windows\System\cFxqOee.exe
  C:\Windows\System\cFxqOee.exe
  2⤵
  PID:5376
- C:\Windows\System\WVCnGTV.exe
  C:\Windows\System\WVCnGTV.exe
  2⤵
  PID:5404
- C:\Windows\System\FiGuUOF.exe
  C:\Windows\System\FiGuUOF.exe
  2⤵
  PID:5432
- C:\Windows\System\TSPPuJj.exe
  C:\Windows\System\TSPPuJj.exe
  2⤵
  PID:5460
- C:\Windows\System\xiluYrI.exe
  C:\Windows\System\xiluYrI.exe
  2⤵
  PID:5488
- C:\Windows\System\MslHHOL.exe
  C:\Windows\System\MslHHOL.exe
  2⤵
  PID:5516
- C:\Windows\System\YJihKSO.exe
  C:\Windows\System\YJihKSO.exe
  2⤵
  PID:5544
- C:\Windows\System\xUDvyUn.exe
  C:\Windows\System\xUDvyUn.exe
  2⤵
  PID:5564
- C:\Windows\System\RHOMiQY.exe
  C:\Windows\System\RHOMiQY.exe
  2⤵
  PID:5600
- C:\Windows\System\inYSlFO.exe
  C:\Windows\System\inYSlFO.exe
  2⤵
  PID:5632
- C:\Windows\System\vcjUFlx.exe
  C:\Windows\System\vcjUFlx.exe
  2⤵
  PID:5660
- C:\Windows\System\qkDBmqE.exe
  C:\Windows\System\qkDBmqE.exe
  2⤵
  PID:5688
- C:\Windows\System\TVcQkBr.exe
  C:\Windows\System\TVcQkBr.exe
  2⤵
  PID:5720
- C:\Windows\System\VWJJumI.exe
  C:\Windows\System\VWJJumI.exe
  2⤵
  PID:5744
- C:\Windows\System\kvFcadN.exe
  C:\Windows\System\kvFcadN.exe
  2⤵
  PID:5776
- C:\Windows\System\DndSBdL.exe
  C:\Windows\System\DndSBdL.exe
  2⤵
  PID:5808
- C:\Windows\System\ZDVoGJV.exe
  C:\Windows\System\ZDVoGJV.exe
  2⤵
  PID:5832
- C:\Windows\System\dzeTuNk.exe
  C:\Windows\System\dzeTuNk.exe
  2⤵
  PID:5860
- C:\Windows\System\qaDBzds.exe
  C:\Windows\System\qaDBzds.exe
  2⤵
  PID:5888
- C:\Windows\System\LHooYka.exe
  C:\Windows\System\LHooYka.exe
  2⤵
  PID:5916
- C:\Windows\System\LbmtmLa.exe
  C:\Windows\System\LbmtmLa.exe
  2⤵
  PID:5944
- C:\Windows\System\DNhnhqe.exe
  C:\Windows\System\DNhnhqe.exe
  2⤵
  PID:5972
- C:\Windows\System\ARHXxVo.exe
  C:\Windows\System\ARHXxVo.exe
  2⤵
  PID:6004
- C:\Windows\System\GeFBoBq.exe
  C:\Windows\System\GeFBoBq.exe
  2⤵
  PID:6028
- C:\Windows\System\kRAHeIu.exe
  C:\Windows\System\kRAHeIu.exe
  2⤵
  PID:6056
- C:\Windows\System\bwDsauV.exe
  C:\Windows\System\bwDsauV.exe
  2⤵
  PID:6088
- C:\Windows\System\XHmKxfd.exe
  C:\Windows\System\XHmKxfd.exe
  2⤵
  PID:6116
- C:\Windows\System\TalHRtH.exe
  C:\Windows\System\TalHRtH.exe
  2⤵
  PID:4460
- C:\Windows\System\ahNcdtE.exe
  C:\Windows\System\ahNcdtE.exe
  2⤵
  PID:3144
- C:\Windows\System\srncPfm.exe
  C:\Windows\System\srncPfm.exe
  2⤵
  PID:2416
- C:\Windows\System\uVvqxTt.exe
  C:\Windows\System\uVvqxTt.exe
  2⤵
  PID:2004
- C:\Windows\System\zllpNQW.exe
  C:\Windows\System\zllpNQW.exe
  2⤵
  PID:5164
- C:\Windows\System\ekvzlDC.exe
  C:\Windows\System\ekvzlDC.exe
  2⤵
  PID:5224
- C:\Windows\System\QcPeGNk.exe
  C:\Windows\System\QcPeGNk.exe
  2⤵
  PID:5284
- C:\Windows\System\WZHXiGf.exe
  C:\Windows\System\WZHXiGf.exe
  2⤵
  PID:5360
- C:\Windows\System\vyxMLTh.exe
  C:\Windows\System\vyxMLTh.exe
  2⤵
  PID:4624
- C:\Windows\System\OWLiCDl.exe
  C:\Windows\System\OWLiCDl.exe
  2⤵
  PID:5452
- C:\Windows\System\htXnHqY.exe
  C:\Windows\System\htXnHqY.exe
  2⤵
  PID:5504
- C:\Windows\System\RvaPDao.exe
  C:\Windows\System\RvaPDao.exe
  2⤵
  PID:5576
- C:\Windows\System\uzSIRju.exe
  C:\Windows\System\uzSIRju.exe
  2⤵
  PID:5620
- C:\Windows\System\QYRXRRy.exe
  C:\Windows\System\QYRXRRy.exe
  2⤵
  PID:5680
- C:\Windows\System\ltzGQnR.exe
  C:\Windows\System\ltzGQnR.exe
  2⤵
  PID:5716
- C:\Windows\System\gjYHngK.exe
  C:\Windows\System\gjYHngK.exe
  2⤵
  PID:5756
- C:\Windows\System\HJUdZWf.exe
  C:\Windows\System\HJUdZWf.exe
  2⤵
  PID:5824
- C:\Windows\System\hDjlTUc.exe
  C:\Windows\System\hDjlTUc.exe
  2⤵
  PID:2780
- C:\Windows\System\OuHcPZl.exe
  C:\Windows\System\OuHcPZl.exe
  2⤵
  PID:5932
- C:\Windows\System\oMQCCbb.exe
  C:\Windows\System\oMQCCbb.exe
  2⤵
  PID:5968
- C:\Windows\System\yEqWlCN.exe
  C:\Windows\System\yEqWlCN.exe
  2⤵
  PID:6024
- C:\Windows\System\foSxHhP.exe
  C:\Windows\System\foSxHhP.exe
  2⤵
  PID:6076
- C:\Windows\System\teQLrnP.exe
  C:\Windows\System\teQLrnP.exe
  2⤵
  PID:6136
- C:\Windows\System\zLQjOex.exe
  C:\Windows\System\zLQjOex.exe
  2⤵
  PID:1600
- C:\Windows\System\GDXvBSZ.exe
  C:\Windows\System\GDXvBSZ.exe
  2⤵
  PID:5140
- C:\Windows\System\zzgRSHi.exe
  C:\Windows\System\zzgRSHi.exe
  2⤵
  PID:5388
- C:\Windows\System\LRRFUkN.exe
  C:\Windows\System\LRRFUkN.exe
  2⤵
  PID:5500
- C:\Windows\System\jAaMMWI.exe
  C:\Windows\System\jAaMMWI.exe
  2⤵
  PID:392
- C:\Windows\System\INcBWYa.exe
  C:\Windows\System\INcBWYa.exe
  2⤵
  PID:5708
- C:\Windows\System\Xwixvfz.exe
  C:\Windows\System\Xwixvfz.exe
  2⤵
  PID:3340
- C:\Windows\System\saecAKD.exe
  C:\Windows\System\saecAKD.exe
  2⤵
  PID:5800
- C:\Windows\System\AwKHzEF.exe
  C:\Windows\System\AwKHzEF.exe
  2⤵
  PID:1540
- C:\Windows\System\aDWxDuZ.exe
  C:\Windows\System\aDWxDuZ.exe
  2⤵
  PID:6128
- C:\Windows\System\KkntINb.exe
  C:\Windows\System\KkntINb.exe
  2⤵
  PID:5048
- C:\Windows\System\NZkEOIv.exe
  C:\Windows\System\NZkEOIv.exe
  2⤵
  PID:4380
- C:\Windows\System\ZwyfUSK.exe
  C:\Windows\System\ZwyfUSK.exe
  2⤵
  PID:4648
- C:\Windows\System\fYECwvZ.exe
  C:\Windows\System\fYECwvZ.exe
  2⤵
  PID:4864
- C:\Windows\System\xSDGzry.exe
  C:\Windows\System\xSDGzry.exe
  2⤵
  PID:3852
- C:\Windows\System\ORxamOm.exe
  C:\Windows\System\ORxamOm.exe
  2⤵
  PID:2680
- C:\Windows\System\pSTVhfm.exe
  C:\Windows\System\pSTVhfm.exe
  2⤵
  PID:2992
- C:\Windows\System\RMmueZR.exe
  C:\Windows\System\RMmueZR.exe
  2⤵
  PID:4752
- C:\Windows\System\briaBJF.exe
  C:\Windows\System\briaBJF.exe
  2⤵
  PID:3524
- C:\Windows\System\SecJchk.exe
  C:\Windows\System\SecJchk.exe
  2⤵
  PID:5908
- C:\Windows\System\cSzSncs.exe
  C:\Windows\System\cSzSncs.exe
  2⤵
  PID:5336
- C:\Windows\System\OWscTeU.exe
  C:\Windows\System\OWscTeU.exe
  2⤵
  PID:3368
- C:\Windows\System\xpuNSLW.exe
  C:\Windows\System\xpuNSLW.exe
  2⤵
  PID:3432
- C:\Windows\System\EPibJoa.exe
  C:\Windows\System\EPibJoa.exe
  2⤵
  PID:5032
- C:\Windows\System\ziaiovv.exe
  C:\Windows\System\ziaiovv.exe
  2⤵
  PID:4732
- C:\Windows\System\ELNdKoB.exe
  C:\Windows\System\ELNdKoB.exe
  2⤵
  PID:3080
- C:\Windows\System\BPFoTNO.exe
  C:\Windows\System\BPFoTNO.exe
  2⤵
  PID:2260
- C:\Windows\System\dwzRtCH.exe
  C:\Windows\System\dwzRtCH.exe
  2⤵
  PID:6148
- C:\Windows\System\AUKMcLi.exe
  C:\Windows\System\AUKMcLi.exe
  2⤵
  PID:6168
- C:\Windows\System\umpthYj.exe
  C:\Windows\System\umpthYj.exe
  2⤵
  PID:6184
- C:\Windows\System\JoaDljL.exe
  C:\Windows\System\JoaDljL.exe
  2⤵
  PID:6208
- C:\Windows\System\MRIPcaU.exe
  C:\Windows\System\MRIPcaU.exe
  2⤵
  PID:6240
- C:\Windows\System\nMBssMN.exe
  C:\Windows\System\nMBssMN.exe
  2⤵
  PID:6264
- C:\Windows\System\leuIJvL.exe
  C:\Windows\System\leuIJvL.exe
  2⤵
  PID:6284
- C:\Windows\System\yiGfofj.exe
  C:\Windows\System\yiGfofj.exe
  2⤵
  PID:6356
- C:\Windows\System\ElirvYY.exe
  C:\Windows\System\ElirvYY.exe
  2⤵
  PID:6412
- C:\Windows\System\sHnMoZc.exe
  C:\Windows\System\sHnMoZc.exe
  2⤵
  PID:6440
- C:\Windows\System\UOmqldq.exe
  C:\Windows\System\UOmqldq.exe
  2⤵
  PID:6464
- C:\Windows\System\nFogwNb.exe
  C:\Windows\System\nFogwNb.exe
  2⤵
  PID:6508
- C:\Windows\System\PkQprdu.exe
  C:\Windows\System\PkQprdu.exe
  2⤵
  PID:6536
- C:\Windows\System\DctvWlz.exe
  C:\Windows\System\DctvWlz.exe
  2⤵
  PID:6560
- C:\Windows\System\eQgVkvY.exe
  C:\Windows\System\eQgVkvY.exe
  2⤵
  PID:6588
- C:\Windows\System\fTRqltB.exe
  C:\Windows\System\fTRqltB.exe
  2⤵
  PID:6612
- C:\Windows\System\iKWsGtq.exe
  C:\Windows\System\iKWsGtq.exe
  2⤵
  PID:6636
- C:\Windows\System\ZGyaYyb.exe
  C:\Windows\System\ZGyaYyb.exe
  2⤵
  PID:6656
- C:\Windows\System\nqjZRyP.exe
  C:\Windows\System\nqjZRyP.exe
  2⤵
  PID:6688
- C:\Windows\System\inNjKjX.exe
  C:\Windows\System\inNjKjX.exe
  2⤵
  PID:6720
- C:\Windows\System\QpnAECk.exe
  C:\Windows\System\QpnAECk.exe
  2⤵
  PID:6736
- C:\Windows\System\uGUMxLm.exe
  C:\Windows\System\uGUMxLm.exe
  2⤵
  PID:6760
- C:\Windows\System\vlZLBBO.exe
  C:\Windows\System\vlZLBBO.exe
  2⤵
  PID:6788
- C:\Windows\System\NlnbPQh.exe
  C:\Windows\System\NlnbPQh.exe
  2⤵
  PID:6804
- C:\Windows\System\KhYyndB.exe
  C:\Windows\System\KhYyndB.exe
  2⤵
  PID:6828
- C:\Windows\System\rhgbGGU.exe
  C:\Windows\System\rhgbGGU.exe
  2⤵
  PID:6848
- C:\Windows\System\vlXXYiE.exe
  C:\Windows\System\vlXXYiE.exe
  2⤵
  PID:6868
- C:\Windows\System\kPWfAaT.exe
  C:\Windows\System\kPWfAaT.exe
  2⤵
  PID:6892
- C:\Windows\System\LvEVQyS.exe
  C:\Windows\System\LvEVQyS.exe
  2⤵
  PID:6908
- C:\Windows\System\SexZEMc.exe
  C:\Windows\System\SexZEMc.exe
  2⤵
  PID:6932
- C:\Windows\System\xLmWFQV.exe
  C:\Windows\System\xLmWFQV.exe
  2⤵
  PID:6960
- C:\Windows\System\kBsfDBR.exe
  C:\Windows\System\kBsfDBR.exe
  2⤵
  PID:6984
- C:\Windows\System\qEGHUCe.exe
  C:\Windows\System\qEGHUCe.exe
  2⤵
  PID:7012
- C:\Windows\System\vQgjkBI.exe
  C:\Windows\System\vQgjkBI.exe
  2⤵
  PID:7028
- C:\Windows\System\ahVhEUY.exe
  C:\Windows\System\ahVhEUY.exe
  2⤵
  PID:7052
- C:\Windows\System\PomNNaK.exe
  C:\Windows\System\PomNNaK.exe
  2⤵
  PID:7148
- C:\Windows\System\FdEGjCO.exe
  C:\Windows\System\FdEGjCO.exe
  2⤵
  PID:7164
- C:\Windows\System\cgKhxhs.exe
  C:\Windows\System\cgKhxhs.exe
  2⤵
  PID:2460
- C:\Windows\System\dLTCwqw.exe
  C:\Windows\System\dLTCwqw.exe
  2⤵
  PID:2736
- C:\Windows\System\pznkHjH.exe
  C:\Windows\System\pznkHjH.exe
  2⤵
  PID:1804
- C:\Windows\System\CKtFVZS.exe
  C:\Windows\System\CKtFVZS.exe
  2⤵
  PID:5996
- C:\Windows\System\svYwlUm.exe
  C:\Windows\System\svYwlUm.exe
  2⤵
  PID:6252
- C:\Windows\System\KVrMUxk.exe
  C:\Windows\System\KVrMUxk.exe
  2⤵
  PID:2768
- C:\Windows\System\vwDqwSG.exe
  C:\Windows\System\vwDqwSG.exe
  2⤵
  PID:6596
- C:\Windows\System\IVuGBhd.exe
  C:\Windows\System\IVuGBhd.exe
  2⤵
  PID:6800
- C:\Windows\System\OXXcXlu.exe
  C:\Windows\System\OXXcXlu.exe
  2⤵
  PID:6840
- C:\Windows\System\owkYyPG.exe
  C:\Windows\System\owkYyPG.exe
  2⤵
  PID:6924
- C:\Windows\System\QxvixlK.exe
  C:\Windows\System\QxvixlK.exe
  2⤵
  PID:6888
- C:\Windows\System\uUgzWmL.exe
  C:\Windows\System\uUgzWmL.exe
  2⤵
  PID:7084
- C:\Windows\System\PgBUsVV.exe
  C:\Windows\System\PgBUsVV.exe
  2⤵
  PID:7072
- C:\Windows\System\OnJisXC.exe
  C:\Windows\System\OnJisXC.exe
  2⤵
  PID:5596
- C:\Windows\System\FIUwlIA.exe
  C:\Windows\System\FIUwlIA.exe
  2⤵
  PID:7024
- C:\Windows\System\zULMBFm.exe
  C:\Windows\System\zULMBFm.exe
  2⤵
  PID:6316
- C:\Windows\System\JDxRhpL.exe
  C:\Windows\System\JDxRhpL.exe
  2⤵
  PID:7096
- C:\Windows\System\GnzQJqd.exe
  C:\Windows\System\GnzQJqd.exe
  2⤵
  PID:4364
- C:\Windows\System\tbRgIJt.exe
  C:\Windows\System\tbRgIJt.exe
  2⤵
  PID:6408
- C:\Windows\System\BDABHPz.exe
  C:\Windows\System\BDABHPz.exe
  2⤵
  PID:3696
- C:\Windows\System\ixielWf.exe
  C:\Windows\System\ixielWf.exe
  2⤵
  PID:6336
- C:\Windows\System\gkWGXes.exe
  C:\Windows\System\gkWGXes.exe
  2⤵
  PID:6796
- C:\Windows\System\XBpRHKJ.exe
  C:\Windows\System\XBpRHKJ.exe
  2⤵
  PID:7044
- C:\Windows\System\dEnAZSD.exe
  C:\Windows\System\dEnAZSD.exe
  2⤵
  PID:7076
- C:\Windows\System\LnlIsWx.exe
  C:\Windows\System\LnlIsWx.exe
  2⤵
  PID:7080
- C:\Windows\System\dcjEfqs.exe
  C:\Windows\System\dcjEfqs.exe
  2⤵
  PID:6460
- C:\Windows\System\kJacALN.exe
  C:\Windows\System\kJacALN.exe
  2⤵
  PID:6684
- C:\Windows\System\hiuavQx.exe
  C:\Windows\System\hiuavQx.exe
  2⤵
  PID:6876
- C:\Windows\System\iGdDXlt.exe
  C:\Windows\System\iGdDXlt.exe
  2⤵
  PID:6220
- C:\Windows\System\AUGJvRR.exe
  C:\Windows\System\AUGJvRR.exe
  2⤵
  PID:6752
- C:\Windows\System\YuaskMS.exe
  C:\Windows\System\YuaskMS.exe
  2⤵
  PID:6276
- C:\Windows\System\EJepSHR.exe
  C:\Windows\System\EJepSHR.exe
  2⤵
  PID:7212
- C:\Windows\System\ZVggnnd.exe
  C:\Windows\System\ZVggnnd.exe
  2⤵
  PID:7240
- C:\Windows\System\OLQyrlR.exe
  C:\Windows\System\OLQyrlR.exe
  2⤵
  PID:7268
- C:\Windows\System\GAfCvGs.exe
  C:\Windows\System\GAfCvGs.exe
  2⤵
  PID:7296
- C:\Windows\System\dhYfuAE.exe
  C:\Windows\System\dhYfuAE.exe
  2⤵
  PID:7320
- C:\Windows\System\KUTYMkN.exe
  C:\Windows\System\KUTYMkN.exe
  2⤵
  PID:7344
- C:\Windows\System\OlZYEDu.exe
  C:\Windows\System\OlZYEDu.exe
  2⤵
  PID:7368
- C:\Windows\System\MOfNzOM.exe
  C:\Windows\System\MOfNzOM.exe
  2⤵
  PID:7392
- C:\Windows\System\aRbpUJZ.exe
  C:\Windows\System\aRbpUJZ.exe
  2⤵
  PID:7412
- C:\Windows\System\zphwqcD.exe
  C:\Windows\System\zphwqcD.exe
  2⤵
  PID:7448
- C:\Windows\System\zjmiIEJ.exe
  C:\Windows\System\zjmiIEJ.exe
  2⤵
  PID:7472
- C:\Windows\System\BvWlIiN.exe
  C:\Windows\System\BvWlIiN.exe
  2⤵
  PID:7492
- C:\Windows\System\DtPlTEY.exe
  C:\Windows\System\DtPlTEY.exe
  2⤵
  PID:7516
- C:\Windows\System\OZxBkYj.exe
  C:\Windows\System\OZxBkYj.exe
  2⤵
  PID:7556
- C:\Windows\System\YqWdgoK.exe
  C:\Windows\System\YqWdgoK.exe
  2⤵
  PID:7596
- C:\Windows\System\pEyzkYK.exe
  C:\Windows\System\pEyzkYK.exe
  2⤵
  PID:7620
- C:\Windows\System\HoPRmDK.exe
  C:\Windows\System\HoPRmDK.exe
  2⤵
  PID:7640
- C:\Windows\System\rKvvWGZ.exe
  C:\Windows\System\rKvvWGZ.exe
  2⤵
  PID:7660
- C:\Windows\System\xuswOTx.exe
  C:\Windows\System\xuswOTx.exe
  2⤵
  PID:7716
- C:\Windows\System\JHAhNbd.exe
  C:\Windows\System\JHAhNbd.exe
  2⤵
  PID:7772
- C:\Windows\System\DEuBpho.exe
  C:\Windows\System\DEuBpho.exe
  2⤵
  PID:7804
- C:\Windows\System\qMdyORJ.exe
  C:\Windows\System\qMdyORJ.exe
  2⤵
  PID:7828
- C:\Windows\System\BDhLYne.exe
  C:\Windows\System\BDhLYne.exe
  2⤵
  PID:7852
- C:\Windows\System\DAXuLfF.exe
  C:\Windows\System\DAXuLfF.exe
  2⤵
  PID:7868
- C:\Windows\System\yvdLYwE.exe
  C:\Windows\System\yvdLYwE.exe
  2⤵
  PID:7924
- C:\Windows\System\YlrQwCC.exe
  C:\Windows\System\YlrQwCC.exe
  2⤵
  PID:7948
- C:\Windows\System\cjbDWCM.exe
  C:\Windows\System\cjbDWCM.exe
  2⤵
  PID:7972
- C:\Windows\System\WrbLhrN.exe
  C:\Windows\System\WrbLhrN.exe
  2⤵
  PID:8012
- C:\Windows\System\COhuSRu.exe
  C:\Windows\System\COhuSRu.exe
  2⤵
  PID:8036
- C:\Windows\System\haDPDSz.exe
  C:\Windows\System\haDPDSz.exe
  2⤵
  PID:8052
- C:\Windows\System\rZYNpjb.exe
  C:\Windows\System\rZYNpjb.exe
  2⤵
  PID:8092
- C:\Windows\System\gtKAEQx.exe
  C:\Windows\System\gtKAEQx.exe
  2⤵
  PID:8108
- C:\Windows\System\TljfmJi.exe
  C:\Windows\System\TljfmJi.exe
  2⤵
  PID:8124
- C:\Windows\System\ZuSvNiC.exe
  C:\Windows\System\ZuSvNiC.exe
  2⤵
  PID:8144
- C:\Windows\System\vdxAkCN.exe
  C:\Windows\System\vdxAkCN.exe
  2⤵
  PID:8176
- C:\Windows\System\KXynNUz.exe
  C:\Windows\System\KXynNUz.exe
  2⤵
  PID:7220
- C:\Windows\System\VUNBTMu.exe
  C:\Windows\System\VUNBTMu.exe
  2⤵
  PID:7288
- C:\Windows\System\qskIrNu.exe
  C:\Windows\System\qskIrNu.exe
  2⤵
  PID:7376
- C:\Windows\System\lkGBsva.exe
  C:\Windows\System\lkGBsva.exe
  2⤵
  PID:7488
- C:\Windows\System\ObcdZZy.exe
  C:\Windows\System\ObcdZZy.exe
  2⤵
  PID:7536
- C:\Windows\System\yZuDOsJ.exe
  C:\Windows\System\yZuDOsJ.exe
  2⤵
  PID:7588
- C:\Windows\System\AGGSejq.exe
  C:\Windows\System\AGGSejq.exe
  2⤵
  PID:7636
- C:\Windows\System\UWeedMF.exe
  C:\Windows\System\UWeedMF.exe
  2⤵
  PID:7704
- C:\Windows\System\RKpjVDU.exe
  C:\Windows\System\RKpjVDU.exe
  2⤵
  PID:7676
- C:\Windows\System\AGVXwWP.exe
  C:\Windows\System\AGVXwWP.exe
  2⤵
  PID:7764
- C:\Windows\System\yquUwUp.exe
  C:\Windows\System\yquUwUp.exe
  2⤵
  PID:7844
- C:\Windows\System\JFrHplV.exe
  C:\Windows\System\JFrHplV.exe
  2⤵
  PID:7916
- C:\Windows\System\fTdUjkT.exe
  C:\Windows\System\fTdUjkT.exe
  2⤵
  PID:7984
- C:\Windows\System\bXboFAm.exe
  C:\Windows\System\bXboFAm.exe
  2⤵
  PID:8076
- C:\Windows\System\irMJTFX.exe
  C:\Windows\System\irMJTFX.exe
  2⤵
  PID:8072
- C:\Windows\System\hAMkgGi.exe
  C:\Windows\System\hAMkgGi.exe
  2⤵
  PID:8116
- C:\Windows\System\TDtahmI.exe
  C:\Windows\System\TDtahmI.exe
  2⤵
  PID:6200
- C:\Windows\System\wkdQUuS.exe
  C:\Windows\System\wkdQUuS.exe
  2⤵
  PID:7360
- C:\Windows\System\Ghcgirz.exe
  C:\Windows\System\Ghcgirz.exe
  2⤵
  PID:7528
- C:\Windows\System\RCQsVYL.exe
  C:\Windows\System\RCQsVYL.exe
  2⤵
  PID:7548
- C:\Windows\System\yDYvYMO.exe
  C:\Windows\System\yDYvYMO.exe
  2⤵
  PID:7628
- C:\Windows\System\fnTeloi.exe
  C:\Windows\System\fnTeloi.exe
  2⤵
  PID:7668
- C:\Windows\System\bYifbXC.exe
  C:\Windows\System\bYifbXC.exe
  2⤵
  PID:7792
- C:\Windows\System\Prfijon.exe
  C:\Windows\System\Prfijon.exe
  2⤵
  PID:7936
- C:\Windows\System\XjJCbGS.exe
  C:\Windows\System\XjJCbGS.exe
  2⤵
  PID:7824
- C:\Windows\System\mUzwDsz.exe
  C:\Windows\System\mUzwDsz.exe
  2⤵
  PID:8104
- C:\Windows\System\zXQdFKk.exe
  C:\Windows\System\zXQdFKk.exe
  2⤵
  PID:8100
- C:\Windows\System\PPgNDfH.exe
  C:\Windows\System\PPgNDfH.exe
  2⤵
  PID:8196
- C:\Windows\System\UCNMzRP.exe
  C:\Windows\System\UCNMzRP.exe
  2⤵
  PID:8244
- C:\Windows\System\IiSqAcQ.exe
  C:\Windows\System\IiSqAcQ.exe
  2⤵
  PID:8292
- C:\Windows\System\OKkNVMd.exe
  C:\Windows\System\OKkNVMd.exe
  2⤵
  PID:8332
- C:\Windows\System\pKcnAPE.exe
  C:\Windows\System\pKcnAPE.exe
  2⤵
  PID:8356
- C:\Windows\System\WdZdRVU.exe
  C:\Windows\System\WdZdRVU.exe
  2⤵
  PID:8376
- C:\Windows\System\uQUsktE.exe
  C:\Windows\System\uQUsktE.exe
  2⤵
  PID:8392
- C:\Windows\System\ihtXHjk.exe
  C:\Windows\System\ihtXHjk.exe
  2⤵
  PID:8412
- C:\Windows\System\hstWdeS.exe
  C:\Windows\System\hstWdeS.exe
  2⤵
  PID:8468
- C:\Windows\System\oJhbayj.exe
  C:\Windows\System\oJhbayj.exe
  2⤵
  PID:8488
- C:\Windows\System\rNeoVvZ.exe
  C:\Windows\System\rNeoVvZ.exe
  2⤵
  PID:8508
- C:\Windows\System\EmqGblr.exe
  C:\Windows\System\EmqGblr.exe
  2⤵
  PID:8548
- C:\Windows\System\SoHBDkA.exe
  C:\Windows\System\SoHBDkA.exe
  2⤵
  PID:8568
- C:\Windows\System\WYARRUt.exe
  C:\Windows\System\WYARRUt.exe
  2⤵
  PID:8592
- C:\Windows\System\Mjwzvlh.exe
  C:\Windows\System\Mjwzvlh.exe
  2⤵
  PID:8620
- C:\Windows\System\dKemLrU.exe
  C:\Windows\System\dKemLrU.exe
  2⤵
  PID:8656
- C:\Windows\System\NWfzkpp.exe
  C:\Windows\System\NWfzkpp.exe
  2⤵
  PID:8676
- C:\Windows\System\WGeRKUV.exe
  C:\Windows\System\WGeRKUV.exe
  2⤵
  PID:8704
- C:\Windows\System\XhZgIcF.exe
  C:\Windows\System\XhZgIcF.exe
  2⤵
  PID:8728
- C:\Windows\System\fWeZUra.exe
  C:\Windows\System\fWeZUra.exe
  2⤵
  PID:8752
- C:\Windows\System\lgKIopc.exe
  C:\Windows\System\lgKIopc.exe
  2⤵
  PID:8804
- C:\Windows\System\NBjTxDo.exe
  C:\Windows\System\NBjTxDo.exe
  2⤵
  PID:8820
- C:\Windows\System\FjetxbP.exe
  C:\Windows\System\FjetxbP.exe
  2⤵
  PID:8844
- C:\Windows\System\ThBLFAM.exe
  C:\Windows\System\ThBLFAM.exe
  2⤵
  PID:8916
- C:\Windows\System\mZsAHFP.exe
  C:\Windows\System\mZsAHFP.exe
  2⤵
  PID:8932
- C:\Windows\System\AaHrGTw.exe
  C:\Windows\System\AaHrGTw.exe
  2⤵
  PID:8952
- C:\Windows\System\wNMPomb.exe
  C:\Windows\System\wNMPomb.exe
  2⤵
  PID:8972
- C:\Windows\System\rofDGSK.exe
  C:\Windows\System\rofDGSK.exe
  2⤵
  PID:8996
- C:\Windows\System\mNPtSbQ.exe
  C:\Windows\System\mNPtSbQ.exe
  2⤵
  PID:9024
- C:\Windows\System\RwiuSAY.exe
  C:\Windows\System\RwiuSAY.exe
  2⤵
  PID:9040
- C:\Windows\System\zzGKvBJ.exe
  C:\Windows\System\zzGKvBJ.exe
  2⤵
  PID:9060
- C:\Windows\System\QhhaKzH.exe
  C:\Windows\System\QhhaKzH.exe
  2⤵
  PID:9116
- C:\Windows\System\Yxtlwks.exe
  C:\Windows\System\Yxtlwks.exe
  2⤵
  PID:9148
- C:\Windows\System\coglXIa.exe
  C:\Windows\System\coglXIa.exe
  2⤵
  PID:9172
- C:\Windows\System\PvVQGQP.exe
  C:\Windows\System\PvVQGQP.exe
  2⤵
  PID:9196
- C:\Windows\System\rPryzEX.exe
  C:\Windows\System\rPryzEX.exe
  2⤵
  PID:9212
- C:\Windows\System\DBYYYKW.exe
  C:\Windows\System\DBYYYKW.exe
  2⤵
  PID:7700
- C:\Windows\System\QnriOej.exe
  C:\Windows\System\QnriOej.exe
  2⤵
  PID:8236
- C:\Windows\System\slrnokG.exe
  C:\Windows\System\slrnokG.exe
  2⤵
  PID:8288
- C:\Windows\System\LLgKwSn.exe
  C:\Windows\System\LLgKwSn.exe
  2⤵
  PID:8344
- C:\Windows\System\bKTxePa.exe
  C:\Windows\System\bKTxePa.exe
  2⤵
  PID:8404
- C:\Windows\System\aOcfTPL.exe
  C:\Windows\System\aOcfTPL.exe
  2⤵
  PID:8520
- C:\Windows\System\STIvYnZ.exe
  C:\Windows\System\STIvYnZ.exe
  2⤵
  PID:8544
- C:\Windows\System\OdWkyvC.exe
  C:\Windows\System\OdWkyvC.exe
  2⤵
  PID:8652
- C:\Windows\System\KmCydYw.exe
  C:\Windows\System\KmCydYw.exe
  2⤵
  PID:8712
- C:\Windows\System\nWPtrGA.exe
  C:\Windows\System\nWPtrGA.exe
  2⤵
  PID:8876
- C:\Windows\System\hIQXoUO.exe
  C:\Windows\System\hIQXoUO.exe
  2⤵
  PID:8860
- C:\Windows\System\MBfvrSe.exe
  C:\Windows\System\MBfvrSe.exe
  2⤵
  PID:9020
- C:\Windows\System\UHWBVkf.exe
  C:\Windows\System\UHWBVkf.exe
  2⤵
  PID:9088
- C:\Windows\System\fVgnpQU.exe
  C:\Windows\System\fVgnpQU.exe
  2⤵
  PID:9136
- C:\Windows\System\YljPlrv.exe
  C:\Windows\System\YljPlrv.exe
  2⤵
  PID:9208
- C:\Windows\System\ujsvDnW.exe
  C:\Windows\System\ujsvDnW.exe
  2⤵
  PID:8284
- C:\Windows\System\vnQzUpX.exe
  C:\Windows\System\vnQzUpX.exe
  2⤵
  PID:8420
- C:\Windows\System\NPKJJVD.exe
  C:\Windows\System\NPKJJVD.exe
  2⤵
  PID:8444
- C:\Windows\System\ohXFgvh.exe
  C:\Windows\System\ohXFgvh.exe
  2⤵
  PID:8668
- C:\Windows\System\hzKcIQk.exe
  C:\Windows\System\hzKcIQk.exe
  2⤵
  PID:7304
- C:\Windows\System\bUkrEne.exe
  C:\Windows\System\bUkrEne.exe
  2⤵
  PID:9132
- C:\Windows\System\VGpUiSs.exe
  C:\Windows\System\VGpUiSs.exe
  2⤵
  PID:9016
- C:\Windows\System\UoOsZie.exe
  C:\Windows\System\UoOsZie.exe
  2⤵
  PID:8992
- C:\Windows\System\rJwbgyO.exe
  C:\Windows\System\rJwbgyO.exe
  2⤵
  PID:728
- C:\Windows\System\gHKyrhA.exe
  C:\Windows\System\gHKyrhA.exe
  2⤵
  PID:9232
- C:\Windows\System\FctwZrC.exe
  C:\Windows\System\FctwZrC.exe
  2⤵
  PID:9256
- C:\Windows\System\uNMOAdI.exe
  C:\Windows\System\uNMOAdI.exe
  2⤵
  PID:9280
- C:\Windows\System\VBSpwvJ.exe
  C:\Windows\System\VBSpwvJ.exe
  2⤵
  PID:9328
- C:\Windows\System\CEfGJnN.exe
  C:\Windows\System\CEfGJnN.exe
  2⤵
  PID:9348
- C:\Windows\System\XIvDRWw.exe
  C:\Windows\System\XIvDRWw.exe
  2⤵
  PID:9368
- C:\Windows\System\ppqteYL.exe
  C:\Windows\System\ppqteYL.exe
  2⤵
  PID:9412
- C:\Windows\System\snmeQDo.exe
  C:\Windows\System\snmeQDo.exe
  2⤵
  PID:9432
- C:\Windows\System\ZKsrOYU.exe
  C:\Windows\System\ZKsrOYU.exe
  2⤵
  PID:9452
- C:\Windows\System\qPYFRrE.exe
  C:\Windows\System\qPYFRrE.exe
  2⤵
  PID:9480
- C:\Windows\System\XWEhAJX.exe
  C:\Windows\System\XWEhAJX.exe
  2⤵
  PID:9520
- C:\Windows\System\QNqYPqD.exe
  C:\Windows\System\QNqYPqD.exe
  2⤵
  PID:9536
- C:\Windows\System\AfbtsHM.exe
  C:\Windows\System\AfbtsHM.exe
  2⤵
  PID:9568
- C:\Windows\System\NeTFGWL.exe
  C:\Windows\System\NeTFGWL.exe
  2⤵
  PID:9600
- C:\Windows\System\DpQtCCi.exe
  C:\Windows\System\DpQtCCi.exe
  2⤵
  PID:9620
- C:\Windows\System\gTotLAq.exe
  C:\Windows\System\gTotLAq.exe
  2⤵
  PID:9648
- C:\Windows\System\EHvqWso.exe
  C:\Windows\System\EHvqWso.exe
  2⤵
  PID:9668
- C:\Windows\System\UgnlIJn.exe
  C:\Windows\System\UgnlIJn.exe
  2⤵
  PID:9688
- C:\Windows\System\iFbpsAK.exe
  C:\Windows\System\iFbpsAK.exe
  2⤵
  PID:9712
- C:\Windows\System\GQbKPBJ.exe
  C:\Windows\System\GQbKPBJ.exe
  2⤵
  PID:9744
- C:\Windows\System\yaQZDzr.exe
  C:\Windows\System\yaQZDzr.exe
  2⤵
  PID:9760
- C:\Windows\System\VrVVMPm.exe
  C:\Windows\System\VrVVMPm.exe
  2⤵
  PID:9784
- C:\Windows\System\SPiviEZ.exe
  C:\Windows\System\SPiviEZ.exe
  2⤵
  PID:9820
- C:\Windows\System\giHhaFr.exe
  C:\Windows\System\giHhaFr.exe
  2⤵
  PID:9840
- C:\Windows\System\LPESSiI.exe
  C:\Windows\System\LPESSiI.exe
  2⤵
  PID:9864
- C:\Windows\System\JWiqQxy.exe
  C:\Windows\System\JWiqQxy.exe
  2⤵
  PID:9924
- C:\Windows\System\OWXOozY.exe
  C:\Windows\System\OWXOozY.exe
  2⤵
  PID:9944
- C:\Windows\System\jAcLFDP.exe
  C:\Windows\System\jAcLFDP.exe
  2⤵
  PID:9984
- C:\Windows\System\AfExwaD.exe
  C:\Windows\System\AfExwaD.exe
  2⤵
  PID:10032
- C:\Windows\System\PuebWDE.exe
  C:\Windows\System\PuebWDE.exe
  2⤵
  PID:10060
- C:\Windows\System\UQzRJbr.exe
  C:\Windows\System\UQzRJbr.exe
  2⤵
  PID:10084
- C:\Windows\System\lCfDqfq.exe
  C:\Windows\System\lCfDqfq.exe
  2⤵
  PID:10100
- C:\Windows\System\SsyTvMm.exe
  C:\Windows\System\SsyTvMm.exe
  2⤵
  PID:10132
- C:\Windows\System\QtiLkBO.exe
  C:\Windows\System\QtiLkBO.exe
  2⤵
  PID:10156
- C:\Windows\System\LcQfenX.exe
  C:\Windows\System\LcQfenX.exe
  2⤵
  PID:10184
- C:\Windows\System\OOCoxMQ.exe
  C:\Windows\System\OOCoxMQ.exe
  2⤵
  PID:10232
- C:\Windows\System\BcviWDJ.exe
  C:\Windows\System\BcviWDJ.exe
  2⤵
  PID:9240
- C:\Windows\System\ttGWWlo.exe
  C:\Windows\System\ttGWWlo.exe
  2⤵
  PID:9312
- C:\Windows\System\BHWqfGJ.exe
  C:\Windows\System\BHWqfGJ.exe
  2⤵
  PID:9336
- C:\Windows\System\MfhqQbL.exe
  C:\Windows\System\MfhqQbL.exe
  2⤵
  PID:9404
- C:\Windows\System\AeFvzZR.exe
  C:\Windows\System\AeFvzZR.exe
  2⤵
  PID:9428
- C:\Windows\System\LCtWdvW.exe
  C:\Windows\System\LCtWdvW.exe
  2⤵
  PID:9472
- C:\Windows\System\nNiwLmo.exe
  C:\Windows\System\nNiwLmo.exe
  2⤵
  PID:9512
- C:\Windows\System\uLXaSnB.exe
  C:\Windows\System\uLXaSnB.exe
  2⤵
  PID:9560
- C:\Windows\System\CBBvudW.exe
  C:\Windows\System\CBBvudW.exe
  2⤵
  PID:9704
- C:\Windows\System\lcbwkYa.exe
  C:\Windows\System\lcbwkYa.exe
  2⤵
  PID:9124
- C:\Windows\System\oLFxRdX.exe
  C:\Windows\System\oLFxRdX.exe
  2⤵
  PID:9812
- C:\Windows\System\JPKnhRI.exe
  C:\Windows\System\JPKnhRI.exe
  2⤵
  PID:9884
- C:\Windows\System\HwOBUIZ.exe
  C:\Windows\System\HwOBUIZ.exe
  2⤵
  PID:9980
- C:\Windows\System\ZKnQfUU.exe
  C:\Windows\System\ZKnQfUU.exe
  2⤵
  PID:10044
- C:\Windows\System\jeDjWMA.exe
  C:\Windows\System\jeDjWMA.exe
  2⤵
  PID:10092
- C:\Windows\System\VussPbB.exe
  C:\Windows\System\VussPbB.exe
  2⤵
  PID:10140
- C:\Windows\System\rEOjzdx.exe
  C:\Windows\System\rEOjzdx.exe
  2⤵
  PID:10200
- C:\Windows\System\hwjBLjx.exe
  C:\Windows\System\hwjBLjx.exe
  2⤵
  PID:9224
- C:\Windows\System\soeIule.exe
  C:\Windows\System\soeIule.exe
  2⤵
  PID:9388
- C:\Windows\System\rmBgVeg.exe
  C:\Windows\System\rmBgVeg.exe
  2⤵
  PID:9444
- C:\Windows\System\KInocYq.exe
  C:\Windows\System\KInocYq.exe
  2⤵
  PID:9588
- C:\Windows\System\baMwOyk.exe
  C:\Windows\System\baMwOyk.exe
  2⤵
  PID:9720
- C:\Windows\System\HGOudBS.exe
  C:\Windows\System\HGOudBS.exe
  2⤵
  PID:9912
- C:\Windows\System\avXPZQm.exe
  C:\Windows\System\avXPZQm.exe
  2⤵
  PID:9976
- C:\Windows\System\NRFDmYT.exe
  C:\Windows\System\NRFDmYT.exe
  2⤵
  PID:10128
- C:\Windows\System\ZrCvfcK.exe
  C:\Windows\System\ZrCvfcK.exe
  2⤵
  PID:8540
- C:\Windows\System\DOsgaXP.exe
  C:\Windows\System\DOsgaXP.exe
  2⤵
  PID:9612
- C:\Windows\System\MxbjAui.exe
  C:\Windows\System\MxbjAui.exe
  2⤵
  PID:10252
- C:\Windows\System\nVRsMKa.exe
  C:\Windows\System\nVRsMKa.exe
  2⤵
  PID:10276
- C:\Windows\System\UpmeVyu.exe
  C:\Windows\System\UpmeVyu.exe
  2⤵
  PID:10296
- C:\Windows\System\HJTxogQ.exe
  C:\Windows\System\HJTxogQ.exe
  2⤵
  PID:10324
- C:\Windows\System\qwOETgG.exe
  C:\Windows\System\qwOETgG.exe
  2⤵
  PID:10348
- C:\Windows\System\xWATSsV.exe
  C:\Windows\System\xWATSsV.exe
  2⤵
  PID:10392
- C:\Windows\System\Pbhphib.exe
  C:\Windows\System\Pbhphib.exe
  2⤵
  PID:10420
- C:\Windows\System\gONnMsY.exe
  C:\Windows\System\gONnMsY.exe
  2⤵
  PID:10452
- C:\Windows\System\BPUYuMa.exe
  C:\Windows\System\BPUYuMa.exe
  2⤵
  PID:10488
- C:\Windows\System\kAPhoRJ.exe
  C:\Windows\System\kAPhoRJ.exe
  2⤵
  PID:10520
- C:\Windows\System\qsYlHmK.exe
  C:\Windows\System\qsYlHmK.exe
  2⤵
  PID:10540
- C:\Windows\System\NBhYqRd.exe
  C:\Windows\System\NBhYqRd.exe
  2⤵
  PID:10568
- C:\Windows\System\YmHISYI.exe
  C:\Windows\System\YmHISYI.exe
  2⤵
  PID:10616
- C:\Windows\System\vhxhBNl.exe
  C:\Windows\System\vhxhBNl.exe
  2⤵
  PID:10636
- C:\Windows\System\NgjRJew.exe
  C:\Windows\System\NgjRJew.exe
  2⤵
  PID:10660
- C:\Windows\System\YMJcIYw.exe
  C:\Windows\System\YMJcIYw.exe
  2⤵
  PID:10680
- C:\Windows\System\IPQokhA.exe
  C:\Windows\System\IPQokhA.exe
  2⤵
  PID:10704
- C:\Windows\System\fAPXaod.exe
  C:\Windows\System\fAPXaod.exe
  2⤵
  PID:10728
- C:\Windows\System\CEfiJHo.exe
  C:\Windows\System\CEfiJHo.exe
  2⤵
  PID:10748
- C:\Windows\System\DrPsHwh.exe
  C:\Windows\System\DrPsHwh.exe
  2⤵
  PID:10768
- C:\Windows\System\pQqNvuQ.exe
  C:\Windows\System\pQqNvuQ.exe
  2⤵
  PID:10832
- C:\Windows\System\XhLnQHo.exe
  C:\Windows\System\XhLnQHo.exe
  2⤵
  PID:10856
- C:\Windows\System\zQvcWuw.exe
  C:\Windows\System\zQvcWuw.exe
  2⤵
  PID:10872
- C:\Windows\System\nfDvEwm.exe
  C:\Windows\System\nfDvEwm.exe
  2⤵
  PID:10892
- C:\Windows\System\EhhBBta.exe
  C:\Windows\System\EhhBBta.exe
  2⤵
  PID:10928
- C:\Windows\System\blIvPzm.exe
  C:\Windows\System\blIvPzm.exe
  2⤵
  PID:10952
- C:\Windows\System\FDPCNNT.exe
  C:\Windows\System\FDPCNNT.exe
  2⤵
  PID:10976
- C:\Windows\System\LowkEAR.exe
  C:\Windows\System\LowkEAR.exe
  2⤵
  PID:11000
- C:\Windows\System\RcyadxY.exe
  C:\Windows\System\RcyadxY.exe
  2⤵
  PID:11020
- C:\Windows\System\mYyDzHy.exe
  C:\Windows\System\mYyDzHy.exe
  2⤵
  PID:11052
- C:\Windows\System\RERaJWy.exe
  C:\Windows\System\RERaJWy.exe
  2⤵
  PID:11104
- C:\Windows\System\tBdrVEo.exe
  C:\Windows\System\tBdrVEo.exe
  2⤵
  PID:11152
- C:\Windows\System\cAJbUmx.exe
  C:\Windows\System\cAJbUmx.exe
  2⤵
  PID:11176
- C:\Windows\System\kwYvrdM.exe
  C:\Windows\System\kwYvrdM.exe
  2⤵
  PID:11196
- C:\Windows\System\XygTdFn.exe
  C:\Windows\System\XygTdFn.exe
  2⤵
  PID:11220
- C:\Windows\System\kIjYrfd.exe
  C:\Windows\System\kIjYrfd.exe
  2⤵
  PID:11236
- C:\Windows\System\VArIcRC.exe
  C:\Windows\System\VArIcRC.exe
  2⤵
  PID:11252
- C:\Windows\System\WkOgZHR.exe
  C:\Windows\System\WkOgZHR.exe
  2⤵
  PID:10268
- C:\Windows\System\JrbQxxY.exe
  C:\Windows\System\JrbQxxY.exe
  2⤵
  PID:10336
- C:\Windows\System\pFSgHYw.exe
  C:\Windows\System\pFSgHYw.exe
  2⤵
  PID:10332
- C:\Windows\System\evsijFH.exe
  C:\Windows\System\evsijFH.exe
  2⤵
  PID:10380
- C:\Windows\System\kwpMHkp.exe
  C:\Windows\System\kwpMHkp.exe
  2⤵
  PID:10416
- C:\Windows\System\ddjDXBI.exe
  C:\Windows\System\ddjDXBI.exe
  2⤵
  PID:10592
- C:\Windows\System\fdqPEyu.exe
  C:\Windows\System\fdqPEyu.exe
  2⤵
  PID:10632
- C:\Windows\System\YtFKATs.exe
  C:\Windows\System\YtFKATs.exe
  2⤵
  PID:10696
- C:\Windows\System\pyjpFwt.exe
  C:\Windows\System\pyjpFwt.exe
  2⤵
  PID:10788
- C:\Windows\System\inlHluy.exe
  C:\Windows\System\inlHluy.exe
  2⤵
  PID:10824
- C:\Windows\System\VIOebDG.exe
  C:\Windows\System\VIOebDG.exe
  2⤵
  PID:10864
- C:\Windows\System\HBUftYe.exe
  C:\Windows\System\HBUftYe.exe
  2⤵
  PID:10968
- C:\Windows\System\JnNLosy.exe
  C:\Windows\System\JnNLosy.exe
  2⤵
  PID:11012
- C:\Windows\System\vKsnVTD.exe
  C:\Windows\System\vKsnVTD.exe
  2⤵
  PID:11048
- C:\Windows\System\EUrJjZl.exe
  C:\Windows\System\EUrJjZl.exe
  2⤵
  PID:11136
- C:\Windows\System\jdXYfxQ.exe
  C:\Windows\System\jdXYfxQ.exe
  2⤵
  PID:11212
- C:\Windows\System\GpXWPcN.exe
  C:\Windows\System\GpXWPcN.exe
  2⤵
  PID:11232
- C:\Windows\System\ZQcqBis.exe
  C:\Windows\System\ZQcqBis.exe
  2⤵
  PID:10264
- C:\Windows\System\uxQsyKJ.exe
  C:\Windows\System\uxQsyKJ.exe
  2⤵
  PID:9660
- C:\Windows\System\sxvnZnd.exe
  C:\Windows\System\sxvnZnd.exe
  2⤵
  PID:10536
- C:\Windows\System\LmFhwPm.exe
  C:\Windows\System\LmFhwPm.exe
  2⤵
  PID:10840
- C:\Windows\System\ZNrYWgF.exe
  C:\Windows\System\ZNrYWgF.exe
  2⤵
  PID:10884
- C:\Windows\System\bqKbgVe.exe
  C:\Windows\System\bqKbgVe.exe
  2⤵
  PID:11100
- C:\Windows\System\MUjdTAq.exe
  C:\Windows\System\MUjdTAq.exe
  2⤵
  PID:11244
- C:\Windows\System\XGbLefA.exe
  C:\Windows\System\XGbLefA.exe
  2⤵
  PID:10304
- C:\Windows\System\rOudcZy.exe
  C:\Windows\System\rOudcZy.exe
  2⤵
  PID:10700
- C:\Windows\System\sOpyGYd.exe
  C:\Windows\System\sOpyGYd.exe
  2⤵
  PID:10988
- C:\Windows\System\QhwvJPo.exe
  C:\Windows\System\QhwvJPo.exe
  2⤵
  PID:11228
- C:\Windows\System\cZPaMmJ.exe
  C:\Windows\System\cZPaMmJ.exe
  2⤵
  PID:10924
- C:\Windows\System\vRYWWSF.exe
  C:\Windows\System\vRYWWSF.exe
  2⤵
  PID:10312
- C:\Windows\System\YeGsqoz.exe
  C:\Windows\System\YeGsqoz.exe
  2⤵
  PID:11288
- C:\Windows\System\ZpmNigx.exe
  C:\Windows\System\ZpmNigx.exe
  2⤵
  PID:11324
- C:\Windows\System\sDhhIfQ.exe
  C:\Windows\System\sDhhIfQ.exe
  2⤵
  PID:11348
- C:\Windows\System\KYZNEKv.exe
  C:\Windows\System\KYZNEKv.exe
  2⤵
  PID:11412
- C:\Windows\System\pwnsrYu.exe
  C:\Windows\System\pwnsrYu.exe
  2⤵
  PID:11428
- C:\Windows\System\LnAjamP.exe
  C:\Windows\System\LnAjamP.exe
  2⤵
  PID:11448
- C:\Windows\System\pDwOuKE.exe
  C:\Windows\System\pDwOuKE.exe
  2⤵
  PID:11468
- C:\Windows\System\OdybAHX.exe
  C:\Windows\System\OdybAHX.exe
  2⤵
  PID:11492
- C:\Windows\System\WXcuGQK.exe
  C:\Windows\System\WXcuGQK.exe
  2⤵
  PID:11516
- C:\Windows\System\uQmvqqd.exe
  C:\Windows\System\uQmvqqd.exe
  2⤵
  PID:11536
- C:\Windows\System\dqYRRdm.exe
  C:\Windows\System\dqYRRdm.exe
  2⤵
  PID:11568
- C:\Windows\System\HorkEBq.exe
  C:\Windows\System\HorkEBq.exe
  2⤵
  PID:11640
- C:\Windows\System\vgxjhyj.exe
  C:\Windows\System\vgxjhyj.exe
  2⤵
  PID:11660
- C:\Windows\System\dWYcQfZ.exe
  C:\Windows\System\dWYcQfZ.exe
  2⤵
  PID:11680
- C:\Windows\System\thJGyPE.exe
  C:\Windows\System\thJGyPE.exe
  2⤵
  PID:11708
- C:\Windows\System\sPBDovR.exe
  C:\Windows\System\sPBDovR.exe
  2⤵
  PID:11740
- C:\Windows\System\tIIsVuo.exe
  C:\Windows\System\tIIsVuo.exe
  2⤵
  PID:11768
- C:\Windows\System\impSzLs.exe
  C:\Windows\System\impSzLs.exe
  2⤵
  PID:11792
- C:\Windows\System\cgrunRM.exe
  C:\Windows\System\cgrunRM.exe
  2⤵
  PID:11812
- C:\Windows\System\eMAGwtL.exe
  C:\Windows\System\eMAGwtL.exe
  2⤵
  PID:11844
- C:\Windows\System\KJTDTTs.exe
  C:\Windows\System\KJTDTTs.exe
  2⤵
  PID:11892
- C:\Windows\System\FAQCOTl.exe
  C:\Windows\System\FAQCOTl.exe
  2⤵
  PID:11916
- C:\Windows\System\iAAKJok.exe
  C:\Windows\System\iAAKJok.exe
  2⤵
  PID:11944
- C:\Windows\System\SzUqziH.exe
  C:\Windows\System\SzUqziH.exe
  2⤵
  PID:11968
- C:\Windows\System\lqDCTbl.exe
  C:\Windows\System\lqDCTbl.exe
  2⤵
  PID:11988
- C:\Windows\System\RacfxLK.exe
  C:\Windows\System\RacfxLK.exe
  2⤵
  PID:12024
- C:\Windows\System\sYtmgPd.exe
  C:\Windows\System\sYtmgPd.exe
  2⤵
  PID:12060
- C:\Windows\System\IkCLtFk.exe
  C:\Windows\System\IkCLtFk.exe
  2⤵
  PID:12076
- C:\Windows\System\RglHSdP.exe
  C:\Windows\System\RglHSdP.exe
  2⤵
  PID:12100
- C:\Windows\System\GmEMlyv.exe
  C:\Windows\System\GmEMlyv.exe
  2⤵
  PID:12120
- C:\Windows\System\QDtlklw.exe
  C:\Windows\System\QDtlklw.exe
  2⤵
  PID:12184
- C:\Windows\System\WeapMOr.exe
  C:\Windows\System\WeapMOr.exe
  2⤵
  PID:12216
- C:\Windows\System\pJneyIt.exe
  C:\Windows\System\pJneyIt.exe
  2⤵
  PID:12248
- C:\Windows\System\nIqLTJC.exe
  C:\Windows\System\nIqLTJC.exe
  2⤵
  PID:12268
- C:\Windows\System\XDOqnZs.exe
  C:\Windows\System\XDOqnZs.exe
  2⤵
  PID:11128
- C:\Windows\System\jnjektM.exe
  C:\Windows\System\jnjektM.exe
  2⤵
  PID:11296
- C:\Windows\System\cgOIPJh.exe
  C:\Windows\System\cgOIPJh.exe
  2⤵
  PID:11316
- C:\Windows\System\MPQzTIt.exe
  C:\Windows\System\MPQzTIt.exe
  2⤵
  PID:11380
- C:\Windows\System\aRpNbza.exe
  C:\Windows\System\aRpNbza.exe
  2⤵
  PID:11456
- C:\Windows\System\THXUSkJ.exe
  C:\Windows\System\THXUSkJ.exe
  2⤵
  PID:11488
- C:\Windows\System\aVPKXvq.exe
  C:\Windows\System\aVPKXvq.exe
  2⤵
  PID:11620
- C:\Windows\System\HIifCDY.exe
  C:\Windows\System\HIifCDY.exe
  2⤵
  PID:11672
- C:\Windows\System\IELjJFL.exe
  C:\Windows\System\IELjJFL.exe
  2⤵
  PID:11756
- C:\Windows\System\BMaxTTG.exe
  C:\Windows\System\BMaxTTG.exe
  2⤵
  PID:11800
- C:\Windows\System\XTpicBJ.exe
  C:\Windows\System\XTpicBJ.exe
  2⤵
  PID:11872
- C:\Windows\System\yfszkRm.exe
  C:\Windows\System\yfszkRm.exe
  2⤵
  PID:11936
- C:\Windows\System\iMrzsfh.exe
  C:\Windows\System\iMrzsfh.exe
  2⤵
  PID:12040
- C:\Windows\System\dpiyqLV.exe
  C:\Windows\System\dpiyqLV.exe
  2⤵
  PID:12148
- C:\Windows\System\KZBXlom.exe
  C:\Windows\System\KZBXlom.exe
  2⤵
  PID:12192
- C:\Windows\System\TehyQed.exe
  C:\Windows\System\TehyQed.exe
  2⤵
  PID:12260
- C:\Windows\System\JGxVJcd.exe
  C:\Windows\System\JGxVJcd.exe
  2⤵
  PID:10920
- C:\Windows\System\YHNxXhn.exe
  C:\Windows\System\YHNxXhn.exe
  2⤵
  PID:11436
- C:\Windows\System\uDezuIG.exe
  C:\Windows\System\uDezuIG.exe
  2⤵
  PID:11484
- C:\Windows\System\twPaUtu.exe
  C:\Windows\System\twPaUtu.exe
  2⤵
  PID:11724
- C:\Windows\System\PWuLgio.exe
  C:\Windows\System\PWuLgio.exe
  2⤵
  PID:11880
- C:\Windows\System\XTTwEsB.exe
  C:\Windows\System\XTTwEsB.exe
  2⤵
  PID:11984
- C:\Windows\System\GhvOSfa.exe
  C:\Windows\System\GhvOSfa.exe
  2⤵
  PID:12108
- C:\Windows\System\lzGSZwe.exe
  C:\Windows\System\lzGSZwe.exe
  2⤵
  PID:11332
- C:\Windows\System\tmCLsvY.exe
  C:\Windows\System\tmCLsvY.exe
  2⤵
  PID:11964
- C:\Windows\System\HuRaSmT.exe
  C:\Windows\System\HuRaSmT.exe
  2⤵
  PID:11628
- C:\Windows\System\bvOYrIY.exe
  C:\Windows\System\bvOYrIY.exe
  2⤵
  PID:12276
- C:\Windows\System\dchFkXZ.exe
  C:\Windows\System\dchFkXZ.exe
  2⤵
  PID:11700
- C:\Windows\System\vmYhtOh.exe
  C:\Windows\System\vmYhtOh.exe
  2⤵
  PID:12324
- C:\Windows\System\etraKYr.exe
  C:\Windows\System\etraKYr.exe
  2⤵
  PID:12348
- C:\Windows\System\QBrUmmF.exe
  C:\Windows\System\QBrUmmF.exe
  2⤵
  PID:12388
- C:\Windows\System\xQKFFIR.exe
  C:\Windows\System\xQKFFIR.exe
  2⤵
  PID:12412
- C:\Windows\System\QnYglUf.exe
  C:\Windows\System\QnYglUf.exe
  2⤵
  PID:12432
- C:\Windows\System\nXVgPtw.exe
  C:\Windows\System\nXVgPtw.exe
  2⤵
  PID:12456
- C:\Windows\System\tYMHdvZ.exe
  C:\Windows\System\tYMHdvZ.exe
  2⤵
  PID:12496
- C:\Windows\System\xzhaEar.exe
  C:\Windows\System\xzhaEar.exe
  2⤵
  PID:12520
- C:\Windows\System\wFlxgmj.exe
  C:\Windows\System\wFlxgmj.exe
  2⤵
  PID:12544
- C:\Windows\System\TxYMWxg.exe
  C:\Windows\System\TxYMWxg.exe
  2⤵
  PID:12564
- C:\Windows\System\gkoWAMa.exe
  C:\Windows\System\gkoWAMa.exe
  2⤵
  PID:12580
- C:\Windows\System\nRVEKkE.exe
  C:\Windows\System\nRVEKkE.exe
  2⤵
  PID:12624
- C:\Windows\System\dYZeGjF.exe
  C:\Windows\System\dYZeGjF.exe
  2⤵
  PID:12648
- C:\Windows\System\jKSFQbK.exe
  C:\Windows\System\jKSFQbK.exe
  2⤵
  PID:12680
- C:\Windows\System\BmskrPw.exe
  C:\Windows\System\BmskrPw.exe
  2⤵
  PID:12704
- C:\Windows\System\SCmlKfF.exe
  C:\Windows\System\SCmlKfF.exe
  2⤵
  PID:12728
- C:\Windows\System\IhDbmWb.exe
  C:\Windows\System\IhDbmWb.exe
  2⤵
  PID:12760
- C:\Windows\System\eqjVOYI.exe
  C:\Windows\System\eqjVOYI.exe
  2⤵
  PID:12792
- C:\Windows\System\PZGQImu.exe
  C:\Windows\System\PZGQImu.exe
  2⤵
  PID:12808
- C:\Windows\System\qFvFkYl.exe
  C:\Windows\System\qFvFkYl.exe
  2⤵
  PID:12868
- C:\Windows\System\xjnqcwD.exe
  C:\Windows\System\xjnqcwD.exe
  2⤵
  PID:12932
- C:\Windows\System\DtwOWgP.exe
  C:\Windows\System\DtwOWgP.exe
  2⤵
  PID:12964
- C:\Windows\System\LkyFxTz.exe
  C:\Windows\System\LkyFxTz.exe
  2⤵
  PID:12988
- C:\Windows\System\WqoHFeD.exe
  C:\Windows\System\WqoHFeD.exe
  2⤵
  PID:13008
- C:\Windows\System\TcrMHEk.exe
  C:\Windows\System\TcrMHEk.exe
  2⤵
  PID:13032
- C:\Windows\System\igDvUEO.exe
  C:\Windows\System\igDvUEO.exe
  2⤵
  PID:13052
- C:\Windows\System\yIvQbDU.exe
  C:\Windows\System\yIvQbDU.exe
  2⤵
  PID:13108
- C:\Windows\System\quYjxMN.exe
  C:\Windows\System\quYjxMN.exe
  2⤵
  PID:13128
- C:\Windows\System\yodVroW.exe
  C:\Windows\System\yodVroW.exe
  2⤵
  PID:13164
- C:\Windows\System\WRDLQkY.exe
  C:\Windows\System\WRDLQkY.exe
  2⤵
  PID:13184
- C:\Windows\System\UAlVCFv.exe
  C:\Windows\System\UAlVCFv.exe
  2⤵
  PID:13208
- C:\Windows\System\JfQiHso.exe
  C:\Windows\System\JfQiHso.exe
  2⤵
  PID:13224
- C:\Windows\System\aXiiFBM.exe
  C:\Windows\System\aXiiFBM.exe
  2⤵
  PID:13276
- C:\Windows\System\FmSbZVj.exe
  C:\Windows\System\FmSbZVj.exe
  2⤵
  PID:13300
- C:\Windows\System\uYRQLbl.exe
  C:\Windows\System\uYRQLbl.exe
  2⤵
  PID:12316
- C:\Windows\System\DGNYSwq.exe
  C:\Windows\System\DGNYSwq.exe
  2⤵
  PID:12344
- C:\Windows\System\dNrdyMe.exe
  C:\Windows\System\dNrdyMe.exe
  2⤵
  PID:12400
- C:\Windows\System\LACyMgV.exe
  C:\Windows\System\LACyMgV.exe
  2⤵
  PID:12444
- C:\Windows\System\NEkXAqa.exe
  C:\Windows\System\NEkXAqa.exe
  2⤵
  PID:12512
- C:\Windows\System\muawOcD.exe
  C:\Windows\System\muawOcD.exe
  2⤵
  PID:12600
- C:\Windows\System\LDrnbdA.exe
  C:\Windows\System\LDrnbdA.exe
  2⤵
  PID:12696
- C:\Windows\System\GlVODJJ.exe
  C:\Windows\System\GlVODJJ.exe
  2⤵
  PID:12768
- C:\Windows\System\eJhKgCi.exe
  C:\Windows\System\eJhKgCi.exe
  2⤵
  PID:12784
- C:\Windows\System\VJfQEil.exe
  C:\Windows\System\VJfQEil.exe
  2⤵
  PID:12908
- C:\Windows\System\LxUPYng.exe
  C:\Windows\System\LxUPYng.exe
  2⤵
  PID:12896
- C:\Windows\System\SieOgPw.exe
  C:\Windows\System\SieOgPw.exe
  2⤵
  PID:12912
- C:\Windows\System\cUkMiKq.exe
  C:\Windows\System\cUkMiKq.exe
  2⤵
  PID:12952
- C:\Windows\System\NoQwFwC.exe
  C:\Windows\System\NoQwFwC.exe
  2⤵
  PID:13020
- C:\Windows\System\MudGzWd.exe
  C:\Windows\System\MudGzWd.exe
  2⤵
  PID:13140
- C:\Windows\System\fcpXMRe.exe
  C:\Windows\System\fcpXMRe.exe
  2⤵
  PID:13192
- C:\Windows\System\oNTtyYt.exe
  C:\Windows\System\oNTtyYt.exe
  2⤵
  PID:13216
- C:\Windows\System\ekzTsKa.exe
  C:\Windows\System\ekzTsKa.exe
  2⤵
  PID:13244
- C:\Windows\System\YaltxOc.exe
  C:\Windows\System\YaltxOc.exe
  2⤵
  PID:11280
- C:\Windows\System\EGdDSHM.exe
  C:\Windows\System\EGdDSHM.exe
  2⤵
  PID:12668
- C:\Windows\System\QPaAbEY.exe
  C:\Windows\System\QPaAbEY.exe
  2⤵
  PID:12836
- C:\Windows\System\aSXCYlh.exe
  C:\Windows\System\aSXCYlh.exe
  2⤵
  PID:13080
- C:\Windows\System\pDSdIQO.exe
  C:\Windows\System\pDSdIQO.exe
  2⤵
  PID:13180
- C:\Windows\System\iNplIeU.exe
  C:\Windows\System\iNplIeU.exe
  2⤵
  PID:13260
- C:\Windows\System\KZKheWw.exe
  C:\Windows\System\KZKheWw.exe
  2⤵
  PID:13292
- C:\Windows\System\AoIpLzo.exe
  C:\Windows\System\AoIpLzo.exe
  2⤵
  PID:12740
- C:\Windows\System\HubVQZj.exe
  C:\Windows\System\HubVQZj.exe
  2⤵
  PID:13256
- C:\Windows\System\iYjRTyp.exe
  C:\Windows\System\iYjRTyp.exe
  2⤵
  PID:12488
- C:\Windows\System\wudIgcs.exe
  C:\Windows\System\wudIgcs.exe
  2⤵
  PID:13148
- C:\Windows\System\uzAryQO.exe
  C:\Windows\System\uzAryQO.exe
  2⤵
  PID:13316
- C:\Windows\System\cFsUKui.exe
  C:\Windows\System\cFsUKui.exe
  2⤵
  PID:13336
- C:\Windows\System\KlXuYkE.exe
  C:\Windows\System\KlXuYkE.exe
  2⤵
  PID:13360
- C:\Windows\System\hNRJpGq.exe
  C:\Windows\System\hNRJpGq.exe
  2⤵
  PID:13380
- C:\Windows\System\VswkZPa.exe
  C:\Windows\System\VswkZPa.exe
  2⤵
  PID:13404
- C:\Windows\System\zMjTXqg.exe
  C:\Windows\System\zMjTXqg.exe
  2⤵
  PID:13448
- C:\Windows\System\yfEdXtC.exe
  C:\Windows\System\yfEdXtC.exe
  2⤵
  PID:13496
- C:\Windows\System\fxcJwit.exe
  C:\Windows\System\fxcJwit.exe
  2⤵
  PID:13524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oz4s3itp.5yi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AJuqTpc.exe

Filesize
2.1MB

MD5
ba37aee62bbdf6a9a2c275c622ce9f62

SHA1
740b92c78e2e522f1afec3e5f5ff038b303a641f

SHA256
c0c8b2d74e540da85f642c87be6a11cbab8b94da1a4da38f86895f963ab7b3e3

SHA512
88580648a347f50102a3381fe48ebee94e8f751dd36e9b352f0fbd49d8f6d2f646ccc1cca18e9ae774baf7b94d2de3cd5cc1180e7952f0fdb084d558bbfe7819

Download Submit
C:\Windows\System\ANzvHBc.exe

Filesize
2.1MB

MD5
5e5622fa41b9fbdb5ae050f3e451ef1e

SHA1
30c88bef6a19230a7c8e379e8e73b5c238030492

SHA256
6a0465c4478dd627163018ce4d1198ca958a6346890881a2699bdf3c9d1364fe

SHA512
29106742440e0ce264bf73eeff2c706d46b027e47fa1c11a17c0db9ffbfb3640aabe261d865a6f1d8dfcd63a18605b28532256495eb5890cde8e832406474d39

Download Submit
C:\Windows\System\BbyzNjy.exe

Filesize
2.1MB

MD5
93483cc620811a373e63afc2508d3087

SHA1
c0e815efd94eaad65be07c8f2cfe956b6a2ab512

SHA256
d2e803e08b04e35e7dc093b6a8f26e78c5e15420b6939f457dab21de96fd24b0

SHA512
85e26d51ec7b5d7fb2b51b331522f017766a0ed6d6763e8ab4cee4168614c41b506310c4318c538d44642f28a66a49b4d4780568ee927879c010a725f2efa958

Download Submit
C:\Windows\System\DqCfkov.exe

Filesize
2.1MB

MD5
c51f5dbf71f00011116e2c586b6077b2

SHA1
8b91fd2711545f51671547511e19536e2b6cbd9e

SHA256
f575835a1d18df84d232e2f9745531305f28f63b9620b65eea058140e071cf87

SHA512
c669a3f7d298e31e742e83fad953db1d18ae46f45a1b812a75a17f28fbf250b58ab7df7a66b94a230f88d94f21b2a38b563d0391cb743b7ef13e9d119e3b9798

Download Submit
C:\Windows\System\HiAQcbX.exe

Filesize
2.1MB

MD5
08ccb0aac417218d416a82b480154845

SHA1
d2ebe9a4a265ecda9da3f58ce34c4b36c5e227e1

SHA256
5c7fc5ed929f823c4bfa016f3be2ef7a46330e09c887133c2b248bdd2bc16473

SHA512
6a0fd2e173bdc2d1b6f800ef005475a8710410b4b9c08185131a3efc299530207b947c962619437cc1f5f8b1fe158184d91a5ee80fb2824019b1f5eef147b4a3

Download Submit
C:\Windows\System\IGyNQNs.exe

Filesize
2.1MB

MD5
58efa15b2bcdb759c16b1fac797a7aeb

SHA1
c60d4bcebf90068a7c02cfaa0d9185589f0e970b

SHA256
6e0ad47784cd5b4c08de2e176fa0101c2169e0b66223b6ac5fa38c7cbca0aef2

SHA512
b0558e156c5ebf47dbdcf90f8fd364fd9100fd50342c068a3f27d318ee154edb592bd73085a753bcb95accf0178a50db431bc094e56c9d46d9c02ce8ca1ec540

Download Submit
C:\Windows\System\IUGEijL.exe

Filesize
2.1MB

MD5
e22ef477aeeb13a0d87087cfd66fee42

SHA1
f8ab38037e76d6d9d3d39a6f286da15dcd0725a4

SHA256
0cf17de970b10915883735e4bf98a70141adadc5f6e6dc582a02080d81d73d7e

SHA512
7da3d3d4f4e9299790c8a2f3fefb222a3b97ec3502d61a8140ab535eec376bf9b6c467efbe5f6c46ecb8954d7fa77e92d99f61f719627840fa667249586bfd7f

Download Submit
C:\Windows\System\JdxJarX.exe

Filesize
2.1MB

MD5
475dec51010a2752c998a5ec6417a317

SHA1
d00ec6a09bae70e9404cecd087e7657f02792e3a

SHA256
f7d5dfb60334dae68cb59881c471429e6c4a9f24492074fd0b948499e11effcd

SHA512
621165e6a1e841de5cacdd337ec7f658cce34b2c33eab0ad5f5bdcd248e0682f78dd28cf402207cbdedc83c59ad3c0c46ec8237b90414b03ef1410b50ac90998

Download Submit
C:\Windows\System\KEQJTgy.exe

Filesize
2.1MB

MD5
0627cc1c2d98fd592c9d6fa1179acd0e

SHA1
92e39b0d42223ba55b5f4125b5af86ce0399500b

SHA256
d44e2aef19a2bbe13771a0668b997fbffa81cff0138dddec33d5bb972d3c34b9

SHA512
3b5aa2e1744ea43edb012edf3dc001af7e7473b0e3a68e55af4bc57c54e9dc867d97ad96fc337e87ccd76bafa28b2587fc704f5ef9c853656dd4cecb361dd8d6

Download Submit
C:\Windows\System\KFRFVLI.exe

Filesize
2.1MB

MD5
fa537ffa01b14fb6ad768297833ea4e7

SHA1
28f664d564ab184744ce91db30bd42d20bf206c9

SHA256
da733ae66fde8c018a34725b890298fd4561a4e76429d3e0a88de2e3042670ab

SHA512
c8b57bafc3dc1ac5dcfd238792a7d6345e0a6f120e8f1a36e826502550121cbef119804b6e5cf0aec92ba0bd15d0bf1788270735b32183c3214ec6ce6e850eb6

Download Submit
C:\Windows\System\LNOqiEb.exe

Filesize
2.1MB

MD5
52a476af0e24f9707059b16dd1a44202

SHA1
498f6b487ec7e6588551d0c529b0c4130b0b6923

SHA256
89a5e06a4a97b56a4e79b2e49555176d4a09590bd2298fbce1530ca32eb0b3e7

SHA512
10578374c2ab20ceedd1251b3bb598478455894aae0c23d5741df988b5bdc04b69957d2de5e29b8e008bc2f7b14ced409bf7447ca3c3ccd1f1fdbb8164aeaca6

Download Submit
C:\Windows\System\OSdXBMm.exe

Filesize
2.1MB

MD5
d17fd93f4e1a7c418ac10557ec7a6aac

SHA1
72134c9c0971352edaee015e3ad8ff9e4188f703

SHA256
ab24a4b717bf8378377ca00eff40c734a8332a51982702c7d8799a9c0fab361c

SHA512
45b3608a26da63746fc4dca9d0548f27b65e4512686ac7831e3f5c6d7155e943730b31e715d0e1af2df929ab06241d4ec7d6b242e2ddd8dddeb125152f424bac

Download Submit
C:\Windows\System\PtISHWa.exe

Filesize
2.1MB

MD5
98a96e3510b1037bfb0e17e7d9ae7f08

SHA1
a0d0a8051bc06fd2e1ba6bff9195bba07406c573

SHA256
22bc4740a1df6915df781090182cbbdf323ce67874e9e735becefa5c3d87b326

SHA512
ec936d5484ee30c199f4f2b6edbc117bb2c8d1b3b564936842174b8a0603070c01397427695b37f5ec77e3f2c23d3f058a0700d07dd194096131c079cc13dede

Download Submit
C:\Windows\System\QOmisdy.exe

Filesize
2.1MB

MD5
c456702ad9d0123243da8be529943c6e

SHA1
ae1fd3e9847cecb38b9a3c225dde4efec0965c9a

SHA256
a28835b9bb838595966786d76567981643430b0200bcc07e335b76af9c4015e2

SHA512
f8deed449962d26d294cd2f0333358a238bb42ba3c19087426b23213a353a77dcb15e60bad58d6b5e562ab5abae0df08b7f72cd5fac32c4e5cd8ebabba9892d5

Download Submit
C:\Windows\System\SpAqLMV.exe

Filesize
2.1MB

MD5
3ca31daa044de96fad7aa05d77bf3e00

SHA1
5ef8a0517d3113c8d7214dfd6472b651cc92534f

SHA256
c754ed2a70887ff870038e671bf8883b27748b0d1829c5b90a3b8ecbdb7ccb38

SHA512
51641217dde114459953a106a8a7cf4161a0296da4931974d311bd333bea6ad20194039292fd39a773c1a143796a98d4f0593a0877fcea6186c36fe527c95f5a

Download Submit
C:\Windows\System\UcQvLLd.exe

Filesize
2.1MB

MD5
2d5e3f911b8f6ece2f201ea338a52d73

SHA1
cdceed130442fdafb2728e470651ab2404744f34

SHA256
8f51734dddcfba17591602b7b00798676708dfb27cdf1c2a8171a6cd174f8fb4

SHA512
5e551556052f88c117a29f71976d30eab686815b29093cc250213171dd5a622e9cc223630ccbcd1f35677744aa8e2cb01ff8e984739f442cf8ac7abe539f9679

Download Submit
C:\Windows\System\UcWLlDo.exe

Filesize
2.1MB

MD5
468b56b49771e058e1e21e6282ff2871

SHA1
aa4a78892d0ebfc925d48651ec34b2d474a6c79d

SHA256
1c2fe9af38ecdc09d81f9bc056561e5c37f202f9e422aa4b61f2f947748a8fb6

SHA512
725a88c36663a0f3ac88884151e69c3c06cd2b560bb4dd35bb86d4aaf6da769e5d60d6e1902e94e0d9af98dc36739eed1fc17c04218a5c7ecdc032a20055220b

Download Submit
C:\Windows\System\bGpupBD.exe

Filesize
2.1MB

MD5
92d23b36c5e8bd75d82fc5a47d1041b2

SHA1
1722bafc93e706b37a6b21111fe947d18e1023e3

SHA256
51c534a6f346c4437a4d96c12a1c72886f2acb8876052bfb6bbe10a6e0866815

SHA512
76c51783b4e3dff0756a4dc0a89e51f84aa691252d88f388bf94c493b52e2f9ca8c4b4eb4f18f1fe0f90b273bd7cd58a3d0f7a7bcf05d413cd3aa548aada63cf

Download Submit
C:\Windows\System\clfQsUG.exe

Filesize
2.1MB

MD5
9301d92848f7c704bc2664b59ba4396c

SHA1
13801fc0e364cbd408f153978fdf45b13319c50b

SHA256
e93d6870a7ebb905fcecec24d3c6e4fac11c08b148a65659eeb2903fedccba45

SHA512
b5f5d68cd206af7a595a8a2e7cbd5f602a5d1af317d5cb2ef275f4768f0786ee057909c6564a4d5dab5929b9c22ddf7fe5cc0e424ef8d66e4ea66d95f515298d

Download Submit
C:\Windows\System\dUmvQTW.exe

Filesize
2.1MB

MD5
93e53c5b3aee1929e652f78e47672ed9

SHA1
433f31cb17ec92f825840a007f24059c287d5a7b

SHA256
4d6ffb345ba1f8b7c308b2a2586cf4b0c8d6f602508e1fff56f870ff022a0b43

SHA512
984f401a3a2962020702497b94e41be2057013b80648e5a787c58f8b68129bc209d07deeb0452892b650e2755268e201f418cf1ec82859f9828a274bc0861265

Download Submit
C:\Windows\System\dVUVdLZ.exe

Filesize
2.1MB

MD5
51e444c6fbc1d2d39a3b6286cb53a626

SHA1
d2c116022be331616a6fc7003794c761628b164a

SHA256
f0cbdbf7249070d4eb982d8a9b0ffce456ae799f2a2b4ffbb4e1e706bca737e4

SHA512
44f08c9ce2431fd7eab8b56b4630029bc6de1d3a490805eb600f43672648c9d13552b348a1f009c665a26f2aadf7c1000416941ad3c45ab9479898ee87e0546c

Download Submit
C:\Windows\System\eJufleO.exe

Filesize
2.1MB

MD5
a02e0a0b9a00f7f17cbe5d3a873db813

SHA1
d10e5fa9edca5f5c9d2689d5dcd976e6ef344050

SHA256
e0810c175b0074caba15926162717d43d1e60389490f6b2a2c2073f72199986e

SHA512
d9fd8e2f2138db64027b7c9723cc25279c755ca552b6128dd9fbe0cd1a7d11e188332d0f948347e2730cc27cda123a740d9a78eff037b99dd4a842b16079bfb7

Download Submit
C:\Windows\System\fOSPtSh.exe

Filesize
2.1MB

MD5
f76c11f1157f978a3ffe0934f09d51e7

SHA1
801ee53b9d18b30984fba14bd459f2f3459e421d

SHA256
9cd901b2904b9b0bcd4c5a39440aa2f5bb0cbcb20717d03806422233026895ff

SHA512
1d0bfc10771068a918a922bb5b518bb9a4aa7bd67f21a4e6f6ff0c2598f633dabcee3c8c7956c8e8ac61c7866c22b8a7dbf898485abc8bbd24001884d0799ccf

Download Submit
C:\Windows\System\hBZCBTo.exe

Filesize
2.1MB

MD5
66c3c11025773c8a0bcd71a8c6bb5e69

SHA1
a90f0afa5bc0bd7049c4d680d9e74021fcb39407

SHA256
6a704955e0c80a4a6ceb551cf7ffda22b125de0a9719ac3571858725a03ee851

SHA512
cf09a18105d0fef1940acea123d887cb25a1e3b2a58411ed46f8d2367d60c3f1dd3ee5c1dc43fc38ae4e84356241c35b7b626b20126dcd08ecbc72d33f232f7c

Download Submit
C:\Windows\System\hjwLeFI.exe

Filesize
2.1MB

MD5
1347db9586decb32c7b7af1d19282711

SHA1
e10c80076a873adaa642266d9784067b0ed35697

SHA256
acf4afa9034b389fc6987c9abd6f58db7a24001fe119bfa09398591dd5ef0d30

SHA512
376fd36502dd2e9dfed2d2f5f195f8546e1034289a2c6ac3a0d6edf42d89a31b1baad4827b5709c87dff81e06108e44a5bcb3491a2a3de11759fc212e8e801c6

Download Submit
C:\Windows\System\kNRJEgl.exe

Filesize
2.1MB

MD5
2bcb6729f994ca3c1003ce9df088b590

SHA1
b479235719686373a9d1b0dff13cd6ba04da27de

SHA256
91a54a7534388539deda255f7447e3c83df20523d6d85f2e4bcaa7b2b9437f9d

SHA512
ac5df21f1395c97f839c5ffdd4dec9f0633c04205f251b8834d82d6b2d6f5969280f83863614c662d8915aea6fbb9570dae474b52c3fe3d4600b782ecf544b57

Download Submit
C:\Windows\System\kmcWaiC.exe

Filesize
2.1MB

MD5
56366fb8d36b7020d9f04b776fc97b07

SHA1
1b6248a6e9572ce896fb09c220564096672e5e7f

SHA256
d594e77af69f995c9a3489ea33967e59f7a8792fb678d59581235cc065e6b1d2

SHA512
f58007858d033d1e900e258fd640d1b64f9c87e63c1762d2790409bada4599dc0267eeefbbbd8e6e0376f7331a027a1d2f422f85b45f02cc064fcbbd41528277

Download Submit
C:\Windows\System\ktANVWu.exe

Filesize
2.1MB

MD5
e77218eefa8e1c63666d6224d2f8a331

SHA1
9dfc3bbd60da788725edea9a1e7735f99a2365ef

SHA256
9c3941c55fb335e69891d36ab6f04cb1b33c43d7faaae4817311054bdc44422b

SHA512
ccd34b7700efdfd35877554394ed8c54086d6d6dc1bb603701316fe27c45c0de85ac6c5f1b81520137f30f9632f6db45bbf54aa381f265d87c46172df73e5c60

Download Submit
C:\Windows\System\nOCUSIp.exe

Filesize
2.1MB

MD5
ce54639c91d27eadf12e6291d02d72cb

SHA1
1586d7eb9f459394be6ca43df0eaa074e800d680

SHA256
e4f8b775bc2a66e3fe2865e3c9fe5fad8853a2596a684812e0f3b3594578700c

SHA512
32786a6c63a8c89e47de3e7aa1010b126fe01fdb817e5fb172e4b11c13ef8a5b0e01efbbcf97a1ad33a7c59067f0665403df8e70423350dd161e0e0731f4bd96

Download Submit
C:\Windows\System\oexmxmn.exe

Filesize
2.1MB

MD5
8ba23c8559392df37280239bb9bde148

SHA1
51133f8b43a37d433716c5ff1cdc55196e36c57e

SHA256
32d5d8be3c3221757d5b6ab23dd7f1e6857c5fbac92baabbce2dc19717835c2f

SHA512
d1589c72440a30f7ce8f63dc36c3ed6b5961e4ad90871cb1362850a785785b0cfa920d6570f990d2d53b56777af3c1a632e59ad6e7964b0d108d007a78624e9f

Download Submit
C:\Windows\System\pGTbCDg.exe

Filesize
2.1MB

MD5
33ebf97475e98cfd2f4989d26863b4bd

SHA1
1bc44bf7209ac1ec3d2b44e4238a2bc7299c553f

SHA256
6c22aa2627dbbe9287da47397d8572019bb3f3999a5a84ab782bf17a9ba3c3cc

SHA512
bf54e8739a58257b42fb3012c412a47ab6c20bd3ed20270cfaaf7a7a33db8b63ea5a22014d8d8680057a43c685c0c68b6876204031a20d619a6df22dc36e74a4

Download Submit
C:\Windows\System\qqgsajf.exe

Filesize
2.1MB

MD5
9a2966d0bafbf92499f62ad9a78e55c1

SHA1
ac3ff969ea4a748b3f3d370e9529e2e1ccd72d20

SHA256
8011aa561f2fd5aade99738e7f9b940fe1de9bab9fdba63ee16fe6392506616f

SHA512
1d1f1bc6356cee92c55cfb349382e32ddeee5e597afc909d8eb3e5388206e51dae42e164b8159b8a9237ce40649653a980bf982b7a2748d1db096bb27789f1f9

Download Submit
C:\Windows\System\xoqeung.exe

Filesize
2.1MB

MD5
76fb7a2f046a370a872ebba92eb65ffb

SHA1
f6acadde20de7347a73cf7106223ac6e7468c319

SHA256
5c88b1fc788d1deec27cf972b79e7c4d41b7900d02c1baed166f89169c157457

SHA512
065d473210a2719d81f0fdfc12384740267c9213a1aa5c604b4cb39fd889a4d26a9163e3f1cbc276eacf4f1547413af30578850cc4cf6d9987e561d2e619b44e

Download Submit
memory/376-177-0x00007FF7C72C0000-0x00007FF7C76B2000-memory.dmp

Filesize
3.9MB

Download
memory/376-2540-0x00007FF7C72C0000-0x00007FF7C76B2000-memory.dmp

Filesize
3.9MB

Download
memory/400-2515-0x00007FF63B490000-0x00007FF63B882000-memory.dmp

Filesize
3.9MB

Download
memory/400-140-0x00007FF63B490000-0x00007FF63B882000-memory.dmp

Filesize
3.9MB

Download
memory/776-102-0x00007FF73C230000-0x00007FF73C622000-memory.dmp

Filesize
3.9MB

Download
memory/776-2510-0x00007FF73C230000-0x00007FF73C622000-memory.dmp

Filesize
3.9MB

Download
memory/920-111-0x00007FF678CB0000-0x00007FF6790A2000-memory.dmp

Filesize
3.9MB

Download
memory/920-2511-0x00007FF678CB0000-0x00007FF6790A2000-memory.dmp

Filesize
3.9MB

Download
memory/996-103-0x00007FF620630000-0x00007FF620A22000-memory.dmp

Filesize
3.9MB

Download
memory/996-2445-0x00007FF620630000-0x00007FF620A22000-memory.dmp

Filesize
3.9MB

Download
memory/1140-2405-0x00007FFD204F0000-0x00007FFD20FB1000-memory.dmp

Filesize
10.8MB

Download
memory/1140-5-0x00007FFD204F3000-0x00007FFD204F5000-memory.dmp

Filesize
8KB

Download
memory/1140-1223-0x00007FFD204F3000-0x00007FFD204F5000-memory.dmp

Filesize
8KB

Download
memory/1140-1104-0x00007FFD204F0000-0x00007FFD20FB1000-memory.dmp

Filesize
10.8MB

Download
memory/1140-378-0x000001AA73B00000-0x000001AA742A6000-memory.dmp

Filesize
7.6MB

Download
memory/1140-35-0x000001AA72EB0000-0x000001AA72ED2000-memory.dmp

Filesize
136KB

Download
memory/1140-52-0x00007FFD204F0000-0x00007FFD20FB1000-memory.dmp

Filesize
10.8MB

Download
memory/1140-33-0x00007FFD204F0000-0x00007FFD20FB1000-memory.dmp

Filesize
10.8MB

Download
memory/1428-98-0x00007FF712240000-0x00007FF712632000-memory.dmp

Filesize
3.9MB

Download
memory/1428-2488-0x00007FF712240000-0x00007FF712632000-memory.dmp

Filesize
3.9MB

Download
memory/1484-133-0x00007FF77C020000-0x00007FF77C412000-memory.dmp

Filesize
3.9MB

Download
memory/1484-2504-0x00007FF77C020000-0x00007FF77C412000-memory.dmp

Filesize
3.9MB

Download
memory/1532-2508-0x00007FF7D8490000-0x00007FF7D8882000-memory.dmp

Filesize
3.9MB

Download
memory/1532-121-0x00007FF7D8490000-0x00007FF7D8882000-memory.dmp

Filesize
3.9MB

Download
memory/1928-2500-0x00007FF73FAC0000-0x00007FF73FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/1928-134-0x00007FF73FAC0000-0x00007FF73FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-146-0x00007FF744980000-0x00007FF744D72000-memory.dmp

Filesize
3.9MB

Download
memory/2072-2513-0x00007FF744980000-0x00007FF744D72000-memory.dmp

Filesize
3.9MB

Download
memory/2144-71-0x00007FF7A9500000-0x00007FF7A98F2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-2465-0x00007FF7A9500000-0x00007FF7A98F2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-2544-0x00007FF607290000-0x00007FF607682000-memory.dmp

Filesize
3.9MB

Download
memory/2176-158-0x00007FF607290000-0x00007FF607682000-memory.dmp

Filesize
3.9MB

Download
memory/2232-1093-0x00007FF718FB0000-0x00007FF7193A2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-0-0x00007FF718FB0000-0x00007FF7193A2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-1-0x000002C285290000-0x000002C2852A0000-memory.dmp

Filesize
64KB

Download
memory/2240-127-0x00007FF60CD10000-0x00007FF60D102000-memory.dmp

Filesize
3.9MB

Download
memory/2240-2506-0x00007FF60CD10000-0x00007FF60D102000-memory.dmp

Filesize
3.9MB

Download
memory/2584-115-0x00007FF6F0FD0000-0x00007FF6F13C2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-2477-0x00007FF6F0FD0000-0x00007FF6F13C2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-2542-0x00007FF670780000-0x00007FF670B72000-memory.dmp

Filesize
3.9MB

Download
memory/2720-159-0x00007FF670780000-0x00007FF670B72000-memory.dmp

Filesize
3.9MB

Download
memory/2908-84-0x00007FF7C2F10000-0x00007FF7C3302000-memory.dmp

Filesize
3.9MB

Download
memory/2908-2471-0x00007FF7C2F10000-0x00007FF7C3302000-memory.dmp

Filesize
3.9MB

Download
memory/3252-2467-0x00007FF685DC0000-0x00007FF6861B2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-66-0x00007FF685DC0000-0x00007FF6861B2000-memory.dmp

Filesize
3.9MB

Download
memory/3284-2474-0x00007FF733760000-0x00007FF733B52000-memory.dmp

Filesize
3.9MB

Download
memory/3284-90-0x00007FF733760000-0x00007FF733B52000-memory.dmp

Filesize
3.9MB

Download
memory/4188-78-0x00007FF797D60000-0x00007FF798152000-memory.dmp

Filesize
3.9MB

Download
memory/4188-2470-0x00007FF797D60000-0x00007FF798152000-memory.dmp

Filesize
3.9MB

Download
memory/4192-2517-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp

Filesize
3.9MB

Download
memory/4192-152-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp

Filesize
3.9MB

Download
memory/4560-171-0x00007FF7DEE70000-0x00007FF7DF262000-memory.dmp

Filesize
3.9MB

Download
memory/4560-2538-0x00007FF7DEE70000-0x00007FF7DF262000-memory.dmp

Filesize
3.9MB

Download
memory/4672-2447-0x00007FF726720000-0x00007FF726B12000-memory.dmp

Filesize
3.9MB

Download
memory/4672-57-0x00007FF726720000-0x00007FF726B12000-memory.dmp

Filesize
3.9MB

Download
memory/4764-2560-0x00007FF7F1A50000-0x00007FF7F1E42000-memory.dmp

Filesize
3.9MB

Download
memory/4764-165-0x00007FF7F1A50000-0x00007FF7F1E42000-memory.dmp

Filesize
3.9MB

Download
memory/4820-2475-0x00007FF7C2860000-0x00007FF7C2C52000-memory.dmp

Filesize
3.9MB

Download
memory/4820-83-0x00007FF7C2860000-0x00007FF7C2C52000-memory.dmp

Filesize
3.9MB

Download