xmrig | 6d3e501fdb875b9a4a8bf1b4258989a0ebe5717ad265546686a05cf53e0fb80a

Analysis

max time kernel
57s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
Size

1.8MB
MD5

06393c08557a83d13a6b9bc2f34030d1
SHA1

115abec09c319c6541f19fd324c6c1f5e4066683
SHA256

6d3e501fdb875b9a4a8bf1b4258989a0ebe5717ad265546686a05cf53e0fb80a
SHA512

cf773d7080e56e1c6bc1d7b55ef551e766fbb524788fb8f1dc7e4a5afb57741098d8e9d6e08926ee9784deb0a1e7c94733c325f4dfbc6f7ab3f822c8cdcf2a21
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl6S:NABO

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/3200-78-0x00007FF633530000-0x00007FF633922000-memory.dmp	xmrig
behavioral2/memory/4744-80-0x00007FF730340000-0x00007FF730732000-memory.dmp	xmrig
behavioral2/memory/1852-81-0x00007FF6D4760000-0x00007FF6D4B52000-memory.dmp	xmrig
behavioral2/memory/1112-83-0x00007FF60BE40000-0x00007FF60C232000-memory.dmp	xmrig
behavioral2/memory/1636-84-0x00007FF635C00000-0x00007FF635FF2000-memory.dmp	xmrig
behavioral2/memory/4052-85-0x00007FF61BDE0000-0x00007FF61C1D2000-memory.dmp	xmrig
behavioral2/memory/3540-86-0x00007FF7F15B0000-0x00007FF7F19A2000-memory.dmp	xmrig
behavioral2/memory/3132-87-0x00007FF728B40000-0x00007FF728F32000-memory.dmp	xmrig
behavioral2/memory/3084-82-0x00007FF6A80C0000-0x00007FF6A84B2000-memory.dmp	xmrig
behavioral2/memory/2520-89-0x00007FF73B150000-0x00007FF73B542000-memory.dmp	xmrig
behavioral2/memory/4468-90-0x00007FF61FB20000-0x00007FF61FF12000-memory.dmp	xmrig
behavioral2/memory/2284-136-0x00007FF682D80000-0x00007FF683172000-memory.dmp	xmrig
behavioral2/memory/1204-165-0x00007FF74FE90000-0x00007FF750282000-memory.dmp	xmrig
behavioral2/memory/1892-159-0x00007FF6F4FD0000-0x00007FF6F53C2000-memory.dmp	xmrig
behavioral2/memory/732-157-0x00007FF67DE70000-0x00007FF67E262000-memory.dmp	xmrig
behavioral2/memory/3104-140-0x00007FF7CE800000-0x00007FF7CEBF2000-memory.dmp	xmrig
behavioral2/memory/760-103-0x00007FF6F4D40000-0x00007FF6F5132000-memory.dmp	xmrig
behavioral2/memory/1852-1782-0x00007FF6D4760000-0x00007FF6D4B52000-memory.dmp	xmrig
behavioral2/memory/4468-1798-0x00007FF61FB20000-0x00007FF61FF12000-memory.dmp	xmrig
behavioral2/memory/3132-1806-0x00007FF728B40000-0x00007FF728F32000-memory.dmp	xmrig
behavioral2/memory/4052-1808-0x00007FF61BDE0000-0x00007FF61C1D2000-memory.dmp	xmrig
behavioral2/memory/3200-1805-0x00007FF633530000-0x00007FF633922000-memory.dmp	xmrig
behavioral2/memory/1112-1803-0x00007FF60BE40000-0x00007FF60C232000-memory.dmp	xmrig
behavioral2/memory/1636-1801-0x00007FF635C00000-0x00007FF635FF2000-memory.dmp	xmrig
behavioral2/memory/2520-1815-0x00007FF73B150000-0x00007FF73B542000-memory.dmp	xmrig
behavioral2/memory/2608-2084-0x00007FF744010000-0x00007FF744402000-memory.dmp	xmrig
behavioral2/memory/3104-2114-0x00007FF7CE800000-0x00007FF7CEBF2000-memory.dmp	xmrig
behavioral2/memory/436-2092-0x00007FF75FDE0000-0x00007FF7601D2000-memory.dmp	xmrig
behavioral2/memory/692-2090-0x00007FF6B28E0000-0x00007FF6B2CD2000-memory.dmp	xmrig
behavioral2/memory/3084-1795-0x00007FF6A80C0000-0x00007FF6A84B2000-memory.dmp	xmrig
behavioral2/memory/3540-1802-0x00007FF7F15B0000-0x00007FF7F19A2000-memory.dmp	xmrig
behavioral2/memory/4744-1771-0x00007FF730340000-0x00007FF730732000-memory.dmp	xmrig
behavioral2/memory/732-2141-0x00007FF67DE70000-0x00007FF67E262000-memory.dmp	xmrig
behavioral2/memory/964-2144-0x00007FF6177A0000-0x00007FF617B92000-memory.dmp	xmrig
behavioral2/memory/1204-2145-0x00007FF74FE90000-0x00007FF750282000-memory.dmp	xmrig

Executes dropped EXE 61 IoCs

pid	Process
4468	oCZwolA.exe
3200	HJuzDbG.exe
4744	UayNNsI.exe
1852	KzpfITm.exe
3084	MUBFFny.exe
1112	UiYQfWv.exe
1636	WbQHVVW.exe
4052	CdZtqDa.exe
3540	GpRrudG.exe
3132	uCnlROX.exe
692	FIHvRMI.exe
2608	kZrhbTt.exe
2520	LwYSBiS.exe
760	bkjxreH.exe
436	WMIvQIF.exe
3104	WcupcAl.exe
732	RVZsild.exe
1892	MRJRkur.exe
964	MWWBaKd.exe
2284	BSUBUwv.exe
1204	luchdiK.exe
4560	REfYjAF.exe
2856	IcwVsgb.exe
3420	LxMcRVR.exe
3208	ujjZHRL.exe
4388	vOOjSPA.exe
408	NaImHJM.exe
2836	BMHwzKM.exe
4340	UbOPDME.exe
3212	tajiKlY.exe
3096	fmNsqss.exe
3912	jmUEJor.exe
2184	hTyPNPu.exe
4740	KMrbyIJ.exe
2852	JssIBYS.exe
2072	LvwLUKP.exe
1008	HUSclSk.exe
684	FNvcSIp.exe
1656	TZfJvqx.exe
2460	YrjEACK.exe
2376	qsplaty.exe
2164	YNhXwMp.exe
2144	fBFTwCG.exe
416	bTeLqSP.exe
2292	BJQtOYx.exe
2432	JOKkCMO.exe
4480	uVCtctn.exe
2820	VTIdsjO.exe
2212	YLycpjA.exe
3288	BNiLcxv.exe
4236	YBKccOS.exe
4360	uFkZmbp.exe
2908	wTNnlgJ.exe
4472	FZlSrKg.exe
4636	XKzjHij.exe
2004	yuiuheB.exe
876	onydZiu.exe
4308	HpGSjIv.exe
4104	soWBinh.exe
4620	RqUtfVH.exe
5144	PcxJlxh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2428-0-0x00007FF7F0830000-0x00007FF7F0C22000-memory.dmp	upx
behavioral2/files/0x0008000000023256-4.dat	upx
behavioral2/files/0x0008000000023259-9.dat	upx
behavioral2/files/0x000800000002325c-8.dat	upx
behavioral2/files/0x000800000002325e-27.dat	upx
behavioral2/files/0x0007000000023261-34.dat	upx
behavioral2/files/0x000800000002325f-42.dat	upx
behavioral2/files/0x0008000000023260-45.dat	upx
behavioral2/files/0x000800000002325a-51.dat	upx
behavioral2/files/0x0007000000023262-69.dat	upx
behavioral2/files/0x0007000000023266-75.dat	upx
behavioral2/files/0x0007000000023263-74.dat	upx
behavioral2/files/0x0007000000023265-68.dat	upx
behavioral2/files/0x0007000000023264-67.dat	upx
behavioral2/memory/3200-78-0x00007FF633530000-0x00007FF633922000-memory.dmp	upx
behavioral2/memory/4744-80-0x00007FF730340000-0x00007FF730732000-memory.dmp	upx
behavioral2/memory/1852-81-0x00007FF6D4760000-0x00007FF6D4B52000-memory.dmp	upx
behavioral2/memory/1112-83-0x00007FF60BE40000-0x00007FF60C232000-memory.dmp	upx
behavioral2/memory/1636-84-0x00007FF635C00000-0x00007FF635FF2000-memory.dmp	upx
behavioral2/memory/4052-85-0x00007FF61BDE0000-0x00007FF61C1D2000-memory.dmp	upx
behavioral2/memory/3540-86-0x00007FF7F15B0000-0x00007FF7F19A2000-memory.dmp	upx
behavioral2/memory/3132-87-0x00007FF728B40000-0x00007FF728F32000-memory.dmp	upx
behavioral2/memory/3084-82-0x00007FF6A80C0000-0x00007FF6A84B2000-memory.dmp	upx
behavioral2/memory/2520-89-0x00007FF73B150000-0x00007FF73B542000-memory.dmp	upx
behavioral2/memory/4468-90-0x00007FF61FB20000-0x00007FF61FF12000-memory.dmp	upx
behavioral2/memory/692-91-0x00007FF6B28E0000-0x00007FF6B2CD2000-memory.dmp	upx
behavioral2/memory/2608-88-0x00007FF744010000-0x00007FF744402000-memory.dmp	upx
behavioral2/files/0x0007000000023267-92.dat	upx
behavioral2/files/0x0007000000023268-101.dat	upx
behavioral2/files/0x000700000002326a-117.dat	upx
behavioral2/files/0x000700000002326b-137.dat	upx
behavioral2/memory/2284-136-0x00007FF682D80000-0x00007FF683172000-memory.dmp	upx
behavioral2/files/0x0007000000023270-135.dat	upx
behavioral2/files/0x000700000002326f-133.dat	upx
behavioral2/memory/964-130-0x00007FF6177A0000-0x00007FF617B92000-memory.dmp	upx
behavioral2/files/0x000700000002326d-128.dat	upx
behavioral2/files/0x000700000002326c-126.dat	upx
behavioral2/files/0x0007000000023269-116.dat	upx
behavioral2/memory/436-113-0x00007FF75FDE0000-0x00007FF7601D2000-memory.dmp	upx
behavioral2/files/0x0007000000023271-144.dat	upx
behavioral2/files/0x0007000000023274-158.dat	upx
behavioral2/files/0x0007000000023273-162.dat	upx
behavioral2/files/0x0007000000023277-180.dat	upx
behavioral2/files/0x000700000002327a-190.dat	upx
behavioral2/files/0x000700000002327d-197.dat	upx
behavioral2/files/0x000700000002327c-194.dat	upx
behavioral2/files/0x000700000002327b-191.dat	upx
behavioral2/files/0x0007000000023279-189.dat	upx
behavioral2/files/0x0007000000023278-183.dat	upx
behavioral2/files/0x0007000000023275-179.dat	upx
behavioral2/files/0x0007000000023276-188.dat	upx
behavioral2/memory/1204-165-0x00007FF74FE90000-0x00007FF750282000-memory.dmp	upx
behavioral2/files/0x0007000000023272-160.dat	upx
behavioral2/memory/1892-159-0x00007FF6F4FD0000-0x00007FF6F53C2000-memory.dmp	upx
behavioral2/memory/732-157-0x00007FF67DE70000-0x00007FF67E262000-memory.dmp	upx
behavioral2/files/0x0007000000023270-148.dat	upx
behavioral2/memory/3104-140-0x00007FF7CE800000-0x00007FF7CEBF2000-memory.dmp	upx
behavioral2/memory/760-103-0x00007FF6F4D40000-0x00007FF6F5132000-memory.dmp	upx
behavioral2/memory/1852-1782-0x00007FF6D4760000-0x00007FF6D4B52000-memory.dmp	upx
behavioral2/memory/4468-1798-0x00007FF61FB20000-0x00007FF61FF12000-memory.dmp	upx
behavioral2/memory/3132-1806-0x00007FF728B40000-0x00007FF728F32000-memory.dmp	upx
behavioral2/memory/4052-1808-0x00007FF61BDE0000-0x00007FF61C1D2000-memory.dmp	upx
behavioral2/memory/3200-1805-0x00007FF633530000-0x00007FF633922000-memory.dmp	upx
behavioral2/memory/1112-1803-0x00007FF60BE40000-0x00007FF60C232000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CdZtqDa.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\LwYSBiS.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\fBFTwCG.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\kZrhbTt.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\UbOPDME.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\BSUBUwv.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\MRJRkur.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\MWWBaKd.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\tajiKlY.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\fmNsqss.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\XKzjHij.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\IcwVsgb.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\vOOjSPA.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\NaImHJM.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\LvwLUKP.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\uCnlROX.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\RVZsild.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\uVCtctn.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\RqUtfVH.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\MUBFFny.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\bTeLqSP.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\LxMcRVR.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\JOKkCMO.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\oCZwolA.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\FZlSrKg.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\TZfJvqx.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\WcupcAl.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\BMHwzKM.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\qsplaty.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\YNhXwMp.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\YLycpjA.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\uFkZmbp.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\yuiuheB.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\onydZiu.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\KzpfITm.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\jmUEJor.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\PcxJlxh.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\KMrbyIJ.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\HUSclSk.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\VTIdsjO.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\BNiLcxv.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\UiYQfWv.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\GpRrudG.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\FIHvRMI.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\hIGnPYY.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\YrjEACK.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\BJQtOYx.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\HpGSjIv.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\soWBinh.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\sLnGbLW.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\bkjxreH.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\hTyPNPu.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\WbQHVVW.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\WMIvQIF.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\luchdiK.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\ujjZHRL.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\JssIBYS.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\HJuzDbG.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\UayNNsI.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\YBKccOS.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\wTNnlgJ.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\tAGUYZm.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\TCWUNGh.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\REfYjAF.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1780	powershell.exe
1780	powershell.exe
1780	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeLockMemoryPrivilege	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1780	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	91
PID 2428 wrote to memory of 1780	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	91
PID 2428 wrote to memory of 4468	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	92
PID 2428 wrote to memory of 4468	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	92
PID 2428 wrote to memory of 3200	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	93
PID 2428 wrote to memory of 3200	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	93
PID 2428 wrote to memory of 4744	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	94
PID 2428 wrote to memory of 4744	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	94
PID 2428 wrote to memory of 1852	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	95
PID 2428 wrote to memory of 1852	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	95
PID 2428 wrote to memory of 3084	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	96
PID 2428 wrote to memory of 3084	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	96
PID 2428 wrote to memory of 1112	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	97
PID 2428 wrote to memory of 1112	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	97
PID 2428 wrote to memory of 1636	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	98
PID 2428 wrote to memory of 1636	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	98
PID 2428 wrote to memory of 4052	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	99
PID 2428 wrote to memory of 4052	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	99
PID 2428 wrote to memory of 3540	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	100
PID 2428 wrote to memory of 3540	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	100
PID 2428 wrote to memory of 3132	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	101
PID 2428 wrote to memory of 3132	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	101
PID 2428 wrote to memory of 692	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	102
PID 2428 wrote to memory of 692	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	102
PID 2428 wrote to memory of 2608	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	103
PID 2428 wrote to memory of 2608	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	103
PID 2428 wrote to memory of 2520	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	104
PID 2428 wrote to memory of 2520	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	104
PID 2428 wrote to memory of 760	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	105
PID 2428 wrote to memory of 760	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	105
PID 2428 wrote to memory of 436	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	106
PID 2428 wrote to memory of 436	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	106
PID 2428 wrote to memory of 3104	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	107
PID 2428 wrote to memory of 3104	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	107
PID 2428 wrote to memory of 732	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	108
PID 2428 wrote to memory of 732	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	108
PID 2428 wrote to memory of 1892	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	109
PID 2428 wrote to memory of 1892	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	109
PID 2428 wrote to memory of 964	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	110
PID 2428 wrote to memory of 964	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	110
PID 2428 wrote to memory of 2284	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	111
PID 2428 wrote to memory of 2284	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	111
PID 2428 wrote to memory of 1204	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	112
PID 2428 wrote to memory of 1204	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	112
PID 2428 wrote to memory of 4560	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	113
PID 2428 wrote to memory of 4560	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	113
PID 2428 wrote to memory of 2856	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	114
PID 2428 wrote to memory of 2856	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	114
PID 2428 wrote to memory of 3420	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	115
PID 2428 wrote to memory of 3420	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	115
PID 2428 wrote to memory of 3208	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	116
PID 2428 wrote to memory of 3208	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	116
PID 2428 wrote to memory of 4388	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	117
PID 2428 wrote to memory of 4388	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	117
PID 2428 wrote to memory of 408	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	118
PID 2428 wrote to memory of 408	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	118
PID 2428 wrote to memory of 2836	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	119
PID 2428 wrote to memory of 2836	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	119
PID 2428 wrote to memory of 4340	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	120
PID 2428 wrote to memory of 4340	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	120
PID 2428 wrote to memory of 3212	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	121
PID 2428 wrote to memory of 3212	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	121
PID 2428 wrote to memory of 3096	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	122
PID 2428 wrote to memory of 3096	2428	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Windows\System\oCZwolA.exe
  C:\Windows\System\oCZwolA.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\HJuzDbG.exe
  C:\Windows\System\HJuzDbG.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\UayNNsI.exe
  C:\Windows\System\UayNNsI.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\KzpfITm.exe
  C:\Windows\System\KzpfITm.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\MUBFFny.exe
  C:\Windows\System\MUBFFny.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\UiYQfWv.exe
  C:\Windows\System\UiYQfWv.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\WbQHVVW.exe
  C:\Windows\System\WbQHVVW.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\CdZtqDa.exe
  C:\Windows\System\CdZtqDa.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\GpRrudG.exe
  C:\Windows\System\GpRrudG.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\uCnlROX.exe
  C:\Windows\System\uCnlROX.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\FIHvRMI.exe
  C:\Windows\System\FIHvRMI.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\kZrhbTt.exe
  C:\Windows\System\kZrhbTt.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\LwYSBiS.exe
  C:\Windows\System\LwYSBiS.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\bkjxreH.exe
  C:\Windows\System\bkjxreH.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\WMIvQIF.exe
  C:\Windows\System\WMIvQIF.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\WcupcAl.exe
  C:\Windows\System\WcupcAl.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\RVZsild.exe
  C:\Windows\System\RVZsild.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\MRJRkur.exe
  C:\Windows\System\MRJRkur.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\MWWBaKd.exe
  C:\Windows\System\MWWBaKd.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\BSUBUwv.exe
  C:\Windows\System\BSUBUwv.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\luchdiK.exe
  C:\Windows\System\luchdiK.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\REfYjAF.exe
  C:\Windows\System\REfYjAF.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\IcwVsgb.exe
  C:\Windows\System\IcwVsgb.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\LxMcRVR.exe
  C:\Windows\System\LxMcRVR.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\ujjZHRL.exe
  C:\Windows\System\ujjZHRL.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\vOOjSPA.exe
  C:\Windows\System\vOOjSPA.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\NaImHJM.exe
  C:\Windows\System\NaImHJM.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\BMHwzKM.exe
  C:\Windows\System\BMHwzKM.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\UbOPDME.exe
  C:\Windows\System\UbOPDME.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\tajiKlY.exe
  C:\Windows\System\tajiKlY.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\fmNsqss.exe
  C:\Windows\System\fmNsqss.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\jmUEJor.exe
  C:\Windows\System\jmUEJor.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\hTyPNPu.exe
  C:\Windows\System\hTyPNPu.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\KMrbyIJ.exe
  C:\Windows\System\KMrbyIJ.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\JssIBYS.exe
  C:\Windows\System\JssIBYS.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\LvwLUKP.exe
  C:\Windows\System\LvwLUKP.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\HUSclSk.exe
  C:\Windows\System\HUSclSk.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\FNvcSIp.exe
  C:\Windows\System\FNvcSIp.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\TZfJvqx.exe
  C:\Windows\System\TZfJvqx.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\bTeLqSP.exe
  C:\Windows\System\bTeLqSP.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\YrjEACK.exe
  C:\Windows\System\YrjEACK.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\qsplaty.exe
  C:\Windows\System\qsplaty.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\YNhXwMp.exe
  C:\Windows\System\YNhXwMp.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\fBFTwCG.exe
  C:\Windows\System\fBFTwCG.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\BJQtOYx.exe
  C:\Windows\System\BJQtOYx.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\JOKkCMO.exe
  C:\Windows\System\JOKkCMO.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\uVCtctn.exe
  C:\Windows\System\uVCtctn.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\VTIdsjO.exe
  C:\Windows\System\VTIdsjO.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\YLycpjA.exe
  C:\Windows\System\YLycpjA.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\BNiLcxv.exe
  C:\Windows\System\BNiLcxv.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\YBKccOS.exe
  C:\Windows\System\YBKccOS.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\uFkZmbp.exe
  C:\Windows\System\uFkZmbp.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\wTNnlgJ.exe
  C:\Windows\System\wTNnlgJ.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\FZlSrKg.exe
  C:\Windows\System\FZlSrKg.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\XKzjHij.exe
  C:\Windows\System\XKzjHij.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\yuiuheB.exe
  C:\Windows\System\yuiuheB.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\onydZiu.exe
  C:\Windows\System\onydZiu.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\HpGSjIv.exe
  C:\Windows\System\HpGSjIv.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\soWBinh.exe
  C:\Windows\System\soWBinh.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\RqUtfVH.exe
  C:\Windows\System\RqUtfVH.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\PcxJlxh.exe
  C:\Windows\System\PcxJlxh.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\hIGnPYY.exe
  C:\Windows\System\hIGnPYY.exe
  2⤵
  PID:5192
- C:\Windows\System\tAGUYZm.exe
  C:\Windows\System\tAGUYZm.exe
  2⤵
  PID:5212
- C:\Windows\System\TCWUNGh.exe
  C:\Windows\System\TCWUNGh.exe
  2⤵
  PID:5228
- C:\Windows\System\sLnGbLW.exe
  C:\Windows\System\sLnGbLW.exe
  2⤵
  PID:5272
- C:\Windows\System\updQTTQ.exe
  C:\Windows\System\updQTTQ.exe
  2⤵
  PID:5288
- C:\Windows\System\urJGIml.exe
  C:\Windows\System\urJGIml.exe
  2⤵
  PID:5304
- C:\Windows\System\CoLFflG.exe
  C:\Windows\System\CoLFflG.exe
  2⤵
  PID:5340
- C:\Windows\System\YkwHPVt.exe
  C:\Windows\System\YkwHPVt.exe
  2⤵
  PID:5364
- C:\Windows\System\rMFxFeG.exe
  C:\Windows\System\rMFxFeG.exe
  2⤵
  PID:5380
- C:\Windows\System\BuRPvah.exe
  C:\Windows\System\BuRPvah.exe
  2⤵
  PID:5424
- C:\Windows\System\yzHehEn.exe
  C:\Windows\System\yzHehEn.exe
  2⤵
  PID:5640
- C:\Windows\System\oWRXiUA.exe
  C:\Windows\System\oWRXiUA.exe
  2⤵
  PID:5660
- C:\Windows\System\XgGkbSX.exe
  C:\Windows\System\XgGkbSX.exe
  2⤵
  PID:5680
- C:\Windows\System\dThnUAV.exe
  C:\Windows\System\dThnUAV.exe
  2⤵
  PID:5700
- C:\Windows\System\SYDuTxA.exe
  C:\Windows\System\SYDuTxA.exe
  2⤵
  PID:5720
- C:\Windows\System\rjxPOAU.exe
  C:\Windows\System\rjxPOAU.exe
  2⤵
  PID:5736
- C:\Windows\System\RFVCtrU.exe
  C:\Windows\System\RFVCtrU.exe
  2⤵
  PID:5780
- C:\Windows\System\FIBPGkd.exe
  C:\Windows\System\FIBPGkd.exe
  2⤵
  PID:5796
- C:\Windows\System\JHqwGsk.exe
  C:\Windows\System\JHqwGsk.exe
  2⤵
  PID:5816
- C:\Windows\System\HbbgCpa.exe
  C:\Windows\System\HbbgCpa.exe
  2⤵
  PID:5832
- C:\Windows\System\sfuZEEr.exe
  C:\Windows\System\sfuZEEr.exe
  2⤵
  PID:5852
- C:\Windows\System\piOLmZy.exe
  C:\Windows\System\piOLmZy.exe
  2⤵
  PID:5868
- C:\Windows\System\qvdgdGc.exe
  C:\Windows\System\qvdgdGc.exe
  2⤵
  PID:5888
- C:\Windows\System\EfRxJxZ.exe
  C:\Windows\System\EfRxJxZ.exe
  2⤵
  PID:5904
- C:\Windows\System\vTpvZCr.exe
  C:\Windows\System\vTpvZCr.exe
  2⤵
  PID:5920
- C:\Windows\System\NReMAvu.exe
  C:\Windows\System\NReMAvu.exe
  2⤵
  PID:5936
- C:\Windows\System\EweVkkI.exe
  C:\Windows\System\EweVkkI.exe
  2⤵
  PID:5956
- C:\Windows\System\LGAAdnN.exe
  C:\Windows\System\LGAAdnN.exe
  2⤵
  PID:5980
- C:\Windows\System\mDEOUCG.exe
  C:\Windows\System\mDEOUCG.exe
  2⤵
  PID:5996
- C:\Windows\System\PMaDPQs.exe
  C:\Windows\System\PMaDPQs.exe
  2⤵
  PID:6016
- C:\Windows\System\LZFoYai.exe
  C:\Windows\System\LZFoYai.exe
  2⤵
  PID:6032
- C:\Windows\System\EnFHshM.exe
  C:\Windows\System\EnFHshM.exe
  2⤵
  PID:6052
- C:\Windows\System\WJjrXIt.exe
  C:\Windows\System\WJjrXIt.exe
  2⤵
  PID:6068
- C:\Windows\System\pzSmNGn.exe
  C:\Windows\System\pzSmNGn.exe
  2⤵
  PID:6088
- C:\Windows\System\uBVVpdL.exe
  C:\Windows\System\uBVVpdL.exe
  2⤵
  PID:6112
- C:\Windows\System\LITzgnN.exe
  C:\Windows\System\LITzgnN.exe
  2⤵
  PID:6132
- C:\Windows\System\lieAnbw.exe
  C:\Windows\System\lieAnbw.exe
  2⤵
  PID:5104
- C:\Windows\System\uWgZJVV.exe
  C:\Windows\System\uWgZJVV.exe
  2⤵
  PID:2524
- C:\Windows\System\VZWoyuz.exe
  C:\Windows\System\VZWoyuz.exe
  2⤵
  PID:4220
- C:\Windows\System\ocbspUK.exe
  C:\Windows\System\ocbspUK.exe
  2⤵
  PID:2540
- C:\Windows\System\zHfzPpg.exe
  C:\Windows\System\zHfzPpg.exe
  2⤵
  PID:2644
- C:\Windows\System\DyZdGJy.exe
  C:\Windows\System\DyZdGJy.exe
  2⤵
  PID:4756
- C:\Windows\System\GahlFVy.exe
  C:\Windows\System\GahlFVy.exe
  2⤵
  PID:5152
- C:\Windows\System\jKQouIN.exe
  C:\Windows\System\jKQouIN.exe
  2⤵
  PID:5220
- C:\Windows\System\RxpSDWM.exe
  C:\Windows\System\RxpSDWM.exe
  2⤵
  PID:5244
- C:\Windows\System\BIJJywJ.exe
  C:\Windows\System\BIJJywJ.exe
  2⤵
  PID:5284
- C:\Windows\System\CyaBGfj.exe
  C:\Windows\System\CyaBGfj.exe
  2⤵
  PID:5332
- C:\Windows\System\tRQWZIE.exe
  C:\Windows\System\tRQWZIE.exe
  2⤵
  PID:5376
- C:\Windows\System\PUWLGQN.exe
  C:\Windows\System\PUWLGQN.exe
  2⤵
  PID:5416
- C:\Windows\System\UtuAiKz.exe
  C:\Windows\System\UtuAiKz.exe
  2⤵
  PID:4736
- C:\Windows\System\ilSKMHg.exe
  C:\Windows\System\ilSKMHg.exe
  2⤵
  PID:4568
- C:\Windows\System\ZprjMMx.exe
  C:\Windows\System\ZprjMMx.exe
  2⤵
  PID:4984
- C:\Windows\System\FsbLIGp.exe
  C:\Windows\System\FsbLIGp.exe
  2⤵
  PID:5080
- C:\Windows\System\YuWlUrM.exe
  C:\Windows\System\YuWlUrM.exe
  2⤵
  PID:4208
- C:\Windows\System\NOkmDrO.exe
  C:\Windows\System\NOkmDrO.exe
  2⤵
  PID:4352
- C:\Windows\System\pEIJPoX.exe
  C:\Windows\System\pEIJPoX.exe
  2⤵
  PID:532
- C:\Windows\System\RkiMdtm.exe
  C:\Windows\System\RkiMdtm.exe
  2⤵
  PID:1396
- C:\Windows\System\itGLdhg.exe
  C:\Windows\System\itGLdhg.exe
  2⤵
  PID:3940
- C:\Windows\System\KjwusvR.exe
  C:\Windows\System\KjwusvR.exe
  2⤵
  PID:5712
- C:\Windows\System\WIERdkl.exe
  C:\Windows\System\WIERdkl.exe
  2⤵
  PID:5788
- C:\Windows\System\zJufvUk.exe
  C:\Windows\System\zJufvUk.exe
  2⤵
  PID:5692
- C:\Windows\System\TNeTgSw.exe
  C:\Windows\System\TNeTgSw.exe
  2⤵
  PID:5772
- C:\Windows\System\XxjeKhU.exe
  C:\Windows\System\XxjeKhU.exe
  2⤵
  PID:5756
- C:\Windows\System\vRtdHwe.exe
  C:\Windows\System\vRtdHwe.exe
  2⤵
  PID:5804
- C:\Windows\System\jVnINTr.exe
  C:\Windows\System\jVnINTr.exe
  2⤵
  PID:5972
- C:\Windows\System\BhiFSwS.exe
  C:\Windows\System\BhiFSwS.exe
  2⤵
  PID:5824
- C:\Windows\System\spdPzvN.exe
  C:\Windows\System\spdPzvN.exe
  2⤵
  PID:5880
- C:\Windows\System\kBDehIZ.exe
  C:\Windows\System\kBDehIZ.exe
  2⤵
  PID:6104
- C:\Windows\System\cEYVpYB.exe
  C:\Windows\System\cEYVpYB.exe
  2⤵
  PID:6128
- C:\Windows\System\LKJOcld.exe
  C:\Windows\System\LKJOcld.exe
  2⤵
  PID:4296
- C:\Windows\System\LPocorC.exe
  C:\Windows\System\LPocorC.exe
  2⤵
  PID:5300
- C:\Windows\System\KzKNJLj.exe
  C:\Windows\System\KzKNJLj.exe
  2⤵
  PID:6080
- C:\Windows\System\snhrBhF.exe
  C:\Windows\System\snhrBhF.exe
  2⤵
  PID:4108
- C:\Windows\System\pVAgUpc.exe
  C:\Windows\System\pVAgUpc.exe
  2⤵
  PID:3544
- C:\Windows\System\dfGbeJr.exe
  C:\Windows\System\dfGbeJr.exe
  2⤵
  PID:6148
- C:\Windows\System\XvPADSu.exe
  C:\Windows\System\XvPADSu.exe
  2⤵
  PID:6184
- C:\Windows\System\gUIbSDQ.exe
  C:\Windows\System\gUIbSDQ.exe
  2⤵
  PID:6204
- C:\Windows\System\klLDRAV.exe
  C:\Windows\System\klLDRAV.exe
  2⤵
  PID:6228
- C:\Windows\System\SztdSNq.exe
  C:\Windows\System\SztdSNq.exe
  2⤵
  PID:6248
- C:\Windows\System\mISHdCY.exe
  C:\Windows\System\mISHdCY.exe
  2⤵
  PID:6272
- C:\Windows\System\opeNLWy.exe
  C:\Windows\System\opeNLWy.exe
  2⤵
  PID:6292
- C:\Windows\System\usdMgPp.exe
  C:\Windows\System\usdMgPp.exe
  2⤵
  PID:6316
- C:\Windows\System\gwZzBlW.exe
  C:\Windows\System\gwZzBlW.exe
  2⤵
  PID:6336
- C:\Windows\System\JGQORDI.exe
  C:\Windows\System\JGQORDI.exe
  2⤵
  PID:6356
- C:\Windows\System\rAcQpbZ.exe
  C:\Windows\System\rAcQpbZ.exe
  2⤵
  PID:6384
- C:\Windows\System\ZFuIbEx.exe
  C:\Windows\System\ZFuIbEx.exe
  2⤵
  PID:6404
- C:\Windows\System\zsFvanp.exe
  C:\Windows\System\zsFvanp.exe
  2⤵
  PID:6424
- C:\Windows\System\KbudCkj.exe
  C:\Windows\System\KbudCkj.exe
  2⤵
  PID:6440
- C:\Windows\System\LXJcTad.exe
  C:\Windows\System\LXJcTad.exe
  2⤵
  PID:6460
- C:\Windows\System\FmHQmNd.exe
  C:\Windows\System\FmHQmNd.exe
  2⤵
  PID:6480
- C:\Windows\System\IeAxLPe.exe
  C:\Windows\System\IeAxLPe.exe
  2⤵
  PID:6504
- C:\Windows\System\ihPlnkb.exe
  C:\Windows\System\ihPlnkb.exe
  2⤵
  PID:6520
- C:\Windows\System\smGBjah.exe
  C:\Windows\System\smGBjah.exe
  2⤵
  PID:6540
- C:\Windows\System\rZcGsLu.exe
  C:\Windows\System\rZcGsLu.exe
  2⤵
  PID:6560
- C:\Windows\System\SKNbJht.exe
  C:\Windows\System\SKNbJht.exe
  2⤵
  PID:6584
- C:\Windows\System\QCtPeiy.exe
  C:\Windows\System\QCtPeiy.exe
  2⤵
  PID:6604
- C:\Windows\System\EglGjmP.exe
  C:\Windows\System\EglGjmP.exe
  2⤵
  PID:6624
- C:\Windows\System\gASNDzS.exe
  C:\Windows\System\gASNDzS.exe
  2⤵
  PID:6648
- C:\Windows\System\dHvhbGG.exe
  C:\Windows\System\dHvhbGG.exe
  2⤵
  PID:6664
- C:\Windows\System\SCCGhxT.exe
  C:\Windows\System\SCCGhxT.exe
  2⤵
  PID:6680
- C:\Windows\System\HiBUdmO.exe
  C:\Windows\System\HiBUdmO.exe
  2⤵
  PID:6700
- C:\Windows\System\bWvJhSN.exe
  C:\Windows\System\bWvJhSN.exe
  2⤵
  PID:6724
- C:\Windows\System\xUiCPEH.exe
  C:\Windows\System\xUiCPEH.exe
  2⤵
  PID:6744
- C:\Windows\System\MzfMjHn.exe
  C:\Windows\System\MzfMjHn.exe
  2⤵
  PID:6760
- C:\Windows\System\XuyIEpo.exe
  C:\Windows\System\XuyIEpo.exe
  2⤵
  PID:6780
- C:\Windows\System\vrZbFcX.exe
  C:\Windows\System\vrZbFcX.exe
  2⤵
  PID:6804
- C:\Windows\System\VHLiaAT.exe
  C:\Windows\System\VHLiaAT.exe
  2⤵
  PID:6832
- C:\Windows\System\CNGjEuZ.exe
  C:\Windows\System\CNGjEuZ.exe
  2⤵
  PID:6852
- C:\Windows\System\zhhHUHN.exe
  C:\Windows\System\zhhHUHN.exe
  2⤵
  PID:6876
- C:\Windows\System\xmyeRUo.exe
  C:\Windows\System\xmyeRUo.exe
  2⤵
  PID:6900
- C:\Windows\System\CXidqDX.exe
  C:\Windows\System\CXidqDX.exe
  2⤵
  PID:6920
- C:\Windows\System\jglDsiJ.exe
  C:\Windows\System\jglDsiJ.exe
  2⤵
  PID:6940
- C:\Windows\System\uAPjard.exe
  C:\Windows\System\uAPjard.exe
  2⤵
  PID:6960
- C:\Windows\System\jOYcrCT.exe
  C:\Windows\System\jOYcrCT.exe
  2⤵
  PID:6984
- C:\Windows\System\zVHulEV.exe
  C:\Windows\System\zVHulEV.exe
  2⤵
  PID:7004
- C:\Windows\System\asaUrUr.exe
  C:\Windows\System\asaUrUr.exe
  2⤵
  PID:7024
- C:\Windows\System\rKJGmQY.exe
  C:\Windows\System\rKJGmQY.exe
  2⤵
  PID:7048
- C:\Windows\System\QaLeykN.exe
  C:\Windows\System\QaLeykN.exe
  2⤵
  PID:7064
- C:\Windows\System\lMTkmxf.exe
  C:\Windows\System\lMTkmxf.exe
  2⤵
  PID:7096
- C:\Windows\System\djzbjrA.exe
  C:\Windows\System\djzbjrA.exe
  2⤵
  PID:7116
- C:\Windows\System\zoeXWiM.exe
  C:\Windows\System\zoeXWiM.exe
  2⤵
  PID:7136
- C:\Windows\System\RYIMNGR.exe
  C:\Windows\System\RYIMNGR.exe
  2⤵
  PID:7160
- C:\Windows\System\xiuyQxz.exe
  C:\Windows\System\xiuyQxz.exe
  2⤵
  PID:2712
- C:\Windows\System\pVZmoYZ.exe
  C:\Windows\System\pVZmoYZ.exe
  2⤵
  PID:5412
- C:\Windows\System\bjzkNgC.exe
  C:\Windows\System\bjzkNgC.exe
  2⤵
  PID:4500
- C:\Windows\System\ZaqVsum.exe
  C:\Windows\System\ZaqVsum.exe
  2⤵
  PID:6064
- C:\Windows\System\rATJNfh.exe
  C:\Windows\System\rATJNfh.exe
  2⤵
  PID:5912
- C:\Windows\System\DqNsdns.exe
  C:\Windows\System\DqNsdns.exe
  2⤵
  PID:6124
- C:\Windows\System\euuEHsz.exe
  C:\Windows\System\euuEHsz.exe
  2⤵
  PID:6192
- C:\Windows\System\bTJrcyB.exe
  C:\Windows\System\bTJrcyB.exe
  2⤵
  PID:6256
- C:\Windows\System\ACJlDdG.exe
  C:\Windows\System\ACJlDdG.exe
  2⤵
  PID:6376
- C:\Windows\System\ljMjGjH.exe
  C:\Windows\System\ljMjGjH.exe
  2⤵
  PID:5968
- C:\Windows\System\RFDhHGQ.exe
  C:\Windows\System\RFDhHGQ.exe
  2⤵
  PID:5864
- C:\Windows\System\fvAGdAj.exe
  C:\Windows\System\fvAGdAj.exe
  2⤵
  PID:4604
- C:\Windows\System\tubdFuO.exe
  C:\Windows\System\tubdFuO.exe
  2⤵
  PID:6576
- C:\Windows\System\kBdvFaS.exe
  C:\Windows\System\kBdvFaS.exe
  2⤵
  PID:6672
- C:\Windows\System\mWjXtWU.exe
  C:\Windows\System\mWjXtWU.exe
  2⤵
  PID:6740
- C:\Windows\System\GNtrQPs.exe
  C:\Windows\System\GNtrQPs.exe
  2⤵
  PID:7192
- C:\Windows\System\TiFoTXB.exe
  C:\Windows\System\TiFoTXB.exe
  2⤵
  PID:7212
- C:\Windows\System\UYmXKXb.exe
  C:\Windows\System\UYmXKXb.exe
  2⤵
  PID:7232
- C:\Windows\System\zPKKaIH.exe
  C:\Windows\System\zPKKaIH.exe
  2⤵
  PID:7256
- C:\Windows\System\SKlTvpT.exe
  C:\Windows\System\SKlTvpT.exe
  2⤵
  PID:7276
- C:\Windows\System\XLtFVEF.exe
  C:\Windows\System\XLtFVEF.exe
  2⤵
  PID:7304
- C:\Windows\System\wsOcdWi.exe
  C:\Windows\System\wsOcdWi.exe
  2⤵
  PID:7328
- C:\Windows\System\AztqtUf.exe
  C:\Windows\System\AztqtUf.exe
  2⤵
  PID:7344
- C:\Windows\System\MFmDYAx.exe
  C:\Windows\System\MFmDYAx.exe
  2⤵
  PID:7364
- C:\Windows\System\KQthRyu.exe
  C:\Windows\System\KQthRyu.exe
  2⤵
  PID:7380
- C:\Windows\System\VNmRXoF.exe
  C:\Windows\System\VNmRXoF.exe
  2⤵
  PID:7404
- C:\Windows\System\RvXgXnF.exe
  C:\Windows\System\RvXgXnF.exe
  2⤵
  PID:7428
- C:\Windows\System\kGXBtsP.exe
  C:\Windows\System\kGXBtsP.exe
  2⤵
  PID:7452
- C:\Windows\System\BSKxtSO.exe
  C:\Windows\System\BSKxtSO.exe
  2⤵
  PID:7468
- C:\Windows\System\wxDMQZz.exe
  C:\Windows\System\wxDMQZz.exe
  2⤵
  PID:7488
- C:\Windows\System\jjYqwxX.exe
  C:\Windows\System\jjYqwxX.exe
  2⤵
  PID:7508
- C:\Windows\System\pkqHgxM.exe
  C:\Windows\System\pkqHgxM.exe
  2⤵
  PID:7532
- C:\Windows\System\LLewnfp.exe
  C:\Windows\System\LLewnfp.exe
  2⤵
  PID:7556
- C:\Windows\System\tdIEIfM.exe
  C:\Windows\System\tdIEIfM.exe
  2⤵
  PID:7576
- C:\Windows\System\JAwLQmj.exe
  C:\Windows\System\JAwLQmj.exe
  2⤵
  PID:7600
- C:\Windows\System\XUviGnf.exe
  C:\Windows\System\XUviGnf.exe
  2⤵
  PID:7624
- C:\Windows\System\OAHGhzE.exe
  C:\Windows\System\OAHGhzE.exe
  2⤵
  PID:7644
- C:\Windows\System\HEcKJfe.exe
  C:\Windows\System\HEcKJfe.exe
  2⤵
  PID:7664
- C:\Windows\System\vXSKaXU.exe
  C:\Windows\System\vXSKaXU.exe
  2⤵
  PID:7684
- C:\Windows\System\QWQeoiu.exe
  C:\Windows\System\QWQeoiu.exe
  2⤵
  PID:7708
- C:\Windows\System\CYYiphK.exe
  C:\Windows\System\CYYiphK.exe
  2⤵
  PID:7724
- C:\Windows\System\elfuOOm.exe
  C:\Windows\System\elfuOOm.exe
  2⤵
  PID:7752
- C:\Windows\System\UNcckGO.exe
  C:\Windows\System\UNcckGO.exe
  2⤵
  PID:7772
- C:\Windows\System\HNnwTAM.exe
  C:\Windows\System\HNnwTAM.exe
  2⤵
  PID:7796
- C:\Windows\System\yPwhrFr.exe
  C:\Windows\System\yPwhrFr.exe
  2⤵
  PID:7820
- C:\Windows\System\zQcLNit.exe
  C:\Windows\System\zQcLNit.exe
  2⤵
  PID:7840
- C:\Windows\System\LiPfTgj.exe
  C:\Windows\System\LiPfTgj.exe
  2⤵
  PID:7860
- C:\Windows\System\ctvnfNN.exe
  C:\Windows\System\ctvnfNN.exe
  2⤵
  PID:7876
- C:\Windows\System\jfCyYVm.exe
  C:\Windows\System\jfCyYVm.exe
  2⤵
  PID:7896
- C:\Windows\System\zpPOdKt.exe
  C:\Windows\System\zpPOdKt.exe
  2⤵
  PID:7916
- C:\Windows\System\gHGXLAz.exe
  C:\Windows\System\gHGXLAz.exe
  2⤵
  PID:7940
- C:\Windows\System\tqeEaOl.exe
  C:\Windows\System\tqeEaOl.exe
  2⤵
  PID:7964
- C:\Windows\System\HNfKOpw.exe
  C:\Windows\System\HNfKOpw.exe
  2⤵
  PID:7980
- C:\Windows\System\xVarYPE.exe
  C:\Windows\System\xVarYPE.exe
  2⤵
  PID:8008
- C:\Windows\System\DTzIQIJ.exe
  C:\Windows\System\DTzIQIJ.exe
  2⤵
  PID:8032
- C:\Windows\System\cfRlHxI.exe
  C:\Windows\System\cfRlHxI.exe
  2⤵
  PID:8048
- C:\Windows\System\aBFXsiY.exe
  C:\Windows\System\aBFXsiY.exe
  2⤵
  PID:8072
- C:\Windows\System\wgXacOc.exe
  C:\Windows\System\wgXacOc.exe
  2⤵
  PID:8096
- C:\Windows\System\pGQhoSd.exe
  C:\Windows\System\pGQhoSd.exe
  2⤵
  PID:8112
- C:\Windows\System\SBvnRWP.exe
  C:\Windows\System\SBvnRWP.exe
  2⤵
  PID:8136
- C:\Windows\System\meHNVas.exe
  C:\Windows\System\meHNVas.exe
  2⤵
  PID:8160
- C:\Windows\System\jBaQQIv.exe
  C:\Windows\System\jBaQQIv.exe
  2⤵
  PID:8180
- C:\Windows\System\GpHFPnS.exe
  C:\Windows\System\GpHFPnS.exe
  2⤵
  PID:4336
- C:\Windows\System\KNoDxam.exe
  C:\Windows\System\KNoDxam.exe
  2⤵
  PID:6892
- C:\Windows\System\ogYtdnQ.exe
  C:\Windows\System\ogYtdnQ.exe
  2⤵
  PID:6224
- C:\Windows\System\aTvKXfp.exe
  C:\Windows\System\aTvKXfp.exe
  2⤵
  PID:6972
- C:\Windows\System\yIvYItX.exe
  C:\Windows\System\yIvYItX.exe
  2⤵
  PID:7032
- C:\Windows\System\qgvasyJ.exe
  C:\Windows\System\qgvasyJ.exe
  2⤵
  PID:7060
- C:\Windows\System\vQCOGYa.exe
  C:\Windows\System\vQCOGYa.exe
  2⤵
  PID:5732
- C:\Windows\System\lFwjpft.exe
  C:\Windows\System\lFwjpft.exe
  2⤵
  PID:6436
- C:\Windows\System\ZQkJTwX.exe
  C:\Windows\System\ZQkJTwX.exe
  2⤵
  PID:6004
- C:\Windows\System\WqeTFyh.exe
  C:\Windows\System\WqeTFyh.exe
  2⤵
  PID:6536
- C:\Windows\System\XmFXMQx.exe
  C:\Windows\System\XmFXMQx.exe
  2⤵
  PID:6600
- C:\Windows\System\gSguqNm.exe
  C:\Windows\System\gSguqNm.exe
  2⤵
  PID:5760
- C:\Windows\System\OxiRrod.exe
  C:\Windows\System\OxiRrod.exe
  2⤵
  PID:6696
- C:\Windows\System\iQohDlz.exe
  C:\Windows\System\iQohDlz.exe
  2⤵
  PID:6532
- C:\Windows\System\IdQXNRq.exe
  C:\Windows\System\IdQXNRq.exe
  2⤵
  PID:6752
- C:\Windows\System\wqtIOWn.exe
  C:\Windows\System\wqtIOWn.exe
  2⤵
  PID:6024
- C:\Windows\System\OGvMdKw.exe
  C:\Windows\System\OGvMdKw.exe
  2⤵
  PID:6824
- C:\Windows\System\kRUnwvL.exe
  C:\Windows\System\kRUnwvL.exe
  2⤵
  PID:6044
- C:\Windows\System\sLYAtqh.exe
  C:\Windows\System\sLYAtqh.exe
  2⤵
  PID:6868
- C:\Windows\System\JGgYMjh.exe
  C:\Windows\System\JGgYMjh.exe
  2⤵
  PID:7312
- C:\Windows\System\KVhEvWR.exe
  C:\Windows\System\KVhEvWR.exe
  2⤵
  PID:7144
- C:\Windows\System\DZoOOKj.exe
  C:\Windows\System\DZoOOKj.exe
  2⤵
  PID:6396
- C:\Windows\System\UPQDeps.exe
  C:\Windows\System\UPQDeps.exe
  2⤵
  PID:8208
- C:\Windows\System\ufvcBST.exe
  C:\Windows\System\ufvcBST.exe
  2⤵
  PID:8236
- C:\Windows\System\RdKNVRt.exe
  C:\Windows\System\RdKNVRt.exe
  2⤵
  PID:8256
- C:\Windows\System\vXpfjsC.exe
  C:\Windows\System\vXpfjsC.exe
  2⤵
  PID:8280
- C:\Windows\System\fblDeMU.exe
  C:\Windows\System\fblDeMU.exe
  2⤵
  PID:8300
- C:\Windows\System\uRaLPYn.exe
  C:\Windows\System\uRaLPYn.exe
  2⤵
  PID:8324
- C:\Windows\System\DUJiKfo.exe
  C:\Windows\System\DUJiKfo.exe
  2⤵
  PID:8344
- C:\Windows\System\SqMVZQa.exe
  C:\Windows\System\SqMVZQa.exe
  2⤵
  PID:8364
- C:\Windows\System\dttEMIT.exe
  C:\Windows\System\dttEMIT.exe
  2⤵
  PID:8384
- C:\Windows\System\wOUnDJx.exe
  C:\Windows\System\wOUnDJx.exe
  2⤵
  PID:8412
- C:\Windows\System\tEsCTHi.exe
  C:\Windows\System\tEsCTHi.exe
  2⤵
  PID:8440
- C:\Windows\System\OmvaKwT.exe
  C:\Windows\System\OmvaKwT.exe
  2⤵
  PID:8460
- C:\Windows\System\laMQlsD.exe
  C:\Windows\System\laMQlsD.exe
  2⤵
  PID:8480
- C:\Windows\System\epswUOy.exe
  C:\Windows\System\epswUOy.exe
  2⤵
  PID:8500
- C:\Windows\System\lMnFlUn.exe
  C:\Windows\System\lMnFlUn.exe
  2⤵
  PID:8524
- C:\Windows\System\iWhlaIh.exe
  C:\Windows\System\iWhlaIh.exe
  2⤵
  PID:8544
- C:\Windows\System\bWfYMTX.exe
  C:\Windows\System\bWfYMTX.exe
  2⤵
  PID:8572
- C:\Windows\System\ZIsZxhE.exe
  C:\Windows\System\ZIsZxhE.exe
  2⤵
  PID:8592
- C:\Windows\System\QkAEsSG.exe
  C:\Windows\System\QkAEsSG.exe
  2⤵
  PID:8608
- C:\Windows\System\FNIddzh.exe
  C:\Windows\System\FNIddzh.exe
  2⤵
  PID:8632
- C:\Windows\System\vPmWQQA.exe
  C:\Windows\System\vPmWQQA.exe
  2⤵
  PID:8656
- C:\Windows\System\zQSXOxU.exe
  C:\Windows\System\zQSXOxU.exe
  2⤵
  PID:8676
- C:\Windows\System\IerwIHQ.exe
  C:\Windows\System\IerwIHQ.exe
  2⤵
  PID:8700
- C:\Windows\System\uznMxyF.exe
  C:\Windows\System\uznMxyF.exe
  2⤵
  PID:8716
- C:\Windows\System\gjEPKdT.exe
  C:\Windows\System\gjEPKdT.exe
  2⤵
  PID:8732
- C:\Windows\System\dLqyECl.exe
  C:\Windows\System\dLqyECl.exe
  2⤵
  PID:8756
- C:\Windows\System\xOGTihu.exe
  C:\Windows\System\xOGTihu.exe
  2⤵
  PID:8780
- C:\Windows\System\XoIwsZW.exe
  C:\Windows\System\XoIwsZW.exe
  2⤵
  PID:8800
- C:\Windows\System\UOiaDmH.exe
  C:\Windows\System\UOiaDmH.exe
  2⤵
  PID:8816
- C:\Windows\System\RVCwINZ.exe
  C:\Windows\System\RVCwINZ.exe
  2⤵
  PID:8836
- C:\Windows\System\IUOvPnM.exe
  C:\Windows\System\IUOvPnM.exe
  2⤵
  PID:8856
- C:\Windows\System\DEThHHg.exe
  C:\Windows\System\DEThHHg.exe
  2⤵
  PID:8880
- C:\Windows\System\KwDxxKh.exe
  C:\Windows\System\KwDxxKh.exe
  2⤵
  PID:8904
- C:\Windows\System\mJPqhyO.exe
  C:\Windows\System\mJPqhyO.exe
  2⤵
  PID:8928
- C:\Windows\System\REJvSYg.exe
  C:\Windows\System\REJvSYg.exe
  2⤵
  PID:8944
- C:\Windows\System\lpTQaSY.exe
  C:\Windows\System\lpTQaSY.exe
  2⤵
  PID:8980
- C:\Windows\System\ROvLoEF.exe
  C:\Windows\System\ROvLoEF.exe
  2⤵
  PID:9000
- C:\Windows\System\LgXSFzq.exe
  C:\Windows\System\LgXSFzq.exe
  2⤵
  PID:9020
- C:\Windows\System\ixOMwoR.exe
  C:\Windows\System\ixOMwoR.exe
  2⤵
  PID:9036
- C:\Windows\System\weoHZtg.exe
  C:\Windows\System\weoHZtg.exe
  2⤵
  PID:9060
- C:\Windows\System\wxtebpu.exe
  C:\Windows\System\wxtebpu.exe
  2⤵
  PID:9080
- C:\Windows\System\KJRBtVM.exe
  C:\Windows\System\KJRBtVM.exe
  2⤵
  PID:9100
- C:\Windows\System\GOPjOSl.exe
  C:\Windows\System\GOPjOSl.exe
  2⤵
  PID:9128
- C:\Windows\System\whScHUY.exe
  C:\Windows\System\whScHUY.exe
  2⤵
  PID:9144
- C:\Windows\System\WImsLGe.exe
  C:\Windows\System\WImsLGe.exe
  2⤵
  PID:9164
- C:\Windows\System\XCLHBsd.exe
  C:\Windows\System\XCLHBsd.exe
  2⤵
  PID:9184
- C:\Windows\System\MAUkoia.exe
  C:\Windows\System\MAUkoia.exe
  2⤵
  PID:7460
- C:\Windows\System\DyDzuvD.exe
  C:\Windows\System\DyDzuvD.exe
  2⤵
  PID:7544
- C:\Windows\System\ZJPQLvz.exe
  C:\Windows\System\ZJPQLvz.exe
  2⤵
  PID:6348
- C:\Windows\System\jeYqtPc.exe
  C:\Windows\System\jeYqtPc.exe
  2⤵
  PID:5636
- C:\Windows\System\CbcPTfy.exe
  C:\Windows\System\CbcPTfy.exe
  2⤵
  PID:7760
- C:\Windows\System\VBRwxNc.exe
  C:\Windows\System\VBRwxNc.exe
  2⤵
  PID:8864
- C:\Windows\System\NslJqzP.exe
  C:\Windows\System\NslJqzP.exe
  2⤵
  PID:8876
- C:\Windows\System\HueiVhF.exe
  C:\Windows\System\HueiVhF.exe
  2⤵
  PID:9008
- C:\Windows\System\BAalQPQ.exe
  C:\Windows\System\BAalQPQ.exe
  2⤵
  PID:8172
- C:\Windows\System\VaQwqBx.exe
  C:\Windows\System\VaQwqBx.exe
  2⤵
  PID:8360
- C:\Windows\System\pxvgfqy.exe
  C:\Windows\System\pxvgfqy.exe
  2⤵
  PID:8432
- C:\Windows\System\ktgxITf.exe
  C:\Windows\System\ktgxITf.exe
  2⤵
  PID:8556
- C:\Windows\System\SutLfpP.exe
  C:\Windows\System\SutLfpP.exe
  2⤵
  PID:6720
- C:\Windows\System\biKhWSO.exe
  C:\Windows\System\biKhWSO.exe
  2⤵
  PID:8652
- C:\Windows\System\FIvgspb.exe
  C:\Windows\System\FIvgspb.exe
  2⤵
  PID:8728
- C:\Windows\System\QBYemZj.exe
  C:\Windows\System\QBYemZj.exe
  2⤵
  PID:8792
- C:\Windows\System\wZbeJpk.exe
  C:\Windows\System\wZbeJpk.exe
  2⤵
  PID:8812
- C:\Windows\System\XfyRyRR.exe
  C:\Windows\System\XfyRyRR.exe
  2⤵
  PID:4516
- C:\Windows\System\TkobSGI.exe
  C:\Windows\System\TkobSGI.exe
  2⤵
  PID:8900
- C:\Windows\System\GocjzuR.exe
  C:\Windows\System\GocjzuR.exe
  2⤵
  PID:8696
- C:\Windows\System\LktRYEz.exe
  C:\Windows\System\LktRYEz.exe
  2⤵
  PID:9200
- C:\Windows\System\HRTlWDz.exe
  C:\Windows\System\HRTlWDz.exe
  2⤵
  PID:8252
- C:\Windows\System\XIJllqw.exe
  C:\Windows\System\XIJllqw.exe
  2⤵
  PID:8920
- C:\Windows\System\EKxBkGV.exe
  C:\Windows\System\EKxBkGV.exe
  2⤵
  PID:8952
- C:\Windows\System\vVzNeos.exe
  C:\Windows\System\vVzNeos.exe
  2⤵
  PID:9108
- C:\Windows\System\gdBJpBs.exe
  C:\Windows\System\gdBJpBs.exe
  2⤵
  PID:9252
- C:\Windows\System\mgbUpJd.exe
  C:\Windows\System\mgbUpJd.exe
  2⤵
  PID:9280
- C:\Windows\System\gOVaHzR.exe
  C:\Windows\System\gOVaHzR.exe
  2⤵
  PID:9364
- C:\Windows\System\XCzczvM.exe
  C:\Windows\System\XCzczvM.exe
  2⤵
  PID:9396
- C:\Windows\System\pquoWSP.exe
  C:\Windows\System\pquoWSP.exe
  2⤵
  PID:9412
- C:\Windows\System\eTufgJW.exe
  C:\Windows\System\eTufgJW.exe
  2⤵
  PID:9436
- C:\Windows\System\geqiomg.exe
  C:\Windows\System\geqiomg.exe
  2⤵
  PID:9460
- C:\Windows\System\JzdjgRB.exe
  C:\Windows\System\JzdjgRB.exe
  2⤵
  PID:9488
- C:\Windows\System\ovQkuxu.exe
  C:\Windows\System\ovQkuxu.exe
  2⤵
  PID:9504
- C:\Windows\System\hJlXDWK.exe
  C:\Windows\System\hJlXDWK.exe
  2⤵
  PID:9528
- C:\Windows\System\OvYDasY.exe
  C:\Windows\System\OvYDasY.exe
  2⤵
  PID:9572
- C:\Windows\System\FhBzNQM.exe
  C:\Windows\System\FhBzNQM.exe
  2⤵
  PID:9608
- C:\Windows\System\rFmBsYx.exe
  C:\Windows\System\rFmBsYx.exe
  2⤵
  PID:9632
- C:\Windows\System\vZQlVLp.exe
  C:\Windows\System\vZQlVLp.exe
  2⤵
  PID:9648
- C:\Windows\System\xQvqMXL.exe
  C:\Windows\System\xQvqMXL.exe
  2⤵
  PID:9672
- C:\Windows\System\ziKLSYc.exe
  C:\Windows\System\ziKLSYc.exe
  2⤵
  PID:9688
- C:\Windows\System\grbfpZw.exe
  C:\Windows\System\grbfpZw.exe
  2⤵
  PID:9712
- C:\Windows\System\XHyScTs.exe
  C:\Windows\System\XHyScTs.exe
  2⤵
  PID:9732
- C:\Windows\System\GqHFpPc.exe
  C:\Windows\System\GqHFpPc.exe
  2⤵
  PID:9784
- C:\Windows\System\AuTlEJi.exe
  C:\Windows\System\AuTlEJi.exe
  2⤵
  PID:9804
- C:\Windows\System\zjyPUff.exe
  C:\Windows\System\zjyPUff.exe
  2⤵
  PID:9832
- C:\Windows\System\cMVGXji.exe
  C:\Windows\System\cMVGXji.exe
  2⤵
  PID:9856
- C:\Windows\System\gqLvvrZ.exe
  C:\Windows\System\gqLvvrZ.exe
  2⤵
  PID:9872
- C:\Windows\System\wAHfXCC.exe
  C:\Windows\System\wAHfXCC.exe
  2⤵
  PID:7976
- C:\Windows\System\xWjJqKl.exe
  C:\Windows\System\xWjJqKl.exe
  2⤵
  PID:7504
- C:\Windows\System\NzwxnNf.exe
  C:\Windows\System\NzwxnNf.exe
  2⤵
  PID:8144
- C:\Windows\System\CEwmgxe.exe
  C:\Windows\System\CEwmgxe.exe
  2⤵
  PID:9312
- C:\Windows\System\UVqsbqs.exe
  C:\Windows\System\UVqsbqs.exe
  2⤵
  PID:9500
- C:\Windows\System\osMNgyR.exe
  C:\Windows\System\osMNgyR.exe
  2⤵
  PID:9604
- C:\Windows\System\GTFedHA.exe
  C:\Windows\System\GTFedHA.exe
  2⤵
  PID:9848
- C:\Windows\System\QJYUAPc.exe
  C:\Windows\System\QJYUAPc.exe
  2⤵
  PID:9296
- C:\Windows\System\CbsqYIH.exe
  C:\Windows\System\CbsqYIH.exe
  2⤵
  PID:9552
- C:\Windows\System\RSxDyEK.exe
  C:\Windows\System\RSxDyEK.exe
  2⤵
  PID:9700
- C:\Windows\System\XdCKVLP.exe
  C:\Windows\System\XdCKVLP.exe
  2⤵
  PID:9892
- C:\Windows\System\TpoOcbT.exe
  C:\Windows\System\TpoOcbT.exe
  2⤵
  PID:8152
- C:\Windows\System\rsRHJYz.exe
  C:\Windows\System\rsRHJYz.exe
  2⤵
  PID:2344
- C:\Windows\System\HXaiJRJ.exe
  C:\Windows\System\HXaiJRJ.exe
  2⤵
  PID:9244
- C:\Windows\System\PzQXbKb.exe
  C:\Windows\System\PzQXbKb.exe
  2⤵
  PID:10052
- C:\Windows\System\FlCdpgN.exe
  C:\Windows\System\FlCdpgN.exe
  2⤵
  PID:10076
- C:\Windows\System\hOcnZdo.exe
  C:\Windows\System\hOcnZdo.exe
  2⤵
  PID:9428
- C:\Windows\System\misvlBW.exe
  C:\Windows\System\misvlBW.exe
  2⤵
  PID:9476
- C:\Windows\System\bbjsnuM.exe
  C:\Windows\System\bbjsnuM.exe
  2⤵
  PID:9660
- C:\Windows\System\gCkQfgy.exe
  C:\Windows\System\gCkQfgy.exe
  2⤵
  PID:9704
- C:\Windows\System\QuZkqMm.exe
  C:\Windows\System\QuZkqMm.exe
  2⤵
  PID:9744
- C:\Windows\System\KBOIEDM.exe
  C:\Windows\System\KBOIEDM.exe
  2⤵
  PID:6312
- C:\Windows\System\fFdXVXL.exe
  C:\Windows\System\fFdXVXL.exe
  2⤵
  PID:5240
- C:\Windows\System\sKPEgxT.exe
  C:\Windows\System\sKPEgxT.exe
  2⤵
  PID:4980
- C:\Windows\System\kthYmil.exe
  C:\Windows\System\kthYmil.exe
  2⤵
  PID:10048
- C:\Windows\System\DcgjOnN.exe
  C:\Windows\System\DcgjOnN.exe
  2⤵
  PID:10088
- C:\Windows\System\WqIyVZP.exe
  C:\Windows\System\WqIyVZP.exe
  2⤵
  PID:10144
- C:\Windows\System\jHLNbTN.exe
  C:\Windows\System\jHLNbTN.exe
  2⤵
  PID:6452
- C:\Windows\System\UXtckyL.exe
  C:\Windows\System\UXtckyL.exe
  2⤵
  PID:9224
- C:\Windows\System\DQSJsUK.exe
  C:\Windows\System\DQSJsUK.exe
  2⤵
  PID:9568
- C:\Windows\System\UOawlEr.exe
  C:\Windows\System\UOawlEr.exe
  2⤵
  PID:9844
- C:\Windows\System\ThXeaqt.exe
  C:\Windows\System\ThXeaqt.exe
  2⤵
  PID:9204
- C:\Windows\System\FYmnBce.exe
  C:\Windows\System\FYmnBce.exe
  2⤵
  PID:10452
- C:\Windows\System\iwtzvbZ.exe
  C:\Windows\System\iwtzvbZ.exe
  2⤵
  PID:10516
- C:\Windows\System\HRTwaQT.exe
  C:\Windows\System\HRTwaQT.exe
  2⤵
  PID:10560
- C:\Windows\System\WABieca.exe
  C:\Windows\System\WABieca.exe
  2⤵
  PID:10584
- C:\Windows\System\urXOPqd.exe
  C:\Windows\System\urXOPqd.exe
  2⤵
  PID:10612
- C:\Windows\System\gAmMgQT.exe
  C:\Windows\System\gAmMgQT.exe
  2⤵
  PID:10632
- C:\Windows\System\qwtSwpu.exe
  C:\Windows\System\qwtSwpu.exe
  2⤵
  PID:10664
- C:\Windows\System\nzmqDnr.exe
  C:\Windows\System\nzmqDnr.exe
  2⤵
  PID:10680
- C:\Windows\System\bkGvTan.exe
  C:\Windows\System\bkGvTan.exe
  2⤵
  PID:10700
- C:\Windows\System\YyCpXTP.exe
  C:\Windows\System\YyCpXTP.exe
  2⤵
  PID:10724
- C:\Windows\System\ssrDGcC.exe
  C:\Windows\System\ssrDGcC.exe
  2⤵
  PID:10748
- C:\Windows\System\qFiYRlb.exe
  C:\Windows\System\qFiYRlb.exe
  2⤵
  PID:10768
- C:\Windows\System\HcAzdOr.exe
  C:\Windows\System\HcAzdOr.exe
  2⤵
  PID:10788
- C:\Windows\System\cNrfhya.exe
  C:\Windows\System\cNrfhya.exe
  2⤵
  PID:10812
- C:\Windows\System\jYRRcXs.exe
  C:\Windows\System\jYRRcXs.exe
  2⤵
  PID:10836
- C:\Windows\System\DfxlGem.exe
  C:\Windows\System\DfxlGem.exe
  2⤵
  PID:10856
- C:\Windows\System\PRAALEh.exe
  C:\Windows\System\PRAALEh.exe
  2⤵
  PID:10872
- C:\Windows\System\xifSYLp.exe
  C:\Windows\System\xifSYLp.exe
  2⤵
  PID:10888
- C:\Windows\System\kNZEIfK.exe
  C:\Windows\System\kNZEIfK.exe
  2⤵
  PID:10904
- C:\Windows\System\rUxRkQm.exe
  C:\Windows\System\rUxRkQm.exe
  2⤵
  PID:10924
- C:\Windows\System\YywYNEW.exe
  C:\Windows\System\YywYNEW.exe
  2⤵
  PID:10948
- C:\Windows\System\jRWrPeB.exe
  C:\Windows\System\jRWrPeB.exe
  2⤵
  PID:10968
- C:\Windows\System\uFSRHkE.exe
  C:\Windows\System\uFSRHkE.exe
  2⤵
  PID:10984
- C:\Windows\System\VQiDinG.exe
  C:\Windows\System\VQiDinG.exe
  2⤵
  PID:11004
- C:\Windows\System\ZRyCAOy.exe
  C:\Windows\System\ZRyCAOy.exe
  2⤵
  PID:11024
- C:\Windows\System\FmfRGRW.exe
  C:\Windows\System\FmfRGRW.exe
  2⤵
  PID:11048
- C:\Windows\System\PRqPSww.exe
  C:\Windows\System\PRqPSww.exe
  2⤵
  PID:11072
- C:\Windows\System\vzkLLoJ.exe
  C:\Windows\System\vzkLLoJ.exe
  2⤵
  PID:11092
- C:\Windows\System\owbkBYG.exe
  C:\Windows\System\owbkBYG.exe
  2⤵
  PID:11108
- C:\Windows\System\szbTTYh.exe
  C:\Windows\System\szbTTYh.exe
  2⤵
  PID:11224
- C:\Windows\System\XYcycJT.exe
  C:\Windows\System\XYcycJT.exe
  2⤵
  PID:11248
- C:\Windows\System\UkegCzZ.exe
  C:\Windows\System\UkegCzZ.exe
  2⤵
  PID:8768
- C:\Windows\System\mmMqNNz.exe
  C:\Windows\System\mmMqNNz.exe
  2⤵
  PID:10492
- C:\Windows\System\OSoWydU.exe
  C:\Windows\System\OSoWydU.exe
  2⤵
  PID:10552
- C:\Windows\System\lnwIQPI.exe
  C:\Windows\System\lnwIQPI.exe
  2⤵
  PID:10388
- C:\Windows\System\pRddLUr.exe
  C:\Windows\System\pRddLUr.exe
  2⤵
  PID:10420
- C:\Windows\System\rfYDLDs.exe
  C:\Windows\System\rfYDLDs.exe
  2⤵
  PID:11180
- C:\Windows\System\UbeHRpy.exe
  C:\Windows\System\UbeHRpy.exe
  2⤵
  PID:5024
- C:\Windows\System\HyntLyB.exe
  C:\Windows\System\HyntLyB.exe
  2⤵
  PID:10820
- C:\Windows\System\RPgzztG.exe
  C:\Windows\System\RPgzztG.exe
  2⤵
  PID:10900
- C:\Windows\System\xjTsyzy.exe
  C:\Windows\System\xjTsyzy.exe
  2⤵
  PID:10956
- C:\Windows\System\hBmmkgv.exe
  C:\Windows\System\hBmmkgv.exe
  2⤵
  PID:10208
- C:\Windows\System\XFtDBIx.exe
  C:\Windows\System\XFtDBIx.exe
  2⤵
  PID:11060
- C:\Windows\System\XiYicpE.exe
  C:\Windows\System\XiYicpE.exe
  2⤵
  PID:11100
- C:\Windows\System\WDoVvAW.exe
  C:\Windows\System\WDoVvAW.exe
  2⤵
  PID:11140
- C:\Windows\System\HxcWiRX.exe
  C:\Windows\System\HxcWiRX.exe
  2⤵
  PID:10484
- C:\Windows\System\aBzZnCG.exe
  C:\Windows\System\aBzZnCG.exe
  2⤵
  PID:9384
- C:\Windows\System\hZLdpfp.exe
  C:\Windows\System\hZLdpfp.exe
  2⤵
  PID:8088
- C:\Windows\System\tDJyTTP.exe
  C:\Windows\System\tDJyTTP.exe
  2⤵
  PID:10408
- C:\Windows\System\ZkNYJXI.exe
  C:\Windows\System\ZkNYJXI.exe
  2⤵
  PID:10276
- C:\Windows\System\jVQqiqy.exe
  C:\Windows\System\jVQqiqy.exe
  2⤵
  PID:5748
- C:\Windows\System\QhJKuKt.exe
  C:\Windows\System\QhJKuKt.exe
  2⤵
  PID:9740
- C:\Windows\System\kGVtUAW.exe
  C:\Windows\System\kGVtUAW.exe
  2⤵
  PID:10608
- C:\Windows\System\UtZgKDA.exe
  C:\Windows\System\UtZgKDA.exe
  2⤵
  PID:10920
- C:\Windows\System\jNlUmYM.exe
  C:\Windows\System\jNlUmYM.exe
  2⤵
  PID:11196
- C:\Windows\System\iDhUpqy.exe
  C:\Windows\System\iDhUpqy.exe
  2⤵
  PID:11088
- C:\Windows\System\mRxiRuE.exe
  C:\Windows\System\mRxiRuE.exe
  2⤵
  PID:10396
- C:\Windows\System\TEAxIhX.exe
  C:\Windows\System\TEAxIhX.exe
  2⤵
  PID:11276
- C:\Windows\System\xDbpuAU.exe
  C:\Windows\System\xDbpuAU.exe
  2⤵
  PID:11292
- C:\Windows\System\ZnDpcZM.exe
  C:\Windows\System\ZnDpcZM.exe
  2⤵
  PID:11312
- C:\Windows\System\KdEKtGX.exe
  C:\Windows\System\KdEKtGX.exe
  2⤵
  PID:11332
- C:\Windows\System\wiDWJMp.exe
  C:\Windows\System\wiDWJMp.exe
  2⤵
  PID:11348
- C:\Windows\System\jUaTvRF.exe
  C:\Windows\System\jUaTvRF.exe
  2⤵
  PID:11368
- C:\Windows\System\ktDgOBs.exe
  C:\Windows\System\ktDgOBs.exe
  2⤵
  PID:11388
- C:\Windows\System\RydAZYW.exe
  C:\Windows\System\RydAZYW.exe
  2⤵
  PID:11432
- C:\Windows\System\VrsJWvn.exe
  C:\Windows\System\VrsJWvn.exe
  2⤵
  PID:11456
- C:\Windows\System\cYEPheW.exe
  C:\Windows\System\cYEPheW.exe
  2⤵
  PID:11484
- C:\Windows\System\sOapbyx.exe
  C:\Windows\System\sOapbyx.exe
  2⤵
  PID:11500
- C:\Windows\System\vrGdVLP.exe
  C:\Windows\System\vrGdVLP.exe
  2⤵
  PID:11520
- C:\Windows\System\KoIuRMw.exe
  C:\Windows\System\KoIuRMw.exe
  2⤵
  PID:11540
- C:\Windows\System\RKFDtxO.exe
  C:\Windows\System\RKFDtxO.exe
  2⤵
  PID:11560
- C:\Windows\System\LRsglWR.exe
  C:\Windows\System\LRsglWR.exe
  2⤵
  PID:11580
- C:\Windows\System\NJUNuQY.exe
  C:\Windows\System\NJUNuQY.exe
  2⤵
  PID:11600
- C:\Windows\System\sGbwplJ.exe
  C:\Windows\System\sGbwplJ.exe
  2⤵
  PID:11624
- C:\Windows\System\vNdnyCk.exe
  C:\Windows\System\vNdnyCk.exe
  2⤵
  PID:11648
- C:\Windows\System\QWUSXQH.exe
  C:\Windows\System\QWUSXQH.exe
  2⤵
  PID:11672
- C:\Windows\System\cLHjeEO.exe
  C:\Windows\System\cLHjeEO.exe
  2⤵
  PID:11688
- C:\Windows\System\VmaroRy.exe
  C:\Windows\System\VmaroRy.exe
  2⤵
  PID:11716
- C:\Windows\System\eXHjBWw.exe
  C:\Windows\System\eXHjBWw.exe
  2⤵
  PID:11740
- C:\Windows\System\fCPGvYx.exe
  C:\Windows\System\fCPGvYx.exe
  2⤵
  PID:11756
- C:\Windows\System\dRjpADU.exe
  C:\Windows\System\dRjpADU.exe
  2⤵
  PID:11776
- C:\Windows\System\VshMuBx.exe
  C:\Windows\System\VshMuBx.exe
  2⤵
  PID:11872
- C:\Windows\System\EprSoHJ.exe
  C:\Windows\System\EprSoHJ.exe
  2⤵
  PID:11888
- C:\Windows\System\KkhPQke.exe
  C:\Windows\System\KkhPQke.exe
  2⤵
  PID:11904
- C:\Windows\System\AApnJDE.exe
  C:\Windows\System\AApnJDE.exe
  2⤵
  PID:11976
- C:\Windows\System\DWQbUAZ.exe
  C:\Windows\System\DWQbUAZ.exe
  2⤵
  PID:12076
- C:\Windows\System\sFQYqEp.exe
  C:\Windows\System\sFQYqEp.exe
  2⤵
  PID:12096
- C:\Windows\System\VlTiIyh.exe
  C:\Windows\System\VlTiIyh.exe
  2⤵
  PID:12124
- C:\Windows\System\rGKZAEL.exe
  C:\Windows\System\rGKZAEL.exe
  2⤵
  PID:12168
- C:\Windows\System\GPTjMGF.exe
  C:\Windows\System\GPTjMGF.exe
  2⤵
  PID:12188
- C:\Windows\System\cmoNXwl.exe
  C:\Windows\System\cmoNXwl.exe
  2⤵
  PID:12204
- C:\Windows\System\uHqlSek.exe
  C:\Windows\System\uHqlSek.exe
  2⤵
  PID:12220
- C:\Windows\System\VSEOVZG.exe
  C:\Windows\System\VSEOVZG.exe
  2⤵
  PID:12236
- C:\Windows\System\msiVFIn.exe
  C:\Windows\System\msiVFIn.exe
  2⤵
  PID:12260
- C:\Windows\System\xqAFSse.exe
  C:\Windows\System\xqAFSse.exe
  2⤵
  PID:10412
- C:\Windows\System\muIyTGJ.exe
  C:\Windows\System\muIyTGJ.exe
  2⤵
  PID:1760
- C:\Windows\System\ALthxFW.exe
  C:\Windows\System\ALthxFW.exe
  2⤵
  PID:2844
- C:\Windows\System\SERGXVS.exe
  C:\Windows\System\SERGXVS.exe
  2⤵
  PID:2252
- C:\Windows\System\zbSHwwK.exe
  C:\Windows\System\zbSHwwK.exe
  2⤵
  PID:10944
- C:\Windows\System\rkCnMsn.exe
  C:\Windows\System\rkCnMsn.exe
  2⤵
  PID:5444
- C:\Windows\System\IhcHHPQ.exe
  C:\Windows\System\IhcHHPQ.exe
  2⤵
  PID:11300
- C:\Windows\System\kTjfyCj.exe
  C:\Windows\System\kTjfyCj.exe
  2⤵
  PID:11444
- C:\Windows\System\nsFUayd.exe
  C:\Windows\System\nsFUayd.exe
  2⤵
  PID:11496
- C:\Windows\System\EtWwVeA.exe
  C:\Windows\System\EtWwVeA.exe
  2⤵
  PID:11680
- C:\Windows\System\nymVJMk.exe
  C:\Windows\System\nymVJMk.exe
  2⤵
  PID:11708
- C:\Windows\System\oWnlzdS.exe
  C:\Windows\System\oWnlzdS.exe
  2⤵
  PID:11448
- C:\Windows\System\xOqWkPP.exe
  C:\Windows\System\xOqWkPP.exe
  2⤵
  PID:11644
- C:\Windows\System\CvTetEI.exe
  C:\Windows\System\CvTetEI.exe
  2⤵
  PID:11684
- C:\Windows\System\ZKudzjx.exe
  C:\Windows\System\ZKudzjx.exe
  2⤵
  PID:11556
- C:\Windows\System\RolLSfU.exe
  C:\Windows\System\RolLSfU.exe
  2⤵
  PID:11592
- C:\Windows\System\StRXtfD.exe
  C:\Windows\System\StRXtfD.exe
  2⤵
  PID:11668
- C:\Windows\System\ZOuDAoB.exe
  C:\Windows\System\ZOuDAoB.exe
  2⤵
  PID:11772
- C:\Windows\System\smulPLE.exe
  C:\Windows\System\smulPLE.exe
  2⤵
  PID:11792
- C:\Windows\System\GFtTjSo.exe
  C:\Windows\System\GFtTjSo.exe
  2⤵
  PID:7660
- C:\Windows\System\wjnhsWz.exe
  C:\Windows\System\wjnhsWz.exe
  2⤵
  PID:12064
- C:\Windows\System\Hupzmkm.exe
  C:\Windows\System\Hupzmkm.exe
  2⤵
  PID:12072
- C:\Windows\System\syPxVHy.exe
  C:\Windows\System\syPxVHy.exe
  2⤵
  PID:12036
- C:\Windows\System\fOPHnSE.exe
  C:\Windows\System\fOPHnSE.exe
  2⤵
  PID:12200
- C:\Windows\System\TglYLRI.exe
  C:\Windows\System\TglYLRI.exe
  2⤵
  PID:12084
- C:\Windows\System\RspdSPC.exe
  C:\Windows\System\RspdSPC.exe
  2⤵
  PID:12232
- C:\Windows\System\zIdJtjK.exe
  C:\Windows\System\zIdJtjK.exe
  2⤵
  PID:4680
- C:\Windows\System\bHUHjQj.exe
  C:\Windows\System\bHUHjQj.exe
  2⤵
  PID:11912
- C:\Windows\System\lNVqrVA.exe
  C:\Windows\System\lNVqrVA.exe
  2⤵
  PID:11804
- C:\Windows\System\iOSRxLy.exe
  C:\Windows\System\iOSRxLy.exe
  2⤵
  PID:11552
- C:\Windows\System\ynACkJv.exe
  C:\Windows\System\ynACkJv.exe
  2⤵
  PID:3412
- C:\Windows\System\TRbhJTt.exe
  C:\Windows\System\TRbhJTt.exe
  2⤵
  PID:12304
- C:\Windows\System\xwxCqaS.exe
  C:\Windows\System\xwxCqaS.exe
  2⤵
  PID:12348
- C:\Windows\System\mxZDVTS.exe
  C:\Windows\System\mxZDVTS.exe
  2⤵
  PID:12364
- C:\Windows\System\QOIxTtY.exe
  C:\Windows\System\QOIxTtY.exe
  2⤵
  PID:12460
- C:\Windows\System\OBvTJTE.exe
  C:\Windows\System\OBvTJTE.exe
  2⤵
  PID:12480
- C:\Windows\System\CCjcDye.exe
  C:\Windows\System\CCjcDye.exe
  2⤵
  PID:12496
- C:\Windows\System\mrsbEUy.exe
  C:\Windows\System\mrsbEUy.exe
  2⤵
  PID:12512
- C:\Windows\System\wAUGpOd.exe
  C:\Windows\System\wAUGpOd.exe
  2⤵
  PID:12528
- C:\Windows\System\KccIxbB.exe
  C:\Windows\System\KccIxbB.exe
  2⤵
  PID:12568
- C:\Windows\System\CXtkvlh.exe
  C:\Windows\System\CXtkvlh.exe
  2⤵
  PID:12588
- C:\Windows\System\xQlEPwr.exe
  C:\Windows\System\xQlEPwr.exe
  2⤵
  PID:12620
- C:\Windows\System\jSHypPn.exe
  C:\Windows\System\jSHypPn.exe
  2⤵
  PID:12640
- C:\Windows\System\CggvhsF.exe
  C:\Windows\System\CggvhsF.exe
  2⤵
  PID:12660
- C:\Windows\System\DGdUdnm.exe
  C:\Windows\System\DGdUdnm.exe
  2⤵
  PID:12728
- C:\Windows\System\pBpErDG.exe
  C:\Windows\System\pBpErDG.exe
  2⤵
  PID:12744
- C:\Windows\System\OLAKaIw.exe
  C:\Windows\System\OLAKaIw.exe
  2⤵
  PID:12764
- C:\Windows\System\rPDutLy.exe
  C:\Windows\System\rPDutLy.exe
  2⤵
  PID:12784
- C:\Windows\System\BVyFbtW.exe
  C:\Windows\System\BVyFbtW.exe
  2⤵
  PID:12800
- C:\Windows\System\ItvVslP.exe
  C:\Windows\System\ItvVslP.exe
  2⤵
  PID:12816
- C:\Windows\System\aEaqyXQ.exe
  C:\Windows\System\aEaqyXQ.exe
  2⤵
  PID:12844
- C:\Windows\System\xAEaOhY.exe
  C:\Windows\System\xAEaOhY.exe
  2⤵
  PID:12860
- C:\Windows\System\uuACcOB.exe
  C:\Windows\System\uuACcOB.exe
  2⤵
  PID:12876
- C:\Windows\System\Vzxwdkd.exe
  C:\Windows\System\Vzxwdkd.exe
  2⤵
  PID:12896
- C:\Windows\System\ZzYLXli.exe
  C:\Windows\System\ZzYLXli.exe
  2⤵
  PID:12912
- C:\Windows\System\FnNgVwZ.exe
  C:\Windows\System\FnNgVwZ.exe
  2⤵
  PID:12940
- C:\Windows\System\ZGLqSaA.exe
  C:\Windows\System\ZGLqSaA.exe
  2⤵
  PID:12968
- C:\Windows\System\nnPesIk.exe
  C:\Windows\System\nnPesIk.exe
  2⤵
  PID:12984
- C:\Windows\System\TmxjBvR.exe
  C:\Windows\System\TmxjBvR.exe
  2⤵
  PID:13000
- C:\Windows\System\BPzZzff.exe
  C:\Windows\System\BPzZzff.exe
  2⤵
  PID:13016
- C:\Windows\System\vFhRqim.exe
  C:\Windows\System\vFhRqim.exe
  2⤵
  PID:13036
- C:\Windows\System\BxoGetZ.exe
  C:\Windows\System\BxoGetZ.exe
  2⤵
  PID:13300
- C:\Windows\System\MFIAERB.exe
  C:\Windows\System\MFIAERB.exe
  2⤵
  PID:12048
- C:\Windows\System\NJHRLSc.exe
  C:\Windows\System\NJHRLSc.exe
  2⤵
  PID:6040
- C:\Windows\System\ABTGPDS.exe
  C:\Windows\System\ABTGPDS.exe
  2⤵
  PID:12632
- C:\Windows\System\suGnJiz.exe
  C:\Windows\System\suGnJiz.exe
  2⤵
  PID:12612
- C:\Windows\System\dJihpdt.exe
  C:\Windows\System\dJihpdt.exe
  2⤵
  PID:12980
- C:\Windows\System\qdehwDn.exe
  C:\Windows\System\qdehwDn.exe
  2⤵
  PID:12868
- C:\Windows\System\hLMxixt.exe
  C:\Windows\System\hLMxixt.exe
  2⤵
  PID:13048
- C:\Windows\System\PgXkNuQ.exe
  C:\Windows\System\PgXkNuQ.exe
  2⤵
  PID:12856
- C:\Windows\System\KrqFNmY.exe
  C:\Windows\System\KrqFNmY.exe
  2⤵
  PID:12904
- C:\Windows\System\eQcnOvG.exe
  C:\Windows\System\eQcnOvG.exe
  2⤵
  PID:12932
- C:\Windows\System\sIaaSde.exe
  C:\Windows\System\sIaaSde.exe
  2⤵
  PID:13088
- C:\Windows\System\UwgCdVM.exe
  C:\Windows\System\UwgCdVM.exe
  2⤵
  PID:13124
- C:\Windows\System\uNMEcyP.exe
  C:\Windows\System\uNMEcyP.exe
  2⤵
  PID:13096
- C:\Windows\System\obpKHxd.exe
  C:\Windows\System\obpKHxd.exe
  2⤵
  PID:13188
- C:\Windows\System\xNjtoQR.exe
  C:\Windows\System\xNjtoQR.exe
  2⤵
  PID:4992
- C:\Windows\System\ySzKPMM.exe
  C:\Windows\System\ySzKPMM.exe
  2⤵
  PID:13208
- C:\Windows\System\vvvnxIS.exe
  C:\Windows\System\vvvnxIS.exe
  2⤵
  PID:12380
- C:\Windows\System\oUsFrAC.exe
  C:\Windows\System\oUsFrAC.exe
  2⤵
  PID:13252
- C:\Windows\System\rffvOYu.exe
  C:\Windows\System\rffvOYu.exe
  2⤵
  PID:12320
- C:\Windows\System\vxDHLXg.exe
  C:\Windows\System\vxDHLXg.exe
  2⤵
  PID:13308
- C:\Windows\System\TVKbpVu.exe
  C:\Windows\System\TVKbpVu.exe
  2⤵
  PID:12340
- C:\Windows\System\GLtKNwl.exe
  C:\Windows\System\GLtKNwl.exe
  2⤵
  PID:12688
- C:\Windows\System\WcEWZXf.exe
  C:\Windows\System\WcEWZXf.exe
  2⤵
  PID:12892
- C:\Windows\System\QxfNGIq.exe
  C:\Windows\System\QxfNGIq.exe
  2⤵
  PID:12652
- C:\Windows\System\zVLogCX.exe
  C:\Windows\System\zVLogCX.exe
  2⤵
  PID:12648
- C:\Windows\System\OmwIeVd.exe
  C:\Windows\System\OmwIeVd.exe
  2⤵
  PID:12760
- C:\Windows\System\lMZbxzl.exe
  C:\Windows\System\lMZbxzl.exe
  2⤵
  PID:12540
- C:\Windows\System\tCsIffY.exe
  C:\Windows\System\tCsIffY.exe
  2⤵
  PID:12492
- C:\Windows\System\OPZHHSN.exe
  C:\Windows\System\OPZHHSN.exe
  2⤵
  PID:13196
- C:\Windows\System\QCafevc.exe
  C:\Windows\System\QCafevc.exe
  2⤵
  PID:12564
- C:\Windows\System\xobcpXx.exe
  C:\Windows\System\xobcpXx.exe
  2⤵
  PID:2220
- C:\Windows\System\FEOqHJN.exe
  C:\Windows\System\FEOqHJN.exe
  2⤵
  PID:712
- C:\Windows\System\KQFRsLX.exe
  C:\Windows\System\KQFRsLX.exe
  2⤵
  PID:12840
- C:\Windows\System\evJkAMG.exe
  C:\Windows\System\evJkAMG.exe
  2⤵
  PID:12796
- C:\Windows\System\MNkaulu.exe
  C:\Windows\System\MNkaulu.exe
  2⤵
  PID:12716
- C:\Windows\System\GsgLUpA.exe
  C:\Windows\System\GsgLUpA.exe
  2⤵
  PID:5492
- C:\Windows\System\abwTbEj.exe
  C:\Windows\System\abwTbEj.exe
  2⤵
  PID:13212
- C:\Windows\System\WxOCyKn.exe
  C:\Windows\System\WxOCyKn.exe
  2⤵
  PID:1444
- C:\Windows\System\NAOBlKn.exe
  C:\Windows\System\NAOBlKn.exe
  2⤵
  PID:4400
- C:\Windows\System\gwSIUnr.exe
  C:\Windows\System\gwSIUnr.exe
  2⤵
  PID:12548
- C:\Windows\System\DwYdZwg.exe
  C:\Windows\System\DwYdZwg.exe
  2⤵
  PID:12324
- C:\Windows\System\PJKnGcj.exe
  C:\Windows\System\PJKnGcj.exe
  2⤵
  PID:12396
- C:\Windows\System\AFjtOTc.exe
  C:\Windows\System\AFjtOTc.exe
  2⤵
  PID:2864
- C:\Windows\System\uIOJmzN.exe
  C:\Windows\System\uIOJmzN.exe
  2⤵
  PID:2592
- C:\Windows\System\EnvHZBa.exe
  C:\Windows\System\EnvHZBa.exe
  2⤵
  PID:3268
- C:\Windows\System\tdZGJrO.exe
  C:\Windows\System\tdZGJrO.exe
  2⤵
  PID:12992
- C:\Windows\System\tTRCNmP.exe
  C:\Windows\System\tTRCNmP.exe
  2⤵
  PID:3816
- C:\Windows\System\Wnikijz.exe
  C:\Windows\System\Wnikijz.exe
  2⤵
  PID:1944
- C:\Windows\System\huHnhxW.exe
  C:\Windows\System\huHnhxW.exe
  2⤵
  PID:2480
- C:\Windows\System\nXznLMZ.exe
  C:\Windows\System\nXznLMZ.exe
  2⤵
  PID:3752
- C:\Windows\System\VmJjbQw.exe
  C:\Windows\System\VmJjbQw.exe
  2⤵
  PID:1292
- C:\Windows\System\MxPSzRE.exe
  C:\Windows\System\MxPSzRE.exe
  2⤵
  PID:4064
- C:\Windows\System\mfVCnuP.exe
  C:\Windows\System\mfVCnuP.exe
  2⤵
  PID:3652
- C:\Windows\System\EkhkkGM.exe
  C:\Windows\System\EkhkkGM.exe
  2⤵
  PID:3356
- C:\Windows\System\NyQEPGe.exe
  C:\Windows\System\NyQEPGe.exe
  2⤵
  PID:4224
- C:\Windows\System\UenfAvp.exe
  C:\Windows\System\UenfAvp.exe
  2⤵
  PID:12440
- C:\Windows\System\arFBdRb.exe
  C:\Windows\System\arFBdRb.exe
  2⤵
  PID:13084
- C:\Windows\System\gCCLMis.exe
  C:\Windows\System\gCCLMis.exe
  2⤵
  PID:2928
- C:\Windows\System\LQwmiIy.exe
  C:\Windows\System\LQwmiIy.exe
  2⤵
  PID:4356
- C:\Windows\System\kobSHsL.exe
  C:\Windows\System\kobSHsL.exe
  2⤵
  PID:1752
- C:\Windows\System\gEgwCtU.exe
  C:\Windows\System\gEgwCtU.exe
  2⤵
  PID:3264
- C:\Windows\System\oYfKQyO.exe
  C:\Windows\System\oYfKQyO.exe
  2⤵
  PID:5140
- C:\Windows\System\zMdqMVA.exe
  C:\Windows\System\zMdqMVA.exe
  2⤵
  PID:5320
- C:\Windows\System\aeIxHem.exe
  C:\Windows\System\aeIxHem.exe
  2⤵
  PID:3856
- C:\Windows\System\tNGVZdv.exe
  C:\Windows\System\tNGVZdv.exe
  2⤵
  PID:13340
- C:\Windows\System\LWbAaqt.exe
  C:\Windows\System\LWbAaqt.exe
  2⤵
  PID:13360
- C:\Windows\System\WIlqYJc.exe
  C:\Windows\System\WIlqYJc.exe
  2⤵
  PID:13380
- C:\Windows\System\YKbdNYZ.exe
  C:\Windows\System\YKbdNYZ.exe
  2⤵
  PID:13396
- C:\Windows\System\xHHsykM.exe
  C:\Windows\System\xHHsykM.exe
  2⤵
  PID:13416
- C:\Windows\System\HyPQslR.exe
  C:\Windows\System\HyPQslR.exe
  2⤵
  PID:13532
- C:\Windows\System\tSkGBcU.exe
  C:\Windows\System\tSkGBcU.exe
  2⤵
  PID:13548
- C:\Windows\System\kkUXPXN.exe
  C:\Windows\System\kkUXPXN.exe
  2⤵
  PID:13564
- C:\Windows\System\ZjIkyIK.exe
  C:\Windows\System\ZjIkyIK.exe
  2⤵
  PID:13580
- C:\Windows\System\YTdPunF.exe
  C:\Windows\System\YTdPunF.exe
  2⤵
  PID:13612
- C:\Windows\System\yhnWPdS.exe
  C:\Windows\System\yhnWPdS.exe
  2⤵
  PID:13648
- C:\Windows\System\jyDZqdc.exe
  C:\Windows\System\jyDZqdc.exe
  2⤵
  PID:13672
- C:\Windows\System\vdySNue.exe
  C:\Windows\System\vdySNue.exe
  2⤵
  PID:13692
- C:\Windows\System\FYEcKaL.exe
  C:\Windows\System\FYEcKaL.exe
  2⤵
  PID:13716
- C:\Windows\System\mTJzVxQ.exe
  C:\Windows\System\mTJzVxQ.exe
  2⤵
  PID:13736
- C:\Windows\System\AHbLMDS.exe
  C:\Windows\System\AHbLMDS.exe
  2⤵
  PID:13760
- C:\Windows\System\IdsxTdo.exe
  C:\Windows\System\IdsxTdo.exe
  2⤵
  PID:13784
- C:\Windows\System\scByiYV.exe
  C:\Windows\System\scByiYV.exe
  2⤵
  PID:13808
- C:\Windows\System\kRLYxPS.exe
  C:\Windows\System\kRLYxPS.exe
  2⤵
  PID:13828
- C:\Windows\System\JLyeCeU.exe
  C:\Windows\System\JLyeCeU.exe
  2⤵
  PID:13852
- C:\Windows\System\ZdNGyci.exe
  C:\Windows\System\ZdNGyci.exe
  2⤵
  PID:13872
- C:\Windows\System\WgcQjIw.exe
  C:\Windows\System\WgcQjIw.exe
  2⤵
  PID:13892
- C:\Windows\System\ITCIjys.exe
  C:\Windows\System\ITCIjys.exe
  2⤵
  PID:13912
- C:\Windows\System\DrJPrzr.exe
  C:\Windows\System\DrJPrzr.exe
  2⤵
  PID:13932
- C:\Windows\System\CVvSCPe.exe
  C:\Windows\System\CVvSCPe.exe
  2⤵
  PID:13948
- C:\Windows\System\UTwfAGf.exe
  C:\Windows\System\UTwfAGf.exe
  2⤵
  PID:13964
- C:\Windows\System\lmdDyBt.exe
  C:\Windows\System\lmdDyBt.exe
  2⤵
  PID:13980
- C:\Windows\System\FJdgoga.exe
  C:\Windows\System\FJdgoga.exe
  2⤵
  PID:13996
- C:\Windows\System\eJHTFxX.exe
  C:\Windows\System\eJHTFxX.exe
  2⤵
  PID:14012
- C:\Windows\System\WeqdUYS.exe
  C:\Windows\System\WeqdUYS.exe
  2⤵
  PID:14032
- C:\Windows\System\VbpUCbW.exe
  C:\Windows\System\VbpUCbW.exe
  2⤵
  PID:14064
- C:\Windows\System\zgychVx.exe
  C:\Windows\System\zgychVx.exe
  2⤵
  PID:14080
- C:\Windows\System\jAZHaWH.exe
  C:\Windows\System\jAZHaWH.exe
  2⤵
  PID:14096
- C:\Windows\System\mVTJEzD.exe
  C:\Windows\System\mVTJEzD.exe
  2⤵
  PID:14116
- C:\Windows\System\uooWctz.exe
  C:\Windows\System\uooWctz.exe
  2⤵
  PID:14300
- C:\Windows\System\VTaEpQS.exe
  C:\Windows\System\VTaEpQS.exe
  2⤵
  PID:14316
- C:\Windows\System\RYbMKfm.exe
  C:\Windows\System\RYbMKfm.exe
  2⤵
  PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l0kheydb.ewa.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BMHwzKM.exe

Filesize
1.8MB

MD5
13c88a19550a224e4fff294d4c427975

SHA1
1ff10f344a6678329a02966eee10e25ed8929e7f

SHA256
1d31f04f3b8453daf19d54496ab395689359b7d51cb595ecf234393cf76d4a06

SHA512
76ce7779d7af6c2924deb67e9475830922620990c73cf838e63daf6df96a30ea82199f33138d4b548a851618aa30e47891e897d6535834d9f593260b5668c13e

Download Submit
C:\Windows\System\BSUBUwv.exe

Filesize
1.8MB

MD5
ce870b429459c6461924854cda06817c

SHA1
6c669a261eb42c7a421bd0b4da84ccc577038a92

SHA256
b4f1a427a21ae7a899bed470178764b002dfd01f7568e0d15497711e55cc204c

SHA512
582c46dbe86d2a42832d7d09065fb9dcd02ecfe27ae09db4388edcb88227c7a1f31c4ed774eea5658bc66b0fa784e348b6df525f676618f2fc025c9ac9b049bd

Download Submit
C:\Windows\System\CdZtqDa.exe

Filesize
1.8MB

MD5
c970dd34d2926c63600d80abc6e25af5

SHA1
4b0e47529a2a37016ac16beb4f2d05b7b11821ee

SHA256
ef41267e106296c218104859c63db109a52a2cf951fe3054320912a708e8291d

SHA512
94c24face724eef9355a50f57e11e1603a26a6b8102c13bc31afefdcfb929c91835a2c43446f5a874c2e55938705b296176fb923cb7c4b6bc3f6902db695b622

Download Submit
C:\Windows\System\FIHvRMI.exe

Filesize
1.8MB

MD5
9d09fa9b665fc7884ece429a683cbb3f

SHA1
a0aeaba6c45ee5f508ba7b8158f936f05533c125

SHA256
eb525093907d66efa95462dd994ec62a619407412a95f8ae3046cd15533110b0

SHA512
9bbc7ad2a71c196ce05ef2cfb761ac5fcbcf833e478ae3890d5665187052c9b95b331f6bbaa12e154b463834eab485ca625c296fe2fdf4940004dc7fe554ff18

Download Submit
C:\Windows\System\GpRrudG.exe

Filesize
1.8MB

MD5
0ab7018ebdf2f0ee8965d44fe2aa9578

SHA1
583e8cf0797d825ab2223211e5ce90856d4b609b

SHA256
80ad8f39aa4683540432d48be370d1f20773b6a686259240787c778292d865f6

SHA512
090b26cf3736c1cf90aeec2f5a09788b6a2bba546467d225400b725c122f3369bc3aaf60f82855a92f773bc3eca142fa4edb4625ef939b56b0dd88b9bf9be0bc

Download Submit
C:\Windows\System\HJuzDbG.exe

Filesize
1.8MB

MD5
0cf11f5e652a0b54846afc83b095925e

SHA1
454138bbe4c0d952a05360eaea5c7f55976e7bee

SHA256
910f1c2096a676f4ed8b1314a40241abab7a0512adb35769ebb89eda246e4e2d

SHA512
e7ce83c800087ffd7165646b494164c69d1f26b27171a229deb23ffe9d5c9c584592f95e5a607676b227317f8918b85fabfc4722409ed0c32c517ff6edc56c76

Download Submit
C:\Windows\System\IcwVsgb.exe

Filesize
1.8MB

MD5
be76000287aef4dedb2970505fc73e0f

SHA1
f504c792a2487bc7ae8106e5c99a71b1f4104dad

SHA256
952493e95e5ea34c41b56b86f8ff2b861979b9f110016ea6324f92eb92788541

SHA512
7dbddf7ddf7a9616fccf41f65ea5fdcc63b6015b452a75689a7ecec267835d90591b3c887203845c7e41c82af9ba51aa3d005e5595a1858fe79977262bac84cd

Download Submit
C:\Windows\System\JssIBYS.exe

Filesize
1.8MB

MD5
d3ddfc97c97dea8ccd5aa207f9aea24f

SHA1
1d1ba0b1aeb7e39e4e8a153c6ca73b63964e8bba

SHA256
a7c8414a5fc3a86c6c9ff681b0a051bb49b1fd7c5b706c0abe27fad8c4f6e680

SHA512
0eefb557a5c9cd8abd3c732de1d5dcba1ec9cdf571b677c0f986b45b79de9ded0881f653b5edf608b8a0932d0c1a9ee190396065bdb5fa3930a44a7f2316a8c9

Download Submit
C:\Windows\System\KMrbyIJ.exe

Filesize
1.8MB

MD5
77956f2b976b2628407c5e256e19e480

SHA1
ecd264b9464d9fa58863ecb44b7bf6823653bdf2

SHA256
c2c04ae652613bcd66269aecd12b6aeb7d6085a77b4a6817e2b1774a0ec306a9

SHA512
abdaa7b4a13c6bd2e5ea8f10e762590b66f56d4e7eab48dda8b89dd2748641154b44380fe5cdddb8c848c343e400cd34ca60d99df3703a59e549f23dc82d7ad8

Download Submit
C:\Windows\System\KzpfITm.exe

Filesize
1.8MB

MD5
3b6aa646066075b21305742a2fc8b1d9

SHA1
f37b6398b54f4be8e78cf60b551c5b26edf08ad8

SHA256
71b9cc43971bcaa33cb2d989c02fde29bd3b5986d93e34965a3e38f1494d7e18

SHA512
f5c0ed1fc3c08585450d5dea909d3f776c1404ce11463f08260b70b40dfc5b2036d3f731718a8109b93647b526bc1872c02429eae5af1d3c4f49f15673ec3e26

Download Submit
C:\Windows\System\LwYSBiS.exe

Filesize
1.8MB

MD5
a75f983d82918e6e38c9c78e9e1da6b4

SHA1
0ec5880c284dacd3d178a6c13e8eea091d806580

SHA256
8850c9db30e615fe10d4ce8607cc608a4a3040f91c48887f2d7a71d48636022c

SHA512
af1cba11b15a71cdc9e5143003cae1ef817ab5ab94bfead6058823921961080b4286a83956b9e773b515831a8e5710f1ec6cb77716e460c5cf9d08e05921b2b0

Download Submit
C:\Windows\System\LxMcRVR.exe

Filesize
1.8MB

MD5
bab724a8ae44c97413de0bd34ac608f0

SHA1
4bbfa4261a118a3140017d31a44d28b2eb14f842

SHA256
b76da5b65143ebcaa4bde09b70ead9dcf4bbf8ff22e4a39001714eba1d5a303d

SHA512
728e3c01536a4253eee700b62d478d953d7c818dbdcccbae8b2fac1f1137e097c8fe2c46dfe7128fc304c3db84462a0f703c28921e089a783a7214e8ac2b9e1b

Download Submit
C:\Windows\System\MRJRkur.exe

Filesize
1.8MB

MD5
30f904b2fea656b5b1aad8efbe1b40df

SHA1
1d7a180a9265c8e579d8e6e43cca8a12b2b09cd2

SHA256
633352ac073aa8999f10ab4bcd9a8a19ca9e1cf36c7fb2e0b5640d38941a8855

SHA512
145ca4f6eb0f652512e2b47e8460df6625110ac68c575c193fecdcec9f6ebf9d89d48f0ec7d478c308c9c981b8d5ab1a4f974dd7d327ee93f3ed3ce5261c8cac

Download Submit
C:\Windows\System\MUBFFny.exe

Filesize
1.8MB

MD5
b1cbccfabae529add7a35df49a38ad9b

SHA1
e0e715a70ed88564d11795f4dd7e4a39f43a8b29

SHA256
734fb773c5fc13233b5f140f02115e6acc38fe4235b605a2d32d2d612c607924

SHA512
aa247bf98e2b561fc38a5235666163593421e7ba349e75a72b14c5592ef088f78f37d9502c8a36c6420fa345a8ab95316986566fcc01afd6da2054a3c6e42e5b

Download Submit
C:\Windows\System\MWWBaKd.exe

Filesize
1.8MB

MD5
cb262f3e7c182a2986aeb4aff37ef37c

SHA1
df410a5c14912a9f51d06910243cd47dad3b107d

SHA256
7ce0482c6c3aecd415ff0bed0d565a03aaeafc66fc3dbbb27ec516f6cda8401f

SHA512
322472e8ed1c8fcf005505fce9802f846e0badef6bb5a90f5b094868f32ed8978e498bc3ad72fc2a2220faf66a47c92ed6b3fa01ca24ebf1cde83876e9aed98d

Download Submit
C:\Windows\System\NaImHJM.exe

Filesize
1.8MB

MD5
1cf35157841aa0c729103471b6887935

SHA1
0c1fd4ea92555a3c888fb6f3b6a3fb2da1e0bd02

SHA256
2b102ca552890c3e4abb988ac34a039aeced7a78492ed008137d360e9b04e6f6

SHA512
455968fec3c9fb0fc16e632d92d80178d1240e788c39114254772e3b3b7012f181dc0e2bb9751cca77bc1a37c260408536e71456a534068ac21c11a695deceff

Download Submit
C:\Windows\System\REfYjAF.exe

Filesize
1.8MB

MD5
02c5ee6ebf9f5d83754204b53bed9ee1

SHA1
76072279ee99b12a03526b1cf3ac2fac3f95a453

SHA256
e0dc0e3e56cde18c9719f2631787faf3bfcae962db2e9f85af9a81584e675645

SHA512
58ed5a47e2c37cdab42d3ab8b326f476838a41c41e5ca4d59c1f43a914c91262cf2f9a0c9c75c9c6919163224c766d91de9f2584faad24f0dd49a25d54f1a561

Download Submit
C:\Windows\System\REfYjAF.exe

Filesize
1.7MB

MD5
8d24417b92ef4f3723c7ab11c5e7dc65

SHA1
6df0f213d66d7a32b3c1fd378ebe9e9ae4f784f5

SHA256
ba9b68be54b03f1c9cfaf68e8b91e77ae634e6ee8ce90d793ae7fd4c05122d07

SHA512
3d7dbe1523250ee47c51c6efc7b4dff19338749b88f4f070df8e839224aa6f1d0687d078a35186854f16f0dff54723c99624308b81ce4e00d9e193f8cd1c9656

Download Submit
C:\Windows\System\RVZsild.exe

Filesize
1.8MB

MD5
e6e312db90ef0e6addcb3e00075a37e6

SHA1
21301318764614f33bd99bb14770193959924535

SHA256
e0c63170d53bf69e67723fd15a0600b71cef0bef5620eb4a1fe2e6c7cd0bac51

SHA512
023a331fd51897e088b3f1ad1c49a6e2889f4b35f2b06732ed06d221cba9abbf72f3ce90c5837da1de43aa620953c2a3d6b1caf8c379d11a57a571ae13aa58dd

Download Submit
C:\Windows\System\UayNNsI.exe

Filesize
1.8MB

MD5
9d41b343052b10b39bb844a8e7db83c9

SHA1
6adfc608175111ffeb616bc00f295f6a4cd2efff

SHA256
ad018a8128f3bf22477ed4d31bda96e6797623e136cff80d8a8d360fdec4817f

SHA512
9655e43d33a1966ead000842238a854dc3e3cc5c2e8016945b9443613447f840d4a3ca4a15849f3de555264c8ba76fc1be9b712801ebac46928d52cfae9603c3

Download Submit
C:\Windows\System\UbOPDME.exe

Filesize
1.8MB

MD5
25181b6caa725ffc94ea7612a355e210

SHA1
0bbc587efe8cfb6d34fe69f8941c5127c244c8da

SHA256
f5167df7776f2148d22ce7418ddad5b38ea41487d66ce5b44e336971f06f56e2

SHA512
9e10a7bd267be207d91dae6205fc08b6af6b084904bf3245d346486674a17f2d22753f59cf467e7d490e883a18ebf815064a6db598dccc40e166543e98ec8e8a

Download Submit
C:\Windows\System\UiYQfWv.exe

Filesize
1.8MB

MD5
06b764b691724312a2aa1da0a275c827

SHA1
2a9f560b5c7ed002b5a8bccb0f52982abdb4d340

SHA256
446f54662aef125c7c8970f52c9dcb3fb3a1038dff5dad57e7ac05d335b7f43b

SHA512
7c730d2f6e87b9b6b19efd069eb071e1ca3aa5ed356dd80fe686aba7bcfea66fda9919a4435690078b46289e03a9be822e75149e039eb57f1e0cdd78002177de

Download Submit
C:\Windows\System\WMIvQIF.exe

Filesize
1.8MB

MD5
8505e54e6532b86c4a1e6d258d29dc66

SHA1
4be546d7853f04162301b4e43b8fd1351c02e002

SHA256
a643fa35ce5996a95a9e1906615e0c1209084d3166eb0676d61432a6b54e6448

SHA512
5394bd7ec0a5558fdc79738a323bb890592e1ee4c97c1104f4e0426ba60401fe51ec0b7c122431b26fbe4e7e24c5d7195e2169a1555127a1748d0ee8af88e959

Download Submit
C:\Windows\System\WbQHVVW.exe

Filesize
1.8MB

MD5
1aa5cc7e1769296229cd546598a2c5e3

SHA1
9752c0527bbb29c065439e28cdbfff587c1083b7

SHA256
e920e5878e2c2d7c915c816ea88003bbd962c948368a707005a95559bc590cc3

SHA512
d2bd534cd819dcb6605008d57419d544f712a8d3a87cc4ecf508bfac2d687e89b596ed07e9010e25a4c34a4b761196e7f1e1136f0915dd118c7e579243d1a32d

Download Submit
C:\Windows\System\WcupcAl.exe

Filesize
1.8MB

MD5
3ff14d90ec4ecb22bdf32d28aab2f720

SHA1
806e62e0a8a5e5503a4237c1299b02ba3d12d91f

SHA256
1769e2dd3325ed6c272ae9bf02fcc33111a45da168a87fe8667e775abe1f975e

SHA512
c41d4334cc53538328fb889892c34a9c4f1d673f9019827929822d842f55542de6d5ba432c72ac35451494b8682989d73dbcaf5d4fc0e7ba5b505797d564e38a

Download Submit
C:\Windows\System\bkjxreH.exe

Filesize
1.8MB

MD5
1b2700a6c6aa12233a48f6c357ffc363

SHA1
541bf37a65b686b52e8d8800249dbd4f45cc082b

SHA256
e192a71a1717554b3f7a4cd94c1c8c7a7086f121f9bfc37c05fa4573a708d9a3

SHA512
52073b5734d95ccf96bf4c2db5d677d104108a28a1562930ec3901f669927690fb6ac369ed41e3de34f5e6ef84033fde0087bd0cedf702994dead81bc6594e77

Download Submit
C:\Windows\System\fmNsqss.exe

Filesize
1.8MB

MD5
2051d7941dabe0cdd31f23eb9fdb7b1a

SHA1
5e2437d38dafb3df22a53e1d7785b2c15a2d8996

SHA256
8ff8081ae89d7d70e1ad1ce5ed572b32d7255c8eb451829d6aad6d2fa68360a4

SHA512
d4d36262c441b6372d57e5c571ecdb8dba3552d9d7864ddaf8756932c5483c251223cb36ab30443a620dbe7bc99bac9bfa418572cadb28107cbd236f9d839988

Download Submit
C:\Windows\System\hTyPNPu.exe

Filesize
1.8MB

MD5
f6da3c73a1b0beeef4c508ac45810865

SHA1
aa3af2e5d43376b888cb97fe866f74847d811bc0

SHA256
1e2ac357873c05437ff573747ef5438829899d4361450374fe3dabb8543fe480

SHA512
67c9af02bb7ea2146f58d9a62f0fb4a7a6bd79107e7747f29b6dbae63c4f8767199f373fa974bcb0d76ac2147def8f768f3f9d4c16167841da9600e5708d89b9

Download Submit
C:\Windows\System\jmUEJor.exe

Filesize
1.8MB

MD5
d2f767d9f1b38d343ab33c665ecf4a89

SHA1
7716d5387b0a95c267f4fcd50e7b71eba657f2e4

SHA256
1a4b14a94e3f8495a38855cda01da553e37d20c0a6b89addb9f52961ac67736e

SHA512
fae67ddfce351f7d0e9413e913eea67a538f2ed31399ea13bb0bee4f800cad7bbacfbd867ba94f3be17d3eb4657ac628d875ce82209274abdfd2fdfd2d569e4a

Download Submit
C:\Windows\System\kZrhbTt.exe

Filesize
1.8MB

MD5
296c8a73f92f7bbd99974b9784ed0286

SHA1
66abf314045a75f29bc8a045ba0e403c14bb0de8

SHA256
8907549c3151464d1eff76b7ce60107747f1906b3393f87ffd764e794a8166af

SHA512
b1f18621ce8055133adea5084ab19c350dbd03f1a12736bf5beef6015d4e7d6f6d418209c1edc08bbb323ea7d4ea6d6a0c52d2db2f6aac24c844ce5e3c7763fd

Download Submit
C:\Windows\System\luchdiK.exe

Filesize
1.8MB

MD5
810a0d0b21386a35a1f36633280dbfd6

SHA1
17afe7a83e5b7696dbd903e0467b978aca602f91

SHA256
c905eabc572a103f0c7045978947faec65ab30d8209207e8b2093d49f4da8aca

SHA512
b5ca971fe732515c2c73f30a2bad038dd18b22c42cdeef181a585fca11b350b3fe4354185ef5dc7987dfd045c9cf400f2421828d0a43d50846ece9048a3b8ef6

Download Submit
C:\Windows\System\oCZwolA.exe

Filesize
1.8MB

MD5
2b69d696de1bb766cd67e79304450e90

SHA1
6e1d1d29d472f7c903196f4d008a230d7fd7f190

SHA256
d2ec15dd93cc10a393b64ce601b84f4274cf950d1bd4a4ed6e46dc6d548a7df0

SHA512
d9dc2842317c264803181fe26f06396fdd9add00b18ffada3b43bd6972512de4312b0df7a0dc71a567e3ee6127fe9321072be7d2094313f613a0eb7644751278

Download Submit
C:\Windows\System\tajiKlY.exe

Filesize
1.8MB

MD5
2d6a468af73fbf148f74c5c4dc29fa7f

SHA1
b4f2d5941fd4aa31bd06a1e83c909a8b5793aa2b

SHA256
c4bd7af307aff67a5ecc8e5e7cadf67d037d6e118ab3cdfd0f0dfb5e7f9bc13d

SHA512
429957aa8bf44781c336c24d7643c1723d1cb3ff7accf46f04badd848c08e1856b00ecc9b83f9feca47a5f307fbe5cc62452aaaa5302d30bdc134933b3ffd2a3

Download Submit
C:\Windows\System\uCnlROX.exe

Filesize
1.8MB

MD5
5ef7473713ef5450a34e39d4e4af193d

SHA1
2f22af7acaf5416496bc75b1ea9896d8e23ffd05

SHA256
168f1886b370b0124b83afd871647bc195d0f8510f41407c41f24a8df779738c

SHA512
51c3c112d73d3026678983a5fe3ed44f287626400c11f16f8b2ae979b69310b42152886bad24eaec5553f31af4a815fa26e2a1e0033436cbe94a7af3fe843cfd

Download Submit
C:\Windows\System\ujjZHRL.exe

Filesize
1.8MB

MD5
fe7a3f226b2070b262b39c414b5199f4

SHA1
b42c98a28a3fb25c3564a794565e3c118b308346

SHA256
8f3d52db6b5a4dd68e5aacc2476eb3a6e7050b5d415fcdfccc351b5e24e01586

SHA512
06fbfd566076c485e0582da362e559d43b884729b6290e0cb2cd0b52acbbdb96f684420b3f340fac324e4f21d9955ca8152aa70386c0fc88ea5635bb7a0b0bd7

Download Submit
C:\Windows\System\vOOjSPA.exe

Filesize
1.8MB

MD5
6f58683886571c1862ce79fce415d0f9

SHA1
4678c5d90192ee85d768fd6524ca6d3670185141

SHA256
f47420ca5693dbce6df7ddcdb9544e9962b2246b2e94c6454560924e6a920653

SHA512
61880e9a17fce5cbe11dda4b507cb6fe1c398879fa7f9dc02027f0500fe74aa922ec0ac2216243e5da7a8b9141b98d1062d88027e4c5d2f8e913fb64532f7cd2

Download Submit
memory/436-2092-0x00007FF75FDE0000-0x00007FF7601D2000-memory.dmp

Filesize
3.9MB

Download
memory/436-113-0x00007FF75FDE0000-0x00007FF7601D2000-memory.dmp

Filesize
3.9MB

Download
memory/692-2090-0x00007FF6B28E0000-0x00007FF6B2CD2000-memory.dmp

Filesize
3.9MB

Download
memory/692-91-0x00007FF6B28E0000-0x00007FF6B2CD2000-memory.dmp

Filesize
3.9MB

Download
memory/732-157-0x00007FF67DE70000-0x00007FF67E262000-memory.dmp

Filesize
3.9MB

Download
memory/732-2141-0x00007FF67DE70000-0x00007FF67E262000-memory.dmp

Filesize
3.9MB

Download
memory/760-103-0x00007FF6F4D40000-0x00007FF6F5132000-memory.dmp

Filesize
3.9MB

Download
memory/964-2144-0x00007FF6177A0000-0x00007FF617B92000-memory.dmp

Filesize
3.9MB

Download
memory/964-130-0x00007FF6177A0000-0x00007FF617B92000-memory.dmp

Filesize
3.9MB

Download
memory/1112-1803-0x00007FF60BE40000-0x00007FF60C232000-memory.dmp

Filesize
3.9MB

Download
memory/1112-83-0x00007FF60BE40000-0x00007FF60C232000-memory.dmp

Filesize
3.9MB

Download
memory/1204-165-0x00007FF74FE90000-0x00007FF750282000-memory.dmp

Filesize
3.9MB

Download
memory/1204-2145-0x00007FF74FE90000-0x00007FF750282000-memory.dmp

Filesize
3.9MB

Download
memory/1636-84-0x00007FF635C00000-0x00007FF635FF2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-1801-0x00007FF635C00000-0x00007FF635FF2000-memory.dmp

Filesize
3.9MB

Download
memory/1780-65-0x000001A024D30000-0x000001A024D40000-memory.dmp

Filesize
64KB

Download
memory/1780-64-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Filesize
10.8MB

Download
memory/1780-29-0x000001A024CD0000-0x000001A024CF2000-memory.dmp

Filesize
136KB

Download
memory/1780-79-0x000001A024D30000-0x000001A024D40000-memory.dmp

Filesize
64KB

Download
memory/1780-355-0x000001A027B70000-0x000001A028316000-memory.dmp

Filesize
7.6MB

Download
memory/1852-81-0x00007FF6D4760000-0x00007FF6D4B52000-memory.dmp

Filesize
3.9MB

Download
memory/1852-1782-0x00007FF6D4760000-0x00007FF6D4B52000-memory.dmp

Filesize
3.9MB

Download
memory/1892-2151-0x00007FF6F4FD0000-0x00007FF6F53C2000-memory.dmp

Filesize
3.9MB

Download
memory/1892-159-0x00007FF6F4FD0000-0x00007FF6F53C2000-memory.dmp

Filesize
3.9MB

Download
memory/2284-136-0x00007FF682D80000-0x00007FF683172000-memory.dmp

Filesize
3.9MB

Download
memory/2428-0-0x00007FF7F0830000-0x00007FF7F0C22000-memory.dmp

Filesize
3.9MB

Download
memory/2428-1-0x00000281013E0000-0x00000281013F0000-memory.dmp

Filesize
64KB

Download
memory/2520-1815-0x00007FF73B150000-0x00007FF73B542000-memory.dmp

Filesize
3.9MB

Download
memory/2520-89-0x00007FF73B150000-0x00007FF73B542000-memory.dmp

Filesize
3.9MB

Download
memory/2608-88-0x00007FF744010000-0x00007FF744402000-memory.dmp

Filesize
3.9MB

Download
memory/2608-2084-0x00007FF744010000-0x00007FF744402000-memory.dmp

Filesize
3.9MB

Download
memory/3084-1795-0x00007FF6A80C0000-0x00007FF6A84B2000-memory.dmp

Filesize
3.9MB

Download
memory/3084-82-0x00007FF6A80C0000-0x00007FF6A84B2000-memory.dmp

Filesize
3.9MB

Download
memory/3104-140-0x00007FF7CE800000-0x00007FF7CEBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3104-2114-0x00007FF7CE800000-0x00007FF7CEBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3132-1806-0x00007FF728B40000-0x00007FF728F32000-memory.dmp

Filesize
3.9MB

Download
memory/3132-87-0x00007FF728B40000-0x00007FF728F32000-memory.dmp

Filesize
3.9MB

Download
memory/3200-78-0x00007FF633530000-0x00007FF633922000-memory.dmp

Filesize
3.9MB

Download
memory/3200-1805-0x00007FF633530000-0x00007FF633922000-memory.dmp

Filesize
3.9MB

Download
memory/3540-1802-0x00007FF7F15B0000-0x00007FF7F19A2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-86-0x00007FF7F15B0000-0x00007FF7F19A2000-memory.dmp

Filesize
3.9MB

Download
memory/4052-85-0x00007FF61BDE0000-0x00007FF61C1D2000-memory.dmp

Filesize
3.9MB

Download
memory/4052-1808-0x00007FF61BDE0000-0x00007FF61C1D2000-memory.dmp

Filesize
3.9MB

Download
memory/4468-1798-0x00007FF61FB20000-0x00007FF61FF12000-memory.dmp

Filesize
3.9MB

Download
memory/4468-90-0x00007FF61FB20000-0x00007FF61FF12000-memory.dmp

Filesize
3.9MB

Download
memory/4744-1771-0x00007FF730340000-0x00007FF730732000-memory.dmp

Filesize
3.9MB

Download
memory/4744-80-0x00007FF730340000-0x00007FF730732000-memory.dmp

Filesize
3.9MB

Download