xmrig | 1881608816275c262b3d6821e429c01c369bf5d34dc171a81c1838b97601938e

Analysis

max time kernel
64s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
Size

2.4MB
MD5

0729e506a4da16c84c40035c2d923b70
SHA1

f0fc23bd4df042b0ba18c30f139e58a0a5539064
SHA256

1881608816275c262b3d6821e429c01c369bf5d34dc171a81c1838b97601938e
SHA512

d05c4ce8ca0f36e00ad7cd7a48968a70e93842060f5cb9229a8d93de373981f6506dfd5fb9ac11d2fb6bbb4a28f4e2e2102010d94dc7be4a91432ce7ffc5e07d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9Yo:NAB+

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1824-569-0x00007FF7CCBC0000-0x00007FF7CCFB2000-memory.dmp	xmrig
behavioral2/memory/4968-587-0x00007FF639700000-0x00007FF639AF2000-memory.dmp	xmrig
behavioral2/memory/652-592-0x00007FF6ADD70000-0x00007FF6AE162000-memory.dmp	xmrig
behavioral2/memory/828-617-0x00007FF7B4500000-0x00007FF7B48F2000-memory.dmp	xmrig
behavioral2/memory/3244-688-0x00007FF76D9A0000-0x00007FF76DD92000-memory.dmp	xmrig
behavioral2/memory/972-682-0x00007FF60F5D0000-0x00007FF60F9C2000-memory.dmp	xmrig
behavioral2/memory/2852-667-0x00007FF759B80000-0x00007FF759F72000-memory.dmp	xmrig
behavioral2/memory/1916-651-0x00007FF7F0CE0000-0x00007FF7F10D2000-memory.dmp	xmrig
behavioral2/memory/3520-642-0x00007FF722D90000-0x00007FF723182000-memory.dmp	xmrig
behavioral2/memory/1144-622-0x00007FF6B2420000-0x00007FF6B2812000-memory.dmp	xmrig
behavioral2/memory/3420-605-0x00007FF795B30000-0x00007FF795F22000-memory.dmp	xmrig
behavioral2/memory/4980-580-0x00007FF7C0AF0000-0x00007FF7C0EE2000-memory.dmp	xmrig
behavioral2/memory/3020-577-0x00007FF663B60000-0x00007FF663F52000-memory.dmp	xmrig
behavioral2/memory/4564-87-0x00007FF671AA0000-0x00007FF671E92000-memory.dmp	xmrig
behavioral2/memory/384-54-0x00007FF6AE1D0000-0x00007FF6AE5C2000-memory.dmp	xmrig
behavioral2/memory/1140-48-0x00007FF7754C0000-0x00007FF7758B2000-memory.dmp	xmrig
behavioral2/memory/1256-42-0x00007FF714480000-0x00007FF714872000-memory.dmp	xmrig
behavioral2/memory/552-30-0x00007FF6B5EA0000-0x00007FF6B6292000-memory.dmp	xmrig
behavioral2/memory/3720-24-0x00007FF6DAB70000-0x00007FF6DAF62000-memory.dmp	xmrig
behavioral2/memory/1408-2099-0x00007FF7E6C10000-0x00007FF7E7002000-memory.dmp	xmrig
behavioral2/memory/2456-2100-0x00007FF7ACA10000-0x00007FF7ACE02000-memory.dmp	xmrig
behavioral2/memory/4564-2101-0x00007FF671AA0000-0x00007FF671E92000-memory.dmp	xmrig
behavioral2/memory/1256-2116-0x00007FF714480000-0x00007FF714872000-memory.dmp	xmrig
behavioral2/memory/3720-2118-0x00007FF6DAB70000-0x00007FF6DAF62000-memory.dmp	xmrig
behavioral2/memory/552-2120-0x00007FF6B5EA0000-0x00007FF6B6292000-memory.dmp	xmrig
behavioral2/memory/1140-2125-0x00007FF7754C0000-0x00007FF7758B2000-memory.dmp	xmrig
behavioral2/memory/1408-2126-0x00007FF7E6C10000-0x00007FF7E7002000-memory.dmp	xmrig
behavioral2/memory/384-2123-0x00007FF6AE1D0000-0x00007FF6AE5C2000-memory.dmp	xmrig
behavioral2/memory/1916-2130-0x00007FF7F0CE0000-0x00007FF7F10D2000-memory.dmp	xmrig
behavioral2/memory/2456-2134-0x00007FF7ACA10000-0x00007FF7ACE02000-memory.dmp	xmrig
behavioral2/memory/4564-2133-0x00007FF671AA0000-0x00007FF671E92000-memory.dmp	xmrig
behavioral2/memory/2852-2129-0x00007FF759B80000-0x00007FF759F72000-memory.dmp	xmrig
behavioral2/memory/972-2146-0x00007FF60F5D0000-0x00007FF60F9C2000-memory.dmp	xmrig
behavioral2/memory/3020-2157-0x00007FF663B60000-0x00007FF663F52000-memory.dmp	xmrig
behavioral2/memory/4980-2156-0x00007FF7C0AF0000-0x00007FF7C0EE2000-memory.dmp	xmrig
behavioral2/memory/4968-2153-0x00007FF639700000-0x00007FF639AF2000-memory.dmp	xmrig
behavioral2/memory/1144-2151-0x00007FF6B2420000-0x00007FF6B2812000-memory.dmp	xmrig
behavioral2/memory/652-2149-0x00007FF6ADD70000-0x00007FF6AE162000-memory.dmp	xmrig
behavioral2/memory/3420-2148-0x00007FF795B30000-0x00007FF795F22000-memory.dmp	xmrig
behavioral2/memory/3520-2140-0x00007FF722D90000-0x00007FF723182000-memory.dmp	xmrig
behavioral2/memory/828-2137-0x00007FF7B4500000-0x00007FF7B48F2000-memory.dmp	xmrig
behavioral2/memory/1824-2144-0x00007FF7CCBC0000-0x00007FF7CCFB2000-memory.dmp	xmrig
behavioral2/memory/3244-2142-0x00007FF76D9A0000-0x00007FF76DD92000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1256	QPzEyWg.exe
3720	cpPKzzZ.exe
552	azcmnUM.exe
1408	AqSGiWx.exe
1140	wrFTfFM.exe
384	aCjBIUp.exe
1916	EmoYCDs.exe
2852	ftELsvM.exe
2456	lQIdoAa.exe
972	pxdRMDk.exe
4564	AXPmWid.exe
1824	McfQGxs.exe
3244	QIclARC.exe
3020	cDvPFgW.exe
4980	nVCQRYd.exe
4968	nHJOyrt.exe
652	xjHbARx.exe
3420	VTZRmVP.exe
828	eBhqsme.exe
1144	yNysvEL.exe
3520	CGAjMRA.exe
1260	dsrswgO.exe
4860	GXexKWF.exe
1384	xjudbUg.exe
3524	BLqJEHW.exe
3080	pNSkLnw.exe
1244	LNugWzk.exe
4028	YZDFdBR.exe
3052	tpbSkPR.exe
900	rTWIuZH.exe
4872	KrQmoYo.exe
4272	ZqsYEsK.exe
3636	zilIjHU.exe
3692	mahqlHU.exe
1996	HNojTWi.exe
4140	HzQpVpO.exe
2344	TWfuiHM.exe
4036	XEMXzrx.exe
2792	TRvjQUN.exe
2168	FjMZpZe.exe
224	aOWnOMX.exe
3168	tUAjSZJ.exe
4032	xlyOhuR.exe
4696	MJtBJKi.exe
4340	mrUCsCc.exe
1308	IRCYaBl.exe
1696	UePgqfO.exe
3016	vCNsbAO.exe
3492	gRkKMxr.exe
4364	UNVKSVz.exe
4072	vHkWOQh.exe
3980	ZGGNKFY.exe
1184	wmxwans.exe
4128	GebnDWQ.exe
1548	vHHdWzP.exe
4644	DYcqMRB.exe
5108	eDsyCMV.exe
3212	mqUfDip.exe
3624	xZjxWFp.exe
3952	YAllCAB.exe
3028	DERBlrT.exe
3416	mJWzmaK.exe
1568	MEJMZyT.exe
3136	TkoQnjI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1516-0-0x00007FF66A050000-0x00007FF66A442000-memory.dmp	upx
behavioral2/files/0x000a000000023b84-6.dat	upx
behavioral2/files/0x000b000000023b7f-8.dat	upx
behavioral2/files/0x000a000000023b83-9.dat	upx
behavioral2/files/0x000a000000023b87-32.dat	upx
behavioral2/files/0x000a000000023b8f-77.dat	upx
behavioral2/files/0x000b000000023b8e-82.dat	upx
behavioral2/files/0x000a000000023b90-88.dat	upx
behavioral2/files/0x000b000000023b80-107.dat	upx
behavioral2/files/0x000a000000023b92-117.dat	upx
behavioral2/files/0x000a000000023b94-127.dat	upx
behavioral2/files/0x000a000000023b9a-149.dat	upx
behavioral2/files/0x000a000000023b9c-159.dat	upx
behavioral2/files/0x000a000000023b9d-172.dat	upx
behavioral2/memory/1824-569-0x00007FF7CCBC0000-0x00007FF7CCFB2000-memory.dmp	upx
behavioral2/memory/4968-587-0x00007FF639700000-0x00007FF639AF2000-memory.dmp	upx
behavioral2/memory/652-592-0x00007FF6ADD70000-0x00007FF6AE162000-memory.dmp	upx
behavioral2/memory/828-617-0x00007FF7B4500000-0x00007FF7B48F2000-memory.dmp	upx
behavioral2/memory/3244-688-0x00007FF76D9A0000-0x00007FF76DD92000-memory.dmp	upx
behavioral2/memory/972-682-0x00007FF60F5D0000-0x00007FF60F9C2000-memory.dmp	upx
behavioral2/memory/2852-667-0x00007FF759B80000-0x00007FF759F72000-memory.dmp	upx
behavioral2/memory/1916-651-0x00007FF7F0CE0000-0x00007FF7F10D2000-memory.dmp	upx
behavioral2/memory/3520-642-0x00007FF722D90000-0x00007FF723182000-memory.dmp	upx
behavioral2/memory/1144-622-0x00007FF6B2420000-0x00007FF6B2812000-memory.dmp	upx
behavioral2/memory/3420-605-0x00007FF795B30000-0x00007FF795F22000-memory.dmp	upx
behavioral2/memory/4980-580-0x00007FF7C0AF0000-0x00007FF7C0EE2000-memory.dmp	upx
behavioral2/memory/3020-577-0x00007FF663B60000-0x00007FF663F52000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-184.dat	upx
behavioral2/files/0x000a000000023b9f-182.dat	upx
behavioral2/files/0x000a000000023ba0-179.dat	upx
behavioral2/files/0x000a000000023b9e-177.dat	upx
behavioral2/files/0x000a000000023b9b-162.dat	upx
behavioral2/files/0x000a000000023b99-152.dat	upx
behavioral2/files/0x000a000000023b98-147.dat	upx
behavioral2/files/0x000a000000023b97-142.dat	upx
behavioral2/files/0x000a000000023b96-137.dat	upx
behavioral2/files/0x000a000000023b95-132.dat	upx
behavioral2/files/0x000a000000023b93-122.dat	upx
behavioral2/files/0x000b000000023b8d-112.dat	upx
behavioral2/files/0x000a000000023b91-102.dat	upx
behavioral2/memory/4564-87-0x00007FF671AA0000-0x00007FF671E92000-memory.dmp	upx
behavioral2/files/0x000a000000023b8c-80.dat	upx
behavioral2/memory/2456-76-0x00007FF7ACA10000-0x00007FF7ACE02000-memory.dmp	upx
behavioral2/files/0x000a000000023b8b-75.dat	upx
behavioral2/files/0x000a000000023b8a-73.dat	upx
behavioral2/files/0x000a000000023b89-68.dat	upx
behavioral2/memory/384-54-0x00007FF6AE1D0000-0x00007FF6AE5C2000-memory.dmp	upx
behavioral2/memory/1140-48-0x00007FF7754C0000-0x00007FF7758B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b88-45.dat	upx
behavioral2/memory/1256-42-0x00007FF714480000-0x00007FF714872000-memory.dmp	upx
behavioral2/memory/1408-39-0x00007FF7E6C10000-0x00007FF7E7002000-memory.dmp	upx
behavioral2/files/0x000a000000023b85-37.dat	upx
behavioral2/files/0x000a000000023b86-35.dat	upx
behavioral2/memory/552-30-0x00007FF6B5EA0000-0x00007FF6B6292000-memory.dmp	upx
behavioral2/memory/3720-24-0x00007FF6DAB70000-0x00007FF6DAF62000-memory.dmp	upx
behavioral2/memory/1408-2099-0x00007FF7E6C10000-0x00007FF7E7002000-memory.dmp	upx
behavioral2/memory/2456-2100-0x00007FF7ACA10000-0x00007FF7ACE02000-memory.dmp	upx
behavioral2/memory/4564-2101-0x00007FF671AA0000-0x00007FF671E92000-memory.dmp	upx
behavioral2/memory/1256-2116-0x00007FF714480000-0x00007FF714872000-memory.dmp	upx
behavioral2/memory/3720-2118-0x00007FF6DAB70000-0x00007FF6DAF62000-memory.dmp	upx
behavioral2/memory/552-2120-0x00007FF6B5EA0000-0x00007FF6B6292000-memory.dmp	upx
behavioral2/memory/1140-2125-0x00007FF7754C0000-0x00007FF7758B2000-memory.dmp	upx
behavioral2/memory/1408-2126-0x00007FF7E6C10000-0x00007FF7E7002000-memory.dmp	upx
behavioral2/memory/384-2123-0x00007FF6AE1D0000-0x00007FF6AE5C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GRetfnY.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\dbvfMFx.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\RsyWFsh.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\YQTMYEY.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\YQqOTbW.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\vBIqeNL.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\Xoemroh.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\URlRhcz.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\pksJgig.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\ABqlnIu.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\sJvVALP.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\cpPKzzZ.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\HNojTWi.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\tRmPLDU.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\TWepvMm.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\DngTgXf.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\ASYXSIS.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\XQMOyDZ.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\LWotBMs.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\XObOnUk.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\DbYzQBp.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\JEBYYVq.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\JsfDaJX.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\fwNPPtW.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\KKICMba.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\iDQWqVw.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\CmxNaPE.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\QlMxWkj.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\hEJAGKo.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\mbXSTOZ.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\vPPaoZP.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\DTNgAnQ.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\GwYYAsy.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\iDAgMvP.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\EoojOky.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\GBORkQo.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\lTUvVRZ.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\LcdLhjD.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\pAUinDL.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\eWErRdF.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\sxzEjhG.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\KfnPrVY.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\CfpGfWn.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\EOgSgbU.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\ljRzvcm.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\TRvjQUN.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\DYcqMRB.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\QbiVNIf.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\zDhMSAQ.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\gbhzGCr.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\AhvVial.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\TkoQnjI.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\NfaOvHF.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\zDEqauP.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\DDFDckE.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\yvKFHpI.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\mrUCsCc.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\uCmzRVI.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\WmABoIm.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\SLCPhID.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\paYBIBU.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\QWUmvOq.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\KPxSOTi.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\VjuYwNG.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3556	powershell.exe
3556	powershell.exe
3556	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
Token: SeDebugPrivilege	3556	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 3556	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	84
PID 1516 wrote to memory of 3556	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	84
PID 1516 wrote to memory of 3720	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	85
PID 1516 wrote to memory of 3720	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	85
PID 1516 wrote to memory of 1256	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	86
PID 1516 wrote to memory of 1256	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	86
PID 1516 wrote to memory of 552	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	87
PID 1516 wrote to memory of 552	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	87
PID 1516 wrote to memory of 1140	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	88
PID 1516 wrote to memory of 1140	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	88
PID 1516 wrote to memory of 1408	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	89
PID 1516 wrote to memory of 1408	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	89
PID 1516 wrote to memory of 384	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	90
PID 1516 wrote to memory of 384	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	90
PID 1516 wrote to memory of 1916	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	91
PID 1516 wrote to memory of 1916	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	91
PID 1516 wrote to memory of 2852	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	92
PID 1516 wrote to memory of 2852	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	92
PID 1516 wrote to memory of 2456	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	93
PID 1516 wrote to memory of 2456	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	93
PID 1516 wrote to memory of 972	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	94
PID 1516 wrote to memory of 972	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	94
PID 1516 wrote to memory of 4564	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	95
PID 1516 wrote to memory of 4564	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	95
PID 1516 wrote to memory of 1824	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	96
PID 1516 wrote to memory of 1824	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	96
PID 1516 wrote to memory of 3244	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	97
PID 1516 wrote to memory of 3244	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	97
PID 1516 wrote to memory of 3020	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	98
PID 1516 wrote to memory of 3020	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	98
PID 1516 wrote to memory of 4980	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	99
PID 1516 wrote to memory of 4980	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	99
PID 1516 wrote to memory of 4968	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	100
PID 1516 wrote to memory of 4968	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	100
PID 1516 wrote to memory of 652	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	101
PID 1516 wrote to memory of 652	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	101
PID 1516 wrote to memory of 3420	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	102
PID 1516 wrote to memory of 3420	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	102
PID 1516 wrote to memory of 828	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	103
PID 1516 wrote to memory of 828	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	103
PID 1516 wrote to memory of 1144	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	104
PID 1516 wrote to memory of 1144	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	104
PID 1516 wrote to memory of 3520	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	105
PID 1516 wrote to memory of 3520	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	105
PID 1516 wrote to memory of 1260	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	106
PID 1516 wrote to memory of 1260	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	106
PID 1516 wrote to memory of 4860	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	107
PID 1516 wrote to memory of 4860	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	107
PID 1516 wrote to memory of 1384	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	108
PID 1516 wrote to memory of 1384	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	108
PID 1516 wrote to memory of 3524	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	109
PID 1516 wrote to memory of 3524	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	109
PID 1516 wrote to memory of 3080	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	110
PID 1516 wrote to memory of 3080	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	110
PID 1516 wrote to memory of 1244	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	111
PID 1516 wrote to memory of 1244	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	111
PID 1516 wrote to memory of 4028	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	112
PID 1516 wrote to memory of 4028	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	112
PID 1516 wrote to memory of 3052	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	113
PID 1516 wrote to memory of 3052	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	113
PID 1516 wrote to memory of 900	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	114
PID 1516 wrote to memory of 900	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	114
PID 1516 wrote to memory of 4872	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	115
PID 1516 wrote to memory of 4872	1516	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3556
- C:\Windows\System\cpPKzzZ.exe
  C:\Windows\System\cpPKzzZ.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\QPzEyWg.exe
  C:\Windows\System\QPzEyWg.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\azcmnUM.exe
  C:\Windows\System\azcmnUM.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\wrFTfFM.exe
  C:\Windows\System\wrFTfFM.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\AqSGiWx.exe
  C:\Windows\System\AqSGiWx.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\aCjBIUp.exe
  C:\Windows\System\aCjBIUp.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\EmoYCDs.exe
  C:\Windows\System\EmoYCDs.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\ftELsvM.exe
  C:\Windows\System\ftELsvM.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\lQIdoAa.exe
  C:\Windows\System\lQIdoAa.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\pxdRMDk.exe
  C:\Windows\System\pxdRMDk.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\AXPmWid.exe
  C:\Windows\System\AXPmWid.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\McfQGxs.exe
  C:\Windows\System\McfQGxs.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\QIclARC.exe
  C:\Windows\System\QIclARC.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\cDvPFgW.exe
  C:\Windows\System\cDvPFgW.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\nVCQRYd.exe
  C:\Windows\System\nVCQRYd.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\nHJOyrt.exe
  C:\Windows\System\nHJOyrt.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\xjHbARx.exe
  C:\Windows\System\xjHbARx.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\VTZRmVP.exe
  C:\Windows\System\VTZRmVP.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\eBhqsme.exe
  C:\Windows\System\eBhqsme.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\yNysvEL.exe
  C:\Windows\System\yNysvEL.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\CGAjMRA.exe
  C:\Windows\System\CGAjMRA.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\dsrswgO.exe
  C:\Windows\System\dsrswgO.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\GXexKWF.exe
  C:\Windows\System\GXexKWF.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\xjudbUg.exe
  C:\Windows\System\xjudbUg.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\BLqJEHW.exe
  C:\Windows\System\BLqJEHW.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\pNSkLnw.exe
  C:\Windows\System\pNSkLnw.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\LNugWzk.exe
  C:\Windows\System\LNugWzk.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\YZDFdBR.exe
  C:\Windows\System\YZDFdBR.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\tpbSkPR.exe
  C:\Windows\System\tpbSkPR.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\rTWIuZH.exe
  C:\Windows\System\rTWIuZH.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\KrQmoYo.exe
  C:\Windows\System\KrQmoYo.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\ZqsYEsK.exe
  C:\Windows\System\ZqsYEsK.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\zilIjHU.exe
  C:\Windows\System\zilIjHU.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\mahqlHU.exe
  C:\Windows\System\mahqlHU.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\HNojTWi.exe
  C:\Windows\System\HNojTWi.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\HzQpVpO.exe
  C:\Windows\System\HzQpVpO.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\TWfuiHM.exe
  C:\Windows\System\TWfuiHM.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\XEMXzrx.exe
  C:\Windows\System\XEMXzrx.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\TRvjQUN.exe
  C:\Windows\System\TRvjQUN.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\FjMZpZe.exe
  C:\Windows\System\FjMZpZe.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\aOWnOMX.exe
  C:\Windows\System\aOWnOMX.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\tUAjSZJ.exe
  C:\Windows\System\tUAjSZJ.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\xlyOhuR.exe
  C:\Windows\System\xlyOhuR.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\MJtBJKi.exe
  C:\Windows\System\MJtBJKi.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\mrUCsCc.exe
  C:\Windows\System\mrUCsCc.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\IRCYaBl.exe
  C:\Windows\System\IRCYaBl.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\UePgqfO.exe
  C:\Windows\System\UePgqfO.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\vCNsbAO.exe
  C:\Windows\System\vCNsbAO.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\gRkKMxr.exe
  C:\Windows\System\gRkKMxr.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\UNVKSVz.exe
  C:\Windows\System\UNVKSVz.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\vHkWOQh.exe
  C:\Windows\System\vHkWOQh.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\ZGGNKFY.exe
  C:\Windows\System\ZGGNKFY.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\wmxwans.exe
  C:\Windows\System\wmxwans.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\GebnDWQ.exe
  C:\Windows\System\GebnDWQ.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\vHHdWzP.exe
  C:\Windows\System\vHHdWzP.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\DYcqMRB.exe
  C:\Windows\System\DYcqMRB.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\eDsyCMV.exe
  C:\Windows\System\eDsyCMV.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\mqUfDip.exe
  C:\Windows\System\mqUfDip.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\xZjxWFp.exe
  C:\Windows\System\xZjxWFp.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\YAllCAB.exe
  C:\Windows\System\YAllCAB.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\DERBlrT.exe
  C:\Windows\System\DERBlrT.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\mJWzmaK.exe
  C:\Windows\System\mJWzmaK.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\MEJMZyT.exe
  C:\Windows\System\MEJMZyT.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\TkoQnjI.exe
  C:\Windows\System\TkoQnjI.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\zCytpfw.exe
  C:\Windows\System\zCytpfw.exe
  2⤵
  PID:4620
- C:\Windows\System\SxwOyyK.exe
  C:\Windows\System\SxwOyyK.exe
  2⤵
  PID:2820
- C:\Windows\System\cCoSFTN.exe
  C:\Windows\System\cCoSFTN.exe
  2⤵
  PID:2352
- C:\Windows\System\utIYlmZ.exe
  C:\Windows\System\utIYlmZ.exe
  2⤵
  PID:1868
- C:\Windows\System\weDKfAj.exe
  C:\Windows\System\weDKfAj.exe
  2⤵
  PID:4212
- C:\Windows\System\VTRgOZB.exe
  C:\Windows\System\VTRgOZB.exe
  2⤵
  PID:2976
- C:\Windows\System\hhxhSUi.exe
  C:\Windows\System\hhxhSUi.exe
  2⤵
  PID:5028
- C:\Windows\System\Syjvxwa.exe
  C:\Windows\System\Syjvxwa.exe
  2⤵
  PID:4708
- C:\Windows\System\lWAQGcR.exe
  C:\Windows\System\lWAQGcR.exe
  2⤵
  PID:1840
- C:\Windows\System\nrpQwGk.exe
  C:\Windows\System\nrpQwGk.exe
  2⤵
  PID:2252
- C:\Windows\System\XugDBwt.exe
  C:\Windows\System\XugDBwt.exe
  2⤵
  PID:1820
- C:\Windows\System\DKlJBSX.exe
  C:\Windows\System\DKlJBSX.exe
  2⤵
  PID:4420
- C:\Windows\System\hfiQyVD.exe
  C:\Windows\System\hfiQyVD.exe
  2⤵
  PID:3024
- C:\Windows\System\KMBlGHx.exe
  C:\Windows\System\KMBlGHx.exe
  2⤵
  PID:5136
- C:\Windows\System\VnKeHfZ.exe
  C:\Windows\System\VnKeHfZ.exe
  2⤵
  PID:5160
- C:\Windows\System\WizpbVB.exe
  C:\Windows\System\WizpbVB.exe
  2⤵
  PID:5188
- C:\Windows\System\DGDPECW.exe
  C:\Windows\System\DGDPECW.exe
  2⤵
  PID:5208
- C:\Windows\System\elQeBIm.exe
  C:\Windows\System\elQeBIm.exe
  2⤵
  PID:5236
- C:\Windows\System\UftDjqH.exe
  C:\Windows\System\UftDjqH.exe
  2⤵
  PID:5264
- C:\Windows\System\bbogRAM.exe
  C:\Windows\System\bbogRAM.exe
  2⤵
  PID:5292
- C:\Windows\System\EejwHoP.exe
  C:\Windows\System\EejwHoP.exe
  2⤵
  PID:5320
- C:\Windows\System\uwNYhdd.exe
  C:\Windows\System\uwNYhdd.exe
  2⤵
  PID:5348
- C:\Windows\System\FJJXtVq.exe
  C:\Windows\System\FJJXtVq.exe
  2⤵
  PID:5376
- C:\Windows\System\iRaZPco.exe
  C:\Windows\System\iRaZPco.exe
  2⤵
  PID:5404
- C:\Windows\System\rsJKVIo.exe
  C:\Windows\System\rsJKVIo.exe
  2⤵
  PID:5432
- C:\Windows\System\mpZjLif.exe
  C:\Windows\System\mpZjLif.exe
  2⤵
  PID:5460
- C:\Windows\System\lKWpRKk.exe
  C:\Windows\System\lKWpRKk.exe
  2⤵
  PID:5488
- C:\Windows\System\VCQroMa.exe
  C:\Windows\System\VCQroMa.exe
  2⤵
  PID:5516
- C:\Windows\System\YRGoNeM.exe
  C:\Windows\System\YRGoNeM.exe
  2⤵
  PID:5544
- C:\Windows\System\kEWtLal.exe
  C:\Windows\System\kEWtLal.exe
  2⤵
  PID:5568
- C:\Windows\System\iXyZIcG.exe
  C:\Windows\System\iXyZIcG.exe
  2⤵
  PID:5600
- C:\Windows\System\ZRztqcL.exe
  C:\Windows\System\ZRztqcL.exe
  2⤵
  PID:5628
- C:\Windows\System\RCoGEKJ.exe
  C:\Windows\System\RCoGEKJ.exe
  2⤵
  PID:5656
- C:\Windows\System\rPjMJAk.exe
  C:\Windows\System\rPjMJAk.exe
  2⤵
  PID:5680
- C:\Windows\System\TkxMRKV.exe
  C:\Windows\System\TkxMRKV.exe
  2⤵
  PID:5712
- C:\Windows\System\SkUGWCx.exe
  C:\Windows\System\SkUGWCx.exe
  2⤵
  PID:5740
- C:\Windows\System\MgwDpfG.exe
  C:\Windows\System\MgwDpfG.exe
  2⤵
  PID:5768
- C:\Windows\System\EEGGUmH.exe
  C:\Windows\System\EEGGUmH.exe
  2⤵
  PID:5796
- C:\Windows\System\TFyVMvn.exe
  C:\Windows\System\TFyVMvn.exe
  2⤵
  PID:5824
- C:\Windows\System\XnYJxHu.exe
  C:\Windows\System\XnYJxHu.exe
  2⤵
  PID:5852
- C:\Windows\System\VNQHAdV.exe
  C:\Windows\System\VNQHAdV.exe
  2⤵
  PID:5880
- C:\Windows\System\jHHgUXR.exe
  C:\Windows\System\jHHgUXR.exe
  2⤵
  PID:5908
- C:\Windows\System\RZWFGXG.exe
  C:\Windows\System\RZWFGXG.exe
  2⤵
  PID:5936
- C:\Windows\System\fUFHllM.exe
  C:\Windows\System\fUFHllM.exe
  2⤵
  PID:5964
- C:\Windows\System\xmopuyL.exe
  C:\Windows\System\xmopuyL.exe
  2⤵
  PID:5992
- C:\Windows\System\ieaHAeT.exe
  C:\Windows\System\ieaHAeT.exe
  2⤵
  PID:6020
- C:\Windows\System\MjsqDWr.exe
  C:\Windows\System\MjsqDWr.exe
  2⤵
  PID:6048
- C:\Windows\System\DWadlNS.exe
  C:\Windows\System\DWadlNS.exe
  2⤵
  PID:6076
- C:\Windows\System\cPhpXtN.exe
  C:\Windows\System\cPhpXtN.exe
  2⤵
  PID:6100
- C:\Windows\System\znxLMAR.exe
  C:\Windows\System\znxLMAR.exe
  2⤵
  PID:6132
- C:\Windows\System\QllcgJQ.exe
  C:\Windows\System\QllcgJQ.exe
  2⤵
  PID:3712
- C:\Windows\System\drlUsBG.exe
  C:\Windows\System\drlUsBG.exe
  2⤵
  PID:1464
- C:\Windows\System\KfnPrVY.exe
  C:\Windows\System\KfnPrVY.exe
  2⤵
  PID:4056
- C:\Windows\System\tRmPLDU.exe
  C:\Windows\System\tRmPLDU.exe
  2⤵
  PID:2552
- C:\Windows\System\uKwpWIz.exe
  C:\Windows\System\uKwpWIz.exe
  2⤵
  PID:5176
- C:\Windows\System\TqhBglE.exe
  C:\Windows\System\TqhBglE.exe
  2⤵
  PID:5224
- C:\Windows\System\kxFQEzm.exe
  C:\Windows\System\kxFQEzm.exe
  2⤵
  PID:2924
- C:\Windows\System\ovGgxcc.exe
  C:\Windows\System\ovGgxcc.exe
  2⤵
  PID:5340
- C:\Windows\System\QkGEbal.exe
  C:\Windows\System\QkGEbal.exe
  2⤵
  PID:5416
- C:\Windows\System\pbohBcl.exe
  C:\Windows\System\pbohBcl.exe
  2⤵
  PID:5472
- C:\Windows\System\RMCjNGk.exe
  C:\Windows\System\RMCjNGk.exe
  2⤵
  PID:5532
- C:\Windows\System\jDxEsxf.exe
  C:\Windows\System\jDxEsxf.exe
  2⤵
  PID:5588
- C:\Windows\System\arjCsil.exe
  C:\Windows\System\arjCsil.exe
  2⤵
  PID:5668
- C:\Windows\System\wExfjOZ.exe
  C:\Windows\System\wExfjOZ.exe
  2⤵
  PID:5704
- C:\Windows\System\jIqKICS.exe
  C:\Windows\System\jIqKICS.exe
  2⤵
  PID:5784
- C:\Windows\System\dhfcmHQ.exe
  C:\Windows\System\dhfcmHQ.exe
  2⤵
  PID:5844
- C:\Windows\System\HZjzyvK.exe
  C:\Windows\System\HZjzyvK.exe
  2⤵
  PID:5920
- C:\Windows\System\LAkTYzl.exe
  C:\Windows\System\LAkTYzl.exe
  2⤵
  PID:5976
- C:\Windows\System\dJcVrLx.exe
  C:\Windows\System\dJcVrLx.exe
  2⤵
  PID:6036
- C:\Windows\System\sKjCGIo.exe
  C:\Windows\System\sKjCGIo.exe
  2⤵
  PID:6092
- C:\Windows\System\hFbcblf.exe
  C:\Windows\System\hFbcblf.exe
  2⤵
  PID:5072
- C:\Windows\System\jqIzamK.exe
  C:\Windows\System\jqIzamK.exe
  2⤵
  PID:4684
- C:\Windows\System\whZFpXa.exe
  C:\Windows\System\whZFpXa.exe
  2⤵
  PID:5152
- C:\Windows\System\usLYjbA.exe
  C:\Windows\System\usLYjbA.exe
  2⤵
  PID:5308
- C:\Windows\System\oskoQzy.exe
  C:\Windows\System\oskoQzy.exe
  2⤵
  PID:1248
- C:\Windows\System\CSAoGyY.exe
  C:\Windows\System\CSAoGyY.exe
  2⤵
  PID:4480
- C:\Windows\System\vBuPvlk.exe
  C:\Windows\System\vBuPvlk.exe
  2⤵
  PID:3548
- C:\Windows\System\XLLSNyT.exe
  C:\Windows\System\XLLSNyT.exe
  2⤵
  PID:5760
- C:\Windows\System\biskWKE.exe
  C:\Windows\System\biskWKE.exe
  2⤵
  PID:2316
- C:\Windows\System\iMbErAB.exe
  C:\Windows\System\iMbErAB.exe
  2⤵
  PID:6008
- C:\Windows\System\QjQQxxu.exe
  C:\Windows\System\QjQQxxu.exe
  2⤵
  PID:2000
- C:\Windows\System\krkfcND.exe
  C:\Windows\System\krkfcND.exe
  2⤵
  PID:5220
- C:\Windows\System\DEgUlsp.exe
  C:\Windows\System\DEgUlsp.exe
  2⤵
  PID:3036
- C:\Windows\System\RGbWJTn.exe
  C:\Windows\System\RGbWJTn.exe
  2⤵
  PID:5620
- C:\Windows\System\vBIqeNL.exe
  C:\Windows\System\vBIqeNL.exe
  2⤵
  PID:3976
- C:\Windows\System\LFYfsWZ.exe
  C:\Windows\System\LFYfsWZ.exe
  2⤵
  PID:6172
- C:\Windows\System\QZZwuzW.exe
  C:\Windows\System\QZZwuzW.exe
  2⤵
  PID:6200
- C:\Windows\System\umhAaxS.exe
  C:\Windows\System\umhAaxS.exe
  2⤵
  PID:6228
- C:\Windows\System\lOkwjds.exe
  C:\Windows\System\lOkwjds.exe
  2⤵
  PID:6256
- C:\Windows\System\tXiHvne.exe
  C:\Windows\System\tXiHvne.exe
  2⤵
  PID:6284
- C:\Windows\System\uaNioFU.exe
  C:\Windows\System\uaNioFU.exe
  2⤵
  PID:6312
- C:\Windows\System\fxVTFea.exe
  C:\Windows\System\fxVTFea.exe
  2⤵
  PID:6340
- C:\Windows\System\RYgmFSP.exe
  C:\Windows\System\RYgmFSP.exe
  2⤵
  PID:6364
- C:\Windows\System\pGqnxjl.exe
  C:\Windows\System\pGqnxjl.exe
  2⤵
  PID:6396
- C:\Windows\System\eVUfxnK.exe
  C:\Windows\System\eVUfxnK.exe
  2⤵
  PID:6424
- C:\Windows\System\PSLSQRo.exe
  C:\Windows\System\PSLSQRo.exe
  2⤵
  PID:6452
- C:\Windows\System\iDQWqVw.exe
  C:\Windows\System\iDQWqVw.exe
  2⤵
  PID:6480
- C:\Windows\System\lYwOAVt.exe
  C:\Windows\System\lYwOAVt.exe
  2⤵
  PID:6508
- C:\Windows\System\deZYeTp.exe
  C:\Windows\System\deZYeTp.exe
  2⤵
  PID:6564
- C:\Windows\System\CZQgUua.exe
  C:\Windows\System\CZQgUua.exe
  2⤵
  PID:6584
- C:\Windows\System\fVggHcN.exe
  C:\Windows\System\fVggHcN.exe
  2⤵
  PID:6604
- C:\Windows\System\tJQCDNX.exe
  C:\Windows\System\tJQCDNX.exe
  2⤵
  PID:6624
- C:\Windows\System\HeutOZn.exe
  C:\Windows\System\HeutOZn.exe
  2⤵
  PID:6652
- C:\Windows\System\PDORaBs.exe
  C:\Windows\System\PDORaBs.exe
  2⤵
  PID:6672
- C:\Windows\System\IEIxAuh.exe
  C:\Windows\System\IEIxAuh.exe
  2⤵
  PID:6692
- C:\Windows\System\kyhCSGN.exe
  C:\Windows\System\kyhCSGN.exe
  2⤵
  PID:6708
- C:\Windows\System\zdlwzIf.exe
  C:\Windows\System\zdlwzIf.exe
  2⤵
  PID:6728
- C:\Windows\System\hUPzLuw.exe
  C:\Windows\System\hUPzLuw.exe
  2⤵
  PID:6744
- C:\Windows\System\SXtsTrK.exe
  C:\Windows\System\SXtsTrK.exe
  2⤵
  PID:6792
- C:\Windows\System\TBOVIGM.exe
  C:\Windows\System\TBOVIGM.exe
  2⤵
  PID:6808
- C:\Windows\System\odlKdoT.exe
  C:\Windows\System\odlKdoT.exe
  2⤵
  PID:6836
- C:\Windows\System\oGqufyX.exe
  C:\Windows\System\oGqufyX.exe
  2⤵
  PID:6856
- C:\Windows\System\TWepvMm.exe
  C:\Windows\System\TWepvMm.exe
  2⤵
  PID:6880
- C:\Windows\System\YYDELtA.exe
  C:\Windows\System\YYDELtA.exe
  2⤵
  PID:6900
- C:\Windows\System\CmxNaPE.exe
  C:\Windows\System\CmxNaPE.exe
  2⤵
  PID:6964
- C:\Windows\System\QlMxWkj.exe
  C:\Windows\System\QlMxWkj.exe
  2⤵
  PID:7004
- C:\Windows\System\ywLPUVY.exe
  C:\Windows\System\ywLPUVY.exe
  2⤵
  PID:7020
- C:\Windows\System\soNowOq.exe
  C:\Windows\System\soNowOq.exe
  2⤵
  PID:7044
- C:\Windows\System\ZCjTswq.exe
  C:\Windows\System\ZCjTswq.exe
  2⤵
  PID:7068
- C:\Windows\System\eidtbLk.exe
  C:\Windows\System\eidtbLk.exe
  2⤵
  PID:7084
- C:\Windows\System\KgLbLeh.exe
  C:\Windows\System\KgLbLeh.exe
  2⤵
  PID:7108
- C:\Windows\System\vXfKuMc.exe
  C:\Windows\System\vXfKuMc.exe
  2⤵
  PID:7128
- C:\Windows\System\pNYIkwt.exe
  C:\Windows\System\pNYIkwt.exe
  2⤵
  PID:7144
- C:\Windows\System\XObOnUk.exe
  C:\Windows\System\XObOnUk.exe
  2⤵
  PID:3604
- C:\Windows\System\saStlqx.exe
  C:\Windows\System\saStlqx.exe
  2⤵
  PID:5368
- C:\Windows\System\TlrgvzP.exe
  C:\Windows\System\TlrgvzP.exe
  2⤵
  PID:5700
- C:\Windows\System\TjOvoxr.exe
  C:\Windows\System\TjOvoxr.exe
  2⤵
  PID:6164
- C:\Windows\System\CfpGfWn.exe
  C:\Windows\System\CfpGfWn.exe
  2⤵
  PID:2124
- C:\Windows\System\SrXudgG.exe
  C:\Windows\System\SrXudgG.exe
  2⤵
  PID:6388
- C:\Windows\System\WZZSlFj.exe
  C:\Windows\System\WZZSlFj.exe
  2⤵
  PID:1844
- C:\Windows\System\gDQTkBE.exe
  C:\Windows\System\gDQTkBE.exe
  2⤵
  PID:3312
- C:\Windows\System\hEJAGKo.exe
  C:\Windows\System\hEJAGKo.exe
  2⤵
  PID:6472
- C:\Windows\System\lojUQCk.exe
  C:\Windows\System\lojUQCk.exe
  2⤵
  PID:3908
- C:\Windows\System\LtxGIza.exe
  C:\Windows\System\LtxGIza.exe
  2⤵
  PID:5008
- C:\Windows\System\NHRZyUS.exe
  C:\Windows\System\NHRZyUS.exe
  2⤵
  PID:6556
- C:\Windows\System\qewUWlB.exe
  C:\Windows\System\qewUWlB.exe
  2⤵
  PID:6600
- C:\Windows\System\auvxyBy.exe
  C:\Windows\System\auvxyBy.exe
  2⤵
  PID:6704
- C:\Windows\System\jEJrfMx.exe
  C:\Windows\System\jEJrfMx.exe
  2⤵
  PID:6724
- C:\Windows\System\GRetfnY.exe
  C:\Windows\System\GRetfnY.exe
  2⤵
  PID:6896
- C:\Windows\System\MfoVJVg.exe
  C:\Windows\System\MfoVJVg.exe
  2⤵
  PID:7016
- C:\Windows\System\LyJjwjV.exe
  C:\Windows\System\LyJjwjV.exe
  2⤵
  PID:7116
- C:\Windows\System\tSyZmQj.exe
  C:\Windows\System\tSyZmQj.exe
  2⤵
  PID:7076
- C:\Windows\System\oSNLvkF.exe
  C:\Windows\System\oSNLvkF.exe
  2⤵
  PID:6192
- C:\Windows\System\hlKTHga.exe
  C:\Windows\System\hlKTHga.exe
  2⤵
  PID:1240
- C:\Windows\System\VUSclsw.exe
  C:\Windows\System\VUSclsw.exe
  2⤵
  PID:780
- C:\Windows\System\LXIseuI.exe
  C:\Windows\System\LXIseuI.exe
  2⤵
  PID:896
- C:\Windows\System\RlASvrj.exe
  C:\Windows\System\RlASvrj.exe
  2⤵
  PID:2504
- C:\Windows\System\mbXSTOZ.exe
  C:\Windows\System\mbXSTOZ.exe
  2⤵
  PID:4892
- C:\Windows\System\DngTgXf.exe
  C:\Windows\System\DngTgXf.exe
  2⤵
  PID:3384
- C:\Windows\System\DbYzQBp.exe
  C:\Windows\System\DbYzQBp.exe
  2⤵
  PID:6640
- C:\Windows\System\rVFaUBo.exe
  C:\Windows\System\rVFaUBo.exe
  2⤵
  PID:6876
- C:\Windows\System\zuWjRkj.exe
  C:\Windows\System\zuWjRkj.exe
  2⤵
  PID:7080
- C:\Windows\System\HicJfND.exe
  C:\Windows\System\HicJfND.exe
  2⤵
  PID:2060
- C:\Windows\System\yJaeiFS.exe
  C:\Windows\System\yJaeiFS.exe
  2⤵
  PID:6832
- C:\Windows\System\nlmcbOx.exe
  C:\Windows\System\nlmcbOx.exe
  2⤵
  PID:7120
- C:\Windows\System\MVDqfXY.exe
  C:\Windows\System\MVDqfXY.exe
  2⤵
  PID:1176
- C:\Windows\System\rqVIdDX.exe
  C:\Windows\System\rqVIdDX.exe
  2⤵
  PID:4920
- C:\Windows\System\lwzfFqo.exe
  C:\Windows\System\lwzfFqo.exe
  2⤵
  PID:4864
- C:\Windows\System\xbDTtmo.exe
  C:\Windows\System\xbDTtmo.exe
  2⤵
  PID:6868
- C:\Windows\System\qvbzqgD.exe
  C:\Windows\System\qvbzqgD.exe
  2⤵
  PID:5504
- C:\Windows\System\blFhByy.exe
  C:\Windows\System\blFhByy.exe
  2⤵
  PID:1988
- C:\Windows\System\pXnQPAe.exe
  C:\Windows\System\pXnQPAe.exe
  2⤵
  PID:6668
- C:\Windows\System\dbkxHdZ.exe
  C:\Windows\System\dbkxHdZ.exe
  2⤵
  PID:2132
- C:\Windows\System\YEdwUiK.exe
  C:\Windows\System\YEdwUiK.exe
  2⤵
  PID:7176
- C:\Windows\System\bROOBGQ.exe
  C:\Windows\System\bROOBGQ.exe
  2⤵
  PID:7220
- C:\Windows\System\aLDpbQa.exe
  C:\Windows\System\aLDpbQa.exe
  2⤵
  PID:7236
- C:\Windows\System\eAjsqyi.exe
  C:\Windows\System\eAjsqyi.exe
  2⤵
  PID:7264
- C:\Windows\System\FSTyKFS.exe
  C:\Windows\System\FSTyKFS.exe
  2⤵
  PID:7284
- C:\Windows\System\vxopuZd.exe
  C:\Windows\System\vxopuZd.exe
  2⤵
  PID:7336
- C:\Windows\System\ibyHjKu.exe
  C:\Windows\System\ibyHjKu.exe
  2⤵
  PID:7356
- C:\Windows\System\aUXfMbR.exe
  C:\Windows\System\aUXfMbR.exe
  2⤵
  PID:7388
- C:\Windows\System\XVMRbLn.exe
  C:\Windows\System\XVMRbLn.exe
  2⤵
  PID:7412
- C:\Windows\System\xEWDUVq.exe
  C:\Windows\System\xEWDUVq.exe
  2⤵
  PID:7436
- C:\Windows\System\gqHxiuc.exe
  C:\Windows\System\gqHxiuc.exe
  2⤵
  PID:7456
- C:\Windows\System\rPvFptN.exe
  C:\Windows\System\rPvFptN.exe
  2⤵
  PID:7484
- C:\Windows\System\TkUYhJM.exe
  C:\Windows\System\TkUYhJM.exe
  2⤵
  PID:7508
- C:\Windows\System\yqAcdup.exe
  C:\Windows\System\yqAcdup.exe
  2⤵
  PID:7528
- C:\Windows\System\icIJQbD.exe
  C:\Windows\System\icIJQbD.exe
  2⤵
  PID:7548
- C:\Windows\System\LWfTAGl.exe
  C:\Windows\System\LWfTAGl.exe
  2⤵
  PID:7568
- C:\Windows\System\fwFwfOb.exe
  C:\Windows\System\fwFwfOb.exe
  2⤵
  PID:7628
- C:\Windows\System\XUCeXdJ.exe
  C:\Windows\System\XUCeXdJ.exe
  2⤵
  PID:7648
- C:\Windows\System\mFRIvJC.exe
  C:\Windows\System\mFRIvJC.exe
  2⤵
  PID:7676
- C:\Windows\System\THeCjPr.exe
  C:\Windows\System\THeCjPr.exe
  2⤵
  PID:7700
- C:\Windows\System\GaEsWzw.exe
  C:\Windows\System\GaEsWzw.exe
  2⤵
  PID:7744
- C:\Windows\System\UAVBEvc.exe
  C:\Windows\System\UAVBEvc.exe
  2⤵
  PID:7764
- C:\Windows\System\VGuHroI.exe
  C:\Windows\System\VGuHroI.exe
  2⤵
  PID:7808
- C:\Windows\System\oaxXwvS.exe
  C:\Windows\System\oaxXwvS.exe
  2⤵
  PID:7828
- C:\Windows\System\gfLKWme.exe
  C:\Windows\System\gfLKWme.exe
  2⤵
  PID:7852
- C:\Windows\System\pXEjloP.exe
  C:\Windows\System\pXEjloP.exe
  2⤵
  PID:7876
- C:\Windows\System\LkrxwYF.exe
  C:\Windows\System\LkrxwYF.exe
  2⤵
  PID:7924
- C:\Windows\System\koFivbn.exe
  C:\Windows\System\koFivbn.exe
  2⤵
  PID:7940
- C:\Windows\System\zSoaWzW.exe
  C:\Windows\System\zSoaWzW.exe
  2⤵
  PID:7960
- C:\Windows\System\RwETzRx.exe
  C:\Windows\System\RwETzRx.exe
  2⤵
  PID:7988
- C:\Windows\System\JEBYYVq.exe
  C:\Windows\System\JEBYYVq.exe
  2⤵
  PID:8016
- C:\Windows\System\TUgYsDv.exe
  C:\Windows\System\TUgYsDv.exe
  2⤵
  PID:8044
- C:\Windows\System\lqawlph.exe
  C:\Windows\System\lqawlph.exe
  2⤵
  PID:8092
- C:\Windows\System\OlEUwrE.exe
  C:\Windows\System\OlEUwrE.exe
  2⤵
  PID:8120
- C:\Windows\System\BWgoHMO.exe
  C:\Windows\System\BWgoHMO.exe
  2⤵
  PID:8140
- C:\Windows\System\IJYsDHd.exe
  C:\Windows\System\IJYsDHd.exe
  2⤵
  PID:8160
- C:\Windows\System\egWwhaS.exe
  C:\Windows\System\egWwhaS.exe
  2⤵
  PID:8184
- C:\Windows\System\RTaukfN.exe
  C:\Windows\System\RTaukfN.exe
  2⤵
  PID:7292
- C:\Windows\System\KPxSOTi.exe
  C:\Windows\System\KPxSOTi.exe
  2⤵
  PID:7308
- C:\Windows\System\WOnSOpa.exe
  C:\Windows\System\WOnSOpa.exe
  2⤵
  PID:7352
- C:\Windows\System\WUMIxYC.exe
  C:\Windows\System\WUMIxYC.exe
  2⤵
  PID:7432
- C:\Windows\System\oqbqFFD.exe
  C:\Windows\System\oqbqFFD.exe
  2⤵
  PID:7452
- C:\Windows\System\yvimEkq.exe
  C:\Windows\System\yvimEkq.exe
  2⤵
  PID:7540
- C:\Windows\System\dUAIWtk.exe
  C:\Windows\System\dUAIWtk.exe
  2⤵
  PID:7616
- C:\Windows\System\oNvTWdE.exe
  C:\Windows\System\oNvTWdE.exe
  2⤵
  PID:7696
- C:\Windows\System\ybgyZGZ.exe
  C:\Windows\System\ybgyZGZ.exe
  2⤵
  PID:7804
- C:\Windows\System\dHyOTNG.exe
  C:\Windows\System\dHyOTNG.exe
  2⤵
  PID:7840
- C:\Windows\System\YMwMhqe.exe
  C:\Windows\System\YMwMhqe.exe
  2⤵
  PID:7900
- C:\Windows\System\CtoECvu.exe
  C:\Windows\System\CtoECvu.exe
  2⤵
  PID:7956
- C:\Windows\System\qZudaiU.exe
  C:\Windows\System\qZudaiU.exe
  2⤵
  PID:8064
- C:\Windows\System\QaUWhrr.exe
  C:\Windows\System\QaUWhrr.exe
  2⤵
  PID:8108
- C:\Windows\System\dbvfMFx.exe
  C:\Windows\System\dbvfMFx.exe
  2⤵
  PID:8176
- C:\Windows\System\adyjkgW.exe
  C:\Windows\System\adyjkgW.exe
  2⤵
  PID:7312
- C:\Windows\System\UzdgVsU.exe
  C:\Windows\System\UzdgVsU.exe
  2⤵
  PID:7332
- C:\Windows\System\IOxuxYm.exe
  C:\Windows\System\IOxuxYm.exe
  2⤵
  PID:7564
- C:\Windows\System\DnpZxEq.exe
  C:\Windows\System\DnpZxEq.exe
  2⤵
  PID:7600
- C:\Windows\System\dyFyfnB.exe
  C:\Windows\System\dyFyfnB.exe
  2⤵
  PID:7800
- C:\Windows\System\DDVOcFr.exe
  C:\Windows\System\DDVOcFr.exe
  2⤵
  PID:7868
- C:\Windows\System\hQpOjNq.exe
  C:\Windows\System\hQpOjNq.exe
  2⤵
  PID:8084
- C:\Windows\System\wrjJmMe.exe
  C:\Windows\System\wrjJmMe.exe
  2⤵
  PID:6928
- C:\Windows\System\IHBRPbx.exe
  C:\Windows\System\IHBRPbx.exe
  2⤵
  PID:7584
- C:\Windows\System\bUbtfHS.exe
  C:\Windows\System\bUbtfHS.exe
  2⤵
  PID:7888
- C:\Windows\System\rmciuME.exe
  C:\Windows\System\rmciuME.exe
  2⤵
  PID:8196
- C:\Windows\System\qUNNbob.exe
  C:\Windows\System\qUNNbob.exe
  2⤵
  PID:8220
- C:\Windows\System\vADzCQN.exe
  C:\Windows\System\vADzCQN.exe
  2⤵
  PID:8244
- C:\Windows\System\pQvzfON.exe
  C:\Windows\System\pQvzfON.exe
  2⤵
  PID:8264
- C:\Windows\System\uCmzRVI.exe
  C:\Windows\System\uCmzRVI.exe
  2⤵
  PID:8320
- C:\Windows\System\iDAgMvP.exe
  C:\Windows\System\iDAgMvP.exe
  2⤵
  PID:8364
- C:\Windows\System\YQzidKM.exe
  C:\Windows\System\YQzidKM.exe
  2⤵
  PID:8404
- C:\Windows\System\lbZwZcb.exe
  C:\Windows\System\lbZwZcb.exe
  2⤵
  PID:8420
- C:\Windows\System\NUFZbvg.exe
  C:\Windows\System\NUFZbvg.exe
  2⤵
  PID:8436
- C:\Windows\System\PqLXovT.exe
  C:\Windows\System\PqLXovT.exe
  2⤵
  PID:8472
- C:\Windows\System\JkHtcPA.exe
  C:\Windows\System\JkHtcPA.exe
  2⤵
  PID:8500
- C:\Windows\System\hUJrgMe.exe
  C:\Windows\System\hUJrgMe.exe
  2⤵
  PID:8520
- C:\Windows\System\BzpUdkm.exe
  C:\Windows\System\BzpUdkm.exe
  2⤵
  PID:8544
- C:\Windows\System\inCJiCq.exe
  C:\Windows\System\inCJiCq.exe
  2⤵
  PID:8568
- C:\Windows\System\gCkVCxy.exe
  C:\Windows\System\gCkVCxy.exe
  2⤵
  PID:8596
- C:\Windows\System\QbiVNIf.exe
  C:\Windows\System\QbiVNIf.exe
  2⤵
  PID:8616
- C:\Windows\System\ScfyGLP.exe
  C:\Windows\System\ScfyGLP.exe
  2⤵
  PID:8640
- C:\Windows\System\YFYUVrC.exe
  C:\Windows\System\YFYUVrC.exe
  2⤵
  PID:8680
- C:\Windows\System\xgZBJDt.exe
  C:\Windows\System\xgZBJDt.exe
  2⤵
  PID:8704
- C:\Windows\System\jDgCLje.exe
  C:\Windows\System\jDgCLje.exe
  2⤵
  PID:8736
- C:\Windows\System\kuqNrPq.exe
  C:\Windows\System\kuqNrPq.exe
  2⤵
  PID:8760
- C:\Windows\System\dFZsgtb.exe
  C:\Windows\System\dFZsgtb.exe
  2⤵
  PID:8780
- C:\Windows\System\vlRsMTV.exe
  C:\Windows\System\vlRsMTV.exe
  2⤵
  PID:8816
- C:\Windows\System\NBopLQk.exe
  C:\Windows\System\NBopLQk.exe
  2⤵
  PID:8860
- C:\Windows\System\ctQhoSJ.exe
  C:\Windows\System\ctQhoSJ.exe
  2⤵
  PID:8900
- C:\Windows\System\EOgSgbU.exe
  C:\Windows\System\EOgSgbU.exe
  2⤵
  PID:8916
- C:\Windows\System\EoojOky.exe
  C:\Windows\System\EoojOky.exe
  2⤵
  PID:8952
- C:\Windows\System\oEMtQeC.exe
  C:\Windows\System\oEMtQeC.exe
  2⤵
  PID:8972
- C:\Windows\System\nlSlmIq.exe
  C:\Windows\System\nlSlmIq.exe
  2⤵
  PID:9004
- C:\Windows\System\RPNbyUR.exe
  C:\Windows\System\RPNbyUR.exe
  2⤵
  PID:9020
- C:\Windows\System\xPttFlZ.exe
  C:\Windows\System\xPttFlZ.exe
  2⤵
  PID:9044
- C:\Windows\System\rpxibJz.exe
  C:\Windows\System\rpxibJz.exe
  2⤵
  PID:9068
- C:\Windows\System\qPMOOpy.exe
  C:\Windows\System\qPMOOpy.exe
  2⤵
  PID:9092
- C:\Windows\System\TzjpIjL.exe
  C:\Windows\System\TzjpIjL.exe
  2⤵
  PID:9120
- C:\Windows\System\akomljF.exe
  C:\Windows\System\akomljF.exe
  2⤵
  PID:9156
- C:\Windows\System\YuRILFx.exe
  C:\Windows\System\YuRILFx.exe
  2⤵
  PID:9188
- C:\Windows\System\LAooUlN.exe
  C:\Windows\System\LAooUlN.exe
  2⤵
  PID:8008
- C:\Windows\System\DBQmRNl.exe
  C:\Windows\System\DBQmRNl.exe
  2⤵
  PID:8212
- C:\Windows\System\kibxlfz.exe
  C:\Windows\System\kibxlfz.exe
  2⤵
  PID:8236
- C:\Windows\System\HmhaozC.exe
  C:\Windows\System\HmhaozC.exe
  2⤵
  PID:8360
- C:\Windows\System\PJruYrs.exe
  C:\Windows\System\PJruYrs.exe
  2⤵
  PID:8388
- C:\Windows\System\UVbInfx.exe
  C:\Windows\System\UVbInfx.exe
  2⤵
  PID:8428
- C:\Windows\System\QvhJHlD.exe
  C:\Windows\System\QvhJHlD.exe
  2⤵
  PID:8540
- C:\Windows\System\PyXNVxm.exe
  C:\Windows\System\PyXNVxm.exe
  2⤵
  PID:8588
- C:\Windows\System\GBORkQo.exe
  C:\Windows\System\GBORkQo.exe
  2⤵
  PID:8652
- C:\Windows\System\eeLwahL.exe
  C:\Windows\System\eeLwahL.exe
  2⤵
  PID:8752
- C:\Windows\System\KEzGtMe.exe
  C:\Windows\System\KEzGtMe.exe
  2⤵
  PID:8844
- C:\Windows\System\erTKIbY.exe
  C:\Windows\System\erTKIbY.exe
  2⤵
  PID:8888
- C:\Windows\System\rWfLEBk.exe
  C:\Windows\System\rWfLEBk.exe
  2⤵
  PID:8964
- C:\Windows\System\srKhifa.exe
  C:\Windows\System\srKhifa.exe
  2⤵
  PID:9040
- C:\Windows\System\eHJkDkW.exe
  C:\Windows\System\eHJkDkW.exe
  2⤵
  PID:9136
- C:\Windows\System\GZvGfrS.exe
  C:\Windows\System\GZvGfrS.exe
  2⤵
  PID:9152
- C:\Windows\System\vOpWBZH.exe
  C:\Windows\System\vOpWBZH.exe
  2⤵
  PID:8132
- C:\Windows\System\ziBqGtQ.exe
  C:\Windows\System\ziBqGtQ.exe
  2⤵
  PID:8352
- C:\Windows\System\mgYLqAd.exe
  C:\Windows\System\mgYLqAd.exe
  2⤵
  PID:8412
- C:\Windows\System\lESldyQ.exe
  C:\Windows\System\lESldyQ.exe
  2⤵
  PID:8512
- C:\Windows\System\EeWJPAn.exe
  C:\Windows\System\EeWJPAn.exe
  2⤵
  PID:8700
- C:\Windows\System\EFUXrOA.exe
  C:\Windows\System\EFUXrOA.exe
  2⤵
  PID:3852
- C:\Windows\System\dkQhgmV.exe
  C:\Windows\System\dkQhgmV.exe
  2⤵
  PID:7736
- C:\Windows\System\IrLlXYI.exe
  C:\Windows\System\IrLlXYI.exe
  2⤵
  PID:8988
- C:\Windows\System\IBzXSXG.exe
  C:\Windows\System\IBzXSXG.exe
  2⤵
  PID:9220
- C:\Windows\System\LEbpwRu.exe
  C:\Windows\System\LEbpwRu.exe
  2⤵
  PID:9280
- C:\Windows\System\ruNeMIV.exe
  C:\Windows\System\ruNeMIV.exe
  2⤵
  PID:9316
- C:\Windows\System\zgFwNbR.exe
  C:\Windows\System\zgFwNbR.exe
  2⤵
  PID:9340
- C:\Windows\System\SrdZchu.exe
  C:\Windows\System\SrdZchu.exe
  2⤵
  PID:9392
- C:\Windows\System\BrBmvcU.exe
  C:\Windows\System\BrBmvcU.exe
  2⤵
  PID:9412
- C:\Windows\System\VFJgRRS.exe
  C:\Windows\System\VFJgRRS.exe
  2⤵
  PID:9436
- C:\Windows\System\EnKpYyh.exe
  C:\Windows\System\EnKpYyh.exe
  2⤵
  PID:9456
- C:\Windows\System\VPGutNA.exe
  C:\Windows\System\VPGutNA.exe
  2⤵
  PID:9488
- C:\Windows\System\ofumfCf.exe
  C:\Windows\System\ofumfCf.exe
  2⤵
  PID:9520
- C:\Windows\System\oFlXIcE.exe
  C:\Windows\System\oFlXIcE.exe
  2⤵
  PID:9540
- C:\Windows\System\bimgSKU.exe
  C:\Windows\System\bimgSKU.exe
  2⤵
  PID:9584
- C:\Windows\System\qALfwOC.exe
  C:\Windows\System\qALfwOC.exe
  2⤵
  PID:9608
- C:\Windows\System\ZLaaAci.exe
  C:\Windows\System\ZLaaAci.exe
  2⤵
  PID:9632
- C:\Windows\System\SfeDvuR.exe
  C:\Windows\System\SfeDvuR.exe
  2⤵
  PID:9672
- C:\Windows\System\vPPaoZP.exe
  C:\Windows\System\vPPaoZP.exe
  2⤵
  PID:9688
- C:\Windows\System\tRrQVCT.exe
  C:\Windows\System\tRrQVCT.exe
  2⤵
  PID:9728
- C:\Windows\System\gMpkhFG.exe
  C:\Windows\System\gMpkhFG.exe
  2⤵
  PID:9748
- C:\Windows\System\mDoDDGo.exe
  C:\Windows\System\mDoDDGo.exe
  2⤵
  PID:9780
- C:\Windows\System\SSFcSkY.exe
  C:\Windows\System\SSFcSkY.exe
  2⤵
  PID:9804
- C:\Windows\System\UahoDDg.exe
  C:\Windows\System\UahoDDg.exe
  2⤵
  PID:9828
- C:\Windows\System\oXPCSQk.exe
  C:\Windows\System\oXPCSQk.exe
  2⤵
  PID:9868
- C:\Windows\System\jynMdLe.exe
  C:\Windows\System\jynMdLe.exe
  2⤵
  PID:9884
- C:\Windows\System\XpsieOo.exe
  C:\Windows\System\XpsieOo.exe
  2⤵
  PID:9904
- C:\Windows\System\GdfpphM.exe
  C:\Windows\System\GdfpphM.exe
  2⤵
  PID:9924
- C:\Windows\System\ntZQimG.exe
  C:\Windows\System\ntZQimG.exe
  2⤵
  PID:9972
- C:\Windows\System\TPlMaMa.exe
  C:\Windows\System\TPlMaMa.exe
  2⤵
  PID:9996
- C:\Windows\System\WQznzTg.exe
  C:\Windows\System\WQznzTg.exe
  2⤵
  PID:10012
- C:\Windows\System\kWgrIoa.exe
  C:\Windows\System\kWgrIoa.exe
  2⤵
  PID:10036
- C:\Windows\System\yZNGQFC.exe
  C:\Windows\System\yZNGQFC.exe
  2⤵
  PID:10080
- C:\Windows\System\tztrhJV.exe
  C:\Windows\System\tztrhJV.exe
  2⤵
  PID:10096
- C:\Windows\System\cIwkLyx.exe
  C:\Windows\System\cIwkLyx.exe
  2⤵
  PID:10116
- C:\Windows\System\CSjDuki.exe
  C:\Windows\System\CSjDuki.exe
  2⤵
  PID:10176
- C:\Windows\System\OGVqYBb.exe
  C:\Windows\System\OGVqYBb.exe
  2⤵
  PID:10196
- C:\Windows\System\hbRdAIZ.exe
  C:\Windows\System\hbRdAIZ.exe
  2⤵
  PID:10220
- C:\Windows\System\pAEoNIk.exe
  C:\Windows\System\pAEoNIk.exe
  2⤵
  PID:8812
- C:\Windows\System\EQWJUfT.exe
  C:\Windows\System\EQWJUfT.exe
  2⤵
  PID:8480
- C:\Windows\System\dHECcIr.exe
  C:\Windows\System\dHECcIr.exe
  2⤵
  PID:8232
- C:\Windows\System\qYbxbwn.exe
  C:\Windows\System\qYbxbwn.exe
  2⤵
  PID:9056
- C:\Windows\System\ASYXSIS.exe
  C:\Windows\System\ASYXSIS.exe
  2⤵
  PID:9228
- C:\Windows\System\BTcrTRb.exe
  C:\Windows\System\BTcrTRb.exe
  2⤵
  PID:9296
- C:\Windows\System\qdgFlSB.exe
  C:\Windows\System\qdgFlSB.exe
  2⤵
  PID:9368
- C:\Windows\System\oumegKA.exe
  C:\Windows\System\oumegKA.exe
  2⤵
  PID:9452
- C:\Windows\System\kBIjKSa.exe
  C:\Windows\System\kBIjKSa.exe
  2⤵
  PID:9512
- C:\Windows\System\tPdWSYa.exe
  C:\Windows\System\tPdWSYa.exe
  2⤵
  PID:9572
- C:\Windows\System\vQZCtrM.exe
  C:\Windows\System\vQZCtrM.exe
  2⤵
  PID:9624
- C:\Windows\System\NPaczKe.exe
  C:\Windows\System\NPaczKe.exe
  2⤵
  PID:9756
- C:\Windows\System\EgmNtCS.exe
  C:\Windows\System\EgmNtCS.exe
  2⤵
  PID:9788
- C:\Windows\System\WAubpgQ.exe
  C:\Windows\System\WAubpgQ.exe
  2⤵
  PID:9820
- C:\Windows\System\eeqdscg.exe
  C:\Windows\System\eeqdscg.exe
  2⤵
  PID:9900
- C:\Windows\System\FSGuEDN.exe
  C:\Windows\System\FSGuEDN.exe
  2⤵
  PID:9948
- C:\Windows\System\qMywgzW.exe
  C:\Windows\System\qMywgzW.exe
  2⤵
  PID:10028
- C:\Windows\System\YoCVZNb.exe
  C:\Windows\System\YoCVZNb.exe
  2⤵
  PID:10092
- C:\Windows\System\idbLvtW.exe
  C:\Windows\System\idbLvtW.exe
  2⤵
  PID:10164
- C:\Windows\System\WbzmSUQ.exe
  C:\Windows\System\WbzmSUQ.exe
  2⤵
  PID:10184
- C:\Windows\System\PlOsMEI.exe
  C:\Windows\System\PlOsMEI.exe
  2⤵
  PID:8448
- C:\Windows\System\PvzdKSj.exe
  C:\Windows\System\PvzdKSj.exe
  2⤵
  PID:8612
- C:\Windows\System\kGzXlUi.exe
  C:\Windows\System\kGzXlUi.exe
  2⤵
  PID:9500
- C:\Windows\System\sZqHwmh.exe
  C:\Windows\System\sZqHwmh.exe
  2⤵
  PID:9668
- C:\Windows\System\ubksuEX.exe
  C:\Windows\System\ubksuEX.exe
  2⤵
  PID:9724
- C:\Windows\System\FZWNdpV.exe
  C:\Windows\System\FZWNdpV.exe
  2⤵
  PID:10108
- C:\Windows\System\bdVwUub.exe
  C:\Windows\System\bdVwUub.exe
  2⤵
  PID:10072
- C:\Windows\System\ycHinJz.exe
  C:\Windows\System\ycHinJz.exe
  2⤵
  PID:8876
- C:\Windows\System\zaTbyMS.exe
  C:\Windows\System\zaTbyMS.exe
  2⤵
  PID:9388
- C:\Windows\System\Xoemroh.exe
  C:\Windows\System\Xoemroh.exe
  2⤵
  PID:9504
- C:\Windows\System\RBsbIlE.exe
  C:\Windows\System\RBsbIlE.exe
  2⤵
  PID:9892
- C:\Windows\System\rQRsFiF.exe
  C:\Windows\System\rQRsFiF.exe
  2⤵
  PID:9308
- C:\Windows\System\XhzgiKf.exe
  C:\Windows\System\XhzgiKf.exe
  2⤵
  PID:9768
- C:\Windows\System\jkkjyzF.exe
  C:\Windows\System\jkkjyzF.exe
  2⤵
  PID:10272
- C:\Windows\System\SSrfThr.exe
  C:\Windows\System\SSrfThr.exe
  2⤵
  PID:10320
- C:\Windows\System\rooDaWp.exe
  C:\Windows\System\rooDaWp.exe
  2⤵
  PID:10344
- C:\Windows\System\FEhvBsv.exe
  C:\Windows\System\FEhvBsv.exe
  2⤵
  PID:10364
- C:\Windows\System\JsfDaJX.exe
  C:\Windows\System\JsfDaJX.exe
  2⤵
  PID:10388
- C:\Windows\System\fwNPPtW.exe
  C:\Windows\System\fwNPPtW.exe
  2⤵
  PID:10428
- C:\Windows\System\fNmAHbg.exe
  C:\Windows\System\fNmAHbg.exe
  2⤵
  PID:10448
- C:\Windows\System\QKgzwzn.exe
  C:\Windows\System\QKgzwzn.exe
  2⤵
  PID:10476
- C:\Windows\System\lbQwkVF.exe
  C:\Windows\System\lbQwkVF.exe
  2⤵
  PID:10496
- C:\Windows\System\ZwQmrfW.exe
  C:\Windows\System\ZwQmrfW.exe
  2⤵
  PID:10540
- C:\Windows\System\vEKHfso.exe
  C:\Windows\System\vEKHfso.exe
  2⤵
  PID:10564
- C:\Windows\System\XNPSISV.exe
  C:\Windows\System\XNPSISV.exe
  2⤵
  PID:10588
- C:\Windows\System\JlqyHKW.exe
  C:\Windows\System\JlqyHKW.exe
  2⤵
  PID:10628
- C:\Windows\System\zDhMSAQ.exe
  C:\Windows\System\zDhMSAQ.exe
  2⤵
  PID:10644
- C:\Windows\System\yOqMTIs.exe
  C:\Windows\System\yOqMTIs.exe
  2⤵
  PID:10676
- C:\Windows\System\URlRhcz.exe
  C:\Windows\System\URlRhcz.exe
  2⤵
  PID:10708
- C:\Windows\System\LYKZkMZ.exe
  C:\Windows\System\LYKZkMZ.exe
  2⤵
  PID:10740
- C:\Windows\System\hluIrbT.exe
  C:\Windows\System\hluIrbT.exe
  2⤵
  PID:10780
- C:\Windows\System\FgtqSWF.exe
  C:\Windows\System\FgtqSWF.exe
  2⤵
  PID:10796
- C:\Windows\System\WuvqpqT.exe
  C:\Windows\System\WuvqpqT.exe
  2⤵
  PID:10820
- C:\Windows\System\bJNjJZc.exe
  C:\Windows\System\bJNjJZc.exe
  2⤵
  PID:10852
- C:\Windows\System\IxyLuyP.exe
  C:\Windows\System\IxyLuyP.exe
  2⤵
  PID:10880
- C:\Windows\System\rYPkobY.exe
  C:\Windows\System\rYPkobY.exe
  2⤵
  PID:10904
- C:\Windows\System\qnDoteS.exe
  C:\Windows\System\qnDoteS.exe
  2⤵
  PID:10924
- C:\Windows\System\nbQgsAw.exe
  C:\Windows\System\nbQgsAw.exe
  2⤵
  PID:10960
- C:\Windows\System\NfaOvHF.exe
  C:\Windows\System\NfaOvHF.exe
  2⤵
  PID:10980
- C:\Windows\System\ALbpAxO.exe
  C:\Windows\System\ALbpAxO.exe
  2⤵
  PID:10996
- C:\Windows\System\yjOXxTF.exe
  C:\Windows\System\yjOXxTF.exe
  2⤵
  PID:11024
- C:\Windows\System\RxwbUGU.exe
  C:\Windows\System\RxwbUGU.exe
  2⤵
  PID:11068
- C:\Windows\System\CSSTzAz.exe
  C:\Windows\System\CSSTzAz.exe
  2⤵
  PID:11096
- C:\Windows\System\CfocPgl.exe
  C:\Windows\System\CfocPgl.exe
  2⤵
  PID:11144
- C:\Windows\System\iYfEArr.exe
  C:\Windows\System\iYfEArr.exe
  2⤵
  PID:11160
- C:\Windows\System\AwmIGaM.exe
  C:\Windows\System\AwmIGaM.exe
  2⤵
  PID:11188
- C:\Windows\System\oFYbUlQ.exe
  C:\Windows\System\oFYbUlQ.exe
  2⤵
  PID:11216
- C:\Windows\System\FZenLYI.exe
  C:\Windows\System\FZenLYI.exe
  2⤵
  PID:11244
- C:\Windows\System\CFFnRFg.exe
  C:\Windows\System\CFFnRFg.exe
  2⤵
  PID:10008
- C:\Windows\System\iXdHLYv.exe
  C:\Windows\System\iXdHLYv.exe
  2⤵
  PID:10280
- C:\Windows\System\gbhzGCr.exe
  C:\Windows\System\gbhzGCr.exe
  2⤵
  PID:10312
- C:\Windows\System\VudbiZu.exe
  C:\Windows\System\VudbiZu.exe
  2⤵
  PID:10420
- C:\Windows\System\eWErRdF.exe
  C:\Windows\System\eWErRdF.exe
  2⤵
  PID:10464
- C:\Windows\System\wLEWkqS.exe
  C:\Windows\System\wLEWkqS.exe
  2⤵
  PID:10508
- C:\Windows\System\caiLuYw.exe
  C:\Windows\System\caiLuYw.exe
  2⤵
  PID:10620
- C:\Windows\System\uUAhEaA.exe
  C:\Windows\System\uUAhEaA.exe
  2⤵
  PID:10664
- C:\Windows\System\WmABoIm.exe
  C:\Windows\System\WmABoIm.exe
  2⤵
  PID:10736
- C:\Windows\System\yYUWQSz.exe
  C:\Windows\System\yYUWQSz.exe
  2⤵
  PID:10804
- C:\Windows\System\GrrNjWD.exe
  C:\Windows\System\GrrNjWD.exe
  2⤵
  PID:1448
- C:\Windows\System\CHDeyIN.exe
  C:\Windows\System\CHDeyIN.exe
  2⤵
  PID:10900
- C:\Windows\System\taOgSPb.exe
  C:\Windows\System\taOgSPb.exe
  2⤵
  PID:11004
- C:\Windows\System\GRIienS.exe
  C:\Windows\System\GRIienS.exe
  2⤵
  PID:11032
- C:\Windows\System\yafRzJb.exe
  C:\Windows\System\yafRzJb.exe
  2⤵
  PID:11128
- C:\Windows\System\akRjCvh.exe
  C:\Windows\System\akRjCvh.exe
  2⤵
  PID:11172
- C:\Windows\System\zYdKdTT.exe
  C:\Windows\System\zYdKdTT.exe
  2⤵
  PID:11236
- C:\Windows\System\yqJGsax.exe
  C:\Windows\System\yqJGsax.exe
  2⤵
  PID:10296
- C:\Windows\System\abiuWKT.exe
  C:\Windows\System\abiuWKT.exe
  2⤵
  PID:10488
- C:\Windows\System\EmpjuFd.exe
  C:\Windows\System\EmpjuFd.exe
  2⤵
  PID:10608
- C:\Windows\System\uHGJYIs.exe
  C:\Windows\System\uHGJYIs.exe
  2⤵
  PID:10720
- C:\Windows\System\IQVtHwD.exe
  C:\Windows\System\IQVtHwD.exe
  2⤵
  PID:10840
- C:\Windows\System\TxYGhHK.exe
  C:\Windows\System\TxYGhHK.exe
  2⤵
  PID:10988
- C:\Windows\System\pksJgig.exe
  C:\Windows\System\pksJgig.exe
  2⤵
  PID:10396
- C:\Windows\System\QNHSxWk.exe
  C:\Windows\System\QNHSxWk.exe
  2⤵
  PID:10640
- C:\Windows\System\SLCPhID.exe
  C:\Windows\System\SLCPhID.exe
  2⤵
  PID:10788
- C:\Windows\System\HFxfiUR.exe
  C:\Windows\System\HFxfiUR.exe
  2⤵
  PID:11084
- C:\Windows\System\JhTKxpe.exe
  C:\Windows\System\JhTKxpe.exe
  2⤵
  PID:9992
- C:\Windows\System\qkivYYH.exe
  C:\Windows\System\qkivYYH.exe
  2⤵
  PID:11016
- C:\Windows\System\BoJSnmh.exe
  C:\Windows\System\BoJSnmh.exe
  2⤵
  PID:11280
- C:\Windows\System\YUEEnMS.exe
  C:\Windows\System\YUEEnMS.exe
  2⤵
  PID:11312
- C:\Windows\System\ADkAhew.exe
  C:\Windows\System\ADkAhew.exe
  2⤵
  PID:11340
- C:\Windows\System\QdZJSfV.exe
  C:\Windows\System\QdZJSfV.exe
  2⤵
  PID:11360
- C:\Windows\System\wjYfJoo.exe
  C:\Windows\System\wjYfJoo.exe
  2⤵
  PID:11412
- C:\Windows\System\djEWNnb.exe
  C:\Windows\System\djEWNnb.exe
  2⤵
  PID:11432
- C:\Windows\System\fwOZFwA.exe
  C:\Windows\System\fwOZFwA.exe
  2⤵
  PID:11460
- C:\Windows\System\pcasVEx.exe
  C:\Windows\System\pcasVEx.exe
  2⤵
  PID:11476
- C:\Windows\System\ORDqzyU.exe
  C:\Windows\System\ORDqzyU.exe
  2⤵
  PID:11516
- C:\Windows\System\zDEqauP.exe
  C:\Windows\System\zDEqauP.exe
  2⤵
  PID:11544
- C:\Windows\System\QBaWlil.exe
  C:\Windows\System\QBaWlil.exe
  2⤵
  PID:11576
- C:\Windows\System\gCOdbJg.exe
  C:\Windows\System\gCOdbJg.exe
  2⤵
  PID:11620
- C:\Windows\System\FxufrWA.exe
  C:\Windows\System\FxufrWA.exe
  2⤵
  PID:11652
- C:\Windows\System\YGqbwqJ.exe
  C:\Windows\System\YGqbwqJ.exe
  2⤵
  PID:11672
- C:\Windows\System\YBeOQvM.exe
  C:\Windows\System\YBeOQvM.exe
  2⤵
  PID:11704
- C:\Windows\System\VyaRGDV.exe
  C:\Windows\System\VyaRGDV.exe
  2⤵
  PID:11728
- C:\Windows\System\MdJTIbb.exe
  C:\Windows\System\MdJTIbb.exe
  2⤵
  PID:11760
- C:\Windows\System\bRaaXPK.exe
  C:\Windows\System\bRaaXPK.exe
  2⤵
  PID:11780
- C:\Windows\System\eYXlllf.exe
  C:\Windows\System\eYXlllf.exe
  2⤵
  PID:11832
- C:\Windows\System\KKICMba.exe
  C:\Windows\System\KKICMba.exe
  2⤵
  PID:11848
- C:\Windows\System\YuTTKQf.exe
  C:\Windows\System\YuTTKQf.exe
  2⤵
  PID:11868
- C:\Windows\System\ZDrjIeP.exe
  C:\Windows\System\ZDrjIeP.exe
  2⤵
  PID:11904
- C:\Windows\System\iMwQtSv.exe
  C:\Windows\System\iMwQtSv.exe
  2⤵
  PID:11924
- C:\Windows\System\qkoWkEy.exe
  C:\Windows\System\qkoWkEy.exe
  2⤵
  PID:11948
- C:\Windows\System\fTROXpD.exe
  C:\Windows\System\fTROXpD.exe
  2⤵
  PID:11988
- C:\Windows\System\XQMOyDZ.exe
  C:\Windows\System\XQMOyDZ.exe
  2⤵
  PID:12092
- C:\Windows\System\QQBhqgm.exe
  C:\Windows\System\QQBhqgm.exe
  2⤵
  PID:12180
- C:\Windows\System\WVOBABS.exe
  C:\Windows\System\WVOBABS.exe
  2⤵
  PID:12200
- C:\Windows\System\jdKtPQx.exe
  C:\Windows\System\jdKtPQx.exe
  2⤵
  PID:12240
- C:\Windows\System\BMoebfZ.exe
  C:\Windows\System\BMoebfZ.exe
  2⤵
  PID:12276
- C:\Windows\System\pWJkxaS.exe
  C:\Windows\System\pWJkxaS.exe
  2⤵
  PID:11272
- C:\Windows\System\sdOCZsY.exe
  C:\Windows\System\sdOCZsY.exe
  2⤵
  PID:11320
- C:\Windows\System\BIliLNa.exe
  C:\Windows\System\BIliLNa.exe
  2⤵
  PID:11384
- C:\Windows\System\xmGcrYt.exe
  C:\Windows\System\xmGcrYt.exe
  2⤵
  PID:11444
- C:\Windows\System\AqObMLs.exe
  C:\Windows\System\AqObMLs.exe
  2⤵
  PID:11500
- C:\Windows\System\mfxjvCm.exe
  C:\Windows\System\mfxjvCm.exe
  2⤵
  PID:11588
- C:\Windows\System\mozixzK.exe
  C:\Windows\System\mozixzK.exe
  2⤵
  PID:11668
- C:\Windows\System\KuzHpCP.exe
  C:\Windows\System\KuzHpCP.exe
  2⤵
  PID:11720
- C:\Windows\System\sNNgYiZ.exe
  C:\Windows\System\sNNgYiZ.exe
  2⤵
  PID:11800
- C:\Windows\System\zsBVyHe.exe
  C:\Windows\System\zsBVyHe.exe
  2⤵
  PID:11824
- C:\Windows\System\yHHSapt.exe
  C:\Windows\System\yHHSapt.exe
  2⤵
  PID:11880
- C:\Windows\System\ffKlXut.exe
  C:\Windows\System\ffKlXut.exe
  2⤵
  PID:11936
- C:\Windows\System\SDflPpl.exe
  C:\Windows\System\SDflPpl.exe
  2⤵
  PID:11980
- C:\Windows\System\OSYoDkH.exe
  C:\Windows\System\OSYoDkH.exe
  2⤵
  PID:12024
- C:\Windows\System\qhagJfM.exe
  C:\Windows\System\qhagJfM.exe
  2⤵
  PID:12140
- C:\Windows\System\pUITUgF.exe
  C:\Windows\System\pUITUgF.exe
  2⤵
  PID:12052
- C:\Windows\System\IQXGoal.exe
  C:\Windows\System\IQXGoal.exe
  2⤵
  PID:12104
- C:\Windows\System\MNfzRlu.exe
  C:\Windows\System\MNfzRlu.exe
  2⤵
  PID:12112
- C:\Windows\System\uSxoyva.exe
  C:\Windows\System\uSxoyva.exe
  2⤵
  PID:12232
- C:\Windows\System\oyprrFg.exe
  C:\Windows\System\oyprrFg.exe
  2⤵
  PID:11292
- C:\Windows\System\paYBIBU.exe
  C:\Windows\System\paYBIBU.exe
  2⤵
  PID:11472
- C:\Windows\System\EaNYRaX.exe
  C:\Windows\System\EaNYRaX.exe
  2⤵
  PID:11428
- C:\Windows\System\IVEVYxV.exe
  C:\Windows\System\IVEVYxV.exe
  2⤵
  PID:11064
- C:\Windows\System\ShOEoPm.exe
  C:\Windows\System\ShOEoPm.exe
  2⤵
  PID:11752
- C:\Windows\System\RhwDHJS.exe
  C:\Windows\System\RhwDHJS.exe
  2⤵
  PID:11920
- C:\Windows\System\eItxFrw.exe
  C:\Windows\System\eItxFrw.exe
  2⤵
  PID:11968
- C:\Windows\System\JJSdlTW.exe
  C:\Windows\System\JJSdlTW.exe
  2⤵
  PID:12196
- C:\Windows\System\JIKQyqm.exe
  C:\Windows\System\JIKQyqm.exe
  2⤵
  PID:12044
- C:\Windows\System\VyEumzP.exe
  C:\Windows\System\VyEumzP.exe
  2⤵
  PID:11332
- C:\Windows\System\KewZzYv.exe
  C:\Windows\System\KewZzYv.exe
  2⤵
  PID:2288
- C:\Windows\System\BbuaRnH.exe
  C:\Windows\System\BbuaRnH.exe
  2⤵
  PID:564
- C:\Windows\System\AhvVial.exe
  C:\Windows\System\AhvVial.exe
  2⤵
  PID:12028
- C:\Windows\System\htTUJNn.exe
  C:\Windows\System\htTUJNn.exe
  2⤵
  PID:12100
- C:\Windows\System\VjuYwNG.exe
  C:\Windows\System\VjuYwNG.exe
  2⤵
  PID:1040
- C:\Windows\System\WniBYfd.exe
  C:\Windows\System\WniBYfd.exe
  2⤵
  PID:11756
- C:\Windows\System\MQQlxzC.exe
  C:\Windows\System\MQQlxzC.exe
  2⤵
  PID:11844
- C:\Windows\System\lTUvVRZ.exe
  C:\Windows\System\lTUvVRZ.exe
  2⤵
  PID:12012
- C:\Windows\System\IQZzejg.exe
  C:\Windows\System\IQZzejg.exe
  2⤵
  PID:12304
- C:\Windows\System\mfGgOpN.exe
  C:\Windows\System\mfGgOpN.exe
  2⤵
  PID:12324
- C:\Windows\System\GKAzFvP.exe
  C:\Windows\System\GKAzFvP.exe
  2⤵
  PID:12348
- C:\Windows\System\VLMejNp.exe
  C:\Windows\System\VLMejNp.exe
  2⤵
  PID:12400
- C:\Windows\System\eKGGOzR.exe
  C:\Windows\System\eKGGOzR.exe
  2⤵
  PID:12416
- C:\Windows\System\UCJYDsd.exe
  C:\Windows\System\UCJYDsd.exe
  2⤵
  PID:12456
- C:\Windows\System\KmrWJaA.exe
  C:\Windows\System\KmrWJaA.exe
  2⤵
  PID:12476
- C:\Windows\System\UUvHBWt.exe
  C:\Windows\System\UUvHBWt.exe
  2⤵
  PID:12504
- C:\Windows\System\eiTFqlr.exe
  C:\Windows\System\eiTFqlr.exe
  2⤵
  PID:12528
- C:\Windows\System\YDOhVxF.exe
  C:\Windows\System\YDOhVxF.exe
  2⤵
  PID:12552
- C:\Windows\System\SqnEknc.exe
  C:\Windows\System\SqnEknc.exe
  2⤵
  PID:12596
- C:\Windows\System\DbFsPsU.exe
  C:\Windows\System\DbFsPsU.exe
  2⤵
  PID:12612
- C:\Windows\System\SkDeYpO.exe
  C:\Windows\System\SkDeYpO.exe
  2⤵
  PID:12640
- C:\Windows\System\vVbxkqJ.exe
  C:\Windows\System\vVbxkqJ.exe
  2⤵
  PID:12676
- C:\Windows\System\ABqlnIu.exe
  C:\Windows\System\ABqlnIu.exe
  2⤵
  PID:12700
- C:\Windows\System\nQvnKeY.exe
  C:\Windows\System\nQvnKeY.exe
  2⤵
  PID:12724
- C:\Windows\System\IucmutO.exe
  C:\Windows\System\IucmutO.exe
  2⤵
  PID:12744
- C:\Windows\System\AcaNZLh.exe
  C:\Windows\System\AcaNZLh.exe
  2⤵
  PID:12768
- C:\Windows\System\qSZVbdi.exe
  C:\Windows\System\qSZVbdi.exe
  2⤵
  PID:12788
- C:\Windows\System\GDgYeLi.exe
  C:\Windows\System\GDgYeLi.exe
  2⤵
  PID:12812
- C:\Windows\System\xVdWuBR.exe
  C:\Windows\System\xVdWuBR.exe
  2⤵
  PID:12836
- C:\Windows\System\MeCBLbS.exe
  C:\Windows\System\MeCBLbS.exe
  2⤵
  PID:12856
- C:\Windows\System\RsyWFsh.exe
  C:\Windows\System\RsyWFsh.exe
  2⤵
  PID:12900
- C:\Windows\System\vyIDZiN.exe
  C:\Windows\System\vyIDZiN.exe
  2⤵
  PID:12924
- C:\Windows\System\DuBgxMD.exe
  C:\Windows\System\DuBgxMD.exe
  2⤵
  PID:12952
- C:\Windows\System\CWYNIEo.exe
  C:\Windows\System\CWYNIEo.exe
  2⤵
  PID:13000
- C:\Windows\System\hvrEdJW.exe
  C:\Windows\System\hvrEdJW.exe
  2⤵
  PID:13020
- C:\Windows\System\hUFseFE.exe
  C:\Windows\System\hUFseFE.exe
  2⤵
  PID:13052
- C:\Windows\System\ULCWQhR.exe
  C:\Windows\System\ULCWQhR.exe
  2⤵
  PID:13080
- C:\Windows\System\kSbRsiF.exe
  C:\Windows\System\kSbRsiF.exe
  2⤵
  PID:13108
- C:\Windows\System\QXrRedv.exe
  C:\Windows\System\QXrRedv.exe
  2⤵
  PID:13128
- C:\Windows\System\vdKNXqy.exe
  C:\Windows\System\vdKNXqy.exe
  2⤵
  PID:13176
- C:\Windows\System\PkMLBwp.exe
  C:\Windows\System\PkMLBwp.exe
  2⤵
  PID:13208
- C:\Windows\System\OpxQbSB.exe
  C:\Windows\System\OpxQbSB.exe
  2⤵
  PID:12436
- C:\Windows\System\EgdAMaj.exe
  C:\Windows\System\EgdAMaj.exe
  2⤵
  PID:12524
- C:\Windows\System\InlCfTJ.exe
  C:\Windows\System\InlCfTJ.exe
  2⤵
  PID:12568
- C:\Windows\System\gFgkNsv.exe
  C:\Windows\System\gFgkNsv.exe
  2⤵
  PID:12624
- C:\Windows\System\yeVkaxJ.exe
  C:\Windows\System\yeVkaxJ.exe
  2⤵
  PID:12712
- C:\Windows\System\EqJzmnl.exe
  C:\Windows\System\EqJzmnl.exe
  2⤵
  PID:12740
- C:\Windows\System\jrNCLwB.exe
  C:\Windows\System\jrNCLwB.exe
  2⤵
  PID:12796
- C:\Windows\System\EYdFiCk.exe
  C:\Windows\System\EYdFiCk.exe
  2⤵
  PID:12828
- C:\Windows\System\jmftMya.exe
  C:\Windows\System\jmftMya.exe
  2⤵
  PID:12908
- C:\Windows\System\HyHigXR.exe
  C:\Windows\System\HyHigXR.exe
  2⤵
  PID:12968
- C:\Windows\System\LcdLhjD.exe
  C:\Windows\System\LcdLhjD.exe
  2⤵
  PID:13012
- C:\Windows\System\sNviHJZ.exe
  C:\Windows\System\sNviHJZ.exe
  2⤵
  PID:3044
- C:\Windows\System\rHAqYON.exe
  C:\Windows\System\rHAqYON.exe
  2⤵
  PID:13152
- C:\Windows\System\PojTXjg.exe
  C:\Windows\System\PojTXjg.exe
  2⤵
  PID:13200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kvkd1wi1.nbq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AXPmWid.exe

Filesize
2.4MB

MD5
5bb86d1d11d57072e3d92263fce93738

SHA1
a7e448e4a359fe16ee943fa94ba7870fb0fffbca

SHA256
c9f3dc27ea18ea7c9aea48e95229e6ac4eaf1db983d3ec1992d03bd6ad461dcd

SHA512
2a4d538c3bf5d4b99298984e519da55a66a659531f28ec17a189aaf54d2d4d9bb92d8bfa6b3b0923901c049d646f59d17da4946ccea5b6d21282b776997f28a4

Download Submit
C:\Windows\System\AqSGiWx.exe

Filesize
2.4MB

MD5
2820861778fb810866e850ada69a752c

SHA1
3268c9960fcd69ba3a8d817a599e95b0e528c92c

SHA256
80c5432bf6c56698b3103be888738e41b464a878163f160024d79aa21755b390

SHA512
de4844f8b26c206b289aa21a1756f587ce56cf7a4fcc33adb649ec695240677f7d1d97d7d85435776680102832c7a7c9842dd33d2dc691526b5e9138fa99221a

Download Submit
C:\Windows\System\BLqJEHW.exe

Filesize
2.4MB

MD5
306ad369f5d3d80a344d0cf73eaeed2d

SHA1
b3a3e43b31b5ae2d20e36a1e683a02eb189055bb

SHA256
d89eea35ee7714e9c86ca0a35e3f0439ac8f308eec3482453bd3ae915a1fba3d

SHA512
50c80383d0d2b58ad9ea8f6a5841036831bafac76ed4819b606581c72f6619ab1728834a2ec912740f8c5cfd67bbad2ce61118f9f007d0e3dbcbe417bbbd0762

Download Submit
C:\Windows\System\CGAjMRA.exe

Filesize
2.4MB

MD5
1ed4fd14aaa5140973ce267cf4636d20

SHA1
4816f56f653119632d1591a7064f3467dc9f0d94

SHA256
b034b0ce1d37e14fa1efc5a7fb4c8cb5d5b01c88b5e81017662939aeb51fbe4b

SHA512
d13ad82e1750bdb39b4c8ee1933f54aa18d323dc7aabac3d9329d7094b3fefee0393cb0c54ccbf80fc5bcf7aa30894a8882f48630c45bc727d585a1a66e31738

Download Submit
C:\Windows\System\EmoYCDs.exe

Filesize
2.4MB

MD5
2c821fe7895334123d6e625c47eca7e2

SHA1
e98f4922337a24ac855fde249537b8fe6985d1b5

SHA256
e47bc84949702e528063e7fd1a33e63fde8ada29bbed567342d656d6037c17c7

SHA512
35a47349964b2f498410588aaadd5b1ada12a0e93fbd44ba113cec9aa3e88d0e3c97ede3c48f249dc29c23c207d0fe76eae1350b9d75809176cc980ed1623390

Download Submit
C:\Windows\System\GXexKWF.exe

Filesize
2.4MB

MD5
91746a1f7c32de5ec8ef80754134c15e

SHA1
28e4f709fcb9eedd69fa2a08836f1a38a2535889

SHA256
e4e4e5b324e05f3aea7d730b0d715098f66f625a0379f743cb417249ae56603e

SHA512
2785638df8e06de0fcf0f04ed959a73dff969dd215799701bea4ef08f06924929191b0441c7a2031a80995c4855c6b5068009b7e1121a74a90bf05e50832a03c

Download Submit
C:\Windows\System\KrQmoYo.exe

Filesize
2.4MB

MD5
fb8add2dcd150412b02136d62a56160b

SHA1
5df4ff0359d85b4b3758c77bec3706efd44dbce9

SHA256
8ca580914f634040cf1be626fa41fbfd95088af64fe8afd73fd7f72054ed2982

SHA512
f020eb4540bcdbb094d7c5464c391409f5adf86977eb2bb16f09641bff6f2bf488c8b4ca1cfd517323bfd48a19882eb108343f817160f25462501f08c420af6e

Download Submit
C:\Windows\System\LNugWzk.exe

Filesize
2.4MB

MD5
3de41502a8bf4695cb5cf5f0f2f8afe1

SHA1
05ba8148e27989f33e6f87a8ceb60d62fbd13e05

SHA256
5806fe89b3fdc7dba42388b22ffee6e3e343117accd8fbb3a899f115be70f95a

SHA512
a8abe3820c16fbc0a0982756ddb2bb7460b070ae5db0630bb2a6a04d2dc434da26e4f36ed9f24021402ec7be50e41bed76a8ea267aed9185807030c3ac2eca9b

Download Submit
C:\Windows\System\McfQGxs.exe

Filesize
2.4MB

MD5
fe0fa0011bfd0f6b1b00254387cddbbb

SHA1
6f12a857e9292eb27aabcd74b1acf29ade6c2cf0

SHA256
a2ef88e0ae133f472e15cd85414d9fbfa6df4bec65b6f6531aec857822a96030

SHA512
71a39cabdb59baf6a74ae02d388ad2bf4cc734e9c20cfa34cf3a18fe0687dca7f8588942d28d8c880a17ecece227a3ad05b0efd64f4a96eed641653d4425b149

Download Submit
C:\Windows\System\QIclARC.exe

Filesize
2.4MB

MD5
f3854f6ca8164a0632a72c4339057cc6

SHA1
2e7b972a4a877401775bb6dc937fb3c6ce4b16c0

SHA256
990f9188bbc04aa397c6be9fb1792c489ef28e3b90833adb14edefa0daec009c

SHA512
5c4bf979faf0f636436b35ef2c29eacf8285e8daf922dc468eb34f8f2d25bc464985801d7c7f51c21834375d57fa408853c016d53ee7206036f6098cca390708

Download Submit
C:\Windows\System\QPzEyWg.exe

Filesize
2.4MB

MD5
bab40d0b175baa7fa575b4591cb46bb7

SHA1
04b02f3c8a2f60a465b1778bdd0bd23c76960766

SHA256
0bfec2f3f15ff5a19cf2bd05e388f74426e0a8486973d5991a302037c9db5a68

SHA512
c28108b6b4b0439aea644db88e4dee4b20723d25e8d75d0715ea1b84671af0befb6e28ad23bc72a59e8a0319e25e881fdefe60d7787221d7d27c82a6f59e4bf0

Download Submit
C:\Windows\System\VTZRmVP.exe

Filesize
2.4MB

MD5
8f3ab9f5707f97f1ae2775e1981e4c3e

SHA1
3413c1f2f4b60a0db87fb013211b561160bac0fb

SHA256
8c19d9d32c9c114e6ed49984a9b82db0c56c745b17fb9abed4ec28ce1c218401

SHA512
d024964066bef4ad580b425777400156eba14f126eae67480bdee75a99d3e026d9cb933b17a2e7a20223966eb553684fb8681b324f4e14ad9539b2fc2c153987

Download Submit
C:\Windows\System\YZDFdBR.exe

Filesize
2.4MB

MD5
7204e5dd4ae23a276c6f2fa34a66c84f

SHA1
f0d6d756403206c5c0318436b7b1f64aca65fb96

SHA256
d4c6815df2130814f7e5ef06640b5f474a166f87813c24fd2e0a8e653d1f25ef

SHA512
321e886d99fec72afc6d3a9de16e87c301343edf3bb3985b282041656fa18ea41a399149dfe33cc90f55b1002c859a5868c876a1f10065cb0c22de887c1469d3

Download Submit
C:\Windows\System\ZqsYEsK.exe

Filesize
2.4MB

MD5
e48316f64745af482dd592afa6695f08

SHA1
7006ad506fa9e9f7eb7f759dc12cccbb1d1f6001

SHA256
4791a3f461fe06a3c881512f6e2156e41f72ebea4795dae8727d151203d0273f

SHA512
cdf49529cf9eebfec3de378082515f1d6bc2fd3d0f49894efac0e04d96e20f74fdcb4c0291b9001a3384b54b9661a67099964d78e86d9be764053bfde1b8a1de

Download Submit
C:\Windows\System\aCjBIUp.exe

Filesize
2.4MB

MD5
e4bca8d4a626ff28baa12581727ee652

SHA1
2d360def7656a15f98ba1753b109092296312f5b

SHA256
e7d0fe423fcdd0ef1c0e8bfaf11d069519e09af06048f8939c7891004a7df485

SHA512
62c9a0bb8990fcc77d038e1db44df0f4c8c3e96a47d3226b5c04f3cb21c81a6d5613ca1c750207033a7adaca696026e5b97d89ae346d5d21d1eb652fb96d4cb8

Download Submit
C:\Windows\System\azcmnUM.exe

Filesize
2.4MB

MD5
f5fd862006fad62bd7cd772156732d68

SHA1
8143fad3847b43bb8d72cd74b386a9a2fc15730a

SHA256
8dc0e892f81607483f71eea1e1aed4213b14f3b1d6bc3cc27d7151f060fe481d

SHA512
2acae205df4ae686202e2009725f315d8c35f5fb1eb229331f3a6052f1bc152e99d84fbcb84024ac2b35c533cbe7484b02795408e3223790fcd6965a7c1ecb34

Download Submit
C:\Windows\System\cDvPFgW.exe

Filesize
2.4MB

MD5
1fa7b6c2eaab5d52f0ce42af0edfefe3

SHA1
a84e1e6bc95b0dd5f451443153b82c09bc4ced7c

SHA256
0a13c3d32ae84feea7ff6f943bea6859d5a796debf2e9582bc05295bee050c5c

SHA512
daae7161d4d509289a782d90a6a5d0dc04ae26f0b96fbd97971d0d12441a2af5a4c8d676545ea7aa95884ce287e57a86d7c21cd4b7bb212312cb022be05b93cd

Download Submit
C:\Windows\System\cpPKzzZ.exe

Filesize
2.4MB

MD5
184452646e5f745c58b68e619d9323ec

SHA1
ca8344bdc169ddf36a6e3c74f06d94e85f6bf6cd

SHA256
0e4a5ae7d471cae5bbd8944ba31b3853e134a95a64ba3897973e4ae94a6674c0

SHA512
e87ae59256b98af7996361d46c852c40e88abf1db159920e5b139f500c9ca21b1715a2040970e8dde15944af949568f641f6c18f14e681b1e13b7f7d3c9df8b6

Download Submit
C:\Windows\System\dsrswgO.exe

Filesize
2.4MB

MD5
2b22d682107df6e7c1c0c7cc21dccf65

SHA1
502a3c2cf6c26e39384396f7ebfb949b0d3aa961

SHA256
0ad4bc6a1422ef0444cb321366f253c5100595600c9fc910833338674f043481

SHA512
f683c3d3df74efbf6c7c5211c595346e70aab148a8e955c1357ec652b35a968f1e9b85a128e3dbe0a450c392b31b96a4c02bfbb81902ae80575a049aff888379

Download Submit
C:\Windows\System\eBhqsme.exe

Filesize
2.4MB

MD5
3fad89ad543eacd85e17b648852e4d29

SHA1
b24aea25d0bb4552c976579d93945a29a6a61d8a

SHA256
1adbf0a65952a2688ef6356a712056ae0767d0d40322fa4e4d5cf69ae65a91dc

SHA512
33dfe26de66653c81dafc490ccb26d36e615f7838bd40842a9df46138ad400424af7c0d8cc474ffcbe2128017f9a15e39ce79b5c232c0fdcc71864d9a6f960a8

Download Submit
C:\Windows\System\ftELsvM.exe

Filesize
2.4MB

MD5
ade475f5147bc709e47bb4611e5dc110

SHA1
50111eca48ed146e38522f39e31d58c5a8ee8e20

SHA256
af6eab49ec184e1359473160073832a98c3a184d6c3f1f96d83a689af31b09da

SHA512
7f22dce8f535d65db8f401305b5a70ff95418e3389c0a34d774585c149844b6cf83b7a70ca5d28038924bcdcb275762491975a1cca966e65ec90efa5d5146884

Download Submit
C:\Windows\System\lQIdoAa.exe

Filesize
2.4MB

MD5
b5a99e116c6df37ce128a36f9653bab8

SHA1
4ff122e032dca3c7949217822aea7cd67941e5d9

SHA256
27d4d01dbcfbcff955aaf66a6e23cc64a41bc3efc6df8fde4c787ab57dc0d898

SHA512
243fe162857dac13d915cff6c8d00ffe22b911c374ffc84d08c5c995e66ef0e4da088b05d6a5ceeb618b098fe51db9dbaeb6776bd9b6302f9835131906aab7c0

Download Submit
C:\Windows\System\nHJOyrt.exe

Filesize
2.4MB

MD5
6ca359038e23c9b8ff91a6be3728a809

SHA1
ae7add1c76f0e336609ca2eff1340163cb5a9e3c

SHA256
fc7520a815d099ce0e1b3ea36f171bb35b53496bed6a2df21189f6810a01d74d

SHA512
ab48dc28ca56f82927d3cb9c45280a1a69d62ce1e2c1e33661e54a68672dd53d43fffeaa959c263acfe3d83ab6186b5e6fb5c4256c122770d445aea9cb5cabd9

Download Submit
C:\Windows\System\nVCQRYd.exe

Filesize
2.4MB

MD5
9f65cbb6a4bbefe4b6b26e693080ff47

SHA1
b3b56ed09c4779c85bffbe683aa23a3e22597dcc

SHA256
cc516ed3a62574ff881c6c30adeec234a47359fe35a1868ab106ce714ff0ffdb

SHA512
692ab5e4767264e57434129b133e4ab2b9d0936391c9fbfae8668f52f3dfb0ab4ae1b2a63a5417838a79f1bf76938b3f9a0d7a7da42ea3730558fe8814c57777

Download Submit
C:\Windows\System\pNSkLnw.exe

Filesize
2.4MB

MD5
01b2a46b380de4f622fb82a4e3cb1bc5

SHA1
de4bdf9b859db73cc3221d4d43da45fa1e4ef562

SHA256
d0a285e0ddff8a329061ca5ca9883c9e586c4fd777cd770e5a71c8666619d3d5

SHA512
1b5aabddd8cf6f574fef1463be8874c7bc15bdf26b3a663c07cab2ac0d1fc1a82727089fa5b6287aa5e378f4159b6217f19a744c0b1ca984426238f32be033a1

Download Submit
C:\Windows\System\pxdRMDk.exe

Filesize
2.4MB

MD5
4f94ec64429d12ffec2d4c600eed0eda

SHA1
c980de170c754f179dac1d315ed87f29bbe1b4e5

SHA256
65a6a06d8d0edf00ff7b944eeb6543eb42111ec7d7e15f08a1c00a409d017a2b

SHA512
36678cf58b0f6801b528c18db341ede7a451e1ce7f9070681c05ed576b1d559633b6ef45285280c6437b1a36b0c85f7a97435581c6408bfbdc2c3f038af34971

Download Submit
C:\Windows\System\rTWIuZH.exe

Filesize
2.4MB

MD5
c721a36122420b0427f4f45e6a05c786

SHA1
84f594ae00e426a5b644ec4c438b6f4801628f97

SHA256
45ec13c26eadb8d2e512cc4a970e7d772134a1663a3030dca4a052a5688b74b5

SHA512
1aa4f6d5f91258a4bcfb54b556052d4991f67ae712833626ea94910603742b9685f65d28f9f203ca03b15978e5f725d4db89d15d09654f679a9bf97c6de9f4b8

Download Submit
C:\Windows\System\tpbSkPR.exe

Filesize
2.4MB

MD5
c6d0d1b4e6ba982a3ba0f8953469081c

SHA1
4a9e45c1415b8af5e0b2154b4c48e47d11d15354

SHA256
55556a8d338d3825d0b6f7348f2743186329e489bb54e008f5aabeaef31d6037

SHA512
f00191ef08fbd40ebff01cf78d918b148c31b15d7a6d7d0a0d723c35c2dd68d2f69f30295d8075ef4134ad5fce429ed8d053a257d3aa883f0120e98cd1da580b

Download Submit
C:\Windows\System\wrFTfFM.exe

Filesize
2.4MB

MD5
9a8c52d9eaeb4d528009342109e17ace

SHA1
777916c3a3db207805e63f6e17f7dc2ef63381d5

SHA256
fbd4b869a83699d3f15ca29a1f4d07baba7bfea45867466671210c4b7d53d905

SHA512
273ab24019f5d743c6c6ee7560e77a5a64a2e0d378fb96c97f9416f59ab90b4abc0937483c1fad6e7870eee029f209cda3888e11dae63fa5bd7268223d4878be

Download Submit
C:\Windows\System\xjHbARx.exe

Filesize
2.4MB

MD5
6a00b0ae1caa6b08815bb70fc515c9d3

SHA1
ce63c6783b5909196de295e4488c8c392652b868

SHA256
8a7e67e4528cecacae49fa0a31877b7e621adc0903635a0f23fc76f8e3d354c9

SHA512
0bed5ea646af6a0eb7620ea04bc753da681dd3314019f8f3ea4b621917b51b4760ef12d5b7090db87c96be12bf1d3072f83d533aa8abac595bfa4e931bd46e38

Download Submit
C:\Windows\System\xjudbUg.exe

Filesize
2.4MB

MD5
1bc22795e3288d09fde3c78bdc3d6c21

SHA1
e4e0fb547651ea7b3c4547d02a747c8bfb44a35c

SHA256
bcf14c0062173db345103528168cb309a9e4875afdbbb2f6a794c913cb2cf688

SHA512
ed81cbb3beff4e4cf28635f1b2ff17b770c18277b53b16bd36dbcd0421cbefd12a0fc4ae13a91e4be57f91f1b36db4f64d321a7f8d2b79be1ed4edf17b1a244d

Download Submit
C:\Windows\System\yNysvEL.exe

Filesize
2.4MB

MD5
dcf40cd1d08a509da6e002a5ea5e5dea

SHA1
4044cf1ab91bcb14c106f1e49794631589190b05

SHA256
83dda8ede0539b721fed766ec4eed7802d9b0f5e122d965efb38bb413843c1e7

SHA512
40beab5aa73c30ff6cef1eea3f5cc6ce571d80d86b83057f81544dfa90d3e07ed1910ca374758b89fbbb6753523478c44773a5700be37fe26dd472c8c0c81c94

Download Submit
C:\Windows\System\zilIjHU.exe

Filesize
2.4MB

MD5
d1a11d8c68e371f7a280f9f392827268

SHA1
c59244ad8b8faa72e3d39c75b51e49d1241ada79

SHA256
be6cf27a24a01e492a93a0bbb95cf2f08c54df086957282213aeab55d890400a

SHA512
b5e4aa332cf08a3ab6a3fe4c7a36b9f455ec23f72a0291fe8bd60bc363ec6c24dcbc1473f79ee8bde49b0161a25d5c87d85b24001a1917a101a30357914507a3

Download Submit
memory/384-2123-0x00007FF6AE1D0000-0x00007FF6AE5C2000-memory.dmp

Filesize
3.9MB

Download
memory/384-54-0x00007FF6AE1D0000-0x00007FF6AE5C2000-memory.dmp

Filesize
3.9MB

Download
memory/552-30-0x00007FF6B5EA0000-0x00007FF6B6292000-memory.dmp

Filesize
3.9MB

Download
memory/552-2120-0x00007FF6B5EA0000-0x00007FF6B6292000-memory.dmp

Filesize
3.9MB

Download
memory/652-2149-0x00007FF6ADD70000-0x00007FF6AE162000-memory.dmp

Filesize
3.9MB

Download
memory/652-592-0x00007FF6ADD70000-0x00007FF6AE162000-memory.dmp

Filesize
3.9MB

Download
memory/828-617-0x00007FF7B4500000-0x00007FF7B48F2000-memory.dmp

Filesize
3.9MB

Download
memory/828-2137-0x00007FF7B4500000-0x00007FF7B48F2000-memory.dmp

Filesize
3.9MB

Download
memory/972-682-0x00007FF60F5D0000-0x00007FF60F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/972-2146-0x00007FF60F5D0000-0x00007FF60F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/1140-48-0x00007FF7754C0000-0x00007FF7758B2000-memory.dmp

Filesize
3.9MB

Download
memory/1140-2125-0x00007FF7754C0000-0x00007FF7758B2000-memory.dmp

Filesize
3.9MB

Download
memory/1144-622-0x00007FF6B2420000-0x00007FF6B2812000-memory.dmp

Filesize
3.9MB

Download
memory/1144-2151-0x00007FF6B2420000-0x00007FF6B2812000-memory.dmp

Filesize
3.9MB

Download
memory/1256-42-0x00007FF714480000-0x00007FF714872000-memory.dmp

Filesize
3.9MB

Download
memory/1256-2116-0x00007FF714480000-0x00007FF714872000-memory.dmp

Filesize
3.9MB

Download
memory/1408-2099-0x00007FF7E6C10000-0x00007FF7E7002000-memory.dmp

Filesize
3.9MB

Download
memory/1408-2126-0x00007FF7E6C10000-0x00007FF7E7002000-memory.dmp

Filesize
3.9MB

Download
memory/1408-39-0x00007FF7E6C10000-0x00007FF7E7002000-memory.dmp

Filesize
3.9MB

Download
memory/1516-1-0x0000028D6E9B0000-0x0000028D6E9C0000-memory.dmp

Filesize
64KB

Download
memory/1516-0-0x00007FF66A050000-0x00007FF66A442000-memory.dmp

Filesize
3.9MB

Download
memory/1824-2144-0x00007FF7CCBC0000-0x00007FF7CCFB2000-memory.dmp

Filesize
3.9MB

Download
memory/1824-569-0x00007FF7CCBC0000-0x00007FF7CCFB2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-651-0x00007FF7F0CE0000-0x00007FF7F10D2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-2130-0x00007FF7F0CE0000-0x00007FF7F10D2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-2100-0x00007FF7ACA10000-0x00007FF7ACE02000-memory.dmp

Filesize
3.9MB

Download
memory/2456-76-0x00007FF7ACA10000-0x00007FF7ACE02000-memory.dmp

Filesize
3.9MB

Download
memory/2456-2134-0x00007FF7ACA10000-0x00007FF7ACE02000-memory.dmp

Filesize
3.9MB

Download
memory/2852-2129-0x00007FF759B80000-0x00007FF759F72000-memory.dmp

Filesize
3.9MB

Download
memory/2852-667-0x00007FF759B80000-0x00007FF759F72000-memory.dmp

Filesize
3.9MB

Download
memory/3020-2157-0x00007FF663B60000-0x00007FF663F52000-memory.dmp

Filesize
3.9MB

Download
memory/3020-577-0x00007FF663B60000-0x00007FF663F52000-memory.dmp

Filesize
3.9MB

Download
memory/3244-2142-0x00007FF76D9A0000-0x00007FF76DD92000-memory.dmp

Filesize
3.9MB

Download
memory/3244-688-0x00007FF76D9A0000-0x00007FF76DD92000-memory.dmp

Filesize
3.9MB

Download
memory/3420-2148-0x00007FF795B30000-0x00007FF795F22000-memory.dmp

Filesize
3.9MB

Download
memory/3420-605-0x00007FF795B30000-0x00007FF795F22000-memory.dmp

Filesize
3.9MB

Download
memory/3520-2140-0x00007FF722D90000-0x00007FF723182000-memory.dmp

Filesize
3.9MB

Download
memory/3520-642-0x00007FF722D90000-0x00007FF723182000-memory.dmp

Filesize
3.9MB

Download
memory/3556-64-0x0000015878C10000-0x0000015878C32000-memory.dmp

Filesize
136KB

Download
memory/3556-20-0x00007FF881A60000-0x00007FF882521000-memory.dmp

Filesize
10.8MB

Download
memory/3556-23-0x0000015876740000-0x0000015876750000-memory.dmp

Filesize
64KB

Download
memory/3556-21-0x0000015876740000-0x0000015876750000-memory.dmp

Filesize
64KB

Download
memory/3720-2118-0x00007FF6DAB70000-0x00007FF6DAF62000-memory.dmp

Filesize
3.9MB

Download
memory/3720-24-0x00007FF6DAB70000-0x00007FF6DAF62000-memory.dmp

Filesize
3.9MB

Download
memory/4564-2133-0x00007FF671AA0000-0x00007FF671E92000-memory.dmp

Filesize
3.9MB

Download
memory/4564-87-0x00007FF671AA0000-0x00007FF671E92000-memory.dmp

Filesize
3.9MB

Download
memory/4564-2101-0x00007FF671AA0000-0x00007FF671E92000-memory.dmp

Filesize
3.9MB

Download
memory/4968-2153-0x00007FF639700000-0x00007FF639AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4968-587-0x00007FF639700000-0x00007FF639AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-580-0x00007FF7C0AF0000-0x00007FF7C0EE2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-2156-0x00007FF7C0AF0000-0x00007FF7C0EE2000-memory.dmp

Filesize
3.9MB

Download