xmrig | 003c54b4f411792ec32a28c0fda791f6c0b60377847c0e07da3c03254285afc2

Analysis

max time kernel
62s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
Size

1.6MB
MD5

0bb0b26b8f85528ee1a90ff8512fef3c
SHA1

03f9e7ca71bfe6ab140ca0f33e27dcf1cfd471c9
SHA256

003c54b4f411792ec32a28c0fda791f6c0b60377847c0e07da3c03254285afc2
SHA512

e77e6058d84269e0b893201ee2b84b1e8c845e5ac3a6da28b29dcf378fb1f1f04a57dd750063c74ee192a50878287792eb8181f9ba8b647d4bc64bce6e42e290
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82Snn1:NABg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/2800-41-0x00007FF656D70000-0x00007FF657162000-memory.dmp	xmrig
behavioral2/memory/1228-31-0x00007FF6526C0000-0x00007FF652AB2000-memory.dmp	xmrig
behavioral2/memory/644-478-0x00007FF773B60000-0x00007FF773F52000-memory.dmp	xmrig
behavioral2/memory/1460-489-0x00007FF629F60000-0x00007FF62A352000-memory.dmp	xmrig
behavioral2/memory/3228-496-0x00007FF69FAA0000-0x00007FF69FE92000-memory.dmp	xmrig
behavioral2/memory/1804-500-0x00007FF659E90000-0x00007FF65A282000-memory.dmp	xmrig
behavioral2/memory/2264-510-0x00007FF7FF920000-0x00007FF7FFD12000-memory.dmp	xmrig
behavioral2/memory/3724-508-0x00007FF79CD80000-0x00007FF79D172000-memory.dmp	xmrig
behavioral2/memory/3272-505-0x00007FF6430C0000-0x00007FF6434B2000-memory.dmp	xmrig
behavioral2/memory/3540-493-0x00007FF7F3610000-0x00007FF7F3A02000-memory.dmp	xmrig
behavioral2/memory/3548-485-0x00007FF6C14D0000-0x00007FF6C18C2000-memory.dmp	xmrig
behavioral2/memory/4284-483-0x00007FF67D370000-0x00007FF67D762000-memory.dmp	xmrig
behavioral2/memory/4748-469-0x00007FF600F60000-0x00007FF601352000-memory.dmp	xmrig
behavioral2/memory/64-464-0x00007FF6171C0000-0x00007FF6175B2000-memory.dmp	xmrig
behavioral2/memory/4828-460-0x00007FF6B5B40000-0x00007FF6B5F32000-memory.dmp	xmrig
behavioral2/memory/752-2049-0x00007FF67A2B0000-0x00007FF67A6A2000-memory.dmp	xmrig
behavioral2/memory/4620-2050-0x00007FF7AD940000-0x00007FF7ADD32000-memory.dmp	xmrig
behavioral2/memory/2176-2051-0x00007FF62B010000-0x00007FF62B402000-memory.dmp	xmrig
behavioral2/memory/4960-2052-0x00007FF6E0F90000-0x00007FF6E1382000-memory.dmp	xmrig
behavioral2/memory/2124-2053-0x00007FF7F7F00000-0x00007FF7F82F2000-memory.dmp	xmrig
behavioral2/memory/4628-2054-0x00007FF72D1B0000-0x00007FF72D5A2000-memory.dmp	xmrig
behavioral2/memory/1460-2056-0x00007FF629F60000-0x00007FF62A352000-memory.dmp	xmrig
behavioral2/memory/752-2058-0x00007FF67A2B0000-0x00007FF67A6A2000-memory.dmp	xmrig
behavioral2/memory/1228-2060-0x00007FF6526C0000-0x00007FF652AB2000-memory.dmp	xmrig
behavioral2/memory/3540-2068-0x00007FF7F3610000-0x00007FF7F3A02000-memory.dmp	xmrig
behavioral2/memory/1804-2070-0x00007FF659E90000-0x00007FF65A282000-memory.dmp	xmrig
behavioral2/memory/2176-2072-0x00007FF62B010000-0x00007FF62B402000-memory.dmp	xmrig
behavioral2/memory/4620-2067-0x00007FF7AD940000-0x00007FF7ADD32000-memory.dmp	xmrig
behavioral2/memory/3228-2065-0x00007FF69FAA0000-0x00007FF69FE92000-memory.dmp	xmrig
behavioral2/memory/2800-2063-0x00007FF656D70000-0x00007FF657162000-memory.dmp	xmrig
behavioral2/memory/4748-2080-0x00007FF600F60000-0x00007FF601352000-memory.dmp	xmrig
behavioral2/memory/3548-2096-0x00007FF6C14D0000-0x00007FF6C18C2000-memory.dmp	xmrig
behavioral2/memory/3272-2094-0x00007FF6430C0000-0x00007FF6434B2000-memory.dmp	xmrig
behavioral2/memory/4828-2090-0x00007FF6B5B40000-0x00007FF6B5F32000-memory.dmp	xmrig
behavioral2/memory/4628-2088-0x00007FF72D1B0000-0x00007FF72D5A2000-memory.dmp	xmrig
behavioral2/memory/3724-2087-0x00007FF79CD80000-0x00007FF79D172000-memory.dmp	xmrig
behavioral2/memory/2124-2085-0x00007FF7F7F00000-0x00007FF7F82F2000-memory.dmp	xmrig
behavioral2/memory/2264-2092-0x00007FF7FF920000-0x00007FF7FFD12000-memory.dmp	xmrig
behavioral2/memory/64-2076-0x00007FF6171C0000-0x00007FF6175B2000-memory.dmp	xmrig
behavioral2/memory/4960-2075-0x00007FF6E0F90000-0x00007FF6E1382000-memory.dmp	xmrig
behavioral2/memory/644-2083-0x00007FF773B60000-0x00007FF773F52000-memory.dmp	xmrig
behavioral2/memory/4284-2079-0x00007FF67D370000-0x00007FF67D762000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
752	wwMCjZz.exe
1460	eIQqtjR.exe
1228	ChZGnlm.exe
2800	USQqKaJ.exe
3540	AwjViRG.exe
4620	YBsLsyh.exe
3228	NpAFSkG.exe
1804	ilhHDsI.exe
2176	egmOzWZ.exe
4960	pbjfonq.exe
3272	iqEKPuL.exe
4628	HGrDBVS.exe
2124	PuKWMRH.exe
4828	vFLEsSn.exe
3724	MqlmPOd.exe
2264	iUwiczB.exe
64	NArAFRu.exe
4748	dHabjHv.exe
644	VTwPLTS.exe
4284	HvXrmgC.exe
3548	PWtVfhY.exe
3364	pYTsjIl.exe
4056	TQpdCXl.exe
2096	vjXEkBF.exe
4840	IMeTWTT.exe
3184	FbryYZX.exe
3296	vqznsbb.exe
4272	GmPUskD.exe
4528	nOyqsqC.exe
3608	QuATbNR.exe
4428	jiCRgmQ.exe
2956	tTWyicR.exe
396	MmWjKKh.exe
2184	AXjgJwY.exe
2656	PasHWbN.exe
1800	LOQxWOs.exe
2344	mlrYner.exe
1888	TkRpqle.exe
1048	WpQtVmv.exe
4340	XbXaAzd.exe
4352	cnVLkTF.exe
3116	dDMadLP.exe
2044	pYDLeXZ.exe
4588	EoJOvaO.exe
2948	UvWriEb.exe
2208	yRaGClo.exe
1328	JcItDqr.exe
3520	KoTemaG.exe
3580	LwnEtTg.exe
532	eJqNSBc.exe
3524	cbHyRuc.exe
4104	MPpXtHi.exe
3668	FwikIek.exe
4596	fRZBsJe.exe
3088	NpOJKKU.exe
408	RbxQPUE.exe
3500	sMrGSsD.exe
4436	IXpwsAP.exe
1584	EcSPXzs.exe
4576	ZtvxpOH.exe
4612	rsmDRlM.exe
2408	UxLtKHo.exe
1588	WePrWDh.exe
1148	kNaGMaH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1056-0-0x00007FF7AD0F0000-0x00007FF7AD4E2000-memory.dmp	upx
behavioral2/files/0x000b000000023ba6-5.dat	upx
behavioral2/files/0x000a000000023ba8-9.dat	upx
behavioral2/files/0x000a000000023ba7-11.dat	upx
behavioral2/files/0x000a000000023bab-32.dat	upx
behavioral2/files/0x000a000000023bad-46.dat	upx
behavioral2/memory/2800-41-0x00007FF656D70000-0x00007FF657162000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-35.dat	upx
behavioral2/files/0x000a000000023bac-37.dat	upx
behavioral2/memory/1228-31-0x00007FF6526C0000-0x00007FF652AB2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-21.dat	upx
behavioral2/memory/4620-62-0x00007FF7AD940000-0x00007FF7ADD32000-memory.dmp	upx
behavioral2/memory/2176-82-0x00007FF62B010000-0x00007FF62B402000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-89.dat	upx
behavioral2/files/0x0032000000023bb5-95.dat	upx
behavioral2/files/0x000a000000023bb8-117.dat	upx
behavioral2/files/0x000a000000023bba-127.dat	upx
behavioral2/files/0x000a000000023bbe-147.dat	upx
behavioral2/files/0x000a000000023bc1-162.dat	upx
behavioral2/memory/2124-452-0x00007FF7F7F00000-0x00007FF7F82F2000-memory.dmp	upx
behavioral2/memory/644-478-0x00007FF773B60000-0x00007FF773F52000-memory.dmp	upx
behavioral2/memory/1460-489-0x00007FF629F60000-0x00007FF62A352000-memory.dmp	upx
behavioral2/memory/3228-496-0x00007FF69FAA0000-0x00007FF69FE92000-memory.dmp	upx
behavioral2/memory/1804-500-0x00007FF659E90000-0x00007FF65A282000-memory.dmp	upx
behavioral2/memory/2264-510-0x00007FF7FF920000-0x00007FF7FFD12000-memory.dmp	upx
behavioral2/memory/3724-508-0x00007FF79CD80000-0x00007FF79D172000-memory.dmp	upx
behavioral2/memory/3272-505-0x00007FF6430C0000-0x00007FF6434B2000-memory.dmp	upx
behavioral2/memory/3540-493-0x00007FF7F3610000-0x00007FF7F3A02000-memory.dmp	upx
behavioral2/memory/3548-485-0x00007FF6C14D0000-0x00007FF6C18C2000-memory.dmp	upx
behavioral2/memory/4284-483-0x00007FF67D370000-0x00007FF67D762000-memory.dmp	upx
behavioral2/memory/4748-469-0x00007FF600F60000-0x00007FF601352000-memory.dmp	upx
behavioral2/memory/64-464-0x00007FF6171C0000-0x00007FF6175B2000-memory.dmp	upx
behavioral2/memory/4828-460-0x00007FF6B5B40000-0x00007FF6B5F32000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-182.dat	upx
behavioral2/files/0x000a000000023bc3-180.dat	upx
behavioral2/files/0x000a000000023bc4-177.dat	upx
behavioral2/files/0x000a000000023bc2-175.dat	upx
behavioral2/files/0x000a000000023bc0-165.dat	upx
behavioral2/files/0x000a000000023bbf-160.dat	upx
behavioral2/files/0x000a000000023bbd-150.dat	upx
behavioral2/files/0x000a000000023bbc-145.dat	upx
behavioral2/files/0x000a000000023bbb-140.dat	upx
behavioral2/files/0x000a000000023bb9-130.dat	upx
behavioral2/files/0x000b000000023bb4-120.dat	upx
behavioral2/files/0x000b000000023ba4-115.dat	upx
behavioral2/files/0x0031000000023bb7-110.dat	upx
behavioral2/files/0x000a000000023bb2-100.dat	upx
behavioral2/files/0x0031000000023bb6-98.dat	upx
behavioral2/memory/4628-94-0x00007FF72D1B0000-0x00007FF72D5A2000-memory.dmp	upx
behavioral2/memory/4960-88-0x00007FF6E0F90000-0x00007FF6E1382000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-87.dat	upx
behavioral2/files/0x000a000000023bb0-84.dat	upx
behavioral2/files/0x000a000000023bae-77.dat	upx
behavioral2/files/0x000a000000023baf-80.dat	upx
behavioral2/memory/752-7-0x00007FF67A2B0000-0x00007FF67A6A2000-memory.dmp	upx
behavioral2/memory/752-2049-0x00007FF67A2B0000-0x00007FF67A6A2000-memory.dmp	upx
behavioral2/memory/4620-2050-0x00007FF7AD940000-0x00007FF7ADD32000-memory.dmp	upx
behavioral2/memory/2176-2051-0x00007FF62B010000-0x00007FF62B402000-memory.dmp	upx
behavioral2/memory/4960-2052-0x00007FF6E0F90000-0x00007FF6E1382000-memory.dmp	upx
behavioral2/memory/2124-2053-0x00007FF7F7F00000-0x00007FF7F82F2000-memory.dmp	upx
behavioral2/memory/4628-2054-0x00007FF72D1B0000-0x00007FF72D5A2000-memory.dmp	upx
behavioral2/memory/1460-2056-0x00007FF629F60000-0x00007FF62A352000-memory.dmp	upx
behavioral2/memory/752-2058-0x00007FF67A2B0000-0x00007FF67A6A2000-memory.dmp	upx
behavioral2/memory/1228-2060-0x00007FF6526C0000-0x00007FF652AB2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\Ytqpglq.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\wYVdHad.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\tyuLRUz.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\ftEmzyA.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\ScOFqCb.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\wHNIApY.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\sUsbPvO.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\mACfrQl.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\HZzWGZn.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\wGVzQoy.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\EqoHvyD.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\MCIpzPK.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\kFPCDJt.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\SPtCIqe.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\glzeHFy.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\NArAFRu.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\tIjItpr.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\NEqRcdf.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\kBjhUEX.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\KAmHQrv.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\IgwoAlu.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\dOtnwfJ.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\jxWZRNx.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\HMZJBYn.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\MDNdpOf.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\HGrDBVS.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\KyCbskF.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\oEsfzbj.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\oLWxsFO.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\jyaxhbG.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\WEWymYm.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\yUIVKvd.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\SDxkRfx.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\AUAdTlB.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\LojWiFt.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\zXsbGAh.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\EoJOvaO.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\UijjikB.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\Rjqkqnz.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\vmwrEST.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\UvWriEb.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\IJrCoqd.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\KqByCYY.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\snZYWaA.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\kFDnvcG.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\oWlpEGe.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\wdriqHs.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\kOpOgzG.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\VpJmJwH.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\GzpjrZQ.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\OpJxzsh.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\CFpIxNJ.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\TjEYCzD.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\EcSPXzs.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\xJAXxBI.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\iajwvbv.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\sZvVCvb.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\rUWaPis.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\NLRLrTT.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\Wueuipt.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\aPWTuTF.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\jpuXyGc.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\hDZMGwG.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\tQwljRt.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1176	powershell.exe
1176	powershell.exe
1176	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
Token: SeDebugPrivilege	1176	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1176	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	86
PID 1056 wrote to memory of 1176	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	86
PID 1056 wrote to memory of 752	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	87
PID 1056 wrote to memory of 752	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	87
PID 1056 wrote to memory of 1460	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	88
PID 1056 wrote to memory of 1460	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	88
PID 1056 wrote to memory of 1228	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	89
PID 1056 wrote to memory of 1228	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	89
PID 1056 wrote to memory of 2800	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	90
PID 1056 wrote to memory of 2800	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	90
PID 1056 wrote to memory of 3540	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	91
PID 1056 wrote to memory of 3540	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	91
PID 1056 wrote to memory of 4620	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	92
PID 1056 wrote to memory of 4620	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	92
PID 1056 wrote to memory of 3228	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	93
PID 1056 wrote to memory of 3228	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	93
PID 1056 wrote to memory of 1804	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	94
PID 1056 wrote to memory of 1804	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	94
PID 1056 wrote to memory of 2176	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	95
PID 1056 wrote to memory of 2176	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	95
PID 1056 wrote to memory of 4960	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	96
PID 1056 wrote to memory of 4960	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	96
PID 1056 wrote to memory of 3272	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	97
PID 1056 wrote to memory of 3272	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	97
PID 1056 wrote to memory of 4628	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	98
PID 1056 wrote to memory of 4628	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	98
PID 1056 wrote to memory of 2124	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	99
PID 1056 wrote to memory of 2124	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	99
PID 1056 wrote to memory of 4828	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	100
PID 1056 wrote to memory of 4828	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	100
PID 1056 wrote to memory of 3724	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	101
PID 1056 wrote to memory of 3724	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	101
PID 1056 wrote to memory of 2264	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	102
PID 1056 wrote to memory of 2264	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	102
PID 1056 wrote to memory of 64	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	103
PID 1056 wrote to memory of 64	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	103
PID 1056 wrote to memory of 4748	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	104
PID 1056 wrote to memory of 4748	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	104
PID 1056 wrote to memory of 644	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	105
PID 1056 wrote to memory of 644	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	105
PID 1056 wrote to memory of 4284	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	106
PID 1056 wrote to memory of 4284	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	106
PID 1056 wrote to memory of 3548	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	107
PID 1056 wrote to memory of 3548	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	107
PID 1056 wrote to memory of 3364	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	108
PID 1056 wrote to memory of 3364	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	108
PID 1056 wrote to memory of 4056	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	109
PID 1056 wrote to memory of 4056	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	109
PID 1056 wrote to memory of 2096	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	110
PID 1056 wrote to memory of 2096	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	110
PID 1056 wrote to memory of 4840	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	111
PID 1056 wrote to memory of 4840	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	111
PID 1056 wrote to memory of 3184	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	112
PID 1056 wrote to memory of 3184	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	112
PID 1056 wrote to memory of 3296	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	113
PID 1056 wrote to memory of 3296	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	113
PID 1056 wrote to memory of 4272	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	114
PID 1056 wrote to memory of 4272	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	114
PID 1056 wrote to memory of 4528	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	115
PID 1056 wrote to memory of 4528	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	115
PID 1056 wrote to memory of 3608	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	116
PID 1056 wrote to memory of 3608	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	116
PID 1056 wrote to memory of 4428	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	117
PID 1056 wrote to memory of 4428	1056	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1176
- C:\Windows\System\wwMCjZz.exe
  C:\Windows\System\wwMCjZz.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\eIQqtjR.exe
  C:\Windows\System\eIQqtjR.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\ChZGnlm.exe
  C:\Windows\System\ChZGnlm.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\USQqKaJ.exe
  C:\Windows\System\USQqKaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\AwjViRG.exe
  C:\Windows\System\AwjViRG.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\YBsLsyh.exe
  C:\Windows\System\YBsLsyh.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\NpAFSkG.exe
  C:\Windows\System\NpAFSkG.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\ilhHDsI.exe
  C:\Windows\System\ilhHDsI.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\egmOzWZ.exe
  C:\Windows\System\egmOzWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\pbjfonq.exe
  C:\Windows\System\pbjfonq.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\iqEKPuL.exe
  C:\Windows\System\iqEKPuL.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\HGrDBVS.exe
  C:\Windows\System\HGrDBVS.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\PuKWMRH.exe
  C:\Windows\System\PuKWMRH.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\vFLEsSn.exe
  C:\Windows\System\vFLEsSn.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\MqlmPOd.exe
  C:\Windows\System\MqlmPOd.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\iUwiczB.exe
  C:\Windows\System\iUwiczB.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\NArAFRu.exe
  C:\Windows\System\NArAFRu.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\dHabjHv.exe
  C:\Windows\System\dHabjHv.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\VTwPLTS.exe
  C:\Windows\System\VTwPLTS.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\HvXrmgC.exe
  C:\Windows\System\HvXrmgC.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\PWtVfhY.exe
  C:\Windows\System\PWtVfhY.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\pYTsjIl.exe
  C:\Windows\System\pYTsjIl.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\TQpdCXl.exe
  C:\Windows\System\TQpdCXl.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\vjXEkBF.exe
  C:\Windows\System\vjXEkBF.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\IMeTWTT.exe
  C:\Windows\System\IMeTWTT.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\FbryYZX.exe
  C:\Windows\System\FbryYZX.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\vqznsbb.exe
  C:\Windows\System\vqznsbb.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\GmPUskD.exe
  C:\Windows\System\GmPUskD.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\nOyqsqC.exe
  C:\Windows\System\nOyqsqC.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\QuATbNR.exe
  C:\Windows\System\QuATbNR.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\jiCRgmQ.exe
  C:\Windows\System\jiCRgmQ.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\tTWyicR.exe
  C:\Windows\System\tTWyicR.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\MmWjKKh.exe
  C:\Windows\System\MmWjKKh.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\AXjgJwY.exe
  C:\Windows\System\AXjgJwY.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\PasHWbN.exe
  C:\Windows\System\PasHWbN.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\LOQxWOs.exe
  C:\Windows\System\LOQxWOs.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\mlrYner.exe
  C:\Windows\System\mlrYner.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\TkRpqle.exe
  C:\Windows\System\TkRpqle.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\WpQtVmv.exe
  C:\Windows\System\WpQtVmv.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\XbXaAzd.exe
  C:\Windows\System\XbXaAzd.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\cnVLkTF.exe
  C:\Windows\System\cnVLkTF.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\dDMadLP.exe
  C:\Windows\System\dDMadLP.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\pYDLeXZ.exe
  C:\Windows\System\pYDLeXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\EoJOvaO.exe
  C:\Windows\System\EoJOvaO.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\UvWriEb.exe
  C:\Windows\System\UvWriEb.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\yRaGClo.exe
  C:\Windows\System\yRaGClo.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\JcItDqr.exe
  C:\Windows\System\JcItDqr.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\KoTemaG.exe
  C:\Windows\System\KoTemaG.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\LwnEtTg.exe
  C:\Windows\System\LwnEtTg.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\eJqNSBc.exe
  C:\Windows\System\eJqNSBc.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\cbHyRuc.exe
  C:\Windows\System\cbHyRuc.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\MPpXtHi.exe
  C:\Windows\System\MPpXtHi.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\FwikIek.exe
  C:\Windows\System\FwikIek.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\fRZBsJe.exe
  C:\Windows\System\fRZBsJe.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\NpOJKKU.exe
  C:\Windows\System\NpOJKKU.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\RbxQPUE.exe
  C:\Windows\System\RbxQPUE.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\sMrGSsD.exe
  C:\Windows\System\sMrGSsD.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\IXpwsAP.exe
  C:\Windows\System\IXpwsAP.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\EcSPXzs.exe
  C:\Windows\System\EcSPXzs.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\ZtvxpOH.exe
  C:\Windows\System\ZtvxpOH.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\rsmDRlM.exe
  C:\Windows\System\rsmDRlM.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\UxLtKHo.exe
  C:\Windows\System\UxLtKHo.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\WePrWDh.exe
  C:\Windows\System\WePrWDh.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\kNaGMaH.exe
  C:\Windows\System\kNaGMaH.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\YJQYGOQ.exe
  C:\Windows\System\YJQYGOQ.exe
  2⤵
  PID:2692
- C:\Windows\System\UTvXLzA.exe
  C:\Windows\System\UTvXLzA.exe
  2⤵
  PID:4456
- C:\Windows\System\UijjikB.exe
  C:\Windows\System\UijjikB.exe
  2⤵
  PID:1728
- C:\Windows\System\uAfxXCd.exe
  C:\Windows\System\uAfxXCd.exe
  2⤵
  PID:5148
- C:\Windows\System\ZpygFgz.exe
  C:\Windows\System\ZpygFgz.exe
  2⤵
  PID:5172
- C:\Windows\System\MdBLhEx.exe
  C:\Windows\System\MdBLhEx.exe
  2⤵
  PID:5204
- C:\Windows\System\LwDQsOD.exe
  C:\Windows\System\LwDQsOD.exe
  2⤵
  PID:5232
- C:\Windows\System\LHMiMaG.exe
  C:\Windows\System\LHMiMaG.exe
  2⤵
  PID:5260
- C:\Windows\System\kYdZcxT.exe
  C:\Windows\System\kYdZcxT.exe
  2⤵
  PID:5288
- C:\Windows\System\IgwoAlu.exe
  C:\Windows\System\IgwoAlu.exe
  2⤵
  PID:5320
- C:\Windows\System\wVZWiNA.exe
  C:\Windows\System\wVZWiNA.exe
  2⤵
  PID:5344
- C:\Windows\System\gCLTaHh.exe
  C:\Windows\System\gCLTaHh.exe
  2⤵
  PID:5372
- C:\Windows\System\TAzeZcY.exe
  C:\Windows\System\TAzeZcY.exe
  2⤵
  PID:5400
- C:\Windows\System\gfzYjlL.exe
  C:\Windows\System\gfzYjlL.exe
  2⤵
  PID:5428
- C:\Windows\System\CtmFKYK.exe
  C:\Windows\System\CtmFKYK.exe
  2⤵
  PID:5456
- C:\Windows\System\MCIpzPK.exe
  C:\Windows\System\MCIpzPK.exe
  2⤵
  PID:5484
- C:\Windows\System\vjQuOuF.exe
  C:\Windows\System\vjQuOuF.exe
  2⤵
  PID:5516
- C:\Windows\System\RzjjkDE.exe
  C:\Windows\System\RzjjkDE.exe
  2⤵
  PID:5540
- C:\Windows\System\wYVdHad.exe
  C:\Windows\System\wYVdHad.exe
  2⤵
  PID:5568
- C:\Windows\System\hSRxQIB.exe
  C:\Windows\System\hSRxQIB.exe
  2⤵
  PID:5596
- C:\Windows\System\BbxOUuG.exe
  C:\Windows\System\BbxOUuG.exe
  2⤵
  PID:5624
- C:\Windows\System\fuCQvzi.exe
  C:\Windows\System\fuCQvzi.exe
  2⤵
  PID:5652
- C:\Windows\System\IJrCoqd.exe
  C:\Windows\System\IJrCoqd.exe
  2⤵
  PID:5680
- C:\Windows\System\OGQGbJN.exe
  C:\Windows\System\OGQGbJN.exe
  2⤵
  PID:5708
- C:\Windows\System\MzwcWrk.exe
  C:\Windows\System\MzwcWrk.exe
  2⤵
  PID:5736
- C:\Windows\System\vWDuQwi.exe
  C:\Windows\System\vWDuQwi.exe
  2⤵
  PID:5764
- C:\Windows\System\MHyjvbX.exe
  C:\Windows\System\MHyjvbX.exe
  2⤵
  PID:5788
- C:\Windows\System\yCpWcIF.exe
  C:\Windows\System\yCpWcIF.exe
  2⤵
  PID:5820
- C:\Windows\System\JgRtBYl.exe
  C:\Windows\System\JgRtBYl.exe
  2⤵
  PID:5848
- C:\Windows\System\bHGSVCM.exe
  C:\Windows\System\bHGSVCM.exe
  2⤵
  PID:5876
- C:\Windows\System\bzsoNMq.exe
  C:\Windows\System\bzsoNMq.exe
  2⤵
  PID:5904
- C:\Windows\System\UlOMymQ.exe
  C:\Windows\System\UlOMymQ.exe
  2⤵
  PID:5932
- C:\Windows\System\eSKcbeD.exe
  C:\Windows\System\eSKcbeD.exe
  2⤵
  PID:5956
- C:\Windows\System\haINDVy.exe
  C:\Windows\System\haINDVy.exe
  2⤵
  PID:5988
- C:\Windows\System\knaURiK.exe
  C:\Windows\System\knaURiK.exe
  2⤵
  PID:6016
- C:\Windows\System\CLvbNCu.exe
  C:\Windows\System\CLvbNCu.exe
  2⤵
  PID:6044
- C:\Windows\System\wMNdoss.exe
  C:\Windows\System\wMNdoss.exe
  2⤵
  PID:6072
- C:\Windows\System\BzuwavT.exe
  C:\Windows\System\BzuwavT.exe
  2⤵
  PID:6100
- C:\Windows\System\MHRNsVr.exe
  C:\Windows\System\MHRNsVr.exe
  2⤵
  PID:6128
- C:\Windows\System\aRDBotF.exe
  C:\Windows\System\aRDBotF.exe
  2⤵
  PID:4704
- C:\Windows\System\Rjqkqnz.exe
  C:\Windows\System\Rjqkqnz.exe
  2⤵
  PID:3552
- C:\Windows\System\NudUvzi.exe
  C:\Windows\System\NudUvzi.exe
  2⤵
  PID:3672
- C:\Windows\System\LFahndm.exe
  C:\Windows\System\LFahndm.exe
  2⤵
  PID:2328
- C:\Windows\System\BJLPkag.exe
  C:\Windows\System\BJLPkag.exe
  2⤵
  PID:3764
- C:\Windows\System\rQpfzbu.exe
  C:\Windows\System\rQpfzbu.exe
  2⤵
  PID:5168
- C:\Windows\System\rcAgmuX.exe
  C:\Windows\System\rcAgmuX.exe
  2⤵
  PID:2204
- C:\Windows\System\dOtnwfJ.exe
  C:\Windows\System\dOtnwfJ.exe
  2⤵
  PID:5300
- C:\Windows\System\NkmUGUw.exe
  C:\Windows\System\NkmUGUw.exe
  2⤵
  PID:5356
- C:\Windows\System\iSgJdII.exe
  C:\Windows\System\iSgJdII.exe
  2⤵
  PID:5392
- C:\Windows\System\AcEdDKc.exe
  C:\Windows\System\AcEdDKc.exe
  2⤵
  PID:5468
- C:\Windows\System\SDxkRfx.exe
  C:\Windows\System\SDxkRfx.exe
  2⤵
  PID:5524
- C:\Windows\System\cwHsBub.exe
  C:\Windows\System\cwHsBub.exe
  2⤵
  PID:5584
- C:\Windows\System\saRrWay.exe
  C:\Windows\System\saRrWay.exe
  2⤵
  PID:5640
- C:\Windows\System\qSIljXB.exe
  C:\Windows\System\qSIljXB.exe
  2⤵
  PID:5696
- C:\Windows\System\dExjIrj.exe
  C:\Windows\System\dExjIrj.exe
  2⤵
  PID:5752
- C:\Windows\System\HZzWGZn.exe
  C:\Windows\System\HZzWGZn.exe
  2⤵
  PID:5812
- C:\Windows\System\BvfkeyQ.exe
  C:\Windows\System\BvfkeyQ.exe
  2⤵
  PID:4080
- C:\Windows\System\HEwCSpd.exe
  C:\Windows\System\HEwCSpd.exe
  2⤵
  PID:5892
- C:\Windows\System\SDsZnaI.exe
  C:\Windows\System\SDsZnaI.exe
  2⤵
  PID:5948
- C:\Windows\System\ZmwAljc.exe
  C:\Windows\System\ZmwAljc.exe
  2⤵
  PID:6000
- C:\Windows\System\fuDvpkG.exe
  C:\Windows\System\fuDvpkG.exe
  2⤵
  PID:6084
- C:\Windows\System\bfblpFm.exe
  C:\Windows\System\bfblpFm.exe
  2⤵
  PID:6120
- C:\Windows\System\YWRdulF.exe
  C:\Windows\System\YWRdulF.exe
  2⤵
  PID:2436
- C:\Windows\System\pAKuarh.exe
  C:\Windows\System\pAKuarh.exe
  2⤵
  PID:964
- C:\Windows\System\onkzqdX.exe
  C:\Windows\System\onkzqdX.exe
  2⤵
  PID:2484
- C:\Windows\System\jxWZRNx.exe
  C:\Windows\System\jxWZRNx.exe
  2⤵
  PID:4460
- C:\Windows\System\wjOAtzU.exe
  C:\Windows\System\wjOAtzU.exe
  2⤵
  PID:2368
- C:\Windows\System\DbPxZaD.exe
  C:\Windows\System\DbPxZaD.exe
  2⤵
  PID:1604
- C:\Windows\System\vlQicsc.exe
  C:\Windows\System\vlQicsc.exe
  2⤵
  PID:5552
- C:\Windows\System\biXRJOr.exe
  C:\Windows\System\biXRJOr.exe
  2⤵
  PID:5664
- C:\Windows\System\EHzNYTP.exe
  C:\Windows\System\EHzNYTP.exe
  2⤵
  PID:2020
- C:\Windows\System\llhhAcU.exe
  C:\Windows\System\llhhAcU.exe
  2⤵
  PID:5872
- C:\Windows\System\xdRDCvI.exe
  C:\Windows\System\xdRDCvI.exe
  2⤵
  PID:2788
- C:\Windows\System\NJjEEsa.exe
  C:\Windows\System\NJjEEsa.exe
  2⤵
  PID:2792
- C:\Windows\System\PUUCFCB.exe
  C:\Windows\System\PUUCFCB.exe
  2⤵
  PID:680
- C:\Windows\System\pMzKIkm.exe
  C:\Windows\System\pMzKIkm.exe
  2⤵
  PID:2320
- C:\Windows\System\kFPCDJt.exe
  C:\Windows\System\kFPCDJt.exe
  2⤵
  PID:4500
- C:\Windows\System\omvfbPV.exe
  C:\Windows\System\omvfbPV.exe
  2⤵
  PID:5612
- C:\Windows\System\fajGqtW.exe
  C:\Windows\System\fajGqtW.exe
  2⤵
  PID:4048
- C:\Windows\System\wjKFxNE.exe
  C:\Windows\System\wjKFxNE.exe
  2⤵
  PID:6116
- C:\Windows\System\hHSWkzO.exe
  C:\Windows\System\hHSWkzO.exe
  2⤵
  PID:2296
- C:\Windows\System\bjfwZYX.exe
  C:\Windows\System\bjfwZYX.exe
  2⤵
  PID:6008
- C:\Windows\System\kcEXfvt.exe
  C:\Windows\System\kcEXfvt.exe
  2⤵
  PID:5748
- C:\Windows\System\KVMsDWf.exe
  C:\Windows\System\KVMsDWf.exe
  2⤵
  PID:4832
- C:\Windows\System\ufnWkBE.exe
  C:\Windows\System\ufnWkBE.exe
  2⤵
  PID:5608
- C:\Windows\System\QFwHxlm.exe
  C:\Windows\System\QFwHxlm.exe
  2⤵
  PID:5920
- C:\Windows\System\JQtEbVj.exe
  C:\Windows\System\JQtEbVj.exe
  2⤵
  PID:2064
- C:\Windows\System\esPIPXZ.exe
  C:\Windows\System\esPIPXZ.exe
  2⤵
  PID:4808
- C:\Windows\System\NLRLrTT.exe
  C:\Windows\System\NLRLrTT.exe
  2⤵
  PID:2600
- C:\Windows\System\QZtzkft.exe
  C:\Windows\System\QZtzkft.exe
  2⤵
  PID:5440
- C:\Windows\System\nDXXGAf.exe
  C:\Windows\System\nDXXGAf.exe
  2⤵
  PID:6160
- C:\Windows\System\SDvehLx.exe
  C:\Windows\System\SDvehLx.exe
  2⤵
  PID:6188
- C:\Windows\System\NGrgJsd.exe
  C:\Windows\System\NGrgJsd.exe
  2⤵
  PID:6212
- C:\Windows\System\OmsChyx.exe
  C:\Windows\System\OmsChyx.exe
  2⤵
  PID:6228
- C:\Windows\System\uaymTOY.exe
  C:\Windows\System\uaymTOY.exe
  2⤵
  PID:6248
- C:\Windows\System\JmuiqyP.exe
  C:\Windows\System\JmuiqyP.exe
  2⤵
  PID:6276
- C:\Windows\System\PKbumVw.exe
  C:\Windows\System\PKbumVw.exe
  2⤵
  PID:6304
- C:\Windows\System\CMwKJbo.exe
  C:\Windows\System\CMwKJbo.exe
  2⤵
  PID:6324
- C:\Windows\System\yvbeIqs.exe
  C:\Windows\System\yvbeIqs.exe
  2⤵
  PID:6348
- C:\Windows\System\pVDzLOJ.exe
  C:\Windows\System\pVDzLOJ.exe
  2⤵
  PID:6376
- C:\Windows\System\TerZMnl.exe
  C:\Windows\System\TerZMnl.exe
  2⤵
  PID:6400
- C:\Windows\System\CXwNBIb.exe
  C:\Windows\System\CXwNBIb.exe
  2⤵
  PID:6420
- C:\Windows\System\pAzLAvb.exe
  C:\Windows\System\pAzLAvb.exe
  2⤵
  PID:6460
- C:\Windows\System\jyaxhbG.exe
  C:\Windows\System\jyaxhbG.exe
  2⤵
  PID:6488
- C:\Windows\System\qIYKdvT.exe
  C:\Windows\System\qIYKdvT.exe
  2⤵
  PID:6540
- C:\Windows\System\fQcTtBn.exe
  C:\Windows\System\fQcTtBn.exe
  2⤵
  PID:6560
- C:\Windows\System\LJMPMEH.exe
  C:\Windows\System\LJMPMEH.exe
  2⤵
  PID:6596
- C:\Windows\System\VPmjrNp.exe
  C:\Windows\System\VPmjrNp.exe
  2⤵
  PID:6616
- C:\Windows\System\TJqgcsm.exe
  C:\Windows\System\TJqgcsm.exe
  2⤵
  PID:6636
- C:\Windows\System\vrzUvll.exe
  C:\Windows\System\vrzUvll.exe
  2⤵
  PID:6660
- C:\Windows\System\kFDnvcG.exe
  C:\Windows\System\kFDnvcG.exe
  2⤵
  PID:6708
- C:\Windows\System\taEWmEG.exe
  C:\Windows\System\taEWmEG.exe
  2⤵
  PID:6724
- C:\Windows\System\iFSgbIL.exe
  C:\Windows\System\iFSgbIL.exe
  2⤵
  PID:6772
- C:\Windows\System\wbtWkDN.exe
  C:\Windows\System\wbtWkDN.exe
  2⤵
  PID:6792
- C:\Windows\System\tyuLRUz.exe
  C:\Windows\System\tyuLRUz.exe
  2⤵
  PID:6808
- C:\Windows\System\TOWeDcm.exe
  C:\Windows\System\TOWeDcm.exe
  2⤵
  PID:6832
- C:\Windows\System\pMvBRXo.exe
  C:\Windows\System\pMvBRXo.exe
  2⤵
  PID:6852
- C:\Windows\System\tYnXDBC.exe
  C:\Windows\System\tYnXDBC.exe
  2⤵
  PID:6872
- C:\Windows\System\uDaOgfx.exe
  C:\Windows\System\uDaOgfx.exe
  2⤵
  PID:6892
- C:\Windows\System\ynvcRXe.exe
  C:\Windows\System\ynvcRXe.exe
  2⤵
  PID:6912
- C:\Windows\System\IArcRrf.exe
  C:\Windows\System\IArcRrf.exe
  2⤵
  PID:6956
- C:\Windows\System\dAaBkjh.exe
  C:\Windows\System\dAaBkjh.exe
  2⤵
  PID:7008
- C:\Windows\System\CFRzAlU.exe
  C:\Windows\System\CFRzAlU.exe
  2⤵
  PID:7024
- C:\Windows\System\gjAZXQT.exe
  C:\Windows\System\gjAZXQT.exe
  2⤵
  PID:7052
- C:\Windows\System\urmeZEA.exe
  C:\Windows\System\urmeZEA.exe
  2⤵
  PID:7088
- C:\Windows\System\KysKmff.exe
  C:\Windows\System\KysKmff.exe
  2⤵
  PID:7116
- C:\Windows\System\pTAenTD.exe
  C:\Windows\System\pTAenTD.exe
  2⤵
  PID:7152
- C:\Windows\System\aKliAxN.exe
  C:\Windows\System\aKliAxN.exe
  2⤵
  PID:4956
- C:\Windows\System\fztpEgZ.exe
  C:\Windows\System\fztpEgZ.exe
  2⤵
  PID:6208
- C:\Windows\System\nfyGjcR.exe
  C:\Windows\System\nfyGjcR.exe
  2⤵
  PID:6224
- C:\Windows\System\ezdFkIB.exe
  C:\Windows\System\ezdFkIB.exe
  2⤵
  PID:6372
- C:\Windows\System\YArlCRs.exe
  C:\Windows\System\YArlCRs.exe
  2⤵
  PID:6388
- C:\Windows\System\sJlJSei.exe
  C:\Windows\System\sJlJSei.exe
  2⤵
  PID:6448
- C:\Windows\System\ScOFqCb.exe
  C:\Windows\System\ScOFqCb.exe
  2⤵
  PID:6624
- C:\Windows\System\GojUpbC.exe
  C:\Windows\System\GojUpbC.exe
  2⤵
  PID:6628
- C:\Windows\System\YtCsMjr.exe
  C:\Windows\System\YtCsMjr.exe
  2⤵
  PID:6648
- C:\Windows\System\SvBWacQ.exe
  C:\Windows\System\SvBWacQ.exe
  2⤵
  PID:6748
- C:\Windows\System\LsyNUxa.exe
  C:\Windows\System\LsyNUxa.exe
  2⤵
  PID:6780
- C:\Windows\System\wRdyjne.exe
  C:\Windows\System\wRdyjne.exe
  2⤵
  PID:6900
- C:\Windows\System\tTETTxi.exe
  C:\Windows\System\tTETTxi.exe
  2⤵
  PID:7048
- C:\Windows\System\HMijoGv.exe
  C:\Windows\System\HMijoGv.exe
  2⤵
  PID:7020
- C:\Windows\System\TnMNJBX.exe
  C:\Windows\System\TnMNJBX.exe
  2⤵
  PID:7132
- C:\Windows\System\kbFVbFU.exe
  C:\Windows\System\kbFVbFU.exe
  2⤵
  PID:7160
- C:\Windows\System\xrzFLbq.exe
  C:\Windows\System\xrzFLbq.exe
  2⤵
  PID:6204
- C:\Windows\System\iVootPO.exe
  C:\Windows\System\iVootPO.exe
  2⤵
  PID:6408
- C:\Windows\System\mVWoKKu.exe
  C:\Windows\System\mVWoKKu.exe
  2⤵
  PID:6568
- C:\Windows\System\Wueuipt.exe
  C:\Windows\System\Wueuipt.exe
  2⤵
  PID:6604
- C:\Windows\System\DSDmLEM.exe
  C:\Windows\System\DSDmLEM.exe
  2⤵
  PID:6672
- C:\Windows\System\HiUrENH.exe
  C:\Windows\System\HiUrENH.exe
  2⤵
  PID:6848
- C:\Windows\System\dqccJKI.exe
  C:\Windows\System\dqccJKI.exe
  2⤵
  PID:6816
- C:\Windows\System\VwgBUTs.exe
  C:\Windows\System\VwgBUTs.exe
  2⤵
  PID:7076
- C:\Windows\System\gCYKSCf.exe
  C:\Windows\System\gCYKSCf.exe
  2⤵
  PID:5496
- C:\Windows\System\YVUwLKq.exe
  C:\Windows\System\YVUwLKq.exe
  2⤵
  PID:6964
- C:\Windows\System\KyCbskF.exe
  C:\Windows\System\KyCbskF.exe
  2⤵
  PID:7112
- C:\Windows\System\TjbfcSw.exe
  C:\Windows\System\TjbfcSw.exe
  2⤵
  PID:7188
- C:\Windows\System\NNrAMSn.exe
  C:\Windows\System\NNrAMSn.exe
  2⤵
  PID:7232
- C:\Windows\System\STDAtxx.exe
  C:\Windows\System\STDAtxx.exe
  2⤵
  PID:7256
- C:\Windows\System\pxLpHed.exe
  C:\Windows\System\pxLpHed.exe
  2⤵
  PID:7292
- C:\Windows\System\BCdZDXD.exe
  C:\Windows\System\BCdZDXD.exe
  2⤵
  PID:7308
- C:\Windows\System\EeDEaea.exe
  C:\Windows\System\EeDEaea.exe
  2⤵
  PID:7328
- C:\Windows\System\oEsfzbj.exe
  C:\Windows\System\oEsfzbj.exe
  2⤵
  PID:7376
- C:\Windows\System\iaSYeTQ.exe
  C:\Windows\System\iaSYeTQ.exe
  2⤵
  PID:7396
- C:\Windows\System\zjLvasL.exe
  C:\Windows\System\zjLvasL.exe
  2⤵
  PID:7464
- C:\Windows\System\YEjBqgI.exe
  C:\Windows\System\YEjBqgI.exe
  2⤵
  PID:7480
- C:\Windows\System\RWDyoHv.exe
  C:\Windows\System\RWDyoHv.exe
  2⤵
  PID:7500
- C:\Windows\System\DQzQZMt.exe
  C:\Windows\System\DQzQZMt.exe
  2⤵
  PID:7544
- C:\Windows\System\WlGPrxE.exe
  C:\Windows\System\WlGPrxE.exe
  2⤵
  PID:7560
- C:\Windows\System\xSkAkbY.exe
  C:\Windows\System\xSkAkbY.exe
  2⤵
  PID:7584
- C:\Windows\System\rrvrWdS.exe
  C:\Windows\System\rrvrWdS.exe
  2⤵
  PID:7600
- C:\Windows\System\KqByCYY.exe
  C:\Windows\System\KqByCYY.exe
  2⤵
  PID:7652
- C:\Windows\System\dcJlsEN.exe
  C:\Windows\System\dcJlsEN.exe
  2⤵
  PID:7676
- C:\Windows\System\RDtVIno.exe
  C:\Windows\System\RDtVIno.exe
  2⤵
  PID:7704
- C:\Windows\System\YcaMJiq.exe
  C:\Windows\System\YcaMJiq.exe
  2⤵
  PID:7724
- C:\Windows\System\WEWymYm.exe
  C:\Windows\System\WEWymYm.exe
  2⤵
  PID:7780
- C:\Windows\System\TdhZHgF.exe
  C:\Windows\System\TdhZHgF.exe
  2⤵
  PID:7804
- C:\Windows\System\vQkIOBF.exe
  C:\Windows\System\vQkIOBF.exe
  2⤵
  PID:7828
- C:\Windows\System\QRUZaHI.exe
  C:\Windows\System\QRUZaHI.exe
  2⤵
  PID:7852
- C:\Windows\System\uBdOUGW.exe
  C:\Windows\System\uBdOUGW.exe
  2⤵
  PID:7872
- C:\Windows\System\SUZpcHy.exe
  C:\Windows\System\SUZpcHy.exe
  2⤵
  PID:7892
- C:\Windows\System\mBCbnhs.exe
  C:\Windows\System\mBCbnhs.exe
  2⤵
  PID:7932
- C:\Windows\System\ExIAXqM.exe
  C:\Windows\System\ExIAXqM.exe
  2⤵
  PID:7952
- C:\Windows\System\MjPiCFt.exe
  C:\Windows\System\MjPiCFt.exe
  2⤵
  PID:7972
- C:\Windows\System\WEDoyzZ.exe
  C:\Windows\System\WEDoyzZ.exe
  2⤵
  PID:8000
- C:\Windows\System\bwuyEmd.exe
  C:\Windows\System\bwuyEmd.exe
  2⤵
  PID:8020
- C:\Windows\System\gSYitrQ.exe
  C:\Windows\System\gSYitrQ.exe
  2⤵
  PID:8056
- C:\Windows\System\fbyzhiN.exe
  C:\Windows\System\fbyzhiN.exe
  2⤵
  PID:8084
- C:\Windows\System\jCIFQdF.exe
  C:\Windows\System\jCIFQdF.exe
  2⤵
  PID:8132
- C:\Windows\System\XWyYzgV.exe
  C:\Windows\System\XWyYzgV.exe
  2⤵
  PID:8152
- C:\Windows\System\ugjmpWG.exe
  C:\Windows\System\ugjmpWG.exe
  2⤵
  PID:6868
- C:\Windows\System\kOpOgzG.exe
  C:\Windows\System\kOpOgzG.exe
  2⤵
  PID:6340
- C:\Windows\System\ZeTlBHs.exe
  C:\Windows\System\ZeTlBHs.exe
  2⤵
  PID:7252
- C:\Windows\System\CEuCBlQ.exe
  C:\Windows\System\CEuCBlQ.exe
  2⤵
  PID:7304
- C:\Windows\System\aPfkYCy.exe
  C:\Windows\System\aPfkYCy.exe
  2⤵
  PID:7336
- C:\Windows\System\WkCnQIX.exe
  C:\Windows\System\WkCnQIX.exe
  2⤵
  PID:7392
- C:\Windows\System\dOuPKqC.exe
  C:\Windows\System\dOuPKqC.exe
  2⤵
  PID:7472
- C:\Windows\System\JRYGPHM.exe
  C:\Windows\System\JRYGPHM.exe
  2⤵
  PID:7576
- C:\Windows\System\ivEEcFw.exe
  C:\Windows\System\ivEEcFw.exe
  2⤵
  PID:7640
- C:\Windows\System\BwVPFVu.exe
  C:\Windows\System\BwVPFVu.exe
  2⤵
  PID:7732
- C:\Windows\System\bOQdZuH.exe
  C:\Windows\System\bOQdZuH.exe
  2⤵
  PID:7796
- C:\Windows\System\WJUvcsX.exe
  C:\Windows\System\WJUvcsX.exe
  2⤵
  PID:7816
- C:\Windows\System\WuugbwC.exe
  C:\Windows\System\WuugbwC.exe
  2⤵
  PID:7904
- C:\Windows\System\sDDNnyn.exe
  C:\Windows\System\sDDNnyn.exe
  2⤵
  PID:7924
- C:\Windows\System\KCpmhiR.exe
  C:\Windows\System\KCpmhiR.exe
  2⤵
  PID:7984
- C:\Windows\System\xHeBxkl.exe
  C:\Windows\System\xHeBxkl.exe
  2⤵
  PID:8036
- C:\Windows\System\jszThNC.exe
  C:\Windows\System\jszThNC.exe
  2⤵
  PID:8108
- C:\Windows\System\nkxMZVy.exe
  C:\Windows\System\nkxMZVy.exe
  2⤵
  PID:8140
- C:\Windows\System\UafmyMJ.exe
  C:\Windows\System\UafmyMJ.exe
  2⤵
  PID:8188
- C:\Windows\System\HGjhkLN.exe
  C:\Windows\System\HGjhkLN.exe
  2⤵
  PID:7184
- C:\Windows\System\ugLMnxs.exe
  C:\Windows\System\ugLMnxs.exe
  2⤵
  PID:7492
- C:\Windows\System\mrXomSJ.exe
  C:\Windows\System\mrXomSJ.exe
  2⤵
  PID:7596
- C:\Windows\System\BsnUCYK.exe
  C:\Windows\System\BsnUCYK.exe
  2⤵
  PID:7760
- C:\Windows\System\PAjqVkD.exe
  C:\Windows\System\PAjqVkD.exe
  2⤵
  PID:7992
- C:\Windows\System\rMYwceG.exe
  C:\Windows\System\rMYwceG.exe
  2⤵
  PID:6432
- C:\Windows\System\qYwaOeR.exe
  C:\Windows\System\qYwaOeR.exe
  2⤵
  PID:8172
- C:\Windows\System\BtHbeQc.exe
  C:\Windows\System\BtHbeQc.exe
  2⤵
  PID:7672
- C:\Windows\System\AmhdspN.exe
  C:\Windows\System\AmhdspN.exe
  2⤵
  PID:7868
- C:\Windows\System\ofDHYrj.exe
  C:\Windows\System\ofDHYrj.exe
  2⤵
  PID:8080
- C:\Windows\System\FjuILNJ.exe
  C:\Windows\System\FjuILNJ.exe
  2⤵
  PID:7356
- C:\Windows\System\xxuXuBl.exe
  C:\Windows\System\xxuXuBl.exe
  2⤵
  PID:8212
- C:\Windows\System\oNiEFrx.exe
  C:\Windows\System\oNiEFrx.exe
  2⤵
  PID:8232
- C:\Windows\System\FCmohrG.exe
  C:\Windows\System\FCmohrG.exe
  2⤵
  PID:8280
- C:\Windows\System\PyyOasD.exe
  C:\Windows\System\PyyOasD.exe
  2⤵
  PID:8304
- C:\Windows\System\PTFndrm.exe
  C:\Windows\System\PTFndrm.exe
  2⤵
  PID:8320
- C:\Windows\System\ktcKdUH.exe
  C:\Windows\System\ktcKdUH.exe
  2⤵
  PID:8344
- C:\Windows\System\QHWWhhx.exe
  C:\Windows\System\QHWWhhx.exe
  2⤵
  PID:8364
- C:\Windows\System\vCKNrPf.exe
  C:\Windows\System\vCKNrPf.exe
  2⤵
  PID:8388
- C:\Windows\System\oWlpEGe.exe
  C:\Windows\System\oWlpEGe.exe
  2⤵
  PID:8432
- C:\Windows\System\vIsqyRZ.exe
  C:\Windows\System\vIsqyRZ.exe
  2⤵
  PID:8460
- C:\Windows\System\wGVzQoy.exe
  C:\Windows\System\wGVzQoy.exe
  2⤵
  PID:8512
- C:\Windows\System\fmaeSTl.exe
  C:\Windows\System\fmaeSTl.exe
  2⤵
  PID:8532
- C:\Windows\System\HHCZnyF.exe
  C:\Windows\System\HHCZnyF.exe
  2⤵
  PID:8576
- C:\Windows\System\JRMTgBS.exe
  C:\Windows\System\JRMTgBS.exe
  2⤵
  PID:8596
- C:\Windows\System\HXytMrA.exe
  C:\Windows\System\HXytMrA.exe
  2⤵
  PID:8620
- C:\Windows\System\PqSgAQd.exe
  C:\Windows\System\PqSgAQd.exe
  2⤵
  PID:8660
- C:\Windows\System\wHNIApY.exe
  C:\Windows\System\wHNIApY.exe
  2⤵
  PID:8680
- C:\Windows\System\FnxMKkK.exe
  C:\Windows\System\FnxMKkK.exe
  2⤵
  PID:8696
- C:\Windows\System\snldCBX.exe
  C:\Windows\System\snldCBX.exe
  2⤵
  PID:8728
- C:\Windows\System\hCSqLjl.exe
  C:\Windows\System\hCSqLjl.exe
  2⤵
  PID:8752
- C:\Windows\System\RaoxZir.exe
  C:\Windows\System\RaoxZir.exe
  2⤵
  PID:8800
- C:\Windows\System\KNYaBXA.exe
  C:\Windows\System\KNYaBXA.exe
  2⤵
  PID:8828
- C:\Windows\System\veLFDtr.exe
  C:\Windows\System\veLFDtr.exe
  2⤵
  PID:8844
- C:\Windows\System\SCLDsKk.exe
  C:\Windows\System\SCLDsKk.exe
  2⤵
  PID:8872
- C:\Windows\System\EujnXui.exe
  C:\Windows\System\EujnXui.exe
  2⤵
  PID:8904
- C:\Windows\System\YeqWcld.exe
  C:\Windows\System\YeqWcld.exe
  2⤵
  PID:8932
- C:\Windows\System\AwLPABL.exe
  C:\Windows\System\AwLPABL.exe
  2⤵
  PID:8972
- C:\Windows\System\SYMUCxr.exe
  C:\Windows\System\SYMUCxr.exe
  2⤵
  PID:9004
- C:\Windows\System\xJAXxBI.exe
  C:\Windows\System\xJAXxBI.exe
  2⤵
  PID:9044
- C:\Windows\System\yUIVKvd.exe
  C:\Windows\System\yUIVKvd.exe
  2⤵
  PID:9072
- C:\Windows\System\nhVbnKh.exe
  C:\Windows\System\nhVbnKh.exe
  2⤵
  PID:9092
- C:\Windows\System\QRFCmqS.exe
  C:\Windows\System\QRFCmqS.exe
  2⤵
  PID:9132
- C:\Windows\System\mquALLj.exe
  C:\Windows\System\mquALLj.exe
  2⤵
  PID:9156
- C:\Windows\System\WiYRVDe.exe
  C:\Windows\System\WiYRVDe.exe
  2⤵
  PID:9172
- C:\Windows\System\kTUGkAF.exe
  C:\Windows\System\kTUGkAF.exe
  2⤵
  PID:9196
- C:\Windows\System\uDHcUvk.exe
  C:\Windows\System\uDHcUvk.exe
  2⤵
  PID:9212
- C:\Windows\System\qpnZWvs.exe
  C:\Windows\System\qpnZWvs.exe
  2⤵
  PID:8208
- C:\Windows\System\HwiSeBV.exe
  C:\Windows\System\HwiSeBV.exe
  2⤵
  PID:8224
- C:\Windows\System\ssFmJfV.exe
  C:\Windows\System\ssFmJfV.exe
  2⤵
  PID:8356
- C:\Windows\System\SAQddhZ.exe
  C:\Windows\System\SAQddhZ.exe
  2⤵
  PID:8316
- C:\Windows\System\SRRAchX.exe
  C:\Windows\System\SRRAchX.exe
  2⤵
  PID:8428
- C:\Windows\System\ZgVJnMG.exe
  C:\Windows\System\ZgVJnMG.exe
  2⤵
  PID:8500
- C:\Windows\System\ihujNgQ.exe
  C:\Windows\System\ihujNgQ.exe
  2⤵
  PID:8636
- C:\Windows\System\TpsUxss.exe
  C:\Windows\System\TpsUxss.exe
  2⤵
  PID:8676
- C:\Windows\System\TtGkFoT.exe
  C:\Windows\System\TtGkFoT.exe
  2⤵
  PID:8724
- C:\Windows\System\pvyHbeH.exe
  C:\Windows\System\pvyHbeH.exe
  2⤵
  PID:8868
- C:\Windows\System\iajwvbv.exe
  C:\Windows\System\iajwvbv.exe
  2⤵
  PID:8912
- C:\Windows\System\FliWyhF.exe
  C:\Windows\System\FliWyhF.exe
  2⤵
  PID:9024
- C:\Windows\System\HCAKfSc.exe
  C:\Windows\System\HCAKfSc.exe
  2⤵
  PID:9080
- C:\Windows\System\toAuszi.exe
  C:\Windows\System\toAuszi.exe
  2⤵
  PID:9144
- C:\Windows\System\yaXcxIF.exe
  C:\Windows\System\yaXcxIF.exe
  2⤵
  PID:9204
- C:\Windows\System\KfzpeJh.exe
  C:\Windows\System\KfzpeJh.exe
  2⤵
  PID:8380
- C:\Windows\System\tueZTSg.exe
  C:\Windows\System\tueZTSg.exe
  2⤵
  PID:8404
- C:\Windows\System\kEaxFbJ.exe
  C:\Windows\System\kEaxFbJ.exe
  2⤵
  PID:8540
- C:\Windows\System\aPWTuTF.exe
  C:\Windows\System\aPWTuTF.exe
  2⤵
  PID:8656
- C:\Windows\System\tvixxSp.exe
  C:\Windows\System\tvixxSp.exe
  2⤵
  PID:8944
- C:\Windows\System\uZubYxg.exe
  C:\Windows\System\uZubYxg.exe
  2⤵
  PID:8996
- C:\Windows\System\oXvDJoR.exe
  C:\Windows\System\oXvDJoR.exe
  2⤵
  PID:9116
- C:\Windows\System\kBjhUEX.exe
  C:\Windows\System\kBjhUEX.exe
  2⤵
  PID:8272
- C:\Windows\System\qTNfBBB.exe
  C:\Windows\System\qTNfBBB.exe
  2⤵
  PID:8472
- C:\Windows\System\IPrUDIb.exe
  C:\Windows\System\IPrUDIb.exe
  2⤵
  PID:8716
- C:\Windows\System\NFwnGqz.exe
  C:\Windows\System\NFwnGqz.exe
  2⤵
  PID:9168
- C:\Windows\System\TzTFucG.exe
  C:\Windows\System\TzTFucG.exe
  2⤵
  PID:9240
- C:\Windows\System\bTshWMi.exe
  C:\Windows\System\bTshWMi.exe
  2⤵
  PID:9260
- C:\Windows\System\VnYHDlP.exe
  C:\Windows\System\VnYHDlP.exe
  2⤵
  PID:9304
- C:\Windows\System\KhDjDzV.exe
  C:\Windows\System\KhDjDzV.exe
  2⤵
  PID:9388
- C:\Windows\System\qJojYSM.exe
  C:\Windows\System\qJojYSM.exe
  2⤵
  PID:9492
- C:\Windows\System\BcrdSFM.exe
  C:\Windows\System\BcrdSFM.exe
  2⤵
  PID:9508
- C:\Windows\System\hxVXQyj.exe
  C:\Windows\System\hxVXQyj.exe
  2⤵
  PID:9524
- C:\Windows\System\iXLMMfY.exe
  C:\Windows\System\iXLMMfY.exe
  2⤵
  PID:9540
- C:\Windows\System\xbgKRda.exe
  C:\Windows\System\xbgKRda.exe
  2⤵
  PID:9556
- C:\Windows\System\CJebcRo.exe
  C:\Windows\System\CJebcRo.exe
  2⤵
  PID:9572
- C:\Windows\System\EfKCCOq.exe
  C:\Windows\System\EfKCCOq.exe
  2⤵
  PID:9588
- C:\Windows\System\RVOcBqA.exe
  C:\Windows\System\RVOcBqA.exe
  2⤵
  PID:9604
- C:\Windows\System\ICSgkSF.exe
  C:\Windows\System\ICSgkSF.exe
  2⤵
  PID:9620
- C:\Windows\System\AtutpFY.exe
  C:\Windows\System\AtutpFY.exe
  2⤵
  PID:9636
- C:\Windows\System\vfGxUVc.exe
  C:\Windows\System\vfGxUVc.exe
  2⤵
  PID:9652
- C:\Windows\System\rjGrPDU.exe
  C:\Windows\System\rjGrPDU.exe
  2⤵
  PID:9668
- C:\Windows\System\jgGGoYQ.exe
  C:\Windows\System\jgGGoYQ.exe
  2⤵
  PID:9684
- C:\Windows\System\CNsrsZk.exe
  C:\Windows\System\CNsrsZk.exe
  2⤵
  PID:9700
- C:\Windows\System\xcvuTMP.exe
  C:\Windows\System\xcvuTMP.exe
  2⤵
  PID:9720
- C:\Windows\System\steCeoH.exe
  C:\Windows\System\steCeoH.exe
  2⤵
  PID:9752
- C:\Windows\System\BlKGmGh.exe
  C:\Windows\System\BlKGmGh.exe
  2⤵
  PID:9768
- C:\Windows\System\YRWFhYj.exe
  C:\Windows\System\YRWFhYj.exe
  2⤵
  PID:9788
- C:\Windows\System\vVDboYg.exe
  C:\Windows\System\vVDboYg.exe
  2⤵
  PID:9820
- C:\Windows\System\ENVgoSU.exe
  C:\Windows\System\ENVgoSU.exe
  2⤵
  PID:9844
- C:\Windows\System\ZkvSNHW.exe
  C:\Windows\System\ZkvSNHW.exe
  2⤵
  PID:9868
- C:\Windows\System\zmgzTTa.exe
  C:\Windows\System\zmgzTTa.exe
  2⤵
  PID:9924
- C:\Windows\System\sbkSGXa.exe
  C:\Windows\System\sbkSGXa.exe
  2⤵
  PID:10044
- C:\Windows\System\Czvjits.exe
  C:\Windows\System\Czvjits.exe
  2⤵
  PID:10152
- C:\Windows\System\qLheeig.exe
  C:\Windows\System\qLheeig.exe
  2⤵
  PID:10172
- C:\Windows\System\sdVADEs.exe
  C:\Windows\System\sdVADEs.exe
  2⤵
  PID:10192
- C:\Windows\System\lgaRqbG.exe
  C:\Windows\System\lgaRqbG.exe
  2⤵
  PID:10212
- C:\Windows\System\mvQjYUa.exe
  C:\Windows\System\mvQjYUa.exe
  2⤵
  PID:10232
- C:\Windows\System\aNvNmRb.exe
  C:\Windows\System\aNvNmRb.exe
  2⤵
  PID:8616
- C:\Windows\System\WHuNffT.exe
  C:\Windows\System\WHuNffT.exe
  2⤵
  PID:9276
- C:\Windows\System\OtPynCZ.exe
  C:\Windows\System\OtPynCZ.exe
  2⤵
  PID:9360
- C:\Windows\System\IfTdYhd.exe
  C:\Windows\System\IfTdYhd.exe
  2⤵
  PID:9336
- C:\Windows\System\PerRLTx.exe
  C:\Windows\System\PerRLTx.exe
  2⤵
  PID:9744
- C:\Windows\System\wJKsJaQ.exe
  C:\Windows\System\wJKsJaQ.exe
  2⤵
  PID:9780
- C:\Windows\System\iqTUDeC.exe
  C:\Windows\System\iqTUDeC.exe
  2⤵
  PID:9356
- C:\Windows\System\dIoTnuq.exe
  C:\Windows\System\dIoTnuq.exe
  2⤵
  PID:9812
- C:\Windows\System\WzEGkvP.exe
  C:\Windows\System\WzEGkvP.exe
  2⤵
  PID:9504
- C:\Windows\System\PTorRvM.exe
  C:\Windows\System\PTorRvM.exe
  2⤵
  PID:9564
- C:\Windows\System\AeAiRRN.exe
  C:\Windows\System\AeAiRRN.exe
  2⤵
  PID:9584
- C:\Windows\System\NQbbUMf.exe
  C:\Windows\System\NQbbUMf.exe
  2⤵
  PID:9664
- C:\Windows\System\HNyePBP.exe
  C:\Windows\System\HNyePBP.exe
  2⤵
  PID:9712
- C:\Windows\System\VWVmfxN.exe
  C:\Windows\System\VWVmfxN.exe
  2⤵
  PID:9892
- C:\Windows\System\PxYdAFF.exe
  C:\Windows\System\PxYdAFF.exe
  2⤵
  PID:9944
- C:\Windows\System\FBKqeoE.exe
  C:\Windows\System\FBKqeoE.exe
  2⤵
  PID:9840
- C:\Windows\System\aAGuzVn.exe
  C:\Windows\System\aAGuzVn.exe
  2⤵
  PID:9916
- C:\Windows\System\hiYjtME.exe
  C:\Windows\System\hiYjtME.exe
  2⤵
  PID:9208
- C:\Windows\System\oVhjwjj.exe
  C:\Windows\System\oVhjwjj.exe
  2⤵
  PID:8816
- C:\Windows\System\QqThYJW.exe
  C:\Windows\System\QqThYJW.exe
  2⤵
  PID:9348
- C:\Windows\System\lvuNhVh.exe
  C:\Windows\System\lvuNhVh.exe
  2⤵
  PID:9332
- C:\Windows\System\VGulRgy.exe
  C:\Windows\System\VGulRgy.exe
  2⤵
  PID:9428
- C:\Windows\System\BzavRQq.exe
  C:\Windows\System\BzavRQq.exe
  2⤵
  PID:9476
- C:\Windows\System\SKjmFVJ.exe
  C:\Windows\System\SKjmFVJ.exe
  2⤵
  PID:9696
- C:\Windows\System\mAinDUx.exe
  C:\Windows\System\mAinDUx.exe
  2⤵
  PID:10000
- C:\Windows\System\tDomZMK.exe
  C:\Windows\System\tDomZMK.exe
  2⤵
  PID:10184
- C:\Windows\System\ZeAljOG.exe
  C:\Windows\System\ZeAljOG.exe
  2⤵
  PID:8720
- C:\Windows\System\XvEXDHy.exe
  C:\Windows\System\XvEXDHy.exe
  2⤵
  PID:9464
- C:\Windows\System\jWMyLPU.exe
  C:\Windows\System\jWMyLPU.exe
  2⤵
  PID:9596
- C:\Windows\System\mnfChYn.exe
  C:\Windows\System\mnfChYn.exe
  2⤵
  PID:9880
- C:\Windows\System\TbfDcfg.exe
  C:\Windows\System\TbfDcfg.exe
  2⤵
  PID:9376
- C:\Windows\System\MoWqwpW.exe
  C:\Windows\System\MoWqwpW.exe
  2⤵
  PID:10248
- C:\Windows\System\dYDoukY.exe
  C:\Windows\System\dYDoukY.exe
  2⤵
  PID:10268
- C:\Windows\System\itNaxwM.exe
  C:\Windows\System\itNaxwM.exe
  2⤵
  PID:10296
- C:\Windows\System\OkQgZqy.exe
  C:\Windows\System\OkQgZqy.exe
  2⤵
  PID:10324
- C:\Windows\System\keMjTrI.exe
  C:\Windows\System\keMjTrI.exe
  2⤵
  PID:10352
- C:\Windows\System\UHwLrOy.exe
  C:\Windows\System\UHwLrOy.exe
  2⤵
  PID:10412
- C:\Windows\System\nDDWBOw.exe
  C:\Windows\System\nDDWBOw.exe
  2⤵
  PID:10440
- C:\Windows\System\HAyBVly.exe
  C:\Windows\System\HAyBVly.exe
  2⤵
  PID:10460
- C:\Windows\System\BwxujTN.exe
  C:\Windows\System\BwxujTN.exe
  2⤵
  PID:10476
- C:\Windows\System\AUAdTlB.exe
  C:\Windows\System\AUAdTlB.exe
  2⤵
  PID:10504
- C:\Windows\System\CwThEQl.exe
  C:\Windows\System\CwThEQl.exe
  2⤵
  PID:10532
- C:\Windows\System\ZcSAvWm.exe
  C:\Windows\System\ZcSAvWm.exe
  2⤵
  PID:10556
- C:\Windows\System\ugodZWC.exe
  C:\Windows\System\ugodZWC.exe
  2⤵
  PID:10592
- C:\Windows\System\iIOdPSx.exe
  C:\Windows\System\iIOdPSx.exe
  2⤵
  PID:10644
- C:\Windows\System\vJPniOW.exe
  C:\Windows\System\vJPniOW.exe
  2⤵
  PID:10676
- C:\Windows\System\XbqwEMa.exe
  C:\Windows\System\XbqwEMa.exe
  2⤵
  PID:10696
- C:\Windows\System\jxQKOqw.exe
  C:\Windows\System\jxQKOqw.exe
  2⤵
  PID:10720
- C:\Windows\System\ziGdZvz.exe
  C:\Windows\System\ziGdZvz.exe
  2⤵
  PID:10736
- C:\Windows\System\qMealfW.exe
  C:\Windows\System\qMealfW.exe
  2⤵
  PID:10780
- C:\Windows\System\sZvVCvb.exe
  C:\Windows\System\sZvVCvb.exe
  2⤵
  PID:10812
- C:\Windows\System\jszWXca.exe
  C:\Windows\System\jszWXca.exe
  2⤵
  PID:10828
- C:\Windows\System\zNWbZzH.exe
  C:\Windows\System\zNWbZzH.exe
  2⤵
  PID:10848
- C:\Windows\System\rZrtksb.exe
  C:\Windows\System\rZrtksb.exe
  2⤵
  PID:10880
- C:\Windows\System\tIjItpr.exe
  C:\Windows\System\tIjItpr.exe
  2⤵
  PID:10904
- C:\Windows\System\PASyOrh.exe
  C:\Windows\System\PASyOrh.exe
  2⤵
  PID:10920
- C:\Windows\System\vLrqlTT.exe
  C:\Windows\System\vLrqlTT.exe
  2⤵
  PID:10940
- C:\Windows\System\yukouNZ.exe
  C:\Windows\System\yukouNZ.exe
  2⤵
  PID:10968
- C:\Windows\System\qmHpkhi.exe
  C:\Windows\System\qmHpkhi.exe
  2⤵
  PID:10992
- C:\Windows\System\MigeLXK.exe
  C:\Windows\System\MigeLXK.exe
  2⤵
  PID:11024
- C:\Windows\System\OpJxzsh.exe
  C:\Windows\System\OpJxzsh.exe
  2⤵
  PID:11068
- C:\Windows\System\CUPyGaw.exe
  C:\Windows\System\CUPyGaw.exe
  2⤵
  PID:11088
- C:\Windows\System\HMZJBYn.exe
  C:\Windows\System\HMZJBYn.exe
  2⤵
  PID:11108
- C:\Windows\System\wdriqHs.exe
  C:\Windows\System\wdriqHs.exe
  2⤵
  PID:11148
- C:\Windows\System\smGCPXp.exe
  C:\Windows\System\smGCPXp.exe
  2⤵
  PID:11196
- C:\Windows\System\yDbAXmx.exe
  C:\Windows\System\yDbAXmx.exe
  2⤵
  PID:11216
- C:\Windows\System\YneVxWo.exe
  C:\Windows\System\YneVxWo.exe
  2⤵
  PID:11244
- C:\Windows\System\uZqatiL.exe
  C:\Windows\System\uZqatiL.exe
  2⤵
  PID:9864
- C:\Windows\System\cvoBOkK.exe
  C:\Windows\System\cvoBOkK.exe
  2⤵
  PID:10288
- C:\Windows\System\pNtWZIU.exe
  C:\Windows\System\pNtWZIU.exe
  2⤵
  PID:10312
- C:\Windows\System\FAxtbDT.exe
  C:\Windows\System\FAxtbDT.exe
  2⤵
  PID:10372
- C:\Windows\System\dfFLPpc.exe
  C:\Windows\System\dfFLPpc.exe
  2⤵
  PID:10428
- C:\Windows\System\ETTAsXw.exe
  C:\Windows\System\ETTAsXw.exe
  2⤵
  PID:10500
- C:\Windows\System\qRPJZfv.exe
  C:\Windows\System\qRPJZfv.exe
  2⤵
  PID:10528
- C:\Windows\System\snZYWaA.exe
  C:\Windows\System\snZYWaA.exe
  2⤵
  PID:10620
- C:\Windows\System\dJqqXzL.exe
  C:\Windows\System\dJqqXzL.exe
  2⤵
  PID:10716
- C:\Windows\System\uZlFbbI.exe
  C:\Windows\System\uZlFbbI.exe
  2⤵
  PID:10756
- C:\Windows\System\jpuXyGc.exe
  C:\Windows\System\jpuXyGc.exe
  2⤵
  PID:10872
- C:\Windows\System\LKXtgGy.exe
  C:\Windows\System\LKXtgGy.exe
  2⤵
  PID:10896
- C:\Windows\System\biwGxUy.exe
  C:\Windows\System\biwGxUy.exe
  2⤵
  PID:11008
- C:\Windows\System\RuAqKDl.exe
  C:\Windows\System\RuAqKDl.exe
  2⤵
  PID:10976
- C:\Windows\System\iXJwLVD.exe
  C:\Windows\System\iXJwLVD.exe
  2⤵
  PID:11144
- C:\Windows\System\kvJfptn.exe
  C:\Windows\System\kvJfptn.exe
  2⤵
  PID:11156
- C:\Windows\System\SRGqmql.exe
  C:\Windows\System\SRGqmql.exe
  2⤵
  PID:11252
- C:\Windows\System\LEDWwfW.exe
  C:\Windows\System\LEDWwfW.exe
  2⤵
  PID:10420
- C:\Windows\System\TDdzuJG.exe
  C:\Windows\System\TDdzuJG.exe
  2⤵
  PID:10484
- C:\Windows\System\sleWZFX.exe
  C:\Windows\System\sleWZFX.exe
  2⤵
  PID:10552
- C:\Windows\System\mjCCuMG.exe
  C:\Windows\System\mjCCuMG.exe
  2⤵
  PID:10672
- C:\Windows\System\aOXaeML.exe
  C:\Windows\System\aOXaeML.exe
  2⤵
  PID:10728
- C:\Windows\System\OChDIus.exe
  C:\Windows\System\OChDIus.exe
  2⤵
  PID:10820
- C:\Windows\System\CFpIxNJ.exe
  C:\Windows\System\CFpIxNJ.exe
  2⤵
  PID:10964
- C:\Windows\System\HgyqiNp.exe
  C:\Windows\System\HgyqiNp.exe
  2⤵
  PID:11232
- C:\Windows\System\PqgbdsV.exe
  C:\Windows\System\PqgbdsV.exe
  2⤵
  PID:10788
- C:\Windows\System\lAxADVk.exe
  C:\Windows\System\lAxADVk.exe
  2⤵
  PID:10932
- C:\Windows\System\aXUUAJX.exe
  C:\Windows\System\aXUUAJX.exe
  2⤵
  PID:10492
- C:\Windows\System\peSMaIm.exe
  C:\Windows\System\peSMaIm.exe
  2⤵
  PID:11284
- C:\Windows\System\LBEWkEh.exe
  C:\Windows\System\LBEWkEh.exe
  2⤵
  PID:11312
- C:\Windows\System\yfwXLlG.exe
  C:\Windows\System\yfwXLlG.exe
  2⤵
  PID:11348
- C:\Windows\System\RcaEdEl.exe
  C:\Windows\System\RcaEdEl.exe
  2⤵
  PID:11368
- C:\Windows\System\SVNyhaB.exe
  C:\Windows\System\SVNyhaB.exe
  2⤵
  PID:11388
- C:\Windows\System\UpnrZXd.exe
  C:\Windows\System\UpnrZXd.exe
  2⤵
  PID:11412
- C:\Windows\System\MDNdpOf.exe
  C:\Windows\System\MDNdpOf.exe
  2⤵
  PID:11432
- C:\Windows\System\UFPRPCl.exe
  C:\Windows\System\UFPRPCl.exe
  2⤵
  PID:11468
- C:\Windows\System\aslNJEX.exe
  C:\Windows\System\aslNJEX.exe
  2⤵
  PID:11484
- C:\Windows\System\QmHuGYD.exe
  C:\Windows\System\QmHuGYD.exe
  2⤵
  PID:11516
- C:\Windows\System\sBMnwQS.exe
  C:\Windows\System\sBMnwQS.exe
  2⤵
  PID:11548
- C:\Windows\System\cZIOksD.exe
  C:\Windows\System\cZIOksD.exe
  2⤵
  PID:11580
- C:\Windows\System\oDrnGFT.exe
  C:\Windows\System\oDrnGFT.exe
  2⤵
  PID:11600
- C:\Windows\System\idMClyK.exe
  C:\Windows\System\idMClyK.exe
  2⤵
  PID:11616
- C:\Windows\System\vmwrEST.exe
  C:\Windows\System\vmwrEST.exe
  2⤵
  PID:11636
- C:\Windows\System\ftEsoyy.exe
  C:\Windows\System\ftEsoyy.exe
  2⤵
  PID:11668
- C:\Windows\System\EVsiwvA.exe
  C:\Windows\System\EVsiwvA.exe
  2⤵
  PID:11724
- C:\Windows\System\OBwqcyg.exe
  C:\Windows\System\OBwqcyg.exe
  2⤵
  PID:11740
- C:\Windows\System\ImCBtSO.exe
  C:\Windows\System\ImCBtSO.exe
  2⤵
  PID:11764
- C:\Windows\System\wIXPVEj.exe
  C:\Windows\System\wIXPVEj.exe
  2⤵
  PID:11784
- C:\Windows\System\CjlxSiQ.exe
  C:\Windows\System\CjlxSiQ.exe
  2⤵
  PID:11824
- C:\Windows\System\LRFkdSW.exe
  C:\Windows\System\LRFkdSW.exe
  2⤵
  PID:11844
- C:\Windows\System\hDZMGwG.exe
  C:\Windows\System\hDZMGwG.exe
  2⤵
  PID:11892
- C:\Windows\System\CloqACh.exe
  C:\Windows\System\CloqACh.exe
  2⤵
  PID:11920
- C:\Windows\System\vWFlMcK.exe
  C:\Windows\System\vWFlMcK.exe
  2⤵
  PID:11948
- C:\Windows\System\sUsbPvO.exe
  C:\Windows\System\sUsbPvO.exe
  2⤵
  PID:11964
- C:\Windows\System\awuFdsZ.exe
  C:\Windows\System\awuFdsZ.exe
  2⤵
  PID:11988
- C:\Windows\System\VNxoqcQ.exe
  C:\Windows\System\VNxoqcQ.exe
  2⤵
  PID:12024
- C:\Windows\System\NaKLZVT.exe
  C:\Windows\System\NaKLZVT.exe
  2⤵
  PID:12040
- C:\Windows\System\DCIxjjD.exe
  C:\Windows\System\DCIxjjD.exe
  2⤵
  PID:12056
- C:\Windows\System\nHxeLrq.exe
  C:\Windows\System\nHxeLrq.exe
  2⤵
  PID:12092
- C:\Windows\System\ClpfhbC.exe
  C:\Windows\System\ClpfhbC.exe
  2⤵
  PID:12108
- C:\Windows\System\naxlfXG.exe
  C:\Windows\System\naxlfXG.exe
  2⤵
  PID:12132
- C:\Windows\System\iRJkFPZ.exe
  C:\Windows\System\iRJkFPZ.exe
  2⤵
  PID:12152
- C:\Windows\System\bXFXnec.exe
  C:\Windows\System\bXFXnec.exe
  2⤵
  PID:12200
- C:\Windows\System\UdcbcLQ.exe
  C:\Windows\System\UdcbcLQ.exe
  2⤵
  PID:12228
- C:\Windows\System\rUWaPis.exe
  C:\Windows\System\rUWaPis.exe
  2⤵
  PID:12280
- C:\Windows\System\TsIRgCX.exe
  C:\Windows\System\TsIRgCX.exe
  2⤵
  PID:10340
- C:\Windows\System\Clsudql.exe
  C:\Windows\System\Clsudql.exe
  2⤵
  PID:11384
- C:\Windows\System\pLiIIor.exe
  C:\Windows\System\pLiIIor.exe
  2⤵
  PID:11360
- C:\Windows\System\HJlDDdy.exe
  C:\Windows\System\HJlDDdy.exe
  2⤵
  PID:11528
- C:\Windows\System\JPYQmhj.exe
  C:\Windows\System\JPYQmhj.exe
  2⤵
  PID:11532
- C:\Windows\System\LiVrpLr.exe
  C:\Windows\System\LiVrpLr.exe
  2⤵
  PID:11608
- C:\Windows\System\hukGfIc.exe
  C:\Windows\System\hukGfIc.exe
  2⤵
  PID:11628
- C:\Windows\System\srBMjax.exe
  C:\Windows\System\srBMjax.exe
  2⤵
  PID:11684
- C:\Windows\System\GYnVUrZ.exe
  C:\Windows\System\GYnVUrZ.exe
  2⤵
  PID:11736
- C:\Windows\System\AFXGAeW.exe
  C:\Windows\System\AFXGAeW.exe
  2⤵
  PID:11900
- C:\Windows\System\fgPGxKS.exe
  C:\Windows\System\fgPGxKS.exe
  2⤵
  PID:2884
- C:\Windows\System\bmlKnBI.exe
  C:\Windows\System\bmlKnBI.exe
  2⤵
  PID:11980
- C:\Windows\System\EWkgynW.exe
  C:\Windows\System\EWkgynW.exe
  2⤵
  PID:11996
- C:\Windows\System\xqRtFbX.exe
  C:\Windows\System\xqRtFbX.exe
  2⤵
  PID:12076
- C:\Windows\System\xNwwdsw.exe
  C:\Windows\System\xNwwdsw.exe
  2⤵
  PID:12188
- C:\Windows\System\BmexqOK.exe
  C:\Windows\System\BmexqOK.exe
  2⤵
  PID:3356
- C:\Windows\System\GbfjTiX.exe
  C:\Windows\System\GbfjTiX.exe
  2⤵
  PID:3080
- C:\Windows\System\xBdyYrg.exe
  C:\Windows\System\xBdyYrg.exe
  2⤵
  PID:10228
- C:\Windows\System\rgboXYy.exe
  C:\Windows\System\rgboXYy.exe
  2⤵
  PID:11380
- C:\Windows\System\LahHCAo.exe
  C:\Windows\System\LahHCAo.exe
  2⤵
  PID:11572
- C:\Windows\System\FZwmrPw.exe
  C:\Windows\System\FZwmrPw.exe
  2⤵
  PID:11632
- C:\Windows\System\JAhsOOm.exe
  C:\Windows\System\JAhsOOm.exe
  2⤵
  PID:11772
- C:\Windows\System\sfEvqcp.exe
  C:\Windows\System\sfEvqcp.exe
  2⤵
  PID:11944
- C:\Windows\System\GapurHr.exe
  C:\Windows\System\GapurHr.exe
  2⤵
  PID:12064
- C:\Windows\System\NEqRcdf.exe
  C:\Windows\System\NEqRcdf.exe
  2⤵
  PID:12080
- C:\Windows\System\EqoHvyD.exe
  C:\Windows\System\EqoHvyD.exe
  2⤵
  PID:2072
- C:\Windows\System\EZyXBCu.exe
  C:\Windows\System\EZyXBCu.exe
  2⤵
  PID:11456
- C:\Windows\System\THdfDoP.exe
  C:\Windows\System\THdfDoP.exe
  2⤵
  PID:11096
- C:\Windows\System\tIqlXmt.exe
  C:\Windows\System\tIqlXmt.exe
  2⤵
  PID:2856
- C:\Windows\System\UJCgFTt.exe
  C:\Windows\System\UJCgFTt.exe
  2⤵
  PID:12104
- C:\Windows\System\pjjFmUl.exe
  C:\Windows\System\pjjFmUl.exe
  2⤵
  PID:11888
- C:\Windows\System\vFQzIkZ.exe
  C:\Windows\System\vFQzIkZ.exe
  2⤵
  PID:12292
- C:\Windows\System\RJocbBQ.exe
  C:\Windows\System\RJocbBQ.exe
  2⤵
  PID:12316
- C:\Windows\System\VMbSypo.exe
  C:\Windows\System\VMbSypo.exe
  2⤵
  PID:12368
- C:\Windows\System\RKWfXfK.exe
  C:\Windows\System\RKWfXfK.exe
  2⤵
  PID:12388
- C:\Windows\System\xMQTLeC.exe
  C:\Windows\System\xMQTLeC.exe
  2⤵
  PID:12408
- C:\Windows\System\jOMijSo.exe
  C:\Windows\System\jOMijSo.exe
  2⤵
  PID:12440
- C:\Windows\System\POfBApJ.exe
  C:\Windows\System\POfBApJ.exe
  2⤵
  PID:12504
- C:\Windows\System\sIJoofR.exe
  C:\Windows\System\sIJoofR.exe
  2⤵
  PID:12528
- C:\Windows\System\lcDAVnL.exe
  C:\Windows\System\lcDAVnL.exe
  2⤵
  PID:12576
- C:\Windows\System\TOVIPkT.exe
  C:\Windows\System\TOVIPkT.exe
  2⤵
  PID:12600
- C:\Windows\System\ipiEgqW.exe
  C:\Windows\System\ipiEgqW.exe
  2⤵
  PID:12620
- C:\Windows\System\mACfrQl.exe
  C:\Windows\System\mACfrQl.exe
  2⤵
  PID:12640
- C:\Windows\System\WhWSeIk.exe
  C:\Windows\System\WhWSeIk.exe
  2⤵
  PID:12668
- C:\Windows\System\QlBelpJ.exe
  C:\Windows\System\QlBelpJ.exe
  2⤵
  PID:12688
- C:\Windows\System\IXZFEPS.exe
  C:\Windows\System\IXZFEPS.exe
  2⤵
  PID:12708
- C:\Windows\System\WDpiDCV.exe
  C:\Windows\System\WDpiDCV.exe
  2⤵
  PID:12752
- C:\Windows\System\McnlLMU.exe
  C:\Windows\System\McnlLMU.exe
  2⤵
  PID:12780
- C:\Windows\System\RRGdgxS.exe
  C:\Windows\System\RRGdgxS.exe
  2⤵
  PID:12804
- C:\Windows\System\SBTBlmM.exe
  C:\Windows\System\SBTBlmM.exe
  2⤵
  PID:12820
- C:\Windows\System\DfJvBtx.exe
  C:\Windows\System\DfJvBtx.exe
  2⤵
  PID:12840
- C:\Windows\System\ZnuzCXg.exe
  C:\Windows\System\ZnuzCXg.exe
  2⤵
  PID:12888
- C:\Windows\System\NmyvKCk.exe
  C:\Windows\System\NmyvKCk.exe
  2⤵
  PID:12952
- C:\Windows\System\glzeHFy.exe
  C:\Windows\System\glzeHFy.exe
  2⤵
  PID:12968
- C:\Windows\System\aHlXfol.exe
  C:\Windows\System\aHlXfol.exe
  2⤵
  PID:12984
- C:\Windows\System\SPtCIqe.exe
  C:\Windows\System\SPtCIqe.exe
  2⤵
  PID:13036
- C:\Windows\System\RzOQHzB.exe
  C:\Windows\System\RzOQHzB.exe
  2⤵
  PID:13052
- C:\Windows\System\QIkxBjD.exe
  C:\Windows\System\QIkxBjD.exe
  2⤵
  PID:13088
- C:\Windows\System\AjBIzKL.exe
  C:\Windows\System\AjBIzKL.exe
  2⤵
  PID:13120
- C:\Windows\System\orVTMMl.exe
  C:\Windows\System\orVTMMl.exe
  2⤵
  PID:13152
- C:\Windows\System\cEVNyrA.exe
  C:\Windows\System\cEVNyrA.exe
  2⤵
  PID:13172
- C:\Windows\System\aZTffeH.exe
  C:\Windows\System\aZTffeH.exe
  2⤵
  PID:13188
- C:\Windows\System\leFCeVQ.exe
  C:\Windows\System\leFCeVQ.exe
  2⤵
  PID:13216
- C:\Windows\System\QcGYTin.exe
  C:\Windows\System\QcGYTin.exe
  2⤵
  PID:13248
- C:\Windows\System\LojWiFt.exe
  C:\Windows\System\LojWiFt.exe
  2⤵
  PID:13272
- C:\Windows\System\bzpxYWW.exe
  C:\Windows\System\bzpxYWW.exe
  2⤵
  PID:11688
- C:\Windows\System\XXpJbNB.exe
  C:\Windows\System\XXpJbNB.exe
  2⤵
  PID:12172
- C:\Windows\System\HebEXRm.exe
  C:\Windows\System\HebEXRm.exe
  2⤵
  PID:12380
- C:\Windows\System\SJEnGbZ.exe
  C:\Windows\System\SJEnGbZ.exe
  2⤵
  PID:12464
- C:\Windows\System\lSaBwJn.exe
  C:\Windows\System\lSaBwJn.exe
  2⤵
  PID:12492
- C:\Windows\System\oDmSeKJ.exe
  C:\Windows\System\oDmSeKJ.exe
  2⤵
  PID:12736
- C:\Windows\System\tQwljRt.exe
  C:\Windows\System\tQwljRt.exe
  2⤵
  PID:12788
- C:\Windows\System\CjGxIaI.exe
  C:\Windows\System\CjGxIaI.exe
  2⤵
  PID:12832
- C:\Windows\System\TAwgumK.exe
  C:\Windows\System\TAwgumK.exe
  2⤵
  PID:12856
- C:\Windows\System\TjEYCzD.exe
  C:\Windows\System\TjEYCzD.exe
  2⤵
  PID:12964
- C:\Windows\System\DodeGPy.exe
  C:\Windows\System\DodeGPy.exe
  2⤵
  PID:13044
- C:\Windows\System\GPfWMHV.exe
  C:\Windows\System\GPfWMHV.exe
  2⤵
  PID:13132
- C:\Windows\System\DEQKTCa.exe
  C:\Windows\System\DEQKTCa.exe
  2⤵
  PID:13148
- C:\Windows\System\ftEmzyA.exe
  C:\Windows\System\ftEmzyA.exe
  2⤵
  PID:13256
- C:\Windows\System\AieHOaq.exe
  C:\Windows\System\AieHOaq.exe
  2⤵
  PID:13264
- C:\Windows\System\wnkXNwA.exe
  C:\Windows\System\wnkXNwA.exe
  2⤵
  PID:13300
- C:\Windows\System\ptZLokL.exe
  C:\Windows\System\ptZLokL.exe
  2⤵
  PID:12428
- C:\Windows\System\RsDWOQy.exe
  C:\Windows\System\RsDWOQy.exe
  2⤵
  PID:12468
- C:\Windows\System\KURfIVA.exe
  C:\Windows\System\KURfIVA.exe
  2⤵
  PID:12636
- C:\Windows\System\eekcFWI.exe
  C:\Windows\System\eekcFWI.exe
  2⤵
  PID:12664
- C:\Windows\System\PaRswVX.exe
  C:\Windows\System\PaRswVX.exe
  2⤵
  PID:12748
- C:\Windows\System\ufhHAMh.exe
  C:\Windows\System\ufhHAMh.exe
  2⤵
  PID:12816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oebiqux3.ws1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AwjViRG.exe

Filesize
1.6MB

MD5
6cbcc54ff7c01c2389344bf8fb9d5b60

SHA1
b117364ddfddb172cfcfef83e16b29bb35037e1e

SHA256
692d0f8b92a071a81c2481c61566bae761ac0179b6ad387612072d062f58f31b

SHA512
cf638369ba30c8a3a2a702586409580ae2f3fdae04f0cc208c8dd7bbfabbfd20ce700ded44950ca22a2a0f43a33a4f015b342274e8865f5b97fb374da4c8035b

Download Submit
C:\Windows\System\ChZGnlm.exe

Filesize
1.6MB

MD5
fa7b8b68516c241a0db2dba52eb465b3

SHA1
c9462362a1d6656cac872d376e4218dea5962311

SHA256
c786d46aa943e06498a1873aa365e8d9813e03d5b1887801046f17ad5b12dcc4

SHA512
5107c859967fbf6e7dfe4902a352ff36416c400e5775129e4dcdace712a9514316cb1edd056845f9e8f9c0313311de2f419cc16b8aec2f942cdb07c163960fd7

Download Submit
C:\Windows\System\FbryYZX.exe

Filesize
1.6MB

MD5
8313542a71236549e207b7d6a5ef4674

SHA1
bd95c27da293527d506c125df7c36e063512d4e9

SHA256
5399794abe1b358340eda1c8cacced78300f3cee96d085dfdad27d2000ac5f2d

SHA512
445fb062f069d1f4eee8dd9ee27b98d77b6618f9b7ae0e2e1c5372be1022a820f28f484c64a2b90aa17253782b29c794c63af8d67c8fecec39cc8fe4b28d66b3

Download Submit
C:\Windows\System\GmPUskD.exe

Filesize
1.6MB

MD5
ecddf1798985abe1b4aaf7d426811425

SHA1
e5cd4fe89d23408da0005baf3da26435f341aa59

SHA256
1ded0c7e804aad02f9153c462556126efc127ca70b2802c0d9a9c6a19ce63b0e

SHA512
cb2e478aede239e8f39c375b691efa47866d3e6903128ed51051dcc9b885e221baf1900770ff99b66087fc7d7e8e349dcfcd8fce9763174023e582a56eee6f8e

Download Submit
C:\Windows\System\HGrDBVS.exe

Filesize
1.6MB

MD5
02b3e79408043fce61afb0c87339db8b

SHA1
ce6cc61ef6ec0dff477ecbfa8dfea743e192392e

SHA256
3ca362ab7a9fd94cbba1db060730354a3e3ed234ef742002322592e41b4695fe

SHA512
22c442c1f1409a19c4e7f2a67a1cac8b1990e05748d2a3d421d8cf4fe08f0138987d3b8614553663ebf2d696b02578d86c30c57a7c2801728bacd8ab26b19cda

Download Submit
C:\Windows\System\HvXrmgC.exe

Filesize
1.6MB

MD5
0361da147fa353e82bcbd35ea085781b

SHA1
645f70ad55ca91591a871cda4c79a16049c4674d

SHA256
f28a297ad593e86cde10d2828bcd56bd0b66dcb0b6fba6ea715685545a8b8c25

SHA512
44ab5578b5426602b41dd69910dce73dddf7d2a2ff7247975b8e1060ba88d53e80e153386085bd8b7e5994fb1e5f0c9173fd8e612e36176838f30735f0d2fe7d

Download Submit
C:\Windows\System\IMeTWTT.exe

Filesize
1.6MB

MD5
ff60b304abeb94f256c439cbc2bf86a5

SHA1
45cce447dd9194d4b64b3a954d7b28385ce64fcf

SHA256
cd2fbcca1d83b747b4a255e0b4b6c887de804f6baf44837e3c56640b12fa03cb

SHA512
aa8995be88228aa2970375cfa819416da0df900d37248edff00af7355e983f8a91b7cde94e26da31cd2a1c62d542874fed8e949ad6e09cb850d00f8c5bb11182

Download Submit
C:\Windows\System\MmWjKKh.exe

Filesize
1.6MB

MD5
a73da07465dc76c9024b41a421404bea

SHA1
8458e002d10d8369e37290202fba12f76996c877

SHA256
b16ed274467254f53dae15a5b1f7d65c9b39056c85826d7f3866fbf1be4c0802

SHA512
674ab608b1fbd0c3233cebd848a5dd9ac695511eab73d3641ba0a553b6a1a1745f16b12abcf3d8f0c11920a4cffbb8a7442e2ae87d55514fdaac05d2b3f7756d

Download Submit
C:\Windows\System\MqlmPOd.exe

Filesize
1.6MB

MD5
b2a8710ca472d78fd9c757bdc22023f1

SHA1
9798c2b9c3cf10accfbd6fdc8670518d31007285

SHA256
ed9fb60a1ccd547fa0d92a2eda04249a6a508e88ed54b343dd576183a0f7c4f0

SHA512
50f092233dca71426a9347ecfffe7ffd3f51e7de45ba6a4294366aae9f1dfbd67bdcdf2f4d192ad2ea50dca4339fcf46e98508ce2b12d46733e46e113e3a6663

Download Submit
C:\Windows\System\NArAFRu.exe

Filesize
1.6MB

MD5
3af5198384e88f84f67a5ee0c2bbf806

SHA1
cd3e111c1ae4dcfe951d0659f53b5b6ebb6b1aec

SHA256
f0d9a5ea4165cb62160959cd06f21a4cceda640fcd720d74f5db4c7960a93479

SHA512
c975fddb7a8e047e99873f678021dc6ea134269a0a2503d313cdea853e4764d5c92eb9441cb221405ddd7cb93c37b28329592eb8a729d2e8224d52c79e81a7ca

Download Submit
C:\Windows\System\NpAFSkG.exe

Filesize
1.6MB

MD5
a68f24747f0f2120765d0d69c05f40df

SHA1
e9b060acdadd13dc78be57944a3b024a397299e7

SHA256
4179f80c640ce72560f69352aa3c7abddb0dea360e254a5e6379ef57e7a48e05

SHA512
57d09f1eaac26744d2450123bca4d6f8fd70c1dfcd5729f1725b41521b67df460daf47fa84cf92ac9fa7fb8340130dbf4e9fc4167e5271f1384e8f2efe8ad0aa

Download Submit
C:\Windows\System\PWtVfhY.exe

Filesize
1.6MB

MD5
68e87c94a77bacea7ae3799359ae4310

SHA1
fadfedb61111e6147fd1e0f5cc51993ff6539536

SHA256
0f260f658fd099d29e626998a81c077f0815af513f42d62f9a6e5c0c1aadbf1e

SHA512
2c1c370ce3b9a84083a8a7553061ed6bf7d625a92f4d188f2ad0a1637f729d879f9e938850482cd5267d58e154232a2534ff263c2929bf31c0f6b3b724d80085

Download Submit
C:\Windows\System\PuKWMRH.exe

Filesize
1.6MB

MD5
5bdf2c952dace51b4c5525c72b478a57

SHA1
5b371200b2025ef1aee6df45c6f26c42b4932909

SHA256
481d3fe5eec4132520adfb41a1e1916c19ebe7c718600886c81deb4c7c71f12c

SHA512
cb51f7082a532bba88fd27ded9ca56aa5275481149b6825d32e6be7ef291c26265a8b056773ad2958e5888ed3fcfaa887dbcf42d15827e0cb566d004a7c56c58

Download Submit
C:\Windows\System\QuATbNR.exe

Filesize
1.6MB

MD5
7628b5023e5f93176c53283afbb5795e

SHA1
91223dc0d5d8bd27b7e0057f9215760f58690514

SHA256
2ad7e52b6e31ed11822a6042c2b4552c02ad61e81f652c8c51441cf6feb8936d

SHA512
5e34c7050bc9ec112c10391f2564844e7c8682891fb76968c3b8f17ac41196644cc0b4a18d84643ce2a8243b70c2de1cf3d66e5ce58810839abc582e2bb80cc4

Download Submit
C:\Windows\System\TQpdCXl.exe

Filesize
1.6MB

MD5
17c50f753e15b230906673693dab8bd7

SHA1
2c08af60148be43d4941a3fd966ed9151b60dea5

SHA256
91a4ac2526ead30f47881fdb42eb3a58edcc83a655dcaf6b79927990073a93eb

SHA512
e8084aaf0a97f313ed37e6bb1315dfff948be1d471cc4452b41f2ffad6b665078f7af4f6c2202c3d29a49ff4d2a741ba527484937d70d88cfa32ba54228ce7aa

Download Submit
C:\Windows\System\USQqKaJ.exe

Filesize
1.6MB

MD5
353e4900b0e214da90d95823518c2f4b

SHA1
3ce0f7462c9e56de5a4c17bd7c1e07bf2f637ad7

SHA256
6a9aa64a086d126c02a57b9404ab1bb8c9d2601b016650392959b086d2ed9d5a

SHA512
17c3692fa3ee3fa85526a278bbbc759c195a59b555fe149cc04972f9bdcaa4267e3547be6da8f588732884dc819f9636eeffa03696a2e64283499b1e40e57f25

Download Submit
C:\Windows\System\VTwPLTS.exe

Filesize
1.6MB

MD5
cd6f2c6fdfe62ecd65ce592f140b908c

SHA1
34c2f8c944ce785e3ba4aaef57219f51d73e532d

SHA256
58aec524c8dea96a6b9e78fef0627378067951362123add959d7ff643f62dbaa

SHA512
5b527da90d25fe7ecb3d12b3eb97feda87f5a866e50a92741c8da05dd984f6585be7ee4c61ddd6812bc75ad5741ea83ba8c5ccd51cab49a97a3ff4f7275606a8

Download Submit
C:\Windows\System\YBsLsyh.exe

Filesize
1.6MB

MD5
ce5af6a1600d4dfac13960662e7294f9

SHA1
308fe4bb77501d2965c6d169f74172407ddc5d4b

SHA256
fb203f23bddd3e971f5821815189ad10d2ed54c31113ee4eb0bd1151a1743a89

SHA512
9abf0e2988cde470ef9d3a23ebf6578d6407e98c34b865cd20e7c58be02da4c8c496687b5aa0a240b00bc7f137255e0ba839842d7de59b211174fdf1a30b69a8

Download Submit
C:\Windows\System\dHabjHv.exe

Filesize
1.6MB

MD5
d0c50bb7e38b920e4d4674baa687d3d3

SHA1
29287bd7d63dbbd3d6c2e4cf45ec1a01f5d61f2d

SHA256
15dc0dabe547de70483fce24f2f4cbcbd8cce0260dc762c01d564163a041247a

SHA512
7b1ac19cdf32ab6f4792f46023a63caf5aceeaa672d377e6b53cb2c5b9bfeb345f31c4bfbf5c7f85f1369b53ebfeffdc8314b10a04df070686ab7d7389d7da69

Download Submit
C:\Windows\System\eIQqtjR.exe

Filesize
1.6MB

MD5
7e304b572902c511c9cf03eea014f2ae

SHA1
ebc2a52f01311decfcb0e41b27874d2ad8e85677

SHA256
583d5c4d740fc04e9934651852fcf36099a39458bfb5d63c48dbeebe9efc6c63

SHA512
e3a3506fc4af6dcb96a8fc6aa805dc7a5d6c99c3c69fdc197fc519955b1da66a73f39ad9bd021bd5a2c83ce0d464750ef491f69dd87458dc335d4d790b8e4a6b

Download Submit
C:\Windows\System\egmOzWZ.exe

Filesize
1.6MB

MD5
461c2d1b1b8e054d1b116c411fbb7bea

SHA1
e349c7cf1bb879bc1e16ea7c2e85b7c45ff6a5dd

SHA256
65dfe97f2ee429d2964d347d283c8ffc15ec13f49a3f1f2788454f6449c8507f

SHA512
d3632765c1c14357bd26867aabbd93f315e199aab8a480a5becf0d258b1147641a108c7ea08904d9243e55f32f0ecd7a58a0fd19c35f475c76abeac5229d4879

Download Submit
C:\Windows\System\iUwiczB.exe

Filesize
1.6MB

MD5
672a08d812d39af136857261446d31ae

SHA1
af27ec35c25ee76716fc1682038251e39596eb4b

SHA256
191434fca00c4a82b597b69a021106b033e3e769cfe8cf010f47d3f9d4699a36

SHA512
973515b0ae7b1e818288c67370d675aa0ac6fab11f1d78c2a58a99324873eb6ca54e97bbf296be107bbe6e5d98deac4cc9f77cfcc98b0a56e15e641b5ddb69f5

Download Submit
C:\Windows\System\ilhHDsI.exe

Filesize
1.6MB

MD5
8231a5cc345b6d2c56a3658f7d1bd700

SHA1
051534120a90a6d62c6e0fe70428c0585b4c4bf6

SHA256
81e731556559c9b2254633257512878dfe4a7a38bda807a9b3d1d019a479ffde

SHA512
80bcce04082565ec697cf2fc471fc65a56259b520a7820c2d9f9682fdad6a5b45d87704dc7c84d4b37191b76d27e50d4b8b40344be9d778c288fa96ac34fe821

Download Submit
C:\Windows\System\iqEKPuL.exe

Filesize
1.6MB

MD5
44998ff409066d939bc52c2e3e34e8da

SHA1
246f54aa1a987bf5a02a2a2205772abfd017be05

SHA256
0d3c4a2783567dbfb82cc4c20f796ea68ad307e890289c0099ee9032bfa9a5cc

SHA512
e238e7058a10cdc36ea676bb85b5b0f9cdd15d8d0a60997fb53869b849a06c61c3b92a8670392236ee8b96e3228301de9f0c47a9a2773b23152f0b0d4a909495

Download Submit
C:\Windows\System\jiCRgmQ.exe

Filesize
1.6MB

MD5
d5e67b837ea026f47b336400718954fc

SHA1
e50e9d3d9147e976a96898bba342abe004e39360

SHA256
52c9a0c81d327498fe9cee754ecfa12aa0f68db1b6cc6c688feb9208a7ef690b

SHA512
6ed50d34e3e018066d0fd92591ce5673a1d6d7c142fd547c339a51a16b0d2a067db113692ed35a9f1d50c836a12f04e3e86c38e0f2394ce89a0647e2fd4ac9ab

Download Submit
C:\Windows\System\nOyqsqC.exe

Filesize
1.6MB

MD5
75154d3a206cb08f607c6f805a53adf6

SHA1
358c1a0582d131b367bf40161e205ef3bbed06f3

SHA256
6b07addd48d16d05c6dc2c3534c3ca7bdf99b80aa891a25dd3c8916ef9483571

SHA512
96167edaa79d52fd1e4415314e45c6ebd803579feb0fca9607286da667e0c13da8e3e823ace1ad977c19e438f651e0184c847cf21e161c436c941c5bc8b023e4

Download Submit
C:\Windows\System\pYTsjIl.exe

Filesize
1.6MB

MD5
161b2c3faa7ad3d5f36c1ffa757a16f9

SHA1
9fa3e2eecfc5121a0df8f478eeec9343e623e8cf

SHA256
8851c74c19ac9888a015f266fdb13adc216c43981c703c60491f62d6415d94d4

SHA512
0f705dfaa4248f5c55bdba50e8ebd5cdc6c018a0a5a7a0ec68cbb79f0388aa560a6374f2ec81043455238470d18e22d7714401bffd96ab7fd1d4053b7cbf96a8

Download Submit
C:\Windows\System\pbjfonq.exe

Filesize
1.6MB

MD5
b1808b17d7d7feff93093e3e17ac2dbc

SHA1
6e70ff08f5049ec0862a2a0e770fb59daeac32f9

SHA256
29c8a3c100946511029c840702caaaff3e19f9e95880233a9426bc81fb71a137

SHA512
8e3513b34eb03922c313fe5500057774acc24cf74d2298437339c5c5a99d93b158d04f7089dac2619fa2167e295e81d279d8c4718b9f8bf7ed26ae0fae539082

Download Submit
C:\Windows\System\tTWyicR.exe

Filesize
1.6MB

MD5
3fe50c2fbb78a10a992330102ec8b29a

SHA1
58c2249cff98acb117345783a78e517a3c56ed34

SHA256
f6ca957fd3e01f1574f900c875192b9166084719ab09ec3800bd23a7600f0114

SHA512
5b68b5ad6f630c93a89d466013f5d1d9838ac0eec25a05f8e2d8b4678e07631ef0ca63ce73dd5da094e2a753e8b1e5a80cd8676cd875ad0cd57e2a84bfee0961

Download Submit
C:\Windows\System\vFLEsSn.exe

Filesize
1.6MB

MD5
b4ab347b5310583818b37c7c20aa1385

SHA1
25f4df3234a9de30821064287632d407822759b0

SHA256
d24e1bedb7071d9c76cafb8dba1395dba69c1a8fd1abee3a1a71be89b9a313dd

SHA512
6f8707e545e71e4c128faf9e36ec48d28cd00afb6b5729f1e8d6225204911720f8097ea711a25ce440f766f6ccf3c5fdfc434a70445a15eac4a0786518fe3b5e

Download Submit
C:\Windows\System\vjXEkBF.exe

Filesize
1.6MB

MD5
b737f4dc912e4e45f822cb17edec5226

SHA1
f7561c9169fe6d9f3291b9b4dc593bcedc67c4fd

SHA256
c146c7f381086756c569fd0cb70b2fb9c519edd352ff8c8063bc4e70f16d7971

SHA512
9176e91d2d68cc711faedaf50e5aa7224bc06591111fa28e550ca8a5b3651dbff5e04be3f11b695cf9adc601b3c97b305a2a4b786f23244b6d3ba37ddf1a7daf

Download Submit
C:\Windows\System\vqznsbb.exe

Filesize
1.6MB

MD5
636c321a8fae84642b9a678427ac8fd4

SHA1
86417cbfd7f9c35562c19f883bc756e51dfd8cae

SHA256
bdaf0e71ed27db1034fa77ca5fc80643d3852498c4ee50c7f4d8a494e9dcfff8

SHA512
b3843aba0dab98c01b9827fa6f92e63c1ed6da79a231ea473da42996ff96febcc32b34a8e1d3370b2c60ffa17eddcf1a569422d6901b3f5cc78ebee8b191eb68

Download Submit
C:\Windows\System\wwMCjZz.exe

Filesize
1.6MB

MD5
0ffc90eb8688d811516ca9ea1dc470db

SHA1
0af69449d6472eaf78f4c2711d75ebcfae7fec2d

SHA256
c0f37cf45872b9bd32afa2ad3f37a64924eb26a7ca6afccebbd188ed8f1be8f9

SHA512
3f0898e9370f41c46f512590b94447b1a961ec4842370f404798e45a6820027d98d551f80e5dcfda67662594c31e7afa1705f09cda4f414aff0086407e00e0e4

Download Submit
memory/64-464-0x00007FF6171C0000-0x00007FF6175B2000-memory.dmp

Filesize
3.9MB

Download
memory/64-2076-0x00007FF6171C0000-0x00007FF6175B2000-memory.dmp

Filesize
3.9MB

Download
memory/644-2083-0x00007FF773B60000-0x00007FF773F52000-memory.dmp

Filesize
3.9MB

Download
memory/644-478-0x00007FF773B60000-0x00007FF773F52000-memory.dmp

Filesize
3.9MB

Download
memory/752-2058-0x00007FF67A2B0000-0x00007FF67A6A2000-memory.dmp

Filesize
3.9MB

Download
memory/752-2049-0x00007FF67A2B0000-0x00007FF67A6A2000-memory.dmp

Filesize
3.9MB

Download
memory/752-7-0x00007FF67A2B0000-0x00007FF67A6A2000-memory.dmp

Filesize
3.9MB

Download
memory/1056-0-0x00007FF7AD0F0000-0x00007FF7AD4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1056-1-0x0000013BA4100000-0x0000013BA4110000-memory.dmp

Filesize
64KB

Download
memory/1176-76-0x0000021464C30000-0x0000021464C52000-memory.dmp

Filesize
136KB

Download
memory/1176-24-0x00007FFE627D0000-0x00007FFE63291000-memory.dmp

Filesize
10.8MB

Download
memory/1176-25-0x0000021464D20000-0x0000021464D30000-memory.dmp

Filesize
64KB

Download
memory/1228-31-0x00007FF6526C0000-0x00007FF652AB2000-memory.dmp

Filesize
3.9MB

Download
memory/1228-2060-0x00007FF6526C0000-0x00007FF652AB2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-489-0x00007FF629F60000-0x00007FF62A352000-memory.dmp

Filesize
3.9MB

Download
memory/1460-2056-0x00007FF629F60000-0x00007FF62A352000-memory.dmp

Filesize
3.9MB

Download
memory/1804-2070-0x00007FF659E90000-0x00007FF65A282000-memory.dmp

Filesize
3.9MB

Download
memory/1804-500-0x00007FF659E90000-0x00007FF65A282000-memory.dmp

Filesize
3.9MB

Download
memory/2124-452-0x00007FF7F7F00000-0x00007FF7F82F2000-memory.dmp

Filesize
3.9MB

Download
memory/2124-2053-0x00007FF7F7F00000-0x00007FF7F82F2000-memory.dmp

Filesize
3.9MB

Download
memory/2124-2085-0x00007FF7F7F00000-0x00007FF7F82F2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-2051-0x00007FF62B010000-0x00007FF62B402000-memory.dmp

Filesize
3.9MB

Download
memory/2176-82-0x00007FF62B010000-0x00007FF62B402000-memory.dmp

Filesize
3.9MB

Download
memory/2176-2072-0x00007FF62B010000-0x00007FF62B402000-memory.dmp

Filesize
3.9MB

Download
memory/2264-2092-0x00007FF7FF920000-0x00007FF7FFD12000-memory.dmp

Filesize
3.9MB

Download
memory/2264-510-0x00007FF7FF920000-0x00007FF7FFD12000-memory.dmp

Filesize
3.9MB

Download
memory/2800-2063-0x00007FF656D70000-0x00007FF657162000-memory.dmp

Filesize
3.9MB

Download
memory/2800-41-0x00007FF656D70000-0x00007FF657162000-memory.dmp

Filesize
3.9MB

Download
memory/3228-2065-0x00007FF69FAA0000-0x00007FF69FE92000-memory.dmp

Filesize
3.9MB

Download
memory/3228-496-0x00007FF69FAA0000-0x00007FF69FE92000-memory.dmp

Filesize
3.9MB

Download
memory/3272-505-0x00007FF6430C0000-0x00007FF6434B2000-memory.dmp

Filesize
3.9MB

Download
memory/3272-2094-0x00007FF6430C0000-0x00007FF6434B2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-493-0x00007FF7F3610000-0x00007FF7F3A02000-memory.dmp

Filesize
3.9MB

Download
memory/3540-2068-0x00007FF7F3610000-0x00007FF7F3A02000-memory.dmp

Filesize
3.9MB

Download
memory/3548-485-0x00007FF6C14D0000-0x00007FF6C18C2000-memory.dmp

Filesize
3.9MB

Download
memory/3548-2096-0x00007FF6C14D0000-0x00007FF6C18C2000-memory.dmp

Filesize
3.9MB

Download
memory/3724-508-0x00007FF79CD80000-0x00007FF79D172000-memory.dmp

Filesize
3.9MB

Download
memory/3724-2087-0x00007FF79CD80000-0x00007FF79D172000-memory.dmp

Filesize
3.9MB

Download
memory/4284-2079-0x00007FF67D370000-0x00007FF67D762000-memory.dmp

Filesize
3.9MB

Download
memory/4284-483-0x00007FF67D370000-0x00007FF67D762000-memory.dmp

Filesize
3.9MB

Download
memory/4620-2067-0x00007FF7AD940000-0x00007FF7ADD32000-memory.dmp

Filesize
3.9MB

Download
memory/4620-2050-0x00007FF7AD940000-0x00007FF7ADD32000-memory.dmp

Filesize
3.9MB

Download
memory/4620-62-0x00007FF7AD940000-0x00007FF7ADD32000-memory.dmp

Filesize
3.9MB

Download
memory/4628-2088-0x00007FF72D1B0000-0x00007FF72D5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4628-94-0x00007FF72D1B0000-0x00007FF72D5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4628-2054-0x00007FF72D1B0000-0x00007FF72D5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-2080-0x00007FF600F60000-0x00007FF601352000-memory.dmp

Filesize
3.9MB

Download
memory/4748-469-0x00007FF600F60000-0x00007FF601352000-memory.dmp

Filesize
3.9MB

Download
memory/4828-2090-0x00007FF6B5B40000-0x00007FF6B5F32000-memory.dmp

Filesize
3.9MB

Download
memory/4828-460-0x00007FF6B5B40000-0x00007FF6B5F32000-memory.dmp

Filesize
3.9MB

Download
memory/4960-2052-0x00007FF6E0F90000-0x00007FF6E1382000-memory.dmp

Filesize
3.9MB

Download
memory/4960-88-0x00007FF6E0F90000-0x00007FF6E1382000-memory.dmp

Filesize
3.9MB

Download
memory/4960-2075-0x00007FF6E0F90000-0x00007FF6E1382000-memory.dmp

Filesize
3.9MB

Download