xmrig | f106fff8a863e0ea03948fc194459e8542046f8b12dbf77bea4335d214621ce1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
Size 1.9MB
Sample240501-d2w5xaha75
SHA256 f106fff8a863e0ea03948fc194459e8542046f8b12dbf77bea4335d214621ce1
MD5 0b0274d447b084fcdc3635587944df99
SHA1 ed273d0569a6b85825c38386f43eaf98baefa5b3
SHA512 4e1790fda1eae6c7663178fb093f14b0286040ca309ba0ea06445c90e97d100e5bbb1cd6f95705d92dfca5b6324e7e96a4173d54d0335747e48390f4401e973e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlB:NABe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4004-56-0x00007FF7267A0000-0x00007FF726B92000-memory.dmp	xmrig
behavioral2/memory/4988-538-0x00007FF7A3110000-0x00007FF7A3502000-memory.dmp	xmrig
behavioral2/memory/1320-607-0x00007FF72C690000-0x00007FF72CA82000-memory.dmp	xmrig
behavioral2/memory/4764-659-0x00007FF72A630000-0x00007FF72AA22000-memory.dmp	xmrig
behavioral2/memory/3300-658-0x00007FF776B30000-0x00007FF776F22000-memory.dmp	xmrig
behavioral2/memory/1788-657-0x00007FF603D70000-0x00007FF604162000-memory.dmp	xmrig
behavioral2/memory/3240-603-0x00007FF754ED0000-0x00007FF7552C2000-memory.dmp	xmrig
behavioral2/memory/4024-478-0x00007FF73CB00000-0x00007FF73CEF2000-memory.dmp	xmrig
behavioral2/memory/2928-429-0x00007FF70C150000-0x00007FF70C542000-memory.dmp	xmrig
behavioral2/memory/1924-426-0x00007FF6D47B0000-0x00007FF6D4BA2000-memory.dmp	xmrig
behavioral2/memory/3540-343-0x00007FF7A55E0000-0x00007FF7A59D2000-memory.dmp	xmrig
behavioral2/memory/4108-346-0x00007FF62B790000-0x00007FF62BB82000-memory.dmp	xmrig
behavioral2/memory/1532-298-0x00007FF71A9F0000-0x00007FF71ADE2000-memory.dmp	xmrig
behavioral2/memory/3720-264-0x00007FF635F50000-0x00007FF636342000-memory.dmp	xmrig
behavioral2/memory/1668-194-0x00007FF776EC0000-0x00007FF7772B2000-memory.dmp	xmrig
behavioral2/memory/1164-199-0x00007FF62B6F0000-0x00007FF62BAE2000-memory.dmp	xmrig
behavioral2/memory/4636-146-0x00007FF636AC0000-0x00007FF636EB2000-memory.dmp	xmrig
behavioral2/memory/3288-110-0x00007FF62F3B0000-0x00007FF62F7A2000-memory.dmp	xmrig
behavioral2/memory/4784-107-0x00007FF7570C0000-0x00007FF7574B2000-memory.dmp	xmrig
behavioral2/memory/4964-76-0x00007FF661C30000-0x00007FF662022000-memory.dmp	xmrig
behavioral2/memory/388-3683-0x00007FF611E60000-0x00007FF612252000-memory.dmp	xmrig
behavioral2/memory/388-3685-0x00007FF611E60000-0x00007FF612252000-memory.dmp	xmrig
behavioral2/memory/4964-3687-0x00007FF661C30000-0x00007FF662022000-memory.dmp	xmrig
behavioral2/memory/1320-3689-0x00007FF72C690000-0x00007FF72CA82000-memory.dmp	xmrig
behavioral2/memory/3288-3692-0x00007FF62F3B0000-0x00007FF62F7A2000-memory.dmp	xmrig
behavioral2/memory/4004-3693-0x00007FF7267A0000-0x00007FF726B92000-memory.dmp	xmrig
behavioral2/memory/4636-3695-0x00007FF636AC0000-0x00007FF636EB2000-memory.dmp	xmrig
behavioral2/memory/3300-3701-0x00007FF776B30000-0x00007FF776F22000-memory.dmp	xmrig
behavioral2/memory/4784-3703-0x00007FF7570C0000-0x00007FF7574B2000-memory.dmp	xmrig
behavioral2/memory/3720-3700-0x00007FF635F50000-0x00007FF636342000-memory.dmp	xmrig
behavioral2/memory/1532-3698-0x00007FF71A9F0000-0x00007FF71ADE2000-memory.dmp	xmrig
behavioral2/memory/4024-3718-0x00007FF73CB00000-0x00007FF73CEF2000-memory.dmp	xmrig
behavioral2/memory/1668-3722-0x00007FF776EC0000-0x00007FF7772B2000-memory.dmp	xmrig
behavioral2/memory/2928-3720-0x00007FF70C150000-0x00007FF70C542000-memory.dmp	xmrig
behavioral2/memory/4988-3717-0x00007FF7A3110000-0x00007FF7A3502000-memory.dmp	xmrig
behavioral2/memory/3540-3711-0x00007FF7A55E0000-0x00007FF7A59D2000-memory.dmp	xmrig
behavioral2/memory/1924-3707-0x00007FF6D47B0000-0x00007FF6D4BA2000-memory.dmp	xmrig
behavioral2/memory/3240-3715-0x00007FF754ED0000-0x00007FF7552C2000-memory.dmp	xmrig
behavioral2/memory/1164-3713-0x00007FF62B6F0000-0x00007FF62BAE2000-memory.dmp	xmrig
behavioral2/memory/4108-3709-0x00007FF62B790000-0x00007FF62BB82000-memory.dmp	xmrig
behavioral2/memory/1788-3756-0x00007FF603D70000-0x00007FF604162000-memory.dmp	xmrig
behavioral2/memory/4764-3760-0x00007FF72A630000-0x00007FF72AA22000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
388	eXpXzmE.exe
1320	przGDKC.exe
4004	QCZkRKz.exe
4964	CwmUlIb.exe
4784	QwbCwJs.exe
3288	UQAtDlv.exe
4636	gAMijFQ.exe
1668	vFnLHCh.exe
1164	YuNOFMt.exe
3720	AtKAdMP.exe
1788	DEDAciC.exe
1532	ENFhPtH.exe
3540	DyYTAgX.exe
4108	uOcsxJl.exe
1924	EoVeQHu.exe
3300	garmWMD.exe
2928	BGxspgN.exe
4024	YkdmQdO.exe
4988	pXxQlNf.exe
3240	BLQRyTu.exe
4764	ubgfYTd.exe
4404	ENgpEnE.exe
5048	siCldxX.exe
4648	LNhHJkx.exe
4652	MqUxGcL.exe
3488	TxSJAkm.exe
2416	acWQkLO.exe
2324	nLxtZDA.exe
4352	STCcvyV.exe
5040	GjiRbxb.exe
1356	dACBjLo.exe
460	LmgszrH.exe
3768	IXQcQam.exe
3496	tbKAeta.exe
4156	UbMFBEr.exe
4548	ucxzOVb.exe
1848	oXBHGZG.exe
436	BfiMLJC.exe
4996	HiYUlBf.exe
4392	TRjgrIL.exe
1156	peGfgbw.exe
4936	VoSMYlm.exe
4624	MAzGTMg.exe
4172	WOwtQMf.exe
2720	FfsYhHV.exe
4068	jGuoIPX.exe
5008	pATZVNc.exe
1420	xAjPKsa.exe
3672	ggLlaRg.exe
3544	pLLEBJN.exe
3264	OaZMnWa.exe
4984	SmDDZeS.exe
3892	jylhgOS.exe
4444	BLXWwgg.exe
3740	CLJYSHD.exe
1888	sNNWFRX.exe
2112	pTEDdTO.exe
4372	jqDBEcC.exe
5104	ZOplFSR.exe
712	UNsZDYk.exe
2504	vutrzWa.exe
3656	NvhHQQY.exe
512	QagjUci.exe
1076	XupMJTZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4816-0-0x00007FF6B70A0000-0x00007FF6B7492000-memory.dmp	upx
behavioral2/files/0x0008000000023445-5.dat	upx
behavioral2/memory/388-12-0x00007FF611E60000-0x00007FF612252000-memory.dmp	upx
behavioral2/files/0x000700000002344a-17.dat	upx
behavioral2/files/0x0007000000023449-37.dat	upx
behavioral2/files/0x000700000002344d-36.dat	upx
behavioral2/files/0x000700000002344c-31.dat	upx
behavioral2/files/0x000700000002344f-43.dat	upx
behavioral2/files/0x0008000000023448-18.dat	upx
behavioral2/files/0x000700000002344b-27.dat	upx
behavioral2/memory/4004-56-0x00007FF7267A0000-0x00007FF726B92000-memory.dmp	upx
behavioral2/files/0x0007000000023456-71.dat	upx
behavioral2/files/0x000700000002345b-102.dat	upx
behavioral2/memory/4988-538-0x00007FF7A3110000-0x00007FF7A3502000-memory.dmp	upx
behavioral2/memory/1320-607-0x00007FF72C690000-0x00007FF72CA82000-memory.dmp	upx
behavioral2/memory/4764-659-0x00007FF72A630000-0x00007FF72AA22000-memory.dmp	upx
behavioral2/memory/3300-658-0x00007FF776B30000-0x00007FF776F22000-memory.dmp	upx
behavioral2/memory/1788-657-0x00007FF603D70000-0x00007FF604162000-memory.dmp	upx
behavioral2/memory/3240-603-0x00007FF754ED0000-0x00007FF7552C2000-memory.dmp	upx
behavioral2/memory/4024-478-0x00007FF73CB00000-0x00007FF73CEF2000-memory.dmp	upx
behavioral2/memory/2928-429-0x00007FF70C150000-0x00007FF70C542000-memory.dmp	upx
behavioral2/memory/1924-426-0x00007FF6D47B0000-0x00007FF6D4BA2000-memory.dmp	upx
behavioral2/memory/3540-343-0x00007FF7A55E0000-0x00007FF7A59D2000-memory.dmp	upx
behavioral2/memory/4108-346-0x00007FF62B790000-0x00007FF62BB82000-memory.dmp	upx
behavioral2/memory/1532-298-0x00007FF71A9F0000-0x00007FF71ADE2000-memory.dmp	upx
behavioral2/memory/3720-264-0x00007FF635F50000-0x00007FF636342000-memory.dmp	upx
behavioral2/memory/1668-194-0x00007FF776EC0000-0x00007FF7772B2000-memory.dmp	upx
behavioral2/files/0x000700000002346f-192.dat	upx
behavioral2/files/0x000700000002346e-189.dat	upx
behavioral2/files/0x000700000002346d-188.dat	upx
behavioral2/files/0x0007000000023459-176.dat	upx
behavioral2/files/0x0007000000023455-173.dat	upx
behavioral2/files/0x000700000002346a-168.dat	upx
behavioral2/files/0x0007000000023469-167.dat	upx
behavioral2/files/0x0007000000023460-164.dat	upx
behavioral2/files/0x0007000000023468-161.dat	upx
behavioral2/memory/1164-199-0x00007FF62B6F0000-0x00007FF62BAE2000-memory.dmp	upx
behavioral2/files/0x0007000000023467-159.dat	upx
behavioral2/files/0x000700000002345c-193.dat	upx
behavioral2/files/0x0007000000023466-157.dat	upx
behavioral2/files/0x000700000002344e-156.dat	upx
behavioral2/files/0x0007000000023465-150.dat	upx
behavioral2/memory/4636-146-0x00007FF636AC0000-0x00007FF636EB2000-memory.dmp	upx
behavioral2/files/0x000700000002346c-187.dat	upx
behavioral2/files/0x0007000000023464-145.dat	upx
behavioral2/files/0x0007000000023463-144.dat	upx
behavioral2/files/0x0007000000023462-143.dat	upx
behavioral2/files/0x000700000002346b-169.dat	upx
behavioral2/files/0x0007000000023452-133.dat	upx
behavioral2/files/0x0007000000023454-128.dat	upx
behavioral2/files/0x0007000000023458-124.dat	upx
behavioral2/files/0x000700000002345f-123.dat	upx
behavioral2/files/0x000700000002345e-122.dat	upx
behavioral2/files/0x000700000002345d-121.dat	upx
behavioral2/files/0x0007000000023450-113.dat	upx
behavioral2/memory/3288-110-0x00007FF62F3B0000-0x00007FF62F7A2000-memory.dmp	upx
behavioral2/memory/4784-107-0x00007FF7570C0000-0x00007FF7574B2000-memory.dmp	upx
behavioral2/files/0x000700000002345a-142.dat	upx
behavioral2/files/0x0007000000023461-141.dat	upx
behavioral2/files/0x0007000000023453-88.dat	upx
behavioral2/files/0x0007000000023457-82.dat	upx
behavioral2/files/0x0007000000023451-81.dat	upx
behavioral2/memory/4964-76-0x00007FF661C30000-0x00007FF662022000-memory.dmp	upx
behavioral2/memory/388-3683-0x00007FF611E60000-0x00007FF612252000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IAXyhBj.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\KXiAIOc.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\YeWvWpX.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\ZrGpoyZ.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\dvsHGSq.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\QTciltQ.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\OWYUTtH.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\ZWePGyG.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\hQupTbm.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\RCqgcWS.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\jQBAwEB.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\TtMtRKd.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\REVgbpc.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\osxjZEj.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\aCSHDhz.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\DTyyugX.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\ypQOJtj.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\lJYWwyj.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\qsQnsNq.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\fJULalt.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\nbimWwW.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\JIFhQDr.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\DyYTAgX.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\uxOwoUm.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\iMnurxT.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\ZwglbPo.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\mcQCiOA.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\YEAYyFw.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\wnNPLCn.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\SvXVeki.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\YoGEibb.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\VoSMYlm.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\QTQQxQm.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\QQLebRT.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\NjnYhtd.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\RZgBmqQ.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\oHZhQBT.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\ZQOLRlx.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\QCrSvfR.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\qlAggxv.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\UhFpSpM.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\SnfjrMr.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\CZLOBfP.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\pipnrGY.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\rnUyfjI.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\EqqBhSt.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\rxStths.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\VCvilBV.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\SEdPGNQ.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\ZHLsBqH.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\coAxRqs.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\OfPCwvC.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\jeNVtRM.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\twaRVsj.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\PgZnrfh.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\UtOavOz.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\aOldZds.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\JBgRsgG.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\WVjevCy.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\McUpiHT.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\eumAwFL.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\ZOjGpyJ.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\OrZkJcn.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
File created	C:\Windows\System\rlxOIFC.exe	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3704	powershell.exe
3704	powershell.exe
3704	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
Token: SeDebugPrivilege	3704	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3704	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	84
PID 4816 wrote to memory of 3704	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	84
PID 4816 wrote to memory of 388	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	85
PID 4816 wrote to memory of 388	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	85
PID 4816 wrote to memory of 1320	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	86
PID 4816 wrote to memory of 1320	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	86
PID 4816 wrote to memory of 4004	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	87
PID 4816 wrote to memory of 4004	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	87
PID 4816 wrote to memory of 4964	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	88
PID 4816 wrote to memory of 4964	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	88
PID 4816 wrote to memory of 4784	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	89
PID 4816 wrote to memory of 4784	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	89
PID 4816 wrote to memory of 3288	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	90
PID 4816 wrote to memory of 3288	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	90
PID 4816 wrote to memory of 4636	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	91
PID 4816 wrote to memory of 4636	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	91
PID 4816 wrote to memory of 1788	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	92
PID 4816 wrote to memory of 1788	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	92
PID 4816 wrote to memory of 1668	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	93
PID 4816 wrote to memory of 1668	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	93
PID 4816 wrote to memory of 1164	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	94
PID 4816 wrote to memory of 1164	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	94
PID 4816 wrote to memory of 3720	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	95
PID 4816 wrote to memory of 3720	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	95
PID 4816 wrote to memory of 4108	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	96
PID 4816 wrote to memory of 4108	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	96
PID 4816 wrote to memory of 1532	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	97
PID 4816 wrote to memory of 1532	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	97
PID 4816 wrote to memory of 3540	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	98
PID 4816 wrote to memory of 3540	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	98
PID 4816 wrote to memory of 4024	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	99
PID 4816 wrote to memory of 4024	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	99
PID 4816 wrote to memory of 1924	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	100
PID 4816 wrote to memory of 1924	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	100
PID 4816 wrote to memory of 3300	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	101
PID 4816 wrote to memory of 3300	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	101
PID 4816 wrote to memory of 2928	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	102
PID 4816 wrote to memory of 2928	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	102
PID 4816 wrote to memory of 4988	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	103
PID 4816 wrote to memory of 4988	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	103
PID 4816 wrote to memory of 2416	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	104
PID 4816 wrote to memory of 2416	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	104
PID 4816 wrote to memory of 3240	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	105
PID 4816 wrote to memory of 3240	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	105
PID 4816 wrote to memory of 4764	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	106
PID 4816 wrote to memory of 4764	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	106
PID 4816 wrote to memory of 4404	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	107
PID 4816 wrote to memory of 4404	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	107
PID 4816 wrote to memory of 5048	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	108
PID 4816 wrote to memory of 5048	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	108
PID 4816 wrote to memory of 4648	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	109
PID 4816 wrote to memory of 4648	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	109
PID 4816 wrote to memory of 4652	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	110
PID 4816 wrote to memory of 4652	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	110
PID 4816 wrote to memory of 3488	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	111
PID 4816 wrote to memory of 3488	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	111
PID 4816 wrote to memory of 2324	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	112
PID 4816 wrote to memory of 2324	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	112
PID 4816 wrote to memory of 4352	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	113
PID 4816 wrote to memory of 4352	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	113
PID 4816 wrote to memory of 5040	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	114
PID 4816 wrote to memory of 5040	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	114
PID 4816 wrote to memory of 1356	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	115
PID 4816 wrote to memory of 1356	4816	0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b0274d447b084fcdc3635587944df99_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3704
- C:\Windows\System\eXpXzmE.exe
  C:\Windows\System\eXpXzmE.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\przGDKC.exe
  C:\Windows\System\przGDKC.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\QCZkRKz.exe
  C:\Windows\System\QCZkRKz.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\CwmUlIb.exe
  C:\Windows\System\CwmUlIb.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\QwbCwJs.exe
  C:\Windows\System\QwbCwJs.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\UQAtDlv.exe
  C:\Windows\System\UQAtDlv.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\gAMijFQ.exe
  C:\Windows\System\gAMijFQ.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\DEDAciC.exe
  C:\Windows\System\DEDAciC.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\vFnLHCh.exe
  C:\Windows\System\vFnLHCh.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\YuNOFMt.exe
  C:\Windows\System\YuNOFMt.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\AtKAdMP.exe
  C:\Windows\System\AtKAdMP.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\uOcsxJl.exe
  C:\Windows\System\uOcsxJl.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\ENFhPtH.exe
  C:\Windows\System\ENFhPtH.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\DyYTAgX.exe
  C:\Windows\System\DyYTAgX.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\YkdmQdO.exe
  C:\Windows\System\YkdmQdO.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\EoVeQHu.exe
  C:\Windows\System\EoVeQHu.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\garmWMD.exe
  C:\Windows\System\garmWMD.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\BGxspgN.exe
  C:\Windows\System\BGxspgN.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\pXxQlNf.exe
  C:\Windows\System\pXxQlNf.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\acWQkLO.exe
  C:\Windows\System\acWQkLO.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\BLQRyTu.exe
  C:\Windows\System\BLQRyTu.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\ubgfYTd.exe
  C:\Windows\System\ubgfYTd.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\ENgpEnE.exe
  C:\Windows\System\ENgpEnE.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\siCldxX.exe
  C:\Windows\System\siCldxX.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\LNhHJkx.exe
  C:\Windows\System\LNhHJkx.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\MqUxGcL.exe
  C:\Windows\System\MqUxGcL.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\TxSJAkm.exe
  C:\Windows\System\TxSJAkm.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\nLxtZDA.exe
  C:\Windows\System\nLxtZDA.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\STCcvyV.exe
  C:\Windows\System\STCcvyV.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\GjiRbxb.exe
  C:\Windows\System\GjiRbxb.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\dACBjLo.exe
  C:\Windows\System\dACBjLo.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\LmgszrH.exe
  C:\Windows\System\LmgszrH.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\IXQcQam.exe
  C:\Windows\System\IXQcQam.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\tbKAeta.exe
  C:\Windows\System\tbKAeta.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\UbMFBEr.exe
  C:\Windows\System\UbMFBEr.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\ucxzOVb.exe
  C:\Windows\System\ucxzOVb.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\oXBHGZG.exe
  C:\Windows\System\oXBHGZG.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\BfiMLJC.exe
  C:\Windows\System\BfiMLJC.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\HiYUlBf.exe
  C:\Windows\System\HiYUlBf.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\TRjgrIL.exe
  C:\Windows\System\TRjgrIL.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\peGfgbw.exe
  C:\Windows\System\peGfgbw.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\VoSMYlm.exe
  C:\Windows\System\VoSMYlm.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\MAzGTMg.exe
  C:\Windows\System\MAzGTMg.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\WOwtQMf.exe
  C:\Windows\System\WOwtQMf.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\FfsYhHV.exe
  C:\Windows\System\FfsYhHV.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\jGuoIPX.exe
  C:\Windows\System\jGuoIPX.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\pATZVNc.exe
  C:\Windows\System\pATZVNc.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\xAjPKsa.exe
  C:\Windows\System\xAjPKsa.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\ggLlaRg.exe
  C:\Windows\System\ggLlaRg.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\pLLEBJN.exe
  C:\Windows\System\pLLEBJN.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\OaZMnWa.exe
  C:\Windows\System\OaZMnWa.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\SmDDZeS.exe
  C:\Windows\System\SmDDZeS.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\jylhgOS.exe
  C:\Windows\System\jylhgOS.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\BLXWwgg.exe
  C:\Windows\System\BLXWwgg.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\CLJYSHD.exe
  C:\Windows\System\CLJYSHD.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\sNNWFRX.exe
  C:\Windows\System\sNNWFRX.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\pTEDdTO.exe
  C:\Windows\System\pTEDdTO.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\jqDBEcC.exe
  C:\Windows\System\jqDBEcC.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\ZOplFSR.exe
  C:\Windows\System\ZOplFSR.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\UNsZDYk.exe
  C:\Windows\System\UNsZDYk.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\vutrzWa.exe
  C:\Windows\System\vutrzWa.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\NvhHQQY.exe
  C:\Windows\System\NvhHQQY.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\QagjUci.exe
  C:\Windows\System\QagjUci.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\XupMJTZ.exe
  C:\Windows\System\XupMJTZ.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\nnmDYOH.exe
  C:\Windows\System\nnmDYOH.exe
  2⤵
  PID:1992
- C:\Windows\System\eqFywJt.exe
  C:\Windows\System\eqFywJt.exe
  2⤵
  PID:4820
- C:\Windows\System\hcrJcLN.exe
  C:\Windows\System\hcrJcLN.exe
  2⤵
  PID:4056
- C:\Windows\System\lIaJefr.exe
  C:\Windows\System\lIaJefr.exe
  2⤵
  PID:4288
- C:\Windows\System\uSKbtIi.exe
  C:\Windows\System\uSKbtIi.exe
  2⤵
  PID:1824
- C:\Windows\System\PtjrIke.exe
  C:\Windows\System\PtjrIke.exe
  2⤵
  PID:4876
- C:\Windows\System\SvNgfUV.exe
  C:\Windows\System\SvNgfUV.exe
  2⤵
  PID:1936
- C:\Windows\System\SNEobwV.exe
  C:\Windows\System\SNEobwV.exe
  2⤵
  PID:1096
- C:\Windows\System\hyNbSus.exe
  C:\Windows\System\hyNbSus.exe
  2⤵
  PID:2900
- C:\Windows\System\LbPaOQU.exe
  C:\Windows\System\LbPaOQU.exe
  2⤵
  PID:2580
- C:\Windows\System\LeAzzcT.exe
  C:\Windows\System\LeAzzcT.exe
  2⤵
  PID:1680
- C:\Windows\System\utcPLWt.exe
  C:\Windows\System\utcPLWt.exe
  2⤵
  PID:1028
- C:\Windows\System\OxTWuSi.exe
  C:\Windows\System\OxTWuSi.exe
  2⤵
  PID:3424
- C:\Windows\System\uqLBePF.exe
  C:\Windows\System\uqLBePF.exe
  2⤵
  PID:5136
- C:\Windows\System\WJsykOt.exe
  C:\Windows\System\WJsykOt.exe
  2⤵
  PID:5164
- C:\Windows\System\zWvZrPK.exe
  C:\Windows\System\zWvZrPK.exe
  2⤵
  PID:5184
- C:\Windows\System\MDytgIj.exe
  C:\Windows\System\MDytgIj.exe
  2⤵
  PID:5212
- C:\Windows\System\HKYNVEF.exe
  C:\Windows\System\HKYNVEF.exe
  2⤵
  PID:5264
- C:\Windows\System\NcqAyeC.exe
  C:\Windows\System\NcqAyeC.exe
  2⤵
  PID:5292
- C:\Windows\System\iGzukYx.exe
  C:\Windows\System\iGzukYx.exe
  2⤵
  PID:5316
- C:\Windows\System\ftbZxuy.exe
  C:\Windows\System\ftbZxuy.exe
  2⤵
  PID:5340
- C:\Windows\System\EgVdyaS.exe
  C:\Windows\System\EgVdyaS.exe
  2⤵
  PID:5360
- C:\Windows\System\CBcDeEn.exe
  C:\Windows\System\CBcDeEn.exe
  2⤵
  PID:5384
- C:\Windows\System\YEMKDlC.exe
  C:\Windows\System\YEMKDlC.exe
  2⤵
  PID:5412
- C:\Windows\System\YvHBvym.exe
  C:\Windows\System\YvHBvym.exe
  2⤵
  PID:5448
- C:\Windows\System\FtIODHL.exe
  C:\Windows\System\FtIODHL.exe
  2⤵
  PID:5472
- C:\Windows\System\MAetymv.exe
  C:\Windows\System\MAetymv.exe
  2⤵
  PID:5500
- C:\Windows\System\HvVBGue.exe
  C:\Windows\System\HvVBGue.exe
  2⤵
  PID:5520
- C:\Windows\System\FDlEGYc.exe
  C:\Windows\System\FDlEGYc.exe
  2⤵
  PID:5540
- C:\Windows\System\ApErMeI.exe
  C:\Windows\System\ApErMeI.exe
  2⤵
  PID:5556
- C:\Windows\System\tWscFCU.exe
  C:\Windows\System\tWscFCU.exe
  2⤵
  PID:5572
- C:\Windows\System\mESqdLS.exe
  C:\Windows\System\mESqdLS.exe
  2⤵
  PID:5588
- C:\Windows\System\rqdJVxp.exe
  C:\Windows\System\rqdJVxp.exe
  2⤵
  PID:5604
- C:\Windows\System\KWEsoZE.exe
  C:\Windows\System\KWEsoZE.exe
  2⤵
  PID:5624
- C:\Windows\System\ClupVeq.exe
  C:\Windows\System\ClupVeq.exe
  2⤵
  PID:5656
- C:\Windows\System\pHhBrMg.exe
  C:\Windows\System\pHhBrMg.exe
  2⤵
  PID:5676
- C:\Windows\System\TnDISyf.exe
  C:\Windows\System\TnDISyf.exe
  2⤵
  PID:5696
- C:\Windows\System\buIgYDy.exe
  C:\Windows\System\buIgYDy.exe
  2⤵
  PID:5716
- C:\Windows\System\CGeJAqW.exe
  C:\Windows\System\CGeJAqW.exe
  2⤵
  PID:5732
- C:\Windows\System\yKXmPrY.exe
  C:\Windows\System\yKXmPrY.exe
  2⤵
  PID:5752
- C:\Windows\System\gLGXqSJ.exe
  C:\Windows\System\gLGXqSJ.exe
  2⤵
  PID:5784
- C:\Windows\System\GuiobgV.exe
  C:\Windows\System\GuiobgV.exe
  2⤵
  PID:5800
- C:\Windows\System\KrvpUvo.exe
  C:\Windows\System\KrvpUvo.exe
  2⤵
  PID:5836
- C:\Windows\System\qxyPtfm.exe
  C:\Windows\System\qxyPtfm.exe
  2⤵
  PID:5852
- C:\Windows\System\jPGXyAD.exe
  C:\Windows\System\jPGXyAD.exe
  2⤵
  PID:5868
- C:\Windows\System\nXadkMg.exe
  C:\Windows\System\nXadkMg.exe
  2⤵
  PID:5884
- C:\Windows\System\CcSPOqE.exe
  C:\Windows\System\CcSPOqE.exe
  2⤵
  PID:5908
- C:\Windows\System\qAQGEPi.exe
  C:\Windows\System\qAQGEPi.exe
  2⤵
  PID:5932
- C:\Windows\System\bTmiEFp.exe
  C:\Windows\System\bTmiEFp.exe
  2⤵
  PID:5948
- C:\Windows\System\nXTkqJC.exe
  C:\Windows\System\nXTkqJC.exe
  2⤵
  PID:5972
- C:\Windows\System\GzeeNoT.exe
  C:\Windows\System\GzeeNoT.exe
  2⤵
  PID:6000
- C:\Windows\System\FnXDBfT.exe
  C:\Windows\System\FnXDBfT.exe
  2⤵
  PID:6016
- C:\Windows\System\LNXNnva.exe
  C:\Windows\System\LNXNnva.exe
  2⤵
  PID:6040
- C:\Windows\System\OfvViXp.exe
  C:\Windows\System\OfvViXp.exe
  2⤵
  PID:6056
- C:\Windows\System\JADROtc.exe
  C:\Windows\System\JADROtc.exe
  2⤵
  PID:6100
- C:\Windows\System\IDLFfCz.exe
  C:\Windows\System\IDLFfCz.exe
  2⤵
  PID:6124
- C:\Windows\System\sqXwcgi.exe
  C:\Windows\System\sqXwcgi.exe
  2⤵
  PID:6140
- C:\Windows\System\yuBiQxC.exe
  C:\Windows\System\yuBiQxC.exe
  2⤵
  PID:4640
- C:\Windows\System\InMhnQO.exe
  C:\Windows\System\InMhnQO.exe
  2⤵
  PID:1252
- C:\Windows\System\EJGcadl.exe
  C:\Windows\System\EJGcadl.exe
  2⤵
  PID:1720
- C:\Windows\System\mTgiHoH.exe
  C:\Windows\System\mTgiHoH.exe
  2⤵
  PID:1948
- C:\Windows\System\IBIJmWQ.exe
  C:\Windows\System\IBIJmWQ.exe
  2⤵
  PID:3776
- C:\Windows\System\PHSklbL.exe
  C:\Windows\System\PHSklbL.exe
  2⤵
  PID:4304
- C:\Windows\System\slueSKU.exe
  C:\Windows\System\slueSKU.exe
  2⤵
  PID:3712
- C:\Windows\System\SMGGZdX.exe
  C:\Windows\System\SMGGZdX.exe
  2⤵
  PID:3268
- C:\Windows\System\SZQAPpA.exe
  C:\Windows\System\SZQAPpA.exe
  2⤵
  PID:3676
- C:\Windows\System\HGWcZtR.exe
  C:\Windows\System\HGWcZtR.exe
  2⤵
  PID:3560
- C:\Windows\System\SFeUjJB.exe
  C:\Windows\System\SFeUjJB.exe
  2⤵
  PID:4116
- C:\Windows\System\kPqgtPa.exe
  C:\Windows\System\kPqgtPa.exe
  2⤵
  PID:4740
- C:\Windows\System\UbEgxKu.exe
  C:\Windows\System\UbEgxKu.exe
  2⤵
  PID:688
- C:\Windows\System\TvUYzqP.exe
  C:\Windows\System\TvUYzqP.exe
  2⤵
  PID:2996
- C:\Windows\System\hSRJzBX.exe
  C:\Windows\System\hSRJzBX.exe
  2⤵
  PID:396
- C:\Windows\System\RNOGiuE.exe
  C:\Windows\System\RNOGiuE.exe
  2⤵
  PID:4440
- C:\Windows\System\qTeKVxb.exe
  C:\Windows\System\qTeKVxb.exe
  2⤵
  PID:5308
- C:\Windows\System\PriBTWv.exe
  C:\Windows\System\PriBTWv.exe
  2⤵
  PID:5084
- C:\Windows\System\YQUliDr.exe
  C:\Windows\System\YQUliDr.exe
  2⤵
  PID:2612
- C:\Windows\System\dEWPAbJ.exe
  C:\Windows\System\dEWPAbJ.exe
  2⤵
  PID:6008
- C:\Windows\System\PMVZsOR.exe
  C:\Windows\System\PMVZsOR.exe
  2⤵
  PID:5220
- C:\Windows\System\CJrstYZ.exe
  C:\Windows\System\CJrstYZ.exe
  2⤵
  PID:5276
- C:\Windows\System\SDTIQIG.exe
  C:\Windows\System\SDTIQIG.exe
  2⤵
  PID:6168
- C:\Windows\System\lxFnysM.exe
  C:\Windows\System\lxFnysM.exe
  2⤵
  PID:6188
- C:\Windows\System\BewjMJo.exe
  C:\Windows\System\BewjMJo.exe
  2⤵
  PID:6216
- C:\Windows\System\yxsNJoc.exe
  C:\Windows\System\yxsNJoc.exe
  2⤵
  PID:6236
- C:\Windows\System\cePswVW.exe
  C:\Windows\System\cePswVW.exe
  2⤵
  PID:6268
- C:\Windows\System\cmIeEaK.exe
  C:\Windows\System\cmIeEaK.exe
  2⤵
  PID:6284
- C:\Windows\System\vKZdQGL.exe
  C:\Windows\System\vKZdQGL.exe
  2⤵
  PID:6304
- C:\Windows\System\ePgYMET.exe
  C:\Windows\System\ePgYMET.exe
  2⤵
  PID:6324
- C:\Windows\System\AOnjTTs.exe
  C:\Windows\System\AOnjTTs.exe
  2⤵
  PID:6340
- C:\Windows\System\wrgIYIV.exe
  C:\Windows\System\wrgIYIV.exe
  2⤵
  PID:6364
- C:\Windows\System\OPygWbD.exe
  C:\Windows\System\OPygWbD.exe
  2⤵
  PID:6380
- C:\Windows\System\JzXxPSQ.exe
  C:\Windows\System\JzXxPSQ.exe
  2⤵
  PID:6404
- C:\Windows\System\kEVTLJO.exe
  C:\Windows\System\kEVTLJO.exe
  2⤵
  PID:6436
- C:\Windows\System\BnaFnXD.exe
  C:\Windows\System\BnaFnXD.exe
  2⤵
  PID:6460
- C:\Windows\System\xoawAGa.exe
  C:\Windows\System\xoawAGa.exe
  2⤵
  PID:6500
- C:\Windows\System\LCKHKsO.exe
  C:\Windows\System\LCKHKsO.exe
  2⤵
  PID:6520
- C:\Windows\System\BRGMthQ.exe
  C:\Windows\System\BRGMthQ.exe
  2⤵
  PID:6544
- C:\Windows\System\CuBpmod.exe
  C:\Windows\System\CuBpmod.exe
  2⤵
  PID:6564
- C:\Windows\System\vATDdGs.exe
  C:\Windows\System\vATDdGs.exe
  2⤵
  PID:6588
- C:\Windows\System\DnhqgNs.exe
  C:\Windows\System\DnhqgNs.exe
  2⤵
  PID:6612
- C:\Windows\System\xXkmAhG.exe
  C:\Windows\System\xXkmAhG.exe
  2⤵
  PID:6628
- C:\Windows\System\XqFSFJn.exe
  C:\Windows\System\XqFSFJn.exe
  2⤵
  PID:6652
- C:\Windows\System\THyOdxD.exe
  C:\Windows\System\THyOdxD.exe
  2⤵
  PID:6736
- C:\Windows\System\oHvMqef.exe
  C:\Windows\System\oHvMqef.exe
  2⤵
  PID:6752
- C:\Windows\System\lzyuspv.exe
  C:\Windows\System\lzyuspv.exe
  2⤵
  PID:6776
- C:\Windows\System\dCltvkM.exe
  C:\Windows\System\dCltvkM.exe
  2⤵
  PID:6792
- C:\Windows\System\zsAUBQv.exe
  C:\Windows\System\zsAUBQv.exe
  2⤵
  PID:6816
- C:\Windows\System\rJwwjsL.exe
  C:\Windows\System\rJwwjsL.exe
  2⤵
  PID:6840
- C:\Windows\System\FCwwKpS.exe
  C:\Windows\System\FCwwKpS.exe
  2⤵
  PID:6856
- C:\Windows\System\itGewjT.exe
  C:\Windows\System\itGewjT.exe
  2⤵
  PID:6884
- C:\Windows\System\hmuldEn.exe
  C:\Windows\System\hmuldEn.exe
  2⤵
  PID:6904
- C:\Windows\System\NGQXmDJ.exe
  C:\Windows\System\NGQXmDJ.exe
  2⤵
  PID:6928
- C:\Windows\System\Szmywjt.exe
  C:\Windows\System\Szmywjt.exe
  2⤵
  PID:6944
- C:\Windows\System\fgYJKMq.exe
  C:\Windows\System\fgYJKMq.exe
  2⤵
  PID:6960
- C:\Windows\System\hXrwSQa.exe
  C:\Windows\System\hXrwSQa.exe
  2⤵
  PID:6984
- C:\Windows\System\jYVptDX.exe
  C:\Windows\System\jYVptDX.exe
  2⤵
  PID:7044
- C:\Windows\System\aibBmws.exe
  C:\Windows\System\aibBmws.exe
  2⤵
  PID:7068
- C:\Windows\System\vkCSgPd.exe
  C:\Windows\System\vkCSgPd.exe
  2⤵
  PID:7084
- C:\Windows\System\tEbKIWM.exe
  C:\Windows\System\tEbKIWM.exe
  2⤵
  PID:7108
- C:\Windows\System\ejsKeTv.exe
  C:\Windows\System\ejsKeTv.exe
  2⤵
  PID:7136
- C:\Windows\System\ssPsotL.exe
  C:\Windows\System\ssPsotL.exe
  2⤵
  PID:7156
- C:\Windows\System\wuZLkXX.exe
  C:\Windows\System\wuZLkXX.exe
  2⤵
  PID:3588
- C:\Windows\System\dmxXOoF.exe
  C:\Windows\System\dmxXOoF.exe
  2⤵
  PID:5692
- C:\Windows\System\PorBvmO.exe
  C:\Windows\System\PorBvmO.exe
  2⤵
  PID:5404
- C:\Windows\System\PLvCFOE.exe
  C:\Windows\System\PLvCFOE.exe
  2⤵
  PID:1360
- C:\Windows\System\KSFChwf.exe
  C:\Windows\System\KSFChwf.exe
  2⤵
  PID:5508
- C:\Windows\System\iZApRRw.exe
  C:\Windows\System\iZApRRw.exe
  2⤵
  PID:5548
- C:\Windows\System\BpTojFt.exe
  C:\Windows\System\BpTojFt.exe
  2⤵
  PID:5596
- C:\Windows\System\RkFFlDK.exe
  C:\Windows\System\RkFFlDK.exe
  2⤵
  PID:2364
- C:\Windows\System\bvJrTjk.exe
  C:\Windows\System\bvJrTjk.exe
  2⤵
  PID:5708
- C:\Windows\System\nUrekXO.exe
  C:\Windows\System\nUrekXO.exe
  2⤵
  PID:5744
- C:\Windows\System\Esdftmd.exe
  C:\Windows\System\Esdftmd.exe
  2⤵
  PID:5816
- C:\Windows\System\WkwKtGE.exe
  C:\Windows\System\WkwKtGE.exe
  2⤵
  PID:5860
- C:\Windows\System\qksrrda.exe
  C:\Windows\System\qksrrda.exe
  2⤵
  PID:5900
- C:\Windows\System\LiBLuEQ.exe
  C:\Windows\System\LiBLuEQ.exe
  2⤵
  PID:5940
- C:\Windows\System\ClLvrci.exe
  C:\Windows\System\ClLvrci.exe
  2⤵
  PID:6084
- C:\Windows\System\YWkryHt.exe
  C:\Windows\System\YWkryHt.exe
  2⤵
  PID:6136
- C:\Windows\System\LFekKyB.exe
  C:\Windows\System\LFekKyB.exe
  2⤵
  PID:4428
- C:\Windows\System\lTvHxBs.exe
  C:\Windows\System\lTvHxBs.exe
  2⤵
  PID:5032
- C:\Windows\System\qjilFlG.exe
  C:\Windows\System\qjilFlG.exe
  2⤵
  PID:2168
- C:\Windows\System\sWctZvh.exe
  C:\Windows\System\sWctZvh.exe
  2⤵
  PID:5196
- C:\Windows\System\jXaIzPP.exe
  C:\Windows\System\jXaIzPP.exe
  2⤵
  PID:2552
- C:\Windows\System\ysGVGIu.exe
  C:\Windows\System\ysGVGIu.exe
  2⤵
  PID:7184
- C:\Windows\System\oKsGtVD.exe
  C:\Windows\System\oKsGtVD.exe
  2⤵
  PID:7204
- C:\Windows\System\AErsArA.exe
  C:\Windows\System\AErsArA.exe
  2⤵
  PID:7224
- C:\Windows\System\ZArcULm.exe
  C:\Windows\System\ZArcULm.exe
  2⤵
  PID:7248
- C:\Windows\System\nRhBhVl.exe
  C:\Windows\System\nRhBhVl.exe
  2⤵
  PID:7264
- C:\Windows\System\GJTiacS.exe
  C:\Windows\System\GJTiacS.exe
  2⤵
  PID:7288
- C:\Windows\System\wnbzdZE.exe
  C:\Windows\System\wnbzdZE.exe
  2⤵
  PID:7340
- C:\Windows\System\ivJjgcs.exe
  C:\Windows\System\ivJjgcs.exe
  2⤵
  PID:7356
- C:\Windows\System\hihICVa.exe
  C:\Windows\System\hihICVa.exe
  2⤵
  PID:7376
- C:\Windows\System\pjiTOnQ.exe
  C:\Windows\System\pjiTOnQ.exe
  2⤵
  PID:7404
- C:\Windows\System\UrjFdLB.exe
  C:\Windows\System\UrjFdLB.exe
  2⤵
  PID:7420
- C:\Windows\System\mcQCiOA.exe
  C:\Windows\System\mcQCiOA.exe
  2⤵
  PID:7588
- C:\Windows\System\kYYmHdV.exe
  C:\Windows\System\kYYmHdV.exe
  2⤵
  PID:7604
- C:\Windows\System\HppxiwD.exe
  C:\Windows\System\HppxiwD.exe
  2⤵
  PID:7620
- C:\Windows\System\IzsYobH.exe
  C:\Windows\System\IzsYobH.exe
  2⤵
  PID:7636
- C:\Windows\System\pHTHPsR.exe
  C:\Windows\System\pHTHPsR.exe
  2⤵
  PID:7652
- C:\Windows\System\QJeUAuS.exe
  C:\Windows\System\QJeUAuS.exe
  2⤵
  PID:7668
- C:\Windows\System\wMWAzqI.exe
  C:\Windows\System\wMWAzqI.exe
  2⤵
  PID:7684
- C:\Windows\System\PWLnTUS.exe
  C:\Windows\System\PWLnTUS.exe
  2⤵
  PID:7700
- C:\Windows\System\WoXznCP.exe
  C:\Windows\System\WoXznCP.exe
  2⤵
  PID:7716
- C:\Windows\System\IXcMvkr.exe
  C:\Windows\System\IXcMvkr.exe
  2⤵
  PID:7732
- C:\Windows\System\JJCPoex.exe
  C:\Windows\System\JJCPoex.exe
  2⤵
  PID:7756
- C:\Windows\System\MpSJVbu.exe
  C:\Windows\System\MpSJVbu.exe
  2⤵
  PID:7772
- C:\Windows\System\HxFpWJT.exe
  C:\Windows\System\HxFpWJT.exe
  2⤵
  PID:7788
- C:\Windows\System\xhCLvbN.exe
  C:\Windows\System\xhCLvbN.exe
  2⤵
  PID:7808
- C:\Windows\System\AmPisVk.exe
  C:\Windows\System\AmPisVk.exe
  2⤵
  PID:7828
- C:\Windows\System\QLdSwXC.exe
  C:\Windows\System\QLdSwXC.exe
  2⤵
  PID:8040
- C:\Windows\System\QjLuZRM.exe
  C:\Windows\System\QjLuZRM.exe
  2⤵
  PID:8068
- C:\Windows\System\ZOjGpyJ.exe
  C:\Windows\System\ZOjGpyJ.exe
  2⤵
  PID:8084
- C:\Windows\System\oTvIBSG.exe
  C:\Windows\System\oTvIBSG.exe
  2⤵
  PID:8100
- C:\Windows\System\ysMzTLo.exe
  C:\Windows\System\ysMzTLo.exe
  2⤵
  PID:8116
- C:\Windows\System\pkHadLW.exe
  C:\Windows\System\pkHadLW.exe
  2⤵
  PID:8152
- C:\Windows\System\ieUEtMG.exe
  C:\Windows\System\ieUEtMG.exe
  2⤵
  PID:8172
- C:\Windows\System\uKJFzID.exe
  C:\Windows\System\uKJFzID.exe
  2⤵
  PID:1760
- C:\Windows\System\LGJerhv.exe
  C:\Windows\System\LGJerhv.exe
  2⤵
  PID:908
- C:\Windows\System\qmijNQt.exe
  C:\Windows\System\qmijNQt.exe
  2⤵
  PID:6032
- C:\Windows\System\nmlUQUh.exe
  C:\Windows\System\nmlUQUh.exe
  2⤵
  PID:6152
- C:\Windows\System\UEkQnDy.exe
  C:\Windows\System\UEkQnDy.exe
  2⤵
  PID:6212
- C:\Windows\System\lOCKCYb.exe
  C:\Windows\System\lOCKCYb.exe
  2⤵
  PID:6276
- C:\Windows\System\fXOYjHb.exe
  C:\Windows\System\fXOYjHb.exe
  2⤵
  PID:6336
- C:\Windows\System\eTebuhL.exe
  C:\Windows\System\eTebuhL.exe
  2⤵
  PID:6396
- C:\Windows\System\WjzELJn.exe
  C:\Windows\System\WjzELJn.exe
  2⤵
  PID:6468
- C:\Windows\System\AtnRohK.exe
  C:\Windows\System\AtnRohK.exe
  2⤵
  PID:6496
- C:\Windows\System\rZXkPfV.exe
  C:\Windows\System\rZXkPfV.exe
  2⤵
  PID:6552
- C:\Windows\System\VOKeyBD.exe
  C:\Windows\System\VOKeyBD.exe
  2⤵
  PID:6600
- C:\Windows\System\HgsSRjV.exe
  C:\Windows\System\HgsSRjV.exe
  2⤵
  PID:6660
- C:\Windows\System\znASwav.exe
  C:\Windows\System\znASwav.exe
  2⤵
  PID:6700
- C:\Windows\System\FeAelen.exe
  C:\Windows\System\FeAelen.exe
  2⤵
  PID:6760
- C:\Windows\System\uTGAnLa.exe
  C:\Windows\System\uTGAnLa.exe
  2⤵
  PID:6808
- C:\Windows\System\QxfmAzc.exe
  C:\Windows\System\QxfmAzc.exe
  2⤵
  PID:6848
- C:\Windows\System\hzIkWlL.exe
  C:\Windows\System\hzIkWlL.exe
  2⤵
  PID:6900
- C:\Windows\System\KEneQpG.exe
  C:\Windows\System\KEneQpG.exe
  2⤵
  PID:6956
- C:\Windows\System\IqgNIWL.exe
  C:\Windows\System\IqgNIWL.exe
  2⤵
  PID:4880
- C:\Windows\System\ydWbavY.exe
  C:\Windows\System\ydWbavY.exe
  2⤵
  PID:6316
- C:\Windows\System\zhOfiDk.exe
  C:\Windows\System\zhOfiDk.exe
  2⤵
  PID:7200
- C:\Windows\System\HVipyIF.exe
  C:\Windows\System\HVipyIF.exe
  2⤵
  PID:7060
- C:\Windows\System\dLdNXuv.exe
  C:\Windows\System\dLdNXuv.exe
  2⤵
  PID:7100
- C:\Windows\System\rpcwUdC.exe
  C:\Windows\System\rpcwUdC.exe
  2⤵
  PID:7152
- C:\Windows\System\TaotWOF.exe
  C:\Windows\System\TaotWOF.exe
  2⤵
  PID:5392
- C:\Windows\System\nOyURVo.exe
  C:\Windows\System\nOyURVo.exe
  2⤵
  PID:5808
- C:\Windows\System\dqgVIGx.exe
  C:\Windows\System\dqgVIGx.exe
  2⤵
  PID:5580
- C:\Windows\System\eLTVCmw.exe
  C:\Windows\System\eLTVCmw.exe
  2⤵
  PID:5488
- C:\Windows\System\WNyAJvN.exe
  C:\Windows\System\WNyAJvN.exe
  2⤵
  PID:5848
- C:\Windows\System\GRgTFoc.exe
  C:\Windows\System\GRgTFoc.exe
  2⤵
  PID:5944
- C:\Windows\System\AdtGVGk.exe
  C:\Windows\System\AdtGVGk.exe
  2⤵
  PID:1892
- C:\Windows\System\MYpKiVV.exe
  C:\Windows\System\MYpKiVV.exe
  2⤵
  PID:812
- C:\Windows\System\TtlpqUS.exe
  C:\Windows\System\TtlpqUS.exe
  2⤵
  PID:3116
- C:\Windows\System\jZgzvyC.exe
  C:\Windows\System\jZgzvyC.exe
  2⤵
  PID:7216
- C:\Windows\System\lhHMHWa.exe
  C:\Windows\System\lhHMHWa.exe
  2⤵
  PID:7260
- C:\Windows\System\nREkVBa.exe
  C:\Windows\System\nREkVBa.exe
  2⤵
  PID:7348
- C:\Windows\System\CCRqJNf.exe
  C:\Windows\System\CCRqJNf.exe
  2⤵
  PID:7396
- C:\Windows\System\sEIVCwi.exe
  C:\Windows\System\sEIVCwi.exe
  2⤵
  PID:8200
- C:\Windows\System\Vgviwfi.exe
  C:\Windows\System\Vgviwfi.exe
  2⤵
  PID:8220
- C:\Windows\System\NgQNYPf.exe
  C:\Windows\System\NgQNYPf.exe
  2⤵
  PID:8240
- C:\Windows\System\dYkvtIO.exe
  C:\Windows\System\dYkvtIO.exe
  2⤵
  PID:8260
- C:\Windows\System\hPPfkHx.exe
  C:\Windows\System\hPPfkHx.exe
  2⤵
  PID:8280
- C:\Windows\System\duwsXMf.exe
  C:\Windows\System\duwsXMf.exe
  2⤵
  PID:8304
- C:\Windows\System\gPMOvfm.exe
  C:\Windows\System\gPMOvfm.exe
  2⤵
  PID:8380
- C:\Windows\System\FvazFVF.exe
  C:\Windows\System\FvazFVF.exe
  2⤵
  PID:8520
- C:\Windows\System\caeZkua.exe
  C:\Windows\System\caeZkua.exe
  2⤵
  PID:8536
- C:\Windows\System\BMaeRKu.exe
  C:\Windows\System\BMaeRKu.exe
  2⤵
  PID:8556
- C:\Windows\System\aKePBQI.exe
  C:\Windows\System\aKePBQI.exe
  2⤵
  PID:8576
- C:\Windows\System\WvRvrdO.exe
  C:\Windows\System\WvRvrdO.exe
  2⤵
  PID:8592
- C:\Windows\System\gMJcZsh.exe
  C:\Windows\System\gMJcZsh.exe
  2⤵
  PID:8612
- C:\Windows\System\NZFVrhi.exe
  C:\Windows\System\NZFVrhi.exe
  2⤵
  PID:8632
- C:\Windows\System\DmbxnVB.exe
  C:\Windows\System\DmbxnVB.exe
  2⤵
  PID:8652
- C:\Windows\System\cATvnUm.exe
  C:\Windows\System\cATvnUm.exe
  2⤵
  PID:8668
- C:\Windows\System\HoCoNLV.exe
  C:\Windows\System\HoCoNLV.exe
  2⤵
  PID:8692
- C:\Windows\System\CFdqMJo.exe
  C:\Windows\System\CFdqMJo.exe
  2⤵
  PID:8708
- C:\Windows\System\WCuzuUj.exe
  C:\Windows\System\WCuzuUj.exe
  2⤵
  PID:8728
- C:\Windows\System\zvNyFwp.exe
  C:\Windows\System\zvNyFwp.exe
  2⤵
  PID:8768
- C:\Windows\System\hycpXGR.exe
  C:\Windows\System\hycpXGR.exe
  2⤵
  PID:8800
- C:\Windows\System\Krvwzyx.exe
  C:\Windows\System\Krvwzyx.exe
  2⤵
  PID:8836
- C:\Windows\System\yJSoZtH.exe
  C:\Windows\System\yJSoZtH.exe
  2⤵
  PID:8868
- C:\Windows\System\WQMuFZi.exe
  C:\Windows\System\WQMuFZi.exe
  2⤵
  PID:8900
- C:\Windows\System\LqdDIBN.exe
  C:\Windows\System\LqdDIBN.exe
  2⤵
  PID:8944
- C:\Windows\System\gECUiwf.exe
  C:\Windows\System\gECUiwf.exe
  2⤵
  PID:8984
- C:\Windows\System\FwdLDNW.exe
  C:\Windows\System\FwdLDNW.exe
  2⤵
  PID:9000
- C:\Windows\System\sIxTksZ.exe
  C:\Windows\System\sIxTksZ.exe
  2⤵
  PID:9024
- C:\Windows\System\raqIjup.exe
  C:\Windows\System\raqIjup.exe
  2⤵
  PID:9044
- C:\Windows\System\dFYJwak.exe
  C:\Windows\System\dFYJwak.exe
  2⤵
  PID:9068
- C:\Windows\System\REVgbpc.exe
  C:\Windows\System\REVgbpc.exe
  2⤵
  PID:9088
- C:\Windows\System\qMwGLMW.exe
  C:\Windows\System\qMwGLMW.exe
  2⤵
  PID:9104
- C:\Windows\System\jVczMOQ.exe
  C:\Windows\System\jVczMOQ.exe
  2⤵
  PID:9120
- C:\Windows\System\FXMOcHT.exe
  C:\Windows\System\FXMOcHT.exe
  2⤵
  PID:9136
- C:\Windows\System\nRGmfmQ.exe
  C:\Windows\System\nRGmfmQ.exe
  2⤵
  PID:9156
- C:\Windows\System\NitZVTQ.exe
  C:\Windows\System\NitZVTQ.exe
  2⤵
  PID:9176
- C:\Windows\System\ocwQPWc.exe
  C:\Windows\System\ocwQPWc.exe
  2⤵
  PID:9192
- C:\Windows\System\AJdddvY.exe
  C:\Windows\System\AJdddvY.exe
  2⤵
  PID:9208
- C:\Windows\System\bbdfxdj.exe
  C:\Windows\System\bbdfxdj.exe
  2⤵
  PID:7428
- C:\Windows\System\GQzwrNE.exe
  C:\Windows\System\GQzwrNE.exe
  2⤵
  PID:8124
- C:\Windows\System\ZZvenhR.exe
  C:\Windows\System\ZZvenhR.exe
  2⤵
  PID:6232
- C:\Windows\System\ULjCqYR.exe
  C:\Windows\System\ULjCqYR.exe
  2⤵
  PID:6388
- C:\Windows\System\evyvukg.exe
  C:\Windows\System\evyvukg.exe
  2⤵
  PID:6532
- C:\Windows\System\HZMANVT.exe
  C:\Windows\System\HZMANVT.exe
  2⤵
  PID:5456
- C:\Windows\System\LTpViPN.exe
  C:\Windows\System\LTpViPN.exe
  2⤵
  PID:5400
- C:\Windows\System\GAGExrY.exe
  C:\Windows\System\GAGExrY.exe
  2⤵
  PID:1376
- C:\Windows\System\IKUPmTq.exe
  C:\Windows\System\IKUPmTq.exe
  2⤵
  PID:8232
- C:\Windows\System\TXmSoQJ.exe
  C:\Windows\System\TXmSoQJ.exe
  2⤵
  PID:8188
- C:\Windows\System\SFmZwpT.exe
  C:\Windows\System\SFmZwpT.exe
  2⤵
  PID:9236
- C:\Windows\System\IyEGtPm.exe
  C:\Windows\System\IyEGtPm.exe
  2⤵
  PID:9252
- C:\Windows\System\mylwUuf.exe
  C:\Windows\System\mylwUuf.exe
  2⤵
  PID:9272
- C:\Windows\System\edFcVgt.exe
  C:\Windows\System\edFcVgt.exe
  2⤵
  PID:9292
- C:\Windows\System\CWczNoj.exe
  C:\Windows\System\CWczNoj.exe
  2⤵
  PID:9308
- C:\Windows\System\MpqvVoZ.exe
  C:\Windows\System\MpqvVoZ.exe
  2⤵
  PID:9328
- C:\Windows\System\putRhcZ.exe
  C:\Windows\System\putRhcZ.exe
  2⤵
  PID:9344
- C:\Windows\System\OSHhoSm.exe
  C:\Windows\System\OSHhoSm.exe
  2⤵
  PID:9364
- C:\Windows\System\tzSWdXM.exe
  C:\Windows\System\tzSWdXM.exe
  2⤵
  PID:9380
- C:\Windows\System\rAdqwPX.exe
  C:\Windows\System\rAdqwPX.exe
  2⤵
  PID:9396
- C:\Windows\System\icxYDSF.exe
  C:\Windows\System\icxYDSF.exe
  2⤵
  PID:9412
- C:\Windows\System\yFfWJaL.exe
  C:\Windows\System\yFfWJaL.exe
  2⤵
  PID:9428
- C:\Windows\System\jAgJVhy.exe
  C:\Windows\System\jAgJVhy.exe
  2⤵
  PID:9452
- C:\Windows\System\PTiwYUS.exe
  C:\Windows\System\PTiwYUS.exe
  2⤵
  PID:9472
- C:\Windows\System\AhRiqoK.exe
  C:\Windows\System\AhRiqoK.exe
  2⤵
  PID:9492
- C:\Windows\System\iLeDaZM.exe
  C:\Windows\System\iLeDaZM.exe
  2⤵
  PID:9512
- C:\Windows\System\mUogitn.exe
  C:\Windows\System\mUogitn.exe
  2⤵
  PID:9532
- C:\Windows\System\DHBOfhf.exe
  C:\Windows\System\DHBOfhf.exe
  2⤵
  PID:9552
- C:\Windows\System\sWYijia.exe
  C:\Windows\System\sWYijia.exe
  2⤵
  PID:9568
- C:\Windows\System\VcuaDeV.exe
  C:\Windows\System\VcuaDeV.exe
  2⤵
  PID:9588
- C:\Windows\System\rEZvJcX.exe
  C:\Windows\System\rEZvJcX.exe
  2⤵
  PID:9604
- C:\Windows\System\ffZgsND.exe
  C:\Windows\System\ffZgsND.exe
  2⤵
  PID:9620
- C:\Windows\System\SgEAiQc.exe
  C:\Windows\System\SgEAiQc.exe
  2⤵
  PID:9640
- C:\Windows\System\hmrNmaM.exe
  C:\Windows\System\hmrNmaM.exe
  2⤵
  PID:9664
- C:\Windows\System\AhORPPh.exe
  C:\Windows\System\AhORPPh.exe
  2⤵
  PID:9684
- C:\Windows\System\MItzeBr.exe
  C:\Windows\System\MItzeBr.exe
  2⤵
  PID:9704
- C:\Windows\System\vTExLBx.exe
  C:\Windows\System\vTExLBx.exe
  2⤵
  PID:9724
- C:\Windows\System\ivQMFMW.exe
  C:\Windows\System\ivQMFMW.exe
  2⤵
  PID:9748
- C:\Windows\System\kFScTad.exe
  C:\Windows\System\kFScTad.exe
  2⤵
  PID:9768
- C:\Windows\System\Gikyqaw.exe
  C:\Windows\System\Gikyqaw.exe
  2⤵
  PID:9788
- C:\Windows\System\tSWwPJB.exe
  C:\Windows\System\tSWwPJB.exe
  2⤵
  PID:9808
- C:\Windows\System\PBLoJtj.exe
  C:\Windows\System\PBLoJtj.exe
  2⤵
  PID:9832
- C:\Windows\System\zilAJHL.exe
  C:\Windows\System\zilAJHL.exe
  2⤵
  PID:9852
- C:\Windows\System\oTQolmt.exe
  C:\Windows\System\oTQolmt.exe
  2⤵
  PID:9872
- C:\Windows\System\igJidXD.exe
  C:\Windows\System\igJidXD.exe
  2⤵
  PID:9900
- C:\Windows\System\HSGjhey.exe
  C:\Windows\System\HSGjhey.exe
  2⤵
  PID:9924
- C:\Windows\System\FyscRXr.exe
  C:\Windows\System\FyscRXr.exe
  2⤵
  PID:9944
- C:\Windows\System\csYajPE.exe
  C:\Windows\System\csYajPE.exe
  2⤵
  PID:10008
- C:\Windows\System\oOfxWPw.exe
  C:\Windows\System\oOfxWPw.exe
  2⤵
  PID:10024
- C:\Windows\System\jKnGynJ.exe
  C:\Windows\System\jKnGynJ.exe
  2⤵
  PID:10040
- C:\Windows\System\OQsgtpf.exe
  C:\Windows\System\OQsgtpf.exe
  2⤵
  PID:10056
- C:\Windows\System\ZciUTDM.exe
  C:\Windows\System\ZciUTDM.exe
  2⤵
  PID:10072
- C:\Windows\System\qnRWoRW.exe
  C:\Windows\System\qnRWoRW.exe
  2⤵
  PID:10088
- C:\Windows\System\eCjVPBZ.exe
  C:\Windows\System\eCjVPBZ.exe
  2⤵
  PID:10112
- C:\Windows\System\yUCnuRG.exe
  C:\Windows\System\yUCnuRG.exe
  2⤵
  PID:10128
- C:\Windows\System\rfnnqRd.exe
  C:\Windows\System\rfnnqRd.exe
  2⤵
  PID:10152
- C:\Windows\System\eoLBdlB.exe
  C:\Windows\System\eoLBdlB.exe
  2⤵
  PID:10176
- C:\Windows\System\aXhoLEH.exe
  C:\Windows\System\aXhoLEH.exe
  2⤵
  PID:10200
- C:\Windows\System\HjWagKx.exe
  C:\Windows\System\HjWagKx.exe
  2⤵
  PID:10220
- C:\Windows\System\OJeAvJF.exe
  C:\Windows\System\OJeAvJF.exe
  2⤵
  PID:5256
- C:\Windows\System\DMZKYPy.exe
  C:\Windows\System\DMZKYPy.exe
  2⤵
  PID:6744
- C:\Windows\System\RCDnciZ.exe
  C:\Windows\System\RCDnciZ.exe
  2⤵
  PID:8892
- C:\Windows\System\DuIfLlB.exe
  C:\Windows\System\DuIfLlB.exe
  2⤵
  PID:6952
- C:\Windows\System\MEIdxiE.exe
  C:\Windows\System\MEIdxiE.exe
  2⤵
  PID:8992
- C:\Windows\System\GKINXpM.exe
  C:\Windows\System\GKINXpM.exe
  2⤵
  PID:9016
- C:\Windows\System\bDaqvod.exe
  C:\Windows\System\bDaqvod.exe
  2⤵
  PID:9052
- C:\Windows\System\lQLwkev.exe
  C:\Windows\System\lQLwkev.exe
  2⤵
  PID:9084
- C:\Windows\System\EofeFJJ.exe
  C:\Windows\System\EofeFJJ.exe
  2⤵
  PID:7176
- C:\Windows\System\VqQzkxi.exe
  C:\Windows\System\VqQzkxi.exe
  2⤵
  PID:8248
- C:\Windows\System\EPqJvCa.exe
  C:\Windows\System\EPqJvCa.exe
  2⤵
  PID:9168
- C:\Windows\System\jPxmHFB.exe
  C:\Windows\System\jPxmHFB.exe
  2⤵
  PID:7384
- C:\Windows\System\XNuIdSz.exe
  C:\Windows\System\XNuIdSz.exe
  2⤵
  PID:6360
- C:\Windows\System\mmMgYwD.exe
  C:\Windows\System\mmMgYwD.exe
  2⤵
  PID:5464
- C:\Windows\System\pDecFxn.exe
  C:\Windows\System\pDecFxn.exe
  2⤵
  PID:7612
- C:\Windows\System\AFHZQQQ.exe
  C:\Windows\System\AFHZQQQ.exe
  2⤵
  PID:7648
- C:\Windows\System\ebmNKcr.exe
  C:\Windows\System\ebmNKcr.exe
  2⤵
  PID:7696
- C:\Windows\System\XpZftTO.exe
  C:\Windows\System\XpZftTO.exe
  2⤵
  PID:7768
- C:\Windows\System\CUPgmnY.exe
  C:\Windows\System\CUPgmnY.exe
  2⤵
  PID:7816
- C:\Windows\System\CjqUtzk.exe
  C:\Windows\System\CjqUtzk.exe
  2⤵
  PID:8000
- C:\Windows\System\QAyOkYw.exe
  C:\Windows\System\QAyOkYw.exe
  2⤵
  PID:8036
- C:\Windows\System\JGQXJgR.exe
  C:\Windows\System\JGQXJgR.exe
  2⤵
  PID:8080
- C:\Windows\System\gMwxfys.exe
  C:\Windows\System\gMwxfys.exe
  2⤵
  PID:8180
- C:\Windows\System\cxeNPTw.exe
  C:\Windows\System\cxeNPTw.exe
  2⤵
  PID:1268
- C:\Windows\System\RwXdWsz.exe
  C:\Windows\System\RwXdWsz.exe
  2⤵
  PID:9244
- C:\Windows\System\GSwFYSe.exe
  C:\Windows\System\GSwFYSe.exe
  2⤵
  PID:8796
- C:\Windows\System\CNDYLCn.exe
  C:\Windows\System\CNDYLCn.exe
  2⤵
  PID:6432
- C:\Windows\System\RMQaYHU.exe
  C:\Windows\System\RMQaYHU.exe
  2⤵
  PID:6424
- C:\Windows\System\qejkwUd.exe
  C:\Windows\System\qejkwUd.exe
  2⤵
  PID:7116
- C:\Windows\System\Jsntxgx.exe
  C:\Windows\System\Jsntxgx.exe
  2⤵
  PID:5664
- C:\Windows\System\tVryPRt.exe
  C:\Windows\System\tVryPRt.exe
  2⤵
  PID:7064
- C:\Windows\System\osxjZEj.exe
  C:\Windows\System\osxjZEj.exe
  2⤵
  PID:3432
- C:\Windows\System\kcyJdXd.exe
  C:\Windows\System\kcyJdXd.exe
  2⤵
  PID:10248
- C:\Windows\System\gfcleUr.exe
  C:\Windows\System\gfcleUr.exe
  2⤵
  PID:10264
- C:\Windows\System\NchWELk.exe
  C:\Windows\System\NchWELk.exe
  2⤵
  PID:10288
- C:\Windows\System\DCbhLoe.exe
  C:\Windows\System\DCbhLoe.exe
  2⤵
  PID:10312
- C:\Windows\System\gnGoMXL.exe
  C:\Windows\System\gnGoMXL.exe
  2⤵
  PID:10336
- C:\Windows\System\ohBKMnp.exe
  C:\Windows\System\ohBKMnp.exe
  2⤵
  PID:10356
- C:\Windows\System\ThYmsnI.exe
  C:\Windows\System\ThYmsnI.exe
  2⤵
  PID:10372
- C:\Windows\System\sgDAxsp.exe
  C:\Windows\System\sgDAxsp.exe
  2⤵
  PID:10392
- C:\Windows\System\puXzvcK.exe
  C:\Windows\System\puXzvcK.exe
  2⤵
  PID:10408
- C:\Windows\System\NpOGlKD.exe
  C:\Windows\System\NpOGlKD.exe
  2⤵
  PID:10424
- C:\Windows\System\BfcRioB.exe
  C:\Windows\System\BfcRioB.exe
  2⤵
  PID:10444
- C:\Windows\System\HYOiwbO.exe
  C:\Windows\System\HYOiwbO.exe
  2⤵
  PID:10468
- C:\Windows\System\soElmuR.exe
  C:\Windows\System\soElmuR.exe
  2⤵
  PID:10496
- C:\Windows\System\bSynCHf.exe
  C:\Windows\System\bSynCHf.exe
  2⤵
  PID:10512
- C:\Windows\System\EQrvKNG.exe
  C:\Windows\System\EQrvKNG.exe
  2⤵
  PID:10544
- C:\Windows\System\LjgsBEX.exe
  C:\Windows\System\LjgsBEX.exe
  2⤵
  PID:10564
- C:\Windows\System\VGZBDOi.exe
  C:\Windows\System\VGZBDOi.exe
  2⤵
  PID:10592
- C:\Windows\System\kQuMcCU.exe
  C:\Windows\System\kQuMcCU.exe
  2⤵
  PID:10616
- C:\Windows\System\iRBpzyS.exe
  C:\Windows\System\iRBpzyS.exe
  2⤵
  PID:10632
- C:\Windows\System\GQXQXwm.exe
  C:\Windows\System\GQXQXwm.exe
  2⤵
  PID:10664
- C:\Windows\System\tcadZer.exe
  C:\Windows\System\tcadZer.exe
  2⤵
  PID:10684
- C:\Windows\System\KnoqmRw.exe
  C:\Windows\System\KnoqmRw.exe
  2⤵
  PID:10712
- C:\Windows\System\eZxKkUu.exe
  C:\Windows\System\eZxKkUu.exe
  2⤵
  PID:10732
- C:\Windows\System\FloqkaI.exe
  C:\Windows\System\FloqkaI.exe
  2⤵
  PID:10756
- C:\Windows\System\zlmqnmz.exe
  C:\Windows\System\zlmqnmz.exe
  2⤵
  PID:10772
- C:\Windows\System\xjAVFMU.exe
  C:\Windows\System\xjAVFMU.exe
  2⤵
  PID:10796
- C:\Windows\System\bIZPDQB.exe
  C:\Windows\System\bIZPDQB.exe
  2⤵
  PID:10820
- C:\Windows\System\Dnlxtjc.exe
  C:\Windows\System\Dnlxtjc.exe
  2⤵
  PID:10836
- C:\Windows\System\ymkdyaW.exe
  C:\Windows\System\ymkdyaW.exe
  2⤵
  PID:10864
- C:\Windows\System\HfaiOih.exe
  C:\Windows\System\HfaiOih.exe
  2⤵
  PID:10880
- C:\Windows\System\bYFZQvV.exe
  C:\Windows\System\bYFZQvV.exe
  2⤵
  PID:10896
- C:\Windows\System\LxSBqoA.exe
  C:\Windows\System\LxSBqoA.exe
  2⤵
  PID:10912
- C:\Windows\System\lxaYWTo.exe
  C:\Windows\System\lxaYWTo.exe
  2⤵
  PID:10928
- C:\Windows\System\ZVOkkXl.exe
  C:\Windows\System\ZVOkkXl.exe
  2⤵
  PID:10968
- C:\Windows\System\CaPBCPF.exe
  C:\Windows\System\CaPBCPF.exe
  2⤵
  PID:10992
- C:\Windows\System\ENnFzPi.exe
  C:\Windows\System\ENnFzPi.exe
  2⤵
  PID:11020
- C:\Windows\System\wSMpMUE.exe
  C:\Windows\System\wSMpMUE.exe
  2⤵
  PID:11060
- C:\Windows\System\WtAIsat.exe
  C:\Windows\System\WtAIsat.exe
  2⤵
  PID:11084
- C:\Windows\System\ysAmqrw.exe
  C:\Windows\System\ysAmqrw.exe
  2⤵
  PID:11116
- C:\Windows\System\pyVSXhf.exe
  C:\Windows\System\pyVSXhf.exe
  2⤵
  PID:11140
- C:\Windows\System\fGzVAOW.exe
  C:\Windows\System\fGzVAOW.exe
  2⤵
  PID:11160
- C:\Windows\System\jjKFSip.exe
  C:\Windows\System\jjKFSip.exe
  2⤵
  PID:11180
- C:\Windows\System\hpdOypV.exe
  C:\Windows\System\hpdOypV.exe
  2⤵
  PID:11204
- C:\Windows\System\FgBJFqr.exe
  C:\Windows\System\FgBJFqr.exe
  2⤵
  PID:11228
- C:\Windows\System\hSylTKR.exe
  C:\Windows\System\hSylTKR.exe
  2⤵
  PID:11252
- C:\Windows\System\kaEBXbf.exe
  C:\Windows\System\kaEBXbf.exe
  2⤵
  PID:7368
- C:\Windows\System\FQhdbBG.exe
  C:\Windows\System\FQhdbBG.exe
  2⤵
  PID:9404
- C:\Windows\System\eBtamIA.exe
  C:\Windows\System\eBtamIA.exe
  2⤵
  PID:8024
- C:\Windows\System\uZbnYBJ.exe
  C:\Windows\System\uZbnYBJ.exe
  2⤵
  PID:4976
- C:\Windows\System\WyosRjp.exe
  C:\Windows\System\WyosRjp.exe
  2⤵
  PID:9956
- C:\Windows\System\FfWMFXq.exe
  C:\Windows\System\FfWMFXq.exe
  2⤵
  PID:8516
- C:\Windows\System\lxvIBRe.exe
  C:\Windows\System\lxvIBRe.exe
  2⤵
  PID:8552
- C:\Windows\System\QCvNJmG.exe
  C:\Windows\System\QCvNJmG.exe
  2⤵
  PID:8588
- C:\Windows\System\VkUEwek.exe
  C:\Windows\System\VkUEwek.exe
  2⤵
  PID:8624
- C:\Windows\System\FcHEfwL.exe
  C:\Windows\System\FcHEfwL.exe
  2⤵
  PID:8676
- C:\Windows\System\rufZTpW.exe
  C:\Windows\System\rufZTpW.exe
  2⤵
  PID:8724
- C:\Windows\System\diQbphZ.exe
  C:\Windows\System\diQbphZ.exe
  2⤵
  PID:10080
- C:\Windows\System\wGbJYxY.exe
  C:\Windows\System\wGbJYxY.exe
  2⤵
  PID:10188
- C:\Windows\System\hgEyLXu.exe
  C:\Windows\System\hgEyLXu.exe
  2⤵
  PID:9232
- C:\Windows\System\dmShzZa.exe
  C:\Windows\System\dmShzZa.exe
  2⤵
  PID:8832
- C:\Windows\System\ckAANmI.exe
  C:\Windows\System\ckAANmI.exe
  2⤵
  PID:7752
- C:\Windows\System\KLLRjrr.exe
  C:\Windows\System\KLLRjrr.exe
  2⤵
  PID:8128
- C:\Windows\System\xRfovoo.exe
  C:\Windows\System\xRfovoo.exe
  2⤵
  PID:11288
- C:\Windows\System\fbjLiMW.exe
  C:\Windows\System\fbjLiMW.exe
  2⤵
  PID:11316
- C:\Windows\System\mnCHEwd.exe
  C:\Windows\System\mnCHEwd.exe
  2⤵
  PID:11332
- C:\Windows\System\bwvLgLR.exe
  C:\Windows\System\bwvLgLR.exe
  2⤵
  PID:11356
- C:\Windows\System\uoWiSsx.exe
  C:\Windows\System\uoWiSsx.exe
  2⤵
  PID:11376
- C:\Windows\System\mqXqqlG.exe
  C:\Windows\System\mqXqqlG.exe
  2⤵
  PID:11400
- C:\Windows\System\GPpoCEq.exe
  C:\Windows\System\GPpoCEq.exe
  2⤵
  PID:11424
- C:\Windows\System\CiAxHzR.exe
  C:\Windows\System\CiAxHzR.exe
  2⤵
  PID:11448
- C:\Windows\System\LHbRxwi.exe
  C:\Windows\System\LHbRxwi.exe
  2⤵
  PID:11468
- C:\Windows\System\giFIhEr.exe
  C:\Windows\System\giFIhEr.exe
  2⤵
  PID:11488
- C:\Windows\System\oZYtcXN.exe
  C:\Windows\System\oZYtcXN.exe
  2⤵
  PID:11516
- C:\Windows\System\WVjevCy.exe
  C:\Windows\System\WVjevCy.exe
  2⤵
  PID:11540
- C:\Windows\System\weBuIaK.exe
  C:\Windows\System\weBuIaK.exe
  2⤵
  PID:11560
- C:\Windows\System\AExXaAA.exe
  C:\Windows\System\AExXaAA.exe
  2⤵
  PID:11584
- C:\Windows\System\xBgslnN.exe
  C:\Windows\System\xBgslnN.exe
  2⤵
  PID:11604
- C:\Windows\System\hyDzbXJ.exe
  C:\Windows\System\hyDzbXJ.exe
  2⤵
  PID:11624
- C:\Windows\System\PsRFsxe.exe
  C:\Windows\System\PsRFsxe.exe
  2⤵
  PID:11648
- C:\Windows\System\MtMaCrP.exe
  C:\Windows\System\MtMaCrP.exe
  2⤵
  PID:11672
- C:\Windows\System\AvSMtTR.exe
  C:\Windows\System\AvSMtTR.exe
  2⤵
  PID:11696
- C:\Windows\System\FhXBuEG.exe
  C:\Windows\System\FhXBuEG.exe
  2⤵
  PID:11712
- C:\Windows\System\awlQvba.exe
  C:\Windows\System\awlQvba.exe
  2⤵
  PID:11736
- C:\Windows\System\OrZkJcn.exe
  C:\Windows\System\OrZkJcn.exe
  2⤵
  PID:11760
- C:\Windows\System\LNVpxrN.exe
  C:\Windows\System\LNVpxrN.exe
  2⤵
  PID:11780
- C:\Windows\System\MkPFcOq.exe
  C:\Windows\System\MkPFcOq.exe
  2⤵
  PID:11800
- C:\Windows\System\MeaUdAQ.exe
  C:\Windows\System\MeaUdAQ.exe
  2⤵
  PID:11824
- C:\Windows\System\kSagRpk.exe
  C:\Windows\System\kSagRpk.exe
  2⤵
  PID:11844
- C:\Windows\System\AoRnUtL.exe
  C:\Windows\System\AoRnUtL.exe
  2⤵
  PID:11864
- C:\Windows\System\LVlqekC.exe
  C:\Windows\System\LVlqekC.exe
  2⤵
  PID:11888
- C:\Windows\System\kRBujQr.exe
  C:\Windows\System\kRBujQr.exe
  2⤵
  PID:11912
- C:\Windows\System\GkfqzBf.exe
  C:\Windows\System\GkfqzBf.exe
  2⤵
  PID:11928
- C:\Windows\System\QbvFYUq.exe
  C:\Windows\System\QbvFYUq.exe
  2⤵
  PID:11952
- C:\Windows\System\sdmkQpJ.exe
  C:\Windows\System\sdmkQpJ.exe
  2⤵
  PID:11976
- C:\Windows\System\fbQsJuQ.exe
  C:\Windows\System\fbQsJuQ.exe
  2⤵
  PID:11996
- C:\Windows\System\YCOphzv.exe
  C:\Windows\System\YCOphzv.exe
  2⤵
  PID:12016
- C:\Windows\System\eWmvEYE.exe
  C:\Windows\System\eWmvEYE.exe
  2⤵
  PID:12032
- C:\Windows\System\FsaJxjm.exe
  C:\Windows\System\FsaJxjm.exe
  2⤵
  PID:12048
- C:\Windows\System\aicHdSZ.exe
  C:\Windows\System\aicHdSZ.exe
  2⤵
  PID:12064
- C:\Windows\System\rKJNzVZ.exe
  C:\Windows\System\rKJNzVZ.exe
  2⤵
  PID:12080
- C:\Windows\System\zomyxHG.exe
  C:\Windows\System\zomyxHG.exe
  2⤵
  PID:12096
- C:\Windows\System\SEdPGNQ.exe
  C:\Windows\System\SEdPGNQ.exe
  2⤵
  PID:12112
- C:\Windows\System\zKhEKms.exe
  C:\Windows\System\zKhEKms.exe
  2⤵
  PID:12128
- C:\Windows\System\pATQnZz.exe
  C:\Windows\System\pATQnZz.exe
  2⤵
  PID:12148
- C:\Windows\System\PLCKvTQ.exe
  C:\Windows\System\PLCKvTQ.exe
  2⤵
  PID:12176
- C:\Windows\System\nauyQKQ.exe
  C:\Windows\System\nauyQKQ.exe
  2⤵
  PID:12192
- C:\Windows\System\qqhEAiW.exe
  C:\Windows\System\qqhEAiW.exe
  2⤵
  PID:12236
- C:\Windows\System\EzEjrqN.exe
  C:\Windows\System\EzEjrqN.exe
  2⤵
  PID:12252
- C:\Windows\System\WHbSWwX.exe
  C:\Windows\System\WHbSWwX.exe
  2⤵
  PID:12272
- C:\Windows\System\CCRDVjq.exe
  C:\Windows\System\CCRDVjq.exe
  2⤵
  PID:9264
- C:\Windows\System\DDHUZlq.exe
  C:\Windows\System\DDHUZlq.exe
  2⤵
  PID:7124
- C:\Windows\System\NoAfjFI.exe
  C:\Windows\System\NoAfjFI.exe
  2⤵
  PID:9444
- C:\Windows\System\sZDESFM.exe
  C:\Windows\System\sZDESFM.exe
  2⤵
  PID:9540
- C:\Windows\System\IIGUeTW.exe
  C:\Windows\System\IIGUeTW.exe
  2⤵
  PID:9144
- C:\Windows\System\VeihCxT.exe
  C:\Windows\System\VeihCxT.exe
  2⤵
  PID:6116
- C:\Windows\System\uBHrhrV.exe
  C:\Windows\System\uBHrhrV.exe
  2⤵
  PID:7328
- C:\Windows\System\bwkBZVn.exe
  C:\Windows\System\bwkBZVn.exe
  2⤵
  PID:8004
- C:\Windows\System\FvBvNle.exe
  C:\Windows\System\FvBvNle.exe
  2⤵
  PID:9320
- C:\Windows\System\EWipPnP.exe
  C:\Windows\System\EWipPnP.exe
  2⤵
  PID:6184
- C:\Windows\System\uzFaOVA.exe
  C:\Windows\System\uzFaOVA.exe
  2⤵
  PID:11328
- C:\Windows\System\PaNXcZj.exe
  C:\Windows\System\PaNXcZj.exe
  2⤵
  PID:9352
- C:\Windows\System\xPUcOsj.exe
  C:\Windows\System\xPUcOsj.exe
  2⤵
  PID:7132
- C:\Windows\System\sQKdpSQ.exe
  C:\Windows\System\sQKdpSQ.exe
  2⤵
  PID:11480
- C:\Windows\System\LGEvSLC.exe
  C:\Windows\System\LGEvSLC.exe
  2⤵
  PID:10244
- C:\Windows\System\PVvCcJJ.exe
  C:\Windows\System\PVvCcJJ.exe
  2⤵
  PID:10280
- C:\Windows\System\YuEByKQ.exe
  C:\Windows\System\YuEByKQ.exe
  2⤵
  PID:10348
- C:\Windows\System\sXOpcer.exe
  C:\Windows\System\sXOpcer.exe
  2⤵
  PID:4168
- C:\Windows\System\RaXMszw.exe
  C:\Windows\System\RaXMszw.exe
  2⤵
  PID:11708
- C:\Windows\System\CDBPPeN.exe
  C:\Windows\System\CDBPPeN.exe
  2⤵
  PID:12296
- C:\Windows\System\MolYPok.exe
  C:\Windows\System\MolYPok.exe
  2⤵
  PID:12320
- C:\Windows\System\fPvTbAy.exe
  C:\Windows\System\fPvTbAy.exe
  2⤵
  PID:12348
- C:\Windows\System\WQXlIMj.exe
  C:\Windows\System\WQXlIMj.exe
  2⤵
  PID:12368
- C:\Windows\System\kDGNCxI.exe
  C:\Windows\System\kDGNCxI.exe
  2⤵
  PID:12388
- C:\Windows\System\cegJZNM.exe
  C:\Windows\System\cegJZNM.exe
  2⤵
  PID:12408
- C:\Windows\System\RCZXnkI.exe
  C:\Windows\System\RCZXnkI.exe
  2⤵
  PID:12424
- C:\Windows\System\lgcpKtQ.exe
  C:\Windows\System\lgcpKtQ.exe
  2⤵
  PID:12440
- C:\Windows\System\SeoeVlq.exe
  C:\Windows\System\SeoeVlq.exe
  2⤵
  PID:12456
- C:\Windows\System\ZHLsBqH.exe
  C:\Windows\System\ZHLsBqH.exe
  2⤵
  PID:12476
- C:\Windows\System\QxbhxVD.exe
  C:\Windows\System\QxbhxVD.exe
  2⤵
  PID:12492
- C:\Windows\System\HGUSIET.exe
  C:\Windows\System\HGUSIET.exe
  2⤵
  PID:12508
- C:\Windows\System\PtWzeis.exe
  C:\Windows\System\PtWzeis.exe
  2⤵
  PID:12524
- C:\Windows\System\oCtzGQi.exe
  C:\Windows\System\oCtzGQi.exe
  2⤵
  PID:12540
- C:\Windows\System\EmTOKkf.exe
  C:\Windows\System\EmTOKkf.exe
  2⤵
  PID:12556
- C:\Windows\System\UaGLlzy.exe
  C:\Windows\System\UaGLlzy.exe
  2⤵
  PID:12572
- C:\Windows\System\VymCvng.exe
  C:\Windows\System\VymCvng.exe
  2⤵
  PID:12588
- C:\Windows\System\fQTwFuV.exe
  C:\Windows\System\fQTwFuV.exe
  2⤵
  PID:12612
- C:\Windows\System\malPBWJ.exe
  C:\Windows\System\malPBWJ.exe
  2⤵
  PID:12636
- C:\Windows\System\UEzarjs.exe
  C:\Windows\System\UEzarjs.exe
  2⤵
  PID:12656
- C:\Windows\System\BAFNwhB.exe
  C:\Windows\System\BAFNwhB.exe
  2⤵
  PID:12676
- C:\Windows\System\asfvYUU.exe
  C:\Windows\System\asfvYUU.exe
  2⤵
  PID:12704
- C:\Windows\System\IUHorEy.exe
  C:\Windows\System\IUHorEy.exe
  2⤵
  PID:12728
- C:\Windows\System\wTwXgVX.exe
  C:\Windows\System\wTwXgVX.exe
  2⤵
  PID:12748
- C:\Windows\System\fIbrKDw.exe
  C:\Windows\System\fIbrKDw.exe
  2⤵
  PID:12776
- C:\Windows\System\WFGqzTq.exe
  C:\Windows\System\WFGqzTq.exe
  2⤵
  PID:12796
- C:\Windows\System\WmpNUqB.exe
  C:\Windows\System\WmpNUqB.exe
  2⤵
  PID:12828
- C:\Windows\System\jigtric.exe
  C:\Windows\System\jigtric.exe
  2⤵
  PID:12848
- C:\Windows\System\DJSgdZR.exe
  C:\Windows\System\DJSgdZR.exe
  2⤵
  PID:12872
- C:\Windows\System\JYEzBif.exe
  C:\Windows\System\JYEzBif.exe
  2⤵
  PID:12896
- C:\Windows\System\AEvzmso.exe
  C:\Windows\System\AEvzmso.exe
  2⤵
  PID:12920
- C:\Windows\System\EXYezYN.exe
  C:\Windows\System\EXYezYN.exe
  2⤵
  PID:12944
- C:\Windows\System\Wtworxh.exe
  C:\Windows\System\Wtworxh.exe
  2⤵
  PID:12960
- C:\Windows\System\jcKlCfn.exe
  C:\Windows\System\jcKlCfn.exe
  2⤵
  PID:12976
- C:\Windows\System\LVerTaz.exe
  C:\Windows\System\LVerTaz.exe
  2⤵
  PID:12996
- C:\Windows\System\FoKMrPB.exe
  C:\Windows\System\FoKMrPB.exe
  2⤵
  PID:13020
- C:\Windows\System\LNEfwbA.exe
  C:\Windows\System\LNEfwbA.exe
  2⤵
  PID:13044
- C:\Windows\System\qeHTLmH.exe
  C:\Windows\System\qeHTLmH.exe
  2⤵
  PID:13072
- C:\Windows\System\CWdOesl.exe
  C:\Windows\System\CWdOesl.exe
  2⤵
  PID:13088
- C:\Windows\System\WlfjeHK.exe
  C:\Windows\System\WlfjeHK.exe
  2⤵
  PID:13112
- C:\Windows\System\VoneqTA.exe
  C:\Windows\System\VoneqTA.exe
  2⤵
  PID:13136
- C:\Windows\System\VyKNyqJ.exe
  C:\Windows\System\VyKNyqJ.exe
  2⤵
  PID:13164
- C:\Windows\System\gbmfAMT.exe
  C:\Windows\System\gbmfAMT.exe
  2⤵
  PID:13184
- C:\Windows\System\CoBwJKV.exe
  C:\Windows\System\CoBwJKV.exe
  2⤵
  PID:13204
- C:\Windows\System\gbWsoIg.exe
  C:\Windows\System\gbWsoIg.exe
  2⤵
  PID:13224
- C:\Windows\System\dxoOCBk.exe
  C:\Windows\System\dxoOCBk.exe
  2⤵
  PID:13248
- C:\Windows\System\bEZubcE.exe
  C:\Windows\System\bEZubcE.exe
  2⤵
  PID:13264
- C:\Windows\System\PDMlVNS.exe
  C:\Windows\System\PDMlVNS.exe
  2⤵
  PID:13284
- C:\Windows\System\IiXzwdo.exe
  C:\Windows\System\IiXzwdo.exe
  2⤵
  PID:13308
- C:\Windows\System\rnUyfjI.exe
  C:\Windows\System\rnUyfjI.exe
  2⤵
  PID:11820
- C:\Windows\System\tsLuxNn.exe
  C:\Windows\System\tsLuxNn.exe
  2⤵
  PID:9464
- C:\Windows\System\JvKdONp.exe
  C:\Windows\System\JvKdONp.exe
  2⤵
  PID:9520
- C:\Windows\System\PhHSavX.exe
  C:\Windows\System\PhHSavX.exe
  2⤵
  PID:9564
- C:\Windows\System\tdsilas.exe
  C:\Windows\System\tdsilas.exe
  2⤵
  PID:10420
- C:\Windows\System\cNARuFl.exe
  C:\Windows\System\cNARuFl.exe
  2⤵
  PID:9656
- C:\Windows\System\VrEjCKQ.exe
  C:\Windows\System\VrEjCKQ.exe
  2⤵
  PID:9696
- C:\Windows\System\vfPkitt.exe
  C:\Windows\System\vfPkitt.exe
  2⤵
  PID:7164
- C:\Windows\System\Xcedynn.exe
  C:\Windows\System\Xcedynn.exe
  2⤵
  PID:11436
- C:\Windows\System\FytDZlS.exe
  C:\Windows\System\FytDZlS.exe
  2⤵
  PID:10724
- C:\Windows\System\NDHykoE.exe
  C:\Windows\System\NDHykoE.exe
  2⤵
  PID:11792
- C:\Windows\System\qwbucif.exe
  C:\Windows\System\qwbucif.exe
  2⤵
  PID:12532
- C:\Windows\System\htoUsey.exe
  C:\Windows\System\htoUsey.exe
  2⤵
  PID:9996
- C:\Windows\System\mgtsnmp.exe
  C:\Windows\System\mgtsnmp.exe
  2⤵
  PID:11988
- C:\Windows\System\cwvzpET.exe
  C:\Windows\System\cwvzpET.exe
  2⤵
  PID:2704
- C:\Windows\System\gAfYoAp.exe
  C:\Windows\System\gAfYoAp.exe
  2⤵
  PID:10048
- C:\Windows\System\HccxFOM.exe
  C:\Windows\System\HccxFOM.exe
  2⤵
  PID:10432
- C:\Windows\System\vgBvNyU.exe
  C:\Windows\System\vgBvNyU.exe
  2⤵
  PID:13036
- C:\Windows\System\RgFjUYQ.exe
  C:\Windows\System\RgFjUYQ.exe
  2⤵
  PID:13108
- C:\Windows\System\FgdooIY.exe
  C:\Windows\System\FgdooIY.exe
  2⤵
  PID:2544
- C:\Windows\System\PbTvioC.exe
  C:\Windows\System\PbTvioC.exe
  2⤵
  PID:6624
- C:\Windows\System\QRxFBhT.exe
  C:\Windows\System\QRxFBhT.exe
  2⤵
  PID:9680
- C:\Windows\System\hwfQxZW.exe
  C:\Windows\System\hwfQxZW.exe
  2⤵
  PID:12396
- C:\Windows\System\bnGWWnt.exe
  C:\Windows\System\bnGWWnt.exe
  2⤵
  PID:11068
- C:\Windows\System\eCIdoxa.exe
  C:\Windows\System\eCIdoxa.exe
  2⤵
  PID:2860
- C:\Windows\System\jMmwvFv.exe
  C:\Windows\System\jMmwvFv.exe
  2⤵
  PID:8196
- C:\Windows\System\HKnpWgi.exe
  C:\Windows\System\HKnpWgi.exe
  2⤵
  PID:13240
- C:\Windows\System\mnUVtBt.exe
  C:\Windows\System\mnUVtBt.exe
  2⤵
  PID:12788
- C:\Windows\System\YgSgwfR.exe
  C:\Windows\System\YgSgwfR.exe
  2⤵
  PID:11640
- C:\Windows\System\mLynsCI.exe
  C:\Windows\System\mLynsCI.exe
  2⤵
  PID:2424
- C:\Windows\System\aLCkuve.exe
  C:\Windows\System\aLCkuve.exe
  2⤵
  PID:2316
- C:\Windows\System\ocpcjjS.exe
  C:\Windows\System\ocpcjjS.exe
  2⤵
  PID:11860
- C:\Windows\System\gvpHHSc.exe
  C:\Windows\System\gvpHHSc.exe
  2⤵
  PID:12012
- C:\Windows\System\qptYjaE.exe
  C:\Windows\System\qptYjaE.exe
  2⤵
  PID:12140
- C:\Windows\System\nwsDfpE.exe
  C:\Windows\System\nwsDfpE.exe
  2⤵
  PID:9488
- C:\Windows\System\SRFsNcM.exe
  C:\Windows\System\SRFsNcM.exe
  2⤵
  PID:4260
- C:\Windows\System\kaeWMWq.exe
  C:\Windows\System\kaeWMWq.exe
  2⤵
  PID:7244
- C:\Windows\System\uiClXgT.exe
  C:\Windows\System\uiClXgT.exe
  2⤵
  PID:9336
- C:\Windows\System\uxOwoUm.exe
  C:\Windows\System\uxOwoUm.exe
  2⤵
  PID:3236
- C:\Windows\System\yrVCMbf.exe
  C:\Windows\System\yrVCMbf.exe
  2⤵
  PID:11240
- C:\Windows\System\NRKdktw.exe
  C:\Windows\System\NRKdktw.exe
  2⤵
  PID:2408
- C:\Windows\System\nEpzsNF.exe
  C:\Windows\System\nEpzsNF.exe
  2⤵
  PID:8268
- C:\Windows\System\xbIqdJu.exe
  C:\Windows\System\xbIqdJu.exe
  2⤵
  PID:12184
- C:\Windows\System\jWIasOC.exe
  C:\Windows\System\jWIasOC.exe
  2⤵
  PID:11944
- C:\Windows\System\bmtxrtJ.exe
  C:\Windows\System\bmtxrtJ.exe
  2⤵
  PID:4048
- C:\Windows\System\NJfGpfp.exe
  C:\Windows\System\NJfGpfp.exe
  2⤵
  PID:9936
- C:\Windows\System\cZVTECo.exe
  C:\Windows\System\cZVTECo.exe
  2⤵
  PID:13040
- C:\Windows\System\mrjIGda.exe
  C:\Windows\System\mrjIGda.exe
  2⤵
  PID:5064
- C:\Windows\System\RZgBmqQ.exe
  C:\Windows\System\RZgBmqQ.exe
  2⤵
  PID:4792
- C:\Windows\System\AZFOUEE.exe
  C:\Windows\System\AZFOUEE.exe
  2⤵
  PID:9848
- C:\Windows\System\xcGQsBD.exe
  C:\Windows\System\xcGQsBD.exe
  2⤵
  PID:1528
- C:\Windows\System\sqUYiJm.exe
  C:\Windows\System\sqUYiJm.exe
  2⤵
  PID:12124
- C:\Windows\System\ascjlAF.exe
  C:\Windows\System\ascjlAF.exe
  2⤵
  PID:13244
- C:\Windows\System\twRjaIM.exe
  C:\Windows\System\twRjaIM.exe
  2⤵
  PID:9012
- C:\Windows\System\VnrZcOc.exe
  C:\Windows\System\VnrZcOc.exe
  2⤵
  PID:2040
- C:\Windows\System\zayDUwu.exe
  C:\Windows\System\zayDUwu.exe
  2⤵
  PID:13080
- C:\Windows\System\QMnbRwS.exe
  C:\Windows\System\QMnbRwS.exe
  2⤵
  PID:12504
- C:\Windows\System\NhluUvI.exe
  C:\Windows\System\NhluUvI.exe
  2⤵
  PID:2820
- C:\Windows\System\qtPhQMD.exe
  C:\Windows\System\qtPhQMD.exe
  2⤵
  PID:4812
- C:\Windows\System\TkYIlys.exe
  C:\Windows\System\TkYIlys.exe
  2⤵
  PID:4592
- C:\Windows\System\auRGcgV.exe
  C:\Windows\System\auRGcgV.exe
  2⤵
  PID:13096
- C:\Windows\System\BPgwEFw.exe
  C:\Windows\System\BPgwEFw.exe
  2⤵
  PID:7504
- C:\Windows\System\lSVagSz.exe
  C:\Windows\System\lSVagSz.exe
  2⤵
  PID:9548
- C:\Windows\System\FXOfbzR.exe
  C:\Windows\System\FXOfbzR.exe
  2⤵
  PID:1804
- C:\Windows\System\RmNGlrV.exe
  C:\Windows\System\RmNGlrV.exe
  2⤵
  PID:11856
- C:\Windows\System\JyXAUnc.exe
  C:\Windows\System\JyXAUnc.exe
  2⤵
  PID:12044
- C:\Windows\System\vAZwgho.exe
  C:\Windows\System\vAZwgho.exe
  2⤵
  PID:11880
- C:\Windows\System\htzXmvY.exe
  C:\Windows\System\htzXmvY.exe
  2⤵
  PID:4704
- C:\Windows\System\QeXAFUT.exe
  C:\Windows\System\QeXAFUT.exe
  2⤵
  PID:10816
- C:\Windows\System\EVGCrwg.exe
  C:\Windows\System\EVGCrwg.exe
  2⤵
  PID:10036
- C:\Windows\System\Hrcjkqr.exe
  C:\Windows\System\Hrcjkqr.exe
  2⤵
  PID:13316
- C:\Windows\System\VUkxHgb.exe
  C:\Windows\System\VUkxHgb.exe
  2⤵
  PID:13348
- C:\Windows\System\sZRaynY.exe
  C:\Windows\System\sZRaynY.exe
  2⤵
  PID:13424
- C:\Windows\System\ReXcREy.exe
  C:\Windows\System\ReXcREy.exe
  2⤵
  PID:13452
- C:\Windows\System\MmeXgfQ.exe
  C:\Windows\System\MmeXgfQ.exe
  2⤵
  PID:13544
- C:\Windows\System\RRTKZUu.exe
  C:\Windows\System\RRTKZUu.exe
  2⤵
  PID:13768
- C:\Windows\System\pMVpFSC.exe
  C:\Windows\System\pMVpFSC.exe
  2⤵
  PID:13972
- C:\Windows\System\qiwfXWM.exe
  C:\Windows\System\qiwfXWM.exe
  2⤵
  PID:13988
- C:\Windows\System\LYLOXja.exe
  C:\Windows\System\LYLOXja.exe
  2⤵
  PID:14084
- C:\Windows\System\gMnLCmq.exe
  C:\Windows\System\gMnLCmq.exe
  2⤵
  PID:14120
- C:\Windows\System\munhZkR.exe
  C:\Windows\System\munhZkR.exe
  2⤵
  PID:14192
- C:\Windows\System\mXHjYmi.exe
  C:\Windows\System\mXHjYmi.exe
  2⤵
  PID:14244
- C:\Windows\System\kSCMlyR.exe
  C:\Windows\System\kSCMlyR.exe
  2⤵
  PID:14288
- C:\Windows\System\KxpSgKa.exe
  C:\Windows\System\KxpSgKa.exe
  2⤵
  PID:14316
- C:\Windows\System\sdkfxGy.exe
  C:\Windows\System\sdkfxGy.exe
  2⤵
  PID:12340
- C:\Windows\System\CzXsPqX.exe
  C:\Windows\System\CzXsPqX.exe
  2⤵
  PID:11684
- C:\Windows\System\BHGVdik.exe
  C:\Windows\System\BHGVdik.exe
  2⤵
  PID:8052
- C:\Windows\System\csgnwFY.exe
  C:\Windows\System\csgnwFY.exe
  2⤵
  PID:11768
- C:\Windows\System\xgvErxF.exe
  C:\Windows\System\xgvErxF.exe
  2⤵
  PID:9284
- C:\Windows\System\NASibPZ.exe
  C:\Windows\System\NASibPZ.exe
  2⤵
  PID:13016
- C:\Windows\System\CsrSemv.exe
  C:\Windows\System\CsrSemv.exe
  2⤵
  PID:11668
- C:\Windows\System\wyRVnbr.exe
  C:\Windows\System\wyRVnbr.exe
  2⤵
  PID:2956
- C:\Windows\System\MBQICar.exe
  C:\Windows\System\MBQICar.exe
  2⤵
  PID:11372
- C:\Windows\System\qBCtoXd.exe
  C:\Windows\System\qBCtoXd.exe
  2⤵
  PID:10768
- C:\Windows\System\PIKcwIM.exe
  C:\Windows\System\PIKcwIM.exe
  2⤵
  PID:4992
- C:\Windows\System\wBjMocL.exe
  C:\Windows\System\wBjMocL.exe
  2⤵
  PID:10260
- C:\Windows\System\GZuPSWd.exe
  C:\Windows\System\GZuPSWd.exe
  2⤵
  PID:13328
- C:\Windows\System\XSalvXQ.exe
  C:\Windows\System\XSalvXQ.exe
  2⤵
  PID:13756
- C:\Windows\System\hAuUdwR.exe
  C:\Windows\System\hAuUdwR.exe
  2⤵
  PID:13468
- C:\Windows\System\IiVFCtK.exe
  C:\Windows\System\IiVFCtK.exe
  2⤵
  PID:13620
- C:\Windows\System\NAInuxY.exe
  C:\Windows\System\NAInuxY.exe
  2⤵
  PID:13648
- C:\Windows\System\ylxyaas.exe
  C:\Windows\System\ylxyaas.exe
  2⤵
  PID:13848
- C:\Windows\System\TPBafDg.exe
  C:\Windows\System\TPBafDg.exe
  2⤵
  PID:14016
- C:\Windows\System\WviHZro.exe
  C:\Windows\System\WviHZro.exe
  2⤵
  PID:14048

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 592 -p 12996 -ip 12996
1⤵
PID:4792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_kbnwtojl.2ug.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kbnwtojl.2ug.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AtKAdMP.exe

Path C:\Windows\System\AtKAdMP.exe
Size 1.9MB
SHA256 65e4c454d59948d8a1e33bb8e5ddaebd170e818b83f603079f0482cd94224dab
MD5 139e74c1f505de4e6daca1d06f21eeac
SHA1 2dbda85f1c84e1c9e7bd44d551a39fbd09ad4df4
SHA512 c5c8991a50d4685bf2644d1e840e664b33c9a2adbd9d2c544c68e7d297a48f08121b1314750a04358ca56c52e46c66cb3a2920cb28c8dfe345156bca7175d78a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlK:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

BGxspgN.exe

Path C:\Windows\System\BGxspgN.exe
Size 1.9MB
SHA256 b2cd83a3d3c185d92a59fa2ed860f693141643fcdfd39528873519ce70572f37
MD5 a110b56eb3d84c0e012ccba1e1909a7a
SHA1 71e51ad2da772d09701bc1f9467ba4ddd55b8a57
SHA512 704ff3bfa8bcfe187c5b05f3a77f57e5dca1c1e420991043c828db0b334026451bb52227f272ea5ad5245b5bf7115d7d82f3535772b8e7cfad5f3999cbb36b78
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlF:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

BLQRyTu.exe

Path C:\Windows\System\BLQRyTu.exe
Size 1.9MB
SHA256 55e0c23ab847480b1b88e6f3b87b015329d66033d7a21c825d276edce9bc7beb
MD5 c98521165891ab2ed9eedd866d4faf2e
SHA1 1848e55f5534f502ad621f81975a4107ad21864f
SHA512 0751594bc0224fa3dbd1e5f87995b941fc67d8d4e0dbe5a1bec1df8d43a7442ccebc757e6e9a0432e82f99b231976613f2d65c9377ce9f773bfcf91bd378ba21
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlI:NABv
MD5 SHA1 SHA512 SSDEEP

Submit Download

BfiMLJC.exe

Path C:\Windows\System\BfiMLJC.exe
Size 1.9MB
SHA256 b87c0f0f3f5139993d74a10de160a6c672afad2052f3dd6119be9d66d2644a48
MD5 c5c8ac89cc6c6a177c755545481db7f0
SHA1 99f287d8ebad239b05e95a4dbf670362c9492818
SHA512 7d07526fd935e229c4eb277d75dbf99c409e6b25ed448829edfbec71c06bcaaca72a1573eb5b69cfc55b6282c7fdd8fefa4399896c6e525ec06a8a2518d09d98
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlR:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

CwmUlIb.exe

Path C:\Windows\System\CwmUlIb.exe
Size 1.9MB
SHA256 34d2d74896146fca50404434377ac0de0ea53945b5816455ea906107cc1f8f22
MD5 82139f7277784768348a301c999ae4ed
SHA1 57a6166541b7a50c79f924ea621fefe5ca71ddcb
SHA512 9a5c5a156016815595f75805488cf6999a8b230452ce11e339d823eebdc51da4cbd2c9599db56ab20c5bdc3556d7333c5c24c1b7835a691deac88be844af2330
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlN:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEDAciC.exe

Path C:\Windows\System\DEDAciC.exe
Size 1.9MB
SHA256 67da34619492ccbcc917713d474ead0efff590f0e2b1b953ff3ed076c384dc4f
MD5 4b7d7fddc433d2b09caab12d9c8f5adf
SHA1 ab6954d77f2e8621a6374b78bbf50b8775a6f9eb
SHA512 705118c41946c23f219e77ad18a4217c97e5e4cb34434c22d2c5f6ac014b55ddecc67448c40558cdfe8b305e0fe468dd661f8ecdf89ab77989bfc1e62ed1441e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl4:NAB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

DyYTAgX.exe

Path C:\Windows\System\DyYTAgX.exe
Size 1.9MB
SHA256 3a386b5fd7b6a15fdd066f5decdc17ddc47af31409d05e530b2b76e039fec10a
MD5 92984a21efa5e34149b382023dec7383
SHA1 bf6eeab3b7565e531bf4d8c944698e7c8a35c8ee
SHA512 9e70f8ef5021639fdd3a28f10f117439765ed14dbca1909fd8c408e2c39c17eb7a7351f0046deda67c31df34abf6f3661c6707eb702cbd843221d402b7745812
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl+:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ENFhPtH.exe

Path C:\Windows\System\ENFhPtH.exe
Size 1.9MB
SHA256 df584753fd5f5527cc74b881666169f4f5d2cabeb29558d4ab43e28e295d3035
MD5 2127166a20f02010cc2818cac61591da
SHA1 ae38a66d1bd44ca87ecc18d2ed4fb327db905c6b
SHA512 c6b945c4245410d75b9222f60cbf5d926a1460acb168c7023b8adbee94058884959da944ecdd69c0832345fa564a2614080ad1343f11c1eab09a013bec175973
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlJ:NABK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ENgpEnE.exe

Path C:\Windows\System\ENgpEnE.exe
Size 1.9MB
SHA256 186d413d5d42e75c26e98c6c6207a923ee6aff790818ab7176e173323c41e151
MD5 a69b311dd579ac6cbac088a4de6c131d
SHA1 eea35a34aa130b50ca2ae1065baed74633e63d6d
SHA512 a63372cea555edb64e834a7d024ac7131304cd06807e68a52895b5fb2221feab4cd070273b9582b4b2e88c688de857e36beeb6e91ef34ec12b0e3d3384d2464e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlf:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

EoVeQHu.exe

Path C:\Windows\System\EoVeQHu.exe
Size 1.9MB
SHA256 87da180cc60a27c052c725b1db80325b7f62ea2ba6c803f0c55cac7e86311af5
MD5 e8aa6d8209545fadf6f54b926952add5
SHA1 b301b927a92b2029609d35aa5358e90718d91204
SHA512 540705f0577633318729408c73c13f5dd6f3f5e4688e886ebfd9c842b41ac13d77acefb7be405afad17e0dbad340d7603818eab773e93062c54bd756c228fae0
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlt:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

GjiRbxb.exe

Path C:\Windows\System\GjiRbxb.exe
Size 1.9MB
SHA256 d2498b91f1382eeb911b25dbe6d2e6bff54d29defe77e51235d97696a4bc3d4a
MD5 e9056d0accc7d872f0177634238bdb53
SHA1 c671eafb27147417836ebd6ba0450275de0e1ac0
SHA512 583a7828ea7adae7085a1f2f79abb4e5aac6689374e70f576a0f0c6a7212bb5c4adcffe7f8774c642013b2a708ef2df207037a0b0de52240dc15ed2207223a2b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlv:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

HiYUlBf.exe

Path C:\Windows\System\HiYUlBf.exe
Size 1.9MB
SHA256 1a1adb6aa555d7a72158c4e8883ab78c0efe2f19a15066b83836318f0a3827af
MD5 f02bf2b9b9ccece6854dda5514c6646f
SHA1 f3ff6ac50941aa811e10439eef1a6dbe70b368c5
SHA512 607a8990f012d2a32cd7b66d1b254c5582f6fc5aaedf72ab20977e97d8f9928d42603809350cd44e2ba717b824c99bafd13aba51681cf5fdd492f488a1330357
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl1:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

IXQcQam.exe

Path C:\Windows\System\IXQcQam.exe
Size 1.9MB
SHA256 65e5ce3b24244fc548320f5fdf9a0eaf63f32f29504f7b81d6aea06b7676bda2
MD5 26e24ed8e25617157b50086833e4aea7
SHA1 adc14b1b8702ff6901cd9c8cf5ec05cad00f4ea5
SHA512 4b97f30521f418adcead8a94b68c94202bea9bf068fc030646e5f513e40e60c197f41beb357decab0333388318a0b3992823311ca00512f4936b8b2b8415de1f
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrln:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

LNhHJkx.exe

Path C:\Windows\System\LNhHJkx.exe
Size 1.9MB
SHA256 189c97210b2abc6feda371804b56e22ed464d765631438d44b2d739c64c5436d
MD5 a7de738d5e1a5a51f9a245a978d637bc
SHA1 c80c7905b5fd6f3f8e2f843314ebf0acff7cae78
SHA512 d9752668a3d6fa7891deaedb878436f3148dbe64f6d7387fb7dabacf103df3cd008f1cdfb41173b2b155e8f542ae0d20a11377ca58e573c91fb0d3425cd7ba37
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl/:NAB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

LmgszrH.exe

Path C:\Windows\System\LmgszrH.exe
Size 1.9MB
SHA256 24c5a86817e14e20ba1b238b0d061b8df28bfc8a855df847972c62a7d55167ca
MD5 486c1654d7a0dd50aae5611c9064361b
SHA1 4994a5e131c6260da5c8511a3613c5a3bb39c7f9
SHA512 c7ed39875c64d5be5c37d843c60d4ed9a2006452f822f8414bac35affa9dfc02ab42d50a7e7df10f9a37f9168947e6cd900f9749dc5425d641b896720850cec9
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlh:NABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

MqUxGcL.exe

Path C:\Windows\System\MqUxGcL.exe
Size 1.9MB
SHA256 38eece9488f329df712cac0fc873567722920d7371d0fe1c50990baf675857ab
MD5 77ef87d70d8eaca3a57216d99a7dfb6b
SHA1 03567ad9e14642f135e6b582503cad8d46aa5514
SHA512 75aa34a04a8c4f27bb31a5e173e409dffcc788c6361909bcfef03b1723435c69efe785a33fe0ad77b3bc19fa6c5dc144c82d983af9bc85d08f88cd6e490416e0
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlj:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

QCZkRKz.exe

Path C:\Windows\System\QCZkRKz.exe
Size 1.9MB
SHA256 af18ba2c0379f97726559f55041c29dc92502a39ede7dab70faf1f8810c8b77e
MD5 8633f40ee331a8f81738c15cd2fc022e
SHA1 f3aecdf9111151fdcef30ddcb53df5719bf34ee7
SHA512 cec9395352efbeb2d00255b6754a789c0d17fd527f2250e4c60b9a7d3c861d350a66a35b3764d35f53aa2933ec42d60c67a0446adf3147f4c83ba6cf90e065fd
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrll:NABC
MD5 SHA1 SHA512 SSDEEP

Submit Download

QwbCwJs.exe

Path C:\Windows\System\QwbCwJs.exe
Size 1.9MB
SHA256 494bea06853a7f06b35741e03484e092cf48486e57f55f546be21c69981f89d7
MD5 6565b80cb75814d05b409bfe705d9d6e
SHA1 bc95c88f1f9a3e9e4d1a5614ba27b057f4c0c5fa
SHA512 9a55f4ee912c6df43064276ed586e556fa4effb4683c88f42062be1e4f5bdfed59ca830bf28d125847fa6c83a3cbc648f5061d8458383e295dd772baeb53f0a5
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl4+:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

STCcvyV.exe

Path C:\Windows\System\STCcvyV.exe
Size 1.9MB
SHA256 088f579ff91f83f10b0259f2a99a4af38894a908145ce8c7b4028c73036f76f3
MD5 7d5ca99b17d1b028a5d708d558709e33
SHA1 f6d6bf108c9abbacc36c543de50a69b63a028b84
SHA512 880ceca802a869619c8efaec336bac202ceb17567308c3873f1ca3f5c62426483480162d5f91636b04b1115eebdfdd342314168e02ad03f1746f546a3d179dd5
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlz:NABg
MD5 SHA1 SHA512 SSDEEP

Submit Download

SuCcyJo.exe

Path C:\Windows\System\SuCcyJo.exe
Size 8B
SHA256 a924546cb05e0d111a25fcb8e7f183457926abae319588a0b32ef2b05d457163
MD5 b849dbcfb08ac877290add49e99178d8
SHA1 e96fe151173fd43a6d834740f52198931a388bf9
SHA512 8b4a01f83882b6e5a7d86633f11ab4b0beb94666eb64954ae2be067858515a1f39d026e62a6fa7cb4c876187b4f3fb07031095ae0126acf1cb139bd0d21d7863
MD5 SHA1 SHA512

Submit Download

TRjgrIL.exe

Path C:\Windows\System\TRjgrIL.exe
Size 1.9MB
SHA256 eb411368b45d705c0fd405e5edf6b5dedbe0bcb472e5813f9afb9c508e1a6616
MD5 da3690378a973b231c4dc891d05b584c
SHA1 928f0d89044d710df325c076aa83b19f965d38e7
SHA512 bcf8e6dafd2507b1bb068739817acad19300f3cf3c8ce91cf631c941e594de03a7e72b885424c0bf57c2540754fd3d7ae793676125d3e8b2f1587f14706fb6a3
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrls:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TxSJAkm.exe

Path C:\Windows\System\TxSJAkm.exe
Size 1.9MB
SHA256 bccaebe9005df235ebeb3fc04c5c646ee5e9bd2b2e0f8f63f868d734aadbe009
MD5 67a08728391f5952a82901ea8c8a67f3
SHA1 f0f1bc469e1bffb1de706a78a2e8ee42d6bd6283
SHA512 99e8015e7fbcbe904c343916d1715cd8b2b1a3c7d6ea73acf5adbac60928513e672d5c3b5e33576cca31fd3e9555ba70e230928ead36d67eed9250cc9e3e7e4b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlY:NABH
MD5 SHA1 SHA512 SSDEEP

Submit Download

UQAtDlv.exe

Path C:\Windows\System\UQAtDlv.exe
Size 1.9MB
SHA256 02b378c86fc40d61f97884654729350c0a59cb700af6ce5d97587aeb08f9c14e
MD5 c098f2b838e0139c2028bbb4d3b0048d
SHA1 ffb769847ac36d7840bb67e666ab4a1b5ab03bd7
SHA512 492aa67640a979ee51f7ec57a0c079ac36bbd692207ee43470b96ebd512a2e7028a9b9023c352cdc3ae417de95580b011ec688784c70b5c6e88b47c0d5e3b23d
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlE:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

UbMFBEr.exe

Path C:\Windows\System\UbMFBEr.exe
Size 1.9MB
SHA256 2dc7e80b01883deb8caebd3da13263ac375c61ee7312aa5c77cf656d2355e325
MD5 d9dd87e3bf6e30aac6c79b03df3f9a27
SHA1 a697e11c4f672e645c7426a8c3672c28cebef5f6
SHA512 c22651cf10f590ff2262a22ac8cf5ba679e082fc4f2cfecdb195d68c98a70a325591fc08a44e175a4630401b49eb6a7f76a17519160c74ed5840548ccc87c596
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlu:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

YkdmQdO.exe

Path C:\Windows\System\YkdmQdO.exe
Size 1.9MB
SHA256 51ff9da263d10e868f8f81e4456b1f55c1d49e3604c52f91390b185037b82c69
MD5 f34b21da6857c18367b347065f9bd791
SHA1 ab60d7f572821cf8a06148a4fd8a2082b81293b2
SHA512 f6048898814cca81d936c9027d68ed842539da722a263a8a9786529b582205379342410c0acb9e5a7b3b2b09aaa1eb5925c5ba4088ea82d090026ce86b028650
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlo:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

YuNOFMt.exe

Path C:\Windows\System\YuNOFMt.exe
Size 1.9MB
SHA256 937c18fd45b3dce055de496e43300fcc07b7bda07572ef70da59ed7cb6c588f6
MD5 a34c7ba4d87d664bdb6308a9dd2268ce
SHA1 eaa8458ab5693ad447d39e124564df2eeb753e6a
SHA512 6958626416ad0104eac701120adb12b6ca7a03788b75da59c902386a61c09d1fdeebf5e7560fea4f231d8a0887b854872f61d6e83e8bfd89c3a74314a46df1e6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlu:NABr
MD5 SHA1 SHA512 SSDEEP

Submit Download

acWQkLO.exe

Path C:\Windows\System\acWQkLO.exe
Size 1.9MB
SHA256 08f7c05d9291eea93fd98aa92e8bfe4e70f6dbb96cef45c4333d6ad0a8b2ee3a
MD5 b7646cf508ca339684628d568cb9b2d9
SHA1 15e9558acc590b4a99fe862ea496a83474cadbd4
SHA512 439fc763d7dcdb001baa8129a6593a02e50ff994bc1dc4060ce2c394a2a122da295be0597784a86a1058114da43f9bf85959ee9042ce512e8b6e0f48a7817356
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlq:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

dACBjLo.exe

Path C:\Windows\System\dACBjLo.exe
Size 1.9MB
SHA256 7bf52c10da2664c46a009d392ef056ec39dbb750dfdfbae8a32d38c897589b80
MD5 117e6591226196fd3934d27f19e28bfe
SHA1 99450f7795b6908b59d9cce093041b827c65dde2
SHA512 035caf9429f8786c054db733a943d95577d6b714d93280c030f2b45f034b51598a3df2ca464ff34f4fa5e0c3379d9d4ab7ac11dafb12e4c4c8a428bf8d5b1a46
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlz:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

eXpXzmE.exe

Path C:\Windows\System\eXpXzmE.exe
Size 1.9MB
SHA256 ce9ed48e08336c1672278d0db8430ec01784a61f1834cfb0e3f8a895a368a7e7
MD5 c2390f6babb42ebcc1b15f517a0d28c5
SHA1 076323cf7666d821dd164d9a78e7dc924de3df9a
SHA512 7ab62511f74316d48ad4cee62c33f14dad3835fa96a83f237c5f5deb8be2f8da7a6d76c6804fd4844df2ce276f0280d7f09b8fa0b912f92b14e7f72fcb721965
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlw:NABP
MD5 SHA1 SHA512 SSDEEP

Submit Download

gAMijFQ.exe

Path C:\Windows\System\gAMijFQ.exe
Size 1.9MB
SHA256 1ae125d4d829da1a7ec58c3809b44b81ee51378eea22dd2e2ce8b938c66ee0eb
MD5 e0bbd30e554581c9ba58990e0f59713d
SHA1 6f5dafda3aada1d5a82047f3b7ae966f1fa6810d
SHA512 5c5ec9c20a9e51afc9d292dab5be0b8c20c94e94707e4d4fedfc2dd9b78f31dae46944541e760e4cd0d12dd16df1e6f4fdff949868ecfdaab2d6e28bf47ccdd7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlA:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

garmWMD.exe

Path C:\Windows\System\garmWMD.exe
Size 1.9MB
SHA256 e1e534f150ebfeb1b8739b6acb728a56f1a8fab6da45dd569bd29eea364b2e8e
MD5 2fadaccbab40f5f68a0bebdf0ca21181
SHA1 1641cea024cdef351567d3e26823fbab7fd825c2
SHA512 5fcbb8d5f857f7d46c0480d50d01e105d1a51b5aef108f9063d6c9876aac3daf80bd4ad1f54c4fd551026c1853a10d72ac57b8bedc5e6829a5ac4e7586f6a258
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlv:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

nLxtZDA.exe

Path C:\Windows\System\nLxtZDA.exe
Size 1.9MB
SHA256 52f76eeb84cebb4e8dcaecfd2891da0725804d6f633dde46a6980568cb818f31
MD5 317e09bb436050bdc880d3390b352ae0
SHA1 3d8636570b457a937a484c9a9e61d405ccfbbed7
SHA512 50f6b5d646ced5af6ff0806ffdc23560f9c54f755cf679f4a56d17b3ab67b5d1dd91cab47d23f6d029942abb928c8dad85a8f03380c7786016c0f2a7912e91a2
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlF:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

oXBHGZG.exe

Path C:\Windows\System\oXBHGZG.exe
Size 1.9MB
SHA256 3b65763bb264cf0b4d77fae1bc1750d09aad765566947d3b905a58a941b3766b
MD5 1c776ba4e734645b0710e400f27de1b5
SHA1 9434830fe79a63e46db919ed48311be5e4206977
SHA512 cbfee6ceb8b2d7d44223dc4087fca7d1bbf0677ad9c40093e27bd979da460087b450b4da1fdfc845244fd63e6df92f4191f92d458090f51add67616ee5d16cd5
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlE:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

pXxQlNf.exe

Path C:\Windows\System\pXxQlNf.exe
Size 1.9MB
SHA256 38046dcf105e11a8ca5915a1572df199f63652fb374a71d038a855fa0e90133b
MD5 741039c31a814e9b8520fd83947d905c
SHA1 471984b64f226868e1c3552e91a3e3534b31b2e3
SHA512 7eef96727818ae3f81e2a18cc574a9d4e7489e9b028bb31a22d61c20f5b1cf6a2445bcab10d66917143ad8c073e9ab1b13c49be4c6f544b9e1d9cc96d8a955b8
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlE:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

peGfgbw.exe

Path C:\Windows\System\peGfgbw.exe
Size 1.9MB
SHA256 4a7188f5150ee8afc108de5a842e9a44a134cde1213b0bd7db61a707e15b6c35
MD5 4add3fc4a0f84a9a7adf0bcae73f2f53
SHA1 4b9475557958814b73eba53f2976c94e56ea4383
SHA512 beca0a5d0479685d6d86c78a71e3f19871367d1b6c28d41c2a7febe71340a961058ce111026893566d0d55e3e1cbf41d8b64d89ebaf219a095945fc7cad640bf
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrll:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

przGDKC.exe

Path C:\Windows\System\przGDKC.exe
Size 1.9MB
SHA256 3466088dc8b43205a90740ca12286b0e9bce984f53642b8b80f7c24c42d94a43
MD5 df5fe93618654cb5af8a8aefda29bf9c
SHA1 63157b2f554afc2deeb2469f3e750a5253432657
SHA512 9f9ecd6d64d7c96355d642beb1d941d4680123a9259b2aecc2b6252ea6b7e09d1c2602089772c123fef588758437824911f6b0fdf75cad2127efc500dbc8cc91
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlx:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

siCldxX.exe

Path C:\Windows\System\siCldxX.exe
Size 1.9MB
SHA256 f5f5a5b746c82ad564c4c483ff806a14f8c8ccddc0ea2e5257518a8dd3568c26
MD5 312afd8c0a4a75033fa042e1e6d2a8a1
SHA1 43630f69f5645c18b4ed758a1ddd0b6b1ce9805d
SHA512 74e50483493302ad8716ba090d2190360496ee4510f63754901fc039615a8b7af3c12d4ff16f26fb83863f4dbaf006da038303097c242b24f0f64d2a99334c07
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlT:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbKAeta.exe

Path C:\Windows\System\tbKAeta.exe
Size 1.9MB
SHA256 7cc96d4ffbd482f6bd1be47b600b29ad8eda5095ba34577f720deff9931fe5e9
MD5 5175272599f1f92d704c4f31ab3e49fd
SHA1 9b31ce025f30fdf4d4da50275cf7c8ffa10556e5
SHA512 c353f05c483f3240b8515d851269bad794da0b14537a1dead34a1d8c0b1dbd2f67403bae00088e1248fc6a6c4fb6f9f93c21692403dec7932121363569135255
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlG:NABv
MD5 SHA1 SHA512 SSDEEP

Submit Download

uOcsxJl.exe

Path C:\Windows\System\uOcsxJl.exe
Size 1.9MB
SHA256 d4306e686cc564120f92dfbd95ab5c0c5f31301a25850790967330433e5b43c9
MD5 d1bad174f9e3422e40176f6bfc77a333
SHA1 17416e2ba91c7b9ca7f826454bcbadbff8d48598
SHA512 a865a43d27394939feca0934db7bed6ce4e64fa6fe708199000e7d909124152ae7a192f6b9a03e9c21e33ac34376492f2136961b59ee93834706d9741fb68683
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlB:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ubgfYTd.exe

Path C:\Windows\System\ubgfYTd.exe
Size 1.9MB
SHA256 d87eab43a3351099db2d1c23bb0d8d2823eaf150381b993240a9bc5f801ed048
MD5 478f46d606bfaed62115ee658692a17b
SHA1 ef796089d2d5c9c846414b1ee5940b57e1670beb
SHA512 610b46f82b9f781b36c3eaaf9611fe3212b6ba2faa2b3792fc461a7a885850853f2259d42eb7590e9e2855c35f0aca4ac20ff18391dcd231d04cb1a12b948aab
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlT:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucxzOVb.exe

Path C:\Windows\System\ucxzOVb.exe
Size 1.9MB
SHA256 10acb7b6de5a07ee6f13db0fb2802ab2e64f611eca6d1dabdde4ebdf28f1d732
MD5 a0cd9ff3206853404c512307b38b1887
SHA1 df7867809b350007494cc5ca557af1c2aa1b73da
SHA512 37a3df608f235aaa257a4038812408eb528b300b018d90d7019f8752faffdc5dbe8d52b85298f134b157f74c0c2faeb4b56a5550187a65de58ff4b8a47f510c1
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlv:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

vFnLHCh.exe

Path C:\Windows\System\vFnLHCh.exe
Size 1.9MB
SHA256 80ca76cac1b89aa6107f6680d2d24a5cb8d76b4f79d4bf2f132f6b5f91843673
MD5 5b9695b95e785ff464edc7430644efcd
SHA1 988dcbeecd20dba2944cc5ccc1214bec3f4f082e
SHA512 c24ce403c309781fc11cce3b7c45ed9726e9d819271898996d7c280da82fa6b762767fb3c3b21d5aaac98c3c46c35a8a91a6b3b49d4b53320c82b22add242e7a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlV:NAB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-3685-0x00007FF611E60000-0x00007FF612252000-memory.dmp

Download

memory/388-3683-0x00007FF611E60000-0x00007FF612252000-memory.dmp

Download

memory/388-12-0x00007FF611E60000-0x00007FF612252000-memory.dmp

Download

memory/1164-199-0x00007FF62B6F0000-0x00007FF62BAE2000-memory.dmp

Download

memory/1164-3713-0x00007FF62B6F0000-0x00007FF62BAE2000-memory.dmp

Download

memory/1320-607-0x00007FF72C690000-0x00007FF72CA82000-memory.dmp

Download

memory/1320-3689-0x00007FF72C690000-0x00007FF72CA82000-memory.dmp

Download

memory/1532-3698-0x00007FF71A9F0000-0x00007FF71ADE2000-memory.dmp

Download

memory/1532-298-0x00007FF71A9F0000-0x00007FF71ADE2000-memory.dmp

Download

memory/1668-194-0x00007FF776EC0000-0x00007FF7772B2000-memory.dmp

Download

memory/1668-3722-0x00007FF776EC0000-0x00007FF7772B2000-memory.dmp

Download

memory/1788-657-0x00007FF603D70000-0x00007FF604162000-memory.dmp

Download

memory/1788-3756-0x00007FF603D70000-0x00007FF604162000-memory.dmp

Download

memory/1924-426-0x00007FF6D47B0000-0x00007FF6D4BA2000-memory.dmp

Download

memory/1924-3707-0x00007FF6D47B0000-0x00007FF6D4BA2000-memory.dmp

Download

memory/2928-429-0x00007FF70C150000-0x00007FF70C542000-memory.dmp

Download

memory/2928-3720-0x00007FF70C150000-0x00007FF70C542000-memory.dmp

Download

memory/3240-3715-0x00007FF754ED0000-0x00007FF7552C2000-memory.dmp

Download

memory/3240-603-0x00007FF754ED0000-0x00007FF7552C2000-memory.dmp

Download

memory/3288-110-0x00007FF62F3B0000-0x00007FF62F7A2000-memory.dmp

Download

memory/3288-3692-0x00007FF62F3B0000-0x00007FF62F7A2000-memory.dmp

Download

memory/3300-3701-0x00007FF776B30000-0x00007FF776F22000-memory.dmp

Download

memory/3300-658-0x00007FF776B30000-0x00007FF776F22000-memory.dmp

Download

memory/3540-343-0x00007FF7A55E0000-0x00007FF7A59D2000-memory.dmp

Download

memory/3540-3711-0x00007FF7A55E0000-0x00007FF7A59D2000-memory.dmp

Download

memory/3704-46-0x00007FFB9CE20000-0x00007FFB9D8E1000-memory.dmp

Download

memory/3704-352-0x00000171764D0000-0x00000171764F2000-memory.dmp

Download

memory/3704-49-0x0000017176250000-0x0000017176260000-memory.dmp

Download

memory/3720-264-0x00007FF635F50000-0x00007FF636342000-memory.dmp

Download

memory/3720-3700-0x00007FF635F50000-0x00007FF636342000-memory.dmp

Download

memory/4004-56-0x00007FF7267A0000-0x00007FF726B92000-memory.dmp

Download

memory/4004-3693-0x00007FF7267A0000-0x00007FF726B92000-memory.dmp

Download

memory/4024-478-0x00007FF73CB00000-0x00007FF73CEF2000-memory.dmp

Download

memory/4024-3718-0x00007FF73CB00000-0x00007FF73CEF2000-memory.dmp

Download

memory/4108-346-0x00007FF62B790000-0x00007FF62BB82000-memory.dmp

Download

memory/4108-3709-0x00007FF62B790000-0x00007FF62BB82000-memory.dmp

Download

memory/4636-3695-0x00007FF636AC0000-0x00007FF636EB2000-memory.dmp

Download

memory/4636-146-0x00007FF636AC0000-0x00007FF636EB2000-memory.dmp

Download

memory/4764-659-0x00007FF72A630000-0x00007FF72AA22000-memory.dmp

Download

memory/4764-3760-0x00007FF72A630000-0x00007FF72AA22000-memory.dmp

Download

memory/4784-3703-0x00007FF7570C0000-0x00007FF7574B2000-memory.dmp

Download

memory/4784-107-0x00007FF7570C0000-0x00007FF7574B2000-memory.dmp

Download

memory/4816-0-0x00007FF6B70A0000-0x00007FF6B7492000-memory.dmp

Download

memory/4816-1-0x0000018380810000-0x0000018380820000-memory.dmp

Download

memory/4964-3687-0x00007FF661C30000-0x00007FF662022000-memory.dmp

Download

memory/4964-76-0x00007FF661C30000-0x00007FF662022000-memory.dmp

Download

memory/4988-3717-0x00007FF7A3110000-0x00007FF7A3502000-memory.dmp

Download

memory/4988-538-0x00007FF7A3110000-0x00007FF7A3502000-memory.dmp

Download