xmrig | f81f5fb8baf95190732e9beb5f25e11c6f68608e6b96d7aa4c8e0d392f683b73

Analysis

max time kernel
150s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
Size 2.2MB
Sample240523-xy4kcsdb53
SHA256 f81f5fb8baf95190732e9beb5f25e11c6f68608e6b96d7aa4c8e0d392f683b73
MD5 6c006c77dc282846b1edcd66e2b7d241
SHA1 aff1026ca9efb8cf8f644e9a63027ea5ed4e6942
SHA512 c70184e974894a3a3f00465f84d0fe16a297296d2912a66ed26a36034d32274699d64b178b81bdd0f2169b1c3e9834f1a7bd307f87f9567881a899321c39e222
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFf9:NABR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral2/memory/1652-395-0x00007FF64F4F0000-0x00007FF64F8E2000-memory.dmp	xmrig
behavioral2/memory/2304-394-0x00007FF650B70000-0x00007FF650F62000-memory.dmp	xmrig
behavioral2/memory/636-877-0x00007FF642890000-0x00007FF642C82000-memory.dmp	xmrig
behavioral2/memory/3476-1053-0x00007FF66FFB0000-0x00007FF6703A2000-memory.dmp	xmrig
behavioral2/memory/4848-1530-0x00007FF647030000-0x00007FF647422000-memory.dmp	xmrig
behavioral2/memory/3892-1528-0x00007FF6503F0000-0x00007FF6507E2000-memory.dmp	xmrig
behavioral2/memory/2656-1525-0x00007FF6EA000000-0x00007FF6EA3F2000-memory.dmp	xmrig
behavioral2/memory/3008-1214-0x00007FF6C66F0000-0x00007FF6C6AE2000-memory.dmp	xmrig
behavioral2/memory/1744-1055-0x00007FF715520000-0x00007FF715912000-memory.dmp	xmrig
behavioral2/memory/4568-1054-0x00007FF7187A0000-0x00007FF718B92000-memory.dmp	xmrig
behavioral2/memory/4908-727-0x00007FF7B0F30000-0x00007FF7B1322000-memory.dmp	xmrig
behavioral2/memory/3668-723-0x00007FF6FF620000-0x00007FF6FFA12000-memory.dmp	xmrig
behavioral2/memory/1200-629-0x00007FF77CA20000-0x00007FF77CE12000-memory.dmp	xmrig
behavioral2/memory/2180-553-0x00007FF7FBAF0000-0x00007FF7FBEE2000-memory.dmp	xmrig
behavioral2/memory/3380-551-0x00007FF63FF80000-0x00007FF640372000-memory.dmp	xmrig
behavioral2/memory/2696-449-0x00007FF7675B0000-0x00007FF7679A2000-memory.dmp	xmrig
behavioral2/memory/1912-354-0x00007FF6A49C0000-0x00007FF6A4DB2000-memory.dmp	xmrig
behavioral2/memory/4540-351-0x00007FF63E170000-0x00007FF63E562000-memory.dmp	xmrig
behavioral2/memory/4328-283-0x00007FF70C830000-0x00007FF70CC22000-memory.dmp	xmrig
behavioral2/memory/3736-282-0x00007FF741640000-0x00007FF741A32000-memory.dmp	xmrig
behavioral2/memory/3712-248-0x00007FF75CD80000-0x00007FF75D172000-memory.dmp	xmrig
behavioral2/memory/2968-226-0x00007FF74C3F0000-0x00007FF74C7E2000-memory.dmp	xmrig
behavioral2/memory/4632-28-0x00007FF7E48C0000-0x00007FF7E4CB2000-memory.dmp	xmrig
behavioral2/memory/4040-4830-0x00007FF6D61D0000-0x00007FF6D65C2000-memory.dmp	xmrig
behavioral2/memory/4968-4638-0x00007FF66B290000-0x00007FF66B682000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4744	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4040	WUjEohq.exe
4632	eOUdoci.exe
2968	KhTBrWh.exe
2656	tifNSVD.exe
3712	LhFNlHa.exe
3736	KfRceFR.exe
4328	foGHpih.exe
4540	gfHSVZk.exe
3892	fXtfSXS.exe
1912	lThqQaz.exe
2304	mHMIIGq.exe
1652	AjcIwAS.exe
2696	oUiWxAP.exe
3380	yprUPdJ.exe
2180	PuxnFZj.exe
1200	YlAQWES.exe
3668	snejVTk.exe
4908	tzIaSiE.exe
636	chwcrwv.exe
3476	TmysTFA.exe
4568	rmwsewN.exe
1744	aKocuNw.exe
3008	iAeqpUJ.exe
4848	grTPOmq.exe
4500	bOMaXNZ.exe
1304	JHDXWWl.exe
2380	utBkqKW.exe
4812	nJQDoSR.exe
1020	SqnstPQ.exe
2320	hWhfvyd.exe
4404	XVGBzyQ.exe
3828	IpANPom.exe
4608	hHaXavW.exe
1892	AbMzguM.exe
4428	lpZFUoW.exe
2544	jjtttlu.exe
1576	yJItVmc.exe
5032	ilWOHdI.exe
2504	MbBmwJQ.exe
1476	ctiIcki.exe
4864	HbXTAme.exe
4380	VgyTmBi.exe
1988	nGorqbm.exe
1316	RlYKMxE.exe
4516	PbsMNHd.exe
3740	HuhBPsa.exe
1496	NQdmIZe.exe
4564	CSnwdGJ.exe
3276	fsOlxna.exe
4796	mBXkNuz.exe
2992	JeTHZlm.exe
3540	ZGKXogf.exe
1812	uGJTBcL.exe
3692	XlyUZVP.exe
2368	cUUXoRV.exe
4928	HySYmjf.exe
4284	KFVTCEl.exe
1160	JgcARus.exe
4668	ynSWMAO.exe
3756	ehcDHwH.exe
1864	UPfwAir.exe
2192	DaNAyEd.exe
2624	TCDmusc.exe
1532	YNqvSsO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4968-0-0x00007FF66B290000-0x00007FF66B682000-memory.dmp	upx
behavioral2/files/0x0007000000023417-7.dat	upx
behavioral2/files/0x000600000002327d-5.dat	upx
behavioral2/memory/4040-8-0x00007FF6D61D0000-0x00007FF6D65C2000-memory.dmp	upx
behavioral2/files/0x0007000000023425-81.dat	upx
behavioral2/files/0x000700000002342b-103.dat	upx
behavioral2/files/0x0007000000023433-143.dat	upx
behavioral2/files/0x000700000002342c-181.dat	upx
behavioral2/memory/1652-395-0x00007FF64F4F0000-0x00007FF64F8E2000-memory.dmp	upx
behavioral2/memory/2304-394-0x00007FF650B70000-0x00007FF650F62000-memory.dmp	upx
behavioral2/memory/636-877-0x00007FF642890000-0x00007FF642C82000-memory.dmp	upx
behavioral2/memory/3476-1053-0x00007FF66FFB0000-0x00007FF6703A2000-memory.dmp	upx
behavioral2/memory/4848-1530-0x00007FF647030000-0x00007FF647422000-memory.dmp	upx
behavioral2/memory/3892-1528-0x00007FF6503F0000-0x00007FF6507E2000-memory.dmp	upx
behavioral2/memory/2656-1525-0x00007FF6EA000000-0x00007FF6EA3F2000-memory.dmp	upx
behavioral2/memory/3008-1214-0x00007FF6C66F0000-0x00007FF6C6AE2000-memory.dmp	upx
behavioral2/memory/1744-1055-0x00007FF715520000-0x00007FF715912000-memory.dmp	upx
behavioral2/memory/4568-1054-0x00007FF7187A0000-0x00007FF718B92000-memory.dmp	upx
behavioral2/memory/4908-727-0x00007FF7B0F30000-0x00007FF7B1322000-memory.dmp	upx
behavioral2/memory/3668-723-0x00007FF6FF620000-0x00007FF6FFA12000-memory.dmp	upx
behavioral2/memory/1200-629-0x00007FF77CA20000-0x00007FF77CE12000-memory.dmp	upx
behavioral2/memory/2180-553-0x00007FF7FBAF0000-0x00007FF7FBEE2000-memory.dmp	upx
behavioral2/memory/3380-551-0x00007FF63FF80000-0x00007FF640372000-memory.dmp	upx
behavioral2/memory/2696-449-0x00007FF7675B0000-0x00007FF7679A2000-memory.dmp	upx
behavioral2/memory/1912-354-0x00007FF6A49C0000-0x00007FF6A4DB2000-memory.dmp	upx
behavioral2/memory/4540-351-0x00007FF63E170000-0x00007FF63E562000-memory.dmp	upx
behavioral2/memory/4328-283-0x00007FF70C830000-0x00007FF70CC22000-memory.dmp	upx
behavioral2/memory/3736-282-0x00007FF741640000-0x00007FF741A32000-memory.dmp	upx
behavioral2/memory/3712-248-0x00007FF75CD80000-0x00007FF75D172000-memory.dmp	upx
behavioral2/memory/2968-226-0x00007FF74C3F0000-0x00007FF74C7E2000-memory.dmp	upx
behavioral2/files/0x000700000002343d-196.dat	upx
behavioral2/files/0x0007000000023434-184.dat	upx
behavioral2/files/0x0007000000023439-180.dat	upx
behavioral2/files/0x000700000002342a-176.dat	upx
behavioral2/files/0x0007000000023438-174.dat	upx
behavioral2/files/0x0007000000023429-164.dat	upx
behavioral2/files/0x0007000000023428-160.dat	upx
behavioral2/files/0x0007000000023422-157.dat	upx
behavioral2/files/0x000700000002342d-189.dat	upx
behavioral2/files/0x000700000002341f-152.dat	upx
behavioral2/files/0x0007000000023436-148.dat	upx
behavioral2/files/0x0007000000023435-147.dat	upx
behavioral2/files/0x000700000002343b-186.dat	upx
behavioral2/files/0x0007000000023432-142.dat	upx
behavioral2/files/0x0007000000023431-137.dat	upx
behavioral2/files/0x0008000000023414-134.dat	upx
behavioral2/files/0x000700000002342e-170.dat	upx
behavioral2/files/0x0007000000023423-131.dat	upx
behavioral2/files/0x000700000002342f-130.dat	upx
behavioral2/files/0x0007000000023421-126.dat	upx
behavioral2/files/0x0007000000023437-156.dat	upx
behavioral2/files/0x0007000000023427-124.dat	upx
behavioral2/files/0x0007000000023420-120.dat	upx
behavioral2/files/0x0007000000023430-136.dat	upx
behavioral2/files/0x0007000000023426-88.dat	upx
behavioral2/files/0x000700000002341e-106.dat	upx
behavioral2/files/0x000700000002341d-83.dat	upx
behavioral2/files/0x0007000000023424-79.dat	upx
behavioral2/files/0x000700000002341a-46.dat	upx
behavioral2/files/0x0007000000023418-39.dat	upx
behavioral2/files/0x000700000002341c-55.dat	upx
behavioral2/files/0x000700000002341b-52.dat	upx
behavioral2/files/0x0007000000023419-43.dat	upx
behavioral2/memory/4632-28-0x00007FF7E48C0000-0x00007FF7E4CB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SvfjtHv.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\OrcFaar.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\rNKppNe.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\MbBmwJQ.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\WvSxpse.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\HPBWFFv.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\jjzlpvg.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\rOmYUQa.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\OAgEBRO.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\AekqRtJ.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\exrWOMv.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\WWrKEfo.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\ZeKcStB.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\uLWxOXB.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\wxdeAjx.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\KUTOdLF.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\WJVAxKj.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\ssOlUxa.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\zWNmPZJ.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\WSofAFa.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\lRBazgP.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\oLdqEhP.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\qRBGrSW.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\zELDqls.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\XSNGXyn.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\BflozKM.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\UCqWjfQ.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\upSUWNO.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\eHlOBTM.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\KPdqxFq.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\WgDXBVm.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\fOTVloK.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\RCiwKld.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\GzezsHL.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\MZfMZsp.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\HySYmjf.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\GDfrVXY.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\NPyWFLL.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\yAHDePl.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\vECOFqU.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\zMKVEEn.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\buBrleC.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\KfRceFR.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\okAhllu.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\DZNKEPG.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\IdVxGcT.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\jyLUYRX.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\faLkFcw.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\zwaHWdT.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\trJYRqo.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\WWssLRo.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\WILEmCi.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\DkRsvlR.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\RzdRtak.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\wSQexYa.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\yprUPdJ.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\omFVsvF.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\gObdgNx.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\IPaCncA.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\ShMWLWI.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\rHfwqON.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\GyYqIxq.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\MPMrhMn.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
File created	C:\Windows\System\IvpEGCH.exe	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4744	powershell.exe
4744	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3576	Process not Found
3552	Process not Found
10152	Process not Found
8380	Process not Found
4272	Process not Found
3932	Process not Found
8444	Process not Found
7860	Process not Found
6980	Process not Found
8468	Process not Found
6880	Process not Found
2356	Process not Found
8680	Process not Found
5956	Process not Found
5216	Process not Found
5040	Process not Found
3608	Process not Found
1788	Process not Found
3660	Process not Found
4744	Process not Found
1568	Process not Found
5076	Process not Found
4252	Process not Found
4912	Process not Found
4088	Process not Found
1724	Process not Found
3276	Process not Found
2992	Process not Found
5156	Process not Found
5772	Process not Found
5896	Process not Found
6000	Process not Found
5980	Process not Found
6128	Process not Found
3180	Process not Found
5436	Process not Found
5548	Process not Found
4416	Process not Found
4624	Process not Found
6180	Process not Found
6832	Process not Found
6988	Process not Found
6040	Process not Found
364	Process not Found
7216	Process not Found
7364	Process not Found
7516	Process not Found
7692	Process not Found
7688	Process not Found
7788	Process not Found
8072	Process not Found
6288	Process not Found
8168	Process not Found
5316	Process not Found
5392	Process not Found
4996	Process not Found
6220	Process not Found
8216	Process not Found
8288	Process not Found
8364	Process not Found
8384	Process not Found
8448	Process not Found
8524	Process not Found
8616	Process not Found

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeCreateGlobalPrivilege	1712	dwm.exe
Token: SeChangeNotifyPrivilege	1712	dwm.exe
Token: 33	1712	dwm.exe
Token: SeIncBasePriorityPrivilege	1712	dwm.exe
Token: SeCreateGlobalPrivilege	11968	dwm.exe
Token: SeChangeNotifyPrivilege	11968	dwm.exe
Token: 33	11968	dwm.exe
Token: SeIncBasePriorityPrivilege	11968	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4744	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	85
PID 4968 wrote to memory of 4744	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	85
PID 4968 wrote to memory of 4040	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	86
PID 4968 wrote to memory of 4040	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	86
PID 4968 wrote to memory of 4632	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	87
PID 4968 wrote to memory of 4632	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	87
PID 4968 wrote to memory of 2968	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	88
PID 4968 wrote to memory of 2968	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	88
PID 4968 wrote to memory of 2656	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	89
PID 4968 wrote to memory of 2656	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	89
PID 4968 wrote to memory of 3712	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	90
PID 4968 wrote to memory of 3712	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	90
PID 4968 wrote to memory of 3736	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	91
PID 4968 wrote to memory of 3736	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	91
PID 4968 wrote to memory of 4328	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	92
PID 4968 wrote to memory of 4328	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	92
PID 4968 wrote to memory of 4540	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	93
PID 4968 wrote to memory of 4540	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	93
PID 4968 wrote to memory of 3892	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	94
PID 4968 wrote to memory of 3892	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	94
PID 4968 wrote to memory of 1912	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	95
PID 4968 wrote to memory of 1912	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	95
PID 4968 wrote to memory of 4908	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	96
PID 4968 wrote to memory of 4908	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	96
PID 4968 wrote to memory of 2304	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	97
PID 4968 wrote to memory of 2304	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	97
PID 4968 wrote to memory of 1652	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	98
PID 4968 wrote to memory of 1652	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	98
PID 4968 wrote to memory of 2696	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	99
PID 4968 wrote to memory of 2696	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	99
PID 4968 wrote to memory of 3380	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	100
PID 4968 wrote to memory of 3380	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	100
PID 4968 wrote to memory of 2180	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	101
PID 4968 wrote to memory of 2180	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	101
PID 4968 wrote to memory of 1200	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	102
PID 4968 wrote to memory of 1200	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	102
PID 4968 wrote to memory of 3668	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	103
PID 4968 wrote to memory of 3668	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	103
PID 4968 wrote to memory of 4500	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	104
PID 4968 wrote to memory of 4500	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	104
PID 4968 wrote to memory of 636	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	105
PID 4968 wrote to memory of 636	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	105
PID 4968 wrote to memory of 3476	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	106
PID 4968 wrote to memory of 3476	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	106
PID 4968 wrote to memory of 4568	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	107
PID 4968 wrote to memory of 4568	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	107
PID 4968 wrote to memory of 1744	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	108
PID 4968 wrote to memory of 1744	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	108
PID 4968 wrote to memory of 3008	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	109
PID 4968 wrote to memory of 3008	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	109
PID 4968 wrote to memory of 4848	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	110
PID 4968 wrote to memory of 4848	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	110
PID 4968 wrote to memory of 1304	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	111
PID 4968 wrote to memory of 1304	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	111
PID 4968 wrote to memory of 2380	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	112
PID 4968 wrote to memory of 2380	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	112
PID 4968 wrote to memory of 4812	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	113
PID 4968 wrote to memory of 4812	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	113
PID 4968 wrote to memory of 1020	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	114
PID 4968 wrote to memory of 1020	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	114
PID 4968 wrote to memory of 2320	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	115
PID 4968 wrote to memory of 2320	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	115
PID 4968 wrote to memory of 4404	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	116
PID 4968 wrote to memory of 4404	4968	6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6c006c77dc282846b1edcd66e2b7d241_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4744
- C:\Windows\System\WUjEohq.exe
  C:\Windows\System\WUjEohq.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\eOUdoci.exe
  C:\Windows\System\eOUdoci.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\KhTBrWh.exe
  C:\Windows\System\KhTBrWh.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\tifNSVD.exe
  C:\Windows\System\tifNSVD.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\LhFNlHa.exe
  C:\Windows\System\LhFNlHa.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\KfRceFR.exe
  C:\Windows\System\KfRceFR.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\foGHpih.exe
  C:\Windows\System\foGHpih.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\gfHSVZk.exe
  C:\Windows\System\gfHSVZk.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\fXtfSXS.exe
  C:\Windows\System\fXtfSXS.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\lThqQaz.exe
  C:\Windows\System\lThqQaz.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\tzIaSiE.exe
  C:\Windows\System\tzIaSiE.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\mHMIIGq.exe
  C:\Windows\System\mHMIIGq.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\AjcIwAS.exe
  C:\Windows\System\AjcIwAS.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\oUiWxAP.exe
  C:\Windows\System\oUiWxAP.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\yprUPdJ.exe
  C:\Windows\System\yprUPdJ.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\PuxnFZj.exe
  C:\Windows\System\PuxnFZj.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\YlAQWES.exe
  C:\Windows\System\YlAQWES.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\snejVTk.exe
  C:\Windows\System\snejVTk.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\bOMaXNZ.exe
  C:\Windows\System\bOMaXNZ.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\chwcrwv.exe
  C:\Windows\System\chwcrwv.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\TmysTFA.exe
  C:\Windows\System\TmysTFA.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\rmwsewN.exe
  C:\Windows\System\rmwsewN.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\aKocuNw.exe
  C:\Windows\System\aKocuNw.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\iAeqpUJ.exe
  C:\Windows\System\iAeqpUJ.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\grTPOmq.exe
  C:\Windows\System\grTPOmq.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\JHDXWWl.exe
  C:\Windows\System\JHDXWWl.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\utBkqKW.exe
  C:\Windows\System\utBkqKW.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\nJQDoSR.exe
  C:\Windows\System\nJQDoSR.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\SqnstPQ.exe
  C:\Windows\System\SqnstPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\hWhfvyd.exe
  C:\Windows\System\hWhfvyd.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\XVGBzyQ.exe
  C:\Windows\System\XVGBzyQ.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\IpANPom.exe
  C:\Windows\System\IpANPom.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\hHaXavW.exe
  C:\Windows\System\hHaXavW.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\AbMzguM.exe
  C:\Windows\System\AbMzguM.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\lpZFUoW.exe
  C:\Windows\System\lpZFUoW.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\jjtttlu.exe
  C:\Windows\System\jjtttlu.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\yJItVmc.exe
  C:\Windows\System\yJItVmc.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\ilWOHdI.exe
  C:\Windows\System\ilWOHdI.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\NQdmIZe.exe
  C:\Windows\System\NQdmIZe.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\MbBmwJQ.exe
  C:\Windows\System\MbBmwJQ.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\mBXkNuz.exe
  C:\Windows\System\mBXkNuz.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\ctiIcki.exe
  C:\Windows\System\ctiIcki.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\HbXTAme.exe
  C:\Windows\System\HbXTAme.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\VgyTmBi.exe
  C:\Windows\System\VgyTmBi.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\nGorqbm.exe
  C:\Windows\System\nGorqbm.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\RlYKMxE.exe
  C:\Windows\System\RlYKMxE.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\PbsMNHd.exe
  C:\Windows\System\PbsMNHd.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\HuhBPsa.exe
  C:\Windows\System\HuhBPsa.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\CSnwdGJ.exe
  C:\Windows\System\CSnwdGJ.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\fsOlxna.exe
  C:\Windows\System\fsOlxna.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\UPfwAir.exe
  C:\Windows\System\UPfwAir.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\JeTHZlm.exe
  C:\Windows\System\JeTHZlm.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\ZGKXogf.exe
  C:\Windows\System\ZGKXogf.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\uGJTBcL.exe
  C:\Windows\System\uGJTBcL.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\XlyUZVP.exe
  C:\Windows\System\XlyUZVP.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\cUUXoRV.exe
  C:\Windows\System\cUUXoRV.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\HySYmjf.exe
  C:\Windows\System\HySYmjf.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\KFVTCEl.exe
  C:\Windows\System\KFVTCEl.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\JgcARus.exe
  C:\Windows\System\JgcARus.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\ynSWMAO.exe
  C:\Windows\System\ynSWMAO.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\ehcDHwH.exe
  C:\Windows\System\ehcDHwH.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\DaNAyEd.exe
  C:\Windows\System\DaNAyEd.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\TCDmusc.exe
  C:\Windows\System\TCDmusc.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\YNqvSsO.exe
  C:\Windows\System\YNqvSsO.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\fTGZbCi.exe
  C:\Windows\System\fTGZbCi.exe
  2⤵
  PID:1108
- C:\Windows\System\mKBatcf.exe
  C:\Windows\System\mKBatcf.exe
  2⤵
  PID:3560
- C:\Windows\System\LDoudOA.exe
  C:\Windows\System\LDoudOA.exe
  2⤵
  PID:1360
- C:\Windows\System\rLkwMSO.exe
  C:\Windows\System\rLkwMSO.exe
  2⤵
  PID:3000
- C:\Windows\System\AuGVQbK.exe
  C:\Windows\System\AuGVQbK.exe
  2⤵
  PID:3520
- C:\Windows\System\AAQygDP.exe
  C:\Windows\System\AAQygDP.exe
  2⤵
  PID:2640
- C:\Windows\System\ixEDuNn.exe
  C:\Windows\System\ixEDuNn.exe
  2⤵
  PID:1220
- C:\Windows\System\rOWyeuw.exe
  C:\Windows\System\rOWyeuw.exe
  2⤵
  PID:3484
- C:\Windows\System\NPmukDl.exe
  C:\Windows\System\NPmukDl.exe
  2⤵
  PID:3224
- C:\Windows\System\UOZpiOk.exe
  C:\Windows\System\UOZpiOk.exe
  2⤵
  PID:3424
- C:\Windows\System\TnCgqJR.exe
  C:\Windows\System\TnCgqJR.exe
  2⤵
  PID:3580
- C:\Windows\System\uOOJiNG.exe
  C:\Windows\System\uOOJiNG.exe
  2⤵
  PID:4244
- C:\Windows\System\dWerQOW.exe
  C:\Windows\System\dWerQOW.exe
  2⤵
  PID:4640
- C:\Windows\System\SGsREYQ.exe
  C:\Windows\System\SGsREYQ.exe
  2⤵
  PID:1708
- C:\Windows\System\pZHltgF.exe
  C:\Windows\System\pZHltgF.exe
  2⤵
  PID:1036
- C:\Windows\System\INQOXjD.exe
  C:\Windows\System\INQOXjD.exe
  2⤵
  PID:5136
- C:\Windows\System\pbMNVXL.exe
  C:\Windows\System\pbMNVXL.exe
  2⤵
  PID:5152
- C:\Windows\System\ttNOHQv.exe
  C:\Windows\System\ttNOHQv.exe
  2⤵
  PID:5188
- C:\Windows\System\XsdIPfg.exe
  C:\Windows\System\XsdIPfg.exe
  2⤵
  PID:5208
- C:\Windows\System\AMJykRB.exe
  C:\Windows\System\AMJykRB.exe
  2⤵
  PID:5236
- C:\Windows\System\LIcBeQN.exe
  C:\Windows\System\LIcBeQN.exe
  2⤵
  PID:5252
- C:\Windows\System\tiAnpQB.exe
  C:\Windows\System\tiAnpQB.exe
  2⤵
  PID:5276
- C:\Windows\System\bgJlMPY.exe
  C:\Windows\System\bgJlMPY.exe
  2⤵
  PID:5300
- C:\Windows\System\FyzVkNT.exe
  C:\Windows\System\FyzVkNT.exe
  2⤵
  PID:5320
- C:\Windows\System\TswWBRI.exe
  C:\Windows\System\TswWBRI.exe
  2⤵
  PID:5340
- C:\Windows\System\pWOEWYp.exe
  C:\Windows\System\pWOEWYp.exe
  2⤵
  PID:5360
- C:\Windows\System\RoyKdLB.exe
  C:\Windows\System\RoyKdLB.exe
  2⤵
  PID:5384
- C:\Windows\System\pUFRNQs.exe
  C:\Windows\System\pUFRNQs.exe
  2⤵
  PID:5408
- C:\Windows\System\czTyrGK.exe
  C:\Windows\System\czTyrGK.exe
  2⤵
  PID:5440
- C:\Windows\System\wXVfsdh.exe
  C:\Windows\System\wXVfsdh.exe
  2⤵
  PID:5492
- C:\Windows\System\JWQBxYi.exe
  C:\Windows\System\JWQBxYi.exe
  2⤵
  PID:5512
- C:\Windows\System\VdPNZqz.exe
  C:\Windows\System\VdPNZqz.exe
  2⤵
  PID:5540
- C:\Windows\System\walqjGG.exe
  C:\Windows\System\walqjGG.exe
  2⤵
  PID:5556
- C:\Windows\System\TqHTKaU.exe
  C:\Windows\System\TqHTKaU.exe
  2⤵
  PID:5580
- C:\Windows\System\NlMBOvk.exe
  C:\Windows\System\NlMBOvk.exe
  2⤵
  PID:5612
- C:\Windows\System\XOHKGUC.exe
  C:\Windows\System\XOHKGUC.exe
  2⤵
  PID:5628
- C:\Windows\System\wzptiHE.exe
  C:\Windows\System\wzptiHE.exe
  2⤵
  PID:5644
- C:\Windows\System\SreygaI.exe
  C:\Windows\System\SreygaI.exe
  2⤵
  PID:5660
- C:\Windows\System\xQLGSAr.exe
  C:\Windows\System\xQLGSAr.exe
  2⤵
  PID:5684
- C:\Windows\System\jsLVqor.exe
  C:\Windows\System\jsLVqor.exe
  2⤵
  PID:5712
- C:\Windows\System\cYXnDaJ.exe
  C:\Windows\System\cYXnDaJ.exe
  2⤵
  PID:5740
- C:\Windows\System\QwejdpA.exe
  C:\Windows\System\QwejdpA.exe
  2⤵
  PID:5768
- C:\Windows\System\tjZhbnw.exe
  C:\Windows\System\tjZhbnw.exe
  2⤵
  PID:5792
- C:\Windows\System\OVbkCop.exe
  C:\Windows\System\OVbkCop.exe
  2⤵
  PID:5812
- C:\Windows\System\nvMdrRQ.exe
  C:\Windows\System\nvMdrRQ.exe
  2⤵
  PID:5836
- C:\Windows\System\sChttxt.exe
  C:\Windows\System\sChttxt.exe
  2⤵
  PID:5868
- C:\Windows\System\QZNGihj.exe
  C:\Windows\System\QZNGihj.exe
  2⤵
  PID:5892
- C:\Windows\System\OiwVjDy.exe
  C:\Windows\System\OiwVjDy.exe
  2⤵
  PID:5912
- C:\Windows\System\xBAzPgD.exe
  C:\Windows\System\xBAzPgD.exe
  2⤵
  PID:5932
- C:\Windows\System\PRqHPiU.exe
  C:\Windows\System\PRqHPiU.exe
  2⤵
  PID:5948
- C:\Windows\System\LjeUpvl.exe
  C:\Windows\System\LjeUpvl.exe
  2⤵
  PID:5976
- C:\Windows\System\MCRepQj.exe
  C:\Windows\System\MCRepQj.exe
  2⤵
  PID:5996
- C:\Windows\System\OtNJZpx.exe
  C:\Windows\System\OtNJZpx.exe
  2⤵
  PID:6024
- C:\Windows\System\aHyrOHJ.exe
  C:\Windows\System\aHyrOHJ.exe
  2⤵
  PID:6048
- C:\Windows\System\UySRkPr.exe
  C:\Windows\System\UySRkPr.exe
  2⤵
  PID:6076
- C:\Windows\System\GQogDdv.exe
  C:\Windows\System\GQogDdv.exe
  2⤵
  PID:6092
- C:\Windows\System\tmRrmiY.exe
  C:\Windows\System\tmRrmiY.exe
  2⤵
  PID:6124
- C:\Windows\System\kDkWNHO.exe
  C:\Windows\System\kDkWNHO.exe
  2⤵
  PID:6140
- C:\Windows\System\RbVuKcJ.exe
  C:\Windows\System\RbVuKcJ.exe
  2⤵
  PID:588
- C:\Windows\System\gBtQKGs.exe
  C:\Windows\System\gBtQKGs.exe
  2⤵
  PID:2200
- C:\Windows\System\nktbByY.exe
  C:\Windows\System\nktbByY.exe
  2⤵
  PID:2928
- C:\Windows\System\TrEYlLR.exe
  C:\Windows\System\TrEYlLR.exe
  2⤵
  PID:424
- C:\Windows\System\ksdkkQo.exe
  C:\Windows\System\ksdkkQo.exe
  2⤵
  PID:3256
- C:\Windows\System\WVJLKOM.exe
  C:\Windows\System\WVJLKOM.exe
  2⤵
  PID:64
- C:\Windows\System\AsmZMEI.exe
  C:\Windows\System\AsmZMEI.exe
  2⤵
  PID:4356
- C:\Windows\System\MWthiri.exe
  C:\Windows\System\MWthiri.exe
  2⤵
  PID:3832
- C:\Windows\System\qZBdbYV.exe
  C:\Windows\System\qZBdbYV.exe
  2⤵
  PID:5404
- C:\Windows\System\GDfrVXY.exe
  C:\Windows\System\GDfrVXY.exe
  2⤵
  PID:5452
- C:\Windows\System\PoAazdX.exe
  C:\Windows\System\PoAazdX.exe
  2⤵
  PID:5484
- C:\Windows\System\fvwkYCx.exe
  C:\Windows\System\fvwkYCx.exe
  2⤵
  PID:5548
- C:\Windows\System\bMhjRUI.exe
  C:\Windows\System\bMhjRUI.exe
  2⤵
  PID:4580
- C:\Windows\System\cROLHIG.exe
  C:\Windows\System\cROLHIG.exe
  2⤵
  PID:524
- C:\Windows\System\bpmcALv.exe
  C:\Windows\System\bpmcALv.exe
  2⤵
  PID:2996
- C:\Windows\System\ZBFwhRC.exe
  C:\Windows\System\ZBFwhRC.exe
  2⤵
  PID:2568
- C:\Windows\System\DbkbPfz.exe
  C:\Windows\System\DbkbPfz.exe
  2⤵
  PID:5376
- C:\Windows\System\LSyxgUV.exe
  C:\Windows\System\LSyxgUV.exe
  2⤵
  PID:5420
- C:\Windows\System\QtPESXc.exe
  C:\Windows\System\QtPESXc.exe
  2⤵
  PID:2912
- C:\Windows\System\RRvkjEY.exe
  C:\Windows\System\RRvkjEY.exe
  2⤵
  PID:5576
- C:\Windows\System\AoRMlgw.exe
  C:\Windows\System\AoRMlgw.exe
  2⤵
  PID:5692
- C:\Windows\System\MNemRHk.exe
  C:\Windows\System\MNemRHk.exe
  2⤵
  PID:3240
- C:\Windows\System\KMeCLzP.exe
  C:\Windows\System\KMeCLzP.exe
  2⤵
  PID:6152
- C:\Windows\System\ADLvyDI.exe
  C:\Windows\System\ADLvyDI.exe
  2⤵
  PID:6180
- C:\Windows\System\NmmzlYR.exe
  C:\Windows\System\NmmzlYR.exe
  2⤵
  PID:6212
- C:\Windows\System\lpviTGT.exe
  C:\Windows\System\lpviTGT.exe
  2⤵
  PID:6232
- C:\Windows\System\GXPjqyz.exe
  C:\Windows\System\GXPjqyz.exe
  2⤵
  PID:6252
- C:\Windows\System\gBaYexI.exe
  C:\Windows\System\gBaYexI.exe
  2⤵
  PID:6276
- C:\Windows\System\tUEOBdM.exe
  C:\Windows\System\tUEOBdM.exe
  2⤵
  PID:6296
- C:\Windows\System\PfZIqMo.exe
  C:\Windows\System\PfZIqMo.exe
  2⤵
  PID:6316
- C:\Windows\System\WqRVysp.exe
  C:\Windows\System\WqRVysp.exe
  2⤵
  PID:6344
- C:\Windows\System\MwBzDYP.exe
  C:\Windows\System\MwBzDYP.exe
  2⤵
  PID:6364
- C:\Windows\System\XwzAkOL.exe
  C:\Windows\System\XwzAkOL.exe
  2⤵
  PID:6384
- C:\Windows\System\HhnGsyS.exe
  C:\Windows\System\HhnGsyS.exe
  2⤵
  PID:6408
- C:\Windows\System\voWUtbO.exe
  C:\Windows\System\voWUtbO.exe
  2⤵
  PID:6428
- C:\Windows\System\YvqzUxA.exe
  C:\Windows\System\YvqzUxA.exe
  2⤵
  PID:6448
- C:\Windows\System\VoTROWv.exe
  C:\Windows\System\VoTROWv.exe
  2⤵
  PID:6472
- C:\Windows\System\NODWzda.exe
  C:\Windows\System\NODWzda.exe
  2⤵
  PID:6488
- C:\Windows\System\XQqgkuj.exe
  C:\Windows\System\XQqgkuj.exe
  2⤵
  PID:6512
- C:\Windows\System\hURYgXJ.exe
  C:\Windows\System\hURYgXJ.exe
  2⤵
  PID:6540
- C:\Windows\System\MpefgAr.exe
  C:\Windows\System\MpefgAr.exe
  2⤵
  PID:6556
- C:\Windows\System\sqbfSHm.exe
  C:\Windows\System\sqbfSHm.exe
  2⤵
  PID:6584
- C:\Windows\System\VFCvcSa.exe
  C:\Windows\System\VFCvcSa.exe
  2⤵
  PID:6604
- C:\Windows\System\vzjdQTr.exe
  C:\Windows\System\vzjdQTr.exe
  2⤵
  PID:6620
- C:\Windows\System\meiCrDI.exe
  C:\Windows\System\meiCrDI.exe
  2⤵
  PID:6640
- C:\Windows\System\zSUFIOc.exe
  C:\Windows\System\zSUFIOc.exe
  2⤵
  PID:6664
- C:\Windows\System\WOWMNOM.exe
  C:\Windows\System\WOWMNOM.exe
  2⤵
  PID:6680
- C:\Windows\System\zwaHWdT.exe
  C:\Windows\System\zwaHWdT.exe
  2⤵
  PID:6704
- C:\Windows\System\rnrVWxi.exe
  C:\Windows\System\rnrVWxi.exe
  2⤵
  PID:6732
- C:\Windows\System\nVpzkAx.exe
  C:\Windows\System\nVpzkAx.exe
  2⤵
  PID:6756
- C:\Windows\System\NkrsRUk.exe
  C:\Windows\System\NkrsRUk.exe
  2⤵
  PID:6788
- C:\Windows\System\LwSHNOh.exe
  C:\Windows\System\LwSHNOh.exe
  2⤵
  PID:6804
- C:\Windows\System\htTvWuc.exe
  C:\Windows\System\htTvWuc.exe
  2⤵
  PID:6828
- C:\Windows\System\LeCBogY.exe
  C:\Windows\System\LeCBogY.exe
  2⤵
  PID:6856
- C:\Windows\System\hXKNkVa.exe
  C:\Windows\System\hXKNkVa.exe
  2⤵
  PID:6872
- C:\Windows\System\ylmvSQn.exe
  C:\Windows\System\ylmvSQn.exe
  2⤵
  PID:6896
- C:\Windows\System\MrwyPXN.exe
  C:\Windows\System\MrwyPXN.exe
  2⤵
  PID:6984
- C:\Windows\System\LIwwAHf.exe
  C:\Windows\System\LIwwAHf.exe
  2⤵
  PID:7008
- C:\Windows\System\jwqcPLk.exe
  C:\Windows\System\jwqcPLk.exe
  2⤵
  PID:7024
- C:\Windows\System\IvJuTCn.exe
  C:\Windows\System\IvJuTCn.exe
  2⤵
  PID:7048
- C:\Windows\System\adfCOxP.exe
  C:\Windows\System\adfCOxP.exe
  2⤵
  PID:7072
- C:\Windows\System\UTfmuDO.exe
  C:\Windows\System\UTfmuDO.exe
  2⤵
  PID:7088
- C:\Windows\System\FcBldqZ.exe
  C:\Windows\System\FcBldqZ.exe
  2⤵
  PID:7120
- C:\Windows\System\gluJNQU.exe
  C:\Windows\System\gluJNQU.exe
  2⤵
  PID:7148
- C:\Windows\System\QGShLgH.exe
  C:\Windows\System\QGShLgH.exe
  2⤵
  PID:5200
- C:\Windows\System\upSUWNO.exe
  C:\Windows\System\upSUWNO.exe
  2⤵
  PID:5272
- C:\Windows\System\yTmRMeD.exe
  C:\Windows\System\yTmRMeD.exe
  2⤵
  PID:5296
- C:\Windows\System\fSMzSWY.exe
  C:\Windows\System\fSMzSWY.exe
  2⤵
  PID:5348
- C:\Windows\System\ZnhogUi.exe
  C:\Windows\System\ZnhogUi.exe
  2⤵
  PID:5536
- C:\Windows\System\HqBxvDU.exe
  C:\Windows\System\HqBxvDU.exe
  2⤵
  PID:5620
- C:\Windows\System\ePDxTBL.exe
  C:\Windows\System\ePDxTBL.exe
  2⤵
  PID:5668
- C:\Windows\System\pPVURrl.exe
  C:\Windows\System\pPVURrl.exe
  2⤵
  PID:5520
- C:\Windows\System\BrxVuoT.exe
  C:\Windows\System\BrxVuoT.exe
  2⤵
  PID:5784
- C:\Windows\System\dRwxAAO.exe
  C:\Windows\System\dRwxAAO.exe
  2⤵
  PID:5820
- C:\Windows\System\tCoMQhh.exe
  C:\Windows\System\tCoMQhh.exe
  2⤵
  PID:6188
- C:\Windows\System\vMydDwf.exe
  C:\Windows\System\vMydDwf.exe
  2⤵
  PID:6396
- C:\Windows\System\oKvyzrh.exe
  C:\Windows\System\oKvyzrh.exe
  2⤵
  PID:5448
- C:\Windows\System\wRteCdV.exe
  C:\Windows\System\wRteCdV.exe
  2⤵
  PID:6468
- C:\Windows\System\xivlvXt.exe
  C:\Windows\System\xivlvXt.exe
  2⤵
  PID:6504
- C:\Windows\System\RsBZRlO.exe
  C:\Windows\System\RsBZRlO.exe
  2⤵
  PID:5992
- C:\Windows\System\xQRTVKO.exe
  C:\Windows\System\xQRTVKO.exe
  2⤵
  PID:6592
- C:\Windows\System\RFMswEc.exe
  C:\Windows\System\RFMswEc.exe
  2⤵
  PID:6040
- C:\Windows\System\CcUFUtj.exe
  C:\Windows\System\CcUFUtj.exe
  2⤵
  PID:6824
- C:\Windows\System\IbIBgBE.exe
  C:\Windows\System\IbIBgBE.exe
  2⤵
  PID:6104
- C:\Windows\System\IxQTMUG.exe
  C:\Windows\System\IxQTMUG.exe
  2⤵
  PID:6136
- C:\Windows\System\PFFCQlz.exe
  C:\Windows\System\PFFCQlz.exe
  2⤵
  PID:1572
- C:\Windows\System\UuhZnab.exe
  C:\Windows\System\UuhZnab.exe
  2⤵
  PID:364
- C:\Windows\System\RmtBJUO.exe
  C:\Windows\System\RmtBJUO.exe
  2⤵
  PID:7184
- C:\Windows\System\iUCQnfU.exe
  C:\Windows\System\iUCQnfU.exe
  2⤵
  PID:7216
- C:\Windows\System\KUTOdLF.exe
  C:\Windows\System\KUTOdLF.exe
  2⤵
  PID:7232
- C:\Windows\System\AGszOBL.exe
  C:\Windows\System\AGszOBL.exe
  2⤵
  PID:7260
- C:\Windows\System\ERyFhVw.exe
  C:\Windows\System\ERyFhVw.exe
  2⤵
  PID:7292
- C:\Windows\System\HqAtsPU.exe
  C:\Windows\System\HqAtsPU.exe
  2⤵
  PID:7312
- C:\Windows\System\cxCdaNS.exe
  C:\Windows\System\cxCdaNS.exe
  2⤵
  PID:7348
- C:\Windows\System\irpTfTO.exe
  C:\Windows\System\irpTfTO.exe
  2⤵
  PID:7364
- C:\Windows\System\CuMrRWC.exe
  C:\Windows\System\CuMrRWC.exe
  2⤵
  PID:7384
- C:\Windows\System\XHTEwnG.exe
  C:\Windows\System\XHTEwnG.exe
  2⤵
  PID:7400
- C:\Windows\System\CQraKpY.exe
  C:\Windows\System\CQraKpY.exe
  2⤵
  PID:7424
- C:\Windows\System\WJVAxKj.exe
  C:\Windows\System\WJVAxKj.exe
  2⤵
  PID:7440
- C:\Windows\System\wCdNrIL.exe
  C:\Windows\System\wCdNrIL.exe
  2⤵
  PID:7468
- C:\Windows\System\RVsbyUP.exe
  C:\Windows\System\RVsbyUP.exe
  2⤵
  PID:7492
- C:\Windows\System\vDyQKDi.exe
  C:\Windows\System\vDyQKDi.exe
  2⤵
  PID:7516
- C:\Windows\System\XsJRbxr.exe
  C:\Windows\System\XsJRbxr.exe
  2⤵
  PID:7536
- C:\Windows\System\trnieLU.exe
  C:\Windows\System\trnieLU.exe
  2⤵
  PID:7564
- C:\Windows\System\VlINzjo.exe
  C:\Windows\System\VlINzjo.exe
  2⤵
  PID:7584
- C:\Windows\System\CdYaVCK.exe
  C:\Windows\System\CdYaVCK.exe
  2⤵
  PID:7604
- C:\Windows\System\knvyKvR.exe
  C:\Windows\System\knvyKvR.exe
  2⤵
  PID:7628
- C:\Windows\System\pFOserj.exe
  C:\Windows\System\pFOserj.exe
  2⤵
  PID:7648
- C:\Windows\System\rHfwqON.exe
  C:\Windows\System\rHfwqON.exe
  2⤵
  PID:7668
- C:\Windows\System\zbFaWiq.exe
  C:\Windows\System\zbFaWiq.exe
  2⤵
  PID:7688
- C:\Windows\System\BVKZdeJ.exe
  C:\Windows\System\BVKZdeJ.exe
  2⤵
  PID:7712
- C:\Windows\System\ATxAYqn.exe
  C:\Windows\System\ATxAYqn.exe
  2⤵
  PID:7740
- C:\Windows\System\jMUqeuT.exe
  C:\Windows\System\jMUqeuT.exe
  2⤵
  PID:7764
- C:\Windows\System\tviqiXo.exe
  C:\Windows\System\tviqiXo.exe
  2⤵
  PID:7788
- C:\Windows\System\atGwbSq.exe
  C:\Windows\System\atGwbSq.exe
  2⤵
  PID:7816
- C:\Windows\System\ihisrCF.exe
  C:\Windows\System\ihisrCF.exe
  2⤵
  PID:7836
- C:\Windows\System\kjnTcEg.exe
  C:\Windows\System\kjnTcEg.exe
  2⤵
  PID:7872
- C:\Windows\System\XaVGlvM.exe
  C:\Windows\System\XaVGlvM.exe
  2⤵
  PID:7888
- C:\Windows\System\FmyCQqk.exe
  C:\Windows\System\FmyCQqk.exe
  2⤵
  PID:7904
- C:\Windows\System\GGmvmZk.exe
  C:\Windows\System\GGmvmZk.exe
  2⤵
  PID:7928
- C:\Windows\System\pnylVAW.exe
  C:\Windows\System\pnylVAW.exe
  2⤵
  PID:7948
- C:\Windows\System\ycFttue.exe
  C:\Windows\System\ycFttue.exe
  2⤵
  PID:7976
- C:\Windows\System\OfIsCER.exe
  C:\Windows\System\OfIsCER.exe
  2⤵
  PID:7996
- C:\Windows\System\KhdcNEc.exe
  C:\Windows\System\KhdcNEc.exe
  2⤵
  PID:8024
- C:\Windows\System\kWqZbnf.exe
  C:\Windows\System\kWqZbnf.exe
  2⤵
  PID:8048
- C:\Windows\System\EfBFGPD.exe
  C:\Windows\System\EfBFGPD.exe
  2⤵
  PID:8072
- C:\Windows\System\VoErjNC.exe
  C:\Windows\System\VoErjNC.exe
  2⤵
  PID:8096
- C:\Windows\System\rXhdFrk.exe
  C:\Windows\System\rXhdFrk.exe
  2⤵
  PID:8116
- C:\Windows\System\aWullen.exe
  C:\Windows\System\aWullen.exe
  2⤵
  PID:8140
- C:\Windows\System\xTFodLs.exe
  C:\Windows\System\xTFodLs.exe
  2⤵
  PID:8168
- C:\Windows\System\giXjDMX.exe
  C:\Windows\System\giXjDMX.exe
  2⤵
  PID:8188
- C:\Windows\System\TTeFeCe.exe
  C:\Windows\System\TTeFeCe.exe
  2⤵
  PID:6288
- C:\Windows\System\cxnsfMJ.exe
  C:\Windows\System\cxnsfMJ.exe
  2⤵
  PID:7128
- C:\Windows\System\ajLvhCB.exe
  C:\Windows\System\ajLvhCB.exe
  2⤵
  PID:5292
- C:\Windows\System\AsncCrI.exe
  C:\Windows\System\AsncCrI.exe
  2⤵
  PID:5316
- C:\Windows\System\VAtpUCH.exe
  C:\Windows\System\VAtpUCH.exe
  2⤵
  PID:5476
- C:\Windows\System\RlpStWv.exe
  C:\Windows\System\RlpStWv.exe
  2⤵
  PID:6632
- C:\Windows\System\hYiqGWL.exe
  C:\Windows\System\hYiqGWL.exe
  2⤵
  PID:3972
- C:\Windows\System\OcdfIHy.exe
  C:\Windows\System\OcdfIHy.exe
  2⤵
  PID:2240
- C:\Windows\System\voKdMbc.exe
  C:\Windows\System\voKdMbc.exe
  2⤵
  PID:1528
- C:\Windows\System\VWmUHCG.exe
  C:\Windows\System\VWmUHCG.exe
  2⤵
  PID:5368
- C:\Windows\System\TpvxlQe.exe
  C:\Windows\System\TpvxlQe.exe
  2⤵
  PID:5392
- C:\Windows\System\NImBovb.exe
  C:\Windows\System\NImBovb.exe
  2⤵
  PID:4996
- C:\Windows\System\ogAepkb.exe
  C:\Windows\System\ogAepkb.exe
  2⤵
  PID:6220
- C:\Windows\System\nsqRXoM.exe
  C:\Windows\System\nsqRXoM.exe
  2⤵
  PID:6260
- C:\Windows\System\PGDmqPT.exe
  C:\Windows\System\PGDmqPT.exe
  2⤵
  PID:7208
- C:\Windows\System\CrdUaqz.exe
  C:\Windows\System\CrdUaqz.exe
  2⤵
  PID:7256
- C:\Windows\System\UjOaTGw.exe
  C:\Windows\System\UjOaTGw.exe
  2⤵
  PID:7136
- C:\Windows\System\QBtomAZ.exe
  C:\Windows\System\QBtomAZ.exe
  2⤵
  PID:6336
- C:\Windows\System\oAeoYxY.exe
  C:\Windows\System\oAeoYxY.exe
  2⤵
  PID:6392
- C:\Windows\System\bjdHySn.exe
  C:\Windows\System\bjdHySn.exe
  2⤵
  PID:5284
- C:\Windows\System\RRCoVbO.exe
  C:\Windows\System\RRCoVbO.exe
  2⤵
  PID:5468
- C:\Windows\System\RCxpZXA.exe
  C:\Windows\System\RCxpZXA.exe
  2⤵
  PID:7504
- C:\Windows\System\YBtdOoe.exe
  C:\Windows\System\YBtdOoe.exe
  2⤵
  PID:6612
- C:\Windows\System\BNeHvTV.exe
  C:\Windows\System\BNeHvTV.exe
  2⤵
  PID:8216
- C:\Windows\System\gMDUXav.exe
  C:\Windows\System\gMDUXav.exe
  2⤵
  PID:8244
- C:\Windows\System\CWSseNY.exe
  C:\Windows\System\CWSseNY.exe
  2⤵
  PID:8268
- C:\Windows\System\vqiPWlB.exe
  C:\Windows\System\vqiPWlB.exe
  2⤵
  PID:8288
- C:\Windows\System\mTataGi.exe
  C:\Windows\System\mTataGi.exe
  2⤵
  PID:8312
- C:\Windows\System\mdeMMiz.exe
  C:\Windows\System\mdeMMiz.exe
  2⤵
  PID:8332
- C:\Windows\System\embcYSL.exe
  C:\Windows\System\embcYSL.exe
  2⤵
  PID:8348
- C:\Windows\System\duUluzC.exe
  C:\Windows\System\duUluzC.exe
  2⤵
  PID:8364
- C:\Windows\System\LCYNQDf.exe
  C:\Windows\System\LCYNQDf.exe
  2⤵
  PID:8384
- C:\Windows\System\lmKqUcy.exe
  C:\Windows\System\lmKqUcy.exe
  2⤵
  PID:8404
- C:\Windows\System\hPWUEOn.exe
  C:\Windows\System\hPWUEOn.exe
  2⤵
  PID:8424
- C:\Windows\System\svtbmXw.exe
  C:\Windows\System\svtbmXw.exe
  2⤵
  PID:8448
- C:\Windows\System\QKFtIdP.exe
  C:\Windows\System\QKFtIdP.exe
  2⤵
  PID:8472
- C:\Windows\System\UNEexkU.exe
  C:\Windows\System\UNEexkU.exe
  2⤵
  PID:8500
- C:\Windows\System\NqaNnYD.exe
  C:\Windows\System\NqaNnYD.exe
  2⤵
  PID:8524
- C:\Windows\System\wirtPyt.exe
  C:\Windows\System\wirtPyt.exe
  2⤵
  PID:8540
- C:\Windows\System\DBjpauu.exe
  C:\Windows\System\DBjpauu.exe
  2⤵
  PID:8564
- C:\Windows\System\TJvJfIF.exe
  C:\Windows\System\TJvJfIF.exe
  2⤵
  PID:8596
- C:\Windows\System\ValWPqG.exe
  C:\Windows\System\ValWPqG.exe
  2⤵
  PID:8612
- C:\Windows\System\wpBUxEi.exe
  C:\Windows\System\wpBUxEi.exe
  2⤵
  PID:8640
- C:\Windows\System\dzrxczL.exe
  C:\Windows\System\dzrxczL.exe
  2⤵
  PID:8668
- C:\Windows\System\EOgfDCa.exe
  C:\Windows\System\EOgfDCa.exe
  2⤵
  PID:8696
- C:\Windows\System\VAVUDdR.exe
  C:\Windows\System\VAVUDdR.exe
  2⤵
  PID:8720
- C:\Windows\System\Ejbcmjq.exe
  C:\Windows\System\Ejbcmjq.exe
  2⤵
  PID:8752
- C:\Windows\System\mqEZuBS.exe
  C:\Windows\System\mqEZuBS.exe
  2⤵
  PID:8776
- C:\Windows\System\moTQAjZ.exe
  C:\Windows\System\moTQAjZ.exe
  2⤵
  PID:8796
- C:\Windows\System\eXFmZTU.exe
  C:\Windows\System\eXFmZTU.exe
  2⤵
  PID:8820
- C:\Windows\System\qlyBEQG.exe
  C:\Windows\System\qlyBEQG.exe
  2⤵
  PID:8840
- C:\Windows\System\igrymwV.exe
  C:\Windows\System\igrymwV.exe
  2⤵
  PID:8860
- C:\Windows\System\ifFpXjD.exe
  C:\Windows\System\ifFpXjD.exe
  2⤵
  PID:8888
- C:\Windows\System\nQwxUUB.exe
  C:\Windows\System\nQwxUUB.exe
  2⤵
  PID:8908
- C:\Windows\System\jHjyhCp.exe
  C:\Windows\System\jHjyhCp.exe
  2⤵
  PID:8932
- C:\Windows\System\wSpFNCP.exe
  C:\Windows\System\wSpFNCP.exe
  2⤵
  PID:8956
- C:\Windows\System\UgfyDLo.exe
  C:\Windows\System\UgfyDLo.exe
  2⤵
  PID:8980
- C:\Windows\System\zubrqli.exe
  C:\Windows\System\zubrqli.exe
  2⤵
  PID:9000
- C:\Windows\System\CzUayyF.exe
  C:\Windows\System\CzUayyF.exe
  2⤵
  PID:9024
- C:\Windows\System\CaosQEf.exe
  C:\Windows\System\CaosQEf.exe
  2⤵
  PID:9048
- C:\Windows\System\lizDeUO.exe
  C:\Windows\System\lizDeUO.exe
  2⤵
  PID:9064
- C:\Windows\System\qtqGAbV.exe
  C:\Windows\System\qtqGAbV.exe
  2⤵
  PID:9092
- C:\Windows\System\FEpKzyx.exe
  C:\Windows\System\FEpKzyx.exe
  2⤵
  PID:9116
- C:\Windows\System\QWvXbwB.exe
  C:\Windows\System\QWvXbwB.exe
  2⤵
  PID:9136
- C:\Windows\System\NWRSRCt.exe
  C:\Windows\System\NWRSRCt.exe
  2⤵
  PID:9160
- C:\Windows\System\KNaLkcD.exe
  C:\Windows\System\KNaLkcD.exe
  2⤵
  PID:9188
- C:\Windows\System\BweTXLI.exe
  C:\Windows\System\BweTXLI.exe
  2⤵
  PID:9208
- C:\Windows\System\jrvqfIK.exe
  C:\Windows\System\jrvqfIK.exe
  2⤵
  PID:6740
- C:\Windows\System\XocbjTq.exe
  C:\Windows\System\XocbjTq.exe
  2⤵
  PID:6764
- C:\Windows\System\ZrUUBOM.exe
  C:\Windows\System\ZrUUBOM.exe
  2⤵
  PID:6420
- C:\Windows\System\OCZHzHk.exe
  C:\Windows\System\OCZHzHk.exe
  2⤵
  PID:6864
- C:\Windows\System\KmBImHb.exe
  C:\Windows\System\KmBImHb.exe
  2⤵
  PID:6904
- C:\Windows\System\LJEApaM.exe
  C:\Windows\System\LJEApaM.exe
  2⤵
  PID:6948
- C:\Windows\System\wLjtKua.exe
  C:\Windows\System\wLjtKua.exe
  2⤵
  PID:8060
- C:\Windows\System\oEGqkJV.exe
  C:\Windows\System\oEGqkJV.exe
  2⤵
  PID:7196
- C:\Windows\System\ttKJAIk.exe
  C:\Windows\System\ttKJAIk.exe
  2⤵
  PID:8108
- C:\Windows\System\pfXFaxu.exe
  C:\Windows\System\pfXFaxu.exe
  2⤵
  PID:7016
- C:\Windows\System\HVTfuMf.exe
  C:\Windows\System\HVTfuMf.exe
  2⤵
  PID:8180
- C:\Windows\System\qxrjIPZ.exe
  C:\Windows\System\qxrjIPZ.exe
  2⤵
  PID:5036
- C:\Windows\System\tHFICZW.exe
  C:\Windows\System\tHFICZW.exe
  2⤵
  PID:6720
- C:\Windows\System\tIOOemH.exe
  C:\Windows\System\tIOOemH.exe
  2⤵
  PID:5144
- C:\Windows\System\BuQFOEz.exe
  C:\Windows\System\BuQFOEz.exe
  2⤵
  PID:6272
- C:\Windows\System\UpIjgwy.exe
  C:\Windows\System\UpIjgwy.exe
  2⤵
  PID:7080
- C:\Windows\System\mBwVcRT.exe
  C:\Windows\System\mBwVcRT.exe
  2⤵
  PID:6328
- C:\Windows\System\YrjNSIk.exe
  C:\Windows\System\YrjNSIk.exe
  2⤵
  PID:7528
- C:\Windows\System\rMJbAei.exe
  C:\Windows\System\rMJbAei.exe
  2⤵
  PID:9220
- C:\Windows\System\zBMHZCD.exe
  C:\Windows\System\zBMHZCD.exe
  2⤵
  PID:9240
- C:\Windows\System\sETBkjg.exe
  C:\Windows\System\sETBkjg.exe
  2⤵
  PID:9264
- C:\Windows\System\xBSLcfB.exe
  C:\Windows\System\xBSLcfB.exe
  2⤵
  PID:9284
- C:\Windows\System\lRBazgP.exe
  C:\Windows\System\lRBazgP.exe
  2⤵
  PID:9308
- C:\Windows\System\RMGaTam.exe
  C:\Windows\System\RMGaTam.exe
  2⤵
  PID:9336
- C:\Windows\System\IQNdwKP.exe
  C:\Windows\System\IQNdwKP.exe
  2⤵
  PID:9364
- C:\Windows\System\lfkKPEh.exe
  C:\Windows\System\lfkKPEh.exe
  2⤵
  PID:9380
- C:\Windows\System\MSWqlMB.exe
  C:\Windows\System\MSWqlMB.exe
  2⤵
  PID:9400
- C:\Windows\System\NdoTZuP.exe
  C:\Windows\System\NdoTZuP.exe
  2⤵
  PID:9420
- C:\Windows\System\TEijdSD.exe
  C:\Windows\System\TEijdSD.exe
  2⤵
  PID:9436
- C:\Windows\System\bIobUPQ.exe
  C:\Windows\System\bIobUPQ.exe
  2⤵
  PID:9452
- C:\Windows\System\XIqZZkD.exe
  C:\Windows\System\XIqZZkD.exe
  2⤵
  PID:9476
- C:\Windows\System\ctvPvNg.exe
  C:\Windows\System\ctvPvNg.exe
  2⤵
  PID:9492
- C:\Windows\System\JbOdNBO.exe
  C:\Windows\System\JbOdNBO.exe
  2⤵
  PID:9516
- C:\Windows\System\xQFaNAy.exe
  C:\Windows\System\xQFaNAy.exe
  2⤵
  PID:9536
- C:\Windows\System\MavZXUH.exe
  C:\Windows\System\MavZXUH.exe
  2⤵
  PID:9564
- C:\Windows\System\XBcPHZY.exe
  C:\Windows\System\XBcPHZY.exe
  2⤵
  PID:9584
- C:\Windows\System\rPXOBbZ.exe
  C:\Windows\System\rPXOBbZ.exe
  2⤵
  PID:9612
- C:\Windows\System\inNOexQ.exe
  C:\Windows\System\inNOexQ.exe
  2⤵
  PID:9640
- C:\Windows\System\cPBfEtW.exe
  C:\Windows\System\cPBfEtW.exe
  2⤵
  PID:9664
- C:\Windows\System\NbZHpUE.exe
  C:\Windows\System\NbZHpUE.exe
  2⤵
  PID:9684
- C:\Windows\System\FbOQlTI.exe
  C:\Windows\System\FbOQlTI.exe
  2⤵
  PID:9708
- C:\Windows\System\TGXGSQG.exe
  C:\Windows\System\TGXGSQG.exe
  2⤵
  PID:9732
- C:\Windows\System\fJZDMyF.exe
  C:\Windows\System\fJZDMyF.exe
  2⤵
  PID:9752
- C:\Windows\System\jtvBYzc.exe
  C:\Windows\System\jtvBYzc.exe
  2⤵
  PID:9776
- C:\Windows\System\EwSPdfH.exe
  C:\Windows\System\EwSPdfH.exe
  2⤵
  PID:9792
- C:\Windows\System\TZSrUEQ.exe
  C:\Windows\System\TZSrUEQ.exe
  2⤵
  PID:9812
- C:\Windows\System\WxEVExA.exe
  C:\Windows\System\WxEVExA.exe
  2⤵
  PID:9828
- C:\Windows\System\zyMgmUF.exe
  C:\Windows\System\zyMgmUF.exe
  2⤵
  PID:9848
- C:\Windows\System\gUCpfmj.exe
  C:\Windows\System\gUCpfmj.exe
  2⤵
  PID:9868
- C:\Windows\System\wjMkgnQ.exe
  C:\Windows\System\wjMkgnQ.exe
  2⤵
  PID:9892
- C:\Windows\System\ZcpazOm.exe
  C:\Windows\System\ZcpazOm.exe
  2⤵
  PID:9920
- C:\Windows\System\ETLlcxw.exe
  C:\Windows\System\ETLlcxw.exe
  2⤵
  PID:9940
- C:\Windows\System\stePljj.exe
  C:\Windows\System\stePljj.exe
  2⤵
  PID:9964
- C:\Windows\System\rununuh.exe
  C:\Windows\System\rununuh.exe
  2⤵
  PID:9988
- C:\Windows\System\HXplAAx.exe
  C:\Windows\System\HXplAAx.exe
  2⤵
  PID:10008
- C:\Windows\System\zCWnTCl.exe
  C:\Windows\System\zCWnTCl.exe
  2⤵
  PID:10040
- C:\Windows\System\bzhYjIf.exe
  C:\Windows\System\bzhYjIf.exe
  2⤵
  PID:10064
- C:\Windows\System\ZYEaXjV.exe
  C:\Windows\System\ZYEaXjV.exe
  2⤵
  PID:10084
- C:\Windows\System\hNpxUpo.exe
  C:\Windows\System\hNpxUpo.exe
  2⤵
  PID:10108
- C:\Windows\System\FubgvJq.exe
  C:\Windows\System\FubgvJq.exe
  2⤵
  PID:10140
- C:\Windows\System\TBvjIip.exe
  C:\Windows\System\TBvjIip.exe
  2⤵
  PID:10168
- C:\Windows\System\jYvCyhn.exe
  C:\Windows\System\jYvCyhn.exe
  2⤵
  PID:10188
- C:\Windows\System\qvbRUdM.exe
  C:\Windows\System\qvbRUdM.exe
  2⤵
  PID:10212
- C:\Windows\System\RRYkOWs.exe
  C:\Windows\System\RRYkOWs.exe
  2⤵
  PID:8228
- C:\Windows\System\LxOHuqP.exe
  C:\Windows\System\LxOHuqP.exe
  2⤵
  PID:7596
- C:\Windows\System\QBbSgJn.exe
  C:\Windows\System\QBbSgJn.exe
  2⤵
  PID:7624
- C:\Windows\System\rmrMmJL.exe
  C:\Windows\System\rmrMmJL.exe
  2⤵
  PID:8440
- C:\Windows\System\bSLOyNB.exe
  C:\Windows\System\bSLOyNB.exe
  2⤵
  PID:8480
- C:\Windows\System\EYBtkCH.exe
  C:\Windows\System\EYBtkCH.exe
  2⤵
  PID:8516
- C:\Windows\System\dcvqDNc.exe
  C:\Windows\System\dcvqDNc.exe
  2⤵
  PID:8560
- C:\Windows\System\qrOioNG.exe
  C:\Windows\System\qrOioNG.exe
  2⤵
  PID:7832
- C:\Windows\System\gIEwwEO.exe
  C:\Windows\System\gIEwwEO.exe
  2⤵
  PID:7916
- C:\Windows\System\NokffYx.exe
  C:\Windows\System\NokffYx.exe
  2⤵
  PID:7960
- C:\Windows\System\NHRFLPL.exe
  C:\Windows\System\NHRFLPL.exe
  2⤵
  PID:7176
- C:\Windows\System\hBbbtyD.exe
  C:\Windows\System\hBbbtyD.exe
  2⤵
  PID:8916
- C:\Windows\System\muqUffb.exe
  C:\Windows\System\muqUffb.exe
  2⤵
  PID:9032
- C:\Windows\System\XSpdZpB.exe
  C:\Windows\System\XSpdZpB.exe
  2⤵
  PID:9100
- C:\Windows\System\yozFDTu.exe
  C:\Windows\System\yozFDTu.exe
  2⤵
  PID:3108
- C:\Windows\System\fRMpAZw.exe
  C:\Windows\System\fRMpAZw.exe
  2⤵
  PID:6748
- C:\Windows\System\uJRHhAi.exe
  C:\Windows\System\uJRHhAi.exe
  2⤵
  PID:6520
- C:\Windows\System\GyYqIxq.exe
  C:\Windows\System\GyYqIxq.exe
  2⤵
  PID:7420
- C:\Windows\System\SCgKXAb.exe
  C:\Windows\System\SCgKXAb.exe
  2⤵
  PID:6160
- C:\Windows\System\cbQzEbd.exe
  C:\Windows\System\cbQzEbd.exe
  2⤵
  PID:8124
- C:\Windows\System\iSdQPjs.exe
  C:\Windows\System\iSdQPjs.exe
  2⤵
  PID:8184
- C:\Windows\System\WczjDQF.exe
  C:\Windows\System\WczjDQF.exe
  2⤵
  PID:7432
- C:\Windows\System\zMKVEEn.exe
  C:\Windows\System\zMKVEEn.exe
  2⤵
  PID:5776
- C:\Windows\System\VhPfWme.exe
  C:\Windows\System\VhPfWme.exe
  2⤵
  PID:9272
- C:\Windows\System\iuKeoOB.exe
  C:\Windows\System\iuKeoOB.exe
  2⤵
  PID:8284
- C:\Windows\System\RjZAUay.exe
  C:\Windows\System\RjZAUay.exe
  2⤵
  PID:8328
- C:\Windows\System\baNFKpi.exe
  C:\Windows\System\baNFKpi.exe
  2⤵
  PID:9396
- C:\Windows\System\QCRFvzt.exe
  C:\Windows\System\QCRFvzt.exe
  2⤵
  PID:10252
- C:\Windows\System\GTocadA.exe
  C:\Windows\System\GTocadA.exe
  2⤵
  PID:10276
- C:\Windows\System\pxEWusC.exe
  C:\Windows\System\pxEWusC.exe
  2⤵
  PID:10292
- C:\Windows\System\Vtkymba.exe
  C:\Windows\System\Vtkymba.exe
  2⤵
  PID:10308
- C:\Windows\System\MfUhEKz.exe
  C:\Windows\System\MfUhEKz.exe
  2⤵
  PID:10328
- C:\Windows\System\umdhoRh.exe
  C:\Windows\System\umdhoRh.exe
  2⤵
  PID:10352
- C:\Windows\System\blObscN.exe
  C:\Windows\System\blObscN.exe
  2⤵
  PID:10380
- C:\Windows\System\mfSsCqS.exe
  C:\Windows\System\mfSsCqS.exe
  2⤵
  PID:10408
- C:\Windows\System\xvwPQdd.exe
  C:\Windows\System\xvwPQdd.exe
  2⤵
  PID:10432
- C:\Windows\System\qSSoJZL.exe
  C:\Windows\System\qSSoJZL.exe
  2⤵
  PID:10452
- C:\Windows\System\DSGkWCB.exe
  C:\Windows\System\DSGkWCB.exe
  2⤵
  PID:10476
- C:\Windows\System\mwVqcCG.exe
  C:\Windows\System\mwVqcCG.exe
  2⤵
  PID:10500
- C:\Windows\System\LiuirVd.exe
  C:\Windows\System\LiuirVd.exe
  2⤵
  PID:10520
- C:\Windows\System\AhpMuWr.exe
  C:\Windows\System\AhpMuWr.exe
  2⤵
  PID:10540
- C:\Windows\System\ixTmdYF.exe
  C:\Windows\System\ixTmdYF.exe
  2⤵
  PID:10556
- C:\Windows\System\UaGTesD.exe
  C:\Windows\System\UaGTesD.exe
  2⤵
  PID:10608
- C:\Windows\System\fWtHKti.exe
  C:\Windows\System\fWtHKti.exe
  2⤵
  PID:10632
- C:\Windows\System\DNIBJvy.exe
  C:\Windows\System\DNIBJvy.exe
  2⤵
  PID:10652
- C:\Windows\System\NxcnyDh.exe
  C:\Windows\System\NxcnyDh.exe
  2⤵
  PID:10672
- C:\Windows\System\pQWaCla.exe
  C:\Windows\System\pQWaCla.exe
  2⤵
  PID:10696
- C:\Windows\System\CSpCaPn.exe
  C:\Windows\System\CSpCaPn.exe
  2⤵
  PID:10764
- C:\Windows\System\XKgxBJh.exe
  C:\Windows\System\XKgxBJh.exe
  2⤵
  PID:10780
- C:\Windows\System\KxLbrAs.exe
  C:\Windows\System\KxLbrAs.exe
  2⤵
  PID:10796
- C:\Windows\System\RMXAFuG.exe
  C:\Windows\System\RMXAFuG.exe
  2⤵
  PID:10820
- C:\Windows\System\NNiQrSY.exe
  C:\Windows\System\NNiQrSY.exe
  2⤵
  PID:10816
- C:\Windows\System\xKxklNv.exe
  C:\Windows\System\xKxklNv.exe
  2⤵
  PID:10000
- C:\Windows\System\zIqqeiJ.exe
  C:\Windows\System\zIqqeiJ.exe
  2⤵
  PID:8948
- C:\Windows\System\HaQWqGB.exe
  C:\Windows\System\HaQWqGB.exe
  2⤵
  PID:10080
- C:\Windows\System\rLdJBjM.exe
  C:\Windows\System\rLdJBjM.exe
  2⤵
  PID:9184
- C:\Windows\System\biDSJda.exe
  C:\Windows\System\biDSJda.exe
  2⤵
  PID:10964
- C:\Windows\System\lhQvgbG.exe
  C:\Windows\System\lhQvgbG.exe
  2⤵
  PID:7684
- C:\Windows\System\kLmxJRK.exe
  C:\Windows\System\kLmxJRK.exe
  2⤵
  PID:8084
- C:\Windows\System\nhQwsyo.exe
  C:\Windows\System\nhQwsyo.exe
  2⤵
  PID:3588
- C:\Windows\System\KHnxKIf.exe
  C:\Windows\System\KHnxKIf.exe
  2⤵
  PID:5708
- C:\Windows\System\JJrFePS.exe
  C:\Windows\System\JJrFePS.exe
  2⤵
  PID:11280
- C:\Windows\System\efRhGRV.exe
  C:\Windows\System\efRhGRV.exe
  2⤵
  PID:11300
- C:\Windows\System\ObFPndK.exe
  C:\Windows\System\ObFPndK.exe
  2⤵
  PID:11328
- C:\Windows\System\ViCiNLu.exe
  C:\Windows\System\ViCiNLu.exe
  2⤵
  PID:11352
- C:\Windows\System\nYenoQs.exe
  C:\Windows\System\nYenoQs.exe
  2⤵
  PID:11376
- C:\Windows\System\TuhPkat.exe
  C:\Windows\System\TuhPkat.exe
  2⤵
  PID:11408
- C:\Windows\System\fcaoLVw.exe
  C:\Windows\System\fcaoLVw.exe
  2⤵
  PID:11436
- C:\Windows\System\FgqZUmB.exe
  C:\Windows\System\FgqZUmB.exe
  2⤵
  PID:11460
- C:\Windows\System\wnAsHek.exe
  C:\Windows\System\wnAsHek.exe
  2⤵
  PID:11492
- C:\Windows\System\TiAEdUg.exe
  C:\Windows\System\TiAEdUg.exe
  2⤵
  PID:11524
- C:\Windows\System\eJSVgpt.exe
  C:\Windows\System\eJSVgpt.exe
  2⤵
  PID:11548
- C:\Windows\System\OcVHBxI.exe
  C:\Windows\System\OcVHBxI.exe
  2⤵
  PID:11576
- C:\Windows\System\SNAtshu.exe
  C:\Windows\System\SNAtshu.exe
  2⤵
  PID:11604
- C:\Windows\System\AfMCmUO.exe
  C:\Windows\System\AfMCmUO.exe
  2⤵
  PID:11628
- C:\Windows\System\ieLUVyF.exe
  C:\Windows\System\ieLUVyF.exe
  2⤵
  PID:11652
- C:\Windows\System\KRywyXt.exe
  C:\Windows\System\KRywyXt.exe
  2⤵
  PID:11680
- C:\Windows\System\DecbGcL.exe
  C:\Windows\System\DecbGcL.exe
  2⤵
  PID:11712
- C:\Windows\System\cayLeIh.exe
  C:\Windows\System\cayLeIh.exe
  2⤵
  PID:11740
- C:\Windows\System\lvywuVh.exe
  C:\Windows\System\lvywuVh.exe
  2⤵
  PID:11760
- C:\Windows\System\MFGhPXf.exe
  C:\Windows\System\MFGhPXf.exe
  2⤵
  PID:11780
- C:\Windows\System\XxZezNc.exe
  C:\Windows\System\XxZezNc.exe
  2⤵
  PID:11800
- C:\Windows\System\OJYhNhs.exe
  C:\Windows\System\OJYhNhs.exe
  2⤵
  PID:11816
- C:\Windows\System\jKmkJGe.exe
  C:\Windows\System\jKmkJGe.exe
  2⤵
  PID:11832
- C:\Windows\System\eafVghY.exe
  C:\Windows\System\eafVghY.exe
  2⤵
  PID:11848
- C:\Windows\System\KbzbCAT.exe
  C:\Windows\System\KbzbCAT.exe
  2⤵
  PID:11864
- C:\Windows\System\VhkzWWd.exe
  C:\Windows\System\VhkzWWd.exe
  2⤵
  PID:11880
- C:\Windows\System\WEBbUlc.exe
  C:\Windows\System\WEBbUlc.exe
  2⤵
  PID:11896
- C:\Windows\System\dAOTawl.exe
  C:\Windows\System\dAOTawl.exe
  2⤵
  PID:11912
- C:\Windows\System\kNXXnZy.exe
  C:\Windows\System\kNXXnZy.exe
  2⤵
  PID:11928
- C:\Windows\System\vdWujPj.exe
  C:\Windows\System\vdWujPj.exe
  2⤵
  PID:11952
- C:\Windows\System\XCwdxVW.exe
  C:\Windows\System\XCwdxVW.exe
  2⤵
  PID:11988
- C:\Windows\System\fLbtqIA.exe
  C:\Windows\System\fLbtqIA.exe
  2⤵
  PID:12016
- C:\Windows\System\yDVvfPZ.exe
  C:\Windows\System\yDVvfPZ.exe
  2⤵
  PID:12036
- C:\Windows\System\oDChQbn.exe
  C:\Windows\System\oDChQbn.exe
  2⤵
  PID:12060
- C:\Windows\System\rELrGBG.exe
  C:\Windows\System\rELrGBG.exe
  2⤵
  PID:12080
- C:\Windows\System\HDDvWTM.exe
  C:\Windows\System\HDDvWTM.exe
  2⤵
  PID:12104
- C:\Windows\System\yiTVJIM.exe
  C:\Windows\System\yiTVJIM.exe
  2⤵
  PID:12128
- C:\Windows\System\Iaqbbqr.exe
  C:\Windows\System\Iaqbbqr.exe
  2⤵
  PID:12156
- C:\Windows\System\VDVSWZg.exe
  C:\Windows\System\VDVSWZg.exe
  2⤵
  PID:12176
- C:\Windows\System\udGwSFd.exe
  C:\Windows\System\udGwSFd.exe
  2⤵
  PID:12196
- C:\Windows\System\dwVvLEn.exe
  C:\Windows\System\dwVvLEn.exe
  2⤵
  PID:12220
- C:\Windows\System\mjndVIk.exe
  C:\Windows\System\mjndVIk.exe
  2⤵
  PID:12236
- C:\Windows\System\DHehIlx.exe
  C:\Windows\System\DHehIlx.exe
  2⤵
  PID:12272
- C:\Windows\System\ibABLCc.exe
  C:\Windows\System\ibABLCc.exe
  2⤵
  PID:9296
- C:\Windows\System\TZZEMcZ.exe
  C:\Windows\System\TZZEMcZ.exe
  2⤵
  PID:9392
- C:\Windows\System\sqToWuW.exe
  C:\Windows\System\sqToWuW.exe
  2⤵
  PID:9464
- C:\Windows\System\hfVQAKx.exe
  C:\Windows\System\hfVQAKx.exe
  2⤵
  PID:11192
- C:\Windows\System\XTTwhfP.exe
  C:\Windows\System\XTTwhfP.exe
  2⤵
  PID:9604
- C:\Windows\System\BrtPixK.exe
  C:\Windows\System\BrtPixK.exe
  2⤵
  PID:9636
- C:\Windows\System\XlIjHGR.exe
  C:\Windows\System\XlIjHGR.exe
  2⤵
  PID:9700
- C:\Windows\System\KQwHXWi.exe
  C:\Windows\System\KQwHXWi.exe
  2⤵
  PID:9728
- C:\Windows\System\ZqdfZhj.exe
  C:\Windows\System\ZqdfZhj.exe
  2⤵
  PID:10568
- C:\Windows\System\haRRpmc.exe
  C:\Windows\System\haRRpmc.exe
  2⤵
  PID:9804
- C:\Windows\System\xehJwSx.exe
  C:\Windows\System\xehJwSx.exe
  2⤵
  PID:9840
- C:\Windows\System\LxazcwY.exe
  C:\Windows\System\LxazcwY.exe
  2⤵
  PID:9880
- C:\Windows\System\AekqRtJ.exe
  C:\Windows\System\AekqRtJ.exe
  2⤵
  PID:10664
- C:\Windows\System\RMyzTDY.exe
  C:\Windows\System\RMyzTDY.exe
  2⤵
  PID:10692
- C:\Windows\System\EFXEvpE.exe
  C:\Windows\System\EFXEvpE.exe
  2⤵
  PID:9932
- C:\Windows\System\cYnhsBi.exe
  C:\Windows\System\cYnhsBi.exe
  2⤵
  PID:12304
- C:\Windows\System\qKJqvuW.exe
  C:\Windows\System\qKJqvuW.exe
  2⤵
  PID:12320
- C:\Windows\System\omFVsvF.exe
  C:\Windows\System\omFVsvF.exe
  2⤵
  PID:12336
- C:\Windows\System\xauuMwR.exe
  C:\Windows\System\xauuMwR.exe
  2⤵
  PID:12356
- C:\Windows\System\DtXxURX.exe
  C:\Windows\System\DtXxURX.exe
  2⤵
  PID:12384
- C:\Windows\System\oKIZAnz.exe
  C:\Windows\System\oKIZAnz.exe
  2⤵
  PID:12496
- C:\Windows\System\hMiQghJ.exe
  C:\Windows\System\hMiQghJ.exe
  2⤵
  PID:12524
- C:\Windows\System\VdmvIVq.exe
  C:\Windows\System\VdmvIVq.exe
  2⤵
  PID:12568
- C:\Windows\System\vxdHEej.exe
  C:\Windows\System\vxdHEej.exe
  2⤵
  PID:12604
- C:\Windows\System\rkIpxGq.exe
  C:\Windows\System\rkIpxGq.exe
  2⤵
  PID:12632
- C:\Windows\System\UiQCJOQ.exe
  C:\Windows\System\UiQCJOQ.exe
  2⤵
  PID:12652
- C:\Windows\System\tzjAKKe.exe
  C:\Windows\System\tzjAKKe.exe
  2⤵
  PID:12668
- C:\Windows\System\DnIJdwu.exe
  C:\Windows\System\DnIJdwu.exe
  2⤵
  PID:12684
- C:\Windows\System\zJGOVkF.exe
  C:\Windows\System\zJGOVkF.exe
  2⤵
  PID:12700
- C:\Windows\System\IFfvSln.exe
  C:\Windows\System\IFfvSln.exe
  2⤵
  PID:12716
- C:\Windows\System\tSaYpMQ.exe
  C:\Windows\System\tSaYpMQ.exe
  2⤵
  PID:12732
- C:\Windows\System\WWssLRo.exe
  C:\Windows\System\WWssLRo.exe
  2⤵
  PID:12748
- C:\Windows\System\rkCTiMv.exe
  C:\Windows\System\rkCTiMv.exe
  2⤵
  PID:12764
- C:\Windows\System\cAxycqy.exe
  C:\Windows\System\cAxycqy.exe
  2⤵
  PID:12780
- C:\Windows\System\NvxxAAm.exe
  C:\Windows\System\NvxxAAm.exe
  2⤵
  PID:12812
- C:\Windows\System\WTrWaUV.exe
  C:\Windows\System\WTrWaUV.exe
  2⤵
  PID:12828
- C:\Windows\System\qGzKzDm.exe
  C:\Windows\System\qGzKzDm.exe
  2⤵
  PID:12848
- C:\Windows\System\emnmLSq.exe
  C:\Windows\System\emnmLSq.exe
  2⤵
  PID:12872
- C:\Windows\System\aDvAkJD.exe
  C:\Windows\System\aDvAkJD.exe
  2⤵
  PID:12900
- C:\Windows\System\MHpueqy.exe
  C:\Windows\System\MHpueqy.exe
  2⤵
  PID:12920
- C:\Windows\System\fBiLBAW.exe
  C:\Windows\System\fBiLBAW.exe
  2⤵
  PID:12940
- C:\Windows\System\cakxxdj.exe
  C:\Windows\System\cakxxdj.exe
  2⤵
  PID:12964
- C:\Windows\System\NpgwgdS.exe
  C:\Windows\System\NpgwgdS.exe
  2⤵
  PID:12996
- C:\Windows\System\ZAhtCsx.exe
  C:\Windows\System\ZAhtCsx.exe
  2⤵
  PID:13020
- C:\Windows\System\OcLkzPI.exe
  C:\Windows\System\OcLkzPI.exe
  2⤵
  PID:13040
- C:\Windows\System\BjLYhzX.exe
  C:\Windows\System\BjLYhzX.exe
  2⤵
  PID:13064
- C:\Windows\System\ksEzPXm.exe
  C:\Windows\System\ksEzPXm.exe
  2⤵
  PID:13080
- C:\Windows\System\TsCjxUm.exe
  C:\Windows\System\TsCjxUm.exe
  2⤵
  PID:13108
- C:\Windows\System\zWtxgDH.exe
  C:\Windows\System\zWtxgDH.exe
  2⤵
  PID:13128
- C:\Windows\System\PcLMYdV.exe
  C:\Windows\System\PcLMYdV.exe
  2⤵
  PID:13148
- C:\Windows\System\OkXroQD.exe
  C:\Windows\System\OkXroQD.exe
  2⤵
  PID:13168
- C:\Windows\System\cKHuoBV.exe
  C:\Windows\System\cKHuoBV.exe
  2⤵
  PID:13192
- C:\Windows\System\JwPgBXs.exe
  C:\Windows\System\JwPgBXs.exe
  2⤵
  PID:13216
- C:\Windows\System\xhaEOhz.exe
  C:\Windows\System\xhaEOhz.exe
  2⤵
  PID:13248
- C:\Windows\System\UwtnrHs.exe
  C:\Windows\System\UwtnrHs.exe
  2⤵
  PID:13272
- C:\Windows\System\WAsdbfo.exe
  C:\Windows\System\WAsdbfo.exe
  2⤵
  PID:13292
- C:\Windows\System\GcgrAoM.exe
  C:\Windows\System\GcgrAoM.exe
  2⤵
  PID:3688
- C:\Windows\System\VodCxgW.exe
  C:\Windows\System\VodCxgW.exe
  2⤵
  PID:10096
- C:\Windows\System\WeKqFYK.exe
  C:\Windows\System\WeKqFYK.exe
  2⤵
  PID:10196
- C:\Windows\System\okNWsLV.exe
  C:\Windows\System\okNWsLV.exe
  2⤵
  PID:3784
- C:\Windows\System\rvDvKtr.exe
  C:\Windows\System\rvDvKtr.exe
  2⤵
  PID:7776
- C:\Windows\System\drsoYkT.exe
  C:\Windows\System\drsoYkT.exe
  2⤵
  PID:1644
- C:\Windows\System\HrKzkll.exe
  C:\Windows\System\HrKzkll.exe
  2⤵
  PID:10004
- C:\Windows\System\DqWcgBE.exe
  C:\Windows\System\DqWcgBE.exe
  2⤵
  PID:9152
- C:\Windows\System\fpTkIYm.exe
  C:\Windows\System\fpTkIYm.exe
  2⤵
  PID:11060
- C:\Windows\System\tvWIxJR.exe
  C:\Windows\System\tvWIxJR.exe
  2⤵
  PID:7164
- C:\Windows\System\HWhfQuL.exe
  C:\Windows\System\HWhfQuL.exe
  2⤵
  PID:2692
- C:\Windows\System\OQQbXRG.exe
  C:\Windows\System\OQQbXRG.exe
  2⤵
  PID:8092
- C:\Windows\System\szrigHY.exe
  C:\Windows\System\szrigHY.exe
  2⤵
  PID:11348
- C:\Windows\System\HhCRsFI.exe
  C:\Windows\System\HhCRsFI.exe
  2⤵
  PID:11104
- C:\Windows\System\mQoweTb.exe
  C:\Windows\System\mQoweTb.exe
  2⤵
  PID:9260
- C:\Windows\System\ohMOmkd.exe
  C:\Windows\System\ohMOmkd.exe
  2⤵
  PID:8320
- C:\Windows\System\iTFOKrf.exe
  C:\Windows\System\iTFOKrf.exe
  2⤵
  PID:11172
- C:\Windows\System\YohZaMM.exe
  C:\Windows\System\YohZaMM.exe
  2⤵
  PID:10268
- C:\Windows\System\HXrbnNL.exe
  C:\Windows\System\HXrbnNL.exe
  2⤵
  PID:11692
- C:\Windows\System\kSiLmJJ.exe
  C:\Windows\System\kSiLmJJ.exe
  2⤵
  PID:10360
- C:\Windows\System\eJJXzFe.exe
  C:\Windows\System\eJJXzFe.exe
  2⤵
  PID:11808
- C:\Windows\System\FXykAet.exe
  C:\Windows\System\FXykAet.exe
  2⤵
  PID:10372
- C:\Windows\System\xpHmbkH.exe
  C:\Windows\System\xpHmbkH.exe
  2⤵
  PID:11940
- C:\Windows\System\iwyoyMc.exe
  C:\Windows\System\iwyoyMc.exe
  2⤵
  PID:10444
- C:\Windows\System\bDOnSlH.exe
  C:\Windows\System\bDOnSlH.exe
  2⤵
  PID:11260
- C:\Windows\System\PUkaPnA.exe
  C:\Windows\System\PUkaPnA.exe
  2⤵
  PID:12088
- C:\Windows\System\idTYvWt.exe
  C:\Windows\System\idTYvWt.exe
  2⤵
  PID:12124
- C:\Windows\System\ChhaBJD.exe
  C:\Windows\System\ChhaBJD.exe
  2⤵
  PID:12164
- C:\Windows\System\ybHAEqD.exe
  C:\Windows\System\ybHAEqD.exe
  2⤵
  PID:12184
- C:\Windows\System\wYVsGOh.exe
  C:\Windows\System\wYVsGOh.exe
  2⤵
  PID:12244
- C:\Windows\System\xdAVxyj.exe
  C:\Windows\System\xdAVxyj.exe
  2⤵
  PID:10628
- C:\Windows\System\QVnnAiz.exe
  C:\Windows\System\QVnnAiz.exe
  2⤵
  PID:9432
- C:\Windows\System\YlVVyUP.exe
  C:\Windows\System\YlVVyUP.exe
  2⤵
  PID:13328
- C:\Windows\System\aZrolws.exe
  C:\Windows\System\aZrolws.exe
  2⤵
  PID:13348
- C:\Windows\System\GIBcPbB.exe
  C:\Windows\System\GIBcPbB.exe
  2⤵
  PID:13464
- C:\Windows\System\uOuCTTc.exe
  C:\Windows\System\uOuCTTc.exe
  2⤵
  PID:12896
- C:\Windows\System\lWvBfSK.exe
  C:\Windows\System\lWvBfSK.exe
  2⤵
  PID:5244
- C:\Windows\System\xtfcPkF.exe
  C:\Windows\System\xtfcPkF.exe
  2⤵
  PID:13056
- C:\Windows\System\sSWhWso.exe
  C:\Windows\System\sSWhWso.exe
  2⤵
  PID:13100
- C:\Windows\System\eDfdntD.exe
  C:\Windows\System\eDfdntD.exe
  2⤵
  PID:13288
- C:\Windows\System\TOfnnnf.exe
  C:\Windows\System\TOfnnnf.exe
  2⤵
  PID:10104
- C:\Windows\System\RIWQskp.exe
  C:\Windows\System\RIWQskp.exe
  2⤵
  PID:736
- C:\Windows\System\IojVaqK.exe
  C:\Windows\System\IojVaqK.exe
  2⤵
  PID:13604
- C:\Windows\System\kdZjtvg.exe
  C:\Windows\System\kdZjtvg.exe
  2⤵
  PID:1584
- C:\Windows\System\BxMWtSa.exe
  C:\Windows\System\BxMWtSa.exe
  2⤵
  PID:13284
- C:\Windows\System\WzePktJ.exe
  C:\Windows\System\WzePktJ.exe
  2⤵
  PID:13156
- C:\Windows\System\FnrLLxy.exe
  C:\Windows\System\FnrLLxy.exe
  2⤵
  PID:9012
- C:\Windows\System\pcSnvxR.exe
  C:\Windows\System\pcSnvxR.exe
  2⤵
  PID:11024
- C:\Windows\System\wYyiLty.exe
  C:\Windows\System\wYyiLty.exe
  2⤵
  PID:13628
- C:\Windows\System\NvrnGgp.exe
  C:\Windows\System\NvrnGgp.exe
  2⤵
  PID:6996
- C:\Windows\System\CRVwesj.exe
  C:\Windows\System\CRVwesj.exe
  2⤵
  PID:11152
- C:\Windows\System\mROQlSc.exe
  C:\Windows\System\mROQlSc.exe
  2⤵
  PID:1136
- C:\Windows\System\kSfhjGN.exe
  C:\Windows\System\kSfhjGN.exe
  2⤵
  PID:11920
- C:\Windows\System\whFKhnn.exe
  C:\Windows\System\whFKhnn.exe
  2⤵
  PID:10516
- C:\Windows\System\wVLmpMd.exe
  C:\Windows\System\wVLmpMd.exe
  2⤵
  PID:10616
- C:\Windows\System\WnJwHCR.exe
  C:\Windows\System\WnJwHCR.exe
  2⤵
  PID:13356
- C:\Windows\System\wAREDKG.exe
  C:\Windows\System\wAREDKG.exe
  2⤵
  PID:13776
- C:\Windows\System\QYatygA.exe
  C:\Windows\System\QYatygA.exe
  2⤵
  PID:13420
- C:\Windows\System\glEmuAL.exe
  C:\Windows\System\glEmuAL.exe
  2⤵
  PID:13452
- C:\Windows\System\FFnoqQZ.exe
  C:\Windows\System\FFnoqQZ.exe
  2⤵
  PID:13488
- C:\Windows\System\flBkTwN.exe
  C:\Windows\System\flBkTwN.exe
  2⤵
  PID:13840
- C:\Windows\System\osuwVgp.exe
  C:\Windows\System\osuwVgp.exe
  2⤵
  PID:13664
- C:\Windows\System\bvAZmbG.exe
  C:\Windows\System\bvAZmbG.exe
  2⤵
  PID:14040
- C:\Windows\System\ouwGKRQ.exe
  C:\Windows\System\ouwGKRQ.exe
  2⤵
  PID:13760
- C:\Windows\System\kmuyOap.exe
  C:\Windows\System\kmuyOap.exe
  2⤵
  PID:13812
- C:\Windows\System\kVEcQaM.exe
  C:\Windows\System\kVEcQaM.exe
  2⤵
  PID:13960
- C:\Windows\System\OtCMqss.exe
  C:\Windows\System\OtCMqss.exe
  2⤵
  PID:14060
- C:\Windows\System\aTRtZRz.exe
  C:\Windows\System\aTRtZRz.exe
  2⤵
  PID:14032
- C:\Windows\System\WILEmCi.exe
  C:\Windows\System\WILEmCi.exe
  2⤵
  PID:14088
- C:\Windows\System\kmExxPI.exe
  C:\Windows\System\kmExxPI.exe
  2⤵
  PID:14112
- C:\Windows\System\XuNgRLc.exe
  C:\Windows\System\XuNgRLc.exe
  2⤵
  PID:14280
- C:\Windows\System\Btwetpx.exe
  C:\Windows\System\Btwetpx.exe
  2⤵
  PID:14232
- C:\Windows\System\jleMpaX.exe
  C:\Windows\System\jleMpaX.exe
  2⤵
  PID:14200
- C:\Windows\System\tJlfZiw.exe
  C:\Windows\System\tJlfZiw.exe
  2⤵
  PID:14172
- C:\Windows\System\CjJYEaS.exe
  C:\Windows\System\CjJYEaS.exe
  2⤵
  PID:14140
- C:\Windows\System\PbUsbGA.exe
  C:\Windows\System\PbUsbGA.exe
  2⤵
  PID:14296
- C:\Windows\System\ZLtXZkG.exe
  C:\Windows\System\ZLtXZkG.exe
  2⤵
  PID:12316
- C:\Windows\System\zRYXTjQ.exe
  C:\Windows\System\zRYXTjQ.exe
  2⤵
  PID:10740
- C:\Windows\System\zqfOhWb.exe
  C:\Windows\System\zqfOhWb.exe
  2⤵
  PID:10788
- C:\Windows\System\hksQnRK.exe
  C:\Windows\System\hksQnRK.exe
  2⤵
  PID:13908
- C:\Windows\System\qTkUosf.exe
  C:\Windows\System\qTkUosf.exe
  2⤵
  PID:3876
- C:\Windows\System\JHEVqmi.exe
  C:\Windows\System\JHEVqmi.exe
  2⤵
  PID:13916
- C:\Windows\System\kyqvjcw.exe
  C:\Windows\System\kyqvjcw.exe
  2⤵
  PID:13632
- C:\Windows\System\buBrleC.exe
  C:\Windows\System\buBrleC.exe
  2⤵
  PID:13920
- C:\Windows\System\dNhliup.exe
  C:\Windows\System\dNhliup.exe
  2⤵
  PID:8344
- C:\Windows\System\fdspDdK.exe
  C:\Windows\System\fdspDdK.exe
  2⤵
  PID:9488
- C:\Windows\System\EDcMWcJ.exe
  C:\Windows\System\EDcMWcJ.exe
  2⤵
  PID:12676
- C:\Windows\System\esobVna.exe
  C:\Windows\System\esobVna.exe
  2⤵
  PID:12772
- C:\Windows\System\QtLAucw.exe
  C:\Windows\System\QtLAucw.exe
  2⤵
  PID:12856
- C:\Windows\System\HRkaOKr.exe
  C:\Windows\System\HRkaOKr.exe
  2⤵
  PID:8224
- C:\Windows\System\QOqVOdB.exe
  C:\Windows\System\QOqVOdB.exe
  2⤵
  PID:5116
- C:\Windows\System\YDibcuK.exe
  C:\Windows\System\YDibcuK.exe
  2⤵
  PID:13076
- C:\Windows\System\ZIBWRDg.exe
  C:\Windows\System\ZIBWRDg.exe
  2⤵
  PID:11420
- C:\Windows\System\LZXWtcV.exe
  C:\Windows\System\LZXWtcV.exe
  2⤵
  PID:10184
- C:\Windows\System\kkbzIlE.exe
  C:\Windows\System\kkbzIlE.exe
  2⤵
  PID:11508
- C:\Windows\System\tApMcBK.exe
  C:\Windows\System\tApMcBK.exe
  2⤵
  PID:11824
- C:\Windows\System\ouMfQlY.exe
  C:\Windows\System\ouMfQlY.exe
  2⤵
  PID:13204
- C:\Windows\System\ZDSRCYV.exe
  C:\Windows\System\ZDSRCYV.exe
  2⤵
  PID:13736
- C:\Windows\System\CJGpBCa.exe
  C:\Windows\System\CJGpBCa.exe
  2⤵
  PID:7856
- C:\Windows\System\NtfCMpJ.exe
  C:\Windows\System\NtfCMpJ.exe
  2⤵
  PID:5424
- C:\Windows\System\ItHNqsT.exe
  C:\Windows\System\ItHNqsT.exe
  2⤵
  PID:10580
- C:\Windows\System\LxAdTnS.exe
  C:\Windows\System\LxAdTnS.exe
  2⤵
  PID:11468
- C:\Windows\System\YWTIzsy.exe
  C:\Windows\System\YWTIzsy.exe
  2⤵
  PID:10284
- C:\Windows\System\CXflpuY.exe
  C:\Windows\System\CXflpuY.exe
  2⤵
  PID:6464
- C:\Windows\System\IiNpNPE.exe
  C:\Windows\System\IiNpNPE.exe
  2⤵
  PID:13696
- C:\Windows\System\auLlTbS.exe
  C:\Windows\System\auLlTbS.exe
  2⤵
  PID:11644
- C:\Windows\System\LBSuGzt.exe
  C:\Windows\System\LBSuGzt.exe
  2⤵
  PID:11596
- C:\Windows\System\HLbEOkJ.exe
  C:\Windows\System\HLbEOkJ.exe
  2⤵
  PID:13756
- C:\Windows\System\PoiTHNv.exe
  C:\Windows\System\PoiTHNv.exe
  2⤵
  PID:12512
- C:\Windows\System\QCQeZhO.exe
  C:\Windows\System\QCQeZhO.exe
  2⤵
  PID:3524
- C:\Windows\System\SfYjQyK.exe
  C:\Windows\System\SfYjQyK.exe
  2⤵
  PID:4892
- C:\Windows\System\oYsUHWT.exe
  C:\Windows\System\oYsUHWT.exe
  2⤵
  PID:13588
- C:\Windows\System\aNprzdc.exe
  C:\Windows\System\aNprzdc.exe
  2⤵
  PID:13036
- C:\Windows\System\yDsTrvF.exe
  C:\Windows\System\yDsTrvF.exe
  2⤵
  PID:14056
- C:\Windows\System\oghboiD.exe
  C:\Windows\System\oghboiD.exe
  2⤵
  PID:3596
- C:\Windows\System\rizQpbu.exe
  C:\Windows\System\rizQpbu.exe
  2⤵
  PID:14108
- C:\Windows\System\wWfyHUh.exe
  C:\Windows\System\wWfyHUh.exe
  2⤵
  PID:12208
- C:\Windows\System\WuCKqpt.exe
  C:\Windows\System\WuCKqpt.exe
  2⤵
  PID:8648
- C:\Windows\System\gZtseFQ.exe
  C:\Windows\System\gZtseFQ.exe
  2⤵
  PID:7192
- C:\Windows\System\gwdPMsm.exe
  C:\Windows\System\gwdPMsm.exe
  2⤵
  PID:4748
- C:\Windows\System\UybFPAi.exe
  C:\Windows\System\UybFPAi.exe
  2⤵
  PID:1596
- C:\Windows\System\fvfTaqQ.exe
  C:\Windows\System\fvfTaqQ.exe
  2⤵
  PID:12556
- C:\Windows\System\nMjvOse.exe
  C:\Windows\System\nMjvOse.exe
  2⤵
  PID:3376
- C:\Windows\System\LDEehdz.exe
  C:\Windows\System\LDEehdz.exe
  2⤵
  PID:11776
- C:\Windows\System\HJJKmFZ.exe
  C:\Windows\System\HJJKmFZ.exe
  2⤵
  PID:11960
- C:\Windows\System\AroepCu.exe
  C:\Windows\System\AroepCu.exe
  2⤵
  PID:11200
- C:\Windows\System\ZomPWhY.exe
  C:\Windows\System\ZomPWhY.exe
  2⤵
  PID:3388
- C:\Windows\System\HuugTfz.exe
  C:\Windows\System\HuugTfz.exe
  2⤵
  PID:4068
- C:\Windows\System\hvHcvFl.exe
  C:\Windows\System\hvHcvFl.exe
  2⤵
  PID:13616
- C:\Windows\System\YTBAoRG.exe
  C:\Windows\System\YTBAoRG.exe
  2⤵
  PID:4584
- C:\Windows\System\vBhzoyX.exe
  C:\Windows\System\vBhzoyX.exe
  2⤵
  PID:1868
- C:\Windows\System\kbkOvdX.exe
  C:\Windows\System\kbkOvdX.exe
  2⤵
  PID:13808
- C:\Windows\System\EJPuEXs.exe
  C:\Windows\System\EJPuEXs.exe
  2⤵
  PID:14284
- C:\Windows\System\BGIkJVw.exe
  C:\Windows\System\BGIkJVw.exe
  2⤵
  PID:12836
- C:\Windows\System\PzFNXAS.exe
  C:\Windows\System\PzFNXAS.exe
  2⤵
  PID:14288
- C:\Windows\System\qLMzAbG.exe
  C:\Windows\System\qLMzAbG.exe
  2⤵
  PID:14132
- C:\Windows\System\KVXLlgP.exe
  C:\Windows\System\KVXLlgP.exe
  2⤵
  PID:4164
- C:\Windows\System\PlXLmDF.exe
  C:\Windows\System\PlXLmDF.exe
  2⤵
  PID:8004
- C:\Windows\System\bgKEOyM.exe
  C:\Windows\System\bgKEOyM.exe
  2⤵
  PID:3360
- C:\Windows\System\Mpdttbg.exe
  C:\Windows\System\Mpdttbg.exe
  2⤵
  PID:10760
- C:\Windows\System\OKPiGdm.exe
  C:\Windows\System\OKPiGdm.exe
  2⤵
  PID:8784
- C:\Windows\System\IjEkuti.exe
  C:\Windows\System\IjEkuti.exe
  2⤵
  PID:1192
- C:\Windows\System\EXKWoPv.exe
  C:\Windows\System\EXKWoPv.exe
  2⤵
  PID:9908
- C:\Windows\System\bQnWhGR.exe
  C:\Windows\System\bQnWhGR.exe
  2⤵
  PID:5056
- C:\Windows\System\pUvBpOE.exe
  C:\Windows\System\pUvBpOE.exe
  2⤵
  PID:12212
- C:\Windows\System\gkSojZt.exe
  C:\Windows\System\gkSojZt.exe
  2⤵
  PID:13980
- C:\Windows\System\UoPWtvc.exe
  C:\Windows\System\UoPWtvc.exe
  2⤵
  PID:1236
- C:\Windows\System\JkJJLDo.exe
  C:\Windows\System\JkJJLDo.exe
  2⤵
  PID:1268
- C:\Windows\System\gwXzIjM.exe
  C:\Windows\System\gwXzIjM.exe
  2⤵
  PID:3724
- C:\Windows\System\LpPdVSF.exe
  C:\Windows\System\LpPdVSF.exe
  2⤵
  PID:7676
- C:\Windows\System\eEBYdqt.exe
  C:\Windows\System\eEBYdqt.exe
  2⤵
  PID:4832
- C:\Windows\System\jrQqXny.exe
  C:\Windows\System\jrQqXny.exe
  2⤵
  PID:8208
- C:\Windows\System\EFbTVZt.exe
  C:\Windows\System\EFbTVZt.exe
  2⤵
  PID:5724
- C:\Windows\System\axBxNBm.exe
  C:\Windows\System\axBxNBm.exe
  2⤵
  PID:1520
- C:\Windows\System\SvfjtHv.exe
  C:\Windows\System\SvfjtHv.exe
  2⤵
  PID:12588
- C:\Windows\System\nivdnJC.exe
  C:\Windows\System\nivdnJC.exe
  2⤵
  PID:9788
- C:\Windows\System\pyjpVXK.exe
  C:\Windows\System\pyjpVXK.exe
  2⤵
  PID:13968
- C:\Windows\System\wIxabZI.exe
  C:\Windows\System\wIxabZI.exe
  2⤵
  PID:12204
- C:\Windows\System\NVJQTMI.exe
  C:\Windows\System\NVJQTMI.exe
  2⤵
  PID:13480
- C:\Windows\System\fXvubaf.exe
  C:\Windows\System\fXvubaf.exe
  2⤵
  PID:12400
- C:\Windows\System\uQGoYly.exe
  C:\Windows\System\uQGoYly.exe
  2⤵
  PID:1012
- C:\Windows\System\aVaGIpv.exe
  C:\Windows\System\aVaGIpv.exe
  2⤵
  PID:4212
- C:\Windows\System\vHuwHfH.exe
  C:\Windows\System\vHuwHfH.exe
  2⤵
  PID:5012
- C:\Windows\System\VeicXJV.exe
  C:\Windows\System\VeicXJV.exe
  2⤵
  PID:7732
- C:\Windows\System\ssJcNqq.exe
  C:\Windows\System\ssJcNqq.exe
  2⤵
  PID:1040

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 12920 -ip 12920
1⤵
PID:11596

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 676 -p 12604 -ip 12604
1⤵
PID:11468

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:11968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_x3k15grq.d4k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x3k15grq.d4k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AbMzguM.exe

Path C:\Windows\System\AbMzguM.exe
Size 2.2MB
SHA256 c0074bc80253efc412e03ac1af8711749544e7083c0f353aab37d09e261bb336
MD5 2170dd9363f9330cc072eac05675096e
SHA1 adbaa4d92bc935f584682430b6eb1dca7da892a7
SHA512 e2debf0c9b7d04bed29f443cbdfc0a95c6ff7289c543cd041cdb0cb87957eeb7fdeb3058f9fb1f85540d93a59c7658b1c9ff0bcc4a92bd720f26f7414a3b630b
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfn:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

AjcIwAS.exe

Path C:\Windows\System\AjcIwAS.exe
Size 2.2MB
SHA256 97315f862f6a272dc00a3cffbbd35b850dfcded57cbd6037c8c75a3079571a1a
MD5 849fb873a0d502b5fa93c223173e0aa0
SHA1 f90263f41b5d292647f06ac03bb023df50c0c133
SHA512 82dc71e7a1069a03364128e046ab6b0cb3916d594a0b3942abf2103b49524ca2d970db16c59f6e1341a8007ca3f4a19a3818b08ef77ad5717ec4f99312a02d9a
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFf2:NABC
MD5 SHA1 SHA512 SSDEEP

Submit Download

IpANPom.exe

Path C:\Windows\System\IpANPom.exe
Size 2.2MB
SHA256 aa37bb773498724b9bcb0181f17bcf3e4c18772ae9ed2851083bfb4c028fc9cd
MD5 3052a4a6da1f1d6be0d7bd30244396e7
SHA1 e5f429b84139af78c7e428ff63b058ac7b1d358a
SHA512 6dd3889ba8be376213080228100a9b19919d4329f51aa833a8a942a14329e9a0dad2b40eca6c7d867bca69eab60c6f12e6000fef59a3df368cf14240cf2b505c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfw:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

JHDXWWl.exe

Path C:\Windows\System\JHDXWWl.exe
Size 2.2MB
SHA256 31e030346e0532b3c213c0aabe3e2ba47c41a615bb2323e778a38d3f7c293dee
MD5 cd1e29b16ff5f8c0736c4d6c3276c5d3
SHA1 711064cebf81246f6c1fb50b2446beba03ebd9a2
SHA512 32936031c55c30b7d42fd2c163cc7ea12ff6e77ec0d89cef0981923c605a77cbcb4f9e0f12c1aadc9088ea88b8940fbd3aa937b0c3fcd76c102d51f355328337
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfs:NAB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

KfRceFR.exe

Path C:\Windows\System\KfRceFR.exe
Size 2.2MB
SHA256 a83d5230e7634541e32764a98a4f88f126896f09a194f2ba9c15a99a4378a9f2
MD5 287941fee8e06afb8a2a99b9901de147
SHA1 52dffee2bd54ece5bf74fa506383bdef1f43bfe4
SHA512 09a9a4c5a16af74d411e87d1d9cb6b0cbf53728ec40cbff87bfde9dbf736c94ee6dbc335846e87a433f71507f88b01f8d34a55795f9fb8e3a030af65fbfb3ddd
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfE:NABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

KhTBrWh.exe

Path C:\Windows\System\KhTBrWh.exe
Size 2.2MB
SHA256 e273ada30674d5ad9a174f91ebb0c511ea6203b53a43088888fd420565d1876a
MD5 5fac981c9e2318370ce17002b235a695
SHA1 f6c6c94460e197958a17f9f43e73d8d5911d8d12
SHA512 2dccd668deb2c32ec629e47d15b1943a6053369a018cd8fc1818b7fedbbfcca2b80c97fb483d1fb485d26c911ae8c44d7d08f2034d25d46db68a90e98ec7dff8
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFf+:NABy
MD5 SHA1 SHA512 SSDEEP

Submit Download

LhFNlHa.exe

Path C:\Windows\System\LhFNlHa.exe
Size 2.2MB
SHA256 1d94dcff5acea111ec9b7a69eb2756899d75829314a5cd809837856070ea82d7
MD5 464b17ee63222aecb673f25427b550f5
SHA1 d950b8258c91e9a51d09a991342a1f080bf2d12b
SHA512 558a9f2fe522d858b26b3b90eb589cc5454b2b559bdb58a4e98d7ee232a6e7c6f9e943f6778268f169c8d49c3876de310886bbbf90b756f7f54f792dc43284f9
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfq:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MbBmwJQ.exe

Path C:\Windows\System\MbBmwJQ.exe
Size 2.2MB
SHA256 3766e3c798bc79e94a87562b6c689e7908be5101160f50303678b04b1a14b91e
MD5 4204e9fd6cbd1808c36069d715b72748
SHA1 66806134bd70be1fcda9d038774dcb98af1b70dd
SHA512 99f5426076c18954fc889bc871c82fd48ba8879fe61ec8957078911b0fa74b189869e6d4209965b46f0e2fa2d50655f59a35b29388780ff9f64b9f5669dba08e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfU:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

PuxnFZj.exe

Path C:\Windows\System\PuxnFZj.exe
Size 2.2MB
SHA256 7ba45c896e53fd681d6abd3950196c6b8614e8fa245d17710bb2b39fd0dc0e52
MD5 a457259c967ef1f8fc7e849668b7ff3e
SHA1 d0b4212dd7cb2810ead9176178f63c05859b8940
SHA512 9764dbe1c134c83e62e6f2d373d57c6ee4c2a72f062bb6830d0eebc8a2e583a56e6b0f084e5f20c29c22bbf395513dac4a72c45fc048f1561c7ac15d33e3e688
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfk:NABY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SqnstPQ.exe

Path C:\Windows\System\SqnstPQ.exe
Size 2.2MB
SHA256 343deef838e0c17c5cd4ade646ab3430f602f4de5ce2506670dd9a96f5c16460
MD5 b281f365761a0bf6aa06d23800e6c802
SHA1 bf9eab08307c2d5f86e5aeac28c637af081b2169
SHA512 c7a88f1686dada1a299deba8ab26bf50d9827fa8fbe66a1d76f4259bda1b78d0ea9676920a63d38efdb7d9e4d9b753bc4a838faa6e45ecd565d32554369004d5
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfB:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmysTFA.exe

Path C:\Windows\System\TmysTFA.exe
Size 2.2MB
SHA256 cbdf20d2b6f9e512515ae1838938a70949f6d152f231431425a9bb7e84c1793a
MD5 ff20b318a01b9e9f05c3eb080c4175d5
SHA1 1813f565789a49067e900ed08c4573373fc7c2be
SHA512 e76ce92041d7684136a5dc5306e8106263d77488ac65bcfb259cd604539b857ee11a8dceaf12415441379e5458bf8bca8a8375e91735edce0bd2a52c56b40f34
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfBu:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

WUjEohq.exe

Path C:\Windows\System\WUjEohq.exe
Size 2.2MB
SHA256 623d92ac89fcd1545a2c6c4ab95480f425e8e45a999b7745f264277674fd19e8
MD5 873cb0ca6df28a7c11d47d2027c7b88f
SHA1 dec48fb62cddd6eb9998915c337eaa12cd4849bf
SHA512 845a8c48200a5af9166ddef1984ac0ce4dd4fcc0d89a527b175d2e58cf4e89d5a31d9484a97f9f8ca1798fc2c016d6d066629d1a7d89b36b89c77c85e7e70ef7
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfT:NABP
MD5 SHA1 SHA512 SSDEEP

Submit Download

XVGBzyQ.exe

Path C:\Windows\System\XVGBzyQ.exe
Size 2.2MB
SHA256 a78c26c8b4368931fc71336f1935be5e2a53293e68ffa93bffc99368c7fe8a1e
MD5 ad997b5d79ead7a34c808a9b600cc53d
SHA1 69dc4d928331a050614346b3b7bea37084781878
SHA512 87d0fb21c0e021c5338ebd4d417d18962a17838eaeab6f2352bf5155364c96e181393019276f8e0956fcbe1fbcfb5d9ca7c01462f9c6618a1d31ac1d57d851c2
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfa:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

YlAQWES.exe

Path C:\Windows\System\YlAQWES.exe
Size 2.2MB
SHA256 05121c2530641005bdb6544d38b7395dc794a61e70e236ddc7615e7738838b92
MD5 30cd1fdfd18b22df896054e1be1ffdf9
SHA1 d90061c2582318fa40a29c90f8e4e9f56a9f3df5
SHA512 ae57223f96b17a00179a09eb544573ff8c5c9d0de788f135ec7c14a7cad828123cb87ac446b11ce8ee48f45b6e0d6e241353c880505e5cfe2c2c138f1ac29471
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfA:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

aKocuNw.exe

Path C:\Windows\System\aKocuNw.exe
Size 2.2MB
SHA256 68f63494a28a25615849925d3a4307fde8444fb71189240e675292d50145aa1e
MD5 dba46f2a5c30a1606c0547f48b328c1a
SHA1 98509166daead530cfb8ac709995389b7ebb3104
SHA512 66c942a5ba67103a10487200a84839880266406e68b4ba7cb71b7aaaad71a5d6e769070f9ab13e1a62808492b04f5b9fbe716b301651a05fbfd58a3d3661cd18
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfe:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

bOMaXNZ.exe

Path C:\Windows\System\bOMaXNZ.exe
Size 2.2MB
SHA256 5d02f9924eafa08405ffeb5d1ad300aec012c748af73d09dfca6cdab19a784e7
MD5 b5fbaa7f57f5dd7e2d5e57b4ac13b610
SHA1 e6785efadeab83519a5a53acf1302e6d542fe471
SHA512 d8335609b58a39a6bdcb010a631f95ed0e489e05cd328b0de7e6743f37b708d8f13496192c62803cb2ec4c14474aa4bbc2841bd866c4c0244bc4b6917d1d5895
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFf8:NABg
MD5 SHA1 SHA512 SSDEEP

Submit Download

chwcrwv.exe

Path C:\Windows\System\chwcrwv.exe
Size 2.2MB
SHA256 3996cd14252e5b1b6b5ac048945b4ae5fb168dc4e42e181fe8aef058860934ce
MD5 5e3302ebf14d32d1d1bc3f374ea14add
SHA1 6d78f22c57b1299047135820835a0f1fdea40db2
SHA512 31329d2f4111a5e86bc46d2a385cb7a15c3b6eb9fc4c8c2396ae57d91fe57402d4c855e3b4fac6c8aae3ee4fd94dd5352ed4f58f7c00373e73bd5c749c42d990
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfp:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ctiIcki.exe

Path C:\Windows\System\ctiIcki.exe
Size 2.2MB
SHA256 1d50654ba6b1c7d2205c06e961c684e84d2ce881a72b8fc60773e2807d48364c
MD5 07f4889c9c36cf994ca6c0e5b5b1f3f2
SHA1 dcf860e4535a495c61cb64bd51ef38dab2c6cca2
SHA512 286b590fe1ae3f8f61ce210cd744f3e4b1711209e3d83dc131388b3be3c44bfd3c1c064d1f2aad71fe85d94ad8792b7346df954f319315e44ce88a78476e4572
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfI:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

eOUdoci.exe

Path C:\Windows\System\eOUdoci.exe
Size 2.2MB
SHA256 81656acb8670464d90b6fe136a9ab41c4d7b05c32ee09be3cecda64c7f73f8b4
MD5 074d426f7f7634aea9da23daa6ed3950
SHA1 36c4c8580204f9ff632cc30a3dbd352f169fb553
SHA512 00e58db1d2ddd856f76bcfbf1b53b6ce9166704035332e60177afe30a1da63c3d2c8f07a5135f9162a80f8bb0a01373647efdeb96deffca0fb09c25e610c6e73
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfq:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

fXtfSXS.exe

Path C:\Windows\System\fXtfSXS.exe
Size 2.2MB
SHA256 71b63c72426e4f32e088236ae79991de8d8c3c37f9afe2401b1512ab95855dd5
MD5 1fb61919621080313f4f1ba5ce20db70
SHA1 57ab6fe1ade82237ed5a92fc7f3b7eeb269a985a
SHA512 62cf8dcd8290a977b0ddb9e476b4ac7ffeb3bde998dc9cf57d06f565ca5bfc0287508fe6d2765d4bff0cfed1db1a113f8e868c343bf5c1c51fb3a00770021554
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFft:NABx
MD5 SHA1 SHA512 SSDEEP

Submit Download

foGHpih.exe

Path C:\Windows\System\foGHpih.exe
Size 2.2MB
SHA256 b3a1c3f3d3bb607e86226d5eb6f96e2b569c2082712916f924603fb07acf2bd5
MD5 4a65e6c101debf5d2b0c4b3548c32f15
SHA1 c1a4e7baad723e08e9c42d36722944f15cbf4da9
SHA512 82394eae75729449d2c4c040d6ccd1ffa73a143360c4d1f1ebc94eaa5892a4221f88bb6cc64612e92dd3b2d3dc49eaaebda3c18294af125e2fc8f1c2b0a245ad
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfb:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

gfHSVZk.exe

Path C:\Windows\System\gfHSVZk.exe
Size 2.2MB
SHA256 ea21363551469a8aca742fa41c158958533502ac5bbd52c665f3a681b0d1ab20
MD5 f6e467f11dcfcecb85146decadce9f64
SHA1 99bc2911ea70c95e8923800c1972294010ff203f
SHA512 b303cab82f021c53c4edc93b823d12ee8d5892a82f0c89d8a943afe34ef7b57b28f8a6c8c5d7cbe4a7763b4c19063e24ca60b9a1a10c8e13b21438f23cacf025
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfM:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

grTPOmq.exe

Path C:\Windows\System\grTPOmq.exe
Size 2.2MB
SHA256 825b78e5c75f04ab71afd439ebbd1f3bfeaee4480438ed0b79d8ecdac421639a
MD5 b44ff38ea1c06aed4c1c351c568a122c
SHA1 a0911448aa2df8c405417788ea8e9b53f32cbabe
SHA512 869ce3c9774dd55390e5885f157c276dc4fd82369fcc79993e455ba6008ad3f672de10bdccacc2c0213cbc210060124cfe577dcb9c3b440e53ebb42093bad920
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfN:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hHaXavW.exe

Path C:\Windows\System\hHaXavW.exe
Size 2.2MB
SHA256 7153bc605677f62696a2181548be1e42fd040b6915d4bd15d902861ad87be42e
MD5 b8c8402c779afa52b7bf5735e2747be3
SHA1 28a87f03f731807f35455aacdbaa3531e5f54eef
SHA512 fafb90ef0556c51eab340a79bf17f283d8b53e385180991e91b33df36283334aabfb58464e07a5061e5d9767682a1d7503d3327d0978f4928be3ae272a6ffb1e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfs:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hWhfvyd.exe

Path C:\Windows\System\hWhfvyd.exe
Size 2.2MB
SHA256 7822da63d9dd329a5637b7813adb639cdec119f5802461ea410487a32b1f1b5d
MD5 a2580ddee3fd308d992d94d40d6863cc
SHA1 ea145070adda03f904d5c882700709ff8fb47833
SHA512 ca85bc02f9a6c8094d0a6ac12a7ce048f473d63cb35aadc63215da4c147df3cc796ab90d6e50b0b0e8da5730a0f11a38b10c000fb902eaf83f43cf207600d15e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfh:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

iAeqpUJ.exe

Path C:\Windows\System\iAeqpUJ.exe
Size 2.2MB
SHA256 30828c15889babd0932c19580e5866632e44dcad35a66d61e7cddd8321237b42
MD5 801dfc2f0a83986686df2e2beeceeecc
SHA1 64588739891a7acea3adef6c6a40892b9dd1f222
SHA512 9823995efc7674d61cfc31534c3fe67b8d1165b989a667481727488fceef678c33294d18352f9a14f91d3674ce669c4009b3f0c5c7311357edb6e2fce92b1000
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFf7:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ilWOHdI.exe

Path C:\Windows\System\ilWOHdI.exe
Size 2.2MB
SHA256 48ea4ed66eb9c5fbe104360bfc69a479682bea97a810805b4621d8572bc3d46d
MD5 5a88a5d3ba3b39f23c3edc25b95b0e20
SHA1 2a5b16737213cfb350bf2c07c2077207dca17545
SHA512 313cce67614a831f528f6b95ce6f1bd325de301a222e4a47b079269755a40657cb1b5fbcf0b3a35430a31529ed2735a4fecae3aa63ade2d0fa6740da8fdfc101
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfUhR:NAB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjtttlu.exe

Path C:\Windows\System\jjtttlu.exe
Size 2.2MB
SHA256 f871d154eebd836d2303edb05810157826e114d6316da22c603cbe627e479805
MD5 179cbaba5b30a00aeb12786589445523
SHA1 84c3d8b7cfd664d5982c71481a220822ff1f8365
SHA512 3b4d2801d3a6714f8866429bc78f4a491471a9de56444ffb2e2f93a68d8d78fee24883fd6417b53fdb70228bdf8488e8c2fe25cedc3660108f6f5acfd26b4816
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfc:NABg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lThqQaz.exe

Path C:\Windows\System\lThqQaz.exe
Size 2.2MB
SHA256 78fab8181a720ee5b90c515cd7f1a58a94bd03d55ce6e22647771db547e4f5fc
MD5 f752d1857da0fc32a1a072eb3275a5e1
SHA1 ac799c0588aa4a17f593893faa4c12506a54a3cf
SHA512 a6976204eeb19272ec087b0b848fdf92b3f3508a7982fe4a18159ccdd39d4a4a717deb0a9f3934e3a960bfcbdf18f1c6d48157dd7919fa1bc14d8290cae728ab
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfN:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lpZFUoW.exe

Path C:\Windows\System\lpZFUoW.exe
Size 2.2MB
SHA256 19826b2d1c35604dfaa94e6de7e5228871067fa7cbe6218a68dbb9837be3545b
MD5 a6534c461c4fa52ee783132b0be44c4c
SHA1 c86e5ba57289cc26a21f5cfab69d8d577da17891
SHA512 e15d4ea437aaab5f375d8c9d7fe37897876fea4c77850eacd8ef7293d9acdcdc0868d02e94cc38830804dab9e3cbb75aa34268f549eec1b0e52b380c0f5b20f6
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfV:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mHMIIGq.exe

Path C:\Windows\System\mHMIIGq.exe
Size 2.2MB
SHA256 fadc1b90455b9745e722cf9ef393c9ca0af24688fc67abdb4a60dd3ea4a7a453
MD5 2d3aee89000fb5b3f53a2321f34013ea
SHA1 ef57f1f70a61dfa2cddbc1b92c5ed327bbbbceb8
SHA512 4ea40beeb60077c84dc65795ca2be6923e519ab73bfdbb59e2492cd576f2d0581807ad7b6a62f032b4b9315568faa9e48595d930cb4015406aa2536f3aaf4738
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfU:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nJQDoSR.exe

Path C:\Windows\System\nJQDoSR.exe
Size 2.2MB
SHA256 ee693644bd07fc054b5c15425baebd3dc78d61c126762b32c121396d77865a49
MD5 e3899c61558afce60435765d025a926e
SHA1 9470d8bd07a8d0bb90f50dcb3ae61e6e759e186c
SHA512 17500e247383190b3fa50ead48da3e54adbce12d00c14973a1a109c1dc69bd6b1c7b7e83881df340c0e71c31ad1ed7fd9ffbcc2cd357bff7d3afceac9331b994
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfY:NAB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

oUiWxAP.exe

Path C:\Windows\System\oUiWxAP.exe
Size 2.2MB
SHA256 e7ff67aa7d0497a2938560a02fc026ae1bc8f219c18bcd927a50bb33ed72379b
MD5 15e995b4dbcf59692e209054105f908b
SHA1 bc6f21877838339afb5d15c2354829adf064b9be
SHA512 fa04d9e07ed5b3fa860357620869939d46c14ae75f5d129dc7345bcb155e2d7479c2d4937b011c189e3f755f14efd06f16dc89ac7285f63bb90ae08fe86c4c73
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfp:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

pteGyGS.exe

Path C:\Windows\System\pteGyGS.exe
Size 8B
SHA256 fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01
MD5 3f9cfe8a165fbe5ed357bf4fb6550d1a
SHA1 d1f76cef8b11f404ce3021901f1968e523167625
SHA512 7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce
MD5 SHA1 SHA512

Submit Download

rmwsewN.exe

Path C:\Windows\System\rmwsewN.exe
Size 2.2MB
SHA256 94e18c4c8227d9388a2887a91fbd11efb17de5e779a32e052dc4ace7cdb473b5
MD5 da6f176359336f064e250bbc449236d2
SHA1 aae51b39d33246dfb03c866337fed1f80f44b7b7
SHA512 72564bf33c061cc98d5072d1a691e689b30d876fc7879e35edbf4f03036f92000b4ffb1ce88c5c0ebb0e9661272bdd641fa0987ada9c15ecfa7d2d05d0a73587
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfd:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

snejVTk.exe

Path C:\Windows\System\snejVTk.exe
Size 2.2MB
SHA256 48dbc62cf4a75565c5ae35fdcc78b230fe74d977dee0b467f19cd572abdd2e1c
MD5 eeed57a7d5953590f549f6e7b16a7f5d
SHA1 f77c4287addabbf8509b9195ef3e206594441ecc
SHA512 9f63494f1e888c93908b773847d8fd0f21e043ea0feeabc801f6b6b99adbae7af7b105419408f483496176ed5ed67bc2faa5042a287c015ce744c6fa03809ac7
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfQy:NABD
MD5 SHA1 SHA512 SSDEEP

Submit Download

tifNSVD.exe

Path C:\Windows\System\tifNSVD.exe
Size 2.2MB
SHA256 9a26e34505c94e296786306f49682d6c5c5882decda60202c4d1cd5bae3dd64e
MD5 e245e2220a828ff14d541e6f4d33a419
SHA1 6ada4c8bfdae1bff2421570898bf4deb88753775
SHA512 d1002c4abb587d237ea71b514d31d97dca3a19e24f5f1535336b989966b8ae9a930af641a720a31ec33bf6a066233cc1e3478468204a59a47492110566b893e4
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFf9:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tzIaSiE.exe

Path C:\Windows\System\tzIaSiE.exe
Size 2.2MB
SHA256 652c282e8b8121b04b4e689d6c94533a055ca601f2e7c5f706aa9fcae9615112
MD5 668a928e7cddc8cf24ebcbd358c17138
SHA1 b21a584373ca655bf7aaf281f05f8bfbbe09622d
SHA512 8c0c5c71afdda6a315ac141c2e3dc8d66e0e9a59315e8bda049e2094046eb39f65cae005cfa86184981bdd6b7fd65ae6a847b664dfeaf1104ca677743fd05f90
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfH:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

utBkqKW.exe

Path C:\Windows\System\utBkqKW.exe
Size 2.2MB
SHA256 a2f9b0d078547c797bcf6bfcfb4b460bb3343ca179aa8036e5804f4004d31eb5
MD5 c589cda39016a671e645a549fdfd4768
SHA1 33a8fc99398a3cea09fbbb8c7fa418b7d7af90fd
SHA512 abff09a6551224754b0826877fbd69a0bbfa781ca0145e10d2c71d66f34c3bb2ea8d63a48974f2e5956ed65e6da772fb948296640a87d34988b3d3ad23cd412c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfH:NABD
MD5 SHA1 SHA512 SSDEEP

Submit Download

yJItVmc.exe

Path C:\Windows\System\yJItVmc.exe
Size 2.2MB
SHA256 c6be85cf3d65bb761ab8c36656d806bab5f1d75eaa81904800cbbcff09b60fd1
MD5 8fa949504cf0a402c23558e65000dd7d
SHA1 7c7ff7d52ae4cb16f30effd95f4082f846059795
SHA512 dd0648e11d6069edd7eb36110a77f7992a1ca7e5e1d8280c03ecf81770b865f8ff6668ad80cb790e61d265ba4041b715c0afe455a8a428a7eef063b3b0e75217
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfo:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

yprUPdJ.exe

Path C:\Windows\System\yprUPdJ.exe
Size 2.2MB
SHA256 e7e362d137f97f20e8dd23656cec850ad594bd81b9b1c1652927b007c0552a1f
MD5 f6dfc9721b1786dfd14756173be1ca48
SHA1 5c44f22021ae57840c5b807822c8e2abad7b2d17
SHA512 cfb3d320002cef6efc1ce4d18d935e7b40f07840ec63c38ec5ddddddeb4b0be296c8e1e17898d9c976227b6bf47097c4ae4e987e70f896e193463c3687f58b2a
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMtfFfQ:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/636-877-0x00007FF642890000-0x00007FF642C82000-memory.dmp

Download

memory/1200-629-0x00007FF77CA20000-0x00007FF77CE12000-memory.dmp

Download

memory/1652-395-0x00007FF64F4F0000-0x00007FF64F8E2000-memory.dmp

Download

memory/1744-1055-0x00007FF715520000-0x00007FF715912000-memory.dmp

Download

memory/1912-354-0x00007FF6A49C0000-0x00007FF6A4DB2000-memory.dmp

Download

memory/2180-553-0x00007FF7FBAF0000-0x00007FF7FBEE2000-memory.dmp

Download

memory/2304-394-0x00007FF650B70000-0x00007FF650F62000-memory.dmp

Download

memory/2656-1525-0x00007FF6EA000000-0x00007FF6EA3F2000-memory.dmp

Download

memory/2696-449-0x00007FF7675B0000-0x00007FF7679A2000-memory.dmp

Download

memory/2968-226-0x00007FF74C3F0000-0x00007FF74C7E2000-memory.dmp

Download

memory/3008-1214-0x00007FF6C66F0000-0x00007FF6C6AE2000-memory.dmp

Download

memory/3380-551-0x00007FF63FF80000-0x00007FF640372000-memory.dmp

Download

memory/3476-1053-0x00007FF66FFB0000-0x00007FF6703A2000-memory.dmp

Download

memory/3668-723-0x00007FF6FF620000-0x00007FF6FFA12000-memory.dmp

Download

memory/3712-248-0x00007FF75CD80000-0x00007FF75D172000-memory.dmp

Download

memory/3736-282-0x00007FF741640000-0x00007FF741A32000-memory.dmp

Download

memory/3892-1528-0x00007FF6503F0000-0x00007FF6507E2000-memory.dmp

Download

memory/4040-4830-0x00007FF6D61D0000-0x00007FF6D65C2000-memory.dmp

Download

memory/4040-8-0x00007FF6D61D0000-0x00007FF6D65C2000-memory.dmp

Download

memory/4328-283-0x00007FF70C830000-0x00007FF70CC22000-memory.dmp

Download

memory/4540-351-0x00007FF63E170000-0x00007FF63E562000-memory.dmp

Download

memory/4568-1054-0x00007FF7187A0000-0x00007FF718B92000-memory.dmp

Download

memory/4632-28-0x00007FF7E48C0000-0x00007FF7E4CB2000-memory.dmp

Download

memory/4744-110-0x00007FF98D980000-0x00007FF98E441000-memory.dmp

Download

memory/4744-1957-0x00007FF98D980000-0x00007FF98E441000-memory.dmp

Download

memory/4744-195-0x00007FF98D980000-0x00007FF98E441000-memory.dmp

Download

memory/4744-324-0x0000015A615B0000-0x0000015A615D2000-memory.dmp

Download

memory/4744-36-0x00007FF98D983000-0x00007FF98D985000-memory.dmp

Download

memory/4848-1530-0x00007FF647030000-0x00007FF647422000-memory.dmp

Download

memory/4908-727-0x00007FF7B0F30000-0x00007FF7B1322000-memory.dmp

Download

memory/4968-1-0x0000021388120000-0x0000021388130000-memory.dmp

Download

memory/4968-0-0x00007FF66B290000-0x00007FF66B682000-memory.dmp

Download

memory/4968-4638-0x00007FF66B290000-0x00007FF66B682000-memory.dmp

Download