xmrig | c80ec55de858feca9ac05feed4b639014d5d73baaa8fc3d33fcde8134fe67072

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
Size 1.8MB
Sample240610-th5wpssekh
SHA256 c80ec55de858feca9ac05feed4b639014d5d73baaa8fc3d33fcde8134fe67072
MD5 9b3f07e3f2fbbb72ead65bb9e549afc5
SHA1 6ab2c57ef4240817835ccfb1212e9c750d95df09
SHA512 d6e4dd62f9b45d766c5d00e21a2673ac248620dbf37608fd6653d3b4de3c92396678cfb6b4a82d36717845c50414c2ff75e7b2f0dac7d48ef994c23dac065621
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0X4:NABY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral2/memory/4492-350-0x00007FF66A840000-0x00007FF66AC32000-memory.dmp	xmrig
behavioral2/memory/2888-353-0x00007FF7976A0000-0x00007FF797A92000-memory.dmp	xmrig
behavioral2/memory/1820-406-0x00007FF73A050000-0x00007FF73A442000-memory.dmp	xmrig
behavioral2/memory/4984-471-0x00007FF666040000-0x00007FF666432000-memory.dmp	xmrig
behavioral2/memory/4944-470-0x00007FF79B220000-0x00007FF79B612000-memory.dmp	xmrig
behavioral2/memory/3340-469-0x00007FF7CEF00000-0x00007FF7CF2F2000-memory.dmp	xmrig
behavioral2/memory/1420-468-0x00007FF791A50000-0x00007FF791E42000-memory.dmp	xmrig
behavioral2/memory/3692-467-0x00007FF78BB70000-0x00007FF78BF62000-memory.dmp	xmrig
behavioral2/memory/5032-441-0x00007FF691B90000-0x00007FF691F82000-memory.dmp	xmrig
behavioral2/memory/4184-352-0x00007FF6822A0000-0x00007FF682692000-memory.dmp	xmrig
behavioral2/memory/4364-341-0x00007FF7DD180000-0x00007FF7DD572000-memory.dmp	xmrig
behavioral2/memory/1948-297-0x00007FF7DB470000-0x00007FF7DB862000-memory.dmp	xmrig
behavioral2/memory/4992-286-0x00007FF64B290000-0x00007FF64B682000-memory.dmp	xmrig
behavioral2/memory/1156-285-0x00007FF7BF0B0000-0x00007FF7BF4A2000-memory.dmp	xmrig
behavioral2/memory/2132-265-0x00007FF755DF0000-0x00007FF7561E2000-memory.dmp	xmrig
behavioral2/memory/1428-250-0x00007FF7A2B80000-0x00007FF7A2F72000-memory.dmp	xmrig
behavioral2/memory/3108-209-0x00007FF7F4F40000-0x00007FF7F5332000-memory.dmp	xmrig
behavioral2/memory/900-167-0x00007FF7F4BC0000-0x00007FF7F4FB2000-memory.dmp	xmrig
behavioral2/memory/2500-127-0x00007FF746D80000-0x00007FF747172000-memory.dmp	xmrig
behavioral2/memory/4004-123-0x00007FF7621B0000-0x00007FF7625A2000-memory.dmp	xmrig
behavioral2/memory/4852-36-0x00007FF628180000-0x00007FF628572000-memory.dmp	xmrig
behavioral2/memory/5036-4643-0x00007FF683FB0000-0x00007FF6843A2000-memory.dmp	xmrig
behavioral2/memory/4716-4646-0x00007FF6B61E0000-0x00007FF6B65D2000-memory.dmp	xmrig
behavioral2/memory/4852-5057-0x00007FF628180000-0x00007FF628572000-memory.dmp	xmrig
behavioral2/memory/4944-5139-0x00007FF79B220000-0x00007FF79B612000-memory.dmp	xmrig
behavioral2/memory/4716-5156-0x00007FF6B61E0000-0x00007FF6B65D2000-memory.dmp	xmrig
behavioral2/memory/4364-5264-0x00007FF7DD180000-0x00007FF7DD572000-memory.dmp	xmrig
behavioral2/memory/2132-5147-0x00007FF755DF0000-0x00007FF7561E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2288	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
384	MOkijRh.exe
4852	MwcisGQ.exe
3692	MyAHBKY.exe
5036	BYsmNVq.exe
4716	YebuTcC.exe
4004	uoxAEas.exe
2500	SIMPIKU.exe
1420	TSuDctp.exe
900	wlBqmvq.exe
3108	vJzfeqS.exe
1428	roPtSfA.exe
3340	BYjbCvf.exe
4944	qWLldgg.exe
2132	ZUBqeyF.exe
1156	SOJQfgA.exe
4992	rJeXhDy.exe
1948	zpPODNb.exe
4364	neCgNuC.exe
4984	fwNUibj.exe
4492	yjpmMYh.exe
4184	drwkmRQ.exe
2888	QqEURrd.exe
1820	tjdgKmr.exe
5032	VHaCbbJ.exe
4556	oPqzZNq.exe
3172	pDKaDsg.exe
1892	qpHMcPc.exe
4548	HSYcCJK.exe
3480	OuipIOh.exe
4704	KPwVhPj.exe
1432	dyGfLLq.exe
1112	YAFopVX.exe
988	kobszTj.exe
2968	qupQgmJ.exe
4844	hZqxFmk.exe
3016	ULkxCep.exe
2756	aRbqEuu.exe
400	nsZIBLS.exe
4976	nvYwdBw.exe
1356	qYeIVub.exe
3140	TeXvTpK.exe
444	kwILHMB.exe
3404	ODvIzQd.exe
3824	DwMnagd.exe
756	SHKDIbE.exe
3660	zHjIoRq.exe
1744	kMSNfXe.exe
4412	iWDaoSC.exe
3392	EdTBBqg.exe
2308	wQcmFir.exe
4032	lDggMae.exe
2208	PpmagCn.exe
3092	XaqtBZL.exe
4464	rbTkYYx.exe
4316	GkiKvTK.exe
528	SqyrNkv.exe
2460	hMAgnEq.exe
4008	heEFYiQ.exe
1872	HhjwcNZ.exe
4888	SfiYecV.exe
836	cTpofoq.exe
1028	hjSZbQc.exe
1928	WDbBQEb.exe
5024	muLPjew.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2248-0-0x00007FF737150000-0x00007FF737542000-memory.dmp	upx
behavioral2/files/0x0007000000023414-6.dat	upx
behavioral2/files/0x0007000000023413-9.dat	upx
behavioral2/files/0x0007000000023418-30.dat	upx
behavioral2/files/0x000700000002341a-52.dat	upx
behavioral2/files/0x0007000000023420-76.dat	upx
behavioral2/files/0x000700000002341f-134.dat	upx
behavioral2/memory/4492-350-0x00007FF66A840000-0x00007FF66AC32000-memory.dmp	upx
behavioral2/memory/2888-353-0x00007FF7976A0000-0x00007FF797A92000-memory.dmp	upx
behavioral2/memory/1820-406-0x00007FF73A050000-0x00007FF73A442000-memory.dmp	upx
behavioral2/memory/4984-471-0x00007FF666040000-0x00007FF666432000-memory.dmp	upx
behavioral2/memory/4944-470-0x00007FF79B220000-0x00007FF79B612000-memory.dmp	upx
behavioral2/memory/3340-469-0x00007FF7CEF00000-0x00007FF7CF2F2000-memory.dmp	upx
behavioral2/memory/1420-468-0x00007FF791A50000-0x00007FF791E42000-memory.dmp	upx
behavioral2/memory/3692-467-0x00007FF78BB70000-0x00007FF78BF62000-memory.dmp	upx
behavioral2/memory/5032-441-0x00007FF691B90000-0x00007FF691F82000-memory.dmp	upx
behavioral2/memory/4184-352-0x00007FF6822A0000-0x00007FF682692000-memory.dmp	upx
behavioral2/memory/4364-341-0x00007FF7DD180000-0x00007FF7DD572000-memory.dmp	upx
behavioral2/memory/1948-297-0x00007FF7DB470000-0x00007FF7DB862000-memory.dmp	upx
behavioral2/memory/4992-286-0x00007FF64B290000-0x00007FF64B682000-memory.dmp	upx
behavioral2/memory/1156-285-0x00007FF7BF0B0000-0x00007FF7BF4A2000-memory.dmp	upx
behavioral2/memory/2132-265-0x00007FF755DF0000-0x00007FF7561E2000-memory.dmp	upx
behavioral2/memory/1428-250-0x00007FF7A2B80000-0x00007FF7A2F72000-memory.dmp	upx
behavioral2/memory/3108-209-0x00007FF7F4F40000-0x00007FF7F5332000-memory.dmp	upx
behavioral2/files/0x0007000000023438-192.dat	upx
behavioral2/files/0x0007000000023439-191.dat	upx
behavioral2/files/0x0007000000023437-186.dat	upx
behavioral2/files/0x0007000000023427-182.dat	upx
behavioral2/files/0x0007000000023436-181.dat	upx
behavioral2/files/0x000700000002342d-180.dat	upx
behavioral2/files/0x0007000000023426-178.dat	upx
behavioral2/files/0x0007000000023435-177.dat	upx
behavioral2/files/0x0007000000023434-176.dat	upx
behavioral2/files/0x0007000000023424-170.dat	upx
behavioral2/memory/900-167-0x00007FF7F4BC0000-0x00007FF7F4FB2000-memory.dmp	upx
behavioral2/files/0x0007000000023433-161.dat	upx
behavioral2/files/0x0007000000023432-159.dat	upx
behavioral2/files/0x0007000000023430-157.dat	upx
behavioral2/files/0x0007000000023421-150.dat	upx
behavioral2/files/0x000700000002342f-149.dat	upx
behavioral2/files/0x000700000002342e-143.dat	upx
behavioral2/files/0x000700000002342c-133.dat	upx
behavioral2/files/0x0007000000023425-171.dat	upx
behavioral2/memory/2500-127-0x00007FF746D80000-0x00007FF747172000-memory.dmp	upx
behavioral2/files/0x000700000002341e-126.dat	upx
behavioral2/memory/4004-123-0x00007FF7621B0000-0x00007FF7625A2000-memory.dmp	upx
behavioral2/files/0x000700000002342a-122.dat	upx
behavioral2/files/0x0007000000023429-118.dat	upx
behavioral2/files/0x0007000000023431-158.dat	upx
behavioral2/files/0x0007000000023422-115.dat	upx
behavioral2/files/0x0007000000023428-114.dat	upx
behavioral2/files/0x000700000002341c-110.dat	upx
behavioral2/files/0x000700000002342b-131.dat	upx
behavioral2/memory/4716-90-0x00007FF6B61E0000-0x00007FF6B65D2000-memory.dmp	upx
behavioral2/files/0x0007000000023415-82.dat	upx
behavioral2/files/0x000700000002341b-105.dat	upx
behavioral2/files/0x0007000000023419-74.dat	upx
behavioral2/files/0x0007000000023423-89.dat	upx
behavioral2/files/0x000700000002341d-61.dat	upx
behavioral2/files/0x0007000000023417-47.dat	upx
behavioral2/files/0x0007000000023416-68.dat	upx
behavioral2/memory/5036-64-0x00007FF683FB0000-0x00007FF6843A2000-memory.dmp	upx
behavioral2/memory/384-29-0x00007FF71B9A0000-0x00007FF71BD92000-memory.dmp	upx
behavioral2/memory/4852-36-0x00007FF628180000-0x00007FF628572000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AxsSXBb.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\ZMwkRYm.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\yoUtWwL.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\PHDSZZr.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\zRcohMj.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\GXAIYbH.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\cjnlZhJ.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\mHNrHYb.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\csjuOhK.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\Mjrkdiu.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\XrCoTOP.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\eEhGewr.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\AHVzLhb.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\MtTUTmR.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\SatONJn.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\dFzvrYY.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\dLsAulF.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\eTdWSsF.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\WBKgxGt.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\UmDjFTS.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\rbdZBlX.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\QphnUrG.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\UMsHcxH.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\CbGfvVG.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\ecSPMIh.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\HWvReBF.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\EZoOFIO.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\LLPYlNV.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\aJKejDd.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\lWIRlwV.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\QUrBuPW.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\OAdHgjn.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\UXShkkI.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\mFeagbA.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\lpGyMrs.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\zKSettS.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\sEyZsbp.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\QQsgZtG.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\zPbQYRw.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\aDgLftW.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\xnVGoip.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\xHAvUzD.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\qDGYkFr.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\NhsAiec.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\hAesEVe.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\NDkdCed.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\BovRFko.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\asgixjp.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\eEZqRsV.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\ADOFFET.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\puFNejF.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\ORCbGfA.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\SeZFdvy.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\cUyvNFk.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\nIHeLBM.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\KzZzgZd.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\ubNrndx.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\tQOpaQe.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\pnVaDVl.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\jOXIyGY.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\RgUFRwk.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\FgDHNKy.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\vOzUJCd.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
File created	C:\Windows\System\wYXGaPe.exe	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
Token: SeDebugPrivilege	2288	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2288	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	85
PID 2248 wrote to memory of 2288	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	85
PID 2248 wrote to memory of 4852	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	86
PID 2248 wrote to memory of 4852	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	86
PID 2248 wrote to memory of 384	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	87
PID 2248 wrote to memory of 384	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	87
PID 2248 wrote to memory of 3692	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	88
PID 2248 wrote to memory of 3692	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	88
PID 2248 wrote to memory of 5036	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	89
PID 2248 wrote to memory of 5036	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	89
PID 2248 wrote to memory of 4716	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	90
PID 2248 wrote to memory of 4716	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	90
PID 2248 wrote to memory of 4004	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	91
PID 2248 wrote to memory of 4004	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	91
PID 2248 wrote to memory of 2500	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	92
PID 2248 wrote to memory of 2500	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	92
PID 2248 wrote to memory of 1420	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	93
PID 2248 wrote to memory of 1420	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	93
PID 2248 wrote to memory of 900	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	94
PID 2248 wrote to memory of 900	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	94
PID 2248 wrote to memory of 3108	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	95
PID 2248 wrote to memory of 3108	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	95
PID 2248 wrote to memory of 1428	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	96
PID 2248 wrote to memory of 1428	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	96
PID 2248 wrote to memory of 3340	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	97
PID 2248 wrote to memory of 3340	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	97
PID 2248 wrote to memory of 4944	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	98
PID 2248 wrote to memory of 4944	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	98
PID 2248 wrote to memory of 2132	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	99
PID 2248 wrote to memory of 2132	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	99
PID 2248 wrote to memory of 1156	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	100
PID 2248 wrote to memory of 1156	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	100
PID 2248 wrote to memory of 4992	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	101
PID 2248 wrote to memory of 4992	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	101
PID 2248 wrote to memory of 1948	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	102
PID 2248 wrote to memory of 1948	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	102
PID 2248 wrote to memory of 4364	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	103
PID 2248 wrote to memory of 4364	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	103
PID 2248 wrote to memory of 4984	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	104
PID 2248 wrote to memory of 4984	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	104
PID 2248 wrote to memory of 4492	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	105
PID 2248 wrote to memory of 4492	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	105
PID 2248 wrote to memory of 4184	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	106
PID 2248 wrote to memory of 4184	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	106
PID 2248 wrote to memory of 2888	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	107
PID 2248 wrote to memory of 2888	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	107
PID 2248 wrote to memory of 1820	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	108
PID 2248 wrote to memory of 1820	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	108
PID 2248 wrote to memory of 5032	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	109
PID 2248 wrote to memory of 5032	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	109
PID 2248 wrote to memory of 4556	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	110
PID 2248 wrote to memory of 4556	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	110
PID 2248 wrote to memory of 3172	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	111
PID 2248 wrote to memory of 3172	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	111
PID 2248 wrote to memory of 1892	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	112
PID 2248 wrote to memory of 1892	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	112
PID 2248 wrote to memory of 4548	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	113
PID 2248 wrote to memory of 4548	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	113
PID 2248 wrote to memory of 3480	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	114
PID 2248 wrote to memory of 3480	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	114
PID 2248 wrote to memory of 4704	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	115
PID 2248 wrote to memory of 4704	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	115
PID 2248 wrote to memory of 1432	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	116
PID 2248 wrote to memory of 1432	2248	9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9b3f07e3f2fbbb72ead65bb9e549afc5_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\System\MwcisGQ.exe
  C:\Windows\System\MwcisGQ.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\MOkijRh.exe
  C:\Windows\System\MOkijRh.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\MyAHBKY.exe
  C:\Windows\System\MyAHBKY.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\BYsmNVq.exe
  C:\Windows\System\BYsmNVq.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\YebuTcC.exe
  C:\Windows\System\YebuTcC.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\uoxAEas.exe
  C:\Windows\System\uoxAEas.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\SIMPIKU.exe
  C:\Windows\System\SIMPIKU.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\TSuDctp.exe
  C:\Windows\System\TSuDctp.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\wlBqmvq.exe
  C:\Windows\System\wlBqmvq.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\vJzfeqS.exe
  C:\Windows\System\vJzfeqS.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\roPtSfA.exe
  C:\Windows\System\roPtSfA.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\BYjbCvf.exe
  C:\Windows\System\BYjbCvf.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\qWLldgg.exe
  C:\Windows\System\qWLldgg.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\ZUBqeyF.exe
  C:\Windows\System\ZUBqeyF.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\SOJQfgA.exe
  C:\Windows\System\SOJQfgA.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\rJeXhDy.exe
  C:\Windows\System\rJeXhDy.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\zpPODNb.exe
  C:\Windows\System\zpPODNb.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\neCgNuC.exe
  C:\Windows\System\neCgNuC.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\fwNUibj.exe
  C:\Windows\System\fwNUibj.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\yjpmMYh.exe
  C:\Windows\System\yjpmMYh.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\drwkmRQ.exe
  C:\Windows\System\drwkmRQ.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\QqEURrd.exe
  C:\Windows\System\QqEURrd.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\tjdgKmr.exe
  C:\Windows\System\tjdgKmr.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\VHaCbbJ.exe
  C:\Windows\System\VHaCbbJ.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\oPqzZNq.exe
  C:\Windows\System\oPqzZNq.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\pDKaDsg.exe
  C:\Windows\System\pDKaDsg.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\qpHMcPc.exe
  C:\Windows\System\qpHMcPc.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\HSYcCJK.exe
  C:\Windows\System\HSYcCJK.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\OuipIOh.exe
  C:\Windows\System\OuipIOh.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\KPwVhPj.exe
  C:\Windows\System\KPwVhPj.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\dyGfLLq.exe
  C:\Windows\System\dyGfLLq.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\YAFopVX.exe
  C:\Windows\System\YAFopVX.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\kobszTj.exe
  C:\Windows\System\kobszTj.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\qupQgmJ.exe
  C:\Windows\System\qupQgmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\hZqxFmk.exe
  C:\Windows\System\hZqxFmk.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\ULkxCep.exe
  C:\Windows\System\ULkxCep.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\aRbqEuu.exe
  C:\Windows\System\aRbqEuu.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\nsZIBLS.exe
  C:\Windows\System\nsZIBLS.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\nvYwdBw.exe
  C:\Windows\System\nvYwdBw.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\qYeIVub.exe
  C:\Windows\System\qYeIVub.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\TeXvTpK.exe
  C:\Windows\System\TeXvTpK.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\kwILHMB.exe
  C:\Windows\System\kwILHMB.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\ODvIzQd.exe
  C:\Windows\System\ODvIzQd.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\DwMnagd.exe
  C:\Windows\System\DwMnagd.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\rbTkYYx.exe
  C:\Windows\System\rbTkYYx.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\SHKDIbE.exe
  C:\Windows\System\SHKDIbE.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\zHjIoRq.exe
  C:\Windows\System\zHjIoRq.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\kMSNfXe.exe
  C:\Windows\System\kMSNfXe.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\iWDaoSC.exe
  C:\Windows\System\iWDaoSC.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\EdTBBqg.exe
  C:\Windows\System\EdTBBqg.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\wQcmFir.exe
  C:\Windows\System\wQcmFir.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\lDggMae.exe
  C:\Windows\System\lDggMae.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\PpmagCn.exe
  C:\Windows\System\PpmagCn.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\XaqtBZL.exe
  C:\Windows\System\XaqtBZL.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\jrNPERq.exe
  C:\Windows\System\jrNPERq.exe
  2⤵
  PID:1088
- C:\Windows\System\GkiKvTK.exe
  C:\Windows\System\GkiKvTK.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\SqyrNkv.exe
  C:\Windows\System\SqyrNkv.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\hMAgnEq.exe
  C:\Windows\System\hMAgnEq.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\heEFYiQ.exe
  C:\Windows\System\heEFYiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\HhjwcNZ.exe
  C:\Windows\System\HhjwcNZ.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\SfiYecV.exe
  C:\Windows\System\SfiYecV.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\cTpofoq.exe
  C:\Windows\System\cTpofoq.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\hjSZbQc.exe
  C:\Windows\System\hjSZbQc.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\WDbBQEb.exe
  C:\Windows\System\WDbBQEb.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\muLPjew.exe
  C:\Windows\System\muLPjew.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\eqHoDaO.exe
  C:\Windows\System\eqHoDaO.exe
  2⤵
  PID:2008
- C:\Windows\System\BANvUMG.exe
  C:\Windows\System\BANvUMG.exe
  2⤵
  PID:1392
- C:\Windows\System\ZcMNJry.exe
  C:\Windows\System\ZcMNJry.exe
  2⤵
  PID:3288
- C:\Windows\System\pKhQgDu.exe
  C:\Windows\System\pKhQgDu.exe
  2⤵
  PID:212
- C:\Windows\System\JeKFtyN.exe
  C:\Windows\System\JeKFtyN.exe
  2⤵
  PID:2024
- C:\Windows\System\ZcgcMUg.exe
  C:\Windows\System\ZcgcMUg.exe
  2⤵
  PID:2724
- C:\Windows\System\EUaeboR.exe
  C:\Windows\System\EUaeboR.exe
  2⤵
  PID:2184
- C:\Windows\System\UpfoUYA.exe
  C:\Windows\System\UpfoUYA.exe
  2⤵
  PID:3352
- C:\Windows\System\AtQvMfb.exe
  C:\Windows\System\AtQvMfb.exe
  2⤵
  PID:408
- C:\Windows\System\vCIatwD.exe
  C:\Windows\System\vCIatwD.exe
  2⤵
  PID:5236
- C:\Windows\System\xdJqXFr.exe
  C:\Windows\System\xdJqXFr.exe
  2⤵
  PID:5272
- C:\Windows\System\ftkySCl.exe
  C:\Windows\System\ftkySCl.exe
  2⤵
  PID:5344
- C:\Windows\System\BWlmheD.exe
  C:\Windows\System\BWlmheD.exe
  2⤵
  PID:5368
- C:\Windows\System\hZbcyVs.exe
  C:\Windows\System\hZbcyVs.exe
  2⤵
  PID:5384
- C:\Windows\System\NJkYGQN.exe
  C:\Windows\System\NJkYGQN.exe
  2⤵
  PID:5408
- C:\Windows\System\kHjQyWJ.exe
  C:\Windows\System\kHjQyWJ.exe
  2⤵
  PID:5432
- C:\Windows\System\VLAeBLW.exe
  C:\Windows\System\VLAeBLW.exe
  2⤵
  PID:5448
- C:\Windows\System\dKfaCLe.exe
  C:\Windows\System\dKfaCLe.exe
  2⤵
  PID:5472
- C:\Windows\System\HEatOeH.exe
  C:\Windows\System\HEatOeH.exe
  2⤵
  PID:5492
- C:\Windows\System\VcEleoW.exe
  C:\Windows\System\VcEleoW.exe
  2⤵
  PID:5512
- C:\Windows\System\aWnBNZA.exe
  C:\Windows\System\aWnBNZA.exe
  2⤵
  PID:5536
- C:\Windows\System\rncrpbv.exe
  C:\Windows\System\rncrpbv.exe
  2⤵
  PID:5552
- C:\Windows\System\xudcVaQ.exe
  C:\Windows\System\xudcVaQ.exe
  2⤵
  PID:5580
- C:\Windows\System\kbLjaso.exe
  C:\Windows\System\kbLjaso.exe
  2⤵
  PID:5604
- C:\Windows\System\PqHryTF.exe
  C:\Windows\System\PqHryTF.exe
  2⤵
  PID:5624
- C:\Windows\System\PeYiAlg.exe
  C:\Windows\System\PeYiAlg.exe
  2⤵
  PID:5640
- C:\Windows\System\GokdLeG.exe
  C:\Windows\System\GokdLeG.exe
  2⤵
  PID:5656
- C:\Windows\System\aLJrpkp.exe
  C:\Windows\System\aLJrpkp.exe
  2⤵
  PID:5860
- C:\Windows\System\LhDLUSR.exe
  C:\Windows\System\LhDLUSR.exe
  2⤵
  PID:5880
- C:\Windows\System\LYucSuc.exe
  C:\Windows\System\LYucSuc.exe
  2⤵
  PID:5900
- C:\Windows\System\hNlAppk.exe
  C:\Windows\System\hNlAppk.exe
  2⤵
  PID:5928
- C:\Windows\System\SHzmetq.exe
  C:\Windows\System\SHzmetq.exe
  2⤵
  PID:5944
- C:\Windows\System\tzzMZmO.exe
  C:\Windows\System\tzzMZmO.exe
  2⤵
  PID:5984
- C:\Windows\System\LEWTJWO.exe
  C:\Windows\System\LEWTJWO.exe
  2⤵
  PID:6000
- C:\Windows\System\McupvVZ.exe
  C:\Windows\System\McupvVZ.exe
  2⤵
  PID:6028
- C:\Windows\System\WwXoWig.exe
  C:\Windows\System\WwXoWig.exe
  2⤵
  PID:6044
- C:\Windows\System\umwpnRe.exe
  C:\Windows\System\umwpnRe.exe
  2⤵
  PID:6060
- C:\Windows\System\IGwAwTB.exe
  C:\Windows\System\IGwAwTB.exe
  2⤵
  PID:6084
- C:\Windows\System\PPyomUW.exe
  C:\Windows\System\PPyomUW.exe
  2⤵
  PID:6108
- C:\Windows\System\BgFvvkB.exe
  C:\Windows\System\BgFvvkB.exe
  2⤵
  PID:6128
- C:\Windows\System\gLXLpml.exe
  C:\Windows\System\gLXLpml.exe
  2⤵
  PID:5116
- C:\Windows\System\WxtOVWr.exe
  C:\Windows\System\WxtOVWr.exe
  2⤵
  PID:1752
- C:\Windows\System\osmtFiW.exe
  C:\Windows\System\osmtFiW.exe
  2⤵
  PID:2804
- C:\Windows\System\NADwTwS.exe
  C:\Windows\System\NADwTwS.exe
  2⤵
  PID:772
- C:\Windows\System\ULuOVmA.exe
  C:\Windows\System\ULuOVmA.exe
  2⤵
  PID:5128
- C:\Windows\System\CyPhdjB.exe
  C:\Windows\System\CyPhdjB.exe
  2⤵
  PID:552
- C:\Windows\System\SUpjQBz.exe
  C:\Windows\System\SUpjQBz.exe
  2⤵
  PID:4136
- C:\Windows\System\OQedUxA.exe
  C:\Windows\System\OQedUxA.exe
  2⤵
  PID:5172
- C:\Windows\System\mcsBuyE.exe
  C:\Windows\System\mcsBuyE.exe
  2⤵
  PID:5232
- C:\Windows\System\vPFPnBe.exe
  C:\Windows\System\vPFPnBe.exe
  2⤵
  PID:5328
- C:\Windows\System\NuvAvgb.exe
  C:\Windows\System\NuvAvgb.exe
  2⤵
  PID:5364
- C:\Windows\System\CBMbAGg.exe
  C:\Windows\System\CBMbAGg.exe
  2⤵
  PID:5616
- C:\Windows\System\NjYQCgG.exe
  C:\Windows\System\NjYQCgG.exe
  2⤵
  PID:5684
- C:\Windows\System\LCZdmaz.exe
  C:\Windows\System\LCZdmaz.exe
  2⤵
  PID:5752
- C:\Windows\System\mFdqXVI.exe
  C:\Windows\System\mFdqXVI.exe
  2⤵
  PID:5820
- C:\Windows\System\IJQWFHW.exe
  C:\Windows\System\IJQWFHW.exe
  2⤵
  PID:5852
- C:\Windows\System\tjXsKrN.exe
  C:\Windows\System\tjXsKrN.exe
  2⤵
  PID:5896
- C:\Windows\System\pnSETdm.exe
  C:\Windows\System\pnSETdm.exe
  2⤵
  PID:5936
- C:\Windows\System\UVAIkFW.exe
  C:\Windows\System\UVAIkFW.exe
  2⤵
  PID:5972
- C:\Windows\System\fmpgkNV.exe
  C:\Windows\System\fmpgkNV.exe
  2⤵
  PID:6008
- C:\Windows\System\WcZJBrN.exe
  C:\Windows\System\WcZJBrN.exe
  2⤵
  PID:6040
- C:\Windows\System\bikcbka.exe
  C:\Windows\System\bikcbka.exe
  2⤵
  PID:6076
- C:\Windows\System\qzIyvBi.exe
  C:\Windows\System\qzIyvBi.exe
  2⤵
  PID:6116
- C:\Windows\System\suiqMYW.exe
  C:\Windows\System\suiqMYW.exe
  2⤵
  PID:6140
- C:\Windows\System\fwtCClg.exe
  C:\Windows\System\fwtCClg.exe
  2⤵
  PID:2728
- C:\Windows\System\bpxDmDE.exe
  C:\Windows\System\bpxDmDE.exe
  2⤵
  PID:548
- C:\Windows\System\kOFWLIG.exe
  C:\Windows\System\kOFWLIG.exe
  2⤵
  PID:3676
- C:\Windows\System\keuqqgf.exe
  C:\Windows\System\keuqqgf.exe
  2⤵
  PID:2688
- C:\Windows\System\gkvDflh.exe
  C:\Windows\System\gkvDflh.exe
  2⤵
  PID:5136
- C:\Windows\System\IstcNBD.exe
  C:\Windows\System\IstcNBD.exe
  2⤵
  PID:4376
- C:\Windows\System\CFJIVpg.exe
  C:\Windows\System\CFJIVpg.exe
  2⤵
  PID:5224
- C:\Windows\System\sbGMTrN.exe
  C:\Windows\System\sbGMTrN.exe
  2⤵
  PID:5256
- C:\Windows\System\XMsbqeV.exe
  C:\Windows\System\XMsbqeV.exe
  2⤵
  PID:5484
- C:\Windows\System\CbobHSj.exe
  C:\Windows\System\CbobHSj.exe
  2⤵
  PID:5548
- C:\Windows\System\EwfDFSm.exe
  C:\Windows\System\EwfDFSm.exe
  2⤵
  PID:5588
- C:\Windows\System\FrvoSVG.exe
  C:\Windows\System\FrvoSVG.exe
  2⤵
  PID:6164
- C:\Windows\System\mhOMJlc.exe
  C:\Windows\System\mhOMJlc.exe
  2⤵
  PID:6180
- C:\Windows\System\IhxNUNz.exe
  C:\Windows\System\IhxNUNz.exe
  2⤵
  PID:6196
- C:\Windows\System\yspqeCl.exe
  C:\Windows\System\yspqeCl.exe
  2⤵
  PID:6212
- C:\Windows\System\EqIdCLi.exe
  C:\Windows\System\EqIdCLi.exe
  2⤵
  PID:6228
- C:\Windows\System\AgwcnOX.exe
  C:\Windows\System\AgwcnOX.exe
  2⤵
  PID:6244
- C:\Windows\System\NKEkCIC.exe
  C:\Windows\System\NKEkCIC.exe
  2⤵
  PID:6344
- C:\Windows\System\brvRtuH.exe
  C:\Windows\System\brvRtuH.exe
  2⤵
  PID:6364
- C:\Windows\System\yoKCiQp.exe
  C:\Windows\System\yoKCiQp.exe
  2⤵
  PID:6388
- C:\Windows\System\QkzZvSr.exe
  C:\Windows\System\QkzZvSr.exe
  2⤵
  PID:6404
- C:\Windows\System\agMpjPB.exe
  C:\Windows\System\agMpjPB.exe
  2⤵
  PID:6428
- C:\Windows\System\aZqPMfD.exe
  C:\Windows\System\aZqPMfD.exe
  2⤵
  PID:6452
- C:\Windows\System\ARttiKE.exe
  C:\Windows\System\ARttiKE.exe
  2⤵
  PID:6468
- C:\Windows\System\mgjkwGv.exe
  C:\Windows\System\mgjkwGv.exe
  2⤵
  PID:6484
- C:\Windows\System\aVDNLJw.exe
  C:\Windows\System\aVDNLJw.exe
  2⤵
  PID:6568
- C:\Windows\System\VWiVFlN.exe
  C:\Windows\System\VWiVFlN.exe
  2⤵
  PID:6592
- C:\Windows\System\YnwNJPh.exe
  C:\Windows\System\YnwNJPh.exe
  2⤵
  PID:6612
- C:\Windows\System\zszrobZ.exe
  C:\Windows\System\zszrobZ.exe
  2⤵
  PID:6636
- C:\Windows\System\Rbvrzjy.exe
  C:\Windows\System\Rbvrzjy.exe
  2⤵
  PID:6656
- C:\Windows\System\gdnxEuK.exe
  C:\Windows\System\gdnxEuK.exe
  2⤵
  PID:6672
- C:\Windows\System\fnhngxQ.exe
  C:\Windows\System\fnhngxQ.exe
  2⤵
  PID:6696
- C:\Windows\System\WvgExzg.exe
  C:\Windows\System\WvgExzg.exe
  2⤵
  PID:6716
- C:\Windows\System\OTmWdLk.exe
  C:\Windows\System\OTmWdLk.exe
  2⤵
  PID:6736
- C:\Windows\System\nGxHaDs.exe
  C:\Windows\System\nGxHaDs.exe
  2⤵
  PID:6764
- C:\Windows\System\YzxijoG.exe
  C:\Windows\System\YzxijoG.exe
  2⤵
  PID:6780
- C:\Windows\System\wNkRSWt.exe
  C:\Windows\System\wNkRSWt.exe
  2⤵
  PID:6800
- C:\Windows\System\lddyczJ.exe
  C:\Windows\System\lddyczJ.exe
  2⤵
  PID:6820
- C:\Windows\System\WWgVyvH.exe
  C:\Windows\System\WWgVyvH.exe
  2⤵
  PID:6836
- C:\Windows\System\WwBexnv.exe
  C:\Windows\System\WwBexnv.exe
  2⤵
  PID:6856
- C:\Windows\System\NqQfPCR.exe
  C:\Windows\System\NqQfPCR.exe
  2⤵
  PID:6872
- C:\Windows\System\DtCLzNN.exe
  C:\Windows\System\DtCLzNN.exe
  2⤵
  PID:6896
- C:\Windows\System\tZAZGqv.exe
  C:\Windows\System\tZAZGqv.exe
  2⤵
  PID:6916
- C:\Windows\System\fsughCw.exe
  C:\Windows\System\fsughCw.exe
  2⤵
  PID:6940
- C:\Windows\System\CJzDEJm.exe
  C:\Windows\System\CJzDEJm.exe
  2⤵
  PID:6960
- C:\Windows\System\JfjEDVA.exe
  C:\Windows\System\JfjEDVA.exe
  2⤵
  PID:6980
- C:\Windows\System\xyHdgbF.exe
  C:\Windows\System\xyHdgbF.exe
  2⤵
  PID:6996
- C:\Windows\System\jYafwvs.exe
  C:\Windows\System\jYafwvs.exe
  2⤵
  PID:7020
- C:\Windows\System\bucJaYN.exe
  C:\Windows\System\bucJaYN.exe
  2⤵
  PID:7044
- C:\Windows\System\IdlLVwe.exe
  C:\Windows\System\IdlLVwe.exe
  2⤵
  PID:7060
- C:\Windows\System\ttWucKb.exe
  C:\Windows\System\ttWucKb.exe
  2⤵
  PID:7076
- C:\Windows\System\aVfUYGN.exe
  C:\Windows\System\aVfUYGN.exe
  2⤵
  PID:7092
- C:\Windows\System\fKKFFXL.exe
  C:\Windows\System\fKKFFXL.exe
  2⤵
  PID:7108
- C:\Windows\System\kZtiDZP.exe
  C:\Windows\System\kZtiDZP.exe
  2⤵
  PID:7124
- C:\Windows\System\FhSTfNv.exe
  C:\Windows\System\FhSTfNv.exe
  2⤵
  PID:7140
- C:\Windows\System\RZyIQAn.exe
  C:\Windows\System\RZyIQAn.exe
  2⤵
  PID:5892
- C:\Windows\System\vcDlUEG.exe
  C:\Windows\System\vcDlUEG.exe
  2⤵
  PID:5960
- C:\Windows\System\XWHOatR.exe
  C:\Windows\System\XWHOatR.exe
  2⤵
  PID:6096
- C:\Windows\System\tLRjKIq.exe
  C:\Windows\System\tLRjKIq.exe
  2⤵
  PID:2236
- C:\Windows\System\hvGAHnG.exe
  C:\Windows\System\hvGAHnG.exe
  2⤵
  PID:2956
- C:\Windows\System\sepRVkf.exe
  C:\Windows\System\sepRVkf.exe
  2⤵
  PID:2812
- C:\Windows\System\sWHMhfb.exe
  C:\Windows\System\sWHMhfb.exe
  2⤵
  PID:4356
- C:\Windows\System\rqvmfiv.exe
  C:\Windows\System\rqvmfiv.exe
  2⤵
  PID:5252
- C:\Windows\System\lHdImeT.exe
  C:\Windows\System\lHdImeT.exe
  2⤵
  PID:5532
- C:\Windows\System\daRpwxe.exe
  C:\Windows\System\daRpwxe.exe
  2⤵
  PID:6156
- C:\Windows\System\fZQbTjX.exe
  C:\Windows\System\fZQbTjX.exe
  2⤵
  PID:6204
- C:\Windows\System\rwrNPzM.exe
  C:\Windows\System\rwrNPzM.exe
  2⤵
  PID:6240
- C:\Windows\System\lYNnGmg.exe
  C:\Windows\System\lYNnGmg.exe
  2⤵
  PID:6988
- C:\Windows\System\rIOnwQP.exe
  C:\Windows\System\rIOnwQP.exe
  2⤵
  PID:6260
- C:\Windows\System\KKCxAqw.exe
  C:\Windows\System\KKCxAqw.exe
  2⤵
  PID:7172
- C:\Windows\System\qtviTWZ.exe
  C:\Windows\System\qtviTWZ.exe
  2⤵
  PID:7192
- C:\Windows\System\UlhiTRs.exe
  C:\Windows\System\UlhiTRs.exe
  2⤵
  PID:7216
- C:\Windows\System\LqHLfho.exe
  C:\Windows\System\LqHLfho.exe
  2⤵
  PID:7232
- C:\Windows\System\OrmBpBo.exe
  C:\Windows\System\OrmBpBo.exe
  2⤵
  PID:7256
- C:\Windows\System\arCeRKc.exe
  C:\Windows\System\arCeRKc.exe
  2⤵
  PID:7304
- C:\Windows\System\BVGDimk.exe
  C:\Windows\System\BVGDimk.exe
  2⤵
  PID:7332
- C:\Windows\System\lFHgHjv.exe
  C:\Windows\System\lFHgHjv.exe
  2⤵
  PID:7356
- C:\Windows\System\WWUBfQk.exe
  C:\Windows\System\WWUBfQk.exe
  2⤵
  PID:7380
- C:\Windows\System\vSkUCRR.exe
  C:\Windows\System\vSkUCRR.exe
  2⤵
  PID:7412
- C:\Windows\System\BiKUnaa.exe
  C:\Windows\System\BiKUnaa.exe
  2⤵
  PID:7428
- C:\Windows\System\enbLOmQ.exe
  C:\Windows\System\enbLOmQ.exe
  2⤵
  PID:7448
- C:\Windows\System\rqvGxOi.exe
  C:\Windows\System\rqvGxOi.exe
  2⤵
  PID:7468
- C:\Windows\System\nnwofGW.exe
  C:\Windows\System\nnwofGW.exe
  2⤵
  PID:7492
- C:\Windows\System\hTziGZk.exe
  C:\Windows\System\hTziGZk.exe
  2⤵
  PID:7516
- C:\Windows\System\dHknHmw.exe
  C:\Windows\System\dHknHmw.exe
  2⤵
  PID:7544
- C:\Windows\System\AKoFyOG.exe
  C:\Windows\System\AKoFyOG.exe
  2⤵
  PID:7564
- C:\Windows\System\mmHdtpe.exe
  C:\Windows\System\mmHdtpe.exe
  2⤵
  PID:7580
- C:\Windows\System\PjQKbHn.exe
  C:\Windows\System\PjQKbHn.exe
  2⤵
  PID:7600
- C:\Windows\System\HhtVaLe.exe
  C:\Windows\System\HhtVaLe.exe
  2⤵
  PID:7624
- C:\Windows\System\vkRvlFp.exe
  C:\Windows\System\vkRvlFp.exe
  2⤵
  PID:7640
- C:\Windows\System\HabiZka.exe
  C:\Windows\System\HabiZka.exe
  2⤵
  PID:7664
- C:\Windows\System\nKonlcO.exe
  C:\Windows\System\nKonlcO.exe
  2⤵
  PID:7700
- C:\Windows\System\asjKeUg.exe
  C:\Windows\System\asjKeUg.exe
  2⤵
  PID:7724
- C:\Windows\System\ykQhpsG.exe
  C:\Windows\System\ykQhpsG.exe
  2⤵
  PID:7748
- C:\Windows\System\UIUWLFE.exe
  C:\Windows\System\UIUWLFE.exe
  2⤵
  PID:7768
- C:\Windows\System\MlHRrog.exe
  C:\Windows\System\MlHRrog.exe
  2⤵
  PID:7792
- C:\Windows\System\ZCokiNa.exe
  C:\Windows\System\ZCokiNa.exe
  2⤵
  PID:7816
- C:\Windows\System\DYAgsBE.exe
  C:\Windows\System\DYAgsBE.exe
  2⤵
  PID:7844
- C:\Windows\System\eFNnXNy.exe
  C:\Windows\System\eFNnXNy.exe
  2⤵
  PID:7860
- C:\Windows\System\oZeXkey.exe
  C:\Windows\System\oZeXkey.exe
  2⤵
  PID:7876
- C:\Windows\System\btJGsqr.exe
  C:\Windows\System\btJGsqr.exe
  2⤵
  PID:7892
- C:\Windows\System\pVmPRXI.exe
  C:\Windows\System\pVmPRXI.exe
  2⤵
  PID:7912
- C:\Windows\System\zbZBWjv.exe
  C:\Windows\System\zbZBWjv.exe
  2⤵
  PID:7936
- C:\Windows\System\MBQzFNf.exe
  C:\Windows\System\MBQzFNf.exe
  2⤵
  PID:7956
- C:\Windows\System\UkIjIuO.exe
  C:\Windows\System\UkIjIuO.exe
  2⤵
  PID:7976
- C:\Windows\System\mpWNlwI.exe
  C:\Windows\System\mpWNlwI.exe
  2⤵
  PID:8000
- C:\Windows\System\FvUjJqi.exe
  C:\Windows\System\FvUjJqi.exe
  2⤵
  PID:8020
- C:\Windows\System\UnbsnRS.exe
  C:\Windows\System\UnbsnRS.exe
  2⤵
  PID:8036
- C:\Windows\System\MQlSdyD.exe
  C:\Windows\System\MQlSdyD.exe
  2⤵
  PID:8052
- C:\Windows\System\nBstrdY.exe
  C:\Windows\System\nBstrdY.exe
  2⤵
  PID:8076
- C:\Windows\System\RMEfMTk.exe
  C:\Windows\System\RMEfMTk.exe
  2⤵
  PID:8100
- C:\Windows\System\mlybfwD.exe
  C:\Windows\System\mlybfwD.exe
  2⤵
  PID:8116
- C:\Windows\System\hXeOHmD.exe
  C:\Windows\System\hXeOHmD.exe
  2⤵
  PID:8148
- C:\Windows\System\maMTyNW.exe
  C:\Windows\System\maMTyNW.exe
  2⤵
  PID:8168
- C:\Windows\System\hmGBakl.exe
  C:\Windows\System\hmGBakl.exe
  2⤵
  PID:6540
- C:\Windows\System\UPWZUEm.exe
  C:\Windows\System\UPWZUEm.exe
  2⤵
  PID:6312
- C:\Windows\System\gdpEqRo.exe
  C:\Windows\System\gdpEqRo.exe
  2⤵
  PID:6380
- C:\Windows\System\YqJphst.exe
  C:\Windows\System\YqJphst.exe
  2⤵
  PID:6412
- C:\Windows\System\tohPfVX.exe
  C:\Windows\System\tohPfVX.exe
  2⤵
  PID:6460
- C:\Windows\System\CzFDMBL.exe
  C:\Windows\System\CzFDMBL.exe
  2⤵
  PID:4368
- C:\Windows\System\Dxzbmlr.exe
  C:\Windows\System\Dxzbmlr.exe
  2⤵
  PID:6548
- C:\Windows\System\aoORwus.exe
  C:\Windows\System\aoORwus.exe
  2⤵
  PID:6604
- C:\Windows\System\BNAoBSt.exe
  C:\Windows\System\BNAoBSt.exe
  2⤵
  PID:6652
- C:\Windows\System\ZIuQMWX.exe
  C:\Windows\System\ZIuQMWX.exe
  2⤵
  PID:7480
- C:\Windows\System\CNZuacr.exe
  C:\Windows\System\CNZuacr.exe
  2⤵
  PID:2984
- C:\Windows\System\mjuOQCH.exe
  C:\Windows\System\mjuOQCH.exe
  2⤵
  PID:3124
- C:\Windows\System\SJazFhz.exe
  C:\Windows\System\SJazFhz.exe
  2⤵
  PID:5520
- C:\Windows\System\mByXazH.exe
  C:\Windows\System\mByXazH.exe
  2⤵
  PID:6188
- C:\Windows\System\IDsDSVR.exe
  C:\Windows\System\IDsDSVR.exe
  2⤵
  PID:7052
- C:\Windows\System\JoNoAEO.exe
  C:\Windows\System\JoNoAEO.exe
  2⤵
  PID:7200
- C:\Windows\System\OcdKBqZ.exe
  C:\Windows\System\OcdKBqZ.exe
  2⤵
  PID:7252
- C:\Windows\System\HlcprFF.exe
  C:\Windows\System\HlcprFF.exe
  2⤵
  PID:7300
- C:\Windows\System\NFJGmVs.exe
  C:\Windows\System\NFJGmVs.exe
  2⤵
  PID:6680
- C:\Windows\System\ExbkEVs.exe
  C:\Windows\System\ExbkEVs.exe
  2⤵
  PID:6524
- C:\Windows\System\UkDFlZC.exe
  C:\Windows\System\UkDFlZC.exe
  2⤵
  PID:7804
- C:\Windows\System\nAeuqXd.exe
  C:\Windows\System\nAeuqXd.exe
  2⤵
  PID:7344
- C:\Windows\System\lMsDAWv.exe
  C:\Windows\System\lMsDAWv.exe
  2⤵
  PID:7352
- C:\Windows\System\gqvbKiV.exe
  C:\Windows\System\gqvbKiV.exe
  2⤵
  PID:8200
- C:\Windows\System\BYBMaBw.exe
  C:\Windows\System\BYBMaBw.exe
  2⤵
  PID:8216
- C:\Windows\System\SNGluTK.exe
  C:\Windows\System\SNGluTK.exe
  2⤵
  PID:8236
- C:\Windows\System\RatmuwR.exe
  C:\Windows\System\RatmuwR.exe
  2⤵
  PID:8264
- C:\Windows\System\sAULEuM.exe
  C:\Windows\System\sAULEuM.exe
  2⤵
  PID:8284
- C:\Windows\System\fXaaWRG.exe
  C:\Windows\System\fXaaWRG.exe
  2⤵
  PID:8304
- C:\Windows\System\AbNprFc.exe
  C:\Windows\System\AbNprFc.exe
  2⤵
  PID:8328
- C:\Windows\System\lKttMbi.exe
  C:\Windows\System\lKttMbi.exe
  2⤵
  PID:8356
- C:\Windows\System\aFBBsJe.exe
  C:\Windows\System\aFBBsJe.exe
  2⤵
  PID:8372
- C:\Windows\System\HMztagb.exe
  C:\Windows\System\HMztagb.exe
  2⤵
  PID:8392
- C:\Windows\System\GNrXVLI.exe
  C:\Windows\System\GNrXVLI.exe
  2⤵
  PID:8412
- C:\Windows\System\eXRTpWj.exe
  C:\Windows\System\eXRTpWj.exe
  2⤵
  PID:8432
- C:\Windows\System\SBdfHcu.exe
  C:\Windows\System\SBdfHcu.exe
  2⤵
  PID:8452
- C:\Windows\System\inmkHAf.exe
  C:\Windows\System\inmkHAf.exe
  2⤵
  PID:8476
- C:\Windows\System\WDnsOrU.exe
  C:\Windows\System\WDnsOrU.exe
  2⤵
  PID:8500
- C:\Windows\System\NdxOQtp.exe
  C:\Windows\System\NdxOQtp.exe
  2⤵
  PID:8524
- C:\Windows\System\hKOefje.exe
  C:\Windows\System\hKOefje.exe
  2⤵
  PID:8540
- C:\Windows\System\SHCWzGy.exe
  C:\Windows\System\SHCWzGy.exe
  2⤵
  PID:8568
- C:\Windows\System\nRoupqA.exe
  C:\Windows\System\nRoupqA.exe
  2⤵
  PID:8592
- C:\Windows\System\OScuWcO.exe
  C:\Windows\System\OScuWcO.exe
  2⤵
  PID:8668
- C:\Windows\System\nplQaYB.exe
  C:\Windows\System\nplQaYB.exe
  2⤵
  PID:8692
- C:\Windows\System\aSAjegv.exe
  C:\Windows\System\aSAjegv.exe
  2⤵
  PID:8712
- C:\Windows\System\NkyuMfj.exe
  C:\Windows\System\NkyuMfj.exe
  2⤵
  PID:8732
- C:\Windows\System\GJyVqNW.exe
  C:\Windows\System\GJyVqNW.exe
  2⤵
  PID:8752
- C:\Windows\System\exFyvRH.exe
  C:\Windows\System\exFyvRH.exe
  2⤵
  PID:8768
- C:\Windows\System\sZxyBhK.exe
  C:\Windows\System\sZxyBhK.exe
  2⤵
  PID:8792
- C:\Windows\System\ZiqKEee.exe
  C:\Windows\System\ZiqKEee.exe
  2⤵
  PID:8812
- C:\Windows\System\FviyuNb.exe
  C:\Windows\System\FviyuNb.exe
  2⤵
  PID:8828
- C:\Windows\System\QPQhguF.exe
  C:\Windows\System\QPQhguF.exe
  2⤵
  PID:8848
- C:\Windows\System\JEdalcp.exe
  C:\Windows\System\JEdalcp.exe
  2⤵
  PID:8868
- C:\Windows\System\sjhOKbC.exe
  C:\Windows\System\sjhOKbC.exe
  2⤵
  PID:8900
- C:\Windows\System\dNyAJPD.exe
  C:\Windows\System\dNyAJPD.exe
  2⤵
  PID:8916
- C:\Windows\System\nXITilw.exe
  C:\Windows\System\nXITilw.exe
  2⤵
  PID:8940
- C:\Windows\System\FaXYdIT.exe
  C:\Windows\System\FaXYdIT.exe
  2⤵
  PID:8964
- C:\Windows\System\GlvcMNF.exe
  C:\Windows\System\GlvcMNF.exe
  2⤵
  PID:8988
- C:\Windows\System\JTvfnLa.exe
  C:\Windows\System\JTvfnLa.exe
  2⤵
  PID:9012
- C:\Windows\System\BUuoVlI.exe
  C:\Windows\System\BUuoVlI.exe
  2⤵
  PID:9036
- C:\Windows\System\IxTBsQL.exe
  C:\Windows\System\IxTBsQL.exe
  2⤵
  PID:9056
- C:\Windows\System\auDdntd.exe
  C:\Windows\System\auDdntd.exe
  2⤵
  PID:9080
- C:\Windows\System\dPPimSN.exe
  C:\Windows\System\dPPimSN.exe
  2⤵
  PID:9104
- C:\Windows\System\emygzvX.exe
  C:\Windows\System\emygzvX.exe
  2⤵
  PID:9124
- C:\Windows\System\oziLyUl.exe
  C:\Windows\System\oziLyUl.exe
  2⤵
  PID:9144
- C:\Windows\System\cBnGHTc.exe
  C:\Windows\System\cBnGHTc.exe
  2⤵
  PID:9164
- C:\Windows\System\ROwJoWn.exe
  C:\Windows\System\ROwJoWn.exe
  2⤵
  PID:9188
- C:\Windows\System\PYOmYyy.exe
  C:\Windows\System\PYOmYyy.exe
  2⤵
  PID:9208
- C:\Windows\System\LvQgSvs.exe
  C:\Windows\System\LvQgSvs.exe
  2⤵
  PID:7104
- C:\Windows\System\rdhlZBW.exe
  C:\Windows\System\rdhlZBW.exe
  2⤵
  PID:7500
- C:\Windows\System\sBVAwUB.exe
  C:\Windows\System\sBVAwUB.exe
  2⤵
  PID:7608
- C:\Windows\System\fKAgGIM.exe
  C:\Windows\System\fKAgGIM.exe
  2⤵
  PID:7712
- C:\Windows\System\dpCPxXq.exe
  C:\Windows\System\dpCPxXq.exe
  2⤵
  PID:7760
- C:\Windows\System\OcBgCSV.exe
  C:\Windows\System\OcBgCSV.exe
  2⤵
  PID:7824
- C:\Windows\System\DBPywkm.exe
  C:\Windows\System\DBPywkm.exe
  2⤵
  PID:7888
- C:\Windows\System\WNOnZfh.exe
  C:\Windows\System\WNOnZfh.exe
  2⤵
  PID:7932
- C:\Windows\System\bmOsUtd.exe
  C:\Windows\System\bmOsUtd.exe
  2⤵
  PID:8032
- C:\Windows\System\yoXRLHB.exe
  C:\Windows\System\yoXRLHB.exe
  2⤵
  PID:8084
- C:\Windows\System\BveeYXQ.exe
  C:\Windows\System\BveeYXQ.exe
  2⤵
  PID:8132
- C:\Windows\System\xelApKT.exe
  C:\Windows\System\xelApKT.exe
  2⤵
  PID:7316
- C:\Windows\System\YxHaEMQ.exe
  C:\Windows\System\YxHaEMQ.exe
  2⤵
  PID:8140
- C:\Windows\System\PiAkfpP.exe
  C:\Windows\System\PiAkfpP.exe
  2⤵
  PID:8300
- C:\Windows\System\TfYmpuX.exe
  C:\Windows\System\TfYmpuX.exe
  2⤵
  PID:8336
- C:\Windows\System\qFqmOAD.exe
  C:\Windows\System\qFqmOAD.exe
  2⤵
  PID:8408
- C:\Windows\System\viWIaRs.exe
  C:\Windows\System\viWIaRs.exe
  2⤵
  PID:6928
- C:\Windows\System\xNCMGgq.exe
  C:\Windows\System\xNCMGgq.exe
  2⤵
  PID:6628
- C:\Windows\System\pgkAloX.exe
  C:\Windows\System\pgkAloX.exe
  2⤵
  PID:8508
- C:\Windows\System\zBWtrfD.exe
  C:\Windows\System\zBWtrfD.exe
  2⤵
  PID:8560
- C:\Windows\System\XqdHlLv.exe
  C:\Windows\System\XqdHlLv.exe
  2⤵
  PID:7656
- C:\Windows\System\lRGrelV.exe
  C:\Windows\System\lRGrelV.exe
  2⤵
  PID:7928
- C:\Windows\System\MUvSbcu.exe
  C:\Windows\System\MUvSbcu.exe
  2⤵
  PID:8108
- C:\Windows\System\SAUHWPP.exe
  C:\Windows\System\SAUHWPP.exe
  2⤵
  PID:6332
- C:\Windows\System\gIGQZqz.exe
  C:\Windows\System\gIGQZqz.exe
  2⤵
  PID:8656
- C:\Windows\System\syUsYXp.exe
  C:\Windows\System\syUsYXp.exe
  2⤵
  PID:8708
- C:\Windows\System\FsJsGGN.exe
  C:\Windows\System\FsJsGGN.exe
  2⤵
  PID:8804
- C:\Windows\System\rDSgnmY.exe
  C:\Windows\System\rDSgnmY.exe
  2⤵
  PID:7084
- C:\Windows\System\KrBUWyz.exe
  C:\Windows\System\KrBUWyz.exe
  2⤵
  PID:9228
- C:\Windows\System\NXiFRKM.exe
  C:\Windows\System\NXiFRKM.exe
  2⤵
  PID:9248
- C:\Windows\System\DNzFMou.exe
  C:\Windows\System\DNzFMou.exe
  2⤵
  PID:9268
- C:\Windows\System\rNujtVo.exe
  C:\Windows\System\rNujtVo.exe
  2⤵
  PID:9292
- C:\Windows\System\tTDHkpz.exe
  C:\Windows\System\tTDHkpz.exe
  2⤵
  PID:9312
- C:\Windows\System\xQLBOrg.exe
  C:\Windows\System\xQLBOrg.exe
  2⤵
  PID:9500
- C:\Windows\System\pYJUOxp.exe
  C:\Windows\System\pYJUOxp.exe
  2⤵
  PID:9524
- C:\Windows\System\BDFpxWQ.exe
  C:\Windows\System\BDFpxWQ.exe
  2⤵
  PID:9540
- C:\Windows\System\jRJkPvR.exe
  C:\Windows\System\jRJkPvR.exe
  2⤵
  PID:9560
- C:\Windows\System\uSmkcwq.exe
  C:\Windows\System\uSmkcwq.exe
  2⤵
  PID:9580
- C:\Windows\System\FZdpoHm.exe
  C:\Windows\System\FZdpoHm.exe
  2⤵
  PID:9600
- C:\Windows\System\YkIyPbO.exe
  C:\Windows\System\YkIyPbO.exe
  2⤵
  PID:9624
- C:\Windows\System\dDiwgBf.exe
  C:\Windows\System\dDiwgBf.exe
  2⤵
  PID:9640
- C:\Windows\System\hPVMSUd.exe
  C:\Windows\System\hPVMSUd.exe
  2⤵
  PID:9664
- C:\Windows\System\QuHhmJp.exe
  C:\Windows\System\QuHhmJp.exe
  2⤵
  PID:9680
- C:\Windows\System\KEsxqyA.exe
  C:\Windows\System\KEsxqyA.exe
  2⤵
  PID:9700
- C:\Windows\System\qHSKpZU.exe
  C:\Windows\System\qHSKpZU.exe
  2⤵
  PID:9724
- C:\Windows\System\cawMwyG.exe
  C:\Windows\System\cawMwyG.exe
  2⤵
  PID:9744
- C:\Windows\System\HNkzLHO.exe
  C:\Windows\System\HNkzLHO.exe
  2⤵
  PID:9772
- C:\Windows\System\UNbORpZ.exe
  C:\Windows\System\UNbORpZ.exe
  2⤵
  PID:9788
- C:\Windows\System\dnLLwnr.exe
  C:\Windows\System\dnLLwnr.exe
  2⤵
  PID:9808
- C:\Windows\System\BGKUZjg.exe
  C:\Windows\System\BGKUZjg.exe
  2⤵
  PID:9832
- C:\Windows\System\wdHwlGG.exe
  C:\Windows\System\wdHwlGG.exe
  2⤵
  PID:9852
- C:\Windows\System\hBVVbbM.exe
  C:\Windows\System\hBVVbbM.exe
  2⤵
  PID:9876
- C:\Windows\System\NvImrqU.exe
  C:\Windows\System\NvImrqU.exe
  2⤵
  PID:9896
- C:\Windows\System\aGahSCQ.exe
  C:\Windows\System\aGahSCQ.exe
  2⤵
  PID:9920
- C:\Windows\System\yYSafrs.exe
  C:\Windows\System\yYSafrs.exe
  2⤵
  PID:9940
- C:\Windows\System\vYxxIkS.exe
  C:\Windows\System\vYxxIkS.exe
  2⤵
  PID:9964
- C:\Windows\System\PBQLfmT.exe
  C:\Windows\System\PBQLfmT.exe
  2⤵
  PID:9984
- C:\Windows\System\ZVAKJMt.exe
  C:\Windows\System\ZVAKJMt.exe
  2⤵
  PID:10048
- C:\Windows\System\CTjLejo.exe
  C:\Windows\System\CTjLejo.exe
  2⤵
  PID:10064
- C:\Windows\System\gWVkoyp.exe
  C:\Windows\System\gWVkoyp.exe
  2⤵
  PID:10080
- C:\Windows\System\PCMfDDR.exe
  C:\Windows\System\PCMfDDR.exe
  2⤵
  PID:10108
- C:\Windows\System\NqLTmrr.exe
  C:\Windows\System\NqLTmrr.exe
  2⤵
  PID:10140
- C:\Windows\System\VgMIwCM.exe
  C:\Windows\System\VgMIwCM.exe
  2⤵
  PID:10176
- C:\Windows\System\WqwZdHd.exe
  C:\Windows\System\WqwZdHd.exe
  2⤵
  PID:10192
- C:\Windows\System\mQtptyt.exe
  C:\Windows\System\mQtptyt.exe
  2⤵
  PID:10216
- C:\Windows\System\wIZBMkP.exe
  C:\Windows\System\wIZBMkP.exe
  2⤵
  PID:3348
- C:\Windows\System\HgONdEz.exe
  C:\Windows\System\HgONdEz.exe
  2⤵
  PID:7444
- C:\Windows\System\amAzcEw.exe
  C:\Windows\System\amAzcEw.exe
  2⤵
  PID:5768
- C:\Windows\System\VVWsYUq.exe
  C:\Windows\System\VVWsYUq.exe
  2⤵
  PID:5400
- C:\Windows\System\yDiZboT.exe
  C:\Windows\System\yDiZboT.exe
  2⤵
  PID:7852
- C:\Windows\System\sOhIBuA.exe
  C:\Windows\System\sOhIBuA.exe
  2⤵
  PID:8112
- C:\Windows\System\vRbVIMF.exe
  C:\Windows\System\vRbVIMF.exe
  2⤵
  PID:8228
- C:\Windows\System\prmhaqr.exe
  C:\Windows\System\prmhaqr.exe
  2⤵
  PID:8280
- C:\Windows\System\uhgRHiC.exe
  C:\Windows\System\uhgRHiC.exe
  2⤵
  PID:8428
- C:\Windows\System\UCqkmLl.exe
  C:\Windows\System\UCqkmLl.exe
  2⤵
  PID:8576
- C:\Windows\System\KbYNyRP.exe
  C:\Windows\System\KbYNyRP.exe
  2⤵
  PID:8700
- C:\Windows\System\ezTXtWG.exe
  C:\Windows\System\ezTXtWG.exe
  2⤵
  PID:8824
- C:\Windows\System\FisKXSy.exe
  C:\Windows\System\FisKXSy.exe
  2⤵
  PID:8876
- C:\Windows\System\YWxRPae.exe
  C:\Windows\System\YWxRPae.exe
  2⤵
  PID:8912
- C:\Windows\System\LidVuZs.exe
  C:\Windows\System\LidVuZs.exe
  2⤵
  PID:8956
- C:\Windows\System\HvQTjWi.exe
  C:\Windows\System\HvQTjWi.exe
  2⤵
  PID:9020
- C:\Windows\System\LXwNHsx.exe
  C:\Windows\System\LXwNHsx.exe
  2⤵
  PID:9072
- C:\Windows\System\KcKAxDb.exe
  C:\Windows\System\KcKAxDb.exe
  2⤵
  PID:9120
- C:\Windows\System\EuQbgCS.exe
  C:\Windows\System\EuQbgCS.exe
  2⤵
  PID:9156
- C:\Windows\System\QtqlGAp.exe
  C:\Windows\System\QtqlGAp.exe
  2⤵
  PID:9196
- C:\Windows\System\dQACUlt.exe
  C:\Windows\System\dQACUlt.exe
  2⤵
  PID:6424
- C:\Windows\System\nUSwiwV.exe
  C:\Windows\System\nUSwiwV.exe
  2⤵
  PID:7660
- C:\Windows\System\PIppiwE.exe
  C:\Windows\System\PIppiwE.exe
  2⤵
  PID:7784
- C:\Windows\System\CDFOoxe.exe
  C:\Windows\System\CDFOoxe.exe
  2⤵
  PID:7920
- C:\Windows\System\bhHOGQl.exe
  C:\Windows\System\bhHOGQl.exe
  2⤵
  PID:8060
- C:\Windows\System\cQcDXRA.exe
  C:\Windows\System\cQcDXRA.exe
  2⤵
  PID:7648
- C:\Windows\System\tspedPG.exe
  C:\Windows\System\tspedPG.exe
  2⤵
  PID:8312
- C:\Windows\System\smxlMby.exe
  C:\Windows\System\smxlMby.exe
  2⤵
  PID:8400
- C:\Windows\System\xLXODfd.exe
  C:\Windows\System\xLXODfd.exe
  2⤵
  PID:8492
- C:\Windows\System\sHZxICv.exe
  C:\Windows\System\sHZxICv.exe
  2⤵
  PID:7708
- C:\Windows\System\IvAFRmB.exe
  C:\Windows\System\IvAFRmB.exe
  2⤵
  PID:8184
- C:\Windows\System\tCXmNup.exe
  C:\Windows\System\tCXmNup.exe
  2⤵
  PID:6924
- C:\Windows\System\XWAwQpj.exe
  C:\Windows\System\XWAwQpj.exe
  2⤵
  PID:364
- C:\Windows\System\TjHxrNy.exe
  C:\Windows\System\TjHxrNy.exe
  2⤵
  PID:1388
- C:\Windows\System\ezTUTyT.exe
  C:\Windows\System\ezTUTyT.exe
  2⤵
  PID:9240
- C:\Windows\System\ZFFcQzm.exe
  C:\Windows\System\ZFFcQzm.exe
  2⤵
  PID:9284
- C:\Windows\System\ynWWHAZ.exe
  C:\Windows\System\ynWWHAZ.exe
  2⤵
  PID:9396
- C:\Windows\System\rcsGvVp.exe
  C:\Windows\System\rcsGvVp.exe
  2⤵
  PID:4560
- C:\Windows\System\csvlfBW.exe
  C:\Windows\System\csvlfBW.exe
  2⤵
  PID:1584
- C:\Windows\System\LPjdiuX.exe
  C:\Windows\System\LPjdiuX.exe
  2⤵
  PID:1152
- C:\Windows\System\JElpydx.exe
  C:\Windows\System\JElpydx.exe
  2⤵
  PID:4948
- C:\Windows\System\jnbiZrS.exe
  C:\Windows\System\jnbiZrS.exe
  2⤵
  PID:2444
- C:\Windows\System\oTGYErx.exe
  C:\Windows\System\oTGYErx.exe
  2⤵
  PID:9420
- C:\Windows\System\UmURbzl.exe
  C:\Windows\System\UmURbzl.exe
  2⤵
  PID:9572
- C:\Windows\System\khYeQMQ.exe
  C:\Windows\System\khYeQMQ.exe
  2⤵
  PID:9740
- C:\Windows\System\gRHfBJX.exe
  C:\Windows\System\gRHfBJX.exe
  2⤵
  PID:9972
- C:\Windows\System\vtCgnuA.exe
  C:\Windows\System\vtCgnuA.exe
  2⤵
  PID:10248
- C:\Windows\System\qCMAPrx.exe
  C:\Windows\System\qCMAPrx.exe
  2⤵
  PID:10276
- C:\Windows\System\pPUzdCI.exe
  C:\Windows\System\pPUzdCI.exe
  2⤵
  PID:10324
- C:\Windows\System\AhvJNFY.exe
  C:\Windows\System\AhvJNFY.exe
  2⤵
  PID:10360
- C:\Windows\System\VelznTp.exe
  C:\Windows\System\VelznTp.exe
  2⤵
  PID:10388
- C:\Windows\System\gQIvDHO.exe
  C:\Windows\System\gQIvDHO.exe
  2⤵
  PID:10404
- C:\Windows\System\LzzeSAc.exe
  C:\Windows\System\LzzeSAc.exe
  2⤵
  PID:10436
- C:\Windows\System\SGdsAaJ.exe
  C:\Windows\System\SGdsAaJ.exe
  2⤵
  PID:10452
- C:\Windows\System\gJgERaW.exe
  C:\Windows\System\gJgERaW.exe
  2⤵
  PID:10468
- C:\Windows\System\JwZNyxT.exe
  C:\Windows\System\JwZNyxT.exe
  2⤵
  PID:10488
- C:\Windows\System\gqKoIXU.exe
  C:\Windows\System\gqKoIXU.exe
  2⤵
  PID:10508
- C:\Windows\System\VRtfRtE.exe
  C:\Windows\System\VRtfRtE.exe
  2⤵
  PID:10524
- C:\Windows\System\HpYNkyn.exe
  C:\Windows\System\HpYNkyn.exe
  2⤵
  PID:10544
- C:\Windows\System\uyFGuev.exe
  C:\Windows\System\uyFGuev.exe
  2⤵
  PID:10564
- C:\Windows\System\IqZloUi.exe
  C:\Windows\System\IqZloUi.exe
  2⤵
  PID:10584
- C:\Windows\System\eTxlVpE.exe
  C:\Windows\System\eTxlVpE.exe
  2⤵
  PID:10604
- C:\Windows\System\hOaOgbY.exe
  C:\Windows\System\hOaOgbY.exe
  2⤵
  PID:10620
- C:\Windows\System\bxgajmL.exe
  C:\Windows\System\bxgajmL.exe
  2⤵
  PID:10640
- C:\Windows\System\gtKLteL.exe
  C:\Windows\System\gtKLteL.exe
  2⤵
  PID:10660
- C:\Windows\System\AaRrSAm.exe
  C:\Windows\System\AaRrSAm.exe
  2⤵
  PID:10680
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 10680 -s 240
    3⤵
    PID:11520
- C:\Windows\System\KOcOaEV.exe
  C:\Windows\System\KOcOaEV.exe
  2⤵
  PID:10700
- C:\Windows\System\ALqjUos.exe
  C:\Windows\System\ALqjUos.exe
  2⤵
  PID:10720
- C:\Windows\System\WZipQGP.exe
  C:\Windows\System\WZipQGP.exe
  2⤵
  PID:10736
- C:\Windows\System\IcvYDUU.exe
  C:\Windows\System\IcvYDUU.exe
  2⤵
  PID:10756
- C:\Windows\System\fhgqgXt.exe
  C:\Windows\System\fhgqgXt.exe
  2⤵
  PID:10780
- C:\Windows\System\NHkbQNt.exe
  C:\Windows\System\NHkbQNt.exe
  2⤵
  PID:10808
- C:\Windows\System\uKmDjtN.exe
  C:\Windows\System\uKmDjtN.exe
  2⤵
  PID:10828
- C:\Windows\System\VANvjvR.exe
  C:\Windows\System\VANvjvR.exe
  2⤵
  PID:10848
- C:\Windows\System\YIVCaRl.exe
  C:\Windows\System\YIVCaRl.exe
  2⤵
  PID:10868
- C:\Windows\System\PSzHzqz.exe
  C:\Windows\System\PSzHzqz.exe
  2⤵
  PID:10892
- C:\Windows\System\oIyoykO.exe
  C:\Windows\System\oIyoykO.exe
  2⤵
  PID:10908
- C:\Windows\System\lOGGykv.exe
  C:\Windows\System\lOGGykv.exe
  2⤵
  PID:10932
- C:\Windows\System\PNoHLiA.exe
  C:\Windows\System\PNoHLiA.exe
  2⤵
  PID:10948
- C:\Windows\System\KEEOvsx.exe
  C:\Windows\System\KEEOvsx.exe
  2⤵
  PID:10996
- C:\Windows\System\JOyvWzy.exe
  C:\Windows\System\JOyvWzy.exe
  2⤵
  PID:11016
- C:\Windows\System\hvXxNfQ.exe
  C:\Windows\System\hvXxNfQ.exe
  2⤵
  PID:11040
- C:\Windows\System\jfNxsGl.exe
  C:\Windows\System\jfNxsGl.exe
  2⤵
  PID:11056
- C:\Windows\System\NZTwNRh.exe
  C:\Windows\System\NZTwNRh.exe
  2⤵
  PID:11080
- C:\Windows\System\XiMEjCx.exe
  C:\Windows\System\XiMEjCx.exe
  2⤵
  PID:11108
- C:\Windows\System\VoKISmr.exe
  C:\Windows\System\VoKISmr.exe
  2⤵
  PID:11124
- C:\Windows\System\QumVUzQ.exe
  C:\Windows\System\QumVUzQ.exe
  2⤵
  PID:11140
- C:\Windows\System\XmrUzJc.exe
  C:\Windows\System\XmrUzJc.exe
  2⤵
  PID:11156
- C:\Windows\System\lqEpaAL.exe
  C:\Windows\System\lqEpaAL.exe
  2⤵
  PID:11176
- C:\Windows\System\TAmlcOE.exe
  C:\Windows\System\TAmlcOE.exe
  2⤵
  PID:11192
- C:\Windows\System\JMjxzSs.exe
  C:\Windows\System\JMjxzSs.exe
  2⤵
  PID:11216
- C:\Windows\System\PKZIkTn.exe
  C:\Windows\System\PKZIkTn.exe
  2⤵
  PID:11236
- C:\Windows\System\aHmbKwP.exe
  C:\Windows\System\aHmbKwP.exe
  2⤵
  PID:11260
- C:\Windows\System\oCoozKu.exe
  C:\Windows\System\oCoozKu.exe
  2⤵
  PID:9460
- C:\Windows\System\JtflTGx.exe
  C:\Windows\System\JtflTGx.exe
  2⤵
  PID:9496
- C:\Windows\System\rZyRxkj.exe
  C:\Windows\System\rZyRxkj.exe
  2⤵
  PID:9552
- C:\Windows\System\FFtVkHE.exe
  C:\Windows\System\FFtVkHE.exe
  2⤵
  PID:9612
- C:\Windows\System\KsojneL.exe
  C:\Windows\System\KsojneL.exe
  2⤵
  PID:9656
- C:\Windows\System\pfHjEfG.exe
  C:\Windows\System\pfHjEfG.exe
  2⤵
  PID:9784
- C:\Windows\System\uxdjjaS.exe
  C:\Windows\System\uxdjjaS.exe
  2⤵
  PID:9820
- C:\Windows\System\XvKZZlw.exe
  C:\Windows\System\XvKZZlw.exe
  2⤵
  PID:9868
- C:\Windows\System\RJvRInv.exe
  C:\Windows\System\RJvRInv.exe
  2⤵
  PID:8256
- C:\Windows\System\YRiHYWF.exe
  C:\Windows\System\YRiHYWF.exe
  2⤵
  PID:8648
- C:\Windows\System\ZqWafhQ.exe
  C:\Windows\System\ZqWafhQ.exe
  2⤵
  PID:8908
- C:\Windows\System\JaNMTRk.exe
  C:\Windows\System\JaNMTRk.exe
  2⤵
  PID:7588
- C:\Windows\System\wilTECT.exe
  C:\Windows\System\wilTECT.exe
  2⤵
  PID:8368
- C:\Windows\System\DBeXCen.exe
  C:\Windows\System\DBeXCen.exe
  2⤵
  PID:7632
- C:\Windows\System\VxyyiVh.exe
  C:\Windows\System\VxyyiVh.exe
  2⤵
  PID:11272
- C:\Windows\System\aEEQvPd.exe
  C:\Windows\System\aEEQvPd.exe
  2⤵
  PID:11288
- C:\Windows\System\tiSBlJn.exe
  C:\Windows\System\tiSBlJn.exe
  2⤵
  PID:11312
- C:\Windows\System\hialwGN.exe
  C:\Windows\System\hialwGN.exe
  2⤵
  PID:11336
- C:\Windows\System\OsDFpbl.exe
  C:\Windows\System\OsDFpbl.exe
  2⤵
  PID:11360
- C:\Windows\System\ZgmkXZb.exe
  C:\Windows\System\ZgmkXZb.exe
  2⤵
  PID:11376
- C:\Windows\System\hHhRtmc.exe
  C:\Windows\System\hHhRtmc.exe
  2⤵
  PID:11404
- C:\Windows\System\OLvlvDq.exe
  C:\Windows\System\OLvlvDq.exe
  2⤵
  PID:11420
- C:\Windows\System\rLKlMDA.exe
  C:\Windows\System\rLKlMDA.exe
  2⤵
  PID:11444
- C:\Windows\System\mSfyPDl.exe
  C:\Windows\System\mSfyPDl.exe
  2⤵
  PID:11464
- C:\Windows\System\yCBbnMo.exe
  C:\Windows\System\yCBbnMo.exe
  2⤵
  PID:11492
- C:\Windows\System\xTgFIDe.exe
  C:\Windows\System\xTgFIDe.exe
  2⤵
  PID:11512
- C:\Windows\System\QOoDIts.exe
  C:\Windows\System\QOoDIts.exe
  2⤵
  PID:11536
- C:\Windows\System\uPpZFsO.exe
  C:\Windows\System\uPpZFsO.exe
  2⤵
  PID:11560
- C:\Windows\System\WnmggwY.exe
  C:\Windows\System\WnmggwY.exe
  2⤵
  PID:11584
- C:\Windows\System\UmhqMPC.exe
  C:\Windows\System\UmhqMPC.exe
  2⤵
  PID:11604
- C:\Windows\System\YrweLLz.exe
  C:\Windows\System\YrweLLz.exe
  2⤵
  PID:11656
- C:\Windows\System\IhqWnui.exe
  C:\Windows\System\IhqWnui.exe
  2⤵
  PID:11676
- C:\Windows\System\hDTFcvv.exe
  C:\Windows\System\hDTFcvv.exe
  2⤵
  PID:11704
- C:\Windows\System\kkithCI.exe
  C:\Windows\System\kkithCI.exe
  2⤵
  PID:11720
- C:\Windows\System\pxunezN.exe
  C:\Windows\System\pxunezN.exe
  2⤵
  PID:11748
- C:\Windows\System\nHgvXEm.exe
  C:\Windows\System\nHgvXEm.exe
  2⤵
  PID:11780
- C:\Windows\System\GXTVnid.exe
  C:\Windows\System\GXTVnid.exe
  2⤵
  PID:11816
- C:\Windows\System\YppFOCz.exe
  C:\Windows\System\YppFOCz.exe
  2⤵
  PID:11848
- C:\Windows\System\vyDExud.exe
  C:\Windows\System\vyDExud.exe
  2⤵
  PID:11868
- C:\Windows\System\FbpyIiO.exe
  C:\Windows\System\FbpyIiO.exe
  2⤵
  PID:11888
- C:\Windows\System\wcOyKdH.exe
  C:\Windows\System\wcOyKdH.exe
  2⤵
  PID:11912
- C:\Windows\System\aPShuii.exe
  C:\Windows\System\aPShuii.exe
  2⤵
  PID:11932
- C:\Windows\System\zatYpAQ.exe
  C:\Windows\System\zatYpAQ.exe
  2⤵
  PID:11952
- C:\Windows\System\JVJnuKo.exe
  C:\Windows\System\JVJnuKo.exe
  2⤵
  PID:11972
- C:\Windows\System\PNnawQT.exe
  C:\Windows\System\PNnawQT.exe
  2⤵
  PID:11988
- C:\Windows\System\FrtrZXD.exe
  C:\Windows\System\FrtrZXD.exe
  2⤵
  PID:12004
- C:\Windows\System\wfjtPVe.exe
  C:\Windows\System\wfjtPVe.exe
  2⤵
  PID:12028
- C:\Windows\System\tOyvxEm.exe
  C:\Windows\System\tOyvxEm.exe
  2⤵
  PID:12048
- C:\Windows\System\OsXlymu.exe
  C:\Windows\System\OsXlymu.exe
  2⤵
  PID:12068
- C:\Windows\System\Ywcbeuj.exe
  C:\Windows\System\Ywcbeuj.exe
  2⤵
  PID:12088
- C:\Windows\System\ezbFTwU.exe
  C:\Windows\System\ezbFTwU.exe
  2⤵
  PID:12112
- C:\Windows\System\PWEYfRL.exe
  C:\Windows\System\PWEYfRL.exe
  2⤵
  PID:12132
- C:\Windows\System\ltiecly.exe
  C:\Windows\System\ltiecly.exe
  2⤵
  PID:12152
- C:\Windows\System\HqFLQnZ.exe
  C:\Windows\System\HqFLQnZ.exe
  2⤵
  PID:12184
- C:\Windows\System\OKJuRMU.exe
  C:\Windows\System\OKJuRMU.exe
  2⤵
  PID:12204
- C:\Windows\System\fnbPlAy.exe
  C:\Windows\System\fnbPlAy.exe
  2⤵
  PID:12224
- C:\Windows\System\vyaHwAk.exe
  C:\Windows\System\vyaHwAk.exe
  2⤵
  PID:12248
- C:\Windows\System\JdggPaf.exe
  C:\Windows\System\JdggPaf.exe
  2⤵
  PID:12268
- C:\Windows\System\poDiNJI.exe
  C:\Windows\System\poDiNJI.exe
  2⤵
  PID:12284
- C:\Windows\System\LAZHIjU.exe
  C:\Windows\System\LAZHIjU.exe
  2⤵
  PID:768
- C:\Windows\System\pIqURbN.exe
  C:\Windows\System\pIqURbN.exe
  2⤵
  PID:2720
- C:\Windows\System\DznQxBb.exe
  C:\Windows\System\DznQxBb.exe
  2⤵
  PID:4532
- C:\Windows\System\RIeGGeX.exe
  C:\Windows\System\RIeGGeX.exe
  2⤵
  PID:9416
- C:\Windows\System\ZqZxbbZ.exe
  C:\Windows\System\ZqZxbbZ.exe
  2⤵
  PID:10264
- C:\Windows\System\vbUImmE.exe
  C:\Windows\System\vbUImmE.exe
  2⤵
  PID:10464
- C:\Windows\System\dxmLagv.exe
  C:\Windows\System\dxmLagv.exe
  2⤵
  PID:10540
- C:\Windows\System\aGcEVcu.exe
  C:\Windows\System\aGcEVcu.exe
  2⤵
  PID:10496
- C:\Windows\System\GBnMpUc.exe
  C:\Windows\System\GBnMpUc.exe
  2⤵
  PID:10460
- C:\Windows\System\nFjUwVh.exe
  C:\Windows\System\nFjUwVh.exe
  2⤵
  PID:10712
- C:\Windows\System\uRiWNtq.exe
  C:\Windows\System\uRiWNtq.exe
  2⤵
  PID:10788
- C:\Windows\System\WmqzTEE.exe
  C:\Windows\System\WmqzTEE.exe
  2⤵
  PID:10844
- C:\Windows\System\iikgbzl.exe
  C:\Windows\System\iikgbzl.exe
  2⤵
  PID:10024
- C:\Windows\System\HXaWabj.exe
  C:\Windows\System\HXaWabj.exe
  2⤵
  PID:10100
- C:\Windows\System\TLeHHra.exe
  C:\Windows\System\TLeHHra.exe
  2⤵
  PID:10160
- C:\Windows\System\qJIkddy.exe
  C:\Windows\System\qJIkddy.exe
  2⤵
  PID:10200
- C:\Windows\System\gZeZywF.exe
  C:\Windows\System\gZeZywF.exe
  2⤵
  PID:8512
- C:\Windows\System\jFioWKd.exe
  C:\Windows\System\jFioWKd.exe
  2⤵
  PID:11052
- C:\Windows\System\wyReLCd.exe
  C:\Windows\System\wyReLCd.exe
  2⤵
  PID:8952
- C:\Windows\System\mSpgnqM.exe
  C:\Windows\System\mSpgnqM.exe
  2⤵
  PID:7476
- C:\Windows\System\qFKzuzM.exe
  C:\Windows\System\qFKzuzM.exe
  2⤵
  PID:12296
- C:\Windows\System\BMCFihO.exe
  C:\Windows\System\BMCFihO.exe
  2⤵
  PID:12320
- C:\Windows\System\DofoNSR.exe
  C:\Windows\System\DofoNSR.exe
  2⤵
  PID:12340
- C:\Windows\System\ipxuXVo.exe
  C:\Windows\System\ipxuXVo.exe
  2⤵
  PID:12356
- C:\Windows\System\wulMjiZ.exe
  C:\Windows\System\wulMjiZ.exe
  2⤵
  PID:12376
- C:\Windows\System\NAWmsUw.exe
  C:\Windows\System\NAWmsUw.exe
  2⤵
  PID:12400
- C:\Windows\System\NmjHPMd.exe
  C:\Windows\System\NmjHPMd.exe
  2⤵
  PID:12420
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12420 -s 28
    3⤵
    PID:11924
- C:\Windows\System\WTcWTSw.exe
  C:\Windows\System\WTcWTSw.exe
  2⤵
  PID:12444
- C:\Windows\System\rxqPvDy.exe
  C:\Windows\System\rxqPvDy.exe
  2⤵
  PID:12464
- C:\Windows\System\eaWxIBu.exe
  C:\Windows\System\eaWxIBu.exe
  2⤵
  PID:12484
- C:\Windows\System\ZXcRkHz.exe
  C:\Windows\System\ZXcRkHz.exe
  2⤵
  PID:12508
- C:\Windows\System\tLqmWqa.exe
  C:\Windows\System\tLqmWqa.exe
  2⤵
  PID:12532
- C:\Windows\System\AVwLEdy.exe
  C:\Windows\System\AVwLEdy.exe
  2⤵
  PID:12548
- C:\Windows\System\oTxtGEd.exe
  C:\Windows\System\oTxtGEd.exe
  2⤵
  PID:12572
- C:\Windows\System\CXZvHtp.exe
  C:\Windows\System\CXZvHtp.exe
  2⤵
  PID:12596
- C:\Windows\System\SlngBAm.exe
  C:\Windows\System\SlngBAm.exe
  2⤵
  PID:12616
- C:\Windows\System\qYqsspH.exe
  C:\Windows\System\qYqsspH.exe
  2⤵
  PID:12640
- C:\Windows\System\tEcCZgV.exe
  C:\Windows\System\tEcCZgV.exe
  2⤵
  PID:12664
- C:\Windows\System\CSdfHpQ.exe
  C:\Windows\System\CSdfHpQ.exe
  2⤵
  PID:12692
- C:\Windows\System\OMvUHVo.exe
  C:\Windows\System\OMvUHVo.exe
  2⤵
  PID:12716
- C:\Windows\System\OlKJzcz.exe
  C:\Windows\System\OlKJzcz.exe
  2⤵
  PID:12740
- C:\Windows\System\dzzOrSJ.exe
  C:\Windows\System\dzzOrSJ.exe
  2⤵
  PID:12760
- C:\Windows\System\zDmEnIx.exe
  C:\Windows\System\zDmEnIx.exe
  2⤵
  PID:12788
- C:\Windows\System\hyYQgMt.exe
  C:\Windows\System\hyYQgMt.exe
  2⤵
  PID:12804
- C:\Windows\System\xfifgiD.exe
  C:\Windows\System\xfifgiD.exe
  2⤵
  PID:12824
- C:\Windows\System\YsqOfVk.exe
  C:\Windows\System\YsqOfVk.exe
  2⤵
  PID:12852
- C:\Windows\System\GZcSOIL.exe
  C:\Windows\System\GZcSOIL.exe
  2⤵
  PID:12872
- C:\Windows\System\aIkKWJk.exe
  C:\Windows\System\aIkKWJk.exe
  2⤵
  PID:12892
- C:\Windows\System\MAFtyrE.exe
  C:\Windows\System\MAFtyrE.exe
  2⤵
  PID:12912
- C:\Windows\System\uGHVkPZ.exe
  C:\Windows\System\uGHVkPZ.exe
  2⤵
  PID:12936
- C:\Windows\System\HuQchVp.exe
  C:\Windows\System\HuQchVp.exe
  2⤵
  PID:12956
- C:\Windows\System\NEsFJEM.exe
  C:\Windows\System\NEsFJEM.exe
  2⤵
  PID:12984
- C:\Windows\System\cAmlgEP.exe
  C:\Windows\System\cAmlgEP.exe
  2⤵
  PID:13004
- C:\Windows\System\cxJdGtg.exe
  C:\Windows\System\cxJdGtg.exe
  2⤵
  PID:13028
- C:\Windows\System\EoBqIMp.exe
  C:\Windows\System\EoBqIMp.exe
  2⤵
  PID:8948
- C:\Windows\System\bvoUAaH.exe
  C:\Windows\System\bvoUAaH.exe
  2⤵
  PID:10956
- C:\Windows\System\adheprN.exe
  C:\Windows\System\adheprN.exe
  2⤵
  PID:9304
- C:\Windows\System\kulHOTv.exe
  C:\Windows\System\kulHOTv.exe
  2⤵
  PID:3968
- C:\Windows\System\FHrQxre.exe
  C:\Windows\System\FHrQxre.exe
  2⤵
  PID:12780
- C:\Windows\System\BNBRgva.exe
  C:\Windows\System\BNBRgva.exe
  2⤵
  PID:1508
- C:\Windows\System\ZZlfMCZ.exe
  C:\Windows\System\ZZlfMCZ.exe
  2⤵
  PID:12080
- C:\Windows\System\yKmLfPc.exe
  C:\Windows\System\yKmLfPc.exe
  2⤵
  PID:12000
- C:\Windows\System\jNJSPuD.exe
  C:\Windows\System\jNJSPuD.exe
  2⤵
  PID:10676
- C:\Windows\System\NEIHFPD.exe
  C:\Windows\System\NEIHFPD.exe
  2⤵
  PID:11948
- C:\Windows\System\EXgWLAW.exe
  C:\Windows\System\EXgWLAW.exe
  2⤵
  PID:10600
- C:\Windows\System\gmMvVpY.exe
  C:\Windows\System\gmMvVpY.exe
  2⤵
  PID:11828
- C:\Windows\System\meVnKbA.exe
  C:\Windows\System\meVnKbA.exe
  2⤵
  PID:8012
- C:\Windows\System\qFLNohs.exe
  C:\Windows\System\qFLNohs.exe
  2⤵
  PID:10708
- C:\Windows\System\EyrOmex.exe
  C:\Windows\System\EyrOmex.exe
  2⤵
  PID:11168
- C:\Windows\System\OuCQolR.exe
  C:\Windows\System\OuCQolR.exe
  2⤵
  PID:12556
- C:\Windows\System\hAGJFKX.exe
  C:\Windows\System\hAGJFKX.exe
  2⤵
  PID:11712
- C:\Windows\System\kbgtFrz.exe
  C:\Windows\System\kbgtFrz.exe
  2⤵
  PID:11248
- C:\Windows\System\kWCQCpq.exe
  C:\Windows\System\kWCQCpq.exe
  2⤵
  PID:10184
- C:\Windows\System\wXPzyfo.exe
  C:\Windows\System\wXPzyfo.exe
  2⤵
  PID:8448
- C:\Windows\System\FKwUBPD.exe
  C:\Windows\System\FKwUBPD.exe
  2⤵
  PID:11076
- C:\Windows\System\WAVldlo.exe
  C:\Windows\System\WAVldlo.exe
  2⤵
  PID:12680
- C:\Windows\System\TymAjcW.exe
  C:\Windows\System\TymAjcW.exe
  2⤵
  PID:12308
- C:\Windows\System\tdRGjeR.exe
  C:\Windows\System\tdRGjeR.exe
  2⤵
  PID:5068
- C:\Windows\System\VuqjedA.exe
  C:\Windows\System\VuqjedA.exe
  2⤵
  PID:10244
- C:\Windows\System\oFkHqee.exe
  C:\Windows\System\oFkHqee.exe
  2⤵
  PID:10352
- C:\Windows\System\vNJZaTo.exe
  C:\Windows\System\vNJZaTo.exe
  2⤵
  PID:12584
- C:\Windows\System\SFnYqph.exe
  C:\Windows\System\SFnYqph.exe
  2⤵
  PID:12632
- C:\Windows\System\PIsdXjQ.exe
  C:\Windows\System\PIsdXjQ.exe
  2⤵
  PID:12840
- C:\Windows\System\acVxbSH.exe
  C:\Windows\System\acVxbSH.exe
  2⤵
  PID:12900
- C:\Windows\System\JEjqsEJ.exe
  C:\Windows\System\JEjqsEJ.exe
  2⤵
  PID:11864
- C:\Windows\System\weQtXKL.exe
  C:\Windows\System\weQtXKL.exe
  2⤵
  PID:11968
- C:\Windows\System\YEXBBvQ.exe
  C:\Windows\System\YEXBBvQ.exe
  2⤵
  PID:12652
- C:\Windows\System\vWNPQFS.exe
  C:\Windows\System\vWNPQFS.exe
  2⤵
  PID:11960
- C:\Windows\System\AgbNDrk.exe
  C:\Windows\System\AgbNDrk.exe
  2⤵
  PID:9264
- C:\Windows\System\OjjCCPK.exe
  C:\Windows\System\OjjCCPK.exe
  2⤵
  PID:3344
- C:\Windows\System\BNtrMTd.exe
  C:\Windows\System\BNtrMTd.exe
  2⤵
  PID:8932
- C:\Windows\System\fmukCeQ.exe
  C:\Windows\System\fmukCeQ.exe
  2⤵
  PID:8860
- C:\Windows\System\qXseJiL.exe
  C:\Windows\System\qXseJiL.exe
  2⤵
  PID:9588
- C:\Windows\System\kjoQafz.exe
  C:\Windows\System\kjoQafz.exe
  2⤵
  PID:2672
- C:\Windows\System\prhHExp.exe
  C:\Windows\System\prhHExp.exe
  2⤵
  PID:10384
- C:\Windows\System\SiriDKh.exe
  C:\Windows\System\SiriDKh.exe
  2⤵
  PID:12612
- C:\Windows\System\mFtcoRv.exe
  C:\Windows\System\mFtcoRv.exe
  2⤵
  PID:11520
- C:\Windows\System\XVttLPt.exe
  C:\Windows\System\XVttLPt.exe
  2⤵
  PID:11788
- C:\Windows\System\OGJKFXH.exe
  C:\Windows\System\OGJKFXH.exe
  2⤵
  PID:3088
- C:\Windows\System\FDMJqNG.exe
  C:\Windows\System\FDMJqNG.exe
  2⤵
  PID:11544
- C:\Windows\System\xHBKRUw.exe
  C:\Windows\System\xHBKRUw.exe
  2⤵
  PID:10764
- C:\Windows\System\JVoJfrg.exe
  C:\Windows\System\JVoJfrg.exe
  2⤵
  PID:12972
- C:\Windows\System\MSDuALi.exe
  C:\Windows\System\MSDuALi.exe
  2⤵
  PID:10088
- C:\Windows\System\bhMIeQM.exe
  C:\Windows\System\bhMIeQM.exe
  2⤵
  PID:9224
- C:\Windows\System\fBaMBFs.exe
  C:\Windows\System\fBaMBFs.exe
  2⤵
  PID:3624
- C:\Windows\System\YbPfgJj.exe
  C:\Windows\System\YbPfgJj.exe
  2⤵
  PID:12264
- C:\Windows\System\CzWVWja.exe
  C:\Windows\System\CzWVWja.exe
  2⤵
  PID:11900
- C:\Windows\System\GlamHiE.exe
  C:\Windows\System\GlamHiE.exe
  2⤵
  PID:13176
- C:\Windows\System\BDCzYdH.exe
  C:\Windows\System\BDCzYdH.exe
  2⤵
  PID:5776
- C:\Windows\System\oagoxtq.exe
  C:\Windows\System\oagoxtq.exe
  2⤵
  PID:1260
- C:\Windows\System\FMcZsbn.exe
  C:\Windows\System\FMcZsbn.exe
  2⤵
  PID:4820
- C:\Windows\System\vyLHGhQ.exe
  C:\Windows\System\vyLHGhQ.exe
  2⤵
  PID:6224
- C:\Windows\System\GfEpEst.exe
  C:\Windows\System\GfEpEst.exe
  2⤵
  PID:7596
- C:\Windows\System\ohNNqRQ.exe
  C:\Windows\System\ohNNqRQ.exe
  2⤵
  PID:11736
- C:\Windows\System\BezYAwt.exe
  C:\Windows\System\BezYAwt.exe
  2⤵
  PID:12276
- C:\Windows\System\xsSAOuv.exe
  C:\Windows\System\xsSAOuv.exe
  2⤵
  PID:4016
- C:\Windows\System\TuNJbVw.exe
  C:\Windows\System\TuNJbVw.exe
  2⤵
  PID:9344
- C:\Windows\System\ULstDbV.exe
  C:\Windows\System\ULstDbV.exe
  2⤵
  PID:11924
- C:\Windows\System\FupdFqX.exe
  C:\Windows\System\FupdFqX.exe
  2⤵
  PID:4708
- C:\Windows\System\YNorzsR.exe
  C:\Windows\System\YNorzsR.exe
  2⤵
  PID:13336
- C:\Windows\System\zXhQOUX.exe
  C:\Windows\System\zXhQOUX.exe
  2⤵
  PID:13400
- C:\Windows\System\gsbikeR.exe
  C:\Windows\System\gsbikeR.exe
  2⤵
  PID:13488
- C:\Windows\System\SPRTYLz.exe
  C:\Windows\System\SPRTYLz.exe
  2⤵
  PID:13512
- C:\Windows\System\WbygxoX.exe
  C:\Windows\System\WbygxoX.exe
  2⤵
  PID:13660
- C:\Windows\System\pdedaSW.exe
  C:\Windows\System\pdedaSW.exe
  2⤵
  PID:13708
- C:\Windows\System\NAbWUqC.exe
  C:\Windows\System\NAbWUqC.exe
  2⤵
  PID:13792
- C:\Windows\System\CfWDnXl.exe
  C:\Windows\System\CfWDnXl.exe
  2⤵
  PID:14020
- C:\Windows\System\VwtNyXD.exe
  C:\Windows\System\VwtNyXD.exe
  2⤵
  PID:14064
- C:\Windows\System\RsGTyiq.exe
  C:\Windows\System\RsGTyiq.exe
  2⤵
  PID:8296
- C:\Windows\System\BVhvVtw.exe
  C:\Windows\System\BVhvVtw.exe
  2⤵
  PID:12040
- C:\Windows\System\HIqqmJZ.exe
  C:\Windows\System\HIqqmJZ.exe
  2⤵
  PID:13360
- C:\Windows\System\VfNWdRh.exe
  C:\Windows\System\VfNWdRh.exe
  2⤵
  PID:13816
- C:\Windows\System\dwcskXe.exe
  C:\Windows\System\dwcskXe.exe
  2⤵
  PID:13736
- C:\Windows\System\gnLzGWz.exe
  C:\Windows\System\gnLzGWz.exe
  2⤵
  PID:2596
- C:\Windows\System\IyxPWpH.exe
  C:\Windows\System\IyxPWpH.exe
  2⤵
  PID:14208
- C:\Windows\System\EorODRt.exe
  C:\Windows\System\EorODRt.exe
  2⤵
  PID:14220
- C:\Windows\System\lGAEoCa.exe
  C:\Windows\System\lGAEoCa.exe
  2⤵
  PID:14236
- C:\Windows\System\aOtXEzg.exe
  C:\Windows\System\aOtXEzg.exe
  2⤵
  PID:14260
- C:\Windows\System\XvzBjCF.exe
  C:\Windows\System\XvzBjCF.exe
  2⤵
  PID:14168
- C:\Windows\System\aBvWJrz.exe
  C:\Windows\System\aBvWJrz.exe
  2⤵
  PID:14284
- C:\Windows\System\vtFnIFW.exe
  C:\Windows\System\vtFnIFW.exe
  2⤵
  PID:14292
- C:\Windows\System\oDECeHE.exe
  C:\Windows\System\oDECeHE.exe
  2⤵
  PID:14316
- C:\Windows\System\meEMGRI.exe
  C:\Windows\System\meEMGRI.exe
  2⤵
  PID:11548
- C:\Windows\System\sZmSABm.exe
  C:\Windows\System\sZmSABm.exe
  2⤵
  PID:3704
- C:\Windows\System\KmklMkd.exe
  C:\Windows\System\KmklMkd.exe
  2⤵
  PID:588
- C:\Windows\System\tTcElkS.exe
  C:\Windows\System\tTcElkS.exe
  2⤵
  PID:2224
- C:\Windows\System\zdJUlpe.exe
  C:\Windows\System\zdJUlpe.exe
  2⤵
  PID:13192
- C:\Windows\System\tsTDGXr.exe
  C:\Windows\System\tsTDGXr.exe
  2⤵
  PID:3812
- C:\Windows\System\BYvuCEB.exe
  C:\Windows\System\BYvuCEB.exe
  2⤵
  PID:8556
- C:\Windows\System\RygTqId.exe
  C:\Windows\System\RygTqId.exe
  2⤵
  PID:3396
- C:\Windows\System\HOhgFJx.exe
  C:\Windows\System\HOhgFJx.exe
  2⤵
  PID:3628
- C:\Windows\System\dDwAQlb.exe
  C:\Windows\System\dDwAQlb.exe
  2⤵
  PID:13440
- C:\Windows\System\kEyQPqU.exe
  C:\Windows\System\kEyQPqU.exe
  2⤵
  PID:10668
- C:\Windows\System\YNGXjHF.exe
  C:\Windows\System\YNGXjHF.exe
  2⤵
  PID:4264
- C:\Windows\System\klRakGf.exe
  C:\Windows\System\klRakGf.exe
  2⤵
  PID:13416
- C:\Windows\System\FfdyXsq.exe
  C:\Windows\System\FfdyXsq.exe
  2⤵
  PID:13684
- C:\Windows\System\mlXIjit.exe
  C:\Windows\System\mlXIjit.exe
  2⤵
  PID:4388
- C:\Windows\System\KUkhMkd.exe
  C:\Windows\System\KUkhMkd.exe
  2⤵
  PID:13652
- C:\Windows\System\rSogdxo.exe
  C:\Windows\System\rSogdxo.exe
  2⤵
  PID:13784
- C:\Windows\System\ubhqRDV.exe
  C:\Windows\System\ubhqRDV.exe
  2⤵
  PID:13900
- C:\Windows\System\bZOpxKR.exe
  C:\Windows\System\bZOpxKR.exe
  2⤵
  PID:13636
- C:\Windows\System\WtslJrl.exe
  C:\Windows\System\WtslJrl.exe
  2⤵
  PID:13964
- C:\Windows\System\oTPCFkr.exe
  C:\Windows\System\oTPCFkr.exe
  2⤵
  PID:14004
- C:\Windows\System\RGcgxNf.exe
  C:\Windows\System\RGcgxNf.exe
  2⤵
  PID:14032
- C:\Windows\System\KNorsRx.exe
  C:\Windows\System\KNorsRx.exe
  2⤵
  PID:14040
- C:\Windows\System\nwVDOjw.exe
  C:\Windows\System\nwVDOjw.exe
  2⤵
  PID:14164
- C:\Windows\System\NQfuKGn.exe
  C:\Windows\System\NQfuKGn.exe
  2⤵
  PID:8760
- C:\Windows\System\OCSSDVX.exe
  C:\Windows\System\OCSSDVX.exe
  2⤵
  PID:13436
- C:\Windows\System\bEadWti.exe
  C:\Windows\System\bEadWti.exe
  2⤵
  PID:11064
- C:\Windows\System\lDzsFMH.exe
  C:\Windows\System\lDzsFMH.exe
  2⤵
  PID:8896
- C:\Windows\System\MsJofUI.exe
  C:\Windows\System\MsJofUI.exe
  2⤵
  PID:13472
- C:\Windows\System\CEUaiwq.exe
  C:\Windows\System\CEUaiwq.exe
  2⤵
  PID:3604
- C:\Windows\System\CndJqzM.exe
  C:\Windows\System\CndJqzM.exe
  2⤵
  PID:13604
- C:\Windows\System\yqzXJBV.exe
  C:\Windows\System\yqzXJBV.exe
  2⤵
  PID:512
- C:\Windows\System\KDPlYhY.exe
  C:\Windows\System\KDPlYhY.exe
  2⤵
  PID:5056
- C:\Windows\System\lrSPBRW.exe
  C:\Windows\System\lrSPBRW.exe
  2⤵
  PID:13572
- C:\Windows\System\rUZQxCM.exe
  C:\Windows\System\rUZQxCM.exe
  2⤵
  PID:13904
- C:\Windows\System\weUMkYm.exe
  C:\Windows\System\weUMkYm.exe
  2⤵
  PID:4268
- C:\Windows\System\QXUdOHx.exe
  C:\Windows\System\QXUdOHx.exe
  2⤵
  PID:10260
- C:\Windows\System\yvMqDgj.exe
  C:\Windows\System\yvMqDgj.exe
  2⤵
  PID:5048
- C:\Windows\System\tpOhZpn.exe
  C:\Windows\System\tpOhZpn.exe
  2⤵
  PID:13552
- C:\Windows\System\ICEceuX.exe
  C:\Windows\System\ICEceuX.exe
  2⤵
  PID:3936
- C:\Windows\System\hHuKHex.exe
  C:\Windows\System\hHuKHex.exe
  2⤵
  PID:2108
- C:\Windows\System\FmZWWjo.exe
  C:\Windows\System\FmZWWjo.exe
  2⤵
  PID:13628
- C:\Windows\System\OavnLyS.exe
  C:\Windows\System\OavnLyS.exe
  2⤵
  PID:4612
- C:\Windows\System\PuxOHcF.exe
  C:\Windows\System\PuxOHcF.exe
  2⤵
  PID:14104
- C:\Windows\System\tFEtkgG.exe
  C:\Windows\System\tFEtkgG.exe
  2⤵
  PID:14080
- C:\Windows\System\OVYcrkN.exe
  C:\Windows\System\OVYcrkN.exe
  2⤵
  PID:14116
- C:\Windows\System\TxIzsRW.exe
  C:\Windows\System\TxIzsRW.exe
  2⤵
  PID:14188
- C:\Windows\System\kqpRxXT.exe
  C:\Windows\System\kqpRxXT.exe
  2⤵
  PID:14248
- C:\Windows\System\wqSHEXi.exe
  C:\Windows\System\wqSHEXi.exe
  2⤵
  PID:4596
- C:\Windows\System\sWOiYgZ.exe
  C:\Windows\System\sWOiYgZ.exe
  2⤵
  PID:880
- C:\Windows\System\GTLRLrf.exe
  C:\Windows\System\GTLRLrf.exe
  2⤵
  PID:448
- C:\Windows\System\gnnrmRE.exe
  C:\Windows\System\gnnrmRE.exe
  2⤵
  PID:536
- C:\Windows\System\XaFnnFs.exe
  C:\Windows\System\XaFnnFs.exe
  2⤵
  PID:3940
- C:\Windows\System\OCJMiWi.exe
  C:\Windows\System\OCJMiWi.exe
  2⤵
  PID:1556
- C:\Windows\System\nTZkNzj.exe
  C:\Windows\System\nTZkNzj.exe
  2⤵
  PID:4680
- C:\Windows\System\VwyyLTV.exe
  C:\Windows\System\VwyyLTV.exe
  2⤵
  PID:3976
- C:\Windows\System\MjIxAhR.exe
  C:\Windows\System\MjIxAhR.exe
  2⤵
  PID:13316
- C:\Windows\System\yDBExcH.exe
  C:\Windows\System\yDBExcH.exe
  2⤵
  PID:5208
- C:\Windows\System\chkvwuJ.exe
  C:\Windows\System\chkvwuJ.exe
  2⤵
  PID:556
- C:\Windows\System\ULjMvoF.exe
  C:\Windows\System\ULjMvoF.exe
  2⤵
  PID:2424
- C:\Windows\System\MpCmUBE.exe
  C:\Windows\System\MpCmUBE.exe
  2⤵
  PID:12084
- C:\Windows\System\dEQoNiK.exe
  C:\Windows\System\dEQoNiK.exe
  2⤵
  PID:5060
- C:\Windows\System\zIyuhaf.exe
  C:\Windows\System\zIyuhaf.exe
  2⤵
  PID:5288
- C:\Windows\System\HDAgqav.exe
  C:\Windows\System\HDAgqav.exe
  2⤵
  PID:14088
- C:\Windows\System\VinvggQ.exe
  C:\Windows\System\VinvggQ.exe
  2⤵
  PID:14320
- C:\Windows\System\BXSTDdO.exe
  C:\Windows\System\BXSTDdO.exe
  2⤵
  PID:14132
- C:\Windows\System\RFeMDKb.exe
  C:\Windows\System\RFeMDKb.exe
  2⤵
  PID:2696
- C:\Windows\System\WAMUydv.exe
  C:\Windows\System\WAMUydv.exe
  2⤵
  PID:2760
- C:\Windows\System\VdKYnte.exe
  C:\Windows\System\VdKYnte.exe
  2⤵
  PID:1864
- C:\Windows\System\EGfThKH.exe
  C:\Windows\System\EGfThKH.exe
  2⤵
  PID:5356
- C:\Windows\System\fqlrzOW.exe
  C:\Windows\System\fqlrzOW.exe
  2⤵
  PID:3052
- C:\Windows\System\MObUXKI.exe
  C:\Windows\System\MObUXKI.exe
  2⤵
  PID:11296
- C:\Windows\System\xEHZDcH.exe
  C:\Windows\System\xEHZDcH.exe
  2⤵
  PID:1648
- C:\Windows\System\wDYkACR.exe
  C:\Windows\System\wDYkACR.exe
  2⤵
  PID:1012
- C:\Windows\System\YMSlTDl.exe
  C:\Windows\System\YMSlTDl.exe
  2⤵
  PID:2952
- C:\Windows\System\JOrcGGN.exe
  C:\Windows\System\JOrcGGN.exe
  2⤵
  PID:5320
- C:\Windows\System\JbBlUSW.exe
  C:\Windows\System\JbBlUSW.exe
  2⤵
  PID:3264
- C:\Windows\System\XXizPdA.exe
  C:\Windows\System\XXizPdA.exe
  2⤵
  PID:5676
- C:\Windows\System\JBzbYZY.exe
  C:\Windows\System\JBzbYZY.exe
  2⤵
  PID:13764
- C:\Windows\System\RRXMill.exe
  C:\Windows\System\RRXMill.exe
  2⤵
  PID:13544
- C:\Windows\System\IoKZQUF.exe
  C:\Windows\System\IoKZQUF.exe
  2⤵
  PID:14308
- C:\Windows\System\TuaHijK.exe
  C:\Windows\System\TuaHijK.exe
  2⤵
  PID:4968
- C:\Windows\System\QwMzita.exe
  C:\Windows\System\QwMzita.exe
  2⤵
  PID:12904
- C:\Windows\System\aAFFWWz.exe
  C:\Windows\System\aAFFWWz.exe
  2⤵
  PID:1192
- C:\Windows\System\eAeEzlr.exe
  C:\Windows\System\eAeEzlr.exe
  2⤵
  PID:5712
- C:\Windows\System\nLPHVMl.exe
  C:\Windows\System\nLPHVMl.exe
  2⤵
  PID:3144
- C:\Windows\System\YVqnHCt.exe
  C:\Windows\System\YVqnHCt.exe
  2⤵
  PID:13356
- C:\Windows\System\uNLsDFr.exe
  C:\Windows\System\uNLsDFr.exe
  2⤵
  PID:5688
- C:\Windows\System\AMNKWnY.exe
  C:\Windows\System\AMNKWnY.exe
  2⤵
  PID:5764
- C:\Windows\System\nVqsGEz.exe
  C:\Windows\System\nVqsGEz.exe
  2⤵
  PID:5724
- C:\Windows\System\RDRNelw.exe
  C:\Windows\System\RDRNelw.exe
  2⤵
  PID:4880
- C:\Windows\System\SWOFkFA.exe
  C:\Windows\System\SWOFkFA.exe
  2⤵
  PID:5420
- C:\Windows\System\jeLKkBy.exe
  C:\Windows\System\jeLKkBy.exe
  2⤵
  PID:5856
- C:\Windows\System\STofSrM.exe
  C:\Windows\System\STofSrM.exe
  2⤵
  PID:1620
- C:\Windows\System\zshfRmf.exe
  C:\Windows\System\zshfRmf.exe
  2⤵
  PID:13772
- C:\Windows\System\pjQudbp.exe
  C:\Windows\System\pjQudbp.exe
  2⤵
  PID:2020
- C:\Windows\System\HMDwMKd.exe
  C:\Windows\System\HMDwMKd.exe
  2⤵
  PID:4284
- C:\Windows\System\fdVUOop.exe
  C:\Windows\System\fdVUOop.exe
  2⤵
  PID:5920
- C:\Windows\System\ttTtUvJ.exe
  C:\Windows\System\ttTtUvJ.exe
  2⤵
  PID:5592
- C:\Windows\System\MgZqARb.exe
  C:\Windows\System\MgZqARb.exe
  2⤵
  PID:5148
- C:\Windows\System\QkOtBrP.exe
  C:\Windows\System\QkOtBrP.exe
  2⤵
  PID:6020
- C:\Windows\System\QLiiWTK.exe
  C:\Windows\System\QLiiWTK.exe
  2⤵
  PID:216
- C:\Windows\System\vHetbbq.exe
  C:\Windows\System\vHetbbq.exe
  2⤵
  PID:3852
- C:\Windows\System\EhKdlZG.exe
  C:\Windows\System\EhKdlZG.exe
  2⤵
  PID:3592
- C:\Windows\System\obCHavL.exe
  C:\Windows\System\obCHavL.exe
  2⤵
  PID:5560
- C:\Windows\System\gtayOiX.exe
  C:\Windows\System\gtayOiX.exe
  2⤵
  PID:5812
- C:\Windows\System\rVUFnBt.exe
  C:\Windows\System\rVUFnBt.exe
  2⤵
  PID:1696
- C:\Windows\System\GpHLoYf.exe
  C:\Windows\System\GpHLoYf.exe
  2⤵
  PID:5280
- C:\Windows\System\JglizHN.exe
  C:\Windows\System\JglizHN.exe
  2⤵
  PID:14184
- C:\Windows\System\LTQzJDN.exe
  C:\Windows\System\LTQzJDN.exe
  2⤵
  PID:5444
- C:\Windows\System\YOZhTJs.exe
  C:\Windows\System\YOZhTJs.exe
  2⤵
  PID:6508
- C:\Windows\System\MqGdWXr.exe
  C:\Windows\System\MqGdWXr.exe
  2⤵
  PID:4396
- C:\Windows\System\zRxMBcf.exe
  C:\Windows\System\zRxMBcf.exe
  2⤵
  PID:5340
- C:\Windows\System\SxokhvF.exe
  C:\Windows\System\SxokhvF.exe
  2⤵
  PID:4320
- C:\Windows\System\TdyfgmE.exe
  C:\Windows\System\TdyfgmE.exe
  2⤵
  PID:7164
- C:\Windows\System\FTSQcVZ.exe
  C:\Windows\System\FTSQcVZ.exe
  2⤵
  PID:5832
- C:\Windows\System\ncYWYkk.exe
  C:\Windows\System\ncYWYkk.exe
  2⤵
  PID:5648
- C:\Windows\System\xdqSdjI.exe
  C:\Windows\System\xdqSdjI.exe
  2⤵
  PID:6724
- C:\Windows\System\kCDhHqt.exe
  C:\Windows\System\kCDhHqt.exe
  2⤵
  PID:6756
- C:\Windows\System\BovRFko.exe
  C:\Windows\System\BovRFko.exe
  2⤵
  PID:2292
- C:\Windows\System\UZoHhTz.exe
  C:\Windows\System\UZoHhTz.exe
  2⤵
  PID:5796
- C:\Windows\System\yUoBDFd.exe
  C:\Windows\System\yUoBDFd.exe
  2⤵
  PID:5544
- C:\Windows\System\OjTrjwp.exe
  C:\Windows\System\OjTrjwp.exe
  2⤵
  PID:4520
- C:\Windows\System\yeZYRIX.exe
  C:\Windows\System\yeZYRIX.exe
  2⤵
  PID:6532
- C:\Windows\System\DOgjBGu.exe
  C:\Windows\System\DOgjBGu.exe
  2⤵
  PID:5744
- C:\Windows\System\NatwnAE.exe
  C:\Windows\System\NatwnAE.exe
  2⤵
  PID:5844
- C:\Windows\System\NmdhjSQ.exe
  C:\Windows\System\NmdhjSQ.exe
  2⤵
  PID:4476
- C:\Windows\System\MZbKGVD.exe
  C:\Windows\System\MZbKGVD.exe
  2⤵
  PID:6176
- C:\Windows\System\wLemsxe.exe
  C:\Windows\System\wLemsxe.exe
  2⤵
  PID:6068
- C:\Windows\System\irLpgGQ.exe
  C:\Windows\System\irLpgGQ.exe
  2⤵
  PID:6536
- C:\Windows\System\FTrYiaL.exe
  C:\Windows\System\FTrYiaL.exe
  2⤵
  PID:2192
- C:\Windows\System\qoLHFrx.exe
  C:\Windows\System\qoLHFrx.exe
  2⤵
  PID:6340
- C:\Windows\System\lNyrAcn.exe
  C:\Windows\System\lNyrAcn.exe
  2⤵
  PID:7272
- C:\Windows\System\DdPAsqs.exe
  C:\Windows\System\DdPAsqs.exe
  2⤵
  PID:6136
- C:\Windows\System\yJkwRPk.exe
  C:\Windows\System\yJkwRPk.exe
  2⤵
  PID:5872
- C:\Windows\System\llTbonn.exe
  C:\Windows\System\llTbonn.exe
  2⤵
  PID:5808
- C:\Windows\System\qavpWxc.exe
  C:\Windows\System\qavpWxc.exe
  2⤵
  PID:5888
- C:\Windows\System\FQsbOkz.exe
  C:\Windows\System\FQsbOkz.exe
  2⤵
  PID:7652
- C:\Windows\System\CIlwPDV.exe
  C:\Windows\System\CIlwPDV.exe
  2⤵
  PID:6600
- C:\Windows\System\XpHUjeK.exe
  C:\Windows\System\XpHUjeK.exe
  2⤵
  PID:5576
- C:\Windows\System\CwkMGhP.exe
  C:\Windows\System\CwkMGhP.exe
  2⤵
  PID:3828
- C:\Windows\System\trrDXtH.exe
  C:\Windows\System\trrDXtH.exe
  2⤵
  PID:5312
- C:\Windows\System\AjAYYGR.exe
  C:\Windows\System\AjAYYGR.exe
  2⤵
  PID:6832
- C:\Windows\System\lZrUhKH.exe
  C:\Windows\System\lZrUhKH.exe
  2⤵
  PID:5952
- C:\Windows\System\jIdmddV.exe
  C:\Windows\System\jIdmddV.exe
  2⤵
  PID:6520
- C:\Windows\System\wpLQXei.exe
  C:\Windows\System\wpLQXei.exe
  2⤵
  PID:5600
- C:\Windows\System\fovJVTC.exe
  C:\Windows\System\fovJVTC.exe
  2⤵
  PID:7152
- C:\Windows\System\XZLCnHY.exe
  C:\Windows\System\XZLCnHY.exe
  2⤵
  PID:3432
- C:\Windows\System\MmNGezT.exe
  C:\Windows\System\MmNGezT.exe
  2⤵
  PID:6788
- C:\Windows\System\FyqPZeu.exe
  C:\Windows\System\FyqPZeu.exe
  2⤵
  PID:7828
- C:\Windows\System\bRQJzIG.exe
  C:\Windows\System\bRQJzIG.exe
  2⤵
  PID:7420
- C:\Windows\System\rJQVPwx.exe
  C:\Windows\System\rJQVPwx.exe
  2⤵
  PID:7296
- C:\Windows\System\hLaYEVC.exe
  C:\Windows\System\hLaYEVC.exe
  2⤵
  PID:6744
- C:\Windows\System\IwyqYXg.exe
  C:\Windows\System\IwyqYXg.exe
  2⤵
  PID:8136
- C:\Windows\System\MuafgUV.exe
  C:\Windows\System\MuafgUV.exe
  2⤵
  PID:7440
- C:\Windows\System\TikYfjf.exe
  C:\Windows\System\TikYfjf.exe
  2⤵
  PID:8564
- C:\Windows\System\mcWjwDU.exe
  C:\Windows\System\mcWjwDU.exe
  2⤵
  PID:7040
- C:\Windows\System\QWmKOxm.exe
  C:\Windows\System\QWmKOxm.exe
  2⤵
  PID:8616
- C:\Windows\System\ChKeZcJ.exe
  C:\Windows\System\ChKeZcJ.exe
  2⤵
  PID:7136
- C:\Windows\System\PWLsQpU.exe
  C:\Windows\System\PWLsQpU.exe
  2⤵
  PID:6848
- C:\Windows\System\iAIOrVX.exe
  C:\Windows\System\iAIOrVX.exe
  2⤵
  PID:8632
- C:\Windows\System\UCZhIBQ.exe
  C:\Windows\System\UCZhIBQ.exe
  2⤵
  PID:5968
- C:\Windows\System\dvuHJcz.exe
  C:\Windows\System\dvuHJcz.exe
  2⤵
  PID:6516
- C:\Windows\System\ePLCuBf.exe
  C:\Windows\System\ePLCuBf.exe
  2⤵
  PID:8636
- C:\Windows\System\uVJKBXH.exe
  C:\Windows\System\uVJKBXH.exe
  2⤵
  PID:6864
- C:\Windows\System\cDFeMhz.exe
  C:\Windows\System\cDFeMhz.exe
  2⤵
  PID:6952
- C:\Windows\System\yrMGOlE.exe
  C:\Windows\System\yrMGOlE.exe
  2⤵
  PID:7132
- C:\Windows\System\flChzuc.exe
  C:\Windows\System\flChzuc.exe
  2⤵
  PID:8440
- C:\Windows\System\lSfHANL.exe
  C:\Windows\System\lSfHANL.exe
  2⤵
  PID:3564
- C:\Windows\System\NhhecPA.exe
  C:\Windows\System\NhhecPA.exe
  2⤵
  PID:7424
- C:\Windows\System\ymtdLZT.exe
  C:\Windows\System\ymtdLZT.exe
  2⤵
  PID:8224
- C:\Windows\System\QJXmQqb.exe
  C:\Windows\System\QJXmQqb.exe
  2⤵
  PID:8316
- C:\Windows\System\AwPvrwe.exe
  C:\Windows\System\AwPvrwe.exe
  2⤵
  PID:6416
- C:\Windows\System\EotYkZJ.exe
  C:\Windows\System\EotYkZJ.exe
  2⤵
  PID:14008
- C:\Windows\System\GVqSiDT.exe
  C:\Windows\System\GVqSiDT.exe
  2⤵
  PID:8552
- C:\Windows\System\rEPMTKB.exe
  C:\Windows\System\rEPMTKB.exe
  2⤵
  PID:7832
- C:\Windows\System\hpnAcIP.exe
  C:\Windows\System\hpnAcIP.exe
  2⤵
  PID:5772
- C:\Windows\System\GzjAkDA.exe
  C:\Windows\System\GzjAkDA.exe
  2⤵
  PID:8764
- C:\Windows\System\ayPrQhg.exe
  C:\Windows\System\ayPrQhg.exe
  2⤵
  PID:6712
- C:\Windows\System\BVzacHn.exe
  C:\Windows\System\BVzacHn.exe
  2⤵
  PID:7008
- C:\Windows\System\ujdyFqN.exe
  C:\Windows\System\ujdyFqN.exe
  2⤵
  PID:8984
- C:\Windows\System\YwOZdku.exe
  C:\Windows\System\YwOZdku.exe
  2⤵
  PID:9388
- C:\Windows\System\ljMXTUW.exe
  C:\Windows\System\ljMXTUW.exe
  2⤵
  PID:7800
- C:\Windows\System\dXaLwix.exe
  C:\Windows\System\dXaLwix.exe
  2⤵
  PID:9324
- C:\Windows\System\PgZoDrf.exe
  C:\Windows\System\PgZoDrf.exe
  2⤵
  PID:8088
- C:\Windows\System\eLPnQsK.exe
  C:\Windows\System\eLPnQsK.exe
  2⤵
  PID:9376
- C:\Windows\System\IGASMQH.exe
  C:\Windows\System\IGASMQH.exe
  2⤵
  PID:7056
- C:\Windows\System\jpfLrYZ.exe
  C:\Windows\System\jpfLrYZ.exe
  2⤵
  PID:8464
- C:\Windows\System\DIwkOXV.exe
  C:\Windows\System\DIwkOXV.exe
  2⤵
  PID:8720
- C:\Windows\System\ZQCYfhf.exe
  C:\Windows\System\ZQCYfhf.exe
  2⤵
  PID:7400
- C:\Windows\System\WLobDMs.exe
  C:\Windows\System\WLobDMs.exe
  2⤵
  PID:6372
- C:\Windows\System\KscTopA.exe
  C:\Windows\System\KscTopA.exe
  2⤵
  PID:9140
- C:\Windows\System\fPwjIjP.exe
  C:\Windows\System\fPwjIjP.exe
  2⤵
  PID:4732
- C:\Windows\System\CoTUPEU.exe
  C:\Windows\System\CoTUPEU.exe
  2⤵
  PID:9352
- C:\Windows\System\LEdmklm.exe
  C:\Windows\System\LEdmklm.exe
  2⤵
  PID:9112
- C:\Windows\System\CHJLoSR.exe
  C:\Windows\System\CHJLoSR.exe
  2⤵
  PID:9340
- C:\Windows\System\afofoOF.exe
  C:\Windows\System\afofoOF.exe
  2⤵
  PID:9032
- C:\Windows\System\XnRDpHy.exe
  C:\Windows\System\XnRDpHy.exe
  2⤵
  PID:6668
- C:\Windows\System\vVIYWDN.exe
  C:\Windows\System\vVIYWDN.exe
  2⤵
  PID:7116
- C:\Windows\System\gkeGIDs.exe
  C:\Windows\System\gkeGIDs.exe
  2⤵
  PID:10000
- C:\Windows\System\tfDcbdp.exe
  C:\Windows\System\tfDcbdp.exe
  2⤵
  PID:5184
- C:\Windows\System\nSQiWRr.exe
  C:\Windows\System\nSQiWRr.exe
  2⤵
  PID:9456
- C:\Windows\System\kaghDRH.exe
  C:\Windows\System\kaghDRH.exe
  2⤵
  PID:14356
- C:\Windows\System\rxsDZVL.exe
  C:\Windows\System\rxsDZVL.exe
  2⤵
  PID:14388
- C:\Windows\System\UaANbXW.exe
  C:\Windows\System\UaANbXW.exe
  2⤵
  PID:14420
- C:\Windows\System\XZudDOV.exe
  C:\Windows\System\XZudDOV.exe
  2⤵
  PID:14452
- C:\Windows\System\FcEezcc.exe
  C:\Windows\System\FcEezcc.exe
  2⤵
  PID:14480
- C:\Windows\System\TIlLwaG.exe
  C:\Windows\System\TIlLwaG.exe
  2⤵
  PID:14520
- C:\Windows\System\MxpAPMW.exe
  C:\Windows\System\MxpAPMW.exe
  2⤵
  PID:14644
- C:\Windows\System\EfYJglR.exe
  C:\Windows\System\EfYJglR.exe
  2⤵
  PID:14676
- C:\Windows\System\bxzCPkd.exe
  C:\Windows\System\bxzCPkd.exe
  2⤵
  PID:14736
- C:\Windows\System\YMebJRw.exe
  C:\Windows\System\YMebJRw.exe
  2⤵
  PID:14804
- C:\Windows\System\IcaxNTY.exe
  C:\Windows\System\IcaxNTY.exe
  2⤵
  PID:14928
- C:\Windows\System\RkKePFh.exe
  C:\Windows\System\RkKePFh.exe
  2⤵
  PID:14980
- C:\Windows\System\ahItZaI.exe
  C:\Windows\System\ahItZaI.exe
  2⤵
  PID:15000
- C:\Windows\System\NDnuCvq.exe
  C:\Windows\System\NDnuCvq.exe
  2⤵
  PID:15080
- C:\Windows\System\onnECjH.exe
  C:\Windows\System\onnECjH.exe
  2⤵
  PID:15120
- C:\Windows\System\UbNYOqJ.exe
  C:\Windows\System\UbNYOqJ.exe
  2⤵
  PID:15228
- C:\Windows\System\IFRXagO.exe
  C:\Windows\System\IFRXagO.exe
  2⤵
  PID:15256
- C:\Windows\System\XKEThGo.exe
  C:\Windows\System\XKEThGo.exe
  2⤵
  PID:15276
- C:\Windows\System\wOTuwwr.exe
  C:\Windows\System\wOTuwwr.exe
  2⤵
  PID:10040
- C:\Windows\System\yojibiz.exe
  C:\Windows\System\yojibiz.exe
  2⤵
  PID:14412
- C:\Windows\System\VFESFQp.exe
  C:\Windows\System\VFESFQp.exe
  2⤵
  PID:8628
- C:\Windows\System\qbENBeI.exe
  C:\Windows\System\qbENBeI.exe
  2⤵
  PID:14404
- C:\Windows\System\qcxXnIm.exe
  C:\Windows\System\qcxXnIm.exe
  2⤵
  PID:14540
- C:\Windows\System\HEfMiue.exe
  C:\Windows\System\HEfMiue.exe
  2⤵
  PID:14564
- C:\Windows\System\rPHDySE.exe
  C:\Windows\System\rPHDySE.exe
  2⤵
  PID:9620
- C:\Windows\System\sROoNtd.exe
  C:\Windows\System\sROoNtd.exe
  2⤵
  PID:14612
- C:\Windows\System\HtzWJzA.exe
  C:\Windows\System\HtzWJzA.exe
  2⤵
  PID:9924
- C:\Windows\System\xCfmFOH.exe
  C:\Windows\System\xCfmFOH.exe
  2⤵
  PID:10236
- C:\Windows\System\UmkuVDR.exe
  C:\Windows\System\UmkuVDR.exe
  2⤵
  PID:14584
- C:\Windows\System\pSIEdoa.exe
  C:\Windows\System\pSIEdoa.exe
  2⤵
  PID:14604
- C:\Windows\System\wqAhily.exe
  C:\Windows\System\wqAhily.exe
  2⤵
  PID:14764
- C:\Windows\System\xDpVRsd.exe
  C:\Windows\System\xDpVRsd.exe
  2⤵
  PID:14776
- C:\Windows\System\lMNrYBf.exe
  C:\Windows\System\lMNrYBf.exe
  2⤵
  PID:14568
- C:\Windows\System\QtNwjug.exe
  C:\Windows\System\QtNwjug.exe
  2⤵
  PID:14684
- C:\Windows\System\zpxJjTx.exe
  C:\Windows\System\zpxJjTx.exe
  2⤵
  PID:10800
- C:\Windows\System\gLkRrbD.exe
  C:\Windows\System\gLkRrbD.exe
  2⤵
  PID:14868
- C:\Windows\System\xoYGilZ.exe
  C:\Windows\System\xoYGilZ.exe
  2⤵
  PID:14888
- C:\Windows\System\lTTeDnJ.exe
  C:\Windows\System\lTTeDnJ.exe
  2⤵
  PID:14920
- C:\Windows\System\uYGmanv.exe
  C:\Windows\System\uYGmanv.exe
  2⤵
  PID:14728
- C:\Windows\System\AJeJLWi.exe
  C:\Windows\System\AJeJLWi.exe
  2⤵
  PID:14968
- C:\Windows\System\JXjpHpr.exe
  C:\Windows\System\JXjpHpr.exe
  2⤵
  PID:9872
- C:\Windows\System\XsWSrRS.exe
  C:\Windows\System\XsWSrRS.exe
  2⤵
  PID:15216
- C:\Windows\System\ZwYcAab.exe
  C:\Windows\System\ZwYcAab.exe
  2⤵
  PID:15244
- C:\Windows\System\ilSWCDr.exe
  C:\Windows\System\ilSWCDr.exe
  2⤵
  PID:10152
- C:\Windows\System\xSFiyfq.exe
  C:\Windows\System\xSFiyfq.exe
  2⤵
  PID:15292
- C:\Windows\System\QOXHoxa.exe
  C:\Windows\System\QOXHoxa.exe
  2⤵
  PID:9736
- C:\Windows\System\fEULvsQ.exe
  C:\Windows\System\fEULvsQ.exe
  2⤵
  PID:10032
- C:\Windows\System\wmLeBGE.exe
  C:\Windows\System\wmLeBGE.exe
  2⤵
  PID:11600
- C:\Windows\System\mWPKbHe.exe
  C:\Windows\System\mWPKbHe.exe
  2⤵
  PID:15348
- C:\Windows\System\EKbJSEO.exe
  C:\Windows\System\EKbJSEO.exe
  2⤵
  PID:9712
- C:\Windows\System\UZXfglG.exe
  C:\Windows\System\UZXfglG.exe
  2⤵
  PID:7872
- C:\Windows\System\AHhRvQY.exe
  C:\Windows\System\AHhRvQY.exe
  2⤵
  PID:14432
- C:\Windows\System\pvAuFMl.exe
  C:\Windows\System\pvAuFMl.exe
  2⤵
  PID:7744
- C:\Windows\System\ikXTuxW.exe
  C:\Windows\System\ikXTuxW.exe
  2⤵
  PID:15316
- C:\Windows\System\qYrmjjY.exe
  C:\Windows\System\qYrmjjY.exe
  2⤵
  PID:11476
- C:\Windows\System\nbFtXOh.exe
  C:\Windows\System\nbFtXOh.exe
  2⤵
  PID:13820
- C:\Windows\System\qjZybFI.exe
  C:\Windows\System\qjZybFI.exe
  2⤵
  PID:10376
- C:\Windows\System\MGUuKYO.exe
  C:\Windows\System\MGUuKYO.exe
  2⤵
  PID:10368
- C:\Windows\System\zUutLch.exe
  C:\Windows\System\zUutLch.exe
  2⤵
  PID:9476
- C:\Windows\System\jJBQyBP.exe
  C:\Windows\System\jJBQyBP.exe
  2⤵
  PID:11740
- C:\Windows\System\cTADGvB.exe
  C:\Windows\System\cTADGvB.exe
  2⤵
  PID:14536
- C:\Windows\System\nSFizfr.exe
  C:\Windows\System\nSFizfr.exe
  2⤵
  PID:11612
- C:\Windows\System\exvuxBw.exe
  C:\Windows\System\exvuxBw.exe
  2⤵
  PID:10124
- C:\Windows\System\rWYUSMo.exe
  C:\Windows\System\rWYUSMo.exe
  2⤵
  PID:14512
- C:\Windows\System\scqNhyB.exe
  C:\Windows\System\scqNhyB.exe
  2⤵
  PID:10300
- C:\Windows\System\QdphDgZ.exe
  C:\Windows\System\QdphDgZ.exe
  2⤵
  PID:12160
- C:\Windows\System\kEvhhFH.exe
  C:\Windows\System\kEvhhFH.exe
  2⤵
  PID:8244
- C:\Windows\System\plTaIma.exe
  C:\Windows\System\plTaIma.exe
  2⤵
  PID:14800
- C:\Windows\System\DQqRFUb.exe
  C:\Windows\System\DQqRFUb.exe
  2⤵
  PID:14924
- C:\Windows\System\RsVciXI.exe
  C:\Windows\System\RsVciXI.exe
  2⤵
  PID:10968
- C:\Windows\System\gyisUsf.exe
  C:\Windows\System\gyisUsf.exe
  2⤵
  PID:10232
- C:\Windows\System\Opdeurp.exe
  C:\Windows\System\Opdeurp.exe
  2⤵
  PID:14900
- C:\Windows\System\yoVTYKb.exe
  C:\Windows\System\yoVTYKb.exe
  2⤵
  PID:14952
- C:\Windows\System\AIHHpQO.exe
  C:\Windows\System\AIHHpQO.exe
  2⤵
  PID:12440
- C:\Windows\System\JewiXLs.exe
  C:\Windows\System\JewiXLs.exe
  2⤵
  PID:11392
- C:\Windows\System\iPAAuFu.exe
  C:\Windows\System\iPAAuFu.exe
  2⤵
  PID:11172
- C:\Windows\System\inaQFVj.exe
  C:\Windows\System\inaQFVj.exe
  2⤵
  PID:11436
- C:\Windows\System\iAEDuZO.exe
  C:\Windows\System\iAEDuZO.exe
  2⤵
  PID:8276
- C:\Windows\System\ienFXrb.exe
  C:\Windows\System\ienFXrb.exe
  2⤵
  PID:15100
- C:\Windows\System\mTRmjPG.exe
  C:\Windows\System\mTRmjPG.exe
  2⤵
  PID:15160
- C:\Windows\System\agzXuvC.exe
  C:\Windows\System\agzXuvC.exe
  2⤵
  PID:15012
- C:\Windows\System\rbIcWKT.exe
  C:\Windows\System\rbIcWKT.exe
  2⤵
  PID:15168
- C:\Windows\System\vgCqZjp.exe
  C:\Windows\System\vgCqZjp.exe
  2⤵
  PID:15036
- C:\Windows\System\TGBSjUu.exe
  C:\Windows\System\TGBSjUu.exe
  2⤵
  PID:12932
- C:\Windows\System\aCPsDbI.exe
  C:\Windows\System\aCPsDbI.exe
  2⤵
  PID:13052
- C:\Windows\System\WJEkchX.exe
  C:\Windows\System\WJEkchX.exe
  2⤵
  PID:10412
- C:\Windows\System\MrprGpJ.exe
  C:\Windows\System\MrprGpJ.exe
  2⤵
  PID:12976
- C:\Windows\System\bpvLlkx.exe
  C:\Windows\System\bpvLlkx.exe
  2⤵
  PID:10092
- C:\Windows\System\maULrUd.exe
  C:\Windows\System\maULrUd.exe
  2⤵
  PID:10012
- C:\Windows\System\hxIwqXP.exe
  C:\Windows\System\hxIwqXP.exe
  2⤵
  PID:15312
- C:\Windows\System\uNtuaUH.exe
  C:\Windows\System\uNtuaUH.exe
  2⤵
  PID:14352
- C:\Windows\System\pnEvOji.exe
  C:\Windows\System\pnEvOji.exe
  2⤵
  PID:15064
- C:\Windows\System\LvSCtXQ.exe
  C:\Windows\System\LvSCtXQ.exe
  2⤵
  PID:10288
- C:\Windows\System\HwsRBAx.exe
  C:\Windows\System\HwsRBAx.exe
  2⤵
  PID:10016
- C:\Windows\System\BlLoNak.exe
  C:\Windows\System\BlLoNak.exe
  2⤵
  PID:9512
- C:\Windows\System\RprCJvF.exe
  C:\Windows\System\RprCJvF.exe
  2⤵
  PID:10396
- C:\Windows\System\RNujvsV.exe
  C:\Windows\System\RNujvsV.exe
  2⤵
  PID:14548
- C:\Windows\System\oEycTAo.exe
  C:\Windows\System\oEycTAo.exe
  2⤵
  PID:14884
- C:\Windows\System\ndryHJD.exe
  C:\Windows\System\ndryHJD.exe
  2⤵
  PID:14384
- C:\Windows\System\YWoblGI.exe
  C:\Windows\System\YWoblGI.exe
  2⤵
  PID:14712
- C:\Windows\System\ClbvDdN.exe
  C:\Windows\System\ClbvDdN.exe
  2⤵
  PID:14744
- C:\Windows\System\XapOcpC.exe
  C:\Windows\System\XapOcpC.exe
  2⤵
  PID:7756
- C:\Windows\System\cRmjnyl.exe
  C:\Windows\System\cRmjnyl.exe
  2⤵
  PID:12580
- C:\Windows\System\AGmXcVA.exe
  C:\Windows\System\AGmXcVA.exe
  2⤵
  PID:15188
- C:\Windows\System\PPyJCYu.exe
  C:\Windows\System\PPyJCYu.exe
  2⤵
  PID:11400
- C:\Windows\System\IqNEquk.exe
  C:\Windows\System\IqNEquk.exe
  2⤵
  PID:8892
- C:\Windows\System\iuBdatg.exe
  C:\Windows\System\iuBdatg.exe
  2⤵
  PID:12656
- C:\Windows\System\gKMavId.exe
  C:\Windows\System\gKMavId.exe
  2⤵
  PID:11344
- C:\Windows\System\wOPZtjs.exe
  C:\Windows\System\wOPZtjs.exe
  2⤵
  PID:12784
- C:\Windows\System\oCFBjOJ.exe
  C:\Windows\System\oCFBjOJ.exe
  2⤵
  PID:15240
- C:\Windows\System\njvSbpr.exe
  C:\Windows\System\njvSbpr.exe
  2⤵
  PID:11356
- C:\Windows\System\lpmXNKA.exe
  C:\Windows\System\lpmXNKA.exe
  2⤵
  PID:13260
- C:\Windows\System\aEczVlm.exe
  C:\Windows\System\aEczVlm.exe
  2⤵
  PID:15180
- C:\Windows\System\zcDykpB.exe
  C:\Windows\System\zcDykpB.exe
  2⤵
  PID:15224
- C:\Windows\System\tKZxIYA.exe
  C:\Windows\System\tKZxIYA.exe
  2⤵
  PID:11320
- C:\Windows\System\qWQLabC.exe
  C:\Windows\System\qWQLabC.exe
  2⤵
  PID:2268
- C:\Windows\System\goInFBI.exe
  C:\Windows\System\goInFBI.exe
  2⤵
  PID:12164
- C:\Windows\System\JYdTBLh.exe
  C:\Windows\System\JYdTBLh.exe
  2⤵
  PID:10308
- C:\Windows\System\WsLirnV.exe
  C:\Windows\System\WsLirnV.exe
  2⤵
  PID:14784
- C:\Windows\System\NVcoluP.exe
  C:\Windows\System\NVcoluP.exe
  2⤵
  PID:11508
- C:\Windows\System\IcckwLt.exe
  C:\Windows\System\IcckwLt.exe
  2⤵
  PID:10212
- C:\Windows\System\XHXjlJr.exe
  C:\Windows\System\XHXjlJr.exe
  2⤵
  PID:7240
- C:\Windows\System\kEgaDqL.exe
  C:\Windows\System\kEgaDqL.exe
  2⤵
  PID:8460
- C:\Windows\System\MSXWiYm.exe
  C:\Windows\System\MSXWiYm.exe
  2⤵
  PID:8580
- C:\Windows\System\YHOjImH.exe
  C:\Windows\System\YHOjImH.exe
  2⤵
  PID:13224
- C:\Windows\System\ztycplP.exe
  C:\Windows\System\ztycplP.exe
  2⤵
  PID:7464
- C:\Windows\System\QnJIIMd.exe
  C:\Windows\System\QnJIIMd.exe
  2⤵
  PID:13264
- C:\Windows\System\lizHBCu.exe
  C:\Windows\System\lizHBCu.exe
  2⤵
  PID:11840
- C:\Windows\System\KcfqzVp.exe
  C:\Windows\System\KcfqzVp.exe
  2⤵
  PID:1384
- C:\Windows\System\aWVKXbd.exe
  C:\Windows\System\aWVKXbd.exe
  2⤵
  PID:15344
- C:\Windows\System\xcpPTBf.exe
  C:\Windows\System\xcpPTBf.exe
  2⤵
  PID:15320
- C:\Windows\System\kXTfZap.exe
  C:\Windows\System\kXTfZap.exe
  2⤵
  PID:11856
- C:\Windows\System\IjbBRzh.exe
  C:\Windows\System\IjbBRzh.exe
  2⤵
  PID:9592
- C:\Windows\System\VllPPJR.exe
  C:\Windows\System\VllPPJR.exe
  2⤵
  PID:8864
- C:\Windows\System\JlfMUHB.exe
  C:\Windows\System\JlfMUHB.exe
  2⤵
  PID:12568
- C:\Windows\System\QBWmwLY.exe
  C:\Windows\System\QBWmwLY.exe
  2⤵
  PID:12364
- C:\Windows\System\TYSLYwA.exe
  C:\Windows\System\TYSLYwA.exe
  2⤵
  PID:9904
- C:\Windows\System\tkYJUeR.exe
  C:\Windows\System\tkYJUeR.exe
  2⤵
  PID:11184
- C:\Windows\System\WynYhNy.exe
  C:\Windows\System\WynYhNy.exe
  2⤵
  PID:10476
- C:\Windows\System\GJYqeKW.exe
  C:\Windows\System\GJYqeKW.exe
  2⤵
  PID:11372
- C:\Windows\System\GpQOhxl.exe
  C:\Windows\System\GpQOhxl.exe
  2⤵
  PID:1232
- C:\Windows\System\cAwEfmg.exe
  C:\Windows\System\cAwEfmg.exe
  2⤵
  PID:9976
- C:\Windows\System\XmJlohZ.exe
  C:\Windows\System\XmJlohZ.exe
  2⤵
  PID:14704
- C:\Windows\System\fFwNlSu.exe
  C:\Windows\System\fFwNlSu.exe
  2⤵
  PID:15264
- C:\Windows\System\vtXCQMl.exe
  C:\Windows\System\vtXCQMl.exe
  2⤵
  PID:11884
- C:\Windows\System\mKrviwT.exe
  C:\Windows\System\mKrviwT.exe
  2⤵
  PID:7672
- C:\Windows\System\DLlbfTt.exe
  C:\Windows\System\DLlbfTt.exe
  2⤵
  PID:9548

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 10100 -ip 10100
1⤵
PID:5776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_4pifsgy3.aie.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4pifsgy3.aie.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BYjbCvf.exe

Path C:\Windows\System\BYjbCvf.exe
Size 1.8MB
SHA256 1c82d81760f1740a36b63aaf7eb4fcf2aeaff54944a1b73e5ec184dc65026dd1
MD5 9e85a361441c756766f8149418277251
SHA1 6f28b1dcd5c7425acfd209ce5874188f4de17bd0
SHA512 f9613fd5fb62be869dd7a706f7904ae55b17fd772fbcbd3293c84b7c4eeced49a2ce893b6d863a9bda03c687d928e666f0ef91f8b64059ec668010356c60d715
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xm:NABG
MD5 SHA1 SHA512 SSDEEP

Submit Download

BYsmNVq.exe

Path C:\Windows\System\BYsmNVq.exe
Size 1.8MB
SHA256 77683699ab36e9d4d5948df73d6d6fe3174324d5cc76ea0d7f8c216033a20220
MD5 6212798e03a276d3c0363d699e6eff09
SHA1 ba920a5336791023f8b173f578a6b2cec993f0ba
SHA512 2c50b36dbea13d2941e7a48a47c525b0e15f2d20ceed26a0fb965106efa683bcbd888379f339e1e690a057340665aba2ac1dd2268a4fe314ae38cadea386b70c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XS:NABy
MD5 SHA1 SHA512 SSDEEP

Submit Download

HSYcCJK.exe

Path C:\Windows\System\HSYcCJK.exe
Size 1.8MB
SHA256 0bd34eba7595860cb42b8c9f3404356263f1841746199e2a94ec874b1200bcf3
MD5 186b33d1d7f1f0ffa15bc2a35d5a09fe
SHA1 37070ed59c7b6118c49498b3036c851a84938680
SHA512 e8d3988ba094ba4e33e9765199ab278d658fd81dd395f8447741f045b4c607c36b96634804a6c7b1bd6882a562b9add4b13a8a4d52148fd3b36f4d4fdc95273e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0X3J:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

KPwVhPj.exe

Path C:\Windows\System\KPwVhPj.exe
Size 1.8MB
SHA256 6009d473bf5ea79e0c374dae73cf9c64132679f50b63d65818d6beda14b47b37
MD5 d19f59c9f56637114489239ad329a237
SHA1 039150af2ad151b21f368cc522c30e2afa29d22f
SHA512 f026315c9eae29da433874b43e9786a4bbb3262555463e51d8a1726003d872be9004c87b9e5e351d7bcb9f676adcf8a0bef085661d0ecb0aca9f308e757525dd
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xe:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

KQJRaxM.exe

Path C:\Windows\System\KQJRaxM.exe
Size 8B
SHA256 5d32e2c5476ec99d6a8b9b32ce8fc3dcfc70c43e01cda6d539f1537b352bc821
MD5 9eed4b82804b22673b9dfb873b8ab9ce
SHA1 f21d2bfa2371f1463e1292b73e9e08fa34f0575c
SHA512 dca73626047a6804b6db7d36b94c16cbc3aa085940e12b1d982bf2f2f9d835da5216fd8f6b7487a1c5fafdc4aff759eb74fe90083f9b59b79152dd8179f2bc5b
MD5 SHA1 SHA512

Submit Download

MOkijRh.exe

Path C:\Windows\System\MOkijRh.exe
Size 1.8MB
SHA256 83228af2b41f59b04fdbc3e5a40a32a16221c4143b08b54f78e36cf1e7fa7b2a
MD5 021470fecb7cbd0df05ef75a40e4fdd9
SHA1 c4303856c73aa05e34d68fb6300c60ff2c464157
SHA512 80f3fa54af8e00b32e577a2baab543bc532d83e1eaddd9c40d97485201d230086151c3fd38d8e8e43f9f9a22179317bfe9dd4f8abc4ef5a8b187e3d068117c29
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XI:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

MwcisGQ.exe

Path C:\Windows\System\MwcisGQ.exe
Size 1.8MB
SHA256 5014ec4029ada7e2641743369762f2757f761174f951afc9f3c6a080935d1bb6
MD5 c1f410fe4a16aa0e31f00335445ce53f
SHA1 3ccc94d93406fae62d6eb590588d56cb7d89383f
SHA512 a17817f95a9e2b3527ecb516c3d5a45502cad76b70a1fad9c799b147b532e3c3185cee1ad5a14a7d2f43f32b9085b7a209a5b3607be519f6dd88acb3a44912dd
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XG:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyAHBKY.exe

Path C:\Windows\System\MyAHBKY.exe
Size 1.8MB
SHA256 7a59172de94c74ca5b89a153adde3a21a2b24bdc85f6ed6438010ce4ccd8469c
MD5 37a03269e4265b8be46de1103a1dda83
SHA1 33920c9da954ec2224d336d46646d1008bc3efac
SHA512 27a03d800b9d9e740d2e51aad85d7e49f09736a1aff7404d2d1a034a7656b16f97389d2f0887b69ae560b1bc10377928cca0a7198a28d288c5ae68be0da58df7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XU:NAB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

OuipIOh.exe

Path C:\Windows\System\OuipIOh.exe
Size 1.8MB
SHA256 a03350adba91830d1dd84451f269adb8dd69b0a7cedf4a28dc5668bed93057f3
MD5 aa8a73ece71faf354f81320f6737513c
SHA1 f81ffccb08edba9b02c88eeb2364ad67928bd42e
SHA512 64046dfab5f95333974900f9aa6cfd551f1feb03c74729f02663279d60cc99147d6f8f1c4700fa66eb99f3ac73c66b1d5ad39fa052e790989ca1d20157af6e3e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0X8:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

PDaaPIk.exe

Path C:\Windows\System\PDaaPIk.exe
Size 18B
SHA256 fd86f7ab7617456dd2fc6566ed65ed74bcb3d16b08e15b51d0cee9e1aadd4754
MD5 6222e4536e384c0a1512170dea9cd5d9
SHA1 677d846b63b411bee372285488700317e50ea9e3
SHA512 90840531058e96d202122fa5e31bc507d46669c9ce853047afa57de66c023e079fd61e5de77df2e2b669a3aad2bee674f532ecf499d638b2fc95b1d1c26c1d5f
MD5 SHA1 SHA512

Submit Download

QqEURrd.exe

Path C:\Windows\System\QqEURrd.exe
Size 1.8MB
SHA256 edca79a8a3ab382d70f40d0e69d2e7be47c42dc707f0147cbcf07d1849d578dc
MD5 3797bc0fff3b1c7b0691fdcdf9800902
SHA1 d374d31d7b2dd5e9a226971297a0eb7f521b02b1
SHA512 9a367801c1e5a98fe3bc102cd21de7be5b989b0d2b44a360754c8eb4dac98f2830cf268a4d3633c90e59d0e75be9a110fd0b71422334676e2094701666d27a7e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xm:NABG
MD5 SHA1 SHA512 SSDEEP

Submit Download

SIMPIKU.exe

Path C:\Windows\System\SIMPIKU.exe
Size 1.8MB
SHA256 3e1c21b38ddfa7b4bce5d3f9d514d536c55e1e27685eedcffcb51168bd118ee0
MD5 8fc1a9f48b0fb5d6fcdb44ddca4dbb64
SHA1 58508b3f776c196b4a84423e46a14edfbb67b06b
SHA512 02b6b38654aa7e25ae397900ea6668d01ced67c0073938b7ddf0f7fd7b1f6646050017fd60d52eb3e3dd6a1ada2efbcb5dbdf1362cce43864471660875c4b84c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xz:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

SOJQfgA.exe

Path C:\Windows\System\SOJQfgA.exe
Size 1.8MB
SHA256 3cd0f7378d51c2247ffbe2edf2fe83845972fad0276d43f1f9b5a067334ef597
MD5 df5b5e5c6a49b4e6094a095670faca66
SHA1 169f0717ec09802bc26d4cbfc9537113d675e76b
SHA512 876f8e67df24d422b1cf0c46ab3d10ff06a9f50f905dfe1f6f38c7c3f6ffdd2786817a7fe41835c63dae10302f32fbd345feaa0ba0880ae870c8394617c7e8cb
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XT:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

TSuDctp.exe

Path C:\Windows\System\TSuDctp.exe
Size 1.8MB
SHA256 ff4495e61016dd409ec9abb52024301a0eb35f1fbfd76e6aec5d32ded509090c
MD5 7380778729459d5e2905bdca5da7932a
SHA1 1d42a450624dcb3894722829aeb5673ff337cc11
SHA512 0fc061caf5d8bd40fb7ef06f59aeec022064d80646c42bf483fca1cd2fb7f6225c5fe7add422ceea7887aee24a4556b49dd3c671d1ed358c05a531bf3d12c9cb
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0X8:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ULkxCep.exe

Path C:\Windows\System\ULkxCep.exe
Size 1.8MB
SHA256 77baaf6aa34a42568a1b10ca5f71eb3a51da07831566ccbc531279e4c199cc6e
MD5 e4b7a7587af5450735f57b72125c087a
SHA1 30304d306524cbdbf2afc4ce339a108d18a1cc20
SHA512 336b1f70c52bde10e469fd1fa1a4ac4287544cd7810b1a8bfb46e3cd2d6d14d7a4a5e1e8c33f1261af3c16f8a01e05b63573ab77316e4a9906ad13f32f89fefc
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xf:NAB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VHaCbbJ.exe

Path C:\Windows\System\VHaCbbJ.exe
Size 1.8MB
SHA256 72c5f94b1748910839bfb489e49682326a18addba8fd0db7d802a547d32cfc43
MD5 6b0fdcb4f6f3be982a55f56c6a5086bb
SHA1 8458b440133a53273fa239d30fca958ed63ed22e
SHA512 444968a89056d934e2ea1afde72c22aea2ecec1b681bbabcead2c6b1177cea9f3da57b805e341b352f2b07a5e77860a39816a5c1ea2eac8f649baeacc598bf1b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0X9:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

YAFopVX.exe

Path C:\Windows\System\YAFopVX.exe
Size 1.8MB
SHA256 fe50b115dd631c44eca9d7c8018881446acfe955c4c58059583856cd016f3a5d
MD5 a4ecade6671ec2a3eb6443f4a95bc636
SHA1 27a85aaac7de0ecbadfff192ebe6e94734c6b6fd
SHA512 7c2785c864aa76e76081dfe4afcf7b4218c533b33a1df9828d8b85d3a85523df92ca4b2be2805729b86cea6cddd038f8dcd4c424d82dc13474e78284c497ef9c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XH:NABn
MD5 SHA1 SHA512 SSDEEP

Submit Download

YebuTcC.exe

Path C:\Windows\System\YebuTcC.exe
Size 1.8MB
SHA256 1772bf144eba852d4bb6880ca0063ac8a3050c63a6b2df5b0b8582cf9715b5d7
MD5 94dee085506360b798bd8a3d72f704ed
SHA1 605a7ad36ac12fdee02757732db36d65ba1b30e9
SHA512 42aef47f31a2395fa95cf46b89120f9fb6811470ebfc081834e9fe552859e92a833678758377710f4013e27ad301e2dd8acb776414e104c7b87f703a10bd37f4
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XG:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZUBqeyF.exe

Path C:\Windows\System\ZUBqeyF.exe
Size 1.8MB
SHA256 ae9a14840d6920b0c5e18e13e042148ec1c04d251f9732ffb76de3492d22e7fd
MD5 9a2acc75cfb941e31dfe970a0bc515c8
SHA1 1da833382f7b364332b352c3eedcfd2cd8f57451
SHA512 9114ed80a5bf191ebb2715a8e168eec6ba0c520ed6d8051cca9aab6144179c08d9536f2ce3f17a91c3f78dc6fcf7fb44344a8bf01c8ca1b4e1f094a9b328e036
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xs:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

aRbqEuu.exe

Path C:\Windows\System\aRbqEuu.exe
Size 1.8MB
SHA256 42e89512080c009c81e5555e8f1b865924a03553051a05a7b3a69f7da26f98f5
MD5 0a75f2e38b50ab7551278901392ed2d9
SHA1 35449f80f88b340fff1e0377537e8031b94da5f8
SHA512 b803dcd31edb312398e94e38f981a3ce89a02e1b18cee3615e37f7403c68dabb8265bd6b27b136bdb1c3a372f31973f58c58b783ebf086abc512651972c3a4ac
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0X28:NABr
MD5 SHA1 SHA512 SSDEEP

Submit Download

drwkmRQ.exe

Path C:\Windows\System\drwkmRQ.exe
Size 1.8MB
SHA256 3134993250f54044e9adb056fa86cf963391c34b1cda6320ed5e4507bc920eee
MD5 f1a98772e7b53f930c13bb93613c604b
SHA1 bd36efe54cb55b7587c3c527468c0282f5e8fd4b
SHA512 344e5f1cb74988d5bc8f6fefc047995af8928934b4bde900a4412487ed9af9490930aaaf29130b5d28b803131f28e290e2560a3c2e22665cbb3096341b8ee60b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XG:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

dyGfLLq.exe

Path C:\Windows\System\dyGfLLq.exe
Size 1.8MB
SHA256 a7bf2bbbc994aeed2a2ca0f171a22f0beb3d8e8b7c644f739e1837817592c62b
MD5 6f14dea417743ac59cda32ff051fb55c
SHA1 6755e60fbea3d95013fa46a0c9414e383338297c
SHA512 c652edd030be0c1567527ae2d403c8da86ab140dd19e1492ef97c8446110c27e8322e90c066f4a816d9266fcd0694774bd196e07d5273fe7a94ba0453d2ff793
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0X5:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwNUibj.exe

Path C:\Windows\System\fwNUibj.exe
Size 1.8MB
SHA256 40e26a4f5ab260b207508485f632f3130a881f481780d0cf8cf5c5b9704a0bbc
MD5 f68f261b6317fb66ab7b8b82c3cd3c77
SHA1 529124896735f9a8aadd0edc880769f738d94439
SHA512 2e2e055cc589850a1672616c2c3daaffcc82fa66cdb15e3c15293a1d084ff87d85e5496fbac978f9eab141cc9f0df06533d9b8213a5db2fc2f4dc0039c64bd62
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xy:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

hZqxFmk.exe

Path C:\Windows\System\hZqxFmk.exe
Size 1.8MB
SHA256 9b4258253e95942676582635560d9839b4b4d22b48a3078686b4bac1cb13dd69
MD5 fa5be388346f14b85c190573f5bfa5fc
SHA1 8290b50020db1967c47c16da16bed12ad82923ce
SHA512 2acbc74ea1fc6c59ef9e660e45a99d4ee553764703ccfb2574a113428f61eaf58fe232916c7c30af2bb81f36359fee577d0fc95730692a68072e6e68f0bd4358
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XZ:NAB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

kobszTj.exe

Path C:\Windows\System\kobszTj.exe
Size 1.8MB
SHA256 12924a3ebf8795039fba9839d15de74f754099a992ec081402d489e39b7c989d
MD5 4653bbf8b6545f28f8d59ce84b7fb2cb
SHA1 96269da555fc0967d6ef394935d2d63c4ddfb5b2
SHA512 7433539a5817334e394eb83ee7d876103c23a18cd25883a52cbfd165182e6347c07dc34c6b4d34b12b85cb798308ab42af0215548c4828a91c610053d2fd2f70
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0X5p:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

neCgNuC.exe

Path C:\Windows\System\neCgNuC.exe
Size 1.8MB
SHA256 41de621dd6daad49121aa1565133b51264300b33d98b05a3526b3a221cf1e1e9
MD5 77e82cdb9f1142fa748feac0e0345e92
SHA1 f551fd8ea44bcace3e4af6a12ab3ae7ac0c77add
SHA512 f1e036e5ff443da0dedb0e7231206672994066ecd5bc85f549149757e47a6369d4806060c8e458d602f52b72e0f9dd80853106197052a09a4dfc978e5de3267b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0X9:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsZIBLS.exe

Path C:\Windows\System\nsZIBLS.exe
Size 1.8MB
SHA256 78c7e01091f068b931387588057241d878f07677496db3872cca665085c6fb28
MD5 de8e1e2360af4a63e93f14d84f2c2db3
SHA1 70b5535da9b671f8f844fa3910796ff070ae058f
SHA512 b16637f83c53a63a63510d04515f80672e2b976d258e7b0e9a7115b959565cc503a21dce99272ec294aef0cc58baa2289113f1305c9d0f4f4fa3984d5ee816b4
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XLx:NABV
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvYwdBw.exe

Path C:\Windows\System\nvYwdBw.exe
Size 1.8MB
SHA256 a265fd8d8ba4bfa260703008cfb777e8801c2fc2fd83b0c95f89592df0e471e1
MD5 3814cbf93d44cce59bc13d7734d6cec5
SHA1 6830c7475ef8704c9b3a94b4724632592c7bb6a7
SHA512 6b8bff066d936b8dd768f0437d56102432f8dcf29ab5a256d64206af9119b6d432b64a91d0b74b71d05b671f6d19fea1d3570e9ea9acfec96e38b4e2fe629ade
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xp:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

oPqzZNq.exe

Path C:\Windows\System\oPqzZNq.exe
Size 1.8MB
SHA256 e70c1066d70f01a3f556df4207e079d361587882ffd911b95240623c6dd65279
MD5 aa8f6ae26fd5e0826580a0c15a4f644e
SHA1 827170c924fb0657adbce30fc296081291d98dc9
SHA512 f5c4d371409662732b05a1e1dd7532e5499d09ce45c2d14700fc125c2933c5c9399be7099f241ead1cce9a5b0bbf7cf1c2355091dd192e2b8369a4eecccc8ae3
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XW:NAB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

pDKaDsg.exe

Path C:\Windows\System\pDKaDsg.exe
Size 1.8MB
SHA256 818e67d2607001538545ecba8319a1875897e564066f526b3980db4e5757bc8d
MD5 fce3236e083283199096f8a0b32d8782
SHA1 36d7f8d745dfbbdf96cf49624d4b77f106f051a1
SHA512 eb6fc92c68ddb1eab95250f8580d662f4e38c50a8a99ca369667facffaf1a438eebe86e11e9e6f285620c92e6785f590b9888406a79c81666e3d5f75aa7e8fa3
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0X7:NABb
MD5 SHA1 SHA512 SSDEEP

Submit Download

qWLldgg.exe

Path C:\Windows\System\qWLldgg.exe
Size 1.8MB
SHA256 8c4fbb34732bc36a746c1dcab81d8a8cae48beeb58d9075015d8a6e249fc289c
MD5 187e7c28a5099bf27f0593c2b7a6cf81
SHA1 4512a7d24c3a9a6455fef51631f1d75a134e6ef0
SHA512 0141cc3cd17c7fdc29de3e84daf5d88a7fed0ee6ffebb5d99b0e8059c39969fbf3f48526f49e5329c7776587dde48f93167d8bce1690321ba8e799e82ad68377
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XE:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

qYeIVub.exe

Path C:\Windows\System\qYeIVub.exe
Size 1.8MB
SHA256 62b265dc8292b55698e9eff2a646f6ecb22babffa993410a9890b31868df2d5c
MD5 ce9b8f7bf3aa9b30f6b9f4e4f6d1fd37
SHA1 a6a9431bcf3a6025c6c0cbccf95a076eb88b340c
SHA512 5f4460f3a318a8232f73c6620f841d45a1eb879997fe9e3b174e8dad3ecb06b80c093f2211d227fa84e5129ef4c1089ad61aeb3d0ceb209c13dc1327992fa107
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0X9:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

qpHMcPc.exe

Path C:\Windows\System\qpHMcPc.exe
Size 1.8MB
SHA256 d5be8c0f303b4be1c4ef6d2b5e606234e84610580aff4f675ca25ea2e40fb40d
MD5 b1a5ac9057313362646948a731113c31
SHA1 4ae1faedb54c79e26f98ccd2d2c24431ae09b6df
SHA512 67f89a2184306bd7bde771ee8a1eb92d396b65a414a013f3e8fe7d287aeec50144be770004a9bacd07a2e5a768b2c5debed3118dd0555e4f2bb288e555c39a67
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XA:NABg
MD5 SHA1 SHA512 SSDEEP

Submit Download

qupQgmJ.exe

Path C:\Windows\System\qupQgmJ.exe
Size 1.8MB
SHA256 8188bd9f4575f2449b8b27d39064dfb7c16f1d8c18a18cf0d6ecff80b0026512
MD5 ca97833a400c67b28e78c76bc088416f
SHA1 fb9ad0a9bd870639b3d8db0a030b2301dbacce76
SHA512 1b205ac6ee4411032fb475807fa0eaf5c653cdff4ab3f061d375e65e604b0c241f1282729a346cebfc94607eab585ab671dd2d2a9112ad7f9745f3c6bad45961
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XDW:NABy
MD5 SHA1 SHA512 SSDEEP

Submit Download

rJeXhDy.exe

Path C:\Windows\System\rJeXhDy.exe
Size 1.8MB
SHA256 688849cf56fb3c4d2eed18a853550fb5c573c13552374fe8429221f362a97d2b
MD5 79d204d5448fb64fa25219e582778447
SHA1 8b4fa64d7884f556704599bbb787964bd819e81d
SHA512 1cb7d39934b3fcdb01c84c44ad8c11e51f44e85f31544b4c8ed7c2e691b4b5d8380282c06ea4d4f4c8b5334e58ea428e20cdc7306b99476d3815c8472607c970
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XE:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

roPtSfA.exe

Path C:\Windows\System\roPtSfA.exe
Size 1.8MB
SHA256 1050117f2c45d61fe2982002a458351b60e203ca1ff7fdd48c22783e1d32f5c8
MD5 92e1119cae0a4652b7625175d93e5000
SHA1 1c1016a707b59ed4cfb1f5b4a3b79717d82ea425
SHA512 baea61ab1dcd81a858bb4d43548a7350f3cc16b0ec8119ec0be89aaf03001470da86b20f2b87b90985ea89a0977f08d375d54c2e3adbe5ef0f30fae725821b95
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XM:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

tjdgKmr.exe

Path C:\Windows\System\tjdgKmr.exe
Size 1.8MB
SHA256 3d5eb9227b8de303ed1ff79a96c05f21bb57d14ebb4291b178fd0fd7b53bd016
MD5 5ede7f9164279d4c1e6519eec6dcf6c9
SHA1 05fb7a450385166e3e9d6f80d1132569daf78502
SHA512 6b79d73cfaf3a6872668941aac3c3596b36ab751e959c7565af64a764495b703141998c8ef6dc709b7af4a1c7dd1893e1bd3d88b36eeb22d075ead31e1c17ab9
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xi:NABC
MD5 SHA1 SHA512 SSDEEP

Submit Download

uoxAEas.exe

Path C:\Windows\System\uoxAEas.exe
Size 1.8MB
SHA256 4fb0c9fa6285fc4d4719b99e2f66eb5f347100fa49707aeb3fd02fcd0e714a9d
MD5 e0aef0a364952902471edd701c5c09d4
SHA1 53afc2f709d015b2037df3dea77a41ddcc11a45a
SHA512 d5ee79489a9a36a73556e82d9fcf1e702c14119067b08a1c3225021e8f5d788d55a49dca7ac89c1c086148e13bf1dedea71112f93bd4f59d606df4407092db38
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XE:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

vJzfeqS.exe

Path C:\Windows\System\vJzfeqS.exe
Size 1.8MB
SHA256 e74dc12cb74511d07f5109e66cd611ba30fcbe86a524b5cbb40fb751b404f343
MD5 df939fd96ca57025dfb4b3a9ce22cdec
SHA1 7d84bf465d5c65e73bfaa4d71eeeb6a5115ca631
SHA512 4ecc1ef03abe40607e97210d12769c18cae7b1b57f33a780d35a05de74dcf9968d00c4c8b27f4a1c6392c5cbf25dcb8806e8bc80088f7c7d637e53e6756cd02b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0XF:NABl
MD5 SHA1 SHA512 SSDEEP

Submit Download

wlBqmvq.exe

Path C:\Windows\System\wlBqmvq.exe
Size 1.8MB
SHA256 dd98803f03edf68b311dadfbddf5288db90921bd81c903405224f600c1199170
MD5 a671bf86eae924b69df28698ccae4cad
SHA1 07366bdb6b686334f34cacd2dad52a0cc7e3549f
SHA512 e8d7bc5495078bb6edf31c0f91a991d9622adb3a8af9e6dc2c0ff6f26ae2704eddf72e3b6e820f1ca883a1b1596de04158c23df38c359c9d380c739b1363a9da
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xjk:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

yjpmMYh.exe

Path C:\Windows\System\yjpmMYh.exe
Size 1.8MB
SHA256 255bb328cd3573ed57f11d096226d7c2dcbf10980266ec9253b85d7f0f07b8a5
MD5 7d5828dd8b5381b1514ed57df5914ae1
SHA1 b880739ab2c9335173cf2db411e66579da570830
SHA512 fe601a4ae4c94fe0b83875eb9ae8751f00c86398dd849792ea779090b1c9f934de24618e96489dabb1304a2875e20183ed6dfd95eea37d7585da8518d057e623
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xu:NABO
MD5 SHA1 SHA512 SSDEEP

Submit Download

zpPODNb.exe

Path C:\Windows\System\zpPODNb.exe
Size 1.8MB
SHA256 6f28a79d2e8b21e5a3231d9f12ca3811d4fe5baf7527763b1337e979c60d6c4b
MD5 b7488a135a3535fc8e77d4cc12026863
SHA1 bd5ac51ec873cb37e3c6263fceccd4ffca39ede8
SHA512 8a372ac611b958b6191e36950caf3c9684e0d4ef029aa842597758f37f9d93fe11c533b13b28514b98b0449c55ef67f95c97f4fd152efb34b0de3b6bf4b786e5
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0Xv:NABP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-29-0x00007FF71B9A0000-0x00007FF71BD92000-memory.dmp

Download

memory/900-167-0x00007FF7F4BC0000-0x00007FF7F4FB2000-memory.dmp

Download

memory/1156-285-0x00007FF7BF0B0000-0x00007FF7BF4A2000-memory.dmp

Download

memory/1420-468-0x00007FF791A50000-0x00007FF791E42000-memory.dmp

Download

memory/1428-250-0x00007FF7A2B80000-0x00007FF7A2F72000-memory.dmp

Download

memory/1820-406-0x00007FF73A050000-0x00007FF73A442000-memory.dmp

Download

memory/1948-297-0x00007FF7DB470000-0x00007FF7DB862000-memory.dmp

Download

memory/2132-5147-0x00007FF755DF0000-0x00007FF7561E2000-memory.dmp

Download

memory/2132-265-0x00007FF755DF0000-0x00007FF7561E2000-memory.dmp

Download

memory/2248-1-0x000002400BC90000-0x000002400BCA0000-memory.dmp

Download

memory/2248-0-0x00007FF737150000-0x00007FF737542000-memory.dmp

Download

memory/2288-2118-0x00007FF900090000-0x00007FF900359000-memory.dmp

Download

memory/2288-296-0x00000194C6930000-0x00000194C6952000-memory.dmp

Download

memory/2288-12-0x00007FF900090000-0x00007FF900359000-memory.dmp

Download

memory/2288-444-0x00007FF900090000-0x00007FF900359000-memory.dmp

Download

memory/2288-57-0x00007FF900090000-0x00007FF900359000-memory.dmp

Download

memory/2500-127-0x00007FF746D80000-0x00007FF747172000-memory.dmp

Download

memory/2888-353-0x00007FF7976A0000-0x00007FF797A92000-memory.dmp

Download

memory/3108-209-0x00007FF7F4F40000-0x00007FF7F5332000-memory.dmp

Download

memory/3340-469-0x00007FF7CEF00000-0x00007FF7CF2F2000-memory.dmp

Download

memory/3692-467-0x00007FF78BB70000-0x00007FF78BF62000-memory.dmp

Download

memory/4004-123-0x00007FF7621B0000-0x00007FF7625A2000-memory.dmp

Download

memory/4184-352-0x00007FF6822A0000-0x00007FF682692000-memory.dmp

Download

memory/4364-5264-0x00007FF7DD180000-0x00007FF7DD572000-memory.dmp

Download

memory/4364-341-0x00007FF7DD180000-0x00007FF7DD572000-memory.dmp

Download

memory/4492-350-0x00007FF66A840000-0x00007FF66AC32000-memory.dmp

Download

memory/4716-5156-0x00007FF6B61E0000-0x00007FF6B65D2000-memory.dmp

Download

memory/4716-4646-0x00007FF6B61E0000-0x00007FF6B65D2000-memory.dmp

Download

memory/4716-90-0x00007FF6B61E0000-0x00007FF6B65D2000-memory.dmp

Download

memory/4852-5057-0x00007FF628180000-0x00007FF628572000-memory.dmp

Download

memory/4852-36-0x00007FF628180000-0x00007FF628572000-memory.dmp

Download

memory/4944-470-0x00007FF79B220000-0x00007FF79B612000-memory.dmp

Download

memory/4944-5139-0x00007FF79B220000-0x00007FF79B612000-memory.dmp

Download

memory/4984-471-0x00007FF666040000-0x00007FF666432000-memory.dmp

Download

memory/4992-286-0x00007FF64B290000-0x00007FF64B682000-memory.dmp

Download

memory/5032-441-0x00007FF691B90000-0x00007FF691F82000-memory.dmp

Download

memory/5036-64-0x00007FF683FB0000-0x00007FF6843A2000-memory.dmp

Download

memory/5036-4643-0x00007FF683FB0000-0x00007FF6843A2000-memory.dmp

Download