xmrig | d2cd947ddab1190fc6fb5ee12d1581eafc22d27686dd26367a410a2ecb34d66c

Analysis

max time kernel
12s
max time network
30s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
Size

1.4MB
MD5

01d81e0823a9fe6bf5e4f24cbcd32523
SHA1

3a44d8942b1d2e0e06a19cadd5f94666613562d7
SHA256

d2cd947ddab1190fc6fb5ee12d1581eafc22d27686dd26367a410a2ecb34d66c
SHA512

d8b159e4196e9244c0222bb8ffff4d04aef6288aa279c6f318d83fac506414050f076dcd2c10b756b6146602ab42d2efb4b1fd9c02e7a8162517c08cdd3f46f3
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPw5n:Lz071uv4BPMkibTIA5CJG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2176-9-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/2552-282-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2640-75-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2204-72-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2476-69-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2428-68-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2176-66-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/3028-60-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/2804-104-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2104-99-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2176	TgkeeGl.exe
2204	wVNdOhW.exe
2640	XMqIxek.exe
2104	MqAgBTz.exe
2552	luTVwOD.exe
1984	YHEzEEE.exe
2428	ZnLystk.exe
2476	gPPkQiS.exe
3040	hFAUoSq.exe
2804	hJFgqUp.exe
2980	AoyyfiW.exe
2984	ySjFjfE.exe
336	JRonmRz.exe
2420	CLZDXvc.exe
2172	EVeHszP.exe
2752	XAgxCUY.exe
1568	CZbtdMq.exe
880	qVOGRoJ.exe
540	EAwYvRL.exe
2528	dsKEzQM.exe
2792	vrdIngB.exe
1032	WmRGrmq.exe
1864	cwACwmv.exe
1072	PscWvsG.exe
2944	IFUrnOz.exe
896	VxlFUDb.exe
1940	rTsVIqr.exe
2672	ZxZraLm.exe
780	rdgSsYY.exe
2688	FVjwXmP.exe
2780	pVxGTvy.exe
320	KjsGKvK.exe
1688	SkpIoae.exe
1708	nCXjnHi.exe
2308	DNfDVJh.exe
1872	XLzcHcK.exe
1112	DqBZjlr.exe
3056	vsmFlyR.exe
2848	SKgeXVT.exe
2860	hVmsdvS.exe
1380	uEBAjNq.exe
1808	KcFDslK.exe
1264	ROkcBtl.exe
1724	nckCRIl.exe
900	WaReddq.exe
2132	uLFFRTZ.exe
2656	ITTgwzQ.exe
2628	ZySCrVs.exe
2852	MzBIYlh.exe
2488	wcbafSy.exe
2664	UMFtGwD.exe
2928	disiuXy.exe
2304	jnLmTqx.exe
592	ekgwdBB.exe
1824	WaKxsWB.exe
2160	ZXBdVVA.exe
904	aXTxiiw.exe
2716	TSBVrkg.exe
3036	WFJokVt.exe
308	GpezMUy.exe
716	rboHVTP.exe
584	MleZuSp.exe
3020	BzaFcFb.exe
1324	GVRuiQj.exe

Loads dropped DLL 64 IoCs

pid	Process
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3028-2-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/files/0x000d000000012342-3.dat	upx
behavioral1/memory/2176-9-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/files/0x0034000000014aa2-10.dat	upx
behavioral1/memory/3028-13-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x0008000000014e51-12.dat	upx
behavioral1/memory/2640-21-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/files/0x000700000001508a-32.dat	upx
behavioral1/memory/2104-31-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/files/0x0007000000014f71-25.dat	upx
behavioral1/memory/2552-40-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/files/0x0008000000015659-47.dat	upx
behavioral1/files/0x0034000000014b27-61.dat	upx
behavioral1/files/0x000900000001566b-70.dat	upx
behavioral1/files/0x0006000000016a9a-146.dat	upx
behavioral1/files/0x0006000000016da7-201.dat	upx
behavioral1/files/0x0006000000016d7e-192.dat	upx
behavioral1/files/0x0006000000016d26-182.dat	upx
behavioral1/memory/2552-282-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/files/0x0006000000016c4a-148.dat	upx
behavioral1/files/0x0006000000016d90-194.dat	upx
behavioral1/files/0x0006000000016d3a-183.dat	upx
behavioral1/files/0x0006000000016d1e-176.dat	upx
behavioral1/files/0x0006000000016ce4-162.dat	upx
behavioral1/files/0x0006000000016c6b-155.dat	upx
behavioral1/files/0x0006000000016d0d-172.dat	upx
behavioral1/files/0x0006000000016cb7-160.dat	upx
behavioral1/files/0x0006000000016c63-154.dat	upx
behavioral1/files/0x000600000001661c-139.dat	upx
behavioral1/files/0x00060000000164b2-123.dat	upx
behavioral1/files/0x00060000000161e7-115.dat	upx
behavioral1/files/0x0006000000015fe9-107.dat	upx
behavioral1/files/0x0006000000015eaf-100.dat	upx
behavioral1/files/0x0006000000015d9b-92.dat	upx
behavioral1/files/0x0006000000015d87-86.dat	upx
behavioral1/files/0x0006000000015d6f-80.dat	upx
behavioral1/memory/2640-75-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/files/0x0006000000015d67-74.dat	upx
behavioral1/memory/3040-73-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2204-72-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2476-69-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2428-68-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2176-66-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/memory/1984-63-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/3028-60-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/files/0x0007000000004e76-55.dat	upx
behavioral1/files/0x0006000000016843-141.dat	upx
behavioral1/files/0x0006000000016572-127.dat	upx
behavioral1/files/0x000600000001630b-119.dat	upx
behavioral1/files/0x0006000000016117-111.dat	upx
behavioral1/memory/2804-104-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x0006000000015f6d-103.dat	upx
behavioral1/memory/2104-99-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/files/0x0006000000015e3a-96.dat	upx
behavioral1/files/0x0006000000015d8f-89.dat	upx
behavioral1/files/0x0006000000015d79-83.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JRonmRz.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\CvljGdO.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\zDVivXA.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\CXFrFtz.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\lIBuAWU.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\uCEDwUt.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\EKBLvVM.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\zYvxVHA.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\hfHouZW.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\pFlEjXI.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\zFqxPqo.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\XktIjwn.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\JUNWRvZ.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\rWKAuIR.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\DxRaclS.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\tKIxXHI.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\LoONJVj.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\YHEzEEE.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\OGeCAcu.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\debFyDu.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\SqHvdKR.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\uEBAjNq.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\TDFmdqj.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\tvosECf.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\NmHtIFY.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\JzoTvBc.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\yrYsBlE.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\WaKxsWB.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\jINJXVP.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\GWLmaZk.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\pSWzXgm.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\CzfsEKe.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\UGOOlgF.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\aXTxiiw.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\saFSbdk.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\ZMBMrcY.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\BHPmEnV.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\IpvvpKt.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\NwsSVJy.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\dJbiZPh.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\QJGPAaA.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\LFOUmtL.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\XJjFNhT.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\YPdqgmV.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\UfbVswI.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\ennVCiJ.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\CexaPlY.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\vsmFlyR.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\ZXBdVVA.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\smyBISq.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\qfeMlmq.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\ovqJXAc.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\dyLvGFq.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\DowgeUJ.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\itbMQyS.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\uqPUJPJ.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\iDNKoQi.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\wLUCcqJ.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\yzHLYGn.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\DNfDVJh.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\uLFFRTZ.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\ITTgwzQ.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\IeRsGdv.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
File created	C:\Windows\System\aAlStnf.exe	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2012	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
Token: SeDebugPrivilege	2012	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2012	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	29
PID 3028 wrote to memory of 2012	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	29
PID 3028 wrote to memory of 2012	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	29
PID 3028 wrote to memory of 2176	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2176	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2176	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2204	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2204	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2204	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2640	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	32
PID 3028 wrote to memory of 2640	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	32
PID 3028 wrote to memory of 2640	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	32
PID 3028 wrote to memory of 2104	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	33
PID 3028 wrote to memory of 2104	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	33
PID 3028 wrote to memory of 2104	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	33
PID 3028 wrote to memory of 2552	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	34
PID 3028 wrote to memory of 2552	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	34
PID 3028 wrote to memory of 2552	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	34
PID 3028 wrote to memory of 1984	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	35
PID 3028 wrote to memory of 1984	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	35
PID 3028 wrote to memory of 1984	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	35
PID 3028 wrote to memory of 2428	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	36
PID 3028 wrote to memory of 2428	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	36
PID 3028 wrote to memory of 2428	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	36
PID 3028 wrote to memory of 2476	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	37
PID 3028 wrote to memory of 2476	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	37
PID 3028 wrote to memory of 2476	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	37
PID 3028 wrote to memory of 3040	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	38
PID 3028 wrote to memory of 3040	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	38
PID 3028 wrote to memory of 3040	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	38
PID 3028 wrote to memory of 2804	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	39
PID 3028 wrote to memory of 2804	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	39
PID 3028 wrote to memory of 2804	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	39
PID 3028 wrote to memory of 2980	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	40
PID 3028 wrote to memory of 2980	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	40
PID 3028 wrote to memory of 2980	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	40
PID 3028 wrote to memory of 2944	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	41
PID 3028 wrote to memory of 2944	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	41
PID 3028 wrote to memory of 2944	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	41
PID 3028 wrote to memory of 2984	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	42
PID 3028 wrote to memory of 2984	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	42
PID 3028 wrote to memory of 2984	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	42
PID 3028 wrote to memory of 2672	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	43
PID 3028 wrote to memory of 2672	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	43
PID 3028 wrote to memory of 2672	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	43
PID 3028 wrote to memory of 336	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	44
PID 3028 wrote to memory of 336	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	44
PID 3028 wrote to memory of 336	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	44
PID 3028 wrote to memory of 780	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	45
PID 3028 wrote to memory of 780	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	45
PID 3028 wrote to memory of 780	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	45
PID 3028 wrote to memory of 2420	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	46
PID 3028 wrote to memory of 2420	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	46
PID 3028 wrote to memory of 2420	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	46
PID 3028 wrote to memory of 2688	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	47
PID 3028 wrote to memory of 2688	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	47
PID 3028 wrote to memory of 2688	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	47
PID 3028 wrote to memory of 2172	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	48
PID 3028 wrote to memory of 2172	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	48
PID 3028 wrote to memory of 2172	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	48
PID 3028 wrote to memory of 2780	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	49
PID 3028 wrote to memory of 2780	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	49
PID 3028 wrote to memory of 2780	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	49
PID 3028 wrote to memory of 2752	3028	01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01d81e0823a9fe6bf5e4f24cbcd32523_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Windows\System\TgkeeGl.exe
  C:\Windows\System\TgkeeGl.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\wVNdOhW.exe
  C:\Windows\System\wVNdOhW.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\XMqIxek.exe
  C:\Windows\System\XMqIxek.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\MqAgBTz.exe
  C:\Windows\System\MqAgBTz.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\luTVwOD.exe
  C:\Windows\System\luTVwOD.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\YHEzEEE.exe
  C:\Windows\System\YHEzEEE.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\ZnLystk.exe
  C:\Windows\System\ZnLystk.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\gPPkQiS.exe
  C:\Windows\System\gPPkQiS.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\hFAUoSq.exe
  C:\Windows\System\hFAUoSq.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\hJFgqUp.exe
  C:\Windows\System\hJFgqUp.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\AoyyfiW.exe
  C:\Windows\System\AoyyfiW.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\IFUrnOz.exe
  C:\Windows\System\IFUrnOz.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\ySjFjfE.exe
  C:\Windows\System\ySjFjfE.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\ZxZraLm.exe
  C:\Windows\System\ZxZraLm.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\JRonmRz.exe
  C:\Windows\System\JRonmRz.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\rdgSsYY.exe
  C:\Windows\System\rdgSsYY.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\CLZDXvc.exe
  C:\Windows\System\CLZDXvc.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\FVjwXmP.exe
  C:\Windows\System\FVjwXmP.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\EVeHszP.exe
  C:\Windows\System\EVeHszP.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\pVxGTvy.exe
  C:\Windows\System\pVxGTvy.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\XAgxCUY.exe
  C:\Windows\System\XAgxCUY.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\KjsGKvK.exe
  C:\Windows\System\KjsGKvK.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\CZbtdMq.exe
  C:\Windows\System\CZbtdMq.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\SkpIoae.exe
  C:\Windows\System\SkpIoae.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\qVOGRoJ.exe
  C:\Windows\System\qVOGRoJ.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\nCXjnHi.exe
  C:\Windows\System\nCXjnHi.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\EAwYvRL.exe
  C:\Windows\System\EAwYvRL.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\DNfDVJh.exe
  C:\Windows\System\DNfDVJh.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\dsKEzQM.exe
  C:\Windows\System\dsKEzQM.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\NUggAPP.exe
  C:\Windows\System\NUggAPP.exe
  2⤵
  PID:2876
- C:\Windows\System\vrdIngB.exe
  C:\Windows\System\vrdIngB.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\IFxggFy.exe
  C:\Windows\System\IFxggFy.exe
  2⤵
  PID:488
- C:\Windows\System\WmRGrmq.exe
  C:\Windows\System\WmRGrmq.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\fjtJdyN.exe
  C:\Windows\System\fjtJdyN.exe
  2⤵
  PID:1508
- C:\Windows\System\cwACwmv.exe
  C:\Windows\System\cwACwmv.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\yrYsBlE.exe
  C:\Windows\System\yrYsBlE.exe
  2⤵
  PID:1868
- C:\Windows\System\PscWvsG.exe
  C:\Windows\System\PscWvsG.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\YmmozID.exe
  C:\Windows\System\YmmozID.exe
  2⤵
  PID:2140
- C:\Windows\System\VxlFUDb.exe
  C:\Windows\System\VxlFUDb.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\gAWmEpI.exe
  C:\Windows\System\gAWmEpI.exe
  2⤵
  PID:1692
- C:\Windows\System\rTsVIqr.exe
  C:\Windows\System\rTsVIqr.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\UHOrInp.exe
  C:\Windows\System\UHOrInp.exe
  2⤵
  PID:1120
- C:\Windows\System\XLzcHcK.exe
  C:\Windows\System\XLzcHcK.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\aUyRNLb.exe
  C:\Windows\System\aUyRNLb.exe
  2⤵
  PID:1012
- C:\Windows\System\DqBZjlr.exe
  C:\Windows\System\DqBZjlr.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\uqSRBST.exe
  C:\Windows\System\uqSRBST.exe
  2⤵
  PID:1036
- C:\Windows\System\vsmFlyR.exe
  C:\Windows\System\vsmFlyR.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\KOEgJFX.exe
  C:\Windows\System\KOEgJFX.exe
  2⤵
  PID:2920
- C:\Windows\System\SKgeXVT.exe
  C:\Windows\System\SKgeXVT.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\okWfLOY.exe
  C:\Windows\System\okWfLOY.exe
  2⤵
  PID:1656
- C:\Windows\System\hVmsdvS.exe
  C:\Windows\System\hVmsdvS.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\gAXarAm.exe
  C:\Windows\System\gAXarAm.exe
  2⤵
  PID:2288
- C:\Windows\System\uEBAjNq.exe
  C:\Windows\System\uEBAjNq.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\PifaLVU.exe
  C:\Windows\System\PifaLVU.exe
  2⤵
  PID:1220
- C:\Windows\System\KcFDslK.exe
  C:\Windows\System\KcFDslK.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\VXajdMO.exe
  C:\Windows\System\VXajdMO.exe
  2⤵
  PID:1728
- C:\Windows\System\ROkcBtl.exe
  C:\Windows\System\ROkcBtl.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\LkzvPQw.exe
  C:\Windows\System\LkzvPQw.exe
  2⤵
  PID:1612
- C:\Windows\System\nckCRIl.exe
  C:\Windows\System\nckCRIl.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\PTzmWaQ.exe
  C:\Windows\System\PTzmWaQ.exe
  2⤵
  PID:568
- C:\Windows\System\WaReddq.exe
  C:\Windows\System\WaReddq.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\mTJyiJU.exe
  C:\Windows\System\mTJyiJU.exe
  2⤵
  PID:2540
- C:\Windows\System\uLFFRTZ.exe
  C:\Windows\System\uLFFRTZ.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\QbpEIJh.exe
  C:\Windows\System\QbpEIJh.exe
  2⤵
  PID:2188
- C:\Windows\System\ITTgwzQ.exe
  C:\Windows\System\ITTgwzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\uxvGnih.exe
  C:\Windows\System\uxvGnih.exe
  2⤵
  PID:2720
- C:\Windows\System\ZySCrVs.exe
  C:\Windows\System\ZySCrVs.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\uCEDwUt.exe
  C:\Windows\System\uCEDwUt.exe
  2⤵
  PID:2732
- C:\Windows\System\MzBIYlh.exe
  C:\Windows\System\MzBIYlh.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\kTvtJiU.exe
  C:\Windows\System\kTvtJiU.exe
  2⤵
  PID:2432
- C:\Windows\System\wcbafSy.exe
  C:\Windows\System\wcbafSy.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\KZZrSGd.exe
  C:\Windows\System\KZZrSGd.exe
  2⤵
  PID:2796
- C:\Windows\System\UMFtGwD.exe
  C:\Windows\System\UMFtGwD.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\IiAwGCq.exe
  C:\Windows\System\IiAwGCq.exe
  2⤵
  PID:784
- C:\Windows\System\disiuXy.exe
  C:\Windows\System\disiuXy.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\jlfNVHA.exe
  C:\Windows\System\jlfNVHA.exe
  2⤵
  PID:2768
- C:\Windows\System\jnLmTqx.exe
  C:\Windows\System\jnLmTqx.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\PatjmEi.exe
  C:\Windows\System\PatjmEi.exe
  2⤵
  PID:268
- C:\Windows\System\ekgwdBB.exe
  C:\Windows\System\ekgwdBB.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\qtXBAPx.exe
  C:\Windows\System\qtXBAPx.exe
  2⤵
  PID:1996
- C:\Windows\System\WaKxsWB.exe
  C:\Windows\System\WaKxsWB.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\YnjAFbw.exe
  C:\Windows\System\YnjAFbw.exe
  2⤵
  PID:1172
- C:\Windows\System\ZXBdVVA.exe
  C:\Windows\System\ZXBdVVA.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\BjYzRww.exe
  C:\Windows\System\BjYzRww.exe
  2⤵
  PID:1008
- C:\Windows\System\aXTxiiw.exe
  C:\Windows\System\aXTxiiw.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\KKUzfHQ.exe
  C:\Windows\System\KKUzfHQ.exe
  2⤵
  PID:1584
- C:\Windows\System\TSBVrkg.exe
  C:\Windows\System\TSBVrkg.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\pvJRyOk.exe
  C:\Windows\System\pvJRyOk.exe
  2⤵
  PID:2560
- C:\Windows\System\WFJokVt.exe
  C:\Windows\System\WFJokVt.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\giGvubG.exe
  C:\Windows\System\giGvubG.exe
  2⤵
  PID:2452
- C:\Windows\System\GpezMUy.exe
  C:\Windows\System\GpezMUy.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\bhgukBd.exe
  C:\Windows\System\bhgukBd.exe
  2⤵
  PID:2800
- C:\Windows\System\rboHVTP.exe
  C:\Windows\System\rboHVTP.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\UHaJCLC.exe
  C:\Windows\System\UHaJCLC.exe
  2⤵
  PID:2776
- C:\Windows\System\MleZuSp.exe
  C:\Windows\System\MleZuSp.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\PlZEsPo.exe
  C:\Windows\System\PlZEsPo.exe
  2⤵
  PID:1332
- C:\Windows\System\BzaFcFb.exe
  C:\Windows\System\BzaFcFb.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\ZNhpyqr.exe
  C:\Windows\System\ZNhpyqr.exe
  2⤵
  PID:2908
- C:\Windows\System\GVRuiQj.exe
  C:\Windows\System\GVRuiQj.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\KwpBMsg.exe
  C:\Windows\System\KwpBMsg.exe
  2⤵
  PID:3084
- C:\Windows\System\UGOOlgF.exe
  C:\Windows\System\UGOOlgF.exe
  2⤵
  PID:3100
- C:\Windows\System\rWKAuIR.exe
  C:\Windows\System\rWKAuIR.exe
  2⤵
  PID:3116
- C:\Windows\System\mZAgNhp.exe
  C:\Windows\System\mZAgNhp.exe
  2⤵
  PID:3132
- C:\Windows\System\pkqraAy.exe
  C:\Windows\System\pkqraAy.exe
  2⤵
  PID:3148
- C:\Windows\System\CpAmgAo.exe
  C:\Windows\System\CpAmgAo.exe
  2⤵
  PID:3164
- C:\Windows\System\BvZAGTS.exe
  C:\Windows\System\BvZAGTS.exe
  2⤵
  PID:3180
- C:\Windows\System\ldGZUZD.exe
  C:\Windows\System\ldGZUZD.exe
  2⤵
  PID:3196
- C:\Windows\System\pforkQt.exe
  C:\Windows\System\pforkQt.exe
  2⤵
  PID:3212
- C:\Windows\System\LlvQjzL.exe
  C:\Windows\System\LlvQjzL.exe
  2⤵
  PID:3228
- C:\Windows\System\UXVhrAj.exe
  C:\Windows\System\UXVhrAj.exe
  2⤵
  PID:3244
- C:\Windows\System\yUjIfIp.exe
  C:\Windows\System\yUjIfIp.exe
  2⤵
  PID:3260
- C:\Windows\System\umjoAJV.exe
  C:\Windows\System\umjoAJV.exe
  2⤵
  PID:3276
- C:\Windows\System\smyBISq.exe
  C:\Windows\System\smyBISq.exe
  2⤵
  PID:3292
- C:\Windows\System\zkzZtqM.exe
  C:\Windows\System\zkzZtqM.exe
  2⤵
  PID:3308
- C:\Windows\System\tNPhLsC.exe
  C:\Windows\System\tNPhLsC.exe
  2⤵
  PID:3324
- C:\Windows\System\vLMVVLC.exe
  C:\Windows\System\vLMVVLC.exe
  2⤵
  PID:3340
- C:\Windows\System\jzLdegD.exe
  C:\Windows\System\jzLdegD.exe
  2⤵
  PID:3356
- C:\Windows\System\qOIhwIL.exe
  C:\Windows\System\qOIhwIL.exe
  2⤵
  PID:3372
- C:\Windows\System\EYrHmJH.exe
  C:\Windows\System\EYrHmJH.exe
  2⤵
  PID:3388
- C:\Windows\System\rAYbkbT.exe
  C:\Windows\System\rAYbkbT.exe
  2⤵
  PID:3404
- C:\Windows\System\Oxaiuyo.exe
  C:\Windows\System\Oxaiuyo.exe
  2⤵
  PID:3420
- C:\Windows\System\hTtDntB.exe
  C:\Windows\System\hTtDntB.exe
  2⤵
  PID:3436
- C:\Windows\System\WZeqcAC.exe
  C:\Windows\System\WZeqcAC.exe
  2⤵
  PID:3452
- C:\Windows\System\XSXNXGw.exe
  C:\Windows\System\XSXNXGw.exe
  2⤵
  PID:3468
- C:\Windows\System\bXVHDXo.exe
  C:\Windows\System\bXVHDXo.exe
  2⤵
  PID:3484
- C:\Windows\System\NMmupSj.exe
  C:\Windows\System\NMmupSj.exe
  2⤵
  PID:3500
- C:\Windows\System\defwTPL.exe
  C:\Windows\System\defwTPL.exe
  2⤵
  PID:3516
- C:\Windows\System\EMktjtD.exe
  C:\Windows\System\EMktjtD.exe
  2⤵
  PID:3532
- C:\Windows\System\BlMhPIv.exe
  C:\Windows\System\BlMhPIv.exe
  2⤵
  PID:3548
- C:\Windows\System\ztgdBpu.exe
  C:\Windows\System\ztgdBpu.exe
  2⤵
  PID:3564
- C:\Windows\System\eQpMlHj.exe
  C:\Windows\System\eQpMlHj.exe
  2⤵
  PID:3580
- C:\Windows\System\NRKaeZX.exe
  C:\Windows\System\NRKaeZX.exe
  2⤵
  PID:3596
- C:\Windows\System\fZfQGmi.exe
  C:\Windows\System\fZfQGmi.exe
  2⤵
  PID:3612
- C:\Windows\System\ksYJQQX.exe
  C:\Windows\System\ksYJQQX.exe
  2⤵
  PID:3628
- C:\Windows\System\VLhMuzQ.exe
  C:\Windows\System\VLhMuzQ.exe
  2⤵
  PID:3644
- C:\Windows\System\OGeCAcu.exe
  C:\Windows\System\OGeCAcu.exe
  2⤵
  PID:3660
- C:\Windows\System\QFkKLKH.exe
  C:\Windows\System\QFkKLKH.exe
  2⤵
  PID:3676
- C:\Windows\System\Hvoyjnd.exe
  C:\Windows\System\Hvoyjnd.exe
  2⤵
  PID:3692
- C:\Windows\System\YBfXJCE.exe
  C:\Windows\System\YBfXJCE.exe
  2⤵
  PID:3708
- C:\Windows\System\iigDell.exe
  C:\Windows\System\iigDell.exe
  2⤵
  PID:3724
- C:\Windows\System\XofssnT.exe
  C:\Windows\System\XofssnT.exe
  2⤵
  PID:3740
- C:\Windows\System\JCyzRSK.exe
  C:\Windows\System\JCyzRSK.exe
  2⤵
  PID:3756
- C:\Windows\System\jINJXVP.exe
  C:\Windows\System\jINJXVP.exe
  2⤵
  PID:3772
- C:\Windows\System\XIpFFYX.exe
  C:\Windows\System\XIpFFYX.exe
  2⤵
  PID:3788
- C:\Windows\System\kXwCJFS.exe
  C:\Windows\System\kXwCJFS.exe
  2⤵
  PID:3804
- C:\Windows\System\elPRsrL.exe
  C:\Windows\System\elPRsrL.exe
  2⤵
  PID:3820
- C:\Windows\System\IeRsGdv.exe
  C:\Windows\System\IeRsGdv.exe
  2⤵
  PID:3836
- C:\Windows\System\CvljGdO.exe
  C:\Windows\System\CvljGdO.exe
  2⤵
  PID:3852
- C:\Windows\System\gahLULN.exe
  C:\Windows\System\gahLULN.exe
  2⤵
  PID:3868
- C:\Windows\System\DXvAnft.exe
  C:\Windows\System\DXvAnft.exe
  2⤵
  PID:3884
- C:\Windows\System\FCKVzxd.exe
  C:\Windows\System\FCKVzxd.exe
  2⤵
  PID:3904
- C:\Windows\System\imMbNkr.exe
  C:\Windows\System\imMbNkr.exe
  2⤵
  PID:3920
- C:\Windows\System\zrKijao.exe
  C:\Windows\System\zrKijao.exe
  2⤵
  PID:3936
- C:\Windows\System\YxIYpao.exe
  C:\Windows\System\YxIYpao.exe
  2⤵
  PID:3952
- C:\Windows\System\bbPglUf.exe
  C:\Windows\System\bbPglUf.exe
  2⤵
  PID:3968
- C:\Windows\System\bfjEDKl.exe
  C:\Windows\System\bfjEDKl.exe
  2⤵
  PID:3984
- C:\Windows\System\EKBLvVM.exe
  C:\Windows\System\EKBLvVM.exe
  2⤵
  PID:4000
- C:\Windows\System\ovqJXAc.exe
  C:\Windows\System\ovqJXAc.exe
  2⤵
  PID:4016
- C:\Windows\System\ZhhpEdV.exe
  C:\Windows\System\ZhhpEdV.exe
  2⤵
  PID:4032
- C:\Windows\System\Qywutwv.exe
  C:\Windows\System\Qywutwv.exe
  2⤵
  PID:4048
- C:\Windows\System\gmErntE.exe
  C:\Windows\System\gmErntE.exe
  2⤵
  PID:4068
- C:\Windows\System\iDNKoQi.exe
  C:\Windows\System\iDNKoQi.exe
  2⤵
  PID:4084
- C:\Windows\System\SZiAcxc.exe
  C:\Windows\System\SZiAcxc.exe
  2⤵
  PID:1516
- C:\Windows\System\zYvxVHA.exe
  C:\Windows\System\zYvxVHA.exe
  2⤵
  PID:788
- C:\Windows\System\MEjHduy.exe
  C:\Windows\System\MEjHduy.exe
  2⤵
  PID:2392
- C:\Windows\System\OdjiZoh.exe
  C:\Windows\System\OdjiZoh.exe
  2⤵
  PID:3076
- C:\Windows\System\TDFmdqj.exe
  C:\Windows\System\TDFmdqj.exe
  2⤵
  PID:3108
- C:\Windows\System\tDhpgRt.exe
  C:\Windows\System\tDhpgRt.exe
  2⤵
  PID:3176
- C:\Windows\System\OBFWmCR.exe
  C:\Windows\System\OBFWmCR.exe
  2⤵
  PID:3240
- C:\Windows\System\NwsSVJy.exe
  C:\Windows\System\NwsSVJy.exe
  2⤵
  PID:3304
- C:\Windows\System\iMAKRhd.exe
  C:\Windows\System\iMAKRhd.exe
  2⤵
  PID:3368
- C:\Windows\System\hfHouZW.exe
  C:\Windows\System\hfHouZW.exe
  2⤵
  PID:3432
- C:\Windows\System\mUsUZLB.exe
  C:\Windows\System\mUsUZLB.exe
  2⤵
  PID:3496
- C:\Windows\System\XapQgCT.exe
  C:\Windows\System\XapQgCT.exe
  2⤵
  PID:3560
- C:\Windows\System\mFxeUOs.exe
  C:\Windows\System\mFxeUOs.exe
  2⤵
  PID:3620
- C:\Windows\System\pFlEjXI.exe
  C:\Windows\System\pFlEjXI.exe
  2⤵
  PID:3684
- C:\Windows\System\shBrnvx.exe
  C:\Windows\System\shBrnvx.exe
  2⤵
  PID:3748
- C:\Windows\System\Mghdshi.exe
  C:\Windows\System\Mghdshi.exe
  2⤵
  PID:3812
- C:\Windows\System\oiMyUrz.exe
  C:\Windows\System\oiMyUrz.exe
  2⤵
  PID:3876
- C:\Windows\System\CECrFKF.exe
  C:\Windows\System\CECrFKF.exe
  2⤵
  PID:3912
- C:\Windows\System\OepveuO.exe
  C:\Windows\System\OepveuO.exe
  2⤵
  PID:452
- C:\Windows\System\VkjLrye.exe
  C:\Windows\System\VkjLrye.exe
  2⤵
  PID:1664
- C:\Windows\System\mTSOYOk.exe
  C:\Windows\System\mTSOYOk.exe
  2⤵
  PID:4112
- C:\Windows\System\QyFcvMN.exe
  C:\Windows\System\QyFcvMN.exe
  2⤵
  PID:4128
- C:\Windows\System\zyubSbc.exe
  C:\Windows\System\zyubSbc.exe
  2⤵
  PID:4144
- C:\Windows\System\aPXtlNU.exe
  C:\Windows\System\aPXtlNU.exe
  2⤵
  PID:4160
- C:\Windows\System\xfnLANU.exe
  C:\Windows\System\xfnLANU.exe
  2⤵
  PID:4176
- C:\Windows\System\gXdrzHA.exe
  C:\Windows\System\gXdrzHA.exe
  2⤵
  PID:4196
- C:\Windows\System\XwISlsw.exe
  C:\Windows\System\XwISlsw.exe
  2⤵
  PID:4212
- C:\Windows\System\BoZGovK.exe
  C:\Windows\System\BoZGovK.exe
  2⤵
  PID:4228
- C:\Windows\System\NjzJJDE.exe
  C:\Windows\System\NjzJJDE.exe
  2⤵
  PID:4244
- C:\Windows\System\qwMjOyE.exe
  C:\Windows\System\qwMjOyE.exe
  2⤵
  PID:4260
- C:\Windows\System\WVnpeGe.exe
  C:\Windows\System\WVnpeGe.exe
  2⤵
  PID:4280
- C:\Windows\System\zFqxPqo.exe
  C:\Windows\System\zFqxPqo.exe
  2⤵
  PID:4296
- C:\Windows\System\tvosECf.exe
  C:\Windows\System\tvosECf.exe
  2⤵
  PID:4312
- C:\Windows\System\xKtfDyF.exe
  C:\Windows\System\xKtfDyF.exe
  2⤵
  PID:4328
- C:\Windows\System\MLQakFv.exe
  C:\Windows\System\MLQakFv.exe
  2⤵
  PID:4344
- C:\Windows\System\CojduaB.exe
  C:\Windows\System\CojduaB.exe
  2⤵
  PID:4360
- C:\Windows\System\iwEGDZa.exe
  C:\Windows\System\iwEGDZa.exe
  2⤵
  PID:4376
- C:\Windows\System\ecbfSfA.exe
  C:\Windows\System\ecbfSfA.exe
  2⤵
  PID:4392
- C:\Windows\System\ktwGKAc.exe
  C:\Windows\System\ktwGKAc.exe
  2⤵
  PID:4408
- C:\Windows\System\ovfoNfp.exe
  C:\Windows\System\ovfoNfp.exe
  2⤵
  PID:4424
- C:\Windows\System\aAlStnf.exe
  C:\Windows\System\aAlStnf.exe
  2⤵
  PID:4440
- C:\Windows\System\iqyQFSC.exe
  C:\Windows\System\iqyQFSC.exe
  2⤵
  PID:4456
- C:\Windows\System\ZRamGLb.exe
  C:\Windows\System\ZRamGLb.exe
  2⤵
  PID:4476
- C:\Windows\System\gFxRHkF.exe
  C:\Windows\System\gFxRHkF.exe
  2⤵
  PID:4492
- C:\Windows\System\JbQwXOo.exe
  C:\Windows\System\JbQwXOo.exe
  2⤵
  PID:4508
- C:\Windows\System\TQHOizT.exe
  C:\Windows\System\TQHOizT.exe
  2⤵
  PID:4524
- C:\Windows\System\lHARMwa.exe
  C:\Windows\System\lHARMwa.exe
  2⤵
  PID:4540
- C:\Windows\System\PXabLME.exe
  C:\Windows\System\PXabLME.exe
  2⤵
  PID:4556
- C:\Windows\System\ecLsBPv.exe
  C:\Windows\System\ecLsBPv.exe
  2⤵
  PID:4572
- C:\Windows\System\QBcztvM.exe
  C:\Windows\System\QBcztvM.exe
  2⤵
  PID:4588
- C:\Windows\System\JgXymNo.exe
  C:\Windows\System\JgXymNo.exe
  2⤵
  PID:4604
- C:\Windows\System\MSLHpPx.exe
  C:\Windows\System\MSLHpPx.exe
  2⤵
  PID:4620
- C:\Windows\System\TXEHZhJ.exe
  C:\Windows\System\TXEHZhJ.exe
  2⤵
  PID:4636
- C:\Windows\System\aqSyhos.exe
  C:\Windows\System\aqSyhos.exe
  2⤵
  PID:4652
- C:\Windows\System\dOluYzr.exe
  C:\Windows\System\dOluYzr.exe
  2⤵
  PID:4668
- C:\Windows\System\TJCKkSI.exe
  C:\Windows\System\TJCKkSI.exe
  2⤵
  PID:4684
- C:\Windows\System\XlQxbfe.exe
  C:\Windows\System\XlQxbfe.exe
  2⤵
  PID:4700
- C:\Windows\System\wLUCcqJ.exe
  C:\Windows\System\wLUCcqJ.exe
  2⤵
  PID:4720
- C:\Windows\System\LFOUmtL.exe
  C:\Windows\System\LFOUmtL.exe
  2⤵
  PID:4736
- C:\Windows\System\USTpjZj.exe
  C:\Windows\System\USTpjZj.exe
  2⤵
  PID:4752
- C:\Windows\System\XHVYBbY.exe
  C:\Windows\System\XHVYBbY.exe
  2⤵
  PID:4768
- C:\Windows\System\PfTYmDw.exe
  C:\Windows\System\PfTYmDw.exe
  2⤵
  PID:4784
- C:\Windows\System\UfbVswI.exe
  C:\Windows\System\UfbVswI.exe
  2⤵
  PID:4800
- C:\Windows\System\FdcxuwD.exe
  C:\Windows\System\FdcxuwD.exe
  2⤵
  PID:4816
- C:\Windows\System\EujCMTn.exe
  C:\Windows\System\EujCMTn.exe
  2⤵
  PID:4832
- C:\Windows\System\NSMwBTn.exe
  C:\Windows\System\NSMwBTn.exe
  2⤵
  PID:4848
- C:\Windows\System\GKENVOV.exe
  C:\Windows\System\GKENVOV.exe
  2⤵
  PID:4864
- C:\Windows\System\dyLvGFq.exe
  C:\Windows\System\dyLvGFq.exe
  2⤵
  PID:4880
- C:\Windows\System\UvTUDAB.exe
  C:\Windows\System\UvTUDAB.exe
  2⤵
  PID:4896
- C:\Windows\System\IXzNnjG.exe
  C:\Windows\System\IXzNnjG.exe
  2⤵
  PID:4912
- C:\Windows\System\bMUxrIp.exe
  C:\Windows\System\bMUxrIp.exe
  2⤵
  PID:4928
- C:\Windows\System\XJjFNhT.exe
  C:\Windows\System\XJjFNhT.exe
  2⤵
  PID:4944
- C:\Windows\System\BrCdgEK.exe
  C:\Windows\System\BrCdgEK.exe
  2⤵
  PID:4960
- C:\Windows\System\hOEdrDq.exe
  C:\Windows\System\hOEdrDq.exe
  2⤵
  PID:4976
- C:\Windows\System\oPBuvqY.exe
  C:\Windows\System\oPBuvqY.exe
  2⤵
  PID:4992
- C:\Windows\System\WnjGzAm.exe
  C:\Windows\System\WnjGzAm.exe
  2⤵
  PID:5008
- C:\Windows\System\WhNDndP.exe
  C:\Windows\System\WhNDndP.exe
  2⤵
  PID:5024
- C:\Windows\System\KBfeSbg.exe
  C:\Windows\System\KBfeSbg.exe
  2⤵
  PID:5040
- C:\Windows\System\MZiEqlD.exe
  C:\Windows\System\MZiEqlD.exe
  2⤵
  PID:5056
- C:\Windows\System\PUGZkFt.exe
  C:\Windows\System\PUGZkFt.exe
  2⤵
  PID:5072
- C:\Windows\System\tWFhPQG.exe
  C:\Windows\System\tWFhPQG.exe
  2⤵
  PID:5088
- C:\Windows\System\zXlQYKh.exe
  C:\Windows\System\zXlQYKh.exe
  2⤵
  PID:5104
- C:\Windows\System\YFrDGFK.exe
  C:\Windows\System\YFrDGFK.exe
  2⤵
  PID:3944
- C:\Windows\System\FVcYVgc.exe
  C:\Windows\System\FVcYVgc.exe
  2⤵
  PID:4008
- C:\Windows\System\MDfEArg.exe
  C:\Windows\System\MDfEArg.exe
  2⤵
  PID:4076
- C:\Windows\System\zDVivXA.exe
  C:\Windows\System\zDVivXA.exe
  2⤵
  PID:2280
- C:\Windows\System\RRsPVAn.exe
  C:\Windows\System\RRsPVAn.exe
  2⤵
  PID:3172
- C:\Windows\System\erVrfys.exe
  C:\Windows\System\erVrfys.exe
  2⤵
  PID:3428
- C:\Windows\System\WdsVgxj.exe
  C:\Windows\System\WdsVgxj.exe
  2⤵
  PID:3656
- C:\Windows\System\tLdMdUQ.exe
  C:\Windows\System\tLdMdUQ.exe
  2⤵
  PID:1920
- C:\Windows\System\dJbiZPh.exe
  C:\Windows\System\dJbiZPh.exe
  2⤵
  PID:4120
- C:\Windows\System\qaddUkU.exe
  C:\Windows\System\qaddUkU.exe
  2⤵
  PID:3008
- C:\Windows\System\NuMaJwl.exe
  C:\Windows\System\NuMaJwl.exe
  2⤵
  PID:1768
- C:\Windows\System\XpyGieK.exe
  C:\Windows\System\XpyGieK.exe
  2⤵
  PID:2756
- C:\Windows\System\AXMovvg.exe
  C:\Windows\System\AXMovvg.exe
  2⤵
  PID:412
- C:\Windows\System\GWLmaZk.exe
  C:\Windows\System\GWLmaZk.exe
  2⤵
  PID:276
- C:\Windows\System\zKfZMUM.exe
  C:\Windows\System\zKfZMUM.exe
  2⤵
  PID:856
- C:\Windows\System\RxCoTwG.exe
  C:\Windows\System\RxCoTwG.exe
  2⤵
  PID:2940
- C:\Windows\System\fdMVOWf.exe
  C:\Windows\System\fdMVOWf.exe
  2⤵
  PID:1936
- C:\Windows\System\cyfcmwo.exe
  C:\Windows\System\cyfcmwo.exe
  2⤵
  PID:2892
- C:\Windows\System\EDuTWnH.exe
  C:\Windows\System\EDuTWnH.exe
  2⤵
  PID:888
- C:\Windows\System\YJzSxhM.exe
  C:\Windows\System\YJzSxhM.exe
  2⤵
  PID:5128
- C:\Windows\System\xyyEcyL.exe
  C:\Windows\System\xyyEcyL.exe
  2⤵
  PID:5144
- C:\Windows\System\XktIjwn.exe
  C:\Windows\System\XktIjwn.exe
  2⤵
  PID:5160
- C:\Windows\System\yuPJtms.exe
  C:\Windows\System\yuPJtms.exe
  2⤵
  PID:5176
- C:\Windows\System\iYecrgP.exe
  C:\Windows\System\iYecrgP.exe
  2⤵
  PID:5192
- C:\Windows\System\OCNXUgB.exe
  C:\Windows\System\OCNXUgB.exe
  2⤵
  PID:5208
- C:\Windows\System\QJGPAaA.exe
  C:\Windows\System\QJGPAaA.exe
  2⤵
  PID:5224
- C:\Windows\System\kbVjdWF.exe
  C:\Windows\System\kbVjdWF.exe
  2⤵
  PID:5240
- C:\Windows\System\tYhJAIg.exe
  C:\Windows\System\tYhJAIg.exe
  2⤵
  PID:5256
- C:\Windows\System\EsqchIe.exe
  C:\Windows\System\EsqchIe.exe
  2⤵
  PID:5272
- C:\Windows\System\mxtnngu.exe
  C:\Windows\System\mxtnngu.exe
  2⤵
  PID:5288
- C:\Windows\System\vzGpvLh.exe
  C:\Windows\System\vzGpvLh.exe
  2⤵
  PID:5304
- C:\Windows\System\eWtBTop.exe
  C:\Windows\System\eWtBTop.exe
  2⤵
  PID:5320
- C:\Windows\System\YPdqgmV.exe
  C:\Windows\System\YPdqgmV.exe
  2⤵
  PID:5336
- C:\Windows\System\ywQuawp.exe
  C:\Windows\System\ywQuawp.exe
  2⤵
  PID:5352
- C:\Windows\System\ennVCiJ.exe
  C:\Windows\System\ennVCiJ.exe
  2⤵
  PID:5368
- C:\Windows\System\UudqRSa.exe
  C:\Windows\System\UudqRSa.exe
  2⤵
  PID:5384
- C:\Windows\System\DxRaclS.exe
  C:\Windows\System\DxRaclS.exe
  2⤵
  PID:5400
- C:\Windows\System\otblstx.exe
  C:\Windows\System\otblstx.exe
  2⤵
  PID:5416
- C:\Windows\System\tThAGUO.exe
  C:\Windows\System\tThAGUO.exe
  2⤵
  PID:5552
- C:\Windows\System\eyWCrHc.exe
  C:\Windows\System\eyWCrHc.exe
  2⤵
  PID:5612
- C:\Windows\System\VIXTJLz.exe
  C:\Windows\System\VIXTJLz.exe
  2⤵
  PID:5676
- C:\Windows\System\xnCDNbV.exe
  C:\Windows\System\xnCDNbV.exe
  2⤵
  PID:5692
- C:\Windows\System\yzHLYGn.exe
  C:\Windows\System\yzHLYGn.exe
  2⤵
  PID:5868
- C:\Windows\System\tUiwpQj.exe
  C:\Windows\System\tUiwpQj.exe
  2⤵
  PID:5884
- C:\Windows\System\Mycexjk.exe
  C:\Windows\System\Mycexjk.exe
  2⤵
  PID:5900
- C:\Windows\System\qfeMlmq.exe
  C:\Windows\System\qfeMlmq.exe
  2⤵
  PID:5916
- C:\Windows\System\eObWkkD.exe
  C:\Windows\System\eObWkkD.exe
  2⤵
  PID:5932
- C:\Windows\System\ceBXACO.exe
  C:\Windows\System\ceBXACO.exe
  2⤵
  PID:5948
- C:\Windows\System\DowgeUJ.exe
  C:\Windows\System\DowgeUJ.exe
  2⤵
  PID:5964
- C:\Windows\System\NRYMele.exe
  C:\Windows\System\NRYMele.exe
  2⤵
  PID:5980
- C:\Windows\System\itbMQyS.exe
  C:\Windows\System\itbMQyS.exe
  2⤵
  PID:5996
- C:\Windows\System\ZzeWesF.exe
  C:\Windows\System\ZzeWesF.exe
  2⤵
  PID:6012
- C:\Windows\System\oYJoiLs.exe
  C:\Windows\System\oYJoiLs.exe
  2⤵
  PID:6028
- C:\Windows\System\sqBWuTl.exe
  C:\Windows\System\sqBWuTl.exe
  2⤵
  PID:6044
- C:\Windows\System\ziTpKgz.exe
  C:\Windows\System\ziTpKgz.exe
  2⤵
  PID:6060
- C:\Windows\System\uLHUidD.exe
  C:\Windows\System\uLHUidD.exe
  2⤵
  PID:6084
- C:\Windows\System\EKeAVGc.exe
  C:\Windows\System\EKeAVGc.exe
  2⤵
  PID:6100
- C:\Windows\System\SCaoxTB.exe
  C:\Windows\System\SCaoxTB.exe
  2⤵
  PID:6116
- C:\Windows\System\vOzPJfq.exe
  C:\Windows\System\vOzPJfq.exe
  2⤵
  PID:6132
- C:\Windows\System\qVsJHWS.exe
  C:\Windows\System\qVsJHWS.exe
  2⤵
  PID:1588
- C:\Windows\System\cIxlTyR.exe
  C:\Windows\System\cIxlTyR.exe
  2⤵
  PID:4156
- C:\Windows\System\OdGLwgG.exe
  C:\Windows\System\OdGLwgG.exe
  2⤵
  PID:4388
- C:\Windows\System\dfVZWvz.exe
  C:\Windows\System\dfVZWvz.exe
  2⤵
  PID:4452
- C:\Windows\System\PdmwJZc.exe
  C:\Windows\System\PdmwJZc.exe
  2⤵
  PID:4520
- C:\Windows\System\kMQfvbX.exe
  C:\Windows\System\kMQfvbX.exe
  2⤵
  PID:4584
- C:\Windows\System\hDKptnK.exe
  C:\Windows\System\hDKptnK.exe
  2⤵
  PID:4648
- C:\Windows\System\sSpSODU.exe
  C:\Windows\System\sSpSODU.exe
  2⤵
  PID:4712
- C:\Windows\System\tFVMghR.exe
  C:\Windows\System\tFVMghR.exe
  2⤵
  PID:4776
- C:\Windows\System\fqnyKxN.exe
  C:\Windows\System\fqnyKxN.exe
  2⤵
  PID:4840
- C:\Windows\System\hzKXVCm.exe
  C:\Windows\System\hzKXVCm.exe
  2⤵
  PID:4904
- C:\Windows\System\BrUohzo.exe
  C:\Windows\System\BrUohzo.exe
  2⤵
  PID:4968
- C:\Windows\System\HMeUuQP.exe
  C:\Windows\System\HMeUuQP.exe
  2⤵
  PID:5032
- C:\Windows\System\GHyPYAx.exe
  C:\Windows\System\GHyPYAx.exe
  2⤵
  PID:5096
- C:\Windows\System\XCTHohB.exe
  C:\Windows\System\XCTHohB.exe
  2⤵
  PID:2180
- C:\Windows\System\qjHaPQC.exe
  C:\Windows\System\qjHaPQC.exe
  2⤵
  PID:1924
- C:\Windows\System\GaVuCAt.exe
  C:\Windows\System\GaVuCAt.exe
  2⤵
  PID:1596
- C:\Windows\System\rDuWCdm.exe
  C:\Windows\System\rDuWCdm.exe
  2⤵
  PID:1564
- C:\Windows\System\zqLQlDp.exe
  C:\Windows\System\zqLQlDp.exe
  2⤵
  PID:5124
- C:\Windows\System\UcdzQcf.exe
  C:\Windows\System\UcdzQcf.exe
  2⤵
  PID:5188
- C:\Windows\System\GytUAhb.exe
  C:\Windows\System\GytUAhb.exe
  2⤵
  PID:5252
- C:\Windows\System\FvcYRBQ.exe
  C:\Windows\System\FvcYRBQ.exe
  2⤵
  PID:5316
- C:\Windows\System\OStjprN.exe
  C:\Windows\System\OStjprN.exe
  2⤵
  PID:5380
- C:\Windows\System\OcETMlk.exe
  C:\Windows\System\OcETMlk.exe
  2⤵
  PID:5564
- C:\Windows\System\cvTRhBi.exe
  C:\Windows\System\cvTRhBi.exe
  2⤵
  PID:628
- C:\Windows\System\POletpf.exe
  C:\Windows\System\POletpf.exe
  2⤵
  PID:2292
- C:\Windows\System\debFyDu.exe
  C:\Windows\System\debFyDu.exe
  2⤵
  PID:2372
- C:\Windows\System\SiAleEr.exe
  C:\Windows\System\SiAleEr.exe
  2⤵
  PID:2652
- C:\Windows\System\kkoyMeH.exe
  C:\Windows\System\kkoyMeH.exe
  2⤵
  PID:2824
- C:\Windows\System\iUzMHAx.exe
  C:\Windows\System\iUzMHAx.exe
  2⤵
  PID:648
- C:\Windows\System\snoMXxb.exe
  C:\Windows\System\snoMXxb.exe
  2⤵
  PID:3052
- C:\Windows\System\fCjhnHO.exe
  C:\Windows\System\fCjhnHO.exe
  2⤵
  PID:2008
- C:\Windows\System\DIasPQD.exe
  C:\Windows\System\DIasPQD.exe
  2⤵
  PID:2296
- C:\Windows\System\GsqquQK.exe
  C:\Windows\System\GsqquQK.exe
  2⤵
  PID:1556
- C:\Windows\System\ozTbjiO.exe
  C:\Windows\System\ozTbjiO.exe
  2⤵
  PID:3092
- C:\Windows\System\myYobdB.exe
  C:\Windows\System\myYobdB.exe
  2⤵
  PID:3192
- C:\Windows\System\FcWPkGy.exe
  C:\Windows\System\FcWPkGy.exe
  2⤵
  PID:3316
- C:\Windows\System\iqercsE.exe
  C:\Windows\System\iqercsE.exe
  2⤵
  PID:3544
- C:\Windows\System\dbvIWcJ.exe
  C:\Windows\System\dbvIWcJ.exe
  2⤵
  PID:3736
- C:\Windows\System\mxRWqfF.exe
  C:\Windows\System\mxRWqfF.exe
  2⤵
  PID:3860
- C:\Windows\System\qePIGHO.exe
  C:\Windows\System\qePIGHO.exe
  2⤵
  PID:3932
- C:\Windows\System\CBvICeA.exe
  C:\Windows\System\CBvICeA.exe
  2⤵
  PID:4024
- C:\Windows\System\YJYhBqc.exe
  C:\Windows\System\YJYhBqc.exe
  2⤵
  PID:1792
- C:\Windows\System\ixBzJmI.exe
  C:\Windows\System\ixBzJmI.exe
  2⤵
  PID:5568
- C:\Windows\System\oWmCxAH.exe
  C:\Windows\System\oWmCxAH.exe
  2⤵
  PID:5584
- C:\Windows\System\ZYXCWnh.exe
  C:\Windows\System\ZYXCWnh.exe
  2⤵
  PID:5600
- C:\Windows\System\XSLFicy.exe
  C:\Windows\System\XSLFicy.exe
  2⤵
  PID:5688
- C:\Windows\System\hZTIGcu.exe
  C:\Windows\System\hZTIGcu.exe
  2⤵
  PID:5876
- C:\Windows\System\eFYdzXY.exe
  C:\Windows\System\eFYdzXY.exe
  2⤵
  PID:4168
- C:\Windows\System\VPLyIvY.exe
  C:\Windows\System\VPLyIvY.exe
  2⤵
  PID:4236
- C:\Windows\System\TOVNlHW.exe
  C:\Windows\System\TOVNlHW.exe
  2⤵
  PID:4276
- C:\Windows\System\BHPmEnV.exe
  C:\Windows\System\BHPmEnV.exe
  2⤵
  PID:4368
- C:\Windows\System\TgRoViB.exe
  C:\Windows\System\TgRoViB.exe
  2⤵
  PID:1696
- C:\Windows\System\OWYZrcn.exe
  C:\Windows\System\OWYZrcn.exe
  2⤵
  PID:4472
- C:\Windows\System\iOGcESG.exe
  C:\Windows\System\iOGcESG.exe
  2⤵
  PID:4504
- C:\Windows\System\NZxsLAu.exe
  C:\Windows\System\NZxsLAu.exe
  2⤵
  PID:4600
- C:\Windows\System\diMnSfq.exe
  C:\Windows\System\diMnSfq.exe
  2⤵
  PID:5940
- C:\Windows\System\yvXRIVP.exe
  C:\Windows\System\yvXRIVP.exe
  2⤵
  PID:4828
- C:\Windows\System\jXDzLYa.exe
  C:\Windows\System\jXDzLYa.exe
  2⤵
  PID:4920
- C:\Windows\System\zpNayOz.exe
  C:\Windows\System\zpNayOz.exe
  2⤵
  PID:5016
- C:\Windows\System\nWTTAHb.exe
  C:\Windows\System\nWTTAHb.exe
  2⤵
  PID:1076
- C:\Windows\System\XOGYZdX.exe
  C:\Windows\System\XOGYZdX.exe
  2⤵
  PID:1928
- C:\Windows\System\zgHwFdD.exe
  C:\Windows\System\zgHwFdD.exe
  2⤵
  PID:6004
- C:\Windows\System\xmKXuWl.exe
  C:\Windows\System\xmKXuWl.exe
  2⤵
  PID:2284
- C:\Windows\System\kBimwGK.exe
  C:\Windows\System\kBimwGK.exe
  2⤵
  PID:6036
- C:\Windows\System\awBBmAy.exe
  C:\Windows\System\awBBmAy.exe
  2⤵
  PID:3016
- C:\Windows\System\vxPmpRN.exe
  C:\Windows\System\vxPmpRN.exe
  2⤵
  PID:2440
- C:\Windows\System\oQNKSBB.exe
  C:\Windows\System\oQNKSBB.exe
  2⤵
  PID:2936
- C:\Windows\System\dUdLlZO.exe
  C:\Windows\System\dUdLlZO.exe
  2⤵
  PID:5760
- C:\Windows\System\MDFNlnm.exe
  C:\Windows\System\MDFNlnm.exe
  2⤵
  PID:5780
- C:\Windows\System\mgWQMtQ.exe
  C:\Windows\System\mgWQMtQ.exe
  2⤵
  PID:5800
- C:\Windows\System\YrdmPgY.exe
  C:\Windows\System\YrdmPgY.exe
  2⤵
  PID:2856
- C:\Windows\System\KLlFpkM.exe
  C:\Windows\System\KLlFpkM.exe
  2⤵
  PID:3256
- C:\Windows\System\mNLERTX.exe
  C:\Windows\System\mNLERTX.exe
  2⤵
  PID:3960
- C:\Windows\System\WvvkAYe.exe
  C:\Windows\System\WvvkAYe.exe
  2⤵
  PID:608
- C:\Windows\System\PlclGXX.exe
  C:\Windows\System\PlclGXX.exe
  2⤵
  PID:3236
- C:\Windows\System\OwgoOZa.exe
  C:\Windows\System\OwgoOZa.exe
  2⤵
  PID:5836
- C:\Windows\System\OkIVNMx.exe
  C:\Windows\System\OkIVNMx.exe
  2⤵
  PID:3364
- C:\Windows\System\VceMmbf.exe
  C:\Windows\System\VceMmbf.exe
  2⤵
  PID:1480
- C:\Windows\System\oCrltFS.exe
  C:\Windows\System\oCrltFS.exe
  2⤵
  PID:3848
- C:\Windows\System\EfDgEAG.exe
  C:\Windows\System\EfDgEAG.exe
  2⤵
  PID:4104
- C:\Windows\System\GhhYFOH.exe
  C:\Windows\System\GhhYFOH.exe
  2⤵
  PID:4304
- C:\Windows\System\SqHvdKR.exe
  C:\Windows\System\SqHvdKR.exe
  2⤵
  PID:4532
- C:\Windows\System\vLTmZKQ.exe
  C:\Windows\System\vLTmZKQ.exe
  2⤵
  PID:4632
- C:\Windows\System\zFtrpnU.exe
  C:\Windows\System\zFtrpnU.exe
  2⤵
  PID:6140
- C:\Windows\System\qZMxtaq.exe
  C:\Windows\System\qZMxtaq.exe
  2⤵
  PID:5048
- C:\Windows\System\xcMEvij.exe
  C:\Windows\System\xcMEvij.exe
  2⤵
  PID:2704
- C:\Windows\System\JUNWRvZ.exe
  C:\Windows\System\JUNWRvZ.exe
  2⤵
  PID:5724
- C:\Windows\System\rlzFufJ.exe
  C:\Windows\System\rlzFufJ.exe
  2⤵
  PID:5764
- C:\Windows\System\lwHvcny.exe
  C:\Windows\System\lwHvcny.exe
  2⤵
  PID:5816
- C:\Windows\System\CXFrFtz.exe
  C:\Windows\System\CXFrFtz.exe
  2⤵
  PID:5856
- C:\Windows\System\vRRXojr.exe
  C:\Windows\System\vRRXojr.exe
  2⤵
  PID:4728
- C:\Windows\System\hivdDoi.exe
  C:\Windows\System\hivdDoi.exe
  2⤵
  PID:4792
- C:\Windows\System\shxSTyi.exe
  C:\Windows\System\shxSTyi.exe
  2⤵
  PID:4956
- C:\Windows\System\RsgQQrF.exe
  C:\Windows\System\RsgQQrF.exe
  2⤵
  PID:5080
- C:\Windows\System\vPXBrIG.exe
  C:\Windows\System\vPXBrIG.exe
  2⤵
  PID:4040
- C:\Windows\System\ywjZmWk.exe
  C:\Windows\System\ywjZmWk.exe
  2⤵
  PID:2080
- C:\Windows\System\uqPUJPJ.exe
  C:\Windows\System\uqPUJPJ.exe
  2⤵
  PID:3000
- C:\Windows\System\oSNwcSf.exe
  C:\Windows\System\oSNwcSf.exe
  2⤵
  PID:5172
- C:\Windows\System\EZZnLeu.exe
  C:\Windows\System\EZZnLeu.exe
  2⤵
  PID:5236
- C:\Windows\System\VxOETXi.exe
  C:\Windows\System\VxOETXi.exe
  2⤵
  PID:5296
- C:\Windows\System\iaCBINY.exe
  C:\Windows\System\iaCBINY.exe
  2⤵
  PID:5360
- C:\Windows\System\wFktIhJ.exe
  C:\Windows\System\wFktIhJ.exe
  2⤵
  PID:5424
- C:\Windows\System\uxTmRoJ.exe
  C:\Windows\System\uxTmRoJ.exe
  2⤵
  PID:5440
- C:\Windows\System\mKAGQpk.exe
  C:\Windows\System\mKAGQpk.exe
  2⤵
  PID:5456
- C:\Windows\System\hjHCnHe.exe
  C:\Windows\System\hjHCnHe.exe
  2⤵
  PID:5472
- C:\Windows\System\CexaPlY.exe
  C:\Windows\System\CexaPlY.exe
  2⤵
  PID:5492
- C:\Windows\System\hDZktrQ.exe
  C:\Windows\System\hDZktrQ.exe
  2⤵
  PID:5508
- C:\Windows\System\PhwhSRC.exe
  C:\Windows\System\PhwhSRC.exe
  2⤵
  PID:5524
- C:\Windows\System\cvzjaqd.exe
  C:\Windows\System\cvzjaqd.exe
  2⤵
  PID:5540
- C:\Windows\System\xDdVFtv.exe
  C:\Windows\System\xDdVFtv.exe
  2⤵
  PID:5624
- C:\Windows\System\tKIxXHI.exe
  C:\Windows\System\tKIxXHI.exe
  2⤵
  PID:5640
- C:\Windows\System\pSWzXgm.exe
  C:\Windows\System\pSWzXgm.exe
  2⤵
  PID:5656
- C:\Windows\System\naIRZrz.exe
  C:\Windows\System\naIRZrz.exe
  2⤵
  PID:5672
- C:\Windows\System\eYXqxFk.exe
  C:\Windows\System\eYXqxFk.exe
  2⤵
  PID:5988
- C:\Windows\System\cwzAlMM.exe
  C:\Windows\System\cwzAlMM.exe
  2⤵
  PID:2508
- C:\Windows\System\DAaFpVz.exe
  C:\Windows\System\DAaFpVz.exe
  2⤵
  PID:4188
- C:\Windows\System\EAwKxDS.exe
  C:\Windows\System\EAwKxDS.exe
  2⤵
  PID:4184
- C:\Windows\System\IpvvpKt.exe
  C:\Windows\System\IpvvpKt.exe
  2⤵
  PID:4488
- C:\Windows\System\crsbKaT.exe
  C:\Windows\System\crsbKaT.exe
  2⤵
  PID:2712
- C:\Windows\System\saFSbdk.exe
  C:\Windows\System\saFSbdk.exe
  2⤵
  PID:1680
- C:\Windows\System\BYXqlge.exe
  C:\Windows\System\BYXqlge.exe
  2⤵
  PID:1732
- C:\Windows\System\lIBuAWU.exe
  C:\Windows\System\lIBuAWU.exe
  2⤵
  PID:2644
- C:\Windows\System\SgZsCLw.exe
  C:\Windows\System\SgZsCLw.exe
  2⤵
  PID:4744
- C:\Windows\System\GLFkpty.exe
  C:\Windows\System\GLFkpty.exe
  2⤵
  PID:4872
- C:\Windows\System\lFCJpKe.exe
  C:\Windows\System\lFCJpKe.exe
  2⤵
  PID:3976
- C:\Windows\System\IMenkzN.exe
  C:\Windows\System\IMenkzN.exe
  2⤵
  PID:2056
- C:\Windows\System\LoONJVj.exe
  C:\Windows\System\LoONJVj.exe
  2⤵
  PID:5348
- C:\Windows\System\RKWrVZY.exe
  C:\Windows\System\RKWrVZY.exe
  2⤵
  PID:2748
- C:\Windows\System\cbDvNuf.exe
  C:\Windows\System\cbDvNuf.exe
  2⤵
  PID:1292
- C:\Windows\System\beyeacJ.exe
  C:\Windows\System\beyeacJ.exe
  2⤵
  PID:2016
- C:\Windows\System\thRcuAh.exe
  C:\Windows\System\thRcuAh.exe
  2⤵
  PID:2320
- C:\Windows\System\emtFjBt.exe
  C:\Windows\System\emtFjBt.exe
  2⤵
  PID:4940
- C:\Windows\System\FqyfHkX.exe
  C:\Windows\System\FqyfHkX.exe
  2⤵
  PID:2088
- C:\Windows\System\kqkTWwx.exe
  C:\Windows\System\kqkTWwx.exe
  2⤵
  PID:5284
- C:\Windows\System\QKrqbJH.exe
  C:\Windows\System\QKrqbJH.exe
  2⤵
  PID:808
- C:\Windows\System\NJxeHGI.exe
  C:\Windows\System\NJxeHGI.exe
  2⤵
  PID:2960
- C:\Windows\System\iHeiogp.exe
  C:\Windows\System\iHeiogp.exe
  2⤵
  PID:1760
- C:\Windows\System\NEzNMAj.exe
  C:\Windows\System\NEzNMAj.exe
  2⤵
  PID:1780
- C:\Windows\System\EHcSklL.exe
  C:\Windows\System\EHcSklL.exe
  2⤵
  PID:3156
- C:\Windows\System\pdpqAKI.exe
  C:\Windows\System\pdpqAKI.exe
  2⤵
  PID:3284
- C:\Windows\System\AqiwCJY.exe
  C:\Windows\System\AqiwCJY.exe
  2⤵
  PID:2484
- C:\Windows\System\LkfkDAc.exe
  C:\Windows\System\LkfkDAc.exe
  2⤵
  PID:3384
- C:\Windows\System\CEJzZSG.exe
  C:\Windows\System\CEJzZSG.exe
  2⤵
  PID:1836
- C:\Windows\System\NhIaNuB.exe
  C:\Windows\System\NhIaNuB.exe
  2⤵
  PID:3448
- C:\Windows\System\DqTcFoY.exe
  C:\Windows\System\DqTcFoY.exe
  2⤵
  PID:3540
- C:\Windows\System\tnDzqoV.exe
  C:\Windows\System\tnDzqoV.exe
  2⤵
  PID:3828
- C:\Windows\System\tKQbeSK.exe
  C:\Windows\System\tKQbeSK.exe
  2⤵
  PID:3996
- C:\Windows\System\NmHtIFY.exe
  C:\Windows\System\NmHtIFY.exe
  2⤵
  PID:2676
- C:\Windows\System\lbEPxCj.exe
  C:\Windows\System\lbEPxCj.exe
  2⤵
  PID:3796
- C:\Windows\System\ZMBMrcY.exe
  C:\Windows\System\ZMBMrcY.exe
  2⤵
  PID:1980
- C:\Windows\System\NdXlplx.exe
  C:\Windows\System\NdXlplx.exe
  2⤵
  PID:4340
- C:\Windows\System\tfGXznK.exe
  C:\Windows\System\tfGXznK.exe
  2⤵
  PID:4564
- C:\Windows\System\cYlMGGp.exe
  C:\Windows\System\cYlMGGp.exe
  2⤵
  PID:3640
- C:\Windows\System\hcvOxMS.exe
  C:\Windows\System\hcvOxMS.exe
  2⤵
  PID:3704
- C:\Windows\System\sQaCSVF.exe
  C:\Windows\System\sQaCSVF.exe
  2⤵
  PID:4060
- C:\Windows\System\QWLaViK.exe
  C:\Windows\System\QWLaViK.exe
  2⤵
  PID:5684
- C:\Windows\System\RHTNPSl.exe
  C:\Windows\System\RHTNPSl.exe
  2⤵
  PID:4272
- C:\Windows\System\DrprlmL.exe
  C:\Windows\System\DrprlmL.exe
  2⤵
  PID:1956
- C:\Windows\System\ACstNZa.exe
  C:\Windows\System\ACstNZa.exe
  2⤵
  PID:2952
- C:\Windows\System\hRAfyBy.exe
  C:\Windows\System\hRAfyBy.exe
  2⤵
  PID:5912
- C:\Windows\System\qiqwCTM.exe
  C:\Windows\System\qiqwCTM.exe
  2⤵
  PID:6008
- C:\Windows\System\XkLzOgD.exe
  C:\Windows\System\XkLzOgD.exe
  2⤵
  PID:1620
- C:\Windows\System\wEbIboB.exe
  C:\Windows\System\wEbIboB.exe
  2⤵
  PID:5808
- C:\Windows\System\RofDxNa.exe
  C:\Windows\System\RofDxNa.exe
  2⤵
  PID:3900
- C:\Windows\System\NZjgcsV.exe
  C:\Windows\System\NZjgcsV.exe
  2⤵
  PID:3188
- C:\Windows\System\EgCdFmM.exe
  C:\Windows\System\EgCdFmM.exe
  2⤵
  PID:2164
- C:\Windows\System\nDkRelg.exe
  C:\Windows\System\nDkRelg.exe
  2⤵
  PID:5892
- C:\Windows\System\MKqSOmP.exe
  C:\Windows\System\MKqSOmP.exe
  2⤵
  PID:3144
- C:\Windows\System\JzoTvBc.exe
  C:\Windows\System\JzoTvBc.exe
  2⤵
  PID:2696
- C:\Windows\System\riJdNGj.exe
  C:\Windows\System\riJdNGj.exe
  2⤵
  PID:5752
- C:\Windows\System\TGYylWl.exe
  C:\Windows\System\TGYylWl.exe
  2⤵
  PID:5832
- C:\Windows\System\LKzziqQ.exe
  C:\Windows\System\LKzziqQ.exe
  2⤵
  PID:4952
- C:\Windows\System\CzfsEKe.exe
  C:\Windows\System\CzfsEKe.exe
  2⤵
  PID:5712
- C:\Windows\System\YCJJvDg.exe
  C:\Windows\System\YCJJvDg.exe
  2⤵
  PID:4628
- C:\Windows\System\yAfJqCK.exe
  C:\Windows\System\yAfJqCK.exe
  2⤵
  PID:5732
- C:\Windows\System\kPHCfXt.exe
  C:\Windows\System\kPHCfXt.exe
  2⤵
  PID:1200
- C:\Windows\System\pwCHdni.exe
  C:\Windows\System\pwCHdni.exe
  2⤵
  PID:5736
- C:\Windows\System\rfkJmiA.exe
  C:\Windows\System\rfkJmiA.exe
  2⤵
  PID:4764
- C:\Windows\System\BtaXHfa.exe
  C:\Windows\System\BtaXHfa.exe
  2⤵
  PID:832
- C:\Windows\System\DaIUHxd.exe
  C:\Windows\System\DaIUHxd.exe
  2⤵
  PID:2520
- C:\Windows\System\xyHlwLT.exe
  C:\Windows\System\xyHlwLT.exe
  2⤵
  PID:2028
- C:\Windows\System\CeIJEDs.exe
  C:\Windows\System\CeIJEDs.exe
  2⤵
  PID:5464
- C:\Windows\System\QMZtScb.exe
  C:\Windows\System\QMZtScb.exe
  2⤵
  PID:5332
- C:\Windows\System\RLyapIL.exe
  C:\Windows\System\RLyapIL.exe
  2⤵
  PID:5532
- C:\Windows\System\YrxJAeV.exe
  C:\Windows\System\YrxJAeV.exe
  2⤵
  PID:5480
- C:\Windows\System\CKWdDHj.exe
  C:\Windows\System\CKWdDHj.exe
  2⤵
  PID:5668
- C:\Windows\System\MkKUyJq.exe
  C:\Windows\System\MkKUyJq.exe
  2⤵
  PID:6052
- C:\Windows\System\MHtBcfV.exe
  C:\Windows\System\MHtBcfV.exe
  2⤵
  PID:1396
- C:\Windows\System\NlVjNFo.exe
  C:\Windows\System\NlVjNFo.exe
  2⤵
  PID:5484
- C:\Windows\System\aBimSej.exe
  C:\Windows\System\aBimSej.exe
  2⤵
  PID:4708
- C:\Windows\System\SsBjHIs.exe
  C:\Windows\System\SsBjHIs.exe
  2⤵
  PID:5220
- C:\Windows\System\lSztQif.exe
  C:\Windows\System\lSztQif.exe
  2⤵
  PID:2736
- C:\Windows\System\ywzlKgU.exe
  C:\Windows\System\ywzlKgU.exe
  2⤵
  PID:3400
- C:\Windows\System\tCizIJP.exe
  C:\Windows\System\tCizIJP.exe
  2⤵
  PID:5704
- C:\Windows\System\paMjHuH.exe
  C:\Windows\System\paMjHuH.exe
  2⤵
  PID:1532
- C:\Windows\System\NGfjtJK.exe
  C:\Windows\System\NGfjtJK.exe
  2⤵
  PID:2364
- C:\Windows\System\qmiDuIC.exe
  C:\Windows\System\qmiDuIC.exe
  2⤵
  PID:3480
- C:\Windows\System\CTfdWjW.exe
  C:\Windows\System\CTfdWjW.exe
  2⤵
  PID:3512
- C:\Windows\System\tTKshzW.exe
  C:\Windows\System\tTKshzW.exe
  2⤵
  PID:4336
- C:\Windows\System\LzgsdKu.exe
  C:\Windows\System\LzgsdKu.exe
  2⤵
  PID:3892
- C:\Windows\System\uOKutWe.exe
  C:\Windows\System\uOKutWe.exe
  2⤵
  PID:4824
- C:\Windows\System\YkbhxWG.exe
  C:\Windows\System\YkbhxWG.exe
  2⤵
  PID:2316
- C:\Windows\System\vibdHhl.exe
  C:\Windows\System\vibdHhl.exe
  2⤵
  PID:2772
- C:\Windows\System\RNjAQbe.exe
  C:\Windows\System\RNjAQbe.exe
  2⤵
  PID:2464
- C:\Windows\System\NvPsApM.exe
  C:\Windows\System\NvPsApM.exe
  2⤵
  PID:4616
- C:\Windows\System\KOicOaA.exe
  C:\Windows\System\KOicOaA.exe
  2⤵
  PID:728
- C:\Windows\System\ZjZBPra.exe
  C:\Windows\System\ZjZBPra.exe
  2⤵
  PID:1772
- C:\Windows\System\pyuuIrq.exe
  C:\Windows\System\pyuuIrq.exe
  2⤵
  PID:3208
- C:\Windows\System\PMuoNiN.exe
  C:\Windows\System\PMuoNiN.exe
  2⤵
  PID:3080
- C:\Windows\System\yUOVDLs.exe
  C:\Windows\System\yUOVDLs.exe
  2⤵
  PID:2584
- C:\Windows\System\FhxIgoW.exe
  C:\Windows\System\FhxIgoW.exe
  2⤵
  PID:2040
- C:\Windows\System\AdqeKfn.exe
  C:\Windows\System\AdqeKfn.exe
  2⤵
  PID:3768
- C:\Windows\System\ryzfSfN.exe
  C:\Windows\System\ryzfSfN.exe
  2⤵
  PID:3576
- C:\Windows\System\eisoOnh.exe
  C:\Windows\System\eisoOnh.exe
  2⤵
  PID:4372
- C:\Windows\System\NlvGPnx.exe
  C:\Windows\System\NlvGPnx.exe
  2⤵
  PID:6068
- C:\Windows\System\GNllgus.exe
  C:\Windows\System\GNllgus.exe
  2⤵
  PID:4892
- C:\Windows\System\ECKbXRP.exe
  C:\Windows\System\ECKbXRP.exe
  2⤵
  PID:5268
- C:\Windows\System\XOQXKGu.exe
  C:\Windows\System\XOQXKGu.exe
  2⤵
  PID:972
- C:\Windows\System\HnOmxww.exe
  C:\Windows\System\HnOmxww.exe
  2⤵
  PID:3636
- C:\Windows\System\LlKOxol.exe
  C:\Windows\System\LlKOxol.exe
  2⤵
  PID:3592
- C:\Windows\System\FIgucQN.exe
  C:\Windows\System\FIgucQN.exe
  2⤵
  PID:4888
- C:\Windows\System\NftVIoB.exe
  C:\Windows\System\NftVIoB.exe
  2⤵
  PID:5848
- C:\Windows\System\lHfAuiW.exe
  C:\Windows\System\lHfAuiW.exe
  2⤵
  PID:5652
- C:\Windows\System\mdYmXHa.exe
  C:\Windows\System\mdYmXHa.exe
  2⤵
  PID:5232
- C:\Windows\System\rEGjKHj.exe
  C:\Windows\System\rEGjKHj.exe
  2⤵
  PID:5548
- C:\Windows\System\IXAbpMr.exe
  C:\Windows\System\IXAbpMr.exe
  2⤵
  PID:5516
- C:\Windows\System\HLQKlhV.exe
  C:\Windows\System\HLQKlhV.exe
  2⤵
  PID:6092
- C:\Windows\System\KEueCvK.exe
  C:\Windows\System\KEueCvK.exe
  2⤵
  PID:5620
- C:\Windows\System\XhXJJxN.exe
  C:\Windows\System\XhXJJxN.exe
  2⤵
  PID:1660
- C:\Windows\System\xiTVcDH.exe
  C:\Windows\System\xiTVcDH.exe
  2⤵
  PID:3348
- C:\Windows\System\MPCjaai.exe
  C:\Windows\System\MPCjaai.exe
  2⤵
  PID:5960
- C:\Windows\System\FmTbpRo.exe
  C:\Windows\System\FmTbpRo.exe
  2⤵
  PID:3224
- C:\Windows\System\yGrjBnt.exe
  C:\Windows\System\yGrjBnt.exe
  2⤵
  PID:2820
- C:\Windows\System\PiFEcZi.exe
  C:\Windows\System\PiFEcZi.exe
  2⤵
  PID:2384
- C:\Windows\System\UQcamgY.exe
  C:\Windows\System\UQcamgY.exe
  2⤵
  PID:2036
- C:\Windows\System\LoAkwLq.exe
  C:\Windows\System\LoAkwLq.exe
  2⤵
  PID:1652
- C:\Windows\System\afmzWxt.exe
  C:\Windows\System\afmzWxt.exe
  2⤵
  PID:2388
- C:\Windows\System\fAfUrJI.exe
  C:\Windows\System\fAfUrJI.exe
  2⤵
  PID:3652
- C:\Windows\System\PdXTcRr.exe
  C:\Windows\System\PdXTcRr.exe
  2⤵
  PID:5784
- C:\Windows\System\cdcigpr.exe
  C:\Windows\System\cdcigpr.exe
  2⤵
  PID:3444
- C:\Windows\System\QPGcQno.exe
  C:\Windows\System\QPGcQno.exe
  2⤵
  PID:5636
- C:\Windows\System\ciRhkVh.exe
  C:\Windows\System\ciRhkVh.exe
  2⤵
  PID:2588
- C:\Windows\System\dLdzRYA.exe
  C:\Windows\System\dLdzRYA.exe
  2⤵
  PID:4208
- C:\Windows\System\QLRbhtL.exe
  C:\Windows\System\QLRbhtL.exe
  2⤵
  PID:5928
- C:\Windows\System\oBOdzCq.exe
  C:\Windows\System\oBOdzCq.exe
  2⤵
  PID:2532
- C:\Windows\System\wdQSrwT.exe
  C:\Windows\System\wdQSrwT.exe
  2⤵
  PID:5392
- C:\Windows\System\pDoiGOe.exe
  C:\Windows\System\pDoiGOe.exe
  2⤵
  PID:5840
- C:\Windows\System\kXnjbVg.exe
  C:\Windows\System\kXnjbVg.exe
  2⤵
  PID:5452
- C:\Windows\System\sgoYCBz.exe
  C:\Windows\System\sgoYCBz.exe
  2⤵
  PID:5632
- C:\Windows\System\NbDuyuw.exe
  C:\Windows\System\NbDuyuw.exe
  2⤵
  PID:2232
- C:\Windows\System\QHmcYWH.exe
  C:\Windows\System\QHmcYWH.exe
  2⤵
  PID:5828
- C:\Windows\System\gYCNiNU.exe
  C:\Windows\System\gYCNiNU.exe
  2⤵
  PID:2808
- C:\Windows\System\cFUmKKb.exe
  C:\Windows\System\cFUmKKb.exe
  2⤵
  PID:5116
- C:\Windows\System\cVwwOZc.exe
  C:\Windows\System\cVwwOZc.exe
  2⤵
  PID:5664
- C:\Windows\System\daZDfza.exe
  C:\Windows\System\daZDfza.exe
  2⤵
  PID:5064
- C:\Windows\System\vrjhLBr.exe
  C:\Windows\System\vrjhLBr.exe
  2⤵
  PID:5520
- C:\Windows\System\tTUmxGU.exe
  C:\Windows\System\tTUmxGU.exe
  2⤵
  PID:2264
- C:\Windows\System\GXVNjRb.exe
  C:\Windows\System\GXVNjRb.exe
  2⤵
  PID:5580
- C:\Windows\System\HXSPQqe.exe
  C:\Windows\System\HXSPQqe.exe
  2⤵
  PID:6160
- C:\Windows\System\QADjwpo.exe
  C:\Windows\System\QADjwpo.exe
  2⤵
  PID:6176
- C:\Windows\System\lVOoKPa.exe
  C:\Windows\System\lVOoKPa.exe
  2⤵
  PID:6192
- C:\Windows\System\xaQFtia.exe
  C:\Windows\System\xaQFtia.exe
  2⤵
  PID:6212
- C:\Windows\System\DGHSHwY.exe
  C:\Windows\System\DGHSHwY.exe
  2⤵
  PID:6228
- C:\Windows\System\HxGzJMi.exe
  C:\Windows\System\HxGzJMi.exe
  2⤵
  PID:6244
- C:\Windows\System\XkzaQkT.exe
  C:\Windows\System\XkzaQkT.exe
  2⤵
  PID:6260
- C:\Windows\System\RtLFSzD.exe
  C:\Windows\System\RtLFSzD.exe
  2⤵
  PID:6276
- C:\Windows\System\JoeVLbR.exe
  C:\Windows\System\JoeVLbR.exe
  2⤵
  PID:6292
- C:\Windows\System\SzGQYZo.exe
  C:\Windows\System\SzGQYZo.exe
  2⤵
  PID:6308
- C:\Windows\System\hpkyiyx.exe
  C:\Windows\System\hpkyiyx.exe
  2⤵
  PID:6324
- C:\Windows\System\mfqKsXR.exe
  C:\Windows\System\mfqKsXR.exe
  2⤵
  PID:6340
- C:\Windows\System\tlWdwUp.exe
  C:\Windows\System\tlWdwUp.exe
  2⤵
  PID:6356
- C:\Windows\System\TsTrLFs.exe
  C:\Windows\System\TsTrLFs.exe
  2⤵
  PID:6372
- C:\Windows\System\wNyjToB.exe
  C:\Windows\System\wNyjToB.exe
  2⤵
  PID:6388
- C:\Windows\System\xhdLhJQ.exe
  C:\Windows\System\xhdLhJQ.exe
  2⤵
  PID:6404
- C:\Windows\System\QRWTHMk.exe
  C:\Windows\System\QRWTHMk.exe
  2⤵
  PID:6420
- C:\Windows\System\rTvufZj.exe
  C:\Windows\System\rTvufZj.exe
  2⤵
  PID:6436
- C:\Windows\System\wkKrETk.exe
  C:\Windows\System\wkKrETk.exe
  2⤵
  PID:6452
- C:\Windows\System\TXsKTmJ.exe
  C:\Windows\System\TXsKTmJ.exe
  2⤵
  PID:6468
- C:\Windows\System\KOcXnBg.exe
  C:\Windows\System\KOcXnBg.exe
  2⤵
  PID:6484
- C:\Windows\System\tLsNXSI.exe
  C:\Windows\System\tLsNXSI.exe
  2⤵
  PID:6500
- C:\Windows\System\cuAZqPN.exe
  C:\Windows\System\cuAZqPN.exe
  2⤵
  PID:6516
- C:\Windows\System\EvYsLuI.exe
  C:\Windows\System\EvYsLuI.exe
  2⤵
  PID:6532
- C:\Windows\System\wrOrBeV.exe
  C:\Windows\System\wrOrBeV.exe
  2⤵
  PID:6548
- C:\Windows\System\DdSqcOH.exe
  C:\Windows\System\DdSqcOH.exe
  2⤵
  PID:6564
- C:\Windows\System\jWtMNcv.exe
  C:\Windows\System\jWtMNcv.exe
  2⤵
  PID:6580
- C:\Windows\System\gChOdPi.exe
  C:\Windows\System\gChOdPi.exe
  2⤵
  PID:6596
- C:\Windows\System\yycLuPN.exe
  C:\Windows\System\yycLuPN.exe
  2⤵
  PID:6612
- C:\Windows\System\JCUqMPj.exe
  C:\Windows\System\JCUqMPj.exe
  2⤵
  PID:6628
- C:\Windows\System\tscKxzx.exe
  C:\Windows\System\tscKxzx.exe
  2⤵
  PID:6644
- C:\Windows\System\RuZfQfy.exe
  C:\Windows\System\RuZfQfy.exe
  2⤵
  PID:6660
- C:\Windows\System\liItyQL.exe
  C:\Windows\System\liItyQL.exe
  2⤵
  PID:6676
- C:\Windows\System\ovfRxlx.exe
  C:\Windows\System\ovfRxlx.exe
  2⤵
  PID:6692
- C:\Windows\System\nwqeDIe.exe
  C:\Windows\System\nwqeDIe.exe
  2⤵
  PID:6708
- C:\Windows\System\COsLnUR.exe
  C:\Windows\System\COsLnUR.exe
  2⤵
  PID:6728
- C:\Windows\System\ulWNEYx.exe
  C:\Windows\System\ulWNEYx.exe
  2⤵
  PID:6744
- C:\Windows\System\JqDVQim.exe
  C:\Windows\System\JqDVQim.exe
  2⤵
  PID:6760
- C:\Windows\System\bbzbyRa.exe
  C:\Windows\System\bbzbyRa.exe
  2⤵
  PID:6776
- C:\Windows\System\VPpxnHw.exe
  C:\Windows\System\VPpxnHw.exe
  2⤵
  PID:6792
- C:\Windows\System\DjGCIfF.exe
  C:\Windows\System\DjGCIfF.exe
  2⤵
  PID:6808
- C:\Windows\System\ktWgBoM.exe
  C:\Windows\System\ktWgBoM.exe
  2⤵
  PID:6828
- C:\Windows\System\RDtLgBB.exe
  C:\Windows\System\RDtLgBB.exe
  2⤵
  PID:6844
- C:\Windows\System\LzmGDKp.exe
  C:\Windows\System\LzmGDKp.exe
  2⤵
  PID:6860
- C:\Windows\System\lMaGcgU.exe
  C:\Windows\System\lMaGcgU.exe
  2⤵
  PID:6876
- C:\Windows\System\YyZMdEl.exe
  C:\Windows\System\YyZMdEl.exe
  2⤵
  PID:6892
- C:\Windows\System\wZzsOHa.exe
  C:\Windows\System\wZzsOHa.exe
  2⤵
  PID:6908
- C:\Windows\System\CwuKONA.exe
  C:\Windows\System\CwuKONA.exe
  2⤵
  PID:6924
- C:\Windows\System\nEvgtEd.exe
  C:\Windows\System\nEvgtEd.exe
  2⤵
  PID:6940
- C:\Windows\System\CNKRIZM.exe
  C:\Windows\System\CNKRIZM.exe
  2⤵
  PID:6956
- C:\Windows\System\aApBvSr.exe
  C:\Windows\System\aApBvSr.exe
  2⤵
  PID:6972
- C:\Windows\System\IvdevtF.exe
  C:\Windows\System\IvdevtF.exe
  2⤵
  PID:6992
- C:\Windows\System\ecoOgdi.exe
  C:\Windows\System\ecoOgdi.exe
  2⤵
  PID:7008
- C:\Windows\System\fnACRxH.exe
  C:\Windows\System\fnACRxH.exe
  2⤵
  PID:7032
- C:\Windows\System\QjRafMh.exe
  C:\Windows\System\QjRafMh.exe
  2⤵
  PID:7048
- C:\Windows\System\HBooJGP.exe
  C:\Windows\System\HBooJGP.exe
  2⤵
  PID:7064
- C:\Windows\System\nfJqBZc.exe
  C:\Windows\System\nfJqBZc.exe
  2⤵
  PID:7080
- C:\Windows\System\QYpAejr.exe
  C:\Windows\System\QYpAejr.exe
  2⤵
  PID:7096
- C:\Windows\System\eVreQNU.exe
  C:\Windows\System\eVreQNU.exe
  2⤵
  PID:7116
- C:\Windows\System\oHMdZkx.exe
  C:\Windows\System\oHMdZkx.exe
  2⤵
  PID:7136
- C:\Windows\System\ZzWHiGX.exe
  C:\Windows\System\ZzWHiGX.exe
  2⤵
  PID:7152
- C:\Windows\System\sfuBWGG.exe
  C:\Windows\System\sfuBWGG.exe
  2⤵
  PID:6152
- C:\Windows\System\hBWOnws.exe
  C:\Windows\System\hBWOnws.exe
  2⤵
  PID:4552
- C:\Windows\System\lscxzaw.exe
  C:\Windows\System\lscxzaw.exe
  2⤵
  PID:6168
- C:\Windows\System\sRJRjjz.exe
  C:\Windows\System\sRJRjjz.exe
  2⤵
  PID:3720
- C:\Windows\System\UEwDfZl.exe
  C:\Windows\System\UEwDfZl.exe
  2⤵
  PID:5168
- C:\Windows\System\KxhzarE.exe
  C:\Windows\System\KxhzarE.exe
  2⤵
  PID:6220
- C:\Windows\System\gzHWWNa.exe
  C:\Windows\System\gzHWWNa.exe
  2⤵
  PID:6240
- C:\Windows\System\tHyDSBH.exe
  C:\Windows\System\tHyDSBH.exe
  2⤵
  PID:6304
- C:\Windows\System\ywZIYcr.exe
  C:\Windows\System\ywZIYcr.exe
  2⤵
  PID:6364
- C:\Windows\System\hvzlGGo.exe
  C:\Windows\System\hvzlGGo.exe
  2⤵
  PID:6288
- C:\Windows\System\sdHCHhN.exe
  C:\Windows\System\sdHCHhN.exe
  2⤵
  PID:6352
- C:\Windows\System\OjVZLsC.exe
  C:\Windows\System\OjVZLsC.exe
  2⤵
  PID:6428
- C:\Windows\System\nzcEyOp.exe
  C:\Windows\System\nzcEyOp.exe
  2⤵
  PID:6448
- C:\Windows\System\rfhoVaI.exe
  C:\Windows\System\rfhoVaI.exe
  2⤵
  PID:6512
- C:\Windows\System\yZQoAtQ.exe
  C:\Windows\System\yZQoAtQ.exe
  2⤵
  PID:6496
- C:\Windows\System\VllNoNs.exe
  C:\Windows\System\VllNoNs.exe
  2⤵
  PID:6572
- C:\Windows\System\vRLReeI.exe
  C:\Windows\System\vRLReeI.exe
  2⤵
  PID:6608
- C:\Windows\System\WEwREPN.exe
  C:\Windows\System\WEwREPN.exe
  2⤵
  PID:6640
- C:\Windows\System\zBgLzBl.exe
  C:\Windows\System\zBgLzBl.exe
  2⤵
  PID:6768
- C:\Windows\System\SAifqzr.exe
  C:\Windows\System\SAifqzr.exe
  2⤵
  PID:6740
- C:\Windows\System\fqSWKLy.exe
  C:\Windows\System\fqSWKLy.exe
  2⤵
  PID:6840
- C:\Windows\System\fjcoSBh.exe
  C:\Windows\System\fjcoSBh.exe
  2⤵
  PID:6592
- C:\Windows\System\UVSobhx.exe
  C:\Windows\System\UVSobhx.exe
  2⤵
  PID:6656
- C:\Windows\System\syPbPor.exe
  C:\Windows\System\syPbPor.exe
  2⤵
  PID:6720
- C:\Windows\System\iuSOuFm.exe
  C:\Windows\System\iuSOuFm.exe
  2⤵
  PID:6936
- C:\Windows\System\IsPPsCy.exe
  C:\Windows\System\IsPPsCy.exe
  2⤵
  PID:6820
- C:\Windows\System\HRZPVcw.exe
  C:\Windows\System\HRZPVcw.exe
  2⤵
  PID:6888
- C:\Windows\System\hzxRJGU.exe
  C:\Windows\System\hzxRJGU.exe
  2⤵
  PID:6952
- C:\Windows\System\zUEkaVO.exe
  C:\Windows\System\zUEkaVO.exe
  2⤵
  PID:7016
- C:\Windows\System\UweTrmO.exe
  C:\Windows\System\UweTrmO.exe
  2⤵
  PID:7040
- C:\Windows\System\DjcrZaz.exe
  C:\Windows\System\DjcrZaz.exe
  2⤵
  PID:7004
- C:\Windows\System\hYiMYcT.exe
  C:\Windows\System\hYiMYcT.exe
  2⤵
  PID:7148
- C:\Windows\System\IibrNBC.exe
  C:\Windows\System\IibrNBC.exe
  2⤵
  PID:3992
- C:\Windows\System\XKfUDoG.exe
  C:\Windows\System\XKfUDoG.exe
  2⤵
  PID:6400
- C:\Windows\System\zZFVPTK.exe
  C:\Windows\System\zZFVPTK.exe
  2⤵
  PID:6384
- C:\Windows\System\tSUBVtP.exe
  C:\Windows\System\tSUBVtP.exe
  2⤵
  PID:6268
- C:\Windows\System\yBxqfvc.exe
  C:\Windows\System\yBxqfvc.exe
  2⤵
  PID:6540
- C:\Windows\System\iEWNNiY.exe
  C:\Windows\System\iEWNNiY.exe
  2⤵
  PID:6464
- C:\Windows\System\AogFbNz.exe
  C:\Windows\System\AogFbNz.exe
  2⤵
  PID:6816
- C:\Windows\System\JxXVFNi.exe
  C:\Windows\System\JxXVFNi.exe
  2⤵
  PID:6900
- C:\Windows\System\rPbUdFq.exe
  C:\Windows\System\rPbUdFq.exe
  2⤵
  PID:7024
- C:\Windows\System\FKJFJHu.exe
  C:\Windows\System\FKJFJHu.exe
  2⤵
  PID:7144
- C:\Windows\System\KMcbLyz.exe
  C:\Windows\System\KMcbLyz.exe
  2⤵
  PID:6804
- C:\Windows\System\hRZvaNb.exe
  C:\Windows\System\hRZvaNb.exe
  2⤵
  PID:7172
- C:\Windows\System\NlewQOR.exe
  C:\Windows\System\NlewQOR.exe
  2⤵
  PID:7188
- C:\Windows\System\ybvgnsz.exe
  C:\Windows\System\ybvgnsz.exe
  2⤵
  PID:7208
- C:\Windows\System\wBiIBIU.exe
  C:\Windows\System\wBiIBIU.exe
  2⤵
  PID:7224
- C:\Windows\System\QVhTzDl.exe
  C:\Windows\System\QVhTzDl.exe
  2⤵
  PID:7244
- C:\Windows\System\BsZSLKW.exe
  C:\Windows\System\BsZSLKW.exe
  2⤵
  PID:7260
- C:\Windows\System\cFiUqbw.exe
  C:\Windows\System\cFiUqbw.exe
  2⤵
  PID:7276
- C:\Windows\System\QfbNZYE.exe
  C:\Windows\System\QfbNZYE.exe
  2⤵
  PID:7292
- C:\Windows\System\MJxuUhr.exe
  C:\Windows\System\MJxuUhr.exe
  2⤵
  PID:7308
- C:\Windows\System\wuuabdt.exe
  C:\Windows\System\wuuabdt.exe
  2⤵
  PID:7324
- C:\Windows\System\HefjcBA.exe
  C:\Windows\System\HefjcBA.exe
  2⤵
  PID:7340
- C:\Windows\System\YOApLrD.exe
  C:\Windows\System\YOApLrD.exe
  2⤵
  PID:7360
- C:\Windows\System\oyxVwXI.exe
  C:\Windows\System\oyxVwXI.exe
  2⤵
  PID:7376
- C:\Windows\System\IUUJMfw.exe
  C:\Windows\System\IUUJMfw.exe
  2⤵
  PID:7396
- C:\Windows\System\hAbzWvS.exe
  C:\Windows\System\hAbzWvS.exe
  2⤵
  PID:7412
- C:\Windows\System\AXkHtpj.exe
  C:\Windows\System\AXkHtpj.exe
  2⤵
  PID:7428
- C:\Windows\System\FjhcEKM.exe
  C:\Windows\System\FjhcEKM.exe
  2⤵
  PID:7444
- C:\Windows\System\MxNmZKt.exe
  C:\Windows\System\MxNmZKt.exe
  2⤵
  PID:7460
- C:\Windows\System\uZicqva.exe
  C:\Windows\System\uZicqva.exe
  2⤵
  PID:7480
- C:\Windows\System\TTpRury.exe
  C:\Windows\System\TTpRury.exe
  2⤵
  PID:7496
- C:\Windows\System\KlJuspD.exe
  C:\Windows\System\KlJuspD.exe
  2⤵
  PID:7512
- C:\Windows\System\MAZLKZe.exe
  C:\Windows\System\MAZLKZe.exe
  2⤵
  PID:7528
- C:\Windows\System\pYLKYyY.exe
  C:\Windows\System\pYLKYyY.exe
  2⤵
  PID:7544
- C:\Windows\System\bFiNimH.exe
  C:\Windows\System\bFiNimH.exe
  2⤵
  PID:7564
- C:\Windows\System\UWnvFXN.exe
  C:\Windows\System\UWnvFXN.exe
  2⤵
  PID:7580
- C:\Windows\System\safWApG.exe
  C:\Windows\System\safWApG.exe
  2⤵
  PID:7596
- C:\Windows\System\Wpgiqpr.exe
  C:\Windows\System\Wpgiqpr.exe
  2⤵
  PID:7612
- C:\Windows\System\FavRewm.exe
  C:\Windows\System\FavRewm.exe
  2⤵
  PID:7628
- C:\Windows\System\crGbRbM.exe
  C:\Windows\System\crGbRbM.exe
  2⤵
  PID:7644
- C:\Windows\System\cmPGtyO.exe
  C:\Windows\System\cmPGtyO.exe
  2⤵
  PID:7660
- C:\Windows\System\nxAfvYw.exe
  C:\Windows\System\nxAfvYw.exe
  2⤵
  PID:7676
- C:\Windows\System\DiyUeOl.exe
  C:\Windows\System\DiyUeOl.exe
  2⤵
  PID:7692
- C:\Windows\System\NifbfiN.exe
  C:\Windows\System\NifbfiN.exe
  2⤵
  PID:7708
- C:\Windows\System\MiaPzQW.exe
  C:\Windows\System\MiaPzQW.exe
  2⤵
  PID:7728
- C:\Windows\System\MpJwcAt.exe
  C:\Windows\System\MpJwcAt.exe
  2⤵
  PID:7744
- C:\Windows\System\jeEZDPs.exe
  C:\Windows\System\jeEZDPs.exe
  2⤵
  PID:7760
- C:\Windows\System\mXuPOTa.exe
  C:\Windows\System\mXuPOTa.exe
  2⤵
  PID:7776
- C:\Windows\System\uTjYbUJ.exe
  C:\Windows\System\uTjYbUJ.exe
  2⤵
  PID:7800
- C:\Windows\System\RkYqPlw.exe
  C:\Windows\System\RkYqPlw.exe
  2⤵
  PID:7816
- C:\Windows\System\MPSEzzZ.exe
  C:\Windows\System\MPSEzzZ.exe
  2⤵
  PID:7836
- C:\Windows\System\eEqPCjM.exe
  C:\Windows\System\eEqPCjM.exe
  2⤵
  PID:7852
- C:\Windows\System\AUepIRg.exe
  C:\Windows\System\AUepIRg.exe
  2⤵
  PID:7868
- C:\Windows\System\VSuXFUk.exe
  C:\Windows\System\VSuXFUk.exe
  2⤵
  PID:7884
- C:\Windows\System\rGCZKBh.exe
  C:\Windows\System\rGCZKBh.exe
  2⤵
  PID:7900
- C:\Windows\System\uAfBpCO.exe
  C:\Windows\System\uAfBpCO.exe
  2⤵
  PID:7920
- C:\Windows\System\XowEhKh.exe
  C:\Windows\System\XowEhKh.exe
  2⤵
  PID:7936
- C:\Windows\System\ikhQwKs.exe
  C:\Windows\System\ikhQwKs.exe
  2⤵
  PID:7952
- C:\Windows\System\pfJKzEl.exe
  C:\Windows\System\pfJKzEl.exe
  2⤵
  PID:7972
- C:\Windows\System\MeEYegw.exe
  C:\Windows\System\MeEYegw.exe
  2⤵
  PID:7988
- C:\Windows\System\YhjOWHv.exe
  C:\Windows\System\YhjOWHv.exe
  2⤵
  PID:8004
- C:\Windows\System\kSSiKno.exe
  C:\Windows\System\kSSiKno.exe
  2⤵
  PID:8020
- C:\Windows\System\YfwCMJr.exe
  C:\Windows\System\YfwCMJr.exe
  2⤵
  PID:8036
- C:\Windows\System\AfKhFFS.exe
  C:\Windows\System\AfKhFFS.exe
  2⤵
  PID:8052
- C:\Windows\System\ZTGGseP.exe
  C:\Windows\System\ZTGGseP.exe
  2⤵
  PID:8068
- C:\Windows\System\VfVQPAY.exe
  C:\Windows\System\VfVQPAY.exe
  2⤵
  PID:8084
- C:\Windows\System\VINEcmU.exe
  C:\Windows\System\VINEcmU.exe
  2⤵
  PID:8100
- C:\Windows\System\gxIWoUg.exe
  C:\Windows\System\gxIWoUg.exe
  2⤵
  PID:8120
- C:\Windows\System\QMkmbSq.exe
  C:\Windows\System\QMkmbSq.exe
  2⤵
  PID:8136
- C:\Windows\System\gghxMtI.exe
  C:\Windows\System\gghxMtI.exe
  2⤵
  PID:8152
- C:\Windows\System\KkkxzCU.exe
  C:\Windows\System\KkkxzCU.exe
  2⤵
  PID:8168
- C:\Windows\System\QAONNzQ.exe
  C:\Windows\System\QAONNzQ.exe
  2⤵
  PID:8184
- C:\Windows\System\sHDhNPE.exe
  C:\Windows\System\sHDhNPE.exe
  2⤵
  PID:6368
- C:\Windows\System\TfdSAJC.exe
  C:\Windows\System\TfdSAJC.exe
  2⤵
  PID:6904
- C:\Windows\System\axfGMMj.exe
  C:\Windows\System\axfGMMj.exe
  2⤵
  PID:6588
- C:\Windows\System\KwnSJkO.exe
  C:\Windows\System\KwnSJkO.exe
  2⤵
  PID:7204
- C:\Windows\System\cekeWXW.exe
  C:\Windows\System\cekeWXW.exe
  2⤵
  PID:7200
- C:\Windows\System\efdDjNz.exe
  C:\Windows\System\efdDjNz.exe
  2⤵
  PID:7180
- C:\Windows\System\xEJAlyf.exe
  C:\Windows\System\xEJAlyf.exe
  2⤵
  PID:5740
- C:\Windows\System\vcLXpDZ.exe
  C:\Windows\System\vcLXpDZ.exe
  2⤵
  PID:6336
- C:\Windows\System\WCtGlqk.exe
  C:\Windows\System\WCtGlqk.exe
  2⤵
  PID:6444
- C:\Windows\System\tjbqMox.exe
  C:\Windows\System\tjbqMox.exe
  2⤵
  PID:7272
- C:\Windows\System\cDXEguq.exe
  C:\Windows\System\cDXEguq.exe
  2⤵
  PID:7072
- C:\Windows\System\YXzmBJX.exe
  C:\Windows\System\YXzmBJX.exe
  2⤵
  PID:6652
- C:\Windows\System\zxbeUqJ.exe
  C:\Windows\System\zxbeUqJ.exe
  2⤵
  PID:6884
- C:\Windows\System\KhxadmY.exe
  C:\Windows\System\KhxadmY.exe
  2⤵
  PID:5328
- C:\Windows\System\MoUwBwo.exe
  C:\Windows\System\MoUwBwo.exe
  2⤵
  PID:7124
- C:\Windows\System\STNLgOL.exe
  C:\Windows\System\STNLgOL.exe
  2⤵
  PID:6788
- C:\Windows\System\LALiQKq.exe
  C:\Windows\System\LALiQKq.exe
  2⤵
  PID:7216
- C:\Windows\System\fITgnuT.exe
  C:\Windows\System\fITgnuT.exe
  2⤵
  PID:7316
- C:\Windows\System\XdckaXF.exe
  C:\Windows\System\XdckaXF.exe
  2⤵
  PID:7356
- C:\Windows\System\Bmksrld.exe
  C:\Windows\System\Bmksrld.exe
  2⤵
  PID:7404
- C:\Windows\System\dBUwPYC.exe
  C:\Windows\System\dBUwPYC.exe
  2⤵
  PID:7408
- C:\Windows\System\NlYqJmC.exe
  C:\Windows\System\NlYqJmC.exe
  2⤵
  PID:7420
- C:\Windows\System\UhIMbiK.exe
  C:\Windows\System\UhIMbiK.exe
  2⤵
  PID:7476
- C:\Windows\System\beiogtf.exe
  C:\Windows\System\beiogtf.exe
  2⤵
  PID:7572
- C:\Windows\System\WdEenSD.exe
  C:\Windows\System\WdEenSD.exe
  2⤵
  PID:7640
- C:\Windows\System\amZgLZL.exe
  C:\Windows\System\amZgLZL.exe
  2⤵
  PID:7668
- C:\Windows\System\sKEjTzM.exe
  C:\Windows\System\sKEjTzM.exe
  2⤵
  PID:7740
- C:\Windows\System\KcMDdaO.exe
  C:\Windows\System\KcMDdaO.exe
  2⤵
  PID:7844
- C:\Windows\System\OaUEgRm.exe
  C:\Windows\System\OaUEgRm.exe
  2⤵
  PID:7944
- C:\Windows\System\ddjmcaQ.exe
  C:\Windows\System\ddjmcaQ.exe
  2⤵
  PID:7908
- C:\Windows\System\FnpHdsS.exe
  C:\Windows\System\FnpHdsS.exe
  2⤵
  PID:7588
- C:\Windows\System\ooPGNRS.exe
  C:\Windows\System\ooPGNRS.exe
  2⤵
  PID:7488
- C:\Windows\System\MNAtOaf.exe
  C:\Windows\System\MNAtOaf.exe
  2⤵
  PID:7524
- C:\Windows\System\ClyMXGk.exe
  C:\Windows\System\ClyMXGk.exe
  2⤵
  PID:7592
- C:\Windows\System\vnIgtQu.exe
  C:\Windows\System\vnIgtQu.exe
  2⤵
  PID:7932
- C:\Windows\System\TZtCVLq.exe
  C:\Windows\System\TZtCVLq.exe
  2⤵
  PID:7684
- C:\Windows\System\bmDhGhT.exe
  C:\Windows\System\bmDhGhT.exe
  2⤵
  PID:7724
- C:\Windows\System\XTtpwoA.exe
  C:\Windows\System\XTtpwoA.exe
  2⤵
  PID:7796
- C:\Windows\System\lgltFan.exe
  C:\Windows\System\lgltFan.exe
  2⤵
  PID:7964
- C:\Windows\System\LDgNzko.exe
  C:\Windows\System\LDgNzko.exe
  2⤵
  PID:8076
- C:\Windows\System\stHofFc.exe
  C:\Windows\System\stHofFc.exe
  2⤵
  PID:8116
- C:\Windows\System\QLaCNDf.exe
  C:\Windows\System\QLaCNDf.exe
  2⤵
  PID:8176
- C:\Windows\System\cUQKuDu.exe
  C:\Windows\System\cUQKuDu.exe
  2⤵
  PID:8160
- C:\Windows\System\dTZBLSe.exe
  C:\Windows\System\dTZBLSe.exe
  2⤵
  PID:6736
- C:\Windows\System\BQYewkL.exe
  C:\Windows\System\BQYewkL.exe
  2⤵
  PID:6348
- C:\Windows\System\mJAGQuE.exe
  C:\Windows\System\mJAGQuE.exe
  2⤵
  PID:6528
- C:\Windows\System\tJLpHYw.exe
  C:\Windows\System\tJLpHYw.exe
  2⤵
  PID:7368
- C:\Windows\System\hkOPJlg.exe
  C:\Windows\System\hkOPJlg.exe
  2⤵
  PID:7700
- C:\Windows\System\KzJfikW.exe
  C:\Windows\System\KzJfikW.exe
  2⤵
  PID:7848
- C:\Windows\System\IXgDHlo.exe
  C:\Windows\System\IXgDHlo.exe
  2⤵
  PID:7792
- C:\Windows\System\ihQzSys.exe
  C:\Windows\System\ihQzSys.exe
  2⤵
  PID:8148
- C:\Windows\System\FubcjgW.exe
  C:\Windows\System\FubcjgW.exe
  2⤵
  PID:7452
- C:\Windows\System\VrArNOR.exe
  C:\Windows\System\VrArNOR.exe
  2⤵
  PID:7916
- C:\Windows\System\qcWERhD.exe
  C:\Windows\System\qcWERhD.exe
  2⤵
  PID:7996
- C:\Windows\System\UwJxKQL.exe
  C:\Windows\System\UwJxKQL.exe
  2⤵
  PID:7196
- C:\Windows\System\vFsgVvU.exe
  C:\Windows\System\vFsgVvU.exe
  2⤵
  PID:7240
- C:\Windows\System\EEdBbQu.exe
  C:\Windows\System\EEdBbQu.exe
  2⤵
  PID:6624
- C:\Windows\System\NFUwBMx.exe
  C:\Windows\System\NFUwBMx.exe
  2⤵
  PID:7384
- C:\Windows\System\JHFdZyH.exe
  C:\Windows\System\JHFdZyH.exe
  2⤵
  PID:7392
- C:\Windows\System\uBgkIdX.exe
  C:\Windows\System\uBgkIdX.exe
  2⤵
  PID:7860
- C:\Windows\System\kJKaOwB.exe
  C:\Windows\System\kJKaOwB.exe
  2⤵
  PID:7784
- C:\Windows\System\sEzuQji.exe
  C:\Windows\System\sEzuQji.exe
  2⤵
  PID:8060
- C:\Windows\System\NzDBxUm.exe
  C:\Windows\System\NzDBxUm.exe
  2⤵
  PID:7468
- C:\Windows\System\oxuwrFh.exe
  C:\Windows\System\oxuwrFh.exe
  2⤵
  PID:7772
- C:\Windows\System\UEeivWD.exe
  C:\Windows\System\UEeivWD.exe
  2⤵
  PID:7720
- C:\Windows\System\jGqboLS.exe
  C:\Windows\System\jGqboLS.exe
  2⤵
  PID:8112
- C:\Windows\System\QuyCpge.exe
  C:\Windows\System\QuyCpge.exe
  2⤵
  PID:6932
- C:\Windows\System\pbAdFek.exe
  C:\Windows\System\pbAdFek.exe
  2⤵
  PID:7336
- C:\Windows\System\GdTYqxS.exe
  C:\Windows\System\GdTYqxS.exe
  2⤵
  PID:8012
- C:\Windows\System\FzLWEYA.exe
  C:\Windows\System\FzLWEYA.exe
  2⤵
  PID:8048
- C:\Windows\System\fOtjQFS.exe
  C:\Windows\System\fOtjQFS.exe
  2⤵
  PID:6756
- C:\Windows\System\PZiGZSl.exe
  C:\Windows\System\PZiGZSl.exe
  2⤵
  PID:6080
- C:\Windows\System\tUVrZoI.exe
  C:\Windows\System\tUVrZoI.exe
  2⤵
  PID:1224
- C:\Windows\System\erBIuYe.exe
  C:\Windows\System\erBIuYe.exe
  2⤵
  PID:6604
- C:\Windows\System\jSiAkZC.exe
  C:\Windows\System\jSiAkZC.exe
  2⤵
  PID:6968
- C:\Windows\System\uZUONqo.exe
  C:\Windows\System\uZUONqo.exe
  2⤵
  PID:7808
- C:\Windows\System\jKSpQyB.exe
  C:\Windows\System\jKSpQyB.exe
  2⤵
  PID:7672
- C:\Windows\System\gMinntV.exe
  C:\Windows\System\gMinntV.exe
  2⤵
  PID:8044
- C:\Windows\System\GcqpKdx.exe
  C:\Windows\System\GcqpKdx.exe
  2⤵
  PID:7456
- C:\Windows\System\WjGtWBF.exe
  C:\Windows\System\WjGtWBF.exe
  2⤵
  PID:7768
- C:\Windows\System\eVjnhoW.exe
  C:\Windows\System\eVjnhoW.exe
  2⤵
  PID:7184
- C:\Windows\System\dOVnIdI.exe
  C:\Windows\System\dOVnIdI.exe
  2⤵
  PID:8016
- C:\Windows\System\ZfPpLmZ.exe
  C:\Windows\System\ZfPpLmZ.exe
  2⤵
  PID:7608
- C:\Windows\System\wSWlTis.exe
  C:\Windows\System\wSWlTis.exe
  2⤵
  PID:8092
- C:\Windows\System\HbnkTrX.exe
  C:\Windows\System\HbnkTrX.exe
  2⤵
  PID:6988
- C:\Windows\System\ippWNwE.exe
  C:\Windows\System\ippWNwE.exe
  2⤵
  PID:7812
- C:\Windows\System\JCMmFlO.exe
  C:\Windows\System\JCMmFlO.exe
  2⤵
  PID:6852
- C:\Windows\System\lYBtrIH.exe
  C:\Windows\System\lYBtrIH.exe
  2⤵
  PID:7560
- C:\Windows\System\TOHqEyK.exe
  C:\Windows\System\TOHqEyK.exe
  2⤵
  PID:6236
- C:\Windows\System\MVNNhve.exe
  C:\Windows\System\MVNNhve.exe
  2⤵
  PID:7984
- C:\Windows\System\MgFCcLK.exe
  C:\Windows\System\MgFCcLK.exe
  2⤵
  PID:8108
- C:\Windows\System\femkhiX.exe
  C:\Windows\System\femkhiX.exe
  2⤵
  PID:8128
- C:\Windows\System\nxGZSKe.exe
  C:\Windows\System\nxGZSKe.exe
  2⤵
  PID:7788
- C:\Windows\System\TldMyob.exe
  C:\Windows\System\TldMyob.exe
  2⤵
  PID:8200
- C:\Windows\System\bLYQqDJ.exe
  C:\Windows\System\bLYQqDJ.exe
  2⤵
  PID:8216
- C:\Windows\System\AszBJXH.exe
  C:\Windows\System\AszBJXH.exe
  2⤵
  PID:8232
- C:\Windows\System\zItkUBx.exe
  C:\Windows\System\zItkUBx.exe
  2⤵
  PID:8248
- C:\Windows\System\lTKkxUs.exe
  C:\Windows\System\lTKkxUs.exe
  2⤵
  PID:8264
- C:\Windows\System\rgHMElh.exe
  C:\Windows\System\rgHMElh.exe
  2⤵
  PID:8280
- C:\Windows\System\bUiTuRg.exe
  C:\Windows\System\bUiTuRg.exe
  2⤵
  PID:8296
- C:\Windows\System\molysbz.exe
  C:\Windows\System\molysbz.exe
  2⤵
  PID:8312
- C:\Windows\System\RakapWA.exe
  C:\Windows\System\RakapWA.exe
  2⤵
  PID:8328
- C:\Windows\System\HJAwyQe.exe
  C:\Windows\System\HJAwyQe.exe
  2⤵
  PID:8344
- C:\Windows\System\lNQOniC.exe
  C:\Windows\System\lNQOniC.exe
  2⤵
  PID:8360
- C:\Windows\System\tfGtRUQ.exe
  C:\Windows\System\tfGtRUQ.exe
  2⤵
  PID:8376
- C:\Windows\System\MZZpimm.exe
  C:\Windows\System\MZZpimm.exe
  2⤵
  PID:8392
- C:\Windows\System\mFpRfWQ.exe
  C:\Windows\System\mFpRfWQ.exe
  2⤵
  PID:8408
- C:\Windows\System\jnVccPH.exe
  C:\Windows\System\jnVccPH.exe
  2⤵
  PID:8424
- C:\Windows\System\fKUrnah.exe
  C:\Windows\System\fKUrnah.exe
  2⤵
  PID:8440
- C:\Windows\System\BgZTlTT.exe
  C:\Windows\System\BgZTlTT.exe
  2⤵
  PID:8456
- C:\Windows\System\VWOQTQT.exe
  C:\Windows\System\VWOQTQT.exe
  2⤵
  PID:8472
- C:\Windows\System\gvdopYW.exe
  C:\Windows\System\gvdopYW.exe
  2⤵
  PID:8488
- C:\Windows\System\vefbSFZ.exe
  C:\Windows\System\vefbSFZ.exe
  2⤵
  PID:8504
- C:\Windows\System\GUkyZwF.exe
  C:\Windows\System\GUkyZwF.exe
  2⤵
  PID:8520
- C:\Windows\System\lrnlWOl.exe
  C:\Windows\System\lrnlWOl.exe
  2⤵
  PID:8536
- C:\Windows\System\ZeBCJjq.exe
  C:\Windows\System\ZeBCJjq.exe
  2⤵
  PID:8552
- C:\Windows\System\vAejjpG.exe
  C:\Windows\System\vAejjpG.exe
  2⤵
  PID:8568
- C:\Windows\System\inJyxGr.exe
  C:\Windows\System\inJyxGr.exe
  2⤵
  PID:8584
- C:\Windows\System\yLNXiYT.exe
  C:\Windows\System\yLNXiYT.exe
  2⤵
  PID:8600
- C:\Windows\System\ccrjjMd.exe
  C:\Windows\System\ccrjjMd.exe
  2⤵
  PID:8616
- C:\Windows\System\eVrSTQe.exe
  C:\Windows\System\eVrSTQe.exe
  2⤵
  PID:8632
- C:\Windows\System\VCErHVG.exe
  C:\Windows\System\VCErHVG.exe
  2⤵
  PID:8648
- C:\Windows\System\MrBWeBs.exe
  C:\Windows\System\MrBWeBs.exe
  2⤵
  PID:8664
- C:\Windows\System\StPjAUD.exe
  C:\Windows\System\StPjAUD.exe
  2⤵
  PID:8680
- C:\Windows\System\ENxQAbC.exe
  C:\Windows\System\ENxQAbC.exe
  2⤵
  PID:8696
- C:\Windows\System\OsREcKy.exe
  C:\Windows\System\OsREcKy.exe
  2⤵
  PID:8712
- C:\Windows\System\xTPQtVy.exe
  C:\Windows\System\xTPQtVy.exe
  2⤵
  PID:8728
- C:\Windows\System\hrJWMXq.exe
  C:\Windows\System\hrJWMXq.exe
  2⤵
  PID:8744
- C:\Windows\System\ihZIRrg.exe
  C:\Windows\System\ihZIRrg.exe
  2⤵
  PID:8760
- C:\Windows\System\eLJLgNN.exe
  C:\Windows\System\eLJLgNN.exe
  2⤵
  PID:8776
- C:\Windows\System\JPcLDGR.exe
  C:\Windows\System\JPcLDGR.exe
  2⤵
  PID:8792
- C:\Windows\System\LayuZiz.exe
  C:\Windows\System\LayuZiz.exe
  2⤵
  PID:8808
- C:\Windows\System\ejwxeTu.exe
  C:\Windows\System\ejwxeTu.exe
  2⤵
  PID:8824
- C:\Windows\System\fzBelun.exe
  C:\Windows\System\fzBelun.exe
  2⤵
  PID:8840
- C:\Windows\System\NuiKaTF.exe
  C:\Windows\System\NuiKaTF.exe
  2⤵
  PID:8856
- C:\Windows\System\zQWhsyo.exe
  C:\Windows\System\zQWhsyo.exe
  2⤵
  PID:8872
- C:\Windows\System\PesdEgJ.exe
  C:\Windows\System\PesdEgJ.exe
  2⤵
  PID:8888
- C:\Windows\System\IphFiJL.exe
  C:\Windows\System\IphFiJL.exe
  2⤵
  PID:8904
- C:\Windows\System\QRyONeb.exe
  C:\Windows\System\QRyONeb.exe
  2⤵
  PID:8920
- C:\Windows\System\brJMDCH.exe
  C:\Windows\System\brJMDCH.exe
  2⤵
  PID:8936
- C:\Windows\System\fZecePN.exe
  C:\Windows\System\fZecePN.exe
  2⤵
  PID:8952
- C:\Windows\System\cwXENGk.exe
  C:\Windows\System\cwXENGk.exe
  2⤵
  PID:8968
- C:\Windows\System\neuyBjq.exe
  C:\Windows\System\neuyBjq.exe
  2⤵
  PID:8984
- C:\Windows\System\hYAOSgP.exe
  C:\Windows\System\hYAOSgP.exe
  2⤵
  PID:9000
- C:\Windows\System\bqxCCAr.exe
  C:\Windows\System\bqxCCAr.exe
  2⤵
  PID:9016
- C:\Windows\System\EVchnFs.exe
  C:\Windows\System\EVchnFs.exe
  2⤵
  PID:9032
- C:\Windows\System\VFKvlja.exe
  C:\Windows\System\VFKvlja.exe
  2⤵
  PID:9048
- C:\Windows\System\JbAHnGs.exe
  C:\Windows\System\JbAHnGs.exe
  2⤵
  PID:9064
- C:\Windows\System\WDVTOac.exe
  C:\Windows\System\WDVTOac.exe
  2⤵
  PID:9080
- C:\Windows\System\qOSPVEj.exe
  C:\Windows\System\qOSPVEj.exe
  2⤵
  PID:9096
- C:\Windows\System\HsOfLMp.exe
  C:\Windows\System\HsOfLMp.exe
  2⤵
  PID:9112
- C:\Windows\System\YRdFZgu.exe
  C:\Windows\System\YRdFZgu.exe
  2⤵
  PID:9128
- C:\Windows\System\CrtbCTn.exe
  C:\Windows\System\CrtbCTn.exe
  2⤵
  PID:9144
- C:\Windows\System\uvuqiaI.exe
  C:\Windows\System\uvuqiaI.exe
  2⤵
  PID:9160
- C:\Windows\System\axXdSJF.exe
  C:\Windows\System\axXdSJF.exe
  2⤵
  PID:9176
- C:\Windows\System\vnuWGwT.exe
  C:\Windows\System\vnuWGwT.exe
  2⤵
  PID:9192
- C:\Windows\System\RtSxXqK.exe
  C:\Windows\System\RtSxXqK.exe
  2⤵
  PID:9208
- C:\Windows\System\ndLOUhn.exe
  C:\Windows\System\ndLOUhn.exe
  2⤵
  PID:8196
- C:\Windows\System\xAhpGTL.exe
  C:\Windows\System\xAhpGTL.exe
  2⤵
  PID:8256
- C:\Windows\System\xekajlr.exe
  C:\Windows\System\xekajlr.exe
  2⤵
  PID:8356
- C:\Windows\System\xrWaCtl.exe
  C:\Windows\System\xrWaCtl.exe
  2⤵
  PID:8416
- C:\Windows\System\qUcfxbj.exe
  C:\Windows\System\qUcfxbj.exe
  2⤵
  PID:7104
- C:\Windows\System\piZKAcy.exe
  C:\Windows\System\piZKAcy.exe
  2⤵
  PID:8272
- C:\Windows\System\TDToFuM.exe
  C:\Windows\System\TDToFuM.exe
  2⤵
  PID:8336
- C:\Windows\System\RNNzklL.exe
  C:\Windows\System\RNNzklL.exe
  2⤵
  PID:8400
- C:\Windows\System\WAsRfGV.exe
  C:\Windows\System\WAsRfGV.exe
  2⤵
  PID:8448
- C:\Windows\System\KgcOlWA.exe
  C:\Windows\System\KgcOlWA.exe
  2⤵
  PID:8484
- C:\Windows\System\QptSpzz.exe
  C:\Windows\System\QptSpzz.exe
  2⤵
  PID:8580
- C:\Windows\System\cJFYvpv.exe
  C:\Windows\System\cJFYvpv.exe
  2⤵
  PID:8608
- C:\Windows\System\kMFbRdo.exe
  C:\Windows\System\kMFbRdo.exe
  2⤵
  PID:8672
- C:\Windows\System\aLDhwiw.exe
  C:\Windows\System\aLDhwiw.exe
  2⤵
  PID:8528
- C:\Windows\System\rHHRyWM.exe
  C:\Windows\System\rHHRyWM.exe
  2⤵
  PID:8564
- C:\Windows\System\aypHBhC.exe
  C:\Windows\System\aypHBhC.exe
  2⤵
  PID:8628
- C:\Windows\System\PzepttS.exe
  C:\Windows\System\PzepttS.exe
  2⤵
  PID:8692
- C:\Windows\System\RlCHqvS.exe
  C:\Windows\System\RlCHqvS.exe
  2⤵
  PID:8740
- C:\Windows\System\AzHlivv.exe
  C:\Windows\System\AzHlivv.exe
  2⤵
  PID:8784
- C:\Windows\System\LpTogJN.exe
  C:\Windows\System\LpTogJN.exe
  2⤵
  PID:8832
- C:\Windows\System\SKOUFUh.exe
  C:\Windows\System\SKOUFUh.exe
  2⤵
  PID:8816
- C:\Windows\System\HBqkGNP.exe
  C:\Windows\System\HBqkGNP.exe
  2⤵
  PID:8864
- C:\Windows\System\ErrsUDH.exe
  C:\Windows\System\ErrsUDH.exe
  2⤵
  PID:8928
- C:\Windows\System\qcCqLPf.exe
  C:\Windows\System\qcCqLPf.exe
  2⤵
  PID:8944
- C:\Windows\System\eZghqFl.exe
  C:\Windows\System\eZghqFl.exe
  2⤵
  PID:8960
- C:\Windows\System\wdJQMTG.exe
  C:\Windows\System\wdJQMTG.exe
  2⤵
  PID:9012
- C:\Windows\System\NWMxUir.exe
  C:\Windows\System\NWMxUir.exe
  2⤵
  PID:9024
- C:\Windows\System\jHFrbbH.exe
  C:\Windows\System\jHFrbbH.exe
  2⤵
  PID:9072
- C:\Windows\System\xJmqfKK.exe
  C:\Windows\System\xJmqfKK.exe
  2⤵
  PID:9120
- C:\Windows\System\RascIGy.exe
  C:\Windows\System\RascIGy.exe
  2⤵
  PID:9092
- C:\Windows\System\pNRIxCF.exe
  C:\Windows\System\pNRIxCF.exe
  2⤵
  PID:9136
- C:\Windows\System\EmteIlw.exe
  C:\Windows\System\EmteIlw.exe
  2⤵
  PID:7540
- C:\Windows\System\UAzvtIb.exe
  C:\Windows\System\UAzvtIb.exe
  2⤵
  PID:8320
- C:\Windows\System\lWBqZTj.exe
  C:\Windows\System\lWBqZTj.exe
  2⤵
  PID:8388
- C:\Windows\System\eUFTDNe.exe
  C:\Windows\System\eUFTDNe.exe
  2⤵
  PID:8212
- C:\Windows\System\nCQUfXn.exe
  C:\Windows\System\nCQUfXn.exe
  2⤵
  PID:8436
- C:\Windows\System\vyyRaoo.exe
  C:\Windows\System\vyyRaoo.exe
  2⤵
  PID:8640
- C:\Windows\System\gUBmluv.exe
  C:\Windows\System\gUBmluv.exe
  2⤵
  PID:8452
- C:\Windows\System\TdaAGIX.exe
  C:\Windows\System\TdaAGIX.exe
  2⤵
  PID:8516
- C:\Windows\System\maftElS.exe
  C:\Windows\System\maftElS.exe
  2⤵
  PID:8596
- C:\Windows\System\nQdsDlz.exe
  C:\Windows\System\nQdsDlz.exe
  2⤵
  PID:8768
- C:\Windows\System\pwmIWtH.exe
  C:\Windows\System\pwmIWtH.exe
  2⤵
  PID:8752
- C:\Windows\System\YpdSWWL.exe
  C:\Windows\System\YpdSWWL.exe
  2⤵
  PID:8788
- C:\Windows\System\rsfIBmY.exe
  C:\Windows\System\rsfIBmY.exe
  2⤵
  PID:8880
- C:\Windows\System\DdeRgSn.exe
  C:\Windows\System\DdeRgSn.exe
  2⤵
  PID:8996
- C:\Windows\System\EJIhWyq.exe
  C:\Windows\System\EJIhWyq.exe
  2⤵
  PID:9076
- C:\Windows\System\qBeThwX.exe
  C:\Windows\System\qBeThwX.exe
  2⤵
  PID:7716
- C:\Windows\System\AWUBrMo.exe
  C:\Windows\System\AWUBrMo.exe
  2⤵
  PID:8208
- C:\Windows\System\jnEXgeR.exe
  C:\Windows\System\jnEXgeR.exe
  2⤵
  PID:9056
- C:\Windows\System\KqDundn.exe
  C:\Windows\System\KqDundn.exe
  2⤵
  PID:8576
- C:\Windows\System\qfFhVzE.exe
  C:\Windows\System\qfFhVzE.exe
  2⤵
  PID:8736
- C:\Windows\System\mzQSMOG.exe
  C:\Windows\System\mzQSMOG.exe
  2⤵
  PID:8432
- C:\Windows\System\HPFblwk.exe
  C:\Windows\System\HPFblwk.exe
  2⤵
  PID:8688
- C:\Windows\System\ETFbsnh.exe
  C:\Windows\System\ETFbsnh.exe
  2⤵
  PID:8372
- C:\Windows\System\tTauoPW.exe
  C:\Windows\System\tTauoPW.exe
  2⤵
  PID:8976
- C:\Windows\System\JRjqrRB.exe
  C:\Windows\System\JRjqrRB.exe
  2⤵
  PID:9140
- C:\Windows\System\ZKzNyJM.exe
  C:\Windows\System\ZKzNyJM.exe
  2⤵
  PID:9152
- C:\Windows\System\ZhKwPsE.exe
  C:\Windows\System\ZhKwPsE.exe
  2⤵
  PID:8756
- C:\Windows\System\LAWRxca.exe
  C:\Windows\System\LAWRxca.exe
  2⤵
  PID:8288
- C:\Windows\System\AYjmlTG.exe
  C:\Windows\System\AYjmlTG.exe
  2⤵
  PID:9228
- C:\Windows\System\drZyZVS.exe
  C:\Windows\System\drZyZVS.exe
  2⤵
  PID:9244
- C:\Windows\System\KnkuNdb.exe
  C:\Windows\System\KnkuNdb.exe
  2⤵
  PID:9260
- C:\Windows\System\FxjpPFQ.exe
  C:\Windows\System\FxjpPFQ.exe
  2⤵
  PID:9276
- C:\Windows\System\MITYfHB.exe
  C:\Windows\System\MITYfHB.exe
  2⤵
  PID:9292
- C:\Windows\System\eNRuLop.exe
  C:\Windows\System\eNRuLop.exe
  2⤵
  PID:9308
- C:\Windows\System\nsAEpuR.exe
  C:\Windows\System\nsAEpuR.exe
  2⤵
  PID:9324
- C:\Windows\System\DeXbgfs.exe
  C:\Windows\System\DeXbgfs.exe
  2⤵
  PID:9340
- C:\Windows\System\ZqbctEO.exe
  C:\Windows\System\ZqbctEO.exe
  2⤵
  PID:9356
- C:\Windows\System\GevmZhC.exe
  C:\Windows\System\GevmZhC.exe
  2⤵
  PID:9376
- C:\Windows\System\uLGxdRc.exe
  C:\Windows\System\uLGxdRc.exe
  2⤵
  PID:9392
- C:\Windows\System\oSAakhd.exe
  C:\Windows\System\oSAakhd.exe
  2⤵
  PID:9408
- C:\Windows\System\OMiuDHu.exe
  C:\Windows\System\OMiuDHu.exe
  2⤵
  PID:9424
- C:\Windows\System\ZnKOZBp.exe
  C:\Windows\System\ZnKOZBp.exe
  2⤵
  PID:9440
- C:\Windows\System\hNaTupO.exe
  C:\Windows\System\hNaTupO.exe
  2⤵
  PID:9456
- C:\Windows\System\IAkVGJA.exe
  C:\Windows\System\IAkVGJA.exe
  2⤵
  PID:9472
- C:\Windows\System\eDUjOtH.exe
  C:\Windows\System\eDUjOtH.exe
  2⤵
  PID:9488
- C:\Windows\System\ZJoJvIy.exe
  C:\Windows\System\ZJoJvIy.exe
  2⤵
  PID:9504
- C:\Windows\System\mwbSdtq.exe
  C:\Windows\System\mwbSdtq.exe
  2⤵
  PID:9520
- C:\Windows\System\OzOCkjk.exe
  C:\Windows\System\OzOCkjk.exe
  2⤵
  PID:9536
- C:\Windows\System\xYcKNAP.exe
  C:\Windows\System\xYcKNAP.exe
  2⤵
  PID:9552
- C:\Windows\System\fWyYPpb.exe
  C:\Windows\System\fWyYPpb.exe
  2⤵
  PID:9568
- C:\Windows\System\SaMYzTw.exe
  C:\Windows\System\SaMYzTw.exe
  2⤵
  PID:9584
- C:\Windows\System\JVyIjiR.exe
  C:\Windows\System\JVyIjiR.exe
  2⤵
  PID:9600
- C:\Windows\System\uEwniSv.exe
  C:\Windows\System\uEwniSv.exe
  2⤵
  PID:9616
- C:\Windows\System\JLWWgbR.exe
  C:\Windows\System\JLWWgbR.exe
  2⤵
  PID:9632
- C:\Windows\System\vbJoLVi.exe
  C:\Windows\System\vbJoLVi.exe
  2⤵
  PID:9648
- C:\Windows\System\hTdwrOK.exe
  C:\Windows\System\hTdwrOK.exe
  2⤵
  PID:9664
- C:\Windows\System\yNMMKDz.exe
  C:\Windows\System\yNMMKDz.exe
  2⤵
  PID:9680
- C:\Windows\System\wsvRTyJ.exe
  C:\Windows\System\wsvRTyJ.exe
  2⤵
  PID:9696
- C:\Windows\System\SMwoWLd.exe
  C:\Windows\System\SMwoWLd.exe
  2⤵
  PID:9712
- C:\Windows\System\uWPSMUv.exe
  C:\Windows\System\uWPSMUv.exe
  2⤵
  PID:9728
- C:\Windows\System\ecyyssH.exe
  C:\Windows\System\ecyyssH.exe
  2⤵
  PID:9744
- C:\Windows\System\WRyPtLK.exe
  C:\Windows\System\WRyPtLK.exe
  2⤵
  PID:9760
- C:\Windows\System\FSiILpm.exe
  C:\Windows\System\FSiILpm.exe
  2⤵
  PID:9776
- C:\Windows\System\WpIBPdl.exe
  C:\Windows\System\WpIBPdl.exe
  2⤵
  PID:9792
- C:\Windows\System\iCPLbwJ.exe
  C:\Windows\System\iCPLbwJ.exe
  2⤵
  PID:9808
- C:\Windows\System\cpcDHMV.exe
  C:\Windows\System\cpcDHMV.exe
  2⤵
  PID:9824
- C:\Windows\System\KSszDBr.exe
  C:\Windows\System\KSszDBr.exe
  2⤵
  PID:9840
- C:\Windows\System\sHKrFPr.exe
  C:\Windows\System\sHKrFPr.exe
  2⤵
  PID:9856
- C:\Windows\System\yrSJTdL.exe
  C:\Windows\System\yrSJTdL.exe
  2⤵
  PID:9872
- C:\Windows\System\IUATeXP.exe
  C:\Windows\System\IUATeXP.exe
  2⤵
  PID:9888
- C:\Windows\System\KKDdgAG.exe
  C:\Windows\System\KKDdgAG.exe
  2⤵
  PID:9908
- C:\Windows\System\utTrnwK.exe
  C:\Windows\System\utTrnwK.exe
  2⤵
  PID:9924
- C:\Windows\System\eEfYAft.exe
  C:\Windows\System\eEfYAft.exe
  2⤵
  PID:9940
- C:\Windows\System\NYavhuJ.exe
  C:\Windows\System\NYavhuJ.exe
  2⤵
  PID:9956
- C:\Windows\System\MYbYRMF.exe
  C:\Windows\System\MYbYRMF.exe
  2⤵
  PID:9972
- C:\Windows\System\ypBPaqO.exe
  C:\Windows\System\ypBPaqO.exe
  2⤵
  PID:9988
- C:\Windows\System\CDZciiB.exe
  C:\Windows\System\CDZciiB.exe
  2⤵
  PID:10004
- C:\Windows\System\LUiEiKL.exe
  C:\Windows\System\LUiEiKL.exe
  2⤵
  PID:10020
- C:\Windows\System\fAnFgzT.exe
  C:\Windows\System\fAnFgzT.exe
  2⤵
  PID:10036
- C:\Windows\System\ZDOXosB.exe
  C:\Windows\System\ZDOXosB.exe
  2⤵
  PID:10052
- C:\Windows\System\VNQCqAn.exe
  C:\Windows\System\VNQCqAn.exe
  2⤵
  PID:10068
- C:\Windows\System\pyAioXv.exe
  C:\Windows\System\pyAioXv.exe
  2⤵
  PID:10084
- C:\Windows\System\hAGBTez.exe
  C:\Windows\System\hAGBTez.exe
  2⤵
  PID:10100
- C:\Windows\System\XhSUHip.exe
  C:\Windows\System\XhSUHip.exe
  2⤵
  PID:10116
- C:\Windows\System\QsODqHP.exe
  C:\Windows\System\QsODqHP.exe
  2⤵
  PID:10132
- C:\Windows\System\MrggFMX.exe
  C:\Windows\System\MrggFMX.exe
  2⤵
  PID:10148
- C:\Windows\System\aeDkfse.exe
  C:\Windows\System\aeDkfse.exe
  2⤵
  PID:10164
- C:\Windows\System\UrneSLi.exe
  C:\Windows\System\UrneSLi.exe
  2⤵
  PID:10180
- C:\Windows\System\haMsTcp.exe
  C:\Windows\System\haMsTcp.exe
  2⤵
  PID:10196
- C:\Windows\System\yHYwMNn.exe
  C:\Windows\System\yHYwMNn.exe
  2⤵
  PID:10212
- C:\Windows\System\gYnUtLf.exe
  C:\Windows\System\gYnUtLf.exe
  2⤵
  PID:10228
- C:\Windows\System\ztqTMoI.exe
  C:\Windows\System\ztqTMoI.exe
  2⤵
  PID:7256
- C:\Windows\System\JuMlMti.exe
  C:\Windows\System\JuMlMti.exe
  2⤵
  PID:8544
- C:\Windows\System\pNBFrcU.exe
  C:\Windows\System\pNBFrcU.exe
  2⤵
  PID:8896
- C:\Windows\System\BMMBMva.exe
  C:\Windows\System\BMMBMva.exe
  2⤵
  PID:8992
- C:\Windows\System\KYXRpnq.exe
  C:\Windows\System\KYXRpnq.exe
  2⤵
  PID:9224
- C:\Windows\System\ENKDpIc.exe
  C:\Windows\System\ENKDpIc.exe
  2⤵
  PID:9304
- C:\Windows\System\DqeTLtc.exe
  C:\Windows\System\DqeTLtc.exe
  2⤵
  PID:9372
- C:\Windows\System\fRgvWCL.exe
  C:\Windows\System\fRgvWCL.exe
  2⤵
  PID:9320
- C:\Windows\System\dIfyXlD.exe
  C:\Windows\System\dIfyXlD.exe
  2⤵
  PID:9388
- C:\Windows\System\rBPvIdJ.exe
  C:\Windows\System\rBPvIdJ.exe
  2⤵
  PID:9464
- C:\Windows\System\QPEjzks.exe
  C:\Windows\System\QPEjzks.exe
  2⤵
  PID:9500
- C:\Windows\System\hYLJbMM.exe
  C:\Windows\System\hYLJbMM.exe
  2⤵
  PID:9564
- C:\Windows\System\FVoScLA.exe
  C:\Windows\System\FVoScLA.exe
  2⤵
  PID:9624
- C:\Windows\System\nIpNpNd.exe
  C:\Windows\System\nIpNpNd.exe
  2⤵
  PID:9656
- C:\Windows\System\TNdLjFG.exe
  C:\Windows\System\TNdLjFG.exe
  2⤵
  PID:9452
- C:\Windows\System\tNagHTg.exe
  C:\Windows\System\tNagHTg.exe
  2⤵
  PID:9516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EAwYvRL.exe

Filesize
1.4MB

MD5
1050cf9c9398c5276b08d8e0a077ac46

SHA1
291cb27acdc9c572ee2ff7d591ddde3b18067b82

SHA256
6cf1669fa351453a3a3aa51bdc71452287d4beec4df342cbed40326a9fee44e0

SHA512
4857bbf8a4497943d0cde4169b44b6247f206d993f0ddb9a6e0bc88a0710e5c58ccdcb54d035ecfd8031247e00d2f72508dcdbbf8138e6a7b12c373dbcb3e56e

Download Submit
C:\Windows\system\MqAgBTz.exe

Filesize
1.4MB

MD5
80fd991e3a10b58c9438fa82527c2737

SHA1
8e1831cb0161575e82e0a5da6e087221a90e4859

SHA256
fc354afbcf7d0acab6c621ccdd7dd8b922d2358e87ffc50445b371fe604c5a4d

SHA512
d3c8fda3cc504ab270594ab996db274c3fab9871c7cbcc1ac5ab42792bd967a449dc4c2ffd4fdb81ec8709f5e1e5eac494148884a6f0b76ec531baf0dec39fd5

Download Submit
C:\Windows\system\PscWvsG.exe

Filesize
1.4MB

MD5
a33ad0b2368b2791c171ac5e756811bb

SHA1
5345c11b9a042113e8e6f42f0b0afdbccd8a455e

SHA256
95aed1ba871ddcbd613ed51757df60a7f9b53117ac04ce271fdf8ee20f52165d

SHA512
41b638bc85800d83984aaaa0541940ef13e23213a464717d37f9503de92235052d0d01673067753c7262851f38d3def8858c659a68ae431cb05354cbe8bbe5d0

Download Submit
C:\Windows\system\WmRGrmq.exe

Filesize
1.4MB

MD5
aa2d53b2b4a2e6ab0ba6efd240ab7542

SHA1
c3d952e582e2a6a8f9e4ab0eb5f5a481f0495076

SHA256
8dd34b1559d9852f3f0c720b90b2f2c5bfaf3c3db83df8db6b99ca6eab54b418

SHA512
9a5d9bbd3235b23fb4291b367923f72e2f8cc8b02c822a6b1ab458d18a68f397a1916a10c8f782a5092b91f2c1ae29f66cb12e80b40857312cd0aa95d774aea5

Download Submit
C:\Windows\system\XMqIxek.exe

Filesize
1.4MB

MD5
cca9dc94fe9027b34795e19026630828

SHA1
09528a1ccf2eb3474605a178808c6aba01297fa9

SHA256
d053976c1957a2e7058be9f7055ce039a5ecfc00aaa2b1480658c51dba34f1a5

SHA512
c6313647d29f9950763ebbd498d73eb1c3cbc3a7530605ff856f391747d13d11b5113208547e49c631eaa27c87499496d009ff700f1d3f76e527117dca1f02b3

Download Submit
C:\Windows\system\YHEzEEE.exe

Filesize
1.4MB

MD5
39720b22d0d57c80f669c2969585c412

SHA1
70653ea3ce3643c1c21bba61667bf88511235b75

SHA256
a11f3ae0a6838f13a672320b2e395f2e61eac8997d29fabecc06d661804e9ec2

SHA512
b344fdb8f8234f35346949467033adea0d4a0872c44d7c46b958a1a635876204e04414b01cbe8a4f0632c5c14c2f9484938c238a0863f625b11c47c88a4e2227

Download Submit
C:\Windows\system\ZnLystk.exe

Filesize
1.4MB

MD5
ffa0efa04f20c3ab159cafa2f364f2b9

SHA1
9fd5a974b1ef805ab47753ff3494f17a9d9ca2b9

SHA256
444754f31f6bcec66bf61a4a689a16a5a92252d3784c35ad457e79278d398266

SHA512
a0a34259da30952fdcd50d2d06aae66b0f6c59685ca57dfcd594d227784e56e4a92544556a0e89f45f889f1b12040dd10a72916ba0b83764856c82072dd8e634

Download Submit
C:\Windows\system\cwACwmv.exe

Filesize
1.4MB

MD5
b98197e6583ccdcf26fbbee9d0d47ecb

SHA1
83b9dabb99b9cf112703d61284469abaeb96da38

SHA256
e3c8776ce05720688b2b724817162efa28430fb066be66ca3c5205747d011202

SHA512
9a268e879d4c2ad45f61cbba04546631f7b1d21528748ccd0b1df4d14c7fce0451bb220d27957fc43d79968d30c71675669a7bf3a5b548aac08a6a9b5241dec6

Download Submit
C:\Windows\system\dsKEzQM.exe

Filesize
1.4MB

MD5
ef9c9fa0ae347db425051229e692b9ac

SHA1
919f9ed5ed551b20aabd6eabd633c4a379f2ac21

SHA256
c5506b005f9a28a36f407795a399cb5dd52a20dd84a0a1c51d7a14006c2291ed

SHA512
98a8d3bd40607bdbba6b3c208fc1ff04ef2210c5825ed380fa103fc625f1651d548f1032944148e24dc077e7242108abdbef7bb5e5b5e72696909016aad07e26

Download Submit
C:\Windows\system\hFAUoSq.exe

Filesize
1.4MB

MD5
ca683fafdbc7934feb6e628282fd5a53

SHA1
d295def514e9778c70562ad721c225179870aff1

SHA256
b4dfb214c56f9a4dd30bf0e448170852e9d32a0ab43bef4f29526cfb94c33be9

SHA512
3a08f65482d24b20199dc93eb040d0597d8852942f39d59a492bbc748927143347531c5459dd1bc2d1a87f704c9dc5d60f1752d12c565ac5b9652ddc571b7c4d

Download Submit
C:\Windows\system\qVOGRoJ.exe

Filesize
1.4MB

MD5
dcc417547d3a19c810c9649814a065cb

SHA1
744a750625d75af5e6d4a5e2a215eeb3c8a20a7f

SHA256
1af53f6cad075918441e6223ee948074ee36d1748e190e6c7b67955f6788ec0b

SHA512
8d575af94255d2a91297544a35853c85394257e35b2f13fa162ae09340f2ee83824691c8bb81f601486ebf785fc6a52c63767c5fa32598d04ffa3292fb89b0d3

Download Submit
C:\Windows\system\vrdIngB.exe

Filesize
1.4MB

MD5
4dda3b2b9fe11540e172a8263cbd23b0

SHA1
9076bf8de2147a6fb861d7114a857d0e107366e3

SHA256
715d975a8410473f37a7aab005ae68d634256b8d57fafb3b34ed1f2e096ec465

SHA512
161ba87b967ab1c90023b687af68ee455f66189de301ca3ede631117a2b9f48de2b7395a3c19422eae499102109419b313369edc6f5d472c1edefaca66da7c60

Download Submit
\Windows\system\AoyyfiW.exe

Filesize
1.4MB

MD5
7cc51b2f689a7ae75ac8e8750f93374a

SHA1
7246240b01501006f0b6437a039b259a521803a2

SHA256
d9367396d4ee63c3d34faebf50ccb487dd68f12d2b7a02b3bfd9c15aca8605c9

SHA512
290b06f4b99867305c5764ada7c141c55195c92ca420133e7917ff7fdae4b0d3795afc04a5b3e6a897d78da55ccab3fe32b51fa6e7b1e06f34dbbc11d74e27ad

Download Submit
\Windows\system\CLZDXvc.exe

Filesize
1.4MB

MD5
d3924511207b7c39369aa1e6cdf2181d

SHA1
1e3cda35163173915535ed881ab720a3462318c6

SHA256
679ec18b68bcd36218a9d4f0a36500de0cc285781c37687b51588bfd1aa989bb

SHA512
ca29a375b358c7121e206387885674310b37d1398a63390250638d2eeca84c8a2495bf1449998feac939d60c8b1ac2f07ac2e756ebccf4fa45e6448627aa77d4

Download Submit
\Windows\system\CZbtdMq.exe

Filesize
1.4MB

MD5
62d0c813b4294920e96636b32f440665

SHA1
da1b1905dcd0d17128c7a1fb2d9b3bc54280c247

SHA256
244adc4e561dfebebb91c0a0d4b214ec57584e9099f4e6a38458f700418d1f73

SHA512
1634ccb958ca295fe95cfdf3d1ee4a2aa1080e33d2500d5666f2e7d1e35b1e8f44414e271eb7b0175259540b0c5dfd498ffc601d4b453e5af0aa38246ec02801

Download Submit
\Windows\system\DNfDVJh.exe

Filesize
1.4MB

MD5
e31660c2c56f94fe2c781be39158432c

SHA1
02fdd197a64836c20fdce259fe0fa215f95a26e0

SHA256
41597242e86937224e2a4cad9b078b5def9b6731fba0ce0dcb0dbe3baf9de0ef

SHA512
6bb016aa3df4465fcd277b6a3c286d091a4568c921390e041b425a884926d479204367bac9e9b8079f0d419d21bae454abb380f1ba38b290b5abb2e2e8ca96a7

Download Submit
\Windows\system\EVeHszP.exe

Filesize
1.4MB

MD5
674736c93470e643a31f25c93941fbce

SHA1
efe227e202e058e61777785e871628a36493bea3

SHA256
19e82cb604a1ccf8063e132e5edcb538ea8e269e612ecaeb6ae37a84640a37eb

SHA512
ddc61856011410e08a0942905bdd9899b5ac691e0fe15812c5578722269e3c18287d022dff95dc57ac29e486893fb571aacb011e86b767951c86ce2f34606228

Download Submit
\Windows\system\FVjwXmP.exe

Filesize
1.4MB

MD5
6f0fbcce025d70202b70b69409422df9

SHA1
069cb1abd9b7122adcf928116d46fdfa6250dbdf

SHA256
7cbc2c4712d16f3c8163dc65706a228c5214cfa973c2023c8c7c8ad5cc2cb863

SHA512
769dbd84d22933b877a24fdbb5ec65a1f6a9029cc44204eff80debc03e2cdd59662cbc17c4fd808f5c2c224923e9e0e7f7846f05e2cdb15b9c67bad559252cd2

Download Submit
\Windows\system\IFUrnOz.exe

Filesize
1.4MB

MD5
fc23b564b9832b4ad1de61e0af22e3ce

SHA1
39cee4d438a0659c7b25136da01be0f0378bbdec

SHA256
4e08cb6cb36fbae8673cfb9085d8d7bc3d2d2ba040a4d0c78dbee4d46e0c5b42

SHA512
7519a272b54869775f79f5947abaf8eaae1e5bb9df6edd239ba44873266ddb34be950513ac4e9f25af64b81f9396baa80fb6394fa5f3a9c7b178fee77f4f9fd7

Download Submit
\Windows\system\IFxggFy.exe

Filesize
1.4MB

MD5
aac4559e3061b9dad0ddcc39bb56fbab

SHA1
7c28ab3010d132f955ce83b2ba8015386a903214

SHA256
da51783930541c8c6ec60a791b05f86049386a9ecbb8a491eae75eacb088aa6a

SHA512
572615bda92a97f920bc54287b060d74b9fd141fe8f986d2176f0ca4a898e7b101968f85bf1c12955914ada81f442f35963a28eae55398272ba03de54be38353

Download Submit
\Windows\system\JRonmRz.exe

Filesize
1.4MB

MD5
04f27deb6aadbf843b3effdd8385e04e

SHA1
3dff33ca6468ce1b95f5a5cd22bd2a2448abc541

SHA256
c44aa2d92da3d014a022a68ebc44f3714f0f353a798046250867bc87013dfac8

SHA512
02a2f192e322518f76fb18231eed26f5d189b09b4ee5cd59c706e0833796911dd45445f5a9fb871e9aa9e144bab4de3953382434c56e097b3edef30d96b97a6c

Download Submit
\Windows\system\KjsGKvK.exe

Filesize
1.4MB

MD5
a68056493facb0d029edbcd480686470

SHA1
fba6a4dbeeda6cf857e16bf7785bca17458d3d41

SHA256
6c5d40a7516e63541fb4654f02525b4c1dd1a44a9a8020c3dca728a05fe4861c

SHA512
3805a22fa9b9cd52c3395d48c8b9079abde35f615d6fa3473c5f8ff57d108d08a52e3e99111bd7a7d929a2e420c90820271dd8ce3a8d1cf1a84f2b8087096984

Download Submit
\Windows\system\NUggAPP.exe

Filesize
1.4MB

MD5
f7ca629cac705595108eabe0ec77e973

SHA1
044f406c9a110d2d32718bba2be408489e3cc2c4

SHA256
edc628b5499275251ed73719f9eb42fcf8095c71eb83dd44caec5e1eef72bebd

SHA512
1863c70d87262a265d0a56acdbaaf9c10fe3986687c380f571f3116f4317f5336ccf972f2af552bc0005abe5bf0818c8e0d25bf503a2f5818c8d5bdf688a7b11

Download Submit
\Windows\system\SkpIoae.exe

Filesize
1.4MB

MD5
c4357fc7200e3f637966f7de535fbb55

SHA1
5a8e8b3e6daeb0bf244812cbc9025d90940bad57

SHA256
9b6572ea524ce68a8e7001d23fb35e9a8b65c59b42eaca1605c566aa0eeaa9d5

SHA512
3a73e8478e9c750755806512669fc6e5f36eac2d77a511317e515929a0ee988ba3b9d87da4cf5daadf60fc9af5caad9bdc623809e8f55945d769c73232205d7a

Download Submit
\Windows\system\TgkeeGl.exe

Filesize
1.4MB

MD5
3b0200be9741144661e9b7f5dea76263

SHA1
01637895c30808e9f3c9667ef7b4505a847d67e5

SHA256
a95596556871fdbb6428d55f020a66b3c0ecac3fc4b2360a89b03869b44388a7

SHA512
3626119a1eaf5bf9f8a34878ee139d9e4e53263a50b456b6e85deff331f9072b744c0f3088aa1ccf23e17be9d4379a61fd161df43503b556125881aaddff9a0a

Download Submit
\Windows\system\VxlFUDb.exe

Filesize
1.4MB

MD5
252b0e5f95ea932c98f4d79046454f4e

SHA1
00fef9849f7a2998c38990f28d0d7b047cc32dc0

SHA256
a5454f3346165d70e351efee98bbbac978d6d48abe599a21d7efbaf2084f02f7

SHA512
1ad2c7dd0fce70f90c671ccec8464a0a08d484d23eab65f46d0fa519ac921f1bc0f8b98712777c4c56229f728345dfc9463c35234ede8106ffab9c32cebbf895

Download Submit
\Windows\system\XAgxCUY.exe

Filesize
1.4MB

MD5
c01a1f882dc869fb5de54055627fe1ef

SHA1
aea916abaa92c3986c4fa33c1402855d717b60ba

SHA256
5d6c92530d9ef52cb4afeec7ac78a8a1faf6d970df6426cf2fe5d5f1ea2380c8

SHA512
423f61ead59c6392b6fcd6da2b0a4d3bf12853e862d92a6fe8f714e35d526cee4ba6bf8a08de39f3690922e7f361b2a8ed394b80c9ef08ee234ac122efafb4a5

Download Submit
\Windows\system\YmmozID.exe

Filesize
1.4MB

MD5
4e10f63f6470446029ba3b4745611a71

SHA1
b444f66da8bde93410db559aefa80cfb5843cf6e

SHA256
e7884a9df155ce1ce3023c3c10da5e606347d6af16d523ed1456415fe9ede85d

SHA512
b672571e9a86cdc8bd11a089d75571bc4fa1c8129d4bdb442b9f41633b055e7e6c3cf7becb46ba0b4ee722d7e3ddab18fc89a850163525ea2120c8e9c9f12505

Download Submit
\Windows\system\ZxZraLm.exe

Filesize
1.4MB

MD5
cccdf67c14e6be1dac9d6bb08254d71b

SHA1
0c66c094f059302509d6429d2a8d26d50f44f6a4

SHA256
adcaab44bdb9ca775159f3449c5ebb9b7672648c7af2572133a1526b2f88d2af

SHA512
738f8bb02318fbbb0bd455e9e99278b4d6ecc2058a8f794b7eb6317f6bf722f93559d30d01046021dcdb940f2e7ab139e3dab932df979da1f024766493074af5

Download Submit
\Windows\system\fjtJdyN.exe

Filesize
1.4MB

MD5
2ba2bb4dea46acb5833acd355b36e02b

SHA1
743f8a8f89b779ec80e5ce381f6f7ebd1ca46fc6

SHA256
552264ce7485f9763ad4047c64d0d4652ef41e4cb2be675584ad44abc5f82514

SHA512
559cc0fed1171170690a41dc95b6502912f27839a710073fd55de5a3533f5274916327e6b425567a0b13dc80c74262093c14f231fbe8148e697817d1a5fd0e71

Download Submit
\Windows\system\gPPkQiS.exe

Filesize
1.4MB

MD5
dd343b245dd08fd432e4ffa131588d17

SHA1
cb0c4fa8375b7c45b72790d565a0c6b100167900

SHA256
df39336c2630af52345b4adde3e8d9e968d3f46478f4bf82c390906568ce7cb7

SHA512
ce485448540d78cd17dae2c12091b651eed3f7018fbb0adf3fa53aed762edd240d8d7c323caf61dd970b16140704bbb840ed7e3d2e0c380f08990d21b5efeea4

Download Submit
\Windows\system\hJFgqUp.exe

Filesize
1.4MB

MD5
1e90f50f4d4b8cb655e145031c7a4607

SHA1
d5bb4665832e02a0d3dcbb17de4b0e0327bf9f89

SHA256
8b76acbbfad039c9c84f2db4eeca89ca80bc3221484b272dff747b6e8790dc1b

SHA512
3193efd2300e1c11fe2c0be2d4148d9f482883b05ded8733dffb797f664f944761653c704af546df846acc797fd69b415741a83844bb3fb1e9be30fdee1c345a

Download Submit
\Windows\system\luTVwOD.exe

Filesize
1.4MB

MD5
7e5033e33eb31f150fbc16c87677711f

SHA1
aa38ee99ad813b15ceed1ea4283c59024b16470f

SHA256
424ef2355301f1e585549a905112c672048722259e6b6f1f94aab79103e51434

SHA512
b08f8405ccf676d8f072489c0bf378db3adb8a44a7208e55fa6c6a7a14439f49bac7104886a43717030fdc887f8530bd2853075aee1995505f9234f0c83844d0

Download Submit
\Windows\system\nCXjnHi.exe

Filesize
1.4MB

MD5
5795475cf5e7aa22eb1ae29ec57453e6

SHA1
e1e049081606bf6b3d7cb1cbd2a90deb96cbc9dd

SHA256
f295c4c8b311109b44ef494b6476e0d6c6072786aeb36bdcf7d84317e2626794

SHA512
fd3b416a87b721465ecd048eac0b088347fcde59ddfe393277aa5248b46266992dced0663158e3f73c32081d06c1a644dbf7daea73d3d7f0efc2a527ae63fbea

Download Submit
\Windows\system\pVxGTvy.exe

Filesize
1.4MB

MD5
e7e9a36d261f5c2677d510b43b6c34a2

SHA1
81bebaed074f78b99da8936bb6b911ddcd8c3dae

SHA256
fb2cbdd024de8869b8a14f8614938218403471649393138a1605247e312a05ca

SHA512
be7481b617098e655ebcbfb678ef5464408ffe1782e4bd508fd1fdcce391c748f081201914fc293cdc4131f851bc9a3f0ab00527d69acee50a7a776554c25a66

Download Submit
\Windows\system\rdgSsYY.exe

Filesize
1.4MB

MD5
82b21d8c5e6ec47b2f92c5977638bd06

SHA1
fd7588ebe1d97fa604cd3fac12ede0aa2d68ab09

SHA256
2909dac357b588b3c7504a06a86b2cb5790ca402b101548af4c274411fdfa2ea

SHA512
66b8d8a6b5f1301a4e7beb8168e21f5820a42e9bd34cdfd0ac82ce974a0f016f87181de3f3cadf499071b28daeb147b9521759e6f288a6586298750cd639d8a2

Download Submit
\Windows\system\wVNdOhW.exe

Filesize
1.4MB

MD5
879740c2224471de3a9371d34ae412ea

SHA1
314d3bec6ef04768abb8970fd934903e7ddc4cd9

SHA256
7e0d8c1b06482eb6d057debbf40909ed82bbaa4bcd30b4cc7f19750fb22ecb6d

SHA512
23a53df14436a0a9261ebbd84fd96a461ed378afd94d68cd9f7e6337a1d008b7639c55649366b0baaff8b388aa6e2d6aded74d2c5bba904ec8922994893f697a

Download Submit
\Windows\system\ySjFjfE.exe

Filesize
1.4MB

MD5
a9bc2d96dfcfb94438175f6ef1443050

SHA1
e11961d1f7aa137c5d884848aa311466c72f6f9f

SHA256
baf08a09164e1274594790f5bddbd3d394f9823ce3f2f4662e2f31fbbf4332da

SHA512
c2d3d6e4989e026ca8bdd6bf33cb1459e1b4ea382a9eb97e0152a819e01201e72ad755b58556d2c34d3b9abddbfc413be910f7ce61aab61d77356c1655d48fb0

Download Submit
\Windows\system\yrYsBlE.exe

Filesize
1.4MB

MD5
838ab512909113e328b77cde192ecf57

SHA1
5aab7c4254758ef3775a9de508e0f72680db95bb

SHA256
bd059cf069afd9217daece3240fe63e4e2af4fe5a9e9b800c4fd4747c0abe041

SHA512
11b9af74fab5675ab47a9fdd700a4423e4c47b70b1642f6243e055dbd74a4fce1d8a1f99c8ab59182bddc3aa1b813cf5461905447a9db21c2bfd8b3bc2803cdf

Download Submit
memory/1984-63-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-56-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2012-58-0x0000000001E20000-0x0000000001E28000-memory.dmp

Filesize
32KB

Download
memory/2104-31-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2104-99-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2176-9-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2176-66-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2204-72-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2428-68-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-69-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2552-282-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2552-40-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2640-75-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-21-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-104-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/3028-59-0x00000000034E0000-0x00000000038D2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-118-0x00000000034E0000-0x00000000038D2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-57-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-34-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/3028-13-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/3028-54-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/3028-110-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/3028-2-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/3028-122-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-19-0x00000000034E0000-0x00000000038D2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-114-0x00000000034E0000-0x00000000038D2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-30-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/3028-60-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/3028-7-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/3028-65-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/3028-50-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-76-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/3028-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/3040-73-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download