xmrig | b22f05912ee290b6283675f2b94e9defbbb15f889e32108f18053beb97a2201d

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
Size 2.3MB
Sample240727-2cs9qa1gnk
SHA256 b22f05912ee290b6283675f2b94e9defbbb15f889e32108f18053beb97a2201d
MD5 014b97e09d26c7be9be9988d89aba96c
SHA1 7460dd6a8950b07a7ea16b2962cc6bbed3441aaa
SHA512 61b91097ede7bd7e9f6620711c28cb2dc4283e749ab34b3dd3c360c8bdddac48127e2e5a61b17c5adabac83d185406eae74c4131715455dfa7e82466b9899bb5
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWac:NABp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/1912-33-0x00007FF6B0720000-0x00007FF6B0B12000-memory.dmp	xmrig
behavioral2/memory/2364-56-0x00007FF66E370000-0x00007FF66E762000-memory.dmp	xmrig
behavioral2/memory/4284-66-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp	xmrig
behavioral2/memory/5016-96-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp	xmrig
behavioral2/memory/5024-727-0x00007FF601BD0000-0x00007FF601FC2000-memory.dmp	xmrig
behavioral2/memory/1452-745-0x00007FF647450000-0x00007FF647842000-memory.dmp	xmrig
behavioral2/memory/1592-742-0x00007FF7C6C10000-0x00007FF7C7002000-memory.dmp	xmrig
behavioral2/memory/4952-736-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp	xmrig
behavioral2/memory/2268-735-0x00007FF68C080000-0x00007FF68C472000-memory.dmp	xmrig
behavioral2/memory/2188-757-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp	xmrig
behavioral2/memory/368-758-0x00007FF7FE080000-0x00007FF7FE472000-memory.dmp	xmrig
behavioral2/memory/3732-755-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp	xmrig
behavioral2/memory/3532-749-0x00007FF76C290000-0x00007FF76C682000-memory.dmp	xmrig
behavioral2/memory/2656-728-0x00007FF70D300000-0x00007FF70D6F2000-memory.dmp	xmrig
behavioral2/memory/2192-712-0x00007FF678930000-0x00007FF678D22000-memory.dmp	xmrig
behavioral2/memory/2644-710-0x00007FF734780000-0x00007FF734B72000-memory.dmp	xmrig
behavioral2/memory/3968-73-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp	xmrig
behavioral2/memory/4984-67-0x00007FF76F270000-0x00007FF76F662000-memory.dmp	xmrig
behavioral2/memory/3560-63-0x00007FF751040000-0x00007FF751432000-memory.dmp	xmrig
behavioral2/memory/3068-60-0x00007FF60E760000-0x00007FF60EB52000-memory.dmp	xmrig
behavioral2/memory/984-48-0x00007FF621220000-0x00007FF621612000-memory.dmp	xmrig
behavioral2/memory/3968-2241-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp	xmrig
behavioral2/memory/844-2253-0x00007FF69B510000-0x00007FF69B902000-memory.dmp	xmrig
behavioral2/memory/348-2254-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp	xmrig
behavioral2/memory/4056-2255-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp	xmrig
behavioral2/memory/5016-2256-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp	xmrig
behavioral2/memory/2192-2258-0x00007FF678930000-0x00007FF678D22000-memory.dmp	xmrig
behavioral2/memory/1912-2262-0x00007FF6B0720000-0x00007FF6B0B12000-memory.dmp	xmrig
behavioral2/memory/3560-2261-0x00007FF751040000-0x00007FF751432000-memory.dmp	xmrig
behavioral2/memory/984-2266-0x00007FF621220000-0x00007FF621612000-memory.dmp	xmrig
behavioral2/memory/2364-2265-0x00007FF66E370000-0x00007FF66E762000-memory.dmp	xmrig
behavioral2/memory/3068-2268-0x00007FF60E760000-0x00007FF60EB52000-memory.dmp	xmrig
behavioral2/memory/4284-2271-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp	xmrig
behavioral2/memory/4984-2275-0x00007FF76F270000-0x00007FF76F662000-memory.dmp	xmrig
behavioral2/memory/4056-2272-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp	xmrig
behavioral2/memory/844-2276-0x00007FF69B510000-0x00007FF69B902000-memory.dmp	xmrig
behavioral2/memory/3968-2280-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp	xmrig
behavioral2/memory/348-2278-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp	xmrig
behavioral2/memory/3672-2284-0x00007FF651F40000-0x00007FF652332000-memory.dmp	xmrig
behavioral2/memory/5016-2282-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp	xmrig
behavioral2/memory/2656-2320-0x00007FF70D300000-0x00007FF70D6F2000-memory.dmp	xmrig
behavioral2/memory/5024-2321-0x00007FF601BD0000-0x00007FF601FC2000-memory.dmp	xmrig
behavioral2/memory/1592-2313-0x00007FF7C6C10000-0x00007FF7C7002000-memory.dmp	xmrig
behavioral2/memory/4952-2317-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp	xmrig
behavioral2/memory/2268-2316-0x00007FF68C080000-0x00007FF68C472000-memory.dmp	xmrig
behavioral2/memory/1452-2312-0x00007FF647450000-0x00007FF647842000-memory.dmp	xmrig
behavioral2/memory/3732-2308-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp	xmrig
behavioral2/memory/368-2306-0x00007FF7FE080000-0x00007FF7FE472000-memory.dmp	xmrig
behavioral2/memory/3532-2310-0x00007FF76C290000-0x00007FF76C682000-memory.dmp	xmrig
behavioral2/memory/2188-2303-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	452	powershell.exe
12	452	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
452	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2192	tPJYoyi.exe
1912	QhkOCxs.exe
3560	nPafUPe.exe
984	suBmtWs.exe
2364	BwvzJRI.exe
4284	SbRXzNA.exe
3068	HaarroR.exe
4984	byHPNQb.exe
3968	FXiVwpo.exe
348	GbhYzjS.exe
844	wBUtXVi.exe
4056	MrRDQGI.exe
5016	GmFOyNi.exe
3672	NwGeluc.exe
5024	uvSkdKa.exe
2656	FWlUKqQ.exe
2268	BKATmdZ.exe
4952	xggIOEH.exe
1592	AZQCvPo.exe
1452	slxdFhT.exe
3532	VAQxTwL.exe
3732	SyUpoiI.exe
2188	drfDWmn.exe
368	gLfjFmc.exe
1564	QXOlsdp.exe
4288	CJPesOD.exe
2948	QdVtyLv.exe
3656	iBCaDrz.exe
4312	amfewAa.exe
1068	EPPzPko.exe
5008	uFYRlOb.exe
624	ZdwJaCU.exe
1540	CBbUkLI.exe
4344	PkxWiGn.exe
4496	DjQZSpa.exe
3048	AyfJUEw.exe
2804	UMucntZ.exe
2480	mkLxpqc.exe
4136	eHwTnfK.exe
1220	TDgrbiT.exe
2616	GYlORGZ.exe
3424	jjMKytS.exe
4028	cStXLkT.exe
2932	GmxhKcz.exe
5068	ssyvgyt.exe
3200	ZBFsDZW.exe
3500	TwWVtsT.exe
748	BhxZCGc.exe
3568	djcuDgM.exe
1232	RSGuzcF.exe
4764	VtQggtM.exe
2088	fgtYWbF.exe
2260	oMUaWII.exe
4112	JdZrehV.exe
1716	PgPWnWu.exe
3800	QDnhQzU.exe
2472	LahXpqh.exe
5132	trVSEDO.exe
5160	PIeVTRL.exe
5192	XKBUBsZ.exe
5220	IisWBjN.exe
5244	HgEXijC.exe
5276	qsSlZmJ.exe
5304	ZfNskqA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2644-0-0x00007FF734780000-0x00007FF734B72000-memory.dmp	upx
behavioral2/memory/2192-9-0x00007FF678930000-0x00007FF678D22000-memory.dmp	upx
behavioral2/files/0x000700000002344f-11.dat	upx
behavioral2/files/0x0007000000023450-16.dat	upx
behavioral2/files/0x000800000002344b-8.dat	upx
behavioral2/files/0x0007000000023451-24.dat	upx
behavioral2/files/0x0007000000023454-39.dat	upx
behavioral2/memory/1912-33-0x00007FF6B0720000-0x00007FF6B0B12000-memory.dmp	upx
behavioral2/memory/2364-56-0x00007FF66E370000-0x00007FF66E762000-memory.dmp	upx
behavioral2/files/0x0007000000023458-61.dat	upx
behavioral2/memory/4284-66-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp	upx
behavioral2/memory/348-77-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp	upx
behavioral2/memory/844-83-0x00007FF69B510000-0x00007FF69B902000-memory.dmp	upx
behavioral2/files/0x000800000002344c-92.dat	upx
behavioral2/files/0x000700000002345a-97.dat	upx
behavioral2/memory/3672-99-0x00007FF651F40000-0x00007FF652332000-memory.dmp	upx
behavioral2/memory/5016-96-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp	upx
behavioral2/files/0x000700000002345d-112.dat	upx
behavioral2/files/0x0007000000023465-155.dat	upx
behavioral2/files/0x0007000000023468-171.dat	upx
behavioral2/memory/5024-727-0x00007FF601BD0000-0x00007FF601FC2000-memory.dmp	upx
behavioral2/memory/1452-745-0x00007FF647450000-0x00007FF647842000-memory.dmp	upx
behavioral2/memory/1592-742-0x00007FF7C6C10000-0x00007FF7C7002000-memory.dmp	upx
behavioral2/memory/4952-736-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp	upx
behavioral2/memory/2268-735-0x00007FF68C080000-0x00007FF68C472000-memory.dmp	upx
behavioral2/memory/2188-757-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp	upx
behavioral2/memory/368-758-0x00007FF7FE080000-0x00007FF7FE472000-memory.dmp	upx
behavioral2/memory/3732-755-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp	upx
behavioral2/memory/3532-749-0x00007FF76C290000-0x00007FF76C682000-memory.dmp	upx
behavioral2/memory/2656-728-0x00007FF70D300000-0x00007FF70D6F2000-memory.dmp	upx
behavioral2/memory/2192-712-0x00007FF678930000-0x00007FF678D22000-memory.dmp	upx
behavioral2/memory/2644-710-0x00007FF734780000-0x00007FF734B72000-memory.dmp	upx
behavioral2/files/0x000700000002346d-190.dat	upx
behavioral2/files/0x000700000002346b-186.dat	upx
behavioral2/files/0x000700000002346c-185.dat	upx
behavioral2/files/0x000700000002346a-181.dat	upx
behavioral2/files/0x0007000000023469-176.dat	upx
behavioral2/files/0x0007000000023467-166.dat	upx
behavioral2/files/0x0007000000023466-161.dat	upx
behavioral2/files/0x0007000000023464-151.dat	upx
behavioral2/files/0x0007000000023463-146.dat	upx
behavioral2/files/0x0007000000023462-141.dat	upx
behavioral2/files/0x0007000000023461-136.dat	upx
behavioral2/files/0x0007000000023460-131.dat	upx
behavioral2/files/0x000700000002345f-126.dat	upx
behavioral2/files/0x000700000002345e-121.dat	upx
behavioral2/files/0x000700000002345c-110.dat	upx
behavioral2/files/0x000700000002345b-106.dat	upx
behavioral2/files/0x0008000000023456-94.dat	upx
behavioral2/memory/4056-90-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp	upx
behavioral2/files/0x0007000000023459-84.dat	upx
behavioral2/files/0x0008000000023457-78.dat	upx
behavioral2/memory/3968-73-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp	upx
behavioral2/memory/4984-67-0x00007FF76F270000-0x00007FF76F662000-memory.dmp	upx
behavioral2/memory/3560-63-0x00007FF751040000-0x00007FF751432000-memory.dmp	upx
behavioral2/files/0x0007000000023455-62.dat	upx
behavioral2/memory/3068-60-0x00007FF60E760000-0x00007FF60EB52000-memory.dmp	upx
behavioral2/memory/984-48-0x00007FF621220000-0x00007FF621612000-memory.dmp	upx
behavioral2/files/0x0007000000023453-41.dat	upx
behavioral2/files/0x0007000000023452-27.dat	upx
behavioral2/memory/3968-2241-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp	upx
behavioral2/memory/844-2253-0x00007FF69B510000-0x00007FF69B902000-memory.dmp	upx
behavioral2/memory/348-2254-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp	upx
behavioral2/memory/4056-2255-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VHXEfvA.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\GhaOpiI.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\WNSgqEF.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\UWvicQJ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ZBdgzOg.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\KsnlPhj.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\QCqcgtc.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\VrIuRly.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\UBeJYqS.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ObNzRnZ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\XYWshsX.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\JzBrxkw.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\cDiXlaj.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\KVylufe.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ajseNBi.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\QUanHja.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\PhIAHEb.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\KBtAgql.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\WpSryhG.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\UTnATNy.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\beyPzjT.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\GgtjroT.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\cddyqXL.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\dsLQCKy.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\uhFSpKe.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\XLTAQLi.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\oTUKolR.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\dtSLcgF.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\TzFxknm.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\pfLJpCV.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\aPmKNbM.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\tXLCFst.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\LsJTPXP.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\brkpkyy.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ItiGLml.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\HCCEXvM.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\vLVDADh.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\QVCOWSl.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\azwglGl.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\JGbKmjl.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\vgQYPQJ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\YGScRJe.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\PywOmsU.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\kqkpMLL.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\VKldjXB.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\fiOxedu.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\eAgqswr.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\OpYzgGq.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ltLrObV.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\hDetThJ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\IwXJpQK.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\TifbGGt.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\qNrFhTG.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\iRJYqJa.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\jTeZEiW.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\jyosYKn.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\oSupSJO.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\yyKxyNA.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\XxfxLxq.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\PxNzDrm.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ipMBhfP.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\HeCrdPm.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\UIbWhui.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\xXQQDrJ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
452	powershell.exe
452	powershell.exe
452	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	452	powershell.exe
Token: SeLockMemoryPrivilege	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 452	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	85
PID 2644 wrote to memory of 452	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	85
PID 2644 wrote to memory of 2192	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	86
PID 2644 wrote to memory of 2192	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	86
PID 2644 wrote to memory of 1912	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	87
PID 2644 wrote to memory of 1912	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	87
PID 2644 wrote to memory of 3560	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	88
PID 2644 wrote to memory of 3560	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	88
PID 2644 wrote to memory of 984	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	89
PID 2644 wrote to memory of 984	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	89
PID 2644 wrote to memory of 2364	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	90
PID 2644 wrote to memory of 2364	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	90
PID 2644 wrote to memory of 4284	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	91
PID 2644 wrote to memory of 4284	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	91
PID 2644 wrote to memory of 3068	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	92
PID 2644 wrote to memory of 3068	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	92
PID 2644 wrote to memory of 4984	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	93
PID 2644 wrote to memory of 4984	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	93
PID 2644 wrote to memory of 3968	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	94
PID 2644 wrote to memory of 3968	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	94
PID 2644 wrote to memory of 348	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	95
PID 2644 wrote to memory of 348	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	95
PID 2644 wrote to memory of 844	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	96
PID 2644 wrote to memory of 844	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	96
PID 2644 wrote to memory of 4056	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	97
PID 2644 wrote to memory of 4056	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	97
PID 2644 wrote to memory of 5016	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	98
PID 2644 wrote to memory of 5016	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	98
PID 2644 wrote to memory of 3672	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	99
PID 2644 wrote to memory of 3672	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	99
PID 2644 wrote to memory of 5024	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	100
PID 2644 wrote to memory of 5024	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	100
PID 2644 wrote to memory of 2656	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	101
PID 2644 wrote to memory of 2656	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	101
PID 2644 wrote to memory of 2268	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	102
PID 2644 wrote to memory of 2268	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	102
PID 2644 wrote to memory of 4952	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	103
PID 2644 wrote to memory of 4952	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	103
PID 2644 wrote to memory of 1592	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	104
PID 2644 wrote to memory of 1592	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	104
PID 2644 wrote to memory of 1452	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	105
PID 2644 wrote to memory of 1452	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	105
PID 2644 wrote to memory of 3532	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	106
PID 2644 wrote to memory of 3532	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	106
PID 2644 wrote to memory of 3732	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	107
PID 2644 wrote to memory of 3732	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	107
PID 2644 wrote to memory of 2188	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	108
PID 2644 wrote to memory of 2188	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	108
PID 2644 wrote to memory of 368	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	109
PID 2644 wrote to memory of 368	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	109
PID 2644 wrote to memory of 1564	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	110
PID 2644 wrote to memory of 1564	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	110
PID 2644 wrote to memory of 4288	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	111
PID 2644 wrote to memory of 4288	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	111
PID 2644 wrote to memory of 2948	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	112
PID 2644 wrote to memory of 2948	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	112
PID 2644 wrote to memory of 3656	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	113
PID 2644 wrote to memory of 3656	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	113
PID 2644 wrote to memory of 4312	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	114
PID 2644 wrote to memory of 4312	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	114
PID 2644 wrote to memory of 1068	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	115
PID 2644 wrote to memory of 1068	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	115
PID 2644 wrote to memory of 5008	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	116
PID 2644 wrote to memory of 5008	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "452" "2984" "2916" "2988" "0" "0" "2992" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4908
- C:\Windows\System\tPJYoyi.exe
  C:\Windows\System\tPJYoyi.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\QhkOCxs.exe
  C:\Windows\System\QhkOCxs.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\nPafUPe.exe
  C:\Windows\System\nPafUPe.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\suBmtWs.exe
  C:\Windows\System\suBmtWs.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\BwvzJRI.exe
  C:\Windows\System\BwvzJRI.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\SbRXzNA.exe
  C:\Windows\System\SbRXzNA.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\HaarroR.exe
  C:\Windows\System\HaarroR.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\byHPNQb.exe
  C:\Windows\System\byHPNQb.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\FXiVwpo.exe
  C:\Windows\System\FXiVwpo.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\GbhYzjS.exe
  C:\Windows\System\GbhYzjS.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\wBUtXVi.exe
  C:\Windows\System\wBUtXVi.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\MrRDQGI.exe
  C:\Windows\System\MrRDQGI.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\GmFOyNi.exe
  C:\Windows\System\GmFOyNi.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\NwGeluc.exe
  C:\Windows\System\NwGeluc.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\uvSkdKa.exe
  C:\Windows\System\uvSkdKa.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\FWlUKqQ.exe
  C:\Windows\System\FWlUKqQ.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\BKATmdZ.exe
  C:\Windows\System\BKATmdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\xggIOEH.exe
  C:\Windows\System\xggIOEH.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\AZQCvPo.exe
  C:\Windows\System\AZQCvPo.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\slxdFhT.exe
  C:\Windows\System\slxdFhT.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\VAQxTwL.exe
  C:\Windows\System\VAQxTwL.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\SyUpoiI.exe
  C:\Windows\System\SyUpoiI.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\drfDWmn.exe
  C:\Windows\System\drfDWmn.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\gLfjFmc.exe
  C:\Windows\System\gLfjFmc.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\QXOlsdp.exe
  C:\Windows\System\QXOlsdp.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\CJPesOD.exe
  C:\Windows\System\CJPesOD.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\QdVtyLv.exe
  C:\Windows\System\QdVtyLv.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\iBCaDrz.exe
  C:\Windows\System\iBCaDrz.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\amfewAa.exe
  C:\Windows\System\amfewAa.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\EPPzPko.exe
  C:\Windows\System\EPPzPko.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\uFYRlOb.exe
  C:\Windows\System\uFYRlOb.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\ZdwJaCU.exe
  C:\Windows\System\ZdwJaCU.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\CBbUkLI.exe
  C:\Windows\System\CBbUkLI.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\PkxWiGn.exe
  C:\Windows\System\PkxWiGn.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\DjQZSpa.exe
  C:\Windows\System\DjQZSpa.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\AyfJUEw.exe
  C:\Windows\System\AyfJUEw.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\UMucntZ.exe
  C:\Windows\System\UMucntZ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\mkLxpqc.exe
  C:\Windows\System\mkLxpqc.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\eHwTnfK.exe
  C:\Windows\System\eHwTnfK.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\TDgrbiT.exe
  C:\Windows\System\TDgrbiT.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\GYlORGZ.exe
  C:\Windows\System\GYlORGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\jjMKytS.exe
  C:\Windows\System\jjMKytS.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\cStXLkT.exe
  C:\Windows\System\cStXLkT.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\GmxhKcz.exe
  C:\Windows\System\GmxhKcz.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\ssyvgyt.exe
  C:\Windows\System\ssyvgyt.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\ZBFsDZW.exe
  C:\Windows\System\ZBFsDZW.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\TwWVtsT.exe
  C:\Windows\System\TwWVtsT.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\BhxZCGc.exe
  C:\Windows\System\BhxZCGc.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\djcuDgM.exe
  C:\Windows\System\djcuDgM.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\RSGuzcF.exe
  C:\Windows\System\RSGuzcF.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\VtQggtM.exe
  C:\Windows\System\VtQggtM.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\fgtYWbF.exe
  C:\Windows\System\fgtYWbF.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\oMUaWII.exe
  C:\Windows\System\oMUaWII.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\JdZrehV.exe
  C:\Windows\System\JdZrehV.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\PgPWnWu.exe
  C:\Windows\System\PgPWnWu.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\QDnhQzU.exe
  C:\Windows\System\QDnhQzU.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\LahXpqh.exe
  C:\Windows\System\LahXpqh.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\trVSEDO.exe
  C:\Windows\System\trVSEDO.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\PIeVTRL.exe
  C:\Windows\System\PIeVTRL.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\XKBUBsZ.exe
  C:\Windows\System\XKBUBsZ.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System\IisWBjN.exe
  C:\Windows\System\IisWBjN.exe
  2⤵
  - Executes dropped EXE
  PID:5220
- C:\Windows\System\HgEXijC.exe
  C:\Windows\System\HgEXijC.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\qsSlZmJ.exe
  C:\Windows\System\qsSlZmJ.exe
  2⤵
  - Executes dropped EXE
  PID:5276
- C:\Windows\System\ZfNskqA.exe
  C:\Windows\System\ZfNskqA.exe
  2⤵
  - Executes dropped EXE
  PID:5304
- C:\Windows\System\PJWAaSt.exe
  C:\Windows\System\PJWAaSt.exe
  2⤵
  PID:5328
- C:\Windows\System\wNwriFW.exe
  C:\Windows\System\wNwriFW.exe
  2⤵
  PID:5356
- C:\Windows\System\pUtwwyi.exe
  C:\Windows\System\pUtwwyi.exe
  2⤵
  PID:5388
- C:\Windows\System\TYFolsr.exe
  C:\Windows\System\TYFolsr.exe
  2⤵
  PID:5416
- C:\Windows\System\IdnKlKm.exe
  C:\Windows\System\IdnKlKm.exe
  2⤵
  PID:5440
- C:\Windows\System\VSmzQIW.exe
  C:\Windows\System\VSmzQIW.exe
  2⤵
  PID:5468
- C:\Windows\System\bHJPsHI.exe
  C:\Windows\System\bHJPsHI.exe
  2⤵
  PID:5496
- C:\Windows\System\mBoSvVq.exe
  C:\Windows\System\mBoSvVq.exe
  2⤵
  PID:5524
- C:\Windows\System\wKxiiah.exe
  C:\Windows\System\wKxiiah.exe
  2⤵
  PID:5552
- C:\Windows\System\mtnRIOc.exe
  C:\Windows\System\mtnRIOc.exe
  2⤵
  PID:5580
- C:\Windows\System\MjIoaEB.exe
  C:\Windows\System\MjIoaEB.exe
  2⤵
  PID:5612
- C:\Windows\System\IFHveAg.exe
  C:\Windows\System\IFHveAg.exe
  2⤵
  PID:5640
- C:\Windows\System\vHdqQpE.exe
  C:\Windows\System\vHdqQpE.exe
  2⤵
  PID:5668
- C:\Windows\System\hgsAgTz.exe
  C:\Windows\System\hgsAgTz.exe
  2⤵
  PID:5696
- C:\Windows\System\egcIwdt.exe
  C:\Windows\System\egcIwdt.exe
  2⤵
  PID:5720
- C:\Windows\System\UCgDJat.exe
  C:\Windows\System\UCgDJat.exe
  2⤵
  PID:5740
- C:\Windows\System\TymsXfL.exe
  C:\Windows\System\TymsXfL.exe
  2⤵
  PID:5776
- C:\Windows\System\hXcbcMe.exe
  C:\Windows\System\hXcbcMe.exe
  2⤵
  PID:5804
- C:\Windows\System\uYokOon.exe
  C:\Windows\System\uYokOon.exe
  2⤵
  PID:5836
- C:\Windows\System\dwMiupc.exe
  C:\Windows\System\dwMiupc.exe
  2⤵
  PID:5860
- C:\Windows\System\CzPBbrT.exe
  C:\Windows\System\CzPBbrT.exe
  2⤵
  PID:5892
- C:\Windows\System\uofnkIl.exe
  C:\Windows\System\uofnkIl.exe
  2⤵
  PID:5920
- C:\Windows\System\uzTiXJz.exe
  C:\Windows\System\uzTiXJz.exe
  2⤵
  PID:5944
- C:\Windows\System\GwLdgHd.exe
  C:\Windows\System\GwLdgHd.exe
  2⤵
  PID:5976
- C:\Windows\System\pGrReDO.exe
  C:\Windows\System\pGrReDO.exe
  2⤵
  PID:6000
- C:\Windows\System\CHtufOd.exe
  C:\Windows\System\CHtufOd.exe
  2⤵
  PID:6028
- C:\Windows\System\sfWDJDB.exe
  C:\Windows\System\sfWDJDB.exe
  2⤵
  PID:6056
- C:\Windows\System\EqSJGpQ.exe
  C:\Windows\System\EqSJGpQ.exe
  2⤵
  PID:6088
- C:\Windows\System\OOOQszK.exe
  C:\Windows\System\OOOQszK.exe
  2⤵
  PID:6112
- C:\Windows\System\RuEHacW.exe
  C:\Windows\System\RuEHacW.exe
  2⤵
  PID:6140
- C:\Windows\System\iAnCbYd.exe
  C:\Windows\System\iAnCbYd.exe
  2⤵
  PID:2776
- C:\Windows\System\eqeguwu.exe
  C:\Windows\System\eqeguwu.exe
  2⤵
  PID:2236
- C:\Windows\System\zVckzqo.exe
  C:\Windows\System\zVckzqo.exe
  2⤵
  PID:4212
- C:\Windows\System\sTlxXHq.exe
  C:\Windows\System\sTlxXHq.exe
  2⤵
  PID:3964
- C:\Windows\System\xswBnpn.exe
  C:\Windows\System\xswBnpn.exe
  2⤵
  PID:5148
- C:\Windows\System\dIfDwTB.exe
  C:\Windows\System\dIfDwTB.exe
  2⤵
  PID:5208
- C:\Windows\System\hzhImcr.exe
  C:\Windows\System\hzhImcr.exe
  2⤵
  PID:5268
- C:\Windows\System\QaRPdBG.exe
  C:\Windows\System\QaRPdBG.exe
  2⤵
  PID:5324
- C:\Windows\System\KkEOGMI.exe
  C:\Windows\System\KkEOGMI.exe
  2⤵
  PID:5400
- C:\Windows\System\pqtBJIk.exe
  C:\Windows\System\pqtBJIk.exe
  2⤵
  PID:5464
- C:\Windows\System\jMayZdY.exe
  C:\Windows\System\jMayZdY.exe
  2⤵
  PID:5520
- C:\Windows\System\IaAXquE.exe
  C:\Windows\System\IaAXquE.exe
  2⤵
  PID:5596
- C:\Windows\System\Cxnieyi.exe
  C:\Windows\System\Cxnieyi.exe
  2⤵
  PID:5656
- C:\Windows\System\LlIFTpf.exe
  C:\Windows\System\LlIFTpf.exe
  2⤵
  PID:5732
- C:\Windows\System\kcWBUCY.exe
  C:\Windows\System\kcWBUCY.exe
  2⤵
  PID:5796
- C:\Windows\System\OKNFEDH.exe
  C:\Windows\System\OKNFEDH.exe
  2⤵
  PID:5852
- C:\Windows\System\CcYeTvy.exe
  C:\Windows\System\CcYeTvy.exe
  2⤵
  PID:5912
- C:\Windows\System\GfzkhkV.exe
  C:\Windows\System\GfzkhkV.exe
  2⤵
  PID:5988
- C:\Windows\System\DBJAQKj.exe
  C:\Windows\System\DBJAQKj.exe
  2⤵
  PID:6048
- C:\Windows\System\hQaAihu.exe
  C:\Windows\System\hQaAihu.exe
  2⤵
  PID:6108
- C:\Windows\System\MDNUEvd.exe
  C:\Windows\System\MDNUEvd.exe
  2⤵
  PID:936
- C:\Windows\System\TqUmifX.exe
  C:\Windows\System\TqUmifX.exe
  2⤵
  PID:1364
- C:\Windows\System\rGsOtKb.exe
  C:\Windows\System\rGsOtKb.exe
  2⤵
  PID:5180
- C:\Windows\System\MCSHSDa.exe
  C:\Windows\System\MCSHSDa.exe
  2⤵
  PID:5296
- C:\Windows\System\FZgEibo.exe
  C:\Windows\System\FZgEibo.exe
  2⤵
  PID:5456
- C:\Windows\System\RsElcJi.exe
  C:\Windows\System\RsElcJi.exe
  2⤵
  PID:5628
- C:\Windows\System\WqISkNM.exe
  C:\Windows\System\WqISkNM.exe
  2⤵
  PID:5760
- C:\Windows\System\DnmWWCH.exe
  C:\Windows\System\DnmWWCH.exe
  2⤵
  PID:5904
- C:\Windows\System\xAhDcvN.exe
  C:\Windows\System\xAhDcvN.exe
  2⤵
  PID:6020
- C:\Windows\System\JsnDBEp.exe
  C:\Windows\System\JsnDBEp.exe
  2⤵
  PID:6172
- C:\Windows\System\oNUmOrS.exe
  C:\Windows\System\oNUmOrS.exe
  2⤵
  PID:6200
- C:\Windows\System\KNOzPFL.exe
  C:\Windows\System\KNOzPFL.exe
  2⤵
  PID:6228
- C:\Windows\System\dqdbvcT.exe
  C:\Windows\System\dqdbvcT.exe
  2⤵
  PID:6252
- C:\Windows\System\hTxNDvN.exe
  C:\Windows\System\hTxNDvN.exe
  2⤵
  PID:6280
- C:\Windows\System\LvCNFEJ.exe
  C:\Windows\System\LvCNFEJ.exe
  2⤵
  PID:6308
- C:\Windows\System\JMFRljr.exe
  C:\Windows\System\JMFRljr.exe
  2⤵
  PID:6336
- C:\Windows\System\ietCaKg.exe
  C:\Windows\System\ietCaKg.exe
  2⤵
  PID:6368
- C:\Windows\System\PYpAJLw.exe
  C:\Windows\System\PYpAJLw.exe
  2⤵
  PID:6392
- C:\Windows\System\PywOmsU.exe
  C:\Windows\System\PywOmsU.exe
  2⤵
  PID:6424
- C:\Windows\System\LfrPtfV.exe
  C:\Windows\System\LfrPtfV.exe
  2⤵
  PID:6456
- C:\Windows\System\caGVBqc.exe
  C:\Windows\System\caGVBqc.exe
  2⤵
  PID:6480
- C:\Windows\System\QyKqyoE.exe
  C:\Windows\System\QyKqyoE.exe
  2⤵
  PID:6508
- C:\Windows\System\WbINkPn.exe
  C:\Windows\System\WbINkPn.exe
  2⤵
  PID:6536
- C:\Windows\System\SbFHbWu.exe
  C:\Windows\System\SbFHbWu.exe
  2⤵
  PID:6560
- C:\Windows\System\NYdwotg.exe
  C:\Windows\System\NYdwotg.exe
  2⤵
  PID:6588
- C:\Windows\System\ppcyRKi.exe
  C:\Windows\System\ppcyRKi.exe
  2⤵
  PID:6616
- C:\Windows\System\QiaSoOJ.exe
  C:\Windows\System\QiaSoOJ.exe
  2⤵
  PID:6648
- C:\Windows\System\UGGwTXu.exe
  C:\Windows\System\UGGwTXu.exe
  2⤵
  PID:6672
- C:\Windows\System\HaKamUY.exe
  C:\Windows\System\HaKamUY.exe
  2⤵
  PID:6704
- C:\Windows\System\neluWLa.exe
  C:\Windows\System\neluWLa.exe
  2⤵
  PID:6728
- C:\Windows\System\ozvnhwH.exe
  C:\Windows\System\ozvnhwH.exe
  2⤵
  PID:6756
- C:\Windows\System\JRgXEGB.exe
  C:\Windows\System\JRgXEGB.exe
  2⤵
  PID:6784
- C:\Windows\System\xCFmYyZ.exe
  C:\Windows\System\xCFmYyZ.exe
  2⤵
  PID:6812
- C:\Windows\System\EcelbIS.exe
  C:\Windows\System\EcelbIS.exe
  2⤵
  PID:6844
- C:\Windows\System\rjKGhMB.exe
  C:\Windows\System\rjKGhMB.exe
  2⤵
  PID:6872
- C:\Windows\System\EfAdAKs.exe
  C:\Windows\System\EfAdAKs.exe
  2⤵
  PID:6900
- C:\Windows\System\RlmDwwc.exe
  C:\Windows\System\RlmDwwc.exe
  2⤵
  PID:6924
- C:\Windows\System\rJwTdFo.exe
  C:\Windows\System\rJwTdFo.exe
  2⤵
  PID:6956
- C:\Windows\System\pSPfAnY.exe
  C:\Windows\System\pSPfAnY.exe
  2⤵
  PID:6980
- C:\Windows\System\egIPhTp.exe
  C:\Windows\System\egIPhTp.exe
  2⤵
  PID:7012
- C:\Windows\System\tQnFVwq.exe
  C:\Windows\System\tQnFVwq.exe
  2⤵
  PID:7036
- C:\Windows\System\zdoCkTq.exe
  C:\Windows\System\zdoCkTq.exe
  2⤵
  PID:7064
- C:\Windows\System\OAGaaTR.exe
  C:\Windows\System\OAGaaTR.exe
  2⤵
  PID:7096
- C:\Windows\System\CArWtwC.exe
  C:\Windows\System\CArWtwC.exe
  2⤵
  PID:7124
- C:\Windows\System\gJWpEOg.exe
  C:\Windows\System\gJWpEOg.exe
  2⤵
  PID:7148
- C:\Windows\System\UIdJkPs.exe
  C:\Windows\System\UIdJkPs.exe
  2⤵
  PID:6132
- C:\Windows\System\CTgXxYZ.exe
  C:\Windows\System\CTgXxYZ.exe
  2⤵
  PID:4308
- C:\Windows\System\lHDdHGd.exe
  C:\Windows\System\lHDdHGd.exe
  2⤵
  PID:2272
- C:\Windows\System\CiRBCOL.exe
  C:\Windows\System\CiRBCOL.exe
  2⤵
  PID:5572
- C:\Windows\System\pXqUYhC.exe
  C:\Windows\System\pXqUYhC.exe
  2⤵
  PID:5968
- C:\Windows\System\GKQkmhZ.exe
  C:\Windows\System\GKQkmhZ.exe
  2⤵
  PID:6184
- C:\Windows\System\FuBwyfW.exe
  C:\Windows\System\FuBwyfW.exe
  2⤵
  PID:3596
- C:\Windows\System\cznEJgy.exe
  C:\Windows\System\cznEJgy.exe
  2⤵
  PID:6276
- C:\Windows\System\QjjriUg.exe
  C:\Windows\System\QjjriUg.exe
  2⤵
  PID:6352
- C:\Windows\System\iROtpUN.exe
  C:\Windows\System\iROtpUN.exe
  2⤵
  PID:4236
- C:\Windows\System\aamtwmR.exe
  C:\Windows\System\aamtwmR.exe
  2⤵
  PID:6464
- C:\Windows\System\JkTODNF.exe
  C:\Windows\System\JkTODNF.exe
  2⤵
  PID:6520
- C:\Windows\System\atzTrof.exe
  C:\Windows\System\atzTrof.exe
  2⤵
  PID:6580
- C:\Windows\System\tDwXlwf.exe
  C:\Windows\System\tDwXlwf.exe
  2⤵
  PID:6640
- C:\Windows\System\KNYhRRl.exe
  C:\Windows\System\KNYhRRl.exe
  2⤵
  PID:6696
- C:\Windows\System\yhFdSSj.exe
  C:\Windows\System\yhFdSSj.exe
  2⤵
  PID:6748
- C:\Windows\System\QEeHpEw.exe
  C:\Windows\System\QEeHpEw.exe
  2⤵
  PID:6808
- C:\Windows\System\CRSRqPz.exe
  C:\Windows\System\CRSRqPz.exe
  2⤵
  PID:6884
- C:\Windows\System\RGDOzPD.exe
  C:\Windows\System\RGDOzPD.exe
  2⤵
  PID:6920
- C:\Windows\System\WdzsCRM.exe
  C:\Windows\System\WdzsCRM.exe
  2⤵
  PID:6996
- C:\Windows\System\lBtzXtR.exe
  C:\Windows\System\lBtzXtR.exe
  2⤵
  PID:7052
- C:\Windows\System\uqCMCRl.exe
  C:\Windows\System\uqCMCRl.exe
  2⤵
  PID:7136
- C:\Windows\System\lEvhOkl.exe
  C:\Windows\System\lEvhOkl.exe
  2⤵
  PID:2372
- C:\Windows\System\ZYlQxbv.exe
  C:\Windows\System\ZYlQxbv.exe
  2⤵
  PID:5240
- C:\Windows\System\bkKmecw.exe
  C:\Windows\System\bkKmecw.exe
  2⤵
  PID:5824
- C:\Windows\System\qjJbMfl.exe
  C:\Windows\System\qjJbMfl.exe
  2⤵
  PID:6192
- C:\Windows\System\NWjPvaD.exe
  C:\Windows\System\NWjPvaD.exe
  2⤵
  PID:6272
- C:\Windows\System\MDYCQXi.exe
  C:\Windows\System\MDYCQXi.exe
  2⤵
  PID:6436
- C:\Windows\System\GoPomQW.exe
  C:\Windows\System\GoPomQW.exe
  2⤵
  PID:6556
- C:\Windows\System\kMtWlMW.exe
  C:\Windows\System\kMtWlMW.exe
  2⤵
  PID:6856
- C:\Windows\System\zPnxknJ.exe
  C:\Windows\System\zPnxknJ.exe
  2⤵
  PID:6912
- C:\Windows\System\KlTAwCz.exe
  C:\Windows\System\KlTAwCz.exe
  2⤵
  PID:6976
- C:\Windows\System\EWjdMVG.exe
  C:\Windows\System\EWjdMVG.exe
  2⤵
  PID:528
- C:\Windows\System\VApSQDj.exe
  C:\Windows\System\VApSQDj.exe
  2⤵
  PID:2708
- C:\Windows\System\yDfPJjP.exe
  C:\Windows\System\yDfPJjP.exe
  2⤵
  PID:1656
- C:\Windows\System\UzeNSpy.exe
  C:\Windows\System\UzeNSpy.exe
  2⤵
  PID:2064
- C:\Windows\System\qubWFoe.exe
  C:\Windows\System\qubWFoe.exe
  2⤵
  PID:1124
- C:\Windows\System\KrqmKUF.exe
  C:\Windows\System\KrqmKUF.exe
  2⤵
  PID:6632
- C:\Windows\System\XyHNeCJ.exe
  C:\Windows\System\XyHNeCJ.exe
  2⤵
  PID:396
- C:\Windows\System\sqLGese.exe
  C:\Windows\System\sqLGese.exe
  2⤵
  PID:2764
- C:\Windows\System\fcVHcFK.exe
  C:\Windows\System\fcVHcFK.exe
  2⤵
  PID:4256
- C:\Windows\System\SNZzKoq.exe
  C:\Windows\System\SNZzKoq.exe
  2⤵
  PID:1608
- C:\Windows\System\ikJJwlO.exe
  C:\Windows\System\ikJJwlO.exe
  2⤵
  PID:1180
- C:\Windows\System\BBPwUnh.exe
  C:\Windows\System\BBPwUnh.exe
  2⤵
  PID:4940
- C:\Windows\System\mycwLbJ.exe
  C:\Windows\System\mycwLbJ.exe
  2⤵
  PID:244
- C:\Windows\System\tuAGzpl.exe
  C:\Windows\System\tuAGzpl.exe
  2⤵
  PID:952
- C:\Windows\System\xmHPiyu.exe
  C:\Windows\System\xmHPiyu.exe
  2⤵
  PID:4816
- C:\Windows\System\TavKljR.exe
  C:\Windows\System\TavKljR.exe
  2⤵
  PID:4980
- C:\Windows\System\nxHSalZ.exe
  C:\Windows\System\nxHSalZ.exe
  2⤵
  PID:3440
- C:\Windows\System\CKrFHGQ.exe
  C:\Windows\System\CKrFHGQ.exe
  2⤵
  PID:4576
- C:\Windows\System\hHmsGFH.exe
  C:\Windows\System\hHmsGFH.exe
  2⤵
  PID:1560
- C:\Windows\System\EQUpIqq.exe
  C:\Windows\System\EQUpIqq.exe
  2⤵
  PID:4564
- C:\Windows\System\BqXLszh.exe
  C:\Windows\System\BqXLszh.exe
  2⤵
  PID:848
- C:\Windows\System\ktqrJun.exe
  C:\Windows\System\ktqrJun.exe
  2⤵
  PID:3536
- C:\Windows\System\AIJowPf.exe
  C:\Windows\System\AIJowPf.exe
  2⤵
  PID:3112
- C:\Windows\System\CFtbKuh.exe
  C:\Windows\System\CFtbKuh.exe
  2⤵
  PID:6496
- C:\Windows\System\paymMmA.exe
  C:\Windows\System\paymMmA.exe
  2⤵
  PID:980
- C:\Windows\System\ykKoqAv.exe
  C:\Windows\System\ykKoqAv.exe
  2⤵
  PID:4364
- C:\Windows\System\qtsoEGo.exe
  C:\Windows\System\qtsoEGo.exe
  2⤵
  PID:6864
- C:\Windows\System\ZgpxICP.exe
  C:\Windows\System\ZgpxICP.exe
  2⤵
  PID:2544
- C:\Windows\System\tZquXIN.exe
  C:\Windows\System\tZquXIN.exe
  2⤵
  PID:4720
- C:\Windows\System\mLXlyKy.exe
  C:\Windows\System\mLXlyKy.exe
  2⤵
  PID:7172
- C:\Windows\System\gLOnAjK.exe
  C:\Windows\System\gLOnAjK.exe
  2⤵
  PID:7212
- C:\Windows\System\Erngewc.exe
  C:\Windows\System\Erngewc.exe
  2⤵
  PID:7240
- C:\Windows\System\VhNucQw.exe
  C:\Windows\System\VhNucQw.exe
  2⤵
  PID:7260
- C:\Windows\System\DKfxcbT.exe
  C:\Windows\System\DKfxcbT.exe
  2⤵
  PID:7300
- C:\Windows\System\JlSqkvm.exe
  C:\Windows\System\JlSqkvm.exe
  2⤵
  PID:7336
- C:\Windows\System\QiqivNS.exe
  C:\Windows\System\QiqivNS.exe
  2⤵
  PID:7376
- C:\Windows\System\CDgMQqZ.exe
  C:\Windows\System\CDgMQqZ.exe
  2⤵
  PID:7392
- C:\Windows\System\bRpgVUx.exe
  C:\Windows\System\bRpgVUx.exe
  2⤵
  PID:7428
- C:\Windows\System\IHUrLey.exe
  C:\Windows\System\IHUrLey.exe
  2⤵
  PID:7460
- C:\Windows\System\tExEBRO.exe
  C:\Windows\System\tExEBRO.exe
  2⤵
  PID:7476
- C:\Windows\System\StPOEmv.exe
  C:\Windows\System\StPOEmv.exe
  2⤵
  PID:7500
- C:\Windows\System\XwFDRKm.exe
  C:\Windows\System\XwFDRKm.exe
  2⤵
  PID:7536
- C:\Windows\System\dNsbVTp.exe
  C:\Windows\System\dNsbVTp.exe
  2⤵
  PID:7560
- C:\Windows\System\PnoamWa.exe
  C:\Windows\System\PnoamWa.exe
  2⤵
  PID:7596
- C:\Windows\System\PTcoQwc.exe
  C:\Windows\System\PTcoQwc.exe
  2⤵
  PID:7624
- C:\Windows\System\mPuGtwI.exe
  C:\Windows\System\mPuGtwI.exe
  2⤵
  PID:7644
- C:\Windows\System\QZrfuLA.exe
  C:\Windows\System\QZrfuLA.exe
  2⤵
  PID:7668
- C:\Windows\System\xLmPwQM.exe
  C:\Windows\System\xLmPwQM.exe
  2⤵
  PID:7688
- C:\Windows\System\JFLogKX.exe
  C:\Windows\System\JFLogKX.exe
  2⤵
  PID:7720
- C:\Windows\System\oehEkEN.exe
  C:\Windows\System\oehEkEN.exe
  2⤵
  PID:7748
- C:\Windows\System\VcVRGfG.exe
  C:\Windows\System\VcVRGfG.exe
  2⤵
  PID:7784
- C:\Windows\System\RPKyjKz.exe
  C:\Windows\System\RPKyjKz.exe
  2⤵
  PID:7816
- C:\Windows\System\iSCeEMx.exe
  C:\Windows\System\iSCeEMx.exe
  2⤵
  PID:7860
- C:\Windows\System\ZPZdVyj.exe
  C:\Windows\System\ZPZdVyj.exe
  2⤵
  PID:7880
- C:\Windows\System\wIEWiWF.exe
  C:\Windows\System\wIEWiWF.exe
  2⤵
  PID:7904
- C:\Windows\System\TotnRPD.exe
  C:\Windows\System\TotnRPD.exe
  2⤵
  PID:7944
- C:\Windows\System\BhsriVE.exe
  C:\Windows\System\BhsriVE.exe
  2⤵
  PID:7968
- C:\Windows\System\VVOTwlb.exe
  C:\Windows\System\VVOTwlb.exe
  2⤵
  PID:7992
- C:\Windows\System\DZqBtfa.exe
  C:\Windows\System\DZqBtfa.exe
  2⤵
  PID:8016
- C:\Windows\System\ipdStpK.exe
  C:\Windows\System\ipdStpK.exe
  2⤵
  PID:8056
- C:\Windows\System\txyPbHD.exe
  C:\Windows\System\txyPbHD.exe
  2⤵
  PID:8072
- C:\Windows\System\syqnSHC.exe
  C:\Windows\System\syqnSHC.exe
  2⤵
  PID:8092
- C:\Windows\System\PTMZKNx.exe
  C:\Windows\System\PTMZKNx.exe
  2⤵
  PID:8132
- C:\Windows\System\lvvIiXz.exe
  C:\Windows\System\lvvIiXz.exe
  2⤵
  PID:8160
- C:\Windows\System\gpVjrpa.exe
  C:\Windows\System\gpVjrpa.exe
  2⤵
  PID:8184
- C:\Windows\System\VGghrAO.exe
  C:\Windows\System\VGghrAO.exe
  2⤵
  PID:4360
- C:\Windows\System\zyPqUhe.exe
  C:\Windows\System\zyPqUhe.exe
  2⤵
  PID:4428
- C:\Windows\System\WkpdAhy.exe
  C:\Windows\System\WkpdAhy.exe
  2⤵
  PID:7228
- C:\Windows\System\qqwTVee.exe
  C:\Windows\System\qqwTVee.exe
  2⤵
  PID:7292
- C:\Windows\System\xktjbZN.exe
  C:\Windows\System\xktjbZN.exe
  2⤵
  PID:7388
- C:\Windows\System\sSpuPQm.exe
  C:\Windows\System\sSpuPQm.exe
  2⤵
  PID:7444
- C:\Windows\System\xbWWsuk.exe
  C:\Windows\System\xbWWsuk.exe
  2⤵
  PID:7028
- C:\Windows\System\SRJsHHu.exe
  C:\Windows\System\SRJsHHu.exe
  2⤵
  PID:7556
- C:\Windows\System\dJuEgwa.exe
  C:\Windows\System\dJuEgwa.exe
  2⤵
  PID:7584
- C:\Windows\System\iVyArlC.exe
  C:\Windows\System\iVyArlC.exe
  2⤵
  PID:7632
- C:\Windows\System\GteFzve.exe
  C:\Windows\System\GteFzve.exe
  2⤵
  PID:3380
- C:\Windows\System\MVHMaFx.exe
  C:\Windows\System\MVHMaFx.exe
  2⤵
  PID:7728
- C:\Windows\System\ipfwoJE.exe
  C:\Windows\System\ipfwoJE.exe
  2⤵
  PID:7780
- C:\Windows\System\XXPwFaw.exe
  C:\Windows\System\XXPwFaw.exe
  2⤵
  PID:7876
- C:\Windows\System\ssWCIVT.exe
  C:\Windows\System\ssWCIVT.exe
  2⤵
  PID:7940
- C:\Windows\System\uwizAqU.exe
  C:\Windows\System\uwizAqU.exe
  2⤵
  PID:1748
- C:\Windows\System\jOCSNCO.exe
  C:\Windows\System\jOCSNCO.exe
  2⤵
  PID:8112
- C:\Windows\System\BxhRqiA.exe
  C:\Windows\System\BxhRqiA.exe
  2⤵
  PID:8168
- C:\Windows\System\zGEhZjP.exe
  C:\Windows\System\zGEhZjP.exe
  2⤵
  PID:7208
- C:\Windows\System\QSXYRtm.exe
  C:\Windows\System\QSXYRtm.exe
  2⤵
  PID:7220
- C:\Windows\System\OgYJXuk.exe
  C:\Windows\System\OgYJXuk.exe
  2⤵
  PID:7328
- C:\Windows\System\qjUXUAL.exe
  C:\Windows\System\qjUXUAL.exe
  2⤵
  PID:7576
- C:\Windows\System\tKaBvco.exe
  C:\Windows\System\tKaBvco.exe
  2⤵
  PID:7776
- C:\Windows\System\zuRppbO.exe
  C:\Windows\System\zuRppbO.exe
  2⤵
  PID:7976
- C:\Windows\System\anhjEAY.exe
  C:\Windows\System\anhjEAY.exe
  2⤵
  PID:6080
- C:\Windows\System\iChCmaf.exe
  C:\Windows\System\iChCmaf.exe
  2⤵
  PID:1480
- C:\Windows\System\ONlltfi.exe
  C:\Windows\System\ONlltfi.exe
  2⤵
  PID:2176
- C:\Windows\System\hEXhWxN.exe
  C:\Windows\System\hEXhWxN.exe
  2⤵
  PID:7608
- C:\Windows\System\yluAYSP.exe
  C:\Windows\System\yluAYSP.exe
  2⤵
  PID:4492
- C:\Windows\System\EXMPUTA.exe
  C:\Windows\System\EXMPUTA.exe
  2⤵
  PID:7768
- C:\Windows\System\unIMspZ.exe
  C:\Windows\System\unIMspZ.exe
  2⤵
  PID:8180
- C:\Windows\System\bKWUCXv.exe
  C:\Windows\System\bKWUCXv.exe
  2⤵
  PID:2728
- C:\Windows\System\GzRyDwC.exe
  C:\Windows\System\GzRyDwC.exe
  2⤵
  PID:8208
- C:\Windows\System\Csafoxz.exe
  C:\Windows\System\Csafoxz.exe
  2⤵
  PID:8268
- C:\Windows\System\OXZEuSs.exe
  C:\Windows\System\OXZEuSs.exe
  2⤵
  PID:8308
- C:\Windows\System\yFdPcbp.exe
  C:\Windows\System\yFdPcbp.exe
  2⤵
  PID:8328
- C:\Windows\System\lXraaot.exe
  C:\Windows\System\lXraaot.exe
  2⤵
  PID:8348
- C:\Windows\System\MWTJpwo.exe
  C:\Windows\System\MWTJpwo.exe
  2⤵
  PID:8372
- C:\Windows\System\YPyjQAQ.exe
  C:\Windows\System\YPyjQAQ.exe
  2⤵
  PID:8404
- C:\Windows\System\lGzdptJ.exe
  C:\Windows\System\lGzdptJ.exe
  2⤵
  PID:8456
- C:\Windows\System\utvfFkV.exe
  C:\Windows\System\utvfFkV.exe
  2⤵
  PID:8480
- C:\Windows\System\XsvKLuF.exe
  C:\Windows\System\XsvKLuF.exe
  2⤵
  PID:8504
- C:\Windows\System\yBJvXlG.exe
  C:\Windows\System\yBJvXlG.exe
  2⤵
  PID:8528
- C:\Windows\System\LfNwFHP.exe
  C:\Windows\System\LfNwFHP.exe
  2⤵
  PID:8552
- C:\Windows\System\cSeKDpB.exe
  C:\Windows\System\cSeKDpB.exe
  2⤵
  PID:8588
- C:\Windows\System\DLITUIQ.exe
  C:\Windows\System\DLITUIQ.exe
  2⤵
  PID:8612
- C:\Windows\System\xIpHjaG.exe
  C:\Windows\System\xIpHjaG.exe
  2⤵
  PID:8660
- C:\Windows\System\TiEBBpm.exe
  C:\Windows\System\TiEBBpm.exe
  2⤵
  PID:8680
- C:\Windows\System\cqszWFr.exe
  C:\Windows\System\cqszWFr.exe
  2⤵
  PID:8700
- C:\Windows\System\NhUgoFt.exe
  C:\Windows\System\NhUgoFt.exe
  2⤵
  PID:8724
- C:\Windows\System\MBGAOUt.exe
  C:\Windows\System\MBGAOUt.exe
  2⤵
  PID:8748
- C:\Windows\System\gpOFRCy.exe
  C:\Windows\System\gpOFRCy.exe
  2⤵
  PID:8772
- C:\Windows\System\RXpoqBL.exe
  C:\Windows\System\RXpoqBL.exe
  2⤵
  PID:8820
- C:\Windows\System\uVLqCWK.exe
  C:\Windows\System\uVLqCWK.exe
  2⤵
  PID:8840
- C:\Windows\System\DSAxgTY.exe
  C:\Windows\System\DSAxgTY.exe
  2⤵
  PID:8864
- C:\Windows\System\jgYklsA.exe
  C:\Windows\System\jgYklsA.exe
  2⤵
  PID:8880
- C:\Windows\System\yOquxrW.exe
  C:\Windows\System\yOquxrW.exe
  2⤵
  PID:8904
- C:\Windows\System\OgaLKqY.exe
  C:\Windows\System\OgaLKqY.exe
  2⤵
  PID:8920
- C:\Windows\System\tXLCFst.exe
  C:\Windows\System\tXLCFst.exe
  2⤵
  PID:8964
- C:\Windows\System\xoElQCW.exe
  C:\Windows\System\xoElQCW.exe
  2⤵
  PID:8988
- C:\Windows\System\sYdJJUg.exe
  C:\Windows\System\sYdJJUg.exe
  2⤵
  PID:9044
- C:\Windows\System\sEzRXSx.exe
  C:\Windows\System\sEzRXSx.exe
  2⤵
  PID:9068
- C:\Windows\System\bJMSMAt.exe
  C:\Windows\System\bJMSMAt.exe
  2⤵
  PID:9084
- C:\Windows\System\bgFhJjl.exe
  C:\Windows\System\bgFhJjl.exe
  2⤵
  PID:9108
- C:\Windows\System\LJVHymd.exe
  C:\Windows\System\LJVHymd.exe
  2⤵
  PID:9124
- C:\Windows\System\UEsypEt.exe
  C:\Windows\System\UEsypEt.exe
  2⤵
  PID:9148
- C:\Windows\System\EkYNICK.exe
  C:\Windows\System\EkYNICK.exe
  2⤵
  PID:9176
- C:\Windows\System\JjZnZbS.exe
  C:\Windows\System\JjZnZbS.exe
  2⤵
  PID:5080
- C:\Windows\System\lICcrQk.exe
  C:\Windows\System\lICcrQk.exe
  2⤵
  PID:7544
- C:\Windows\System\oQPFMVM.exe
  C:\Windows\System\oQPFMVM.exe
  2⤵
  PID:7900
- C:\Windows\System\FGNEZUw.exe
  C:\Windows\System\FGNEZUw.exe
  2⤵
  PID:8244
- C:\Windows\System\ByKulbm.exe
  C:\Windows\System\ByKulbm.exe
  2⤵
  PID:8280
- C:\Windows\System\ZnFvSgb.exe
  C:\Windows\System\ZnFvSgb.exe
  2⤵
  PID:8324
- C:\Windows\System\rVAXIyl.exe
  C:\Windows\System\rVAXIyl.exe
  2⤵
  PID:8364
- C:\Windows\System\LpuuHsO.exe
  C:\Windows\System\LpuuHsO.exe
  2⤵
  PID:8384
- C:\Windows\System\cNtjtRO.exe
  C:\Windows\System\cNtjtRO.exe
  2⤵
  PID:8540
- C:\Windows\System\DAveGHP.exe
  C:\Windows\System\DAveGHP.exe
  2⤵
  PID:8604
- C:\Windows\System\seGYtlT.exe
  C:\Windows\System\seGYtlT.exe
  2⤵
  PID:8644
- C:\Windows\System\AHRQbHS.exe
  C:\Windows\System\AHRQbHS.exe
  2⤵
  PID:8812
- C:\Windows\System\uDqsIkh.exe
  C:\Windows\System\uDqsIkh.exe
  2⤵
  PID:8836
- C:\Windows\System\KEMmvDx.exe
  C:\Windows\System\KEMmvDx.exe
  2⤵
  PID:8916
- C:\Windows\System\JmFaQAM.exe
  C:\Windows\System\JmFaQAM.exe
  2⤵
  PID:8956
- C:\Windows\System\KDAlNCy.exe
  C:\Windows\System\KDAlNCy.exe
  2⤵
  PID:9056
- C:\Windows\System\FrucCzH.exe
  C:\Windows\System\FrucCzH.exe
  2⤵
  PID:9192
- C:\Windows\System\HCCEXvM.exe
  C:\Windows\System\HCCEXvM.exe
  2⤵
  PID:9212
- C:\Windows\System\DDzAltt.exe
  C:\Windows\System\DDzAltt.exe
  2⤵
  PID:8260
- C:\Windows\System\eMfiZhE.exe
  C:\Windows\System\eMfiZhE.exe
  2⤵
  PID:8492
- C:\Windows\System\VhyZEbL.exe
  C:\Windows\System\VhyZEbL.exe
  2⤵
  PID:8512
- C:\Windows\System\oAOJash.exe
  C:\Windows\System\oAOJash.exe
  2⤵
  PID:8764
- C:\Windows\System\mLzFSod.exe
  C:\Windows\System\mLzFSod.exe
  2⤵
  PID:8952
- C:\Windows\System\zFptXwl.exe
  C:\Windows\System\zFptXwl.exe
  2⤵
  PID:8104
- C:\Windows\System\XPPbpWX.exe
  C:\Windows\System\XPPbpWX.exe
  2⤵
  PID:2212
- C:\Windows\System\DblUxnU.exe
  C:\Windows\System\DblUxnU.exe
  2⤵
  PID:8848
- C:\Windows\System\bJJiDhz.exe
  C:\Windows\System\bJJiDhz.exe
  2⤵
  PID:8912
- C:\Windows\System\rBrUapT.exe
  C:\Windows\System\rBrUapT.exe
  2⤵
  PID:9220
- C:\Windows\System\FSRSjXS.exe
  C:\Windows\System\FSRSjXS.exe
  2⤵
  PID:9240
- C:\Windows\System\opaNeaH.exe
  C:\Windows\System\opaNeaH.exe
  2⤵
  PID:9268
- C:\Windows\System\cyHJOpr.exe
  C:\Windows\System\cyHJOpr.exe
  2⤵
  PID:9292
- C:\Windows\System\wPFGPNF.exe
  C:\Windows\System\wPFGPNF.exe
  2⤵
  PID:9324
- C:\Windows\System\gdtcQge.exe
  C:\Windows\System\gdtcQge.exe
  2⤵
  PID:9340
- C:\Windows\System\KFGjoqw.exe
  C:\Windows\System\KFGjoqw.exe
  2⤵
  PID:9360
- C:\Windows\System\LDgSyZP.exe
  C:\Windows\System\LDgSyZP.exe
  2⤵
  PID:9384
- C:\Windows\System\JDWBwMe.exe
  C:\Windows\System\JDWBwMe.exe
  2⤵
  PID:9408
- C:\Windows\System\UKlagiu.exe
  C:\Windows\System\UKlagiu.exe
  2⤵
  PID:9424
- C:\Windows\System\MLYaKyt.exe
  C:\Windows\System\MLYaKyt.exe
  2⤵
  PID:9484
- C:\Windows\System\huQaLOr.exe
  C:\Windows\System\huQaLOr.exe
  2⤵
  PID:9528
- C:\Windows\System\JbgBKpW.exe
  C:\Windows\System\JbgBKpW.exe
  2⤵
  PID:9556
- C:\Windows\System\wINeWdL.exe
  C:\Windows\System\wINeWdL.exe
  2⤵
  PID:9576
- C:\Windows\System\ZAzaDgp.exe
  C:\Windows\System\ZAzaDgp.exe
  2⤵
  PID:9596
- C:\Windows\System\hHZjZgN.exe
  C:\Windows\System\hHZjZgN.exe
  2⤵
  PID:9624
- C:\Windows\System\MOfeKQm.exe
  C:\Windows\System\MOfeKQm.exe
  2⤵
  PID:9656
- C:\Windows\System\QiTWwWf.exe
  C:\Windows\System\QiTWwWf.exe
  2⤵
  PID:9700
- C:\Windows\System\yvuPANj.exe
  C:\Windows\System\yvuPANj.exe
  2⤵
  PID:9720
- C:\Windows\System\hmxEbUO.exe
  C:\Windows\System\hmxEbUO.exe
  2⤵
  PID:9744
- C:\Windows\System\baLWfwa.exe
  C:\Windows\System\baLWfwa.exe
  2⤵
  PID:9784
- C:\Windows\System\ItphDwc.exe
  C:\Windows\System\ItphDwc.exe
  2⤵
  PID:9804
- C:\Windows\System\EHKzmpz.exe
  C:\Windows\System\EHKzmpz.exe
  2⤵
  PID:9828
- C:\Windows\System\pIlkTHQ.exe
  C:\Windows\System\pIlkTHQ.exe
  2⤵
  PID:9848
- C:\Windows\System\GNCBYOj.exe
  C:\Windows\System\GNCBYOj.exe
  2⤵
  PID:9876
- C:\Windows\System\RYJXFgX.exe
  C:\Windows\System\RYJXFgX.exe
  2⤵
  PID:9904
- C:\Windows\System\JXBUhNu.exe
  C:\Windows\System\JXBUhNu.exe
  2⤵
  PID:9936
- C:\Windows\System\wWCalzt.exe
  C:\Windows\System\wWCalzt.exe
  2⤵
  PID:9952
- C:\Windows\System\IBzbHlD.exe
  C:\Windows\System\IBzbHlD.exe
  2⤵
  PID:9968
- C:\Windows\System\AdqehFm.exe
  C:\Windows\System\AdqehFm.exe
  2⤵
  PID:9984
- C:\Windows\System\RtprLOu.exe
  C:\Windows\System\RtprLOu.exe
  2⤵
  PID:10004
- C:\Windows\System\cDiXlaj.exe
  C:\Windows\System\cDiXlaj.exe
  2⤵
  PID:10072
- C:\Windows\System\aODvSxc.exe
  C:\Windows\System\aODvSxc.exe
  2⤵
  PID:10112
- C:\Windows\System\PyeMkqr.exe
  C:\Windows\System\PyeMkqr.exe
  2⤵
  PID:10136
- C:\Windows\System\MziANnC.exe
  C:\Windows\System\MziANnC.exe
  2⤵
  PID:10164
- C:\Windows\System\JSZqowa.exe
  C:\Windows\System\JSZqowa.exe
  2⤵
  PID:10184
- C:\Windows\System\mEtBfFV.exe
  C:\Windows\System\mEtBfFV.exe
  2⤵
  PID:10216
- C:\Windows\System\aZRhxUv.exe
  C:\Windows\System\aZRhxUv.exe
  2⤵
  PID:10236
- C:\Windows\System\MrnLVBT.exe
  C:\Windows\System\MrnLVBT.exe
  2⤵
  PID:9332
- C:\Windows\System\mvFfKLI.exe
  C:\Windows\System\mvFfKLI.exe
  2⤵
  PID:9368
- C:\Windows\System\DDPZDxB.exe
  C:\Windows\System\DDPZDxB.exe
  2⤵
  PID:9456
- C:\Windows\System\gqwcBZI.exe
  C:\Windows\System\gqwcBZI.exe
  2⤵
  PID:9520
- C:\Windows\System\TioZsXN.exe
  C:\Windows\System\TioZsXN.exe
  2⤵
  PID:9572
- C:\Windows\System\ndDvIpb.exe
  C:\Windows\System\ndDvIpb.exe
  2⤵
  PID:9664
- C:\Windows\System\YtEgNEp.exe
  C:\Windows\System\YtEgNEp.exe
  2⤵
  PID:9780
- C:\Windows\System\HvnJEGh.exe
  C:\Windows\System\HvnJEGh.exe
  2⤵
  PID:9812
- C:\Windows\System\BGoYLzk.exe
  C:\Windows\System\BGoYLzk.exe
  2⤵
  PID:9868
- C:\Windows\System\LGFHZrL.exe
  C:\Windows\System\LGFHZrL.exe
  2⤵
  PID:9920
- C:\Windows\System\CQHgCUq.exe
  C:\Windows\System\CQHgCUq.exe
  2⤵
  PID:10016
- C:\Windows\System\GJDOmvS.exe
  C:\Windows\System\GJDOmvS.exe
  2⤵
  PID:10032
- C:\Windows\System\LEOIdrd.exe
  C:\Windows\System\LEOIdrd.exe
  2⤵
  PID:10104
- C:\Windows\System\dzitNAT.exe
  C:\Windows\System\dzitNAT.exe
  2⤵
  PID:10108
- C:\Windows\System\tAWSDyt.exe
  C:\Windows\System\tAWSDyt.exe
  2⤵
  PID:10160
- C:\Windows\System\RiFaXlu.exe
  C:\Windows\System\RiFaXlu.exe
  2⤵
  PID:9480
- C:\Windows\System\hDGfSyb.exe
  C:\Windows\System\hDGfSyb.exe
  2⤵
  PID:9544
- C:\Windows\System\hllAVxU.exe
  C:\Windows\System\hllAVxU.exe
  2⤵
  PID:9716
- C:\Windows\System\itaxTSh.exe
  C:\Windows\System\itaxTSh.exe
  2⤵
  PID:9796
- C:\Windows\System\fdbuOkw.exe
  C:\Windows\System\fdbuOkw.exe
  2⤵
  PID:9932
- C:\Windows\System\ozDudjk.exe
  C:\Windows\System\ozDudjk.exe
  2⤵
  PID:9228
- C:\Windows\System\XLTAQLi.exe
  C:\Windows\System\XLTAQLi.exe
  2⤵
  PID:9300
- C:\Windows\System\UczmQwX.exe
  C:\Windows\System\UczmQwX.exe
  2⤵
  PID:9376
- C:\Windows\System\TVSLIqF.exe
  C:\Windows\System\TVSLIqF.exe
  2⤵
  PID:9896
- C:\Windows\System\PwWBPiD.exe
  C:\Windows\System\PwWBPiD.exe
  2⤵
  PID:9392
- C:\Windows\System\TltjPwz.exe
  C:\Windows\System\TltjPwz.exe
  2⤵
  PID:9996
- C:\Windows\System\RMqaACr.exe
  C:\Windows\System\RMqaACr.exe
  2⤵
  PID:10256
- C:\Windows\System\aGMJddj.exe
  C:\Windows\System\aGMJddj.exe
  2⤵
  PID:10276
- C:\Windows\System\vhiThHU.exe
  C:\Windows\System\vhiThHU.exe
  2⤵
  PID:10324
- C:\Windows\System\JgaQOei.exe
  C:\Windows\System\JgaQOei.exe
  2⤵
  PID:10364
- C:\Windows\System\PnrpfNm.exe
  C:\Windows\System\PnrpfNm.exe
  2⤵
  PID:10396
- C:\Windows\System\IPEQcZA.exe
  C:\Windows\System\IPEQcZA.exe
  2⤵
  PID:10412
- C:\Windows\System\EHGadFG.exe
  C:\Windows\System\EHGadFG.exe
  2⤵
  PID:10436
- C:\Windows\System\RBBhHGP.exe
  C:\Windows\System\RBBhHGP.exe
  2⤵
  PID:10456
- C:\Windows\System\TAOBgLF.exe
  C:\Windows\System\TAOBgLF.exe
  2⤵
  PID:10480
- C:\Windows\System\rigKVUq.exe
  C:\Windows\System\rigKVUq.exe
  2⤵
  PID:10500
- C:\Windows\System\HYVXWfV.exe
  C:\Windows\System\HYVXWfV.exe
  2⤵
  PID:10528
- C:\Windows\System\UYSuuAd.exe
  C:\Windows\System\UYSuuAd.exe
  2⤵
  PID:10560
- C:\Windows\System\cAgnYXE.exe
  C:\Windows\System\cAgnYXE.exe
  2⤵
  PID:10580
- C:\Windows\System\UTvHfnc.exe
  C:\Windows\System\UTvHfnc.exe
  2⤵
  PID:10620
- C:\Windows\System\aKIzpwA.exe
  C:\Windows\System\aKIzpwA.exe
  2⤵
  PID:10648
- C:\Windows\System\eMFlfxg.exe
  C:\Windows\System\eMFlfxg.exe
  2⤵
  PID:10668
- C:\Windows\System\tWNApVf.exe
  C:\Windows\System\tWNApVf.exe
  2⤵
  PID:10708
- C:\Windows\System\SuzExwb.exe
  C:\Windows\System\SuzExwb.exe
  2⤵
  PID:10732
- C:\Windows\System\ChvLmBA.exe
  C:\Windows\System\ChvLmBA.exe
  2⤵
  PID:10756
- C:\Windows\System\VLrlJJn.exe
  C:\Windows\System\VLrlJJn.exe
  2⤵
  PID:10776
- C:\Windows\System\HCSdeNv.exe
  C:\Windows\System\HCSdeNv.exe
  2⤵
  PID:10796
- C:\Windows\System\frrlkRM.exe
  C:\Windows\System\frrlkRM.exe
  2⤵
  PID:10820
- C:\Windows\System\kCtWrzh.exe
  C:\Windows\System\kCtWrzh.exe
  2⤵
  PID:10840
- C:\Windows\System\fNvFnng.exe
  C:\Windows\System\fNvFnng.exe
  2⤵
  PID:10872
- C:\Windows\System\uGzcINr.exe
  C:\Windows\System\uGzcINr.exe
  2⤵
  PID:10904
- C:\Windows\System\rDcKQWx.exe
  C:\Windows\System\rDcKQWx.exe
  2⤵
  PID:10960
- C:\Windows\System\iPzQtyD.exe
  C:\Windows\System\iPzQtyD.exe
  2⤵
  PID:10984
- C:\Windows\System\XQQaKdK.exe
  C:\Windows\System\XQQaKdK.exe
  2⤵
  PID:11004
- C:\Windows\System\feDAfHV.exe
  C:\Windows\System\feDAfHV.exe
  2⤵
  PID:11032
- C:\Windows\System\NPPuajc.exe
  C:\Windows\System\NPPuajc.exe
  2⤵
  PID:11052
- C:\Windows\System\liTOOWr.exe
  C:\Windows\System\liTOOWr.exe
  2⤵
  PID:11088
- C:\Windows\System\NgzLfuR.exe
  C:\Windows\System\NgzLfuR.exe
  2⤵
  PID:11124
- C:\Windows\System\bARWwJw.exe
  C:\Windows\System\bARWwJw.exe
  2⤵
  PID:11144
- C:\Windows\System\TgQHmDU.exe
  C:\Windows\System\TgQHmDU.exe
  2⤵
  PID:11196
- C:\Windows\System\OCqjAYQ.exe
  C:\Windows\System\OCqjAYQ.exe
  2⤵
  PID:11224
- C:\Windows\System\OnUHVLX.exe
  C:\Windows\System\OnUHVLX.exe
  2⤵
  PID:11248
- C:\Windows\System\hUvffiv.exe
  C:\Windows\System\hUvffiv.exe
  2⤵
  PID:9800
- C:\Windows\System\RhnmCAm.exe
  C:\Windows\System\RhnmCAm.exe
  2⤵
  PID:10296
- C:\Windows\System\kbitlTM.exe
  C:\Windows\System\kbitlTM.exe
  2⤵
  PID:10348
- C:\Windows\System\ywdAXUk.exe
  C:\Windows\System\ywdAXUk.exe
  2⤵
  PID:10408
- C:\Windows\System\TawVleD.exe
  C:\Windows\System\TawVleD.exe
  2⤵
  PID:10452
- C:\Windows\System\fGwkHce.exe
  C:\Windows\System\fGwkHce.exe
  2⤵
  PID:10496
- C:\Windows\System\kPqybex.exe
  C:\Windows\System\kPqybex.exe
  2⤵
  PID:10608
- C:\Windows\System\cRPMZOo.exe
  C:\Windows\System\cRPMZOo.exe
  2⤵
  PID:10660
- C:\Windows\System\hUaXCQn.exe
  C:\Windows\System\hUaXCQn.exe
  2⤵
  PID:10716
- C:\Windows\System\vHrNriY.exe
  C:\Windows\System\vHrNriY.exe
  2⤵
  PID:10812
- C:\Windows\System\WcbTmYR.exe
  C:\Windows\System\WcbTmYR.exe
  2⤵
  PID:10864
- C:\Windows\System\UgicsNQ.exe
  C:\Windows\System\UgicsNQ.exe
  2⤵
  PID:10956
- C:\Windows\System\OGIjpVQ.exe
  C:\Windows\System\OGIjpVQ.exe
  2⤵
  PID:10996
- C:\Windows\System\qeGFSYi.exe
  C:\Windows\System\qeGFSYi.exe
  2⤵
  PID:11044
- C:\Windows\System\ydKhHPD.exe
  C:\Windows\System\ydKhHPD.exe
  2⤵
  PID:11176
- C:\Windows\System\FTskruq.exe
  C:\Windows\System\FTskruq.exe
  2⤵
  PID:11220
- C:\Windows\System\gExsPpr.exe
  C:\Windows\System\gExsPpr.exe
  2⤵
  PID:3400
- C:\Windows\System\jXCCZii.exe
  C:\Windows\System\jXCCZii.exe
  2⤵
  PID:10388
- C:\Windows\System\CgXfyLZ.exe
  C:\Windows\System\CgXfyLZ.exe
  2⤵
  PID:10520
- C:\Windows\System\KUymOhU.exe
  C:\Windows\System\KUymOhU.exe
  2⤵
  PID:10740
- C:\Windows\System\vqxsdHL.exe
  C:\Windows\System\vqxsdHL.exe
  2⤵
  PID:10832
- C:\Windows\System\VjirCGT.exe
  C:\Windows\System\VjirCGT.exe
  2⤵
  PID:11016
- C:\Windows\System\mnKlvuz.exe
  C:\Windows\System\mnKlvuz.exe
  2⤵
  PID:11100
- C:\Windows\System\nGHgIZO.exe
  C:\Windows\System\nGHgIZO.exe
  2⤵
  PID:10556
- C:\Windows\System\dDCQQRM.exe
  C:\Windows\System\dDCQQRM.exe
  2⤵
  PID:10916
- C:\Windows\System\pAYujed.exe
  C:\Windows\System\pAYujed.exe
  2⤵
  PID:10360
- C:\Windows\System\PlsaIvx.exe
  C:\Windows\System\PlsaIvx.exe
  2⤵
  PID:11180
- C:\Windows\System\abczLOR.exe
  C:\Windows\System\abczLOR.exe
  2⤵
  PID:11288
- C:\Windows\System\WBMPCeL.exe
  C:\Windows\System\WBMPCeL.exe
  2⤵
  PID:11316
- C:\Windows\System\AqNRuRI.exe
  C:\Windows\System\AqNRuRI.exe
  2⤵
  PID:11336
- C:\Windows\System\hDJHBLz.exe
  C:\Windows\System\hDJHBLz.exe
  2⤵
  PID:11356
- C:\Windows\System\qFFvYdw.exe
  C:\Windows\System\qFFvYdw.exe
  2⤵
  PID:11384
- C:\Windows\System\xqthUmV.exe
  C:\Windows\System\xqthUmV.exe
  2⤵
  PID:11404
- C:\Windows\System\qCzaxVv.exe
  C:\Windows\System\qCzaxVv.exe
  2⤵
  PID:11424
- C:\Windows\System\ukLpRfr.exe
  C:\Windows\System\ukLpRfr.exe
  2⤵
  PID:11464
- C:\Windows\System\YJBzFTA.exe
  C:\Windows\System\YJBzFTA.exe
  2⤵
  PID:11484
- C:\Windows\System\dAskkRu.exe
  C:\Windows\System\dAskkRu.exe
  2⤵
  PID:11524
- C:\Windows\System\CKYoIIZ.exe
  C:\Windows\System\CKYoIIZ.exe
  2⤵
  PID:11572
- C:\Windows\System\VNILPYL.exe
  C:\Windows\System\VNILPYL.exe
  2⤵
  PID:11588
- C:\Windows\System\edBzyva.exe
  C:\Windows\System\edBzyva.exe
  2⤵
  PID:11612
- C:\Windows\System\bJWSADi.exe
  C:\Windows\System\bJWSADi.exe
  2⤵
  PID:11640
- C:\Windows\System\pghGkhi.exe
  C:\Windows\System\pghGkhi.exe
  2⤵
  PID:11660
- C:\Windows\System\UYzFBeO.exe
  C:\Windows\System\UYzFBeO.exe
  2⤵
  PID:11684
- C:\Windows\System\ITYJJVn.exe
  C:\Windows\System\ITYJJVn.exe
  2⤵
  PID:11700
- C:\Windows\System\kHyNBKl.exe
  C:\Windows\System\kHyNBKl.exe
  2⤵
  PID:11728
- C:\Windows\System\gmofsYD.exe
  C:\Windows\System\gmofsYD.exe
  2⤵
  PID:11748
- C:\Windows\System\clTpIEW.exe
  C:\Windows\System\clTpIEW.exe
  2⤵
  PID:11768
- C:\Windows\System\eDlyEgb.exe
  C:\Windows\System\eDlyEgb.exe
  2⤵
  PID:11848
- C:\Windows\System\uXtdnwO.exe
  C:\Windows\System\uXtdnwO.exe
  2⤵
  PID:11868
- C:\Windows\System\QigDpSc.exe
  C:\Windows\System\QigDpSc.exe
  2⤵
  PID:11896
- C:\Windows\System\sZADHTj.exe
  C:\Windows\System\sZADHTj.exe
  2⤵
  PID:11924
- C:\Windows\System\yTvpETA.exe
  C:\Windows\System\yTvpETA.exe
  2⤵
  PID:11968
- C:\Windows\System\dlUZMcD.exe
  C:\Windows\System\dlUZMcD.exe
  2⤵
  PID:11984
- C:\Windows\System\VaLxEpO.exe
  C:\Windows\System\VaLxEpO.exe
  2⤵
  PID:12008
- C:\Windows\System\hIoueTV.exe
  C:\Windows\System\hIoueTV.exe
  2⤵
  PID:12056
- C:\Windows\System\FVcSVpl.exe
  C:\Windows\System\FVcSVpl.exe
  2⤵
  PID:12076
- C:\Windows\System\ePRWNTJ.exe
  C:\Windows\System\ePRWNTJ.exe
  2⤵
  PID:12100
- C:\Windows\System\BbSoXgu.exe
  C:\Windows\System\BbSoXgu.exe
  2⤵
  PID:12120
- C:\Windows\System\aDZyEgq.exe
  C:\Windows\System\aDZyEgq.exe
  2⤵
  PID:12140
- C:\Windows\System\xuUiEiJ.exe
  C:\Windows\System\xuUiEiJ.exe
  2⤵
  PID:12176
- C:\Windows\System\HnfEWRl.exe
  C:\Windows\System\HnfEWRl.exe
  2⤵
  PID:12212
- C:\Windows\System\nFPvGhQ.exe
  C:\Windows\System\nFPvGhQ.exe
  2⤵
  PID:12240
- C:\Windows\System\fmJMPQc.exe
  C:\Windows\System\fmJMPQc.exe
  2⤵
  PID:12260
- C:\Windows\System\oxUssDq.exe
  C:\Windows\System\oxUssDq.exe
  2⤵
  PID:11296
- C:\Windows\System\fLdpWZc.exe
  C:\Windows\System\fLdpWZc.exe
  2⤵
  PID:11332
- C:\Windows\System\PXhuCgq.exe
  C:\Windows\System\PXhuCgq.exe
  2⤵
  PID:11392
- C:\Windows\System\UudJLfh.exe
  C:\Windows\System\UudJLfh.exe
  2⤵
  PID:11452
- C:\Windows\System\pPwzNYG.exe
  C:\Windows\System\pPwzNYG.exe
  2⤵
  PID:11520
- C:\Windows\System\dukvfme.exe
  C:\Windows\System\dukvfme.exe
  2⤵
  PID:11564
- C:\Windows\System\quYLbtH.exe
  C:\Windows\System\quYLbtH.exe
  2⤵
  PID:11620
- C:\Windows\System\ayTxStp.exe
  C:\Windows\System\ayTxStp.exe
  2⤵
  PID:11712
- C:\Windows\System\ANVZBcJ.exe
  C:\Windows\System\ANVZBcJ.exe
  2⤵
  PID:11696
- C:\Windows\System\inyKRnJ.exe
  C:\Windows\System\inyKRnJ.exe
  2⤵
  PID:11844
- C:\Windows\System\uMrvWlx.exe
  C:\Windows\System\uMrvWlx.exe
  2⤵
  PID:11916
- C:\Windows\System\UqSXMbw.exe
  C:\Windows\System\UqSXMbw.exe
  2⤵
  PID:11980
- C:\Windows\System\wwnwILO.exe
  C:\Windows\System\wwnwILO.exe
  2⤵
  PID:12040
- C:\Windows\System\svlNwuG.exe
  C:\Windows\System\svlNwuG.exe
  2⤵
  PID:12068
- C:\Windows\System\CoFcYrR.exe
  C:\Windows\System\CoFcYrR.exe
  2⤵
  PID:12168
- C:\Windows\System\XMesSuB.exe
  C:\Windows\System\XMesSuB.exe
  2⤵
  PID:12208
- C:\Windows\System\mTPPIJH.exe
  C:\Windows\System\mTPPIJH.exe
  2⤵
  PID:11348
- C:\Windows\System\MtdKpVg.exe
  C:\Windows\System\MtdKpVg.exe
  2⤵
  PID:11420
- C:\Windows\System\uJvSGHj.exe
  C:\Windows\System\uJvSGHj.exe
  2⤵
  PID:11584
- C:\Windows\System\kVdYBdz.exe
  C:\Windows\System\kVdYBdz.exe
  2⤵
  PID:11604
- C:\Windows\System\FtOXmkx.exe
  C:\Windows\System\FtOXmkx.exe
  2⤵
  PID:11992
- C:\Windows\System\PCLszIj.exe
  C:\Windows\System\PCLszIj.exe
  2⤵
  PID:12132
- C:\Windows\System\DmCtvXa.exe
  C:\Windows\System\DmCtvXa.exe
  2⤵
  PID:12200
- C:\Windows\System\SRZnmkg.exe
  C:\Windows\System\SRZnmkg.exe
  2⤵
  PID:11328
- C:\Windows\System\cZNIKTl.exe
  C:\Windows\System\cZNIKTl.exe
  2⤵
  PID:11632
- C:\Windows\System\CKyeFIA.exe
  C:\Windows\System\CKyeFIA.exe
  2⤵
  PID:12036
- C:\Windows\System\hViryCq.exe
  C:\Windows\System\hViryCq.exe
  2⤵
  PID:11504
- C:\Windows\System\ENWoWhn.exe
  C:\Windows\System\ENWoWhn.exe
  2⤵
  PID:12304
- C:\Windows\System\PefqLwf.exe
  C:\Windows\System\PefqLwf.exe
  2⤵
  PID:12324
- C:\Windows\System\IrVmstd.exe
  C:\Windows\System\IrVmstd.exe
  2⤵
  PID:12360
- C:\Windows\System\iBTxhmo.exe
  C:\Windows\System\iBTxhmo.exe
  2⤵
  PID:12380
- C:\Windows\System\dyQeUYD.exe
  C:\Windows\System\dyQeUYD.exe
  2⤵
  PID:12404
- C:\Windows\System\oaGeseh.exe
  C:\Windows\System\oaGeseh.exe
  2⤵
  PID:12424
- C:\Windows\System\zdIRUCs.exe
  C:\Windows\System\zdIRUCs.exe
  2⤵
  PID:12476
- C:\Windows\System\GOgvFln.exe
  C:\Windows\System\GOgvFln.exe
  2⤵
  PID:12536
- C:\Windows\System\jVVFKZL.exe
  C:\Windows\System\jVVFKZL.exe
  2⤵
  PID:12556
- C:\Windows\System\ZKMUrnq.exe
  C:\Windows\System\ZKMUrnq.exe
  2⤵
  PID:12572
- C:\Windows\System\kRupksr.exe
  C:\Windows\System\kRupksr.exe
  2⤵
  PID:12676
- C:\Windows\System\uqFONms.exe
  C:\Windows\System\uqFONms.exe
  2⤵
  PID:12716
- C:\Windows\System\dATWXEf.exe
  C:\Windows\System\dATWXEf.exe
  2⤵
  PID:12736
- C:\Windows\System\NHdxlhy.exe
  C:\Windows\System\NHdxlhy.exe
  2⤵
  PID:12772
- C:\Windows\System\iiIeBUf.exe
  C:\Windows\System\iiIeBUf.exe
  2⤵
  PID:12824
- C:\Windows\System\hqzkWbZ.exe
  C:\Windows\System\hqzkWbZ.exe
  2⤵
  PID:12864
- C:\Windows\System\CSEjTer.exe
  C:\Windows\System\CSEjTer.exe
  2⤵
  PID:12888
- C:\Windows\System\ADGkDIc.exe
  C:\Windows\System\ADGkDIc.exe
  2⤵
  PID:12912
- C:\Windows\System\VqVcgmM.exe
  C:\Windows\System\VqVcgmM.exe
  2⤵
  PID:12940
- C:\Windows\System\OJSiFah.exe
  C:\Windows\System\OJSiFah.exe
  2⤵
  PID:12968
- C:\Windows\System\ATnOfUt.exe
  C:\Windows\System\ATnOfUt.exe
  2⤵
  PID:12992
- C:\Windows\System\evJAiMe.exe
  C:\Windows\System\evJAiMe.exe
  2⤵
  PID:13012
- C:\Windows\System\qbedGdV.exe
  C:\Windows\System\qbedGdV.exe
  2⤵
  PID:13052
- C:\Windows\System\GMoDzvK.exe
  C:\Windows\System\GMoDzvK.exe
  2⤵
  PID:13080
- C:\Windows\System\QMZkJkI.exe
  C:\Windows\System\QMZkJkI.exe
  2⤵
  PID:13108
- C:\Windows\System\gjjPFCW.exe
  C:\Windows\System\gjjPFCW.exe
  2⤵
  PID:13132
- C:\Windows\System\FhrxgSZ.exe
  C:\Windows\System\FhrxgSZ.exe
  2⤵
  PID:13152
- C:\Windows\System\vofqLKb.exe
  C:\Windows\System\vofqLKb.exe
  2⤵
  PID:13176
- C:\Windows\System\mPJcfnx.exe
  C:\Windows\System\mPJcfnx.exe
  2⤵
  PID:13196
- C:\Windows\System\wqQSezU.exe
  C:\Windows\System\wqQSezU.exe
  2⤵
  PID:13220
- C:\Windows\System\pYvlSch.exe
  C:\Windows\System\pYvlSch.exe
  2⤵
  PID:13240
- C:\Windows\System\KBtAgql.exe
  C:\Windows\System\KBtAgql.exe
  2⤵
  PID:13280
- C:\Windows\System\iPASATu.exe
  C:\Windows\System\iPASATu.exe
  2⤵
  PID:13300
- C:\Windows\System\PukUOGK.exe
  C:\Windows\System\PukUOGK.exe
  2⤵
  PID:1572
- C:\Windows\System\NxTZkQn.exe
  C:\Windows\System\NxTZkQn.exe
  2⤵
  PID:12300
- C:\Windows\System\nWczzJP.exe
  C:\Windows\System\nWczzJP.exe
  2⤵
  PID:12396
- C:\Windows\System\ukDpHJs.exe
  C:\Windows\System\ukDpHJs.exe
  2⤵
  PID:12440
- C:\Windows\System\CVdWFQR.exe
  C:\Windows\System\CVdWFQR.exe
  2⤵
  PID:12420
- C:\Windows\System\yONHfVF.exe
  C:\Windows\System\yONHfVF.exe
  2⤵
  PID:12612
- C:\Windows\System\eLyUDHy.exe
  C:\Windows\System\eLyUDHy.exe
  2⤵
  PID:12692
- C:\Windows\System\QYOxoFU.exe
  C:\Windows\System\QYOxoFU.exe
  2⤵
  PID:12652
- C:\Windows\System\lnTtjlF.exe
  C:\Windows\System\lnTtjlF.exe
  2⤵
  PID:12580
- C:\Windows\System\NwPQFWW.exe
  C:\Windows\System\NwPQFWW.exe
  2⤵
  PID:12544
- C:\Windows\System\GdiwyXv.exe
  C:\Windows\System\GdiwyXv.exe
  2⤵
  PID:12664
- C:\Windows\System\zavTULv.exe
  C:\Windows\System\zavTULv.exe
  2⤵
  PID:12820
- C:\Windows\System\lgHvDcE.exe
  C:\Windows\System\lgHvDcE.exe
  2⤵
  PID:12880
- C:\Windows\System\UFbkQrp.exe
  C:\Windows\System\UFbkQrp.exe
  2⤵
  PID:13068
- C:\Windows\System\cmkHVWS.exe
  C:\Windows\System\cmkHVWS.exe
  2⤵
  PID:12964
- C:\Windows\System\JLtStMi.exe
  C:\Windows\System\JLtStMi.exe
  2⤵
  PID:13188
- C:\Windows\System\leFcjxn.exe
  C:\Windows\System\leFcjxn.exe
  2⤵
  PID:4480
- C:\Windows\System\LLnFLhM.exe
  C:\Windows\System\LLnFLhM.exe
  2⤵
  PID:1424
- C:\Windows\System\vMrnRMN.exe
  C:\Windows\System\vMrnRMN.exe
  2⤵
  PID:12344
- C:\Windows\System\kUFLemM.exe
  C:\Windows\System\kUFLemM.exe
  2⤵
  PID:3984
- C:\Windows\System\kpOagjm.exe
  C:\Windows\System\kpOagjm.exe
  2⤵
  PID:2620
- C:\Windows\System\cbruHZo.exe
  C:\Windows\System\cbruHZo.exe
  2⤵
  PID:12564
- C:\Windows\System\RfOsUcF.exe
  C:\Windows\System\RfOsUcF.exe
  2⤵
  PID:6072
- C:\Windows\System\LjQgKct.exe
  C:\Windows\System\LjQgKct.exe
  2⤵
  PID:6612
- C:\Windows\System\WyCNoBA.exe
  C:\Windows\System\WyCNoBA.exe
  2⤵
  PID:2680
- C:\Windows\System\WpPhGWD.exe
  C:\Windows\System\WpPhGWD.exe
  2⤵
  PID:1652
- C:\Windows\System\hexIVJh.exe
  C:\Windows\System\hexIVJh.exe
  2⤵
  PID:3668
- C:\Windows\System\wYKQcPj.exe
  C:\Windows\System\wYKQcPj.exe
  2⤵
  PID:1700
- C:\Windows\System\RAhOQfX.exe
  C:\Windows\System\RAhOQfX.exe
  2⤵
  PID:7660
- C:\Windows\System\mXjqFhB.exe
  C:\Windows\System\mXjqFhB.exe
  2⤵
  PID:1936
- C:\Windows\System\VBIZegs.exe
  C:\Windows\System\VBIZegs.exe
  2⤵
  PID:6248
- C:\Windows\System\HShZbFW.exe
  C:\Windows\System\HShZbFW.exe
  2⤵
  PID:3368
- C:\Windows\System\kUUlEuZ.exe
  C:\Windows\System\kUUlEuZ.exe
  2⤵
  PID:3252
- C:\Windows\System\ASNCJYP.exe
  C:\Windows\System\ASNCJYP.exe
  2⤵
  PID:1356
- C:\Windows\System\eHuBwAv.exe
  C:\Windows\System\eHuBwAv.exe
  2⤵
  PID:1784
- C:\Windows\System\wVcEJne.exe
  C:\Windows\System\wVcEJne.exe
  2⤵
  PID:1616
- C:\Windows\System\WsrjDjY.exe
  C:\Windows\System\WsrjDjY.exe
  2⤵
  PID:4912
- C:\Windows\System\tshNkOp.exe
  C:\Windows\System\tshNkOp.exe
  2⤵
  PID:3340
- C:\Windows\System\OpdpXtg.exe
  C:\Windows\System\OpdpXtg.exe
  2⤵
  PID:7804
- C:\Windows\System\lSnBCoc.exe
  C:\Windows\System\lSnBCoc.exe
  2⤵
  PID:1552
- C:\Windows\System\HoMgBQm.exe
  C:\Windows\System\HoMgBQm.exe
  2⤵
  PID:3220
- C:\Windows\System\QhsgKfm.exe
  C:\Windows\System\QhsgKfm.exe
  2⤵
  PID:4624
- C:\Windows\System\JygmjoI.exe
  C:\Windows\System\JygmjoI.exe
  2⤵
  PID:13232
- C:\Windows\System\WplwlCD.exe
  C:\Windows\System\WplwlCD.exe
  2⤵
  PID:13276
- C:\Windows\System\PwKeyLx.exe
  C:\Windows\System\PwKeyLx.exe
  2⤵
  PID:4100
- C:\Windows\System\NLsGqBO.exe
  C:\Windows\System\NLsGqBO.exe
  2⤵
  PID:2284
- C:\Windows\System\mUFZTnI.exe
  C:\Windows\System\mUFZTnI.exe
  2⤵
  PID:2324
- C:\Windows\System\ryVSAjP.exe
  C:\Windows\System\ryVSAjP.exe
  2⤵
  PID:4828
- C:\Windows\System\UWlQIMU.exe
  C:\Windows\System\UWlQIMU.exe
  2⤵
  PID:13296
- C:\Windows\System\OjPdZQE.exe
  C:\Windows\System\OjPdZQE.exe
  2⤵
  PID:13264
- C:\Windows\System\yyGejod.exe
  C:\Windows\System\yyGejod.exe
  2⤵
  PID:3600
- C:\Windows\System\dTlqCzn.exe
  C:\Windows\System\dTlqCzn.exe
  2⤵
  PID:3936
- C:\Windows\System\yURXlbo.exe
  C:\Windows\System\yURXlbo.exe
  2⤵
  PID:3880
- C:\Windows\System\ptCBuKe.exe
  C:\Windows\System\ptCBuKe.exe
  2⤵
  PID:744
- C:\Windows\System\JJcexPd.exe
  C:\Windows\System\JJcexPd.exe
  2⤵
  PID:12620
- C:\Windows\System\KVroPDg.exe
  C:\Windows\System\KVroPDg.exe
  2⤵
  PID:1196
- C:\Windows\System\TYmztNa.exe
  C:\Windows\System\TYmztNa.exe
  2⤵
  PID:12752
- C:\Windows\System\ePjLCAH.exe
  C:\Windows\System\ePjLCAH.exe
  2⤵
  PID:4388
- C:\Windows\System\atqRhGl.exe
  C:\Windows\System\atqRhGl.exe
  2⤵
  PID:2772
- C:\Windows\System\ySgPssg.exe
  C:\Windows\System\ySgPssg.exe
  2⤵
  PID:2256
- C:\Windows\System\inwAmPk.exe
  C:\Windows\System\inwAmPk.exe
  2⤵
  PID:1064
- C:\Windows\System\zkBZITw.exe
  C:\Windows\System\zkBZITw.exe
  2⤵
  PID:768
- C:\Windows\System\oFtnNxp.exe
  C:\Windows\System\oFtnNxp.exe
  2⤵
  PID:7192
- C:\Windows\System\QmGfjVV.exe
  C:\Windows\System\QmGfjVV.exe
  2⤵
  PID:5216
- C:\Windows\System\AqkZAgB.exe
  C:\Windows\System\AqkZAgB.exe
  2⤵
  PID:2672
- C:\Windows\System\MkGAtJE.exe
  C:\Windows\System\MkGAtJE.exe
  2⤵
  PID:3828
- C:\Windows\System\VJAyQxR.exe
  C:\Windows\System\VJAyQxR.exe
  2⤵
  PID:1604
- C:\Windows\System\FvxhGLJ.exe
  C:\Windows\System\FvxhGLJ.exe
  2⤵
  PID:220
- C:\Windows\System\lsUmXWs.exe
  C:\Windows\System\lsUmXWs.exe
  2⤵
  PID:4376
- C:\Windows\System\yxRufST.exe
  C:\Windows\System\yxRufST.exe
  2⤵
  PID:3908
- C:\Windows\System\esosCek.exe
  C:\Windows\System\esosCek.exe
  2⤵
  PID:13040
- C:\Windows\System\XSyszhf.exe
  C:\Windows\System\XSyszhf.exe
  2⤵
  PID:4772
- C:\Windows\System\oFNrbjI.exe
  C:\Windows\System\oFNrbjI.exe
  2⤵
  PID:4640
- C:\Windows\System\iSSQuur.exe
  C:\Windows\System\iSSQuur.exe
  2⤵
  PID:13104
- C:\Windows\System\LsJTPXP.exe
  C:\Windows\System\LsJTPXP.exe
  2⤵
  PID:2768
- C:\Windows\System\xMxTPUo.exe
  C:\Windows\System\xMxTPUo.exe
  2⤵
  PID:228
- C:\Windows\System\IXaXDjQ.exe
  C:\Windows\System\IXaXDjQ.exe
  2⤵
  PID:1096
- C:\Windows\System\kdqnlcI.exe
  C:\Windows\System\kdqnlcI.exe
  2⤵
  PID:5072
- C:\Windows\System\VOBJziY.exe
  C:\Windows\System\VOBJziY.exe
  2⤵
  PID:7508
- C:\Windows\System\SsNgilE.exe
  C:\Windows\System\SsNgilE.exe
  2⤵
  PID:5340
- C:\Windows\System\tdhfbAa.exe
  C:\Windows\System\tdhfbAa.exe
  2⤵
  PID:588
- C:\Windows\System\WXQFlqQ.exe
  C:\Windows\System\WXQFlqQ.exe
  2⤵
  PID:4348
- C:\Windows\System\odkZPWP.exe
  C:\Windows\System\odkZPWP.exe
  2⤵
  PID:1208
- C:\Windows\System\PADamTm.exe
  C:\Windows\System\PADamTm.exe
  2⤵
  PID:636
- C:\Windows\System\uVjWEXc.exe
  C:\Windows\System\uVjWEXc.exe
  2⤵
  PID:232
- C:\Windows\System\gtKaUNf.exe
  C:\Windows\System\gtKaUNf.exe
  2⤵
  PID:5532
- C:\Windows\System\XChCfZV.exe
  C:\Windows\System\XChCfZV.exe
  2⤵
  PID:752
- C:\Windows\System\TPMItfs.exe
  C:\Windows\System\TPMItfs.exe
  2⤵
  PID:5608
- C:\Windows\System\bFHYOJo.exe
  C:\Windows\System\bFHYOJo.exe
  2⤵
  PID:5588
- C:\Windows\System\ZBuXosx.exe
  C:\Windows\System\ZBuXosx.exe
  2⤵
  PID:1764
- C:\Windows\System\rMHDhtY.exe
  C:\Windows\System\rMHDhtY.exe
  2⤵
  PID:5636
- C:\Windows\System\TXWrOka.exe
  C:\Windows\System\TXWrOka.exe
  2⤵
  PID:3464
- C:\Windows\System\YPYDFmv.exe
  C:\Windows\System\YPYDFmv.exe
  2⤵
  PID:4188
- C:\Windows\System\zafzlKN.exe
  C:\Windows\System\zafzlKN.exe
  2⤵
  PID:916
- C:\Windows\System\PhBNGPF.exe
  C:\Windows\System\PhBNGPF.exe
  2⤵
  PID:5048
- C:\Windows\System\UvixJFF.exe
  C:\Windows\System\UvixJFF.exe
  2⤵
  PID:8
- C:\Windows\System\VKaLDxI.exe
  C:\Windows\System\VKaLDxI.exe
  2⤵
  PID:12296
- C:\Windows\System\vltwotp.exe
  C:\Windows\System\vltwotp.exe
  2⤵
  PID:5692
- C:\Windows\System\jOMdENM.exe
  C:\Windows\System\jOMdENM.exe
  2⤵
  PID:3244
- C:\Windows\System\WoeZnfa.exe
  C:\Windows\System\WoeZnfa.exe
  2⤵
  PID:3516
- C:\Windows\System\OOuUHNn.exe
  C:\Windows\System\OOuUHNn.exe
  2⤵
  PID:8004
- C:\Windows\System\pfziHgW.exe
  C:\Windows\System\pfziHgW.exe
  2⤵
  PID:4208
- C:\Windows\System\cgMKljb.exe
  C:\Windows\System\cgMKljb.exe
  2⤵
  PID:3520
- C:\Windows\System\cvOBOMQ.exe
  C:\Windows\System\cvOBOMQ.exe
  2⤵
  PID:8024
- C:\Windows\System\gfWyysc.exe
  C:\Windows\System\gfWyysc.exe
  2⤵
  PID:8080
- C:\Windows\System\lbxXFfI.exe
  C:\Windows\System\lbxXFfI.exe
  2⤵
  PID:8172
- C:\Windows\System\YPwoDLn.exe
  C:\Windows\System\YPwoDLn.exe
  2⤵
  PID:7204
- C:\Windows\System\BQyDxbp.exe
  C:\Windows\System\BQyDxbp.exe
  2⤵
  PID:7256
- C:\Windows\System\GUubGzN.exe
  C:\Windows\System\GUubGzN.exe
  2⤵
  PID:7384
- C:\Windows\System\ZSqaTfr.exe
  C:\Windows\System\ZSqaTfr.exe
  2⤵
  PID:6388
- C:\Windows\System\uNPefTd.exe
  C:\Windows\System\uNPefTd.exe
  2⤵
  PID:7680
- C:\Windows\System\coavsZk.exe
  C:\Windows\System\coavsZk.exe
  2⤵
  PID:12936
- C:\Windows\System\UNXaqNG.exe
  C:\Windows\System\UNXaqNG.exe
  2⤵
  PID:5812
- C:\Windows\System\eDNHLJO.exe
  C:\Windows\System\eDNHLJO.exe
  2⤵
  PID:12976
- C:\Windows\System\BuTVEGv.exe
  C:\Windows\System\BuTVEGv.exe
  2⤵
  PID:5900
- C:\Windows\System\MLYbbUS.exe
  C:\Windows\System\MLYbbUS.exe
  2⤵
  PID:5956
- C:\Windows\System\OeQcEle.exe
  C:\Windows\System\OeQcEle.exe
  2⤵
  PID:2264
- C:\Windows\System\vTrNisP.exe
  C:\Windows\System\vTrNisP.exe
  2⤵
  PID:4120
- C:\Windows\System\RSVUvTQ.exe
  C:\Windows\System\RSVUvTQ.exe
  2⤵
  PID:6036
- C:\Windows\System\GYPiTyT.exe
  C:\Windows\System\GYPiTyT.exe
  2⤵
  PID:8124
- C:\Windows\System\riqkTdW.exe
  C:\Windows\System\riqkTdW.exe
  2⤵
  PID:12908
- C:\Windows\System\vKwhwhs.exe
  C:\Windows\System\vKwhwhs.exe
  2⤵
  PID:12812
- C:\Windows\System\UIGPLXa.exe
  C:\Windows\System\UIGPLXa.exe
  2⤵
  PID:1728
- C:\Windows\System\nDceZjr.exe
  C:\Windows\System\nDceZjr.exe
  2⤵
  PID:2720
- C:\Windows\System\UWLzALm.exe
  C:\Windows\System\UWLzALm.exe
  2⤵
  PID:7112
- C:\Windows\System\zJNHcgs.exe
  C:\Windows\System\zJNHcgs.exe
  2⤵
  PID:6120
- C:\Windows\System\GduqSNE.exe
  C:\Windows\System\GduqSNE.exe
  2⤵
  PID:7612
- C:\Windows\System\XIJDrrK.exe
  C:\Windows\System\XIJDrrK.exe
  2⤵
  PID:3836
- C:\Windows\System\rtAaqRi.exe
  C:\Windows\System\rtAaqRi.exe
  2⤵
  PID:3992
- C:\Windows\System\bTGIhCr.exe
  C:\Windows\System\bTGIhCr.exe
  2⤵
  PID:13008
- C:\Windows\System\eTGHFmn.exe
  C:\Windows\System\eTGHFmn.exe
  2⤵
  PID:6668
- C:\Windows\System\HezsRot.exe
  C:\Windows\System\HezsRot.exe
  2⤵
  PID:4416
- C:\Windows\System\AwuTHiG.exe
  C:\Windows\System\AwuTHiG.exe
  2⤵
  PID:12932
- C:\Windows\System\mxVWdSr.exe
  C:\Windows\System\mxVWdSr.exe
  2⤵
  PID:5228
- C:\Windows\System\LFmJHmW.exe
  C:\Windows\System\LFmJHmW.exe
  2⤵
  PID:2308
- C:\Windows\System\NNZtkRz.exe
  C:\Windows\System\NNZtkRz.exe
  2⤵
  PID:7440
- C:\Windows\System\QWbJAGP.exe
  C:\Windows\System\QWbJAGP.exe
  2⤵
  PID:4252
- C:\Windows\System\duqDAqB.exe
  C:\Windows\System\duqDAqB.exe
  2⤵
  PID:2376
- C:\Windows\System\XTCEUwI.exe
  C:\Windows\System\XTCEUwI.exe
  2⤵
  PID:5368
- C:\Windows\System\CFNqnvy.exe
  C:\Windows\System\CFNqnvy.exe
  2⤵
  PID:8232
- C:\Windows\System\wGrnJsF.exe
  C:\Windows\System\wGrnJsF.exe
  2⤵
  PID:5264
- C:\Windows\System\vXtFCGS.exe
  C:\Windows\System\vXtFCGS.exe
  2⤵
  PID:4560
- C:\Windows\System\IWbMvCH.exe
  C:\Windows\System\IWbMvCH.exe
  2⤵
  PID:5364
- C:\Windows\System\kTswwRg.exe
  C:\Windows\System\kTswwRg.exe
  2⤵
  PID:1800
- C:\Windows\System\LykZaju.exe
  C:\Windows\System\LykZaju.exe
  2⤵
  PID:416
- C:\Windows\System\FqmFIxf.exe
  C:\Windows\System\FqmFIxf.exe
  2⤵
  PID:8488
- C:\Windows\System\OEJywgC.exe
  C:\Windows\System\OEJywgC.exe
  2⤵
  PID:8548
- C:\Windows\System\jkHVIpP.exe
  C:\Windows\System\jkHVIpP.exe
  2⤵
  PID:3612
- C:\Windows\System\JFtTZcl.exe
  C:\Windows\System\JFtTZcl.exe
  2⤵
  PID:5256
- C:\Windows\System\GsgNCdv.exe
  C:\Windows\System\GsgNCdv.exe
  2⤵
  PID:2852
- C:\Windows\System\mdRcwwt.exe
  C:\Windows\System\mdRcwwt.exe
  2⤵
  PID:1864
- C:\Windows\System\uQsqxWD.exe
  C:\Windows\System\uQsqxWD.exe
  2⤵
  PID:8576
- C:\Windows\System\aDXakRk.exe
  C:\Windows\System\aDXakRk.exe
  2⤵
  PID:5452
- C:\Windows\System\AVOlhIN.exe
  C:\Windows\System\AVOlhIN.exe
  2⤵
  PID:8656
- C:\Windows\System\XvhEFcb.exe
  C:\Windows\System\XvhEFcb.exe
  2⤵
  PID:3904
- C:\Windows\System\qCAnihd.exe
  C:\Windows\System\qCAnihd.exe
  2⤵
  PID:8676
- C:\Windows\System\amdNgeK.exe
  C:\Windows\System\amdNgeK.exe
  2⤵
  PID:7588
- C:\Windows\System\iODrpHV.exe
  C:\Windows\System\iODrpHV.exe
  2⤵
  PID:13088
- C:\Windows\System\BoPGULF.exe
  C:\Windows\System\BoPGULF.exe
  2⤵
  PID:5504
- C:\Windows\System\spDRHpR.exe
  C:\Windows\System\spDRHpR.exe
  2⤵
  PID:2528
- C:\Windows\System\pKWbDIM.exe
  C:\Windows\System\pKWbDIM.exe
  2⤵
  PID:5292
- C:\Windows\System\VnuaBvK.exe
  C:\Windows\System\VnuaBvK.exe
  2⤵
  PID:5428
- C:\Windows\System\mLdnViu.exe
  C:\Windows\System\mLdnViu.exe
  2⤵
  PID:5548
- C:\Windows\System\cbROTZc.exe
  C:\Windows\System\cbROTZc.exe
  2⤵
  PID:4184
- C:\Windows\System\mnvyOlV.exe
  C:\Windows\System\mnvyOlV.exe
  2⤵
  PID:7656
- C:\Windows\System\yvFmTpF.exe
  C:\Windows\System\yvFmTpF.exe
  2⤵
  PID:7952
- C:\Windows\System\fnIUkjN.exe
  C:\Windows\System\fnIUkjN.exe
  2⤵
  PID:8928
- C:\Windows\System\xsEHrjg.exe
  C:\Windows\System\xsEHrjg.exe
  2⤵
  PID:5684
- C:\Windows\System\knjVTrY.exe
  C:\Windows\System\knjVTrY.exe
  2⤵
  PID:5820
- C:\Windows\System\uNnXiJx.exe
  C:\Windows\System\uNnXiJx.exe
  2⤵
  PID:4572
- C:\Windows\System\FOkgHye.exe
  C:\Windows\System\FOkgHye.exe
  2⤵
  PID:12236
- C:\Windows\System\RXxqQVi.exe
  C:\Windows\System\RXxqQVi.exe
  2⤵
  PID:8040
- C:\Windows\System\eYrppJo.exe
  C:\Windows\System\eYrppJo.exe
  2⤵
  PID:2600
- C:\Windows\System\rnoCkFF.exe
  C:\Windows\System\rnoCkFF.exe
  2⤵
  PID:5784
- C:\Windows\System\dtSLcgF.exe
  C:\Windows\System\dtSLcgF.exe
  2⤵
  PID:2536
- C:\Windows\System\QkbjYHu.exe
  C:\Windows\System\QkbjYHu.exe
  2⤵
  PID:7248
- C:\Windows\System\IHbDQeg.exe
  C:\Windows\System\IHbDQeg.exe
  2⤵
  PID:5756
- C:\Windows\System\FKzBwlj.exe
  C:\Windows\System\FKzBwlj.exe
  2⤵
  PID:8100
- C:\Windows\System\TDLwagD.exe
  C:\Windows\System\TDLwagD.exe
  2⤵
  PID:2868
- C:\Windows\System\XjYkasg.exe
  C:\Windows\System\XjYkasg.exe
  2⤵
  PID:3952
- C:\Windows\System\ivVNdRf.exe
  C:\Windows\System\ivVNdRf.exe
  2⤵
  PID:6916
- C:\Windows\System\CXyDCdq.exe
  C:\Windows\System\CXyDCdq.exe
  2⤵
  PID:7636
- C:\Windows\System\WjYDvdr.exe
  C:\Windows\System\WjYDvdr.exe
  2⤵
  PID:7764
- C:\Windows\System\kgPqjRb.exe
  C:\Windows\System\kgPqjRb.exe
  2⤵
  PID:5832
- C:\Windows\System\RXuLJFm.exe
  C:\Windows\System\RXuLJFm.exe
  2⤵
  PID:5372
- C:\Windows\System\EPaokzo.exe
  C:\Windows\System\EPaokzo.exe
  2⤵
  PID:5512
- C:\Windows\System\FFxgNEc.exe
  C:\Windows\System\FFxgNEc.exe
  2⤵
  PID:5764
- C:\Windows\System\dsEeUzY.exe
  C:\Windows\System\dsEeUzY.exe
  2⤵
  PID:8052
- C:\Windows\System\bckPBQy.exe
  C:\Windows\System\bckPBQy.exe
  2⤵
  PID:5996
- C:\Windows\System\ZcwwEEJ.exe
  C:\Windows\System\ZcwwEEJ.exe
  2⤵
  PID:6148
- C:\Windows\System\AcxVNSO.exe
  C:\Windows\System\AcxVNSO.exe
  2⤵
  PID:13160
- C:\Windows\System\EXMqDsJ.exe
  C:\Windows\System\EXMqDsJ.exe
  2⤵
  PID:6168
- C:\Windows\System\bOqSceV.exe
  C:\Windows\System\bOqSceV.exe
  2⤵
  PID:4660
- C:\Windows\System\BdgxLJe.exe
  C:\Windows\System\BdgxLJe.exe
  2⤵
  PID:3024
- C:\Windows\System\EbHPJWW.exe
  C:\Windows\System\EbHPJWW.exe
  2⤵
  PID:7424
- C:\Windows\System\aorveOZ.exe
  C:\Windows\System\aorveOZ.exe
  2⤵
  PID:6260
- C:\Windows\System\yjFGgkg.exe
  C:\Windows\System\yjFGgkg.exe
  2⤵
  PID:7592
- C:\Windows\System\heQJTlY.exe
  C:\Windows\System\heQJTlY.exe
  2⤵
  PID:6288
- C:\Windows\System\feMvBlz.exe
  C:\Windows\System\feMvBlz.exe
  2⤵
  PID:1916
- C:\Windows\System\pBPNEww.exe
  C:\Windows\System\pBPNEww.exe
  2⤵
  PID:8940
- C:\Windows\System\fpbaJFL.exe
  C:\Windows\System\fpbaJFL.exe
  2⤵
  PID:960
- C:\Windows\System\NBKrsSG.exe
  C:\Windows\System\NBKrsSG.exe
  2⤵
  PID:7676
- C:\Windows\System\VvPwupe.exe
  C:\Windows\System\VvPwupe.exe
  2⤵
  PID:6320
- C:\Windows\System\oaeZUsS.exe
  C:\Windows\System\oaeZUsS.exe
  2⤵
  PID:1328
- C:\Windows\System\IaFLRvq.exe
  C:\Windows\System\IaFLRvq.exe
  2⤵
  PID:5156
- C:\Windows\System\oKypLYY.exe
  C:\Windows\System\oKypLYY.exe
  2⤵
  PID:4020
- C:\Windows\System\AufjeJg.exe
  C:\Windows\System\AufjeJg.exe
  2⤵
  PID:8420
- C:\Windows\System\wPijqEg.exe
  C:\Windows\System\wPijqEg.exe
  2⤵
  PID:2428
- C:\Windows\System\PAaVKCr.exe
  C:\Windows\System\PAaVKCr.exe
  2⤵
  PID:8500
- C:\Windows\System\ZhxdatC.exe
  C:\Windows\System\ZhxdatC.exe
  2⤵
  PID:3760
- C:\Windows\System\DIgSqmW.exe
  C:\Windows\System\DIgSqmW.exe
  2⤵
  PID:6504
- C:\Windows\System\iMPJplu.exe
  C:\Windows\System\iMPJplu.exe
  2⤵
  PID:9492
- C:\Windows\System\DkQppqS.exe
  C:\Windows\System\DkQppqS.exe
  2⤵
  PID:9536
- C:\Windows\System\ScBLkVZ.exe
  C:\Windows\System\ScBLkVZ.exe
  2⤵
  PID:6532
- C:\Windows\System\tTCPDRT.exe
  C:\Windows\System\tTCPDRT.exe
  2⤵
  PID:2092
- C:\Windows\System\jzPApoA.exe
  C:\Windows\System\jzPApoA.exe
  2⤵
  PID:6568
- C:\Windows\System\rumfatt.exe
  C:\Windows\System\rumfatt.exe
  2⤵
  PID:9612
- C:\Windows\System\nhKwoFF.exe
  C:\Windows\System\nhKwoFF.exe
  2⤵
  PID:8652
- C:\Windows\System\gFyVRek.exe
  C:\Windows\System\gFyVRek.exe
  2⤵
  PID:4148
- C:\Windows\System\GtbMANy.exe
  C:\Windows\System\GtbMANy.exe
  2⤵
  PID:7568
- C:\Windows\System\RQGnSIs.exe
  C:\Windows\System\RQGnSIs.exe
  2⤵
  PID:9752
- C:\Windows\System\IoFuyon.exe
  C:\Windows\System\IoFuyon.exe
  2⤵
  PID:460
- C:\Windows\System\sbCroxx.exe
  C:\Windows\System\sbCroxx.exe
  2⤵
  PID:9792
- C:\Windows\System\mNHbNdG.exe
  C:\Windows\System\mNHbNdG.exe
  2⤵
  PID:2872
- C:\Windows\System\qPuuHTO.exe
  C:\Windows\System\qPuuHTO.exe
  2⤵
  PID:2156
- C:\Windows\System\EIUFVKj.exe
  C:\Windows\System\EIUFVKj.exe
  2⤵
  PID:6684
- C:\Windows\System\XeKxuuO.exe
  C:\Windows\System\XeKxuuO.exe
  2⤵
  PID:5604
- C:\Windows\System\bGVkdEO.exe
  C:\Windows\System\bGVkdEO.exe
  2⤵
  PID:6712
- C:\Windows\System\HAsFaiv.exe
  C:\Windows\System\HAsFaiv.exe
  2⤵
  PID:5624
- C:\Windows\System\OVGIEmJ.exe
  C:\Windows\System\OVGIEmJ.exe
  2⤵
  PID:6792
- C:\Windows\System\pimiKwy.exe
  C:\Windows\System\pimiKwy.exe
  2⤵
  PID:7824
- C:\Windows\System\REuswPu.exe
  C:\Windows\System\REuswPu.exe
  2⤵
  PID:5752
- C:\Windows\System\JUTQRlF.exe
  C:\Windows\System\JUTQRlF.exe
  2⤵
  PID:6824
- C:\Windows\System\Uaibqha.exe
  C:\Windows\System\Uaibqha.exe
  2⤵
  PID:8028
- C:\Windows\System\krGzHtD.exe
  C:\Windows\System\krGzHtD.exe
  2⤵
  PID:8140
- C:\Windows\System\IGAtoBG.exe
  C:\Windows\System\IGAtoBG.exe
  2⤵
  PID:780
- C:\Windows\System\RnCUWVC.exe
  C:\Windows\System\RnCUWVC.exe
  2⤵
  PID:6908
- C:\Windows\System\aNCUGDc.exe
  C:\Windows\System\aNCUGDc.exe
  2⤵
  PID:6936
- C:\Windows\System\oJyUUoQ.exe
  C:\Windows\System\oJyUUoQ.exe
  2⤵
  PID:2744
- C:\Windows\System\JNnCIIV.exe
  C:\Windows\System\JNnCIIV.exe
  2⤵
  PID:7736
- C:\Windows\System\dejSiic.exe
  C:\Windows\System\dejSiic.exe
  2⤵
  PID:7008
- C:\Windows\System\ZMLwbaM.exe
  C:\Windows\System\ZMLwbaM.exe
  2⤵
  PID:9588
- C:\Windows\System\jyasYBI.exe
  C:\Windows\System\jyasYBI.exe
  2⤵
  PID:9680
- C:\Windows\System\XeNKcYe.exe
  C:\Windows\System\XeNKcYe.exe
  2⤵
  PID:9760
- C:\Windows\System\PEKzgHz.exe
  C:\Windows\System\PEKzgHz.exe
  2⤵
  PID:7072
- C:\Windows\System\bIhdefK.exe
  C:\Windows\System\bIhdefK.exe
  2⤵
  PID:3892
- C:\Windows\System\WHUalAN.exe
  C:\Windows\System\WHUalAN.exe
  2⤵
  PID:5652
- C:\Windows\System\QaZoaLs.exe
  C:\Windows\System\QaZoaLs.exe
  2⤵
  PID:9960
- C:\Windows\System\KFldkkY.exe
  C:\Windows\System\KFldkkY.exe
  2⤵
  PID:7120
- C:\Windows\System\CNeLxrE.exe
  C:\Windows\System\CNeLxrE.exe
  2⤵
  PID:8156
- C:\Windows\System\oPTPjwb.exe
  C:\Windows\System\oPTPjwb.exe
  2⤵
  PID:12592
- C:\Windows\System\OtCTtJx.exe
  C:\Windows\System\OtCTtJx.exe
  2⤵
  PID:9352
- C:\Windows\System\OmSQPvq.exe
  C:\Windows\System\OmSQPvq.exe
  2⤵
  PID:6180
- C:\Windows\System\ilesdxk.exe
  C:\Windows\System\ilesdxk.exe
  2⤵
  PID:6100
- C:\Windows\System\vrAtycf.exe
  C:\Windows\System\vrAtycf.exe
  2⤵
  PID:6208
- C:\Windows\System\zPJnLGA.exe
  C:\Windows\System\zPJnLGA.exe
  2⤵
  PID:5124
- C:\Windows\System\KwfEeKh.exe
  C:\Windows\System\KwfEeKh.exe
  2⤵
  PID:5376
- C:\Windows\System\UiDCbqo.exe
  C:\Windows\System\UiDCbqo.exe
  2⤵
  PID:6688
- C:\Windows\System\ARjROuq.exe
  C:\Windows\System\ARjROuq.exe
  2⤵
  PID:9040
- C:\Windows\System\wnrUByV.exe
  C:\Windows\System\wnrUByV.exe
  2⤵
  PID:3860
- C:\Windows\System\VuAZkUl.exe
  C:\Windows\System\VuAZkUl.exe
  2⤵
  PID:5964
- C:\Windows\System\SpvLhor.exe
  C:\Windows\System\SpvLhor.exe
  2⤵
  PID:6344
- C:\Windows\System\oiMiepI.exe
  C:\Windows\System\oiMiepI.exe
  2⤵
  PID:8888
- C:\Windows\System\gnYbhLP.exe
  C:\Windows\System\gnYbhLP.exe
  2⤵
  PID:8284
- C:\Windows\System\DtTSacQ.exe
  C:\Windows\System\DtTSacQ.exe
  2⤵
  PID:5312
- C:\Windows\System\cFYjLlG.exe
  C:\Windows\System\cFYjLlG.exe
  2⤵
  PID:3844
- C:\Windows\System\WccOUxx.exe
  C:\Windows\System\WccOUxx.exe
  2⤵
  PID:6364
- C:\Windows\System\OTHhofK.exe
  C:\Windows\System\OTHhofK.exe
  2⤵
  PID:6420
- C:\Windows\System\bFcQnXd.exe
  C:\Windows\System\bFcQnXd.exe
  2⤵
  PID:10372
- C:\Windows\System\XnDRUVs.exe
  C:\Windows\System\XnDRUVs.exe
  2⤵
  PID:8708
- C:\Windows\System\nmIXfBp.exe
  C:\Windows\System\nmIXfBp.exe
  2⤵
  PID:7604
- C:\Windows\System\vhIFQDi.exe
  C:\Windows\System\vhIFQDi.exe
  2⤵
  PID:1756
- C:\Windows\System\VcDovoF.exe
  C:\Windows\System\VcDovoF.exe
  2⤵
  PID:6348
- C:\Windows\System\dQBGObk.exe
  C:\Windows\System\dQBGObk.exe
  2⤵
  PID:6400
- C:\Windows\System\CyDIYHH.exe
  C:\Windows\System\CyDIYHH.exe
  2⤵
  PID:8624
- C:\Windows\System\hvZhYGt.exe
  C:\Windows\System\hvZhYGt.exe
  2⤵
  PID:6804
- C:\Windows\System\KDwvHay.exe
  C:\Windows\System\KDwvHay.exe
  2⤵
  PID:6572
- C:\Windows\System\RLWAHgr.exe
  C:\Windows\System\RLWAHgr.exe
  2⤵
  PID:9888
- C:\Windows\System\zdQblDA.exe
  C:\Windows\System\zdQblDA.exe
  2⤵
  PID:6244
- C:\Windows\System\GIdHgCR.exe
  C:\Windows\System\GIdHgCR.exe
  2⤵
  PID:5284
- C:\Windows\System\yfRzBkY.exe
  C:\Windows\System\yfRzBkY.exe
  2⤵
  PID:1084
- C:\Windows\System\PEsABIU.exe
  C:\Windows\System\PEsABIU.exe
  2⤵
  PID:6360
- C:\Windows\System\wLyrlBN.exe
  C:\Windows\System\wLyrlBN.exe
  2⤵
  PID:8560
- C:\Windows\System\RwDlIiL.exe
  C:\Windows\System\RwDlIiL.exe
  2⤵
  PID:7488
- C:\Windows\System\ceVmVwd.exe
  C:\Windows\System\ceVmVwd.exe
  2⤵
  PID:10512
- C:\Windows\System\rjWPaku.exe
  C:\Windows\System\rjWPaku.exe
  2⤵
  PID:6528
- C:\Windows\System\WKupfMH.exe
  C:\Windows\System\WKupfMH.exe
  2⤵
  PID:6736
- C:\Windows\System\COmHTUI.exe
  C:\Windows\System\COmHTUI.exe
  2⤵
  PID:6764
- C:\Windows\System\aLFnAhA.exe
  C:\Windows\System\aLFnAhA.exe
  2⤵
  PID:5880
- C:\Windows\System\SuQoWgq.exe
  C:\Windows\System\SuQoWgq.exe
  2⤵
  PID:2896
- C:\Windows\System\TelJbyS.exe
  C:\Windows\System\TelJbyS.exe
  2⤵
  PID:5560
- C:\Windows\System\pAOOFhS.exe
  C:\Windows\System\pAOOFhS.exe
  2⤵
  PID:6664
- C:\Windows\System\rxaMZUb.exe
  C:\Windows\System\rxaMZUb.exe
  2⤵
  PID:6776
- C:\Windows\System\EBHmory.exe
  C:\Windows\System\EBHmory.exe
  2⤵
  PID:6840
- C:\Windows\System\IAkpGHi.exe
  C:\Windows\System\IAkpGHi.exe
  2⤵
  PID:6932
- C:\Windows\System\adfTNVV.exe
  C:\Windows\System\adfTNVV.exe
  2⤵
  PID:6780
- C:\Windows\System\VnGxawe.exe
  C:\Windows\System\VnGxawe.exe
  2⤵
  PID:8444
- C:\Windows\System\JcPnrad.exe
  C:\Windows\System\JcPnrad.exe
  2⤵
  PID:6952
- C:\Windows\System\eBsgXnR.exe
  C:\Windows\System\eBsgXnR.exe
  2⤵
  PID:6944
- C:\Windows\System\gEsiXya.exe
  C:\Windows\System\gEsiXya.exe
  2⤵
  PID:7456
- C:\Windows\System\hmqvBWj.exe
  C:\Windows\System\hmqvBWj.exe
  2⤵
  PID:7004
- C:\Windows\System\wAWxPok.exe
  C:\Windows\System\wAWxPok.exe
  2⤵
  PID:5176
- C:\Windows\System\oNIOKsu.exe
  C:\Windows\System\oNIOKsu.exe
  2⤵
  PID:5816
- C:\Windows\System\xkBDclC.exe
  C:\Windows\System\xkBDclC.exe
  2⤵
  PID:5436
- C:\Windows\System\kmqwsmQ.exe
  C:\Windows\System\kmqwsmQ.exe
  2⤵
  PID:5972
- C:\Windows\System\MPLkXxj.exe
  C:\Windows\System\MPLkXxj.exe
  2⤵
  PID:7076
- C:\Windows\System\pHkcaKm.exe
  C:\Windows\System\pHkcaKm.exe
  2⤵
  PID:2396
- C:\Windows\System\OCrRwza.exe
  C:\Windows\System\OCrRwza.exe
  2⤵
  PID:1052
- C:\Windows\System\jppppWa.exe
  C:\Windows\System\jppppWa.exe
  2⤵
  PID:5432
- C:\Windows\System\aUDkizP.exe
  C:\Windows\System\aUDkizP.exe
  2⤵
  PID:12628
- C:\Windows\System\zHlGmGm.exe
  C:\Windows\System\zHlGmGm.exe
  2⤵
  PID:10228
- C:\Windows\System\Shedihz.exe
  C:\Windows\System\Shedihz.exe
  2⤵
  PID:11076
- C:\Windows\System\gIHueoM.exe
  C:\Windows\System\gIHueoM.exe
  2⤵
  PID:3392
- C:\Windows\System\DCmnhJW.exe
  C:\Windows\System\DCmnhJW.exe
  2⤵
  PID:8792
- C:\Windows\System\xahNZgj.exe
  C:\Windows\System\xahNZgj.exe
  2⤵
  PID:2492
- C:\Windows\System\gVoNQpq.exe
  C:\Windows\System\gVoNQpq.exe
  2⤵
  PID:5144
- C:\Windows\System\MYphIsF.exe
  C:\Windows\System\MYphIsF.exe
  2⤵
  PID:11236
- C:\Windows\System\ovLGFxn.exe
  C:\Windows\System\ovLGFxn.exe
  2⤵
  PID:9248
- C:\Windows\System\CVNRGcz.exe
  C:\Windows\System\CVNRGcz.exe
  2⤵
  PID:4908
- C:\Windows\System\MCSTXPx.exe
  C:\Windows\System\MCSTXPx.exe
  2⤵
  PID:6404
- C:\Windows\System\nAwIwai.exe
  C:\Windows\System\nAwIwai.exe
  2⤵
  PID:1016
- C:\Windows\System\XPHPWcd.exe
  C:\Windows\System\XPHPWcd.exe
  2⤵
  PID:6300
- C:\Windows\System\jEyPjOX.exe
  C:\Windows\System\jEyPjOX.exe
  2⤵
  PID:4936
- C:\Windows\System\mBJwbUv.exe
  C:\Windows\System\mBJwbUv.exe
  2⤵
  PID:11112
- C:\Windows\System\XxVARqV.exe
  C:\Windows\System\XxVARqV.exe
  2⤵
  PID:9584
- C:\Windows\System\dyZArzq.exe
  C:\Windows\System\dyZArzq.exe
  2⤵
  PID:6628
- C:\Windows\System\BSyZViI.exe
  C:\Windows\System\BSyZViI.exe
  2⤵
  PID:4484
- C:\Windows\System\AHFcqmO.exe
  C:\Windows\System\AHFcqmO.exe
  2⤵
  PID:5936
- C:\Windows\System\CPSYoGT.exe
  C:\Windows\System\CPSYoGT.exe
  2⤵
  PID:6548
- C:\Windows\System\UvbAXNl.exe
  C:\Windows\System\UvbAXNl.exe
  2⤵
  PID:10476
- C:\Windows\System\obnfKRS.exe
  C:\Windows\System\obnfKRS.exe
  2⤵
  PID:5396
- C:\Windows\System\bXyCijR.exe
  C:\Windows\System\bXyCijR.exe
  2⤵
  PID:5748
- C:\Windows\System\jYkFvpA.exe
  C:\Windows\System\jYkFvpA.exe
  2⤵
  PID:6832
- C:\Windows\System\MZPrOWF.exe
  C:\Windows\System\MZPrOWF.exe
  2⤵
  PID:11212
- C:\Windows\System\nOqDaGB.exe
  C:\Windows\System\nOqDaGB.exe
  2⤵
  PID:10640
- C:\Windows\System\fFEWayt.exe
  C:\Windows\System\fFEWayt.exe
  2⤵
  PID:6988
- C:\Windows\System\lRDpnxd.exe
  C:\Windows\System\lRDpnxd.exe
  2⤵
  PID:7532
- C:\Windows\System\UKCAETB.exe
  C:\Windows\System\UKCAETB.exe
  2⤵
  PID:1588
- C:\Windows\System\jxlROrq.exe
  C:\Windows\System\jxlROrq.exe
  2⤵
  PID:5236
- C:\Windows\System\FKguctr.exe
  C:\Windows\System\FKguctr.exe
  2⤵
  PID:7044
- C:\Windows\System\klxBwAl.exe
  C:\Windows\System\klxBwAl.exe
  2⤵
  PID:7080
- C:\Windows\System\ZbdHhqH.exe
  C:\Windows\System\ZbdHhqH.exe
  2⤵
  PID:1260
- C:\Windows\System\izcvwLt.exe
  C:\Windows\System\izcvwLt.exe
  2⤵
  PID:9976
- C:\Windows\System\vCWKgbA.exe
  C:\Windows\System\vCWKgbA.exe
  2⤵
  PID:12960
- C:\Windows\System\zpukzLI.exe
  C:\Windows\System\zpukzLI.exe
  2⤵
  PID:10924
- C:\Windows\System\KKjkItC.exe
  C:\Windows\System\KKjkItC.exe
  2⤵
  PID:10200
- C:\Windows\System\KUBtZrg.exe
  C:\Windows\System\KUBtZrg.exe
  2⤵
  PID:12516
- C:\Windows\System\ViBuSYu.exe
  C:\Windows\System\ViBuSYu.exe
  2⤵
  PID:11472
- C:\Windows\System\PoEqvWS.exe
  C:\Windows\System\PoEqvWS.exe
  2⤵
  PID:9548
- C:\Windows\System\pgzKvAW.exe
  C:\Windows\System\pgzKvAW.exe
  2⤵
  PID:11512
- C:\Windows\System\dRwUDlR.exe
  C:\Windows\System\dRwUDlR.exe
  2⤵
  PID:11132
- C:\Windows\System\UpwihjD.exe
  C:\Windows\System\UpwihjD.exe
  2⤵
  PID:11600
- C:\Windows\System\QTDDoGo.exe
  C:\Windows\System\QTDDoGo.exe
  2⤵
  PID:10664
- C:\Windows\System\RTsgGTh.exe
  C:\Windows\System\RTsgGTh.exe
  2⤵
  PID:8732
- C:\Windows\System\IgALQCo.exe
  C:\Windows\System\IgALQCo.exe
  2⤵
  PID:11164
- C:\Windows\System\MiQhPTG.exe
  C:\Windows\System\MiQhPTG.exe
  2⤵
  PID:2028
- C:\Windows\System\EZioBdb.exe
  C:\Windows\System\EZioBdb.exe
  2⤵
  PID:10804
- C:\Windows\System\MHqVAgM.exe
  C:\Windows\System\MHqVAgM.exe
  2⤵
  PID:9732
- C:\Windows\System\nlQREjR.exe
  C:\Windows\System\nlQREjR.exe
  2⤵
  PID:10628
- C:\Windows\System\qbqKioR.exe
  C:\Windows\System\qbqKioR.exe
  2⤵
  PID:5252
- C:\Windows\System\HsxIoVZ.exe
  C:\Windows\System\HsxIoVZ.exe
  2⤵
  PID:9756
- C:\Windows\System\jgcBjBE.exe
  C:\Windows\System\jgcBjBE.exe
  2⤵
  PID:10352
- C:\Windows\System\ddFsXpo.exe
  C:\Windows\System\ddFsXpo.exe
  2⤵
  PID:9708
- C:\Windows\System\IGaawls.exe
  C:\Windows\System\IGaawls.exe
  2⤵
  PID:1872
- C:\Windows\System\FBLLjdH.exe
  C:\Windows\System\FBLLjdH.exe
  2⤵
  PID:7524
- C:\Windows\System\QaxYFsu.exe
  C:\Windows\System\QaxYFsu.exe
  2⤵
  PID:11912
- C:\Windows\System\cEmpyvc.exe
  C:\Windows\System\cEmpyvc.exe
  2⤵
  PID:9452
- C:\Windows\System\GNHycSD.exe
  C:\Windows\System\GNHycSD.exe
  2⤵
  PID:11000
- C:\Windows\System\NsMdryS.exe
  C:\Windows\System\NsMdryS.exe
  2⤵
  PID:9476
- C:\Windows\System\sFtoTVp.exe
  C:\Windows\System\sFtoTVp.exe
  2⤵
  PID:11168
- C:\Windows\System\phSSsGg.exe
  C:\Windows\System\phSSsGg.exe
  2⤵
  PID:12032
- C:\Windows\System\yMLQGDS.exe
  C:\Windows\System\yMLQGDS.exe
  2⤵
  PID:4076
- C:\Windows\System\gddEgSd.exe
  C:\Windows\System\gddEgSd.exe
  2⤵
  PID:12108
- C:\Windows\System\sokDzgu.exe
  C:\Windows\System\sokDzgu.exe
  2⤵
  PID:7932
- C:\Windows\System\omivcYy.exe
  C:\Windows\System\omivcYy.exe
  2⤵
  PID:2316
- C:\Windows\System\aSLlSKe.exe
  C:\Windows\System\aSLlSKe.exe
  2⤵
  PID:12220
- C:\Windows\System\chkZtyY.exe
  C:\Windows\System\chkZtyY.exe
  2⤵
  PID:6836
- C:\Windows\System\pmInTUs.exe
  C:\Windows\System\pmInTUs.exe
  2⤵
  PID:11268
- C:\Windows\System\YkZOIsk.exe
  C:\Windows\System\YkZOIsk.exe
  2⤵
  PID:11324
- C:\Windows\System\yZAHiDB.exe
  C:\Windows\System\yZAHiDB.exe
  2⤵
  PID:11364
- C:\Windows\System\AKxTvGP.exe
  C:\Windows\System\AKxTvGP.exe
  2⤵
  PID:7108
- C:\Windows\System\BiDLSYQ.exe
  C:\Windows\System\BiDLSYQ.exe
  2⤵
  PID:5576
- C:\Windows\System\ssDuTGa.exe
  C:\Windows\System\ssDuTGa.exe
  2⤵
  PID:11628
- C:\Windows\System\bKtNMjm.exe
  C:\Windows\System\bKtNMjm.exe
  2⤵
  PID:4352
- C:\Windows\System\KVAUvBo.exe
  C:\Windows\System\KVAUvBo.exe
  2⤵
  PID:7132
- C:\Windows\System\ygsKaMF.exe
  C:\Windows\System\ygsKaMF.exe
  2⤵
  PID:11800
- C:\Windows\System\jUISwKZ.exe
  C:\Windows\System\jUISwKZ.exe
  2⤵
  PID:11060
- C:\Windows\System\ZqzGqfY.exe
  C:\Windows\System\ZqzGqfY.exe
  2⤵
  PID:11552
- C:\Windows\System\GfMoNRs.exe
  C:\Windows\System\GfMoNRs.exe
  2⤵
  PID:10572
- C:\Windows\System\iQWbeFr.exe
  C:\Windows\System\iQWbeFr.exe
  2⤵
  PID:7924
- C:\Windows\System\mZAoSVf.exe
  C:\Windows\System\mZAoSVf.exe
  2⤵
  PID:7828
- C:\Windows\System\PhIAHEb.exe
  C:\Windows\System\PhIAHEb.exe
  2⤵
  PID:9288
- C:\Windows\System\XWzxCXi.exe
  C:\Windows\System\XWzxCXi.exe
  2⤵
  PID:6212
- C:\Windows\System\XWzqCfv.exe
  C:\Windows\System\XWzqCfv.exe
  2⤵
  PID:10552
- C:\Windows\System\RsluRZA.exe
  C:\Windows\System\RsluRZA.exe
  2⤵
  PID:11864
- C:\Windows\System\ZLLfSRX.exe
  C:\Windows\System\ZLLfSRX.exe
  2⤵
  PID:11960
- C:\Windows\System\DqmnpVm.exe
  C:\Windows\System\DqmnpVm.exe
  2⤵
  PID:6332
- C:\Windows\System\PGejsHL.exe
  C:\Windows\System\PGejsHL.exe
  2⤵
  PID:11996
- C:\Windows\System\bZRUfNs.exe
  C:\Windows\System\bZRUfNs.exe
  2⤵
  PID:3816
- C:\Windows\System\GajNRdV.exe
  C:\Windows\System\GajNRdV.exe
  2⤵
  PID:7916
- C:\Windows\System\QMXlrrN.exe
  C:\Windows\System\QMXlrrN.exe
  2⤵
  PID:10312
- C:\Windows\System\sPwfQMx.exe
  C:\Windows\System\sPwfQMx.exe
  2⤵
  PID:10896
- C:\Windows\System\WXOsosx.exe
  C:\Windows\System\WXOsosx.exe
  2⤵
  PID:11272
- C:\Windows\System\tEEXzal.exe
  C:\Windows\System\tEEXzal.exe
  2⤵
  PID:11596
- C:\Windows\System\PDMxKke.exe
  C:\Windows\System\PDMxKke.exe
  2⤵
  PID:2808
- C:\Windows\System\UokIrEw.exe
  C:\Windows\System\UokIrEw.exe
  2⤵
  PID:11436
- C:\Windows\System\lZMYmVc.exe
  C:\Windows\System\lZMYmVc.exe
  2⤵
  PID:10180
- C:\Windows\System\uRifwRY.exe
  C:\Windows\System\uRifwRY.exe
  2⤵
  PID:7236
- C:\Windows\System\XJTlyeI.exe
  C:\Windows\System\XJTlyeI.exe
  2⤵
  PID:9052
- C:\Windows\System\eBAltfr.exe
  C:\Windows\System\eBAltfr.exe
  2⤵
  PID:6596
- C:\Windows\System\yyjFloE.exe
  C:\Windows\System\yyjFloE.exe
  2⤵
  PID:11480
- C:\Windows\System\BwbVLsV.exe
  C:\Windows\System\BwbVLsV.exe
  2⤵
  PID:6896
- C:\Windows\System\OVJGvgp.exe
  C:\Windows\System\OVJGvgp.exe
  2⤵
  PID:11948
- C:\Windows\System\EaHlXvs.exe
  C:\Windows\System\EaHlXvs.exe
  2⤵
  PID:7332
- C:\Windows\System\wXmnavm.exe
  C:\Windows\System\wXmnavm.exe
  2⤵
  PID:12928
- C:\Windows\System\MqJszxP.exe
  C:\Windows\System\MqJszxP.exe
  2⤵
  PID:12980
- C:\Windows\System\ISFOgXE.exe
  C:\Windows\System\ISFOgXE.exe
  2⤵
  PID:11400
- C:\Windows\System\AHaJjDH.exe
  C:\Windows\System\AHaJjDH.exe
  2⤵
  PID:1432
- C:\Windows\System\MMiMpJb.exe
  C:\Windows\System\MMiMpJb.exe
  2⤵
  PID:13020
- C:\Windows\System\KDvJscJ.exe
  C:\Windows\System\KDvJscJ.exe
  2⤵
  PID:13072
- C:\Windows\System\JtatUHN.exe
  C:\Windows\System\JtatUHN.exe
  2⤵
  PID:10020
- C:\Windows\System\GeUEBEP.exe
  C:\Windows\System\GeUEBEP.exe
  2⤵
  PID:7436
- C:\Windows\System\WORpsZc.exe
  C:\Windows\System\WORpsZc.exe
  2⤵
  PID:8696
- C:\Windows\System\APNmXem.exe
  C:\Windows\System\APNmXem.exe
  2⤵
  PID:11368
- C:\Windows\System\HeCrdPm.exe
  C:\Windows\System\HeCrdPm.exe
  2⤵
  PID:11884
- C:\Windows\System\BZDHIaa.exe
  C:\Windows\System\BZDHIaa.exe
  2⤵
  PID:6700
- C:\Windows\System\zXtTDuw.exe
  C:\Windows\System\zXtTDuw.exe
  2⤵
  PID:7320
- C:\Windows\System\YcUcDWW.exe
  C:\Windows\System\YcUcDWW.exe
  2⤵
  PID:13352
- C:\Windows\System\VnBfqFr.exe
  C:\Windows\System\VnBfqFr.exe
  2⤵
  PID:13384
- C:\Windows\System\fhYGSFQ.exe
  C:\Windows\System\fhYGSFQ.exe
  2⤵
  PID:13400
- C:\Windows\System\sDOtQfQ.exe
  C:\Windows\System\sDOtQfQ.exe
  2⤵
  PID:13416
- C:\Windows\System\mrUVMCC.exe
  C:\Windows\System\mrUVMCC.exe
  2⤵
  PID:13432
- C:\Windows\System\FMRgZNl.exe
  C:\Windows\System\FMRgZNl.exe
  2⤵
  PID:13448
- C:\Windows\System\kqkpMLL.exe
  C:\Windows\System\kqkpMLL.exe
  2⤵
  PID:13464
- C:\Windows\System\bhubuHx.exe
  C:\Windows\System\bhubuHx.exe
  2⤵
  PID:13480
- C:\Windows\System\RfzQacY.exe
  C:\Windows\System\RfzQacY.exe
  2⤵
  PID:13496
- C:\Windows\System\NhSYlVS.exe
  C:\Windows\System\NhSYlVS.exe
  2⤵
  PID:13516
- C:\Windows\System\krYcnYx.exe
  C:\Windows\System\krYcnYx.exe
  2⤵
  PID:13536
- C:\Windows\System\lGaIVFh.exe
  C:\Windows\System\lGaIVFh.exe
  2⤵
  PID:13552
- C:\Windows\System\MIjwjfm.exe
  C:\Windows\System\MIjwjfm.exe
  2⤵
  PID:13576
- C:\Windows\System\roAvzFB.exe
  C:\Windows\System\roAvzFB.exe
  2⤵
  PID:13600
- C:\Windows\System\SGzoENs.exe
  C:\Windows\System\SGzoENs.exe
  2⤵
  PID:13620
- C:\Windows\System\VjBRaPT.exe
  C:\Windows\System\VjBRaPT.exe
  2⤵
  PID:13636
- C:\Windows\System\wNdJJSv.exe
  C:\Windows\System\wNdJJSv.exe
  2⤵
  PID:13656
- C:\Windows\System\DDDyoeA.exe
  C:\Windows\System\DDDyoeA.exe
  2⤵
  PID:13688
- C:\Windows\System\TAOHzwW.exe
  C:\Windows\System\TAOHzwW.exe
  2⤵
  PID:13712
- C:\Windows\System\HmGQTBE.exe
  C:\Windows\System\HmGQTBE.exe
  2⤵
  PID:13740
- C:\Windows\System\cDsugrF.exe
  C:\Windows\System\cDsugrF.exe
  2⤵
  PID:13764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_x4wgid4l.2un.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x4wgid4l.2un.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AZQCvPo.exe

Path C:\Windows\System\AZQCvPo.exe
Size 2.3MB
SHA256 554b27c77d9aa43c5bd551381c6c736e7a747a53e101e9edfb8498031457d0e6
MD5 22c6b2d1e57aacbaff14552b1ef60a53
SHA1 25ea7431b5c222828876d787a51c1b61990396af
SHA512 eb817f28a7faaedb86f3dd9012e4684dd5aad885bf36db2e2762330951957ea057cc27918e9626d994f704805bfe619a65b171d08388896b09027879995ce9b7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWae:NABH
MD5 SHA1 SHA512 SSDEEP

Submit Download

BKATmdZ.exe

Path C:\Windows\System\BKATmdZ.exe
Size 2.3MB
SHA256 847a2bd4bad23a04c46d6fc87fb1322a84db20abd572891d238cb6e7c690652a
MD5 f5b2b91c9c975ffeeb5e1d243cc6b4f2
SHA1 a449f3e3d77b835a85937c6eb68f00cd83de8a94
SHA512 1f5ee7901bcb59139087d2b7535b8bb4409c85a62bcc30cb7bc65c32e8edb5e19d269d38568e69d13e0225ba1f79db202c00780d0a7fb4d264ac80f45f074855
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWai:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

BwvzJRI.exe

Path C:\Windows\System\BwvzJRI.exe
Size 2.3MB
SHA256 0fa0731cb9a1ce0c7440e621bb92da327e5b9c599173a00b9afec98870cac99a
MD5 ba46c3761f7c4f3dbd90c43c486ae160
SHA1 3b50b1e148be996a290db3fbd1708a548f284d46
SHA512 30302082df8eb7b33bec01b1a7c854e68ad35457431d7e140823c89ecdc702d6ad8c4a0006b38939e3a92c35c6148be8ad6ac6882d7ecfcecb3664453877a743
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWa1:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

CBbUkLI.exe

Path C:\Windows\System\CBbUkLI.exe
Size 2.4MB
SHA256 352288a66f4c5fa1504f5eb55da476f6975112e223a6c1037637165ad2c68571
MD5 1ff8adb42fb86110e58d78a8f7e8f07b
SHA1 9e98b8c0069769c1ed7d419c5cefcfcb633056c3
SHA512 90530377753e5f31bae8d89d5864b65b1f03bdd62d87165b98d870a76215f15305d60c7e387e8df794d6f4eaeb40dfc56aea50f770e0dbb2d51eb4ad66921fe5
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWa5:NABg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CJPesOD.exe

Path C:\Windows\System\CJPesOD.exe
Size 2.3MB
SHA256 73372c94709e6cd995e6fa29795362b6cb9f2639db25b579e1eab8f0995dcd40
MD5 bff2a39836fa634a8c07d82d98eef203
SHA1 75a625921893f850490db745c36a5af77e734c0e
SHA512 3f12659e596ae311161939334d22bcecdaba6b1ea0105b96510551c229bf933e2542d09de23bd0bd3c26f38f9d48c5ee671b56a0fe7524e19c800f78c06b9f01
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWat:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

EPPzPko.exe

Path C:\Windows\System\EPPzPko.exe
Size 2.3MB
SHA256 a451de73eda3d0b5b84b3234d072d5a68d148f6f4d6c318c98ed45e4626a0f6e
MD5 dfd0c76d8190ca5ebaf2be9419bb5522
SHA1 27c3652b64ebaf056140fa25ecae89e335d5fb61
SHA512 a14f17100f5192f82dae86b4ed11706326b5c032732fc56878ed5d9a9f20fd475e85a783cda75622fdc72b9bbdc69fe1e9b9a5e8729f65f2a534f578c7d13d1a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaB:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

FWlUKqQ.exe

Path C:\Windows\System\FWlUKqQ.exe
Size 2.3MB
SHA256 1f25293fc06f392bb06df074e2499289ac5ab2c647a9461db4d4b6f4cf6cd1d4
MD5 6b135ef64136dbf5f6b84123aa855669
SHA1 b7e96bf9f31263f1d10351fc130e8c81183e4d78
SHA512 d3f9b1c81f9fc3c1333e726be594e00dd789f8d269690e0a67d748a9ca4c0e976aacf3f8ef690bbcee6dd780c1c7d67fbc690944cee8ee0333b1a5d1f478b527
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaI:NAB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXiVwpo.exe

Path C:\Windows\System\FXiVwpo.exe
Size 2.3MB
SHA256 2a74a5e55bab8b75a1cca6beffca2ec9f3eca626e34aa02a40c67524ae41bc91
MD5 00976b03391eee8b630837366f3c5097
SHA1 9db72fec64a02517eed932eca768d3aa4c83fd47
SHA512 ca242c32376987bda5629b861a2889bfb71eff10ea166141d9cf85300d6d873fbba9e54588dbb0df1cd4ab957cd23602847998e2ad7a36b972ac590fb82c756c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaF:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

GbhYzjS.exe

Path C:\Windows\System\GbhYzjS.exe
Size 2.3MB
SHA256 bd4498feba04492a6be6e372eeb202f26f9a875c5bcf0af9781f556e35a20e52
MD5 e7941ed00789bbc18119c5aeffc2ec7c
SHA1 45c4146facec654acbb741f57b44fa6670175c1c
SHA512 c5eaa015f21c583b3b85903a625417866dc23814bf5b8896294a4215156847bf2638287dd1e5175d8e4b9ababc2e68fb43b61b076f234cd1cc8f1e41cae3baae
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaQ:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

GmFOyNi.exe

Path C:\Windows\System\GmFOyNi.exe
Size 2.3MB
SHA256 d187eff774f544cd8b842e8984270ecba1f0644a2b49b31c1437168a3e6e9f50
MD5 0d7a7d814e65c0c2deb8e9367a83236a
SHA1 99ecae0a6479eef178c0661cb1e9d47ae2634630
SHA512 766f0b78e59e7226acf9ce6fc089c12f4ace67bcfd1f22f13b3452274c712a1d0fc81cde3c9cf3fd7fb97ddfb2e36d1fa73abd68c9f4888d9e9b23a0cfb61df9
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaY:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

HaarroR.exe

Path C:\Windows\System\HaarroR.exe
Size 2.3MB
SHA256 7933cf7725813829315d61e6d1bb6b81b7212b23d4839943750be99f01a5121f
MD5 c9fad8d33ddc1dc63af5aea2dcdafbf9
SHA1 68582dfdaf18161f0c1f56a33d87a883ead8b061
SHA512 f0308a89d2ca7e39c58f08dc65d5d6870efe7093eb0c8c5ce6e01a61226f253a35d746b5f14c106aa9474a3a0b34bb687931a4bc6edad8253f03403b22495d2a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaK:NABv
MD5 SHA1 SHA512 SSDEEP

Submit Download

MrRDQGI.exe

Path C:\Windows\System\MrRDQGI.exe
Size 2.3MB
SHA256 4d5d4088e6945a86ae01568af8dd4fb647faee8c09cb31273e7cd378b9d7f836
MD5 ac692ab6f7c863544e029d12d8a9a275
SHA1 0f6d006b37aaa0e19d530d77e7c2157473fa5ee4
SHA512 c6c05d5c283972bfbecec7b5d63f3590eb42ddf00cb912dfbfba254961af37a06cce905eb9f2d4a624534bc72f74dfec8269b9d7ee2b560f360708960fc84203
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaW:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

NwGeluc.exe

Path C:\Windows\System\NwGeluc.exe
Size 2.3MB
SHA256 098f668539e945fa7357c9f74a3773a83bc1d79e37f5198be4dd0bf92fd51014
MD5 105ff76a21ad60b183f0a7afee439776
SHA1 c2b47905f2eced06fc44cc08f6aa964ae97cee98
SHA512 0c592c1e228d4e0c30ea10ae189e169edc8b2e543e062f46f0dc479f834d3c80a4420dd6a8730e35434a58d477dd7c6205fabc4dd92a6a73a62ba3db4d3bcbdd
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaW:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

QXOlsdp.exe

Path C:\Windows\System\QXOlsdp.exe
Size 2.3MB
SHA256 876ddcd7e86658b71833d03e36d6b171d1b3920b18dad66f73de68863ddfd3dd
MD5 eb6770b0ee9d3b92afa53cebbb937693
SHA1 c38b4eedd121c370c3165cb6da35cea2392ecde5
SHA512 090f7603a42ab05574fd11e4a8e069dfd5b22115578dcb30cdd7ab9444a34867ac16229ec809a8534210e42dc55a4fa60f132cbd6fb7c1a6f64c1cf0468479dd
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWag:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

QdVtyLv.exe

Path C:\Windows\System\QdVtyLv.exe
Size 2.3MB
SHA256 21046958a6729a2b018564c786b00fa7e9a5d60e168d17c5a5ced63bdfe98580
MD5 6850759b1f4ba1f87d7e7c236c06d8bf
SHA1 4918beea3c5af4c8662aa4520243ef1ff9d43921
SHA512 eeb554e577b4340b53097d10d65cf70f2e4e8cf9e1378c0cee7e6dcbaeaa046cb00168cb5dcbae0f238af624b1ced8d2e72ceda6f6006fa7822f827d2aaca6f6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaZ:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

QhkOCxs.exe

Path C:\Windows\System\QhkOCxs.exe
Size 2.3MB
SHA256 f3c191c261edab24bcf3e67da8f9f625bfe43576c84bee310430de4715eb4f8b
MD5 5ec95113d1881a5a9f361349b8a4d2c2
SHA1 ce1a20796a658835c1fd7de1c70fff57f1003b9f
SHA512 9a896797017e181e621bfb214eea5b31431dbc0ace54d20f07379ed4685d115cddaccbc638443ff303f1f0fb06bff24ebcd99b4761bf6be9684a2c3c246a5be3
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaJ:NABG
MD5 SHA1 SHA512 SSDEEP

Submit Download

SbRXzNA.exe

Path C:\Windows\System\SbRXzNA.exe
Size 2.3MB
SHA256 6d00b947125b095e54918a5db76feec66f87a30a6698dcc87d26aac8c3d1f152
MD5 075ac6009fd40385b747986a1a59b41a
SHA1 965ae0f38df262c93fed5f5a9863e6fbe11d61f9
SHA512 a3e081477b980c4e0011ab086602052d227d35dff6f8c63302db50deee2fd27a1651f6a613b288f17df7548b344a5074b503a8ea0496c444724234b02f221ffd
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWay:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SyUpoiI.exe

Path C:\Windows\System\SyUpoiI.exe
Size 2.3MB
SHA256 d9392edb20940698ec39b4df6df8c4f53af0215bbe2e3f2753d9c25c8b0c97bd
MD5 316c0c65b7346824587ec86948f712a4
SHA1 b889406baa72bd966cc2c4ebb6cd7557ffeba208
SHA512 3fd076f4afc6b317a9445d60ab92514be5631d4f4610a19f3c6a1cd0595ddaf2893ab68bdf930ec5a2d242a7b7dbaf0c0daf96d3d88e9fe81a225f86a8e43ad0
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaN:NABW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VAQxTwL.exe

Path C:\Windows\System\VAQxTwL.exe
Size 2.3MB
SHA256 0d03b4d1da4421dae36ff031c86b3acdcc9bd5a3befcd26979632b457970c6a1
MD5 e115e2e500a59dc94998f57b68b911ba
SHA1 2b261b349c2265e8a103c21cb20c0f31b24c93a2
SHA512 f8497dcdf5c9fc32d74c9d9309c8079aea64f1430078527f997d4b3c7a286b4a05fea0098f7d34c13ad35327725317b29d4eece0c2aad8a9f8f8be8abff9ac4e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaM:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZdwJaCU.exe

Path C:\Windows\System\ZdwJaCU.exe
Size 2.4MB
SHA256 1a00291883c30da09d1a428f98be8b8a02d883854f0c03e770f83bb5c996db11
MD5 d830b6fb2e4cfa84aa51dc08981de560
SHA1 0cb2661aeb6a06db578ce0c35097685690eea298
SHA512 c59f8c1e25d95b06a53e796c0a48defba9928a661e2f4f144c215a7e5544297fc394a0719604cc73a412089d6227105210a9ea19086332f44809c7b9912640f7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaB:NABW
MD5 SHA1 SHA512 SSDEEP

Submit Download

amfewAa.exe

Path C:\Windows\System\amfewAa.exe
Size 2.3MB
SHA256 144f1842d79cca9f2f81ba64874da189a74e41bf2e51a2d0d563350aca38f92d
MD5 5567474aee2b8f7e83eac56150595b94
SHA1 6d84bc941075860899b7801d5813270ae014bfb5
SHA512 3b79bf6cc0b40f288073b2a65976e8c0496d7eda4ecca1c5ce8c87d4e005038c6fabccbe8aa7b7a4cf32e947d6a81a02ac905d740761f5200b510a778e1035d1
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWatt:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

byHPNQb.exe

Path C:\Windows\System\byHPNQb.exe
Size 2.3MB
SHA256 0d9e58f7eb4f83d1dc2bdc865a4db7cf8632766a5fd1dcf602d5db67ebe102f0
MD5 052dfc9d58c633a53d164570392a2bbd
SHA1 01a62a89875e7c1a67f3de2251fb599492dbc53a
SHA512 2f9777582b137aaefa8098f91cf63bd8dc8c618e0ed19265b6f65130aef730fe2d43b994f12a31b2bd7de721bafae3a94716fc4136326c0fc3217ab3eae4eb38
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaW:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

drfDWmn.exe

Path C:\Windows\System\drfDWmn.exe
Size 2.3MB
SHA256 66a38f9ea1bc16e4c78418d08a4653da2df3d4d7e462c3e9410f9b1d66cace42
MD5 7f6acbe0bb5f283ef8025abf76c2e35f
SHA1 12d6d4d19612adf23679ff51efb37b4a81e70dc0
SHA512 ba33a0b411442e69200add0b76246d9300283e67fe65ee38e98213a4c8bce874a1104046d87387a186da7c0283766112e9ccb505ab05f8a84556208f1ce33bfa
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaJD:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

gLfjFmc.exe

Path C:\Windows\System\gLfjFmc.exe
Size 2.3MB
SHA256 59073be44fe7379574f5a255d1417635c9fca81d5b6eee0a6876be40b40c08b7
MD5 48808495937365781e36d11be08849ff
SHA1 5f21665e5b37d17b3b7aeb684cdcf2021609b232
SHA512 e3b8feac348e3003d7dac2072e8e0bfa55d2993f57b2fcdd5be605b34df28e7c5699bcb5cbd86824ec8ad004ae50a5038fbd45e330d0f6dcf20c59461680d2f6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWav:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

iBCaDrz.exe

Path C:\Windows\System\iBCaDrz.exe
Size 2.3MB
SHA256 604a2dbadb424019154168af1c70ede2ee7a9297c055db53cf81c36ba0440efe
MD5 91b4a180004121bfcf9f5be0f35a2915
SHA1 05b55a14d6d8a26fd42477407e661db2dab194bd
SHA512 b36ebcdb94842a4abc9ff9d1378dc4fde3e597ed46924bb3acc8bfe7eaa91bf6caa6e2cec5ec775a2dfd56c280cde5ef1cfa246bfe17f0c7d15542117a87d1b6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaP:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

lTGqnqr.exe

Path C:\Windows\System\lTGqnqr.exe
Size 8B
SHA256 fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01
MD5 3f9cfe8a165fbe5ed357bf4fb6550d1a
SHA1 d1f76cef8b11f404ce3021901f1968e523167625
SHA512 7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce
MD5 SHA1 SHA512

Submit Download

nPafUPe.exe

Path C:\Windows\System\nPafUPe.exe
Size 2.3MB
SHA256 8f9f1bb049f220c15f81b94b10357846477453a82ce77354291394350c4f74aa
MD5 ae619e7bcf738f8b788d2742e9a431d0
SHA1 bd20709f747d0db54dcdbda6be0f9a1f3404433f
SHA512 f81a68599786f35dad0634de0182cbb5f7b6510384b890c2d64ed7bd2e5b167c080675434da7a4b9be4284f779c0c3b70e2ddf4ce258ad9f6ee238497850b418
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWar:NABK
MD5 SHA1 SHA512 SSDEEP

Submit Download

slxdFhT.exe

Path C:\Windows\System\slxdFhT.exe
Size 2.3MB
SHA256 5eb3ef8ce5e736a2879f7fd037b84b8c53c86262e26dbffa6b390858f2f40c2c
MD5 baeb314636015c5d83bfdedc53b7e6f9
SHA1 233ce8290932de29a988910ae46e89de32552206
SHA512 a659c6765c82b57fd62ca5f8012965910b8a656aac59e52d8a483b2bef1db670f2cd38e87c0614bd6bb911d0c4fcaab5d7811ebe7b09d6bf28fc2107cae9f889
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaP:NABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

suBmtWs.exe

Path C:\Windows\System\suBmtWs.exe
Size 2.3MB
SHA256 e2448b0298785fb69ac7b02c55feb1385835a96f8ce5e3c4d67d2b6d711982a6
MD5 226c38e1fbbba058fd82052d943c2fa6
SHA1 a4bbf2ea312109b6688c2a921ed7db66304503ff
SHA512 a4e12e4ecc690a35aa3986c362f18327d33747e335c4de13f806a630915750d0b1217fb29b6d4d43b0dc019ff95feadb4b85522c027e160c74f460e2fa363126
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaE:NABX
MD5 SHA1 SHA512 SSDEEP

Submit Download

tPJYoyi.exe

Path C:\Windows\System\tPJYoyi.exe
Size 2.3MB
SHA256 019cc7aeb4469c85c3ff9b4ac3f573205420c3bbc4f2436d9c659303af23d955
MD5 afcdbe5692be406d61af062b8d84a586
SHA1 08be0ed9cb39ca94d0e7847f2276406ba552b4d3
SHA512 3475d6dd29e3cac88bef80995e12683a536d5ef217973a3e81e08e60915f9c692177ec6d247e410608cd7d92e5a516e6605d665a15aba8539b389f623d56a86a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaL:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

uFYRlOb.exe

Path C:\Windows\System\uFYRlOb.exe
Size 2.4MB
SHA256 a6068bc0df3848fcaa1c7f497cd60d6d66eff0c6f279904ed4aeec7efd20a0bd
MD5 4ffce8df9b598bc1455e1b43e811059e
SHA1 443c6b72b4ee5650113098d0eb0719e506dfcf3d
SHA512 4a455fa158e37f643e3ca51ef65da37d4e21f3f6aed30a50f4aace555fef1dec0893363d0af5a51dab2b0b14b1aade2459959564bd1211e9482f24052eda0867
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaC:NABn
MD5 SHA1 SHA512 SSDEEP

Submit Download

uvSkdKa.exe

Path C:\Windows\System\uvSkdKa.exe
Size 2.3MB
SHA256 1137a08ad141f92d617172f8c5b672731882150d71710b8c749302aa35fa1ff0
MD5 81e1452e46ae9da23f7e8313f96ca634
SHA1 5ea759175434f2532414fe2920f2b5b59ad2bb3f
SHA512 2010e4fdd2f816ee33758c32ab76d68ecbf07f27b00b55cd315753b23f55fb2d3054ad7cf4c85a9e6ea806145c153c68ae7590d131222c2c37d4471565b6287d
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaa:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

wBUtXVi.exe

Path C:\Windows\System\wBUtXVi.exe
Size 2.3MB
SHA256 826d7bd1f18daf04910db98485cd6ad14c90567709edea276e7787283b72cde5
MD5 f7a1f4cf6eb656ab0e1f3fe0baa951c3
SHA1 1c1f753b2f054f624a907ff60a66fff0ca2f7f88
SHA512 31928c0804d49fe910b23abb382f6812ccc17c18603b959b714989b8383765a07bfa12959e91ddf38ec02b7562bfc3b50297ee4b1abb098eca8978058cafc571
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWa2:NABX
MD5 SHA1 SHA512 SSDEEP

Submit Download

xggIOEH.exe

Path C:\Windows\System\xggIOEH.exe
Size 2.3MB
SHA256 e6a558c3c78ee70d4f95c6fda0710c021e837a89629971621ad43f96539f3dee
MD5 e016c448b057cdb8f44765524a114439
SHA1 d3c22a4b33b6574428b6e2904af50da2c49599af
SHA512 870c3b28d6b1b5af2f5a0621ac2f36c9a25e581bd822135e4463e2a3b4edeead25c5963d9c285e2887fd7bf6baf224f2ef486eb893c21750c0fae9b0dc4aaafd
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaC:NABR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/348-2278-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp

Download

memory/348-2254-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp

Download

memory/348-77-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp

Download

memory/368-758-0x00007FF7FE080000-0x00007FF7FE472000-memory.dmp

Download

memory/368-2306-0x00007FF7FE080000-0x00007FF7FE472000-memory.dmp

Download

memory/452-53-0x000001B83E4B0000-0x000001B83E4D2000-memory.dmp

Download

memory/452-31-0x00007FF9EC4E0000-0x00007FF9ECFA1000-memory.dmp

Download

memory/452-767-0x000001B83F100000-0x000001B83F8A6000-memory.dmp

Download

memory/452-1277-0x00007FF9EC4E0000-0x00007FF9ECFA1000-memory.dmp

Download

memory/452-1816-0x000001B83E010000-0x000001B83E020000-memory.dmp

Download

memory/452-2066-0x00007FF9EC4E3000-0x00007FF9EC4E5000-memory.dmp

Download

memory/452-2429-0x00007FF9EC4E0000-0x00007FF9ECFA1000-memory.dmp

Download

memory/452-15-0x00007FF9EC4E3000-0x00007FF9EC4E5000-memory.dmp

Download

memory/452-10-0x000001B83E010000-0x000001B83E020000-memory.dmp

Download

memory/844-2276-0x00007FF69B510000-0x00007FF69B902000-memory.dmp

Download

memory/844-83-0x00007FF69B510000-0x00007FF69B902000-memory.dmp

Download

memory/844-2253-0x00007FF69B510000-0x00007FF69B902000-memory.dmp

Download

memory/984-48-0x00007FF621220000-0x00007FF621612000-memory.dmp

Download

memory/984-2266-0x00007FF621220000-0x00007FF621612000-memory.dmp

Download

memory/1452-745-0x00007FF647450000-0x00007FF647842000-memory.dmp

Download

memory/1452-2312-0x00007FF647450000-0x00007FF647842000-memory.dmp

Download

memory/1592-2313-0x00007FF7C6C10000-0x00007FF7C7002000-memory.dmp

Download

memory/1592-742-0x00007FF7C6C10000-0x00007FF7C7002000-memory.dmp

Download

memory/1912-33-0x00007FF6B0720000-0x00007FF6B0B12000-memory.dmp

Download

memory/1912-2262-0x00007FF6B0720000-0x00007FF6B0B12000-memory.dmp

Download

memory/2188-757-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp

Download

memory/2188-2303-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp

Download

memory/2192-712-0x00007FF678930000-0x00007FF678D22000-memory.dmp

Download

memory/2192-9-0x00007FF678930000-0x00007FF678D22000-memory.dmp

Download

memory/2192-2258-0x00007FF678930000-0x00007FF678D22000-memory.dmp

Download

memory/2268-735-0x00007FF68C080000-0x00007FF68C472000-memory.dmp

Download

memory/2268-2316-0x00007FF68C080000-0x00007FF68C472000-memory.dmp

Download

memory/2364-56-0x00007FF66E370000-0x00007FF66E762000-memory.dmp

Download

memory/2364-2265-0x00007FF66E370000-0x00007FF66E762000-memory.dmp

Download

memory/2644-1-0x000001E5AF670000-0x000001E5AF680000-memory.dmp

Download

memory/2644-0-0x00007FF734780000-0x00007FF734B72000-memory.dmp

Download

memory/2644-710-0x00007FF734780000-0x00007FF734B72000-memory.dmp

Download

memory/2656-728-0x00007FF70D300000-0x00007FF70D6F2000-memory.dmp

Download

memory/2656-2320-0x00007FF70D300000-0x00007FF70D6F2000-memory.dmp

Download

memory/3068-2268-0x00007FF60E760000-0x00007FF60EB52000-memory.dmp

Download

memory/3068-60-0x00007FF60E760000-0x00007FF60EB52000-memory.dmp

Download

memory/3532-749-0x00007FF76C290000-0x00007FF76C682000-memory.dmp

Download

memory/3532-2310-0x00007FF76C290000-0x00007FF76C682000-memory.dmp

Download

memory/3560-2261-0x00007FF751040000-0x00007FF751432000-memory.dmp

Download

memory/3560-63-0x00007FF751040000-0x00007FF751432000-memory.dmp

Download

memory/3672-99-0x00007FF651F40000-0x00007FF652332000-memory.dmp

Download

memory/3672-2284-0x00007FF651F40000-0x00007FF652332000-memory.dmp

Download

memory/3732-2308-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp

Download

memory/3732-755-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp

Download

memory/3968-73-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp

Download

memory/3968-2241-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp

Download

memory/3968-2280-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp

Download

memory/4056-2255-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp

Download

memory/4056-2272-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp

Download

memory/4056-90-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp

Download

memory/4284-66-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp

Download

memory/4284-2271-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp

Download

memory/4952-2317-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp

Download

memory/4952-736-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp

Download

memory/4984-2275-0x00007FF76F270000-0x00007FF76F662000-memory.dmp

Download

memory/4984-67-0x00007FF76F270000-0x00007FF76F662000-memory.dmp

Download

memory/5016-2256-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp

Download

memory/5016-2282-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp

Download

memory/5016-96-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp

Download

memory/5024-2321-0x00007FF601BD0000-0x00007FF601FC2000-memory.dmp

Download

memory/5024-727-0x00007FF601BD0000-0x00007FF601FC2000-memory.dmp

Download