xmrig | a4f75c01e07f807ce8265808101f24f4cb5e8aa46f5eb1370ee2762546f0ef27

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
Size 2.0MB
Sample240728-a1mcja1bnf
SHA256 a4f75c01e07f807ce8265808101f24f4cb5e8aa46f5eb1370ee2762546f0ef27
MD5 03e5d6a3cbb1ac1414b72c519bafdd5c
SHA1 45677bcf2809061f98882c67c4f369e539cfb926
SHA512 4c39aa11c68afc5449cc687df8483b118fcfa9a80803fd7305f63769e451530d18ad193bd3224fb4d8136b2e596b8aed4419c125a203adb0aa306d55720ab2f4
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMp:NABm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1508-323-0x00007FF72E960000-0x00007FF72ED52000-memory.dmp	xmrig
behavioral2/memory/2508-283-0x00007FF68D650000-0x00007FF68DA42000-memory.dmp	xmrig
behavioral2/memory/1880-233-0x00007FF66A6B0000-0x00007FF66AAA2000-memory.dmp	xmrig
behavioral2/memory/2032-386-0x00007FF7EE180000-0x00007FF7EE572000-memory.dmp	xmrig
behavioral2/memory/4400-415-0x00007FF698660000-0x00007FF698A52000-memory.dmp	xmrig
behavioral2/memory/756-425-0x00007FF765770000-0x00007FF765B62000-memory.dmp	xmrig
behavioral2/memory/4768-429-0x00007FF696A50000-0x00007FF696E42000-memory.dmp	xmrig
behavioral2/memory/5100-433-0x00007FF6EE910000-0x00007FF6EED02000-memory.dmp	xmrig
behavioral2/memory/940-435-0x00007FF696D00000-0x00007FF6970F2000-memory.dmp	xmrig
behavioral2/memory/3956-482-0x00007FF728720000-0x00007FF728B12000-memory.dmp	xmrig
behavioral2/memory/3136-434-0x00007FF7C7370000-0x00007FF7C7762000-memory.dmp	xmrig
behavioral2/memory/4692-432-0x00007FF626F60000-0x00007FF627352000-memory.dmp	xmrig
behavioral2/memory/3264-431-0x00007FF7B7180000-0x00007FF7B7572000-memory.dmp	xmrig
behavioral2/memory/1000-430-0x00007FF7D3090000-0x00007FF7D3482000-memory.dmp	xmrig
behavioral2/memory/4992-428-0x00007FF739CE0000-0x00007FF73A0D2000-memory.dmp	xmrig
behavioral2/memory/3056-427-0x00007FF6C8E40000-0x00007FF6C9232000-memory.dmp	xmrig
behavioral2/memory/4080-426-0x00007FF7D9A40000-0x00007FF7D9E32000-memory.dmp	xmrig
behavioral2/memory/2460-424-0x00007FF781B50000-0x00007FF781F42000-memory.dmp	xmrig
behavioral2/memory/3968-423-0x00007FF621490000-0x00007FF621882000-memory.dmp	xmrig
behavioral2/memory/4024-422-0x00007FF7A0380000-0x00007FF7A0772000-memory.dmp	xmrig
behavioral2/memory/736-421-0x00007FF67FCE0000-0x00007FF6800D2000-memory.dmp	xmrig
behavioral2/memory/5084-420-0x00007FF638780000-0x00007FF638B72000-memory.dmp	xmrig
behavioral2/memory/1852-6372-0x00007FF651B70000-0x00007FF651F62000-memory.dmp	xmrig
behavioral2/memory/2508-6489-0x00007FF68D650000-0x00007FF68DA42000-memory.dmp	xmrig
behavioral2/memory/756-6525-0x00007FF765770000-0x00007FF765B62000-memory.dmp	xmrig
behavioral2/memory/3968-6573-0x00007FF621490000-0x00007FF621882000-memory.dmp	xmrig
behavioral2/memory/5100-6593-0x00007FF6EE910000-0x00007FF6EED02000-memory.dmp	xmrig
behavioral2/memory/4080-6606-0x00007FF7D9A40000-0x00007FF7D9E32000-memory.dmp	xmrig
behavioral2/memory/3956-6612-0x00007FF728720000-0x00007FF728B12000-memory.dmp	xmrig
behavioral2/memory/4992-6590-0x00007FF739CE0000-0x00007FF73A0D2000-memory.dmp	xmrig
behavioral2/memory/2460-6585-0x00007FF781B50000-0x00007FF781F42000-memory.dmp	xmrig
behavioral2/memory/3264-6576-0x00007FF7B7180000-0x00007FF7B7572000-memory.dmp	xmrig
behavioral2/memory/4768-6566-0x00007FF696A50000-0x00007FF696E42000-memory.dmp	xmrig
behavioral2/memory/4692-6560-0x00007FF626F60000-0x00007FF627352000-memory.dmp	xmrig
behavioral2/memory/5084-6557-0x00007FF638780000-0x00007FF638B72000-memory.dmp	xmrig
behavioral2/memory/4400-6551-0x00007FF698660000-0x00007FF698A52000-memory.dmp	xmrig
behavioral2/memory/1000-6549-0x00007FF7D3090000-0x00007FF7D3482000-memory.dmp	xmrig
behavioral2/memory/4024-6540-0x00007FF7A0380000-0x00007FF7A0772000-memory.dmp	xmrig
behavioral2/memory/1508-6542-0x00007FF72E960000-0x00007FF72ED52000-memory.dmp	xmrig
behavioral2/memory/3056-6541-0x00007FF6C8E40000-0x00007FF6C9232000-memory.dmp	xmrig
behavioral2/memory/940-6482-0x00007FF696D00000-0x00007FF6970F2000-memory.dmp	xmrig
behavioral2/memory/3136-6461-0x00007FF7C7370000-0x00007FF7C7762000-memory.dmp	xmrig
behavioral2/memory/1880-6460-0x00007FF66A6B0000-0x00007FF66AAA2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	3468	powershell.exe
6	3468	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3468	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1260	VzPDmCw.exe
1852	geaQPaw.exe
1880	HpSLVfl.exe
2508	LsozNqe.exe
3136	lBGkcrF.exe
940	CXzeLcX.exe
1508	eBgJoNM.exe
2032	XFEEyuR.exe
4400	ulMDVnf.exe
5084	pDgfdxI.exe
736	ArGJwjZ.exe
4024	IYRGcco.exe
3968	aqEVlTb.exe
2460	XpMluAh.exe
756	LupPxnP.exe
4080	SRImuld.exe
3056	ajhpkhU.exe
4992	ktcwMRb.exe
4768	pTZAYga.exe
1000	JQqDqIq.exe
3264	VLlQQPq.exe
4692	aGllUgG.exe
5100	UhCXsvt.exe
3956	fZQkPya.exe
4868	tlMBSTX.exe
4836	copyDwc.exe
3796	HqRmULr.exe
4860	ZoftgvJ.exe
624	vljJiHb.exe
4700	YUlTNXT.exe
3972	wElhCMn.exe
416	AcBvyPa.exe
2144	jGdIIvw.exe
3816	KZKoFfx.exe
748	EhjJFAY.exe
220	jTclxxi.exe
4228	nwgtolC.exe
5092	HLIJKxp.exe
4364	roInGwr.exe
4028	Todipze.exe
1344	klhdDVE.exe
3040	tmNOjsZ.exe
1836	InecgCF.exe
652	NNBbtnt.exe
4432	aFgsWPb.exe
4904	qfhoQPe.exe
4316	CNvmRrJ.exe
3736	qOmWOpv.exe
1196	YGsVxgK.exe
4508	lpVUfVU.exe
2664	QUPvNLZ.exe
4592	KJGbgOx.exe
1580	PZoWuLn.exe
2272	pQrZXlM.exe
452	YROsUfA.exe
5096	ZfVNxdF.exe
4496	bawvQPR.exe
532	xtGzMnl.exe
3288	rjOXwWS.exe
4964	BwnKYYo.exe
1360	jZstEqA.exe
3464	dHhyamB.exe
4632	KQTgPXb.exe
3300	wXoKWcJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3372-0-0x00007FF6E7A10000-0x00007FF6E7E02000-memory.dmp	upx
behavioral2/files/0x0009000000023476-7.dat	upx
behavioral2/files/0x00070000000234d8-6.dat	upx
behavioral2/files/0x00070000000234d7-12.dat	upx
behavioral2/memory/1260-10-0x00007FF6AB060000-0x00007FF6AB452000-memory.dmp	upx
behavioral2/files/0x00070000000234da-44.dat	upx
behavioral2/files/0x00070000000234dd-47.dat	upx
behavioral2/files/0x00070000000234e2-68.dat	upx
behavioral2/files/0x00070000000234ea-143.dat	upx
behavioral2/memory/1508-323-0x00007FF72E960000-0x00007FF72ED52000-memory.dmp	upx
behavioral2/memory/2508-283-0x00007FF68D650000-0x00007FF68DA42000-memory.dmp	upx
behavioral2/memory/1880-233-0x00007FF66A6B0000-0x00007FF66AAA2000-memory.dmp	upx
behavioral2/files/0x00070000000234fb-201.dat	upx
behavioral2/files/0x00070000000234fa-195.dat	upx
behavioral2/files/0x00070000000234f2-191.dat	upx
behavioral2/files/0x00070000000234f1-183.dat	upx
behavioral2/files/0x00070000000234ed-171.dat	upx
behavioral2/files/0x00070000000234f8-170.dat	upx
behavioral2/files/0x00070000000234f7-164.dat	upx
behavioral2/files/0x00070000000234f6-162.dat	upx
behavioral2/files/0x00070000000234f5-160.dat	upx
behavioral2/files/0x00070000000234ee-154.dat	upx
behavioral2/files/0x00070000000234e5-151.dat	upx
behavioral2/files/0x00070000000234de-148.dat	upx
behavioral2/files/0x00080000000234d4-188.dat	upx
behavioral2/files/0x00070000000234f0-142.dat	upx
behavioral2/files/0x00070000000234e7-130.dat	upx
behavioral2/files/0x00070000000234ec-127.dat	upx
behavioral2/files/0x00070000000234eb-125.dat	upx
behavioral2/files/0x00070000000234ef-124.dat	upx
behavioral2/files/0x00070000000234f3-155.dat	upx
behavioral2/files/0x00070000000234e9-110.dat	upx
behavioral2/files/0x00070000000234e8-133.dat	upx
behavioral2/files/0x00070000000234e0-100.dat	upx
behavioral2/files/0x00070000000234e4-99.dat	upx
behavioral2/files/0x00070000000234df-96.dat	upx
behavioral2/files/0x00070000000234e3-92.dat	upx
behavioral2/files/0x00070000000234e6-78.dat	upx
behavioral2/files/0x00070000000234e1-77.dat	upx
behavioral2/files/0x00070000000234dc-83.dat	upx
behavioral2/files/0x00070000000234d9-57.dat	upx
behavioral2/files/0x00070000000234db-34.dat	upx
behavioral2/memory/1852-27-0x00007FF651B70000-0x00007FF651F62000-memory.dmp	upx
behavioral2/memory/2032-386-0x00007FF7EE180000-0x00007FF7EE572000-memory.dmp	upx
behavioral2/memory/4400-415-0x00007FF698660000-0x00007FF698A52000-memory.dmp	upx
behavioral2/memory/756-425-0x00007FF765770000-0x00007FF765B62000-memory.dmp	upx
behavioral2/memory/4768-429-0x00007FF696A50000-0x00007FF696E42000-memory.dmp	upx
behavioral2/memory/5100-433-0x00007FF6EE910000-0x00007FF6EED02000-memory.dmp	upx
behavioral2/memory/940-435-0x00007FF696D00000-0x00007FF6970F2000-memory.dmp	upx
behavioral2/memory/3956-482-0x00007FF728720000-0x00007FF728B12000-memory.dmp	upx
behavioral2/memory/3136-434-0x00007FF7C7370000-0x00007FF7C7762000-memory.dmp	upx
behavioral2/memory/4692-432-0x00007FF626F60000-0x00007FF627352000-memory.dmp	upx
behavioral2/memory/3264-431-0x00007FF7B7180000-0x00007FF7B7572000-memory.dmp	upx
behavioral2/memory/1000-430-0x00007FF7D3090000-0x00007FF7D3482000-memory.dmp	upx
behavioral2/memory/4992-428-0x00007FF739CE0000-0x00007FF73A0D2000-memory.dmp	upx
behavioral2/memory/3056-427-0x00007FF6C8E40000-0x00007FF6C9232000-memory.dmp	upx
behavioral2/memory/4080-426-0x00007FF7D9A40000-0x00007FF7D9E32000-memory.dmp	upx
behavioral2/memory/2460-424-0x00007FF781B50000-0x00007FF781F42000-memory.dmp	upx
behavioral2/memory/3968-423-0x00007FF621490000-0x00007FF621882000-memory.dmp	upx
behavioral2/memory/4024-422-0x00007FF7A0380000-0x00007FF7A0772000-memory.dmp	upx
behavioral2/memory/736-421-0x00007FF67FCE0000-0x00007FF6800D2000-memory.dmp	upx
behavioral2/memory/5084-420-0x00007FF638780000-0x00007FF638B72000-memory.dmp	upx
behavioral2/memory/1852-6372-0x00007FF651B70000-0x00007FF651F62000-memory.dmp	upx
behavioral2/memory/2508-6489-0x00007FF68D650000-0x00007FF68DA42000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZVGKoyo.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\jZDfbWi.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\cILIHSt.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\ijWFUWS.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\dDcPRxv.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\VIzlYTI.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\VTitPNM.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\RizYyFa.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\jrSnmTp.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\NasOyMF.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\qbvJhZz.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\mUGLQwY.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\DWHUXjm.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\AzoOiny.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\NgmXFOV.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\GsUXymA.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\LVvmOnn.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\wbMSiDY.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\sUfXFQo.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\FgnqBnq.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\rrPDMzL.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\urOMMiW.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\GxqsRdH.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\iimJloX.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\SLBhVhs.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\axADXle.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\HPAYdSf.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\LDJzcZo.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\PyRhaCH.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\IePzJYV.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\nuhPxEk.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\EwxRBVF.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\KTFxumf.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\xMuUSJZ.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\BfRUYFv.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\zLPtsfH.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\dIolWLe.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\FiAhybv.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\mvTMwln.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\DpZnpVS.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\vCohRGO.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\fMZankm.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\uILogLL.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\lOECBuY.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\BnGHehA.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\TulvEUM.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\KkQMYdD.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\mBFyFNf.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\sDQqgxW.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\XIniLwj.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\mOctDxk.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\ByFqpnA.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\FfVHoYJ.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\LlOgfKA.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\JyYzmaU.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\kHpObvJ.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\xDbccao.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\vdrXHNw.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\rZiUhom.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\ZXCdfnK.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\ExaSjxB.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\TbqWdag.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\YAfmJTs.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
File created	C:\Windows\System\MPuPrRK.exe	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3468	powershell.exe
3468	powershell.exe
3468	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeLockMemoryPrivilege	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	4112	dwm.exe
Token: SeChangeNotifyPrivilege	4112	dwm.exe
Token: 33	4112	dwm.exe
Token: SeIncBasePriorityPrivilege	4112	dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
13216	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3468	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	84
PID 3372 wrote to memory of 3468	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	84
PID 3372 wrote to memory of 1260	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	85
PID 3372 wrote to memory of 1260	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	85
PID 3372 wrote to memory of 1852	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	86
PID 3372 wrote to memory of 1852	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	86
PID 3372 wrote to memory of 1880	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	87
PID 3372 wrote to memory of 1880	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	87
PID 3372 wrote to memory of 2508	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	88
PID 3372 wrote to memory of 2508	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	88
PID 3372 wrote to memory of 3136	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	89
PID 3372 wrote to memory of 3136	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	89
PID 3372 wrote to memory of 940	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	90
PID 3372 wrote to memory of 940	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	90
PID 3372 wrote to memory of 1508	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	91
PID 3372 wrote to memory of 1508	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	91
PID 3372 wrote to memory of 2032	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	92
PID 3372 wrote to memory of 2032	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	92
PID 3372 wrote to memory of 2460	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	93
PID 3372 wrote to memory of 2460	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	93
PID 3372 wrote to memory of 4400	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	94
PID 3372 wrote to memory of 4400	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	94
PID 3372 wrote to memory of 5084	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	95
PID 3372 wrote to memory of 5084	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	95
PID 3372 wrote to memory of 736	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	96
PID 3372 wrote to memory of 736	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	96
PID 3372 wrote to memory of 3968	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	97
PID 3372 wrote to memory of 3968	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	97
PID 3372 wrote to memory of 4024	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	98
PID 3372 wrote to memory of 4024	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	98
PID 3372 wrote to memory of 756	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	99
PID 3372 wrote to memory of 756	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	99
PID 3372 wrote to memory of 4080	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	100
PID 3372 wrote to memory of 4080	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	100
PID 3372 wrote to memory of 3056	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	101
PID 3372 wrote to memory of 3056	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	101
PID 3372 wrote to memory of 4992	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	102
PID 3372 wrote to memory of 4992	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	102
PID 3372 wrote to memory of 4768	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	103
PID 3372 wrote to memory of 4768	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	103
PID 3372 wrote to memory of 1000	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	104
PID 3372 wrote to memory of 1000	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	104
PID 3372 wrote to memory of 3264	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	105
PID 3372 wrote to memory of 3264	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	105
PID 3372 wrote to memory of 4692	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	106
PID 3372 wrote to memory of 4692	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	106
PID 3372 wrote to memory of 4868	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	107
PID 3372 wrote to memory of 4868	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	107
PID 3372 wrote to memory of 5100	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	108
PID 3372 wrote to memory of 5100	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	108
PID 3372 wrote to memory of 624	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	109
PID 3372 wrote to memory of 624	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	109
PID 3372 wrote to memory of 3956	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	110
PID 3372 wrote to memory of 3956	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	110
PID 3372 wrote to memory of 4836	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	111
PID 3372 wrote to memory of 4836	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	111
PID 3372 wrote to memory of 748	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	112
PID 3372 wrote to memory of 748	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	112
PID 3372 wrote to memory of 3796	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	113
PID 3372 wrote to memory of 3796	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	113
PID 3372 wrote to memory of 4860	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	114
PID 3372 wrote to memory of 4860	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	114
PID 3372 wrote to memory of 4700	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	115
PID 3372 wrote to memory of 4700	3372	03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03e5d6a3cbb1ac1414b72c519bafdd5c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3468
- C:\Windows\System\VzPDmCw.exe
  C:\Windows\System\VzPDmCw.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\geaQPaw.exe
  C:\Windows\System\geaQPaw.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\HpSLVfl.exe
  C:\Windows\System\HpSLVfl.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\LsozNqe.exe
  C:\Windows\System\LsozNqe.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\lBGkcrF.exe
  C:\Windows\System\lBGkcrF.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\CXzeLcX.exe
  C:\Windows\System\CXzeLcX.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\eBgJoNM.exe
  C:\Windows\System\eBgJoNM.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\XFEEyuR.exe
  C:\Windows\System\XFEEyuR.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\XpMluAh.exe
  C:\Windows\System\XpMluAh.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\ulMDVnf.exe
  C:\Windows\System\ulMDVnf.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\pDgfdxI.exe
  C:\Windows\System\pDgfdxI.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\ArGJwjZ.exe
  C:\Windows\System\ArGJwjZ.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\aqEVlTb.exe
  C:\Windows\System\aqEVlTb.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\IYRGcco.exe
  C:\Windows\System\IYRGcco.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\LupPxnP.exe
  C:\Windows\System\LupPxnP.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\SRImuld.exe
  C:\Windows\System\SRImuld.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\ajhpkhU.exe
  C:\Windows\System\ajhpkhU.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\ktcwMRb.exe
  C:\Windows\System\ktcwMRb.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\pTZAYga.exe
  C:\Windows\System\pTZAYga.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\JQqDqIq.exe
  C:\Windows\System\JQqDqIq.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\VLlQQPq.exe
  C:\Windows\System\VLlQQPq.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\aGllUgG.exe
  C:\Windows\System\aGllUgG.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\tlMBSTX.exe
  C:\Windows\System\tlMBSTX.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\UhCXsvt.exe
  C:\Windows\System\UhCXsvt.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\vljJiHb.exe
  C:\Windows\System\vljJiHb.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\fZQkPya.exe
  C:\Windows\System\fZQkPya.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\copyDwc.exe
  C:\Windows\System\copyDwc.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\EhjJFAY.exe
  C:\Windows\System\EhjJFAY.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\HqRmULr.exe
  C:\Windows\System\HqRmULr.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\ZoftgvJ.exe
  C:\Windows\System\ZoftgvJ.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\YUlTNXT.exe
  C:\Windows\System\YUlTNXT.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\roInGwr.exe
  C:\Windows\System\roInGwr.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\wElhCMn.exe
  C:\Windows\System\wElhCMn.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\AcBvyPa.exe
  C:\Windows\System\AcBvyPa.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\jGdIIvw.exe
  C:\Windows\System\jGdIIvw.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\KZKoFfx.exe
  C:\Windows\System\KZKoFfx.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\aFgsWPb.exe
  C:\Windows\System\aFgsWPb.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\jTclxxi.exe
  C:\Windows\System\jTclxxi.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\nwgtolC.exe
  C:\Windows\System\nwgtolC.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\HLIJKxp.exe
  C:\Windows\System\HLIJKxp.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\Todipze.exe
  C:\Windows\System\Todipze.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\klhdDVE.exe
  C:\Windows\System\klhdDVE.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\tmNOjsZ.exe
  C:\Windows\System\tmNOjsZ.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\InecgCF.exe
  C:\Windows\System\InecgCF.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\NNBbtnt.exe
  C:\Windows\System\NNBbtnt.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\qfhoQPe.exe
  C:\Windows\System\qfhoQPe.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\CNvmRrJ.exe
  C:\Windows\System\CNvmRrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\qOmWOpv.exe
  C:\Windows\System\qOmWOpv.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\YGsVxgK.exe
  C:\Windows\System\YGsVxgK.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\lpVUfVU.exe
  C:\Windows\System\lpVUfVU.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\QUPvNLZ.exe
  C:\Windows\System\QUPvNLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\KJGbgOx.exe
  C:\Windows\System\KJGbgOx.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\PZoWuLn.exe
  C:\Windows\System\PZoWuLn.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\pQrZXlM.exe
  C:\Windows\System\pQrZXlM.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\YROsUfA.exe
  C:\Windows\System\YROsUfA.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\ZfVNxdF.exe
  C:\Windows\System\ZfVNxdF.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\bawvQPR.exe
  C:\Windows\System\bawvQPR.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\xtGzMnl.exe
  C:\Windows\System\xtGzMnl.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\rjOXwWS.exe
  C:\Windows\System\rjOXwWS.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\BwnKYYo.exe
  C:\Windows\System\BwnKYYo.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\jZstEqA.exe
  C:\Windows\System\jZstEqA.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\dHhyamB.exe
  C:\Windows\System\dHhyamB.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\KQTgPXb.exe
  C:\Windows\System\KQTgPXb.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\wXoKWcJ.exe
  C:\Windows\System\wXoKWcJ.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\cbCTtYA.exe
  C:\Windows\System\cbCTtYA.exe
  2⤵
  PID:2684
- C:\Windows\System\PRRKTyd.exe
  C:\Windows\System\PRRKTyd.exe
  2⤵
  PID:3144
- C:\Windows\System\nYmsmgj.exe
  C:\Windows\System\nYmsmgj.exe
  2⤵
  PID:4532
- C:\Windows\System\BYnIFKu.exe
  C:\Windows\System\BYnIFKu.exe
  2⤵
  PID:4812
- C:\Windows\System\qvzlBBQ.exe
  C:\Windows\System\qvzlBBQ.exe
  2⤵
  PID:4100
- C:\Windows\System\MsMamBo.exe
  C:\Windows\System\MsMamBo.exe
  2⤵
  PID:3184
- C:\Windows\System\UnGuzjZ.exe
  C:\Windows\System\UnGuzjZ.exe
  2⤵
  PID:2020
- C:\Windows\System\cZEvXJj.exe
  C:\Windows\System\cZEvXJj.exe
  2⤵
  PID:4220
- C:\Windows\System\JSTWwxK.exe
  C:\Windows\System\JSTWwxK.exe
  2⤵
  PID:4392
- C:\Windows\System\vAFTrjy.exe
  C:\Windows\System\vAFTrjy.exe
  2⤵
  PID:4144
- C:\Windows\System\fGdnCIQ.exe
  C:\Windows\System\fGdnCIQ.exe
  2⤵
  PID:2000
- C:\Windows\System\YJYFxvC.exe
  C:\Windows\System\YJYFxvC.exe
  2⤵
  PID:1600
- C:\Windows\System\TKAMnSj.exe
  C:\Windows\System\TKAMnSj.exe
  2⤵
  PID:3516
- C:\Windows\System\tdJqAeJ.exe
  C:\Windows\System\tdJqAeJ.exe
  2⤵
  PID:1784
- C:\Windows\System\prNSriv.exe
  C:\Windows\System\prNSriv.exe
  2⤵
  PID:1144
- C:\Windows\System\SbvGFFW.exe
  C:\Windows\System\SbvGFFW.exe
  2⤵
  PID:1008
- C:\Windows\System\sOMSMbv.exe
  C:\Windows\System\sOMSMbv.exe
  2⤵
  PID:4652
- C:\Windows\System\XxaGnpg.exe
  C:\Windows\System\XxaGnpg.exe
  2⤵
  PID:2488
- C:\Windows\System\jKmIKTH.exe
  C:\Windows\System\jKmIKTH.exe
  2⤵
  PID:1216
- C:\Windows\System\iBvvTFf.exe
  C:\Windows\System\iBvvTFf.exe
  2⤵
  PID:884
- C:\Windows\System\BLDlrIl.exe
  C:\Windows\System\BLDlrIl.exe
  2⤵
  PID:1180
- C:\Windows\System\fOppDEF.exe
  C:\Windows\System\fOppDEF.exe
  2⤵
  PID:2976
- C:\Windows\System\NLrjSqj.exe
  C:\Windows\System\NLrjSqj.exe
  2⤵
  PID:4032
- C:\Windows\System\JMZfohc.exe
  C:\Windows\System\JMZfohc.exe
  2⤵
  PID:5132
- C:\Windows\System\IVvPRMY.exe
  C:\Windows\System\IVvPRMY.exe
  2⤵
  PID:5152
- C:\Windows\System\BLhdxjf.exe
  C:\Windows\System\BLhdxjf.exe
  2⤵
  PID:5172
- C:\Windows\System\LOqzncZ.exe
  C:\Windows\System\LOqzncZ.exe
  2⤵
  PID:5212
- C:\Windows\System\zCGKLIA.exe
  C:\Windows\System\zCGKLIA.exe
  2⤵
  PID:5240
- C:\Windows\System\stftciP.exe
  C:\Windows\System\stftciP.exe
  2⤵
  PID:5264
- C:\Windows\System\wcklKdJ.exe
  C:\Windows\System\wcklKdJ.exe
  2⤵
  PID:5284
- C:\Windows\System\YLVboNt.exe
  C:\Windows\System\YLVboNt.exe
  2⤵
  PID:5304
- C:\Windows\System\zMgXveB.exe
  C:\Windows\System\zMgXveB.exe
  2⤵
  PID:5324
- C:\Windows\System\BUjjcvC.exe
  C:\Windows\System\BUjjcvC.exe
  2⤵
  PID:5344
- C:\Windows\System\GJcYWkP.exe
  C:\Windows\System\GJcYWkP.exe
  2⤵
  PID:5364
- C:\Windows\System\CdpMFRJ.exe
  C:\Windows\System\CdpMFRJ.exe
  2⤵
  PID:5388
- C:\Windows\System\VdzTLrs.exe
  C:\Windows\System\VdzTLrs.exe
  2⤵
  PID:5416
- C:\Windows\System\bpqRRAU.exe
  C:\Windows\System\bpqRRAU.exe
  2⤵
  PID:5444
- C:\Windows\System\XryjqOG.exe
  C:\Windows\System\XryjqOG.exe
  2⤵
  PID:5468
- C:\Windows\System\AXepYeI.exe
  C:\Windows\System\AXepYeI.exe
  2⤵
  PID:5496
- C:\Windows\System\ObgPTqf.exe
  C:\Windows\System\ObgPTqf.exe
  2⤵
  PID:5512
- C:\Windows\System\gSduzfU.exe
  C:\Windows\System\gSduzfU.exe
  2⤵
  PID:5532
- C:\Windows\System\eKfJeFZ.exe
  C:\Windows\System\eKfJeFZ.exe
  2⤵
  PID:5556
- C:\Windows\System\HrjiqOG.exe
  C:\Windows\System\HrjiqOG.exe
  2⤵
  PID:5572
- C:\Windows\System\jGoLdsz.exe
  C:\Windows\System\jGoLdsz.exe
  2⤵
  PID:5600
- C:\Windows\System\EeIQuLx.exe
  C:\Windows\System\EeIQuLx.exe
  2⤵
  PID:5624
- C:\Windows\System\ilgwoQQ.exe
  C:\Windows\System\ilgwoQQ.exe
  2⤵
  PID:5668
- C:\Windows\System\ygAAeWs.exe
  C:\Windows\System\ygAAeWs.exe
  2⤵
  PID:5688
- C:\Windows\System\biybfce.exe
  C:\Windows\System\biybfce.exe
  2⤵
  PID:5704
- C:\Windows\System\GRGXcmv.exe
  C:\Windows\System\GRGXcmv.exe
  2⤵
  PID:5732
- C:\Windows\System\DoiSehG.exe
  C:\Windows\System\DoiSehG.exe
  2⤵
  PID:5748
- C:\Windows\System\kxvOGTm.exe
  C:\Windows\System\kxvOGTm.exe
  2⤵
  PID:5784
- C:\Windows\System\JpFIQvd.exe
  C:\Windows\System\JpFIQvd.exe
  2⤵
  PID:5804
- C:\Windows\System\fLvMPjz.exe
  C:\Windows\System\fLvMPjz.exe
  2⤵
  PID:5824
- C:\Windows\System\rvdnpye.exe
  C:\Windows\System\rvdnpye.exe
  2⤵
  PID:5848
- C:\Windows\System\oEtFZop.exe
  C:\Windows\System\oEtFZop.exe
  2⤵
  PID:5880
- C:\Windows\System\VKXMYNg.exe
  C:\Windows\System\VKXMYNg.exe
  2⤵
  PID:5900
- C:\Windows\System\oAMsUPT.exe
  C:\Windows\System\oAMsUPT.exe
  2⤵
  PID:5924
- C:\Windows\System\MOMVjUU.exe
  C:\Windows\System\MOMVjUU.exe
  2⤵
  PID:5940
- C:\Windows\System\CUopCdR.exe
  C:\Windows\System\CUopCdR.exe
  2⤵
  PID:5960
- C:\Windows\System\XDOmCiG.exe
  C:\Windows\System\XDOmCiG.exe
  2⤵
  PID:5984
- C:\Windows\System\PdCarKV.exe
  C:\Windows\System\PdCarKV.exe
  2⤵
  PID:4480
- C:\Windows\System\sMVTPKG.exe
  C:\Windows\System\sMVTPKG.exe
  2⤵
  PID:3276
- C:\Windows\System\zrlFUlc.exe
  C:\Windows\System\zrlFUlc.exe
  2⤵
  PID:4616
- C:\Windows\System\QxlCtSQ.exe
  C:\Windows\System\QxlCtSQ.exe
  2⤵
  PID:4132
- C:\Windows\System\zyCHeEy.exe
  C:\Windows\System\zyCHeEy.exe
  2⤵
  PID:1572
- C:\Windows\System\oCnSjoZ.exe
  C:\Windows\System\oCnSjoZ.exe
  2⤵
  PID:3432
- C:\Windows\System\MrFbBYA.exe
  C:\Windows\System\MrFbBYA.exe
  2⤵
  PID:5316
- C:\Windows\System\ubaZtPs.exe
  C:\Windows\System\ubaZtPs.exe
  2⤵
  PID:3164
- C:\Windows\System\DlyYmlX.exe
  C:\Windows\System\DlyYmlX.exe
  2⤵
  PID:4516
- C:\Windows\System\SgMeyyj.exe
  C:\Windows\System\SgMeyyj.exe
  2⤵
  PID:2568
- C:\Windows\System\ccIKrjA.exe
  C:\Windows\System\ccIKrjA.exe
  2⤵
  PID:5464
- C:\Windows\System\WBThezM.exe
  C:\Windows\System\WBThezM.exe
  2⤵
  PID:4832
- C:\Windows\System\OpSHjvd.exe
  C:\Windows\System\OpSHjvd.exe
  2⤵
  PID:2368
- C:\Windows\System\lDfjMCt.exe
  C:\Windows\System\lDfjMCt.exe
  2⤵
  PID:5540
- C:\Windows\System\JhwsrGz.exe
  C:\Windows\System\JhwsrGz.exe
  2⤵
  PID:5620
- C:\Windows\System\zFCwXfQ.exe
  C:\Windows\System\zFCwXfQ.exe
  2⤵
  PID:5552
- C:\Windows\System\ZDqwjbi.exe
  C:\Windows\System\ZDqwjbi.exe
  2⤵
  PID:5432
- C:\Windows\System\gDsyNNk.exe
  C:\Windows\System\gDsyNNk.exe
  2⤵
  PID:5596
- C:\Windows\System\OBBdnSM.exe
  C:\Windows\System\OBBdnSM.exe
  2⤵
  PID:5676
- C:\Windows\System\flsIIbI.exe
  C:\Windows\System\flsIIbI.exe
  2⤵
  PID:5720
- C:\Windows\System\AngZduv.exe
  C:\Windows\System\AngZduv.exe
  2⤵
  PID:5780
- C:\Windows\System\YcePtHq.exe
  C:\Windows\System\YcePtHq.exe
  2⤵
  PID:5816
- C:\Windows\System\LDxFOob.exe
  C:\Windows\System\LDxFOob.exe
  2⤵
  PID:5892
- C:\Windows\System\vdgmymq.exe
  C:\Windows\System\vdgmymq.exe
  2⤵
  PID:6012
- C:\Windows\System\uPfrdvv.exe
  C:\Windows\System\uPfrdvv.exe
  2⤵
  PID:6084
- C:\Windows\System\rwKxEsr.exe
  C:\Windows\System\rwKxEsr.exe
  2⤵
  PID:6128
- C:\Windows\System\cnmEbhB.exe
  C:\Windows\System\cnmEbhB.exe
  2⤵
  PID:1620
- C:\Windows\System\vrOtiPv.exe
  C:\Windows\System\vrOtiPv.exe
  2⤵
  PID:6148
- C:\Windows\System\vvfYZCT.exe
  C:\Windows\System\vvfYZCT.exe
  2⤵
  PID:6172
- C:\Windows\System\RmzryGQ.exe
  C:\Windows\System\RmzryGQ.exe
  2⤵
  PID:6192
- C:\Windows\System\WmYWHCH.exe
  C:\Windows\System\WmYWHCH.exe
  2⤵
  PID:6212
- C:\Windows\System\NOtmikq.exe
  C:\Windows\System\NOtmikq.exe
  2⤵
  PID:6240
- C:\Windows\System\KpkxbTk.exe
  C:\Windows\System\KpkxbTk.exe
  2⤵
  PID:6256
- C:\Windows\System\vecCgMw.exe
  C:\Windows\System\vecCgMw.exe
  2⤵
  PID:6276
- C:\Windows\System\rUVFYXx.exe
  C:\Windows\System\rUVFYXx.exe
  2⤵
  PID:6300
- C:\Windows\System\HILQora.exe
  C:\Windows\System\HILQora.exe
  2⤵
  PID:6432
- C:\Windows\System\tywNEff.exe
  C:\Windows\System\tywNEff.exe
  2⤵
  PID:6456
- C:\Windows\System\llErujg.exe
  C:\Windows\System\llErujg.exe
  2⤵
  PID:6492
- C:\Windows\System\NYuaYaj.exe
  C:\Windows\System\NYuaYaj.exe
  2⤵
  PID:6512
- C:\Windows\System\YrIuuQt.exe
  C:\Windows\System\YrIuuQt.exe
  2⤵
  PID:6536
- C:\Windows\System\dheVnYR.exe
  C:\Windows\System\dheVnYR.exe
  2⤵
  PID:6552
- C:\Windows\System\bmNYVQE.exe
  C:\Windows\System\bmNYVQE.exe
  2⤵
  PID:6576
- C:\Windows\System\cZgFUMQ.exe
  C:\Windows\System\cZgFUMQ.exe
  2⤵
  PID:6604
- C:\Windows\System\jYeryhI.exe
  C:\Windows\System\jYeryhI.exe
  2⤵
  PID:6620
- C:\Windows\System\pqInnvs.exe
  C:\Windows\System\pqInnvs.exe
  2⤵
  PID:6744
- C:\Windows\System\ELLWAjG.exe
  C:\Windows\System\ELLWAjG.exe
  2⤵
  PID:6768
- C:\Windows\System\mYrcwzP.exe
  C:\Windows\System\mYrcwzP.exe
  2⤵
  PID:6792
- C:\Windows\System\GYGmrvS.exe
  C:\Windows\System\GYGmrvS.exe
  2⤵
  PID:6812
- C:\Windows\System\pnWjGaw.exe
  C:\Windows\System\pnWjGaw.exe
  2⤵
  PID:6832
- C:\Windows\System\BpYXCBA.exe
  C:\Windows\System\BpYXCBA.exe
  2⤵
  PID:6856
- C:\Windows\System\FeCohGp.exe
  C:\Windows\System\FeCohGp.exe
  2⤵
  PID:6880
- C:\Windows\System\EHEFLpe.exe
  C:\Windows\System\EHEFLpe.exe
  2⤵
  PID:6896
- C:\Windows\System\AyzwYhH.exe
  C:\Windows\System\AyzwYhH.exe
  2⤵
  PID:6912
- C:\Windows\System\WAOJsZo.exe
  C:\Windows\System\WAOJsZo.exe
  2⤵
  PID:6932
- C:\Windows\System\mdZuqKb.exe
  C:\Windows\System\mdZuqKb.exe
  2⤵
  PID:6952
- C:\Windows\System\cAYANRG.exe
  C:\Windows\System\cAYANRG.exe
  2⤵
  PID:6972
- C:\Windows\System\JdJGbOE.exe
  C:\Windows\System\JdJGbOE.exe
  2⤵
  PID:6992
- C:\Windows\System\ZBMYEfz.exe
  C:\Windows\System\ZBMYEfz.exe
  2⤵
  PID:7016
- C:\Windows\System\KdECSuE.exe
  C:\Windows\System\KdECSuE.exe
  2⤵
  PID:7044
- C:\Windows\System\RWnFOIi.exe
  C:\Windows\System\RWnFOIi.exe
  2⤵
  PID:7060
- C:\Windows\System\XgJGgrL.exe
  C:\Windows\System\XgJGgrL.exe
  2⤵
  PID:7080
- C:\Windows\System\ATbAdib.exe
  C:\Windows\System\ATbAdib.exe
  2⤵
  PID:7104
- C:\Windows\System\zyLoInt.exe
  C:\Windows\System\zyLoInt.exe
  2⤵
  PID:7124
- C:\Windows\System\gUdiqJR.exe
  C:\Windows\System\gUdiqJR.exe
  2⤵
  PID:7148
- C:\Windows\System\nJSCyBF.exe
  C:\Windows\System\nJSCyBF.exe
  2⤵
  PID:1636
- C:\Windows\System\WclHOoW.exe
  C:\Windows\System\WclHOoW.exe
  2⤵
  PID:1380
- C:\Windows\System\cXTFDcU.exe
  C:\Windows\System\cXTFDcU.exe
  2⤵
  PID:1696
- C:\Windows\System\JYNwvxg.exe
  C:\Windows\System\JYNwvxg.exe
  2⤵
  PID:2288
- C:\Windows\System\FUuepkq.exe
  C:\Windows\System\FUuepkq.exe
  2⤵
  PID:1732
- C:\Windows\System\ZrzrSxu.exe
  C:\Windows\System\ZrzrSxu.exe
  2⤵
  PID:5696
- C:\Windows\System\GPNwIii.exe
  C:\Windows\System\GPNwIii.exe
  2⤵
  PID:5776
- C:\Windows\System\iBNuyQU.exe
  C:\Windows\System\iBNuyQU.exe
  2⤵
  PID:5876
- C:\Windows\System\ebekWxO.exe
  C:\Windows\System\ebekWxO.exe
  2⤵
  PID:6064
- C:\Windows\System\fSdKLsU.exe
  C:\Windows\System\fSdKLsU.exe
  2⤵
  PID:5504
- C:\Windows\System\EPnKEuh.exe
  C:\Windows\System\EPnKEuh.exe
  2⤵
  PID:6188
- C:\Windows\System\NeEURrK.exe
  C:\Windows\System\NeEURrK.exe
  2⤵
  PID:7072
- C:\Windows\System\GOejvxi.exe
  C:\Windows\System\GOejvxi.exe
  2⤵
  PID:7008
- C:\Windows\System\IScmAvI.exe
  C:\Windows\System\IScmAvI.exe
  2⤵
  PID:6868
- C:\Windows\System\NJCbmGH.exe
  C:\Windows\System\NJCbmGH.exe
  2⤵
  PID:6800
- C:\Windows\System\RYxLmEt.exe
  C:\Windows\System\RYxLmEt.exe
  2⤵
  PID:5188
- C:\Windows\System\klPayka.exe
  C:\Windows\System\klPayka.exe
  2⤵
  PID:6420
- C:\Windows\System\PtvBnsW.exe
  C:\Windows\System\PtvBnsW.exe
  2⤵
  PID:6484
- C:\Windows\System\iLZoYKU.exe
  C:\Windows\System\iLZoYKU.exe
  2⤵
  PID:6524
- C:\Windows\System\qQDzxHl.exe
  C:\Windows\System\qQDzxHl.exe
  2⤵
  PID:6568
- C:\Windows\System\rEcNrVK.exe
  C:\Windows\System\rEcNrVK.exe
  2⤵
  PID:6616
- C:\Windows\System\uZRJrTc.exe
  C:\Windows\System\uZRJrTc.exe
  2⤵
  PID:5712
- C:\Windows\System\jkKESIc.exe
  C:\Windows\System\jkKESIc.exe
  2⤵
  PID:7176
- C:\Windows\System\jPdIyoz.exe
  C:\Windows\System\jPdIyoz.exe
  2⤵
  PID:7200
- C:\Windows\System\kbhefxm.exe
  C:\Windows\System\kbhefxm.exe
  2⤵
  PID:7220
- C:\Windows\System\RRXAJVe.exe
  C:\Windows\System\RRXAJVe.exe
  2⤵
  PID:7244
- C:\Windows\System\PSOddxS.exe
  C:\Windows\System\PSOddxS.exe
  2⤵
  PID:7268
- C:\Windows\System\CjOkQHi.exe
  C:\Windows\System\CjOkQHi.exe
  2⤵
  PID:7284
- C:\Windows\System\zxctitn.exe
  C:\Windows\System\zxctitn.exe
  2⤵
  PID:7308
- C:\Windows\System\qOMHxUN.exe
  C:\Windows\System\qOMHxUN.exe
  2⤵
  PID:7332
- C:\Windows\System\LWRTvDI.exe
  C:\Windows\System\LWRTvDI.exe
  2⤵
  PID:7356
- C:\Windows\System\SVVGqBL.exe
  C:\Windows\System\SVVGqBL.exe
  2⤵
  PID:7384
- C:\Windows\System\KeLbhXd.exe
  C:\Windows\System\KeLbhXd.exe
  2⤵
  PID:7408
- C:\Windows\System\oXRKDQR.exe
  C:\Windows\System\oXRKDQR.exe
  2⤵
  PID:7540
- C:\Windows\System\xwxQVvs.exe
  C:\Windows\System\xwxQVvs.exe
  2⤵
  PID:7560
- C:\Windows\System\hFoPTqg.exe
  C:\Windows\System\hFoPTqg.exe
  2⤵
  PID:7584
- C:\Windows\System\FrCCNfD.exe
  C:\Windows\System\FrCCNfD.exe
  2⤵
  PID:7600
- C:\Windows\System\BbMPkKB.exe
  C:\Windows\System\BbMPkKB.exe
  2⤵
  PID:7632
- C:\Windows\System\iFCJGRF.exe
  C:\Windows\System\iFCJGRF.exe
  2⤵
  PID:7656
- C:\Windows\System\NcdtKVZ.exe
  C:\Windows\System\NcdtKVZ.exe
  2⤵
  PID:7680
- C:\Windows\System\BGQaVve.exe
  C:\Windows\System\BGQaVve.exe
  2⤵
  PID:7708
- C:\Windows\System\BokSsvp.exe
  C:\Windows\System\BokSsvp.exe
  2⤵
  PID:7732
- C:\Windows\System\MaHxVGy.exe
  C:\Windows\System\MaHxVGy.exe
  2⤵
  PID:7752
- C:\Windows\System\UtGBdna.exe
  C:\Windows\System\UtGBdna.exe
  2⤵
  PID:7772
- C:\Windows\System\VpHffLL.exe
  C:\Windows\System\VpHffLL.exe
  2⤵
  PID:7796
- C:\Windows\System\ERhiKEH.exe
  C:\Windows\System\ERhiKEH.exe
  2⤵
  PID:7816
- C:\Windows\System\CqNIhfF.exe
  C:\Windows\System\CqNIhfF.exe
  2⤵
  PID:7960
- C:\Windows\System\DRtRHmo.exe
  C:\Windows\System\DRtRHmo.exe
  2⤵
  PID:7980
- C:\Windows\System\XhRcRIs.exe
  C:\Windows\System\XhRcRIs.exe
  2⤵
  PID:7996
- C:\Windows\System\vLTmwDi.exe
  C:\Windows\System\vLTmwDi.exe
  2⤵
  PID:8016
- C:\Windows\System\jrsFcyE.exe
  C:\Windows\System\jrsFcyE.exe
  2⤵
  PID:8036
- C:\Windows\System\jsJxuJq.exe
  C:\Windows\System\jsJxuJq.exe
  2⤵
  PID:8060
- C:\Windows\System\dhdalBR.exe
  C:\Windows\System\dhdalBR.exe
  2⤵
  PID:8084
- C:\Windows\System\CdEKiqC.exe
  C:\Windows\System\CdEKiqC.exe
  2⤵
  PID:8108
- C:\Windows\System\ZfuERLY.exe
  C:\Windows\System\ZfuERLY.exe
  2⤵
  PID:8128
- C:\Windows\System\NNzhzky.exe
  C:\Windows\System\NNzhzky.exe
  2⤵
  PID:8148
- C:\Windows\System\jsIbCDN.exe
  C:\Windows\System\jsIbCDN.exe
  2⤵
  PID:8172
- C:\Windows\System\xZraUQV.exe
  C:\Windows\System\xZraUQV.exe
  2⤵
  PID:6692
- C:\Windows\System\RKPnxIC.exe
  C:\Windows\System\RKPnxIC.exe
  2⤵
  PID:6740
- C:\Windows\System\jSqzQZh.exe
  C:\Windows\System\jSqzQZh.exe
  2⤵
  PID:6808
- C:\Windows\System\aatCaQl.exe
  C:\Windows\System\aatCaQl.exe
  2⤵
  PID:6892
- C:\Windows\System\NhNdmAm.exe
  C:\Windows\System\NhNdmAm.exe
  2⤵
  PID:6968
- C:\Windows\System\QglecDh.exe
  C:\Windows\System\QglecDh.exe
  2⤵
  PID:7024
- C:\Windows\System\VYgiTYv.exe
  C:\Windows\System\VYgiTYv.exe
  2⤵
  PID:7088
- C:\Windows\System\RmojwuS.exe
  C:\Windows\System\RmojwuS.exe
  2⤵
  PID:7140
- C:\Windows\System\ziOnSpY.exe
  C:\Windows\System\ziOnSpY.exe
  2⤵
  PID:6220
- C:\Windows\System\QrRqysR.exe
  C:\Windows\System\QrRqysR.exe
  2⤵
  PID:5060
- C:\Windows\System\HzvwQEQ.exe
  C:\Windows\System\HzvwQEQ.exe
  2⤵
  PID:7028
- C:\Windows\System\lIdJwxB.exe
  C:\Windows\System\lIdJwxB.exe
  2⤵
  PID:6780
- C:\Windows\System\gtdugRj.exe
  C:\Windows\System\gtdugRj.exe
  2⤵
  PID:6452
- C:\Windows\System\JEkGqvk.exe
  C:\Windows\System\JEkGqvk.exe
  2⤵
  PID:6600
- C:\Windows\System\JdoitZL.exe
  C:\Windows\System\JdoitZL.exe
  2⤵
  PID:6520
- C:\Windows\System\ueluhmh.exe
  C:\Windows\System\ueluhmh.exe
  2⤵
  PID:7172
- C:\Windows\System\UDOVZfL.exe
  C:\Windows\System\UDOVZfL.exe
  2⤵
  PID:7228
- C:\Windows\System\zdhyifY.exe
  C:\Windows\System\zdhyifY.exe
  2⤵
  PID:7276
- C:\Windows\System\pknMULE.exe
  C:\Windows\System\pknMULE.exe
  2⤵
  PID:7324
- C:\Windows\System\pXJzsYK.exe
  C:\Windows\System\pXJzsYK.exe
  2⤵
  PID:7676
- C:\Windows\System\ZuQGPgj.exe
  C:\Windows\System\ZuQGPgj.exe
  2⤵
  PID:7716
- C:\Windows\System\BphYBZO.exe
  C:\Windows\System\BphYBZO.exe
  2⤵
  PID:7764
- C:\Windows\System\GqfJWxs.exe
  C:\Windows\System\GqfJWxs.exe
  2⤵
  PID:6928
- C:\Windows\System\ozlpJiC.exe
  C:\Windows\System\ozlpJiC.exe
  2⤵
  PID:8196
- C:\Windows\System\JBfIeYx.exe
  C:\Windows\System\JBfIeYx.exe
  2⤵
  PID:8216
- C:\Windows\System\ejVaJjP.exe
  C:\Windows\System\ejVaJjP.exe
  2⤵
  PID:8236
- C:\Windows\System\FTFMaOf.exe
  C:\Windows\System\FTFMaOf.exe
  2⤵
  PID:8260
- C:\Windows\System\unTsvFn.exe
  C:\Windows\System\unTsvFn.exe
  2⤵
  PID:8280
- C:\Windows\System\dSCYkSe.exe
  C:\Windows\System\dSCYkSe.exe
  2⤵
  PID:8300
- C:\Windows\System\xmpNoXR.exe
  C:\Windows\System\xmpNoXR.exe
  2⤵
  PID:8324
- C:\Windows\System\ugqiuDq.exe
  C:\Windows\System\ugqiuDq.exe
  2⤵
  PID:8352
- C:\Windows\System\vVScfdq.exe
  C:\Windows\System\vVScfdq.exe
  2⤵
  PID:8368
- C:\Windows\System\nxzjHPU.exe
  C:\Windows\System\nxzjHPU.exe
  2⤵
  PID:8388
- C:\Windows\System\AwZFhOd.exe
  C:\Windows\System\AwZFhOd.exe
  2⤵
  PID:8416
- C:\Windows\System\bkXBFet.exe
  C:\Windows\System\bkXBFet.exe
  2⤵
  PID:8436
- C:\Windows\System\FxMetIO.exe
  C:\Windows\System\FxMetIO.exe
  2⤵
  PID:8488
- C:\Windows\System\zSqdclv.exe
  C:\Windows\System\zSqdclv.exe
  2⤵
  PID:8508
- C:\Windows\System\xaUVFbe.exe
  C:\Windows\System\xaUVFbe.exe
  2⤵
  PID:8528
- C:\Windows\System\WyMlDrF.exe
  C:\Windows\System\WyMlDrF.exe
  2⤵
  PID:8548
- C:\Windows\System\uPgLiyO.exe
  C:\Windows\System\uPgLiyO.exe
  2⤵
  PID:8564
- C:\Windows\System\dHleDQs.exe
  C:\Windows\System\dHleDQs.exe
  2⤵
  PID:8584
- C:\Windows\System\LvxOXDF.exe
  C:\Windows\System\LvxOXDF.exe
  2⤵
  PID:8608
- C:\Windows\System\Tajfewa.exe
  C:\Windows\System\Tajfewa.exe
  2⤵
  PID:8636
- C:\Windows\System\zfQHacs.exe
  C:\Windows\System\zfQHacs.exe
  2⤵
  PID:8668
- C:\Windows\System\alZpOya.exe
  C:\Windows\System\alZpOya.exe
  2⤵
  PID:8692
- C:\Windows\System\wakmAHv.exe
  C:\Windows\System\wakmAHv.exe
  2⤵
  PID:8712
- C:\Windows\System\WTObnbC.exe
  C:\Windows\System\WTObnbC.exe
  2⤵
  PID:8728
- C:\Windows\System\JQzthcj.exe
  C:\Windows\System\JQzthcj.exe
  2⤵
  PID:8748
- C:\Windows\System\ngzbpqD.exe
  C:\Windows\System\ngzbpqD.exe
  2⤵
  PID:8780
- C:\Windows\System\iVlAspq.exe
  C:\Windows\System\iVlAspq.exe
  2⤵
  PID:8796
- C:\Windows\System\vrksyLZ.exe
  C:\Windows\System\vrksyLZ.exe
  2⤵
  PID:8812
- C:\Windows\System\MnbutJv.exe
  C:\Windows\System\MnbutJv.exe
  2⤵
  PID:8872
- C:\Windows\System\JnJnTfs.exe
  C:\Windows\System\JnJnTfs.exe
  2⤵
  PID:8892
- C:\Windows\System\TBxapxL.exe
  C:\Windows\System\TBxapxL.exe
  2⤵
  PID:8912
- C:\Windows\System\gAbDjCJ.exe
  C:\Windows\System\gAbDjCJ.exe
  2⤵
  PID:9004
- C:\Windows\System\hvWOLoU.exe
  C:\Windows\System\hvWOLoU.exe
  2⤵
  PID:9028
- C:\Windows\System\phPJYxK.exe
  C:\Windows\System\phPJYxK.exe
  2⤵
  PID:9044
- C:\Windows\System\cXHBkrJ.exe
  C:\Windows\System\cXHBkrJ.exe
  2⤵
  PID:9060
- C:\Windows\System\vhYrsMS.exe
  C:\Windows\System\vhYrsMS.exe
  2⤵
  PID:9076
- C:\Windows\System\NkjOPRd.exe
  C:\Windows\System\NkjOPRd.exe
  2⤵
  PID:9104
- C:\Windows\System\UmToGPw.exe
  C:\Windows\System\UmToGPw.exe
  2⤵
  PID:9124
- C:\Windows\System\WFEjDzV.exe
  C:\Windows\System\WFEjDzV.exe
  2⤵
  PID:9148
- C:\Windows\System\tRKpfrx.exe
  C:\Windows\System\tRKpfrx.exe
  2⤵
  PID:9172
- C:\Windows\System\LIChEDn.exe
  C:\Windows\System\LIChEDn.exe
  2⤵
  PID:9196
- C:\Windows\System\xUtaZDW.exe
  C:\Windows\System\xUtaZDW.exe
  2⤵
  PID:5068
- C:\Windows\System\GNvPRXS.exe
  C:\Windows\System\GNvPRXS.exe
  2⤵
  PID:5456
- C:\Windows\System\KfaWkFp.exe
  C:\Windows\System\KfaWkFp.exe
  2⤵
  PID:6960
- C:\Windows\System\DsGDNVp.exe
  C:\Windows\System\DsGDNVp.exe
  2⤵
  PID:6352
- C:\Windows\System\MEYfzIi.exe
  C:\Windows\System\MEYfzIi.exe
  2⤵
  PID:6584
- C:\Windows\System\rPBoEyw.exe
  C:\Windows\System\rPBoEyw.exe
  2⤵
  PID:7216
- C:\Windows\System\NjMpAYS.exe
  C:\Windows\System\NjMpAYS.exe
  2⤵
  PID:7292
- C:\Windows\System\oAkpVuj.exe
  C:\Windows\System\oAkpVuj.exe
  2⤵
  PID:7484
- C:\Windows\System\TXWiXoQ.exe
  C:\Windows\System\TXWiXoQ.exe
  2⤵
  PID:8212
- C:\Windows\System\ChzJzEF.exe
  C:\Windows\System\ChzJzEF.exe
  2⤵
  PID:8276
- C:\Windows\System\uLLlYhY.exe
  C:\Windows\System\uLLlYhY.exe
  2⤵
  PID:7640
- C:\Windows\System\FrloQmp.exe
  C:\Windows\System\FrloQmp.exe
  2⤵
  PID:7728
- C:\Windows\System\TPSzNPg.exe
  C:\Windows\System\TPSzNPg.exe
  2⤵
  PID:4576
- C:\Windows\System\CNByXfi.exe
  C:\Windows\System\CNByXfi.exe
  2⤵
  PID:8292
- C:\Windows\System\PwXahsL.exe
  C:\Windows\System\PwXahsL.exe
  2⤵
  PID:6788
- C:\Windows\System\neCNzvI.exe
  C:\Windows\System\neCNzvI.exe
  2⤵
  PID:6964
- C:\Windows\System\bKbXcaB.exe
  C:\Windows\System\bKbXcaB.exe
  2⤵
  PID:8232
- C:\Windows\System\lqHNFgF.exe
  C:\Windows\System\lqHNFgF.exe
  2⤵
  PID:8332
- C:\Windows\System\mOEyRUL.exe
  C:\Windows\System\mOEyRUL.exe
  2⤵
  PID:8384
- C:\Windows\System\USdiyQD.exe
  C:\Windows\System\USdiyQD.exe
  2⤵
  PID:3280
- C:\Windows\System\OHNwxuL.exe
  C:\Windows\System\OHNwxuL.exe
  2⤵
  PID:8536
- C:\Windows\System\bGqyOLy.exe
  C:\Windows\System\bGqyOLy.exe
  2⤵
  PID:8580
- C:\Windows\System\yWxXzzR.exe
  C:\Windows\System\yWxXzzR.exe
  2⤵
  PID:8656
- C:\Windows\System\ONumOAO.exe
  C:\Windows\System\ONumOAO.exe
  2⤵
  PID:8756
- C:\Windows\System\KLjqGFG.exe
  C:\Windows\System\KLjqGFG.exe
  2⤵
  PID:9072
- C:\Windows\System\EixYYIv.exe
  C:\Windows\System\EixYYIv.exe
  2⤵
  PID:8788
- C:\Windows\System\uLdHmQJ.exe
  C:\Windows\System\uLdHmQJ.exe
  2⤵
  PID:8836
- C:\Windows\System\bwnSoVu.exe
  C:\Windows\System\bwnSoVu.exe
  2⤵
  PID:3068
- C:\Windows\System\knsxIQI.exe
  C:\Windows\System\knsxIQI.exe
  2⤵
  PID:8272
- C:\Windows\System\MwDjOoa.exe
  C:\Windows\System\MwDjOoa.exe
  2⤵
  PID:3480
- C:\Windows\System\IbbosDT.exe
  C:\Windows\System\IbbosDT.exe
  2⤵
  PID:8964
- C:\Windows\System\vDsLTEx.exe
  C:\Windows\System\vDsLTEx.exe
  2⤵
  PID:8972
- C:\Windows\System\BHQiLiQ.exe
  C:\Windows\System\BHQiLiQ.exe
  2⤵
  PID:9220
- C:\Windows\System\BAIVJLF.exe
  C:\Windows\System\BAIVJLF.exe
  2⤵
  PID:9236
- C:\Windows\System\YtDLRbE.exe
  C:\Windows\System\YtDLRbE.exe
  2⤵
  PID:9260
- C:\Windows\System\mDRiosH.exe
  C:\Windows\System\mDRiosH.exe
  2⤵
  PID:9280
- C:\Windows\System\qDDMWAo.exe
  C:\Windows\System\qDDMWAo.exe
  2⤵
  PID:9296
- C:\Windows\System\UjhYStU.exe
  C:\Windows\System\UjhYStU.exe
  2⤵
  PID:9316
- C:\Windows\System\RizYyFa.exe
  C:\Windows\System\RizYyFa.exe
  2⤵
  PID:9336
- C:\Windows\System\AVbgvDL.exe
  C:\Windows\System\AVbgvDL.exe
  2⤵
  PID:9360
- C:\Windows\System\lladdJZ.exe
  C:\Windows\System\lladdJZ.exe
  2⤵
  PID:9380
- C:\Windows\System\vRFsunb.exe
  C:\Windows\System\vRFsunb.exe
  2⤵
  PID:9404
- C:\Windows\System\TsYpnwk.exe
  C:\Windows\System\TsYpnwk.exe
  2⤵
  PID:9420
- C:\Windows\System\QJiIJig.exe
  C:\Windows\System\QJiIJig.exe
  2⤵
  PID:9440
- C:\Windows\System\YIsJCaL.exe
  C:\Windows\System\YIsJCaL.exe
  2⤵
  PID:9468
- C:\Windows\System\zvoFsUl.exe
  C:\Windows\System\zvoFsUl.exe
  2⤵
  PID:9488
- C:\Windows\System\eZHQaqe.exe
  C:\Windows\System\eZHQaqe.exe
  2⤵
  PID:9508
- C:\Windows\System\qOKlJTU.exe
  C:\Windows\System\qOKlJTU.exe
  2⤵
  PID:9536
- C:\Windows\System\YbuDzNg.exe
  C:\Windows\System\YbuDzNg.exe
  2⤵
  PID:9552
- C:\Windows\System\HLcXAcU.exe
  C:\Windows\System\HLcXAcU.exe
  2⤵
  PID:9572
- C:\Windows\System\OhwhnGn.exe
  C:\Windows\System\OhwhnGn.exe
  2⤵
  PID:9592
- C:\Windows\System\Svfyoju.exe
  C:\Windows\System\Svfyoju.exe
  2⤵
  PID:9608
- C:\Windows\System\senVrlm.exe
  C:\Windows\System\senVrlm.exe
  2⤵
  PID:9636
- C:\Windows\System\JgUhwKR.exe
  C:\Windows\System\JgUhwKR.exe
  2⤵
  PID:9656
- C:\Windows\System\opeFtyL.exe
  C:\Windows\System\opeFtyL.exe
  2⤵
  PID:9676
- C:\Windows\System\BaytUTU.exe
  C:\Windows\System\BaytUTU.exe
  2⤵
  PID:9696
- C:\Windows\System\tFjrFYd.exe
  C:\Windows\System\tFjrFYd.exe
  2⤵
  PID:9716
- C:\Windows\System\kFpMyRw.exe
  C:\Windows\System\kFpMyRw.exe
  2⤵
  PID:9740
- C:\Windows\System\YPcrmBy.exe
  C:\Windows\System\YPcrmBy.exe
  2⤵
  PID:9760
- C:\Windows\System\UYVjCCr.exe
  C:\Windows\System\UYVjCCr.exe
  2⤵
  PID:9780
- C:\Windows\System\OApoNam.exe
  C:\Windows\System\OApoNam.exe
  2⤵
  PID:9796
- C:\Windows\System\LMtAxtu.exe
  C:\Windows\System\LMtAxtu.exe
  2⤵
  PID:9820
- C:\Windows\System\NYBoPbt.exe
  C:\Windows\System\NYBoPbt.exe
  2⤵
  PID:9844
- C:\Windows\System\YMZphxw.exe
  C:\Windows\System\YMZphxw.exe
  2⤵
  PID:9860
- C:\Windows\System\XOADDhN.exe
  C:\Windows\System\XOADDhN.exe
  2⤵
  PID:9892
- C:\Windows\System\ezCHazD.exe
  C:\Windows\System\ezCHazD.exe
  2⤵
  PID:9916
- C:\Windows\System\ylRMEkY.exe
  C:\Windows\System\ylRMEkY.exe
  2⤵
  PID:9940
- C:\Windows\System\wMnXJHX.exe
  C:\Windows\System\wMnXJHX.exe
  2⤵
  PID:9956
- C:\Windows\System\jrSnmTp.exe
  C:\Windows\System\jrSnmTp.exe
  2⤵
  PID:9980
- C:\Windows\System\OnjxrEw.exe
  C:\Windows\System\OnjxrEw.exe
  2⤵
  PID:10000
- C:\Windows\System\HQTADVI.exe
  C:\Windows\System\HQTADVI.exe
  2⤵
  PID:10172
- C:\Windows\System\AGSVlMI.exe
  C:\Windows\System\AGSVlMI.exe
  2⤵
  PID:10196
- C:\Windows\System\aDjdVnW.exe
  C:\Windows\System\aDjdVnW.exe
  2⤵
  PID:10228
- C:\Windows\System\AKyFdBD.exe
  C:\Windows\System\AKyFdBD.exe
  2⤵
  PID:8516
- C:\Windows\System\enmrPFc.exe
  C:\Windows\System\enmrPFc.exe
  2⤵
  PID:8720
- C:\Windows\System\YtBeGIg.exe
  C:\Windows\System\YtBeGIg.exe
  2⤵
  PID:6864
- C:\Windows\System\cyQalbW.exe
  C:\Windows\System\cyQalbW.exe
  2⤵
  PID:9056
- C:\Windows\System\DvYfjNc.exe
  C:\Windows\System\DvYfjNc.exe
  2⤵
  PID:9144
- C:\Windows\System\dZWquKq.exe
  C:\Windows\System\dZWquKq.exe
  2⤵
  PID:9204
- C:\Windows\System\VLxjkOj.exe
  C:\Windows\System\VLxjkOj.exe
  2⤵
  PID:6848
- C:\Windows\System\JIAWRSQ.exe
  C:\Windows\System\JIAWRSQ.exe
  2⤵
  PID:5992
- C:\Windows\System\ClOsxWU.exe
  C:\Windows\System\ClOsxWU.exe
  2⤵
  PID:8404
- C:\Windows\System\sQgOthp.exe
  C:\Windows\System\sQgOthp.exe
  2⤵
  PID:7304
- C:\Windows\System\iDdNuYT.exe
  C:\Windows\System\iDdNuYT.exe
  2⤵
  PID:5036
- C:\Windows\System\dwMnbwi.exe
  C:\Windows\System\dwMnbwi.exe
  2⤵
  PID:2084
- C:\Windows\System\mUOWbPa.exe
  C:\Windows\System\mUOWbPa.exe
  2⤵
  PID:2292
- C:\Windows\System\SNQtVmh.exe
  C:\Windows\System\SNQtVmh.exe
  2⤵
  PID:9276
- C:\Windows\System\wtEMTYm.exe
  C:\Windows\System\wtEMTYm.exe
  2⤵
  PID:9344
- C:\Windows\System\OEyIEqS.exe
  C:\Windows\System\OEyIEqS.exe
  2⤵
  PID:9392
- C:\Windows\System\GPqdZqZ.exe
  C:\Windows\System\GPqdZqZ.exe
  2⤵
  PID:8824
- C:\Windows\System\HbSDZlf.exe
  C:\Windows\System\HbSDZlf.exe
  2⤵
  PID:9672
- C:\Windows\System\AYvYFHX.exe
  C:\Windows\System\AYvYFHX.exe
  2⤵
  PID:9252
- C:\Windows\System\qBBADFi.exe
  C:\Windows\System\qBBADFi.exe
  2⤵
  PID:9952
- C:\Windows\System\rXmvzoH.exe
  C:\Windows\System\rXmvzoH.exe
  2⤵
  PID:9476
- C:\Windows\System\FRxWoTa.exe
  C:\Windows\System\FRxWoTa.exe
  2⤵
  PID:9852
- C:\Windows\System\slJDeeY.exe
  C:\Windows\System\slJDeeY.exe
  2⤵
  PID:9500
- C:\Windows\System\REpQwdG.exe
  C:\Windows\System\REpQwdG.exe
  2⤵
  PID:9616
- C:\Windows\System\ZbYJHBc.exe
  C:\Windows\System\ZbYJHBc.exe
  2⤵
  PID:9732
- C:\Windows\System\bnpbcPU.exe
  C:\Windows\System\bnpbcPU.exe
  2⤵
  PID:9100
- C:\Windows\System\CVmGFAr.exe
  C:\Windows\System\CVmGFAr.exe
  2⤵
  PID:9516
- C:\Windows\System\eIKETux.exe
  C:\Windows\System\eIKETux.exe
  2⤵
  PID:2712
- C:\Windows\System\UxAmbWi.exe
  C:\Windows\System\UxAmbWi.exe
  2⤵
  PID:9688
- C:\Windows\System\LFfjVQJ.exe
  C:\Windows\System\LFfjVQJ.exe
  2⤵
  PID:10108
- C:\Windows\System\OvEjqXY.exe
  C:\Windows\System\OvEjqXY.exe
  2⤵
  PID:4944
- C:\Windows\System\jCHwseA.exe
  C:\Windows\System\jCHwseA.exe
  2⤵
  PID:9356
- C:\Windows\System\SNGtDIg.exe
  C:\Windows\System\SNGtDIg.exe
  2⤵
  PID:10160
- C:\Windows\System\UbkIojC.exe
  C:\Windows\System\UbkIojC.exe
  2⤵
  PID:10256
- C:\Windows\System\pyUMdIJ.exe
  C:\Windows\System\pyUMdIJ.exe
  2⤵
  PID:10276
- C:\Windows\System\zrxCmEo.exe
  C:\Windows\System\zrxCmEo.exe
  2⤵
  PID:10296
- C:\Windows\System\HFqVcUv.exe
  C:\Windows\System\HFqVcUv.exe
  2⤵
  PID:10316
- C:\Windows\System\RKwqtVI.exe
  C:\Windows\System\RKwqtVI.exe
  2⤵
  PID:10348
- C:\Windows\System\xBGnnOx.exe
  C:\Windows\System\xBGnnOx.exe
  2⤵
  PID:10368
- C:\Windows\System\sQBvaeS.exe
  C:\Windows\System\sQBvaeS.exe
  2⤵
  PID:10396
- C:\Windows\System\wAyqxIB.exe
  C:\Windows\System\wAyqxIB.exe
  2⤵
  PID:10420
- C:\Windows\System\jYGQXIl.exe
  C:\Windows\System\jYGQXIl.exe
  2⤵
  PID:10452
- C:\Windows\System\jyDIIxH.exe
  C:\Windows\System\jyDIIxH.exe
  2⤵
  PID:10468
- C:\Windows\System\neIVdCz.exe
  C:\Windows\System\neIVdCz.exe
  2⤵
  PID:10488
- C:\Windows\System\loIObSv.exe
  C:\Windows\System\loIObSv.exe
  2⤵
  PID:10516
- C:\Windows\System\PikzwHL.exe
  C:\Windows\System\PikzwHL.exe
  2⤵
  PID:10536
- C:\Windows\System\mWYTcQc.exe
  C:\Windows\System\mWYTcQc.exe
  2⤵
  PID:10556
- C:\Windows\System\FfCpDcm.exe
  C:\Windows\System\FfCpDcm.exe
  2⤵
  PID:10580
- C:\Windows\System\XNrARHG.exe
  C:\Windows\System\XNrARHG.exe
  2⤵
  PID:10600
- C:\Windows\System\yOboPAO.exe
  C:\Windows\System\yOboPAO.exe
  2⤵
  PID:10620
- C:\Windows\System\HMPPaTb.exe
  C:\Windows\System\HMPPaTb.exe
  2⤵
  PID:10640
- C:\Windows\System\qzdGQwM.exe
  C:\Windows\System\qzdGQwM.exe
  2⤵
  PID:10656
- C:\Windows\System\VfrHNGT.exe
  C:\Windows\System\VfrHNGT.exe
  2⤵
  PID:10672
- C:\Windows\System\oCdQJbX.exe
  C:\Windows\System\oCdQJbX.exe
  2⤵
  PID:10688
- C:\Windows\System\JFjOGqV.exe
  C:\Windows\System\JFjOGqV.exe
  2⤵
  PID:10704
- C:\Windows\System\FukTqNm.exe
  C:\Windows\System\FukTqNm.exe
  2⤵
  PID:10736
- C:\Windows\System\hbeCIXj.exe
  C:\Windows\System\hbeCIXj.exe
  2⤵
  PID:10776
- C:\Windows\System\XLeyHRn.exe
  C:\Windows\System\XLeyHRn.exe
  2⤵
  PID:10796
- C:\Windows\System\MCkDvyH.exe
  C:\Windows\System\MCkDvyH.exe
  2⤵
  PID:10812
- C:\Windows\System\YvuclMl.exe
  C:\Windows\System\YvuclMl.exe
  2⤵
  PID:10836
- C:\Windows\System\DnjjVkk.exe
  C:\Windows\System\DnjjVkk.exe
  2⤵
  PID:10856
- C:\Windows\System\hsjykqM.exe
  C:\Windows\System\hsjykqM.exe
  2⤵
  PID:10880
- C:\Windows\System\SxGjwFJ.exe
  C:\Windows\System\SxGjwFJ.exe
  2⤵
  PID:10908
- C:\Windows\System\AtQoMvq.exe
  C:\Windows\System\AtQoMvq.exe
  2⤵
  PID:10928
- C:\Windows\System\lBMUYaT.exe
  C:\Windows\System\lBMUYaT.exe
  2⤵
  PID:10952
- C:\Windows\System\gEagCPQ.exe
  C:\Windows\System\gEagCPQ.exe
  2⤵
  PID:10980
- C:\Windows\System\ClxMgCl.exe
  C:\Windows\System\ClxMgCl.exe
  2⤵
  PID:11000
- C:\Windows\System\ymUWNXv.exe
  C:\Windows\System\ymUWNXv.exe
  2⤵
  PID:11024
- C:\Windows\System\aZlCuFi.exe
  C:\Windows\System\aZlCuFi.exe
  2⤵
  PID:11044
- C:\Windows\System\JpOtoSf.exe
  C:\Windows\System\JpOtoSf.exe
  2⤵
  PID:11072
- C:\Windows\System\gMzhwMT.exe
  C:\Windows\System\gMzhwMT.exe
  2⤵
  PID:11092
- C:\Windows\System\rNpELze.exe
  C:\Windows\System\rNpELze.exe
  2⤵
  PID:11112
- C:\Windows\System\aXFaasm.exe
  C:\Windows\System\aXFaasm.exe
  2⤵
  PID:11132
- C:\Windows\System\bUdHRsb.exe
  C:\Windows\System\bUdHRsb.exe
  2⤵
  PID:11164
- C:\Windows\System\SXVIKlB.exe
  C:\Windows\System\SXVIKlB.exe
  2⤵
  PID:11184
- C:\Windows\System\dOekHAy.exe
  C:\Windows\System\dOekHAy.exe
  2⤵
  PID:11200
- C:\Windows\System\euzAHeC.exe
  C:\Windows\System\euzAHeC.exe
  2⤵
  PID:11220
- C:\Windows\System\kLfjsma.exe
  C:\Windows\System\kLfjsma.exe
  2⤵
  PID:11244
- C:\Windows\System\jpRdXLy.exe
  C:\Windows\System\jpRdXLy.exe
  2⤵
  PID:11260
- C:\Windows\System\xQuuWQU.exe
  C:\Windows\System\xQuuWQU.exe
  2⤵
  PID:9168
- C:\Windows\System\jjubKlO.exe
  C:\Windows\System\jjubKlO.exe
  2⤵
  PID:9460
- C:\Windows\System\ydWlTwV.exe
  C:\Windows\System\ydWlTwV.exe
  2⤵
  PID:9588
- C:\Windows\System\MHIuQgm.exe
  C:\Windows\System\MHIuQgm.exe
  2⤵
  PID:4052
- C:\Windows\System\sQQFJoN.exe
  C:\Windows\System\sQQFJoN.exe
  2⤵
  PID:9368
- C:\Windows\System\onokDWp.exe
  C:\Windows\System\onokDWp.exe
  2⤵
  PID:10064
- C:\Windows\System\JqevALk.exe
  C:\Windows\System\JqevALk.exe
  2⤵
  PID:3524
- C:\Windows\System\zJzVUiE.exe
  C:\Windows\System\zJzVUiE.exe
  2⤵
  PID:9828
- C:\Windows\System\UrLuWJi.exe
  C:\Windows\System\UrLuWJi.exe
  2⤵
  PID:9504
- C:\Windows\System\YtwMdIF.exe
  C:\Windows\System\YtwMdIF.exe
  2⤵
  PID:10144
- C:\Windows\System\aGtFXmb.exe
  C:\Windows\System\aGtFXmb.exe
  2⤵
  PID:9684
- C:\Windows\System\aInaLRU.exe
  C:\Windows\System\aInaLRU.exe
  2⤵
  PID:8920
- C:\Windows\System\HnfzsXX.exe
  C:\Windows\System\HnfzsXX.exe
  2⤵
  PID:10312
- C:\Windows\System\akNFjpI.exe
  C:\Windows\System\akNFjpI.exe
  2⤵
  PID:8804
- C:\Windows\System\heLBiLh.exe
  C:\Windows\System\heLBiLh.exe
  2⤵
  PID:3592
- C:\Windows\System\OufENBF.exe
  C:\Windows\System\OufENBF.exe
  2⤵
  PID:10592
- C:\Windows\System\tlIeXtJ.exe
  C:\Windows\System\tlIeXtJ.exe
  2⤵
  PID:10636
- C:\Windows\System\BDeCAir.exe
  C:\Windows\System\BDeCAir.exe
  2⤵
  PID:4604
- C:\Windows\System\GfFuUlM.exe
  C:\Windows\System\GfFuUlM.exe
  2⤵
  PID:2244
- C:\Windows\System\BhGQbDB.exe
  C:\Windows\System\BhGQbDB.exe
  2⤵
  PID:9432
- C:\Windows\System\APVxdRW.exe
  C:\Windows\System\APVxdRW.exe
  2⤵
  PID:1496
- C:\Windows\System\MsSXHWl.exe
  C:\Windows\System\MsSXHWl.exe
  2⤵
  PID:10136
- C:\Windows\System\HNSbRFg.exe
  C:\Windows\System\HNSbRFg.exe
  2⤵
  PID:10216
- C:\Windows\System\hMIGNPP.exe
  C:\Windows\System\hMIGNPP.exe
  2⤵
  PID:11272
- C:\Windows\System\XowjCPn.exe
  C:\Windows\System\XowjCPn.exe
  2⤵
  PID:11296
- C:\Windows\System\cHxYCxr.exe
  C:\Windows\System\cHxYCxr.exe
  2⤵
  PID:11320
- C:\Windows\System\BUvYGQM.exe
  C:\Windows\System\BUvYGQM.exe
  2⤵
  PID:11336
- C:\Windows\System\rYTfNBV.exe
  C:\Windows\System\rYTfNBV.exe
  2⤵
  PID:11352
- C:\Windows\System\zquXAVB.exe
  C:\Windows\System\zquXAVB.exe
  2⤵
  PID:11372
- C:\Windows\System\mlbscEV.exe
  C:\Windows\System\mlbscEV.exe
  2⤵
  PID:11800
- C:\Windows\System\JhDooJl.exe
  C:\Windows\System\JhDooJl.exe
  2⤵
  PID:11824
- C:\Windows\System\cSASAsE.exe
  C:\Windows\System\cSASAsE.exe
  2⤵
  PID:11860
- C:\Windows\System\XUazGgo.exe
  C:\Windows\System\XUazGgo.exe
  2⤵
  PID:11896
- C:\Windows\System\BhGaMuh.exe
  C:\Windows\System\BhGaMuh.exe
  2⤵
  PID:11920
- C:\Windows\System\ieASyvC.exe
  C:\Windows\System\ieASyvC.exe
  2⤵
  PID:11944
- C:\Windows\System\YqFXMdB.exe
  C:\Windows\System\YqFXMdB.exe
  2⤵
  PID:11964
- C:\Windows\System\vanpmcb.exe
  C:\Windows\System\vanpmcb.exe
  2⤵
  PID:11992
- C:\Windows\System\RLcLlyI.exe
  C:\Windows\System\RLcLlyI.exe
  2⤵
  PID:12016
- C:\Windows\System\huMXAMc.exe
  C:\Windows\System\huMXAMc.exe
  2⤵
  PID:12064
- C:\Windows\System\wzPdtGP.exe
  C:\Windows\System\wzPdtGP.exe
  2⤵
  PID:12084
- C:\Windows\System\qYPqvlu.exe
  C:\Windows\System\qYPqvlu.exe
  2⤵
  PID:12128
- C:\Windows\System\EampDoJ.exe
  C:\Windows\System\EampDoJ.exe
  2⤵
  PID:12148
- C:\Windows\System\lWdnYRX.exe
  C:\Windows\System\lWdnYRX.exe
  2⤵
  PID:12176
- C:\Windows\System\HbZGtil.exe
  C:\Windows\System\HbZGtil.exe
  2⤵
  PID:12204
- C:\Windows\System\FzkIzMc.exe
  C:\Windows\System\FzkIzMc.exe
  2⤵
  PID:12240
- C:\Windows\System\dwBTjzg.exe
  C:\Windows\System\dwBTjzg.exe
  2⤵
  PID:12256
- C:\Windows\System\mvrElkC.exe
  C:\Windows\System\mvrElkC.exe
  2⤵
  PID:12272
- C:\Windows\System\sEESSRT.exe
  C:\Windows\System\sEESSRT.exe
  2⤵
  PID:8520
- C:\Windows\System\OSVHNzc.exe
  C:\Windows\System\OSVHNzc.exe
  2⤵
  PID:10356
- C:\Windows\System\CHbfgQt.exe
  C:\Windows\System\CHbfgQt.exe
  2⤵
  PID:6472
- C:\Windows\System\zmpirRc.exe
  C:\Windows\System\zmpirRc.exe
  2⤵
  PID:9112
- C:\Windows\System\wHumkGD.exe
  C:\Windows\System\wHumkGD.exe
  2⤵
  PID:10436
- C:\Windows\System\ROTrnNM.exe
  C:\Windows\System\ROTrnNM.exe
  2⤵
  PID:11216
- C:\Windows\System\qNRHBFZ.exe
  C:\Windows\System\qNRHBFZ.exe
  2⤵
  PID:11256
- C:\Windows\System\tsZcDKi.exe
  C:\Windows\System\tsZcDKi.exe
  2⤵
  PID:10616
- C:\Windows\System\QGCqvcm.exe
  C:\Windows\System\QGCqvcm.exe
  2⤵
  PID:10680
- C:\Windows\System\clSBJsq.exe
  C:\Windows\System\clSBJsq.exe
  2⤵
  PID:9904
- C:\Windows\System\REDcVDd.exe
  C:\Windows\System\REDcVDd.exe
  2⤵
  PID:9884
- C:\Windows\System\MUQWvJq.exe
  C:\Windows\System\MUQWvJq.exe
  2⤵
  PID:9544
- C:\Windows\System\OapqMjx.exe
  C:\Windows\System\OapqMjx.exe
  2⤵
  PID:10040
- C:\Windows\System\StBfHOy.exe
  C:\Windows\System\StBfHOy.exe
  2⤵
  PID:2748
- C:\Windows\System\bVHnuna.exe
  C:\Windows\System\bVHnuna.exe
  2⤵
  PID:10184
- C:\Windows\System\CbRoZyq.exe
  C:\Windows\System\CbRoZyq.exe
  2⤵
  PID:10264
- C:\Windows\System\INwiOgi.exe
  C:\Windows\System\INwiOgi.exe
  2⤵
  PID:11176
- C:\Windows\System\ETKzaDD.exe
  C:\Windows\System\ETKzaDD.exe
  2⤵
  PID:10484
- C:\Windows\System\niTDUsM.exe
  C:\Windows\System\niTDUsM.exe
  2⤵
  PID:10572
- C:\Windows\System\CeMMoKA.exe
  C:\Windows\System\CeMMoKA.exe
  2⤵
  PID:10788
- C:\Windows\System\XsMUMHA.exe
  C:\Windows\System\XsMUMHA.exe
  2⤵
  PID:10904
- C:\Windows\System\DwdPitD.exe
  C:\Windows\System\DwdPitD.exe
  2⤵
  PID:10864
- C:\Windows\System\Wzkomvy.exe
  C:\Windows\System\Wzkomvy.exe
  2⤵
  PID:1780
- C:\Windows\System\lBUDBJn.exe
  C:\Windows\System\lBUDBJn.exe
  2⤵
  PID:10920
- C:\Windows\System\GcARJhf.exe
  C:\Windows\System\GcARJhf.exe
  2⤵
  PID:11128
- C:\Windows\System\DNsotNZ.exe
  C:\Windows\System\DNsotNZ.exe
  2⤵
  PID:11328
- C:\Windows\System\CZIrJrU.exe
  C:\Windows\System\CZIrJrU.exe
  2⤵
  PID:11380
- C:\Windows\System\vVjMUff.exe
  C:\Windows\System\vVjMUff.exe
  2⤵
  PID:11192
- C:\Windows\System\FDYdSzj.exe
  C:\Windows\System\FDYdSzj.exe
  2⤵
  PID:11812
- C:\Windows\System\VVyjrGV.exe
  C:\Windows\System\VVyjrGV.exe
  2⤵
  PID:6876
- C:\Windows\System\gnENdzW.exe
  C:\Windows\System\gnENdzW.exe
  2⤵
  PID:3108
- C:\Windows\System\VKDPovc.exe
  C:\Windows\System\VKDPovc.exe
  2⤵
  PID:12292
- C:\Windows\System\PGFajOu.exe
  C:\Windows\System\PGFajOu.exe
  2⤵
  PID:12312
- C:\Windows\System\Tnphobs.exe
  C:\Windows\System\Tnphobs.exe
  2⤵
  PID:12332
- C:\Windows\System\XtbDzVc.exe
  C:\Windows\System\XtbDzVc.exe
  2⤵
  PID:12352
- C:\Windows\System\JTNkfyr.exe
  C:\Windows\System\JTNkfyr.exe
  2⤵
  PID:12376
- C:\Windows\System\bTsPBLr.exe
  C:\Windows\System\bTsPBLr.exe
  2⤵
  PID:12400
- C:\Windows\System\iUfhPMT.exe
  C:\Windows\System\iUfhPMT.exe
  2⤵
  PID:12424
- C:\Windows\System\TncSdaA.exe
  C:\Windows\System\TncSdaA.exe
  2⤵
  PID:12444
- C:\Windows\System\IDknLxu.exe
  C:\Windows\System\IDknLxu.exe
  2⤵
  PID:12460
- C:\Windows\System\GsUXymA.exe
  C:\Windows\System\GsUXymA.exe
  2⤵
  PID:12484
- C:\Windows\System\NfrOgES.exe
  C:\Windows\System\NfrOgES.exe
  2⤵
  PID:12500
- C:\Windows\System\jdYGCqM.exe
  C:\Windows\System\jdYGCqM.exe
  2⤵
  PID:12528
- C:\Windows\System\AsNyYDa.exe
  C:\Windows\System\AsNyYDa.exe
  2⤵
  PID:12548
- C:\Windows\System\PsnFfcm.exe
  C:\Windows\System\PsnFfcm.exe
  2⤵
  PID:12572
- C:\Windows\System\tDzjlzr.exe
  C:\Windows\System\tDzjlzr.exe
  2⤵
  PID:12596
- C:\Windows\System\bGAMtxD.exe
  C:\Windows\System\bGAMtxD.exe
  2⤵
  PID:12612
- C:\Windows\System\feCpRXu.exe
  C:\Windows\System\feCpRXu.exe
  2⤵
  PID:12628
- C:\Windows\System\uJLtUmD.exe
  C:\Windows\System\uJLtUmD.exe
  2⤵
  PID:13272
- C:\Windows\System\qgKCZGt.exe
  C:\Windows\System\qgKCZGt.exe
  2⤵
  PID:8648
- C:\Windows\System\TJIVRaa.exe
  C:\Windows\System\TJIVRaa.exe
  2⤵
  PID:10432
- C:\Windows\System\eazUuUE.exe
  C:\Windows\System\eazUuUE.exe
  2⤵
  PID:8244
- C:\Windows\System\sykMnLJ.exe
  C:\Windows\System\sykMnLJ.exe
  2⤵
  PID:11384
- C:\Windows\System\PKXKNUF.exe
  C:\Windows\System\PKXKNUF.exe
  2⤵
  PID:11444
- C:\Windows\System\fFJCBih.exe
  C:\Windows\System\fFJCBih.exe
  2⤵
  PID:11464
- C:\Windows\System\XerHmTt.exe
  C:\Windows\System\XerHmTt.exe
  2⤵
  PID:12280
- C:\Windows\System\MvadJrH.exe
  C:\Windows\System\MvadJrH.exe
  2⤵
  PID:9624
- C:\Windows\System\TXIxoyD.exe
  C:\Windows\System\TXIxoyD.exe
  2⤵
  PID:11856
- C:\Windows\System\QNYkyUP.exe
  C:\Windows\System\QNYkyUP.exe
  2⤵
  PID:10588
- C:\Windows\System\ppOyVPV.exe
  C:\Windows\System\ppOyVPV.exe
  2⤵
  PID:11068
- C:\Windows\System\LuKRNpR.exe
  C:\Windows\System\LuKRNpR.exe
  2⤵
  PID:12384
- C:\Windows\System\FloMpWs.exe
  C:\Windows\System\FloMpWs.exe
  2⤵
  PID:12736
- C:\Windows\System\gFlOztz.exe
  C:\Windows\System\gFlOztz.exe
  2⤵
  PID:12888
- C:\Windows\System\QavHhEQ.exe
  C:\Windows\System\QavHhEQ.exe
  2⤵
  PID:12912
- C:\Windows\System\gtBkqsI.exe
  C:\Windows\System\gtBkqsI.exe
  2⤵
  PID:12952
- C:\Windows\System\IeeKEyh.exe
  C:\Windows\System\IeeKEyh.exe
  2⤵
  PID:13096
- C:\Windows\System\SexLqoi.exe
  C:\Windows\System\SexLqoi.exe
  2⤵
  PID:13164
- C:\Windows\System\OZTdHUM.exe
  C:\Windows\System\OZTdHUM.exe
  2⤵
  PID:13224
- C:\Windows\System\naivzSC.exe
  C:\Windows\System\naivzSC.exe
  2⤵
  PID:13284
- C:\Windows\System\JtBrYSd.exe
  C:\Windows\System\JtBrYSd.exe
  2⤵
  PID:10408
- C:\Windows\System\ueVjchm.exe
  C:\Windows\System\ueVjchm.exe
  2⤵
  PID:1192
- C:\Windows\System\Dytejuq.exe
  C:\Windows\System\Dytejuq.exe
  2⤵
  PID:12284
- C:\Windows\System\kyEGssB.exe
  C:\Windows\System\kyEGssB.exe
  2⤵
  PID:6104
- C:\Windows\System\qhRllsb.exe
  C:\Windows\System\qhRllsb.exe
  2⤵
  PID:11140
- C:\Windows\System\xktuJtL.exe
  C:\Windows\System\xktuJtL.exe
  2⤵
  PID:11912
- C:\Windows\System\sdPSqrn.exe
  C:\Windows\System\sdPSqrn.exe
  2⤵
  PID:11212
- C:\Windows\System\kGFfywP.exe
  C:\Windows\System\kGFfywP.exe
  2⤵
  PID:11956
- C:\Windows\System\AOdIhkK.exe
  C:\Windows\System\AOdIhkK.exe
  2⤵
  PID:13100
- C:\Windows\System\XppFprk.exe
  C:\Windows\System\XppFprk.exe
  2⤵
  PID:4680
- C:\Windows\System\TkJkVrr.exe
  C:\Windows\System\TkJkVrr.exe
  2⤵
  PID:13148
- C:\Windows\System\dqnTprG.exe
  C:\Windows\System\dqnTprG.exe
  2⤵
  PID:11640
- C:\Windows\System\EPStGEs.exe
  C:\Windows\System\EPStGEs.exe
  2⤵
  PID:12836
- C:\Windows\System\fqcpUry.exe
  C:\Windows\System\fqcpUry.exe
  2⤵
  PID:12784
- C:\Windows\System\mSDsiZN.exe
  C:\Windows\System\mSDsiZN.exe
  2⤵
  PID:12772
- C:\Windows\System\DSMEcuJ.exe
  C:\Windows\System\DSMEcuJ.exe
  2⤵
  PID:3620
- C:\Windows\System\RuBkaEp.exe
  C:\Windows\System\RuBkaEp.exe
  2⤵
  PID:12796
- C:\Windows\System\EkLgCOM.exe
  C:\Windows\System\EkLgCOM.exe
  2⤵
  PID:2280
- C:\Windows\System\oBQCjER.exe
  C:\Windows\System\oBQCjER.exe
  2⤵
  PID:10652
- C:\Windows\System\TgEPTTY.exe
  C:\Windows\System\TgEPTTY.exe
  2⤵
  PID:12852
- C:\Windows\System\QThEjyH.exe
  C:\Windows\System\QThEjyH.exe
  2⤵
  PID:11692
- C:\Windows\System\YkLZcHd.exe
  C:\Windows\System\YkLZcHd.exe
  2⤵
  PID:12344
- C:\Windows\System\siYdLux.exe
  C:\Windows\System\siYdLux.exe
  2⤵
  PID:13056
- C:\Windows\System\lAvgBQE.exe
  C:\Windows\System\lAvgBQE.exe
  2⤵
  PID:12844
- C:\Windows\System\anLbPlU.exe
  C:\Windows\System\anLbPlU.exe
  2⤵
  PID:10648
- C:\Windows\System\JuuDipU.exe
  C:\Windows\System\JuuDipU.exe
  2⤵
  PID:12984
- C:\Windows\System\xLrhBvZ.exe
  C:\Windows\System\xLrhBvZ.exe
  2⤵
  PID:13228
- C:\Windows\System\ayETIAR.exe
  C:\Windows\System\ayETIAR.exe
  2⤵
  PID:13260
- C:\Windows\System\sHpcYGA.exe
  C:\Windows\System\sHpcYGA.exe
  2⤵
  PID:12948
- C:\Windows\System\aVRiiZp.exe
  C:\Windows\System\aVRiiZp.exe
  2⤵
  PID:13252
- C:\Windows\System\ePPUiZS.exe
  C:\Windows\System\ePPUiZS.exe
  2⤵
  PID:12996
- C:\Windows\System\vaGUYcS.exe
  C:\Windows\System\vaGUYcS.exe
  2⤵
  PID:13136
- C:\Windows\System\amZIhyl.exe
  C:\Windows\System\amZIhyl.exe
  2⤵
  PID:12744
- C:\Windows\System\SPCCfBX.exe
  C:\Windows\System\SPCCfBX.exe
  2⤵
  PID:10948
- C:\Windows\System\qKuTngc.exe
  C:\Windows\System\qKuTngc.exe
  2⤵
  PID:10092
- C:\Windows\System\XJGjSRJ.exe
  C:\Windows\System\XJGjSRJ.exe
  2⤵
  PID:11532
- C:\Windows\System\ASuknif.exe
  C:\Windows\System\ASuknif.exe
  2⤵
  PID:13200
- C:\Windows\System\zZMiJdB.exe
  C:\Windows\System\zZMiJdB.exe
  2⤵
  PID:12760
- C:\Windows\System\xisYfKZ.exe
  C:\Windows\System\xisYfKZ.exe
  2⤵
  PID:12964
- C:\Windows\System\aCSSlpV.exe
  C:\Windows\System\aCSSlpV.exe
  2⤵
  PID:12676
- C:\Windows\System\uIsWjUJ.exe
  C:\Windows\System\uIsWjUJ.exe
  2⤵
  PID:11496
- C:\Windows\System\OdmivMt.exe
  C:\Windows\System\OdmivMt.exe
  2⤵
  PID:12100
- C:\Windows\System\azMqndQ.exe
  C:\Windows\System\azMqndQ.exe
  2⤵
  PID:13080
- C:\Windows\System\jtvqrPC.exe
  C:\Windows\System\jtvqrPC.exe
  2⤵
  PID:12468
- C:\Windows\System\SqquLRY.exe
  C:\Windows\System\SqquLRY.exe
  2⤵
  PID:2512
- C:\Windows\System\vFVcuXE.exe
  C:\Windows\System\vFVcuXE.exe
  2⤵
  PID:9388
- C:\Windows\System\DOWyJxk.exe
  C:\Windows\System\DOWyJxk.exe
  2⤵
  PID:11688
- C:\Windows\System\YGHWCwb.exe
  C:\Windows\System\YGHWCwb.exe
  2⤵
  PID:7804
- C:\Windows\System\SLhLMBK.exe
  C:\Windows\System\SLhLMBK.exe
  2⤵
  PID:3492
- C:\Windows\System\QQFFmWJ.exe
  C:\Windows\System\QQFFmWJ.exe
  2⤵
  PID:13244
- C:\Windows\System\qfjLQFW.exe
  C:\Windows\System\qfjLQFW.exe
  2⤵
  PID:10944
- C:\Windows\System\bnOIrLs.exe
  C:\Windows\System\bnOIrLs.exe
  2⤵
  PID:12704
- C:\Windows\System\tFivPkK.exe
  C:\Windows\System\tFivPkK.exe
  2⤵
  PID:10764
- C:\Windows\System\jJoauyD.exe
  C:\Windows\System\jJoauyD.exe
  2⤵
  PID:3332
- C:\Windows\System\YOcDRVk.exe
  C:\Windows\System\YOcDRVk.exe
  2⤵
  PID:12652
- C:\Windows\System\DuatQwP.exe
  C:\Windows\System\DuatQwP.exe
  2⤵
  PID:10804
- C:\Windows\System\dlGBGND.exe
  C:\Windows\System\dlGBGND.exe
  2⤵
  PID:12696
- C:\Windows\System\ixZxTXJ.exe
  C:\Windows\System\ixZxTXJ.exe
  2⤵
  PID:11252
- C:\Windows\System\cAtumBo.exe
  C:\Windows\System\cAtumBo.exe
  2⤵
  PID:8856
- C:\Windows\System\MNIKSvD.exe
  C:\Windows\System\MNIKSvD.exe
  2⤵
  PID:3248
- C:\Windows\System\CuBgLSJ.exe
  C:\Windows\System\CuBgLSJ.exe
  2⤵
  PID:13040
- C:\Windows\System\IlQKmLf.exe
  C:\Windows\System\IlQKmLf.exe
  2⤵
  PID:7592
- C:\Windows\System\AUOTpUz.exe
  C:\Windows\System\AUOTpUz.exe
  2⤵
  PID:2720
- C:\Windows\System\etIwSQy.exe
  C:\Windows\System\etIwSQy.exe
  2⤵
  PID:5128
- C:\Windows\System\IqcKVha.exe
  C:\Windows\System\IqcKVha.exe
  2⤵
  PID:4852
- C:\Windows\System\NCjbala.exe
  C:\Windows\System\NCjbala.exe
  2⤵
  PID:1840
- C:\Windows\System\wdEEgFI.exe
  C:\Windows\System\wdEEgFI.exe
  2⤵
  PID:2740
- C:\Windows\System\PyRhaCH.exe
  C:\Windows\System\PyRhaCH.exe
  2⤵
  PID:12820
- C:\Windows\System\kRhWDNR.exe
  C:\Windows\System\kRhWDNR.exe
  2⤵
  PID:3496
- C:\Windows\System\oyxbGII.exe
  C:\Windows\System\oyxbGII.exe
  2⤵
  PID:812
- C:\Windows\System\TFEzbdY.exe
  C:\Windows\System\TFEzbdY.exe
  2⤵
  PID:2040
- C:\Windows\System\fDehpNg.exe
  C:\Windows\System\fDehpNg.exe
  2⤵
  PID:720
- C:\Windows\System\WuuQxlT.exe
  C:\Windows\System\WuuQxlT.exe
  2⤵
  PID:9268
- C:\Windows\System\RUDEzJy.exe
  C:\Windows\System\RUDEzJy.exe
  2⤵
  PID:1972
- C:\Windows\System\oRkYHit.exe
  C:\Windows\System\oRkYHit.exe
  2⤵
  PID:5052
- C:\Windows\System\kBQcHBA.exe
  C:\Windows\System\kBQcHBA.exe
  2⤵
  PID:1796
- C:\Windows\System\aDZXOWl.exe
  C:\Windows\System\aDZXOWl.exe
  2⤵
  PID:4996
- C:\Windows\System\BKEuBfB.exe
  C:\Windows\System\BKEuBfB.exe
  2⤵
  PID:3904
- C:\Windows\System\TqYMgRy.exe
  C:\Windows\System\TqYMgRy.exe
  2⤵
  PID:1012
- C:\Windows\System\MsDiUrX.exe
  C:\Windows\System\MsDiUrX.exe
  2⤵
  PID:2964
- C:\Windows\System\bequZoN.exe
  C:\Windows\System\bequZoN.exe
  2⤵
  PID:4284
- C:\Windows\System\gUUSPuC.exe
  C:\Windows\System\gUUSPuC.exe
  2⤵
  PID:3364
- C:\Windows\System\LclrEaw.exe
  C:\Windows\System\LclrEaw.exe
  2⤵
  PID:10224
- C:\Windows\System\QvZoXze.exe
  C:\Windows\System\QvZoXze.exe
  2⤵
  PID:9308
- C:\Windows\System\NNZjWIf.exe
  C:\Windows\System\NNZjWIf.exe
  2⤵
  PID:9928
- C:\Windows\System\IrSrMgg.exe
  C:\Windows\System\IrSrMgg.exe
  2⤵
  PID:4580
- C:\Windows\System\yuVUqIf.exe
  C:\Windows\System\yuVUqIf.exe
  2⤵
  PID:5200
- C:\Windows\System\oHIqrxI.exe
  C:\Windows\System\oHIqrxI.exe
  2⤵
  PID:5248
- C:\Windows\System\NDFmuSq.exe
  C:\Windows\System\NDFmuSq.exe
  2⤵
  PID:1384
- C:\Windows\System\qERAwbM.exe
  C:\Windows\System\qERAwbM.exe
  2⤵
  PID:1564
- C:\Windows\System\nYyhwsm.exe
  C:\Windows\System\nYyhwsm.exe
  2⤵
  PID:4896
- C:\Windows\System\aspgsyS.exe
  C:\Windows\System\aspgsyS.exe
  2⤵
  PID:3352
- C:\Windows\System\FbdOVqd.exe
  C:\Windows\System\FbdOVqd.exe
  2⤵
  PID:4464
- C:\Windows\System\qLtugRt.exe
  C:\Windows\System\qLtugRt.exe
  2⤵
  PID:13140
- C:\Windows\System\TedYHQF.exe
  C:\Windows\System\TedYHQF.exe
  2⤵
  PID:1744
- C:\Windows\System\EooJSPq.exe
  C:\Windows\System\EooJSPq.exe
  2⤵
  PID:10128
- C:\Windows\System\qPXfJPQ.exe
  C:\Windows\System\qPXfJPQ.exe
  2⤵
  PID:9272
- C:\Windows\System\oSYKMxs.exe
  C:\Windows\System\oSYKMxs.exe
  2⤵
  PID:12540
- C:\Windows\System\WvaWNRS.exe
  C:\Windows\System\WvaWNRS.exe
  2⤵
  PID:4188
- C:\Windows\System\gndsoKd.exe
  C:\Windows\System\gndsoKd.exe
  2⤵
  PID:2536
- C:\Windows\System\OmygBUz.exe
  C:\Windows\System\OmygBUz.exe
  2⤵
  PID:10168
- C:\Windows\System\GkVwhui.exe
  C:\Windows\System\GkVwhui.exe
  2⤵
  PID:1892
- C:\Windows\System\waaBbRN.exe
  C:\Windows\System\waaBbRN.exe
  2⤵
  PID:1528
- C:\Windows\System\coqtYge.exe
  C:\Windows\System\coqtYge.exe
  2⤵
  PID:5168
- C:\Windows\System\LfpnErn.exe
  C:\Windows\System\LfpnErn.exe
  2⤵
  PID:1400
- C:\Windows\System\gMEqatT.exe
  C:\Windows\System\gMEqatT.exe
  2⤵
  PID:10192
- C:\Windows\System\mcOmzUH.exe
  C:\Windows\System\mcOmzUH.exe
  2⤵
  PID:2028
- C:\Windows\System\zgixHia.exe
  C:\Windows\System\zgixHia.exe
  2⤵
  PID:3124
- C:\Windows\System\SkalocC.exe
  C:\Windows\System\SkalocC.exe
  2⤵
  PID:6132
- C:\Windows\System\bvhUDAz.exe
  C:\Windows\System\bvhUDAz.exe
  2⤵
  PID:3192
- C:\Windows\System\QFyQRVA.exe
  C:\Windows\System\QFyQRVA.exe
  2⤵
  PID:5440
- C:\Windows\System\qUSrORE.exe
  C:\Windows\System\qUSrORE.exe
  2⤵
  PID:6004
- C:\Windows\System\LmUjlfq.exe
  C:\Windows\System\LmUjlfq.exe
  2⤵
  PID:5728
- C:\Windows\System\QwteIYo.exe
  C:\Windows\System\QwteIYo.exe
  2⤵
  PID:5592
- C:\Windows\System\orvCysl.exe
  C:\Windows\System\orvCysl.exe
  2⤵
  PID:5864
- C:\Windows\System\wfzXRml.exe
  C:\Windows\System\wfzXRml.exe
  2⤵
  PID:3284
- C:\Windows\System\afyJUPb.exe
  C:\Windows\System\afyJUPb.exe
  2⤵
  PID:6088
- C:\Windows\System\psZPQJU.exe
  C:\Windows\System\psZPQJU.exe
  2⤵
  PID:6120
- C:\Windows\System\SvNcjoA.exe
  C:\Windows\System\SvNcjoA.exe
  2⤵
  PID:1188
- C:\Windows\System\mBFyFNf.exe
  C:\Windows\System\mBFyFNf.exe
  2⤵
  PID:1940
- C:\Windows\System\thoMxFq.exe
  C:\Windows\System\thoMxFq.exe
  2⤵
  PID:9768
- C:\Windows\System\aeDQQVt.exe
  C:\Windows\System\aeDQQVt.exe
  2⤵
  PID:5868
- C:\Windows\System\CMhQTrE.exe
  C:\Windows\System\CMhQTrE.exe
  2⤵
  PID:6008
- C:\Windows\System\hIdfVTM.exe
  C:\Windows\System\hIdfVTM.exe
  2⤵
  PID:1624
- C:\Windows\System\MKxPEHs.exe
  C:\Windows\System\MKxPEHs.exe
  2⤵
  PID:13332
- C:\Windows\System\uyMkFvd.exe
  C:\Windows\System\uyMkFvd.exe
  2⤵
  PID:13360
- C:\Windows\System\sQlwILY.exe
  C:\Windows\System\sQlwILY.exe
  2⤵
  PID:13396
- C:\Windows\System\dWzPdLW.exe
  C:\Windows\System\dWzPdLW.exe
  2⤵
  PID:13436
- C:\Windows\System\jZkwSUz.exe
  C:\Windows\System\jZkwSUz.exe
  2⤵
  PID:13464
- C:\Windows\System\zvKHXtH.exe
  C:\Windows\System\zvKHXtH.exe
  2⤵
  PID:13520
- C:\Windows\System\WazduEt.exe
  C:\Windows\System\WazduEt.exe
  2⤵
  PID:13552
- C:\Windows\System\RydYHxd.exe
  C:\Windows\System\RydYHxd.exe
  2⤵
  PID:13588
- C:\Windows\System\rRyDUtK.exe
  C:\Windows\System\rRyDUtK.exe
  2⤵
  PID:13852
- C:\Windows\System\ljmeYFT.exe
  C:\Windows\System\ljmeYFT.exe
  2⤵
  PID:13868
- C:\Windows\System\fnraLem.exe
  C:\Windows\System\fnraLem.exe
  2⤵
  PID:13884
- C:\Windows\System\shlzlHO.exe
  C:\Windows\System\shlzlHO.exe
  2⤵
  PID:13900
- C:\Windows\System\uEGMscY.exe
  C:\Windows\System\uEGMscY.exe
  2⤵
  PID:13916
- C:\Windows\System\SSNkYUG.exe
  C:\Windows\System\SSNkYUG.exe
  2⤵
  PID:13932
- C:\Windows\System\mwaQrQA.exe
  C:\Windows\System\mwaQrQA.exe
  2⤵
  PID:13948
- C:\Windows\System\DSRXeGf.exe
  C:\Windows\System\DSRXeGf.exe
  2⤵
  PID:13964
- C:\Windows\System\lfBFMZg.exe
  C:\Windows\System\lfBFMZg.exe
  2⤵
  PID:13980
- C:\Windows\System\FFLJQGo.exe
  C:\Windows\System\FFLJQGo.exe
  2⤵
  PID:13996
- C:\Windows\System\HjDLeRf.exe
  C:\Windows\System\HjDLeRf.exe
  2⤵
  PID:14012
- C:\Windows\System\rImQfIg.exe
  C:\Windows\System\rImQfIg.exe
  2⤵
  PID:14028
- C:\Windows\System\Kqwkxzc.exe
  C:\Windows\System\Kqwkxzc.exe
  2⤵
  PID:14044
- C:\Windows\System\KJwZLAP.exe
  C:\Windows\System\KJwZLAP.exe
  2⤵
  PID:14060
- C:\Windows\System\JCVMiHF.exe
  C:\Windows\System\JCVMiHF.exe
  2⤵
  PID:14076
- C:\Windows\System\KSmYrJc.exe
  C:\Windows\System\KSmYrJc.exe
  2⤵
  PID:14096
- C:\Windows\System\nRyXgyK.exe
  C:\Windows\System\nRyXgyK.exe
  2⤵
  PID:14120
- C:\Windows\System\MgMGBtt.exe
  C:\Windows\System\MgMGBtt.exe
  2⤵
  PID:14140
- C:\Windows\System\cbyOGEt.exe
  C:\Windows\System\cbyOGEt.exe
  2⤵
  PID:14192
- C:\Windows\System\SxvmGDl.exe
  C:\Windows\System\SxvmGDl.exe
  2⤵
  PID:14208
- C:\Windows\System\glTmaiJ.exe
  C:\Windows\System\glTmaiJ.exe
  2⤵
  PID:14228
- C:\Windows\System\JXenTLq.exe
  C:\Windows\System\JXenTLq.exe
  2⤵
  PID:14244
- C:\Windows\System\VDkIrRs.exe
  C:\Windows\System\VDkIrRs.exe
  2⤵
  PID:10272
- C:\Windows\System\zFsdjCB.exe
  C:\Windows\System\zFsdjCB.exe
  2⤵
  PID:12032
- C:\Windows\System\IHSfORS.exe
  C:\Windows\System\IHSfORS.exe
  2⤵
  PID:6060
- C:\Windows\System\FCKHcki.exe
  C:\Windows\System\FCKHcki.exe
  2⤵
  PID:13416
- C:\Windows\System\QqxFDAa.exe
  C:\Windows\System\QqxFDAa.exe
  2⤵
  PID:5148
- C:\Windows\System\NuIPhWn.exe
  C:\Windows\System\NuIPhWn.exe
  2⤵
  PID:13444
- C:\Windows\System\VddiGHC.exe
  C:\Windows\System\VddiGHC.exe
  2⤵
  PID:5180
- C:\Windows\System\LXxXUbu.exe
  C:\Windows\System\LXxXUbu.exe
  2⤵
  PID:13540
- C:\Windows\System\PYuQoVx.exe
  C:\Windows\System\PYuQoVx.exe
  2⤵
  PID:13580
- C:\Windows\System\myFIBOE.exe
  C:\Windows\System\myFIBOE.exe
  2⤵
  PID:6388
- C:\Windows\System\hugULQC.exe
  C:\Windows\System\hugULQC.exe
  2⤵
  PID:13792
- C:\Windows\System\JXUkuKg.exe
  C:\Windows\System\JXUkuKg.exe
  2⤵
  PID:14072
- C:\Windows\System\VojoNjV.exe
  C:\Windows\System\VojoNjV.exe
  2⤵
  PID:6708
- C:\Windows\System\QcnDwpE.exe
  C:\Windows\System\QcnDwpE.exe
  2⤵
  PID:13756
- C:\Windows\System\yIQQEGp.exe
  C:\Windows\System\yIQQEGp.exe
  2⤵
  PID:4120
- C:\Windows\System\HxWrIEM.exe
  C:\Windows\System\HxWrIEM.exe
  2⤵
  PID:5664
- C:\Windows\System\OBrWudO.exe
  C:\Windows\System\OBrWudO.exe
  2⤵
  PID:5756
- C:\Windows\System\XadbIYw.exe
  C:\Windows\System\XadbIYw.exe
  2⤵
  PID:13944
- C:\Windows\System\jlMDdiY.exe
  C:\Windows\System\jlMDdiY.exe
  2⤵
  PID:13976
- C:\Windows\System\fTAKrsI.exe
  C:\Windows\System\fTAKrsI.exe
  2⤵
  PID:6528
- C:\Windows\System\PtlNXOe.exe
  C:\Windows\System\PtlNXOe.exe
  2⤵
  PID:436
- C:\Windows\System\FZKTqvT.exe
  C:\Windows\System\FZKTqvT.exe
  2⤵
  PID:5568
- C:\Windows\System\bXvNykE.exe
  C:\Windows\System\bXvNykE.exe
  2⤵
  PID:6648
- C:\Windows\System\qHCMuVv.exe
  C:\Windows\System\qHCMuVv.exe
  2⤵
  PID:6324
- C:\Windows\System\rVUJhuk.exe
  C:\Windows\System\rVUJhuk.exe
  2⤵
  PID:14056
- C:\Windows\System\ekngNgn.exe
  C:\Windows\System\ekngNgn.exe
  2⤵
  PID:6632
- C:\Windows\System\syjPbKU.exe
  C:\Windows\System\syjPbKU.exe
  2⤵
  PID:3532
- C:\Windows\System\vrxmTNd.exe
  C:\Windows\System\vrxmTNd.exe
  2⤵
  PID:4368
- C:\Windows\System\VFbSZzF.exe
  C:\Windows\System\VFbSZzF.exe
  2⤵
  PID:14092
- C:\Windows\System\KZfnvHH.exe
  C:\Windows\System\KZfnvHH.exe
  2⤵
  PID:14296
- C:\Windows\System\aCdZhxu.exe
  C:\Windows\System\aCdZhxu.exe
  2⤵
  PID:7092
- C:\Windows\System\ofbpeUP.exe
  C:\Windows\System\ofbpeUP.exe
  2⤵
  PID:6872
- C:\Windows\System\mVSvxbq.exe
  C:\Windows\System\mVSvxbq.exe
  2⤵
  PID:14112
- C:\Windows\System\bKuMLKq.exe
  C:\Windows\System\bKuMLKq.exe
  2⤵
  PID:14176
- C:\Windows\System\hgEIsBl.exe
  C:\Windows\System\hgEIsBl.exe
  2⤵
  PID:14292
- C:\Windows\System\twfATTk.exe
  C:\Windows\System\twfATTk.exe
  2⤵
  PID:6736
- C:\Windows\System\DaxedSK.exe
  C:\Windows\System\DaxedSK.exe
  2⤵
  PID:7440
- C:\Windows\System\aHssdLg.exe
  C:\Windows\System\aHssdLg.exe
  2⤵
  PID:14288
- C:\Windows\System\nPrbqaM.exe
  C:\Windows\System\nPrbqaM.exe
  2⤵
  PID:5520
- C:\Windows\System\fVFIRZr.exe
  C:\Windows\System\fVFIRZr.exe
  2⤵
  PID:6044
- C:\Windows\System\vYrKTxV.exe
  C:\Windows\System\vYrKTxV.exe
  2⤵
  PID:14020
- C:\Windows\System\doMlYgp.exe
  C:\Windows\System\doMlYgp.exe
  2⤵
  PID:13548
- C:\Windows\System\yydhfaX.exe
  C:\Windows\System\yydhfaX.exe
  2⤵
  PID:2108
- C:\Windows\System\FUwaUDx.exe
  C:\Windows\System\FUwaUDx.exe
  2⤵
  PID:6544
- C:\Windows\System\NGxpAGC.exe
  C:\Windows\System\NGxpAGC.exe
  2⤵
  PID:7208
- C:\Windows\System\CqxJffH.exe
  C:\Windows\System\CqxJffH.exe
  2⤵
  PID:13776
- C:\Windows\System\gPUPwzD.exe
  C:\Windows\System\gPUPwzD.exe
  2⤵
  PID:13476
- C:\Windows\System\kKCyRGU.exe
  C:\Windows\System\kKCyRGU.exe
  2⤵
  PID:13500
- C:\Windows\System\QLhpZrL.exe
  C:\Windows\System\QLhpZrL.exe
  2⤵
  PID:6652
- C:\Windows\System\AIRZRmX.exe
  C:\Windows\System\AIRZRmX.exe
  2⤵
  PID:7644
- C:\Windows\System\xbCPwye.exe
  C:\Windows\System\xbCPwye.exe
  2⤵
  PID:13724
- C:\Windows\System\lEeRgrT.exe
  C:\Windows\System\lEeRgrT.exe
  2⤵
  PID:7724
- C:\Windows\System\NCSVTeq.exe
  C:\Windows\System\NCSVTeq.exe
  2⤵
  PID:7532
- C:\Windows\System\XlOSIvw.exe
  C:\Windows\System\XlOSIvw.exe
  2⤵
  PID:6320
- C:\Windows\System\vEZKNBV.exe
  C:\Windows\System\vEZKNBV.exe
  2⤵
  PID:7668
- C:\Windows\System\eQvKzOF.exe
  C:\Windows\System\eQvKzOF.exe
  2⤵
  PID:7164
- C:\Windows\System\QkHRKNZ.exe
  C:\Windows\System\QkHRKNZ.exe
  2⤵
  PID:13908
- C:\Windows\System\TiiHkTT.exe
  C:\Windows\System\TiiHkTT.exe
  2⤵
  PID:13960
- C:\Windows\System\NAsSdPo.exe
  C:\Windows\System\NAsSdPo.exe
  2⤵
  PID:7004
- C:\Windows\System\RBepfwO.exe
  C:\Windows\System\RBepfwO.exe
  2⤵
  PID:5032
- C:\Windows\System\bZCDrkI.exe
  C:\Windows\System\bZCDrkI.exe
  2⤵
  PID:5372
- C:\Windows\System\juQnLMt.exe
  C:\Windows\System\juQnLMt.exe
  2⤵
  PID:6356
- C:\Windows\System\FQYYHmh.exe
  C:\Windows\System\FQYYHmh.exe
  2⤵
  PID:6672
- C:\Windows\System\JDOlFmd.exe
  C:\Windows\System\JDOlFmd.exe
  2⤵
  PID:8012
- C:\Windows\System\XFTogdR.exe
  C:\Windows\System\XFTogdR.exe
  2⤵
  PID:5112
- C:\Windows\System\lXeqDih.exe
  C:\Windows\System\lXeqDih.exe
  2⤵
  PID:6944
- C:\Windows\System\AqrFNaL.exe
  C:\Windows\System\AqrFNaL.exe
  2⤵
  PID:6248
- C:\Windows\System\gkRpOcy.exe
  C:\Windows\System\gkRpOcy.exe
  2⤵
  PID:2924
- C:\Windows\System\CYhEgvE.exe
  C:\Windows\System\CYhEgvE.exe
  2⤵
  PID:6296
- C:\Windows\System\ljBJpeb.exe
  C:\Windows\System\ljBJpeb.exe
  2⤵
  PID:7420
- C:\Windows\System\dwOIAAx.exe
  C:\Windows\System\dwOIAAx.exe
  2⤵
  PID:7192
- C:\Windows\System\ouSjgJA.exe
  C:\Windows\System\ouSjgJA.exe
  2⤵
  PID:4320
- C:\Windows\System\lBaQlLH.exe
  C:\Windows\System\lBaQlLH.exe
  2⤵
  PID:7788
- C:\Windows\System\JvvnyAk.exe
  C:\Windows\System\JvvnyAk.exe
  2⤵
  PID:7808
- C:\Windows\System\BPoPvag.exe
  C:\Windows\System\BPoPvag.exe
  2⤵
  PID:13576
- C:\Windows\System\fpZtWjJ.exe
  C:\Windows\System\fpZtWjJ.exe
  2⤵
  PID:8056
- C:\Windows\System\oUvlwpX.exe
  C:\Windows\System\oUvlwpX.exe
  2⤵
  PID:13716
- C:\Windows\System\ffmtJYp.exe
  C:\Windows\System\ffmtJYp.exe
  2⤵
  PID:7452
- C:\Windows\System\whagXBE.exe
  C:\Windows\System\whagXBE.exe
  2⤵
  PID:8632
- C:\Windows\System\gwzvlWC.exe
  C:\Windows\System\gwzvlWC.exe
  2⤵
  PID:7992
- C:\Windows\System\rGonEnQ.exe
  C:\Windows\System\rGonEnQ.exe
  2⤵
  PID:6504
- C:\Windows\System\hNqEqGi.exe
  C:\Windows\System\hNqEqGi.exe
  2⤵
  PID:5160
- C:\Windows\System\VTIOpBK.exe
  C:\Windows\System\VTIOpBK.exe
  2⤵
  PID:7880
- C:\Windows\System\bBokcCo.exe
  C:\Windows\System\bBokcCo.exe
  2⤵
  PID:8660
- C:\Windows\System\ZanYMOB.exe
  C:\Windows\System\ZanYMOB.exe
  2⤵
  PID:8468
- C:\Windows\System\JsWQFjt.exe
  C:\Windows\System\JsWQFjt.exe
  2⤵
  PID:6676
- C:\Windows\System\CauCIco.exe
  C:\Windows\System\CauCIco.exe
  2⤵
  PID:7392
- C:\Windows\System\nvvUNIw.exe
  C:\Windows\System\nvvUNIw.exe
  2⤵
  PID:8472
- C:\Windows\System\dbOwFJh.exe
  C:\Windows\System\dbOwFJh.exe
  2⤵
  PID:7784
- C:\Windows\System\CDHMadz.exe
  C:\Windows\System\CDHMadz.exe
  2⤵
  PID:8464
- C:\Windows\System\ClFxlYY.exe
  C:\Windows\System\ClFxlYY.exe
  2⤵
  PID:7932
- C:\Windows\System\uRmmlTV.exe
  C:\Windows\System\uRmmlTV.exe
  2⤵
  PID:2620
- C:\Windows\System\CMliQYz.exe
  C:\Windows\System\CMliQYz.exe
  2⤵
  PID:9208
- C:\Windows\System\ucyAquj.exe
  C:\Windows\System\ucyAquj.exe
  2⤵
  PID:8760
- C:\Windows\System\KgCRmhW.exe
  C:\Windows\System\KgCRmhW.exe
  2⤵
  PID:8992
- C:\Windows\System\oCzgAXL.exe
  C:\Windows\System\oCzgAXL.exe
  2⤵
  PID:7924
- C:\Windows\System\DtcTAai.exe
  C:\Windows\System\DtcTAai.exe
  2⤵
  PID:5872
- C:\Windows\System\bdxHYTl.exe
  C:\Windows\System\bdxHYTl.exe
  2⤵
  PID:6308
- C:\Windows\System\PpfySwJ.exe
  C:\Windows\System\PpfySwJ.exe
  2⤵
  PID:14204
- C:\Windows\System\UZOICUB.exe
  C:\Windows\System\UZOICUB.exe
  2⤵
  PID:8700
- C:\Windows\System\JyYzmaU.exe
  C:\Windows\System\JyYzmaU.exe
  2⤵
  PID:7548
- C:\Windows\System\iUGQLQK.exe
  C:\Windows\System\iUGQLQK.exe
  2⤵
  PID:4452
- C:\Windows\System\dPuYywa.exe
  C:\Windows\System\dPuYywa.exe
  2⤵
  PID:8524
- C:\Windows\System\KZssrhZ.exe
  C:\Windows\System\KZssrhZ.exe
  2⤵
  PID:1740
- C:\Windows\System\lAInpUZ.exe
  C:\Windows\System\lAInpUZ.exe
  2⤵
  PID:5228
- C:\Windows\System\kLedCHS.exe
  C:\Windows\System\kLedCHS.exe
  2⤵
  PID:13564
- C:\Windows\System\tZpjohy.exe
  C:\Windows\System\tZpjohy.exe
  2⤵
  PID:13840
- C:\Windows\System\iobriLR.exe
  C:\Windows\System\iobriLR.exe
  2⤵
  PID:8120
- C:\Windows\System\WmzqASC.exe
  C:\Windows\System\WmzqASC.exe
  2⤵
  PID:8140
- C:\Windows\System\ATOcokU.exe
  C:\Windows\System\ATOcokU.exe
  2⤵
  PID:8156
- C:\Windows\System\Bgdobaq.exe
  C:\Windows\System\Bgdobaq.exe
  2⤵
  PID:7888
- C:\Windows\System\EzvbjQb.exe
  C:\Windows\System\EzvbjQb.exe
  2⤵
  PID:13796
- C:\Windows\System\GZZmyIo.exe
  C:\Windows\System\GZZmyIo.exe
  2⤵
  PID:9628
- C:\Windows\System\DxBBFOQ.exe
  C:\Windows\System\DxBBFOQ.exe
  2⤵
  PID:7860
- C:\Windows\System\cyQuDoX.exe
  C:\Windows\System\cyQuDoX.exe
  2⤵
  PID:9908
- C:\Windows\System\lPrmfVk.exe
  C:\Windows\System\lPrmfVk.exe
  2⤵
  PID:10008
- C:\Windows\System\RfXqRKh.exe
  C:\Windows\System\RfXqRKh.exe
  2⤵
  PID:10088
- C:\Windows\System\eQvpcDc.exe
  C:\Windows\System\eQvpcDc.exe
  2⤵
  PID:10100
- C:\Windows\System\HkGZdzs.exe
  C:\Windows\System\HkGZdzs.exe
  2⤵
  PID:9836
- C:\Windows\System\PxtCLkd.exe
  C:\Windows\System\PxtCLkd.exe
  2⤵
  PID:9312
- C:\Windows\System\PahHUZQ.exe
  C:\Windows\System\PahHUZQ.exe
  2⤵
  PID:7316
- C:\Windows\System\astcYIj.exe
  C:\Windows\System\astcYIj.exe
  2⤵
  PID:7436
- C:\Windows\System\zzvLXRS.exe
  C:\Windows\System\zzvLXRS.exe
  2⤵
  PID:14300
- C:\Windows\System\KVONkAp.exe
  C:\Windows\System\KVONkAp.exe
  2⤵
  PID:10132
- C:\Windows\System\hmpXMop.exe
  C:\Windows\System\hmpXMop.exe
  2⤵
  PID:7344
- C:\Windows\System\NrBhilQ.exe
  C:\Windows\System\NrBhilQ.exe
  2⤵
  PID:7748
- C:\Windows\System\fSYhbeC.exe
  C:\Windows\System\fSYhbeC.exe
  2⤵
  PID:7812
- C:\Windows\System\cJpWoZF.exe
  C:\Windows\System\cJpWoZF.exe
  2⤵
  PID:6208
- C:\Windows\System\hITgbiB.exe
  C:\Windows\System\hITgbiB.exe
  2⤵
  PID:832
- C:\Windows\System\KPXlziq.exe
  C:\Windows\System\KPXlziq.exe
  2⤵
  PID:8448
- C:\Windows\System\TVZfqoT.exe
  C:\Windows\System\TVZfqoT.exe
  2⤵
  PID:10392
- C:\Windows\System\HJVEuSx.exe
  C:\Windows\System\HJVEuSx.exe
  2⤵
  PID:13880
- C:\Windows\System\vTPPJOi.exe
  C:\Windows\System\vTPPJOi.exe
  2⤵
  PID:10448
- C:\Windows\System\mXQNswi.exe
  C:\Windows\System\mXQNswi.exe
  2⤵
  PID:7620
- C:\Windows\System\UJfVGnO.exe
  C:\Windows\System\UJfVGnO.exe
  2⤵
  PID:9888
- C:\Windows\System\UCiupzI.exe
  C:\Windows\System\UCiupzI.exe
  2⤵
  PID:7936
- C:\Windows\System\WWQsxXU.exe
  C:\Windows\System\WWQsxXU.exe
  2⤵
  PID:10112
- C:\Windows\System\SthILnG.exe
  C:\Windows\System\SthILnG.exe
  2⤵
  PID:14152
- C:\Windows\System\wSwgBBd.exe
  C:\Windows\System\wSwgBBd.exe
  2⤵
  PID:10304
- C:\Windows\System\yEDmnJy.exe
  C:\Windows\System\yEDmnJy.exe
  2⤵
  PID:7380
- C:\Windows\System\WhuSqjm.exe
  C:\Windows\System\WhuSqjm.exe
  2⤵
  PID:11304
- C:\Windows\System\jGKQIYl.exe
  C:\Windows\System\jGKQIYl.exe
  2⤵
  PID:5452
- C:\Windows\System\TJPzPbJ.exe
  C:\Windows\System\TJPzPbJ.exe
  2⤵
  PID:1772
- C:\Windows\System\kszRXwx.exe
  C:\Windows\System\kszRXwx.exe
  2⤵
  PID:11240
- C:\Windows\System\jSHUjGN.exe
  C:\Windows\System\jSHUjGN.exe
  2⤵
  PID:7488
- C:\Windows\System\mPHQfcm.exe
  C:\Windows\System\mPHQfcm.exe
  2⤵
  PID:13380
- C:\Windows\System\WcwFueK.exe
  C:\Windows\System\WcwFueK.exe
  2⤵
  PID:9712
- C:\Windows\System\fMCzkJr.exe
  C:\Windows\System\fMCzkJr.exe
  2⤵
  PID:7472
- C:\Windows\System\YupaWiB.exe
  C:\Windows\System\YupaWiB.exe
  2⤵
  PID:9832
- C:\Windows\System\kAgZNkW.exe
  C:\Windows\System\kAgZNkW.exe
  2⤵
  PID:1568
- C:\Windows\System\iuYhyrp.exe
  C:\Windows\System\iuYhyrp.exe
  2⤵
  PID:11040
- C:\Windows\System\qoqMfEj.exe
  C:\Windows\System\qoqMfEj.exe
  2⤵
  PID:10444
- C:\Windows\System\whRYwCW.exe
  C:\Windows\System\whRYwCW.exe
  2⤵
  PID:11104
- C:\Windows\System\ckFXeHA.exe
  C:\Windows\System\ckFXeHA.exe
  2⤵
  PID:8860
- C:\Windows\System\VUZgsTq.exe
  C:\Windows\System\VUZgsTq.exe
  2⤵
  PID:2868
- C:\Windows\System\ZjkGxmE.exe
  C:\Windows\System\ZjkGxmE.exe
  2⤵
  PID:11504
- C:\Windows\System\tRWFeaC.exe
  C:\Windows\System\tRWFeaC.exe
  2⤵
  PID:7628
- C:\Windows\System\CDimAme.exe
  C:\Windows\System\CDimAme.exe
  2⤵
  PID:11644
- C:\Windows\System\kQmXrkQ.exe
  C:\Windows\System\kQmXrkQ.exe
  2⤵
  PID:8900
- C:\Windows\System\WrWqbqL.exe
  C:\Windows\System\WrWqbqL.exe
  2⤵
  PID:11588
- C:\Windows\System\zBTEGJq.exe
  C:\Windows\System\zBTEGJq.exe
  2⤵
  PID:11700
- C:\Windows\System\BtkSSxV.exe
  C:\Windows\System\BtkSSxV.exe
  2⤵
  PID:9792
- C:\Windows\System\YSsAimh.exe
  C:\Windows\System\YSsAimh.exe
  2⤵
  PID:8908
- C:\Windows\System\rLeRvaq.exe
  C:\Windows\System\rLeRvaq.exe
  2⤵
  PID:7000
- C:\Windows\System\RcuHzML.exe
  C:\Windows\System\RcuHzML.exe
  2⤵
  PID:10748
- C:\Windows\System\vNtOfaX.exe
  C:\Windows\System\vNtOfaX.exe
  2⤵
  PID:11716
- C:\Windows\System\AREcSRh.exe
  C:\Windows\System\AREcSRh.exe
  2⤵
  PID:5220
- C:\Windows\System\quFOtkf.exe
  C:\Windows\System\quFOtkf.exe
  2⤵
  PID:9600
- C:\Windows\System\ChfutMn.exe
  C:\Windows\System\ChfutMn.exe
  2⤵
  PID:11836
- C:\Windows\System\sEobTpk.exe
  C:\Windows\System\sEobTpk.exe
  2⤵
  PID:9620
- C:\Windows\System\MFZablt.exe
  C:\Windows\System\MFZablt.exe
  2⤵
  PID:11544
- C:\Windows\System\fgARPFh.exe
  C:\Windows\System\fgARPFh.exe
  2⤵
  PID:8880
- C:\Windows\System\UZnpxtT.exe
  C:\Windows\System\UZnpxtT.exe
  2⤵
  PID:14328
- C:\Windows\System\SYNHOLr.exe
  C:\Windows\System\SYNHOLr.exe
  2⤵
  PID:12216
- C:\Windows\System\XOusnEb.exe
  C:\Windows\System\XOusnEb.exe
  2⤵
  PID:11724
- C:\Windows\System\bmybIJm.exe
  C:\Windows\System\bmybIJm.exe
  2⤵
  PID:10068
- C:\Windows\System\BXODkuJ.exe
  C:\Windows\System\BXODkuJ.exe
  2⤵
  PID:9332
- C:\Windows\System\RrbIFxf.exe
  C:\Windows\System\RrbIFxf.exe
  2⤵
  PID:11628
- C:\Windows\System\QQwOjcD.exe
  C:\Windows\System\QQwOjcD.exe
  2⤵
  PID:11652
- C:\Windows\System\JJBHkVJ.exe
  C:\Windows\System\JJBHkVJ.exe
  2⤵
  PID:11584
- C:\Windows\System\ApARLxO.exe
  C:\Windows\System\ApARLxO.exe
  2⤵
  PID:11552
- C:\Windows\System\WoJpdlu.exe
  C:\Windows\System\WoJpdlu.exe
  2⤵
  PID:12416
- C:\Windows\System\wJyYZIj.exe
  C:\Windows\System\wJyYZIj.exe
  2⤵
  PID:12052
- C:\Windows\System\oAmhIpO.exe
  C:\Windows\System\oAmhIpO.exe
  2⤵
  PID:10404
- C:\Windows\System\ZbVxzbn.exe
  C:\Windows\System\ZbVxzbn.exe
  2⤵
  PID:11580
- C:\Windows\System\rvfMYRk.exe
  C:\Windows\System\rvfMYRk.exe
  2⤵
  PID:10476
- C:\Windows\System\ChrcUZC.exe
  C:\Windows\System\ChrcUZC.exe
  2⤵
  PID:12640
- C:\Windows\System\PtuFLaE.exe
  C:\Windows\System\PtuFLaE.exe
  2⤵
  PID:9160
- C:\Windows\System\lrAhoLL.exe
  C:\Windows\System\lrAhoLL.exe
  2⤵
  PID:11736
- C:\Windows\System\bQgIjFP.exe
  C:\Windows\System\bQgIjFP.exe
  2⤵
  PID:12856
- C:\Windows\System\sILxgNw.exe
  C:\Windows\System\sILxgNw.exe
  2⤵
  PID:5056
- C:\Windows\System\dIolWLe.exe
  C:\Windows\System\dIolWLe.exe
  2⤵
  PID:9052
- C:\Windows\System\kGpZztp.exe
  C:\Windows\System\kGpZztp.exe
  2⤵
  PID:9968
- C:\Windows\System\NAbmeBV.exe
  C:\Windows\System\NAbmeBV.exe
  2⤵
  PID:12056
- C:\Windows\System\HQVmxBS.exe
  C:\Windows\System\HQVmxBS.exe
  2⤵
  PID:11748
- C:\Windows\System\qKKjstw.exe
  C:\Windows\System\qKKjstw.exe
  2⤵
  PID:13072
- C:\Windows\System\eTpLOoD.exe
  C:\Windows\System\eTpLOoD.exe
  2⤵
  PID:12740
- C:\Windows\System\ewnQdzN.exe
  C:\Windows\System\ewnQdzN.exe
  2⤵
  PID:9232
- C:\Windows\System\VcuoMXP.exe
  C:\Windows\System\VcuoMXP.exe
  2⤵
  PID:12672
- C:\Windows\System\NExDtgp.exe
  C:\Windows\System\NExDtgp.exe
  2⤵
  PID:11412
- C:\Windows\System\QebJagI.exe
  C:\Windows\System\QebJagI.exe
  2⤵
  PID:6328
- C:\Windows\System\WpqfFtU.exe
  C:\Windows\System\WpqfFtU.exe
  2⤵
  PID:4352
- C:\Windows\System\zqFRlPZ.exe
  C:\Windows\System\zqFRlPZ.exe
  2⤵
  PID:1476
- C:\Windows\System\lFaUSGJ.exe
  C:\Windows\System\lFaUSGJ.exe
  2⤵
  PID:12044
- C:\Windows\System\JEEpZEO.exe
  C:\Windows\System\JEEpZEO.exe
  2⤵
  PID:3336
- C:\Windows\System\TxnUWSs.exe
  C:\Windows\System\TxnUWSs.exe
  2⤵
  PID:11288
- C:\Windows\System\ouLcPBa.exe
  C:\Windows\System\ouLcPBa.exe
  2⤵
  PID:11732
- C:\Windows\System\lCKyIZK.exe
  C:\Windows\System\lCKyIZK.exe
  2⤵
  PID:11784
- C:\Windows\System\oWLmYft.exe
  C:\Windows\System\oWLmYft.exe
  2⤵
  PID:12824
- C:\Windows\System\cFguFlD.exe
  C:\Windows\System\cFguFlD.exe
  2⤵
  PID:1532
- C:\Windows\System\MkmhWxq.exe
  C:\Windows\System\MkmhWxq.exe
  2⤵
  PID:9604
- C:\Windows\System\rOsCGmF.exe
  C:\Windows\System\rOsCGmF.exe
  2⤵
  PID:12980
- C:\Windows\System\lvpGMNL.exe
  C:\Windows\System\lvpGMNL.exe
  2⤵
  PID:12660
- C:\Windows\System\YXzbUTq.exe
  C:\Windows\System\YXzbUTq.exe
  2⤵
  PID:8952
- C:\Windows\System\IMarETO.exe
  C:\Windows\System\IMarETO.exe
  2⤵
  PID:11420
- C:\Windows\System\jLdedza.exe
  C:\Windows\System\jLdedza.exe
  2⤵
  PID:12004
- C:\Windows\System\HWllFsW.exe
  C:\Windows\System\HWllFsW.exe
  2⤵
  PID:9580
- C:\Windows\System\IKXovYh.exe
  C:\Windows\System\IKXovYh.exe
  2⤵
  PID:11144
- C:\Windows\System\XaiLCLk.exe
  C:\Windows\System\XaiLCLk.exe
  2⤵
  PID:3408
- C:\Windows\System\klMzfWK.exe
  C:\Windows\System\klMzfWK.exe
  2⤵
  PID:12848
- C:\Windows\System\iUujZze.exe
  C:\Windows\System\iUujZze.exe
  2⤵
  PID:852
- C:\Windows\System\GFXNtdL.exe
  C:\Windows\System\GFXNtdL.exe
  2⤵
  PID:12668
- C:\Windows\System\giNcYfe.exe
  C:\Windows\System\giNcYfe.exe
  2⤵
  PID:9560
- C:\Windows\System\yVUnKgt.exe
  C:\Windows\System\yVUnKgt.exe
  2⤵
  PID:9156
- C:\Windows\System\gJrBSnF.exe
  C:\Windows\System\gJrBSnF.exe
  2⤵
  PID:12264
- C:\Windows\System\FvaDkKq.exe
  C:\Windows\System\FvaDkKq.exe
  2⤵
  PID:1908
- C:\Windows\System\CurbslD.exe
  C:\Windows\System\CurbslD.exe
  2⤵
  PID:12232
- C:\Windows\System\qoovGHm.exe
  C:\Windows\System\qoovGHm.exe
  2⤵
  PID:14360
- C:\Windows\System\TMvFgaM.exe
  C:\Windows\System\TMvFgaM.exe
  2⤵
  PID:14396
- C:\Windows\System\kZdkJCb.exe
  C:\Windows\System\kZdkJCb.exe
  2⤵
  PID:14424
- C:\Windows\System\GZxaynl.exe
  C:\Windows\System\GZxaynl.exe
  2⤵
  PID:14460
- C:\Windows\System\JYySkrP.exe
  C:\Windows\System\JYySkrP.exe
  2⤵
  PID:14488
- C:\Windows\System\MBSxoyh.exe
  C:\Windows\System\MBSxoyh.exe
  2⤵
  PID:14520
- C:\Windows\System\PXskVPL.exe
  C:\Windows\System\PXskVPL.exe
  2⤵
  PID:14564
- C:\Windows\System\ggzhAni.exe
  C:\Windows\System\ggzhAni.exe
  2⤵
  PID:14592
- C:\Windows\System\oINTpUo.exe
  C:\Windows\System\oINTpUo.exe
  2⤵
  PID:14624
- C:\Windows\System\FhbraIe.exe
  C:\Windows\System\FhbraIe.exe
  2⤵
  PID:14656
- C:\Windows\System\ggcbzQS.exe
  C:\Windows\System\ggcbzQS.exe
  2⤵
  PID:14692
- C:\Windows\System\fuFbnKp.exe
  C:\Windows\System\fuFbnKp.exe
  2⤵
  PID:14720
- C:\Windows\System\PbZpaDf.exe
  C:\Windows\System\PbZpaDf.exe
  2⤵
  PID:14768
- C:\Windows\System\sBxOoCl.exe
  C:\Windows\System\sBxOoCl.exe
  2⤵
  PID:14796
- C:\Windows\System\kCVtIoe.exe
  C:\Windows\System\kCVtIoe.exe
  2⤵
  PID:14832
- C:\Windows\System\bPEyOdD.exe
  C:\Windows\System\bPEyOdD.exe
  2⤵
  PID:14856
- C:\Windows\System\lvsFHTI.exe
  C:\Windows\System\lvsFHTI.exe
  2⤵
  PID:14896
- C:\Windows\System\sVImBog.exe
  C:\Windows\System\sVImBog.exe
  2⤵
  PID:14924
- C:\Windows\System\SLBhVhs.exe
  C:\Windows\System\SLBhVhs.exe
  2⤵
  PID:14952
- C:\Windows\System\bkMZFZb.exe
  C:\Windows\System\bkMZFZb.exe
  2⤵
  PID:14968
- C:\Windows\System\WQzKsWD.exe
  C:\Windows\System\WQzKsWD.exe
  2⤵
  PID:15000
- C:\Windows\System\YUusdmU.exe
  C:\Windows\System\YUusdmU.exe
  2⤵
  PID:15036
- C:\Windows\System\WgIfJOP.exe
  C:\Windows\System\WgIfJOP.exe
  2⤵
  PID:15064
- C:\Windows\System\cTZNqqa.exe
  C:\Windows\System\cTZNqqa.exe
  2⤵
  PID:15096
- C:\Windows\System\IYcXQam.exe
  C:\Windows\System\IYcXQam.exe
  2⤵
  PID:15136
- C:\Windows\System\HjZeZeN.exe
  C:\Windows\System\HjZeZeN.exe
  2⤵
  PID:15164
- C:\Windows\System\RUwriGA.exe
  C:\Windows\System\RUwriGA.exe
  2⤵
  PID:15192
- C:\Windows\System\rxOvpQn.exe
  C:\Windows\System\rxOvpQn.exe
  2⤵
  PID:15228
- C:\Windows\System\UpZrpZU.exe
  C:\Windows\System\UpZrpZU.exe
  2⤵
  PID:15260
- C:\Windows\System\TPkPzpn.exe
  C:\Windows\System\TPkPzpn.exe
  2⤵
  PID:15344
- C:\Windows\System\CvrDWUt.exe
  C:\Windows\System\CvrDWUt.exe
  2⤵
  PID:12192
- C:\Windows\System\yKOJKSY.exe
  C:\Windows\System\yKOJKSY.exe
  2⤵
  PID:14372
- C:\Windows\System\BfoTBWZ.exe
  C:\Windows\System\BfoTBWZ.exe
  2⤵
  PID:12164
- C:\Windows\System\LhJHPmw.exe
  C:\Windows\System\LhJHPmw.exe
  2⤵
  PID:14416
- C:\Windows\System\DQIVZsS.exe
  C:\Windows\System\DQIVZsS.exe
  2⤵
  PID:10632
- C:\Windows\System\QgFOGim.exe
  C:\Windows\System\QgFOGim.exe
  2⤵
  PID:14472
- C:\Windows\System\FLHDKBX.exe
  C:\Windows\System\FLHDKBX.exe
  2⤵
  PID:14532
- C:\Windows\System\iqniODL.exe
  C:\Windows\System\iqniODL.exe
  2⤵
  PID:14552
- C:\Windows\System\nmuCeWc.exe
  C:\Windows\System\nmuCeWc.exe
  2⤵
  PID:14580
- C:\Windows\System\LZovrRA.exe
  C:\Windows\System\LZovrRA.exe
  2⤵
  PID:14576
- C:\Windows\System\kDyqkQE.exe
  C:\Windows\System\kDyqkQE.exe
  2⤵
  PID:14632
- C:\Windows\System\fxReoxz.exe
  C:\Windows\System\fxReoxz.exe
  2⤵
  PID:2248
- C:\Windows\System\vPJcOtm.exe
  C:\Windows\System\vPJcOtm.exe
  2⤵
  PID:12584
- C:\Windows\System\cVqIXTV.exe
  C:\Windows\System\cVqIXTV.exe
  2⤵
  PID:14940
- C:\Windows\System\FBYFCir.exe
  C:\Windows\System\FBYFCir.exe
  2⤵
  PID:3828
- C:\Windows\System\gpsxQqI.exe
  C:\Windows\System\gpsxQqI.exe
  2⤵
  PID:15044
- C:\Windows\System\VKnvbiR.exe
  C:\Windows\System\VKnvbiR.exe
  2⤵
  PID:15076
- C:\Windows\System\qYRRoNp.exe
  C:\Windows\System\qYRRoNp.exe
  2⤵
  PID:15120
- C:\Windows\System\fALGCIS.exe
  C:\Windows\System\fALGCIS.exe
  2⤵
  PID:15152
- C:\Windows\System\lKRhuUx.exe
  C:\Windows\System\lKRhuUx.exe
  2⤵
  PID:15236
- C:\Windows\System\QGXmQrN.exe
  C:\Windows\System\QGXmQrN.exe
  2⤵
  PID:14352
- C:\Windows\System\VMCTiRp.exe
  C:\Windows\System\VMCTiRp.exe
  2⤵
  PID:15256
- C:\Windows\System\jYHeQSm.exe
  C:\Windows\System\jYHeQSm.exe
  2⤵
  PID:15284
- C:\Windows\System\SWCXklB.exe
  C:\Windows\System\SWCXklB.exe
  2⤵
  PID:15300
- C:\Windows\System\GKsIbIM.exe
  C:\Windows\System\GKsIbIM.exe
  2⤵
  PID:4360
- C:\Windows\System\yYYvqBV.exe
  C:\Windows\System\yYYvqBV.exe
  2⤵
  PID:13016
- C:\Windows\System\nnYcXVz.exe
  C:\Windows\System\nnYcXVz.exe
  2⤵
  PID:14620
- C:\Windows\System\tANXQok.exe
  C:\Windows\System\tANXQok.exe
  2⤵
  PID:14812
- C:\Windows\System\KPpBTQk.exe
  C:\Windows\System\KPpBTQk.exe
  2⤵
  PID:15024
- C:\Windows\System\CNvztOW.exe
  C:\Windows\System\CNvztOW.exe
  2⤵
  PID:12804
- C:\Windows\System\EtZqtqU.exe
  C:\Windows\System\EtZqtqU.exe
  2⤵
  PID:14392

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5292

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:13216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_vnijnvly.sev.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vnijnvly.sev.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AcBvyPa.exe

Path C:\Windows\System\AcBvyPa.exe
Size 2.1MB
SHA256 1006e62cc8bc0b5ae61a87d643a3a51fe2e756cb69369147d72ecfb0cc515423
MD5 8ac144e00e65e6fb967d8170e3d09e31
SHA1 8ad8d5599733c3aac5198cb60a471729a93339a3
SHA512 b311997031151496d177cb60a346c1662db4e8b1508e45a506f868314b308e98b32d64751629417dd92797d93cea4385c561d040f1fc387dc63116c5d69d6dde
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMF:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ArGJwjZ.exe

Path C:\Windows\System\ArGJwjZ.exe
Size 2.0MB
SHA256 918fdf5fbb2e328c9cccced57687d7323c972ebc5dd8aaa9b677cae582ec5bba
MD5 951ee5c1bfc819f562abafb1c050f956
SHA1 529e07dc2504147130cd3c8b61b76d733bc52c6d
SHA512 fb544829f1977fd904e7f254e67ad29c0d3b5c41a5c0253afb332e947cd1b784c07afb90979c4ecd09223365f6187b4cba0dd5d7fd62652856706941b7495845
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMC:NABb
MD5 SHA1 SHA512 SSDEEP

Submit Download

CXzeLcX.exe

Path C:\Windows\System\CXzeLcX.exe
Size 2.0MB
SHA256 00a3d093a3cf986af7b0b73ff17b47c344ed50189a09ee43c24c99647def922c
MD5 b59640631333465d36aa15900a5c0565
SHA1 5f350523cbddf852afe3296b7dae64a138ab15d7
SHA512 ff5c46efaee7c9aee34154dd280f5056fc74f7d950909925299819e87941ed0a2a349fe96e75901d528937f02ee2c7f10472a3f90e2f93c82c173b52adc99e5d
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMB:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

EhjJFAY.exe

Path C:\Windows\System\EhjJFAY.exe
Size 2.1MB
SHA256 71180ef07f58f22cf9990898953bc589dd865b20c58e34a68102f99218f96a6d
MD5 4a9697d025a6f0c8c137c9ca9b555147
SHA1 8bce2a568b46bca646123308031039583ce955d0
SHA512 97d34d23a94e3b2d8ff5db83c02ade455bff79cc1746997a06216fed0ff8d450553108d980e32e804b926063be388f39da9407af5ce7e34204c9dc00d6e9f403
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DM3:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

GrPcfwU.exe

Path C:\Windows\System\GrPcfwU.exe
Size 18B
SHA256 d755648ce473104eb4288ba17f93fb6dd46beb071ec41f05965c776f53951ba4
MD5 bfb583257cb761da77fbf8352ec954a6
SHA1 19e34ff1de8a6f5272d90e872addece324fb8cc5
SHA512 3298b6cc8f31df1cc48609a760655c2e163242b2f4a77c4f3a22d5de8a28aedadf8f58ddd3f500b371eda566553c4d7daf2e2cde5a1ae24a34154d120553ae0f
MD5 SHA1 SHA512

Submit Download

HpSLVfl.exe

Path C:\Windows\System\HpSLVfl.exe
Size 2.0MB
SHA256 a1baa67de1861f61f7cee683d036caf6af6933eb4bb568265b190d3b3f647f1a
MD5 c0909c2da2187cb1ee0b0083d7c5e9d2
SHA1 5c5dc8b6db3cecd69900f8d80e686c6ded953b07
SHA512 3ffabbce467a3162264b9ed4adeca321782aa0a4dad25fcc63bf4e5616d1cb0282ec782a43cab6dc1dbe9187331cafd3ed4b1e4315dabfd4e5600bdf1460b0e6
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DM5:NABG
MD5 SHA1 SHA512 SSDEEP

Submit Download

HqRmULr.exe

Path C:\Windows\System\HqRmULr.exe
Size 2.1MB
SHA256 1eab6f9962ab5b282fdcbd4460bd0daa6a392e5e671ee23c431acc4018db0c85
MD5 1bbdc5ba690b65d464723fbb4d9e4512
SHA1 93a003a379ef2fcf3793a1e6874555f2325fa234
SHA512 8499900b790e6bd0bc8ba3f75252359d70c838fb6623dbb8027b8431ba6a09069387fb4e6e1ae04169dcf47f7a99c3467d5051e6281fec3074aedcee1f0b9c2e
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMJad:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

IYRGcco.exe

Path C:\Windows\System\IYRGcco.exe
Size 2.0MB
SHA256 a2b931137b4bd87e63e5786fb7a2d7f8ff8fd44f2f897edacfeaa2b8eabd7a77
MD5 087e93db3c3cd7e7312782a1825dd016
SHA1 f7207714c9e510ca82bf7d19fbabf99ffae66741
SHA512 6ed685df1d9d7ff6df3335737c7d827402040741ad6ed26378eaccbb7e899c488570484abee2fdfe66b06ed9cbc30c7e167fc20be168dcd1ab88d42c4d478e92
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMn:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

JQqDqIq.exe

Path C:\Windows\System\JQqDqIq.exe
Size 2.0MB
SHA256 217cb774b4179b54cc8f77084d114a0d3e96a0bd990e428359ad56ae2eddada1
MD5 dd15b67add926753af661921db6b57ec
SHA1 524e7aeb931806b1d45a9c9985f1e281800ce8c0
SHA512 d108e4066ea0ecd05e5f00602178f651d87c205d18c5108a8baf92a1d5a33d9dc26f218e3d81e75764c5aba54dc2a9f9c34ab42afe0807a835e327df9db001fc
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DML:NABq
MD5 SHA1 SHA512 SSDEEP

Submit Download

KZKoFfx.exe

Path C:\Windows\System\KZKoFfx.exe
Size 2.1MB
SHA256 fb2e22aef9be73a0d7cda2517606a0a26c8d1cc5a4dd778b1bd374315403ba9c
MD5 934e0118b5862902d66bf12385891380
SHA1 b70c0bcb84f541ef43888e0982b7c73017152c14
SHA512 645cb5506893936bf239611468cbe5fdae8a1e803d651c25eed56ff0bc86deeec2b7e173911e51ebc4cf149a547e578985b8b330b1d31fab6c1bea4a61c1eba5
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMF:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LsozNqe.exe

Path C:\Windows\System\LsozNqe.exe
Size 2.0MB
SHA256 8d76f509e48d94de19dcb0c42099a070ac4b09ba3f47abdf3266cad5c4b86ec2
MD5 6caf49407703c029070d2de8c7bc2047
SHA1 4f2d2451358ed799ffae753b3bc73d3eb020228c
SHA512 06a1ac2fdcda9fc06b019fc0fff091ee5525cddd48bccc55ebf9716640edcaad87e245164a0f6312b8a3e50f32597603dbeaea0ea44b58d9a014600a561a7f73
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMt:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

LupPxnP.exe

Path C:\Windows\System\LupPxnP.exe
Size 2.0MB
SHA256 c9085c24c70cb0f730775d0b5ad98bd580138d796a0dd608ca9f8a365556f5b4
MD5 a84a4df1450be6d759ec278fde51f9cf
SHA1 995bdc189cd1ddb06eeb3bf0aac30d101da10a20
SHA512 6d7a41f6006b8dbd1fead5c94003d3b4afd4930881aa55ed221dc0928ce268bddf34e9e903680a4bab4e4780f07b2105a09b9b1532195e38417b90a1cd693955
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMc:NABH
MD5 SHA1 SHA512 SSDEEP

Submit Download

SRImuld.exe

Path C:\Windows\System\SRImuld.exe
Size 2.0MB
SHA256 41a63f8e2d4fd48e89ec8922a3c86522bd88415d948f5e9a010f420f0c677707
MD5 302c7785ce0ecead50ba0ff7817fcca0
SHA1 d878cc3f9843228f68dd51a2bae9adb6e85d45ed
SHA512 48b23c8424dced5d297d8e96f05dd5056c9790ac1e2b487229b309173b16759dcce98c138bdea2ba0e3b2c90d3791696126895e21011539c9d8bde973e3c6241
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMC:NABb
MD5 SHA1 SHA512 SSDEEP

Submit Download

UhCXsvt.exe

Path C:\Windows\System\UhCXsvt.exe
Size 2.0MB
SHA256 547b4cb0dbec8f3c9d619f0aae35bb5b6e2d7c74d5b347ac89113643ab0d3d41
MD5 ca1f39d7c7703d7ff461c545cd6c097c
SHA1 2afc4f5d016694d5092e8c751cce3650de7c5e32
SHA512 2d3f4fc0a153ed6502f5407dcc76e94d1f5838056e31afd791994e394d6106dd7738619958ce052da80933650d29b3c6894084fb8bd7e2a29561b621aee2d1a5
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMj:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

VLlQQPq.exe

Path C:\Windows\System\VLlQQPq.exe
Size 2.0MB
SHA256 87ca0f63fd2b20f4321af8e2c9032e45e2b1e9ffe261ba3217a1a27845d2b565
MD5 bea3a21d7b42997913db377e4ff97179
SHA1 40997026225875d8827103f259542c2ccb77ab2d
SHA512 c200a775e70ef4bd2d84baa3e9924b248e498b02d175b0af78e25ac68394af998b71ea463b80ae2397e318369e1fd024dcbef6a305c5627a15c09efbb91394aa
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DM7:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VzPDmCw.exe

Path C:\Windows\System\VzPDmCw.exe
Size 2.0MB
SHA256 ded1e63a5228ecd9c60a44288c419be484eece39ad2f265e0b4df8d6b8903b15
MD5 1f51a4fafe7ba9ee612db5b56fa83db0
SHA1 b7e8fa16310d965a907596b9a3ad1a6cdbdc41fa
SHA512 c64f49bed5e8b63bcfd19abee5645d9e2a1e1f1430cc4fd0e2f8ddf0504273fd5f5b6fdbdf9b6eb82705c54925a03d69bba5716c0f5f8ca6015de31170d980eb
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMp:NABO
MD5 SHA1 SHA512 SSDEEP

Submit Download

XFEEyuR.exe

Path C:\Windows\System\XFEEyuR.exe
Size 2.0MB
SHA256 44a1a6933397d3506a41657ed7940706237130ecd12ad129cb0389239b3c9d32
MD5 471ffca33b833fffe87b4bce2764cca1
SHA1 cf878fb7878b159a40a770c589b600f0e9d3a34c
SHA512 c51b283e40cb09d1ae6582c1525d2dcdbdf5638aaee5a3816665fda299091e70cee24cd8562e18ee3ccd259e9f1507f3aeb2653360872c12e0dcd2ed30abd0e4
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMM:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

XpMluAh.exe

Path C:\Windows\System\XpMluAh.exe
Size 2.0MB
SHA256 1efa0e34ca95024b94763130bc3570e207b09efb3c9ffb98df56406d2b2fc01c
MD5 39f037720dbb529bac863c503feba5eb
SHA1 6e9bb5ba3e1d55ff55b6b2a01f91311f35b7dc69
SHA512 97fc866c928e0f605ac367a18a22c77e497f63de921a0e5788b3ab5b0baea54ada75c79b49c400bf7027c6f91ce06416792352e54f673f3af391f2fc2cd2c274
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DM6:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

YUlTNXT.exe

Path C:\Windows\System\YUlTNXT.exe
Size 2.1MB
SHA256 571d8d0c57f6797f0bb8f27ce9b7ed82cdd629e7ce3388de268fe3701f40d8ea
MD5 c32b7c563ee464eb3d0f735ef6b46488
SHA1 d712bed7c1a3f6c46b5dffd7bc3e6c4ec3e59425
SHA512 3804a43bca1b010090ed49d09c4cbaf8ccec5fa9c6078dc5ac595c0b89fe6254cf703b6588b39e256854488fe22dd37315ac377ecb29e62674f7f82f0f95ad9d
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMt:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZoftgvJ.exe

Path C:\Windows\System\ZoftgvJ.exe
Size 2.1MB
SHA256 576f33ede62a540529afce82e806391730fbe21fdb415532fa4b5dac6cfbf98d
MD5 a7f4046ea31b3406e956766b0622d027
SHA1 e4d3a66c9d1fef46f290ae2211e750941d65abbc
SHA512 f1fd32ec43f231a7af11634c84af8106c6b22408f2d10399d2702441cf88beb925051fb54542f3433d507cf0049bc80b4ec75be783af1456b79fc1b7eeefa308
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DM7:NABy
MD5 SHA1 SHA512 SSDEEP

Submit Download

aGllUgG.exe

Path C:\Windows\System\aGllUgG.exe
Size 2.0MB
SHA256 1667eb1dda4555593295168c17ce4fb1440a2b37eaa6da67a4b525fd76a9a899
MD5 c97e019464fcd5948cbde1ec8924c88f
SHA1 398953818c6d798e11b7c9b1d82c51ecd9b3ca15
SHA512 d87bf74999ebad3d51897872815a2fccc7c7a5b142f7244cc009c7cf6db3c515a03b203319f111fc0c4a231cbda85593fa292f2c63609da524d8e136710fdec9
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMG:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ajhpkhU.exe

Path C:\Windows\System\ajhpkhU.exe
Size 2.0MB
SHA256 684f141f46c58bddb9b66deb276995c09f97d64c6b2f6343640578d4fa259539
MD5 f08d67e9dcd9acd11d5bf741456b672a
SHA1 9c25bdd789ea480639aecb87dfb500e80e1aafc9
SHA512 ef22a7445b1e98af3e1a815654c7c4ab166ae534906c3e1cde37ed21b55f25a10f8151487ad21ba62312e0cb60e111c1d8c737bb3c3e9a2c13b953b0ba5f82a5
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMU:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

aqEVlTb.exe

Path C:\Windows\System\aqEVlTb.exe
Size 2.0MB
SHA256 f246845681c24eae26f5ae25c0c44fc94c795d4688a7c12c9e95f1a3bbe6b44c
MD5 11a879eea8683a493097d5eab673dfaf
SHA1 b5e3cc3193177876c0a19572f73a9148a53bc6bf
SHA512 df28060e9055534d7e960649b6424c6d767d0c35b55dbb335622af0b37a715c3bd9d3a4aba46a8b1daa7066010f42b0bec663c680b5dde0e1e228e4c2f2dfc46
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMr:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

copyDwc.exe

Path C:\Windows\System\copyDwc.exe
Size 2.1MB
SHA256 e0ed510daf073002ce591cbd00a5b83055d31e353c9f05b5eb9451a70c8d32a2
MD5 968fa0b89518519dc2d71bd33a9b74e5
SHA1 1712f6cf95d0fcbe148f63cfa09371cb9cb2fc3c
SHA512 6b73d32fade81ab35dfe8d3d07b278e52932deb8b3686cc1b79dbe1ad64b2d1d66fdb0223af10f046c67e6a23ee6907ca3754a2f0f50303cfc74c639fce684c9
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMX:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

eBgJoNM.exe

Path C:\Windows\System\eBgJoNM.exe
Size 2.0MB
SHA256 62b5c96c5e998aaa62be4902783be0012aa2f6f8e08f43dd4497506b63bfb506
MD5 c3349738410734b678f4de0c23d22865
SHA1 8a9ee43548db49cc1c03260e9b98d9dd6e11965f
SHA512 235e333b3d80ed23a1ec08a2ca9f57f4a6cf4dc172a43066b6ae4fa686ec7a3cd28cdbf22529160263c0ad6e9ea9302b36207feecb49ab86297602da3ab1e0bb
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMf:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

fZQkPya.exe

Path C:\Windows\System\fZQkPya.exe
Size 2.1MB
SHA256 0faa53beecaf31365b47598d656d7b95708ace571e2a9f169db2f9c505fade2b
MD5 b3244fcf093d6a129bd38a0c20eedd33
SHA1 2b6c487b1d16b0112fab6d289a827e0378e31c6f
SHA512 42a1aba7ffc21a5b673d0d137c74ddfdf833ebec191549bb5f80ee3db71e1ec6786ea2912af90d7d932dbfd453720c0840cb6ad1be41b426720ea20fec266b97
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMu:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

geaQPaw.exe

Path C:\Windows\System\geaQPaw.exe
Size 2.0MB
SHA256 83beb13c39d3c9d80f5155a022861aefa48b7f2db2e5e2cf765498c90cbef5e0
MD5 bf4b820af30a9877ed4e59f9d1be8834
SHA1 8baad3b4b98cbe44568f6c42f79e08ba0bb81e88
SHA512 57fb41660c9305b78e39783c3fcea8caf0674c72c2d1172cd4444cdbf013da0eab25f69089d86331489a4d3a459f392ef8a46575173e61f97147dd72b65702f7
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMY:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jGdIIvw.exe

Path C:\Windows\System\jGdIIvw.exe
Size 2.1MB
SHA256 055be513844e1da437cf9d3fd6646e19eb9d42244c0618598569474816ca90a4
MD5 9f185fec9ffbc5cf66945d0c510f124a
SHA1 bd9a7bc5bc79a5b63773d00ebbc4840dbd29a56f
SHA512 89fa75f8746aa5cbc8804598555a4617ad3520b4fcbf03fa4f02e2d3f1a3b0695eb81147965ba48e36d794519ca7386dc991d423aa01886c41abacb2d1c62466
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMZ:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jTclxxi.exe

Path C:\Windows\System\jTclxxi.exe
Size 2.1MB
SHA256 7e6bd5a5c93c5cdeb25980231c00e2b066f0155b38c442891d71570dc7c1b0ab
MD5 6b2c96eb2b0702577d008deeeceead76
SHA1 04efa811df84670cf23c03a4192b49e9f1a1d33e
SHA512 daf52870fee0e925a76b17fdded4d2c2495ce787775afed32cee4c681d15e38f66fe30464543d802724e11ed731884c58a64086bee9abf7371de6681e97e04e1
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMg:NAB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ktcwMRb.exe

Path C:\Windows\System\ktcwMRb.exe
Size 2.0MB
SHA256 7d99dfa37e4d5280c5a45b30f5a14e8723a8f895b661ca5fb6f0c0bf033b554b
MD5 647c8d810f990dbdd9e1b41543a04e5a
SHA1 b136b107359bddc76fcf0a7ef335cd4e78a80567
SHA512 6cd9c630abe4a5f27f3c0d598ff93402cf3a9b8897b7cc157cc1db6e987dac7d77e76da78f70459e8bd017362d47118e5a47129535ede8e8b116449035977af6
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMt:NAB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

lBGkcrF.exe

Path C:\Windows\System\lBGkcrF.exe
Size 2.0MB
SHA256 a1dceb07e48e3ba3d9ac75189890b08f07a3887a6d0df5d16d792044afb97941
MD5 dc47e376fe2eb08a07bcf3133ba151b7
SHA1 fca8ce81b88f09ebe1bffc920711e1c145d94dad
SHA512 f9c7bb235070b1849370896d003150136fcfbaaf02bd6e8a4e77319184246c018eaf833802218439485113cdfbd1bf36b90051a3ad0a6cad6985def5b4cd6806
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMG:NABx
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwgtolC.exe

Path C:\Windows\System\nwgtolC.exe
Size 2.1MB
SHA256 e8f583587a7f79406c8ff9d6ff803e185ff1ab3dfbb694c8128972a7926386f0
MD5 519ae92c959c5658cdf3aac44ed338c6
SHA1 d3d4b9572f30947403029f7e546b3270b6077c92
SHA512 6471ef140bf2c9712e0f0da6ed94953ba9b5241145c727d57dcd4cfe3db9c90ab6aa8778e24f71e452028c29cf47ebf03becb20a0b05270c09023a235ccd0834
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DM8:NABD
MD5 SHA1 SHA512 SSDEEP

Submit Download

pDgfdxI.exe

Path C:\Windows\System\pDgfdxI.exe
Size 2.0MB
SHA256 24a7b92f50c35c4c30037129db353a038dedb438fa4f53f2f8e67cc528c60d06
MD5 931f3db89cd65fd7197fb705df47580c
SHA1 e3b8890dd0444a4254ccccf21876389405cf7dc2
SHA512 ea3dd94c96248fe0073c21a532192725de15c50e894821e3c70c5a7261824185047a6983cb43d2f91a6d96ecad435bc569222f6dee78d5133a671aca075f3955
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMM:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

pTZAYga.exe

Path C:\Windows\System\pTZAYga.exe
Size 2.0MB
SHA256 71ca7622ba448bb3de295c2d52045593f434d273bea0a39516f08cdc79b6a0be
MD5 0f7204a9c6ca0e512f64c1068d641f5d
SHA1 c095abbb127a21185a2877d5da0aeef133496b71
SHA512 835b3265d87c02ca5425240fc975d72290f7dd1a343e00834b1a265004a6a79ac2d7586f33344492b6aceaae5d0dad4f6ba681307e02239efb6cb74f2498f91c
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMH:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

tlMBSTX.exe

Path C:\Windows\System\tlMBSTX.exe
Size 2.0MB
SHA256 e385d9b5c4cc4060c4315f978f3e33f0ee9b4fc90eae3c2f6801246625ee3ccf
MD5 49b72092f74bc091eb1fc8b15f342972
SHA1 b598ad05b67e26c2477a048d6f563cd5c347953c
SHA512 9333406a5b579994399ca7fc0c98ffbac24e16a8a94d7558a1f2307c540de89d0abd6f7c53e201a3daa483cb4902b8e9e8f486f103a46539b75888ea0092c4cc
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMa:NABV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ulMDVnf.exe

Path C:\Windows\System\ulMDVnf.exe
Size 2.0MB
SHA256 2a6aa859ecd7888c3ded700f0755cca330cb6420aa5f7ea169bd598482bcdba8
MD5 e2eaf516535a5ab698d1945e8554997f
SHA1 d70275c9cb829e17034ec67be92ecab87b9f1da9
SHA512 e91986849c64abaef53308b2ad5bc5f62fc4b873f97545dfeaadd5c1efd812bff36ccf392873019f7df86c8cdf6fd6f2a7e7aa6dfd35964a93ada36576c0dc9d
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMW:NABv
MD5 SHA1 SHA512 SSDEEP

Submit Download

vljJiHb.exe

Path C:\Windows\System\vljJiHb.exe
Size 2.0MB
SHA256 3752dc544ad9f75648d0bed97c3e4b54ad973802f33c47015a558b568b234342
MD5 e961ab3bbf52176b2b51aefae28db67e
SHA1 ec97cf0348d85cba65693cb80eb71ad065b88e06
SHA512 30b5b9b46dd1a8bafeeb97d78658b66a1cf1de0355dde1ae120a4fb6124e01a89f819ad5a774e9978f395e23450de7b242bd68a79f6600882974ac1a18c238b3
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DME:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

wElhCMn.exe

Path C:\Windows\System\wElhCMn.exe
Size 2.1MB
SHA256 9d645be9b658209121f953d0e1c670ca38d49ad6edec82bd22be25a9878ed896
MD5 cc05fc4f7bdf40526a67d0586ed18425
SHA1 b9021399b036e8eeb9cbce348d8d57a3ccf577ce
SHA512 69a3edd3a6ccf7befa05bc341e06e7225cc483d2da202661739a33d052a76d80e062b178044952a568d0feb02f3f5baed398fb5e13dfc67041f32de7e9bce9f3
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4DMZ:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/736-421-0x00007FF67FCE0000-0x00007FF6800D2000-memory.dmp

Download

memory/756-425-0x00007FF765770000-0x00007FF765B62000-memory.dmp

Download

memory/756-6525-0x00007FF765770000-0x00007FF765B62000-memory.dmp

Download

memory/940-6482-0x00007FF696D00000-0x00007FF6970F2000-memory.dmp

Download

memory/940-435-0x00007FF696D00000-0x00007FF6970F2000-memory.dmp

Download

memory/1000-430-0x00007FF7D3090000-0x00007FF7D3482000-memory.dmp

Download

memory/1000-6549-0x00007FF7D3090000-0x00007FF7D3482000-memory.dmp

Download

memory/1260-10-0x00007FF6AB060000-0x00007FF6AB452000-memory.dmp

Download

memory/1508-6542-0x00007FF72E960000-0x00007FF72ED52000-memory.dmp

Download

memory/1508-323-0x00007FF72E960000-0x00007FF72ED52000-memory.dmp

Download

memory/1852-27-0x00007FF651B70000-0x00007FF651F62000-memory.dmp

Download

memory/1852-6372-0x00007FF651B70000-0x00007FF651F62000-memory.dmp

Download

memory/1880-233-0x00007FF66A6B0000-0x00007FF66AAA2000-memory.dmp

Download

memory/1880-6460-0x00007FF66A6B0000-0x00007FF66AAA2000-memory.dmp

Download

memory/2032-386-0x00007FF7EE180000-0x00007FF7EE572000-memory.dmp

Download

memory/2460-6585-0x00007FF781B50000-0x00007FF781F42000-memory.dmp

Download

memory/2460-424-0x00007FF781B50000-0x00007FF781F42000-memory.dmp

Download

memory/2508-6489-0x00007FF68D650000-0x00007FF68DA42000-memory.dmp

Download

memory/2508-283-0x00007FF68D650000-0x00007FF68DA42000-memory.dmp

Download

memory/3056-6541-0x00007FF6C8E40000-0x00007FF6C9232000-memory.dmp

Download

memory/3056-427-0x00007FF6C8E40000-0x00007FF6C9232000-memory.dmp

Download

memory/3136-434-0x00007FF7C7370000-0x00007FF7C7762000-memory.dmp

Download

memory/3136-6461-0x00007FF7C7370000-0x00007FF7C7762000-memory.dmp

Download

memory/3264-431-0x00007FF7B7180000-0x00007FF7B7572000-memory.dmp

Download

memory/3264-6576-0x00007FF7B7180000-0x00007FF7B7572000-memory.dmp

Download

memory/3372-1-0x0000028A365C0000-0x0000028A365D0000-memory.dmp

Download

memory/3372-0-0x00007FF6E7A10000-0x00007FF6E7E02000-memory.dmp

Download

memory/3468-204-0x00007FFB657A0000-0x00007FFB66261000-memory.dmp

Download

memory/3468-267-0x0000015F2DEC0000-0x0000015F2DEE2000-memory.dmp

Download

memory/3468-2532-0x00007FFB657A0000-0x00007FFB66261000-memory.dmp

Download

memory/3468-29-0x00007FFB657A3000-0x00007FFB657A5000-memory.dmp

Download

memory/3468-98-0x00007FFB657A0000-0x00007FFB66261000-memory.dmp

Download

memory/3956-6612-0x00007FF728720000-0x00007FF728B12000-memory.dmp

Download

memory/3956-482-0x00007FF728720000-0x00007FF728B12000-memory.dmp

Download

memory/3968-423-0x00007FF621490000-0x00007FF621882000-memory.dmp

Download

memory/3968-6573-0x00007FF621490000-0x00007FF621882000-memory.dmp

Download

memory/4024-6540-0x00007FF7A0380000-0x00007FF7A0772000-memory.dmp

Download

memory/4024-422-0x00007FF7A0380000-0x00007FF7A0772000-memory.dmp

Download

memory/4080-6606-0x00007FF7D9A40000-0x00007FF7D9E32000-memory.dmp

Download

memory/4080-426-0x00007FF7D9A40000-0x00007FF7D9E32000-memory.dmp

Download

memory/4400-415-0x00007FF698660000-0x00007FF698A52000-memory.dmp

Download

memory/4400-6551-0x00007FF698660000-0x00007FF698A52000-memory.dmp

Download

memory/4692-432-0x00007FF626F60000-0x00007FF627352000-memory.dmp

Download

memory/4692-6560-0x00007FF626F60000-0x00007FF627352000-memory.dmp

Download

memory/4768-6566-0x00007FF696A50000-0x00007FF696E42000-memory.dmp

Download

memory/4768-429-0x00007FF696A50000-0x00007FF696E42000-memory.dmp

Download

memory/4992-6590-0x00007FF739CE0000-0x00007FF73A0D2000-memory.dmp

Download

memory/4992-428-0x00007FF739CE0000-0x00007FF73A0D2000-memory.dmp

Download

memory/5084-6557-0x00007FF638780000-0x00007FF638B72000-memory.dmp

Download

memory/5084-420-0x00007FF638780000-0x00007FF638B72000-memory.dmp

Download

memory/5100-6593-0x00007FF6EE910000-0x00007FF6EED02000-memory.dmp

Download

memory/5100-433-0x00007FF6EE910000-0x00007FF6EED02000-memory.dmp

Download