xmrig | 7578b29addcb834dfdf64a67fabdaa23143cb47e99a1cb0fa2f77ad2b44fc14b

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
Size

2.1MB
MD5

0f88f1996085a8650ac3a675a46a20ac
SHA1

b9748066f6a44bf61e2dded48552a7161fd84f53
SHA256

7578b29addcb834dfdf64a67fabdaa23143cb47e99a1cb0fa2f77ad2b44fc14b
SHA512

5c4c50d3ee9d989c16360bccedef0b142633201257154d705fb0801e1966c1f2a2d59a1a27160868d4bbc4fd4137f893fa7a6e06fd30fd7f1a96546a9227a9c2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qru/:NABx

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/2016-12-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2520-4746-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2476-5053-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/3028-5051-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/1488-5060-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2628-5056-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2680-5066-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2768-5072-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2580-5064-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2016-5076-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2536-5082-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/1836-5087-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2200	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2016	hwgKRQu.exe
3032	WtFTRrA.exe
2680	TIHNsct.exe
2580	IzvLriA.exe
2768	GHOXbEf.exe
1488	gMhmHXd.exe
2628	KJqzKec.exe
2520	QjgNIlA.exe
2476	wmTlMBL.exe
2536	beGOvnc.exe
3028	BrFgLHX.exe
1836	bKEEoUf.exe
920	OcGenGS.exe
2844	pYGMLEu.exe
2856	gSLNBVS.exe
2904	rjhTLNR.exe
2900	EWhBkYI.exe
2564	ysVQEEm.exe
3016	WWYNAcd.exe
1696	FlIevCr.exe
1656	aqqgulB.exe
1792	yDTVGMd.exe
2148	sBHOkwF.exe
2772	gaPpjuf.exe
2784	UjUUcat.exe
348	jdGGQIb.exe
1780	GRRRNPO.exe
2504	tXoYGtl.exe
3056	gjXQuXw.exe
2208	zotrOKj.exe
1220	CfWfAsJ.exe
2248	WjdgQyC.exe
1852	JEnEfsG.exe
2252	lSDnuPw.exe
1572	UCQeESV.exe
2192	IzAQipE.exe
2984	HEcWVdN.exe
1732	eGpSQCT.exe
904	OqNCJku.exe
952	AioSaHu.exe
600	rlMVEoZ.exe
1316	AmfVdTS.exe
1668	lQGLgyH.exe
300	aPPviHE.exe
2156	DDslGwo.exe
568	YdhCtNR.exe
2400	VMKMkAB.exe
2184	LvdbHqk.exe
880	XVrnovJ.exe
1764	sAktMBF.exe
2300	kDDkhxF.exe
1540	NpsJSdx.exe
2120	EEWzNUb.exe
1556	kEeZSxI.exe
1560	iKXycRq.exe
1324	bgXTIlx.exe
1628	zVQjUJh.exe
2684	xqoVxoh.exe
2744	GLgAqah.exe
2812	LRvJIsj.exe
2732	PVughGi.exe
2496	nNdytah.exe
1164	LAXnSRt.exe
1616	HNMxMHJ.exe

Loads dropped DLL 64 IoCs

pid	Process
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2036-1-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/files/0x000b000000012301-3.dat	upx
behavioral1/files/0x00360000000167e8-8.dat	upx
behavioral1/memory/3032-15-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2016-12-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x000500000001937a-164.dat	upx
behavioral1/files/0x000500000001927b-137.dat	upx
behavioral1/files/0x000500000001925a-129.dat	upx
behavioral1/files/0x000600000001902f-122.dat	upx
behavioral1/memory/1836-158-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/3028-156-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2536-155-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/2476-153-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/2520-151-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2628-149-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/1488-147-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2768-145-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2580-143-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/files/0x000500000001928e-141.dat	upx
behavioral1/files/0x0005000000019276-133.dat	upx
behavioral1/files/0x0005000000019254-125.dat	upx
behavioral1/files/0x0005000000018749-113.dat	upx
behavioral1/files/0x000500000001870e-105.dat	upx
behavioral1/files/0x000500000001878f-117.dat	upx
behavioral1/files/0x000500000001871c-109.dat	upx
behavioral1/files/0x00050000000186a2-101.dat	upx
behavioral1/files/0x000d000000018689-97.dat	upx
behavioral1/files/0x0006000000017603-92.dat	upx
behavioral1/files/0x00060000000175fd-88.dat	upx
behavioral1/files/0x00060000000175f7-84.dat	upx
behavioral1/files/0x0006000000017577-80.dat	upx
behavioral1/files/0x00060000000174ef-76.dat	upx
behavioral1/files/0x0006000000017436-72.dat	upx
behavioral1/files/0x00060000000173e5-68.dat	upx
behavioral1/files/0x00060000000173e2-64.dat	upx
behavioral1/files/0x000600000001738f-60.dat	upx
behavioral1/files/0x000600000001738e-57.dat	upx
behavioral1/files/0x00060000000171ad-52.dat	upx
behavioral1/files/0x000700000001708c-48.dat	upx
behavioral1/files/0x0009000000016d19-45.dat	upx
behavioral1/files/0x0007000000016d01-40.dat	upx
behavioral1/files/0x0008000000016cf2-37.dat	upx
behavioral1/files/0x00130000000054a8-33.dat	upx
behavioral1/memory/2680-27-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/files/0x0008000000016c5b-10.dat	upx
behavioral1/memory/2520-4746-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2476-5053-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/3028-5051-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/1488-5060-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2628-5056-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2680-5066-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2768-5072-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2580-5064-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2016-5076-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2536-5082-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/1836-5087-0x000000013F280000-0x000000013F672000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CiPZMpI.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\yfVjiXj.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\rOLPkxo.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\GieHylz.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\ZVBIZPh.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\XvebTLU.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\ZWfMJHv.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\rxYiWcZ.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\pQLfRGl.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\xrfsYRS.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\nlhmLtk.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\xECKtsE.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\dwEOFrh.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\IOBPMMT.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\sVUfYus.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\HXzwZyN.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\PnekRrZ.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\MiIkdGs.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\tmKLucg.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\SLwXujL.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\sVCQXbE.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\RRDSPSb.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\LrQznRW.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\zRCTWfR.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\vJHizoB.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\ytqjJBZ.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\vplrGkk.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\TIxWZJj.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\ZXNYNIb.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\eHuogZm.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\LxJDmtH.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\bgrfmtx.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\bWvznQA.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\oBUVrSN.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\eKQiqGn.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\knqSUYW.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\nFPZhjs.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\nNQtnRn.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\LbtVqQa.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\zPqBFgZ.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\cIKLMYH.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\JTYuxiv.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\uZHLtLe.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\DhqeOBs.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\nKguHPV.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\IJMPfvy.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\VJCVdnW.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\qzAauFB.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\pIDtDQJ.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\FSExSfO.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\wStUJeS.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\ECMPRQk.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\zSeZlPm.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\roTdOpH.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\QppgOZB.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\EyEecJO.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\aszYToI.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\ltdwTJj.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\FAdzZPr.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\QqqRBRB.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\kfesFoT.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\pavTBCa.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\LwshIAV.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
File created	C:\Windows\System\xvBNziH.exe	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeLockMemoryPrivilege	19260	Process not Found
Token: SeLockMemoryPrivilege	19260	Process not Found
Token: SeLockMemoryPrivilege	20184	Process not Found
Token: SeLockMemoryPrivilege	20184	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2200	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	29
PID 2036 wrote to memory of 2200	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	29
PID 2036 wrote to memory of 2200	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	29
PID 2036 wrote to memory of 2016	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2016	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2016	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	30
PID 2036 wrote to memory of 3032	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	31
PID 2036 wrote to memory of 3032	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	31
PID 2036 wrote to memory of 3032	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2680	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2680	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2680	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2580	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2580	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2580	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2768	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2768	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2768	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	34
PID 2036 wrote to memory of 1488	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	35
PID 2036 wrote to memory of 1488	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	35
PID 2036 wrote to memory of 1488	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	35
PID 2036 wrote to memory of 2628	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2628	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2628	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2520	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2520	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2520	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2476	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2476	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2476	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2536	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	39
PID 2036 wrote to memory of 2536	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	39
PID 2036 wrote to memory of 2536	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	39
PID 2036 wrote to memory of 3028	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	40
PID 2036 wrote to memory of 3028	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	40
PID 2036 wrote to memory of 3028	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	40
PID 2036 wrote to memory of 1836	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	41
PID 2036 wrote to memory of 1836	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	41
PID 2036 wrote to memory of 1836	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	41
PID 2036 wrote to memory of 920	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	42
PID 2036 wrote to memory of 920	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	42
PID 2036 wrote to memory of 920	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	42
PID 2036 wrote to memory of 2844	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	43
PID 2036 wrote to memory of 2844	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	43
PID 2036 wrote to memory of 2844	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	43
PID 2036 wrote to memory of 2856	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	44
PID 2036 wrote to memory of 2856	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	44
PID 2036 wrote to memory of 2856	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	44
PID 2036 wrote to memory of 2904	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	45
PID 2036 wrote to memory of 2904	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	45
PID 2036 wrote to memory of 2904	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	45
PID 2036 wrote to memory of 2900	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	46
PID 2036 wrote to memory of 2900	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	46
PID 2036 wrote to memory of 2900	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	46
PID 2036 wrote to memory of 2564	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	47
PID 2036 wrote to memory of 2564	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	47
PID 2036 wrote to memory of 2564	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	47
PID 2036 wrote to memory of 3016	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	48
PID 2036 wrote to memory of 3016	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	48
PID 2036 wrote to memory of 3016	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	48
PID 2036 wrote to memory of 1696	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	49
PID 2036 wrote to memory of 1696	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	49
PID 2036 wrote to memory of 1696	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	49
PID 2036 wrote to memory of 1656	2036	0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f88f1996085a8650ac3a675a46a20ac_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\System\hwgKRQu.exe
  C:\Windows\System\hwgKRQu.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\WtFTRrA.exe
  C:\Windows\System\WtFTRrA.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\TIHNsct.exe
  C:\Windows\System\TIHNsct.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\IzvLriA.exe
  C:\Windows\System\IzvLriA.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\GHOXbEf.exe
  C:\Windows\System\GHOXbEf.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\gMhmHXd.exe
  C:\Windows\System\gMhmHXd.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\KJqzKec.exe
  C:\Windows\System\KJqzKec.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\QjgNIlA.exe
  C:\Windows\System\QjgNIlA.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\wmTlMBL.exe
  C:\Windows\System\wmTlMBL.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\beGOvnc.exe
  C:\Windows\System\beGOvnc.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\BrFgLHX.exe
  C:\Windows\System\BrFgLHX.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\bKEEoUf.exe
  C:\Windows\System\bKEEoUf.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\OcGenGS.exe
  C:\Windows\System\OcGenGS.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\pYGMLEu.exe
  C:\Windows\System\pYGMLEu.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\gSLNBVS.exe
  C:\Windows\System\gSLNBVS.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\rjhTLNR.exe
  C:\Windows\System\rjhTLNR.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\EWhBkYI.exe
  C:\Windows\System\EWhBkYI.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ysVQEEm.exe
  C:\Windows\System\ysVQEEm.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\WWYNAcd.exe
  C:\Windows\System\WWYNAcd.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\FlIevCr.exe
  C:\Windows\System\FlIevCr.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\aqqgulB.exe
  C:\Windows\System\aqqgulB.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\yDTVGMd.exe
  C:\Windows\System\yDTVGMd.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\sBHOkwF.exe
  C:\Windows\System\sBHOkwF.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\gaPpjuf.exe
  C:\Windows\System\gaPpjuf.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\UjUUcat.exe
  C:\Windows\System\UjUUcat.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\jdGGQIb.exe
  C:\Windows\System\jdGGQIb.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\GRRRNPO.exe
  C:\Windows\System\GRRRNPO.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\tXoYGtl.exe
  C:\Windows\System\tXoYGtl.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\gjXQuXw.exe
  C:\Windows\System\gjXQuXw.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\zotrOKj.exe
  C:\Windows\System\zotrOKj.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\CfWfAsJ.exe
  C:\Windows\System\CfWfAsJ.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\WjdgQyC.exe
  C:\Windows\System\WjdgQyC.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\JEnEfsG.exe
  C:\Windows\System\JEnEfsG.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\lSDnuPw.exe
  C:\Windows\System\lSDnuPw.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\UCQeESV.exe
  C:\Windows\System\UCQeESV.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\IzAQipE.exe
  C:\Windows\System\IzAQipE.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\HEcWVdN.exe
  C:\Windows\System\HEcWVdN.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\eGpSQCT.exe
  C:\Windows\System\eGpSQCT.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\OqNCJku.exe
  C:\Windows\System\OqNCJku.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\AioSaHu.exe
  C:\Windows\System\AioSaHu.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\rlMVEoZ.exe
  C:\Windows\System\rlMVEoZ.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\AmfVdTS.exe
  C:\Windows\System\AmfVdTS.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\lQGLgyH.exe
  C:\Windows\System\lQGLgyH.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\aPPviHE.exe
  C:\Windows\System\aPPviHE.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\DDslGwo.exe
  C:\Windows\System\DDslGwo.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\YdhCtNR.exe
  C:\Windows\System\YdhCtNR.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\VMKMkAB.exe
  C:\Windows\System\VMKMkAB.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\LvdbHqk.exe
  C:\Windows\System\LvdbHqk.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\XVrnovJ.exe
  C:\Windows\System\XVrnovJ.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\sAktMBF.exe
  C:\Windows\System\sAktMBF.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\kDDkhxF.exe
  C:\Windows\System\kDDkhxF.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\NpsJSdx.exe
  C:\Windows\System\NpsJSdx.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\EEWzNUb.exe
  C:\Windows\System\EEWzNUb.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\kEeZSxI.exe
  C:\Windows\System\kEeZSxI.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\iKXycRq.exe
  C:\Windows\System\iKXycRq.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\bgXTIlx.exe
  C:\Windows\System\bgXTIlx.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\zVQjUJh.exe
  C:\Windows\System\zVQjUJh.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\xqoVxoh.exe
  C:\Windows\System\xqoVxoh.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\GLgAqah.exe
  C:\Windows\System\GLgAqah.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\LRvJIsj.exe
  C:\Windows\System\LRvJIsj.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\PVughGi.exe
  C:\Windows\System\PVughGi.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\nNdytah.exe
  C:\Windows\System\nNdytah.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\LAXnSRt.exe
  C:\Windows\System\LAXnSRt.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\HNMxMHJ.exe
  C:\Windows\System\HNMxMHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\AUwOLlQ.exe
  C:\Windows\System\AUwOLlQ.exe
  2⤵
  PID:2880
- C:\Windows\System\LdFbzfX.exe
  C:\Windows\System\LdFbzfX.exe
  2⤵
  PID:2892
- C:\Windows\System\ZxYLEYQ.exe
  C:\Windows\System\ZxYLEYQ.exe
  2⤵
  PID:1808
- C:\Windows\System\uTKbEdj.exe
  C:\Windows\System\uTKbEdj.exe
  2⤵
  PID:2532
- C:\Windows\System\rBDreyt.exe
  C:\Windows\System\rBDreyt.exe
  2⤵
  PID:2640
- C:\Windows\System\gkXHgaZ.exe
  C:\Windows\System\gkXHgaZ.exe
  2⤵
  PID:3052
- C:\Windows\System\ZJNGarG.exe
  C:\Windows\System\ZJNGarG.exe
  2⤵
  PID:2004
- C:\Windows\System\VZbsqXa.exe
  C:\Windows\System\VZbsqXa.exe
  2⤵
  PID:2944
- C:\Windows\System\uRXklOj.exe
  C:\Windows\System\uRXklOj.exe
  2⤵
  PID:628
- C:\Windows\System\CJgyMdY.exe
  C:\Windows\System\CJgyMdY.exe
  2⤵
  PID:1308
- C:\Windows\System\simiohB.exe
  C:\Windows\System\simiohB.exe
  2⤵
  PID:1136
- C:\Windows\System\qqoCSCK.exe
  C:\Windows\System\qqoCSCK.exe
  2⤵
  PID:2416
- C:\Windows\System\WLNkGqp.exe
  C:\Windows\System\WLNkGqp.exe
  2⤵
  PID:812
- C:\Windows\System\KuQzfhX.exe
  C:\Windows\System\KuQzfhX.exe
  2⤵
  PID:1428
- C:\Windows\System\LYNMNAU.exe
  C:\Windows\System\LYNMNAU.exe
  2⤵
  PID:2748
- C:\Windows\System\ICefHkz.exe
  C:\Windows\System\ICefHkz.exe
  2⤵
  PID:2508
- C:\Windows\System\mJwsylu.exe
  C:\Windows\System\mJwsylu.exe
  2⤵
  PID:1232
- C:\Windows\System\LfwpmUx.exe
  C:\Windows\System\LfwpmUx.exe
  2⤵
  PID:2176
- C:\Windows\System\LXjirHP.exe
  C:\Windows\System\LXjirHP.exe
  2⤵
  PID:1824
- C:\Windows\System\KDQrTTj.exe
  C:\Windows\System\KDQrTTj.exe
  2⤵
  PID:2452
- C:\Windows\System\rWJcNEe.exe
  C:\Windows\System\rWJcNEe.exe
  2⤵
  PID:2896
- C:\Windows\System\qDdEUSM.exe
  C:\Windows\System\qDdEUSM.exe
  2⤵
  PID:2788
- C:\Windows\System\XincRtv.exe
  C:\Windows\System\XincRtv.exe
  2⤵
  PID:2960
- C:\Windows\System\GPllhix.exe
  C:\Windows\System\GPllhix.exe
  2⤵
  PID:2972
- C:\Windows\System\DUVbqCK.exe
  C:\Windows\System\DUVbqCK.exe
  2⤵
  PID:2964
- C:\Windows\System\kwhwmwx.exe
  C:\Windows\System\kwhwmwx.exe
  2⤵
  PID:1196
- C:\Windows\System\nkyFsyY.exe
  C:\Windows\System\nkyFsyY.exe
  2⤵
  PID:2444
- C:\Windows\System\ZnwyWPY.exe
  C:\Windows\System\ZnwyWPY.exe
  2⤵
  PID:956
- C:\Windows\System\EOOXCQk.exe
  C:\Windows\System\EOOXCQk.exe
  2⤵
  PID:2100
- C:\Windows\System\FYmqyvp.exe
  C:\Windows\System\FYmqyvp.exe
  2⤵
  PID:1468
- C:\Windows\System\uprdNln.exe
  C:\Windows\System\uprdNln.exe
  2⤵
  PID:984
- C:\Windows\System\ODZoQkT.exe
  C:\Windows\System\ODZoQkT.exe
  2⤵
  PID:1244
- C:\Windows\System\ZuHbYVV.exe
  C:\Windows\System\ZuHbYVV.exe
  2⤵
  PID:1880
- C:\Windows\System\xaZTzHu.exe
  C:\Windows\System\xaZTzHu.exe
  2⤵
  PID:852
- C:\Windows\System\OCOUcqT.exe
  C:\Windows\System\OCOUcqT.exe
  2⤵
  PID:1348
- C:\Windows\System\sOyTOwA.exe
  C:\Windows\System\sOyTOwA.exe
  2⤵
  PID:1940
- C:\Windows\System\pIzzivz.exe
  C:\Windows\System\pIzzivz.exe
  2⤵
  PID:2116
- C:\Windows\System\olrGkdY.exe
  C:\Windows\System\olrGkdY.exe
  2⤵
  PID:936
- C:\Windows\System\Fmnexfb.exe
  C:\Windows\System\Fmnexfb.exe
  2⤵
  PID:1040
- C:\Windows\System\sEYkXWS.exe
  C:\Windows\System\sEYkXWS.exe
  2⤵
  PID:1508
- C:\Windows\System\JxOlKuF.exe
  C:\Windows\System\JxOlKuF.exe
  2⤵
  PID:1892
- C:\Windows\System\xzpMjze.exe
  C:\Windows\System\xzpMjze.exe
  2⤵
  PID:2940
- C:\Windows\System\RVrnfrl.exe
  C:\Windows\System\RVrnfrl.exe
  2⤵
  PID:2992
- C:\Windows\System\EeSPYaK.exe
  C:\Windows\System\EeSPYaK.exe
  2⤵
  PID:496
- C:\Windows\System\CGVMlQG.exe
  C:\Windows\System\CGVMlQG.exe
  2⤵
  PID:2556
- C:\Windows\System\dARfBMO.exe
  C:\Windows\System\dARfBMO.exe
  2⤵
  PID:1684
- C:\Windows\System\yognQbN.exe
  C:\Windows\System\yognQbN.exe
  2⤵
  PID:2764
- C:\Windows\System\APuRRTe.exe
  C:\Windows\System\APuRRTe.exe
  2⤵
  PID:2588
- C:\Windows\System\nXmAeKb.exe
  C:\Windows\System\nXmAeKb.exe
  2⤵
  PID:2464
- C:\Windows\System\wTVuOGT.exe
  C:\Windows\System\wTVuOGT.exe
  2⤵
  PID:3020
- C:\Windows\System\HcXFokt.exe
  C:\Windows\System\HcXFokt.exe
  2⤵
  PID:2848
- C:\Windows\System\byQoNJv.exe
  C:\Windows\System\byQoNJv.exe
  2⤵
  PID:1676
- C:\Windows\System\NOcpWdV.exe
  C:\Windows\System\NOcpWdV.exe
  2⤵
  PID:2652
- C:\Windows\System\KnDwnOd.exe
  C:\Windows\System\KnDwnOd.exe
  2⤵
  PID:2212
- C:\Windows\System\dHxhGgM.exe
  C:\Windows\System\dHxhGgM.exe
  2⤵
  PID:1080
- C:\Windows\System\ApDjDih.exe
  C:\Windows\System\ApDjDih.exe
  2⤵
  PID:1132
- C:\Windows\System\hGnrDbh.exe
  C:\Windows\System\hGnrDbh.exe
  2⤵
  PID:620
- C:\Windows\System\zPjaCbz.exe
  C:\Windows\System\zPjaCbz.exe
  2⤵
  PID:2636
- C:\Windows\System\UAoSHkw.exe
  C:\Windows\System\UAoSHkw.exe
  2⤵
  PID:2836
- C:\Windows\System\OmhlMEi.exe
  C:\Windows\System\OmhlMEi.exe
  2⤵
  PID:1100
- C:\Windows\System\HHHgdkj.exe
  C:\Windows\System\HHHgdkj.exe
  2⤵
  PID:2824
- C:\Windows\System\eNtSuYO.exe
  C:\Windows\System\eNtSuYO.exe
  2⤵
  PID:1464
- C:\Windows\System\sgBseWQ.exe
  C:\Windows\System\sgBseWQ.exe
  2⤵
  PID:2448
- C:\Windows\System\nHnjyBf.exe
  C:\Windows\System\nHnjyBf.exe
  2⤵
  PID:2712
- C:\Windows\System\SslNrqQ.exe
  C:\Windows\System\SslNrqQ.exe
  2⤵
  PID:2108
- C:\Windows\System\OBvTsLL.exe
  C:\Windows\System\OBvTsLL.exe
  2⤵
  PID:2332
- C:\Windows\System\ykblAxI.exe
  C:\Windows\System\ykblAxI.exe
  2⤵
  PID:1744
- C:\Windows\System\hgNxrAY.exe
  C:\Windows\System\hgNxrAY.exe
  2⤵
  PID:3044
- C:\Windows\System\JTtnpmE.exe
  C:\Windows\System\JTtnpmE.exe
  2⤵
  PID:1724
- C:\Windows\System\DdCfTJL.exe
  C:\Windows\System\DdCfTJL.exe
  2⤵
  PID:1856
- C:\Windows\System\jqheLgC.exe
  C:\Windows\System\jqheLgC.exe
  2⤵
  PID:2912
- C:\Windows\System\VDVHLrk.exe
  C:\Windows\System\VDVHLrk.exe
  2⤵
  PID:2136
- C:\Windows\System\HWQtYSO.exe
  C:\Windows\System\HWQtYSO.exe
  2⤵
  PID:892
- C:\Windows\System\owZOYfV.exe
  C:\Windows\System\owZOYfV.exe
  2⤵
  PID:1816
- C:\Windows\System\MApchEz.exe
  C:\Windows\System\MApchEz.exe
  2⤵
  PID:2668
- C:\Windows\System\EaVPBHI.exe
  C:\Windows\System\EaVPBHI.exe
  2⤵
  PID:2632
- C:\Windows\System\sWjTceR.exe
  C:\Windows\System\sWjTceR.exe
  2⤵
  PID:2720
- C:\Windows\System\waWlIGL.exe
  C:\Windows\System\waWlIGL.exe
  2⤵
  PID:1500
- C:\Windows\System\eqkVsaq.exe
  C:\Windows\System\eqkVsaq.exe
  2⤵
  PID:2864
- C:\Windows\System\lHVYHrp.exe
  C:\Windows\System\lHVYHrp.exe
  2⤵
  PID:2752
- C:\Windows\System\ZmQcjQy.exe
  C:\Windows\System\ZmQcjQy.exe
  2⤵
  PID:1192
- C:\Windows\System\ieKSsSt.exe
  C:\Windows\System\ieKSsSt.exe
  2⤵
  PID:2868
- C:\Windows\System\ZAIXeTR.exe
  C:\Windows\System\ZAIXeTR.exe
  2⤵
  PID:2052
- C:\Windows\System\eOshMuu.exe
  C:\Windows\System\eOshMuu.exe
  2⤵
  PID:1988
- C:\Windows\System\sBDYoss.exe
  C:\Windows\System\sBDYoss.exe
  2⤵
  PID:1296
- C:\Windows\System\mwGuXbe.exe
  C:\Windows\System\mwGuXbe.exe
  2⤵
  PID:1584
- C:\Windows\System\bMrUIpp.exe
  C:\Windows\System\bMrUIpp.exe
  2⤵
  PID:3064
- C:\Windows\System\qDnJIXz.exe
  C:\Windows\System\qDnJIXz.exe
  2⤵
  PID:376
- C:\Windows\System\xmWgbKm.exe
  C:\Windows\System\xmWgbKm.exe
  2⤵
  PID:820
- C:\Windows\System\jHOOoxv.exe
  C:\Windows\System\jHOOoxv.exe
  2⤵
  PID:352
- C:\Windows\System\taOJmIM.exe
  C:\Windows\System\taOJmIM.exe
  2⤵
  PID:872
- C:\Windows\System\shOiyUf.exe
  C:\Windows\System\shOiyUf.exe
  2⤵
  PID:2572
- C:\Windows\System\jbYrFqQ.exe
  C:\Windows\System\jbYrFqQ.exe
  2⤵
  PID:1552
- C:\Windows\System\gpkHNnh.exe
  C:\Windows\System\gpkHNnh.exe
  2⤵
  PID:2584
- C:\Windows\System\NkQhTGA.exe
  C:\Windows\System\NkQhTGA.exe
  2⤵
  PID:1884
- C:\Windows\System\jvbxccM.exe
  C:\Windows\System\jvbxccM.exe
  2⤵
  PID:1672
- C:\Windows\System\KqUgShG.exe
  C:\Windows\System\KqUgShG.exe
  2⤵
  PID:2412
- C:\Windows\System\OyQnEMU.exe
  C:\Windows\System\OyQnEMU.exe
  2⤵
  PID:1600
- C:\Windows\System\BlrecUJ.exe
  C:\Windows\System\BlrecUJ.exe
  2⤵
  PID:1036
- C:\Windows\System\AFuJQuz.exe
  C:\Windows\System\AFuJQuz.exe
  2⤵
  PID:1408
- C:\Windows\System\YyRRHdq.exe
  C:\Windows\System\YyRRHdq.exe
  2⤵
  PID:2168
- C:\Windows\System\NsiNWPQ.exe
  C:\Windows\System\NsiNWPQ.exe
  2⤵
  PID:1844
- C:\Windows\System\rMlnIVL.exe
  C:\Windows\System\rMlnIVL.exe
  2⤵
  PID:1932
- C:\Windows\System\vZXzciL.exe
  C:\Windows\System\vZXzciL.exe
  2⤵
  PID:2592
- C:\Windows\System\aKycKQL.exe
  C:\Windows\System\aKycKQL.exe
  2⤵
  PID:3080
- C:\Windows\System\TIxWZJj.exe
  C:\Windows\System\TIxWZJj.exe
  2⤵
  PID:3096
- C:\Windows\System\ilJTlQz.exe
  C:\Windows\System\ilJTlQz.exe
  2⤵
  PID:3112
- C:\Windows\System\LHhoNlr.exe
  C:\Windows\System\LHhoNlr.exe
  2⤵
  PID:3128
- C:\Windows\System\CUAaslI.exe
  C:\Windows\System\CUAaslI.exe
  2⤵
  PID:3144
- C:\Windows\System\iJBNTuR.exe
  C:\Windows\System\iJBNTuR.exe
  2⤵
  PID:3164
- C:\Windows\System\rSzvNQn.exe
  C:\Windows\System\rSzvNQn.exe
  2⤵
  PID:3180
- C:\Windows\System\LnNsvNs.exe
  C:\Windows\System\LnNsvNs.exe
  2⤵
  PID:3196
- C:\Windows\System\QvPAJWV.exe
  C:\Windows\System\QvPAJWV.exe
  2⤵
  PID:3248
- C:\Windows\System\mNwsgsx.exe
  C:\Windows\System\mNwsgsx.exe
  2⤵
  PID:3268
- C:\Windows\System\FElbmBF.exe
  C:\Windows\System\FElbmBF.exe
  2⤵
  PID:3284
- C:\Windows\System\tYsShAj.exe
  C:\Windows\System\tYsShAj.exe
  2⤵
  PID:3300
- C:\Windows\System\ciBTDkH.exe
  C:\Windows\System\ciBTDkH.exe
  2⤵
  PID:3316
- C:\Windows\System\zTqJpnA.exe
  C:\Windows\System\zTqJpnA.exe
  2⤵
  PID:3332
- C:\Windows\System\hOQaiyt.exe
  C:\Windows\System\hOQaiyt.exe
  2⤵
  PID:3352
- C:\Windows\System\rktnUMl.exe
  C:\Windows\System\rktnUMl.exe
  2⤵
  PID:3368
- C:\Windows\System\PAalctM.exe
  C:\Windows\System\PAalctM.exe
  2⤵
  PID:3384
- C:\Windows\System\HjMuOzN.exe
  C:\Windows\System\HjMuOzN.exe
  2⤵
  PID:3400
- C:\Windows\System\WbYwvEg.exe
  C:\Windows\System\WbYwvEg.exe
  2⤵
  PID:3420
- C:\Windows\System\esByBXH.exe
  C:\Windows\System\esByBXH.exe
  2⤵
  PID:3436
- C:\Windows\System\EYZkUHm.exe
  C:\Windows\System\EYZkUHm.exe
  2⤵
  PID:3452
- C:\Windows\System\XXtsOCi.exe
  C:\Windows\System\XXtsOCi.exe
  2⤵
  PID:3472
- C:\Windows\System\NKunsvy.exe
  C:\Windows\System\NKunsvy.exe
  2⤵
  PID:3488
- C:\Windows\System\xUVugPY.exe
  C:\Windows\System\xUVugPY.exe
  2⤵
  PID:3504
- C:\Windows\System\lauZliP.exe
  C:\Windows\System\lauZliP.exe
  2⤵
  PID:3520
- C:\Windows\System\ywQEQps.exe
  C:\Windows\System\ywQEQps.exe
  2⤵
  PID:3536
- C:\Windows\System\jfNsjLw.exe
  C:\Windows\System\jfNsjLw.exe
  2⤵
  PID:3556
- C:\Windows\System\qyNeMWM.exe
  C:\Windows\System\qyNeMWM.exe
  2⤵
  PID:3572
- C:\Windows\System\BbXXYHf.exe
  C:\Windows\System\BbXXYHf.exe
  2⤵
  PID:3588
- C:\Windows\System\SfdYUKk.exe
  C:\Windows\System\SfdYUKk.exe
  2⤵
  PID:3604
- C:\Windows\System\SwyBOYZ.exe
  C:\Windows\System\SwyBOYZ.exe
  2⤵
  PID:3624
- C:\Windows\System\uLZZUUG.exe
  C:\Windows\System\uLZZUUG.exe
  2⤵
  PID:3640
- C:\Windows\System\snakQds.exe
  C:\Windows\System\snakQds.exe
  2⤵
  PID:3656
- C:\Windows\System\PmFPAXe.exe
  C:\Windows\System\PmFPAXe.exe
  2⤵
  PID:3672
- C:\Windows\System\DmbqVbO.exe
  C:\Windows\System\DmbqVbO.exe
  2⤵
  PID:3692
- C:\Windows\System\fLSyugw.exe
  C:\Windows\System\fLSyugw.exe
  2⤵
  PID:3708
- C:\Windows\System\EUsSPIG.exe
  C:\Windows\System\EUsSPIG.exe
  2⤵
  PID:3724
- C:\Windows\System\EzYUCCe.exe
  C:\Windows\System\EzYUCCe.exe
  2⤵
  PID:3740
- C:\Windows\System\lmbNMqt.exe
  C:\Windows\System\lmbNMqt.exe
  2⤵
  PID:3756
- C:\Windows\System\BJwZDsU.exe
  C:\Windows\System\BJwZDsU.exe
  2⤵
  PID:3776
- C:\Windows\System\vMxfFPI.exe
  C:\Windows\System\vMxfFPI.exe
  2⤵
  PID:3792
- C:\Windows\System\PbjHFZe.exe
  C:\Windows\System\PbjHFZe.exe
  2⤵
  PID:3812
- C:\Windows\System\mjoooZP.exe
  C:\Windows\System\mjoooZP.exe
  2⤵
  PID:3832
- C:\Windows\System\VudWLNQ.exe
  C:\Windows\System\VudWLNQ.exe
  2⤵
  PID:3848
- C:\Windows\System\UfLYuSW.exe
  C:\Windows\System\UfLYuSW.exe
  2⤵
  PID:3868
- C:\Windows\System\FnlDYjb.exe
  C:\Windows\System\FnlDYjb.exe
  2⤵
  PID:3884
- C:\Windows\System\ScgWclA.exe
  C:\Windows\System\ScgWclA.exe
  2⤵
  PID:3900
- C:\Windows\System\XTqFtBe.exe
  C:\Windows\System\XTqFtBe.exe
  2⤵
  PID:3920
- C:\Windows\System\HFcTZcM.exe
  C:\Windows\System\HFcTZcM.exe
  2⤵
  PID:3936
- C:\Windows\System\ApvZOIx.exe
  C:\Windows\System\ApvZOIx.exe
  2⤵
  PID:3952
- C:\Windows\System\VfVVNyo.exe
  C:\Windows\System\VfVVNyo.exe
  2⤵
  PID:3968
- C:\Windows\System\TETABAX.exe
  C:\Windows\System\TETABAX.exe
  2⤵
  PID:3984
- C:\Windows\System\DccvQtN.exe
  C:\Windows\System\DccvQtN.exe
  2⤵
  PID:4000
- C:\Windows\System\Nbbilmd.exe
  C:\Windows\System\Nbbilmd.exe
  2⤵
  PID:4016
- C:\Windows\System\goTzUVv.exe
  C:\Windows\System\goTzUVv.exe
  2⤵
  PID:4032
- C:\Windows\System\eycazFn.exe
  C:\Windows\System\eycazFn.exe
  2⤵
  PID:4048
- C:\Windows\System\uGWXrND.exe
  C:\Windows\System\uGWXrND.exe
  2⤵
  PID:4064
- C:\Windows\System\hwHgpqP.exe
  C:\Windows\System\hwHgpqP.exe
  2⤵
  PID:4080
- C:\Windows\System\lDiJXCT.exe
  C:\Windows\System\lDiJXCT.exe
  2⤵
  PID:856
- C:\Windows\System\sVCQXbE.exe
  C:\Windows\System\sVCQXbE.exe
  2⤵
  PID:2492
- C:\Windows\System\hYGoDRe.exe
  C:\Windows\System\hYGoDRe.exe
  2⤵
  PID:1248
- C:\Windows\System\qpGOCMO.exe
  C:\Windows\System\qpGOCMO.exe
  2⤵
  PID:3092
- C:\Windows\System\pigzTTZ.exe
  C:\Windows\System\pigzTTZ.exe
  2⤵
  PID:3156
- C:\Windows\System\GZIWNok.exe
  C:\Windows\System\GZIWNok.exe
  2⤵
  PID:2032
- C:\Windows\System\zQaUrQI.exe
  C:\Windows\System\zQaUrQI.exe
  2⤵
  PID:408
- C:\Windows\System\DnYNDPx.exe
  C:\Windows\System\DnYNDPx.exe
  2⤵
  PID:1840
- C:\Windows\System\SIfYzCy.exe
  C:\Windows\System\SIfYzCy.exe
  2⤵
  PID:2420
- C:\Windows\System\wxFkazn.exe
  C:\Windows\System\wxFkazn.exe
  2⤵
  PID:3136
- C:\Windows\System\dWeZaEf.exe
  C:\Windows\System\dWeZaEf.exe
  2⤵
  PID:3204
- C:\Windows\System\HaCyCgf.exe
  C:\Windows\System\HaCyCgf.exe
  2⤵
  PID:3224
- C:\Windows\System\swamodQ.exe
  C:\Windows\System\swamodQ.exe
  2⤵
  PID:3208
- C:\Windows\System\fFqSgFg.exe
  C:\Windows\System\fFqSgFg.exe
  2⤵
  PID:3264
- C:\Windows\System\QfLmGgZ.exe
  C:\Windows\System\QfLmGgZ.exe
  2⤵
  PID:3328
- C:\Windows\System\RmqxFso.exe
  C:\Windows\System\RmqxFso.exe
  2⤵
  PID:3364
- C:\Windows\System\UrqYMve.exe
  C:\Windows\System\UrqYMve.exe
  2⤵
  PID:3464
- C:\Windows\System\LatinmS.exe
  C:\Windows\System\LatinmS.exe
  2⤵
  PID:3568
- C:\Windows\System\AKptHkq.exe
  C:\Windows\System\AKptHkq.exe
  2⤵
  PID:3564
- C:\Windows\System\gAgAlje.exe
  C:\Windows\System\gAgAlje.exe
  2⤵
  PID:3276
- C:\Windows\System\TeDxTDk.exe
  C:\Windows\System\TeDxTDk.exe
  2⤵
  PID:3340
- C:\Windows\System\zbGjCeW.exe
  C:\Windows\System\zbGjCeW.exe
  2⤵
  PID:3380
- C:\Windows\System\FbXBHZK.exe
  C:\Windows\System\FbXBHZK.exe
  2⤵
  PID:3448
- C:\Windows\System\gTHntgw.exe
  C:\Windows\System\gTHntgw.exe
  2⤵
  PID:3800
- C:\Windows\System\bWGePhs.exe
  C:\Windows\System\bWGePhs.exe
  2⤵
  PID:3764
- C:\Windows\System\sftBxYb.exe
  C:\Windows\System\sftBxYb.exe
  2⤵
  PID:3552
- C:\Windows\System\LorATON.exe
  C:\Windows\System\LorATON.exe
  2⤵
  PID:3612
- C:\Windows\System\daywnTB.exe
  C:\Windows\System\daywnTB.exe
  2⤵
  PID:3680
- C:\Windows\System\uZpITKH.exe
  C:\Windows\System\uZpITKH.exe
  2⤵
  PID:3720
- C:\Windows\System\xIJBNfj.exe
  C:\Windows\System\xIJBNfj.exe
  2⤵
  PID:3804
- C:\Windows\System\OxUfEBF.exe
  C:\Windows\System\OxUfEBF.exe
  2⤵
  PID:3824
- C:\Windows\System\gioEJzt.exe
  C:\Windows\System\gioEJzt.exe
  2⤵
  PID:3892
- C:\Windows\System\HRWqqSq.exe
  C:\Windows\System\HRWqqSq.exe
  2⤵
  PID:3876
- C:\Windows\System\sZxUWfr.exe
  C:\Windows\System\sZxUWfr.exe
  2⤵
  PID:3916
- C:\Windows\System\HyjjSmb.exe
  C:\Windows\System\HyjjSmb.exe
  2⤵
  PID:4008
- C:\Windows\System\NuhYGHw.exe
  C:\Windows\System\NuhYGHw.exe
  2⤵
  PID:3828
- C:\Windows\System\TjnBPvb.exe
  C:\Windows\System\TjnBPvb.exe
  2⤵
  PID:4076
- C:\Windows\System\oLsAwWe.exe
  C:\Windows\System\oLsAwWe.exe
  2⤵
  PID:3088
- C:\Windows\System\BqRmbPA.exe
  C:\Windows\System\BqRmbPA.exe
  2⤵
  PID:1516
- C:\Windows\System\AnrQHJM.exe
  C:\Windows\System\AnrQHJM.exe
  2⤵
  PID:3220
- C:\Windows\System\DigABIN.exe
  C:\Windows\System\DigABIN.exe
  2⤵
  PID:3496
- C:\Windows\System\glhLNjX.exe
  C:\Windows\System\glhLNjX.exe
  2⤵
  PID:3636
- C:\Windows\System\VNfNYcb.exe
  C:\Windows\System\VNfNYcb.exe
  2⤵
  PID:3512
- C:\Windows\System\ltbWOEX.exe
  C:\Windows\System\ltbWOEX.exe
  2⤵
  PID:4024
- C:\Windows\System\YbSvVqk.exe
  C:\Windows\System\YbSvVqk.exe
  2⤵
  PID:4088
- C:\Windows\System\yZdlKOg.exe
  C:\Windows\System\yZdlKOg.exe
  2⤵
  PID:3152
- C:\Windows\System\BLCkgIO.exe
  C:\Windows\System\BLCkgIO.exe
  2⤵
  PID:1604
- C:\Windows\System\NMypqtI.exe
  C:\Windows\System\NMypqtI.exe
  2⤵
  PID:3236
- C:\Windows\System\YiSyCDT.exe
  C:\Windows\System\YiSyCDT.exe
  2⤵
  PID:3964
- C:\Windows\System\FoqZUuF.exe
  C:\Windows\System\FoqZUuF.exe
  2⤵
  PID:3308
- C:\Windows\System\hYGocEJ.exe
  C:\Windows\System\hYGocEJ.exe
  2⤵
  PID:3652
- C:\Windows\System\XKEJnaW.exe
  C:\Windows\System\XKEJnaW.exe
  2⤵
  PID:3960
- C:\Windows\System\FEpqefr.exe
  C:\Windows\System\FEpqefr.exe
  2⤵
  PID:3772
- C:\Windows\System\ONppPEq.exe
  C:\Windows\System\ONppPEq.exe
  2⤵
  PID:3788
- C:\Windows\System\RJqowOp.exe
  C:\Windows\System\RJqowOp.exe
  2⤵
  PID:4040
- C:\Windows\System\KCSsjjJ.exe
  C:\Windows\System\KCSsjjJ.exe
  2⤵
  PID:3108
- C:\Windows\System\mcDxuNA.exe
  C:\Windows\System\mcDxuNA.exe
  2⤵
  PID:3992
- C:\Windows\System\qfKNdbf.exe
  C:\Windows\System\qfKNdbf.exe
  2⤵
  PID:3124
- C:\Windows\System\UsHjvma.exe
  C:\Windows\System\UsHjvma.exe
  2⤵
  PID:3544
- C:\Windows\System\fPfXHRH.exe
  C:\Windows\System\fPfXHRH.exe
  2⤵
  PID:3784
- C:\Windows\System\OVdrVIV.exe
  C:\Windows\System\OVdrVIV.exe
  2⤵
  PID:3948
- C:\Windows\System\iYUqGQZ.exe
  C:\Windows\System\iYUqGQZ.exe
  2⤵
  PID:4072
- C:\Windows\System\OHglRny.exe
  C:\Windows\System\OHglRny.exe
  2⤵
  PID:3460
- C:\Windows\System\mhgQBxr.exe
  C:\Windows\System\mhgQBxr.exe
  2⤵
  PID:4056
- C:\Windows\System\YRoveSr.exe
  C:\Windows\System\YRoveSr.exe
  2⤵
  PID:3432
- C:\Windows\System\TfKRccc.exe
  C:\Windows\System\TfKRccc.exe
  2⤵
  PID:3620
- C:\Windows\System\nZiGfqO.exe
  C:\Windows\System\nZiGfqO.exe
  2⤵
  PID:3820
- C:\Windows\System\bXSEfIr.exe
  C:\Windows\System\bXSEfIr.exe
  2⤵
  PID:3908
- C:\Windows\System\HOQYlfr.exe
  C:\Windows\System\HOQYlfr.exe
  2⤵
  PID:4112
- C:\Windows\System\soAxBmF.exe
  C:\Windows\System\soAxBmF.exe
  2⤵
  PID:4128
- C:\Windows\System\zsyyOQc.exe
  C:\Windows\System\zsyyOQc.exe
  2⤵
  PID:4144
- C:\Windows\System\tuCHwrk.exe
  C:\Windows\System\tuCHwrk.exe
  2⤵
  PID:4160
- C:\Windows\System\WuXstuy.exe
  C:\Windows\System\WuXstuy.exe
  2⤵
  PID:4176
- C:\Windows\System\GkZyaMB.exe
  C:\Windows\System\GkZyaMB.exe
  2⤵
  PID:4192
- C:\Windows\System\pjXobvq.exe
  C:\Windows\System\pjXobvq.exe
  2⤵
  PID:4208
- C:\Windows\System\nxolDkD.exe
  C:\Windows\System\nxolDkD.exe
  2⤵
  PID:4224
- C:\Windows\System\AYiDwAg.exe
  C:\Windows\System\AYiDwAg.exe
  2⤵
  PID:4240
- C:\Windows\System\NruBttQ.exe
  C:\Windows\System\NruBttQ.exe
  2⤵
  PID:4260
- C:\Windows\System\jxRWgNf.exe
  C:\Windows\System\jxRWgNf.exe
  2⤵
  PID:4276
- C:\Windows\System\uqPDiYE.exe
  C:\Windows\System\uqPDiYE.exe
  2⤵
  PID:4292
- C:\Windows\System\hZiaSWA.exe
  C:\Windows\System\hZiaSWA.exe
  2⤵
  PID:4308
- C:\Windows\System\kGfUSvY.exe
  C:\Windows\System\kGfUSvY.exe
  2⤵
  PID:4324
- C:\Windows\System\eBbPTVB.exe
  C:\Windows\System\eBbPTVB.exe
  2⤵
  PID:4340
- C:\Windows\System\YysBWyP.exe
  C:\Windows\System\YysBWyP.exe
  2⤵
  PID:4380
- C:\Windows\System\ubiCSbK.exe
  C:\Windows\System\ubiCSbK.exe
  2⤵
  PID:4396
- C:\Windows\System\ZZynXqU.exe
  C:\Windows\System\ZZynXqU.exe
  2⤵
  PID:4412
- C:\Windows\System\CYPbrku.exe
  C:\Windows\System\CYPbrku.exe
  2⤵
  PID:4428
- C:\Windows\System\LFOckmH.exe
  C:\Windows\System\LFOckmH.exe
  2⤵
  PID:4444
- C:\Windows\System\ZsHxDXh.exe
  C:\Windows\System\ZsHxDXh.exe
  2⤵
  PID:4464
- C:\Windows\System\nYRPCda.exe
  C:\Windows\System\nYRPCda.exe
  2⤵
  PID:4480
- C:\Windows\System\fETcRDg.exe
  C:\Windows\System\fETcRDg.exe
  2⤵
  PID:4496
- C:\Windows\System\ueAOhDa.exe
  C:\Windows\System\ueAOhDa.exe
  2⤵
  PID:4512
- C:\Windows\System\usArMMS.exe
  C:\Windows\System\usArMMS.exe
  2⤵
  PID:4528
- C:\Windows\System\OUADeQW.exe
  C:\Windows\System\OUADeQW.exe
  2⤵
  PID:4548
- C:\Windows\System\kBDUNTt.exe
  C:\Windows\System\kBDUNTt.exe
  2⤵
  PID:4564
- C:\Windows\System\YbmRxjz.exe
  C:\Windows\System\YbmRxjz.exe
  2⤵
  PID:4580
- C:\Windows\System\EGxhtSH.exe
  C:\Windows\System\EGxhtSH.exe
  2⤵
  PID:4596
- C:\Windows\System\FFOhSzs.exe
  C:\Windows\System\FFOhSzs.exe
  2⤵
  PID:4616
- C:\Windows\System\WxurrVz.exe
  C:\Windows\System\WxurrVz.exe
  2⤵
  PID:4632
- C:\Windows\System\kiVCWbi.exe
  C:\Windows\System\kiVCWbi.exe
  2⤵
  PID:4648
- C:\Windows\System\RrtYJFs.exe
  C:\Windows\System\RrtYJFs.exe
  2⤵
  PID:4664
- C:\Windows\System\ZtpggRu.exe
  C:\Windows\System\ZtpggRu.exe
  2⤵
  PID:4680
- C:\Windows\System\tKEWOkj.exe
  C:\Windows\System\tKEWOkj.exe
  2⤵
  PID:4696
- C:\Windows\System\mkEQGvf.exe
  C:\Windows\System\mkEQGvf.exe
  2⤵
  PID:4712
- C:\Windows\System\EWQzwjt.exe
  C:\Windows\System\EWQzwjt.exe
  2⤵
  PID:4728
- C:\Windows\System\KhTmhGE.exe
  C:\Windows\System\KhTmhGE.exe
  2⤵
  PID:4744
- C:\Windows\System\AyBkOgR.exe
  C:\Windows\System\AyBkOgR.exe
  2⤵
  PID:4768
- C:\Windows\System\xJHWsWD.exe
  C:\Windows\System\xJHWsWD.exe
  2⤵
  PID:4784
- C:\Windows\System\aFeWcaV.exe
  C:\Windows\System\aFeWcaV.exe
  2⤵
  PID:4852
- C:\Windows\System\xUkWtVc.exe
  C:\Windows\System\xUkWtVc.exe
  2⤵
  PID:4868
- C:\Windows\System\SMUHCRi.exe
  C:\Windows\System\SMUHCRi.exe
  2⤵
  PID:4888
- C:\Windows\System\NUUKDii.exe
  C:\Windows\System\NUUKDii.exe
  2⤵
  PID:4908
- C:\Windows\System\bInEgPi.exe
  C:\Windows\System\bInEgPi.exe
  2⤵
  PID:4924
- C:\Windows\System\cGIuKfc.exe
  C:\Windows\System\cGIuKfc.exe
  2⤵
  PID:4940
- C:\Windows\System\AQXIqUB.exe
  C:\Windows\System\AQXIqUB.exe
  2⤵
  PID:4960
- C:\Windows\System\SHUFHdw.exe
  C:\Windows\System\SHUFHdw.exe
  2⤵
  PID:4976
- C:\Windows\System\ndPUaNM.exe
  C:\Windows\System\ndPUaNM.exe
  2⤵
  PID:4996
- C:\Windows\System\bGuBkNy.exe
  C:\Windows\System\bGuBkNy.exe
  2⤵
  PID:5012
- C:\Windows\System\aayDZjp.exe
  C:\Windows\System\aayDZjp.exe
  2⤵
  PID:5028
- C:\Windows\System\aGPGULZ.exe
  C:\Windows\System\aGPGULZ.exe
  2⤵
  PID:5044
- C:\Windows\System\RDTVAhB.exe
  C:\Windows\System\RDTVAhB.exe
  2⤵
  PID:5064
- C:\Windows\System\YoxjHSl.exe
  C:\Windows\System\YoxjHSl.exe
  2⤵
  PID:5080
- C:\Windows\System\zLEHBbA.exe
  C:\Windows\System\zLEHBbA.exe
  2⤵
  PID:5096
- C:\Windows\System\MPbGaPL.exe
  C:\Windows\System\MPbGaPL.exe
  2⤵
  PID:5116
- C:\Windows\System\UjppZaa.exe
  C:\Windows\System\UjppZaa.exe
  2⤵
  PID:3232
- C:\Windows\System\oBqzVzp.exe
  C:\Windows\System\oBqzVzp.exe
  2⤵
  PID:2884
- C:\Windows\System\BCzAQtb.exe
  C:\Windows\System\BCzAQtb.exe
  2⤵
  PID:3844
- C:\Windows\System\AyzBoab.exe
  C:\Windows\System\AyzBoab.exe
  2⤵
  PID:3348
- C:\Windows\System\sNdesDD.exe
  C:\Windows\System\sNdesDD.exe
  2⤵
  PID:3324
- C:\Windows\System\WOolLQD.exe
  C:\Windows\System\WOolLQD.exe
  2⤵
  PID:4248
- C:\Windows\System\LiMMDgr.exe
  C:\Windows\System\LiMMDgr.exe
  2⤵
  PID:4284
- C:\Windows\System\HhXBBzv.exe
  C:\Windows\System\HhXBBzv.exe
  2⤵
  PID:4252
- C:\Windows\System\ADUkYHW.exe
  C:\Windows\System\ADUkYHW.exe
  2⤵
  PID:4232
- C:\Windows\System\TSToNSQ.exe
  C:\Windows\System\TSToNSQ.exe
  2⤵
  PID:4336
- C:\Windows\System\PAMTvze.exe
  C:\Windows\System\PAMTvze.exe
  2⤵
  PID:4204
- C:\Windows\System\McWOtof.exe
  C:\Windows\System\McWOtof.exe
  2⤵
  PID:2500
- C:\Windows\System\NXGkCDj.exe
  C:\Windows\System\NXGkCDj.exe
  2⤵
  PID:3716
- C:\Windows\System\PgKebUK.exe
  C:\Windows\System\PgKebUK.exe
  2⤵
  PID:4372
- C:\Windows\System\eaerkcO.exe
  C:\Windows\System\eaerkcO.exe
  2⤵
  PID:4436
- C:\Windows\System\ntSmWPi.exe
  C:\Windows\System\ntSmWPi.exe
  2⤵
  PID:4504
- C:\Windows\System\kkDyiDO.exe
  C:\Windows\System\kkDyiDO.exe
  2⤵
  PID:4544
- C:\Windows\System\dglsaTg.exe
  C:\Windows\System\dglsaTg.exe
  2⤵
  PID:4608
- C:\Windows\System\WoHgIpl.exe
  C:\Windows\System\WoHgIpl.exe
  2⤵
  PID:4168
- C:\Windows\System\BCuIiqh.exe
  C:\Windows\System\BCuIiqh.exe
  2⤵
  PID:4672
- C:\Windows\System\jOsfoai.exe
  C:\Windows\System\jOsfoai.exe
  2⤵
  PID:4736
- C:\Windows\System\tTmInvU.exe
  C:\Windows\System\tTmInvU.exe
  2⤵
  PID:4388
- C:\Windows\System\WDnaanZ.exe
  C:\Windows\System\WDnaanZ.exe
  2⤵
  PID:4456
- C:\Windows\System\oxIZSMC.exe
  C:\Windows\System\oxIZSMC.exe
  2⤵
  PID:4520
- C:\Windows\System\MRLFiOC.exe
  C:\Windows\System\MRLFiOC.exe
  2⤵
  PID:4588
- C:\Windows\System\MedXMvD.exe
  C:\Windows\System\MedXMvD.exe
  2⤵
  PID:4656
- C:\Windows\System\LydvtjB.exe
  C:\Windows\System\LydvtjB.exe
  2⤵
  PID:4720
- C:\Windows\System\ADWgrNg.exe
  C:\Windows\System\ADWgrNg.exe
  2⤵
  PID:4764
- C:\Windows\System\VBiXCWq.exe
  C:\Windows\System\VBiXCWq.exe
  2⤵
  PID:4724
- C:\Windows\System\NBfigFM.exe
  C:\Windows\System\NBfigFM.exe
  2⤵
  PID:4820
- C:\Windows\System\xmmQXBp.exe
  C:\Windows\System\xmmQXBp.exe
  2⤵
  PID:4836
- C:\Windows\System\XjCXVLa.exe
  C:\Windows\System\XjCXVLa.exe
  2⤵
  PID:4900
- C:\Windows\System\WloNKGg.exe
  C:\Windows\System\WloNKGg.exe
  2⤵
  PID:4932
- C:\Windows\System\NnqKPCa.exe
  C:\Windows\System\NnqKPCa.exe
  2⤵
  PID:5004
- C:\Windows\System\FmuPDQU.exe
  C:\Windows\System\FmuPDQU.exe
  2⤵
  PID:4884
- C:\Windows\System\RbbtEYe.exe
  C:\Windows\System\RbbtEYe.exe
  2⤵
  PID:4920
- C:\Windows\System\bOPXcga.exe
  C:\Windows\System\bOPXcga.exe
  2⤵
  PID:4992
- C:\Windows\System\eugjXCw.exe
  C:\Windows\System\eugjXCw.exe
  2⤵
  PID:5020
- C:\Windows\System\HXvUJNs.exe
  C:\Windows\System\HXvUJNs.exe
  2⤵
  PID:4848
- C:\Windows\System\WwTKQiX.exe
  C:\Windows\System\WwTKQiX.exe
  2⤵
  PID:4988
- C:\Windows\System\qZMNNSL.exe
  C:\Windows\System\qZMNNSL.exe
  2⤵
  PID:2408
- C:\Windows\System\rHKTsNe.exe
  C:\Windows\System\rHKTsNe.exe
  2⤵
  PID:4348
- C:\Windows\System\lLzzQAw.exe
  C:\Windows\System\lLzzQAw.exe
  2⤵
  PID:3532
- C:\Windows\System\nPnxNKe.exe
  C:\Windows\System\nPnxNKe.exe
  2⤵
  PID:4332
- C:\Windows\System\gRyBnOu.exe
  C:\Windows\System\gRyBnOu.exe
  2⤵
  PID:3444
- C:\Windows\System\KWvjPsc.exe
  C:\Windows\System\KWvjPsc.exe
  2⤵
  PID:4472
- C:\Windows\System\YRdHfdH.exe
  C:\Windows\System\YRdHfdH.exe
  2⤵
  PID:4156
- C:\Windows\System\ZREUgjC.exe
  C:\Windows\System\ZREUgjC.exe
  2⤵
  PID:4288
- C:\Windows\System\UczwJAE.exe
  C:\Windows\System\UczwJAE.exe
  2⤵
  PID:4540
- C:\Windows\System\ZbejPRh.exe
  C:\Windows\System\ZbejPRh.exe
  2⤵
  PID:4640
- C:\Windows\System\rxqIYhs.exe
  C:\Windows\System\rxqIYhs.exe
  2⤵
  PID:4104
- C:\Windows\System\OLFYIsk.exe
  C:\Windows\System\OLFYIsk.exe
  2⤵
  PID:4628
- C:\Windows\System\IFaJpDv.exe
  C:\Windows\System\IFaJpDv.exe
  2⤵
  PID:4708
- C:\Windows\System\uSfiijl.exe
  C:\Windows\System\uSfiijl.exe
  2⤵
  PID:4760
- C:\Windows\System\YIHUbQd.exe
  C:\Windows\System\YIHUbQd.exe
  2⤵
  PID:4556
- C:\Windows\System\kIcMpPN.exe
  C:\Windows\System\kIcMpPN.exe
  2⤵
  PID:4808
- C:\Windows\System\ZIqFLeI.exe
  C:\Windows\System\ZIqFLeI.exe
  2⤵
  PID:4972
- C:\Windows\System\JXWFAmD.exe
  C:\Windows\System\JXWFAmD.exe
  2⤵
  PID:4916
- C:\Windows\System\GYxMIvD.exe
  C:\Windows\System\GYxMIvD.exe
  2⤵
  PID:4956
- C:\Windows\System\gxftBtx.exe
  C:\Windows\System\gxftBtx.exe
  2⤵
  PID:5108
- C:\Windows\System\eClepvf.exe
  C:\Windows\System\eClepvf.exe
  2⤵
  PID:5076
- C:\Windows\System\myYEibW.exe
  C:\Windows\System\myYEibW.exe
  2⤵
  PID:5060
- C:\Windows\System\oRoXzab.exe
  C:\Windows\System\oRoXzab.exe
  2⤵
  PID:4368
- C:\Windows\System\EFrcXbG.exe
  C:\Windows\System\EFrcXbG.exe
  2⤵
  PID:4604
- C:\Windows\System\GXhCWvh.exe
  C:\Windows\System\GXhCWvh.exe
  2⤵
  PID:4756
- C:\Windows\System\wdPovTd.exe
  C:\Windows\System\wdPovTd.exe
  2⤵
  PID:4780
- C:\Windows\System\YZbuCpX.exe
  C:\Windows\System\YZbuCpX.exe
  2⤵
  PID:4304
- C:\Windows\System\ImSCkXo.exe
  C:\Windows\System\ImSCkXo.exe
  2⤵
  PID:4776
- C:\Windows\System\FRslPRo.exe
  C:\Windows\System\FRslPRo.exe
  2⤵
  PID:4692
- C:\Windows\System\EiGbnCQ.exe
  C:\Windows\System\EiGbnCQ.exe
  2⤵
  PID:4864
- C:\Windows\System\VRMGKnk.exe
  C:\Windows\System\VRMGKnk.exe
  2⤵
  PID:4320
- C:\Windows\System\XFkwOqh.exe
  C:\Windows\System\XFkwOqh.exe
  2⤵
  PID:4968
- C:\Windows\System\NJxiMdh.exe
  C:\Windows\System\NJxiMdh.exe
  2⤵
  PID:4268
- C:\Windows\System\ggNcJHi.exe
  C:\Windows\System\ggNcJHi.exe
  2⤵
  PID:5112
- C:\Windows\System\TKOyZJa.exe
  C:\Windows\System\TKOyZJa.exe
  2⤵
  PID:3484
- C:\Windows\System\dVtVeiy.exe
  C:\Windows\System\dVtVeiy.exe
  2⤵
  PID:4880
- C:\Windows\System\lwjZzgv.exe
  C:\Windows\System\lwjZzgv.exe
  2⤵
  PID:4624
- C:\Windows\System\cVMBOEN.exe
  C:\Windows\System\cVMBOEN.exe
  2⤵
  PID:4152
- C:\Windows\System\ZNUyhir.exe
  C:\Windows\System\ZNUyhir.exe
  2⤵
  PID:4124
- C:\Windows\System\eptpqKU.exe
  C:\Windows\System\eptpqKU.exe
  2⤵
  PID:5136
- C:\Windows\System\YCsfdFj.exe
  C:\Windows\System\YCsfdFj.exe
  2⤵
  PID:5156
- C:\Windows\System\iwvziFG.exe
  C:\Windows\System\iwvziFG.exe
  2⤵
  PID:5172
- C:\Windows\System\NQaMelM.exe
  C:\Windows\System\NQaMelM.exe
  2⤵
  PID:5188
- C:\Windows\System\VYcunRK.exe
  C:\Windows\System\VYcunRK.exe
  2⤵
  PID:5208
- C:\Windows\System\rjlNFHd.exe
  C:\Windows\System\rjlNFHd.exe
  2⤵
  PID:5228
- C:\Windows\System\hhliSPX.exe
  C:\Windows\System\hhliSPX.exe
  2⤵
  PID:5244
- C:\Windows\System\TAXQBHW.exe
  C:\Windows\System\TAXQBHW.exe
  2⤵
  PID:5260
- C:\Windows\System\otsmCJk.exe
  C:\Windows\System\otsmCJk.exe
  2⤵
  PID:5276
- C:\Windows\System\CwsrUdV.exe
  C:\Windows\System\CwsrUdV.exe
  2⤵
  PID:5292
- C:\Windows\System\BmyDZZi.exe
  C:\Windows\System\BmyDZZi.exe
  2⤵
  PID:5308
- C:\Windows\System\MRfRBNW.exe
  C:\Windows\System\MRfRBNW.exe
  2⤵
  PID:5340
- C:\Windows\System\GnuFqNZ.exe
  C:\Windows\System\GnuFqNZ.exe
  2⤵
  PID:5356
- C:\Windows\System\rtEateM.exe
  C:\Windows\System\rtEateM.exe
  2⤵
  PID:5372
- C:\Windows\System\OntUwAQ.exe
  C:\Windows\System\OntUwAQ.exe
  2⤵
  PID:5388
- C:\Windows\System\MYLQJpC.exe
  C:\Windows\System\MYLQJpC.exe
  2⤵
  PID:5404
- C:\Windows\System\nlhmLtk.exe
  C:\Windows\System\nlhmLtk.exe
  2⤵
  PID:5420
- C:\Windows\System\ZLwMKqJ.exe
  C:\Windows\System\ZLwMKqJ.exe
  2⤵
  PID:5436
- C:\Windows\System\KseWjJC.exe
  C:\Windows\System\KseWjJC.exe
  2⤵
  PID:5452
- C:\Windows\System\WECvnBV.exe
  C:\Windows\System\WECvnBV.exe
  2⤵
  PID:5468
- C:\Windows\System\XuHWbqd.exe
  C:\Windows\System\XuHWbqd.exe
  2⤵
  PID:5484
- C:\Windows\System\viweOCV.exe
  C:\Windows\System\viweOCV.exe
  2⤵
  PID:5500
- C:\Windows\System\OYqguEP.exe
  C:\Windows\System\OYqguEP.exe
  2⤵
  PID:5520
- C:\Windows\System\yUrManK.exe
  C:\Windows\System\yUrManK.exe
  2⤵
  PID:5556
- C:\Windows\System\LiAYvAm.exe
  C:\Windows\System\LiAYvAm.exe
  2⤵
  PID:5572
- C:\Windows\System\DzrIyWI.exe
  C:\Windows\System\DzrIyWI.exe
  2⤵
  PID:5588
- C:\Windows\System\qUwCHPo.exe
  C:\Windows\System\qUwCHPo.exe
  2⤵
  PID:5604
- C:\Windows\System\cJHnPwo.exe
  C:\Windows\System\cJHnPwo.exe
  2⤵
  PID:5624
- C:\Windows\System\kByWPXy.exe
  C:\Windows\System\kByWPXy.exe
  2⤵
  PID:5640
- C:\Windows\System\QDiEiyL.exe
  C:\Windows\System\QDiEiyL.exe
  2⤵
  PID:5656
- C:\Windows\System\PUXXjRz.exe
  C:\Windows\System\PUXXjRz.exe
  2⤵
  PID:5672
- C:\Windows\System\CzMuTAK.exe
  C:\Windows\System\CzMuTAK.exe
  2⤵
  PID:5688
- C:\Windows\System\AGtkNnX.exe
  C:\Windows\System\AGtkNnX.exe
  2⤵
  PID:5704
- C:\Windows\System\pdhEXFX.exe
  C:\Windows\System\pdhEXFX.exe
  2⤵
  PID:5720
- C:\Windows\System\nITUdLm.exe
  C:\Windows\System\nITUdLm.exe
  2⤵
  PID:5748
- C:\Windows\System\YYJwZAt.exe
  C:\Windows\System\YYJwZAt.exe
  2⤵
  PID:5764
- C:\Windows\System\dZMeAcM.exe
  C:\Windows\System\dZMeAcM.exe
  2⤵
  PID:5780
- C:\Windows\System\ThBziZU.exe
  C:\Windows\System\ThBziZU.exe
  2⤵
  PID:5796
- C:\Windows\System\tiXzzOu.exe
  C:\Windows\System\tiXzzOu.exe
  2⤵
  PID:5812
- C:\Windows\System\SbqNkuy.exe
  C:\Windows\System\SbqNkuy.exe
  2⤵
  PID:5828
- C:\Windows\System\lvNYVHk.exe
  C:\Windows\System\lvNYVHk.exe
  2⤵
  PID:5844
- C:\Windows\System\HIhTqOe.exe
  C:\Windows\System\HIhTqOe.exe
  2⤵
  PID:5860
- C:\Windows\System\VncKRtI.exe
  C:\Windows\System\VncKRtI.exe
  2⤵
  PID:5876
- C:\Windows\System\jHGLIbD.exe
  C:\Windows\System\jHGLIbD.exe
  2⤵
  PID:5892
- C:\Windows\System\rrSZRwK.exe
  C:\Windows\System\rrSZRwK.exe
  2⤵
  PID:5920
- C:\Windows\System\gAjyNma.exe
  C:\Windows\System\gAjyNma.exe
  2⤵
  PID:5936
- C:\Windows\System\TlYXPYR.exe
  C:\Windows\System\TlYXPYR.exe
  2⤵
  PID:5956
- C:\Windows\System\ySHHNiC.exe
  C:\Windows\System\ySHHNiC.exe
  2⤵
  PID:5972
- C:\Windows\System\xcUwxvk.exe
  C:\Windows\System\xcUwxvk.exe
  2⤵
  PID:5988
- C:\Windows\System\PzpoxzT.exe
  C:\Windows\System\PzpoxzT.exe
  2⤵
  PID:6004
- C:\Windows\System\KUSWBtu.exe
  C:\Windows\System\KUSWBtu.exe
  2⤵
  PID:6020
- C:\Windows\System\varalFm.exe
  C:\Windows\System\varalFm.exe
  2⤵
  PID:6036
- C:\Windows\System\SlmOfOh.exe
  C:\Windows\System\SlmOfOh.exe
  2⤵
  PID:6052
- C:\Windows\System\VouAokt.exe
  C:\Windows\System\VouAokt.exe
  2⤵
  PID:6068
- C:\Windows\System\rDUDlIw.exe
  C:\Windows\System\rDUDlIw.exe
  2⤵
  PID:6096
- C:\Windows\System\JPQRwHW.exe
  C:\Windows\System\JPQRwHW.exe
  2⤵
  PID:6112
- C:\Windows\System\uXDtEfO.exe
  C:\Windows\System\uXDtEfO.exe
  2⤵
  PID:6132
- C:\Windows\System\mEOOKzS.exe
  C:\Windows\System\mEOOKzS.exe
  2⤵
  PID:5128
- C:\Windows\System\GkhzgdS.exe
  C:\Windows\System\GkhzgdS.exe
  2⤵
  PID:5168
- C:\Windows\System\eokjRyK.exe
  C:\Windows\System\eokjRyK.exe
  2⤵
  PID:5236
- C:\Windows\System\QlWEKxT.exe
  C:\Windows\System\QlWEKxT.exe
  2⤵
  PID:5268
- C:\Windows\System\qXTFoXd.exe
  C:\Windows\System\qXTFoXd.exe
  2⤵
  PID:5152
- C:\Windows\System\sQXNymb.exe
  C:\Windows\System\sQXNymb.exe
  2⤵
  PID:5180
- C:\Windows\System\qzAauFB.exe
  C:\Windows\System\qzAauFB.exe
  2⤵
  PID:5252
- C:\Windows\System\CnIuoYt.exe
  C:\Windows\System\CnIuoYt.exe
  2⤵
  PID:5304
- C:\Windows\System\zRiymyr.exe
  C:\Windows\System\zRiymyr.exe
  2⤵
  PID:5320
- C:\Windows\System\dHXHqdM.exe
  C:\Windows\System\dHXHqdM.exe
  2⤵
  PID:5412
- C:\Windows\System\wFNrNQn.exe
  C:\Windows\System\wFNrNQn.exe
  2⤵
  PID:5476
- C:\Windows\System\jWRIPtb.exe
  C:\Windows\System\jWRIPtb.exe
  2⤵
  PID:5336
- C:\Windows\System\ZjtbKdM.exe
  C:\Windows\System\ZjtbKdM.exe
  2⤵
  PID:5400
- C:\Windows\System\JBsvSxx.exe
  C:\Windows\System\JBsvSxx.exe
  2⤵
  PID:5428
- C:\Windows\System\uQVHYHf.exe
  C:\Windows\System\uQVHYHf.exe
  2⤵
  PID:5464
- C:\Windows\System\bbCORZt.exe
  C:\Windows\System\bbCORZt.exe
  2⤵
  PID:5540
- C:\Windows\System\bQhGImj.exe
  C:\Windows\System\bQhGImj.exe
  2⤵
  PID:5600
- C:\Windows\System\cxpwllF.exe
  C:\Windows\System\cxpwllF.exe
  2⤵
  PID:5548
- C:\Windows\System\EsySWNm.exe
  C:\Windows\System\EsySWNm.exe
  2⤵
  PID:5584
- C:\Windows\System\irIzceO.exe
  C:\Windows\System\irIzceO.exe
  2⤵
  PID:5668
- C:\Windows\System\adxQDXf.exe
  C:\Windows\System\adxQDXf.exe
  2⤵
  PID:5728
- C:\Windows\System\YjDoKja.exe
  C:\Windows\System\YjDoKja.exe
  2⤵
  PID:5744
- C:\Windows\System\yZDwHtv.exe
  C:\Windows\System\yZDwHtv.exe
  2⤵
  PID:5804
- C:\Windows\System\cotGSCR.exe
  C:\Windows\System\cotGSCR.exe
  2⤵
  PID:5872
- C:\Windows\System\EjluzCI.exe
  C:\Windows\System\EjluzCI.exe
  2⤵
  PID:5820
- C:\Windows\System\IVkNLlP.exe
  C:\Windows\System\IVkNLlP.exe
  2⤵
  PID:5884
- C:\Windows\System\uvWGFwS.exe
  C:\Windows\System\uvWGFwS.exe
  2⤵
  PID:5760
- C:\Windows\System\MVdrmOR.exe
  C:\Windows\System\MVdrmOR.exe
  2⤵
  PID:5912
- C:\Windows\System\NYXFzqw.exe
  C:\Windows\System\NYXFzqw.exe
  2⤵
  PID:5980
- C:\Windows\System\OgBrvOg.exe
  C:\Windows\System\OgBrvOg.exe
  2⤵
  PID:6044
- C:\Windows\System\CoytyyQ.exe
  C:\Windows\System\CoytyyQ.exe
  2⤵
  PID:6000
- C:\Windows\System\MSjQYRE.exe
  C:\Windows\System\MSjQYRE.exe
  2⤵
  PID:5968
- C:\Windows\System\TvHBhlR.exe
  C:\Windows\System\TvHBhlR.exe
  2⤵
  PID:6084
- C:\Windows\System\vEaWiNO.exe
  C:\Windows\System\vEaWiNO.exe
  2⤵
  PID:6104
- C:\Windows\System\nMMZHqn.exe
  C:\Windows\System\nMMZHqn.exe
  2⤵
  PID:6128
- C:\Windows\System\kfesFoT.exe
  C:\Windows\System\kfesFoT.exe
  2⤵
  PID:5184
- C:\Windows\System\LcJCMwR.exe
  C:\Windows\System\LcJCMwR.exe
  2⤵
  PID:6140
- C:\Windows\System\XiMsgBs.exe
  C:\Windows\System\XiMsgBs.exe
  2⤵
  PID:4188
- C:\Windows\System\OhOFIfe.exe
  C:\Windows\System\OhOFIfe.exe
  2⤵
  PID:5380
- C:\Windows\System\TFzWQvW.exe
  C:\Windows\System\TFzWQvW.exe
  2⤵
  PID:5496
- C:\Windows\System\yyjevCM.exe
  C:\Windows\System\yyjevCM.exe
  2⤵
  PID:5616
- C:\Windows\System\LhmKbxV.exe
  C:\Windows\System\LhmKbxV.exe
  2⤵
  PID:5680
- C:\Windows\System\wHxhHzR.exe
  C:\Windows\System\wHxhHzR.exe
  2⤵
  PID:5364
- C:\Windows\System\yKqcPsk.exe
  C:\Windows\System\yKqcPsk.exe
  2⤵
  PID:5596
- C:\Windows\System\oYiZDUi.exe
  C:\Windows\System\oYiZDUi.exe
  2⤵
  PID:5696
- C:\Windows\System\LIXWqcl.exe
  C:\Windows\System\LIXWqcl.exe
  2⤵
  PID:5444
- C:\Windows\System\GEHKYJI.exe
  C:\Windows\System\GEHKYJI.exe
  2⤵
  PID:5856
- C:\Windows\System\afGrqLS.exe
  C:\Windows\System\afGrqLS.exe
  2⤵
  PID:5700
- C:\Windows\System\MZZomlH.exe
  C:\Windows\System\MZZomlH.exe
  2⤵
  PID:6012
- C:\Windows\System\rCZWRlu.exe
  C:\Windows\System\rCZWRlu.exe
  2⤵
  PID:6064
- C:\Windows\System\roTdOpH.exe
  C:\Windows\System\roTdOpH.exe
  2⤵
  PID:5716
- C:\Windows\System\zAMwxMQ.exe
  C:\Windows\System\zAMwxMQ.exe
  2⤵
  PID:6060
- C:\Windows\System\cBDHaCZ.exe
  C:\Windows\System\cBDHaCZ.exe
  2⤵
  PID:4408
- C:\Windows\System\sNdcBoT.exe
  C:\Windows\System\sNdcBoT.exe
  2⤵
  PID:5508
- C:\Windows\System\GjAEKDq.exe
  C:\Windows\System\GjAEKDq.exe
  2⤵
  PID:5460
- C:\Windows\System\UwmBJGE.exe
  C:\Windows\System\UwmBJGE.exe
  2⤵
  PID:5904
- C:\Windows\System\whXxlHY.exe
  C:\Windows\System\whXxlHY.exe
  2⤵
  PID:6032
- C:\Windows\System\JXUTfUf.exe
  C:\Windows\System\JXUTfUf.exe
  2⤵
  PID:5220
- C:\Windows\System\dgsURkA.exe
  C:\Windows\System\dgsURkA.exe
  2⤵
  PID:6160
- C:\Windows\System\pbWjFmL.exe
  C:\Windows\System\pbWjFmL.exe
  2⤵
  PID:6176
- C:\Windows\System\xaCXmMv.exe
  C:\Windows\System\xaCXmMv.exe
  2⤵
  PID:6192
- C:\Windows\System\YFnVBlj.exe
  C:\Windows\System\YFnVBlj.exe
  2⤵
  PID:6208
- C:\Windows\System\qZuMzIN.exe
  C:\Windows\System\qZuMzIN.exe
  2⤵
  PID:6224
- C:\Windows\System\xFRJDMJ.exe
  C:\Windows\System\xFRJDMJ.exe
  2⤵
  PID:6240
- C:\Windows\System\ysoRqgd.exe
  C:\Windows\System\ysoRqgd.exe
  2⤵
  PID:6256
- C:\Windows\System\WUfvDIa.exe
  C:\Windows\System\WUfvDIa.exe
  2⤵
  PID:6272
- C:\Windows\System\JcPuGmw.exe
  C:\Windows\System\JcPuGmw.exe
  2⤵
  PID:6288
- C:\Windows\System\cgekNFX.exe
  C:\Windows\System\cgekNFX.exe
  2⤵
  PID:6304
- C:\Windows\System\SmqysEH.exe
  C:\Windows\System\SmqysEH.exe
  2⤵
  PID:6320
- C:\Windows\System\obWXEAY.exe
  C:\Windows\System\obWXEAY.exe
  2⤵
  PID:6336
- C:\Windows\System\ZtnlqVG.exe
  C:\Windows\System\ZtnlqVG.exe
  2⤵
  PID:6352
- C:\Windows\System\sLQtAgY.exe
  C:\Windows\System\sLQtAgY.exe
  2⤵
  PID:6368
- C:\Windows\System\SlAzZyN.exe
  C:\Windows\System\SlAzZyN.exe
  2⤵
  PID:6384
- C:\Windows\System\tNuylGi.exe
  C:\Windows\System\tNuylGi.exe
  2⤵
  PID:6400
- C:\Windows\System\mvJjidg.exe
  C:\Windows\System\mvJjidg.exe
  2⤵
  PID:6416
- C:\Windows\System\TfYCmax.exe
  C:\Windows\System\TfYCmax.exe
  2⤵
  PID:6432
- C:\Windows\System\wJXRCdc.exe
  C:\Windows\System\wJXRCdc.exe
  2⤵
  PID:6448
- C:\Windows\System\RlNVozp.exe
  C:\Windows\System\RlNVozp.exe
  2⤵
  PID:6464
- C:\Windows\System\CjJiCtl.exe
  C:\Windows\System\CjJiCtl.exe
  2⤵
  PID:6488
- C:\Windows\System\iNsgpRM.exe
  C:\Windows\System\iNsgpRM.exe
  2⤵
  PID:6504
- C:\Windows\System\AJQolrz.exe
  C:\Windows\System\AJQolrz.exe
  2⤵
  PID:6520
- C:\Windows\System\RcEAYlu.exe
  C:\Windows\System\RcEAYlu.exe
  2⤵
  PID:6536
- C:\Windows\System\AWZMJld.exe
  C:\Windows\System\AWZMJld.exe
  2⤵
  PID:6552
- C:\Windows\System\fmhUNps.exe
  C:\Windows\System\fmhUNps.exe
  2⤵
  PID:6568
- C:\Windows\System\ifgvFhW.exe
  C:\Windows\System\ifgvFhW.exe
  2⤵
  PID:6584
- C:\Windows\System\xECKtsE.exe
  C:\Windows\System\xECKtsE.exe
  2⤵
  PID:6600
- C:\Windows\System\lJKBseZ.exe
  C:\Windows\System\lJKBseZ.exe
  2⤵
  PID:6616
- C:\Windows\System\PVxJTfF.exe
  C:\Windows\System\PVxJTfF.exe
  2⤵
  PID:6640
- C:\Windows\System\njravNK.exe
  C:\Windows\System\njravNK.exe
  2⤵
  PID:6660
- C:\Windows\System\wdycGmR.exe
  C:\Windows\System\wdycGmR.exe
  2⤵
  PID:6680
- C:\Windows\System\agHrovs.exe
  C:\Windows\System\agHrovs.exe
  2⤵
  PID:6696
- C:\Windows\System\eCqUgmp.exe
  C:\Windows\System\eCqUgmp.exe
  2⤵
  PID:6712
- C:\Windows\System\datUImQ.exe
  C:\Windows\System\datUImQ.exe
  2⤵
  PID:6728
- C:\Windows\System\Chcoxeg.exe
  C:\Windows\System\Chcoxeg.exe
  2⤵
  PID:6744
- C:\Windows\System\kLXmKKL.exe
  C:\Windows\System\kLXmKKL.exe
  2⤵
  PID:6760
- C:\Windows\System\FDuLyBh.exe
  C:\Windows\System\FDuLyBh.exe
  2⤵
  PID:6776
- C:\Windows\System\rbzEWgE.exe
  C:\Windows\System\rbzEWgE.exe
  2⤵
  PID:6792
- C:\Windows\System\CvehlFE.exe
  C:\Windows\System\CvehlFE.exe
  2⤵
  PID:6808
- C:\Windows\System\yMORKgY.exe
  C:\Windows\System\yMORKgY.exe
  2⤵
  PID:6824
- C:\Windows\System\EEWJfLk.exe
  C:\Windows\System\EEWJfLk.exe
  2⤵
  PID:6860
- C:\Windows\System\rUfRCKs.exe
  C:\Windows\System\rUfRCKs.exe
  2⤵
  PID:6876
- C:\Windows\System\nfxsLcE.exe
  C:\Windows\System\nfxsLcE.exe
  2⤵
  PID:6892
- C:\Windows\System\reOpgAm.exe
  C:\Windows\System\reOpgAm.exe
  2⤵
  PID:6908
- C:\Windows\System\qRZfIpx.exe
  C:\Windows\System\qRZfIpx.exe
  2⤵
  PID:6928
- C:\Windows\System\HFKDxJz.exe
  C:\Windows\System\HFKDxJz.exe
  2⤵
  PID:6944
- C:\Windows\System\YxEjIFv.exe
  C:\Windows\System\YxEjIFv.exe
  2⤵
  PID:6960
- C:\Windows\System\QMdtfQz.exe
  C:\Windows\System\QMdtfQz.exe
  2⤵
  PID:6976
- C:\Windows\System\lniaryc.exe
  C:\Windows\System\lniaryc.exe
  2⤵
  PID:6992
- C:\Windows\System\SSZPDQE.exe
  C:\Windows\System\SSZPDQE.exe
  2⤵
  PID:7016
- C:\Windows\System\cvjgHSK.exe
  C:\Windows\System\cvjgHSK.exe
  2⤵
  PID:7032
- C:\Windows\System\rFbihtu.exe
  C:\Windows\System\rFbihtu.exe
  2⤵
  PID:7048
- C:\Windows\System\jglkNeC.exe
  C:\Windows\System\jglkNeC.exe
  2⤵
  PID:7064
- C:\Windows\System\ZbaboUL.exe
  C:\Windows\System\ZbaboUL.exe
  2⤵
  PID:7080
- C:\Windows\System\SktzIeN.exe
  C:\Windows\System\SktzIeN.exe
  2⤵
  PID:7096
- C:\Windows\System\iFgIizJ.exe
  C:\Windows\System\iFgIizJ.exe
  2⤵
  PID:7112
- C:\Windows\System\OlQbQtW.exe
  C:\Windows\System\OlQbQtW.exe
  2⤵
  PID:7128
- C:\Windows\System\BFpERWk.exe
  C:\Windows\System\BFpERWk.exe
  2⤵
  PID:7144
- C:\Windows\System\tTbDqbE.exe
  C:\Windows\System\tTbDqbE.exe
  2⤵
  PID:7164
- C:\Windows\System\EeEYvFW.exe
  C:\Windows\System\EeEYvFW.exe
  2⤵
  PID:5996
- C:\Windows\System\gsdtzRb.exe
  C:\Windows\System\gsdtzRb.exe
  2⤵
  PID:6204
- C:\Windows\System\dYxsHtr.exe
  C:\Windows\System\dYxsHtr.exe
  2⤵
  PID:5256
- C:\Windows\System\ddlMoQd.exe
  C:\Windows\System\ddlMoQd.exe
  2⤵
  PID:6296
- C:\Windows\System\bjpUnrI.exe
  C:\Windows\System\bjpUnrI.exe
  2⤵
  PID:6360
- C:\Windows\System\icAxXLe.exe
  C:\Windows\System\icAxXLe.exe
  2⤵
  PID:6424
- C:\Windows\System\QrVivFp.exe
  C:\Windows\System\QrVivFp.exe
  2⤵
  PID:5868
- C:\Windows\System\GUzNGZY.exe
  C:\Windows\System\GUzNGZY.exe
  2⤵
  PID:5580
- C:\Windows\System\oRKbtWg.exe
  C:\Windows\System\oRKbtWg.exe
  2⤵
  PID:4896
- C:\Windows\System\wQRiBIQ.exe
  C:\Windows\System\wQRiBIQ.exe
  2⤵
  PID:5948
- C:\Windows\System\qtPhEYE.exe
  C:\Windows\System\qtPhEYE.exe
  2⤵
  PID:4172
- C:\Windows\System\ciZepwT.exe
  C:\Windows\System\ciZepwT.exe
  2⤵
  PID:6380
- C:\Windows\System\PdHvZdJ.exe
  C:\Windows\System\PdHvZdJ.exe
  2⤵
  PID:1048
- C:\Windows\System\WGVDpSp.exe
  C:\Windows\System\WGVDpSp.exe
  2⤵
  PID:6500
- C:\Windows\System\jIvfAVu.exe
  C:\Windows\System\jIvfAVu.exe
  2⤵
  PID:6444
- C:\Windows\System\csFAYBX.exe
  C:\Windows\System\csFAYBX.exe
  2⤵
  PID:6532
- C:\Windows\System\VhtReHZ.exe
  C:\Windows\System\VhtReHZ.exe
  2⤵
  PID:6312
- C:\Windows\System\DnBTlch.exe
  C:\Windows\System\DnBTlch.exe
  2⤵
  PID:6248
- C:\Windows\System\oibWWtq.exe
  C:\Windows\System\oibWWtq.exe
  2⤵
  PID:6564
- C:\Windows\System\jbzBwwF.exe
  C:\Windows\System\jbzBwwF.exe
  2⤵
  PID:6480
- C:\Windows\System\cyKSpaA.exe
  C:\Windows\System\cyKSpaA.exe
  2⤵
  PID:6516
- C:\Windows\System\guOEJkE.exe
  C:\Windows\System\guOEJkE.exe
  2⤵
  PID:6624
- C:\Windows\System\NPoTKWB.exe
  C:\Windows\System\NPoTKWB.exe
  2⤵
  PID:6612
- C:\Windows\System\sbGCXYM.exe
  C:\Windows\System\sbGCXYM.exe
  2⤵
  PID:6704
- C:\Windows\System\gWtwwvX.exe
  C:\Windows\System\gWtwwvX.exe
  2⤵
  PID:6768
- C:\Windows\System\NpCAuIx.exe
  C:\Windows\System\NpCAuIx.exe
  2⤵
  PID:6688
- C:\Windows\System\FYfIkPW.exe
  C:\Windows\System\FYfIkPW.exe
  2⤵
  PID:6756
- C:\Windows\System\jRIJELT.exe
  C:\Windows\System\jRIJELT.exe
  2⤵
  PID:6820
- C:\Windows\System\nAhpSBG.exe
  C:\Windows\System\nAhpSBG.exe
  2⤵
  PID:6648
- C:\Windows\System\mAMhfof.exe
  C:\Windows\System\mAMhfof.exe
  2⤵
  PID:6920
- C:\Windows\System\FxaeDhz.exe
  C:\Windows\System\FxaeDhz.exe
  2⤵
  PID:6916
- C:\Windows\System\pyaqaJj.exe
  C:\Windows\System\pyaqaJj.exe
  2⤵
  PID:6984
- C:\Windows\System\lQfxsJE.exe
  C:\Windows\System\lQfxsJE.exe
  2⤵
  PID:6940
- C:\Windows\System\XWaaezX.exe
  C:\Windows\System\XWaaezX.exe
  2⤵
  PID:7008
- C:\Windows\System\RYBETLH.exe
  C:\Windows\System\RYBETLH.exe
  2⤵
  PID:7004
- C:\Windows\System\ZBSAhUz.exe
  C:\Windows\System\ZBSAhUz.exe
  2⤵
  PID:7024
- C:\Windows\System\audPREG.exe
  C:\Windows\System\audPREG.exe
  2⤵
  PID:7120
- C:\Windows\System\BLdBurm.exe
  C:\Windows\System\BLdBurm.exe
  2⤵
  PID:7160
- C:\Windows\System\aWRzdoh.exe
  C:\Windows\System\aWRzdoh.exe
  2⤵
  PID:5536
- C:\Windows\System\VyYrRun.exe
  C:\Windows\System\VyYrRun.exe
  2⤵
  PID:5836
- C:\Windows\System\jNLPODz.exe
  C:\Windows\System\jNLPODz.exe
  2⤵
  PID:7136
- C:\Windows\System\yBqTaoh.exe
  C:\Windows\System\yBqTaoh.exe
  2⤵
  PID:5636
- C:\Windows\System\eZcyIyV.exe
  C:\Windows\System\eZcyIyV.exe
  2⤵
  PID:6396
- C:\Windows\System\WBkZDSz.exe
  C:\Windows\System\WBkZDSz.exe
  2⤵
  PID:7076
- C:\Windows\System\IKsDpdk.exe
  C:\Windows\System\IKsDpdk.exe
  2⤵
  PID:5196
- C:\Windows\System\bDEWQrG.exe
  C:\Windows\System\bDEWQrG.exe
  2⤵
  PID:6472
- C:\Windows\System\BAUwsWD.exe
  C:\Windows\System\BAUwsWD.exe
  2⤵
  PID:5908
- C:\Windows\System\OInVDCn.exe
  C:\Windows\System\OInVDCn.exe
  2⤵
  PID:6528
- C:\Windows\System\CSNxDmT.exe
  C:\Windows\System\CSNxDmT.exe
  2⤵
  PID:6476
- C:\Windows\System\sNclSey.exe
  C:\Windows\System\sNclSey.exe
  2⤵
  PID:6152
- C:\Windows\System\TlRxwUJ.exe
  C:\Windows\System\TlRxwUJ.exe
  2⤵
  PID:6592
- C:\Windows\System\vUlZxdf.exe
  C:\Windows\System\vUlZxdf.exe
  2⤵
  PID:6440
- C:\Windows\System\oaWjkFw.exe
  C:\Windows\System\oaWjkFw.exe
  2⤵
  PID:6412
- C:\Windows\System\JmZcNFF.exe
  C:\Windows\System\JmZcNFF.exe
  2⤵
  PID:6724
- C:\Windows\System\NgnuLJb.exe
  C:\Windows\System\NgnuLJb.exe
  2⤵
  PID:6816
- C:\Windows\System\VjkMRqi.exe
  C:\Windows\System\VjkMRqi.exe
  2⤵
  PID:6956
- C:\Windows\System\KFOHUfQ.exe
  C:\Windows\System\KFOHUfQ.exe
  2⤵
  PID:7060
- C:\Windows\System\ArYzVUt.exe
  C:\Windows\System\ArYzVUt.exe
  2⤵
  PID:5684
- C:\Windows\System\NinMcdd.exe
  C:\Windows\System\NinMcdd.exe
  2⤵
  PID:5396
- C:\Windows\System\LdjkHwY.exe
  C:\Windows\System\LdjkHwY.exe
  2⤵
  PID:5964
- C:\Windows\System\SEXWrvt.exe
  C:\Windows\System\SEXWrvt.exe
  2⤵
  PID:7092
- C:\Windows\System\uEiLYXR.exe
  C:\Windows\System\uEiLYXR.exe
  2⤵
  PID:6836
- C:\Windows\System\IwGVVwp.exe
  C:\Windows\System\IwGVVwp.exe
  2⤵
  PID:6832
- C:\Windows\System\JFVYvZP.exe
  C:\Windows\System\JFVYvZP.exe
  2⤵
  PID:6884
- C:\Windows\System\PJHBLkT.exe
  C:\Windows\System\PJHBLkT.exe
  2⤵
  PID:6852
- C:\Windows\System\LnorLWB.exe
  C:\Windows\System\LnorLWB.exe
  2⤵
  PID:7104
- C:\Windows\System\lsXlfLp.exe
  C:\Windows\System\lsXlfLp.exe
  2⤵
  PID:6460
- C:\Windows\System\vRAiJFM.exe
  C:\Windows\System\vRAiJFM.exe
  2⤵
  PID:6656
- C:\Windows\System\onTmvMO.exe
  C:\Windows\System\onTmvMO.exe
  2⤵
  PID:6788
- C:\Windows\System\sQFuFFJ.exe
  C:\Windows\System\sQFuFFJ.exe
  2⤵
  PID:6168
- C:\Windows\System\cXLVsAY.exe
  C:\Windows\System\cXLVsAY.exe
  2⤵
  PID:6580
- C:\Windows\System\LwQTlUs.exe
  C:\Windows\System\LwQTlUs.exe
  2⤵
  PID:6344
- C:\Windows\System\QZRGDKc.exe
  C:\Windows\System\QZRGDKc.exe
  2⤵
  PID:6736
- C:\Windows\System\rhVeDHQ.exe
  C:\Windows\System\rhVeDHQ.exe
  2⤵
  PID:6548
- C:\Windows\System\ZjenjTU.exe
  C:\Windows\System\ZjenjTU.exe
  2⤵
  PID:6676
- C:\Windows\System\vIcSvyk.exe
  C:\Windows\System\vIcSvyk.exe
  2⤵
  PID:6952
- C:\Windows\System\hfEquks.exe
  C:\Windows\System\hfEquks.exe
  2⤵
  PID:6252
- C:\Windows\System\tHKbshn.exe
  C:\Windows\System\tHKbshn.exe
  2⤵
  PID:7180
- C:\Windows\System\dkXALfS.exe
  C:\Windows\System\dkXALfS.exe
  2⤵
  PID:7196
- C:\Windows\System\XalThNV.exe
  C:\Windows\System\XalThNV.exe
  2⤵
  PID:7212
- C:\Windows\System\qIxRZRY.exe
  C:\Windows\System\qIxRZRY.exe
  2⤵
  PID:7228
- C:\Windows\System\VgmiQby.exe
  C:\Windows\System\VgmiQby.exe
  2⤵
  PID:7244
- C:\Windows\System\TwfAkfV.exe
  C:\Windows\System\TwfAkfV.exe
  2⤵
  PID:7260
- C:\Windows\System\LvvBzMJ.exe
  C:\Windows\System\LvvBzMJ.exe
  2⤵
  PID:7280
- C:\Windows\System\xTTzJGK.exe
  C:\Windows\System\xTTzJGK.exe
  2⤵
  PID:7300
- C:\Windows\System\jxqeYYw.exe
  C:\Windows\System\jxqeYYw.exe
  2⤵
  PID:7316
- C:\Windows\System\fcbapjC.exe
  C:\Windows\System\fcbapjC.exe
  2⤵
  PID:7332
- C:\Windows\System\bBHtZAh.exe
  C:\Windows\System\bBHtZAh.exe
  2⤵
  PID:7348
- C:\Windows\System\gnebOvO.exe
  C:\Windows\System\gnebOvO.exe
  2⤵
  PID:7364
- C:\Windows\System\nyhCGBe.exe
  C:\Windows\System\nyhCGBe.exe
  2⤵
  PID:7380
- C:\Windows\System\NYKqUmj.exe
  C:\Windows\System\NYKqUmj.exe
  2⤵
  PID:7400
- C:\Windows\System\CisWHRo.exe
  C:\Windows\System\CisWHRo.exe
  2⤵
  PID:7416
- C:\Windows\System\aPtIwby.exe
  C:\Windows\System\aPtIwby.exe
  2⤵
  PID:7452
- C:\Windows\System\ndKzfdu.exe
  C:\Windows\System\ndKzfdu.exe
  2⤵
  PID:7468
- C:\Windows\System\llaxMhn.exe
  C:\Windows\System\llaxMhn.exe
  2⤵
  PID:7484
- C:\Windows\System\xJCNJcK.exe
  C:\Windows\System\xJCNJcK.exe
  2⤵
  PID:7500
- C:\Windows\System\bOHGsZj.exe
  C:\Windows\System\bOHGsZj.exe
  2⤵
  PID:7516
- C:\Windows\System\JBfxaOE.exe
  C:\Windows\System\JBfxaOE.exe
  2⤵
  PID:7536
- C:\Windows\System\TXssuIm.exe
  C:\Windows\System\TXssuIm.exe
  2⤵
  PID:7552
- C:\Windows\System\cXkjQQG.exe
  C:\Windows\System\cXkjQQG.exe
  2⤵
  PID:7568
- C:\Windows\System\FEkMcJW.exe
  C:\Windows\System\FEkMcJW.exe
  2⤵
  PID:7584
- C:\Windows\System\vjTaYGw.exe
  C:\Windows\System\vjTaYGw.exe
  2⤵
  PID:7604
- C:\Windows\System\FqsDKLr.exe
  C:\Windows\System\FqsDKLr.exe
  2⤵
  PID:7620
- C:\Windows\System\gpJJPto.exe
  C:\Windows\System\gpJJPto.exe
  2⤵
  PID:7640
- C:\Windows\System\MatcedL.exe
  C:\Windows\System\MatcedL.exe
  2⤵
  PID:7656
- C:\Windows\System\qoKuoPv.exe
  C:\Windows\System\qoKuoPv.exe
  2⤵
  PID:7672
- C:\Windows\System\GUShAKl.exe
  C:\Windows\System\GUShAKl.exe
  2⤵
  PID:7688
- C:\Windows\System\obJFFgX.exe
  C:\Windows\System\obJFFgX.exe
  2⤵
  PID:7704
- C:\Windows\System\mpPMLdb.exe
  C:\Windows\System\mpPMLdb.exe
  2⤵
  PID:7720
- C:\Windows\System\LGsMdMN.exe
  C:\Windows\System\LGsMdMN.exe
  2⤵
  PID:7784
- C:\Windows\System\kuXHlPP.exe
  C:\Windows\System\kuXHlPP.exe
  2⤵
  PID:7820
- C:\Windows\System\mupJRkc.exe
  C:\Windows\System\mupJRkc.exe
  2⤵
  PID:7928
- C:\Windows\System\axnUypl.exe
  C:\Windows\System\axnUypl.exe
  2⤵
  PID:7960
- C:\Windows\System\enUmqfN.exe
  C:\Windows\System\enUmqfN.exe
  2⤵
  PID:7980
- C:\Windows\System\ntdqNqS.exe
  C:\Windows\System\ntdqNqS.exe
  2⤵
  PID:7996
- C:\Windows\System\nagCqvr.exe
  C:\Windows\System\nagCqvr.exe
  2⤵
  PID:8012
- C:\Windows\System\PlgeTMk.exe
  C:\Windows\System\PlgeTMk.exe
  2⤵
  PID:8028
- C:\Windows\System\GZznElj.exe
  C:\Windows\System\GZznElj.exe
  2⤵
  PID:8044
- C:\Windows\System\TFUYGIL.exe
  C:\Windows\System\TFUYGIL.exe
  2⤵
  PID:8060
- C:\Windows\System\uEaeBiB.exe
  C:\Windows\System\uEaeBiB.exe
  2⤵
  PID:8076
- C:\Windows\System\eAbYQts.exe
  C:\Windows\System\eAbYQts.exe
  2⤵
  PID:8092
- C:\Windows\System\EaXAbSb.exe
  C:\Windows\System\EaXAbSb.exe
  2⤵
  PID:8108
- C:\Windows\System\FKdnJKO.exe
  C:\Windows\System\FKdnJKO.exe
  2⤵
  PID:8128
- C:\Windows\System\VVQFuvQ.exe
  C:\Windows\System\VVQFuvQ.exe
  2⤵
  PID:8144
- C:\Windows\System\lYpqerh.exe
  C:\Windows\System\lYpqerh.exe
  2⤵
  PID:8160
- C:\Windows\System\HrMmOiB.exe
  C:\Windows\System\HrMmOiB.exe
  2⤵
  PID:8176
- C:\Windows\System\hWOmMgm.exe
  C:\Windows\System\hWOmMgm.exe
  2⤵
  PID:7172
- C:\Windows\System\VdvQLGJ.exe
  C:\Windows\System\VdvQLGJ.exe
  2⤵
  PID:7308
- C:\Windows\System\UzYyXUd.exe
  C:\Windows\System\UzYyXUd.exe
  2⤵
  PID:7272
- C:\Windows\System\KaMjUKh.exe
  C:\Windows\System\KaMjUKh.exe
  2⤵
  PID:7372
- C:\Windows\System\xJCoQPV.exe
  C:\Windows\System\xJCoQPV.exe
  2⤵
  PID:6332
- C:\Windows\System\bZiodrL.exe
  C:\Windows\System\bZiodrL.exe
  2⤵
  PID:7188
- C:\Windows\System\tUmHMsM.exe
  C:\Windows\System\tUmHMsM.exe
  2⤵
  PID:7252
- C:\Windows\System\UrYrPUp.exe
  C:\Windows\System\UrYrPUp.exe
  2⤵
  PID:7296
- C:\Windows\System\KXMwkzs.exe
  C:\Windows\System\KXMwkzs.exe
  2⤵
  PID:7392
- C:\Windows\System\ESxXtLi.exe
  C:\Windows\System\ESxXtLi.exe
  2⤵
  PID:7436
- C:\Windows\System\iMXNIvN.exe
  C:\Windows\System\iMXNIvN.exe
  2⤵
  PID:7492
- C:\Windows\System\EmRbUdU.exe
  C:\Windows\System\EmRbUdU.exe
  2⤵
  PID:7428
- C:\Windows\System\MXiQwyQ.exe
  C:\Windows\System\MXiQwyQ.exe
  2⤵
  PID:7512
- C:\Windows\System\YVnihcS.exe
  C:\Windows\System\YVnihcS.exe
  2⤵
  PID:7592
- C:\Windows\System\fOxEIlS.exe
  C:\Windows\System\fOxEIlS.exe
  2⤵
  PID:7632
- C:\Windows\System\uQWyfMe.exe
  C:\Windows\System\uQWyfMe.exe
  2⤵
  PID:7544
- C:\Windows\System\VctpWLe.exe
  C:\Windows\System\VctpWLe.exe
  2⤵
  PID:7612
- C:\Windows\System\KNqgwch.exe
  C:\Windows\System\KNqgwch.exe
  2⤵
  PID:7652
- C:\Windows\System\mvQUQts.exe
  C:\Windows\System\mvQUQts.exe
  2⤵
  PID:7736
- C:\Windows\System\eTsQkCM.exe
  C:\Windows\System\eTsQkCM.exe
  2⤵
  PID:6840
- C:\Windows\System\AwTDfdn.exe
  C:\Windows\System\AwTDfdn.exe
  2⤵
  PID:7764
- C:\Windows\System\QvKBmst.exe
  C:\Windows\System\QvKBmst.exe
  2⤵
  PID:7796
- C:\Windows\System\ucVieGr.exe
  C:\Windows\System\ucVieGr.exe
  2⤵
  PID:7812
- C:\Windows\System\jYVlqIw.exe
  C:\Windows\System\jYVlqIw.exe
  2⤵
  PID:7844
- C:\Windows\System\nhBIpGs.exe
  C:\Windows\System\nhBIpGs.exe
  2⤵
  PID:7860
- C:\Windows\System\uJRuPbR.exe
  C:\Windows\System\uJRuPbR.exe
  2⤵
  PID:7876
- C:\Windows\System\lsvbrQS.exe
  C:\Windows\System\lsvbrQS.exe
  2⤵
  PID:7892
- C:\Windows\System\pcVeeCF.exe
  C:\Windows\System\pcVeeCF.exe
  2⤵
  PID:7912
- C:\Windows\System\hceKPMc.exe
  C:\Windows\System\hceKPMc.exe
  2⤵
  PID:7920
- C:\Windows\System\LuGPdZO.exe
  C:\Windows\System\LuGPdZO.exe
  2⤵
  PID:7968
- C:\Windows\System\hHfxfwx.exe
  C:\Windows\System\hHfxfwx.exe
  2⤵
  PID:7976
- C:\Windows\System\GuXYgzq.exe
  C:\Windows\System\GuXYgzq.exe
  2⤵
  PID:7988
- C:\Windows\System\ixlwdvs.exe
  C:\Windows\System\ixlwdvs.exe
  2⤵
  PID:6156
- C:\Windows\System\VdIhhXT.exe
  C:\Windows\System\VdIhhXT.exe
  2⤵
  PID:8188
- C:\Windows\System\rbWnglL.exe
  C:\Windows\System\rbWnglL.exe
  2⤵
  PID:8124
- C:\Windows\System\oxlSkUQ.exe
  C:\Windows\System\oxlSkUQ.exe
  2⤵
  PID:7360
- C:\Windows\System\xXvWOQM.exe
  C:\Windows\System\xXvWOQM.exe
  2⤵
  PID:7460
- C:\Windows\System\VMiHWJa.exe
  C:\Windows\System\VMiHWJa.exe
  2⤵
  PID:7464
- C:\Windows\System\QQbfMJk.exe
  C:\Windows\System\QQbfMJk.exe
  2⤵
  PID:7648
- C:\Windows\System\VmEktqy.exe
  C:\Windows\System\VmEktqy.exe
  2⤵
  PID:7576
- C:\Windows\System\mNOmqnR.exe
  C:\Windows\System\mNOmqnR.exe
  2⤵
  PID:7684
- C:\Windows\System\WNCAebY.exe
  C:\Windows\System\WNCAebY.exe
  2⤵
  PID:7716
- C:\Windows\System\vLmppYo.exe
  C:\Windows\System\vLmppYo.exe
  2⤵
  PID:7828
- C:\Windows\System\yYDDjIT.exe
  C:\Windows\System\yYDDjIT.exe
  2⤵
  PID:7904
- C:\Windows\System\kocriGs.exe
  C:\Windows\System\kocriGs.exe
  2⤵
  PID:8004
- C:\Windows\System\EbBpvPz.exe
  C:\Windows\System\EbBpvPz.exe
  2⤵
  PID:8100
- C:\Windows\System\ocOWukQ.exe
  C:\Windows\System\ocOWukQ.exe
  2⤵
  PID:7888
- C:\Windows\System\hgUStGE.exe
  C:\Windows\System\hgUStGE.exe
  2⤵
  PID:7312
- C:\Windows\System\tMxPyJb.exe
  C:\Windows\System\tMxPyJb.exe
  2⤵
  PID:8152
- C:\Windows\System\gpJbxQQ.exe
  C:\Windows\System\gpJbxQQ.exe
  2⤵
  PID:7328
- C:\Windows\System\IfbsNVD.exe
  C:\Windows\System\IfbsNVD.exe
  2⤵
  PID:7432
- C:\Windows\System\DvkFnfL.exe
  C:\Windows\System\DvkFnfL.exe
  2⤵
  PID:7696
- C:\Windows\System\CztUzDZ.exe
  C:\Windows\System\CztUzDZ.exe
  2⤵
  PID:7780
- C:\Windows\System\RPucqOM.exe
  C:\Windows\System\RPucqOM.exe
  2⤵
  PID:7972
- C:\Windows\System\ixOEDTO.exe
  C:\Windows\System\ixOEDTO.exe
  2⤵
  PID:7804
- C:\Windows\System\ySjhaqG.exe
  C:\Windows\System\ySjhaqG.exe
  2⤵
  PID:7756
- C:\Windows\System\qkPWZvT.exe
  C:\Windows\System\qkPWZvT.exe
  2⤵
  PID:2112
- C:\Windows\System\evFCbMK.exe
  C:\Windows\System\evFCbMK.exe
  2⤵
  PID:7240
- C:\Windows\System\QSbyDJE.exe
  C:\Windows\System\QSbyDJE.exe
  2⤵
  PID:1532
- C:\Windows\System\TOrPjKX.exe
  C:\Windows\System\TOrPjKX.exe
  2⤵
  PID:8140
- C:\Windows\System\xHbIAhZ.exe
  C:\Windows\System\xHbIAhZ.exe
  2⤵
  PID:8168
- C:\Windows\System\pMruYzo.exe
  C:\Windows\System\pMruYzo.exe
  2⤵
  PID:7268
- C:\Windows\System\rltULOm.exe
  C:\Windows\System\rltULOm.exe
  2⤵
  PID:8156
- C:\Windows\System\iBvqBDx.exe
  C:\Windows\System\iBvqBDx.exe
  2⤵
  PID:7292
- C:\Windows\System\nDIPPUr.exe
  C:\Windows\System\nDIPPUr.exe
  2⤵
  PID:7852
- C:\Windows\System\FCnloDR.exe
  C:\Windows\System\FCnloDR.exe
  2⤵
  PID:5204
- C:\Windows\System\PMgLvRT.exe
  C:\Windows\System\PMgLvRT.exe
  2⤵
  PID:7288
- C:\Windows\System\sOUeKSE.exe
  C:\Windows\System\sOUeKSE.exe
  2⤵
  PID:7088
- C:\Windows\System\gfWJTvc.exe
  C:\Windows\System\gfWJTvc.exe
  2⤵
  PID:7636
- C:\Windows\System\lgPJRqv.exe
  C:\Windows\System\lgPJRqv.exe
  2⤵
  PID:7560
- C:\Windows\System\urJRfQs.exe
  C:\Windows\System\urJRfQs.exe
  2⤵
  PID:7580
- C:\Windows\System\mWWNsMK.exe
  C:\Windows\System\mWWNsMK.exe
  2⤵
  PID:8040
- C:\Windows\System\tFTwkcl.exe
  C:\Windows\System\tFTwkcl.exe
  2⤵
  PID:7564
- C:\Windows\System\gQmyDcT.exe
  C:\Windows\System\gQmyDcT.exe
  2⤵
  PID:8020
- C:\Windows\System\aKUIxgS.exe
  C:\Windows\System\aKUIxgS.exe
  2⤵
  PID:7952
- C:\Windows\System\OxSTWqB.exe
  C:\Windows\System\OxSTWqB.exe
  2⤵
  PID:8172
- C:\Windows\System\XgzXKzC.exe
  C:\Windows\System\XgzXKzC.exe
  2⤵
  PID:7856
- C:\Windows\System\OBsSyQt.exe
  C:\Windows\System\OBsSyQt.exe
  2⤵
  PID:7840
- C:\Windows\System\RLuPUeS.exe
  C:\Windows\System\RLuPUeS.exe
  2⤵
  PID:8072
- C:\Windows\System\pgdSZlh.exe
  C:\Windows\System\pgdSZlh.exe
  2⤵
  PID:8104
- C:\Windows\System\ToSXRPr.exe
  C:\Windows\System\ToSXRPr.exe
  2⤵
  PID:8208
- C:\Windows\System\sVUfYus.exe
  C:\Windows\System\sVUfYus.exe
  2⤵
  PID:8224
- C:\Windows\System\PcJMOBx.exe
  C:\Windows\System\PcJMOBx.exe
  2⤵
  PID:8240
- C:\Windows\System\wqrUGHu.exe
  C:\Windows\System\wqrUGHu.exe
  2⤵
  PID:8256
- C:\Windows\System\SQwFJlg.exe
  C:\Windows\System\SQwFJlg.exe
  2⤵
  PID:8272
- C:\Windows\System\zivNgmm.exe
  C:\Windows\System\zivNgmm.exe
  2⤵
  PID:8288
- C:\Windows\System\fXXLuIH.exe
  C:\Windows\System\fXXLuIH.exe
  2⤵
  PID:8304
- C:\Windows\System\VhjLgOp.exe
  C:\Windows\System\VhjLgOp.exe
  2⤵
  PID:8320
- C:\Windows\System\VAizIur.exe
  C:\Windows\System\VAizIur.exe
  2⤵
  PID:8336
- C:\Windows\System\IWIdgaQ.exe
  C:\Windows\System\IWIdgaQ.exe
  2⤵
  PID:8352
- C:\Windows\System\UouikeK.exe
  C:\Windows\System\UouikeK.exe
  2⤵
  PID:8368
- C:\Windows\System\jHdAZCe.exe
  C:\Windows\System\jHdAZCe.exe
  2⤵
  PID:8384
- C:\Windows\System\dWzISRq.exe
  C:\Windows\System\dWzISRq.exe
  2⤵
  PID:8400
- C:\Windows\System\mBbQnal.exe
  C:\Windows\System\mBbQnal.exe
  2⤵
  PID:8416
- C:\Windows\System\vpAAJQS.exe
  C:\Windows\System\vpAAJQS.exe
  2⤵
  PID:8432
- C:\Windows\System\Kpeycqv.exe
  C:\Windows\System\Kpeycqv.exe
  2⤵
  PID:8448
- C:\Windows\System\BMDoBmK.exe
  C:\Windows\System\BMDoBmK.exe
  2⤵
  PID:8464
- C:\Windows\System\ciJgXJb.exe
  C:\Windows\System\ciJgXJb.exe
  2⤵
  PID:8480
- C:\Windows\System\EQvwYfQ.exe
  C:\Windows\System\EQvwYfQ.exe
  2⤵
  PID:8496
- C:\Windows\System\GyoSbta.exe
  C:\Windows\System\GyoSbta.exe
  2⤵
  PID:8512
- C:\Windows\System\enPqAsE.exe
  C:\Windows\System\enPqAsE.exe
  2⤵
  PID:8528
- C:\Windows\System\rFifYeW.exe
  C:\Windows\System\rFifYeW.exe
  2⤵
  PID:8544
- C:\Windows\System\zxytGQK.exe
  C:\Windows\System\zxytGQK.exe
  2⤵
  PID:8560
- C:\Windows\System\monFeTZ.exe
  C:\Windows\System\monFeTZ.exe
  2⤵
  PID:8576
- C:\Windows\System\EnWGyZM.exe
  C:\Windows\System\EnWGyZM.exe
  2⤵
  PID:8592
- C:\Windows\System\sTEBTwS.exe
  C:\Windows\System\sTEBTwS.exe
  2⤵
  PID:8608
- C:\Windows\System\jammEIB.exe
  C:\Windows\System\jammEIB.exe
  2⤵
  PID:8624
- C:\Windows\System\xdYNgBu.exe
  C:\Windows\System\xdYNgBu.exe
  2⤵
  PID:8640
- C:\Windows\System\bRLzpZe.exe
  C:\Windows\System\bRLzpZe.exe
  2⤵
  PID:8656
- C:\Windows\System\hrgNors.exe
  C:\Windows\System\hrgNors.exe
  2⤵
  PID:8672
- C:\Windows\System\FBuDTOM.exe
  C:\Windows\System\FBuDTOM.exe
  2⤵
  PID:8688
- C:\Windows\System\sKqzdJn.exe
  C:\Windows\System\sKqzdJn.exe
  2⤵
  PID:8704
- C:\Windows\System\IIZWisE.exe
  C:\Windows\System\IIZWisE.exe
  2⤵
  PID:8720
- C:\Windows\System\vOwDyEa.exe
  C:\Windows\System\vOwDyEa.exe
  2⤵
  PID:8736
- C:\Windows\System\UIWsQuW.exe
  C:\Windows\System\UIWsQuW.exe
  2⤵
  PID:8752
- C:\Windows\System\cfVSyqg.exe
  C:\Windows\System\cfVSyqg.exe
  2⤵
  PID:8768
- C:\Windows\System\CmfRELj.exe
  C:\Windows\System\CmfRELj.exe
  2⤵
  PID:8784
- C:\Windows\System\ZHPOiKx.exe
  C:\Windows\System\ZHPOiKx.exe
  2⤵
  PID:8800
- C:\Windows\System\YaVkixr.exe
  C:\Windows\System\YaVkixr.exe
  2⤵
  PID:8816
- C:\Windows\System\OXiMsod.exe
  C:\Windows\System\OXiMsod.exe
  2⤵
  PID:8832
- C:\Windows\System\inxxQDE.exe
  C:\Windows\System\inxxQDE.exe
  2⤵
  PID:8848
- C:\Windows\System\SOEoSOu.exe
  C:\Windows\System\SOEoSOu.exe
  2⤵
  PID:8864
- C:\Windows\System\sYtPxlY.exe
  C:\Windows\System\sYtPxlY.exe
  2⤵
  PID:8880
- C:\Windows\System\LMspEeK.exe
  C:\Windows\System\LMspEeK.exe
  2⤵
  PID:8896
- C:\Windows\System\AWiLJYf.exe
  C:\Windows\System\AWiLJYf.exe
  2⤵
  PID:8912
- C:\Windows\System\zTFnmlN.exe
  C:\Windows\System\zTFnmlN.exe
  2⤵
  PID:8928
- C:\Windows\System\ZXNYNIb.exe
  C:\Windows\System\ZXNYNIb.exe
  2⤵
  PID:8944
- C:\Windows\System\fySOPEy.exe
  C:\Windows\System\fySOPEy.exe
  2⤵
  PID:8960
- C:\Windows\System\vcVpFpx.exe
  C:\Windows\System\vcVpFpx.exe
  2⤵
  PID:8976
- C:\Windows\System\oPTxaek.exe
  C:\Windows\System\oPTxaek.exe
  2⤵
  PID:8992
- C:\Windows\System\jQbIqEi.exe
  C:\Windows\System\jQbIqEi.exe
  2⤵
  PID:9008
- C:\Windows\System\uMxCvMN.exe
  C:\Windows\System\uMxCvMN.exe
  2⤵
  PID:9024
- C:\Windows\System\rniYsGO.exe
  C:\Windows\System\rniYsGO.exe
  2⤵
  PID:9040
- C:\Windows\System\UqmfJqL.exe
  C:\Windows\System\UqmfJqL.exe
  2⤵
  PID:9056
- C:\Windows\System\GGZCwum.exe
  C:\Windows\System\GGZCwum.exe
  2⤵
  PID:9072
- C:\Windows\System\lsXasmj.exe
  C:\Windows\System\lsXasmj.exe
  2⤵
  PID:9088
- C:\Windows\System\qHEMraS.exe
  C:\Windows\System\qHEMraS.exe
  2⤵
  PID:9104
- C:\Windows\System\osBXPtP.exe
  C:\Windows\System\osBXPtP.exe
  2⤵
  PID:9120
- C:\Windows\System\zDDXpLj.exe
  C:\Windows\System\zDDXpLj.exe
  2⤵
  PID:9136
- C:\Windows\System\TlghCuO.exe
  C:\Windows\System\TlghCuO.exe
  2⤵
  PID:9152
- C:\Windows\System\BxEcKkv.exe
  C:\Windows\System\BxEcKkv.exe
  2⤵
  PID:9168
- C:\Windows\System\uFkWfxA.exe
  C:\Windows\System\uFkWfxA.exe
  2⤵
  PID:9184
- C:\Windows\System\qsBhmCt.exe
  C:\Windows\System\qsBhmCt.exe
  2⤵
  PID:9200
- C:\Windows\System\dGeCLHl.exe
  C:\Windows\System\dGeCLHl.exe
  2⤵
  PID:8200
- C:\Windows\System\iyiILRk.exe
  C:\Windows\System\iyiILRk.exe
  2⤵
  PID:8248
- C:\Windows\System\vCCMiHy.exe
  C:\Windows\System\vCCMiHy.exe
  2⤵
  PID:8236
- C:\Windows\System\xVZUpjG.exe
  C:\Windows\System\xVZUpjG.exe
  2⤵
  PID:8264
- C:\Windows\System\NPuSSDe.exe
  C:\Windows\System\NPuSSDe.exe
  2⤵
  PID:8328
- C:\Windows\System\OyWNUFb.exe
  C:\Windows\System\OyWNUFb.exe
  2⤵
  PID:8376
- C:\Windows\System\sPLwdUc.exe
  C:\Windows\System\sPLwdUc.exe
  2⤵
  PID:8408
- C:\Windows\System\nbienhZ.exe
  C:\Windows\System\nbienhZ.exe
  2⤵
  PID:8412
- C:\Windows\System\tFnKywa.exe
  C:\Windows\System\tFnKywa.exe
  2⤵
  PID:8476
- C:\Windows\System\JGNBazm.exe
  C:\Windows\System\JGNBazm.exe
  2⤵
  PID:8424
- C:\Windows\System\qEUmqLR.exe
  C:\Windows\System\qEUmqLR.exe
  2⤵
  PID:8488
- C:\Windows\System\ULABEdf.exe
  C:\Windows\System\ULABEdf.exe
  2⤵
  PID:8632
- C:\Windows\System\kzuFptv.exe
  C:\Windows\System\kzuFptv.exe
  2⤵
  PID:8584
- C:\Windows\System\spsFwms.exe
  C:\Windows\System\spsFwms.exe
  2⤵
  PID:8520
- C:\Windows\System\zPqBFgZ.exe
  C:\Windows\System\zPqBFgZ.exe
  2⤵
  PID:8664
- C:\Windows\System\ZorxEoy.exe
  C:\Windows\System\ZorxEoy.exe
  2⤵
  PID:8652
- C:\Windows\System\XMMQMSo.exe
  C:\Windows\System\XMMQMSo.exe
  2⤵
  PID:8620
- C:\Windows\System\iKPXWil.exe
  C:\Windows\System\iKPXWil.exe
  2⤵
  PID:8744
- C:\Windows\System\QBTsGKB.exe
  C:\Windows\System\QBTsGKB.exe
  2⤵
  PID:8796
- C:\Windows\System\vnPdvnx.exe
  C:\Windows\System\vnPdvnx.exe
  2⤵
  PID:8828
- C:\Windows\System\AYgLktj.exe
  C:\Windows\System\AYgLktj.exe
  2⤵
  PID:8860
- C:\Windows\System\TtYMfuj.exe
  C:\Windows\System\TtYMfuj.exe
  2⤵
  PID:8808
- C:\Windows\System\DwMzRFn.exe
  C:\Windows\System\DwMzRFn.exe
  2⤵
  PID:8892
- C:\Windows\System\tnrxpWN.exe
  C:\Windows\System\tnrxpWN.exe
  2⤵
  PID:8952
- C:\Windows\System\ElpDHhg.exe
  C:\Windows\System\ElpDHhg.exe
  2⤵
  PID:8956
- C:\Windows\System\EAtOFHj.exe
  C:\Windows\System\EAtOFHj.exe
  2⤵
  PID:9048
- C:\Windows\System\yFDJRoP.exe
  C:\Windows\System\yFDJRoP.exe
  2⤵
  PID:8972
- C:\Windows\System\tpxTKGg.exe
  C:\Windows\System\tpxTKGg.exe
  2⤵
  PID:9032
- C:\Windows\System\okimLFE.exe
  C:\Windows\System\okimLFE.exe
  2⤵
  PID:9096
- C:\Windows\System\VoKVqrm.exe
  C:\Windows\System\VoKVqrm.exe
  2⤵
  PID:9100
- C:\Windows\System\EGVhsIa.exe
  C:\Windows\System\EGVhsIa.exe
  2⤵
  PID:9132
- C:\Windows\System\OfWNtMO.exe
  C:\Windows\System\OfWNtMO.exe
  2⤵
  PID:9196
- C:\Windows\System\tiOBdmI.exe
  C:\Windows\System\tiOBdmI.exe
  2⤵
  PID:8280
- C:\Windows\System\MoEFqJa.exe
  C:\Windows\System\MoEFqJa.exe
  2⤵
  PID:8344
- C:\Windows\System\cIpBVbo.exe
  C:\Windows\System\cIpBVbo.exe
  2⤵
  PID:8360
- C:\Windows\System\uUXpyst.exe
  C:\Windows\System\uUXpyst.exe
  2⤵
  PID:8296
- C:\Windows\System\ZMCdaoc.exe
  C:\Windows\System\ZMCdaoc.exe
  2⤵
  PID:8472
- C:\Windows\System\IfNAdbw.exe
  C:\Windows\System\IfNAdbw.exe
  2⤵
  PID:8568
- C:\Windows\System\OviEJjj.exe
  C:\Windows\System\OviEJjj.exe
  2⤵
  PID:8600
- C:\Windows\System\esofKWP.exe
  C:\Windows\System\esofKWP.exe
  2⤵
  PID:8728
- C:\Windows\System\JfYqBTs.exe
  C:\Windows\System\JfYqBTs.exe
  2⤵
  PID:8856
- C:\Windows\System\EVGIyVV.exe
  C:\Windows\System\EVGIyVV.exe
  2⤵
  PID:8908
- C:\Windows\System\GzkkHHp.exe
  C:\Windows\System\GzkkHHp.exe
  2⤵
  PID:8760
- C:\Windows\System\FkuYojO.exe
  C:\Windows\System\FkuYojO.exe
  2⤵
  PID:8812
- C:\Windows\System\mfJEbsM.exe
  C:\Windows\System\mfJEbsM.exe
  2⤵
  PID:8988
- C:\Windows\System\TNexjqQ.exe
  C:\Windows\System\TNexjqQ.exe
  2⤵
  PID:9036
- C:\Windows\System\mYqwMTr.exe
  C:\Windows\System\mYqwMTr.exe
  2⤵
  PID:9176
- C:\Windows\System\Tquqhdu.exe
  C:\Windows\System\Tquqhdu.exe
  2⤵
  PID:9212
- C:\Windows\System\miPWQvE.exe
  C:\Windows\System\miPWQvE.exe
  2⤵
  PID:9192
- C:\Windows\System\lnxujkw.exe
  C:\Windows\System\lnxujkw.exe
  2⤵
  PID:8300
- C:\Windows\System\Xqbyzta.exe
  C:\Windows\System\Xqbyzta.exe
  2⤵
  PID:8552
- C:\Windows\System\VzoVNXy.exe
  C:\Windows\System\VzoVNXy.exe
  2⤵
  PID:8508
- C:\Windows\System\IiDtsKe.exe
  C:\Windows\System\IiDtsKe.exe
  2⤵
  PID:8888
- C:\Windows\System\ivPCaQy.exe
  C:\Windows\System\ivPCaQy.exe
  2⤵
  PID:8648
- C:\Windows\System\FTURxAw.exe
  C:\Windows\System\FTURxAw.exe
  2⤵
  PID:9116
- C:\Windows\System\yDulyUT.exe
  C:\Windows\System\yDulyUT.exe
  2⤵
  PID:8220
- C:\Windows\System\iIicJYV.exe
  C:\Windows\System\iIicJYV.exe
  2⤵
  PID:9208
- C:\Windows\System\ZwIPLxb.exe
  C:\Windows\System\ZwIPLxb.exe
  2⤵
  PID:8680
- C:\Windows\System\bpUtYZZ.exe
  C:\Windows\System\bpUtYZZ.exe
  2⤵
  PID:8924
- C:\Windows\System\mPwDVfy.exe
  C:\Windows\System\mPwDVfy.exe
  2⤵
  PID:8776
- C:\Windows\System\wOLpLGR.exe
  C:\Windows\System\wOLpLGR.exe
  2⤵
  PID:9228
- C:\Windows\System\DsWbQwO.exe
  C:\Windows\System\DsWbQwO.exe
  2⤵
  PID:9244
- C:\Windows\System\QDynYKw.exe
  C:\Windows\System\QDynYKw.exe
  2⤵
  PID:9260
- C:\Windows\System\WaLdRNL.exe
  C:\Windows\System\WaLdRNL.exe
  2⤵
  PID:9276
- C:\Windows\System\TgiCcqm.exe
  C:\Windows\System\TgiCcqm.exe
  2⤵
  PID:9292
- C:\Windows\System\QzYipkO.exe
  C:\Windows\System\QzYipkO.exe
  2⤵
  PID:9308
- C:\Windows\System\IINTWrf.exe
  C:\Windows\System\IINTWrf.exe
  2⤵
  PID:9324
- C:\Windows\System\ZtUFjqQ.exe
  C:\Windows\System\ZtUFjqQ.exe
  2⤵
  PID:9340
- C:\Windows\System\VNCuzrF.exe
  C:\Windows\System\VNCuzrF.exe
  2⤵
  PID:9356
- C:\Windows\System\HJgDwIp.exe
  C:\Windows\System\HJgDwIp.exe
  2⤵
  PID:9372
- C:\Windows\System\acxBSge.exe
  C:\Windows\System\acxBSge.exe
  2⤵
  PID:9388
- C:\Windows\System\TLyXyGu.exe
  C:\Windows\System\TLyXyGu.exe
  2⤵
  PID:9404
- C:\Windows\System\atqJvcw.exe
  C:\Windows\System\atqJvcw.exe
  2⤵
  PID:9420
- C:\Windows\System\mMTkkJq.exe
  C:\Windows\System\mMTkkJq.exe
  2⤵
  PID:9436
- C:\Windows\System\rXUlJHh.exe
  C:\Windows\System\rXUlJHh.exe
  2⤵
  PID:9452
- C:\Windows\System\jFwNACt.exe
  C:\Windows\System\jFwNACt.exe
  2⤵
  PID:9468
- C:\Windows\System\IYgjTHx.exe
  C:\Windows\System\IYgjTHx.exe
  2⤵
  PID:9484
- C:\Windows\System\jyyfjlI.exe
  C:\Windows\System\jyyfjlI.exe
  2⤵
  PID:9500
- C:\Windows\System\NcQjvbd.exe
  C:\Windows\System\NcQjvbd.exe
  2⤵
  PID:9516
- C:\Windows\System\LYaIATk.exe
  C:\Windows\System\LYaIATk.exe
  2⤵
  PID:9532
- C:\Windows\System\zhIyXXS.exe
  C:\Windows\System\zhIyXXS.exe
  2⤵
  PID:9548
- C:\Windows\System\JjCzNvQ.exe
  C:\Windows\System\JjCzNvQ.exe
  2⤵
  PID:9564
- C:\Windows\System\qsmbAaO.exe
  C:\Windows\System\qsmbAaO.exe
  2⤵
  PID:9580
- C:\Windows\System\MiZWCzL.exe
  C:\Windows\System\MiZWCzL.exe
  2⤵
  PID:9596
- C:\Windows\System\RXIjHku.exe
  C:\Windows\System\RXIjHku.exe
  2⤵
  PID:9612
- C:\Windows\System\UsRhEwt.exe
  C:\Windows\System\UsRhEwt.exe
  2⤵
  PID:9628
- C:\Windows\System\RPRDHlM.exe
  C:\Windows\System\RPRDHlM.exe
  2⤵
  PID:9644
- C:\Windows\System\WiXimgE.exe
  C:\Windows\System\WiXimgE.exe
  2⤵
  PID:9660
- C:\Windows\System\ItWJjAs.exe
  C:\Windows\System\ItWJjAs.exe
  2⤵
  PID:9676
- C:\Windows\System\VhzloXP.exe
  C:\Windows\System\VhzloXP.exe
  2⤵
  PID:9692
- C:\Windows\System\zIOHOPX.exe
  C:\Windows\System\zIOHOPX.exe
  2⤵
  PID:9708
- C:\Windows\System\FfKNokq.exe
  C:\Windows\System\FfKNokq.exe
  2⤵
  PID:9724
- C:\Windows\System\rDVyboR.exe
  C:\Windows\System\rDVyboR.exe
  2⤵
  PID:9740
- C:\Windows\System\SjXhEBo.exe
  C:\Windows\System\SjXhEBo.exe
  2⤵
  PID:9756
- C:\Windows\System\pIsqpXo.exe
  C:\Windows\System\pIsqpXo.exe
  2⤵
  PID:9772
- C:\Windows\System\baweBsD.exe
  C:\Windows\System\baweBsD.exe
  2⤵
  PID:9788
- C:\Windows\System\gVhHsDV.exe
  C:\Windows\System\gVhHsDV.exe
  2⤵
  PID:9804
- C:\Windows\System\Wrulaqg.exe
  C:\Windows\System\Wrulaqg.exe
  2⤵
  PID:9820
- C:\Windows\System\GTWmhRP.exe
  C:\Windows\System\GTWmhRP.exe
  2⤵
  PID:9836
- C:\Windows\System\pIDtDQJ.exe
  C:\Windows\System\pIDtDQJ.exe
  2⤵
  PID:9852
- C:\Windows\System\xjMSARW.exe
  C:\Windows\System\xjMSARW.exe
  2⤵
  PID:9868
- C:\Windows\System\DsHhFpH.exe
  C:\Windows\System\DsHhFpH.exe
  2⤵
  PID:9884
- C:\Windows\System\hZcqkqJ.exe
  C:\Windows\System\hZcqkqJ.exe
  2⤵
  PID:9900
- C:\Windows\System\MYIzXOV.exe
  C:\Windows\System\MYIzXOV.exe
  2⤵
  PID:9916
- C:\Windows\System\pqIBKXd.exe
  C:\Windows\System\pqIBKXd.exe
  2⤵
  PID:9932
- C:\Windows\System\AeNjYYA.exe
  C:\Windows\System\AeNjYYA.exe
  2⤵
  PID:9948
- C:\Windows\System\xtAqZva.exe
  C:\Windows\System\xtAqZva.exe
  2⤵
  PID:9964
- C:\Windows\System\YMiCFyk.exe
  C:\Windows\System\YMiCFyk.exe
  2⤵
  PID:9980
- C:\Windows\System\MDfewWY.exe
  C:\Windows\System\MDfewWY.exe
  2⤵
  PID:9996
- C:\Windows\System\iuqcTrT.exe
  C:\Windows\System\iuqcTrT.exe
  2⤵
  PID:10012
- C:\Windows\System\PlupNTa.exe
  C:\Windows\System\PlupNTa.exe
  2⤵
  PID:10028
- C:\Windows\System\kHXfqlw.exe
  C:\Windows\System\kHXfqlw.exe
  2⤵
  PID:10044
- C:\Windows\System\WJDednO.exe
  C:\Windows\System\WJDednO.exe
  2⤵
  PID:10060
- C:\Windows\System\MaLMFkY.exe
  C:\Windows\System\MaLMFkY.exe
  2⤵
  PID:10076
- C:\Windows\System\VutedCW.exe
  C:\Windows\System\VutedCW.exe
  2⤵
  PID:10092
- C:\Windows\System\QZvCwka.exe
  C:\Windows\System\QZvCwka.exe
  2⤵
  PID:10108
- C:\Windows\System\ZiFhQrY.exe
  C:\Windows\System\ZiFhQrY.exe
  2⤵
  PID:10124
- C:\Windows\System\IppByRN.exe
  C:\Windows\System\IppByRN.exe
  2⤵
  PID:10140
- C:\Windows\System\DUAwTqO.exe
  C:\Windows\System\DUAwTqO.exe
  2⤵
  PID:10156
- C:\Windows\System\yVvmWxP.exe
  C:\Windows\System\yVvmWxP.exe
  2⤵
  PID:10172
- C:\Windows\System\pwEaVYj.exe
  C:\Windows\System\pwEaVYj.exe
  2⤵
  PID:10188
- C:\Windows\System\xovnZhW.exe
  C:\Windows\System\xovnZhW.exe
  2⤵
  PID:10204
- C:\Windows\System\OzniTba.exe
  C:\Windows\System\OzniTba.exe
  2⤵
  PID:10220
- C:\Windows\System\SPtexhh.exe
  C:\Windows\System\SPtexhh.exe
  2⤵
  PID:10236
- C:\Windows\System\hkOziEL.exe
  C:\Windows\System\hkOziEL.exe
  2⤵
  PID:8716
- C:\Windows\System\IkMcvas.exe
  C:\Windows\System\IkMcvas.exe
  2⤵
  PID:8396
- C:\Windows\System\rtHHAhJ.exe
  C:\Windows\System\rtHHAhJ.exe
  2⤵
  PID:9236
- C:\Windows\System\bKvmGzf.exe
  C:\Windows\System\bKvmGzf.exe
  2⤵
  PID:9284
- C:\Windows\System\eFoStWn.exe
  C:\Windows\System\eFoStWn.exe
  2⤵
  PID:9348
- C:\Windows\System\CMFnCwI.exe
  C:\Windows\System\CMFnCwI.exe
  2⤵
  PID:9364
- C:\Windows\System\CDMZfzG.exe
  C:\Windows\System\CDMZfzG.exe
  2⤵
  PID:9416
- C:\Windows\System\fwdtUyy.exe
  C:\Windows\System\fwdtUyy.exe
  2⤵
  PID:9508
- C:\Windows\System\xESEyOO.exe
  C:\Windows\System\xESEyOO.exe
  2⤵
  PID:9492
- C:\Windows\System\bBTzqqi.exe
  C:\Windows\System\bBTzqqi.exe
  2⤵
  PID:9272
- C:\Windows\System\ZluNzxV.exe
  C:\Windows\System\ZluNzxV.exe
  2⤵
  PID:9368
- C:\Windows\System\mmeXyiZ.exe
  C:\Windows\System\mmeXyiZ.exe
  2⤵
  PID:9428
- C:\Windows\System\BHrHMBf.exe
  C:\Windows\System\BHrHMBf.exe
  2⤵
  PID:9560
- C:\Windows\System\UMTzKxi.exe
  C:\Windows\System\UMTzKxi.exe
  2⤵
  PID:9608
- C:\Windows\System\YjVDvXY.exe
  C:\Windows\System\YjVDvXY.exe
  2⤵
  PID:9640
- C:\Windows\System\mqnwgDb.exe
  C:\Windows\System\mqnwgDb.exe
  2⤵
  PID:9652
- C:\Windows\System\puuIuZP.exe
  C:\Windows\System\puuIuZP.exe
  2⤵
  PID:9684
- C:\Windows\System\VjhsXov.exe
  C:\Windows\System\VjhsXov.exe
  2⤵
  PID:9736
- C:\Windows\System\lclggzV.exe
  C:\Windows\System\lclggzV.exe
  2⤵
  PID:9800
- C:\Windows\System\koSyntx.exe
  C:\Windows\System\koSyntx.exe
  2⤵
  PID:9780
- C:\Windows\System\oKjkCCc.exe
  C:\Windows\System\oKjkCCc.exe
  2⤵
  PID:9828
- C:\Windows\System\NwgyBpg.exe
  C:\Windows\System\NwgyBpg.exe
  2⤵
  PID:9860
- C:\Windows\System\otOQKNG.exe
  C:\Windows\System\otOQKNG.exe
  2⤵
  PID:9876
- C:\Windows\System\OAGYsYm.exe
  C:\Windows\System\OAGYsYm.exe
  2⤵
  PID:9928
- C:\Windows\System\nfEQDHI.exe
  C:\Windows\System\nfEQDHI.exe
  2⤵
  PID:9944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BrFgLHX.exe

Filesize
2.1MB

MD5
eee40c8aaacc6ee852c751914934eca8

SHA1
d89c1f55526b9d99e17c1698b789fb07d5058334

SHA256
b19eed05adbabbaf1da6858c5e71e7681d37616dbfc7f6109e71ee27a4d39a10

SHA512
75ecd8e2995e79df1bee45022d48198c8259a1937cf19aa3e5720088d2fd903d61abacc90d470fda4e36b94b39bf65bd7d5dd018600e6cbfc31f1d7f9042a883

Download Submit
C:\Windows\system\CfWfAsJ.exe

Filesize
2.1MB

MD5
2196aba0a400393f93ad33fe837d4861

SHA1
7f6cebaf614a42f77d3eaa44318271e7c14677c5

SHA256
d0d999c1753d1cd5c4be5ee4a80cb9edc93ea9999a70b2556582a703c72a87e6

SHA512
954ed34a3bb125ce86d026c019a3d00b80562bf269fc1ddbd61b1f09e5c8b7768c66aeb492fb1f51d9ad5c3040ab243acc08f00dba8ec39c869ab453274f3969

Download Submit
C:\Windows\system\EWhBkYI.exe

Filesize
2.1MB

MD5
b69b0e92061373258e66756db6bcc132

SHA1
cfa0c43e9d8a0dbe969a08623935aad8e8c5617d

SHA256
e55d2085ed3a74ce627ea0c11f62869a6f975db42ec16e59d12e5fd44676c88f

SHA512
54dbd2f46b164e2591b0b206334fd5c9b7ca2af17fd62cc6cd8c509dcb668aa4eacdedaf8dc9e9709214e9cd551e8bd57be1e3d0270795963fbdbd7468684121

Download Submit
C:\Windows\system\FlIevCr.exe

Filesize
2.1MB

MD5
af92140e1c914e9c4dce0fa10dc19e04

SHA1
cd82481b3a51dba74300bb69664db12a8cf5df39

SHA256
95d4f32fc6715f008c3985e905e0163188e322a70c86b06cf6c7c2da3322d0ce

SHA512
4d2c5bf31e14cb97fe907b366c7edd575fe514b721de86ff374b3f532ed9c78c89e60deb3225230e0779e650ec9316ee72839b82ff6ab85a989ff76dc1df3b9a

Download Submit
C:\Windows\system\GHOXbEf.exe

Filesize
2.1MB

MD5
576be5cd4e56c5502d878038af0be9cc

SHA1
2b5b7474cf109618aede50dc67e2e16342dd98a5

SHA256
3d4c86ed0176a89f1a39cd5a8dc3b543406eda0ff22db4c006aaf4535d6eaa12

SHA512
6d2ac3e4119f979cc06ce212e0dd00432a7c61139d1ca8e5c10ad080b359e6f06e084565e4cbe684a2aef0b6e799739166f09cf994a8a5d361e9871b8aae9073

Download Submit
C:\Windows\system\GRRRNPO.exe

Filesize
2.1MB

MD5
08e05557281818c01addd448af7fc27e

SHA1
0977822011dd29aca95e48d721b07c2896853838

SHA256
d5224cb617c71172690de6e1255b5d63d83b83017c2a890f498021420e131941

SHA512
7e7ce015e4d85585c6032ececfd9bffcc3f6e0af0f7e1afd62be034e833463c099cbcd050780ed14bf2f8c9c4520968379e7641ede14e676bb07f76b6aaecbdf

Download Submit
C:\Windows\system\IzvLriA.exe

Filesize
2.1MB

MD5
ad6709affcfa47b3d39e4acc2a7af9c9

SHA1
7df6f2a4cb357268ff3f2b87779446cfd2daaa0e

SHA256
1614884d68732a367f4cb13fc549136e37cb7bf7e4b6c409b7aca8a213b7e3b3

SHA512
c4e5418a44edcba7b24926721bf412c283afd4d2ee3ec4f964f3b8a60ead4c3558763bdab8c73c744cf073557b334360d9251bc0e777518d5c95ce6cca2e6cb5

Download Submit
C:\Windows\system\KJqzKec.exe

Filesize
2.1MB

MD5
878f55dfac9dcdab5a288f5223dd49fe

SHA1
1c851eb8d49e063b9a8404b9aae98f666704d8de

SHA256
3c909c408c8494b0a39e74ea8cb4b84ed69ac48184a9a2f156f4babcc2197095

SHA512
9a544c53e48dc2f1a88526500fc9c10001e085966c7e67d0d52d5fbd6c4f010fdff02957e4b02eda8a051e00c6e077cc0dd6fab87d249b8b644c77ed406c158a

Download Submit
C:\Windows\system\OcGenGS.exe

Filesize
2.1MB

MD5
8237061519d9b9a67bffff428aaa84b1

SHA1
cadaa8df4cf9db70b656c4e48fac1fe4094823e5

SHA256
1e7628e8e90f0da82305a01b9054a12179bc32216d98b148f999eaf7ee48880a

SHA512
92976672e5850f5044264b2efeab2dc49b1a93bceaf81ebd9ccbf215f59ca7f9b9318c47cbd60b9abaad6ba4f5e1c9237eb37217e79921aaa2b4dcc7d8892d70

Download Submit
C:\Windows\system\QjgNIlA.exe

Filesize
2.1MB

MD5
a23c5b99d188e49ca17a0c6c7284e1e0

SHA1
cef88340ba87a66e004f1f6059feae8f17592049

SHA256
204881aafecf7cace0f3b44a6b5d080c01eded308ab1ab5ef1203c0499d52d15

SHA512
3144a8d500bc34761a68c4ddbbfc9be039de11d7c0292f52edb408172365c0ba6bc901844b2895f317f018b982be2f4f34a7bb6c28ee07645b063d9ef07b2222

Download Submit
C:\Windows\system\TIHNsct.exe

Filesize
2.1MB

MD5
dc329ef458f2e1ed4b9b5d05cdc8b667

SHA1
79eb7bdd0bc19a6e02250889b9819fc543774371

SHA256
8afc5ff90599064927f16ea6ef0829f41cce79dfca6f25670c6b34195edc2065

SHA512
2d43b161907133a14f63aaef4aca5eb127443b6be8c7be11783b0c6a2c78c702796845b6575f4de4c9641ed0e3ae7d1b5042a4776130be17cafeb38a478af5df

Download Submit
C:\Windows\system\UjUUcat.exe

Filesize
2.1MB

MD5
b0399ab209999bf15b41ef34ac3a1d36

SHA1
75f7cbc4c5327bf7c504a47931a9b84a969f1f85

SHA256
78a265f3ae7aa3f57a5988e5bdd8f38622a434ea137d801af61ff813e296ca56

SHA512
647c907988c5658ffe6a27a6d23235ef25c3f68b6aaff05db7cc5ae7cc64441f2db69bcf65b31a46c6353ed8518e4328c22062f158b2c6489d865e266798cc6d

Download Submit
C:\Windows\system\WWYNAcd.exe

Filesize
2.1MB

MD5
f7fce5d71e0bbbc02a0914fb0aec8669

SHA1
3339c03d8f9bb0f60ccde4caf211b57ea667191a

SHA256
ae85578fcfd599caeea5f88811329000e046dd73db90f1e40f13f36c7a59175a

SHA512
517f53743051a02c9ab268300fde366cc63ed1a907917ad10061e78c645727af0a190dc52a176f60d674b221047383767027a7c058b5e04926ebc20dea92fcf1

Download Submit
C:\Windows\system\WjdgQyC.exe

Filesize
2.1MB

MD5
b5911237b22aaf590c089364d3820445

SHA1
8bbae174a57318b4037ba1225d8866529650486c

SHA256
2c431b3ab5d341f6bad16df249bef57300f53c51d4894d5f066677e6f57dc091

SHA512
4436b38c1ebb2920feee0ec8168cb361bee3ca0d894fa1ad6e46b7004142ff23340d9f1f0dba0f0c002b76e7c5effcb969ac67a5f0b38d4f122e5d1f643a95ff

Download Submit
C:\Windows\system\aqqgulB.exe

Filesize
2.1MB

MD5
8b14c8a443c1cf312b9efe2e25c02c52

SHA1
12a30e570f6018a882f5ce92e37a2327bd1e6098

SHA256
1fcd3b9fb87089a6268d716d909c0e7acf4f623e8db84f7216e1bce1cb45d17a

SHA512
b080ba6e54cdf111a318c7f046acc21bf52677271791a17d5b30356cb264730ba3f6507f174a78b44a74469fb7ebecfd882a6385cd390ebda1285a207a7c84bf

Download Submit
C:\Windows\system\bKEEoUf.exe

Filesize
2.1MB

MD5
b49f7594acf43838cef5017186170fae

SHA1
1a299bf04b3987a73af1f4372f06c11679607b2f

SHA256
2c4aeca5ceb70e92f591068c6dc4a09fdd76ac41b5f8afb095f86c8007c17a71

SHA512
55cae0c43de34c4e306770ab7a6bab0e78ec829a894ae222a8c92faf4c1270b6b4b40a4eca049f94fa6a4be00885064910e974d67ae2589efe067dd30a04ec51

Download Submit
C:\Windows\system\beGOvnc.exe

Filesize
2.1MB

MD5
ea110ea7618c237ba2ab72a3dc6496fa

SHA1
af5fceae9f470b6432d18f47498697e306cf9856

SHA256
0cd8ea02d462c8b31801826dd983d1e1d3e604b4e2b8e96d33ae0b658a53f9c1

SHA512
5d2a1a68487d46cdf03249cacfebd05edc1973236e7ec450d976010bb187dd812d0e509cef096f99223210ca7af79440a6ae01af3cdf1d1901872b39f98613f7

Download Submit
C:\Windows\system\gMhmHXd.exe

Filesize
2.1MB

MD5
08d9b367af53f40e10fdcebf2547131f

SHA1
2cec9a4b9e91b61b7bf1374d915e0a27beeb4e12

SHA256
64076083bbcaec3744c739c869c37e744cd3055283ac0e1c9f950e409be98402

SHA512
afce77346b333388077ea420c97b46070779606c335886bb25a3a5a6c4ec13ebd182b0636ca8b272bb034f96e24b2ad3cd5b16320a1682a11783890d8a251fd0

Download Submit
C:\Windows\system\gSLNBVS.exe

Filesize
2.1MB

MD5
2ec94496e536c96f8fb155ed097567b8

SHA1
f4b4d0929d4c245677b49e45935fc522876461c6

SHA256
64db8d4dd9f1e7a1d1a471489bdc144d11c3bc6d9ae386f4d7e92292256c6ce9

SHA512
fd110920c0ccc75f33d924cc99329925c5a97255882c7e9aa6323448b901e7df065235c96ae80cd37d28ee26268ea82af22f90927ce3e3099d6f96b5ac73d8d7

Download Submit
C:\Windows\system\gaPpjuf.exe

Filesize
2.1MB

MD5
750a4a17dc0378d6cffe55bd6b26473f

SHA1
e57ffeca9c262b6b8c8c438434372f3d1906731f

SHA256
c85dda6849c4213426987005910e7f2aa650147d2b05787887a5b90fa4508d4d

SHA512
87217ebfbb5a8a636dd3de3021df7d2a74a3fac0f059808d2cdd9c7c265e58fabe905020280697762f24ae152c4ac9a7a12573f4fc385e0460d675a8a8997f67

Download Submit
C:\Windows\system\gjXQuXw.exe

Filesize
2.1MB

MD5
7b4a11353f6c1d4c5e2832c0d95cf794

SHA1
91c1761c5d7da90f846c6e40bb357bace84a1177

SHA256
32f2f3deadbc5cb6fda02dfe25b70347b81060259f710ab3d9210446fa27644c

SHA512
4b22d5f5887cc59058e22dcffbec561b83aebaa7c06e58b702f0a2bd09495dee7a95d00fc8402ecf78e1d0c9077bb5c83cd8fba82490d854ac936774124f91c7

Download Submit
C:\Windows\system\jdGGQIb.exe

Filesize
2.1MB

MD5
832d07cf243148b355883dc663a15edb

SHA1
20fd120209663613201b3f19b92b212944ac87ec

SHA256
2b60a6e7cc5e384a0b4f7e18332f642fa484af950497be743f611f16c88312d8

SHA512
cd0fe0e042b931ca86af599dc15b2ecd5f37ac7a2bd69f567467fab3a6d3d150193a44a94e241500533ae3469d8b3efa1e501fe4d541d285487d2f701880ff21

Download Submit
C:\Windows\system\pYGMLEu.exe

Filesize
2.1MB

MD5
fab3e5e8590083d85873bb4d6aa88b35

SHA1
d0960e55271bb44535a76e050d948c7dc2d3559e

SHA256
b3c68dd9450dcc3832e5e26ea63d5062be79a0dc28ffb9dfc5100cac27faa5f8

SHA512
079d06510de2749bd3fe75701ba6c92941c4a6c7f7c90df6e8b74afbb80c3f866df23f3e6b1fc083190bd02bc8974cdaade92c3bc2ba712b8672c7d12c2c6691

Download Submit
C:\Windows\system\pgyjDPl.exe

Filesize
8B

MD5
9b90da0a69e951cd462b1eb758815183

SHA1
63967807e9454c932d426e140e54cf54f4b96b3d

SHA256
fa873a129f14c00fb7bfb54baa970a28ebb7242cf2a4ad85b216b415ec2708e2

SHA512
5c6aa3117864a9850afb9ee701d079f1a9a6c02c3a295a6c6f410c0a3aeeb90c5a920fc2bd4e5d2b279ddc86486ff2b88838b785f2d8b70ef966bd1196adb8c2

Download Submit
C:\Windows\system\rjhTLNR.exe

Filesize
2.1MB

MD5
3366fc43ea0d2297815566b1b41dea88

SHA1
beed4da8523e2947b33ad1b0c380552fd42f8192

SHA256
76848a5f5261e9918c805cfe324e183c67d531d371d8f5c2a47c216aee44f8b2

SHA512
c727d56d524b201e6e7c17e08a52972c956cb808b81adb0bd931bc34e967e6e9977dccd68c7efe4af149de61d1faf8b9b23f113fa9540b1e9221be1d530ba62e

Download Submit
C:\Windows\system\sBHOkwF.exe

Filesize
2.1MB

MD5
79587ebdb6ee5e55f64fc73a6db23c36

SHA1
a62a2e13a39ccda0ede7f70256b2d6b468db05dd

SHA256
230d66e872b87132773b35d3babf6582ebc980622f2744411a887f5aea75d7d7

SHA512
e78d8a00e7424a437337180266f8fd551a8bae57b0098c9f0f78905a4c8b3181692bc66fd793d142354c80d95c3a83cdddb7e65d868058e760c483333962993b

Download Submit
C:\Windows\system\tXoYGtl.exe

Filesize
2.1MB

MD5
95589438092e4f86e18958d5679815b7

SHA1
32d5333020def6886c5cb46b2f7d7ca3958631cb

SHA256
102d8852df9bca367712743d0e2f4590f9fe2b9f6caf25948a4cc3ebe0cda991

SHA512
8fd1257dd077fff58f611602e39df87d6587e0131d287c10698af1a27079a352141512b47430ea9382933446b7c0373b1c38855bfe146e9ae4a9f938308184a4

Download Submit
C:\Windows\system\wmTlMBL.exe

Filesize
2.1MB

MD5
5efd5c15c05ed94587221b32cfe02120

SHA1
56f445853a016ad7dc75bdbb62cda76eb1b4a8ca

SHA256
0da0dd462f9556939165bde51b7249a5af1321e082d8ce91c61bda47aac72f5a

SHA512
a59789297617a38ed5e2a24074348bd09f4acf31f4f39cfa4f71ade22ad4a5a6fcabc83a75ef001f5bd018e691323f67a70a60422a36524549816135f65419ad

Download Submit
C:\Windows\system\yDTVGMd.exe

Filesize
2.1MB

MD5
e1be27c20677221e05ffb969815fc7d0

SHA1
5e34f50dcf237f212fe7030fdd3373021cb881b6

SHA256
22546c2e8f03c42fc616c697ec3457749c231be966814a797d5b5c96ab761e01

SHA512
6d67aff725d43b513640a3a90fa184b677c8f6a6c5b3c96e348b24d2fb19a304a618de7a507e7c759fb57a35903c1ef0b942345eb565796998935676aa5e04b7

Download Submit
C:\Windows\system\ysVQEEm.exe

Filesize
2.1MB

MD5
5be523cbb006a5cb8d905667b91eed68

SHA1
8d4b97eb7afc9605cf26dfb8f18f97130e8c171f

SHA256
bc9a6139d94e19e829a775ca7cac99cac7ee9829ffcc88567ecd4e690a924323

SHA512
de7dacd95209c678ae4e42bfd228190af705b40cd4f15a42ac6ed6b37aac6841eff9de5c994c92281a97162ae705131afc11963628bc7792ee01d2a6f186aaef

Download Submit
C:\Windows\system\zotrOKj.exe

Filesize
2.1MB

MD5
97c5be5ae20609846c2a542e27d4a34b

SHA1
ff99bdfb2853d05a3e098225742662c3d41429f4

SHA256
eccd3801da695bccdad57cad7b2a799b7141eb756fc6ccb46c33145e85ac9910

SHA512
2dae4641c1bc6b752547e8fe23794484b3af896836c4f057ce2a70fe881c2900519209124c8032917083149d4a92e140cd9e2b79075e5403f837e1609032e7eb

Download Submit
\Windows\system\WtFTRrA.exe

Filesize
2.1MB

MD5
db1d9009a8ffdaa629d4e6560b08cc5b

SHA1
a3b8e036717736d2bd7dd869ff0c0b9f3cad4d71

SHA256
72d0eba5b8186ad10fa511e113adef88145453b46b577a0b304ad6f3d31a64b0

SHA512
0d696a8a5b2471820e07f52a8ab7bfc2768ac76b905929a359a977fd036aebcb763cbcc874beceade6ba5a17778788d10d8960f0cf693ce965ae7a4de7f18ed7

Download Submit
\Windows\system\hwgKRQu.exe

Filesize
2.1MB

MD5
f0b748ae56c11dc5ba5242405229cbf5

SHA1
5eb5da8d20c194012c521b627bcd41a23c77f262

SHA256
fa6e3a06f8dd47665dc74157a2c56feadd3dab070840b2773d4cbda64d843490

SHA512
14417e12033351b9a19a6b7ff2ebf4e882549deb385a459aebde7829098fccba8fa0436bb277dd9d372e2224107aa04e8d92b6bd0286121f5aa9bc363936f8e0

Download Submit
memory/1488-147-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/1488-5060-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/1836-158-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1836-5087-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2016-5076-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2016-12-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2036-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2036-24-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2036-152-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-1-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2036-154-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2036-14-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-150-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2036-157-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2036-146-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2036-148-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-11-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2036-159-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2036-144-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2200-2975-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-183-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2200-142-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-94-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/2200-28-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/2200-29-0x000007FEF556E000-0x000007FEF556F000-memory.dmp

Filesize
4KB

Download
memory/2476-153-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-5053-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-151-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2520-4746-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2536-5082-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2536-155-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2580-143-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2580-5064-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2628-149-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-5056-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-27-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2680-5066-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2768-5072-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2768-145-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/3028-5051-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-156-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/3032-15-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download