xmrig | 5fe7256f31771e3987e9826fa9d184a575e0651d52024cb35c12ac95fd095cec

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28/07/2024, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
Size

2.2MB
MD5

03c71b31d54c4af96341e395d350e66f
SHA1

7151a6d33878de441f5cf791469afd095ee94d01
SHA256

5fe7256f31771e3987e9826fa9d184a575e0651d52024cb35c12ac95fd095cec
SHA512

18035c37db45b76423a68a8e45e17c0769ea0cb944453f6faa2db62804a9e1a79564771acf6ece60122a27fff88ebf8e0e78ddfaf30cd1581049ab59511f3451
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMvwWBB:NABB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral1/memory/2740-16-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2860-31-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2684-26-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2524-51-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/848-50-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/1148-63-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2136-77-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/540-84-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2716-83-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/1268-91-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/3064-1019-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2812-99-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2376-70-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/3064-59-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2716-53-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/3064-3073-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/1148-3115-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2524-3108-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/2740-3107-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/1268-3106-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2376-3114-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2860-3113-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2136-3112-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/848-3104-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2684-3292-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2812-5382-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/540-5384-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1924	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2740	hGFWSgq.exe
2684	OerZQGo.exe
2860	KHSllup.exe
848	qqJBTmm.exe
2524	XwCKgvx.exe
3064	xEHPsRA.exe
1148	DNLEtlL.exe
2376	kjYTmax.exe
2136	WGKFWib.exe
540	EoAzUeq.exe
1268	woQYXOn.exe
2812	VZvFjtm.exe
1388	GVffWVb.exe
444	kBNGMit.exe
2332	lWWpGnO.exe
1920	cXNCzaM.exe
1876	syYMTfp.exe
1608	MjdaHVh.exe
532	aesZgsW.exe
1880	oYRQMTX.exe
1424	xXSAXCi.exe
2212	cAJCyxI.exe
2188	knddupW.exe
1364	sdfXuFh.exe
2072	ihMynZb.exe
2272	mYUAomH.exe
1156	kptrIhw.exe
2208	AkhXojH.exe
2068	TmIWtEk.exe
1092	MolXTOq.exe
2372	nAigQXt.exe
1536	EQfMaKE.exe
1532	ZxjKcFj.exe
2664	RVPaBvx.exe
1780	weFfgnS.exe
1760	tSsBasn.exe
1012	VsJhGSw.exe
2288	zdeYiRS.exe
1976	iUJjeii.exe
2996	MROwWim.exe
2984	CxECHPU.exe
3044	GoYhCvF.exe
1248	OCelvux.exe
1296	IhwZCSw.exe
1272	cOsKwcN.exe
2256	dcYGNlD.exe
1084	OTJDZHH.exe
1584	ROSEGVr.exe
2460	gljcRiM.exe
2728	anwkavy.exe
2528	cATIOCU.exe
2544	nbGVLzF.exe
2588	XRHljXH.exe
2540	aRqoETZ.exe
604	YzYOfto.exe
2948	uSzIJVx.exe
2244	gougTVR.exe
1236	iKQjCgV.exe
2848	NlQEypx.exe
2008	WJmUJKa.exe
284	cKHOKrN.exe
2428	SmmuUKW.exe
1696	dkiqaNY.exe
2364	AOicvLG.exe

Loads dropped DLL 64 IoCs

pid	Process
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2716-0-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/files/0x00070000000120fe-5.dat	upx
behavioral1/files/0x00070000000195f7-18.dat	upx
behavioral1/memory/2740-16-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/files/0x00070000000195f9-19.dat	upx
behavioral1/memory/2860-31-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2684-26-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-43.dat	upx
behavioral1/memory/2524-51-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/memory/848-50-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/files/0x0006000000019601-55.dat	upx
behavioral1/memory/1148-63-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/files/0x0008000000019616-74.dat	upx
behavioral1/memory/2136-77-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/files/0x000500000001a4b7-80.dat	upx
behavioral1/memory/540-84-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2716-83-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/1268-91-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/files/0x000500000001a4bd-103.dat	upx
behavioral1/files/0x000500000001a4bf-107.dat	upx
behavioral1/files/0x000500000001a4cd-142.dat	upx
behavioral1/files/0x000500000001a4d0-148.dat	upx
behavioral1/files/0x000500000001a4da-172.dat	upx
behavioral1/files/0x000500000001a4e3-192.dat	upx
behavioral1/memory/3064-1019-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/files/0x000500000001a4e9-198.dat	upx
behavioral1/files/0x000500000001a4e1-188.dat	upx
behavioral1/files/0x000500000001a4df-182.dat	upx
behavioral1/files/0x000500000001a4dd-178.dat	upx
behavioral1/files/0x000500000001a4d8-168.dat	upx
behavioral1/files/0x000500000001a4d6-162.dat	upx
behavioral1/files/0x000500000001a4d4-158.dat	upx
behavioral1/files/0x000500000001a4d2-151.dat	upx
behavioral1/files/0x000500000001a4cb-137.dat	upx
behavioral1/files/0x000500000001a4c9-133.dat	upx
behavioral1/files/0x000500000001a4c7-127.dat	upx
behavioral1/files/0x000500000001a4c3-117.dat	upx
behavioral1/files/0x000500000001a4c5-123.dat	upx
behavioral1/files/0x000500000001a4c1-113.dat	upx
behavioral1/memory/2812-99-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/files/0x000500000001a4bb-94.dat	upx
behavioral1/files/0x000500000001a4b9-88.dat	upx
behavioral1/memory/2376-70-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/files/0x0006000000019603-67.dat	upx
behavioral1/memory/3064-59-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/files/0x00070000000195ff-52.dat	upx
behavioral1/files/0x002d000000019565-41.dat	upx
behavioral1/memory/3064-3073-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/1148-3115-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2524-3108-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/memory/2740-3107-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/1268-3106-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2376-3114-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2860-3113-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2136-3112-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/848-3104-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2684-3292-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2812-5382-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/540-5384-0x000000013F920000-0x000000013FD12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JBRAXka.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\TGYfhMJ.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\jMoXoyO.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\yiJPXLp.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\cKSsOZc.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\pHOvBTN.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\XrXWsxn.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\VFPeopX.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\WZZRYqu.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\YyBcFRh.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\BFLwwVk.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\XWeBqQA.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\aHShyOQ.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\BxgQhuZ.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\bEeCqoV.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\fnuxdbI.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\rcXUiVi.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\cBhddGk.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\BjFPmxO.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\IqXlVOv.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\IEApshh.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\MtiTgVP.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\eHtJsha.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\FgYRnvw.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\VIBAgRp.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\fGzWNyw.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\srvJKpe.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\OGPHNrF.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\vPYJQcf.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\UxNOWXI.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\mPYCDuQ.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\DqRrXYD.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\EUsZKHc.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\CpOmCAj.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\rxXOsBS.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\HKKBXRy.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\ZhIgNip.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\kRofjbX.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\EzAkvYH.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\mZHNaHX.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\DZCcRmi.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\haLNRZS.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\OKKdoZa.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\QxVJHfe.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\UoCnreV.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\xnyvwQq.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\RETzBqg.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\bmoQENz.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\WDMVHyo.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\JqeCCxA.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\JNVqpgp.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\yMuxora.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\PtkXqAw.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\JXDPBCG.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\dCayJMX.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\QBKjpJi.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\HDdfcXS.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\aWHHXLj.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\nolltKi.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\bcVAmQq.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\anwkavy.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\srYsxIb.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\eRGyIoy.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\SLFtObM.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1924	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
Token: SeDebugPrivilege	1924	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 1924	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	31
PID 2716 wrote to memory of 1924	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	31
PID 2716 wrote to memory of 1924	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	31
PID 2716 wrote to memory of 2740	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	32
PID 2716 wrote to memory of 2740	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	32
PID 2716 wrote to memory of 2740	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	32
PID 2716 wrote to memory of 2684	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	33
PID 2716 wrote to memory of 2684	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	33
PID 2716 wrote to memory of 2684	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	33
PID 2716 wrote to memory of 2860	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	34
PID 2716 wrote to memory of 2860	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	34
PID 2716 wrote to memory of 2860	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	34
PID 2716 wrote to memory of 2524	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	35
PID 2716 wrote to memory of 2524	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	35
PID 2716 wrote to memory of 2524	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	35
PID 2716 wrote to memory of 848	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	36
PID 2716 wrote to memory of 848	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	36
PID 2716 wrote to memory of 848	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	36
PID 2716 wrote to memory of 3064	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	37
PID 2716 wrote to memory of 3064	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	37
PID 2716 wrote to memory of 3064	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	37
PID 2716 wrote to memory of 1148	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	38
PID 2716 wrote to memory of 1148	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	38
PID 2716 wrote to memory of 1148	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	38
PID 2716 wrote to memory of 2376	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	39
PID 2716 wrote to memory of 2376	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	39
PID 2716 wrote to memory of 2376	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	39
PID 2716 wrote to memory of 2136	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	40
PID 2716 wrote to memory of 2136	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	40
PID 2716 wrote to memory of 2136	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	40
PID 2716 wrote to memory of 540	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	41
PID 2716 wrote to memory of 540	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	41
PID 2716 wrote to memory of 540	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	41
PID 2716 wrote to memory of 1268	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	42
PID 2716 wrote to memory of 1268	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	42
PID 2716 wrote to memory of 1268	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	42
PID 2716 wrote to memory of 2812	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	43
PID 2716 wrote to memory of 2812	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	43
PID 2716 wrote to memory of 2812	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	43
PID 2716 wrote to memory of 1388	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	44
PID 2716 wrote to memory of 1388	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	44
PID 2716 wrote to memory of 1388	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	44
PID 2716 wrote to memory of 444	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	45
PID 2716 wrote to memory of 444	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	45
PID 2716 wrote to memory of 444	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	45
PID 2716 wrote to memory of 2332	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	46
PID 2716 wrote to memory of 2332	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	46
PID 2716 wrote to memory of 2332	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	46
PID 2716 wrote to memory of 1920	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	47
PID 2716 wrote to memory of 1920	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	47
PID 2716 wrote to memory of 1920	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	47
PID 2716 wrote to memory of 1876	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	48
PID 2716 wrote to memory of 1876	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	48
PID 2716 wrote to memory of 1876	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	48
PID 2716 wrote to memory of 1608	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	49
PID 2716 wrote to memory of 1608	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	49
PID 2716 wrote to memory of 1608	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	49
PID 2716 wrote to memory of 532	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	50
PID 2716 wrote to memory of 532	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	50
PID 2716 wrote to memory of 532	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	50
PID 2716 wrote to memory of 1880	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	51
PID 2716 wrote to memory of 1880	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	51
PID 2716 wrote to memory of 1880	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	51
PID 2716 wrote to memory of 1424	2716	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\System\hGFWSgq.exe
  C:\Windows\System\hGFWSgq.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\OerZQGo.exe
  C:\Windows\System\OerZQGo.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\KHSllup.exe
  C:\Windows\System\KHSllup.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\XwCKgvx.exe
  C:\Windows\System\XwCKgvx.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\qqJBTmm.exe
  C:\Windows\System\qqJBTmm.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\xEHPsRA.exe
  C:\Windows\System\xEHPsRA.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\DNLEtlL.exe
  C:\Windows\System\DNLEtlL.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\kjYTmax.exe
  C:\Windows\System\kjYTmax.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\WGKFWib.exe
  C:\Windows\System\WGKFWib.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\EoAzUeq.exe
  C:\Windows\System\EoAzUeq.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\woQYXOn.exe
  C:\Windows\System\woQYXOn.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\VZvFjtm.exe
  C:\Windows\System\VZvFjtm.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\GVffWVb.exe
  C:\Windows\System\GVffWVb.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\kBNGMit.exe
  C:\Windows\System\kBNGMit.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\lWWpGnO.exe
  C:\Windows\System\lWWpGnO.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\cXNCzaM.exe
  C:\Windows\System\cXNCzaM.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\syYMTfp.exe
  C:\Windows\System\syYMTfp.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\MjdaHVh.exe
  C:\Windows\System\MjdaHVh.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\aesZgsW.exe
  C:\Windows\System\aesZgsW.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\oYRQMTX.exe
  C:\Windows\System\oYRQMTX.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\xXSAXCi.exe
  C:\Windows\System\xXSAXCi.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\cAJCyxI.exe
  C:\Windows\System\cAJCyxI.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\knddupW.exe
  C:\Windows\System\knddupW.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\sdfXuFh.exe
  C:\Windows\System\sdfXuFh.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\ihMynZb.exe
  C:\Windows\System\ihMynZb.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\mYUAomH.exe
  C:\Windows\System\mYUAomH.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\kptrIhw.exe
  C:\Windows\System\kptrIhw.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\AkhXojH.exe
  C:\Windows\System\AkhXojH.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\TmIWtEk.exe
  C:\Windows\System\TmIWtEk.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\MolXTOq.exe
  C:\Windows\System\MolXTOq.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\nAigQXt.exe
  C:\Windows\System\nAigQXt.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\EQfMaKE.exe
  C:\Windows\System\EQfMaKE.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\ZxjKcFj.exe
  C:\Windows\System\ZxjKcFj.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\RVPaBvx.exe
  C:\Windows\System\RVPaBvx.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\weFfgnS.exe
  C:\Windows\System\weFfgnS.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\tSsBasn.exe
  C:\Windows\System\tSsBasn.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\VsJhGSw.exe
  C:\Windows\System\VsJhGSw.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\zdeYiRS.exe
  C:\Windows\System\zdeYiRS.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\iUJjeii.exe
  C:\Windows\System\iUJjeii.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\MROwWim.exe
  C:\Windows\System\MROwWim.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\CxECHPU.exe
  C:\Windows\System\CxECHPU.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\GoYhCvF.exe
  C:\Windows\System\GoYhCvF.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\OCelvux.exe
  C:\Windows\System\OCelvux.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\IhwZCSw.exe
  C:\Windows\System\IhwZCSw.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\cOsKwcN.exe
  C:\Windows\System\cOsKwcN.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\dcYGNlD.exe
  C:\Windows\System\dcYGNlD.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\OTJDZHH.exe
  C:\Windows\System\OTJDZHH.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\ROSEGVr.exe
  C:\Windows\System\ROSEGVr.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\gljcRiM.exe
  C:\Windows\System\gljcRiM.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\anwkavy.exe
  C:\Windows\System\anwkavy.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\cATIOCU.exe
  C:\Windows\System\cATIOCU.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\nbGVLzF.exe
  C:\Windows\System\nbGVLzF.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\XRHljXH.exe
  C:\Windows\System\XRHljXH.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\aRqoETZ.exe
  C:\Windows\System\aRqoETZ.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\YzYOfto.exe
  C:\Windows\System\YzYOfto.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\uSzIJVx.exe
  C:\Windows\System\uSzIJVx.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\gougTVR.exe
  C:\Windows\System\gougTVR.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\iKQjCgV.exe
  C:\Windows\System\iKQjCgV.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\NlQEypx.exe
  C:\Windows\System\NlQEypx.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\WJmUJKa.exe
  C:\Windows\System\WJmUJKa.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\cKHOKrN.exe
  C:\Windows\System\cKHOKrN.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\SmmuUKW.exe
  C:\Windows\System\SmmuUKW.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\dkiqaNY.exe
  C:\Windows\System\dkiqaNY.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\AOicvLG.exe
  C:\Windows\System\AOicvLG.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\KshCiCx.exe
  C:\Windows\System\KshCiCx.exe
  2⤵
  PID:2148
- C:\Windows\System\PoBOIyr.exe
  C:\Windows\System\PoBOIyr.exe
  2⤵
  PID:2308
- C:\Windows\System\KJmORan.exe
  C:\Windows\System\KJmORan.exe
  2⤵
  PID:3068
- C:\Windows\System\JxqpsGo.exe
  C:\Windows\System\JxqpsGo.exe
  2⤵
  PID:2100
- C:\Windows\System\muFtJGd.exe
  C:\Windows\System\muFtJGd.exe
  2⤵
  PID:2112
- C:\Windows\System\qnGfAvC.exe
  C:\Windows\System\qnGfAvC.exe
  2⤵
  PID:1664
- C:\Windows\System\ettmfKt.exe
  C:\Windows\System\ettmfKt.exe
  2⤵
  PID:3012
- C:\Windows\System\ZuEujKR.exe
  C:\Windows\System\ZuEujKR.exe
  2⤵
  PID:1496
- C:\Windows\System\ldyFyTP.exe
  C:\Windows\System\ldyFyTP.exe
  2⤵
  PID:1548
- C:\Windows\System\BVXBPzy.exe
  C:\Windows\System\BVXBPzy.exe
  2⤵
  PID:1936
- C:\Windows\System\vzxOVlP.exe
  C:\Windows\System\vzxOVlP.exe
  2⤵
  PID:1928
- C:\Windows\System\rxXOsBS.exe
  C:\Windows\System\rxXOsBS.exe
  2⤵
  PID:1704
- C:\Windows\System\GhzXiwv.exe
  C:\Windows\System\GhzXiwv.exe
  2⤵
  PID:2988
- C:\Windows\System\FIblfjD.exe
  C:\Windows\System\FIblfjD.exe
  2⤵
  PID:2436
- C:\Windows\System\zlKZONk.exe
  C:\Windows\System\zlKZONk.exe
  2⤵
  PID:744
- C:\Windows\System\qGLEIfv.exe
  C:\Windows\System\qGLEIfv.exe
  2⤵
  PID:2604
- C:\Windows\System\whkjMfj.exe
  C:\Windows\System\whkjMfj.exe
  2⤵
  PID:2236
- C:\Windows\System\CCWmqzJ.exe
  C:\Windows\System\CCWmqzJ.exe
  2⤵
  PID:2252
- C:\Windows\System\wQGGhvE.exe
  C:\Windows\System\wQGGhvE.exe
  2⤵
  PID:2116
- C:\Windows\System\OYIEXGz.exe
  C:\Windows\System\OYIEXGz.exe
  2⤵
  PID:2080
- C:\Windows\System\hwcdjXh.exe
  C:\Windows\System\hwcdjXh.exe
  2⤵
  PID:572
- C:\Windows\System\jcQJbYt.exe
  C:\Windows\System\jcQJbYt.exe
  2⤵
  PID:348
- C:\Windows\System\ndUCKcE.exe
  C:\Windows\System\ndUCKcE.exe
  2⤵
  PID:2508
- C:\Windows\System\hXWUybW.exe
  C:\Windows\System\hXWUybW.exe
  2⤵
  PID:2808
- C:\Windows\System\ICFedNr.exe
  C:\Windows\System\ICFedNr.exe
  2⤵
  PID:2580
- C:\Windows\System\FUSOvSm.exe
  C:\Windows\System\FUSOvSm.exe
  2⤵
  PID:264
- C:\Windows\System\uXHULHH.exe
  C:\Windows\System\uXHULHH.exe
  2⤵
  PID:2340
- C:\Windows\System\yebDGiv.exe
  C:\Windows\System\yebDGiv.exe
  2⤵
  PID:2196
- C:\Windows\System\DgatYlx.exe
  C:\Windows\System\DgatYlx.exe
  2⤵
  PID:2092
- C:\Windows\System\AiNtQxA.exe
  C:\Windows\System\AiNtQxA.exe
  2⤵
  PID:2032
- C:\Windows\System\kpeKxni.exe
  C:\Windows\System\kpeKxni.exe
  2⤵
  PID:904
- C:\Windows\System\WLTAaMk.exe
  C:\Windows\System\WLTAaMk.exe
  2⤵
  PID:1932
- C:\Windows\System\FzeUcQq.exe
  C:\Windows\System\FzeUcQq.exe
  2⤵
  PID:1808
- C:\Windows\System\lAgjRVA.exe
  C:\Windows\System\lAgjRVA.exe
  2⤵
  PID:1700
- C:\Windows\System\EWubsdx.exe
  C:\Windows\System\EWubsdx.exe
  2⤵
  PID:2892
- C:\Windows\System\lHQLzQu.exe
  C:\Windows\System\lHQLzQu.exe
  2⤵
  PID:2408
- C:\Windows\System\bEmuify.exe
  C:\Windows\System\bEmuify.exe
  2⤵
  PID:2552
- C:\Windows\System\LlRrKhw.exe
  C:\Windows\System\LlRrKhw.exe
  2⤵
  PID:2700
- C:\Windows\System\LWnqqmq.exe
  C:\Windows\System\LWnqqmq.exe
  2⤵
  PID:2788
- C:\Windows\System\UmOzfNO.exe
  C:\Windows\System\UmOzfNO.exe
  2⤵
  PID:2820
- C:\Windows\System\dGEnBUW.exe
  C:\Windows\System\dGEnBUW.exe
  2⤵
  PID:2644
- C:\Windows\System\RdAMXJl.exe
  C:\Windows\System\RdAMXJl.exe
  2⤵
  PID:1240
- C:\Windows\System\zdtFgNc.exe
  C:\Windows\System\zdtFgNc.exe
  2⤵
  PID:2400
- C:\Windows\System\SbBLcRN.exe
  C:\Windows\System\SbBLcRN.exe
  2⤵
  PID:2768
- C:\Windows\System\ngrutBG.exe
  C:\Windows\System\ngrutBG.exe
  2⤵
  PID:1900
- C:\Windows\System\WCXKRNb.exe
  C:\Windows\System\WCXKRNb.exe
  2⤵
  PID:988
- C:\Windows\System\fWQqxmc.exe
  C:\Windows\System\fWQqxmc.exe
  2⤵
  PID:1520
- C:\Windows\System\IYrsuzZ.exe
  C:\Windows\System\IYrsuzZ.exe
  2⤵
  PID:1944
- C:\Windows\System\rEiJKrq.exe
  C:\Windows\System\rEiJKrq.exe
  2⤵
  PID:2936
- C:\Windows\System\bEIUJmW.exe
  C:\Windows\System\bEIUJmW.exe
  2⤵
  PID:2348
- C:\Windows\System\nXFJMoX.exe
  C:\Windows\System\nXFJMoX.exe
  2⤵
  PID:2960
- C:\Windows\System\XzMXSPt.exe
  C:\Windows\System\XzMXSPt.exe
  2⤵
  PID:1632
- C:\Windows\System\FJnoKtF.exe
  C:\Windows\System\FJnoKtF.exe
  2⤵
  PID:2444
- C:\Windows\System\gtRxoIt.exe
  C:\Windows\System\gtRxoIt.exe
  2⤵
  PID:2568
- C:\Windows\System\UroFhsY.exe
  C:\Windows\System\UroFhsY.exe
  2⤵
  PID:1076
- C:\Windows\System\rdeRZCL.exe
  C:\Windows\System\rdeRZCL.exe
  2⤵
  PID:2192
- C:\Windows\System\nsUkPAL.exe
  C:\Windows\System\nsUkPAL.exe
  2⤵
  PID:1620
- C:\Windows\System\zeRiopn.exe
  C:\Windows\System\zeRiopn.exe
  2⤵
  PID:2868
- C:\Windows\System\MbkEIvj.exe
  C:\Windows\System\MbkEIvj.exe
  2⤵
  PID:2932
- C:\Windows\System\sddFVws.exe
  C:\Windows\System\sddFVws.exe
  2⤵
  PID:2420
- C:\Windows\System\MlpBWDQ.exe
  C:\Windows\System\MlpBWDQ.exe
  2⤵
  PID:2084
- C:\Windows\System\WpLxKgq.exe
  C:\Windows\System\WpLxKgq.exe
  2⤵
  PID:2468
- C:\Windows\System\IlZAXqp.exe
  C:\Windows\System\IlZAXqp.exe
  2⤵
  PID:1096
- C:\Windows\System\zplmimB.exe
  C:\Windows\System\zplmimB.exe
  2⤵
  PID:2704
- C:\Windows\System\RyqwyuV.exe
  C:\Windows\System\RyqwyuV.exe
  2⤵
  PID:2296
- C:\Windows\System\MtiTgVP.exe
  C:\Windows\System\MtiTgVP.exe
  2⤵
  PID:3004
- C:\Windows\System\dLbSqOQ.exe
  C:\Windows\System\dLbSqOQ.exe
  2⤵
  PID:2596
- C:\Windows\System\TGVmcfL.exe
  C:\Windows\System\TGVmcfL.exe
  2⤵
  PID:3040
- C:\Windows\System\WRhQQHm.exe
  C:\Windows\System\WRhQQHm.exe
  2⤵
  PID:2760
- C:\Windows\System\oOrcbDw.exe
  C:\Windows\System\oOrcbDw.exe
  2⤵
  PID:3028
- C:\Windows\System\fdgeUOQ.exe
  C:\Windows\System\fdgeUOQ.exe
  2⤵
  PID:1708
- C:\Windows\System\NlQLEmP.exe
  C:\Windows\System\NlQLEmP.exe
  2⤵
  PID:2424
- C:\Windows\System\UdUXaPo.exe
  C:\Windows\System\UdUXaPo.exe
  2⤵
  PID:1896
- C:\Windows\System\eFBiXYp.exe
  C:\Windows\System\eFBiXYp.exe
  2⤵
  PID:812
- C:\Windows\System\qevotYl.exe
  C:\Windows\System\qevotYl.exe
  2⤵
  PID:1560
- C:\Windows\System\ixqwHEq.exe
  C:\Windows\System\ixqwHEq.exe
  2⤵
  PID:2124
- C:\Windows\System\AUKLbLp.exe
  C:\Windows\System\AUKLbLp.exe
  2⤵
  PID:356
- C:\Windows\System\nYfxBeh.exe
  C:\Windows\System\nYfxBeh.exe
  2⤵
  PID:1884
- C:\Windows\System\DNHDdqt.exe
  C:\Windows\System\DNHDdqt.exe
  2⤵
  PID:2692
- C:\Windows\System\zQCSjFF.exe
  C:\Windows\System\zQCSjFF.exe
  2⤵
  PID:2840
- C:\Windows\System\tdmfVVp.exe
  C:\Windows\System\tdmfVVp.exe
  2⤵
  PID:664
- C:\Windows\System\Htiehle.exe
  C:\Windows\System\Htiehle.exe
  2⤵
  PID:1912
- C:\Windows\System\eRIPbgE.exe
  C:\Windows\System\eRIPbgE.exe
  2⤵
  PID:1356
- C:\Windows\System\MNSuWrn.exe
  C:\Windows\System\MNSuWrn.exe
  2⤵
  PID:1160
- C:\Windows\System\xEaSYOb.exe
  C:\Windows\System\xEaSYOb.exe
  2⤵
  PID:2064
- C:\Windows\System\DtOdPPa.exe
  C:\Windows\System\DtOdPPa.exe
  2⤵
  PID:1484
- C:\Windows\System\nDBipOH.exe
  C:\Windows\System\nDBipOH.exe
  2⤵
  PID:1220
- C:\Windows\System\BHFZfWN.exe
  C:\Windows\System\BHFZfWN.exe
  2⤵
  PID:2184
- C:\Windows\System\WcBTDzU.exe
  C:\Windows\System\WcBTDzU.exe
  2⤵
  PID:1360
- C:\Windows\System\nvhHjng.exe
  C:\Windows\System\nvhHjng.exe
  2⤵
  PID:2720
- C:\Windows\System\yYAOzCs.exe
  C:\Windows\System\yYAOzCs.exe
  2⤵
  PID:2816
- C:\Windows\System\gZDeYTf.exe
  C:\Windows\System\gZDeYTf.exe
  2⤵
  PID:1552
- C:\Windows\System\itFwgDl.exe
  C:\Windows\System\itFwgDl.exe
  2⤵
  PID:2940
- C:\Windows\System\FkPxkne.exe
  C:\Windows\System\FkPxkne.exe
  2⤵
  PID:1612
- C:\Windows\System\ilIClOW.exe
  C:\Windows\System\ilIClOW.exe
  2⤵
  PID:2388
- C:\Windows\System\fpgYDXu.exe
  C:\Windows\System\fpgYDXu.exe
  2⤵
  PID:2600
- C:\Windows\System\PiDtnll.exe
  C:\Windows\System\PiDtnll.exe
  2⤵
  PID:2660
- C:\Windows\System\NCuQenW.exe
  C:\Windows\System\NCuQenW.exe
  2⤵
  PID:448
- C:\Windows\System\eAbauza.exe
  C:\Windows\System\eAbauza.exe
  2⤵
  PID:2956
- C:\Windows\System\HxSPyvd.exe
  C:\Windows\System\HxSPyvd.exe
  2⤵
  PID:872
- C:\Windows\System\MKEnYUi.exe
  C:\Windows\System\MKEnYUi.exe
  2⤵
  PID:804
- C:\Windows\System\DsJPQKi.exe
  C:\Windows\System\DsJPQKi.exe
  2⤵
  PID:1120
- C:\Windows\System\QwUXVBP.exe
  C:\Windows\System\QwUXVBP.exe
  2⤵
  PID:2780
- C:\Windows\System\LaWkpHh.exe
  C:\Windows\System\LaWkpHh.exe
  2⤵
  PID:3020
- C:\Windows\System\SUTZejV.exe
  C:\Windows\System\SUTZejV.exe
  2⤵
  PID:964
- C:\Windows\System\PoNDmun.exe
  C:\Windows\System\PoNDmun.exe
  2⤵
  PID:2344
- C:\Windows\System\IOtEPgW.exe
  C:\Windows\System\IOtEPgW.exe
  2⤵
  PID:1460
- C:\Windows\System\KGIGtzD.exe
  C:\Windows\System\KGIGtzD.exe
  2⤵
  PID:3076
- C:\Windows\System\hAbuKvx.exe
  C:\Windows\System\hAbuKvx.exe
  2⤵
  PID:3092
- C:\Windows\System\lkArxov.exe
  C:\Windows\System\lkArxov.exe
  2⤵
  PID:3108
- C:\Windows\System\maxzTFS.exe
  C:\Windows\System\maxzTFS.exe
  2⤵
  PID:3124
- C:\Windows\System\ntwrDZu.exe
  C:\Windows\System\ntwrDZu.exe
  2⤵
  PID:3140
- C:\Windows\System\KQcspqd.exe
  C:\Windows\System\KQcspqd.exe
  2⤵
  PID:3156
- C:\Windows\System\EgxoueF.exe
  C:\Windows\System\EgxoueF.exe
  2⤵
  PID:3176
- C:\Windows\System\wFLFOTL.exe
  C:\Windows\System\wFLFOTL.exe
  2⤵
  PID:3192
- C:\Windows\System\VIBAgRp.exe
  C:\Windows\System\VIBAgRp.exe
  2⤵
  PID:3208
- C:\Windows\System\ugDrCMq.exe
  C:\Windows\System\ugDrCMq.exe
  2⤵
  PID:3224
- C:\Windows\System\aiSMfIa.exe
  C:\Windows\System\aiSMfIa.exe
  2⤵
  PID:3244
- C:\Windows\System\UkCRtpB.exe
  C:\Windows\System\UkCRtpB.exe
  2⤵
  PID:3260
- C:\Windows\System\TyxqyTo.exe
  C:\Windows\System\TyxqyTo.exe
  2⤵
  PID:3276
- C:\Windows\System\OYIKOay.exe
  C:\Windows\System\OYIKOay.exe
  2⤵
  PID:3292
- C:\Windows\System\rYqljen.exe
  C:\Windows\System\rYqljen.exe
  2⤵
  PID:3312
- C:\Windows\System\KLAjOCu.exe
  C:\Windows\System\KLAjOCu.exe
  2⤵
  PID:3332
- C:\Windows\System\iuuwkwO.exe
  C:\Windows\System\iuuwkwO.exe
  2⤵
  PID:3348
- C:\Windows\System\nTwLDjR.exe
  C:\Windows\System\nTwLDjR.exe
  2⤵
  PID:3364
- C:\Windows\System\MxSNkxC.exe
  C:\Windows\System\MxSNkxC.exe
  2⤵
  PID:3380
- C:\Windows\System\hOWjuKe.exe
  C:\Windows\System\hOWjuKe.exe
  2⤵
  PID:3396
- C:\Windows\System\SWgLhNr.exe
  C:\Windows\System\SWgLhNr.exe
  2⤵
  PID:3416
- C:\Windows\System\dNCrENI.exe
  C:\Windows\System\dNCrENI.exe
  2⤵
  PID:3432
- C:\Windows\System\PQEjSSN.exe
  C:\Windows\System\PQEjSSN.exe
  2⤵
  PID:3448
- C:\Windows\System\DGQxACG.exe
  C:\Windows\System\DGQxACG.exe
  2⤵
  PID:3464
- C:\Windows\System\DgetEwu.exe
  C:\Windows\System\DgetEwu.exe
  2⤵
  PID:3480
- C:\Windows\System\ZDlrZBJ.exe
  C:\Windows\System\ZDlrZBJ.exe
  2⤵
  PID:3496
- C:\Windows\System\LKGnFWm.exe
  C:\Windows\System\LKGnFWm.exe
  2⤵
  PID:3512
- C:\Windows\System\pCaAogG.exe
  C:\Windows\System\pCaAogG.exe
  2⤵
  PID:3528
- C:\Windows\System\fSYJbwu.exe
  C:\Windows\System\fSYJbwu.exe
  2⤵
  PID:3544
- C:\Windows\System\VtnyQZI.exe
  C:\Windows\System\VtnyQZI.exe
  2⤵
  PID:3560
- C:\Windows\System\FYsPATi.exe
  C:\Windows\System\FYsPATi.exe
  2⤵
  PID:3588
- C:\Windows\System\QXcdOlF.exe
  C:\Windows\System\QXcdOlF.exe
  2⤵
  PID:3604
- C:\Windows\System\aGetile.exe
  C:\Windows\System\aGetile.exe
  2⤵
  PID:3620
- C:\Windows\System\KGyyNfq.exe
  C:\Windows\System\KGyyNfq.exe
  2⤵
  PID:3744
- C:\Windows\System\edObWUX.exe
  C:\Windows\System\edObWUX.exe
  2⤵
  PID:3760
- C:\Windows\System\AhvaHqf.exe
  C:\Windows\System\AhvaHqf.exe
  2⤵
  PID:3776
- C:\Windows\System\gkFbvLB.exe
  C:\Windows\System\gkFbvLB.exe
  2⤵
  PID:3792
- C:\Windows\System\LBTpMiY.exe
  C:\Windows\System\LBTpMiY.exe
  2⤵
  PID:3808
- C:\Windows\System\zWLSmza.exe
  C:\Windows\System\zWLSmza.exe
  2⤵
  PID:3824
- C:\Windows\System\zhqDyNt.exe
  C:\Windows\System\zhqDyNt.exe
  2⤵
  PID:3840
- C:\Windows\System\BuFhcjD.exe
  C:\Windows\System\BuFhcjD.exe
  2⤵
  PID:3856
- C:\Windows\System\YSHPnJD.exe
  C:\Windows\System\YSHPnJD.exe
  2⤵
  PID:3876
- C:\Windows\System\laOiVLu.exe
  C:\Windows\System\laOiVLu.exe
  2⤵
  PID:3892
- C:\Windows\System\gKgaTjd.exe
  C:\Windows\System\gKgaTjd.exe
  2⤵
  PID:3908
- C:\Windows\System\BaYJtBH.exe
  C:\Windows\System\BaYJtBH.exe
  2⤵
  PID:3928
- C:\Windows\System\SrmBzUN.exe
  C:\Windows\System\SrmBzUN.exe
  2⤵
  PID:3944
- C:\Windows\System\ZYQYYEH.exe
  C:\Windows\System\ZYQYYEH.exe
  2⤵
  PID:3960
- C:\Windows\System\qvGDQxO.exe
  C:\Windows\System\qvGDQxO.exe
  2⤵
  PID:3976
- C:\Windows\System\DwRBszH.exe
  C:\Windows\System\DwRBszH.exe
  2⤵
  PID:3996
- C:\Windows\System\FIHDSJb.exe
  C:\Windows\System\FIHDSJb.exe
  2⤵
  PID:4012
- C:\Windows\System\sGfqDrQ.exe
  C:\Windows\System\sGfqDrQ.exe
  2⤵
  PID:4028
- C:\Windows\System\JPMAEXn.exe
  C:\Windows\System\JPMAEXn.exe
  2⤵
  PID:4044
- C:\Windows\System\HqkHlTH.exe
  C:\Windows\System\HqkHlTH.exe
  2⤵
  PID:4064
- C:\Windows\System\VBJDNqt.exe
  C:\Windows\System\VBJDNqt.exe
  2⤵
  PID:4080
- C:\Windows\System\kngBUid.exe
  C:\Windows\System\kngBUid.exe
  2⤵
  PID:2800
- C:\Windows\System\wRImAnu.exe
  C:\Windows\System\wRImAnu.exe
  2⤵
  PID:3132
- C:\Windows\System\xcyZhtV.exe
  C:\Windows\System\xcyZhtV.exe
  2⤵
  PID:3136
- C:\Windows\System\djSMLeU.exe
  C:\Windows\System\djSMLeU.exe
  2⤵
  PID:3236
- C:\Windows\System\NZslyzT.exe
  C:\Windows\System\NZslyzT.exe
  2⤵
  PID:3304
- C:\Windows\System\KvrpuOL.exe
  C:\Windows\System\KvrpuOL.exe
  2⤵
  PID:3288
- C:\Windows\System\ZJKCxHq.exe
  C:\Windows\System\ZJKCxHq.exe
  2⤵
  PID:3360
- C:\Windows\System\TfMuzdn.exe
  C:\Windows\System\TfMuzdn.exe
  2⤵
  PID:3460
- C:\Windows\System\seOKdRz.exe
  C:\Windows\System\seOKdRz.exe
  2⤵
  PID:3372
- C:\Windows\System\TzNjCdd.exe
  C:\Windows\System\TzNjCdd.exe
  2⤵
  PID:3412
- C:\Windows\System\uxyDaPJ.exe
  C:\Windows\System\uxyDaPJ.exe
  2⤵
  PID:3504
- C:\Windows\System\OznNdZP.exe
  C:\Windows\System\OznNdZP.exe
  2⤵
  PID:3572
- C:\Windows\System\leUWgpX.exe
  C:\Windows\System\leUWgpX.exe
  2⤵
  PID:3612
- C:\Windows\System\BnjpBVc.exe
  C:\Windows\System\BnjpBVc.exe
  2⤵
  PID:3552
- C:\Windows\System\JNVqpgp.exe
  C:\Windows\System\JNVqpgp.exe
  2⤵
  PID:3632
- C:\Windows\System\rknBQAr.exe
  C:\Windows\System\rknBQAr.exe
  2⤵
  PID:3648
- C:\Windows\System\YCFfHTu.exe
  C:\Windows\System\YCFfHTu.exe
  2⤵
  PID:3668
- C:\Windows\System\RmpJuGK.exe
  C:\Windows\System\RmpJuGK.exe
  2⤵
  PID:3356
- C:\Windows\System\nWvaaLx.exe
  C:\Windows\System\nWvaaLx.exe
  2⤵
  PID:3692
- C:\Windows\System\iSnmLPt.exe
  C:\Windows\System\iSnmLPt.exe
  2⤵
  PID:3708
- C:\Windows\System\SoZYRqb.exe
  C:\Windows\System\SoZYRqb.exe
  2⤵
  PID:3756
- C:\Windows\System\qhTiZFV.exe
  C:\Windows\System\qhTiZFV.exe
  2⤵
  PID:3728
- C:\Windows\System\qCEKFRi.exe
  C:\Windows\System\qCEKFRi.exe
  2⤵
  PID:3952
- C:\Windows\System\PdOlvfR.exe
  C:\Windows\System\PdOlvfR.exe
  2⤵
  PID:4088
- C:\Windows\System\BRHvHLC.exe
  C:\Windows\System\BRHvHLC.exe
  2⤵
  PID:3268
- C:\Windows\System\nCAKKWg.exe
  C:\Windows\System\nCAKKWg.exe
  2⤵
  PID:3344
- C:\Windows\System\SLFtObM.exe
  C:\Windows\System\SLFtObM.exe
  2⤵
  PID:3600
- C:\Windows\System\BQXKpzo.exe
  C:\Windows\System\BQXKpzo.exe
  2⤵
  PID:3736
- C:\Windows\System\PmTsAte.exe
  C:\Windows\System\PmTsAte.exe
  2⤵
  PID:3832
- C:\Windows\System\icSfdZf.exe
  C:\Windows\System\icSfdZf.exe
  2⤵
  PID:3900
- C:\Windows\System\HiyYely.exe
  C:\Windows\System\HiyYely.exe
  2⤵
  PID:3968
- C:\Windows\System\mpUoarH.exe
  C:\Windows\System\mpUoarH.exe
  2⤵
  PID:4040
- C:\Windows\System\xeRglzO.exe
  C:\Windows\System\xeRglzO.exe
  2⤵
  PID:3688
- C:\Windows\System\JBRAXka.exe
  C:\Windows\System\JBRAXka.exe
  2⤵
  PID:3848
- C:\Windows\System\ELByqaR.exe
  C:\Windows\System\ELByqaR.exe
  2⤵
  PID:2792
- C:\Windows\System\rLVpGwH.exe
  C:\Windows\System\rLVpGwH.exe
  2⤵
  PID:3200
- C:\Windows\System\AjEsSEf.exe
  C:\Windows\System\AjEsSEf.exe
  2⤵
  PID:3884
- C:\Windows\System\wUKbfkZ.exe
  C:\Windows\System\wUKbfkZ.exe
  2⤵
  PID:3628
- C:\Windows\System\ZekyfRw.exe
  C:\Windows\System\ZekyfRw.exe
  2⤵
  PID:3816
- C:\Windows\System\zOtDmbB.exe
  C:\Windows\System\zOtDmbB.exe
  2⤵
  PID:3888
- C:\Windows\System\MaHLKqF.exe
  C:\Windows\System\MaHLKqF.exe
  2⤵
  PID:3924
- C:\Windows\System\Ruauols.exe
  C:\Windows\System\Ruauols.exe
  2⤵
  PID:3424
- C:\Windows\System\bckqsxi.exe
  C:\Windows\System\bckqsxi.exe
  2⤵
  PID:3428
- C:\Windows\System\bOGxswE.exe
  C:\Windows\System\bOGxswE.exe
  2⤵
  PID:3488
- C:\Windows\System\OaSjqsN.exe
  C:\Windows\System\OaSjqsN.exe
  2⤵
  PID:3472
- C:\Windows\System\KGpThwh.exe
  C:\Windows\System\KGpThwh.exe
  2⤵
  PID:3804
- C:\Windows\System\HDnInOX.exe
  C:\Windows\System\HDnInOX.exe
  2⤵
  PID:4108
- C:\Windows\System\uadkqpS.exe
  C:\Windows\System\uadkqpS.exe
  2⤵
  PID:4128
- C:\Windows\System\eJkNVmQ.exe
  C:\Windows\System\eJkNVmQ.exe
  2⤵
  PID:4144
- C:\Windows\System\fDMrSWd.exe
  C:\Windows\System\fDMrSWd.exe
  2⤵
  PID:4244
- C:\Windows\System\moPSlhA.exe
  C:\Windows\System\moPSlhA.exe
  2⤵
  PID:4288
- C:\Windows\System\WHefHcc.exe
  C:\Windows\System\WHefHcc.exe
  2⤵
  PID:4304
- C:\Windows\System\LLYxLjr.exe
  C:\Windows\System\LLYxLjr.exe
  2⤵
  PID:4324
- C:\Windows\System\KSOZkiw.exe
  C:\Windows\System\KSOZkiw.exe
  2⤵
  PID:4344
- C:\Windows\System\cDTVYNu.exe
  C:\Windows\System\cDTVYNu.exe
  2⤵
  PID:4364
- C:\Windows\System\EuhyrQm.exe
  C:\Windows\System\EuhyrQm.exe
  2⤵
  PID:4380
- C:\Windows\System\tAbUnaI.exe
  C:\Windows\System\tAbUnaI.exe
  2⤵
  PID:4400
- C:\Windows\System\JCMQPtj.exe
  C:\Windows\System\JCMQPtj.exe
  2⤵
  PID:4416
- C:\Windows\System\sEtmcFb.exe
  C:\Windows\System\sEtmcFb.exe
  2⤵
  PID:4432
- C:\Windows\System\meeBQEX.exe
  C:\Windows\System\meeBQEX.exe
  2⤵
  PID:4452
- C:\Windows\System\rhBRBei.exe
  C:\Windows\System\rhBRBei.exe
  2⤵
  PID:4468
- C:\Windows\System\dBTwqHI.exe
  C:\Windows\System\dBTwqHI.exe
  2⤵
  PID:4484
- C:\Windows\System\yeJKYbl.exe
  C:\Windows\System\yeJKYbl.exe
  2⤵
  PID:4500
- C:\Windows\System\IROTGRY.exe
  C:\Windows\System\IROTGRY.exe
  2⤵
  PID:4520
- C:\Windows\System\SqpxDhH.exe
  C:\Windows\System\SqpxDhH.exe
  2⤵
  PID:4536
- C:\Windows\System\VNhtkyj.exe
  C:\Windows\System\VNhtkyj.exe
  2⤵
  PID:4556
- C:\Windows\System\kjMMXNk.exe
  C:\Windows\System\kjMMXNk.exe
  2⤵
  PID:4628
- C:\Windows\System\wqUYPxF.exe
  C:\Windows\System\wqUYPxF.exe
  2⤵
  PID:4660
- C:\Windows\System\wWERbSd.exe
  C:\Windows\System\wWERbSd.exe
  2⤵
  PID:4772
- C:\Windows\System\WDMVHyo.exe
  C:\Windows\System\WDMVHyo.exe
  2⤵
  PID:4792
- C:\Windows\System\nymTJLp.exe
  C:\Windows\System\nymTJLp.exe
  2⤵
  PID:4808
- C:\Windows\System\RuLviWu.exe
  C:\Windows\System\RuLviWu.exe
  2⤵
  PID:4824
- C:\Windows\System\NHXQucJ.exe
  C:\Windows\System\NHXQucJ.exe
  2⤵
  PID:4840
- C:\Windows\System\SFhaWGO.exe
  C:\Windows\System\SFhaWGO.exe
  2⤵
  PID:4860
- C:\Windows\System\kZGGJWH.exe
  C:\Windows\System\kZGGJWH.exe
  2⤵
  PID:4876
- C:\Windows\System\fRnsRQa.exe
  C:\Windows\System\fRnsRQa.exe
  2⤵
  PID:4896
- C:\Windows\System\RWiTuhD.exe
  C:\Windows\System\RWiTuhD.exe
  2⤵
  PID:4912
- C:\Windows\System\BoMduBK.exe
  C:\Windows\System\BoMduBK.exe
  2⤵
  PID:4932
- C:\Windows\System\ObVdJPq.exe
  C:\Windows\System\ObVdJPq.exe
  2⤵
  PID:4952
- C:\Windows\System\xZcrula.exe
  C:\Windows\System\xZcrula.exe
  2⤵
  PID:4968
- C:\Windows\System\LXaWKtJ.exe
  C:\Windows\System\LXaWKtJ.exe
  2⤵
  PID:4988
- C:\Windows\System\wWvVvSX.exe
  C:\Windows\System\wWvVvSX.exe
  2⤵
  PID:5004
- C:\Windows\System\jIYFqWe.exe
  C:\Windows\System\jIYFqWe.exe
  2⤵
  PID:5020
- C:\Windows\System\SurMRvm.exe
  C:\Windows\System\SurMRvm.exe
  2⤵
  PID:5044
- C:\Windows\System\wCCuzbw.exe
  C:\Windows\System\wCCuzbw.exe
  2⤵
  PID:5064
- C:\Windows\System\VrVyvwm.exe
  C:\Windows\System\VrVyvwm.exe
  2⤵
  PID:4072
- C:\Windows\System\dFTeFbj.exe
  C:\Windows\System\dFTeFbj.exe
  2⤵
  PID:3644
- C:\Windows\System\taDqBOk.exe
  C:\Windows\System\taDqBOk.exe
  2⤵
  PID:3700
- C:\Windows\System\bEYOIij.exe
  C:\Windows\System\bEYOIij.exe
  2⤵
  PID:3992
- C:\Windows\System\PvYdjGQ.exe
  C:\Windows\System\PvYdjGQ.exe
  2⤵
  PID:3772
- C:\Windows\System\UaibDxy.exe
  C:\Windows\System\UaibDxy.exe
  2⤵
  PID:3324
- C:\Windows\System\aTWXEIx.exe
  C:\Windows\System\aTWXEIx.exe
  2⤵
  PID:3664
- C:\Windows\System\HgKUYHv.exe
  C:\Windows\System\HgKUYHv.exe
  2⤵
  PID:3836
- C:\Windows\System\tOHdfis.exe
  C:\Windows\System\tOHdfis.exe
  2⤵
  PID:3740
- C:\Windows\System\URFtLyY.exe
  C:\Windows\System\URFtLyY.exe
  2⤵
  PID:1724
- C:\Windows\System\ExUHuvD.exe
  C:\Windows\System\ExUHuvD.exe
  2⤵
  PID:3872
- C:\Windows\System\LzbfRkQ.exe
  C:\Windows\System\LzbfRkQ.exe
  2⤵
  PID:4124
- C:\Windows\System\dqyTvCF.exe
  C:\Windows\System\dqyTvCF.exe
  2⤵
  PID:4172
- C:\Windows\System\qzaQrkl.exe
  C:\Windows\System\qzaQrkl.exe
  2⤵
  PID:4120
- C:\Windows\System\wqZnpja.exe
  C:\Windows\System\wqZnpja.exe
  2⤵
  PID:4140
- C:\Windows\System\VEQWXJO.exe
  C:\Windows\System\VEQWXJO.exe
  2⤵
  PID:4168
- C:\Windows\System\YygLuLM.exe
  C:\Windows\System\YygLuLM.exe
  2⤵
  PID:4224
- C:\Windows\System\uEQHskZ.exe
  C:\Windows\System\uEQHskZ.exe
  2⤵
  PID:4296
- C:\Windows\System\mPdCvDe.exe
  C:\Windows\System\mPdCvDe.exe
  2⤵
  PID:4320
- C:\Windows\System\qieTZpW.exe
  C:\Windows\System\qieTZpW.exe
  2⤵
  PID:4388
- C:\Windows\System\pcMCfrI.exe
  C:\Windows\System\pcMCfrI.exe
  2⤵
  PID:4464
- C:\Windows\System\KWRSRbi.exe
  C:\Windows\System\KWRSRbi.exe
  2⤵
  PID:4412
- C:\Windows\System\mFukEdF.exe
  C:\Windows\System\mFukEdF.exe
  2⤵
  PID:4480
- C:\Windows\System\jftpCPs.exe
  C:\Windows\System\jftpCPs.exe
  2⤵
  PID:4440
- C:\Windows\System\psBaNpr.exe
  C:\Windows\System\psBaNpr.exe
  2⤵
  PID:4336
- C:\Windows\System\asOlRyr.exe
  C:\Windows\System\asOlRyr.exe
  2⤵
  PID:4568
- C:\Windows\System\rTNtwLF.exe
  C:\Windows\System\rTNtwLF.exe
  2⤵
  PID:4576
- C:\Windows\System\BPhXIeN.exe
  C:\Windows\System\BPhXIeN.exe
  2⤵
  PID:4596
- C:\Windows\System\fnCDQIL.exe
  C:\Windows\System\fnCDQIL.exe
  2⤵
  PID:4636
- C:\Windows\System\cnqsZis.exe
  C:\Windows\System\cnqsZis.exe
  2⤵
  PID:4656
- C:\Windows\System\PqcHbsY.exe
  C:\Windows\System\PqcHbsY.exe
  2⤵
  PID:2216
- C:\Windows\System\LOBKQBF.exe
  C:\Windows\System\LOBKQBF.exe
  2⤵
  PID:4688
- C:\Windows\System\tGBVUwH.exe
  C:\Windows\System\tGBVUwH.exe
  2⤵
  PID:4228
- C:\Windows\System\NnSxIGU.exe
  C:\Windows\System\NnSxIGU.exe
  2⤵
  PID:4712
- C:\Windows\System\ORbQZTX.exe
  C:\Windows\System\ORbQZTX.exe
  2⤵
  PID:4768
- C:\Windows\System\pPWYitA.exe
  C:\Windows\System\pPWYitA.exe
  2⤵
  PID:2696
- C:\Windows\System\bmeYixm.exe
  C:\Windows\System\bmeYixm.exe
  2⤵
  PID:4872
- C:\Windows\System\KEvVXGb.exe
  C:\Windows\System\KEvVXGb.exe
  2⤵
  PID:4856
- C:\Windows\System\TOZSUYB.exe
  C:\Windows\System\TOZSUYB.exe
  2⤵
  PID:4884
- C:\Windows\System\ARxKCsQ.exe
  C:\Windows\System\ARxKCsQ.exe
  2⤵
  PID:4924
- C:\Windows\System\WcPRPZV.exe
  C:\Windows\System\WcPRPZV.exe
  2⤵
  PID:4960
- C:\Windows\System\JYGYcUq.exe
  C:\Windows\System\JYGYcUq.exe
  2⤵
  PID:5016
- C:\Windows\System\xNVAOik.exe
  C:\Windows\System\xNVAOik.exe
  2⤵
  PID:5060
- C:\Windows\System\gIDAIpO.exe
  C:\Windows\System\gIDAIpO.exe
  2⤵
  PID:4676
- C:\Windows\System\FnunJLr.exe
  C:\Windows\System\FnunJLr.exe
  2⤵
  PID:5092
- C:\Windows\System\FvQlMDv.exe
  C:\Windows\System\FvQlMDv.exe
  2⤵
  PID:5112
- C:\Windows\System\vtCMUwb.exe
  C:\Windows\System\vtCMUwb.exe
  2⤵
  PID:3184
- C:\Windows\System\UXvyrEA.exe
  C:\Windows\System\UXvyrEA.exe
  2⤵
  PID:3720
- C:\Windows\System\qMPSnkB.exe
  C:\Windows\System\qMPSnkB.exe
  2⤵
  PID:4052
- C:\Windows\System\XqKTHgG.exe
  C:\Windows\System\XqKTHgG.exe
  2⤵
  PID:1952
- C:\Windows\System\VuYjYNp.exe
  C:\Windows\System\VuYjYNp.exe
  2⤵
  PID:3784
- C:\Windows\System\EmpuIQV.exe
  C:\Windows\System\EmpuIQV.exe
  2⤵
  PID:3984
- C:\Windows\System\PHhcUUa.exe
  C:\Windows\System\PHhcUUa.exe
  2⤵
  PID:4004
- C:\Windows\System\ruLmMIi.exe
  C:\Windows\System\ruLmMIi.exe
  2⤵
  PID:3568
- C:\Windows\System\aRLKqIk.exe
  C:\Windows\System\aRLKqIk.exe
  2⤵
  PID:4176
- C:\Windows\System\biptTrn.exe
  C:\Windows\System\biptTrn.exe
  2⤵
  PID:5104
- C:\Windows\System\vGjCOPo.exe
  C:\Windows\System\vGjCOPo.exe
  2⤵
  PID:4192
- C:\Windows\System\TUHnBHu.exe
  C:\Windows\System\TUHnBHu.exe
  2⤵
  PID:4260
- C:\Windows\System\QfEbLEY.exe
  C:\Windows\System\QfEbLEY.exe
  2⤵
  PID:4316
- C:\Windows\System\VDDBazi.exe
  C:\Windows\System\VDDBazi.exe
  2⤵
  PID:4532
- C:\Windows\System\nolltKi.exe
  C:\Windows\System\nolltKi.exe
  2⤵
  PID:4396
- C:\Windows\System\IbaDulW.exe
  C:\Windows\System\IbaDulW.exe
  2⤵
  PID:4552
- C:\Windows\System\YBHxpAl.exe
  C:\Windows\System\YBHxpAl.exe
  2⤵
  PID:4728
- C:\Windows\System\GcdCEmh.exe
  C:\Windows\System\GcdCEmh.exe
  2⤵
  PID:4604
- C:\Windows\System\NCuvNhn.exe
  C:\Windows\System\NCuvNhn.exe
  2⤵
  PID:3152
- C:\Windows\System\majKyaW.exe
  C:\Windows\System\majKyaW.exe
  2⤵
  PID:4700
- C:\Windows\System\XsNlBYj.exe
  C:\Windows\System\XsNlBYj.exe
  2⤵
  PID:4740
- C:\Windows\System\pCNLWoB.exe
  C:\Windows\System\pCNLWoB.exe
  2⤵
  PID:4804
- C:\Windows\System\DvonITC.exe
  C:\Windows\System\DvonITC.exe
  2⤵
  PID:4816
- C:\Windows\System\eUhazFw.exe
  C:\Windows\System\eUhazFw.exe
  2⤵
  PID:4944
- C:\Windows\System\yZhFwOs.exe
  C:\Windows\System\yZhFwOs.exe
  2⤵
  PID:4948
- C:\Windows\System\UqrlzID.exe
  C:\Windows\System\UqrlzID.exe
  2⤵
  PID:5000
- C:\Windows\System\lRfBIpl.exe
  C:\Windows\System\lRfBIpl.exe
  2⤵
  PID:5040
- C:\Windows\System\AzAhGLQ.exe
  C:\Windows\System\AzAhGLQ.exe
  2⤵
  PID:5076
- C:\Windows\System\PmKbOij.exe
  C:\Windows\System\PmKbOij.exe
  2⤵
  PID:5084
- C:\Windows\System\ISJvqvd.exe
  C:\Windows\System\ISJvqvd.exe
  2⤵
  PID:5116
- C:\Windows\System\JGoRUoN.exe
  C:\Windows\System\JGoRUoN.exe
  2⤵
  PID:3524
- C:\Windows\System\xfNfMUc.exe
  C:\Windows\System\xfNfMUc.exe
  2⤵
  PID:3940
- C:\Windows\System\VnddoKw.exe
  C:\Windows\System\VnddoKw.exe
  2⤵
  PID:2668
- C:\Windows\System\EWaamoY.exe
  C:\Windows\System\EWaamoY.exe
  2⤵
  PID:4152
- C:\Windows\System\hloSLZz.exe
  C:\Windows\System\hloSLZz.exe
  2⤵
  PID:3148
- C:\Windows\System\uVQUOvz.exe
  C:\Windows\System\uVQUOvz.exe
  2⤵
  PID:4204
- C:\Windows\System\eqPKbFD.exe
  C:\Windows\System\eqPKbFD.exe
  2⤵
  PID:4376
- C:\Windows\System\LZCvKBF.exe
  C:\Windows\System\LZCvKBF.exe
  2⤵
  PID:4760
- C:\Windows\System\MliGTtT.exe
  C:\Windows\System\MliGTtT.exe
  2⤵
  PID:4724
- C:\Windows\System\ZZUrdwq.exe
  C:\Windows\System\ZZUrdwq.exe
  2⤵
  PID:4928
- C:\Windows\System\diaayzz.exe
  C:\Windows\System\diaayzz.exe
  2⤵
  PID:4984
- C:\Windows\System\VheLdBm.exe
  C:\Windows\System\VheLdBm.exe
  2⤵
  PID:3340
- C:\Windows\System\xubOVEN.exe
  C:\Windows\System\xubOVEN.exe
  2⤵
  PID:4748
- C:\Windows\System\IZChEbp.exe
  C:\Windows\System\IZChEbp.exe
  2⤵
  PID:4976
- C:\Windows\System\wtAcgXE.exe
  C:\Windows\System\wtAcgXE.exe
  2⤵
  PID:4820
- C:\Windows\System\CwWucXX.exe
  C:\Windows\System\CwWucXX.exe
  2⤵
  PID:3988
- C:\Windows\System\RHtGifk.exe
  C:\Windows\System\RHtGifk.exe
  2⤵
  PID:3116
- C:\Windows\System\XqEEgiV.exe
  C:\Windows\System\XqEEgiV.exe
  2⤵
  PID:4356
- C:\Windows\System\PkifFpP.exe
  C:\Windows\System\PkifFpP.exe
  2⤵
  PID:4312
- C:\Windows\System\MpzVpSK.exe
  C:\Windows\System\MpzVpSK.exe
  2⤵
  PID:4648
- C:\Windows\System\OXnbjEi.exe
  C:\Windows\System\OXnbjEi.exe
  2⤵
  PID:4692
- C:\Windows\System\qWxgKrQ.exe
  C:\Windows\System\qWxgKrQ.exe
  2⤵
  PID:4732
- C:\Windows\System\pymLHAc.exe
  C:\Windows\System\pymLHAc.exe
  2⤵
  PID:5128
- C:\Windows\System\PRikfIG.exe
  C:\Windows\System\PRikfIG.exe
  2⤵
  PID:5144
- C:\Windows\System\cqswWCg.exe
  C:\Windows\System\cqswWCg.exe
  2⤵
  PID:5224
- C:\Windows\System\IJjyZOA.exe
  C:\Windows\System\IJjyZOA.exe
  2⤵
  PID:5244
- C:\Windows\System\TGYfhMJ.exe
  C:\Windows\System\TGYfhMJ.exe
  2⤵
  PID:5268
- C:\Windows\System\BtYEKsb.exe
  C:\Windows\System\BtYEKsb.exe
  2⤵
  PID:5284
- C:\Windows\System\cnSnwuT.exe
  C:\Windows\System\cnSnwuT.exe
  2⤵
  PID:5300
- C:\Windows\System\TloCFyV.exe
  C:\Windows\System\TloCFyV.exe
  2⤵
  PID:5324
- C:\Windows\System\HiGPiSg.exe
  C:\Windows\System\HiGPiSg.exe
  2⤵
  PID:5340
- C:\Windows\System\kAtoeZg.exe
  C:\Windows\System\kAtoeZg.exe
  2⤵
  PID:5360
- C:\Windows\System\EUsZKHc.exe
  C:\Windows\System\EUsZKHc.exe
  2⤵
  PID:5376
- C:\Windows\System\bfGPQRv.exe
  C:\Windows\System\bfGPQRv.exe
  2⤵
  PID:5392
- C:\Windows\System\FdlfWUY.exe
  C:\Windows\System\FdlfWUY.exe
  2⤵
  PID:5408
- C:\Windows\System\lxIdCku.exe
  C:\Windows\System\lxIdCku.exe
  2⤵
  PID:5424
- C:\Windows\System\AZwlKam.exe
  C:\Windows\System\AZwlKam.exe
  2⤵
  PID:5440
- C:\Windows\System\rcXUiVi.exe
  C:\Windows\System\rcXUiVi.exe
  2⤵
  PID:5460
- C:\Windows\System\yiDMOTk.exe
  C:\Windows\System\yiDMOTk.exe
  2⤵
  PID:5476
- C:\Windows\System\aNOPvcr.exe
  C:\Windows\System\aNOPvcr.exe
  2⤵
  PID:5492
- C:\Windows\System\AThybOg.exe
  C:\Windows\System\AThybOg.exe
  2⤵
  PID:5512
- C:\Windows\System\TTbwNUw.exe
  C:\Windows\System\TTbwNUw.exe
  2⤵
  PID:5528
- C:\Windows\System\JULoUYv.exe
  C:\Windows\System\JULoUYv.exe
  2⤵
  PID:5544
- C:\Windows\System\GqjBbcw.exe
  C:\Windows\System\GqjBbcw.exe
  2⤵
  PID:5560
- C:\Windows\System\WUYlyEW.exe
  C:\Windows\System\WUYlyEW.exe
  2⤵
  PID:5616
- C:\Windows\System\WTsprsP.exe
  C:\Windows\System\WTsprsP.exe
  2⤵
  PID:5636
- C:\Windows\System\klmszuf.exe
  C:\Windows\System\klmszuf.exe
  2⤵
  PID:5652
- C:\Windows\System\CxMXfZK.exe
  C:\Windows\System\CxMXfZK.exe
  2⤵
  PID:5668
- C:\Windows\System\tUowEzb.exe
  C:\Windows\System\tUowEzb.exe
  2⤵
  PID:5688
- C:\Windows\System\KbXxVRv.exe
  C:\Windows\System\KbXxVRv.exe
  2⤵
  PID:5704
- C:\Windows\System\ymEzZhy.exe
  C:\Windows\System\ymEzZhy.exe
  2⤵
  PID:5724
- C:\Windows\System\ZkyHEUO.exe
  C:\Windows\System\ZkyHEUO.exe
  2⤵
  PID:5756
- C:\Windows\System\eFcBuxQ.exe
  C:\Windows\System\eFcBuxQ.exe
  2⤵
  PID:5792
- C:\Windows\System\OKKdoZa.exe
  C:\Windows\System\OKKdoZa.exe
  2⤵
  PID:5808
- C:\Windows\System\zmeCMgS.exe
  C:\Windows\System\zmeCMgS.exe
  2⤵
  PID:5824
- C:\Windows\System\xjPpRMq.exe
  C:\Windows\System\xjPpRMq.exe
  2⤵
  PID:5840
- C:\Windows\System\RSwVMoC.exe
  C:\Windows\System\RSwVMoC.exe
  2⤵
  PID:5856
- C:\Windows\System\FwKUzsL.exe
  C:\Windows\System\FwKUzsL.exe
  2⤵
  PID:5876
- C:\Windows\System\NNkGSFp.exe
  C:\Windows\System\NNkGSFp.exe
  2⤵
  PID:5892
- C:\Windows\System\TYrcpMA.exe
  C:\Windows\System\TYrcpMA.exe
  2⤵
  PID:5908
- C:\Windows\System\ehMXAQy.exe
  C:\Windows\System\ehMXAQy.exe
  2⤵
  PID:5924
- C:\Windows\System\rDsxmNp.exe
  C:\Windows\System\rDsxmNp.exe
  2⤵
  PID:5952
- C:\Windows\System\gPSxRIT.exe
  C:\Windows\System\gPSxRIT.exe
  2⤵
  PID:6064
- C:\Windows\System\kAPacZo.exe
  C:\Windows\System\kAPacZo.exe
  2⤵
  PID:6088
- C:\Windows\System\ncJnXQM.exe
  C:\Windows\System\ncJnXQM.exe
  2⤵
  PID:6104
- C:\Windows\System\lvfpvyk.exe
  C:\Windows\System\lvfpvyk.exe
  2⤵
  PID:6120
- C:\Windows\System\EbWSJyP.exe
  C:\Windows\System\EbWSJyP.exe
  2⤵
  PID:6136
- C:\Windows\System\DZCcRmi.exe
  C:\Windows\System\DZCcRmi.exe
  2⤵
  PID:4460
- C:\Windows\System\IsiyUmS.exe
  C:\Windows\System\IsiyUmS.exe
  2⤵
  PID:5136
- C:\Windows\System\CJdIVfD.exe
  C:\Windows\System\CJdIVfD.exe
  2⤵
  PID:5088
- C:\Windows\System\HovomGE.exe
  C:\Windows\System\HovomGE.exe
  2⤵
  PID:4544
- C:\Windows\System\LGxWjKn.exe
  C:\Windows\System\LGxWjKn.exe
  2⤵
  PID:5140
- C:\Windows\System\LlJGwjo.exe
  C:\Windows\System\LlJGwjo.exe
  2⤵
  PID:4444
- C:\Windows\System\Osluckn.exe
  C:\Windows\System\Osluckn.exe
  2⤵
  PID:4332
- C:\Windows\System\gOSkwSg.exe
  C:\Windows\System\gOSkwSg.exe
  2⤵
  PID:4180
- C:\Windows\System\xohoOBJ.exe
  C:\Windows\System\xohoOBJ.exe
  2⤵
  PID:4428
- C:\Windows\System\eEXEEOc.exe
  C:\Windows\System\eEXEEOc.exe
  2⤵
  PID:5208
- C:\Windows\System\tHplMcq.exe
  C:\Windows\System\tHplMcq.exe
  2⤵
  PID:5160
- C:\Windows\System\HzFAUbX.exe
  C:\Windows\System\HzFAUbX.exe
  2⤵
  PID:5192
- C:\Windows\System\jwbUeov.exe
  C:\Windows\System\jwbUeov.exe
  2⤵
  PID:5180
- C:\Windows\System\fBLRimq.exe
  C:\Windows\System\fBLRimq.exe
  2⤵
  PID:5384
- C:\Windows\System\QOASvsZ.exe
  C:\Windows\System\QOASvsZ.exe
  2⤵
  PID:5488
- C:\Windows\System\WhdWoCr.exe
  C:\Windows\System\WhdWoCr.exe
  2⤵
  PID:5416
- C:\Windows\System\qJAtIJj.exe
  C:\Windows\System\qJAtIJj.exe
  2⤵
  PID:5372
- C:\Windows\System\sxGqqjt.exe
  C:\Windows\System\sxGqqjt.exe
  2⤵
  PID:5436
- C:\Windows\System\evVHQZC.exe
  C:\Windows\System\evVHQZC.exe
  2⤵
  PID:5660
- C:\Windows\System\CGYoMYh.exe
  C:\Windows\System\CGYoMYh.exe
  2⤵
  PID:5584
- C:\Windows\System\BtFPJoO.exe
  C:\Windows\System\BtFPJoO.exe
  2⤵
  PID:5596
- C:\Windows\System\QsfAsQn.exe
  C:\Windows\System\QsfAsQn.exe
  2⤵
  PID:5508
- C:\Windows\System\UHykOMU.exe
  C:\Windows\System\UHykOMU.exe
  2⤵
  PID:5604
- C:\Windows\System\CPPwDsH.exe
  C:\Windows\System\CPPwDsH.exe
  2⤵
  PID:5732
- C:\Windows\System\YuUkmPl.exe
  C:\Windows\System\YuUkmPl.exe
  2⤵
  PID:5744
- C:\Windows\System\IHmYjik.exe
  C:\Windows\System\IHmYjik.exe
  2⤵
  PID:5648
- C:\Windows\System\fYBkooS.exe
  C:\Windows\System\fYBkooS.exe
  2⤵
  PID:5752
- C:\Windows\System\qQSMcdU.exe
  C:\Windows\System\qQSMcdU.exe
  2⤵
  PID:5172
- C:\Windows\System\vPoqojo.exe
  C:\Windows\System\vPoqojo.exe
  2⤵
  PID:5868
- C:\Windows\System\aklLFBU.exe
  C:\Windows\System\aklLFBU.exe
  2⤵
  PID:5948
- C:\Windows\System\RMLfDYP.exe
  C:\Windows\System\RMLfDYP.exe
  2⤵
  PID:5916
- C:\Windows\System\eFDGhNb.exe
  C:\Windows\System\eFDGhNb.exe
  2⤵
  PID:5976
- C:\Windows\System\HMfRoTg.exe
  C:\Windows\System\HMfRoTg.exe
  2⤵
  PID:5972
- C:\Windows\System\XrXWsxn.exe
  C:\Windows\System\XrXWsxn.exe
  2⤵
  PID:6012
- C:\Windows\System\KdXcZnn.exe
  C:\Windows\System\KdXcZnn.exe
  2⤵
  PID:6016
- C:\Windows\System\rPAWvbY.exe
  C:\Windows\System\rPAWvbY.exe
  2⤵
  PID:6048
- C:\Windows\System\oRjsbtA.exe
  C:\Windows\System\oRjsbtA.exe
  2⤵
  PID:6080
- C:\Windows\System\AqtXTlr.exe
  C:\Windows\System\AqtXTlr.exe
  2⤵
  PID:6116
- C:\Windows\System\MtJEGjb.exe
  C:\Windows\System\MtJEGjb.exe
  2⤵
  PID:4868
- C:\Windows\System\qdrKLxN.exe
  C:\Windows\System\qdrKLxN.exe
  2⤵
  PID:6056
- C:\Windows\System\iLLCOcZ.exe
  C:\Windows\System\iLLCOcZ.exe
  2⤵
  PID:5156
- C:\Windows\System\JzouAPN.exe
  C:\Windows\System\JzouAPN.exe
  2⤵
  PID:6100
- C:\Windows\System\gxNHVpS.exe
  C:\Windows\System\gxNHVpS.exe
  2⤵
  PID:4680
- C:\Windows\System\tAJzDSi.exe
  C:\Windows\System\tAJzDSi.exe
  2⤵
  PID:4836
- C:\Windows\System\GBWRtdj.exe
  C:\Windows\System\GBWRtdj.exe
  2⤵
  PID:2576
- C:\Windows\System\mwzjsNT.exe
  C:\Windows\System\mwzjsNT.exe
  2⤵
  PID:5784
- C:\Windows\System\ZDOybpI.exe
  C:\Windows\System\ZDOybpI.exe
  2⤵
  PID:5308
- C:\Windows\System\LmIITSh.exe
  C:\Windows\System\LmIITSh.exe
  2⤵
  PID:5332
- C:\Windows\System\uUWOehs.exe
  C:\Windows\System\uUWOehs.exe
  2⤵
  PID:5348
- C:\Windows\System\URdtavp.exe
  C:\Windows\System\URdtavp.exe
  2⤵
  PID:5264
- C:\Windows\System\SRSADFl.exe
  C:\Windows\System\SRSADFl.exe
  2⤵
  PID:5484
- C:\Windows\System\piFozPB.exe
  C:\Windows\System\piFozPB.exe
  2⤵
  PID:5576
- C:\Windows\System\wOoOCoJ.exe
  C:\Windows\System\wOoOCoJ.exe
  2⤵
  PID:5504
- C:\Windows\System\zPoKEWt.exe
  C:\Windows\System\zPoKEWt.exe
  2⤵
  PID:5628
- C:\Windows\System\qcObaCp.exe
  C:\Windows\System\qcObaCp.exe
  2⤵
  PID:5700
- C:\Windows\System\IMbzAgg.exe
  C:\Windows\System\IMbzAgg.exe
  2⤵
  PID:5712
- C:\Windows\System\GsoFOuA.exe
  C:\Windows\System\GsoFOuA.exe
  2⤵
  PID:5804
- C:\Windows\System\sdYGbFo.exe
  C:\Windows\System\sdYGbFo.exe
  2⤵
  PID:5816
- C:\Windows\System\SlXgPDZ.exe
  C:\Windows\System\SlXgPDZ.exe
  2⤵
  PID:5904
- C:\Windows\System\xVtEnYf.exe
  C:\Windows\System\xVtEnYf.exe
  2⤵
  PID:5864
- C:\Windows\System\joSZnlB.exe
  C:\Windows\System\joSZnlB.exe
  2⤵
  PID:5964
- C:\Windows\System\tljpqIt.exe
  C:\Windows\System\tljpqIt.exe
  2⤵
  PID:5032
- C:\Windows\System\bNuPiHU.exe
  C:\Windows\System\bNuPiHU.exe
  2⤵
  PID:4564
- C:\Windows\System\DGSnPrx.exe
  C:\Windows\System\DGSnPrx.exe
  2⤵
  PID:5612
- C:\Windows\System\wEkjLqk.exe
  C:\Windows\System\wEkjLqk.exe
  2⤵
  PID:4156
- C:\Windows\System\jkCzExl.exe
  C:\Windows\System\jkCzExl.exe
  2⤵
  PID:5260
- C:\Windows\System\ETuLyXS.exe
  C:\Windows\System\ETuLyXS.exe
  2⤵
  PID:5296
- C:\Windows\System\uAmjwSC.exe
  C:\Windows\System\uAmjwSC.exe
  2⤵
  PID:5176
- C:\Windows\System\qWNFmzu.exe
  C:\Windows\System\qWNFmzu.exe
  2⤵
  PID:4448
- C:\Windows\System\IbPyHGH.exe
  C:\Windows\System\IbPyHGH.exe
  2⤵
  PID:5556
- C:\Windows\System\clwSfKT.exe
  C:\Windows\System\clwSfKT.exe
  2⤵
  PID:5468
- C:\Windows\System\VRSKsBH.exe
  C:\Windows\System\VRSKsBH.exe
  2⤵
  PID:5944
- C:\Windows\System\SgCiHYf.exe
  C:\Windows\System\SgCiHYf.exe
  2⤵
  PID:5988
- C:\Windows\System\gUaPWnq.exe
  C:\Windows\System\gUaPWnq.exe
  2⤵
  PID:5740
- C:\Windows\System\htggilQ.exe
  C:\Windows\System\htggilQ.exe
  2⤵
  PID:5776
- C:\Windows\System\fvUyrUO.exe
  C:\Windows\System\fvUyrUO.exe
  2⤵
  PID:6028
- C:\Windows\System\HWEdUBe.exe
  C:\Windows\System\HWEdUBe.exe
  2⤵
  PID:5204
- C:\Windows\System\jhigLXK.exe
  C:\Windows\System\jhigLXK.exe
  2⤵
  PID:5124
- C:\Windows\System\iSihUNu.exe
  C:\Windows\System\iSihUNu.exe
  2⤵
  PID:5336
- C:\Windows\System\ZkjVMwN.exe
  C:\Windows\System\ZkjVMwN.exe
  2⤵
  PID:5580
- C:\Windows\System\pFCePrt.exe
  C:\Windows\System\pFCePrt.exe
  2⤵
  PID:5368
- C:\Windows\System\aToTvlA.exe
  C:\Windows\System\aToTvlA.exe
  2⤵
  PID:5552
- C:\Windows\System\KzMqYDO.exe
  C:\Windows\System\KzMqYDO.exe
  2⤵
  PID:5568
- C:\Windows\System\jMoXoyO.exe
  C:\Windows\System\jMoXoyO.exe
  2⤵
  PID:5968
- C:\Windows\System\qvBGkcI.exe
  C:\Windows\System\qvBGkcI.exe
  2⤵
  PID:5920
- C:\Windows\System\PZVfrGw.exe
  C:\Windows\System\PZVfrGw.exe
  2⤵
  PID:6152
- C:\Windows\System\NZHoWZF.exe
  C:\Windows\System\NZHoWZF.exe
  2⤵
  PID:6168
- C:\Windows\System\QIPZOuc.exe
  C:\Windows\System\QIPZOuc.exe
  2⤵
  PID:6192
- C:\Windows\System\goPWhpg.exe
  C:\Windows\System\goPWhpg.exe
  2⤵
  PID:6212
- C:\Windows\System\FfliucB.exe
  C:\Windows\System\FfliucB.exe
  2⤵
  PID:6228
- C:\Windows\System\DWqxbPZ.exe
  C:\Windows\System\DWqxbPZ.exe
  2⤵
  PID:6244
- C:\Windows\System\Kineufg.exe
  C:\Windows\System\Kineufg.exe
  2⤵
  PID:6264
- C:\Windows\System\yhqVIMG.exe
  C:\Windows\System\yhqVIMG.exe
  2⤵
  PID:6280
- C:\Windows\System\gCLlWTi.exe
  C:\Windows\System\gCLlWTi.exe
  2⤵
  PID:6296
- C:\Windows\System\hyZhhXP.exe
  C:\Windows\System\hyZhhXP.exe
  2⤵
  PID:6312
- C:\Windows\System\aHShyOQ.exe
  C:\Windows\System\aHShyOQ.exe
  2⤵
  PID:6332
- C:\Windows\System\CkcTxZT.exe
  C:\Windows\System\CkcTxZT.exe
  2⤵
  PID:6348
- C:\Windows\System\TtcdGYg.exe
  C:\Windows\System\TtcdGYg.exe
  2⤵
  PID:6364
- C:\Windows\System\Yhonuur.exe
  C:\Windows\System\Yhonuur.exe
  2⤵
  PID:6380
- C:\Windows\System\GpMiviz.exe
  C:\Windows\System\GpMiviz.exe
  2⤵
  PID:6400
- C:\Windows\System\ptppQvi.exe
  C:\Windows\System\ptppQvi.exe
  2⤵
  PID:6416
- C:\Windows\System\znSJIQJ.exe
  C:\Windows\System\znSJIQJ.exe
  2⤵
  PID:6432
- C:\Windows\System\LLdZylB.exe
  C:\Windows\System\LLdZylB.exe
  2⤵
  PID:6448
- C:\Windows\System\zJHMwah.exe
  C:\Windows\System\zJHMwah.exe
  2⤵
  PID:6464
- C:\Windows\System\fNtdBGd.exe
  C:\Windows\System\fNtdBGd.exe
  2⤵
  PID:6484
- C:\Windows\System\eLhcZhz.exe
  C:\Windows\System\eLhcZhz.exe
  2⤵
  PID:6500
- C:\Windows\System\aGSMFPU.exe
  C:\Windows\System\aGSMFPU.exe
  2⤵
  PID:6516
- C:\Windows\System\PnTYplC.exe
  C:\Windows\System\PnTYplC.exe
  2⤵
  PID:6532
- C:\Windows\System\VFPeopX.exe
  C:\Windows\System\VFPeopX.exe
  2⤵
  PID:6548
- C:\Windows\System\SqpRWHo.exe
  C:\Windows\System\SqpRWHo.exe
  2⤵
  PID:6568
- C:\Windows\System\lMnYgPV.exe
  C:\Windows\System\lMnYgPV.exe
  2⤵
  PID:6588
- C:\Windows\System\bxxAtlf.exe
  C:\Windows\System\bxxAtlf.exe
  2⤵
  PID:6604
- C:\Windows\System\XkoSlUV.exe
  C:\Windows\System\XkoSlUV.exe
  2⤵
  PID:6624
- C:\Windows\System\jeYjxUy.exe
  C:\Windows\System\jeYjxUy.exe
  2⤵
  PID:6640
- C:\Windows\System\VeRinuv.exe
  C:\Windows\System\VeRinuv.exe
  2⤵
  PID:6656
- C:\Windows\System\PaCzMJg.exe
  C:\Windows\System\PaCzMJg.exe
  2⤵
  PID:6672
- C:\Windows\System\jAGubte.exe
  C:\Windows\System\jAGubte.exe
  2⤵
  PID:6688
- C:\Windows\System\MDxnBhZ.exe
  C:\Windows\System\MDxnBhZ.exe
  2⤵
  PID:6716
- C:\Windows\System\TksDPGY.exe
  C:\Windows\System\TksDPGY.exe
  2⤵
  PID:6732
- C:\Windows\System\RiPrwDK.exe
  C:\Windows\System\RiPrwDK.exe
  2⤵
  PID:6748
- C:\Windows\System\CoIwmzZ.exe
  C:\Windows\System\CoIwmzZ.exe
  2⤵
  PID:6768
- C:\Windows\System\LmCDxdh.exe
  C:\Windows\System\LmCDxdh.exe
  2⤵
  PID:6844
- C:\Windows\System\LDqfxCM.exe
  C:\Windows\System\LDqfxCM.exe
  2⤵
  PID:6864
- C:\Windows\System\UkxlpGf.exe
  C:\Windows\System\UkxlpGf.exe
  2⤵
  PID:6880
- C:\Windows\System\hTwjgJk.exe
  C:\Windows\System\hTwjgJk.exe
  2⤵
  PID:6896
- C:\Windows\System\CxJqzcY.exe
  C:\Windows\System\CxJqzcY.exe
  2⤵
  PID:6916
- C:\Windows\System\VDIAEvI.exe
  C:\Windows\System\VDIAEvI.exe
  2⤵
  PID:6932
- C:\Windows\System\dfrHmBZ.exe
  C:\Windows\System\dfrHmBZ.exe
  2⤵
  PID:6972
- C:\Windows\System\KsQgTdb.exe
  C:\Windows\System\KsQgTdb.exe
  2⤵
  PID:6992
- C:\Windows\System\chdCbLY.exe
  C:\Windows\System\chdCbLY.exe
  2⤵
  PID:7012
- C:\Windows\System\WcyLHAq.exe
  C:\Windows\System\WcyLHAq.exe
  2⤵
  PID:7028
- C:\Windows\System\xEyoycL.exe
  C:\Windows\System\xEyoycL.exe
  2⤵
  PID:7044
- C:\Windows\System\UpkEaxw.exe
  C:\Windows\System\UpkEaxw.exe
  2⤵
  PID:7060
- C:\Windows\System\FHaJWmU.exe
  C:\Windows\System\FHaJWmU.exe
  2⤵
  PID:7080
- C:\Windows\System\yFlYcXA.exe
  C:\Windows\System\yFlYcXA.exe
  2⤵
  PID:7096
- C:\Windows\System\FKXDtZM.exe
  C:\Windows\System\FKXDtZM.exe
  2⤵
  PID:7112
- C:\Windows\System\IsdazCC.exe
  C:\Windows\System\IsdazCC.exe
  2⤵
  PID:7128
- C:\Windows\System\YQesvaR.exe
  C:\Windows\System\YQesvaR.exe
  2⤵
  PID:7148
- C:\Windows\System\MpInMYJ.exe
  C:\Windows\System\MpInMYJ.exe
  2⤵
  PID:7164
- C:\Windows\System\MClxVBl.exe
  C:\Windows\System\MClxVBl.exe
  2⤵
  PID:5720
- C:\Windows\System\SyuHEcS.exe
  C:\Windows\System\SyuHEcS.exe
  2⤵
  PID:6084
- C:\Windows\System\HVBGRbZ.exe
  C:\Windows\System\HVBGRbZ.exe
  2⤵
  PID:6208
- C:\Windows\System\QzauVkH.exe
  C:\Windows\System\QzauVkH.exe
  2⤵
  PID:5676
- C:\Windows\System\eiCnOne.exe
  C:\Windows\System\eiCnOne.exe
  2⤵
  PID:5292
- C:\Windows\System\pibeYsm.exe
  C:\Windows\System\pibeYsm.exe
  2⤵
  PID:6200
- C:\Windows\System\qeQWQlU.exe
  C:\Windows\System\qeQWQlU.exe
  2⤵
  PID:6440
- C:\Windows\System\kqcExOE.exe
  C:\Windows\System\kqcExOE.exe
  2⤵
  PID:6512
- C:\Windows\System\yeicDjE.exe
  C:\Windows\System\yeicDjE.exe
  2⤵
  PID:6008
- C:\Windows\System\ChUEkmI.exe
  C:\Windows\System\ChUEkmI.exe
  2⤵
  PID:6576
- C:\Windows\System\ZIwebRc.exe
  C:\Windows\System\ZIwebRc.exe
  2⤵
  PID:6648
- C:\Windows\System\wcZFdZW.exe
  C:\Windows\System\wcZFdZW.exe
  2⤵
  PID:6724
- C:\Windows\System\hjKRyUO.exe
  C:\Windows\System\hjKRyUO.exe
  2⤵
  PID:6188
- C:\Windows\System\FGMRmBf.exe
  C:\Windows\System\FGMRmBf.exe
  2⤵
  PID:3104
- C:\Windows\System\SAWdItr.exe
  C:\Windows\System\SAWdItr.exe
  2⤵
  PID:6148
- C:\Windows\System\iroisqS.exe
  C:\Windows\System\iroisqS.exe
  2⤵
  PID:6392
- C:\Windows\System\LNrGrLI.exe
  C:\Windows\System\LNrGrLI.exe
  2⤵
  PID:6496
- C:\Windows\System\oGQHFzK.exe
  C:\Windows\System\oGQHFzK.exe
  2⤵
  PID:6600
- C:\Windows\System\YrhaDOS.exe
  C:\Windows\System\YrhaDOS.exe
  2⤵
  PID:6700
- C:\Windows\System\asKEPYT.exe
  C:\Windows\System\asKEPYT.exe
  2⤵
  PID:6780
- C:\Windows\System\yfFPXIz.exe
  C:\Windows\System\yfFPXIz.exe
  2⤵
  PID:5500
- C:\Windows\System\XIrXytF.exe
  C:\Windows\System\XIrXytF.exe
  2⤵
  PID:6252
- C:\Windows\System\IQglipy.exe
  C:\Windows\System\IQglipy.exe
  2⤵
  PID:6424
- C:\Windows\System\pnNOYBN.exe
  C:\Windows\System\pnNOYBN.exe
  2⤵
  PID:6596
- C:\Windows\System\SHNAxQq.exe
  C:\Windows\System\SHNAxQq.exe
  2⤵
  PID:6852
- C:\Windows\System\dKrGHpX.exe
  C:\Windows\System\dKrGHpX.exe
  2⤵
  PID:6892
- C:\Windows\System\dnSZKkF.exe
  C:\Windows\System\dnSZKkF.exe
  2⤵
  PID:6988
- C:\Windows\System\uPbQxhI.exe
  C:\Windows\System\uPbQxhI.exe
  2⤵
  PID:7056
- C:\Windows\System\vEEdppb.exe
  C:\Windows\System\vEEdppb.exe
  2⤵
  PID:6556
- C:\Windows\System\WgKiWnu.exe
  C:\Windows\System\WgKiWnu.exe
  2⤵
  PID:6824
- C:\Windows\System\AzdAWCi.exe
  C:\Windows\System\AzdAWCi.exe
  2⤵
  PID:7104
- C:\Windows\System\DdklWic.exe
  C:\Windows\System\DdklWic.exe
  2⤵
  PID:6788
- C:\Windows\System\PwzKfHR.exe
  C:\Windows\System\PwzKfHR.exe
  2⤵
  PID:6808
- C:\Windows\System\knkTIZJ.exe
  C:\Windows\System\knkTIZJ.exe
  2⤵
  PID:6876
- C:\Windows\System\iCgbkCk.exe
  C:\Windows\System\iCgbkCk.exe
  2⤵
  PID:6940
- C:\Windows\System\PFXMcwa.exe
  C:\Windows\System\PFXMcwa.exe
  2⤵
  PID:6956
- C:\Windows\System\GSaIxYq.exe
  C:\Windows\System\GSaIxYq.exe
  2⤵
  PID:6968
- C:\Windows\System\iGwQqSf.exe
  C:\Windows\System\iGwQqSf.exe
  2⤵
  PID:6160
- C:\Windows\System\EzRbzks.exe
  C:\Windows\System\EzRbzks.exe
  2⤵
  PID:6344
- C:\Windows\System\XuNgccq.exe
  C:\Windows\System\XuNgccq.exe
  2⤵
  PID:6544
- C:\Windows\System\yKBQBFI.exe
  C:\Windows\System\yKBQBFI.exe
  2⤵
  PID:6260
- C:\Windows\System\sBIPCqy.exe
  C:\Windows\System\sBIPCqy.exe
  2⤵
  PID:6320
- C:\Windows\System\UyRQDQc.exe
  C:\Windows\System\UyRQDQc.exe
  2⤵
  PID:6360
- C:\Windows\System\iibBktD.exe
  C:\Windows\System\iibBktD.exe
  2⤵
  PID:6708
- C:\Windows\System\GOWDRcB.exe
  C:\Windows\System\GOWDRcB.exe
  2⤵
  PID:5592
- C:\Windows\System\sAaEJna.exe
  C:\Windows\System\sAaEJna.exe
  2⤵
  PID:6524
- C:\Windows\System\zTiVHHT.exe
  C:\Windows\System\zTiVHHT.exe
  2⤵
  PID:7140
- C:\Windows\System\wPSqwGc.exe
  C:\Windows\System\wPSqwGc.exe
  2⤵
  PID:6000
- C:\Windows\System\srYsxIb.exe
  C:\Windows\System\srYsxIb.exe
  2⤵
  PID:6276
- C:\Windows\System\SZzBxqZ.exe
  C:\Windows\System\SZzBxqZ.exe
  2⤵
  PID:6760
- C:\Windows\System\eTnrRdR.exe
  C:\Windows\System\eTnrRdR.exe
  2⤵
  PID:6408
- C:\Windows\System\RVQGhmw.exe
  C:\Windows\System\RVQGhmw.exe
  2⤵
  PID:6612
- C:\Windows\System\KfsYiHL.exe
  C:\Windows\System\KfsYiHL.exe
  2⤵
  PID:7052
- C:\Windows\System\JYOTPXm.exe
  C:\Windows\System\JYOTPXm.exe
  2⤵
  PID:6356
- C:\Windows\System\ZatvJbo.exe
  C:\Windows\System\ZatvJbo.exe
  2⤵
  PID:6816
- C:\Windows\System\iYLyaex.exe
  C:\Windows\System\iYLyaex.exe
  2⤵
  PID:6904
- C:\Windows\System\ycpvKll.exe
  C:\Windows\System\ycpvKll.exe
  2⤵
  PID:6980
- C:\Windows\System\CmIKbIA.exe
  C:\Windows\System\CmIKbIA.exe
  2⤵
  PID:6792
- C:\Windows\System\UPwjzLL.exe
  C:\Windows\System\UPwjzLL.exe
  2⤵
  PID:7068
- C:\Windows\System\OPMQdvV.exe
  C:\Windows\System\OPMQdvV.exe
  2⤵
  PID:6948
- C:\Windows\System\FCbATBX.exe
  C:\Windows\System\FCbATBX.exe
  2⤵
  PID:6508
- C:\Windows\System\KwjESel.exe
  C:\Windows\System\KwjESel.exe
  2⤵
  PID:6908
- C:\Windows\System\whtzfwr.exe
  C:\Windows\System\whtzfwr.exe
  2⤵
  PID:6964
- C:\Windows\System\SjzOAak.exe
  C:\Windows\System\SjzOAak.exe
  2⤵
  PID:6240
- C:\Windows\System\KbYGeYU.exe
  C:\Windows\System\KbYGeYU.exe
  2⤵
  PID:6636
- C:\Windows\System\QOPcNeZ.exe
  C:\Windows\System\QOPcNeZ.exe
  2⤵
  PID:5960
- C:\Windows\System\uawgUcB.exe
  C:\Windows\System\uawgUcB.exe
  2⤵
  PID:6820
- C:\Windows\System\cBhddGk.exe
  C:\Windows\System\cBhddGk.exe
  2⤵
  PID:6784
- C:\Windows\System\DLFlMmQ.exe
  C:\Windows\System\DLFlMmQ.exe
  2⤵
  PID:6872
- C:\Windows\System\ObKaJTk.exe
  C:\Windows\System\ObKaJTk.exe
  2⤵
  PID:6840
- C:\Windows\System\PhOKQkr.exe
  C:\Windows\System\PhOKQkr.exe
  2⤵
  PID:7156
- C:\Windows\System\FTEKiCc.exe
  C:\Windows\System\FTEKiCc.exe
  2⤵
  PID:6460
- C:\Windows\System\GRKOpnV.exe
  C:\Windows\System\GRKOpnV.exe
  2⤵
  PID:6236
- C:\Windows\System\ZBMuFre.exe
  C:\Windows\System\ZBMuFre.exe
  2⤵
  PID:6444
- C:\Windows\System\HKKBXRy.exe
  C:\Windows\System\HKKBXRy.exe
  2⤵
  PID:6796
- C:\Windows\System\PIGQAHf.exe
  C:\Windows\System\PIGQAHf.exe
  2⤵
  PID:6564
- C:\Windows\System\hECVfyr.exe
  C:\Windows\System\hECVfyr.exe
  2⤵
  PID:6764
- C:\Windows\System\bBTqrgO.exe
  C:\Windows\System\bBTqrgO.exe
  2⤵
  PID:1564
- C:\Windows\System\FGdGlFZ.exe
  C:\Windows\System\FGdGlFZ.exe
  2⤵
  PID:6376
- C:\Windows\System\UyhrGmh.exe
  C:\Windows\System\UyhrGmh.exe
  2⤵
  PID:6744
- C:\Windows\System\ZJokrih.exe
  C:\Windows\System\ZJokrih.exe
  2⤵
  PID:5848
- C:\Windows\System\FBPFviJ.exe
  C:\Windows\System\FBPFviJ.exe
  2⤵
  PID:6324
- C:\Windows\System\UPPTJxc.exe
  C:\Windows\System\UPPTJxc.exe
  2⤵
  PID:6036
- C:\Windows\System\tzpdjEf.exe
  C:\Windows\System\tzpdjEf.exe
  2⤵
  PID:6412
- C:\Windows\System\oaLlWGs.exe
  C:\Windows\System\oaLlWGs.exe
  2⤵
  PID:7184
- C:\Windows\System\okdYRYw.exe
  C:\Windows\System\okdYRYw.exe
  2⤵
  PID:7200
- C:\Windows\System\johSytD.exe
  C:\Windows\System\johSytD.exe
  2⤵
  PID:7220
- C:\Windows\System\FoGpIRw.exe
  C:\Windows\System\FoGpIRw.exe
  2⤵
  PID:7236
- C:\Windows\System\oqtYYIm.exe
  C:\Windows\System\oqtYYIm.exe
  2⤵
  PID:7252
- C:\Windows\System\ovolSAW.exe
  C:\Windows\System\ovolSAW.exe
  2⤵
  PID:7268
- C:\Windows\System\mybOZJE.exe
  C:\Windows\System\mybOZJE.exe
  2⤵
  PID:7284
- C:\Windows\System\nasEgEL.exe
  C:\Windows\System\nasEgEL.exe
  2⤵
  PID:7300
- C:\Windows\System\qBNtQXj.exe
  C:\Windows\System\qBNtQXj.exe
  2⤵
  PID:7316
- C:\Windows\System\RjUgjWL.exe
  C:\Windows\System\RjUgjWL.exe
  2⤵
  PID:7332
- C:\Windows\System\wQyOylp.exe
  C:\Windows\System\wQyOylp.exe
  2⤵
  PID:7348
- C:\Windows\System\TDyFUFi.exe
  C:\Windows\System\TDyFUFi.exe
  2⤵
  PID:7364
- C:\Windows\System\QMaKrfo.exe
  C:\Windows\System\QMaKrfo.exe
  2⤵
  PID:7380
- C:\Windows\System\hfGYWjE.exe
  C:\Windows\System\hfGYWjE.exe
  2⤵
  PID:7396
- C:\Windows\System\cFHZkiS.exe
  C:\Windows\System\cFHZkiS.exe
  2⤵
  PID:7412
- C:\Windows\System\trMdTUb.exe
  C:\Windows\System\trMdTUb.exe
  2⤵
  PID:7428
- C:\Windows\System\QivMefs.exe
  C:\Windows\System\QivMefs.exe
  2⤵
  PID:7444
- C:\Windows\System\ezRwePl.exe
  C:\Windows\System\ezRwePl.exe
  2⤵
  PID:7460
- C:\Windows\System\ZhIgNip.exe
  C:\Windows\System\ZhIgNip.exe
  2⤵
  PID:7484
- C:\Windows\System\wdByfSH.exe
  C:\Windows\System\wdByfSH.exe
  2⤵
  PID:7504
- C:\Windows\System\jXOLRcU.exe
  C:\Windows\System\jXOLRcU.exe
  2⤵
  PID:7520
- C:\Windows\System\BAaTCwj.exe
  C:\Windows\System\BAaTCwj.exe
  2⤵
  PID:7536
- C:\Windows\System\fXKQPgh.exe
  C:\Windows\System\fXKQPgh.exe
  2⤵
  PID:7552
- C:\Windows\System\uvlhsTC.exe
  C:\Windows\System\uvlhsTC.exe
  2⤵
  PID:7568
- C:\Windows\System\CpOmCAj.exe
  C:\Windows\System\CpOmCAj.exe
  2⤵
  PID:7584
- C:\Windows\System\jNmpUJL.exe
  C:\Windows\System\jNmpUJL.exe
  2⤵
  PID:7600
- C:\Windows\System\phsJbwV.exe
  C:\Windows\System\phsJbwV.exe
  2⤵
  PID:7616
- C:\Windows\System\bFuZFXq.exe
  C:\Windows\System\bFuZFXq.exe
  2⤵
  PID:7632
- C:\Windows\System\wbIZYAY.exe
  C:\Windows\System\wbIZYAY.exe
  2⤵
  PID:7656
- C:\Windows\System\zZJvsvl.exe
  C:\Windows\System\zZJvsvl.exe
  2⤵
  PID:7672
- C:\Windows\System\ZQVEEPk.exe
  C:\Windows\System\ZQVEEPk.exe
  2⤵
  PID:7688
- C:\Windows\System\CsKyxTU.exe
  C:\Windows\System\CsKyxTU.exe
  2⤵
  PID:7704
- C:\Windows\System\KFcrTuA.exe
  C:\Windows\System\KFcrTuA.exe
  2⤵
  PID:7720
- C:\Windows\System\RNbfuHB.exe
  C:\Windows\System\RNbfuHB.exe
  2⤵
  PID:7736
- C:\Windows\System\QUEKCKf.exe
  C:\Windows\System\QUEKCKf.exe
  2⤵
  PID:7752
- C:\Windows\System\COQAyQm.exe
  C:\Windows\System\COQAyQm.exe
  2⤵
  PID:7768
- C:\Windows\System\oqOruda.exe
  C:\Windows\System\oqOruda.exe
  2⤵
  PID:7784
- C:\Windows\System\mqQYtHO.exe
  C:\Windows\System\mqQYtHO.exe
  2⤵
  PID:7800
- C:\Windows\System\zwTlZgY.exe
  C:\Windows\System\zwTlZgY.exe
  2⤵
  PID:7816
- C:\Windows\System\shCdJJm.exe
  C:\Windows\System\shCdJJm.exe
  2⤵
  PID:7832
- C:\Windows\System\TlMsaKQ.exe
  C:\Windows\System\TlMsaKQ.exe
  2⤵
  PID:7848
- C:\Windows\System\iWSrsgM.exe
  C:\Windows\System\iWSrsgM.exe
  2⤵
  PID:7864
- C:\Windows\System\SmRYulS.exe
  C:\Windows\System\SmRYulS.exe
  2⤵
  PID:7880
- C:\Windows\System\QRvoUml.exe
  C:\Windows\System\QRvoUml.exe
  2⤵
  PID:7896
- C:\Windows\System\hcZpSyQ.exe
  C:\Windows\System\hcZpSyQ.exe
  2⤵
  PID:7912
- C:\Windows\System\lclIvKy.exe
  C:\Windows\System\lclIvKy.exe
  2⤵
  PID:7928
- C:\Windows\System\ELzpYuE.exe
  C:\Windows\System\ELzpYuE.exe
  2⤵
  PID:7944
- C:\Windows\System\tQJhIHq.exe
  C:\Windows\System\tQJhIHq.exe
  2⤵
  PID:7960
- C:\Windows\System\nusPgiJ.exe
  C:\Windows\System\nusPgiJ.exe
  2⤵
  PID:7976
- C:\Windows\System\haLNRZS.exe
  C:\Windows\System\haLNRZS.exe
  2⤵
  PID:7992
- C:\Windows\System\NxWgPWX.exe
  C:\Windows\System\NxWgPWX.exe
  2⤵
  PID:8008
- C:\Windows\System\iXwMirD.exe
  C:\Windows\System\iXwMirD.exe
  2⤵
  PID:8024
- C:\Windows\System\LUwNrhP.exe
  C:\Windows\System\LUwNrhP.exe
  2⤵
  PID:8040
- C:\Windows\System\svsAwqf.exe
  C:\Windows\System\svsAwqf.exe
  2⤵
  PID:8056
- C:\Windows\System\bmhfWRJ.exe
  C:\Windows\System\bmhfWRJ.exe
  2⤵
  PID:8072
- C:\Windows\System\jEtNlkg.exe
  C:\Windows\System\jEtNlkg.exe
  2⤵
  PID:8088
- C:\Windows\System\JtyUmSy.exe
  C:\Windows\System\JtyUmSy.exe
  2⤵
  PID:8104
- C:\Windows\System\fZcprhp.exe
  C:\Windows\System\fZcprhp.exe
  2⤵
  PID:8120
- C:\Windows\System\VhTNxLv.exe
  C:\Windows\System\VhTNxLv.exe
  2⤵
  PID:8136
- C:\Windows\System\tkvDFzf.exe
  C:\Windows\System\tkvDFzf.exe
  2⤵
  PID:8152
- C:\Windows\System\FlwjuPN.exe
  C:\Windows\System\FlwjuPN.exe
  2⤵
  PID:8172
- C:\Windows\System\hqSOXuJ.exe
  C:\Windows\System\hqSOXuJ.exe
  2⤵
  PID:8188
- C:\Windows\System\vRFbpKJ.exe
  C:\Windows\System\vRFbpKJ.exe
  2⤵
  PID:7180
- C:\Windows\System\YuqcDOz.exe
  C:\Windows\System\YuqcDOz.exe
  2⤵
  PID:5236
- C:\Windows\System\usqrOxD.exe
  C:\Windows\System\usqrOxD.exe
  2⤵
  PID:7216
- C:\Windows\System\rKADMWX.exe
  C:\Windows\System\rKADMWX.exe
  2⤵
  PID:7264
- C:\Windows\System\CYxxhzJ.exe
  C:\Windows\System\CYxxhzJ.exe
  2⤵
  PID:7296
- C:\Windows\System\pPnzUay.exe
  C:\Windows\System\pPnzUay.exe
  2⤵
  PID:7564
- C:\Windows\System\OeXdZby.exe
  C:\Windows\System\OeXdZby.exe
  2⤵
  PID:7512
- C:\Windows\System\KSaRXkX.exe
  C:\Windows\System\KSaRXkX.exe
  2⤵
  PID:7576
- C:\Windows\System\vnEWNKQ.exe
  C:\Windows\System\vnEWNKQ.exe
  2⤵
  PID:7640
- C:\Windows\System\djaexqe.exe
  C:\Windows\System\djaexqe.exe
  2⤵
  PID:7728
- C:\Windows\System\QxVJHfe.exe
  C:\Windows\System\QxVJHfe.exe
  2⤵
  PID:7680
- C:\Windows\System\myFETYI.exe
  C:\Windows\System\myFETYI.exe
  2⤵
  PID:7780
- C:\Windows\System\IOytlHA.exe
  C:\Windows\System\IOytlHA.exe
  2⤵
  PID:7940
- C:\Windows\System\egjFMNm.exe
  C:\Windows\System\egjFMNm.exe
  2⤵
  PID:7968
- C:\Windows\System\ZeeYXuc.exe
  C:\Windows\System\ZeeYXuc.exe
  2⤵
  PID:8004
- C:\Windows\System\SHQkIQS.exe
  C:\Windows\System\SHQkIQS.exe
  2⤵
  PID:8052
- C:\Windows\System\uruSFal.exe
  C:\Windows\System\uruSFal.exe
  2⤵
  PID:8084
- C:\Windows\System\VWcAiyI.exe
  C:\Windows\System\VWcAiyI.exe
  2⤵
  PID:8144
- C:\Windows\System\uEMIsjM.exe
  C:\Windows\System\uEMIsjM.exe
  2⤵
  PID:6888
- C:\Windows\System\XCtxJmr.exe
  C:\Windows\System\XCtxJmr.exe
  2⤵
  PID:7312
- C:\Windows\System\QzxuxXv.exe
  C:\Windows\System\QzxuxXv.exe
  2⤵
  PID:7356
- C:\Windows\System\MWNDWYv.exe
  C:\Windows\System\MWNDWYv.exe
  2⤵
  PID:8128
- C:\Windows\System\cFxgsOz.exe
  C:\Windows\System\cFxgsOz.exe
  2⤵
  PID:8168
- C:\Windows\System\xqgObTG.exe
  C:\Windows\System\xqgObTG.exe
  2⤵
  PID:7212
- C:\Windows\System\FTvsIBA.exe
  C:\Windows\System\FTvsIBA.exe
  2⤵
  PID:7424
- C:\Windows\System\nKJjDPF.exe
  C:\Windows\System\nKJjDPF.exe
  2⤵
  PID:7452
- C:\Windows\System\Nfhltur.exe
  C:\Windows\System\Nfhltur.exe
  2⤵
  PID:7436
- C:\Windows\System\zzIBdmY.exe
  C:\Windows\System\zzIBdmY.exe
  2⤵
  PID:7844
- C:\Windows\System\joNvnDH.exe
  C:\Windows\System\joNvnDH.exe
  2⤵
  PID:8000
- C:\Windows\System\SbiPScX.exe
  C:\Windows\System\SbiPScX.exe
  2⤵
  PID:7372
- C:\Windows\System\eovKPHU.exe
  C:\Windows\System\eovKPHU.exe
  2⤵
  PID:7496
- C:\Windows\System\CwMwENy.exe
  C:\Windows\System\CwMwENy.exe
  2⤵
  PID:7468
- C:\Windows\System\IXzEUhq.exe
  C:\Windows\System\IXzEUhq.exe
  2⤵
  PID:7548
- C:\Windows\System\gwWbADk.exe
  C:\Windows\System\gwWbADk.exe
  2⤵
  PID:8036
- C:\Windows\System\BjFPmxO.exe
  C:\Windows\System\BjFPmxO.exe
  2⤵
  PID:8096
- C:\Windows\System\eXBtdiw.exe
  C:\Windows\System\eXBtdiw.exe
  2⤵
  PID:8112
- C:\Windows\System\kHpKSLD.exe
  C:\Windows\System\kHpKSLD.exe
  2⤵
  PID:7192
- C:\Windows\System\djJSvXB.exe
  C:\Windows\System\djJSvXB.exe
  2⤵
  PID:7892
- C:\Windows\System\SHNtVjc.exe
  C:\Windows\System\SHNtVjc.exe
  2⤵
  PID:7924
- C:\Windows\System\KEYVcra.exe
  C:\Windows\System\KEYVcra.exe
  2⤵
  PID:7500
- C:\Windows\System\lhSnrZP.exe
  C:\Windows\System\lhSnrZP.exe
  2⤵
  PID:7956
- C:\Windows\System\uHVoMaP.exe
  C:\Windows\System\uHVoMaP.exe
  2⤵
  PID:7532
- C:\Windows\System\tOJwTwc.exe
  C:\Windows\System\tOJwTwc.exe
  2⤵
  PID:7528
- C:\Windows\System\AYkTGuf.exe
  C:\Windows\System\AYkTGuf.exe
  2⤵
  PID:7376
- C:\Windows\System\JooCZwd.exe
  C:\Windows\System\JooCZwd.exe
  2⤵
  PID:7856
- C:\Windows\System\YcvuyaE.exe
  C:\Windows\System\YcvuyaE.exe
  2⤵
  PID:7624
- C:\Windows\System\lqsCmav.exe
  C:\Windows\System\lqsCmav.exe
  2⤵
  PID:7808
- C:\Windows\System\JYHAWKp.exe
  C:\Windows\System\JYHAWKp.exe
  2⤵
  PID:7612
- C:\Windows\System\lOWOdFx.exe
  C:\Windows\System\lOWOdFx.exe
  2⤵
  PID:7764
- C:\Windows\System\UHwTizn.exe
  C:\Windows\System\UHwTizn.exe
  2⤵
  PID:6984
- C:\Windows\System\FQPoors.exe
  C:\Windows\System\FQPoors.exe
  2⤵
  PID:8180
- C:\Windows\System\MoqJQBs.exe
  C:\Windows\System\MoqJQBs.exe
  2⤵
  PID:8160
- C:\Windows\System\JGVfhCq.exe
  C:\Windows\System\JGVfhCq.exe
  2⤵
  PID:7904
- C:\Windows\System\ChkRizD.exe
  C:\Windows\System\ChkRizD.exe
  2⤵
  PID:7792
- C:\Windows\System\RkpjzOx.exe
  C:\Windows\System\RkpjzOx.exe
  2⤵
  PID:8020
- C:\Windows\System\xsQFHtN.exe
  C:\Windows\System\xsQFHtN.exe
  2⤵
  PID:7260
- C:\Windows\System\zyEodmj.exe
  C:\Windows\System\zyEodmj.exe
  2⤵
  PID:7908
- C:\Windows\System\VdyXKrd.exe
  C:\Windows\System\VdyXKrd.exe
  2⤵
  PID:7684
- C:\Windows\System\zIFHZur.exe
  C:\Windows\System\zIFHZur.exe
  2⤵
  PID:8116
- C:\Windows\System\jlbRqWM.exe
  C:\Windows\System\jlbRqWM.exe
  2⤵
  PID:7196
- C:\Windows\System\TIqdccd.exe
  C:\Windows\System\TIqdccd.exe
  2⤵
  PID:7888
- C:\Windows\System\iVlXlse.exe
  C:\Windows\System\iVlXlse.exe
  2⤵
  PID:7828
- C:\Windows\System\JCacAzi.exe
  C:\Windows\System\JCacAzi.exe
  2⤵
  PID:7176
- C:\Windows\System\gyknnqI.exe
  C:\Windows\System\gyknnqI.exe
  2⤵
  PID:8204
- C:\Windows\System\NuPXhun.exe
  C:\Windows\System\NuPXhun.exe
  2⤵
  PID:8220
- C:\Windows\System\MexUiTY.exe
  C:\Windows\System\MexUiTY.exe
  2⤵
  PID:8236
- C:\Windows\System\qVqsjZZ.exe
  C:\Windows\System\qVqsjZZ.exe
  2⤵
  PID:8252
- C:\Windows\System\bUKkFCa.exe
  C:\Windows\System\bUKkFCa.exe
  2⤵
  PID:8268
- C:\Windows\System\vdXyWES.exe
  C:\Windows\System\vdXyWES.exe
  2⤵
  PID:8284
- C:\Windows\System\fhchxfH.exe
  C:\Windows\System\fhchxfH.exe
  2⤵
  PID:8304
- C:\Windows\System\piPUVty.exe
  C:\Windows\System\piPUVty.exe
  2⤵
  PID:8320
- C:\Windows\System\HgYsdsK.exe
  C:\Windows\System\HgYsdsK.exe
  2⤵
  PID:8336
- C:\Windows\System\yrFqzwK.exe
  C:\Windows\System\yrFqzwK.exe
  2⤵
  PID:8352
- C:\Windows\System\HAriJKN.exe
  C:\Windows\System\HAriJKN.exe
  2⤵
  PID:8368
- C:\Windows\System\yMuxora.exe
  C:\Windows\System\yMuxora.exe
  2⤵
  PID:8384
- C:\Windows\System\IOzZGVO.exe
  C:\Windows\System\IOzZGVO.exe
  2⤵
  PID:8400
- C:\Windows\System\xcQqXjf.exe
  C:\Windows\System\xcQqXjf.exe
  2⤵
  PID:8416
- C:\Windows\System\InFVwNY.exe
  C:\Windows\System\InFVwNY.exe
  2⤵
  PID:8432
- C:\Windows\System\socfawb.exe
  C:\Windows\System\socfawb.exe
  2⤵
  PID:8448
- C:\Windows\System\eZSsUXO.exe
  C:\Windows\System\eZSsUXO.exe
  2⤵
  PID:8464
- C:\Windows\System\CEhDbjj.exe
  C:\Windows\System\CEhDbjj.exe
  2⤵
  PID:8480
- C:\Windows\System\WZZRYqu.exe
  C:\Windows\System\WZZRYqu.exe
  2⤵
  PID:8496
- C:\Windows\System\qpNfHYi.exe
  C:\Windows\System\qpNfHYi.exe
  2⤵
  PID:8512
- C:\Windows\System\xZgcMIt.exe
  C:\Windows\System\xZgcMIt.exe
  2⤵
  PID:8528
- C:\Windows\System\EqpHxfR.exe
  C:\Windows\System\EqpHxfR.exe
  2⤵
  PID:8544
- C:\Windows\System\jeBMTYM.exe
  C:\Windows\System\jeBMTYM.exe
  2⤵
  PID:8560
- C:\Windows\System\ffPeOaX.exe
  C:\Windows\System\ffPeOaX.exe
  2⤵
  PID:8576
- C:\Windows\System\YGWptyY.exe
  C:\Windows\System\YGWptyY.exe
  2⤵
  PID:8592
- C:\Windows\System\aCooxSB.exe
  C:\Windows\System\aCooxSB.exe
  2⤵
  PID:8608
- C:\Windows\System\RpHqRKc.exe
  C:\Windows\System\RpHqRKc.exe
  2⤵
  PID:8624
- C:\Windows\System\rXlAZMl.exe
  C:\Windows\System\rXlAZMl.exe
  2⤵
  PID:8640
- C:\Windows\System\kughyNK.exe
  C:\Windows\System\kughyNK.exe
  2⤵
  PID:8656
- C:\Windows\System\vgHeehx.exe
  C:\Windows\System\vgHeehx.exe
  2⤵
  PID:8672
- C:\Windows\System\YyBcFRh.exe
  C:\Windows\System\YyBcFRh.exe
  2⤵
  PID:8692
- C:\Windows\System\GBAahop.exe
  C:\Windows\System\GBAahop.exe
  2⤵
  PID:8708
- C:\Windows\System\RBXRJIK.exe
  C:\Windows\System\RBXRJIK.exe
  2⤵
  PID:8724
- C:\Windows\System\RxxwFMJ.exe
  C:\Windows\System\RxxwFMJ.exe
  2⤵
  PID:8744
- C:\Windows\System\TFcKHJd.exe
  C:\Windows\System\TFcKHJd.exe
  2⤵
  PID:8760
- C:\Windows\System\XmDOJpn.exe
  C:\Windows\System\XmDOJpn.exe
  2⤵
  PID:8776
- C:\Windows\System\RRSkiDn.exe
  C:\Windows\System\RRSkiDn.exe
  2⤵
  PID:8792
- C:\Windows\System\JSADuwn.exe
  C:\Windows\System\JSADuwn.exe
  2⤵
  PID:8816
- C:\Windows\System\PeKwpmi.exe
  C:\Windows\System\PeKwpmi.exe
  2⤵
  PID:8844
- C:\Windows\System\mmiVisa.exe
  C:\Windows\System\mmiVisa.exe
  2⤵
  PID:8860
- C:\Windows\System\RpUCdHw.exe
  C:\Windows\System\RpUCdHw.exe
  2⤵
  PID:8880
- C:\Windows\System\WoNBMoZ.exe
  C:\Windows\System\WoNBMoZ.exe
  2⤵
  PID:8896
- C:\Windows\System\xHzsyFE.exe
  C:\Windows\System\xHzsyFE.exe
  2⤵
  PID:8912
- C:\Windows\System\WaiAwKB.exe
  C:\Windows\System\WaiAwKB.exe
  2⤵
  PID:8928
- C:\Windows\System\OOPCCOT.exe
  C:\Windows\System\OOPCCOT.exe
  2⤵
  PID:8944
- C:\Windows\System\JypRSGM.exe
  C:\Windows\System\JypRSGM.exe
  2⤵
  PID:8960
- C:\Windows\System\QPfrJnR.exe
  C:\Windows\System\QPfrJnR.exe
  2⤵
  PID:8976
- C:\Windows\System\WgOYAFn.exe
  C:\Windows\System\WgOYAFn.exe
  2⤵
  PID:8992
- C:\Windows\System\JItYenm.exe
  C:\Windows\System\JItYenm.exe
  2⤵
  PID:9048
- C:\Windows\System\dYpXUMg.exe
  C:\Windows\System\dYpXUMg.exe
  2⤵
  PID:9064
- C:\Windows\System\HWsKvZY.exe
  C:\Windows\System\HWsKvZY.exe
  2⤵
  PID:9084
- C:\Windows\System\DYyhmgd.exe
  C:\Windows\System\DYyhmgd.exe
  2⤵
  PID:9100
- C:\Windows\System\xADryFe.exe
  C:\Windows\System\xADryFe.exe
  2⤵
  PID:9116
- C:\Windows\System\hjlomty.exe
  C:\Windows\System\hjlomty.exe
  2⤵
  PID:9132
- C:\Windows\System\IbIJTxi.exe
  C:\Windows\System\IbIJTxi.exe
  2⤵
  PID:9148
- C:\Windows\System\xprCjJL.exe
  C:\Windows\System\xprCjJL.exe
  2⤵
  PID:9164
- C:\Windows\System\OkkKcoq.exe
  C:\Windows\System\OkkKcoq.exe
  2⤵
  PID:9180
- C:\Windows\System\ejjylYD.exe
  C:\Windows\System\ejjylYD.exe
  2⤵
  PID:9196
- C:\Windows\System\oqFTGuy.exe
  C:\Windows\System\oqFTGuy.exe
  2⤵
  PID:9212
- C:\Windows\System\hJRyGue.exe
  C:\Windows\System\hJRyGue.exe
  2⤵
  PID:8232
- C:\Windows\System\xVovRAc.exe
  C:\Windows\System\xVovRAc.exe
  2⤵
  PID:8328
- C:\Windows\System\ZvLkrXH.exe
  C:\Windows\System\ZvLkrXH.exe
  2⤵
  PID:7628
- C:\Windows\System\JkbCGuc.exe
  C:\Windows\System\JkbCGuc.exe
  2⤵
  PID:8392
- C:\Windows\System\ToKWRJu.exe
  C:\Windows\System\ToKWRJu.exe
  2⤵
  PID:8244
- C:\Windows\System\iZnEhvA.exe
  C:\Windows\System\iZnEhvA.exe
  2⤵
  PID:8348
- C:\Windows\System\etVSLsQ.exe
  C:\Windows\System\etVSLsQ.exe
  2⤵
  PID:8408
- C:\Windows\System\STeKcPA.exe
  C:\Windows\System\STeKcPA.exe
  2⤵
  PID:8412
- C:\Windows\System\KgxpdNE.exe
  C:\Windows\System\KgxpdNE.exe
  2⤵
  PID:8440
- C:\Windows\System\MyCqmBZ.exe
  C:\Windows\System\MyCqmBZ.exe
  2⤵
  PID:8556
- C:\Windows\System\QWndvPo.exe
  C:\Windows\System\QWndvPo.exe
  2⤵
  PID:7324
- C:\Windows\System\xSNDkwZ.exe
  C:\Windows\System\xSNDkwZ.exe
  2⤵
  PID:8616
- C:\Windows\System\GnpUBFy.exe
  C:\Windows\System\GnpUBFy.exe
  2⤵
  PID:8568
- C:\Windows\System\HofjwRr.exe
  C:\Windows\System\HofjwRr.exe
  2⤵
  PID:8604
- C:\Windows\System\FdeJpTf.exe
  C:\Windows\System\FdeJpTf.exe
  2⤵
  PID:8680
- C:\Windows\System\zliHJwQ.exe
  C:\Windows\System\zliHJwQ.exe
  2⤵
  PID:8720
- C:\Windows\System\uNPNePp.exe
  C:\Windows\System\uNPNePp.exe
  2⤵
  PID:9000
- C:\Windows\System\vPYJQcf.exe
  C:\Windows\System\vPYJQcf.exe
  2⤵
  PID:9020
- C:\Windows\System\EfQYUSG.exe
  C:\Windows\System\EfQYUSG.exe
  2⤵
  PID:9036
- C:\Windows\System\FlPhNbc.exe
  C:\Windows\System\FlPhNbc.exe
  2⤵
  PID:8840
- C:\Windows\System\MyRMwwv.exe
  C:\Windows\System\MyRMwwv.exe
  2⤵
  PID:8892
- C:\Windows\System\BxgQhuZ.exe
  C:\Windows\System\BxgQhuZ.exe
  2⤵
  PID:8920
- C:\Windows\System\qrlneUz.exe
  C:\Windows\System\qrlneUz.exe
  2⤵
  PID:9080
- C:\Windows\System\bxhHsCb.exe
  C:\Windows\System\bxhHsCb.exe
  2⤵
  PID:9144
- C:\Windows\System\uhmyMOK.exe
  C:\Windows\System\uhmyMOK.exe
  2⤵
  PID:8344
- C:\Windows\System\MBIJigr.exe
  C:\Windows\System\MBIJigr.exe
  2⤵
  PID:8772
- C:\Windows\System\xyqooxf.exe
  C:\Windows\System\xyqooxf.exe
  2⤵
  PID:9096
- C:\Windows\System\ZQaRJgc.exe
  C:\Windows\System\ZQaRJgc.exe
  2⤵
  PID:8520
- C:\Windows\System\bmGWrpH.exe
  C:\Windows\System\bmGWrpH.exe
  2⤵
  PID:8956
- C:\Windows\System\WZYgkuI.exe
  C:\Windows\System\WZYgkuI.exe
  2⤵
  PID:9176
- C:\Windows\System\zHFHgEk.exe
  C:\Windows\System\zHFHgEk.exe
  2⤵
  PID:8472
- C:\Windows\System\kRofjbX.exe
  C:\Windows\System\kRofjbX.exe
  2⤵
  PID:8552
- C:\Windows\System\oKRLjTV.exe
  C:\Windows\System\oKRLjTV.exe
  2⤵
  PID:9204
- C:\Windows\System\CxCQeDr.exe
  C:\Windows\System\CxCQeDr.exe
  2⤵
  PID:8936
- C:\Windows\System\ALwfkar.exe
  C:\Windows\System\ALwfkar.exe
  2⤵
  PID:8600
- C:\Windows\System\dFGdNHa.exe
  C:\Windows\System\dFGdNHa.exe
  2⤵
  PID:8784
- C:\Windows\System\yLzDGQa.exe
  C:\Windows\System\yLzDGQa.exe
  2⤵
  PID:8828
- C:\Windows\System\PuWdbvY.exe
  C:\Windows\System\PuWdbvY.exe
  2⤵
  PID:9208
- C:\Windows\System\KSDzPsH.exe
  C:\Windows\System\KSDzPsH.exe
  2⤵
  PID:9128
- C:\Windows\System\vaIfQux.exe
  C:\Windows\System\vaIfQux.exe
  2⤵
  PID:8836
- C:\Windows\System\oZEkqWN.exe
  C:\Windows\System\oZEkqWN.exe
  2⤵
  PID:8508
- C:\Windows\System\wsNRKbi.exe
  C:\Windows\System\wsNRKbi.exe
  2⤵
  PID:9032
- C:\Windows\System\wmpHYjj.exe
  C:\Windows\System\wmpHYjj.exe
  2⤵
  PID:8536
- C:\Windows\System\EQYSsSa.exe
  C:\Windows\System\EQYSsSa.exe
  2⤵
  PID:9092
- C:\Windows\System\YZBqfzI.exe
  C:\Windows\System\YZBqfzI.exe
  2⤵
  PID:8216
- C:\Windows\System\PtkXqAw.exe
  C:\Windows\System\PtkXqAw.exe
  2⤵
  PID:8788
- C:\Windows\System\neEiZbx.exe
  C:\Windows\System\neEiZbx.exe
  2⤵
  PID:9188
- C:\Windows\System\qTDHDHO.exe
  C:\Windows\System\qTDHDHO.exe
  2⤵
  PID:8904
- C:\Windows\System\qwHHqlJ.exe
  C:\Windows\System\qwHHqlJ.exe
  2⤵
  PID:8812
- C:\Windows\System\tuBqKhO.exe
  C:\Windows\System\tuBqKhO.exe
  2⤵
  PID:8620
- C:\Windows\System\CZUrHuj.exe
  C:\Windows\System\CZUrHuj.exe
  2⤵
  PID:9028
- C:\Windows\System\ngHJNgI.exe
  C:\Windows\System\ngHJNgI.exe
  2⤵
  PID:8524
- C:\Windows\System\hHaTeSH.exe
  C:\Windows\System\hHaTeSH.exe
  2⤵
  PID:8700
- C:\Windows\System\ThbTUEW.exe
  C:\Windows\System\ThbTUEW.exe
  2⤵
  PID:9016
- C:\Windows\System\Fkovjcl.exe
  C:\Windows\System\Fkovjcl.exe
  2⤵
  PID:8800
- C:\Windows\System\LGXXDZO.exe
  C:\Windows\System\LGXXDZO.exe
  2⤵
  PID:9156
- C:\Windows\System\NvlxdGc.exe
  C:\Windows\System\NvlxdGc.exe
  2⤵
  PID:8380
- C:\Windows\System\DUGWPSY.exe
  C:\Windows\System\DUGWPSY.exe
  2⤵
  PID:8888
- C:\Windows\System\LxoDKfq.exe
  C:\Windows\System\LxoDKfq.exe
  2⤵
  PID:9160
- C:\Windows\System\OWheFrX.exe
  C:\Windows\System\OWheFrX.exe
  2⤵
  PID:8364
- C:\Windows\System\FisGOEJ.exe
  C:\Windows\System\FisGOEJ.exe
  2⤵
  PID:8456
- C:\Windows\System\NiljehZ.exe
  C:\Windows\System\NiljehZ.exe
  2⤵
  PID:8756
- C:\Windows\System\UoCnreV.exe
  C:\Windows\System\UoCnreV.exe
  2⤵
  PID:9224
- C:\Windows\System\nknBZyn.exe
  C:\Windows\System\nknBZyn.exe
  2⤵
  PID:9240
- C:\Windows\System\WtZYYjj.exe
  C:\Windows\System\WtZYYjj.exe
  2⤵
  PID:9256
- C:\Windows\System\rTPWqWr.exe
  C:\Windows\System\rTPWqWr.exe
  2⤵
  PID:9272
- C:\Windows\System\gMTDMel.exe
  C:\Windows\System\gMTDMel.exe
  2⤵
  PID:9288
- C:\Windows\System\sOZdcBs.exe
  C:\Windows\System\sOZdcBs.exe
  2⤵
  PID:9308
- C:\Windows\System\GyMueTz.exe
  C:\Windows\System\GyMueTz.exe
  2⤵
  PID:9328
- C:\Windows\System\fjCIvQX.exe
  C:\Windows\System\fjCIvQX.exe
  2⤵
  PID:9348
- C:\Windows\System\unXGaZy.exe
  C:\Windows\System\unXGaZy.exe
  2⤵
  PID:9368
- C:\Windows\System\lBONpFx.exe
  C:\Windows\System\lBONpFx.exe
  2⤵
  PID:9384
- C:\Windows\System\NZkZoue.exe
  C:\Windows\System\NZkZoue.exe
  2⤵
  PID:9404
- C:\Windows\System\GFXeSys.exe
  C:\Windows\System\GFXeSys.exe
  2⤵
  PID:9424
- C:\Windows\System\TEBtoVG.exe
  C:\Windows\System\TEBtoVG.exe
  2⤵
  PID:9440
- C:\Windows\System\NhOYUbR.exe
  C:\Windows\System\NhOYUbR.exe
  2⤵
  PID:9464
- C:\Windows\System\Asxyboq.exe
  C:\Windows\System\Asxyboq.exe
  2⤵
  PID:9480
- C:\Windows\System\XnxGYyX.exe
  C:\Windows\System\XnxGYyX.exe
  2⤵
  PID:9500
- C:\Windows\System\zCbExSa.exe
  C:\Windows\System\zCbExSa.exe
  2⤵
  PID:9556
- C:\Windows\System\xrzisug.exe
  C:\Windows\System\xrzisug.exe
  2⤵
  PID:9572
- C:\Windows\System\KpgQlxN.exe
  C:\Windows\System\KpgQlxN.exe
  2⤵
  PID:9588
- C:\Windows\System\XRzxhyp.exe
  C:\Windows\System\XRzxhyp.exe
  2⤵
  PID:9604
- C:\Windows\System\MySMUUZ.exe
  C:\Windows\System\MySMUUZ.exe
  2⤵
  PID:9624
- C:\Windows\System\tZibwwK.exe
  C:\Windows\System\tZibwwK.exe
  2⤵
  PID:9640
- C:\Windows\System\ZqUCavX.exe
  C:\Windows\System\ZqUCavX.exe
  2⤵
  PID:9656
- C:\Windows\System\LcGbbCJ.exe
  C:\Windows\System\LcGbbCJ.exe
  2⤵
  PID:9672
- C:\Windows\System\RYYvimG.exe
  C:\Windows\System\RYYvimG.exe
  2⤵
  PID:9688
- C:\Windows\System\yKzrwsN.exe
  C:\Windows\System\yKzrwsN.exe
  2⤵
  PID:9704
- C:\Windows\System\gjPshoE.exe
  C:\Windows\System\gjPshoE.exe
  2⤵
  PID:9720
- C:\Windows\System\hdSPjXV.exe
  C:\Windows\System\hdSPjXV.exe
  2⤵
  PID:9736
- C:\Windows\System\LKKoCep.exe
  C:\Windows\System\LKKoCep.exe
  2⤵
  PID:9756
- C:\Windows\System\bpWVAca.exe
  C:\Windows\System\bpWVAca.exe
  2⤵
  PID:9772
- C:\Windows\System\sOMLLyb.exe
  C:\Windows\System\sOMLLyb.exe
  2⤵
  PID:9788
- C:\Windows\System\fPeaIbq.exe
  C:\Windows\System\fPeaIbq.exe
  2⤵
  PID:9804
- C:\Windows\System\mTSiwmR.exe
  C:\Windows\System\mTSiwmR.exe
  2⤵
  PID:9820
- C:\Windows\System\xlGpvvP.exe
  C:\Windows\System\xlGpvvP.exe
  2⤵
  PID:9836
- C:\Windows\System\tbKFpqz.exe
  C:\Windows\System\tbKFpqz.exe
  2⤵
  PID:9852
- C:\Windows\System\VcDgdAN.exe
  C:\Windows\System\VcDgdAN.exe
  2⤵
  PID:9868
- C:\Windows\System\WASJZOp.exe
  C:\Windows\System\WASJZOp.exe
  2⤵
  PID:9884
- C:\Windows\System\lOyWBax.exe
  C:\Windows\System\lOyWBax.exe
  2⤵
  PID:9968
- C:\Windows\System\PdJGimH.exe
  C:\Windows\System\PdJGimH.exe
  2⤵
  PID:9988
- C:\Windows\System\YcxlmTn.exe
  C:\Windows\System\YcxlmTn.exe
  2⤵
  PID:10004
- C:\Windows\System\yRWufwz.exe
  C:\Windows\System\yRWufwz.exe
  2⤵
  PID:10020
- C:\Windows\System\cLadVJO.exe
  C:\Windows\System\cLadVJO.exe
  2⤵
  PID:10036
- C:\Windows\System\hWBzvTS.exe
  C:\Windows\System\hWBzvTS.exe
  2⤵
  PID:10052
- C:\Windows\System\lrKAqyt.exe
  C:\Windows\System\lrKAqyt.exe
  2⤵
  PID:10068
- C:\Windows\System\bewUqgD.exe
  C:\Windows\System\bewUqgD.exe
  2⤵
  PID:10088
- C:\Windows\System\sddzUrn.exe
  C:\Windows\System\sddzUrn.exe
  2⤵
  PID:10104
- C:\Windows\System\ShqFQiu.exe
  C:\Windows\System\ShqFQiu.exe
  2⤵
  PID:10120
- C:\Windows\System\MLNHpKa.exe
  C:\Windows\System\MLNHpKa.exe
  2⤵
  PID:10136
- C:\Windows\System\GWHXTiu.exe
  C:\Windows\System\GWHXTiu.exe
  2⤵
  PID:10152
- C:\Windows\System\jnVyXgL.exe
  C:\Windows\System\jnVyXgL.exe
  2⤵
  PID:10168
- C:\Windows\System\Vyommdu.exe
  C:\Windows\System\Vyommdu.exe
  2⤵
  PID:10184
- C:\Windows\System\aBFzNWS.exe
  C:\Windows\System\aBFzNWS.exe
  2⤵
  PID:10200
- C:\Windows\System\IFZFfpP.exe
  C:\Windows\System\IFZFfpP.exe
  2⤵
  PID:10216
- C:\Windows\System\xMLBSay.exe
  C:\Windows\System\xMLBSay.exe
  2⤵
  PID:10236
- C:\Windows\System\JPnAfLP.exe
  C:\Windows\System\JPnAfLP.exe
  2⤵
  PID:8296
- C:\Windows\System\dCJaKKD.exe
  C:\Windows\System\dCJaKKD.exe
  2⤵
  PID:9300
- C:\Windows\System\HXsfEEh.exe
  C:\Windows\System\HXsfEEh.exe
  2⤵
  PID:9412
- C:\Windows\System\VnMSzYY.exe
  C:\Windows\System\VnMSzYY.exe
  2⤵
  PID:9448
- C:\Windows\System\ddFFNYC.exe
  C:\Windows\System\ddFFNYC.exe
  2⤵
  PID:9460
- C:\Windows\System\KwcLgPq.exe
  C:\Windows\System\KwcLgPq.exe
  2⤵
  PID:9492
- C:\Windows\System\NstfKrW.exe
  C:\Windows\System\NstfKrW.exe
  2⤵
  PID:8316
- C:\Windows\System\PtlOVqu.exe
  C:\Windows\System\PtlOVqu.exe
  2⤵
  PID:8740
- C:\Windows\System\PYvUQwb.exe
  C:\Windows\System\PYvUQwb.exe
  2⤵
  PID:9324
- C:\Windows\System\QPRjFte.exe
  C:\Windows\System\QPRjFte.exe
  2⤵
  PID:9472
- C:\Windows\System\NvxwRBO.exe
  C:\Windows\System\NvxwRBO.exe
  2⤵
  PID:9432
- C:\Windows\System\ULewHKZ.exe
  C:\Windows\System\ULewHKZ.exe
  2⤵
  PID:9280
- C:\Windows\System\eEGuXJq.exe
  C:\Windows\System\eEGuXJq.exe
  2⤵
  PID:9548
- C:\Windows\System\HNtbHWj.exe
  C:\Windows\System\HNtbHWj.exe
  2⤵
  PID:9564
- C:\Windows\System\FRtJtqf.exe
  C:\Windows\System\FRtJtqf.exe
  2⤵
  PID:9600
- C:\Windows\System\xaPIcsy.exe
  C:\Windows\System\xaPIcsy.exe
  2⤵
  PID:9912
- C:\Windows\System\WJIUNeA.exe
  C:\Windows\System\WJIUNeA.exe
  2⤵
  PID:9928
- C:\Windows\System\ITuczDI.exe
  C:\Windows\System\ITuczDI.exe
  2⤵
  PID:9944
- C:\Windows\System\FQupWYb.exe
  C:\Windows\System\FQupWYb.exe
  2⤵
  PID:9996
- C:\Windows\System\JXDPBCG.exe
  C:\Windows\System\JXDPBCG.exe
  2⤵
  PID:10112
- C:\Windows\System\XysVoki.exe
  C:\Windows\System\XysVoki.exe
  2⤵
  PID:10176
- C:\Windows\System\JZHPSGw.exe
  C:\Windows\System\JZHPSGw.exe
  2⤵
  PID:10228
- C:\Windows\System\DPZnHqZ.exe
  C:\Windows\System\DPZnHqZ.exe
  2⤵
  PID:9236
- C:\Windows\System\ZrMVlOQ.exe
  C:\Windows\System\ZrMVlOQ.exe
  2⤵
  PID:9420
- C:\Windows\System\CGjSVNm.exe
  C:\Windows\System\CGjSVNm.exe
  2⤵
  PID:9456
- C:\Windows\System\RRMkBYg.exe
  C:\Windows\System\RRMkBYg.exe
  2⤵
  PID:9356
- C:\Windows\System\UqkiKCj.exe
  C:\Windows\System\UqkiKCj.exe
  2⤵
  PID:9476
- C:\Windows\System\HiRjeqD.exe
  C:\Windows\System\HiRjeqD.exe
  2⤵
  PID:9532
- C:\Windows\System\ATJjVrE.exe
  C:\Windows\System\ATJjVrE.exe
  2⤵
  PID:9596
- C:\Windows\System\kvkIpra.exe
  C:\Windows\System\kvkIpra.exe
  2⤵
  PID:9664
- C:\Windows\System\MGSiXZB.exe
  C:\Windows\System\MGSiXZB.exe
  2⤵
  PID:9732
- C:\Windows\System\twwCcjz.exe
  C:\Windows\System\twwCcjz.exe
  2⤵
  PID:9712
- C:\Windows\System\PSYGqlj.exe
  C:\Windows\System\PSYGqlj.exe
  2⤵
  PID:9752
- C:\Windows\System\oGIuSen.exe
  C:\Windows\System\oGIuSen.exe
  2⤵
  PID:9784
- C:\Windows\System\HdITzhe.exe
  C:\Windows\System\HdITzhe.exe
  2⤵
  PID:9904
- C:\Windows\System\TfPhPYP.exe
  C:\Windows\System\TfPhPYP.exe
  2⤵
  PID:9880
- C:\Windows\System\icdecnk.exe
  C:\Windows\System\icdecnk.exe
  2⤵
  PID:9800
- C:\Windows\System\CSfnylU.exe
  C:\Windows\System\CSfnylU.exe
  2⤵
  PID:9964
- C:\Windows\System\qDsNTZD.exe
  C:\Windows\System\qDsNTZD.exe
  2⤵
  PID:9956
- C:\Windows\System\sxzVgZq.exe
  C:\Windows\System\sxzVgZq.exe
  2⤵
  PID:10096
- C:\Windows\System\GmYSTSc.exe
  C:\Windows\System\GmYSTSc.exe
  2⤵
  PID:10164
- C:\Windows\System\InxAqka.exe
  C:\Windows\System\InxAqka.exe
  2⤵
  PID:10212
- C:\Windows\System\ldEwJRc.exe
  C:\Windows\System\ldEwJRc.exe
  2⤵
  PID:9296
- C:\Windows\System\ySTVXOi.exe
  C:\Windows\System\ySTVXOi.exe
  2⤵
  PID:9896
- C:\Windows\System\EvquBaT.exe
  C:\Windows\System\EvquBaT.exe
  2⤵
  PID:9336
- C:\Windows\System\ydRCTvq.exe
  C:\Windows\System\ydRCTvq.exe
  2⤵
  PID:9524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AkhXojH.exe

Filesize
2.2MB

MD5
645b7af9983bf45172058baefe86fb6f

SHA1
b7052c01627024bb5b70e5f906e580cd350bf4e2

SHA256
4f615b0f1d20bc50bf1a8e5fd626f72bad16c0bd228a0ac1be8428e30dff1180

SHA512
e069749472d863af5940f09b66f0696a23b439626b55decbfef086d36f9e885954a7b3d619c94da34209d2ba3e1db1aa2e26c338d0183586ab64a5d7923e83f7

Download Submit
C:\Windows\system\EQfMaKE.exe

Filesize
2.2MB

MD5
4a2b5416a1c6215f5d7af7f70737cc2a

SHA1
c264be5b16496f493e1e1436032d5cb22b81ecc9

SHA256
27b1e103f410864b29d72772159bbfb37418d5242ad7790e0f3566e335060e02

SHA512
1ab8b9e76f493ca4482b61f0e6a7708fba5fbed925750771f1c9b39024324e662e4dfe5fbcec300a0a05a4195b4a1c26112946c93dd41c1ea90ce84f6ef3bd4a

Download Submit
C:\Windows\system\EoAzUeq.exe

Filesize
2.2MB

MD5
fbdd2df5b5ed57ff3cd938ee2653fb58

SHA1
bd52aaa6dbd5f739be2da9d1891352300e192787

SHA256
e047ebac74411a83cc9da544a00c0c6be72540441f01cefbceb2f35a14bbc9a6

SHA512
a97697ea1fdcf8456bdb36fbc736d006ff7bcb1407e96936077879fa90b253df54a253738f812ca1ba9e6120b804028d44020708304a9af42a4c91ce1f780d84

Download Submit
C:\Windows\system\GVffWVb.exe

Filesize
2.2MB

MD5
8449cea5a23867e5bf4dccf03674978e

SHA1
91a70dcb98a114742ec7957612f96c6ebbf76fd2

SHA256
e76969ae0e3a1abe82ff8e5a57509c65ff041ba9940bd107b63908a630618c3b

SHA512
243f1eea7c0c248e38c3f2671516558a08fd8570a6c3e94ebcb2291af7d072750d3d974c0db51a5e666adba8f18c59929602b77a5ddd20d7a049094c25c9c646

Download Submit
C:\Windows\system\MjdaHVh.exe

Filesize
2.2MB

MD5
a5c228ebc394ce1d415a5a646d6dc50d

SHA1
ea3cca6c738f1a27508eb590c86873703df6dec7

SHA256
4f5164a60870987a71af1e9374235c969fcf79bc9f5d7d7ebb59eec5990fa452

SHA512
c39332beac0a8f633ff8e5250c14f6b1d25239471dd788cc7d49bd0e284e5eef0bc70ff2ab2c09a4a7d0584d7ccb04890c9518e0e20a12d8f66c874314875549

Download Submit
C:\Windows\system\MolXTOq.exe

Filesize
2.2MB

MD5
6a2a9cff4f218a1e285b70c1b899282f

SHA1
0e2d7836daa5faf0ad74a7041e39f3710d4c52e5

SHA256
52295531feece0cc1d4173aa9522e450bed315ffda1026d3b2f6f7370fe5e24c

SHA512
096e1551146a1d45937a7e56cbf40b5186efc23e77f8c75c0966d660e80b04a7300b859ee327b1a873e83ed316d6830e3974190c08ace8f57574e56fbea7a9ab

Download Submit
C:\Windows\system\OerZQGo.exe

Filesize
2.2MB

MD5
e8ff281af8a843396b7d37abc8d1073f

SHA1
33d4175ff7dc9599ec4cf3260fe61f360582ca68

SHA256
b16b5c5f1d4e25c73f6be80455087e40aa5ff0f78c609621984b140cf6bcae5d

SHA512
fc218f330b7705ae31ff276b7153bdd41cc9adf46d89ba322e06a53a9762436f7bcc77f9425c03838dbd7b4cf99cdd94ae4a20549bbc9c855fad49bc345c9e0f

Download Submit
C:\Windows\system\TmIWtEk.exe

Filesize
2.2MB

MD5
b6f437f3f94578bed6f40f5acc8e50de

SHA1
8713b2df4fef298a594906219cad5fbca05cdfed

SHA256
17d754b86fea9f7f18e85fcec6ce679d5c70db6c6566604767175246759fdf7a

SHA512
eabd43a9eccaee9334ed8bc7b5ebcd36c2ed93b3afb9d3b05133d69e7b6be5111bec5d206b1d7296cbe1beb3b30250da14d6d70ecd1cbb5622ae5d7d0699e6f7

Download Submit
C:\Windows\system\VZvFjtm.exe

Filesize
2.2MB

MD5
da2353323bd7ed80c35599954f7e9ec9

SHA1
756504f78bc5d729b92e3086a12805a876f53f54

SHA256
5ea55b690d87e5c8ccb6f63cc56e546e95cd32dabe1db8d9be88f708dd4168ca

SHA512
f44b50a530cb59fd5fb8873dd8169712460cfcf1cb489a1394aa3ed10d5df9ef549516a03abde8ea9c817e8c389f53834965377c9d5bd18da7f26e18812b7f7c

Download Submit
C:\Windows\system\WGKFWib.exe

Filesize
2.2MB

MD5
12c9e99327762a8e70f3e45d0b0a3a4b

SHA1
54828b0947990c1025fcbc613be00047dfbfb41a

SHA256
6bb6bc9d574b366db3c03099a439a22f43dc6ef0d8e7dac48119aeac64f8c916

SHA512
cfa942f888262f88907424cbd723c13f22257891dbcaf3b882a0e3e35a3d6f2402ae499292a12bad542c969bfd4869dfe747cdbf9233f22631d3cba74c8f1d34

Download Submit
C:\Windows\system\XwCKgvx.exe

Filesize
2.2MB

MD5
5cef59bf0e2050847651b51ae26616cb

SHA1
dd00bb891e7531d9b443d967ebc43f8398b4d968

SHA256
9ba11023447aaa121fe9cdb0ed46df7ca701bf52ac45d93ab614bc4b9d8df289

SHA512
b396f78603be7623f16d728a8d0fcd7db5d65c9178ada49f1a5c1face6413fd82b3d855eed1aa23743603a5625756a8e2f7ef88004079553564a4a67b9b6a267

Download Submit
C:\Windows\system\aesZgsW.exe

Filesize
2.2MB

MD5
0ef3696cf140ce225283f80938da514d

SHA1
9d9da82b4b703641055e65a29fd641ebaf6b7d3f

SHA256
26a27cce372a238e5d6d9c084b57be6aa81c33ca8a799359a266128fe63f9678

SHA512
92cd22e684a5de9409408b34bf34e5b9680ef7619f82ce699e9d55b54b81639f002fc35f1fa7f8f03dc64e8c5888293be93cad52c0d6edeca778a03617d0f42c

Download Submit
C:\Windows\system\cAJCyxI.exe

Filesize
2.2MB

MD5
2e2492b31c29d459cc5113629b7d9ea4

SHA1
abf4bbf5def77f566947b87df7a6796d4f1bd80d

SHA256
62e2c2fc7a2fb2485a261f3e5412cf811357133366a0f8c2d782a8bbd63891ac

SHA512
e6956eceee40898631925ef112a64973e4ebe011de99dc4f1a09ddcfe68f20c2bbd63a3990776351ba7abe14f351299bdbea1b64d0e218aca984b63c3a238673

Download Submit
C:\Windows\system\cXNCzaM.exe

Filesize
2.2MB

MD5
41a956e974b48a337dbfd58da1e305ab

SHA1
31c7b7c11f4670cb35231740e29246efbcbfb450

SHA256
5f876e120eb580c4330265986f2bbe067cdb920d1384daea4745fe28adb4f6dd

SHA512
1eeee5bb9e9f091df843976817b3d92ee07055f8770c727654c108481c7485b029a5d388da6d2771df1f2830aad86569552e3b97a8d5a68911256f196323884e

Download Submit
C:\Windows\system\hGFWSgq.exe

Filesize
2.2MB

MD5
c04ee029c011810a33d18ce2c1fde63c

SHA1
9451904a89b2667c930c13736a33491f51ad8c4b

SHA256
83a3eb44034f51784ffbccb14fb553d5ac56a91d71e3a19f7a2f273c47c29dde

SHA512
234144b4853728ab021a7281e956cb17aa4cf6da4ac88fafae578cc76d2f9b29181ccf5689d5ed08c65d9b04706bd15f89d9193b4e5a6dbd3c63fa15a7dab1d7

Download Submit
C:\Windows\system\ihMynZb.exe

Filesize
2.2MB

MD5
4314fd60047d5173b0568585e6901bec

SHA1
8216184438fdc1c3242de76de942f6285f1fa525

SHA256
94ca4bd51b2db17445db31ef5f97dcaece593784b50298b574270a53409292f3

SHA512
7e1842904bd515d92b23284f85bebd8a147b7a4107021ea6c08575832226f756a30c744981413b0c82c909024fcea947b499289eb61139905d75b143cabec438

Download Submit
C:\Windows\system\kBNGMit.exe

Filesize
2.2MB

MD5
dc2c6d64b2b64eababff248a168f1a20

SHA1
74a99a79d82312b31d931c28444f0907cf6d69ef

SHA256
928e85ad3ebd39361ecf9107b00fdeafb48a80ca27cc55a71b1b515affff7526

SHA512
4db14f3d4cf715c073fd47649acecb53e69c3b23317b5c77f89a6040f7a04e470d0fcebf2f8664a29a73b8f8623ebc1976f5dc2a187dfc42c951ff576ac4b0ff

Download Submit
C:\Windows\system\kjYTmax.exe

Filesize
2.2MB

MD5
7bce724cc6e02555d320938c71cc99c0

SHA1
956367d01fa91c747ed4a3af67220175f8ad9287

SHA256
895b6421c812513facd58fb7c98d26a6cf507f083badc134da96d918eaee84ba

SHA512
472ad7b40d7438da351bd90c0b6be075b58b21ca85938744bc2db7250a112b45b75d5bb05f25abb5c7ec932e6e19c299306ec8d7c88aae5a68da8d4e59ef3401

Download Submit
C:\Windows\system\knddupW.exe

Filesize
2.2MB

MD5
dd652da4b8f0a219779e1e85fafb7055

SHA1
fca234424fb7326a537f914494c96bed5ca9c803

SHA256
c9bd0fa33d0ad6b2e9c6ec57c8b43d2c7a1181d21d96ee41049eaef5b3d4e8d0

SHA512
b9c39d4dfe336aa9a5f286af8d9245fc06433a400604a144e42d92ae19e3fce2d90671f9d32baaccb2473a1a93c24542c8e08ae6496214c15b094406f6afa6e5

Download Submit
C:\Windows\system\kptrIhw.exe

Filesize
2.2MB

MD5
b56d5d419d15da608913a2345b7d51b1

SHA1
a18d0206f1f8970d28406cacd25bd8622636c995

SHA256
ba9189e59bb7191e75a3049fcf4f2b5ad0059b17f61202069ef17ee86f7624cc

SHA512
00c0ff0d3414429a6a977c1ea9d53a0e99d22194f39d8ac3d58458e141be77c26e592c80fe1eda05deae582f85dced9d38d7baccb1392c61711c617b2107ff38

Download Submit
C:\Windows\system\lWWpGnO.exe

Filesize
2.2MB

MD5
1ec0d0f98377448e8e5cc7bbdaf8de4f

SHA1
06968d8e5dca4300230e69e1f2454e57d2039a7c

SHA256
e99b1f11bb71ced2a652cb91a08a5fd8700504994416e762f4eb7ec87874ae6d

SHA512
f3e212679d474c34aae715fb827f16d9f1721cd806a852136c65f03c5939f279c4d58ffc815594167354060e5fad0749534ab23b240d04cab974bbafcf0a1241

Download Submit
C:\Windows\system\mYUAomH.exe

Filesize
2.2MB

MD5
ce8307d38f48a19870b2fa839f9f4f15

SHA1
753094a22d6f91caae83aa365ab6c70f081b5ebf

SHA256
98c65aabf790c76c18a9c33ca65b0d08d2320af55e642acbc244d0e5e9775ec7

SHA512
20205bfa4eb5bdc95678e7912777c9643322140e5debfabd5781c7d4d0a59e1fcccb5360b4d3c1a93b2cfdd9c9e0421182692fd117a5828acfa92a63f74cbac0

Download Submit
C:\Windows\system\nAigQXt.exe

Filesize
2.2MB

MD5
b6cdd71916ec37719963520ae21f6c8a

SHA1
477899cd1f53c02ee6851f0110fd5de3f7dd2c97

SHA256
add1eb9bce5bcbc2ba507ce90dd346dea75b635160e11781bed7fefc0f6a18be

SHA512
f5cdcd9e3633091938023eb2bdecaa50be6c4bef4ab3abea7eeeb62e142aed837f98f839f4124a27da5d61305e2b6dc7adbd460d1fb63149ebf0ad32efde06ed

Download Submit
C:\Windows\system\oYRQMTX.exe

Filesize
2.2MB

MD5
1bc12b583699e94a170b777c79f654b8

SHA1
6056b456bdcd1414f549ce3330963d14ef84c53b

SHA256
c3fcad41a59e5ad1008df101861c4ba1c7869d27810d3b58e418aa8bd84c7864

SHA512
3f087f7eaa168a8d26ec0d3931a9bd0aa8266d7f6b00c1afaec738e967545f921346acf5539ad7115193aa192fdeaabe11efe2e95e5f1ebba8ccacb98c9f6b17

Download Submit
C:\Windows\system\qqJBTmm.exe

Filesize
2.2MB

MD5
7aff4f4ea14a6ca9d3da8f8ca889283e

SHA1
5225c3d371bdeb2be00cef8b3c161f349beb1ae5

SHA256
d9e734fbbff0db748de96dea95b5796e508e8f6c8ff229ca3a6f4c7db4972600

SHA512
e2343a18153c2c7820e0d82728c86fdcd071426320f4a60e510284e409a3c65443458cd215f9b8c464f5354a6f3615aeeca8eb9cc93dda7ed40e68c4de274e0a

Download Submit
C:\Windows\system\sdfXuFh.exe

Filesize
2.2MB

MD5
ef2f75bb7f00cf62655a304276a2aace

SHA1
5f5599ddf023986971298879203883ed1b58c477

SHA256
f0d8e6a07a7b799ddd0f65f8ece8293ba3fc16dbc5d4f551c3a484accbb771b1

SHA512
3090818054317ade3cd629ff95629748647785c826811f6b59dba957f0ef84c06be94f715bb976cd70df5ee8a23aba1cab459021a25bea8c83cd70946094e3f9

Download Submit
C:\Windows\system\syYMTfp.exe

Filesize
2.2MB

MD5
03d3163b7b948f1cd0b41d5e8403ae68

SHA1
460cc4bdc84bc67742938300e54d94fe9e04d579

SHA256
2763879eadd05bcbb16a878383eec59d4199eb61fde6cc2c253fabbbe5184ff5

SHA512
45f4bb6fef16a22093d6537c045553decd44ef9e9fdf2f4bcc4a29cfb5f2d10b71b3effed2d2cd0809760fdde33aaf643222b3a24cc7dd06fef8f27e507d0c45

Download Submit
C:\Windows\system\woQYXOn.exe

Filesize
2.2MB

MD5
f7df806a16fdaa5ee521ea79a20d691c

SHA1
d6eda72b9b41e20644cd4209506c60e2dd6160ba

SHA256
99c450eaef92d9bf16ad549ad90145aae33b35a5e3670a0778a4f41f6f9605a8

SHA512
73ae4f5c5dfcdd770da00b97bff352ad911daa7d29c94b8a7595b297e8eed1a542eaf7171f0fe0eab96d5ed6a19d94c0edef8128e9e827aac1387cbc663fb97c

Download Submit
C:\Windows\system\xEHPsRA.exe

Filesize
2.2MB

MD5
c7238eca9f451fb07c1f7aeed78eaeb9

SHA1
ea63d0996f6e30455d8dc50b9b9a8ade09882083

SHA256
a532dce184af92822493ebd0078fb30cf720b08b42f004bcce08a9f245ae75d0

SHA512
da5b82cb04608a63fa073fa4e526580061f38f66b8862b9e8992b88118e2ac201c68a64489f4b1b9bdfa212133ce017fd8bf2caf65005cc73a569920dd22ff07

Download Submit
C:\Windows\system\xXSAXCi.exe

Filesize
2.2MB

MD5
9dd4fb1230360fd638a5e9103af7ae63

SHA1
6592a39a8b74dbb4869d09422713e0efe33e91d9

SHA256
bc4e85eb84fd115978ac40833c8eb524b71237a240cf2031f12a8382fcff8b4a

SHA512
5a6c01eb4a44edc2d0662e634019a57c62a7b9f129c1db108470c2a67fe16c9aadde1982159bf7d08a07c5607dbd4ec234f9c12c3fdf9473e81101ac86ecb328

Download Submit
\Windows\system\DNLEtlL.exe

Filesize
2.2MB

MD5
3e2f12f7bc92473a7d1872050454c2b0

SHA1
dac614e5f754b69e99850c0bdeda4b9021250a28

SHA256
e0c2bb343403101cdbb65a367061418b4e9237e327c9a081974558f0f13a7473

SHA512
244ae630183d3789123fcb6b4ccf2d81dc245c52ca314e8d37f6471dea7575eb547de348382f378ea4f404f1f2ae0b92319566fc2e48e5e746d66179fdff0213

Download Submit
\Windows\system\KHSllup.exe

Filesize
2.2MB

MD5
d83844764d58e9be09002bc407f9b735

SHA1
976989cf88a4704715328101879be238d748ba50

SHA256
3f61bc91d88e81e3baf5e47a8f376e56a65d76501bf12fda95a5b65c42e2274e

SHA512
1b27995ee9f65dd5949ecf2e07a1d0698f2c002995f907180ade256d0356953b33fba63c9d64333dcc594b76edbc2bb02e33de8f7b147f66fc4c238be53c3e20

Download Submit
memory/540-84-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/540-5384-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/848-50-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/848-3104-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-3115-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/1148-63-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/1268-91-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1268-3106-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1924-29-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download
memory/1924-97-0x000007FEF63BE000-0x000007FEF63BF000-memory.dmp

Filesize
4KB

Download
memory/1924-44-0x000007FEF6100000-0x000007FEF6A9D000-memory.dmp

Filesize
9.6MB

Download
memory/1924-34-0x000007FEF6100000-0x000007FEF6A9D000-memory.dmp

Filesize
9.6MB

Download
memory/1924-33-0x000007FEF6100000-0x000007FEF6A9D000-memory.dmp

Filesize
9.6MB

Download
memory/1924-30-0x000007FEF6100000-0x000007FEF6A9D000-memory.dmp

Filesize
9.6MB

Download
memory/1924-27-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/1924-554-0x000007FEF6100000-0x000007FEF6A9D000-memory.dmp

Filesize
9.6MB

Download
memory/1924-90-0x000007FEF6100000-0x000007FEF6A9D000-memory.dmp

Filesize
9.6MB

Download
memory/1924-25-0x000007FEF6100000-0x000007FEF6A9D000-memory.dmp

Filesize
9.6MB

Download
memory/1924-17-0x000007FEF63BE000-0x000007FEF63BF000-memory.dmp

Filesize
4KB

Download
memory/2136-77-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-3112-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-70-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2376-3114-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2524-51-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2524-3108-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2684-3292-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2684-26-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2716-45-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-1015-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-76-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-0-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2716-69-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-62-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2716-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2716-53-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2716-83-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2716-8-0x0000000003100000-0x00000000034F2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-32-0x0000000003100000-0x00000000034F2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-1263-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2716-1500-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-54-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-28-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-98-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2740-3107-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2740-16-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2812-99-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2812-5382-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2860-3113-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-31-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-1019-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/3064-3073-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/3064-59-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download