xmrig | d1178241d20d0d1fc7035e37b701a20d236aa2792cd9a36959908f6de8ea4fbf

Analysis

max time kernel
30s
max time network
31s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
Size

1.9MB
MD5

03c318f87a0d38fa5e29f5a91dac807f
SHA1

521655606ec73b87cb0a4ce9b2636c0d1d72f931
SHA256

d1178241d20d0d1fc7035e37b701a20d236aa2792cd9a36959908f6de8ea4fbf
SHA512

ce14c11d82233bff7c9398ba2046cb209fdfcfd3597ec12b7b534a7ea272a7ae1012cff363be9c1726c63d7f3ae848b2cced4777f88da51f1f9c60c4d3096855
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uf:NAB8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2500-122-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2476-127-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/2124-111-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2664-131-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2740-125-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/2708-124-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2660-123-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2876-120-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

Processes:

nKkWvUh.exeoxKgmiW.execBBNGTm.exeETgHxYY.exeBuMrQTo.exeiBEWrOR.exeUWjKgAC.exeQcIRlOs.exeEkQvzGd.exeoBCLCup.exekFPEYhl.exepFLrWqX.exeFNeJffa.exeijxxgwt.exeMItnTLI.exefuVVnqz.execskNRDn.exehQmuBqB.exeerdXAjO.exekAsBzCP.exepHzJZpz.exevJFVrXS.exeiVuXvyb.exebhOytoL.exeDSCbGBI.exeFYNDNuQ.exeWHmzRJD.exeNkOZIZi.exejuxwQgq.exeoeAJbXo.exetzKwtgl.exeFPkjNre.exerbxjRTv.exejsuYYiD.exejYvLPRO.exeMYYtmRS.exeyKyBBbe.exeDudfmCL.exeynBqnmu.exemoKIpBU.exeMZrvXtL.exeVDllqGt.exenXxrPCI.exeOJONaOP.exeprQVGvw.exeIEULOJi.exeqRwtEfg.exemiKmVfi.exexckeSnV.exeqEFyjGj.exevkzPrpe.exeMdLiaMM.exehYvwCYI.exeerSbzKs.exewjIYWQf.exebauzlLf.exeoJsNlLA.exeyUeTiJX.exeSmQwGBQ.exeoykOOuW.exeGjEZFcJ.exekfSLzpl.exehLYkcBn.exeCbONLZP.exe

pid	process
2648	nKkWvUh.exe
2124	oxKgmiW.exe
2664	cBBNGTm.exe
2876	ETgHxYY.exe
2500	BuMrQTo.exe
2660	iBEWrOR.exe
2708	UWjKgAC.exe
2740	QcIRlOs.exe
2476	EkQvzGd.exe
2976	oBCLCup.exe
2536	kFPEYhl.exe
2972	pFLrWqX.exe
1616	FNeJffa.exe
2700	ijxxgwt.exe
2944	MItnTLI.exe
1632	fuVVnqz.exe
2532	cskNRDn.exe
2176	hQmuBqB.exe
2352	erdXAjO.exe
2784	kAsBzCP.exe
1640	pHzJZpz.exe
2308	vJFVrXS.exe
2560	iVuXvyb.exe
2832	bhOytoL.exe
2328	DSCbGBI.exe
268	FYNDNuQ.exe
1164	WHmzRJD.exe
1500	NkOZIZi.exe
1344	juxwQgq.exe
1072	oeAJbXo.exe
1140	tzKwtgl.exe
2068	FPkjNre.exe
1608	rbxjRTv.exe
1360	jsuYYiD.exe
1032	jYvLPRO.exe
308	MYYtmRS.exe
568	yKyBBbe.exe
1340	DudfmCL.exe
1776	ynBqnmu.exe
2056	moKIpBU.exe
1532	MZrvXtL.exe
2148	VDllqGt.exe
2388	nXxrPCI.exe
1692	OJONaOP.exe
2556	prQVGvw.exe
2736	IEULOJi.exe
2528	qRwtEfg.exe
2792	miKmVfi.exe
2964	xckeSnV.exe
816	qEFyjGj.exe
332	vkzPrpe.exe
2396	MdLiaMM.exe
1704	hYvwCYI.exe
1092	erSbzKs.exe
844	wjIYWQf.exe
1104	bauzlLf.exe
1896	oJsNlLA.exe
2188	yUeTiJX.exe
2100	SmQwGBQ.exe
2852	oykOOuW.exe
600	GjEZFcJ.exe
3020	kfSLzpl.exe
2732	hLYkcBn.exe
2744	CbONLZP.exe

Loads dropped DLL 64 IoCs

Processes:

03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe

pid	process
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2392-1-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
C:\Windows\system\nKkWvUh.exe	upx
behavioral1/memory/2648-8-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
\Windows\system\iBEWrOR.exe	upx
C:\Windows\system\oxKgmiW.exe	upx
C:\Windows\system\kFPEYhl.exe	upx
\Windows\system\FNeJffa.exe	upx
C:\Windows\system\QcIRlOs.exe	upx
C:\Windows\system\pFLrWqX.exe	upx
C:\Windows\system\MItnTLI.exe	upx
C:\Windows\system\ijxxgwt.exe	upx
C:\Windows\system\fuVVnqz.exe	upx
C:\Windows\system\cskNRDn.exe	upx
\Windows\system\erdXAjO.exe	upx
C:\Windows\system\kAsBzCP.exe	upx
behavioral1/memory/2500-122-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2476-127-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
C:\Windows\system\pHzJZpz.exe	upx
C:\Windows\system\iVuXvyb.exe	upx
C:\Windows\system\DSCbGBI.exe	upx
\Windows\system\dnmCPBK.exe	upx
\Windows\system\cTstPZE.exe	upx
\Windows\system\WCCsIPS.exe	upx
\Windows\system\pJRCNOh.exe	upx
\Windows\system\OucHRlN.exe	upx
\Windows\system\HJjOLtU.exe	upx
\Windows\system\CLBDRtF.exe	upx
\Windows\system\AAXPXMX.exe	upx
behavioral1/memory/2124-111-0x000000013F220000-0x000000013F612000-memory.dmp	upx
C:\Windows\system\NkOZIZi.exe	upx
C:\Windows\system\WHmzRJD.exe	upx
C:\Windows\system\FYNDNuQ.exe	upx
C:\Windows\system\bhOytoL.exe	upx
C:\Windows\system\vJFVrXS.exe	upx
behavioral1/memory/2664-131-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2740-125-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2708-124-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2660-123-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2876-120-0x000000013F150000-0x000000013F542000-memory.dmp	upx
C:\Windows\system\hQmuBqB.exe	upx
C:\Windows\system\UWjKgAC.exe	upx
C:\Windows\system\oBCLCup.exe	upx
C:\Windows\system\EkQvzGd.exe	upx
C:\Windows\system\BuMrQTo.exe	upx
C:\Windows\system\ETgHxYY.exe	upx
C:\Windows\system\cBBNGTm.exe	upx

Drops file in Windows directory 64 IoCs

Processes:

03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System\Hanufla.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\bFrQWfN.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\fsVKelX.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ZylIPXa.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\TMNnvyx.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\uENcDUd.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\dVUfDDk.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ldaaxeQ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\PoCDGYh.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\FTJcQlg.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\cPDbUsG.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\uWmUtUh.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\uSyXGhA.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\VjLyZUR.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\QFoWXTX.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\uToIvRT.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\PReBPEY.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\MWUcWmI.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\YpLycSQ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\VlDhldT.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\fFmreNW.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\Eorktcm.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\SDEzLvE.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\bkBIYwu.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\IOWmpzo.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\DsXJBCR.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ibLpKtU.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\zofrEtm.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\YoaFsgC.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\dxpQsHH.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\JMZTzFF.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\IStmqSy.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\NkOZIZi.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\PGxikmI.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\WchsHxF.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\quNljPr.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\uwKQtmK.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\mIMgUfZ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\lndVttp.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\DduFuyT.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\EFnJIzE.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\EPsxIKg.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\cXpMFbp.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\LgQoQYD.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\lGMABDQ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\edqQxov.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\PdGGzpt.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\dnmCPBK.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\KnblgOY.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\szgyChp.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\JmPPgvC.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\GNbkLEK.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\qBnEvEG.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\KEFPYTt.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\MVCSTrC.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ohKMKAv.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\frFFpXS.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\IsMpkUY.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\mApVJja.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\IJDzlav.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\yNQfcQp.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\erdXAjO.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\KQNsNav.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\FCRjMUe.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2864 powershell.exe

pid	process
2864	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
Token: SeDebugPrivilege	2864	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe

description	pid	process	target process
PID 2392 wrote to memory of 2864	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	powershell.exe
PID 2392 wrote to memory of 2864	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	powershell.exe
PID 2392 wrote to memory of 2864	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	powershell.exe
PID 2392 wrote to memory of 2648	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	nKkWvUh.exe
PID 2392 wrote to memory of 2648	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	nKkWvUh.exe
PID 2392 wrote to memory of 2648	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	nKkWvUh.exe
PID 2392 wrote to memory of 2124	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	oxKgmiW.exe
PID 2392 wrote to memory of 2124	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	oxKgmiW.exe
PID 2392 wrote to memory of 2124	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	oxKgmiW.exe
PID 2392 wrote to memory of 2664	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	cBBNGTm.exe
PID 2392 wrote to memory of 2664	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	cBBNGTm.exe
PID 2392 wrote to memory of 2664	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	cBBNGTm.exe
PID 2392 wrote to memory of 2660	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	iBEWrOR.exe
PID 2392 wrote to memory of 2660	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	iBEWrOR.exe
PID 2392 wrote to memory of 2660	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	iBEWrOR.exe
PID 2392 wrote to memory of 2876	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ETgHxYY.exe
PID 2392 wrote to memory of 2876	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ETgHxYY.exe
PID 2392 wrote to memory of 2876	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ETgHxYY.exe
PID 2392 wrote to memory of 2708	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	UWjKgAC.exe
PID 2392 wrote to memory of 2708	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	UWjKgAC.exe
PID 2392 wrote to memory of 2708	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	UWjKgAC.exe
PID 2392 wrote to memory of 2500	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	BuMrQTo.exe
PID 2392 wrote to memory of 2500	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	BuMrQTo.exe
PID 2392 wrote to memory of 2500	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	BuMrQTo.exe
PID 2392 wrote to memory of 2740	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	QcIRlOs.exe
PID 2392 wrote to memory of 2740	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	QcIRlOs.exe
PID 2392 wrote to memory of 2740	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	QcIRlOs.exe
PID 2392 wrote to memory of 2476	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	EkQvzGd.exe
PID 2392 wrote to memory of 2476	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	EkQvzGd.exe
PID 2392 wrote to memory of 2476	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	EkQvzGd.exe
PID 2392 wrote to memory of 2536	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	kFPEYhl.exe
PID 2392 wrote to memory of 2536	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	kFPEYhl.exe
PID 2392 wrote to memory of 2536	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	kFPEYhl.exe
PID 2392 wrote to memory of 2976	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	oBCLCup.exe
PID 2392 wrote to memory of 2976	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	oBCLCup.exe
PID 2392 wrote to memory of 2976	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	oBCLCup.exe
PID 2392 wrote to memory of 2972	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	pFLrWqX.exe
PID 2392 wrote to memory of 2972	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	pFLrWqX.exe
PID 2392 wrote to memory of 2972	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	pFLrWqX.exe
PID 2392 wrote to memory of 1616	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	FNeJffa.exe
PID 2392 wrote to memory of 1616	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	FNeJffa.exe
PID 2392 wrote to memory of 1616	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	FNeJffa.exe
PID 2392 wrote to memory of 2700	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ijxxgwt.exe
PID 2392 wrote to memory of 2700	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ijxxgwt.exe
PID 2392 wrote to memory of 2700	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ijxxgwt.exe
PID 2392 wrote to memory of 2944	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	MItnTLI.exe
PID 2392 wrote to memory of 2944	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	MItnTLI.exe
PID 2392 wrote to memory of 2944	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	MItnTLI.exe
PID 2392 wrote to memory of 1632	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	fuVVnqz.exe
PID 2392 wrote to memory of 1632	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	fuVVnqz.exe
PID 2392 wrote to memory of 1632	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	fuVVnqz.exe
PID 2392 wrote to memory of 2532	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	cskNRDn.exe
PID 2392 wrote to memory of 2532	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	cskNRDn.exe
PID 2392 wrote to memory of 2532	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	cskNRDn.exe
PID 2392 wrote to memory of 2176	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	hQmuBqB.exe
PID 2392 wrote to memory of 2176	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	hQmuBqB.exe
PID 2392 wrote to memory of 2176	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	hQmuBqB.exe
PID 2392 wrote to memory of 2352	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	erdXAjO.exe
PID 2392 wrote to memory of 2352	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	erdXAjO.exe
PID 2392 wrote to memory of 2352	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	erdXAjO.exe
PID 2392 wrote to memory of 1640	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	pHzJZpz.exe
PID 2392 wrote to memory of 1640	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	pHzJZpz.exe
PID 2392 wrote to memory of 1640	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	pHzJZpz.exe
PID 2392 wrote to memory of 2784	2392	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	kAsBzCP.exe

C:\Users\Admin\AppData\Local\Temp\03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\System\nKkWvUh.exe
  C:\Windows\System\nKkWvUh.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\oxKgmiW.exe
  C:\Windows\System\oxKgmiW.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\cBBNGTm.exe
  C:\Windows\System\cBBNGTm.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\iBEWrOR.exe
  C:\Windows\System\iBEWrOR.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ETgHxYY.exe
  C:\Windows\System\ETgHxYY.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\UWjKgAC.exe
  C:\Windows\System\UWjKgAC.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\BuMrQTo.exe
  C:\Windows\System\BuMrQTo.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\QcIRlOs.exe
  C:\Windows\System\QcIRlOs.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\EkQvzGd.exe
  C:\Windows\System\EkQvzGd.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\kFPEYhl.exe
  C:\Windows\System\kFPEYhl.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\oBCLCup.exe
  C:\Windows\System\oBCLCup.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\pFLrWqX.exe
  C:\Windows\System\pFLrWqX.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\FNeJffa.exe
  C:\Windows\System\FNeJffa.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\ijxxgwt.exe
  C:\Windows\System\ijxxgwt.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\MItnTLI.exe
  C:\Windows\System\MItnTLI.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\fuVVnqz.exe
  C:\Windows\System\fuVVnqz.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\cskNRDn.exe
  C:\Windows\System\cskNRDn.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\hQmuBqB.exe
  C:\Windows\System\hQmuBqB.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\erdXAjO.exe
  C:\Windows\System\erdXAjO.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\pHzJZpz.exe
  C:\Windows\System\pHzJZpz.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\kAsBzCP.exe
  C:\Windows\System\kAsBzCP.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\AAXPXMX.exe
  C:\Windows\System\AAXPXMX.exe
  2⤵
  PID:1208
- C:\Windows\System\vJFVrXS.exe
  C:\Windows\System\vJFVrXS.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\CLBDRtF.exe
  C:\Windows\System\CLBDRtF.exe
  2⤵
  PID:2128
- C:\Windows\System\iVuXvyb.exe
  C:\Windows\System\iVuXvyb.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\HJjOLtU.exe
  C:\Windows\System\HJjOLtU.exe
  2⤵
  PID:2884
- C:\Windows\System\bhOytoL.exe
  C:\Windows\System\bhOytoL.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\OucHRlN.exe
  C:\Windows\System\OucHRlN.exe
  2⤵
  PID:2116
- C:\Windows\System\DSCbGBI.exe
  C:\Windows\System\DSCbGBI.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\pJRCNOh.exe
  C:\Windows\System\pJRCNOh.exe
  2⤵
  PID:536
- C:\Windows\System\FYNDNuQ.exe
  C:\Windows\System\FYNDNuQ.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\WCCsIPS.exe
  C:\Windows\System\WCCsIPS.exe
  2⤵
  PID:1172
- C:\Windows\System\WHmzRJD.exe
  C:\Windows\System\WHmzRJD.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\cTstPZE.exe
  C:\Windows\System\cTstPZE.exe
  2⤵
  PID:916
- C:\Windows\System\NkOZIZi.exe
  C:\Windows\System\NkOZIZi.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\dnmCPBK.exe
  C:\Windows\System\dnmCPBK.exe
  2⤵
  PID:820
- C:\Windows\System\juxwQgq.exe
  C:\Windows\System\juxwQgq.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\tazRlHE.exe
  C:\Windows\System\tazRlHE.exe
  2⤵
  PID:648
- C:\Windows\System\oeAJbXo.exe
  C:\Windows\System\oeAJbXo.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\ENtDGKQ.exe
  C:\Windows\System\ENtDGKQ.exe
  2⤵
  PID:408
- C:\Windows\System\tzKwtgl.exe
  C:\Windows\System\tzKwtgl.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\ALHidSZ.exe
  C:\Windows\System\ALHidSZ.exe
  2⤵
  PID:2272
- C:\Windows\System\FPkjNre.exe
  C:\Windows\System\FPkjNre.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\bHKXKfM.exe
  C:\Windows\System\bHKXKfM.exe
  2⤵
  PID:1400
- C:\Windows\System\rbxjRTv.exe
  C:\Windows\System\rbxjRTv.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\hCUKgOs.exe
  C:\Windows\System\hCUKgOs.exe
  2⤵
  PID:1984
- C:\Windows\System\jsuYYiD.exe
  C:\Windows\System\jsuYYiD.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\cKkIlzV.exe
  C:\Windows\System\cKkIlzV.exe
  2⤵
  PID:780
- C:\Windows\System\jYvLPRO.exe
  C:\Windows\System\jYvLPRO.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\lndVttp.exe
  C:\Windows\System\lndVttp.exe
  2⤵
  PID:1836
- C:\Windows\System\MYYtmRS.exe
  C:\Windows\System\MYYtmRS.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\iKhfJCq.exe
  C:\Windows\System\iKhfJCq.exe
  2⤵
  PID:868
- C:\Windows\System\yKyBBbe.exe
  C:\Windows\System\yKyBBbe.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\BODzjNW.exe
  C:\Windows\System\BODzjNW.exe
  2⤵
  PID:924
- C:\Windows\System\DudfmCL.exe
  C:\Windows\System\DudfmCL.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\awXjWhr.exe
  C:\Windows\System\awXjWhr.exe
  2⤵
  PID:1996
- C:\Windows\System\ynBqnmu.exe
  C:\Windows\System\ynBqnmu.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\ldaaxeQ.exe
  C:\Windows\System\ldaaxeQ.exe
  2⤵
  PID:856
- C:\Windows\System\moKIpBU.exe
  C:\Windows\System\moKIpBU.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\DvZVbsV.exe
  C:\Windows\System\DvZVbsV.exe
  2⤵
  PID:1312
- C:\Windows\System\MZrvXtL.exe
  C:\Windows\System\MZrvXtL.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\MRMCGkx.exe
  C:\Windows\System\MRMCGkx.exe
  2⤵
  PID:1756
- C:\Windows\System\VDllqGt.exe
  C:\Windows\System\VDllqGt.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\XAgnEie.exe
  C:\Windows\System\XAgnEie.exe
  2⤵
  PID:1236
- C:\Windows\System\nXxrPCI.exe
  C:\Windows\System\nXxrPCI.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\FwZbnEz.exe
  C:\Windows\System\FwZbnEz.exe
  2⤵
  PID:1596
- C:\Windows\System\OJONaOP.exe
  C:\Windows\System\OJONaOP.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\XNMCKne.exe
  C:\Windows\System\XNMCKne.exe
  2⤵
  PID:1300
- C:\Windows\System\prQVGvw.exe
  C:\Windows\System\prQVGvw.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\IogQXtx.exe
  C:\Windows\System\IogQXtx.exe
  2⤵
  PID:2888
- C:\Windows\System\IEULOJi.exe
  C:\Windows\System\IEULOJi.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\WiXjFkP.exe
  C:\Windows\System\WiXjFkP.exe
  2⤵
  PID:2600
- C:\Windows\System\qRwtEfg.exe
  C:\Windows\System\qRwtEfg.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\Reyplsz.exe
  C:\Windows\System\Reyplsz.exe
  2⤵
  PID:2588
- C:\Windows\System\miKmVfi.exe
  C:\Windows\System\miKmVfi.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\ezBuJfv.exe
  C:\Windows\System\ezBuJfv.exe
  2⤵
  PID:2232
- C:\Windows\System\xckeSnV.exe
  C:\Windows\System\xckeSnV.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\CZDfWIC.exe
  C:\Windows\System\CZDfWIC.exe
  2⤵
  PID:1972
- C:\Windows\System\qEFyjGj.exe
  C:\Windows\System\qEFyjGj.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\TNiMfBx.exe
  C:\Windows\System\TNiMfBx.exe
  2⤵
  PID:2696
- C:\Windows\System\vkzPrpe.exe
  C:\Windows\System\vkzPrpe.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\sHpLOlI.exe
  C:\Windows\System\sHpLOlI.exe
  2⤵
  PID:2452
- C:\Windows\System\MdLiaMM.exe
  C:\Windows\System\MdLiaMM.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\DpyQvEB.exe
  C:\Windows\System\DpyQvEB.exe
  2⤵
  PID:3036
- C:\Windows\System\hYvwCYI.exe
  C:\Windows\System\hYvwCYI.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\yxpNqix.exe
  C:\Windows\System\yxpNqix.exe
  2⤵
  PID:3048
- C:\Windows\System\erSbzKs.exe
  C:\Windows\System\erSbzKs.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\uNkDJwS.exe
  C:\Windows\System\uNkDJwS.exe
  2⤵
  PID:624
- C:\Windows\System\wjIYWQf.exe
  C:\Windows\System\wjIYWQf.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\rcuxpup.exe
  C:\Windows\System\rcuxpup.exe
  2⤵
  PID:2336
- C:\Windows\System\bauzlLf.exe
  C:\Windows\System\bauzlLf.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\fUwgaYx.exe
  C:\Windows\System\fUwgaYx.exe
  2⤵
  PID:908
- C:\Windows\System\oJsNlLA.exe
  C:\Windows\System\oJsNlLA.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\xjtaSnO.exe
  C:\Windows\System\xjtaSnO.exe
  2⤵
  PID:2300
- C:\Windows\System\yUeTiJX.exe
  C:\Windows\System\yUeTiJX.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\zBVQfqR.exe
  C:\Windows\System\zBVQfqR.exe
  2⤵
  PID:1796
- C:\Windows\System\SmQwGBQ.exe
  C:\Windows\System\SmQwGBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\asgmGrP.exe
  C:\Windows\System\asgmGrP.exe
  2⤵
  PID:2380
- C:\Windows\System\oykOOuW.exe
  C:\Windows\System\oykOOuW.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\yEqqeRc.exe
  C:\Windows\System\yEqqeRc.exe
  2⤵
  PID:2692
- C:\Windows\System\GjEZFcJ.exe
  C:\Windows\System\GjEZFcJ.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\UVdfJHM.exe
  C:\Windows\System\UVdfJHM.exe
  2⤵
  PID:2412
- C:\Windows\System\kfSLzpl.exe
  C:\Windows\System\kfSLzpl.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\bkOuEIC.exe
  C:\Windows\System\bkOuEIC.exe
  2⤵
  PID:2684
- C:\Windows\System\hLYkcBn.exe
  C:\Windows\System\hLYkcBn.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\MJJWBCG.exe
  C:\Windows\System\MJJWBCG.exe
  2⤵
  PID:3044
- C:\Windows\System\CbONLZP.exe
  C:\Windows\System\CbONLZP.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\aMzAkVj.exe
  C:\Windows\System\aMzAkVj.exe
  2⤵
  PID:3528
- C:\Windows\System\zhhZefU.exe
  C:\Windows\System\zhhZefU.exe
  2⤵
  PID:3868
- C:\Windows\System\CHwKFec.exe
  C:\Windows\System\CHwKFec.exe
  2⤵
  PID:3908
- C:\Windows\System\lqeOJvn.exe
  C:\Windows\System\lqeOJvn.exe
  2⤵
  PID:3924
- C:\Windows\System\jerudcb.exe
  C:\Windows\System\jerudcb.exe
  2⤵
  PID:3948
- C:\Windows\System\yeFxVZX.exe
  C:\Windows\System\yeFxVZX.exe
  2⤵
  PID:3964
- C:\Windows\System\wMZnvfy.exe
  C:\Windows\System\wMZnvfy.exe
  2⤵
  PID:3984
- C:\Windows\System\yojKyFt.exe
  C:\Windows\System\yojKyFt.exe
  2⤵
  PID:4000
- C:\Windows\System\vJZGXvV.exe
  C:\Windows\System\vJZGXvV.exe
  2⤵
  PID:4020
- C:\Windows\System\KlDnkfT.exe
  C:\Windows\System\KlDnkfT.exe
  2⤵
  PID:4044
- C:\Windows\System\zFBxYBp.exe
  C:\Windows\System\zFBxYBp.exe
  2⤵
  PID:4064
- C:\Windows\System\YwZThWp.exe
  C:\Windows\System\YwZThWp.exe
  2⤵
  PID:4084
- C:\Windows\System\nMHoDsf.exe
  C:\Windows\System\nMHoDsf.exe
  2⤵
  PID:1604
- C:\Windows\System\pZxkJMZ.exe
  C:\Windows\System\pZxkJMZ.exe
  2⤵
  PID:2892
- C:\Windows\System\AsUEmkh.exe
  C:\Windows\System\AsUEmkh.exe
  2⤵
  PID:920
- C:\Windows\System\tZeoptV.exe
  C:\Windows\System\tZeoptV.exe
  2⤵
  PID:1728
- C:\Windows\System\utsYqPo.exe
  C:\Windows\System\utsYqPo.exe
  2⤵
  PID:2076
- C:\Windows\System\GXlFoGV.exe
  C:\Windows\System\GXlFoGV.exe
  2⤵
  PID:3100
- C:\Windows\System\uWmUtUh.exe
  C:\Windows\System\uWmUtUh.exe
  2⤵
  PID:3136
- C:\Windows\System\VEKAHYo.exe
  C:\Windows\System\VEKAHYo.exe
  2⤵
  PID:3148
- C:\Windows\System\KnblgOY.exe
  C:\Windows\System\KnblgOY.exe
  2⤵
  PID:3184
- C:\Windows\System\DzLwBAu.exe
  C:\Windows\System\DzLwBAu.exe
  2⤵
  PID:3204
- C:\Windows\System\TvOMjNY.exe
  C:\Windows\System\TvOMjNY.exe
  2⤵
  PID:3236
- C:\Windows\System\BGJzNfF.exe
  C:\Windows\System\BGJzNfF.exe
  2⤵
  PID:3252
- C:\Windows\System\erliexB.exe
  C:\Windows\System\erliexB.exe
  2⤵
  PID:3268
- C:\Windows\System\vMGpCon.exe
  C:\Windows\System\vMGpCon.exe
  2⤵
  PID:3292
- C:\Windows\System\jlNpjoO.exe
  C:\Windows\System\jlNpjoO.exe
  2⤵
  PID:3316
- C:\Windows\System\CgjegMh.exe
  C:\Windows\System\CgjegMh.exe
  2⤵
  PID:3332
- C:\Windows\System\OQZcnKD.exe
  C:\Windows\System\OQZcnKD.exe
  2⤵
  PID:3356
- C:\Windows\System\KNRoRcl.exe
  C:\Windows\System\KNRoRcl.exe
  2⤵
  PID:3376
- C:\Windows\System\TcrYxqM.exe
  C:\Windows\System\TcrYxqM.exe
  2⤵
  PID:3392
- C:\Windows\System\JbUnMPA.exe
  C:\Windows\System\JbUnMPA.exe
  2⤵
  PID:2408
- C:\Windows\System\zHTRBpN.exe
  C:\Windows\System\zHTRBpN.exe
  2⤵
  PID:1568
- C:\Windows\System\yMcsxjY.exe
  C:\Windows\System\yMcsxjY.exe
  2⤵
  PID:2280
- C:\Windows\System\FhqtBcp.exe
  C:\Windows\System\FhqtBcp.exe
  2⤵
  PID:1108
- C:\Windows\System\vHRxwCk.exe
  C:\Windows\System\vHRxwCk.exe
  2⤵
  PID:2244
- C:\Windows\System\tOIJTfH.exe
  C:\Windows\System\tOIJTfH.exe
  2⤵
  PID:2904
- C:\Windows\System\ZzuxlPL.exe
  C:\Windows\System\ZzuxlPL.exe
  2⤵
  PID:988
- C:\Windows\System\LrqxKrr.exe
  C:\Windows\System\LrqxKrr.exe
  2⤵
  PID:1648
- C:\Windows\System\WogoDMx.exe
  C:\Windows\System\WogoDMx.exe
  2⤵
  PID:2136
- C:\Windows\System\nlOamgy.exe
  C:\Windows\System\nlOamgy.exe
  2⤵
  PID:2724
- C:\Windows\System\TczsKuI.exe
  C:\Windows\System\TczsKuI.exe
  2⤵
  PID:2896
- C:\Windows\System\sykjzJR.exe
  C:\Windows\System\sykjzJR.exe
  2⤵
  PID:2472
- C:\Windows\System\sYEgsKh.exe
  C:\Windows\System\sYEgsKh.exe
  2⤵
  PID:328
- C:\Windows\System\bnhFHeI.exe
  C:\Windows\System\bnhFHeI.exe
  2⤵
  PID:3740
- C:\Windows\System\gIisGiA.exe
  C:\Windows\System\gIisGiA.exe
  2⤵
  PID:3804
- C:\Windows\System\szgyChp.exe
  C:\Windows\System\szgyChp.exe
  2⤵
  PID:3824
- C:\Windows\System\YAlbQAo.exe
  C:\Windows\System\YAlbQAo.exe
  2⤵
  PID:3840
- C:\Windows\System\nZoVwLH.exe
  C:\Windows\System\nZoVwLH.exe
  2⤵
  PID:1636
- C:\Windows\System\aOLsMyl.exe
  C:\Windows\System\aOLsMyl.exe
  2⤵
  PID:560
- C:\Windows\System\XYyNbQS.exe
  C:\Windows\System\XYyNbQS.exe
  2⤵
  PID:1600
- C:\Windows\System\OHzqZdg.exe
  C:\Windows\System\OHzqZdg.exe
  2⤵
  PID:2828
- C:\Windows\System\NoGeCwQ.exe
  C:\Windows\System\NoGeCwQ.exe
  2⤵
  PID:2776
- C:\Windows\System\eGulQuP.exe
  C:\Windows\System\eGulQuP.exe
  2⤵
  PID:3864
- C:\Windows\System\gWvzcXm.exe
  C:\Windows\System\gWvzcXm.exe
  2⤵
  PID:1944
- C:\Windows\System\rhcZKnF.exe
  C:\Windows\System\rhcZKnF.exe
  2⤵
  PID:2604
- C:\Windows\System\JQHajFs.exe
  C:\Windows\System\JQHajFs.exe
  2⤵
  PID:2256
- C:\Windows\System\nsZQNzJ.exe
  C:\Windows\System\nsZQNzJ.exe
  2⤵
  PID:2344
- C:\Windows\System\vzyQVwK.exe
  C:\Windows\System\vzyQVwK.exe
  2⤵
  PID:2644
- C:\Windows\System\oXoQcFs.exe
  C:\Windows\System\oXoQcFs.exe
  2⤵
  PID:2572
- C:\Windows\System\YYZvYFv.exe
  C:\Windows\System\YYZvYFv.exe
  2⤵
  PID:2060
- C:\Windows\System\XvygYGv.exe
  C:\Windows\System\XvygYGv.exe
  2⤵
  PID:3896
- C:\Windows\System\NEpLZCE.exe
  C:\Windows\System\NEpLZCE.exe
  2⤵
  PID:3892
- C:\Windows\System\DsXJBCR.exe
  C:\Windows\System\DsXJBCR.exe
  2⤵
  PID:1832
- C:\Windows\System\MAPViXs.exe
  C:\Windows\System\MAPViXs.exe
  2⤵
  PID:3940
- C:\Windows\System\xjmsCSN.exe
  C:\Windows\System\xjmsCSN.exe
  2⤵
  PID:3972
- C:\Windows\System\Xvttuyq.exe
  C:\Windows\System\Xvttuyq.exe
  2⤵
  PID:3976
- C:\Windows\System\CiWRatx.exe
  C:\Windows\System\CiWRatx.exe
  2⤵
  PID:3996
- C:\Windows\System\kSVmxTV.exe
  C:\Windows\System\kSVmxTV.exe
  2⤵
  PID:2504
- C:\Windows\System\QiMvgqF.exe
  C:\Windows\System\QiMvgqF.exe
  2⤵
  PID:4052
- C:\Windows\System\guTaFwr.exe
  C:\Windows\System\guTaFwr.exe
  2⤵
  PID:4060
- C:\Windows\System\JJdYggY.exe
  C:\Windows\System\JJdYggY.exe
  2⤵
  PID:4080
- C:\Windows\System\XSgRLlH.exe
  C:\Windows\System\XSgRLlH.exe
  2⤵
  PID:2800
- C:\Windows\System\aKrCvdQ.exe
  C:\Windows\System\aKrCvdQ.exe
  2⤵
  PID:3192
- C:\Windows\System\dLYrluK.exe
  C:\Windows\System\dLYrluK.exe
  2⤵
  PID:3216
- C:\Windows\System\jsUmIGk.exe
  C:\Windows\System\jsUmIGk.exe
  2⤵
  PID:3272
- C:\Windows\System\sIWqnFm.exe
  C:\Windows\System\sIWqnFm.exe
  2⤵
  PID:3284
- C:\Windows\System\MVCSTrC.exe
  C:\Windows\System\MVCSTrC.exe
  2⤵
  PID:3304
- C:\Windows\System\PMlYDVe.exe
  C:\Windows\System\PMlYDVe.exe
  2⤵
  PID:3324
- C:\Windows\System\dUbOnYx.exe
  C:\Windows\System\dUbOnYx.exe
  2⤵
  PID:3348
- C:\Windows\System\opeezru.exe
  C:\Windows\System\opeezru.exe
  2⤵
  PID:3344
- C:\Windows\System\YCyyQxc.exe
  C:\Windows\System\YCyyQxc.exe
  2⤵
  PID:3372
- C:\Windows\System\uvVxRqg.exe
  C:\Windows\System\uvVxRqg.exe
  2⤵
  PID:3384
- C:\Windows\System\NQrAuaK.exe
  C:\Windows\System\NQrAuaK.exe
  2⤵
  PID:1964
- C:\Windows\System\DLDuuNz.exe
  C:\Windows\System\DLDuuNz.exe
  2⤵
  PID:2348
- C:\Windows\System\mVJRzvi.exe
  C:\Windows\System\mVJRzvi.exe
  2⤵
  PID:940
- C:\Windows\System\iziLfkN.exe
  C:\Windows\System\iziLfkN.exe
  2⤵
  PID:1956
- C:\Windows\System\CHCHPqO.exe
  C:\Windows\System\CHCHPqO.exe
  2⤵
  PID:2960
- C:\Windows\System\VMNFHzO.exe
  C:\Windows\System\VMNFHzO.exe
  2⤵
  PID:3832
- C:\Windows\System\eWiPyQH.exe
  C:\Windows\System\eWiPyQH.exe
  2⤵
  PID:2932
- C:\Windows\System\pYnmPrg.exe
  C:\Windows\System\pYnmPrg.exe
  2⤵
  PID:784
- C:\Windows\System\jTHdUTP.exe
  C:\Windows\System\jTHdUTP.exe
  2⤵
  PID:3884
- C:\Windows\System\HmJmRqr.exe
  C:\Windows\System\HmJmRqr.exe
  2⤵
  PID:3936
- C:\Windows\System\OkJtkJY.exe
  C:\Windows\System\OkJtkJY.exe
  2⤵
  PID:4032
- C:\Windows\System\jXSgQaa.exe
  C:\Windows\System\jXSgQaa.exe
  2⤵
  PID:1760
- C:\Windows\System\BwgFJNJ.exe
  C:\Windows\System\BwgFJNJ.exe
  2⤵
  PID:3052
- C:\Windows\System\eqyHqXN.exe
  C:\Windows\System\eqyHqXN.exe
  2⤵
  PID:1324
- C:\Windows\System\ohKMKAv.exe
  C:\Windows\System\ohKMKAv.exe
  2⤵
  PID:2464
- C:\Windows\System\nYhmBJf.exe
  C:\Windows\System\nYhmBJf.exe
  2⤵
  PID:3816
- C:\Windows\System\cRFfaur.exe
  C:\Windows\System\cRFfaur.exe
  2⤵
  PID:2552
- C:\Windows\System\gvZgucx.exe
  C:\Windows\System\gvZgucx.exe
  2⤵
  PID:2000
- C:\Windows\System\ndJaViD.exe
  C:\Windows\System\ndJaViD.exe
  2⤵
  PID:2636
- C:\Windows\System\frFFpXS.exe
  C:\Windows\System\frFFpXS.exe
  2⤵
  PID:2748
- C:\Windows\System\OrKubaW.exe
  C:\Windows\System\OrKubaW.exe
  2⤵
  PID:4040
- C:\Windows\System\TTJVzME.exe
  C:\Windows\System\TTJVzME.exe
  2⤵
  PID:4092
- C:\Windows\System\fsyyMxx.exe
  C:\Windows\System\fsyyMxx.exe
  2⤵
  PID:348
- C:\Windows\System\pxaZiAb.exe
  C:\Windows\System\pxaZiAb.exe
  2⤵
  PID:2620
- C:\Windows\System\ZDWZOHH.exe
  C:\Windows\System\ZDWZOHH.exe
  2⤵
  PID:2040
- C:\Windows\System\SNcMBDq.exe
  C:\Windows\System\SNcMBDq.exe
  2⤵
  PID:2216
- C:\Windows\System\MrEYglE.exe
  C:\Windows\System\MrEYglE.exe
  2⤵
  PID:1132
- C:\Windows\System\djANtsW.exe
  C:\Windows\System\djANtsW.exe
  2⤵
  PID:3128
- C:\Windows\System\bXlLWAZ.exe
  C:\Windows\System\bXlLWAZ.exe
  2⤵
  PID:3164
- C:\Windows\System\zBdtPDo.exe
  C:\Windows\System\zBdtPDo.exe
  2⤵
  PID:3196
- C:\Windows\System\FLJpdtG.exe
  C:\Windows\System\FLJpdtG.exe
  2⤵
  PID:1948
- C:\Windows\System\dzjYGCE.exe
  C:\Windows\System\dzjYGCE.exe
  2⤵
  PID:3308
- C:\Windows\System\BcwloKn.exe
  C:\Windows\System\BcwloKn.exe
  2⤵
  PID:3412
- C:\Windows\System\QkFtcEn.exe
  C:\Windows\System\QkFtcEn.exe
  2⤵
  PID:4104
- C:\Windows\System\oKEVjrE.exe
  C:\Windows\System\oKEVjrE.exe
  2⤵
  PID:4120
- C:\Windows\System\wAEPhxC.exe
  C:\Windows\System\wAEPhxC.exe
  2⤵
  PID:4136
- C:\Windows\System\IgqBWyw.exe
  C:\Windows\System\IgqBWyw.exe
  2⤵
  PID:4152
- C:\Windows\System\fqoVkZu.exe
  C:\Windows\System\fqoVkZu.exe
  2⤵
  PID:4344
- C:\Windows\System\QeFdUBB.exe
  C:\Windows\System\QeFdUBB.exe
  2⤵
  PID:4360
- C:\Windows\System\gwsdmVW.exe
  C:\Windows\System\gwsdmVW.exe
  2⤵
  PID:4376
- C:\Windows\System\PReBPEY.exe
  C:\Windows\System\PReBPEY.exe
  2⤵
  PID:4392
- C:\Windows\System\lRSKDsx.exe
  C:\Windows\System\lRSKDsx.exe
  2⤵
  PID:4408
- C:\Windows\System\hVMkadF.exe
  C:\Windows\System\hVMkadF.exe
  2⤵
  PID:4424
- C:\Windows\System\nXbuLHy.exe
  C:\Windows\System\nXbuLHy.exe
  2⤵
  PID:4440
- C:\Windows\System\aSfCyyC.exe
  C:\Windows\System\aSfCyyC.exe
  2⤵
  PID:4460
- C:\Windows\System\hGjpduz.exe
  C:\Windows\System\hGjpduz.exe
  2⤵
  PID:4476
- C:\Windows\System\TGFURfW.exe
  C:\Windows\System\TGFURfW.exe
  2⤵
  PID:4492
- C:\Windows\System\ndCYVzn.exe
  C:\Windows\System\ndCYVzn.exe
  2⤵
  PID:4508
- C:\Windows\System\uAubRAy.exe
  C:\Windows\System\uAubRAy.exe
  2⤵
  PID:4524
- C:\Windows\System\NXxUDZT.exe
  C:\Windows\System\NXxUDZT.exe
  2⤵
  PID:4544
- C:\Windows\System\xxLkZrh.exe
  C:\Windows\System\xxLkZrh.exe
  2⤵
  PID:4560
- C:\Windows\System\VJHbyTM.exe
  C:\Windows\System\VJHbyTM.exe
  2⤵
  PID:4576
- C:\Windows\System\dnRTeaM.exe
  C:\Windows\System\dnRTeaM.exe
  2⤵
  PID:4592
- C:\Windows\System\yeAfQwa.exe
  C:\Windows\System\yeAfQwa.exe
  2⤵
  PID:4608
- C:\Windows\System\EbpDRqd.exe
  C:\Windows\System\EbpDRqd.exe
  2⤵
  PID:4624
- C:\Windows\System\VXadYrN.exe
  C:\Windows\System\VXadYrN.exe
  2⤵
  PID:4644
- C:\Windows\System\ibAclnB.exe
  C:\Windows\System\ibAclnB.exe
  2⤵
  PID:4660
- C:\Windows\System\fFmreNW.exe
  C:\Windows\System\fFmreNW.exe
  2⤵
  PID:4676
- C:\Windows\System\BkyQDyI.exe
  C:\Windows\System\BkyQDyI.exe
  2⤵
  PID:4692
- C:\Windows\System\jwkBWNz.exe
  C:\Windows\System\jwkBWNz.exe
  2⤵
  PID:4708
- C:\Windows\System\aLziNZe.exe
  C:\Windows\System\aLziNZe.exe
  2⤵
  PID:4724
- C:\Windows\System\xsVkhDx.exe
  C:\Windows\System\xsVkhDx.exe
  2⤵
  PID:4740
- C:\Windows\System\klJYfjz.exe
  C:\Windows\System\klJYfjz.exe
  2⤵
  PID:4760
- C:\Windows\System\iGISSIB.exe
  C:\Windows\System\iGISSIB.exe
  2⤵
  PID:4776
- C:\Windows\System\rmBHWNu.exe
  C:\Windows\System\rmBHWNu.exe
  2⤵
  PID:4792
- C:\Windows\System\dLJgLmK.exe
  C:\Windows\System\dLJgLmK.exe
  2⤵
  PID:4808
- C:\Windows\System\syXlPqo.exe
  C:\Windows\System\syXlPqo.exe
  2⤵
  PID:4824
- C:\Windows\System\OwIPdGD.exe
  C:\Windows\System\OwIPdGD.exe
  2⤵
  PID:4844
- C:\Windows\System\nJRQQhs.exe
  C:\Windows\System\nJRQQhs.exe
  2⤵
  PID:4860
- C:\Windows\System\bLmgaqZ.exe
  C:\Windows\System\bLmgaqZ.exe
  2⤵
  PID:4880
- C:\Windows\System\mgVqUPn.exe
  C:\Windows\System\mgVqUPn.exe
  2⤵
  PID:4968
- C:\Windows\System\OSpThKh.exe
  C:\Windows\System\OSpThKh.exe
  2⤵
  PID:5060
- C:\Windows\System\Twnflkj.exe
  C:\Windows\System\Twnflkj.exe
  2⤵
  PID:5076
- C:\Windows\System\xFjleQW.exe
  C:\Windows\System\xFjleQW.exe
  2⤵
  PID:5092
- C:\Windows\System\RadDoMq.exe
  C:\Windows\System\RadDoMq.exe
  2⤵
  PID:5108
- C:\Windows\System\QDzOChU.exe
  C:\Windows\System\QDzOChU.exe
  2⤵
  PID:1176
- C:\Windows\System\PWSlxSL.exe
  C:\Windows\System\PWSlxSL.exe
  2⤵
  PID:3888
- C:\Windows\System\RcktMzv.exe
  C:\Windows\System\RcktMzv.exe
  2⤵
  PID:2836
- C:\Windows\System\nfPdbVy.exe
  C:\Windows\System\nfPdbVy.exe
  2⤵
  PID:3300
- C:\Windows\System\xWgnmCG.exe
  C:\Windows\System\xWgnmCG.exe
  2⤵
  PID:1652
- C:\Windows\System\zdxklzN.exe
  C:\Windows\System\zdxklzN.exe
  2⤵
  PID:2112
- C:\Windows\System\YcANwTv.exe
  C:\Windows\System\YcANwTv.exe
  2⤵
  PID:3932
- C:\Windows\System\MWUcWmI.exe
  C:\Windows\System\MWUcWmI.exe
  2⤵
  PID:1644
- C:\Windows\System\VYufHRR.exe
  C:\Windows\System\VYufHRR.exe
  2⤵
  PID:1416
- C:\Windows\System\LbDrWLs.exe
  C:\Windows\System\LbDrWLs.exe
  2⤵
  PID:3248
- C:\Windows\System\SlNzgNR.exe
  C:\Windows\System\SlNzgNR.exe
  2⤵
  PID:4132
- C:\Windows\System\vVzONou.exe
  C:\Windows\System\vVzONou.exe
  2⤵
  PID:4184
- C:\Windows\System\tClPpjQ.exe
  C:\Windows\System\tClPpjQ.exe
  2⤵
  PID:4200
- C:\Windows\System\VWQddwL.exe
  C:\Windows\System\VWQddwL.exe
  2⤵
  PID:4216
- C:\Windows\System\FdGBqyn.exe
  C:\Windows\System\FdGBqyn.exe
  2⤵
  PID:2872
- C:\Windows\System\bJrLiBm.exe
  C:\Windows\System\bJrLiBm.exe
  2⤵
  PID:1524
- C:\Windows\System\Qcpxgkc.exe
  C:\Windows\System\Qcpxgkc.exe
  2⤵
  PID:4256
- C:\Windows\System\viUmDed.exe
  C:\Windows\System\viUmDed.exe
  2⤵
  PID:3916
- C:\Windows\System\ZXKgATK.exe
  C:\Windows\System\ZXKgATK.exe
  2⤵
  PID:2576
- C:\Windows\System\KQNsNav.exe
  C:\Windows\System\KQNsNav.exe
  2⤵
  PID:4172
- C:\Windows\System\qSwblpE.exe
  C:\Windows\System\qSwblpE.exe
  2⤵
  PID:3288
- C:\Windows\System\jMdMMPI.exe
  C:\Windows\System\jMdMMPI.exe
  2⤵
  PID:3368
- C:\Windows\System\AxzOwzy.exe
  C:\Windows\System\AxzOwzy.exe
  2⤵
  PID:4072
- C:\Windows\System\FMqRXFj.exe
  C:\Windows\System\FMqRXFj.exe
  2⤵
  PID:3008
- C:\Windows\System\JTaktjx.exe
  C:\Windows\System\JTaktjx.exe
  2⤵
  PID:4100
- C:\Windows\System\zEWDRXI.exe
  C:\Windows\System\zEWDRXI.exe
  2⤵
  PID:4420
- C:\Windows\System\hnlUPmm.exe
  C:\Windows\System\hnlUPmm.exe
  2⤵
  PID:4280
- C:\Windows\System\DAuXexR.exe
  C:\Windows\System\DAuXexR.exe
  2⤵
  PID:4316
- C:\Windows\System\VjhdpvE.exe
  C:\Windows\System\VjhdpvE.exe
  2⤵
  PID:4556
- C:\Windows\System\tmAtmBQ.exe
  C:\Windows\System\tmAtmBQ.exe
  2⤵
  PID:4652
- C:\Windows\System\gHxOOyb.exe
  C:\Windows\System\gHxOOyb.exe
  2⤵
  PID:4716
- C:\Windows\System\JmPPgvC.exe
  C:\Windows\System\JmPPgvC.exe
  2⤵
  PID:4784
- C:\Windows\System\iyDDlwd.exe
  C:\Windows\System\iyDDlwd.exe
  2⤵
  PID:4488
- C:\Windows\System\CoEpKMg.exe
  C:\Windows\System\CoEpKMg.exe
  2⤵
  PID:768
- C:\Windows\System\ZXIwuJU.exe
  C:\Windows\System\ZXIwuJU.exe
  2⤵
  PID:4432
- C:\Windows\System\LCnKkLH.exe
  C:\Windows\System\LCnKkLH.exe
  2⤵
  PID:4500
- C:\Windows\System\SmTORNp.exe
  C:\Windows\System\SmTORNp.exe
  2⤵
  PID:4600
- C:\Windows\System\ZOiQgrY.exe
  C:\Windows\System\ZOiQgrY.exe
  2⤵
  PID:4604
- C:\Windows\System\AtHjNNl.exe
  C:\Windows\System\AtHjNNl.exe
  2⤵
  PID:4700
- C:\Windows\System\ibLpKtU.exe
  C:\Windows\System\ibLpKtU.exe
  2⤵
  PID:4768
- C:\Windows\System\zEBpeRC.exe
  C:\Windows\System\zEBpeRC.exe
  2⤵
  PID:4832
- C:\Windows\System\DduFuyT.exe
  C:\Windows\System\DduFuyT.exe
  2⤵
  PID:4872
- C:\Windows\System\lkYdmrQ.exe
  C:\Windows\System\lkYdmrQ.exe
  2⤵
  PID:4916
- C:\Windows\System\roNONyF.exe
  C:\Windows\System\roNONyF.exe
  2⤵
  PID:4936
- C:\Windows\System\dqxWsFX.exe
  C:\Windows\System\dqxWsFX.exe
  2⤵
  PID:4912
- C:\Windows\System\nwEvyFV.exe
  C:\Windows\System\nwEvyFV.exe
  2⤵
  PID:5012
- C:\Windows\System\rblUIbq.exe
  C:\Windows\System\rblUIbq.exe
  2⤵
  PID:5052
- C:\Windows\System\hpKJEex.exe
  C:\Windows\System\hpKJEex.exe
  2⤵
  PID:5116
- C:\Windows\System\JZREgPQ.exe
  C:\Windows\System\JZREgPQ.exe
  2⤵
  PID:3260
- C:\Windows\System\hmxzuJj.exe
  C:\Windows\System\hmxzuJj.exe
  2⤵
  PID:3956
- C:\Windows\System\YafeEXP.exe
  C:\Windows\System\YafeEXP.exe
  2⤵
  PID:4012
- C:\Windows\System\pROPRbf.exe
  C:\Windows\System\pROPRbf.exe
  2⤵
  PID:704
- C:\Windows\System\IjnSgno.exe
  C:\Windows\System\IjnSgno.exe
  2⤵
  PID:3404
- C:\Windows\System\BnCVfAs.exe
  C:\Windows\System\BnCVfAs.exe
  2⤵
  PID:4148
- C:\Windows\System\rsyXQOq.exe
  C:\Windows\System\rsyXQOq.exe
  2⤵
  PID:1788
- C:\Windows\System\BtBBseo.exe
  C:\Windows\System\BtBBseo.exe
  2⤵
  PID:1688
- C:\Windows\System\EpQFvXk.exe
  C:\Windows\System\EpQFvXk.exe
  2⤵
  PID:3188
- C:\Windows\System\CbiKlmd.exe
  C:\Windows\System\CbiKlmd.exe
  2⤵
  PID:3320
- C:\Windows\System\ECPrFSO.exe
  C:\Windows\System\ECPrFSO.exe
  2⤵
  PID:4232
- C:\Windows\System\vOZXydv.exe
  C:\Windows\System\vOZXydv.exe
  2⤵
  PID:3388
- C:\Windows\System\KPWvpeU.exe
  C:\Windows\System\KPWvpeU.exe
  2⤵
  PID:4168
- C:\Windows\System\LBnSbAx.exe
  C:\Windows\System\LBnSbAx.exe
  2⤵
  PID:852
- C:\Windows\System\BdfyiBe.exe
  C:\Windows\System\BdfyiBe.exe
  2⤵
  PID:4284
- C:\Windows\System\MquMRbB.exe
  C:\Windows\System\MquMRbB.exe
  2⤵
  PID:4180
- C:\Windows\System\BTqhnvz.exe
  C:\Windows\System\BTqhnvz.exe
  2⤵
  PID:4300
- C:\Windows\System\JBDftlV.exe
  C:\Windows\System\JBDftlV.exe
  2⤵
  PID:4516
- C:\Windows\System\qgXWTKj.exe
  C:\Windows\System\qgXWTKj.exe
  2⤵
  PID:4640
- C:\Windows\System\LBVkXgV.exe
  C:\Windows\System\LBVkXgV.exe
  2⤵
  PID:4532
- C:\Windows\System\BijnNMQ.exe
  C:\Windows\System\BijnNMQ.exe
  2⤵
  PID:4568
- C:\Windows\System\CcCemxR.exe
  C:\Windows\System\CcCemxR.exe
  2⤵
  PID:4888
- C:\Windows\System\ZOFLKRx.exe
  C:\Windows\System\ZOFLKRx.exe
  2⤵
  PID:4672
- C:\Windows\System\DRbosqw.exe
  C:\Windows\System\DRbosqw.exe
  2⤵
  PID:4900
- C:\Windows\System\EtdOtTJ.exe
  C:\Windows\System\EtdOtTJ.exe
  2⤵
  PID:4908
- C:\Windows\System\hweVcnG.exe
  C:\Windows\System\hweVcnG.exe
  2⤵
  PID:4952
- C:\Windows\System\rwZgbXj.exe
  C:\Windows\System\rwZgbXj.exe
  2⤵
  PID:1544
- C:\Windows\System\BfWjGhf.exe
  C:\Windows\System\BfWjGhf.exe
  2⤵
  PID:5008
- C:\Windows\System\kmsktIa.exe
  C:\Windows\System\kmsktIa.exe
  2⤵
  PID:1724
- C:\Windows\System\IiKRpqy.exe
  C:\Windows\System\IiKRpqy.exe
  2⤵
  PID:5088
- C:\Windows\System\upesGIt.exe
  C:\Windows\System\upesGIt.exe
  2⤵
  PID:5068
- C:\Windows\System\xiVeJVi.exe
  C:\Windows\System\xiVeJVi.exe
  2⤵
  PID:4116
- C:\Windows\System\EVFbqYl.exe
  C:\Windows\System\EVFbqYl.exe
  2⤵
  PID:576
- C:\Windows\System\UCpeEIe.exe
  C:\Windows\System\UCpeEIe.exe
  2⤵
  PID:3408
- C:\Windows\System\bMiIdQD.exe
  C:\Windows\System\bMiIdQD.exe
  2⤵
  PID:772
- C:\Windows\System\PyHMNKR.exe
  C:\Windows\System\PyHMNKR.exe
  2⤵
  PID:1744
- C:\Windows\System\TStVeQK.exe
  C:\Windows\System\TStVeQK.exe
  2⤵
  PID:4228
- C:\Windows\System\JuzauBr.exe
  C:\Windows\System\JuzauBr.exe
  2⤵
  PID:4248
- C:\Windows\System\GKrYYQN.exe
  C:\Windows\System\GKrYYQN.exe
  2⤵
  PID:4144
- C:\Windows\System\OtVREbs.exe
  C:\Windows\System\OtVREbs.exe
  2⤵
  PID:3068
- C:\Windows\System\rOTDUns.exe
  C:\Windows\System\rOTDUns.exe
  2⤵
  PID:4356
- C:\Windows\System\uZRaPAo.exe
  C:\Windows\System\uZRaPAo.exe
  2⤵
  PID:4272
- C:\Windows\System\aXCyXok.exe
  C:\Windows\System\aXCyXok.exe
  2⤵
  PID:4484
- C:\Windows\System\XTKDroJ.exe
  C:\Windows\System\XTKDroJ.exe
  2⤵
  PID:4552
- C:\Windows\System\dpvVZJM.exe
  C:\Windows\System\dpvVZJM.exe
  2⤵
  PID:4128
- C:\Windows\System\OVOVvKN.exe
  C:\Windows\System\OVOVvKN.exe
  2⤵
  PID:4520
- C:\Windows\System\slGsjTJ.exe
  C:\Windows\System\slGsjTJ.exe
  2⤵
  PID:4964
- C:\Windows\System\xJRaEXA.exe
  C:\Windows\System\xJRaEXA.exe
  2⤵
  PID:5084
- C:\Windows\System\yfdNKLn.exe
  C:\Windows\System\yfdNKLn.exe
  2⤵
  PID:3900
- C:\Windows\System\noDBOVi.exe
  C:\Windows\System\noDBOVi.exe
  2⤵
  PID:4176
- C:\Windows\System\UHFfwVP.exe
  C:\Windows\System\UHFfwVP.exe
  2⤵
  PID:3232
- C:\Windows\System\PauClxQ.exe
  C:\Windows\System\PauClxQ.exe
  2⤵
  PID:4304
- C:\Windows\System\gRQEyzq.exe
  C:\Windows\System\gRQEyzq.exe
  2⤵
  PID:4472
- C:\Windows\System\zmHJJjV.exe
  C:\Windows\System\zmHJJjV.exe
  2⤵
  PID:4852
- C:\Windows\System\HInwWJf.exe
  C:\Windows\System\HInwWJf.exe
  2⤵
  PID:4536
- C:\Windows\System\RLqmBwE.exe
  C:\Windows\System\RLqmBwE.exe
  2⤵
  PID:376
- C:\Windows\System\mvemFub.exe
  C:\Windows\System\mvemFub.exe
  2⤵
  PID:4332
- C:\Windows\System\FUGsuZD.exe
  C:\Windows\System\FUGsuZD.exe
  2⤵
  PID:3812
- C:\Windows\System\uRgaBLn.exe
  C:\Windows\System\uRgaBLn.exe
  2⤵
  PID:1408
- C:\Windows\System\DyfeFRb.exe
  C:\Windows\System\DyfeFRb.exe
  2⤵
  PID:3152
- C:\Windows\System\zUUDhHH.exe
  C:\Windows\System\zUUDhHH.exe
  2⤵
  PID:4540
- C:\Windows\System\MopRhXj.exe
  C:\Windows\System\MopRhXj.exe
  2⤵
  PID:3280
- C:\Windows\System\QNZYWsm.exe
  C:\Windows\System\QNZYWsm.exe
  2⤵
  PID:2084
- C:\Windows\System\dprOymB.exe
  C:\Windows\System\dprOymB.exe
  2⤵
  PID:4820
- C:\Windows\System\PHwBGfB.exe
  C:\Windows\System\PHwBGfB.exe
  2⤵
  PID:1156
- C:\Windows\System\kmNGGDc.exe
  C:\Windows\System\kmNGGDc.exe
  2⤵
  PID:4684
- C:\Windows\System\YaengFT.exe
  C:\Windows\System\YaengFT.exe
  2⤵
  PID:1656
- C:\Windows\System\jxloCee.exe
  C:\Windows\System\jxloCee.exe
  2⤵
  PID:4892
- C:\Windows\System\eHmefjp.exe
  C:\Windows\System\eHmefjp.exe
  2⤵
  PID:2028
- C:\Windows\System\qTTjdgY.exe
  C:\Windows\System\qTTjdgY.exe
  2⤵
  PID:5104
- C:\Windows\System\PWtxXFV.exe
  C:\Windows\System\PWtxXFV.exe
  2⤵
  PID:4948
- C:\Windows\System\RHMdyDq.exe
  C:\Windows\System\RHMdyDq.exe
  2⤵
  PID:1548
- C:\Windows\System\ynmBIKq.exe
  C:\Windows\System\ynmBIKq.exe
  2⤵
  PID:4456
- C:\Windows\System\GKezdxL.exe
  C:\Windows\System\GKezdxL.exe
  2⤵
  PID:4688
- C:\Windows\System\NCgdpGZ.exe
  C:\Windows\System\NCgdpGZ.exe
  2⤵
  PID:340
- C:\Windows\System\KeUmThz.exe
  C:\Windows\System\KeUmThz.exe
  2⤵
  PID:4404
- C:\Windows\System\qyszpXO.exe
  C:\Windows\System\qyszpXO.exe
  2⤵
  PID:5140
- C:\Windows\System\FDYEuOq.exe
  C:\Windows\System\FDYEuOq.exe
  2⤵
  PID:5156
- C:\Windows\System\NSVlRRi.exe
  C:\Windows\System\NSVlRRi.exe
  2⤵
  PID:5176
- C:\Windows\System\hwmBAav.exe
  C:\Windows\System\hwmBAav.exe
  2⤵
  PID:5196
- C:\Windows\System\krwewsZ.exe
  C:\Windows\System\krwewsZ.exe
  2⤵
  PID:5224
- C:\Windows\System\hUxCUDL.exe
  C:\Windows\System\hUxCUDL.exe
  2⤵
  PID:5240
- C:\Windows\System\Tbqzozd.exe
  C:\Windows\System\Tbqzozd.exe
  2⤵
  PID:5260
- C:\Windows\System\UjKECuI.exe
  C:\Windows\System\UjKECuI.exe
  2⤵
  PID:5280
- C:\Windows\System\tZqPFXv.exe
  C:\Windows\System\tZqPFXv.exe
  2⤵
  PID:5296
- C:\Windows\System\oRKrPfa.exe
  C:\Windows\System\oRKrPfa.exe
  2⤵
  PID:5312
- C:\Windows\System\rVBrOVX.exe
  C:\Windows\System\rVBrOVX.exe
  2⤵
  PID:5328
- C:\Windows\System\qLPlDLx.exe
  C:\Windows\System\qLPlDLx.exe
  2⤵
  PID:5344
- C:\Windows\System\XTrvpHN.exe
  C:\Windows\System\XTrvpHN.exe
  2⤵
  PID:5364
- C:\Windows\System\wZnFlFz.exe
  C:\Windows\System\wZnFlFz.exe
  2⤵
  PID:5380
- C:\Windows\System\IvFOClM.exe
  C:\Windows\System\IvFOClM.exe
  2⤵
  PID:5396
- C:\Windows\System\DSHWlVA.exe
  C:\Windows\System\DSHWlVA.exe
  2⤵
  PID:5412
- C:\Windows\System\GdXsjhT.exe
  C:\Windows\System\GdXsjhT.exe
  2⤵
  PID:5428
- C:\Windows\System\POUxCdP.exe
  C:\Windows\System\POUxCdP.exe
  2⤵
  PID:5444
- C:\Windows\System\jhXQZJz.exe
  C:\Windows\System\jhXQZJz.exe
  2⤵
  PID:5460
- C:\Windows\System\iZwVaig.exe
  C:\Windows\System\iZwVaig.exe
  2⤵
  PID:5476
- C:\Windows\System\GvPqTuK.exe
  C:\Windows\System\GvPqTuK.exe
  2⤵
  PID:5492
- C:\Windows\System\GfsvLDA.exe
  C:\Windows\System\GfsvLDA.exe
  2⤵
  PID:5508
- C:\Windows\System\zofrEtm.exe
  C:\Windows\System\zofrEtm.exe
  2⤵
  PID:5528
- C:\Windows\System\mxTSoYu.exe
  C:\Windows\System\mxTSoYu.exe
  2⤵
  PID:5544
- C:\Windows\System\ayuTEAq.exe
  C:\Windows\System\ayuTEAq.exe
  2⤵
  PID:5560
- C:\Windows\System\djEEBPc.exe
  C:\Windows\System\djEEBPc.exe
  2⤵
  PID:5576
- C:\Windows\System\IsMpkUY.exe
  C:\Windows\System\IsMpkUY.exe
  2⤵
  PID:5692
- C:\Windows\System\yAnQLOP.exe
  C:\Windows\System\yAnQLOP.exe
  2⤵
  PID:5708
- C:\Windows\System\uSyXGhA.exe
  C:\Windows\System\uSyXGhA.exe
  2⤵
  PID:5724
- C:\Windows\System\eylLhCo.exe
  C:\Windows\System\eylLhCo.exe
  2⤵
  PID:5740
- C:\Windows\System\FhfggWA.exe
  C:\Windows\System\FhfggWA.exe
  2⤵
  PID:5756
- C:\Windows\System\MGHEMNR.exe
  C:\Windows\System\MGHEMNR.exe
  2⤵
  PID:5772
- C:\Windows\System\UelsRwa.exe
  C:\Windows\System\UelsRwa.exe
  2⤵
  PID:5788
- C:\Windows\System\KbcdwIg.exe
  C:\Windows\System\KbcdwIg.exe
  2⤵
  PID:5808
- C:\Windows\System\lApMMKf.exe
  C:\Windows\System\lApMMKf.exe
  2⤵
  PID:5824
- C:\Windows\System\obEIlil.exe
  C:\Windows\System\obEIlil.exe
  2⤵
  PID:5840
- C:\Windows\System\UcixmdF.exe
  C:\Windows\System\UcixmdF.exe
  2⤵
  PID:5856
- C:\Windows\System\GvlbgZo.exe
  C:\Windows\System\GvlbgZo.exe
  2⤵
  PID:5872
- C:\Windows\System\jFSiHqs.exe
  C:\Windows\System\jFSiHqs.exe
  2⤵
  PID:5888
- C:\Windows\System\NbEvaWm.exe
  C:\Windows\System\NbEvaWm.exe
  2⤵
  PID:5908
- C:\Windows\System\lbtaEqk.exe
  C:\Windows\System\lbtaEqk.exe
  2⤵
  PID:5924
- C:\Windows\System\cZnevgU.exe
  C:\Windows\System\cZnevgU.exe
  2⤵
  PID:5940
- C:\Windows\System\YjSuuKC.exe
  C:\Windows\System\YjSuuKC.exe
  2⤵
  PID:5956
- C:\Windows\System\PKtOAnv.exe
  C:\Windows\System\PKtOAnv.exe
  2⤵
  PID:5972
- C:\Windows\System\fkoXLVR.exe
  C:\Windows\System\fkoXLVR.exe
  2⤵
  PID:5992
- C:\Windows\System\VjsgdjX.exe
  C:\Windows\System\VjsgdjX.exe
  2⤵
  PID:6008
- C:\Windows\System\XNsbCYR.exe
  C:\Windows\System\XNsbCYR.exe
  2⤵
  PID:6024
- C:\Windows\System\NZTEtyg.exe
  C:\Windows\System\NZTEtyg.exe
  2⤵
  PID:6040
- C:\Windows\System\ZYrnfnc.exe
  C:\Windows\System\ZYrnfnc.exe
  2⤵
  PID:6056
- C:\Windows\System\UnpCZmD.exe
  C:\Windows\System\UnpCZmD.exe
  2⤵
  PID:6076
- C:\Windows\System\ecMdKwS.exe
  C:\Windows\System\ecMdKwS.exe
  2⤵
  PID:6092
- C:\Windows\System\voAqFXG.exe
  C:\Windows\System\voAqFXG.exe
  2⤵
  PID:6108
- C:\Windows\System\HFxjnPb.exe
  C:\Windows\System\HFxjnPb.exe
  2⤵
  PID:6124
- C:\Windows\System\VjLyZUR.exe
  C:\Windows\System\VjLyZUR.exe
  2⤵
  PID:5212
- C:\Windows\System\yVpvlSQ.exe
  C:\Windows\System\yVpvlSQ.exe
  2⤵
  PID:5256
- C:\Windows\System\KKqjOIJ.exe
  C:\Windows\System\KKqjOIJ.exe
  2⤵
  PID:5308
- C:\Windows\System\TiRawvF.exe
  C:\Windows\System\TiRawvF.exe
  2⤵
  PID:5292
- C:\Windows\System\aJFxoVj.exe
  C:\Windows\System\aJFxoVj.exe
  2⤵
  PID:5516
- C:\Windows\System\xwakmKU.exe
  C:\Windows\System\xwakmKU.exe
  2⤵
  PID:5320
- C:\Windows\System\EwWYdVy.exe
  C:\Windows\System\EwWYdVy.exe
  2⤵
  PID:5420
- C:\Windows\System\mdeaDQA.exe
  C:\Windows\System\mdeaDQA.exe
  2⤵
  PID:5524
- C:\Windows\System\niXIjrR.exe
  C:\Windows\System\niXIjrR.exe
  2⤵
  PID:5472
- C:\Windows\System\AWdLvqW.exe
  C:\Windows\System\AWdLvqW.exe
  2⤵
  PID:5540
- C:\Windows\System\xmpaCYr.exe
  C:\Windows\System\xmpaCYr.exe
  2⤵
  PID:5336
- C:\Windows\System\wQCiKlV.exe
  C:\Windows\System\wQCiKlV.exe
  2⤵
  PID:5388
- C:\Windows\System\fZIxCAY.exe
  C:\Windows\System\fZIxCAY.exe
  2⤵
  PID:5620
- C:\Windows\System\SnGJQQu.exe
  C:\Windows\System\SnGJQQu.exe
  2⤵
  PID:5636
- C:\Windows\System\VpTNLrf.exe
  C:\Windows\System\VpTNLrf.exe
  2⤵
  PID:5652
- C:\Windows\System\UZQBvzY.exe
  C:\Windows\System\UZQBvzY.exe
  2⤵
  PID:5668
- C:\Windows\System\qomvewl.exe
  C:\Windows\System\qomvewl.exe
  2⤵
  PID:5684
- C:\Windows\System\fBBMZMl.exe
  C:\Windows\System\fBBMZMl.exe
  2⤵
  PID:5736
- C:\Windows\System\PGxikmI.exe
  C:\Windows\System\PGxikmI.exe
  2⤵
  PID:5768
- C:\Windows\System\felupep.exe
  C:\Windows\System\felupep.exe
  2⤵
  PID:5832
- C:\Windows\System\cRrgieW.exe
  C:\Windows\System\cRrgieW.exe
  2⤵
  PID:5900
- C:\Windows\System\zYiIlgK.exe
  C:\Windows\System\zYiIlgK.exe
  2⤵
  PID:5936
- C:\Windows\System\AHatABR.exe
  C:\Windows\System\AHatABR.exe
  2⤵
  PID:5168
- C:\Windows\System\MiruRRM.exe
  C:\Windows\System\MiruRRM.exe
  2⤵
  PID:4816
- C:\Windows\System\MHWeqiJ.exe
  C:\Windows\System\MHWeqiJ.exe
  2⤵
  PID:5128
- C:\Windows\System\BQxvDYT.exe
  C:\Windows\System\BQxvDYT.exe
  2⤵
  PID:5852
- C:\Windows\System\fhrfYzV.exe
  C:\Windows\System\fhrfYzV.exe
  2⤵
  PID:5752
- C:\Windows\System\sPqVVCi.exe
  C:\Windows\System\sPqVVCi.exe
  2⤵
  PID:6020
- C:\Windows\System\Eorktcm.exe
  C:\Windows\System\Eorktcm.exe
  2⤵
  PID:6120
- C:\Windows\System\mubmLgG.exe
  C:\Windows\System\mubmLgG.exe
  2⤵
  PID:6004
- C:\Windows\System\qLevMTR.exe
  C:\Windows\System\qLevMTR.exe
  2⤵
  PID:5952
- C:\Windows\System\IlLXoKw.exe
  C:\Windows\System\IlLXoKw.exe
  2⤵
  PID:5232
- C:\Windows\System\pUNPiGV.exe
  C:\Windows\System\pUNPiGV.exe
  2⤵
  PID:5520
- C:\Windows\System\rGAlncL.exe
  C:\Windows\System\rGAlncL.exe
  2⤵
  PID:5572
- C:\Windows\System\tcSCNNk.exe
  C:\Windows\System\tcSCNNk.exe
  2⤵
  PID:5632
- C:\Windows\System\BsvwLIk.exe
  C:\Windows\System\BsvwLIk.exe
  2⤵
  PID:5732
- C:\Windows\System\dOuGMGw.exe
  C:\Windows\System\dOuGMGw.exe
  2⤵
  PID:5932
- C:\Windows\System\oDkSaTg.exe
  C:\Windows\System\oDkSaTg.exe
  2⤵
  PID:5252
- C:\Windows\System\lSlDfiY.exe
  C:\Windows\System\lSlDfiY.exe
  2⤵
  PID:5676
- C:\Windows\System\WvEdHDk.exe
  C:\Windows\System\WvEdHDk.exe
  2⤵
  PID:5288
- C:\Windows\System\ocgGRUg.exe
  C:\Windows\System\ocgGRUg.exe
  2⤵
  PID:5596
- C:\Windows\System\kdkKadL.exe
  C:\Windows\System\kdkKadL.exe
  2⤵
  PID:6068
- C:\Windows\System\efnrnBF.exe
  C:\Windows\System\efnrnBF.exe
  2⤵
  PID:6032
- C:\Windows\System\GNbkLEK.exe
  C:\Windows\System\GNbkLEK.exe
  2⤵
  PID:5192
- C:\Windows\System\JcLkXeV.exe
  C:\Windows\System\JcLkXeV.exe
  2⤵
  PID:5748
- C:\Windows\System\XzTJUzt.exe
  C:\Windows\System\XzTJUzt.exe
  2⤵
  PID:6088
- C:\Windows\System\SkXrnfI.exe
  C:\Windows\System\SkXrnfI.exe
  2⤵
  PID:5216
- C:\Windows\System\yBFKJJg.exe
  C:\Windows\System\yBFKJJg.exe
  2⤵
  PID:5628
- C:\Windows\System\NjoXlrT.exe
  C:\Windows\System\NjoXlrT.exe
  2⤵
  PID:5804
- C:\Windows\System\gGzZTMA.exe
  C:\Windows\System\gGzZTMA.exe
  2⤵
  PID:5820
- C:\Windows\System\QhsiBaH.exe
  C:\Windows\System\QhsiBaH.exe
  2⤵
  PID:5816
- C:\Windows\System\xMOkQaV.exe
  C:\Windows\System\xMOkQaV.exe
  2⤵
  PID:5704
- C:\Windows\System\waUbCpF.exe
  C:\Windows\System\waUbCpF.exe
  2⤵
  PID:5764
- C:\Windows\System\mOajVnA.exe
  C:\Windows\System\mOajVnA.exe
  2⤵
  PID:2052
- C:\Windows\System\RolCNXQ.exe
  C:\Windows\System\RolCNXQ.exe
  2⤵
  PID:5920
- C:\Windows\System\ENxDkjT.exe
  C:\Windows\System\ENxDkjT.exe
  2⤵
  PID:1772
- C:\Windows\System\CLcarzH.exe
  C:\Windows\System\CLcarzH.exe
  2⤵
  PID:5988
- C:\Windows\System\WchsHxF.exe
  C:\Windows\System\WchsHxF.exe
  2⤵
  PID:5980
- C:\Windows\System\TMNnvyx.exe
  C:\Windows\System\TMNnvyx.exe
  2⤵
  PID:5208
- C:\Windows\System\OqakOvA.exe
  C:\Windows\System\OqakOvA.exe
  2⤵
  PID:5268
- C:\Windows\System\TMBzyiA.exe
  C:\Windows\System\TMBzyiA.exe
  2⤵
  PID:5868
- C:\Windows\System\GINLeXK.exe
  C:\Windows\System\GINLeXK.exe
  2⤵
  PID:6136
- C:\Windows\System\lVwCBNd.exe
  C:\Windows\System\lVwCBNd.exe
  2⤵
  PID:5688
- C:\Windows\System\AIgPGxI.exe
  C:\Windows\System\AIgPGxI.exe
  2⤵
  PID:5616
- C:\Windows\System\qBnEvEG.exe
  C:\Windows\System\qBnEvEG.exe
  2⤵
  PID:5964
- C:\Windows\System\XfQUDFY.exe
  C:\Windows\System\XfQUDFY.exe
  2⤵
  PID:5968
- C:\Windows\System\PoCDGYh.exe
  C:\Windows\System\PoCDGYh.exe
  2⤵
  PID:6148
- C:\Windows\System\fPJNZTu.exe
  C:\Windows\System\fPJNZTu.exe
  2⤵
  PID:6164
- C:\Windows\System\tKzmJef.exe
  C:\Windows\System\tKzmJef.exe
  2⤵
  PID:6180
- C:\Windows\System\bPZIYeU.exe
  C:\Windows\System\bPZIYeU.exe
  2⤵
  PID:6196
- C:\Windows\System\vrxrFLN.exe
  C:\Windows\System\vrxrFLN.exe
  2⤵
  PID:6212
- C:\Windows\System\DcopOlZ.exe
  C:\Windows\System\DcopOlZ.exe
  2⤵
  PID:6228
- C:\Windows\System\pmHopoX.exe
  C:\Windows\System\pmHopoX.exe
  2⤵
  PID:6244
- C:\Windows\System\SQbVOwi.exe
  C:\Windows\System\SQbVOwi.exe
  2⤵
  PID:6264
- C:\Windows\System\aSsEFBz.exe
  C:\Windows\System\aSsEFBz.exe
  2⤵
  PID:6280
- C:\Windows\System\mApVJja.exe
  C:\Windows\System\mApVJja.exe
  2⤵
  PID:6296
- C:\Windows\System\sVwqzjU.exe
  C:\Windows\System\sVwqzjU.exe
  2⤵
  PID:6312
- C:\Windows\System\FEsbJxj.exe
  C:\Windows\System\FEsbJxj.exe
  2⤵
  PID:6328
- C:\Windows\System\NxMBIbd.exe
  C:\Windows\System\NxMBIbd.exe
  2⤵
  PID:6344
- C:\Windows\System\KOxZicS.exe
  C:\Windows\System\KOxZicS.exe
  2⤵
  PID:6360
- C:\Windows\System\MlESbAY.exe
  C:\Windows\System\MlESbAY.exe
  2⤵
  PID:6376
- C:\Windows\System\iJkEYVs.exe
  C:\Windows\System\iJkEYVs.exe
  2⤵
  PID:6392
- C:\Windows\System\iuFSBZr.exe
  C:\Windows\System\iuFSBZr.exe
  2⤵
  PID:6408
- C:\Windows\System\lORajKB.exe
  C:\Windows\System\lORajKB.exe
  2⤵
  PID:6424
- C:\Windows\System\UzbEJVI.exe
  C:\Windows\System\UzbEJVI.exe
  2⤵
  PID:6444
- C:\Windows\System\nUyPcew.exe
  C:\Windows\System\nUyPcew.exe
  2⤵
  PID:6460
- C:\Windows\System\KyGRdXb.exe
  C:\Windows\System\KyGRdXb.exe
  2⤵
  PID:6476
- C:\Windows\System\mlIiMGg.exe
  C:\Windows\System\mlIiMGg.exe
  2⤵
  PID:6492
- C:\Windows\System\lBTJWhb.exe
  C:\Windows\System\lBTJWhb.exe
  2⤵
  PID:6508
- C:\Windows\System\coqDhjA.exe
  C:\Windows\System\coqDhjA.exe
  2⤵
  PID:6524
- C:\Windows\System\oIcRqIn.exe
  C:\Windows\System\oIcRqIn.exe
  2⤵
  PID:6540
- C:\Windows\System\IzFApQT.exe
  C:\Windows\System\IzFApQT.exe
  2⤵
  PID:6556
- C:\Windows\System\JpNfEoj.exe
  C:\Windows\System\JpNfEoj.exe
  2⤵
  PID:6576
- C:\Windows\System\uAJtsZw.exe
  C:\Windows\System\uAJtsZw.exe
  2⤵
  PID:6592
- C:\Windows\System\dkBdSpv.exe
  C:\Windows\System\dkBdSpv.exe
  2⤵
  PID:6608
- C:\Windows\System\EAKqjud.exe
  C:\Windows\System\EAKqjud.exe
  2⤵
  PID:6624
- C:\Windows\System\BGAkUre.exe
  C:\Windows\System\BGAkUre.exe
  2⤵
  PID:6644
- C:\Windows\System\iXJHkau.exe
  C:\Windows\System\iXJHkau.exe
  2⤵
  PID:6660
- C:\Windows\System\mQOfylx.exe
  C:\Windows\System\mQOfylx.exe
  2⤵
  PID:6676
- C:\Windows\System\ygNRzZB.exe
  C:\Windows\System\ygNRzZB.exe
  2⤵
  PID:6696
- C:\Windows\System\zdorxyx.exe
  C:\Windows\System\zdorxyx.exe
  2⤵
  PID:6712
- C:\Windows\System\RySOHYU.exe
  C:\Windows\System\RySOHYU.exe
  2⤵
  PID:6752
- C:\Windows\System\vPoOTeo.exe
  C:\Windows\System\vPoOTeo.exe
  2⤵
  PID:6768
- C:\Windows\System\EFnJIzE.exe
  C:\Windows\System\EFnJIzE.exe
  2⤵
  PID:6788
- C:\Windows\System\uTBeYAU.exe
  C:\Windows\System\uTBeYAU.exe
  2⤵
  PID:6804
- C:\Windows\System\CRJMypb.exe
  C:\Windows\System\CRJMypb.exe
  2⤵
  PID:6820
- C:\Windows\System\dstYmwG.exe
  C:\Windows\System\dstYmwG.exe
  2⤵
  PID:6836
- C:\Windows\System\rrKSGsN.exe
  C:\Windows\System\rrKSGsN.exe
  2⤵
  PID:6852
- C:\Windows\System\TXZnjdl.exe
  C:\Windows\System\TXZnjdl.exe
  2⤵
  PID:6868
- C:\Windows\System\KjeYDkD.exe
  C:\Windows\System\KjeYDkD.exe
  2⤵
  PID:6888
- C:\Windows\System\vLOkOMt.exe
  C:\Windows\System\vLOkOMt.exe
  2⤵
  PID:6904
- C:\Windows\System\CsNRTIf.exe
  C:\Windows\System\CsNRTIf.exe
  2⤵
  PID:6920
- C:\Windows\System\yUKcqzp.exe
  C:\Windows\System\yUKcqzp.exe
  2⤵
  PID:6936
- C:\Windows\System\ducjoZN.exe
  C:\Windows\System\ducjoZN.exe
  2⤵
  PID:6952
- C:\Windows\System\MvOXMEB.exe
  C:\Windows\System\MvOXMEB.exe
  2⤵
  PID:6972
- C:\Windows\System\EPsxIKg.exe
  C:\Windows\System\EPsxIKg.exe
  2⤵
  PID:6988
- C:\Windows\System\EmVXPzw.exe
  C:\Windows\System\EmVXPzw.exe
  2⤵
  PID:7004
- C:\Windows\System\VzZYrmL.exe
  C:\Windows\System\VzZYrmL.exe
  2⤵
  PID:7020
- C:\Windows\System\mAAdjcP.exe
  C:\Windows\System\mAAdjcP.exe
  2⤵
  PID:7036
- C:\Windows\System\DWsMIgR.exe
  C:\Windows\System\DWsMIgR.exe
  2⤵
  PID:7052
- C:\Windows\System\nYrSZuL.exe
  C:\Windows\System\nYrSZuL.exe
  2⤵
  PID:7068
- C:\Windows\System\hBRYWzD.exe
  C:\Windows\System\hBRYWzD.exe
  2⤵
  PID:7088
- C:\Windows\System\vcSQwQu.exe
  C:\Windows\System\vcSQwQu.exe
  2⤵
  PID:7104
- C:\Windows\System\WIBzaLC.exe
  C:\Windows\System\WIBzaLC.exe
  2⤵
  PID:7120
- C:\Windows\System\pwyUQqt.exe
  C:\Windows\System\pwyUQqt.exe
  2⤵
  PID:7136
- C:\Windows\System\OEcfNAz.exe
  C:\Windows\System\OEcfNAz.exe
  2⤵
  PID:7152
- C:\Windows\System\GtZGjvH.exe
  C:\Windows\System\GtZGjvH.exe
  2⤵
  PID:5716
- C:\Windows\System\mTBlJhq.exe
  C:\Windows\System\mTBlJhq.exe
  2⤵
  PID:6084
- C:\Windows\System\dDxElCA.exe
  C:\Windows\System\dDxElCA.exe
  2⤵
  PID:6172
- C:\Windows\System\ALrYzYj.exe
  C:\Windows\System\ALrYzYj.exe
  2⤵
  PID:6236
- C:\Windows\System\AKbRwvB.exe
  C:\Windows\System\AKbRwvB.exe
  2⤵
  PID:6304
- C:\Windows\System\aDEQAhF.exe
  C:\Windows\System\aDEQAhF.exe
  2⤵
  PID:6368
- C:\Windows\System\IuRnGQi.exe
  C:\Windows\System\IuRnGQi.exe
  2⤵
  PID:6436
- C:\Windows\System\KGyWVJP.exe
  C:\Windows\System\KGyWVJP.exe
  2⤵
  PID:6488
- C:\Windows\System\Eprxetd.exe
  C:\Windows\System\Eprxetd.exe
  2⤵
  PID:6548
- C:\Windows\System\JAAtQYj.exe
  C:\Windows\System\JAAtQYj.exe
  2⤵
  PID:6616
- C:\Windows\System\gXFBqIt.exe
  C:\Windows\System\gXFBqIt.exe
  2⤵
  PID:6692
- C:\Windows\System\sZYOemP.exe
  C:\Windows\System\sZYOemP.exe
  2⤵
  PID:5784
- C:\Windows\System\TfNvslk.exe
  C:\Windows\System\TfNvslk.exe
  2⤵
  PID:6620
- C:\Windows\System\jbrAsNi.exe
  C:\Windows\System\jbrAsNi.exe
  2⤵
  PID:6188
- C:\Windows\System\sDlrtiX.exe
  C:\Windows\System\sDlrtiX.exe
  2⤵
  PID:6256
- C:\Windows\System\tfhfSwv.exe
  C:\Windows\System\tfhfSwv.exe
  2⤵
  PID:6388
- C:\Windows\System\UgVNxBZ.exe
  C:\Windows\System\UgVNxBZ.exe
  2⤵
  PID:6484
- C:\Windows\System\oxRfYoJ.exe
  C:\Windows\System\oxRfYoJ.exe
  2⤵
  PID:6736
- C:\Windows\System\rWJmTay.exe
  C:\Windows\System\rWJmTay.exe
  2⤵
  PID:6812
- C:\Windows\System\lAnswEw.exe
  C:\Windows\System\lAnswEw.exe
  2⤵
  PID:6848
- C:\Windows\System\bfssVrr.exe
  C:\Windows\System\bfssVrr.exe
  2⤵
  PID:6884
- C:\Windows\System\OhogKeT.exe
  C:\Windows\System\OhogKeT.exe
  2⤵
  PID:6796
- C:\Windows\System\XdQUuNw.exe
  C:\Windows\System\XdQUuNw.exe
  2⤵
  PID:6832
- C:\Windows\System\hprvGCf.exe
  C:\Windows\System\hprvGCf.exe
  2⤵
  PID:6928
- C:\Windows\System\ejNccuf.exe
  C:\Windows\System\ejNccuf.exe
  2⤵
  PID:6968
- C:\Windows\System\WNggZKs.exe
  C:\Windows\System\WNggZKs.exe
  2⤵
  PID:7032
- C:\Windows\System\YoaFsgC.exe
  C:\Windows\System\YoaFsgC.exe
  2⤵
  PID:7096
- C:\Windows\System\OCarQTT.exe
  C:\Windows\System\OCarQTT.exe
  2⤵
  PID:7132
- C:\Windows\System\SljpXYs.exe
  C:\Windows\System\SljpXYs.exe
  2⤵
  PID:5904
- C:\Windows\System\cycIanu.exe
  C:\Windows\System\cycIanu.exe
  2⤵
  PID:6432
- C:\Windows\System\JckSBYu.exe
  C:\Windows\System\JckSBYu.exe
  2⤵
  PID:5456
- C:\Windows\System\njKOUaq.exe
  C:\Windows\System\njKOUaq.exe
  2⤵
  PID:6520
- C:\Windows\System\wvgaCgE.exe
  C:\Windows\System\wvgaCgE.exe
  2⤵
  PID:7112
- C:\Windows\System\UgaKSsP.exe
  C:\Windows\System\UgaKSsP.exe
  2⤵
  PID:7080
- C:\Windows\System\GkWCBbM.exe
  C:\Windows\System\GkWCBbM.exe
  2⤵
  PID:6208
- C:\Windows\System\EeipiCX.exe
  C:\Windows\System\EeipiCX.exe
  2⤵
  PID:6472
- C:\Windows\System\UJFqCrX.exe
  C:\Windows\System\UJFqCrX.exe
  2⤵
  PID:6656
- C:\Windows\System\DcXiIrA.exe
  C:\Windows\System\DcXiIrA.exe
  2⤵
  PID:6220
- C:\Windows\System\BmiETal.exe
  C:\Windows\System\BmiETal.exe
  2⤵
  PID:6224
- C:\Windows\System\zhrXEon.exe
  C:\Windows\System\zhrXEon.exe
  2⤵
  PID:6324
- C:\Windows\System\wGvQBPp.exe
  C:\Windows\System\wGvQBPp.exe
  2⤵
  PID:6704
- C:\Windows\System\qTcisNw.exe
  C:\Windows\System\qTcisNw.exe
  2⤵
  PID:6640
- C:\Windows\System\yGbEjbQ.exe
  C:\Windows\System\yGbEjbQ.exe
  2⤵
  PID:6572
- C:\Windows\System\fLTZyta.exe
  C:\Windows\System\fLTZyta.exe
  2⤵
  PID:6456
- C:\Windows\System\dhRCHJq.exe
  C:\Windows\System\dhRCHJq.exe
  2⤵
  PID:6776
- C:\Windows\System\ULoZatl.exe
  C:\Windows\System\ULoZatl.exe
  2⤵
  PID:6504
- C:\Windows\System\VdkZkxz.exe
  C:\Windows\System\VdkZkxz.exe
  2⤵
  PID:6384
- C:\Windows\System\urUgFfW.exe
  C:\Windows\System\urUgFfW.exe
  2⤵
  PID:6964
- C:\Windows\System\PpBqiac.exe
  C:\Windows\System\PpBqiac.exe
  2⤵
  PID:7064
- C:\Windows\System\PnsOUCZ.exe
  C:\Windows\System\PnsOUCZ.exe
  2⤵
  PID:6900
- C:\Windows\System\HKaTybT.exe
  C:\Windows\System\HKaTybT.exe
  2⤵
  PID:5884
- C:\Windows\System\ZoxNCMl.exe
  C:\Windows\System\ZoxNCMl.exe
  2⤵
  PID:7044
- C:\Windows\System\yaWRGhr.exe
  C:\Windows\System\yaWRGhr.exe
  2⤵
  PID:5152
- C:\Windows\System\DRuNSrl.exe
  C:\Windows\System\DRuNSrl.exe
  2⤵
  PID:6500
- C:\Windows\System\TAWvgJZ.exe
  C:\Windows\System\TAWvgJZ.exe
  2⤵
  PID:6276
- C:\Windows\System\FrdIYzJ.exe
  C:\Windows\System\FrdIYzJ.exe
  2⤵
  PID:6896
- C:\Windows\System\iHwwmtA.exe
  C:\Windows\System\iHwwmtA.exe
  2⤵
  PID:6356
- C:\Windows\System\HwdnQzv.exe
  C:\Windows\System\HwdnQzv.exe
  2⤵
  PID:6588
- C:\Windows\System\XenfZTv.exe
  C:\Windows\System\XenfZTv.exe
  2⤵
  PID:6292
- C:\Windows\System\jcxEVlP.exe
  C:\Windows\System\jcxEVlP.exe
  2⤵
  PID:6984
- C:\Windows\System\TpBTttk.exe
  C:\Windows\System\TpBTttk.exe
  2⤵
  PID:6760
- C:\Windows\System\xUNbIUC.exe
  C:\Windows\System\xUNbIUC.exe
  2⤵
  PID:6564
- C:\Windows\System\vfHtvnz.exe
  C:\Windows\System\vfHtvnz.exe
  2⤵
  PID:6864
- C:\Windows\System\MdpBjvL.exe
  C:\Windows\System\MdpBjvL.exe
  2⤵
  PID:5584
- C:\Windows\System\yXWdNCa.exe
  C:\Windows\System\yXWdNCa.exe
  2⤵
  PID:6600
- C:\Windows\System\FTJcQlg.exe
  C:\Windows\System\FTJcQlg.exe
  2⤵
  PID:7128
- C:\Windows\System\pxZalDZ.exe
  C:\Windows\System\pxZalDZ.exe
  2⤵
  PID:6204
- C:\Windows\System\ndfMzwL.exe
  C:\Windows\System\ndfMzwL.exe
  2⤵
  PID:6672
- C:\Windows\System\OpXRihM.exe
  C:\Windows\System\OpXRihM.exe
  2⤵
  PID:6960
- C:\Windows\System\wKYbAfv.exe
  C:\Windows\System\wKYbAfv.exe
  2⤵
  PID:6468
- C:\Windows\System\dojUJju.exe
  C:\Windows\System\dojUJju.exe
  2⤵
  PID:6668
- C:\Windows\System\XfFudWf.exe
  C:\Windows\System\XfFudWf.exe
  2⤵
  PID:7144
- C:\Windows\System\xCWHYZg.exe
  C:\Windows\System\xCWHYZg.exe
  2⤵
  PID:7172
- C:\Windows\System\AojjWul.exe
  C:\Windows\System\AojjWul.exe
  2⤵
  PID:7188
- C:\Windows\System\AYxYuCE.exe
  C:\Windows\System\AYxYuCE.exe
  2⤵
  PID:7204
- C:\Windows\System\ZsCLrYX.exe
  C:\Windows\System\ZsCLrYX.exe
  2⤵
  PID:7220
- C:\Windows\System\eBkwJoY.exe
  C:\Windows\System\eBkwJoY.exe
  2⤵
  PID:7236
- C:\Windows\System\bFtmJRP.exe
  C:\Windows\System\bFtmJRP.exe
  2⤵
  PID:7252
- C:\Windows\System\jRKrZOk.exe
  C:\Windows\System\jRKrZOk.exe
  2⤵
  PID:7268
- C:\Windows\System\GuAAGbk.exe
  C:\Windows\System\GuAAGbk.exe
  2⤵
  PID:7288
- C:\Windows\System\RxmgoXz.exe
  C:\Windows\System\RxmgoXz.exe
  2⤵
  PID:7304
- C:\Windows\System\jQTCsfI.exe
  C:\Windows\System\jQTCsfI.exe
  2⤵
  PID:7320
- C:\Windows\System\nAwDaql.exe
  C:\Windows\System\nAwDaql.exe
  2⤵
  PID:7336
- C:\Windows\System\uBaUQnL.exe
  C:\Windows\System\uBaUQnL.exe
  2⤵
  PID:7356
- C:\Windows\System\RwCzRzP.exe
  C:\Windows\System\RwCzRzP.exe
  2⤵
  PID:7372
- C:\Windows\System\ayoDGHj.exe
  C:\Windows\System\ayoDGHj.exe
  2⤵
  PID:7392
- C:\Windows\System\SYNbwiu.exe
  C:\Windows\System\SYNbwiu.exe
  2⤵
  PID:7408
- C:\Windows\System\Hanufla.exe
  C:\Windows\System\Hanufla.exe
  2⤵
  PID:7424
- C:\Windows\System\VodDjhN.exe
  C:\Windows\System\VodDjhN.exe
  2⤵
  PID:7440
- C:\Windows\System\iheEbFA.exe
  C:\Windows\System\iheEbFA.exe
  2⤵
  PID:7456
- C:\Windows\System\vUEUqYQ.exe
  C:\Windows\System\vUEUqYQ.exe
  2⤵
  PID:7472
- C:\Windows\System\ELbTJIw.exe
  C:\Windows\System\ELbTJIw.exe
  2⤵
  PID:7488
- C:\Windows\System\ZmRWTeS.exe
  C:\Windows\System\ZmRWTeS.exe
  2⤵
  PID:7504
- C:\Windows\System\uXobAfH.exe
  C:\Windows\System\uXobAfH.exe
  2⤵
  PID:7520
- C:\Windows\System\XKbwfhb.exe
  C:\Windows\System\XKbwfhb.exe
  2⤵
  PID:7536
- C:\Windows\System\JyYZwVZ.exe
  C:\Windows\System\JyYZwVZ.exe
  2⤵
  PID:7552
- C:\Windows\System\dpbAfbi.exe
  C:\Windows\System\dpbAfbi.exe
  2⤵
  PID:7572
- C:\Windows\System\uENcDUd.exe
  C:\Windows\System\uENcDUd.exe
  2⤵
  PID:7588
- C:\Windows\System\pbFSRVl.exe
  C:\Windows\System\pbFSRVl.exe
  2⤵
  PID:7604
- C:\Windows\System\dYonVyq.exe
  C:\Windows\System\dYonVyq.exe
  2⤵
  PID:7620
- C:\Windows\System\reJWOUN.exe
  C:\Windows\System\reJWOUN.exe
  2⤵
  PID:7636
- C:\Windows\System\zKcyrVk.exe
  C:\Windows\System\zKcyrVk.exe
  2⤵
  PID:7652
- C:\Windows\System\epsMTTr.exe
  C:\Windows\System\epsMTTr.exe
  2⤵
  PID:7668
- C:\Windows\System\quNljPr.exe
  C:\Windows\System\quNljPr.exe
  2⤵
  PID:7684
- C:\Windows\System\sYOiUZR.exe
  C:\Windows\System\sYOiUZR.exe
  2⤵
  PID:7704
- C:\Windows\System\udQZiWQ.exe
  C:\Windows\System\udQZiWQ.exe
  2⤵
  PID:7720
- C:\Windows\System\baoIpoM.exe
  C:\Windows\System\baoIpoM.exe
  2⤵
  PID:7736
- C:\Windows\System\QLgFvmn.exe
  C:\Windows\System\QLgFvmn.exe
  2⤵
  PID:7752
- C:\Windows\System\bPcSIND.exe
  C:\Windows\System\bPcSIND.exe
  2⤵
  PID:7768
- C:\Windows\System\fWubgTo.exe
  C:\Windows\System\fWubgTo.exe
  2⤵
  PID:7784
- C:\Windows\System\uOjsiRK.exe
  C:\Windows\System\uOjsiRK.exe
  2⤵
  PID:7800
- C:\Windows\System\TFcTPUl.exe
  C:\Windows\System\TFcTPUl.exe
  2⤵
  PID:7816
- C:\Windows\System\WlEzsQF.exe
  C:\Windows\System\WlEzsQF.exe
  2⤵
  PID:7832
- C:\Windows\System\xStsNeU.exe
  C:\Windows\System\xStsNeU.exe
  2⤵
  PID:7852
- C:\Windows\System\qEUrRRG.exe
  C:\Windows\System\qEUrRRG.exe
  2⤵
  PID:7868
- C:\Windows\System\UUemKDf.exe
  C:\Windows\System\UUemKDf.exe
  2⤵
  PID:7884
- C:\Windows\System\gNUFXQs.exe
  C:\Windows\System\gNUFXQs.exe
  2⤵
  PID:7900
- C:\Windows\System\cCXpkMZ.exe
  C:\Windows\System\cCXpkMZ.exe
  2⤵
  PID:7916
- C:\Windows\System\oFXKqAY.exe
  C:\Windows\System\oFXKqAY.exe
  2⤵
  PID:7932
- C:\Windows\System\zJstJDY.exe
  C:\Windows\System\zJstJDY.exe
  2⤵
  PID:7948
- C:\Windows\System\VdknLXH.exe
  C:\Windows\System\VdknLXH.exe
  2⤵
  PID:7964
- C:\Windows\System\QzYXKMV.exe
  C:\Windows\System\QzYXKMV.exe
  2⤵
  PID:7980
- C:\Windows\System\HkByxnM.exe
  C:\Windows\System\HkByxnM.exe
  2⤵
  PID:7996
- C:\Windows\System\IXegCES.exe
  C:\Windows\System\IXegCES.exe
  2⤵
  PID:8012
- C:\Windows\System\FCRjMUe.exe
  C:\Windows\System\FCRjMUe.exe
  2⤵
  PID:8032
- C:\Windows\System\znsWzuR.exe
  C:\Windows\System\znsWzuR.exe
  2⤵
  PID:8048
- C:\Windows\System\DogJoEr.exe
  C:\Windows\System\DogJoEr.exe
  2⤵
  PID:8064
- C:\Windows\System\vallceQ.exe
  C:\Windows\System\vallceQ.exe
  2⤵
  PID:8084
- C:\Windows\System\FwYYteQ.exe
  C:\Windows\System\FwYYteQ.exe
  2⤵
  PID:8100
- C:\Windows\System\uwKQtmK.exe
  C:\Windows\System\uwKQtmK.exe
  2⤵
  PID:8116
- C:\Windows\System\elEYBDf.exe
  C:\Windows\System\elEYBDf.exe
  2⤵
  PID:8132
- C:\Windows\System\SPGnxUJ.exe
  C:\Windows\System\SPGnxUJ.exe
  2⤵
  PID:8148
- C:\Windows\System\SBgKSZw.exe
  C:\Windows\System\SBgKSZw.exe
  2⤵
  PID:8164
- C:\Windows\System\uDEtpZr.exe
  C:\Windows\System\uDEtpZr.exe
  2⤵
  PID:8180
- C:\Windows\System\ORhsZah.exe
  C:\Windows\System\ORhsZah.exe
  2⤵
  PID:6416
- C:\Windows\System\onKMcKn.exe
  C:\Windows\System\onKMcKn.exe
  2⤵
  PID:7200
- C:\Windows\System\RNJZgtJ.exe
  C:\Windows\System\RNJZgtJ.exe
  2⤵
  PID:7180
- C:\Windows\System\MJnDuug.exe
  C:\Windows\System\MJnDuug.exe
  2⤵
  PID:7212
- C:\Windows\System\GTnQuaq.exe
  C:\Windows\System\GTnQuaq.exe
  2⤵
  PID:7276
- C:\Windows\System\hqDINLN.exe
  C:\Windows\System\hqDINLN.exe
  2⤵
  PID:7300
- C:\Windows\System\KDlrFRF.exe
  C:\Windows\System\KDlrFRF.exe
  2⤵
  PID:7368
- C:\Windows\System\iJIoDgP.exe
  C:\Windows\System\iJIoDgP.exe
  2⤵
  PID:7400
- C:\Windows\System\xFDTWmD.exe
  C:\Windows\System\xFDTWmD.exe
  2⤵
  PID:7432
- C:\Windows\System\UNwrskw.exe
  C:\Windows\System\UNwrskw.exe
  2⤵
  PID:7352
- C:\Windows\System\KVXbgqH.exe
  C:\Windows\System\KVXbgqH.exe
  2⤵
  PID:7420
- C:\Windows\System\sEHswND.exe
  C:\Windows\System\sEHswND.exe
  2⤵
  PID:7468
- C:\Windows\System\AixfJKz.exe
  C:\Windows\System\AixfJKz.exe
  2⤵
  PID:7564
- C:\Windows\System\ntuneWc.exe
  C:\Windows\System\ntuneWc.exe
  2⤵
  PID:7600
- C:\Windows\System\oWhDbmr.exe
  C:\Windows\System\oWhDbmr.exe
  2⤵
  PID:7660
- C:\Windows\System\xKUtAJa.exe
  C:\Windows\System\xKUtAJa.exe
  2⤵
  PID:7484
- C:\Windows\System\zjeCDgf.exe
  C:\Windows\System\zjeCDgf.exe
  2⤵
  PID:7584
- C:\Windows\System\PQZpnqV.exe
  C:\Windows\System\PQZpnqV.exe
  2⤵
  PID:7648
- C:\Windows\System\orVNYBe.exe
  C:\Windows\System\orVNYBe.exe
  2⤵
  PID:7696
- C:\Windows\System\LeepLiZ.exe
  C:\Windows\System\LeepLiZ.exe
  2⤵
  PID:7764
- C:\Windows\System\MQfLLYW.exe
  C:\Windows\System\MQfLLYW.exe
  2⤵
  PID:7828
- C:\Windows\System\IjTKGxw.exe
  C:\Windows\System\IjTKGxw.exe
  2⤵
  PID:7896
- C:\Windows\System\qndJirM.exe
  C:\Windows\System\qndJirM.exe
  2⤵
  PID:7960
- C:\Windows\System\oHvyvbG.exe
  C:\Windows\System\oHvyvbG.exe
  2⤵
  PID:7776
- C:\Windows\System\lyhuWDz.exe
  C:\Windows\System\lyhuWDz.exe
  2⤵
  PID:7676
- C:\Windows\System\gRQZWaA.exe
  C:\Windows\System\gRQZWaA.exe
  2⤵
  PID:7808
- C:\Windows\System\Cxzgmrv.exe
  C:\Windows\System\Cxzgmrv.exe
  2⤵
  PID:7876
- C:\Windows\System\dxpQsHH.exe
  C:\Windows\System\dxpQsHH.exe
  2⤵
  PID:8060
- C:\Windows\System\FTPEAqb.exe
  C:\Windows\System\FTPEAqb.exe
  2⤵
  PID:8156
- C:\Windows\System\dtlYmHs.exe
  C:\Windows\System\dtlYmHs.exe
  2⤵
  PID:7228
- C:\Windows\System\jEAAozr.exe
  C:\Windows\System\jEAAozr.exe
  2⤵
  PID:7332
- C:\Windows\System\KquKCEP.exe
  C:\Windows\System\KquKCEP.exe
  2⤵
  PID:7364
- C:\Windows\System\mTeMDgP.exe
  C:\Windows\System\mTeMDgP.exe
  2⤵
  PID:7388
- C:\Windows\System\ybRqOcX.exe
  C:\Windows\System\ybRqOcX.exe
  2⤵
  PID:7972
- C:\Windows\System\fENPozj.exe
  C:\Windows\System\fENPozj.exe
  2⤵
  PID:7416
- C:\Windows\System\vlJCECg.exe
  C:\Windows\System\vlJCECg.exe
  2⤵
  PID:7464
- C:\Windows\System\RKPpRot.exe
  C:\Windows\System\RKPpRot.exe
  2⤵
  PID:7580
- C:\Windows\System\PzyaaEi.exe
  C:\Windows\System\PzyaaEi.exe
  2⤵
  PID:8144
- C:\Windows\System\pSATQQI.exe
  C:\Windows\System\pSATQQI.exe
  2⤵
  PID:7196
- C:\Windows\System\OwVhShp.exe
  C:\Windows\System\OwVhShp.exe
  2⤵
  PID:7296
- C:\Windows\System\JJaNNWo.exe
  C:\Windows\System\JJaNNWo.exe
  2⤵
  PID:7596
- C:\Windows\System\WHqqHRj.exe
  C:\Windows\System\WHqqHRj.exe
  2⤵
  PID:7512
- C:\Windows\System\dgvQeDl.exe
  C:\Windows\System\dgvQeDl.exe
  2⤵
  PID:7616
- C:\Windows\System\QOhAodj.exe
  C:\Windows\System\QOhAodj.exe
  2⤵
  PID:7824
- C:\Windows\System\CLQKfpx.exe
  C:\Windows\System\CLQKfpx.exe
  2⤵
  PID:7956
- C:\Windows\System\GwovWTT.exe
  C:\Windows\System\GwovWTT.exe
  2⤵
  PID:8056
- C:\Windows\System\QFoWXTX.exe
  C:\Windows\System\QFoWXTX.exe
  2⤵
  PID:7700
- C:\Windows\System\VdRNACm.exe
  C:\Windows\System\VdRNACm.exe
  2⤵
  PID:6916
- C:\Windows\System\RNAlSAO.exe
  C:\Windows\System\RNAlSAO.exe
  2⤵
  PID:1592
- C:\Windows\System\pzZLECf.exe
  C:\Windows\System\pzZLECf.exe
  2⤵
  PID:7848
- C:\Windows\System\rVImkBt.exe
  C:\Windows\System\rVImkBt.exe
  2⤵
  PID:7264
- C:\Windows\System\WPVZYJz.exe
  C:\Windows\System\WPVZYJz.exe
  2⤵
  PID:6604
- C:\Windows\System\gyKvfmQ.exe
  C:\Windows\System\gyKvfmQ.exe
  2⤵
  PID:7732
- C:\Windows\System\cPDbUsG.exe
  C:\Windows\System\cPDbUsG.exe
  2⤵
  PID:8128
- C:\Windows\System\QoEJrLf.exe
  C:\Windows\System\QoEJrLf.exe
  2⤵
  PID:7384
- C:\Windows\System\tsQweMl.exe
  C:\Windows\System\tsQweMl.exe
  2⤵
  PID:8076
- C:\Windows\System\PMAwtue.exe
  C:\Windows\System\PMAwtue.exe
  2⤵
  PID:8112
- C:\Windows\System\ewyWIDZ.exe
  C:\Windows\System\ewyWIDZ.exe
  2⤵
  PID:7452
- C:\Windows\System\nUBHGKM.exe
  C:\Windows\System\nUBHGKM.exe
  2⤵
  PID:8220
- C:\Windows\System\fRWrZvg.exe
  C:\Windows\System\fRWrZvg.exe
  2⤵
  PID:8236
- C:\Windows\System\kJBNDRZ.exe
  C:\Windows\System\kJBNDRZ.exe
  2⤵
  PID:8252
- C:\Windows\System\EnBuUFu.exe
  C:\Windows\System\EnBuUFu.exe
  2⤵
  PID:8272
- C:\Windows\System\LxodScs.exe
  C:\Windows\System\LxodScs.exe
  2⤵
  PID:8288
- C:\Windows\System\iXoLrop.exe
  C:\Windows\System\iXoLrop.exe
  2⤵
  PID:8304
- C:\Windows\System\VgrcKee.exe
  C:\Windows\System\VgrcKee.exe
  2⤵
  PID:8320
- C:\Windows\System\rVGfCtT.exe
  C:\Windows\System\rVGfCtT.exe
  2⤵
  PID:8336
- C:\Windows\System\bnMmRRX.exe
  C:\Windows\System\bnMmRRX.exe
  2⤵
  PID:8352
- C:\Windows\System\VnuxupG.exe
  C:\Windows\System\VnuxupG.exe
  2⤵
  PID:8376
- C:\Windows\System\YpLycSQ.exe
  C:\Windows\System\YpLycSQ.exe
  2⤵
  PID:8392
- C:\Windows\System\cSREcrZ.exe
  C:\Windows\System\cSREcrZ.exe
  2⤵
  PID:8408
- C:\Windows\System\USkzNFy.exe
  C:\Windows\System\USkzNFy.exe
  2⤵
  PID:8424
- C:\Windows\System\gkWdCdl.exe
  C:\Windows\System\gkWdCdl.exe
  2⤵
  PID:8440
- C:\Windows\System\SDEzLvE.exe
  C:\Windows\System\SDEzLvE.exe
  2⤵
  PID:8456
- C:\Windows\System\bFrQWfN.exe
  C:\Windows\System\bFrQWfN.exe
  2⤵
  PID:8472
- C:\Windows\System\KfwtJlO.exe
  C:\Windows\System\KfwtJlO.exe
  2⤵
  PID:8488
- C:\Windows\System\WYaSAJu.exe
  C:\Windows\System\WYaSAJu.exe
  2⤵
  PID:8504
- C:\Windows\System\TuwIaku.exe
  C:\Windows\System\TuwIaku.exe
  2⤵
  PID:8520
- C:\Windows\System\WIdWKez.exe
  C:\Windows\System\WIdWKez.exe
  2⤵
  PID:8536
- C:\Windows\System\YASuJvH.exe
  C:\Windows\System\YASuJvH.exe
  2⤵
  PID:8552
- C:\Windows\System\wIEjKnW.exe
  C:\Windows\System\wIEjKnW.exe
  2⤵
  PID:8568
- C:\Windows\System\oIApDCF.exe
  C:\Windows\System\oIApDCF.exe
  2⤵
  PID:8584
- C:\Windows\System\gHZHezY.exe
  C:\Windows\System\gHZHezY.exe
  2⤵
  PID:8600
- C:\Windows\System\eMlgKqM.exe
  C:\Windows\System\eMlgKqM.exe
  2⤵
  PID:8616
- C:\Windows\System\OQpvmGx.exe
  C:\Windows\System\OQpvmGx.exe
  2⤵
  PID:8632
- C:\Windows\System\qNNRUSZ.exe
  C:\Windows\System\qNNRUSZ.exe
  2⤵
  PID:8648
- C:\Windows\System\wdUlNzZ.exe
  C:\Windows\System\wdUlNzZ.exe
  2⤵
  PID:8664
- C:\Windows\System\HlXegTZ.exe
  C:\Windows\System\HlXegTZ.exe
  2⤵
  PID:8680
- C:\Windows\System\tGbsYfc.exe
  C:\Windows\System\tGbsYfc.exe
  2⤵
  PID:8784
- C:\Windows\System\ylEwSls.exe
  C:\Windows\System\ylEwSls.exe
  2⤵
  PID:8804
- C:\Windows\System\ZajfkKn.exe
  C:\Windows\System\ZajfkKn.exe
  2⤵
  PID:8820
- C:\Windows\System\KwqdFXq.exe
  C:\Windows\System\KwqdFXq.exe
  2⤵
  PID:8836
- C:\Windows\System\FnkFwNx.exe
  C:\Windows\System\FnkFwNx.exe
  2⤵
  PID:8852
- C:\Windows\System\RHaDGZx.exe
  C:\Windows\System\RHaDGZx.exe
  2⤵
  PID:8868
- C:\Windows\System\VATovIr.exe
  C:\Windows\System\VATovIr.exe
  2⤵
  PID:8884
- C:\Windows\System\hnhMBRx.exe
  C:\Windows\System\hnhMBRx.exe
  2⤵
  PID:8900
- C:\Windows\System\INIyrfQ.exe
  C:\Windows\System\INIyrfQ.exe
  2⤵
  PID:8916
- C:\Windows\System\mIMgUfZ.exe
  C:\Windows\System\mIMgUfZ.exe
  2⤵
  PID:8932
- C:\Windows\System\TxMPYQj.exe
  C:\Windows\System\TxMPYQj.exe
  2⤵
  PID:8948
- C:\Windows\System\OMIplOn.exe
  C:\Windows\System\OMIplOn.exe
  2⤵
  PID:8972
- C:\Windows\System\AgxIhYt.exe
  C:\Windows\System\AgxIhYt.exe
  2⤵
  PID:8988
- C:\Windows\System\cXpMFbp.exe
  C:\Windows\System\cXpMFbp.exe
  2⤵
  PID:9004
- C:\Windows\System\KlYeyeb.exe
  C:\Windows\System\KlYeyeb.exe
  2⤵
  PID:9028
- C:\Windows\System\lVGjnlE.exe
  C:\Windows\System\lVGjnlE.exe
  2⤵
  PID:9044
- C:\Windows\System\sMcymYk.exe
  C:\Windows\System\sMcymYk.exe
  2⤵
  PID:9060
- C:\Windows\System\sLZLVjI.exe
  C:\Windows\System\sLZLVjI.exe
  2⤵
  PID:9076
- C:\Windows\System\mJiYXkO.exe
  C:\Windows\System\mJiYXkO.exe
  2⤵
  PID:9096
- C:\Windows\System\mOXwafa.exe
  C:\Windows\System\mOXwafa.exe
  2⤵
  PID:9116
- C:\Windows\System\crKGLuC.exe
  C:\Windows\System\crKGLuC.exe
  2⤵
  PID:7532
- C:\Windows\System\nOWlkkw.exe
  C:\Windows\System\nOWlkkw.exe
  2⤵
  PID:8020
- C:\Windows\System\TWCnYkd.exe
  C:\Windows\System\TWCnYkd.exe
  2⤵
  PID:8212
- C:\Windows\System\sabJuLd.exe
  C:\Windows\System\sabJuLd.exe
  2⤵
  PID:7436
- C:\Windows\System\pXrZBhJ.exe
  C:\Windows\System\pXrZBhJ.exe
  2⤵
  PID:8072
- C:\Windows\System\ZwtHXgp.exe
  C:\Windows\System\ZwtHXgp.exe
  2⤵
  PID:8124
- C:\Windows\System\pawAXwr.exe
  C:\Windows\System\pawAXwr.exe
  2⤵
  PID:8140
- C:\Windows\System\wAcMLcU.exe
  C:\Windows\System\wAcMLcU.exe
  2⤵
  PID:8248
- C:\Windows\System\NvccxoC.exe
  C:\Windows\System\NvccxoC.exe
  2⤵
  PID:8344
- C:\Windows\System\CNlpZPR.exe
  C:\Windows\System\CNlpZPR.exe
  2⤵
  PID:8388
- C:\Windows\System\AbASDsB.exe
  C:\Windows\System\AbASDsB.exe
  2⤵
  PID:8452
- C:\Windows\System\AbRlBAl.exe
  C:\Windows\System\AbRlBAl.exe
  2⤵
  PID:8516
- C:\Windows\System\pwwCTfX.exe
  C:\Windows\System\pwwCTfX.exe
  2⤵
  PID:8580
- C:\Windows\System\dKSgIZC.exe
  C:\Windows\System\dKSgIZC.exe
  2⤵
  PID:8612
- C:\Windows\System\vTGBfai.exe
  C:\Windows\System\vTGBfai.exe
  2⤵
  PID:8268
- C:\Windows\System\xiiVwve.exe
  C:\Windows\System\xiiVwve.exe
  2⤵
  PID:8560
- C:\Windows\System\qLwHtiG.exe
  C:\Windows\System\qLwHtiG.exe
  2⤵
  PID:8596
- C:\Windows\System\IJDzlav.exe
  C:\Windows\System\IJDzlav.exe
  2⤵
  PID:8400
- C:\Windows\System\FRBQkvU.exe
  C:\Windows\System\FRBQkvU.exe
  2⤵
  PID:8468
- C:\Windows\System\FSmaBNh.exe
  C:\Windows\System\FSmaBNh.exe
  2⤵
  PID:8656
- C:\Windows\System\SuMMCsx.exe
  C:\Windows\System\SuMMCsx.exe
  2⤵
  PID:8696
- C:\Windows\System\gqhUUWh.exe
  C:\Windows\System\gqhUUWh.exe
  2⤵
  PID:8716
- C:\Windows\System\jbjXUmX.exe
  C:\Windows\System\jbjXUmX.exe
  2⤵
  PID:8760
- C:\Windows\System\Njvnyaw.exe
  C:\Windows\System\Njvnyaw.exe
  2⤵
  PID:8832
- C:\Windows\System\IZjbQnI.exe
  C:\Windows\System\IZjbQnI.exe
  2⤵
  PID:8776
- C:\Windows\System\sJluSgP.exe
  C:\Windows\System\sJluSgP.exe
  2⤵
  PID:8844
- C:\Windows\System\eiDjoQz.exe
  C:\Windows\System\eiDjoQz.exe
  2⤵
  PID:8896
- C:\Windows\System\mOCtYzj.exe
  C:\Windows\System\mOCtYzj.exe
  2⤵
  PID:8908
- C:\Windows\System\dqdGquR.exe
  C:\Windows\System\dqdGquR.exe
  2⤵
  PID:8260
- C:\Windows\System\fsVKelX.exe
  C:\Windows\System\fsVKelX.exe
  2⤵
  PID:9036
- C:\Windows\System\nKNGwKO.exe
  C:\Windows\System\nKNGwKO.exe
  2⤵
  PID:9104
- C:\Windows\System\FgybHFe.exe
  C:\Windows\System\FgybHFe.exe
  2⤵
  PID:8176
- C:\Windows\System\pBGfuQJ.exe
  C:\Windows\System\pBGfuQJ.exe
  2⤵
  PID:9128
- C:\Windows\System\OlWKTwZ.exe
  C:\Windows\System\OlWKTwZ.exe
  2⤵
  PID:9180
- C:\Windows\System\RFZMWrM.exe
  C:\Windows\System\RFZMWrM.exe
  2⤵
  PID:8980
- C:\Windows\System\RTCRSnb.exe
  C:\Windows\System\RTCRSnb.exe
  2⤵
  PID:9024
- C:\Windows\System\dpUUtmg.exe
  C:\Windows\System\dpUUtmg.exe
  2⤵
  PID:9092
- C:\Windows\System\bkBIYwu.exe
  C:\Windows\System\bkBIYwu.exe
  2⤵
  PID:9152
- C:\Windows\System\qinGctr.exe
  C:\Windows\System\qinGctr.exe
  2⤵
  PID:9196
- C:\Windows\System\mUWFRDt.exe
  C:\Windows\System\mUWFRDt.exe
  2⤵
  PID:9208
- C:\Windows\System\iuZEgsd.exe
  C:\Windows\System\iuZEgsd.exe
  2⤵
  PID:8200
- C:\Windows\System\FLZgHmY.exe
  C:\Windows\System\FLZgHmY.exe
  2⤵
  PID:9124
- C:\Windows\System\vChwIyd.exe
  C:\Windows\System\vChwIyd.exe
  2⤵
  PID:8384
- C:\Windows\System\qMXRmVr.exe
  C:\Windows\System\qMXRmVr.exe
  2⤵
  PID:8640
- C:\Windows\System\JDTKtNH.exe
  C:\Windows\System\JDTKtNH.exe
  2⤵
  PID:7716
- C:\Windows\System\jLcNvog.exe
  C:\Windows\System\jLcNvog.exe
  2⤵
  PID:8548
- C:\Windows\System\ujjnNdi.exe
  C:\Windows\System\ujjnNdi.exe
  2⤵
  PID:8676
- C:\Windows\System\NWyRdRz.exe
  C:\Windows\System\NWyRdRz.exe
  2⤵
  PID:8300
- C:\Windows\System\GtNovur.exe
  C:\Windows\System\GtNovur.exe
  2⤵
  PID:8464
- C:\Windows\System\LgQoQYD.exe
  C:\Windows\System\LgQoQYD.exe
  2⤵
  PID:8592
- C:\Windows\System\veppeyh.exe
  C:\Windows\System\veppeyh.exe
  2⤵
  PID:8724
- C:\Windows\System\HKcNuiD.exe
  C:\Windows\System\HKcNuiD.exe
  2⤵
  PID:8740
- C:\Windows\System\xfetJjr.exe
  C:\Windows\System\xfetJjr.exe
  2⤵
  PID:8752
- C:\Windows\System\kvqzHZR.exe
  C:\Windows\System\kvqzHZR.exe
  2⤵
  PID:8796
- C:\Windows\System\evhjdCn.exe
  C:\Windows\System\evhjdCn.exe
  2⤵
  PID:8944
- C:\Windows\System\fdvlUGV.exe
  C:\Windows\System\fdvlUGV.exe
  2⤵
  PID:8880
- C:\Windows\System\nlTMyxB.exe
  C:\Windows\System\nlTMyxB.exe
  2⤵
  PID:9072
- C:\Windows\System\kxwYoky.exe
  C:\Windows\System\kxwYoky.exe
  2⤵
  PID:9112
- C:\Windows\System\HROhbte.exe
  C:\Windows\System\HROhbte.exe
  2⤵
  PID:8208
- C:\Windows\System\ixHreFd.exe
  C:\Windows\System\ixHreFd.exe
  2⤵
  PID:9016
- C:\Windows\System\sHLTWrh.exe
  C:\Windows\System\sHLTWrh.exe
  2⤵
  PID:9164
- C:\Windows\System\uToIvRT.exe
  C:\Windows\System\uToIvRT.exe
  2⤵
  PID:9136
- C:\Windows\System\mkMKVRh.exe
  C:\Windows\System\mkMKVRh.exe
  2⤵
  PID:9172
- C:\Windows\System\nuysaDa.exe
  C:\Windows\System\nuysaDa.exe
  2⤵
  PID:7744
- C:\Windows\System\eQRxlKq.exe
  C:\Windows\System\eQRxlKq.exe
  2⤵
  PID:8528
- C:\Windows\System\xqyjEqP.exe
  C:\Windows\System\xqyjEqP.exe
  2⤵
  PID:8628
- C:\Windows\System\bOLIjtJ.exe
  C:\Windows\System\bOLIjtJ.exe
  2⤵
  PID:8928
- C:\Windows\System\uHLSsLv.exe
  C:\Windows\System\uHLSsLv.exe
  2⤵
  PID:8608
- C:\Windows\System\QrJAjYX.exe
  C:\Windows\System\QrJAjYX.exe
  2⤵
  PID:8996
- C:\Windows\System\RZLKpND.exe
  C:\Windows\System\RZLKpND.exe
  2⤵
  PID:8732
- C:\Windows\System\lBRmlcK.exe
  C:\Windows\System\lBRmlcK.exe
  2⤵
  PID:8420
- C:\Windows\System\cFdlKMe.exe
  C:\Windows\System\cFdlKMe.exe
  2⤵
  PID:7632
- C:\Windows\System\FDiqlag.exe
  C:\Windows\System\FDiqlag.exe
  2⤵
  PID:8432
- C:\Windows\System\iVKhOHa.exe
  C:\Windows\System\iVKhOHa.exe
  2⤵
  PID:9220
- C:\Windows\System\qJVQHpa.exe
  C:\Windows\System\qJVQHpa.exe
  2⤵
  PID:9236
- C:\Windows\System\Nicqyrj.exe
  C:\Windows\System\Nicqyrj.exe
  2⤵
  PID:9260
- C:\Windows\System\lGMABDQ.exe
  C:\Windows\System\lGMABDQ.exe
  2⤵
  PID:9276
- C:\Windows\System\bATjTwl.exe
  C:\Windows\System\bATjTwl.exe
  2⤵
  PID:9296
- C:\Windows\System\dmURKoL.exe
  C:\Windows\System\dmURKoL.exe
  2⤵
  PID:9312
- C:\Windows\System\dPcbfkW.exe
  C:\Windows\System\dPcbfkW.exe
  2⤵
  PID:9332
- C:\Windows\System\pdolbAd.exe
  C:\Windows\System\pdolbAd.exe
  2⤵
  PID:9348
- C:\Windows\System\YXIPKux.exe
  C:\Windows\System\YXIPKux.exe
  2⤵
  PID:9364
- C:\Windows\System\VvFyVhd.exe
  C:\Windows\System\VvFyVhd.exe
  2⤵
  PID:9384
- C:\Windows\System\sbuEUZV.exe
  C:\Windows\System\sbuEUZV.exe
  2⤵
  PID:9400
- C:\Windows\System\trEZrdz.exe
  C:\Windows\System\trEZrdz.exe
  2⤵
  PID:9424
- C:\Windows\System\yHIXHzP.exe
  C:\Windows\System\yHIXHzP.exe
  2⤵
  PID:9440
- C:\Windows\System\ohfuExA.exe
  C:\Windows\System\ohfuExA.exe
  2⤵
  PID:9456
- C:\Windows\System\DGDUdAs.exe
  C:\Windows\System\DGDUdAs.exe
  2⤵
  PID:9472
- C:\Windows\System\nwaoyTX.exe
  C:\Windows\System\nwaoyTX.exe
  2⤵
  PID:9488
- C:\Windows\System\VltnOoW.exe
  C:\Windows\System\VltnOoW.exe
  2⤵
  PID:9504
- C:\Windows\System\zHdnKFT.exe
  C:\Windows\System\zHdnKFT.exe
  2⤵
  PID:9520
- C:\Windows\System\xexhJZI.exe
  C:\Windows\System\xexhJZI.exe
  2⤵
  PID:9536
- C:\Windows\System\iWwPrsz.exe
  C:\Windows\System\iWwPrsz.exe
  2⤵
  PID:9552
- C:\Windows\System\qsmViAo.exe
  C:\Windows\System\qsmViAo.exe
  2⤵
  PID:9568
- C:\Windows\System\wrUOIuX.exe
  C:\Windows\System\wrUOIuX.exe
  2⤵
  PID:9584
- C:\Windows\System\sIvJDSx.exe
  C:\Windows\System\sIvJDSx.exe
  2⤵
  PID:9600
- C:\Windows\System\szYhrNc.exe
  C:\Windows\System\szYhrNc.exe
  2⤵
  PID:9616
- C:\Windows\System\XqdvbzY.exe
  C:\Windows\System\XqdvbzY.exe
  2⤵
  PID:9636
- C:\Windows\System\zxBWfNn.exe
  C:\Windows\System\zxBWfNn.exe
  2⤵
  PID:9652
- C:\Windows\System\jbwreKs.exe
  C:\Windows\System\jbwreKs.exe
  2⤵
  PID:9668
- C:\Windows\System\qRkRSCp.exe
  C:\Windows\System\qRkRSCp.exe
  2⤵
  PID:9684
- C:\Windows\System\yGniHvh.exe
  C:\Windows\System\yGniHvh.exe
  2⤵
  PID:9704
- C:\Windows\System\yFfHRDi.exe
  C:\Windows\System\yFfHRDi.exe
  2⤵
  PID:9720
- C:\Windows\System\mXGrBRj.exe
  C:\Windows\System\mXGrBRj.exe
  2⤵
  PID:9736
- C:\Windows\System\HlXOqxq.exe
  C:\Windows\System\HlXOqxq.exe
  2⤵
  PID:9752
- C:\Windows\System\VlDhldT.exe
  C:\Windows\System\VlDhldT.exe
  2⤵
  PID:9768
- C:\Windows\System\BdOyZJz.exe
  C:\Windows\System\BdOyZJz.exe
  2⤵
  PID:9784
- C:\Windows\System\RIRNGCO.exe
  C:\Windows\System\RIRNGCO.exe
  2⤵
  PID:9800
- C:\Windows\System\BffwzLN.exe
  C:\Windows\System\BffwzLN.exe
  2⤵
  PID:9816
- C:\Windows\System\WInFVEp.exe
  C:\Windows\System\WInFVEp.exe
  2⤵
  PID:9832
- C:\Windows\System\FgiItDh.exe
  C:\Windows\System\FgiItDh.exe
  2⤵
  PID:9848
- C:\Windows\System\fexcbyO.exe
  C:\Windows\System\fexcbyO.exe
  2⤵
  PID:9864
- C:\Windows\System\MUgEhBi.exe
  C:\Windows\System\MUgEhBi.exe
  2⤵
  PID:9880
- C:\Windows\System\yNQfcQp.exe
  C:\Windows\System\yNQfcQp.exe
  2⤵
  PID:9896
- C:\Windows\System\FvqNlhF.exe
  C:\Windows\System\FvqNlhF.exe
  2⤵
  PID:9912
- C:\Windows\System\nORkiWa.exe
  C:\Windows\System\nORkiWa.exe
  2⤵
  PID:9928
- C:\Windows\System\xkgccwA.exe
  C:\Windows\System\xkgccwA.exe
  2⤵
  PID:9944
- C:\Windows\System\StJebBb.exe
  C:\Windows\System\StJebBb.exe
  2⤵
  PID:9960
- C:\Windows\System\ZWDIJXo.exe
  C:\Windows\System\ZWDIJXo.exe
  2⤵
  PID:9976
- C:\Windows\System\MGiOHWF.exe
  C:\Windows\System\MGiOHWF.exe
  2⤵
  PID:9992
- C:\Windows\System\vyHFhlu.exe
  C:\Windows\System\vyHFhlu.exe
  2⤵
  PID:10008
- C:\Windows\System\ugRPLsP.exe
  C:\Windows\System\ugRPLsP.exe
  2⤵
  PID:10024
- C:\Windows\System\AAsMVMr.exe
  C:\Windows\System\AAsMVMr.exe
  2⤵
  PID:10040
- C:\Windows\System\giOSnXP.exe
  C:\Windows\System\giOSnXP.exe
  2⤵
  PID:10056
- C:\Windows\System\ckOrEjY.exe
  C:\Windows\System\ckOrEjY.exe
  2⤵
  PID:10076
- C:\Windows\System\nefUpcv.exe
  C:\Windows\System\nefUpcv.exe
  2⤵
  PID:10092
- C:\Windows\System\kkAHTZU.exe
  C:\Windows\System\kkAHTZU.exe
  2⤵
  PID:10108
- C:\Windows\System\jZWHEor.exe
  C:\Windows\System\jZWHEor.exe
  2⤵
  PID:10128
- C:\Windows\System\ICvuWxN.exe
  C:\Windows\System\ICvuWxN.exe
  2⤵
  PID:10144
- C:\Windows\System\QbRKXDK.exe
  C:\Windows\System\QbRKXDK.exe
  2⤵
  PID:10160
- C:\Windows\System\PBdkPKX.exe
  C:\Windows\System\PBdkPKX.exe
  2⤵
  PID:10180
- C:\Windows\System\FVKsiVh.exe
  C:\Windows\System\FVKsiVh.exe
  2⤵
  PID:10196
- C:\Windows\System\ujQLyor.exe
  C:\Windows\System\ujQLyor.exe
  2⤵
  PID:10212
- C:\Windows\System\DEcnUnX.exe
  C:\Windows\System\DEcnUnX.exe
  2⤵
  PID:10228
- C:\Windows\System\ruBxaip.exe
  C:\Windows\System\ruBxaip.exe
  2⤵
  PID:8748
- C:\Windows\System\EhxCroZ.exe
  C:\Windows\System\EhxCroZ.exe
  2⤵
  PID:9184
- C:\Windows\System\atZIkaX.exe
  C:\Windows\System\atZIkaX.exe
  2⤵
  PID:9244
- C:\Windows\System\LGVjWyu.exe
  C:\Windows\System\LGVjWyu.exe
  2⤵
  PID:9288
- C:\Windows\System\IOWmpzo.exe
  C:\Windows\System\IOWmpzo.exe
  2⤵
  PID:9056
- C:\Windows\System\vKZFCJG.exe
  C:\Windows\System\vKZFCJG.exe
  2⤵
  PID:8672
- C:\Windows\System\gcAKUnz.exe
  C:\Windows\System\gcAKUnz.exe
  2⤵
  PID:8812
- C:\Windows\System\EbAxwwK.exe
  C:\Windows\System\EbAxwwK.exe
  2⤵
  PID:8332
- C:\Windows\System\JSzjrpo.exe
  C:\Windows\System\JSzjrpo.exe
  2⤵
  PID:9272
- C:\Windows\System\JnlpvKE.exe
  C:\Windows\System\JnlpvKE.exe
  2⤵
  PID:9344
- C:\Windows\System\edqQxov.exe
  C:\Windows\System\edqQxov.exe
  2⤵
  PID:9416
- C:\Windows\System\eQjRyYz.exe
  C:\Windows\System\eQjRyYz.exe
  2⤵
  PID:9484
- C:\Windows\System\smxAXwI.exe
  C:\Windows\System\smxAXwI.exe
  2⤵
  PID:9548
- C:\Windows\System\UtxHJYp.exe
  C:\Windows\System\UtxHJYp.exe
  2⤵
  PID:9612
- C:\Windows\System\DaYasyH.exe
  C:\Windows\System\DaYasyH.exe
  2⤵
  PID:9648
- C:\Windows\System\bGqZzJS.exe
  C:\Windows\System\bGqZzJS.exe
  2⤵
  PID:9596
- C:\Windows\System\uUVyIoQ.exe
  C:\Windows\System\uUVyIoQ.exe
  2⤵
  PID:9664
- C:\Windows\System\vQyEZSZ.exe
  C:\Windows\System\vQyEZSZ.exe
  2⤵
  PID:9732
- C:\Windows\System\gPnejSS.exe
  C:\Windows\System\gPnejSS.exe
  2⤵
  PID:9764
- C:\Windows\System\zZAeOfZ.exe
  C:\Windows\System\zZAeOfZ.exe
  2⤵
  PID:9824
- C:\Windows\System\rgTusHK.exe
  C:\Windows\System\rgTusHK.exe
  2⤵
  PID:9808
- C:\Windows\System\ivLaqUt.exe
  C:\Windows\System\ivLaqUt.exe
  2⤵
  PID:9776
- C:\Windows\System\hNPoemE.exe
  C:\Windows\System\hNPoemE.exe
  2⤵
  PID:9888
- C:\Windows\System\harboLD.exe
  C:\Windows\System\harboLD.exe
  2⤵
  PID:9952
- C:\Windows\System\zlhLvmM.exe
  C:\Windows\System\zlhLvmM.exe
  2⤵
  PID:9840
- C:\Windows\System\BCdeXPO.exe
  C:\Windows\System\BCdeXPO.exe
  2⤵
  PID:9872
- C:\Windows\System\ONRIQJg.exe
  C:\Windows\System\ONRIQJg.exe
  2⤵
  PID:10000
- C:\Windows\System\NXyVmRz.exe
  C:\Windows\System\NXyVmRz.exe
  2⤵
  PID:10120
- C:\Windows\System\ojxoCbN.exe
  C:\Windows\System\ojxoCbN.exe
  2⤵
  PID:10124
- C:\Windows\System\fvjKhLg.exe
  C:\Windows\System\fvjKhLg.exe
  2⤵
  PID:10032
- C:\Windows\System\tkYyUSc.exe
  C:\Windows\System\tkYyUSc.exe
  2⤵
  PID:10156
- C:\Windows\System\AvQjujW.exe
  C:\Windows\System\AvQjujW.exe
  2⤵
  PID:10100
- C:\Windows\System\uOSJWHq.exe
  C:\Windows\System\uOSJWHq.exe
  2⤵
  PID:10176
- C:\Windows\System\RUecPgQ.exe
  C:\Windows\System\RUecPgQ.exe
  2⤵
  PID:10224
- C:\Windows\System\BVohmYX.exe
  C:\Windows\System\BVohmYX.exe
  2⤵
  PID:9284
- C:\Windows\System\GgLrPPZ.exe
  C:\Windows\System\GgLrPPZ.exe
  2⤵
  PID:10204
- C:\Windows\System\KbUozhb.exe
  C:\Windows\System\KbUozhb.exe
  2⤵
  PID:8532
- C:\Windows\System\uUdGGxI.exe
  C:\Windows\System\uUdGGxI.exe
  2⤵
  PID:9328
- C:\Windows\System\fFvdzBl.exe
  C:\Windows\System\fFvdzBl.exe
  2⤵
  PID:9396
- C:\Windows\System\ZPKmJoJ.exe
  C:\Windows\System\ZPKmJoJ.exe
  2⤵
  PID:9468
- C:\Windows\System\NCvDoTg.exe
  C:\Windows\System\NCvDoTg.exe
  2⤵
  PID:9140
- C:\Windows\System\YllkSFQ.exe
  C:\Windows\System\YllkSFQ.exe
  2⤵
  PID:8772
- C:\Windows\System\zLtXiiU.exe
  C:\Windows\System\zLtXiiU.exe
  2⤵
  PID:9012
- C:\Windows\System\CjijwEr.exe
  C:\Windows\System\CjijwEr.exe
  2⤵
  PID:8692
- C:\Windows\System\yGEIiku.exe
  C:\Windows\System\yGEIiku.exe
  2⤵
  PID:9308
- C:\Windows\System\XuJJlgU.exe
  C:\Windows\System\XuJJlgU.exe
  2⤵
  PID:9268
- C:\Windows\System\BHHXsmk.exe
  C:\Windows\System\BHHXsmk.exe
  2⤵
  PID:9580
- C:\Windows\System\mSUBTNv.exe
  C:\Windows\System\mSUBTNv.exe
  2⤵
  PID:9592
- C:\Windows\System\KRMztPg.exe
  C:\Windows\System\KRMztPg.exe
  2⤵
  PID:9748
- C:\Windows\System\oRKyUub.exe
  C:\Windows\System\oRKyUub.exe
  2⤵
  PID:9920
- C:\Windows\System\ZQhUDjL.exe
  C:\Windows\System\ZQhUDjL.exe
  2⤵
  PID:10088
- C:\Windows\System\UbhKIbQ.exe
  C:\Windows\System\UbhKIbQ.exe
  2⤵
  PID:10136
- C:\Windows\System\EeCXcwT.exe
  C:\Windows\System\EeCXcwT.exe
  2⤵
  PID:10172
- C:\Windows\System\bPWOLYw.exe
  C:\Windows\System\bPWOLYw.exe
  2⤵
  PID:9324
- C:\Windows\System\EENEPcF.exe
  C:\Windows\System\EENEPcF.exe
  2⤵
  PID:9436
- C:\Windows\System\EsWFxbd.exe
  C:\Windows\System\EsWFxbd.exe
  2⤵
  PID:9204
- C:\Windows\System\vUzFUgs.exe
  C:\Windows\System\vUzFUgs.exe
  2⤵
  PID:9608
- C:\Windows\System\qvheTyn.exe
  C:\Windows\System\qvheTyn.exe
  2⤵
  PID:9972
- C:\Windows\System\QtfwWWR.exe
  C:\Windows\System\QtfwWWR.exe
  2⤵
  PID:9084
- C:\Windows\System\ZwmLCCh.exe
  C:\Windows\System\ZwmLCCh.exe
  2⤵
  PID:9680
- C:\Windows\System\tbvrMZE.exe
  C:\Windows\System\tbvrMZE.exe
  2⤵
  PID:9716
- C:\Windows\System\xonYblQ.exe
  C:\Windows\System\xonYblQ.exe
  2⤵
  PID:9660
- C:\Windows\System\wwahXsl.exe
  C:\Windows\System\wwahXsl.exe
  2⤵
  PID:10244
- C:\Windows\System\MqydUhl.exe
  C:\Windows\System\MqydUhl.exe
  2⤵
  PID:10260
- C:\Windows\System\OOqiqoV.exe
  C:\Windows\System\OOqiqoV.exe
  2⤵
  PID:10276
- C:\Windows\System\DYyvpZr.exe
  C:\Windows\System\DYyvpZr.exe
  2⤵
  PID:10292
- C:\Windows\System\lvfxmZi.exe
  C:\Windows\System\lvfxmZi.exe
  2⤵
  PID:10308
- C:\Windows\System\AvueNrL.exe
  C:\Windows\System\AvueNrL.exe
  2⤵
  PID:10324
- C:\Windows\System\kxfontB.exe
  C:\Windows\System\kxfontB.exe
  2⤵
  PID:10340
- C:\Windows\System\fWRtFug.exe
  C:\Windows\System\fWRtFug.exe
  2⤵
  PID:10356
- C:\Windows\System\SzkrwQI.exe
  C:\Windows\System\SzkrwQI.exe
  2⤵
  PID:10372
- C:\Windows\System\oONvaUt.exe
  C:\Windows\System\oONvaUt.exe
  2⤵
  PID:10388
- C:\Windows\System\FmBzUsF.exe
  C:\Windows\System\FmBzUsF.exe
  2⤵
  PID:10404
- C:\Windows\System\khbKAhZ.exe
  C:\Windows\System\khbKAhZ.exe
  2⤵
  PID:10508
- C:\Windows\System\kQmVWzi.exe
  C:\Windows\System\kQmVWzi.exe
  2⤵
  PID:10572
- C:\Windows\System\YbYUSdB.exe
  C:\Windows\System\YbYUSdB.exe
  2⤵
  PID:10588
- C:\Windows\System\WRVFCMt.exe
  C:\Windows\System\WRVFCMt.exe
  2⤵
  PID:10604
- C:\Windows\System\VQFlNxi.exe
  C:\Windows\System\VQFlNxi.exe
  2⤵
  PID:10624
- C:\Windows\System\oxEazvW.exe
  C:\Windows\System\oxEazvW.exe
  2⤵
  PID:10648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BuMrQTo.exe

Filesize
1.9MB

MD5
49e44a5a8b795a0922746c3b8e542faa

SHA1
b210a4d9af7cb31b03846822ee54dfcabb43c4d1

SHA256
c74d41bac8610b07593ff37ae8c1017f72c06a358fb559a2497bd952c985d470

SHA512
979e87119e3b42c6655b86f0799b859ae80d5b822bf667303e191c63eaf8ad03e24374f1801754a14f3e42f80557919d4ba0c4b0a95515c6d2d51b1d228b5cb9

Download Submit
C:\Windows\system\DSCbGBI.exe

Filesize
1.9MB

MD5
67333b54307e8b8708d05e5781571cda

SHA1
fd6022c70938f7570a13ae4a8bffbb98366bcc7c

SHA256
6567edbe40d90ef7498f86f9139d4f035f1cdea07f98e1acbae04ffb2f6868dd

SHA512
c7734bf497ffae3d611503a48a5b4b9af593e4ae8402192f5e5f3b8b01de88b0272d1d8bc142825da1dde0b2bdb3e20bc4d59fd34aa41208b4b242c5ee6da895

Download Submit
C:\Windows\system\ETgHxYY.exe

Filesize
1.9MB

MD5
85a7dc99010f61122b0f712018e8e886

SHA1
bb7a1b7104ad8a1c5329d146172038b21355a5ab

SHA256
74b552f2dd88359bc8551bb41f0de912c9f02e911f45eed02f127e76f4f52e7e

SHA512
4d81bc85812fda117c63fe1416f92a325151031bf17b0387daf8791c17314559da784586ffaca3e1611846ed3a6e7f788c7bb723dd45865ae966618ff91bf2eb

Download Submit
C:\Windows\system\EkQvzGd.exe

Filesize
1.9MB

MD5
d8ef67bfc845a5ea6be9f0361753f5cf

SHA1
5308ebff1d928dd8cc4dbdd309a501fe644be149

SHA256
e830afdf6fc1fa7752e48b71ba62d571a6504cab0368f98bbd54b4fdeb1ea0c2

SHA512
11473009f1e3488b8e5f6e8c790a4e706133dd70b31ea20827cb96f9688e8d7c11501ee8f3d84903b34f5daf5795e1666b3a35101ff26dd459c9c777d4cce096

Download Submit
C:\Windows\system\FYNDNuQ.exe

Filesize
1.9MB

MD5
b1d5071c830e1a009ba14cb74fcfdb9a

SHA1
495b3642bd09f0b036698b067485b5a7d2fe22f0

SHA256
dedb7176d8cb4d22e71e42ad4ff5a29578366c412c43dd0162d4835be2ff8098

SHA512
0f885240b66feacb95757cbf8d330b5523a1d4ed2c93ceeb5e5fd8e538f865ee7aa96492ce9cf7d7989fd9cdb81a033acd193b8f9132bb2563e174e0667cd402

Download Submit
C:\Windows\system\MItnTLI.exe

Filesize
1.9MB

MD5
18a75b0f2b7d999852585704e53471d0

SHA1
ba02a2032fa918aa7a1b8d33b7fbbde99e06a661

SHA256
33576a416885e49bd5f5825129e8612e6ad96f92b32c9d54eebfca6d02e303f0

SHA512
fce76f6dc69398a69d7a836012d0d936e188ad70659a0a48a43dadcc56d65d266f2f0bb011e86f075a7e80883289e8d74b41ae6ccb15d4de7807fdc3e0caf5e2

Download Submit
C:\Windows\system\NkOZIZi.exe

Filesize
1.9MB

MD5
3670df2b1e2aa4514babade9ecb54ff6

SHA1
315c6eee2b6bd2f7af0ae8fc1408688155546538

SHA256
a0749cc4fce89d77b29b3284d8f27290f9a1fbc8b54b28949f19f800db0650ef

SHA512
e79e67f2c566b06b013bc600f66c9ebad7844361682cd8b24ceb099012bb8a669fcf856868bdeb31644d91dbb58504323cb237ccdcb524be0d9a98486c182f12

Download Submit
C:\Windows\system\QcIRlOs.exe

Filesize
1.9MB

MD5
4e8ad29f27771784e350236a4c33b657

SHA1
3f7e76e4b12768abf154e75c87bd8f079a78d37a

SHA256
860959969879d40c7a5e9f2c7ece7870e4e50b3ecb864aae780167532c8ac9a5

SHA512
4ecf5453a50350bd58e09ef368fd0f4f9e9949aba80fa8871f17fdaae6828c2378a31e787eb6f8ca25117accfe16f1a000ae3d77cc25e34574a0339812b934da

Download Submit
C:\Windows\system\UWjKgAC.exe

Filesize
1.9MB

MD5
df425d87aa9a97588d0c7aa9c07f5ad4

SHA1
df3c06b2e22e72be56a5dc954964a21c28085b95

SHA256
1e0e87206eb5aba0c2f9f5584845087b58719fbb88d352becfc6b35f6eab089d

SHA512
7fb6fc950a717a488383aff35f242c8a6958fafd95b5a1ee06817a6e20dfde10510cad32aa4c1711e03027264bef415e6675e368fe8fbba0849b0fd5187aa0d7

Download Submit
C:\Windows\system\WHmzRJD.exe

Filesize
1.9MB

MD5
f6bbf199431cb6be3381ed1af12bea69

SHA1
3c366dda19fdf75a8065d95d55c09ce9fe191867

SHA256
643ff984102ec93b63f452594f43b2023fb467183cafe9c9fdfc30996dd3952c

SHA512
29f28e0bcbc123b4b74acc5dde396ff1f6f9dcbb914198f923ff8c48bc60697d388620469fc8eba81800d376400aac1033268a6b0bd397508168e5dfb4dc74ae

Download Submit
C:\Windows\system\bhOytoL.exe

Filesize
1.9MB

MD5
47828ae50454a4bf4dd4b7bf9a8e76ac

SHA1
a4fb3cdd27d3c1a0d8a8d94fd205f0b6f64ddad1

SHA256
5cf4d0d7d25f177ac14efc78e331a263c4ded353ad4df8c38f95a2ba4360a528

SHA512
ec6d1f524afc10d184c20a757ae5543354342cdff95422b8bd3da63ed26b6315fc8f73661cd75562349e43b6d6e00e6fa44063ba187dfe416c3d6e0f1208ab9e

Download Submit
C:\Windows\system\cBBNGTm.exe

Filesize
1.9MB

MD5
d2fef371d02b4aba6ee50aa9f686b0d9

SHA1
e7fe0ee63a1aeaa6f93ac0f85fa45ba4a2a72515

SHA256
9999e7b25f6f2ffd79ba1059b9c404199bb555c99c529b3564e139d8a71459bf

SHA512
aca4b4e2d5059b94c881630ec50d229e0baf443912797b6364ab54d85d66c5f289d0a91b5abf6f29927de07d0b64b9ee9a16a54160853fc2a7859d9d5e8161cd

Download Submit
C:\Windows\system\cskNRDn.exe

Filesize
1.9MB

MD5
fcec4ad68cc253766ff52308d81a9d1b

SHA1
a32f47c0bbd69c4b1d6b3f41023eee02a9501939

SHA256
ba5479ff53d4026c01018c606b3ff4e39564070a074f1503c0d43f4e5f877be6

SHA512
cc68030c200f79232a311b8136b6544e6db5d2dd5f1c813580f750622b76f3a963960ed58d2bd372c07c717b64dfe59256c9739a7a02d05f639c32fc60d9b57c

Download Submit
C:\Windows\system\fuVVnqz.exe

Filesize
1.9MB

MD5
96b149c4c0729902c78b3c38e58aea83

SHA1
04b981bf6fc3cb229c5914a9e648caad00ebf753

SHA256
51b9a54520f3e8e28f0ab07a230a6ba3e9d1ff28bbb5fe64332252e57dea970f

SHA512
95a1dd93ad295f79a2fdd9af4c5be4633c04ea15f50625c431d66be1626b18224ce944cc5fe702a6bdba0097926e8415a4046f97c0aa301c3277d7981961573c

Download Submit
C:\Windows\system\hQmuBqB.exe

Filesize
1.9MB

MD5
e868219489c93e19791aa18e9bbde32d

SHA1
675ebf9264171bff6ace199f48d80fc554a83f39

SHA256
0885cf9ef7ae0ccf4fa70ab5583886ba93e9373bc7b889b4d95ff88e7d565491

SHA512
eaa8944655caf94b32cb0f352151256b1b89aa8992a982976651cc33def4b3684e5c35366244b0c217abf3401bbe67f2e570b4c2c128e1c9b8125c570ad7355e

Download Submit
C:\Windows\system\iVuXvyb.exe

Filesize
1.9MB

MD5
06033bb0c3034a6b3eb8cc413e3d68a8

SHA1
4ede96b25dcda487bae167f78595afa1fa40425a

SHA256
013c8fd3250958fd338122d7f1de74865926817da81666eb88e9526a23242ebf

SHA512
86978681477684ffd2005a3d106d232525086831172c826b88eff20aa9645aee70b7ab99560887814875c87311738b7787106263f959c354d72ca655d7e03b24

Download Submit
C:\Windows\system\ijxxgwt.exe

Filesize
1.9MB

MD5
5eade8b7d531aef354b1ef191560c207

SHA1
d75bbc6b022bfec594e517616934253bc0c81b45

SHA256
56bf846973c8d5d4ee44a480eaf2ad2730b33f118a5ee5d19807b1775cf4a947

SHA512
e7d9d15dfc470ce287307f7c7fdb6ca9688c8a741e94722554c36f8936312e4774734d3ed0cdf84b8ba53f333bf2ab6d3b19579ecb921c90c4ab76d78560410e

Download Submit
C:\Windows\system\kAsBzCP.exe

Filesize
1.9MB

MD5
f813009790184119c7e89dda98e3c4ae

SHA1
051de79ac30a49eaebdfc3b01a14d86296b8b0e2

SHA256
042e9a367851d492e594c412db264eb11ae4ac32d7f5e6111b7f87df6b062d38

SHA512
52c89880a82a0a0569395208e534fcaa6ad594282ffef4b1ed54d18e982fb14a2e41ea881b52f7d217b96a219cc074f8c604379317a682aecce70f79168a5244

Download Submit
C:\Windows\system\kFPEYhl.exe

Filesize
1.9MB

MD5
bf9e95328fc521948ec4d71d0dcb7799

SHA1
47d33c898fd32a25174cd29e68f6aab6e6eab7cc

SHA256
4f53285e8ddf8e47330e8dbccb4017cbbd69c42161828c5b8b23c8eb8f76b8ba

SHA512
9445507f3834ab9d0765a49005e4b96a4f67addeb19cb8b3b5a768b0efbcd41c8d028dcdef9d53447f33f77f29b5a38ac56581f48634ce9dc8ffea8d68142b5a

Download Submit
C:\Windows\system\nKkWvUh.exe

Filesize
1.9MB

MD5
96951a0f01944be509c921bd69f05e9d

SHA1
06619bae4f18b0efb479e70bb9ccc79b78dcb011

SHA256
ef405dc4562482441dfba1add42e39e7b7f2d5169af110d5e694896a6aa82ae9

SHA512
79c6a3f5deda47369e9f7802f152630744c0b2c4da11e483b278ab16d16198de1abf5855af164cd59bba1c9b127d1a29b3cd32d4a203045aafc4612e7ddd2edc

Download Submit
C:\Windows\system\oBCLCup.exe

Filesize
1.9MB

MD5
72549c31777134bf2620b40417d20b08

SHA1
e563cfc26c597674d33d3cefe11fff0b6b83a063

SHA256
64900c4f614384282f88dfa95bbf3334452a23516ea3618fc9b50eb90b48eede

SHA512
a89f266968311746656880e6e7ce1457aecf5b7fbfc94f46276684622cf281fe20036e6a6888734141d8f9b402bf65131dc91f372366ef77c09750b1cda771cc

Download Submit
C:\Windows\system\oxKgmiW.exe

Filesize
1.9MB

MD5
57f9dc2f8c1c686f8915d71c80ecb0af

SHA1
d8a653a5a7ffdb5e460e77f0b3629b1ce2a0cabb

SHA256
2652119785eb7152502a9a623a47f7f388376cd1e506e0cf222a9e07d2e404ca

SHA512
cea9da2f10e4c8e2a6e779674c26bf8183f50427d964eb151c8aae45511053d388c98ff4079c6dddec2f732c5a342534dff5bfafa8853cb97250e060cc1ae0b6

Download Submit
C:\Windows\system\pFLrWqX.exe

Filesize
1.9MB

MD5
1d6a6dd4288e18109884e91bc6bb2cf6

SHA1
863b077c525a80b4e895f4a69d9e9bc336e7d8ca

SHA256
5b31ca13e1512e0f7484ac199bcff30b87dd2c62e02e6c2f862f61e7b5130084

SHA512
b09fd8b4d61afaaddbdf7e49b68e11570503bb8e4f6d54dc349b2cd03d82ade0158c388830ae1ec5a72cee6412fff659e1ebbbf042268f934510df9c8585c5d7

Download Submit
C:\Windows\system\pHzJZpz.exe

Filesize
1.9MB

MD5
25ecf299aa9d99e5f3b5b295ceb68044

SHA1
f524514b8df844ef89b5532305fed6299f055414

SHA256
68ab5fd8800caeb67526187981e9ad08e5de7b9f49e3a41d9fbc4c2a00401408

SHA512
3d1c67d4c46fd5d7f5bfeb85e54ffb70c004e4dd081873f0c0b62e6fb674e9c30eec5c83aa7e673aa71a13c7c44fb8c75ed4100190539bc5816e739056671bc0

Download Submit
C:\Windows\system\vJFVrXS.exe

Filesize
1.9MB

MD5
7c42fd348b9ac59885827e14c4daf9a1

SHA1
323114f9950b7e1f85277a5fb85f80e3eadb2d0e

SHA256
bf1a318a7fb1dacae9a52412db938cff3265d58e0d86ddbc2f19867ade9ff7cc

SHA512
bde06a15d83b38b33c478073587d30b79f63cfe6561be391274d235467b4ec717829be26a769f46ea46f9dc9ddaa0a22bea70400b66a68a4f1a15a3aed2312dd

Download Submit
\Windows\system\AAXPXMX.exe

Filesize
1.9MB

MD5
7c74c6e43d0fbc8c10b22c77dc452728

SHA1
86710bb9eed7c4ec3ddf25475df92c278749c682

SHA256
87731dff1bc410ceb8043f9a74192f10c36a69b3c80efad71cefc66505893a39

SHA512
30bfa08c45920c60e01f85f63bc98dd2353c822ecb709099a5f87ffaf1d86d803e8d1142114a884366af4aff60089c6069ce3d1eb2c06952d0f2f41e49195dc5

Download Submit
\Windows\system\CLBDRtF.exe

Filesize
1.9MB

MD5
e21c0463a4363dc7218c5807100a086f

SHA1
f0e749ff6694c30fe7b578c23d73de418775221d

SHA256
859f2d34b8954d08f8cb84b5cd8db73c53d967b8f3aeb2254d0e8bdb66ca0aa7

SHA512
2d54a03efb9403e4f5066b61cfddcec9227bc9f565f617f0b86b0f2cf0c05e0a0967f5de3d50b6dc1695f2719a73d5831d914f22f477728037b4ba2d25c845f4

Download Submit
\Windows\system\FNeJffa.exe

Filesize
1.9MB

MD5
fef69d3c158deb9488598231e244f2de

SHA1
d159628ad8c19e824893a82116c3ac9675d76639

SHA256
91085181ae226c5663d18e8f35ad15837ca6508c07a6bc548a9af13f1bc77e0b

SHA512
7ae4341accb3372d9f50c43ec1dc4cf282e65f2257841430af1323668f324a777ebd1ffc0c250fa5e5adfc34aa3ac1a0189cb84cb7ea166a57e7fb24eb882d15

Download Submit
\Windows\system\HJjOLtU.exe

Filesize
1.9MB

MD5
66e855411fd5e5aee79d5a5dfd2e45ab

SHA1
7e08c98e712416dcbc1ec9b885c4d9b6ba166ee6

SHA256
38d25f92c73cd554d21706fd9aa0e248f4397ab30227e3787727012e45b40a44

SHA512
fc7edfd28c4f6def7533b58477349da0162b0a7ae49d4a4258fe949247ec6e48a1c7b459b747e3fb5fca69ea50fa7dbc8bcd4279304c7909886876ddc9834602

Download Submit
\Windows\system\OucHRlN.exe

Filesize
1.9MB

MD5
004cb696f07106fc11fd31fe18de5077

SHA1
e931fa70d0d7abb9545e86aecde877a077732e9d

SHA256
7db8a6be983edab79d4dcc76d545ffad1a4fb691d9a7f720cf8f5d71124503b4

SHA512
a11f8b1ed06c1873c42bb198ae45a7b34d60a8bbb441d8cc1cdfcab7c1085b960d3fecc4a0619d58a69f581cfd136e70c3328cf521dcf76d10815e30459cb783

Download Submit
\Windows\system\WCCsIPS.exe

Filesize
1.9MB

MD5
173aae35801f9e240d022fc52450bf65

SHA1
6b39444b822f42ab0d4ddf5e8e8a7830b48da2f9

SHA256
93c514551c00a4724ac764e3fbdd7d6ff7d80831bd70390472cb3f90f02e14a5

SHA512
85549c636158f614bfd05bfe4e689c7be474252ca83c9139e681a6ab2567d58ae3e69fa943adde62b837a6b49b92a16e0caab34677842c3391d5e68f53f1edea

Download Submit
\Windows\system\cTstPZE.exe

Filesize
1.9MB

MD5
96bd7537810f51c95500bcd0862bfe61

SHA1
f6f6fb30089d21d042ae16b093e87199171636f2

SHA256
f93b92189150efccb8e126dc6d19aa180eec0e0cb2afb02f5c67592157aeef4d

SHA512
4b95cb1cb6ec2cafd0f5751ef5353293712b3eab7b06698ca0c24026e6fa63a4f78eb411ccef6d28cdc5d3c2df07751927ea553234155dc936f2ef60e6d1dd8f

Download Submit
\Windows\system\dnmCPBK.exe

Filesize
1.9MB

MD5
1428955799cd48a5956964424137d9c9

SHA1
9f3c1c2a8e3c9d8cc58b7b1e1ae8520f851b12ad

SHA256
ef3caf6967737949a2f7d6ff4c1b29d8dfaba12362db508b098c13cdb9ca074a

SHA512
cc9c66b436abf849ebdc8c03b456fe0763858aba1cdc8605fcdbf91214bbe35858ecde4f7b9abc5024243a2ab4c026fab19b11062fc9b988eb6d060d8e3d75b4

Download Submit
\Windows\system\erdXAjO.exe

Filesize
1.9MB

MD5
b51c69c02981fd550d92688637277381

SHA1
5386e5d770ab6c1790903e62214df8cd63c38dd4

SHA256
c64ac36ae687c4648c6264c7877356d78cbafe5d8d2bd35c0fadf7517642174c

SHA512
a369b6e59d362ab1851436421c8e4b6328821ef6ca99016df4f0abc9c06aee3f06f318c73a4b8dcedc8bb2aaa763b8d07521fe7496e86f0145c38d8e4aab9e1e

Download Submit
\Windows\system\iBEWrOR.exe

Filesize
1.9MB

MD5
19570083dfa2bf0602239759ae9755f4

SHA1
64ea9e08d6a964c1511f370c176a6e71bfde32d0

SHA256
b16405960bdcf6c3a0a0c6265eb24cc77162942cac5695c3cc52feb77a4c9a5d

SHA512
dd3ff013c50473327eb11d670f02bc1a47de0734dad08001e72d4d0f1347781d1b73e7747049024e556491543eea58384079596cb6a952914783101106586bf1

Download Submit
\Windows\system\pJRCNOh.exe

Filesize
1.9MB

MD5
a10bc63c672ca4c0abb093d68cdaf719

SHA1
7f0a8d264739d0b44331aed858168bf227a40396

SHA256
578fddd2fed7b705089a4f82334dae914f0731070533bbd5cf4ea308b46e11c0

SHA512
ef3b16d0e7b4ec99852db599a772160f08a087d2de7f464f4bd77f65f0131f743f6c14118796d0525b04e48fe2ee6b89f6434cef12d0540d1d857e2ba391d503

Download Submit
memory/2124-111-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2392-132-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2392-130-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2392-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2392-126-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-7-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2392-41-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2392-129-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-128-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-1-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-119-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-127-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-122-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-8-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2660-123-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-131-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2708-124-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2740-125-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2864-101-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

Filesize
9.6MB

Download
memory/2864-95-0x0000000001D00000-0x0000000001D08000-memory.dmp

Filesize
32KB

Download
memory/2864-93-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2864-110-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2864-109-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

Filesize
9.6MB

Download
memory/2864-102-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2864-420-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

Filesize
9.6MB

Download
memory/2876-120-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download