xmrig | ffe18c87676f1d96d5065ccac9a1ceccd34e1bfe88d3c9cb6e140b003a33bd7e

Analysis

max time kernel
36s
max time network
31s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
Size

1.9MB
MD5

064061d68dd202d1147f540354fc59ee
SHA1

8e4b4f446b2c2634695ebe503f6740c67f353941
SHA256

ffe18c87676f1d96d5065ccac9a1ceccd34e1bfe88d3c9cb6e140b003a33bd7e
SHA512

3fac5be2e97170cbcf11d473dab5910df06750bf5dc53def7e6042564acf44690ac0ccc054640637a8c29a4d852f2aff299d18de2c92803cd697becad2ea84f9
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UX:NABa

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral1/memory/3048-6-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2704-12-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2520-16-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2492-70-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2392-68-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2684-66-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2428-65-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/3048-63-0x0000000003110000-0x0000000003502000-memory.dmp	xmrig
behavioral1/memory/2396-62-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2708-60-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2504-57-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/3048-2092-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2704-2094-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2704	IpDqtiD.exe
2520	pOTHvTB.exe
2504	WHmWNTd.exe
2708	hTadqOx.exe
2396	OapGmok.exe
2428	qnkwIaS.exe
2684	qiAgKcC.exe
2392	whqgkIT.exe
2492	kmEZEOO.exe
2724	GiNoFWK.exe
2756	SDNBYyi.exe
1908	MrhNNvL.exe
472	varQQbY.exe
2256	EXHTHnM.exe
2432	NbZIPvg.exe
2152	mpAfnGu.exe
1516	qFzgykm.exe
2172	vinICpJ.exe
904	NOWndAp.exe
2044	Jnjibfv.exe
324	qSIkCPe.exe
1428	qxkJQxU.exe
2832	yodpjoP.exe
1804	AaPLIvX.exe
1280	rBDKevQ.exe
1688	umBXGaq.exe
300	wwcdChs.exe
1716	OTpZPhG.exe
968	zvefnnG.exe
1796	ARvfxhP.exe
1604	SYfQrPf.exe
672	CAPCByR.exe
3056	ygEGsyp.exe
1984	NRAMWMV.exe
1212	JWVkUOP.exe
2848	yuVKSPe.exe
2844	XVuIcOi.exe
2116	hhfPbaJ.exe
864	PDoFPCy.exe
2464	guQAzbH.exe
2820	JMdAixY.exe
2964	aAsiYNT.exe
2664	UtBmvcY.exe
2424	PAFSMhy.exe
816	NDxkuKe.exe
2260	idCFhmT.exe
2868	kbivXOy.exe
2224	kSvCWsH.exe
1160	MVLiOzC.exe
2508	sTxfsvb.exe
920	BwAQmyk.exe
1584	YDEZQAR.exe
2232	GxdRJBh.exe
2892	tLLaVZe.exe
1940	KerqGOs.exe
3088	jGnxAME.exe
3120	WKAgVXM.exe
3152	wQNGvSM.exe
3184	TvNXNZd.exe
3216	EPoLObZ.exe
3248	XKXAYhM.exe
3280	YRMBrHh.exe
3312	cyPMzuq.exe
3344	pWTgmMx.exe

Loads dropped DLL 64 IoCs

pid	Process
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000014890-5.dat	upx
behavioral1/memory/3048-6-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/files/0x0033000000015083-7.dat	upx
behavioral1/memory/2704-12-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2520-16-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x0008000000015662-21.dat	upx
behavioral1/files/0x0008000000015ae3-34.dat	upx
behavioral1/files/0x0007000000015b50-44.dat	upx
behavioral1/files/0x0007000000015d9c-48.dat	upx
behavioral1/files/0x0006000000015f23-52.dat	upx
behavioral1/files/0x0007000000015b85-42.dat	upx
behavioral1/files/0x0016000000005586-30.dat	upx
behavioral1/memory/2492-70-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/files/0x0006000000016c30-120.dat	upx
behavioral1/files/0x0006000000016cf3-141.dat	upx
behavioral1/files/0x0006000000016d06-148.dat	upx
behavioral1/files/0x0006000000016f7e-183.dat	upx
behavioral1/files/0x0006000000015fa6-77.dat	upx
behavioral1/files/0x0006000000016e56-178.dat	upx
behavioral1/files/0x0006000000016d85-171.dat	upx
behavioral1/files/0x0006000000016d31-164.dat	upx
behavioral1/files/0x0006000000016d21-157.dat	upx
behavioral1/files/0x0006000000016d10-150.dat	upx
behavioral1/files/0x0006000000016cfd-143.dat	upx
behavioral1/files/0x0006000000016ced-136.dat	upx
behavioral1/files/0x0006000000016cb5-129.dat	upx
behavioral1/files/0x0006000000016c38-122.dat	upx
behavioral1/files/0x0006000000016c1f-115.dat	upx
behavioral1/files/0x00060000000167bf-108.dat	upx
behavioral1/files/0x00060000000164ec-101.dat	upx
behavioral1/files/0x00060000000161ee-94.dat	upx
behavioral1/files/0x0006000000016013-87.dat	upx
behavioral1/files/0x0006000000016da9-176.dat	upx
behavioral1/files/0x0006000000016d81-169.dat	upx
behavioral1/files/0x0006000000016d29-162.dat	upx
behavioral1/files/0x0006000000016d18-155.dat	upx
behavioral1/files/0x0006000000016ce0-134.dat	upx
behavioral1/files/0x0006000000016c84-127.dat	upx
behavioral1/files/0x0006000000016a28-113.dat	upx
behavioral1/files/0x0006000000016575-106.dat	upx
behavioral1/files/0x00060000000163eb-99.dat	upx
behavioral1/files/0x0006000000016122-92.dat	upx
behavioral1/files/0x00330000000150d9-84.dat	upx
behavioral1/memory/2392-68-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/2684-66-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/2428-65-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/2396-62-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2708-60-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2504-57-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/3048-2092-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2704-2094-0x000000013F720000-0x000000013FB12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iOMtBsg.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\szeNAkr.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\hiUHAsz.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\oZgBeMp.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\WBrlLcA.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\CskwOkp.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\TyScIEa.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\OjgLWvd.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\nQkZcXw.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\rzoOiCp.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\HJQOONx.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\SmPDijF.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\dElHgTu.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\zWmdADx.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\PlMjpHS.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\mSwFNRW.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\AdRVVSp.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\QdxqGID.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\wFtsQGV.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\DBmmhXI.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\ysuoghI.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\EgyIIvk.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\YixwEkH.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\bbWGCkx.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\xQxFzkP.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\YdZdlVH.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\PdfkGpW.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\uXsRRLZ.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\GDORTkj.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\qaVAgfb.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\wjTBVPN.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\zJwBggu.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\trQprZi.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\qXHXVGM.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\gfAFpXw.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\xxukHzt.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\xgNNhGr.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\RyLEXcm.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\xKKySdu.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\PCmuLUV.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\UFmUwcn.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\uvAlRwA.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\zgSgCQW.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\suGJYds.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\KXaLYOv.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\sdgpsGq.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\zmENNqc.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\zfXFCHR.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\aMCwOtU.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\JGxiUIW.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\zXasEXI.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\dSLcQlu.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\vWITxin.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\CHjGiCz.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\hOnBQzL.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\eEmTCkB.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\dibLnuF.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\HNHPztG.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\HiOrFhH.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\NhAUolh.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\puoKBxa.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\QPLFFyP.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\CljYHTH.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
File created	C:\Windows\System\XFUwSph.exe	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2956	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeLockMemoryPrivilege	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2956	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	29
PID 3048 wrote to memory of 2956	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	29
PID 3048 wrote to memory of 2956	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	29
PID 3048 wrote to memory of 2704	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	30
PID 3048 wrote to memory of 2704	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	30
PID 3048 wrote to memory of 2704	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	30
PID 3048 wrote to memory of 2520	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2520	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2520	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2504	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	32
PID 3048 wrote to memory of 2504	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	32
PID 3048 wrote to memory of 2504	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	32
PID 3048 wrote to memory of 2708	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	33
PID 3048 wrote to memory of 2708	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	33
PID 3048 wrote to memory of 2708	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	33
PID 3048 wrote to memory of 2396	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	34
PID 3048 wrote to memory of 2396	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	34
PID 3048 wrote to memory of 2396	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	34
PID 3048 wrote to memory of 2684	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	35
PID 3048 wrote to memory of 2684	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	35
PID 3048 wrote to memory of 2684	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	35
PID 3048 wrote to memory of 2428	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	36
PID 3048 wrote to memory of 2428	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	36
PID 3048 wrote to memory of 2428	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	36
PID 3048 wrote to memory of 2392	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	37
PID 3048 wrote to memory of 2392	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	37
PID 3048 wrote to memory of 2392	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	37
PID 3048 wrote to memory of 2492	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	38
PID 3048 wrote to memory of 2492	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	38
PID 3048 wrote to memory of 2492	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	38
PID 3048 wrote to memory of 2756	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	39
PID 3048 wrote to memory of 2756	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	39
PID 3048 wrote to memory of 2756	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	39
PID 3048 wrote to memory of 2724	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	40
PID 3048 wrote to memory of 2724	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	40
PID 3048 wrote to memory of 2724	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	40
PID 3048 wrote to memory of 812	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	41
PID 3048 wrote to memory of 812	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	41
PID 3048 wrote to memory of 812	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	41
PID 3048 wrote to memory of 1908	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	42
PID 3048 wrote to memory of 1908	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	42
PID 3048 wrote to memory of 1908	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	42
PID 3048 wrote to memory of 1924	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	43
PID 3048 wrote to memory of 1924	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	43
PID 3048 wrote to memory of 1924	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	43
PID 3048 wrote to memory of 472	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	44
PID 3048 wrote to memory of 472	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	44
PID 3048 wrote to memory of 472	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	44
PID 3048 wrote to memory of 2100	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	45
PID 3048 wrote to memory of 2100	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	45
PID 3048 wrote to memory of 2100	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	45
PID 3048 wrote to memory of 2256	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	46
PID 3048 wrote to memory of 2256	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	46
PID 3048 wrote to memory of 2256	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	46
PID 3048 wrote to memory of 1696	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	47
PID 3048 wrote to memory of 1696	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	47
PID 3048 wrote to memory of 1696	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	47
PID 3048 wrote to memory of 2432	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	48
PID 3048 wrote to memory of 2432	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	48
PID 3048 wrote to memory of 2432	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	48
PID 3048 wrote to memory of 2460	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	49
PID 3048 wrote to memory of 2460	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	49
PID 3048 wrote to memory of 2460	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	49
PID 3048 wrote to memory of 2152	3048	064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\064061d68dd202d1147f540354fc59ee_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\System\IpDqtiD.exe
  C:\Windows\System\IpDqtiD.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\pOTHvTB.exe
  C:\Windows\System\pOTHvTB.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\WHmWNTd.exe
  C:\Windows\System\WHmWNTd.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\hTadqOx.exe
  C:\Windows\System\hTadqOx.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\OapGmok.exe
  C:\Windows\System\OapGmok.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\qiAgKcC.exe
  C:\Windows\System\qiAgKcC.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\qnkwIaS.exe
  C:\Windows\System\qnkwIaS.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\whqgkIT.exe
  C:\Windows\System\whqgkIT.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\kmEZEOO.exe
  C:\Windows\System\kmEZEOO.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\SDNBYyi.exe
  C:\Windows\System\SDNBYyi.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\GiNoFWK.exe
  C:\Windows\System\GiNoFWK.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\Xqkkgou.exe
  C:\Windows\System\Xqkkgou.exe
  2⤵
  PID:812
- C:\Windows\System\MrhNNvL.exe
  C:\Windows\System\MrhNNvL.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\SNLGxKC.exe
  C:\Windows\System\SNLGxKC.exe
  2⤵
  PID:1924
- C:\Windows\System\varQQbY.exe
  C:\Windows\System\varQQbY.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\dVTvekF.exe
  C:\Windows\System\dVTvekF.exe
  2⤵
  PID:2100
- C:\Windows\System\EXHTHnM.exe
  C:\Windows\System\EXHTHnM.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\nNFfdgX.exe
  C:\Windows\System\nNFfdgX.exe
  2⤵
  PID:1696
- C:\Windows\System\NbZIPvg.exe
  C:\Windows\System\NbZIPvg.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\CPAoZRR.exe
  C:\Windows\System\CPAoZRR.exe
  2⤵
  PID:2460
- C:\Windows\System\mpAfnGu.exe
  C:\Windows\System\mpAfnGu.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\SuJDEUK.exe
  C:\Windows\System\SuJDEUK.exe
  2⤵
  PID:1476
- C:\Windows\System\qFzgykm.exe
  C:\Windows\System\qFzgykm.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\PNGFkNV.exe
  C:\Windows\System\PNGFkNV.exe
  2⤵
  PID:1708
- C:\Windows\System\vinICpJ.exe
  C:\Windows\System\vinICpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\xxslFNe.exe
  C:\Windows\System\xxslFNe.exe
  2⤵
  PID:2880
- C:\Windows\System\NOWndAp.exe
  C:\Windows\System\NOWndAp.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\lnrisqQ.exe
  C:\Windows\System\lnrisqQ.exe
  2⤵
  PID:2212
- C:\Windows\System\Jnjibfv.exe
  C:\Windows\System\Jnjibfv.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\VmAJrbB.exe
  C:\Windows\System\VmAJrbB.exe
  2⤵
  PID:2192
- C:\Windows\System\qSIkCPe.exe
  C:\Windows\System\qSIkCPe.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\pJBBGMD.exe
  C:\Windows\System\pJBBGMD.exe
  2⤵
  PID:392
- C:\Windows\System\qxkJQxU.exe
  C:\Windows\System\qxkJQxU.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\Njphcar.exe
  C:\Windows\System\Njphcar.exe
  2⤵
  PID:964
- C:\Windows\System\yodpjoP.exe
  C:\Windows\System\yodpjoP.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\BVjPLtt.exe
  C:\Windows\System\BVjPLtt.exe
  2⤵
  PID:2752
- C:\Windows\System\AaPLIvX.exe
  C:\Windows\System\AaPLIvX.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\wyaMUmj.exe
  C:\Windows\System\wyaMUmj.exe
  2⤵
  PID:1468
- C:\Windows\System\rBDKevQ.exe
  C:\Windows\System\rBDKevQ.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\bSlWfQy.exe
  C:\Windows\System\bSlWfQy.exe
  2⤵
  PID:724
- C:\Windows\System\umBXGaq.exe
  C:\Windows\System\umBXGaq.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\BldoArk.exe
  C:\Windows\System\BldoArk.exe
  2⤵
  PID:2072
- C:\Windows\System\wwcdChs.exe
  C:\Windows\System\wwcdChs.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\uokgznh.exe
  C:\Windows\System\uokgznh.exe
  2⤵
  PID:1548
- C:\Windows\System\OTpZPhG.exe
  C:\Windows\System\OTpZPhG.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\fvMXtBJ.exe
  C:\Windows\System\fvMXtBJ.exe
  2⤵
  PID:1484
- C:\Windows\System\zvefnnG.exe
  C:\Windows\System\zvefnnG.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\vgbAzEN.exe
  C:\Windows\System\vgbAzEN.exe
  2⤵
  PID:1812
- C:\Windows\System\ARvfxhP.exe
  C:\Windows\System\ARvfxhP.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\WVnOidZ.exe
  C:\Windows\System\WVnOidZ.exe
  2⤵
  PID:1592
- C:\Windows\System\SYfQrPf.exe
  C:\Windows\System\SYfQrPf.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\xkYZDjz.exe
  C:\Windows\System\xkYZDjz.exe
  2⤵
  PID:1012
- C:\Windows\System\CAPCByR.exe
  C:\Windows\System\CAPCByR.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\CsxaWgU.exe
  C:\Windows\System\CsxaWgU.exe
  2⤵
  PID:2292
- C:\Windows\System\ygEGsyp.exe
  C:\Windows\System\ygEGsyp.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\RZSbaYE.exe
  C:\Windows\System\RZSbaYE.exe
  2⤵
  PID:2180
- C:\Windows\System\NRAMWMV.exe
  C:\Windows\System\NRAMWMV.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\ddQAXur.exe
  C:\Windows\System\ddQAXur.exe
  2⤵
  PID:832
- C:\Windows\System\JWVkUOP.exe
  C:\Windows\System\JWVkUOP.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\wQkogrS.exe
  C:\Windows\System\wQkogrS.exe
  2⤵
  PID:3064
- C:\Windows\System\yuVKSPe.exe
  C:\Windows\System\yuVKSPe.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\cUDiTHy.exe
  C:\Windows\System\cUDiTHy.exe
  2⤵
  PID:2088
- C:\Windows\System\XVuIcOi.exe
  C:\Windows\System\XVuIcOi.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\ZvOkDoA.exe
  C:\Windows\System\ZvOkDoA.exe
  2⤵
  PID:2700
- C:\Windows\System\hhfPbaJ.exe
  C:\Windows\System\hhfPbaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\wqCUXrT.exe
  C:\Windows\System\wqCUXrT.exe
  2⤵
  PID:1952
- C:\Windows\System\PDoFPCy.exe
  C:\Windows\System\PDoFPCy.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\yFFKApk.exe
  C:\Windows\System\yFFKApk.exe
  2⤵
  PID:1660
- C:\Windows\System\guQAzbH.exe
  C:\Windows\System\guQAzbH.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\TSxFGpo.exe
  C:\Windows\System\TSxFGpo.exe
  2⤵
  PID:2576
- C:\Windows\System\JMdAixY.exe
  C:\Windows\System\JMdAixY.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\jXWzBNt.exe
  C:\Windows\System\jXWzBNt.exe
  2⤵
  PID:2692
- C:\Windows\System\aAsiYNT.exe
  C:\Windows\System\aAsiYNT.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\MluYPfx.exe
  C:\Windows\System\MluYPfx.exe
  2⤵
  PID:2544
- C:\Windows\System\UtBmvcY.exe
  C:\Windows\System\UtBmvcY.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\seRLEeP.exe
  C:\Windows\System\seRLEeP.exe
  2⤵
  PID:2436
- C:\Windows\System\PAFSMhy.exe
  C:\Windows\System\PAFSMhy.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\iznFKHZ.exe
  C:\Windows\System\iznFKHZ.exe
  2⤵
  PID:2268
- C:\Windows\System\NDxkuKe.exe
  C:\Windows\System\NDxkuKe.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\dVYrPOV.exe
  C:\Windows\System\dVYrPOV.exe
  2⤵
  PID:1916
- C:\Windows\System\idCFhmT.exe
  C:\Windows\System\idCFhmT.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\zAUHfyg.exe
  C:\Windows\System\zAUHfyg.exe
  2⤵
  PID:2784
- C:\Windows\System\kbivXOy.exe
  C:\Windows\System\kbivXOy.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\XQzlmIG.exe
  C:\Windows\System\XQzlmIG.exe
  2⤵
  PID:2208
- C:\Windows\System\kSvCWsH.exe
  C:\Windows\System\kSvCWsH.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\dxBWdng.exe
  C:\Windows\System\dxBWdng.exe
  2⤵
  PID:1420
- C:\Windows\System\MVLiOzC.exe
  C:\Windows\System\MVLiOzC.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\nOrSDxi.exe
  C:\Windows\System\nOrSDxi.exe
  2⤵
  PID:2104
- C:\Windows\System\sTxfsvb.exe
  C:\Windows\System\sTxfsvb.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\wavTTrO.exe
  C:\Windows\System\wavTTrO.exe
  2⤵
  PID:1552
- C:\Windows\System\BwAQmyk.exe
  C:\Windows\System\BwAQmyk.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\minvdnu.exe
  C:\Windows\System\minvdnu.exe
  2⤵
  PID:3068
- C:\Windows\System\YDEZQAR.exe
  C:\Windows\System\YDEZQAR.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\kXiulQF.exe
  C:\Windows\System\kXiulQF.exe
  2⤵
  PID:1628
- C:\Windows\System\GxdRJBh.exe
  C:\Windows\System\GxdRJBh.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\zehWpom.exe
  C:\Windows\System\zehWpom.exe
  2⤵
  PID:2968
- C:\Windows\System\tLLaVZe.exe
  C:\Windows\System\tLLaVZe.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\veLMwld.exe
  C:\Windows\System\veLMwld.exe
  2⤵
  PID:2132
- C:\Windows\System\KerqGOs.exe
  C:\Windows\System\KerqGOs.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\wdMqkDM.exe
  C:\Windows\System\wdMqkDM.exe
  2⤵
  PID:2792
- C:\Windows\System\jGnxAME.exe
  C:\Windows\System\jGnxAME.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\ugOFUVw.exe
  C:\Windows\System\ugOFUVw.exe
  2⤵
  PID:3104
- C:\Windows\System\WKAgVXM.exe
  C:\Windows\System\WKAgVXM.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\NvZfDZc.exe
  C:\Windows\System\NvZfDZc.exe
  2⤵
  PID:3136
- C:\Windows\System\wQNGvSM.exe
  C:\Windows\System\wQNGvSM.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\PwPSdSC.exe
  C:\Windows\System\PwPSdSC.exe
  2⤵
  PID:3168
- C:\Windows\System\TvNXNZd.exe
  C:\Windows\System\TvNXNZd.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\LFilfeH.exe
  C:\Windows\System\LFilfeH.exe
  2⤵
  PID:3200
- C:\Windows\System\EPoLObZ.exe
  C:\Windows\System\EPoLObZ.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\HQoBXMp.exe
  C:\Windows\System\HQoBXMp.exe
  2⤵
  PID:3232
- C:\Windows\System\XKXAYhM.exe
  C:\Windows\System\XKXAYhM.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\fFREOQA.exe
  C:\Windows\System\fFREOQA.exe
  2⤵
  PID:3264
- C:\Windows\System\YRMBrHh.exe
  C:\Windows\System\YRMBrHh.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\tmLOwXv.exe
  C:\Windows\System\tmLOwXv.exe
  2⤵
  PID:3296
- C:\Windows\System\cyPMzuq.exe
  C:\Windows\System\cyPMzuq.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\FLqaLto.exe
  C:\Windows\System\FLqaLto.exe
  2⤵
  PID:3328
- C:\Windows\System\pWTgmMx.exe
  C:\Windows\System\pWTgmMx.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\OtsUNaC.exe
  C:\Windows\System\OtsUNaC.exe
  2⤵
  PID:3360
- C:\Windows\System\gYZGBKD.exe
  C:\Windows\System\gYZGBKD.exe
  2⤵
  PID:3376
- C:\Windows\System\EoPiikO.exe
  C:\Windows\System\EoPiikO.exe
  2⤵
  PID:3392
- C:\Windows\System\GlbVgrx.exe
  C:\Windows\System\GlbVgrx.exe
  2⤵
  PID:3408
- C:\Windows\System\RQsFsly.exe
  C:\Windows\System\RQsFsly.exe
  2⤵
  PID:3424
- C:\Windows\System\elABHmU.exe
  C:\Windows\System\elABHmU.exe
  2⤵
  PID:3440
- C:\Windows\System\FflLyii.exe
  C:\Windows\System\FflLyii.exe
  2⤵
  PID:3456
- C:\Windows\System\UQgWfss.exe
  C:\Windows\System\UQgWfss.exe
  2⤵
  PID:3472
- C:\Windows\System\HVSqjhX.exe
  C:\Windows\System\HVSqjhX.exe
  2⤵
  PID:3488
- C:\Windows\System\tCBjiqx.exe
  C:\Windows\System\tCBjiqx.exe
  2⤵
  PID:3504
- C:\Windows\System\NlUNcma.exe
  C:\Windows\System\NlUNcma.exe
  2⤵
  PID:3520
- C:\Windows\System\CphZjBK.exe
  C:\Windows\System\CphZjBK.exe
  2⤵
  PID:3536
- C:\Windows\System\VoMMWRW.exe
  C:\Windows\System\VoMMWRW.exe
  2⤵
  PID:3552
- C:\Windows\System\ysKrOcV.exe
  C:\Windows\System\ysKrOcV.exe
  2⤵
  PID:3568
- C:\Windows\System\AqglMdT.exe
  C:\Windows\System\AqglMdT.exe
  2⤵
  PID:3584
- C:\Windows\System\piZxNar.exe
  C:\Windows\System\piZxNar.exe
  2⤵
  PID:3600
- C:\Windows\System\LXQyNDQ.exe
  C:\Windows\System\LXQyNDQ.exe
  2⤵
  PID:3616
- C:\Windows\System\gBPYbie.exe
  C:\Windows\System\gBPYbie.exe
  2⤵
  PID:3632
- C:\Windows\System\ZTiaVNc.exe
  C:\Windows\System\ZTiaVNc.exe
  2⤵
  PID:3648
- C:\Windows\System\UVsOylC.exe
  C:\Windows\System\UVsOylC.exe
  2⤵
  PID:3664
- C:\Windows\System\bhyWuUG.exe
  C:\Windows\System\bhyWuUG.exe
  2⤵
  PID:3680
- C:\Windows\System\BagvMyz.exe
  C:\Windows\System\BagvMyz.exe
  2⤵
  PID:3696
- C:\Windows\System\CHjGiCz.exe
  C:\Windows\System\CHjGiCz.exe
  2⤵
  PID:3712
- C:\Windows\System\ccvpHXG.exe
  C:\Windows\System\ccvpHXG.exe
  2⤵
  PID:3728
- C:\Windows\System\iMXZhLi.exe
  C:\Windows\System\iMXZhLi.exe
  2⤵
  PID:3744
- C:\Windows\System\PIoCPrs.exe
  C:\Windows\System\PIoCPrs.exe
  2⤵
  PID:3760
- C:\Windows\System\ePPPMUb.exe
  C:\Windows\System\ePPPMUb.exe
  2⤵
  PID:3776
- C:\Windows\System\RnWfiPR.exe
  C:\Windows\System\RnWfiPR.exe
  2⤵
  PID:3792
- C:\Windows\System\osvwWfX.exe
  C:\Windows\System\osvwWfX.exe
  2⤵
  PID:3808
- C:\Windows\System\KdSgvpt.exe
  C:\Windows\System\KdSgvpt.exe
  2⤵
  PID:3824
- C:\Windows\System\FqPyhBX.exe
  C:\Windows\System\FqPyhBX.exe
  2⤵
  PID:3840
- C:\Windows\System\cEQglga.exe
  C:\Windows\System\cEQglga.exe
  2⤵
  PID:3856
- C:\Windows\System\HTWlosp.exe
  C:\Windows\System\HTWlosp.exe
  2⤵
  PID:3872
- C:\Windows\System\yZZwATB.exe
  C:\Windows\System\yZZwATB.exe
  2⤵
  PID:3888
- C:\Windows\System\BQXmPIE.exe
  C:\Windows\System\BQXmPIE.exe
  2⤵
  PID:3904
- C:\Windows\System\YzpuYrN.exe
  C:\Windows\System\YzpuYrN.exe
  2⤵
  PID:3920
- C:\Windows\System\RukTqED.exe
  C:\Windows\System\RukTqED.exe
  2⤵
  PID:3936
- C:\Windows\System\rUZHcoL.exe
  C:\Windows\System\rUZHcoL.exe
  2⤵
  PID:3952
- C:\Windows\System\qaVAgfb.exe
  C:\Windows\System\qaVAgfb.exe
  2⤵
  PID:3968
- C:\Windows\System\WBrlLcA.exe
  C:\Windows\System\WBrlLcA.exe
  2⤵
  PID:3984
- C:\Windows\System\LeCwWmd.exe
  C:\Windows\System\LeCwWmd.exe
  2⤵
  PID:4000
- C:\Windows\System\aMCwOtU.exe
  C:\Windows\System\aMCwOtU.exe
  2⤵
  PID:4016
- C:\Windows\System\ctEeIMi.exe
  C:\Windows\System\ctEeIMi.exe
  2⤵
  PID:4032
- C:\Windows\System\kEMoIOD.exe
  C:\Windows\System\kEMoIOD.exe
  2⤵
  PID:4048
- C:\Windows\System\XfMRXYJ.exe
  C:\Windows\System\XfMRXYJ.exe
  2⤵
  PID:4064
- C:\Windows\System\pyIxBMT.exe
  C:\Windows\System\pyIxBMT.exe
  2⤵
  PID:4080
- C:\Windows\System\IEaooON.exe
  C:\Windows\System\IEaooON.exe
  2⤵
  PID:2032
- C:\Windows\System\lEidbtL.exe
  C:\Windows\System\lEidbtL.exe
  2⤵
  PID:1200
- C:\Windows\System\JmnTpyA.exe
  C:\Windows\System\JmnTpyA.exe
  2⤵
  PID:1508
- C:\Windows\System\OfTundD.exe
  C:\Windows\System\OfTundD.exe
  2⤵
  PID:3192
- C:\Windows\System\eetXrNQ.exe
  C:\Windows\System\eetXrNQ.exe
  2⤵
  PID:3452
- C:\Windows\System\RFiVWvB.exe
  C:\Windows\System\RFiVWvB.exe
  2⤵
  PID:3592
- C:\Windows\System\vsNzeRh.exe
  C:\Windows\System\vsNzeRh.exe
  2⤵
  PID:3720
- C:\Windows\System\hNWfNAv.exe
  C:\Windows\System\hNWfNAv.exe
  2⤵
  PID:376
- C:\Windows\System\xFRXOSV.exe
  C:\Windows\System\xFRXOSV.exe
  2⤵
  PID:1856
- C:\Windows\System\glOLhIV.exe
  C:\Windows\System\glOLhIV.exe
  2⤵
  PID:1864
- C:\Windows\System\zxpDgQQ.exe
  C:\Windows\System\zxpDgQQ.exe
  2⤵
  PID:280
- C:\Windows\System\DEkxoxl.exe
  C:\Windows\System\DEkxoxl.exe
  2⤵
  PID:4056
- C:\Windows\System\RfyvJkJ.exe
  C:\Windows\System\RfyvJkJ.exe
  2⤵
  PID:2712
- C:\Windows\System\xsTciaX.exe
  C:\Windows\System\xsTciaX.exe
  2⤵
  PID:3784
- C:\Windows\System\NiVJDIi.exe
  C:\Windows\System\NiVJDIi.exe
  2⤵
  PID:3848
- C:\Windows\System\xOPTzNa.exe
  C:\Windows\System\xOPTzNa.exe
  2⤵
  PID:3912
- C:\Windows\System\sqwMFFQ.exe
  C:\Windows\System\sqwMFFQ.exe
  2⤵
  PID:4012
- C:\Windows\System\bdGNUfS.exe
  C:\Windows\System\bdGNUfS.exe
  2⤵
  PID:4076
- C:\Windows\System\TpPjvKr.exe
  C:\Windows\System\TpPjvKr.exe
  2⤵
  PID:576
- C:\Windows\System\XDjfILc.exe
  C:\Windows\System\XDjfILc.exe
  2⤵
  PID:2416
- C:\Windows\System\iNPvxfk.exe
  C:\Windows\System\iNPvxfk.exe
  2⤵
  PID:3772
- C:\Windows\System\XpjiJsP.exe
  C:\Windows\System\XpjiJsP.exe
  2⤵
  PID:1884
- C:\Windows\System\bcfxlDF.exe
  C:\Windows\System\bcfxlDF.exe
  2⤵
  PID:276
- C:\Windows\System\lJjkjpO.exe
  C:\Windows\System\lJjkjpO.exe
  2⤵
  PID:1512
- C:\Windows\System\GWjjTSt.exe
  C:\Windows\System\GWjjTSt.exe
  2⤵
  PID:272
- C:\Windows\System\ZZrwqUo.exe
  C:\Windows\System\ZZrwqUo.exe
  2⤵
  PID:1412
- C:\Windows\System\PgeOdcU.exe
  C:\Windows\System\PgeOdcU.exe
  2⤵
  PID:2076
- C:\Windows\System\PSpRigj.exe
  C:\Windows\System\PSpRigj.exe
  2⤵
  PID:2984
- C:\Windows\System\nJwAljQ.exe
  C:\Windows\System\nJwAljQ.exe
  2⤵
  PID:872
- C:\Windows\System\nwsTJJP.exe
  C:\Windows\System\nwsTJJP.exe
  2⤵
  PID:1456
- C:\Windows\System\gTJLiEa.exe
  C:\Windows\System\gTJLiEa.exe
  2⤵
  PID:708
- C:\Windows\System\juXYpik.exe
  C:\Windows\System\juXYpik.exe
  2⤵
  PID:2228
- C:\Windows\System\FbpIXEI.exe
  C:\Windows\System\FbpIXEI.exe
  2⤵
  PID:2552
- C:\Windows\System\npSJqgc.exe
  C:\Windows\System\npSJqgc.exe
  2⤵
  PID:556
- C:\Windows\System\gfAFpXw.exe
  C:\Windows\System\gfAFpXw.exe
  2⤵
  PID:2216
- C:\Windows\System\vZjQZJG.exe
  C:\Windows\System\vZjQZJG.exe
  2⤵
  PID:976
- C:\Windows\System\NplDGpA.exe
  C:\Windows\System\NplDGpA.exe
  2⤵
  PID:1808
- C:\Windows\System\pSiMmfx.exe
  C:\Windows\System\pSiMmfx.exe
  2⤵
  PID:3964
- C:\Windows\System\UClGRxH.exe
  C:\Windows\System\UClGRxH.exe
  2⤵
  PID:4028
- C:\Windows\System\wYeziET.exe
  C:\Windows\System\wYeziET.exe
  2⤵
  PID:4092
- C:\Windows\System\IPSaSzd.exe
  C:\Windows\System\IPSaSzd.exe
  2⤵
  PID:4088
- C:\Windows\System\jZVjuUr.exe
  C:\Windows\System\jZVjuUr.exe
  2⤵
  PID:1556
- C:\Windows\System\zINuXED.exe
  C:\Windows\System\zINuXED.exe
  2⤵
  PID:3756
- C:\Windows\System\dAYQCqh.exe
  C:\Windows\System\dAYQCqh.exe
  2⤵
  PID:3788
- C:\Windows\System\RKBZuGm.exe
  C:\Windows\System\RKBZuGm.exe
  2⤵
  PID:3880
- C:\Windows\System\JMrnkdr.exe
  C:\Windows\System\JMrnkdr.exe
  2⤵
  PID:3980
- C:\Windows\System\Iackgpy.exe
  C:\Windows\System\Iackgpy.exe
  2⤵
  PID:2620
- C:\Windows\System\GoyNTsu.exe
  C:\Windows\System\GoyNTsu.exe
  2⤵
  PID:1912
- C:\Windows\System\qWEUOYb.exe
  C:\Windows\System\qWEUOYb.exe
  2⤵
  PID:3484
- C:\Windows\System\WUpwxdV.exe
  C:\Windows\System\WUpwxdV.exe
  2⤵
  PID:4072
- C:\Windows\System\aJoolXy.exe
  C:\Windows\System\aJoolXy.exe
  2⤵
  PID:2772
- C:\Windows\System\FwfDgNv.exe
  C:\Windows\System\FwfDgNv.exe
  2⤵
  PID:2604
- C:\Windows\System\mgXxibb.exe
  C:\Windows\System\mgXxibb.exe
  2⤵
  PID:2252
- C:\Windows\System\FLupxRN.exe
  C:\Windows\System\FLupxRN.exe
  2⤵
  PID:2780
- C:\Windows\System\TKpuNYh.exe
  C:\Windows\System\TKpuNYh.exe
  2⤵
  PID:3028
- C:\Windows\System\AtdOFZf.exe
  C:\Windows\System\AtdOFZf.exe
  2⤵
  PID:4112
- C:\Windows\System\DdPyaQs.exe
  C:\Windows\System\DdPyaQs.exe
  2⤵
  PID:4144
- C:\Windows\System\dANVZIp.exe
  C:\Windows\System\dANVZIp.exe
  2⤵
  PID:4160
- C:\Windows\System\CqzrpPf.exe
  C:\Windows\System\CqzrpPf.exe
  2⤵
  PID:4176
- C:\Windows\System\SKUvxat.exe
  C:\Windows\System\SKUvxat.exe
  2⤵
  PID:4192
- C:\Windows\System\PZbNbjz.exe
  C:\Windows\System\PZbNbjz.exe
  2⤵
  PID:4208
- C:\Windows\System\jJdiFtL.exe
  C:\Windows\System\jJdiFtL.exe
  2⤵
  PID:4224
- C:\Windows\System\VhxtzCe.exe
  C:\Windows\System\VhxtzCe.exe
  2⤵
  PID:4244
- C:\Windows\System\dkBHEBz.exe
  C:\Windows\System\dkBHEBz.exe
  2⤵
  PID:4308
- C:\Windows\System\TfJYdjG.exe
  C:\Windows\System\TfJYdjG.exe
  2⤵
  PID:4600
- C:\Windows\System\hPpAOFT.exe
  C:\Windows\System\hPpAOFT.exe
  2⤵
  PID:4616
- C:\Windows\System\nsCGNFv.exe
  C:\Windows\System\nsCGNFv.exe
  2⤵
  PID:4632
- C:\Windows\System\RrHJPZp.exe
  C:\Windows\System\RrHJPZp.exe
  2⤵
  PID:4648
- C:\Windows\System\pLLJAVw.exe
  C:\Windows\System\pLLJAVw.exe
  2⤵
  PID:4664
- C:\Windows\System\fasUHCp.exe
  C:\Windows\System\fasUHCp.exe
  2⤵
  PID:4680
- C:\Windows\System\GjtbPEp.exe
  C:\Windows\System\GjtbPEp.exe
  2⤵
  PID:4696
- C:\Windows\System\JzKusAt.exe
  C:\Windows\System\JzKusAt.exe
  2⤵
  PID:4712
- C:\Windows\System\vRENfll.exe
  C:\Windows\System\vRENfll.exe
  2⤵
  PID:4728
- C:\Windows\System\aFDLQpD.exe
  C:\Windows\System\aFDLQpD.exe
  2⤵
  PID:4748
- C:\Windows\System\QujyzGj.exe
  C:\Windows\System\QujyzGj.exe
  2⤵
  PID:4764
- C:\Windows\System\XqLABOK.exe
  C:\Windows\System\XqLABOK.exe
  2⤵
  PID:4780
- C:\Windows\System\KPOUNri.exe
  C:\Windows\System\KPOUNri.exe
  2⤵
  PID:4796
- C:\Windows\System\zXasEXI.exe
  C:\Windows\System\zXasEXI.exe
  2⤵
  PID:4848
- C:\Windows\System\wSqfKtu.exe
  C:\Windows\System\wSqfKtu.exe
  2⤵
  PID:4864
- C:\Windows\System\wEKdXTP.exe
  C:\Windows\System\wEKdXTP.exe
  2⤵
  PID:4880
- C:\Windows\System\cNAjBWo.exe
  C:\Windows\System\cNAjBWo.exe
  2⤵
  PID:4896
- C:\Windows\System\SGZxJBY.exe
  C:\Windows\System\SGZxJBY.exe
  2⤵
  PID:4912
- C:\Windows\System\PoAvcjD.exe
  C:\Windows\System\PoAvcjD.exe
  2⤵
  PID:4928
- C:\Windows\System\tWeQhmI.exe
  C:\Windows\System\tWeQhmI.exe
  2⤵
  PID:4944
- C:\Windows\System\BUfDtZQ.exe
  C:\Windows\System\BUfDtZQ.exe
  2⤵
  PID:4960
- C:\Windows\System\wFtsQGV.exe
  C:\Windows\System\wFtsQGV.exe
  2⤵
  PID:4980
- C:\Windows\System\PlmruOa.exe
  C:\Windows\System\PlmruOa.exe
  2⤵
  PID:4996
- C:\Windows\System\zAMdXER.exe
  C:\Windows\System\zAMdXER.exe
  2⤵
  PID:5020
- C:\Windows\System\XherBww.exe
  C:\Windows\System\XherBww.exe
  2⤵
  PID:5036
- C:\Windows\System\bbZREAl.exe
  C:\Windows\System\bbZREAl.exe
  2⤵
  PID:5052
- C:\Windows\System\WYULhlJ.exe
  C:\Windows\System\WYULhlJ.exe
  2⤵
  PID:5068
- C:\Windows\System\CKqBAII.exe
  C:\Windows\System\CKqBAII.exe
  2⤵
  PID:5084
- C:\Windows\System\zCEOjVo.exe
  C:\Windows\System\zCEOjVo.exe
  2⤵
  PID:5100
- C:\Windows\System\EXUOFLC.exe
  C:\Windows\System\EXUOFLC.exe
  2⤵
  PID:5116
- C:\Windows\System\WMhISig.exe
  C:\Windows\System\WMhISig.exe
  2⤵
  PID:1944
- C:\Windows\System\uuijYvx.exe
  C:\Windows\System\uuijYvx.exe
  2⤵
  PID:2548
- C:\Windows\System\PnHDjzA.exe
  C:\Windows\System\PnHDjzA.exe
  2⤵
  PID:1768
- C:\Windows\System\oRKXrWX.exe
  C:\Windows\System\oRKXrWX.exe
  2⤵
  PID:2588
- C:\Windows\System\YixwEkH.exe
  C:\Windows\System\YixwEkH.exe
  2⤵
  PID:2360
- C:\Windows\System\LRntCVe.exe
  C:\Windows\System\LRntCVe.exe
  2⤵
  PID:2944
- C:\Windows\System\DoHGCYR.exe
  C:\Windows\System\DoHGCYR.exe
  2⤵
  PID:4132
- C:\Windows\System\nnRiIja.exe
  C:\Windows\System\nnRiIja.exe
  2⤵
  PID:4172
- C:\Windows\System\glLVQpm.exe
  C:\Windows\System\glLVQpm.exe
  2⤵
  PID:2788
- C:\Windows\System\ZXsBIBB.exe
  C:\Windows\System\ZXsBIBB.exe
  2⤵
  PID:1648
- C:\Windows\System\yPLDUjT.exe
  C:\Windows\System\yPLDUjT.exe
  2⤵
  PID:780
- C:\Windows\System\MTxPNRZ.exe
  C:\Windows\System\MTxPNRZ.exe
  2⤵
  PID:4060
- C:\Windows\System\vZYrref.exe
  C:\Windows\System\vZYrref.exe
  2⤵
  PID:1876
- C:\Windows\System\AsReCiB.exe
  C:\Windows\System\AsReCiB.exe
  2⤵
  PID:596
- C:\Windows\System\vWnCLHd.exe
  C:\Windows\System\vWnCLHd.exe
  2⤵
  PID:2680
- C:\Windows\System\ItZLhND.exe
  C:\Windows\System\ItZLhND.exe
  2⤵
  PID:4104
- C:\Windows\System\WeRHnOz.exe
  C:\Windows\System\WeRHnOz.exe
  2⤵
  PID:4184
- C:\Windows\System\AcgbbuE.exe
  C:\Windows\System\AcgbbuE.exe
  2⤵
  PID:696
- C:\Windows\System\UvDHJkO.exe
  C:\Windows\System\UvDHJkO.exe
  2⤵
  PID:1360
- C:\Windows\System\SyVrwRW.exe
  C:\Windows\System\SyVrwRW.exe
  2⤵
  PID:2524
- C:\Windows\System\EafMcXh.exe
  C:\Windows\System\EafMcXh.exe
  2⤵
  PID:4336
- C:\Windows\System\DjvOXhZ.exe
  C:\Windows\System\DjvOXhZ.exe
  2⤵
  PID:4404
- C:\Windows\System\weqSqBH.exe
  C:\Windows\System\weqSqBH.exe
  2⤵
  PID:4388
- C:\Windows\System\iOMtBsg.exe
  C:\Windows\System\iOMtBsg.exe
  2⤵
  PID:4372
- C:\Windows\System\wthvkAo.exe
  C:\Windows\System\wthvkAo.exe
  2⤵
  PID:4352
- C:\Windows\System\iAciLeF.exe
  C:\Windows\System\iAciLeF.exe
  2⤵
  PID:4412
- C:\Windows\System\oLTBJaw.exe
  C:\Windows\System\oLTBJaw.exe
  2⤵
  PID:4428
- C:\Windows\System\HtPffoG.exe
  C:\Windows\System\HtPffoG.exe
  2⤵
  PID:4444
- C:\Windows\System\qBJfThh.exe
  C:\Windows\System\qBJfThh.exe
  2⤵
  PID:4460
- C:\Windows\System\WbcbiQq.exe
  C:\Windows\System\WbcbiQq.exe
  2⤵
  PID:4512
- C:\Windows\System\ETgPLzx.exe
  C:\Windows\System\ETgPLzx.exe
  2⤵
  PID:4536
- C:\Windows\System\mSwFNRW.exe
  C:\Windows\System\mSwFNRW.exe
  2⤵
  PID:4560
- C:\Windows\System\OtwXrkM.exe
  C:\Windows\System\OtwXrkM.exe
  2⤵
  PID:4572
- C:\Windows\System\rzMAzis.exe
  C:\Windows\System\rzMAzis.exe
  2⤵
  PID:4588
- C:\Windows\System\LdiUlZy.exe
  C:\Windows\System\LdiUlZy.exe
  2⤵
  PID:4656
- C:\Windows\System\yQPOSdk.exe
  C:\Windows\System\yQPOSdk.exe
  2⤵
  PID:4692
- C:\Windows\System\KZRRupe.exe
  C:\Windows\System\KZRRupe.exe
  2⤵
  PID:4760
- C:\Windows\System\xbgNwGS.exe
  C:\Windows\System\xbgNwGS.exe
  2⤵
  PID:4644
- C:\Windows\System\fltCRsR.exe
  C:\Windows\System\fltCRsR.exe
  2⤵
  PID:2488
- C:\Windows\System\hOkZCGA.exe
  C:\Windows\System\hOkZCGA.exe
  2⤵
  PID:4772
- C:\Windows\System\mHdBMSX.exe
  C:\Windows\System\mHdBMSX.exe
  2⤵
  PID:4816
- C:\Windows\System\XgNLMzl.exe
  C:\Windows\System\XgNLMzl.exe
  2⤵
  PID:4824
- C:\Windows\System\xAtEyJd.exe
  C:\Windows\System\xAtEyJd.exe
  2⤵
  PID:4832
- C:\Windows\System\CTjMwGm.exe
  C:\Windows\System\CTjMwGm.exe
  2⤵
  PID:4804
- C:\Windows\System\weWWzRg.exe
  C:\Windows\System\weWWzRg.exe
  2⤵
  PID:4872
- C:\Windows\System\rwnfdpp.exe
  C:\Windows\System\rwnfdpp.exe
  2⤵
  PID:4972
- C:\Windows\System\VYlkMaA.exe
  C:\Windows\System\VYlkMaA.exe
  2⤵
  PID:5012
- C:\Windows\System\stLMoKw.exe
  C:\Windows\System\stLMoKw.exe
  2⤵
  PID:5076
- C:\Windows\System\ZBGHRKs.exe
  C:\Windows\System\ZBGHRKs.exe
  2⤵
  PID:2188
- C:\Windows\System\ZAYRftl.exe
  C:\Windows\System\ZAYRftl.exe
  2⤵
  PID:4856
- C:\Windows\System\TblGLpO.exe
  C:\Windows\System\TblGLpO.exe
  2⤵
  PID:4920
- C:\Windows\System\PEmbLHP.exe
  C:\Windows\System\PEmbLHP.exe
  2⤵
  PID:1948
- C:\Windows\System\YrpvaiS.exe
  C:\Windows\System\YrpvaiS.exe
  2⤵
  PID:4168
- C:\Windows\System\MpmNNWP.exe
  C:\Windows\System\MpmNNWP.exe
  2⤵
  PID:3996
- C:\Windows\System\vwRytHN.exe
  C:\Windows\System\vwRytHN.exe
  2⤵
  PID:4100
- C:\Windows\System\dsImZeS.exe
  C:\Windows\System\dsImZeS.exe
  2⤵
  PID:1872
- C:\Windows\System\dVfgrcn.exe
  C:\Windows\System\dVfgrcn.exe
  2⤵
  PID:4376
- C:\Windows\System\KEVZvfJ.exe
  C:\Windows\System\KEVZvfJ.exe
  2⤵
  PID:4524
- C:\Windows\System\wwOkGTd.exe
  C:\Windows\System\wwOkGTd.exe
  2⤵
  PID:2444
- C:\Windows\System\QjqQmwT.exe
  C:\Windows\System\QjqQmwT.exe
  2⤵
  PID:4640
- C:\Windows\System\tvypvoY.exe
  C:\Windows\System\tvypvoY.exe
  2⤵
  PID:4708
- C:\Windows\System\QFAhcCQ.exe
  C:\Windows\System\QFAhcCQ.exe
  2⤵
  PID:4840
- C:\Windows\System\ZNPnYak.exe
  C:\Windows\System\ZNPnYak.exe
  2⤵
  PID:5048
- C:\Windows\System\xWxFHmZ.exe
  C:\Windows\System\xWxFHmZ.exe
  2⤵
  PID:4252
- C:\Windows\System\xXwYmna.exe
  C:\Windows\System\xXwYmna.exe
  2⤵
  PID:2688
- C:\Windows\System\ooVJbwm.exe
  C:\Windows\System\ooVJbwm.exe
  2⤵
  PID:4744
- C:\Windows\System\pfuYeFr.exe
  C:\Windows\System\pfuYeFr.exe
  2⤵
  PID:5008
- C:\Windows\System\jrWgZYq.exe
  C:\Windows\System\jrWgZYq.exe
  2⤵
  PID:4892
- C:\Windows\System\xBrjhgg.exe
  C:\Windows\System\xBrjhgg.exe
  2⤵
  PID:2564
- C:\Windows\System\uNxrlfl.exe
  C:\Windows\System\uNxrlfl.exe
  2⤵
  PID:4420
- C:\Windows\System\bRINXrr.exe
  C:\Windows\System\bRINXrr.exe
  2⤵
  PID:4156
- C:\Windows\System\lvNhNgD.exe
  C:\Windows\System\lvNhNgD.exe
  2⤵
  PID:5060
- C:\Windows\System\xegSjFq.exe
  C:\Windows\System\xegSjFq.exe
  2⤵
  PID:1568
- C:\Windows\System\cFkOClH.exe
  C:\Windows\System\cFkOClH.exe
  2⤵
  PID:2728
- C:\Windows\System\YuMEQbs.exe
  C:\Windows\System\YuMEQbs.exe
  2⤵
  PID:2736
- C:\Windows\System\QTdaAxV.exe
  C:\Windows\System\QTdaAxV.exe
  2⤵
  PID:4040
- C:\Windows\System\sdgpsGq.exe
  C:\Windows\System\sdgpsGq.exe
  2⤵
  PID:4300
- C:\Windows\System\uvAlRwA.exe
  C:\Windows\System\uvAlRwA.exe
  2⤵
  PID:4360
- C:\Windows\System\TYYpUQC.exe
  C:\Windows\System\TYYpUQC.exe
  2⤵
  PID:4500
- C:\Windows\System\DhgPszG.exe
  C:\Windows\System\DhgPszG.exe
  2⤵
  PID:4468
- C:\Windows\System\inppCOR.exe
  C:\Windows\System\inppCOR.exe
  2⤵
  PID:4520
- C:\Windows\System\suSxjAf.exe
  C:\Windows\System\suSxjAf.exe
  2⤵
  PID:4660
- C:\Windows\System\qjKjyug.exe
  C:\Windows\System\qjKjyug.exe
  2⤵
  PID:4820
- C:\Windows\System\ZFUlAgz.exe
  C:\Windows\System\ZFUlAgz.exe
  2⤵
  PID:4584
- C:\Windows\System\LTDxJYk.exe
  C:\Windows\System\LTDxJYk.exe
  2⤵
  PID:4724
- C:\Windows\System\utsmjuW.exe
  C:\Windows\System\utsmjuW.exe
  2⤵
  PID:4812
- C:\Windows\System\NBsOKvh.exe
  C:\Windows\System\NBsOKvh.exe
  2⤵
  PID:5004
- C:\Windows\System\jpzinMz.exe
  C:\Windows\System\jpzinMz.exe
  2⤵
  PID:4380
- C:\Windows\System\kdUHfIo.exe
  C:\Windows\System\kdUHfIo.exe
  2⤵
  PID:4452
- C:\Windows\System\DBmmhXI.exe
  C:\Windows\System\DBmmhXI.exe
  2⤵
  PID:5028
- C:\Windows\System\lmjMzzj.exe
  C:\Windows\System\lmjMzzj.exe
  2⤵
  PID:3004
- C:\Windows\System\rQXEVLN.exe
  C:\Windows\System\rQXEVLN.exe
  2⤵
  PID:2904
- C:\Windows\System\JkEPWUq.exe
  C:\Windows\System\JkEPWUq.exe
  2⤵
  PID:4396
- C:\Windows\System\vodnqsK.exe
  C:\Windows\System\vodnqsK.exe
  2⤵
  PID:4508
- C:\Windows\System\YvVDnxM.exe
  C:\Windows\System\YvVDnxM.exe
  2⤵
  PID:4440
- C:\Windows\System\GOHtGkg.exe
  C:\Windows\System\GOHtGkg.exe
  2⤵
  PID:4548
- C:\Windows\System\IfDNfdz.exe
  C:\Windows\System\IfDNfdz.exe
  2⤵
  PID:5044
- C:\Windows\System\MHuHSDm.exe
  C:\Windows\System\MHuHSDm.exe
  2⤵
  PID:4592
- C:\Windows\System\DTIATZZ.exe
  C:\Windows\System\DTIATZZ.exe
  2⤵
  PID:4608
- C:\Windows\System\WivSpIO.exe
  C:\Windows\System\WivSpIO.exe
  2⤵
  PID:5016
- C:\Windows\System\VCaFGnn.exe
  C:\Windows\System\VCaFGnn.exe
  2⤵
  PID:4024
- C:\Windows\System\szeNAkr.exe
  C:\Windows\System\szeNAkr.exe
  2⤵
  PID:4232
- C:\Windows\System\iAJSuPw.exe
  C:\Windows\System\iAJSuPw.exe
  2⤵
  PID:4492
- C:\Windows\System\gGYaIgj.exe
  C:\Windows\System\gGYaIgj.exe
  2⤵
  PID:4472
- C:\Windows\System\poMJlrJ.exe
  C:\Windows\System\poMJlrJ.exe
  2⤵
  PID:3992
- C:\Windows\System\jubAkNS.exe
  C:\Windows\System\jubAkNS.exe
  2⤵
  PID:2600
- C:\Windows\System\nYXzcOv.exe
  C:\Windows\System\nYXzcOv.exe
  2⤵
  PID:5092
- C:\Windows\System\lWfhLWO.exe
  C:\Windows\System\lWfhLWO.exe
  2⤵
  PID:3836
- C:\Windows\System\FhjSmSB.exe
  C:\Windows\System\FhjSmSB.exe
  2⤵
  PID:2912
- C:\Windows\System\QBwOTOE.exe
  C:\Windows\System\QBwOTOE.exe
  2⤵
  PID:4792
- C:\Windows\System\BDrjUhI.exe
  C:\Windows\System\BDrjUhI.exe
  2⤵
  PID:4788
- C:\Windows\System\pgVBCbn.exe
  C:\Windows\System\pgVBCbn.exe
  2⤵
  PID:4488
- C:\Windows\System\tVmOcGG.exe
  C:\Windows\System\tVmOcGG.exe
  2⤵
  PID:5032
- C:\Windows\System\glKMrfd.exe
  C:\Windows\System\glKMrfd.exe
  2⤵
  PID:4484
- C:\Windows\System\jBvSjCU.exe
  C:\Windows\System\jBvSjCU.exe
  2⤵
  PID:5124
- C:\Windows\System\LgqEcQn.exe
  C:\Windows\System\LgqEcQn.exe
  2⤵
  PID:5140
- C:\Windows\System\ZqAxeiE.exe
  C:\Windows\System\ZqAxeiE.exe
  2⤵
  PID:5156
- C:\Windows\System\CskwOkp.exe
  C:\Windows\System\CskwOkp.exe
  2⤵
  PID:5228
- C:\Windows\System\HiOrFhH.exe
  C:\Windows\System\HiOrFhH.exe
  2⤵
  PID:5248
- C:\Windows\System\uDfOorm.exe
  C:\Windows\System\uDfOorm.exe
  2⤵
  PID:5284
- C:\Windows\System\lKszJle.exe
  C:\Windows\System\lKszJle.exe
  2⤵
  PID:5300
- C:\Windows\System\MxpAPxq.exe
  C:\Windows\System\MxpAPxq.exe
  2⤵
  PID:5316
- C:\Windows\System\levlVYd.exe
  C:\Windows\System\levlVYd.exe
  2⤵
  PID:5340
- C:\Windows\System\rtOWhzq.exe
  C:\Windows\System\rtOWhzq.exe
  2⤵
  PID:5356
- C:\Windows\System\JJmznMO.exe
  C:\Windows\System\JJmznMO.exe
  2⤵
  PID:5372
- C:\Windows\System\CoLmjND.exe
  C:\Windows\System\CoLmjND.exe
  2⤵
  PID:5388
- C:\Windows\System\pJdKKSO.exe
  C:\Windows\System\pJdKKSO.exe
  2⤵
  PID:5412
- C:\Windows\System\TkvxMfv.exe
  C:\Windows\System\TkvxMfv.exe
  2⤵
  PID:5432
- C:\Windows\System\HPWiitG.exe
  C:\Windows\System\HPWiitG.exe
  2⤵
  PID:5448
- C:\Windows\System\wMXRbop.exe
  C:\Windows\System\wMXRbop.exe
  2⤵
  PID:5468
- C:\Windows\System\WvOZLIe.exe
  C:\Windows\System\WvOZLIe.exe
  2⤵
  PID:5484
- C:\Windows\System\cWIwfJT.exe
  C:\Windows\System\cWIwfJT.exe
  2⤵
  PID:5500
- C:\Windows\System\eEarzZt.exe
  C:\Windows\System\eEarzZt.exe
  2⤵
  PID:5592
- C:\Windows\System\CQTSWaD.exe
  C:\Windows\System\CQTSWaD.exe
  2⤵
  PID:5608
- C:\Windows\System\OPAZgee.exe
  C:\Windows\System\OPAZgee.exe
  2⤵
  PID:5624
- C:\Windows\System\EjCofjn.exe
  C:\Windows\System\EjCofjn.exe
  2⤵
  PID:5652
- C:\Windows\System\hwRaWUj.exe
  C:\Windows\System\hwRaWUj.exe
  2⤵
  PID:5668
- C:\Windows\System\VokxMKD.exe
  C:\Windows\System\VokxMKD.exe
  2⤵
  PID:5684
- C:\Windows\System\ONXlCmB.exe
  C:\Windows\System\ONXlCmB.exe
  2⤵
  PID:5700
- C:\Windows\System\NhAUolh.exe
  C:\Windows\System\NhAUolh.exe
  2⤵
  PID:5736
- C:\Windows\System\cENAcME.exe
  C:\Windows\System\cENAcME.exe
  2⤵
  PID:5752
- C:\Windows\System\wyThmju.exe
  C:\Windows\System\wyThmju.exe
  2⤵
  PID:5768
- C:\Windows\System\pkMXOxN.exe
  C:\Windows\System\pkMXOxN.exe
  2⤵
  PID:5784
- C:\Windows\System\XBZotaF.exe
  C:\Windows\System\XBZotaF.exe
  2⤵
  PID:5800
- C:\Windows\System\oKklZyU.exe
  C:\Windows\System\oKklZyU.exe
  2⤵
  PID:5816
- C:\Windows\System\ymTxgZP.exe
  C:\Windows\System\ymTxgZP.exe
  2⤵
  PID:5860
- C:\Windows\System\kmKvulK.exe
  C:\Windows\System\kmKvulK.exe
  2⤵
  PID:5876
- C:\Windows\System\ZGKJAfa.exe
  C:\Windows\System\ZGKJAfa.exe
  2⤵
  PID:5892
- C:\Windows\System\ygpKxHm.exe
  C:\Windows\System\ygpKxHm.exe
  2⤵
  PID:5908
- C:\Windows\System\pIibeNd.exe
  C:\Windows\System\pIibeNd.exe
  2⤵
  PID:5940
- C:\Windows\System\YGplGNH.exe
  C:\Windows\System\YGplGNH.exe
  2⤵
  PID:5956
- C:\Windows\System\xwIYbWF.exe
  C:\Windows\System\xwIYbWF.exe
  2⤵
  PID:5972
- C:\Windows\System\NTPOnXJ.exe
  C:\Windows\System\NTPOnXJ.exe
  2⤵
  PID:5988
- C:\Windows\System\ODkQfvQ.exe
  C:\Windows\System\ODkQfvQ.exe
  2⤵
  PID:6004
- C:\Windows\System\ubtsXUN.exe
  C:\Windows\System\ubtsXUN.exe
  2⤵
  PID:6032
- C:\Windows\System\VwjrMKY.exe
  C:\Windows\System\VwjrMKY.exe
  2⤵
  PID:6048
- C:\Windows\System\VGQLXxO.exe
  C:\Windows\System\VGQLXxO.exe
  2⤵
  PID:6064
- C:\Windows\System\PZXsPKB.exe
  C:\Windows\System\PZXsPKB.exe
  2⤵
  PID:6080
- C:\Windows\System\pgwRWMZ.exe
  C:\Windows\System\pgwRWMZ.exe
  2⤵
  PID:6100
- C:\Windows\System\deoRmft.exe
  C:\Windows\System\deoRmft.exe
  2⤵
  PID:6116
- C:\Windows\System\tidsLev.exe
  C:\Windows\System\tidsLev.exe
  2⤵
  PID:6132
- C:\Windows\System\bOgspwe.exe
  C:\Windows\System\bOgspwe.exe
  2⤵
  PID:4140
- C:\Windows\System\TwCRjbT.exe
  C:\Windows\System\TwCRjbT.exe
  2⤵
  PID:5176
- C:\Windows\System\wjTBVPN.exe
  C:\Windows\System\wjTBVPN.exe
  2⤵
  PID:4552
- C:\Windows\System\UvbqsLQ.exe
  C:\Windows\System\UvbqsLQ.exe
  2⤵
  PID:5188
- C:\Windows\System\sqxqSte.exe
  C:\Windows\System\sqxqSte.exe
  2⤵
  PID:5204
- C:\Windows\System\bJJwXVY.exe
  C:\Windows\System\bJJwXVY.exe
  2⤵
  PID:5184
- C:\Windows\System\OmuvHUM.exe
  C:\Windows\System\OmuvHUM.exe
  2⤵
  PID:5276
- C:\Windows\System\uTKpvZJ.exe
  C:\Windows\System\uTKpvZJ.exe
  2⤵
  PID:5308
- C:\Windows\System\FqIOQDh.exe
  C:\Windows\System\FqIOQDh.exe
  2⤵
  PID:5380
- C:\Windows\System\BKurTiF.exe
  C:\Windows\System\BKurTiF.exe
  2⤵
  PID:5396
- C:\Windows\System\ZyZUjCP.exe
  C:\Windows\System\ZyZUjCP.exe
  2⤵
  PID:5368
- C:\Windows\System\OdsfXld.exe
  C:\Windows\System\OdsfXld.exe
  2⤵
  PID:2796
- C:\Windows\System\YKGKbcF.exe
  C:\Windows\System\YKGKbcF.exe
  2⤵
  PID:5456
- C:\Windows\System\IQpMQnI.exe
  C:\Windows\System\IQpMQnI.exe
  2⤵
  PID:5444
- C:\Windows\System\HJQOONx.exe
  C:\Windows\System\HJQOONx.exe
  2⤵
  PID:5480
- C:\Windows\System\WaxHfOt.exe
  C:\Windows\System\WaxHfOt.exe
  2⤵
  PID:5512
- C:\Windows\System\pTehAsd.exe
  C:\Windows\System\pTehAsd.exe
  2⤵
  PID:5536
- C:\Windows\System\bbWGCkx.exe
  C:\Windows\System\bbWGCkx.exe
  2⤵
  PID:5552
- C:\Windows\System\wieoyhd.exe
  C:\Windows\System\wieoyhd.exe
  2⤵
  PID:5568
- C:\Windows\System\SVMyxMh.exe
  C:\Windows\System\SVMyxMh.exe
  2⤵
  PID:5584
- C:\Windows\System\NaujOoa.exe
  C:\Windows\System\NaujOoa.exe
  2⤵
  PID:5616
- C:\Windows\System\FyHztbq.exe
  C:\Windows\System\FyHztbq.exe
  2⤵
  PID:5636
- C:\Windows\System\nlIhRWC.exe
  C:\Windows\System\nlIhRWC.exe
  2⤵
  PID:5660
- C:\Windows\System\HIghqmi.exe
  C:\Windows\System\HIghqmi.exe
  2⤵
  PID:5676
- C:\Windows\System\sMkizbx.exe
  C:\Windows\System\sMkizbx.exe
  2⤵
  PID:5716
- C:\Windows\System\KvKUmHN.exe
  C:\Windows\System\KvKUmHN.exe
  2⤵
  PID:5744
- C:\Windows\System\EwxPDRf.exe
  C:\Windows\System\EwxPDRf.exe
  2⤵
  PID:5776
- C:\Windows\System\FjTGqGM.exe
  C:\Windows\System\FjTGqGM.exe
  2⤵
  PID:5828
- C:\Windows\System\dXrXzFG.exe
  C:\Windows\System\dXrXzFG.exe
  2⤵
  PID:5832
- C:\Windows\System\QrKUQSd.exe
  C:\Windows\System\QrKUQSd.exe
  2⤵
  PID:5848
- C:\Windows\System\NpGKXJQ.exe
  C:\Windows\System\NpGKXJQ.exe
  2⤵
  PID:5872
- C:\Windows\System\fuEzeSz.exe
  C:\Windows\System\fuEzeSz.exe
  2⤵
  PID:5900
- C:\Windows\System\ttwcWFZ.exe
  C:\Windows\System\ttwcWFZ.exe
  2⤵
  PID:5932
- C:\Windows\System\Ajcmecs.exe
  C:\Windows\System\Ajcmecs.exe
  2⤵
  PID:5964
- C:\Windows\System\nHZOBuc.exe
  C:\Windows\System\nHZOBuc.exe
  2⤵
  PID:6000
- C:\Windows\System\PvGYQLS.exe
  C:\Windows\System\PvGYQLS.exe
  2⤵
  PID:6028
- C:\Windows\System\ivThpvI.exe
  C:\Windows\System\ivThpvI.exe
  2⤵
  PID:6040
- C:\Windows\System\uPYRhdW.exe
  C:\Windows\System\uPYRhdW.exe
  2⤵
  PID:6108
- C:\Windows\System\OqwgUnu.exe
  C:\Windows\System\OqwgUnu.exe
  2⤵
  PID:6140
- C:\Windows\System\Tscpict.exe
  C:\Windows\System\Tscpict.exe
  2⤵
  PID:6088
- C:\Windows\System\conzauY.exe
  C:\Windows\System\conzauY.exe
  2⤵
  PID:5164
- C:\Windows\System\gYSEras.exe
  C:\Windows\System\gYSEras.exe
  2⤵
  PID:6096
- C:\Windows\System\JFWckNn.exe
  C:\Windows\System\JFWckNn.exe
  2⤵
  PID:5212
- C:\Windows\System\RHLfePe.exe
  C:\Windows\System\RHLfePe.exe
  2⤵
  PID:5224
- C:\Windows\System\DNICtJP.exe
  C:\Windows\System\DNICtJP.exe
  2⤵
  PID:5312
- C:\Windows\System\xKXPkxA.exe
  C:\Windows\System\xKXPkxA.exe
  2⤵
  PID:5328
- C:\Windows\System\CprmoDD.exe
  C:\Windows\System\CprmoDD.exe
  2⤵
  PID:5292
- C:\Windows\System\hOjYdeo.exe
  C:\Windows\System\hOjYdeo.exe
  2⤵
  PID:5544
- C:\Windows\System\OozAMPM.exe
  C:\Windows\System\OozAMPM.exe
  2⤵
  PID:5404
- C:\Windows\System\OyovTem.exe
  C:\Windows\System\OyovTem.exe
  2⤵
  PID:5580
- C:\Windows\System\EETUgCy.exe
  C:\Windows\System\EETUgCy.exe
  2⤵
  PID:5508
- C:\Windows\System\NxjUyoL.exe
  C:\Windows\System\NxjUyoL.exe
  2⤵
  PID:5732
- C:\Windows\System\ERdgOGU.exe
  C:\Windows\System\ERdgOGU.exe
  2⤵
  PID:5796
- C:\Windows\System\lgFCeen.exe
  C:\Windows\System\lgFCeen.exe
  2⤵
  PID:5428
- C:\Windows\System\yCVexue.exe
  C:\Windows\System\yCVexue.exe
  2⤵
  PID:5696
- C:\Windows\System\MycHiCM.exe
  C:\Windows\System\MycHiCM.exe
  2⤵
  PID:5780
- C:\Windows\System\yLBhyvp.exe
  C:\Windows\System\yLBhyvp.exe
  2⤵
  PID:5904
- C:\Windows\System\EJkIlsW.exe
  C:\Windows\System\EJkIlsW.exe
  2⤵
  PID:5192
- C:\Windows\System\NiaFvJJ.exe
  C:\Windows\System\NiaFvJJ.exe
  2⤵
  PID:5936
- C:\Windows\System\xwyBbYh.exe
  C:\Windows\System\xwyBbYh.exe
  2⤵
  PID:4908
- C:\Windows\System\cmuafWT.exe
  C:\Windows\System\cmuafWT.exe
  2⤵
  PID:5256
- C:\Windows\System\ZbLGiea.exe
  C:\Windows\System\ZbLGiea.exe
  2⤵
  PID:5924
- C:\Windows\System\BeKCHRW.exe
  C:\Windows\System\BeKCHRW.exe
  2⤵
  PID:5200
- C:\Windows\System\oTuPDPo.exe
  C:\Windows\System\oTuPDPo.exe
  2⤵
  PID:5364
- C:\Windows\System\EiNhVIC.exe
  C:\Windows\System\EiNhVIC.exe
  2⤵
  PID:5640
- C:\Windows\System\TmOXhXI.exe
  C:\Windows\System\TmOXhXI.exe
  2⤵
  PID:5648
- C:\Windows\System\tgyuxaN.exe
  C:\Windows\System\tgyuxaN.exe
  2⤵
  PID:6024
- C:\Windows\System\zPuLEkn.exe
  C:\Windows\System\zPuLEkn.exe
  2⤵
  PID:6020
- C:\Windows\System\wsFfvTp.exe
  C:\Windows\System\wsFfvTp.exe
  2⤵
  PID:5948
- C:\Windows\System\nwgtQcB.exe
  C:\Windows\System\nwgtQcB.exe
  2⤵
  PID:5884
- C:\Windows\System\YdwCJxd.exe
  C:\Windows\System\YdwCJxd.exe
  2⤵
  PID:5576
- C:\Windows\System\gQzLshp.exe
  C:\Windows\System\gQzLshp.exe
  2⤵
  PID:5600
- C:\Windows\System\WzIkZtU.exe
  C:\Windows\System\WzIkZtU.exe
  2⤵
  PID:5520
- C:\Windows\System\AZjgZGq.exe
  C:\Windows\System\AZjgZGq.exe
  2⤵
  PID:5564
- C:\Windows\System\ctLletl.exe
  C:\Windows\System\ctLletl.exe
  2⤵
  PID:5136
- C:\Windows\System\PYTgOZT.exe
  C:\Windows\System\PYTgOZT.exe
  2⤵
  PID:5348
- C:\Windows\System\lKBXFom.exe
  C:\Windows\System\lKBXFom.exe
  2⤵
  PID:5180
- C:\Windows\System\Nupsnti.exe
  C:\Windows\System\Nupsnti.exe
  2⤵
  PID:5868
- C:\Windows\System\hrkEopK.exe
  C:\Windows\System\hrkEopK.exe
  2⤵
  PID:5764
- C:\Windows\System\JxDLSCS.exe
  C:\Windows\System\JxDLSCS.exe
  2⤵
  PID:5968
- C:\Windows\System\FUhxERX.exe
  C:\Windows\System\FUhxERX.exe
  2⤵
  PID:5460
- C:\Windows\System\vIaHGcR.exe
  C:\Windows\System\vIaHGcR.exe
  2⤵
  PID:6156
- C:\Windows\System\IFxWEOH.exe
  C:\Windows\System\IFxWEOH.exe
  2⤵
  PID:6172
- C:\Windows\System\nXloNoC.exe
  C:\Windows\System\nXloNoC.exe
  2⤵
  PID:6188
- C:\Windows\System\AHiqHCL.exe
  C:\Windows\System\AHiqHCL.exe
  2⤵
  PID:6204
- C:\Windows\System\JrrtJQm.exe
  C:\Windows\System\JrrtJQm.exe
  2⤵
  PID:6220
- C:\Windows\System\VgWeMfs.exe
  C:\Windows\System\VgWeMfs.exe
  2⤵
  PID:6236
- C:\Windows\System\sgXOYXX.exe
  C:\Windows\System\sgXOYXX.exe
  2⤵
  PID:6252
- C:\Windows\System\iZaqHpI.exe
  C:\Windows\System\iZaqHpI.exe
  2⤵
  PID:6268
- C:\Windows\System\jRhuBvM.exe
  C:\Windows\System\jRhuBvM.exe
  2⤵
  PID:6284
- C:\Windows\System\UskCeQQ.exe
  C:\Windows\System\UskCeQQ.exe
  2⤵
  PID:6300
- C:\Windows\System\FpZWSOE.exe
  C:\Windows\System\FpZWSOE.exe
  2⤵
  PID:6316
- C:\Windows\System\URZZSgH.exe
  C:\Windows\System\URZZSgH.exe
  2⤵
  PID:6332
- C:\Windows\System\MLnsuql.exe
  C:\Windows\System\MLnsuql.exe
  2⤵
  PID:6348
- C:\Windows\System\GrrjjNM.exe
  C:\Windows\System\GrrjjNM.exe
  2⤵
  PID:6364
- C:\Windows\System\tBQTqSZ.exe
  C:\Windows\System\tBQTqSZ.exe
  2⤵
  PID:6380
- C:\Windows\System\tMdCWoW.exe
  C:\Windows\System\tMdCWoW.exe
  2⤵
  PID:6396
- C:\Windows\System\DieQnqx.exe
  C:\Windows\System\DieQnqx.exe
  2⤵
  PID:6412
- C:\Windows\System\duWrfbf.exe
  C:\Windows\System\duWrfbf.exe
  2⤵
  PID:6428
- C:\Windows\System\MlfmojF.exe
  C:\Windows\System\MlfmojF.exe
  2⤵
  PID:6444
- C:\Windows\System\eOMlSWI.exe
  C:\Windows\System\eOMlSWI.exe
  2⤵
  PID:6460
- C:\Windows\System\lNmnqDI.exe
  C:\Windows\System\lNmnqDI.exe
  2⤵
  PID:6476
- C:\Windows\System\VFTBLmI.exe
  C:\Windows\System\VFTBLmI.exe
  2⤵
  PID:6492
- C:\Windows\System\PCXWxeh.exe
  C:\Windows\System\PCXWxeh.exe
  2⤵
  PID:6588
- C:\Windows\System\mbZQchl.exe
  C:\Windows\System\mbZQchl.exe
  2⤵
  PID:6608
- C:\Windows\System\PmrDNXK.exe
  C:\Windows\System\PmrDNXK.exe
  2⤵
  PID:6628
- C:\Windows\System\zqPrbgx.exe
  C:\Windows\System\zqPrbgx.exe
  2⤵
  PID:6644
- C:\Windows\System\uOybmUe.exe
  C:\Windows\System\uOybmUe.exe
  2⤵
  PID:6660
- C:\Windows\System\CDuTTXz.exe
  C:\Windows\System\CDuTTXz.exe
  2⤵
  PID:6680
- C:\Windows\System\fxBzCEM.exe
  C:\Windows\System\fxBzCEM.exe
  2⤵
  PID:6700
- C:\Windows\System\GYlkyCn.exe
  C:\Windows\System\GYlkyCn.exe
  2⤵
  PID:6720
- C:\Windows\System\DAwxkGp.exe
  C:\Windows\System\DAwxkGp.exe
  2⤵
  PID:6736
- C:\Windows\System\lvKFxLu.exe
  C:\Windows\System\lvKFxLu.exe
  2⤵
  PID:6752
- C:\Windows\System\QpHdbxm.exe
  C:\Windows\System\QpHdbxm.exe
  2⤵
  PID:6768
- C:\Windows\System\xEvdsBX.exe
  C:\Windows\System\xEvdsBX.exe
  2⤵
  PID:6784
- C:\Windows\System\EsrzSrT.exe
  C:\Windows\System\EsrzSrT.exe
  2⤵
  PID:6800
- C:\Windows\System\DvNiRcK.exe
  C:\Windows\System\DvNiRcK.exe
  2⤵
  PID:6816
- C:\Windows\System\gIsteLn.exe
  C:\Windows\System\gIsteLn.exe
  2⤵
  PID:6832
- C:\Windows\System\UooFOom.exe
  C:\Windows\System\UooFOom.exe
  2⤵
  PID:6848
- C:\Windows\System\urtzeRD.exe
  C:\Windows\System\urtzeRD.exe
  2⤵
  PID:6864
- C:\Windows\System\RZIEkWD.exe
  C:\Windows\System\RZIEkWD.exe
  2⤵
  PID:6880
- C:\Windows\System\puoKBxa.exe
  C:\Windows\System\puoKBxa.exe
  2⤵
  PID:6896
- C:\Windows\System\AmEhFfL.exe
  C:\Windows\System\AmEhFfL.exe
  2⤵
  PID:6912
- C:\Windows\System\pyUbVQr.exe
  C:\Windows\System\pyUbVQr.exe
  2⤵
  PID:6928
- C:\Windows\System\puagFXA.exe
  C:\Windows\System\puagFXA.exe
  2⤵
  PID:6944
- C:\Windows\System\mwJqOvp.exe
  C:\Windows\System\mwJqOvp.exe
  2⤵
  PID:6960
- C:\Windows\System\phpILIe.exe
  C:\Windows\System\phpILIe.exe
  2⤵
  PID:6976
- C:\Windows\System\NNCkInP.exe
  C:\Windows\System\NNCkInP.exe
  2⤵
  PID:6992
- C:\Windows\System\fnBYcHc.exe
  C:\Windows\System\fnBYcHc.exe
  2⤵
  PID:7008
- C:\Windows\System\DOneNAd.exe
  C:\Windows\System\DOneNAd.exe
  2⤵
  PID:7024
- C:\Windows\System\PgMjBEO.exe
  C:\Windows\System\PgMjBEO.exe
  2⤵
  PID:7040
- C:\Windows\System\GHalifO.exe
  C:\Windows\System\GHalifO.exe
  2⤵
  PID:7056
- C:\Windows\System\QPLFFyP.exe
  C:\Windows\System\QPLFFyP.exe
  2⤵
  PID:7072
- C:\Windows\System\UdaoFFD.exe
  C:\Windows\System\UdaoFFD.exe
  2⤵
  PID:7088
- C:\Windows\System\roQxJoh.exe
  C:\Windows\System\roQxJoh.exe
  2⤵
  PID:7108
- C:\Windows\System\VukTqqj.exe
  C:\Windows\System\VukTqqj.exe
  2⤵
  PID:7124
- C:\Windows\System\oOQIlWE.exe
  C:\Windows\System\oOQIlWE.exe
  2⤵
  PID:7140
- C:\Windows\System\avUhwVC.exe
  C:\Windows\System\avUhwVC.exe
  2⤵
  PID:6228
- C:\Windows\System\dUQFWQQ.exe
  C:\Windows\System\dUQFWQQ.exe
  2⤵
  PID:6340
- C:\Windows\System\bqnqnvF.exe
  C:\Windows\System\bqnqnvF.exe
  2⤵
  PID:6424
- C:\Windows\System\WqisiGG.exe
  C:\Windows\System\WqisiGG.exe
  2⤵
  PID:6472
- C:\Windows\System\NaBbLPl.exe
  C:\Windows\System\NaBbLPl.exe
  2⤵
  PID:6500
- C:\Windows\System\GcRPhCL.exe
  C:\Windows\System\GcRPhCL.exe
  2⤵
  PID:6512
- C:\Windows\System\HGHKaBY.exe
  C:\Windows\System\HGHKaBY.exe
  2⤵
  PID:6528
- C:\Windows\System\mmMMBCG.exe
  C:\Windows\System\mmMMBCG.exe
  2⤵
  PID:6540
- C:\Windows\System\gZrFdtE.exe
  C:\Windows\System\gZrFdtE.exe
  2⤵
  PID:6560
- C:\Windows\System\OSPPiCL.exe
  C:\Windows\System\OSPPiCL.exe
  2⤵
  PID:6576
- C:\Windows\System\QZjDIZe.exe
  C:\Windows\System\QZjDIZe.exe
  2⤵
  PID:6620
- C:\Windows\System\HsDvTMT.exe
  C:\Windows\System\HsDvTMT.exe
  2⤵
  PID:6636
- C:\Windows\System\nOlWBRX.exe
  C:\Windows\System\nOlWBRX.exe
  2⤵
  PID:6728
- C:\Windows\System\aZRLCxi.exe
  C:\Windows\System\aZRLCxi.exe
  2⤵
  PID:6708
- C:\Windows\System\yiFxZgF.exe
  C:\Windows\System\yiFxZgF.exe
  2⤵
  PID:6600
- C:\Windows\System\uHHkoyp.exe
  C:\Windows\System\uHHkoyp.exe
  2⤵
  PID:6904
- C:\Windows\System\FmiyiJp.exe
  C:\Windows\System\FmiyiJp.exe
  2⤵
  PID:6828
- C:\Windows\System\NzVoJqb.exe
  C:\Windows\System\NzVoJqb.exe
  2⤵
  PID:6892
- C:\Windows\System\dnUCZLw.exe
  C:\Windows\System\dnUCZLw.exe
  2⤵
  PID:6956
- C:\Windows\System\PjYzHoY.exe
  C:\Windows\System\PjYzHoY.exe
  2⤵
  PID:7020
- C:\Windows\System\rESsMui.exe
  C:\Windows\System\rESsMui.exe
  2⤵
  PID:7084
- C:\Windows\System\ogUlCzj.exe
  C:\Windows\System\ogUlCzj.exe
  2⤵
  PID:7148
- C:\Windows\System\pSkBXGM.exe
  C:\Windows\System\pSkBXGM.exe
  2⤵
  PID:6972
- C:\Windows\System\nYUCFAY.exe
  C:\Windows\System\nYUCFAY.exe
  2⤵
  PID:7096
- C:\Windows\System\RQSfWOZ.exe
  C:\Windows\System\RQSfWOZ.exe
  2⤵
  PID:6776
- C:\Windows\System\cWtqlPr.exe
  C:\Windows\System\cWtqlPr.exe
  2⤵
  PID:6792
- C:\Windows\System\VeucVZT.exe
  C:\Windows\System\VeucVZT.exe
  2⤵
  PID:6744
- C:\Windows\System\mIKhaqU.exe
  C:\Windows\System\mIKhaqU.exe
  2⤵
  PID:6840
- C:\Windows\System\uUIkgIW.exe
  C:\Windows\System\uUIkgIW.exe
  2⤵
  PID:6148
- C:\Windows\System\fwIyQpe.exe
  C:\Windows\System\fwIyQpe.exe
  2⤵
  PID:5268
- C:\Windows\System\ldtutVV.exe
  C:\Windows\System\ldtutVV.exe
  2⤵
  PID:6168
- C:\Windows\System\hqebDoQ.exe
  C:\Windows\System\hqebDoQ.exe
  2⤵
  PID:6232
- C:\Windows\System\RwFamvw.exe
  C:\Windows\System\RwFamvw.exe
  2⤵
  PID:6260
- C:\Windows\System\fJIZzLp.exe
  C:\Windows\System\fJIZzLp.exe
  2⤵
  PID:6356
- C:\Windows\System\rUynZfK.exe
  C:\Windows\System\rUynZfK.exe
  2⤵
  PID:6276
- C:\Windows\System\NRBAmYb.exe
  C:\Windows\System\NRBAmYb.exe
  2⤵
  PID:6376
- C:\Windows\System\TyScIEa.exe
  C:\Windows\System\TyScIEa.exe
  2⤵
  PID:6484
- C:\Windows\System\GHpTBmr.exe
  C:\Windows\System\GHpTBmr.exe
  2⤵
  PID:6372
- C:\Windows\System\UglFzJr.exe
  C:\Windows\System\UglFzJr.exe
  2⤵
  PID:6536
- C:\Windows\System\pccdVoF.exe
  C:\Windows\System\pccdVoF.exe
  2⤵
  PID:6572
- C:\Windows\System\mjzjRZZ.exe
  C:\Windows\System\mjzjRZZ.exe
  2⤵
  PID:6860
- C:\Windows\System\QyDqofp.exe
  C:\Windows\System\QyDqofp.exe
  2⤵
  PID:6764
- C:\Windows\System\IwDukPe.exe
  C:\Windows\System\IwDukPe.exe
  2⤵
  PID:6716
- C:\Windows\System\qkvQiYL.exe
  C:\Windows\System\qkvQiYL.exe
  2⤵
  PID:6440
- C:\Windows\System\SWuMGIh.exe
  C:\Windows\System\SWuMGIh.exe
  2⤵
  PID:6196
- C:\Windows\System\FWXEwrt.exe
  C:\Windows\System\FWXEwrt.exe
  2⤵
  PID:6688
- C:\Windows\System\daEKiPc.exe
  C:\Windows\System\daEKiPc.exe
  2⤵
  PID:6164
- C:\Windows\System\igjCGNG.exe
  C:\Windows\System\igjCGNG.exe
  2⤵
  PID:6616
- C:\Windows\System\jHejUkp.exe
  C:\Windows\System\jHejUkp.exe
  2⤵
  PID:6200
- C:\Windows\System\sTFhclS.exe
  C:\Windows\System\sTFhclS.exe
  2⤵
  PID:7052
- C:\Windows\System\RjQRUTU.exe
  C:\Windows\System\RjQRUTU.exe
  2⤵
  PID:7164
- C:\Windows\System\mCvvBSY.exe
  C:\Windows\System\mCvvBSY.exe
  2⤵
  PID:5440
- C:\Windows\System\amaZiFl.exe
  C:\Windows\System\amaZiFl.exe
  2⤵
  PID:6360
- C:\Windows\System\xAhydoU.exe
  C:\Windows\System\xAhydoU.exe
  2⤵
  PID:6280
- C:\Windows\System\IReLQLz.exe
  C:\Windows\System\IReLQLz.exe
  2⤵
  PID:6504
- C:\Windows\System\MubZUTq.exe
  C:\Windows\System\MubZUTq.exe
  2⤵
  PID:7016
- C:\Windows\System\UrNNvKg.exe
  C:\Windows\System\UrNNvKg.exe
  2⤵
  PID:7036
- C:\Windows\System\AdRVVSp.exe
  C:\Windows\System\AdRVVSp.exe
  2⤵
  PID:5236
- C:\Windows\System\NbXvTAg.exe
  C:\Windows\System\NbXvTAg.exe
  2⤵
  PID:6532
- C:\Windows\System\gFOkFrH.exe
  C:\Windows\System\gFOkFrH.exe
  2⤵
  PID:7068
- C:\Windows\System\sTfKOLi.exe
  C:\Windows\System\sTfKOLi.exe
  2⤵
  PID:6184
- C:\Windows\System\tuVAXJH.exe
  C:\Windows\System\tuVAXJH.exe
  2⤵
  PID:6920
- C:\Windows\System\xSnvAKq.exe
  C:\Windows\System\xSnvAKq.exe
  2⤵
  PID:6296
- C:\Windows\System\hHTXuvK.exe
  C:\Windows\System\hHTXuvK.exe
  2⤵
  PID:7160
- C:\Windows\System\BATjOxR.exe
  C:\Windows\System\BATjOxR.exe
  2⤵
  PID:6312
- C:\Windows\System\cSXcCvl.exe
  C:\Windows\System\cSXcCvl.exe
  2⤵
  PID:7064
- C:\Windows\System\hQchrCz.exe
  C:\Windows\System\hQchrCz.exe
  2⤵
  PID:6812
- C:\Windows\System\vaHisFt.exe
  C:\Windows\System\vaHisFt.exe
  2⤵
  PID:6780
- C:\Windows\System\mwUIYYZ.exe
  C:\Windows\System\mwUIYYZ.exe
  2⤵
  PID:7176
- C:\Windows\System\cZImjtq.exe
  C:\Windows\System\cZImjtq.exe
  2⤵
  PID:7192
- C:\Windows\System\nhsDJYT.exe
  C:\Windows\System\nhsDJYT.exe
  2⤵
  PID:7208
- C:\Windows\System\WZGdeKS.exe
  C:\Windows\System\WZGdeKS.exe
  2⤵
  PID:7228
- C:\Windows\System\IdZHuMf.exe
  C:\Windows\System\IdZHuMf.exe
  2⤵
  PID:7244
- C:\Windows\System\icMqQmw.exe
  C:\Windows\System\icMqQmw.exe
  2⤵
  PID:7260
- C:\Windows\System\SePXNYk.exe
  C:\Windows\System\SePXNYk.exe
  2⤵
  PID:7280
- C:\Windows\System\fNRnRZR.exe
  C:\Windows\System\fNRnRZR.exe
  2⤵
  PID:7296
- C:\Windows\System\vDXeVJW.exe
  C:\Windows\System\vDXeVJW.exe
  2⤵
  PID:7316
- C:\Windows\System\sDCsZRe.exe
  C:\Windows\System\sDCsZRe.exe
  2⤵
  PID:7332
- C:\Windows\System\fyuLTYI.exe
  C:\Windows\System\fyuLTYI.exe
  2⤵
  PID:7348
- C:\Windows\System\EQEegTT.exe
  C:\Windows\System\EQEegTT.exe
  2⤵
  PID:7368
- C:\Windows\System\XOwyNVG.exe
  C:\Windows\System\XOwyNVG.exe
  2⤵
  PID:7384
- C:\Windows\System\lLqkMvS.exe
  C:\Windows\System\lLqkMvS.exe
  2⤵
  PID:7400
- C:\Windows\System\VQIDWSP.exe
  C:\Windows\System\VQIDWSP.exe
  2⤵
  PID:7416
- C:\Windows\System\mdzvGVs.exe
  C:\Windows\System\mdzvGVs.exe
  2⤵
  PID:7432
- C:\Windows\System\ATNxqRV.exe
  C:\Windows\System\ATNxqRV.exe
  2⤵
  PID:7448
- C:\Windows\System\eInnjfJ.exe
  C:\Windows\System\eInnjfJ.exe
  2⤵
  PID:7468
- C:\Windows\System\LtHujqM.exe
  C:\Windows\System\LtHujqM.exe
  2⤵
  PID:7484
- C:\Windows\System\AGfRlTH.exe
  C:\Windows\System\AGfRlTH.exe
  2⤵
  PID:7500
- C:\Windows\System\LTeWUwo.exe
  C:\Windows\System\LTeWUwo.exe
  2⤵
  PID:7520
- C:\Windows\System\ygUQvDQ.exe
  C:\Windows\System\ygUQvDQ.exe
  2⤵
  PID:7536
- C:\Windows\System\XQRWAQJ.exe
  C:\Windows\System\XQRWAQJ.exe
  2⤵
  PID:7552
- C:\Windows\System\eahOjMe.exe
  C:\Windows\System\eahOjMe.exe
  2⤵
  PID:7568
- C:\Windows\System\cNwvRxC.exe
  C:\Windows\System\cNwvRxC.exe
  2⤵
  PID:7584
- C:\Windows\System\iilMXDq.exe
  C:\Windows\System\iilMXDq.exe
  2⤵
  PID:7604
- C:\Windows\System\VimVFfn.exe
  C:\Windows\System\VimVFfn.exe
  2⤵
  PID:7620
- C:\Windows\System\joGNZrF.exe
  C:\Windows\System\joGNZrF.exe
  2⤵
  PID:7636
- C:\Windows\System\ElkGVEd.exe
  C:\Windows\System\ElkGVEd.exe
  2⤵
  PID:7652
- C:\Windows\System\hBfNbBm.exe
  C:\Windows\System\hBfNbBm.exe
  2⤵
  PID:7672
- C:\Windows\System\oegMZzQ.exe
  C:\Windows\System\oegMZzQ.exe
  2⤵
  PID:7692
- C:\Windows\System\MKBXMid.exe
  C:\Windows\System\MKBXMid.exe
  2⤵
  PID:7712
- C:\Windows\System\lAuFOXM.exe
  C:\Windows\System\lAuFOXM.exe
  2⤵
  PID:7728
- C:\Windows\System\GNaDbAC.exe
  C:\Windows\System\GNaDbAC.exe
  2⤵
  PID:7744
- C:\Windows\System\LhQAHfi.exe
  C:\Windows\System\LhQAHfi.exe
  2⤵
  PID:7760
- C:\Windows\System\MGRDywG.exe
  C:\Windows\System\MGRDywG.exe
  2⤵
  PID:7776
- C:\Windows\System\tJEdsXG.exe
  C:\Windows\System\tJEdsXG.exe
  2⤵
  PID:7796
- C:\Windows\System\ldZMMpx.exe
  C:\Windows\System\ldZMMpx.exe
  2⤵
  PID:7812
- C:\Windows\System\TTFOARk.exe
  C:\Windows\System\TTFOARk.exe
  2⤵
  PID:7832
- C:\Windows\System\NVFMtxs.exe
  C:\Windows\System\NVFMtxs.exe
  2⤵
  PID:7848
- C:\Windows\System\BxIZnQc.exe
  C:\Windows\System\BxIZnQc.exe
  2⤵
  PID:7864
- C:\Windows\System\fTIUBIP.exe
  C:\Windows\System\fTIUBIP.exe
  2⤵
  PID:7880
- C:\Windows\System\XWHHKtC.exe
  C:\Windows\System\XWHHKtC.exe
  2⤵
  PID:7900
- C:\Windows\System\eJhPRgL.exe
  C:\Windows\System\eJhPRgL.exe
  2⤵
  PID:7916
- C:\Windows\System\wvUmkQQ.exe
  C:\Windows\System\wvUmkQQ.exe
  2⤵
  PID:7932
- C:\Windows\System\HuVevmX.exe
  C:\Windows\System\HuVevmX.exe
  2⤵
  PID:7948
- C:\Windows\System\JgBsCiB.exe
  C:\Windows\System\JgBsCiB.exe
  2⤵
  PID:7964
- C:\Windows\System\XxZqrmf.exe
  C:\Windows\System\XxZqrmf.exe
  2⤵
  PID:7984
- C:\Windows\System\AtqGKxe.exe
  C:\Windows\System\AtqGKxe.exe
  2⤵
  PID:8000
- C:\Windows\System\RiyVBWS.exe
  C:\Windows\System\RiyVBWS.exe
  2⤵
  PID:8020
- C:\Windows\System\GrwORPX.exe
  C:\Windows\System\GrwORPX.exe
  2⤵
  PID:8036
- C:\Windows\System\XLylwJu.exe
  C:\Windows\System\XLylwJu.exe
  2⤵
  PID:8052
- C:\Windows\System\YjdYonn.exe
  C:\Windows\System\YjdYonn.exe
  2⤵
  PID:8072
- C:\Windows\System\CQinGMQ.exe
  C:\Windows\System\CQinGMQ.exe
  2⤵
  PID:8088
- C:\Windows\System\pCVeZqd.exe
  C:\Windows\System\pCVeZqd.exe
  2⤵
  PID:8104
- C:\Windows\System\AGljses.exe
  C:\Windows\System\AGljses.exe
  2⤵
  PID:8120
- C:\Windows\System\KzPrsMi.exe
  C:\Windows\System\KzPrsMi.exe
  2⤵
  PID:8140
- C:\Windows\System\oknoXTp.exe
  C:\Windows\System\oknoXTp.exe
  2⤵
  PID:8156
- C:\Windows\System\ucuddGC.exe
  C:\Windows\System\ucuddGC.exe
  2⤵
  PID:8172
- C:\Windows\System\ExkAmwN.exe
  C:\Windows\System\ExkAmwN.exe
  2⤵
  PID:8188
- C:\Windows\System\LSCpGDb.exe
  C:\Windows\System\LSCpGDb.exe
  2⤵
  PID:7220
- C:\Windows\System\BZmOeqK.exe
  C:\Windows\System\BZmOeqK.exe
  2⤵
  PID:7292
- C:\Windows\System\myaIEbD.exe
  C:\Windows\System\myaIEbD.exe
  2⤵
  PID:6924
- C:\Windows\System\AdeVRev.exe
  C:\Windows\System\AdeVRev.exe
  2⤵
  PID:7272
- C:\Windows\System\tfeUYZC.exe
  C:\Windows\System\tfeUYZC.exe
  2⤵
  PID:6328
- C:\Windows\System\WdPCsyN.exe
  C:\Windows\System\WdPCsyN.exe
  2⤵
  PID:7172
- C:\Windows\System\wlXrRTX.exe
  C:\Windows\System\wlXrRTX.exe
  2⤵
  PID:7236
- C:\Windows\System\Iavdzyr.exe
  C:\Windows\System\Iavdzyr.exe
  2⤵
  PID:7328
- C:\Windows\System\RdlmNVo.exe
  C:\Windows\System\RdlmNVo.exe
  2⤵
  PID:7392
- C:\Windows\System\ckIkDOh.exe
  C:\Windows\System\ckIkDOh.exe
  2⤵
  PID:7376
- C:\Windows\System\bPTPwoi.exe
  C:\Windows\System\bPTPwoi.exe
  2⤵
  PID:7456
- C:\Windows\System\iWQRNbj.exe
  C:\Windows\System\iWQRNbj.exe
  2⤵
  PID:7496
- C:\Windows\System\mhEYepd.exe
  C:\Windows\System\mhEYepd.exe
  2⤵
  PID:7476
- C:\Windows\System\yUHXPPq.exe
  C:\Windows\System\yUHXPPq.exe
  2⤵
  PID:7480
- C:\Windows\System\SfTHdYN.exe
  C:\Windows\System\SfTHdYN.exe
  2⤵
  PID:7564
- C:\Windows\System\UFjKhoq.exe
  C:\Windows\System\UFjKhoq.exe
  2⤵
  PID:7628
- C:\Windows\System\YajbvmC.exe
  C:\Windows\System\YajbvmC.exe
  2⤵
  PID:7616
- C:\Windows\System\OQijPhL.exe
  C:\Windows\System\OQijPhL.exe
  2⤵
  PID:7664
- C:\Windows\System\VVKZJDZ.exe
  C:\Windows\System\VVKZJDZ.exe
  2⤵
  PID:7736
- C:\Windows\System\dmISPwD.exe
  C:\Windows\System\dmISPwD.exe
  2⤵
  PID:7808
- C:\Windows\System\jQWuoTM.exe
  C:\Windows\System\jQWuoTM.exe
  2⤵
  PID:7876
- C:\Windows\System\ANzCjIP.exe
  C:\Windows\System\ANzCjIP.exe
  2⤵
  PID:7940
- C:\Windows\System\wmNeUut.exe
  C:\Windows\System\wmNeUut.exe
  2⤵
  PID:8008
- C:\Windows\System\CCszhuL.exe
  C:\Windows\System\CCszhuL.exe
  2⤵
  PID:8048
- C:\Windows\System\mIwqHzq.exe
  C:\Windows\System\mIwqHzq.exe
  2⤵
  PID:8116
- C:\Windows\System\VsmRdiu.exe
  C:\Windows\System\VsmRdiu.exe
  2⤵
  PID:7648
- C:\Windows\System\EhiSWZS.exe
  C:\Windows\System\EhiSWZS.exe
  2⤵
  PID:7856
- C:\Windows\System\jLOMvAI.exe
  C:\Windows\System\jLOMvAI.exe
  2⤵
  PID:7892
- C:\Windows\System\tsENHqD.exe
  C:\Windows\System\tsENHqD.exe
  2⤵
  PID:7956
- C:\Windows\System\lwcekSW.exe
  C:\Windows\System\lwcekSW.exe
  2⤵
  PID:8096
- C:\Windows\System\fFiGxIJ.exe
  C:\Windows\System\fFiGxIJ.exe
  2⤵
  PID:8064
- C:\Windows\System\rLdyIxW.exe
  C:\Windows\System\rLdyIxW.exe
  2⤵
  PID:7256
- C:\Windows\System\PClTCmp.exe
  C:\Windows\System\PClTCmp.exe
  2⤵
  PID:7960
- C:\Windows\System\ljuAjEI.exe
  C:\Windows\System\ljuAjEI.exe
  2⤵
  PID:8032
- C:\Windows\System\VYGSkJi.exe
  C:\Windows\System\VYGSkJi.exe
  2⤵
  PID:7216
- C:\Windows\System\PXiuHxH.exe
  C:\Windows\System\PXiuHxH.exe
  2⤵
  PID:7324
- C:\Windows\System\ysuoghI.exe
  C:\Windows\System\ysuoghI.exe
  2⤵
  PID:8132
- C:\Windows\System\OjgLWvd.exe
  C:\Windows\System\OjgLWvd.exe
  2⤵
  PID:7136
- C:\Windows\System\wIXNbCf.exe
  C:\Windows\System\wIXNbCf.exe
  2⤵
  PID:7200
- C:\Windows\System\ZCChvrU.exe
  C:\Windows\System\ZCChvrU.exe
  2⤵
  PID:7464
- C:\Windows\System\nLqAqmz.exe
  C:\Windows\System\nLqAqmz.exe
  2⤵
  PID:7512
- C:\Windows\System\UaHWQeV.exe
  C:\Windows\System\UaHWQeV.exe
  2⤵
  PID:7560
- C:\Windows\System\mWcuqwC.exe
  C:\Windows\System\mWcuqwC.exe
  2⤵
  PID:6556
- C:\Windows\System\NtZvaYn.exe
  C:\Windows\System\NtZvaYn.exe
  2⤵
  PID:7872
- C:\Windows\System\amZdPwo.exe
  C:\Windows\System\amZdPwo.exe
  2⤵
  PID:7980
- C:\Windows\System\pcytTWA.exe
  C:\Windows\System\pcytTWA.exe
  2⤵
  PID:8112
- C:\Windows\System\TsJfyvl.exe
  C:\Windows\System\TsJfyvl.exe
  2⤵
  PID:7824
- C:\Windows\System\foCmMWo.exe
  C:\Windows\System\foCmMWo.exe
  2⤵
  PID:7924
- C:\Windows\System\ufUdiWC.exe
  C:\Windows\System\ufUdiWC.exe
  2⤵
  PID:7804
- C:\Windows\System\fWMXObM.exe
  C:\Windows\System\fWMXObM.exe
  2⤵
  PID:7680
- C:\Windows\System\RxzkGws.exe
  C:\Windows\System\RxzkGws.exe
  2⤵
  PID:7688
- C:\Windows\System\UkZeLMm.exe
  C:\Windows\System\UkZeLMm.exe
  2⤵
  PID:7312
- C:\Windows\System\sLZVHiQ.exe
  C:\Windows\System\sLZVHiQ.exe
  2⤵
  PID:8128
- C:\Windows\System\dgccvef.exe
  C:\Windows\System\dgccvef.exe
  2⤵
  PID:8068
- C:\Windows\System\dmWzySt.exe
  C:\Windows\System\dmWzySt.exe
  2⤵
  PID:7304
- C:\Windows\System\AejkwoH.exe
  C:\Windows\System\AejkwoH.exe
  2⤵
  PID:6248
- C:\Windows\System\pbFVulB.exe
  C:\Windows\System\pbFVulB.exe
  2⤵
  PID:7492
- C:\Windows\System\nsJjmpR.exe
  C:\Windows\System\nsJjmpR.exe
  2⤵
  PID:7660
- C:\Windows\System\NYcSuya.exe
  C:\Windows\System\NYcSuya.exe
  2⤵
  PID:8012
- C:\Windows\System\tvqHxLL.exe
  C:\Windows\System\tvqHxLL.exe
  2⤵
  PID:7684
- C:\Windows\System\KwTGFlI.exe
  C:\Windows\System\KwTGFlI.exe
  2⤵
  PID:7844
- C:\Windows\System\DandJXz.exe
  C:\Windows\System\DandJXz.exe
  2⤵
  PID:7288
- C:\Windows\System\trPxzZr.exe
  C:\Windows\System\trPxzZr.exe
  2⤵
  PID:7700
- C:\Windows\System\ABBInIQ.exe
  C:\Windows\System\ABBInIQ.exe
  2⤵
  PID:8028
- C:\Windows\System\mbXcAOl.exe
  C:\Windows\System\mbXcAOl.exe
  2⤵
  PID:6420
- C:\Windows\System\katKmzV.exe
  C:\Windows\System\katKmzV.exe
  2⤵
  PID:7544
- C:\Windows\System\vgpkEWK.exe
  C:\Windows\System\vgpkEWK.exe
  2⤵
  PID:7752
- C:\Windows\System\NgmcTER.exe
  C:\Windows\System\NgmcTER.exe
  2⤵
  PID:8204
- C:\Windows\System\HgbKklx.exe
  C:\Windows\System\HgbKklx.exe
  2⤵
  PID:8224
- C:\Windows\System\NdcjiEK.exe
  C:\Windows\System\NdcjiEK.exe
  2⤵
  PID:8240
- C:\Windows\System\EjRCdxw.exe
  C:\Windows\System\EjRCdxw.exe
  2⤵
  PID:8256
- C:\Windows\System\UdzXwNF.exe
  C:\Windows\System\UdzXwNF.exe
  2⤵
  PID:8272
- C:\Windows\System\ZAWFKrB.exe
  C:\Windows\System\ZAWFKrB.exe
  2⤵
  PID:8292
- C:\Windows\System\QOTZZlU.exe
  C:\Windows\System\QOTZZlU.exe
  2⤵
  PID:8308
- C:\Windows\System\ZsdwVTj.exe
  C:\Windows\System\ZsdwVTj.exe
  2⤵
  PID:8324
- C:\Windows\System\RqkngzU.exe
  C:\Windows\System\RqkngzU.exe
  2⤵
  PID:8340
- C:\Windows\System\ylpZaVK.exe
  C:\Windows\System\ylpZaVK.exe
  2⤵
  PID:8396
- C:\Windows\System\YMyCnGJ.exe
  C:\Windows\System\YMyCnGJ.exe
  2⤵
  PID:8416
- C:\Windows\System\Dxmqzzq.exe
  C:\Windows\System\Dxmqzzq.exe
  2⤵
  PID:8432
- C:\Windows\System\zgSgCQW.exe
  C:\Windows\System\zgSgCQW.exe
  2⤵
  PID:8448
- C:\Windows\System\uSrwLVe.exe
  C:\Windows\System\uSrwLVe.exe
  2⤵
  PID:8464
- C:\Windows\System\aHJVeZF.exe
  C:\Windows\System\aHJVeZF.exe
  2⤵
  PID:8480
- C:\Windows\System\yxIDWdS.exe
  C:\Windows\System\yxIDWdS.exe
  2⤵
  PID:8500
- C:\Windows\System\kzyzaJp.exe
  C:\Windows\System\kzyzaJp.exe
  2⤵
  PID:8516
- C:\Windows\System\gezBeOB.exe
  C:\Windows\System\gezBeOB.exe
  2⤵
  PID:8536
- C:\Windows\System\yYziAqD.exe
  C:\Windows\System\yYziAqD.exe
  2⤵
  PID:8552
- C:\Windows\System\iYmsdZv.exe
  C:\Windows\System\iYmsdZv.exe
  2⤵
  PID:8568
- C:\Windows\System\GPNfdId.exe
  C:\Windows\System\GPNfdId.exe
  2⤵
  PID:8584
- C:\Windows\System\VujTREf.exe
  C:\Windows\System\VujTREf.exe
  2⤵
  PID:8604
- C:\Windows\System\TVPkwVS.exe
  C:\Windows\System\TVPkwVS.exe
  2⤵
  PID:8628
- C:\Windows\System\CJIqJkh.exe
  C:\Windows\System\CJIqJkh.exe
  2⤵
  PID:8648
- C:\Windows\System\ToTCNNQ.exe
  C:\Windows\System\ToTCNNQ.exe
  2⤵
  PID:8668
- C:\Windows\System\lgTGAnx.exe
  C:\Windows\System\lgTGAnx.exe
  2⤵
  PID:8684
- C:\Windows\System\EegFTSw.exe
  C:\Windows\System\EegFTSw.exe
  2⤵
  PID:8700
- C:\Windows\System\sNRylFt.exe
  C:\Windows\System\sNRylFt.exe
  2⤵
  PID:8716
- C:\Windows\System\towxzTw.exe
  C:\Windows\System\towxzTw.exe
  2⤵
  PID:8732
- C:\Windows\System\GDStxSs.exe
  C:\Windows\System\GDStxSs.exe
  2⤵
  PID:8748
- C:\Windows\System\PePNoFb.exe
  C:\Windows\System\PePNoFb.exe
  2⤵
  PID:8764
- C:\Windows\System\rFSccFv.exe
  C:\Windows\System\rFSccFv.exe
  2⤵
  PID:8780
- C:\Windows\System\WwgJRqk.exe
  C:\Windows\System\WwgJRqk.exe
  2⤵
  PID:8796
- C:\Windows\System\cmQWPHN.exe
  C:\Windows\System\cmQWPHN.exe
  2⤵
  PID:8812
- C:\Windows\System\SpPwIEq.exe
  C:\Windows\System\SpPwIEq.exe
  2⤵
  PID:8828
- C:\Windows\System\ndZZnAR.exe
  C:\Windows\System\ndZZnAR.exe
  2⤵
  PID:8844
- C:\Windows\System\IYlEQDu.exe
  C:\Windows\System\IYlEQDu.exe
  2⤵
  PID:8860
- C:\Windows\System\GFFMrDE.exe
  C:\Windows\System\GFFMrDE.exe
  2⤵
  PID:8876
- C:\Windows\System\FVsGFfr.exe
  C:\Windows\System\FVsGFfr.exe
  2⤵
  PID:8892
- C:\Windows\System\OJAYWhC.exe
  C:\Windows\System\OJAYWhC.exe
  2⤵
  PID:8908
- C:\Windows\System\YhVUpxG.exe
  C:\Windows\System\YhVUpxG.exe
  2⤵
  PID:8924
- C:\Windows\System\idQXILK.exe
  C:\Windows\System\idQXILK.exe
  2⤵
  PID:8940
- C:\Windows\System\jNVqEKt.exe
  C:\Windows\System\jNVqEKt.exe
  2⤵
  PID:8956
- C:\Windows\System\VnCpCIl.exe
  C:\Windows\System\VnCpCIl.exe
  2⤵
  PID:8972
- C:\Windows\System\rwCYbgz.exe
  C:\Windows\System\rwCYbgz.exe
  2⤵
  PID:8988
- C:\Windows\System\obkIDKi.exe
  C:\Windows\System\obkIDKi.exe
  2⤵
  PID:9004
- C:\Windows\System\eoPKKUG.exe
  C:\Windows\System\eoPKKUG.exe
  2⤵
  PID:9020
- C:\Windows\System\SBGpFub.exe
  C:\Windows\System\SBGpFub.exe
  2⤵
  PID:9036
- C:\Windows\System\FvJrVQI.exe
  C:\Windows\System\FvJrVQI.exe
  2⤵
  PID:9056
- C:\Windows\System\qOAQbqv.exe
  C:\Windows\System\qOAQbqv.exe
  2⤵
  PID:9072
- C:\Windows\System\ZiYwgMf.exe
  C:\Windows\System\ZiYwgMf.exe
  2⤵
  PID:9088
- C:\Windows\System\erWeeVY.exe
  C:\Windows\System\erWeeVY.exe
  2⤵
  PID:9104
- C:\Windows\System\AWPOIKR.exe
  C:\Windows\System\AWPOIKR.exe
  2⤵
  PID:9120
- C:\Windows\System\BubyHMJ.exe
  C:\Windows\System\BubyHMJ.exe
  2⤵
  PID:9136
- C:\Windows\System\macWHuv.exe
  C:\Windows\System\macWHuv.exe
  2⤵
  PID:9152
- C:\Windows\System\oXtiZTF.exe
  C:\Windows\System\oXtiZTF.exe
  2⤵
  PID:9168
- C:\Windows\System\FAoMTth.exe
  C:\Windows\System\FAoMTth.exe
  2⤵
  PID:9184
- C:\Windows\System\wXlwvpi.exe
  C:\Windows\System\wXlwvpi.exe
  2⤵
  PID:9200
- C:\Windows\System\uzPqOUL.exe
  C:\Windows\System\uzPqOUL.exe
  2⤵
  PID:7768
- C:\Windows\System\joQUeIq.exe
  C:\Windows\System\joQUeIq.exe
  2⤵
  PID:7576
- C:\Windows\System\POZSIMd.exe
  C:\Windows\System\POZSIMd.exe
  2⤵
  PID:8232
- C:\Windows\System\pLloUbd.exe
  C:\Windows\System\pLloUbd.exe
  2⤵
  PID:7204
- C:\Windows\System\qweRblQ.exe
  C:\Windows\System\qweRblQ.exe
  2⤵
  PID:8304
- C:\Windows\System\NxptBKd.exe
  C:\Windows\System\NxptBKd.exe
  2⤵
  PID:8212
- C:\Windows\System\qbWwUAF.exe
  C:\Windows\System\qbWwUAF.exe
  2⤵
  PID:7408
- C:\Windows\System\jifzBBM.exe
  C:\Windows\System\jifzBBM.exe
  2⤵
  PID:8184
- C:\Windows\System\TBusDkf.exe
  C:\Windows\System\TBusDkf.exe
  2⤵
  PID:8284
- C:\Windows\System\mWOLVDi.exe
  C:\Windows\System\mWOLVDi.exe
  2⤵
  PID:8356
- C:\Windows\System\uSuUlog.exe
  C:\Windows\System\uSuUlog.exe
  2⤵
  PID:8364
- C:\Windows\System\GAjRdLE.exe
  C:\Windows\System\GAjRdLE.exe
  2⤵
  PID:8380
- C:\Windows\System\nZqgQwx.exe
  C:\Windows\System\nZqgQwx.exe
  2⤵
  PID:8424
- C:\Windows\System\rAndIin.exe
  C:\Windows\System\rAndIin.exe
  2⤵
  PID:8492
- C:\Windows\System\lKNaMhw.exe
  C:\Windows\System\lKNaMhw.exe
  2⤵
  PID:8532
- C:\Windows\System\liwVXsE.exe
  C:\Windows\System\liwVXsE.exe
  2⤵
  PID:8592
- C:\Windows\System\eZhRUzj.exe
  C:\Windows\System\eZhRUzj.exe
  2⤵
  PID:8548
- C:\Windows\System\OqJAtCN.exe
  C:\Windows\System\OqJAtCN.exe
  2⤵
  PID:8640
- C:\Windows\System\nlMhqgv.exe
  C:\Windows\System\nlMhqgv.exe
  2⤵
  PID:8660
- C:\Windows\System\QGYWwRk.exe
  C:\Windows\System\QGYWwRk.exe
  2⤵
  PID:8692
- C:\Windows\System\oUrpZGw.exe
  C:\Windows\System\oUrpZGw.exe
  2⤵
  PID:8680
- C:\Windows\System\OVEaGFy.exe
  C:\Windows\System\OVEaGFy.exe
  2⤵
  PID:8744
- C:\Windows\System\fvNgMTW.exe
  C:\Windows\System\fvNgMTW.exe
  2⤵
  PID:8772
- C:\Windows\System\XKXyNsK.exe
  C:\Windows\System\XKXyNsK.exe
  2⤵
  PID:8820
- C:\Windows\System\hMWePzL.exe
  C:\Windows\System\hMWePzL.exe
  2⤵
  PID:8808
- C:\Windows\System\bcqBiDb.exe
  C:\Windows\System\bcqBiDb.exe
  2⤵
  PID:8884
- C:\Windows\System\RedqpWz.exe
  C:\Windows\System\RedqpWz.exe
  2⤵
  PID:8920
- C:\Windows\System\LbXsASQ.exe
  C:\Windows\System\LbXsASQ.exe
  2⤵
  PID:8952
- C:\Windows\System\XETKmUS.exe
  C:\Windows\System\XETKmUS.exe
  2⤵
  PID:8984
- C:\Windows\System\cNPyDgs.exe
  C:\Windows\System\cNPyDgs.exe
  2⤵
  PID:9044
- C:\Windows\System\AhOJZIM.exe
  C:\Windows\System\AhOJZIM.exe
  2⤵
  PID:9048
- C:\Windows\System\mKpNyvw.exe
  C:\Windows\System\mKpNyvw.exe
  2⤵
  PID:9084
- C:\Windows\System\frNpVAe.exe
  C:\Windows\System\frNpVAe.exe
  2⤵
  PID:9148
- C:\Windows\System\yWIERGG.exe
  C:\Windows\System\yWIERGG.exe
  2⤵
  PID:9132
- C:\Windows\System\NGVbipg.exe
  C:\Windows\System\NGVbipg.exe
  2⤵
  PID:9164
- C:\Windows\System\JfcjuYy.exe
  C:\Windows\System\JfcjuYy.exe
  2⤵
  PID:7428
- C:\Windows\System\sAopAvo.exe
  C:\Windows\System\sAopAvo.exe
  2⤵
  PID:8300
- C:\Windows\System\YqfbvCj.exe
  C:\Windows\System\YqfbvCj.exe
  2⤵
  PID:8336
- C:\Windows\System\twINBdI.exe
  C:\Windows\System\twINBdI.exe
  2⤵
  PID:8348
- C:\Windows\System\RZOihBn.exe
  C:\Windows\System\RZOihBn.exe
  2⤵
  PID:8280
- C:\Windows\System\LvkWkby.exe
  C:\Windows\System\LvkWkby.exe
  2⤵
  PID:8360
- C:\Windows\System\cXeHzhf.exe
  C:\Windows\System\cXeHzhf.exe
  2⤵
  PID:8496
- C:\Windows\System\BXYjNlK.exe
  C:\Windows\System\BXYjNlK.exe
  2⤵
  PID:8600
- C:\Windows\System\tilgdyD.exe
  C:\Windows\System\tilgdyD.exe
  2⤵
  PID:8624
- C:\Windows\System\FZwwxXe.exe
  C:\Windows\System\FZwwxXe.exe
  2⤵
  PID:8756
- C:\Windows\System\ejmtQXq.exe
  C:\Windows\System\ejmtQXq.exe
  2⤵
  PID:8472
- C:\Windows\System\sMXBLjb.exe
  C:\Windows\System\sMXBLjb.exe
  2⤵
  PID:8580
- C:\Windows\System\IBLslSw.exe
  C:\Windows\System\IBLslSw.exe
  2⤵
  PID:8644
- C:\Windows\System\tJWArwk.exe
  C:\Windows\System\tJWArwk.exe
  2⤵
  PID:8488
- C:\Windows\System\JNibyBO.exe
  C:\Windows\System\JNibyBO.exe
  2⤵
  PID:8728
- C:\Windows\System\UpeEBaT.exe
  C:\Windows\System\UpeEBaT.exe
  2⤵
  PID:8904
- C:\Windows\System\OyKdWzK.exe
  C:\Windows\System\OyKdWzK.exe
  2⤵
  PID:8980
- C:\Windows\System\bsgclge.exe
  C:\Windows\System\bsgclge.exe
  2⤵
  PID:9116
- C:\Windows\System\qlyORjh.exe
  C:\Windows\System\qlyORjh.exe
  2⤵
  PID:9144
- C:\Windows\System\qBfZCNo.exe
  C:\Windows\System\qBfZCNo.exe
  2⤵
  PID:9128
- C:\Windows\System\bbVFYqf.exe
  C:\Windows\System\bbVFYqf.exe
  2⤵
  PID:9196
- C:\Windows\System\lTAdOfi.exe
  C:\Windows\System\lTAdOfi.exe
  2⤵
  PID:7424
- C:\Windows\System\equonbI.exe
  C:\Windows\System\equonbI.exe
  2⤵
  PID:7600
- C:\Windows\System\FrPyAQo.exe
  C:\Windows\System\FrPyAQo.exe
  2⤵
  PID:8528
- C:\Windows\System\ixxDGRR.exe
  C:\Windows\System\ixxDGRR.exe
  2⤵
  PID:8676
- C:\Windows\System\nCuffLS.exe
  C:\Windows\System\nCuffLS.exe
  2⤵
  PID:8412
- C:\Windows\System\UNOrtaT.exe
  C:\Windows\System\UNOrtaT.exe
  2⤵
  PID:8460
- C:\Windows\System\uFPdkkW.exe
  C:\Windows\System\uFPdkkW.exe
  2⤵
  PID:8708
- C:\Windows\System\tkrxFFq.exe
  C:\Windows\System\tkrxFFq.exe
  2⤵
  PID:9032
- C:\Windows\System\BEhIEvm.exe
  C:\Windows\System\BEhIEvm.exe
  2⤵
  PID:8968
- C:\Windows\System\CHESsLR.exe
  C:\Windows\System\CHESsLR.exe
  2⤵
  PID:8996
- C:\Windows\System\xCMfhbr.exe
  C:\Windows\System\xCMfhbr.exe
  2⤵
  PID:7360
- C:\Windows\System\cHspTqJ.exe
  C:\Windows\System\cHspTqJ.exe
  2⤵
  PID:8760
- C:\Windows\System\dMGCXmV.exe
  C:\Windows\System\dMGCXmV.exe
  2⤵
  PID:8872
- C:\Windows\System\uZnyVQe.exe
  C:\Windows\System\uZnyVQe.exe
  2⤵
  PID:8868
- C:\Windows\System\ANUlPux.exe
  C:\Windows\System\ANUlPux.exe
  2⤵
  PID:9192
- C:\Windows\System\gOGLdVR.exe
  C:\Windows\System\gOGLdVR.exe
  2⤵
  PID:8248
- C:\Windows\System\xgpOGJr.exe
  C:\Windows\System\xgpOGJr.exe
  2⤵
  PID:9232
- C:\Windows\System\vzPndQp.exe
  C:\Windows\System\vzPndQp.exe
  2⤵
  PID:9256
- C:\Windows\System\mIoQaHd.exe
  C:\Windows\System\mIoQaHd.exe
  2⤵
  PID:9272
- C:\Windows\System\HHGGWhn.exe
  C:\Windows\System\HHGGWhn.exe
  2⤵
  PID:9288
- C:\Windows\System\nWfGqCW.exe
  C:\Windows\System\nWfGqCW.exe
  2⤵
  PID:9304
- C:\Windows\System\EkbLtgv.exe
  C:\Windows\System\EkbLtgv.exe
  2⤵
  PID:9320
- C:\Windows\System\NdfFKon.exe
  C:\Windows\System\NdfFKon.exe
  2⤵
  PID:9336
- C:\Windows\System\OZCjorL.exe
  C:\Windows\System\OZCjorL.exe
  2⤵
  PID:9356
- C:\Windows\System\YRCJMVA.exe
  C:\Windows\System\YRCJMVA.exe
  2⤵
  PID:9372
- C:\Windows\System\HcShwko.exe
  C:\Windows\System\HcShwko.exe
  2⤵
  PID:9388
- C:\Windows\System\aAIlALR.exe
  C:\Windows\System\aAIlALR.exe
  2⤵
  PID:9404
- C:\Windows\System\GpaMEbp.exe
  C:\Windows\System\GpaMEbp.exe
  2⤵
  PID:9420
- C:\Windows\System\IbARFyU.exe
  C:\Windows\System\IbARFyU.exe
  2⤵
  PID:9436
- C:\Windows\System\zUkNjWW.exe
  C:\Windows\System\zUkNjWW.exe
  2⤵
  PID:9456
- C:\Windows\System\zAiBnwO.exe
  C:\Windows\System\zAiBnwO.exe
  2⤵
  PID:9472
- C:\Windows\System\owmvYdt.exe
  C:\Windows\System\owmvYdt.exe
  2⤵
  PID:9488
- C:\Windows\System\LDJjdAS.exe
  C:\Windows\System\LDJjdAS.exe
  2⤵
  PID:9504
- C:\Windows\System\RtqkfBM.exe
  C:\Windows\System\RtqkfBM.exe
  2⤵
  PID:9520
- C:\Windows\System\aqILiYH.exe
  C:\Windows\System\aqILiYH.exe
  2⤵
  PID:9540
- C:\Windows\System\qYUiaKX.exe
  C:\Windows\System\qYUiaKX.exe
  2⤵
  PID:9560
- C:\Windows\System\xYLPVSj.exe
  C:\Windows\System\xYLPVSj.exe
  2⤵
  PID:9576
- C:\Windows\System\uhzTLyC.exe
  C:\Windows\System\uhzTLyC.exe
  2⤵
  PID:9592
- C:\Windows\System\VVBAnVL.exe
  C:\Windows\System\VVBAnVL.exe
  2⤵
  PID:9612
- C:\Windows\System\ZpjbkDA.exe
  C:\Windows\System\ZpjbkDA.exe
  2⤵
  PID:9628
- C:\Windows\System\eYPZgQf.exe
  C:\Windows\System\eYPZgQf.exe
  2⤵
  PID:9648
- C:\Windows\System\PeVhKTs.exe
  C:\Windows\System\PeVhKTs.exe
  2⤵
  PID:9664
- C:\Windows\System\TmirdOA.exe
  C:\Windows\System\TmirdOA.exe
  2⤵
  PID:9680
- C:\Windows\System\InMSOsT.exe
  C:\Windows\System\InMSOsT.exe
  2⤵
  PID:9700
- C:\Windows\System\azYoMsJ.exe
  C:\Windows\System\azYoMsJ.exe
  2⤵
  PID:9716
- C:\Windows\System\CLRWApW.exe
  C:\Windows\System\CLRWApW.exe
  2⤵
  PID:9736
- C:\Windows\System\VQkOran.exe
  C:\Windows\System\VQkOran.exe
  2⤵
  PID:9752
- C:\Windows\System\YynFITq.exe
  C:\Windows\System\YynFITq.exe
  2⤵
  PID:9768
- C:\Windows\System\fQFUqfK.exe
  C:\Windows\System\fQFUqfK.exe
  2⤵
  PID:9788
- C:\Windows\System\XDukXTv.exe
  C:\Windows\System\XDukXTv.exe
  2⤵
  PID:9808
- C:\Windows\System\gsOEfwn.exe
  C:\Windows\System\gsOEfwn.exe
  2⤵
  PID:9824
- C:\Windows\System\UyXCRLp.exe
  C:\Windows\System\UyXCRLp.exe
  2⤵
  PID:9844
- C:\Windows\System\GHvOScp.exe
  C:\Windows\System\GHvOScp.exe
  2⤵
  PID:9860
- C:\Windows\System\OkMUsol.exe
  C:\Windows\System\OkMUsol.exe
  2⤵
  PID:9876
- C:\Windows\System\Tweiezo.exe
  C:\Windows\System\Tweiezo.exe
  2⤵
  PID:9896
- C:\Windows\System\sTZbKRT.exe
  C:\Windows\System\sTZbKRT.exe
  2⤵
  PID:9916
- C:\Windows\System\DEDiMDL.exe
  C:\Windows\System\DEDiMDL.exe
  2⤵
  PID:9936
- C:\Windows\System\LzZaWNs.exe
  C:\Windows\System\LzZaWNs.exe
  2⤵
  PID:9956
- C:\Windows\System\gpEEFPT.exe
  C:\Windows\System\gpEEFPT.exe
  2⤵
  PID:9972
- C:\Windows\System\hJlZDeJ.exe
  C:\Windows\System\hJlZDeJ.exe
  2⤵
  PID:9992
- C:\Windows\System\eJpkpQr.exe
  C:\Windows\System\eJpkpQr.exe
  2⤵
  PID:10008
- C:\Windows\System\LUnTDZm.exe
  C:\Windows\System\LUnTDZm.exe
  2⤵
  PID:10024
- C:\Windows\System\IbSboUQ.exe
  C:\Windows\System\IbSboUQ.exe
  2⤵
  PID:10040
- C:\Windows\System\NdCgklo.exe
  C:\Windows\System\NdCgklo.exe
  2⤵
  PID:10056
- C:\Windows\System\SYGmPXZ.exe
  C:\Windows\System\SYGmPXZ.exe
  2⤵
  PID:10076
- C:\Windows\System\UOppZlN.exe
  C:\Windows\System\UOppZlN.exe
  2⤵
  PID:10092
- C:\Windows\System\RztRZJs.exe
  C:\Windows\System\RztRZJs.exe
  2⤵
  PID:10108
- C:\Windows\System\DAdNiwF.exe
  C:\Windows\System\DAdNiwF.exe
  2⤵
  PID:10124
- C:\Windows\System\ibjLkLe.exe
  C:\Windows\System\ibjLkLe.exe
  2⤵
  PID:10144
- C:\Windows\System\QSlQozp.exe
  C:\Windows\System\QSlQozp.exe
  2⤵
  PID:10160
- C:\Windows\System\fNLHTOv.exe
  C:\Windows\System\fNLHTOv.exe
  2⤵
  PID:10176
- C:\Windows\System\fqogTMO.exe
  C:\Windows\System\fqogTMO.exe
  2⤵
  PID:10192
- C:\Windows\System\Zxjzpwp.exe
  C:\Windows\System\Zxjzpwp.exe
  2⤵
  PID:10208
- C:\Windows\System\kPryuBS.exe
  C:\Windows\System\kPryuBS.exe
  2⤵
  PID:10228
- C:\Windows\System\MCiDuaK.exe
  C:\Windows\System\MCiDuaK.exe
  2⤵
  PID:8268
- C:\Windows\System\MnUKDGY.exe
  C:\Windows\System\MnUKDGY.exe
  2⤵
  PID:8804
- C:\Windows\System\TeGOEnL.exe
  C:\Windows\System\TeGOEnL.exe
  2⤵
  PID:8376
- C:\Windows\System\MaRILMD.exe
  C:\Windows\System\MaRILMD.exe
  2⤵
  PID:9248
- C:\Windows\System\JHoGMhX.exe
  C:\Windows\System\JHoGMhX.exe
  2⤵
  PID:9280
- C:\Windows\System\kwoBCYq.exe
  C:\Windows\System\kwoBCYq.exe
  2⤵
  PID:9344
- C:\Windows\System\MjxgXYr.exe
  C:\Windows\System\MjxgXYr.exe
  2⤵
  PID:9352
- C:\Windows\System\JGTBRdy.exe
  C:\Windows\System\JGTBRdy.exe
  2⤵
  PID:9400
- C:\Windows\System\gkhSTtG.exe
  C:\Windows\System\gkhSTtG.exe
  2⤵
  PID:9468
- C:\Windows\System\kxaXicp.exe
  C:\Windows\System\kxaXicp.exe
  2⤵
  PID:9528
- C:\Windows\System\GxcbtUY.exe
  C:\Windows\System\GxcbtUY.exe
  2⤵
  PID:9448
- C:\Windows\System\asUyhTd.exe
  C:\Windows\System\asUyhTd.exe
  2⤵
  PID:9536
- C:\Windows\System\oczZPky.exe
  C:\Windows\System\oczZPky.exe
  2⤵
  PID:9548
- C:\Windows\System\dqEkdNL.exe
  C:\Windows\System\dqEkdNL.exe
  2⤵
  PID:9604
- C:\Windows\System\TkIuLJt.exe
  C:\Windows\System\TkIuLJt.exe
  2⤵
  PID:9672
- C:\Windows\System\eXbQOrV.exe
  C:\Windows\System\eXbQOrV.exe
  2⤵
  PID:9640
- C:\Windows\System\CQMYBuR.exe
  C:\Windows\System\CQMYBuR.exe
  2⤵
  PID:9712
- C:\Windows\System\hzmEeTm.exe
  C:\Windows\System\hzmEeTm.exe
  2⤵
  PID:9688
- C:\Windows\System\CrcSQee.exe
  C:\Windows\System\CrcSQee.exe
  2⤵
  PID:9728
- C:\Windows\System\nMitaZo.exe
  C:\Windows\System\nMitaZo.exe
  2⤵
  PID:9780
- C:\Windows\System\SrvQxty.exe
  C:\Windows\System\SrvQxty.exe
  2⤵
  PID:9800
- C:\Windows\System\wLECKCZ.exe
  C:\Windows\System\wLECKCZ.exe
  2⤵
  PID:9892
- C:\Windows\System\OGdlwwk.exe
  C:\Windows\System\OGdlwwk.exe
  2⤵
  PID:9968
- C:\Windows\System\GgALYrp.exe
  C:\Windows\System\GgALYrp.exe
  2⤵
  PID:9984
- C:\Windows\System\wcezKJQ.exe
  C:\Windows\System\wcezKJQ.exe
  2⤵
  PID:9980
- C:\Windows\System\RIbZCUm.exe
  C:\Windows\System\RIbZCUm.exe
  2⤵
  PID:10048
- C:\Windows\System\JGxiUIW.exe
  C:\Windows\System\JGxiUIW.exe
  2⤵
  PID:10088
- C:\Windows\System\MIYBBFD.exe
  C:\Windows\System\MIYBBFD.exe
  2⤵
  PID:10104
- C:\Windows\System\xxukHzt.exe
  C:\Windows\System\xxukHzt.exe
  2⤵
  PID:10072
- C:\Windows\System\byrXmOF.exe
  C:\Windows\System\byrXmOF.exe
  2⤵
  PID:10168
- C:\Windows\System\VYmiGOD.exe
  C:\Windows\System\VYmiGOD.exe
  2⤵
  PID:10172
- C:\Windows\System\erWxqnH.exe
  C:\Windows\System\erWxqnH.exe
  2⤵
  PID:10220
- C:\Windows\System\frafAbu.exe
  C:\Windows\System\frafAbu.exe
  2⤵
  PID:10236
- C:\Windows\System\jrBVzxz.exe
  C:\Windows\System\jrBVzxz.exe
  2⤵
  PID:9240
- C:\Windows\System\XTzdlgk.exe
  C:\Windows\System\XTzdlgk.exe
  2⤵
  PID:8456
- C:\Windows\System\EfgTXRM.exe
  C:\Windows\System\EfgTXRM.exe
  2⤵
  PID:9332
- C:\Windows\System\BEecngB.exe
  C:\Windows\System\BEecngB.exe
  2⤵
  PID:9444
- C:\Windows\System\poLenAK.exe
  C:\Windows\System\poLenAK.exe
  2⤵
  PID:9636
- C:\Windows\System\EwUzSpZ.exe
  C:\Windows\System\EwUzSpZ.exe
  2⤵
  PID:9656
- C:\Windows\System\MsZILzw.exe
  C:\Windows\System\MsZILzw.exe
  2⤵
  PID:9416
- C:\Windows\System\ZfrcAil.exe
  C:\Windows\System\ZfrcAil.exe
  2⤵
  PID:9588
- C:\Windows\System\fTlnUpz.exe
  C:\Windows\System\fTlnUpz.exe
  2⤵
  PID:9496
- C:\Windows\System\ySFZbbm.exe
  C:\Windows\System\ySFZbbm.exe
  2⤵
  PID:9532
- C:\Windows\System\KuMXrGP.exe
  C:\Windows\System\KuMXrGP.exe
  2⤵
  PID:9764
- C:\Windows\System\fuOdQIM.exe
  C:\Windows\System\fuOdQIM.exe
  2⤵
  PID:9776
- C:\Windows\System\yGaxrvc.exe
  C:\Windows\System\yGaxrvc.exe
  2⤵
  PID:9840
- C:\Windows\System\ugxRrkx.exe
  C:\Windows\System\ugxRrkx.exe
  2⤵
  PID:9872
- C:\Windows\System\UwUNnpo.exe
  C:\Windows\System\UwUNnpo.exe
  2⤵
  PID:10084
- C:\Windows\System\GeOtYsR.exe
  C:\Windows\System\GeOtYsR.exe
  2⤵
  PID:10156
- C:\Windows\System\LvFXKOz.exe
  C:\Windows\System\LvFXKOz.exe
  2⤵
  PID:9224
- C:\Windows\System\ggVjYjt.exe
  C:\Windows\System\ggVjYjt.exe
  2⤵
  PID:9384
- C:\Windows\System\EPyqopS.exe
  C:\Windows\System\EPyqopS.exe
  2⤵
  PID:9480
- C:\Windows\System\qsiBJkz.exe
  C:\Windows\System\qsiBJkz.exe
  2⤵
  PID:10000
- C:\Windows\System\hRirBcL.exe
  C:\Windows\System\hRirBcL.exe
  2⤵
  PID:10184
- C:\Windows\System\rJFwSiS.exe
  C:\Windows\System\rJFwSiS.exe
  2⤵
  PID:9912
- C:\Windows\System\QoztKnI.exe
  C:\Windows\System\QoztKnI.exe
  2⤵
  PID:9676
- C:\Windows\System\rEzWNKq.exe
  C:\Windows\System\rEzWNKq.exe
  2⤵
  PID:9300
- C:\Windows\System\UGaUOQD.exe
  C:\Windows\System\UGaUOQD.exe
  2⤵
  PID:9816
- C:\Windows\System\vaXpdbX.exe
  C:\Windows\System\vaXpdbX.exe
  2⤵
  PID:9868
- C:\Windows\System\IotiVNG.exe
  C:\Windows\System\IotiVNG.exe
  2⤵
  PID:10036
- C:\Windows\System\YdZdlVH.exe
  C:\Windows\System\YdZdlVH.exe
  2⤵
  PID:9464
- C:\Windows\System\gmUWVYM.exe
  C:\Windows\System\gmUWVYM.exe
  2⤵
  PID:9696
- C:\Windows\System\sdLywmO.exe
  C:\Windows\System\sdLywmO.exe
  2⤵
  PID:9888
- C:\Windows\System\YJBNlTY.exe
  C:\Windows\System\YJBNlTY.exe
  2⤵
  PID:10116
- C:\Windows\System\pJUeLFP.exe
  C:\Windows\System\pJUeLFP.exe
  2⤵
  PID:10152
- C:\Windows\System\jTKvmMS.exe
  C:\Windows\System\jTKvmMS.exe
  2⤵
  PID:9856
- C:\Windows\System\zJwBggu.exe
  C:\Windows\System\zJwBggu.exe
  2⤵
  PID:10244
- C:\Windows\System\KateTNT.exe
  C:\Windows\System\KateTNT.exe
  2⤵
  PID:10260
- C:\Windows\System\rcYQDaN.exe
  C:\Windows\System\rcYQDaN.exe
  2⤵
  PID:10276
- C:\Windows\System\uLWyPzp.exe
  C:\Windows\System\uLWyPzp.exe
  2⤵
  PID:10292
- C:\Windows\System\LZaLHRZ.exe
  C:\Windows\System\LZaLHRZ.exe
  2⤵
  PID:10308
- C:\Windows\System\BiGGBOv.exe
  C:\Windows\System\BiGGBOv.exe
  2⤵
  PID:10328
- C:\Windows\System\UxmrVXF.exe
  C:\Windows\System\UxmrVXF.exe
  2⤵
  PID:10344
- C:\Windows\System\trQprZi.exe
  C:\Windows\System\trQprZi.exe
  2⤵
  PID:10360
- C:\Windows\System\fJgOAmg.exe
  C:\Windows\System\fJgOAmg.exe
  2⤵
  PID:10384
- C:\Windows\System\VDSZLkq.exe
  C:\Windows\System\VDSZLkq.exe
  2⤵
  PID:10400
- C:\Windows\System\sHwWKfL.exe
  C:\Windows\System\sHwWKfL.exe
  2⤵
  PID:10416
- C:\Windows\System\eUtjCXo.exe
  C:\Windows\System\eUtjCXo.exe
  2⤵
  PID:10436
- C:\Windows\System\NfjDfXg.exe
  C:\Windows\System\NfjDfXg.exe
  2⤵
  PID:10452
- C:\Windows\System\MgHhFQz.exe
  C:\Windows\System\MgHhFQz.exe
  2⤵
  PID:10468
- C:\Windows\System\xqUJqtV.exe
  C:\Windows\System\xqUJqtV.exe
  2⤵
  PID:10484
- C:\Windows\System\vimDGod.exe
  C:\Windows\System\vimDGod.exe
  2⤵
  PID:10504
- C:\Windows\System\KkkGwBk.exe
  C:\Windows\System\KkkGwBk.exe
  2⤵
  PID:10520
- C:\Windows\System\sLRaICK.exe
  C:\Windows\System\sLRaICK.exe
  2⤵
  PID:10540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AaPLIvX.exe

Filesize
1.9MB

MD5
7607f96d0cc485ef6154fe9ee9c0506b

SHA1
66069c7f579c2813c353ec8d22b38c5dff21b04a

SHA256
89152381af6fc0072395658928844133642c22f4fc1d6c598c8fedf9d0399f1e

SHA512
22b3240c8c0c7be65b234d82f50ef5ee26e79757bae07ac748a93d6108ebbf71529cab8c6611cb18e67d6778cd7209d74352399574f9690b9b20e5c299a1efe3

Download Submit
C:\Windows\system\EXHTHnM.exe

Filesize
1.9MB

MD5
6410877e4536ee5ead313ffe3d0f329f

SHA1
35d40179f227d523926652ebb23f9f532ba7d2f0

SHA256
bfbbcbae86e6ce80d3d77c7af563aef95be520afb5dfdd7d13b571bc6405b892

SHA512
e0335a6d611bada42c3c4034e1cdbc5ecedb8e221f71890fdcd1827c64c3bdb0d1c576c44516fea1a920640dfeed99517f7870c8a83c70bc2cb9750455fa30f2

Download Submit
C:\Windows\system\GiNoFWK.exe

Filesize
1.9MB

MD5
2b2a34bdc96d64354784be2ecbf71bdd

SHA1
1a2141c573b3625d34fb0360618e8cc0fb7243c6

SHA256
8dcacb7c15b179a09dbceeb433b8e3b16b4ceab98f3de5d47ea9933218bd8de8

SHA512
a0c9fb35c0e55525fa06058304ac166d6b1bb33ee5e72544f8c5064c707e9c4a296460bc6dd4c9305c963b94611efad0b130699551fe5f8bc5b5049782f82f87

Download Submit
C:\Windows\system\IpDqtiD.exe

Filesize
1.9MB

MD5
2687ffa27a20de82a7ae898ddb62644a

SHA1
f1d5ac287b7f3a93032225d02de0953d541aa7a2

SHA256
353fcd9dff644ac3653629ebd19049a799f7f9058317e645bb7c5d84cfb95dbf

SHA512
9e04de06bc37d0688f77f311732cc3dc2b1106c6e59f07cacacd16c7f6f1405f2f7a7908683871498bba0dd40a8e15f90874062a9acdbe728a1880abc9889980

Download Submit
C:\Windows\system\Jnjibfv.exe

Filesize
1.9MB

MD5
be99e1dd3fe3c5e6d296ce2f29424ca3

SHA1
c3fe2645cef892a13268ac56576935f621865d45

SHA256
fa7722864fe35e218b5ee70f93ef74f3a395ba9fb543d851855130ca374485e4

SHA512
94b642da61a2d4f2a930c1cae93458f4b72b5698cb483820a011d390a337b2599cebc58251852c135faebf9766400e33e88337395326faea440070aeb8a5b7a9

Download Submit
C:\Windows\system\MrhNNvL.exe

Filesize
1.9MB

MD5
3d30b2c14fb3397eb6b586eb58f02733

SHA1
5dff1964d1a3118ba27fb04bdc6cc7db6bb38a7b

SHA256
961bbc973665455808a484697a55a02d6ebbd807b300112cfe86c8d71908ee1c

SHA512
164a571d34242f79436c7d525fc550462d57ee9686b62f9b475d043ce470050d81f4754f9191721582c6d7c912449f0eb4b0a3a4a8de3f54feae1f03c9bc62e3

Download Submit
C:\Windows\system\NOWndAp.exe

Filesize
1.9MB

MD5
44b7c5dcb8adcd54a8aa0493cd5b9eb0

SHA1
a250120de88f9ba88864332754b1da10a2bf067f

SHA256
0170a1d3f5bd8637344ca34bd34ca406f7de9da7fb680521898ea89f1237214c

SHA512
891117c7152d0a2c09097e06a8d041ce81c2ae0ec59365d397d06af10953c8afe88d3dbd0858149693b6cca8393e845b9218dc2f5d7ac8f24c418bd71598e4f3

Download Submit
C:\Windows\system\NbZIPvg.exe

Filesize
1.9MB

MD5
6752ef3f67fc4fb8be36491dac80226b

SHA1
6da2687d51278a63651f759b03c7914e0f9617eb

SHA256
ac70d411e8d0767684f3c3241cb20946324de3d71f169b3bdc86b6fed7dacb4d

SHA512
d87e8cbf27ea038f377b2a26f5427cea6e0d58ed5c9819e9c2495e9c4a64299c6963c531a6b8ab4b6531c5f6533faf3860911d98902aa97d59881f07d3597de7

Download Submit
C:\Windows\system\OapGmok.exe

Filesize
1.9MB

MD5
bc653201203559d538821343fedbe549

SHA1
03e82158219a10fa58dd5841bb79308f2aa9f909

SHA256
89b6cf38975e4b569dc1b3dca7beba074e1765d599e7cadca03587951689f65d

SHA512
dc64bbd214b8d22c4d78d493a8737f5012303125da329bab82fec66d1a9417d697297e6552743dcf4c19f2bc266e2c12119c88514ec5ce046522d4efddce0d82

Download Submit
C:\Windows\system\hTadqOx.exe

Filesize
1.9MB

MD5
3ed6704857204e068ebf03c09cd4e440

SHA1
8923c8b10d4a039d93ab6a15432f1312d3327289

SHA256
1a05b4f9075d0c8b8472e19a1020d3e3c66781d64ab2fa14b1587d29ced88fa2

SHA512
4616be83924e6234c47320b0bd3f21c5b90ad1e2b3b5609995b665a1ceea26d5366156b45dc20ac2028257fda7f5283c8be8ad20ad745a3b64031e140d4a3e57

Download Submit
C:\Windows\system\kmEZEOO.exe

Filesize
1.9MB

MD5
999ae7712a2d8a29de2fa925303eceea

SHA1
0a4848eedf9e2c63e58f0d7251b05110dcbb39f3

SHA256
c99790bf0b90ba0ea58fb2e6d757324507628bca44caeb5f9969db3022c11fc8

SHA512
47c6aff78e97a5f6c972f6d443d19d5b977b1624616e25348f568f7c94e6ce1ff33d96711e06209b9719f678a1385cb9a1377abcfbca375af9c3a4e551749258

Download Submit
C:\Windows\system\mpAfnGu.exe

Filesize
1.9MB

MD5
91bb4194bf26a51ae0384c05bff979f7

SHA1
ab6de125a4ba4246aa1aec88c31d4bc38a3f0d18

SHA256
29afb0dde185e8d0513abb0b3a03b8a8a3765e94f29cf8757c5829cf5245d6bf

SHA512
f2c96ca2d34d77af42f9fc72f8d0bd22322f02d59df2da7c32114cfb57b28a3c4f518b990f8322dfbe72b6f96a700b4602a318dd23cdcebfdff8e79a46e66d0d

Download Submit
C:\Windows\system\qFzgykm.exe

Filesize
1.9MB

MD5
4a93c4833b0c7582f3e3d8139dd4af89

SHA1
e0f549a180032f73d218ff3beaf534b6259c9575

SHA256
e1e17e2be5c8c34969edbc0d57f1d03304a08e9af0ad7ca3d379fde0b1277e05

SHA512
93ddbec76dc8f66df133071d0ebfe818831f5ee7e6e8dd67ec1765b1fbfdcbcb9ee9993735e8cd9c2cfd6eb9da457ead09c99477b074a095e3d951aab9f02586

Download Submit
C:\Windows\system\qSIkCPe.exe

Filesize
1.9MB

MD5
70b68ad86e2ef8682a91e4df3b77af92

SHA1
26d529201de2323a45fe7984491c6a1a723e0df9

SHA256
b35b25fb3be8b1970822bcb1f8485a191444fb09aca9c2dac6aaaaad7807a591

SHA512
aa0f212b2b2ca55fa16c2fcc075f8c565cef66251161f252238e86413698c185dae349c318d463625270e4b12792613c9b8817af7ac4ff7a1fb845bffb40d57e

Download Submit
C:\Windows\system\qiAgKcC.exe

Filesize
1.9MB

MD5
a4c10b78128bdac40b822e63cd4e3535

SHA1
185c76e001ea46d56cba26a74bdbae5c02a42833

SHA256
f0beb6c8837684b78a9ef75c8f8b2b5a1f5b2f9bbb69507c27a73ed3c0d17769

SHA512
c02ffae85c24d40d601c8112b877c20cf6b791ba53e762396150aa90bc6dffce17a7d4ff994f4ea92d43c237c24be5e59d8969def5d610e532bde47777eeb682

Download Submit
C:\Windows\system\qnkwIaS.exe

Filesize
1.9MB

MD5
cec6a6c170eab64406b2c4fc6f0623ab

SHA1
1d3725584b24c01c7405646a775198346a2b76f7

SHA256
69d07e4c58f4cd62fc98890c560c8ec82fa8ce349608cc8e5cc50421c4dcde57

SHA512
872d7b30052a265524b67689f0906d9eb4fb3ce3de261cbbd6d1be93aa8ece7e3946fca27502c8be7aa2e61f7cc6f6cba47eae7e5c175efd140bd34cd2c14786

Download Submit
C:\Windows\system\qxkJQxU.exe

Filesize
1.9MB

MD5
7fbe6ab236f84d8728fb84588d70798f

SHA1
aeb20665f6ef91b931b1671a003c21239096e288

SHA256
107468419041796cad743c710e68a96860cea363178a80db3f00767ef6f63b55

SHA512
5997d620dbb91298f40cb3f38ea93431b6db8c03a7d0690c66283343a90584acff92e8869fe072a0ba97be70a8a10d49b0b3802a30a5262c32c8d75fca04a18c

Download Submit
C:\Windows\system\rBDKevQ.exe

Filesize
1.9MB

MD5
871cf1bea7600f002f2183295ff6158d

SHA1
43d357a21e66b5b1e2ebf711db5aabe2e0e50528

SHA256
2b9db96fc31f2fe4205820733f7b9de1bc7d5f5969b266a615b53be09e043c2a

SHA512
5a8147a791292863b6a2395f4c231e638abc76d2fcf32ff8d6398210672033bf99e73ec2fe32146883bae3dbc55f3f88fb1c71df849cfc38a8c0768f5e92e740

Download Submit
C:\Windows\system\varQQbY.exe

Filesize
1.9MB

MD5
1a63b18ed782ffa1a46d1e98e947875b

SHA1
724ac08d02670b2bb5b689d06057ec261c7ed316

SHA256
1917d856d9e562087625151d96d868967b85fae7c4e872a91cec5aed47d84aa1

SHA512
dae512c4e35e89ddac1fef9f8becc5a7eaa15d6b480027a8125e2339728a0e1b3ed3b31fcb548efb77f12161e37b501d91a5c92e521d1730fefbadd7a6752752

Download Submit
C:\Windows\system\vinICpJ.exe

Filesize
1.9MB

MD5
d679ccfb3fc2c720010013180816b883

SHA1
3766d6e6628e94535af20f417abb62630567c21d

SHA256
24c856ee874e52ec499bd48184a1e4581528309dd863e49af4b15fa1e0c869a1

SHA512
001fa5dadd4b92bfbf0fc9c81bc125631f64dd34ab258d6f3e6265bbae777255a08c7cfb0a608d47101356e45ec21b881a48d9e234499b40869ca1f64d70fac5

Download Submit
C:\Windows\system\whqgkIT.exe

Filesize
1.9MB

MD5
600fee1fa4fc10e16a05b74ea68da65a

SHA1
6e8a903524e81394e450d725a6c53179dc25b0a0

SHA256
a03b0fe84648dbbfc216a0bb872830cada78db1e88f27c37848bd49738d9a5f6

SHA512
2289daf25506400c588eedbf25c06e44397fbd90933f10f8603d0998e6df22fb1849d4fd08242f8d7fbbfa93de554f43ed875ddc875ba5546ab626477d643b75

Download Submit
C:\Windows\system\yodpjoP.exe

Filesize
1.9MB

MD5
5643311349bd1f8c2ea42ecf563c4394

SHA1
e4f643b8aba6a00529020c44099ce4d1f6f264a3

SHA256
62724ec98be751a1a2b5492a7fd5868e810cf260bc6bc6fd929e535dafb44434

SHA512
a88a59f5d40c83d49694dc7ef3b6a05dc48e40b36d2a4043847194e3d3a97638bf05b3533c73917711844776797a33f8017dd9f646e1551c9d054d21b6d01d02

Download Submit
\Windows\system\BVjPLtt.exe

Filesize
1.9MB

MD5
3dd6c5a90a349e5ce110a1edd163fa54

SHA1
98aa55d3d48e0f1a02d2858d48c1551b09397b5b

SHA256
c7b011386acfebd1ba51b529022f39b18e8bd367012e26cf503e0c9ca1171498

SHA512
764065cf46906b304ba3411a70c41fc07a9cd4dac34007e09c8034c06db0caf1ffcc419fbf30f86f3c881eb6258d23ce0a65a9694d3fd469fb5db7f5906a04f2

Download Submit
\Windows\system\CPAoZRR.exe

Filesize
1.9MB

MD5
560ecdb5f14bcbc2d137636f0cf0188f

SHA1
9816cfab6b6d76cde4680f4186b6634072539d42

SHA256
bad3f97e32333ea23e0c884c350ede670ad483af7e128fea9094723b8b363209

SHA512
ceda1fbc8f0f70651bdd3caba02516b818d58b672e6444d1f2a6f7f9bc1df556f7293509e3b8388bf0dd7e7b1c713957413136872640c5bfac357a1e34ba2211

Download Submit
\Windows\system\Njphcar.exe

Filesize
1.9MB

MD5
bb7be411adba472d6c2ef521668ba7b1

SHA1
5fd651910105ef170535ace21514d527816d2f00

SHA256
e4aa696396b1ff82dfa9864207bbd0c513ade9b0634fe0906cf42ce9a2370f17

SHA512
854f2dec32a8177ba874db8a730db203b868a87b4331dcdd01a70de8f4f26b6aed4714cc4c01cc81e98f30d99aff8f251dde36a8ac859665962131b5274f94a2

Download Submit
\Windows\system\PNGFkNV.exe

Filesize
1.9MB

MD5
e2090198e30bb075b932b19bb14725c8

SHA1
57718008b6921e524828c6c43d1c659bd9c3af0d

SHA256
500a2d7f56e8cca1802ad19e6e4fcb80f3a882295da120886d66ac802b545ae3

SHA512
76f2504070301221a5927b4b40959cd607ab8d926129591758227f4c29142ab95595d046ad4f824be91fbc4aa4a6f1f6e7acbfd74bf47ab999529343dd2691e3

Download Submit
\Windows\system\SDNBYyi.exe

Filesize
1.9MB

MD5
70306108246dcd623bc3736b740222f9

SHA1
373829229374a318db00bb4748139fe6d6d1a17a

SHA256
16a0c835f969bfecc7ba4631d8160033888ddad2c174eb0494ce3d69057a652e

SHA512
14279664e72ff7d70d425263fce5d5ff504a991f080ab297ee934e5c8c2ebfbf774940fd3845ace2e637cde62b4430da0f23462711f7f345cb083abbc7badfbc

Download Submit
\Windows\system\SNLGxKC.exe

Filesize
1.9MB

MD5
d7463aed046cf5b8ada3abc16932dda6

SHA1
833af78ac85387bb1f310ca94caee7a478039e81

SHA256
1e42f35daecf6401d978c61f208e9f3b83b0bcd65a57b5b51cee8b9b2b4e8d4d

SHA512
1c33f509d3caaf3bc018541b65b5f7c40a5efba57cd2b3b8ece3c4da18b50a71eb35d19be633ab7141e202735406b3650f01c5cfc4221daccd795caa324b453f

Download Submit
\Windows\system\SuJDEUK.exe

Filesize
1.9MB

MD5
028e353c3f143521067b439c1feb7d52

SHA1
165a9806e1fba05f2862c08a652b17aaf6a4a493

SHA256
ea65c645189cd57a15e57542c9845aa94a990a17ef7a1ef9417753cfe6070050

SHA512
a615e2f15c1b835cf68ef55729b6a6465857284ce8fef3b2b74309edc27714356542698ce42a6a78f509e101056ae3800007d97b513acc3687ef0ffd1fe5b13e

Download Submit
\Windows\system\VmAJrbB.exe

Filesize
1.9MB

MD5
74e25c1eff2dad214390e56366b5c3d8

SHA1
1e79638e6dad170294e56f431b2df59df81d7f70

SHA256
31d62c48b529f9169b45228a4e911351ee103cd5497c6c763deaf019bb58845a

SHA512
3aebcfee4ae72f0408ef8969c59019a51b9eafd5a56de7814d5a85aa38ac07c0f4575b1bd11ccc12f029e2811183a0e63e774a08085722faae1e726d8ae07c97

Download Submit
\Windows\system\WHmWNTd.exe

Filesize
1.9MB

MD5
7efe4c9567327c0ece5695bb4e95eb3d

SHA1
f0d8dab34a7a2ea2c2b058d62b9070cd2e3a85f5

SHA256
7e3545d235473fae7273678df2ea4d4599de4125e863d066fe579541b9b76051

SHA512
79352ac164286ce502c097223e6742eaa77262d2144ca2637b93edc16e15df2fa82eb0a6807e73c06f151a82290a9040dbac050c54872dbf6d6249d8e83e46eb

Download Submit
\Windows\system\Xqkkgou.exe

Filesize
1.9MB

MD5
758865f215dbd35ddde04f1b1f13abe7

SHA1
855f230d57282391abf0681227b08a1a780434c9

SHA256
dcfcdc217ac2a5812f562779af1b3ca30991e1bb712fa150623275fefd951355

SHA512
df7642d134c3a8b85e8d2044c29f388367316c4731e8e85fbceaf7a57dfc126cb92124e27af704427fcda04cde416a6eba8e2f5fe278d9b216b05e4231df71ae

Download Submit
\Windows\system\dVTvekF.exe

Filesize
1.9MB

MD5
69d326cc9a87b5f10b2c92e8278da609

SHA1
b1735991de8995c4cb8afe0828ba207bed659f0a

SHA256
f6e0e64d7d0a244804912736c0bebec5e05c7730901eba27381bad6c83413206

SHA512
c24e29b24b004a737aa22ea9fab5f63caf62aef56a3132a19285e5ba7e2b7fc4c92a57ec423c1c4e579b461505f1f53943811321f10707c132122c262d2ac780

Download Submit
\Windows\system\lnrisqQ.exe

Filesize
1.9MB

MD5
ed97035e39c87537b6214c27b4a65f24

SHA1
555c160b5e3dc82cc5eb162f6d20b1adfe8a55ed

SHA256
54d7892320535cf57c0f90038f9a9155df952d4e2d034597407ac8a808efef60

SHA512
df721c5c851cd438136eb5c8bf2a3f2d85ec725859978dce80af68a617d4454b4c57e7e493d1b95a4c8fb963095afed7be389c59155882bbc533b3fb2b21c4d9

Download Submit
\Windows\system\nNFfdgX.exe

Filesize
1.9MB

MD5
b7d1f5bef5737ec735efa41dac00c39f

SHA1
3ce5b59ef89d0a180951a8b6f364604adc5b86bf

SHA256
3bbd6ea6417b01657ccaf60e093b7c5a00ea15d2de3af5a446ff7ade2e7ca798

SHA512
31e323dcda54435e2041e2e5164637060c519d469ec6d8f9e082832ee3626f38b0944190b0c4bf24157b893d67f33720c116d162af1e7df6b37dd89e67f4441e

Download Submit
\Windows\system\pJBBGMD.exe

Filesize
1.9MB

MD5
3481063f0bf7e51b96256910664247c4

SHA1
fb0d081f7faeafd21242945d28d17e8df3c748d1

SHA256
e33323312d9e563a68d2bea611e8fced65f1bfb53d15814c2a8cd244f391e2dc

SHA512
b75af5df41f5d96bdc42345ef55c7d876a43cfc4b50bada678454363a16e31a1750d2c7fbaeb928ee79d4b1566c193192cf40bb2632250e2416be19781e87c9a

Download Submit
\Windows\system\pOTHvTB.exe

Filesize
1.9MB

MD5
002effb14ae14fa65f0e35c26c309bb0

SHA1
79409725f73a77612ff5f6f3b4e4bab37c276335

SHA256
13eafae0a2208a6515e80679145a0b354c61a975e3b24b7646a76ef19c5f8d43

SHA512
4fcc9e949f004fc6b616a59ede3e0b92be02508668142c93b4be668575a33fff79e63ddb40bd504cd2c5957a1fa7d5fc9bab71996ac606e12a41243b980f62dc

Download Submit
\Windows\system\wyaMUmj.exe

Filesize
1.9MB

MD5
05557680a02644b829d16a66bda5377c

SHA1
f3faaf4554e99510a230f82a538fe09585c1c0bf

SHA256
224ec2c4e2ecff08a6a3b2f7efe2fc010d23a3681b067e12f5fbc94acc77537e

SHA512
9abeb24b21e15797c42603a2aff2fe5a288818e2ccdc41f129925971d621dca955a02bbcb03900ad94012a34b58e408a4ceed20c9070bc1fb7cbd14383fc96fa

Download Submit
\Windows\system\xxslFNe.exe

Filesize
1.9MB

MD5
9c9267e94ce05525a8f5a939d74e6257

SHA1
5628baa5ac9a65c9fcd19259389a328887c900a6

SHA256
a074b3eea5f040be7530ed105f0c3d8b4da6bccfcb37ded78b28671fcddfbfa0

SHA512
5229a7d190713280a569bb192426ae342d733787db3d8d2e4120c6265928c0580c551ddfc09209502893011a7053f627609a0fafe22ec82117f5547f547e42eb

Download Submit
memory/2392-68-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2396-62-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-65-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2492-70-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2504-57-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-16-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-66-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2704-12-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2704-2094-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2708-60-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-55-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2956-53-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2956-54-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/2956-778-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2956-58-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2956-56-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2956-73-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2956-71-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/3048-61-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/3048-69-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/3048-83-0x0000000003660000-0x0000000003A52000-memory.dmp

Filesize
3.9MB

Download
memory/3048-6-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/3048-63-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/3048-14-0x0000000002A50000-0x0000000002E42000-memory.dmp

Filesize
3.9MB

Download
memory/3048-15-0x00000000028B0000-0x0000000002CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-64-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/3048-67-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/3048-74-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/3048-26-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/3048-2092-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/3048-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download