xmrig | 2fca1920bff751dd1edcd4ad89beb6041ca766aa308b56c5ca12055234596e60

Analysis

max time kernel
40s
max time network
36s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
Size

2.3MB
MD5

015959bb69f30b5aebc2d3944fd1de41
SHA1

06a165b51bfaed5d15dd9e87de2dcd8865fbf28f
SHA256

2fca1920bff751dd1edcd4ad89beb6041ca766aa308b56c5ca12055234596e60
SHA512

ff78738f0d562ea2bdc6c5804eae7c43bf89eb2eb9ea3de7bf8a1eece7857e1d6cb5d6512aa21ee7c4044f26fc9984aab6c004518a49d95adf8041c23d35f309
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDUF:NAB9

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2512-13-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2456-77-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2876-83-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2992-80-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2576-78-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2252-66-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2600-64-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2608-62-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2752-71-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2512	PzXgpFj.exe
2608	XwcGLiH.exe
2600	BWGNrGE.exe
2252	XROqrrr.exe
2752	CxZVYzg.exe
2456	FkiXPAr.exe
2576	oheEhKZ.exe
2992	EyrzidG.exe
2876	OaDJzWJ.exe
1596	mPChGgE.exe
2716	RqHsBrc.exe
2908	JKnWxMK.exe
1592	ZjkWtQA.exe
1872	AZuUUIM.exe
868	zyYDdFd.exe
2656	eOkvWDV.exe
1196	UGsnpos.exe
2144	mvtXZxe.exe
704	izIiPbp.exe
2912	fLbdUME.exe
1852	PSahyxX.exe
2292	cbOMRUB.exe
1400	DFKEvit.exe
2056	KWVLwEt.exe
2364	PlUhMCt.exe
1328	vADyZcc.exe
1488	BvcHCYF.exe
1324	UqMoHKb.exe
300	pvzokHt.exe
560	ynpCqsJ.exe
3060	NxyRKSM.exe
1600	oxBnsKr.exe
2204	WbmmwcS.exe
2080	pdydidb.exe
1440	Zwwkcap.exe
112	nXmtpZD.exe
2824	vnqlhjd.exe
604	FYPXfbK.exe
1228	TtPjKHu.exe
2504	vxYMaby.exe
2040	ueuqzlq.exe
2440	unrViRZ.exe
2740	KUFDzee.exe
1636	pXPwcPX.exe
860	TmEzWDg.exe
2248	kuebdLt.exe
2972	SxEjneM.exe
2808	gfJxlTj.exe
492	GzpIqXw.exe
1672	ELBUNow.exe
912	mlZXRTa.exe
2928	SEzTZPN.exe
2592	xfivkGA.exe
2780	nssOAgF.exe
2888	ABjPsya.exe
2924	xtevIXS.exe
2112	nqaiaJd.exe
2424	ujkuOCT.exe
3084	AHPJXfN.exe
3116	bQQdOMF.exe
2744	dFQsigR.exe
1136	sVSyJiy.exe
2268	wSHlrzS.exe
3000	EVRhNDR.exe

Loads dropped DLL 64 IoCs

pid	Process
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2492-0-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/files/0x000b000000016056-3.dat	upx
behavioral1/memory/2512-13-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/files/0x00390000000167ef-18.dat	upx
behavioral1/files/0x001400000000549e-17.dat	upx
behavioral1/files/0x0008000000016c7a-24.dat	upx
behavioral1/files/0x0009000000016ced-37.dat	upx
behavioral1/files/0x0007000000016cc9-33.dat	upx
behavioral1/files/0x0006000000017060-51.dat	upx
behavioral1/files/0x0006000000017185-53.dat	upx
behavioral1/files/0x0007000000016cf5-47.dat	upx
behavioral1/files/0x0006000000017384-67.dat	upx
behavioral1/memory/2456-77-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2876-83-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/files/0x0005000000018664-115.dat	upx
behavioral1/files/0x0005000000019316-178.dat	upx
behavioral1/files/0x00050000000193e7-193.dat	upx
behavioral1/files/0x000500000001938d-186.dat	upx
behavioral1/files/0x0005000000019250-171.dat	upx
behavioral1/files/0x000500000001922d-162.dat	upx
behavioral1/files/0x000500000001876e-152.dat	upx
behavioral1/files/0x0005000000018756-144.dat	upx
behavioral1/files/0x0005000000018765-146.dat	upx
behavioral1/files/0x0005000000018717-138.dat	upx
behavioral1/files/0x0039000000016a45-137.dat	upx
behavioral1/files/0x0006000000017465-133.dat	upx
behavioral1/files/0x00050000000186dd-128.dat	upx
behavioral1/files/0x0006000000017474-104.dat	upx
behavioral1/files/0x0009000000018648-103.dat	upx
behavioral1/files/0x00050000000193a1-189.dat	upx
behavioral1/files/0x000500000001865b-185.dat	upx
behavioral1/files/0x0005000000019383-180.dat	upx
behavioral1/files/0x0005000000019260-172.dat	upx
behavioral1/files/0x0005000000019233-164.dat	upx
behavioral1/files/0x0006000000018ffa-154.dat	upx
behavioral1/files/0x00050000000186c4-118.dat	upx
behavioral1/files/0x00050000000186cf-126.dat	upx
behavioral1/files/0x0006000000017387-91.dat	upx
behavioral1/files/0x0031000000018649-110.dat	upx
behavioral1/files/0x0006000000017458-94.dat	upx
behavioral1/memory/2992-80-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2576-78-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2252-66-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2600-64-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2608-62-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2752-71-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/files/0x0007000000016cab-32.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xSRZKpz.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\oCjujST.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\ABnyPNG.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\lMxNdzv.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\YfNmQTX.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\AjUMEVL.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\maoUaos.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\AteTEie.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\WmMwhyI.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\fHOYMEt.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\YnfYLmq.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\bJLBQvG.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\bQbYEcj.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\gxDXyFS.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\tjCSiYG.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\zjzUEWM.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\grRTYCV.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\BnEkOOl.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\AQYcHeD.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\DABoXzs.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\FWoEDXR.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\ZiXTmTl.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\gIrmxTZ.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\fxGlXob.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\fWeBDPv.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\OrulFHp.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\mguWYzT.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\BwhjbnH.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\HCbugIg.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\QjQGVkD.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\MdDFQYS.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\uInyGkP.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\eZALWGw.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\HxWKskC.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\VQcrqVz.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\kwQlrlh.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\dDqhoom.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\LicOHEa.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\IXryDNJ.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\dlHJWel.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\DDtcVIn.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\xxSqILR.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\OuEdjej.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\JnWyASz.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\neqONga.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\DQrRsiz.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\zcoHbFw.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\PtecUmk.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\iMSOtdS.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\oohlwEA.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\QxouJur.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\FMWvgLs.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\EfVZuAO.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\CCFkZph.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\aQfOuUB.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\cmrDbXn.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\tgERJQd.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\YvnMQaY.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\GamNxSy.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\NIgedmV.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\noEzXDs.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\OXIapCj.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\axmDEPX.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\hUclvhQ.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2500	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
Token: SeDebugPrivilege	2500	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2500	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	29
PID 2492 wrote to memory of 2500	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	29
PID 2492 wrote to memory of 2500	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	29
PID 2492 wrote to memory of 2512	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	30
PID 2492 wrote to memory of 2512	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	30
PID 2492 wrote to memory of 2512	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	30
PID 2492 wrote to memory of 2608	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2608	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2608	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2600	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	32
PID 2492 wrote to memory of 2600	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	32
PID 2492 wrote to memory of 2600	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	32
PID 2492 wrote to memory of 2252	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	33
PID 2492 wrote to memory of 2252	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	33
PID 2492 wrote to memory of 2252	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	33
PID 2492 wrote to memory of 2752	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	34
PID 2492 wrote to memory of 2752	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	34
PID 2492 wrote to memory of 2752	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	34
PID 2492 wrote to memory of 2576	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	35
PID 2492 wrote to memory of 2576	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	35
PID 2492 wrote to memory of 2576	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	35
PID 2492 wrote to memory of 2456	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	36
PID 2492 wrote to memory of 2456	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	36
PID 2492 wrote to memory of 2456	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	36
PID 2492 wrote to memory of 2992	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	37
PID 2492 wrote to memory of 2992	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	37
PID 2492 wrote to memory of 2992	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	37
PID 2492 wrote to memory of 2876	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	38
PID 2492 wrote to memory of 2876	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	38
PID 2492 wrote to memory of 2876	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	38
PID 2492 wrote to memory of 1596	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	39
PID 2492 wrote to memory of 1596	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	39
PID 2492 wrote to memory of 1596	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	39
PID 2492 wrote to memory of 2716	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	40
PID 2492 wrote to memory of 2716	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	40
PID 2492 wrote to memory of 2716	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	40
PID 2492 wrote to memory of 2908	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	41
PID 2492 wrote to memory of 2908	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	41
PID 2492 wrote to memory of 2908	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	41
PID 2492 wrote to memory of 1592	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	42
PID 2492 wrote to memory of 1592	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	42
PID 2492 wrote to memory of 1592	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	42
PID 2492 wrote to memory of 2144	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	43
PID 2492 wrote to memory of 2144	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	43
PID 2492 wrote to memory of 2144	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	43
PID 2492 wrote to memory of 1872	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	44
PID 2492 wrote to memory of 1872	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	44
PID 2492 wrote to memory of 1872	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	44
PID 2492 wrote to memory of 2292	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	45
PID 2492 wrote to memory of 2292	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	45
PID 2492 wrote to memory of 2292	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	45
PID 2492 wrote to memory of 868	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	46
PID 2492 wrote to memory of 868	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	46
PID 2492 wrote to memory of 868	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	46
PID 2492 wrote to memory of 1328	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	47
PID 2492 wrote to memory of 1328	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	47
PID 2492 wrote to memory of 1328	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	47
PID 2492 wrote to memory of 2656	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	48
PID 2492 wrote to memory of 2656	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	48
PID 2492 wrote to memory of 2656	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	48
PID 2492 wrote to memory of 604	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	49
PID 2492 wrote to memory of 604	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	49
PID 2492 wrote to memory of 604	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	49
PID 2492 wrote to memory of 1196	2492	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\System\PzXgpFj.exe
  C:\Windows\System\PzXgpFj.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\XwcGLiH.exe
  C:\Windows\System\XwcGLiH.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\BWGNrGE.exe
  C:\Windows\System\BWGNrGE.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\XROqrrr.exe
  C:\Windows\System\XROqrrr.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\CxZVYzg.exe
  C:\Windows\System\CxZVYzg.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\oheEhKZ.exe
  C:\Windows\System\oheEhKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\FkiXPAr.exe
  C:\Windows\System\FkiXPAr.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\EyrzidG.exe
  C:\Windows\System\EyrzidG.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\OaDJzWJ.exe
  C:\Windows\System\OaDJzWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\mPChGgE.exe
  C:\Windows\System\mPChGgE.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\RqHsBrc.exe
  C:\Windows\System\RqHsBrc.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\JKnWxMK.exe
  C:\Windows\System\JKnWxMK.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\ZjkWtQA.exe
  C:\Windows\System\ZjkWtQA.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\mvtXZxe.exe
  C:\Windows\System\mvtXZxe.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\AZuUUIM.exe
  C:\Windows\System\AZuUUIM.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\cbOMRUB.exe
  C:\Windows\System\cbOMRUB.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\zyYDdFd.exe
  C:\Windows\System\zyYDdFd.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\vADyZcc.exe
  C:\Windows\System\vADyZcc.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\eOkvWDV.exe
  C:\Windows\System\eOkvWDV.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\FYPXfbK.exe
  C:\Windows\System\FYPXfbK.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\UGsnpos.exe
  C:\Windows\System\UGsnpos.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\TtPjKHu.exe
  C:\Windows\System\TtPjKHu.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\izIiPbp.exe
  C:\Windows\System\izIiPbp.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\vxYMaby.exe
  C:\Windows\System\vxYMaby.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\fLbdUME.exe
  C:\Windows\System\fLbdUME.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\ueuqzlq.exe
  C:\Windows\System\ueuqzlq.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\PSahyxX.exe
  C:\Windows\System\PSahyxX.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\dFQsigR.exe
  C:\Windows\System\dFQsigR.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\DFKEvit.exe
  C:\Windows\System\DFKEvit.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\sVSyJiy.exe
  C:\Windows\System\sVSyJiy.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\KWVLwEt.exe
  C:\Windows\System\KWVLwEt.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\wSHlrzS.exe
  C:\Windows\System\wSHlrzS.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\PlUhMCt.exe
  C:\Windows\System\PlUhMCt.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\EVRhNDR.exe
  C:\Windows\System\EVRhNDR.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\BvcHCYF.exe
  C:\Windows\System\BvcHCYF.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\OeTnoos.exe
  C:\Windows\System\OeTnoos.exe
  2⤵
  PID:1900
- C:\Windows\System\UqMoHKb.exe
  C:\Windows\System\UqMoHKb.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\ALTCxRS.exe
  C:\Windows\System\ALTCxRS.exe
  2⤵
  PID:1804
- C:\Windows\System\pvzokHt.exe
  C:\Windows\System\pvzokHt.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\YTfSjIe.exe
  C:\Windows\System\YTfSjIe.exe
  2⤵
  PID:820
- C:\Windows\System\ynpCqsJ.exe
  C:\Windows\System\ynpCqsJ.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\rhVMuNL.exe
  C:\Windows\System\rhVMuNL.exe
  2⤵
  PID:1448
- C:\Windows\System\NxyRKSM.exe
  C:\Windows\System\NxyRKSM.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\lOoOawn.exe
  C:\Windows\System\lOoOawn.exe
  2⤵
  PID:1700
- C:\Windows\System\oxBnsKr.exe
  C:\Windows\System\oxBnsKr.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\ACpgflr.exe
  C:\Windows\System\ACpgflr.exe
  2⤵
  PID:1688
- C:\Windows\System\WbmmwcS.exe
  C:\Windows\System\WbmmwcS.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\VXTrmwN.exe
  C:\Windows\System\VXTrmwN.exe
  2⤵
  PID:2148
- C:\Windows\System\pdydidb.exe
  C:\Windows\System\pdydidb.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\eUATNJo.exe
  C:\Windows\System\eUATNJo.exe
  2⤵
  PID:1924
- C:\Windows\System\Zwwkcap.exe
  C:\Windows\System\Zwwkcap.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\QqkSsVh.exe
  C:\Windows\System\QqkSsVh.exe
  2⤵
  PID:2316
- C:\Windows\System\nXmtpZD.exe
  C:\Windows\System\nXmtpZD.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\NsqHxmI.exe
  C:\Windows\System\NsqHxmI.exe
  2⤵
  PID:2304
- C:\Windows\System\vnqlhjd.exe
  C:\Windows\System\vnqlhjd.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ZhgSitw.exe
  C:\Windows\System\ZhgSitw.exe
  2⤵
  PID:2200
- C:\Windows\System\unrViRZ.exe
  C:\Windows\System\unrViRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\GXaryTh.exe
  C:\Windows\System\GXaryTh.exe
  2⤵
  PID:1764
- C:\Windows\System\KUFDzee.exe
  C:\Windows\System\KUFDzee.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\QsvfHvv.exe
  C:\Windows\System\QsvfHvv.exe
  2⤵
  PID:2700
- C:\Windows\System\pXPwcPX.exe
  C:\Windows\System\pXPwcPX.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\LaiGkHW.exe
  C:\Windows\System\LaiGkHW.exe
  2⤵
  PID:1920
- C:\Windows\System\TmEzWDg.exe
  C:\Windows\System\TmEzWDg.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\WNtGNaL.exe
  C:\Windows\System\WNtGNaL.exe
  2⤵
  PID:2096
- C:\Windows\System\kuebdLt.exe
  C:\Windows\System\kuebdLt.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\jeXWRYJ.exe
  C:\Windows\System\jeXWRYJ.exe
  2⤵
  PID:1740
- C:\Windows\System\SxEjneM.exe
  C:\Windows\System\SxEjneM.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\YVmQzOK.exe
  C:\Windows\System\YVmQzOK.exe
  2⤵
  PID:1864
- C:\Windows\System\gfJxlTj.exe
  C:\Windows\System\gfJxlTj.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\GslQjNB.exe
  C:\Windows\System\GslQjNB.exe
  2⤵
  PID:2680
- C:\Windows\System\GzpIqXw.exe
  C:\Windows\System\GzpIqXw.exe
  2⤵
  - Executes dropped EXE
  PID:492
- C:\Windows\System\symGegG.exe
  C:\Windows\System\symGegG.exe
  2⤵
  PID:2420
- C:\Windows\System\ELBUNow.exe
  C:\Windows\System\ELBUNow.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\AaabWDK.exe
  C:\Windows\System\AaabWDK.exe
  2⤵
  PID:3020
- C:\Windows\System\mlZXRTa.exe
  C:\Windows\System\mlZXRTa.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\WPdwdgB.exe
  C:\Windows\System\WPdwdgB.exe
  2⤵
  PID:552
- C:\Windows\System\SEzTZPN.exe
  C:\Windows\System\SEzTZPN.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\QtrywXT.exe
  C:\Windows\System\QtrywXT.exe
  2⤵
  PID:2224
- C:\Windows\System\xfivkGA.exe
  C:\Windows\System\xfivkGA.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\yZuHXBM.exe
  C:\Windows\System\yZuHXBM.exe
  2⤵
  PID:2672
- C:\Windows\System\nssOAgF.exe
  C:\Windows\System\nssOAgF.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\ZYUWyDd.exe
  C:\Windows\System\ZYUWyDd.exe
  2⤵
  PID:3056
- C:\Windows\System\ABjPsya.exe
  C:\Windows\System\ABjPsya.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\PdEEECO.exe
  C:\Windows\System\PdEEECO.exe
  2⤵
  PID:1432
- C:\Windows\System\xtevIXS.exe
  C:\Windows\System\xtevIXS.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\oHIprkm.exe
  C:\Windows\System\oHIprkm.exe
  2⤵
  PID:2568
- C:\Windows\System\nqaiaJd.exe
  C:\Windows\System\nqaiaJd.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\SSpnmWh.exe
  C:\Windows\System\SSpnmWh.exe
  2⤵
  PID:2128
- C:\Windows\System\ujkuOCT.exe
  C:\Windows\System\ujkuOCT.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\MzTVgsN.exe
  C:\Windows\System\MzTVgsN.exe
  2⤵
  PID:2900
- C:\Windows\System\AHPJXfN.exe
  C:\Windows\System\AHPJXfN.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\RehIbrM.exe
  C:\Windows\System\RehIbrM.exe
  2⤵
  PID:3100
- C:\Windows\System\bQQdOMF.exe
  C:\Windows\System\bQQdOMF.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\PYzcBwH.exe
  C:\Windows\System\PYzcBwH.exe
  2⤵
  PID:3132
- C:\Windows\System\iQgcjTM.exe
  C:\Windows\System\iQgcjTM.exe
  2⤵
  PID:3156
- C:\Windows\System\lwpuMPQ.exe
  C:\Windows\System\lwpuMPQ.exe
  2⤵
  PID:3184
- C:\Windows\System\LpwBQpW.exe
  C:\Windows\System\LpwBQpW.exe
  2⤵
  PID:3208
- C:\Windows\System\stGLoAr.exe
  C:\Windows\System\stGLoAr.exe
  2⤵
  PID:3224
- C:\Windows\System\yDiTYMp.exe
  C:\Windows\System\yDiTYMp.exe
  2⤵
  PID:3240
- C:\Windows\System\DzSKFNK.exe
  C:\Windows\System\DzSKFNK.exe
  2⤵
  PID:3256
- C:\Windows\System\dgSxIyM.exe
  C:\Windows\System\dgSxIyM.exe
  2⤵
  PID:3272
- C:\Windows\System\quYnTWe.exe
  C:\Windows\System\quYnTWe.exe
  2⤵
  PID:3288
- C:\Windows\System\woqsGqj.exe
  C:\Windows\System\woqsGqj.exe
  2⤵
  PID:3304
- C:\Windows\System\UMFzBSe.exe
  C:\Windows\System\UMFzBSe.exe
  2⤵
  PID:3328
- C:\Windows\System\uyrMfSC.exe
  C:\Windows\System\uyrMfSC.exe
  2⤵
  PID:3352
- C:\Windows\System\gYSOKQg.exe
  C:\Windows\System\gYSOKQg.exe
  2⤵
  PID:3368
- C:\Windows\System\cshgqnF.exe
  C:\Windows\System\cshgqnF.exe
  2⤵
  PID:3384
- C:\Windows\System\MSaSVPT.exe
  C:\Windows\System\MSaSVPT.exe
  2⤵
  PID:3400
- C:\Windows\System\iQyCtTc.exe
  C:\Windows\System\iQyCtTc.exe
  2⤵
  PID:3424
- C:\Windows\System\EcjGxby.exe
  C:\Windows\System\EcjGxby.exe
  2⤵
  PID:3448
- C:\Windows\System\DWdforG.exe
  C:\Windows\System\DWdforG.exe
  2⤵
  PID:3464
- C:\Windows\System\qYoiIdW.exe
  C:\Windows\System\qYoiIdW.exe
  2⤵
  PID:3480
- C:\Windows\System\wMtuaim.exe
  C:\Windows\System\wMtuaim.exe
  2⤵
  PID:3496
- C:\Windows\System\ZikdtOa.exe
  C:\Windows\System\ZikdtOa.exe
  2⤵
  PID:3512
- C:\Windows\System\sQWjkHj.exe
  C:\Windows\System\sQWjkHj.exe
  2⤵
  PID:3528
- C:\Windows\System\OBvhOWs.exe
  C:\Windows\System\OBvhOWs.exe
  2⤵
  PID:3544
- C:\Windows\System\aBphQtb.exe
  C:\Windows\System\aBphQtb.exe
  2⤵
  PID:3564
- C:\Windows\System\mChZKEf.exe
  C:\Windows\System\mChZKEf.exe
  2⤵
  PID:3580
- C:\Windows\System\BhwELtP.exe
  C:\Windows\System\BhwELtP.exe
  2⤵
  PID:3596
- C:\Windows\System\KwtIQfL.exe
  C:\Windows\System\KwtIQfL.exe
  2⤵
  PID:3612
- C:\Windows\System\DCVyzyS.exe
  C:\Windows\System\DCVyzyS.exe
  2⤵
  PID:3628
- C:\Windows\System\fQMywTG.exe
  C:\Windows\System\fQMywTG.exe
  2⤵
  PID:3644
- C:\Windows\System\elsEcoH.exe
  C:\Windows\System\elsEcoH.exe
  2⤵
  PID:3660
- C:\Windows\System\mkpbCxn.exe
  C:\Windows\System\mkpbCxn.exe
  2⤵
  PID:3680
- C:\Windows\System\KwcQBMj.exe
  C:\Windows\System\KwcQBMj.exe
  2⤵
  PID:3696
- C:\Windows\System\EbjLKAp.exe
  C:\Windows\System\EbjLKAp.exe
  2⤵
  PID:3712
- C:\Windows\System\HENqOoa.exe
  C:\Windows\System\HENqOoa.exe
  2⤵
  PID:3728
- C:\Windows\System\JHhkOqW.exe
  C:\Windows\System\JHhkOqW.exe
  2⤵
  PID:3744
- C:\Windows\System\sCITikp.exe
  C:\Windows\System\sCITikp.exe
  2⤵
  PID:3760
- C:\Windows\System\fsECGEM.exe
  C:\Windows\System\fsECGEM.exe
  2⤵
  PID:3776
- C:\Windows\System\krBCjUp.exe
  C:\Windows\System\krBCjUp.exe
  2⤵
  PID:3796
- C:\Windows\System\YfPoZJQ.exe
  C:\Windows\System\YfPoZJQ.exe
  2⤵
  PID:3812
- C:\Windows\System\IkTSIQz.exe
  C:\Windows\System\IkTSIQz.exe
  2⤵
  PID:3828
- C:\Windows\System\gbkWiXw.exe
  C:\Windows\System\gbkWiXw.exe
  2⤵
  PID:3844
- C:\Windows\System\aWEHjBH.exe
  C:\Windows\System\aWEHjBH.exe
  2⤵
  PID:3860
- C:\Windows\System\hIgdmNS.exe
  C:\Windows\System\hIgdmNS.exe
  2⤵
  PID:3876
- C:\Windows\System\LUPZdOK.exe
  C:\Windows\System\LUPZdOK.exe
  2⤵
  PID:3892
- C:\Windows\System\PIhZGGy.exe
  C:\Windows\System\PIhZGGy.exe
  2⤵
  PID:3912
- C:\Windows\System\kbpDlNt.exe
  C:\Windows\System\kbpDlNt.exe
  2⤵
  PID:3928
- C:\Windows\System\KBPoHee.exe
  C:\Windows\System\KBPoHee.exe
  2⤵
  PID:3944
- C:\Windows\System\dBsIoyK.exe
  C:\Windows\System\dBsIoyK.exe
  2⤵
  PID:3960
- C:\Windows\System\vddIFRj.exe
  C:\Windows\System\vddIFRj.exe
  2⤵
  PID:3976
- C:\Windows\System\JeLRVPY.exe
  C:\Windows\System\JeLRVPY.exe
  2⤵
  PID:3992
- C:\Windows\System\FWdxxHQ.exe
  C:\Windows\System\FWdxxHQ.exe
  2⤵
  PID:4008
- C:\Windows\System\qTNwdfb.exe
  C:\Windows\System\qTNwdfb.exe
  2⤵
  PID:4028
- C:\Windows\System\tHsKAin.exe
  C:\Windows\System\tHsKAin.exe
  2⤵
  PID:4044
- C:\Windows\System\QaEHVes.exe
  C:\Windows\System\QaEHVes.exe
  2⤵
  PID:4060
- C:\Windows\System\hkpMLdF.exe
  C:\Windows\System\hkpMLdF.exe
  2⤵
  PID:4076
- C:\Windows\System\fzyTnnU.exe
  C:\Windows\System\fzyTnnU.exe
  2⤵
  PID:4092
- C:\Windows\System\YRlMKID.exe
  C:\Windows\System\YRlMKID.exe
  2⤵
  PID:3092
- C:\Windows\System\nOkgnyg.exe
  C:\Windows\System\nOkgnyg.exe
  2⤵
  PID:2088
- C:\Windows\System\rvWPlbc.exe
  C:\Windows\System\rvWPlbc.exe
  2⤵
  PID:452
- C:\Windows\System\clFJaCF.exe
  C:\Windows\System\clFJaCF.exe
  2⤵
  PID:4220
- C:\Windows\System\voKoZNd.exe
  C:\Windows\System\voKoZNd.exe
  2⤵
  PID:4236
- C:\Windows\System\HkreYhk.exe
  C:\Windows\System\HkreYhk.exe
  2⤵
  PID:4252
- C:\Windows\System\ClbDxgx.exe
  C:\Windows\System\ClbDxgx.exe
  2⤵
  PID:4272
- C:\Windows\System\WGXThYN.exe
  C:\Windows\System\WGXThYN.exe
  2⤵
  PID:4288
- C:\Windows\System\WIIBisj.exe
  C:\Windows\System\WIIBisj.exe
  2⤵
  PID:4304
- C:\Windows\System\xSzcYiu.exe
  C:\Windows\System\xSzcYiu.exe
  2⤵
  PID:4320
- C:\Windows\System\LWJsRsW.exe
  C:\Windows\System\LWJsRsW.exe
  2⤵
  PID:4336
- C:\Windows\System\jJxeCfh.exe
  C:\Windows\System\jJxeCfh.exe
  2⤵
  PID:4352
- C:\Windows\System\NUftnqL.exe
  C:\Windows\System\NUftnqL.exe
  2⤵
  PID:4368
- C:\Windows\System\xPanVEq.exe
  C:\Windows\System\xPanVEq.exe
  2⤵
  PID:4788
- C:\Windows\System\sVmfvtL.exe
  C:\Windows\System\sVmfvtL.exe
  2⤵
  PID:4804
- C:\Windows\System\URxWvEz.exe
  C:\Windows\System\URxWvEz.exe
  2⤵
  PID:4820
- C:\Windows\System\DOpyrZw.exe
  C:\Windows\System\DOpyrZw.exe
  2⤵
  PID:4844
- C:\Windows\System\iaNehcw.exe
  C:\Windows\System\iaNehcw.exe
  2⤵
  PID:4864
- C:\Windows\System\vIOFDNy.exe
  C:\Windows\System\vIOFDNy.exe
  2⤵
  PID:4892
- C:\Windows\System\yVWAiHR.exe
  C:\Windows\System\yVWAiHR.exe
  2⤵
  PID:4912
- C:\Windows\System\mezseIa.exe
  C:\Windows\System\mezseIa.exe
  2⤵
  PID:3704
- C:\Windows\System\FZycylC.exe
  C:\Windows\System\FZycylC.exe
  2⤵
  PID:3868
- C:\Windows\System\aiNhRhC.exe
  C:\Windows\System\aiNhRhC.exe
  2⤵
  PID:3908
- C:\Windows\System\qqfJOsh.exe
  C:\Windows\System\qqfJOsh.exe
  2⤵
  PID:4036
- C:\Windows\System\ZSBDwJo.exe
  C:\Windows\System\ZSBDwJo.exe
  2⤵
  PID:1876
- C:\Windows\System\HGsuuuR.exe
  C:\Windows\System\HGsuuuR.exe
  2⤵
  PID:3012
- C:\Windows\System\oJpZuMB.exe
  C:\Windows\System\oJpZuMB.exe
  2⤵
  PID:2880
- C:\Windows\System\THkFsSU.exe
  C:\Windows\System\THkFsSU.exe
  2⤵
  PID:568
- C:\Windows\System\yfLwcEx.exe
  C:\Windows\System\yfLwcEx.exe
  2⤵
  PID:2468
- C:\Windows\System\cQSlnWt.exe
  C:\Windows\System\cQSlnWt.exe
  2⤵
  PID:4260
- C:\Windows\System\zUiRyqm.exe
  C:\Windows\System\zUiRyqm.exe
  2⤵
  PID:4300
- C:\Windows\System\DTOZmhw.exe
  C:\Windows\System\DTOZmhw.exe
  2⤵
  PID:4364
- C:\Windows\System\WxtaKeM.exe
  C:\Windows\System\WxtaKeM.exe
  2⤵
  PID:496
- C:\Windows\System\nHblbdr.exe
  C:\Windows\System\nHblbdr.exe
  2⤵
  PID:2760
- C:\Windows\System\XCMteeL.exe
  C:\Windows\System\XCMteeL.exe
  2⤵
  PID:3952
- C:\Windows\System\Lymgaud.exe
  C:\Windows\System\Lymgaud.exe
  2⤵
  PID:3792
- C:\Windows\System\BocwklI.exe
  C:\Windows\System\BocwklI.exe
  2⤵
  PID:3656
- C:\Windows\System\jdFAQLI.exe
  C:\Windows\System\jdFAQLI.exe
  2⤵
  PID:3524
- C:\Windows\System\kVnQrCB.exe
  C:\Windows\System\kVnQrCB.exe
  2⤵
  PID:3408
- C:\Windows\System\pgTfmuj.exe
  C:\Windows\System\pgTfmuj.exe
  2⤵
  PID:3336
- C:\Windows\System\MWFCqsm.exe
  C:\Windows\System\MWFCqsm.exe
  2⤵
  PID:3236
- C:\Windows\System\CvWqoxM.exe
  C:\Windows\System\CvWqoxM.exe
  2⤵
  PID:2412
- C:\Windows\System\iAzFKor.exe
  C:\Windows\System\iAzFKor.exe
  2⤵
  PID:2952
- C:\Windows\System\QjQGVkD.exe
  C:\Windows\System\QjQGVkD.exe
  2⤵
  PID:3080
- C:\Windows\System\WwgzXkQ.exe
  C:\Windows\System\WwgzXkQ.exe
  2⤵
  PID:1036
- C:\Windows\System\cAgMqPG.exe
  C:\Windows\System\cAgMqPG.exe
  2⤵
  PID:4020
- C:\Windows\System\FhpaACQ.exe
  C:\Windows\System\FhpaACQ.exe
  2⤵
  PID:4836
- C:\Windows\System\tVALQms.exe
  C:\Windows\System\tVALQms.exe
  2⤵
  PID:4888
- C:\Windows\System\FUwjDMu.exe
  C:\Windows\System\FUwjDMu.exe
  2⤵
  PID:2724
- C:\Windows\System\SnvdNnZ.exe
  C:\Windows\System\SnvdNnZ.exe
  2⤵
  PID:2296
- C:\Windows\System\heEpBeD.exe
  C:\Windows\System\heEpBeD.exe
  2⤵
  PID:5028
- C:\Windows\System\tuqgOCz.exe
  C:\Windows\System\tuqgOCz.exe
  2⤵
  PID:5040
- C:\Windows\System\glbTSHa.exe
  C:\Windows\System\glbTSHa.exe
  2⤵
  PID:5060
- C:\Windows\System\gIsDFTs.exe
  C:\Windows\System\gIsDFTs.exe
  2⤵
  PID:5076
- C:\Windows\System\KJyKyIe.exe
  C:\Windows\System\KJyKyIe.exe
  2⤵
  PID:5096
- C:\Windows\System\ZFwdvKv.exe
  C:\Windows\System\ZFwdvKv.exe
  2⤵
  PID:5108
- C:\Windows\System\ZmTknWO.exe
  C:\Windows\System\ZmTknWO.exe
  2⤵
  PID:3128
- C:\Windows\System\lWhxoXa.exe
  C:\Windows\System\lWhxoXa.exe
  2⤵
  PID:3220
- C:\Windows\System\nyDYOVl.exe
  C:\Windows\System\nyDYOVl.exe
  2⤵
  PID:3316
- C:\Windows\System\cwqgvQp.exe
  C:\Windows\System\cwqgvQp.exe
  2⤵
  PID:3392
- C:\Windows\System\XtCSlfW.exe
  C:\Windows\System\XtCSlfW.exe
  2⤵
  PID:2220
- C:\Windows\System\FDYEKnL.exe
  C:\Windows\System\FDYEKnL.exe
  2⤵
  PID:3476
- C:\Windows\System\KAzNIau.exe
  C:\Windows\System\KAzNIau.exe
  2⤵
  PID:3576
- C:\Windows\System\HIljNEz.exe
  C:\Windows\System\HIljNEz.exe
  2⤵
  PID:3636
- C:\Windows\System\ItfOajM.exe
  C:\Windows\System\ItfOajM.exe
  2⤵
  PID:2188
- C:\Windows\System\WobgaeS.exe
  C:\Windows\System\WobgaeS.exe
  2⤵
  PID:1612
- C:\Windows\System\OComVdY.exe
  C:\Windows\System\OComVdY.exe
  2⤵
  PID:1004
- C:\Windows\System\uscHMZa.exe
  C:\Windows\System\uscHMZa.exe
  2⤵
  PID:3920
- C:\Windows\System\IoHnSrh.exe
  C:\Windows\System\IoHnSrh.exe
  2⤵
  PID:3720
- C:\Windows\System\TsWLQRD.exe
  C:\Windows\System\TsWLQRD.exe
  2⤵
  PID:3588
- C:\Windows\System\mFhPgNB.exe
  C:\Windows\System\mFhPgNB.exe
  2⤵
  PID:3456
- C:\Windows\System\doqcoJx.exe
  C:\Windows\System\doqcoJx.exe
  2⤵
  PID:3196
- C:\Windows\System\wVmHUUd.exe
  C:\Windows\System\wVmHUUd.exe
  2⤵
  PID:2676
- C:\Windows\System\YWjpOgT.exe
  C:\Windows\System\YWjpOgT.exe
  2⤵
  PID:3768
- C:\Windows\System\WixVGqR.exe
  C:\Windows\System\WixVGqR.exe
  2⤵
  PID:964
- C:\Windows\System\rzrueJb.exe
  C:\Windows\System\rzrueJb.exe
  2⤵
  PID:2032
- C:\Windows\System\sSSzKSf.exe
  C:\Windows\System\sSSzKSf.exe
  2⤵
  PID:2688
- C:\Windows\System\qmUYOWU.exe
  C:\Windows\System\qmUYOWU.exe
  2⤵
  PID:288
- C:\Windows\System\sYqKPYH.exe
  C:\Windows\System\sYqKPYH.exe
  2⤵
  PID:2944
- C:\Windows\System\ERAvzuy.exe
  C:\Windows\System\ERAvzuy.exe
  2⤵
  PID:4280
- C:\Windows\System\MEXgVkN.exe
  C:\Windows\System\MEXgVkN.exe
  2⤵
  PID:4344
- C:\Windows\System\zmBnShH.exe
  C:\Windows\System\zmBnShH.exe
  2⤵
  PID:4388
- C:\Windows\System\bXJGcdr.exe
  C:\Windows\System\bXJGcdr.exe
  2⤵
  PID:4404
- C:\Windows\System\KnNWiDL.exe
  C:\Windows\System\KnNWiDL.exe
  2⤵
  PID:4420
- C:\Windows\System\RyiyWFE.exe
  C:\Windows\System\RyiyWFE.exe
  2⤵
  PID:4436
- C:\Windows\System\oeXEVcb.exe
  C:\Windows\System\oeXEVcb.exe
  2⤵
  PID:4456
- C:\Windows\System\ExwrcPn.exe
  C:\Windows\System\ExwrcPn.exe
  2⤵
  PID:4708
- C:\Windows\System\bbGpKfD.exe
  C:\Windows\System\bbGpKfD.exe
  2⤵
  PID:4724
- C:\Windows\System\xSImJhc.exe
  C:\Windows\System\xSImJhc.exe
  2⤵
  PID:4740
- C:\Windows\System\TLMDOUL.exe
  C:\Windows\System\TLMDOUL.exe
  2⤵
  PID:4756
- C:\Windows\System\wAMPvTk.exe
  C:\Windows\System\wAMPvTk.exe
  2⤵
  PID:4772
- C:\Windows\System\OsYaLJp.exe
  C:\Windows\System\OsYaLJp.exe
  2⤵
  PID:4776
- C:\Windows\System\ofVeCQk.exe
  C:\Windows\System\ofVeCQk.exe
  2⤵
  PID:4860
- C:\Windows\System\WeSAOiI.exe
  C:\Windows\System\WeSAOiI.exe
  2⤵
  PID:4216
- C:\Windows\System\owrwXpm.exe
  C:\Windows\System\owrwXpm.exe
  2⤵
  PID:4088
- C:\Windows\System\akmVsjt.exe
  C:\Windows\System\akmVsjt.exe
  2⤵
  PID:4052
- C:\Windows\System\lqRFLXb.exe
  C:\Windows\System\lqRFLXb.exe
  2⤵
  PID:3692
- C:\Windows\System\pvOQJZi.exe
  C:\Windows\System\pvOQJZi.exe
  2⤵
  PID:4332
- C:\Windows\System\vnyezbD.exe
  C:\Windows\System\vnyezbD.exe
  2⤵
  PID:2300
- C:\Windows\System\DHltzgz.exe
  C:\Windows\System\DHltzgz.exe
  2⤵
  PID:1244
- C:\Windows\System\FQbQZzm.exe
  C:\Windows\System\FQbQZzm.exe
  2⤵
  PID:2124
- C:\Windows\System\SdBVIbS.exe
  C:\Windows\System\SdBVIbS.exe
  2⤵
  PID:4828
- C:\Windows\System\yUlMZuW.exe
  C:\Windows\System\yUlMZuW.exe
  2⤵
  PID:3376
- C:\Windows\System\qLcmnZg.exe
  C:\Windows\System\qLcmnZg.exe
  2⤵
  PID:5088
- C:\Windows\System\QCLjcUi.exe
  C:\Windows\System\QCLjcUi.exe
  2⤵
  PID:3508
- C:\Windows\System\JTIsHQw.exe
  C:\Windows\System\JTIsHQw.exe
  2⤵
  PID:1560
- C:\Windows\System\AFbfHfw.exe
  C:\Windows\System\AFbfHfw.exe
  2⤵
  PID:828
- C:\Windows\System\HVcipjp.exe
  C:\Windows\System\HVcipjp.exe
  2⤵
  PID:3148
- C:\Windows\System\ZgurgGM.exe
  C:\Windows\System\ZgurgGM.exe
  2⤵
  PID:1116
- C:\Windows\System\NgOjlXE.exe
  C:\Windows\System\NgOjlXE.exe
  2⤵
  PID:3108
- C:\Windows\System\BBsehjA.exe
  C:\Windows\System\BBsehjA.exe
  2⤵
  PID:4104
- C:\Windows\System\QEkkDBh.exe
  C:\Windows\System\QEkkDBh.exe
  2⤵
  PID:4128
- C:\Windows\System\tyQhBJK.exe
  C:\Windows\System\tyQhBJK.exe
  2⤵
  PID:4144
- C:\Windows\System\OpQwhEC.exe
  C:\Windows\System\OpQwhEC.exe
  2⤵
  PID:3032
- C:\Windows\System\yjqwMtk.exe
  C:\Windows\System\yjqwMtk.exe
  2⤵
  PID:384
- C:\Windows\System\mmSlRyO.exe
  C:\Windows\System\mmSlRyO.exe
  2⤵
  PID:4316
- C:\Windows\System\GhUpVMy.exe
  C:\Windows\System\GhUpVMy.exe
  2⤵
  PID:4464
- C:\Windows\System\FMWvgLs.exe
  C:\Windows\System\FMWvgLs.exe
  2⤵
  PID:4736
- C:\Windows\System\SJOCbZZ.exe
  C:\Windows\System\SJOCbZZ.exe
  2⤵
  PID:2012
- C:\Windows\System\bjmvZQB.exe
  C:\Windows\System\bjmvZQB.exe
  2⤵
  PID:3772
- C:\Windows\System\nQCibuA.exe
  C:\Windows\System\nQCibuA.exe
  2⤵
  PID:4068
- C:\Windows\System\NEDXcDj.exe
  C:\Windows\System\NEDXcDj.exe
  2⤵
  PID:2884
- C:\Windows\System\hRfnkSC.exe
  C:\Windows\System\hRfnkSC.exe
  2⤵
  PID:3856
- C:\Windows\System\ntMDPxF.exe
  C:\Windows\System\ntMDPxF.exe
  2⤵
  PID:2448
- C:\Windows\System\SfLfZhK.exe
  C:\Windows\System\SfLfZhK.exe
  2⤵
  PID:1552
- C:\Windows\System\oDLwfey.exe
  C:\Windows\System\oDLwfey.exe
  2⤵
  PID:2784
- C:\Windows\System\nZSJyfa.exe
  C:\Windows\System\nZSJyfa.exe
  2⤵
  PID:4380
- C:\Windows\System\odmLrCa.exe
  C:\Windows\System\odmLrCa.exe
  2⤵
  PID:4448
- C:\Windows\System\LGiyQdX.exe
  C:\Windows\System\LGiyQdX.exe
  2⤵
  PID:4748
- C:\Windows\System\WezybCu.exe
  C:\Windows\System\WezybCu.exe
  2⤵
  PID:4900
- C:\Windows\System\aJWuXgF.exe
  C:\Windows\System\aJWuXgF.exe
  2⤵
  PID:3972
- C:\Windows\System\AEvrzEl.exe
  C:\Windows\System\AEvrzEl.exe
  2⤵
  PID:1984
- C:\Windows\System\XDzaKCV.exe
  C:\Windows\System\XDzaKCV.exe
  2⤵
  PID:1452
- C:\Windows\System\tzTgEOz.exe
  C:\Windows\System\tzTgEOz.exe
  2⤵
  PID:2284
- C:\Windows\System\laAmZNH.exe
  C:\Windows\System\laAmZNH.exe
  2⤵
  PID:2560
- C:\Windows\System\DcLRmyv.exe
  C:\Windows\System\DcLRmyv.exe
  2⤵
  PID:2652
- C:\Windows\System\aIIvcTm.exe
  C:\Windows\System\aIIvcTm.exe
  2⤵
  PID:2228
- C:\Windows\System\PiDAOxG.exe
  C:\Windows\System\PiDAOxG.exe
  2⤵
  PID:4932
- C:\Windows\System\rOLnmts.exe
  C:\Windows\System\rOLnmts.exe
  2⤵
  PID:2820
- C:\Windows\System\ShNIXeM.exe
  C:\Windows\System\ShNIXeM.exe
  2⤵
  PID:2852
- C:\Windows\System\FDYGJyj.exe
  C:\Windows\System\FDYGJyj.exe
  2⤵
  PID:3620
- C:\Windows\System\IbGoTID.exe
  C:\Windows\System\IbGoTID.exe
  2⤵
  PID:4880
- C:\Windows\System\sgKnlLG.exe
  C:\Windows\System\sgKnlLG.exe
  2⤵
  PID:2856
- C:\Windows\System\aMpYayB.exe
  C:\Windows\System\aMpYayB.exe
  2⤵
  PID:5100
- C:\Windows\System\sWWHYSh.exe
  C:\Windows\System\sWWHYSh.exe
  2⤵
  PID:4016
- C:\Windows\System\RSupZVR.exe
  C:\Windows\System\RSupZVR.exe
  2⤵
  PID:3604
- C:\Windows\System\hKXMduJ.exe
  C:\Windows\System\hKXMduJ.exe
  2⤵
  PID:3280
- C:\Windows\System\utheQGI.exe
  C:\Windows\System\utheQGI.exe
  2⤵
  PID:3852
- C:\Windows\System\aOQcdsP.exe
  C:\Windows\System\aOQcdsP.exe
  2⤵
  PID:3888
- C:\Windows\System\gSaUMMC.exe
  C:\Windows\System\gSaUMMC.exe
  2⤵
  PID:4428
- C:\Windows\System\lkgSvvz.exe
  C:\Windows\System\lkgSvvz.exe
  2⤵
  PID:4140
- C:\Windows\System\dQAsWnp.exe
  C:\Windows\System\dQAsWnp.exe
  2⤵
  PID:3024
- C:\Windows\System\wiXrQFK.exe
  C:\Windows\System\wiXrQFK.exe
  2⤵
  PID:4832
- C:\Windows\System\fRNCDRv.exe
  C:\Windows\System\fRNCDRv.exe
  2⤵
  PID:5048
- C:\Windows\System\aXhyUwT.exe
  C:\Windows\System\aXhyUwT.exe
  2⤵
  PID:5024
- C:\Windows\System\IWgukUM.exe
  C:\Windows\System\IWgukUM.exe
  2⤵
  PID:3540
- C:\Windows\System\wepYpIL.exe
  C:\Windows\System\wepYpIL.exe
  2⤵
  PID:3488
- C:\Windows\System\mTkGFTg.exe
  C:\Windows\System\mTkGFTg.exe
  2⤵
  PID:4152
- C:\Windows\System\liMVGXx.exe
  C:\Windows\System\liMVGXx.exe
  2⤵
  PID:4312
- C:\Windows\System\aURteOb.exe
  C:\Windows\System\aURteOb.exe
  2⤵
  PID:4852
- C:\Windows\System\JzOKNKS.exe
  C:\Windows\System\JzOKNKS.exe
  2⤵
  PID:3740
- C:\Windows\System\iYSFwoY.exe
  C:\Windows\System\iYSFwoY.exe
  2⤵
  PID:2616
- C:\Windows\System\ADboDYo.exe
  C:\Windows\System\ADboDYo.exe
  2⤵
  PID:3592
- C:\Windows\System\yRgEBXn.exe
  C:\Windows\System\yRgEBXn.exe
  2⤵
  PID:1468
- C:\Windows\System\XnYbpKm.exe
  C:\Windows\System\XnYbpKm.exe
  2⤵
  PID:1272
- C:\Windows\System\DsfycIg.exe
  C:\Windows\System\DsfycIg.exe
  2⤵
  PID:4084
- C:\Windows\System\bXEeldy.exe
  C:\Windows\System\bXEeldy.exe
  2⤵
  PID:2008
- C:\Windows\System\EBdqPJK.exe
  C:\Windows\System\EBdqPJK.exe
  2⤵
  PID:3736
- C:\Windows\System\EjpDbGs.exe
  C:\Windows\System\EjpDbGs.exe
  2⤵
  PID:2132
- C:\Windows\System\nwbFXrL.exe
  C:\Windows\System\nwbFXrL.exe
  2⤵
  PID:284
- C:\Windows\System\AcixOjK.exe
  C:\Windows\System\AcixOjK.exe
  2⤵
  PID:2384
- C:\Windows\System\ysshDxg.exe
  C:\Windows\System\ysshDxg.exe
  2⤵
  PID:3232
- C:\Windows\System\bvPbsZt.exe
  C:\Windows\System\bvPbsZt.exe
  2⤵
  PID:2572
- C:\Windows\System\tLjBfcn.exe
  C:\Windows\System\tLjBfcn.exe
  2⤵
  PID:3216
- C:\Windows\System\gKvlUPd.exe
  C:\Windows\System\gKvlUPd.exe
  2⤵
  PID:5052
- C:\Windows\System\ZffOaZH.exe
  C:\Windows\System\ZffOaZH.exe
  2⤵
  PID:1644
- C:\Windows\System\pkpRlgN.exe
  C:\Windows\System\pkpRlgN.exe
  2⤵
  PID:4120
- C:\Windows\System\ltJSCXh.exe
  C:\Windows\System\ltJSCXh.exe
  2⤵
  PID:876
- C:\Windows\System\kPUYmxe.exe
  C:\Windows\System\kPUYmxe.exe
  2⤵
  PID:2580
- C:\Windows\System\czPxWlI.exe
  C:\Windows\System\czPxWlI.exe
  2⤵
  PID:4244
- C:\Windows\System\ihXTArL.exe
  C:\Windows\System\ihXTArL.exe
  2⤵
  PID:4940
- C:\Windows\System\cgGfmzx.exe
  C:\Windows\System\cgGfmzx.exe
  2⤵
  PID:4432
- C:\Windows\System\FriNtNW.exe
  C:\Windows\System\FriNtNW.exe
  2⤵
  PID:2208
- C:\Windows\System\aFjoXqc.exe
  C:\Windows\System\aFjoXqc.exe
  2⤵
  PID:1928
- C:\Windows\System\wsOasRY.exe
  C:\Windows\System\wsOasRY.exe
  2⤵
  PID:2044
- C:\Windows\System\oWVvyZW.exe
  C:\Windows\System\oWVvyZW.exe
  2⤵
  PID:352
- C:\Windows\System\uHemkfk.exe
  C:\Windows\System\uHemkfk.exe
  2⤵
  PID:4000
- C:\Windows\System\lIXjghH.exe
  C:\Windows\System\lIXjghH.exe
  2⤵
  PID:1292
- C:\Windows\System\zvjnJQK.exe
  C:\Windows\System\zvjnJQK.exe
  2⤵
  PID:4132
- C:\Windows\System\xWAVTJW.exe
  C:\Windows\System\xWAVTJW.exe
  2⤵
  PID:3820
- C:\Windows\System\HPRbeGU.exe
  C:\Windows\System\HPRbeGU.exe
  2⤵
  PID:2416
- C:\Windows\System\DkuDZOm.exe
  C:\Windows\System\DkuDZOm.exe
  2⤵
  PID:5068
- C:\Windows\System\KgRYbWs.exe
  C:\Windows\System\KgRYbWs.exe
  2⤵
  PID:2720
- C:\Windows\System\RtjaVgR.exe
  C:\Windows\System\RtjaVgR.exe
  2⤵
  PID:3296
- C:\Windows\System\EfVZuAO.exe
  C:\Windows\System\EfVZuAO.exe
  2⤵
  PID:2584
- C:\Windows\System\xhupktu.exe
  C:\Windows\System\xhupktu.exe
  2⤵
  PID:1632
- C:\Windows\System\kGCBqer.exe
  C:\Windows\System\kGCBqer.exe
  2⤵
  PID:4816
- C:\Windows\System\cmbpoPQ.exe
  C:\Windows\System\cmbpoPQ.exe
  2⤵
  PID:2596
- C:\Windows\System\AUTrkzQ.exe
  C:\Windows\System\AUTrkzQ.exe
  2⤵
  PID:1996
- C:\Windows\System\iMeLEVR.exe
  C:\Windows\System\iMeLEVR.exe
  2⤵
  PID:3444
- C:\Windows\System\jDPeixK.exe
  C:\Windows\System\jDPeixK.exe
  2⤵
  PID:4268
- C:\Windows\System\hsYCXpU.exe
  C:\Windows\System\hsYCXpU.exe
  2⤵
  PID:1916
- C:\Windows\System\axTdpuk.exe
  C:\Windows\System\axTdpuk.exe
  2⤵
  PID:5136
- C:\Windows\System\hpMnelr.exe
  C:\Windows\System\hpMnelr.exe
  2⤵
  PID:5152
- C:\Windows\System\TLcUDfY.exe
  C:\Windows\System\TLcUDfY.exe
  2⤵
  PID:5168
- C:\Windows\System\koqxDYK.exe
  C:\Windows\System\koqxDYK.exe
  2⤵
  PID:5184
- C:\Windows\System\TKcTgwX.exe
  C:\Windows\System\TKcTgwX.exe
  2⤵
  PID:5200
- C:\Windows\System\pmlRgTC.exe
  C:\Windows\System\pmlRgTC.exe
  2⤵
  PID:5216
- C:\Windows\System\EZRFFTf.exe
  C:\Windows\System\EZRFFTf.exe
  2⤵
  PID:5232
- C:\Windows\System\KMDWFFC.exe
  C:\Windows\System\KMDWFFC.exe
  2⤵
  PID:5248
- C:\Windows\System\UbElpoH.exe
  C:\Windows\System\UbElpoH.exe
  2⤵
  PID:5264
- C:\Windows\System\pEmULtv.exe
  C:\Windows\System\pEmULtv.exe
  2⤵
  PID:5280
- C:\Windows\System\FxISwfn.exe
  C:\Windows\System\FxISwfn.exe
  2⤵
  PID:5296
- C:\Windows\System\aNvEuJV.exe
  C:\Windows\System\aNvEuJV.exe
  2⤵
  PID:5312
- C:\Windows\System\egJXIbS.exe
  C:\Windows\System\egJXIbS.exe
  2⤵
  PID:5328
- C:\Windows\System\unEICwc.exe
  C:\Windows\System\unEICwc.exe
  2⤵
  PID:5344
- C:\Windows\System\LwTmgPo.exe
  C:\Windows\System\LwTmgPo.exe
  2⤵
  PID:5360
- C:\Windows\System\SsSnysZ.exe
  C:\Windows\System\SsSnysZ.exe
  2⤵
  PID:5376
- C:\Windows\System\dZZRNeD.exe
  C:\Windows\System\dZZRNeD.exe
  2⤵
  PID:5392
- C:\Windows\System\GFhLWta.exe
  C:\Windows\System\GFhLWta.exe
  2⤵
  PID:5408
- C:\Windows\System\mUMrTWc.exe
  C:\Windows\System\mUMrTWc.exe
  2⤵
  PID:5424
- C:\Windows\System\PAAJPhk.exe
  C:\Windows\System\PAAJPhk.exe
  2⤵
  PID:5444
- C:\Windows\System\ldhEzUn.exe
  C:\Windows\System\ldhEzUn.exe
  2⤵
  PID:5460
- C:\Windows\System\YbSCgWN.exe
  C:\Windows\System\YbSCgWN.exe
  2⤵
  PID:5480
- C:\Windows\System\IqrZidH.exe
  C:\Windows\System\IqrZidH.exe
  2⤵
  PID:5496
- C:\Windows\System\vKyUNCs.exe
  C:\Windows\System\vKyUNCs.exe
  2⤵
  PID:5512
- C:\Windows\System\zfeKzrO.exe
  C:\Windows\System\zfeKzrO.exe
  2⤵
  PID:5528
- C:\Windows\System\NtMNtkS.exe
  C:\Windows\System\NtMNtkS.exe
  2⤵
  PID:5544
- C:\Windows\System\CIICovF.exe
  C:\Windows\System\CIICovF.exe
  2⤵
  PID:5560
- C:\Windows\System\ZZBHzrL.exe
  C:\Windows\System\ZZBHzrL.exe
  2⤵
  PID:5576
- C:\Windows\System\EAMGXnw.exe
  C:\Windows\System\EAMGXnw.exe
  2⤵
  PID:5596
- C:\Windows\System\wmEdKCI.exe
  C:\Windows\System\wmEdKCI.exe
  2⤵
  PID:5612
- C:\Windows\System\rFRAnkl.exe
  C:\Windows\System\rFRAnkl.exe
  2⤵
  PID:5628
- C:\Windows\System\tLCIZIw.exe
  C:\Windows\System\tLCIZIw.exe
  2⤵
  PID:5644
- C:\Windows\System\mOonqoE.exe
  C:\Windows\System\mOonqoE.exe
  2⤵
  PID:5660
- C:\Windows\System\ZpVyrKP.exe
  C:\Windows\System\ZpVyrKP.exe
  2⤵
  PID:5676
- C:\Windows\System\eZjQYBu.exe
  C:\Windows\System\eZjQYBu.exe
  2⤵
  PID:5692
- C:\Windows\System\dWCYtTT.exe
  C:\Windows\System\dWCYtTT.exe
  2⤵
  PID:5708
- C:\Windows\System\LgKhUaW.exe
  C:\Windows\System\LgKhUaW.exe
  2⤵
  PID:5724
- C:\Windows\System\jtgDYTx.exe
  C:\Windows\System\jtgDYTx.exe
  2⤵
  PID:5740
- C:\Windows\System\dErAPfL.exe
  C:\Windows\System\dErAPfL.exe
  2⤵
  PID:5756
- C:\Windows\System\ztaGOOn.exe
  C:\Windows\System\ztaGOOn.exe
  2⤵
  PID:5772
- C:\Windows\System\wuMMNux.exe
  C:\Windows\System\wuMMNux.exe
  2⤵
  PID:5788
- C:\Windows\System\BQIKUHV.exe
  C:\Windows\System\BQIKUHV.exe
  2⤵
  PID:5804
- C:\Windows\System\UnZZfTF.exe
  C:\Windows\System\UnZZfTF.exe
  2⤵
  PID:5828
- C:\Windows\System\NKFLYxS.exe
  C:\Windows\System\NKFLYxS.exe
  2⤵
  PID:5844
- C:\Windows\System\gWvhpIi.exe
  C:\Windows\System\gWvhpIi.exe
  2⤵
  PID:5860
- C:\Windows\System\wObSBuj.exe
  C:\Windows\System\wObSBuj.exe
  2⤵
  PID:5876
- C:\Windows\System\tsHMMUm.exe
  C:\Windows\System\tsHMMUm.exe
  2⤵
  PID:5892
- C:\Windows\System\bmliiHQ.exe
  C:\Windows\System\bmliiHQ.exe
  2⤵
  PID:5908
- C:\Windows\System\IQPtJRm.exe
  C:\Windows\System\IQPtJRm.exe
  2⤵
  PID:5924
- C:\Windows\System\OzDlgUo.exe
  C:\Windows\System\OzDlgUo.exe
  2⤵
  PID:5940
- C:\Windows\System\KbJYlRW.exe
  C:\Windows\System\KbJYlRW.exe
  2⤵
  PID:5956
- C:\Windows\System\bRwinej.exe
  C:\Windows\System\bRwinej.exe
  2⤵
  PID:5972
- C:\Windows\System\vyVrsht.exe
  C:\Windows\System\vyVrsht.exe
  2⤵
  PID:5988
- C:\Windows\System\AXJQyvr.exe
  C:\Windows\System\AXJQyvr.exe
  2⤵
  PID:6004
- C:\Windows\System\RsJgMLF.exe
  C:\Windows\System\RsJgMLF.exe
  2⤵
  PID:6020
- C:\Windows\System\XmXQYya.exe
  C:\Windows\System\XmXQYya.exe
  2⤵
  PID:6036
- C:\Windows\System\gccBApQ.exe
  C:\Windows\System\gccBApQ.exe
  2⤵
  PID:6052
- C:\Windows\System\uDupjyq.exe
  C:\Windows\System\uDupjyq.exe
  2⤵
  PID:6068
- C:\Windows\System\KnvdtTp.exe
  C:\Windows\System\KnvdtTp.exe
  2⤵
  PID:4108
- C:\Windows\System\dLtCPrK.exe
  C:\Windows\System\dLtCPrK.exe
  2⤵
  PID:5256
- C:\Windows\System\rDLOpVP.exe
  C:\Windows\System\rDLOpVP.exe
  2⤵
  PID:5240
- C:\Windows\System\miVFhNH.exe
  C:\Windows\System\miVFhNH.exe
  2⤵
  PID:5568
- C:\Windows\System\ssWnuWM.exe
  C:\Windows\System\ssWnuWM.exe
  2⤵
  PID:5584
- C:\Windows\System\fvpKSFB.exe
  C:\Windows\System\fvpKSFB.exe
  2⤵
  PID:5620
- C:\Windows\System\LrKTVEh.exe
  C:\Windows\System\LrKTVEh.exe
  2⤵
  PID:5624
- C:\Windows\System\zKcZWsF.exe
  C:\Windows\System\zKcZWsF.exe
  2⤵
  PID:5780
- C:\Windows\System\HDvPoGS.exe
  C:\Windows\System\HDvPoGS.exe
  2⤵
  PID:5700
- C:\Windows\System\tEouTBu.exe
  C:\Windows\System\tEouTBu.exe
  2⤵
  PID:5948
- C:\Windows\System\qYSYFhe.exe
  C:\Windows\System\qYSYFhe.exe
  2⤵
  PID:5640
- C:\Windows\System\WHrfWhm.exe
  C:\Windows\System\WHrfWhm.exe
  2⤵
  PID:5768
- C:\Windows\System\oKtMLjw.exe
  C:\Windows\System\oKtMLjw.exe
  2⤵
  PID:5996
- C:\Windows\System\qLBdzfN.exe
  C:\Windows\System\qLBdzfN.exe
  2⤵
  PID:6028
- C:\Windows\System\NMXfxUa.exe
  C:\Windows\System\NMXfxUa.exe
  2⤵
  PID:6076
- C:\Windows\System\jknhcyl.exe
  C:\Windows\System\jknhcyl.exe
  2⤵
  PID:6084
- C:\Windows\System\ujzxibb.exe
  C:\Windows\System\ujzxibb.exe
  2⤵
  PID:5124
- C:\Windows\System\BHzEYzo.exe
  C:\Windows\System\BHzEYzo.exe
  2⤵
  PID:5452
- C:\Windows\System\LpOXHav.exe
  C:\Windows\System\LpOXHav.exe
  2⤵
  PID:5420
- C:\Windows\System\IefjerU.exe
  C:\Windows\System\IefjerU.exe
  2⤵
  PID:5456
- C:\Windows\System\qDsvmRQ.exe
  C:\Windows\System\qDsvmRQ.exe
  2⤵
  PID:5556
- C:\Windows\System\IQnDywa.exe
  C:\Windows\System\IQnDywa.exe
  2⤵
  PID:5524
- C:\Windows\System\OeMMNVg.exe
  C:\Windows\System\OeMMNVg.exe
  2⤵
  PID:5688
- C:\Windows\System\PivOOeq.exe
  C:\Windows\System\PivOOeq.exe
  2⤵
  PID:5748
- C:\Windows\System\ulGJIxh.exe
  C:\Windows\System\ulGJIxh.exe
  2⤵
  PID:5636
- C:\Windows\System\WoHUlER.exe
  C:\Windows\System\WoHUlER.exe
  2⤵
  PID:5984
- C:\Windows\System\pIjZtdr.exe
  C:\Windows\System\pIjZtdr.exe
  2⤵
  PID:6044
- C:\Windows\System\jZuChHk.exe
  C:\Windows\System\jZuChHk.exe
  2⤵
  PID:5784
- C:\Windows\System\uWpaLrG.exe
  C:\Windows\System\uWpaLrG.exe
  2⤵
  PID:5800
- C:\Windows\System\nNHSfDn.exe
  C:\Windows\System\nNHSfDn.exe
  2⤵
  PID:5936
- C:\Windows\System\TJUQbTs.exe
  C:\Windows\System\TJUQbTs.exe
  2⤵
  PID:2732
- C:\Windows\System\wKJYeIU.exe
  C:\Windows\System\wKJYeIU.exe
  2⤵
  PID:2156
- C:\Windows\System\vJfxktd.exe
  C:\Windows\System\vJfxktd.exe
  2⤵
  PID:3472
- C:\Windows\System\FOwEqOL.exe
  C:\Windows\System\FOwEqOL.exe
  2⤵
  PID:2508
- C:\Windows\System\VNZAyFp.exe
  C:\Windows\System\VNZAyFp.exe
  2⤵
  PID:2640
- C:\Windows\System\xSRZKpz.exe
  C:\Windows\System\xSRZKpz.exe
  2⤵
  PID:6000
- C:\Windows\System\uEMwqkF.exe
  C:\Windows\System\uEMwqkF.exe
  2⤵
  PID:6132
- C:\Windows\System\feKhBtk.exe
  C:\Windows\System\feKhBtk.exe
  2⤵
  PID:2708
- C:\Windows\System\NABpdOr.exe
  C:\Windows\System\NABpdOr.exe
  2⤵
  PID:5260
- C:\Windows\System\vaHhUfM.exe
  C:\Windows\System\vaHhUfM.exe
  2⤵
  PID:5324
- C:\Windows\System\LGVlbqs.exe
  C:\Windows\System\LGVlbqs.exe
  2⤵
  PID:5292
- C:\Windows\System\MzYPHKz.exe
  C:\Windows\System\MzYPHKz.exe
  2⤵
  PID:5368
- C:\Windows\System\yHHMVMV.exe
  C:\Windows\System\yHHMVMV.exe
  2⤵
  PID:5436
- C:\Windows\System\rmjwaxZ.exe
  C:\Windows\System\rmjwaxZ.exe
  2⤵
  PID:5472
- C:\Windows\System\BJRNWVH.exe
  C:\Windows\System\BJRNWVH.exe
  2⤵
  PID:5488
- C:\Windows\System\mewwTwE.exe
  C:\Windows\System\mewwTwE.exe
  2⤵
  PID:5552
- C:\Windows\System\KdSUuMs.exe
  C:\Windows\System\KdSUuMs.exe
  2⤵
  PID:5872
- C:\Windows\System\ZHNCkYc.exe
  C:\Windows\System\ZHNCkYc.exe
  2⤵
  PID:2728
- C:\Windows\System\TJVkVQI.exe
  C:\Windows\System\TJVkVQI.exe
  2⤵
  PID:5288
- C:\Windows\System\PwqjGMs.exe
  C:\Windows\System\PwqjGMs.exe
  2⤵
  PID:6032
- C:\Windows\System\zONkfvM.exe
  C:\Windows\System\zONkfvM.exe
  2⤵
  PID:5684
- C:\Windows\System\KapgmfD.exe
  C:\Windows\System\KapgmfD.exe
  2⤵
  PID:5608
- C:\Windows\System\ahAEgVg.exe
  C:\Windows\System\ahAEgVg.exe
  2⤵
  PID:5572
- C:\Windows\System\CzlSbzZ.exe
  C:\Windows\System\CzlSbzZ.exe
  2⤵
  PID:6124
- C:\Windows\System\gBgwdxZ.exe
  C:\Windows\System\gBgwdxZ.exe
  2⤵
  PID:5764
- C:\Windows\System\TQPSoDQ.exe
  C:\Windows\System\TQPSoDQ.exe
  2⤵
  PID:5132
- C:\Windows\System\KiCIwyL.exe
  C:\Windows\System\KiCIwyL.exe
  2⤵
  PID:5176
- C:\Windows\System\yeLPDsA.exe
  C:\Windows\System\yeLPDsA.exe
  2⤵
  PID:5272
- C:\Windows\System\rLxJXrt.exe
  C:\Windows\System\rLxJXrt.exe
  2⤵
  PID:5824
- C:\Windows\System\CsaITsA.exe
  C:\Windows\System\CsaITsA.exe
  2⤵
  PID:776
- C:\Windows\System\jUZbTOH.exe
  C:\Windows\System\jUZbTOH.exe
  2⤵
  PID:5196
- C:\Windows\System\GMZIJPK.exe
  C:\Windows\System\GMZIJPK.exe
  2⤵
  PID:5372
- C:\Windows\System\dARFOAi.exe
  C:\Windows\System\dARFOAi.exe
  2⤵
  PID:6064
- C:\Windows\System\SebvfOV.exe
  C:\Windows\System\SebvfOV.exe
  2⤵
  PID:5144
- C:\Windows\System\lTnAkBn.exe
  C:\Windows\System\lTnAkBn.exe
  2⤵
  PID:6152
- C:\Windows\System\sryPafY.exe
  C:\Windows\System\sryPafY.exe
  2⤵
  PID:6172
- C:\Windows\System\hzEDjmu.exe
  C:\Windows\System\hzEDjmu.exe
  2⤵
  PID:6188
- C:\Windows\System\AgSWfWK.exe
  C:\Windows\System\AgSWfWK.exe
  2⤵
  PID:6204
- C:\Windows\System\EqzlDmd.exe
  C:\Windows\System\EqzlDmd.exe
  2⤵
  PID:6220
- C:\Windows\System\EDMorfM.exe
  C:\Windows\System\EDMorfM.exe
  2⤵
  PID:6236
- C:\Windows\System\xZstnWq.exe
  C:\Windows\System\xZstnWq.exe
  2⤵
  PID:6252
- C:\Windows\System\NIgedmV.exe
  C:\Windows\System\NIgedmV.exe
  2⤵
  PID:6268
- C:\Windows\System\ZCBllSB.exe
  C:\Windows\System\ZCBllSB.exe
  2⤵
  PID:6284
- C:\Windows\System\wPJfSvC.exe
  C:\Windows\System\wPJfSvC.exe
  2⤵
  PID:6300
- C:\Windows\System\xoAsElp.exe
  C:\Windows\System\xoAsElp.exe
  2⤵
  PID:6316
- C:\Windows\System\ZUgQkUY.exe
  C:\Windows\System\ZUgQkUY.exe
  2⤵
  PID:6332
- C:\Windows\System\HfqSnrI.exe
  C:\Windows\System\HfqSnrI.exe
  2⤵
  PID:6348
- C:\Windows\System\mXsiDxv.exe
  C:\Windows\System\mXsiDxv.exe
  2⤵
  PID:6364
- C:\Windows\System\jIBtRxC.exe
  C:\Windows\System\jIBtRxC.exe
  2⤵
  PID:6380
- C:\Windows\System\WKxwjrO.exe
  C:\Windows\System\WKxwjrO.exe
  2⤵
  PID:6400
- C:\Windows\System\cdVrUZD.exe
  C:\Windows\System\cdVrUZD.exe
  2⤵
  PID:6416
- C:\Windows\System\uUmgybs.exe
  C:\Windows\System\uUmgybs.exe
  2⤵
  PID:6432
- C:\Windows\System\bgMEQUL.exe
  C:\Windows\System\bgMEQUL.exe
  2⤵
  PID:6452
- C:\Windows\System\DDYflCo.exe
  C:\Windows\System\DDYflCo.exe
  2⤵
  PID:6468
- C:\Windows\System\BXuTaWS.exe
  C:\Windows\System\BXuTaWS.exe
  2⤵
  PID:6484
- C:\Windows\System\XVqoYWu.exe
  C:\Windows\System\XVqoYWu.exe
  2⤵
  PID:6500
- C:\Windows\System\gOGnFxG.exe
  C:\Windows\System\gOGnFxG.exe
  2⤵
  PID:6516
- C:\Windows\System\cHZgPem.exe
  C:\Windows\System\cHZgPem.exe
  2⤵
  PID:6532
- C:\Windows\System\rZqcJFq.exe
  C:\Windows\System\rZqcJFq.exe
  2⤵
  PID:6548
- C:\Windows\System\znVvycr.exe
  C:\Windows\System\znVvycr.exe
  2⤵
  PID:6564
- C:\Windows\System\RJmEBca.exe
  C:\Windows\System\RJmEBca.exe
  2⤵
  PID:6580
- C:\Windows\System\gmtfyyI.exe
  C:\Windows\System\gmtfyyI.exe
  2⤵
  PID:6596
- C:\Windows\System\Resujgg.exe
  C:\Windows\System\Resujgg.exe
  2⤵
  PID:6612
- C:\Windows\System\fqptzEp.exe
  C:\Windows\System\fqptzEp.exe
  2⤵
  PID:6628
- C:\Windows\System\tzMWHIb.exe
  C:\Windows\System\tzMWHIb.exe
  2⤵
  PID:6644
- C:\Windows\System\KXOdpvc.exe
  C:\Windows\System\KXOdpvc.exe
  2⤵
  PID:6664
- C:\Windows\System\thMhLEa.exe
  C:\Windows\System\thMhLEa.exe
  2⤵
  PID:6680
- C:\Windows\System\OaDKNzL.exe
  C:\Windows\System\OaDKNzL.exe
  2⤵
  PID:6696
- C:\Windows\System\xYGsryx.exe
  C:\Windows\System\xYGsryx.exe
  2⤵
  PID:6712
- C:\Windows\System\wVqRtRS.exe
  C:\Windows\System\wVqRtRS.exe
  2⤵
  PID:6728
- C:\Windows\System\UQVeZwL.exe
  C:\Windows\System\UQVeZwL.exe
  2⤵
  PID:6744
- C:\Windows\System\kPSUjNm.exe
  C:\Windows\System\kPSUjNm.exe
  2⤵
  PID:6820
- C:\Windows\System\mhccIpT.exe
  C:\Windows\System\mhccIpT.exe
  2⤵
  PID:6836
- C:\Windows\System\tZyerqw.exe
  C:\Windows\System\tZyerqw.exe
  2⤵
  PID:6856
- C:\Windows\System\BquBmsH.exe
  C:\Windows\System\BquBmsH.exe
  2⤵
  PID:6872
- C:\Windows\System\fIAeEvj.exe
  C:\Windows\System\fIAeEvj.exe
  2⤵
  PID:6888
- C:\Windows\System\FDbpFqy.exe
  C:\Windows\System\FDbpFqy.exe
  2⤵
  PID:6904
- C:\Windows\System\sqiCMBo.exe
  C:\Windows\System\sqiCMBo.exe
  2⤵
  PID:6920
- C:\Windows\System\kMYMHhC.exe
  C:\Windows\System\kMYMHhC.exe
  2⤵
  PID:6936
- C:\Windows\System\wdPAxNv.exe
  C:\Windows\System\wdPAxNv.exe
  2⤵
  PID:6956
- C:\Windows\System\ZeHoAfA.exe
  C:\Windows\System\ZeHoAfA.exe
  2⤵
  PID:6976
- C:\Windows\System\ZTDDpcW.exe
  C:\Windows\System\ZTDDpcW.exe
  2⤵
  PID:6992
- C:\Windows\System\wusqfCv.exe
  C:\Windows\System\wusqfCv.exe
  2⤵
  PID:7008
- C:\Windows\System\jhWjUsS.exe
  C:\Windows\System\jhWjUsS.exe
  2⤵
  PID:7024
- C:\Windows\System\hjvxikC.exe
  C:\Windows\System\hjvxikC.exe
  2⤵
  PID:7040
- C:\Windows\System\fVKmfps.exe
  C:\Windows\System\fVKmfps.exe
  2⤵
  PID:7060
- C:\Windows\System\KkSjbxs.exe
  C:\Windows\System\KkSjbxs.exe
  2⤵
  PID:7076
- C:\Windows\System\cByNuTI.exe
  C:\Windows\System\cByNuTI.exe
  2⤵
  PID:7092
- C:\Windows\System\NIeLINZ.exe
  C:\Windows\System\NIeLINZ.exe
  2⤵
  PID:7108
- C:\Windows\System\Yuzxngj.exe
  C:\Windows\System\Yuzxngj.exe
  2⤵
  PID:7124
- C:\Windows\System\coeNXdV.exe
  C:\Windows\System\coeNXdV.exe
  2⤵
  PID:7140
- C:\Windows\System\EqoMaeu.exe
  C:\Windows\System\EqoMaeu.exe
  2⤵
  PID:7156
- C:\Windows\System\CcKNAUv.exe
  C:\Windows\System\CcKNAUv.exe
  2⤵
  PID:2140
- C:\Windows\System\axKNMra.exe
  C:\Windows\System\axKNMra.exe
  2⤵
  PID:5492
- C:\Windows\System\JtSPbhZ.exe
  C:\Windows\System\JtSPbhZ.exe
  2⤵
  PID:5164
- C:\Windows\System\YvPDkrx.exe
  C:\Windows\System\YvPDkrx.exe
  2⤵
  PID:5276
- C:\Windows\System\svJtvLl.exe
  C:\Windows\System\svJtvLl.exe
  2⤵
  PID:5816
- C:\Windows\System\OOFvdtD.exe
  C:\Windows\System\OOFvdtD.exe
  2⤵
  PID:5336
- C:\Windows\System\PXuErVL.exe
  C:\Windows\System\PXuErVL.exe
  2⤵
  PID:6136
- C:\Windows\System\ELigsgG.exe
  C:\Windows\System\ELigsgG.exe
  2⤵
  PID:6212
- C:\Windows\System\QASezvG.exe
  C:\Windows\System\QASezvG.exe
  2⤵
  PID:6228
- C:\Windows\System\opxAbVu.exe
  C:\Windows\System\opxAbVu.exe
  2⤵
  PID:6260
- C:\Windows\System\pcwCWxZ.exe
  C:\Windows\System\pcwCWxZ.exe
  2⤵
  PID:6292
- C:\Windows\System\mIaIVku.exe
  C:\Windows\System\mIaIVku.exe
  2⤵
  PID:6308
- C:\Windows\System\Nlkgemg.exe
  C:\Windows\System\Nlkgemg.exe
  2⤵
  PID:6340
- C:\Windows\System\rsAYQzw.exe
  C:\Windows\System\rsAYQzw.exe
  2⤵
  PID:6480
- C:\Windows\System\UPRoKuc.exe
  C:\Windows\System\UPRoKuc.exe
  2⤵
  PID:6396
- C:\Windows\System\JxtwtWf.exe
  C:\Windows\System\JxtwtWf.exe
  2⤵
  PID:6464
- C:\Windows\System\XgsikrV.exe
  C:\Windows\System\XgsikrV.exe
  2⤵
  PID:6440
- C:\Windows\System\RvYOOAC.exe
  C:\Windows\System\RvYOOAC.exe
  2⤵
  PID:6528
- C:\Windows\System\CWLyRhe.exe
  C:\Windows\System\CWLyRhe.exe
  2⤵
  PID:6544
- C:\Windows\System\ucjVwFz.exe
  C:\Windows\System\ucjVwFz.exe
  2⤵
  PID:6556
- C:\Windows\System\DvFDcWO.exe
  C:\Windows\System\DvFDcWO.exe
  2⤵
  PID:6652
- C:\Windows\System\MUsArrl.exe
  C:\Windows\System\MUsArrl.exe
  2⤵
  PID:6604
- C:\Windows\System\bJJahsl.exe
  C:\Windows\System\bJJahsl.exe
  2⤵
  PID:6636
- C:\Windows\System\dZXkHfp.exe
  C:\Windows\System\dZXkHfp.exe
  2⤵
  PID:6740
- C:\Windows\System\rHzkOlF.exe
  C:\Windows\System\rHzkOlF.exe
  2⤵
  PID:6720
- C:\Windows\System\FgVnnzF.exe
  C:\Windows\System\FgVnnzF.exe
  2⤵
  PID:6772
- C:\Windows\System\HocQLek.exe
  C:\Windows\System\HocQLek.exe
  2⤵
  PID:6792
- C:\Windows\System\NodUIvJ.exe
  C:\Windows\System\NodUIvJ.exe
  2⤵
  PID:6804
- C:\Windows\System\NJKnYqs.exe
  C:\Windows\System\NJKnYqs.exe
  2⤵
  PID:6844
- C:\Windows\System\xKcAjJD.exe
  C:\Windows\System\xKcAjJD.exe
  2⤵
  PID:6912
- C:\Windows\System\Ztdvqah.exe
  C:\Windows\System\Ztdvqah.exe
  2⤵
  PID:6952
- C:\Windows\System\VlqWvOZ.exe
  C:\Windows\System\VlqWvOZ.exe
  2⤵
  PID:7020
- C:\Windows\System\UzRhnrL.exe
  C:\Windows\System\UzRhnrL.exe
  2⤵
  PID:7056
- C:\Windows\System\TaGjSBI.exe
  C:\Windows\System\TaGjSBI.exe
  2⤵
  PID:7088
- C:\Windows\System\idnnskl.exe
  C:\Windows\System\idnnskl.exe
  2⤵
  PID:6896
- C:\Windows\System\Tnfvlvl.exe
  C:\Windows\System\Tnfvlvl.exe
  2⤵
  PID:7036
- C:\Windows\System\hkXISia.exe
  C:\Windows\System\hkXISia.exe
  2⤵
  PID:7132
- C:\Windows\System\kqwQumv.exe
  C:\Windows\System\kqwQumv.exe
  2⤵
  PID:6964
- C:\Windows\System\pxwhNEQ.exe
  C:\Windows\System\pxwhNEQ.exe
  2⤵
  PID:7004
- C:\Windows\System\uWwTPxA.exe
  C:\Windows\System\uWwTPxA.exe
  2⤵
  PID:6140
- C:\Windows\System\FkoSGxn.exe
  C:\Windows\System\FkoSGxn.exe
  2⤵
  PID:5884
- C:\Windows\System\VgINHKK.exe
  C:\Windows\System\VgINHKK.exe
  2⤵
  PID:5840
- C:\Windows\System\iaeOLvg.exe
  C:\Windows\System\iaeOLvg.exe
  2⤵
  PID:6168
- C:\Windows\System\pZsZmwT.exe
  C:\Windows\System\pZsZmwT.exe
  2⤵
  PID:6200
- C:\Windows\System\AlOGaWz.exe
  C:\Windows\System\AlOGaWz.exe
  2⤵
  PID:6372
- C:\Windows\System\DlFSEdW.exe
  C:\Windows\System\DlFSEdW.exe
  2⤵
  PID:6448
- C:\Windows\System\VVJWJky.exe
  C:\Windows\System\VVJWJky.exe
  2⤵
  PID:6588
- C:\Windows\System\NAfVlVF.exe
  C:\Windows\System\NAfVlVF.exe
  2⤵
  PID:6988
- C:\Windows\System\LUdjOyW.exe
  C:\Windows\System\LUdjOyW.exe
  2⤵
  PID:6900
- C:\Windows\System\XhLoVdJ.exe
  C:\Windows\System\XhLoVdJ.exe
  2⤵
  PID:6312
- C:\Windows\System\qvzZxVb.exe
  C:\Windows\System\qvzZxVb.exe
  2⤵
  PID:6944
- C:\Windows\System\dpDiZWh.exe
  C:\Windows\System\dpDiZWh.exe
  2⤵
  PID:6412
- C:\Windows\System\yDbwZjV.exe
  C:\Windows\System\yDbwZjV.exe
  2⤵
  PID:5148
- C:\Windows\System\FVSrMHD.exe
  C:\Windows\System\FVSrMHD.exe
  2⤵
  PID:6620
- C:\Windows\System\yyNJMRu.exe
  C:\Windows\System\yyNJMRu.exe
  2⤵
  PID:6724
- C:\Windows\System\YVxwNlh.exe
  C:\Windows\System\YVxwNlh.exe
  2⤵
  PID:7100
- C:\Windows\System\mZCrvFl.exe
  C:\Windows\System\mZCrvFl.exe
  2⤵
  PID:5836
- C:\Windows\System\RsRcDkV.exe
  C:\Windows\System\RsRcDkV.exe
  2⤵
  PID:6248
- C:\Windows\System\uwcrmBm.exe
  C:\Windows\System\uwcrmBm.exe
  2⤵
  PID:7164
- C:\Windows\System\GYvxamS.exe
  C:\Windows\System\GYvxamS.exe
  2⤵
  PID:6164
- C:\Windows\System\IfsLEbx.exe
  C:\Windows\System\IfsLEbx.exe
  2⤵
  PID:7104
- C:\Windows\System\FJIKrQo.exe
  C:\Windows\System\FJIKrQo.exe
  2⤵
  PID:6764
- C:\Windows\System\rBwyqQc.exe
  C:\Windows\System\rBwyqQc.exe
  2⤵
  PID:6832
- C:\Windows\System\ribtFao.exe
  C:\Windows\System\ribtFao.exe
  2⤵
  PID:6408
- C:\Windows\System\FTAkqsk.exe
  C:\Windows\System\FTAkqsk.exe
  2⤵
  PID:6736
- C:\Windows\System\vRFaEPJ.exe
  C:\Windows\System\vRFaEPJ.exe
  2⤵
  PID:6264
- C:\Windows\System\DswyRPx.exe
  C:\Windows\System\DswyRPx.exe
  2⤵
  PID:6540
- C:\Windows\System\hfJEBeT.exe
  C:\Windows\System\hfJEBeT.exe
  2⤵
  PID:6160
- C:\Windows\System\IxkhQYV.exe
  C:\Windows\System\IxkhQYV.exe
  2⤵
  PID:6328
- C:\Windows\System\GUjlsTf.exe
  C:\Windows\System\GUjlsTf.exe
  2⤵
  PID:7176
- C:\Windows\System\JyHXddm.exe
  C:\Windows\System\JyHXddm.exe
  2⤵
  PID:7192
- C:\Windows\System\miQWCOd.exe
  C:\Windows\System\miQWCOd.exe
  2⤵
  PID:7208
- C:\Windows\System\ZXIAMiu.exe
  C:\Windows\System\ZXIAMiu.exe
  2⤵
  PID:7228
- C:\Windows\System\ahTqUEy.exe
  C:\Windows\System\ahTqUEy.exe
  2⤵
  PID:7244
- C:\Windows\System\kARJiwT.exe
  C:\Windows\System\kARJiwT.exe
  2⤵
  PID:7260
- C:\Windows\System\GLSWRVn.exe
  C:\Windows\System\GLSWRVn.exe
  2⤵
  PID:7276
- C:\Windows\System\uxriIbP.exe
  C:\Windows\System\uxriIbP.exe
  2⤵
  PID:7292
- C:\Windows\System\RUOMuUi.exe
  C:\Windows\System\RUOMuUi.exe
  2⤵
  PID:7308
- C:\Windows\System\pokzfEP.exe
  C:\Windows\System\pokzfEP.exe
  2⤵
  PID:7328
- C:\Windows\System\jbrZkPQ.exe
  C:\Windows\System\jbrZkPQ.exe
  2⤵
  PID:7344
- C:\Windows\System\BSIiaNJ.exe
  C:\Windows\System\BSIiaNJ.exe
  2⤵
  PID:7360
- C:\Windows\System\TauMzxV.exe
  C:\Windows\System\TauMzxV.exe
  2⤵
  PID:7376
- C:\Windows\System\ladQUXf.exe
  C:\Windows\System\ladQUXf.exe
  2⤵
  PID:7392
- C:\Windows\System\SePCLVG.exe
  C:\Windows\System\SePCLVG.exe
  2⤵
  PID:7408
- C:\Windows\System\ptwtrpf.exe
  C:\Windows\System\ptwtrpf.exe
  2⤵
  PID:7424
- C:\Windows\System\tYXvBSL.exe
  C:\Windows\System\tYXvBSL.exe
  2⤵
  PID:7440
- C:\Windows\System\NFoEvvv.exe
  C:\Windows\System\NFoEvvv.exe
  2⤵
  PID:7456
- C:\Windows\System\FczJkdq.exe
  C:\Windows\System\FczJkdq.exe
  2⤵
  PID:7472
- C:\Windows\System\rYOuOlm.exe
  C:\Windows\System\rYOuOlm.exe
  2⤵
  PID:7488
- C:\Windows\System\UcvrKwv.exe
  C:\Windows\System\UcvrKwv.exe
  2⤵
  PID:7504
- C:\Windows\System\BuaUmyb.exe
  C:\Windows\System\BuaUmyb.exe
  2⤵
  PID:7520
- C:\Windows\System\qssRVMq.exe
  C:\Windows\System\qssRVMq.exe
  2⤵
  PID:7536
- C:\Windows\System\uLYGjMa.exe
  C:\Windows\System\uLYGjMa.exe
  2⤵
  PID:7552
- C:\Windows\System\xNEiTPI.exe
  C:\Windows\System\xNEiTPI.exe
  2⤵
  PID:7568
- C:\Windows\System\SUPSnYn.exe
  C:\Windows\System\SUPSnYn.exe
  2⤵
  PID:7588
- C:\Windows\System\xqBlkcn.exe
  C:\Windows\System\xqBlkcn.exe
  2⤵
  PID:7604
- C:\Windows\System\zqhZKto.exe
  C:\Windows\System\zqhZKto.exe
  2⤵
  PID:7620
- C:\Windows\System\zGKAeGh.exe
  C:\Windows\System\zGKAeGh.exe
  2⤵
  PID:7636
- C:\Windows\System\UsDrHoN.exe
  C:\Windows\System\UsDrHoN.exe
  2⤵
  PID:7652
- C:\Windows\System\yJaOoWj.exe
  C:\Windows\System\yJaOoWj.exe
  2⤵
  PID:7668
- C:\Windows\System\WQxKtFG.exe
  C:\Windows\System\WQxKtFG.exe
  2⤵
  PID:7684
- C:\Windows\System\VGOWEUo.exe
  C:\Windows\System\VGOWEUo.exe
  2⤵
  PID:7700
- C:\Windows\System\vrzMbxi.exe
  C:\Windows\System\vrzMbxi.exe
  2⤵
  PID:7716
- C:\Windows\System\GEDZtwS.exe
  C:\Windows\System\GEDZtwS.exe
  2⤵
  PID:7732
- C:\Windows\System\EByHWko.exe
  C:\Windows\System\EByHWko.exe
  2⤵
  PID:7748
- C:\Windows\System\nCylpzP.exe
  C:\Windows\System\nCylpzP.exe
  2⤵
  PID:7764
- C:\Windows\System\UoIUaRL.exe
  C:\Windows\System\UoIUaRL.exe
  2⤵
  PID:7784
- C:\Windows\System\ZPtcrjz.exe
  C:\Windows\System\ZPtcrjz.exe
  2⤵
  PID:7800
- C:\Windows\System\lcGIAXU.exe
  C:\Windows\System\lcGIAXU.exe
  2⤵
  PID:7816
- C:\Windows\System\AScrOTP.exe
  C:\Windows\System\AScrOTP.exe
  2⤵
  PID:7832
- C:\Windows\System\zsUrLcm.exe
  C:\Windows\System\zsUrLcm.exe
  2⤵
  PID:7848
- C:\Windows\System\oHJZWIG.exe
  C:\Windows\System\oHJZWIG.exe
  2⤵
  PID:7864
- C:\Windows\System\gjrUJut.exe
  C:\Windows\System\gjrUJut.exe
  2⤵
  PID:7880
- C:\Windows\System\QjqGyTS.exe
  C:\Windows\System\QjqGyTS.exe
  2⤵
  PID:7896
- C:\Windows\System\xbnoNNf.exe
  C:\Windows\System\xbnoNNf.exe
  2⤵
  PID:7912
- C:\Windows\System\jNfmfJN.exe
  C:\Windows\System\jNfmfJN.exe
  2⤵
  PID:7932
- C:\Windows\System\dzZkehq.exe
  C:\Windows\System\dzZkehq.exe
  2⤵
  PID:7948
- C:\Windows\System\YrSppqS.exe
  C:\Windows\System\YrSppqS.exe
  2⤵
  PID:7964
- C:\Windows\System\LtOcRaL.exe
  C:\Windows\System\LtOcRaL.exe
  2⤵
  PID:7980
- C:\Windows\System\TQSsyPJ.exe
  C:\Windows\System\TQSsyPJ.exe
  2⤵
  PID:7996
- C:\Windows\System\kdqYiIE.exe
  C:\Windows\System\kdqYiIE.exe
  2⤵
  PID:8012
- C:\Windows\System\VdLmvkj.exe
  C:\Windows\System\VdLmvkj.exe
  2⤵
  PID:8028
- C:\Windows\System\adnGQwD.exe
  C:\Windows\System\adnGQwD.exe
  2⤵
  PID:8044
- C:\Windows\System\HMxIVQy.exe
  C:\Windows\System\HMxIVQy.exe
  2⤵
  PID:8060
- C:\Windows\System\MFcCreb.exe
  C:\Windows\System\MFcCreb.exe
  2⤵
  PID:8076
- C:\Windows\System\hGGBUAP.exe
  C:\Windows\System\hGGBUAP.exe
  2⤵
  PID:8092
- C:\Windows\System\EZNXYBX.exe
  C:\Windows\System\EZNXYBX.exe
  2⤵
  PID:8108
- C:\Windows\System\rxWnnIj.exe
  C:\Windows\System\rxWnnIj.exe
  2⤵
  PID:8124
- C:\Windows\System\wuasOIL.exe
  C:\Windows\System\wuasOIL.exe
  2⤵
  PID:8140
- C:\Windows\System\bkOTUwk.exe
  C:\Windows\System\bkOTUwk.exe
  2⤵
  PID:8156
- C:\Windows\System\oAOeNkk.exe
  C:\Windows\System\oAOeNkk.exe
  2⤵
  PID:8172
- C:\Windows\System\SoFyzkr.exe
  C:\Windows\System\SoFyzkr.exe
  2⤵
  PID:8188
- C:\Windows\System\CDlOZJt.exe
  C:\Windows\System\CDlOZJt.exe
  2⤵
  PID:6276
- C:\Windows\System\ViRSRUC.exe
  C:\Windows\System\ViRSRUC.exe
  2⤵
  PID:7172
- C:\Windows\System\OQbfrPT.exe
  C:\Windows\System\OQbfrPT.exe
  2⤵
  PID:7240
- C:\Windows\System\SkZjMiZ.exe
  C:\Windows\System\SkZjMiZ.exe
  2⤵
  PID:7304
- C:\Windows\System\iyiDjgI.exe
  C:\Windows\System\iyiDjgI.exe
  2⤵
  PID:7372
- C:\Windows\System\xVoIkgf.exe
  C:\Windows\System\xVoIkgf.exe
  2⤵
  PID:7436
- C:\Windows\System\weTnIRM.exe
  C:\Windows\System\weTnIRM.exe
  2⤵
  PID:7500
- C:\Windows\System\viSeHdS.exe
  C:\Windows\System\viSeHdS.exe
  2⤵
  PID:7564
- C:\Windows\System\JrVNidq.exe
  C:\Windows\System\JrVNidq.exe
  2⤵
  PID:7632
- C:\Windows\System\mxUDNLK.exe
  C:\Windows\System\mxUDNLK.exe
  2⤵
  PID:6460
- C:\Windows\System\cUNaDfc.exe
  C:\Windows\System\cUNaDfc.exe
  2⤵
  PID:6524
- C:\Windows\System\XPovacz.exe
  C:\Windows\System\XPovacz.exe
  2⤵
  PID:6928
- C:\Windows\System\OZUUVTT.exe
  C:\Windows\System\OZUUVTT.exe
  2⤵
  PID:7052
- C:\Windows\System\vsDazPI.exe
  C:\Windows\System\vsDazPI.exe
  2⤵
  PID:7000
- C:\Windows\System\TrvklzC.exe
  C:\Windows\System\TrvklzC.exe
  2⤵
  PID:7224
- C:\Windows\System\ByrJEoA.exe
  C:\Windows\System\ByrJEoA.exe
  2⤵
  PID:7324
- C:\Windows\System\ljeIdtp.exe
  C:\Windows\System\ljeIdtp.exe
  2⤵
  PID:7548
- C:\Windows\System\SFTMwAb.exe
  C:\Windows\System\SFTMwAb.exe
  2⤵
  PID:7680
- C:\Windows\System\sjajjsx.exe
  C:\Windows\System\sjajjsx.exe
  2⤵
  PID:7692
- C:\Windows\System\zzKadAg.exe
  C:\Windows\System\zzKadAg.exe
  2⤵
  PID:7724
- C:\Windows\System\mKqSTYm.exe
  C:\Windows\System\mKqSTYm.exe
  2⤵
  PID:7780
- C:\Windows\System\QnpjwzR.exe
  C:\Windows\System\QnpjwzR.exe
  2⤵
  PID:7888
- C:\Windows\System\SeeluAa.exe
  C:\Windows\System\SeeluAa.exe
  2⤵
  PID:7928
- C:\Windows\System\EsYBQjC.exe
  C:\Windows\System\EsYBQjC.exe
  2⤵
  PID:7944
- C:\Windows\System\ycqOKja.exe
  C:\Windows\System\ycqOKja.exe
  2⤵
  PID:7908
- C:\Windows\System\dGsuiMn.exe
  C:\Windows\System\dGsuiMn.exe
  2⤵
  PID:7976
- C:\Windows\System\IOThDTv.exe
  C:\Windows\System\IOThDTv.exe
  2⤵
  PID:8040
- C:\Windows\System\mGmdskb.exe
  C:\Windows\System\mGmdskb.exe
  2⤵
  PID:8104
- C:\Windows\System\pLqaPia.exe
  C:\Windows\System\pLqaPia.exe
  2⤵
  PID:8136
- C:\Windows\System\JZtpKTu.exe
  C:\Windows\System\JZtpKTu.exe
  2⤵
  PID:7236
- C:\Windows\System\dIwcLKP.exe
  C:\Windows\System\dIwcLKP.exe
  2⤵
  PID:7988
- C:\Windows\System\RZlcBER.exe
  C:\Windows\System\RZlcBER.exe
  2⤵
  PID:8052
- C:\Windows\System\JDikTJb.exe
  C:\Windows\System\JDikTJb.exe
  2⤵
  PID:8116
- C:\Windows\System\mMFJsIY.exe
  C:\Windows\System\mMFJsIY.exe
  2⤵
  PID:8180
- C:\Windows\System\SIwopjR.exe
  C:\Windows\System\SIwopjR.exe
  2⤵
  PID:7268
- C:\Windows\System\BZeiykU.exe
  C:\Windows\System\BZeiykU.exe
  2⤵
  PID:7532
- C:\Windows\System\DDxVQGX.exe
  C:\Windows\System\DDxVQGX.exe
  2⤵
  PID:7600
- C:\Windows\System\PbatrHQ.exe
  C:\Windows\System\PbatrHQ.exe
  2⤵
  PID:7560
- C:\Windows\System\VoesfaV.exe
  C:\Windows\System\VoesfaV.exe
  2⤵
  PID:6080
- C:\Windows\System\OTYdxAe.exe
  C:\Windows\System\OTYdxAe.exe
  2⤵
  PID:7188
- C:\Windows\System\eqpTKiZ.exe
  C:\Windows\System\eqpTKiZ.exe
  2⤵
  PID:6972
- C:\Windows\System\RUhXyoD.exe
  C:\Windows\System\RUhXyoD.exe
  2⤵
  PID:6880
- C:\Windows\System\iVcJpWT.exe
  C:\Windows\System\iVcJpWT.exe
  2⤵
  PID:7616
- C:\Windows\System\lNJgCsF.exe
  C:\Windows\System\lNJgCsF.exe
  2⤵
  PID:7728
- C:\Windows\System\WuOrNsj.exe
  C:\Windows\System\WuOrNsj.exe
  2⤵
  PID:7824
- C:\Windows\System\nBoYXyj.exe
  C:\Windows\System\nBoYXyj.exe
  2⤵
  PID:7860
- C:\Windows\System\HNMNnre.exe
  C:\Windows\System\HNMNnre.exe
  2⤵
  PID:7972
- C:\Windows\System\EnvYefI.exe
  C:\Windows\System\EnvYefI.exe
  2⤵
  PID:7416
- C:\Windows\System\JNWRyjU.exe
  C:\Windows\System\JNWRyjU.exe
  2⤵
  PID:7384
- C:\Windows\System\fWeBDPv.exe
  C:\Windows\System\fWeBDPv.exe
  2⤵
  PID:7448
- C:\Windows\System\MXJzaLE.exe
  C:\Windows\System\MXJzaLE.exe
  2⤵
  PID:7516
- C:\Windows\System\sKKFqXN.exe
  C:\Windows\System\sKKFqXN.exe
  2⤵
  PID:7776
- C:\Windows\System\NtqHeHt.exe
  C:\Windows\System\NtqHeHt.exe
  2⤵
  PID:8008
- C:\Windows\System\qyUsLdh.exe
  C:\Windows\System\qyUsLdh.exe
  2⤵
  PID:8020
- C:\Windows\System\xPCOnWj.exe
  C:\Windows\System\xPCOnWj.exe
  2⤵
  PID:8152
- C:\Windows\System\EdLVsZt.exe
  C:\Windows\System\EdLVsZt.exe
  2⤵
  PID:7468
- C:\Windows\System\uCeuFuk.exe
  C:\Windows\System\uCeuFuk.exe
  2⤵
  PID:6768
- C:\Windows\System\ljZGMDy.exe
  C:\Windows\System\ljZGMDy.exe
  2⤵
  PID:7544
- C:\Windows\System\PFUkazb.exe
  C:\Windows\System\PFUkazb.exe
  2⤵
  PID:7120
- C:\Windows\System\yWnIRqf.exe
  C:\Windows\System\yWnIRqf.exe
  2⤵
  PID:7648
- C:\Windows\System\iTRTgqx.exe
  C:\Windows\System\iTRTgqx.exe
  2⤵
  PID:6884
- C:\Windows\System\HbSQXmI.exe
  C:\Windows\System\HbSQXmI.exe
  2⤵
  PID:8068
- C:\Windows\System\FRxxmwF.exe
  C:\Windows\System\FRxxmwF.exe
  2⤵
  PID:7792
- C:\Windows\System\XCInfpZ.exe
  C:\Windows\System\XCInfpZ.exe
  2⤵
  PID:7512
- C:\Windows\System\ioouNwy.exe
  C:\Windows\System\ioouNwy.exe
  2⤵
  PID:7876
- C:\Windows\System\MuFsMdH.exe
  C:\Windows\System\MuFsMdH.exe
  2⤵
  PID:7960
- C:\Windows\System\ANuzxWM.exe
  C:\Windows\System\ANuzxWM.exe
  2⤵
  PID:7368
- C:\Windows\System\TNNdxfO.exe
  C:\Windows\System\TNNdxfO.exe
  2⤵
  PID:7284
- C:\Windows\System\rXqpoON.exe
  C:\Windows\System\rXqpoON.exe
  2⤵
  PID:7320
- C:\Windows\System\ZbTLziZ.exe
  C:\Windows\System\ZbTLziZ.exe
  2⤵
  PID:7744
- C:\Windows\System\DwiGzaP.exe
  C:\Windows\System\DwiGzaP.exe
  2⤵
  PID:7420
- C:\Windows\System\TXDRugP.exe
  C:\Windows\System\TXDRugP.exe
  2⤵
  PID:7204
- C:\Windows\System\RJFXPNK.exe
  C:\Windows\System\RJFXPNK.exe
  2⤵
  PID:8084
- C:\Windows\System\OMirhFZ.exe
  C:\Windows\System\OMirhFZ.exe
  2⤵
  PID:8208
- C:\Windows\System\EHBaTcB.exe
  C:\Windows\System\EHBaTcB.exe
  2⤵
  PID:8224
- C:\Windows\System\NjMMgrt.exe
  C:\Windows\System\NjMMgrt.exe
  2⤵
  PID:8240
- C:\Windows\System\LlFofTY.exe
  C:\Windows\System\LlFofTY.exe
  2⤵
  PID:8256
- C:\Windows\System\EBysEDs.exe
  C:\Windows\System\EBysEDs.exe
  2⤵
  PID:8272
- C:\Windows\System\FZWXQvI.exe
  C:\Windows\System\FZWXQvI.exe
  2⤵
  PID:8288
- C:\Windows\System\TaojyGw.exe
  C:\Windows\System\TaojyGw.exe
  2⤵
  PID:8304
- C:\Windows\System\GbCyPOb.exe
  C:\Windows\System\GbCyPOb.exe
  2⤵
  PID:8324
- C:\Windows\System\DPLzZRu.exe
  C:\Windows\System\DPLzZRu.exe
  2⤵
  PID:8340
- C:\Windows\System\kdqiAmt.exe
  C:\Windows\System\kdqiAmt.exe
  2⤵
  PID:8356
- C:\Windows\System\PVvepAX.exe
  C:\Windows\System\PVvepAX.exe
  2⤵
  PID:8372
- C:\Windows\System\dNOkCuI.exe
  C:\Windows\System\dNOkCuI.exe
  2⤵
  PID:8388
- C:\Windows\System\GFJsRPU.exe
  C:\Windows\System\GFJsRPU.exe
  2⤵
  PID:8404
- C:\Windows\System\HextUhr.exe
  C:\Windows\System\HextUhr.exe
  2⤵
  PID:8420
- C:\Windows\System\oKFTNuQ.exe
  C:\Windows\System\oKFTNuQ.exe
  2⤵
  PID:8436
- C:\Windows\System\HVGyEMG.exe
  C:\Windows\System\HVGyEMG.exe
  2⤵
  PID:8452
- C:\Windows\System\kwZoyIo.exe
  C:\Windows\System\kwZoyIo.exe
  2⤵
  PID:8468
- C:\Windows\System\nqNJOAX.exe
  C:\Windows\System\nqNJOAX.exe
  2⤵
  PID:8484
- C:\Windows\System\tujQcxv.exe
  C:\Windows\System\tujQcxv.exe
  2⤵
  PID:8500
- C:\Windows\System\nwfOyiA.exe
  C:\Windows\System\nwfOyiA.exe
  2⤵
  PID:8516
- C:\Windows\System\FmWutWY.exe
  C:\Windows\System\FmWutWY.exe
  2⤵
  PID:8532
- C:\Windows\System\aptcBQT.exe
  C:\Windows\System\aptcBQT.exe
  2⤵
  PID:8548
- C:\Windows\System\UauIIgh.exe
  C:\Windows\System\UauIIgh.exe
  2⤵
  PID:8564
- C:\Windows\System\NpdjRHE.exe
  C:\Windows\System\NpdjRHE.exe
  2⤵
  PID:8580
- C:\Windows\System\fqBPKsX.exe
  C:\Windows\System\fqBPKsX.exe
  2⤵
  PID:8596
- C:\Windows\System\nZoQGGk.exe
  C:\Windows\System\nZoQGGk.exe
  2⤵
  PID:8612
- C:\Windows\System\RazEEFv.exe
  C:\Windows\System\RazEEFv.exe
  2⤵
  PID:8628
- C:\Windows\System\KedaHcN.exe
  C:\Windows\System\KedaHcN.exe
  2⤵
  PID:8644
- C:\Windows\System\YixdpnS.exe
  C:\Windows\System\YixdpnS.exe
  2⤵
  PID:8660
- C:\Windows\System\eVpzluy.exe
  C:\Windows\System\eVpzluy.exe
  2⤵
  PID:8676
- C:\Windows\System\NxbhNZv.exe
  C:\Windows\System\NxbhNZv.exe
  2⤵
  PID:8692
- C:\Windows\System\KbiCLCf.exe
  C:\Windows\System\KbiCLCf.exe
  2⤵
  PID:8708
- C:\Windows\System\BbaYvkt.exe
  C:\Windows\System\BbaYvkt.exe
  2⤵
  PID:8724
- C:\Windows\System\nyYOPBg.exe
  C:\Windows\System\nyYOPBg.exe
  2⤵
  PID:8740
- C:\Windows\System\LWMYqto.exe
  C:\Windows\System\LWMYqto.exe
  2⤵
  PID:8756
- C:\Windows\System\jPVBjmb.exe
  C:\Windows\System\jPVBjmb.exe
  2⤵
  PID:8772
- C:\Windows\System\TFhCbya.exe
  C:\Windows\System\TFhCbya.exe
  2⤵
  PID:8788
- C:\Windows\System\YIqYaQH.exe
  C:\Windows\System\YIqYaQH.exe
  2⤵
  PID:8804
- C:\Windows\System\YKdhfpu.exe
  C:\Windows\System\YKdhfpu.exe
  2⤵
  PID:8820
- C:\Windows\System\LXeRazq.exe
  C:\Windows\System\LXeRazq.exe
  2⤵
  PID:8840
- C:\Windows\System\ePDbXcI.exe
  C:\Windows\System\ePDbXcI.exe
  2⤵
  PID:8856
- C:\Windows\System\wNGCeOl.exe
  C:\Windows\System\wNGCeOl.exe
  2⤵
  PID:8872
- C:\Windows\System\fXRmWba.exe
  C:\Windows\System\fXRmWba.exe
  2⤵
  PID:8888
- C:\Windows\System\NHzhghA.exe
  C:\Windows\System\NHzhghA.exe
  2⤵
  PID:8904
- C:\Windows\System\JZfmass.exe
  C:\Windows\System\JZfmass.exe
  2⤵
  PID:8920
- C:\Windows\System\kGXRwnS.exe
  C:\Windows\System\kGXRwnS.exe
  2⤵
  PID:8936
- C:\Windows\System\JIGACFb.exe
  C:\Windows\System\JIGACFb.exe
  2⤵
  PID:8952
- C:\Windows\System\OuvdDPu.exe
  C:\Windows\System\OuvdDPu.exe
  2⤵
  PID:8968
- C:\Windows\System\sZgFpVD.exe
  C:\Windows\System\sZgFpVD.exe
  2⤵
  PID:8984
- C:\Windows\System\rjCaTmH.exe
  C:\Windows\System\rjCaTmH.exe
  2⤵
  PID:9000
- C:\Windows\System\ZvWWPpj.exe
  C:\Windows\System\ZvWWPpj.exe
  2⤵
  PID:9016
- C:\Windows\System\ItNHrgi.exe
  C:\Windows\System\ItNHrgi.exe
  2⤵
  PID:9032
- C:\Windows\System\yAAxSOs.exe
  C:\Windows\System\yAAxSOs.exe
  2⤵
  PID:9048
- C:\Windows\System\iPkeFLR.exe
  C:\Windows\System\iPkeFLR.exe
  2⤵
  PID:9064
- C:\Windows\System\fRBGcqf.exe
  C:\Windows\System\fRBGcqf.exe
  2⤵
  PID:9080
- C:\Windows\System\nLbTVsY.exe
  C:\Windows\System\nLbTVsY.exe
  2⤵
  PID:9096
- C:\Windows\System\LbpFAAj.exe
  C:\Windows\System\LbpFAAj.exe
  2⤵
  PID:9112
- C:\Windows\System\QxfziKS.exe
  C:\Windows\System\QxfziKS.exe
  2⤵
  PID:9128
- C:\Windows\System\ChjjSoH.exe
  C:\Windows\System\ChjjSoH.exe
  2⤵
  PID:9144
- C:\Windows\System\kdawKLo.exe
  C:\Windows\System\kdawKLo.exe
  2⤵
  PID:9160
- C:\Windows\System\kxpxXtL.exe
  C:\Windows\System\kxpxXtL.exe
  2⤵
  PID:9176
- C:\Windows\System\uLlLVSO.exe
  C:\Windows\System\uLlLVSO.exe
  2⤵
  PID:9192
- C:\Windows\System\ypgdjqs.exe
  C:\Windows\System\ypgdjqs.exe
  2⤵
  PID:9208
- C:\Windows\System\wiISAtK.exe
  C:\Windows\System\wiISAtK.exe
  2⤵
  PID:7352
- C:\Windows\System\mwmGcvn.exe
  C:\Windows\System\mwmGcvn.exe
  2⤵
  PID:8216
- C:\Windows\System\FWclaJi.exe
  C:\Windows\System\FWclaJi.exe
  2⤵
  PID:8132
- C:\Windows\System\weuKeyh.exe
  C:\Windows\System\weuKeyh.exe
  2⤵
  PID:8236
- C:\Windows\System\cfjulKb.exe
  C:\Windows\System\cfjulKb.exe
  2⤵
  PID:8252
- C:\Windows\System\zVsWIQA.exe
  C:\Windows\System\zVsWIQA.exe
  2⤵
  PID:8332
- C:\Windows\System\yMCPgux.exe
  C:\Windows\System\yMCPgux.exe
  2⤵
  PID:8280
- C:\Windows\System\SMqeuQX.exe
  C:\Windows\System\SMqeuQX.exe
  2⤵
  PID:8352
- C:\Windows\System\YetlRdR.exe
  C:\Windows\System\YetlRdR.exe
  2⤵
  PID:8396
- C:\Windows\System\weMZQhs.exe
  C:\Windows\System\weMZQhs.exe
  2⤵
  PID:8460
- C:\Windows\System\bedVMaZ.exe
  C:\Windows\System\bedVMaZ.exe
  2⤵
  PID:8476
- C:\Windows\System\syjjBxi.exe
  C:\Windows\System\syjjBxi.exe
  2⤵
  PID:8496
- C:\Windows\System\XNrRrEF.exe
  C:\Windows\System\XNrRrEF.exe
  2⤵
  PID:8588
- C:\Windows\System\aqgsGgX.exe
  C:\Windows\System\aqgsGgX.exe
  2⤵
  PID:8544
- C:\Windows\System\oAOXoGb.exe
  C:\Windows\System\oAOXoGb.exe
  2⤵
  PID:8512
- C:\Windows\System\BlTzzgd.exe
  C:\Windows\System\BlTzzgd.exe
  2⤵
  PID:8652
- C:\Windows\System\VhkNeuS.exe
  C:\Windows\System\VhkNeuS.exe
  2⤵
  PID:8572
- C:\Windows\System\HriQYch.exe
  C:\Windows\System\HriQYch.exe
  2⤵
  PID:8636
- C:\Windows\System\MevEKiw.exe
  C:\Windows\System\MevEKiw.exe
  2⤵
  PID:8704
- C:\Windows\System\awKczvn.exe
  C:\Windows\System\awKczvn.exe
  2⤵
  PID:8732
- C:\Windows\System\JDNsCVc.exe
  C:\Windows\System\JDNsCVc.exe
  2⤵
  PID:8796
- C:\Windows\System\ubOMgGf.exe
  C:\Windows\System\ubOMgGf.exe
  2⤵
  PID:8816
- C:\Windows\System\yUnCFVP.exe
  C:\Windows\System\yUnCFVP.exe
  2⤵
  PID:8848
- C:\Windows\System\OkKWsIn.exe
  C:\Windows\System\OkKWsIn.exe
  2⤵
  PID:8868
- C:\Windows\System\LeuhbhW.exe
  C:\Windows\System\LeuhbhW.exe
  2⤵
  PID:8912
- C:\Windows\System\rdVfJXE.exe
  C:\Windows\System\rdVfJXE.exe
  2⤵
  PID:8980
- C:\Windows\System\ydmpPLU.exe
  C:\Windows\System\ydmpPLU.exe
  2⤵
  PID:9040
- C:\Windows\System\mtKqAMm.exe
  C:\Windows\System\mtKqAMm.exe
  2⤵
  PID:9076
- C:\Windows\System\NLVpUUO.exe
  C:\Windows\System\NLVpUUO.exe
  2⤵
  PID:8992
- C:\Windows\System\wBqyGEJ.exe
  C:\Windows\System\wBqyGEJ.exe
  2⤵
  PID:9024
- C:\Windows\System\OvNXxOq.exe
  C:\Windows\System\OvNXxOq.exe
  2⤵
  PID:9108
- C:\Windows\System\xLmbnMq.exe
  C:\Windows\System\xLmbnMq.exe
  2⤵
  PID:9168
- C:\Windows\System\voTBUSW.exe
  C:\Windows\System\voTBUSW.exe
  2⤵
  PID:9204
- C:\Windows\System\hfTIfjS.exe
  C:\Windows\System\hfTIfjS.exe
  2⤵
  PID:7496
- C:\Windows\System\KWujkle.exe
  C:\Windows\System\KWujkle.exe
  2⤵
  PID:9184
- C:\Windows\System\UOyXNjQ.exe
  C:\Windows\System\UOyXNjQ.exe
  2⤵
  PID:8268
- C:\Windows\System\bdiAirl.exe
  C:\Windows\System\bdiAirl.exe
  2⤵
  PID:8364
- C:\Windows\System\ElQUjfh.exe
  C:\Windows\System\ElQUjfh.exe
  2⤵
  PID:7676
- C:\Windows\System\uYwafZP.exe
  C:\Windows\System\uYwafZP.exe
  2⤵
  PID:8380
- C:\Windows\System\UjLwyeS.exe
  C:\Windows\System\UjLwyeS.exe
  2⤵
  PID:8416
- C:\Windows\System\aIoyRoR.exe
  C:\Windows\System\aIoyRoR.exe
  2⤵
  PID:8624
- C:\Windows\System\cdMcRYv.exe
  C:\Windows\System\cdMcRYv.exe
  2⤵
  PID:8672
- C:\Windows\System\llyNCOn.exe
  C:\Windows\System\llyNCOn.exe
  2⤵
  PID:8812
- C:\Windows\System\vAOziBo.exe
  C:\Windows\System\vAOziBo.exe
  2⤵
  PID:8448
- C:\Windows\System\elsEDmD.exe
  C:\Windows\System\elsEDmD.exe
  2⤵
  PID:8688
- C:\Windows\System\NUJRhjc.exe
  C:\Windows\System\NUJRhjc.exe
  2⤵
  PID:8784
- C:\Windows\System\aKrqLHf.exe
  C:\Windows\System\aKrqLHf.exe
  2⤵
  PID:9044
- C:\Windows\System\lraFxJf.exe
  C:\Windows\System\lraFxJf.exe
  2⤵
  PID:9136
- C:\Windows\System\MJbxJNl.exe
  C:\Windows\System\MJbxJNl.exe
  2⤵
  PID:8300
- C:\Windows\System\nVDSfWC.exe
  C:\Windows\System\nVDSfWC.exe
  2⤵
  PID:8884
- C:\Windows\System\JpDftCk.exe
  C:\Windows\System\JpDftCk.exe
  2⤵
  PID:8948
- C:\Windows\System\zMZPRaY.exe
  C:\Windows\System\zMZPRaY.exe
  2⤵
  PID:8204
- C:\Windows\System\RIhSwod.exe
  C:\Windows\System\RIhSwod.exe
  2⤵
  PID:9060
- C:\Windows\System\mohGRah.exe
  C:\Windows\System\mohGRah.exe
  2⤵
  PID:8316
- C:\Windows\System\miNBRFY.exe
  C:\Windows\System\miNBRFY.exe
  2⤵
  PID:8716
- C:\Windows\System\LKicDFG.exe
  C:\Windows\System\LKicDFG.exe
  2⤵
  PID:8800
- C:\Windows\System\yqwLsJq.exe
  C:\Windows\System\yqwLsJq.exe
  2⤵
  PID:8836
- C:\Windows\System\BZBkiDC.exe
  C:\Windows\System\BZBkiDC.exe
  2⤵
  PID:8976
- C:\Windows\System\pobkbbk.exe
  C:\Windows\System\pobkbbk.exe
  2⤵
  PID:6676
- C:\Windows\System\aUAxLXR.exe
  C:\Windows\System\aUAxLXR.exe
  2⤵
  PID:8556
- C:\Windows\System\scOuafG.exe
  C:\Windows\System\scOuafG.exe
  2⤵
  PID:8768
- C:\Windows\System\chKMhBO.exe
  C:\Windows\System\chKMhBO.exe
  2⤵
  PID:8928
- C:\Windows\System\kEZbIpu.exe
  C:\Windows\System\kEZbIpu.exe
  2⤵
  PID:8508
- C:\Windows\System\dMOwNDP.exe
  C:\Windows\System\dMOwNDP.exe
  2⤵
  PID:9104
- C:\Windows\System\XueVZaX.exe
  C:\Windows\System\XueVZaX.exe
  2⤵
  PID:8668
- C:\Windows\System\WByzEwz.exe
  C:\Windows\System\WByzEwz.exe
  2⤵
  PID:9232
- C:\Windows\System\FzhNVLM.exe
  C:\Windows\System\FzhNVLM.exe
  2⤵
  PID:9248
- C:\Windows\System\xIrojDN.exe
  C:\Windows\System\xIrojDN.exe
  2⤵
  PID:9264
- C:\Windows\System\AJxSCph.exe
  C:\Windows\System\AJxSCph.exe
  2⤵
  PID:9280
- C:\Windows\System\rYJcfly.exe
  C:\Windows\System\rYJcfly.exe
  2⤵
  PID:9296
- C:\Windows\System\nhWSigk.exe
  C:\Windows\System\nhWSigk.exe
  2⤵
  PID:9312
- C:\Windows\System\MvMsHIl.exe
  C:\Windows\System\MvMsHIl.exe
  2⤵
  PID:9328
- C:\Windows\System\BhPYHQt.exe
  C:\Windows\System\BhPYHQt.exe
  2⤵
  PID:9344
- C:\Windows\System\ETyExAE.exe
  C:\Windows\System\ETyExAE.exe
  2⤵
  PID:9360
- C:\Windows\System\aGuxEyx.exe
  C:\Windows\System\aGuxEyx.exe
  2⤵
  PID:9404
- C:\Windows\System\fStYQra.exe
  C:\Windows\System\fStYQra.exe
  2⤵
  PID:9420
- C:\Windows\System\ZbFTphd.exe
  C:\Windows\System\ZbFTphd.exe
  2⤵
  PID:9440
- C:\Windows\System\XPtpXyr.exe
  C:\Windows\System\XPtpXyr.exe
  2⤵
  PID:9456
- C:\Windows\System\wbnvVOZ.exe
  C:\Windows\System\wbnvVOZ.exe
  2⤵
  PID:9476
- C:\Windows\System\xdpVXNp.exe
  C:\Windows\System\xdpVXNp.exe
  2⤵
  PID:9636
- C:\Windows\System\GjVxMcX.exe
  C:\Windows\System\GjVxMcX.exe
  2⤵
  PID:9652
- C:\Windows\System\mHwfDSQ.exe
  C:\Windows\System\mHwfDSQ.exe
  2⤵
  PID:9676
- C:\Windows\System\rGvMBAF.exe
  C:\Windows\System\rGvMBAF.exe
  2⤵
  PID:9692
- C:\Windows\System\EyjEDmp.exe
  C:\Windows\System\EyjEDmp.exe
  2⤵
  PID:9708
- C:\Windows\System\CaAYDLH.exe
  C:\Windows\System\CaAYDLH.exe
  2⤵
  PID:9724
- C:\Windows\System\ZjYJuvW.exe
  C:\Windows\System\ZjYJuvW.exe
  2⤵
  PID:9740
- C:\Windows\System\yIpWKUU.exe
  C:\Windows\System\yIpWKUU.exe
  2⤵
  PID:9756
- C:\Windows\System\obAvaUc.exe
  C:\Windows\System\obAvaUc.exe
  2⤵
  PID:9772
- C:\Windows\System\LzeYIJc.exe
  C:\Windows\System\LzeYIJc.exe
  2⤵
  PID:9788
- C:\Windows\System\PCqhVOo.exe
  C:\Windows\System\PCqhVOo.exe
  2⤵
  PID:9804
- C:\Windows\System\ejbBEVZ.exe
  C:\Windows\System\ejbBEVZ.exe
  2⤵
  PID:9820
- C:\Windows\System\eEAwFzK.exe
  C:\Windows\System\eEAwFzK.exe
  2⤵
  PID:9836
- C:\Windows\System\rUyyDjd.exe
  C:\Windows\System\rUyyDjd.exe
  2⤵
  PID:9852
- C:\Windows\System\AEWnWGg.exe
  C:\Windows\System\AEWnWGg.exe
  2⤵
  PID:9868
- C:\Windows\System\LqtSDsc.exe
  C:\Windows\System\LqtSDsc.exe
  2⤵
  PID:9884
- C:\Windows\System\QCnSWnN.exe
  C:\Windows\System\QCnSWnN.exe
  2⤵
  PID:9900
- C:\Windows\System\lbRsYJJ.exe
  C:\Windows\System\lbRsYJJ.exe
  2⤵
  PID:9916
- C:\Windows\System\xJZibhW.exe
  C:\Windows\System\xJZibhW.exe
  2⤵
  PID:9932
- C:\Windows\System\iNOBVil.exe
  C:\Windows\System\iNOBVil.exe
  2⤵
  PID:9948
- C:\Windows\System\ZiSrQGA.exe
  C:\Windows\System\ZiSrQGA.exe
  2⤵
  PID:9964
- C:\Windows\System\boOZzrf.exe
  C:\Windows\System\boOZzrf.exe
  2⤵
  PID:9980
- C:\Windows\System\XsHWKKg.exe
  C:\Windows\System\XsHWKKg.exe
  2⤵
  PID:10004
- C:\Windows\System\ydyiOEe.exe
  C:\Windows\System\ydyiOEe.exe
  2⤵
  PID:10020
- C:\Windows\System\MIxAKOV.exe
  C:\Windows\System\MIxAKOV.exe
  2⤵
  PID:10036
- C:\Windows\System\TxBGdeN.exe
  C:\Windows\System\TxBGdeN.exe
  2⤵
  PID:10056
- C:\Windows\System\qsmesjA.exe
  C:\Windows\System\qsmesjA.exe
  2⤵
  PID:10076
- C:\Windows\System\btBEOvG.exe
  C:\Windows\System\btBEOvG.exe
  2⤵
  PID:10092
- C:\Windows\System\IHWsVwa.exe
  C:\Windows\System\IHWsVwa.exe
  2⤵
  PID:10112
- C:\Windows\System\iByyxKI.exe
  C:\Windows\System\iByyxKI.exe
  2⤵
  PID:10128
- C:\Windows\System\gqiIoYc.exe
  C:\Windows\System\gqiIoYc.exe
  2⤵
  PID:10144
- C:\Windows\System\cfphzmm.exe
  C:\Windows\System\cfphzmm.exe
  2⤵
  PID:10160
- C:\Windows\System\ZMHMFHW.exe
  C:\Windows\System\ZMHMFHW.exe
  2⤵
  PID:10188
- C:\Windows\System\rvqtSsB.exe
  C:\Windows\System\rvqtSsB.exe
  2⤵
  PID:10204
- C:\Windows\System\mmUKfKI.exe
  C:\Windows\System\mmUKfKI.exe
  2⤵
  PID:10232
- C:\Windows\System\FRylxMO.exe
  C:\Windows\System\FRylxMO.exe
  2⤵
  PID:8900
- C:\Windows\System\WfSBljp.exe
  C:\Windows\System\WfSBljp.exe
  2⤵
  PID:9416
- C:\Windows\System\iJKLjwT.exe
  C:\Windows\System\iJKLjwT.exe
  2⤵
  PID:9448
- C:\Windows\System\TglQDUX.exe
  C:\Windows\System\TglQDUX.exe
  2⤵
  PID:9472
- C:\Windows\System\aiBCPnR.exe
  C:\Windows\System\aiBCPnR.exe
  2⤵
  PID:9508
- C:\Windows\System\zPUXAUt.exe
  C:\Windows\System\zPUXAUt.exe
  2⤵
  PID:9516
- C:\Windows\System\iAjAjEt.exe
  C:\Windows\System\iAjAjEt.exe
  2⤵
  PID:9532
- C:\Windows\System\vwWROAn.exe
  C:\Windows\System\vwWROAn.exe
  2⤵
  PID:9544
- C:\Windows\System\EitEfNr.exe
  C:\Windows\System\EitEfNr.exe
  2⤵
  PID:9564
- C:\Windows\System\cmrDbXn.exe
  C:\Windows\System\cmrDbXn.exe
  2⤵
  PID:9584
- C:\Windows\System\oEzOzmi.exe
  C:\Windows\System\oEzOzmi.exe
  2⤵
  PID:9600
- C:\Windows\System\RVxeMaK.exe
  C:\Windows\System\RVxeMaK.exe
  2⤵
  PID:9616
- C:\Windows\System\yxKkYTC.exe
  C:\Windows\System\yxKkYTC.exe
  2⤵
  PID:9628
- C:\Windows\System\QnQpdDk.exe
  C:\Windows\System\QnQpdDk.exe
  2⤵
  PID:9672
- C:\Windows\System\dFaktRh.exe
  C:\Windows\System\dFaktRh.exe
  2⤵
  PID:9648
- C:\Windows\System\mfeiZQu.exe
  C:\Windows\System\mfeiZQu.exe
  2⤵
  PID:9732
- C:\Windows\System\GAlgYnL.exe
  C:\Windows\System\GAlgYnL.exe
  2⤵
  PID:9752
- C:\Windows\System\ApfGsBK.exe
  C:\Windows\System\ApfGsBK.exe
  2⤵
  PID:9800
- C:\Windows\System\EJUNkui.exe
  C:\Windows\System\EJUNkui.exe
  2⤵
  PID:9864
- C:\Windows\System\tfFDOEk.exe
  C:\Windows\System\tfFDOEk.exe
  2⤵
  PID:9816
- C:\Windows\System\MSLOVNe.exe
  C:\Windows\System\MSLOVNe.exe
  2⤵
  PID:9784
- C:\Windows\System\hyXYWrp.exe
  C:\Windows\System\hyXYWrp.exe
  2⤵
  PID:9956
- C:\Windows\System\zrPWggN.exe
  C:\Windows\System\zrPWggN.exe
  2⤵
  PID:9812
- C:\Windows\System\vAEFnvv.exe
  C:\Windows\System\vAEFnvv.exe
  2⤵
  PID:9572
- C:\Windows\System\Uxisfbi.exe
  C:\Windows\System\Uxisfbi.exe
  2⤵
  PID:10064
- C:\Windows\System\DRvhzSn.exe
  C:\Windows\System\DRvhzSn.exe
  2⤵
  PID:10140
- C:\Windows\System\HZzUVIb.exe
  C:\Windows\System\HZzUVIb.exe
  2⤵
  PID:10180
- C:\Windows\System\mGVBfxk.exe
  C:\Windows\System\mGVBfxk.exe
  2⤵
  PID:10100
- C:\Windows\System\krdZsxu.exe
  C:\Windows\System\krdZsxu.exe
  2⤵
  PID:8432
- C:\Windows\System\RLUekpn.exe
  C:\Windows\System\RLUekpn.exe
  2⤵
  PID:8720
- C:\Windows\System\PdRiZEB.exe
  C:\Windows\System\PdRiZEB.exe
  2⤵
  PID:9260
- C:\Windows\System\tkXPkYx.exe
  C:\Windows\System\tkXPkYx.exe
  2⤵
  PID:9324
- C:\Windows\System\PclLTsb.exe
  C:\Windows\System\PclLTsb.exe
  2⤵
  PID:9376
- C:\Windows\System\YCUkZqi.exe
  C:\Windows\System\YCUkZqi.exe
  2⤵
  PID:9388
- C:\Windows\System\HvHebgs.exe
  C:\Windows\System\HvHebgs.exe
  2⤵
  PID:10156
- C:\Windows\System\FbRiwBy.exe
  C:\Windows\System\FbRiwBy.exe
  2⤵
  PID:8880
- C:\Windows\System\pIskVbB.exe
  C:\Windows\System\pIskVbB.exe
  2⤵
  PID:9392
- C:\Windows\System\JvCZZyI.exe
  C:\Windows\System\JvCZZyI.exe
  2⤵
  PID:9464
- C:\Windows\System\smpbhWA.exe
  C:\Windows\System\smpbhWA.exe
  2⤵
  PID:8944
- C:\Windows\System\fQLFEXL.exe
  C:\Windows\System\fQLFEXL.exe
  2⤵
  PID:9664
- C:\Windows\System\ANbtobe.exe
  C:\Windows\System\ANbtobe.exe
  2⤵
  PID:9768
- C:\Windows\System\iqRydEH.exe
  C:\Windows\System\iqRydEH.exe
  2⤵
  PID:9848
- C:\Windows\System\wPHFLmz.exe
  C:\Windows\System\wPHFLmz.exe
  2⤵
  PID:9944
- C:\Windows\System\PBNXziw.exe
  C:\Windows\System\PBNXziw.exe
  2⤵
  PID:9992
- C:\Windows\System\OWarqaE.exe
  C:\Windows\System\OWarqaE.exe
  2⤵
  PID:9256
- C:\Windows\System\KfLUrhW.exe
  C:\Windows\System\KfLUrhW.exe
  2⤵
  PID:9276
- C:\Windows\System\OmjLsEZ.exe
  C:\Windows\System\OmjLsEZ.exe
  2⤵
  PID:9560
- C:\Windows\System\EfUuqbQ.exe
  C:\Windows\System\EfUuqbQ.exe
  2⤵
  PID:9412
- C:\Windows\System\Efynesg.exe
  C:\Windows\System\Efynesg.exe
  2⤵
  PID:9496
- C:\Windows\System\JotzTnt.exe
  C:\Windows\System\JotzTnt.exe
  2⤵
  PID:8492
- C:\Windows\System\fQoxqWD.exe
  C:\Windows\System\fQoxqWD.exe
  2⤵
  PID:9400
- C:\Windows\System\AOnNJxo.exe
  C:\Windows\System\AOnNJxo.exe
  2⤵
  PID:9736
- C:\Windows\System\rfpfObj.exe
  C:\Windows\System\rfpfObj.exe
  2⤵
  PID:10016
- C:\Windows\System\TiZLgBS.exe
  C:\Windows\System\TiZLgBS.exe
  2⤵
  PID:10216
- C:\Windows\System\GEFvDJN.exe
  C:\Windows\System\GEFvDJN.exe
  2⤵
  PID:10012
- C:\Windows\System\QYZnJZx.exe
  C:\Windows\System\QYZnJZx.exe
  2⤵
  PID:9596
- C:\Windows\System\ADqslFV.exe
  C:\Windows\System\ADqslFV.exe
  2⤵
  PID:9356
- C:\Windows\System\UOAJwXN.exe
  C:\Windows\System\UOAJwXN.exe
  2⤵
  PID:9320
- C:\Windows\System\FepFHSX.exe
  C:\Windows\System\FepFHSX.exe
  2⤵
  PID:9540
- C:\Windows\System\fjxOqKt.exe
  C:\Windows\System\fjxOqKt.exe
  2⤵
  PID:9624
- C:\Windows\System\GWvzYdJ.exe
  C:\Windows\System\GWvzYdJ.exe
  2⤵
  PID:9556
- C:\Windows\System\pqsCcNM.exe
  C:\Windows\System\pqsCcNM.exe
  2⤵
  PID:9876
- C:\Windows\System\bJberlR.exe
  C:\Windows\System\bJberlR.exe
  2⤵
  PID:10176
- C:\Windows\System\EPRzNRh.exe
  C:\Windows\System\EPRzNRh.exe
  2⤵
  PID:9288
- C:\Windows\System\eZALWGw.exe
  C:\Windows\System\eZALWGw.exe
  2⤵
  PID:9468
- C:\Windows\System\LhJPCKM.exe
  C:\Windows\System\LhJPCKM.exe
  2⤵
  PID:10224
- C:\Windows\System\zSvOjrw.exe
  C:\Windows\System\zSvOjrw.exe
  2⤵
  PID:9384
- C:\Windows\System\zjcRlnl.exe
  C:\Windows\System\zjcRlnl.exe
  2⤵
  PID:9240
- C:\Windows\System\NrHZHXt.exe
  C:\Windows\System\NrHZHXt.exe
  2⤵
  PID:10088
- C:\Windows\System\qGCUOaq.exe
  C:\Windows\System\qGCUOaq.exe
  2⤵
  PID:9716
- C:\Windows\System\cVdNuXc.exe
  C:\Windows\System\cVdNuXc.exe
  2⤵
  PID:9704
- C:\Windows\System\YAMQndr.exe
  C:\Windows\System\YAMQndr.exe
  2⤵
  PID:10124
- C:\Windows\System\ZoCQzEf.exe
  C:\Windows\System\ZoCQzEf.exe
  2⤵
  PID:9552
- C:\Windows\System\QAFVCpa.exe
  C:\Windows\System\QAFVCpa.exe
  2⤵
  PID:10260
- C:\Windows\System\jVxYrYG.exe
  C:\Windows\System\jVxYrYG.exe
  2⤵
  PID:10276
- C:\Windows\System\JMzteYC.exe
  C:\Windows\System\JMzteYC.exe
  2⤵
  PID:10292
- C:\Windows\System\IczsqoH.exe
  C:\Windows\System\IczsqoH.exe
  2⤵
  PID:10308
- C:\Windows\System\DtccLzF.exe
  C:\Windows\System\DtccLzF.exe
  2⤵
  PID:10328
- C:\Windows\System\UvlTRNH.exe
  C:\Windows\System\UvlTRNH.exe
  2⤵
  PID:10348
- C:\Windows\System\VSfncfM.exe
  C:\Windows\System\VSfncfM.exe
  2⤵
  PID:10364
- C:\Windows\System\YzIkGcT.exe
  C:\Windows\System\YzIkGcT.exe
  2⤵
  PID:10384
- C:\Windows\System\EtFsMkH.exe
  C:\Windows\System\EtFsMkH.exe
  2⤵
  PID:10400
- C:\Windows\System\ARQebHd.exe
  C:\Windows\System\ARQebHd.exe
  2⤵
  PID:10420
- C:\Windows\System\NwqFRoe.exe
  C:\Windows\System\NwqFRoe.exe
  2⤵
  PID:10436
- C:\Windows\System\IdFheGm.exe
  C:\Windows\System\IdFheGm.exe
  2⤵
  PID:10452
- C:\Windows\System\WHeqXGk.exe
  C:\Windows\System\WHeqXGk.exe
  2⤵
  PID:10468
- C:\Windows\System\CwuVIit.exe
  C:\Windows\System\CwuVIit.exe
  2⤵
  PID:10584
- C:\Windows\System\bmLxChx.exe
  C:\Windows\System\bmLxChx.exe
  2⤵
  PID:10608
- C:\Windows\System\XDlgSOQ.exe
  C:\Windows\System\XDlgSOQ.exe
  2⤵
  PID:10624
- C:\Windows\System\BDGjqfQ.exe
  C:\Windows\System\BDGjqfQ.exe
  2⤵
  PID:10640
- C:\Windows\System\UYuCjPg.exe
  C:\Windows\System\UYuCjPg.exe
  2⤵
  PID:10660
- C:\Windows\System\ztnaTGd.exe
  C:\Windows\System\ztnaTGd.exe
  2⤵
  PID:10676
- C:\Windows\System\fknOInK.exe
  C:\Windows\System\fknOInK.exe
  2⤵
  PID:10692
- C:\Windows\System\QtjMwwQ.exe
  C:\Windows\System\QtjMwwQ.exe
  2⤵
  PID:10712
- C:\Windows\System\vWnqSFM.exe
  C:\Windows\System\vWnqSFM.exe
  2⤵
  PID:10728
- C:\Windows\System\XbaCalt.exe
  C:\Windows\System\XbaCalt.exe
  2⤵
  PID:10744
- C:\Windows\System\ttjHJhp.exe
  C:\Windows\System\ttjHJhp.exe
  2⤵
  PID:10760
- C:\Windows\System\OKKsIEh.exe
  C:\Windows\System\OKKsIEh.exe
  2⤵
  PID:10776
- C:\Windows\System\DlTekRg.exe
  C:\Windows\System\DlTekRg.exe
  2⤵
  PID:10792
- C:\Windows\System\HldoawP.exe
  C:\Windows\System\HldoawP.exe
  2⤵
  PID:10812
- C:\Windows\System\hOctZSU.exe
  C:\Windows\System\hOctZSU.exe
  2⤵
  PID:10832
- C:\Windows\System\iMZJKLj.exe
  C:\Windows\System\iMZJKLj.exe
  2⤵
  PID:10848
- C:\Windows\System\nNLCqjb.exe
  C:\Windows\System\nNLCqjb.exe
  2⤵
  PID:10864
- C:\Windows\System\CeFDMjs.exe
  C:\Windows\System\CeFDMjs.exe
  2⤵
  PID:10880
- C:\Windows\System\kKxiQbI.exe
  C:\Windows\System\kKxiQbI.exe
  2⤵
  PID:10904
- C:\Windows\System\tPwxsKc.exe
  C:\Windows\System\tPwxsKc.exe
  2⤵
  PID:10920
- C:\Windows\System\pThupTb.exe
  C:\Windows\System\pThupTb.exe
  2⤵
  PID:10936
- C:\Windows\System\fBiorjI.exe
  C:\Windows\System\fBiorjI.exe
  2⤵
  PID:10956
- C:\Windows\System\CDoBzCP.exe
  C:\Windows\System\CDoBzCP.exe
  2⤵
  PID:10972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AZuUUIM.exe

Filesize
2.3MB

MD5
a6a5ac4f94ddec2f3fce7d7a7b2e8591

SHA1
01320e21b0b4819d1cbe74b0fdf921db2090e4a1

SHA256
f5050979946c4eac2dc884f7b15f66ed9c578c62f2df46ee512ba60613856f7b

SHA512
e4be679a189a0a10c0b64cc4813e3447f996fafb0152944b68e49f4661617ec6ff43d7abfe9e676874c472007d02058bb5e651516c84bafc4f219d9c17e0e088

Download Submit
C:\Windows\system\BWGNrGE.exe

Filesize
2.3MB

MD5
ab5096e091a711dfc4aee85f5d97bcda

SHA1
619c49c98284e9e0c863ab3c131f84b0f80e3aca

SHA256
83c9e946d84e116d703744ce31d237f37ef49330b3b3d578f4c4eb7895721be7

SHA512
6655dd3c1c6f5fd27d31c366e5260a103a2eb12456cba0bed9e02021a2980592ac27e84663fc7bbc2507e0c4346283901fdfb375420234d7a9ae16ab6db0ac20

Download Submit
C:\Windows\system\CxZVYzg.exe

Filesize
2.3MB

MD5
13df861a92d3194964e613894ec22160

SHA1
749895da1602163e1807deb5cf103163d63ae361

SHA256
a0c38408c9c7b30a9aaed24679965caf06a02aadf896f895c5a006f29c1cff7b

SHA512
258e69225d023838136491964773862d9c4dfc53dd2443923494130d05358518299b1e9c3101707da292ef28acb321a0f1e53b194cd9e7b1722646765fd4a3f5

Download Submit
C:\Windows\system\DFKEvit.exe

Filesize
2.3MB

MD5
fff7bd2bbd9ccd5f8b2d50064274a0e2

SHA1
1ced55c33b3da9c35daf394f8646b8b5a8c49cb1

SHA256
426ca0d19db4549c8c4aa4a1c07f3088bf74505450ca2d33f0d1a367d19e70cd

SHA512
a279349b1d18e627641da658e0895dad595c507756ca5264862f87eca5f9d8ef0bd5e3a2625a5992a6453534b65082e8a2bc3eacfe8d60356946e45ca866db1a

Download Submit
C:\Windows\system\EyrzidG.exe

Filesize
2.3MB

MD5
915f8339038ae85eb9e16c894b1c024e

SHA1
4d957df018546d232117cb66d4f91ffed3b64da7

SHA256
04b93ce8370b1ce0bb6b38f1ac3d0192eb491b4d485d2ba0f2c967fec196a77d

SHA512
72161cd1a3111e546ab9559ea203b7a5abfe2f3f54c829bb290414a270edacc5e80f1f243d28b4fdccca6b1d230399ea236788f7ad78baeb5c878e725946d55e

Download Submit
C:\Windows\system\JKnWxMK.exe

Filesize
2.3MB

MD5
2baa854b1b6279e91f05020c75766699

SHA1
ad5dbf2ac15dd7e449fb0186b10fa9e2de9d9e2c

SHA256
19d30d90e5fce444317ed25088c86cb04acadd846a23a0481563216c1246d100

SHA512
0ce942337f21adb0a10c610f4301fbd781356fb14ba49e418a3b67120970a77ba624f572aee470e3e506b9fe60e9a5864c455c228847bc7d1e40f60cd83775ec

Download Submit
C:\Windows\system\KWVLwEt.exe

Filesize
2.3MB

MD5
a71e95f854a2c99013e3003010fbedba

SHA1
4133b29b4400b1b1011f8fb8ee91427881ba10be

SHA256
425b5f0bc91cbc0b57b4ee844ab944167b964baebd1ecc8a94ecd5df40263805

SHA512
c77d1f0e5a37846831a6862a2fb9fe68aae7f0623260a411285160a919d4bf32656a0e72b4bb0ec422b1d556b6c7f49a34f5bff7d8f263f0c05f816343fa0e3c

Download Submit
C:\Windows\system\OaDJzWJ.exe

Filesize
2.3MB

MD5
65a6dd63206edf00cfec7f9de3a98ded

SHA1
8051b0ac952842d91cb99573edd98c76112a24bc

SHA256
fec2a8e7e74952d5d13ff9dbad75b07d51ec3a0a5a0a839d17c18c5d470a6c3c

SHA512
689469b89df9c4caf32c9f1b98d73b9beed1ed9aea7adc05ff2bd7f2a88db7c33b764affe176d6be30f502a5cc16414c3423d5cdef076cf9ebde337a8649b79c

Download Submit
C:\Windows\system\PSahyxX.exe

Filesize
2.3MB

MD5
d015f8da5e7ffb3aa12c77bfd0865a07

SHA1
6a946475170deaf07c03b325f1353d4152185f98

SHA256
ab874a55e1e2b071313ac3b7dd64e797668ce59fef0e0cfe6bf0a8b758298804

SHA512
2081e6fbe5d1bf564fa78eed5c7204a459d6199a8f47fee3002466c46c80b327b264d25776f900b750a5369a5f83bce4498a61c1189989af5a102fbd0f28dcc8

Download Submit
C:\Windows\system\PlUhMCt.exe

Filesize
2.3MB

MD5
dfc53d8537bce923ef29ddecd4c88f23

SHA1
5aaca3411c828473052ce02d9f0ddc37efa06d9d

SHA256
124a90620a0f6f12e36d84382d9cf347b97364d3402be25c48a01eea6f1006c5

SHA512
81d8a956e84bb69303e894d8687d44060fa100c40bda9a3032bdbc318c28efae75cc1b991bbe0aa17f6c468d1a1cf9b7d3bb5837f91a2a930b77fc06a6ed7a95

Download Submit
C:\Windows\system\UGsnpos.exe

Filesize
2.3MB

MD5
f8563cb669cf201e0a493a2a0cffff67

SHA1
e30170e4ead25ae3580ce99630e4140afc6faef0

SHA256
38cca50e9f01fb788a51880f8de70e560a82bf1bacfbedb4586a8e58dddcafc8

SHA512
f9c7acb3e03aa18c905bf7d6ee8f4f669f3f7a58a8543e35b0dc202c6e5c57ee20c42803c6ed4d20493f9cd05b23573720b019546440222a0d18cc664dfa7a00

Download Submit
C:\Windows\system\XwcGLiH.exe

Filesize
2.3MB

MD5
0025533cb48b57f7afc4d2129083ebd9

SHA1
3edc8f3bac14d9565021af6d5f4f3963378e3aaf

SHA256
e39a2b1c26c413425b96e9c6c1cb35c178546437fe2f04c8756bb18617e54c4b

SHA512
b6b648ee4c65f5a68fb54871ace7aa7a9895e5ececd22134a5dd8ac35ca0923777c65376ca1f72fd5b2cbbab93b1bc7528ef289e44eb6d6003d8f4a907c70a39

Download Submit
C:\Windows\system\ZjkWtQA.exe

Filesize
2.3MB

MD5
99c48fcf66bef934154da15dfe6f9177

SHA1
32671a09ee7ae6eef69bb22e83f21a69ee122f80

SHA256
0a03eb5911dd54bbf5d81f174465f4051b8d184aa07d5119d4fdf0c54ee491ee

SHA512
92af2d3d237373815e3461bd5268600d6bb633fa982b2b4a892f7a7b515db3c30a8a8c849d508627a0e328db3e303d535b2178c27273a04675e5b45952819d1e

Download Submit
C:\Windows\system\fLbdUME.exe

Filesize
2.3MB

MD5
bd0b2518685e64b5f4c06492e4c764ff

SHA1
85abfe577adf4c5bf17c78ffe2d9504589e6edef

SHA256
0101dc31c32043aa17544061d3eadfe8e47a3b55b913d400f12c4ed3f1451524

SHA512
cc18d5b2a1d233ecd1fbd734094e690cf0fb6a785e69d2f0dfd48c29d53436f8ee934648a61d71d9fc61371874c6cc824d194ce6eeb377cdab8900dafb3b411a

Download Submit
C:\Windows\system\izIiPbp.exe

Filesize
2.3MB

MD5
0f5496a907a0b3044653113da06912df

SHA1
9773c49bb01c4523850bf877cc58bb18505a1318

SHA256
881aa27be641e772c6cbb9ba6eb709371f4b6111cf97f31f43b71cf0befc546f

SHA512
d7107c4374ea5c5a1d4f802647f37c2ae6a13d3ca18723515e99555520aa954c30e2fd403f69c4f22e34d496f8a1b3d2e9637c9628033cf7ce81d219c3fab9b5

Download Submit
C:\Windows\system\mvtXZxe.exe

Filesize
2.3MB

MD5
8a5f80edbf9c04f6dee365f9acec8fb2

SHA1
ff324f53ee67c229dd4d011422409dd75d8be446

SHA256
f03748ba4ae314080e299a750f3c23bd90d8837bb08779bd1622e727e3e5d1ab

SHA512
95315eba2fdaed467fd18d606daac22029ef25a2fb66a6fb6e6c68ad3552b422cc52f8e0acfeea0060444775a252f7406da91e7e64dec29442daa2ebc76df1e7

Download Submit
C:\Windows\system\vADyZcc.exe

Filesize
2.3MB

MD5
6a0a0be1cee8fbc785c2a7fe64c209d8

SHA1
31d85e9321bfb0f584c56e30b03a6bd7be15e9db

SHA256
9c3e420d03968af162df7507a7104bc6af0f4f63574c0e6575b7fd9bdff6ccf2

SHA512
37cbe11faf884d5dd7f6e23b8c91ef18a3adf6d73cdafda18bc29648adee4ac93f3a3243e223367bb02e2d7b9836c1cbdda13051f6de5411d6654bca039121b6

Download Submit
C:\Windows\system\zyYDdFd.exe

Filesize
2.3MB

MD5
f8cd96a01d0102de05dae6af22575ffa

SHA1
4e7be69058fb0df8dd10176c52c2533afe924ce5

SHA256
9107558be35e0be19d194c2aeb422df663c19910b4ca5bc1333709c5a6c8b8ec

SHA512
08e3a94b700f36d4ad1535d71416431603f044ef2277ab5d44a1b26feadd55abacf56f2055796a42efa7e7c42da6f770eaec7432dda23470b59f47869611f8fe

Download Submit
\Windows\system\BvcHCYF.exe

Filesize
2.3MB

MD5
bb923982b002f6544ce34ed5d63ce316

SHA1
32b2c0d9d2b02002cfbfff02d622524cbe0cb8a1

SHA256
8f0cec7310a0a8bbde26bd123e0604f8a3d34a20bd99437633642847f173e26b

SHA512
776ffcc9661cb79901572a45efa2d6babfe3fb00af0d0c6d96af487e242bb489a054325bb4729c4c9bf3804ba5bfb67f0a7ba2be76a1a29bc2e12a7da319fe74

Download Submit
\Windows\system\EVRhNDR.exe

Filesize
2.3MB

MD5
727ebe508ee08a7877180481caf50bac

SHA1
f176a5b9624d78eac204cf5f4b8a97281a8e5f36

SHA256
a952e01a20ab22a2f2c21d02fecc871c5e0821ab8b73e2859446134c56ea6c66

SHA512
f6e8dc7b67b4cda2d296c8d42141abadb40bdb4d5907fd9f79e33f43be88351ee1d1cb381860e50e0c7c7376af4fc43c5dd3ecb0482e911ecd8d26069abd9b94

Download Submit
\Windows\system\FYPXfbK.exe

Filesize
2.3MB

MD5
2c8cda47549c0ce37a87180a14f2074d

SHA1
8cb7d4669e680bdf85906d0c01565959392e5ed2

SHA256
a3550effbbe1d84db98d20c415c2ec9a5eab4f6606a803501d7e726837c976aa

SHA512
2e8157ac39e45c495a6f1ce268fec03c5ed0017d2ff78bddb5863628eb6b6a5819d95627222a23ab3f818a3cc2d8639e794391a20749d367212b9fba1321e8cd

Download Submit
\Windows\system\FkiXPAr.exe

Filesize
2.3MB

MD5
d84fb6ac5dbf95e4c4aae73ba2dc86f9

SHA1
9b6d20f0d127d6beee840d1766dfc150682cd09b

SHA256
8f8b886b872f577a7893c4dbc9d3a2b766d926466004156047748098436b49fc

SHA512
e0fd001523bd0b59117231f14838a42755255e2109405c296e1d9385f14767690706ff16bc6dc03295a03d3e554f612e9009e507bd94a5e3a9e768e4be759698

Download Submit
\Windows\system\OeTnoos.exe

Filesize
2.3MB

MD5
0366f438ec750e481e1f972d6f5c12d9

SHA1
9877758d7d3a9f9ab7a23feb8d10153fac0ec66e

SHA256
ed212a0af356e6b499c104bf4d9f4ba7c00fc265dffe68a3522c03a88f71a2ab

SHA512
6d19e0e43430a2c675eef1c57e0d8847bc23ec3eb638336a8710942280e7a62edcfba84bbfd7733a9d980e0dc7068f0571f1f163c7f17c94644685ac3621769f

Download Submit
\Windows\system\PzXgpFj.exe

Filesize
2.3MB

MD5
f0bcc24b38e3fb1769bca354aeeb7911

SHA1
1f2b8e9ac17567e40e9c0477e392fe6ff86c46aa

SHA256
8f7c9f7fec3f1b331c105e45d39d7164c4575ab86f4a00fa66a2b40a8fb5d935

SHA512
18ca0caae4ac2b1f519b9d449e41dd14d8b2daa585bcd6d955629f36bef11a7df0d9da5d0d1beb8344de73e8e91b09d8bd26d4e0067d47f3cf837c3fa8668f40

Download Submit
\Windows\system\RqHsBrc.exe

Filesize
2.3MB

MD5
b268642c12297b2efac949d3eca07613

SHA1
ad6ee96917455a6bcd701f6c7ce935f44efc6f14

SHA256
06e2c8a3b1bd0063d53adf38e5ed8c6030c9955e8bb30f198cdeaa888e251fd1

SHA512
b7f1d335fe0de2c973818700b9535447ef311ace9b9bca79bd41965811d4fc2f3f432e363391b59d46e2e95cf0f53310a8be164dabb194284f0e9040ec5fd597

Download Submit
\Windows\system\TtPjKHu.exe

Filesize
2.3MB

MD5
0fc49b81922fa110bcfa785c27524259

SHA1
5e18492ffa2fac0f7644cec9cdf3727c83b10884

SHA256
76f5fc9d33d6f645d874470a5468d921ef60b647aeaab1eecdc46dac68010b02

SHA512
9bc4f13fe0fee304f1d82b0454a186196131ef0f57e4cebd19a4ddffcaa07bcd7665599d9a1b4d8e75eb416ea5226f7d6b88713817e4d2bb13873b831c30b387

Download Submit
\Windows\system\UqMoHKb.exe

Filesize
2.3MB

MD5
c7db450d7fb7af1d36d3788ac657ff4e

SHA1
b7b53d20e8bb6575936e63ef176a316a5ceb6c00

SHA256
9dbea93f6fde13bc53fa574f85d45559e5767d787092d7ce9666a886e73df4a0

SHA512
8f17aac35bd67bccb610c92b3c36209f4a955faa0b1daf3c8d183065c277577ccf9cf78b81f98a7b49abcf25c34a9ca3db35dec5b7e46d20cde1e9136d7ef00d

Download Submit
\Windows\system\XROqrrr.exe

Filesize
2.3MB

MD5
8854695a4317a30508033f924527f034

SHA1
d342a785130515de2d16a97ed54a655cd94966aa

SHA256
d3fe4be6181c9d529db9dd7085410e574bedc221e669b95eff2f31da01beec8a

SHA512
a7d3e41da4ca32405d18fbbd1eb485ac7cea9a6a468ee1ab5af598dcdafbd663d59d71460be8ff5ba4f8a279b0a45cff99a2b1ad99b4f4ab75ffdb8e214da42e

Download Submit
\Windows\system\cbOMRUB.exe

Filesize
2.3MB

MD5
68ca3c2b70240c657c1b417ab8193086

SHA1
37640975e79de3907edf1108529130a3bc02b86d

SHA256
b1661bf46b15d07ce49ef2c5659df47e1848f35d5f7893c93711fca2dbe10b5c

SHA512
178b50e2bb0c99b247a74e4d048656aa4936ea5d39e5529be539523151aa566a9846f00e3607b4159749e3d5b1b5a552fa644a9ce0c8a0b6c35e75aff9718a1f

Download Submit
\Windows\system\dFQsigR.exe

Filesize
2.3MB

MD5
ca085dd1306708d9abf3c3abc1e87195

SHA1
ac1e83d18e20bd3093e7a776a2d583ecf7e05a0a

SHA256
350c54d2eb4ac75d41795040d09d40202623c2df4ade29fabe5a570668b7e563

SHA512
89d955101defcac0ac40df2c5f681da0d1bb0502c1259910e494f18acd4d7b16241ed14a5bd4eada906cde6723e29c1766ccd1db81c44ad195b15013f00b0b4b

Download Submit
\Windows\system\eOkvWDV.exe

Filesize
2.3MB

MD5
1df37e69426e676b59c17a83dddfc992

SHA1
0daa2eef0b92f00bb05993a1b423f7b6cd45066d

SHA256
dee51fb3dd2627419dcabafd86c3b70e521e188df9fefe16a7f30a8c2a4bbfeb

SHA512
b4aa303a88c35f5682447c6829dfbf9474a7fd5c2d182599cf6e8d16ae8cf73917a12964deee796180c67c4a8696af88327434432806145493be0af078403fab

Download Submit
\Windows\system\mPChGgE.exe

Filesize
2.3MB

MD5
9ae7f7d64c8e48c6dd35b1ea65de02e0

SHA1
172b726140df3ac7a2f6738f6564c857edaabc36

SHA256
e596699cf6014af81df80bef2a9c822079580bfbf5e154c54c31625fbb6ef84c

SHA512
6b1cdddb02e0e4ee9838c018b33ed922d7cf6f63d0c27d3e6b4aa4099e4abba97ce15b4c2ca55a28aa2bf32878c50680f1d9f4c132b7fd9370bb488e0b58f6fc

Download Submit
\Windows\system\oheEhKZ.exe

Filesize
2.3MB

MD5
e84aef40fec1c319bbeb2ff930198938

SHA1
ca9cd5a45723ce5f823e8eca0a8c018f34fd1c53

SHA256
0460f679c69c65da78733c574fb2c167ba7bc1c4daf7543ef541f9363537569d

SHA512
0e7a8409faf0751840f3a45c32de5792df95d1a526972588fc57e550ebc8c5084868b011d8633d4a8ede92fc8b3dff50795db03b634310c2b6bc72d99fe6c47c

Download Submit
\Windows\system\sVSyJiy.exe

Filesize
2.3MB

MD5
70fd9302f563b374119d0d154a91ec21

SHA1
47f15f5c6112c91ec159f3abcd0630025828dabc

SHA256
da1ffb0cf8bbf58b587f9fd439188ddccf64bb24aa9a6d3d170694e58d029319

SHA512
e5e5c12e61f04386cd97c9b06cba1bc56f955fde1b1b2722d8d242b80a28a65aedaaa6b7d26c99e6c491dd37dbba3302f6eadbfadbe5f266733bb33f0d62905c

Download Submit
\Windows\system\ueuqzlq.exe

Filesize
2.3MB

MD5
e11c28ab9a5a2963cbc184b85e8fa0e2

SHA1
3e2b0c41052086f3a01eb0dd3583195010a4ae46

SHA256
763aca2f7ede500fb0370bcc8c822e2f5a1a127e7028d99284772a4f17d1ac06

SHA512
840cfd3a53be2c8a8f18b3e8c13645568236c122889ec035cb091d90845795914e287965a31dece66a1c44b5d4492ca46b306f6c106aa900345159404bcb8f8b

Download Submit
\Windows\system\vxYMaby.exe

Filesize
2.3MB

MD5
1ceab337fdd73d4a63a7cc089ceabe36

SHA1
0aa69df304b1e66053a7e4e96bdde2ca982b64dd

SHA256
8093653495a4250e8c265c5c9823bc87cd0b2be1e153024e74d7f38ff1aa58ba

SHA512
4d89bd8f386f5672db5c64957565dbc4f382773d65aefe897330b7ef0ee29ea35dbb5c56e5f470326a5008c84c880d25da7d3c7fa75f547d964ab2b228d68ecb

Download Submit
\Windows\system\wSHlrzS.exe

Filesize
2.3MB

MD5
af6f2aacd4168627348e468779f7686c

SHA1
1f7f7962a4e15e825fa302d64ab599d3bb6b4589

SHA256
53523006e48a0381e485e7eef9aca32fd9ec0268ff84456d90fc6f80fbc6f0e6

SHA512
07df8bd2c3879314ee60161bed58070cb100052ae298a70cc9c7c3e0da9a293220fccc8d4ad75b3cc9bd9071924a24d3e2f4ba07d8b37cd6c7a14a69c9d32c70

Download Submit
memory/2252-66-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-77-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2492-63-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-79-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2492-75-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2492-87-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2492-84-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2492-74-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-0-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2492-12-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2492-70-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2492-65-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-82-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-81-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/2500-86-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/2500-55-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2500-14-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/2500-640-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2500-48-0x000000001B4E0000-0x000000001B7C2000-memory.dmp

Filesize
2.9MB

Download
memory/2500-61-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2500-85-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2512-13-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2576-78-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-64-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2608-62-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-71-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-83-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-80-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download