xmrig | f3f2a1c347878dd21dd35ead44b9ff2f26ba6c4258673175412b4f87ca1c0fa2

Analysis

max time kernel
29s
max time network
28s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
Size

1.9MB
MD5

071245b6aa0d079c9b239d9aff2ec7e6
SHA1

24c74652755b4b5f6861453c51418faac6604047
SHA256

f3f2a1c347878dd21dd35ead44b9ff2f26ba6c4258673175412b4f87ca1c0fa2
SHA512

844000887ac29919cb42278c3d42525579911ea99bfb5e78df4c08fb5d769c602cc3f95393c56a83c9cbe5b25da4bc6d5dbf7ecb6c8ab1d2be1d9500b5b2c7cf
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrCD:NABl

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/2228-20-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/3052-30-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2800-28-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2600-27-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2548-69-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2328-77-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2892-84-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/1844-81-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2448-80-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2392-53-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2228-1068-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/1620-1066-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2228	xRjyqAd.exe
3052	GXQYOXI.exe
2600	GeZayTr.exe
2800	jdOvlTE.exe
2744	ypEsmEj.exe
2392	EKypgSq.exe
2548	wudkRMi.exe
2328	GUcRBtI.exe
2892	oyfTIQs.exe
2448	cZYOlUv.exe
1844	bmZSOWo.exe
2560	aZmVuCT.exe
1568	iVmdJQz.exe
1960	XHJpUKN.exe
2156	jiYmUPG.exe
1584	HQoEsQl.exe
2096	VtcZiSs.exe
1320	RouffFn.exe
1676	pahgJAX.exe
1452	iuyDXNH.exe
2840	PtfDloM.exe
844	blAsApN.exe
2768	QCSYrHi.exe
2192	gyqVoFx.exe
1924	YJIoNiS.exe
1820	gwRVxjG.exe
1788	JisaSaJ.exe
2020	yUUWqdq.exe
2348	BnxLfiB.exe
448	SkNaUUp.exe
1200	HuXXdRV.exe
1312	ywTZXzx.exe
2312	tOwRdAZ.exe
1696	lsLdMpf.exe
1300	lIWRkaG.exe
1904	FLHpIYV.exe
328	csYpECk.exe
2988	dsYAgSg.exe
656	VnpoUhJ.exe
332	PXDjCpb.exe
1740	JYVaKrM.exe
2284	JsZEakq.exe
2016	XMdFqzu.exe
600	PwxOkwk.exe
304	oEGgbJM.exe
984	eNsKYsW.exe
1948	DPjmXxa.exe
112	cbpFDsS.exe
1744	ArQMiiC.exe
1532	gKpfIUL.exe
2540	XZiJCme.exe
2772	DTgIlpT.exe
2424	SIEpfDd.exe
2896	ZYThbrD.exe
1672	DiybrOY.exe
1524	BsHcLeD.exe
2496	zYOnCad.exe
2500	ZHLNeJC.exe
2612	DrgnIcb.exe
2660	DvFDsSQ.exe
2664	jGpkdTh.exe
340	wRfUkNm.exe
2128	TprMYzv.exe
356	yyeAkZQ.exe

Loads dropped DLL 64 IoCs

pid	Process
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1620-1-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x000700000001418c-12.dat	upx
behavioral1/memory/2228-20-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/files/0x0007000000014183-19.dat	upx
behavioral1/memory/3052-30-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/2744-41-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x000700000001431b-42.dat	upx
behavioral1/memory/1620-43-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2800-28-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2600-27-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/files/0x0007000000014251-34.dat	upx
behavioral1/files/0x000d00000001342e-17.dat	upx
behavioral1/files/0x002a000000013a88-8.dat	upx
behavioral1/files/0x0016000000005586-47.dat	upx
behavioral1/memory/2548-69-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2328-77-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x0006000000014f57-89.dat	upx
behavioral1/files/0x0006000000015083-98.dat	upx
behavioral1/files/0x0006000000014c2d-87.dat	upx
behavioral1/files/0x00060000000158d9-142.dat	upx
behavioral1/files/0x0006000000015cb1-159.dat	upx
behavioral1/files/0x0006000000015d0a-184.dat	upx
behavioral1/files/0x0006000000015cee-178.dat	upx
behavioral1/files/0x0006000000015d21-189.dat	upx
behavioral1/files/0x0006000000015cd2-164.dat	upx
behavioral1/files/0x0006000000015cf8-182.dat	upx
behavioral1/files/0x0006000000015ce3-170.dat	upx
behavioral1/files/0x0006000000015cc5-162.dat	upx
behavioral1/files/0x0006000000015c9a-148.dat	upx
behavioral1/files/0x000600000001565a-135.dat	upx
behavioral1/files/0x00060000000150d9-133.dat	upx
behavioral1/files/0x0006000000015b50-127.dat	upx
behavioral1/files/0x0006000000015ca8-152.dat	upx
behavioral1/files/0x000600000001507a-96.dat	upx
behavioral1/files/0x0006000000015b85-139.dat	upx
behavioral1/files/0x0006000000015ae3-126.dat	upx
behavioral1/files/0x0006000000015662-116.dat	upx
behavioral1/files/0x00060000000153ee-109.dat	upx
behavioral1/memory/2560-93-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2892-84-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/1844-81-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2448-80-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/files/0x0006000000014b1c-74.dat	upx
behavioral1/files/0x0006000000014bd7-72.dat	upx
behavioral1/files/0x0029000000013adc-71.dat	upx
behavioral1/memory/2392-53-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/files/0x00090000000143fb-56.dat	upx
behavioral1/memory/2228-1068-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/1620-1066-0x000000013FE90000-0x0000000140282000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gLQRidL.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\HeRSjlf.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\tsGsXYd.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\DPZZgYU.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\DsFbZms.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\qGwQeSt.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\vpjjMJj.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\itFEGSd.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\MGKaZMh.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\vzjhcKt.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\fIMMhBu.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\oyFhebx.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\iKuAwYt.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\rLDTREZ.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\dnAzEZY.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\TcwZTNT.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\gJzPyfH.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\QVzAIGe.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\XmdXJMd.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\vKanbjp.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\RPeIGIi.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\QASNPhS.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\RbsMEmE.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\aCkIhXe.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\UvgfBkM.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\UNkPPVX.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\Pbyocyh.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\eXwSQBM.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\WRbbovf.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\vmmdNhn.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\bBTLqIC.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\znsOIAW.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\wRBHCXM.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\XHJpUKN.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\uOxClSi.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\dwUSBJS.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\mjmDQBI.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\qIUKBhS.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\mqONDiQ.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\TsxfNNA.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\tBRezTZ.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\aeHeVJs.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\zYOnCad.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\UzDMBAi.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\ZojkOEK.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\fmGAybg.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\VONXZLG.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\XyUfuFT.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\ypEsmEj.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\gwRVxjG.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\uYNgKLC.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\OlxOmvq.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\yyeAkZQ.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\fgqxWHS.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\yWtdtGW.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\aotIUVf.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\avbngzj.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\JyAcRns.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\xvQmWPJ.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\tdrJAQf.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\cUEgfOH.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\EFWkBBv.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\mGpTcIb.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
File created	C:\Windows\System\QsFcEEF.exe	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2568	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
Token: SeDebugPrivilege	2568	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2568	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	29
PID 1620 wrote to memory of 2568	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	29
PID 1620 wrote to memory of 2568	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	29
PID 1620 wrote to memory of 3052	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	30
PID 1620 wrote to memory of 3052	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	30
PID 1620 wrote to memory of 3052	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2228	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	31
PID 1620 wrote to memory of 2228	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	31
PID 1620 wrote to memory of 2228	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	31
PID 1620 wrote to memory of 2600	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	32
PID 1620 wrote to memory of 2600	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	32
PID 1620 wrote to memory of 2600	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	32
PID 1620 wrote to memory of 2800	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	33
PID 1620 wrote to memory of 2800	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	33
PID 1620 wrote to memory of 2800	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	33
PID 1620 wrote to memory of 2744	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	34
PID 1620 wrote to memory of 2744	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	34
PID 1620 wrote to memory of 2744	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	34
PID 1620 wrote to memory of 2392	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	35
PID 1620 wrote to memory of 2392	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	35
PID 1620 wrote to memory of 2392	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	35
PID 1620 wrote to memory of 2548	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	36
PID 1620 wrote to memory of 2548	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	36
PID 1620 wrote to memory of 2548	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	36
PID 1620 wrote to memory of 2328	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	37
PID 1620 wrote to memory of 2328	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	37
PID 1620 wrote to memory of 2328	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	37
PID 1620 wrote to memory of 2892	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	38
PID 1620 wrote to memory of 2892	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	38
PID 1620 wrote to memory of 2892	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	38
PID 1620 wrote to memory of 1844	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	39
PID 1620 wrote to memory of 1844	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	39
PID 1620 wrote to memory of 1844	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	39
PID 1620 wrote to memory of 2448	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	40
PID 1620 wrote to memory of 2448	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	40
PID 1620 wrote to memory of 2448	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	40
PID 1620 wrote to memory of 2560	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	41
PID 1620 wrote to memory of 2560	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	41
PID 1620 wrote to memory of 2560	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	41
PID 1620 wrote to memory of 1568	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	42
PID 1620 wrote to memory of 1568	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	42
PID 1620 wrote to memory of 1568	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	42
PID 1620 wrote to memory of 1960	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	43
PID 1620 wrote to memory of 1960	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	43
PID 1620 wrote to memory of 1960	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	43
PID 1620 wrote to memory of 2156	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	44
PID 1620 wrote to memory of 2156	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	44
PID 1620 wrote to memory of 2156	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	44
PID 1620 wrote to memory of 1676	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	45
PID 1620 wrote to memory of 1676	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	45
PID 1620 wrote to memory of 1676	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	45
PID 1620 wrote to memory of 1584	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	46
PID 1620 wrote to memory of 1584	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	46
PID 1620 wrote to memory of 1584	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	46
PID 1620 wrote to memory of 1452	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	47
PID 1620 wrote to memory of 1452	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	47
PID 1620 wrote to memory of 1452	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	47
PID 1620 wrote to memory of 2096	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	48
PID 1620 wrote to memory of 2096	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	48
PID 1620 wrote to memory of 2096	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	48
PID 1620 wrote to memory of 844	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	49
PID 1620 wrote to memory of 844	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	49
PID 1620 wrote to memory of 844	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	49
PID 1620 wrote to memory of 1320	1620	071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\071245b6aa0d079c9b239d9aff2ec7e6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Windows\System\GXQYOXI.exe
  C:\Windows\System\GXQYOXI.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\xRjyqAd.exe
  C:\Windows\System\xRjyqAd.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\GeZayTr.exe
  C:\Windows\System\GeZayTr.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\jdOvlTE.exe
  C:\Windows\System\jdOvlTE.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\ypEsmEj.exe
  C:\Windows\System\ypEsmEj.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\EKypgSq.exe
  C:\Windows\System\EKypgSq.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\wudkRMi.exe
  C:\Windows\System\wudkRMi.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\GUcRBtI.exe
  C:\Windows\System\GUcRBtI.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\oyfTIQs.exe
  C:\Windows\System\oyfTIQs.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\bmZSOWo.exe
  C:\Windows\System\bmZSOWo.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\cZYOlUv.exe
  C:\Windows\System\cZYOlUv.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\aZmVuCT.exe
  C:\Windows\System\aZmVuCT.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\iVmdJQz.exe
  C:\Windows\System\iVmdJQz.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\XHJpUKN.exe
  C:\Windows\System\XHJpUKN.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\jiYmUPG.exe
  C:\Windows\System\jiYmUPG.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\pahgJAX.exe
  C:\Windows\System\pahgJAX.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\HQoEsQl.exe
  C:\Windows\System\HQoEsQl.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\iuyDXNH.exe
  C:\Windows\System\iuyDXNH.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\VtcZiSs.exe
  C:\Windows\System\VtcZiSs.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\blAsApN.exe
  C:\Windows\System\blAsApN.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\RouffFn.exe
  C:\Windows\System\RouffFn.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\QCSYrHi.exe
  C:\Windows\System\QCSYrHi.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\PtfDloM.exe
  C:\Windows\System\PtfDloM.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\gyqVoFx.exe
  C:\Windows\System\gyqVoFx.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\YJIoNiS.exe
  C:\Windows\System\YJIoNiS.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\gwRVxjG.exe
  C:\Windows\System\gwRVxjG.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\JisaSaJ.exe
  C:\Windows\System\JisaSaJ.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\BnxLfiB.exe
  C:\Windows\System\BnxLfiB.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\yUUWqdq.exe
  C:\Windows\System\yUUWqdq.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\SkNaUUp.exe
  C:\Windows\System\SkNaUUp.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\HuXXdRV.exe
  C:\Windows\System\HuXXdRV.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\tOwRdAZ.exe
  C:\Windows\System\tOwRdAZ.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ywTZXzx.exe
  C:\Windows\System\ywTZXzx.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\lsLdMpf.exe
  C:\Windows\System\lsLdMpf.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\lIWRkaG.exe
  C:\Windows\System\lIWRkaG.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\FLHpIYV.exe
  C:\Windows\System\FLHpIYV.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\csYpECk.exe
  C:\Windows\System\csYpECk.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\VnpoUhJ.exe
  C:\Windows\System\VnpoUhJ.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\dsYAgSg.exe
  C:\Windows\System\dsYAgSg.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\PXDjCpb.exe
  C:\Windows\System\PXDjCpb.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\JYVaKrM.exe
  C:\Windows\System\JYVaKrM.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\JsZEakq.exe
  C:\Windows\System\JsZEakq.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\XMdFqzu.exe
  C:\Windows\System\XMdFqzu.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\PwxOkwk.exe
  C:\Windows\System\PwxOkwk.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\oEGgbJM.exe
  C:\Windows\System\oEGgbJM.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\eNsKYsW.exe
  C:\Windows\System\eNsKYsW.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\DPjmXxa.exe
  C:\Windows\System\DPjmXxa.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\DTgIlpT.exe
  C:\Windows\System\DTgIlpT.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\cbpFDsS.exe
  C:\Windows\System\cbpFDsS.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\ZYThbrD.exe
  C:\Windows\System\ZYThbrD.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\ArQMiiC.exe
  C:\Windows\System\ArQMiiC.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\DiybrOY.exe
  C:\Windows\System\DiybrOY.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\gKpfIUL.exe
  C:\Windows\System\gKpfIUL.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\BsHcLeD.exe
  C:\Windows\System\BsHcLeD.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\XZiJCme.exe
  C:\Windows\System\XZiJCme.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\zYOnCad.exe
  C:\Windows\System\zYOnCad.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\SIEpfDd.exe
  C:\Windows\System\SIEpfDd.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\ZHLNeJC.exe
  C:\Windows\System\ZHLNeJC.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\DrgnIcb.exe
  C:\Windows\System\DrgnIcb.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\DvFDsSQ.exe
  C:\Windows\System\DvFDsSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\jGpkdTh.exe
  C:\Windows\System\jGpkdTh.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\wRfUkNm.exe
  C:\Windows\System\wRfUkNm.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\TprMYzv.exe
  C:\Windows\System\TprMYzv.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\yyeAkZQ.exe
  C:\Windows\System\yyeAkZQ.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\puvsuEB.exe
  C:\Windows\System\puvsuEB.exe
  2⤵
  PID:1180
- C:\Windows\System\UzDMBAi.exe
  C:\Windows\System\UzDMBAi.exe
  2⤵
  PID:1540
- C:\Windows\System\jmTclfy.exe
  C:\Windows\System\jmTclfy.exe
  2⤵
  PID:2036
- C:\Windows\System\urjVSst.exe
  C:\Windows\System\urjVSst.exe
  2⤵
  PID:1348
- C:\Windows\System\wGbMlHs.exe
  C:\Windows\System\wGbMlHs.exe
  2⤵
  PID:840
- C:\Windows\System\AtwlfUs.exe
  C:\Windows\System\AtwlfUs.exe
  2⤵
  PID:2880
- C:\Windows\System\bKaWBPd.exe
  C:\Windows\System\bKaWBPd.exe
  2⤵
  PID:2180
- C:\Windows\System\JwQMUCo.exe
  C:\Windows\System\JwQMUCo.exe
  2⤵
  PID:680
- C:\Windows\System\qFDTsvy.exe
  C:\Windows\System\qFDTsvy.exe
  2⤵
  PID:2620
- C:\Windows\System\nWmMhmu.exe
  C:\Windows\System\nWmMhmu.exe
  2⤵
  PID:2720
- C:\Windows\System\fzpXgPt.exe
  C:\Windows\System\fzpXgPt.exe
  2⤵
  PID:1476
- C:\Windows\System\JjdvQtP.exe
  C:\Windows\System\JjdvQtP.exe
  2⤵
  PID:1796
- C:\Windows\System\ZTKgMNu.exe
  C:\Windows\System\ZTKgMNu.exe
  2⤵
  PID:1912
- C:\Windows\System\pWjtvCc.exe
  C:\Windows\System\pWjtvCc.exe
  2⤵
  PID:1292
- C:\Windows\System\LcQTPmA.exe
  C:\Windows\System\LcQTPmA.exe
  2⤵
  PID:2996
- C:\Windows\System\AthiVWg.exe
  C:\Windows\System\AthiVWg.exe
  2⤵
  PID:884
- C:\Windows\System\hJXGHuO.exe
  C:\Windows\System\hJXGHuO.exe
  2⤵
  PID:2932
- C:\Windows\System\hdeyvRR.exe
  C:\Windows\System\hdeyvRR.exe
  2⤵
  PID:284
- C:\Windows\System\oYaSzzr.exe
  C:\Windows\System\oYaSzzr.exe
  2⤵
  PID:2964
- C:\Windows\System\bbTymBl.exe
  C:\Windows\System\bbTymBl.exe
  2⤵
  PID:1640
- C:\Windows\System\aJRXtCN.exe
  C:\Windows\System\aJRXtCN.exe
  2⤵
  PID:1972
- C:\Windows\System\HexAWWe.exe
  C:\Windows\System\HexAWWe.exe
  2⤵
  PID:1656
- C:\Windows\System\ywKpSoc.exe
  C:\Windows\System\ywKpSoc.exe
  2⤵
  PID:1884
- C:\Windows\System\uijSrKe.exe
  C:\Windows\System\uijSrKe.exe
  2⤵
  PID:3000
- C:\Windows\System\uYNgKLC.exe
  C:\Windows\System\uYNgKLC.exe
  2⤵
  PID:2580
- C:\Windows\System\kinVFvi.exe
  C:\Windows\System\kinVFvi.exe
  2⤵
  PID:1500
- C:\Windows\System\ZOHOvee.exe
  C:\Windows\System\ZOHOvee.exe
  2⤵
  PID:2596
- C:\Windows\System\RNSBmjj.exe
  C:\Windows\System\RNSBmjj.exe
  2⤵
  PID:2920
- C:\Windows\System\RfZJlWr.exe
  C:\Windows\System\RfZJlWr.exe
  2⤵
  PID:2692
- C:\Windows\System\cWMTnZG.exe
  C:\Windows\System\cWMTnZG.exe
  2⤵
  PID:2512
- C:\Windows\System\KaPDoZA.exe
  C:\Windows\System\KaPDoZA.exe
  2⤵
  PID:2684
- C:\Windows\System\WxcrtkW.exe
  C:\Windows\System\WxcrtkW.exe
  2⤵
  PID:1792
- C:\Windows\System\WpJoksh.exe
  C:\Windows\System\WpJoksh.exe
  2⤵
  PID:3004
- C:\Windows\System\xGuUCqR.exe
  C:\Windows\System\xGuUCqR.exe
  2⤵
  PID:2188
- C:\Windows\System\EogPVTG.exe
  C:\Windows\System\EogPVTG.exe
  2⤵
  PID:1980
- C:\Windows\System\dcXqGRu.exe
  C:\Windows\System\dcXqGRu.exe
  2⤵
  PID:2344
- C:\Windows\System\ebxjMhw.exe
  C:\Windows\System\ebxjMhw.exe
  2⤵
  PID:2992
- C:\Windows\System\SoSVRnn.exe
  C:\Windows\System\SoSVRnn.exe
  2⤵
  PID:556
- C:\Windows\System\SkuIAPQ.exe
  C:\Windows\System\SkuIAPQ.exe
  2⤵
  PID:2616
- C:\Windows\System\vOOUKzH.exe
  C:\Windows\System\vOOUKzH.exe
  2⤵
  PID:2708
- C:\Windows\System\BlmUCgc.exe
  C:\Windows\System\BlmUCgc.exe
  2⤵
  PID:2592
- C:\Windows\System\QqjxQDL.exe
  C:\Windows\System\QqjxQDL.exe
  2⤵
  PID:1856
- C:\Windows\System\eUYFFIn.exe
  C:\Windows\System\eUYFFIn.exe
  2⤵
  PID:3088
- C:\Windows\System\MDtVKlF.exe
  C:\Windows\System\MDtVKlF.exe
  2⤵
  PID:3108
- C:\Windows\System\ZyuAMzY.exe
  C:\Windows\System\ZyuAMzY.exe
  2⤵
  PID:3128
- C:\Windows\System\utrYqhm.exe
  C:\Windows\System\utrYqhm.exe
  2⤵
  PID:3144
- C:\Windows\System\ThaLDoA.exe
  C:\Windows\System\ThaLDoA.exe
  2⤵
  PID:3160
- C:\Windows\System\hwbxGia.exe
  C:\Windows\System\hwbxGia.exe
  2⤵
  PID:3176
- C:\Windows\System\iPvbUuU.exe
  C:\Windows\System\iPvbUuU.exe
  2⤵
  PID:3192
- C:\Windows\System\pzTFJQe.exe
  C:\Windows\System\pzTFJQe.exe
  2⤵
  PID:3208
- C:\Windows\System\RORlxdW.exe
  C:\Windows\System\RORlxdW.exe
  2⤵
  PID:3224
- C:\Windows\System\AIYpjvE.exe
  C:\Windows\System\AIYpjvE.exe
  2⤵
  PID:3252
- C:\Windows\System\kKyFqwo.exe
  C:\Windows\System\kKyFqwo.exe
  2⤵
  PID:3268
- C:\Windows\System\lIoPTVq.exe
  C:\Windows\System\lIoPTVq.exe
  2⤵
  PID:3284
- C:\Windows\System\sxBgWoE.exe
  C:\Windows\System\sxBgWoE.exe
  2⤵
  PID:3328
- C:\Windows\System\XtHMLDL.exe
  C:\Windows\System\XtHMLDL.exe
  2⤵
  PID:3344
- C:\Windows\System\SQqrzGG.exe
  C:\Windows\System\SQqrzGG.exe
  2⤵
  PID:3372
- C:\Windows\System\ZojkOEK.exe
  C:\Windows\System\ZojkOEK.exe
  2⤵
  PID:3404
- C:\Windows\System\vlMttDu.exe
  C:\Windows\System\vlMttDu.exe
  2⤵
  PID:3436
- C:\Windows\System\dJfjztv.exe
  C:\Windows\System\dJfjztv.exe
  2⤵
  PID:3452
- C:\Windows\System\zxHFuxb.exe
  C:\Windows\System\zxHFuxb.exe
  2⤵
  PID:3468
- C:\Windows\System\kIMLjJF.exe
  C:\Windows\System\kIMLjJF.exe
  2⤵
  PID:3580
- C:\Windows\System\KhuEAXm.exe
  C:\Windows\System\KhuEAXm.exe
  2⤵
  PID:3596
- C:\Windows\System\DPZZgYU.exe
  C:\Windows\System\DPZZgYU.exe
  2⤵
  PID:3616
- C:\Windows\System\VCDWRwN.exe
  C:\Windows\System\VCDWRwN.exe
  2⤵
  PID:3640
- C:\Windows\System\WVpTSTI.exe
  C:\Windows\System\WVpTSTI.exe
  2⤵
  PID:3656
- C:\Windows\System\HuxysZf.exe
  C:\Windows\System\HuxysZf.exe
  2⤵
  PID:3672
- C:\Windows\System\uOxClSi.exe
  C:\Windows\System\uOxClSi.exe
  2⤵
  PID:3708
- C:\Windows\System\tHNhxkQ.exe
  C:\Windows\System\tHNhxkQ.exe
  2⤵
  PID:3728
- C:\Windows\System\NdIBtiq.exe
  C:\Windows\System\NdIBtiq.exe
  2⤵
  PID:3752
- C:\Windows\System\jXkLBGb.exe
  C:\Windows\System\jXkLBGb.exe
  2⤵
  PID:3772
- C:\Windows\System\SjPtHtl.exe
  C:\Windows\System\SjPtHtl.exe
  2⤵
  PID:3788
- C:\Windows\System\cXNHAGz.exe
  C:\Windows\System\cXNHAGz.exe
  2⤵
  PID:3808
- C:\Windows\System\VryTkcR.exe
  C:\Windows\System\VryTkcR.exe
  2⤵
  PID:3828
- C:\Windows\System\lxumMYg.exe
  C:\Windows\System\lxumMYg.exe
  2⤵
  PID:3844
- C:\Windows\System\RPeIGIi.exe
  C:\Windows\System\RPeIGIi.exe
  2⤵
  PID:3864
- C:\Windows\System\sdyEfof.exe
  C:\Windows\System\sdyEfof.exe
  2⤵
  PID:3888
- C:\Windows\System\PCPCwqm.exe
  C:\Windows\System\PCPCwqm.exe
  2⤵
  PID:3916
- C:\Windows\System\rNJThhV.exe
  C:\Windows\System\rNJThhV.exe
  2⤵
  PID:3936
- C:\Windows\System\tIVxbOO.exe
  C:\Windows\System\tIVxbOO.exe
  2⤵
  PID:3952
- C:\Windows\System\wYUTRUD.exe
  C:\Windows\System\wYUTRUD.exe
  2⤵
  PID:3972
- C:\Windows\System\OQtLMrp.exe
  C:\Windows\System\OQtLMrp.exe
  2⤵
  PID:3988
- C:\Windows\System\avbngzj.exe
  C:\Windows\System\avbngzj.exe
  2⤵
  PID:4012
- C:\Windows\System\YonMTCl.exe
  C:\Windows\System\YonMTCl.exe
  2⤵
  PID:4036
- C:\Windows\System\mDQhAKI.exe
  C:\Windows\System\mDQhAKI.exe
  2⤵
  PID:4052
- C:\Windows\System\budGkKl.exe
  C:\Windows\System\budGkKl.exe
  2⤵
  PID:4072
- C:\Windows\System\iUOSyNB.exe
  C:\Windows\System\iUOSyNB.exe
  2⤵
  PID:4092
- C:\Windows\System\HjPIOMB.exe
  C:\Windows\System\HjPIOMB.exe
  2⤵
  PID:880
- C:\Windows\System\EZsMWgJ.exe
  C:\Windows\System\EZsMWgJ.exe
  2⤵
  PID:3100
- C:\Windows\System\DsFbZms.exe
  C:\Windows\System\DsFbZms.exe
  2⤵
  PID:3172
- C:\Windows\System\YqSigrA.exe
  C:\Windows\System\YqSigrA.exe
  2⤵
  PID:2868
- C:\Windows\System\oZoDYIY.exe
  C:\Windows\System\oZoDYIY.exe
  2⤵
  PID:3236
- C:\Windows\System\bqeHkYl.exe
  C:\Windows\System\bqeHkYl.exe
  2⤵
  PID:2004
- C:\Windows\System\yyNvZvy.exe
  C:\Windows\System\yyNvZvy.exe
  2⤵
  PID:3380
- C:\Windows\System\VlRKaxX.exe
  C:\Windows\System\VlRKaxX.exe
  2⤵
  PID:3388
- C:\Windows\System\GoIidqh.exe
  C:\Windows\System\GoIidqh.exe
  2⤵
  PID:2200
- C:\Windows\System\uNZGQVB.exe
  C:\Windows\System\uNZGQVB.exe
  2⤵
  PID:3444
- C:\Windows\System\EYpXlCb.exe
  C:\Windows\System\EYpXlCb.exe
  2⤵
  PID:3488
- C:\Windows\System\RsmBXSI.exe
  C:\Windows\System\RsmBXSI.exe
  2⤵
  PID:3508
- C:\Windows\System\xfoXbrr.exe
  C:\Windows\System\xfoXbrr.exe
  2⤵
  PID:3520
- C:\Windows\System\mrtSote.exe
  C:\Windows\System\mrtSote.exe
  2⤵
  PID:2052
- C:\Windows\System\vIhgQyJ.exe
  C:\Windows\System\vIhgQyJ.exe
  2⤵
  PID:848
- C:\Windows\System\ATVnPUA.exe
  C:\Windows\System\ATVnPUA.exe
  2⤵
  PID:2956
- C:\Windows\System\SqOlUfi.exe
  C:\Windows\System\SqOlUfi.exe
  2⤵
  PID:3544
- C:\Windows\System\KDUtRhH.exe
  C:\Windows\System\KDUtRhH.exe
  2⤵
  PID:3548
- C:\Windows\System\WVRPYQB.exe
  C:\Windows\System\WVRPYQB.exe
  2⤵
  PID:320
- C:\Windows\System\bwPipYN.exe
  C:\Windows\System\bwPipYN.exe
  2⤵
  PID:3564
- C:\Windows\System\iYyofyf.exe
  C:\Windows\System\iYyofyf.exe
  2⤵
  PID:1776
- C:\Windows\System\VNCMxDK.exe
  C:\Windows\System\VNCMxDK.exe
  2⤵
  PID:1992
- C:\Windows\System\TeLGqzD.exe
  C:\Windows\System\TeLGqzD.exe
  2⤵
  PID:3412
- C:\Windows\System\rMGzDDR.exe
  C:\Windows\System\rMGzDDR.exe
  2⤵
  PID:1020
- C:\Windows\System\lpNyINP.exe
  C:\Windows\System\lpNyINP.exe
  2⤵
  PID:2132
- C:\Windows\System\qlrsIYU.exe
  C:\Windows\System\qlrsIYU.exe
  2⤵
  PID:2588
- C:\Windows\System\cbSKsji.exe
  C:\Windows\System\cbSKsji.exe
  2⤵
  PID:2440
- C:\Windows\System\EFWkBBv.exe
  C:\Windows\System\EFWkBBv.exe
  2⤵
  PID:1188
- C:\Windows\System\JbIaRXA.exe
  C:\Windows\System\JbIaRXA.exe
  2⤵
  PID:2148
- C:\Windows\System\rNKFSPO.exe
  C:\Windows\System\rNKFSPO.exe
  2⤵
  PID:1852
- C:\Windows\System\pODhdRF.exe
  C:\Windows\System\pODhdRF.exe
  2⤵
  PID:3080
- C:\Windows\System\mPSWCzS.exe
  C:\Windows\System\mPSWCzS.exe
  2⤵
  PID:3124
- C:\Windows\System\WRbbovf.exe
  C:\Windows\System\WRbbovf.exe
  2⤵
  PID:3216
- C:\Windows\System\vyiwiNj.exe
  C:\Windows\System\vyiwiNj.exe
  2⤵
  PID:3292
- C:\Windows\System\fYHxLaW.exe
  C:\Windows\System\fYHxLaW.exe
  2⤵
  PID:3308
- C:\Windows\System\FflEyzT.exe
  C:\Windows\System\FflEyzT.exe
  2⤵
  PID:3324
- C:\Windows\System\vmmdNhn.exe
  C:\Windows\System\vmmdNhn.exe
  2⤵
  PID:3364
- C:\Windows\System\iEgOrgK.exe
  C:\Windows\System\iEgOrgK.exe
  2⤵
  PID:3608
- C:\Windows\System\llqAwQn.exe
  C:\Windows\System\llqAwQn.exe
  2⤵
  PID:3680
- C:\Windows\System\ODbaPfE.exe
  C:\Windows\System\ODbaPfE.exe
  2⤵
  PID:3700
- C:\Windows\System\fczidaN.exe
  C:\Windows\System\fczidaN.exe
  2⤵
  PID:2732
- C:\Windows\System\qZdIKtY.exe
  C:\Windows\System\qZdIKtY.exe
  2⤵
  PID:2452
- C:\Windows\System\CosgTzA.exe
  C:\Windows\System\CosgTzA.exe
  2⤵
  PID:3432
- C:\Windows\System\CqndAtl.exe
  C:\Windows\System\CqndAtl.exe
  2⤵
  PID:1648
- C:\Windows\System\WARNfYj.exe
  C:\Windows\System\WARNfYj.exe
  2⤵
  PID:2308
- C:\Windows\System\pZLDNDY.exe
  C:\Windows\System\pZLDNDY.exe
  2⤵
  PID:3588
- C:\Windows\System\PcxARJw.exe
  C:\Windows\System\PcxARJw.exe
  2⤵
  PID:3664
- C:\Windows\System\LroDGJR.exe
  C:\Windows\System\LroDGJR.exe
  2⤵
  PID:3736
- C:\Windows\System\KiSbKhA.exe
  C:\Windows\System\KiSbKhA.exe
  2⤵
  PID:3720
- C:\Windows\System\vvkGZFU.exe
  C:\Windows\System\vvkGZFU.exe
  2⤵
  PID:3760
- C:\Windows\System\OopIEIi.exe
  C:\Windows\System\OopIEIi.exe
  2⤵
  PID:2972
- C:\Windows\System\SzitVvK.exe
  C:\Windows\System\SzitVvK.exe
  2⤵
  PID:3796
- C:\Windows\System\VuIFKna.exe
  C:\Windows\System\VuIFKna.exe
  2⤵
  PID:3824
- C:\Windows\System\QASNPhS.exe
  C:\Windows\System\QASNPhS.exe
  2⤵
  PID:3852
- C:\Windows\System\ONQBYRc.exe
  C:\Windows\System\ONQBYRc.exe
  2⤵
  PID:3872
- C:\Windows\System\wrwelkH.exe
  C:\Windows\System\wrwelkH.exe
  2⤵
  PID:3896
- C:\Windows\System\JrZBRLi.exe
  C:\Windows\System\JrZBRLi.exe
  2⤵
  PID:620
- C:\Windows\System\kOzsOmc.exe
  C:\Windows\System\kOzsOmc.exe
  2⤵
  PID:1608
- C:\Windows\System\WfhYVTi.exe
  C:\Windows\System\WfhYVTi.exe
  2⤵
  PID:2336
- C:\Windows\System\umfyrwN.exe
  C:\Windows\System\umfyrwN.exe
  2⤵
  PID:3928
- C:\Windows\System\KyaMLPB.exe
  C:\Windows\System\KyaMLPB.exe
  2⤵
  PID:3980
- C:\Windows\System\wsWrgUZ.exe
  C:\Windows\System\wsWrgUZ.exe
  2⤵
  PID:4004
- C:\Windows\System\MLTIcBk.exe
  C:\Windows\System\MLTIcBk.exe
  2⤵
  PID:4020
- C:\Windows\System\OPDidSU.exe
  C:\Windows\System\OPDidSU.exe
  2⤵
  PID:4028
- C:\Windows\System\rLDTREZ.exe
  C:\Windows\System\rLDTREZ.exe
  2⤵
  PID:108
- C:\Windows\System\LwtKwKg.exe
  C:\Windows\System\LwtKwKg.exe
  2⤵
  PID:4068
- C:\Windows\System\hzniePw.exe
  C:\Windows\System\hzniePw.exe
  2⤵
  PID:4064
- C:\Windows\System\JyAcRns.exe
  C:\Windows\System\JyAcRns.exe
  2⤵
  PID:1928
- C:\Windows\System\ZewbpWG.exe
  C:\Windows\System\ZewbpWG.exe
  2⤵
  PID:3096
- C:\Windows\System\vdLFUdp.exe
  C:\Windows\System\vdLFUdp.exe
  2⤵
  PID:3048
- C:\Windows\System\dwUSBJS.exe
  C:\Windows\System\dwUSBJS.exe
  2⤵
  PID:2256
- C:\Windows\System\pyUUOiB.exe
  C:\Windows\System\pyUUOiB.exe
  2⤵
  PID:3260
- C:\Windows\System\xvQmWPJ.exe
  C:\Windows\System\xvQmWPJ.exe
  2⤵
  PID:2716
- C:\Windows\System\TbCUzqk.exe
  C:\Windows\System\TbCUzqk.exe
  2⤵
  PID:3416
- C:\Windows\System\uXHoIjc.exe
  C:\Windows\System\uXHoIjc.exe
  2⤵
  PID:3704
- C:\Windows\System\NcgxNff.exe
  C:\Windows\System\NcgxNff.exe
  2⤵
  PID:1708
- C:\Windows\System\qzuKmIj.exe
  C:\Windows\System\qzuKmIj.exe
  2⤵
  PID:3784
- C:\Windows\System\VONXZLG.exe
  C:\Windows\System\VONXZLG.exe
  2⤵
  PID:3884
- C:\Windows\System\pitzJIz.exe
  C:\Windows\System\pitzJIz.exe
  2⤵
  PID:3932
- C:\Windows\System\zPaEkhk.exe
  C:\Windows\System\zPaEkhk.exe
  2⤵
  PID:692
- C:\Windows\System\fBtMSZV.exe
  C:\Windows\System\fBtMSZV.exe
  2⤵
  PID:4060
- C:\Windows\System\rgUGeOC.exe
  C:\Windows\System\rgUGeOC.exe
  2⤵
  PID:2752
- C:\Windows\System\GXeiYjF.exe
  C:\Windows\System\GXeiYjF.exe
  2⤵
  PID:3204
- C:\Windows\System\noZMqju.exe
  C:\Windows\System\noZMqju.exe
  2⤵
  PID:3276
- C:\Windows\System\pklOOMI.exe
  C:\Windows\System\pklOOMI.exe
  2⤵
  PID:3336
- C:\Windows\System\fnmJbGC.exe
  C:\Windows\System\fnmJbGC.exe
  2⤵
  PID:1632
- C:\Windows\System\weSDtVG.exe
  C:\Windows\System\weSDtVG.exe
  2⤵
  PID:3392
- C:\Windows\System\ASIqAWO.exe
  C:\Windows\System\ASIqAWO.exe
  2⤵
  PID:2668
- C:\Windows\System\pSfMeGO.exe
  C:\Windows\System\pSfMeGO.exe
  2⤵
  PID:3476
- C:\Windows\System\qGwQeSt.exe
  C:\Windows\System\qGwQeSt.exe
  2⤵
  PID:3480
- C:\Windows\System\RWdUjck.exe
  C:\Windows\System\RWdUjck.exe
  2⤵
  PID:3504
- C:\Windows\System\hVSzOAl.exe
  C:\Windows\System\hVSzOAl.exe
  2⤵
  PID:2044
- C:\Windows\System\XURuasX.exe
  C:\Windows\System\XURuasX.exe
  2⤵
  PID:912
- C:\Windows\System\FhSCOIm.exe
  C:\Windows\System\FhSCOIm.exe
  2⤵
  PID:2196
- C:\Windows\System\fjszLIs.exe
  C:\Windows\System\fjszLIs.exe
  2⤵
  PID:2140
- C:\Windows\System\RbsMEmE.exe
  C:\Windows\System\RbsMEmE.exe
  2⤵
  PID:2884
- C:\Windows\System\rOrbOYs.exe
  C:\Windows\System\rOrbOYs.exe
  2⤵
  PID:3116
- C:\Windows\System\cHfloRf.exe
  C:\Windows\System\cHfloRf.exe
  2⤵
  PID:3652
- C:\Windows\System\MtSewpR.exe
  C:\Windows\System\MtSewpR.exe
  2⤵
  PID:2204
- C:\Windows\System\GlpMMCG.exe
  C:\Windows\System\GlpMMCG.exe
  2⤵
  PID:2608
- C:\Windows\System\mtiHYYl.exe
  C:\Windows\System\mtiHYYl.exe
  2⤵
  PID:3060
- C:\Windows\System\kwEReCL.exe
  C:\Windows\System\kwEReCL.exe
  2⤵
  PID:3032
- C:\Windows\System\TsNlIYZ.exe
  C:\Windows\System\TsNlIYZ.exe
  2⤵
  PID:3076
- C:\Windows\System\qDRgYcy.exe
  C:\Windows\System\qDRgYcy.exe
  2⤵
  PID:3300
- C:\Windows\System\xpkxKRA.exe
  C:\Windows\System\xpkxKRA.exe
  2⤵
  PID:2376
- C:\Windows\System\nqtFeqM.exe
  C:\Windows\System\nqtFeqM.exe
  2⤵
  PID:3696
- C:\Windows\System\xyCNIOl.exe
  C:\Windows\System\xyCNIOl.exe
  2⤵
  PID:3724
- C:\Windows\System\TXMyxTh.exe
  C:\Windows\System\TXMyxTh.exe
  2⤵
  PID:2384
- C:\Windows\System\DkHcglf.exe
  C:\Windows\System\DkHcglf.exe
  2⤵
  PID:3912
- C:\Windows\System\nGJeulz.exe
  C:\Windows\System\nGJeulz.exe
  2⤵
  PID:3964
- C:\Windows\System\BNwHYoW.exe
  C:\Windows\System\BNwHYoW.exe
  2⤵
  PID:4044
- C:\Windows\System\EMaOHQW.exe
  C:\Windows\System\EMaOHQW.exe
  2⤵
  PID:1556
- C:\Windows\System\ZmxWKQp.exe
  C:\Windows\System\ZmxWKQp.exe
  2⤵
  PID:3460
- C:\Windows\System\OAlQaRs.exe
  C:\Windows\System\OAlQaRs.exe
  2⤵
  PID:3576
- C:\Windows\System\GMxyMCt.exe
  C:\Windows\System\GMxyMCt.exe
  2⤵
  PID:2728
- C:\Windows\System\qhOBOoh.exe
  C:\Windows\System\qhOBOoh.exe
  2⤵
  PID:3280
- C:\Windows\System\uukZlXg.exe
  C:\Windows\System\uukZlXg.exe
  2⤵
  PID:3880
- C:\Windows\System\oqKrPhq.exe
  C:\Windows\System\oqKrPhq.exe
  2⤵
  PID:3168
- C:\Windows\System\piLvWBq.exe
  C:\Windows\System\piLvWBq.exe
  2⤵
  PID:4112
- C:\Windows\System\FMVhQHv.exe
  C:\Windows\System\FMVhQHv.exe
  2⤵
  PID:4128
- C:\Windows\System\omBmjbn.exe
  C:\Windows\System\omBmjbn.exe
  2⤵
  PID:4148
- C:\Windows\System\oNrkGYw.exe
  C:\Windows\System\oNrkGYw.exe
  2⤵
  PID:4164
- C:\Windows\System\pLUHKJl.exe
  C:\Windows\System\pLUHKJl.exe
  2⤵
  PID:4180
- C:\Windows\System\lNPOaog.exe
  C:\Windows\System\lNPOaog.exe
  2⤵
  PID:4196
- C:\Windows\System\UGmYJsg.exe
  C:\Windows\System\UGmYJsg.exe
  2⤵
  PID:4212
- C:\Windows\System\tuvqsoc.exe
  C:\Windows\System\tuvqsoc.exe
  2⤵
  PID:4324
- C:\Windows\System\RmzBqlW.exe
  C:\Windows\System\RmzBqlW.exe
  2⤵
  PID:4456
- C:\Windows\System\TNKhCrA.exe
  C:\Windows\System\TNKhCrA.exe
  2⤵
  PID:4472
- C:\Windows\System\JArXyPb.exe
  C:\Windows\System\JArXyPb.exe
  2⤵
  PID:4488
- C:\Windows\System\vWnABzW.exe
  C:\Windows\System\vWnABzW.exe
  2⤵
  PID:4504
- C:\Windows\System\hiEeshd.exe
  C:\Windows\System\hiEeshd.exe
  2⤵
  PID:4520
- C:\Windows\System\FeOWEYB.exe
  C:\Windows\System\FeOWEYB.exe
  2⤵
  PID:4536
- C:\Windows\System\OidiscS.exe
  C:\Windows\System\OidiscS.exe
  2⤵
  PID:4552
- C:\Windows\System\WEDcokz.exe
  C:\Windows\System\WEDcokz.exe
  2⤵
  PID:4628
- C:\Windows\System\ZpFMRnq.exe
  C:\Windows\System\ZpFMRnq.exe
  2⤵
  PID:4644
- C:\Windows\System\pVSdtWm.exe
  C:\Windows\System\pVSdtWm.exe
  2⤵
  PID:4660
- C:\Windows\System\OTPLEBP.exe
  C:\Windows\System\OTPLEBP.exe
  2⤵
  PID:4676
- C:\Windows\System\hfsUIXX.exe
  C:\Windows\System\hfsUIXX.exe
  2⤵
  PID:4712
- C:\Windows\System\yldGQXe.exe
  C:\Windows\System\yldGQXe.exe
  2⤵
  PID:4728
- C:\Windows\System\YBRfYmQ.exe
  C:\Windows\System\YBRfYmQ.exe
  2⤵
  PID:4744
- C:\Windows\System\TrHRwKX.exe
  C:\Windows\System\TrHRwKX.exe
  2⤵
  PID:4760
- C:\Windows\System\bGxZuIf.exe
  C:\Windows\System\bGxZuIf.exe
  2⤵
  PID:4776
- C:\Windows\System\gVvQVjM.exe
  C:\Windows\System\gVvQVjM.exe
  2⤵
  PID:4792
- C:\Windows\System\iawpcmg.exe
  C:\Windows\System\iawpcmg.exe
  2⤵
  PID:4808
- C:\Windows\System\vpjjMJj.exe
  C:\Windows\System\vpjjMJj.exe
  2⤵
  PID:4824
- C:\Windows\System\drqxZkg.exe
  C:\Windows\System\drqxZkg.exe
  2⤵
  PID:4840
- C:\Windows\System\BOUrlID.exe
  C:\Windows\System\BOUrlID.exe
  2⤵
  PID:4856
- C:\Windows\System\GZXbvnH.exe
  C:\Windows\System\GZXbvnH.exe
  2⤵
  PID:4872
- C:\Windows\System\YxqUMhc.exe
  C:\Windows\System\YxqUMhc.exe
  2⤵
  PID:4888
- C:\Windows\System\zZNYayv.exe
  C:\Windows\System\zZNYayv.exe
  2⤵
  PID:4904
- C:\Windows\System\qEaSPrm.exe
  C:\Windows\System\qEaSPrm.exe
  2⤵
  PID:4920
- C:\Windows\System\ONrUZef.exe
  C:\Windows\System\ONrUZef.exe
  2⤵
  PID:4936
- C:\Windows\System\bUYElhO.exe
  C:\Windows\System\bUYElhO.exe
  2⤵
  PID:4952
- C:\Windows\System\zkTjncN.exe
  C:\Windows\System\zkTjncN.exe
  2⤵
  PID:4968
- C:\Windows\System\xCsbzPA.exe
  C:\Windows\System\xCsbzPA.exe
  2⤵
  PID:4984
- C:\Windows\System\mUiTPdJ.exe
  C:\Windows\System\mUiTPdJ.exe
  2⤵
  PID:5000
- C:\Windows\System\qIUKBhS.exe
  C:\Windows\System\qIUKBhS.exe
  2⤵
  PID:5016
- C:\Windows\System\ZktkSjw.exe
  C:\Windows\System\ZktkSjw.exe
  2⤵
  PID:5032
- C:\Windows\System\ctKPesS.exe
  C:\Windows\System\ctKPesS.exe
  2⤵
  PID:5048
- C:\Windows\System\ZhQVIxh.exe
  C:\Windows\System\ZhQVIxh.exe
  2⤵
  PID:5064
- C:\Windows\System\quTMtMf.exe
  C:\Windows\System\quTMtMf.exe
  2⤵
  PID:5080
- C:\Windows\System\qluggQk.exe
  C:\Windows\System\qluggQk.exe
  2⤵
  PID:3816
- C:\Windows\System\IuVxqzJ.exe
  C:\Windows\System\IuVxqzJ.exe
  2⤵
  PID:2636
- C:\Windows\System\tkJOXXK.exe
  C:\Windows\System\tkJOXXK.exe
  2⤵
  PID:4160
- C:\Windows\System\pWMYPkY.exe
  C:\Windows\System\pWMYPkY.exe
  2⤵
  PID:2736
- C:\Windows\System\xjUNwye.exe
  C:\Windows\System\xjUNwye.exe
  2⤵
  PID:2700
- C:\Windows\System\pqSgrUu.exe
  C:\Windows\System\pqSgrUu.exe
  2⤵
  PID:4240
- C:\Windows\System\qZNFgAr.exe
  C:\Windows\System\qZNFgAr.exe
  2⤵
  PID:4264
- C:\Windows\System\JHKxovJ.exe
  C:\Windows\System\JHKxovJ.exe
  2⤵
  PID:2084
- C:\Windows\System\tdrJAQf.exe
  C:\Windows\System\tdrJAQf.exe
  2⤵
  PID:3840
- C:\Windows\System\jpIHTLE.exe
  C:\Windows\System\jpIHTLE.exe
  2⤵
  PID:2304
- C:\Windows\System\TfpIrnL.exe
  C:\Windows\System\TfpIrnL.exe
  2⤵
  PID:2872
- C:\Windows\System\ZySDrfn.exe
  C:\Windows\System\ZySDrfn.exe
  2⤵
  PID:2644
- C:\Windows\System\UcbnQED.exe
  C:\Windows\System\UcbnQED.exe
  2⤵
  PID:3360
- C:\Windows\System\gkVQCST.exe
  C:\Windows\System\gkVQCST.exe
  2⤵
  PID:4008
- C:\Windows\System\WIBxenQ.exe
  C:\Windows\System\WIBxenQ.exe
  2⤵
  PID:3320
- C:\Windows\System\uucXzCr.exe
  C:\Windows\System\uucXzCr.exe
  2⤵
  PID:4144
- C:\Windows\System\akfdtYg.exe
  C:\Windows\System\akfdtYg.exe
  2⤵
  PID:4256
- C:\Windows\System\UtjVZOK.exe
  C:\Windows\System\UtjVZOK.exe
  2⤵
  PID:4300
- C:\Windows\System\EfifLzR.exe
  C:\Windows\System\EfifLzR.exe
  2⤵
  PID:4284
- C:\Windows\System\kNSnSDb.exe
  C:\Windows\System\kNSnSDb.exe
  2⤵
  PID:1612
- C:\Windows\System\mkNqkSI.exe
  C:\Windows\System\mkNqkSI.exe
  2⤵
  PID:4352
- C:\Windows\System\CFQFUpL.exe
  C:\Windows\System\CFQFUpL.exe
  2⤵
  PID:4368
- C:\Windows\System\XPXGOOE.exe
  C:\Windows\System\XPXGOOE.exe
  2⤵
  PID:4392
- C:\Windows\System\BmIQSme.exe
  C:\Windows\System\BmIQSme.exe
  2⤵
  PID:4416
- C:\Windows\System\xLFeYeY.exe
  C:\Windows\System\xLFeYeY.exe
  2⤵
  PID:4436
- C:\Windows\System\CDmqZap.exe
  C:\Windows\System\CDmqZap.exe
  2⤵
  PID:4464
- C:\Windows\System\fVfDdKZ.exe
  C:\Windows\System\fVfDdKZ.exe
  2⤵
  PID:4532
- C:\Windows\System\bBTLqIC.exe
  C:\Windows\System\bBTLqIC.exe
  2⤵
  PID:4484
- C:\Windows\System\VYRHxuE.exe
  C:\Windows\System\VYRHxuE.exe
  2⤵
  PID:4496
- C:\Windows\System\PcshHpM.exe
  C:\Windows\System\PcshHpM.exe
  2⤵
  PID:4600
- C:\Windows\System\lsvjOYf.exe
  C:\Windows\System\lsvjOYf.exe
  2⤵
  PID:4640
- C:\Windows\System\OFuZXDb.exe
  C:\Windows\System\OFuZXDb.exe
  2⤵
  PID:4688
- C:\Windows\System\DBjVRcE.exe
  C:\Windows\System\DBjVRcE.exe
  2⤵
  PID:4696
- C:\Windows\System\IFBHmec.exe
  C:\Windows\System\IFBHmec.exe
  2⤵
  PID:4724
- C:\Windows\System\syMyawo.exe
  C:\Windows\System\syMyawo.exe
  2⤵
  PID:4816
- C:\Windows\System\AVAdeZT.exe
  C:\Windows\System\AVAdeZT.exe
  2⤵
  PID:4912
- C:\Windows\System\MgfBmVK.exe
  C:\Windows\System\MgfBmVK.exe
  2⤵
  PID:4848
- C:\Windows\System\JbXlKxJ.exe
  C:\Windows\System\JbXlKxJ.exe
  2⤵
  PID:4864
- C:\Windows\System\yfIKqSo.exe
  C:\Windows\System\yfIKqSo.exe
  2⤵
  PID:4928
- C:\Windows\System\mGPeuqi.exe
  C:\Windows\System\mGPeuqi.exe
  2⤵
  PID:4736
- C:\Windows\System\nNRQYQq.exe
  C:\Windows\System\nNRQYQq.exe
  2⤵
  PID:4944
- C:\Windows\System\xoGxgJa.exe
  C:\Windows\System\xoGxgJa.exe
  2⤵
  PID:5056
- C:\Windows\System\VBeNUza.exe
  C:\Windows\System\VBeNUza.exe
  2⤵
  PID:5040
- C:\Windows\System\xMBCMIK.exe
  C:\Windows\System\xMBCMIK.exe
  2⤵
  PID:5104
- C:\Windows\System\bVkYcqW.exe
  C:\Windows\System\bVkYcqW.exe
  2⤵
  PID:5116
- C:\Windows\System\vzjhcKt.exe
  C:\Windows\System\vzjhcKt.exe
  2⤵
  PID:4976
- C:\Windows\System\SCtxeXP.exe
  C:\Windows\System\SCtxeXP.exe
  2⤵
  PID:1244
- C:\Windows\System\SpiYXnd.exe
  C:\Windows\System\SpiYXnd.exe
  2⤵
  PID:2656
- C:\Windows\System\XgdUkxy.exe
  C:\Windows\System\XgdUkxy.exe
  2⤵
  PID:3184
- C:\Windows\System\XhkMOoW.exe
  C:\Windows\System\XhkMOoW.exe
  2⤵
  PID:2416
- C:\Windows\System\vBgfCNv.exe
  C:\Windows\System\vBgfCNv.exe
  2⤵
  PID:3996
- C:\Windows\System\sRQshXk.exe
  C:\Windows\System\sRQshXk.exe
  2⤵
  PID:4704
- C:\Windows\System\fIMMhBu.exe
  C:\Windows\System\fIMMhBu.exe
  2⤵
  PID:4232
- C:\Windows\System\ocbtIBZ.exe
  C:\Windows\System\ocbtIBZ.exe
  2⤵
  PID:804
- C:\Windows\System\cjglgtf.exe
  C:\Windows\System\cjglgtf.exe
  2⤵
  PID:1644
- C:\Windows\System\shlJMCg.exe
  C:\Windows\System\shlJMCg.exe
  2⤵
  PID:2796
- C:\Windows\System\wZAmiqE.exe
  C:\Windows\System\wZAmiqE.exe
  2⤵
  PID:1652
- C:\Windows\System\AZOsERp.exe
  C:\Windows\System\AZOsERp.exe
  2⤵
  PID:2412
- C:\Windows\System\dwqRJUj.exe
  C:\Windows\System\dwqRJUj.exe
  2⤵
  PID:856
- C:\Windows\System\JOcwbWk.exe
  C:\Windows\System\JOcwbWk.exe
  2⤵
  PID:2504
- C:\Windows\System\kUNTXMX.exe
  C:\Windows\System\kUNTXMX.exe
  2⤵
  PID:3316
- C:\Windows\System\bqiDhAU.exe
  C:\Windows\System\bqiDhAU.exe
  2⤵
  PID:3684
- C:\Windows\System\dViZboW.exe
  C:\Windows\System\dViZboW.exe
  2⤵
  PID:4176
- C:\Windows\System\wXWGkin.exe
  C:\Windows\System\wXWGkin.exe
  2⤵
  PID:4292
- C:\Windows\System\tmrzXww.exe
  C:\Windows\System\tmrzXww.exe
  2⤵
  PID:3900
- C:\Windows\System\enQcwTK.exe
  C:\Windows\System\enQcwTK.exe
  2⤵
  PID:4376
- C:\Windows\System\baYgaZg.exe
  C:\Windows\System\baYgaZg.exe
  2⤵
  PID:4408
- C:\Windows\System\KWUYgkq.exe
  C:\Windows\System\KWUYgkq.exe
  2⤵
  PID:4384
- C:\Windows\System\znsOIAW.exe
  C:\Windows\System\znsOIAW.exe
  2⤵
  PID:4480
- C:\Windows\System\TtlfIgn.exe
  C:\Windows\System\TtlfIgn.exe
  2⤵
  PID:4564
- C:\Windows\System\cevFvAM.exe
  C:\Windows\System\cevFvAM.exe
  2⤵
  PID:4568
- C:\Windows\System\pQiWfrX.exe
  C:\Windows\System\pQiWfrX.exe
  2⤵
  PID:4636
- C:\Windows\System\jmSsRxt.exe
  C:\Windows\System\jmSsRxt.exe
  2⤵
  PID:4788
- C:\Windows\System\vvtTlqg.exe
  C:\Windows\System\vvtTlqg.exe
  2⤵
  PID:4804
- C:\Windows\System\WAuKxOe.exe
  C:\Windows\System\WAuKxOe.exe
  2⤵
  PID:2856
- C:\Windows\System\AbTEphG.exe
  C:\Windows\System\AbTEphG.exe
  2⤵
  PID:3740
- C:\Windows\System\kmMgiSE.exe
  C:\Windows\System\kmMgiSE.exe
  2⤵
  PID:1752
- C:\Windows\System\AxbMCNk.exe
  C:\Windows\System\AxbMCNk.exe
  2⤵
  PID:4868
- C:\Windows\System\kmayMyM.exe
  C:\Windows\System\kmayMyM.exe
  2⤵
  PID:5012
- C:\Windows\System\OZSooNL.exe
  C:\Windows\System\OZSooNL.exe
  2⤵
  PID:3244
- C:\Windows\System\fTXmKAI.exe
  C:\Windows\System\fTXmKAI.exe
  2⤵
  PID:2888
- C:\Windows\System\VeeIHNg.exe
  C:\Windows\System\VeeIHNg.exe
  2⤵
  PID:4220
- C:\Windows\System\BCJCOpU.exe
  C:\Windows\System\BCJCOpU.exe
  2⤵
  PID:2208
- C:\Windows\System\KONluDh.exe
  C:\Windows\System\KONluDh.exe
  2⤵
  PID:3612
- C:\Windows\System\yLQeyec.exe
  C:\Windows\System\yLQeyec.exe
  2⤵
  PID:4316
- C:\Windows\System\mqONDiQ.exe
  C:\Windows\System\mqONDiQ.exe
  2⤵
  PID:4224
- C:\Windows\System\VrnzayU.exe
  C:\Windows\System\VrnzayU.exe
  2⤵
  PID:4432
- C:\Windows\System\lhbnauX.exe
  C:\Windows\System\lhbnauX.exe
  2⤵
  PID:4684
- C:\Windows\System\raJENoz.exe
  C:\Windows\System\raJENoz.exe
  2⤵
  PID:2704
- C:\Windows\System\mGpTcIb.exe
  C:\Windows\System\mGpTcIb.exe
  2⤵
  PID:4576
- C:\Windows\System\bpXtZmY.exe
  C:\Windows\System\bpXtZmY.exe
  2⤵
  PID:4700
- C:\Windows\System\TaKRRSE.exe
  C:\Windows\System\TaKRRSE.exe
  2⤵
  PID:4852
- C:\Windows\System\nWSFqeK.exe
  C:\Windows\System\nWSFqeK.exe
  2⤵
  PID:3764
- C:\Windows\System\KTqkTpe.exe
  C:\Windows\System\KTqkTpe.exe
  2⤵
  PID:1520
- C:\Windows\System\bppZAFC.exe
  C:\Windows\System\bppZAFC.exe
  2⤵
  PID:2696
- C:\Windows\System\ddtvIqw.exe
  C:\Windows\System\ddtvIqw.exe
  2⤵
  PID:4740
- C:\Windows\System\oLdNvqO.exe
  C:\Windows\System\oLdNvqO.exe
  2⤵
  PID:5076
- C:\Windows\System\qcxVNhs.exe
  C:\Windows\System\qcxVNhs.exe
  2⤵
  PID:1280
- C:\Windows\System\tvlXCSd.exe
  C:\Windows\System\tvlXCSd.exe
  2⤵
  PID:5108
- C:\Windows\System\OlxOmvq.exe
  C:\Windows\System\OlxOmvq.exe
  2⤵
  PID:4380
- C:\Windows\System\sbzGjwH.exe
  C:\Windows\System\sbzGjwH.exe
  2⤵
  PID:2068
- C:\Windows\System\SMeOvPs.exe
  C:\Windows\System\SMeOvPs.exe
  2⤵
  PID:4784
- C:\Windows\System\oyFhebx.exe
  C:\Windows\System\oyFhebx.exe
  2⤵
  PID:2092
- C:\Windows\System\heJZVNP.exe
  C:\Windows\System\heJZVNP.exe
  2⤵
  PID:4512
- C:\Windows\System\OJLSySs.exe
  C:\Windows\System\OJLSySs.exe
  2⤵
  PID:5100
- C:\Windows\System\XTANmZL.exe
  C:\Windows\System\XTANmZL.exe
  2⤵
  PID:3484
- C:\Windows\System\NiOEIXm.exe
  C:\Windows\System\NiOEIXm.exe
  2⤵
  PID:1732
- C:\Windows\System\kPYXoel.exe
  C:\Windows\System\kPYXoel.exe
  2⤵
  PID:4548
- C:\Windows\System\qNfgDTy.exe
  C:\Windows\System\qNfgDTy.exe
  2⤵
  PID:4288
- C:\Windows\System\zXUluhi.exe
  C:\Windows\System\zXUluhi.exe
  2⤵
  PID:4880
- C:\Windows\System\PdWgHEp.exe
  C:\Windows\System\PdWgHEp.exe
  2⤵
  PID:5060
- C:\Windows\System\ncsCDny.exe
  C:\Windows\System\ncsCDny.exe
  2⤵
  PID:2480
- C:\Windows\System\mHiGhDn.exe
  C:\Windows\System\mHiGhDn.exe
  2⤵
  PID:4624
- C:\Windows\System\rgZGkFb.exe
  C:\Windows\System\rgZGkFb.exe
  2⤵
  PID:5124
- C:\Windows\System\rdFwYqk.exe
  C:\Windows\System\rdFwYqk.exe
  2⤵
  PID:5140
- C:\Windows\System\dnAzEZY.exe
  C:\Windows\System\dnAzEZY.exe
  2⤵
  PID:5156
- C:\Windows\System\pODpFGi.exe
  C:\Windows\System\pODpFGi.exe
  2⤵
  PID:5172
- C:\Windows\System\wymgnjA.exe
  C:\Windows\System\wymgnjA.exe
  2⤵
  PID:5188
- C:\Windows\System\bzHxZpn.exe
  C:\Windows\System\bzHxZpn.exe
  2⤵
  PID:5204
- C:\Windows\System\TvtiwNw.exe
  C:\Windows\System\TvtiwNw.exe
  2⤵
  PID:5220
- C:\Windows\System\mjmDQBI.exe
  C:\Windows\System\mjmDQBI.exe
  2⤵
  PID:5236
- C:\Windows\System\plUNxoU.exe
  C:\Windows\System\plUNxoU.exe
  2⤵
  PID:5256
- C:\Windows\System\aQZjTRL.exe
  C:\Windows\System\aQZjTRL.exe
  2⤵
  PID:5272
- C:\Windows\System\JyymwDC.exe
  C:\Windows\System\JyymwDC.exe
  2⤵
  PID:5288
- C:\Windows\System\pojrNbj.exe
  C:\Windows\System\pojrNbj.exe
  2⤵
  PID:5304
- C:\Windows\System\ygIeqgx.exe
  C:\Windows\System\ygIeqgx.exe
  2⤵
  PID:5320
- C:\Windows\System\xYZXJoa.exe
  C:\Windows\System\xYZXJoa.exe
  2⤵
  PID:5336
- C:\Windows\System\NAwBsll.exe
  C:\Windows\System\NAwBsll.exe
  2⤵
  PID:5352
- C:\Windows\System\spdMJHH.exe
  C:\Windows\System\spdMJHH.exe
  2⤵
  PID:5368
- C:\Windows\System\zAOZbVW.exe
  C:\Windows\System\zAOZbVW.exe
  2⤵
  PID:5384
- C:\Windows\System\kVnQmaz.exe
  C:\Windows\System\kVnQmaz.exe
  2⤵
  PID:5400
- C:\Windows\System\mLOLsoQ.exe
  C:\Windows\System\mLOLsoQ.exe
  2⤵
  PID:5416
- C:\Windows\System\RCMwkRb.exe
  C:\Windows\System\RCMwkRb.exe
  2⤵
  PID:5432
- C:\Windows\System\HviVfVU.exe
  C:\Windows\System\HviVfVU.exe
  2⤵
  PID:5448
- C:\Windows\System\aouowxR.exe
  C:\Windows\System\aouowxR.exe
  2⤵
  PID:5468
- C:\Windows\System\XyXkatX.exe
  C:\Windows\System\XyXkatX.exe
  2⤵
  PID:5484
- C:\Windows\System\WtvCdGD.exe
  C:\Windows\System\WtvCdGD.exe
  2⤵
  PID:5500
- C:\Windows\System\uKiTljT.exe
  C:\Windows\System\uKiTljT.exe
  2⤵
  PID:5516
- C:\Windows\System\vFOmfWP.exe
  C:\Windows\System\vFOmfWP.exe
  2⤵
  PID:5532
- C:\Windows\System\vphYhzx.exe
  C:\Windows\System\vphYhzx.exe
  2⤵
  PID:5548
- C:\Windows\System\CkQWBZD.exe
  C:\Windows\System\CkQWBZD.exe
  2⤵
  PID:5568
- C:\Windows\System\soXYFQA.exe
  C:\Windows\System\soXYFQA.exe
  2⤵
  PID:5584
- C:\Windows\System\XCVDAFV.exe
  C:\Windows\System\XCVDAFV.exe
  2⤵
  PID:5600
- C:\Windows\System\UFXGKyQ.exe
  C:\Windows\System\UFXGKyQ.exe
  2⤵
  PID:5616
- C:\Windows\System\RfRpPXH.exe
  C:\Windows\System\RfRpPXH.exe
  2⤵
  PID:5632
- C:\Windows\System\QXoqJZf.exe
  C:\Windows\System\QXoqJZf.exe
  2⤵
  PID:5648
- C:\Windows\System\oMoyhUA.exe
  C:\Windows\System\oMoyhUA.exe
  2⤵
  PID:5664
- C:\Windows\System\xlaawGT.exe
  C:\Windows\System\xlaawGT.exe
  2⤵
  PID:5680
- C:\Windows\System\iKuAwYt.exe
  C:\Windows\System\iKuAwYt.exe
  2⤵
  PID:5696
- C:\Windows\System\olWlCGR.exe
  C:\Windows\System\olWlCGR.exe
  2⤵
  PID:5712
- C:\Windows\System\pKsvVdj.exe
  C:\Windows\System\pKsvVdj.exe
  2⤵
  PID:5728
- C:\Windows\System\IBRbywV.exe
  C:\Windows\System\IBRbywV.exe
  2⤵
  PID:5744
- C:\Windows\System\hgiBkva.exe
  C:\Windows\System\hgiBkva.exe
  2⤵
  PID:5760
- C:\Windows\System\EyyJTJn.exe
  C:\Windows\System\EyyJTJn.exe
  2⤵
  PID:5776
- C:\Windows\System\yFisScw.exe
  C:\Windows\System\yFisScw.exe
  2⤵
  PID:5792
- C:\Windows\System\zJTyEDm.exe
  C:\Windows\System\zJTyEDm.exe
  2⤵
  PID:5808
- C:\Windows\System\AnODgMW.exe
  C:\Windows\System\AnODgMW.exe
  2⤵
  PID:5824
- C:\Windows\System\BxLnqBv.exe
  C:\Windows\System\BxLnqBv.exe
  2⤵
  PID:5840
- C:\Windows\System\GJZRhzo.exe
  C:\Windows\System\GJZRhzo.exe
  2⤵
  PID:5856
- C:\Windows\System\YasbCfL.exe
  C:\Windows\System\YasbCfL.exe
  2⤵
  PID:5872
- C:\Windows\System\mLIIYYL.exe
  C:\Windows\System\mLIIYYL.exe
  2⤵
  PID:5888
- C:\Windows\System\SzhQUii.exe
  C:\Windows\System\SzhQUii.exe
  2⤵
  PID:5904
- C:\Windows\System\ZPqFSWn.exe
  C:\Windows\System\ZPqFSWn.exe
  2⤵
  PID:5920
- C:\Windows\System\tPffuha.exe
  C:\Windows\System\tPffuha.exe
  2⤵
  PID:5936
- C:\Windows\System\bnOpyGi.exe
  C:\Windows\System\bnOpyGi.exe
  2⤵
  PID:5952
- C:\Windows\System\gLQRidL.exe
  C:\Windows\System\gLQRidL.exe
  2⤵
  PID:5968
- C:\Windows\System\WArYdnx.exe
  C:\Windows\System\WArYdnx.exe
  2⤵
  PID:5984
- C:\Windows\System\SlDepyq.exe
  C:\Windows\System\SlDepyq.exe
  2⤵
  PID:6000
- C:\Windows\System\lHqUvTK.exe
  C:\Windows\System\lHqUvTK.exe
  2⤵
  PID:6016
- C:\Windows\System\fGoOLzm.exe
  C:\Windows\System\fGoOLzm.exe
  2⤵
  PID:6032
- C:\Windows\System\IfqJpEE.exe
  C:\Windows\System\IfqJpEE.exe
  2⤵
  PID:4360
- C:\Windows\System\TsxfNNA.exe
  C:\Windows\System\TsxfNNA.exe
  2⤵
  PID:5168
- C:\Windows\System\fVlxOqc.exe
  C:\Windows\System\fVlxOqc.exe
  2⤵
  PID:5228
- C:\Windows\System\DyHYaga.exe
  C:\Windows\System\DyHYaga.exe
  2⤵
  PID:5296
- C:\Windows\System\QCyrjKU.exe
  C:\Windows\System\QCyrjKU.exe
  2⤵
  PID:5360
- C:\Windows\System\jopZTOw.exe
  C:\Windows\System\jopZTOw.exe
  2⤵
  PID:5424
- C:\Windows\System\OBYrchA.exe
  C:\Windows\System\OBYrchA.exe
  2⤵
  PID:5180
- C:\Windows\System\KfMufFl.exe
  C:\Windows\System\KfMufFl.exe
  2⤵
  PID:5492
- C:\Windows\System\uCCarkD.exe
  C:\Windows\System\uCCarkD.exe
  2⤵
  PID:5556
- C:\Windows\System\KXeOqrw.exe
  C:\Windows\System\KXeOqrw.exe
  2⤵
  PID:5312
- C:\Windows\System\ZVxreIM.exe
  C:\Windows\System\ZVxreIM.exe
  2⤵
  PID:4768
- C:\Windows\System\juzlsKO.exe
  C:\Windows\System\juzlsKO.exe
  2⤵
  PID:5216
- C:\Windows\System\iZjlOAK.exe
  C:\Windows\System\iZjlOAK.exe
  2⤵
  PID:5280
- C:\Windows\System\pgWFFjd.exe
  C:\Windows\System\pgWFFjd.exe
  2⤵
  PID:5376
- C:\Windows\System\okaIRfC.exe
  C:\Windows\System\okaIRfC.exe
  2⤵
  PID:5440
- C:\Windows\System\phGfPyc.exe
  C:\Windows\System\phGfPyc.exe
  2⤵
  PID:5508
- C:\Windows\System\aHsbaAk.exe
  C:\Windows\System\aHsbaAk.exe
  2⤵
  PID:5576
- C:\Windows\System\BUSyQcI.exe
  C:\Windows\System\BUSyQcI.exe
  2⤵
  PID:5596
- C:\Windows\System\NoeZjxa.exe
  C:\Windows\System\NoeZjxa.exe
  2⤵
  PID:5660
- C:\Windows\System\dBfEewa.exe
  C:\Windows\System\dBfEewa.exe
  2⤵
  PID:5724
- C:\Windows\System\ngWZJzP.exe
  C:\Windows\System\ngWZJzP.exe
  2⤵
  PID:5788
- C:\Windows\System\NZzGEvR.exe
  C:\Windows\System\NZzGEvR.exe
  2⤵
  PID:5852
- C:\Windows\System\ANJVhvq.exe
  C:\Windows\System\ANJVhvq.exe
  2⤵
  PID:5916
- C:\Windows\System\yxIDjJD.exe
  C:\Windows\System\yxIDjJD.exe
  2⤵
  PID:5980
- C:\Windows\System\jfiMmOI.exe
  C:\Windows\System\jfiMmOI.exe
  2⤵
  PID:5704
- C:\Windows\System\QqtiLAF.exe
  C:\Windows\System\QqtiLAF.exe
  2⤵
  PID:5612
- C:\Windows\System\ZifAdbH.exe
  C:\Windows\System\ZifAdbH.exe
  2⤵
  PID:5736
- C:\Windows\System\zPoyOZE.exe
  C:\Windows\System\zPoyOZE.exe
  2⤵
  PID:5832
- C:\Windows\System\hpbucmh.exe
  C:\Windows\System\hpbucmh.exe
  2⤵
  PID:5900
- C:\Windows\System\bcrbeJZ.exe
  C:\Windows\System\bcrbeJZ.exe
  2⤵
  PID:5964
- C:\Windows\System\WjREPAV.exe
  C:\Windows\System\WjREPAV.exe
  2⤵
  PID:6028
- C:\Windows\System\zpvBZmq.exe
  C:\Windows\System\zpvBZmq.exe
  2⤵
  PID:6060
- C:\Windows\System\fZOvbNS.exe
  C:\Windows\System\fZOvbNS.exe
  2⤵
  PID:3012
- C:\Windows\System\OBZMceH.exe
  C:\Windows\System\OBZMceH.exe
  2⤵
  PID:6088
- C:\Windows\System\LONiJTA.exe
  C:\Windows\System\LONiJTA.exe
  2⤵
  PID:6104
- C:\Windows\System\wRBHCXM.exe
  C:\Windows\System\wRBHCXM.exe
  2⤵
  PID:6120
- C:\Windows\System\GslLbNx.exe
  C:\Windows\System\GslLbNx.exe
  2⤵
  PID:6140
- C:\Windows\System\OVByFiz.exe
  C:\Windows\System\OVByFiz.exe
  2⤵
  PID:4668
- C:\Windows\System\PZEzZzy.exe
  C:\Windows\System\PZEzZzy.exe
  2⤵
  PID:5332
- C:\Windows\System\WRawgIR.exe
  C:\Windows\System\WRawgIR.exe
  2⤵
  PID:5524
- C:\Windows\System\mPzfsqh.exe
  C:\Windows\System\mPzfsqh.exe
  2⤵
  PID:2876
- C:\Windows\System\wWcetXE.exe
  C:\Windows\System\wWcetXE.exe
  2⤵
  PID:5412
- C:\Windows\System\QtcOrYT.exe
  C:\Windows\System\QtcOrYT.exe
  2⤵
  PID:5656
- C:\Windows\System\miYoXOp.exe
  C:\Windows\System\miYoXOp.exe
  2⤵
  PID:5912
- C:\Windows\System\kzAmXlX.exe
  C:\Windows\System\kzAmXlX.exe
  2⤵
  PID:5676
- C:\Windows\System\dlzhjpd.exe
  C:\Windows\System\dlzhjpd.exe
  2⤵
  PID:5392
- C:\Windows\System\woIiauF.exe
  C:\Windows\System\woIiauF.exe
  2⤵
  PID:5112
- C:\Windows\System\SCUIcQg.exe
  C:\Windows\System\SCUIcQg.exe
  2⤵
  PID:5592
- C:\Windows\System\oAABQUS.exe
  C:\Windows\System\oAABQUS.exe
  2⤵
  PID:5480
- C:\Windows\System\wmFyQUc.exe
  C:\Windows\System\wmFyQUc.exe
  2⤵
  PID:6132
- C:\Windows\System\rKmDnFP.exe
  C:\Windows\System\rKmDnFP.exe
  2⤵
  PID:5464
- C:\Windows\System\dhtMjhE.exe
  C:\Windows\System\dhtMjhE.exe
  2⤵
  PID:5476
- C:\Windows\System\meXlpsq.exe
  C:\Windows\System\meXlpsq.exe
  2⤵
  PID:5820
- C:\Windows\System\AACQliP.exe
  C:\Windows\System\AACQliP.exe
  2⤵
  PID:5836
- C:\Windows\System\wlQrkic.exe
  C:\Windows\System\wlQrkic.exe
  2⤵
  PID:5800
- C:\Windows\System\VmJlYqa.exe
  C:\Windows\System\VmJlYqa.exe
  2⤵
  PID:6112
- C:\Windows\System\skuJjsL.exe
  C:\Windows\System\skuJjsL.exe
  2⤵
  PID:5196
- C:\Windows\System\lYHPzHt.exe
  C:\Windows\System\lYHPzHt.exe
  2⤵
  PID:5544
- C:\Windows\System\ULtRNlm.exe
  C:\Windows\System\ULtRNlm.exe
  2⤵
  PID:5640
- C:\Windows\System\KffYUEZ.exe
  C:\Windows\System\KffYUEZ.exe
  2⤵
  PID:5152
- C:\Windows\System\FDmaugh.exe
  C:\Windows\System\FDmaugh.exe
  2⤵
  PID:5396
- C:\Windows\System\aphEBVr.exe
  C:\Windows\System\aphEBVr.exe
  2⤵
  PID:5884
- C:\Windows\System\VcTpHJk.exe
  C:\Windows\System\VcTpHJk.exe
  2⤵
  PID:6084
- C:\Windows\System\mthROnT.exe
  C:\Windows\System\mthROnT.exe
  2⤵
  PID:5976
- C:\Windows\System\NUiOXon.exe
  C:\Windows\System\NUiOXon.exe
  2⤵
  PID:6100
- C:\Windows\System\vcIGWbP.exe
  C:\Windows\System\vcIGWbP.exe
  2⤵
  PID:5344
- C:\Windows\System\TyDLerY.exe
  C:\Windows\System\TyDLerY.exe
  2⤵
  PID:6068
- C:\Windows\System\QSrzdrC.exe
  C:\Windows\System\QSrzdrC.exe
  2⤵
  PID:5996
- C:\Windows\System\SuHcBrx.exe
  C:\Windows\System\SuHcBrx.exe
  2⤵
  PID:6040
- C:\Windows\System\BliFEKM.exe
  C:\Windows\System\BliFEKM.exe
  2⤵
  PID:6160
- C:\Windows\System\CEwLijR.exe
  C:\Windows\System\CEwLijR.exe
  2⤵
  PID:6176
- C:\Windows\System\rXgjKzJ.exe
  C:\Windows\System\rXgjKzJ.exe
  2⤵
  PID:6272
- C:\Windows\System\fDKOXZv.exe
  C:\Windows\System\fDKOXZv.exe
  2⤵
  PID:6288
- C:\Windows\System\IdVsKJz.exe
  C:\Windows\System\IdVsKJz.exe
  2⤵
  PID:6304
- C:\Windows\System\AEDazln.exe
  C:\Windows\System\AEDazln.exe
  2⤵
  PID:6320
- C:\Windows\System\AFxxRsw.exe
  C:\Windows\System\AFxxRsw.exe
  2⤵
  PID:6336
- C:\Windows\System\SJtDlMF.exe
  C:\Windows\System\SJtDlMF.exe
  2⤵
  PID:6352
- C:\Windows\System\JexJemY.exe
  C:\Windows\System\JexJemY.exe
  2⤵
  PID:6368
- C:\Windows\System\ofkXIqZ.exe
  C:\Windows\System\ofkXIqZ.exe
  2⤵
  PID:6384
- C:\Windows\System\zpzPyaO.exe
  C:\Windows\System\zpzPyaO.exe
  2⤵
  PID:6400
- C:\Windows\System\xTrYCBr.exe
  C:\Windows\System\xTrYCBr.exe
  2⤵
  PID:6416
- C:\Windows\System\nYvGSWR.exe
  C:\Windows\System\nYvGSWR.exe
  2⤵
  PID:6432
- C:\Windows\System\gAgTmAe.exe
  C:\Windows\System\gAgTmAe.exe
  2⤵
  PID:6468
- C:\Windows\System\ZEEpEUD.exe
  C:\Windows\System\ZEEpEUD.exe
  2⤵
  PID:6484
- C:\Windows\System\ZzobUvS.exe
  C:\Windows\System\ZzobUvS.exe
  2⤵
  PID:6500
- C:\Windows\System\XiFvNnW.exe
  C:\Windows\System\XiFvNnW.exe
  2⤵
  PID:6516
- C:\Windows\System\NweRALd.exe
  C:\Windows\System\NweRALd.exe
  2⤵
  PID:6536
- C:\Windows\System\YudyIEh.exe
  C:\Windows\System\YudyIEh.exe
  2⤵
  PID:6556
- C:\Windows\System\RaECbzf.exe
  C:\Windows\System\RaECbzf.exe
  2⤵
  PID:6572
- C:\Windows\System\KQNDIci.exe
  C:\Windows\System\KQNDIci.exe
  2⤵
  PID:6588
- C:\Windows\System\kSaAioY.exe
  C:\Windows\System\kSaAioY.exe
  2⤵
  PID:6604
- C:\Windows\System\nREaHeA.exe
  C:\Windows\System\nREaHeA.exe
  2⤵
  PID:6620
- C:\Windows\System\YzNjbLl.exe
  C:\Windows\System\YzNjbLl.exe
  2⤵
  PID:6644
- C:\Windows\System\KiPEWTg.exe
  C:\Windows\System\KiPEWTg.exe
  2⤵
  PID:6660
- C:\Windows\System\qaBMoqL.exe
  C:\Windows\System\qaBMoqL.exe
  2⤵
  PID:6676
- C:\Windows\System\PQnkaTA.exe
  C:\Windows\System\PQnkaTA.exe
  2⤵
  PID:6692
- C:\Windows\System\uGZqzui.exe
  C:\Windows\System\uGZqzui.exe
  2⤵
  PID:6708
- C:\Windows\System\LUHKGce.exe
  C:\Windows\System\LUHKGce.exe
  2⤵
  PID:6724
- C:\Windows\System\KAFrFjr.exe
  C:\Windows\System\KAFrFjr.exe
  2⤵
  PID:6740
- C:\Windows\System\ilMkSPs.exe
  C:\Windows\System\ilMkSPs.exe
  2⤵
  PID:6760
- C:\Windows\System\OIHWdId.exe
  C:\Windows\System\OIHWdId.exe
  2⤵
  PID:6776
- C:\Windows\System\daCHsrU.exe
  C:\Windows\System\daCHsrU.exe
  2⤵
  PID:6792
- C:\Windows\System\BKdBbrF.exe
  C:\Windows\System\BKdBbrF.exe
  2⤵
  PID:6808
- C:\Windows\System\nufbQtE.exe
  C:\Windows\System\nufbQtE.exe
  2⤵
  PID:6824
- C:\Windows\System\mGpJBSc.exe
  C:\Windows\System\mGpJBSc.exe
  2⤵
  PID:6840
- C:\Windows\System\wBVyNLp.exe
  C:\Windows\System\wBVyNLp.exe
  2⤵
  PID:6860
- C:\Windows\System\sYOyWeY.exe
  C:\Windows\System\sYOyWeY.exe
  2⤵
  PID:6876
- C:\Windows\System\JCviqPp.exe
  C:\Windows\System\JCviqPp.exe
  2⤵
  PID:6928
- C:\Windows\System\xnUYHVi.exe
  C:\Windows\System\xnUYHVi.exe
  2⤵
  PID:6980
- C:\Windows\System\thZTFbf.exe
  C:\Windows\System\thZTFbf.exe
  2⤵
  PID:7000
- C:\Windows\System\rGpZisn.exe
  C:\Windows\System\rGpZisn.exe
  2⤵
  PID:7016
- C:\Windows\System\lytItRj.exe
  C:\Windows\System\lytItRj.exe
  2⤵
  PID:7032
- C:\Windows\System\EcLeiCG.exe
  C:\Windows\System\EcLeiCG.exe
  2⤵
  PID:7056
- C:\Windows\System\BZBKkCd.exe
  C:\Windows\System\BZBKkCd.exe
  2⤵
  PID:7076
- C:\Windows\System\pcqQOrW.exe
  C:\Windows\System\pcqQOrW.exe
  2⤵
  PID:7096
- C:\Windows\System\qbYhftM.exe
  C:\Windows\System\qbYhftM.exe
  2⤵
  PID:7112
- C:\Windows\System\amGTjmA.exe
  C:\Windows\System\amGTjmA.exe
  2⤵
  PID:7128
- C:\Windows\System\sRQCdnN.exe
  C:\Windows\System\sRQCdnN.exe
  2⤵
  PID:7144
- C:\Windows\System\jxfUuEM.exe
  C:\Windows\System\jxfUuEM.exe
  2⤵
  PID:7160
- C:\Windows\System\WOkytbr.exe
  C:\Windows\System\WOkytbr.exe
  2⤵
  PID:4304
- C:\Windows\System\FxuhMNI.exe
  C:\Windows\System\FxuhMNI.exe
  2⤵
  PID:5200
- C:\Windows\System\hvcywxg.exe
  C:\Windows\System\hvcywxg.exe
  2⤵
  PID:6188
- C:\Windows\System\RbQqQHY.exe
  C:\Windows\System\RbQqQHY.exe
  2⤵
  PID:5628
- C:\Windows\System\VinmYSu.exe
  C:\Windows\System\VinmYSu.exe
  2⤵
  PID:6212
- C:\Windows\System\tNDLatN.exe
  C:\Windows\System\tNDLatN.exe
  2⤵
  PID:6236
- C:\Windows\System\dJnPSel.exe
  C:\Windows\System\dJnPSel.exe
  2⤵
  PID:6248
- C:\Windows\System\yiyhpGl.exe
  C:\Windows\System\yiyhpGl.exe
  2⤵
  PID:1720
- C:\Windows\System\rAJUtKx.exe
  C:\Windows\System\rAJUtKx.exe
  2⤵
  PID:6328
- C:\Windows\System\dZBdhWc.exe
  C:\Windows\System\dZBdhWc.exe
  2⤵
  PID:6316
- C:\Windows\System\ASJExJR.exe
  C:\Windows\System\ASJExJR.exe
  2⤵
  PID:6380
- C:\Windows\System\iKZWuOh.exe
  C:\Windows\System\iKZWuOh.exe
  2⤵
  PID:6412
- C:\Windows\System\itFEGSd.exe
  C:\Windows\System\itFEGSd.exe
  2⤵
  PID:6456
- C:\Windows\System\MryViRX.exe
  C:\Windows\System\MryViRX.exe
  2⤵
  PID:6528
- C:\Windows\System\OVfjGRF.exe
  C:\Windows\System\OVfjGRF.exe
  2⤵
  PID:6596
- C:\Windows\System\TySSzZK.exe
  C:\Windows\System\TySSzZK.exe
  2⤵
  PID:6636
- C:\Windows\System\XOrJOXr.exe
  C:\Windows\System\XOrJOXr.exe
  2⤵
  PID:6612
- C:\Windows\System\bYWHQMN.exe
  C:\Windows\System\bYWHQMN.exe
  2⤵
  PID:6544
- C:\Windows\System\yRGkpHi.exe
  C:\Windows\System\yRGkpHi.exe
  2⤵
  PID:6688
- C:\Windows\System\mTUCZlJ.exe
  C:\Windows\System\mTUCZlJ.exe
  2⤵
  PID:6424
- C:\Windows\System\tVJVorq.exe
  C:\Windows\System\tVJVorq.exe
  2⤵
  PID:6548
- C:\Windows\System\fQldqoY.exe
  C:\Windows\System\fQldqoY.exe
  2⤵
  PID:6716
- C:\Windows\System\QodHYUo.exe
  C:\Windows\System\QodHYUo.exe
  2⤵
  PID:6448
- C:\Windows\System\rwrGaNT.exe
  C:\Windows\System\rwrGaNT.exe
  2⤵
  PID:6736
- C:\Windows\System\UJIMhYK.exe
  C:\Windows\System\UJIMhYK.exe
  2⤵
  PID:6804
- C:\Windows\System\XMtSOYT.exe
  C:\Windows\System\XMtSOYT.exe
  2⤵
  PID:6672
- C:\Windows\System\IuixubG.exe
  C:\Windows\System\IuixubG.exe
  2⤵
  PID:6852
- C:\Windows\System\GMNfGqc.exe
  C:\Windows\System\GMNfGqc.exe
  2⤵
  PID:6816
- C:\Windows\System\qVKtpJf.exe
  C:\Windows\System\qVKtpJf.exe
  2⤵
  PID:6904
- C:\Windows\System\fIAXmui.exe
  C:\Windows\System\fIAXmui.exe
  2⤵
  PID:6972
- C:\Windows\System\wPGmnWZ.exe
  C:\Windows\System\wPGmnWZ.exe
  2⤵
  PID:7040
- C:\Windows\System\GuiIVrn.exe
  C:\Windows\System\GuiIVrn.exe
  2⤵
  PID:7084
- C:\Windows\System\ZgSGloF.exe
  C:\Windows\System\ZgSGloF.exe
  2⤵
  PID:7124
- C:\Windows\System\pNCtVCj.exe
  C:\Windows\System\pNCtVCj.exe
  2⤵
  PID:5896
- C:\Windows\System\IcoMssL.exe
  C:\Windows\System\IcoMssL.exe
  2⤵
  PID:6988
- C:\Windows\System\WuodECS.exe
  C:\Windows\System\WuodECS.exe
  2⤵
  PID:6152
- C:\Windows\System\wRluGCQ.exe
  C:\Windows\System\wRluGCQ.exe
  2⤵
  PID:6280
- C:\Windows\System\QsFcEEF.exe
  C:\Windows\System\QsFcEEF.exe
  2⤵
  PID:6496
- C:\Windows\System\gYKhLXV.exe
  C:\Windows\System\gYKhLXV.exe
  2⤵
  PID:6628
- C:\Windows\System\boPsEbg.exe
  C:\Windows\System\boPsEbg.exe
  2⤵
  PID:6748
- C:\Windows\System\ucXAfHr.exe
  C:\Windows\System\ucXAfHr.exe
  2⤵
  PID:6732
- C:\Windows\System\TcwZTNT.exe
  C:\Windows\System\TcwZTNT.exe
  2⤵
  PID:6784
- C:\Windows\System\cNSwejg.exe
  C:\Windows\System\cNSwejg.exe
  2⤵
  PID:6924
- C:\Windows\System\cewpaWP.exe
  C:\Windows\System\cewpaWP.exe
  2⤵
  PID:7068
- C:\Windows\System\gyhFNaH.exe
  C:\Windows\System\gyhFNaH.exe
  2⤵
  PID:7136
- C:\Windows\System\vSagVAM.exe
  C:\Windows\System\vSagVAM.exe
  2⤵
  PID:7156
- C:\Windows\System\MWqxUbG.exe
  C:\Windows\System\MWqxUbG.exe
  2⤵
  PID:6376
- C:\Windows\System\FwUyDrr.exe
  C:\Windows\System\FwUyDrr.exe
  2⤵
  PID:6508
- C:\Windows\System\HvsIwUM.exe
  C:\Windows\System\HvsIwUM.exe
  2⤵
  PID:7140
- C:\Windows\System\KcmcRYt.exe
  C:\Windows\System\KcmcRYt.exe
  2⤵
  PID:7028
- C:\Windows\System\dKegEfR.exe
  C:\Windows\System\dKegEfR.exe
  2⤵
  PID:6704
- C:\Windows\System\XTjrWqO.exe
  C:\Windows\System\XTjrWqO.exe
  2⤵
  PID:6240
- C:\Windows\System\UvgfBkM.exe
  C:\Windows\System\UvgfBkM.exe
  2⤵
  PID:6284
- C:\Windows\System\CEXtalQ.exe
  C:\Windows\System\CEXtalQ.exe
  2⤵
  PID:6192
- C:\Windows\System\cZiHvgS.exe
  C:\Windows\System\cZiHvgS.exe
  2⤵
  PID:6184
- C:\Windows\System\cevXiPh.exe
  C:\Windows\System\cevXiPh.exe
  2⤵
  PID:7172
- C:\Windows\System\IzSmCYv.exe
  C:\Windows\System\IzSmCYv.exe
  2⤵
  PID:7188
- C:\Windows\System\mRVtAvL.exe
  C:\Windows\System\mRVtAvL.exe
  2⤵
  PID:7204
- C:\Windows\System\fifAmXG.exe
  C:\Windows\System\fifAmXG.exe
  2⤵
  PID:7220
- C:\Windows\System\iSmbaEH.exe
  C:\Windows\System\iSmbaEH.exe
  2⤵
  PID:7236
- C:\Windows\System\LPuARSM.exe
  C:\Windows\System\LPuARSM.exe
  2⤵
  PID:7252
- C:\Windows\System\DIjdYAB.exe
  C:\Windows\System\DIjdYAB.exe
  2⤵
  PID:7268
- C:\Windows\System\aehNpjF.exe
  C:\Windows\System\aehNpjF.exe
  2⤵
  PID:7340
- C:\Windows\System\uPXdbmd.exe
  C:\Windows\System\uPXdbmd.exe
  2⤵
  PID:7360
- C:\Windows\System\uhXBWDm.exe
  C:\Windows\System\uhXBWDm.exe
  2⤵
  PID:7376
- C:\Windows\System\FKCSOLX.exe
  C:\Windows\System\FKCSOLX.exe
  2⤵
  PID:7392
- C:\Windows\System\KnvEfMr.exe
  C:\Windows\System\KnvEfMr.exe
  2⤵
  PID:7408
- C:\Windows\System\TfmEpWX.exe
  C:\Windows\System\TfmEpWX.exe
  2⤵
  PID:7424
- C:\Windows\System\RziWLZU.exe
  C:\Windows\System\RziWLZU.exe
  2⤵
  PID:7444
- C:\Windows\System\dleLcqZ.exe
  C:\Windows\System\dleLcqZ.exe
  2⤵
  PID:7460
- C:\Windows\System\CNcXTpA.exe
  C:\Windows\System\CNcXTpA.exe
  2⤵
  PID:7476
- C:\Windows\System\PvmRSAe.exe
  C:\Windows\System\PvmRSAe.exe
  2⤵
  PID:7492
- C:\Windows\System\wzoBQWp.exe
  C:\Windows\System\wzoBQWp.exe
  2⤵
  PID:7508
- C:\Windows\System\naUVUaj.exe
  C:\Windows\System\naUVUaj.exe
  2⤵
  PID:7524
- C:\Windows\System\RWXqOIW.exe
  C:\Windows\System\RWXqOIW.exe
  2⤵
  PID:7540
- C:\Windows\System\AmWvLrA.exe
  C:\Windows\System\AmWvLrA.exe
  2⤵
  PID:7560
- C:\Windows\System\oZtxmyc.exe
  C:\Windows\System\oZtxmyc.exe
  2⤵
  PID:7576
- C:\Windows\System\fmGAybg.exe
  C:\Windows\System\fmGAybg.exe
  2⤵
  PID:7592
- C:\Windows\System\iNTJwmd.exe
  C:\Windows\System\iNTJwmd.exe
  2⤵
  PID:7608
- C:\Windows\System\RKyojfG.exe
  C:\Windows\System\RKyojfG.exe
  2⤵
  PID:7624
- C:\Windows\System\CmSgGZi.exe
  C:\Windows\System\CmSgGZi.exe
  2⤵
  PID:7640
- C:\Windows\System\KgSwlpM.exe
  C:\Windows\System\KgSwlpM.exe
  2⤵
  PID:7656
- C:\Windows\System\pndsDOQ.exe
  C:\Windows\System\pndsDOQ.exe
  2⤵
  PID:7672
- C:\Windows\System\natnnKb.exe
  C:\Windows\System\natnnKb.exe
  2⤵
  PID:7688
- C:\Windows\System\CcTntRv.exe
  C:\Windows\System\CcTntRv.exe
  2⤵
  PID:7704
- C:\Windows\System\xYStCwy.exe
  C:\Windows\System\xYStCwy.exe
  2⤵
  PID:7724
- C:\Windows\System\ujQhLMa.exe
  C:\Windows\System\ujQhLMa.exe
  2⤵
  PID:7740
- C:\Windows\System\gzcYmAR.exe
  C:\Windows\System\gzcYmAR.exe
  2⤵
  PID:7760
- C:\Windows\System\IqBWtUH.exe
  C:\Windows\System\IqBWtUH.exe
  2⤵
  PID:7776
- C:\Windows\System\nUfdTmB.exe
  C:\Windows\System\nUfdTmB.exe
  2⤵
  PID:7792
- C:\Windows\System\feuDONX.exe
  C:\Windows\System\feuDONX.exe
  2⤵
  PID:7808
- C:\Windows\System\ShjomNz.exe
  C:\Windows\System\ShjomNz.exe
  2⤵
  PID:7824
- C:\Windows\System\sUeINhz.exe
  C:\Windows\System\sUeINhz.exe
  2⤵
  PID:7844
- C:\Windows\System\SzGqmSx.exe
  C:\Windows\System\SzGqmSx.exe
  2⤵
  PID:7860
- C:\Windows\System\PtkRaed.exe
  C:\Windows\System\PtkRaed.exe
  2⤵
  PID:7876
- C:\Windows\System\gNmWqfh.exe
  C:\Windows\System\gNmWqfh.exe
  2⤵
  PID:7892
- C:\Windows\System\gJzPyfH.exe
  C:\Windows\System\gJzPyfH.exe
  2⤵
  PID:7908
- C:\Windows\System\FQfxcQt.exe
  C:\Windows\System\FQfxcQt.exe
  2⤵
  PID:7924
- C:\Windows\System\XyUfuFT.exe
  C:\Windows\System\XyUfuFT.exe
  2⤵
  PID:7940
- C:\Windows\System\KmewjLH.exe
  C:\Windows\System\KmewjLH.exe
  2⤵
  PID:7956
- C:\Windows\System\KLsEFjz.exe
  C:\Windows\System\KLsEFjz.exe
  2⤵
  PID:7972
- C:\Windows\System\kjDfrFA.exe
  C:\Windows\System\kjDfrFA.exe
  2⤵
  PID:7988
- C:\Windows\System\JOpwtdT.exe
  C:\Windows\System\JOpwtdT.exe
  2⤵
  PID:8004
- C:\Windows\System\ZMWDuFs.exe
  C:\Windows\System\ZMWDuFs.exe
  2⤵
  PID:8020
- C:\Windows\System\kzypFII.exe
  C:\Windows\System\kzypFII.exe
  2⤵
  PID:8036
- C:\Windows\System\rdLpcWP.exe
  C:\Windows\System\rdLpcWP.exe
  2⤵
  PID:8052
- C:\Windows\System\NIPxJpR.exe
  C:\Windows\System\NIPxJpR.exe
  2⤵
  PID:8072
- C:\Windows\System\BVfwzyo.exe
  C:\Windows\System\BVfwzyo.exe
  2⤵
  PID:8092
- C:\Windows\System\CywdKim.exe
  C:\Windows\System\CywdKim.exe
  2⤵
  PID:8108
- C:\Windows\System\wLctcAj.exe
  C:\Windows\System\wLctcAj.exe
  2⤵
  PID:8128
- C:\Windows\System\dWeglVy.exe
  C:\Windows\System\dWeglVy.exe
  2⤵
  PID:8148
- C:\Windows\System\gVsSmwF.exe
  C:\Windows\System\gVsSmwF.exe
  2⤵
  PID:8164
- C:\Windows\System\EtNVJxW.exe
  C:\Windows\System\EtNVJxW.exe
  2⤵
  PID:8180
- C:\Windows\System\XYAkvMr.exe
  C:\Windows\System\XYAkvMr.exe
  2⤵
  PID:7196
- C:\Windows\System\uVeVhby.exe
  C:\Windows\System\uVeVhby.exe
  2⤵
  PID:7260
- C:\Windows\System\hicUbQq.exe
  C:\Windows\System\hicUbQq.exe
  2⤵
  PID:6452
- C:\Windows\System\oPqHOkL.exe
  C:\Windows\System\oPqHOkL.exe
  2⤵
  PID:6360
- C:\Windows\System\fovufly.exe
  C:\Windows\System\fovufly.exe
  2⤵
  PID:7012
- C:\Windows\System\pJXUSbX.exe
  C:\Windows\System\pJXUSbX.exe
  2⤵
  PID:6964
- C:\Windows\System\oQaxUCr.exe
  C:\Windows\System\oQaxUCr.exe
  2⤵
  PID:6480
- C:\Windows\System\VPaoQNV.exe
  C:\Windows\System\VPaoQNV.exe
  2⤵
  PID:6564
- C:\Windows\System\QFOIERm.exe
  C:\Windows\System\QFOIERm.exe
  2⤵
  PID:6956
- C:\Windows\System\GeCOaBe.exe
  C:\Windows\System\GeCOaBe.exe
  2⤵
  PID:6912
- C:\Windows\System\tBRezTZ.exe
  C:\Windows\System\tBRezTZ.exe
  2⤵
  PID:6256
- C:\Windows\System\RphfuKw.exe
  C:\Windows\System\RphfuKw.exe
  2⤵
  PID:7104
- C:\Windows\System\VIOOUWe.exe
  C:\Windows\System\VIOOUWe.exe
  2⤵
  PID:5720
- C:\Windows\System\TEiemIa.exe
  C:\Windows\System\TEiemIa.exe
  2⤵
  PID:7184
- C:\Windows\System\irQAikM.exe
  C:\Windows\System\irQAikM.exe
  2⤵
  PID:7284
- C:\Windows\System\pFWtsYL.exe
  C:\Windows\System\pFWtsYL.exe
  2⤵
  PID:7276
- C:\Windows\System\snhFdsc.exe
  C:\Windows\System\snhFdsc.exe
  2⤵
  PID:7304
- C:\Windows\System\AGsypSx.exe
  C:\Windows\System\AGsypSx.exe
  2⤵
  PID:7324
- C:\Windows\System\BvQnCMU.exe
  C:\Windows\System\BvQnCMU.exe
  2⤵
  PID:7352
- C:\Windows\System\xfdWkwt.exe
  C:\Windows\System\xfdWkwt.exe
  2⤵
  PID:7384
- C:\Windows\System\yPjWhzM.exe
  C:\Windows\System\yPjWhzM.exe
  2⤵
  PID:7456
- C:\Windows\System\lypUNLd.exe
  C:\Windows\System\lypUNLd.exe
  2⤵
  PID:7548
- C:\Windows\System\ZWdnlCe.exe
  C:\Windows\System\ZWdnlCe.exe
  2⤵
  PID:7588
- C:\Windows\System\iHEqZhH.exe
  C:\Windows\System\iHEqZhH.exe
  2⤵
  PID:7432
- C:\Windows\System\UMaeMkX.exe
  C:\Windows\System\UMaeMkX.exe
  2⤵
  PID:7684
- C:\Windows\System\DHqmvns.exe
  C:\Windows\System\DHqmvns.exe
  2⤵
  PID:7748
- C:\Windows\System\cvzYFuU.exe
  C:\Windows\System\cvzYFuU.exe
  2⤵
  PID:7816
- C:\Windows\System\ncOkRaP.exe
  C:\Windows\System\ncOkRaP.exe
  2⤵
  PID:7756
- C:\Windows\System\rQInUYx.exe
  C:\Windows\System\rQInUYx.exe
  2⤵
  PID:7916
- C:\Windows\System\cuDNLld.exe
  C:\Windows\System\cuDNLld.exe
  2⤵
  PID:7980
- C:\Windows\System\HDzeRZR.exe
  C:\Windows\System\HDzeRZR.exe
  2⤵
  PID:7404
- C:\Windows\System\PlVYjlH.exe
  C:\Windows\System\PlVYjlH.exe
  2⤵
  PID:7440
- C:\Windows\System\bChDbYe.exe
  C:\Windows\System\bChDbYe.exe
  2⤵
  PID:7468
- C:\Windows\System\xoNHQIe.exe
  C:\Windows\System\xoNHQIe.exe
  2⤵
  PID:8048
- C:\Windows\System\aVOWupM.exe
  C:\Windows\System\aVOWupM.exe
  2⤵
  PID:7568
- C:\Windows\System\VVmtpIE.exe
  C:\Windows\System\VVmtpIE.exe
  2⤵
  PID:7604
- C:\Windows\System\DjhJxEY.exe
  C:\Windows\System\DjhJxEY.exe
  2⤵
  PID:8032
- C:\Windows\System\XFTgimO.exe
  C:\Windows\System\XFTgimO.exe
  2⤵
  PID:8124
- C:\Windows\System\lRqRtDC.exe
  C:\Windows\System\lRqRtDC.exe
  2⤵
  PID:7732
- C:\Windows\System\yWtdtGW.exe
  C:\Windows\System\yWtdtGW.exe
  2⤵
  PID:7800
- C:\Windows\System\qAkeRpx.exe
  C:\Windows\System\qAkeRpx.exe
  2⤵
  PID:8172
- C:\Windows\System\GNcoMHf.exe
  C:\Windows\System\GNcoMHf.exe
  2⤵
  PID:8176
- C:\Windows\System\AxDxDfI.exe
  C:\Windows\System\AxDxDfI.exe
  2⤵
  PID:6800
- C:\Windows\System\SdkGven.exe
  C:\Windows\System\SdkGven.exe
  2⤵
  PID:6916
- C:\Windows\System\KAVRleA.exe
  C:\Windows\System\KAVRleA.exe
  2⤵
  PID:6568
- C:\Windows\System\VyNuhon.exe
  C:\Windows\System\VyNuhon.exe
  2⤵
  PID:6652
- C:\Windows\System\COpjMsb.exe
  C:\Windows\System\COpjMsb.exe
  2⤵
  PID:6884
- C:\Windows\System\mPkCdrC.exe
  C:\Windows\System\mPkCdrC.exe
  2⤵
  PID:5212
- C:\Windows\System\mHYueTN.exe
  C:\Windows\System\mHYueTN.exe
  2⤵
  PID:7180
- C:\Windows\System\HeRSjlf.exe
  C:\Windows\System\HeRSjlf.exe
  2⤵
  PID:7348
- C:\Windows\System\UjbMiGN.exe
  C:\Windows\System\UjbMiGN.exe
  2⤵
  PID:7556
- C:\Windows\System\IDBeaYm.exe
  C:\Windows\System\IDBeaYm.exe
  2⤵
  PID:7680
- C:\Windows\System\pUGmCmj.exe
  C:\Windows\System\pUGmCmj.exe
  2⤵
  PID:7320
- C:\Windows\System\IwMbPmr.exe
  C:\Windows\System\IwMbPmr.exe
  2⤵
  PID:7516
- C:\Windows\System\LeblTLd.exe
  C:\Windows\System\LeblTLd.exe
  2⤵
  PID:7888
- C:\Windows\System\QSFgcou.exe
  C:\Windows\System\QSFgcou.exe
  2⤵
  PID:7536
- C:\Windows\System\BKdXCho.exe
  C:\Windows\System\BKdXCho.exe
  2⤵
  PID:7636
- C:\Windows\System\bJZhnce.exe
  C:\Windows\System\bJZhnce.exe
  2⤵
  PID:7768
- C:\Windows\System\ozyElkI.exe
  C:\Windows\System\ozyElkI.exe
  2⤵
  PID:7500
- C:\Windows\System\GUYpGBY.exe
  C:\Windows\System\GUYpGBY.exe
  2⤵
  PID:8088
- C:\Windows\System\iBmWGMW.exe
  C:\Windows\System\iBmWGMW.exe
  2⤵
  PID:7232
- C:\Windows\System\MXeQKtX.exe
  C:\Windows\System\MXeQKtX.exe
  2⤵
  PID:7296
- C:\Windows\System\pcqxHwz.exe
  C:\Windows\System\pcqxHwz.exe
  2⤵
  PID:7484
- C:\Windows\System\hzFgOEe.exe
  C:\Windows\System\hzFgOEe.exe
  2⤵
  PID:7716
- C:\Windows\System\gHRmhKz.exe
  C:\Windows\System\gHRmhKz.exe
  2⤵
  PID:7952
- C:\Windows\System\onbKckx.exe
  C:\Windows\System\onbKckx.exe
  2⤵
  PID:7720
- C:\Windows\System\pFEzJhr.exe
  C:\Windows\System\pFEzJhr.exe
  2⤵
  PID:6200
- C:\Windows\System\YtuOFpa.exe
  C:\Windows\System\YtuOFpa.exe
  2⤵
  PID:6700
- C:\Windows\System\KJttfVY.exe
  C:\Windows\System\KJttfVY.exe
  2⤵
  PID:6524
- C:\Windows\System\AhXKmsS.exe
  C:\Windows\System\AhXKmsS.exe
  2⤵
  PID:7472
- C:\Windows\System\axQeoVo.exe
  C:\Windows\System\axQeoVo.exe
  2⤵
  PID:7840
- C:\Windows\System\MwyYLAJ.exe
  C:\Windows\System\MwyYLAJ.exe
  2⤵
  PID:7884
- C:\Windows\System\YVslAqS.exe
  C:\Windows\System\YVslAqS.exe
  2⤵
  PID:7932
- C:\Windows\System\hHPDJLK.exe
  C:\Windows\System\hHPDJLK.exe
  2⤵
  PID:8060
- C:\Windows\System\jffCoIk.exe
  C:\Windows\System\jffCoIk.exe
  2⤵
  PID:8144
- C:\Windows\System\fhFFJzA.exe
  C:\Windows\System\fhFFJzA.exe
  2⤵
  PID:8140
- C:\Windows\System\HumCOQK.exe
  C:\Windows\System\HumCOQK.exe
  2⤵
  PID:8136
- C:\Windows\System\mFPTbbx.exe
  C:\Windows\System\mFPTbbx.exe
  2⤵
  PID:7288
- C:\Windows\System\TiYPcOY.exe
  C:\Windows\System\TiYPcOY.exe
  2⤵
  PID:7008
- C:\Windows\System\WhUCTYJ.exe
  C:\Windows\System\WhUCTYJ.exe
  2⤵
  PID:7504
- C:\Windows\System\lAEZIjP.exe
  C:\Windows\System\lAEZIjP.exe
  2⤵
  PID:7964
- C:\Windows\System\iHLutJq.exe
  C:\Windows\System\iHLutJq.exe
  2⤵
  PID:8188
- C:\Windows\System\NgFjPYr.exe
  C:\Windows\System\NgFjPYr.exe
  2⤵
  PID:7652
- C:\Windows\System\JAvpMLF.exe
  C:\Windows\System\JAvpMLF.exe
  2⤵
  PID:7836
- C:\Windows\System\nvFcZIu.exe
  C:\Windows\System\nvFcZIu.exe
  2⤵
  PID:8028
- C:\Windows\System\MSdCESs.exe
  C:\Windows\System\MSdCESs.exe
  2⤵
  PID:8104
- C:\Windows\System\TzYsHNr.exe
  C:\Windows\System\TzYsHNr.exe
  2⤵
  PID:7244
- C:\Windows\System\waOhCOG.exe
  C:\Windows\System\waOhCOG.exe
  2⤵
  PID:7868
- C:\Windows\System\QJcEUMh.exe
  C:\Windows\System\QJcEUMh.exe
  2⤵
  PID:7264
- C:\Windows\System\yIcRtCp.exe
  C:\Windows\System\yIcRtCp.exe
  2⤵
  PID:7904
- C:\Windows\System\OHEHXsa.exe
  C:\Windows\System\OHEHXsa.exe
  2⤵
  PID:7620
- C:\Windows\System\qpFXWBp.exe
  C:\Windows\System\qpFXWBp.exe
  2⤵
  PID:8200
- C:\Windows\System\TXfRtiJ.exe
  C:\Windows\System\TXfRtiJ.exe
  2⤵
  PID:8216
- C:\Windows\System\NaTlSCg.exe
  C:\Windows\System\NaTlSCg.exe
  2⤵
  PID:8232
- C:\Windows\System\KjljlEB.exe
  C:\Windows\System\KjljlEB.exe
  2⤵
  PID:8248
- C:\Windows\System\fhzlNfO.exe
  C:\Windows\System\fhzlNfO.exe
  2⤵
  PID:8264
- C:\Windows\System\DzoHVlk.exe
  C:\Windows\System\DzoHVlk.exe
  2⤵
  PID:8280
- C:\Windows\System\JuHNenE.exe
  C:\Windows\System\JuHNenE.exe
  2⤵
  PID:8296
- C:\Windows\System\UtyJafG.exe
  C:\Windows\System\UtyJafG.exe
  2⤵
  PID:8312
- C:\Windows\System\TzjeEXJ.exe
  C:\Windows\System\TzjeEXJ.exe
  2⤵
  PID:8328
- C:\Windows\System\tXeEyBi.exe
  C:\Windows\System\tXeEyBi.exe
  2⤵
  PID:8344
- C:\Windows\System\eLlhBKz.exe
  C:\Windows\System\eLlhBKz.exe
  2⤵
  PID:8360
- C:\Windows\System\rwvmLSv.exe
  C:\Windows\System\rwvmLSv.exe
  2⤵
  PID:8376
- C:\Windows\System\THZdCqf.exe
  C:\Windows\System\THZdCqf.exe
  2⤵
  PID:8392
- C:\Windows\System\nVNbzrq.exe
  C:\Windows\System\nVNbzrq.exe
  2⤵
  PID:8408
- C:\Windows\System\pBMdANf.exe
  C:\Windows\System\pBMdANf.exe
  2⤵
  PID:8424
- C:\Windows\System\aCkIhXe.exe
  C:\Windows\System\aCkIhXe.exe
  2⤵
  PID:8440
- C:\Windows\System\QVzAIGe.exe
  C:\Windows\System\QVzAIGe.exe
  2⤵
  PID:8456
- C:\Windows\System\DjeXSWy.exe
  C:\Windows\System\DjeXSWy.exe
  2⤵
  PID:8472
- C:\Windows\System\aotIUVf.exe
  C:\Windows\System\aotIUVf.exe
  2⤵
  PID:8488
- C:\Windows\System\JqFgOwE.exe
  C:\Windows\System\JqFgOwE.exe
  2⤵
  PID:8504
- C:\Windows\System\zpvlfWL.exe
  C:\Windows\System\zpvlfWL.exe
  2⤵
  PID:8520
- C:\Windows\System\XGNlWdi.exe
  C:\Windows\System\XGNlWdi.exe
  2⤵
  PID:8536
- C:\Windows\System\cUEgfOH.exe
  C:\Windows\System\cUEgfOH.exe
  2⤵
  PID:8552
- C:\Windows\System\ijdlGfo.exe
  C:\Windows\System\ijdlGfo.exe
  2⤵
  PID:8568
- C:\Windows\System\vuLGBpU.exe
  C:\Windows\System\vuLGBpU.exe
  2⤵
  PID:8584
- C:\Windows\System\jDHsbbK.exe
  C:\Windows\System\jDHsbbK.exe
  2⤵
  PID:8600
- C:\Windows\System\tfacaoV.exe
  C:\Windows\System\tfacaoV.exe
  2⤵
  PID:8616
- C:\Windows\System\eGRiyis.exe
  C:\Windows\System\eGRiyis.exe
  2⤵
  PID:8632
- C:\Windows\System\SikLvuO.exe
  C:\Windows\System\SikLvuO.exe
  2⤵
  PID:8648
- C:\Windows\System\OEfSEmf.exe
  C:\Windows\System\OEfSEmf.exe
  2⤵
  PID:8664
- C:\Windows\System\OABUfPT.exe
  C:\Windows\System\OABUfPT.exe
  2⤵
  PID:8680
- C:\Windows\System\iOYBUtd.exe
  C:\Windows\System\iOYBUtd.exe
  2⤵
  PID:8696
- C:\Windows\System\lAhnJpa.exe
  C:\Windows\System\lAhnJpa.exe
  2⤵
  PID:8712
- C:\Windows\System\lCbFWks.exe
  C:\Windows\System\lCbFWks.exe
  2⤵
  PID:8728
- C:\Windows\System\bEJNonG.exe
  C:\Windows\System\bEJNonG.exe
  2⤵
  PID:8748
- C:\Windows\System\aBBzbYQ.exe
  C:\Windows\System\aBBzbYQ.exe
  2⤵
  PID:8764
- C:\Windows\System\spNQwyz.exe
  C:\Windows\System\spNQwyz.exe
  2⤵
  PID:8784
- C:\Windows\System\vSmoAmV.exe
  C:\Windows\System\vSmoAmV.exe
  2⤵
  PID:8800
- C:\Windows\System\vbpiKJR.exe
  C:\Windows\System\vbpiKJR.exe
  2⤵
  PID:8816
- C:\Windows\System\EhkAjfW.exe
  C:\Windows\System\EhkAjfW.exe
  2⤵
  PID:8832
- C:\Windows\System\WVEhfac.exe
  C:\Windows\System\WVEhfac.exe
  2⤵
  PID:8848
- C:\Windows\System\FloUOKR.exe
  C:\Windows\System\FloUOKR.exe
  2⤵
  PID:8864
- C:\Windows\System\TyLlSvO.exe
  C:\Windows\System\TyLlSvO.exe
  2⤵
  PID:8880
- C:\Windows\System\UzbNboZ.exe
  C:\Windows\System\UzbNboZ.exe
  2⤵
  PID:8900
- C:\Windows\System\XkGYqBz.exe
  C:\Windows\System\XkGYqBz.exe
  2⤵
  PID:8916
- C:\Windows\System\faIHoZA.exe
  C:\Windows\System\faIHoZA.exe
  2⤵
  PID:8932
- C:\Windows\System\VTifvNW.exe
  C:\Windows\System\VTifvNW.exe
  2⤵
  PID:8948
- C:\Windows\System\IiKkSTi.exe
  C:\Windows\System\IiKkSTi.exe
  2⤵
  PID:8964
- C:\Windows\System\GAbqEYr.exe
  C:\Windows\System\GAbqEYr.exe
  2⤵
  PID:8980
- C:\Windows\System\qmLiDuW.exe
  C:\Windows\System\qmLiDuW.exe
  2⤵
  PID:8996
- C:\Windows\System\ozXxxdR.exe
  C:\Windows\System\ozXxxdR.exe
  2⤵
  PID:9012
- C:\Windows\System\sSoxBxX.exe
  C:\Windows\System\sSoxBxX.exe
  2⤵
  PID:9028
- C:\Windows\System\iwugSSZ.exe
  C:\Windows\System\iwugSSZ.exe
  2⤵
  PID:9044
- C:\Windows\System\UtLCcTH.exe
  C:\Windows\System\UtLCcTH.exe
  2⤵
  PID:9060
- C:\Windows\System\FfTtUoc.exe
  C:\Windows\System\FfTtUoc.exe
  2⤵
  PID:9076
- C:\Windows\System\IQKRJmv.exe
  C:\Windows\System\IQKRJmv.exe
  2⤵
  PID:9092
- C:\Windows\System\nsaIfem.exe
  C:\Windows\System\nsaIfem.exe
  2⤵
  PID:9108
- C:\Windows\System\VtYFjyN.exe
  C:\Windows\System\VtYFjyN.exe
  2⤵
  PID:9124
- C:\Windows\System\NSVNnUZ.exe
  C:\Windows\System\NSVNnUZ.exe
  2⤵
  PID:9140
- C:\Windows\System\yeiVQzS.exe
  C:\Windows\System\yeiVQzS.exe
  2⤵
  PID:9156
- C:\Windows\System\LKdJrVr.exe
  C:\Windows\System\LKdJrVr.exe
  2⤵
  PID:9172
- C:\Windows\System\mvGvUPl.exe
  C:\Windows\System\mvGvUPl.exe
  2⤵
  PID:9188
- C:\Windows\System\pKDoXBN.exe
  C:\Windows\System\pKDoXBN.exe
  2⤵
  PID:9204
- C:\Windows\System\ngUXWnq.exe
  C:\Windows\System\ngUXWnq.exe
  2⤵
  PID:4188
- C:\Windows\System\nIRVSZL.exe
  C:\Windows\System\nIRVSZL.exe
  2⤵
  PID:6204
- C:\Windows\System\YJkekFZ.exe
  C:\Windows\System\YJkekFZ.exe
  2⤵
  PID:8276
- C:\Windows\System\Rfivito.exe
  C:\Windows\System\Rfivito.exe
  2⤵
  PID:8368
- C:\Windows\System\iRtyNaQ.exe
  C:\Windows\System\iRtyNaQ.exe
  2⤵
  PID:8228
- C:\Windows\System\ZBsPzcS.exe
  C:\Windows\System\ZBsPzcS.exe
  2⤵
  PID:7900
- C:\Windows\System\lUqQMYd.exe
  C:\Windows\System\lUqQMYd.exe
  2⤵
  PID:8468
- C:\Windows\System\enCfIat.exe
  C:\Windows\System\enCfIat.exe
  2⤵
  PID:8528
- C:\Windows\System\goqSGma.exe
  C:\Windows\System\goqSGma.exe
  2⤵
  PID:8256
- C:\Windows\System\bQFyuel.exe
  C:\Windows\System\bQFyuel.exe
  2⤵
  PID:8196
- C:\Windows\System\MWkLSln.exe
  C:\Windows\System\MWkLSln.exe
  2⤵
  PID:8292
- C:\Windows\System\Xmjzqwm.exe
  C:\Windows\System\Xmjzqwm.exe
  2⤵
  PID:8384
- C:\Windows\System\JucRkdU.exe
  C:\Windows\System\JucRkdU.exe
  2⤵
  PID:8452
- C:\Windows\System\DIAWgxp.exe
  C:\Windows\System\DIAWgxp.exe
  2⤵
  PID:8516
- C:\Windows\System\LhSiSXZ.exe
  C:\Windows\System\LhSiSXZ.exe
  2⤵
  PID:8596
- C:\Windows\System\CgxcjrK.exe
  C:\Windows\System\CgxcjrK.exe
  2⤵
  PID:8660
- C:\Windows\System\OTMhrdO.exe
  C:\Windows\System\OTMhrdO.exe
  2⤵
  PID:8692
- C:\Windows\System\MmglAjB.exe
  C:\Windows\System\MmglAjB.exe
  2⤵
  PID:8672
- C:\Windows\System\wIZXqOQ.exe
  C:\Windows\System\wIZXqOQ.exe
  2⤵
  PID:8756
- C:\Windows\System\BexzAsE.exe
  C:\Windows\System\BexzAsE.exe
  2⤵
  PID:8792
- C:\Windows\System\xnufuRd.exe
  C:\Windows\System\xnufuRd.exe
  2⤵
  PID:8856
- C:\Windows\System\Srnqfny.exe
  C:\Windows\System\Srnqfny.exe
  2⤵
  PID:8888
- C:\Windows\System\uiZEmFZ.exe
  C:\Windows\System\uiZEmFZ.exe
  2⤵
  PID:8772
- C:\Windows\System\hExlZCC.exe
  C:\Windows\System\hExlZCC.exe
  2⤵
  PID:8876
- C:\Windows\System\iMJDCCp.exe
  C:\Windows\System\iMJDCCp.exe
  2⤵
  PID:8896
- C:\Windows\System\fCryHeS.exe
  C:\Windows\System\fCryHeS.exe
  2⤵
  PID:8992
- C:\Windows\System\Slptbdg.exe
  C:\Windows\System\Slptbdg.exe
  2⤵
  PID:9052
- C:\Windows\System\epUOuVc.exe
  C:\Windows\System\epUOuVc.exe
  2⤵
  PID:9088
- C:\Windows\System\lMBmYoQ.exe
  C:\Windows\System\lMBmYoQ.exe
  2⤵
  PID:9152
- C:\Windows\System\XaKgnew.exe
  C:\Windows\System\XaKgnew.exe
  2⤵
  PID:7996
- C:\Windows\System\uFdZDKH.exe
  C:\Windows\System\uFdZDKH.exe
  2⤵
  PID:8944
- C:\Windows\System\lFDOCKH.exe
  C:\Windows\System\lFDOCKH.exe
  2⤵
  PID:9004
- C:\Windows\System\fZuYvjP.exe
  C:\Windows\System\fZuYvjP.exe
  2⤵
  PID:9136
- C:\Windows\System\uOtgGJs.exe
  C:\Windows\System\uOtgGJs.exe
  2⤵
  PID:8464
- C:\Windows\System\oZFMIES.exe
  C:\Windows\System\oZFMIES.exe
  2⤵
  PID:9196
- C:\Windows\System\cxlPmrH.exe
  C:\Windows\System\cxlPmrH.exe
  2⤵
  PID:8336
- C:\Windows\System\AIyEWxo.exe
  C:\Windows\System\AIyEWxo.exe
  2⤵
  PID:9068
- C:\Windows\System\WHlVDlW.exe
  C:\Windows\System\WHlVDlW.exe
  2⤵
  PID:8496
- C:\Windows\System\VBqknQY.exe
  C:\Windows\System\VBqknQY.exe
  2⤵
  PID:8100
- C:\Windows\System\moZRrKQ.exe
  C:\Windows\System\moZRrKQ.exe
  2⤵
  PID:8324
- C:\Windows\System\KscldgG.exe
  C:\Windows\System\KscldgG.exe
  2⤵
  PID:8484
- C:\Windows\System\fTXyQEG.exe
  C:\Windows\System\fTXyQEG.exe
  2⤵
  PID:8656
- C:\Windows\System\MbdtHGy.exe
  C:\Windows\System\MbdtHGy.exe
  2⤵
  PID:8644
- C:\Windows\System\kvXdGkn.exe
  C:\Windows\System\kvXdGkn.exe
  2⤵
  PID:8624
- C:\Windows\System\GMfohYB.exe
  C:\Windows\System\GMfohYB.exe
  2⤵
  PID:8912
- C:\Windows\System\IdVeKxa.exe
  C:\Windows\System\IdVeKxa.exe
  2⤵
  PID:8812
- C:\Windows\System\ErdexGU.exe
  C:\Windows\System\ErdexGU.exe
  2⤵
  PID:8960
- C:\Windows\System\WBiGYzx.exe
  C:\Windows\System\WBiGYzx.exe
  2⤵
  PID:7308
- C:\Windows\System\fxsfUoJ.exe
  C:\Windows\System\fxsfUoJ.exe
  2⤵
  PID:9148
- C:\Windows\System\CsHvtpx.exe
  C:\Windows\System\CsHvtpx.exe
  2⤵
  PID:9168
- C:\Windows\System\tZXsOMS.exe
  C:\Windows\System\tZXsOMS.exe
  2⤵
  PID:8500
- C:\Windows\System\ktHNvFw.exe
  C:\Windows\System\ktHNvFw.exe
  2⤵
  PID:8708
- C:\Windows\System\eJfKwbN.exe
  C:\Windows\System\eJfKwbN.exe
  2⤵
  PID:9084
- C:\Windows\System\QojfCOe.exe
  C:\Windows\System\QojfCOe.exe
  2⤵
  PID:8940
- C:\Windows\System\XLNIZOQ.exe
  C:\Windows\System\XLNIZOQ.exe
  2⤵
  PID:8208
- C:\Windows\System\kQwEZqt.exe
  C:\Windows\System\kQwEZqt.exe
  2⤵
  PID:8224
- C:\Windows\System\RBzDMaF.exe
  C:\Windows\System\RBzDMaF.exe
  2⤵
  PID:8736
- C:\Windows\System\FNvJpZK.exe
  C:\Windows\System\FNvJpZK.exe
  2⤵
  PID:9072
- C:\Windows\System\YSWeoDb.exe
  C:\Windows\System\YSWeoDb.exe
  2⤵
  PID:8976
- C:\Windows\System\kflaPkb.exe
  C:\Windows\System\kflaPkb.exe
  2⤵
  PID:9020
- C:\Windows\System\mzwJLxC.exe
  C:\Windows\System\mzwJLxC.exe
  2⤵
  PID:9228
- C:\Windows\System\GCHKNOF.exe
  C:\Windows\System\GCHKNOF.exe
  2⤵
  PID:9244
- C:\Windows\System\DkLcaPG.exe
  C:\Windows\System\DkLcaPG.exe
  2⤵
  PID:9260
- C:\Windows\System\wWjCXQx.exe
  C:\Windows\System\wWjCXQx.exe
  2⤵
  PID:9276
- C:\Windows\System\PBwUmBE.exe
  C:\Windows\System\PBwUmBE.exe
  2⤵
  PID:9292
- C:\Windows\System\fZQqYtN.exe
  C:\Windows\System\fZQqYtN.exe
  2⤵
  PID:9308
- C:\Windows\System\VBryarB.exe
  C:\Windows\System\VBryarB.exe
  2⤵
  PID:9324
- C:\Windows\System\HodKPax.exe
  C:\Windows\System\HodKPax.exe
  2⤵
  PID:9340
- C:\Windows\System\qqTVfty.exe
  C:\Windows\System\qqTVfty.exe
  2⤵
  PID:9356
- C:\Windows\System\TJuHCuw.exe
  C:\Windows\System\TJuHCuw.exe
  2⤵
  PID:9372
- C:\Windows\System\OiMHUGP.exe
  C:\Windows\System\OiMHUGP.exe
  2⤵
  PID:9388
- C:\Windows\System\kCjzkRK.exe
  C:\Windows\System\kCjzkRK.exe
  2⤵
  PID:9404
- C:\Windows\System\roqwzIz.exe
  C:\Windows\System\roqwzIz.exe
  2⤵
  PID:9420
- C:\Windows\System\HAOpOaN.exe
  C:\Windows\System\HAOpOaN.exe
  2⤵
  PID:9436
- C:\Windows\System\gnbMNuY.exe
  C:\Windows\System\gnbMNuY.exe
  2⤵
  PID:9452
- C:\Windows\System\IQQBzEa.exe
  C:\Windows\System\IQQBzEa.exe
  2⤵
  PID:9468
- C:\Windows\System\ESErLhY.exe
  C:\Windows\System\ESErLhY.exe
  2⤵
  PID:9488
- C:\Windows\System\VQDJalF.exe
  C:\Windows\System\VQDJalF.exe
  2⤵
  PID:9504
- C:\Windows\System\RqeBGlJ.exe
  C:\Windows\System\RqeBGlJ.exe
  2⤵
  PID:9520
- C:\Windows\System\yBwnVpB.exe
  C:\Windows\System\yBwnVpB.exe
  2⤵
  PID:9536
- C:\Windows\System\gocuxWM.exe
  C:\Windows\System\gocuxWM.exe
  2⤵
  PID:9552
- C:\Windows\System\wynMaQQ.exe
  C:\Windows\System\wynMaQQ.exe
  2⤵
  PID:9568
- C:\Windows\System\dAxfJfR.exe
  C:\Windows\System\dAxfJfR.exe
  2⤵
  PID:9584
- C:\Windows\System\HMRjZZj.exe
  C:\Windows\System\HMRjZZj.exe
  2⤵
  PID:9600
- C:\Windows\System\trOmMFV.exe
  C:\Windows\System\trOmMFV.exe
  2⤵
  PID:9616
- C:\Windows\System\cRCQbKS.exe
  C:\Windows\System\cRCQbKS.exe
  2⤵
  PID:9632
- C:\Windows\System\HdZhLLF.exe
  C:\Windows\System\HdZhLLF.exe
  2⤵
  PID:9648
- C:\Windows\System\CqAKqPY.exe
  C:\Windows\System\CqAKqPY.exe
  2⤵
  PID:9664
- C:\Windows\System\wQySrzQ.exe
  C:\Windows\System\wQySrzQ.exe
  2⤵
  PID:9680
- C:\Windows\System\PZdpwrI.exe
  C:\Windows\System\PZdpwrI.exe
  2⤵
  PID:9696
- C:\Windows\System\VsZJtGe.exe
  C:\Windows\System\VsZJtGe.exe
  2⤵
  PID:9712
- C:\Windows\System\BchhSAx.exe
  C:\Windows\System\BchhSAx.exe
  2⤵
  PID:9728
- C:\Windows\System\dEHZFKT.exe
  C:\Windows\System\dEHZFKT.exe
  2⤵
  PID:9744
- C:\Windows\System\DaYZXcT.exe
  C:\Windows\System\DaYZXcT.exe
  2⤵
  PID:9760
- C:\Windows\System\QbWeLPd.exe
  C:\Windows\System\QbWeLPd.exe
  2⤵
  PID:9776
- C:\Windows\System\OAHLPxj.exe
  C:\Windows\System\OAHLPxj.exe
  2⤵
  PID:9792
- C:\Windows\System\mUYrfUP.exe
  C:\Windows\System\mUYrfUP.exe
  2⤵
  PID:9808
- C:\Windows\System\TmuZqFS.exe
  C:\Windows\System\TmuZqFS.exe
  2⤵
  PID:9824
- C:\Windows\System\YakNSJz.exe
  C:\Windows\System\YakNSJz.exe
  2⤵
  PID:9840
- C:\Windows\System\XpPDZqp.exe
  C:\Windows\System\XpPDZqp.exe
  2⤵
  PID:9856
- C:\Windows\System\ipRJbqJ.exe
  C:\Windows\System\ipRJbqJ.exe
  2⤵
  PID:9872
- C:\Windows\System\fRsDuzv.exe
  C:\Windows\System\fRsDuzv.exe
  2⤵
  PID:9888
- C:\Windows\System\lBOtbNx.exe
  C:\Windows\System\lBOtbNx.exe
  2⤵
  PID:9904
- C:\Windows\System\ucfXXTS.exe
  C:\Windows\System\ucfXXTS.exe
  2⤵
  PID:9920
- C:\Windows\System\aUnvYDY.exe
  C:\Windows\System\aUnvYDY.exe
  2⤵
  PID:9936
- C:\Windows\System\iPwTbFc.exe
  C:\Windows\System\iPwTbFc.exe
  2⤵
  PID:9952
- C:\Windows\System\wXjaHLf.exe
  C:\Windows\System\wXjaHLf.exe
  2⤵
  PID:9968
- C:\Windows\System\vvPnsUb.exe
  C:\Windows\System\vvPnsUb.exe
  2⤵
  PID:9984
- C:\Windows\System\tvFmNbJ.exe
  C:\Windows\System\tvFmNbJ.exe
  2⤵
  PID:10000
- C:\Windows\System\HOwVXGS.exe
  C:\Windows\System\HOwVXGS.exe
  2⤵
  PID:10016
- C:\Windows\System\QTZXLxp.exe
  C:\Windows\System\QTZXLxp.exe
  2⤵
  PID:10032
- C:\Windows\System\bhcknhs.exe
  C:\Windows\System\bhcknhs.exe
  2⤵
  PID:10048
- C:\Windows\System\tcpKHjB.exe
  C:\Windows\System\tcpKHjB.exe
  2⤵
  PID:10064
- C:\Windows\System\erAWUaY.exe
  C:\Windows\System\erAWUaY.exe
  2⤵
  PID:10080
- C:\Windows\System\VNoVcqJ.exe
  C:\Windows\System\VNoVcqJ.exe
  2⤵
  PID:10096
- C:\Windows\System\InLeHfv.exe
  C:\Windows\System\InLeHfv.exe
  2⤵
  PID:10112
- C:\Windows\System\tOXGKqw.exe
  C:\Windows\System\tOXGKqw.exe
  2⤵
  PID:10128
- C:\Windows\System\NpIsaIR.exe
  C:\Windows\System\NpIsaIR.exe
  2⤵
  PID:10144
- C:\Windows\System\EAvHWrQ.exe
  C:\Windows\System\EAvHWrQ.exe
  2⤵
  PID:10220
- C:\Windows\System\QvvCiFZ.exe
  C:\Windows\System\QvvCiFZ.exe
  2⤵
  PID:9220
- C:\Windows\System\xmfDrFZ.exe
  C:\Windows\System\xmfDrFZ.exe
  2⤵
  PID:9284
- C:\Windows\System\vxRWVpx.exe
  C:\Windows\System\vxRWVpx.exe
  2⤵
  PID:9348
- C:\Windows\System\vEdWwNI.exe
  C:\Windows\System\vEdWwNI.exe
  2⤵
  PID:8956
- C:\Windows\System\DkEYTqT.exe
  C:\Windows\System\DkEYTqT.exe
  2⤵
  PID:9444
- C:\Windows\System\XmdXJMd.exe
  C:\Windows\System\XmdXJMd.exe
  2⤵
  PID:9512
- C:\Windows\System\rullstt.exe
  C:\Windows\System\rullstt.exe
  2⤵
  PID:9576
- C:\Windows\System\TCAdgCk.exe
  C:\Windows\System\TCAdgCk.exe
  2⤵
  PID:8872
- C:\Windows\System\FoRPufp.exe
  C:\Windows\System\FoRPufp.exe
  2⤵
  PID:9236
- C:\Windows\System\KizuWdD.exe
  C:\Windows\System\KizuWdD.exe
  2⤵
  PID:8576
- C:\Windows\System\tAryGdm.exe
  C:\Windows\System\tAryGdm.exe
  2⤵
  PID:8808
- C:\Windows\System\ALwFPhM.exe
  C:\Windows\System\ALwFPhM.exe
  2⤵
  PID:9272
- C:\Windows\System\AZbmRGA.exe
  C:\Windows\System\AZbmRGA.exe
  2⤵
  PID:9368
- C:\Windows\System\OEjXvAo.exe
  C:\Windows\System\OEjXvAo.exe
  2⤵
  PID:9432
- C:\Windows\System\GNzEerI.exe
  C:\Windows\System\GNzEerI.exe
  2⤵
  PID:9500
- C:\Windows\System\iPqacSz.exe
  C:\Windows\System\iPqacSz.exe
  2⤵
  PID:9564
- C:\Windows\System\SLqTDwS.exe
  C:\Windows\System\SLqTDwS.exe
  2⤵
  PID:9612
- C:\Windows\System\cQlLlsa.exe
  C:\Windows\System\cQlLlsa.exe
  2⤵
  PID:9672
- C:\Windows\System\YhDPFRs.exe
  C:\Windows\System\YhDPFRs.exe
  2⤵
  PID:9624
- C:\Windows\System\lyhcmek.exe
  C:\Windows\System\lyhcmek.exe
  2⤵
  PID:9740
- C:\Windows\System\vrCFxbI.exe
  C:\Windows\System\vrCFxbI.exe
  2⤵
  PID:9800
- C:\Windows\System\jDlhQEc.exe
  C:\Windows\System\jDlhQEc.exe
  2⤵
  PID:9752
- C:\Windows\System\iZSkZMa.exe
  C:\Windows\System\iZSkZMa.exe
  2⤵
  PID:9720
- C:\Windows\System\XPSaatw.exe
  C:\Windows\System\XPSaatw.exe
  2⤵
  PID:9788
- C:\Windows\System\oYxIRTw.exe
  C:\Windows\System\oYxIRTw.exe
  2⤵
  PID:9852
- C:\Windows\System\pxTsloU.exe
  C:\Windows\System\pxTsloU.exe
  2⤵
  PID:9900
- C:\Windows\System\ccTPjKq.exe
  C:\Windows\System\ccTPjKq.exe
  2⤵
  PID:9932
- C:\Windows\System\ApTyeTD.exe
  C:\Windows\System\ApTyeTD.exe
  2⤵
  PID:9996
- C:\Windows\System\LCQxbMs.exe
  C:\Windows\System\LCQxbMs.exe
  2⤵
  PID:9976
- C:\Windows\System\qRbExWZ.exe
  C:\Windows\System\qRbExWZ.exe
  2⤵
  PID:10024
- C:\Windows\System\MLBnUDU.exe
  C:\Windows\System\MLBnUDU.exe
  2⤵
  PID:10088
- C:\Windows\System\gBZixvP.exe
  C:\Windows\System\gBZixvP.exe
  2⤵
  PID:10104
- C:\Windows\System\lbABtQH.exe
  C:\Windows\System\lbABtQH.exe
  2⤵
  PID:10124
- C:\Windows\System\ypKOdbI.exe
  C:\Windows\System\ypKOdbI.exe
  2⤵
  PID:10140
- C:\Windows\System\ISgXbVJ.exe
  C:\Windows\System\ISgXbVJ.exe
  2⤵
  PID:10172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\GUcRBtI.exe

Filesize
1.9MB

MD5
85d4eb0d56e5bff67672790a8de4a016

SHA1
df392465b276ba27386d8f2e3566c631377ccbe2

SHA256
5a792ea52c46803e6371ca42935c62738099e538567799366f9d1fff9cf5c252

SHA512
1b2c9584065e79db7f50c257ad3ee62b73a78f26107de3af2402ca983a8eaaabd562c8c3c1b345bf780e00e22c24e4b7b9e7d9e5b93f6d64e18993731190204c

Download Submit
C:\Windows\system\GXQYOXI.exe

Filesize
1.9MB

MD5
3e430629c7f1e02de673fba20f5d8a7d

SHA1
5a07a6d56149248ab61b927d9d09d8170b28285a

SHA256
9c1b73d51c415113522ca12210d52e724fd16cb5782274c48b9962aece4d8151

SHA512
903d4b49b36a9ee0328aacd3e25aea7ac53ab64c7f6304eb3b445df5b9e61970ac97c9af15d0ffbcf80eb715e34ca4ce47ff3def249799c04829cf67dfe01795

Download Submit
C:\Windows\system\GeZayTr.exe

Filesize
1.9MB

MD5
89680d01c9c02ba04d26025cb7aa8f15

SHA1
291254d33da7f146892a433ba717acccef71073e

SHA256
72927ecc48ee681fe1b580dc87afeb80c87496476b4782b2b4c5553f5a5540e3

SHA512
ded7dae928cb6281a4f971109428648dd0b3dba47c83be95be5471f97a30492512a3083e08f4bd6441eb557eba930ce2204e0db6d092f2c10674d17ee7e35a08

Download Submit
C:\Windows\system\HQoEsQl.exe

Filesize
1.9MB

MD5
9d0032adabd5e28de72bc30928570cf4

SHA1
c19599f0df2df72a930b65eacdaec3c0b44f2bca

SHA256
c05345893be73150536c9a07c78d05ff4b2900cb1f1786b422c355a22960e8d1

SHA512
41a83e1f58b1a3feab7fd153a6aa5bddecec94d04a5aaef523bca62ff142739629b3c0ab8a9ef83179ab7a2608625a77147ecee67b88aebfacd10c9db8cd73f3

Download Submit
C:\Windows\system\HuXXdRV.exe

Filesize
1.9MB

MD5
1e12b0cfbd46b074abb5a7337683fa66

SHA1
d9484785d0e53b5e0ae0c694b76025df152d24f6

SHA256
0a20a05387c15cc5d204f7068ab36522fa14cc89f3e48dc8578288e1174b15b7

SHA512
63e3fff2fe6956a446c7c51ec80af809469d70dc6dca15a493d211bdff4242414708ad48e521659af4428dd674d3bfb3f2002df47ec6b08620ddc6257fe55b3e

Download Submit
C:\Windows\system\JisaSaJ.exe

Filesize
1.9MB

MD5
4c6b48801a41af754a3d299bf00ffd13

SHA1
99b79ea927de6a044894e8fee725a08321c87651

SHA256
913fbd8c6a80313504acfcc6f719ea7e3d15a5ff396ef011f4d3d98bf12c3800

SHA512
82d4d43bcf181f9c35942251f854c09ac88e527d56f76c5b84682c158a497b48c0704ba5a984cd9391d2bca1d734267988517642a3c28041598569abaf953b90

Download Submit
C:\Windows\system\PtfDloM.exe

Filesize
1.9MB

MD5
124fe882cd8c5cb771691c814a57da7b

SHA1
932ceb56757e184af3ebeb7a7cf2549cf7d28b5e

SHA256
717a980f908c1b9af43d958b9def73f5711e63363add93ddf87df265dcc6047a

SHA512
1abb19e006c7176bf188ace82caed15e619d139deb0955927f654b0c7dd4c573474a67bc910c0ec40102450aaebd3a87bd6453cfc870614c988874bb45ee3572

Download Submit
C:\Windows\system\RouffFn.exe

Filesize
1.9MB

MD5
0eb3221ab9183729617d9afd5bd30944

SHA1
6df3374849115a4432ca18c4886759748bd5450e

SHA256
d2fa9bdbce5db19a3b9fc4790e15acbd10b76ea29df8cb5a889f7dc27240bc2b

SHA512
023baa11cceb0e0a6a4f313da45e8e8b3f69ea984cf48219cd4a2c191b32e5f1abf6a2ed7a5b88a1c5d1eb3993425f089044f635071a31c2f8379b35b1cdc274

Download Submit
C:\Windows\system\SkNaUUp.exe

Filesize
1.9MB

MD5
a56baa865e9ed710356495e8f7fa7055

SHA1
4b640c77ceb8e6dc547241696420762eb3806f4d

SHA256
ecca53c50e1bd39e63086d1884f3c65658d46cbc868efed7aff252579a21966a

SHA512
7bba68f1a2d711985391cc50d3a3e067cc2540e34970a48096d7b7051d8ae1b117e0f42c336e8a68eca91132fd0506660bb31d267f640358993ef6f2b3b7f75c

Download Submit
C:\Windows\system\VtcZiSs.exe

Filesize
1.9MB

MD5
eb1245039929f829bdff439c7e01883d

SHA1
03c03ee7ae487a01432b0fea90b142cb2233a5e3

SHA256
2f73e2023685f51228b31f2ff8e173d0417a917ef3986bb67bc7b38713d8696c

SHA512
26a8edb34e25da12376fb6f3a1b483530b325a6286e82d7e7a3ac87321b1ff1a19c5df8b1139630bdb56f094567faf2f538fbc88620a51ca540b9392f6ac5fcb

Download Submit
C:\Windows\system\XHJpUKN.exe

Filesize
1.9MB

MD5
f4f28f23aec45bb01c509e6d2538c884

SHA1
307998c80d7640fbcfc5addb2284ea6233e6ffd4

SHA256
e17e2cd9554bb8de41202625aaf6b8c221f6f33e9a1130514b3193fd794ceeb4

SHA512
acb66b6af1c55382e5b2a3639bb9765ee4d1d247b86d5b61605edb64bda445f08383e26b0794927daf15210d933bd429bfa37dfa6a8808b18941100f2219e013

Download Submit
C:\Windows\system\YJIoNiS.exe

Filesize
1.9MB

MD5
b2d4e41caecbf393632c7cc467ea55c7

SHA1
422fd3422ae4ea9ea6f6feea041b5e0d3be47bb4

SHA256
04910b7231cd0b49b3207fbed43ff64181e074c70e2d985899a679b46122ef3b

SHA512
bc161f5ceb4eb169a72ec39f7e2d2eb24ebf931821a75a6e189fe61b5847156735a63f11f8eb1ddb6a15915eb0c76a5e6c374eb006ec5a614d15b28916e66f91

Download Submit
C:\Windows\system\aZmVuCT.exe

Filesize
1.9MB

MD5
1e94bd1db69a0e363b2a82ad567055ae

SHA1
c73537ef6f54f00f93b74537ac88ac70febb22b6

SHA256
b2daffe8070a9d94af418d730d94035425938623ef890867ea4dd45cac2ee3b7

SHA512
d539d2afd633d65c6ba6e1e60c729f60e6837b6a2b4d890a79862e3621210e44111f11f5d3b9b334b9f45c55d6f2f548da1b0dbbc2fed72b0d7ed586dc40b988

Download Submit
C:\Windows\system\blAsApN.exe

Filesize
1.9MB

MD5
0631b2fd6bc66208496f04e5d85889ad

SHA1
d01b1cb21ded2c1367b146216c4e8aa3b1092769

SHA256
0714c58d2d02164ecee5b8ea7aa926f027b4f4963cdf4437021d057eb3b8f655

SHA512
a9e1b3d8ce02fc9454265ce3d830936c1f7ea8515cbeb8867b083ab1ea9e43fd97c97ba5afac56abfccf02905addfbbddd33c31041129d4ede31f9d2e1798a58

Download Submit
C:\Windows\system\bmZSOWo.exe

Filesize
1.9MB

MD5
43fc80a906db09a55dfe62f565ad161e

SHA1
5f99baaa2af334aaa0b11d6c54ccc87c7ba64299

SHA256
ce018d18eabfcafcaee3bd0f4f039c8ff8c86acb06822cc7f3bdb2da5349ae67

SHA512
cd687c1e187240bc61e65fb29bf1530c4477efbe44569a3c8a51d1132654774a7e5a2f8d1eafe0561e9fdb09ecbe46e85714e853cb7592facb13e227068c41b5

Download Submit
C:\Windows\system\cZYOlUv.exe

Filesize
1.9MB

MD5
b6b2b804d9654f5bc0f723c3abf008ad

SHA1
f1d3401dd277a855a6c85e23593c9d9448269e2e

SHA256
c44724a02d8c8ac8a2109475adb7560d8b69758ecc58a87ef8278b7479e2ed88

SHA512
1281ef1d10bfa006e89291a1ce9b21b17b6dbea9b7a05666a9ee26a67e47510355e5689ee9e64f88fa01305eafdec482433c87ef8339d2209665a58fce677f6f

Download Submit
C:\Windows\system\gwRVxjG.exe

Filesize
1.9MB

MD5
f7f176ca287629cb6c650c8e333394c5

SHA1
001165154837f5084be9729676d83f0813497fc1

SHA256
44c8a655cc26bf58c97994aef0f8b0cc77bf63adeba8434f835b2354791855e4

SHA512
0d19cf572925db3bf7cb01ecef434af8cba0f643a36b6f0ec1ca8cc172fab02363c932a18c55e00fe49fb7b86e7c607a3e720c92cf607724a1e1921437bc3f1c

Download Submit
C:\Windows\system\gyqVoFx.exe

Filesize
1.9MB

MD5
3466b895b2282781390d3c1afebada41

SHA1
ecafaaf36d29ec6f3c5d08333de2e50bab196247

SHA256
b4e643492bd2034bbba03884823ca36737ea822979509c32bd210340d4a96950

SHA512
e66098fc787d4a083479b1012d1440818571a5d187abca5b301e35872414e7b22955d60e65f0868dac6a456597694fe03fa9c1bc225f2647411cf399c9d224db

Download Submit
C:\Windows\system\iuyDXNH.exe

Filesize
1.9MB

MD5
61afb3b997ff555eb6b49fcfc9175db0

SHA1
3bef2f2a7ccf44787dc933c87542af7feaeb958b

SHA256
ec43bbcb497227dca8f77ede548a69df53d45193b4a92ffaeab5f62599d7bba4

SHA512
56cd32bd9c349fa45cacdc938463047562b31c0593b27cb2660cecb9125ac24ba6bafc40c8228bd127089199752cf1f6d67c21869f27a63b973e26666a8116ae

Download Submit
C:\Windows\system\jdOvlTE.exe

Filesize
1.9MB

MD5
5e4e7e88a68036e183845dd1bd636df7

SHA1
caeb617fa893309ab84c0fa0486e43f15d316613

SHA256
800c034b7a4e222830210fac311fa57fd4b31659e35c2a5009b7fb2b5258888d

SHA512
a2a16de04de83d2decf680544d267eb5df59dd5ed38c11e04258b60b272df91cb2fb066f355b10beeb43bd2e2f348decd717a9a3b515f6c1a29cbc6230cf18e5

Download Submit
C:\Windows\system\oyfTIQs.exe

Filesize
1.9MB

MD5
c581c12f1e8a79e7682b2c98c0c18487

SHA1
cdb1d86cfaa785c94dc6e4234a98a81ebde9ae59

SHA256
7b00a788a28ea70daa93acbf61f1e54116c53d7a6200d63dee86874905e093c7

SHA512
3a8fb339b8f4aa85bce0567ae7a8d53e84cb2ccb16a3de535f40e21e763dacfcad6e5194cb5ef17d87de9e03564c76303b7b45fe8dfa1b52b7f827948c4dcde3

Download Submit
C:\Windows\system\pahgJAX.exe

Filesize
1.9MB

MD5
a6f6a6c73b4cd5d200fa410ad7cefa8d

SHA1
4dfa8b319447dde9a0169b65664c0028e0ad5c69

SHA256
f64714c5ee3341ff0f82570e170bdce49847113ce075bd33ffc89d81d5c55699

SHA512
bd393d1368481de834228b3284e137c7ab9a7c7a762b0f1d856bd1dd1043b96e63e78787c6ba085446738271ca4c4c006e4114608e6d6b6932599bd3387b4092

Download Submit
C:\Windows\system\xRjyqAd.exe

Filesize
1.9MB

MD5
8a474972ee151e6adf687b45e100e56c

SHA1
be959beb6cc47f01d2b01c82c46740e4745ee341

SHA256
041d02fd4059e5f882ee163a3ca02d64587a98d98f91da4d907fa9c6cbbd1783

SHA512
27fe8c0a0c04d9dd0c1ea0c344a633fa7fa6d7797962f1c34049fa2e96f8fcf06592036ea1fc16b12573c28110b8b2491db6ac6279e41162051f77c30224f777

Download Submit
C:\Windows\system\yUUWqdq.exe

Filesize
1.9MB

MD5
8128889b8208b32a22120d3155bf7cdb

SHA1
254c9d0650716aab25df6c47df20257b6b31d59e

SHA256
306406c381e217c493add56e3736e2ce161039b115cc03cf4c5a5f3aa3df464e

SHA512
f363b207db1eb84de50d08c1073878ecd3625fda2f144944d017ab1d63cef49209ebb011eed67aaad46bf0afc1b1e3346f13fe44daa1fa6fa04052d1c2f65125

Download Submit
C:\Windows\system\ypEsmEj.exe

Filesize
1.9MB

MD5
4a3d7da31d16dc110084c88a69d224cc

SHA1
9ec42de776a8f16b3819ad58a24a27428924d99a

SHA256
37aca9a7837d706708c1d87503523b96fb7e80877ebef142d4acf3cad6455f53

SHA512
6950cefaf71b1be7454523f467531e37c422ffdc798d9f22f9f8f39907ef7dfb297adf8f88bc3c0452499a1fad34542fa3dbea00cdec0e8f7f916e2610fa332a

Download Submit
\Windows\system\BnxLfiB.exe

Filesize
1.9MB

MD5
877562c9f6dfbd18f91450bf0f40c617

SHA1
e2580fa7df28ce9bbc5ee21abcac010877fae8ab

SHA256
934e7878375458757c4ff9b9f141cc7f16d539e807b5d7b4bff63b9cafef4098

SHA512
e2a576a13e2cba1a109dfa81b2dbe8d4a8db50501706c49bf3815fe89e76a5b8b22f610c0a8ac80c6c076920c2cac2cb8df4b182f0db9f23e45bbf2eda9f3799

Download Submit
\Windows\system\EKypgSq.exe

Filesize
1.9MB

MD5
84d800ace7999e7854941165b3cb7072

SHA1
86a89bbcc1df97e57c3dda70cfcc697bbafaa97b

SHA256
578c7f8ca5a8ff8635d56eb877cec23fdb7015915b0305f43f76d56d4f10bc8b

SHA512
8666931dc8b39a6ad9fff8bd89a489acb3363738d6d9ab72a4a4601a6bd2a23f20e30b78d7c8d295e3449057d86465799adfc3a863c4f5b5656edeb06c69f07f

Download Submit
\Windows\system\QCSYrHi.exe

Filesize
1.9MB

MD5
9896700875bd688bb08e1fe03693c1aa

SHA1
49c2dac9e03d9de56d714b07f88987df0239fdbc

SHA256
bca50d797eeefccd77de78c962c43a1b249a551c1fcf3b836e4b6242100896ce

SHA512
67b0492c5025b2447d050bf9e836284c92783bf561e7e22ef25e66f1031cc14869d529538938efa8fd50f7adb33ba74952cb15215f45f4e600898115233617d3

Download Submit
\Windows\system\iVmdJQz.exe

Filesize
1.9MB

MD5
3efb38d404e7e9f051489318ebfb793b

SHA1
d15f83ceac41e41519d1c93c08fae4a6b81a543d

SHA256
d4fce262005a661771e16563427b29ec5b0dc5d70b45cb7d4978a3addc8fa36c

SHA512
9da9453ec5ffd40606f0e56e84936ef6a42075fe06a4ae59839867522ce900ca1ad7bf4dc99e7241d0790afea93834e4f830edb5b68869c9e12db5a2fe7537f7

Download Submit
\Windows\system\jiYmUPG.exe

Filesize
1.9MB

MD5
90c9dff7d9ed4a07758e3ef3dedcfdd2

SHA1
968d20894b64f12192b5436de6a7d9f3def1ece5

SHA256
e2a0c4c83032cecf0ce4a79d271df8e7edb4b3339bf683eedaa91928a2faf5e7

SHA512
d2c4534c6aa2cea4354d39dae5fa34a067ba6e9d471756639379fafa050515053d85d109c093ff5e85ccca56975e0d2c40b4491ee0ce7a7c053db9fc030c2349

Download Submit
\Windows\system\tOwRdAZ.exe

Filesize
1.9MB

MD5
f045b33b930048fdc4be98cdf9508dac

SHA1
19cb5c8ea7e06d866cf1f7be854985b9caf46dde

SHA256
b273ff6bcfd592bf15864c62b2cf92fc505ba4a98fd1fafa3f9c4f41d7fd9694

SHA512
f0ce31cf8922ba00d6b10a6df14e252ffc1c1e4ce6bcce72668d2b3c4910fa92bc26789843d781c234d0ef5b6d4605aa2312cc0bf504bcb1c4691d89c8f801a9

Download Submit
\Windows\system\wudkRMi.exe

Filesize
1.9MB

MD5
ad1bdad35e516372ffe19e0a433e4bb5

SHA1
ed53c057541611f25aca993872b5faa9c2d1cdc9

SHA256
38eb5e222e2963672a2b30c12c1fffb726f8bcab515e67e1bac4953437a907e5

SHA512
6723cc4a634fbd00d3820d9bf8cdedf3c6e2dd979fcee7274602f8e8b3eea7ba9e096246ac34dff0a3dcfba8854b370cb506071b9065921e602b0f6c5ce1870a

Download Submit
\Windows\system\ywTZXzx.exe

Filesize
1.9MB

MD5
73f7ad4f4b0f5b4853726532f6b77fb5

SHA1
0ae656167b8d994dd6c82eb81fcd059267d8fe1a

SHA256
e4aa523693434c6e0b06a2232cce18829a1671635835cf38d74412830a5d1f50

SHA512
595971f188f4dd24d80154dc3d9521ab33d8ca89a4d60a601abcd03d2688dba55c1a57847bf912be80e6f376128187d33e1f22dd18d56770404afc9e017c346b

Download Submit
memory/1620-61-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/1620-25-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/1620-16-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1620-1066-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1620-1067-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-79-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-82-0x0000000003710000-0x0000000003B02000-memory.dmp

Filesize
3.9MB

Download
memory/1620-43-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/1620-29-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-83-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/1620-35-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/1620-1-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1620-26-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/1844-81-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2228-1068-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2228-20-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-77-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-53-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2448-80-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2548-69-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2560-93-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-73-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2568-70-0x000000001B550000-0x000000001B832000-memory.dmp

Filesize
2.9MB

Download
memory/2600-27-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2744-41-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2800-28-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2892-84-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/3052-30-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download