xmrig | 376fa8c509c8e4b32b23eb619b6daafe9ccd5a17ea1a9f140b8955b80ad43af6

Analysis

max time kernel
31s
max time network
29s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
Size

1.9MB
MD5

095093b5cdfc07ac85a489e3364417f9
SHA1

b85386bf8319dee5fbb2256b5da4699a8e05a7af
SHA256

376fa8c509c8e4b32b23eb619b6daafe9ccd5a17ea1a9f140b8955b80ad43af6
SHA512

b7ebfcb02bbd1085cfe6a279216a7e724a35ff3958aab8d2c85a99e09f0f2b9939eaa01c0685d03d2ce10a786978c3c0ab25dcaea7d5fe29e7153200557dc08b
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U6:NAB5

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2696-40-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2620-46-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2740-44-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2848-41-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2884-37-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/840-352-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/1228-627-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1228	yTsIBBl.exe
2884	WWKwXnG.exe
2696	GrMtZry.exe
2740	iQtKIxb.exe
2848	VrJuKXr.exe
2620	pXgQgCk.exe
2608	zZPQJFR.exe
296	auOLgzG.exe
1344	IvhyidV.exe
2832	IPMPIEK.exe
1248	ETZlJwL.exe
1612	iSkwAEk.exe
2400	dUrXOrf.exe
1148	jNarQPH.exe
908	qDdzPOO.exe
2588	dGAJohJ.exe
2660	klxthXT.exe
2040	mmaomRc.exe
2856	CaKqIJZ.exe
2816	TdWjeWu.exe
1420	cRUAhCo.exe
1864	kiybfLB.exe
800	cAzVHuY.exe
1840	yzagCLE.exe
1824	lKpINhK.exe
2948	TSAuaGP.exe
756	yFgbPdF.exe
1068	EtRzoSP.exe
1404	Zcdlorz.exe
2372	SerpNiC.exe
828	WtAeAhK.exe
2084	TqrVypJ.exe
2416	GSlceGt.exe
1908	ZtJqZDl.exe
448	inGhHDa.exe
612	EMTBXei.exe
1236	hmMcEUF.exe
1872	lDOUDlY.exe
272	LqDOUGu.exe
1292	smBgair.exe
2436	ZwdASXJ.exe
752	fjoJFcW.exe
3020	OcAUsdy.exe
1636	pPBTCeE.exe
580	ipQoGEF.exe
1112	LJFypJN.exe
1608	EbIMZzA.exe
2860	yeLrUmt.exe
1652	XiIckBz.exe
1536	lflmGyQ.exe
2716	AZixsjh.exe
2504	nmcvPth.exe
1648	LuNmSKM.exe
2788	qZFOlql.exe
2288	hiXcHWi.exe
3032	ilENImY.exe
1456	DblSsjj.exe
2900	ARTPDEz.exe
1816	DLMEsow.exe
3064	PswPYhU.exe
1832	eKaPtgt.exe
2464	zsWSqSd.exe
408	lhgIits.exe
592	cmKkSmq.exe

Loads dropped DLL 64 IoCs

pid	Process
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/840-0-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x000b0000000122ee-6.dat	upx
behavioral1/memory/1228-8-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/files/0x0008000000013a15-15.dat	upx
behavioral1/files/0x00090000000134f5-22.dat	upx
behavioral1/files/0x000a000000013b02-35.dat	upx
behavioral1/memory/2696-40-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2620-46-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/memory/840-50-0x0000000003450000-0x0000000003842000-memory.dmp	upx
behavioral1/memory/2608-49-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/files/0x000800000001451d-48.dat	upx
behavioral1/files/0x0008000000013a85-24.dat	upx
behavioral1/memory/2740-44-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2848-41-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/memory/2884-37-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/files/0x0008000000013a65-34.dat	upx
behavioral1/files/0x0039000000013362-31.dat	upx
behavioral1/memory/296-62-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/files/0x00060000000148af-88.dat	upx
behavioral1/memory/1344-114-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/files/0x00060000000150aa-111.dat	upx
behavioral1/files/0x000600000001543a-128.dat	upx
behavioral1/files/0x000600000001523e-158.dat	upx
behavioral1/files/0x0006000000015bb5-182.dat	upx
behavioral1/files/0x0006000000015c9b-180.dat	upx
behavioral1/files/0x0006000000015b37-165.dat	upx
behavioral1/files/0x00060000000155e8-163.dat	upx
behavioral1/files/0x0006000000014a29-147.dat	upx
behavioral1/files/0x000600000001475f-145.dat	upx
behavioral1/files/0x0007000000014730-143.dat	upx
behavioral1/files/0x00060000000146a7-141.dat	upx
behavioral1/files/0x0006000000015ca9-184.dat	upx
behavioral1/files/0x0006000000015c91-177.dat	upx
behavioral1/files/0x0006000000015b72-168.dat	upx
behavioral1/files/0x0006000000014fac-121.dat	upx
behavioral1/files/0x0006000000014c0b-120.dat	upx
behavioral1/files/0x000600000001474b-109.dat	upx
behavioral1/files/0x00130000000054a8-108.dat	upx
behavioral1/files/0x0006000000015077-105.dat	upx
behavioral1/files/0x0006000000014d0f-99.dat	upx
behavioral1/files/0x0006000000014525-57.dat	upx
behavioral1/files/0x0006000000015a15-151.dat	upx
behavioral1/files/0x00060000000145d4-69.dat	upx
behavioral1/files/0x003900000001340e-55.dat	upx
behavioral1/memory/840-352-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/1228-627-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OeHDjNA.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\KvXOTuS.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\dwQIZDR.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\LuNmSKM.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\ArNvGDd.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\jfpppTs.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\IbfOJHt.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\qKDRBgn.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\HVwoDmk.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\nhXxzne.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\jNarQPH.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\FyrXxMj.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\QOUJUVZ.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\IDDZypJ.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\PyFtXul.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\bRdhuur.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\cmKkSmq.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\FtDvqui.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\GcYZTkO.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\cpjGrFo.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\OZpcLCQ.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\rHSSAwB.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\PYvHHCj.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\CLIaVjn.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\ImijGJI.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\htCYzml.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\wPRfrfV.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\nNlYSmn.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\HfZgKIH.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\ggnkkvQ.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\wcXSUZj.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\XiIckBz.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\nPySTsT.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\KhpJQLH.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\LyBbvib.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\ZMvwiZC.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\tvRzKfh.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\YxLChIO.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\SERuYAk.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\BwDDxMZ.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\iYMYMQh.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\QSvlwao.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\tdHnrfC.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\oixCmlN.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\VlYcCAk.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\AZexVHC.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\CewkwNO.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\WWKwXnG.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\OsXXCTa.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\pgtnJaC.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\NrViNfg.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\TfimHQB.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\LTGnOfF.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\oFSsxoX.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\DaZLYpm.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\aRFgxvR.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\bQcbLBI.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\YSFuBup.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\KRBeKXN.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\HVZYpYx.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\omYEjOu.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\chsjfnE.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\EItuPXB.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
File created	C:\Windows\System\NNQnVxI.exe	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2352	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
Token: SeDebugPrivilege	2352	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2352	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	29
PID 840 wrote to memory of 2352	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	29
PID 840 wrote to memory of 2352	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	29
PID 840 wrote to memory of 1228	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	30
PID 840 wrote to memory of 1228	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	30
PID 840 wrote to memory of 1228	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	30
PID 840 wrote to memory of 2696	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	31
PID 840 wrote to memory of 2696	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	31
PID 840 wrote to memory of 2696	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	31
PID 840 wrote to memory of 2884	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	32
PID 840 wrote to memory of 2884	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	32
PID 840 wrote to memory of 2884	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	32
PID 840 wrote to memory of 2620	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	33
PID 840 wrote to memory of 2620	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	33
PID 840 wrote to memory of 2620	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	33
PID 840 wrote to memory of 2740	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	34
PID 840 wrote to memory of 2740	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	34
PID 840 wrote to memory of 2740	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	34
PID 840 wrote to memory of 2608	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	35
PID 840 wrote to memory of 2608	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	35
PID 840 wrote to memory of 2608	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	35
PID 840 wrote to memory of 2848	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	36
PID 840 wrote to memory of 2848	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	36
PID 840 wrote to memory of 2848	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	36
PID 840 wrote to memory of 2660	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	37
PID 840 wrote to memory of 2660	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	37
PID 840 wrote to memory of 2660	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	37
PID 840 wrote to memory of 296	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	38
PID 840 wrote to memory of 296	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	38
PID 840 wrote to memory of 296	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	38
PID 840 wrote to memory of 2040	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	39
PID 840 wrote to memory of 2040	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	39
PID 840 wrote to memory of 2040	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	39
PID 840 wrote to memory of 1344	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	40
PID 840 wrote to memory of 1344	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	40
PID 840 wrote to memory of 1344	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	40
PID 840 wrote to memory of 2856	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	41
PID 840 wrote to memory of 2856	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	41
PID 840 wrote to memory of 2856	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	41
PID 840 wrote to memory of 2832	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	42
PID 840 wrote to memory of 2832	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	42
PID 840 wrote to memory of 2832	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	42
PID 840 wrote to memory of 2816	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	43
PID 840 wrote to memory of 2816	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	43
PID 840 wrote to memory of 2816	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	43
PID 840 wrote to memory of 1248	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	44
PID 840 wrote to memory of 1248	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	44
PID 840 wrote to memory of 1248	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	44
PID 840 wrote to memory of 1420	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	45
PID 840 wrote to memory of 1420	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	45
PID 840 wrote to memory of 1420	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	45
PID 840 wrote to memory of 1612	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	46
PID 840 wrote to memory of 1612	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	46
PID 840 wrote to memory of 1612	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	46
PID 840 wrote to memory of 1864	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	47
PID 840 wrote to memory of 1864	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	47
PID 840 wrote to memory of 1864	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	47
PID 840 wrote to memory of 2400	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	48
PID 840 wrote to memory of 2400	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	48
PID 840 wrote to memory of 2400	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	48
PID 840 wrote to memory of 1840	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	49
PID 840 wrote to memory of 1840	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	49
PID 840 wrote to memory of 1840	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	49
PID 840 wrote to memory of 1148	840	095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\095093b5cdfc07ac85a489e3364417f9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\System\yTsIBBl.exe
  C:\Windows\System\yTsIBBl.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\GrMtZry.exe
  C:\Windows\System\GrMtZry.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\WWKwXnG.exe
  C:\Windows\System\WWKwXnG.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\pXgQgCk.exe
  C:\Windows\System\pXgQgCk.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\iQtKIxb.exe
  C:\Windows\System\iQtKIxb.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\zZPQJFR.exe
  C:\Windows\System\zZPQJFR.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\VrJuKXr.exe
  C:\Windows\System\VrJuKXr.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\klxthXT.exe
  C:\Windows\System\klxthXT.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\auOLgzG.exe
  C:\Windows\System\auOLgzG.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\mmaomRc.exe
  C:\Windows\System\mmaomRc.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\IvhyidV.exe
  C:\Windows\System\IvhyidV.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\CaKqIJZ.exe
  C:\Windows\System\CaKqIJZ.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\IPMPIEK.exe
  C:\Windows\System\IPMPIEK.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\TdWjeWu.exe
  C:\Windows\System\TdWjeWu.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\ETZlJwL.exe
  C:\Windows\System\ETZlJwL.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\cRUAhCo.exe
  C:\Windows\System\cRUAhCo.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\iSkwAEk.exe
  C:\Windows\System\iSkwAEk.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\kiybfLB.exe
  C:\Windows\System\kiybfLB.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\dUrXOrf.exe
  C:\Windows\System\dUrXOrf.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\yzagCLE.exe
  C:\Windows\System\yzagCLE.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\jNarQPH.exe
  C:\Windows\System\jNarQPH.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\lKpINhK.exe
  C:\Windows\System\lKpINhK.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\qDdzPOO.exe
  C:\Windows\System\qDdzPOO.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\TSAuaGP.exe
  C:\Windows\System\TSAuaGP.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\dGAJohJ.exe
  C:\Windows\System\dGAJohJ.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\yFgbPdF.exe
  C:\Windows\System\yFgbPdF.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\cAzVHuY.exe
  C:\Windows\System\cAzVHuY.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\EtRzoSP.exe
  C:\Windows\System\EtRzoSP.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\Zcdlorz.exe
  C:\Windows\System\Zcdlorz.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\WtAeAhK.exe
  C:\Windows\System\WtAeAhK.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\SerpNiC.exe
  C:\Windows\System\SerpNiC.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\ZtJqZDl.exe
  C:\Windows\System\ZtJqZDl.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\TqrVypJ.exe
  C:\Windows\System\TqrVypJ.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\inGhHDa.exe
  C:\Windows\System\inGhHDa.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\GSlceGt.exe
  C:\Windows\System\GSlceGt.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\EMTBXei.exe
  C:\Windows\System\EMTBXei.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\hmMcEUF.exe
  C:\Windows\System\hmMcEUF.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\lDOUDlY.exe
  C:\Windows\System\lDOUDlY.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\LqDOUGu.exe
  C:\Windows\System\LqDOUGu.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\smBgair.exe
  C:\Windows\System\smBgair.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\ZwdASXJ.exe
  C:\Windows\System\ZwdASXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\nXIIxyt.exe
  C:\Windows\System\nXIIxyt.exe
  2⤵
  PID:2180
- C:\Windows\System\fjoJFcW.exe
  C:\Windows\System\fjoJFcW.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\MBFLmtr.exe
  C:\Windows\System\MBFLmtr.exe
  2⤵
  PID:2200
- C:\Windows\System\OcAUsdy.exe
  C:\Windows\System\OcAUsdy.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\thGHKqj.exe
  C:\Windows\System\thGHKqj.exe
  2⤵
  PID:2404
- C:\Windows\System\pPBTCeE.exe
  C:\Windows\System\pPBTCeE.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\cHNITrP.exe
  C:\Windows\System\cHNITrP.exe
  2⤵
  PID:2144
- C:\Windows\System\ipQoGEF.exe
  C:\Windows\System\ipQoGEF.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\VaCXkkS.exe
  C:\Windows\System\VaCXkkS.exe
  2⤵
  PID:1708
- C:\Windows\System\LJFypJN.exe
  C:\Windows\System\LJFypJN.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\kZrqvZB.exe
  C:\Windows\System\kZrqvZB.exe
  2⤵
  PID:988
- C:\Windows\System\EbIMZzA.exe
  C:\Windows\System\EbIMZzA.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\iricYNb.exe
  C:\Windows\System\iricYNb.exe
  2⤵
  PID:1432
- C:\Windows\System\yeLrUmt.exe
  C:\Windows\System\yeLrUmt.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\AnKUWzJ.exe
  C:\Windows\System\AnKUWzJ.exe
  2⤵
  PID:1740
- C:\Windows\System\XiIckBz.exe
  C:\Windows\System\XiIckBz.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\MtEInOl.exe
  C:\Windows\System\MtEInOl.exe
  2⤵
  PID:1724
- C:\Windows\System\lflmGyQ.exe
  C:\Windows\System\lflmGyQ.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\yJWSnBb.exe
  C:\Windows\System\yJWSnBb.exe
  2⤵
  PID:1496
- C:\Windows\System\AZixsjh.exe
  C:\Windows\System\AZixsjh.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\ElZiPOj.exe
  C:\Windows\System\ElZiPOj.exe
  2⤵
  PID:2876
- C:\Windows\System\nmcvPth.exe
  C:\Windows\System\nmcvPth.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\LDJAvhE.exe
  C:\Windows\System\LDJAvhE.exe
  2⤵
  PID:2756
- C:\Windows\System\LuNmSKM.exe
  C:\Windows\System\LuNmSKM.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\htIgofi.exe
  C:\Windows\System\htIgofi.exe
  2⤵
  PID:2800
- C:\Windows\System\qZFOlql.exe
  C:\Windows\System\qZFOlql.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\BCJOJRs.exe
  C:\Windows\System\BCJOJRs.exe
  2⤵
  PID:2044
- C:\Windows\System\hiXcHWi.exe
  C:\Windows\System\hiXcHWi.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\txVBEbY.exe
  C:\Windows\System\txVBEbY.exe
  2⤵
  PID:1852
- C:\Windows\System\ilENImY.exe
  C:\Windows\System\ilENImY.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\mnETclf.exe
  C:\Windows\System\mnETclf.exe
  2⤵
  PID:2364
- C:\Windows\System\DblSsjj.exe
  C:\Windows\System\DblSsjj.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\QgvXGmo.exe
  C:\Windows\System\QgvXGmo.exe
  2⤵
  PID:676
- C:\Windows\System\ARTPDEz.exe
  C:\Windows\System\ARTPDEz.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ACirqfs.exe
  C:\Windows\System\ACirqfs.exe
  2⤵
  PID:2960
- C:\Windows\System\DLMEsow.exe
  C:\Windows\System\DLMEsow.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\BugriyR.exe
  C:\Windows\System\BugriyR.exe
  2⤵
  PID:1912
- C:\Windows\System\PswPYhU.exe
  C:\Windows\System\PswPYhU.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ZUcHpmN.exe
  C:\Windows\System\ZUcHpmN.exe
  2⤵
  PID:2420
- C:\Windows\System\eKaPtgt.exe
  C:\Windows\System\eKaPtgt.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\YfQDWgG.exe
  C:\Windows\System\YfQDWgG.exe
  2⤵
  PID:1784
- C:\Windows\System\zsWSqSd.exe
  C:\Windows\System\zsWSqSd.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\UtqFGMU.exe
  C:\Windows\System\UtqFGMU.exe
  2⤵
  PID:2904
- C:\Windows\System\lhgIits.exe
  C:\Windows\System\lhgIits.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\vrsmXBa.exe
  C:\Windows\System\vrsmXBa.exe
  2⤵
  PID:2368
- C:\Windows\System\cmKkSmq.exe
  C:\Windows\System\cmKkSmq.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\RPdMmxg.exe
  C:\Windows\System\RPdMmxg.exe
  2⤵
  PID:1728
- C:\Windows\System\fVgmumI.exe
  C:\Windows\System\fVgmumI.exe
  2⤵
  PID:3068
- C:\Windows\System\lDTLFYV.exe
  C:\Windows\System\lDTLFYV.exe
  2⤵
  PID:1108
- C:\Windows\System\JesTVol.exe
  C:\Windows\System\JesTVol.exe
  2⤵
  PID:1704
- C:\Windows\System\vzfuncw.exe
  C:\Windows\System\vzfuncw.exe
  2⤵
  PID:1956
- C:\Windows\System\gnaatCO.exe
  C:\Windows\System\gnaatCO.exe
  2⤵
  PID:1296
- C:\Windows\System\YckpBpn.exe
  C:\Windows\System\YckpBpn.exe
  2⤵
  PID:1504
- C:\Windows\System\WZmIImY.exe
  C:\Windows\System\WZmIImY.exe
  2⤵
  PID:2612
- C:\Windows\System\oHJkokz.exe
  C:\Windows\System\oHJkokz.exe
  2⤵
  PID:2868
- C:\Windows\System\VqUjOLJ.exe
  C:\Windows\System\VqUjOLJ.exe
  2⤵
  PID:1720
- C:\Windows\System\YxLChIO.exe
  C:\Windows\System\YxLChIO.exe
  2⤵
  PID:2252
- C:\Windows\System\AmWDzbp.exe
  C:\Windows\System\AmWDzbp.exe
  2⤵
  PID:1644
- C:\Windows\System\hrPjTqf.exe
  C:\Windows\System\hrPjTqf.exe
  2⤵
  PID:2820
- C:\Windows\System\UvpOoJw.exe
  C:\Windows\System\UvpOoJw.exe
  2⤵
  PID:1284
- C:\Windows\System\JPcebPn.exe
  C:\Windows\System\JPcebPn.exe
  2⤵
  PID:2640
- C:\Windows\System\faIzSQa.exe
  C:\Windows\System\faIzSQa.exe
  2⤵
  PID:2408
- C:\Windows\System\sJdQgiN.exe
  C:\Windows\System\sJdQgiN.exe
  2⤵
  PID:2456
- C:\Windows\System\lsxNmjB.exe
  C:\Windows\System\lsxNmjB.exe
  2⤵
  PID:2896
- C:\Windows\System\JUcGWPa.exe
  C:\Windows\System\JUcGWPa.exe
  2⤵
  PID:1736
- C:\Windows\System\vQqmbzo.exe
  C:\Windows\System\vQqmbzo.exe
  2⤵
  PID:2488
- C:\Windows\System\qTavMCd.exe
  C:\Windows\System\qTavMCd.exe
  2⤵
  PID:3084
- C:\Windows\System\LBFGLzC.exe
  C:\Windows\System\LBFGLzC.exe
  2⤵
  PID:3100
- C:\Windows\System\uIrSndF.exe
  C:\Windows\System\uIrSndF.exe
  2⤵
  PID:3116
- C:\Windows\System\GcYZTkO.exe
  C:\Windows\System\GcYZTkO.exe
  2⤵
  PID:3136
- C:\Windows\System\thEbgck.exe
  C:\Windows\System\thEbgck.exe
  2⤵
  PID:3152
- C:\Windows\System\nNlYSmn.exe
  C:\Windows\System\nNlYSmn.exe
  2⤵
  PID:3172
- C:\Windows\System\vwwAiDZ.exe
  C:\Windows\System\vwwAiDZ.exe
  2⤵
  PID:3188
- C:\Windows\System\XyRblCJ.exe
  C:\Windows\System\XyRblCJ.exe
  2⤵
  PID:3204
- C:\Windows\System\EnOjhjh.exe
  C:\Windows\System\EnOjhjh.exe
  2⤵
  PID:3224
- C:\Windows\System\fiKFFJh.exe
  C:\Windows\System\fiKFFJh.exe
  2⤵
  PID:3240
- C:\Windows\System\pcEbsmw.exe
  C:\Windows\System\pcEbsmw.exe
  2⤵
  PID:3264
- C:\Windows\System\HkqbPpY.exe
  C:\Windows\System\HkqbPpY.exe
  2⤵
  PID:3304
- C:\Windows\System\QKkHVhQ.exe
  C:\Windows\System\QKkHVhQ.exe
  2⤵
  PID:3332
- C:\Windows\System\QPqnhlN.exe
  C:\Windows\System\QPqnhlN.exe
  2⤵
  PID:3348
- C:\Windows\System\YWGTlKd.exe
  C:\Windows\System\YWGTlKd.exe
  2⤵
  PID:3364
- C:\Windows\System\moNvVAU.exe
  C:\Windows\System\moNvVAU.exe
  2⤵
  PID:3380
- C:\Windows\System\QCNoqfT.exe
  C:\Windows\System\QCNoqfT.exe
  2⤵
  PID:3396
- C:\Windows\System\uyADsbn.exe
  C:\Windows\System\uyADsbn.exe
  2⤵
  PID:3576
- C:\Windows\System\SGfDZRT.exe
  C:\Windows\System\SGfDZRT.exe
  2⤵
  PID:3804
- C:\Windows\System\woYCUig.exe
  C:\Windows\System\woYCUig.exe
  2⤵
  PID:3832
- C:\Windows\System\nEVusnC.exe
  C:\Windows\System\nEVusnC.exe
  2⤵
  PID:3852
- C:\Windows\System\OhKlAOO.exe
  C:\Windows\System\OhKlAOO.exe
  2⤵
  PID:3872
- C:\Windows\System\RFqfdOM.exe
  C:\Windows\System\RFqfdOM.exe
  2⤵
  PID:3892
- C:\Windows\System\qBzPRxH.exe
  C:\Windows\System\qBzPRxH.exe
  2⤵
  PID:3912
- C:\Windows\System\QRVIfKW.exe
  C:\Windows\System\QRVIfKW.exe
  2⤵
  PID:3932
- C:\Windows\System\iayyobm.exe
  C:\Windows\System\iayyobm.exe
  2⤵
  PID:3952
- C:\Windows\System\rdTPKqs.exe
  C:\Windows\System\rdTPKqs.exe
  2⤵
  PID:3972
- C:\Windows\System\eiPNybT.exe
  C:\Windows\System\eiPNybT.exe
  2⤵
  PID:3988
- C:\Windows\System\orNFWfu.exe
  C:\Windows\System\orNFWfu.exe
  2⤵
  PID:4004
- C:\Windows\System\ThyRpON.exe
  C:\Windows\System\ThyRpON.exe
  2⤵
  PID:4028
- C:\Windows\System\vbmmEqN.exe
  C:\Windows\System\vbmmEqN.exe
  2⤵
  PID:4052
- C:\Windows\System\QAXSGXM.exe
  C:\Windows\System\QAXSGXM.exe
  2⤵
  PID:4068
- C:\Windows\System\VLhRgzZ.exe
  C:\Windows\System\VLhRgzZ.exe
  2⤵
  PID:4084
- C:\Windows\System\XZWwyUJ.exe
  C:\Windows\System\XZWwyUJ.exe
  2⤵
  PID:2140
- C:\Windows\System\yzKRHwi.exe
  C:\Windows\System\yzKRHwi.exe
  2⤵
  PID:2360
- C:\Windows\System\aSOhTrW.exe
  C:\Windows\System\aSOhTrW.exe
  2⤵
  PID:1584
- C:\Windows\System\RiKuTnp.exe
  C:\Windows\System\RiKuTnp.exe
  2⤵
  PID:3108
- C:\Windows\System\FqDvrzn.exe
  C:\Windows\System\FqDvrzn.exe
  2⤵
  PID:1836
- C:\Windows\System\kTfRkuf.exe
  C:\Windows\System\kTfRkuf.exe
  2⤵
  PID:1040
- C:\Windows\System\tFjJpkE.exe
  C:\Windows\System\tFjJpkE.exe
  2⤵
  PID:308
- C:\Windows\System\ArNvGDd.exe
  C:\Windows\System\ArNvGDd.exe
  2⤵
  PID:340
- C:\Windows\System\hnMBzPo.exe
  C:\Windows\System\hnMBzPo.exe
  2⤵
  PID:2484
- C:\Windows\System\EUnueUs.exe
  C:\Windows\System\EUnueUs.exe
  2⤵
  PID:2568
- C:\Windows\System\FyrXxMj.exe
  C:\Windows\System\FyrXxMj.exe
  2⤵
  PID:1960
- C:\Windows\System\vTTBICl.exe
  C:\Windows\System\vTTBICl.exe
  2⤵
  PID:3184
- C:\Windows\System\DFsPHhF.exe
  C:\Windows\System\DFsPHhF.exe
  2⤵
  PID:484
- C:\Windows\System\NrViNfg.exe
  C:\Windows\System\NrViNfg.exe
  2⤵
  PID:3220
- C:\Windows\System\DOffGCJ.exe
  C:\Windows\System\DOffGCJ.exe
  2⤵
  PID:2720
- C:\Windows\System\BisbKJD.exe
  C:\Windows\System\BisbKJD.exe
  2⤵
  PID:3328
- C:\Windows\System\sYFCsQe.exe
  C:\Windows\System\sYFCsQe.exe
  2⤵
  PID:3588
- C:\Windows\System\SwExPja.exe
  C:\Windows\System\SwExPja.exe
  2⤵
  PID:3604
- C:\Windows\System\srZQzNQ.exe
  C:\Windows\System\srZQzNQ.exe
  2⤵
  PID:3612
- C:\Windows\System\IDDZypJ.exe
  C:\Windows\System\IDDZypJ.exe
  2⤵
  PID:1924
- C:\Windows\System\tdUaizL.exe
  C:\Windows\System\tdUaizL.exe
  2⤵
  PID:900
- C:\Windows\System\eGBXGOv.exe
  C:\Windows\System\eGBXGOv.exe
  2⤵
  PID:2008
- C:\Windows\System\SHchjgZ.exe
  C:\Windows\System\SHchjgZ.exe
  2⤵
  PID:1540
- C:\Windows\System\VyfObxd.exe
  C:\Windows\System\VyfObxd.exe
  2⤵
  PID:292
- C:\Windows\System\NqTwfCr.exe
  C:\Windows\System\NqTwfCr.exe
  2⤵
  PID:2248
- C:\Windows\System\jfpppTs.exe
  C:\Windows\System\jfpppTs.exe
  2⤵
  PID:2680
- C:\Windows\System\KdVqMII.exe
  C:\Windows\System\KdVqMII.exe
  2⤵
  PID:288
- C:\Windows\System\diDeBCu.exe
  C:\Windows\System\diDeBCu.exe
  2⤵
  PID:2924
- C:\Windows\System\wnRLXEi.exe
  C:\Windows\System\wnRLXEi.exe
  2⤵
  PID:1668
- C:\Windows\System\AqaYOHq.exe
  C:\Windows\System\AqaYOHq.exe
  2⤵
  PID:2728
- C:\Windows\System\PyFtXul.exe
  C:\Windows\System\PyFtXul.exe
  2⤵
  PID:1036
- C:\Windows\System\OeHDjNA.exe
  C:\Windows\System\OeHDjNA.exe
  2⤵
  PID:320
- C:\Windows\System\VfPUlSN.exe
  C:\Windows\System\VfPUlSN.exe
  2⤵
  PID:1624
- C:\Windows\System\WrCSkaE.exe
  C:\Windows\System\WrCSkaE.exe
  2⤵
  PID:2236
- C:\Windows\System\eCJIxcZ.exe
  C:\Windows\System\eCJIxcZ.exe
  2⤵
  PID:1416
- C:\Windows\System\ymhlHss.exe
  C:\Windows\System\ymhlHss.exe
  2⤵
  PID:2908
- C:\Windows\System\vmPAOxq.exe
  C:\Windows\System\vmPAOxq.exe
  2⤵
  PID:3036
- C:\Windows\System\NdIkcTn.exe
  C:\Windows\System\NdIkcTn.exe
  2⤵
  PID:536
- C:\Windows\System\UdTngGJ.exe
  C:\Windows\System\UdTngGJ.exe
  2⤵
  PID:2112
- C:\Windows\System\pRVBEHX.exe
  C:\Windows\System\pRVBEHX.exe
  2⤵
  PID:3128
- C:\Windows\System\LMIRjXd.exe
  C:\Windows\System\LMIRjXd.exe
  2⤵
  PID:3196
- C:\Windows\System\ctfziWC.exe
  C:\Windows\System\ctfziWC.exe
  2⤵
  PID:3272
- C:\Windows\System\OZpcLCQ.exe
  C:\Windows\System\OZpcLCQ.exe
  2⤵
  PID:3260
- C:\Windows\System\pbHKzHf.exe
  C:\Windows\System\pbHKzHf.exe
  2⤵
  PID:3692
- C:\Windows\System\chsjfnE.exe
  C:\Windows\System\chsjfnE.exe
  2⤵
  PID:3708
- C:\Windows\System\cpjGrFo.exe
  C:\Windows\System\cpjGrFo.exe
  2⤵
  PID:3724
- C:\Windows\System\ILyjfmg.exe
  C:\Windows\System\ILyjfmg.exe
  2⤵
  PID:3780
- C:\Windows\System\VHvnanB.exe
  C:\Windows\System\VHvnanB.exe
  2⤵
  PID:3796
- C:\Windows\System\IwIZqYM.exe
  C:\Windows\System\IwIZqYM.exe
  2⤵
  PID:3500
- C:\Windows\System\zEFOHKd.exe
  C:\Windows\System\zEFOHKd.exe
  2⤵
  PID:3528
- C:\Windows\System\nXqCeeQ.exe
  C:\Windows\System\nXqCeeQ.exe
  2⤵
  PID:3544
- C:\Windows\System\nPySTsT.exe
  C:\Windows\System\nPySTsT.exe
  2⤵
  PID:3560
- C:\Windows\System\ohqRmvs.exe
  C:\Windows\System\ohqRmvs.exe
  2⤵
  PID:944
- C:\Windows\System\OXFBdqn.exe
  C:\Windows\System\OXFBdqn.exe
  2⤵
  PID:3812
- C:\Windows\System\SERuYAk.exe
  C:\Windows\System\SERuYAk.exe
  2⤵
  PID:3828
- C:\Windows\System\qUJoClJ.exe
  C:\Windows\System\qUJoClJ.exe
  2⤵
  PID:2652
- C:\Windows\System\LPgTolV.exe
  C:\Windows\System\LPgTolV.exe
  2⤵
  PID:3920
- C:\Windows\System\KhcOevB.exe
  C:\Windows\System\KhcOevB.exe
  2⤵
  PID:2380
- C:\Windows\System\APWWpKf.exe
  C:\Windows\System\APWWpKf.exe
  2⤵
  PID:3944
- C:\Windows\System\LOXhqpl.exe
  C:\Windows\System\LOXhqpl.exe
  2⤵
  PID:4060
- C:\Windows\System\FDMhyLh.exe
  C:\Windows\System\FDMhyLh.exe
  2⤵
  PID:4048
- C:\Windows\System\qxTfpCR.exe
  C:\Windows\System\qxTfpCR.exe
  2⤵
  PID:2920
- C:\Windows\System\pOtlrKl.exe
  C:\Windows\System\pOtlrKl.exe
  2⤵
  PID:3980
- C:\Windows\System\gAXlzVX.exe
  C:\Windows\System\gAXlzVX.exe
  2⤵
  PID:3076
- C:\Windows\System\nAtzEJG.exe
  C:\Windows\System\nAtzEJG.exe
  2⤵
  PID:2012
- C:\Windows\System\KcIYMfY.exe
  C:\Windows\System\KcIYMfY.exe
  2⤵
  PID:1364
- C:\Windows\System\rbPRzYa.exe
  C:\Windows\System\rbPRzYa.exe
  2⤵
  PID:2072
- C:\Windows\System\HhtvUPN.exe
  C:\Windows\System\HhtvUPN.exe
  2⤵
  PID:4024
- C:\Windows\System\ubkIWkr.exe
  C:\Windows\System\ubkIWkr.exe
  2⤵
  PID:2492
- C:\Windows\System\skHDtHT.exe
  C:\Windows\System\skHDtHT.exe
  2⤵
  PID:1580
- C:\Windows\System\AilCbvV.exe
  C:\Windows\System\AilCbvV.exe
  2⤵
  PID:2724
- C:\Windows\System\PaYuvIk.exe
  C:\Windows\System\PaYuvIk.exe
  2⤵
  PID:2560
- C:\Windows\System\BnaVzhb.exe
  C:\Windows\System\BnaVzhb.exe
  2⤵
  PID:1804
- C:\Windows\System\YhxGWhj.exe
  C:\Windows\System\YhxGWhj.exe
  2⤵
  PID:2752
- C:\Windows\System\INvSpMq.exe
  C:\Windows\System\INvSpMq.exe
  2⤵
  PID:2932
- C:\Windows\System\jxTRSyG.exe
  C:\Windows\System\jxTRSyG.exe
  2⤵
  PID:2976
- C:\Windows\System\yIbqqjj.exe
  C:\Windows\System\yIbqqjj.exe
  2⤵
  PID:1212
- C:\Windows\System\BlowXjb.exe
  C:\Windows\System\BlowXjb.exe
  2⤵
  PID:3096
- C:\Windows\System\BwDDxMZ.exe
  C:\Windows\System\BwDDxMZ.exe
  2⤵
  PID:3644
- C:\Windows\System\VlYcCAk.exe
  C:\Windows\System\VlYcCAk.exe
  2⤵
  PID:2520
- C:\Windows\System\gsiMGbp.exe
  C:\Windows\System\gsiMGbp.exe
  2⤵
  PID:1868
- C:\Windows\System\CLIaVjn.exe
  C:\Windows\System\CLIaVjn.exe
  2⤵
  PID:2780
- C:\Windows\System\QOUJUVZ.exe
  C:\Windows\System\QOUJUVZ.exe
  2⤵
  PID:2916
- C:\Windows\System\MVndrzm.exe
  C:\Windows\System\MVndrzm.exe
  2⤵
  PID:956
- C:\Windows\System\YVwzSRC.exe
  C:\Windows\System\YVwzSRC.exe
  2⤵
  PID:692
- C:\Windows\System\wqtCBzz.exe
  C:\Windows\System\wqtCBzz.exe
  2⤵
  PID:2292
- C:\Windows\System\xfQuWZB.exe
  C:\Windows\System\xfQuWZB.exe
  2⤵
  PID:3748
- C:\Windows\System\MCnGkNJ.exe
  C:\Windows\System\MCnGkNJ.exe
  2⤵
  PID:3772
- C:\Windows\System\iDXYgDe.exe
  C:\Windows\System\iDXYgDe.exe
  2⤵
  PID:3512
- C:\Windows\System\EDOQuNL.exe
  C:\Windows\System\EDOQuNL.exe
  2⤵
  PID:3412
- C:\Windows\System\MQpykqn.exe
  C:\Windows\System\MQpykqn.exe
  2⤵
  PID:3428
- C:\Windows\System\DeWoVjb.exe
  C:\Windows\System\DeWoVjb.exe
  2⤵
  PID:3444
- C:\Windows\System\pDkBhIp.exe
  C:\Windows\System\pDkBhIp.exe
  2⤵
  PID:3460
- C:\Windows\System\oHlxAkW.exe
  C:\Windows\System\oHlxAkW.exe
  2⤵
  PID:3480
- C:\Windows\System\dvNkKFC.exe
  C:\Windows\System\dvNkKFC.exe
  2⤵
  PID:3496
- C:\Windows\System\RtrRSnu.exe
  C:\Windows\System\RtrRSnu.exe
  2⤵
  PID:1072
- C:\Windows\System\AInwasw.exe
  C:\Windows\System\AInwasw.exe
  2⤵
  PID:2836
- C:\Windows\System\lSujlJd.exe
  C:\Windows\System\lSujlJd.exe
  2⤵
  PID:1208
- C:\Windows\System\QDzwTGx.exe
  C:\Windows\System\QDzwTGx.exe
  2⤵
  PID:3060
- C:\Windows\System\ggXeGUU.exe
  C:\Windows\System\ggXeGUU.exe
  2⤵
  PID:2980
- C:\Windows\System\CywynHf.exe
  C:\Windows\System\CywynHf.exe
  2⤵
  PID:3524
- C:\Windows\System\gAxDsXm.exe
  C:\Windows\System\gAxDsXm.exe
  2⤵
  PID:3556
- C:\Windows\System\NCeKVTs.exe
  C:\Windows\System\NCeKVTs.exe
  2⤵
  PID:1676
- C:\Windows\System\WIodTdD.exe
  C:\Windows\System\WIodTdD.exe
  2⤵
  PID:3860
- C:\Windows\System\PvNIfxg.exe
  C:\Windows\System\PvNIfxg.exe
  2⤵
  PID:3824
- C:\Windows\System\MapgPwG.exe
  C:\Windows\System\MapgPwG.exe
  2⤵
  PID:3960
- C:\Windows\System\ZqrOAlB.exe
  C:\Windows\System\ZqrOAlB.exe
  2⤵
  PID:2844
- C:\Windows\System\LizwYFG.exe
  C:\Windows\System\LizwYFG.exe
  2⤵
  PID:3008
- C:\Windows\System\WvJQCgy.exe
  C:\Windows\System\WvJQCgy.exe
  2⤵
  PID:2348
- C:\Windows\System\JDVEXBL.exe
  C:\Windows\System\JDVEXBL.exe
  2⤵
  PID:304
- C:\Windows\System\CBBfMVI.exe
  C:\Windows\System\CBBfMVI.exe
  2⤵
  PID:4040
- C:\Windows\System\VsiXHtx.exe
  C:\Windows\System\VsiXHtx.exe
  2⤵
  PID:4036
- C:\Windows\System\GsRNwIQ.exe
  C:\Windows\System\GsRNwIQ.exe
  2⤵
  PID:3636
- C:\Windows\System\qRuFhmM.exe
  C:\Windows\System\qRuFhmM.exe
  2⤵
  PID:3388
- C:\Windows\System\VxxzMTm.exe
  C:\Windows\System\VxxzMTm.exe
  2⤵
  PID:2212
- C:\Windows\System\UQoSFao.exe
  C:\Windows\System\UQoSFao.exe
  2⤵
  PID:3420
- C:\Windows\System\ogyiyeZ.exe
  C:\Windows\System\ogyiyeZ.exe
  2⤵
  PID:3452
- C:\Windows\System\TXeyACd.exe
  C:\Windows\System\TXeyACd.exe
  2⤵
  PID:3776
- C:\Windows\System\EEGFyXq.exe
  C:\Windows\System\EEGFyXq.exe
  2⤵
  PID:888
- C:\Windows\System\endVVnm.exe
  C:\Windows\System\endVVnm.exe
  2⤵
  PID:3732
- C:\Windows\System\kjHfmib.exe
  C:\Windows\System\kjHfmib.exe
  2⤵
  PID:2176
- C:\Windows\System\JltPayN.exe
  C:\Windows\System\JltPayN.exe
  2⤵
  PID:3392
- C:\Windows\System\VJEctAe.exe
  C:\Windows\System\VJEctAe.exe
  2⤵
  PID:3888
- C:\Windows\System\byHoZzA.exe
  C:\Windows\System\byHoZzA.exe
  2⤵
  PID:2516
- C:\Windows\System\qcRTotX.exe
  C:\Windows\System\qcRTotX.exe
  2⤵
  PID:388
- C:\Windows\System\aRFgxvR.exe
  C:\Windows\System\aRFgxvR.exe
  2⤵
  PID:1232
- C:\Windows\System\XFdDMJm.exe
  C:\Windows\System\XFdDMJm.exe
  2⤵
  PID:3540
- C:\Windows\System\KJiZzuD.exe
  C:\Windows\System\KJiZzuD.exe
  2⤵
  PID:2240
- C:\Windows\System\kmWZUJb.exe
  C:\Windows\System\kmWZUJb.exe
  2⤵
  PID:3844
- C:\Windows\System\YGJAyBc.exe
  C:\Windows\System\YGJAyBc.exe
  2⤵
  PID:1468
- C:\Windows\System\KhpJQLH.exe
  C:\Windows\System\KhpJQLH.exe
  2⤵
  PID:3764
- C:\Windows\System\deyIUwZ.exe
  C:\Windows\System\deyIUwZ.exe
  2⤵
  PID:3436
- C:\Windows\System\GIhWZrx.exe
  C:\Windows\System\GIhWZrx.exe
  2⤵
  PID:3468
- C:\Windows\System\WclYUJP.exe
  C:\Windows\System\WclYUJP.exe
  2⤵
  PID:2540
- C:\Windows\System\fkJDkei.exe
  C:\Windows\System\fkJDkei.exe
  2⤵
  PID:2220
- C:\Windows\System\ZMOCgfs.exe
  C:\Windows\System\ZMOCgfs.exe
  2⤵
  PID:3592
- C:\Windows\System\KaVjdAL.exe
  C:\Windows\System\KaVjdAL.exe
  2⤵
  PID:2388
- C:\Windows\System\eKDwykX.exe
  C:\Windows\System\eKDwykX.exe
  2⤵
  PID:884
- C:\Windows\System\FtDvqui.exe
  C:\Windows\System\FtDvqui.exe
  2⤵
  PID:4080
- C:\Windows\System\KtMtVeD.exe
  C:\Windows\System\KtMtVeD.exe
  2⤵
  PID:4016
- C:\Windows\System\fceCVWI.exe
  C:\Windows\System\fceCVWI.exe
  2⤵
  PID:1144
- C:\Windows\System\qSJJhjS.exe
  C:\Windows\System\qSJJhjS.exe
  2⤵
  PID:3372
- C:\Windows\System\EItuPXB.exe
  C:\Windows\System\EItuPXB.exe
  2⤵
  PID:2036
- C:\Windows\System\UcUbrdv.exe
  C:\Windows\System\UcUbrdv.exe
  2⤵
  PID:2564
- C:\Windows\System\FdEqXRH.exe
  C:\Windows\System\FdEqXRH.exe
  2⤵
  PID:352
- C:\Windows\System\pSfEcOp.exe
  C:\Windows\System\pSfEcOp.exe
  2⤵
  PID:3608
- C:\Windows\System\opOfUcM.exe
  C:\Windows\System\opOfUcM.exe
  2⤵
  PID:1768
- C:\Windows\System\iNhxCUv.exe
  C:\Windows\System\iNhxCUv.exe
  2⤵
  PID:1620
- C:\Windows\System\aMPBgyH.exe
  C:\Windows\System\aMPBgyH.exe
  2⤵
  PID:3864
- C:\Windows\System\ITzJHFD.exe
  C:\Windows\System\ITzJHFD.exe
  2⤵
  PID:2700
- C:\Windows\System\NAdbPiE.exe
  C:\Windows\System\NAdbPiE.exe
  2⤵
  PID:4000
- C:\Windows\System\qteriAX.exe
  C:\Windows\System\qteriAX.exe
  2⤵
  PID:2556
- C:\Windows\System\gpFIHRE.exe
  C:\Windows\System\gpFIHRE.exe
  2⤵
  PID:3964
- C:\Windows\System\AjDyJOH.exe
  C:\Windows\System\AjDyJOH.exe
  2⤵
  PID:2508
- C:\Windows\System\sslqwzU.exe
  C:\Windows\System\sslqwzU.exe
  2⤵
  PID:3820
- C:\Windows\System\RnTdfLD.exe
  C:\Windows\System\RnTdfLD.exe
  2⤵
  PID:3908
- C:\Windows\System\KvXOTuS.exe
  C:\Windows\System\KvXOTuS.exe
  2⤵
  PID:2964
- C:\Windows\System\ACyupkR.exe
  C:\Windows\System\ACyupkR.exe
  2⤵
  PID:3584
- C:\Windows\System\nhMtghm.exe
  C:\Windows\System\nhMtghm.exe
  2⤵
  PID:1460
- C:\Windows\System\ikrBuyw.exe
  C:\Windows\System\ikrBuyw.exe
  2⤵
  PID:624
- C:\Windows\System\TTdAVnG.exe
  C:\Windows\System\TTdAVnG.exe
  2⤵
  PID:1828
- C:\Windows\System\CqxCXmI.exe
  C:\Windows\System\CqxCXmI.exe
  2⤵
  PID:3744
- C:\Windows\System\BRgNCOQ.exe
  C:\Windows\System\BRgNCOQ.exe
  2⤵
  PID:2104
- C:\Windows\System\GtTyfJk.exe
  C:\Windows\System\GtTyfJk.exe
  2⤵
  PID:1048
- C:\Windows\System\bHwdgfa.exe
  C:\Windows\System\bHwdgfa.exe
  2⤵
  PID:4104
- C:\Windows\System\gpwBqHj.exe
  C:\Windows\System\gpwBqHj.exe
  2⤵
  PID:4212
- C:\Windows\System\riXokhn.exe
  C:\Windows\System\riXokhn.exe
  2⤵
  PID:4236
- C:\Windows\System\xCyFzNM.exe
  C:\Windows\System\xCyFzNM.exe
  2⤵
  PID:4256
- C:\Windows\System\gkDTTcz.exe
  C:\Windows\System\gkDTTcz.exe
  2⤵
  PID:4272
- C:\Windows\System\wkXmCcT.exe
  C:\Windows\System\wkXmCcT.exe
  2⤵
  PID:4300
- C:\Windows\System\aIRxRGN.exe
  C:\Windows\System\aIRxRGN.exe
  2⤵
  PID:4320
- C:\Windows\System\RnWgnUc.exe
  C:\Windows\System\RnWgnUc.exe
  2⤵
  PID:4340
- C:\Windows\System\XdCLtil.exe
  C:\Windows\System\XdCLtil.exe
  2⤵
  PID:4356
- C:\Windows\System\OSgRpMN.exe
  C:\Windows\System\OSgRpMN.exe
  2⤵
  PID:4384
- C:\Windows\System\BIaVjbf.exe
  C:\Windows\System\BIaVjbf.exe
  2⤵
  PID:4408
- C:\Windows\System\npgpYpO.exe
  C:\Windows\System\npgpYpO.exe
  2⤵
  PID:4424
- C:\Windows\System\irclUBF.exe
  C:\Windows\System\irclUBF.exe
  2⤵
  PID:4496
- C:\Windows\System\IbfOJHt.exe
  C:\Windows\System\IbfOJHt.exe
  2⤵
  PID:4520
- C:\Windows\System\FEbCXDe.exe
  C:\Windows\System\FEbCXDe.exe
  2⤵
  PID:4540
- C:\Windows\System\NTkFefl.exe
  C:\Windows\System\NTkFefl.exe
  2⤵
  PID:4560
- C:\Windows\System\rIlQtkG.exe
  C:\Windows\System\rIlQtkG.exe
  2⤵
  PID:4576
- C:\Windows\System\MpIeVyK.exe
  C:\Windows\System\MpIeVyK.exe
  2⤵
  PID:4600
- C:\Windows\System\xrkzjWf.exe
  C:\Windows\System\xrkzjWf.exe
  2⤵
  PID:4628
- C:\Windows\System\UnASZDp.exe
  C:\Windows\System\UnASZDp.exe
  2⤵
  PID:4652
- C:\Windows\System\mxnObbl.exe
  C:\Windows\System\mxnObbl.exe
  2⤵
  PID:4676
- C:\Windows\System\ameUSkB.exe
  C:\Windows\System\ameUSkB.exe
  2⤵
  PID:4700
- C:\Windows\System\halwlwB.exe
  C:\Windows\System\halwlwB.exe
  2⤵
  PID:4716
- C:\Windows\System\TFpjfuy.exe
  C:\Windows\System\TFpjfuy.exe
  2⤵
  PID:4732
- C:\Windows\System\pqJOSzC.exe
  C:\Windows\System\pqJOSzC.exe
  2⤵
  PID:4748
- C:\Windows\System\fntTTQQ.exe
  C:\Windows\System\fntTTQQ.exe
  2⤵
  PID:4764
- C:\Windows\System\xXStXla.exe
  C:\Windows\System\xXStXla.exe
  2⤵
  PID:4780
- C:\Windows\System\XesTfsJ.exe
  C:\Windows\System\XesTfsJ.exe
  2⤵
  PID:4796
- C:\Windows\System\RywyuSX.exe
  C:\Windows\System\RywyuSX.exe
  2⤵
  PID:4812
- C:\Windows\System\YPGBdxZ.exe
  C:\Windows\System\YPGBdxZ.exe
  2⤵
  PID:4828
- C:\Windows\System\grRjNoi.exe
  C:\Windows\System\grRjNoi.exe
  2⤵
  PID:4844
- C:\Windows\System\TCxQOkF.exe
  C:\Windows\System\TCxQOkF.exe
  2⤵
  PID:4860
- C:\Windows\System\NsFyBgI.exe
  C:\Windows\System\NsFyBgI.exe
  2⤵
  PID:4876
- C:\Windows\System\TOJIWLG.exe
  C:\Windows\System\TOJIWLG.exe
  2⤵
  PID:4892
- C:\Windows\System\PYvHHCj.exe
  C:\Windows\System\PYvHHCj.exe
  2⤵
  PID:4908
- C:\Windows\System\ZKULCUn.exe
  C:\Windows\System\ZKULCUn.exe
  2⤵
  PID:4924
- C:\Windows\System\biuNROK.exe
  C:\Windows\System\biuNROK.exe
  2⤵
  PID:4940
- C:\Windows\System\bnAPrFS.exe
  C:\Windows\System\bnAPrFS.exe
  2⤵
  PID:4956
- C:\Windows\System\SUfkcyd.exe
  C:\Windows\System\SUfkcyd.exe
  2⤵
  PID:4972
- C:\Windows\System\zLTTsLL.exe
  C:\Windows\System\zLTTsLL.exe
  2⤵
  PID:4988
- C:\Windows\System\wEonUwx.exe
  C:\Windows\System\wEonUwx.exe
  2⤵
  PID:5004
- C:\Windows\System\ggjyJac.exe
  C:\Windows\System\ggjyJac.exe
  2⤵
  PID:5020
- C:\Windows\System\vvNgspM.exe
  C:\Windows\System\vvNgspM.exe
  2⤵
  PID:5036
- C:\Windows\System\drordYP.exe
  C:\Windows\System\drordYP.exe
  2⤵
  PID:5052
- C:\Windows\System\jJYbGAJ.exe
  C:\Windows\System\jJYbGAJ.exe
  2⤵
  PID:5088
- C:\Windows\System\WSyDIOg.exe
  C:\Windows\System\WSyDIOg.exe
  2⤵
  PID:5108
- C:\Windows\System\WoYWRQB.exe
  C:\Windows\System\WoYWRQB.exe
  2⤵
  PID:3760
- C:\Windows\System\DTMbAKD.exe
  C:\Windows\System\DTMbAKD.exe
  2⤵
  PID:3492
- C:\Windows\System\eULMyoC.exe
  C:\Windows\System\eULMyoC.exe
  2⤵
  PID:1572
- C:\Windows\System\AyayXjW.exe
  C:\Windows\System\AyayXjW.exe
  2⤵
  PID:4132
- C:\Windows\System\lQkWCjP.exe
  C:\Windows\System\lQkWCjP.exe
  2⤵
  PID:4144
- C:\Windows\System\mdhegYn.exe
  C:\Windows\System\mdhegYn.exe
  2⤵
  PID:4156
- C:\Windows\System\TjUPuWK.exe
  C:\Windows\System\TjUPuWK.exe
  2⤵
  PID:4168
- C:\Windows\System\iYMYMQh.exe
  C:\Windows\System\iYMYMQh.exe
  2⤵
  PID:4188
- C:\Windows\System\HcVUcWy.exe
  C:\Windows\System\HcVUcWy.exe
  2⤵
  PID:3880
- C:\Windows\System\nPVWMMv.exe
  C:\Windows\System\nPVWMMv.exe
  2⤵
  PID:4252
- C:\Windows\System\cbZXeeo.exe
  C:\Windows\System\cbZXeeo.exe
  2⤵
  PID:4248
- C:\Windows\System\prhZtds.exe
  C:\Windows\System\prhZtds.exe
  2⤵
  PID:4284
- C:\Windows\System\RKgykEO.exe
  C:\Windows\System\RKgykEO.exe
  2⤵
  PID:4316
- C:\Windows\System\uAfVKAF.exe
  C:\Windows\System\uAfVKAF.exe
  2⤵
  PID:4332
- C:\Windows\System\HooDTqp.exe
  C:\Windows\System\HooDTqp.exe
  2⤵
  PID:4368
- C:\Windows\System\qqjlyBY.exe
  C:\Windows\System\qqjlyBY.exe
  2⤵
  PID:4392
- C:\Windows\System\ATNXVEY.exe
  C:\Windows\System\ATNXVEY.exe
  2⤵
  PID:4416
- C:\Windows\System\BbsNSaP.exe
  C:\Windows\System\BbsNSaP.exe
  2⤵
  PID:4436
- C:\Windows\System\LAkJSNe.exe
  C:\Windows\System\LAkJSNe.exe
  2⤵
  PID:4516
- C:\Windows\System\wPRfrfV.exe
  C:\Windows\System\wPRfrfV.exe
  2⤵
  PID:4464
- C:\Windows\System\JvBGfWS.exe
  C:\Windows\System\JvBGfWS.exe
  2⤵
  PID:4480
- C:\Windows\System\HhATrnb.exe
  C:\Windows\System\HhATrnb.exe
  2⤵
  PID:4440
- C:\Windows\System\KYKANKW.exe
  C:\Windows\System\KYKANKW.exe
  2⤵
  PID:4448
- C:\Windows\System\GtsyByK.exe
  C:\Windows\System\GtsyByK.exe
  2⤵
  PID:4612
- C:\Windows\System\dyqtnVO.exe
  C:\Windows\System\dyqtnVO.exe
  2⤵
  PID:4660
- C:\Windows\System\sWpcgyu.exe
  C:\Windows\System\sWpcgyu.exe
  2⤵
  PID:1812
- C:\Windows\System\azOuJDd.exe
  C:\Windows\System\azOuJDd.exe
  2⤵
  PID:4744
- C:\Windows\System\czdtGcX.exe
  C:\Windows\System\czdtGcX.exe
  2⤵
  PID:4808
- C:\Windows\System\lZUWJVG.exe
  C:\Windows\System\lZUWJVG.exe
  2⤵
  PID:4872
- C:\Windows\System\LTGnOfF.exe
  C:\Windows\System\LTGnOfF.exe
  2⤵
  PID:4936
- C:\Windows\System\yHFnOel.exe
  C:\Windows\System\yHFnOel.exe
  2⤵
  PID:4996
- C:\Windows\System\lQrEFvH.exe
  C:\Windows\System\lQrEFvH.exe
  2⤵
  PID:5060
- C:\Windows\System\ljACXAr.exe
  C:\Windows\System\ljACXAr.exe
  2⤵
  PID:4552
- C:\Windows\System\HwWvVVx.exe
  C:\Windows\System\HwWvVVx.exe
  2⤵
  PID:4888
- C:\Windows\System\gsMvZTC.exe
  C:\Windows\System\gsMvZTC.exe
  2⤵
  PID:4596
- C:\Windows\System\bywdtCn.exe
  C:\Windows\System\bywdtCn.exe
  2⤵
  PID:4648
- C:\Windows\System\YkUoGRP.exe
  C:\Windows\System\YkUoGRP.exe
  2⤵
  PID:4696
- C:\Windows\System\GujxGQN.exe
  C:\Windows\System\GujxGQN.exe
  2⤵
  PID:4788
- C:\Windows\System\JFBpbtX.exe
  C:\Windows\System\JFBpbtX.exe
  2⤵
  PID:4852
- C:\Windows\System\SGebwAQ.exe
  C:\Windows\System\SGebwAQ.exe
  2⤵
  PID:4948
- C:\Windows\System\HEbwWxn.exe
  C:\Windows\System\HEbwWxn.exe
  2⤵
  PID:5012
- C:\Windows\System\AGgFbAA.exe
  C:\Windows\System\AGgFbAA.exe
  2⤵
  PID:5084
- C:\Windows\System\bRdhuur.exe
  C:\Windows\System\bRdhuur.exe
  2⤵
  PID:5116
- C:\Windows\System\EOiKQhX.exe
  C:\Windows\System\EOiKQhX.exe
  2⤵
  PID:4124
- C:\Windows\System\ITtFBUu.exe
  C:\Windows\System\ITtFBUu.exe
  2⤵
  PID:4196
- C:\Windows\System\jkROkJs.exe
  C:\Windows\System\jkROkJs.exe
  2⤵
  PID:4148
- C:\Windows\System\QhAbgfz.exe
  C:\Windows\System\QhAbgfz.exe
  2⤵
  PID:4116
- C:\Windows\System\AdSncAw.exe
  C:\Windows\System\AdSncAw.exe
  2⤵
  PID:5100
- C:\Windows\System\dVGeaoX.exe
  C:\Windows\System\dVGeaoX.exe
  2⤵
  PID:3408
- C:\Windows\System\nENzbtc.exe
  C:\Windows\System\nENzbtc.exe
  2⤵
  PID:4180
- C:\Windows\System\KBNzhrV.exe
  C:\Windows\System\KBNzhrV.exe
  2⤵
  PID:4268
- C:\Windows\System\umPzOhG.exe
  C:\Windows\System\umPzOhG.exe
  2⤵
  PID:4456
- C:\Windows\System\sqaWlZM.exe
  C:\Windows\System\sqaWlZM.exe
  2⤵
  PID:4488
- C:\Windows\System\AZexVHC.exe
  C:\Windows\System\AZexVHC.exe
  2⤵
  PID:4532
- C:\Windows\System\ZxAKBxR.exe
  C:\Windows\System\ZxAKBxR.exe
  2⤵
  PID:4712
- C:\Windows\System\ilqPcUi.exe
  C:\Windows\System\ilqPcUi.exe
  2⤵
  PID:3360
- C:\Windows\System\pkyzOMw.exe
  C:\Windows\System\pkyzOMw.exe
  2⤵
  PID:4968
- C:\Windows\System\UbUUdjv.exe
  C:\Windows\System\UbUUdjv.exe
  2⤵
  PID:4668
- C:\Windows\System\qciNpnx.exe
  C:\Windows\System\qciNpnx.exe
  2⤵
  PID:4608
- C:\Windows\System\mUzazii.exe
  C:\Windows\System\mUzazii.exe
  2⤵
  PID:4776
- C:\Windows\System\DLqBbYT.exe
  C:\Windows\System\DLqBbYT.exe
  2⤵
  PID:4932
- C:\Windows\System\BTQlLqs.exe
  C:\Windows\System\BTQlLqs.exe
  2⤵
  PID:4756
- C:\Windows\System\NCRokvD.exe
  C:\Windows\System\NCRokvD.exe
  2⤵
  PID:4728
- C:\Windows\System\CewkwNO.exe
  C:\Windows\System\CewkwNO.exe
  2⤵
  PID:5048
- C:\Windows\System\Crhyrzf.exe
  C:\Windows\System\Crhyrzf.exe
  2⤵
  PID:4232
- C:\Windows\System\eLstRcL.exe
  C:\Windows\System\eLstRcL.exe
  2⤵
  PID:4980
- C:\Windows\System\xglUsZa.exe
  C:\Windows\System\xglUsZa.exe
  2⤵
  PID:4372
- C:\Windows\System\FwDbyeR.exe
  C:\Windows\System\FwDbyeR.exe
  2⤵
  PID:4420
- C:\Windows\System\KmMNBsB.exe
  C:\Windows\System\KmMNBsB.exe
  2⤵
  PID:4548
- C:\Windows\System\YwERXns.exe
  C:\Windows\System\YwERXns.exe
  2⤵
  PID:5064
- C:\Windows\System\aaJgnQg.exe
  C:\Windows\System\aaJgnQg.exe
  2⤵
  PID:4592
- C:\Windows\System\bQcbLBI.exe
  C:\Windows\System\bQcbLBI.exe
  2⤵
  PID:5080
- C:\Windows\System\xLEraCW.exe
  C:\Windows\System\xLEraCW.exe
  2⤵
  PID:4164
- C:\Windows\System\edBdYwv.exe
  C:\Windows\System\edBdYwv.exe
  2⤵
  PID:4228
- C:\Windows\System\afrNppg.exe
  C:\Windows\System\afrNppg.exe
  2⤵
  PID:4208
- C:\Windows\System\LyBbvib.exe
  C:\Windows\System\LyBbvib.exe
  2⤵
  PID:4620
- C:\Windows\System\ElRezMC.exe
  C:\Windows\System\ElRezMC.exe
  2⤵
  PID:4452
- C:\Windows\System\hvyykAn.exe
  C:\Windows\System\hvyykAn.exe
  2⤵
  PID:3924
- C:\Windows\System\nvFJkpW.exe
  C:\Windows\System\nvFJkpW.exe
  2⤵
  PID:4644
- C:\Windows\System\tBuCmGy.exe
  C:\Windows\System\tBuCmGy.exe
  2⤵
  PID:5096
- C:\Windows\System\LRZfVAB.exe
  C:\Windows\System\LRZfVAB.exe
  2⤵
  PID:4348
- C:\Windows\System\MsLQNTK.exe
  C:\Windows\System\MsLQNTK.exe
  2⤵
  PID:4152
- C:\Windows\System\NNQnVxI.exe
  C:\Windows\System\NNQnVxI.exe
  2⤵
  PID:4820
- C:\Windows\System\tdHnrfC.exe
  C:\Windows\System\tdHnrfC.exe
  2⤵
  PID:3700
- C:\Windows\System\gjRuMLd.exe
  C:\Windows\System\gjRuMLd.exe
  2⤵
  PID:4692
- C:\Windows\System\XPWCAcQ.exe
  C:\Windows\System\XPWCAcQ.exe
  2⤵
  PID:4472
- C:\Windows\System\cWUVhZl.exe
  C:\Windows\System\cWUVhZl.exe
  2⤵
  PID:4476
- C:\Windows\System\jvRKRGb.exe
  C:\Windows\System\jvRKRGb.exe
  2⤵
  PID:5128
- C:\Windows\System\knTTZaM.exe
  C:\Windows\System\knTTZaM.exe
  2⤵
  PID:5144
- C:\Windows\System\HrDbNBY.exe
  C:\Windows\System\HrDbNBY.exe
  2⤵
  PID:5160
- C:\Windows\System\sRWDqCQ.exe
  C:\Windows\System\sRWDqCQ.exe
  2⤵
  PID:5176
- C:\Windows\System\nXUcCsd.exe
  C:\Windows\System\nXUcCsd.exe
  2⤵
  PID:5192
- C:\Windows\System\tRILGMJ.exe
  C:\Windows\System\tRILGMJ.exe
  2⤵
  PID:5208
- C:\Windows\System\TsDbMAB.exe
  C:\Windows\System\TsDbMAB.exe
  2⤵
  PID:5224
- C:\Windows\System\SWvVvDB.exe
  C:\Windows\System\SWvVvDB.exe
  2⤵
  PID:5240
- C:\Windows\System\YGEPFZU.exe
  C:\Windows\System\YGEPFZU.exe
  2⤵
  PID:5256
- C:\Windows\System\OOqejAm.exe
  C:\Windows\System\OOqejAm.exe
  2⤵
  PID:5272
- C:\Windows\System\egGQTrN.exe
  C:\Windows\System\egGQTrN.exe
  2⤵
  PID:5288
- C:\Windows\System\ZEjUOtz.exe
  C:\Windows\System\ZEjUOtz.exe
  2⤵
  PID:5304
- C:\Windows\System\qMakXuw.exe
  C:\Windows\System\qMakXuw.exe
  2⤵
  PID:5320
- C:\Windows\System\vDlRzNg.exe
  C:\Windows\System\vDlRzNg.exe
  2⤵
  PID:5336
- C:\Windows\System\mKxJjsn.exe
  C:\Windows\System\mKxJjsn.exe
  2⤵
  PID:5352
- C:\Windows\System\NIhepbw.exe
  C:\Windows\System\NIhepbw.exe
  2⤵
  PID:5368
- C:\Windows\System\ImijGJI.exe
  C:\Windows\System\ImijGJI.exe
  2⤵
  PID:5384
- C:\Windows\System\ImwqTJh.exe
  C:\Windows\System\ImwqTJh.exe
  2⤵
  PID:5400
- C:\Windows\System\KRBeKXN.exe
  C:\Windows\System\KRBeKXN.exe
  2⤵
  PID:5416
- C:\Windows\System\gXJyFHy.exe
  C:\Windows\System\gXJyFHy.exe
  2⤵
  PID:5432
- C:\Windows\System\GxWYfeh.exe
  C:\Windows\System\GxWYfeh.exe
  2⤵
  PID:5448
- C:\Windows\System\HVZYpYx.exe
  C:\Windows\System\HVZYpYx.exe
  2⤵
  PID:5464
- C:\Windows\System\htqmCQd.exe
  C:\Windows\System\htqmCQd.exe
  2⤵
  PID:5480
- C:\Windows\System\OtOiPkH.exe
  C:\Windows\System\OtOiPkH.exe
  2⤵
  PID:5496
- C:\Windows\System\dPOujIR.exe
  C:\Windows\System\dPOujIR.exe
  2⤵
  PID:5512
- C:\Windows\System\lHeylRK.exe
  C:\Windows\System\lHeylRK.exe
  2⤵
  PID:5528
- C:\Windows\System\agTdjKC.exe
  C:\Windows\System\agTdjKC.exe
  2⤵
  PID:5544
- C:\Windows\System\aihdOcU.exe
  C:\Windows\System\aihdOcU.exe
  2⤵
  PID:5564
- C:\Windows\System\FEWZFQs.exe
  C:\Windows\System\FEWZFQs.exe
  2⤵
  PID:5580
- C:\Windows\System\JvbQZYs.exe
  C:\Windows\System\JvbQZYs.exe
  2⤵
  PID:5596
- C:\Windows\System\KwkgpsU.exe
  C:\Windows\System\KwkgpsU.exe
  2⤵
  PID:5612
- C:\Windows\System\juJDbvv.exe
  C:\Windows\System\juJDbvv.exe
  2⤵
  PID:5628
- C:\Windows\System\gauAWJD.exe
  C:\Windows\System\gauAWJD.exe
  2⤵
  PID:5644
- C:\Windows\System\yAJXkky.exe
  C:\Windows\System\yAJXkky.exe
  2⤵
  PID:5660
- C:\Windows\System\auWNgsm.exe
  C:\Windows\System\auWNgsm.exe
  2⤵
  PID:5676
- C:\Windows\System\shgIiha.exe
  C:\Windows\System\shgIiha.exe
  2⤵
  PID:5692
- C:\Windows\System\JDVwIqU.exe
  C:\Windows\System\JDVwIqU.exe
  2⤵
  PID:5708
- C:\Windows\System\EioddCl.exe
  C:\Windows\System\EioddCl.exe
  2⤵
  PID:5724
- C:\Windows\System\QGnLeBA.exe
  C:\Windows\System\QGnLeBA.exe
  2⤵
  PID:5740
- C:\Windows\System\IucrwWp.exe
  C:\Windows\System\IucrwWp.exe
  2⤵
  PID:5756
- C:\Windows\System\AOmxJqd.exe
  C:\Windows\System\AOmxJqd.exe
  2⤵
  PID:5772
- C:\Windows\System\lyqzuse.exe
  C:\Windows\System\lyqzuse.exe
  2⤵
  PID:5788
- C:\Windows\System\heiuAOa.exe
  C:\Windows\System\heiuAOa.exe
  2⤵
  PID:5804
- C:\Windows\System\jEYpYcA.exe
  C:\Windows\System\jEYpYcA.exe
  2⤵
  PID:5820
- C:\Windows\System\ushfAYE.exe
  C:\Windows\System\ushfAYE.exe
  2⤵
  PID:5836
- C:\Windows\System\HOzjyqv.exe
  C:\Windows\System\HOzjyqv.exe
  2⤵
  PID:5852
- C:\Windows\System\eQSGqkv.exe
  C:\Windows\System\eQSGqkv.exe
  2⤵
  PID:5868
- C:\Windows\System\BHYBaOp.exe
  C:\Windows\System\BHYBaOp.exe
  2⤵
  PID:5884
- C:\Windows\System\jdnrPkV.exe
  C:\Windows\System\jdnrPkV.exe
  2⤵
  PID:5900
- C:\Windows\System\BnGwvFM.exe
  C:\Windows\System\BnGwvFM.exe
  2⤵
  PID:5916
- C:\Windows\System\qprzylK.exe
  C:\Windows\System\qprzylK.exe
  2⤵
  PID:5932
- C:\Windows\System\yvJFBpV.exe
  C:\Windows\System\yvJFBpV.exe
  2⤵
  PID:5948
- C:\Windows\System\hbjZQjy.exe
  C:\Windows\System\hbjZQjy.exe
  2⤵
  PID:5964
- C:\Windows\System\IyMBRIh.exe
  C:\Windows\System\IyMBRIh.exe
  2⤵
  PID:5984
- C:\Windows\System\iaZluuP.exe
  C:\Windows\System\iaZluuP.exe
  2⤵
  PID:6000
- C:\Windows\System\gBbiTYM.exe
  C:\Windows\System\gBbiTYM.exe
  2⤵
  PID:6016
- C:\Windows\System\GlkUypx.exe
  C:\Windows\System\GlkUypx.exe
  2⤵
  PID:6032
- C:\Windows\System\nTZvSng.exe
  C:\Windows\System\nTZvSng.exe
  2⤵
  PID:6048
- C:\Windows\System\FnsJhgc.exe
  C:\Windows\System\FnsJhgc.exe
  2⤵
  PID:6064
- C:\Windows\System\qKDRBgn.exe
  C:\Windows\System\qKDRBgn.exe
  2⤵
  PID:6080
- C:\Windows\System\OsXXCTa.exe
  C:\Windows\System\OsXXCTa.exe
  2⤵
  PID:6096
- C:\Windows\System\wcXSUZj.exe
  C:\Windows\System\wcXSUZj.exe
  2⤵
  PID:6112
- C:\Windows\System\WaziSim.exe
  C:\Windows\System\WaziSim.exe
  2⤵
  PID:6128
- C:\Windows\System\fOrgRwT.exe
  C:\Windows\System\fOrgRwT.exe
  2⤵
  PID:5136
- C:\Windows\System\aAKAhRW.exe
  C:\Windows\System\aAKAhRW.exe
  2⤵
  PID:5124
- C:\Windows\System\whEBUSY.exe
  C:\Windows\System\whEBUSY.exe
  2⤵
  PID:5152
- C:\Windows\System\rHSSAwB.exe
  C:\Windows\System\rHSSAwB.exe
  2⤵
  PID:5204
- C:\Windows\System\JbVxXen.exe
  C:\Windows\System\JbVxXen.exe
  2⤵
  PID:5248
- C:\Windows\System\OpAWpsG.exe
  C:\Windows\System\OpAWpsG.exe
  2⤵
  PID:5316
- C:\Windows\System\qmyrVvf.exe
  C:\Windows\System\qmyrVvf.exe
  2⤵
  PID:5296
- C:\Windows\System\dBUUveT.exe
  C:\Windows\System\dBUUveT.exe
  2⤵
  PID:5236
- C:\Windows\System\rrnejcg.exe
  C:\Windows\System\rrnejcg.exe
  2⤵
  PID:5440
- C:\Windows\System\iMXrGxx.exe
  C:\Windows\System\iMXrGxx.exe
  2⤵
  PID:5380
- C:\Windows\System\ThmgUaH.exe
  C:\Windows\System\ThmgUaH.exe
  2⤵
  PID:5396
- C:\Windows\System\xljJzxQ.exe
  C:\Windows\System\xljJzxQ.exe
  2⤵
  PID:5476
- C:\Windows\System\rIFusBq.exe
  C:\Windows\System\rIFusBq.exe
  2⤵
  PID:5508
- C:\Windows\System\NdxVEmJ.exe
  C:\Windows\System\NdxVEmJ.exe
  2⤵
  PID:5524
- C:\Windows\System\HwcIsIY.exe
  C:\Windows\System\HwcIsIY.exe
  2⤵
  PID:5560
- C:\Windows\System\MuHvpSH.exe
  C:\Windows\System\MuHvpSH.exe
  2⤵
  PID:5624
- C:\Windows\System\lMCKStd.exe
  C:\Windows\System\lMCKStd.exe
  2⤵
  PID:5688
- C:\Windows\System\xTdUwpa.exe
  C:\Windows\System\xTdUwpa.exe
  2⤵
  PID:5704
- C:\Windows\System\IkgdSvK.exe
  C:\Windows\System\IkgdSvK.exe
  2⤵
  PID:5576
- C:\Windows\System\oWrCEmu.exe
  C:\Windows\System\oWrCEmu.exe
  2⤵
  PID:5764
- C:\Windows\System\oRFkOqe.exe
  C:\Windows\System\oRFkOqe.exe
  2⤵
  PID:5768
- C:\Windows\System\klqNJHo.exe
  C:\Windows\System\klqNJHo.exe
  2⤵
  PID:5748
- C:\Windows\System\nVrfIAc.exe
  C:\Windows\System\nVrfIAc.exe
  2⤵
  PID:5832
- C:\Windows\System\lnTbUhY.exe
  C:\Windows\System\lnTbUhY.exe
  2⤵
  PID:5844
- C:\Windows\System\azFtmVC.exe
  C:\Windows\System\azFtmVC.exe
  2⤵
  PID:5880
- C:\Windows\System\SVGmkij.exe
  C:\Windows\System\SVGmkij.exe
  2⤵
  PID:5956
- C:\Windows\System\jFubUBO.exe
  C:\Windows\System\jFubUBO.exe
  2⤵
  PID:6024
- C:\Windows\System\nuySpfJ.exe
  C:\Windows\System\nuySpfJ.exe
  2⤵
  PID:6056
- C:\Windows\System\cjQfAEo.exe
  C:\Windows\System\cjQfAEo.exe
  2⤵
  PID:5976
- C:\Windows\System\VwDGfif.exe
  C:\Windows\System\VwDGfif.exe
  2⤵
  PID:6092
- C:\Windows\System\XSVlIkY.exe
  C:\Windows\System\XSVlIkY.exe
  2⤵
  PID:6044
- C:\Windows\System\aXdxJAD.exe
  C:\Windows\System\aXdxJAD.exe
  2⤵
  PID:6104
- C:\Windows\System\TtSWfaN.exe
  C:\Windows\System\TtSWfaN.exe
  2⤵
  PID:5172
- C:\Windows\System\YAPGJZm.exe
  C:\Windows\System\YAPGJZm.exe
  2⤵
  PID:4568
- C:\Windows\System\aETwsfh.exe
  C:\Windows\System\aETwsfh.exe
  2⤵
  PID:5188
- C:\Windows\System\YKWRCVh.exe
  C:\Windows\System\YKWRCVh.exe
  2⤵
  PID:5200
- C:\Windows\System\khGYDtN.exe
  C:\Windows\System\khGYDtN.exe
  2⤵
  PID:5392
- C:\Windows\System\xEYGQaF.exe
  C:\Windows\System\xEYGQaF.exe
  2⤵
  PID:5752
- C:\Windows\System\RSBwCZD.exe
  C:\Windows\System\RSBwCZD.exe
  2⤵
  PID:5784
- C:\Windows\System\NOdeVLh.exe
  C:\Windows\System\NOdeVLh.exe
  2⤵
  PID:5992
- C:\Windows\System\ooNFPZW.exe
  C:\Windows\System\ooNFPZW.exe
  2⤵
  PID:5284
- C:\Windows\System\OOgAOFR.exe
  C:\Windows\System\OOgAOFR.exe
  2⤵
  PID:5376
- C:\Windows\System\nlTeFvY.exe
  C:\Windows\System\nlTeFvY.exe
  2⤵
  PID:5520
- C:\Windows\System\MemydMW.exe
  C:\Windows\System\MemydMW.exe
  2⤵
  PID:5700
- C:\Windows\System\nMWDrRM.exe
  C:\Windows\System\nMWDrRM.exe
  2⤵
  PID:5800
- C:\Windows\System\cFmKUqW.exe
  C:\Windows\System\cFmKUqW.exe
  2⤵
  PID:5928
- C:\Windows\System\WwewBYt.exe
  C:\Windows\System\WwewBYt.exe
  2⤵
  PID:6008
- C:\Windows\System\FkUwbTf.exe
  C:\Windows\System\FkUwbTf.exe
  2⤵
  PID:6140
- C:\Windows\System\SvkVAEC.exe
  C:\Windows\System\SvkVAEC.exe
  2⤵
  PID:5972
- C:\Windows\System\VCbVYdL.exe
  C:\Windows\System\VCbVYdL.exe
  2⤵
  PID:5656
- C:\Windows\System\MDRlmGr.exe
  C:\Windows\System\MDRlmGr.exe
  2⤵
  PID:5408
- C:\Windows\System\PnuxjqN.exe
  C:\Windows\System\PnuxjqN.exe
  2⤵
  PID:5332
- C:\Windows\System\hYOBebR.exe
  C:\Windows\System\hYOBebR.exe
  2⤵
  PID:5472
- C:\Windows\System\bWfmPME.exe
  C:\Windows\System\bWfmPME.exe
  2⤵
  PID:5672
- C:\Windows\System\JuVjpcI.exe
  C:\Windows\System\JuVjpcI.exe
  2⤵
  PID:5572
- C:\Windows\System\aKohwSY.exe
  C:\Windows\System\aKohwSY.exe
  2⤵
  PID:6028
- C:\Windows\System\qYLORPZ.exe
  C:\Windows\System\qYLORPZ.exe
  2⤵
  PID:5668
- C:\Windows\System\eRVjiDe.exe
  C:\Windows\System\eRVjiDe.exe
  2⤵
  PID:5456
- C:\Windows\System\XuVNzrV.exe
  C:\Windows\System\XuVNzrV.exe
  2⤵
  PID:5444
- C:\Windows\System\VIyWRFH.exe
  C:\Windows\System\VIyWRFH.exe
  2⤵
  PID:5540
- C:\Windows\System\Gjikdgg.exe
  C:\Windows\System\Gjikdgg.exe
  2⤵
  PID:5620
- C:\Windows\System\AFFqDAS.exe
  C:\Windows\System\AFFqDAS.exe
  2⤵
  PID:6152
- C:\Windows\System\UACFKWg.exe
  C:\Windows\System\UACFKWg.exe
  2⤵
  PID:6168
- C:\Windows\System\PZIPkzq.exe
  C:\Windows\System\PZIPkzq.exe
  2⤵
  PID:6184
- C:\Windows\System\SUrbWDw.exe
  C:\Windows\System\SUrbWDw.exe
  2⤵
  PID:6200
- C:\Windows\System\YGeDuNa.exe
  C:\Windows\System\YGeDuNa.exe
  2⤵
  PID:6216
- C:\Windows\System\AnsFofq.exe
  C:\Windows\System\AnsFofq.exe
  2⤵
  PID:6232
- C:\Windows\System\wATrhji.exe
  C:\Windows\System\wATrhji.exe
  2⤵
  PID:6248
- C:\Windows\System\YedfthJ.exe
  C:\Windows\System\YedfthJ.exe
  2⤵
  PID:6264
- C:\Windows\System\eVOsqVf.exe
  C:\Windows\System\eVOsqVf.exe
  2⤵
  PID:6280
- C:\Windows\System\saxWzil.exe
  C:\Windows\System\saxWzil.exe
  2⤵
  PID:6296
- C:\Windows\System\pToKfvT.exe
  C:\Windows\System\pToKfvT.exe
  2⤵
  PID:6312
- C:\Windows\System\hiRiqNf.exe
  C:\Windows\System\hiRiqNf.exe
  2⤵
  PID:6328
- C:\Windows\System\XqXMIDt.exe
  C:\Windows\System\XqXMIDt.exe
  2⤵
  PID:6344
- C:\Windows\System\upbTtmN.exe
  C:\Windows\System\upbTtmN.exe
  2⤵
  PID:6360
- C:\Windows\System\tBlUSTj.exe
  C:\Windows\System\tBlUSTj.exe
  2⤵
  PID:6376
- C:\Windows\System\pAzkGvD.exe
  C:\Windows\System\pAzkGvD.exe
  2⤵
  PID:6392
- C:\Windows\System\RIWWsHt.exe
  C:\Windows\System\RIWWsHt.exe
  2⤵
  PID:6408
- C:\Windows\System\zfNTfwb.exe
  C:\Windows\System\zfNTfwb.exe
  2⤵
  PID:6424
- C:\Windows\System\dGlxvqg.exe
  C:\Windows\System\dGlxvqg.exe
  2⤵
  PID:6440
- C:\Windows\System\lDdaePC.exe
  C:\Windows\System\lDdaePC.exe
  2⤵
  PID:6456
- C:\Windows\System\AogOnLF.exe
  C:\Windows\System\AogOnLF.exe
  2⤵
  PID:6472
- C:\Windows\System\umoRUzs.exe
  C:\Windows\System\umoRUzs.exe
  2⤵
  PID:6488
- C:\Windows\System\HlDdcpr.exe
  C:\Windows\System\HlDdcpr.exe
  2⤵
  PID:6504
- C:\Windows\System\KUMAfIg.exe
  C:\Windows\System\KUMAfIg.exe
  2⤵
  PID:6520
- C:\Windows\System\jLJeewN.exe
  C:\Windows\System\jLJeewN.exe
  2⤵
  PID:6536
- C:\Windows\System\wbroZzH.exe
  C:\Windows\System\wbroZzH.exe
  2⤵
  PID:6552
- C:\Windows\System\hUAlyQY.exe
  C:\Windows\System\hUAlyQY.exe
  2⤵
  PID:6568
- C:\Windows\System\mQmjfuB.exe
  C:\Windows\System\mQmjfuB.exe
  2⤵
  PID:6584
- C:\Windows\System\lDVoBHP.exe
  C:\Windows\System\lDVoBHP.exe
  2⤵
  PID:6600
- C:\Windows\System\bsBpreD.exe
  C:\Windows\System\bsBpreD.exe
  2⤵
  PID:6616
- C:\Windows\System\oSXWSsn.exe
  C:\Windows\System\oSXWSsn.exe
  2⤵
  PID:6632
- C:\Windows\System\ZMvwiZC.exe
  C:\Windows\System\ZMvwiZC.exe
  2⤵
  PID:6652
- C:\Windows\System\xvlugAZ.exe
  C:\Windows\System\xvlugAZ.exe
  2⤵
  PID:6668
- C:\Windows\System\yDNpGYH.exe
  C:\Windows\System\yDNpGYH.exe
  2⤵
  PID:6684
- C:\Windows\System\VlFHtGn.exe
  C:\Windows\System\VlFHtGn.exe
  2⤵
  PID:6700
- C:\Windows\System\WyeUyBW.exe
  C:\Windows\System\WyeUyBW.exe
  2⤵
  PID:6716
- C:\Windows\System\smHSgqL.exe
  C:\Windows\System\smHSgqL.exe
  2⤵
  PID:6732
- C:\Windows\System\RwNmobp.exe
  C:\Windows\System\RwNmobp.exe
  2⤵
  PID:6748
- C:\Windows\System\HVwoDmk.exe
  C:\Windows\System\HVwoDmk.exe
  2⤵
  PID:6780
- C:\Windows\System\rGzalzR.exe
  C:\Windows\System\rGzalzR.exe
  2⤵
  PID:6796
- C:\Windows\System\tvRzKfh.exe
  C:\Windows\System\tvRzKfh.exe
  2⤵
  PID:6812
- C:\Windows\System\nZvDtIV.exe
  C:\Windows\System\nZvDtIV.exe
  2⤵
  PID:6840
- C:\Windows\System\taYXVCf.exe
  C:\Windows\System\taYXVCf.exe
  2⤵
  PID:6872
- C:\Windows\System\QoLXRIn.exe
  C:\Windows\System\QoLXRIn.exe
  2⤵
  PID:6888
- C:\Windows\System\BWpYUaA.exe
  C:\Windows\System\BWpYUaA.exe
  2⤵
  PID:6904
- C:\Windows\System\DArNRML.exe
  C:\Windows\System\DArNRML.exe
  2⤵
  PID:6920
- C:\Windows\System\ZdIliyI.exe
  C:\Windows\System\ZdIliyI.exe
  2⤵
  PID:6936
- C:\Windows\System\KgcSEQV.exe
  C:\Windows\System\KgcSEQV.exe
  2⤵
  PID:6952
- C:\Windows\System\KFHkjVU.exe
  C:\Windows\System\KFHkjVU.exe
  2⤵
  PID:6972
- C:\Windows\System\kJcoctS.exe
  C:\Windows\System\kJcoctS.exe
  2⤵
  PID:6988
- C:\Windows\System\EEWXzId.exe
  C:\Windows\System\EEWXzId.exe
  2⤵
  PID:7004
- C:\Windows\System\DAiJJmm.exe
  C:\Windows\System\DAiJJmm.exe
  2⤵
  PID:7020
- C:\Windows\System\SyOACUY.exe
  C:\Windows\System\SyOACUY.exe
  2⤵
  PID:7036
- C:\Windows\System\tffPxes.exe
  C:\Windows\System\tffPxes.exe
  2⤵
  PID:7056
- C:\Windows\System\EbPFvPA.exe
  C:\Windows\System\EbPFvPA.exe
  2⤵
  PID:7072
- C:\Windows\System\KknPDQR.exe
  C:\Windows\System\KknPDQR.exe
  2⤵
  PID:7088
- C:\Windows\System\HkkRxhJ.exe
  C:\Windows\System\HkkRxhJ.exe
  2⤵
  PID:7108
- C:\Windows\System\GHTgETe.exe
  C:\Windows\System\GHTgETe.exe
  2⤵
  PID:7124
- C:\Windows\System\BCidHIr.exe
  C:\Windows\System\BCidHIr.exe
  2⤵
  PID:7140
- C:\Windows\System\YSFuBup.exe
  C:\Windows\System\YSFuBup.exe
  2⤵
  PID:7156
- C:\Windows\System\kJCvgqt.exe
  C:\Windows\System\kJCvgqt.exe
  2⤵
  PID:5608
- C:\Windows\System\NQEYRWk.exe
  C:\Windows\System\NQEYRWk.exe
  2⤵
  PID:5460
- C:\Windows\System\PreqXaI.exe
  C:\Windows\System\PreqXaI.exe
  2⤵
  PID:6196
- C:\Windows\System\FkJpBnL.exe
  C:\Windows\System\FkJpBnL.exe
  2⤵
  PID:6256
- C:\Windows\System\XFssqgS.exe
  C:\Windows\System\XFssqgS.exe
  2⤵
  PID:6288
- C:\Windows\System\ZWvyHQN.exe
  C:\Windows\System\ZWvyHQN.exe
  2⤵
  PID:6324
- C:\Windows\System\TcQRTdv.exe
  C:\Windows\System\TcQRTdv.exe
  2⤵
  PID:6212
- C:\Windows\System\jsltbym.exe
  C:\Windows\System\jsltbym.exe
  2⤵
  PID:6340
- C:\Windows\System\AwKTgIb.exe
  C:\Windows\System\AwKTgIb.exe
  2⤵
  PID:6372
- C:\Windows\System\yygxYzF.exe
  C:\Windows\System\yygxYzF.exe
  2⤵
  PID:6480
- C:\Windows\System\pgtnJaC.exe
  C:\Windows\System\pgtnJaC.exe
  2⤵
  PID:6416
- C:\Windows\System\KMTQUvY.exe
  C:\Windows\System\KMTQUvY.exe
  2⤵
  PID:6432
- C:\Windows\System\myyhmZU.exe
  C:\Windows\System\myyhmZU.exe
  2⤵
  PID:6500
- C:\Windows\System\yYisoJm.exe
  C:\Windows\System\yYisoJm.exe
  2⤵
  PID:6560
- C:\Windows\System\lZEhvVw.exe
  C:\Windows\System\lZEhvVw.exe
  2⤵
  PID:6548
- C:\Windows\System\UvQVPqJ.exe
  C:\Windows\System\UvQVPqJ.exe
  2⤵
  PID:6612
- C:\Windows\System\WEuLTHa.exe
  C:\Windows\System\WEuLTHa.exe
  2⤵
  PID:6624
- C:\Windows\System\vUTjDhJ.exe
  C:\Windows\System\vUTjDhJ.exe
  2⤵
  PID:6676
- C:\Windows\System\CLGzwli.exe
  C:\Windows\System\CLGzwli.exe
  2⤵
  PID:6708
- C:\Windows\System\dwQIZDR.exe
  C:\Windows\System\dwQIZDR.exe
  2⤵
  PID:6724
- C:\Windows\System\CBtxCwZ.exe
  C:\Windows\System\CBtxCwZ.exe
  2⤵
  PID:6772
- C:\Windows\System\QtbEoIO.exe
  C:\Windows\System\QtbEoIO.exe
  2⤵
  PID:6808
- C:\Windows\System\hSuIqYj.exe
  C:\Windows\System\hSuIqYj.exe
  2⤵
  PID:6824
- C:\Windows\System\iPWdkJq.exe
  C:\Windows\System\iPWdkJq.exe
  2⤵
  PID:6884
- C:\Windows\System\nhXxzne.exe
  C:\Windows\System\nhXxzne.exe
  2⤵
  PID:6944
- C:\Windows\System\bsEmAxE.exe
  C:\Windows\System\bsEmAxE.exe
  2⤵
  PID:6848
- C:\Windows\System\CuZnbcz.exe
  C:\Windows\System\CuZnbcz.exe
  2⤵
  PID:7016
- C:\Windows\System\COXkEos.exe
  C:\Windows\System\COXkEos.exe
  2⤵
  PID:7080
- C:\Windows\System\fwJNddr.exe
  C:\Windows\System\fwJNddr.exe
  2⤵
  PID:6860
- C:\Windows\System\tcwdRYd.exe
  C:\Windows\System\tcwdRYd.exe
  2⤵
  PID:7148
- C:\Windows\System\CysxadZ.exe
  C:\Windows\System\CysxadZ.exe
  2⤵
  PID:6176
- C:\Windows\System\yiQEHvz.exe
  C:\Windows\System\yiQEHvz.exe
  2⤵
  PID:6996
- C:\Windows\System\rxovmWI.exe
  C:\Windows\System\rxovmWI.exe
  2⤵
  PID:7068
- C:\Windows\System\nCAVQaq.exe
  C:\Windows\System\nCAVQaq.exe
  2⤵
  PID:6192
- C:\Windows\System\OwqFBWM.exe
  C:\Windows\System\OwqFBWM.exe
  2⤵
  PID:7132
- C:\Windows\System\pqxFFxa.exe
  C:\Windows\System\pqxFFxa.exe
  2⤵
  PID:7100
- C:\Windows\System\GbNiqfe.exe
  C:\Windows\System\GbNiqfe.exe
  2⤵
  PID:6452
- C:\Windows\System\RNLVGMK.exe
  C:\Windows\System\RNLVGMK.exe
  2⤵
  PID:7136
- C:\Windows\System\OVRFCZN.exe
  C:\Windows\System\OVRFCZN.exe
  2⤵
  PID:6564
- C:\Windows\System\LlXWswr.exe
  C:\Windows\System\LlXWswr.exe
  2⤵
  PID:6580
- C:\Windows\System\aQWGAqC.exe
  C:\Windows\System\aQWGAqC.exe
  2⤵
  PID:6352
- C:\Windows\System\CwragiX.exe
  C:\Windows\System\CwragiX.exe
  2⤵
  PID:6388
- C:\Windows\System\eeXavbu.exe
  C:\Windows\System\eeXavbu.exe
  2⤵
  PID:6404
- C:\Windows\System\cKnUYrH.exe
  C:\Windows\System\cKnUYrH.exe
  2⤵
  PID:6756
- C:\Windows\System\agTPHja.exe
  C:\Windows\System\agTPHja.exe
  2⤵
  PID:6696
- C:\Windows\System\tyzUbva.exe
  C:\Windows\System\tyzUbva.exe
  2⤵
  PID:6648
- C:\Windows\System\oFSsxoX.exe
  C:\Windows\System\oFSsxoX.exe
  2⤵
  PID:6916
- C:\Windows\System\pyTEGMf.exe
  C:\Windows\System\pyTEGMf.exe
  2⤵
  PID:6984
- C:\Windows\System\giSNfxE.exe
  C:\Windows\System\giSNfxE.exe
  2⤵
  PID:7116
- C:\Windows\System\qsnutfQ.exe
  C:\Windows\System\qsnutfQ.exe
  2⤵
  PID:6896
- C:\Windows\System\GqXLVJr.exe
  C:\Windows\System\GqXLVJr.exe
  2⤵
  PID:5864
- C:\Windows\System\ftlrtds.exe
  C:\Windows\System\ftlrtds.exe
  2⤵
  PID:6852
- C:\Windows\System\BbvClPm.exe
  C:\Windows\System\BbvClPm.exe
  2⤵
  PID:6464
- C:\Windows\System\kvDDpnH.exe
  C:\Windows\System\kvDDpnH.exe
  2⤵
  PID:6368
- C:\Windows\System\pAPTZrV.exe
  C:\Windows\System\pAPTZrV.exe
  2⤵
  PID:6664
- C:\Windows\System\gYdvpky.exe
  C:\Windows\System\gYdvpky.exe
  2⤵
  PID:6764
- C:\Windows\System\azYLEJh.exe
  C:\Windows\System\azYLEJh.exe
  2⤵
  PID:6928
- C:\Windows\System\ZEsrBPf.exe
  C:\Windows\System\ZEsrBPf.exe
  2⤵
  PID:6912
- C:\Windows\System\alKNRwq.exe
  C:\Windows\System\alKNRwq.exe
  2⤵
  PID:6644
- C:\Windows\System\qtrqVDs.exe
  C:\Windows\System\qtrqVDs.exe
  2⤵
  PID:6820
- C:\Windows\System\nPzgSzC.exe
  C:\Windows\System\nPzgSzC.exe
  2⤵
  PID:7012
- C:\Windows\System\HWgsVAJ.exe
  C:\Windows\System\HWgsVAJ.exe
  2⤵
  PID:6900
- C:\Windows\System\SOsDfAL.exe
  C:\Windows\System\SOsDfAL.exe
  2⤵
  PID:7104
- C:\Windows\System\PWMEgWG.exe
  C:\Windows\System\PWMEgWG.exe
  2⤵
  PID:6448
- C:\Windows\System\JSfEhIx.exe
  C:\Windows\System\JSfEhIx.exe
  2⤵
  PID:6836
- C:\Windows\System\pjbIsro.exe
  C:\Windows\System\pjbIsro.exe
  2⤵
  PID:5940
- C:\Windows\System\BNclULu.exe
  C:\Windows\System\BNclULu.exe
  2⤵
  PID:6260
- C:\Windows\System\eaLvOMD.exe
  C:\Windows\System\eaLvOMD.exe
  2⤵
  PID:6832
- C:\Windows\System\OSNZoNm.exe
  C:\Windows\System\OSNZoNm.exe
  2⤵
  PID:7184
- C:\Windows\System\SKdLuyS.exe
  C:\Windows\System\SKdLuyS.exe
  2⤵
  PID:7200
- C:\Windows\System\iPUsPOa.exe
  C:\Windows\System\iPUsPOa.exe
  2⤵
  PID:7216
- C:\Windows\System\PmFaqtT.exe
  C:\Windows\System\PmFaqtT.exe
  2⤵
  PID:7232
- C:\Windows\System\zyJcWgy.exe
  C:\Windows\System\zyJcWgy.exe
  2⤵
  PID:7248
- C:\Windows\System\TIzfxFT.exe
  C:\Windows\System\TIzfxFT.exe
  2⤵
  PID:7264
- C:\Windows\System\DaZLYpm.exe
  C:\Windows\System\DaZLYpm.exe
  2⤵
  PID:7280
- C:\Windows\System\HDGxbyp.exe
  C:\Windows\System\HDGxbyp.exe
  2⤵
  PID:7296
- C:\Windows\System\EjnIIBo.exe
  C:\Windows\System\EjnIIBo.exe
  2⤵
  PID:7312
- C:\Windows\System\RQcRTAz.exe
  C:\Windows\System\RQcRTAz.exe
  2⤵
  PID:7328
- C:\Windows\System\mDglYSL.exe
  C:\Windows\System\mDglYSL.exe
  2⤵
  PID:7344
- C:\Windows\System\LWtLOQv.exe
  C:\Windows\System\LWtLOQv.exe
  2⤵
  PID:7360
- C:\Windows\System\oixCmlN.exe
  C:\Windows\System\oixCmlN.exe
  2⤵
  PID:7376
- C:\Windows\System\EMrVyhH.exe
  C:\Windows\System\EMrVyhH.exe
  2⤵
  PID:7392
- C:\Windows\System\rmMlcYs.exe
  C:\Windows\System\rmMlcYs.exe
  2⤵
  PID:7408
- C:\Windows\System\AlaVwNE.exe
  C:\Windows\System\AlaVwNE.exe
  2⤵
  PID:7428
- C:\Windows\System\MANQXUE.exe
  C:\Windows\System\MANQXUE.exe
  2⤵
  PID:7444
- C:\Windows\System\qgHtJgV.exe
  C:\Windows\System\qgHtJgV.exe
  2⤵
  PID:7460
- C:\Windows\System\smXpCJP.exe
  C:\Windows\System\smXpCJP.exe
  2⤵
  PID:7476
- C:\Windows\System\QasTkXS.exe
  C:\Windows\System\QasTkXS.exe
  2⤵
  PID:7492
- C:\Windows\System\PSRakGd.exe
  C:\Windows\System\PSRakGd.exe
  2⤵
  PID:7564
- C:\Windows\System\yeUkMyt.exe
  C:\Windows\System\yeUkMyt.exe
  2⤵
  PID:7596
- C:\Windows\System\ihtkovD.exe
  C:\Windows\System\ihtkovD.exe
  2⤵
  PID:7612
- C:\Windows\System\pNFxuBx.exe
  C:\Windows\System\pNFxuBx.exe
  2⤵
  PID:7628
- C:\Windows\System\PaHMLPw.exe
  C:\Windows\System\PaHMLPw.exe
  2⤵
  PID:7644
- C:\Windows\System\jSDBYIz.exe
  C:\Windows\System\jSDBYIz.exe
  2⤵
  PID:7664
- C:\Windows\System\fMrxqNV.exe
  C:\Windows\System\fMrxqNV.exe
  2⤵
  PID:7680
- C:\Windows\System\YDBYpRR.exe
  C:\Windows\System\YDBYpRR.exe
  2⤵
  PID:7696
- C:\Windows\System\fPPSZuH.exe
  C:\Windows\System\fPPSZuH.exe
  2⤵
  PID:7712
- C:\Windows\System\FZbpxYX.exe
  C:\Windows\System\FZbpxYX.exe
  2⤵
  PID:7728
- C:\Windows\System\YFSILvx.exe
  C:\Windows\System\YFSILvx.exe
  2⤵
  PID:7744
- C:\Windows\System\LDjfpvb.exe
  C:\Windows\System\LDjfpvb.exe
  2⤵
  PID:7760
- C:\Windows\System\QSvlwao.exe
  C:\Windows\System\QSvlwao.exe
  2⤵
  PID:7776
- C:\Windows\System\VjaPVvt.exe
  C:\Windows\System\VjaPVvt.exe
  2⤵
  PID:7792
- C:\Windows\System\jkFFETl.exe
  C:\Windows\System\jkFFETl.exe
  2⤵
  PID:7808
- C:\Windows\System\cmBfJEs.exe
  C:\Windows\System\cmBfJEs.exe
  2⤵
  PID:7824
- C:\Windows\System\emmEJgC.exe
  C:\Windows\System\emmEJgC.exe
  2⤵
  PID:7840
- C:\Windows\System\XthOBbP.exe
  C:\Windows\System\XthOBbP.exe
  2⤵
  PID:7856
- C:\Windows\System\HBsjdAE.exe
  C:\Windows\System\HBsjdAE.exe
  2⤵
  PID:7872
- C:\Windows\System\ErLsfqW.exe
  C:\Windows\System\ErLsfqW.exe
  2⤵
  PID:7888
- C:\Windows\System\bPfnnci.exe
  C:\Windows\System\bPfnnci.exe
  2⤵
  PID:7904
- C:\Windows\System\QlIpvvD.exe
  C:\Windows\System\QlIpvvD.exe
  2⤵
  PID:7920
- C:\Windows\System\BJzHLoF.exe
  C:\Windows\System\BJzHLoF.exe
  2⤵
  PID:7936
- C:\Windows\System\CHNsNXb.exe
  C:\Windows\System\CHNsNXb.exe
  2⤵
  PID:7952
- C:\Windows\System\VOCvnfx.exe
  C:\Windows\System\VOCvnfx.exe
  2⤵
  PID:7968
- C:\Windows\System\gwLgyBm.exe
  C:\Windows\System\gwLgyBm.exe
  2⤵
  PID:7984
- C:\Windows\System\zRggTTV.exe
  C:\Windows\System\zRggTTV.exe
  2⤵
  PID:8000
- C:\Windows\System\nRqYLMV.exe
  C:\Windows\System\nRqYLMV.exe
  2⤵
  PID:8016
- C:\Windows\System\trcKBur.exe
  C:\Windows\System\trcKBur.exe
  2⤵
  PID:8032
- C:\Windows\System\MUYCYVU.exe
  C:\Windows\System\MUYCYVU.exe
  2⤵
  PID:8048
- C:\Windows\System\tgUEbpa.exe
  C:\Windows\System\tgUEbpa.exe
  2⤵
  PID:8064
- C:\Windows\System\Paqkzym.exe
  C:\Windows\System\Paqkzym.exe
  2⤵
  PID:8080
- C:\Windows\System\goWguhJ.exe
  C:\Windows\System\goWguhJ.exe
  2⤵
  PID:8096
- C:\Windows\System\UcWQhav.exe
  C:\Windows\System\UcWQhav.exe
  2⤵
  PID:8112
- C:\Windows\System\MGOMtZE.exe
  C:\Windows\System\MGOMtZE.exe
  2⤵
  PID:8132
- C:\Windows\System\FewaIQQ.exe
  C:\Windows\System\FewaIQQ.exe
  2⤵
  PID:8148
- C:\Windows\System\HVLONor.exe
  C:\Windows\System\HVLONor.exe
  2⤵
  PID:8164
- C:\Windows\System\GwpEeIe.exe
  C:\Windows\System\GwpEeIe.exe
  2⤵
  PID:8180
- C:\Windows\System\qSyyLDq.exe
  C:\Windows\System\qSyyLDq.exe
  2⤵
  PID:6320
- C:\Windows\System\TnBmSJF.exe
  C:\Windows\System\TnBmSJF.exe
  2⤵
  PID:6336
- C:\Windows\System\ReDaUwb.exe
  C:\Windows\System\ReDaUwb.exe
  2⤵
  PID:7228
- C:\Windows\System\ZhNFLOh.exe
  C:\Windows\System\ZhNFLOh.exe
  2⤵
  PID:7292
- C:\Windows\System\gsffLhH.exe
  C:\Windows\System\gsffLhH.exe
  2⤵
  PID:7356
- C:\Windows\System\VDhqMbl.exe
  C:\Windows\System\VDhqMbl.exe
  2⤵
  PID:7400
- C:\Windows\System\uuDZVSF.exe
  C:\Windows\System\uuDZVSF.exe
  2⤵
  PID:7244
- C:\Windows\System\sAZgpUX.exe
  C:\Windows\System\sAZgpUX.exe
  2⤵
  PID:7308
- C:\Windows\System\MCspTln.exe
  C:\Windows\System\MCspTln.exe
  2⤵
  PID:7404
- C:\Windows\System\lyTDQAP.exe
  C:\Windows\System\lyTDQAP.exe
  2⤵
  PID:7424
- C:\Windows\System\dAwSVLX.exe
  C:\Windows\System\dAwSVLX.exe
  2⤵
  PID:7456
- C:\Windows\System\iGnKGFp.exe
  C:\Windows\System\iGnKGFp.exe
  2⤵
  PID:7484
- C:\Windows\System\BSfyFwK.exe
  C:\Windows\System\BSfyFwK.exe
  2⤵
  PID:7512
- C:\Windows\System\SqwXaTT.exe
  C:\Windows\System\SqwXaTT.exe
  2⤵
  PID:7528
- C:\Windows\System\RFynVic.exe
  C:\Windows\System\RFynVic.exe
  2⤵
  PID:7544
- C:\Windows\System\wadBUnk.exe
  C:\Windows\System\wadBUnk.exe
  2⤵
  PID:7572
- C:\Windows\System\Htriptg.exe
  C:\Windows\System\Htriptg.exe
  2⤵
  PID:7588
- C:\Windows\System\aMXNlKp.exe
  C:\Windows\System\aMXNlKp.exe
  2⤵
  PID:7624
- C:\Windows\System\olHLFdR.exe
  C:\Windows\System\olHLFdR.exe
  2⤵
  PID:7688
- C:\Windows\System\ffyzKXK.exe
  C:\Windows\System\ffyzKXK.exe
  2⤵
  PID:7752
- C:\Windows\System\BQTxPuC.exe
  C:\Windows\System\BQTxPuC.exe
  2⤵
  PID:7784
- C:\Windows\System\FBGIgue.exe
  C:\Windows\System\FBGIgue.exe
  2⤵
  PID:7736
- C:\Windows\System\uVDajJr.exe
  C:\Windows\System\uVDajJr.exe
  2⤵
  PID:7708
- C:\Windows\System\sepxzkv.exe
  C:\Windows\System\sepxzkv.exe
  2⤵
  PID:7804
- C:\Windows\System\JekjGHt.exe
  C:\Windows\System\JekjGHt.exe
  2⤵
  PID:7880
- C:\Windows\System\zDskYRl.exe
  C:\Windows\System\zDskYRl.exe
  2⤵
  PID:7832
- C:\Windows\System\DbXXNiR.exe
  C:\Windows\System\DbXXNiR.exe
  2⤵
  PID:7980
- C:\Windows\System\olLXNQc.exe
  C:\Windows\System\olLXNQc.exe
  2⤵
  PID:7868
- C:\Windows\System\LTmdkif.exe
  C:\Windows\System\LTmdkif.exe
  2⤵
  PID:7960
- C:\Windows\System\DkrYhNY.exe
  C:\Windows\System\DkrYhNY.exe
  2⤵
  PID:7996
- C:\Windows\System\ITOxQop.exe
  C:\Windows\System\ITOxQop.exe
  2⤵
  PID:8072
- C:\Windows\System\GTLIOkx.exe
  C:\Windows\System\GTLIOkx.exe
  2⤵
  PID:8056
- C:\Windows\System\mKPTbOm.exe
  C:\Windows\System\mKPTbOm.exe
  2⤵
  PID:8144
- C:\Windows\System\FKejmfn.exe
  C:\Windows\System\FKejmfn.exe
  2⤵
  PID:8088
- C:\Windows\System\mOljAZw.exe
  C:\Windows\System\mOljAZw.exe
  2⤵
  PID:8092
- C:\Windows\System\tsNnqMK.exe
  C:\Windows\System\tsNnqMK.exe
  2⤵
  PID:8160
- C:\Windows\System\zPsVURG.exe
  C:\Windows\System\zPsVURG.exe
  2⤵
  PID:7372
- C:\Windows\System\shlCZTB.exe
  C:\Windows\System\shlCZTB.exe
  2⤵
  PID:7384
- C:\Windows\System\uSiiItp.exe
  C:\Windows\System\uSiiItp.exe
  2⤵
  PID:7472
- C:\Windows\System\JOjxCwH.exe
  C:\Windows\System\JOjxCwH.exe
  2⤵
  PID:7552
- C:\Windows\System\NLZCvvH.exe
  C:\Windows\System\NLZCvvH.exe
  2⤵
  PID:7660
- C:\Windows\System\SGdvgfw.exe
  C:\Windows\System\SGdvgfw.exe
  2⤵
  PID:7788
- C:\Windows\System\tklXCEP.exe
  C:\Windows\System\tklXCEP.exe
  2⤵
  PID:7352
- C:\Windows\System\htCYzml.exe
  C:\Windows\System\htCYzml.exe
  2⤵
  PID:7504
- C:\Windows\System\nSeDmVl.exe
  C:\Windows\System\nSeDmVl.exe
  2⤵
  PID:7388
- C:\Windows\System\iIDlnec.exe
  C:\Windows\System\iIDlnec.exe
  2⤵
  PID:7676
- C:\Windows\System\ZwxlREV.exe
  C:\Windows\System\ZwxlREV.exe
  2⤵
  PID:6124
- C:\Windows\System\IGrJaWb.exe
  C:\Windows\System\IGrJaWb.exe
  2⤵
  PID:7852
- C:\Windows\System\ltxvois.exe
  C:\Windows\System\ltxvois.exe
  2⤵
  PID:7932
- C:\Windows\System\IBUTWXq.exe
  C:\Windows\System\IBUTWXq.exe
  2⤵
  PID:8040
- C:\Windows\System\NPiGnGA.exe
  C:\Windows\System\NPiGnGA.exe
  2⤵
  PID:7288
- C:\Windows\System\IPeDwkS.exe
  C:\Windows\System\IPeDwkS.exe
  2⤵
  PID:7304
- C:\Windows\System\hqGAXan.exe
  C:\Windows\System\hqGAXan.exe
  2⤵
  PID:8044
- C:\Windows\System\CCLHVGP.exe
  C:\Windows\System\CCLHVGP.exe
  2⤵
  PID:7800
- C:\Windows\System\maKustY.exe
  C:\Windows\System\maKustY.exe
  2⤵
  PID:8108
- C:\Windows\System\UXqfmzU.exe
  C:\Windows\System\UXqfmzU.exe
  2⤵
  PID:7208
- C:\Windows\System\LswyxQF.exe
  C:\Windows\System\LswyxQF.exe
  2⤵
  PID:7620
- C:\Windows\System\xadJsUJ.exe
  C:\Windows\System\xadJsUJ.exe
  2⤵
  PID:7212
- C:\Windows\System\NuAueiW.exe
  C:\Windows\System\NuAueiW.exe
  2⤵
  PID:7640
- C:\Windows\System\hZvCOAF.exe
  C:\Windows\System\hZvCOAF.exe
  2⤵
  PID:7556
- C:\Windows\System\jAQSRnF.exe
  C:\Windows\System\jAQSRnF.exe
  2⤵
  PID:8012
- C:\Windows\System\qvHzzrt.exe
  C:\Windows\System\qvHzzrt.exe
  2⤵
  PID:7416
- C:\Windows\System\ZFyMXmA.exe
  C:\Windows\System\ZFyMXmA.exe
  2⤵
  PID:7912
- C:\Windows\System\sENawoo.exe
  C:\Windows\System\sENawoo.exe
  2⤵
  PID:7240
- C:\Windows\System\gaHrsrB.exe
  C:\Windows\System\gaHrsrB.exe
  2⤵
  PID:7368
- C:\Windows\System\HzQHiJZ.exe
  C:\Windows\System\HzQHiJZ.exe
  2⤵
  PID:8008
- C:\Windows\System\bCzGTiO.exe
  C:\Windows\System\bCzGTiO.exe
  2⤵
  PID:7524
- C:\Windows\System\nsHbnLB.exe
  C:\Windows\System\nsHbnLB.exe
  2⤵
  PID:7656
- C:\Windows\System\HOjkxHL.exe
  C:\Windows\System\HOjkxHL.exe
  2⤵
  PID:7724
- C:\Windows\System\EhTircY.exe
  C:\Windows\System\EhTircY.exe
  2⤵
  PID:8204
- C:\Windows\System\bsLcJzb.exe
  C:\Windows\System\bsLcJzb.exe
  2⤵
  PID:8220
- C:\Windows\System\HIDPRSz.exe
  C:\Windows\System\HIDPRSz.exe
  2⤵
  PID:8240
- C:\Windows\System\sWTCIOt.exe
  C:\Windows\System\sWTCIOt.exe
  2⤵
  PID:8256
- C:\Windows\System\fRuesIE.exe
  C:\Windows\System\fRuesIE.exe
  2⤵
  PID:8272
- C:\Windows\System\OKPJIQG.exe
  C:\Windows\System\OKPJIQG.exe
  2⤵
  PID:8288
- C:\Windows\System\EVJSgTN.exe
  C:\Windows\System\EVJSgTN.exe
  2⤵
  PID:8304
- C:\Windows\System\NkeDlzB.exe
  C:\Windows\System\NkeDlzB.exe
  2⤵
  PID:8320
- C:\Windows\System\UliOTfP.exe
  C:\Windows\System\UliOTfP.exe
  2⤵
  PID:8336
- C:\Windows\System\sBzNZDr.exe
  C:\Windows\System\sBzNZDr.exe
  2⤵
  PID:8352
- C:\Windows\System\YayMRDc.exe
  C:\Windows\System\YayMRDc.exe
  2⤵
  PID:8368
- C:\Windows\System\WPGJYuK.exe
  C:\Windows\System\WPGJYuK.exe
  2⤵
  PID:8384
- C:\Windows\System\vrXlJDX.exe
  C:\Windows\System\vrXlJDX.exe
  2⤵
  PID:8400
- C:\Windows\System\HfZgKIH.exe
  C:\Windows\System\HfZgKIH.exe
  2⤵
  PID:8416
- C:\Windows\System\gLtSdAy.exe
  C:\Windows\System\gLtSdAy.exe
  2⤵
  PID:8432
- C:\Windows\System\gwARFZf.exe
  C:\Windows\System\gwARFZf.exe
  2⤵
  PID:8448
- C:\Windows\System\JiLbtUl.exe
  C:\Windows\System\JiLbtUl.exe
  2⤵
  PID:8464
- C:\Windows\System\tRyflSa.exe
  C:\Windows\System\tRyflSa.exe
  2⤵
  PID:8480
- C:\Windows\System\zWEolwR.exe
  C:\Windows\System\zWEolwR.exe
  2⤵
  PID:8496
- C:\Windows\System\gXImTwR.exe
  C:\Windows\System\gXImTwR.exe
  2⤵
  PID:8512
- C:\Windows\System\KKFEugB.exe
  C:\Windows\System\KKFEugB.exe
  2⤵
  PID:8528
- C:\Windows\System\lspaOtD.exe
  C:\Windows\System\lspaOtD.exe
  2⤵
  PID:8544
- C:\Windows\System\tTpjiNx.exe
  C:\Windows\System\tTpjiNx.exe
  2⤵
  PID:8560
- C:\Windows\System\omYEjOu.exe
  C:\Windows\System\omYEjOu.exe
  2⤵
  PID:8576
- C:\Windows\System\wbxvVTI.exe
  C:\Windows\System\wbxvVTI.exe
  2⤵
  PID:8592
- C:\Windows\System\VSfGfud.exe
  C:\Windows\System\VSfGfud.exe
  2⤵
  PID:8608
- C:\Windows\System\xOtyagO.exe
  C:\Windows\System\xOtyagO.exe
  2⤵
  PID:8624
- C:\Windows\System\kYSiEaE.exe
  C:\Windows\System\kYSiEaE.exe
  2⤵
  PID:8640
- C:\Windows\System\ovGhKcw.exe
  C:\Windows\System\ovGhKcw.exe
  2⤵
  PID:8656
- C:\Windows\System\QkjBPSK.exe
  C:\Windows\System\QkjBPSK.exe
  2⤵
  PID:8672
- C:\Windows\System\lHnGgOa.exe
  C:\Windows\System\lHnGgOa.exe
  2⤵
  PID:8688
- C:\Windows\System\bkcibOG.exe
  C:\Windows\System\bkcibOG.exe
  2⤵
  PID:8704
- C:\Windows\System\UnmfWpS.exe
  C:\Windows\System\UnmfWpS.exe
  2⤵
  PID:8720
- C:\Windows\System\FBPvncR.exe
  C:\Windows\System\FBPvncR.exe
  2⤵
  PID:8736
- C:\Windows\System\abiKSEx.exe
  C:\Windows\System\abiKSEx.exe
  2⤵
  PID:8752
- C:\Windows\System\bvocSBe.exe
  C:\Windows\System\bvocSBe.exe
  2⤵
  PID:8768
- C:\Windows\System\wfnNlLE.exe
  C:\Windows\System\wfnNlLE.exe
  2⤵
  PID:8784
- C:\Windows\System\DivWIqL.exe
  C:\Windows\System\DivWIqL.exe
  2⤵
  PID:8800
- C:\Windows\System\OimCyfM.exe
  C:\Windows\System\OimCyfM.exe
  2⤵
  PID:8816
- C:\Windows\System\dBmLRjm.exe
  C:\Windows\System\dBmLRjm.exe
  2⤵
  PID:8832
- C:\Windows\System\AFHbANi.exe
  C:\Windows\System\AFHbANi.exe
  2⤵
  PID:8852
- C:\Windows\System\QMEbuRI.exe
  C:\Windows\System\QMEbuRI.exe
  2⤵
  PID:8868
- C:\Windows\System\BKnYYVH.exe
  C:\Windows\System\BKnYYVH.exe
  2⤵
  PID:8884
- C:\Windows\System\rydgPGG.exe
  C:\Windows\System\rydgPGG.exe
  2⤵
  PID:8900
- C:\Windows\System\nWxJmbO.exe
  C:\Windows\System\nWxJmbO.exe
  2⤵
  PID:8916
- C:\Windows\System\TfimHQB.exe
  C:\Windows\System\TfimHQB.exe
  2⤵
  PID:8932
- C:\Windows\System\DHhHyer.exe
  C:\Windows\System\DHhHyer.exe
  2⤵
  PID:8948
- C:\Windows\System\sNWUyEg.exe
  C:\Windows\System\sNWUyEg.exe
  2⤵
  PID:8968
- C:\Windows\System\zLjjUJH.exe
  C:\Windows\System\zLjjUJH.exe
  2⤵
  PID:8984
- C:\Windows\System\rersesA.exe
  C:\Windows\System\rersesA.exe
  2⤵
  PID:9000
- C:\Windows\System\tnGgzVQ.exe
  C:\Windows\System\tnGgzVQ.exe
  2⤵
  PID:9064
- C:\Windows\System\ElwNNqZ.exe
  C:\Windows\System\ElwNNqZ.exe
  2⤵
  PID:9080
- C:\Windows\System\FsxFHzo.exe
  C:\Windows\System\FsxFHzo.exe
  2⤵
  PID:9096
- C:\Windows\System\cnSmyWh.exe
  C:\Windows\System\cnSmyWh.exe
  2⤵
  PID:9112
- C:\Windows\System\VtfNQot.exe
  C:\Windows\System\VtfNQot.exe
  2⤵
  PID:9128
- C:\Windows\System\OtDHLIK.exe
  C:\Windows\System\OtDHLIK.exe
  2⤵
  PID:9144
- C:\Windows\System\akbBDQw.exe
  C:\Windows\System\akbBDQw.exe
  2⤵
  PID:9168
- C:\Windows\System\KPpMksU.exe
  C:\Windows\System\KPpMksU.exe
  2⤵
  PID:9184
- C:\Windows\System\MytIydF.exe
  C:\Windows\System\MytIydF.exe
  2⤵
  PID:9200
- C:\Windows\System\BCDkCSP.exe
  C:\Windows\System\BCDkCSP.exe
  2⤵
  PID:8124
- C:\Windows\System\YlUalNc.exe
  C:\Windows\System\YlUalNc.exe
  2⤵
  PID:7864
- C:\Windows\System\EHvyDGo.exe
  C:\Windows\System\EHvyDGo.exe
  2⤵
  PID:8216
- C:\Windows\System\rXVrrGm.exe
  C:\Windows\System\rXVrrGm.exe
  2⤵
  PID:8236
- C:\Windows\System\ThuIVgo.exe
  C:\Windows\System\ThuIVgo.exe
  2⤵
  PID:8300
- C:\Windows\System\JfQfGXS.exe
  C:\Windows\System\JfQfGXS.exe
  2⤵
  PID:8280
- C:\Windows\System\UkRvTcC.exe
  C:\Windows\System\UkRvTcC.exe
  2⤵
  PID:8348
- C:\Windows\System\mWPZdYL.exe
  C:\Windows\System\mWPZdYL.exe
  2⤵
  PID:8476
- C:\Windows\System\CxKNhdp.exe
  C:\Windows\System\CxKNhdp.exe
  2⤵
  PID:8392
- C:\Windows\System\JlitTDL.exe
  C:\Windows\System\JlitTDL.exe
  2⤵
  PID:8568
- C:\Windows\System\FxhmpbG.exe
  C:\Windows\System\FxhmpbG.exe
  2⤵
  PID:8460
- C:\Windows\System\NcoADrz.exe
  C:\Windows\System\NcoADrz.exe
  2⤵
  PID:8524
- C:\Windows\System\ggnkkvQ.exe
  C:\Windows\System\ggnkkvQ.exe
  2⤵
  PID:8588
- C:\Windows\System\NMTTUkl.exe
  C:\Windows\System\NMTTUkl.exe
  2⤵
  PID:8668
- C:\Windows\System\nsFKrfW.exe
  C:\Windows\System\nsFKrfW.exe
  2⤵
  PID:8748
- C:\Windows\System\ZdenQyY.exe
  C:\Windows\System\ZdenQyY.exe
  2⤵
  PID:8696
- C:\Windows\System\gpVYedO.exe
  C:\Windows\System\gpVYedO.exe
  2⤵
  PID:8840
- C:\Windows\System\kphpNNg.exe
  C:\Windows\System\kphpNNg.exe
  2⤵
  PID:8764
- C:\Windows\System\JGSbrtf.exe
  C:\Windows\System\JGSbrtf.exe
  2⤵
  PID:8792
- C:\Windows\System\EzYXWvV.exe
  C:\Windows\System\EzYXWvV.exe
  2⤵
  PID:8828
- C:\Windows\System\zPDEhEF.exe
  C:\Windows\System\zPDEhEF.exe
  2⤵
  PID:8892
- C:\Windows\System\HHPvmtx.exe
  C:\Windows\System\HHPvmtx.exe
  2⤵
  PID:8924
- C:\Windows\System\cifUCPE.exe
  C:\Windows\System\cifUCPE.exe
  2⤵
  PID:9016
- C:\Windows\System\PQVmNIT.exe
  C:\Windows\System\PQVmNIT.exe
  2⤵
  PID:8960
- C:\Windows\System\rnwSxHS.exe
  C:\Windows\System\rnwSxHS.exe
  2⤵
  PID:8928
- C:\Windows\System\mPcPWKL.exe
  C:\Windows\System\mPcPWKL.exe
  2⤵
  PID:9036
- C:\Windows\System\aCSGBtL.exe
  C:\Windows\System\aCSGBtL.exe
  2⤵
  PID:9056
- C:\Windows\System\QGclQcv.exe
  C:\Windows\System\QGclQcv.exe
  2⤵
  PID:9120
- C:\Windows\System\iAMXIRl.exe
  C:\Windows\System\iAMXIRl.exe
  2⤵
  PID:9160
- C:\Windows\System\DyisVTu.exe
  C:\Windows\System\DyisVTu.exe
  2⤵
  PID:8176
- C:\Windows\System\QDBGdwR.exe
  C:\Windows\System\QDBGdwR.exe
  2⤵
  PID:9072
- C:\Windows\System\pLBUwRT.exe
  C:\Windows\System\pLBUwRT.exe
  2⤵
  PID:8232
- C:\Windows\System\AnMpuUh.exe
  C:\Windows\System\AnMpuUh.exe
  2⤵
  PID:8380
- C:\Windows\System\HWjLwCh.exe
  C:\Windows\System\HWjLwCh.exe
  2⤵
  PID:9180
- C:\Windows\System\krwsXma.exe
  C:\Windows\System\krwsXma.exe
  2⤵
  PID:8268
- C:\Windows\System\WqVOPeI.exe
  C:\Windows\System\WqVOPeI.exe
  2⤵
  PID:8504
- C:\Windows\System\XehOlgi.exe
  C:\Windows\System\XehOlgi.exe
  2⤵
  PID:8508
- C:\Windows\System\icPVzlA.exe
  C:\Windows\System\icPVzlA.exe
  2⤵
  PID:8332
- C:\Windows\System\syZTNzB.exe
  C:\Windows\System\syZTNzB.exe
  2⤵
  PID:8604
- C:\Windows\System\MKGyVMH.exe
  C:\Windows\System\MKGyVMH.exe
  2⤵
  PID:8488
- C:\Windows\System\vCrUeeK.exe
  C:\Windows\System\vCrUeeK.exe
  2⤵
  PID:8520
- C:\Windows\System\HrvMGuc.exe
  C:\Windows\System\HrvMGuc.exe
  2⤵
  PID:8776
- C:\Windows\System\vFtEOGk.exe
  C:\Windows\System\vFtEOGk.exe
  2⤵
  PID:8824
- C:\Windows\System\SryuRbE.exe
  C:\Windows\System\SryuRbE.exe
  2⤵
  PID:8992
- C:\Windows\System\HSEljkL.exe
  C:\Windows\System\HSEljkL.exe
  2⤵
  PID:9088
- C:\Windows\System\LKCytJv.exe
  C:\Windows\System\LKCytJv.exe
  2⤵
  PID:8684
- C:\Windows\System\kxpXeqT.exe
  C:\Windows\System\kxpXeqT.exe
  2⤵
  PID:8940
- C:\Windows\System\aDJSMNb.exe
  C:\Windows\System\aDJSMNb.exe
  2⤵
  PID:8912
- C:\Windows\System\MWSeOQE.exe
  C:\Windows\System\MWSeOQE.exe
  2⤵
  PID:9048
- C:\Windows\System\SojupOh.exe
  C:\Windows\System\SojupOh.exe
  2⤵
  PID:8228
- C:\Windows\System\YkxkcfL.exe
  C:\Windows\System\YkxkcfL.exe
  2⤵
  PID:9108
- C:\Windows\System\lHPUpaC.exe
  C:\Windows\System\lHPUpaC.exe
  2⤵
  PID:8316
- C:\Windows\System\XCobfvh.exe
  C:\Windows\System\XCobfvh.exe
  2⤵
  PID:8540
- C:\Windows\System\frTgwvw.exe
  C:\Windows\System\frTgwvw.exe
  2⤵
  PID:8664
- C:\Windows\System\IRVeGzY.exe
  C:\Windows\System\IRVeGzY.exe
  2⤵
  PID:8376
- C:\Windows\System\nyQnCwH.exe
  C:\Windows\System\nyQnCwH.exe
  2⤵
  PID:8444
- C:\Windows\System\YGEKlyb.exe
  C:\Windows\System\YGEKlyb.exe
  2⤵
  PID:8760
- C:\Windows\System\xgnYJWO.exe
  C:\Windows\System\xgnYJWO.exe
  2⤵
  PID:8712
- C:\Windows\System\KdPuqft.exe
  C:\Windows\System\KdPuqft.exe
  2⤵
  PID:9032
- C:\Windows\System\gGzBmRC.exe
  C:\Windows\System\gGzBmRC.exe
  2⤵
  PID:9152
- C:\Windows\System\vIwovKH.exe
  C:\Windows\System\vIwovKH.exe
  2⤵
  PID:9140
- C:\Windows\System\kROFzvF.exe
  C:\Windows\System\kROFzvF.exe
  2⤵
  PID:8732
- C:\Windows\System\ZrzzPmQ.exe
  C:\Windows\System\ZrzzPmQ.exe
  2⤵
  PID:8716
- C:\Windows\System\YyIJeBB.exe
  C:\Windows\System\YyIJeBB.exe
  2⤵
  PID:8648
- C:\Windows\System\VvkycrS.exe
  C:\Windows\System\VvkycrS.exe
  2⤵
  PID:9224
- C:\Windows\System\VOuJuVn.exe
  C:\Windows\System\VOuJuVn.exe
  2⤵
  PID:9240
- C:\Windows\System\ogiwjYS.exe
  C:\Windows\System\ogiwjYS.exe
  2⤵
  PID:9256
- C:\Windows\System\CGeHgLY.exe
  C:\Windows\System\CGeHgLY.exe
  2⤵
  PID:9272
- C:\Windows\System\zrKwVab.exe
  C:\Windows\System\zrKwVab.exe
  2⤵
  PID:9288
- C:\Windows\System\wsQxGIk.exe
  C:\Windows\System\wsQxGIk.exe
  2⤵
  PID:9304
- C:\Windows\System\OSYQAVs.exe
  C:\Windows\System\OSYQAVs.exe
  2⤵
  PID:9320
- C:\Windows\System\ifMHrze.exe
  C:\Windows\System\ifMHrze.exe
  2⤵
  PID:9336
- C:\Windows\System\kFZBrza.exe
  C:\Windows\System\kFZBrza.exe
  2⤵
  PID:9352
- C:\Windows\System\hgtiZbn.exe
  C:\Windows\System\hgtiZbn.exe
  2⤵
  PID:9368
- C:\Windows\System\yHLjFlg.exe
  C:\Windows\System\yHLjFlg.exe
  2⤵
  PID:9384
- C:\Windows\System\wqaanxD.exe
  C:\Windows\System\wqaanxD.exe
  2⤵
  PID:9400
- C:\Windows\System\JjxgNnH.exe
  C:\Windows\System\JjxgNnH.exe
  2⤵
  PID:9416
- C:\Windows\System\MPkstAQ.exe
  C:\Windows\System\MPkstAQ.exe
  2⤵
  PID:9432
- C:\Windows\System\SwdKAoJ.exe
  C:\Windows\System\SwdKAoJ.exe
  2⤵
  PID:9448
- C:\Windows\System\ilDZhmQ.exe
  C:\Windows\System\ilDZhmQ.exe
  2⤵
  PID:9464
- C:\Windows\System\kYzhabU.exe
  C:\Windows\System\kYzhabU.exe
  2⤵
  PID:9480
- C:\Windows\System\VpIUXLM.exe
  C:\Windows\System\VpIUXLM.exe
  2⤵
  PID:9496
- C:\Windows\System\NdHfMvY.exe
  C:\Windows\System\NdHfMvY.exe
  2⤵
  PID:9512
- C:\Windows\System\rTipHjF.exe
  C:\Windows\System\rTipHjF.exe
  2⤵
  PID:9528
- C:\Windows\System\uvnbQjh.exe
  C:\Windows\System\uvnbQjh.exe
  2⤵
  PID:9544
- C:\Windows\System\VoHtgYz.exe
  C:\Windows\System\VoHtgYz.exe
  2⤵
  PID:9560
- C:\Windows\System\YGCbZsC.exe
  C:\Windows\System\YGCbZsC.exe
  2⤵
  PID:9576
- C:\Windows\System\HkvTEsM.exe
  C:\Windows\System\HkvTEsM.exe
  2⤵
  PID:9592
- C:\Windows\System\coAXvQp.exe
  C:\Windows\System\coAXvQp.exe
  2⤵
  PID:9608
- C:\Windows\System\CGhWqVK.exe
  C:\Windows\System\CGhWqVK.exe
  2⤵
  PID:9624
- C:\Windows\System\pbrffog.exe
  C:\Windows\System\pbrffog.exe
  2⤵
  PID:9640
- C:\Windows\System\mBqsyBH.exe
  C:\Windows\System\mBqsyBH.exe
  2⤵
  PID:9656
- C:\Windows\System\NUixABr.exe
  C:\Windows\System\NUixABr.exe
  2⤵
  PID:9672
- C:\Windows\System\JpDqKSS.exe
  C:\Windows\System\JpDqKSS.exe
  2⤵
  PID:9688
- C:\Windows\System\KydFiiw.exe
  C:\Windows\System\KydFiiw.exe
  2⤵
  PID:9704
- C:\Windows\System\OiqAKGE.exe
  C:\Windows\System\OiqAKGE.exe
  2⤵
  PID:9720
- C:\Windows\System\TROGQgv.exe
  C:\Windows\System\TROGQgv.exe
  2⤵
  PID:9736
- C:\Windows\System\zYVzxwS.exe
  C:\Windows\System\zYVzxwS.exe
  2⤵
  PID:9752
- C:\Windows\System\bOhhsjE.exe
  C:\Windows\System\bOhhsjE.exe
  2⤵
  PID:9768
- C:\Windows\System\bRebSxD.exe
  C:\Windows\System\bRebSxD.exe
  2⤵
  PID:9784
- C:\Windows\System\czIttSm.exe
  C:\Windows\System\czIttSm.exe
  2⤵
  PID:9800
- C:\Windows\System\rWkgBPv.exe
  C:\Windows\System\rWkgBPv.exe
  2⤵
  PID:9816
- C:\Windows\System\VdlSNGF.exe
  C:\Windows\System\VdlSNGF.exe
  2⤵
  PID:9832
- C:\Windows\System\uUctaAQ.exe
  C:\Windows\System\uUctaAQ.exe
  2⤵
  PID:9848
- C:\Windows\System\helsmQB.exe
  C:\Windows\System\helsmQB.exe
  2⤵
  PID:9868
- C:\Windows\System\KNIlECD.exe
  C:\Windows\System\KNIlECD.exe
  2⤵
  PID:9884
- C:\Windows\System\ibjSpAq.exe
  C:\Windows\System\ibjSpAq.exe
  2⤵
  PID:9900
- C:\Windows\System\Bzindkb.exe
  C:\Windows\System\Bzindkb.exe
  2⤵
  PID:9916
- C:\Windows\System\SaPzgek.exe
  C:\Windows\System\SaPzgek.exe
  2⤵
  PID:9932
- C:\Windows\System\iDFWLIl.exe
  C:\Windows\System\iDFWLIl.exe
  2⤵
  PID:9948
- C:\Windows\System\LtYvEry.exe
  C:\Windows\System\LtYvEry.exe
  2⤵
  PID:9964
- C:\Windows\System\vTVDzRe.exe
  C:\Windows\System\vTVDzRe.exe
  2⤵
  PID:9984
- C:\Windows\System\UmOhyhw.exe
  C:\Windows\System\UmOhyhw.exe
  2⤵
  PID:10000
- C:\Windows\System\aVDufeP.exe
  C:\Windows\System\aVDufeP.exe
  2⤵
  PID:10016
- C:\Windows\System\PdcWatT.exe
  C:\Windows\System\PdcWatT.exe
  2⤵
  PID:10032
- C:\Windows\System\dbRSRIb.exe
  C:\Windows\System\dbRSRIb.exe
  2⤵
  PID:10048
- C:\Windows\System\HCbwQKC.exe
  C:\Windows\System\HCbwQKC.exe
  2⤵
  PID:10068
- C:\Windows\System\ZciakHv.exe
  C:\Windows\System\ZciakHv.exe
  2⤵
  PID:10088
- C:\Windows\System\zlkXsbM.exe
  C:\Windows\System\zlkXsbM.exe
  2⤵
  PID:10104
- C:\Windows\System\GsnqYme.exe
  C:\Windows\System\GsnqYme.exe
  2⤵
  PID:10120
- C:\Windows\System\SWPclAH.exe
  C:\Windows\System\SWPclAH.exe
  2⤵
  PID:10136
- C:\Windows\System\ueuSJEF.exe
  C:\Windows\System\ueuSJEF.exe
  2⤵
  PID:10152
- C:\Windows\System\TibrAHD.exe
  C:\Windows\System\TibrAHD.exe
  2⤵
  PID:10168
- C:\Windows\System\xbDupJY.exe
  C:\Windows\System\xbDupJY.exe
  2⤵
  PID:10184
- C:\Windows\System\odPfvzH.exe
  C:\Windows\System\odPfvzH.exe
  2⤵
  PID:10200
- C:\Windows\System\lKlZkIc.exe
  C:\Windows\System\lKlZkIc.exe
  2⤵
  PID:10216
- C:\Windows\System\IVGelQH.exe
  C:\Windows\System\IVGelQH.exe
  2⤵
  PID:10236
- C:\Windows\System\VYsZUiO.exe
  C:\Windows\System\VYsZUiO.exe
  2⤵
  PID:9236
- C:\Windows\System\DvImjGb.exe
  C:\Windows\System\DvImjGb.exe
  2⤵
  PID:8284
- C:\Windows\System\XMlMqJB.exe
  C:\Windows\System\XMlMqJB.exe
  2⤵
  PID:9196
- C:\Windows\System\mxJrUNf.exe
  C:\Windows\System\mxJrUNf.exe
  2⤵
  PID:9220
- C:\Windows\System\IhnhSXg.exe
  C:\Windows\System\IhnhSXg.exe
  2⤵
  PID:9268
- C:\Windows\System\dHQqbMD.exe
  C:\Windows\System\dHQqbMD.exe
  2⤵
  PID:9332
- C:\Windows\System\myhkiLR.exe
  C:\Windows\System\myhkiLR.exe
  2⤵
  PID:9392
- C:\Windows\System\MSZhvuZ.exe
  C:\Windows\System\MSZhvuZ.exe
  2⤵
  PID:9456
- C:\Windows\System\HCCTbtJ.exe
  C:\Windows\System\HCCTbtJ.exe
  2⤵
  PID:9520
- C:\Windows\System\EdTqaSW.exe
  C:\Windows\System\EdTqaSW.exe
  2⤵
  PID:9556
- C:\Windows\System\FZMPBzG.exe
  C:\Windows\System\FZMPBzG.exe
  2⤵
  PID:9316
- C:\Windows\System\DGViDcf.exe
  C:\Windows\System\DGViDcf.exe
  2⤵
  PID:9284
- C:\Windows\System\WNkmPys.exe
  C:\Windows\System\WNkmPys.exe
  2⤵
  PID:9504
- C:\Windows\System\mfVAdyZ.exe
  C:\Windows\System\mfVAdyZ.exe
  2⤵
  PID:9584
- C:\Windows\System\pKZLLWt.exe
  C:\Windows\System\pKZLLWt.exe
  2⤵
  PID:9620
- C:\Windows\System\bfCWHlT.exe
  C:\Windows\System\bfCWHlT.exe
  2⤵
  PID:9680
- C:\Windows\System\UIRNaaT.exe
  C:\Windows\System\UIRNaaT.exe
  2⤵
  PID:9716
- C:\Windows\System\XmVDyOn.exe
  C:\Windows\System\XmVDyOn.exe
  2⤵
  PID:9780
- C:\Windows\System\smlKUxJ.exe
  C:\Windows\System\smlKUxJ.exe
  2⤵
  PID:9600
- C:\Windows\System\UQUIzor.exe
  C:\Windows\System\UQUIzor.exe
  2⤵
  PID:9700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CaKqIJZ.exe

Filesize
1.9MB

MD5
40390c3b738b5b69cf10877ae15c2b9d

SHA1
928a28f12f2b22d500acc81c62cdb834a0f14c44

SHA256
3059edcd241312073316bfccaf1d3b12f6229a11dc4f29a173adbacf6e126f62

SHA512
dedfa9922fdf06efaf144cd746c5f841b8a83e4c2442d9941b89d476cc726f5bc8b076b50859563feff212d8cd0d4f62d51fe0553ce720054cd3f45b13e9a1b1

Download Submit
C:\Windows\system\ETZlJwL.exe

Filesize
1.9MB

MD5
237f080ee347e31c93e3682e8f4bedce

SHA1
001f0b07801dc69f21b79a4d55b816a74aa35915

SHA256
d261ce6581a2705298cd7063f6c64a31c21135ff1861b17422718df0910043ad

SHA512
ca84ed37970e7c1b42660c093b71d2c7639ff87642047789ed5bda5fb9f5c16667b5254d10d4fd1ec11166fbfc7cd48e8f9e2b02230abba29a550652b68ca12e

Download Submit
C:\Windows\system\EtRzoSP.exe

Filesize
1.9MB

MD5
cc4946f8b6e80a1a9aa323320a5bfb13

SHA1
54bf87339cbbfc1408e7ff689361afa96314ad82

SHA256
a0af57ffa6f5decb7b22cd9c7906419e070c095cefc302060ab36bbf47a475ff

SHA512
e4322b832ec296bd4de0021c5e06c4b09a9cbf648284047f0d8ec14f0dade12d62aea0332a9b0123e810134d5c7bda25cbe43bb6864fe4632e8025fb884ec8a0

Download Submit
C:\Windows\system\GrMtZry.exe

Filesize
1.9MB

MD5
76224f64f8b8374ea06301dd90ed6708

SHA1
e4eb471923392bf27f1615c3b41dfb3c790a75d8

SHA256
1cd19bc400a2cf85b9b7c54ee14d8ae221347f0b185643c145e5bd83767eef2f

SHA512
b35093fe866f2a8313f2c9c20a59a99a82f92342bb10c09ff7acbe0e3425075bba3972618536cfa66e1e0d153a9485080d96969008d70fb8cb6000ba907b2495

Download Submit
C:\Windows\system\IPMPIEK.exe

Filesize
1.9MB

MD5
6ce19ba1c7290539e37c1ee0a39bf2da

SHA1
487ec65a987275c73c3c93c7e33cbcf92d2ca7d3

SHA256
dc9d88a15ea34d42232d831eb49066668453c0509ad12f14fdaecac24114d024

SHA512
a2da99490fcce4363c632aa6269c1aee158898a9ec32392e5f73485d96037bf551db535f4007dc451eb78e532bd2762d8b1199b1f3278b49329695a89f689c65

Download Submit
C:\Windows\system\IvhyidV.exe

Filesize
1.9MB

MD5
11cbb76c0fe0818d4a614cfa53658dcd

SHA1
e69a344d620e7e653e626b522fee9f6dd997f7b1

SHA256
6eca178088376d4a9bd0796f18426a9eb8772cbcbb0c1dbd7925d1c5a79dff9c

SHA512
998c3aab6650df1e64fdda6d4d8dfed8b0e5ec3f47531a8328e90a070fea94b1ec2d0792a0e127e8a7e8f3f077102e7229504bfeef29a42698d115076628c083

Download Submit
C:\Windows\system\SerpNiC.exe

Filesize
1.9MB

MD5
67e96d5bd8e0998af196a40352dc080c

SHA1
fd13eb2b2225c5bb9b68bb1fab79b2d159391cde

SHA256
17a7c47b41ef8691867fdbed2fc2b922c9ac1ef6e8ffcf33b536e69bd6a97d2b

SHA512
7d9a62a088e49f9d2ad694038dc0cb85c8d2f72b4351c0697a0276e9cb308397504cc17827c0713c0b87b36a48b87169cb786b0de98e80692414c65d69eae5b2

Download Submit
C:\Windows\system\TSAuaGP.exe

Filesize
1.9MB

MD5
16b8b2d9209e71228369dc4de02c8a62

SHA1
345d68c19e26255819b447a0fe47abfef57be364

SHA256
b151c4866c8b0b2ced04d85e9fa2ca70ee3d9b71124907f8454c5dee5bcdd57a

SHA512
6c19303c8d48f34a57a3f99a749c0a43d98c4e194874b2b9acad613ffea63c12d68d507d884af9e6621098713e397b56c0c2997a468b9f34ebb5d0d9a82f4cd7

Download Submit
C:\Windows\system\TdWjeWu.exe

Filesize
1.9MB

MD5
c3b508e666c709e252c3cd009f236122

SHA1
3ff8ec5e4e95ff4f0d27eb7c60411b1a25116f71

SHA256
2d19673bef4ad56f8d5c3d622768cc72b1361a25c3f512574422832b34bf2089

SHA512
9536a686ebc39b64e6e3068758cf9faab58c0e8b9807a2b9dc5f94a8d4a72f0e7426e386a65740cd3cd31dcfb9f9515c03c1ebd842d9d26138284f4013a67681

Download Submit
C:\Windows\system\VrJuKXr.exe

Filesize
1.9MB

MD5
bbda2ea40e90c57a7b102208a95ae83d

SHA1
ef2034dda25abd08a3160afa3b998d36c2e8f968

SHA256
48e54e7079a8ae45006e8667df6723200215cf57ad006dea72b621663f7a8aab

SHA512
ebd21307b226b53fbe12e02cbb3bdf82d375c3fa67ae6696d741e54192e5b8c3f765687963e6253b7c838c63393c42cd6a4b7c0b5d62bb31ef75ddbfef11abe8

Download Submit
C:\Windows\system\WWKwXnG.exe

Filesize
1.9MB

MD5
5c84df558c7f482f5961be51bf0f5c4b

SHA1
9aeb4403e8ff3da1f3e628db9c7eed0cd058d766

SHA256
d932e882c4f23b681c792ad0744339ed059885ae3bb365760c923860b4ecc48c

SHA512
92f59cb1f9171d1bcf41c89563699f0da5be49cc4dcc1a06bfcc9a1c31d6f83efc09b673a0cb95ea0c78f6817744df82ae04c9f983c858032a512b47619b991a

Download Submit
C:\Windows\system\WtAeAhK.exe

Filesize
1.9MB

MD5
e176a1d8cf6492c31b74b6b98d3f2105

SHA1
e9d22140a1a0a88070ef5b6aeb13cd3621fd7b47

SHA256
43a88eeee236373704d85fb55dc4d59b4246344bac3a8a42e049ea744108b9fd

SHA512
de1a3000965aa583ed94eb9ecad6d2bdf9587137200df80015de040ceb33f3af8c33cb2ecdbd86c2280d66e07bcc65d33d668fa598b693b7115fbd4c770fa46f

Download Submit
C:\Windows\system\Zcdlorz.exe

Filesize
1.9MB

MD5
5c75d3449abc7a91d804969ee37fbb22

SHA1
cfcfca63f7a821160a3f263b7aeb7ce6e626723c

SHA256
46f388fc7559d580dd400c4df1c598f2ba23dac80ec2421729d2c011cfe17fb2

SHA512
99453ec28a16b3875db94b01b538f56ba3ca4b7d2ef3f3bd3f2d0fcb2eb516c41c80e221afce7de5bc2039fd8014e10919bdb5f519b76b9e8a3be2eed80c83f0

Download Submit
C:\Windows\system\auOLgzG.exe

Filesize
1.9MB

MD5
3c8d3a27e9e896fb530af7e4ddbc6c5d

SHA1
30d7e7dcf46134f1802709aca2165db8b6d09d99

SHA256
cc234072c07224d67a81cb839ce90d94bd28edf919172596b0a18f7c9bfbe919

SHA512
5e02225f78cbdbaed7d28f93c34323263aa9bc1e1899dfdf08359cffe375a29e8f32dcba190682332545a158e43092704bff4084bfa0c2bd3462d6187f2a798f

Download Submit
C:\Windows\system\cAzVHuY.exe

Filesize
1.9MB

MD5
f4aaf634109c702f808d73fe544e2f7a

SHA1
efa9efa759d6189947ca52ca0fb209b62c6da45a

SHA256
a70983835ba71fd96cf7ac8dbe79f1922a95363e604971fa7bebc816490d9483

SHA512
afff6229119fa3f42862f34f9d9b92f5692563c3db377f1fd011906b698690c97d4e2fc7d4f7c0e1fdb092fbe2ed05ecf3cfa65701abd0d1ad88299aa27bbec0

Download Submit
C:\Windows\system\cRUAhCo.exe

Filesize
1.9MB

MD5
a00248c38cbb161689e283d87ff332fe

SHA1
0036708f3e50ed2130657260e6d72522269e6949

SHA256
6fa95eaca0447d943bb91bb9b89232227b651fed47d01bcfcf2c60a66f50f0de

SHA512
8f088c8cc808b93f7f0e70d16831c86ce844e4b9d81d6252b81613f511376a0163d60dcded56b60065fb83b7db5d9441d9b9064554d9ba593f9071b4c6f6f95b

Download Submit
C:\Windows\system\dGAJohJ.exe

Filesize
1.9MB

MD5
caa382f73eef6f52bca3dd285bf7366b

SHA1
867cae971feec92a54d59be576acbfdfe014fd36

SHA256
1d83cc0b38b74a779cd45f55714e3488df5d7f6366fd5828a8de94e11a3101dd

SHA512
999d1bc4ea909ca8cf8bf6858db85c5969087e0ed9309ab6b17cbfbc53dc95b4360cae6b68d4df4b637f53b6ec6841bac784c726c5a7d14eed886bcd007a5035

Download Submit
C:\Windows\system\dUrXOrf.exe

Filesize
1.9MB

MD5
290429246817dd0ef9255655c372c77a

SHA1
ec07f00f5f60f5f577f673da0741ec54ad160057

SHA256
e271ca01e8e87cb48b09d5b7bd53dbc4914195fa8ed45bd0b1a157f2f15023da

SHA512
4124896c3740f9f8da462a391aa3ceba8a36b448866a92b7c24132a9fe0895a44728d35ac574ea72d0d89cbb8721a7ba5ca72d89b802c51cb62d3515c57ad4cc

Download Submit
C:\Windows\system\iQtKIxb.exe

Filesize
1.9MB

MD5
28f419ec423271bee11e5d8ae0ce9df1

SHA1
4657d9e49c4892275146d0a556ebea7d42d2cf91

SHA256
487368ff5da77431ad682a5ea1a23bb4b67b8890b7064d435210e7ccc998fc51

SHA512
bce88d3f71d62912bbb7ea4008cb426a975cfa3ff19e4c9b21addb9ddfacc0c707dc85078ad9803acea2fa2439b918df3d2afe2b3e72776d3427f08c0148a556

Download Submit
C:\Windows\system\jBENJmL.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\system\jNarQPH.exe

Filesize
1.9MB

MD5
1fe3207bf23791483ac7c232ef1bb5d7

SHA1
95bfb8837c144f18e993429082ccb5b4d17275a4

SHA256
9b3c0b534098d724f7787d64efe696ff19e0336dc29a75ccdb1d10f91ce95f6a

SHA512
9cda9f5ccc33dbb5e1e5ae142b7fdb5500332f597a2e574e90e664f0f3bb52d4d4461d2c5a812dc513e558fc22a001aa3b5c5f9decab763070ff4ce4b6be4d87

Download Submit
C:\Windows\system\kiybfLB.exe

Filesize
1.9MB

MD5
624e25ff873fa7149115711f41a1d0ad

SHA1
0f8b01861bf4b459403408e571d363663d0619bf

SHA256
3e21934ab740e9a061c22dee5248cd89fa19d02f84538290809adb10b646084e

SHA512
976402573cb3ad8d687e51da0fc16270d97a71410f73abc70e6a0cc66ebfd6df9ec9b4860d260f775203ae9f7c57d23854b0ec9ce1700d52e0553a2829b009ae

Download Submit
C:\Windows\system\pXgQgCk.exe

Filesize
1.9MB

MD5
0b23630717720768ab1f7de726d0f6af

SHA1
1922c6a93968c9f0a456538e29d898168e805b44

SHA256
12b4b4824a8af826f289e637e9766fb359ff83b871f912e95564f119001cc140

SHA512
80bbde890aae9c7c91525b018d54a04ad8bffdcb824a62c1a387873ad2324d2b5060c0223a28e39de10e4bcdbd346fe68dacf8a00f59ac8b8bd82c611c8afe7e

Download Submit
C:\Windows\system\yFgbPdF.exe

Filesize
1.9MB

MD5
3adba4f03dc527d6411e4c493c453cb6

SHA1
19c41b69ebfa7606babe13d5d2405a786e625ee5

SHA256
ee27e3f375f610d125eb4366f231a3e44e1b9d9ee33cdf65402fbf0af67029d0

SHA512
531e4de786932e8711083bbb6e646963f66bf149f9acf3d4fe2dcb1679680af4d76096073dffe53adf956bbf39cc3d6acc3a8b5e0946b3ad759d852e041bd02d

Download Submit
C:\Windows\system\yTsIBBl.exe

Filesize
1.9MB

MD5
15058ea24f2ace0b9a228b1c12e784f6

SHA1
959ac42a31a9749ba00786ccf207856601505cc5

SHA256
e34feefa42e517b2fbfc5cfc78d8bbab545b258958cbca522c761c449ca3206a

SHA512
8841cb9a178c58576fdb69b604b5b41228f9fd253c5e1c135a099ef5044fcf48633d64f619f5f7a553baab0202a8b1aa579e4418bc452c28dcb20571aaafde5d

Download Submit
\Windows\system\TqrVypJ.exe

Filesize
1.9MB

MD5
23b40adfe6f03a35d8f8ae4fcb9c460c

SHA1
0d5ea06617515a6f5d2ae6058bee369c8a311a71

SHA256
4ca32adb2041cd2a8718970ad2a3fad5cc7bb4edd652cd6234b95ae485726356

SHA512
429a914d9fee4fb12b55cfa38ca0c29ba573b3b6881cc0b6f1b555f001f2f32a5f93c11b6d75e09e47b00ffb4add2d89d0041575307e9e59e93c72b537ab2222

Download Submit
\Windows\system\ZtJqZDl.exe

Filesize
1.9MB

MD5
7da4987114f6eb7a9faf3d4644196772

SHA1
b0495d359da3635a7fe92bac239da6e870d963a4

SHA256
7be4889f13ea8cdc7f83a352969d8b25ff2d51c06107f3dfd199e95877064bbe

SHA512
04dafbbbf04daaa492c9c124de4a5f2e5c90cadb8305476f56a3fe70283320db4168391eafceaefc7e2cdf3c2e03dc9e88686af696f318b313bbe37c90b1fbef

Download Submit
\Windows\system\iSkwAEk.exe

Filesize
1.9MB

MD5
1c37737b57ce128e7db0c3c984ad00a7

SHA1
bb0a4567addff37a9e5a05911faf94b902f61768

SHA256
8a6911da9f0e6cb5681dc60e63c3033ed7189888922e789c0c7395d7fa5faa1b

SHA512
ac8cd4c1291472593e9a59d1b61696b2b9859846286bddb38e6edc465bb92ecd8b6c536e6ba1f84b140f374948fe4a15be561adde90841c94dd123711088766a

Download Submit
\Windows\system\klxthXT.exe

Filesize
1.9MB

MD5
7ac435e57e1994d2b13057eb405f897a

SHA1
68725e38f0a24699a8fa5cb3b615f3862910b56b

SHA256
14463f096438c38f9538f3334e387537ab631a7444b8c65a1bf9ba85b06422f3

SHA512
87c8e1ee4e7b92ae78196b061c5d71d7a7ac5e38eec221e7a1571cc2a32db75c23438c8bd8c375d1ede33a48eca6e16cb6b584e15e5077d5cb1148ecde0ea056

Download Submit
\Windows\system\lKpINhK.exe

Filesize
1.9MB

MD5
c9e8bea39112a64f8e7e094cf50b0acd

SHA1
350de814b48ceb76ee43094164e2b8598b945479

SHA256
f04245ddff2e9b2a50b185584abf07013eefe801ebe81881d7dde8124262420a

SHA512
9692232f024838c5006d0b4da2bcf4725c98b844e3e1f6ff179f96f7f3114b62cebbeaa0a4f4fd18db6b02d9339ccc56f8840a115d810cd16df86afe89899e73

Download Submit
\Windows\system\mmaomRc.exe

Filesize
1.9MB

MD5
a63a75ae3cf08c92618a61294924cf55

SHA1
4eec52e403cd67b15a27da7e53ffd408e8a3034f

SHA256
0ce3a59c6c5d32bbdb75bcd2d7b86b437304790f9fd3c16f9e5ea3b28ccfc9da

SHA512
d2425ec87263c873f1617984792d6029e612b771098bd7d35e187b94da91d5ef57d45b80cf4a3490705019b24b027dd9ac0ae0dbb63e494af95b4fb4d6fe9994

Download Submit
\Windows\system\qDdzPOO.exe

Filesize
1.9MB

MD5
6ded2b73570da6ecca295919551dcc41

SHA1
0e06c023d8ac0930f7475785550414ad96e08fe2

SHA256
eb7502de35c40fcf3a8094db70e52b1cf606fc2ca3abebf9d44d62a261091673

SHA512
e185fb075987351bf7ddb032886a751f531e74d163862fbd65513ca3691858eef34be08772b37b8afe725b0aa9509cb1780ca45fee047bc921637cc6ce8c28e7

Download Submit
\Windows\system\yzagCLE.exe

Filesize
1.9MB

MD5
f061d2e4853adfbdaf595abe5f4baf29

SHA1
2f49cf9d3eb8bb537603a2cecfcf826e31566e32

SHA256
afe1a1652c3f57cdb51649a3414b33a80d52582514414da8b8912fcffc2d00f7

SHA512
f8d1d2a13ba270cf9c8ed251d311a7881c07cb994bcfda4f6fcc7247f2a477d4ef752f0e9d6b980388b281007a9d9201e4c972b041efba374c01ac744da6db80

Download Submit
\Windows\system\zZPQJFR.exe

Filesize
1.9MB

MD5
08951f746df298876d0405f3890d0b02

SHA1
eb7f5982d4c710a20457bf12f08d767477d5ba98

SHA256
2d736d606e558a160ee8b3eb4ce0897e5a55c492337b9b82ceb4d6ce83824bb1

SHA512
3ec03240e52ce4cb70de90b2735c3e0010b204409878e26c38ff3404e0ab1a8da154c8aba593b36a87b4f56c9e0625cc4e6a682d4e41a34ddd94fec8580aa60d

Download Submit
memory/296-62-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/840-84-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/840-63-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/840-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/840-36-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/840-60-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/840-352-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/840-12-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/840-43-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/840-118-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/840-7-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/840-50-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/840-27-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/840-91-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/840-0-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1228-8-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/1228-627-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/1344-114-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2352-212-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/2352-211-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2608-49-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-46-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2696-40-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2740-44-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2848-41-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2884-37-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download