xmrig | 428dc48849193be21542551f2a03f86ab751fc3eb0802c4ec61e6c822f3f01fb

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
Size

2.3MB
MD5

20ec60de3b0b7dd95d64bd6f371bf733
SHA1

50ab60810dc015dd24ee714bccc611d8dd9d2df5
SHA256

428dc48849193be21542551f2a03f86ab751fc3eb0802c4ec61e6c822f3f01fb
SHA512

2775e4ffbdd874c9b88b4f8a5b461c196f3a0994f3cc2f169a2dbf26c8fab88e5e7b1d53ab3c028a8445843463a53432a16acb1a510f4520af70a9f7989339d8
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDiiB:NABM

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2492-13-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2376-96-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/1672-93-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2424-110-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/1624-108-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2868-104-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2428-101-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2500-89-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2400-77-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2664-75-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2492-3890-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2400-3915-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/1624-4003-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2500-4006-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2376-4001-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/1672-4044-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2064-4041-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2428-4055-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2424-4049-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2616-4040-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2156-10522-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3008	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2492	AmTHoss.exe
2664	YvzvpCB.exe
2400	MFWzYBe.exe
2616	viatlYi.exe
2500	xfcrdlD.exe
1672	wqihDSL.exe
2376	bOJynLB.exe
2428	NJbqAXt.exe
2868	LuTnWKz.exe
2064	qnNnKeW.exe
1624	gPAVipS.exe
2424	pVojTlc.exe
2556	fKclouk.exe
2604	cjEIMyb.exe
2708	CdYXFvD.exe
1604	kCxjSSQ.exe
2160	vuFZoRS.exe
2864	wJuLtiY.exe
2088	WaZKXQt.exe
2200	IMOiWWc.exe
1956	GHFkwsE.exe
1916	iAxozUR.exe
588	CsonhJP.exe
580	etjRjFY.exe
1064	QlntqHR.exe
1792	ppiLxKB.exe
1084	ckAODHW.exe
2172	fhPRGuH.exe
2292	FGAJQkA.exe
2988	NmSpzdP.exe
1016	rzTxJEB.exe
2560	LhWydNV.exe
972	eNMWhFC.exe
1060	WVUMRrh.exe
780	APjhybs.exe
404	XhyjScR.exe
920	mIcilFg.exe
1080	xygRujG.exe
572	MGdJGYh.exe
2236	cBqXGwb.exe
1968	wTKTXsc.exe
3064	ETZSQKo.exe
792	zUOUObF.exe
1656	FiQerfN.exe
1452	AwBwKkN.exe
2020	lUWqvAO.exe
896	BIYVCDZ.exe
2212	eYvHgHJ.exe
2220	tBurHpv.exe
1516	jCZrFdE.exe
1884	fJJDPOx.exe
2672	BoXSEez.exe
2520	MzYBaGG.exe
2004	mtTOmth.exe
2476	eoyIrho.exe
2372	VQsIRAa.exe
3036	ptntffg.exe
2464	QWMQXPI.exe
1600	MLAKMSZ.exe
2168	PRLvHry.exe
1912	SfPOeQF.exe
2728	RkeAujX.exe
876	yPGtaDp.exe
2840	gznKLBh.exe

Loads dropped DLL 64 IoCs

pid	Process
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2156-0-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x000d000000015ccd-6.dat	upx
behavioral1/memory/2492-13-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-23.dat	upx
behavioral1/files/0x0034000000015d4e-19.dat	upx
behavioral1/files/0x0007000000015d93-32.dat	upx
behavioral1/files/0x0009000000015f65-40.dat	upx
behavioral1/files/0x0006000000016cdc-48.dat	upx
behavioral1/files/0x0006000000016d18-56.dat	upx
behavioral1/files/0x0006000000016d43-119.dat	upx
behavioral1/memory/2376-96-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/files/0x0006000000016d74-125.dat	upx
behavioral1/files/0x0006000000016d8e-134.dat	upx
behavioral1/files/0x0006000000016d9d-139.dat	upx
behavioral1/files/0x0006000000016da5-145.dat	upx
behavioral1/files/0x0006000000016dbe-159.dat	upx
behavioral1/files/0x00060000000171df-175.dat	upx
behavioral1/files/0x0031000000018649-193.dat	upx
behavioral1/files/0x0015000000018644-190.dat	upx
behavioral1/files/0x0006000000017437-185.dat	upx
behavioral1/files/0x00060000000173d0-179.dat	upx
behavioral1/files/0x000600000001708b-170.dat	upx
behavioral1/files/0x000600000001704a-165.dat	upx
behavioral1/files/0x0006000000016db9-156.dat	upx
behavioral1/files/0x0006000000016db1-149.dat	upx
behavioral1/files/0x0034000000015d56-129.dat	upx
behavioral1/memory/1672-93-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2424-110-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/1624-108-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2064-106-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2868-104-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2428-101-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x0006000000016d5f-99.dat	upx
behavioral1/memory/2500-89-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2616-79-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2400-77-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2664-75-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/files/0x0006000000016d3e-72.dat	upx
behavioral1/files/0x0006000000016d3a-68.dat	upx
behavioral1/files/0x0006000000016d34-64.dat	upx
behavioral1/files/0x0006000000016d20-60.dat	upx
behavioral1/files/0x0006000000016d07-52.dat	upx
behavioral1/files/0x0007000000016cb0-43.dat	upx
behavioral1/files/0x0007000000015e32-35.dat	upx
behavioral1/files/0x0008000000015d87-28.dat	upx
behavioral1/memory/2492-3890-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2400-3915-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/1624-4003-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2500-4006-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2376-4001-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/1672-4044-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2064-4041-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2428-4055-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2424-4049-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2616-4040-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2156-10522-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MzYBaGG.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\mPowMTc.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\RGWJscn.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\zRvknEl.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\qyiWiTD.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\ugkyPzI.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\wmimEGN.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\ALATzyL.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\jxvkJAO.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\ghFnAoj.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\aKmgUez.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\CrhWwPQ.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\VofUrkB.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\SjHcLXS.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\CsonhJP.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\emeZeaB.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\bLpZzkM.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\njtBwzw.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\wyDwYtz.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\tSMxlcl.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\MBVBjRi.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\umleGiY.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\eqaLLym.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\NzXCFQD.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\pryhRnQ.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\eYSwKHQ.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\jQRHtNT.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\vWnutGq.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\KvqBKEV.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\bmcXUbJ.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\hdKweXo.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\gtSPDgK.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\IsWQDOn.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\YsyfckI.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\DRQIzSd.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\AahvqWi.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\GLgFkCY.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\qvNDlMj.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\sMIMIVF.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\EbpVeNW.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\JURlCQm.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\iqwGsCp.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\NLdZJUc.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\yRHZQWJ.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\yJKeoss.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\NrVexAJ.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\UPFJvZB.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\YApoekQ.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\XNdSiur.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\hoUmuTF.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\QdjSDhd.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\jgPYxuL.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\acoVmwC.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\FvTXtuX.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\qgjKHis.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\XjoncIy.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\tUxXWUN.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\IwMBLAN.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\dLtjkTj.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\veRcteg.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\bbHZubT.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\BaVKPDC.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\UyMeKTa.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
File created	C:\Windows\System\QlntqHR.exe	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3008	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeLockMemoryPrivilege	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3008	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	29
PID 2156 wrote to memory of 3008	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	29
PID 2156 wrote to memory of 3008	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	29
PID 2156 wrote to memory of 2492	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2492	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2492	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2664	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	31
PID 2156 wrote to memory of 2664	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	31
PID 2156 wrote to memory of 2664	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	31
PID 2156 wrote to memory of 2400	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	32
PID 2156 wrote to memory of 2400	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	32
PID 2156 wrote to memory of 2400	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	32
PID 2156 wrote to memory of 2616	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2616	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2616	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2500	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2500	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2500	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	34
PID 2156 wrote to memory of 1672	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	35
PID 2156 wrote to memory of 1672	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	35
PID 2156 wrote to memory of 1672	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	35
PID 2156 wrote to memory of 2376	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	36
PID 2156 wrote to memory of 2376	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	36
PID 2156 wrote to memory of 2376	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	36
PID 2156 wrote to memory of 2428	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2428	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2428	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2868	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2868	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2868	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2064	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	39
PID 2156 wrote to memory of 2064	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	39
PID 2156 wrote to memory of 2064	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	39
PID 2156 wrote to memory of 1624	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	40
PID 2156 wrote to memory of 1624	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	40
PID 2156 wrote to memory of 1624	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	40
PID 2156 wrote to memory of 2424	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	41
PID 2156 wrote to memory of 2424	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	41
PID 2156 wrote to memory of 2424	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	41
PID 2156 wrote to memory of 2556	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	42
PID 2156 wrote to memory of 2556	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	42
PID 2156 wrote to memory of 2556	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	42
PID 2156 wrote to memory of 2604	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	43
PID 2156 wrote to memory of 2604	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	43
PID 2156 wrote to memory of 2604	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	43
PID 2156 wrote to memory of 2708	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	44
PID 2156 wrote to memory of 2708	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	44
PID 2156 wrote to memory of 2708	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	44
PID 2156 wrote to memory of 2160	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	45
PID 2156 wrote to memory of 2160	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	45
PID 2156 wrote to memory of 2160	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	45
PID 2156 wrote to memory of 1604	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	46
PID 2156 wrote to memory of 1604	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	46
PID 2156 wrote to memory of 1604	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	46
PID 2156 wrote to memory of 2864	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	47
PID 2156 wrote to memory of 2864	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	47
PID 2156 wrote to memory of 2864	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	47
PID 2156 wrote to memory of 2088	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	48
PID 2156 wrote to memory of 2088	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	48
PID 2156 wrote to memory of 2088	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	48
PID 2156 wrote to memory of 2200	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	49
PID 2156 wrote to memory of 2200	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	49
PID 2156 wrote to memory of 2200	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	49
PID 2156 wrote to memory of 1956	2156	20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20ec60de3b0b7dd95d64bd6f371bf733_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\System\AmTHoss.exe
  C:\Windows\System\AmTHoss.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\YvzvpCB.exe
  C:\Windows\System\YvzvpCB.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\MFWzYBe.exe
  C:\Windows\System\MFWzYBe.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\viatlYi.exe
  C:\Windows\System\viatlYi.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\xfcrdlD.exe
  C:\Windows\System\xfcrdlD.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\wqihDSL.exe
  C:\Windows\System\wqihDSL.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\bOJynLB.exe
  C:\Windows\System\bOJynLB.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\NJbqAXt.exe
  C:\Windows\System\NJbqAXt.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\LuTnWKz.exe
  C:\Windows\System\LuTnWKz.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\qnNnKeW.exe
  C:\Windows\System\qnNnKeW.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\gPAVipS.exe
  C:\Windows\System\gPAVipS.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\pVojTlc.exe
  C:\Windows\System\pVojTlc.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\fKclouk.exe
  C:\Windows\System\fKclouk.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\cjEIMyb.exe
  C:\Windows\System\cjEIMyb.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\CdYXFvD.exe
  C:\Windows\System\CdYXFvD.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\vuFZoRS.exe
  C:\Windows\System\vuFZoRS.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\kCxjSSQ.exe
  C:\Windows\System\kCxjSSQ.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\wJuLtiY.exe
  C:\Windows\System\wJuLtiY.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\WaZKXQt.exe
  C:\Windows\System\WaZKXQt.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\IMOiWWc.exe
  C:\Windows\System\IMOiWWc.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\GHFkwsE.exe
  C:\Windows\System\GHFkwsE.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\iAxozUR.exe
  C:\Windows\System\iAxozUR.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\CsonhJP.exe
  C:\Windows\System\CsonhJP.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\etjRjFY.exe
  C:\Windows\System\etjRjFY.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\QlntqHR.exe
  C:\Windows\System\QlntqHR.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\ppiLxKB.exe
  C:\Windows\System\ppiLxKB.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\ckAODHW.exe
  C:\Windows\System\ckAODHW.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\fhPRGuH.exe
  C:\Windows\System\fhPRGuH.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\FGAJQkA.exe
  C:\Windows\System\FGAJQkA.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\NmSpzdP.exe
  C:\Windows\System\NmSpzdP.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\rzTxJEB.exe
  C:\Windows\System\rzTxJEB.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\LhWydNV.exe
  C:\Windows\System\LhWydNV.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\eNMWhFC.exe
  C:\Windows\System\eNMWhFC.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\WVUMRrh.exe
  C:\Windows\System\WVUMRrh.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\APjhybs.exe
  C:\Windows\System\APjhybs.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\XhyjScR.exe
  C:\Windows\System\XhyjScR.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\mIcilFg.exe
  C:\Windows\System\mIcilFg.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\xygRujG.exe
  C:\Windows\System\xygRujG.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\MGdJGYh.exe
  C:\Windows\System\MGdJGYh.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\cBqXGwb.exe
  C:\Windows\System\cBqXGwb.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\wTKTXsc.exe
  C:\Windows\System\wTKTXsc.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\ETZSQKo.exe
  C:\Windows\System\ETZSQKo.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\zUOUObF.exe
  C:\Windows\System\zUOUObF.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\FiQerfN.exe
  C:\Windows\System\FiQerfN.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\AwBwKkN.exe
  C:\Windows\System\AwBwKkN.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\lUWqvAO.exe
  C:\Windows\System\lUWqvAO.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\BIYVCDZ.exe
  C:\Windows\System\BIYVCDZ.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\eYvHgHJ.exe
  C:\Windows\System\eYvHgHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\tBurHpv.exe
  C:\Windows\System\tBurHpv.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\jCZrFdE.exe
  C:\Windows\System\jCZrFdE.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\fJJDPOx.exe
  C:\Windows\System\fJJDPOx.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\BoXSEez.exe
  C:\Windows\System\BoXSEez.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\MzYBaGG.exe
  C:\Windows\System\MzYBaGG.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\mtTOmth.exe
  C:\Windows\System\mtTOmth.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\eoyIrho.exe
  C:\Windows\System\eoyIrho.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\VQsIRAa.exe
  C:\Windows\System\VQsIRAa.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\ptntffg.exe
  C:\Windows\System\ptntffg.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\QWMQXPI.exe
  C:\Windows\System\QWMQXPI.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\MLAKMSZ.exe
  C:\Windows\System\MLAKMSZ.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\PRLvHry.exe
  C:\Windows\System\PRLvHry.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\SfPOeQF.exe
  C:\Windows\System\SfPOeQF.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\RkeAujX.exe
  C:\Windows\System\RkeAujX.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\yPGtaDp.exe
  C:\Windows\System\yPGtaDp.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\gznKLBh.exe
  C:\Windows\System\gznKLBh.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\QiZIQVh.exe
  C:\Windows\System\QiZIQVh.exe
  2⤵
  PID:2756
- C:\Windows\System\aauczSK.exe
  C:\Windows\System\aauczSK.exe
  2⤵
  PID:2192
- C:\Windows\System\FKUEjQw.exe
  C:\Windows\System\FKUEjQw.exe
  2⤵
  PID:2460
- C:\Windows\System\QpyNJUK.exe
  C:\Windows\System\QpyNJUK.exe
  2⤵
  PID:540
- C:\Windows\System\YAjCuuh.exe
  C:\Windows\System\YAjCuuh.exe
  2⤵
  PID:2648
- C:\Windows\System\eHnuqsN.exe
  C:\Windows\System\eHnuqsN.exe
  2⤵
  PID:856
- C:\Windows\System\clTieLy.exe
  C:\Windows\System\clTieLy.exe
  2⤵
  PID:1596
- C:\Windows\System\OdwTQuM.exe
  C:\Windows\System\OdwTQuM.exe
  2⤵
  PID:1732
- C:\Windows\System\HiHkaXH.exe
  C:\Windows\System\HiHkaXH.exe
  2⤵
  PID:2148
- C:\Windows\System\NLbBliZ.exe
  C:\Windows\System\NLbBliZ.exe
  2⤵
  PID:2952
- C:\Windows\System\qgsPfTz.exe
  C:\Windows\System\qgsPfTz.exe
  2⤵
  PID:2384
- C:\Windows\System\AoPaUJp.exe
  C:\Windows\System\AoPaUJp.exe
  2⤵
  PID:1576
- C:\Windows\System\WuTYuIs.exe
  C:\Windows\System\WuTYuIs.exe
  2⤵
  PID:1004
- C:\Windows\System\cURMKEz.exe
  C:\Windows\System\cURMKEz.exe
  2⤵
  PID:928
- C:\Windows\System\SfBZaQd.exe
  C:\Windows\System\SfBZaQd.exe
  2⤵
  PID:1972
- C:\Windows\System\oXlwEYa.exe
  C:\Windows\System\oXlwEYa.exe
  2⤵
  PID:1220
- C:\Windows\System\OMlxkTm.exe
  C:\Windows\System\OMlxkTm.exe
  2⤵
  PID:1484
- C:\Windows\System\RCabGBY.exe
  C:\Windows\System\RCabGBY.exe
  2⤵
  PID:276
- C:\Windows\System\AqPQXFD.exe
  C:\Windows\System\AqPQXFD.exe
  2⤵
  PID:2328
- C:\Windows\System\RLFPqxU.exe
  C:\Windows\System\RLFPqxU.exe
  2⤵
  PID:548
- C:\Windows\System\BMhtwrX.exe
  C:\Windows\System\BMhtwrX.exe
  2⤵
  PID:1628
- C:\Windows\System\WYLmwgJ.exe
  C:\Windows\System\WYLmwgJ.exe
  2⤵
  PID:2692
- C:\Windows\System\DbwJzyW.exe
  C:\Windows\System\DbwJzyW.exe
  2⤵
  PID:2724
- C:\Windows\System\emeZeaB.exe
  C:\Windows\System\emeZeaB.exe
  2⤵
  PID:2572
- C:\Windows\System\jZZcFxc.exe
  C:\Windows\System\jZZcFxc.exe
  2⤵
  PID:2504
- C:\Windows\System\zTfqfKc.exe
  C:\Windows\System\zTfqfKc.exe
  2⤵
  PID:2660
- C:\Windows\System\GTqQYJm.exe
  C:\Windows\System\GTqQYJm.exe
  2⤵
  PID:2676
- C:\Windows\System\JzYWDYL.exe
  C:\Windows\System\JzYWDYL.exe
  2⤵
  PID:2948
- C:\Windows\System\WHVHFdC.exe
  C:\Windows\System\WHVHFdC.exe
  2⤵
  PID:2580
- C:\Windows\System\UjpKUcj.exe
  C:\Windows\System\UjpKUcj.exe
  2⤵
  PID:1764
- C:\Windows\System\xDlkQOd.exe
  C:\Windows\System\xDlkQOd.exe
  2⤵
  PID:1568
- C:\Windows\System\lPnnPuS.exe
  C:\Windows\System\lPnnPuS.exe
  2⤵
  PID:2404
- C:\Windows\System\QwLyExs.exe
  C:\Windows\System\QwLyExs.exe
  2⤵
  PID:2736
- C:\Windows\System\jkYpIvw.exe
  C:\Windows\System\jkYpIvw.exe
  2⤵
  PID:2568
- C:\Windows\System\IoruRjo.exe
  C:\Windows\System\IoruRjo.exe
  2⤵
  PID:604
- C:\Windows\System\mzKSNUz.exe
  C:\Windows\System\mzKSNUz.exe
  2⤵
  PID:2412
- C:\Windows\System\mDerQki.exe
  C:\Windows\System\mDerQki.exe
  2⤵
  PID:828
- C:\Windows\System\lKRNEJd.exe
  C:\Windows\System\lKRNEJd.exe
  2⤵
  PID:1100
- C:\Windows\System\NtsamkN.exe
  C:\Windows\System\NtsamkN.exe
  2⤵
  PID:2960
- C:\Windows\System\QQofmvw.exe
  C:\Windows\System\QQofmvw.exe
  2⤵
  PID:852
- C:\Windows\System\gEEBYiw.exe
  C:\Windows\System\gEEBYiw.exe
  2⤵
  PID:2416
- C:\Windows\System\sMarNco.exe
  C:\Windows\System\sMarNco.exe
  2⤵
  PID:320
- C:\Windows\System\urtscwi.exe
  C:\Windows\System\urtscwi.exe
  2⤵
  PID:3056
- C:\Windows\System\DOuZJBB.exe
  C:\Windows\System\DOuZJBB.exe
  2⤵
  PID:328
- C:\Windows\System\OspiMSL.exe
  C:\Windows\System\OspiMSL.exe
  2⤵
  PID:1908
- C:\Windows\System\hKSGism.exe
  C:\Windows\System\hKSGism.exe
  2⤵
  PID:2600
- C:\Windows\System\uBVeGMg.exe
  C:\Windows\System\uBVeGMg.exe
  2⤵
  PID:2980
- C:\Windows\System\QjCwudy.exe
  C:\Windows\System\QjCwudy.exe
  2⤵
  PID:2104
- C:\Windows\System\taywdqv.exe
  C:\Windows\System\taywdqv.exe
  2⤵
  PID:2768
- C:\Windows\System\jaqHTVK.exe
  C:\Windows\System\jaqHTVK.exe
  2⤵
  PID:2456
- C:\Windows\System\YJAhnrA.exe
  C:\Windows\System\YJAhnrA.exe
  2⤵
  PID:2516
- C:\Windows\System\siuvrVI.exe
  C:\Windows\System\siuvrVI.exe
  2⤵
  PID:1520
- C:\Windows\System\NljEkTF.exe
  C:\Windows\System\NljEkTF.exe
  2⤵
  PID:596
- C:\Windows\System\ojtryQn.exe
  C:\Windows\System\ojtryQn.exe
  2⤵
  PID:2312
- C:\Windows\System\KnAGasW.exe
  C:\Windows\System\KnAGasW.exe
  2⤵
  PID:1532
- C:\Windows\System\EdQrxuh.exe
  C:\Windows\System\EdQrxuh.exe
  2⤵
  PID:900
- C:\Windows\System\ItDBoXz.exe
  C:\Windows\System\ItDBoXz.exe
  2⤵
  PID:2592
- C:\Windows\System\qqsIwWH.exe
  C:\Windows\System\qqsIwWH.exe
  2⤵
  PID:1032
- C:\Windows\System\jTyqebJ.exe
  C:\Windows\System\jTyqebJ.exe
  2⤵
  PID:2576
- C:\Windows\System\YUypwCt.exe
  C:\Windows\System\YUypwCt.exe
  2⤵
  PID:2968
- C:\Windows\System\GYJcLeZ.exe
  C:\Windows\System\GYJcLeZ.exe
  2⤵
  PID:2368
- C:\Windows\System\UBbTkgG.exe
  C:\Windows\System\UBbTkgG.exe
  2⤵
  PID:912
- C:\Windows\System\pFMGQda.exe
  C:\Windows\System\pFMGQda.exe
  2⤵
  PID:2496
- C:\Windows\System\fyHFnhf.exe
  C:\Windows\System\fyHFnhf.exe
  2⤵
  PID:1288
- C:\Windows\System\QLQnlcU.exe
  C:\Windows\System\QLQnlcU.exe
  2⤵
  PID:2264
- C:\Windows\System\WBWpqXg.exe
  C:\Windows\System\WBWpqXg.exe
  2⤵
  PID:784
- C:\Windows\System\sOtZaMy.exe
  C:\Windows\System\sOtZaMy.exe
  2⤵
  PID:2828
- C:\Windows\System\htbeiYg.exe
  C:\Windows\System\htbeiYg.exe
  2⤵
  PID:888
- C:\Windows\System\whNdrXX.exe
  C:\Windows\System\whNdrXX.exe
  2⤵
  PID:1564
- C:\Windows\System\cqUEfqy.exe
  C:\Windows\System\cqUEfqy.exe
  2⤵
  PID:2068
- C:\Windows\System\uBVkLdt.exe
  C:\Windows\System\uBVkLdt.exe
  2⤵
  PID:2432
- C:\Windows\System\FhozgBI.exe
  C:\Windows\System\FhozgBI.exe
  2⤵
  PID:1380
- C:\Windows\System\msTDYfK.exe
  C:\Windows\System\msTDYfK.exe
  2⤵
  PID:2120
- C:\Windows\System\VCTPLyM.exe
  C:\Windows\System\VCTPLyM.exe
  2⤵
  PID:1472
- C:\Windows\System\yAORTiE.exe
  C:\Windows\System\yAORTiE.exe
  2⤵
  PID:2640
- C:\Windows\System\KVPbSUB.exe
  C:\Windows\System\KVPbSUB.exe
  2⤵
  PID:2624
- C:\Windows\System\bNtHojE.exe
  C:\Windows\System\bNtHojE.exe
  2⤵
  PID:1252
- C:\Windows\System\NzXCFQD.exe
  C:\Windows\System\NzXCFQD.exe
  2⤵
  PID:1924
- C:\Windows\System\tijBlhq.exe
  C:\Windows\System\tijBlhq.exe
  2⤵
  PID:1848
- C:\Windows\System\ywssYAj.exe
  C:\Windows\System\ywssYAj.exe
  2⤵
  PID:668
- C:\Windows\System\vPBgEMz.exe
  C:\Windows\System\vPBgEMz.exe
  2⤵
  PID:2784
- C:\Windows\System\khIDLBc.exe
  C:\Windows\System\khIDLBc.exe
  2⤵
  PID:3028
- C:\Windows\System\PZoeHuN.exe
  C:\Windows\System\PZoeHuN.exe
  2⤵
  PID:2880
- C:\Windows\System\SMFvcHq.exe
  C:\Windows\System\SMFvcHq.exe
  2⤵
  PID:1464
- C:\Windows\System\vQziybO.exe
  C:\Windows\System\vQziybO.exe
  2⤵
  PID:2084
- C:\Windows\System\txWJLKr.exe
  C:\Windows\System\txWJLKr.exe
  2⤵
  PID:2128
- C:\Windows\System\IiQcfKE.exe
  C:\Windows\System\IiQcfKE.exe
  2⤵
  PID:2092
- C:\Windows\System\HWPsJtD.exe
  C:\Windows\System\HWPsJtD.exe
  2⤵
  PID:2816
- C:\Windows\System\NmYYWvR.exe
  C:\Windows\System\NmYYWvR.exe
  2⤵
  PID:692
- C:\Windows\System\ObekVba.exe
  C:\Windows\System\ObekVba.exe
  2⤵
  PID:2772
- C:\Windows\System\mlHSQYi.exe
  C:\Windows\System\mlHSQYi.exe
  2⤵
  PID:2196
- C:\Windows\System\GDZgZhJ.exe
  C:\Windows\System\GDZgZhJ.exe
  2⤵
  PID:2308
- C:\Windows\System\RiQZxYo.exe
  C:\Windows\System\RiQZxYo.exe
  2⤵
  PID:2204
- C:\Windows\System\sAheTTl.exe
  C:\Windows\System\sAheTTl.exe
  2⤵
  PID:2252
- C:\Windows\System\CJQMFYo.exe
  C:\Windows\System\CJQMFYo.exe
  2⤵
  PID:1648
- C:\Windows\System\tkqpkFR.exe
  C:\Windows\System\tkqpkFR.exe
  2⤵
  PID:1572
- C:\Windows\System\dfWccsl.exe
  C:\Windows\System\dfWccsl.exe
  2⤵
  PID:2804
- C:\Windows\System\LvuaVtI.exe
  C:\Windows\System\LvuaVtI.exe
  2⤵
  PID:1456
- C:\Windows\System\RAFrMAc.exe
  C:\Windows\System\RAFrMAc.exe
  2⤵
  PID:1712
- C:\Windows\System\hpbKNLS.exe
  C:\Windows\System\hpbKNLS.exe
  2⤵
  PID:1696
- C:\Windows\System\Xtzwnog.exe
  C:\Windows\System\Xtzwnog.exe
  2⤵
  PID:608
- C:\Windows\System\UnbPPSX.exe
  C:\Windows\System\UnbPPSX.exe
  2⤵
  PID:1680
- C:\Windows\System\feRpwQE.exe
  C:\Windows\System\feRpwQE.exe
  2⤵
  PID:948
- C:\Windows\System\RTVbGrG.exe
  C:\Windows\System\RTVbGrG.exe
  2⤵
  PID:2584
- C:\Windows\System\znXFSIK.exe
  C:\Windows\System\znXFSIK.exe
  2⤵
  PID:1560
- C:\Windows\System\dtivVrI.exe
  C:\Windows\System\dtivVrI.exe
  2⤵
  PID:1788
- C:\Windows\System\vhCYPxb.exe
  C:\Windows\System\vhCYPxb.exe
  2⤵
  PID:1440
- C:\Windows\System\ZknPAKc.exe
  C:\Windows\System\ZknPAKc.exe
  2⤵
  PID:2876
- C:\Windows\System\JuJRhSG.exe
  C:\Windows\System\JuJRhSG.exe
  2⤵
  PID:644
- C:\Windows\System\mhaOTmd.exe
  C:\Windows\System\mhaOTmd.exe
  2⤵
  PID:2132
- C:\Windows\System\vezVfsi.exe
  C:\Windows\System\vezVfsi.exe
  2⤵
  PID:1424
- C:\Windows\System\DacGkPv.exe
  C:\Windows\System\DacGkPv.exe
  2⤵
  PID:2636
- C:\Windows\System\xUaubKl.exe
  C:\Windows\System\xUaubKl.exe
  2⤵
  PID:2288
- C:\Windows\System\wKVnjqM.exe
  C:\Windows\System\wKVnjqM.exe
  2⤵
  PID:3088
- C:\Windows\System\FLOnzVB.exe
  C:\Windows\System\FLOnzVB.exe
  2⤵
  PID:3104
- C:\Windows\System\nxGiMLb.exe
  C:\Windows\System\nxGiMLb.exe
  2⤵
  PID:3120
- C:\Windows\System\LzVAwlR.exe
  C:\Windows\System\LzVAwlR.exe
  2⤵
  PID:3136
- C:\Windows\System\tDIlwCq.exe
  C:\Windows\System\tDIlwCq.exe
  2⤵
  PID:3156
- C:\Windows\System\jDSvDxU.exe
  C:\Windows\System\jDSvDxU.exe
  2⤵
  PID:3172
- C:\Windows\System\MQvjPJG.exe
  C:\Windows\System\MQvjPJG.exe
  2⤵
  PID:3188
- C:\Windows\System\WbUCZCz.exe
  C:\Windows\System\WbUCZCz.exe
  2⤵
  PID:3208
- C:\Windows\System\fcnlQhW.exe
  C:\Windows\System\fcnlQhW.exe
  2⤵
  PID:3224
- C:\Windows\System\LDyalFi.exe
  C:\Windows\System\LDyalFi.exe
  2⤵
  PID:3240
- C:\Windows\System\JpScPdD.exe
  C:\Windows\System\JpScPdD.exe
  2⤵
  PID:3256
- C:\Windows\System\YnWWsJK.exe
  C:\Windows\System\YnWWsJK.exe
  2⤵
  PID:3272
- C:\Windows\System\fIuHnEX.exe
  C:\Windows\System\fIuHnEX.exe
  2⤵
  PID:3292
- C:\Windows\System\QhnaoOe.exe
  C:\Windows\System\QhnaoOe.exe
  2⤵
  PID:3308
- C:\Windows\System\joRZCCi.exe
  C:\Windows\System\joRZCCi.exe
  2⤵
  PID:3324
- C:\Windows\System\MlEUFvq.exe
  C:\Windows\System\MlEUFvq.exe
  2⤵
  PID:3340
- C:\Windows\System\ArWOPpO.exe
  C:\Windows\System\ArWOPpO.exe
  2⤵
  PID:3356
- C:\Windows\System\YyhbYSE.exe
  C:\Windows\System\YyhbYSE.exe
  2⤵
  PID:3372
- C:\Windows\System\qHQKxnJ.exe
  C:\Windows\System\qHQKxnJ.exe
  2⤵
  PID:3392
- C:\Windows\System\yMxEwud.exe
  C:\Windows\System\yMxEwud.exe
  2⤵
  PID:3408
- C:\Windows\System\ZyOCFbF.exe
  C:\Windows\System\ZyOCFbF.exe
  2⤵
  PID:3424
- C:\Windows\System\LvsYdLz.exe
  C:\Windows\System\LvsYdLz.exe
  2⤵
  PID:3440
- C:\Windows\System\JDqkMNE.exe
  C:\Windows\System\JDqkMNE.exe
  2⤵
  PID:3456
- C:\Windows\System\pYYgvec.exe
  C:\Windows\System\pYYgvec.exe
  2⤵
  PID:3472
- C:\Windows\System\LNmidAR.exe
  C:\Windows\System\LNmidAR.exe
  2⤵
  PID:3488
- C:\Windows\System\YknnPqi.exe
  C:\Windows\System\YknnPqi.exe
  2⤵
  PID:3504
- C:\Windows\System\AHDWnSv.exe
  C:\Windows\System\AHDWnSv.exe
  2⤵
  PID:3524
- C:\Windows\System\NrVexAJ.exe
  C:\Windows\System\NrVexAJ.exe
  2⤵
  PID:3540
- C:\Windows\System\YyKOycg.exe
  C:\Windows\System\YyKOycg.exe
  2⤵
  PID:3556
- C:\Windows\System\cSVTVky.exe
  C:\Windows\System\cSVTVky.exe
  2⤵
  PID:3716
- C:\Windows\System\CcOXbKh.exe
  C:\Windows\System\CcOXbKh.exe
  2⤵
  PID:3732
- C:\Windows\System\pEiOmfi.exe
  C:\Windows\System\pEiOmfi.exe
  2⤵
  PID:3748
- C:\Windows\System\EoxnwLE.exe
  C:\Windows\System\EoxnwLE.exe
  2⤵
  PID:3764
- C:\Windows\System\TffViFQ.exe
  C:\Windows\System\TffViFQ.exe
  2⤵
  PID:3780
- C:\Windows\System\PGeNvNT.exe
  C:\Windows\System\PGeNvNT.exe
  2⤵
  PID:3812
- C:\Windows\System\OPowhfe.exe
  C:\Windows\System\OPowhfe.exe
  2⤵
  PID:3836
- C:\Windows\System\IntjEnw.exe
  C:\Windows\System\IntjEnw.exe
  2⤵
  PID:3852
- C:\Windows\System\omxOtFp.exe
  C:\Windows\System\omxOtFp.exe
  2⤵
  PID:3868
- C:\Windows\System\maTAYoZ.exe
  C:\Windows\System\maTAYoZ.exe
  2⤵
  PID:3884
- C:\Windows\System\zVjLFEt.exe
  C:\Windows\System\zVjLFEt.exe
  2⤵
  PID:3900
- C:\Windows\System\UzrnblW.exe
  C:\Windows\System\UzrnblW.exe
  2⤵
  PID:3916
- C:\Windows\System\jqmcgVD.exe
  C:\Windows\System\jqmcgVD.exe
  2⤵
  PID:3936
- C:\Windows\System\TgYNkJu.exe
  C:\Windows\System\TgYNkJu.exe
  2⤵
  PID:3952
- C:\Windows\System\iFmXqYn.exe
  C:\Windows\System\iFmXqYn.exe
  2⤵
  PID:3968
- C:\Windows\System\iLWrcIB.exe
  C:\Windows\System\iLWrcIB.exe
  2⤵
  PID:3984
- C:\Windows\System\brXHEgx.exe
  C:\Windows\System\brXHEgx.exe
  2⤵
  PID:4004
- C:\Windows\System\qwEquoj.exe
  C:\Windows\System\qwEquoj.exe
  2⤵
  PID:4020
- C:\Windows\System\bQOkiik.exe
  C:\Windows\System\bQOkiik.exe
  2⤵
  PID:4036
- C:\Windows\System\PkaUrEJ.exe
  C:\Windows\System\PkaUrEJ.exe
  2⤵
  PID:4052
- C:\Windows\System\pPCsyqd.exe
  C:\Windows\System\pPCsyqd.exe
  2⤵
  PID:4068
- C:\Windows\System\AZxNruh.exe
  C:\Windows\System\AZxNruh.exe
  2⤵
  PID:4088
- C:\Windows\System\FSzdxFz.exe
  C:\Windows\System\FSzdxFz.exe
  2⤵
  PID:2316
- C:\Windows\System\PqmHsvA.exe
  C:\Windows\System\PqmHsvA.exe
  2⤵
  PID:2100
- C:\Windows\System\rsaKnEl.exe
  C:\Windows\System\rsaKnEl.exe
  2⤵
  PID:3128
- C:\Windows\System\gZFgegV.exe
  C:\Windows\System\gZFgegV.exe
  2⤵
  PID:3380
- C:\Windows\System\abXLaMT.exe
  C:\Windows\System\abXLaMT.exe
  2⤵
  PID:3204
- C:\Windows\System\XdkAsMI.exe
  C:\Windows\System\XdkAsMI.exe
  2⤵
  PID:3268
- C:\Windows\System\lxjoJoS.exe
  C:\Windows\System\lxjoJoS.exe
  2⤵
  PID:3248
- C:\Windows\System\bqKIuGK.exe
  C:\Windows\System\bqKIuGK.exe
  2⤵
  PID:3512
- C:\Windows\System\aMWpGXt.exe
  C:\Windows\System\aMWpGXt.exe
  2⤵
  PID:3548
- C:\Windows\System\RSPTBjW.exe
  C:\Windows\System\RSPTBjW.exe
  2⤵
  PID:3180
- C:\Windows\System\IxtuyzL.exe
  C:\Windows\System\IxtuyzL.exe
  2⤵
  PID:3196
- C:\Windows\System\jTRbRDV.exe
  C:\Windows\System\jTRbRDV.exe
  2⤵
  PID:3668
- C:\Windows\System\kDYjQma.exe
  C:\Windows\System\kDYjQma.exe
  2⤵
  PID:3400
- C:\Windows\System\fsYIQEn.exe
  C:\Windows\System\fsYIQEn.exe
  2⤵
  PID:3464
- C:\Windows\System\RZXuWAy.exe
  C:\Windows\System\RZXuWAy.exe
  2⤵
  PID:3532
- C:\Windows\System\WhnHOsV.exe
  C:\Windows\System\WhnHOsV.exe
  2⤵
  PID:3700
- C:\Windows\System\bUVLlRt.exe
  C:\Windows\System\bUVLlRt.exe
  2⤵
  PID:3580
- C:\Windows\System\inYKnvx.exe
  C:\Windows\System\inYKnvx.exe
  2⤵
  PID:3596
- C:\Windows\System\icaxKqj.exe
  C:\Windows\System\icaxKqj.exe
  2⤵
  PID:3616
- C:\Windows\System\BXgnWlq.exe
  C:\Windows\System\BXgnWlq.exe
  2⤵
  PID:3704
- C:\Windows\System\MSGilgr.exe
  C:\Windows\System\MSGilgr.exe
  2⤵
  PID:3648
- C:\Windows\System\phHNHSu.exe
  C:\Windows\System\phHNHSu.exe
  2⤵
  PID:3688
- C:\Windows\System\hqhWqQj.exe
  C:\Windows\System\hqhWqQj.exe
  2⤵
  PID:3772
- C:\Windows\System\mabyIPb.exe
  C:\Windows\System\mabyIPb.exe
  2⤵
  PID:3756
- C:\Windows\System\PhpIcGo.exe
  C:\Windows\System\PhpIcGo.exe
  2⤵
  PID:3740
- C:\Windows\System\qDxClTf.exe
  C:\Windows\System\qDxClTf.exe
  2⤵
  PID:3808
- C:\Windows\System\uWTLRGY.exe
  C:\Windows\System\uWTLRGY.exe
  2⤵
  PID:3848
- C:\Windows\System\ZSbImgh.exe
  C:\Windows\System\ZSbImgh.exe
  2⤵
  PID:3828
- C:\Windows\System\jQRHtNT.exe
  C:\Windows\System\jQRHtNT.exe
  2⤵
  PID:3892
- C:\Windows\System\oBobZlZ.exe
  C:\Windows\System\oBobZlZ.exe
  2⤵
  PID:3932
- C:\Windows\System\mFAouUk.exe
  C:\Windows\System\mFAouUk.exe
  2⤵
  PID:1260
- C:\Windows\System\GpaXqtV.exe
  C:\Windows\System\GpaXqtV.exe
  2⤵
  PID:3908
- C:\Windows\System\VakHcFM.exe
  C:\Windows\System\VakHcFM.exe
  2⤵
  PID:804
- C:\Windows\System\WDZxxfb.exe
  C:\Windows\System\WDZxxfb.exe
  2⤵
  PID:3980
- C:\Windows\System\gRzCVbP.exe
  C:\Windows\System\gRzCVbP.exe
  2⤵
  PID:4080
- C:\Windows\System\vRDJvfl.exe
  C:\Windows\System\vRDJvfl.exe
  2⤵
  PID:3264
- C:\Windows\System\YsyfckI.exe
  C:\Windows\System\YsyfckI.exe
  2⤵
  PID:4064
- C:\Windows\System\CuUETXK.exe
  C:\Windows\System\CuUETXK.exe
  2⤵
  PID:3200
- C:\Windows\System\fOOOzDN.exe
  C:\Windows\System\fOOOzDN.exe
  2⤵
  PID:3660
- C:\Windows\System\epwzlMk.exe
  C:\Windows\System\epwzlMk.exe
  2⤵
  PID:3280
- C:\Windows\System\ZEoxyln.exe
  C:\Windows\System\ZEoxyln.exe
  2⤵
  PID:3316
- C:\Windows\System\UrdUhDF.exe
  C:\Windows\System\UrdUhDF.exe
  2⤵
  PID:3420
- C:\Windows\System\WnIDbbc.exe
  C:\Windows\System\WnIDbbc.exe
  2⤵
  PID:3100
- C:\Windows\System\HreaysD.exe
  C:\Windows\System\HreaysD.exe
  2⤵
  PID:4028
- C:\Windows\System\OxAadCR.exe
  C:\Windows\System\OxAadCR.exe
  2⤵
  PID:3112
- C:\Windows\System\SCpIwSy.exe
  C:\Windows\System\SCpIwSy.exe
  2⤵
  PID:3216
- C:\Windows\System\GBRXNQT.exe
  C:\Windows\System\GBRXNQT.exe
  2⤵
  PID:3656
- C:\Windows\System\zkXegem.exe
  C:\Windows\System\zkXegem.exe
  2⤵
  PID:3608
- C:\Windows\System\XJIBnJC.exe
  C:\Windows\System\XJIBnJC.exe
  2⤵
  PID:3992
- C:\Windows\System\nqJzeEk.exe
  C:\Windows\System\nqJzeEk.exe
  2⤵
  PID:3944
- C:\Windows\System\LALFIks.exe
  C:\Windows\System\LALFIks.exe
  2⤵
  PID:3332
- C:\Windows\System\uUBHmJg.exe
  C:\Windows\System\uUBHmJg.exe
  2⤵
  PID:3368
- C:\Windows\System\hYDghAg.exe
  C:\Windows\System\hYDghAg.exe
  2⤵
  PID:2244
- C:\Windows\System\WandtsC.exe
  C:\Windows\System\WandtsC.exe
  2⤵
  PID:3152
- C:\Windows\System\KGEvgeh.exe
  C:\Windows\System\KGEvgeh.exe
  2⤵
  PID:3672
- C:\Windows\System\LXvzmVa.exe
  C:\Windows\System\LXvzmVa.exe
  2⤵
  PID:3664
- C:\Windows\System\EfTmCEX.exe
  C:\Windows\System\EfTmCEX.exe
  2⤵
  PID:3588
- C:\Windows\System\hjfnCBo.exe
  C:\Windows\System\hjfnCBo.exe
  2⤵
  PID:3628
- C:\Windows\System\vWDHYwI.exe
  C:\Windows\System\vWDHYwI.exe
  2⤵
  PID:3820
- C:\Windows\System\JPxnLhD.exe
  C:\Windows\System\JPxnLhD.exe
  2⤵
  PID:3552
- C:\Windows\System\MCfSmwC.exe
  C:\Windows\System\MCfSmwC.exe
  2⤵
  PID:3644
- C:\Windows\System\BlKJsIH.exe
  C:\Windows\System\BlKJsIH.exe
  2⤵
  PID:3096
- C:\Windows\System\xCCiIZT.exe
  C:\Windows\System\xCCiIZT.exe
  2⤵
  PID:3084
- C:\Windows\System\WOLpWDK.exe
  C:\Windows\System\WOLpWDK.exe
  2⤵
  PID:3568
- C:\Windows\System\VOJLTvG.exe
  C:\Windows\System\VOJLTvG.exe
  2⤵
  PID:3484
- C:\Windows\System\yNxSfij.exe
  C:\Windows\System\yNxSfij.exe
  2⤵
  PID:3168
- C:\Windows\System\ADgVIqd.exe
  C:\Windows\System\ADgVIqd.exe
  2⤵
  PID:4032
- C:\Windows\System\ZefBtaI.exe
  C:\Windows\System\ZefBtaI.exe
  2⤵
  PID:3864
- C:\Windows\System\szzcEcG.exe
  C:\Windows\System\szzcEcG.exe
  2⤵
  PID:4076
- C:\Windows\System\kQVEwNh.exe
  C:\Windows\System\kQVEwNh.exe
  2⤵
  PID:4060
- C:\Windows\System\WJloSIs.exe
  C:\Windows\System\WJloSIs.exe
  2⤵
  PID:3960
- C:\Windows\System\AltOEFy.exe
  C:\Windows\System\AltOEFy.exe
  2⤵
  PID:3776
- C:\Windows\System\BojQjqR.exe
  C:\Windows\System\BojQjqR.exe
  2⤵
  PID:4112
- C:\Windows\System\NbciYAm.exe
  C:\Windows\System\NbciYAm.exe
  2⤵
  PID:4160
- C:\Windows\System\cRMODJH.exe
  C:\Windows\System\cRMODJH.exe
  2⤵
  PID:4192
- C:\Windows\System\ikUJGIv.exe
  C:\Windows\System\ikUJGIv.exe
  2⤵
  PID:4212
- C:\Windows\System\XTKOake.exe
  C:\Windows\System\XTKOake.exe
  2⤵
  PID:4232
- C:\Windows\System\MaZokwz.exe
  C:\Windows\System\MaZokwz.exe
  2⤵
  PID:4248
- C:\Windows\System\KOiwoJk.exe
  C:\Windows\System\KOiwoJk.exe
  2⤵
  PID:4268
- C:\Windows\System\YPteSBu.exe
  C:\Windows\System\YPteSBu.exe
  2⤵
  PID:4296
- C:\Windows\System\pPcCFVC.exe
  C:\Windows\System\pPcCFVC.exe
  2⤵
  PID:4316
- C:\Windows\System\XtctQny.exe
  C:\Windows\System\XtctQny.exe
  2⤵
  PID:4332
- C:\Windows\System\OaxaqWC.exe
  C:\Windows\System\OaxaqWC.exe
  2⤵
  PID:4356
- C:\Windows\System\gBQWgzQ.exe
  C:\Windows\System\gBQWgzQ.exe
  2⤵
  PID:4372
- C:\Windows\System\mmMQmOV.exe
  C:\Windows\System\mmMQmOV.exe
  2⤵
  PID:4392
- C:\Windows\System\AyzOnXu.exe
  C:\Windows\System\AyzOnXu.exe
  2⤵
  PID:4408
- C:\Windows\System\ZHOmsYB.exe
  C:\Windows\System\ZHOmsYB.exe
  2⤵
  PID:4432
- C:\Windows\System\eFUuOce.exe
  C:\Windows\System\eFUuOce.exe
  2⤵
  PID:4452
- C:\Windows\System\kPYfzvC.exe
  C:\Windows\System\kPYfzvC.exe
  2⤵
  PID:4472
- C:\Windows\System\AMYPkeG.exe
  C:\Windows\System\AMYPkeG.exe
  2⤵
  PID:4488
- C:\Windows\System\EQbDspl.exe
  C:\Windows\System\EQbDspl.exe
  2⤵
  PID:4504
- C:\Windows\System\ZCLAEjN.exe
  C:\Windows\System\ZCLAEjN.exe
  2⤵
  PID:4520
- C:\Windows\System\hBuJwCS.exe
  C:\Windows\System\hBuJwCS.exe
  2⤵
  PID:4552
- C:\Windows\System\JBcFONx.exe
  C:\Windows\System\JBcFONx.exe
  2⤵
  PID:4568
- C:\Windows\System\KfUuIkH.exe
  C:\Windows\System\KfUuIkH.exe
  2⤵
  PID:4584
- C:\Windows\System\GFlLomg.exe
  C:\Windows\System\GFlLomg.exe
  2⤵
  PID:4600
- C:\Windows\System\qwazsGQ.exe
  C:\Windows\System\qwazsGQ.exe
  2⤵
  PID:4616
- C:\Windows\System\DlUKTNs.exe
  C:\Windows\System\DlUKTNs.exe
  2⤵
  PID:4648
- C:\Windows\System\YYvCjvm.exe
  C:\Windows\System\YYvCjvm.exe
  2⤵
  PID:4668
- C:\Windows\System\jFCFexf.exe
  C:\Windows\System\jFCFexf.exe
  2⤵
  PID:4684
- C:\Windows\System\HNdZWBL.exe
  C:\Windows\System\HNdZWBL.exe
  2⤵
  PID:4704
- C:\Windows\System\jOwnYbP.exe
  C:\Windows\System\jOwnYbP.exe
  2⤵
  PID:4720
- C:\Windows\System\EvsAOac.exe
  C:\Windows\System\EvsAOac.exe
  2⤵
  PID:4740
- C:\Windows\System\HFhfYBc.exe
  C:\Windows\System\HFhfYBc.exe
  2⤵
  PID:4756
- C:\Windows\System\SMqFWMJ.exe
  C:\Windows\System\SMqFWMJ.exe
  2⤵
  PID:4772
- C:\Windows\System\jlAUyJo.exe
  C:\Windows\System\jlAUyJo.exe
  2⤵
  PID:4788
- C:\Windows\System\IefuXBs.exe
  C:\Windows\System\IefuXBs.exe
  2⤵
  PID:4804
- C:\Windows\System\muQiRwS.exe
  C:\Windows\System\muQiRwS.exe
  2⤵
  PID:4820
- C:\Windows\System\OgWTuEZ.exe
  C:\Windows\System\OgWTuEZ.exe
  2⤵
  PID:4836
- C:\Windows\System\GHPEsmE.exe
  C:\Windows\System\GHPEsmE.exe
  2⤵
  PID:4852
- C:\Windows\System\WWKWolr.exe
  C:\Windows\System\WWKWolr.exe
  2⤵
  PID:4868
- C:\Windows\System\HcxIuJw.exe
  C:\Windows\System\HcxIuJw.exe
  2⤵
  PID:4888
- C:\Windows\System\luqDJpD.exe
  C:\Windows\System\luqDJpD.exe
  2⤵
  PID:4904
- C:\Windows\System\xrakiUm.exe
  C:\Windows\System\xrakiUm.exe
  2⤵
  PID:4920
- C:\Windows\System\ijhTtOa.exe
  C:\Windows\System\ijhTtOa.exe
  2⤵
  PID:4936
- C:\Windows\System\AJHTYTk.exe
  C:\Windows\System\AJHTYTk.exe
  2⤵
  PID:4956
- C:\Windows\System\ulcnPXa.exe
  C:\Windows\System\ulcnPXa.exe
  2⤵
  PID:4972
- C:\Windows\System\zdOgOkb.exe
  C:\Windows\System\zdOgOkb.exe
  2⤵
  PID:4988
- C:\Windows\System\ORpRPZD.exe
  C:\Windows\System\ORpRPZD.exe
  2⤵
  PID:5004
- C:\Windows\System\jWiIZvY.exe
  C:\Windows\System\jWiIZvY.exe
  2⤵
  PID:5020
- C:\Windows\System\EMrkZGH.exe
  C:\Windows\System\EMrkZGH.exe
  2⤵
  PID:5036
- C:\Windows\System\jplJStG.exe
  C:\Windows\System\jplJStG.exe
  2⤵
  PID:5052
- C:\Windows\System\XPzmCHP.exe
  C:\Windows\System\XPzmCHP.exe
  2⤵
  PID:5068
- C:\Windows\System\BlodbPn.exe
  C:\Windows\System\BlodbPn.exe
  2⤵
  PID:5084
- C:\Windows\System\gpcnPtn.exe
  C:\Windows\System\gpcnPtn.exe
  2⤵
  PID:5100
- C:\Windows\System\VxobdNl.exe
  C:\Windows\System\VxobdNl.exe
  2⤵
  PID:5116
- C:\Windows\System\gPgMiFB.exe
  C:\Windows\System\gPgMiFB.exe
  2⤵
  PID:3612
- C:\Windows\System\cFqsPQq.exe
  C:\Windows\System\cFqsPQq.exe
  2⤵
  PID:4128
- C:\Windows\System\TpOsVzr.exe
  C:\Windows\System\TpOsVzr.exe
  2⤵
  PID:4168
- C:\Windows\System\MmcSjxN.exe
  C:\Windows\System\MmcSjxN.exe
  2⤵
  PID:4144
- C:\Windows\System\cXuimLT.exe
  C:\Windows\System\cXuimLT.exe
  2⤵
  PID:4148
- C:\Windows\System\UqEGUpQ.exe
  C:\Windows\System\UqEGUpQ.exe
  2⤵
  PID:4204
- C:\Windows\System\XRzaDjM.exe
  C:\Windows\System\XRzaDjM.exe
  2⤵
  PID:4240
- C:\Windows\System\JKNZbsz.exe
  C:\Windows\System\JKNZbsz.exe
  2⤵
  PID:4280
- C:\Windows\System\robZDtc.exe
  C:\Windows\System\robZDtc.exe
  2⤵
  PID:4312
- C:\Windows\System\BmpipHt.exe
  C:\Windows\System\BmpipHt.exe
  2⤵
  PID:4340
- C:\Windows\System\NUiXgRC.exe
  C:\Windows\System\NUiXgRC.exe
  2⤵
  PID:4352
- C:\Windows\System\MBqDeXs.exe
  C:\Windows\System\MBqDeXs.exe
  2⤵
  PID:4400
- C:\Windows\System\sGIzKrJ.exe
  C:\Windows\System\sGIzKrJ.exe
  2⤵
  PID:4428
- C:\Windows\System\NgyWPyX.exe
  C:\Windows\System\NgyWPyX.exe
  2⤵
  PID:4448
- C:\Windows\System\lUcPylI.exe
  C:\Windows\System\lUcPylI.exe
  2⤵
  PID:4480
- C:\Windows\System\yaQlYwP.exe
  C:\Windows\System\yaQlYwP.exe
  2⤵
  PID:4484
- C:\Windows\System\JbczTSm.exe
  C:\Windows\System\JbczTSm.exe
  2⤵
  PID:4532
- C:\Windows\System\BVzbLMS.exe
  C:\Windows\System\BVzbLMS.exe
  2⤵
  PID:4592
- C:\Windows\System\YuuqYHb.exe
  C:\Windows\System\YuuqYHb.exe
  2⤵
  PID:4564
- C:\Windows\System\LMhmnKh.exe
  C:\Windows\System\LMhmnKh.exe
  2⤵
  PID:4636
- C:\Windows\System\teupYVD.exe
  C:\Windows\System\teupYVD.exe
  2⤵
  PID:4676
- C:\Windows\System\FemiyhG.exe
  C:\Windows\System\FemiyhG.exe
  2⤵
  PID:4680
- C:\Windows\System\nwfkECi.exe
  C:\Windows\System\nwfkECi.exe
  2⤵
  PID:4752
- C:\Windows\System\yOhbSGr.exe
  C:\Windows\System\yOhbSGr.exe
  2⤵
  PID:4844
- C:\Windows\System\ScSjBVI.exe
  C:\Windows\System\ScSjBVI.exe
  2⤵
  PID:4884
- C:\Windows\System\GNCEKoA.exe
  C:\Windows\System\GNCEKoA.exe
  2⤵
  PID:5128
- C:\Windows\System\DTEpLOI.exe
  C:\Windows\System\DTEpLOI.exe
  2⤵
  PID:5144
- C:\Windows\System\uOQSJLb.exe
  C:\Windows\System\uOQSJLb.exe
  2⤵
  PID:5160
- C:\Windows\System\GXodhIp.exe
  C:\Windows\System\GXodhIp.exe
  2⤵
  PID:5180
- C:\Windows\System\KSBbLIN.exe
  C:\Windows\System\KSBbLIN.exe
  2⤵
  PID:5196
- C:\Windows\System\cjbUQXs.exe
  C:\Windows\System\cjbUQXs.exe
  2⤵
  PID:5212
- C:\Windows\System\vkEPSTJ.exe
  C:\Windows\System\vkEPSTJ.exe
  2⤵
  PID:5420
- C:\Windows\System\PLAUFwc.exe
  C:\Windows\System\PLAUFwc.exe
  2⤵
  PID:5436
- C:\Windows\System\uysdEix.exe
  C:\Windows\System\uysdEix.exe
  2⤵
  PID:5452
- C:\Windows\System\YBCzHkZ.exe
  C:\Windows\System\YBCzHkZ.exe
  2⤵
  PID:5468
- C:\Windows\System\DQoqGEf.exe
  C:\Windows\System\DQoqGEf.exe
  2⤵
  PID:5484
- C:\Windows\System\spwBGaQ.exe
  C:\Windows\System\spwBGaQ.exe
  2⤵
  PID:5500
- C:\Windows\System\QtcuhBB.exe
  C:\Windows\System\QtcuhBB.exe
  2⤵
  PID:5516
- C:\Windows\System\BEkQCmQ.exe
  C:\Windows\System\BEkQCmQ.exe
  2⤵
  PID:5532
- C:\Windows\System\SWzyRsO.exe
  C:\Windows\System\SWzyRsO.exe
  2⤵
  PID:5548
- C:\Windows\System\nsROpFE.exe
  C:\Windows\System\nsROpFE.exe
  2⤵
  PID:5568
- C:\Windows\System\gnfkqku.exe
  C:\Windows\System\gnfkqku.exe
  2⤵
  PID:5584
- C:\Windows\System\hgCAbsA.exe
  C:\Windows\System\hgCAbsA.exe
  2⤵
  PID:5600
- C:\Windows\System\KkFzwyu.exe
  C:\Windows\System\KkFzwyu.exe
  2⤵
  PID:5620
- C:\Windows\System\qJLOwys.exe
  C:\Windows\System\qJLOwys.exe
  2⤵
  PID:5636
- C:\Windows\System\XDlqfUG.exe
  C:\Windows\System\XDlqfUG.exe
  2⤵
  PID:5652
- C:\Windows\System\HQFDFxR.exe
  C:\Windows\System\HQFDFxR.exe
  2⤵
  PID:5668
- C:\Windows\System\DPEdLvy.exe
  C:\Windows\System\DPEdLvy.exe
  2⤵
  PID:5684
- C:\Windows\System\ztNFyjk.exe
  C:\Windows\System\ztNFyjk.exe
  2⤵
  PID:5704
- C:\Windows\System\bBfULMl.exe
  C:\Windows\System\bBfULMl.exe
  2⤵
  PID:5720
- C:\Windows\System\lrjUalh.exe
  C:\Windows\System\lrjUalh.exe
  2⤵
  PID:5736
- C:\Windows\System\fQfUwTH.exe
  C:\Windows\System\fQfUwTH.exe
  2⤵
  PID:5820
- C:\Windows\System\NXIvwWm.exe
  C:\Windows\System\NXIvwWm.exe
  2⤵
  PID:5844
- C:\Windows\System\EKinteF.exe
  C:\Windows\System\EKinteF.exe
  2⤵
  PID:5860
- C:\Windows\System\HHZgCZe.exe
  C:\Windows\System\HHZgCZe.exe
  2⤵
  PID:5876
- C:\Windows\System\taQHSFY.exe
  C:\Windows\System\taQHSFY.exe
  2⤵
  PID:5892
- C:\Windows\System\sAIvOJu.exe
  C:\Windows\System\sAIvOJu.exe
  2⤵
  PID:5908
- C:\Windows\System\jCKbmJt.exe
  C:\Windows\System\jCKbmJt.exe
  2⤵
  PID:5928
- C:\Windows\System\NkdmQyE.exe
  C:\Windows\System\NkdmQyE.exe
  2⤵
  PID:5944
- C:\Windows\System\djnRgMn.exe
  C:\Windows\System\djnRgMn.exe
  2⤵
  PID:5960
- C:\Windows\System\adBXJQM.exe
  C:\Windows\System\adBXJQM.exe
  2⤵
  PID:5976
- C:\Windows\System\nCubHWP.exe
  C:\Windows\System\nCubHWP.exe
  2⤵
  PID:5992
- C:\Windows\System\cdeZGAi.exe
  C:\Windows\System\cdeZGAi.exe
  2⤵
  PID:6028
- C:\Windows\System\LwgoVfX.exe
  C:\Windows\System\LwgoVfX.exe
  2⤵
  PID:6044
- C:\Windows\System\oMdKvyg.exe
  C:\Windows\System\oMdKvyg.exe
  2⤵
  PID:6084
- C:\Windows\System\tAONSPQ.exe
  C:\Windows\System\tAONSPQ.exe
  2⤵
  PID:6100
- C:\Windows\System\GrqyeLb.exe
  C:\Windows\System\GrqyeLb.exe
  2⤵
  PID:6116
- C:\Windows\System\anNRhat.exe
  C:\Windows\System\anNRhat.exe
  2⤵
  PID:6132
- C:\Windows\System\QAxWGYM.exe
  C:\Windows\System\QAxWGYM.exe
  2⤵
  PID:4696
- C:\Windows\System\cGwXiBR.exe
  C:\Windows\System\cGwXiBR.exe
  2⤵
  PID:4732
- C:\Windows\System\kAJrkpR.exe
  C:\Windows\System\kAJrkpR.exe
  2⤵
  PID:4796
- C:\Windows\System\pjjyhzW.exe
  C:\Windows\System\pjjyhzW.exe
  2⤵
  PID:4828
- C:\Windows\System\XuXpYXA.exe
  C:\Windows\System\XuXpYXA.exe
  2⤵
  PID:4984
- C:\Windows\System\KgNNToT.exe
  C:\Windows\System\KgNNToT.exe
  2⤵
  PID:4932
- C:\Windows\System\vbTLsln.exe
  C:\Windows\System\vbTLsln.exe
  2⤵
  PID:5028
- C:\Windows\System\uthftGl.exe
  C:\Windows\System\uthftGl.exe
  2⤵
  PID:4284
- C:\Windows\System\bYgLJbt.exe
  C:\Windows\System\bYgLJbt.exe
  2⤵
  PID:5064
- C:\Windows\System\fDHInyL.exe
  C:\Windows\System\fDHInyL.exe
  2⤵
  PID:4100
- C:\Windows\System\HrjGvyB.exe
  C:\Windows\System\HrjGvyB.exe
  2⤵
  PID:4104
- C:\Windows\System\myTJnmg.exe
  C:\Windows\System\myTJnmg.exe
  2⤵
  PID:4156
- C:\Windows\System\JqFedAp.exe
  C:\Windows\System\JqFedAp.exe
  2⤵
  PID:4224
- C:\Windows\System\rNhfCCY.exe
  C:\Windows\System\rNhfCCY.exe
  2⤵
  PID:4136
- C:\Windows\System\RMCiLeV.exe
  C:\Windows\System\RMCiLeV.exe
  2⤵
  PID:4264
- C:\Windows\System\zkvJftb.exe
  C:\Windows\System\zkvJftb.exe
  2⤵
  PID:4388
- C:\Windows\System\MSjyvUX.exe
  C:\Windows\System\MSjyvUX.exe
  2⤵
  PID:4536
- C:\Windows\System\MWTabRk.exe
  C:\Windows\System\MWTabRk.exe
  2⤵
  PID:4576
- C:\Windows\System\DOGyBmp.exe
  C:\Windows\System\DOGyBmp.exe
  2⤵
  PID:4632
- C:\Windows\System\NBmUECx.exe
  C:\Windows\System\NBmUECx.exe
  2⤵
  PID:4812
- C:\Windows\System\ZkBPaUb.exe
  C:\Windows\System\ZkBPaUb.exe
  2⤵
  PID:5152
- C:\Windows\System\GisEXPA.exe
  C:\Windows\System\GisEXPA.exe
  2⤵
  PID:5232
- C:\Windows\System\bLYAaWE.exe
  C:\Windows\System\bLYAaWE.exe
  2⤵
  PID:5256
- C:\Windows\System\HNFbzkK.exe
  C:\Windows\System\HNFbzkK.exe
  2⤵
  PID:5292
- C:\Windows\System\EYxdTRn.exe
  C:\Windows\System\EYxdTRn.exe
  2⤵
  PID:4712
- C:\Windows\System\BZHXRJi.exe
  C:\Windows\System\BZHXRJi.exe
  2⤵
  PID:5392
- C:\Windows\System\GxeiymE.exe
  C:\Windows\System\GxeiymE.exe
  2⤵
  PID:5208
- C:\Windows\System\AzyUaCK.exe
  C:\Windows\System\AzyUaCK.exe
  2⤵
  PID:4364
- C:\Windows\System\WAqpGCp.exe
  C:\Windows\System\WAqpGCp.exe
  2⤵
  PID:4716
- C:\Windows\System\lQgRJFZ.exe
  C:\Windows\System\lQgRJFZ.exe
  2⤵
  PID:4640
- C:\Windows\System\tNVuSbq.exe
  C:\Windows\System\tNVuSbq.exe
  2⤵
  PID:5412
- C:\Windows\System\qEBnytx.exe
  C:\Windows\System\qEBnytx.exe
  2⤵
  PID:5476
- C:\Windows\System\kjpJvwo.exe
  C:\Windows\System\kjpJvwo.exe
  2⤵
  PID:5608
- C:\Windows\System\HklLnWA.exe
  C:\Windows\System\HklLnWA.exe
  2⤵
  PID:5556
- C:\Windows\System\GLrGUFU.exe
  C:\Windows\System\GLrGUFU.exe
  2⤵
  PID:5492
- C:\Windows\System\SUkhJOE.exe
  C:\Windows\System\SUkhJOE.exe
  2⤵
  PID:5428
- C:\Windows\System\zsUBwWM.exe
  C:\Windows\System\zsUBwWM.exe
  2⤵
  PID:5592
- C:\Windows\System\INKkdzL.exe
  C:\Windows\System\INKkdzL.exe
  2⤵
  PID:5628
- C:\Windows\System\GGFUWpb.exe
  C:\Windows\System\GGFUWpb.exe
  2⤵
  PID:5696
- C:\Windows\System\YkOngje.exe
  C:\Windows\System\YkOngje.exe
  2⤵
  PID:5712
- C:\Windows\System\jKcFLeZ.exe
  C:\Windows\System\jKcFLeZ.exe
  2⤵
  PID:5756
- C:\Windows\System\ZIVOVma.exe
  C:\Windows\System\ZIVOVma.exe
  2⤵
  PID:5808
- C:\Windows\System\KNAiFlH.exe
  C:\Windows\System\KNAiFlH.exe
  2⤵
  PID:5828
- C:\Windows\System\xrgSSpd.exe
  C:\Windows\System\xrgSSpd.exe
  2⤵
  PID:5852
- C:\Windows\System\XcvvsyB.exe
  C:\Windows\System\XcvvsyB.exe
  2⤵
  PID:5916
- C:\Windows\System\GUezVKB.exe
  C:\Windows\System\GUezVKB.exe
  2⤵
  PID:5920
- C:\Windows\System\jvLybqf.exe
  C:\Windows\System\jvLybqf.exe
  2⤵
  PID:5904
- C:\Windows\System\lXBGXtK.exe
  C:\Windows\System\lXBGXtK.exe
  2⤵
  PID:5968
- C:\Windows\System\sYXZUGZ.exe
  C:\Windows\System\sYXZUGZ.exe
  2⤵
  PID:5936
- C:\Windows\System\dKdDKKi.exe
  C:\Windows\System\dKdDKKi.exe
  2⤵
  PID:6052
- C:\Windows\System\slXrnuc.exe
  C:\Windows\System\slXrnuc.exe
  2⤵
  PID:6040
- C:\Windows\System\JmwirIm.exe
  C:\Windows\System\JmwirIm.exe
  2⤵
  PID:6072
- C:\Windows\System\wVKuMuK.exe
  C:\Windows\System\wVKuMuK.exe
  2⤵
  PID:6108
- C:\Windows\System\qgzcQRx.exe
  C:\Windows\System\qgzcQRx.exe
  2⤵
  PID:356
- C:\Windows\System\kDFpzKS.exe
  C:\Windows\System\kDFpzKS.exe
  2⤵
  PID:4900
- C:\Windows\System\mayzrGy.exe
  C:\Windows\System\mayzrGy.exe
  2⤵
  PID:6140
- C:\Windows\System\uQyaTBb.exe
  C:\Windows\System\uQyaTBb.exe
  2⤵
  PID:4172
- C:\Windows\System\vmPVLKR.exe
  C:\Windows\System\vmPVLKR.exe
  2⤵
  PID:4968
- C:\Windows\System\cvpijXT.exe
  C:\Windows\System\cvpijXT.exe
  2⤵
  PID:4952
- C:\Windows\System\OeQiRPL.exe
  C:\Windows\System\OeQiRPL.exe
  2⤵
  PID:4528
- C:\Windows\System\BTMXPgD.exe
  C:\Windows\System\BTMXPgD.exe
  2⤵
  PID:5048
- C:\Windows\System\SgykuGl.exe
  C:\Windows\System\SgykuGl.exe
  2⤵
  PID:3388
- C:\Windows\System\fNUUnxh.exe
  C:\Windows\System\fNUUnxh.exe
  2⤵
  PID:4120
- C:\Windows\System\QKGpJPR.exe
  C:\Windows\System\QKGpJPR.exe
  2⤵
  PID:5288
- C:\Windows\System\PmRbwXQ.exe
  C:\Windows\System\PmRbwXQ.exe
  2⤵
  PID:5188
- C:\Windows\System\ZsCMcDe.exe
  C:\Windows\System\ZsCMcDe.exe
  2⤵
  PID:5276
- C:\Windows\System\qtDFWSg.exe
  C:\Windows\System\qtDFWSg.exe
  2⤵
  PID:5312
- C:\Windows\System\OfAXwkt.exe
  C:\Windows\System\OfAXwkt.exe
  2⤵
  PID:5336
- C:\Windows\System\wEJaROV.exe
  C:\Windows\System\wEJaROV.exe
  2⤵
  PID:5356
- C:\Windows\System\SiKdftb.exe
  C:\Windows\System\SiKdftb.exe
  2⤵
  PID:5368
- C:\Windows\System\OlcOXXh.exe
  C:\Windows\System\OlcOXXh.exe
  2⤵
  PID:4228
- C:\Windows\System\tSMxlcl.exe
  C:\Windows\System\tSMxlcl.exe
  2⤵
  PID:4424
- C:\Windows\System\arVYvXc.exe
  C:\Windows\System\arVYvXc.exe
  2⤵
  PID:4612
- C:\Windows\System\KJumKuH.exe
  C:\Windows\System\KJumKuH.exe
  2⤵
  PID:5080
- C:\Windows\System\RWDjqeI.exe
  C:\Windows\System\RWDjqeI.exe
  2⤵
  PID:5408
- C:\Windows\System\ctQKKcS.exe
  C:\Windows\System\ctQKKcS.exe
  2⤵
  PID:5540
- C:\Windows\System\TYQlScN.exe
  C:\Windows\System\TYQlScN.exe
  2⤵
  PID:5460
- C:\Windows\System\gSJIbcM.exe
  C:\Windows\System\gSJIbcM.exe
  2⤵
  PID:5648
- C:\Windows\System\DaReiWH.exe
  C:\Windows\System\DaReiWH.exe
  2⤵
  PID:5680
- C:\Windows\System\mVVOVyU.exe
  C:\Windows\System\mVVOVyU.exe
  2⤵
  PID:5752
- C:\Windows\System\OUZlMdR.exe
  C:\Windows\System\OUZlMdR.exe
  2⤵
  PID:5792
- C:\Windows\System\ANnnsGM.exe
  C:\Windows\System\ANnnsGM.exe
  2⤵
  PID:5780
- C:\Windows\System\AdeSiFr.exe
  C:\Windows\System\AdeSiFr.exe
  2⤵
  PID:5768
- C:\Windows\System\NDKdCPP.exe
  C:\Windows\System\NDKdCPP.exe
  2⤵
  PID:5956
- C:\Windows\System\JHmQazX.exe
  C:\Windows\System\JHmQazX.exe
  2⤵
  PID:2108
- C:\Windows\System\lUjSTNz.exe
  C:\Windows\System\lUjSTNz.exe
  2⤵
  PID:4864
- C:\Windows\System\FKCegLc.exe
  C:\Windows\System\FKCegLc.exe
  2⤵
  PID:5836
- C:\Windows\System\JlbuPHd.exe
  C:\Windows\System\JlbuPHd.exe
  2⤵
  PID:6128
- C:\Windows\System\BVYbDGo.exe
  C:\Windows\System\BVYbDGo.exe
  2⤵
  PID:4944
- C:\Windows\System\yeKHWUI.exe
  C:\Windows\System\yeKHWUI.exe
  2⤵
  PID:5816
- C:\Windows\System\blVVVNv.exe
  C:\Windows\System\blVVVNv.exe
  2⤵
  PID:6000
- C:\Windows\System\qgaSyyE.exe
  C:\Windows\System\qgaSyyE.exe
  2⤵
  PID:6096
- C:\Windows\System\mPHPnRz.exe
  C:\Windows\System\mPHPnRz.exe
  2⤵
  PID:4768
- C:\Windows\System\YnUHEbH.exe
  C:\Windows\System\YnUHEbH.exe
  2⤵
  PID:5096
- C:\Windows\System\vsvqdEY.exe
  C:\Windows\System\vsvqdEY.exe
  2⤵
  PID:5252
- C:\Windows\System\mKOPVpV.exe
  C:\Windows\System\mKOPVpV.exe
  2⤵
  PID:4996
- C:\Windows\System\DKTIppb.exe
  C:\Windows\System\DKTIppb.exe
  2⤵
  PID:2260
- C:\Windows\System\nmNJVAD.exe
  C:\Windows\System\nmNJVAD.exe
  2⤵
  PID:5044
- C:\Windows\System\PwTyrgz.exe
  C:\Windows\System\PwTyrgz.exe
  2⤵
  PID:4540
- C:\Windows\System\oqUIRBw.exe
  C:\Windows\System\oqUIRBw.exe
  2⤵
  PID:5332
- C:\Windows\System\ZDeYyMO.exe
  C:\Windows\System\ZDeYyMO.exe
  2⤵
  PID:5404
- C:\Windows\System\QkVtddm.exe
  C:\Windows\System\QkVtddm.exe
  2⤵
  PID:5384
- C:\Windows\System\QwHXODX.exe
  C:\Windows\System\QwHXODX.exe
  2⤵
  PID:5432
- C:\Windows\System\vWnutGq.exe
  C:\Windows\System\vWnutGq.exe
  2⤵
  PID:5776
- C:\Windows\System\UwlNnum.exe
  C:\Windows\System\UwlNnum.exe
  2⤵
  PID:4548
- C:\Windows\System\dLwiTZm.exe
  C:\Windows\System\dLwiTZm.exe
  2⤵
  PID:4140
- C:\Windows\System\ejMyKok.exe
  C:\Windows\System\ejMyKok.exe
  2⤵
  PID:5448
- C:\Windows\System\mdSLZsp.exe
  C:\Windows\System\mdSLZsp.exe
  2⤵
  PID:5644
- C:\Windows\System\zGvGlCb.exe
  C:\Windows\System\zGvGlCb.exe
  2⤵
  PID:5812
- C:\Windows\System\wHCAkUn.exe
  C:\Windows\System\wHCAkUn.exe
  2⤵
  PID:5108
- C:\Windows\System\ORpkgxS.exe
  C:\Windows\System\ORpkgxS.exe
  2⤵
  PID:5544
- C:\Windows\System\OiLjUKd.exe
  C:\Windows\System\OiLjUKd.exe
  2⤵
  PID:4220
- C:\Windows\System\WKIWCtf.exe
  C:\Windows\System\WKIWCtf.exe
  2⤵
  PID:4948
- C:\Windows\System\MIGEPXb.exe
  C:\Windows\System\MIGEPXb.exe
  2⤵
  PID:5328
- C:\Windows\System\IhtEiPV.exe
  C:\Windows\System\IhtEiPV.exe
  2⤵
  PID:5732
- C:\Windows\System\mWntHgp.exe
  C:\Windows\System\mWntHgp.exe
  2⤵
  PID:6068
- C:\Windows\System\xmDFGgS.exe
  C:\Windows\System\xmDFGgS.exe
  2⤵
  PID:5112
- C:\Windows\System\FnFsYVT.exe
  C:\Windows\System\FnFsYVT.exe
  2⤵
  PID:6016
- C:\Windows\System\pmUEdvE.exe
  C:\Windows\System\pmUEdvE.exe
  2⤵
  PID:5664
- C:\Windows\System\rvazzbs.exe
  C:\Windows\System\rvazzbs.exe
  2⤵
  PID:6080
- C:\Windows\System\oYRMhpy.exe
  C:\Windows\System\oYRMhpy.exe
  2⤵
  PID:5192
- C:\Windows\System\wquTzzP.exe
  C:\Windows\System\wquTzzP.exe
  2⤵
  PID:5344
- C:\Windows\System\TJMNRFA.exe
  C:\Windows\System\TJMNRFA.exe
  2⤵
  PID:4292
- C:\Windows\System\DDJIJXD.exe
  C:\Windows\System\DDJIJXD.exe
  2⤵
  PID:5840
- C:\Windows\System\UGXFIIP.exe
  C:\Windows\System\UGXFIIP.exe
  2⤵
  PID:5984
- C:\Windows\System\nunBQIR.exe
  C:\Windows\System\nunBQIR.exe
  2⤵
  PID:4644
- C:\Windows\System\uhtycET.exe
  C:\Windows\System\uhtycET.exe
  2⤵
  PID:1276
- C:\Windows\System\BmrcqrG.exe
  C:\Windows\System\BmrcqrG.exe
  2⤵
  PID:4764
- C:\Windows\System\SOBDHqi.exe
  C:\Windows\System\SOBDHqi.exe
  2⤵
  PID:5284
- C:\Windows\System\pqutixP.exe
  C:\Windows\System\pqutixP.exe
  2⤵
  PID:6156
- C:\Windows\System\HuFeOai.exe
  C:\Windows\System\HuFeOai.exe
  2⤵
  PID:6172
- C:\Windows\System\BKTgSel.exe
  C:\Windows\System\BKTgSel.exe
  2⤵
  PID:6188
- C:\Windows\System\fEePRHC.exe
  C:\Windows\System\fEePRHC.exe
  2⤵
  PID:6208
- C:\Windows\System\eSccgwd.exe
  C:\Windows\System\eSccgwd.exe
  2⤵
  PID:6224
- C:\Windows\System\zenmyKL.exe
  C:\Windows\System\zenmyKL.exe
  2⤵
  PID:6280
- C:\Windows\System\WMAkrdY.exe
  C:\Windows\System\WMAkrdY.exe
  2⤵
  PID:6296
- C:\Windows\System\xzbUKqW.exe
  C:\Windows\System\xzbUKqW.exe
  2⤵
  PID:6312
- C:\Windows\System\XmocqnM.exe
  C:\Windows\System\XmocqnM.exe
  2⤵
  PID:6328
- C:\Windows\System\qXXuqdO.exe
  C:\Windows\System\qXXuqdO.exe
  2⤵
  PID:6344
- C:\Windows\System\HnLXgwE.exe
  C:\Windows\System\HnLXgwE.exe
  2⤵
  PID:6360
- C:\Windows\System\jWCkAtR.exe
  C:\Windows\System\jWCkAtR.exe
  2⤵
  PID:6376
- C:\Windows\System\koBsdFQ.exe
  C:\Windows\System\koBsdFQ.exe
  2⤵
  PID:6392
- C:\Windows\System\DWrGNXn.exe
  C:\Windows\System\DWrGNXn.exe
  2⤵
  PID:6408
- C:\Windows\System\RHAttDg.exe
  C:\Windows\System\RHAttDg.exe
  2⤵
  PID:6424
- C:\Windows\System\wSLGTaG.exe
  C:\Windows\System\wSLGTaG.exe
  2⤵
  PID:6440
- C:\Windows\System\xTOzoYw.exe
  C:\Windows\System\xTOzoYw.exe
  2⤵
  PID:6456
- C:\Windows\System\UmLsKvo.exe
  C:\Windows\System\UmLsKvo.exe
  2⤵
  PID:6472
- C:\Windows\System\PQoKEty.exe
  C:\Windows\System\PQoKEty.exe
  2⤵
  PID:6488
- C:\Windows\System\bRClKEw.exe
  C:\Windows\System\bRClKEw.exe
  2⤵
  PID:6504
- C:\Windows\System\gzjODqo.exe
  C:\Windows\System\gzjODqo.exe
  2⤵
  PID:6520
- C:\Windows\System\cIaJiNE.exe
  C:\Windows\System\cIaJiNE.exe
  2⤵
  PID:6536
- C:\Windows\System\ZaBDwKS.exe
  C:\Windows\System\ZaBDwKS.exe
  2⤵
  PID:6556
- C:\Windows\System\lUGgVNw.exe
  C:\Windows\System\lUGgVNw.exe
  2⤵
  PID:6572
- C:\Windows\System\YnBjUYi.exe
  C:\Windows\System\YnBjUYi.exe
  2⤵
  PID:6592
- C:\Windows\System\IaUTSiR.exe
  C:\Windows\System\IaUTSiR.exe
  2⤵
  PID:6608
- C:\Windows\System\JhJMKva.exe
  C:\Windows\System\JhJMKva.exe
  2⤵
  PID:6624
- C:\Windows\System\QdjSDhd.exe
  C:\Windows\System\QdjSDhd.exe
  2⤵
  PID:6640
- C:\Windows\System\KDhbBhY.exe
  C:\Windows\System\KDhbBhY.exe
  2⤵
  PID:6656
- C:\Windows\System\GiDqPtG.exe
  C:\Windows\System\GiDqPtG.exe
  2⤵
  PID:6672
- C:\Windows\System\BggdBhI.exe
  C:\Windows\System\BggdBhI.exe
  2⤵
  PID:6744
- C:\Windows\System\eSOppSR.exe
  C:\Windows\System\eSOppSR.exe
  2⤵
  PID:6760
- C:\Windows\System\FLDymDz.exe
  C:\Windows\System\FLDymDz.exe
  2⤵
  PID:6784
- C:\Windows\System\YyUTkFo.exe
  C:\Windows\System\YyUTkFo.exe
  2⤵
  PID:6800
- C:\Windows\System\ojLEtCo.exe
  C:\Windows\System\ojLEtCo.exe
  2⤵
  PID:6816
- C:\Windows\System\RBfHYHL.exe
  C:\Windows\System\RBfHYHL.exe
  2⤵
  PID:6832
- C:\Windows\System\AhdBPqs.exe
  C:\Windows\System\AhdBPqs.exe
  2⤵
  PID:6848
- C:\Windows\System\oprDBeQ.exe
  C:\Windows\System\oprDBeQ.exe
  2⤵
  PID:6868
- C:\Windows\System\IAtDwBb.exe
  C:\Windows\System\IAtDwBb.exe
  2⤵
  PID:6884
- C:\Windows\System\NWzEJkF.exe
  C:\Windows\System\NWzEJkF.exe
  2⤵
  PID:6900
- C:\Windows\System\TmpysFg.exe
  C:\Windows\System\TmpysFg.exe
  2⤵
  PID:6916
- C:\Windows\System\lSdwOvT.exe
  C:\Windows\System\lSdwOvT.exe
  2⤵
  PID:6932
- C:\Windows\System\sDXUggV.exe
  C:\Windows\System\sDXUggV.exe
  2⤵
  PID:6948
- C:\Windows\System\GjDWOYO.exe
  C:\Windows\System\GjDWOYO.exe
  2⤵
  PID:6964
- C:\Windows\System\fLuWlov.exe
  C:\Windows\System\fLuWlov.exe
  2⤵
  PID:6980
- C:\Windows\System\DXiaYZS.exe
  C:\Windows\System\DXiaYZS.exe
  2⤵
  PID:6996
- C:\Windows\System\zvmdSGR.exe
  C:\Windows\System\zvmdSGR.exe
  2⤵
  PID:7016
- C:\Windows\System\cdgkqbr.exe
  C:\Windows\System\cdgkqbr.exe
  2⤵
  PID:7032
- C:\Windows\System\suSUzuZ.exe
  C:\Windows\System\suSUzuZ.exe
  2⤵
  PID:7048
- C:\Windows\System\XfwzKGR.exe
  C:\Windows\System\XfwzKGR.exe
  2⤵
  PID:7064
- C:\Windows\System\JdMFSYI.exe
  C:\Windows\System\JdMFSYI.exe
  2⤵
  PID:7080
- C:\Windows\System\YKmsALX.exe
  C:\Windows\System\YKmsALX.exe
  2⤵
  PID:7096
- C:\Windows\System\gODNpcP.exe
  C:\Windows\System\gODNpcP.exe
  2⤵
  PID:7112
- C:\Windows\System\bfmaHOr.exe
  C:\Windows\System\bfmaHOr.exe
  2⤵
  PID:7128
- C:\Windows\System\sxzuqck.exe
  C:\Windows\System\sxzuqck.exe
  2⤵
  PID:7144
- C:\Windows\System\zdQPaFe.exe
  C:\Windows\System\zdQPaFe.exe
  2⤵
  PID:7160
- C:\Windows\System\PUgtipl.exe
  C:\Windows\System\PUgtipl.exe
  2⤵
  PID:5576
- C:\Windows\System\SNwZZDf.exe
  C:\Windows\System\SNwZZDf.exe
  2⤵
  PID:5380
- C:\Windows\System\xvSeAZb.exe
  C:\Windows\System\xvSeAZb.exe
  2⤵
  PID:5788
- C:\Windows\System\JYvssIw.exe
  C:\Windows\System\JYvssIw.exe
  2⤵
  PID:6148
- C:\Windows\System\fNMRjRv.exe
  C:\Windows\System\fNMRjRv.exe
  2⤵
  PID:6216
- C:\Windows\System\adoUUYC.exe
  C:\Windows\System\adoUUYC.exe
  2⤵
  PID:6248
- C:\Windows\System\eHttFyD.exe
  C:\Windows\System\eHttFyD.exe
  2⤵
  PID:6008
- C:\Windows\System\JqWpMEP.exe
  C:\Windows\System\JqWpMEP.exe
  2⤵
  PID:6196
- C:\Windows\System\uSCPPdy.exe
  C:\Windows\System\uSCPPdy.exe
  2⤵
  PID:6288
- C:\Windows\System\IopVgGX.exe
  C:\Windows\System\IopVgGX.exe
  2⤵
  PID:6404
- C:\Windows\System\ZNxCLNl.exe
  C:\Windows\System\ZNxCLNl.exe
  2⤵
  PID:6448
- C:\Windows\System\bwmkUkw.exe
  C:\Windows\System\bwmkUkw.exe
  2⤵
  PID:6324
- C:\Windows\System\hcyNrbD.exe
  C:\Windows\System\hcyNrbD.exe
  2⤵
  PID:6688
- C:\Windows\System\iDQWFFe.exe
  C:\Windows\System\iDQWFFe.exe
  2⤵
  PID:6484
- C:\Windows\System\EfkSPZB.exe
  C:\Windows\System\EfkSPZB.exe
  2⤵
  PID:6684
- C:\Windows\System\HtVGXkj.exe
  C:\Windows\System\HtVGXkj.exe
  2⤵
  PID:6708
- C:\Windows\System\hPAitiu.exe
  C:\Windows\System\hPAitiu.exe
  2⤵
  PID:6728
- C:\Windows\System\bpVEZfz.exe
  C:\Windows\System\bpVEZfz.exe
  2⤵
  PID:6740
- C:\Windows\System\UcJsTte.exe
  C:\Windows\System\UcJsTte.exe
  2⤵
  PID:6532
- C:\Windows\System\ovGPJHG.exe
  C:\Windows\System\ovGPJHG.exe
  2⤵
  PID:6632
- C:\Windows\System\oWNmZhO.exe
  C:\Windows\System\oWNmZhO.exe
  2⤵
  PID:6776
- C:\Windows\System\hlXWXRP.exe
  C:\Windows\System\hlXWXRP.exe
  2⤵
  PID:6808
- C:\Windows\System\QzfjKrS.exe
  C:\Windows\System\QzfjKrS.exe
  2⤵
  PID:6844
- C:\Windows\System\pGeqnRx.exe
  C:\Windows\System\pGeqnRx.exe
  2⤵
  PID:6912
- C:\Windows\System\VtTroPc.exe
  C:\Windows\System\VtTroPc.exe
  2⤵
  PID:7004
- C:\Windows\System\HkkVbQT.exe
  C:\Windows\System\HkkVbQT.exe
  2⤵
  PID:7072
- C:\Windows\System\XUoYFhu.exe
  C:\Windows\System\XUoYFhu.exe
  2⤵
  PID:7108
- C:\Windows\System\jfMiRKF.exe
  C:\Windows\System\jfMiRKF.exe
  2⤵
  PID:6796
- C:\Windows\System\eUgIyjk.exe
  C:\Windows\System\eUgIyjk.exe
  2⤵
  PID:5364
- C:\Windows\System\pRhkIwN.exe
  C:\Windows\System\pRhkIwN.exe
  2⤵
  PID:6896
- C:\Windows\System\KwjbgYG.exe
  C:\Windows\System\KwjbgYG.exe
  2⤵
  PID:6960
- C:\Windows\System\FTuSgYC.exe
  C:\Windows\System\FTuSgYC.exe
  2⤵
  PID:7028
- C:\Windows\System\AAmgoAZ.exe
  C:\Windows\System\AAmgoAZ.exe
  2⤵
  PID:6256
- C:\Windows\System\xUMHVzh.exe
  C:\Windows\System\xUMHVzh.exe
  2⤵
  PID:6236
- C:\Windows\System\CxzmlJd.exe
  C:\Windows\System\CxzmlJd.exe
  2⤵
  PID:6308
- C:\Windows\System\QPFcOug.exe
  C:\Windows\System\QPFcOug.exe
  2⤵
  PID:6336
- C:\Windows\System\Mkjyntn.exe
  C:\Windows\System\Mkjyntn.exe
  2⤵
  PID:6616
- C:\Windows\System\vnOLVMt.exe
  C:\Windows\System\vnOLVMt.exe
  2⤵
  PID:6436
- C:\Windows\System\vYbtyPy.exe
  C:\Windows\System\vYbtyPy.exe
  2⤵
  PID:6712
- C:\Windows\System\sHRQLFN.exe
  C:\Windows\System\sHRQLFN.exe
  2⤵
  PID:6720
- C:\Windows\System\lrPbrjg.exe
  C:\Windows\System\lrPbrjg.exe
  2⤵
  PID:6528
- C:\Windows\System\FFmHOeo.exe
  C:\Windows\System\FFmHOeo.exe
  2⤵
  PID:6544
- C:\Windows\System\FLJTgIR.exe
  C:\Windows\System\FLJTgIR.exe
  2⤵
  PID:6452
- C:\Windows\System\uiaCNbK.exe
  C:\Windows\System\uiaCNbK.exe
  2⤵
  PID:6700
- C:\Windows\System\bHOPDHd.exe
  C:\Windows\System\bHOPDHd.exe
  2⤵
  PID:6604
- C:\Windows\System\qMyPcDV.exe
  C:\Windows\System\qMyPcDV.exe
  2⤵
  PID:6908
- C:\Windows\System\CXUKkHT.exe
  C:\Windows\System\CXUKkHT.exe
  2⤵
  PID:7104
- C:\Windows\System\dqZlNqT.exe
  C:\Windows\System\dqZlNqT.exe
  2⤵
  PID:6956
- C:\Windows\System\SoZSVyW.exe
  C:\Windows\System\SoZSVyW.exe
  2⤵
  PID:7140
- C:\Windows\System\ALixLsV.exe
  C:\Windows\System\ALixLsV.exe
  2⤵
  PID:4916
- C:\Windows\System\bnCtiaS.exe
  C:\Windows\System\bnCtiaS.exe
  2⤵
  PID:7088
- C:\Windows\System\ucERjyR.exe
  C:\Windows\System\ucERjyR.exe
  2⤵
  PID:7092
- C:\Windows\System\dVLfgbL.exe
  C:\Windows\System\dVLfgbL.exe
  2⤵
  PID:7124
- C:\Windows\System\hYNtoVW.exe
  C:\Windows\System\hYNtoVW.exe
  2⤵
  PID:6272
- C:\Windows\System\MVmSilB.exe
  C:\Windows\System\MVmSilB.exe
  2⤵
  PID:4256
- C:\Windows\System\BhCMPwm.exe
  C:\Windows\System\BhCMPwm.exe
  2⤵
  PID:5320
- C:\Windows\System\HvQhDpI.exe
  C:\Windows\System\HvQhDpI.exe
  2⤵
  PID:5248
- C:\Windows\System\bVshMJU.exe
  C:\Windows\System\bVshMJU.exe
  2⤵
  PID:6432
- C:\Windows\System\RSAwGOs.exe
  C:\Windows\System\RSAwGOs.exe
  2⤵
  PID:6500
- C:\Windows\System\wcwfaXU.exe
  C:\Windows\System\wcwfaXU.exe
  2⤵
  PID:6600
- C:\Windows\System\ybdcgWL.exe
  C:\Windows\System\ybdcgWL.exe
  2⤵
  PID:6860
- C:\Windows\System\voHldST.exe
  C:\Windows\System\voHldST.exe
  2⤵
  PID:6992
- C:\Windows\System\MIEWynP.exe
  C:\Windows\System\MIEWynP.exe
  2⤵
  PID:6168
- C:\Windows\System\xnUFULK.exe
  C:\Windows\System\xnUFULK.exe
  2⤵
  PID:6468
- C:\Windows\System\gCInolc.exe
  C:\Windows\System\gCInolc.exe
  2⤵
  PID:6696
- C:\Windows\System\tBdFGvs.exe
  C:\Windows\System\tBdFGvs.exe
  2⤵
  PID:6588
- C:\Windows\System\dLBsLgk.exe
  C:\Windows\System\dLBsLgk.exe
  2⤵
  PID:6892
- C:\Windows\System\oVXaLSd.exe
  C:\Windows\System\oVXaLSd.exe
  2⤵
  PID:6880
- C:\Windows\System\PBueQtc.exe
  C:\Windows\System\PBueQtc.exe
  2⤵
  PID:6512
- C:\Windows\System\QICictR.exe
  C:\Windows\System\QICictR.exe
  2⤵
  PID:6976
- C:\Windows\System\KKoAFka.exe
  C:\Windows\System\KKoAFka.exe
  2⤵
  PID:6756
- C:\Windows\System\PQTdSFz.exe
  C:\Windows\System\PQTdSFz.exe
  2⤵
  PID:7180
- C:\Windows\System\EyMcAiN.exe
  C:\Windows\System\EyMcAiN.exe
  2⤵
  PID:7200
- C:\Windows\System\IUAqvIO.exe
  C:\Windows\System\IUAqvIO.exe
  2⤵
  PID:7216
- C:\Windows\System\LuezEVi.exe
  C:\Windows\System\LuezEVi.exe
  2⤵
  PID:7232
- C:\Windows\System\JeBBEbv.exe
  C:\Windows\System\JeBBEbv.exe
  2⤵
  PID:7248
- C:\Windows\System\UiJYXtH.exe
  C:\Windows\System\UiJYXtH.exe
  2⤵
  PID:7264
- C:\Windows\System\qeoOQeu.exe
  C:\Windows\System\qeoOQeu.exe
  2⤵
  PID:7284
- C:\Windows\System\xzlOIhs.exe
  C:\Windows\System\xzlOIhs.exe
  2⤵
  PID:7300
- C:\Windows\System\NzYCCpa.exe
  C:\Windows\System\NzYCCpa.exe
  2⤵
  PID:7324
- C:\Windows\System\NWXRzGs.exe
  C:\Windows\System\NWXRzGs.exe
  2⤵
  PID:7344
- C:\Windows\System\DMOPEsm.exe
  C:\Windows\System\DMOPEsm.exe
  2⤵
  PID:7444
- C:\Windows\System\mkeCETi.exe
  C:\Windows\System\mkeCETi.exe
  2⤵
  PID:7464
- C:\Windows\System\HeFfpKz.exe
  C:\Windows\System\HeFfpKz.exe
  2⤵
  PID:7480
- C:\Windows\System\wPOyyMS.exe
  C:\Windows\System\wPOyyMS.exe
  2⤵
  PID:7500
- C:\Windows\System\EIKupVT.exe
  C:\Windows\System\EIKupVT.exe
  2⤵
  PID:7524
- C:\Windows\System\CPvepuq.exe
  C:\Windows\System\CPvepuq.exe
  2⤵
  PID:7540
- C:\Windows\System\TPaPJUo.exe
  C:\Windows\System\TPaPJUo.exe
  2⤵
  PID:7556
- C:\Windows\System\OueoYXN.exe
  C:\Windows\System\OueoYXN.exe
  2⤵
  PID:7572
- C:\Windows\System\muSIGEN.exe
  C:\Windows\System\muSIGEN.exe
  2⤵
  PID:7592
- C:\Windows\System\AAkNbhi.exe
  C:\Windows\System\AAkNbhi.exe
  2⤵
  PID:7608
- C:\Windows\System\MzlLhgq.exe
  C:\Windows\System\MzlLhgq.exe
  2⤵
  PID:7624
- C:\Windows\System\MpVxqqT.exe
  C:\Windows\System\MpVxqqT.exe
  2⤵
  PID:7640
- C:\Windows\System\MVLDpAj.exe
  C:\Windows\System\MVLDpAj.exe
  2⤵
  PID:7656
- C:\Windows\System\ifrYsRQ.exe
  C:\Windows\System\ifrYsRQ.exe
  2⤵
  PID:7672
- C:\Windows\System\pUObVGv.exe
  C:\Windows\System\pUObVGv.exe
  2⤵
  PID:7688
- C:\Windows\System\pvKsdeQ.exe
  C:\Windows\System\pvKsdeQ.exe
  2⤵
  PID:7704
- C:\Windows\System\JndhdvE.exe
  C:\Windows\System\JndhdvE.exe
  2⤵
  PID:7720
- C:\Windows\System\VYwlMQR.exe
  C:\Windows\System\VYwlMQR.exe
  2⤵
  PID:7736
- C:\Windows\System\RbFGSsQ.exe
  C:\Windows\System\RbFGSsQ.exe
  2⤵
  PID:7752
- C:\Windows\System\uydyHFu.exe
  C:\Windows\System\uydyHFu.exe
  2⤵
  PID:7768
- C:\Windows\System\WHrnDTR.exe
  C:\Windows\System\WHrnDTR.exe
  2⤵
  PID:7784
- C:\Windows\System\SRWHeBq.exe
  C:\Windows\System\SRWHeBq.exe
  2⤵
  PID:7800
- C:\Windows\System\SJtZKDg.exe
  C:\Windows\System\SJtZKDg.exe
  2⤵
  PID:7816
- C:\Windows\System\HTzxERZ.exe
  C:\Windows\System\HTzxERZ.exe
  2⤵
  PID:7840
- C:\Windows\System\BpcyrCm.exe
  C:\Windows\System\BpcyrCm.exe
  2⤵
  PID:7856
- C:\Windows\System\YSNbjuW.exe
  C:\Windows\System\YSNbjuW.exe
  2⤵
  PID:7872
- C:\Windows\System\EGjhXgx.exe
  C:\Windows\System\EGjhXgx.exe
  2⤵
  PID:7888
- C:\Windows\System\exnXcCs.exe
  C:\Windows\System\exnXcCs.exe
  2⤵
  PID:8052
- C:\Windows\System\lLrTOMD.exe
  C:\Windows\System\lLrTOMD.exe
  2⤵
  PID:8068
- C:\Windows\System\vcQffDC.exe
  C:\Windows\System\vcQffDC.exe
  2⤵
  PID:6184
- C:\Windows\System\ZEAEOin.exe
  C:\Windows\System\ZEAEOin.exe
  2⤵
  PID:6972
- C:\Windows\System\HRHGtEd.exe
  C:\Windows\System\HRHGtEd.exe
  2⤵
  PID:7192
- C:\Windows\System\qIEnZNx.exe
  C:\Windows\System\qIEnZNx.exe
  2⤵
  PID:7196
- C:\Windows\System\hbISfow.exe
  C:\Windows\System\hbISfow.exe
  2⤵
  PID:6232
- C:\Windows\System\gjpYHCp.exe
  C:\Windows\System\gjpYHCp.exe
  2⤵
  PID:7040
- C:\Windows\System\iwUKgSU.exe
  C:\Windows\System\iwUKgSU.exe
  2⤵
  PID:7296
- C:\Windows\System\ZUPbIbr.exe
  C:\Windows\System\ZUPbIbr.exe
  2⤵
  PID:7208
- C:\Windows\System\ksOQYcX.exe
  C:\Windows\System\ksOQYcX.exe
  2⤵
  PID:7336
- C:\Windows\System\yPgrxtn.exe
  C:\Windows\System\yPgrxtn.exe
  2⤵
  PID:7308
- C:\Windows\System\ukhFPuM.exe
  C:\Windows\System\ukhFPuM.exe
  2⤵
  PID:7352
- C:\Windows\System\aYcZsXJ.exe
  C:\Windows\System\aYcZsXJ.exe
  2⤵
  PID:7392
- C:\Windows\System\kHTQIZc.exe
  C:\Windows\System\kHTQIZc.exe
  2⤵
  PID:7372
- C:\Windows\System\nGYOjFP.exe
  C:\Windows\System\nGYOjFP.exe
  2⤵
  PID:7356
- C:\Windows\System\YZhyJvl.exe
  C:\Windows\System\YZhyJvl.exe
  2⤵
  PID:7420
- C:\Windows\System\lcaZqyP.exe
  C:\Windows\System\lcaZqyP.exe
  2⤵
  PID:7436
- C:\Windows\System\IMlhzmg.exe
  C:\Windows\System\IMlhzmg.exe
  2⤵
  PID:7488
- C:\Windows\System\fvgEgUc.exe
  C:\Windows\System\fvgEgUc.exe
  2⤵
  PID:7496
- C:\Windows\System\OvvKblM.exe
  C:\Windows\System\OvvKblM.exe
  2⤵
  PID:7520
- C:\Windows\System\zDmyVWo.exe
  C:\Windows\System\zDmyVWo.exe
  2⤵
  PID:7632
- C:\Windows\System\zNHDesi.exe
  C:\Windows\System\zNHDesi.exe
  2⤵
  PID:7760
- C:\Windows\System\YBZcSpj.exe
  C:\Windows\System\YBZcSpj.exe
  2⤵
  PID:7824
- C:\Windows\System\OaxWDVg.exe
  C:\Windows\System\OaxWDVg.exe
  2⤵
  PID:7868
- C:\Windows\System\YGjBTrZ.exe
  C:\Windows\System\YGjBTrZ.exe
  2⤵
  PID:7880
- C:\Windows\System\qFARDpo.exe
  C:\Windows\System\qFARDpo.exe
  2⤵
  PID:7808
- C:\Windows\System\FnynKlF.exe
  C:\Windows\System\FnynKlF.exe
  2⤵
  PID:7744
- C:\Windows\System\YdEesoN.exe
  C:\Windows\System\YdEesoN.exe
  2⤵
  PID:7680
- C:\Windows\System\cFRpgio.exe
  C:\Windows\System\cFRpgio.exe
  2⤵
  PID:7580
- C:\Windows\System\TLFFFHI.exe
  C:\Windows\System\TLFFFHI.exe
  2⤵
  PID:7920
- C:\Windows\System\YcimaKy.exe
  C:\Windows\System\YcimaKy.exe
  2⤵
  PID:7940
- C:\Windows\System\LNYNSCN.exe
  C:\Windows\System\LNYNSCN.exe
  2⤵
  PID:7960
- C:\Windows\System\AxLiCpq.exe
  C:\Windows\System\AxLiCpq.exe
  2⤵
  PID:7980
- C:\Windows\System\uUbkbTm.exe
  C:\Windows\System\uUbkbTm.exe
  2⤵
  PID:8008
- C:\Windows\System\XbHUaFg.exe
  C:\Windows\System\XbHUaFg.exe
  2⤵
  PID:8020
- C:\Windows\System\LtNPduf.exe
  C:\Windows\System\LtNPduf.exe
  2⤵
  PID:8076
- C:\Windows\System\zUMlOcw.exe
  C:\Windows\System\zUMlOcw.exe
  2⤵
  PID:8092
- C:\Windows\System\ewBTqim.exe
  C:\Windows\System\ewBTqim.exe
  2⤵
  PID:8108
- C:\Windows\System\gJjqdyd.exe
  C:\Windows\System\gJjqdyd.exe
  2⤵
  PID:8124
- C:\Windows\System\YMQQxiV.exe
  C:\Windows\System\YMQQxiV.exe
  2⤵
  PID:8144
- C:\Windows\System\RGnDitI.exe
  C:\Windows\System\RGnDitI.exe
  2⤵
  PID:8164
- C:\Windows\System\MFbwekC.exe
  C:\Windows\System\MFbwekC.exe
  2⤵
  PID:8180
- C:\Windows\System\DhiroGc.exe
  C:\Windows\System\DhiroGc.exe
  2⤵
  PID:6772
- C:\Windows\System\IBYxoAn.exe
  C:\Windows\System\IBYxoAn.exe
  2⤵
  PID:5800
- C:\Windows\System\ByRMGMp.exe
  C:\Windows\System\ByRMGMp.exe
  2⤵
  PID:6320
- C:\Windows\System\fiqrvbv.exe
  C:\Windows\System\fiqrvbv.exe
  2⤵
  PID:7332
- C:\Windows\System\DfRQssF.exe
  C:\Windows\System\DfRQssF.exe
  2⤵
  PID:7476
- C:\Windows\System\GsWffps.exe
  C:\Windows\System\GsWffps.exe
  2⤵
  PID:7636
- C:\Windows\System\lIoevlS.exe
  C:\Windows\System\lIoevlS.exe
  2⤵
  PID:7728
- C:\Windows\System\ZQbkLJB.exe
  C:\Windows\System\ZQbkLJB.exe
  2⤵
  PID:7864
- C:\Windows\System\NuCdAjC.exe
  C:\Windows\System\NuCdAjC.exe
  2⤵
  PID:7776
- C:\Windows\System\EJQIhSE.exe
  C:\Windows\System\EJQIhSE.exe
  2⤵
  PID:7648
- C:\Windows\System\ekbSTyW.exe
  C:\Windows\System\ekbSTyW.exe
  2⤵
  PID:7684
- C:\Windows\System\eKznyVt.exe
  C:\Windows\System\eKznyVt.exe
  2⤵
  PID:7900
- C:\Windows\System\UTFhRMM.exe
  C:\Windows\System\UTFhRMM.exe
  2⤵
  PID:7948
- C:\Windows\System\vKUVksn.exe
  C:\Windows\System\vKUVksn.exe
  2⤵
  PID:8012
- C:\Windows\System\GPfvIQB.exe
  C:\Windows\System\GPfvIQB.exe
  2⤵
  PID:7968
- C:\Windows\System\DuSPzqZ.exe
  C:\Windows\System\DuSPzqZ.exe
  2⤵
  PID:8132
- C:\Windows\System\cMxIPVh.exe
  C:\Windows\System\cMxIPVh.exe
  2⤵
  PID:8036
- C:\Windows\System\aZtzsvb.exe
  C:\Windows\System\aZtzsvb.exe
  2⤵
  PID:8172
- C:\Windows\System\ZiXyEBP.exe
  C:\Windows\System\ZiXyEBP.exe
  2⤵
  PID:8176
- C:\Windows\System\gxzGmug.exe
  C:\Windows\System\gxzGmug.exe
  2⤵
  PID:8148
- C:\Windows\System\JFUUzuU.exe
  C:\Windows\System\JFUUzuU.exe
  2⤵
  PID:8188
- C:\Windows\System\MBVBjRi.exe
  C:\Windows\System\MBVBjRi.exe
  2⤵
  PID:7312
- C:\Windows\System\WqAbIrS.exe
  C:\Windows\System\WqAbIrS.exe
  2⤵
  PID:7360
- C:\Windows\System\jaUqbDA.exe
  C:\Windows\System\jaUqbDA.exe
  2⤵
  PID:7368
- C:\Windows\System\kCcxNqv.exe
  C:\Windows\System\kCcxNqv.exe
  2⤵
  PID:7404
- C:\Windows\System\pRsrlUw.exe
  C:\Windows\System\pRsrlUw.exe
  2⤵
  PID:7564
- C:\Windows\System\gbPgyBR.exe
  C:\Windows\System\gbPgyBR.exe
  2⤵
  PID:7700
- C:\Windows\System\DCZYMQm.exe
  C:\Windows\System\DCZYMQm.exe
  2⤵
  PID:8080
- C:\Windows\System\DRQIzSd.exe
  C:\Windows\System\DRQIzSd.exe
  2⤵
  PID:6652
- C:\Windows\System\sLOkiLx.exe
  C:\Windows\System\sLOkiLx.exe
  2⤵
  PID:7616
- C:\Windows\System\bIIhLqQ.exe
  C:\Windows\System\bIIhLqQ.exe
  2⤵
  PID:7412
- C:\Windows\System\gEbhnWD.exe
  C:\Windows\System\gEbhnWD.exe
  2⤵
  PID:7492
- C:\Windows\System\LSaAyEH.exe
  C:\Windows\System\LSaAyEH.exe
  2⤵
  PID:8084
- C:\Windows\System\QnByuIw.exe
  C:\Windows\System\QnByuIw.exe
  2⤵
  PID:8048
- C:\Windows\System\pZtmpDd.exe
  C:\Windows\System\pZtmpDd.exe
  2⤵
  PID:8060
- C:\Windows\System\Pvgfbdx.exe
  C:\Windows\System\Pvgfbdx.exe
  2⤵
  PID:7792
- C:\Windows\System\CIwVbbV.exe
  C:\Windows\System\CIwVbbV.exe
  2⤵
  PID:7952
- C:\Windows\System\JtJOUkJ.exe
  C:\Windows\System\JtJOUkJ.exe
  2⤵
  PID:7884
- C:\Windows\System\kXYMLwP.exe
  C:\Windows\System\kXYMLwP.exe
  2⤵
  PID:7696
- C:\Windows\System\HJHKPQJ.exe
  C:\Windows\System\HJHKPQJ.exe
  2⤵
  PID:7812
- C:\Windows\System\EDtGZlp.exe
  C:\Windows\System\EDtGZlp.exe
  2⤵
  PID:8120
- C:\Windows\System\GDpARXh.exe
  C:\Windows\System\GDpARXh.exe
  2⤵
  PID:8044
- C:\Windows\System\BGMZONj.exe
  C:\Windows\System\BGMZONj.exe
  2⤵
  PID:7440
- C:\Windows\System\KnPlYJJ.exe
  C:\Windows\System\KnPlYJJ.exe
  2⤵
  PID:7280
- C:\Windows\System\awZnxNe.exe
  C:\Windows\System\awZnxNe.exe
  2⤵
  PID:7276
- C:\Windows\System\WIoczbG.exe
  C:\Windows\System\WIoczbG.exe
  2⤵
  PID:7932
- C:\Windows\System\dPLrmGx.exe
  C:\Windows\System\dPLrmGx.exe
  2⤵
  PID:8200
- C:\Windows\System\KVgADCw.exe
  C:\Windows\System\KVgADCw.exe
  2⤵
  PID:8224
- C:\Windows\System\zykPoke.exe
  C:\Windows\System\zykPoke.exe
  2⤵
  PID:8240
- C:\Windows\System\OfYAsbl.exe
  C:\Windows\System\OfYAsbl.exe
  2⤵
  PID:8256
- C:\Windows\System\TeOzzqA.exe
  C:\Windows\System\TeOzzqA.exe
  2⤵
  PID:8272
- C:\Windows\System\sPLPZti.exe
  C:\Windows\System\sPLPZti.exe
  2⤵
  PID:8288
- C:\Windows\System\OdmfNvq.exe
  C:\Windows\System\OdmfNvq.exe
  2⤵
  PID:8304
- C:\Windows\System\CSYgZWD.exe
  C:\Windows\System\CSYgZWD.exe
  2⤵
  PID:8324
- C:\Windows\System\MGpScYf.exe
  C:\Windows\System\MGpScYf.exe
  2⤵
  PID:8340
- C:\Windows\System\CyCxQpr.exe
  C:\Windows\System\CyCxQpr.exe
  2⤵
  PID:8420
- C:\Windows\System\cYrADNo.exe
  C:\Windows\System\cYrADNo.exe
  2⤵
  PID:8436
- C:\Windows\System\efBaHMb.exe
  C:\Windows\System\efBaHMb.exe
  2⤵
  PID:8452
- C:\Windows\System\jtfxFbo.exe
  C:\Windows\System\jtfxFbo.exe
  2⤵
  PID:8468
- C:\Windows\System\UGXMnCO.exe
  C:\Windows\System\UGXMnCO.exe
  2⤵
  PID:8484
- C:\Windows\System\KfDyxvw.exe
  C:\Windows\System\KfDyxvw.exe
  2⤵
  PID:8500
- C:\Windows\System\LmzwCbH.exe
  C:\Windows\System\LmzwCbH.exe
  2⤵
  PID:8520
- C:\Windows\System\YDnHvTm.exe
  C:\Windows\System\YDnHvTm.exe
  2⤵
  PID:8540
- C:\Windows\System\qMtUgZE.exe
  C:\Windows\System\qMtUgZE.exe
  2⤵
  PID:8556
- C:\Windows\System\EMLJKvw.exe
  C:\Windows\System\EMLJKvw.exe
  2⤵
  PID:8572
- C:\Windows\System\xYZpTii.exe
  C:\Windows\System\xYZpTii.exe
  2⤵
  PID:8588
- C:\Windows\System\UUkjomk.exe
  C:\Windows\System\UUkjomk.exe
  2⤵
  PID:8608
- C:\Windows\System\MsOljxM.exe
  C:\Windows\System\MsOljxM.exe
  2⤵
  PID:8624
- C:\Windows\System\odgSSGQ.exe
  C:\Windows\System\odgSSGQ.exe
  2⤵
  PID:8640
- C:\Windows\System\HgMEuPU.exe
  C:\Windows\System\HgMEuPU.exe
  2⤵
  PID:8672
- C:\Windows\System\THjtDMh.exe
  C:\Windows\System\THjtDMh.exe
  2⤵
  PID:8696
- C:\Windows\System\xefaDJk.exe
  C:\Windows\System\xefaDJk.exe
  2⤵
  PID:8712
- C:\Windows\System\ohXmgfE.exe
  C:\Windows\System\ohXmgfE.exe
  2⤵
  PID:8728
- C:\Windows\System\BXdhBiV.exe
  C:\Windows\System\BXdhBiV.exe
  2⤵
  PID:8772
- C:\Windows\System\tVZImkS.exe
  C:\Windows\System\tVZImkS.exe
  2⤵
  PID:8788
- C:\Windows\System\McsKouG.exe
  C:\Windows\System\McsKouG.exe
  2⤵
  PID:8804
- C:\Windows\System\pyfvcUV.exe
  C:\Windows\System\pyfvcUV.exe
  2⤵
  PID:8820
- C:\Windows\System\MbAiMyO.exe
  C:\Windows\System\MbAiMyO.exe
  2⤵
  PID:8840
- C:\Windows\System\oBqAhyS.exe
  C:\Windows\System\oBqAhyS.exe
  2⤵
  PID:8856
- C:\Windows\System\BluBBib.exe
  C:\Windows\System\BluBBib.exe
  2⤵
  PID:8876
- C:\Windows\System\dlKBauK.exe
  C:\Windows\System\dlKBauK.exe
  2⤵
  PID:8896
- C:\Windows\System\WrdFYPC.exe
  C:\Windows\System\WrdFYPC.exe
  2⤵
  PID:8912
- C:\Windows\System\oJKcUMr.exe
  C:\Windows\System\oJKcUMr.exe
  2⤵
  PID:8928
- C:\Windows\System\GiEWUXW.exe
  C:\Windows\System\GiEWUXW.exe
  2⤵
  PID:8944
- C:\Windows\System\fcLkUmI.exe
  C:\Windows\System\fcLkUmI.exe
  2⤵
  PID:8964
- C:\Windows\System\zOvqoKf.exe
  C:\Windows\System\zOvqoKf.exe
  2⤵
  PID:8980
- C:\Windows\System\IXiTOzJ.exe
  C:\Windows\System\IXiTOzJ.exe
  2⤵
  PID:8996
- C:\Windows\System\PlJEEjg.exe
  C:\Windows\System\PlJEEjg.exe
  2⤵
  PID:9016
- C:\Windows\System\TJlRhps.exe
  C:\Windows\System\TJlRhps.exe
  2⤵
  PID:9032
- C:\Windows\System\dRkXdIA.exe
  C:\Windows\System\dRkXdIA.exe
  2⤵
  PID:9048
- C:\Windows\System\xvursIy.exe
  C:\Windows\System\xvursIy.exe
  2⤵
  PID:9112
- C:\Windows\System\kwsFxRF.exe
  C:\Windows\System\kwsFxRF.exe
  2⤵
  PID:9140
- C:\Windows\System\wrFfzIO.exe
  C:\Windows\System\wrFfzIO.exe
  2⤵
  PID:9156
- C:\Windows\System\doRPeUE.exe
  C:\Windows\System\doRPeUE.exe
  2⤵
  PID:9172
- C:\Windows\System\XmPsCuu.exe
  C:\Windows\System\XmPsCuu.exe
  2⤵
  PID:9188
- C:\Windows\System\DmNccaH.exe
  C:\Windows\System\DmNccaH.exe
  2⤵
  PID:9204
- C:\Windows\System\bNZGorK.exe
  C:\Windows\System\bNZGorK.exe
  2⤵
  PID:7896
- C:\Windows\System\zFzbdrt.exe
  C:\Windows\System\zFzbdrt.exe
  2⤵
  PID:8220
- C:\Windows\System\XiiOEUT.exe
  C:\Windows\System\XiiOEUT.exe
  2⤵
  PID:7400
- C:\Windows\System\hDgbxvH.exe
  C:\Windows\System\hDgbxvH.exe
  2⤵
  PID:8024
- C:\Windows\System\oUZNIzl.exe
  C:\Windows\System\oUZNIzl.exe
  2⤵
  PID:8152
- C:\Windows\System\CJhbMzA.exe
  C:\Windows\System\CJhbMzA.exe
  2⤵
  PID:8216
- C:\Windows\System\NBkXjvR.exe
  C:\Windows\System\NBkXjvR.exe
  2⤵
  PID:8320
- C:\Windows\System\SvyBEZn.exe
  C:\Windows\System\SvyBEZn.exe
  2⤵
  PID:8360
- C:\Windows\System\tJSmIBI.exe
  C:\Windows\System\tJSmIBI.exe
  2⤵
  PID:8388
- C:\Windows\System\AahvqWi.exe
  C:\Windows\System\AahvqWi.exe
  2⤵
  PID:7992
- C:\Windows\System\aWGWQbZ.exe
  C:\Windows\System\aWGWQbZ.exe
  2⤵
  PID:8232
- C:\Windows\System\HwWkKTQ.exe
  C:\Windows\System\HwWkKTQ.exe
  2⤵
  PID:8300
- C:\Windows\System\trxKoWd.exe
  C:\Windows\System\trxKoWd.exe
  2⤵
  PID:8428
- C:\Windows\System\MrMbVJT.exe
  C:\Windows\System\MrMbVJT.exe
  2⤵
  PID:8448
- C:\Windows\System\kvcSprf.exe
  C:\Windows\System\kvcSprf.exe
  2⤵
  PID:8496
- C:\Windows\System\xHpespP.exe
  C:\Windows\System\xHpespP.exe
  2⤵
  PID:8580
- C:\Windows\System\AnMuvjh.exe
  C:\Windows\System\AnMuvjh.exe
  2⤵
  PID:8516
- C:\Windows\System\KtNOQHS.exe
  C:\Windows\System\KtNOQHS.exe
  2⤵
  PID:8536
- C:\Windows\System\bpASnaT.exe
  C:\Windows\System\bpASnaT.exe
  2⤵
  PID:8632
- C:\Windows\System\jygwVZp.exe
  C:\Windows\System\jygwVZp.exe
  2⤵
  PID:8648
- C:\Windows\System\QBsJXJr.exe
  C:\Windows\System\QBsJXJr.exe
  2⤵
  PID:8668
- C:\Windows\System\jXVpjpm.exe
  C:\Windows\System\jXVpjpm.exe
  2⤵
  PID:8744
- C:\Windows\System\FvRPBgU.exe
  C:\Windows\System\FvRPBgU.exe
  2⤵
  PID:8760
- C:\Windows\System\yalbGln.exe
  C:\Windows\System\yalbGln.exe
  2⤵
  PID:8740
- C:\Windows\System\VWcvbjj.exe
  C:\Windows\System\VWcvbjj.exe
  2⤵
  PID:8688
- C:\Windows\System\DrckNgj.exe
  C:\Windows\System\DrckNgj.exe
  2⤵
  PID:8780
- C:\Windows\System\fAHjiuP.exe
  C:\Windows\System\fAHjiuP.exe
  2⤵
  PID:8972
- C:\Windows\System\DwgyEcP.exe
  C:\Windows\System\DwgyEcP.exe
  2⤵
  PID:8956
- C:\Windows\System\WBiRQuT.exe
  C:\Windows\System\WBiRQuT.exe
  2⤵
  PID:8892
- C:\Windows\System\NWOXEPs.exe
  C:\Windows\System\NWOXEPs.exe
  2⤵
  PID:8992
- C:\Windows\System\IKqczhA.exe
  C:\Windows\System\IKqczhA.exe
  2⤵
  PID:9064
- C:\Windows\System\PfLtrRY.exe
  C:\Windows\System\PfLtrRY.exe
  2⤵
  PID:9120
- C:\Windows\System\kplJMzm.exe
  C:\Windows\System\kplJMzm.exe
  2⤵
  PID:9136
- C:\Windows\System\yqpSpmN.exe
  C:\Windows\System\yqpSpmN.exe
  2⤵
  PID:9200
- C:\Windows\System\GOUokwy.exe
  C:\Windows\System\GOUokwy.exe
  2⤵
  PID:8352
- C:\Windows\System\SUFeHJG.exe
  C:\Windows\System\SUFeHJG.exe
  2⤵
  PID:8212
- C:\Windows\System\mHpXoQA.exe
  C:\Windows\System\mHpXoQA.exe
  2⤵
  PID:8336
- C:\Windows\System\EVHvXcq.exe
  C:\Windows\System\EVHvXcq.exe
  2⤵
  PID:8376
- C:\Windows\System\awUVTXI.exe
  C:\Windows\System\awUVTXI.exe
  2⤵
  PID:6020
- C:\Windows\System\oEAeZXy.exe
  C:\Windows\System\oEAeZXy.exe
  2⤵
  PID:8704
- C:\Windows\System\jCFVBaN.exe
  C:\Windows\System\jCFVBaN.exe
  2⤵
  PID:8764
- C:\Windows\System\fvpeUTz.exe
  C:\Windows\System\fvpeUTz.exe
  2⤵
  PID:9004
- C:\Windows\System\dkbEjZA.exe
  C:\Windows\System\dkbEjZA.exe
  2⤵
  PID:8616
- C:\Windows\System\zUNUVRb.exe
  C:\Windows\System\zUNUVRb.exe
  2⤵
  PID:8736
- C:\Windows\System\DsbWKqO.exe
  C:\Windows\System\DsbWKqO.exe
  2⤵
  PID:8384
- C:\Windows\System\toMVsrs.exe
  C:\Windows\System\toMVsrs.exe
  2⤵
  PID:7956
- C:\Windows\System\YjLJmJv.exe
  C:\Windows\System\YjLJmJv.exe
  2⤵
  PID:8416
- C:\Windows\System\iGfCdJb.exe
  C:\Windows\System\iGfCdJb.exe
  2⤵
  PID:8512
- C:\Windows\System\eGUlaWI.exe
  C:\Windows\System\eGUlaWI.exe
  2⤵
  PID:8664
- C:\Windows\System\kgwDEUd.exe
  C:\Windows\System\kgwDEUd.exe
  2⤵
  PID:7320
- C:\Windows\System\LQSBFtt.exe
  C:\Windows\System\LQSBFtt.exe
  2⤵
  PID:8752
- C:\Windows\System\WHEyCNO.exe
  C:\Windows\System\WHEyCNO.exe
  2⤵
  PID:8864
- C:\Windows\System\WBNfQqd.exe
  C:\Windows\System\WBNfQqd.exe
  2⤵
  PID:8908
- C:\Windows\System\QAeAaXK.exe
  C:\Windows\System\QAeAaXK.exe
  2⤵
  PID:9040
- C:\Windows\System\YbIsHEl.exe
  C:\Windows\System\YbIsHEl.exe
  2⤵
  PID:9108
- C:\Windows\System\TBWrLlD.exe
  C:\Windows\System\TBWrLlD.exe
  2⤵
  PID:9084
- C:\Windows\System\CWuOPXo.exe
  C:\Windows\System\CWuOPXo.exe
  2⤵
  PID:9104
- C:\Windows\System\XLikYmI.exe
  C:\Windows\System\XLikYmI.exe
  2⤵
  PID:9196
- C:\Windows\System\TgagXOH.exe
  C:\Windows\System\TgagXOH.exe
  2⤵
  PID:7432
- C:\Windows\System\yRyDSXR.exe
  C:\Windows\System\yRyDSXR.exe
  2⤵
  PID:7600
- C:\Windows\System\HQaLGfc.exe
  C:\Windows\System\HQaLGfc.exe
  2⤵
  PID:8564
- C:\Windows\System\pSsQDkS.exe
  C:\Windows\System\pSsQDkS.exe
  2⤵
  PID:8528
- C:\Windows\System\oglzQIF.exe
  C:\Windows\System\oglzQIF.exe
  2⤵
  PID:8280
- C:\Windows\System\WMPxaWo.exe
  C:\Windows\System\WMPxaWo.exe
  2⤵
  PID:7460
- C:\Windows\System\HaVrbwz.exe
  C:\Windows\System\HaVrbwz.exe
  2⤵
  PID:8884
- C:\Windows\System\jrAgQDu.exe
  C:\Windows\System\jrAgQDu.exe
  2⤵
  PID:8368
- C:\Windows\System\ZFVswDY.exe
  C:\Windows\System\ZFVswDY.exe
  2⤵
  PID:8660
- C:\Windows\System\wRbLXVq.exe
  C:\Windows\System\wRbLXVq.exe
  2⤵
  PID:8868
- C:\Windows\System\vXmMTEh.exe
  C:\Windows\System\vXmMTEh.exe
  2⤵
  PID:9096
- C:\Windows\System\LWmvVSS.exe
  C:\Windows\System\LWmvVSS.exe
  2⤵
  PID:8196
- C:\Windows\System\DifXPUr.exe
  C:\Windows\System\DifXPUr.exe
  2⤵
  PID:8412
- C:\Windows\System\ZCGOmtl.exe
  C:\Windows\System\ZCGOmtl.exe
  2⤵
  PID:9012
- C:\Windows\System\NYpMYIC.exe
  C:\Windows\System\NYpMYIC.exe
  2⤵
  PID:8600
- C:\Windows\System\LAIWTOn.exe
  C:\Windows\System\LAIWTOn.exe
  2⤵
  PID:9152
- C:\Windows\System\kXFuUrN.exe
  C:\Windows\System\kXFuUrN.exe
  2⤵
  PID:8848
- C:\Windows\System\xEAPrCb.exe
  C:\Windows\System\xEAPrCb.exe
  2⤵
  PID:1020
- C:\Windows\System\aMjMash.exe
  C:\Windows\System\aMjMash.exe
  2⤵
  PID:9092
- C:\Windows\System\LTghRZq.exe
  C:\Windows\System\LTghRZq.exe
  2⤵
  PID:9132
- C:\Windows\System\MiBwHUo.exe
  C:\Windows\System\MiBwHUo.exe
  2⤵
  PID:7452
- C:\Windows\System\smWVToY.exe
  C:\Windows\System\smWVToY.exe
  2⤵
  PID:9228
- C:\Windows\System\NeUSAAn.exe
  C:\Windows\System\NeUSAAn.exe
  2⤵
  PID:9244
- C:\Windows\System\TBGIkxj.exe
  C:\Windows\System\TBGIkxj.exe
  2⤵
  PID:9264
- C:\Windows\System\xFGMFxt.exe
  C:\Windows\System\xFGMFxt.exe
  2⤵
  PID:9280
- C:\Windows\System\nwTehRk.exe
  C:\Windows\System\nwTehRk.exe
  2⤵
  PID:9296
- C:\Windows\System\RINyBoc.exe
  C:\Windows\System\RINyBoc.exe
  2⤵
  PID:9312
- C:\Windows\System\tOSZSwB.exe
  C:\Windows\System\tOSZSwB.exe
  2⤵
  PID:9328
- C:\Windows\System\MrnTKBD.exe
  C:\Windows\System\MrnTKBD.exe
  2⤵
  PID:9348
- C:\Windows\System\auIAmRR.exe
  C:\Windows\System\auIAmRR.exe
  2⤵
  PID:9364
- C:\Windows\System\lZJzEpx.exe
  C:\Windows\System\lZJzEpx.exe
  2⤵
  PID:9380
- C:\Windows\System\hnabaMU.exe
  C:\Windows\System\hnabaMU.exe
  2⤵
  PID:9396
- C:\Windows\System\WDDjMzp.exe
  C:\Windows\System\WDDjMzp.exe
  2⤵
  PID:9412
- C:\Windows\System\wArccaN.exe
  C:\Windows\System\wArccaN.exe
  2⤵
  PID:9428
- C:\Windows\System\PFcNzpj.exe
  C:\Windows\System\PFcNzpj.exe
  2⤵
  PID:9444
- C:\Windows\System\MmFTIfX.exe
  C:\Windows\System\MmFTIfX.exe
  2⤵
  PID:9460
- C:\Windows\System\WeHQclr.exe
  C:\Windows\System\WeHQclr.exe
  2⤵
  PID:9476
- C:\Windows\System\YsputFz.exe
  C:\Windows\System\YsputFz.exe
  2⤵
  PID:9496
- C:\Windows\System\wyXDVKH.exe
  C:\Windows\System\wyXDVKH.exe
  2⤵
  PID:9588
- C:\Windows\System\eXXPcuU.exe
  C:\Windows\System\eXXPcuU.exe
  2⤵
  PID:9604
- C:\Windows\System\MxEnBYu.exe
  C:\Windows\System\MxEnBYu.exe
  2⤵
  PID:9620
- C:\Windows\System\iAPwTid.exe
  C:\Windows\System\iAPwTid.exe
  2⤵
  PID:9636
- C:\Windows\System\ecMpKfk.exe
  C:\Windows\System\ecMpKfk.exe
  2⤵
  PID:9660
- C:\Windows\System\gzXsmwQ.exe
  C:\Windows\System\gzXsmwQ.exe
  2⤵
  PID:9676
- C:\Windows\System\LxpIvkV.exe
  C:\Windows\System\LxpIvkV.exe
  2⤵
  PID:9696
- C:\Windows\System\OAOskpH.exe
  C:\Windows\System\OAOskpH.exe
  2⤵
  PID:9712
- C:\Windows\System\FfEmZxs.exe
  C:\Windows\System\FfEmZxs.exe
  2⤵
  PID:9728
- C:\Windows\System\XLvuLWB.exe
  C:\Windows\System\XLvuLWB.exe
  2⤵
  PID:9748
- C:\Windows\System\XIjvCVe.exe
  C:\Windows\System\XIjvCVe.exe
  2⤵
  PID:9764
- C:\Windows\System\pgbnXFt.exe
  C:\Windows\System\pgbnXFt.exe
  2⤵
  PID:9780
- C:\Windows\System\jFWpIhl.exe
  C:\Windows\System\jFWpIhl.exe
  2⤵
  PID:9796
- C:\Windows\System\BrVeHzh.exe
  C:\Windows\System\BrVeHzh.exe
  2⤵
  PID:9812
- C:\Windows\System\BgbdWdW.exe
  C:\Windows\System\BgbdWdW.exe
  2⤵
  PID:9828
- C:\Windows\System\XjxwPzu.exe
  C:\Windows\System\XjxwPzu.exe
  2⤵
  PID:9848
- C:\Windows\System\fZiSslG.exe
  C:\Windows\System\fZiSslG.exe
  2⤵
  PID:9864
- C:\Windows\System\cICBfuB.exe
  C:\Windows\System\cICBfuB.exe
  2⤵
  PID:9880
- C:\Windows\System\eVPHziW.exe
  C:\Windows\System\eVPHziW.exe
  2⤵
  PID:9896
- C:\Windows\System\XiTWzEJ.exe
  C:\Windows\System\XiTWzEJ.exe
  2⤵
  PID:9916
- C:\Windows\System\AGFPTQL.exe
  C:\Windows\System\AGFPTQL.exe
  2⤵
  PID:10040
- C:\Windows\System\iACEqzI.exe
  C:\Windows\System\iACEqzI.exe
  2⤵
  PID:10168
- C:\Windows\System\anIkwWJ.exe
  C:\Windows\System\anIkwWJ.exe
  2⤵
  PID:10188
- C:\Windows\System\TWUpMic.exe
  C:\Windows\System\TWUpMic.exe
  2⤵
  PID:10204
- C:\Windows\System\UzjmDMX.exe
  C:\Windows\System\UzjmDMX.exe
  2⤵
  PID:10220
- C:\Windows\System\WNHprNZ.exe
  C:\Windows\System\WNHprNZ.exe
  2⤵
  PID:9212
- C:\Windows\System\XqqrEbK.exe
  C:\Windows\System\XqqrEbK.exe
  2⤵
  PID:9408
- C:\Windows\System\WiLRiaN.exe
  C:\Windows\System\WiLRiaN.exe
  2⤵
  PID:9472
- C:\Windows\System\LsQbtrq.exe
  C:\Windows\System\LsQbtrq.exe
  2⤵
  PID:9372
- C:\Windows\System\pOEcCTm.exe
  C:\Windows\System\pOEcCTm.exe
  2⤵
  PID:9288
- C:\Windows\System\qgiRmCc.exe
  C:\Windows\System\qgiRmCc.exe
  2⤵
  PID:9356
- C:\Windows\System\ZAGsbFV.exe
  C:\Windows\System\ZAGsbFV.exe
  2⤵
  PID:9424
- C:\Windows\System\GguPNNU.exe
  C:\Windows\System\GguPNNU.exe
  2⤵
  PID:9488
- C:\Windows\System\GMLNOgc.exe
  C:\Windows\System\GMLNOgc.exe
  2⤵
  PID:9528
- C:\Windows\System\mBjgGFo.exe
  C:\Windows\System\mBjgGFo.exe
  2⤵
  PID:9552
- C:\Windows\System\leIHINt.exe
  C:\Windows\System\leIHINt.exe
  2⤵
  PID:9560
- C:\Windows\System\UetkriR.exe
  C:\Windows\System\UetkriR.exe
  2⤵
  PID:9576
- C:\Windows\System\LlkZkrT.exe
  C:\Windows\System\LlkZkrT.exe
  2⤵
  PID:9632
- C:\Windows\System\HmhKflp.exe
  C:\Windows\System\HmhKflp.exe
  2⤵
  PID:9644
- C:\Windows\System\vHupCMV.exe
  C:\Windows\System\vHupCMV.exe
  2⤵
  PID:9616
- C:\Windows\System\GwfwXuT.exe
  C:\Windows\System\GwfwXuT.exe
  2⤵
  PID:9684
- C:\Windows\System\bVxMUTG.exe
  C:\Windows\System\bVxMUTG.exe
  2⤵
  PID:9708
- C:\Windows\System\kNBItDc.exe
  C:\Windows\System\kNBItDc.exe
  2⤵
  PID:9876
- C:\Windows\System\GLgFkCY.exe
  C:\Windows\System\GLgFkCY.exe
  2⤵
  PID:9788
- C:\Windows\System\NhzvQAh.exe
  C:\Windows\System\NhzvQAh.exe
  2⤵
  PID:9856
- C:\Windows\System\ZpNJqxU.exe
  C:\Windows\System\ZpNJqxU.exe
  2⤵
  PID:9924
- C:\Windows\System\uhQTtnr.exe
  C:\Windows\System\uhQTtnr.exe
  2⤵
  PID:9944
- C:\Windows\System\CicjEGg.exe
  C:\Windows\System\CicjEGg.exe
  2⤵
  PID:9960
- C:\Windows\System\pxIRXVk.exe
  C:\Windows\System\pxIRXVk.exe
  2⤵
  PID:9984
- C:\Windows\System\FAtqvzJ.exe
  C:\Windows\System\FAtqvzJ.exe
  2⤵
  PID:10000
- C:\Windows\System\YnNXsTZ.exe
  C:\Windows\System\YnNXsTZ.exe
  2⤵
  PID:10024
- C:\Windows\System\hFJUAvd.exe
  C:\Windows\System\hFJUAvd.exe
  2⤵
  PID:10056
- C:\Windows\System\nPFsGBK.exe
  C:\Windows\System\nPFsGBK.exe
  2⤵
  PID:10072
- C:\Windows\System\SCIXTlW.exe
  C:\Windows\System\SCIXTlW.exe
  2⤵
  PID:10088
- C:\Windows\System\latELMx.exe
  C:\Windows\System\latELMx.exe
  2⤵
  PID:10104
- C:\Windows\System\BUVagwC.exe
  C:\Windows\System\BUVagwC.exe
  2⤵
  PID:10120
- C:\Windows\System\uBneSGx.exe
  C:\Windows\System\uBneSGx.exe
  2⤵
  PID:10144
- C:\Windows\System\aWGGLNJ.exe
  C:\Windows\System\aWGGLNJ.exe
  2⤵
  PID:10160
- C:\Windows\System\kUwJUEd.exe
  C:\Windows\System\kUwJUEd.exe
  2⤵
  PID:10200
- C:\Windows\System\vgdCAWA.exe
  C:\Windows\System\vgdCAWA.exe
  2⤵
  PID:9220
- C:\Windows\System\mggxKOY.exe
  C:\Windows\System\mggxKOY.exe
  2⤵
  PID:10180
- C:\Windows\System\ykmKmls.exe
  C:\Windows\System\ykmKmls.exe
  2⤵
  PID:8836
- C:\Windows\System\dMHdnaD.exe
  C:\Windows\System\dMHdnaD.exe
  2⤵
  PID:9088
- C:\Windows\System\MbgMYLJ.exe
  C:\Windows\System\MbgMYLJ.exe
  2⤵
  PID:9340
- C:\Windows\System\fVaXLty.exe
  C:\Windows\System\fVaXLty.exe
  2⤵
  PID:9060
- C:\Windows\System\TAUhuYB.exe
  C:\Windows\System\TAUhuYB.exe
  2⤵
  PID:9240
- C:\Windows\System\NOhwAEd.exe
  C:\Windows\System\NOhwAEd.exe
  2⤵
  PID:9076
- C:\Windows\System\fzUTSck.exe
  C:\Windows\System\fzUTSck.exe
  2⤵
  PID:9456
- C:\Windows\System\LEuqncp.exe
  C:\Windows\System\LEuqncp.exe
  2⤵
  PID:9572
- C:\Windows\System\AaDPyjP.exe
  C:\Windows\System\AaDPyjP.exe
  2⤵
  PID:9584
- C:\Windows\System\eJUQjel.exe
  C:\Windows\System\eJUQjel.exe
  2⤵
  PID:8316
- C:\Windows\System\MpJYhNj.exe
  C:\Windows\System\MpJYhNj.exe
  2⤵
  PID:9420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AmTHoss.exe

Filesize
2.3MB

MD5
3ddb6d87dfe5dab74f0d845ea9d83db4

SHA1
b2a52a6c84e1e0dc567eb03d017947a2101f261e

SHA256
831775edc85873db887ec67a4d6a9d50fa100ce1c7fbeb72d6b95a2003d4ab2e

SHA512
efa76289909f9f450d73b41805eca9372a118a15d6920b811b1f8e51df898d73fa94746ce528d01f16409cb2efc9dcf264bb1910843fba3fa48391146d782ae5

Download Submit
C:\Windows\system\CdYXFvD.exe

Filesize
2.3MB

MD5
56a4843e2d1770fc2ccd3eecd7ece3b1

SHA1
d6b10bffd80330865f599045dba0f68bd4deb9ab

SHA256
6c5e9056d3d39b04a0f151c3c1f745b099da03df8f2b6f111171866f818e2ae9

SHA512
998e611d42b2e3babc76fe43f885a3a9de7742792c19d840e2b802e4862d1a2c0ac5c86e3a2ee7d1f10fe936683ce5dd187e5761c491fbad458830a1835a4e5d

Download Submit
C:\Windows\system\CsonhJP.exe

Filesize
2.3MB

MD5
6bed8852f4f1e06f6cfd50c1b780bdb9

SHA1
2dcf18f1dbfcc0444c98da3b656c5652384f052c

SHA256
011e333bed0d5921e2c3e1c03a6395ef7b6a701ccfda2c0447010567569a66f6

SHA512
fd497fc1846e8c6fc264ecb24bf10bc7a33876de80b22715798ead876c06de0b2edd782a06a66bf3388659d967fe0978936ecb472cd9d0f386f531ea52048fa7

Download Submit
C:\Windows\system\FGAJQkA.exe

Filesize
2.3MB

MD5
3eecc5861c45201040a8a951e295e46d

SHA1
d3b9149dd5453a2de63702c8394d77692f4448ea

SHA256
c141a49ff884755f9c6837b536f44a01eade85f3538a10898967c3ea312a60e8

SHA512
6aa8cf1499f5beee037b691a09ec08a463d9011f895012637e5c672d29c3a70b7fe4b05f5ab4cd7a50f68df8ab15d74073bff1bc9d707b692e01968150045c82

Download Submit
C:\Windows\system\GHFkwsE.exe

Filesize
2.3MB

MD5
48cca92e31a5fdbb1d2a9d14bb69d45c

SHA1
a784b8b680894a797ffa73be2a7b4d51c2f7242c

SHA256
482f73e65a4f948e8de3a05ea25566d92572125c8f0d8c68f8e03c4e6d0837ba

SHA512
7308a89c6de5be716a9295e3f01ae074fe36b6c99f2eaf43436c5c1f7418b94c8c2d230688195612b90fb5075b3f7952e1785eb7f64231eaba7ee10f8e5d8296

Download Submit
C:\Windows\system\IMOiWWc.exe

Filesize
2.3MB

MD5
38bb2812f1e7391fb211f90b8d8a52bd

SHA1
569a53d6921225d0695647ef31ab72125ba19740

SHA256
0c9d22c4171f1f3003d32f142fab66f8edc277c264c45269ef2b0bb47fe6b169

SHA512
e1bc1c760e076072b77d1253852c47649dc6e3deb5e764baf6a16422ae7e4bb32dfc2fc2fa0816c8bebd4b44c8d2f207c12b78fe614311d211629c8fa94eabb9

Download Submit
C:\Windows\system\LuTnWKz.exe

Filesize
2.3MB

MD5
e39252ba02f03e8be72e5b8734038ae3

SHA1
9db0db75bbeee0f6eb9de1bb38bb40e1c9a34b56

SHA256
5418bbc2564fc7435bc100b326eae4818d3bfd838f86334c12f575151054b84b

SHA512
4abb458f4eefd927d60719817742cb2bd18917d14a824e5c1e946761f71701869d86e2c25335e49f417c36f82da02655d20af28aa1d970700b4f4e2dc727db4f

Download Submit
C:\Windows\system\MFWzYBe.exe

Filesize
2.3MB

MD5
f742efc53d074328c4a3f902dd56844a

SHA1
12011d18857bd0a1b2e6c68a308b4c28ca794b3a

SHA256
1c359af3c88f9c058f0c35ed70dacbc3ff53c6d93c5ea497768b79372e3f8aa8

SHA512
c0f7de1d1cd27fef8da638f8b4474fe284fef174ade6851005ef2c3991dd824c7508e796bdd813e34c43ca0be5349229938ca94a1477f14cddf625c51d637bcb

Download Submit
C:\Windows\system\NJbqAXt.exe

Filesize
2.3MB

MD5
85c86d024871cec15456f4e9dd8d98b8

SHA1
5e2c1047d03c7b42dc1d0755228a66563d79bff8

SHA256
2f7c7c387eab5459d59988defdd53e312d1d5b9ae4d0cb49586e719236957c22

SHA512
651a3889293de508c640b8099230204047086747e691b95655f1177fc57637076be22584fb2f786fbad67bdc9efc5d7bf7b7f261fb69cc09543ca6b28a50b8f7

Download Submit
C:\Windows\system\NmSpzdP.exe

Filesize
2.3MB

MD5
dbc0f6e2ed9ed4ef0c3a4ecaa5984555

SHA1
cded192712b743a2459b44f4ca871b7fc99a9162

SHA256
b747dab7c50e4e40fa56c71c076849815fee40290b0ad43ca95db4ede9ae4ec7

SHA512
1587d54e823842a60469626135e5ddca4dc02adc276333c4d4739c6b134dd2e063f4bab57fdc097d18734d0c47b179789bc4795676dadb0ec1882a97d294b128

Download Submit
C:\Windows\system\QlntqHR.exe

Filesize
2.3MB

MD5
75842fb5ee7b7b1a153bb0a78af69f6d

SHA1
f6344e7e9c80abb58cdcc19c4e3e4c05b232b096

SHA256
df357bef6bd1e6e2162da8dc686f86fa50b39946b2b76ba3927f06d51efc3f78

SHA512
2a597fe487956529a2a7d954a42541bd40782b02179d22a54aaeede5712b261e84270a04d29a21d9ac8d3d01f6c2736795927f348ca854034a238e197d980b81

Download Submit
C:\Windows\system\WaZKXQt.exe

Filesize
2.3MB

MD5
c59925ebfa33060c1a33ce4ccb16537d

SHA1
3bd4ee3e34f5308f67cc5b9d6d67b629f24bc51e

SHA256
475036d8bd0d61c13e777da11f41bf2b10696b648f2a64284c8e880c26fb6baf

SHA512
c14b76e0d2c67a79e2537102ffde1900fc1409d4a5ea3b5ed4ce9e53a2cf996d7c5f91d15fd84658e22063b50dd349bea9b9f8b32351889268520196f8113a83

Download Submit
C:\Windows\system\YvzvpCB.exe

Filesize
2.3MB

MD5
39148078fd55e12a224f4ac5f35cdb38

SHA1
6d0f53f5a2eead428efa6cfd35ee117e47dd6229

SHA256
c1dd27f1a9edbe9b31a7e3ede17e6c444d8407943140e9e87e5f00d657098a81

SHA512
2cc866a345f9a25a1b72d72d570539cc689f7c4500e7f859d238300604d1d46f247f81c7925e977f923f51dd3acd2509b2e3c873dd37982b560bdea98b5a296a

Download Submit
C:\Windows\system\bOJynLB.exe

Filesize
2.3MB

MD5
40dab1d055f60d6a176feb51a94582d7

SHA1
858f6912ea038bda2ec1842ac49f8579a3c729a2

SHA256
c0a511d9ab919518789768f6d5622b4b993b078377c2834193058d32d3d57e7a

SHA512
ba0a6984a2054e1df94887639d2d227042d651972ae974ee0bf9e1e1b10388825531550bcf0a33774d856432b472dc00dacbd08f68f90a38c593bf4704be91f4

Download Submit
C:\Windows\system\cjEIMyb.exe

Filesize
2.3MB

MD5
187947ea15be7a8088a0b2f788f8c06f

SHA1
0297042fed46c1f51678e2c5f55c1f8023f16201

SHA256
63cd2d5c50f5bdb966bf7d1e4c5beb6e9bd9781066319329e30afd0d5153603e

SHA512
64c5390ffe86d3d750778d3ca8609c1e6974df1703e739dc1b8a391c55007650f15dd133f14959d1bb16d15b2536aeb35e025f471cff61b7a2615f120abdb979

Download Submit
C:\Windows\system\ckAODHW.exe

Filesize
2.3MB

MD5
a4f38485fc905544386fcc173c68994e

SHA1
386b502ed74e298c4bb934624b5b2e53aeb78b37

SHA256
1ffabb58c2dad9e02e3b8b8c1d75b9f0f9cfb227f7c731c5e52253de45c4d508

SHA512
85199d6df52fe3e703c68726c412263c29be9c58da523b6d3b375df04a579ef05c5907f1ec6a16f034855e1f8ca2e4d70b5f97e983eb9eca12af8c2bbe0a633d

Download Submit
C:\Windows\system\etjRjFY.exe

Filesize
2.3MB

MD5
1f21fe16bce2fb727a5a5c7151672053

SHA1
5932f65af86b78384db6ccb9fb54993d130fc2f2

SHA256
50fcf549926e84d9584cd67d912e97485e539d10b38a75636de43c140fa9846b

SHA512
953e23d2086c3067f6f0723a7dfa633cb403388b8e9aa16e52e4a5fff76624563488e30a37d8f9c411d8ad8b664001002d36a3ee19a838c32c29a9ee972d63a9

Download Submit
C:\Windows\system\fKclouk.exe

Filesize
2.3MB

MD5
0cb0f7da1120766b40ca5a8da746dfdd

SHA1
e3aaa91e09e0b5e84aea5908e2255c6cfc3b318e

SHA256
ed18cfc9a1469bbb82deb522a9ac844f56e20f333fd0892beeced6aed9da1770

SHA512
4663e226ef74d045c8812d7970a15410a33c7e176be468aaa9042fe1a819d05ed0e3e8bef23f64d99ed0d4f149c4594942b89a20e6693a4fcfd9383b0df8da2c

Download Submit
C:\Windows\system\fhPRGuH.exe

Filesize
2.3MB

MD5
88e33d6569c687466e87b37df81a6f49

SHA1
65c2e435f084db239be11ef7ea1027f60cfef788

SHA256
c9867941ce066406b3e73fefe71c3673fb3cd37831e7293c7bcf6945891f5df0

SHA512
d434e13bf4438c1ed487fff512abc7224a70d18151469e58cad2cb848d24d28d34e68f443a274386583805e298b74ff5bd6956ca1290da508c900967413e5dee

Download Submit
C:\Windows\system\gPAVipS.exe

Filesize
2.3MB

MD5
deb51f4dcf52462db66b8144c3ec45d2

SHA1
c9a91ec813bd83710362928b49add4bdb3c40948

SHA256
1d5f7faad283e8ca3733c6f88160f14eef43a62a579b4ac1cbaa3956e90d19c1

SHA512
0051a7b34b571000a35b427815dbef8cb8af312ba414824db01f02f24941aa078f2ff47f24a4f39d8575dc19294173491d0ef76c0171333023d7d6b28249bb6d

Download Submit
C:\Windows\system\iAxozUR.exe

Filesize
2.3MB

MD5
d8207254be2d0f877e0404e8105395d9

SHA1
0aef23a82e76d765236fef8cc84e528b34f4f830

SHA256
b7b417606ac5369d750a681ff2d3d423d1f3e113e09b1b787858411c024281a6

SHA512
27b17530dc14d1b3954730bf524b295903c7efbee12f54529971e9b63c75e03b66d8789b14bfb7f17974ad93a1d8a8eaef97697c020f49258c6fdfaac92aa9f7

Download Submit
C:\Windows\system\kCxjSSQ.exe

Filesize
2.3MB

MD5
a0ae40f1a8db478ee6d62e898fad9494

SHA1
d0181e2496a4e27fc4f5a8b93de6ecbb93f75bac

SHA256
12fe7675963605ce1979b5bf155ebedbc436d1096afc2d65b1d9e1c22e00fbce

SHA512
dc3c66a1c6ca0a452d6ea43e4d6a5f87c25eba0ace8db30316236bb06f6448ba0a1dbc4e702f9c1f3089691285a9eae672ccb137618001e176849748036cba4f

Download Submit
C:\Windows\system\pVojTlc.exe

Filesize
2.3MB

MD5
1ebcb100bb41946c70ddb7358cef733b

SHA1
5d7e92a170d5b3324b7d7919c1493dd729df5b90

SHA256
5ed659bcb63c63b011ff5750a828bc3a4d94202b726176756f15ea35b32f5948

SHA512
a555682648c5b970a1370580781e4259dbfeec79fe8ac34c1a449971218a23fc6918eefdb0fb0b0616cf9621188e06e7e0f9b907ad45f260571ac58fca999149

Download Submit
C:\Windows\system\ppiLxKB.exe

Filesize
2.3MB

MD5
08b2d9c5b604ab7dd90b0448bacfee0d

SHA1
4bc745853b292297bde401d257e26ba2e23d28fc

SHA256
1d5371e36a98c5de2391084fe15f19790e906041391fd9c06854135dc214aac4

SHA512
12a3d5f0e40ae9ca884814fd51ca2d3f128899cb9531be794e0bc63dc13fa2896e67cd5f284b5989d72ac5b3e20c88b781b027e14e894802a5181f721605b355

Download Submit
C:\Windows\system\qnNnKeW.exe

Filesize
2.3MB

MD5
baf6de2bb8d42f93ce2dd6e387711306

SHA1
b17f8b635528d1665d6e45fee19c167397b1236e

SHA256
7ddd0e8e2375bc670ab3b30799dfdabe1aeeb9a036555cb0b9645adc662395ff

SHA512
761764d4d24e1ef4b6b1e9aa51b17bb51d8a19211c122f4542aa0d4b07a1014872c169e339dcda9cac16740875feb896edc15484be0068c21adc2cc48fc0848b

Download Submit
C:\Windows\system\rzTxJEB.exe

Filesize
2.3MB

MD5
0d2ebc8938d8d1fd14a2da233375146c

SHA1
f65cdac39625a18274d844cd262275f5c0afe554

SHA256
8f3287f67f047e470ffa2b8495272a9c981aee9c7a2ef4afef35b639f4027250

SHA512
c37bf5184cd4ba2c8272e789c7dcb5892dc3d02a668a9dc51b3ab6f864db8cb42c7b4d6603669ee106e329925c53ed1a110f0c7c03f940016d5f779d34aef1aa

Download Submit
C:\Windows\system\viatlYi.exe

Filesize
2.3MB

MD5
9607d2601708fcf08e095cb6a288ca3b

SHA1
522c235e16ef821ba4831113a6c6af0e6ad86fc1

SHA256
1e8421b6f9353e3f07f66dd14bd90ac566e6f7d5c78a52f8e3d0c54f65912251

SHA512
64f768c5be136c7cabdf4da199ddcfb592a201fbf61982aa1f5fcdf275b0b348b3868f9dfeb2a23c5441e7157e3abaced0366f39b70ebf773d39d7bef2dd9a65

Download Submit
C:\Windows\system\vuFZoRS.exe

Filesize
2.3MB

MD5
eb7063a60cc0062ae98c8d9b93897feb

SHA1
983ef810be5c1eda8ed31dd9cd3828e12f1029cf

SHA256
d74fc96058f5e711c32907428eab27129c2cda543fd8722c8c671b4d0cd82017

SHA512
171ba71b93f63600a0aeb66d5c2f9391ef72a66d07f17241e241c6a1230d395c1b7ded91902ac34083a371596dd2b05ff80621c73e561a21fc23df054b334410

Download Submit
C:\Windows\system\wJuLtiY.exe

Filesize
2.3MB

MD5
c2bd5c3c6b4292903791dc14c524a203

SHA1
d9b914e0224b7c26a848bbf62949ab3083564d4f

SHA256
78d9ca5a429f6cdb9d9dfcdfae6a24b17ff6818c532dc1c14c26de6127050ceb

SHA512
9e73ab538188ed1d097cfbb72ad7472e088306be19ec113a4a2475ef39b61a4a960b927d8010d9b4e574ac17cbab3082be11ec8942d09fb8a9e475c7cdc6a4df

Download Submit
C:\Windows\system\wqihDSL.exe

Filesize
2.3MB

MD5
9cc14b6a17f758788488e83cc65523d3

SHA1
3ff51560912ab05674052d319aa4540ee634563a

SHA256
26bea69c33bcbdc0523c6c89b76326bef81121564ca0b07ae69049dfc15b6990

SHA512
e799e223f5aa32035fdc2cf966bc64e902bdc7886f46eaac14f2e84ea6c9e14bafa08b6828c0742bff7cea4f9c7cc5b646d24144da1216d581a8f74f503cbc4e

Download Submit
C:\Windows\system\xfcrdlD.exe

Filesize
2.3MB

MD5
5727166d5b631e5cc10013dd8a8becc7

SHA1
3c316158aa61865642df827a35b5a8fcf8e1972a

SHA256
f586dd69800ea372390653fd3e2b152847618dad15b4378ff47d04d89f2f0fdc

SHA512
d92c8f190b3e120bcc6e9d812e80fcc163341e18796f2834eebfccdf449794136b649e8d5af818da5ab519e13cb1a8ae4745e5eb085d2f784a302d9da96b84da

Download Submit
\Windows\system\LhWydNV.exe

Filesize
2.3MB

MD5
1eda8ac9722e018126674c07accb2964

SHA1
ff92f523f09554a8135eeaa3397d30c425d61ffa

SHA256
27faf13148fcbba3b13ee8e0df0c45dccc454b9f28236c5db7468bc2a364d087

SHA512
ea74336815b4f57dea4d560a32648330a959c5f5f45596bdab14f41282f8fba117475de9eb4894bda6672913e2dfedecc2d9cc2bfa4be31e750127731b4123be

Download Submit
memory/1624-4003-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1624-108-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1672-4044-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/1672-93-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-106-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2064-4041-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2156-100-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-78-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2156-10522-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-103-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-111-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-12-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-109-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2156-107-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-90-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-76-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-105-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-80-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2156-0-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-94-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2376-4001-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-96-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2400-3915-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2400-77-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-4049-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2424-110-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2428-101-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-4055-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-3890-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2492-13-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2500-89-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2500-4006-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2616-79-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2616-4040-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2664-75-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2868-104-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/3008-82-0x0000000002330000-0x0000000002338000-memory.dmp

Filesize
32KB

Download
memory/3008-152-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

Filesize
9.6MB

Download
memory/3008-102-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

Filesize
9.6MB

Download
memory/3008-15-0x000007FEF5B4E000-0x000007FEF5B4F000-memory.dmp

Filesize
4KB

Download
memory/3008-14-0x0000000002AF0000-0x0000000002B70000-memory.dmp

Filesize
512KB

Download
memory/3008-44-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/3008-74-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

Filesize
9.6MB

Download