xmrig | 74829f49822dd6abdc1991e97ce309cd7fe099d58a053d367d06e474f4ea7282

Analysis

max time kernel
143s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
Size

1.9MB
MD5

040bbbd0626c742afa97da9ad7463c61
SHA1

dab0891105d499f5cf77635a23f70555dc09db2e
SHA256

74829f49822dd6abdc1991e97ce309cd7fe099d58a053d367d06e474f4ea7282
SHA512

d7af5d29d65fc1cb350b428d3c1053fb6518c3977bc48e5fb6fcc3d294697342d4c2178a08ae0cc95ff6d8fd43c235ff937f880374729e72925ffbdcbd68b947
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1B:NAB4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/1840-200-0x00007FF775DE0000-0x00007FF7761D2000-memory.dmp	xmrig
behavioral2/memory/3004-220-0x00007FF707170000-0x00007FF707562000-memory.dmp	xmrig
behavioral2/memory/3684-226-0x00007FF7ED1B0000-0x00007FF7ED5A2000-memory.dmp	xmrig
behavioral2/memory/540-246-0x00007FF6DBE90000-0x00007FF6DC282000-memory.dmp	xmrig
behavioral2/memory/2764-250-0x00007FF7BF090000-0x00007FF7BF482000-memory.dmp	xmrig
behavioral2/memory/2232-245-0x00007FF739BF0000-0x00007FF739FE2000-memory.dmp	xmrig
behavioral2/memory/2056-244-0x00007FF702C00000-0x00007FF702FF2000-memory.dmp	xmrig
behavioral2/memory/4572-224-0x00007FF74EF20000-0x00007FF74F312000-memory.dmp	xmrig
behavioral2/memory/2908-214-0x00007FF7DEB80000-0x00007FF7DEF72000-memory.dmp	xmrig
behavioral2/memory/856-190-0x00007FF744D20000-0x00007FF745112000-memory.dmp	xmrig
behavioral2/memory/2536-176-0x00007FF735390000-0x00007FF735782000-memory.dmp	xmrig
behavioral2/memory/3812-150-0x00007FF78CA00000-0x00007FF78CDF2000-memory.dmp	xmrig
behavioral2/memory/432-127-0x00007FF7FE660000-0x00007FF7FEA52000-memory.dmp	xmrig
behavioral2/memory/4432-126-0x00007FF666D60000-0x00007FF667152000-memory.dmp	xmrig
behavioral2/memory/4860-105-0x00007FF6605F0000-0x00007FF6609E2000-memory.dmp	xmrig
behavioral2/memory/2484-87-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp	xmrig
behavioral2/memory/3104-81-0x00007FF796D40000-0x00007FF797132000-memory.dmp	xmrig
behavioral2/memory/4864-22-0x00007FF794A80000-0x00007FF794E72000-memory.dmp	xmrig
behavioral2/memory/3104-4861-0x00007FF796D40000-0x00007FF797132000-memory.dmp	xmrig
behavioral2/memory/4860-4840-0x00007FF6605F0000-0x00007FF6609E2000-memory.dmp	xmrig
behavioral2/memory/1596-4901-0x00007FF70B7D0000-0x00007FF70BBC2000-memory.dmp	xmrig
behavioral2/memory/4432-4905-0x00007FF666D60000-0x00007FF667152000-memory.dmp	xmrig
behavioral2/memory/2484-4902-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp	xmrig
behavioral2/memory/3004-4973-0x00007FF707170000-0x00007FF707562000-memory.dmp	xmrig
behavioral2/memory/540-4971-0x00007FF6DBE90000-0x00007FF6DC282000-memory.dmp	xmrig
behavioral2/memory/1840-4967-0x00007FF775DE0000-0x00007FF7761D2000-memory.dmp	xmrig
behavioral2/memory/2908-4962-0x00007FF7DEB80000-0x00007FF7DEF72000-memory.dmp	xmrig
behavioral2/memory/2232-4958-0x00007FF739BF0000-0x00007FF739FE2000-memory.dmp	xmrig
behavioral2/memory/2536-4933-0x00007FF735390000-0x00007FF735782000-memory.dmp	xmrig
behavioral2/memory/856-4951-0x00007FF744D20000-0x00007FF745112000-memory.dmp	xmrig
behavioral2/memory/3812-4918-0x00007FF78CA00000-0x00007FF78CDF2000-memory.dmp	xmrig
behavioral2/memory/2056-4915-0x00007FF702C00000-0x00007FF702FF2000-memory.dmp	xmrig
behavioral2/memory/2356-4909-0x00007FF7C00C0000-0x00007FF7C04B2000-memory.dmp	xmrig
behavioral2/memory/2764-5011-0x00007FF7BF090000-0x00007FF7BF482000-memory.dmp	xmrig
behavioral2/memory/4572-4988-0x00007FF74EF20000-0x00007FF74F312000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1256	jQHAbFD.exe
4864	NXuOIYG.exe
1596	cLiEHSY.exe
3684	KjsoGQc.exe
2356	KSSRfeN.exe
3104	kBpHeol.exe
2484	iMIghSz.exe
4860	cRgFKGr.exe
2056	QKARngQ.exe
4432	RhUeets.exe
432	CuTLLEL.exe
3812	okLCRIH.exe
2232	hOPmZZn.exe
2536	NJTegMF.exe
856	tCjOmiV.exe
1840	xWoVTQT.exe
2908	UalbeYS.exe
540	CvjnnQY.exe
3004	XvXZkEC.exe
4572	Yqrjoqm.exe
2764	UgTEChp.exe
2728	QiJvqzN.exe
4356	dNCknCm.exe
2576	rmTmlYv.exe
3508	zSwpBNB.exe
4116	UsLXnCU.exe
3372	qzlSnVl.exe
2592	hzJLEZI.exe
1360	JeyuGju.exe
1748	XXTRmkK.exe
3432	MskFVld.exe
3428	vEwpaWz.exe
4076	RrLZOrJ.exe
532	TGgyQdx.exe
4396	ejJdyQI.exe
872	yuHodYr.exe
1252	DbRgHKv.exe
4284	KNrsaDy.exe
3032	ccRTuNm.exe
4840	SeksEXU.exe
3180	IvkISZW.exe
3772	oqjoPGu.exe
1604	nBQjOLF.exe
4928	zTsiprX.exe
3828	rRyuMKz.exe
4952	KGmdtgd.exe
1628	rCvdwrW.exe
3516	bTKqpxO.exe
5072	cnbmnhp.exe
3172	NrUebua.exe
5036	kQDqwTD.exe
1960	zudRmud.exe
3556	WYyjMJC.exe
952	kFfzEVd.exe
1056	pDyLJtH.exe
3836	FDJStkr.exe
4584	LhsyWkp.exe
2120	kNTPuCy.exe
1272	tgoYgnn.exe
2352	ymWIPGY.exe
4768	XROOVPX.exe
3144	hkcIakm.exe
1296	IGlVhuE.exe
2656	YkEatNE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2916-0-0x00007FF6689C0000-0x00007FF668DB2000-memory.dmp	upx
behavioral2/files/0x000b000000023bb0-5.dat	upx
behavioral2/files/0x0031000000023bb4-11.dat	upx
behavioral2/files/0x0031000000023bb5-10.dat	upx
behavioral2/files/0x000a000000023bb7-44.dat	upx
behavioral2/files/0x000a000000023bb9-67.dat	upx
behavioral2/files/0x000a000000023bc8-122.dat	upx
behavioral2/files/0x000a000000023bc7-143.dat	upx
behavioral2/files/0x000a000000023bcf-167.dat	upx
behavioral2/files/0x000a000000023bcd-188.dat	upx
behavioral2/memory/1840-200-0x00007FF775DE0000-0x00007FF7761D2000-memory.dmp	upx
behavioral2/memory/3004-220-0x00007FF707170000-0x00007FF707562000-memory.dmp	upx
behavioral2/memory/3684-226-0x00007FF7ED1B0000-0x00007FF7ED5A2000-memory.dmp	upx
behavioral2/memory/540-246-0x00007FF6DBE90000-0x00007FF6DC282000-memory.dmp	upx
behavioral2/memory/2764-250-0x00007FF7BF090000-0x00007FF7BF482000-memory.dmp	upx
behavioral2/memory/2232-245-0x00007FF739BF0000-0x00007FF739FE2000-memory.dmp	upx
behavioral2/memory/2056-244-0x00007FF702C00000-0x00007FF702FF2000-memory.dmp	upx
behavioral2/memory/4572-224-0x00007FF74EF20000-0x00007FF74F312000-memory.dmp	upx
behavioral2/memory/2908-214-0x00007FF7DEB80000-0x00007FF7DEF72000-memory.dmp	upx
behavioral2/memory/856-190-0x00007FF744D20000-0x00007FF745112000-memory.dmp	upx
behavioral2/files/0x000a000000023bd5-187.dat	upx
behavioral2/files/0x000a000000023bd4-186.dat	upx
behavioral2/files/0x000a000000023bd3-183.dat	upx
behavioral2/files/0x000a000000023bce-181.dat	upx
behavioral2/files/0x000a000000023bd2-180.dat	upx
behavioral2/files/0x000a000000023bca-178.dat	upx
behavioral2/files/0x000a000000023bd1-177.dat	upx
behavioral2/memory/2536-176-0x00007FF735390000-0x00007FF735782000-memory.dmp	upx
behavioral2/files/0x000a000000023bd0-175.dat	upx
behavioral2/files/0x000a000000023bc9-169.dat	upx
behavioral2/files/0x000a000000023bc6-160.dat	upx
behavioral2/files/0x000a000000023bcc-158.dat	upx
behavioral2/files/0x000a000000023bcb-156.dat	upx
behavioral2/files/0x000b000000023bb1-155.dat	upx
behavioral2/memory/3812-150-0x00007FF78CA00000-0x00007FF78CDF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-135.dat	upx
behavioral2/files/0x000a000000023bc5-132.dat	upx
behavioral2/files/0x000a000000023bc4-131.dat	upx
behavioral2/memory/432-127-0x00007FF7FE660000-0x00007FF7FEA52000-memory.dmp	upx
behavioral2/memory/4432-126-0x00007FF666D60000-0x00007FF667152000-memory.dmp	upx
behavioral2/files/0x000a000000023bc0-118.dat	upx
behavioral2/files/0x000a000000023bc2-116.dat	upx
behavioral2/files/0x000b000000023bbb-110.dat	upx
behavioral2/files/0x000a000000023bc1-109.dat	upx
behavioral2/memory/4860-105-0x00007FF6605F0000-0x00007FF6609E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc3-123.dat	upx
behavioral2/files/0x000b000000023bbc-95.dat	upx
behavioral2/files/0x000a000000023bbe-92.dat	upx
behavioral2/files/0x000a000000023bbd-88.dat	upx
behavioral2/memory/2484-87-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp	upx
behavioral2/memory/3104-81-0x00007FF796D40000-0x00007FF797132000-memory.dmp	upx
behavioral2/memory/2356-78-0x00007FF7C00C0000-0x00007FF7C04B2000-memory.dmp	upx
behavioral2/memory/1596-59-0x00007FF70B7D0000-0x00007FF70BBC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-56.dat	upx
behavioral2/files/0x000a000000023bb8-45.dat	upx
behavioral2/files/0x0031000000023bb6-27.dat	upx
behavioral2/memory/4864-22-0x00007FF794A80000-0x00007FF794E72000-memory.dmp	upx
behavioral2/memory/1256-7-0x00007FF6F4140000-0x00007FF6F4532000-memory.dmp	upx
behavioral2/memory/3104-4861-0x00007FF796D40000-0x00007FF797132000-memory.dmp	upx
behavioral2/memory/4860-4840-0x00007FF6605F0000-0x00007FF6609E2000-memory.dmp	upx
behavioral2/memory/1596-4901-0x00007FF70B7D0000-0x00007FF70BBC2000-memory.dmp	upx
behavioral2/memory/4432-4905-0x00007FF666D60000-0x00007FF667152000-memory.dmp	upx
behavioral2/memory/2484-4902-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp	upx
behavioral2/memory/3004-4973-0x00007FF707170000-0x00007FF707562000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZCnjZMQ.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\EHDuBxe.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\keJQYJw.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\kVobMkL.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\YSjVrla.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\SvnSkOQ.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\cCFtbGm.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\qbzFEpb.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\ZjlKouh.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\cKkUpGI.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\gLCcsQj.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\TBaUjUI.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\spxChte.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\TgBEXrq.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\IPCOnyV.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\UPVYYXz.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\tkGAKII.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\IkaCkDm.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\ORpjFqa.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\LqBExpx.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\mQPImGT.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\BhwYimD.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\BKgXorl.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\eVwlJaA.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\jNSWWJK.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\VbYJVbr.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\OidNuym.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\DPAnBNw.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\dIVGhsw.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\XiXQbvD.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\kxlGcxd.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\mBIMcLo.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\eMtfmZt.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\sBzWhOA.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\yruEcUJ.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\zsTXfjK.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\MAdniqE.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\szzNpUo.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\JeRiiiK.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\qXInOsd.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\epiePTh.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\bffnYHm.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\JQITbNs.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\EpKeUSJ.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\pzLJVGl.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\UhHrxid.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\TJxisnq.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\nPRJguQ.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\SjLReuM.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\nJXPaVL.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\zLeAvNV.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\BoFkZwA.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\nTEtCFb.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\teeuhxZ.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\GnEduFj.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\CGvGHnX.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\wVTpvcg.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\HTJhNyZ.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\VzQlZpC.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\TzHpmxj.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\lFuAnla.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\rAoVsYk.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\zvYnLEN.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\XcQPUyD.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
888	powershell.exe
888	powershell.exe
888	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeCreateGlobalPrivilege	3276	dwm.exe
Token: SeChangeNotifyPrivilege	3276	dwm.exe
Token: 33	3276	dwm.exe
Token: SeIncBasePriorityPrivilege	3276	dwm.exe
Token: SeCreateGlobalPrivilege	916	dwm.exe
Token: SeChangeNotifyPrivilege	916	dwm.exe
Token: 33	916	dwm.exe
Token: SeIncBasePriorityPrivilege	916	dwm.exe
Token: SeCreateGlobalPrivilege	14112	dwm.exe
Token: SeChangeNotifyPrivilege	14112	dwm.exe
Token: 33	14112	dwm.exe
Token: SeIncBasePriorityPrivilege	14112	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 888	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	85
PID 2916 wrote to memory of 888	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	85
PID 2916 wrote to memory of 1256	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	86
PID 2916 wrote to memory of 1256	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	86
PID 2916 wrote to memory of 4864	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	87
PID 2916 wrote to memory of 4864	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	87
PID 2916 wrote to memory of 1596	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	88
PID 2916 wrote to memory of 1596	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	88
PID 2916 wrote to memory of 3684	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	89
PID 2916 wrote to memory of 3684	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	89
PID 2916 wrote to memory of 2356	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	90
PID 2916 wrote to memory of 2356	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	90
PID 2916 wrote to memory of 3104	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	91
PID 2916 wrote to memory of 3104	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	91
PID 2916 wrote to memory of 2484	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	92
PID 2916 wrote to memory of 2484	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	92
PID 2916 wrote to memory of 4860	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	93
PID 2916 wrote to memory of 4860	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	93
PID 2916 wrote to memory of 2056	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	94
PID 2916 wrote to memory of 2056	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	94
PID 2916 wrote to memory of 4432	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	95
PID 2916 wrote to memory of 4432	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	95
PID 2916 wrote to memory of 1840	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	96
PID 2916 wrote to memory of 1840	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	96
PID 2916 wrote to memory of 432	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	97
PID 2916 wrote to memory of 432	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	97
PID 2916 wrote to memory of 3812	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	98
PID 2916 wrote to memory of 3812	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	98
PID 2916 wrote to memory of 2232	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	99
PID 2916 wrote to memory of 2232	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	99
PID 2916 wrote to memory of 2536	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	100
PID 2916 wrote to memory of 2536	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	100
PID 2916 wrote to memory of 856	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	101
PID 2916 wrote to memory of 856	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	101
PID 2916 wrote to memory of 2908	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	102
PID 2916 wrote to memory of 2908	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	102
PID 2916 wrote to memory of 2728	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	103
PID 2916 wrote to memory of 2728	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	103
PID 2916 wrote to memory of 4356	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	104
PID 2916 wrote to memory of 4356	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	104
PID 2916 wrote to memory of 4116	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	105
PID 2916 wrote to memory of 4116	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	105
PID 2916 wrote to memory of 540	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	106
PID 2916 wrote to memory of 540	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	106
PID 2916 wrote to memory of 3004	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	107
PID 2916 wrote to memory of 3004	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	107
PID 2916 wrote to memory of 4572	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	108
PID 2916 wrote to memory of 4572	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	108
PID 2916 wrote to memory of 2764	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	109
PID 2916 wrote to memory of 2764	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	109
PID 2916 wrote to memory of 2576	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	110
PID 2916 wrote to memory of 2576	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	110
PID 2916 wrote to memory of 3508	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	111
PID 2916 wrote to memory of 3508	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	111
PID 2916 wrote to memory of 3372	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	112
PID 2916 wrote to memory of 3372	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	112
PID 2916 wrote to memory of 2592	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	113
PID 2916 wrote to memory of 2592	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	113
PID 2916 wrote to memory of 1360	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	114
PID 2916 wrote to memory of 1360	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	114
PID 2916 wrote to memory of 1748	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	115
PID 2916 wrote to memory of 1748	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	115
PID 2916 wrote to memory of 3432	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	116
PID 2916 wrote to memory of 3432	2916	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:888
- C:\Windows\System\jQHAbFD.exe
  C:\Windows\System\jQHAbFD.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\NXuOIYG.exe
  C:\Windows\System\NXuOIYG.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\cLiEHSY.exe
  C:\Windows\System\cLiEHSY.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\KjsoGQc.exe
  C:\Windows\System\KjsoGQc.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\KSSRfeN.exe
  C:\Windows\System\KSSRfeN.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\kBpHeol.exe
  C:\Windows\System\kBpHeol.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\iMIghSz.exe
  C:\Windows\System\iMIghSz.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\cRgFKGr.exe
  C:\Windows\System\cRgFKGr.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\QKARngQ.exe
  C:\Windows\System\QKARngQ.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\RhUeets.exe
  C:\Windows\System\RhUeets.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\xWoVTQT.exe
  C:\Windows\System\xWoVTQT.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\CuTLLEL.exe
  C:\Windows\System\CuTLLEL.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\okLCRIH.exe
  C:\Windows\System\okLCRIH.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\hOPmZZn.exe
  C:\Windows\System\hOPmZZn.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\NJTegMF.exe
  C:\Windows\System\NJTegMF.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\tCjOmiV.exe
  C:\Windows\System\tCjOmiV.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\UalbeYS.exe
  C:\Windows\System\UalbeYS.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\QiJvqzN.exe
  C:\Windows\System\QiJvqzN.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\dNCknCm.exe
  C:\Windows\System\dNCknCm.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\UsLXnCU.exe
  C:\Windows\System\UsLXnCU.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\CvjnnQY.exe
  C:\Windows\System\CvjnnQY.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\XvXZkEC.exe
  C:\Windows\System\XvXZkEC.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\Yqrjoqm.exe
  C:\Windows\System\Yqrjoqm.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\UgTEChp.exe
  C:\Windows\System\UgTEChp.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\rmTmlYv.exe
  C:\Windows\System\rmTmlYv.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\zSwpBNB.exe
  C:\Windows\System\zSwpBNB.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\qzlSnVl.exe
  C:\Windows\System\qzlSnVl.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\hzJLEZI.exe
  C:\Windows\System\hzJLEZI.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\JeyuGju.exe
  C:\Windows\System\JeyuGju.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\XXTRmkK.exe
  C:\Windows\System\XXTRmkK.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\MskFVld.exe
  C:\Windows\System\MskFVld.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\vEwpaWz.exe
  C:\Windows\System\vEwpaWz.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\RrLZOrJ.exe
  C:\Windows\System\RrLZOrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\TGgyQdx.exe
  C:\Windows\System\TGgyQdx.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\ejJdyQI.exe
  C:\Windows\System\ejJdyQI.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\yuHodYr.exe
  C:\Windows\System\yuHodYr.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\DbRgHKv.exe
  C:\Windows\System\DbRgHKv.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\KNrsaDy.exe
  C:\Windows\System\KNrsaDy.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\ccRTuNm.exe
  C:\Windows\System\ccRTuNm.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\SeksEXU.exe
  C:\Windows\System\SeksEXU.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\IvkISZW.exe
  C:\Windows\System\IvkISZW.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\oqjoPGu.exe
  C:\Windows\System\oqjoPGu.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\nBQjOLF.exe
  C:\Windows\System\nBQjOLF.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\zTsiprX.exe
  C:\Windows\System\zTsiprX.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\rRyuMKz.exe
  C:\Windows\System\rRyuMKz.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\KGmdtgd.exe
  C:\Windows\System\KGmdtgd.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\rCvdwrW.exe
  C:\Windows\System\rCvdwrW.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\bTKqpxO.exe
  C:\Windows\System\bTKqpxO.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\cnbmnhp.exe
  C:\Windows\System\cnbmnhp.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\NrUebua.exe
  C:\Windows\System\NrUebua.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\kQDqwTD.exe
  C:\Windows\System\kQDqwTD.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\zudRmud.exe
  C:\Windows\System\zudRmud.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\WYyjMJC.exe
  C:\Windows\System\WYyjMJC.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\kFfzEVd.exe
  C:\Windows\System\kFfzEVd.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\pDyLJtH.exe
  C:\Windows\System\pDyLJtH.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\FDJStkr.exe
  C:\Windows\System\FDJStkr.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\LhsyWkp.exe
  C:\Windows\System\LhsyWkp.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\kNTPuCy.exe
  C:\Windows\System\kNTPuCy.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\tgoYgnn.exe
  C:\Windows\System\tgoYgnn.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\ymWIPGY.exe
  C:\Windows\System\ymWIPGY.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\XROOVPX.exe
  C:\Windows\System\XROOVPX.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\hkcIakm.exe
  C:\Windows\System\hkcIakm.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\IGlVhuE.exe
  C:\Windows\System\IGlVhuE.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\YkEatNE.exe
  C:\Windows\System\YkEatNE.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\EiDzrTP.exe
  C:\Windows\System\EiDzrTP.exe
  2⤵
  PID:4020
- C:\Windows\System\BpWzWbn.exe
  C:\Windows\System\BpWzWbn.exe
  2⤵
  PID:4912
- C:\Windows\System\YAjwAoV.exe
  C:\Windows\System\YAjwAoV.exe
  2⤵
  PID:1428
- C:\Windows\System\bGIAOep.exe
  C:\Windows\System\bGIAOep.exe
  2⤵
  PID:4444
- C:\Windows\System\bKCbQYL.exe
  C:\Windows\System\bKCbQYL.exe
  2⤵
  PID:744
- C:\Windows\System\qOqeGfo.exe
  C:\Windows\System\qOqeGfo.exe
  2⤵
  PID:2812
- C:\Windows\System\vJeGTEb.exe
  C:\Windows\System\vJeGTEb.exe
  2⤵
  PID:3704
- C:\Windows\System\CHbVaYx.exe
  C:\Windows\System\CHbVaYx.exe
  2⤵
  PID:2800
- C:\Windows\System\enTUpEB.exe
  C:\Windows\System\enTUpEB.exe
  2⤵
  PID:2896
- C:\Windows\System\zWbAPuL.exe
  C:\Windows\System\zWbAPuL.exe
  2⤵
  PID:3968
- C:\Windows\System\DHSFiCB.exe
  C:\Windows\System\DHSFiCB.exe
  2⤵
  PID:4596
- C:\Windows\System\MAsQFqe.exe
  C:\Windows\System\MAsQFqe.exe
  2⤵
  PID:3896
- C:\Windows\System\qXwehJx.exe
  C:\Windows\System\qXwehJx.exe
  2⤵
  PID:2012
- C:\Windows\System\scCWLlg.exe
  C:\Windows\System\scCWLlg.exe
  2⤵
  PID:4300
- C:\Windows\System\IRFGNBe.exe
  C:\Windows\System\IRFGNBe.exe
  2⤵
  PID:4512
- C:\Windows\System\xhiPPKC.exe
  C:\Windows\System\xhiPPKC.exe
  2⤵
  PID:964
- C:\Windows\System\PXUDeoe.exe
  C:\Windows\System\PXUDeoe.exe
  2⤵
  PID:3608
- C:\Windows\System\UHWhnpO.exe
  C:\Windows\System\UHWhnpO.exe
  2⤵
  PID:1012
- C:\Windows\System\wPKLZJR.exe
  C:\Windows\System\wPKLZJR.exe
  2⤵
  PID:1204
- C:\Windows\System\hbeSqlc.exe
  C:\Windows\System\hbeSqlc.exe
  2⤵
  PID:4904
- C:\Windows\System\jAHGrYQ.exe
  C:\Windows\System\jAHGrYQ.exe
  2⤵
  PID:1620
- C:\Windows\System\cdDotdx.exe
  C:\Windows\System\cdDotdx.exe
  2⤵
  PID:1852
- C:\Windows\System\sqgADbZ.exe
  C:\Windows\System\sqgADbZ.exe
  2⤵
  PID:4008
- C:\Windows\System\eELhlWe.exe
  C:\Windows\System\eELhlWe.exe
  2⤵
  PID:3360
- C:\Windows\System\MRNGtHy.exe
  C:\Windows\System\MRNGtHy.exe
  2⤵
  PID:4844
- C:\Windows\System\GhwRvfo.exe
  C:\Windows\System\GhwRvfo.exe
  2⤵
  PID:1484
- C:\Windows\System\JPlMdzM.exe
  C:\Windows\System\JPlMdzM.exe
  2⤵
  PID:1552
- C:\Windows\System\BAWmeqF.exe
  C:\Windows\System\BAWmeqF.exe
  2⤵
  PID:4484
- C:\Windows\System\qDvcdms.exe
  C:\Windows\System\qDvcdms.exe
  2⤵
  PID:2264
- C:\Windows\System\okCfBPM.exe
  C:\Windows\System\okCfBPM.exe
  2⤵
  PID:4528
- C:\Windows\System\tCAGvEz.exe
  C:\Windows\System\tCAGvEz.exe
  2⤵
  PID:4536
- C:\Windows\System\UMeOJMC.exe
  C:\Windows\System\UMeOJMC.exe
  2⤵
  PID:3016
- C:\Windows\System\oDpwlok.exe
  C:\Windows\System\oDpwlok.exe
  2⤵
  PID:1356
- C:\Windows\System\eDUEWYr.exe
  C:\Windows\System\eDUEWYr.exe
  2⤵
  PID:1328
- C:\Windows\System\uTJTXGG.exe
  C:\Windows\System\uTJTXGG.exe
  2⤵
  PID:1912
- C:\Windows\System\NjxAnJw.exe
  C:\Windows\System\NjxAnJw.exe
  2⤵
  PID:2412
- C:\Windows\System\NgCGOuI.exe
  C:\Windows\System\NgCGOuI.exe
  2⤵
  PID:1936
- C:\Windows\System\ncHbiZd.exe
  C:\Windows\System\ncHbiZd.exe
  2⤵
  PID:5088
- C:\Windows\System\VNLQNTk.exe
  C:\Windows\System\VNLQNTk.exe
  2⤵
  PID:5140
- C:\Windows\System\DDLFoVv.exe
  C:\Windows\System\DDLFoVv.exe
  2⤵
  PID:5160
- C:\Windows\System\KgwwZRt.exe
  C:\Windows\System\KgwwZRt.exe
  2⤵
  PID:5188
- C:\Windows\System\fDDtuyz.exe
  C:\Windows\System\fDDtuyz.exe
  2⤵
  PID:5208
- C:\Windows\System\qaEaLvu.exe
  C:\Windows\System\qaEaLvu.exe
  2⤵
  PID:5232
- C:\Windows\System\IkuBzZU.exe
  C:\Windows\System\IkuBzZU.exe
  2⤵
  PID:5248
- C:\Windows\System\UWeQvqe.exe
  C:\Windows\System\UWeQvqe.exe
  2⤵
  PID:5268
- C:\Windows\System\VsxAckv.exe
  C:\Windows\System\VsxAckv.exe
  2⤵
  PID:5288
- C:\Windows\System\scXFIvf.exe
  C:\Windows\System\scXFIvf.exe
  2⤵
  PID:5312
- C:\Windows\System\RWHeAGN.exe
  C:\Windows\System\RWHeAGN.exe
  2⤵
  PID:5328
- C:\Windows\System\BCAuHcN.exe
  C:\Windows\System\BCAuHcN.exe
  2⤵
  PID:5356
- C:\Windows\System\wTReEYz.exe
  C:\Windows\System\wTReEYz.exe
  2⤵
  PID:5380
- C:\Windows\System\ulibViP.exe
  C:\Windows\System\ulibViP.exe
  2⤵
  PID:5400
- C:\Windows\System\CDDxDbF.exe
  C:\Windows\System\CDDxDbF.exe
  2⤵
  PID:5420
- C:\Windows\System\InoOlji.exe
  C:\Windows\System\InoOlji.exe
  2⤵
  PID:5444
- C:\Windows\System\fxhPkps.exe
  C:\Windows\System\fxhPkps.exe
  2⤵
  PID:5464
- C:\Windows\System\kDwKarj.exe
  C:\Windows\System\kDwKarj.exe
  2⤵
  PID:5484
- C:\Windows\System\uiBVUtN.exe
  C:\Windows\System\uiBVUtN.exe
  2⤵
  PID:5500
- C:\Windows\System\wFnNnMi.exe
  C:\Windows\System\wFnNnMi.exe
  2⤵
  PID:5528
- C:\Windows\System\ISczdJQ.exe
  C:\Windows\System\ISczdJQ.exe
  2⤵
  PID:5548
- C:\Windows\System\ClqRtWc.exe
  C:\Windows\System\ClqRtWc.exe
  2⤵
  PID:5568
- C:\Windows\System\mTkRjkv.exe
  C:\Windows\System\mTkRjkv.exe
  2⤵
  PID:5596
- C:\Windows\System\wRzpAaB.exe
  C:\Windows\System\wRzpAaB.exe
  2⤵
  PID:5616
- C:\Windows\System\HwzNzgO.exe
  C:\Windows\System\HwzNzgO.exe
  2⤵
  PID:5640
- C:\Windows\System\XrwaCwO.exe
  C:\Windows\System\XrwaCwO.exe
  2⤵
  PID:5656
- C:\Windows\System\mFUGmMm.exe
  C:\Windows\System\mFUGmMm.exe
  2⤵
  PID:5680
- C:\Windows\System\eJAmeaS.exe
  C:\Windows\System\eJAmeaS.exe
  2⤵
  PID:5696
- C:\Windows\System\HNRekKy.exe
  C:\Windows\System\HNRekKy.exe
  2⤵
  PID:5720
- C:\Windows\System\rfzDUSI.exe
  C:\Windows\System\rfzDUSI.exe
  2⤵
  PID:5748
- C:\Windows\System\YYAFgVy.exe
  C:\Windows\System\YYAFgVy.exe
  2⤵
  PID:5768
- C:\Windows\System\BHZIKez.exe
  C:\Windows\System\BHZIKez.exe
  2⤵
  PID:5792
- C:\Windows\System\NOUkNnm.exe
  C:\Windows\System\NOUkNnm.exe
  2⤵
  PID:5808
- C:\Windows\System\nyQZquH.exe
  C:\Windows\System\nyQZquH.exe
  2⤵
  PID:5836
- C:\Windows\System\FWpIGRd.exe
  C:\Windows\System\FWpIGRd.exe
  2⤵
  PID:5860
- C:\Windows\System\oXHOydq.exe
  C:\Windows\System\oXHOydq.exe
  2⤵
  PID:5884
- C:\Windows\System\LQUNUEb.exe
  C:\Windows\System\LQUNUEb.exe
  2⤵
  PID:5904
- C:\Windows\System\nFsbZUp.exe
  C:\Windows\System\nFsbZUp.exe
  2⤵
  PID:5924
- C:\Windows\System\ddzpYlR.exe
  C:\Windows\System\ddzpYlR.exe
  2⤵
  PID:5944
- C:\Windows\System\pLoZAaY.exe
  C:\Windows\System\pLoZAaY.exe
  2⤵
  PID:5976
- C:\Windows\System\LxCTnKH.exe
  C:\Windows\System\LxCTnKH.exe
  2⤵
  PID:5996
- C:\Windows\System\nmhGpUa.exe
  C:\Windows\System\nmhGpUa.exe
  2⤵
  PID:6024
- C:\Windows\System\gOEXEdE.exe
  C:\Windows\System\gOEXEdE.exe
  2⤵
  PID:6040
- C:\Windows\System\CfvbhmW.exe
  C:\Windows\System\CfvbhmW.exe
  2⤵
  PID:6064
- C:\Windows\System\ameKgPQ.exe
  C:\Windows\System\ameKgPQ.exe
  2⤵
  PID:6084
- C:\Windows\System\xGEuawd.exe
  C:\Windows\System\xGEuawd.exe
  2⤵
  PID:6108
- C:\Windows\System\WdLiCVb.exe
  C:\Windows\System\WdLiCVb.exe
  2⤵
  PID:6124
- C:\Windows\System\pfCbXgG.exe
  C:\Windows\System\pfCbXgG.exe
  2⤵
  PID:316
- C:\Windows\System\dYLkFUs.exe
  C:\Windows\System\dYLkFUs.exe
  2⤵
  PID:5152
- C:\Windows\System\ntyNBZm.exe
  C:\Windows\System\ntyNBZm.exe
  2⤵
  PID:1728
- C:\Windows\System\GxKBIyp.exe
  C:\Windows\System\GxKBIyp.exe
  2⤵
  PID:5176
- C:\Windows\System\BosfjcZ.exe
  C:\Windows\System\BosfjcZ.exe
  2⤵
  PID:3064
- C:\Windows\System\UrntMsZ.exe
  C:\Windows\System\UrntMsZ.exe
  2⤵
  PID:5296
- C:\Windows\System\XlEwgRI.exe
  C:\Windows\System\XlEwgRI.exe
  2⤵
  PID:5204
- C:\Windows\System\RcUyzgx.exe
  C:\Windows\System\RcUyzgx.exe
  2⤵
  PID:5324
- C:\Windows\System\mmMNbmu.exe
  C:\Windows\System\mmMNbmu.exe
  2⤵
  PID:5516
- C:\Windows\System\GMdrvcx.exe
  C:\Windows\System\GMdrvcx.exe
  2⤵
  PID:5396
- C:\Windows\System\iJKLMdE.exe
  C:\Windows\System\iJKLMdE.exe
  2⤵
  PID:5576
- C:\Windows\System\aqYuQpr.exe
  C:\Windows\System\aqYuQpr.exe
  2⤵
  PID:5636
- C:\Windows\System\wMZMySr.exe
  C:\Windows\System\wMZMySr.exe
  2⤵
  PID:5704
- C:\Windows\System\LWHQYnL.exe
  C:\Windows\System\LWHQYnL.exe
  2⤵
  PID:5736
- C:\Windows\System\cUxTfkN.exe
  C:\Windows\System\cUxTfkN.exe
  2⤵
  PID:5520
- C:\Windows\System\UvANQnY.exe
  C:\Windows\System\UvANQnY.exe
  2⤵
  PID:5780
- C:\Windows\System\ZzHyeOu.exe
  C:\Windows\System\ZzHyeOu.exe
  2⤵
  PID:5868
- C:\Windows\System\xeXyoQK.exe
  C:\Windows\System\xeXyoQK.exe
  2⤵
  PID:5912
- C:\Windows\System\WqiBKSB.exe
  C:\Windows\System\WqiBKSB.exe
  2⤵
  PID:5952
- C:\Windows\System\tYhhkSX.exe
  C:\Windows\System\tYhhkSX.exe
  2⤵
  PID:5988
- C:\Windows\System\IAklfTk.exe
  C:\Windows\System\IAklfTk.exe
  2⤵
  PID:6048
- C:\Windows\System\AKqxikG.exe
  C:\Windows\System\AKqxikG.exe
  2⤵
  PID:6076
- C:\Windows\System\HdzrsOo.exe
  C:\Windows\System\HdzrsOo.exe
  2⤵
  PID:4580
- C:\Windows\System\CeJkUZg.exe
  C:\Windows\System\CeJkUZg.exe
  2⤵
  PID:6152
- C:\Windows\System\exhEfTh.exe
  C:\Windows\System\exhEfTh.exe
  2⤵
  PID:6180
- C:\Windows\System\bpWAlac.exe
  C:\Windows\System\bpWAlac.exe
  2⤵
  PID:6200
- C:\Windows\System\KOlhDoy.exe
  C:\Windows\System\KOlhDoy.exe
  2⤵
  PID:6220
- C:\Windows\System\xQWhjjy.exe
  C:\Windows\System\xQWhjjy.exe
  2⤵
  PID:6240
- C:\Windows\System\KYmfNcI.exe
  C:\Windows\System\KYmfNcI.exe
  2⤵
  PID:6264
- C:\Windows\System\ewpstle.exe
  C:\Windows\System\ewpstle.exe
  2⤵
  PID:6280
- C:\Windows\System\ajcXSlH.exe
  C:\Windows\System\ajcXSlH.exe
  2⤵
  PID:6300
- C:\Windows\System\ZDCBXmY.exe
  C:\Windows\System\ZDCBXmY.exe
  2⤵
  PID:6324
- C:\Windows\System\fXIKbEC.exe
  C:\Windows\System\fXIKbEC.exe
  2⤵
  PID:6344
- C:\Windows\System\upkLvPi.exe
  C:\Windows\System\upkLvPi.exe
  2⤵
  PID:6364
- C:\Windows\System\kumxsiG.exe
  C:\Windows\System\kumxsiG.exe
  2⤵
  PID:6388
- C:\Windows\System\luzKrVk.exe
  C:\Windows\System\luzKrVk.exe
  2⤵
  PID:6408
- C:\Windows\System\KoWICdr.exe
  C:\Windows\System\KoWICdr.exe
  2⤵
  PID:6424
- C:\Windows\System\qsVKNcn.exe
  C:\Windows\System\qsVKNcn.exe
  2⤵
  PID:6444
- C:\Windows\System\cYrhqKG.exe
  C:\Windows\System\cYrhqKG.exe
  2⤵
  PID:6468
- C:\Windows\System\qzaTdPR.exe
  C:\Windows\System\qzaTdPR.exe
  2⤵
  PID:6492
- C:\Windows\System\PirPGtM.exe
  C:\Windows\System\PirPGtM.exe
  2⤵
  PID:6520
- C:\Windows\System\pgTbxJk.exe
  C:\Windows\System\pgTbxJk.exe
  2⤵
  PID:6540
- C:\Windows\System\jDxkJse.exe
  C:\Windows\System\jDxkJse.exe
  2⤵
  PID:6556
- C:\Windows\System\lHbqmrt.exe
  C:\Windows\System\lHbqmrt.exe
  2⤵
  PID:6580
- C:\Windows\System\jPWmCjz.exe
  C:\Windows\System\jPWmCjz.exe
  2⤵
  PID:6608
- C:\Windows\System\XHQvLxa.exe
  C:\Windows\System\XHQvLxa.exe
  2⤵
  PID:6628
- C:\Windows\System\IvesQUE.exe
  C:\Windows\System\IvesQUE.exe
  2⤵
  PID:6648
- C:\Windows\System\xehiISi.exe
  C:\Windows\System\xehiISi.exe
  2⤵
  PID:6744
- C:\Windows\System\KfAwjfv.exe
  C:\Windows\System\KfAwjfv.exe
  2⤵
  PID:6772
- C:\Windows\System\JSYsTif.exe
  C:\Windows\System\JSYsTif.exe
  2⤵
  PID:6796
- C:\Windows\System\UykgQfS.exe
  C:\Windows\System\UykgQfS.exe
  2⤵
  PID:6816
- C:\Windows\System\Tjvhiep.exe
  C:\Windows\System\Tjvhiep.exe
  2⤵
  PID:6840
- C:\Windows\System\OHYSAEu.exe
  C:\Windows\System\OHYSAEu.exe
  2⤵
  PID:6860
- C:\Windows\System\hHJQWws.exe
  C:\Windows\System\hHJQWws.exe
  2⤵
  PID:6884
- C:\Windows\System\qZtXwxR.exe
  C:\Windows\System\qZtXwxR.exe
  2⤵
  PID:6900
- C:\Windows\System\uyPfCZW.exe
  C:\Windows\System\uyPfCZW.exe
  2⤵
  PID:6924
- C:\Windows\System\vdbHIip.exe
  C:\Windows\System\vdbHIip.exe
  2⤵
  PID:6944
- C:\Windows\System\GqwhdVV.exe
  C:\Windows\System\GqwhdVV.exe
  2⤵
  PID:6964
- C:\Windows\System\POBzPMR.exe
  C:\Windows\System\POBzPMR.exe
  2⤵
  PID:6992
- C:\Windows\System\igZhxcM.exe
  C:\Windows\System\igZhxcM.exe
  2⤵
  PID:7012
- C:\Windows\System\CrzEmNk.exe
  C:\Windows\System\CrzEmNk.exe
  2⤵
  PID:7036
- C:\Windows\System\XutVqgw.exe
  C:\Windows\System\XutVqgw.exe
  2⤵
  PID:7060
- C:\Windows\System\Efqrnui.exe
  C:\Windows\System\Efqrnui.exe
  2⤵
  PID:7092
- C:\Windows\System\zTpehCG.exe
  C:\Windows\System\zTpehCG.exe
  2⤵
  PID:7112
- C:\Windows\System\CckLSHp.exe
  C:\Windows\System\CckLSHp.exe
  2⤵
  PID:7140
- C:\Windows\System\CSplyNe.exe
  C:\Windows\System\CSplyNe.exe
  2⤵
  PID:7160
- C:\Windows\System\zBFWghH.exe
  C:\Windows\System\zBFWghH.exe
  2⤵
  PID:2160
- C:\Windows\System\AJoYTih.exe
  C:\Windows\System\AJoYTih.exe
  2⤵
  PID:5624
- C:\Windows\System\yTxsTCz.exe
  C:\Windows\System\yTxsTCz.exe
  2⤵
  PID:5480
- C:\Windows\System\XaezKNW.exe
  C:\Windows\System\XaezKNW.exe
  2⤵
  PID:5416
- C:\Windows\System\GYXbHCl.exe
  C:\Windows\System\GYXbHCl.exe
  2⤵
  PID:5676
- C:\Windows\System\CQzuvJh.exe
  C:\Windows\System\CQzuvJh.exe
  2⤵
  PID:6120
- C:\Windows\System\MOcQhtu.exe
  C:\Windows\System\MOcQhtu.exe
  2⤵
  PID:6172
- C:\Windows\System\sfyaiLm.exe
  C:\Windows\System\sfyaiLm.exe
  2⤵
  PID:5916
- C:\Windows\System\UeVFqUY.exe
  C:\Windows\System\UeVFqUY.exe
  2⤵
  PID:6360
- C:\Windows\System\bhdRetA.exe
  C:\Windows\System\bhdRetA.exe
  2⤵
  PID:5340
- C:\Windows\System\DTBQCWE.exe
  C:\Windows\System\DTBQCWE.exe
  2⤵
  PID:5256
- C:\Windows\System\ymNnnJD.exe
  C:\Windows\System\ymNnnJD.exe
  2⤵
  PID:6624
- C:\Windows\System\fwXmbql.exe
  C:\Windows\System\fwXmbql.exe
  2⤵
  PID:6660
- C:\Windows\System\nXMewfQ.exe
  C:\Windows\System\nXMewfQ.exe
  2⤵
  PID:6596
- C:\Windows\System\nHPlmFF.exe
  C:\Windows\System\nHPlmFF.exe
  2⤵
  PID:6436
- C:\Windows\System\asBCwtr.exe
  C:\Windows\System\asBCwtr.exe
  2⤵
  PID:6288
- C:\Windows\System\eKaDxIe.exe
  C:\Windows\System\eKaDxIe.exe
  2⤵
  PID:5148
- C:\Windows\System\ScmrQXk.exe
  C:\Windows\System\ScmrQXk.exe
  2⤵
  PID:6260
- C:\Windows\System\aXOTuXZ.exe
  C:\Windows\System\aXOTuXZ.exe
  2⤵
  PID:6452
- C:\Windows\System\zrNsVPm.exe
  C:\Windows\System\zrNsVPm.exe
  2⤵
  PID:6576
- C:\Windows\System\OOlnNRI.exe
  C:\Windows\System\OOlnNRI.exe
  2⤵
  PID:6032
- C:\Windows\System\bfRByqH.exe
  C:\Windows\System\bfRByqH.exe
  2⤵
  PID:6828
- C:\Windows\System\rGUbizT.exe
  C:\Windows\System\rGUbizT.exe
  2⤵
  PID:6972
- C:\Windows\System\aBYUhCk.exe
  C:\Windows\System\aBYUhCk.exe
  2⤵
  PID:7008
- C:\Windows\System\LsdyEgd.exe
  C:\Windows\System\LsdyEgd.exe
  2⤵
  PID:6700
- C:\Windows\System\PjZOOfk.exe
  C:\Windows\System\PjZOOfk.exe
  2⤵
  PID:7156
- C:\Windows\System\MmdsRGy.exe
  C:\Windows\System\MmdsRGy.exe
  2⤵
  PID:5732
- C:\Windows\System\hLkhSzm.exe
  C:\Windows\System\hLkhSzm.exe
  2⤵
  PID:6552
- C:\Windows\System\QPKZEvJ.exe
  C:\Windows\System\QPKZEvJ.exe
  2⤵
  PID:5960
- C:\Windows\System\gCLpcGa.exe
  C:\Windows\System\gCLpcGa.exe
  2⤵
  PID:7192
- C:\Windows\System\VcIyJBn.exe
  C:\Windows\System\VcIyJBn.exe
  2⤵
  PID:7212
- C:\Windows\System\BVgYzKw.exe
  C:\Windows\System\BVgYzKw.exe
  2⤵
  PID:7232
- C:\Windows\System\whBxBPh.exe
  C:\Windows\System\whBxBPh.exe
  2⤵
  PID:7252
- C:\Windows\System\GYJeCBE.exe
  C:\Windows\System\GYJeCBE.exe
  2⤵
  PID:7276
- C:\Windows\System\zanQfkq.exe
  C:\Windows\System\zanQfkq.exe
  2⤵
  PID:7296
- C:\Windows\System\fQdzUuP.exe
  C:\Windows\System\fQdzUuP.exe
  2⤵
  PID:7316
- C:\Windows\System\RUTnQpy.exe
  C:\Windows\System\RUTnQpy.exe
  2⤵
  PID:7340
- C:\Windows\System\bHWZtoB.exe
  C:\Windows\System\bHWZtoB.exe
  2⤵
  PID:7364
- C:\Windows\System\QNeAVgg.exe
  C:\Windows\System\QNeAVgg.exe
  2⤵
  PID:7384
- C:\Windows\System\PnwNitm.exe
  C:\Windows\System\PnwNitm.exe
  2⤵
  PID:7408
- C:\Windows\System\KLKKvyB.exe
  C:\Windows\System\KLKKvyB.exe
  2⤵
  PID:7424
- C:\Windows\System\rICMcJZ.exe
  C:\Windows\System\rICMcJZ.exe
  2⤵
  PID:7448
- C:\Windows\System\ZJinFmI.exe
  C:\Windows\System\ZJinFmI.exe
  2⤵
  PID:7472
- C:\Windows\System\NKCYhHb.exe
  C:\Windows\System\NKCYhHb.exe
  2⤵
  PID:7492
- C:\Windows\System\iJAMwxh.exe
  C:\Windows\System\iJAMwxh.exe
  2⤵
  PID:7516
- C:\Windows\System\aUAfyhZ.exe
  C:\Windows\System\aUAfyhZ.exe
  2⤵
  PID:7536
- C:\Windows\System\uEJudUh.exe
  C:\Windows\System\uEJudUh.exe
  2⤵
  PID:7560
- C:\Windows\System\gasoahD.exe
  C:\Windows\System\gasoahD.exe
  2⤵
  PID:7580
- C:\Windows\System\RyZskxQ.exe
  C:\Windows\System\RyZskxQ.exe
  2⤵
  PID:7596
- C:\Windows\System\HhvBmrP.exe
  C:\Windows\System\HhvBmrP.exe
  2⤵
  PID:7620
- C:\Windows\System\NKCRpcJ.exe
  C:\Windows\System\NKCRpcJ.exe
  2⤵
  PID:7640
- C:\Windows\System\JsFSkJv.exe
  C:\Windows\System\JsFSkJv.exe
  2⤵
  PID:7656
- C:\Windows\System\yjIqTWD.exe
  C:\Windows\System\yjIqTWD.exe
  2⤵
  PID:7676
- C:\Windows\System\UPgqOgf.exe
  C:\Windows\System\UPgqOgf.exe
  2⤵
  PID:7700
- C:\Windows\System\GwBXzpe.exe
  C:\Windows\System\GwBXzpe.exe
  2⤵
  PID:7724
- C:\Windows\System\BWSTpir.exe
  C:\Windows\System\BWSTpir.exe
  2⤵
  PID:7748
- C:\Windows\System\DVXgDir.exe
  C:\Windows\System\DVXgDir.exe
  2⤵
  PID:7764
- C:\Windows\System\xMpmOKc.exe
  C:\Windows\System\xMpmOKc.exe
  2⤵
  PID:7788
- C:\Windows\System\lXpKiCO.exe
  C:\Windows\System\lXpKiCO.exe
  2⤵
  PID:7816
- C:\Windows\System\pjwXjdQ.exe
  C:\Windows\System\pjwXjdQ.exe
  2⤵
  PID:7836
- C:\Windows\System\mavbpMw.exe
  C:\Windows\System\mavbpMw.exe
  2⤵
  PID:7860
- C:\Windows\System\ElkbxOg.exe
  C:\Windows\System\ElkbxOg.exe
  2⤵
  PID:7880
- C:\Windows\System\sHRSaCR.exe
  C:\Windows\System\sHRSaCR.exe
  2⤵
  PID:7900
- C:\Windows\System\MjDKyTA.exe
  C:\Windows\System\MjDKyTA.exe
  2⤵
  PID:7924
- C:\Windows\System\TbBRmLz.exe
  C:\Windows\System\TbBRmLz.exe
  2⤵
  PID:7944
- C:\Windows\System\AZCdThy.exe
  C:\Windows\System\AZCdThy.exe
  2⤵
  PID:7968
- C:\Windows\System\QxOWdWs.exe
  C:\Windows\System\QxOWdWs.exe
  2⤵
  PID:7988
- C:\Windows\System\ZSIzUNt.exe
  C:\Windows\System\ZSIzUNt.exe
  2⤵
  PID:8012
- C:\Windows\System\UVMdfPT.exe
  C:\Windows\System\UVMdfPT.exe
  2⤵
  PID:8028
- C:\Windows\System\ycrqMCP.exe
  C:\Windows\System\ycrqMCP.exe
  2⤵
  PID:8048
- C:\Windows\System\RsKWAHL.exe
  C:\Windows\System\RsKWAHL.exe
  2⤵
  PID:8072
- C:\Windows\System\KvbnIvt.exe
  C:\Windows\System\KvbnIvt.exe
  2⤵
  PID:8096
- C:\Windows\System\KcFcTZD.exe
  C:\Windows\System\KcFcTZD.exe
  2⤵
  PID:8124
- C:\Windows\System\iSpXuWD.exe
  C:\Windows\System\iSpXuWD.exe
  2⤵
  PID:8148
- C:\Windows\System\XzXxkbg.exe
  C:\Windows\System\XzXxkbg.exe
  2⤵
  PID:8172
- C:\Windows\System\nIiZBPJ.exe
  C:\Windows\System\nIiZBPJ.exe
  2⤵
  PID:6548
- C:\Windows\System\ptFnorn.exe
  C:\Windows\System\ptFnorn.exe
  2⤵
  PID:6396
- C:\Windows\System\aGlxlpa.exe
  C:\Windows\System\aGlxlpa.exe
  2⤵
  PID:6872
- C:\Windows\System\TxyzWYO.exe
  C:\Windows\System\TxyzWYO.exe
  2⤵
  PID:6484
- C:\Windows\System\PJsKnXj.exe
  C:\Windows\System\PJsKnXj.exe
  2⤵
  PID:7128
- C:\Windows\System\PePtGLa.exe
  C:\Windows\System\PePtGLa.exe
  2⤵
  PID:5776
- C:\Windows\System\tFiQFPi.exe
  C:\Windows\System\tFiQFPi.exe
  2⤵
  PID:6668
- C:\Windows\System\FbwlUUa.exe
  C:\Windows\System\FbwlUUa.exe
  2⤵
  PID:6640
- C:\Windows\System\cBalRpT.exe
  C:\Windows\System\cBalRpT.exe
  2⤵
  PID:7284
- C:\Windows\System\UISByIw.exe
  C:\Windows\System\UISByIw.exe
  2⤵
  PID:8264
- C:\Windows\System\ZkrWrBh.exe
  C:\Windows\System\ZkrWrBh.exe
  2⤵
  PID:8280
- C:\Windows\System\dsyJKix.exe
  C:\Windows\System\dsyJKix.exe
  2⤵
  PID:8308
- C:\Windows\System\hhTQegn.exe
  C:\Windows\System\hhTQegn.exe
  2⤵
  PID:8328
- C:\Windows\System\RKpUUNT.exe
  C:\Windows\System\RKpUUNT.exe
  2⤵
  PID:8344
- C:\Windows\System\HbHLdMr.exe
  C:\Windows\System\HbHLdMr.exe
  2⤵
  PID:8364
- C:\Windows\System\CbZecyw.exe
  C:\Windows\System\CbZecyw.exe
  2⤵
  PID:8388
- C:\Windows\System\TraQYvO.exe
  C:\Windows\System\TraQYvO.exe
  2⤵
  PID:8408
- C:\Windows\System\lkyCBlo.exe
  C:\Windows\System\lkyCBlo.exe
  2⤵
  PID:8432
- C:\Windows\System\EmwOsQX.exe
  C:\Windows\System\EmwOsQX.exe
  2⤵
  PID:8460
- C:\Windows\System\IbLkbmG.exe
  C:\Windows\System\IbLkbmG.exe
  2⤵
  PID:8480
- C:\Windows\System\BUuqGbt.exe
  C:\Windows\System\BUuqGbt.exe
  2⤵
  PID:8508
- C:\Windows\System\wceVXpW.exe
  C:\Windows\System\wceVXpW.exe
  2⤵
  PID:8712
- C:\Windows\System\akqNJQZ.exe
  C:\Windows\System\akqNJQZ.exe
  2⤵
  PID:8736
- C:\Windows\System\osVoCRk.exe
  C:\Windows\System\osVoCRk.exe
  2⤵
  PID:8772
- C:\Windows\System\uVlTgwc.exe
  C:\Windows\System\uVlTgwc.exe
  2⤵
  PID:8796
- C:\Windows\System\Ypaopzb.exe
  C:\Windows\System\Ypaopzb.exe
  2⤵
  PID:8816
- C:\Windows\System\fXzNzLR.exe
  C:\Windows\System\fXzNzLR.exe
  2⤵
  PID:8844
- C:\Windows\System\vSVLoCq.exe
  C:\Windows\System\vSVLoCq.exe
  2⤵
  PID:8868
- C:\Windows\System\piScdNr.exe
  C:\Windows\System\piScdNr.exe
  2⤵
  PID:8892
- C:\Windows\System\GSJJfxg.exe
  C:\Windows\System\GSJJfxg.exe
  2⤵
  PID:8916
- C:\Windows\System\HuTplfi.exe
  C:\Windows\System\HuTplfi.exe
  2⤵
  PID:8932
- C:\Windows\System\KuGImmg.exe
  C:\Windows\System\KuGImmg.exe
  2⤵
  PID:8956
- C:\Windows\System\ZHrvsht.exe
  C:\Windows\System\ZHrvsht.exe
  2⤵
  PID:8992
- C:\Windows\System\TBafBKz.exe
  C:\Windows\System\TBafBKz.exe
  2⤵
  PID:9008
- C:\Windows\System\oJAanun.exe
  C:\Windows\System\oJAanun.exe
  2⤵
  PID:9036
- C:\Windows\System\TDKjfEE.exe
  C:\Windows\System\TDKjfEE.exe
  2⤵
  PID:9060
- C:\Windows\System\bteZrzn.exe
  C:\Windows\System\bteZrzn.exe
  2⤵
  PID:9088
- C:\Windows\System\aRexLNi.exe
  C:\Windows\System\aRexLNi.exe
  2⤵
  PID:9112
- C:\Windows\System\klfDjrm.exe
  C:\Windows\System\klfDjrm.exe
  2⤵
  PID:9136
- C:\Windows\System\nVVSoGX.exe
  C:\Windows\System\nVVSoGX.exe
  2⤵
  PID:9160
- C:\Windows\System\bPwKJlK.exe
  C:\Windows\System\bPwKJlK.exe
  2⤵
  PID:9184
- C:\Windows\System\YiXMqXG.exe
  C:\Windows\System\YiXMqXG.exe
  2⤵
  PID:9204
- C:\Windows\System\OMKFTMj.exe
  C:\Windows\System\OMKFTMj.exe
  2⤵
  PID:7632
- C:\Windows\System\IZmmLVZ.exe
  C:\Windows\System\IZmmLVZ.exe
  2⤵
  PID:6316
- C:\Windows\System\wqlTboU.exe
  C:\Windows\System\wqlTboU.exe
  2⤵
  PID:7908
- C:\Windows\System\uFuOqek.exe
  C:\Windows\System\uFuOqek.exe
  2⤵
  PID:8056
- C:\Windows\System\qVVdvEe.exe
  C:\Windows\System\qVVdvEe.exe
  2⤵
  PID:8132
- C:\Windows\System\RmAgfpj.exe
  C:\Windows\System\RmAgfpj.exe
  2⤵
  PID:5804
- C:\Windows\System\GHdYdOp.exe
  C:\Windows\System\GHdYdOp.exe
  2⤵
  PID:6188
- C:\Windows\System\FSvxGWD.exe
  C:\Windows\System\FSvxGWD.exe
  2⤵
  PID:7224
- C:\Windows\System\iCIoAvZ.exe
  C:\Windows\System\iCIoAvZ.exe
  2⤵
  PID:7652
- C:\Windows\System\tzxwKoi.exe
  C:\Windows\System\tzxwKoi.exe
  2⤵
  PID:7796
- C:\Windows\System\dEbAozs.exe
  C:\Windows\System\dEbAozs.exe
  2⤵
  PID:8276
- C:\Windows\System\HOeYOOa.exe
  C:\Windows\System\HOeYOOa.exe
  2⤵
  PID:7940
- C:\Windows\System\HYyhOVs.exe
  C:\Windows\System\HYyhOVs.exe
  2⤵
  PID:8384
- C:\Windows\System\ZXJxRIY.exe
  C:\Windows\System\ZXJxRIY.exe
  2⤵
  PID:3600
- C:\Windows\System\FlUamZd.exe
  C:\Windows\System\FlUamZd.exe
  2⤵
  PID:8524
- C:\Windows\System\kQBFGbq.exe
  C:\Windows\System\kQBFGbq.exe
  2⤵
  PID:5992
- C:\Windows\System\XsVczGE.exe
  C:\Windows\System\XsVczGE.exe
  2⤵
  PID:6476
- C:\Windows\System\bLUzLNV.exe
  C:\Windows\System\bLUzLNV.exe
  2⤵
  PID:7528
- C:\Windows\System\QKCwYEj.exe
  C:\Windows\System\QKCwYEj.exe
  2⤵
  PID:8744
- C:\Windows\System\DxuDqfd.exe
  C:\Windows\System\DxuDqfd.exe
  2⤵
  PID:8804
- C:\Windows\System\HdArNGT.exe
  C:\Windows\System\HdArNGT.exe
  2⤵
  PID:8340
- C:\Windows\System\vKKroWs.exe
  C:\Windows\System\vKKroWs.exe
  2⤵
  PID:8964
- C:\Windows\System\aEHdUlk.exe
  C:\Windows\System\aEHdUlk.exe
  2⤵
  PID:9000
- C:\Windows\System\VvSXILx.exe
  C:\Windows\System\VvSXILx.exe
  2⤵
  PID:8444
- C:\Windows\System\WJLHwQg.exe
  C:\Windows\System\WJLHwQg.exe
  2⤵
  PID:9096
- C:\Windows\System\tkMDKuL.exe
  C:\Windows\System\tkMDKuL.exe
  2⤵
  PID:9224
- C:\Windows\System\tmNbLLy.exe
  C:\Windows\System\tmNbLLy.exe
  2⤵
  PID:9244
- C:\Windows\System\ApSIOHU.exe
  C:\Windows\System\ApSIOHU.exe
  2⤵
  PID:9268
- C:\Windows\System\SwBgZrd.exe
  C:\Windows\System\SwBgZrd.exe
  2⤵
  PID:9292
- C:\Windows\System\TRgMQXa.exe
  C:\Windows\System\TRgMQXa.exe
  2⤵
  PID:9316
- C:\Windows\System\PEHNBbN.exe
  C:\Windows\System\PEHNBbN.exe
  2⤵
  PID:9344
- C:\Windows\System\DkLGQmN.exe
  C:\Windows\System\DkLGQmN.exe
  2⤵
  PID:9372
- C:\Windows\System\jUyLamz.exe
  C:\Windows\System\jUyLamz.exe
  2⤵
  PID:9392
- C:\Windows\System\CIOpWJk.exe
  C:\Windows\System\CIOpWJk.exe
  2⤵
  PID:9412
- C:\Windows\System\ZBDatvB.exe
  C:\Windows\System\ZBDatvB.exe
  2⤵
  PID:9440
- C:\Windows\System\zfuiJTs.exe
  C:\Windows\System\zfuiJTs.exe
  2⤵
  PID:9464
- C:\Windows\System\yBXhsHL.exe
  C:\Windows\System\yBXhsHL.exe
  2⤵
  PID:9484
- C:\Windows\System\QYuloHI.exe
  C:\Windows\System\QYuloHI.exe
  2⤵
  PID:9508
- C:\Windows\System\XBvSWkI.exe
  C:\Windows\System\XBvSWkI.exe
  2⤵
  PID:9528
- C:\Windows\System\TryCPLL.exe
  C:\Windows\System\TryCPLL.exe
  2⤵
  PID:9544
- C:\Windows\System\blXYCUc.exe
  C:\Windows\System\blXYCUc.exe
  2⤵
  PID:9564
- C:\Windows\System\SQtFpup.exe
  C:\Windows\System\SQtFpup.exe
  2⤵
  PID:9580
- C:\Windows\System\EDcoTlZ.exe
  C:\Windows\System\EDcoTlZ.exe
  2⤵
  PID:9600
- C:\Windows\System\ESwLANP.exe
  C:\Windows\System\ESwLANP.exe
  2⤵
  PID:9616
- C:\Windows\System\ftSixXc.exe
  C:\Windows\System\ftSixXc.exe
  2⤵
  PID:9636
- C:\Windows\System\megFDLC.exe
  C:\Windows\System\megFDLC.exe
  2⤵
  PID:9656
- C:\Windows\System\SMDhIyP.exe
  C:\Windows\System\SMDhIyP.exe
  2⤵
  PID:9676
- C:\Windows\System\hpVouWI.exe
  C:\Windows\System\hpVouWI.exe
  2⤵
  PID:9696
- C:\Windows\System\EKlQcbU.exe
  C:\Windows\System\EKlQcbU.exe
  2⤵
  PID:9716
- C:\Windows\System\AompiAA.exe
  C:\Windows\System\AompiAA.exe
  2⤵
  PID:9736
- C:\Windows\System\fRacSIP.exe
  C:\Windows\System\fRacSIP.exe
  2⤵
  PID:9756
- C:\Windows\System\mdotBqG.exe
  C:\Windows\System\mdotBqG.exe
  2⤵
  PID:9780
- C:\Windows\System\dxQoeBx.exe
  C:\Windows\System\dxQoeBx.exe
  2⤵
  PID:9800
- C:\Windows\System\YLAaJPz.exe
  C:\Windows\System\YLAaJPz.exe
  2⤵
  PID:9824
- C:\Windows\System\DmrcGaY.exe
  C:\Windows\System\DmrcGaY.exe
  2⤵
  PID:9844
- C:\Windows\System\eTSkauS.exe
  C:\Windows\System\eTSkauS.exe
  2⤵
  PID:9872
- C:\Windows\System\FiVJVwo.exe
  C:\Windows\System\FiVJVwo.exe
  2⤵
  PID:9892
- C:\Windows\System\SbhGFRU.exe
  C:\Windows\System\SbhGFRU.exe
  2⤵
  PID:9916
- C:\Windows\System\nIxuvtG.exe
  C:\Windows\System\nIxuvtG.exe
  2⤵
  PID:9944
- C:\Windows\System\jsVCPyq.exe
  C:\Windows\System\jsVCPyq.exe
  2⤵
  PID:9964
- C:\Windows\System\Memknbt.exe
  C:\Windows\System\Memknbt.exe
  2⤵
  PID:9988
- C:\Windows\System\qEGDJyR.exe
  C:\Windows\System\qEGDJyR.exe
  2⤵
  PID:10008
- C:\Windows\System\TEiezUb.exe
  C:\Windows\System\TEiezUb.exe
  2⤵
  PID:10028
- C:\Windows\System\RTpYODq.exe
  C:\Windows\System\RTpYODq.exe
  2⤵
  PID:10048
- C:\Windows\System\roVRblR.exe
  C:\Windows\System\roVRblR.exe
  2⤵
  PID:10072
- C:\Windows\System\kICkXTB.exe
  C:\Windows\System\kICkXTB.exe
  2⤵
  PID:10096
- C:\Windows\System\LySOUoD.exe
  C:\Windows\System\LySOUoD.exe
  2⤵
  PID:10112
- C:\Windows\System\CgyVmfR.exe
  C:\Windows\System\CgyVmfR.exe
  2⤵
  PID:10132
- C:\Windows\System\uofnwCw.exe
  C:\Windows\System\uofnwCw.exe
  2⤵
  PID:10168
- C:\Windows\System\JFAgSNn.exe
  C:\Windows\System\JFAgSNn.exe
  2⤵
  PID:10184
- C:\Windows\System\FHaHnKc.exe
  C:\Windows\System\FHaHnKc.exe
  2⤵
  PID:10216
- C:\Windows\System\DgOyMQg.exe
  C:\Windows\System\DgOyMQg.exe
  2⤵
  PID:10236
- C:\Windows\System\rnlalJB.exe
  C:\Windows\System\rnlalJB.exe
  2⤵
  PID:9212
- C:\Windows\System\UIhImGo.exe
  C:\Windows\System\UIhImGo.exe
  2⤵
  PID:7684
- C:\Windows\System\DlMaIAn.exe
  C:\Windows\System\DlMaIAn.exe
  2⤵
  PID:8604
- C:\Windows\System\TEUfkfw.exe
  C:\Windows\System\TEUfkfw.exe
  2⤵
  PID:7336
- C:\Windows\System\TYKoabz.exe
  C:\Windows\System\TYKoabz.exe
  2⤵
  PID:8720
- C:\Windows\System\fhUlAfv.exe
  C:\Windows\System\fhUlAfv.exe
  2⤵
  PID:8316
- C:\Windows\System\LFAcgUi.exe
  C:\Windows\System\LFAcgUi.exe
  2⤵
  PID:8024
- C:\Windows\System\akdMiXm.exe
  C:\Windows\System\akdMiXm.exe
  2⤵
  PID:8336
- C:\Windows\System\AvrqNnR.exe
  C:\Windows\System\AvrqNnR.exe
  2⤵
  PID:9056
- C:\Windows\System\rASGezU.exe
  C:\Windows\System\rASGezU.exe
  2⤵
  PID:8564
- C:\Windows\System\vUmiSMp.exe
  C:\Windows\System\vUmiSMp.exe
  2⤵
  PID:9312
- C:\Windows\System\hmAffji.exe
  C:\Windows\System\hmAffji.exe
  2⤵
  PID:9384
- C:\Windows\System\mSiiUFM.exe
  C:\Windows\System\mSiiUFM.exe
  2⤵
  PID:9432
- C:\Windows\System\jNOZuGf.exe
  C:\Windows\System\jNOZuGf.exe
  2⤵
  PID:9480
- C:\Windows\System\IZuobqX.exe
  C:\Windows\System\IZuobqX.exe
  2⤵
  PID:8688
- C:\Windows\System\frKitUR.exe
  C:\Windows\System\frKitUR.exe
  2⤵
  PID:9540
- C:\Windows\System\hwTvuls.exe
  C:\Windows\System\hwTvuls.exe
  2⤵
  PID:9588
- C:\Windows\System\WuVSOEW.exe
  C:\Windows\System\WuVSOEW.exe
  2⤵
  PID:1048
- C:\Windows\System\qDiheBB.exe
  C:\Windows\System\qDiheBB.exe
  2⤵
  PID:9632
- C:\Windows\System\CsFovFa.exe
  C:\Windows\System\CsFovFa.exe
  2⤵
  PID:8824
- C:\Windows\System\JYMOiPW.exe
  C:\Windows\System\JYMOiPW.exe
  2⤵
  PID:7876
- C:\Windows\System\eERUKww.exe
  C:\Windows\System\eERUKww.exe
  2⤵
  PID:8860
- C:\Windows\System\YGmIVss.exe
  C:\Windows\System\YGmIVss.exe
  2⤵
  PID:1888
- C:\Windows\System\NWPiVsk.exe
  C:\Windows\System\NWPiVsk.exe
  2⤵
  PID:8168
- C:\Windows\System\gERFnFj.exe
  C:\Windows\System\gERFnFj.exe
  2⤵
  PID:8972
- C:\Windows\System\duaAOYc.exe
  C:\Windows\System\duaAOYc.exe
  2⤵
  PID:9900
- C:\Windows\System\EpowvMa.exe
  C:\Windows\System\EpowvMa.exe
  2⤵
  PID:10256
- C:\Windows\System\BbZZUrw.exe
  C:\Windows\System\BbZZUrw.exe
  2⤵
  PID:10280
- C:\Windows\System\KxITnPx.exe
  C:\Windows\System\KxITnPx.exe
  2⤵
  PID:10304
- C:\Windows\System\htgguGg.exe
  C:\Windows\System\htgguGg.exe
  2⤵
  PID:10324
- C:\Windows\System\lVrqvUz.exe
  C:\Windows\System\lVrqvUz.exe
  2⤵
  PID:10352
- C:\Windows\System\IkhUxUk.exe
  C:\Windows\System\IkhUxUk.exe
  2⤵
  PID:10368
- C:\Windows\System\ffyHOlP.exe
  C:\Windows\System\ffyHOlP.exe
  2⤵
  PID:10388
- C:\Windows\System\yzeEjSi.exe
  C:\Windows\System\yzeEjSi.exe
  2⤵
  PID:10416
- C:\Windows\System\ceUziiQ.exe
  C:\Windows\System\ceUziiQ.exe
  2⤵
  PID:10436
- C:\Windows\System\csndXXC.exe
  C:\Windows\System\csndXXC.exe
  2⤵
  PID:10452
- C:\Windows\System\rEBytaI.exe
  C:\Windows\System\rEBytaI.exe
  2⤵
  PID:10468
- C:\Windows\System\IAFzPrm.exe
  C:\Windows\System\IAFzPrm.exe
  2⤵
  PID:10484
- C:\Windows\System\BZcHcbS.exe
  C:\Windows\System\BZcHcbS.exe
  2⤵
  PID:10504
- C:\Windows\System\kieyUsH.exe
  C:\Windows\System\kieyUsH.exe
  2⤵
  PID:10528
- C:\Windows\System\tFktmVT.exe
  C:\Windows\System\tFktmVT.exe
  2⤵
  PID:10548
- C:\Windows\System\wkHxdGc.exe
  C:\Windows\System\wkHxdGc.exe
  2⤵
  PID:10572
- C:\Windows\System\yfqAVcK.exe
  C:\Windows\System\yfqAVcK.exe
  2⤵
  PID:10592
- C:\Windows\System\mgdNZxf.exe
  C:\Windows\System\mgdNZxf.exe
  2⤵
  PID:10612
- C:\Windows\System\RCIKfKU.exe
  C:\Windows\System\RCIKfKU.exe
  2⤵
  PID:10636
- C:\Windows\System\isyoeze.exe
  C:\Windows\System\isyoeze.exe
  2⤵
  PID:10660
- C:\Windows\System\kiWpNnZ.exe
  C:\Windows\System\kiWpNnZ.exe
  2⤵
  PID:10688
- C:\Windows\System\wSygmna.exe
  C:\Windows\System\wSygmna.exe
  2⤵
  PID:10708
- C:\Windows\System\zLqYKAt.exe
  C:\Windows\System\zLqYKAt.exe
  2⤵
  PID:10736
- C:\Windows\System\kVEZUQR.exe
  C:\Windows\System\kVEZUQR.exe
  2⤵
  PID:10760
- C:\Windows\System\iLscwGb.exe
  C:\Windows\System\iLscwGb.exe
  2⤵
  PID:10784
- C:\Windows\System\MHqYqVK.exe
  C:\Windows\System\MHqYqVK.exe
  2⤵
  PID:10804
- C:\Windows\System\nFYoIfy.exe
  C:\Windows\System\nFYoIfy.exe
  2⤵
  PID:10828
- C:\Windows\System\AmTRYrd.exe
  C:\Windows\System\AmTRYrd.exe
  2⤵
  PID:10848
- C:\Windows\System\uerHCjJ.exe
  C:\Windows\System\uerHCjJ.exe
  2⤵
  PID:10872
- C:\Windows\System\MhbrZnL.exe
  C:\Windows\System\MhbrZnL.exe
  2⤵
  PID:10888
- C:\Windows\System\BkahyIH.exe
  C:\Windows\System\BkahyIH.exe
  2⤵
  PID:10912
- C:\Windows\System\eIWMviq.exe
  C:\Windows\System\eIWMviq.exe
  2⤵
  PID:10940
- C:\Windows\System\blcCrSa.exe
  C:\Windows\System\blcCrSa.exe
  2⤵
  PID:10956
- C:\Windows\System\yWfwIiA.exe
  C:\Windows\System\yWfwIiA.exe
  2⤵
  PID:10984
- C:\Windows\System\fxhgmLs.exe
  C:\Windows\System\fxhgmLs.exe
  2⤵
  PID:11004
- C:\Windows\System\JYQbkfm.exe
  C:\Windows\System\JYQbkfm.exe
  2⤵
  PID:11024
- C:\Windows\System\uOSRIuX.exe
  C:\Windows\System\uOSRIuX.exe
  2⤵
  PID:11048
- C:\Windows\System\KbRdOQB.exe
  C:\Windows\System\KbRdOQB.exe
  2⤵
  PID:11072
- C:\Windows\System\tnPZglM.exe
  C:\Windows\System\tnPZglM.exe
  2⤵
  PID:11092
- C:\Windows\System\dEvbnAI.exe
  C:\Windows\System\dEvbnAI.exe
  2⤵
  PID:11108
- C:\Windows\System\wCWNWTy.exe
  C:\Windows\System\wCWNWTy.exe
  2⤵
  PID:11128
- C:\Windows\System\niMrcxN.exe
  C:\Windows\System\niMrcxN.exe
  2⤵
  PID:11152
- C:\Windows\System\CptttOz.exe
  C:\Windows\System\CptttOz.exe
  2⤵
  PID:11172
- C:\Windows\System\ZSNwZAV.exe
  C:\Windows\System\ZSNwZAV.exe
  2⤵
  PID:11192
- C:\Windows\System\vqTNmXc.exe
  C:\Windows\System\vqTNmXc.exe
  2⤵
  PID:11216
- C:\Windows\System\LaYuNbX.exe
  C:\Windows\System\LaYuNbX.exe
  2⤵
  PID:11240
- C:\Windows\System\pxPIkdl.exe
  C:\Windows\System\pxPIkdl.exe
  2⤵
  PID:11260
- C:\Windows\System\avSstps.exe
  C:\Windows\System\avSstps.exe
  2⤵
  PID:8428
- C:\Windows\System\tWHISpe.exe
  C:\Windows\System\tWHISpe.exe
  2⤵
  PID:9080
- C:\Windows\System\byzLeIb.exe
  C:\Windows\System\byzLeIb.exe
  2⤵
  PID:10044
- C:\Windows\System\TMIncMm.exe
  C:\Windows\System\TMIncMm.exe
  2⤵
  PID:10104
- C:\Windows\System\HfcMeRx.exe
  C:\Windows\System\HfcMeRx.exe
  2⤵
  PID:7744
- C:\Windows\System\rYRmODk.exe
  C:\Windows\System\rYRmODk.exe
  2⤵
  PID:10180
- C:\Windows\System\XBJLaXe.exe
  C:\Windows\System\XBJLaXe.exe
  2⤵
  PID:6808
- C:\Windows\System\ZCnjZMQ.exe
  C:\Windows\System\ZCnjZMQ.exe
  2⤵
  PID:9516
- C:\Windows\System\ccevCSF.exe
  C:\Windows\System\ccevCSF.exe
  2⤵
  PID:8672
- C:\Windows\System\QzIPfAy.exe
  C:\Windows\System\QzIPfAy.exe
  2⤵
  PID:1892
- C:\Windows\System\nOqEbVv.exe
  C:\Windows\System\nOqEbVv.exe
  2⤵
  PID:9668
- C:\Windows\System\yGtneiH.exe
  C:\Windows\System\yGtneiH.exe
  2⤵
  PID:8324
- C:\Windows\System\BircqiW.exe
  C:\Windows\System\BircqiW.exe
  2⤵
  PID:3872
- C:\Windows\System\IwRxlpI.exe
  C:\Windows\System\IwRxlpI.exe
  2⤵
  PID:216
- C:\Windows\System\tRhMDCY.exe
  C:\Windows\System\tRhMDCY.exe
  2⤵
  PID:9684
- C:\Windows\System\qbqIyhH.exe
  C:\Windows\System\qbqIyhH.exe
  2⤵
  PID:8924
- C:\Windows\System\mZFRiCK.exe
  C:\Windows\System\mZFRiCK.exe
  2⤵
  PID:8784
- C:\Windows\System\wkSaHGP.exe
  C:\Windows\System\wkSaHGP.exe
  2⤵
  PID:10272
- C:\Windows\System\bYghKRH.exe
  C:\Windows\System\bYghKRH.exe
  2⤵
  PID:8416
- C:\Windows\System\JbzDHKr.exe
  C:\Windows\System\JbzDHKr.exe
  2⤵
  PID:9980
- C:\Windows\System\gxwIbvO.exe
  C:\Windows\System\gxwIbvO.exe
  2⤵
  PID:3040
- C:\Windows\System\RmnShIw.exe
  C:\Windows\System\RmnShIw.exe
  2⤵
  PID:10464
- C:\Windows\System\qualzJO.exe
  C:\Windows\System\qualzJO.exe
  2⤵
  PID:10068
- C:\Windows\System\qqXCwQS.exe
  C:\Windows\System\qqXCwQS.exe
  2⤵
  PID:11268
- C:\Windows\System\YLWjFVE.exe
  C:\Windows\System\YLWjFVE.exe
  2⤵
  PID:11288
- C:\Windows\System\cMUSsHG.exe
  C:\Windows\System\cMUSsHG.exe
  2⤵
  PID:11312
- C:\Windows\System\JhnPMyd.exe
  C:\Windows\System\JhnPMyd.exe
  2⤵
  PID:11332
- C:\Windows\System\wcQlosh.exe
  C:\Windows\System\wcQlosh.exe
  2⤵
  PID:11348
- C:\Windows\System\mZCdFlu.exe
  C:\Windows\System\mZCdFlu.exe
  2⤵
  PID:11364
- C:\Windows\System\Svlqoor.exe
  C:\Windows\System\Svlqoor.exe
  2⤵
  PID:11384
- C:\Windows\System\FRWHpFP.exe
  C:\Windows\System\FRWHpFP.exe
  2⤵
  PID:11400
- C:\Windows\System\ivAhnME.exe
  C:\Windows\System\ivAhnME.exe
  2⤵
  PID:11416
- C:\Windows\System\eeTBofR.exe
  C:\Windows\System\eeTBofR.exe
  2⤵
  PID:11432
- C:\Windows\System\gJEwCuo.exe
  C:\Windows\System\gJEwCuo.exe
  2⤵
  PID:11456
- C:\Windows\System\KODyDBH.exe
  C:\Windows\System\KODyDBH.exe
  2⤵
  PID:11476
- C:\Windows\System\ndjXprN.exe
  C:\Windows\System\ndjXprN.exe
  2⤵
  PID:11496
- C:\Windows\System\wYKXlIr.exe
  C:\Windows\System\wYKXlIr.exe
  2⤵
  PID:11520
- C:\Windows\System\CwcXQAC.exe
  C:\Windows\System\CwcXQAC.exe
  2⤵
  PID:11540
- C:\Windows\System\PCkyvif.exe
  C:\Windows\System\PCkyvif.exe
  2⤵
  PID:11560
- C:\Windows\System\RHeJllk.exe
  C:\Windows\System\RHeJllk.exe
  2⤵
  PID:11584
- C:\Windows\System\owGJmQD.exe
  C:\Windows\System\owGJmQD.exe
  2⤵
  PID:11604
- C:\Windows\System\KlVCMYU.exe
  C:\Windows\System\KlVCMYU.exe
  2⤵
  PID:11624
- C:\Windows\System\WqvvGuQ.exe
  C:\Windows\System\WqvvGuQ.exe
  2⤵
  PID:11652
- C:\Windows\System\DedaBmQ.exe
  C:\Windows\System\DedaBmQ.exe
  2⤵
  PID:11672
- C:\Windows\System\TQeQlah.exe
  C:\Windows\System\TQeQlah.exe
  2⤵
  PID:11696
- C:\Windows\System\aWMQAGb.exe
  C:\Windows\System\aWMQAGb.exe
  2⤵
  PID:11720
- C:\Windows\System\oVvpNWF.exe
  C:\Windows\System\oVvpNWF.exe
  2⤵
  PID:11736
- C:\Windows\System\rHjGSVQ.exe
  C:\Windows\System\rHjGSVQ.exe
  2⤵
  PID:11756
- C:\Windows\System\CKwrLEo.exe
  C:\Windows\System\CKwrLEo.exe
  2⤵
  PID:11784
- C:\Windows\System\GoDDvZg.exe
  C:\Windows\System\GoDDvZg.exe
  2⤵
  PID:11808
- C:\Windows\System\acBIxDL.exe
  C:\Windows\System\acBIxDL.exe
  2⤵
  PID:11840
- C:\Windows\System\HXpjbEp.exe
  C:\Windows\System\HXpjbEp.exe
  2⤵
  PID:11864
- C:\Windows\System\RGbjMSI.exe
  C:\Windows\System\RGbjMSI.exe
  2⤵
  PID:11884
- C:\Windows\System\xONdmGI.exe
  C:\Windows\System\xONdmGI.exe
  2⤵
  PID:11908
- C:\Windows\System\kMOQYdI.exe
  C:\Windows\System\kMOQYdI.exe
  2⤵
  PID:11936
- C:\Windows\System\XjipqbO.exe
  C:\Windows\System\XjipqbO.exe
  2⤵
  PID:11956
- C:\Windows\System\cddALFQ.exe
  C:\Windows\System\cddALFQ.exe
  2⤵
  PID:11980
- C:\Windows\System\iuORfHQ.exe
  C:\Windows\System\iuORfHQ.exe
  2⤵
  PID:12000
- C:\Windows\System\IjQoKxS.exe
  C:\Windows\System\IjQoKxS.exe
  2⤵
  PID:12024
- C:\Windows\System\jwGFpsU.exe
  C:\Windows\System\jwGFpsU.exe
  2⤵
  PID:12048
- C:\Windows\System\Srntfae.exe
  C:\Windows\System\Srntfae.exe
  2⤵
  PID:12068
- C:\Windows\System\BhFgMaX.exe
  C:\Windows\System\BhFgMaX.exe
  2⤵
  PID:12088
- C:\Windows\System\RqWyhGy.exe
  C:\Windows\System\RqWyhGy.exe
  2⤵
  PID:12116
- C:\Windows\System\uvDQydU.exe
  C:\Windows\System\uvDQydU.exe
  2⤵
  PID:12140
- C:\Windows\System\LQtcwuG.exe
  C:\Windows\System\LQtcwuG.exe
  2⤵
  PID:12156
- C:\Windows\System\AoNoJnW.exe
  C:\Windows\System\AoNoJnW.exe
  2⤵
  PID:12176
- C:\Windows\System\WGsMrbm.exe
  C:\Windows\System\WGsMrbm.exe
  2⤵
  PID:12196
- C:\Windows\System\iLwvfXt.exe
  C:\Windows\System\iLwvfXt.exe
  2⤵
  PID:12216
- C:\Windows\System\DlqjAxW.exe
  C:\Windows\System\DlqjAxW.exe
  2⤵
  PID:12236
- C:\Windows\System\NtvKpbe.exe
  C:\Windows\System\NtvKpbe.exe
  2⤵
  PID:12260
- C:\Windows\System\uxDrHbH.exe
  C:\Windows\System\uxDrHbH.exe
  2⤵
  PID:12280
- C:\Windows\System\xwtLfIv.exe
  C:\Windows\System\xwtLfIv.exe
  2⤵
  PID:10124
- C:\Windows\System\pFVvnPe.exe
  C:\Windows\System\pFVvnPe.exe
  2⤵
  PID:10176
- C:\Windows\System\mDAiNlW.exe
  C:\Windows\System\mDAiNlW.exe
  2⤵
  PID:10700
- C:\Windows\System\ohkFELQ.exe
  C:\Windows\System\ohkFELQ.exe
  2⤵
  PID:10724
- C:\Windows\System\pWSLXhG.exe
  C:\Windows\System\pWSLXhG.exe
  2⤵
  PID:10896
- C:\Windows\System\wsrwAuQ.exe
  C:\Windows\System\wsrwAuQ.exe
  2⤵
  PID:10972
- C:\Windows\System\KhnJpGG.exe
  C:\Windows\System\KhnJpGG.exe
  2⤵
  PID:8728
- C:\Windows\System\nqvtgDk.exe
  C:\Windows\System\nqvtgDk.exe
  2⤵
  PID:11124
- C:\Windows\System\gOkTgOl.exe
  C:\Windows\System\gOkTgOl.exe
  2⤵
  PID:9772
- C:\Windows\System\CmntSYc.exe
  C:\Windows\System\CmntSYc.exe
  2⤵
  PID:9812
- C:\Windows\System\riheBGP.exe
  C:\Windows\System\riheBGP.exe
  2⤵
  PID:10040
- C:\Windows\System\NMJZyEt.exe
  C:\Windows\System\NMJZyEt.exe
  2⤵
  PID:9200
- C:\Windows\System\CGZFOcr.exe
  C:\Windows\System\CGZFOcr.exe
  2⤵
  PID:9356
- C:\Windows\System\aFBJSdo.exe
  C:\Windows\System\aFBJSdo.exe
  2⤵
  PID:6656
- C:\Windows\System\DZhbTvt.exe
  C:\Windows\System\DZhbTvt.exe
  2⤵
  PID:8108
- C:\Windows\System\rOzxNNe.exe
  C:\Windows\System\rOzxNNe.exe
  2⤵
  PID:8296
- C:\Windows\System\ScxWJBw.exe
  C:\Windows\System\ScxWJBw.exe
  2⤵
  PID:10292
- C:\Windows\System\dBlbQkv.exe
  C:\Windows\System\dBlbQkv.exe
  2⤵
  PID:9952
- C:\Windows\System\YCGaXvb.exe
  C:\Windows\System\YCGaXvb.exe
  2⤵
  PID:10020
- C:\Windows\System\JakuUPP.exe
  C:\Windows\System\JakuUPP.exe
  2⤵
  PID:9888
- C:\Windows\System\sqxiwCu.exe
  C:\Windows\System\sqxiwCu.exe
  2⤵
  PID:8584
- C:\Windows\System\fFVgwEN.exe
  C:\Windows\System\fFVgwEN.exe
  2⤵
  PID:10496
- C:\Windows\System\ODNdBxR.exe
  C:\Windows\System\ODNdBxR.exe
  2⤵
  PID:10564
- C:\Windows\System\hhyDrGo.exe
  C:\Windows\System\hhyDrGo.exe
  2⤵
  PID:12300
- C:\Windows\System\nFtfqxU.exe
  C:\Windows\System\nFtfqxU.exe
  2⤵
  PID:12324
- C:\Windows\System\xRhGgkL.exe
  C:\Windows\System\xRhGgkL.exe
  2⤵
  PID:12344
- C:\Windows\System\nnTyeJu.exe
  C:\Windows\System\nnTyeJu.exe
  2⤵
  PID:12360
- C:\Windows\System\eQWrzfu.exe
  C:\Windows\System\eQWrzfu.exe
  2⤵
  PID:12376
- C:\Windows\System\wqlqPgH.exe
  C:\Windows\System\wqlqPgH.exe
  2⤵
  PID:12396
- C:\Windows\System\ScLzeXE.exe
  C:\Windows\System\ScLzeXE.exe
  2⤵
  PID:12420
- C:\Windows\System\XLJxrwx.exe
  C:\Windows\System\XLJxrwx.exe
  2⤵
  PID:12440
- C:\Windows\System\EQCbkmK.exe
  C:\Windows\System\EQCbkmK.exe
  2⤵
  PID:12468
- C:\Windows\System\GPWCRMX.exe
  C:\Windows\System\GPWCRMX.exe
  2⤵
  PID:12496
- C:\Windows\System\NhrNIHC.exe
  C:\Windows\System\NhrNIHC.exe
  2⤵
  PID:12520
- C:\Windows\System\avHqSsc.exe
  C:\Windows\System\avHqSsc.exe
  2⤵
  PID:12548
- C:\Windows\System\jYJyBEC.exe
  C:\Windows\System\jYJyBEC.exe
  2⤵
  PID:12576
- C:\Windows\System\txBjCdA.exe
  C:\Windows\System\txBjCdA.exe
  2⤵
  PID:12600
- C:\Windows\System\Kyqvwjr.exe
  C:\Windows\System\Kyqvwjr.exe
  2⤵
  PID:12640
- C:\Windows\System\JbHfWBb.exe
  C:\Windows\System\JbHfWBb.exe
  2⤵
  PID:12668
- C:\Windows\System\vvuZFNZ.exe
  C:\Windows\System\vvuZFNZ.exe
  2⤵
  PID:12692
- C:\Windows\System\uyucoIN.exe
  C:\Windows\System\uyucoIN.exe
  2⤵
  PID:12708
- C:\Windows\System\ZOmQPSb.exe
  C:\Windows\System\ZOmQPSb.exe
  2⤵
  PID:12732
- C:\Windows\System\GzPhedh.exe
  C:\Windows\System\GzPhedh.exe
  2⤵
  PID:12760
- C:\Windows\System\DOEtQNt.exe
  C:\Windows\System\DOEtQNt.exe
  2⤵
  PID:12792
- C:\Windows\System\hrBJNkj.exe
  C:\Windows\System\hrBJNkj.exe
  2⤵
  PID:12820
- C:\Windows\System\VQiMmXy.exe
  C:\Windows\System\VQiMmXy.exe
  2⤵
  PID:12852
- C:\Windows\System\ucfURFy.exe
  C:\Windows\System\ucfURFy.exe
  2⤵
  PID:12876
- C:\Windows\System\ozDkmZU.exe
  C:\Windows\System\ozDkmZU.exe
  2⤵
  PID:12896
- C:\Windows\System\ZDDxRGr.exe
  C:\Windows\System\ZDDxRGr.exe
  2⤵
  PID:12920
- C:\Windows\System\CXWsHGm.exe
  C:\Windows\System\CXWsHGm.exe
  2⤵
  PID:12952
- C:\Windows\System\cOWxdiY.exe
  C:\Windows\System\cOWxdiY.exe
  2⤵
  PID:12980
- C:\Windows\System\IcaZyDx.exe
  C:\Windows\System\IcaZyDx.exe
  2⤵
  PID:13000
- C:\Windows\System\FhrApWj.exe
  C:\Windows\System\FhrApWj.exe
  2⤵
  PID:13020
- C:\Windows\System\XkZgvsE.exe
  C:\Windows\System\XkZgvsE.exe
  2⤵
  PID:7976
- C:\Windows\System\fesrnXR.exe
  C:\Windows\System\fesrnXR.exe
  2⤵
  PID:9428
- C:\Windows\System\WNQkOJR.exe
  C:\Windows\System\WNQkOJR.exe
  2⤵
  PID:12148
- C:\Windows\System\AbfjSSH.exe
  C:\Windows\System\AbfjSSH.exe
  2⤵
  PID:11212
- C:\Windows\System\dsDcPva.exe
  C:\Windows\System\dsDcPva.exe
  2⤵
  PID:12228
- C:\Windows\System\gtKdPRo.exe
  C:\Windows\System\gtKdPRo.exe
  2⤵
  PID:12276
- C:\Windows\System\sCoNRCA.exe
  C:\Windows\System\sCoNRCA.exe
  2⤵
  PID:9352
- C:\Windows\System\DlvmhzW.exe
  C:\Windows\System\DlvmhzW.exe
  2⤵
  PID:9192
- C:\Windows\System\CjFhAsv.exe
  C:\Windows\System\CjFhAsv.exe
  2⤵
  PID:10932
- C:\Windows\System\xPrzfQE.exe
  C:\Windows\System\xPrzfQE.exe
  2⤵
  PID:8472
- C:\Windows\System\iWLsVFZ.exe
  C:\Windows\System\iWLsVFZ.exe
  2⤵
  PID:11188
- C:\Windows\System\dmVOFrm.exe
  C:\Windows\System\dmVOFrm.exe
  2⤵
  PID:9648
- C:\Windows\System\QIeZFpY.exe
  C:\Windows\System\QIeZFpY.exe
  2⤵
  PID:10424
- C:\Windows\System\ugJpjPP.exe
  C:\Windows\System\ugJpjPP.exe
  2⤵
  PID:8004
- C:\Windows\System\LofSLjH.exe
  C:\Windows\System\LofSLjH.exe
  2⤵
  PID:10584
- C:\Windows\System\mIuQsxF.exe
  C:\Windows\System\mIuQsxF.exe
  2⤵
  PID:12292
- C:\Windows\System\ilgVINH.exe
  C:\Windows\System\ilgVINH.exe
  2⤵
  PID:12296
- C:\Windows\System\VDiYzYw.exe
  C:\Windows\System\VDiYzYw.exe
  2⤵
  PID:11448
- C:\Windows\System\VyazECe.exe
  C:\Windows\System\VyazECe.exe
  2⤵
  PID:10780
- C:\Windows\System\LcYsdmL.exe
  C:\Windows\System\LcYsdmL.exe
  2⤵
  PID:11708
- C:\Windows\System\EkgGKmh.exe
  C:\Windows\System\EkgGKmh.exe
  2⤵
  PID:11848
- C:\Windows\System\OLggojN.exe
  C:\Windows\System\OLggojN.exe
  2⤵
  PID:12660
- C:\Windows\System\IFazGtP.exe
  C:\Windows\System\IFazGtP.exe
  2⤵
  PID:11876
- C:\Windows\System\XegrLWd.exe
  C:\Windows\System\XegrLWd.exe
  2⤵
  PID:11144
- C:\Windows\System\vjaDAOd.exe
  C:\Windows\System\vjaDAOd.exe
  2⤵
  PID:12132
- C:\Windows\System\NqrchVn.exe
  C:\Windows\System\NqrchVn.exe
  2⤵
  PID:12916
- C:\Windows\System\OJPLsJe.exe
  C:\Windows\System\OJPLsJe.exe
  2⤵
  PID:8440
- C:\Windows\System\uaWTNAM.exe
  C:\Windows\System\uaWTNAM.exe
  2⤵
  PID:10756
- C:\Windows\System\vyNfxDT.exe
  C:\Windows\System\vyNfxDT.exe
  2⤵
  PID:13096
- C:\Windows\System\wZnIvCY.exe
  C:\Windows\System\wZnIvCY.exe
  2⤵
  PID:7208
- C:\Windows\System\XAihYdG.exe
  C:\Windows\System\XAihYdG.exe
  2⤵
  PID:8656
- C:\Windows\System\lnEeOdB.exe
  C:\Windows\System\lnEeOdB.exe
  2⤵
  PID:9748
- C:\Windows\System\MfxNEdK.exe
  C:\Windows\System\MfxNEdK.exe
  2⤵
  PID:10408
- C:\Windows\System\SSFKVME.exe
  C:\Windows\System\SSFKVME.exe
  2⤵
  PID:13188
- C:\Windows\System\pFBCNYO.exe
  C:\Windows\System\pFBCNYO.exe
  2⤵
  PID:11396
- C:\Windows\System\wlJHOdY.exe
  C:\Windows\System\wlJHOdY.exe
  2⤵
  PID:13220
- C:\Windows\System\bVGMtkW.exe
  C:\Windows\System\bVGMtkW.exe
  2⤵
  PID:11488
- C:\Windows\System\qWcDOUe.exe
  C:\Windows\System\qWcDOUe.exe
  2⤵
  PID:12512
- C:\Windows\System\MnMmKsn.exe
  C:\Windows\System\MnMmKsn.exe
  2⤵
  PID:10620
- C:\Windows\System\ILyHfiH.exe
  C:\Windows\System\ILyHfiH.exe
  2⤵
  PID:11344
- C:\Windows\System\pQoeUar.exe
  C:\Windows\System\pQoeUar.exe
  2⤵
  PID:11508
- C:\Windows\System\EAxSajx.exe
  C:\Windows\System\EAxSajx.exe
  2⤵
  PID:13308
- C:\Windows\System\KnJCkLP.exe
  C:\Windows\System\KnJCkLP.exe
  2⤵
  PID:11664
- C:\Windows\System\KZacIyx.exe
  C:\Windows\System\KZacIyx.exe
  2⤵
  PID:11896
- C:\Windows\System\FtbfFgn.exe
  C:\Windows\System\FtbfFgn.exe
  2⤵
  PID:12268
- C:\Windows\System\yYaSsKp.exe
  C:\Windows\System\yYaSsKp.exe
  2⤵
  PID:9232
- C:\Windows\System\jttBFwe.exe
  C:\Windows\System\jttBFwe.exe
  2⤵
  PID:10588
- C:\Windows\System\YBjKVLJ.exe
  C:\Windows\System\YBjKVLJ.exe
  2⤵
  PID:10704
- C:\Windows\System\wzIYdws.exe
  C:\Windows\System\wzIYdws.exe
  2⤵
  PID:11020
- C:\Windows\System\ETqxUYD.exe
  C:\Windows\System\ETqxUYD.exe
  2⤵
  PID:10264
- C:\Windows\System\TujOhrQ.exe
  C:\Windows\System\TujOhrQ.exe
  2⤵
  PID:10344
- C:\Windows\System\gCdjgDp.exe
  C:\Windows\System\gCdjgDp.exe
  2⤵
  PID:12436
- C:\Windows\System\FTshrEu.exe
  C:\Windows\System\FTshrEu.exe
  2⤵
  PID:13224
- C:\Windows\System\iBEMYtP.exe
  C:\Windows\System\iBEMYtP.exe
  2⤵
  PID:9328
- C:\Windows\System\WwDAEMx.exe
  C:\Windows\System\WwDAEMx.exe
  2⤵
  PID:11164
- C:\Windows\System\VqZyoOx.exe
  C:\Windows\System\VqZyoOx.exe
  2⤵
  PID:4608
- C:\Windows\System\VeeBWQT.exe
  C:\Windows\System\VeeBWQT.exe
  2⤵
  PID:11728
- C:\Windows\System\HVHTwEI.exe
  C:\Windows\System\HVHTwEI.exe
  2⤵
  PID:11256
- C:\Windows\System\EUordCI.exe
  C:\Windows\System\EUordCI.exe
  2⤵
  PID:9152
- C:\Windows\System\SKRseXK.exe
  C:\Windows\System\SKRseXK.exe
  2⤵
  PID:12972
- C:\Windows\System\OEESKiN.exe
  C:\Windows\System\OEESKiN.exe
  2⤵
  PID:13472
- C:\Windows\System\GfsCVqa.exe
  C:\Windows\System\GfsCVqa.exe
  2⤵
  PID:13500
- C:\Windows\System\JBBVEUB.exe
  C:\Windows\System\JBBVEUB.exe
  2⤵
  PID:13520
- C:\Windows\System\eTekLXs.exe
  C:\Windows\System\eTekLXs.exe
  2⤵
  PID:13604
- C:\Windows\System\LYhrLhF.exe
  C:\Windows\System\LYhrLhF.exe
  2⤵
  PID:13656
- C:\Windows\System\NYMOGfy.exe
  C:\Windows\System\NYMOGfy.exe
  2⤵
  PID:13680
- C:\Windows\System\MiTgYLo.exe
  C:\Windows\System\MiTgYLo.exe
  2⤵
  PID:13708
- C:\Windows\System\vZmQUeY.exe
  C:\Windows\System\vZmQUeY.exe
  2⤵
  PID:13728
- C:\Windows\System\mdSVSvX.exe
  C:\Windows\System\mdSVSvX.exe
  2⤵
  PID:13744
- C:\Windows\System\AhrBSBh.exe
  C:\Windows\System\AhrBSBh.exe
  2⤵
  PID:13764
- C:\Windows\System\mPhFxNM.exe
  C:\Windows\System\mPhFxNM.exe
  2⤵
  PID:13804
- C:\Windows\System\XAtKbPT.exe
  C:\Windows\System\XAtKbPT.exe
  2⤵
  PID:13848
- C:\Windows\System\hloajYV.exe
  C:\Windows\System\hloajYV.exe
  2⤵
  PID:13868
- C:\Windows\System\ahDeMdr.exe
  C:\Windows\System\ahDeMdr.exe
  2⤵
  PID:13892
- C:\Windows\System\tkReQJq.exe
  C:\Windows\System\tkReQJq.exe
  2⤵
  PID:13908
- C:\Windows\System\tRglUUf.exe
  C:\Windows\System\tRglUUf.exe
  2⤵
  PID:13928
- C:\Windows\System\sjTxeEZ.exe
  C:\Windows\System\sjTxeEZ.exe
  2⤵
  PID:14168
- C:\Windows\System\jIpScOu.exe
  C:\Windows\System\jIpScOu.exe
  2⤵
  PID:14332
- C:\Windows\System\pCvUtlf.exe
  C:\Windows\System\pCvUtlf.exe
  2⤵
  PID:11532
- C:\Windows\System\cpEcWxx.exe
  C:\Windows\System\cpEcWxx.exe
  2⤵
  PID:11504
- C:\Windows\System\VBRlIlN.exe
  C:\Windows\System\VBRlIlN.exe
  2⤵
  PID:12608
- C:\Windows\System\wmaXcXg.exe
  C:\Windows\System\wmaXcXg.exe
  2⤵
  PID:11100
- C:\Windows\System\zwBBTLA.exe
  C:\Windows\System\zwBBTLA.exe
  2⤵
  PID:13420
- C:\Windows\System\AKHALXf.exe
  C:\Windows\System\AKHALXf.exe
  2⤵
  PID:13796
- C:\Windows\System\jVjWyZc.exe
  C:\Windows\System\jVjWyZc.exe
  2⤵
  PID:13924
- C:\Windows\System\SWkGDLS.exe
  C:\Windows\System\SWkGDLS.exe
  2⤵
  PID:13840
- C:\Windows\System\dXQLIEi.exe
  C:\Windows\System\dXQLIEi.exe
  2⤵
  PID:13820
- C:\Windows\System\AXsgyRI.exe
  C:\Windows\System\AXsgyRI.exe
  2⤵
  PID:13936
- C:\Windows\System\glXxypo.exe
  C:\Windows\System\glXxypo.exe
  2⤵
  PID:13860
- C:\Windows\System\UIbBTpi.exe
  C:\Windows\System\UIbBTpi.exe
  2⤵
  PID:14004
- C:\Windows\System\UJAhtVA.exe
  C:\Windows\System\UJAhtVA.exe
  2⤵
  PID:14044
- C:\Windows\System\hmTuMaY.exe
  C:\Windows\System\hmTuMaY.exe
  2⤵
  PID:14096
- C:\Windows\System\FRReEud.exe
  C:\Windows\System\FRReEud.exe
  2⤵
  PID:14136
- C:\Windows\System\jZiifdx.exe
  C:\Windows\System\jZiifdx.exe
  2⤵
  PID:12740
- C:\Windows\System\HhVarPC.exe
  C:\Windows\System\HhVarPC.exe
  2⤵
  PID:11060
- C:\Windows\System\YCtCwKe.exe
  C:\Windows\System\YCtCwKe.exe
  2⤵
  PID:13056
- C:\Windows\System\WxCEKzt.exe
  C:\Windows\System\WxCEKzt.exe
  2⤵
  PID:12096
- C:\Windows\System\eIvfoHC.exe
  C:\Windows\System\eIvfoHC.exe
  2⤵
  PID:14144
- C:\Windows\System\AdHbKpc.exe
  C:\Windows\System\AdHbKpc.exe
  2⤵
  PID:14184
- C:\Windows\System\JHYTuCP.exe
  C:\Windows\System\JHYTuCP.exe
  2⤵
  PID:14212
- C:\Windows\System\dkLrWSU.exe
  C:\Windows\System\dkLrWSU.exe
  2⤵
  PID:2080
- C:\Windows\System\ZaCAXnn.exe
  C:\Windows\System\ZaCAXnn.exe
  2⤵
  PID:14236
- C:\Windows\System\UTRMEne.exe
  C:\Windows\System\UTRMEne.exe
  2⤵
  PID:13720
- C:\Windows\System\xYRzUTe.exe
  C:\Windows\System\xYRzUTe.exe
  2⤵
  PID:10244
- C:\Windows\System\WjAJSTz.exe
  C:\Windows\System\WjAJSTz.exe
  2⤵
  PID:13624
- C:\Windows\System\ancxyEV.exe
  C:\Windows\System\ancxyEV.exe
  2⤵
  PID:13888
- C:\Windows\System\UOIxtct.exe
  C:\Windows\System\UOIxtct.exe
  2⤵
  PID:13864
- C:\Windows\System\FlkJDTg.exe
  C:\Windows\System\FlkJDTg.exe
  2⤵
  PID:8212
- C:\Windows\System\helKLqk.exe
  C:\Windows\System\helKLqk.exe
  2⤵
  PID:11892
- C:\Windows\System\WSrVqxQ.exe
  C:\Windows\System\WSrVqxQ.exe
  2⤵
  PID:13836
- C:\Windows\System\bJpfIAy.exe
  C:\Windows\System\bJpfIAy.exe
  2⤵
  PID:824
- C:\Windows\System\ampxDfz.exe
  C:\Windows\System\ampxDfz.exe
  2⤵
  PID:13644
- C:\Windows\System\sFLLliS.exe
  C:\Windows\System\sFLLliS.exe
  2⤵
  PID:12136
- C:\Windows\System\PLZJAAS.exe
  C:\Windows\System\PLZJAAS.exe
  2⤵
  PID:14248
- C:\Windows\System\SJAEUFw.exe
  C:\Windows\System\SJAEUFw.exe
  2⤵
  PID:13332
- C:\Windows\System\RuelXEB.exe
  C:\Windows\System\RuelXEB.exe
  2⤵
  PID:3024
- C:\Windows\System\GyBtnkE.exe
  C:\Windows\System\GyBtnkE.exe
  2⤵
  PID:1136
- C:\Windows\System\sGOaaNk.exe
  C:\Windows\System\sGOaaNk.exe
  2⤵
  PID:1180
- C:\Windows\System\HFYNNFt.exe
  C:\Windows\System\HFYNNFt.exe
  2⤵
  PID:1524
- C:\Windows\System\ChOhSZx.exe
  C:\Windows\System\ChOhSZx.exe
  2⤵
  PID:3260
- C:\Windows\System\AreaNHA.exe
  C:\Windows\System\AreaNHA.exe
  2⤵
  PID:3604
- C:\Windows\System\vpQcwTP.exe
  C:\Windows\System\vpQcwTP.exe
  2⤵
  PID:4260
- C:\Windows\System\PvYncrm.exe
  C:\Windows\System\PvYncrm.exe
  2⤵
  PID:10920
- C:\Windows\System\UxYeaSH.exe
  C:\Windows\System\UxYeaSH.exe
  2⤵
  PID:13688
- C:\Windows\System\XiYWpwC.exe
  C:\Windows\System\XiYWpwC.exe
  2⤵
  PID:2472
- C:\Windows\System\BXrCAtx.exe
  C:\Windows\System\BXrCAtx.exe
  2⤵
  PID:11412
- C:\Windows\System\CIDruHV.exe
  C:\Windows\System\CIDruHV.exe
  2⤵
  PID:13776
- C:\Windows\System\HQyPeBu.exe
  C:\Windows\System\HQyPeBu.exe
  2⤵
  PID:14012
- C:\Windows\System\AoCRkYm.exe
  C:\Windows\System\AoCRkYm.exe
  2⤵
  PID:3244
- C:\Windows\System\MBAEKhc.exe
  C:\Windows\System\MBAEKhc.exe
  2⤵
  PID:1708
- C:\Windows\System\DviktqH.exe
  C:\Windows\System\DviktqH.exe
  2⤵
  PID:3864
- C:\Windows\System\JSNcBlu.exe
  C:\Windows\System\JSNcBlu.exe
  2⤵
  PID:3592
- C:\Windows\System\aRnYRgo.exe
  C:\Windows\System\aRnYRgo.exe
  2⤵
  PID:4940
- C:\Windows\System\ArbkuJH.exe
  C:\Windows\System\ArbkuJH.exe
  2⤵
  PID:4552
- C:\Windows\System\ObeHHEv.exe
  C:\Windows\System\ObeHHEv.exe
  2⤵
  PID:3524
- C:\Windows\System\siRHyrj.exe
  C:\Windows\System\siRHyrj.exe
  2⤵
  PID:3784
- C:\Windows\System\LCAgOAl.exe
  C:\Windows\System\LCAgOAl.exe
  2⤵
  PID:3716
- C:\Windows\System\bVKLZRw.exe
  C:\Windows\System\bVKLZRw.exe
  2⤵
  PID:3480
- C:\Windows\System\KgNZivK.exe
  C:\Windows\System\KgNZivK.exe
  2⤵
  PID:14240
- C:\Windows\System\oahneXg.exe
  C:\Windows\System\oahneXg.exe
  2⤵
  PID:9796
- C:\Windows\System\SeDYsUC.exe
  C:\Windows\System\SeDYsUC.exe
  2⤵
  PID:4228
- C:\Windows\System\IDresHj.exe
  C:\Windows\System\IDresHj.exe
  2⤵
  PID:1536
- C:\Windows\System\zNnkRgk.exe
  C:\Windows\System\zNnkRgk.exe
  2⤵
  PID:14204
- C:\Windows\System\JgweQZd.exe
  C:\Windows\System\JgweQZd.exe
  2⤵
  PID:13592
- C:\Windows\System\ZwNvnUA.exe
  C:\Windows\System\ZwNvnUA.exe
  2⤵
  PID:11360
- C:\Windows\System\WMEZZkj.exe
  C:\Windows\System\WMEZZkj.exe
  2⤵
  PID:3152
- C:\Windows\System\DzmLlia.exe
  C:\Windows\System\DzmLlia.exe
  2⤵
  PID:4060
- C:\Windows\System\dzbFtSA.exe
  C:\Windows\System\dzbFtSA.exe
  2⤵
  PID:13488
- C:\Windows\System\GvoPgjU.exe
  C:\Windows\System\GvoPgjU.exe
  2⤵
  PID:4944
- C:\Windows\System\wWjHstw.exe
  C:\Windows\System\wWjHstw.exe
  2⤵
  PID:1436
- C:\Windows\System\LjmMQdG.exe
  C:\Windows\System\LjmMQdG.exe
  2⤵
  PID:996
- C:\Windows\System\ZOoWzOK.exe
  C:\Windows\System\ZOoWzOK.exe
  2⤵
  PID:3276
- C:\Windows\System\EITqNAf.exe
  C:\Windows\System\EITqNAf.exe
  2⤵
  PID:4012
- C:\Windows\System\daTvoJG.exe
  C:\Windows\System\daTvoJG.exe
  2⤵
  PID:4072
- C:\Windows\System\yhPuDKY.exe
  C:\Windows\System\yhPuDKY.exe
  2⤵
  PID:10092
- C:\Windows\System\mYSBSmJ.exe
  C:\Windows\System\mYSBSmJ.exe
  2⤵
  PID:13576
- C:\Windows\System\QhbPLez.exe
  C:\Windows\System\QhbPLez.exe
  2⤵
  PID:2952
- C:\Windows\System\szbcJLL.exe
  C:\Windows\System\szbcJLL.exe
  2⤵
  PID:4732
- C:\Windows\System\OcvxPWo.exe
  C:\Windows\System\OcvxPWo.exe
  2⤵
  PID:2404
- C:\Windows\System\TlgQZaK.exe
  C:\Windows\System\TlgQZaK.exe
  2⤵
  PID:4124
- C:\Windows\System\evUNhMx.exe
  C:\Windows\System\evUNhMx.exe
  2⤵
  PID:3712
- C:\Windows\System\UaOjIpd.exe
  C:\Windows\System\UaOjIpd.exe
  2⤵
  PID:1132
- C:\Windows\System\mBIMcLo.exe
  C:\Windows\System\mBIMcLo.exe
  2⤵
  PID:4032
- C:\Windows\System\BbqFwcj.exe
  C:\Windows\System\BbqFwcj.exe
  2⤵
  PID:4800
- C:\Windows\System\YtWTYFR.exe
  C:\Windows\System\YtWTYFR.exe
  2⤵
  PID:2936
- C:\Windows\System\btNaqBS.exe
  C:\Windows\System\btNaqBS.exe
  2⤵
  PID:2360
- C:\Windows\System\NwNCofB.exe
  C:\Windows\System\NwNCofB.exe
  2⤵
  PID:1240
- C:\Windows\System\tlXyBFQ.exe
  C:\Windows\System\tlXyBFQ.exe
  2⤵
  PID:2336
- C:\Windows\System\HSdZyDD.exe
  C:\Windows\System\HSdZyDD.exe
  2⤵
  PID:4216
- C:\Windows\System\bPAbYEW.exe
  C:\Windows\System\bPAbYEW.exe
  2⤵
  PID:14328
- C:\Windows\System\prNkoue.exe
  C:\Windows\System\prNkoue.exe
  2⤵
  PID:13156
- C:\Windows\System\LYgCQWp.exe
  C:\Windows\System\LYgCQWp.exe
  2⤵
  PID:2584
- C:\Windows\System\PYhXZBf.exe
  C:\Windows\System\PYhXZBf.exe
  2⤵
  PID:3484
- C:\Windows\System\mBgujnR.exe
  C:\Windows\System\mBgujnR.exe
  2⤵
  PID:2124
- C:\Windows\System\Sbhcifq.exe
  C:\Windows\System\Sbhcifq.exe
  2⤵
  PID:3444
- C:\Windows\System\OrurLat.exe
  C:\Windows\System\OrurLat.exe
  2⤵
  PID:3924
- C:\Windows\System\LsqFUEi.exe
  C:\Windows\System\LsqFUEi.exe
  2⤵
  PID:12680
- C:\Windows\System\EBnQNne.exe
  C:\Windows\System\EBnQNne.exe
  2⤵
  PID:13956
- C:\Windows\System\iksvftp.exe
  C:\Windows\System\iksvftp.exe
  2⤵
  PID:11552
- C:\Windows\System\ZfdplRU.exe
  C:\Windows\System\ZfdplRU.exe
  2⤵
  PID:3136
- C:\Windows\System\gfIFYCA.exe
  C:\Windows\System\gfIFYCA.exe
  2⤵
  PID:14052
- C:\Windows\System\sxkjsmM.exe
  C:\Windows\System\sxkjsmM.exe
  2⤵
  PID:13696
- C:\Windows\System\YFIkRzx.exe
  C:\Windows\System\YFIkRzx.exe
  2⤵
  PID:2540
- C:\Windows\System\DwRfrZn.exe
  C:\Windows\System\DwRfrZn.exe
  2⤵
  PID:2156
- C:\Windows\System\VbYJVbr.exe
  C:\Windows\System\VbYJVbr.exe
  2⤵
  PID:1872
- C:\Windows\System\LkMCvYr.exe
  C:\Windows\System\LkMCvYr.exe
  2⤵
  PID:3756
- C:\Windows\System\tjNtwvD.exe
  C:\Windows\System\tjNtwvD.exe
  2⤵
  PID:1156
- C:\Windows\System\bhgWepi.exe
  C:\Windows\System\bhgWepi.exe
  2⤵
  PID:3496
- C:\Windows\System\PofMuNI.exe
  C:\Windows\System\PofMuNI.exe
  2⤵
  PID:2644
- C:\Windows\System\RANABZO.exe
  C:\Windows\System\RANABZO.exe
  2⤵
  PID:3356
- C:\Windows\System\cmeZsZs.exe
  C:\Windows\System\cmeZsZs.exe
  2⤵
  PID:1680
- C:\Windows\System\czqTmxh.exe
  C:\Windows\System\czqTmxh.exe
  2⤵
  PID:4644
- C:\Windows\System\gUuTbhe.exe
  C:\Windows\System\gUuTbhe.exe
  2⤵
  PID:4304
- C:\Windows\System\eFLrmea.exe
  C:\Windows\System\eFLrmea.exe
  2⤵
  PID:1992
- C:\Windows\System\zGemgNL.exe
  C:\Windows\System\zGemgNL.exe
  2⤵
  PID:3408
- C:\Windows\System\lxThAgc.exe
  C:\Windows\System\lxThAgc.exe
  2⤵
  PID:1084
- C:\Windows\System\fVcvruR.exe
  C:\Windows\System\fVcvruR.exe
  2⤵
  PID:4104
- C:\Windows\System\txitipi.exe
  C:\Windows\System\txitipi.exe
  2⤵
  PID:7136
- C:\Windows\System\peobFAp.exe
  C:\Windows\System\peobFAp.exe
  2⤵
  PID:6008
- C:\Windows\System\vkacNCC.exe
  C:\Windows\System\vkacNCC.exe
  2⤵
  PID:7932
- C:\Windows\System\hulwolA.exe
  C:\Windows\System\hulwolA.exe
  2⤵
  PID:1060
- C:\Windows\System\UwHjkbd.exe
  C:\Windows\System\UwHjkbd.exe
  2⤵
  PID:1476
- C:\Windows\System\xHhakYq.exe
  C:\Windows\System\xHhakYq.exe
  2⤵
  PID:13192
- C:\Windows\System\bgNEKxY.exe
  C:\Windows\System\bgNEKxY.exe
  2⤵
  PID:14300
- C:\Windows\System\nAtYkaR.exe
  C:\Windows\System\nAtYkaR.exe
  2⤵
  PID:3148
- C:\Windows\System\vwNyGoT.exe
  C:\Windows\System\vwNyGoT.exe
  2⤵
  PID:3196
- C:\Windows\System\UXyVgQw.exe
  C:\Windows\System\UXyVgQw.exe
  2⤵
  PID:7400
- C:\Windows\System\SYOBkFB.exe
  C:\Windows\System\SYOBkFB.exe
  2⤵
  PID:13792
- C:\Windows\System\YyjQTfu.exe
  C:\Windows\System\YyjQTfu.exe
  2⤵
  PID:4048
- C:\Windows\System\MxKsPjv.exe
  C:\Windows\System\MxKsPjv.exe
  2⤵
  PID:7464
- C:\Windows\System\JVojyqW.exe
  C:\Windows\System\JVojyqW.exe
  2⤵
  PID:7664
- C:\Windows\System\usonlrg.exe
  C:\Windows\System\usonlrg.exe
  2⤵
  PID:7776
- C:\Windows\System\eBGQPoA.exe
  C:\Windows\System\eBGQPoA.exe
  2⤵
  PID:4320
- C:\Windows\System\wuJBBbi.exe
  C:\Windows\System\wuJBBbi.exe
  2⤵
  PID:8060
- C:\Windows\System\ybZDZbp.exe
  C:\Windows\System\ybZDZbp.exe
  2⤵
  PID:8180
- C:\Windows\System\ojkgDLM.exe
  C:\Windows\System\ojkgDLM.exe
  2⤵
  PID:2780
- C:\Windows\System\SuaFsAc.exe
  C:\Windows\System\SuaFsAc.exe
  2⤵
  PID:7672
- C:\Windows\System\NpsgXLQ.exe
  C:\Windows\System\NpsgXLQ.exe
  2⤵
  PID:4040
- C:\Windows\System\QxsArhg.exe
  C:\Windows\System\QxsArhg.exe
  2⤵
  PID:2716
- C:\Windows\System\gkBSpyg.exe
  C:\Windows\System\gkBSpyg.exe
  2⤵
  PID:4796
- C:\Windows\System\baCEuZR.exe
  C:\Windows\System\baCEuZR.exe
  2⤵
  PID:2704
- C:\Windows\System\pFomBuj.exe
  C:\Windows\System\pFomBuj.exe
  2⤵
  PID:5492
- C:\Windows\System\ZYmeZWw.exe
  C:\Windows\System\ZYmeZWw.exe
  2⤵
  PID:6980
- C:\Windows\System\KBFtFJF.exe
  C:\Windows\System\KBFtFJF.exe
  2⤵
  PID:4828
- C:\Windows\System\yDHZeLn.exe
  C:\Windows\System\yDHZeLn.exe
  2⤵
  PID:13948
- C:\Windows\System\jDjwDKf.exe
  C:\Windows\System\jDjwDKf.exe
  2⤵
  PID:2808
- C:\Windows\System\KGwreZS.exe
  C:\Windows\System\KGwreZS.exe
  2⤵
  PID:4976
- C:\Windows\System\wQxHaTM.exe
  C:\Windows\System\wQxHaTM.exe
  2⤵
  PID:7912
- C:\Windows\System\JseLqXE.exe
  C:\Windows\System\JseLqXE.exe
  2⤵
  PID:2904
- C:\Windows\System\kPVNvAd.exe
  C:\Windows\System\kPVNvAd.exe
  2⤵
  PID:4180
- C:\Windows\System\vcrrZqc.exe
  C:\Windows\System\vcrrZqc.exe
  2⤵
  PID:4028
- C:\Windows\System\TNtXsYg.exe
  C:\Windows\System\TNtXsYg.exe
  2⤵
  PID:3000
- C:\Windows\System\iNRjKdQ.exe
  C:\Windows\System\iNRjKdQ.exe
  2⤵
  PID:5512
- C:\Windows\System\lfQkyTQ.exe
  C:\Windows\System\lfQkyTQ.exe
  2⤵
  PID:5220
- C:\Windows\System\eMWYrgp.exe
  C:\Windows\System\eMWYrgp.exe
  2⤵
  PID:4620
- C:\Windows\System\EWBZCjF.exe
  C:\Windows\System\EWBZCjF.exe
  2⤵
  PID:7888
- C:\Windows\System\bFcGyoG.exe
  C:\Windows\System\bFcGyoG.exe
  2⤵
  PID:224
- C:\Windows\System\TUjDtzS.exe
  C:\Windows\System\TUjDtzS.exe
  2⤵
  PID:5128
- C:\Windows\System\ZaHbfEM.exe
  C:\Windows\System\ZaHbfEM.exe
  2⤵
  PID:5100
- C:\Windows\System\YiwoKCJ.exe
  C:\Windows\System\YiwoKCJ.exe
  2⤵
  PID:5368
- C:\Windows\System\DMBIHBs.exe
  C:\Windows\System\DMBIHBs.exe
  2⤵
  PID:1044
- C:\Windows\System\bZVTUUs.exe
  C:\Windows\System\bZVTUUs.exe
  2⤵
  PID:7732
- C:\Windows\System\EtCgwty.exe
  C:\Windows\System\EtCgwty.exe
  2⤵
  PID:2856
- C:\Windows\System\mjjBCzB.exe
  C:\Windows\System\mjjBCzB.exe
  2⤵
  PID:13832
- C:\Windows\System\YNfQchQ.exe
  C:\Windows\System\YNfQchQ.exe
  2⤵
  PID:2436
- C:\Windows\System\gdtRbTM.exe
  C:\Windows\System\gdtRbTM.exe
  2⤵
  PID:5228
- C:\Windows\System\ZPWTOLj.exe
  C:\Windows\System\ZPWTOLj.exe
  2⤵
  PID:5440
- C:\Windows\System\UXPEEcx.exe
  C:\Windows\System\UXPEEcx.exe
  2⤵
  PID:5556
- C:\Windows\System\OhblfJL.exe
  C:\Windows\System\OhblfJL.exe
  2⤵
  PID:4292
- C:\Windows\System\XsvDPIf.exe
  C:\Windows\System\XsvDPIf.exe
  2⤵
  PID:4948
- C:\Windows\System\ADcZnbR.exe
  C:\Windows\System\ADcZnbR.exe
  2⤵
  PID:14056
- C:\Windows\System\wmnIZzT.exe
  C:\Windows\System\wmnIZzT.exe
  2⤵
  PID:1388
- C:\Windows\System\sjVyIAq.exe
  C:\Windows\System\sjVyIAq.exe
  2⤵
  PID:6056
- C:\Windows\System\FnbCQNl.exe
  C:\Windows\System\FnbCQNl.exe
  2⤵
  PID:5852
- C:\Windows\System\zixbApb.exe
  C:\Windows\System\zixbApb.exe
  2⤵
  PID:5964
- C:\Windows\System\qeEByEt.exe
  C:\Windows\System\qeEByEt.exe
  2⤵
  PID:6676
- C:\Windows\System\aaJDETw.exe
  C:\Windows\System\aaJDETw.exe
  2⤵
  PID:5172
- C:\Windows\System\ifaveFI.exe
  C:\Windows\System\ifaveFI.exe
  2⤵
  PID:5276
- C:\Windows\System\EIPoFys.exe
  C:\Windows\System\EIPoFys.exe
  2⤵
  PID:6320
- C:\Windows\System\txPEyAM.exe
  C:\Windows\System\txPEyAM.exe
  2⤵
  PID:2760
- C:\Windows\System\mqjhGrP.exe
  C:\Windows\System\mqjhGrP.exe
  2⤵
  PID:6696
- C:\Windows\System\YNuiFgU.exe
  C:\Windows\System\YNuiFgU.exe
  2⤵
  PID:6432
- C:\Windows\System\ooXodaC.exe
  C:\Windows\System\ooXodaC.exe
  2⤵
  PID:6252
- C:\Windows\System\ZKpppBq.exe
  C:\Windows\System\ZKpppBq.exe
  2⤵
  PID:6164
- C:\Windows\System\NktxkQe.exe
  C:\Windows\System\NktxkQe.exe
  2⤵
  PID:5848
- C:\Windows\System\eboOxKn.exe
  C:\Windows\System\eboOxKn.exe
  2⤵
  PID:6712
- C:\Windows\System\pnVMmfG.exe
  C:\Windows\System\pnVMmfG.exe
  2⤵
  PID:6764
- C:\Windows\System\kcywQpE.exe
  C:\Windows\System\kcywQpE.exe
  2⤵
  PID:6728
- C:\Windows\System\ExnXoGC.exe
  C:\Windows\System\ExnXoGC.exe
  2⤵
  PID:6636
- C:\Windows\System\HaMrqIZ.exe
  C:\Windows\System\HaMrqIZ.exe
  2⤵
  PID:6332
- C:\Windows\System\VzNeUFQ.exe
  C:\Windows\System\VzNeUFQ.exe
  2⤵
  PID:5828
- C:\Windows\System\oEltiDK.exe
  C:\Windows\System\oEltiDK.exe
  2⤵
  PID:6020
- C:\Windows\System\dOkKeBt.exe
  C:\Windows\System\dOkKeBt.exe
  2⤵
  PID:6836
- C:\Windows\System\ggCsJSB.exe
  C:\Windows\System\ggCsJSB.exe
  2⤵
  PID:8160
- C:\Windows\System\rhjOVWr.exe
  C:\Windows\System\rhjOVWr.exe
  2⤵
  PID:7292
- C:\Windows\System\sJASyQE.exe
  C:\Windows\System\sJASyQE.exe
  2⤵
  PID:6752
- C:\Windows\System\VivFVcd.exe
  C:\Windows\System\VivFVcd.exe
  2⤵
  PID:3120
- C:\Windows\System\KrxmwKG.exe
  C:\Windows\System\KrxmwKG.exe
  2⤵
  PID:6952
- C:\Windows\System\odwiUmR.exe
  C:\Windows\System\odwiUmR.exe
  2⤵
  PID:7120
- C:\Windows\System\LZQGodf.exe
  C:\Windows\System\LZQGodf.exe
  2⤵
  PID:6716
- C:\Windows\System\wYftntu.exe
  C:\Windows\System\wYftntu.exe
  2⤵
  PID:7220
- C:\Windows\System\teMZeAa.exe
  C:\Windows\System\teMZeAa.exe
  2⤵
  PID:6464
- C:\Windows\System\CEPRsKb.exe
  C:\Windows\System\CEPRsKb.exe
  2⤵
  PID:5896
- C:\Windows\System\xAfAYMz.exe
  C:\Windows\System\xAfAYMz.exe
  2⤵
  PID:5524
- C:\Windows\System\YRosVYe.exe
  C:\Windows\System\YRosVYe.exe
  2⤵
  PID:7396
- C:\Windows\System\qtInUKU.exe
  C:\Windows\System\qtInUKU.exe
  2⤵
  PID:7532
- C:\Windows\System\VTfjXOx.exe
  C:\Windows\System\VTfjXOx.exe
  2⤵
  PID:6340
- C:\Windows\System\hFXZvIG.exe
  C:\Windows\System\hFXZvIG.exe
  2⤵
  PID:8240
- C:\Windows\System\xzHvpcD.exe
  C:\Windows\System\xzHvpcD.exe
  2⤵
  PID:7264
- C:\Windows\System\sKfFqPh.exe
  C:\Windows\System\sKfFqPh.exe
  2⤵
  PID:7804
- C:\Windows\System\JQsCoVH.exe
  C:\Windows\System\JQsCoVH.exe
  2⤵
  PID:5508
- C:\Windows\System\HRnqUyL.exe
  C:\Windows\System\HRnqUyL.exe
  2⤵
  PID:5432
- C:\Windows\System\nCbHdOC.exe
  C:\Windows\System\nCbHdOC.exe
  2⤵
  PID:6440
- C:\Windows\System\keOVucp.exe
  C:\Windows\System\keOVucp.exe
  2⤵
  PID:8504
- C:\Windows\System\SbkDwzR.exe
  C:\Windows\System\SbkDwzR.exe
  2⤵
  PID:7348
- C:\Windows\System\kHBbTBJ.exe
  C:\Windows\System\kHBbTBJ.exe
  2⤵
  PID:7332
- C:\Windows\System\zPnFABa.exe
  C:\Windows\System\zPnFABa.exe
  2⤵
  PID:208
- C:\Windows\System\cZxbnar.exe
  C:\Windows\System\cZxbnar.exe
  2⤵
  PID:6208
- C:\Windows\System\rQBiMsd.exe
  C:\Windows\System\rQBiMsd.exe
  2⤵
  PID:8616
- C:\Windows\System\gRLJQRe.exe
  C:\Windows\System\gRLJQRe.exe
  2⤵
  PID:8628
- C:\Windows\System\LahdPqX.exe
  C:\Windows\System\LahdPqX.exe
  2⤵
  PID:7456
- C:\Windows\System\gYXPUta.exe
  C:\Windows\System\gYXPUta.exe
  2⤵
  PID:6568
- C:\Windows\System\HLbNYyw.exe
  C:\Windows\System\HLbNYyw.exe
  2⤵
  PID:13512
- C:\Windows\System\LBooJEh.exe
  C:\Windows\System\LBooJEh.exe
  2⤵
  PID:8256
- C:\Windows\System\vaVrJUQ.exe
  C:\Windows\System\vaVrJUQ.exe
  2⤵
  PID:8912
- C:\Windows\System\eTZOOeQ.exe
  C:\Windows\System\eTZOOeQ.exe
  2⤵
  PID:8660
- C:\Windows\System\WeuMvkb.exe
  C:\Windows\System\WeuMvkb.exe
  2⤵
  PID:8292
- C:\Windows\System\rWIrrXt.exe
  C:\Windows\System\rWIrrXt.exe
  2⤵
  PID:8420
- C:\Windows\System\phuLXGl.exe
  C:\Windows\System\phuLXGl.exe
  2⤵
  PID:7568
- C:\Windows\System\UBnAINH.exe
  C:\Windows\System\UBnAINH.exe
  2⤵
  PID:8164
- C:\Windows\System\BkKJyGZ.exe
  C:\Windows\System\BkKJyGZ.exe
  2⤵
  PID:6460
- C:\Windows\System\vlDBNvX.exe
  C:\Windows\System\vlDBNvX.exe
  2⤵
  PID:7552
- C:\Windows\System\sOuIRnl.exe
  C:\Windows\System\sOuIRnl.exe
  2⤵
  PID:7360
- C:\Windows\System\bTkLdus.exe
  C:\Windows\System\bTkLdus.exe
  2⤵
  PID:14024
- C:\Windows\System\VcOKTOl.exe
  C:\Windows\System\VcOKTOl.exe
  2⤵
  PID:7420
- C:\Windows\System\QiETTQl.exe
  C:\Windows\System\QiETTQl.exe
  2⤵
  PID:6932
- C:\Windows\System\Eoboxfe.exe
  C:\Windows\System\Eoboxfe.exe
  2⤵
  PID:7508
- C:\Windows\System\nCDNsMr.exe
  C:\Windows\System\nCDNsMr.exe
  2⤵
  PID:9460
- C:\Windows\System\xohCrwH.exe
  C:\Windows\System\xohCrwH.exe
  2⤵
  PID:7068
- C:\Windows\System\nXXCbma.exe
  C:\Windows\System\nXXCbma.exe
  2⤵
  PID:8840
- C:\Windows\System\zwKjVfT.exe
  C:\Windows\System\zwKjVfT.exe
  2⤵
  PID:6788
- C:\Windows\System\FRArHsC.exe
  C:\Windows\System\FRArHsC.exe
  2⤵
  PID:7980
- C:\Windows\System\WAbhFou.exe
  C:\Windows\System\WAbhFou.exe
  2⤵
  PID:10492
- C:\Windows\System\LkZRezp.exe
  C:\Windows\System\LkZRezp.exe
  2⤵
  PID:8540
- C:\Windows\System\XUdhoAZ.exe
  C:\Windows\System\XUdhoAZ.exe
  2⤵
  PID:9388
- C:\Windows\System\ravSQBt.exe
  C:\Windows\System\ravSQBt.exe
  2⤵
  PID:3368
- C:\Windows\System\gbwrgkx.exe
  C:\Windows\System\gbwrgkx.exe
  2⤵
  PID:6848
- C:\Windows\System\DoMuTMl.exe
  C:\Windows\System\DoMuTMl.exe
  2⤵
  PID:10232
- C:\Windows\System\NtJyYAf.exe
  C:\Windows\System\NtJyYAf.exe
  2⤵
  PID:6336
- C:\Windows\System\WuCdjMU.exe
  C:\Windows\System\WuCdjMU.exe
  2⤵
  PID:8572
- C:\Windows\System\rLIDtQS.exe
  C:\Windows\System\rLIDtQS.exe
  2⤵
  PID:9500
- C:\Windows\System\zcuoxGg.exe
  C:\Windows\System\zcuoxGg.exe
  2⤵
  PID:9476
- C:\Windows\System\bHQzvfW.exe
  C:\Windows\System\bHQzvfW.exe
  2⤵
  PID:9424
- C:\Windows\System\SNsmqCP.exe
  C:\Windows\System\SNsmqCP.exe
  2⤵
  PID:9972
- C:\Windows\System\eGcmhSx.exe
  C:\Windows\System\eGcmhSx.exe
  2⤵
  PID:10524
- C:\Windows\System\uIXxWMr.exe
  C:\Windows\System\uIXxWMr.exe
  2⤵
  PID:10980
- C:\Windows\System\kvhZtjx.exe
  C:\Windows\System\kvhZtjx.exe
  2⤵
  PID:8732
- C:\Windows\System\JGrrtfe.exe
  C:\Windows\System\JGrrtfe.exe
  2⤵
  PID:9156
- C:\Windows\System\EgBOcRC.exe
  C:\Windows\System\EgBOcRC.exe
  2⤵
  PID:9840
- C:\Windows\System\kwrRoUI.exe
  C:\Windows\System\kwrRoUI.exe
  2⤵
  PID:9172
- C:\Windows\System\VjTkigS.exe
  C:\Windows\System\VjTkigS.exe
  2⤵
  PID:8560
- C:\Windows\System\ixOTzvs.exe
  C:\Windows\System\ixOTzvs.exe
  2⤵
  PID:9956
- C:\Windows\System\IKtullj.exe
  C:\Windows\System\IKtullj.exe
  2⤵
  PID:8652
- C:\Windows\System\dkHsKME.exe
  C:\Windows\System\dkHsKME.exe
  2⤵
  PID:12036
- C:\Windows\System\eczfuCU.exe
  C:\Windows\System\eczfuCU.exe
  2⤵
  PID:6536
- C:\Windows\System\sjRsRvb.exe
  C:\Windows\System\sjRsRvb.exe
  2⤵
  PID:10268
- C:\Windows\System\YTGNFma.exe
  C:\Windows\System\YTGNFma.exe
  2⤵
  PID:8640
- C:\Windows\System\duMsHvV.exe
  C:\Windows\System\duMsHvV.exe
  2⤵
  PID:8500
- C:\Windows\System\iyZBKdD.exe
  C:\Windows\System\iyZBKdD.exe
  2⤵
  PID:412
- C:\Windows\System\FGRIjPZ.exe
  C:\Windows\System\FGRIjPZ.exe
  2⤵
  PID:8228
- C:\Windows\System\ixCFNHw.exe
  C:\Windows\System\ixCFNHw.exe
  2⤵
  PID:11516
- C:\Windows\System\QhjPwtA.exe
  C:\Windows\System\QhjPwtA.exe
  2⤵
  PID:10856
- C:\Windows\System\mraZMdT.exe
  C:\Windows\System\mraZMdT.exe
  2⤵
  PID:11856
- C:\Windows\System\gHDeoTY.exe
  C:\Windows\System\gHDeoTY.exe
  2⤵
  PID:11236
- C:\Windows\System\nYjrWfF.exe
  C:\Windows\System\nYjrWfF.exe
  2⤵
  PID:9504
- C:\Windows\System\KvyrrVh.exe
  C:\Windows\System\KvyrrVh.exe
  2⤵
  PID:11116
- C:\Windows\System\wcZzXot.exe
  C:\Windows\System\wcZzXot.exe
  2⤵
  PID:8904
- C:\Windows\System\UODnXbK.exe
  C:\Windows\System\UODnXbK.exe
  2⤵
  PID:8360
- C:\Windows\System\fcZOkTC.exe
  C:\Windows\System\fcZOkTC.exe
  2⤵
  PID:10860
- C:\Windows\System\FyHZKFs.exe
  C:\Windows\System\FyHZKFs.exe
  2⤵
  PID:10908
- C:\Windows\System\ShsISFD.exe
  C:\Windows\System\ShsISFD.exe
  2⤵
  PID:12244
- C:\Windows\System\hwgbXoN.exe
  C:\Windows\System\hwgbXoN.exe
  2⤵
  PID:6856
- C:\Windows\System\HnqdQBc.exe
  C:\Windows\System\HnqdQBc.exe
  2⤵
  PID:9688
- C:\Windows\System\wLusSga.exe
  C:\Windows\System\wLusSga.exe
  2⤵
  PID:10748
- C:\Windows\System\GAnrnNs.exe
  C:\Windows\System\GAnrnNs.exe
  2⤵
  PID:10024
- C:\Windows\System\JxjnIvo.exe
  C:\Windows\System\JxjnIvo.exe
  2⤵
  PID:10672
- C:\Windows\System\IuTLCAj.exe
  C:\Windows\System\IuTLCAj.exe
  2⤵
  PID:9264
- C:\Windows\System\CunfDzB.exe
  C:\Windows\System\CunfDzB.exe
  2⤵
  PID:8792
- C:\Windows\System\IssuiHL.exe
  C:\Windows\System\IssuiHL.exe
  2⤵
  PID:14388
- C:\Windows\System\PRGyHwj.exe
  C:\Windows\System\PRGyHwj.exe
  2⤵
  PID:14436
- C:\Windows\System\anwFmna.exe
  C:\Windows\System\anwFmna.exe
  2⤵
  PID:14472
- C:\Windows\System\rgwxSPX.exe
  C:\Windows\System\rgwxSPX.exe
  2⤵
  PID:14496
- C:\Windows\System\jjoKrVy.exe
  C:\Windows\System\jjoKrVy.exe
  2⤵
  PID:14580
- C:\Windows\System\ZwatRxR.exe
  C:\Windows\System\ZwatRxR.exe
  2⤵
  PID:14596
- C:\Windows\System\vDSJqIW.exe
  C:\Windows\System\vDSJqIW.exe
  2⤵
  PID:14612
- C:\Windows\System\cjVgPOV.exe
  C:\Windows\System\cjVgPOV.exe
  2⤵
  PID:14636
- C:\Windows\System\ddCHAIU.exe
  C:\Windows\System\ddCHAIU.exe
  2⤵
  PID:14668
- C:\Windows\System\smAGfQc.exe
  C:\Windows\System\smAGfQc.exe
  2⤵
  PID:14820
- C:\Windows\System\Zkriuof.exe
  C:\Windows\System\Zkriuof.exe
  2⤵
  PID:14836
- C:\Windows\System\JKMnhiO.exe
  C:\Windows\System\JKMnhiO.exe
  2⤵
  PID:14860
- C:\Windows\System\imkoLpB.exe
  C:\Windows\System\imkoLpB.exe
  2⤵
  PID:15096
- C:\Windows\System\FWnvLkR.exe
  C:\Windows\System\FWnvLkR.exe
  2⤵
  PID:15132
- C:\Windows\System\uxUPSmY.exe
  C:\Windows\System\uxUPSmY.exe
  2⤵
  PID:15168
- C:\Windows\System\nTRwBEb.exe
  C:\Windows\System\nTRwBEb.exe
  2⤵
  PID:15200
- C:\Windows\System\Vlbcuyi.exe
  C:\Windows\System\Vlbcuyi.exe
  2⤵
  PID:15220
- C:\Windows\System\lepueBH.exe
  C:\Windows\System\lepueBH.exe
  2⤵
  PID:15252
- C:\Windows\System\rPdTXOY.exe
  C:\Windows\System\rPdTXOY.exe
  2⤵
  PID:15284
- C:\Windows\System\lNUNnvI.exe
  C:\Windows\System\lNUNnvI.exe
  2⤵
  PID:15328
- C:\Windows\System\aMWFZpD.exe
  C:\Windows\System\aMWFZpD.exe
  2⤵
  PID:15352
- C:\Windows\System\vGKkXmZ.exe
  C:\Windows\System\vGKkXmZ.exe
  2⤵
  PID:9120
- C:\Windows\System\OGQmHvK.exe
  C:\Windows\System\OGQmHvK.exe
  2⤵
  PID:11056
- C:\Windows\System\bqBdqQh.exe
  C:\Windows\System\bqBdqQh.exe
  2⤵
  PID:11780
- C:\Windows\System\bWiPzAK.exe
  C:\Windows\System\bWiPzAK.exe
  2⤵
  PID:11088
- C:\Windows\System\VDsNSZl.exe
  C:\Windows\System\VDsNSZl.exe
  2⤵
  PID:14340
- C:\Windows\System\kXjdQmw.exe
  C:\Windows\System\kXjdQmw.exe
  2⤵
  PID:12664
- C:\Windows\System\NzfgCMb.exe
  C:\Windows\System\NzfgCMb.exe
  2⤵
  PID:14428
- C:\Windows\System\hlqWcjU.exe
  C:\Windows\System\hlqWcjU.exe
  2⤵
  PID:12516
- C:\Windows\System\adDreHd.exe
  C:\Windows\System\adDreHd.exe
  2⤵
  PID:9492
- C:\Windows\System\IEJSTtW.exe
  C:\Windows\System\IEJSTtW.exe
  2⤵
  PID:6852
- C:\Windows\System\mzYnHQq.exe
  C:\Windows\System\mzYnHQq.exe
  2⤵
  PID:9936
- C:\Windows\System\plJeEYm.exe
  C:\Windows\System\plJeEYm.exe
  2⤵
  PID:13800
- C:\Windows\System\WsmOnpv.exe
  C:\Windows\System\WsmOnpv.exe
  2⤵
  PID:10560
- C:\Windows\System\IfOUSgi.exe
  C:\Windows\System\IfOUSgi.exe
  2⤵
  PID:11796
- C:\Windows\System\gecxgxG.exe
  C:\Windows\System\gecxgxG.exe
  2⤵
  PID:9236
- C:\Windows\System\UKJXhxP.exe
  C:\Windows\System\UKJXhxP.exe
  2⤵
  PID:12936
- C:\Windows\System\wJmcKFs.exe
  C:\Windows\System\wJmcKFs.exe
  2⤵
  PID:13180
- C:\Windows\System\lLTXQqg.exe
  C:\Windows\System\lLTXQqg.exe
  2⤵
  PID:9408
- C:\Windows\System\thcEgXy.exe
  C:\Windows\System\thcEgXy.exe
  2⤵
  PID:14412
- C:\Windows\System\GaznSWc.exe
  C:\Windows\System\GaznSWc.exe
  2⤵
  PID:14560
- C:\Windows\System\zcPbHhL.exe
  C:\Windows\System\zcPbHhL.exe
  2⤵
  PID:13132
- C:\Windows\System\dXxEWWf.exe
  C:\Windows\System\dXxEWWf.exe
  2⤵
  PID:14676
- C:\Windows\System\xMXNRwR.exe
  C:\Windows\System\xMXNRwR.exe
  2⤵
  PID:14708
- C:\Windows\System\jPafJMv.exe
  C:\Windows\System\jPafJMv.exe
  2⤵
  PID:12932
- C:\Windows\System\BQMuKkr.exe
  C:\Windows\System\BQMuKkr.exe
  2⤵
  PID:14516
- C:\Windows\System\mCmQtti.exe
  C:\Windows\System\mCmQtti.exe
  2⤵
  PID:14520
- C:\Windows\System\xuygINv.exe
  C:\Windows\System\xuygINv.exe
  2⤵
  PID:14784
- C:\Windows\System\deAVXCh.exe
  C:\Windows\System\deAVXCh.exe
  2⤵
  PID:12340

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14112

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:13540

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:14028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tnawnaay.2lr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CuTLLEL.exe

Filesize
1.9MB

MD5
1bc9619f47defdd94e772f26cbb12cf1

SHA1
16dbd0b3aa6671a031e162a8c9c45702ab446904

SHA256
dc4deaf0ca69cb0f7fafbcdc03b2df22a4f1976fe2982b921026cebd76b75915

SHA512
8320ef35a7298d0df5d95656404d20305e07b993400e92728dd6750fa83a9b4e3cbcf45c0a6165cd2904236f78f1458e462e0131facc747d39e402a856ab3cc4

Download Submit
C:\Windows\System\CvjnnQY.exe

Filesize
1.9MB

MD5
f95fb8589cc0d6086e622c4634188468

SHA1
23735ac47a769f7acba75f7bbdf08d9a18691e30

SHA256
6b6195ed232b2b748420b94f9b3019fda7572c5dfcd952be5a375081b3387661

SHA512
b4797a596189746b9c6e5b2f0bb24d1d3dbbde02b1131148c9c7af78bfb721f1ff2ea63f4678adf18237572289ef5d4844ffc4d304a311affa7ce91a48913f02

Download Submit
C:\Windows\System\JeyuGju.exe

Filesize
1.9MB

MD5
26cf29d61e4895d41e60edefcb7a2b67

SHA1
f5b41797df957c7eadfca7d04c16f990ce5c9911

SHA256
47ac31227e806cdfa7152958ee279005a1717d508c0665346d658bf90a683d70

SHA512
ffa2e4ef007d56af4874868102a1710e906da6fd0a35b39f7853f1fc39156ac7648f2fdb04794900551c849c5afbdcc5af144807f0e32f45d81d03c655e332f6

Download Submit
C:\Windows\System\KSSRfeN.exe

Filesize
1.9MB

MD5
595f3e96af0fa4f6db660b0e5e63df52

SHA1
3e8af4f869190c581e1d4082a3f67dbfda7beb6e

SHA256
92e327eaf8a3b0e77e51b7b87726d4005e89874bf419c0641e7c397739fe7012

SHA512
5e212016e95cd517232bf160791ef8e4e7c1576e5252e037780db0e673b407a0f6341dfe54ae287d68f4c54253af3e633042d3d56bb8f4feff7112e4f8e5a80d

Download Submit
C:\Windows\System\KjsoGQc.exe

Filesize
1.9MB

MD5
ef92981b54b6b5c27b15acbb2bad46c7

SHA1
3991e442bcb6c0d6775adb7872575a1adafeba3e

SHA256
ee18607b9e3f1d04af0b0b380378ead6e92e17993fe28f998e48005f211237a0

SHA512
5807082f63d13363529217c572f22941020607e17cbbfd62cadc65abbe8988c64572b01979454ee34f3773d873d300c9e92be2fa8c0ebffed5d92c405fd0e7e2

Download Submit
C:\Windows\System\MskFVld.exe

Filesize
1.9MB

MD5
e85014cea375088fff899e019838c103

SHA1
4d7099b7140435c78bf31b95433336517aac9e8b

SHA256
49cb36f527394db7d9aca4b6daa67cc27aaf5b8c284ac8c545cf53a15fccd778

SHA512
e92d304b1f4fac39f69b835649e7fb07530c8c33715f4446bcea6929d7d88a9d6da469e7b7dc410af1279e373b74ef022583334ba62308d7821fc6723cd14183

Download Submit
C:\Windows\System\NJTegMF.exe

Filesize
1.9MB

MD5
1957b4fbf388a585a9b27d64f8f54b1a

SHA1
5aa5c32c32745e609c3068e0fb6daa201fe4f731

SHA256
fc67338f52f24be4bad86127ac6616fe3bfc67900c28102690421e591058a583

SHA512
8d4fbcd404babe3e53362f415ffe8d46bf81e638170c1f824ebcbf38e6e85e856378db6642cf797e4cf97b12951821d3bc9e01d96398d6a5994cff109b0bd36f

Download Submit
C:\Windows\System\NXuOIYG.exe

Filesize
1.9MB

MD5
2a3f160b3b7fa8d9c7ee145d9a98a170

SHA1
1b713471ca5c948512e11cbe38034269953b1cba

SHA256
4174dfd6dd84c63112d432a47d7f954eb6192595f391fc200a86b3ce961e02f0

SHA512
b04451028130d2498769f9e315e2c4cb0216a6a8fe1ad008af1e639159c23b98cc469cc351af08c28cb3e221ce02a271d1ce938720508f6e1327f2b1959a6e0c

Download Submit
C:\Windows\System\QKARngQ.exe

Filesize
1.9MB

MD5
6504be45ae3feca2e1b808f02657fb20

SHA1
bd2e48c7164b2e58c159fd61b4e3b4a34b0fd326

SHA256
8220ce65bc8cf08dcc8a5288527c4fdea802e730330e51dd4dabf35c8684c309

SHA512
a2dbc6bf7b99f79450adcfd3ad5ae2a681c04962846a40e13ef48a952d4e2b373bfe1206f6f2bf7793791e7c93a1b26adc7107873709791dbed787dc349e4237

Download Submit
C:\Windows\System\QiJvqzN.exe

Filesize
1.9MB

MD5
6ec868f6ba55079b3b9b78ccd15ebda6

SHA1
82701244041b715032a690fbd9b525928af5a671

SHA256
3979eb4ec29ceb794eb98d1c2203657bd5638dc0d2c40b533ac7060a1cabdebf

SHA512
267762db409f26728c419c5836a955057208e90c3ec72085f0c37303ac93049a5e137ac384dbd9612b8f75e3cffb6372ffe6307cabdea3336fc67d04572cdf88

Download Submit
C:\Windows\System\RYsnfUN.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\RhUeets.exe

Filesize
1.9MB

MD5
4e77f9206b0fff32c0d2a9041cf0b595

SHA1
f19ac834130a60b0264a45d280a31c2fb261be5e

SHA256
59bbaeed97669913d5e8ba695c616b00c21c59ba510237e24b11472e72e14f78

SHA512
b00c6ff180a06339463217f13fa7b01ff6829f7845a28754db17407b5d0cb0ff0e6e0a38b204093edbfacb41a76585f6995b47a04d70711e21bdd1882353e38b

Download Submit
C:\Windows\System\RrLZOrJ.exe

Filesize
1.9MB

MD5
80b5ed1dbf27255d44d33e74f3613822

SHA1
59d1ee2317f133a0f8f8380d0fcd3c7e0b9838ad

SHA256
b3592a266fa71c9b1184e3e8ae4fe330b688098f6dea7b65038e9c6406405d8d

SHA512
3fbd90780b1f0c6361a67c1aec9d2995f07fe0081257453637eba0a974804b44836a62d0f11de23ce60fa2d2ed7a585804450ae5e284e2cc6a3b6c396b20bc48

Download Submit
C:\Windows\System\TGgyQdx.exe

Filesize
1.9MB

MD5
f47e1529007a88171ee88e2241697320

SHA1
85a6830ade8e9587681cf4957135bd095491d3f3

SHA256
8126394034a1743c3f39b667b0dd107b8778696fcc5c3447cb4826048a1bfc44

SHA512
3c6db3504bec74b1dd2727d389821a10a4d05df357aa1e273c571e1a53cdb09a88795d539e75b739b2c616ff75f5ce963e3fef0b4c1b6efca31447f5208eaf25

Download Submit
C:\Windows\System\UalbeYS.exe

Filesize
1.9MB

MD5
bfbb38122220d7aed70a55fba945dec5

SHA1
a3a4bdaa574ab23f446201fcff99f58f6e639847

SHA256
0a56c2df814dddcd33f202439a0626e7fc8a97be935488e6629791b1c97aed77

SHA512
24fb7c711bf5bc6bb0b11681ca6c278d293be4a2b1add9e7d4b53faf3eb2bc0f6ef4c7e3b9f258a93652b83cabecbe3c05818ad6d3ebea40d1dd8c43b39b0166

Download Submit
C:\Windows\System\UgTEChp.exe

Filesize
1.9MB

MD5
e9d2ba54a3fb76c1c6698a8fb6b6c909

SHA1
b45e90932b5044490d1e0fd3ef28628253d3d107

SHA256
2dadde856f4950071d4e9ff5708e0d9792f967bc15c7685b7df665627b80ef26

SHA512
b13c4e6ffb979c7da035c6ddbfb39684aac5e407226a8d81f392bbff7ff585bdf9c411dbaa6f572c61a4684bcb7d9eb050047c535a1fa624723739c388e3413d

Download Submit
C:\Windows\System\UsLXnCU.exe

Filesize
1.9MB

MD5
e73cbbafbca2e948ec40bc2114b8f1c8

SHA1
9a68343d04c6f06a21a44a414a844ca8fbb38e51

SHA256
e9f7a29d414b3a3f86de48a05260f199ca75905c66d7c7b25c9eda87cf31750a

SHA512
7d1fb22a91045d5f342b4ba1d1a38193a821f4c8b45d012bfd6489651f9e761a5d8361e79390366077a95753edbd8c982317af34db2a88f9e578b1cd8d0f3448

Download Submit
C:\Windows\System\XXTRmkK.exe

Filesize
1.9MB

MD5
039ea793948522beec172ba6a450b4df

SHA1
3a3f47e7502beaad10136e036875044fc96e9fe8

SHA256
5d225b59bd4912384b6ae062fb8d147b5ea4de8b143214472a3c83aeb6b1bfff

SHA512
a3ff7af540276fcff4742ad93b24a919d89a484f9ba6e8c699fb6e4f348ec339afd56a7e54f327e7f1019b568a63601b3bc8c50cbd08aac15be183730f594d19

Download Submit
C:\Windows\System\XvXZkEC.exe

Filesize
1.9MB

MD5
cbfebd726d8d78880ee565208f5861df

SHA1
e007dfc8ab0ef53bdd89f02eded1f736d71e91c8

SHA256
ce00ba68bde9d158f1db6996ca10473d9d7feb5a68f51c43773c386b7fbde2e4

SHA512
898bf717d76abdb1486138a32ad81df5a3e28434ba91a4959c42b886f80131fea92be61acf6662953741e15b53c353356880cace896760e399f13d72b898a300

Download Submit
C:\Windows\System\Yqrjoqm.exe

Filesize
1.9MB

MD5
e5b76d41bc382fc91eb75f975307c4ed

SHA1
238079b0475acf2329283af6004858c5fc9a1882

SHA256
2cad2e748722254046741a1f4e0e56285b37b22fe7d0871ea14efe2595fed086

SHA512
4ff052e31a5784f508824eab611916244806394c5a67afb7bfea279ef817489db601cef92789d9fc41b6b0ec880cf43106fcf138e17131bc5d93bdc4a2ae2d59

Download Submit
C:\Windows\System\cLiEHSY.exe

Filesize
1.9MB

MD5
b136d39ed992e951a52798700b089b4f

SHA1
84cd3b4a3f0839f741fcd8aae88e6dabb9d78ed8

SHA256
47641b0ad3026c6fa68fac1e312903d1af493a4110af4f0468ad3493943fd9de

SHA512
2561ff66beb664e7e30bb2d11adff4f54004ff76fc4c335c69e6ba92f9f850a4de9578fe894b948e1966fa0c4fb5460e9b4499d3597e3b9006215622fa991d64

Download Submit
C:\Windows\System\cRgFKGr.exe

Filesize
1.9MB

MD5
cfbf0fcc77d22b0f87f5347557df2bf7

SHA1
6eccd518dfd96e97751983f58364470c07084807

SHA256
cf7ea23870486c56c6f52eb8d02267dc6b75e42dc110506dea2d31e61d8b0c3c

SHA512
b6900ee7fe6357890254d19edd3de9e85763c02cc4ea437942558360428b1393c31db0744c46b276f70c8fabcb7f69c65d7dafc03ce867b13beafd10604ac3ab

Download Submit
C:\Windows\System\dNCknCm.exe

Filesize
1.9MB

MD5
61c675d41eb9cf4c54294c9d4cee4153

SHA1
b9db77ad8f1e0cd26bdec9a6322a28440ecffad7

SHA256
f261d0078dfd062f7f2fc82366b72fd4a29f048c7661cf8320097e674a3908c1

SHA512
65543e0d49fd564f9c28f7426f683f6a3fef79d2ef1b060d9829fe82de3843310ae334b94a0d658b8b794ad25765c129c112a1746dafa6f192e1c7ca92ff4bc5

Download Submit
C:\Windows\System\ejJdyQI.exe

Filesize
1.9MB

MD5
06cc9ab77f6ab5f593ecfd2f8ede51f1

SHA1
410feade389cfb0b0814b24f08b81c282e55e580

SHA256
07a6120fa516945abfb45d5588d4bd8bdba592f976d446cc8e3a9f4f08f30fe5

SHA512
abca896d119c268bed597eba006f649115c7999ee4a9d30416615a3c851ef68dc33f67652c33464d88f2acd9613dd03efd7b33f0a5df703bc7ead01651a728e9

Download Submit
C:\Windows\System\hOPmZZn.exe

Filesize
1.9MB

MD5
a0684fdadeb0e4b08a1a172b98c62487

SHA1
a9c1099b41ead976075f3104eb7ede8458a40440

SHA256
30a730993efc0b1f4dbcf5d317efe1b3554ddb4c4a2f27483ad14572642ecb11

SHA512
3de0cf61976f3aff49a60a4963f1391d2d72a7b10a21097d72c1c4882ccc8c22094893cf6b39b68ad534d30ed599b3b14a85f79b041baa3adb542c33918da00e

Download Submit
C:\Windows\System\hzJLEZI.exe

Filesize
1.9MB

MD5
db9321c140070ae9f512b606408b1d34

SHA1
978c0c86b15604c3666cece651b7197a3186c14c

SHA256
7c9bf85bced119dfa47a758e0bb0c3b5edc9d5a0868dd1251998e7608dea5bb4

SHA512
b1aa4ddf5de1dc7d3239c838ac95b4c89d58bca5ca435ecf9cd2854d45be5cb66691b1b3f5eb86b67bf1dd55b99ace9d4179580902b63d077a7a341f9788475f

Download Submit
C:\Windows\System\iMIghSz.exe

Filesize
1.9MB

MD5
af411802e18c08fbc2e24fe1c5a2705c

SHA1
f0e3f472f81b2f25f31a59e8583c672fc03b7bda

SHA256
5240871af4d96968df6cca789639b2b773c39c34d3c78f42114224736290ccc7

SHA512
c71faff7afe4126ae6e53077040de2ce506e389e74f91f79275ecaf759309aea149a8f47afdd6fc4530e47df241f60e77ed85ebd25403b5d665a5242c06fb28c

Download Submit
C:\Windows\System\jQHAbFD.exe

Filesize
1.9MB

MD5
7c8aa81efeea217e0e6d7ba9d7a623a8

SHA1
af5c287caf5c7d16e22cff43501da4e3fc7537f2

SHA256
542a2b945b60c110817577b82814d1bf39d0c37d4d09e1220a063a4f4f57c778

SHA512
8e01f6e029a18068392a00c0048a87b545d3afaa31b7f2a6b448650817cc64b26e337844041836cc4cfa1a102f4dfbc83b80eaec0ebf0b4d7f71a969ef18365c

Download Submit
C:\Windows\System\kBpHeol.exe

Filesize
1.9MB

MD5
f8474f20fe17f08318d1eb81eb395b3c

SHA1
6d9e7058eb980774c613da7fc416b05381b3e70a

SHA256
963242e5821f178f8c0f8ca825452895d0c866cbd19c4f4138c5b2e83b3024b2

SHA512
23908f095c25e7bac41f9e206a2a74b78dd8c5270048faa703074422d3f593b6c40ab98219bfb9f7a74653768d1328e2949208fe281bc84800f07e3424e39996

Download Submit
C:\Windows\System\okLCRIH.exe

Filesize
1.9MB

MD5
0c141a10f31c3e77ca06812113338817

SHA1
cfc9f87e0ed7a4723f47ca639d543ee78dba8ae2

SHA256
b7afc975a1e9280e78ac79155449b74014edeb8dc734ff9e83adbb7a6292127f

SHA512
dc786386919e21652bf2cc8659bc4946085baeff267e44cb8147d3d56fa39be033b0a434ac24e9dc7a7b03927a0df3ddf20b0051a302ef9e96302d580248de30

Download Submit
C:\Windows\System\pdZTEfY.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\qzlSnVl.exe

Filesize
1.9MB

MD5
9c8a7d250ccefcf5ba456c73b26dd315

SHA1
707984eaf0b98b66912ead1b79a7a04551bd70b4

SHA256
d83658901771fddabd657c70d876725989b6660bdb432e9a18cba16db6f45121

SHA512
60f1ecc0dda9dd433e204ba5fa0dd415cd699121a4ac2c9442335f4b0041c66dda5df0fb0a8c7a4e9829cdd32a604aca7f6761604846ae6725603ab8dc9554eb

Download Submit
C:\Windows\System\rmTmlYv.exe

Filesize
1.9MB

MD5
92ade5f29ada0ebe551c2ba67aa72d6a

SHA1
7209d0e7e511212190c3d2fafdf42d2b9de7f008

SHA256
02ee1e6899a88bfb0b57f8a4cc0941caa1b8f80317865333bc8e9c1268a7a785

SHA512
da23e40d76d7a9d033b3b799d71742a5bf89aeff8e9ae8e0ee4cc75cef702ab13ab7e56524712c99738e48f0ab0b401303fa7411948beb89ce8728d28ce01b6f

Download Submit
C:\Windows\System\tCjOmiV.exe

Filesize
1.9MB

MD5
b41597c94124e286b516e393bc53dad6

SHA1
dcb9801ec19998df2e94fd9994cbef76d50c7115

SHA256
11b73dec892217bb32b6bcad165fea3814be4ebe19de2a262f4d782b10f4b648

SHA512
14f8f38ab8a324d42ecc0d180744dd286f071dcbb125164a6afce329c622ab15172aa52dc9d018f2d31af8d9e4d9868c8d9fd8734ca9efa13b868021751746cf

Download Submit
C:\Windows\System\vEwpaWz.exe

Filesize
1.9MB

MD5
8bf77046db4ff48492f4b51ebdb924e7

SHA1
76b7a731039f606b7f999a86b7f8897328d4c605

SHA256
5bae4e42762e9b6688e6b8862a6858929de699f9506923dc3c3ec18b38c7813c

SHA512
e1e3bf7e195e917cd3ef57a5daae339ff17fea65976a34c8c53fea08d5e08292b2f7c22119449c37f8ef1352f7ccc591d60ecf421a6c521287fba19a863d287e

Download Submit
C:\Windows\System\xWoVTQT.exe

Filesize
1.9MB

MD5
dbbbef1c55bd54a0c3f6ad5d6c62fc56

SHA1
436d856ea211e671197b2c6351bb214a8d4adb87

SHA256
ca489459c8a4df2264465f64f0f926d60e444ed60aff91d4a88bdf1144ee7ff3

SHA512
28662293d460ad090874829a98d95fc52293a0df8e32f4c457fb574457cf69e415477247e0553237d53c93e3d922bf32ba9cdea08b8918475e69cbb5df205710

Download Submit
C:\Windows\System\yuHodYr.exe

Filesize
1.9MB

MD5
97bc92b33b0d26c5151c0ea1a3d31b11

SHA1
71712490b3696084148ec1a9007a9035684bb251

SHA256
a82936d8bc420a83c5db887f7dfdfbb9f6b0dc7f0f6988b0de218e573b7d1731

SHA512
072038a1048149fb6daf5a41f46e8f4f04e006c0775601bfe6a90ebeb0b4af0bccb8d6f94e5e065a346a36722d1be81fc23dd5f1e044cc2fe287d8d603f9187e

Download Submit
C:\Windows\System\zSwpBNB.exe

Filesize
1.9MB

MD5
6cb414f8c79a506e3bea6f060f743d3e

SHA1
cdf3b2309b270f2dea09d49de332b7e2c03dae48

SHA256
da3cfc6450e7782b32b25be0dcf103ba7e81db7a317eb70d29f70e80ae8548e8

SHA512
27d2793829efa176ed264aeaab7e84909af56b81dd9482e77a40f76760ea963f3c69d79433a24d0829aad481f48e586a6dcf27abc16bff698fb0211eaff5a5ea

Download Submit
memory/432-127-0x00007FF7FE660000-0x00007FF7FEA52000-memory.dmp

Filesize
3.9MB

Download
memory/540-246-0x00007FF6DBE90000-0x00007FF6DC282000-memory.dmp

Filesize
3.9MB

Download
memory/540-4971-0x00007FF6DBE90000-0x00007FF6DC282000-memory.dmp

Filesize
3.9MB

Download
memory/856-190-0x00007FF744D20000-0x00007FF745112000-memory.dmp

Filesize
3.9MB

Download
memory/856-4951-0x00007FF744D20000-0x00007FF745112000-memory.dmp

Filesize
3.9MB

Download
memory/888-41-0x0000022552DB0000-0x0000022552DD2000-memory.dmp

Filesize
136KB

Download
memory/888-225-0x0000022552C30000-0x0000022552C40000-memory.dmp

Filesize
64KB

Download
memory/888-16-0x00007FFA559B0000-0x00007FFA56471000-memory.dmp

Filesize
10.8MB

Download
memory/888-24-0x0000022552C30000-0x0000022552C40000-memory.dmp

Filesize
64KB

Download
memory/1256-7-0x00007FF6F4140000-0x00007FF6F4532000-memory.dmp

Filesize
3.9MB

Download
memory/1596-59-0x00007FF70B7D0000-0x00007FF70BBC2000-memory.dmp

Filesize
3.9MB

Download
memory/1596-4901-0x00007FF70B7D0000-0x00007FF70BBC2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-200-0x00007FF775DE0000-0x00007FF7761D2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-4967-0x00007FF775DE0000-0x00007FF7761D2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-4915-0x00007FF702C00000-0x00007FF702FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-244-0x00007FF702C00000-0x00007FF702FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-245-0x00007FF739BF0000-0x00007FF739FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-4958-0x00007FF739BF0000-0x00007FF739FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-4909-0x00007FF7C00C0000-0x00007FF7C04B2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-78-0x00007FF7C00C0000-0x00007FF7C04B2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-87-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp

Filesize
3.9MB

Download
memory/2484-4902-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp

Filesize
3.9MB

Download
memory/2536-176-0x00007FF735390000-0x00007FF735782000-memory.dmp

Filesize
3.9MB

Download
memory/2536-4933-0x00007FF735390000-0x00007FF735782000-memory.dmp

Filesize
3.9MB

Download
memory/2764-5011-0x00007FF7BF090000-0x00007FF7BF482000-memory.dmp

Filesize
3.9MB

Download
memory/2764-250-0x00007FF7BF090000-0x00007FF7BF482000-memory.dmp

Filesize
3.9MB

Download
memory/2908-214-0x00007FF7DEB80000-0x00007FF7DEF72000-memory.dmp

Filesize
3.9MB

Download
memory/2908-4962-0x00007FF7DEB80000-0x00007FF7DEF72000-memory.dmp

Filesize
3.9MB

Download
memory/2916-1-0x0000017B05C80000-0x0000017B05C90000-memory.dmp

Filesize
64KB

Download
memory/2916-0-0x00007FF6689C0000-0x00007FF668DB2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-4973-0x00007FF707170000-0x00007FF707562000-memory.dmp

Filesize
3.9MB

Download
memory/3004-220-0x00007FF707170000-0x00007FF707562000-memory.dmp

Filesize
3.9MB

Download
memory/3104-4861-0x00007FF796D40000-0x00007FF797132000-memory.dmp

Filesize
3.9MB

Download
memory/3104-81-0x00007FF796D40000-0x00007FF797132000-memory.dmp

Filesize
3.9MB

Download
memory/3684-226-0x00007FF7ED1B0000-0x00007FF7ED5A2000-memory.dmp

Filesize
3.9MB

Download
memory/3812-4918-0x00007FF78CA00000-0x00007FF78CDF2000-memory.dmp

Filesize
3.9MB

Download
memory/3812-150-0x00007FF78CA00000-0x00007FF78CDF2000-memory.dmp

Filesize
3.9MB

Download
memory/4432-126-0x00007FF666D60000-0x00007FF667152000-memory.dmp

Filesize
3.9MB

Download
memory/4432-4905-0x00007FF666D60000-0x00007FF667152000-memory.dmp

Filesize
3.9MB

Download
memory/4572-224-0x00007FF74EF20000-0x00007FF74F312000-memory.dmp

Filesize
3.9MB

Download
memory/4572-4988-0x00007FF74EF20000-0x00007FF74F312000-memory.dmp

Filesize
3.9MB

Download
memory/4860-4840-0x00007FF6605F0000-0x00007FF6609E2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-105-0x00007FF6605F0000-0x00007FF6609E2000-memory.dmp

Filesize
3.9MB

Download
memory/4864-22-0x00007FF794A80000-0x00007FF794E72000-memory.dmp

Filesize
3.9MB

Download