xmrig | a761c06379bc49f5f7e6407ba02591fb7b2378fdde8abf75f5c72c69a5a8e26f

Analysis

max time kernel
137s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
Size

1.9MB
MD5

04724294f71b11d6dc6f56157d14fe21
SHA1

6d685c2bd426ad5ee5cb11e6d78caae44e393f75
SHA256

a761c06379bc49f5f7e6407ba02591fb7b2378fdde8abf75f5c72c69a5a8e26f
SHA512

787fd9ce25c9c1630e806edd8edd6c13de530cd651cbd655bc37d3b3ea80d716bb4a7505f3346a83e86a0d56a13c06e6e46eb1ef47cfa62e32664f8a367285c5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlLdx:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral2/memory/2640-75-0x00007FF776AE0000-0x00007FF776ED2000-memory.dmp	xmrig
behavioral2/memory/2868-87-0x00007FF7F6E60000-0x00007FF7F7252000-memory.dmp	xmrig
behavioral2/memory/3636-120-0x00007FF60D130000-0x00007FF60D522000-memory.dmp	xmrig
behavioral2/memory/8-123-0x00007FF76FB60000-0x00007FF76FF52000-memory.dmp	xmrig
behavioral2/memory/4628-122-0x00007FF60EE10000-0x00007FF60F202000-memory.dmp	xmrig
behavioral2/memory/4452-121-0x00007FF74ABB0000-0x00007FF74AFA2000-memory.dmp	xmrig
behavioral2/memory/3596-119-0x00007FF7F27A0000-0x00007FF7F2B92000-memory.dmp	xmrig
behavioral2/memory/1448-113-0x00007FF62E340000-0x00007FF62E732000-memory.dmp	xmrig
behavioral2/memory/3780-106-0x00007FF708E50000-0x00007FF709242000-memory.dmp	xmrig
behavioral2/memory/3748-96-0x00007FF70B730000-0x00007FF70BB22000-memory.dmp	xmrig
behavioral2/memory/4668-95-0x00007FF7A8490000-0x00007FF7A8882000-memory.dmp	xmrig
behavioral2/memory/1548-76-0x00007FF7E9D70000-0x00007FF7EA162000-memory.dmp	xmrig
behavioral2/memory/432-20-0x00007FF68BAC0000-0x00007FF68BEB2000-memory.dmp	xmrig
behavioral2/memory/1576-151-0x00007FF67C440000-0x00007FF67C832000-memory.dmp	xmrig
behavioral2/memory/3592-140-0x00007FF61BB90000-0x00007FF61BF82000-memory.dmp	xmrig
behavioral2/memory/1460-136-0x00007FF6B9640000-0x00007FF6B9A32000-memory.dmp	xmrig
behavioral2/memory/432-2708-0x00007FF68BAC0000-0x00007FF68BEB2000-memory.dmp	xmrig
behavioral2/memory/1676-2709-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp	xmrig
behavioral2/memory/448-3482-0x00007FF734DC0000-0x00007FF7351B2000-memory.dmp	xmrig
behavioral2/memory/1676-4632-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp	xmrig
behavioral2/memory/1352-4657-0x00007FF66FB50000-0x00007FF66FF42000-memory.dmp	xmrig
behavioral2/memory/1448-4674-0x00007FF62E340000-0x00007FF62E732000-memory.dmp	xmrig
behavioral2/memory/448-4715-0x00007FF734DC0000-0x00007FF7351B2000-memory.dmp	xmrig
behavioral2/memory/8-4719-0x00007FF76FB60000-0x00007FF76FF52000-memory.dmp	xmrig
behavioral2/memory/1576-6263-0x00007FF67C440000-0x00007FF67C832000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4884	OzVUtQt.exe
432	fSTDOMk.exe
1676	SOCPpNb.exe
2640	qnWBWLu.exe
1352	EyLGalC.exe
1548	fQWvzfD.exe
4008	TbUAkkd.exe
3596	ouWMsCv.exe
2868	CLtGAsf.exe
4668	vVvkhNK.exe
3748	Uqhuviu.exe
3780	ZYyXRJG.exe
1448	YVgcqPg.exe
3636	spMjIHx.exe
4452	FcauznH.exe
4628	FxGwdfs.exe
8	POdfZmh.exe
448	EIZBirz.exe
1460	YULUyhp.exe
3592	HTYOZuc.exe
1576	RiuZaUS.exe
2140	HSOPzLD.exe
4652	eYBhGih.exe
3504	RkJUbjE.exe
4028	OOcrofi.exe
4928	orKdXnH.exe
4280	Fmozqsc.exe
3032	ZSAUCgB.exe
4052	ZNkGZKh.exe
3288	ASejEpW.exe
4592	cOEpyAv.exe
4984	gceFyRQ.exe
1228	aimdFar.exe
3156	pQHLjUm.exe
4912	exBYbmD.exe
320	JLuQfNv.exe
3452	lKAMhCd.exe
876	DrSUWVL.exe
2368	KzMrsAv.exe
4384	NEzpxUt.exe
1568	zHcLjGi.exe
2600	UWjEZdR.exe
3304	PTweNmW.exe
4932	BHSpZUG.exe
1860	bYvpLbu.exe
4888	BqJRtjZ.exe
4148	LnmDYlT.exe
3292	OOeIyFO.exe
2684	KyQUjUu.exe
3500	XckMAQd.exe
4016	CzumiFy.exe
1984	lluehvF.exe
5008	MfpQCUV.exe
4356	mBEELJK.exe
4844	wPfChEN.exe
2408	wZwJwnl.exe
2716	BTnDbJe.exe
4312	UgvBZlp.exe
4996	siYgfOq.exe
1356	bSgaWGf.exe
1524	ymODPsi.exe
4840	kWRabrZ.exe
5012	JSZYYlh.exe
3896	rVtzjnq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4916-0-0x00007FF7F6CC0000-0x00007FF7F70B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-7.dat	upx
behavioral2/files/0x0010000000023b7b-16.dat	upx
behavioral2/files/0x000a000000023bc8-24.dat	upx
behavioral2/files/0x000a000000023bc9-30.dat	upx
behavioral2/files/0x000a000000023bc7-37.dat	upx
behavioral2/files/0x000a000000023bcc-51.dat	upx
behavioral2/files/0x000a000000023bcb-56.dat	upx
behavioral2/files/0x000a000000023bcd-63.dat	upx
behavioral2/files/0x000a000000023bd0-69.dat	upx
behavioral2/memory/2640-75-0x00007FF776AE0000-0x00007FF776ED2000-memory.dmp	upx
behavioral2/memory/2868-87-0x00007FF7F6E60000-0x00007FF7F7252000-memory.dmp	upx
behavioral2/files/0x000a000000023bd3-98.dat	upx
behavioral2/files/0x000b000000023bc3-115.dat	upx
behavioral2/memory/3636-120-0x00007FF60D130000-0x00007FF60D522000-memory.dmp	upx
behavioral2/memory/8-123-0x00007FF76FB60000-0x00007FF76FF52000-memory.dmp	upx
behavioral2/memory/4628-122-0x00007FF60EE10000-0x00007FF60F202000-memory.dmp	upx
behavioral2/memory/4452-121-0x00007FF74ABB0000-0x00007FF74AFA2000-memory.dmp	upx
behavioral2/memory/3596-119-0x00007FF7F27A0000-0x00007FF7F2B92000-memory.dmp	upx
behavioral2/files/0x000a000000023bd6-117.dat	upx
behavioral2/memory/448-114-0x00007FF734DC0000-0x00007FF7351B2000-memory.dmp	upx
behavioral2/memory/1448-113-0x00007FF62E340000-0x00007FF62E732000-memory.dmp	upx
behavioral2/files/0x000a000000023bd2-107.dat	upx
behavioral2/memory/3780-106-0x00007FF708E50000-0x00007FF709242000-memory.dmp	upx
behavioral2/memory/3748-96-0x00007FF70B730000-0x00007FF70BB22000-memory.dmp	upx
behavioral2/memory/4668-95-0x00007FF7A8490000-0x00007FF7A8882000-memory.dmp	upx
behavioral2/files/0x000a000000023bd1-92.dat	upx
behavioral2/files/0x000a000000023bcf-90.dat	upx
behavioral2/memory/1548-76-0x00007FF7E9D70000-0x00007FF7EA162000-memory.dmp	upx
behavioral2/files/0x000a000000023bce-66.dat	upx
behavioral2/files/0x000a000000023bca-49.dat	upx
behavioral2/memory/4008-45-0x00007FF741960000-0x00007FF741D52000-memory.dmp	upx
behavioral2/memory/1352-38-0x00007FF66FB50000-0x00007FF66FF42000-memory.dmp	upx
behavioral2/memory/1676-27-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp	upx
behavioral2/memory/432-20-0x00007FF68BAC0000-0x00007FF68BEB2000-memory.dmp	upx
behavioral2/files/0x000b000000023bc2-12.dat	upx
behavioral2/memory/4884-14-0x00007FF726EC0000-0x00007FF7272B2000-memory.dmp	upx
behavioral2/files/0x000b000000023bd5-127.dat	upx
behavioral2/files/0x000a000000023bd9-148.dat	upx
behavioral2/files/0x000a000000023bdc-155.dat	upx
behavioral2/files/0x000a000000023bde-169.dat	upx
behavioral2/files/0x000a000000023be9-187.dat	upx
behavioral2/files/0x000b000000023be1-184.dat	upx
behavioral2/files/0x0009000000023bfe-198.dat	upx
behavioral2/files/0x0008000000023bf9-197.dat	upx
behavioral2/files/0x000e000000023bf0-196.dat	upx
behavioral2/files/0x000b000000023be0-180.dat	upx
behavioral2/files/0x000b000000023bdf-177.dat	upx
behavioral2/files/0x000a000000023bdd-164.dat	upx
behavioral2/files/0x000a000000023bdb-160.dat	upx
behavioral2/files/0x000a000000023bda-156.dat	upx
behavioral2/memory/1576-151-0x00007FF67C440000-0x00007FF67C832000-memory.dmp	upx
behavioral2/files/0x000a000000023bd8-142.dat	upx
behavioral2/memory/3592-140-0x00007FF61BB90000-0x00007FF61BF82000-memory.dmp	upx
behavioral2/memory/1460-136-0x00007FF6B9640000-0x00007FF6B9A32000-memory.dmp	upx
behavioral2/files/0x000a000000023bd7-131.dat	upx
behavioral2/memory/432-2708-0x00007FF68BAC0000-0x00007FF68BEB2000-memory.dmp	upx
behavioral2/memory/1676-2709-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp	upx
behavioral2/memory/448-3482-0x00007FF734DC0000-0x00007FF7351B2000-memory.dmp	upx
behavioral2/memory/1676-4632-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp	upx
behavioral2/memory/1352-4657-0x00007FF66FB50000-0x00007FF66FF42000-memory.dmp	upx
behavioral2/memory/1448-4674-0x00007FF62E340000-0x00007FF62E732000-memory.dmp	upx
behavioral2/memory/448-4715-0x00007FF734DC0000-0x00007FF7351B2000-memory.dmp	upx
behavioral2/memory/8-4719-0x00007FF76FB60000-0x00007FF76FF52000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gzdyuyi.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\cmyNRiB.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\HQpDYdi.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\LMQarBx.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\mgRLyxz.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\IVzWzSH.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\qwpUfFh.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\atEbmSY.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\NHDgdTw.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\hmkJGYu.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\WezlRsy.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\fJOUgGi.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\NtJJpsH.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\MxQbLSl.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\NPdpCxS.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\RSFmSFr.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\SHYUuFa.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\YYouZYQ.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\GDUnQdg.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\OzVUtQt.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\eQvUtYa.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\WOpydyK.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\DCmsASV.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\HZzatCs.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\NujjoSD.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\kebjMzj.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\MdPAeOW.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\Opbkfzo.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\EMdzRbp.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\Jukvwch.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\umHEqAc.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\YqlqxUS.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\FShmVgu.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\fRLlWpZ.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\WPJvVJc.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\xUFmlJo.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\WbIOOWr.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\HovnVkX.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\LnLBFzr.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\knElxFF.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\ynKMLhD.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\xpcvngP.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\nNdpClY.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\dkFftku.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\Pphvpjg.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\jkvGRuA.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\wygoyiO.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\QwAMZhh.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\vXsczlA.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\ypQnzto.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\sASvWUw.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\bhQDArc.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\Jdoebcm.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\FxTEkgT.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\gfoJhcx.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\dQOxNUi.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\PDPIrOn.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\cBUkTrh.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\CNVIhgG.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\XAohzWk.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\YrYFhBB.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\mcxeKzN.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\EgPBpzZ.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\qlQyqEM.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3068	powershell.exe
3068	powershell.exe
3068	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
Token: SeDebugPrivilege	3068	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3068	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	85
PID 4916 wrote to memory of 3068	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	85
PID 4916 wrote to memory of 4884	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	86
PID 4916 wrote to memory of 4884	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	86
PID 4916 wrote to memory of 432	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	87
PID 4916 wrote to memory of 432	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	87
PID 4916 wrote to memory of 1676	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	88
PID 4916 wrote to memory of 1676	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	88
PID 4916 wrote to memory of 2640	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	89
PID 4916 wrote to memory of 2640	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	89
PID 4916 wrote to memory of 1352	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	90
PID 4916 wrote to memory of 1352	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	90
PID 4916 wrote to memory of 1548	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	91
PID 4916 wrote to memory of 1548	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	91
PID 4916 wrote to memory of 4008	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	92
PID 4916 wrote to memory of 4008	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	92
PID 4916 wrote to memory of 3596	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	93
PID 4916 wrote to memory of 3596	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	93
PID 4916 wrote to memory of 2868	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	94
PID 4916 wrote to memory of 2868	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	94
PID 4916 wrote to memory of 4668	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	95
PID 4916 wrote to memory of 4668	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	95
PID 4916 wrote to memory of 3748	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	96
PID 4916 wrote to memory of 3748	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	96
PID 4916 wrote to memory of 3780	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	97
PID 4916 wrote to memory of 3780	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	97
PID 4916 wrote to memory of 1448	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	98
PID 4916 wrote to memory of 1448	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	98
PID 4916 wrote to memory of 3636	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	99
PID 4916 wrote to memory of 3636	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	99
PID 4916 wrote to memory of 4452	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	100
PID 4916 wrote to memory of 4452	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	100
PID 4916 wrote to memory of 4628	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	101
PID 4916 wrote to memory of 4628	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	101
PID 4916 wrote to memory of 8	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	102
PID 4916 wrote to memory of 8	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	102
PID 4916 wrote to memory of 448	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	103
PID 4916 wrote to memory of 448	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	103
PID 4916 wrote to memory of 1460	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	104
PID 4916 wrote to memory of 1460	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	104
PID 4916 wrote to memory of 3592	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	105
PID 4916 wrote to memory of 3592	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	105
PID 4916 wrote to memory of 1576	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	106
PID 4916 wrote to memory of 1576	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	106
PID 4916 wrote to memory of 2140	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	107
PID 4916 wrote to memory of 2140	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	107
PID 4916 wrote to memory of 4652	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	108
PID 4916 wrote to memory of 4652	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	108
PID 4916 wrote to memory of 3504	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	109
PID 4916 wrote to memory of 3504	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	109
PID 4916 wrote to memory of 4028	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	110
PID 4916 wrote to memory of 4028	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	110
PID 4916 wrote to memory of 4928	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	112
PID 4916 wrote to memory of 4928	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	112
PID 4916 wrote to memory of 4280	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	113
PID 4916 wrote to memory of 4280	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	113
PID 4916 wrote to memory of 3032	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	114
PID 4916 wrote to memory of 3032	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	114
PID 4916 wrote to memory of 4052	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	115
PID 4916 wrote to memory of 4052	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	115
PID 4916 wrote to memory of 3288	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	116
PID 4916 wrote to memory of 3288	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	116
PID 4916 wrote to memory of 4592	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	117
PID 4916 wrote to memory of 4592	4916	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\System\OzVUtQt.exe
  C:\Windows\System\OzVUtQt.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\fSTDOMk.exe
  C:\Windows\System\fSTDOMk.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\SOCPpNb.exe
  C:\Windows\System\SOCPpNb.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\qnWBWLu.exe
  C:\Windows\System\qnWBWLu.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\EyLGalC.exe
  C:\Windows\System\EyLGalC.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\fQWvzfD.exe
  C:\Windows\System\fQWvzfD.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\TbUAkkd.exe
  C:\Windows\System\TbUAkkd.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\ouWMsCv.exe
  C:\Windows\System\ouWMsCv.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\CLtGAsf.exe
  C:\Windows\System\CLtGAsf.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\vVvkhNK.exe
  C:\Windows\System\vVvkhNK.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\Uqhuviu.exe
  C:\Windows\System\Uqhuviu.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\ZYyXRJG.exe
  C:\Windows\System\ZYyXRJG.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\YVgcqPg.exe
  C:\Windows\System\YVgcqPg.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\spMjIHx.exe
  C:\Windows\System\spMjIHx.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\FcauznH.exe
  C:\Windows\System\FcauznH.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\FxGwdfs.exe
  C:\Windows\System\FxGwdfs.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\POdfZmh.exe
  C:\Windows\System\POdfZmh.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\EIZBirz.exe
  C:\Windows\System\EIZBirz.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\YULUyhp.exe
  C:\Windows\System\YULUyhp.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\HTYOZuc.exe
  C:\Windows\System\HTYOZuc.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\RiuZaUS.exe
  C:\Windows\System\RiuZaUS.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\HSOPzLD.exe
  C:\Windows\System\HSOPzLD.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\eYBhGih.exe
  C:\Windows\System\eYBhGih.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\RkJUbjE.exe
  C:\Windows\System\RkJUbjE.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\OOcrofi.exe
  C:\Windows\System\OOcrofi.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\orKdXnH.exe
  C:\Windows\System\orKdXnH.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\Fmozqsc.exe
  C:\Windows\System\Fmozqsc.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\ZSAUCgB.exe
  C:\Windows\System\ZSAUCgB.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\ZNkGZKh.exe
  C:\Windows\System\ZNkGZKh.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\ASejEpW.exe
  C:\Windows\System\ASejEpW.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\cOEpyAv.exe
  C:\Windows\System\cOEpyAv.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\gceFyRQ.exe
  C:\Windows\System\gceFyRQ.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\aimdFar.exe
  C:\Windows\System\aimdFar.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\pQHLjUm.exe
  C:\Windows\System\pQHLjUm.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\exBYbmD.exe
  C:\Windows\System\exBYbmD.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\JLuQfNv.exe
  C:\Windows\System\JLuQfNv.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\lKAMhCd.exe
  C:\Windows\System\lKAMhCd.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\DrSUWVL.exe
  C:\Windows\System\DrSUWVL.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\KzMrsAv.exe
  C:\Windows\System\KzMrsAv.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\NEzpxUt.exe
  C:\Windows\System\NEzpxUt.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\zHcLjGi.exe
  C:\Windows\System\zHcLjGi.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\UWjEZdR.exe
  C:\Windows\System\UWjEZdR.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\PTweNmW.exe
  C:\Windows\System\PTweNmW.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\BHSpZUG.exe
  C:\Windows\System\BHSpZUG.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\bYvpLbu.exe
  C:\Windows\System\bYvpLbu.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\BqJRtjZ.exe
  C:\Windows\System\BqJRtjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\LnmDYlT.exe
  C:\Windows\System\LnmDYlT.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\OOeIyFO.exe
  C:\Windows\System\OOeIyFO.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\KyQUjUu.exe
  C:\Windows\System\KyQUjUu.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\XckMAQd.exe
  C:\Windows\System\XckMAQd.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\CzumiFy.exe
  C:\Windows\System\CzumiFy.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\lluehvF.exe
  C:\Windows\System\lluehvF.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\MfpQCUV.exe
  C:\Windows\System\MfpQCUV.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\mBEELJK.exe
  C:\Windows\System\mBEELJK.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\wPfChEN.exe
  C:\Windows\System\wPfChEN.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\wZwJwnl.exe
  C:\Windows\System\wZwJwnl.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\BTnDbJe.exe
  C:\Windows\System\BTnDbJe.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\UgvBZlp.exe
  C:\Windows\System\UgvBZlp.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\siYgfOq.exe
  C:\Windows\System\siYgfOq.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\bSgaWGf.exe
  C:\Windows\System\bSgaWGf.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\ymODPsi.exe
  C:\Windows\System\ymODPsi.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\kWRabrZ.exe
  C:\Windows\System\kWRabrZ.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\JSZYYlh.exe
  C:\Windows\System\JSZYYlh.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\rVtzjnq.exe
  C:\Windows\System\rVtzjnq.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\oUjWOYo.exe
  C:\Windows\System\oUjWOYo.exe
  2⤵
  PID:5128
- C:\Windows\System\XAeIDqF.exe
  C:\Windows\System\XAeIDqF.exe
  2⤵
  PID:5156
- C:\Windows\System\RnTGxnb.exe
  C:\Windows\System\RnTGxnb.exe
  2⤵
  PID:5184
- C:\Windows\System\ZLhcRyb.exe
  C:\Windows\System\ZLhcRyb.exe
  2⤵
  PID:5212
- C:\Windows\System\FtThmiE.exe
  C:\Windows\System\FtThmiE.exe
  2⤵
  PID:5240
- C:\Windows\System\dgCltTZ.exe
  C:\Windows\System\dgCltTZ.exe
  2⤵
  PID:5268
- C:\Windows\System\uJnxoBx.exe
  C:\Windows\System\uJnxoBx.exe
  2⤵
  PID:5292
- C:\Windows\System\MPIQuhO.exe
  C:\Windows\System\MPIQuhO.exe
  2⤵
  PID:5324
- C:\Windows\System\vXsczlA.exe
  C:\Windows\System\vXsczlA.exe
  2⤵
  PID:5352
- C:\Windows\System\iMnEMaP.exe
  C:\Windows\System\iMnEMaP.exe
  2⤵
  PID:5380
- C:\Windows\System\ZagGgJd.exe
  C:\Windows\System\ZagGgJd.exe
  2⤵
  PID:5408
- C:\Windows\System\mUpylJc.exe
  C:\Windows\System\mUpylJc.exe
  2⤵
  PID:5436
- C:\Windows\System\DlUbfPk.exe
  C:\Windows\System\DlUbfPk.exe
  2⤵
  PID:5464
- C:\Windows\System\oXbjXMU.exe
  C:\Windows\System\oXbjXMU.exe
  2⤵
  PID:5492
- C:\Windows\System\pjwhMIH.exe
  C:\Windows\System\pjwhMIH.exe
  2⤵
  PID:5520
- C:\Windows\System\dODzHVP.exe
  C:\Windows\System\dODzHVP.exe
  2⤵
  PID:5604
- C:\Windows\System\UmNrvjI.exe
  C:\Windows\System\UmNrvjI.exe
  2⤵
  PID:5620
- C:\Windows\System\tKzzDGT.exe
  C:\Windows\System\tKzzDGT.exe
  2⤵
  PID:5644
- C:\Windows\System\fkyafru.exe
  C:\Windows\System\fkyafru.exe
  2⤵
  PID:5676
- C:\Windows\System\HVXYjWD.exe
  C:\Windows\System\HVXYjWD.exe
  2⤵
  PID:5700
- C:\Windows\System\rIEYBhi.exe
  C:\Windows\System\rIEYBhi.exe
  2⤵
  PID:5744
- C:\Windows\System\ApnCmMF.exe
  C:\Windows\System\ApnCmMF.exe
  2⤵
  PID:5764
- C:\Windows\System\FKeEoVJ.exe
  C:\Windows\System\FKeEoVJ.exe
  2⤵
  PID:5808
- C:\Windows\System\HhqapuQ.exe
  C:\Windows\System\HhqapuQ.exe
  2⤵
  PID:5832
- C:\Windows\System\jFxXxJP.exe
  C:\Windows\System\jFxXxJP.exe
  2⤵
  PID:5864
- C:\Windows\System\sPrAiCf.exe
  C:\Windows\System\sPrAiCf.exe
  2⤵
  PID:5904
- C:\Windows\System\YXHycxW.exe
  C:\Windows\System\YXHycxW.exe
  2⤵
  PID:5920
- C:\Windows\System\LSZWQZk.exe
  C:\Windows\System\LSZWQZk.exe
  2⤵
  PID:5948
- C:\Windows\System\YtomivK.exe
  C:\Windows\System\YtomivK.exe
  2⤵
  PID:5972
- C:\Windows\System\gkbVmTd.exe
  C:\Windows\System\gkbVmTd.exe
  2⤵
  PID:6004
- C:\Windows\System\bUrUcdu.exe
  C:\Windows\System\bUrUcdu.exe
  2⤵
  PID:6036
- C:\Windows\System\VMpYOrA.exe
  C:\Windows\System\VMpYOrA.exe
  2⤵
  PID:6060
- C:\Windows\System\nQtkSVY.exe
  C:\Windows\System\nQtkSVY.exe
  2⤵
  PID:6088
- C:\Windows\System\OvjRuJC.exe
  C:\Windows\System\OvjRuJC.exe
  2⤵
  PID:6104
- C:\Windows\System\tsTwZQN.exe
  C:\Windows\System\tsTwZQN.exe
  2⤵
  PID:6132
- C:\Windows\System\XxpLyaR.exe
  C:\Windows\System\XxpLyaR.exe
  2⤵
  PID:5420
- C:\Windows\System\QRXppIQ.exe
  C:\Windows\System\QRXppIQ.exe
  2⤵
  PID:5372
- C:\Windows\System\xAGqYQa.exe
  C:\Windows\System\xAGqYQa.exe
  2⤵
  PID:5340
- C:\Windows\System\KkFibVm.exe
  C:\Windows\System\KkFibVm.exe
  2⤵
  PID:5288
- C:\Windows\System\xHxKhLm.exe
  C:\Windows\System\xHxKhLm.exe
  2⤵
  PID:5260
- C:\Windows\System\mOlOtEC.exe
  C:\Windows\System\mOlOtEC.exe
  2⤵
  PID:5176
- C:\Windows\System\BVfTTTu.exe
  C:\Windows\System\BVfTTTu.exe
  2⤵
  PID:2380
- C:\Windows\System\PjRVuLd.exe
  C:\Windows\System\PjRVuLd.exe
  2⤵
  PID:1696
- C:\Windows\System\MLEqMxL.exe
  C:\Windows\System\MLEqMxL.exe
  2⤵
  PID:4952
- C:\Windows\System\uCABhXf.exe
  C:\Windows\System\uCABhXf.exe
  2⤵
  PID:620
- C:\Windows\System\ejuPCYD.exe
  C:\Windows\System\ejuPCYD.exe
  2⤵
  PID:2556
- C:\Windows\System\XfPVCIv.exe
  C:\Windows\System\XfPVCIv.exe
  2⤵
  PID:3824
- C:\Windows\System\tnOXDot.exe
  C:\Windows\System\tnOXDot.exe
  2⤵
  PID:2552
- C:\Windows\System\CfEvZXK.exe
  C:\Windows\System\CfEvZXK.exe
  2⤵
  PID:4440
- C:\Windows\System\tsTHuqX.exe
  C:\Windows\System\tsTHuqX.exe
  2⤵
  PID:1368
- C:\Windows\System\dNKhVip.exe
  C:\Windows\System\dNKhVip.exe
  2⤵
  PID:4484
- C:\Windows\System\NoNTHih.exe
  C:\Windows\System\NoNTHih.exe
  2⤵
  PID:4368
- C:\Windows\System\IpPtxOV.exe
  C:\Windows\System\IpPtxOV.exe
  2⤵
  PID:3140
- C:\Windows\System\eSxyLkk.exe
  C:\Windows\System\eSxyLkk.exe
  2⤵
  PID:2348
- C:\Windows\System\UlePunN.exe
  C:\Windows\System\UlePunN.exe
  2⤵
  PID:5040
- C:\Windows\System\aAPTEag.exe
  C:\Windows\System\aAPTEag.exe
  2⤵
  PID:2496
- C:\Windows\System\LGmxDrC.exe
  C:\Windows\System\LGmxDrC.exe
  2⤵
  PID:5484
- C:\Windows\System\YMjHNRE.exe
  C:\Windows\System\YMjHNRE.exe
  2⤵
  PID:5528
- C:\Windows\System\SjypdgM.exe
  C:\Windows\System\SjypdgM.exe
  2⤵
  PID:2236
- C:\Windows\System\euYmYho.exe
  C:\Windows\System\euYmYho.exe
  2⤵
  PID:2416
- C:\Windows\System\OxqQRou.exe
  C:\Windows\System\OxqQRou.exe
  2⤵
  PID:5600
- C:\Windows\System\dMoargX.exe
  C:\Windows\System\dMoargX.exe
  2⤵
  PID:5772
- C:\Windows\System\LlcEHsh.exe
  C:\Windows\System\LlcEHsh.exe
  2⤵
  PID:5756
- C:\Windows\System\eiLRHtV.exe
  C:\Windows\System\eiLRHtV.exe
  2⤵
  PID:5876
- C:\Windows\System\tDOBPNC.exe
  C:\Windows\System\tDOBPNC.exe
  2⤵
  PID:5956
- C:\Windows\System\EizSQLz.exe
  C:\Windows\System\EizSQLz.exe
  2⤵
  PID:6052
- C:\Windows\System\mMmTAhk.exe
  C:\Windows\System\mMmTAhk.exe
  2⤵
  PID:6044
- C:\Windows\System\DlJOgFl.exe
  C:\Windows\System\DlJOgFl.exe
  2⤵
  PID:6120
- C:\Windows\System\PwBpCBj.exe
  C:\Windows\System\PwBpCBj.exe
  2⤵
  PID:4308
- C:\Windows\System\CjajEgC.exe
  C:\Windows\System\CjajEgC.exe
  2⤵
  PID:3796
- C:\Windows\System\MlOqukc.exe
  C:\Windows\System\MlOqukc.exe
  2⤵
  PID:1268
- C:\Windows\System\pYXCAaM.exe
  C:\Windows\System\pYXCAaM.exe
  2⤵
  PID:1828
- C:\Windows\System\bQLxjDM.exe
  C:\Windows\System\bQLxjDM.exe
  2⤵
  PID:4100
- C:\Windows\System\VfqeKdL.exe
  C:\Windows\System\VfqeKdL.exe
  2⤵
  PID:436
- C:\Windows\System\sqkLFzA.exe
  C:\Windows\System\sqkLFzA.exe
  2⤵
  PID:4564
- C:\Windows\System\PvFmuur.exe
  C:\Windows\System\PvFmuur.exe
  2⤵
  PID:2872
- C:\Windows\System\OaOzziA.exe
  C:\Windows\System\OaOzziA.exe
  2⤵
  PID:3272
- C:\Windows\System\zPWrXpV.exe
  C:\Windows\System\zPWrXpV.exe
  2⤵
  PID:3228
- C:\Windows\System\IkFvSdA.exe
  C:\Windows\System\IkFvSdA.exe
  2⤵
  PID:3764
- C:\Windows\System\WoxkDFO.exe
  C:\Windows\System\WoxkDFO.exe
  2⤵
  PID:1500
- C:\Windows\System\EltmuUp.exe
  C:\Windows\System\EltmuUp.exe
  2⤵
  PID:5516
- C:\Windows\System\cgQzTfK.exe
  C:\Windows\System\cgQzTfK.exe
  2⤵
  PID:4172
- C:\Windows\System\WEjOsTv.exe
  C:\Windows\System\WEjOsTv.exe
  2⤵
  PID:5824
- C:\Windows\System\OdxZCPX.exe
  C:\Windows\System\OdxZCPX.exe
  2⤵
  PID:5804
- C:\Windows\System\GjFoEMB.exe
  C:\Windows\System\GjFoEMB.exe
  2⤵
  PID:5928
- C:\Windows\System\ofogKtR.exe
  C:\Windows\System\ofogKtR.exe
  2⤵
  PID:1516
- C:\Windows\System\nrXTsEA.exe
  C:\Windows\System\nrXTsEA.exe
  2⤵
  PID:4940
- C:\Windows\System\FqFtCdR.exe
  C:\Windows\System\FqFtCdR.exe
  2⤵
  PID:5096
- C:\Windows\System\HEKaIcP.exe
  C:\Windows\System\HEKaIcP.exe
  2⤵
  PID:1468
- C:\Windows\System\qDecZbq.exe
  C:\Windows\System\qDecZbq.exe
  2⤵
  PID:3196
- C:\Windows\System\oAkJpQM.exe
  C:\Windows\System\oAkJpQM.exe
  2⤵
  PID:3480
- C:\Windows\System\MSbfwcE.exe
  C:\Windows\System\MSbfwcE.exe
  2⤵
  PID:5476
- C:\Windows\System\FeFMNbM.exe
  C:\Windows\System\FeFMNbM.exe
  2⤵
  PID:6168
- C:\Windows\System\fpAuABa.exe
  C:\Windows\System\fpAuABa.exe
  2⤵
  PID:6188
- C:\Windows\System\tFdPHqL.exe
  C:\Windows\System\tFdPHqL.exe
  2⤵
  PID:6212
- C:\Windows\System\alTmtTL.exe
  C:\Windows\System\alTmtTL.exe
  2⤵
  PID:6236
- C:\Windows\System\kUouNMG.exe
  C:\Windows\System\kUouNMG.exe
  2⤵
  PID:6256
- C:\Windows\System\zwdIgNF.exe
  C:\Windows\System\zwdIgNF.exe
  2⤵
  PID:6336
- C:\Windows\System\mEwxWZQ.exe
  C:\Windows\System\mEwxWZQ.exe
  2⤵
  PID:6384
- C:\Windows\System\JRZOeHN.exe
  C:\Windows\System\JRZOeHN.exe
  2⤵
  PID:6404
- C:\Windows\System\dJRIRJu.exe
  C:\Windows\System\dJRIRJu.exe
  2⤵
  PID:6424
- C:\Windows\System\FUSPnUw.exe
  C:\Windows\System\FUSPnUw.exe
  2⤵
  PID:6448
- C:\Windows\System\yoiNHAH.exe
  C:\Windows\System\yoiNHAH.exe
  2⤵
  PID:6472
- C:\Windows\System\nWutfMa.exe
  C:\Windows\System\nWutfMa.exe
  2⤵
  PID:6504
- C:\Windows\System\EnGJIWc.exe
  C:\Windows\System\EnGJIWc.exe
  2⤵
  PID:6520
- C:\Windows\System\LwsPhEG.exe
  C:\Windows\System\LwsPhEG.exe
  2⤵
  PID:6544
- C:\Windows\System\kvgZRKw.exe
  C:\Windows\System\kvgZRKw.exe
  2⤵
  PID:6568
- C:\Windows\System\TJJEcaG.exe
  C:\Windows\System\TJJEcaG.exe
  2⤵
  PID:6588
- C:\Windows\System\OFXqrRZ.exe
  C:\Windows\System\OFXqrRZ.exe
  2⤵
  PID:6644
- C:\Windows\System\LucUxpe.exe
  C:\Windows\System\LucUxpe.exe
  2⤵
  PID:6664
- C:\Windows\System\WtBfgLm.exe
  C:\Windows\System\WtBfgLm.exe
  2⤵
  PID:6688
- C:\Windows\System\RFoLfSg.exe
  C:\Windows\System\RFoLfSg.exe
  2⤵
  PID:6704
- C:\Windows\System\evoGxmF.exe
  C:\Windows\System\evoGxmF.exe
  2⤵
  PID:6724
- C:\Windows\System\chRwMaN.exe
  C:\Windows\System\chRwMaN.exe
  2⤵
  PID:6772
- C:\Windows\System\hXseEFk.exe
  C:\Windows\System\hXseEFk.exe
  2⤵
  PID:6804
- C:\Windows\System\sGQFqxy.exe
  C:\Windows\System\sGQFqxy.exe
  2⤵
  PID:6820
- C:\Windows\System\dEzJjSc.exe
  C:\Windows\System\dEzJjSc.exe
  2⤵
  PID:6844
- C:\Windows\System\BZCJngJ.exe
  C:\Windows\System\BZCJngJ.exe
  2⤵
  PID:6860
- C:\Windows\System\gVtwIWv.exe
  C:\Windows\System\gVtwIWv.exe
  2⤵
  PID:6924
- C:\Windows\System\lgnUSzP.exe
  C:\Windows\System\lgnUSzP.exe
  2⤵
  PID:6944
- C:\Windows\System\xktGkfN.exe
  C:\Windows\System\xktGkfN.exe
  2⤵
  PID:6968
- C:\Windows\System\oAuOfkw.exe
  C:\Windows\System\oAuOfkw.exe
  2⤵
  PID:6984
- C:\Windows\System\NFprpxW.exe
  C:\Windows\System\NFprpxW.exe
  2⤵
  PID:7036
- C:\Windows\System\ANTNGjj.exe
  C:\Windows\System\ANTNGjj.exe
  2⤵
  PID:7084
- C:\Windows\System\HgxWmfK.exe
  C:\Windows\System\HgxWmfK.exe
  2⤵
  PID:7104
- C:\Windows\System\lcLOQHf.exe
  C:\Windows\System\lcLOQHf.exe
  2⤵
  PID:7124
- C:\Windows\System\IrCbPjH.exe
  C:\Windows\System\IrCbPjH.exe
  2⤵
  PID:7148
- C:\Windows\System\KLgyquF.exe
  C:\Windows\System\KLgyquF.exe
  2⤵
  PID:5320
- C:\Windows\System\pRJiCbh.exe
  C:\Windows\System\pRJiCbh.exe
  2⤵
  PID:5448
- C:\Windows\System\fZqSzal.exe
  C:\Windows\System\fZqSzal.exe
  2⤵
  PID:6204
- C:\Windows\System\PHkhOpt.exe
  C:\Windows\System\PHkhOpt.exe
  2⤵
  PID:6284
- C:\Windows\System\tShtpkO.exe
  C:\Windows\System\tShtpkO.exe
  2⤵
  PID:6324
- C:\Windows\System\nQlvtja.exe
  C:\Windows\System\nQlvtja.exe
  2⤵
  PID:6436
- C:\Windows\System\eQCAcac.exe
  C:\Windows\System\eQCAcac.exe
  2⤵
  PID:6468
- C:\Windows\System\RktvoaY.exe
  C:\Windows\System\RktvoaY.exe
  2⤵
  PID:6528
- C:\Windows\System\MKVyEnf.exe
  C:\Windows\System\MKVyEnf.exe
  2⤵
  PID:6580
- C:\Windows\System\TRGCRht.exe
  C:\Windows\System\TRGCRht.exe
  2⤵
  PID:6676
- C:\Windows\System\SSKarcY.exe
  C:\Windows\System\SSKarcY.exe
  2⤵
  PID:6736
- C:\Windows\System\nieOssf.exe
  C:\Windows\System\nieOssf.exe
  2⤵
  PID:6816
- C:\Windows\System\LQcZVIh.exe
  C:\Windows\System\LQcZVIh.exe
  2⤵
  PID:6884
- C:\Windows\System\GcWZKEQ.exe
  C:\Windows\System\GcWZKEQ.exe
  2⤵
  PID:6896
- C:\Windows\System\RiSHsCc.exe
  C:\Windows\System\RiSHsCc.exe
  2⤵
  PID:7012
- C:\Windows\System\rPjRheI.exe
  C:\Windows\System\rPjRheI.exe
  2⤵
  PID:7028
- C:\Windows\System\tWOPrkx.exe
  C:\Windows\System\tWOPrkx.exe
  2⤵
  PID:7056
- C:\Windows\System\zHtdWZt.exe
  C:\Windows\System\zHtdWZt.exe
  2⤵
  PID:7092
- C:\Windows\System\TPSUWzG.exe
  C:\Windows\System\TPSUWzG.exe
  2⤵
  PID:6128
- C:\Windows\System\nUyQEBk.exe
  C:\Windows\System\nUyQEBk.exe
  2⤵
  PID:6432
- C:\Windows\System\tMYeGxl.exe
  C:\Windows\System\tMYeGxl.exe
  2⤵
  PID:6464
- C:\Windows\System\xyQfuBF.exe
  C:\Windows\System\xyQfuBF.exe
  2⤵
  PID:6716
- C:\Windows\System\OIpzfbS.exe
  C:\Windows\System\OIpzfbS.exe
  2⤵
  PID:6828
- C:\Windows\System\gTUpxEJ.exe
  C:\Windows\System\gTUpxEJ.exe
  2⤵
  PID:7132
- C:\Windows\System\lAbHaeJ.exe
  C:\Windows\System\lAbHaeJ.exe
  2⤵
  PID:6952
- C:\Windows\System\nFXpvAp.exe
  C:\Windows\System\nFXpvAp.exe
  2⤵
  PID:6352
- C:\Windows\System\lADKHzq.exe
  C:\Windows\System\lADKHzq.exe
  2⤵
  PID:6312
- C:\Windows\System\uCPHtfC.exe
  C:\Windows\System\uCPHtfC.exe
  2⤵
  PID:6560
- C:\Windows\System\owMMFPi.exe
  C:\Windows\System\owMMFPi.exe
  2⤵
  PID:7208
- C:\Windows\System\HQpDYdi.exe
  C:\Windows\System\HQpDYdi.exe
  2⤵
  PID:7228
- C:\Windows\System\lEpQgze.exe
  C:\Windows\System\lEpQgze.exe
  2⤵
  PID:7248
- C:\Windows\System\KokanEu.exe
  C:\Windows\System\KokanEu.exe
  2⤵
  PID:7272
- C:\Windows\System\ZeyhQVv.exe
  C:\Windows\System\ZeyhQVv.exe
  2⤵
  PID:7288
- C:\Windows\System\QYvXAQD.exe
  C:\Windows\System\QYvXAQD.exe
  2⤵
  PID:7304
- C:\Windows\System\ipCFNHt.exe
  C:\Windows\System\ipCFNHt.exe
  2⤵
  PID:7356
- C:\Windows\System\slqMpwr.exe
  C:\Windows\System\slqMpwr.exe
  2⤵
  PID:7400
- C:\Windows\System\ezRsodz.exe
  C:\Windows\System\ezRsodz.exe
  2⤵
  PID:7436
- C:\Windows\System\zSIFnYh.exe
  C:\Windows\System\zSIFnYh.exe
  2⤵
  PID:7456
- C:\Windows\System\ZaCkkIP.exe
  C:\Windows\System\ZaCkkIP.exe
  2⤵
  PID:7480
- C:\Windows\System\NOjzkDa.exe
  C:\Windows\System\NOjzkDa.exe
  2⤵
  PID:7500
- C:\Windows\System\HXxVVPr.exe
  C:\Windows\System\HXxVVPr.exe
  2⤵
  PID:7520
- C:\Windows\System\RbzQjJF.exe
  C:\Windows\System\RbzQjJF.exe
  2⤵
  PID:7568
- C:\Windows\System\yEQqJob.exe
  C:\Windows\System\yEQqJob.exe
  2⤵
  PID:7600
- C:\Windows\System\poeDEwT.exe
  C:\Windows\System\poeDEwT.exe
  2⤵
  PID:7620
- C:\Windows\System\tBDAJsf.exe
  C:\Windows\System\tBDAJsf.exe
  2⤵
  PID:7640
- C:\Windows\System\fxowXqr.exe
  C:\Windows\System\fxowXqr.exe
  2⤵
  PID:7664
- C:\Windows\System\DQJCZbs.exe
  C:\Windows\System\DQJCZbs.exe
  2⤵
  PID:7684
- C:\Windows\System\AKXFkvn.exe
  C:\Windows\System\AKXFkvn.exe
  2⤵
  PID:7704
- C:\Windows\System\ODMAWSn.exe
  C:\Windows\System\ODMAWSn.exe
  2⤵
  PID:7740
- C:\Windows\System\ACwJemp.exe
  C:\Windows\System\ACwJemp.exe
  2⤵
  PID:7760
- C:\Windows\System\cOhKlSi.exe
  C:\Windows\System\cOhKlSi.exe
  2⤵
  PID:7788
- C:\Windows\System\jeIkBHn.exe
  C:\Windows\System\jeIkBHn.exe
  2⤵
  PID:7812
- C:\Windows\System\laimLdx.exe
  C:\Windows\System\laimLdx.exe
  2⤵
  PID:7844
- C:\Windows\System\zIoiARM.exe
  C:\Windows\System\zIoiARM.exe
  2⤵
  PID:7868
- C:\Windows\System\kHHmhko.exe
  C:\Windows\System\kHHmhko.exe
  2⤵
  PID:7888
- C:\Windows\System\yJgAPGu.exe
  C:\Windows\System\yJgAPGu.exe
  2⤵
  PID:7936
- C:\Windows\System\FclCgDp.exe
  C:\Windows\System\FclCgDp.exe
  2⤵
  PID:7960
- C:\Windows\System\NIsLWHO.exe
  C:\Windows\System\NIsLWHO.exe
  2⤵
  PID:7988
- C:\Windows\System\lOmKMFw.exe
  C:\Windows\System\lOmKMFw.exe
  2⤵
  PID:8024
- C:\Windows\System\FfwsBto.exe
  C:\Windows\System\FfwsBto.exe
  2⤵
  PID:8052
- C:\Windows\System\CCDwBbV.exe
  C:\Windows\System\CCDwBbV.exe
  2⤵
  PID:8112
- C:\Windows\System\BcqyPoS.exe
  C:\Windows\System\BcqyPoS.exe
  2⤵
  PID:8144
- C:\Windows\System\pazlmuK.exe
  C:\Windows\System\pazlmuK.exe
  2⤵
  PID:8172
- C:\Windows\System\tcJpMPc.exe
  C:\Windows\System\tcJpMPc.exe
  2⤵
  PID:7052
- C:\Windows\System\zguXwaS.exe
  C:\Windows\System\zguXwaS.exe
  2⤵
  PID:7220
- C:\Windows\System\EJoQulL.exe
  C:\Windows\System\EJoQulL.exe
  2⤵
  PID:7280
- C:\Windows\System\mgoUKQX.exe
  C:\Windows\System\mgoUKQX.exe
  2⤵
  PID:7320
- C:\Windows\System\SqjQfjm.exe
  C:\Windows\System\SqjQfjm.exe
  2⤵
  PID:7352
- C:\Windows\System\RqVzzYl.exe
  C:\Windows\System\RqVzzYl.exe
  2⤵
  PID:7412
- C:\Windows\System\ndQKrUo.exe
  C:\Windows\System\ndQKrUo.exe
  2⤵
  PID:7472
- C:\Windows\System\lkuVVwt.exe
  C:\Windows\System\lkuVVwt.exe
  2⤵
  PID:7516
- C:\Windows\System\FuBTUOm.exe
  C:\Windows\System\FuBTUOm.exe
  2⤵
  PID:7692
- C:\Windows\System\joVTsOq.exe
  C:\Windows\System\joVTsOq.exe
  2⤵
  PID:7632
- C:\Windows\System\lkanrEY.exe
  C:\Windows\System\lkanrEY.exe
  2⤵
  PID:7636
- C:\Windows\System\sStTbRE.exe
  C:\Windows\System\sStTbRE.exe
  2⤵
  PID:7796
- C:\Windows\System\DUfjGrC.exe
  C:\Windows\System\DUfjGrC.exe
  2⤵
  PID:7804
- C:\Windows\System\rEwTRHp.exe
  C:\Windows\System\rEwTRHp.exe
  2⤵
  PID:7884
- C:\Windows\System\MqJIcwo.exe
  C:\Windows\System\MqJIcwo.exe
  2⤵
  PID:7976
- C:\Windows\System\zfteTgt.exe
  C:\Windows\System\zfteTgt.exe
  2⤵
  PID:8044
- C:\Windows\System\AOITBwS.exe
  C:\Windows\System\AOITBwS.exe
  2⤵
  PID:8120
- C:\Windows\System\oZJrFNI.exe
  C:\Windows\System\oZJrFNI.exe
  2⤵
  PID:8164
- C:\Windows\System\xTVTvwG.exe
  C:\Windows\System\xTVTvwG.exe
  2⤵
  PID:7176
- C:\Windows\System\gmbToGC.exe
  C:\Windows\System\gmbToGC.exe
  2⤵
  PID:7464
- C:\Windows\System\lZfHbGV.exe
  C:\Windows\System\lZfHbGV.exe
  2⤵
  PID:7580
- C:\Windows\System\CpnrnXa.exe
  C:\Windows\System\CpnrnXa.exe
  2⤵
  PID:7720
- C:\Windows\System\SSpTmNl.exe
  C:\Windows\System\SSpTmNl.exe
  2⤵
  PID:7756
- C:\Windows\System\UfTIJCm.exe
  C:\Windows\System\UfTIJCm.exe
  2⤵
  PID:8076
- C:\Windows\System\kWGkXBI.exe
  C:\Windows\System\kWGkXBI.exe
  2⤵
  PID:8140
- C:\Windows\System\uPLhFdi.exe
  C:\Windows\System\uPLhFdi.exe
  2⤵
  PID:7388
- C:\Windows\System\FJEgAgI.exe
  C:\Windows\System\FJEgAgI.exe
  2⤵
  PID:7608
- C:\Windows\System\ZpSSwuB.exe
  C:\Windows\System\ZpSSwuB.exe
  2⤵
  PID:7944
- C:\Windows\System\tIMKwnw.exe
  C:\Windows\System\tIMKwnw.exe
  2⤵
  PID:8220
- C:\Windows\System\fAOkLKj.exe
  C:\Windows\System\fAOkLKj.exe
  2⤵
  PID:8240
- C:\Windows\System\dSvQSGc.exe
  C:\Windows\System\dSvQSGc.exe
  2⤵
  PID:8264
- C:\Windows\System\uynpUPf.exe
  C:\Windows\System\uynpUPf.exe
  2⤵
  PID:8280
- C:\Windows\System\mCqskGA.exe
  C:\Windows\System\mCqskGA.exe
  2⤵
  PID:8328
- C:\Windows\System\FsAyRKQ.exe
  C:\Windows\System\FsAyRKQ.exe
  2⤵
  PID:8344
- C:\Windows\System\DdqxtFW.exe
  C:\Windows\System\DdqxtFW.exe
  2⤵
  PID:8368
- C:\Windows\System\qTEXllF.exe
  C:\Windows\System\qTEXllF.exe
  2⤵
  PID:8388
- C:\Windows\System\zOLlkKC.exe
  C:\Windows\System\zOLlkKC.exe
  2⤵
  PID:8412
- C:\Windows\System\mcldSPf.exe
  C:\Windows\System\mcldSPf.exe
  2⤵
  PID:8436
- C:\Windows\System\SHZrlSc.exe
  C:\Windows\System\SHZrlSc.exe
  2⤵
  PID:8484
- C:\Windows\System\sfnFWol.exe
  C:\Windows\System\sfnFWol.exe
  2⤵
  PID:8508
- C:\Windows\System\nLRFbrs.exe
  C:\Windows\System\nLRFbrs.exe
  2⤵
  PID:8616
- C:\Windows\System\XHeTShI.exe
  C:\Windows\System\XHeTShI.exe
  2⤵
  PID:8636
- C:\Windows\System\hhxXQAb.exe
  C:\Windows\System\hhxXQAb.exe
  2⤵
  PID:8660
- C:\Windows\System\KRquJSI.exe
  C:\Windows\System\KRquJSI.exe
  2⤵
  PID:8680
- C:\Windows\System\saeOisW.exe
  C:\Windows\System\saeOisW.exe
  2⤵
  PID:8700
- C:\Windows\System\RlUhHLG.exe
  C:\Windows\System\RlUhHLG.exe
  2⤵
  PID:8720
- C:\Windows\System\JFYZPuN.exe
  C:\Windows\System\JFYZPuN.exe
  2⤵
  PID:8748
- C:\Windows\System\eVrGWWE.exe
  C:\Windows\System\eVrGWWE.exe
  2⤵
  PID:8768
- C:\Windows\System\RSkKYfW.exe
  C:\Windows\System\RSkKYfW.exe
  2⤵
  PID:8816
- C:\Windows\System\wbyLgBS.exe
  C:\Windows\System\wbyLgBS.exe
  2⤵
  PID:8856
- C:\Windows\System\WgcXDjn.exe
  C:\Windows\System\WgcXDjn.exe
  2⤵
  PID:8892
- C:\Windows\System\mgqqVfI.exe
  C:\Windows\System\mgqqVfI.exe
  2⤵
  PID:8908
- C:\Windows\System\NRaEuXu.exe
  C:\Windows\System\NRaEuXu.exe
  2⤵
  PID:8932
- C:\Windows\System\ydtitmX.exe
  C:\Windows\System\ydtitmX.exe
  2⤵
  PID:8976
- C:\Windows\System\mEwNYHU.exe
  C:\Windows\System\mEwNYHU.exe
  2⤵
  PID:9000
- C:\Windows\System\xEsgcRB.exe
  C:\Windows\System\xEsgcRB.exe
  2⤵
  PID:9020
- C:\Windows\System\YWcEgvg.exe
  C:\Windows\System\YWcEgvg.exe
  2⤵
  PID:9064
- C:\Windows\System\fpWpFiw.exe
  C:\Windows\System\fpWpFiw.exe
  2⤵
  PID:9100
- C:\Windows\System\hTPbNnR.exe
  C:\Windows\System\hTPbNnR.exe
  2⤵
  PID:9136
- C:\Windows\System\YDkZVJT.exe
  C:\Windows\System\YDkZVJT.exe
  2⤵
  PID:9156
- C:\Windows\System\imAScDT.exe
  C:\Windows\System\imAScDT.exe
  2⤵
  PID:9204
- C:\Windows\System\OiiOCTh.exe
  C:\Windows\System\OiiOCTh.exe
  2⤵
  PID:7700
- C:\Windows\System\YtNcSBO.exe
  C:\Windows\System\YtNcSBO.exe
  2⤵
  PID:6992
- C:\Windows\System\sgmvSai.exe
  C:\Windows\System\sgmvSai.exe
  2⤵
  PID:8276
- C:\Windows\System\xnIfOYe.exe
  C:\Windows\System\xnIfOYe.exe
  2⤵
  PID:8420
- C:\Windows\System\ubfTpFq.exe
  C:\Windows\System\ubfTpFq.exe
  2⤵
  PID:8404
- C:\Windows\System\TUXFooP.exe
  C:\Windows\System\TUXFooP.exe
  2⤵
  PID:8452
- C:\Windows\System\TwjPTFB.exe
  C:\Windows\System\TwjPTFB.exe
  2⤵
  PID:8580
- C:\Windows\System\VJJuEwv.exe
  C:\Windows\System\VJJuEwv.exe
  2⤵
  PID:3552
- C:\Windows\System\JFhASxj.exe
  C:\Windows\System\JFhASxj.exe
  2⤵
  PID:8504
- C:\Windows\System\NWIvMXf.exe
  C:\Windows\System\NWIvMXf.exe
  2⤵
  PID:8656
- C:\Windows\System\wKDxTXX.exe
  C:\Windows\System\wKDxTXX.exe
  2⤵
  PID:8672
- C:\Windows\System\NaAbNqX.exe
  C:\Windows\System\NaAbNqX.exe
  2⤵
  PID:8764
- C:\Windows\System\ogsWKXB.exe
  C:\Windows\System\ogsWKXB.exe
  2⤵
  PID:8808
- C:\Windows\System\viJTPoS.exe
  C:\Windows\System\viJTPoS.exe
  2⤵
  PID:8924
- C:\Windows\System\irKabIB.exe
  C:\Windows\System\irKabIB.exe
  2⤵
  PID:8848
- C:\Windows\System\tuCBEMK.exe
  C:\Windows\System\tuCBEMK.exe
  2⤵
  PID:8968
- C:\Windows\System\VHYFBGY.exe
  C:\Windows\System\VHYFBGY.exe
  2⤵
  PID:8992
- C:\Windows\System\OcBJVbk.exe
  C:\Windows\System\OcBJVbk.exe
  2⤵
  PID:9128
- C:\Windows\System\zzBIWXk.exe
  C:\Windows\System\zzBIWXk.exe
  2⤵
  PID:9200
- C:\Windows\System\FzGAebm.exe
  C:\Windows\System\FzGAebm.exe
  2⤵
  PID:6744
- C:\Windows\System\BcrhTlD.exe
  C:\Windows\System\BcrhTlD.exe
  2⤵
  PID:8384
- C:\Windows\System\WVpBuLV.exe
  C:\Windows\System\WVpBuLV.exe
  2⤵
  PID:8568
- C:\Windows\System\abSsKLS.exe
  C:\Windows\System\abSsKLS.exe
  2⤵
  PID:2488
- C:\Windows\System\kvaMheS.exe
  C:\Windows\System\kvaMheS.exe
  2⤵
  PID:8712
- C:\Windows\System\iVGEZSp.exe
  C:\Windows\System\iVGEZSp.exe
  2⤵
  PID:8940
- C:\Windows\System\EaoAucR.exe
  C:\Windows\System\EaoAucR.exe
  2⤵
  PID:9080
- C:\Windows\System\Wlsyhht.exe
  C:\Windows\System\Wlsyhht.exe
  2⤵
  PID:9196
- C:\Windows\System\zTHRmOx.exe
  C:\Windows\System\zTHRmOx.exe
  2⤵
  PID:8364
- C:\Windows\System\wKYqMLr.exe
  C:\Windows\System\wKYqMLr.exe
  2⤵
  PID:8592
- C:\Windows\System\yrGqShW.exe
  C:\Windows\System\yrGqShW.exe
  2⤵
  PID:8916
- C:\Windows\System\GzUHsbN.exe
  C:\Windows\System\GzUHsbN.exe
  2⤵
  PID:9076
- C:\Windows\System\QrzbLzX.exe
  C:\Windows\System\QrzbLzX.exe
  2⤵
  PID:8624
- C:\Windows\System\pQQFSnW.exe
  C:\Windows\System\pQQFSnW.exe
  2⤵
  PID:9220
- C:\Windows\System\JVbanZS.exe
  C:\Windows\System\JVbanZS.exe
  2⤵
  PID:9240
- C:\Windows\System\KfNJyzr.exe
  C:\Windows\System\KfNJyzr.exe
  2⤵
  PID:9288
- C:\Windows\System\BzFSvxr.exe
  C:\Windows\System\BzFSvxr.exe
  2⤵
  PID:9312
- C:\Windows\System\mTPcyGI.exe
  C:\Windows\System\mTPcyGI.exe
  2⤵
  PID:9332
- C:\Windows\System\huxVnqH.exe
  C:\Windows\System\huxVnqH.exe
  2⤵
  PID:9380
- C:\Windows\System\LhsnIQh.exe
  C:\Windows\System\LhsnIQh.exe
  2⤵
  PID:9404
- C:\Windows\System\XcKLCqZ.exe
  C:\Windows\System\XcKLCqZ.exe
  2⤵
  PID:9424
- C:\Windows\System\WMdfZSx.exe
  C:\Windows\System\WMdfZSx.exe
  2⤵
  PID:9452
- C:\Windows\System\LwBnVHn.exe
  C:\Windows\System\LwBnVHn.exe
  2⤵
  PID:9500
- C:\Windows\System\mLbtMZo.exe
  C:\Windows\System\mLbtMZo.exe
  2⤵
  PID:9516
- C:\Windows\System\sLWjCPH.exe
  C:\Windows\System\sLWjCPH.exe
  2⤵
  PID:9544
- C:\Windows\System\AhpHTuh.exe
  C:\Windows\System\AhpHTuh.exe
  2⤵
  PID:9572
- C:\Windows\System\QiSNvco.exe
  C:\Windows\System\QiSNvco.exe
  2⤵
  PID:9600
- C:\Windows\System\UWyHgnc.exe
  C:\Windows\System\UWyHgnc.exe
  2⤵
  PID:9644
- C:\Windows\System\woHwPnd.exe
  C:\Windows\System\woHwPnd.exe
  2⤵
  PID:9668
- C:\Windows\System\xGWJfXP.exe
  C:\Windows\System\xGWJfXP.exe
  2⤵
  PID:9720
- C:\Windows\System\wqlzmYn.exe
  C:\Windows\System\wqlzmYn.exe
  2⤵
  PID:9740
- C:\Windows\System\skgXQBj.exe
  C:\Windows\System\skgXQBj.exe
  2⤵
  PID:9764
- C:\Windows\System\RgGLCIn.exe
  C:\Windows\System\RgGLCIn.exe
  2⤵
  PID:9784
- C:\Windows\System\fqjICaS.exe
  C:\Windows\System\fqjICaS.exe
  2⤵
  PID:9800
- C:\Windows\System\DsslrUU.exe
  C:\Windows\System\DsslrUU.exe
  2⤵
  PID:9824
- C:\Windows\System\wueEoED.exe
  C:\Windows\System\wueEoED.exe
  2⤵
  PID:9840
- C:\Windows\System\kGrmGOx.exe
  C:\Windows\System\kGrmGOx.exe
  2⤵
  PID:9860
- C:\Windows\System\KiMzPzr.exe
  C:\Windows\System\KiMzPzr.exe
  2⤵
  PID:9884
- C:\Windows\System\LBalsDE.exe
  C:\Windows\System\LBalsDE.exe
  2⤵
  PID:9920
- C:\Windows\System\SjCNQys.exe
  C:\Windows\System\SjCNQys.exe
  2⤵
  PID:10028
- C:\Windows\System\dGUwCZl.exe
  C:\Windows\System\dGUwCZl.exe
  2⤵
  PID:10044
- C:\Windows\System\ODFWhMX.exe
  C:\Windows\System\ODFWhMX.exe
  2⤵
  PID:10064
- C:\Windows\System\AZvHCwC.exe
  C:\Windows\System\AZvHCwC.exe
  2⤵
  PID:10088
- C:\Windows\System\ImNdkTT.exe
  C:\Windows\System\ImNdkTT.exe
  2⤵
  PID:10128
- C:\Windows\System\EBexSHJ.exe
  C:\Windows\System\EBexSHJ.exe
  2⤵
  PID:10152
- C:\Windows\System\qhGgPDy.exe
  C:\Windows\System\qhGgPDy.exe
  2⤵
  PID:10168
- C:\Windows\System\ZqGPxTe.exe
  C:\Windows\System\ZqGPxTe.exe
  2⤵
  PID:10192
- C:\Windows\System\ekWiiCB.exe
  C:\Windows\System\ekWiiCB.exe
  2⤵
  PID:10228
- C:\Windows\System\sRnpZNf.exe
  C:\Windows\System\sRnpZNf.exe
  2⤵
  PID:9152
- C:\Windows\System\JSyMZei.exe
  C:\Windows\System\JSyMZei.exe
  2⤵
  PID:9300
- C:\Windows\System\AKXCmnZ.exe
  C:\Windows\System\AKXCmnZ.exe
  2⤵
  PID:9268
- C:\Windows\System\AVQkMYb.exe
  C:\Windows\System\AVQkMYb.exe
  2⤵
  PID:9284
- C:\Windows\System\eaFNPAA.exe
  C:\Windows\System\eaFNPAA.exe
  2⤵
  PID:9448
- C:\Windows\System\USNteea.exe
  C:\Windows\System\USNteea.exe
  2⤵
  PID:9496
- C:\Windows\System\MErmkVu.exe
  C:\Windows\System\MErmkVu.exe
  2⤵
  PID:9552
- C:\Windows\System\prLtKrg.exe
  C:\Windows\System\prLtKrg.exe
  2⤵
  PID:9652
- C:\Windows\System\fdoaDOu.exe
  C:\Windows\System\fdoaDOu.exe
  2⤵
  PID:9664
- C:\Windows\System\KvgLkrk.exe
  C:\Windows\System\KvgLkrk.exe
  2⤵
  PID:9760
- C:\Windows\System\vKEfQEl.exe
  C:\Windows\System\vKEfQEl.exe
  2⤵
  PID:9792
- C:\Windows\System\GhdGNiq.exe
  C:\Windows\System\GhdGNiq.exe
  2⤵
  PID:9880
- C:\Windows\System\vIzdtlZ.exe
  C:\Windows\System\vIzdtlZ.exe
  2⤵
  PID:9960
- C:\Windows\System\WcgnXKQ.exe
  C:\Windows\System\WcgnXKQ.exe
  2⤵
  PID:3984
- C:\Windows\System\WkAQaIU.exe
  C:\Windows\System\WkAQaIU.exe
  2⤵
  PID:10040
- C:\Windows\System\ztRebqt.exe
  C:\Windows\System\ztRebqt.exe
  2⤵
  PID:10104
- C:\Windows\System\wKAksfs.exe
  C:\Windows\System\wKAksfs.exe
  2⤵
  PID:10164
- C:\Windows\System\LgukAEa.exe
  C:\Windows\System\LgukAEa.exe
  2⤵
  PID:1932
- C:\Windows\System\HPdLuCb.exe
  C:\Windows\System\HPdLuCb.exe
  2⤵
  PID:9032
- C:\Windows\System\sjzyqru.exe
  C:\Windows\System\sjzyqru.exe
  2⤵
  PID:9388
- C:\Windows\System\gBcOfcP.exe
  C:\Windows\System\gBcOfcP.exe
  2⤵
  PID:9432
- C:\Windows\System\mcJIkaK.exe
  C:\Windows\System\mcJIkaK.exe
  2⤵
  PID:9532
- C:\Windows\System\jclDJmx.exe
  C:\Windows\System\jclDJmx.exe
  2⤵
  PID:9748
- C:\Windows\System\GaerxsJ.exe
  C:\Windows\System\GaerxsJ.exe
  2⤵
  PID:9832
- C:\Windows\System\FypfiAE.exe
  C:\Windows\System\FypfiAE.exe
  2⤵
  PID:9936
- C:\Windows\System\fOIQBYR.exe
  C:\Windows\System\fOIQBYR.exe
  2⤵
  PID:3264
- C:\Windows\System\HkXYlmT.exe
  C:\Windows\System\HkXYlmT.exe
  2⤵
  PID:10084
- C:\Windows\System\QyPKzTd.exe
  C:\Windows\System\QyPKzTd.exe
  2⤵
  PID:10220
- C:\Windows\System\xbhRIVt.exe
  C:\Windows\System\xbhRIVt.exe
  2⤵
  PID:9628
- C:\Windows\System\yRykeAH.exe
  C:\Windows\System\yRykeAH.exe
  2⤵
  PID:10012
- C:\Windows\System\icxCPjt.exe
  C:\Windows\System\icxCPjt.exe
  2⤵
  PID:3316
- C:\Windows\System\SuCBxvt.exe
  C:\Windows\System\SuCBxvt.exe
  2⤵
  PID:4672
- C:\Windows\System\wCEMPJd.exe
  C:\Windows\System\wCEMPJd.exe
  2⤵
  PID:10252
- C:\Windows\System\sexwSYU.exe
  C:\Windows\System\sexwSYU.exe
  2⤵
  PID:10284
- C:\Windows\System\KlUSmka.exe
  C:\Windows\System\KlUSmka.exe
  2⤵
  PID:10308
- C:\Windows\System\dYHtHLB.exe
  C:\Windows\System\dYHtHLB.exe
  2⤵
  PID:10352
- C:\Windows\System\FmjLPBI.exe
  C:\Windows\System\FmjLPBI.exe
  2⤵
  PID:10372
- C:\Windows\System\sXVACSx.exe
  C:\Windows\System\sXVACSx.exe
  2⤵
  PID:10416
- C:\Windows\System\sjqtJuG.exe
  C:\Windows\System\sjqtJuG.exe
  2⤵
  PID:10464
- C:\Windows\System\HxcFgXS.exe
  C:\Windows\System\HxcFgXS.exe
  2⤵
  PID:10488
- C:\Windows\System\sxwgbcZ.exe
  C:\Windows\System\sxwgbcZ.exe
  2⤵
  PID:10508
- C:\Windows\System\vrftWCe.exe
  C:\Windows\System\vrftWCe.exe
  2⤵
  PID:10528
- C:\Windows\System\SmUfWVa.exe
  C:\Windows\System\SmUfWVa.exe
  2⤵
  PID:10556
- C:\Windows\System\accWOeN.exe
  C:\Windows\System\accWOeN.exe
  2⤵
  PID:10572
- C:\Windows\System\CzPqgpF.exe
  C:\Windows\System\CzPqgpF.exe
  2⤵
  PID:10592
- C:\Windows\System\AjsFbbG.exe
  C:\Windows\System\AjsFbbG.exe
  2⤵
  PID:10616
- C:\Windows\System\kcJGUgK.exe
  C:\Windows\System\kcJGUgK.exe
  2⤵
  PID:10644
- C:\Windows\System\pSSfHEn.exe
  C:\Windows\System\pSSfHEn.exe
  2⤵
  PID:10672
- C:\Windows\System\opoQFii.exe
  C:\Windows\System\opoQFii.exe
  2⤵
  PID:10712
- C:\Windows\System\TnROWqR.exe
  C:\Windows\System\TnROWqR.exe
  2⤵
  PID:10752
- C:\Windows\System\brcOLmj.exe
  C:\Windows\System\brcOLmj.exe
  2⤵
  PID:10768
- C:\Windows\System\nJVTyDV.exe
  C:\Windows\System\nJVTyDV.exe
  2⤵
  PID:10816
- C:\Windows\System\VOFVFIw.exe
  C:\Windows\System\VOFVFIw.exe
  2⤵
  PID:10856
- C:\Windows\System\hLIjnhN.exe
  C:\Windows\System\hLIjnhN.exe
  2⤵
  PID:10876
- C:\Windows\System\FqHvaqc.exe
  C:\Windows\System\FqHvaqc.exe
  2⤵
  PID:10900
- C:\Windows\System\eFXONsO.exe
  C:\Windows\System\eFXONsO.exe
  2⤵
  PID:10916
- C:\Windows\System\sFnngXH.exe
  C:\Windows\System\sFnngXH.exe
  2⤵
  PID:10940
- C:\Windows\System\dVStkgH.exe
  C:\Windows\System\dVStkgH.exe
  2⤵
  PID:10956
- C:\Windows\System\axzzXWF.exe
  C:\Windows\System\axzzXWF.exe
  2⤵
  PID:10976
- C:\Windows\System\tkHqrlP.exe
  C:\Windows\System\tkHqrlP.exe
  2⤵
  PID:11024
- C:\Windows\System\EVrazjU.exe
  C:\Windows\System\EVrazjU.exe
  2⤵
  PID:11044
- C:\Windows\System\FGeGyoG.exe
  C:\Windows\System\FGeGyoG.exe
  2⤵
  PID:11072
- C:\Windows\System\GINYeZm.exe
  C:\Windows\System\GINYeZm.exe
  2⤵
  PID:11092
- C:\Windows\System\bKickza.exe
  C:\Windows\System\bKickza.exe
  2⤵
  PID:11116
- C:\Windows\System\quOnFzG.exe
  C:\Windows\System\quOnFzG.exe
  2⤵
  PID:11136
- C:\Windows\System\KRiDsxP.exe
  C:\Windows\System\KRiDsxP.exe
  2⤵
  PID:11188
- C:\Windows\System\pqGCdLJ.exe
  C:\Windows\System\pqGCdLJ.exe
  2⤵
  PID:11216
- C:\Windows\System\XmQOImd.exe
  C:\Windows\System\XmQOImd.exe
  2⤵
  PID:11256
- C:\Windows\System\ISjdGCG.exe
  C:\Windows\System\ISjdGCG.exe
  2⤵
  PID:9280
- C:\Windows\System\qKdWjkT.exe
  C:\Windows\System\qKdWjkT.exe
  2⤵
  PID:10296
- C:\Windows\System\YLUzoRl.exe
  C:\Windows\System\YLUzoRl.exe
  2⤵
  PID:10340
- C:\Windows\System\OjQViPD.exe
  C:\Windows\System\OjQViPD.exe
  2⤵
  PID:10368
- C:\Windows\System\ZXMBOUC.exe
  C:\Windows\System\ZXMBOUC.exe
  2⤵
  PID:10500
- C:\Windows\System\dsiphKj.exe
  C:\Windows\System\dsiphKj.exe
  2⤵
  PID:1824
- C:\Windows\System\fBgjqJf.exe
  C:\Windows\System\fBgjqJf.exe
  2⤵
  PID:10536
- C:\Windows\System\YzGUPXn.exe
  C:\Windows\System\YzGUPXn.exe
  2⤵
  PID:10660
- C:\Windows\System\vjavVst.exe
  C:\Windows\System\vjavVst.exe
  2⤵
  PID:10692
- C:\Windows\System\nsYZima.exe
  C:\Windows\System\nsYZima.exe
  2⤵
  PID:10792
- C:\Windows\System\LEoRlEd.exe
  C:\Windows\System\LEoRlEd.exe
  2⤵
  PID:10832
- C:\Windows\System\irUcljQ.exe
  C:\Windows\System\irUcljQ.exe
  2⤵
  PID:10868
- C:\Windows\System\jAqRcnh.exe
  C:\Windows\System\jAqRcnh.exe
  2⤵
  PID:10924
- C:\Windows\System\mFTZslC.exe
  C:\Windows\System\mFTZslC.exe
  2⤵
  PID:11012
- C:\Windows\System\mfKsOfz.exe
  C:\Windows\System\mfKsOfz.exe
  2⤵
  PID:11064
- C:\Windows\System\kpmSSRa.exe
  C:\Windows\System\kpmSSRa.exe
  2⤵
  PID:11204
- C:\Windows\System\pUTOPRg.exe
  C:\Windows\System\pUTOPRg.exe
  2⤵
  PID:11248
- C:\Windows\System\xqgjhuw.exe
  C:\Windows\System\xqgjhuw.exe
  2⤵
  PID:10276
- C:\Windows\System\wtsEbaF.exe
  C:\Windows\System\wtsEbaF.exe
  2⤵
  PID:10440
- C:\Windows\System\ldLbnZb.exe
  C:\Windows\System\ldLbnZb.exe
  2⤵
  PID:10568
- C:\Windows\System\yQTQsWt.exe
  C:\Windows\System\yQTQsWt.exe
  2⤵
  PID:10680
- C:\Windows\System\oPWnmvW.exe
  C:\Windows\System\oPWnmvW.exe
  2⤵
  PID:10892
- C:\Windows\System\ecFtlEF.exe
  C:\Windows\System\ecFtlEF.exe
  2⤵
  PID:10912
- C:\Windows\System\sFxaNdh.exe
  C:\Windows\System\sFxaNdh.exe
  2⤵
  PID:11172
- C:\Windows\System\HTUZFlM.exe
  C:\Windows\System\HTUZFlM.exe
  2⤵
  PID:1400
- C:\Windows\System\meoUrBa.exe
  C:\Windows\System\meoUrBa.exe
  2⤵
  PID:10036
- C:\Windows\System\QUNUqob.exe
  C:\Windows\System\QUNUqob.exe
  2⤵
  PID:10640
- C:\Windows\System\QIQRNcd.exe
  C:\Windows\System\QIQRNcd.exe
  2⤵
  PID:10852
- C:\Windows\System\BILRLJN.exe
  C:\Windows\System\BILRLJN.exe
  2⤵
  PID:11180
- C:\Windows\System\jyhVIxh.exe
  C:\Windows\System\jyhVIxh.exe
  2⤵
  PID:11292
- C:\Windows\System\WbIOOWr.exe
  C:\Windows\System\WbIOOWr.exe
  2⤵
  PID:11320
- C:\Windows\System\lcsIcwW.exe
  C:\Windows\System\lcsIcwW.exe
  2⤵
  PID:11356
- C:\Windows\System\rSKMsTU.exe
  C:\Windows\System\rSKMsTU.exe
  2⤵
  PID:11372
- C:\Windows\System\ZAdksmQ.exe
  C:\Windows\System\ZAdksmQ.exe
  2⤵
  PID:11400
- C:\Windows\System\TaOYwcp.exe
  C:\Windows\System\TaOYwcp.exe
  2⤵
  PID:11424
- C:\Windows\System\vKglZWi.exe
  C:\Windows\System\vKglZWi.exe
  2⤵
  PID:11448
- C:\Windows\System\DKOBINZ.exe
  C:\Windows\System\DKOBINZ.exe
  2⤵
  PID:11540
- C:\Windows\System\ymyspIA.exe
  C:\Windows\System\ymyspIA.exe
  2⤵
  PID:11564
- C:\Windows\System\fsxwOqL.exe
  C:\Windows\System\fsxwOqL.exe
  2⤵
  PID:11580
- C:\Windows\System\qyYDnpX.exe
  C:\Windows\System\qyYDnpX.exe
  2⤵
  PID:11596
- C:\Windows\System\AKpnXlN.exe
  C:\Windows\System\AKpnXlN.exe
  2⤵
  PID:11612
- C:\Windows\System\aCGshvM.exe
  C:\Windows\System\aCGshvM.exe
  2⤵
  PID:11628
- C:\Windows\System\OyOLZEs.exe
  C:\Windows\System\OyOLZEs.exe
  2⤵
  PID:11644
- C:\Windows\System\NfgbwtZ.exe
  C:\Windows\System\NfgbwtZ.exe
  2⤵
  PID:11660
- C:\Windows\System\KcWQpxw.exe
  C:\Windows\System\KcWQpxw.exe
  2⤵
  PID:11676
- C:\Windows\System\FQpCalF.exe
  C:\Windows\System\FQpCalF.exe
  2⤵
  PID:11692
- C:\Windows\System\eUljYtj.exe
  C:\Windows\System\eUljYtj.exe
  2⤵
  PID:11708
- C:\Windows\System\stdAvlP.exe
  C:\Windows\System\stdAvlP.exe
  2⤵
  PID:11724
- C:\Windows\System\XUaivII.exe
  C:\Windows\System\XUaivII.exe
  2⤵
  PID:11740
- C:\Windows\System\oRXWgkR.exe
  C:\Windows\System\oRXWgkR.exe
  2⤵
  PID:11784
- C:\Windows\System\gkdjofM.exe
  C:\Windows\System\gkdjofM.exe
  2⤵
  PID:11804
- C:\Windows\System\xWBOrzN.exe
  C:\Windows\System\xWBOrzN.exe
  2⤵
  PID:11832
- C:\Windows\System\PHDSgZH.exe
  C:\Windows\System\PHDSgZH.exe
  2⤵
  PID:11860
- C:\Windows\System\mINqOnO.exe
  C:\Windows\System\mINqOnO.exe
  2⤵
  PID:11884
- C:\Windows\System\vAmKCYS.exe
  C:\Windows\System\vAmKCYS.exe
  2⤵
  PID:11904
- C:\Windows\System\DIodRYr.exe
  C:\Windows\System\DIodRYr.exe
  2⤵
  PID:11928
- C:\Windows\System\UWZRvZW.exe
  C:\Windows\System\UWZRvZW.exe
  2⤵
  PID:11948
- C:\Windows\System\nWyPeGM.exe
  C:\Windows\System\nWyPeGM.exe
  2⤵
  PID:11968
- C:\Windows\System\dCCPPtD.exe
  C:\Windows\System\dCCPPtD.exe
  2⤵
  PID:11992
- C:\Windows\System\zbGJeUl.exe
  C:\Windows\System\zbGJeUl.exe
  2⤵
  PID:12084
- C:\Windows\System\TpFAqWv.exe
  C:\Windows\System\TpFAqWv.exe
  2⤵
  PID:12104
- C:\Windows\System\EliHqgb.exe
  C:\Windows\System\EliHqgb.exe
  2⤵
  PID:12156
- C:\Windows\System\JNFeuIc.exe
  C:\Windows\System\JNFeuIc.exe
  2⤵
  PID:12176
- C:\Windows\System\jYmSnur.exe
  C:\Windows\System\jYmSnur.exe
  2⤵
  PID:12200
- C:\Windows\System\zsvgobn.exe
  C:\Windows\System\zsvgobn.exe
  2⤵
  PID:12272
- C:\Windows\System\zsJCJTb.exe
  C:\Windows\System\zsJCJTb.exe
  2⤵
  PID:11416
- C:\Windows\System\heSxCsl.exe
  C:\Windows\System\heSxCsl.exe
  2⤵
  PID:11396
- C:\Windows\System\udpIsYk.exe
  C:\Windows\System\udpIsYk.exe
  2⤵
  PID:11436
- C:\Windows\System\izcEKNB.exe
  C:\Windows\System\izcEKNB.exe
  2⤵
  PID:11476
- C:\Windows\System\VFvdVDH.exe
  C:\Windows\System\VFvdVDH.exe
  2⤵
  PID:11488
- C:\Windows\System\yucKMLD.exe
  C:\Windows\System\yucKMLD.exe
  2⤵
  PID:3608
- C:\Windows\System\CyKEzPk.exe
  C:\Windows\System\CyKEzPk.exe
  2⤵
  PID:11732
- C:\Windows\System\MXPqXpN.exe
  C:\Windows\System\MXPqXpN.exe
  2⤵
  PID:11752
- C:\Windows\System\jKQOHzH.exe
  C:\Windows\System\jKQOHzH.exe
  2⤵
  PID:11796
- C:\Windows\System\pcnvEnR.exe
  C:\Windows\System\pcnvEnR.exe
  2⤵
  PID:12004
- C:\Windows\System\cfceUji.exe
  C:\Windows\System\cfceUji.exe
  2⤵
  PID:11828
- C:\Windows\System\FlwtEvL.exe
  C:\Windows\System\FlwtEvL.exe
  2⤵
  PID:11840
- C:\Windows\System\CurUXVS.exe
  C:\Windows\System\CurUXVS.exe
  2⤵
  PID:11900
- C:\Windows\System\NOuFAQV.exe
  C:\Windows\System\NOuFAQV.exe
  2⤵
  PID:12076
- C:\Windows\System\anUslyz.exe
  C:\Windows\System\anUslyz.exe
  2⤵
  PID:12208
- C:\Windows\System\XMZQTFm.exe
  C:\Windows\System\XMZQTFm.exe
  2⤵
  PID:12092
- C:\Windows\System\qWwHaHi.exe
  C:\Windows\System\qWwHaHi.exe
  2⤵
  PID:10396
- C:\Windows\System\BEZLhZp.exe
  C:\Windows\System\BEZLhZp.exe
  2⤵
  PID:12264
- C:\Windows\System\YfJLiKQ.exe
  C:\Windows\System\YfJLiKQ.exe
  2⤵
  PID:11388
- C:\Windows\System\rlFYeNh.exe
  C:\Windows\System\rlFYeNh.exe
  2⤵
  PID:11668
- C:\Windows\System\tEyoSNv.exe
  C:\Windows\System\tEyoSNv.exe
  2⤵
  PID:11640
- C:\Windows\System\xGruGzF.exe
  C:\Windows\System\xGruGzF.exe
  2⤵
  PID:4492
- C:\Windows\System\AZhsTyR.exe
  C:\Windows\System\AZhsTyR.exe
  2⤵
  PID:12024
- C:\Windows\System\bcGvVxX.exe
  C:\Windows\System\bcGvVxX.exe
  2⤵
  PID:3224
- C:\Windows\System\eZuverX.exe
  C:\Windows\System\eZuverX.exe
  2⤵
  PID:4000
- C:\Windows\System\shgrhLi.exe
  C:\Windows\System\shgrhLi.exe
  2⤵
  PID:3772
- C:\Windows\System\eBWRnef.exe
  C:\Windows\System\eBWRnef.exe
  2⤵
  PID:12080
- C:\Windows\System\qIGClub.exe
  C:\Windows\System\qIGClub.exe
  2⤵
  PID:11412
- C:\Windows\System\UDzhWpa.exe
  C:\Windows\System\UDzhWpa.exe
  2⤵
  PID:11572
- C:\Windows\System\CTXWHRP.exe
  C:\Windows\System\CTXWHRP.exe
  2⤵
  PID:11636
- C:\Windows\System\NMTJdcm.exe
  C:\Windows\System\NMTJdcm.exe
  2⤵
  PID:12020
- C:\Windows\System\HVfffff.exe
  C:\Windows\System\HVfffff.exe
  2⤵
  PID:4244
- C:\Windows\System\qLOkPnY.exe
  C:\Windows\System\qLOkPnY.exe
  2⤵
  PID:12188
- C:\Windows\System\KNgRyEI.exe
  C:\Windows\System\KNgRyEI.exe
  2⤵
  PID:11936
- C:\Windows\System\qOdgjNY.exe
  C:\Windows\System\qOdgjNY.exe
  2⤵
  PID:3476
- C:\Windows\System\dJAazMr.exe
  C:\Windows\System\dJAazMr.exe
  2⤵
  PID:12296
- C:\Windows\System\PlYsyIl.exe
  C:\Windows\System\PlYsyIl.exe
  2⤵
  PID:12316
- C:\Windows\System\oxLdAYO.exe
  C:\Windows\System\oxLdAYO.exe
  2⤵
  PID:12352
- C:\Windows\System\nBXdDhk.exe
  C:\Windows\System\nBXdDhk.exe
  2⤵
  PID:12396
- C:\Windows\System\gSGVuUF.exe
  C:\Windows\System\gSGVuUF.exe
  2⤵
  PID:12432
- C:\Windows\System\YkwjwVz.exe
  C:\Windows\System\YkwjwVz.exe
  2⤵
  PID:12456
- C:\Windows\System\IJiuRaX.exe
  C:\Windows\System\IJiuRaX.exe
  2⤵
  PID:12484
- C:\Windows\System\FeOSNiq.exe
  C:\Windows\System\FeOSNiq.exe
  2⤵
  PID:12500
- C:\Windows\System\YqwDWYb.exe
  C:\Windows\System\YqwDWYb.exe
  2⤵
  PID:12516
- C:\Windows\System\kBgslyE.exe
  C:\Windows\System\kBgslyE.exe
  2⤵
  PID:12556
- C:\Windows\System\IklAicO.exe
  C:\Windows\System\IklAicO.exe
  2⤵
  PID:12600
- C:\Windows\System\eCHKTJm.exe
  C:\Windows\System\eCHKTJm.exe
  2⤵
  PID:12620
- C:\Windows\System\yZIMkTb.exe
  C:\Windows\System\yZIMkTb.exe
  2⤵
  PID:12644
- C:\Windows\System\JLaJyDD.exe
  C:\Windows\System\JLaJyDD.exe
  2⤵
  PID:12684
- C:\Windows\System\nzVIlfx.exe
  C:\Windows\System\nzVIlfx.exe
  2⤵
  PID:12708
- C:\Windows\System\LxPeHeX.exe
  C:\Windows\System\LxPeHeX.exe
  2⤵
  PID:12752
- C:\Windows\System\dvrIJpq.exe
  C:\Windows\System\dvrIJpq.exe
  2⤵
  PID:12768
- C:\Windows\System\wHeoccZ.exe
  C:\Windows\System\wHeoccZ.exe
  2⤵
  PID:12796
- C:\Windows\System\EdSRSoK.exe
  C:\Windows\System\EdSRSoK.exe
  2⤵
  PID:12816
- C:\Windows\System\uEjuiTA.exe
  C:\Windows\System\uEjuiTA.exe
  2⤵
  PID:12840
- C:\Windows\System\azChWdV.exe
  C:\Windows\System\azChWdV.exe
  2⤵
  PID:12872
- C:\Windows\System\MQzgzll.exe
  C:\Windows\System\MQzgzll.exe
  2⤵
  PID:12900
- C:\Windows\System\VBuXrLH.exe
  C:\Windows\System\VBuXrLH.exe
  2⤵
  PID:12924
- C:\Windows\System\ezCDGWi.exe
  C:\Windows\System\ezCDGWi.exe
  2⤵
  PID:12956
- C:\Windows\System\TbIwZlO.exe
  C:\Windows\System\TbIwZlO.exe
  2⤵
  PID:12980
- C:\Windows\System\HiHVEZo.exe
  C:\Windows\System\HiHVEZo.exe
  2⤵
  PID:13012
- C:\Windows\System\EjhSQmo.exe
  C:\Windows\System\EjhSQmo.exe
  2⤵
  PID:13040
- C:\Windows\System\MPOQtVK.exe
  C:\Windows\System\MPOQtVK.exe
  2⤵
  PID:13064
- C:\Windows\System\zWZTBPh.exe
  C:\Windows\System\zWZTBPh.exe
  2⤵
  PID:13080
- C:\Windows\System\XdqioGw.exe
  C:\Windows\System\XdqioGw.exe
  2⤵
  PID:13124
- C:\Windows\System\babcEig.exe
  C:\Windows\System\babcEig.exe
  2⤵
  PID:13152
- C:\Windows\System\IOJLXVj.exe
  C:\Windows\System\IOJLXVj.exe
  2⤵
  PID:13172
- C:\Windows\System\KGoTvAe.exe
  C:\Windows\System\KGoTvAe.exe
  2⤵
  PID:13196
- C:\Windows\System\vCyiQPu.exe
  C:\Windows\System\vCyiQPu.exe
  2⤵
  PID:13232
- C:\Windows\System\knElxFF.exe
  C:\Windows\System\knElxFF.exe
  2⤵
  PID:13252
- C:\Windows\System\lpbJrRd.exe
  C:\Windows\System\lpbJrRd.exe
  2⤵
  PID:13276
- C:\Windows\System\agKXudQ.exe
  C:\Windows\System\agKXudQ.exe
  2⤵
  PID:12332
- C:\Windows\System\tvEvwNK.exe
  C:\Windows\System\tvEvwNK.exe
  2⤵
  PID:12392
- C:\Windows\System\wdQmtgO.exe
  C:\Windows\System\wdQmtgO.exe
  2⤵
  PID:12440
- C:\Windows\System\FlJLUgt.exe
  C:\Windows\System\FlJLUgt.exe
  2⤵
  PID:12468
- C:\Windows\System\ycHAydQ.exe
  C:\Windows\System\ycHAydQ.exe
  2⤵
  PID:12512
- C:\Windows\System\jsxRSQx.exe
  C:\Windows\System\jsxRSQx.exe
  2⤵
  PID:12616
- C:\Windows\System\LbrhPFt.exe
  C:\Windows\System\LbrhPFt.exe
  2⤵
  PID:12652
- C:\Windows\System\ASzvLaD.exe
  C:\Windows\System\ASzvLaD.exe
  2⤵
  PID:12704
- C:\Windows\System\ygYbyro.exe
  C:\Windows\System\ygYbyro.exe
  2⤵
  PID:12764
- C:\Windows\System\gZlpjVI.exe
  C:\Windows\System\gZlpjVI.exe
  2⤵
  PID:13028
- C:\Windows\System\wLdrktf.exe
  C:\Windows\System\wLdrktf.exe
  2⤵
  PID:12452
- C:\Windows\System\eeeigPx.exe
  C:\Windows\System\eeeigPx.exe
  2⤵
  PID:5584
- C:\Windows\System\qADtBDu.exe
  C:\Windows\System\qADtBDu.exe
  2⤵
  PID:13244
- C:\Windows\System\lMMIhVf.exe
  C:\Windows\System\lMMIhVf.exe
  2⤵
  PID:4816
- C:\Windows\System\QnAYIix.exe
  C:\Windows\System\QnAYIix.exe
  2⤵
  PID:3396
- C:\Windows\System\XPGrZna.exe
  C:\Windows\System\XPGrZna.exe
  2⤵
  PID:12824
- C:\Windows\System\DDvbIEE.exe
  C:\Windows\System\DDvbIEE.exe
  2⤵
  PID:1788
- C:\Windows\System\tiWrSSx.exe
  C:\Windows\System\tiWrSSx.exe
  2⤵
  PID:13304
- C:\Windows\System\yMNNovA.exe
  C:\Windows\System\yMNNovA.exe
  2⤵
  PID:12856
- C:\Windows\System\EWvrvPT.exe
  C:\Windows\System\EWvrvPT.exe
  2⤵
  PID:2352
- C:\Windows\System\tUIWswi.exe
  C:\Windows\System\tUIWswi.exe
  2⤵
  PID:12940
- C:\Windows\System\UcHbghg.exe
  C:\Windows\System\UcHbghg.exe
  2⤵
  PID:3360
- C:\Windows\System\ADNwAyh.exe
  C:\Windows\System\ADNwAyh.exe
  2⤵
  PID:5116
- C:\Windows\System\oFAQFtM.exe
  C:\Windows\System\oFAQFtM.exe
  2⤵
  PID:12864
- C:\Windows\System\fmHVFLf.exe
  C:\Windows\System\fmHVFLf.exe
  2⤵
  PID:708
- C:\Windows\System\bwJZxHU.exe
  C:\Windows\System\bwJZxHU.exe
  2⤵
  PID:13056
- C:\Windows\System\PXylBNQ.exe
  C:\Windows\System\PXylBNQ.exe
  2⤵
  PID:13112
- C:\Windows\System\QzCvzmP.exe
  C:\Windows\System\QzCvzmP.exe
  2⤵
  PID:12636
- C:\Windows\System\ZtxBFwL.exe
  C:\Windows\System\ZtxBFwL.exe
  2⤵
  PID:6116
- C:\Windows\System\zWEqgGQ.exe
  C:\Windows\System\zWEqgGQ.exe
  2⤵
  PID:4092
- C:\Windows\System\koPnvrh.exe
  C:\Windows\System\koPnvrh.exe
  2⤵
  PID:928
- C:\Windows\System\NJAEyfB.exe
  C:\Windows\System\NJAEyfB.exe
  2⤵
  PID:12912
- C:\Windows\System\cyWjmTy.exe
  C:\Windows\System\cyWjmTy.exe
  2⤵
  PID:800
- C:\Windows\System\nBNyxCL.exe
  C:\Windows\System\nBNyxCL.exe
  2⤵
  PID:2984
- C:\Windows\System\xczYrfp.exe
  C:\Windows\System\xczYrfp.exe
  2⤵
  PID:3176
- C:\Windows\System\UZNGqJM.exe
  C:\Windows\System\UZNGqJM.exe
  2⤵
  PID:5712
- C:\Windows\System\IPkTpJT.exe
  C:\Windows\System\IPkTpJT.exe
  2⤵
  PID:12880
- C:\Windows\System\qqDGmqZ.exe
  C:\Windows\System\qqDGmqZ.exe
  2⤵
  PID:2948
- C:\Windows\System\VhxkBcU.exe
  C:\Windows\System\VhxkBcU.exe
  2⤵
  PID:13000
- C:\Windows\System\hjHTeEz.exe
  C:\Windows\System\hjHTeEz.exe
  2⤵
  PID:2620
- C:\Windows\System\RQnEpXN.exe
  C:\Windows\System\RQnEpXN.exe
  2⤵
  PID:3144
- C:\Windows\System\MmDfLxW.exe
  C:\Windows\System\MmDfLxW.exe
  2⤵
  PID:540
- C:\Windows\System\lUHrbRk.exe
  C:\Windows\System\lUHrbRk.exe
  2⤵
  PID:8096
- C:\Windows\System\OVEkLSi.exe
  C:\Windows\System\OVEkLSi.exe
  2⤵
  PID:7476
- C:\Windows\System\QoqEPyw.exe
  C:\Windows\System\QoqEPyw.exe
  2⤵
  PID:8920
- C:\Windows\System\gQvCBnC.exe
  C:\Windows\System\gQvCBnC.exe
  2⤵
  PID:3760
- C:\Windows\System\DVitmot.exe
  C:\Windows\System\DVitmot.exe
  2⤵
  PID:2540
- C:\Windows\System\FjUVUYQ.exe
  C:\Windows\System\FjUVUYQ.exe
  2⤵
  PID:5892
- C:\Windows\System\ynOTnWo.exe
  C:\Windows\System\ynOTnWo.exe
  2⤵
  PID:4612
- C:\Windows\System\fWeIDNW.exe
  C:\Windows\System\fWeIDNW.exe
  2⤵
  PID:6748
- C:\Windows\System\Kuoncyg.exe
  C:\Windows\System\Kuoncyg.exe
  2⤵
  PID:7512
- C:\Windows\System\TRlXUpJ.exe
  C:\Windows\System\TRlXUpJ.exe
  2⤵
  PID:7496
- C:\Windows\System\jvLwJqX.exe
  C:\Windows\System\jvLwJqX.exe
  2⤵
  PID:3628
- C:\Windows\System\oUobEpw.exe
  C:\Windows\System\oUobEpw.exe
  2⤵
  PID:8444
- C:\Windows\System\jtlhsyT.exe
  C:\Windows\System\jtlhsyT.exe
  2⤵
  PID:3276
- C:\Windows\System\hKHUbKF.exe
  C:\Windows\System\hKHUbKF.exe
  2⤵
  PID:8272
- C:\Windows\System\mjizzKW.exe
  C:\Windows\System\mjizzKW.exe
  2⤵
  PID:4644
- C:\Windows\System\pdrmeZt.exe
  C:\Windows\System\pdrmeZt.exe
  2⤵
  PID:9656
- C:\Windows\System\jsokiSi.exe
  C:\Windows\System\jsokiSi.exe
  2⤵
  PID:6208
- C:\Windows\System\dbdozdR.exe
  C:\Windows\System\dbdozdR.exe
  2⤵
  PID:9676
- C:\Windows\System\nBJLSOq.exe
  C:\Windows\System\nBJLSOq.exe
  2⤵
  PID:6492
- C:\Windows\System\MYhXLqw.exe
  C:\Windows\System\MYhXLqw.exe
  2⤵
  PID:9700
- C:\Windows\System\UyEsPvy.exe
  C:\Windows\System\UyEsPvy.exe
  2⤵
  PID:6620
- C:\Windows\System\qjayaZt.exe
  C:\Windows\System\qjayaZt.exe
  2⤵
  PID:752
- C:\Windows\System\RhVsKeg.exe
  C:\Windows\System\RhVsKeg.exe
  2⤵
  PID:7396
- C:\Windows\System\QHFmSyS.exe
  C:\Windows\System\QHFmSyS.exe
  2⤵
  PID:8756
- C:\Windows\System\SDMBcCN.exe
  C:\Windows\System\SDMBcCN.exe
  2⤵
  PID:9988
- C:\Windows\System\esjUFMa.exe
  C:\Windows\System\esjUFMa.exe
  2⤵
  PID:8788
- C:\Windows\System\zKiRDYG.exe
  C:\Windows\System\zKiRDYG.exe
  2⤵
  PID:1908
- C:\Windows\System\PcGmzhM.exe
  C:\Windows\System\PcGmzhM.exe
  2⤵
  PID:7852
- C:\Windows\System\UwgwryR.exe
  C:\Windows\System\UwgwryR.exe
  2⤵
  PID:3468
- C:\Windows\System\aWvTpNP.exe
  C:\Windows\System\aWvTpNP.exe
  2⤵
  PID:2812
- C:\Windows\System\IRhlezz.exe
  C:\Windows\System\IRhlezz.exe
  2⤵
  PID:1308
- C:\Windows\System\pawcTul.exe
  C:\Windows\System\pawcTul.exe
  2⤵
  PID:10324
- C:\Windows\System\dCCgbfy.exe
  C:\Windows\System\dCCgbfy.exe
  2⤵
  PID:7296
- C:\Windows\System\oGlnkTj.exe
  C:\Windows\System\oGlnkTj.exe
  2⤵
  PID:10404
- C:\Windows\System\rBvHqlS.exe
  C:\Windows\System\rBvHqlS.exe
  2⤵
  PID:4180
- C:\Windows\System\ZviOkMj.exe
  C:\Windows\System\ZviOkMj.exe
  2⤵
  PID:5112
- C:\Windows\System\yNKCjqU.exe
  C:\Windows\System\yNKCjqU.exe
  2⤵
  PID:7748
- C:\Windows\System\AmnDtgd.exe
  C:\Windows\System\AmnDtgd.exe
  2⤵
  PID:10720
- C:\Windows\System\uWleqtq.exe
  C:\Windows\System\uWleqtq.exe
  2⤵
  PID:1800
- C:\Windows\System\EIdsPYn.exe
  C:\Windows\System\EIdsPYn.exe
  2⤵
  PID:7008
- C:\Windows\System\iSwoLzz.exe
  C:\Windows\System\iSwoLzz.exe
  2⤵
  PID:6248
- C:\Windows\System\acFNAVw.exe
  C:\Windows\System\acFNAVw.exe
  2⤵
  PID:9584
- C:\Windows\System\YMZoQpw.exe
  C:\Windows\System\YMZoQpw.exe
  2⤵
  PID:2788
- C:\Windows\System\HosEbxE.exe
  C:\Windows\System\HosEbxE.exe
  2⤵
  PID:8564
- C:\Windows\System\gSuDSpU.exe
  C:\Windows\System\gSuDSpU.exe
  2⤵
  PID:2400
- C:\Windows\System\utTAVGD.exe
  C:\Windows\System\utTAVGD.exe
  2⤵
  PID:8692
- C:\Windows\System\pPYljyS.exe
  C:\Windows\System\pPYljyS.exe
  2⤵
  PID:10624
- C:\Windows\System\QMpOUOY.exe
  C:\Windows\System\QMpOUOY.exe
  2⤵
  PID:9908
- C:\Windows\System\nowEAys.exe
  C:\Windows\System\nowEAys.exe
  2⤵
  PID:2288
- C:\Windows\System\xiXiuLf.exe
  C:\Windows\System\xiXiuLf.exe
  2⤵
  PID:10968
- C:\Windows\System\NlPCcgA.exe
  C:\Windows\System\NlPCcgA.exe
  2⤵
  PID:7160
- C:\Windows\System\cfTObpO.exe
  C:\Windows\System\cfTObpO.exe
  2⤵
  PID:8560
- C:\Windows\System\YsJMHvh.exe
  C:\Windows\System\YsJMHvh.exe
  2⤵
  PID:11348
- C:\Windows\System\WvepxpA.exe
  C:\Windows\System\WvepxpA.exe
  2⤵
  PID:10804
- C:\Windows\System\YzmUwVn.exe
  C:\Windows\System\YzmUwVn.exe
  2⤵
  PID:3308
- C:\Windows\System\bFjyjsV.exe
  C:\Windows\System\bFjyjsV.exe
  2⤵
  PID:1504
- C:\Windows\System\DpeIHYT.exe
  C:\Windows\System\DpeIHYT.exe
  2⤵
  PID:5724
- C:\Windows\System\PdAKeyZ.exe
  C:\Windows\System\PdAKeyZ.exe
  2⤵
  PID:7060
- C:\Windows\System\MmnUeeJ.exe
  C:\Windows\System\MmnUeeJ.exe
  2⤵
  PID:8520
- C:\Windows\System\BkuXrnK.exe
  C:\Windows\System\BkuXrnK.exe
  2⤵
  PID:2820
- C:\Windows\System\lgwSiPl.exe
  C:\Windows\System\lgwSiPl.exe
  2⤵
  PID:6020
- C:\Windows\System\GFlbtrW.exe
  C:\Windows\System\GFlbtrW.exe
  2⤵
  PID:9904
- C:\Windows\System\YTLtAOu.exe
  C:\Windows\System\YTLtAOu.exe
  2⤵
  PID:5896
- C:\Windows\System\GowWZKn.exe
  C:\Windows\System\GowWZKn.exe
  2⤵
  PID:5556
- C:\Windows\System\TdeRJGi.exe
  C:\Windows\System\TdeRJGi.exe
  2⤵
  PID:10776
- C:\Windows\System\dojlvLI.exe
  C:\Windows\System\dojlvLI.exe
  2⤵
  PID:3192
- C:\Windows\System\gOloVzE.exe
  C:\Windows\System\gOloVzE.exe
  2⤵
  PID:8840
- C:\Windows\System\oRQCNfb.exe
  C:\Windows\System\oRQCNfb.exe
  2⤵
  PID:8212
- C:\Windows\System\wEPXSyd.exe
  C:\Windows\System\wEPXSyd.exe
  2⤵
  PID:10272
- C:\Windows\System\Pphvpjg.exe
  C:\Windows\System\Pphvpjg.exe
  2⤵
  PID:12744
- C:\Windows\System\GZNgjJN.exe
  C:\Windows\System\GZNgjJN.exe
  2⤵
  PID:7300
- C:\Windows\System\nuDnPmC.exe
  C:\Windows\System\nuDnPmC.exe
  2⤵
  PID:11508
- C:\Windows\System\AEMEbOJ.exe
  C:\Windows\System\AEMEbOJ.exe
  2⤵
  PID:10080
- C:\Windows\System\nMwAvFl.exe
  C:\Windows\System\nMwAvFl.exe
  2⤵
  PID:3812
- C:\Windows\System\nhUjsHd.exe
  C:\Windows\System\nhUjsHd.exe
  2⤵
  PID:5656
- C:\Windows\System\PvcHDbT.exe
  C:\Windows\System\PvcHDbT.exe
  2⤵
  PID:8156
- C:\Windows\System\pjSjqpE.exe
  C:\Windows\System\pjSjqpE.exe
  2⤵
  PID:11720
- C:\Windows\System\ogGsePa.exe
  C:\Windows\System\ogGsePa.exe
  2⤵
  PID:3972
- C:\Windows\System\OlWfrnv.exe
  C:\Windows\System\OlWfrnv.exe
  2⤵
  PID:10180
- C:\Windows\System\taKwNaB.exe
  C:\Windows\System\taKwNaB.exe
  2⤵
  PID:5944
- C:\Windows\System\pWztAZz.exe
  C:\Windows\System\pWztAZz.exe
  2⤵
  PID:3540
- C:\Windows\System\yuwPQVt.exe
  C:\Windows\System\yuwPQVt.exe
  2⤵
  PID:10780
- C:\Windows\System\FsNWmRs.exe
  C:\Windows\System\FsNWmRs.exe
  2⤵
  PID:11408
- C:\Windows\System\WCRYotv.exe
  C:\Windows\System\WCRYotv.exe
  2⤵
  PID:9464
- C:\Windows\System\yzVEjds.exe
  C:\Windows\System\yzVEjds.exe
  2⤵
  PID:10828
- C:\Windows\System\DRNxfmn.exe
  C:\Windows\System\DRNxfmn.exe
  2⤵
  PID:5800
- C:\Windows\System\spvZGCl.exe
  C:\Windows\System\spvZGCl.exe
  2⤵
  PID:9524
- C:\Windows\System\UiHNgZm.exe
  C:\Windows\System\UiHNgZm.exe
  2⤵
  PID:9588
- C:\Windows\System\gCFWUPx.exe
  C:\Windows\System\gCFWUPx.exe
  2⤵
  PID:7924
- C:\Windows\System\BfkkvLZ.exe
  C:\Windows\System\BfkkvLZ.exe
  2⤵
  PID:7080
- C:\Windows\System\Swwirot.exe
  C:\Windows\System\Swwirot.exe
  2⤵
  PID:2612
- C:\Windows\System\zcjoGws.exe
  C:\Windows\System\zcjoGws.exe
  2⤵
  PID:6584
- C:\Windows\System\RcWEBcv.exe
  C:\Windows\System\RcWEBcv.exe
  2⤵
  PID:5432
- C:\Windows\System\YlcnItn.exe
  C:\Windows\System\YlcnItn.exe
  2⤵
  PID:10412
- C:\Windows\System\VPldfmN.exe
  C:\Windows\System\VPldfmN.exe
  2⤵
  PID:6024
- C:\Windows\System\iKWWxoQ.exe
  C:\Windows\System\iKWWxoQ.exe
  2⤵
  PID:5444
- C:\Windows\System\ccYSukm.exe
  C:\Windows\System\ccYSukm.exe
  2⤵
  PID:5980
- C:\Windows\System\dnzvzkH.exe
  C:\Windows\System\dnzvzkH.exe
  2⤵
  PID:8068
- C:\Windows\System\qmauLKF.exe
  C:\Windows\System\qmauLKF.exe
  2⤵
  PID:12472
- C:\Windows\System\wqLoWBN.exe
  C:\Windows\System\wqLoWBN.exe
  2⤵
  PID:8012
- C:\Windows\System\PLYUAsc.exe
  C:\Windows\System\PLYUAsc.exe
  2⤵
  PID:9124
- C:\Windows\System\fjIrgfO.exe
  C:\Windows\System\fjIrgfO.exe
  2⤵
  PID:5364
- C:\Windows\System\gzTFzDb.exe
  C:\Windows\System\gzTFzDb.exe
  2⤵
  PID:5308
- C:\Windows\System\vMktHPL.exe
  C:\Windows\System\vMktHPL.exe
  2⤵
  PID:1988
- C:\Windows\System\ZEqlInQ.exe
  C:\Windows\System\ZEqlInQ.exe
  2⤵
  PID:6068
- C:\Windows\System\OlQEWkC.exe
  C:\Windows\System\OlQEWkC.exe
  2⤵
  PID:1340
- C:\Windows\System\SRgYDAM.exe
  C:\Windows\System\SRgYDAM.exe
  2⤵
  PID:2656
- C:\Windows\System\QKVRUfv.exe
  C:\Windows\System\QKVRUfv.exe
  2⤵
  PID:8956
- C:\Windows\System\xBjNEjx.exe
  C:\Windows\System\xBjNEjx.exe
  2⤵
  PID:4744
- C:\Windows\System\DFmSsar.exe
  C:\Windows\System\DFmSsar.exe
  2⤵
  PID:10392
- C:\Windows\System\HRVSBrU.exe
  C:\Windows\System\HRVSBrU.exe
  2⤵
  PID:12592
- C:\Windows\System\iGZekGs.exe
  C:\Windows\System\iGZekGs.exe
  2⤵
  PID:11040
- C:\Windows\System\MiDXLFG.exe
  C:\Windows\System\MiDXLFG.exe
  2⤵
  PID:216
- C:\Windows\System\nCbdrNJ.exe
  C:\Windows\System\nCbdrNJ.exe
  2⤵
  PID:5708
- C:\Windows\System\yUmndvr.exe
  C:\Windows\System\yUmndvr.exe
  2⤵
  PID:8460
- C:\Windows\System\AgayHhV.exe
  C:\Windows\System\AgayHhV.exe
  2⤵
  PID:9084
- C:\Windows\System\YnQttKC.exe
  C:\Windows\System\YnQttKC.exe
  2⤵
  PID:5816
- C:\Windows\System\NpCHkfI.exe
  C:\Windows\System\NpCHkfI.exe
  2⤵
  PID:5428
- C:\Windows\System\wbeHsPn.exe
  C:\Windows\System\wbeHsPn.exe
  2⤵
  PID:5000
- C:\Windows\System\QThtzEm.exe
  C:\Windows\System\QThtzEm.exe
  2⤵
  PID:8468
- C:\Windows\System\ZJCTxGG.exe
  C:\Windows\System\ZJCTxGG.exe
  2⤵
  PID:5840
- C:\Windows\System\ASeRbYi.exe
  C:\Windows\System\ASeRbYi.exe
  2⤵
  PID:5236
- C:\Windows\System\LnbRILF.exe
  C:\Windows\System\LnbRILF.exe
  2⤵
  PID:5544
- C:\Windows\System\xTFOloL.exe
  C:\Windows\System\xTFOloL.exe
  2⤵
  PID:6288
- C:\Windows\System\UPTHirK.exe
  C:\Windows\System\UPTHirK.exe
  2⤵
  PID:6332
- C:\Windows\System\bkRRifW.exe
  C:\Windows\System\bkRRifW.exe
  2⤵
  PID:6500
- C:\Windows\System\kuWNMAT.exe
  C:\Windows\System\kuWNMAT.exe
  2⤵
  PID:8008
- C:\Windows\System\csIqlOs.exe
  C:\Windows\System\csIqlOs.exe
  2⤵
  PID:2136
- C:\Windows\System\ztpTygs.exe
  C:\Windows\System\ztpTygs.exe
  2⤵
  PID:6412
- C:\Windows\System\mDJZoMo.exe
  C:\Windows\System\mDJZoMo.exe
  2⤵
  PID:1996
- C:\Windows\System\ALSbnYC.exe
  C:\Windows\System\ALSbnYC.exe
  2⤵
  PID:6632
- C:\Windows\System\fJtUWtd.exe
  C:\Windows\System\fJtUWtd.exe
  2⤵
  PID:6456
- C:\Windows\System\WdGavvn.exe
  C:\Windows\System\WdGavvn.exe
  2⤵
  PID:6624
- C:\Windows\System\ghjRRgB.exe
  C:\Windows\System\ghjRRgB.exe
  2⤵
  PID:5196
- C:\Windows\System\horrBeb.exe
  C:\Windows\System\horrBeb.exe
  2⤵
  PID:3536
- C:\Windows\System\pXpKQSi.exe
  C:\Windows\System\pXpKQSi.exe
  2⤵
  PID:1544
- C:\Windows\System\MfZPXlV.exe
  C:\Windows\System\MfZPXlV.exe
  2⤵
  PID:4700
- C:\Windows\System\PLNUNvR.exe
  C:\Windows\System\PLNUNvR.exe
  2⤵
  PID:6784
- C:\Windows\System\gKdMJoV.exe
  C:\Windows\System\gKdMJoV.exe
  2⤵
  PID:6956
- C:\Windows\System\yfsjYkl.exe
  C:\Windows\System\yfsjYkl.exe
  2⤵
  PID:4432
- C:\Windows\System\HTVlknL.exe
  C:\Windows\System\HTVlknL.exe
  2⤵
  PID:10436
- C:\Windows\System\oQUtEaN.exe
  C:\Windows\System\oQUtEaN.exe
  2⤵
  PID:3136
- C:\Windows\System\wjYxsvx.exe
  C:\Windows\System\wjYxsvx.exe
  2⤵
  PID:12920
- C:\Windows\System\oplOzMI.exe
  C:\Windows\System\oplOzMI.exe
  2⤵
  PID:1324
- C:\Windows\System\ZRqTBXY.exe
  C:\Windows\System\ZRqTBXY.exe
  2⤵
  PID:512
- C:\Windows\System\ffpLexg.exe
  C:\Windows\System\ffpLexg.exe
  2⤵
  PID:10784
- C:\Windows\System\IYIHJDU.exe
  C:\Windows\System\IYIHJDU.exe
  2⤵
  PID:6720
- C:\Windows\System\bQUTzZC.exe
  C:\Windows\System\bQUTzZC.exe
  2⤵
  PID:232
- C:\Windows\System\NPRhivq.exe
  C:\Windows\System\NPRhivq.exe
  2⤵
  PID:7156
- C:\Windows\System\abUjFrF.exe
  C:\Windows\System\abUjFrF.exe
  2⤵
  PID:7628
- C:\Windows\System\MNRfSjF.exe
  C:\Windows\System\MNRfSjF.exe
  2⤵
  PID:7284
- C:\Windows\System\rSFZOvu.exe
  C:\Windows\System\rSFZOvu.exe
  2⤵
  PID:7140
- C:\Windows\System\HcPbvso.exe
  C:\Windows\System\HcPbvso.exe
  2⤵
  PID:7380
- C:\Windows\System\wXMARxg.exe
  C:\Windows\System\wXMARxg.exe
  2⤵
  PID:2452
- C:\Windows\System\YiaNOYa.exe
  C:\Windows\System\YiaNOYa.exe
  2⤵
  PID:6812
- C:\Windows\System\PVijhhC.exe
  C:\Windows\System\PVijhhC.exe
  2⤵
  PID:7324
- C:\Windows\System\TdjCSSl.exe
  C:\Windows\System\TdjCSSl.exe
  2⤵
  PID:6516
- C:\Windows\System\SkMZWXx.exe
  C:\Windows\System\SkMZWXx.exe
  2⤵
  PID:8188
- C:\Windows\System\HmWNphm.exe
  C:\Windows\System\HmWNphm.exe
  2⤵
  PID:3328
- C:\Windows\System\MjvxDDe.exe
  C:\Windows\System\MjvxDDe.exe
  2⤵
  PID:4104
- C:\Windows\System\YPNjTgO.exe
  C:\Windows\System\YPNjTgO.exe
  2⤵
  PID:1732
- C:\Windows\System\ancELBS.exe
  C:\Windows\System\ancELBS.exe
  2⤵
  PID:6556
- C:\Windows\System\ZBhAAiJ.exe
  C:\Windows\System\ZBhAAiJ.exe
  2⤵
  PID:1028
- C:\Windows\System\NsSpJjn.exe
  C:\Windows\System\NsSpJjn.exe
  2⤵
  PID:6244
- C:\Windows\System\CRvhfrh.exe
  C:\Windows\System\CRvhfrh.exe
  2⤵
  PID:9872
- C:\Windows\System\WxSEbTs.exe
  C:\Windows\System\WxSEbTs.exe
  2⤵
  PID:7164
- C:\Windows\System\LjbRmeR.exe
  C:\Windows\System\LjbRmeR.exe
  2⤵
  PID:7912
- C:\Windows\System\AlMAoIi.exe
  C:\Windows\System\AlMAoIi.exe
  2⤵
  PID:7576
- C:\Windows\System\NIlexEI.exe
  C:\Windows\System\NIlexEI.exe
  2⤵
  PID:5560
- C:\Windows\System\zJlySNq.exe
  C:\Windows\System\zJlySNq.exe
  2⤵
  PID:5900
- C:\Windows\System\sBksebh.exe
  C:\Windows\System\sBksebh.exe
  2⤵
  PID:8160
- C:\Windows\System\mOLiuaQ.exe
  C:\Windows\System\mOLiuaQ.exe
  2⤵
  PID:12640
- C:\Windows\System\XEIYaBn.exe
  C:\Windows\System\XEIYaBn.exe
  2⤵
  PID:7536
- C:\Windows\System\TFHwffN.exe
  C:\Windows\System\TFHwffN.exe
  2⤵
  PID:3152
- C:\Windows\System\rrvbJnL.exe
  C:\Windows\System\rrvbJnL.exe
  2⤵
  PID:10732
- C:\Windows\System\GLEnzLL.exe
  C:\Windows\System\GLEnzLL.exe
  2⤵
  PID:2484
- C:\Windows\System\SnCgOmE.exe
  C:\Windows\System\SnCgOmE.exe
  2⤵
  PID:8708
- C:\Windows\System\anathZd.exe
  C:\Windows\System\anathZd.exe
  2⤵
  PID:1884
- C:\Windows\System\IQusoaR.exe
  C:\Windows\System\IQusoaR.exe
  2⤵
  PID:12676
- C:\Windows\System\eFBLEUN.exe
  C:\Windows\System\eFBLEUN.exe
  2⤵
  PID:11688
- C:\Windows\System\dtgACXF.exe
  C:\Windows\System\dtgACXF.exe
  2⤵
  PID:8884
- C:\Windows\System\KtZlNcE.exe
  C:\Windows\System\KtZlNcE.exe
  2⤵
  PID:972
- C:\Windows\System\MDKChxu.exe
  C:\Windows\System\MDKChxu.exe
  2⤵
  PID:6908
- C:\Windows\System\pORVBaF.exe
  C:\Windows\System\pORVBaF.exe
  2⤵
  PID:9008
- C:\Windows\System\EEflyNh.exe
  C:\Windows\System\EEflyNh.exe
  2⤵
  PID:12852
- C:\Windows\System\ZcVPHMy.exe
  C:\Windows\System\ZcVPHMy.exe
  2⤵
  PID:9212
- C:\Windows\System\iLMXhxf.exe
  C:\Windows\System\iLMXhxf.exe
  2⤵
  PID:8464
- C:\Windows\System\dQnrUiY.exe
  C:\Windows\System\dQnrUiY.exe
  2⤵
  PID:7908
- C:\Windows\System\pEdVjJe.exe
  C:\Windows\System\pEdVjJe.exe
  2⤵
  PID:9108
- C:\Windows\System\KEDoVNH.exe
  C:\Windows\System\KEDoVNH.exe
  2⤵
  PID:2528
- C:\Windows\System\sEkENjh.exe
  C:\Windows\System\sEkENjh.exe
  2⤵
  PID:7256
- C:\Windows\System\zXdjczu.exe
  C:\Windows\System\zXdjczu.exe
  2⤵
  PID:6836
- C:\Windows\System\mKuKCAB.exe
  C:\Windows\System\mKuKCAB.exe
  2⤵
  PID:7184
- C:\Windows\System\WLfdcpN.exe
  C:\Windows\System\WLfdcpN.exe
  2⤵
  PID:5300
- C:\Windows\System\mJaGIUo.exe
  C:\Windows\System\mJaGIUo.exe
  2⤵
  PID:2916
- C:\Windows\System\xGYonXV.exe
  C:\Windows\System\xGYonXV.exe
  2⤵
  PID:6616
- C:\Windows\System\WFMdMwR.exe
  C:\Windows\System\WFMdMwR.exe
  2⤵
  PID:12016
- C:\Windows\System\xCphGrA.exe
  C:\Windows\System\xCphGrA.exe
  2⤵
  PID:12788
- C:\Windows\System\MMVcVzd.exe
  C:\Windows\System\MMVcVzd.exe
  2⤵
  PID:9412
- C:\Windows\System\ZnDpVcT.exe
  C:\Windows\System\ZnDpVcT.exe
  2⤵
  PID:4676
- C:\Windows\System\wESVBwt.exe
  C:\Windows\System\wESVBwt.exe
  2⤵
  PID:5392
- C:\Windows\System\hQpUuea.exe
  C:\Windows\System\hQpUuea.exe
  2⤵
  PID:8836
- C:\Windows\System\KfsKCSe.exe
  C:\Windows\System\KfsKCSe.exe
  2⤵
  PID:5228
- C:\Windows\System\oHIyWtV.exe
  C:\Windows\System\oHIyWtV.exe
  2⤵
  PID:8868
- C:\Windows\System\MprsCOo.exe
  C:\Windows\System\MprsCOo.exe
  2⤵
  PID:9256
- C:\Windows\System\ndzYlpj.exe
  C:\Windows\System\ndzYlpj.exe
  2⤵
  PID:9344
- C:\Windows\System\STrlLHN.exe
  C:\Windows\System\STrlLHN.exe
  2⤵
  PID:9252
- C:\Windows\System\kEGVRvP.exe
  C:\Windows\System\kEGVRvP.exe
  2⤵
  PID:9696
- C:\Windows\System\yJcrHcb.exe
  C:\Windows\System\yJcrHcb.exe
  2⤵
  PID:6856
- C:\Windows\System\FAJPgKL.exe
  C:\Windows\System\FAJPgKL.exe
  2⤵
  PID:8732
- C:\Windows\System\VXxQMXY.exe
  C:\Windows\System\VXxQMXY.exe
  2⤵
  PID:5144
- C:\Windows\System\LfzXLwI.exe
  C:\Windows\System\LfzXLwI.exe
  2⤵
  PID:8944
- C:\Windows\System\ffciRzB.exe
  C:\Windows\System\ffciRzB.exe
  2⤵
  PID:5220
- C:\Windows\System\kDcYNLu.exe
  C:\Windows\System\kDcYNLu.exe
  2⤵
  PID:11492
- C:\Windows\System\DivMrLf.exe
  C:\Windows\System\DivMrLf.exe
  2⤵
  PID:9952
- C:\Windows\System\zcPdsCk.exe
  C:\Windows\System\zcPdsCk.exe
  2⤵
  PID:9248
- C:\Windows\System\ygGCZQW.exe
  C:\Windows\System\ygGCZQW.exe
  2⤵
  PID:7204
- C:\Windows\System\KbjMahw.exe
  C:\Windows\System\KbjMahw.exe
  2⤵
  PID:9036
- C:\Windows\System\YeKlBok.exe
  C:\Windows\System\YeKlBok.exe
  2⤵
  PID:8304
- C:\Windows\System\CrvVQyr.exe
  C:\Windows\System\CrvVQyr.exe
  2⤵
  PID:8032
- C:\Windows\System\CsCQnEb.exe
  C:\Windows\System\CsCQnEb.exe
  2⤵
  PID:9816
- C:\Windows\System\RctqRjd.exe
  C:\Windows\System\RctqRjd.exe
  2⤵
  PID:9848
- C:\Windows\System\kqwgcLW.exe
  C:\Windows\System\kqwgcLW.exe
  2⤵
  PID:1668
- C:\Windows\System\UIwMkOh.exe
  C:\Windows\System\UIwMkOh.exe
  2⤵
  PID:9612
- C:\Windows\System\sXjBuQF.exe
  C:\Windows\System\sXjBuQF.exe
  2⤵
  PID:5988
- C:\Windows\System\UuLZinV.exe
  C:\Windows\System\UuLZinV.exe
  2⤵
  PID:6012
- C:\Windows\System\ufdHwOa.exe
  C:\Windows\System\ufdHwOa.exe
  2⤵
  PID:9608
- C:\Windows\System\RQRkyVZ.exe
  C:\Windows\System\RQRkyVZ.exe
  2⤵
  PID:8004
- C:\Windows\System\TfsmyLQ.exe
  C:\Windows\System\TfsmyLQ.exe
  2⤵
  PID:8628
- C:\Windows\System\FpdvTWF.exe
  C:\Windows\System\FpdvTWF.exe
  2⤵
  PID:6912
- C:\Windows\System\qbQTjUy.exe
  C:\Windows\System\qbQTjUy.exe
  2⤵
  PID:7972
- C:\Windows\System\bQfXMCG.exe
  C:\Windows\System\bQfXMCG.exe
  2⤵
  PID:9356
- C:\Windows\System\ppggEkz.exe
  C:\Windows\System\ppggEkz.exe
  2⤵
  PID:13332
- C:\Windows\System\VdEEZmH.exe
  C:\Windows\System\VdEEZmH.exe
  2⤵
  PID:13360
- C:\Windows\System\DHbEJrO.exe
  C:\Windows\System\DHbEJrO.exe
  2⤵
  PID:13384
- C:\Windows\System\QuCKZUj.exe
  C:\Windows\System\QuCKZUj.exe
  2⤵
  PID:13408
- C:\Windows\System\KTHbfdm.exe
  C:\Windows\System\KTHbfdm.exe
  2⤵
  PID:13440
- C:\Windows\System\mLkQALe.exe
  C:\Windows\System\mLkQALe.exe
  2⤵
  PID:13464
- C:\Windows\System\OVHiLaw.exe
  C:\Windows\System\OVHiLaw.exe
  2⤵
  PID:13488
- C:\Windows\System\XcVUbpL.exe
  C:\Windows\System\XcVUbpL.exe
  2⤵
  PID:13512
- C:\Windows\System\EehTszJ.exe
  C:\Windows\System\EehTszJ.exe
  2⤵
  PID:13536
- C:\Windows\System\bbLtjyf.exe
  C:\Windows\System\bbLtjyf.exe
  2⤵
  PID:13644
- C:\Windows\System\PnURXGE.exe
  C:\Windows\System\PnURXGE.exe
  2⤵
  PID:13676
- C:\Windows\System\wDhjELI.exe
  C:\Windows\System\wDhjELI.exe
  2⤵
  PID:13712
- C:\Windows\System\LrBTTqI.exe
  C:\Windows\System\LrBTTqI.exe
  2⤵
  PID:13744
- C:\Windows\System\mXtYggG.exe
  C:\Windows\System\mXtYggG.exe
  2⤵
  PID:13780
- C:\Windows\System\bVkvDjf.exe
  C:\Windows\System\bVkvDjf.exe
  2⤵
  PID:13816
- C:\Windows\System\wAbJWiB.exe
  C:\Windows\System\wAbJWiB.exe
  2⤵
  PID:13840
- C:\Windows\System\TcxhofK.exe
  C:\Windows\System\TcxhofK.exe
  2⤵
  PID:13860
- C:\Windows\System\DVjluOG.exe
  C:\Windows\System\DVjluOG.exe
  2⤵
  PID:13880
- C:\Windows\System\uhcVhIJ.exe
  C:\Windows\System\uhcVhIJ.exe
  2⤵
  PID:13912
- C:\Windows\System\MuqmtsM.exe
  C:\Windows\System\MuqmtsM.exe
  2⤵
  PID:13940
- C:\Windows\System\abqHHEb.exe
  C:\Windows\System\abqHHEb.exe
  2⤵
  PID:13960
- C:\Windows\System\QEemGHX.exe
  C:\Windows\System\QEemGHX.exe
  2⤵
  PID:13984
- C:\Windows\System\PXWlfFO.exe
  C:\Windows\System\PXWlfFO.exe
  2⤵
  PID:14008
- C:\Windows\System\IpoXDZR.exe
  C:\Windows\System\IpoXDZR.exe
  2⤵
  PID:14044
- C:\Windows\System\shpAfAS.exe
  C:\Windows\System\shpAfAS.exe
  2⤵
  PID:14084
- C:\Windows\System\oiomTwa.exe
  C:\Windows\System\oiomTwa.exe
  2⤵
  PID:14108
- C:\Windows\System\NagEnRH.exe
  C:\Windows\System\NagEnRH.exe
  2⤵
  PID:14136
- C:\Windows\System\XULKvkj.exe
  C:\Windows\System\XULKvkj.exe
  2⤵
  PID:14168
- C:\Windows\System\IIQIZTT.exe
  C:\Windows\System\IIQIZTT.exe
  2⤵
  PID:14192
- C:\Windows\System\NgBwdiW.exe
  C:\Windows\System\NgBwdiW.exe
  2⤵
  PID:14220
- C:\Windows\System\yFYTfCx.exe
  C:\Windows\System\yFYTfCx.exe
  2⤵
  PID:14248
- C:\Windows\System\yebUhmh.exe
  C:\Windows\System\yebUhmh.exe
  2⤵
  PID:14280
- C:\Windows\System\khjwxFT.exe
  C:\Windows\System\khjwxFT.exe
  2⤵
  PID:14312
- C:\Windows\System\EpUkjaT.exe
  C:\Windows\System\EpUkjaT.exe
  2⤵
  PID:8852
- C:\Windows\System\PwXwrVD.exe
  C:\Windows\System\PwXwrVD.exe
  2⤵
  PID:7556
- C:\Windows\System\mktiKpX.exe
  C:\Windows\System\mktiKpX.exe
  2⤵
  PID:9492
- C:\Windows\System\WPsjHjl.exe
  C:\Windows\System\WPsjHjl.exe
  2⤵
  PID:2968
- C:\Windows\System\HbSpaiT.exe
  C:\Windows\System\HbSpaiT.exe
  2⤵
  PID:7020
- C:\Windows\System\jAOnkxM.exe
  C:\Windows\System\jAOnkxM.exe
  2⤵
  PID:3260
- C:\Windows\System\OiTUSQz.exe
  C:\Windows\System\OiTUSQz.exe
  2⤵
  PID:9568
- C:\Windows\System\BWohjAO.exe
  C:\Windows\System\BWohjAO.exe
  2⤵
  PID:9352
- C:\Windows\System\RPQjGgq.exe
  C:\Windows\System\RPQjGgq.exe
  2⤵
  PID:10280
- C:\Windows\System\zqBxfbd.exe
  C:\Windows\System\zqBxfbd.exe
  2⤵
  PID:10600
- C:\Windows\System\eMMiptg.exe
  C:\Windows\System\eMMiptg.exe
  2⤵
  PID:10292
- C:\Windows\System\CbRocIt.exe
  C:\Windows\System\CbRocIt.exe
  2⤵
  PID:10696
- C:\Windows\System\nXwveSN.exe
  C:\Windows\System\nXwveSN.exe
  2⤵
  PID:13368
- C:\Windows\System\flXmDqU.exe
  C:\Windows\System\flXmDqU.exe
  2⤵
  PID:10348
- C:\Windows\System\haeBtCh.exe
  C:\Windows\System\haeBtCh.exe
  2⤵
  PID:6604
- C:\Windows\System\UdCrcEv.exe
  C:\Windows\System\UdCrcEv.exe
  2⤵
  PID:3632
- C:\Windows\System\IqoYXRs.exe
  C:\Windows\System\IqoYXRs.exe
  2⤵
  PID:11068
- C:\Windows\System\laBdPtG.exe
  C:\Windows\System\laBdPtG.exe
  2⤵
  PID:11032
- C:\Windows\System\BhABuFO.exe
  C:\Windows\System\BhABuFO.exe
  2⤵
  PID:13356
- C:\Windows\System\qrEGfIS.exe
  C:\Windows\System\qrEGfIS.exe
  2⤵
  PID:10684
- C:\Windows\System\zNHRDiI.exe
  C:\Windows\System\zNHRDiI.exe
  2⤵
  PID:13664
- C:\Windows\System\dXrERcN.exe
  C:\Windows\System\dXrERcN.exe
  2⤵
  PID:10060
- C:\Windows\System\xjbiVLU.exe
  C:\Windows\System\xjbiVLU.exe
  2⤵
  PID:10248
- C:\Windows\System\ooWSqTj.exe
  C:\Windows\System\ooWSqTj.exe
  2⤵
  PID:14156
- C:\Windows\System\pBFadGV.exe
  C:\Windows\System\pBFadGV.exe
  2⤵
  PID:14228
- C:\Windows\System\cgFFDoH.exe
  C:\Windows\System\cgFFDoH.exe
  2⤵
  PID:14260
- C:\Windows\System\EYMxkFI.exe
  C:\Windows\System\EYMxkFI.exe
  2⤵
  PID:14308
- C:\Windows\System\uMgglsz.exe
  C:\Windows\System\uMgglsz.exe
  2⤵
  PID:10760
- C:\Windows\System\LBcINME.exe
  C:\Windows\System\LBcINME.exe
  2⤵
  PID:13936
- C:\Windows\System\YFCbRti.exe
  C:\Windows\System\YFCbRti.exe
  2⤵
  PID:11232
- C:\Windows\System\TTsisBy.exe
  C:\Windows\System\TTsisBy.exe
  2⤵
  PID:11036
- C:\Windows\System\QsAFEnc.exe
  C:\Windows\System\QsAFEnc.exe
  2⤵
  PID:12964
- C:\Windows\System\GnJikBJ.exe
  C:\Windows\System\GnJikBJ.exe
  2⤵
  PID:13704
- C:\Windows\System\QpgozNP.exe
  C:\Windows\System\QpgozNP.exe
  2⤵
  PID:4852
- C:\Windows\System\SNlrFFF.exe
  C:\Windows\System\SNlrFFF.exe
  2⤵
  PID:5592
- C:\Windows\System\vMNaECp.exe
  C:\Windows\System\vMNaECp.exe
  2⤵
  PID:14288
- C:\Windows\System\NBlLDOu.exe
  C:\Windows\System\NBlLDOu.exe
  2⤵
  PID:13872
- C:\Windows\System\VFGneww.exe
  C:\Windows\System\VFGneww.exe
  2⤵
  PID:9704
- C:\Windows\System\qbsNJIv.exe
  C:\Windows\System\qbsNJIv.exe
  2⤵
  PID:13548
- C:\Windows\System\yNZcHuZ.exe
  C:\Windows\System\yNZcHuZ.exe
  2⤵
  PID:9512
- C:\Windows\System\iCvsJlh.exe
  C:\Windows\System\iCvsJlh.exe
  2⤵
  PID:6372
- C:\Windows\System\IQxbhTc.exe
  C:\Windows\System\IQxbhTc.exe
  2⤵
  PID:14120
- C:\Windows\System\qmyEsox.exe
  C:\Windows\System\qmyEsox.exe
  2⤵
  PID:11792
- C:\Windows\System\DTqXzZA.exe
  C:\Windows\System\DTqXzZA.exe
  2⤵
  PID:13376
- C:\Windows\System\mOuyYfj.exe
  C:\Windows\System\mOuyYfj.exe
  2⤵
  PID:11980
- C:\Windows\System\ScBrzkU.exe
  C:\Windows\System\ScBrzkU.exe
  2⤵
  PID:12072
- C:\Windows\System\xuIhbOp.exe
  C:\Windows\System\xuIhbOp.exe
  2⤵
  PID:12144
- C:\Windows\System\mSHLAzm.exe
  C:\Windows\System\mSHLAzm.exe
  2⤵
  PID:9964
- C:\Windows\System\qScUdVv.exe
  C:\Windows\System\qScUdVv.exe
  2⤵
  PID:11060
- C:\Windows\System\diSzlwE.exe
  C:\Windows\System\diSzlwE.exe
  2⤵
  PID:11432
- C:\Windows\System\ihhfvNj.exe
  C:\Windows\System\ihhfvNj.exe
  2⤵
  PID:11164
- C:\Windows\System\adJFrEZ.exe
  C:\Windows\System\adJFrEZ.exe
  2⤵
  PID:10788
- C:\Windows\System\SKOaIkJ.exe
  C:\Windows\System\SKOaIkJ.exe
  2⤵
  PID:10480
- C:\Windows\System\OXdVfaO.exe
  C:\Windows\System\OXdVfaO.exe
  2⤵
  PID:4360
- C:\Windows\System\qebcOcx.exe
  C:\Windows\System\qebcOcx.exe
  2⤵
  PID:14180
- C:\Windows\System\VtDAjuF.exe
  C:\Windows\System\VtDAjuF.exe
  2⤵
  PID:13788
- C:\Windows\System\XsPjdMc.exe
  C:\Windows\System\XsPjdMc.exe
  2⤵
  PID:13868
- C:\Windows\System\vzAOnzz.exe
  C:\Windows\System\vzAOnzz.exe
  2⤵
  PID:13584
- C:\Windows\System\UTXGUUo.exe
  C:\Windows\System\UTXGUUo.exe
  2⤵
  PID:9444
- C:\Windows\System\rfPwteC.exe
  C:\Windows\System\rfPwteC.exe
  2⤵
  PID:12280
- C:\Windows\System\FQsAmLf.exe
  C:\Windows\System\FQsAmLf.exe
  2⤵
  PID:13620
- C:\Windows\System\YvUsCxE.exe
  C:\Windows\System\YvUsCxE.exe
  2⤵
  PID:13708
- C:\Windows\System\BgqLdSP.exe
  C:\Windows\System\BgqLdSP.exe
  2⤵
  PID:14052
- C:\Windows\System\rsVayqv.exe
  C:\Windows\System\rsVayqv.exe
  2⤵
  PID:14056
- C:\Windows\System\tetMwPh.exe
  C:\Windows\System\tetMwPh.exe
  2⤵
  PID:10884
- C:\Windows\System\sDXezNt.exe
  C:\Windows\System\sDXezNt.exe
  2⤵
  PID:13808
- C:\Windows\System\MPjFDvt.exe
  C:\Windows\System\MPjFDvt.exe
  2⤵
  PID:14100
- C:\Windows\System\OFfjwoe.exe
  C:\Windows\System\OFfjwoe.exe
  2⤵
  PID:14000
- C:\Windows\System\hOKcCfu.exe
  C:\Windows\System\hOKcCfu.exe
  2⤵
  PID:14024
- C:\Windows\System\MyjPCbJ.exe
  C:\Windows\System\MyjPCbJ.exe
  2⤵
  PID:5576
- C:\Windows\System\evlzexn.exe
  C:\Windows\System\evlzexn.exe
  2⤵
  PID:4164
- C:\Windows\System\psopZXm.exe
  C:\Windows\System\psopZXm.exe
  2⤵
  PID:11700
- C:\Windows\System\eqVjATm.exe
  C:\Windows\System\eqVjATm.exe
  2⤵
  PID:12328
- C:\Windows\System\qHPidVD.exe
  C:\Windows\System\qHPidVD.exe
  2⤵
  PID:6868
- C:\Windows\System\WhZCFeP.exe
  C:\Windows\System\WhZCFeP.exe
  2⤵
  PID:9228
- C:\Windows\System\HVcFCKi.exe
  C:\Windows\System\HVcFCKi.exe
  2⤵
  PID:12376
- C:\Windows\System\NJNPphj.exe
  C:\Windows\System\NJNPphj.exe
  2⤵
  PID:11308
- C:\Windows\System\KkfjfQj.exe
  C:\Windows\System\KkfjfQj.exe
  2⤵
  PID:12700
- C:\Windows\System\QLJFmPM.exe
  C:\Windows\System\QLJFmPM.exe
  2⤵
  PID:11312
- C:\Windows\System\XrXSdaS.exe
  C:\Windows\System\XrXSdaS.exe
  2⤵
  PID:12668
- C:\Windows\System\JEXUcbJ.exe
  C:\Windows\System\JEXUcbJ.exe
  2⤵
  PID:9932
- C:\Windows\System\NNOydYK.exe
  C:\Windows\System\NNOydYK.exe
  2⤵
  PID:11340
- C:\Windows\System\MNiMxEw.exe
  C:\Windows\System\MNiMxEw.exe
  2⤵
  PID:12896
- C:\Windows\System\NNlsDtm.exe
  C:\Windows\System\NNlsDtm.exe
  2⤵
  PID:13180
- C:\Windows\System\pAhlChu.exe
  C:\Windows\System\pAhlChu.exe
  2⤵
  PID:3108
- C:\Windows\System\mJarQBm.exe
  C:\Windows\System\mJarQBm.exe
  2⤵
  PID:11516
- C:\Windows\System\oyAZSlf.exe
  C:\Windows\System\oyAZSlf.exe
  2⤵
  PID:13120
- C:\Windows\System\jvZRRFn.exe
  C:\Windows\System\jvZRRFn.exe
  2⤵
  PID:13948
- C:\Windows\System\rCifnPl.exe
  C:\Windows\System\rCifnPl.exe
  2⤵
  PID:14104
- C:\Windows\System\NwrviTl.exe
  C:\Windows\System\NwrviTl.exe
  2⤵
  PID:13452
- C:\Windows\System\DigYclD.exe
  C:\Windows\System\DigYclD.exe
  2⤵
  PID:12724
- C:\Windows\System\uUmRDai.exe
  C:\Windows\System\uUmRDai.exe
  2⤵
  PID:11984
- C:\Windows\System\NjAfcOi.exe
  C:\Windows\System\NjAfcOi.exe
  2⤵
  PID:13024
- C:\Windows\System\qoYBVFM.exe
  C:\Windows\System\qoYBVFM.exe
  2⤵
  PID:10764
- C:\Windows\System\RNwNMxi.exe
  C:\Windows\System\RNwNMxi.exe
  2⤵
  PID:11956
- C:\Windows\System\fzYkedM.exe
  C:\Windows\System\fzYkedM.exe
  2⤵
  PID:13616
- C:\Windows\System\kFqdvgf.exe
  C:\Windows\System\kFqdvgf.exe
  2⤵
  PID:13300
- C:\Windows\System\HGoshAe.exe
  C:\Windows\System\HGoshAe.exe
  2⤵
  PID:11760
- C:\Windows\System\IAFfwCG.exe
  C:\Windows\System\IAFfwCG.exe
  2⤵
  PID:11512
- C:\Windows\System\GhFFFpF.exe
  C:\Windows\System\GhFFFpF.exe
  2⤵
  PID:11556
- C:\Windows\System\IpkHDRs.exe
  C:\Windows\System\IpkHDRs.exe
  2⤵
  PID:12224
- C:\Windows\System\YxDqMlf.exe
  C:\Windows\System\YxDqMlf.exe
  2⤵
  PID:13612
- C:\Windows\System\CJyGAEU.exe
  C:\Windows\System\CJyGAEU.exe
  2⤵
  PID:5716
- C:\Windows\System\vCpXXNb.exe
  C:\Windows\System\vCpXXNb.exe
  2⤵
  PID:12184
- C:\Windows\System\OUSZWdf.exe
  C:\Windows\System\OUSZWdf.exe
  2⤵
  PID:13272
- C:\Windows\System\OVJITBo.exe
  C:\Windows\System\OVJITBo.exe
  2⤵
  PID:11880
- C:\Windows\System\jSXYfQK.exe
  C:\Windows\System\jSXYfQK.exe
  2⤵
  PID:14352
- C:\Windows\System\dTVijCF.exe
  C:\Windows\System\dTVijCF.exe
  2⤵
  PID:14380
- C:\Windows\System\eWjqalm.exe
  C:\Windows\System\eWjqalm.exe
  2⤵
  PID:14396
- C:\Windows\System\pgPBoUK.exe
  C:\Windows\System\pgPBoUK.exe
  2⤵
  PID:14416
- C:\Windows\System\DeodUoi.exe
  C:\Windows\System\DeodUoi.exe
  2⤵
  PID:14448
- C:\Windows\System\gQVPaDp.exe
  C:\Windows\System\gQVPaDp.exe
  2⤵
  PID:14468
- C:\Windows\System\QVbustQ.exe
  C:\Windows\System\QVbustQ.exe
  2⤵
  PID:14504
- C:\Windows\System\tjnVZNr.exe
  C:\Windows\System\tjnVZNr.exe
  2⤵
  PID:14540
- C:\Windows\System\ZqqaPJE.exe
  C:\Windows\System\ZqqaPJE.exe
  2⤵
  PID:14572
- C:\Windows\System\PDPIrOn.exe
  C:\Windows\System\PDPIrOn.exe
  2⤵
  PID:14608
- C:\Windows\System\vlPQoNq.exe
  C:\Windows\System\vlPQoNq.exe
  2⤵
  PID:14632
- C:\Windows\System\tspfMOs.exe
  C:\Windows\System\tspfMOs.exe
  2⤵
  PID:14660
- C:\Windows\System\JyjRQFt.exe
  C:\Windows\System\JyjRQFt.exe
  2⤵
  PID:14688
- C:\Windows\System\OWHRIQi.exe
  C:\Windows\System\OWHRIQi.exe
  2⤵
  PID:14704
- C:\Windows\System\UhqkbkT.exe
  C:\Windows\System\UhqkbkT.exe
  2⤵
  PID:14732
- C:\Windows\System\CLYBarz.exe
  C:\Windows\System\CLYBarz.exe
  2⤵
  PID:14760
- C:\Windows\System\hAvcPYo.exe
  C:\Windows\System\hAvcPYo.exe
  2⤵
  PID:14792
- C:\Windows\System\QspDZnu.exe
  C:\Windows\System\QspDZnu.exe
  2⤵
  PID:14820
- C:\Windows\System\tQZCcoC.exe
  C:\Windows\System\tQZCcoC.exe
  2⤵
  PID:14856
- C:\Windows\System\abZTLOO.exe
  C:\Windows\System\abZTLOO.exe
  2⤵
  PID:14872
- C:\Windows\System\CZDyBTm.exe
  C:\Windows\System\CZDyBTm.exe
  2⤵
  PID:14900
- C:\Windows\System\ecICdFP.exe
  C:\Windows\System\ecICdFP.exe
  2⤵
  PID:14952

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:13000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tx1r2szy.e5e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ASejEpW.exe

Filesize
1.9MB

MD5
d561d846b54fc81991b3f0b06dc58882

SHA1
c0f547cfbffa4259dfe7b25a0b1210ff88004de7

SHA256
6bf271407f22cbd8a73c2ff99314007e776e2a46f16c8c81588547ae547ff236

SHA512
b72d28d197a42806f6cfda2490dafce3b355b7d5be6878822312231bd2c4f9038156512e3061a7cc511c8df7796e0a0e8297c24bbc8e223694911727e52c4921

Download Submit
C:\Windows\System\CLtGAsf.exe

Filesize
1.9MB

MD5
27c8e1f88061f320caba6f8ae5c6fa02

SHA1
4b1a70ebe7a91d934782f1132cd108533a16dcc2

SHA256
f722c693c5850f9112ce298860855cf2eb09ee7c7eb76d947d4d007f87d083e2

SHA512
d7857bfd1e284edb7b436c46c22dede609b1c1b8a12d40c1c2ca900c39ae6866b530f6ddf1dd62c2b7504a4b079cfa0e33e535f2956b6d1b47dc3abf65755826

Download Submit
C:\Windows\System\EIZBirz.exe

Filesize
1.9MB

MD5
73b03ed523e6b9d5491880bc023eb806

SHA1
a1418b70b3014ce5c2cd16aae5af686540faa4d3

SHA256
5a5e5fe11adae584587882145433c3ff11e48736425deb17cdffd44161f5ca46

SHA512
8294ebf3de75ae854511562c812f51dca6d5a5ba3f2ab06cc5070639b52dd93da855c9c43a65d2e379c376b8e74d580b139350101e8feeaa2dee42c130aad48e

Download Submit
C:\Windows\System\EyLGalC.exe

Filesize
1.9MB

MD5
fc22d909652d8218933358ffb65a98be

SHA1
a0baede4b7da7bc8513d3598642f28a92c05ba74

SHA256
43e268d2de1d27f80163229bea2dc1c44cba2650bb15af41945fa15f672c81b2

SHA512
448dca82472c64160fabc26901242c4cf9eb3650e3e3723b855b4477a14ddb06b34ad91584aaa603c981890f139431812bdec80f988d236d337f89e1d1c2ed9b

Download Submit
C:\Windows\System\FcauznH.exe

Filesize
1.9MB

MD5
36d88140a76b519790a23d4fc9881e53

SHA1
7d4fce3707b319b86eb5a8bfdf9bf3c24dbb879b

SHA256
92f1eea6aa4b93fb552a8838d124e48cc0a0a2cb273ace707f13de5a7bec1550

SHA512
05c215a9efb3b1ce4df87e20eb6c0cec9853c9dc0cefa3d0dd075f94647b91603118ee5628f20a25446c6c30971fac3cc7c8b14f87f681a266dad32c52253386

Download Submit
C:\Windows\System\Fmozqsc.exe

Filesize
1.9MB

MD5
86bfdcd88e8f17169c544985cd337f1e

SHA1
9208cfbdae8fd8b241a7b4dd9eaee43f7cc31045

SHA256
aec0ff7a494e8ae525c2bbad78f73d6614625ceef313260b3aa8f943fea57ebe

SHA512
31b80af03452581f7fb6af8814b98df5a151608f699dd63b464e24f5fe08ceef919eec730d0d9cb63695c64cd64cfbecdee6857cf0a57851733a3fb40e9a4d35

Download Submit
C:\Windows\System\FxGwdfs.exe

Filesize
1.9MB

MD5
122885bc75e5260ab4c9ef36d6ea0040

SHA1
ebec3f724732eaee5e0e2474cc4927be7b5155e4

SHA256
cb526b27fbb884c1b12fdc93473d776a97a992d676530af580513efd2e52e526

SHA512
4df36860009f961951122bb50b1254cdb5f4fdd9ea0f29558fbee28d44d2f96abdb6fa1e16f470ccda33ce8c6b7601aaa7d358e796b78c0d4e3a7df1e7dde614

Download Submit
C:\Windows\System\HSOPzLD.exe

Filesize
1.9MB

MD5
6b433373ebce2c41030e5b29fbadd618

SHA1
e0d7ba9cc675003e89bc15d15e3d46d08e2a4a2b

SHA256
13ec2bbdc04685f10bd55a248b3e312a04207410f80634b633b3831246733e3b

SHA512
f0901745304da63b41fd541f8b2766d76b4a56c499373b0f91a5e285b6f945039e4636ec782d7d7f7ab43a2c459e420617333d9bc18d5fe91d36c3ea2ab98df9

Download Submit
C:\Windows\System\HTYOZuc.exe

Filesize
1.9MB

MD5
ae894261d57c5d9d5d53dde438c00dd7

SHA1
b83dcf36a55bfadfaa895747dcdbbed96c4ae523

SHA256
08f0664d12f21c81b2b76d4f7942d8f6461ee79d27326173e1f1fa326382037d

SHA512
953e18e077155d7b79f508a59b52753610b2969f2f2ae5c1668fc76c9a5ee3a4b0c8819b79e770a5ef108bf07a78fffabe37f30cd4a9f98510641847f0c85f58

Download Submit
C:\Windows\System\OOcrofi.exe

Filesize
1.9MB

MD5
e810578b77f41e18206071af86ab87c8

SHA1
ae3050e3704c3137a2eaed31915fa8ad0b02ce06

SHA256
c99c9aa14ee4bd4468bf9e9ac948d4a8869e44674ba78caee1036da773a1df5b

SHA512
eab701de3b68afea025b65b4c443bfc57b67a77202c3e60454657f169d2c35e7bdfff3c1a0e9e8741271020a3378a613a0f0041001b2ff3a5d7e0fd857b06f45

Download Submit
C:\Windows\System\OzVUtQt.exe

Filesize
1.9MB

MD5
57041a3bad63f6a9b6ca36bf121f888c

SHA1
2cb5902eba24c8a9ff01d0c84c6fe34c5ac3baab

SHA256
c6f5c148507a14fb2846eb18d3632fb15cf3154ea4d0cd47034ce4fd1af5f332

SHA512
7097c6d95f0d133a5b3ca598837ee1b711d41080c5c4e0ce3319be0016e1d7ae427e41da0cb5d420a3cc7c175c813c99d68586e6dc60fc7fdeaa19d381979363

Download Submit
C:\Windows\System\POdfZmh.exe

Filesize
1.9MB

MD5
1dc920d30f2df23b410ff52f8cef5a95

SHA1
8a98d9137cb4815508b7a27c8bed45bb13acc866

SHA256
0484482c7332cc68f0de4d7ca99e08e3c81f929a7dfcaba7bc08af758d9a8a43

SHA512
3d69fc1cf5448c96e32fd0774483ba76cd411b62aad79fbbff8559cb6ace5d589278b92569a79cc65165e4969c241d3431fc7632c8e7c3970ee0c394c952f317

Download Submit
C:\Windows\System\RiuZaUS.exe

Filesize
1.9MB

MD5
9d3fb942b2c5ba8c5b41bf42406b8686

SHA1
7e4e0c7a9d4e848cc4ab514ca45081b83a3fd186

SHA256
cd28c9f8933652065cba0e18316e6675e2faadae819ec403941c458cd036ec72

SHA512
89b1e01380cd367722951869ac7fd79267294056316b7f2be4269ce1808ef42b892d0ac7f9421d2d213f679961f7b8e8a77d9d7375cc25ce479eca6169238d46

Download Submit
C:\Windows\System\RkJUbjE.exe

Filesize
1.9MB

MD5
04c02f5ab765ab23c15a37e9f4a291fd

SHA1
0117fc9b80d43053b639387d386fe7755128da38

SHA256
e9543013800d82de9eeadc7da564de30cf7339a2de860eaa6206e9a05ee0fd1e

SHA512
1c57a4925fa0e7a7f0357bde5a3cca2cc621ca3bb069ad3f66fedb227149e5abe3439ddf81506cc069a268907453b8e9354dd4daf877d955c3908ad5a568659e

Download Submit
C:\Windows\System\SOCPpNb.exe

Filesize
1.9MB

MD5
a96001c46f125257ccfa5b1bd1758808

SHA1
cc92ad20004c78b947893457e49344930a9e5e5d

SHA256
8d27b50b388e6af648a08cccdc39ea0f0c2f28a9d470248fb2e17a74343cf3fb

SHA512
3ef1cc03f0f46044540a5a569b41af891a71e1938828ffcbb08146c60135ef954f82e60997563fe210af9bb000182f6c262a82231b26eb701e9571c3b2ac26f6

Download Submit
C:\Windows\System\TbUAkkd.exe

Filesize
1.9MB

MD5
590c637db7902e16acc47562505a784e

SHA1
8d04e2220fe182b2647b171248e9ff19d6ab3079

SHA256
87ecb0881a32b5ace603ebd93bd32cc8bd42f88bb8c33790ac073f59dab2cd8f

SHA512
93423f5b152b997c2b0cbab7c1b206070df537c02b0b0dfab5d085f5a2f2b3c49fc3439648e126f48760e6f20316cfc3dd4e203dd930f726a879c23a2bc4ad9a

Download Submit
C:\Windows\System\Uqhuviu.exe

Filesize
1.9MB

MD5
c746977ffa110560367295ece92b3b4b

SHA1
1acd3776002a26a498312a4798b3d2c78378ab6f

SHA256
d3a7f7702a191d4be6ee33642ced0aca6d362f4103a6495ab52a3b20a7b8c5c5

SHA512
67ecd64de23258f3f83b81afbe69a7409d2b8bc61e43d958cfe4269870e543acd4638e7c10dbec30caba97114c3c0c9167985ade22611d850ab6ab8053330997

Download Submit
C:\Windows\System\YULUyhp.exe

Filesize
1.9MB

MD5
b5429feade73ff729cbaab36c29f0739

SHA1
04bddab91e7e02336c71c37cf4076c671b4ec185

SHA256
dc01585c0173f65a52abf1cbfe00e2eec2ab38ad52768d03c694f0a083315556

SHA512
13ff5ca2f1120f4935918aaaeb1c49a82b9f2d6f28ecfc3fff627c68f9caf427159d3e1dbcd02a2d058ca81cfde678c3db90d7c6942383875edc33fb583fae56

Download Submit
C:\Windows\System\YVgcqPg.exe

Filesize
1.9MB

MD5
07c5d0b56b46da6d9180e32a5b3f876f

SHA1
5c5b56de301d15d1459a1d48916beef2127ba035

SHA256
7e382746d911de72c909e8b5486c0b19ef2caac39e19e1de83549deda98c7118

SHA512
eaf9a50c5cbaa780b411cf080e00d6e5b9531f31700269881a229ef983129b1b5e893b720b1aa85bcff7cf890142713f237da72500853d384cce2acd1e149b2d

Download Submit
C:\Windows\System\ZNkGZKh.exe

Filesize
1.9MB

MD5
87736fccd534fa632608ad47f66179ff

SHA1
59d71fd9cbd6b76e037cc738b2ae84af37a32946

SHA256
3958861560895d8fced0208bad01cc6501adb1c4158c7c27c9e173cb5888701b

SHA512
2471f90bb8f9f6392d8f2c09e63bb9695ea8b5fef52561bb3e8eb06016a54bc19068502858b5922783dd88c458060382e2ff59699a1b0705f022ef07150f55ca

Download Submit
C:\Windows\System\ZSAUCgB.exe

Filesize
1.9MB

MD5
5415c5d52da04c9d26c2e6158b22fbba

SHA1
142723c064554d965f4a73f3749423ae95ec3d0f

SHA256
6731f8749fa3f73f00884f413377989feac57b2043dac1bd6f697e9399f82469

SHA512
aa6d7e5223a9a3ec85a74d22a93e2c690b0932f19d43d1af5502754bd7a3622e713b9dcf8303a878cbc1ffdf95ad92bdc02fea12d681c11464b3a3078f921593

Download Submit
C:\Windows\System\ZYyXRJG.exe

Filesize
1.9MB

MD5
629780100b1893a2210f3799fe02809a

SHA1
d8a2ac50a2a5e68d447b5ef537a8a41438f7b96d

SHA256
dd784ea1275a9c6d311794c1c75249f0e6cf24bd103d7c7eb1b3d17256cb9744

SHA512
0a711d7535ee37b0db801e084e4cbdd5fbfaf95f1e540737f1a40dbd3b37ad8935fcbd0f80e59ce6286bc8327f76db4a68045931b465922c1c266a1d277bcf1a

Download Submit
C:\Windows\System\aimdFar.exe

Filesize
1.9MB

MD5
d7fe1515ddf4e952aa1529c7510e6f7e

SHA1
c526d3678716cb530fa5ba5badfbf51cdc58dde1

SHA256
860851623a18929642bf8a307bc98bd1efefd4c06dcc8413ad1b0004ecf920ff

SHA512
8152078f362400b5dc1da4ae021523b3657897cc9711004b1b2970de1c8c4857d9e52a9fd5ffaf06f49d5246d4e081063bd818e52fede2c8360015d9d69cbb0b

Download Submit
C:\Windows\System\cOEpyAv.exe

Filesize
1.9MB

MD5
ea875d6b518691155410a7cf1a60aeec

SHA1
428ed190c8d01e63ac968be802f9e39f79ee864b

SHA256
fae16607e69079d75e3764b81d384fea9e7a74829657218bf23440a269fa152c

SHA512
50405455a42d5c2085219a19144565a7f87c9d8e1df37c554ddde4b63b99966a66c9df38aa5d24dbe8969e5ba88236ec130efbabcff4f5acb8c6c2ae93fe1d14

Download Submit
C:\Windows\System\eYBhGih.exe

Filesize
1.9MB

MD5
fffffa41577b3e16258e565ca136076b

SHA1
b21a8acbf01e41be826ddee602fdc3bc6bdabc40

SHA256
86280ad669337276980ac18fc61e7468074bfcb4c315731d5243f4f50c9bca71

SHA512
0fcc3ec6c7f912a0e29b61ca0746159b06c5b0c0c24c8c9607844dce497dcfba6818320e05ab090363d14084c9955ab24dae1365efb7a8a43f994ebc3a618ce4

Download Submit
C:\Windows\System\fQWvzfD.exe

Filesize
1.9MB

MD5
e992a118df9dbcfe843820baa4da16e3

SHA1
e98d92d0eaa9e89b38de82eed6b2df3c3bd1eeea

SHA256
91c83633b424720c1740543e6ce89712f1e3559c644c92907badc698b1191523

SHA512
cc34e0c6e2b687f54b53c54e66a4356e5ec57a1b30be98e02411507eb0ccae46422283a31ab821b0e8f1cfaa7c099958380e5871af10be20b780cd0bf0dc2c86

Download Submit
C:\Windows\System\fSTDOMk.exe

Filesize
1.9MB

MD5
1d0f52a846e5d9634ee38bb127f154e1

SHA1
30affc3ffb3ae291ed2a56fac9fb21e4df33bb52

SHA256
76f1d0a3b4e5fe02fc23429dfed218deb1ce39468eef996f7f1511abc1ef59c6

SHA512
dbc91efab92e64d99cc0ba26cfe390d8c89bcb8f1e9f8769b1ed19a3b75baf1c644835c0085b3c69b1aaa962ad3c455b930752ced13866c97a3474136a9d2aaa

Download Submit
C:\Windows\System\gceFyRQ.exe

Filesize
1.9MB

MD5
60cc01c24cfb2d5948d4c5d28de8ae0f

SHA1
ed47c660738774cb4851ac1459a8c85937587cef

SHA256
02f2ba20584b8e4fb10d2de6581c78a75d6d634fa4f75d5837addf9c11dc095c

SHA512
e61462b3de2142661641972852b31a707c324a4dd5006f55d10a15acc14cfaa833362089fb586382f10cc73cfc73d5d35cf98ea596027a8d133dec0f8e4787fa

Download Submit
C:\Windows\System\jCipNFr.exe

Filesize
18B

MD5
245dee33bd0829fb0a14fffbb01cddca

SHA1
3098465efbb0ab58d084dea73fb53b7464aa2124

SHA256
42ab9954ae85f062ea70b5a38d7cb35251b9594624f80f499a57a579cabb5d86

SHA512
4a249b410305275b4e8f1049bfb6debe0c906ca24cdd1c084f91263bd1208ad51b8937135ff9506b71885993cc7bafe2c69d5ba8bf11fa3ad12e247f4d803429

Download Submit
C:\Windows\System\jhIQfkH.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\orKdXnH.exe

Filesize
1.9MB

MD5
160756dea0f0608f0c7ca76f16d846b9

SHA1
78a0fce427f439584c982038b2c9351f309460df

SHA256
27de53a5d1aa8f877c0dabd3bcf4dda5c6760148e04168abe847eec7b5705d74

SHA512
4ac95433e9964661b4b95922a731744d5bfcdb6f87ac9e71c0fa71dd293af6c135e9c5a13baa5a6440526c4a4d08b00bd71199a7e927a400d369c393c4b1e643

Download Submit
C:\Windows\System\ouWMsCv.exe

Filesize
1.9MB

MD5
0cc6eeebc4fd2a49ac0bf433dc4854aa

SHA1
fad9ddb5fff584cfb8f953919722cc3ede829d83

SHA256
7f4464b36ff8ab8732b15c174799bb87fd6660048e7a2b6220dbf03bb88d74c2

SHA512
9a94a6dd706648ac2758f9ff56924aa4bd980dcc5959c37109436c748a8658415add254d0438ad978ed70e69ed556843f6a66d821c63f017c350ada4d9dd74f2

Download Submit
C:\Windows\System\pQHLjUm.exe

Filesize
1.9MB

MD5
6946b06db4bd5c0bbd7de358b4780258

SHA1
5b9325fffc75eeab65ba2d2ef8adab1c3b22729e

SHA256
35ac159caf22ca248deaadf2317bbd05befddf3baf4c8697ffae5789fbc5497f

SHA512
4a595431bdf0909190a1a5ff2f8b25e3f5bc49243054a414c23995610064c6016b5690a5138ba1a8d6670221ecad5a6b2b9ebb033f70801a951954e6121eefbb

Download Submit
C:\Windows\System\qnWBWLu.exe

Filesize
1.9MB

MD5
8f4f5af77067b4577944b1c4f559e736

SHA1
da2d45255c2d3bc2fad6e9973fb347c85256dff5

SHA256
aee6e38ccc57f475b9984594cd4a4eadf489fa946f4874265b7a82963f5e101a

SHA512
0bd5be29cfbf071aa03b5d80169110397148932274f7858eb06e9f5b2866aa693b8247cb6d5dac64545b6f7cf0b2465f806ce81320e19445496aeb25890164ef

Download Submit
C:\Windows\System\spMjIHx.exe

Filesize
1.9MB

MD5
246eef69ec18e1809f58b56e4bfc79d9

SHA1
0c128cbb657ff3b3343507cd6bd26a422a83617a

SHA256
90fe2e1af5b66bb61ad98780b3ba1a31499ae7f0d8a7fd3ee6b9a1f31f52cfd3

SHA512
55ef25a466c129506ac409ad5fa404f3f3bec3591d482c9d82d85fb8376db9db7253d6e8de5d3bbdfcc0be6834cf315ee68b88216ceeb60c48569d0d62cf35e5

Download Submit
C:\Windows\System\vVvkhNK.exe

Filesize
1.9MB

MD5
0c5b830698dcbaff87f42cd3c1656e34

SHA1
7725e8946000ac26d2e5a5c013d6fb532383e966

SHA256
16321aa930f4f1af15caa1b45394056655280b9dd9b019bc388e720b40eeaaa1

SHA512
51fa1bd7b7057beea186ea84e8b6128825eb3f651f3abd125b5f3b43950101e21edefc426965e45c3c107fd81c7488fa2bb4dc4e5b666397176df7a08990cbd4

Download Submit
memory/8-4719-0x00007FF76FB60000-0x00007FF76FF52000-memory.dmp

Filesize
3.9MB

Download
memory/8-123-0x00007FF76FB60000-0x00007FF76FF52000-memory.dmp

Filesize
3.9MB

Download
memory/432-2708-0x00007FF68BAC0000-0x00007FF68BEB2000-memory.dmp

Filesize
3.9MB

Download
memory/432-20-0x00007FF68BAC0000-0x00007FF68BEB2000-memory.dmp

Filesize
3.9MB

Download
memory/448-4715-0x00007FF734DC0000-0x00007FF7351B2000-memory.dmp

Filesize
3.9MB

Download
memory/448-114-0x00007FF734DC0000-0x00007FF7351B2000-memory.dmp

Filesize
3.9MB

Download
memory/448-3482-0x00007FF734DC0000-0x00007FF7351B2000-memory.dmp

Filesize
3.9MB

Download
memory/1352-38-0x00007FF66FB50000-0x00007FF66FF42000-memory.dmp

Filesize
3.9MB

Download
memory/1352-4657-0x00007FF66FB50000-0x00007FF66FF42000-memory.dmp

Filesize
3.9MB

Download
memory/1448-4674-0x00007FF62E340000-0x00007FF62E732000-memory.dmp

Filesize
3.9MB

Download
memory/1448-113-0x00007FF62E340000-0x00007FF62E732000-memory.dmp

Filesize
3.9MB

Download
memory/1460-136-0x00007FF6B9640000-0x00007FF6B9A32000-memory.dmp

Filesize
3.9MB

Download
memory/1548-76-0x00007FF7E9D70000-0x00007FF7EA162000-memory.dmp

Filesize
3.9MB

Download
memory/1576-6263-0x00007FF67C440000-0x00007FF67C832000-memory.dmp

Filesize
3.9MB

Download
memory/1576-151-0x00007FF67C440000-0x00007FF67C832000-memory.dmp

Filesize
3.9MB

Download
memory/1676-2709-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp

Filesize
3.9MB

Download
memory/1676-27-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp

Filesize
3.9MB

Download
memory/1676-4632-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-75-0x00007FF776AE0000-0x00007FF776ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-87-0x00007FF7F6E60000-0x00007FF7F7252000-memory.dmp

Filesize
3.9MB

Download
memory/3068-85-0x000001F8FBF90000-0x000001F8FBFB2000-memory.dmp

Filesize
136KB

Download
memory/3068-72-0x000001F8E3700000-0x000001F8E3710000-memory.dmp

Filesize
64KB

Download
memory/3068-65-0x00007FFF27C80000-0x00007FFF28741000-memory.dmp

Filesize
10.8MB

Download
memory/3068-1719-0x00007FFF27C80000-0x00007FFF28741000-memory.dmp

Filesize
10.8MB

Download
memory/3068-21-0x000001F8E3700000-0x000001F8E3710000-memory.dmp

Filesize
64KB

Download
memory/3592-140-0x00007FF61BB90000-0x00007FF61BF82000-memory.dmp

Filesize
3.9MB

Download
memory/3596-119-0x00007FF7F27A0000-0x00007FF7F2B92000-memory.dmp

Filesize
3.9MB

Download
memory/3636-120-0x00007FF60D130000-0x00007FF60D522000-memory.dmp

Filesize
3.9MB

Download
memory/3748-96-0x00007FF70B730000-0x00007FF70BB22000-memory.dmp

Filesize
3.9MB

Download
memory/3780-106-0x00007FF708E50000-0x00007FF709242000-memory.dmp

Filesize
3.9MB

Download
memory/4008-45-0x00007FF741960000-0x00007FF741D52000-memory.dmp

Filesize
3.9MB

Download
memory/4452-121-0x00007FF74ABB0000-0x00007FF74AFA2000-memory.dmp

Filesize
3.9MB

Download
memory/4628-122-0x00007FF60EE10000-0x00007FF60F202000-memory.dmp

Filesize
3.9MB

Download
memory/4668-95-0x00007FF7A8490000-0x00007FF7A8882000-memory.dmp

Filesize
3.9MB

Download
memory/4884-14-0x00007FF726EC0000-0x00007FF7272B2000-memory.dmp

Filesize
3.9MB

Download
memory/4916-1-0x00000218994B0000-0x00000218994C0000-memory.dmp

Filesize
64KB

Download
memory/4916-0-0x00007FF7F6CC0000-0x00007FF7F70B2000-memory.dmp

Filesize
3.9MB

Download