xmrig | 8ea459c17cd909f454130aef539fd956e1dc52342eeea8313370fa6f1e459021

Analysis

max time kernel
138s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
Size

1.7MB
MD5

05445304ee0102f726bc7d2a260e22ea
SHA1

e2af57956a3bb26548538fdbc10c92e39c4643e8
SHA256

8ea459c17cd909f454130aef539fd956e1dc52342eeea8313370fa6f1e459021
SHA512

3d687197f893085fbd90b39cae30156e8f4724318d236577d3ca08729a8082984ba2b662094257a0cc71f2621cf2303cd5d102421e58c0759374d35d914e79a2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDh:NAB4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral2/memory/4680-80-0x00007FF693770000-0x00007FF693B62000-memory.dmp	xmrig
behavioral2/memory/4616-155-0x00007FF79B4C0000-0x00007FF79B8B2000-memory.dmp	xmrig
behavioral2/memory/2376-149-0x00007FF627D00000-0x00007FF6280F2000-memory.dmp	xmrig
behavioral2/memory/2108-148-0x00007FF7267D0000-0x00007FF726BC2000-memory.dmp	xmrig
behavioral2/memory/3368-142-0x00007FF69B800000-0x00007FF69BBF2000-memory.dmp	xmrig
behavioral2/memory/60-141-0x00007FF719EB0000-0x00007FF71A2A2000-memory.dmp	xmrig
behavioral2/memory/3876-117-0x00007FF71C570000-0x00007FF71C962000-memory.dmp	xmrig
behavioral2/memory/972-76-0x00007FF6D7A70000-0x00007FF6D7E62000-memory.dmp	xmrig
behavioral2/memory/2912-75-0x00007FF778570000-0x00007FF778962000-memory.dmp	xmrig
behavioral2/memory/3840-69-0x00007FF65D480000-0x00007FF65D872000-memory.dmp	xmrig
behavioral2/memory/5008-54-0x00007FF6A6760000-0x00007FF6A6B52000-memory.dmp	xmrig
behavioral2/memory/3200-42-0x00007FF71A880000-0x00007FF71AC72000-memory.dmp	xmrig
behavioral2/memory/2108-33-0x00007FF7267D0000-0x00007FF726BC2000-memory.dmp	xmrig
behavioral2/memory/3504-1413-0x00007FF7C56C0000-0x00007FF7C5AB2000-memory.dmp	xmrig
behavioral2/memory/5064-1412-0x00007FF6D2A70000-0x00007FF6D2E62000-memory.dmp	xmrig
behavioral2/memory/3752-2686-0x00007FF7C6380000-0x00007FF7C6772000-memory.dmp	xmrig
behavioral2/memory/1516-4382-0x00007FF7E1100000-0x00007FF7E14F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3200	IbFmlQj.exe
2108	ZXkzTES.exe
3504	fZjlWCT.exe
2376	ptHcZmX.exe
5008	dZlqvuv.exe
3840	wuxcIOa.exe
5064	PdEZyXu.exe
2912	lcgJrlV.exe
972	qifMBXb.exe
4680	EJLFWhy.exe
3772	KuJWnPw.exe
5100	TCvWxaK.exe
3752	INgxqTl.exe
1428	KhaSTzz.exe
4328	JPIDVmI.exe
2548	VItHtTT.exe
4528	RVklWAt.exe
1516	WdqSXzY.exe
60	JGLRoDv.exe
3368	SAEDbMW.exe
4616	oLFtWvr.exe
1972	GkIPTPb.exe
4944	EHTuTnx.exe
4972	wGTnFbQ.exe
3144	UyQKQkS.exe
1416	YEKqbdU.exe
2024	yjrUULO.exe
2864	PhSmqNj.exe
1904	wIVyyAT.exe
3604	tMuxQlD.exe
3348	tZdcqtX.exe
3640	bjmneXd.exe
1660	aykzocT.exe
1872	tibvIut.exe
4236	DxdVWSJ.exe
2044	aSecaOs.exe
2576	GIZCjmi.exe
3868	bYnheUS.exe
3896	GquXhVS.exe
4320	hKRkewy.exe
3512	wKbTvSF.exe
4472	TzoerGu.exe
1160	LhlpRWG.exe
4860	OjvYnXB.exe
3924	iteevEh.exe
624	LzUDRsH.exe
3412	GOJNaID.exe
2004	bphBAKt.exe
456	CQwiGtj.exe
4604	kprdbPp.exe
1292	rADVBfQ.exe
3244	DmlImha.exe
1528	veJMqhe.exe
856	QqPfSbB.exe
3524	UUMciCQ.exe
2028	xNqdYcT.exe
4152	FAqfIHr.exe
3448	VNakoYj.exe
4196	QddYWzr.exe
5028	ePszBxE.exe
4128	nJBOSDR.exe
4360	jeArCEL.exe
1520	wnERQgQ.exe
3300	oQKsxcK.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3876-0-0x00007FF71C570000-0x00007FF71C962000-memory.dmp	upx
behavioral2/files/0x000b000000023b69-5.dat	upx
behavioral2/files/0x000a000000023b6e-9.dat	upx
behavioral2/files/0x000a000000023b6d-10.dat	upx
behavioral2/files/0x000a000000023b6f-31.dat	upx
behavioral2/files/0x000b000000023b71-44.dat	upx
behavioral2/files/0x000a000000023b74-60.dat	upx
behavioral2/files/0x000a000000023b75-66.dat	upx
behavioral2/memory/4680-80-0x00007FF693770000-0x00007FF693B62000-memory.dmp	upx
behavioral2/files/0x000a000000023b78-94.dat	upx
behavioral2/files/0x000a000000023b7a-102.dat	upx
behavioral2/memory/2548-111-0x00007FF61CB90000-0x00007FF61CF82000-memory.dmp	upx
behavioral2/files/0x000a000000023b7d-120.dat	upx
behavioral2/files/0x000a000000023b85-168.dat	upx
behavioral2/files/0x000a000000023b8a-199.dat	upx
behavioral2/files/0x000a000000023b8b-198.dat	upx
behavioral2/files/0x000a000000023b89-196.dat	upx
behavioral2/files/0x000a000000023b88-191.dat	upx
behavioral2/files/0x000a000000023b87-186.dat	upx
behavioral2/files/0x000a000000023b86-181.dat	upx
behavioral2/files/0x000a000000023b84-171.dat	upx
behavioral2/files/0x000a000000023b83-166.dat	upx
behavioral2/files/0x000a000000023b82-161.dat	upx
behavioral2/files/0x000a000000023b81-156.dat	upx
behavioral2/memory/4616-155-0x00007FF79B4C0000-0x00007FF79B8B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b80-150.dat	upx
behavioral2/memory/2376-149-0x00007FF627D00000-0x00007FF6280F2000-memory.dmp	upx
behavioral2/memory/2108-148-0x00007FF7267D0000-0x00007FF726BC2000-memory.dmp	upx
behavioral2/files/0x000a000000023b7f-143.dat	upx
behavioral2/memory/3368-142-0x00007FF69B800000-0x00007FF69BBF2000-memory.dmp	upx
behavioral2/memory/60-141-0x00007FF719EB0000-0x00007FF71A2A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b7e-135.dat	upx
behavioral2/memory/1516-129-0x00007FF7E1100000-0x00007FF7E14F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b7c-124.dat	upx
behavioral2/memory/4528-123-0x00007FF6D8990000-0x00007FF6D8D82000-memory.dmp	upx
behavioral2/files/0x000a000000023b7b-118.dat	upx
behavioral2/memory/3876-117-0x00007FF71C570000-0x00007FF71C962000-memory.dmp	upx
behavioral2/files/0x000b000000023b6a-106.dat	upx
behavioral2/memory/4328-105-0x00007FF627B50000-0x00007FF627F42000-memory.dmp	upx
behavioral2/files/0x000a000000023b79-100.dat	upx
behavioral2/memory/1428-99-0x00007FF705F20000-0x00007FF706312000-memory.dmp	upx
behavioral2/memory/3752-93-0x00007FF7C6380000-0x00007FF7C6772000-memory.dmp	upx
behavioral2/memory/5100-89-0x00007FF7EC650000-0x00007FF7ECA42000-memory.dmp	upx
behavioral2/files/0x000a000000023b77-84.dat	upx
behavioral2/memory/3772-83-0x00007FF648AD0000-0x00007FF648EC2000-memory.dmp	upx
behavioral2/memory/972-76-0x00007FF6D7A70000-0x00007FF6D7E62000-memory.dmp	upx
behavioral2/memory/2912-75-0x00007FF778570000-0x00007FF778962000-memory.dmp	upx
behavioral2/files/0x000a000000023b76-70.dat	upx
behavioral2/memory/3840-69-0x00007FF65D480000-0x00007FF65D872000-memory.dmp	upx
behavioral2/files/0x000b000000023b72-64.dat	upx
behavioral2/memory/5064-63-0x00007FF6D2A70000-0x00007FF6D2E62000-memory.dmp	upx
behavioral2/files/0x000a000000023b73-55.dat	upx
behavioral2/memory/5008-54-0x00007FF6A6760000-0x00007FF6A6B52000-memory.dmp	upx
behavioral2/memory/3504-48-0x00007FF7C56C0000-0x00007FF7C5AB2000-memory.dmp	upx
behavioral2/memory/3200-42-0x00007FF71A880000-0x00007FF71AC72000-memory.dmp	upx
behavioral2/memory/2376-39-0x00007FF627D00000-0x00007FF6280F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b70-35.dat	upx
behavioral2/memory/2108-33-0x00007FF7267D0000-0x00007FF726BC2000-memory.dmp	upx
behavioral2/memory/3504-1413-0x00007FF7C56C0000-0x00007FF7C5AB2000-memory.dmp	upx
behavioral2/memory/5064-1412-0x00007FF6D2A70000-0x00007FF6D2E62000-memory.dmp	upx
behavioral2/memory/3752-2686-0x00007FF7C6380000-0x00007FF7C6772000-memory.dmp	upx
behavioral2/memory/1516-4382-0x00007FF7E1100000-0x00007FF7E14F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HCLhPVo.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\dmIdlUo.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\YSUsUmY.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\nhuTDjc.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\IgQhjjW.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\kyBpQAE.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\zFdiLub.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\TxVlYbC.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\vqqGMyM.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\CxpGgms.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\EPCyIaN.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\KIbXJjD.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\MzszsaG.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\fzimfRN.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\FYXggds.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\bEjBNtx.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\ftansjJ.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\aYznNsj.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\vsCbCKd.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\gDglFJi.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\utWoJJQ.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\HXGHZOe.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\bGVyFex.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\uBljyfK.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\KXKPNpR.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\WrVKKui.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\JUEcMHf.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\PugDKUZ.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\zUkHsDO.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\FfJxHeI.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\siSskwp.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\oSluJdR.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\aoIkcsJ.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\Kxzgwtj.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\LsIPTNb.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\TBaQHzH.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\jjNIpnd.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\UvYbfWu.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\HuQDLoM.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\uwPVmOt.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\CZgKONI.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\PMAexuf.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\IQTXFve.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\YZOfvBo.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\kvXkrZG.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\GKVZXSP.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\FZpMQFH.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\xbLBdkO.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\PtqELNT.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\uPPbNfd.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\LjyTFKw.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\reiFLKh.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\IOIgJFF.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\jkRsApG.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\lKQavhu.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\IJEyPAO.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\MVeCHdU.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\eynMsow.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\bphBAKt.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\PEyfxpG.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\wYbceij.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\rFrpySX.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\jdadcHo.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\NNaIWYV.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe

Modifies data under HKEY_USERS 32 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
Token: SeDebugPrivilege	1552	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4964	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 1552	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	84
PID 3876 wrote to memory of 1552	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	84
PID 3876 wrote to memory of 3200	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	85
PID 3876 wrote to memory of 3200	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	85
PID 3876 wrote to memory of 2108	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	86
PID 3876 wrote to memory of 2108	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	86
PID 3876 wrote to memory of 3504	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	87
PID 3876 wrote to memory of 3504	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	87
PID 3876 wrote to memory of 2376	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	88
PID 3876 wrote to memory of 2376	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	88
PID 3876 wrote to memory of 5008	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	89
PID 3876 wrote to memory of 5008	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	89
PID 3876 wrote to memory of 3840	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	90
PID 3876 wrote to memory of 3840	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	90
PID 3876 wrote to memory of 5064	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	91
PID 3876 wrote to memory of 5064	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	91
PID 3876 wrote to memory of 2912	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	92
PID 3876 wrote to memory of 2912	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	92
PID 3876 wrote to memory of 972	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	93
PID 3876 wrote to memory of 972	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	93
PID 3876 wrote to memory of 4680	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	94
PID 3876 wrote to memory of 4680	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	94
PID 3876 wrote to memory of 3772	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	95
PID 3876 wrote to memory of 3772	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	95
PID 3876 wrote to memory of 5100	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	96
PID 3876 wrote to memory of 5100	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	96
PID 3876 wrote to memory of 3752	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	97
PID 3876 wrote to memory of 3752	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	97
PID 3876 wrote to memory of 1428	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	98
PID 3876 wrote to memory of 1428	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	98
PID 3876 wrote to memory of 4328	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	99
PID 3876 wrote to memory of 4328	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	99
PID 3876 wrote to memory of 2548	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	100
PID 3876 wrote to memory of 2548	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	100
PID 3876 wrote to memory of 4528	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	101
PID 3876 wrote to memory of 4528	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	101
PID 3876 wrote to memory of 1516	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	102
PID 3876 wrote to memory of 1516	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	102
PID 3876 wrote to memory of 60	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	103
PID 3876 wrote to memory of 60	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	103
PID 3876 wrote to memory of 3368	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	104
PID 3876 wrote to memory of 3368	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	104
PID 3876 wrote to memory of 4616	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	105
PID 3876 wrote to memory of 4616	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	105
PID 3876 wrote to memory of 1972	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	106
PID 3876 wrote to memory of 1972	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	106
PID 3876 wrote to memory of 4944	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	107
PID 3876 wrote to memory of 4944	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	107
PID 3876 wrote to memory of 4972	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	108
PID 3876 wrote to memory of 4972	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	108
PID 3876 wrote to memory of 3144	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	109
PID 3876 wrote to memory of 3144	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	109
PID 3876 wrote to memory of 1416	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	110
PID 3876 wrote to memory of 1416	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	110
PID 3876 wrote to memory of 2024	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	111
PID 3876 wrote to memory of 2024	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	111
PID 3876 wrote to memory of 2864	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	112
PID 3876 wrote to memory of 2864	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	112
PID 3876 wrote to memory of 1904	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	113
PID 3876 wrote to memory of 1904	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	113
PID 3876 wrote to memory of 3604	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	114
PID 3876 wrote to memory of 3604	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	114
PID 3876 wrote to memory of 3348	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	115
PID 3876 wrote to memory of 3348	3876	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\System\IbFmlQj.exe
  C:\Windows\System\IbFmlQj.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\ZXkzTES.exe
  C:\Windows\System\ZXkzTES.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\fZjlWCT.exe
  C:\Windows\System\fZjlWCT.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\ptHcZmX.exe
  C:\Windows\System\ptHcZmX.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\dZlqvuv.exe
  C:\Windows\System\dZlqvuv.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\wuxcIOa.exe
  C:\Windows\System\wuxcIOa.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\PdEZyXu.exe
  C:\Windows\System\PdEZyXu.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\lcgJrlV.exe
  C:\Windows\System\lcgJrlV.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\qifMBXb.exe
  C:\Windows\System\qifMBXb.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\EJLFWhy.exe
  C:\Windows\System\EJLFWhy.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\KuJWnPw.exe
  C:\Windows\System\KuJWnPw.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\TCvWxaK.exe
  C:\Windows\System\TCvWxaK.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\INgxqTl.exe
  C:\Windows\System\INgxqTl.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\KhaSTzz.exe
  C:\Windows\System\KhaSTzz.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\JPIDVmI.exe
  C:\Windows\System\JPIDVmI.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\VItHtTT.exe
  C:\Windows\System\VItHtTT.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\RVklWAt.exe
  C:\Windows\System\RVklWAt.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\WdqSXzY.exe
  C:\Windows\System\WdqSXzY.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\JGLRoDv.exe
  C:\Windows\System\JGLRoDv.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\SAEDbMW.exe
  C:\Windows\System\SAEDbMW.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\oLFtWvr.exe
  C:\Windows\System\oLFtWvr.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\GkIPTPb.exe
  C:\Windows\System\GkIPTPb.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\EHTuTnx.exe
  C:\Windows\System\EHTuTnx.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\wGTnFbQ.exe
  C:\Windows\System\wGTnFbQ.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\UyQKQkS.exe
  C:\Windows\System\UyQKQkS.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\YEKqbdU.exe
  C:\Windows\System\YEKqbdU.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\yjrUULO.exe
  C:\Windows\System\yjrUULO.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\PhSmqNj.exe
  C:\Windows\System\PhSmqNj.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\wIVyyAT.exe
  C:\Windows\System\wIVyyAT.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\tMuxQlD.exe
  C:\Windows\System\tMuxQlD.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\tZdcqtX.exe
  C:\Windows\System\tZdcqtX.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\bjmneXd.exe
  C:\Windows\System\bjmneXd.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\aykzocT.exe
  C:\Windows\System\aykzocT.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\tibvIut.exe
  C:\Windows\System\tibvIut.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\DxdVWSJ.exe
  C:\Windows\System\DxdVWSJ.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\aSecaOs.exe
  C:\Windows\System\aSecaOs.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\GIZCjmi.exe
  C:\Windows\System\GIZCjmi.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\bYnheUS.exe
  C:\Windows\System\bYnheUS.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\GquXhVS.exe
  C:\Windows\System\GquXhVS.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\hKRkewy.exe
  C:\Windows\System\hKRkewy.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\wKbTvSF.exe
  C:\Windows\System\wKbTvSF.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\TzoerGu.exe
  C:\Windows\System\TzoerGu.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\LhlpRWG.exe
  C:\Windows\System\LhlpRWG.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\OjvYnXB.exe
  C:\Windows\System\OjvYnXB.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\iteevEh.exe
  C:\Windows\System\iteevEh.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\LzUDRsH.exe
  C:\Windows\System\LzUDRsH.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\GOJNaID.exe
  C:\Windows\System\GOJNaID.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\bphBAKt.exe
  C:\Windows\System\bphBAKt.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\CQwiGtj.exe
  C:\Windows\System\CQwiGtj.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\kprdbPp.exe
  C:\Windows\System\kprdbPp.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\rADVBfQ.exe
  C:\Windows\System\rADVBfQ.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\DmlImha.exe
  C:\Windows\System\DmlImha.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\veJMqhe.exe
  C:\Windows\System\veJMqhe.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\QqPfSbB.exe
  C:\Windows\System\QqPfSbB.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\UUMciCQ.exe
  C:\Windows\System\UUMciCQ.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\xNqdYcT.exe
  C:\Windows\System\xNqdYcT.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\FAqfIHr.exe
  C:\Windows\System\FAqfIHr.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\VNakoYj.exe
  C:\Windows\System\VNakoYj.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\QddYWzr.exe
  C:\Windows\System\QddYWzr.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\ePszBxE.exe
  C:\Windows\System\ePszBxE.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\nJBOSDR.exe
  C:\Windows\System\nJBOSDR.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\jeArCEL.exe
  C:\Windows\System\jeArCEL.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\wnERQgQ.exe
  C:\Windows\System\wnERQgQ.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\oQKsxcK.exe
  C:\Windows\System\oQKsxcK.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\zqGdKbo.exe
  C:\Windows\System\zqGdKbo.exe
  2⤵
  PID:3088
- C:\Windows\System\gEfdkES.exe
  C:\Windows\System\gEfdkES.exe
  2⤵
  PID:2876
- C:\Windows\System\KoLlyME.exe
  C:\Windows\System\KoLlyME.exe
  2⤵
  PID:5012
- C:\Windows\System\CgAsynW.exe
  C:\Windows\System\CgAsynW.exe
  2⤵
  PID:1684
- C:\Windows\System\lsdAYHC.exe
  C:\Windows\System\lsdAYHC.exe
  2⤵
  PID:4444
- C:\Windows\System\NbhdHqf.exe
  C:\Windows\System\NbhdHqf.exe
  2⤵
  PID:5148
- C:\Windows\System\SSCoPIo.exe
  C:\Windows\System\SSCoPIo.exe
  2⤵
  PID:5180
- C:\Windows\System\yQlIQDx.exe
  C:\Windows\System\yQlIQDx.exe
  2⤵
  PID:5204
- C:\Windows\System\mYQDxld.exe
  C:\Windows\System\mYQDxld.exe
  2⤵
  PID:5232
- C:\Windows\System\DVMDIiQ.exe
  C:\Windows\System\DVMDIiQ.exe
  2⤵
  PID:5260
- C:\Windows\System\pxkBhRs.exe
  C:\Windows\System\pxkBhRs.exe
  2⤵
  PID:5288
- C:\Windows\System\DzqWymr.exe
  C:\Windows\System\DzqWymr.exe
  2⤵
  PID:5316
- C:\Windows\System\AbxdEnr.exe
  C:\Windows\System\AbxdEnr.exe
  2⤵
  PID:5340
- C:\Windows\System\TzumXph.exe
  C:\Windows\System\TzumXph.exe
  2⤵
  PID:5372
- C:\Windows\System\jXtInLp.exe
  C:\Windows\System\jXtInLp.exe
  2⤵
  PID:5400
- C:\Windows\System\tFbLSDF.exe
  C:\Windows\System\tFbLSDF.exe
  2⤵
  PID:5428
- C:\Windows\System\UxlRwPv.exe
  C:\Windows\System\UxlRwPv.exe
  2⤵
  PID:5456
- C:\Windows\System\CZugFme.exe
  C:\Windows\System\CZugFme.exe
  2⤵
  PID:5484
- C:\Windows\System\GCOuXxE.exe
  C:\Windows\System\GCOuXxE.exe
  2⤵
  PID:5512
- C:\Windows\System\VGsGqXk.exe
  C:\Windows\System\VGsGqXk.exe
  2⤵
  PID:5540
- C:\Windows\System\nFhGHhv.exe
  C:\Windows\System\nFhGHhv.exe
  2⤵
  PID:5568
- C:\Windows\System\HCQOOHm.exe
  C:\Windows\System\HCQOOHm.exe
  2⤵
  PID:5596
- C:\Windows\System\gNzAZYx.exe
  C:\Windows\System\gNzAZYx.exe
  2⤵
  PID:5624
- C:\Windows\System\yiuWKva.exe
  C:\Windows\System\yiuWKva.exe
  2⤵
  PID:5652
- C:\Windows\System\AuErCfH.exe
  C:\Windows\System\AuErCfH.exe
  2⤵
  PID:5680
- C:\Windows\System\kMZrDSF.exe
  C:\Windows\System\kMZrDSF.exe
  2⤵
  PID:5704
- C:\Windows\System\TicPUsm.exe
  C:\Windows\System\TicPUsm.exe
  2⤵
  PID:5736
- C:\Windows\System\oDYlAdL.exe
  C:\Windows\System\oDYlAdL.exe
  2⤵
  PID:5764
- C:\Windows\System\QiQqRSm.exe
  C:\Windows\System\QiQqRSm.exe
  2⤵
  PID:5792
- C:\Windows\System\mcYcVYn.exe
  C:\Windows\System\mcYcVYn.exe
  2⤵
  PID:5820
- C:\Windows\System\uiHXQSB.exe
  C:\Windows\System\uiHXQSB.exe
  2⤵
  PID:5848
- C:\Windows\System\eaFWDoM.exe
  C:\Windows\System\eaFWDoM.exe
  2⤵
  PID:5876
- C:\Windows\System\vKsDkcN.exe
  C:\Windows\System\vKsDkcN.exe
  2⤵
  PID:5904
- C:\Windows\System\TQTmwAA.exe
  C:\Windows\System\TQTmwAA.exe
  2⤵
  PID:5932
- C:\Windows\System\ECWfZOI.exe
  C:\Windows\System\ECWfZOI.exe
  2⤵
  PID:5956
- C:\Windows\System\lBfhhMA.exe
  C:\Windows\System\lBfhhMA.exe
  2⤵
  PID:6008
- C:\Windows\System\KaowJAp.exe
  C:\Windows\System\KaowJAp.exe
  2⤵
  PID:6028
- C:\Windows\System\WxXSjNx.exe
  C:\Windows\System\WxXSjNx.exe
  2⤵
  PID:6044
- C:\Windows\System\ogZkfMC.exe
  C:\Windows\System\ogZkfMC.exe
  2⤵
  PID:6060
- C:\Windows\System\IToFGsY.exe
  C:\Windows\System\IToFGsY.exe
  2⤵
  PID:6088
- C:\Windows\System\LWbJwEu.exe
  C:\Windows\System\LWbJwEu.exe
  2⤵
  PID:6112
- C:\Windows\System\mXIvKbo.exe
  C:\Windows\System\mXIvKbo.exe
  2⤵
  PID:6140
- C:\Windows\System\yGXXkIW.exe
  C:\Windows\System\yGXXkIW.exe
  2⤵
  PID:4056
- C:\Windows\System\JJlPcmJ.exe
  C:\Windows\System\JJlPcmJ.exe
  2⤵
  PID:4340
- C:\Windows\System\skNbhzl.exe
  C:\Windows\System\skNbhzl.exe
  2⤵
  PID:4648
- C:\Windows\System\TnZmdms.exe
  C:\Windows\System\TnZmdms.exe
  2⤵
  PID:956
- C:\Windows\System\ImuPqDx.exe
  C:\Windows\System\ImuPqDx.exe
  2⤵
  PID:3540
- C:\Windows\System\zxXRCye.exe
  C:\Windows\System\zxXRCye.exe
  2⤵
  PID:5196
- C:\Windows\System\GUJqeJC.exe
  C:\Windows\System\GUJqeJC.exe
  2⤵
  PID:5248
- C:\Windows\System\WmELoTe.exe
  C:\Windows\System\WmELoTe.exe
  2⤵
  PID:5308
- C:\Windows\System\GOsoOrr.exe
  C:\Windows\System\GOsoOrr.exe
  2⤵
  PID:5384
- C:\Windows\System\kolgwdd.exe
  C:\Windows\System\kolgwdd.exe
  2⤵
  PID:5440
- C:\Windows\System\rjYcwoS.exe
  C:\Windows\System\rjYcwoS.exe
  2⤵
  PID:5496
- C:\Windows\System\WQMuvrN.exe
  C:\Windows\System\WQMuvrN.exe
  2⤵
  PID:5556
- C:\Windows\System\PYaIxqD.exe
  C:\Windows\System\PYaIxqD.exe
  2⤵
  PID:5588
- C:\Windows\System\NdyZcGW.exe
  C:\Windows\System\NdyZcGW.exe
  2⤵
  PID:5664
- C:\Windows\System\leMPKZO.exe
  C:\Windows\System\leMPKZO.exe
  2⤵
  PID:5720
- C:\Windows\System\hpUxpcE.exe
  C:\Windows\System\hpUxpcE.exe
  2⤵
  PID:5776
- C:\Windows\System\VPpXfkm.exe
  C:\Windows\System\VPpXfkm.exe
  2⤵
  PID:5836
- C:\Windows\System\lMYMbBn.exe
  C:\Windows\System\lMYMbBn.exe
  2⤵
  PID:380
- C:\Windows\System\dfhLtoq.exe
  C:\Windows\System\dfhLtoq.exe
  2⤵
  PID:4180
- C:\Windows\System\ocHwPSH.exe
  C:\Windows\System\ocHwPSH.exe
  2⤵
  PID:6004
- C:\Windows\System\ahydQfT.exe
  C:\Windows\System\ahydQfT.exe
  2⤵
  PID:6056
- C:\Windows\System\iikqfZB.exe
  C:\Windows\System\iikqfZB.exe
  2⤵
  PID:6104
- C:\Windows\System\dyixRcW.exe
  C:\Windows\System\dyixRcW.exe
  2⤵
  PID:4468
- C:\Windows\System\RnMJkdm.exe
  C:\Windows\System\RnMJkdm.exe
  2⤵
  PID:1544
- C:\Windows\System\CiZnwOJ.exe
  C:\Windows\System\CiZnwOJ.exe
  2⤵
  PID:5164
- C:\Windows\System\LDhKjaq.exe
  C:\Windows\System\LDhKjaq.exe
  2⤵
  PID:2696
- C:\Windows\System\GeylEoV.exe
  C:\Windows\System\GeylEoV.exe
  2⤵
  PID:5420
- C:\Windows\System\lsAvaEf.exe
  C:\Windows\System\lsAvaEf.exe
  2⤵
  PID:5532
- C:\Windows\System\IawclCc.exe
  C:\Windows\System\IawclCc.exe
  2⤵
  PID:5640
- C:\Windows\System\AqZWPdR.exe
  C:\Windows\System\AqZWPdR.exe
  2⤵
  PID:5752
- C:\Windows\System\MxmXeih.exe
  C:\Windows\System\MxmXeih.exe
  2⤵
  PID:5896
- C:\Windows\System\WginJDO.exe
  C:\Windows\System\WginJDO.exe
  2⤵
  PID:5992
- C:\Windows\System\xxBTGzg.exe
  C:\Windows\System\xxBTGzg.exe
  2⤵
  PID:2312
- C:\Windows\System\VHuvkoS.exe
  C:\Windows\System\VHuvkoS.exe
  2⤵
  PID:3828
- C:\Windows\System\wfkUKEQ.exe
  C:\Windows\System\wfkUKEQ.exe
  2⤵
  PID:5092
- C:\Windows\System\utBIISN.exe
  C:\Windows\System\utBIISN.exe
  2⤵
  PID:5472
- C:\Windows\System\PgZLyjM.exe
  C:\Windows\System\PgZLyjM.exe
  2⤵
  PID:5700
- C:\Windows\System\dUXnWHK.exe
  C:\Windows\System\dUXnWHK.exe
  2⤵
  PID:6180
- C:\Windows\System\NiCmOLz.exe
  C:\Windows\System\NiCmOLz.exe
  2⤵
  PID:6208
- C:\Windows\System\yHZYZww.exe
  C:\Windows\System\yHZYZww.exe
  2⤵
  PID:6236
- C:\Windows\System\UykXgrF.exe
  C:\Windows\System\UykXgrF.exe
  2⤵
  PID:6256
- C:\Windows\System\TMYXGrY.exe
  C:\Windows\System\TMYXGrY.exe
  2⤵
  PID:6284
- C:\Windows\System\HBLWmQH.exe
  C:\Windows\System\HBLWmQH.exe
  2⤵
  PID:6312
- C:\Windows\System\Crpppwb.exe
  C:\Windows\System\Crpppwb.exe
  2⤵
  PID:6340
- C:\Windows\System\ykKqgrD.exe
  C:\Windows\System\ykKqgrD.exe
  2⤵
  PID:6368
- C:\Windows\System\foPAGyk.exe
  C:\Windows\System\foPAGyk.exe
  2⤵
  PID:6392
- C:\Windows\System\rVvWAoJ.exe
  C:\Windows\System\rVvWAoJ.exe
  2⤵
  PID:6424
- C:\Windows\System\wjKACee.exe
  C:\Windows\System\wjKACee.exe
  2⤵
  PID:6448
- C:\Windows\System\AYYCaxF.exe
  C:\Windows\System\AYYCaxF.exe
  2⤵
  PID:6476
- C:\Windows\System\SalwjYc.exe
  C:\Windows\System\SalwjYc.exe
  2⤵
  PID:6504
- C:\Windows\System\AREBnRh.exe
  C:\Windows\System\AREBnRh.exe
  2⤵
  PID:6532
- C:\Windows\System\OkFEohu.exe
  C:\Windows\System\OkFEohu.exe
  2⤵
  PID:6560
- C:\Windows\System\NIYnPWC.exe
  C:\Windows\System\NIYnPWC.exe
  2⤵
  PID:6592
- C:\Windows\System\BARouht.exe
  C:\Windows\System\BARouht.exe
  2⤵
  PID:6620
- C:\Windows\System\eREbxrI.exe
  C:\Windows\System\eREbxrI.exe
  2⤵
  PID:6644
- C:\Windows\System\JwlEfqK.exe
  C:\Windows\System\JwlEfqK.exe
  2⤵
  PID:6672
- C:\Windows\System\OUBLryj.exe
  C:\Windows\System\OUBLryj.exe
  2⤵
  PID:6700
- C:\Windows\System\bEHnpUF.exe
  C:\Windows\System\bEHnpUF.exe
  2⤵
  PID:6728
- C:\Windows\System\YTUQmlk.exe
  C:\Windows\System\YTUQmlk.exe
  2⤵
  PID:6756
- C:\Windows\System\GqpRcMx.exe
  C:\Windows\System\GqpRcMx.exe
  2⤵
  PID:6784
- C:\Windows\System\BjZXKZU.exe
  C:\Windows\System\BjZXKZU.exe
  2⤵
  PID:6812
- C:\Windows\System\YigERMN.exe
  C:\Windows\System\YigERMN.exe
  2⤵
  PID:6840
- C:\Windows\System\xuGclYF.exe
  C:\Windows\System\xuGclYF.exe
  2⤵
  PID:6868
- C:\Windows\System\FklfNdS.exe
  C:\Windows\System\FklfNdS.exe
  2⤵
  PID:6900
- C:\Windows\System\WiPQKWm.exe
  C:\Windows\System\WiPQKWm.exe
  2⤵
  PID:6924
- C:\Windows\System\fIevuMn.exe
  C:\Windows\System\fIevuMn.exe
  2⤵
  PID:6952
- C:\Windows\System\fcpEelP.exe
  C:\Windows\System\fcpEelP.exe
  2⤵
  PID:6980
- C:\Windows\System\pLSaHBT.exe
  C:\Windows\System\pLSaHBT.exe
  2⤵
  PID:7012
- C:\Windows\System\arCGvEN.exe
  C:\Windows\System\arCGvEN.exe
  2⤵
  PID:7040
- C:\Windows\System\zLlszGT.exe
  C:\Windows\System\zLlszGT.exe
  2⤵
  PID:7064
- C:\Windows\System\ddmcXvD.exe
  C:\Windows\System\ddmcXvD.exe
  2⤵
  PID:7092
- C:\Windows\System\QZjlIAV.exe
  C:\Windows\System\QZjlIAV.exe
  2⤵
  PID:7120
- C:\Windows\System\aqKuSfp.exe
  C:\Windows\System\aqKuSfp.exe
  2⤵
  PID:7148
- C:\Windows\System\fCZhyHh.exe
  C:\Windows\System\fCZhyHh.exe
  2⤵
  PID:5832
- C:\Windows\System\nHwjhyt.exe
  C:\Windows\System\nHwjhyt.exe
  2⤵
  PID:6080
- C:\Windows\System\XtbOcGX.exe
  C:\Windows\System\XtbOcGX.exe
  2⤵
  PID:3044
- C:\Windows\System\gkLRkfI.exe
  C:\Windows\System\gkLRkfI.exe
  2⤵
  PID:1320
- C:\Windows\System\lgzdHMu.exe
  C:\Windows\System\lgzdHMu.exe
  2⤵
  PID:6176
- C:\Windows\System\bgxYERc.exe
  C:\Windows\System\bgxYERc.exe
  2⤵
  PID:6228
- C:\Windows\System\dPzihkQ.exe
  C:\Windows\System\dPzihkQ.exe
  2⤵
  PID:6276
- C:\Windows\System\HffdfBd.exe
  C:\Windows\System\HffdfBd.exe
  2⤵
  PID:6328
- C:\Windows\System\jBPevzn.exe
  C:\Windows\System\jBPevzn.exe
  2⤵
  PID:2844
- C:\Windows\System\AjikKkL.exe
  C:\Windows\System\AjikKkL.exe
  2⤵
  PID:3960
- C:\Windows\System\vqumKmg.exe
  C:\Windows\System\vqumKmg.exe
  2⤵
  PID:4656
- C:\Windows\System\DDjhivZ.exe
  C:\Windows\System\DDjhivZ.exe
  2⤵
  PID:4836
- C:\Windows\System\GXbcgem.exe
  C:\Windows\System\GXbcgem.exe
  2⤵
  PID:760
- C:\Windows\System\JZeScoP.exe
  C:\Windows\System\JZeScoP.exe
  2⤵
  PID:6584
- C:\Windows\System\JEvxGVC.exe
  C:\Windows\System\JEvxGVC.exe
  2⤵
  PID:6604
- C:\Windows\System\KdxhxgO.exe
  C:\Windows\System\KdxhxgO.exe
  2⤵
  PID:6636
- C:\Windows\System\ZOJgGUA.exe
  C:\Windows\System\ZOJgGUA.exe
  2⤵
  PID:6688
- C:\Windows\System\HqZFTZn.exe
  C:\Windows\System\HqZFTZn.exe
  2⤵
  PID:6720
- C:\Windows\System\ncjzaUk.exe
  C:\Windows\System\ncjzaUk.exe
  2⤵
  PID:6780
- C:\Windows\System\AOpVQGt.exe
  C:\Windows\System\AOpVQGt.exe
  2⤵
  PID:6832
- C:\Windows\System\iPBnpjh.exe
  C:\Windows\System\iPBnpjh.exe
  2⤵
  PID:6884
- C:\Windows\System\FjjtkFD.exe
  C:\Windows\System\FjjtkFD.exe
  2⤵
  PID:6920
- C:\Windows\System\hYWmlco.exe
  C:\Windows\System\hYWmlco.exe
  2⤵
  PID:6972
- C:\Windows\System\WsnwpFD.exe
  C:\Windows\System\WsnwpFD.exe
  2⤵
  PID:7024
- C:\Windows\System\OktJqQP.exe
  C:\Windows\System\OktJqQP.exe
  2⤵
  PID:7060
- C:\Windows\System\pZROKEk.exe
  C:\Windows\System\pZROKEk.exe
  2⤵
  PID:7116
- C:\Windows\System\IbYOGQW.exe
  C:\Windows\System\IbYOGQW.exe
  2⤵
  PID:7164
- C:\Windows\System\RwWLeRw.exe
  C:\Windows\System\RwWLeRw.exe
  2⤵
  PID:2852
- C:\Windows\System\WZZJlfq.exe
  C:\Windows\System\WZZJlfq.exe
  2⤵
  PID:3904
- C:\Windows\System\ZiLBdKF.exe
  C:\Windows\System\ZiLBdKF.exe
  2⤵
  PID:6160
- C:\Windows\System\LsFAofG.exe
  C:\Windows\System\LsFAofG.exe
  2⤵
  PID:6224
- C:\Windows\System\avnfPBd.exe
  C:\Windows\System\avnfPBd.exe
  2⤵
  PID:6300
- C:\Windows\System\XWzhWCV.exe
  C:\Windows\System\XWzhWCV.exe
  2⤵
  PID:6356
- C:\Windows\System\ocShgai.exe
  C:\Windows\System\ocShgai.exe
  2⤵
  PID:4204
- C:\Windows\System\QtsFlYB.exe
  C:\Windows\System\QtsFlYB.exe
  2⤵
  PID:6468
- C:\Windows\System\CuNOMoi.exe
  C:\Windows\System\CuNOMoi.exe
  2⤵
  PID:4776
- C:\Windows\System\eXxJsbd.exe
  C:\Windows\System\eXxJsbd.exe
  2⤵
  PID:5084
- C:\Windows\System\lxCWzEm.exe
  C:\Windows\System\lxCWzEm.exe
  2⤵
  PID:6408
- C:\Windows\System\JEERLiz.exe
  C:\Windows\System\JEERLiz.exe
  2⤵
  PID:3096
- C:\Windows\System\SrcAMvP.exe
  C:\Windows\System\SrcAMvP.exe
  2⤵
  PID:4140
- C:\Windows\System\cVGNTlA.exe
  C:\Windows\System\cVGNTlA.exe
  2⤵
  PID:3696
- C:\Windows\System\RmWLIPk.exe
  C:\Windows\System\RmWLIPk.exe
  2⤵
  PID:6828
- C:\Windows\System\JgSdqkW.exe
  C:\Windows\System\JgSdqkW.exe
  2⤵
  PID:7052
- C:\Windows\System\YmSQbXA.exe
  C:\Windows\System\YmSQbXA.exe
  2⤵
  PID:4592
- C:\Windows\System\lkcJIrv.exe
  C:\Windows\System\lkcJIrv.exe
  2⤵
  PID:2600
- C:\Windows\System\fdItyjF.exe
  C:\Windows\System\fdItyjF.exe
  2⤵
  PID:6804
- C:\Windows\System\pGMtBRf.exe
  C:\Windows\System\pGMtBRf.exe
  2⤵
  PID:6304
- C:\Windows\System\tpBKPyN.exe
  C:\Windows\System\tpBKPyN.exe
  2⤵
  PID:1944
- C:\Windows\System\DbXytSj.exe
  C:\Windows\System\DbXytSj.exe
  2⤵
  PID:7180
- C:\Windows\System\JeRMqaq.exe
  C:\Windows\System\JeRMqaq.exe
  2⤵
  PID:7200
- C:\Windows\System\uLQlaCD.exe
  C:\Windows\System\uLQlaCD.exe
  2⤵
  PID:7232
- C:\Windows\System\kdsbRFM.exe
  C:\Windows\System\kdsbRFM.exe
  2⤵
  PID:7248
- C:\Windows\System\pMVnyUn.exe
  C:\Windows\System\pMVnyUn.exe
  2⤵
  PID:7300
- C:\Windows\System\BKBAzay.exe
  C:\Windows\System\BKBAzay.exe
  2⤵
  PID:7328
- C:\Windows\System\VksqBSv.exe
  C:\Windows\System\VksqBSv.exe
  2⤵
  PID:7352
- C:\Windows\System\HDIpHNV.exe
  C:\Windows\System\HDIpHNV.exe
  2⤵
  PID:7376
- C:\Windows\System\bfzTtfu.exe
  C:\Windows\System\bfzTtfu.exe
  2⤵
  PID:7396
- C:\Windows\System\mrSMVwW.exe
  C:\Windows\System\mrSMVwW.exe
  2⤵
  PID:7444
- C:\Windows\System\OgfQVTz.exe
  C:\Windows\System\OgfQVTz.exe
  2⤵
  PID:7464
- C:\Windows\System\KIDKtHK.exe
  C:\Windows\System\KIDKtHK.exe
  2⤵
  PID:7484
- C:\Windows\System\wnqePOf.exe
  C:\Windows\System\wnqePOf.exe
  2⤵
  PID:7516
- C:\Windows\System\iWCXpjO.exe
  C:\Windows\System\iWCXpjO.exe
  2⤵
  PID:7564
- C:\Windows\System\UTkqWNp.exe
  C:\Windows\System\UTkqWNp.exe
  2⤵
  PID:7584
- C:\Windows\System\TAGMpPP.exe
  C:\Windows\System\TAGMpPP.exe
  2⤵
  PID:7612
- C:\Windows\System\xMcjgaz.exe
  C:\Windows\System\xMcjgaz.exe
  2⤵
  PID:7664
- C:\Windows\System\oIOWAYk.exe
  C:\Windows\System\oIOWAYk.exe
  2⤵
  PID:7716
- C:\Windows\System\WvbzHba.exe
  C:\Windows\System\WvbzHba.exe
  2⤵
  PID:7740
- C:\Windows\System\UFcXAAi.exe
  C:\Windows\System\UFcXAAi.exe
  2⤵
  PID:7760
- C:\Windows\System\uhaXliN.exe
  C:\Windows\System\uhaXliN.exe
  2⤵
  PID:7780
- C:\Windows\System\EKubssP.exe
  C:\Windows\System\EKubssP.exe
  2⤵
  PID:7820
- C:\Windows\System\OjMBLYN.exe
  C:\Windows\System\OjMBLYN.exe
  2⤵
  PID:7840
- C:\Windows\System\BCnHdyD.exe
  C:\Windows\System\BCnHdyD.exe
  2⤵
  PID:7920
- C:\Windows\System\wqCpDat.exe
  C:\Windows\System\wqCpDat.exe
  2⤵
  PID:7940
- C:\Windows\System\vCJXCFr.exe
  C:\Windows\System\vCJXCFr.exe
  2⤵
  PID:7972
- C:\Windows\System\YBdCJYT.exe
  C:\Windows\System\YBdCJYT.exe
  2⤵
  PID:7992
- C:\Windows\System\Ttkfwqv.exe
  C:\Windows\System\Ttkfwqv.exe
  2⤵
  PID:8024
- C:\Windows\System\OCUovkj.exe
  C:\Windows\System\OCUovkj.exe
  2⤵
  PID:8048
- C:\Windows\System\YdFMQtB.exe
  C:\Windows\System\YdFMQtB.exe
  2⤵
  PID:8068
- C:\Windows\System\THzATmB.exe
  C:\Windows\System\THzATmB.exe
  2⤵
  PID:8108
- C:\Windows\System\fPqyQCS.exe
  C:\Windows\System\fPqyQCS.exe
  2⤵
  PID:8144
- C:\Windows\System\rNZwwrn.exe
  C:\Windows\System\rNZwwrn.exe
  2⤵
  PID:8164
- C:\Windows\System\WMlkojp.exe
  C:\Windows\System\WMlkojp.exe
  2⤵
  PID:8188
- C:\Windows\System\UdVvOWi.exe
  C:\Windows\System\UdVvOWi.exe
  2⤵
  PID:6324
- C:\Windows\System\OrlQPFP.exe
  C:\Windows\System\OrlQPFP.exe
  2⤵
  PID:6156
- C:\Windows\System\lhYctdE.exe
  C:\Windows\System\lhYctdE.exe
  2⤵
  PID:2768
- C:\Windows\System\kpTwLqi.exe
  C:\Windows\System\kpTwLqi.exe
  2⤵
  PID:7176
- C:\Windows\System\erMxHOh.exe
  C:\Windows\System\erMxHOh.exe
  2⤵
  PID:7216
- C:\Windows\System\LFYcfAH.exe
  C:\Windows\System\LFYcfAH.exe
  2⤵
  PID:7408
- C:\Windows\System\iRoFBbd.exe
  C:\Windows\System\iRoFBbd.exe
  2⤵
  PID:7496
- C:\Windows\System\qpUsUVR.exe
  C:\Windows\System\qpUsUVR.exe
  2⤵
  PID:7388
- C:\Windows\System\gJfWQFR.exe
  C:\Windows\System\gJfWQFR.exe
  2⤵
  PID:7432
- C:\Windows\System\iFVnChS.exe
  C:\Windows\System\iFVnChS.exe
  2⤵
  PID:7708
- C:\Windows\System\PFweKYO.exe
  C:\Windows\System\PFweKYO.exe
  2⤵
  PID:7732
- C:\Windows\System\gDPMBDh.exe
  C:\Windows\System\gDPMBDh.exe
  2⤵
  PID:7756
- C:\Windows\System\RnCOqeL.exe
  C:\Windows\System\RnCOqeL.exe
  2⤵
  PID:7804
- C:\Windows\System\tOzBVXB.exe
  C:\Windows\System\tOzBVXB.exe
  2⤵
  PID:7852
- C:\Windows\System\vUusrfo.exe
  C:\Windows\System\vUusrfo.exe
  2⤵
  PID:7916
- C:\Windows\System\RsfKFlF.exe
  C:\Windows\System\RsfKFlF.exe
  2⤵
  PID:7956
- C:\Windows\System\IrbnGeF.exe
  C:\Windows\System\IrbnGeF.exe
  2⤵
  PID:8044
- C:\Windows\System\ylEGVfb.exe
  C:\Windows\System\ylEGVfb.exe
  2⤵
  PID:8088
- C:\Windows\System\NllxJXq.exe
  C:\Windows\System\NllxJXq.exe
  2⤵
  PID:8160
- C:\Windows\System\RFwzTpT.exe
  C:\Windows\System\RFwzTpT.exe
  2⤵
  PID:4200
- C:\Windows\System\ODUoSPD.exe
  C:\Windows\System\ODUoSPD.exe
  2⤵
  PID:7192
- C:\Windows\System\skLhDsZ.exe
  C:\Windows\System\skLhDsZ.exe
  2⤵
  PID:7364
- C:\Windows\System\EgKrvwM.exe
  C:\Windows\System\EgKrvwM.exe
  2⤵
  PID:7556
- C:\Windows\System\jGqQrKa.exe
  C:\Windows\System\jGqQrKa.exe
  2⤵
  PID:7768
- C:\Windows\System\CYOzyxv.exe
  C:\Windows\System\CYOzyxv.exe
  2⤵
  PID:7872
- C:\Windows\System\cHaOrbP.exe
  C:\Windows\System\cHaOrbP.exe
  2⤵
  PID:7932
- C:\Windows\System\GqjdJEk.exe
  C:\Windows\System\GqjdJEk.exe
  2⤵
  PID:7172
- C:\Windows\System\IJvEUiw.exe
  C:\Windows\System\IJvEUiw.exe
  2⤵
  PID:7384
- C:\Windows\System\YGBGRkQ.exe
  C:\Windows\System\YGBGRkQ.exe
  2⤵
  PID:7928
- C:\Windows\System\gIvlxPv.exe
  C:\Windows\System\gIvlxPv.exe
  2⤵
  PID:7912
- C:\Windows\System\xijuOGM.exe
  C:\Windows\System\xijuOGM.exe
  2⤵
  PID:8136
- C:\Windows\System\YzEfEsY.exe
  C:\Windows\System\YzEfEsY.exe
  2⤵
  PID:8224
- C:\Windows\System\cQmaVRO.exe
  C:\Windows\System\cQmaVRO.exe
  2⤵
  PID:8252
- C:\Windows\System\OAWoATq.exe
  C:\Windows\System\OAWoATq.exe
  2⤵
  PID:8300
- C:\Windows\System\uvYFCRH.exe
  C:\Windows\System\uvYFCRH.exe
  2⤵
  PID:8320
- C:\Windows\System\AKzpSew.exe
  C:\Windows\System\AKzpSew.exe
  2⤵
  PID:8344
- C:\Windows\System\epdMpws.exe
  C:\Windows\System\epdMpws.exe
  2⤵
  PID:8364
- C:\Windows\System\JTvJOTY.exe
  C:\Windows\System\JTvJOTY.exe
  2⤵
  PID:8412
- C:\Windows\System\OOXqMoQ.exe
  C:\Windows\System\OOXqMoQ.exe
  2⤵
  PID:8432
- C:\Windows\System\mwFDLTM.exe
  C:\Windows\System\mwFDLTM.exe
  2⤵
  PID:8472
- C:\Windows\System\qkMiLXB.exe
  C:\Windows\System\qkMiLXB.exe
  2⤵
  PID:8488
- C:\Windows\System\oJqPcUZ.exe
  C:\Windows\System\oJqPcUZ.exe
  2⤵
  PID:8512
- C:\Windows\System\WGsHhTz.exe
  C:\Windows\System\WGsHhTz.exe
  2⤵
  PID:8536
- C:\Windows\System\aainrRu.exe
  C:\Windows\System\aainrRu.exe
  2⤵
  PID:8580
- C:\Windows\System\QzrPrZs.exe
  C:\Windows\System\QzrPrZs.exe
  2⤵
  PID:8624
- C:\Windows\System\NkbArDR.exe
  C:\Windows\System\NkbArDR.exe
  2⤵
  PID:8648
- C:\Windows\System\RTWDrgr.exe
  C:\Windows\System\RTWDrgr.exe
  2⤵
  PID:8668
- C:\Windows\System\uQSnuHj.exe
  C:\Windows\System\uQSnuHj.exe
  2⤵
  PID:8696
- C:\Windows\System\ECSJmCL.exe
  C:\Windows\System\ECSJmCL.exe
  2⤵
  PID:8720
- C:\Windows\System\TKQyVua.exe
  C:\Windows\System\TKQyVua.exe
  2⤵
  PID:8764
- C:\Windows\System\ccXNFIs.exe
  C:\Windows\System\ccXNFIs.exe
  2⤵
  PID:8780
- C:\Windows\System\bAKiooD.exe
  C:\Windows\System\bAKiooD.exe
  2⤵
  PID:8804
- C:\Windows\System\kZzEAls.exe
  C:\Windows\System\kZzEAls.exe
  2⤵
  PID:8824
- C:\Windows\System\PugDKUZ.exe
  C:\Windows\System\PugDKUZ.exe
  2⤵
  PID:8852
- C:\Windows\System\kjgxDEl.exe
  C:\Windows\System\kjgxDEl.exe
  2⤵
  PID:8880
- C:\Windows\System\TbmKRuf.exe
  C:\Windows\System\TbmKRuf.exe
  2⤵
  PID:8900
- C:\Windows\System\RHHbFQv.exe
  C:\Windows\System\RHHbFQv.exe
  2⤵
  PID:8924
- C:\Windows\System\FypVCvI.exe
  C:\Windows\System\FypVCvI.exe
  2⤵
  PID:8944
- C:\Windows\System\rjOkRhg.exe
  C:\Windows\System\rjOkRhg.exe
  2⤵
  PID:8968
- C:\Windows\System\adcwkxY.exe
  C:\Windows\System\adcwkxY.exe
  2⤵
  PID:9012
- C:\Windows\System\RIZSuLw.exe
  C:\Windows\System\RIZSuLw.exe
  2⤵
  PID:9028
- C:\Windows\System\QbpmagJ.exe
  C:\Windows\System\QbpmagJ.exe
  2⤵
  PID:9064
- C:\Windows\System\DEZBUwk.exe
  C:\Windows\System\DEZBUwk.exe
  2⤵
  PID:9092
- C:\Windows\System\EkrTjBL.exe
  C:\Windows\System\EkrTjBL.exe
  2⤵
  PID:9108
- C:\Windows\System\nbrtnOP.exe
  C:\Windows\System\nbrtnOP.exe
  2⤵
  PID:9136
- C:\Windows\System\rAqXHmM.exe
  C:\Windows\System\rAqXHmM.exe
  2⤵
  PID:9160
- C:\Windows\System\hysTQLi.exe
  C:\Windows\System\hysTQLi.exe
  2⤵
  PID:8124
- C:\Windows\System\XbYXiZj.exe
  C:\Windows\System\XbYXiZj.exe
  2⤵
  PID:7832
- C:\Windows\System\vXbirbS.exe
  C:\Windows\System\vXbirbS.exe
  2⤵
  PID:8216
- C:\Windows\System\xMNXcmS.exe
  C:\Windows\System\xMNXcmS.exe
  2⤵
  PID:8328
- C:\Windows\System\QCqZhnJ.exe
  C:\Windows\System\QCqZhnJ.exe
  2⤵
  PID:8356
- C:\Windows\System\obUIpaZ.exe
  C:\Windows\System\obUIpaZ.exe
  2⤵
  PID:8428
- C:\Windows\System\TshvnIO.exe
  C:\Windows\System\TshvnIO.exe
  2⤵
  PID:8524
- C:\Windows\System\OCtpvYq.exe
  C:\Windows\System\OCtpvYq.exe
  2⤵
  PID:8556
- C:\Windows\System\duFPNMq.exe
  C:\Windows\System\duFPNMq.exe
  2⤵
  PID:8644
- C:\Windows\System\hcntCLK.exe
  C:\Windows\System\hcntCLK.exe
  2⤵
  PID:8748
- C:\Windows\System\HLuAWoU.exe
  C:\Windows\System\HLuAWoU.exe
  2⤵
  PID:8800
- C:\Windows\System\tDlHqSo.exe
  C:\Windows\System\tDlHqSo.exe
  2⤵
  PID:8840
- C:\Windows\System\cvAcVyJ.exe
  C:\Windows\System\cvAcVyJ.exe
  2⤵
  PID:8868
- C:\Windows\System\nLWUILM.exe
  C:\Windows\System\nLWUILM.exe
  2⤵
  PID:9036
- C:\Windows\System\vGGePyX.exe
  C:\Windows\System\vGGePyX.exe
  2⤵
  PID:9020
- C:\Windows\System\IweYOsm.exe
  C:\Windows\System\IweYOsm.exe
  2⤵
  PID:9188
- C:\Windows\System\VlCklvC.exe
  C:\Windows\System\VlCklvC.exe
  2⤵
  PID:9208
- C:\Windows\System\sFndbRH.exe
  C:\Windows\System\sFndbRH.exe
  2⤵
  PID:8244
- C:\Windows\System\MpmWNXy.exe
  C:\Windows\System\MpmWNXy.exe
  2⤵
  PID:8504
- C:\Windows\System\bYPxSGf.exe
  C:\Windows\System\bYPxSGf.exe
  2⤵
  PID:8636
- C:\Windows\System\DXPhwdb.exe
  C:\Windows\System\DXPhwdb.exe
  2⤵
  PID:8704
- C:\Windows\System\NckYZxA.exe
  C:\Windows\System\NckYZxA.exe
  2⤵
  PID:8892
- C:\Windows\System\VpzGKxC.exe
  C:\Windows\System\VpzGKxC.exe
  2⤵
  PID:9084
- C:\Windows\System\kyXxcpQ.exe
  C:\Windows\System\kyXxcpQ.exe
  2⤵
  PID:8204
- C:\Windows\System\rmFBoKN.exe
  C:\Windows\System\rmFBoKN.exe
  2⤵
  PID:8444
- C:\Windows\System\CBWwvCl.exe
  C:\Windows\System\CBWwvCl.exe
  2⤵
  PID:8860
- C:\Windows\System\NJIBMrt.exe
  C:\Windows\System\NJIBMrt.exe
  2⤵
  PID:9060
- C:\Windows\System\gJLPTLA.exe
  C:\Windows\System\gJLPTLA.exe
  2⤵
  PID:8776
- C:\Windows\System\rCrXARd.exe
  C:\Windows\System\rCrXARd.exe
  2⤵
  PID:9228
- C:\Windows\System\DPNgFBC.exe
  C:\Windows\System\DPNgFBC.exe
  2⤵
  PID:9284
- C:\Windows\System\JtcAlmH.exe
  C:\Windows\System\JtcAlmH.exe
  2⤵
  PID:9312
- C:\Windows\System\XjMiAap.exe
  C:\Windows\System\XjMiAap.exe
  2⤵
  PID:9332
- C:\Windows\System\otpCgJY.exe
  C:\Windows\System\otpCgJY.exe
  2⤵
  PID:9356
- C:\Windows\System\lSZzGcs.exe
  C:\Windows\System\lSZzGcs.exe
  2⤵
  PID:9400
- C:\Windows\System\TtDxntJ.exe
  C:\Windows\System\TtDxntJ.exe
  2⤵
  PID:9416
- C:\Windows\System\nBPgwmP.exe
  C:\Windows\System\nBPgwmP.exe
  2⤵
  PID:9440
- C:\Windows\System\ndvFUQC.exe
  C:\Windows\System\ndvFUQC.exe
  2⤵
  PID:9464
- C:\Windows\System\KgqNnKi.exe
  C:\Windows\System\KgqNnKi.exe
  2⤵
  PID:9488
- C:\Windows\System\sIUxapY.exe
  C:\Windows\System\sIUxapY.exe
  2⤵
  PID:9512
- C:\Windows\System\ZeWSrbC.exe
  C:\Windows\System\ZeWSrbC.exe
  2⤵
  PID:9532
- C:\Windows\System\YOwLGAb.exe
  C:\Windows\System\YOwLGAb.exe
  2⤵
  PID:9568
- C:\Windows\System\JzyxmRM.exe
  C:\Windows\System\JzyxmRM.exe
  2⤵
  PID:9596
- C:\Windows\System\gdziqen.exe
  C:\Windows\System\gdziqen.exe
  2⤵
  PID:9652
- C:\Windows\System\bvGYbLr.exe
  C:\Windows\System\bvGYbLr.exe
  2⤵
  PID:9676
- C:\Windows\System\cphvrYI.exe
  C:\Windows\System\cphvrYI.exe
  2⤵
  PID:9692
- C:\Windows\System\wingHui.exe
  C:\Windows\System\wingHui.exe
  2⤵
  PID:9716
- C:\Windows\System\AEtddnR.exe
  C:\Windows\System\AEtddnR.exe
  2⤵
  PID:9736
- C:\Windows\System\UOcDLef.exe
  C:\Windows\System\UOcDLef.exe
  2⤵
  PID:9760
- C:\Windows\System\WFZKdDy.exe
  C:\Windows\System\WFZKdDy.exe
  2⤵
  PID:9780
- C:\Windows\System\CGWroHa.exe
  C:\Windows\System\CGWroHa.exe
  2⤵
  PID:9804
- C:\Windows\System\OOIyoes.exe
  C:\Windows\System\OOIyoes.exe
  2⤵
  PID:9856
- C:\Windows\System\LhrfauP.exe
  C:\Windows\System\LhrfauP.exe
  2⤵
  PID:9876
- C:\Windows\System\SgizYMG.exe
  C:\Windows\System\SgizYMG.exe
  2⤵
  PID:9904
- C:\Windows\System\QNAUSHD.exe
  C:\Windows\System\QNAUSHD.exe
  2⤵
  PID:9928
- C:\Windows\System\UNxslfp.exe
  C:\Windows\System\UNxslfp.exe
  2⤵
  PID:9960
- C:\Windows\System\eJVBKBS.exe
  C:\Windows\System\eJVBKBS.exe
  2⤵
  PID:9984
- C:\Windows\System\luaDezp.exe
  C:\Windows\System\luaDezp.exe
  2⤵
  PID:10016
- C:\Windows\System\KJDcNjF.exe
  C:\Windows\System\KJDcNjF.exe
  2⤵
  PID:10044
- C:\Windows\System\wkIvhcT.exe
  C:\Windows\System\wkIvhcT.exe
  2⤵
  PID:10064
- C:\Windows\System\zhNKbvQ.exe
  C:\Windows\System\zhNKbvQ.exe
  2⤵
  PID:10092
- C:\Windows\System\SooaYAv.exe
  C:\Windows\System\SooaYAv.exe
  2⤵
  PID:10112
- C:\Windows\System\cCLQCWQ.exe
  C:\Windows\System\cCLQCWQ.exe
  2⤵
  PID:10148
- C:\Windows\System\VMVfpdJ.exe
  C:\Windows\System\VMVfpdJ.exe
  2⤵
  PID:10172
- C:\Windows\System\vdiEEBK.exe
  C:\Windows\System\vdiEEBK.exe
  2⤵
  PID:10196
- C:\Windows\System\FAliGqE.exe
  C:\Windows\System\FAliGqE.exe
  2⤵
  PID:10232
- C:\Windows\System\XuwouOm.exe
  C:\Windows\System\XuwouOm.exe
  2⤵
  PID:9224
- C:\Windows\System\gykXmNm.exe
  C:\Windows\System\gykXmNm.exe
  2⤵
  PID:9300
- C:\Windows\System\fhNWDVQ.exe
  C:\Windows\System\fhNWDVQ.exe
  2⤵
  PID:9380
- C:\Windows\System\ADobNCH.exe
  C:\Windows\System\ADobNCH.exe
  2⤵
  PID:9472
- C:\Windows\System\bjtkhzM.exe
  C:\Windows\System\bjtkhzM.exe
  2⤵
  PID:9508
- C:\Windows\System\tSLpGhw.exe
  C:\Windows\System\tSLpGhw.exe
  2⤵
  PID:8532
- C:\Windows\System\dTkcIIg.exe
  C:\Windows\System\dTkcIIg.exe
  2⤵
  PID:9644
- C:\Windows\System\IuUbAhS.exe
  C:\Windows\System\IuUbAhS.exe
  2⤵
  PID:9768
- C:\Windows\System\BBHzvgE.exe
  C:\Windows\System\BBHzvgE.exe
  2⤵
  PID:9816
- C:\Windows\System\KCetJHk.exe
  C:\Windows\System\KCetJHk.exe
  2⤵
  PID:9868
- C:\Windows\System\tftkxME.exe
  C:\Windows\System\tftkxME.exe
  2⤵
  PID:9916
- C:\Windows\System\dRvtrjf.exe
  C:\Windows\System\dRvtrjf.exe
  2⤵
  PID:9936
- C:\Windows\System\SAOgKKW.exe
  C:\Windows\System\SAOgKKW.exe
  2⤵
  PID:10060
- C:\Windows\System\pgJCRMm.exe
  C:\Windows\System\pgJCRMm.exe
  2⤵
  PID:10104
- C:\Windows\System\sqcPooK.exe
  C:\Windows\System\sqcPooK.exe
  2⤵
  PID:10204
- C:\Windows\System\KzdPIke.exe
  C:\Windows\System\KzdPIke.exe
  2⤵
  PID:9348
- C:\Windows\System\BVcsQjc.exe
  C:\Windows\System\BVcsQjc.exe
  2⤵
  PID:9504
- C:\Windows\System\fQtgRgR.exe
  C:\Windows\System\fQtgRgR.exe
  2⤵
  PID:9484
- C:\Windows\System\jhlgWXI.exe
  C:\Windows\System\jhlgWXI.exe
  2⤵
  PID:9672
- C:\Windows\System\QOqVtwH.exe
  C:\Windows\System\QOqVtwH.exe
  2⤵
  PID:9832
- C:\Windows\System\UvHwJYt.exe
  C:\Windows\System\UvHwJYt.exe
  2⤵
  PID:9840
- C:\Windows\System\YpaCmOT.exe
  C:\Windows\System\YpaCmOT.exe
  2⤵
  PID:10108
- C:\Windows\System\icXNaxH.exe
  C:\Windows\System\icXNaxH.exe
  2⤵
  PID:10164
- C:\Windows\System\NcMzCoJ.exe
  C:\Windows\System\NcMzCoJ.exe
  2⤵
  PID:8220
- C:\Windows\System\wdYNmxv.exe
  C:\Windows\System\wdYNmxv.exe
  2⤵
  PID:9700
- C:\Windows\System\WVMkFiS.exe
  C:\Windows\System\WVMkFiS.exe
  2⤵
  PID:9296
- C:\Windows\System\YkMzPTV.exe
  C:\Windows\System\YkMzPTV.exe
  2⤵
  PID:10248
- C:\Windows\System\LpqWuix.exe
  C:\Windows\System\LpqWuix.exe
  2⤵
  PID:10276
- C:\Windows\System\PQUFJTf.exe
  C:\Windows\System\PQUFJTf.exe
  2⤵
  PID:10296
- C:\Windows\System\grBfRWa.exe
  C:\Windows\System\grBfRWa.exe
  2⤵
  PID:10320
- C:\Windows\System\aSGFJoO.exe
  C:\Windows\System\aSGFJoO.exe
  2⤵
  PID:10420
- C:\Windows\System\rYQWhqA.exe
  C:\Windows\System\rYQWhqA.exe
  2⤵
  PID:10440
- C:\Windows\System\RSDbiYG.exe
  C:\Windows\System\RSDbiYG.exe
  2⤵
  PID:10456
- C:\Windows\System\VfuFzXp.exe
  C:\Windows\System\VfuFzXp.exe
  2⤵
  PID:10544
- C:\Windows\System\GhlKNkl.exe
  C:\Windows\System\GhlKNkl.exe
  2⤵
  PID:10636
- C:\Windows\System\DUHtZqH.exe
  C:\Windows\System\DUHtZqH.exe
  2⤵
  PID:10660
- C:\Windows\System\rFdentn.exe
  C:\Windows\System\rFdentn.exe
  2⤵
  PID:10676
- C:\Windows\System\xdDaGBK.exe
  C:\Windows\System\xdDaGBK.exe
  2⤵
  PID:10692
- C:\Windows\System\lPplOJE.exe
  C:\Windows\System\lPplOJE.exe
  2⤵
  PID:10708
- C:\Windows\System\fhxOKoq.exe
  C:\Windows\System\fhxOKoq.exe
  2⤵
  PID:10732
- C:\Windows\System\SEFfZvH.exe
  C:\Windows\System\SEFfZvH.exe
  2⤵
  PID:10776
- C:\Windows\System\BYssBrJ.exe
  C:\Windows\System\BYssBrJ.exe
  2⤵
  PID:10832
- C:\Windows\System\NMLeNcY.exe
  C:\Windows\System\NMLeNcY.exe
  2⤵
  PID:10860
- C:\Windows\System\GTHVgzb.exe
  C:\Windows\System\GTHVgzb.exe
  2⤵
  PID:10892
- C:\Windows\System\jVGbiEM.exe
  C:\Windows\System\jVGbiEM.exe
  2⤵
  PID:10916
- C:\Windows\System\vevtVyR.exe
  C:\Windows\System\vevtVyR.exe
  2⤵
  PID:10940
- C:\Windows\System\wzgoNxf.exe
  C:\Windows\System\wzgoNxf.exe
  2⤵
  PID:10960
- C:\Windows\System\EMRCSxc.exe
  C:\Windows\System\EMRCSxc.exe
  2⤵
  PID:11000
- C:\Windows\System\iwqFqMm.exe
  C:\Windows\System\iwqFqMm.exe
  2⤵
  PID:11016
- C:\Windows\System\FIOvyrL.exe
  C:\Windows\System\FIOvyrL.exe
  2⤵
  PID:11040
- C:\Windows\System\jRgVIbk.exe
  C:\Windows\System\jRgVIbk.exe
  2⤵
  PID:11080
- C:\Windows\System\XFkZGHJ.exe
  C:\Windows\System\XFkZGHJ.exe
  2⤵
  PID:11096
- C:\Windows\System\lOQcyYe.exe
  C:\Windows\System\lOQcyYe.exe
  2⤵
  PID:11132
- C:\Windows\System\ZQrTWrc.exe
  C:\Windows\System\ZQrTWrc.exe
  2⤵
  PID:11152
- C:\Windows\System\ZHdKFWp.exe
  C:\Windows\System\ZHdKFWp.exe
  2⤵
  PID:11184
- C:\Windows\System\DXslVFl.exe
  C:\Windows\System\DXslVFl.exe
  2⤵
  PID:11220
- C:\Windows\System\lZtOiiE.exe
  C:\Windows\System\lZtOiiE.exe
  2⤵
  PID:11244
- C:\Windows\System\PtJPBBF.exe
  C:\Windows\System\PtJPBBF.exe
  2⤵
  PID:9220
- C:\Windows\System\JpfwaVD.exe
  C:\Windows\System\JpfwaVD.exe
  2⤵
  PID:10288
- C:\Windows\System\znvJYqn.exe
  C:\Windows\System\znvJYqn.exe
  2⤵
  PID:10404
- C:\Windows\System\crEVGQl.exe
  C:\Windows\System\crEVGQl.exe
  2⤵
  PID:10436
- C:\Windows\System\axGTzqw.exe
  C:\Windows\System\axGTzqw.exe
  2⤵
  PID:10488
- C:\Windows\System\KOBaNyV.exe
  C:\Windows\System\KOBaNyV.exe
  2⤵
  PID:10508
- C:\Windows\System\KdxTaIG.exe
  C:\Windows\System\KdxTaIG.exe
  2⤵
  PID:10448
- C:\Windows\System\DgHeKui.exe
  C:\Windows\System\DgHeKui.exe
  2⤵
  PID:10588
- C:\Windows\System\ynSbojy.exe
  C:\Windows\System\ynSbojy.exe
  2⤵
  PID:10620
- C:\Windows\System\LgezRUe.exe
  C:\Windows\System\LgezRUe.exe
  2⤵
  PID:10624
- C:\Windows\System\YFpeyXK.exe
  C:\Windows\System\YFpeyXK.exe
  2⤵
  PID:10668
- C:\Windows\System\WVZaUkj.exe
  C:\Windows\System\WVZaUkj.exe
  2⤵
  PID:10672
- C:\Windows\System\lZkQWoY.exe
  C:\Windows\System\lZkQWoY.exe
  2⤵
  PID:10792
- C:\Windows\System\aZbVKSf.exe
  C:\Windows\System\aZbVKSf.exe
  2⤵
  PID:10844
- C:\Windows\System\vQsGUCl.exe
  C:\Windows\System\vQsGUCl.exe
  2⤵
  PID:10876
- C:\Windows\System\jCqmwvk.exe
  C:\Windows\System\jCqmwvk.exe
  2⤵
  PID:10912
- C:\Windows\System\CLVhmDJ.exe
  C:\Windows\System\CLVhmDJ.exe
  2⤵
  PID:11012
- C:\Windows\System\qZnNjzS.exe
  C:\Windows\System\qZnNjzS.exe
  2⤵
  PID:11032
- C:\Windows\System\UYIrivG.exe
  C:\Windows\System\UYIrivG.exe
  2⤵
  PID:11072
- C:\Windows\System\hHDrbFU.exe
  C:\Windows\System\hHDrbFU.exe
  2⤵
  PID:11144
- C:\Windows\System\ZCrnLkT.exe
  C:\Windows\System\ZCrnLkT.exe
  2⤵
  PID:11256
- C:\Windows\System\DddfuhU.exe
  C:\Windows\System\DddfuhU.exe
  2⤵
  PID:10072
- C:\Windows\System\rMCwAwq.exe
  C:\Windows\System\rMCwAwq.exe
  2⤵
  PID:10472
- C:\Windows\System\hqOsJLT.exe
  C:\Windows\System\hqOsJLT.exe
  2⤵
  PID:10604
- C:\Windows\System\CCGYxVs.exe
  C:\Windows\System\CCGYxVs.exe
  2⤵
  PID:10596
- C:\Windows\System\zdIOKxF.exe
  C:\Windows\System\zdIOKxF.exe
  2⤵
  PID:10756
- C:\Windows\System\cGubHRw.exe
  C:\Windows\System\cGubHRw.exe
  2⤵
  PID:10852
- C:\Windows\System\fRbKMbq.exe
  C:\Windows\System\fRbKMbq.exe
  2⤵
  PID:10980
- C:\Windows\System\ViqrYGF.exe
  C:\Windows\System\ViqrYGF.exe
  2⤵
  PID:10284
- C:\Windows\System\farfkns.exe
  C:\Windows\System\farfkns.exe
  2⤵
  PID:10504
- C:\Windows\System\PQsdfFx.exe
  C:\Windows\System\PQsdfFx.exe
  2⤵
  PID:11180
- C:\Windows\System\sBuvuaa.exe
  C:\Windows\System\sBuvuaa.exe
  2⤵
  PID:9576
- C:\Windows\System\sAiyxlO.exe
  C:\Windows\System\sAiyxlO.exe
  2⤵
  PID:10992
- C:\Windows\System\ZtLzxkC.exe
  C:\Windows\System\ZtLzxkC.exe
  2⤵
  PID:11276
- C:\Windows\System\ZRMxdUG.exe
  C:\Windows\System\ZRMxdUG.exe
  2⤵
  PID:11304
- C:\Windows\System\bHkNXlI.exe
  C:\Windows\System\bHkNXlI.exe
  2⤵
  PID:11332
- C:\Windows\System\ikTDtwf.exe
  C:\Windows\System\ikTDtwf.exe
  2⤵
  PID:11372
- C:\Windows\System\AtXurIg.exe
  C:\Windows\System\AtXurIg.exe
  2⤵
  PID:11396
- C:\Windows\System\yeMlxuT.exe
  C:\Windows\System\yeMlxuT.exe
  2⤵
  PID:11416
- C:\Windows\System\YDoPCDR.exe
  C:\Windows\System\YDoPCDR.exe
  2⤵
  PID:11440
- C:\Windows\System\QfIVOll.exe
  C:\Windows\System\QfIVOll.exe
  2⤵
  PID:11460
- C:\Windows\System\JgpTMzb.exe
  C:\Windows\System\JgpTMzb.exe
  2⤵
  PID:11480
- C:\Windows\System\msjmSpV.exe
  C:\Windows\System\msjmSpV.exe
  2⤵
  PID:11504
- C:\Windows\System\dItmcco.exe
  C:\Windows\System\dItmcco.exe
  2⤵
  PID:11528
- C:\Windows\System\laHgjHI.exe
  C:\Windows\System\laHgjHI.exe
  2⤵
  PID:11560
- C:\Windows\System\vobWbEk.exe
  C:\Windows\System\vobWbEk.exe
  2⤵
  PID:11592
- C:\Windows\System\vmYdsBZ.exe
  C:\Windows\System\vmYdsBZ.exe
  2⤵
  PID:11640
- C:\Windows\System\tqESlcA.exe
  C:\Windows\System\tqESlcA.exe
  2⤵
  PID:11656
- C:\Windows\System\vfoqBdf.exe
  C:\Windows\System\vfoqBdf.exe
  2⤵
  PID:11696
- C:\Windows\System\UOZUjFs.exe
  C:\Windows\System\UOZUjFs.exe
  2⤵
  PID:11724
- C:\Windows\System\muIcJbQ.exe
  C:\Windows\System\muIcJbQ.exe
  2⤵
  PID:11760
- C:\Windows\System\fTaOgjS.exe
  C:\Windows\System\fTaOgjS.exe
  2⤵
  PID:11788
- C:\Windows\System\FRJvibj.exe
  C:\Windows\System\FRJvibj.exe
  2⤵
  PID:11812
- C:\Windows\System\qMbTTJL.exe
  C:\Windows\System\qMbTTJL.exe
  2⤵
  PID:11840
- C:\Windows\System\oWPBasx.exe
  C:\Windows\System\oWPBasx.exe
  2⤵
  PID:11860
- C:\Windows\System\SLhEbnP.exe
  C:\Windows\System\SLhEbnP.exe
  2⤵
  PID:11880
- C:\Windows\System\RpiDvUJ.exe
  C:\Windows\System\RpiDvUJ.exe
  2⤵
  PID:11944
- C:\Windows\System\nwGDldl.exe
  C:\Windows\System\nwGDldl.exe
  2⤵
  PID:11964
- C:\Windows\System\GrxFQrZ.exe
  C:\Windows\System\GrxFQrZ.exe
  2⤵
  PID:11992
- C:\Windows\System\rVFAMZR.exe
  C:\Windows\System\rVFAMZR.exe
  2⤵
  PID:12016
- C:\Windows\System\GPgTkqW.exe
  C:\Windows\System\GPgTkqW.exe
  2⤵
  PID:12036
- C:\Windows\System\jNsgiBK.exe
  C:\Windows\System\jNsgiBK.exe
  2⤵
  PID:12056
- C:\Windows\System\tPcyzaN.exe
  C:\Windows\System\tPcyzaN.exe
  2⤵
  PID:12076
- C:\Windows\System\uRnwEZN.exe
  C:\Windows\System\uRnwEZN.exe
  2⤵
  PID:12108
- C:\Windows\System\XJILlWX.exe
  C:\Windows\System\XJILlWX.exe
  2⤵
  PID:12128
- C:\Windows\System\lYfyQoq.exe
  C:\Windows\System\lYfyQoq.exe
  2⤵
  PID:12148
- C:\Windows\System\fvNKRad.exe
  C:\Windows\System\fvNKRad.exe
  2⤵
  PID:12184
- C:\Windows\System\cFPUiWK.exe
  C:\Windows\System\cFPUiWK.exe
  2⤵
  PID:12204
- C:\Windows\System\VPfUKcB.exe
  C:\Windows\System\VPfUKcB.exe
  2⤵
  PID:12224
- C:\Windows\System\frcBnJi.exe
  C:\Windows\System\frcBnJi.exe
  2⤵
  PID:12244
- C:\Windows\System\bwxoVrc.exe
  C:\Windows\System\bwxoVrc.exe
  2⤵
  PID:12264
- C:\Windows\System\BemmvXs.exe
  C:\Windows\System\BemmvXs.exe
  2⤵
  PID:11324
- C:\Windows\System\hSXClJd.exe
  C:\Windows\System\hSXClJd.exe
  2⤵
  PID:11344
- C:\Windows\System\eRAkSjQ.exe
  C:\Windows\System\eRAkSjQ.exe
  2⤵
  PID:11392
- C:\Windows\System\CKXKAqr.exe
  C:\Windows\System\CKXKAqr.exe
  2⤵
  PID:11512
- C:\Windows\System\OOpgBFi.exe
  C:\Windows\System\OOpgBFi.exe
  2⤵
  PID:11576
- C:\Windows\System\wAeAnae.exe
  C:\Windows\System\wAeAnae.exe
  2⤵
  PID:11736
- C:\Windows\System\KeFitvn.exe
  C:\Windows\System\KeFitvn.exe
  2⤵
  PID:11772
- C:\Windows\System\rsSkArn.exe
  C:\Windows\System\rsSkArn.exe
  2⤵
  PID:11828
- C:\Windows\System\kDNmvpy.exe
  C:\Windows\System\kDNmvpy.exe
  2⤵
  PID:11856
- C:\Windows\System\umBYaKU.exe
  C:\Windows\System\umBYaKU.exe
  2⤵
  PID:11936
- C:\Windows\System\opqgABV.exe
  C:\Windows\System\opqgABV.exe
  2⤵
  PID:12012
- C:\Windows\System\xSaWhkk.exe
  C:\Windows\System\xSaWhkk.exe
  2⤵
  PID:12044
- C:\Windows\System\tULBOgF.exe
  C:\Windows\System\tULBOgF.exe
  2⤵
  PID:12176
- C:\Windows\System\ENRheem.exe
  C:\Windows\System\ENRheem.exe
  2⤵
  PID:12260
- C:\Windows\System\lFOkNZw.exe
  C:\Windows\System\lFOkNZw.exe
  2⤵
  PID:12216
- C:\Windows\System\MGQJgpy.exe
  C:\Windows\System\MGQJgpy.exe
  2⤵
  PID:12276
- C:\Windows\System\Eevewhf.exe
  C:\Windows\System\Eevewhf.exe
  2⤵
  PID:11468
- C:\Windows\System\yZNwbKz.exe
  C:\Windows\System\yZNwbKz.exe
  2⤵
  PID:11648
- C:\Windows\System\gjNEIPq.exe
  C:\Windows\System\gjNEIPq.exe
  2⤵
  PID:11808
- C:\Windows\System\LJlpqoY.exe
  C:\Windows\System\LJlpqoY.exe
  2⤵
  PID:11832
- C:\Windows\System\INmUieH.exe
  C:\Windows\System\INmUieH.exe
  2⤵
  PID:12048
- C:\Windows\System\UThaOYh.exe
  C:\Windows\System\UThaOYh.exe
  2⤵
  PID:12144
- C:\Windows\System\qkeRbjS.exe
  C:\Windows\System\qkeRbjS.exe
  2⤵
  PID:11432
- C:\Windows\System\eyjuObg.exe
  C:\Windows\System\eyjuObg.exe
  2⤵
  PID:11852
- C:\Windows\System\ndUKypX.exe
  C:\Windows\System\ndUKypX.exe
  2⤵
  PID:11744
- C:\Windows\System\KcObksF.exe
  C:\Windows\System\KcObksF.exe
  2⤵
  PID:11496
- C:\Windows\System\fZXOHtm.exe
  C:\Windows\System\fZXOHtm.exe
  2⤵
  PID:12312
- C:\Windows\System\rZziFFx.exe
  C:\Windows\System\rZziFFx.exe
  2⤵
  PID:12344
- C:\Windows\System\khSNILk.exe
  C:\Windows\System\khSNILk.exe
  2⤵
  PID:12384
- C:\Windows\System\bCzVyIx.exe
  C:\Windows\System\bCzVyIx.exe
  2⤵
  PID:12408
- C:\Windows\System\owwrpbY.exe
  C:\Windows\System\owwrpbY.exe
  2⤵
  PID:12436
- C:\Windows\System\KmpYLPr.exe
  C:\Windows\System\KmpYLPr.exe
  2⤵
  PID:12460
- C:\Windows\System\tHFFQvZ.exe
  C:\Windows\System\tHFFQvZ.exe
  2⤵
  PID:12488
- C:\Windows\System\TZTvUjk.exe
  C:\Windows\System\TZTvUjk.exe
  2⤵
  PID:12524
- C:\Windows\System\dYnfuec.exe
  C:\Windows\System\dYnfuec.exe
  2⤵
  PID:12540
- C:\Windows\System\fLmRoXF.exe
  C:\Windows\System\fLmRoXF.exe
  2⤵
  PID:12564
- C:\Windows\System\jWfthTl.exe
  C:\Windows\System\jWfthTl.exe
  2⤵
  PID:12580
- C:\Windows\System\THNKccx.exe
  C:\Windows\System\THNKccx.exe
  2⤵
  PID:12600
- C:\Windows\System\guNgEap.exe
  C:\Windows\System\guNgEap.exe
  2⤵
  PID:12652
- C:\Windows\System\LFhiRuo.exe
  C:\Windows\System\LFhiRuo.exe
  2⤵
  PID:12692
- C:\Windows\System\ULPTSOz.exe
  C:\Windows\System\ULPTSOz.exe
  2⤵
  PID:12716
- C:\Windows\System\SLFLJqx.exe
  C:\Windows\System\SLFLJqx.exe
  2⤵
  PID:12736
- C:\Windows\System\AXNhzVU.exe
  C:\Windows\System\AXNhzVU.exe
  2⤵
  PID:12760
- C:\Windows\System\NRhIqla.exe
  C:\Windows\System\NRhIqla.exe
  2⤵
  PID:12776
- C:\Windows\System\TYhEsmD.exe
  C:\Windows\System\TYhEsmD.exe
  2⤵
  PID:12804
- C:\Windows\System\pPLBXyj.exe
  C:\Windows\System\pPLBXyj.exe
  2⤵
  PID:12824
- C:\Windows\System\LWSbGgG.exe
  C:\Windows\System\LWSbGgG.exe
  2⤵
  PID:12844
- C:\Windows\System\wxyXVDf.exe
  C:\Windows\System\wxyXVDf.exe
  2⤵
  PID:12892
- C:\Windows\System\oRosiAy.exe
  C:\Windows\System\oRosiAy.exe
  2⤵
  PID:12940
- C:\Windows\System\VDrnuZg.exe
  C:\Windows\System\VDrnuZg.exe
  2⤵
  PID:12980
- C:\Windows\System\ENWgkjV.exe
  C:\Windows\System\ENWgkjV.exe
  2⤵
  PID:13004
- C:\Windows\System\IUuGrhv.exe
  C:\Windows\System\IUuGrhv.exe
  2⤵
  PID:13024
- C:\Windows\System\dKYAhyg.exe
  C:\Windows\System\dKYAhyg.exe
  2⤵
  PID:13044
- C:\Windows\System\weswerh.exe
  C:\Windows\System\weswerh.exe
  2⤵
  PID:13060
- C:\Windows\System\cIHzfbl.exe
  C:\Windows\System\cIHzfbl.exe
  2⤵
  PID:13084
- C:\Windows\System\pYxjsQs.exe
  C:\Windows\System\pYxjsQs.exe
  2⤵
  PID:13100
- C:\Windows\System\KJdUHNL.exe
  C:\Windows\System\KJdUHNL.exe
  2⤵
  PID:13136
- C:\Windows\System\oagtjbR.exe
  C:\Windows\System\oagtjbR.exe
  2⤵
  PID:13156
- C:\Windows\System\dcoqpXs.exe
  C:\Windows\System\dcoqpXs.exe
  2⤵
  PID:13172
- C:\Windows\System\lbYrzsl.exe
  C:\Windows\System\lbYrzsl.exe
  2⤵
  PID:13232
- C:\Windows\System\qekrcAO.exe
  C:\Windows\System\qekrcAO.exe
  2⤵
  PID:13268
- C:\Windows\System\rNbieFY.exe
  C:\Windows\System\rNbieFY.exe
  2⤵
  PID:12008
- C:\Windows\System\TYbFNGR.exe
  C:\Windows\System\TYbFNGR.exe
  2⤵
  PID:12304
- C:\Windows\System\qtUszid.exe
  C:\Windows\System\qtUszid.exe
  2⤵
  PID:12364
- C:\Windows\System\VVtCVvw.exe
  C:\Windows\System\VVtCVvw.exe
  2⤵
  PID:116
- C:\Windows\System\BoEAQvV.exe
  C:\Windows\System\BoEAQvV.exe
  2⤵
  PID:12400
- C:\Windows\System\XVVQxWl.exe
  C:\Windows\System\XVVQxWl.exe
  2⤵
  PID:12452
- C:\Windows\System\DEXnKnm.exe
  C:\Windows\System\DEXnKnm.exe
  2⤵
  PID:12560
- C:\Windows\System\DpoFwCt.exe
  C:\Windows\System\DpoFwCt.exe
  2⤵
  PID:12612
- C:\Windows\System\NPmCEpp.exe
  C:\Windows\System\NPmCEpp.exe
  2⤵
  PID:12688
- C:\Windows\System\QPvgwaF.exe
  C:\Windows\System\QPvgwaF.exe
  2⤵
  PID:12748
- C:\Windows\System\TetFmEy.exe
  C:\Windows\System\TetFmEy.exe
  2⤵
  PID:12772
- C:\Windows\System\YZXHuJC.exe
  C:\Windows\System\YZXHuJC.exe
  2⤵
  PID:12840
- C:\Windows\System\cOaMhOj.exe
  C:\Windows\System\cOaMhOj.exe
  2⤵
  PID:13184
- C:\Windows\System\FeFtpPd.exe
  C:\Windows\System\FeFtpPd.exe
  2⤵
  PID:13224
- C:\Windows\System\ShGhxyi.exe
  C:\Windows\System\ShGhxyi.exe
  2⤵
  PID:12380
- C:\Windows\System\ATRCiiX.exe
  C:\Windows\System\ATRCiiX.exe
  2⤵
  PID:12032
- C:\Windows\System\TvXNzmQ.exe
  C:\Windows\System\TvXNzmQ.exe
  2⤵
  PID:13020
- C:\Windows\System\MheVDBx.exe
  C:\Windows\System\MheVDBx.exe
  2⤵
  PID:13168
- C:\Windows\System\ScVfpAy.exe
  C:\Windows\System\ScVfpAy.exe
  2⤵
  PID:13148
- C:\Windows\System\IAQlZSB.exe
  C:\Windows\System\IAQlZSB.exe
  2⤵
  PID:13112
- C:\Windows\System\gYUxggF.exe
  C:\Windows\System\gYUxggF.exe
  2⤵
  PID:13220
- C:\Windows\System\KVIpEND.exe
  C:\Windows\System\KVIpEND.exe
  2⤵
  PID:13296
- C:\Windows\System\efbiqfZ.exe
  C:\Windows\System\efbiqfZ.exe
  2⤵
  PID:13288
- C:\Windows\System\gOJDWco.exe
  C:\Windows\System\gOJDWco.exe
  2⤵
  PID:12512
- C:\Windows\System\yaAZNjG.exe
  C:\Windows\System\yaAZNjG.exe
  2⤵
  PID:1964
- C:\Windows\System\AeTwuBJ.exe
  C:\Windows\System\AeTwuBJ.exe
  2⤵
  PID:12576
- C:\Windows\System\AvhAvqA.exe
  C:\Windows\System\AvhAvqA.exe
  2⤵
  PID:13052
- C:\Windows\System\ajSzQJs.exe
  C:\Windows\System\ajSzQJs.exe
  2⤵
  PID:12332
- C:\Windows\System\bgkmVWC.exe
  C:\Windows\System\bgkmVWC.exe
  2⤵
  PID:12836
- C:\Windows\System\RHFdVKH.exe
  C:\Windows\System\RHFdVKH.exe
  2⤵
  PID:13152
- C:\Windows\System\xVXHCar.exe
  C:\Windows\System\xVXHCar.exe
  2⤵
  PID:4884
- C:\Windows\System\FMVwTkI.exe
  C:\Windows\System\FMVwTkI.exe
  2⤵
  PID:4608
- C:\Windows\System\fgaMKvL.exe
  C:\Windows\System\fgaMKvL.exe
  2⤵
  PID:3652
- C:\Windows\System\RgHSFxy.exe
  C:\Windows\System\RgHSFxy.exe
  2⤵
  PID:2556
- C:\Windows\System\XmruDjV.exe
  C:\Windows\System\XmruDjV.exe
  2⤵
  PID:3392
- C:\Windows\System\JURFHhD.exe
  C:\Windows\System\JURFHhD.exe
  2⤵
  PID:4632
- C:\Windows\System\TJPdRhR.exe
  C:\Windows\System\TJPdRhR.exe
  2⤵
  PID:468
- C:\Windows\System\ACokDzS.exe
  C:\Windows\System\ACokDzS.exe
  2⤵
  PID:2320
- C:\Windows\System\FEtxOIp.exe
  C:\Windows\System\FEtxOIp.exe
  2⤵
  PID:8568
- C:\Windows\System\prSLKdl.exe
  C:\Windows\System\prSLKdl.exe
  2⤵
  PID:4896
- C:\Windows\System\ribnEgC.exe
  C:\Windows\System\ribnEgC.exe
  2⤵
  PID:1444
- C:\Windows\System\KyDtuwP.exe
  C:\Windows\System\KyDtuwP.exe
  2⤵
  PID:4440
- C:\Windows\System\AUjjhqg.exe
  C:\Windows\System\AUjjhqg.exe
  2⤵
  PID:13012
- C:\Windows\System\uEljlIn.exe
  C:\Windows\System\uEljlIn.exe
  2⤵
  PID:2236
- C:\Windows\System\mBKkyZc.exe
  C:\Windows\System\mBKkyZc.exe
  2⤵
  PID:3016
- C:\Windows\System\ovaVqvt.exe
  C:\Windows\System\ovaVqvt.exe
  2⤵
  PID:2416
- C:\Windows\System\JDFvwdT.exe
  C:\Windows\System\JDFvwdT.exe
  2⤵
  PID:4240
- C:\Windows\System\blkWMgL.exe
  C:\Windows\System\blkWMgL.exe
  2⤵
  PID:7476
- C:\Windows\System\VojBpac.exe
  C:\Windows\System\VojBpac.exe
  2⤵
  PID:2128
- C:\Windows\System\hxaqOau.exe
  C:\Windows\System\hxaqOau.exe
  2⤵
  PID:1908
- C:\Windows\System\tmBmLBu.exe
  C:\Windows\System\tmBmLBu.exe
  2⤵
  PID:3344
- C:\Windows\System\FFIMHBe.exe
  C:\Windows\System\FFIMHBe.exe
  2⤵
  PID:8100
- C:\Windows\System\IGrOUnX.exe
  C:\Windows\System\IGrOUnX.exe
  2⤵
  PID:4224
- C:\Windows\System\VziIfwP.exe
  C:\Windows\System\VziIfwP.exe
  2⤵
  PID:8468
- C:\Windows\System\bnGCxLb.exe
  C:\Windows\System\bnGCxLb.exe
  2⤵
  PID:4948
- C:\Windows\System\DyeJBYX.exe
  C:\Windows\System\DyeJBYX.exe
  2⤵
  PID:1000
- C:\Windows\System\aZPUEYb.exe
  C:\Windows\System\aZPUEYb.exe
  2⤵
  PID:8376
- C:\Windows\System\PvRlFTJ.exe
  C:\Windows\System\PvRlFTJ.exe
  2⤵
  PID:8456
- C:\Windows\System\LqWcIRy.exe
  C:\Windows\System\LqWcIRy.exe
  2⤵
  PID:3308
- C:\Windows\System\qFQdpLS.exe
  C:\Windows\System\qFQdpLS.exe
  2⤵
  PID:13252
- C:\Windows\System\zgiNaxQ.exe
  C:\Windows\System\zgiNaxQ.exe
  2⤵
  PID:1664
- C:\Windows\System\ikSIBIh.exe
  C:\Windows\System\ikSIBIh.exe
  2⤵
  PID:2324
- C:\Windows\System\VtCAmlc.exe
  C:\Windows\System\VtCAmlc.exe
  2⤵
  PID:3060
- C:\Windows\System\qoSJNMh.exe
  C:\Windows\System\qoSJNMh.exe
  2⤵
  PID:3212
- C:\Windows\System\RxweQde.exe
  C:\Windows\System\RxweQde.exe
  2⤵
  PID:9584
- C:\Windows\System\oyXZYjc.exe
  C:\Windows\System\oyXZYjc.exe
  2⤵
  PID:2084
- C:\Windows\System\sYSpbBD.exe
  C:\Windows\System\sYSpbBD.exe
  2⤵
  PID:7896
- C:\Windows\System\vbwhXXX.exe
  C:\Windows\System\vbwhXXX.exe
  2⤵
  PID:2228
- C:\Windows\System\QHExqSZ.exe
  C:\Windows\System\QHExqSZ.exe
  2⤵
  PID:9180
- C:\Windows\System\YPCHicm.exe
  C:\Windows\System\YPCHicm.exe
  2⤵
  PID:8340
- C:\Windows\System\xJwmVJF.exe
  C:\Windows\System\xJwmVJF.exe
  2⤵
  PID:2036
- C:\Windows\System\JvwOEsf.exe
  C:\Windows\System\JvwOEsf.exe
  2⤵
  PID:6464
- C:\Windows\System\MJGdOlA.exe
  C:\Windows\System\MJGdOlA.exe
  2⤵
  PID:4568
- C:\Windows\System\xVXjDNH.exe
  C:\Windows\System\xVXjDNH.exe
  2⤵
  PID:8312
- C:\Windows\System\hXzHvqL.exe
  C:\Windows\System\hXzHvqL.exe
  2⤵
  PID:2400
- C:\Windows\System\RPMyiCh.exe
  C:\Windows\System\RPMyiCh.exe
  2⤵
  PID:3460
- C:\Windows\System\aIAGANj.exe
  C:\Windows\System\aIAGANj.exe
  2⤵
  PID:8588
- C:\Windows\System\LplusLE.exe
  C:\Windows\System\LplusLE.exe
  2⤵
  PID:8612
- C:\Windows\System\XSaMHcx.exe
  C:\Windows\System\XSaMHcx.exe
  2⤵
  PID:4060
- C:\Windows\System\yGUnfol.exe
  C:\Windows\System\yGUnfol.exe
  2⤵
  PID:9320
- C:\Windows\System\scnaxej.exe
  C:\Windows\System\scnaxej.exe
  2⤵
  PID:4696
- C:\Windows\System\RrEqcnA.exe
  C:\Windows\System\RrEqcnA.exe
  2⤵
  PID:9552
- C:\Windows\System\HTsOEih.exe
  C:\Windows\System\HTsOEih.exe
  2⤵
  PID:5212
- C:\Windows\System\cUvtoqY.exe
  C:\Windows\System\cUvtoqY.exe
  2⤵
  PID:13280
- C:\Windows\System\PYdiQOK.exe
  C:\Windows\System\PYdiQOK.exe
  2⤵
  PID:4452
- C:\Windows\System\oPncjFa.exe
  C:\Windows\System\oPncjFa.exe
  2⤵
  PID:7948
- C:\Windows\System\PhUeKmG.exe
  C:\Windows\System\PhUeKmG.exe
  2⤵
  PID:8708
- C:\Windows\System\FHEGGii.exe
  C:\Windows\System\FHEGGii.exe
  2⤵
  PID:5368
- C:\Windows\System\tIAjqPF.exe
  C:\Windows\System\tIAjqPF.exe
  2⤵
  PID:4552
- C:\Windows\System\bTGrfyz.exe
  C:\Windows\System\bTGrfyz.exe
  2⤵
  PID:1256
- C:\Windows\System\KhCnQfL.exe
  C:\Windows\System\KhCnQfL.exe
  2⤵
  PID:9352
- C:\Windows\System\gtIYypl.exe
  C:\Windows\System\gtIYypl.exe
  2⤵
  PID:4556
- C:\Windows\System\HPllsgN.exe
  C:\Windows\System\HPllsgN.exe
  2⤵
  PID:2952
- C:\Windows\System\eowRyGy.exe
  C:\Windows\System\eowRyGy.exe
  2⤵
  PID:10408
- C:\Windows\System\OXVZCTR.exe
  C:\Windows\System\OXVZCTR.exe
  2⤵
  PID:4416
- C:\Windows\System\VOrDAGC.exe
  C:\Windows\System\VOrDAGC.exe
  2⤵
  PID:1208
- C:\Windows\System\bRpMGsT.exe
  C:\Windows\System\bRpMGsT.exe
  2⤵
  PID:220
- C:\Windows\System\LHITAOp.exe
  C:\Windows\System\LHITAOp.exe
  2⤵
  PID:7580
- C:\Windows\System\RweOMSV.exe
  C:\Windows\System\RweOMSV.exe
  2⤵
  PID:4976
- C:\Windows\System\JRjMXbm.exe
  C:\Windows\System\JRjMXbm.exe
  2⤵
  PID:9636
- C:\Windows\System\YeCLnEm.exe
  C:\Windows\System\YeCLnEm.exe
  2⤵
  PID:10028
- C:\Windows\System\eLDVMWl.exe
  C:\Windows\System\eLDVMWl.exe
  2⤵
  PID:2664
- C:\Windows\System\wlLLzBI.exe
  C:\Windows\System\wlLLzBI.exe
  2⤵
  PID:9304
- C:\Windows\System\bDMPHMT.exe
  C:\Windows\System\bDMPHMT.exe
  2⤵
  PID:1260
- C:\Windows\System\uUbgKFI.exe
  C:\Windows\System\uUbgKFI.exe
  2⤵
  PID:8084
- C:\Windows\System\jHKYXTi.exe
  C:\Windows\System\jHKYXTi.exe
  2⤵
  PID:5396
- C:\Windows\System\zziAccF.exe
  C:\Windows\System\zziAccF.exe
  2⤵
  PID:2908
- C:\Windows\System\tPLYwuQ.exe
  C:\Windows\System\tPLYwuQ.exe
  2⤵
  PID:5480
- C:\Windows\System\haXKtyF.exe
  C:\Windows\System\haXKtyF.exe
  2⤵
  PID:2256
- C:\Windows\System\oIpEsPU.exe
  C:\Windows\System\oIpEsPU.exe
  2⤵
  PID:6124
- C:\Windows\System\QoEtBqM.exe
  C:\Windows\System\QoEtBqM.exe
  2⤵
  PID:4020
- C:\Windows\System\TcSKfEZ.exe
  C:\Windows\System\TcSKfEZ.exe
  2⤵
  PID:10356
- C:\Windows\System\uPOKnPf.exe
  C:\Windows\System\uPOKnPf.exe
  2⤵
  PID:516
- C:\Windows\System\yNfliPp.exe
  C:\Windows\System\yNfliPp.exe
  2⤵
  PID:10532
- C:\Windows\System\lSIwSWM.exe
  C:\Windows\System\lSIwSWM.exe
  2⤵
  PID:3112
- C:\Windows\System\YyndNbE.exe
  C:\Windows\System\YyndNbE.exe
  2⤵
  PID:5392
- C:\Windows\System\PajLavQ.exe
  C:\Windows\System\PajLavQ.exe
  2⤵
  PID:4600
- C:\Windows\System\mGLGYEu.exe
  C:\Windows\System\mGLGYEu.exe
  2⤵
  PID:5816
- C:\Windows\System\fEwfGGh.exe
  C:\Windows\System\fEwfGGh.exe
  2⤵
  PID:9792
- C:\Windows\System\jvgrPhk.exe
  C:\Windows\System\jvgrPhk.exe
  2⤵
  PID:3068
- C:\Windows\System\srRbjtI.exe
  C:\Windows\System\srRbjtI.exe
  2⤵
  PID:4392
- C:\Windows\System\GejvRfT.exe
  C:\Windows\System\GejvRfT.exe
  2⤵
  PID:10928
- C:\Windows\System\kClGfRA.exe
  C:\Windows\System\kClGfRA.exe
  2⤵
  PID:9272
- C:\Windows\System\OXigOZc.exe
  C:\Windows\System\OXigOZc.exe
  2⤵
  PID:4036
- C:\Windows\System\xvWyihj.exe
  C:\Windows\System\xvWyihj.exe
  2⤵
  PID:4824
- C:\Windows\System\RZguVmi.exe
  C:\Windows\System\RZguVmi.exe
  2⤵
  PID:4512
- C:\Windows\System\wsekpSd.exe
  C:\Windows\System\wsekpSd.exe
  2⤵
  PID:11428
- C:\Windows\System\JBGTyaw.exe
  C:\Windows\System\JBGTyaw.exe
  2⤵
  PID:2296
- C:\Windows\System\JUZnDEi.exe
  C:\Windows\System\JUZnDEi.exe
  2⤵
  PID:11488
- C:\Windows\System\RitOKQJ.exe
  C:\Windows\System\RitOKQJ.exe
  2⤵
  PID:7596
- C:\Windows\System\rFHfiEV.exe
  C:\Windows\System\rFHfiEV.exe
  2⤵
  PID:5040
- C:\Windows\System\omblxUM.exe
  C:\Windows\System\omblxUM.exe
  2⤵
  PID:4032
- C:\Windows\System\XtEtuKg.exe
  C:\Windows\System\XtEtuKg.exe
  2⤵
  PID:12596
- C:\Windows\System\jCoukzJ.exe
  C:\Windows\System\jCoukzJ.exe
  2⤵
  PID:9632
- C:\Windows\System\aIuOyWB.exe
  C:\Windows\System\aIuOyWB.exe
  2⤵
  PID:368
- C:\Windows\System\dITSMRE.exe
  C:\Windows\System\dITSMRE.exe
  2⤵
  PID:5732
- C:\Windows\System\PnJEZKd.exe
  C:\Windows\System\PnJEZKd.exe
  2⤵
  PID:7900
- C:\Windows\System\KTlIZlC.exe
  C:\Windows\System\KTlIZlC.exe
  2⤵
  PID:5300
- C:\Windows\System\PXEPrZW.exe
  C:\Windows\System\PXEPrZW.exe
  2⤵
  PID:5416
- C:\Windows\System\UuVkZOw.exe
  C:\Windows\System\UuVkZOw.exe
  2⤵
  PID:5504
- C:\Windows\System\WAdsphr.exe
  C:\Windows\System\WAdsphr.exe
  2⤵
  PID:5348
- C:\Windows\System\OdMxyoj.exe
  C:\Windows\System\OdMxyoj.exe
  2⤵
  PID:5912
- C:\Windows\System\OvSVFgo.exe
  C:\Windows\System\OvSVFgo.exe
  2⤵
  PID:8232
- C:\Windows\System\kkqTWXO.exe
  C:\Windows\System\kkqTWXO.exe
  2⤵
  PID:5672
- C:\Windows\System\TxcPZYB.exe
  C:\Windows\System\TxcPZYB.exe
  2⤵
  PID:5940
- C:\Windows\System\wUgOYGV.exe
  C:\Windows\System\wUgOYGV.exe
  2⤵
  PID:5452
- C:\Windows\System\WISwKfm.exe
  C:\Windows\System\WISwKfm.exe
  2⤵
  PID:5996
- C:\Windows\System\aiIcDGM.exe
  C:\Windows\System\aiIcDGM.exe
  2⤵
  PID:5380
- C:\Windows\System\UneHzTX.exe
  C:\Windows\System\UneHzTX.exe
  2⤵
  PID:8116
- C:\Windows\System\sHJMgNH.exe
  C:\Windows\System\sHJMgNH.exe
  2⤵
  PID:11956
- C:\Windows\System\LgmxXFa.exe
  C:\Windows\System\LgmxXFa.exe
  2⤵
  PID:6036
- C:\Windows\System\tYpTfRF.exe
  C:\Windows\System\tYpTfRF.exe
  2⤵
  PID:9048
- C:\Windows\System\SngOesU.exe
  C:\Windows\System\SngOesU.exe
  2⤵
  PID:12124
- C:\Windows\System\sAlqASW.exe
  C:\Windows\System\sAlqASW.exe
  2⤵
  PID:10608
- C:\Windows\System\LacVBoD.exe
  C:\Windows\System\LacVBoD.exe
  2⤵
  PID:8684
- C:\Windows\System\FYbqbuh.exe
  C:\Windows\System\FYbqbuh.exe
  2⤵
  PID:9368
- C:\Windows\System\uGqoZNr.exe
  C:\Windows\System\uGqoZNr.exe
  2⤵
  PID:11384
- C:\Windows\System\ATnBJMt.exe
  C:\Windows\System\ATnBJMt.exe
  2⤵
  PID:12832
- C:\Windows\System\sqhDvgm.exe
  C:\Windows\System\sqhDvgm.exe
  2⤵
  PID:6588
- C:\Windows\System\CUwTLEl.exe
  C:\Windows\System\CUwTLEl.exe
  2⤵
  PID:6656
- C:\Windows\System\vgPvMYz.exe
  C:\Windows\System\vgPvMYz.exe
  2⤵
  PID:5216
- C:\Windows\System\QsvzyyY.exe
  C:\Windows\System\QsvzyyY.exe
  2⤵
  PID:6684
- C:\Windows\System\CBBhJbL.exe
  C:\Windows\System\CBBhJbL.exe
  2⤵
  PID:6848
- C:\Windows\System\wafaYAk.exe
  C:\Windows\System\wafaYAk.exe
  2⤵
  PID:5696
- C:\Windows\System\veZxKlO.exe
  C:\Windows\System\veZxKlO.exe
  2⤵
  PID:7104
- C:\Windows\System\DPcryzL.exe
  C:\Windows\System\DPcryzL.exe
  2⤵
  PID:5944
- C:\Windows\System\VIzgRza.exe
  C:\Windows\System\VIzgRza.exe
  2⤵
  PID:6120
- C:\Windows\System\pokWwUI.exe
  C:\Windows\System\pokWwUI.exe
  2⤵
  PID:7132
- C:\Windows\System\acscbAU.exe
  C:\Windows\System\acscbAU.exe
  2⤵
  PID:1804
- C:\Windows\System\MtPNCUA.exe
  C:\Windows\System\MtPNCUA.exe
  2⤵
  PID:5124
- C:\Windows\System\XsJzykl.exe
  C:\Windows\System\XsJzykl.exe
  2⤵
  PID:5240
- C:\Windows\System\tQPsJXE.exe
  C:\Windows\System\tQPsJXE.exe
  2⤵
  PID:2204
- C:\Windows\System\khxHFfz.exe
  C:\Windows\System\khxHFfz.exe
  2⤵
  PID:12852
- C:\Windows\System\NCislLP.exe
  C:\Windows\System\NCislLP.exe
  2⤵
  PID:6768
- C:\Windows\System\LSPIcFz.exe
  C:\Windows\System\LSPIcFz.exe
  2⤵
  PID:13180
- C:\Windows\System\bSSyHoa.exe
  C:\Windows\System\bSSyHoa.exe
  2⤵
  PID:8464
- C:\Windows\System\KvhcMFN.exe
  C:\Windows\System\KvhcMFN.exe
  2⤵
  PID:11908
- C:\Windows\System\aWJlBAJ.exe
  C:\Windows\System\aWJlBAJ.exe
  2⤵
  PID:2224
- C:\Windows\System\lZlcjZn.exe
  C:\Windows\System\lZlcjZn.exe
  2⤵
  PID:1164
- C:\Windows\System\jFYefwn.exe
  C:\Windows\System\jFYefwn.exe
  2⤵
  PID:7048
- C:\Windows\System\IpgPHGe.exe
  C:\Windows\System\IpgPHGe.exe
  2⤵
  PID:4900
- C:\Windows\System\ubgNApD.exe
  C:\Windows\System\ubgNApD.exe
  2⤵
  PID:12164
- C:\Windows\System\BnptHtd.exe
  C:\Windows\System\BnptHtd.exe
  2⤵
  PID:6052
- C:\Windows\System\MPSavZh.exe
  C:\Windows\System\MPSavZh.exe
  2⤵
  PID:10360
- C:\Windows\System\auOZHyH.exe
  C:\Windows\System\auOZHyH.exe
  2⤵
  PID:5448
- C:\Windows\System\XDifCle.exe
  C:\Windows\System\XDifCle.exe
  2⤵
  PID:12352
- C:\Windows\System\iKSvfYw.exe
  C:\Windows\System\iKSvfYw.exe
  2⤵
  PID:6188
- C:\Windows\System\XYcYEYR.exe
  C:\Windows\System\XYcYEYR.exe
  2⤵
  PID:2344
- C:\Windows\System\luDccta.exe
  C:\Windows\System\luDccta.exe
  2⤵
  PID:1792
- C:\Windows\System\jBBlTqO.exe
  C:\Windows\System\jBBlTqO.exe
  2⤵
  PID:12640
- C:\Windows\System\CDnHsMK.exe
  C:\Windows\System\CDnHsMK.exe
  2⤵
  PID:5136
- C:\Windows\System\WrYzrXv.exe
  C:\Windows\System\WrYzrXv.exe
  2⤵
  PID:1112
- C:\Windows\System\QDHskuY.exe
  C:\Windows\System\QDHskuY.exe
  2⤵
  PID:5336
- C:\Windows\System\QbjokvD.exe
  C:\Windows\System\QbjokvD.exe
  2⤵
  PID:5172
- C:\Windows\System\QZHPGbV.exe
  C:\Windows\System\QZHPGbV.exe
  2⤵
  PID:2608
- C:\Windows\System\YTOYvdg.exe
  C:\Windows\System\YTOYvdg.exe
  2⤵
  PID:2732
- C:\Windows\System\nehtqbh.exe
  C:\Windows\System\nehtqbh.exe
  2⤵
  PID:952
- C:\Windows\System\NkDtjte.exe
  C:\Windows\System\NkDtjte.exe
  2⤵
  PID:13284
- C:\Windows\System\dVMwoJd.exe
  C:\Windows\System\dVMwoJd.exe
  2⤵
  PID:6964
- C:\Windows\System\OKOaJwz.exe
  C:\Windows\System\OKOaJwz.exe
  2⤵
  PID:12500
- C:\Windows\System\LFmifEQ.exe
  C:\Windows\System\LFmifEQ.exe
  2⤵
  PID:2184
- C:\Windows\System\aTxVQyl.exe
  C:\Windows\System\aTxVQyl.exe
  2⤵
  PID:9372
- C:\Windows\System\LyOUOyS.exe
  C:\Windows\System\LyOUOyS.exe
  2⤵
  PID:9308
- C:\Windows\System\JAbmAMQ.exe
  C:\Windows\System\JAbmAMQ.exe
  2⤵
  PID:12456
- C:\Windows\System\NonqsQC.exe
  C:\Windows\System\NonqsQC.exe
  2⤵
  PID:6716
- C:\Windows\System\qLRFBGI.exe
  C:\Windows\System\qLRFBGI.exe
  2⤵
  PID:11340
- C:\Windows\System\kxHMqKG.exe
  C:\Windows\System\kxHMqKG.exe
  2⤵
  PID:6164
- C:\Windows\System\AwLueiL.exe
  C:\Windows\System\AwLueiL.exe
  2⤵
  PID:6264
- C:\Windows\System\yyfRPwM.exe
  C:\Windows\System\yyfRPwM.exe
  2⤵
  PID:3424
- C:\Windows\System\AeGkkHA.exe
  C:\Windows\System\AeGkkHA.exe
  2⤵
  PID:7256
- C:\Windows\System\KbQcjPL.exe
  C:\Windows\System\KbQcjPL.exe
  2⤵
  PID:12504
- C:\Windows\System\oXSSTeN.exe
  C:\Windows\System\oXSSTeN.exe
  2⤵
  PID:6152
- C:\Windows\System\NSseggG.exe
  C:\Windows\System\NSseggG.exe
  2⤵
  PID:6292
- C:\Windows\System\bhhuyHW.exe
  C:\Windows\System\bhhuyHW.exe
  2⤵
  PID:8744
- C:\Windows\System\XjylytR.exe
  C:\Windows\System\XjylytR.exe
  2⤵
  PID:12444
- C:\Windows\System\bbWTIet.exe
  C:\Windows\System\bbWTIet.exe
  2⤵
  PID:7308
- C:\Windows\System\ImDqxeN.exe
  C:\Windows\System\ImDqxeN.exe
  2⤵
  PID:4612
- C:\Windows\System\Qxqgnqz.exe
  C:\Windows\System\Qxqgnqz.exe
  2⤵
  PID:7368
- C:\Windows\System\xCBAjvH.exe
  C:\Windows\System\xCBAjvH.exe
  2⤵
  PID:12516
- C:\Windows\System\EgMTcGG.exe
  C:\Windows\System\EgMTcGG.exe
  2⤵
  PID:6652
- C:\Windows\System\QfyvgUb.exe
  C:\Windows\System\QfyvgUb.exe
  2⤵
  PID:7336
- C:\Windows\System\fzprkga.exe
  C:\Windows\System\fzprkga.exe
  2⤵
  PID:4708
- C:\Windows\System\BHpyaOf.exe
  C:\Windows\System\BHpyaOf.exe
  2⤵
  PID:6712
- C:\Windows\System\vOwzhZR.exe
  C:\Windows\System\vOwzhZR.exe
  2⤵
  PID:7480
- C:\Windows\System\oRLTBHF.exe
  C:\Windows\System\oRLTBHF.exe
  2⤵
  PID:11740
- C:\Windows\System\rmxMNqA.exe
  C:\Windows\System\rmxMNqA.exe
  2⤵
  PID:2540
- C:\Windows\System\FDjOYpJ.exe
  C:\Windows\System\FDjOYpJ.exe
  2⤵
  PID:3672
- C:\Windows\System\RSdwpWc.exe
  C:\Windows\System\RSdwpWc.exe
  2⤵
  PID:7624
- C:\Windows\System\cxvViwe.exe
  C:\Windows\System\cxvViwe.exe
  2⤵
  PID:1900
- C:\Windows\System\oAQrNPp.exe
  C:\Windows\System\oAQrNPp.exe
  2⤵
  PID:6896
- C:\Windows\System\dqbXFbI.exe
  C:\Windows\System\dqbXFbI.exe
  2⤵
  PID:10600
- C:\Windows\System\JNlcxYh.exe
  C:\Windows\System\JNlcxYh.exe
  2⤵
  PID:6660
- C:\Windows\System\SWlLGHv.exe
  C:\Windows\System\SWlLGHv.exe
  2⤵
  PID:7240
- C:\Windows\System\yazBNdd.exe
  C:\Windows\System\yazBNdd.exe
  2⤵
  PID:6932
- C:\Windows\System\SECdGvg.exe
  C:\Windows\System\SECdGvg.exe
  2⤵
  PID:7156
- C:\Windows\System\VxBwyHl.exe
  C:\Windows\System\VxBwyHl.exe
  2⤵
  PID:7528
- C:\Windows\System\auLDNSB.exe
  C:\Windows\System\auLDNSB.exe
  2⤵
  PID:6668
- C:\Windows\System\TkVwcQp.exe
  C:\Windows\System\TkVwcQp.exe
  2⤵
  PID:12028
- C:\Windows\System\lbHJmTR.exe
  C:\Windows\System\lbHJmTR.exe
  2⤵
  PID:8036
- C:\Windows\System\yIcYjxJ.exe
  C:\Windows\System\yIcYjxJ.exe
  2⤵
  PID:5892
- C:\Windows\System\mDJztxa.exe
  C:\Windows\System\mDJztxa.exe
  2⤵
  PID:9392
- C:\Windows\System\AWVfGvf.exe
  C:\Windows\System\AWVfGvf.exe
  2⤵
  PID:5648
- C:\Windows\System\tTlgGAV.exe
  C:\Windows\System\tTlgGAV.exe
  2⤵
  PID:8176
- C:\Windows\System\raCEYOR.exe
  C:\Windows\System\raCEYOR.exe
  2⤵
  PID:8792
- C:\Windows\System\DzcuYmI.exe
  C:\Windows\System\DzcuYmI.exe
  2⤵
  PID:8064
- C:\Windows\System\ONUQXHW.exe
  C:\Windows\System\ONUQXHW.exe
  2⤵
  PID:3788
- C:\Windows\System\YMcVCzC.exe
  C:\Windows\System\YMcVCzC.exe
  2⤵
  PID:12120
- C:\Windows\System\MJQzOTx.exe
  C:\Windows\System\MJQzOTx.exe
  2⤵
  PID:6420
- C:\Windows\System\hiLnQgp.exe
  C:\Windows\System\hiLnQgp.exe
  2⤵
  PID:7504
- C:\Windows\System\VixxwXQ.exe
  C:\Windows\System\VixxwXQ.exe
  2⤵
  PID:7644
- C:\Windows\System\KukMJcG.exe
  C:\Windows\System\KukMJcG.exe
  2⤵
  PID:2800
- C:\Windows\System\RmQBjbR.exe
  C:\Windows\System\RmQBjbR.exe
  2⤵
  PID:7724
- C:\Windows\System\IvJsXty.exe
  C:\Windows\System\IvJsXty.exe
  2⤵
  PID:7536
- C:\Windows\System\mRZTpYy.exe
  C:\Windows\System\mRZTpYy.exe
  2⤵
  PID:7404
- C:\Windows\System\Rjifoht.exe
  C:\Windows\System\Rjifoht.exe
  2⤵
  PID:6892
- C:\Windows\System\OAZjCvw.exe
  C:\Windows\System\OAZjCvw.exe
  2⤵
  PID:7544
- C:\Windows\System\MjShfNx.exe
  C:\Windows\System\MjShfNx.exe
  2⤵
  PID:2836
- C:\Windows\System\hjyghYZ.exe
  C:\Windows\System\hjyghYZ.exe
  2⤵
  PID:8404
- C:\Windows\System\QGsHZsG.exe
  C:\Windows\System\QGsHZsG.exe
  2⤵
  PID:6988
- C:\Windows\System\uRaHXlJ.exe
  C:\Windows\System\uRaHXlJ.exe
  2⤵
  PID:7280
- C:\Windows\System\Hhkvazf.exe
  C:\Windows\System\Hhkvazf.exe
  2⤵
  PID:8408
- C:\Windows\System\wYCyeqp.exe
  C:\Windows\System\wYCyeqp.exe
  2⤵
  PID:8660
- C:\Windows\System\TSTNCBM.exe
  C:\Windows\System\TSTNCBM.exe
  2⤵
  PID:3584
- C:\Windows\System\teltQkO.exe
  C:\Windows\System\teltQkO.exe
  2⤵
  PID:9448
- C:\Windows\System\qepttjW.exe
  C:\Windows\System\qepttjW.exe
  2⤵
  PID:10796
- C:\Windows\System\PchPgCK.exe
  C:\Windows\System\PchPgCK.exe
  2⤵
  PID:7372
- C:\Windows\System\NTuXuiN.exe
  C:\Windows\System\NTuXuiN.exe
  2⤵
  PID:8564
- C:\Windows\System\SRwGHEx.exe
  C:\Windows\System\SRwGHEx.exe
  2⤵
  PID:12608
- C:\Windows\System\tRNArmz.exe
  C:\Windows\System\tRNArmz.exe
  2⤵
  PID:6696
- C:\Windows\System\JHuYcqp.exe
  C:\Windows\System\JHuYcqp.exe
  2⤵
  PID:6736
- C:\Windows\System\XpbGXpS.exe
  C:\Windows\System\XpbGXpS.exe
  2⤵
  PID:8104
- C:\Windows\System\DzeCLzS.exe
  C:\Windows\System\DzeCLzS.exe
  2⤵
  PID:8452
- C:\Windows\System\iSggjYJ.exe
  C:\Windows\System\iSggjYJ.exe
  2⤵
  PID:8988
- C:\Windows\System\JBbTfGm.exe
  C:\Windows\System\JBbTfGm.exe
  2⤵
  PID:12860
- C:\Windows\System\pLjjqkA.exe
  C:\Windows\System\pLjjqkA.exe
  2⤵
  PID:7340
- C:\Windows\System\XEitzOU.exe
  C:\Windows\System\XEitzOU.exe
  2⤵
  PID:8248
- C:\Windows\System\rgyHPFv.exe
  C:\Windows\System\rgyHPFv.exe
  2⤵
  PID:7460
- C:\Windows\System\GvJucsT.exe
  C:\Windows\System\GvJucsT.exe
  2⤵
  PID:8576
- C:\Windows\System\wRibROJ.exe
  C:\Windows\System\wRibROJ.exe
  2⤵
  PID:5492
- C:\Windows\System\kDvdnPv.exe
  C:\Windows\System\kDvdnPv.exe
  2⤵
  PID:7636
- C:\Windows\System\pTTyLdI.exe
  C:\Windows\System\pTTyLdI.exe
  2⤵
  PID:13068
- C:\Windows\System\rcCPEPy.exe
  C:\Windows\System\rcCPEPy.exe
  2⤵
  PID:7560
- C:\Windows\System\JjxmWyq.exe
  C:\Windows\System\JjxmWyq.exe
  2⤵
  PID:9044
- C:\Windows\System\nGVoNao.exe
  C:\Windows\System\nGVoNao.exe
  2⤵
  PID:7828
- C:\Windows\System\AjLehMC.exe
  C:\Windows\System\AjLehMC.exe
  2⤵
  PID:7196
- C:\Windows\System\dDNxwBg.exe
  C:\Windows\System\dDNxwBg.exe
  2⤵
  PID:6444
- C:\Windows\System\khLncXc.exe
  C:\Windows\System\khLncXc.exe
  2⤵
  PID:8984
- C:\Windows\System\QarCrEJ.exe
  C:\Windows\System\QarCrEJ.exe
  2⤵
  PID:13348
- C:\Windows\System\bpxNdwM.exe
  C:\Windows\System\bpxNdwM.exe
  2⤵
  PID:13500
- C:\Windows\System\CebOmPp.exe
  C:\Windows\System\CebOmPp.exe
  2⤵
  PID:13612
- C:\Windows\System\smBFacv.exe
  C:\Windows\System\smBFacv.exe
  2⤵
  PID:13640
- C:\Windows\System\HXlesxd.exe
  C:\Windows\System\HXlesxd.exe
  2⤵
  PID:13688
- C:\Windows\System\QmvuYbK.exe
  C:\Windows\System\QmvuYbK.exe
  2⤵
  PID:13740
- C:\Windows\System\SfXkfUg.exe
  C:\Windows\System\SfXkfUg.exe
  2⤵
  PID:13768
- C:\Windows\System\eJItGNZ.exe
  C:\Windows\System\eJItGNZ.exe
  2⤵
  PID:13804
- C:\Windows\System\WeTalPQ.exe
  C:\Windows\System\WeTalPQ.exe
  2⤵
  PID:13836
- C:\Windows\System\FpokalB.exe
  C:\Windows\System\FpokalB.exe
  2⤵
  PID:13872
- C:\Windows\System\KwepYMi.exe
  C:\Windows\System\KwepYMi.exe
  2⤵
  PID:13900
- C:\Windows\System\xjTuhbx.exe
  C:\Windows\System\xjTuhbx.exe
  2⤵
  PID:13928
- C:\Windows\System\FTfKuRW.exe
  C:\Windows\System\FTfKuRW.exe
  2⤵
  PID:13952
- C:\Windows\System\YvMKLtB.exe
  C:\Windows\System\YvMKLtB.exe
  2⤵
  PID:13968
- C:\Windows\System\gNwjXjs.exe
  C:\Windows\System\gNwjXjs.exe
  2⤵
  PID:13984
- C:\Windows\System\UlMHUax.exe
  C:\Windows\System\UlMHUax.exe
  2⤵
  PID:14000
- C:\Windows\System\LzEoPNG.exe
  C:\Windows\System\LzEoPNG.exe
  2⤵
  PID:14016
- C:\Windows\System\ApptlvC.exe
  C:\Windows\System\ApptlvC.exe
  2⤵
  PID:14060
- C:\Windows\System\UQrzSFg.exe
  C:\Windows\System\UQrzSFg.exe
  2⤵
  PID:14084
- C:\Windows\System\aGLVdkP.exe
  C:\Windows\System\aGLVdkP.exe
  2⤵
  PID:14120
- C:\Windows\System\BJGCUkR.exe
  C:\Windows\System\BJGCUkR.exe
  2⤵
  PID:14152
- C:\Windows\System\JNjpRzB.exe
  C:\Windows\System\JNjpRzB.exe
  2⤵
  PID:14176
- C:\Windows\System\CohlTOO.exe
  C:\Windows\System\CohlTOO.exe
  2⤵
  PID:14208
- C:\Windows\System\uHocjkX.exe
  C:\Windows\System\uHocjkX.exe
  2⤵
  PID:14232
- C:\Windows\System\YSUsUmY.exe
  C:\Windows\System\YSUsUmY.exe
  2⤵
  PID:14248
- C:\Windows\System\gOziEhF.exe
  C:\Windows\System\gOziEhF.exe
  2⤵
  PID:14272
- C:\Windows\System\NqMmoVY.exe
  C:\Windows\System\NqMmoVY.exe
  2⤵
  PID:14292
- C:\Windows\System\InBUhFG.exe
  C:\Windows\System\InBUhFG.exe
  2⤵
  PID:14320
- C:\Windows\System\joYwbuJ.exe
  C:\Windows\System\joYwbuJ.exe
  2⤵
  PID:8388
- C:\Windows\System\DgaqtlU.exe
  C:\Windows\System\DgaqtlU.exe
  2⤵
  PID:8740
- C:\Windows\System\jQkWKrT.exe
  C:\Windows\System\jQkWKrT.exe
  2⤵
  PID:408
- C:\Windows\System\NdKQtgR.exe
  C:\Windows\System\NdKQtgR.exe
  2⤵
  PID:7188
- C:\Windows\System\fjkwYFf.exe
  C:\Windows\System\fjkwYFf.exe
  2⤵
  PID:8508
- C:\Windows\System\JPKQmyZ.exe
  C:\Windows\System\JPKQmyZ.exe
  2⤵
  PID:2276
- C:\Windows\System\UKtXbkD.exe
  C:\Windows\System\UKtXbkD.exe
  2⤵
  PID:7792
- C:\Windows\System\sTqqSYv.exe
  C:\Windows\System\sTqqSYv.exe
  2⤵
  PID:13340
- C:\Windows\System\xAXmzUo.exe
  C:\Windows\System\xAXmzUo.exe
  2⤵
  PID:8372
- C:\Windows\System\LkKXXWn.exe
  C:\Windows\System\LkKXXWn.exe
  2⤵
  PID:9944
- C:\Windows\System\HeRKMIN.exe
  C:\Windows\System\HeRKMIN.exe
  2⤵
  PID:9200
- C:\Windows\System\umevhli.exe
  C:\Windows\System\umevhli.exe
  2⤵
  PID:10228
- C:\Windows\System\TCnxkSy.exe
  C:\Windows\System\TCnxkSy.exe
  2⤵
  PID:9100
- C:\Windows\System\JdvQCOh.exe
  C:\Windows\System\JdvQCOh.exe
  2⤵
  PID:8772
- C:\Windows\System\vNWIlTN.exe
  C:\Windows\System\vNWIlTN.exe
  2⤵
  PID:9604
- C:\Windows\System\SgOfDfJ.exe
  C:\Windows\System\SgOfDfJ.exe
  2⤵
  PID:9688
- C:\Windows\System\QYkchvc.exe
  C:\Windows\System\QYkchvc.exe
  2⤵
  PID:13456
- C:\Windows\System\JVJxXDT.exe
  C:\Windows\System\JVJxXDT.exe
  2⤵
  PID:13488
- C:\Windows\System\JLJCCpP.exe
  C:\Windows\System\JLJCCpP.exe
  2⤵
  PID:10224
- C:\Windows\System\ayqTRdN.exe
  C:\Windows\System\ayqTRdN.exe
  2⤵
  PID:9076
- C:\Windows\System\lGuZUUk.exe
  C:\Windows\System\lGuZUUk.exe
  2⤵
  PID:13704
- C:\Windows\System\bTMdyiJ.exe
  C:\Windows\System\bTMdyiJ.exe
  2⤵
  PID:10216
- C:\Windows\System\PQFNIft.exe
  C:\Windows\System\PQFNIft.exe
  2⤵
  PID:10040
- C:\Windows\System\AuvTFRJ.exe
  C:\Windows\System\AuvTFRJ.exe
  2⤵
  PID:9684
- C:\Windows\System\vfbfRhD.exe
  C:\Windows\System\vfbfRhD.exe
  2⤵
  PID:13420
- C:\Windows\System\CqLYweW.exe
  C:\Windows\System\CqLYweW.exe
  2⤵
  PID:10024
- C:\Windows\System\mITjGkQ.exe
  C:\Windows\System\mITjGkQ.exe
  2⤵
  PID:10304
- C:\Windows\System\FukkgjT.exe
  C:\Windows\System\FukkgjT.exe
  2⤵
  PID:8316
- C:\Windows\System\kIQWZEP.exe
  C:\Windows\System\kIQWZEP.exe
  2⤵
  PID:9776
- C:\Windows\System\DxBatGx.exe
  C:\Windows\System\DxBatGx.exe
  2⤵
  PID:13976
- C:\Windows\System\deWoaZZ.exe
  C:\Windows\System\deWoaZZ.exe
  2⤵
  PID:14048
- C:\Windows\System\OqTkzhY.exe
  C:\Windows\System\OqTkzhY.exe
  2⤵
  PID:13828
- C:\Windows\System\TQxNNoj.exe
  C:\Windows\System\TQxNNoj.exe
  2⤵
  PID:14144
- C:\Windows\System\dnrJEoP.exe
  C:\Windows\System\dnrJEoP.exe
  2⤵
  PID:14188
- C:\Windows\System\AFViFim.exe
  C:\Windows\System\AFViFim.exe
  2⤵
  PID:10328
- C:\Windows\System\YdwrjWa.exe
  C:\Windows\System\YdwrjWa.exe
  2⤵
  PID:13728
- C:\Windows\System\XTVVBnw.exe
  C:\Windows\System\XTVVBnw.exe
  2⤵
  PID:14260
- C:\Windows\System\mGvdNsi.exe
  C:\Windows\System\mGvdNsi.exe
  2⤵
  PID:14056
- C:\Windows\System\klvvTSH.exe
  C:\Windows\System\klvvTSH.exe
  2⤵
  PID:10552
- C:\Windows\System\BAAeDnt.exe
  C:\Windows\System\BAAeDnt.exe
  2⤵
  PID:13884
- C:\Windows\System\orXkbYJ.exe
  C:\Windows\System\orXkbYJ.exe
  2⤵
  PID:13920
- C:\Windows\System\hfpwxZY.exe
  C:\Windows\System\hfpwxZY.exe
  2⤵
  PID:7620
- C:\Windows\System\WOCDvjP.exe
  C:\Windows\System\WOCDvjP.exe
  2⤵
  PID:14240
- C:\Windows\System\QEuBxhZ.exe
  C:\Windows\System\QEuBxhZ.exe
  2⤵
  PID:10984
- C:\Windows\System\seoPTcL.exe
  C:\Windows\System\seoPTcL.exe
  2⤵
  PID:10720
- C:\Windows\System\SWvAIWc.exe
  C:\Windows\System\SWvAIWc.exe
  2⤵
  PID:9544
- C:\Windows\System\iItxykX.exe
  C:\Windows\System\iItxykX.exe
  2⤵
  PID:13316
- C:\Windows\System\bhvQjzz.exe
  C:\Windows\System\bhvQjzz.exe
  2⤵
  PID:10264
- C:\Windows\System\eAVgCiC.exe
  C:\Windows\System\eAVgCiC.exe
  2⤵
  PID:9104
- C:\Windows\System\TSVwQSl.exe
  C:\Windows\System\TSVwQSl.exe
  2⤵
  PID:10564
- C:\Windows\System\gBVGGTl.exe
  C:\Windows\System\gBVGGTl.exe
  2⤵
  PID:9952
- C:\Windows\System\IuVWzIQ.exe
  C:\Windows\System\IuVWzIQ.exe
  2⤵
  PID:14032
- C:\Windows\System\EFmyCty.exe
  C:\Windows\System\EFmyCty.exe
  2⤵
  PID:13452
- C:\Windows\System\voRNzqW.exe
  C:\Windows\System\voRNzqW.exe
  2⤵
  PID:10084
- C:\Windows\System\eyEXtFY.exe
  C:\Windows\System\eyEXtFY.exe
  2⤵
  PID:14268
- C:\Windows\System\YgBPken.exe
  C:\Windows\System\YgBPken.exe
  2⤵
  PID:13936
- C:\Windows\System\MMDPNRl.exe
  C:\Windows\System\MMDPNRl.exe
  2⤵
  PID:11448
- C:\Windows\System\kKhWsuZ.exe
  C:\Windows\System\kKhWsuZ.exe
  2⤵
  PID:9460
- C:\Windows\System\rQnVJkX.exe
  C:\Windows\System\rQnVJkX.exe
  2⤵
  PID:13580
- C:\Windows\System\JUreDUi.exe
  C:\Windows\System\JUreDUi.exe
  2⤵
  PID:8676
- C:\Windows\System\brPuMey.exe
  C:\Windows\System\brPuMey.exe
  2⤵
  PID:13948
- C:\Windows\System\tzEhCsy.exe
  C:\Windows\System\tzEhCsy.exe
  2⤵
  PID:13408
- C:\Windows\System\wznvfkb.exe
  C:\Windows\System\wznvfkb.exe
  2⤵
  PID:13440
- C:\Windows\System\wHYrROX.exe
  C:\Windows\System\wHYrROX.exe
  2⤵
  PID:13996
- C:\Windows\System\rtCmXGu.exe
  C:\Windows\System\rtCmXGu.exe
  2⤵
  PID:10536
- C:\Windows\System\DCdGMeb.exe
  C:\Windows\System\DCdGMeb.exe
  2⤵
  PID:13696
- C:\Windows\System\fwbmhpa.exe
  C:\Windows\System\fwbmhpa.exe
  2⤵
  PID:10724
- C:\Windows\System\rtJbDww.exe
  C:\Windows\System\rtJbDww.exe
  2⤵
  PID:13852
- C:\Windows\System\ayaMmxi.exe
  C:\Windows\System\ayaMmxi.exe
  2⤵
  PID:11316
- C:\Windows\System\skDPHuu.exe
  C:\Windows\System\skDPHuu.exe
  2⤵
  PID:11892
- C:\Windows\System\ZvPOZBb.exe
  C:\Windows\System\ZvPOZBb.exe
  2⤵
  PID:10728
- C:\Windows\System\FEIjlLg.exe
  C:\Windows\System\FEIjlLg.exe
  2⤵
  PID:11092
- C:\Windows\System\AodZkAl.exe
  C:\Windows\System\AodZkAl.exe
  2⤵
  PID:12156
- C:\Windows\System\paQNzVJ.exe
  C:\Windows\System\paQNzVJ.exe
  2⤵
  PID:9744
- C:\Windows\System\PonpxCM.exe
  C:\Windows\System\PonpxCM.exe
  2⤵
  PID:10584
- C:\Windows\System\zHKVwoW.exe
  C:\Windows\System\zHKVwoW.exe
  2⤵
  PID:13940
- C:\Windows\System\alOBLsp.exe
  C:\Windows\System\alOBLsp.exe
  2⤵
  PID:11328
- C:\Windows\System\YsLkDBL.exe
  C:\Windows\System\YsLkDBL.exe
  2⤵
  PID:12284
- C:\Windows\System\FtlsNNb.exe
  C:\Windows\System\FtlsNNb.exe
  2⤵
  PID:11348
- C:\Windows\System\OHSqcuQ.exe
  C:\Windows\System\OHSqcuQ.exe
  2⤵
  PID:10592
- C:\Windows\System\pHwwuHU.exe
  C:\Windows\System\pHwwuHU.exe
  2⤵
  PID:12160
- C:\Windows\System\naQGoLS.exe
  C:\Windows\System\naQGoLS.exe
  2⤵
  PID:11920
- C:\Windows\System\IMMjkUC.exe
  C:\Windows\System\IMMjkUC.exe
  2⤵
  PID:11352
- C:\Windows\System\XPqsWci.exe
  C:\Windows\System\XPqsWci.exe
  2⤵
  PID:12636
- C:\Windows\System\UYQUWlC.exe
  C:\Windows\System\UYQUWlC.exe
  2⤵
  PID:12812
- C:\Windows\System\bEjBNtx.exe
  C:\Windows\System\bEjBNtx.exe
  2⤵
  PID:11216
- C:\Windows\System\wMQLjJM.exe
  C:\Windows\System\wMQLjJM.exe
  2⤵
  PID:12632
- C:\Windows\System\PADRCPe.exe
  C:\Windows\System\PADRCPe.exe
  2⤵
  PID:9924
- C:\Windows\System\bKfRwjL.exe
  C:\Windows\System\bKfRwjL.exe
  2⤵
  PID:10272
- C:\Windows\System\yPEGKCs.exe
  C:\Windows\System\yPEGKCs.exe
  2⤵
  PID:14200
- C:\Windows\System\Arrrtdp.exe
  C:\Windows\System\Arrrtdp.exe
  2⤵
  PID:4540
- C:\Windows\System\zBagtaF.exe
  C:\Windows\System\zBagtaF.exe
  2⤵
  PID:14164
- C:\Windows\System\goGoOko.exe
  C:\Windows\System\goGoOko.exe
  2⤵
  PID:11500
- C:\Windows\System\CzLLGrI.exe
  C:\Windows\System\CzLLGrI.exe
  2⤵
  PID:12796
- C:\Windows\System\CHVqfOx.exe
  C:\Windows\System\CHVqfOx.exe
  2⤵
  PID:12684
- C:\Windows\System\pfWVaHE.exe
  C:\Windows\System\pfWVaHE.exe
  2⤵
  PID:8616
- C:\Windows\System\GDAZBre.exe
  C:\Windows\System\GDAZBre.exe
  2⤵
  PID:12784
- C:\Windows\System\UyYAbUs.exe
  C:\Windows\System\UyYAbUs.exe
  2⤵
  PID:14160
- C:\Windows\System\GJZTQmz.exe
  C:\Windows\System\GJZTQmz.exe
  2⤵
  PID:13732
- C:\Windows\System\fFbzuTS.exe
  C:\Windows\System\fFbzuTS.exe
  2⤵
  PID:13344
- C:\Windows\System\IvHSiAV.exe
  C:\Windows\System\IvHSiAV.exe
  2⤵
  PID:13144
- C:\Windows\System\YSOQkYj.exe
  C:\Windows\System\YSOQkYj.exe
  2⤵
  PID:14184
- C:\Windows\System\sxelKyj.exe
  C:\Windows\System\sxelKyj.exe
  2⤵
  PID:1192
- C:\Windows\System\KIqzgOG.exe
  C:\Windows\System\KIqzgOG.exe
  2⤵
  PID:11300
- C:\Windows\System\obsACFj.exe
  C:\Windows\System\obsACFj.exe
  2⤵
  PID:11768
- C:\Windows\System\JhHzzkX.exe
  C:\Windows\System\JhHzzkX.exe
  2⤵
  PID:11292
- C:\Windows\System\WIflWxd.exe
  C:\Windows\System\WIflWxd.exe
  2⤵
  PID:12140
- C:\Windows\System\xgHyAGU.exe
  C:\Windows\System\xgHyAGU.exe
  2⤵
  PID:12864
- C:\Windows\System\LkaTQBY.exe
  C:\Windows\System\LkaTQBY.exe
  2⤵
  PID:10260
- C:\Windows\System\jxIKvjY.exe
  C:\Windows\System\jxIKvjY.exe
  2⤵
  PID:13568
- C:\Windows\System\AwrxGiG.exe
  C:\Windows\System\AwrxGiG.exe
  2⤵
  PID:9712
- C:\Windows\System\aqsVLns.exe
  C:\Windows\System\aqsVLns.exe
  2⤵
  PID:11108
- C:\Windows\System\ZRSDjuE.exe
  C:\Windows\System\ZRSDjuE.exe
  2⤵
  PID:8760
- C:\Windows\System\JFebuVn.exe
  C:\Windows\System\JFebuVn.exe
  2⤵
  PID:11380
- C:\Windows\System\gzMtfvG.exe
  C:\Windows\System\gzMtfvG.exe
  2⤵
  PID:14100
- C:\Windows\System\LftvXYF.exe
  C:\Windows\System\LftvXYF.exe
  2⤵
  PID:12088
- C:\Windows\System\SgBEvsZ.exe
  C:\Windows\System\SgBEvsZ.exe
  2⤵
  PID:11552
- C:\Windows\System\TcPdbyf.exe
  C:\Windows\System\TcPdbyf.exe
  2⤵
  PID:13464
- C:\Windows\System\nDxgZSW.exe
  C:\Windows\System\nDxgZSW.exe
  2⤵
  PID:12676
- C:\Windows\System\fFhZiwg.exe
  C:\Windows\System\fFhZiwg.exe
  2⤵
  PID:12552
- C:\Windows\System\lbLyGIC.exe
  C:\Windows\System\lbLyGIC.exe
  2⤵
  PID:14036
- C:\Windows\System\ZyFcgXk.exe
  C:\Windows\System\ZyFcgXk.exe
  2⤵
  PID:13700
- C:\Windows\System\BumAqtA.exe
  C:\Windows\System\BumAqtA.exe
  2⤵
  PID:12272
- C:\Windows\System\mBXNAKP.exe
  C:\Windows\System\mBXNAKP.exe
  2⤵
  PID:13108

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4964

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:12508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2vszp5q1.ymy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EHTuTnx.exe

Filesize
1.7MB

MD5
177862f9600c38dbf4e8cf43a9c5856e

SHA1
3ac12af4bd71e215394755476b8dacf0ad5d1f4b

SHA256
da2dce1c7dd19877ca4d0d19c0e0d52c2f9c2499ae1068402f798be91ab7bb7d

SHA512
5f8e4e9944b4256b263091d0b6f6b2af8f41c71d46e5e8c3f964112ff497a83a7dae63e4e83b1847461652550fed5af22282d770e36f74821df47f249201dfc5

Download Submit
C:\Windows\System\EJLFWhy.exe

Filesize
1.7MB

MD5
e76cbfc9fde0fa9db585783d9b5b3c57

SHA1
ec55a4db993aba095c27477781734e2d79d25103

SHA256
176e75d7272b8a25034f6379a8ceccf2195091d20b067a8992e66570225806af

SHA512
a5c9c034d50245bcc7ce97f29c05d67b7d22601876bece4135d4e6f8d90b192d78607dfc830380b94440ff1eb5275a6cc44f3c182508b0949f74a03435f2e162

Download Submit
C:\Windows\System\GkIPTPb.exe

Filesize
1.7MB

MD5
d127943c27051a6c0c78384433b09068

SHA1
11a21a6e76240d55253ff1f6b005465929e8818d

SHA256
bedfe43778b7d78af8a4d8cd3c39fb94d524a8c303d1597c2863344220be02fa

SHA512
4158467b8d99b362eda22c8ce14d8ac0021776434bfb7bc77714c320d0f54f7b99fc77376ccd7df0e179d648d75b7eeea4f5b0177dd4d4902abac15fa9918b6d

Download Submit
C:\Windows\System\INgxqTl.exe

Filesize
1.7MB

MD5
a74e2840ee4cdb188f28ff8b65c7badc

SHA1
e38193eda61b7f280928ff22fd3b9f046064a985

SHA256
cdb00f24c155d8d71a1bd27967d9567af30e04d2cbfd52a360e270673205b62e

SHA512
033403aec2524744e2a46f4824ed454e97ac08690e06ddc44323052ea09eaed8eb91fbe86e99c89d27e63a8f255056df35fa4b3a9de63d06d99fe87b537a25fb

Download Submit
C:\Windows\System\IbFmlQj.exe

Filesize
1.7MB

MD5
b1179abd61b8d93b808ef08114abbc8a

SHA1
666f36f437e4a02de678cf73903bf8ae63346076

SHA256
65b44bb153a2a0085f9db0015c683ac494e9f3e5cb242fd27159d3810fcf8dde

SHA512
947017b1108443eb308ab135511a563e328ef1261066434f2ae9d9c1a6288bc05a7d92b628877579eb506f79fbef4667e61b323603074e35e4f3ec0e06c75a7c

Download Submit
C:\Windows\System\JGLRoDv.exe

Filesize
1.7MB

MD5
3246b660be1d26a33d38a21643c36c08

SHA1
22799a6a7f9a51cc69e0f502cd13b8f673890460

SHA256
7acce871e0459e5c08161f1336330cb4a28dbd778e182751fb0e07ee728f2552

SHA512
121c7723d2b7b4021f8ca6f2624289789db02d5e4e8ccb158266404451797b59dedab615566b30649213c55bf547cf5ad09e310eb210207f26ba8cd8e860658b

Download Submit
C:\Windows\System\JPIDVmI.exe

Filesize
1.7MB

MD5
7009afc7af1fdb2fa4a566a65a7b07e6

SHA1
85669e6c46b1f006374d57c9fdd0930113b841c9

SHA256
59ef2b5a57f2b0b97b4b03dd99728e27be246d39a1668a7a1ea5351d2d1da066

SHA512
a9dd8e52eb5d7b71360d43b82c43ac617bbf0a2d2cc19dc932e3a57eac60f78d568ed54983a6998694f8874ccb451eadfb63196e6a292dcf305d7f2fc059d2f7

Download Submit
C:\Windows\System\KhaSTzz.exe

Filesize
1.7MB

MD5
4989da73d854b3e905eb313d2a0b5df0

SHA1
703f7377b47c5855ac462ff6ef2f6508a7632e5b

SHA256
e03139695441345a4ee9cce9d3c476dcbc5d1a89937e5f3a28860e5efb391149

SHA512
b6c766465e99f28ba392138994934919e2b9f3b0a72ea8b1f0ec1b7e7c4936acc20f230f698c30aaeec7f5e1e139cae2dc6353b1e14a9bb022a68cac150ba62f

Download Submit
C:\Windows\System\KuJWnPw.exe

Filesize
1.7MB

MD5
dddc4421a0db55ca9eb781d008d52656

SHA1
adad305bdb0fc6b84dbb652e60b58c46e4b177f4

SHA256
7cd74a74fbeb566ebf24f307630a64774ff42e6bbbb47135906a12f5b9428b12

SHA512
acc73ebfd2d42ab4545768d71634f5d2286d08fd5daa72deb689e507882356fe86be0c576572cd83518d0af54a61e21a22970674ec8e42805022b0c9fc15733b

Download Submit
C:\Windows\System\PdEZyXu.exe

Filesize
1.7MB

MD5
4d0c6d9c632df873be2e55c613d78029

SHA1
984de056bcd23bb39e4a3363010f8a75eab9602e

SHA256
33378ce7db9d86a469e86b179125715aa7aed5ff812118d2fb523d93822a993b

SHA512
31a4fe6e62e91fad2a9c58448c2ca4642bb461b255dfc8c158fb3fe0f2f0a2db100e9668f547c523878b957621378f291c18cfa444a035aa9b3189b5dac3a5b6

Download Submit
C:\Windows\System\PhSmqNj.exe

Filesize
1.7MB

MD5
60772fb35d323439ae95be1c6627bf8e

SHA1
e25ea2dfebb5336f9fe10f0a2e321b84a4fd6ce5

SHA256
327ebd16faffc143c3f59bebcf01b715c1be2e5a41b2e81c790bfe789a2d3798

SHA512
e174a455a9767d906e67d6127d92973016e23e29ca9ae814d14a7efeb8581114c73ccc5f6ca237ded55e710d7e2cfdf31494f1b42e5ff84b2d8c43e7a5fb993f

Download Submit
C:\Windows\System\RVklWAt.exe

Filesize
1.7MB

MD5
5bd973fef74ab0ab702d48a63d1628fb

SHA1
f5dac3fcc422255b78765e12d7d2dcf724d1ba1e

SHA256
0c3638442c262da9af7e99aaf1f23e8cadccb487c568673e80b3a31c15ff9c23

SHA512
4f64f20ec5a061e1e49abf4965b73519f4f981d3fbc144cd555eb7ee530a928f8d603e8903b734d2468721bb47e229a97b424bae77a0eb93c7d38668267cbb60

Download Submit
C:\Windows\System\SAEDbMW.exe

Filesize
1.7MB

MD5
5da2642db65e3a3e95dc8715c107ba9d

SHA1
0f2eceb65228305bae40762260f9038b0f4eca86

SHA256
b9ba012556e72be3ce132a99ab166de5e128f0d20f8f44baf7ad4b8195345d09

SHA512
0e276f6884c2fad666c6bc0967b809c1a0b6a1a689c688459cfef4d723a6e2a409ca0c5a44cf90f203358ccdb673512f6a89579d98396981d728f532c747d6fa

Download Submit
C:\Windows\System\TCvWxaK.exe

Filesize
1.7MB

MD5
af0384d1290cc01e7a1e2920a0fd0955

SHA1
30148eaa71cdf1f08b1fe978da0bb82dfc627aaf

SHA256
bd68f5c8448e44c0072d13d74be928d832053808044d5c1f77770ee79f4f9177

SHA512
4b57d65bf4cdc5b4c50e64f5c7a76ef5bb898090e4169a21888c08800055158711ce6b46a588a940a99e507692892e0eb7e3c502db3ece73cf56b0971563b786

Download Submit
C:\Windows\System\UyQKQkS.exe

Filesize
1.7MB

MD5
87ddc34f1261ee8803365c6c2cae1b81

SHA1
38bceed86ee78df5d0d77602997d5146df2315e5

SHA256
860c86a6192fab92e400a7002ced9ca02b92f0da593011ca58c74979d38c0aca

SHA512
bf35234259897ca657f89635b04b66fc749d3586ca841b67c54ce3134203ab181d518bddc39377179ee82fd4d737fabcd6150f8d9370fc0f9714816647c846d1

Download Submit
C:\Windows\System\VItHtTT.exe

Filesize
1.7MB

MD5
67f680821e88cecbdeaeedc9f6dfebb3

SHA1
2e1cf5b849a343cad300c827d4d47deeb6381708

SHA256
16122332a5d81d25f6d60c23c28501db0d3e3d40422f36e41967f4dd65eea9fa

SHA512
0b1b6168a92f1560eb108712266518b87623392e7f39832093589faa4112047b72b72656a74d815b89c99d107d3f26fcf1e6022a8c1660955f8c27f2ac2f55d8

Download Submit
C:\Windows\System\WdqSXzY.exe

Filesize
1.7MB

MD5
52e6b995c7fe81bf1b971d8e68f72e75

SHA1
f7347dacc34bc043453ecea4e289ff431553794e

SHA256
f4270ba4e6ab7e7ffe05999da538b6aa4d4df6ca1def975d421ff33e3a80ff25

SHA512
260ba9558b2600897e57a0c64d38ba373117af397c459259c3c091b81a7f2012a87bf392a6081f64d6b4ae1c40872412f0c5493738e016570b3e3aa572ffb276

Download Submit
C:\Windows\System\YEKqbdU.exe

Filesize
1.7MB

MD5
a896e13d938757af8725660ebd5da3ab

SHA1
1f3533fe0e7974599f6eef099ac1c47b87603c78

SHA256
8dbf1e02aa3591490837f2148a8a89b576e20c843e39b4ff05eeef26713f434f

SHA512
e0a244e95b099dd955c9108e7b50007a05b0a546f91d91d703a82c6c491ec6a6df8d37697ab15678f48cc8779d0a5d13999fffeec4d3e8a2395077c6c638b3ce

Download Submit
C:\Windows\System\ZXkzTES.exe

Filesize
1.7MB

MD5
5f29dbbbbed0ad4b65cc43245a9ec88e

SHA1
45b5140fd8ac395cf0e517c7f817f73ae78bd405

SHA256
5762ac7dbca8e63f28710cc737ad54e9d4ebfda6395b0b85d68183a705a8b2d8

SHA512
4d1d3cbcd95290e99acf99fb6baaa18aa39a93141f7f1d35a1f1f48d4ada0c4f9c6e73862c9e327752fa91921e3bec349fffa3cea818a26dfad310accea09279

Download Submit
C:\Windows\System\aUZkbzA.exe

Filesize
8B

MD5
66d7e297b90fe34ca06f598960896d19

SHA1
0433321fa0d916440f15cdee91c3e93318197dee

SHA256
62c8848e8576ee6bb1b62b04fa3898ea9c1bff1c6df8e2421efa77ab49fa4456

SHA512
4abb742b6807bc5e9c1f07c9bd2c9a15b441e3a0f7a9715e62b9a71c659b66c03f5bdd4961bd675100bab1c61778e8b524a13e9a54f36d441aeb74ce1a0b5e73

Download Submit
C:\Windows\System\aykzocT.exe

Filesize
1.7MB

MD5
4b55358adbafbf155f94699d12d44d50

SHA1
9ee7322b5984bc0c19284dfd33496bb452dd699b

SHA256
749609f1eee6d4040f4fe58f2156d49da4d8636271d5d73034e84bd2d4dd3606

SHA512
a1e66dd39252d4d9d13a01d5394a3fc9db72b839d6318a8cd7e04299ade34966ff439468d9defe3440381b08dec71b29a179e0df5e7e05dcf712278bf47cd6e0

Download Submit
C:\Windows\System\bjmneXd.exe

Filesize
1.7MB

MD5
940b9bb1baa0ffedcbe2f5893852bb4c

SHA1
2ed05452de58fdb11f5faf0e0b2cc31df0358990

SHA256
095286550f88976e3d1afcf8a413ceedf7cb784e129fe351d05f3902cd136b31

SHA512
c41fb8946e675c148da56a1d73c1712a46f71fcd47b3f3ceda668cad0cb883bcd0527b5a4c2d029374eab25d3e60d0a39f3baaaf45e8a660eab46d4bc7199e83

Download Submit
C:\Windows\System\dZlqvuv.exe

Filesize
1.7MB

MD5
34db3c70a7a04b09e5f26b6ee52f6c78

SHA1
344f78221fed95f7584b9df6d0e4bb3953ea9472

SHA256
1fccf47e708259bf5e0373a1d3b1aae9139a55a6369acb6d0abf10a0acf9e0fa

SHA512
e706bbd07e9284fab7e7b827aa823831f26be6046cc7d62e3d425814a0da35e70d91a09962254905d4b147651573bcfdf4217189e63915b438d7515cb56c8e21

Download Submit
C:\Windows\System\fZjlWCT.exe

Filesize
1.7MB

MD5
d05599378884a8a18ce159c083c38d33

SHA1
aaba61d23d78727a65c18d1a19abba079646485d

SHA256
c01282fd03bb7c16b75d153af465c05e774fb5fe77f8a280bebc4cd4feb55b31

SHA512
942235e31bb97acb87ffd700eaa51fa204b93c667fd7c5aff482318fdc674c1e8c978cd1e6a52ea363b0f0ab59839bbc32660fbb1fab0942cb2d9cd7397d5396

Download Submit
C:\Windows\System\lcgJrlV.exe

Filesize
1.7MB

MD5
85afd35546f2b5acdd48dc0188bf3a90

SHA1
e8761d1857ab40cd97cf0a497640b7ab244a20a6

SHA256
4b9eead21b1e5f0ae7669e70108f5c02d0947480cb20a94e9e9d53b54cb3dd3f

SHA512
6e297c1c98f188b75bd47a4108078ae400b25f07b6dfc3a7db5637df8c72e231fd1bf439f96026674e2973e9d65642e1d8306d55ef7e621454eb19e50279e173

Download Submit
C:\Windows\System\oLFtWvr.exe

Filesize
1.7MB

MD5
8d4afd94f093945685caa8bec2b4556e

SHA1
05027e8f864a7f3255b4994281ccda88fbb1bef2

SHA256
9653ff13a63be642f5e948fe5c64db16659a45db614b6325123fd2450fc622f6

SHA512
0f55fe4b3ba348b0efc9d1102adefb91be526a7d1a7a1fb875b1c852f7e11dc099d7b9f17d80cc90ac5efd2d6b7440ef36f58ea7057d76643029624ac83ee11f

Download Submit
C:\Windows\System\ptHcZmX.exe

Filesize
1.7MB

MD5
3f8e0e6881b92ea57bb34cc0f32e467c

SHA1
a8ab9df755fd3857d762db094e531ceb49c7e935

SHA256
731df62515ac1ebcc1b4bc770072cbdc7f9e9a6a2f0a55d3bd0e16c50b215215

SHA512
f8f580286d88066a28a9d4256ca08fa510d2d3e85ec4d4c325cad000a9145fd60aa0630c63b18de2efce6ac6eb67da046ea3691f34df28ca21e7b40e5cb8ac6c

Download Submit
C:\Windows\System\qifMBXb.exe

Filesize
1.7MB

MD5
0d70320ff31254bd14e7fa112b7bf38a

SHA1
3fe869324f29fa199a8ea4611d84a5af50a471bf

SHA256
3b1517d34746fe1c968b0a23ae8ee538c62da6fce8ac1bc5183c8fd013d800be

SHA512
fb587bd9b7bd1dc657a626453bcee46f491dccf1953c7f6db908b88be05d274a448cb075f0f322b1fe3367dd3eaf6da2fe1a701fb517437f7f3a736b545ace71

Download Submit
C:\Windows\System\tMuxQlD.exe

Filesize
1.7MB

MD5
4fd2484eeafd3f170f3ce54136b01156

SHA1
0d4179535e7fa96a3a2b92d567b2a2155c847a4b

SHA256
c49c4a058b777a61fdf78f9919e999c26323e22707a75d1d30bc34a61cc654c1

SHA512
5ff87331a4780c7ca2941b5ff95b80e6416f15009453eeaad1f200af0e56266652f009fc5a6517340791c35dd51fd8bf50c78f25a56b80ebf0cb819728839fdb

Download Submit
C:\Windows\System\tZdcqtX.exe

Filesize
1.7MB

MD5
450bad744880447f711d1df03dd97846

SHA1
402605e4f54fb40cee4088fdb408c9cac7b6c592

SHA256
2ed84fa0ac8a3b12d7bbce42e8aaf8105ff7902a17d05a93bcbe676c09a3b834

SHA512
603bbfabc0e13b00b815fb85523fcaf3b492a0719726894cf551d0704208486d0e638e3495e701504fc5798f60022608fdd0ee770c479de44ba31ad146662f90

Download Submit
C:\Windows\System\wGTnFbQ.exe

Filesize
1.7MB

MD5
3e06c70785ec055f85c45cea31b87038

SHA1
7d7bdcb8390fa3c8dcccd5bbcb6dd90932b8095e

SHA256
0581cd496bd65751dadad3bb9873bd36ba6980719449491c19bbf3ce208c5aed

SHA512
6660afadf401889236def62479b143f33a5c24d603d7205b6fc8b17b9f01c2cba6bde36790da48de5f9a9c1f54c5a0306b02000ce5461ab280d32e19f6db884b

Download Submit
C:\Windows\System\wIVyyAT.exe

Filesize
1.7MB

MD5
19d1e0587f7bb4be7fe925c1613ad84c

SHA1
396c5ea826343dd675fa43b6a3548702d5019bfa

SHA256
9a287b0493e72b7cfb66e110bb8b8f22398897fdcb7b47bacf4a1c7042ea971d

SHA512
f2e715879f838af2e31d0b225c786ddeca086df5f685d4ed481ed70e75b8d34760936a7193f62bfcd37c94416e209952cbf0d6f0a3774a6baf61281e2f6d5515

Download Submit
C:\Windows\System\wYbvmFM.exe

Filesize
18B

MD5
69949a16428cf7e91e16ecdbbbab0f02

SHA1
1bc1b083758681dcffdfa5fa5685d6e92b962d88

SHA256
2be943b1ef11e32fd01cd1d56d41e85e87f5cb46820e52d7de606f63654bf5da

SHA512
d5ffad16f872bbff18949218ec79dceedbbc88a99af414a13b6c7d08a90c4285a65335c6cfe31a1901e5a91add08957302ef854059054f89c6e4b91731c6b7a4

Download Submit
C:\Windows\System\wuxcIOa.exe

Filesize
1.7MB

MD5
fdd71f45ae64705d225befbd58e3e236

SHA1
9a1e90b4c64395d86e501cc4aeb4132c1d392cb3

SHA256
a45f49f9f655d003347e3dcc0df0f65dd2716ab3cff6908b7785c63dc9f2db40

SHA512
70b8a45b9843faed6921df96756e064bd5c66f9020dd7d2782753207abefcd16115ad36435648b726c62538cbc2be9635e605f63c53a87761d2bcae9b42859f6

Download Submit
C:\Windows\System\yjrUULO.exe

Filesize
1.7MB

MD5
22bbe8e6410f2322a1ca501eb47106f0

SHA1
a0aa1b9eda35fae06aa9f9641d9eb633313ecf8e

SHA256
aa91f345daf10d4b6ecbe07612f410b91ce02501c6f1d64d1361d760715940b5

SHA512
a1687576faa314b4ca8df70c555bb8ff646815c15e841c60b61adeaf4034a2d3ad5f418ffd376a2e18f53541577268d4f436309f141017c54a4dd4957b8e133d

Download Submit
memory/60-141-0x00007FF719EB0000-0x00007FF71A2A2000-memory.dmp

Filesize
3.9MB

Download
memory/972-76-0x00007FF6D7A70000-0x00007FF6D7E62000-memory.dmp

Filesize
3.9MB

Download
memory/1428-99-0x00007FF705F20000-0x00007FF706312000-memory.dmp

Filesize
3.9MB

Download
memory/1516-129-0x00007FF7E1100000-0x00007FF7E14F2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-4382-0x00007FF7E1100000-0x00007FF7E14F2000-memory.dmp

Filesize
3.9MB

Download
memory/1552-140-0x00007FFC22A70000-0x00007FFC23531000-memory.dmp

Filesize
10.8MB

Download
memory/1552-13-0x00007FFC22A70000-0x00007FFC23531000-memory.dmp

Filesize
10.8MB

Download
memory/1552-17-0x0000027A30860000-0x0000027A30870000-memory.dmp

Filesize
64KB

Download
memory/1552-32-0x0000027A307E0000-0x0000027A30802000-memory.dmp

Filesize
136KB

Download
memory/2108-148-0x00007FF7267D0000-0x00007FF726BC2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-33-0x00007FF7267D0000-0x00007FF726BC2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-149-0x00007FF627D00000-0x00007FF6280F2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-39-0x00007FF627D00000-0x00007FF6280F2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-111-0x00007FF61CB90000-0x00007FF61CF82000-memory.dmp

Filesize
3.9MB

Download
memory/2912-75-0x00007FF778570000-0x00007FF778962000-memory.dmp

Filesize
3.9MB

Download
memory/3200-42-0x00007FF71A880000-0x00007FF71AC72000-memory.dmp

Filesize
3.9MB

Download
memory/3368-142-0x00007FF69B800000-0x00007FF69BBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-1413-0x00007FF7C56C0000-0x00007FF7C5AB2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-48-0x00007FF7C56C0000-0x00007FF7C5AB2000-memory.dmp

Filesize
3.9MB

Download
memory/3752-2686-0x00007FF7C6380000-0x00007FF7C6772000-memory.dmp

Filesize
3.9MB

Download
memory/3752-93-0x00007FF7C6380000-0x00007FF7C6772000-memory.dmp

Filesize
3.9MB

Download
memory/3772-83-0x00007FF648AD0000-0x00007FF648EC2000-memory.dmp

Filesize
3.9MB

Download
memory/3840-69-0x00007FF65D480000-0x00007FF65D872000-memory.dmp

Filesize
3.9MB

Download
memory/3876-0-0x00007FF71C570000-0x00007FF71C962000-memory.dmp

Filesize
3.9MB

Download
memory/3876-1-0x000001827C610000-0x000001827C620000-memory.dmp

Filesize
64KB

Download
memory/3876-117-0x00007FF71C570000-0x00007FF71C962000-memory.dmp

Filesize
3.9MB

Download
memory/4328-105-0x00007FF627B50000-0x00007FF627F42000-memory.dmp

Filesize
3.9MB

Download
memory/4528-123-0x00007FF6D8990000-0x00007FF6D8D82000-memory.dmp

Filesize
3.9MB

Download
memory/4616-155-0x00007FF79B4C0000-0x00007FF79B8B2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-80-0x00007FF693770000-0x00007FF693B62000-memory.dmp

Filesize
3.9MB

Download
memory/5008-54-0x00007FF6A6760000-0x00007FF6A6B52000-memory.dmp

Filesize
3.9MB

Download
memory/5064-63-0x00007FF6D2A70000-0x00007FF6D2E62000-memory.dmp

Filesize
3.9MB

Download
memory/5064-1412-0x00007FF6D2A70000-0x00007FF6D2E62000-memory.dmp

Filesize
3.9MB

Download
memory/5100-89-0x00007FF7EC650000-0x00007FF7ECA42000-memory.dmp

Filesize
3.9MB

Download