xmrig | 11380006e6ccda4994f8413986ce5e2f3c5146ab3e1fdc77f740ece32e3fdad5

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
Size

1.7MB
MD5

087beeb1c01f911bd2d3c31cad92279f
SHA1

965887f9f3ce01e1c5db997ef0810c15496f189b
SHA256

11380006e6ccda4994f8413986ce5e2f3c5146ab3e1fdc77f740ece32e3fdad5
SHA512

72161687454e25f7e9ddfe18b9d3d2d9d507223666180f1b367ac3b63bf36a65d8d60dc1a8bf5e0756436c4bc2ddb586e0f08464310c953ba5a3f98d9616fca5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDB:NABo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral2/memory/952-35-0x00007FF7E8340000-0x00007FF7E8732000-memory.dmp	xmrig
behavioral2/memory/3196-46-0x00007FF66EA60000-0x00007FF66EE52000-memory.dmp	xmrig
behavioral2/memory/2080-499-0x00007FF6A6F60000-0x00007FF6A7352000-memory.dmp	xmrig
behavioral2/memory/2452-560-0x00007FF723C20000-0x00007FF724012000-memory.dmp	xmrig
behavioral2/memory/980-582-0x00007FF62A830000-0x00007FF62AC22000-memory.dmp	xmrig
behavioral2/memory/1584-564-0x00007FF7AF280000-0x00007FF7AF672000-memory.dmp	xmrig
behavioral2/memory/1304-547-0x00007FF6F5620000-0x00007FF6F5A12000-memory.dmp	xmrig
behavioral2/memory/1328-546-0x00007FF744D70000-0x00007FF745162000-memory.dmp	xmrig
behavioral2/memory/1876-524-0x00007FF75C9C0000-0x00007FF75CDB2000-memory.dmp	xmrig
behavioral2/memory/2524-518-0x00007FF6D8040000-0x00007FF6D8432000-memory.dmp	xmrig
behavioral2/memory/4820-513-0x00007FF7C3030000-0x00007FF7C3422000-memory.dmp	xmrig
behavioral2/memory/3192-509-0x00007FF633880000-0x00007FF633C72000-memory.dmp	xmrig
behavioral2/memory/2072-68-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp	xmrig
behavioral2/memory/4576-62-0x00007FF66F550000-0x00007FF66F942000-memory.dmp	xmrig
behavioral2/memory/5032-58-0x00007FF7CA4D0000-0x00007FF7CA8C2000-memory.dmp	xmrig
behavioral2/memory/1548-57-0x00007FF7D89B0000-0x00007FF7D8DA2000-memory.dmp	xmrig
behavioral2/memory/1320-41-0x00007FF6F57F0000-0x00007FF6F5BE2000-memory.dmp	xmrig
behavioral2/memory/4408-2841-0x00007FF7AB080000-0x00007FF7AB472000-memory.dmp	xmrig
behavioral2/memory/2072-3201-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp	xmrig
behavioral2/memory/3192-4246-0x00007FF633880000-0x00007FF633C72000-memory.dmp	xmrig
behavioral2/memory/1328-4298-0x00007FF744D70000-0x00007FF745162000-memory.dmp	xmrig
behavioral2/memory/980-4306-0x00007FF62A830000-0x00007FF62AC22000-memory.dmp	xmrig
behavioral2/memory/2452-4304-0x00007FF723C20000-0x00007FF724012000-memory.dmp	xmrig
behavioral2/memory/1304-4302-0x00007FF6F5620000-0x00007FF6F5A12000-memory.dmp	xmrig
behavioral2/memory/1584-4301-0x00007FF7AF280000-0x00007FF7AF672000-memory.dmp	xmrig
behavioral2/memory/2524-4294-0x00007FF6D8040000-0x00007FF6D8432000-memory.dmp	xmrig
behavioral2/memory/2812-4793-0x00007FF6670B0000-0x00007FF6674A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4408	IzvMTmp.exe
1548	qAbDNiC.exe
952	SeQWNNb.exe
5032	IPzhtHi.exe
1320	IBmgRDr.exe
3196	RiqAcUl.exe
4576	aVeJExJ.exe
2072	dAZpSmu.exe
3272	EJuCaTy.exe
2648	UJnKuGS.exe
2812	WMkRyMq.exe
2080	vlecHxZ.exe
3192	lbfFXSC.exe
4820	DNkaBsH.exe
2524	fOWDBMl.exe
1876	ZFfLxNs.exe
1328	BGPNyxL.exe
1304	kngKrMZ.exe
2452	wZALzvE.exe
1584	rWlKVum.exe
980	uRBCYcV.exe
1408	uzGJJKy.exe
3360	ZHvMvmS.exe
4808	otAMlhR.exe
1808	CoImhoJ.exe
3452	WuGZSqZ.exe
3696	BoHTieI.exe
2020	KlXgCWI.exe
4956	hUjDAJF.exe
1640	njcgiPm.exe
2468	knKVAMo.exe
3800	rDKiqnB.exe
2016	dROcDoA.exe
4220	HCJWCJA.exe
4988	awOZqGI.exe
3468	IgWDBRY.exe
3892	vyhNUEA.exe
4432	IyNWerl.exe
4068	cjfAdva.exe
4504	ulhxEhj.exe
3120	HqIEQSu.exe
1720	HMDBURh.exe
4516	CeoikiY.exe
4848	IVOwpMp.exe
996	PiPwojH.exe
4064	rlPmJGg.exe
3748	YidZcFB.exe
3372	FMKptCZ.exe
2536	YeVDFGd.exe
2232	jVegQyq.exe
4628	XvueONI.exe
988	iLeKtsk.exe
4736	jvcHXRL.exe
1996	yRZzGIN.exe
4324	ozVysGj.exe
3992	JBIzcLB.exe
2984	NIgUNGa.exe
1412	DJDkalp.exe
2448	LSZfCoX.exe
3340	gwuxUca.exe
1624	KROIdJg.exe
3840	BsvTduD.exe
4544	LRdwJvz.exe
2576	eOlZBxA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2204-0-0x00007FF7687F0000-0x00007FF768BE2000-memory.dmp	upx
behavioral2/files/0x000b000000023b97-5.dat	upx
behavioral2/files/0x000a000000023b9c-11.dat	upx
behavioral2/files/0x000a000000023b9b-10.dat	upx
behavioral2/files/0x000a000000023b9e-23.dat	upx
behavioral2/files/0x000a000000023b9f-31.dat	upx
behavioral2/memory/952-35-0x00007FF7E8340000-0x00007FF7E8732000-memory.dmp	upx
behavioral2/memory/3196-46-0x00007FF66EA60000-0x00007FF66EE52000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-66.dat	upx
behavioral2/memory/3272-72-0x00007FF7B5290000-0x00007FF7B5682000-memory.dmp	upx
behavioral2/memory/2648-76-0x00007FF68B440000-0x00007FF68B832000-memory.dmp	upx
behavioral2/memory/2812-79-0x00007FF6670B0000-0x00007FF6674A2000-memory.dmp	upx
behavioral2/files/0x000b000000023ba3-91.dat	upx
behavioral2/files/0x000a000000023ba8-109.dat	upx
behavioral2/files/0x000a000000023baa-119.dat	upx
behavioral2/files/0x000a000000023bac-129.dat	upx
behavioral2/files/0x000a000000023bb1-154.dat	upx
behavioral2/files/0x000a000000023bb4-169.dat	upx
behavioral2/files/0x0031000000023bb7-184.dat	upx
behavioral2/memory/2080-499-0x00007FF6A6F60000-0x00007FF6A7352000-memory.dmp	upx
behavioral2/memory/2452-560-0x00007FF723C20000-0x00007FF724012000-memory.dmp	upx
behavioral2/memory/980-582-0x00007FF62A830000-0x00007FF62AC22000-memory.dmp	upx
behavioral2/memory/1584-564-0x00007FF7AF280000-0x00007FF7AF672000-memory.dmp	upx
behavioral2/memory/1304-547-0x00007FF6F5620000-0x00007FF6F5A12000-memory.dmp	upx
behavioral2/memory/1328-546-0x00007FF744D70000-0x00007FF745162000-memory.dmp	upx
behavioral2/memory/1876-524-0x00007FF75C9C0000-0x00007FF75CDB2000-memory.dmp	upx
behavioral2/memory/2524-518-0x00007FF6D8040000-0x00007FF6D8432000-memory.dmp	upx
behavioral2/memory/4820-513-0x00007FF7C3030000-0x00007FF7C3422000-memory.dmp	upx
behavioral2/memory/3192-509-0x00007FF633880000-0x00007FF633C72000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-186.dat	upx
behavioral2/files/0x0031000000023bb8-181.dat	upx
behavioral2/files/0x0031000000023bb6-179.dat	upx
behavioral2/files/0x000a000000023bb5-174.dat	upx
behavioral2/files/0x000a000000023bb3-164.dat	upx
behavioral2/files/0x000a000000023bb2-159.dat	upx
behavioral2/files/0x000a000000023bb0-149.dat	upx
behavioral2/files/0x000a000000023baf-144.dat	upx
behavioral2/files/0x000a000000023bae-139.dat	upx
behavioral2/files/0x000a000000023bad-134.dat	upx
behavioral2/files/0x000a000000023bab-124.dat	upx
behavioral2/files/0x000a000000023ba9-114.dat	upx
behavioral2/files/0x000a000000023ba7-104.dat	upx
behavioral2/files/0x000b000000023b98-94.dat	upx
behavioral2/files/0x000a000000023ba6-86.dat	upx
behavioral2/files/0x000b000000023ba4-80.dat	upx
behavioral2/files/0x000a000000023ba5-77.dat	upx
behavioral2/files/0x000a000000023ba2-74.dat	upx
behavioral2/memory/2072-68-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp	upx
behavioral2/memory/4576-62-0x00007FF66F550000-0x00007FF66F942000-memory.dmp	upx
behavioral2/memory/5032-58-0x00007FF7CA4D0000-0x00007FF7CA8C2000-memory.dmp	upx
behavioral2/memory/1548-57-0x00007FF7D89B0000-0x00007FF7D8DA2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-44.dat	upx
behavioral2/memory/1320-41-0x00007FF6F57F0000-0x00007FF6F5BE2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-24.dat	upx
behavioral2/memory/4408-13-0x00007FF7AB080000-0x00007FF7AB472000-memory.dmp	upx
behavioral2/memory/4408-2841-0x00007FF7AB080000-0x00007FF7AB472000-memory.dmp	upx
behavioral2/memory/2072-3201-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp	upx
behavioral2/memory/3192-4246-0x00007FF633880000-0x00007FF633C72000-memory.dmp	upx
behavioral2/memory/1328-4298-0x00007FF744D70000-0x00007FF745162000-memory.dmp	upx
behavioral2/memory/980-4306-0x00007FF62A830000-0x00007FF62AC22000-memory.dmp	upx
behavioral2/memory/2452-4304-0x00007FF723C20000-0x00007FF724012000-memory.dmp	upx
behavioral2/memory/1304-4302-0x00007FF6F5620000-0x00007FF6F5A12000-memory.dmp	upx
behavioral2/memory/1584-4301-0x00007FF7AF280000-0x00007FF7AF672000-memory.dmp	upx
behavioral2/memory/2524-4294-0x00007FF6D8040000-0x00007FF6D8432000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ksZijtY.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\fvuUqfR.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\WKuKkBN.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\MFdHDVY.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\YkxPyoG.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\foPwFGc.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\snnaITH.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\RruVsIY.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\nbOrqpa.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\OHkhqBc.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\LIisqxz.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\eDxUQuQ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\laapWeG.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\KzXYNDQ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\MjFiFFd.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\hmQJauS.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\gYKNKgT.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\CgJAlUc.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\gSRJqkm.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\VURTcgE.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\TwGuyac.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\tkMrzxY.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\mDOhjmQ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\mJKxozz.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\xZmCTWd.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\iwhzezJ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\OaxhRGo.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\tXCVXul.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\ntDYkGg.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\UrsnzJr.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\khfFeRr.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\IsPiRyz.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\NViXtZv.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\iCfehEA.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\rPVlPdq.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\JEdZeGi.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\WXyYsCz.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\sdjYwPq.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\tkAyFcK.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\eKOCdMU.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\vEkILuN.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\DXfoJlK.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\QwRlndv.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\dBGERXk.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\QvbfvHU.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\YWXQvtd.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\GqToFYA.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\AdIEMDG.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\FUxPNIv.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\otpklcx.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\MWRTazF.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\RwwsCNf.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\OnzYzFn.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\YIqhGiS.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\VLrpAWh.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\wjgAlvj.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\CuJXZqk.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\ptUAThy.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\fMcOXkK.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\OBEnvLf.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\ptkQoSO.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\ngnsNOA.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\EchyjyP.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\pZdxTfa.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2532	powershell.exe
2532	powershell.exe
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeCreateGlobalPrivilege	3596	dwm.exe
Token: SeChangeNotifyPrivilege	3596	dwm.exe
Token: 33	3596	dwm.exe
Token: SeIncBasePriorityPrivilege	3596	dwm.exe
Token: SeShutdownPrivilege	3596	dwm.exe
Token: SeCreatePagefilePrivilege	3596	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2532	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	85
PID 2204 wrote to memory of 2532	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	85
PID 2204 wrote to memory of 4408	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	86
PID 2204 wrote to memory of 4408	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	86
PID 2204 wrote to memory of 1548	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	87
PID 2204 wrote to memory of 1548	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	87
PID 2204 wrote to memory of 952	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	88
PID 2204 wrote to memory of 952	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	88
PID 2204 wrote to memory of 5032	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	89
PID 2204 wrote to memory of 5032	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	89
PID 2204 wrote to memory of 1320	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	90
PID 2204 wrote to memory of 1320	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	90
PID 2204 wrote to memory of 3196	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	91
PID 2204 wrote to memory of 3196	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	91
PID 2204 wrote to memory of 4576	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	92
PID 2204 wrote to memory of 4576	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	92
PID 2204 wrote to memory of 2072	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	93
PID 2204 wrote to memory of 2072	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	93
PID 2204 wrote to memory of 3272	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	94
PID 2204 wrote to memory of 3272	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	94
PID 2204 wrote to memory of 2648	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	95
PID 2204 wrote to memory of 2648	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	95
PID 2204 wrote to memory of 2812	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	96
PID 2204 wrote to memory of 2812	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	96
PID 2204 wrote to memory of 2080	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	97
PID 2204 wrote to memory of 2080	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	97
PID 2204 wrote to memory of 3192	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	98
PID 2204 wrote to memory of 3192	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	98
PID 2204 wrote to memory of 4820	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	99
PID 2204 wrote to memory of 4820	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	99
PID 2204 wrote to memory of 2524	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	100
PID 2204 wrote to memory of 2524	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	100
PID 2204 wrote to memory of 1876	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	101
PID 2204 wrote to memory of 1876	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	101
PID 2204 wrote to memory of 1328	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	102
PID 2204 wrote to memory of 1328	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	102
PID 2204 wrote to memory of 1304	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	103
PID 2204 wrote to memory of 1304	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	103
PID 2204 wrote to memory of 2452	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	104
PID 2204 wrote to memory of 2452	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	104
PID 2204 wrote to memory of 1584	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	105
PID 2204 wrote to memory of 1584	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	105
PID 2204 wrote to memory of 980	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	106
PID 2204 wrote to memory of 980	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	106
PID 2204 wrote to memory of 1408	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	107
PID 2204 wrote to memory of 1408	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	107
PID 2204 wrote to memory of 3360	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	108
PID 2204 wrote to memory of 3360	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	108
PID 2204 wrote to memory of 4808	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	109
PID 2204 wrote to memory of 4808	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	109
PID 2204 wrote to memory of 1808	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	110
PID 2204 wrote to memory of 1808	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	110
PID 2204 wrote to memory of 3452	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	111
PID 2204 wrote to memory of 3452	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	111
PID 2204 wrote to memory of 3696	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	112
PID 2204 wrote to memory of 3696	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	112
PID 2204 wrote to memory of 2020	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	113
PID 2204 wrote to memory of 2020	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	113
PID 2204 wrote to memory of 4956	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	114
PID 2204 wrote to memory of 4956	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	114
PID 2204 wrote to memory of 1640	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	115
PID 2204 wrote to memory of 1640	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	115
PID 2204 wrote to memory of 2468	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	116
PID 2204 wrote to memory of 2468	2204	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\System\IzvMTmp.exe
  C:\Windows\System\IzvMTmp.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\qAbDNiC.exe
  C:\Windows\System\qAbDNiC.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\SeQWNNb.exe
  C:\Windows\System\SeQWNNb.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\IPzhtHi.exe
  C:\Windows\System\IPzhtHi.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\IBmgRDr.exe
  C:\Windows\System\IBmgRDr.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\RiqAcUl.exe
  C:\Windows\System\RiqAcUl.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\aVeJExJ.exe
  C:\Windows\System\aVeJExJ.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\dAZpSmu.exe
  C:\Windows\System\dAZpSmu.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\EJuCaTy.exe
  C:\Windows\System\EJuCaTy.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\UJnKuGS.exe
  C:\Windows\System\UJnKuGS.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\WMkRyMq.exe
  C:\Windows\System\WMkRyMq.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\vlecHxZ.exe
  C:\Windows\System\vlecHxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\lbfFXSC.exe
  C:\Windows\System\lbfFXSC.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\DNkaBsH.exe
  C:\Windows\System\DNkaBsH.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\fOWDBMl.exe
  C:\Windows\System\fOWDBMl.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\ZFfLxNs.exe
  C:\Windows\System\ZFfLxNs.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\BGPNyxL.exe
  C:\Windows\System\BGPNyxL.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\kngKrMZ.exe
  C:\Windows\System\kngKrMZ.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\wZALzvE.exe
  C:\Windows\System\wZALzvE.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\rWlKVum.exe
  C:\Windows\System\rWlKVum.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\uRBCYcV.exe
  C:\Windows\System\uRBCYcV.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\uzGJJKy.exe
  C:\Windows\System\uzGJJKy.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\ZHvMvmS.exe
  C:\Windows\System\ZHvMvmS.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\otAMlhR.exe
  C:\Windows\System\otAMlhR.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\CoImhoJ.exe
  C:\Windows\System\CoImhoJ.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\WuGZSqZ.exe
  C:\Windows\System\WuGZSqZ.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\BoHTieI.exe
  C:\Windows\System\BoHTieI.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\KlXgCWI.exe
  C:\Windows\System\KlXgCWI.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\hUjDAJF.exe
  C:\Windows\System\hUjDAJF.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\njcgiPm.exe
  C:\Windows\System\njcgiPm.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\knKVAMo.exe
  C:\Windows\System\knKVAMo.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\rDKiqnB.exe
  C:\Windows\System\rDKiqnB.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\dROcDoA.exe
  C:\Windows\System\dROcDoA.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\HCJWCJA.exe
  C:\Windows\System\HCJWCJA.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\awOZqGI.exe
  C:\Windows\System\awOZqGI.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\IgWDBRY.exe
  C:\Windows\System\IgWDBRY.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\vyhNUEA.exe
  C:\Windows\System\vyhNUEA.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\IyNWerl.exe
  C:\Windows\System\IyNWerl.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\cjfAdva.exe
  C:\Windows\System\cjfAdva.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\ulhxEhj.exe
  C:\Windows\System\ulhxEhj.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\HqIEQSu.exe
  C:\Windows\System\HqIEQSu.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\HMDBURh.exe
  C:\Windows\System\HMDBURh.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\CeoikiY.exe
  C:\Windows\System\CeoikiY.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\IVOwpMp.exe
  C:\Windows\System\IVOwpMp.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\PiPwojH.exe
  C:\Windows\System\PiPwojH.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\rlPmJGg.exe
  C:\Windows\System\rlPmJGg.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\YidZcFB.exe
  C:\Windows\System\YidZcFB.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\FMKptCZ.exe
  C:\Windows\System\FMKptCZ.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\YeVDFGd.exe
  C:\Windows\System\YeVDFGd.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\jVegQyq.exe
  C:\Windows\System\jVegQyq.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\XvueONI.exe
  C:\Windows\System\XvueONI.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\iLeKtsk.exe
  C:\Windows\System\iLeKtsk.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\jvcHXRL.exe
  C:\Windows\System\jvcHXRL.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\yRZzGIN.exe
  C:\Windows\System\yRZzGIN.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\ozVysGj.exe
  C:\Windows\System\ozVysGj.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\JBIzcLB.exe
  C:\Windows\System\JBIzcLB.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\NIgUNGa.exe
  C:\Windows\System\NIgUNGa.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\DJDkalp.exe
  C:\Windows\System\DJDkalp.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\LSZfCoX.exe
  C:\Windows\System\LSZfCoX.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\gwuxUca.exe
  C:\Windows\System\gwuxUca.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\KROIdJg.exe
  C:\Windows\System\KROIdJg.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\BsvTduD.exe
  C:\Windows\System\BsvTduD.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\LRdwJvz.exe
  C:\Windows\System\LRdwJvz.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\eOlZBxA.exe
  C:\Windows\System\eOlZBxA.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\WBNzyZm.exe
  C:\Windows\System\WBNzyZm.exe
  2⤵
  PID:3216
- C:\Windows\System\WErwYHB.exe
  C:\Windows\System\WErwYHB.exe
  2⤵
  PID:5044
- C:\Windows\System\IoMHmIK.exe
  C:\Windows\System\IoMHmIK.exe
  2⤵
  PID:5124
- C:\Windows\System\BoLPFSx.exe
  C:\Windows\System\BoLPFSx.exe
  2⤵
  PID:5148
- C:\Windows\System\zGfjwCt.exe
  C:\Windows\System\zGfjwCt.exe
  2⤵
  PID:5180
- C:\Windows\System\LEphvNl.exe
  C:\Windows\System\LEphvNl.exe
  2⤵
  PID:5208
- C:\Windows\System\BkhZpGh.exe
  C:\Windows\System\BkhZpGh.exe
  2⤵
  PID:5232
- C:\Windows\System\ljbpuep.exe
  C:\Windows\System\ljbpuep.exe
  2⤵
  PID:5260
- C:\Windows\System\fqwgKBy.exe
  C:\Windows\System\fqwgKBy.exe
  2⤵
  PID:5288
- C:\Windows\System\SLLUcVn.exe
  C:\Windows\System\SLLUcVn.exe
  2⤵
  PID:5312
- C:\Windows\System\IWiEucE.exe
  C:\Windows\System\IWiEucE.exe
  2⤵
  PID:5340
- C:\Windows\System\hHGtQdT.exe
  C:\Windows\System\hHGtQdT.exe
  2⤵
  PID:5372
- C:\Windows\System\trCFTcV.exe
  C:\Windows\System\trCFTcV.exe
  2⤵
  PID:5400
- C:\Windows\System\BYfEFjV.exe
  C:\Windows\System\BYfEFjV.exe
  2⤵
  PID:5428
- C:\Windows\System\cyYXbin.exe
  C:\Windows\System\cyYXbin.exe
  2⤵
  PID:5460
- C:\Windows\System\FeiyCHE.exe
  C:\Windows\System\FeiyCHE.exe
  2⤵
  PID:5484
- C:\Windows\System\NDqbtXU.exe
  C:\Windows\System\NDqbtXU.exe
  2⤵
  PID:5512
- C:\Windows\System\MjdWMZe.exe
  C:\Windows\System\MjdWMZe.exe
  2⤵
  PID:5540
- C:\Windows\System\MduFpgn.exe
  C:\Windows\System\MduFpgn.exe
  2⤵
  PID:5568
- C:\Windows\System\oEFMHLT.exe
  C:\Windows\System\oEFMHLT.exe
  2⤵
  PID:5596
- C:\Windows\System\gxKkRyc.exe
  C:\Windows\System\gxKkRyc.exe
  2⤵
  PID:5628
- C:\Windows\System\KsSFUry.exe
  C:\Windows\System\KsSFUry.exe
  2⤵
  PID:5652
- C:\Windows\System\KihPSVH.exe
  C:\Windows\System\KihPSVH.exe
  2⤵
  PID:5680
- C:\Windows\System\tkPvgxD.exe
  C:\Windows\System\tkPvgxD.exe
  2⤵
  PID:5708
- C:\Windows\System\jRQrPvm.exe
  C:\Windows\System\jRQrPvm.exe
  2⤵
  PID:5740
- C:\Windows\System\yhTvfPn.exe
  C:\Windows\System\yhTvfPn.exe
  2⤵
  PID:5768
- C:\Windows\System\xfXOJbh.exe
  C:\Windows\System\xfXOJbh.exe
  2⤵
  PID:5796
- C:\Windows\System\KqepHqw.exe
  C:\Windows\System\KqepHqw.exe
  2⤵
  PID:5824
- C:\Windows\System\NoKKbrv.exe
  C:\Windows\System\NoKKbrv.exe
  2⤵
  PID:5852
- C:\Windows\System\vydabeK.exe
  C:\Windows\System\vydabeK.exe
  2⤵
  PID:5876
- C:\Windows\System\fiewSaO.exe
  C:\Windows\System\fiewSaO.exe
  2⤵
  PID:5904
- C:\Windows\System\KPlIJBn.exe
  C:\Windows\System\KPlIJBn.exe
  2⤵
  PID:5936
- C:\Windows\System\oAMPngb.exe
  C:\Windows\System\oAMPngb.exe
  2⤵
  PID:5960
- C:\Windows\System\ZswwYkO.exe
  C:\Windows\System\ZswwYkO.exe
  2⤵
  PID:5988
- C:\Windows\System\ZbonWJG.exe
  C:\Windows\System\ZbonWJG.exe
  2⤵
  PID:6020
- C:\Windows\System\bSIIjWF.exe
  C:\Windows\System\bSIIjWF.exe
  2⤵
  PID:6048
- C:\Windows\System\GnbaAvK.exe
  C:\Windows\System\GnbaAvK.exe
  2⤵
  PID:6080
- C:\Windows\System\ccJvHug.exe
  C:\Windows\System\ccJvHug.exe
  2⤵
  PID:6104
- C:\Windows\System\ZxnVPgX.exe
  C:\Windows\System\ZxnVPgX.exe
  2⤵
  PID:6132
- C:\Windows\System\BaZJQUa.exe
  C:\Windows\System\BaZJQUa.exe
  2⤵
  PID:1272
- C:\Windows\System\JqRHwnP.exe
  C:\Windows\System\JqRHwnP.exe
  2⤵
  PID:940
- C:\Windows\System\GGsdrJM.exe
  C:\Windows\System\GGsdrJM.exe
  2⤵
  PID:4844
- C:\Windows\System\hrbnUPP.exe
  C:\Windows\System\hrbnUPP.exe
  2⤵
  PID:3484
- C:\Windows\System\VpaDyHH.exe
  C:\Windows\System\VpaDyHH.exe
  2⤵
  PID:3056
- C:\Windows\System\pwBAjop.exe
  C:\Windows\System\pwBAjop.exe
  2⤵
  PID:5160
- C:\Windows\System\cXVGFwn.exe
  C:\Windows\System\cXVGFwn.exe
  2⤵
  PID:5216
- C:\Windows\System\uShQHZe.exe
  C:\Windows\System\uShQHZe.exe
  2⤵
  PID:1756
- C:\Windows\System\FpCbvRK.exe
  C:\Windows\System\FpCbvRK.exe
  2⤵
  PID:5336
- C:\Windows\System\ZNJUCmU.exe
  C:\Windows\System\ZNJUCmU.exe
  2⤵
  PID:5468
- C:\Windows\System\WiRNQCG.exe
  C:\Windows\System\WiRNQCG.exe
  2⤵
  PID:5500
- C:\Windows\System\ZgOpTNj.exe
  C:\Windows\System\ZgOpTNj.exe
  2⤵
  PID:5528
- C:\Windows\System\YijPhXr.exe
  C:\Windows\System\YijPhXr.exe
  2⤵
  PID:5580
- C:\Windows\System\VvETVEv.exe
  C:\Windows\System\VvETVEv.exe
  2⤵
  PID:5644
- C:\Windows\System\QvbfvHU.exe
  C:\Windows\System\QvbfvHU.exe
  2⤵
  PID:5692
- C:\Windows\System\Atzzrsw.exe
  C:\Windows\System\Atzzrsw.exe
  2⤵
  PID:5756
- C:\Windows\System\wudOauT.exe
  C:\Windows\System\wudOauT.exe
  2⤵
  PID:5816
- C:\Windows\System\ZYoSrxN.exe
  C:\Windows\System\ZYoSrxN.exe
  2⤵
  PID:5888
- C:\Windows\System\mQVENPs.exe
  C:\Windows\System\mQVENPs.exe
  2⤵
  PID:5944
- C:\Windows\System\zQtlaqK.exe
  C:\Windows\System\zQtlaqK.exe
  2⤵
  PID:6000
- C:\Windows\System\fYwHWUm.exe
  C:\Windows\System\fYwHWUm.exe
  2⤵
  PID:6056
- C:\Windows\System\grgAbud.exe
  C:\Windows\System\grgAbud.exe
  2⤵
  PID:6112
- C:\Windows\System\lSjPiNv.exe
  C:\Windows\System\lSjPiNv.exe
  2⤵
  PID:4344
- C:\Windows\System\HZjZBfQ.exe
  C:\Windows\System\HZjZBfQ.exe
  2⤵
  PID:4512
- C:\Windows\System\ZeMJVTr.exe
  C:\Windows\System\ZeMJVTr.exe
  2⤵
  PID:5144
- C:\Windows\System\HxdBkjw.exe
  C:\Windows\System\HxdBkjw.exe
  2⤵
  PID:5248
- C:\Windows\System\TbAeZNC.exe
  C:\Windows\System\TbAeZNC.exe
  2⤵
  PID:5392
- C:\Windows\System\yVYFpVE.exe
  C:\Windows\System\yVYFpVE.exe
  2⤵
  PID:2504
- C:\Windows\System\NTuPUxU.exe
  C:\Windows\System\NTuPUxU.exe
  2⤵
  PID:5560
- C:\Windows\System\LqJzBSx.exe
  C:\Windows\System\LqJzBSx.exe
  2⤵
  PID:5720
- C:\Windows\System\YbqdCeO.exe
  C:\Windows\System\YbqdCeO.exe
  2⤵
  PID:5844
- C:\Windows\System\BskjfIW.exe
  C:\Windows\System\BskjfIW.exe
  2⤵
  PID:5920
- C:\Windows\System\uaipxsj.exe
  C:\Windows\System\uaipxsj.exe
  2⤵
  PID:4204
- C:\Windows\System\JJpUPps.exe
  C:\Windows\System\JJpUPps.exe
  2⤵
  PID:4108
- C:\Windows\System\dZcWcOw.exe
  C:\Windows\System\dZcWcOw.exe
  2⤵
  PID:4904
- C:\Windows\System\XDyMnNg.exe
  C:\Windows\System\XDyMnNg.exe
  2⤵
  PID:5364
- C:\Windows\System\MlFtlDK.exe
  C:\Windows\System\MlFtlDK.exe
  2⤵
  PID:1300
- C:\Windows\System\wTTWBfL.exe
  C:\Windows\System\wTTWBfL.exe
  2⤵
  PID:4640
- C:\Windows\System\FVsakSx.exe
  C:\Windows\System\FVsakSx.exe
  2⤵
  PID:4520
- C:\Windows\System\rXBpQsu.exe
  C:\Windows\System\rXBpQsu.exe
  2⤵
  PID:3336
- C:\Windows\System\lHzqBPL.exe
  C:\Windows\System\lHzqBPL.exe
  2⤵
  PID:1152
- C:\Windows\System\bzEgAdu.exe
  C:\Windows\System\bzEgAdu.exe
  2⤵
  PID:2160
- C:\Windows\System\lqakIkC.exe
  C:\Windows\System\lqakIkC.exe
  2⤵
  PID:2996
- C:\Windows\System\XcEAgoi.exe
  C:\Windows\System\XcEAgoi.exe
  2⤵
  PID:1576
- C:\Windows\System\rJgdosJ.exe
  C:\Windows\System\rJgdosJ.exe
  2⤵
  PID:464
- C:\Windows\System\WpPeTuy.exe
  C:\Windows\System\WpPeTuy.exe
  2⤵
  PID:4912
- C:\Windows\System\MGuArYL.exe
  C:\Windows\System\MGuArYL.exe
  2⤵
  PID:4288
- C:\Windows\System\VfPxdXq.exe
  C:\Windows\System\VfPxdXq.exe
  2⤵
  PID:2796
- C:\Windows\System\aDSHBPc.exe
  C:\Windows\System\aDSHBPc.exe
  2⤵
  PID:1816
- C:\Windows\System\zAkKwAF.exe
  C:\Windows\System\zAkKwAF.exe
  2⤵
  PID:4460
- C:\Windows\System\FxJGbNL.exe
  C:\Windows\System\FxJGbNL.exe
  2⤵
  PID:1656
- C:\Windows\System\lFcqGZN.exe
  C:\Windows\System\lFcqGZN.exe
  2⤵
  PID:6152
- C:\Windows\System\pyEktWI.exe
  C:\Windows\System\pyEktWI.exe
  2⤵
  PID:6208
- C:\Windows\System\EEPSfvg.exe
  C:\Windows\System\EEPSfvg.exe
  2⤵
  PID:6232
- C:\Windows\System\moBrDqr.exe
  C:\Windows\System\moBrDqr.exe
  2⤵
  PID:6248
- C:\Windows\System\wShYjcp.exe
  C:\Windows\System\wShYjcp.exe
  2⤵
  PID:6264
- C:\Windows\System\ZPVSloz.exe
  C:\Windows\System\ZPVSloz.exe
  2⤵
  PID:6300
- C:\Windows\System\WRWckoL.exe
  C:\Windows\System\WRWckoL.exe
  2⤵
  PID:6352
- C:\Windows\System\IpjbARs.exe
  C:\Windows\System\IpjbARs.exe
  2⤵
  PID:6368
- C:\Windows\System\ZyztBYY.exe
  C:\Windows\System\ZyztBYY.exe
  2⤵
  PID:6396
- C:\Windows\System\buJLZev.exe
  C:\Windows\System\buJLZev.exe
  2⤵
  PID:6416
- C:\Windows\System\ZouImIk.exe
  C:\Windows\System\ZouImIk.exe
  2⤵
  PID:6436
- C:\Windows\System\JQYisxH.exe
  C:\Windows\System\JQYisxH.exe
  2⤵
  PID:6452
- C:\Windows\System\ZRhpNJA.exe
  C:\Windows\System\ZRhpNJA.exe
  2⤵
  PID:6480
- C:\Windows\System\AbfSRJo.exe
  C:\Windows\System\AbfSRJo.exe
  2⤵
  PID:6548
- C:\Windows\System\anWoRwx.exe
  C:\Windows\System\anWoRwx.exe
  2⤵
  PID:6620
- C:\Windows\System\AoZGcLu.exe
  C:\Windows\System\AoZGcLu.exe
  2⤵
  PID:6644
- C:\Windows\System\IlPpvlN.exe
  C:\Windows\System\IlPpvlN.exe
  2⤵
  PID:6672
- C:\Windows\System\HXIrHun.exe
  C:\Windows\System\HXIrHun.exe
  2⤵
  PID:6708
- C:\Windows\System\SCEBZmC.exe
  C:\Windows\System\SCEBZmC.exe
  2⤵
  PID:6724
- C:\Windows\System\XCZkgHP.exe
  C:\Windows\System\XCZkgHP.exe
  2⤵
  PID:6748
- C:\Windows\System\CQQajZD.exe
  C:\Windows\System\CQQajZD.exe
  2⤵
  PID:6768
- C:\Windows\System\SyzpDKa.exe
  C:\Windows\System\SyzpDKa.exe
  2⤵
  PID:6796
- C:\Windows\System\MdVMfCV.exe
  C:\Windows\System\MdVMfCV.exe
  2⤵
  PID:6844
- C:\Windows\System\RHZCvTy.exe
  C:\Windows\System\RHZCvTy.exe
  2⤵
  PID:6872
- C:\Windows\System\jdTgVwp.exe
  C:\Windows\System\jdTgVwp.exe
  2⤵
  PID:6948
- C:\Windows\System\grMHNRn.exe
  C:\Windows\System\grMHNRn.exe
  2⤵
  PID:7020
- C:\Windows\System\zDSPwMf.exe
  C:\Windows\System\zDSPwMf.exe
  2⤵
  PID:7044
- C:\Windows\System\rGUxctg.exe
  C:\Windows\System\rGUxctg.exe
  2⤵
  PID:7068
- C:\Windows\System\nwcmSGr.exe
  C:\Windows\System\nwcmSGr.exe
  2⤵
  PID:7088
- C:\Windows\System\zabKavX.exe
  C:\Windows\System\zabKavX.exe
  2⤵
  PID:7108
- C:\Windows\System\MtXzsyQ.exe
  C:\Windows\System\MtXzsyQ.exe
  2⤵
  PID:7128
- C:\Windows\System\KDgVeGC.exe
  C:\Windows\System\KDgVeGC.exe
  2⤵
  PID:1968
- C:\Windows\System\PbjHFNk.exe
  C:\Windows\System\PbjHFNk.exe
  2⤵
  PID:6256
- C:\Windows\System\EmCMwAn.exe
  C:\Windows\System\EmCMwAn.exe
  2⤵
  PID:5308
- C:\Windows\System\JJowfty.exe
  C:\Windows\System\JJowfty.exe
  2⤵
  PID:2948
- C:\Windows\System\vuzFXxF.exe
  C:\Windows\System\vuzFXxF.exe
  2⤵
  PID:1060
- C:\Windows\System\tyoNlfG.exe
  C:\Windows\System\tyoNlfG.exe
  2⤵
  PID:6340
- C:\Windows\System\caAhzYZ.exe
  C:\Windows\System\caAhzYZ.exe
  2⤵
  PID:6228
- C:\Windows\System\CzwVndS.exe
  C:\Windows\System\CzwVndS.exe
  2⤵
  PID:6364
- C:\Windows\System\UauZxgb.exe
  C:\Windows\System\UauZxgb.exe
  2⤵
  PID:6412
- C:\Windows\System\MWRTazF.exe
  C:\Windows\System\MWRTazF.exe
  2⤵
  PID:6448
- C:\Windows\System\KPgREjl.exe
  C:\Windows\System\KPgREjl.exe
  2⤵
  PID:3312
- C:\Windows\System\uDkHgUI.exe
  C:\Windows\System\uDkHgUI.exe
  2⤵
  PID:4776
- C:\Windows\System\foPwFGc.exe
  C:\Windows\System\foPwFGc.exe
  2⤵
  PID:6660
- C:\Windows\System\kayglss.exe
  C:\Windows\System\kayglss.exe
  2⤵
  PID:6792
- C:\Windows\System\DZmeBfA.exe
  C:\Windows\System\DZmeBfA.exe
  2⤵
  PID:6756
- C:\Windows\System\MxhGLCD.exe
  C:\Windows\System\MxhGLCD.exe
  2⤵
  PID:6788
- C:\Windows\System\XrOxTUQ.exe
  C:\Windows\System\XrOxTUQ.exe
  2⤵
  PID:6932
- C:\Windows\System\SYDUbco.exe
  C:\Windows\System\SYDUbco.exe
  2⤵
  PID:7012
- C:\Windows\System\SiwfiCC.exe
  C:\Windows\System\SiwfiCC.exe
  2⤵
  PID:3280
- C:\Windows\System\sndXKYw.exe
  C:\Windows\System\sndXKYw.exe
  2⤵
  PID:7060
- C:\Windows\System\nPhWskq.exe
  C:\Windows\System\nPhWskq.exe
  2⤵
  PID:4928
- C:\Windows\System\AJiOqWe.exe
  C:\Windows\System\AJiOqWe.exe
  2⤵
  PID:6220
- C:\Windows\System\OgwLbZR.exe
  C:\Windows\System\OgwLbZR.exe
  2⤵
  PID:4876
- C:\Windows\System\MABnLPp.exe
  C:\Windows\System\MABnLPp.exe
  2⤵
  PID:5112
- C:\Windows\System\qFttyoS.exe
  C:\Windows\System\qFttyoS.exe
  2⤵
  PID:6244
- C:\Windows\System\vXsMyFb.exe
  C:\Windows\System\vXsMyFb.exe
  2⤵
  PID:6604
- C:\Windows\System\gCGweEg.exe
  C:\Windows\System\gCGweEg.exe
  2⤵
  PID:6636
- C:\Windows\System\IIKQLPn.exe
  C:\Windows\System\IIKQLPn.exe
  2⤵
  PID:6880
- C:\Windows\System\AiBxuAR.exe
  C:\Windows\System\AiBxuAR.exe
  2⤵
  PID:6784
- C:\Windows\System\OdnyDhJ.exe
  C:\Windows\System\OdnyDhJ.exe
  2⤵
  PID:7052
- C:\Windows\System\PBSDZnE.exe
  C:\Windows\System\PBSDZnE.exe
  2⤵
  PID:6184
- C:\Windows\System\VUyJeOZ.exe
  C:\Windows\System\VUyJeOZ.exe
  2⤵
  PID:6492
- C:\Windows\System\BXxpZZL.exe
  C:\Windows\System\BXxpZZL.exe
  2⤵
  PID:2172
- C:\Windows\System\NASbimp.exe
  C:\Windows\System\NASbimp.exe
  2⤵
  PID:6540
- C:\Windows\System\NCJGfNB.exe
  C:\Windows\System\NCJGfNB.exe
  2⤵
  PID:1532
- C:\Windows\System\AjNeCgc.exe
  C:\Windows\System\AjNeCgc.exe
  2⤵
  PID:6732
- C:\Windows\System\fqhLgNh.exe
  C:\Windows\System\fqhLgNh.exe
  2⤵
  PID:7188
- C:\Windows\System\OcfsxVV.exe
  C:\Windows\System\OcfsxVV.exe
  2⤵
  PID:7212
- C:\Windows\System\Vfidkej.exe
  C:\Windows\System\Vfidkej.exe
  2⤵
  PID:7256
- C:\Windows\System\qnrwRUx.exe
  C:\Windows\System\qnrwRUx.exe
  2⤵
  PID:7328
- C:\Windows\System\zqEaPLo.exe
  C:\Windows\System\zqEaPLo.exe
  2⤵
  PID:7348
- C:\Windows\System\BBHnheY.exe
  C:\Windows\System\BBHnheY.exe
  2⤵
  PID:7368
- C:\Windows\System\WzZJLKW.exe
  C:\Windows\System\WzZJLKW.exe
  2⤵
  PID:7400
- C:\Windows\System\tImneqp.exe
  C:\Windows\System\tImneqp.exe
  2⤵
  PID:7424
- C:\Windows\System\ZynAJXg.exe
  C:\Windows\System\ZynAJXg.exe
  2⤵
  PID:7452
- C:\Windows\System\jmivbif.exe
  C:\Windows\System\jmivbif.exe
  2⤵
  PID:7484
- C:\Windows\System\rvKDRfs.exe
  C:\Windows\System\rvKDRfs.exe
  2⤵
  PID:7512
- C:\Windows\System\IytgqcU.exe
  C:\Windows\System\IytgqcU.exe
  2⤵
  PID:7540
- C:\Windows\System\XCYvoCI.exe
  C:\Windows\System\XCYvoCI.exe
  2⤵
  PID:7564
- C:\Windows\System\zSMgMtv.exe
  C:\Windows\System\zSMgMtv.exe
  2⤵
  PID:7580
- C:\Windows\System\gyGrscw.exe
  C:\Windows\System\gyGrscw.exe
  2⤵
  PID:7596
- C:\Windows\System\oDIjAKz.exe
  C:\Windows\System\oDIjAKz.exe
  2⤵
  PID:7616
- C:\Windows\System\ZwCdYhV.exe
  C:\Windows\System\ZwCdYhV.exe
  2⤵
  PID:7640
- C:\Windows\System\JLSyycO.exe
  C:\Windows\System\JLSyycO.exe
  2⤵
  PID:7708
- C:\Windows\System\SWOkdte.exe
  C:\Windows\System\SWOkdte.exe
  2⤵
  PID:7752
- C:\Windows\System\abvKwiG.exe
  C:\Windows\System\abvKwiG.exe
  2⤵
  PID:7768
- C:\Windows\System\AoipIOx.exe
  C:\Windows\System\AoipIOx.exe
  2⤵
  PID:7792
- C:\Windows\System\taCcmTW.exe
  C:\Windows\System\taCcmTW.exe
  2⤵
  PID:7816
- C:\Windows\System\nqrBVvp.exe
  C:\Windows\System\nqrBVvp.exe
  2⤵
  PID:7836
- C:\Windows\System\KWqQhWu.exe
  C:\Windows\System\KWqQhWu.exe
  2⤵
  PID:7860
- C:\Windows\System\UfYWJgk.exe
  C:\Windows\System\UfYWJgk.exe
  2⤵
  PID:7876
- C:\Windows\System\LaIMxfr.exe
  C:\Windows\System\LaIMxfr.exe
  2⤵
  PID:7896
- C:\Windows\System\iTWmAeL.exe
  C:\Windows\System\iTWmAeL.exe
  2⤵
  PID:7912
- C:\Windows\System\xxpnuEl.exe
  C:\Windows\System\xxpnuEl.exe
  2⤵
  PID:7952
- C:\Windows\System\mJwGgHQ.exe
  C:\Windows\System\mJwGgHQ.exe
  2⤵
  PID:8024
- C:\Windows\System\TJBZZzR.exe
  C:\Windows\System\TJBZZzR.exe
  2⤵
  PID:8040
- C:\Windows\System\zmHXqvh.exe
  C:\Windows\System\zmHXqvh.exe
  2⤵
  PID:8084
- C:\Windows\System\XOctpVV.exe
  C:\Windows\System\XOctpVV.exe
  2⤵
  PID:8112
- C:\Windows\System\fwSingr.exe
  C:\Windows\System\fwSingr.exe
  2⤵
  PID:8128
- C:\Windows\System\NNIwwig.exe
  C:\Windows\System\NNIwwig.exe
  2⤵
  PID:8156
- C:\Windows\System\vpajWKO.exe
  C:\Windows\System\vpajWKO.exe
  2⤵
  PID:8176
- C:\Windows\System\zOyACum.exe
  C:\Windows\System\zOyACum.exe
  2⤵
  PID:7196
- C:\Windows\System\VxeFeNL.exe
  C:\Windows\System\VxeFeNL.exe
  2⤵
  PID:7144
- C:\Windows\System\mDcmiTV.exe
  C:\Windows\System\mDcmiTV.exe
  2⤵
  PID:7236
- C:\Windows\System\atCnclf.exe
  C:\Windows\System\atCnclf.exe
  2⤵
  PID:7320
- C:\Windows\System\pDBQtXT.exe
  C:\Windows\System\pDBQtXT.exe
  2⤵
  PID:7420
- C:\Windows\System\snnaITH.exe
  C:\Windows\System\snnaITH.exe
  2⤵
  PID:7520
- C:\Windows\System\pWfXDxj.exe
  C:\Windows\System\pWfXDxj.exe
  2⤵
  PID:7504
- C:\Windows\System\wLbYAcY.exe
  C:\Windows\System\wLbYAcY.exe
  2⤵
  PID:7660
- C:\Windows\System\ibwYAiW.exe
  C:\Windows\System\ibwYAiW.exe
  2⤵
  PID:7668
- C:\Windows\System\ygeVHtf.exe
  C:\Windows\System\ygeVHtf.exe
  2⤵
  PID:7728
- C:\Windows\System\WRhZBoi.exe
  C:\Windows\System\WRhZBoi.exe
  2⤵
  PID:7764
- C:\Windows\System\agxwLUQ.exe
  C:\Windows\System\agxwLUQ.exe
  2⤵
  PID:7800
- C:\Windows\System\kuTdgjM.exe
  C:\Windows\System\kuTdgjM.exe
  2⤵
  PID:7852
- C:\Windows\System\cTkkEOE.exe
  C:\Windows\System\cTkkEOE.exe
  2⤵
  PID:7988
- C:\Windows\System\IpxOQjD.exe
  C:\Windows\System\IpxOQjD.exe
  2⤵
  PID:8012
- C:\Windows\System\mETcmVG.exe
  C:\Windows\System\mETcmVG.exe
  2⤵
  PID:8108
- C:\Windows\System\KHNhWZR.exe
  C:\Windows\System\KHNhWZR.exe
  2⤵
  PID:8100
- C:\Windows\System\jwAweBg.exe
  C:\Windows\System\jwAweBg.exe
  2⤵
  PID:6472
- C:\Windows\System\jiZMmnQ.exe
  C:\Windows\System\jiZMmnQ.exe
  2⤵
  PID:6204
- C:\Windows\System\AazecMc.exe
  C:\Windows\System\AazecMc.exe
  2⤵
  PID:7364
- C:\Windows\System\rTiYaGD.exe
  C:\Windows\System\rTiYaGD.exe
  2⤵
  PID:7460
- C:\Windows\System\nIiRhUd.exe
  C:\Windows\System\nIiRhUd.exe
  2⤵
  PID:8004
- C:\Windows\System\yenBGex.exe
  C:\Windows\System\yenBGex.exe
  2⤵
  PID:8056
- C:\Windows\System\UbwDaBD.exe
  C:\Windows\System\UbwDaBD.exe
  2⤵
  PID:6780
- C:\Windows\System\JbQlsLG.exe
  C:\Windows\System\JbQlsLG.exe
  2⤵
  PID:7700
- C:\Windows\System\ZadhlLF.exe
  C:\Windows\System\ZadhlLF.exe
  2⤵
  PID:7832
- C:\Windows\System\aJdcTMv.exe
  C:\Windows\System\aJdcTMv.exe
  2⤵
  PID:8172
- C:\Windows\System\jlqOpMk.exe
  C:\Windows\System\jlqOpMk.exe
  2⤵
  PID:8092
- C:\Windows\System\MOQTocn.exe
  C:\Windows\System\MOQTocn.exe
  2⤵
  PID:8204
- C:\Windows\System\ivrBRsw.exe
  C:\Windows\System\ivrBRsw.exe
  2⤵
  PID:8244
- C:\Windows\System\nYlCfmj.exe
  C:\Windows\System\nYlCfmj.exe
  2⤵
  PID:8268
- C:\Windows\System\QusJhdG.exe
  C:\Windows\System\QusJhdG.exe
  2⤵
  PID:8288
- C:\Windows\System\QfHDKjb.exe
  C:\Windows\System\QfHDKjb.exe
  2⤵
  PID:8304
- C:\Windows\System\WzyZLvT.exe
  C:\Windows\System\WzyZLvT.exe
  2⤵
  PID:8328
- C:\Windows\System\NscLcRI.exe
  C:\Windows\System\NscLcRI.exe
  2⤵
  PID:8348
- C:\Windows\System\nqYWkCT.exe
  C:\Windows\System\nqYWkCT.exe
  2⤵
  PID:8372
- C:\Windows\System\UcDncKC.exe
  C:\Windows\System\UcDncKC.exe
  2⤵
  PID:8408
- C:\Windows\System\vZgZOlp.exe
  C:\Windows\System\vZgZOlp.exe
  2⤵
  PID:8428
- C:\Windows\System\DgzwlSb.exe
  C:\Windows\System\DgzwlSb.exe
  2⤵
  PID:8448
- C:\Windows\System\bXOJDzY.exe
  C:\Windows\System\bXOJDzY.exe
  2⤵
  PID:8472
- C:\Windows\System\JnAeGkN.exe
  C:\Windows\System\JnAeGkN.exe
  2⤵
  PID:8492
- C:\Windows\System\ZLMpBnA.exe
  C:\Windows\System\ZLMpBnA.exe
  2⤵
  PID:8516
- C:\Windows\System\yjDvXer.exe
  C:\Windows\System\yjDvXer.exe
  2⤵
  PID:8568
- C:\Windows\System\rjglluy.exe
  C:\Windows\System\rjglluy.exe
  2⤵
  PID:8588
- C:\Windows\System\yEedyXX.exe
  C:\Windows\System\yEedyXX.exe
  2⤵
  PID:8640
- C:\Windows\System\EqhxsuT.exe
  C:\Windows\System\EqhxsuT.exe
  2⤵
  PID:8656
- C:\Windows\System\RgfNyrF.exe
  C:\Windows\System\RgfNyrF.exe
  2⤵
  PID:8700
- C:\Windows\System\SmZktBw.exe
  C:\Windows\System\SmZktBw.exe
  2⤵
  PID:8740
- C:\Windows\System\prVTdth.exe
  C:\Windows\System\prVTdth.exe
  2⤵
  PID:8764
- C:\Windows\System\zscLnOn.exe
  C:\Windows\System\zscLnOn.exe
  2⤵
  PID:8796
- C:\Windows\System\TOZANBC.exe
  C:\Windows\System\TOZANBC.exe
  2⤵
  PID:8844
- C:\Windows\System\nCqPdhw.exe
  C:\Windows\System\nCqPdhw.exe
  2⤵
  PID:8860
- C:\Windows\System\wtSmtWQ.exe
  C:\Windows\System\wtSmtWQ.exe
  2⤵
  PID:8880
- C:\Windows\System\wGfBaGK.exe
  C:\Windows\System\wGfBaGK.exe
  2⤵
  PID:8920
- C:\Windows\System\mlckMAI.exe
  C:\Windows\System\mlckMAI.exe
  2⤵
  PID:8936
- C:\Windows\System\VyerhiJ.exe
  C:\Windows\System\VyerhiJ.exe
  2⤵
  PID:8960
- C:\Windows\System\hOTNEYW.exe
  C:\Windows\System\hOTNEYW.exe
  2⤵
  PID:8984
- C:\Windows\System\FkhBJZw.exe
  C:\Windows\System\FkhBJZw.exe
  2⤵
  PID:9036
- C:\Windows\System\QWxtUNV.exe
  C:\Windows\System\QWxtUNV.exe
  2⤵
  PID:9056
- C:\Windows\System\lDHJpCw.exe
  C:\Windows\System\lDHJpCw.exe
  2⤵
  PID:9096
- C:\Windows\System\pXeixXo.exe
  C:\Windows\System\pXeixXo.exe
  2⤵
  PID:9112
- C:\Windows\System\tLctIyb.exe
  C:\Windows\System\tLctIyb.exe
  2⤵
  PID:9128
- C:\Windows\System\TyPqods.exe
  C:\Windows\System\TyPqods.exe
  2⤵
  PID:9144
- C:\Windows\System\TMocsme.exe
  C:\Windows\System\TMocsme.exe
  2⤵
  PID:9164
- C:\Windows\System\urgqtrf.exe
  C:\Windows\System\urgqtrf.exe
  2⤵
  PID:9208
- C:\Windows\System\yjicSoy.exe
  C:\Windows\System\yjicSoy.exe
  2⤵
  PID:8196
- C:\Windows\System\sfHGnpk.exe
  C:\Windows\System\sfHGnpk.exe
  2⤵
  PID:8260
- C:\Windows\System\UFmGEOW.exe
  C:\Windows\System\UFmGEOW.exe
  2⤵
  PID:8336
- C:\Windows\System\tiCugAR.exe
  C:\Windows\System\tiCugAR.exe
  2⤵
  PID:8364
- C:\Windows\System\bvSOjer.exe
  C:\Windows\System\bvSOjer.exe
  2⤵
  PID:8488
- C:\Windows\System\wMfVhxs.exe
  C:\Windows\System\wMfVhxs.exe
  2⤵
  PID:8596
- C:\Windows\System\SgOqpLU.exe
  C:\Windows\System\SgOqpLU.exe
  2⤵
  PID:8604
- C:\Windows\System\tSyoheP.exe
  C:\Windows\System\tSyoheP.exe
  2⤵
  PID:8736
- C:\Windows\System\ZCWNiCl.exe
  C:\Windows\System\ZCWNiCl.exe
  2⤵
  PID:8756
- C:\Windows\System\ZiwOpPs.exe
  C:\Windows\System\ZiwOpPs.exe
  2⤵
  PID:8788
- C:\Windows\System\ATurwWC.exe
  C:\Windows\System\ATurwWC.exe
  2⤵
  PID:8852
- C:\Windows\System\TRrvNLY.exe
  C:\Windows\System\TRrvNLY.exe
  2⤵
  PID:8912
- C:\Windows\System\blzdIXH.exe
  C:\Windows\System\blzdIXH.exe
  2⤵
  PID:8980
- C:\Windows\System\BvMoqwV.exe
  C:\Windows\System\BvMoqwV.exe
  2⤵
  PID:9032
- C:\Windows\System\vQbKHWK.exe
  C:\Windows\System\vQbKHWK.exe
  2⤵
  PID:9092
- C:\Windows\System\jPcVJun.exe
  C:\Windows\System\jPcVJun.exe
  2⤵
  PID:9136
- C:\Windows\System\wCFnsMO.exe
  C:\Windows\System\wCFnsMO.exe
  2⤵
  PID:8232
- C:\Windows\System\zQzRsDk.exe
  C:\Windows\System\zQzRsDk.exe
  2⤵
  PID:9192
- C:\Windows\System\VjwTWTx.exe
  C:\Windows\System\VjwTWTx.exe
  2⤵
  PID:8276
- C:\Windows\System\yKDUTGr.exe
  C:\Windows\System\yKDUTGr.exe
  2⤵
  PID:8720
- C:\Windows\System\UIvoccV.exe
  C:\Windows\System\UIvoccV.exe
  2⤵
  PID:7468
- C:\Windows\System\roqWCDX.exe
  C:\Windows\System\roqWCDX.exe
  2⤵
  PID:9028
- C:\Windows\System\xxDNRwa.exe
  C:\Windows\System\xxDNRwa.exe
  2⤵
  PID:9120
- C:\Windows\System\fnVxWwp.exe
  C:\Windows\System\fnVxWwp.exe
  2⤵
  PID:8400
- C:\Windows\System\MXLtLuz.exe
  C:\Windows\System\MXLtLuz.exe
  2⤵
  PID:9104
- C:\Windows\System\qDtdjnl.exe
  C:\Windows\System\qDtdjnl.exe
  2⤵
  PID:8344
- C:\Windows\System\MRdmMXQ.exe
  C:\Windows\System\MRdmMXQ.exe
  2⤵
  PID:9232
- C:\Windows\System\QlZNTod.exe
  C:\Windows\System\QlZNTod.exe
  2⤵
  PID:9268
- C:\Windows\System\DRxOyuR.exe
  C:\Windows\System\DRxOyuR.exe
  2⤵
  PID:9288
- C:\Windows\System\WhpzZPd.exe
  C:\Windows\System\WhpzZPd.exe
  2⤵
  PID:9304
- C:\Windows\System\YJLVgto.exe
  C:\Windows\System\YJLVgto.exe
  2⤵
  PID:9324
- C:\Windows\System\FVmQnmT.exe
  C:\Windows\System\FVmQnmT.exe
  2⤵
  PID:9344
- C:\Windows\System\hflSCNS.exe
  C:\Windows\System\hflSCNS.exe
  2⤵
  PID:9364
- C:\Windows\System\ZKuzMZu.exe
  C:\Windows\System\ZKuzMZu.exe
  2⤵
  PID:9392
- C:\Windows\System\muaxfdx.exe
  C:\Windows\System\muaxfdx.exe
  2⤵
  PID:9412
- C:\Windows\System\YjVPIoV.exe
  C:\Windows\System\YjVPIoV.exe
  2⤵
  PID:9436
- C:\Windows\System\EGhUELg.exe
  C:\Windows\System\EGhUELg.exe
  2⤵
  PID:9464
- C:\Windows\System\lgDXTKv.exe
  C:\Windows\System\lgDXTKv.exe
  2⤵
  PID:9484
- C:\Windows\System\OLnvjkk.exe
  C:\Windows\System\OLnvjkk.exe
  2⤵
  PID:9504
- C:\Windows\System\XtyEPke.exe
  C:\Windows\System\XtyEPke.exe
  2⤵
  PID:9564
- C:\Windows\System\AIRARSQ.exe
  C:\Windows\System\AIRARSQ.exe
  2⤵
  PID:9604
- C:\Windows\System\GLKbQZC.exe
  C:\Windows\System\GLKbQZC.exe
  2⤵
  PID:9624
- C:\Windows\System\MNAyynd.exe
  C:\Windows\System\MNAyynd.exe
  2⤵
  PID:9648
- C:\Windows\System\AZckCva.exe
  C:\Windows\System\AZckCva.exe
  2⤵
  PID:9720
- C:\Windows\System\irjYUMz.exe
  C:\Windows\System\irjYUMz.exe
  2⤵
  PID:9744
- C:\Windows\System\cngrmhG.exe
  C:\Windows\System\cngrmhG.exe
  2⤵
  PID:9764
- C:\Windows\System\vSJYobW.exe
  C:\Windows\System\vSJYobW.exe
  2⤵
  PID:9784
- C:\Windows\System\XwOrSUB.exe
  C:\Windows\System\XwOrSUB.exe
  2⤵
  PID:9804
- C:\Windows\System\yJLHcsJ.exe
  C:\Windows\System\yJLHcsJ.exe
  2⤵
  PID:9820
- C:\Windows\System\RCJJbsu.exe
  C:\Windows\System\RCJJbsu.exe
  2⤵
  PID:9844
- C:\Windows\System\qUoypaA.exe
  C:\Windows\System\qUoypaA.exe
  2⤵
  PID:9864
- C:\Windows\System\jDzcnHJ.exe
  C:\Windows\System\jDzcnHJ.exe
  2⤵
  PID:9912
- C:\Windows\System\COernPh.exe
  C:\Windows\System\COernPh.exe
  2⤵
  PID:9964
- C:\Windows\System\meizblK.exe
  C:\Windows\System\meizblK.exe
  2⤵
  PID:10004
- C:\Windows\System\NuvVbUz.exe
  C:\Windows\System\NuvVbUz.exe
  2⤵
  PID:10044
- C:\Windows\System\utzOaxZ.exe
  C:\Windows\System\utzOaxZ.exe
  2⤵
  PID:10064
- C:\Windows\System\VJvDRhX.exe
  C:\Windows\System\VJvDRhX.exe
  2⤵
  PID:10088
- C:\Windows\System\wDKdwaw.exe
  C:\Windows\System\wDKdwaw.exe
  2⤵
  PID:10120
- C:\Windows\System\AiqFPsM.exe
  C:\Windows\System\AiqFPsM.exe
  2⤵
  PID:10152
- C:\Windows\System\XcVsYDh.exe
  C:\Windows\System\XcVsYDh.exe
  2⤵
  PID:10172
- C:\Windows\System\REBXdEA.exe
  C:\Windows\System\REBXdEA.exe
  2⤵
  PID:10212
- C:\Windows\System\rUFqcDp.exe
  C:\Windows\System\rUFqcDp.exe
  2⤵
  PID:10228
- C:\Windows\System\mLIrQbu.exe
  C:\Windows\System\mLIrQbu.exe
  2⤵
  PID:8280
- C:\Windows\System\IeBHloi.exe
  C:\Windows\System\IeBHloi.exe
  2⤵
  PID:9264
- C:\Windows\System\fRIRvdQ.exe
  C:\Windows\System\fRIRvdQ.exe
  2⤵
  PID:9360
- C:\Windows\System\GHgOzBe.exe
  C:\Windows\System\GHgOzBe.exe
  2⤵
  PID:9400
- C:\Windows\System\YCmdYfm.exe
  C:\Windows\System\YCmdYfm.exe
  2⤵
  PID:9460
- C:\Windows\System\lChhdiW.exe
  C:\Windows\System\lChhdiW.exe
  2⤵
  PID:9536
- C:\Windows\System\ZsVljGA.exe
  C:\Windows\System\ZsVljGA.exe
  2⤵
  PID:9596
- C:\Windows\System\xTeyHVJ.exe
  C:\Windows\System\xTeyHVJ.exe
  2⤵
  PID:9688
- C:\Windows\System\ridlwvz.exe
  C:\Windows\System\ridlwvz.exe
  2⤵
  PID:9704
- C:\Windows\System\zXDWiqR.exe
  C:\Windows\System\zXDWiqR.exe
  2⤵
  PID:9760
- C:\Windows\System\cqEqOeO.exe
  C:\Windows\System\cqEqOeO.exe
  2⤵
  PID:9860
- C:\Windows\System\AyMMfPp.exe
  C:\Windows\System\AyMMfPp.exe
  2⤵
  PID:9944
- C:\Windows\System\EEihCjS.exe
  C:\Windows\System\EEihCjS.exe
  2⤵
  PID:9960
- C:\Windows\System\bfkbUFG.exe
  C:\Windows\System\bfkbUFG.exe
  2⤵
  PID:10040
- C:\Windows\System\rwtBMgP.exe
  C:\Windows\System\rwtBMgP.exe
  2⤵
  PID:10144
- C:\Windows\System\RruVsIY.exe
  C:\Windows\System\RruVsIY.exe
  2⤵
  PID:10208
- C:\Windows\System\njEZTJF.exe
  C:\Windows\System\njEZTJF.exe
  2⤵
  PID:9256
- C:\Windows\System\SNLlwGx.exe
  C:\Windows\System\SNLlwGx.exe
  2⤵
  PID:9320
- C:\Windows\System\RsHrwNv.exe
  C:\Windows\System\RsHrwNv.exe
  2⤵
  PID:9384
- C:\Windows\System\jumistL.exe
  C:\Windows\System\jumistL.exe
  2⤵
  PID:9556
- C:\Windows\System\dWHWEOs.exe
  C:\Windows\System\dWHWEOs.exe
  2⤵
  PID:9616
- C:\Windows\System\MkBcGAu.exe
  C:\Windows\System\MkBcGAu.exe
  2⤵
  PID:9892
- C:\Windows\System\KRPiYDf.exe
  C:\Windows\System\KRPiYDf.exe
  2⤵
  PID:10256
- C:\Windows\System\TzMvpTO.exe
  C:\Windows\System\TzMvpTO.exe
  2⤵
  PID:10272
- C:\Windows\System\PGDvbwP.exe
  C:\Windows\System\PGDvbwP.exe
  2⤵
  PID:10288
- C:\Windows\System\oshvwAc.exe
  C:\Windows\System\oshvwAc.exe
  2⤵
  PID:10304
- C:\Windows\System\kJWfHvI.exe
  C:\Windows\System\kJWfHvI.exe
  2⤵
  PID:10320
- C:\Windows\System\SoLrhZG.exe
  C:\Windows\System\SoLrhZG.exe
  2⤵
  PID:10336
- C:\Windows\System\qOUfSdB.exe
  C:\Windows\System\qOUfSdB.exe
  2⤵
  PID:10352
- C:\Windows\System\QQqoYTK.exe
  C:\Windows\System\QQqoYTK.exe
  2⤵
  PID:10368
- C:\Windows\System\vUtZXku.exe
  C:\Windows\System\vUtZXku.exe
  2⤵
  PID:10428
- C:\Windows\System\YgBvbbV.exe
  C:\Windows\System\YgBvbbV.exe
  2⤵
  PID:10452
- C:\Windows\System\vvbOlfh.exe
  C:\Windows\System\vvbOlfh.exe
  2⤵
  PID:10468
- C:\Windows\System\ThQDFdA.exe
  C:\Windows\System\ThQDFdA.exe
  2⤵
  PID:10488
- C:\Windows\System\AvhjXQv.exe
  C:\Windows\System\AvhjXQv.exe
  2⤵
  PID:10504
- C:\Windows\System\ZYNrDDA.exe
  C:\Windows\System\ZYNrDDA.exe
  2⤵
  PID:10520
- C:\Windows\System\nIznVAb.exe
  C:\Windows\System\nIznVAb.exe
  2⤵
  PID:10536
- C:\Windows\System\oGEoXfr.exe
  C:\Windows\System\oGEoXfr.exe
  2⤵
  PID:10556
- C:\Windows\System\ClRiREo.exe
  C:\Windows\System\ClRiREo.exe
  2⤵
  PID:10576
- C:\Windows\System\NKhtuZV.exe
  C:\Windows\System\NKhtuZV.exe
  2⤵
  PID:10592
- C:\Windows\System\FWRmRzK.exe
  C:\Windows\System\FWRmRzK.exe
  2⤵
  PID:10648
- C:\Windows\System\sVnDwLR.exe
  C:\Windows\System\sVnDwLR.exe
  2⤵
  PID:10684
- C:\Windows\System\bsbfHuP.exe
  C:\Windows\System\bsbfHuP.exe
  2⤵
  PID:10712
- C:\Windows\System\tvzjjGF.exe
  C:\Windows\System\tvzjjGF.exe
  2⤵
  PID:10880
- C:\Windows\System\rZLtwct.exe
  C:\Windows\System\rZLtwct.exe
  2⤵
  PID:10920
- C:\Windows\System\SdUnnnA.exe
  C:\Windows\System\SdUnnnA.exe
  2⤵
  PID:10940
- C:\Windows\System\WldhwpQ.exe
  C:\Windows\System\WldhwpQ.exe
  2⤵
  PID:10968
- C:\Windows\System\YHrvqAQ.exe
  C:\Windows\System\YHrvqAQ.exe
  2⤵
  PID:10996
- C:\Windows\System\oljFtrz.exe
  C:\Windows\System\oljFtrz.exe
  2⤵
  PID:11028
- C:\Windows\System\zHKOTOC.exe
  C:\Windows\System\zHKOTOC.exe
  2⤵
  PID:11052
- C:\Windows\System\pkAPrwp.exe
  C:\Windows\System\pkAPrwp.exe
  2⤵
  PID:11092
- C:\Windows\System\rSPDuoR.exe
  C:\Windows\System\rSPDuoR.exe
  2⤵
  PID:11116
- C:\Windows\System\qMlJlLl.exe
  C:\Windows\System\qMlJlLl.exe
  2⤵
  PID:11144
- C:\Windows\System\Khyzfdl.exe
  C:\Windows\System\Khyzfdl.exe
  2⤵
  PID:11164
- C:\Windows\System\WckkFgC.exe
  C:\Windows\System\WckkFgC.exe
  2⤵
  PID:11184
- C:\Windows\System\RwAtTWi.exe
  C:\Windows\System\RwAtTWi.exe
  2⤵
  PID:11212
- C:\Windows\System\IFlHsIA.exe
  C:\Windows\System\IFlHsIA.exe
  2⤵
  PID:9924
- C:\Windows\System\FNDJAZl.exe
  C:\Windows\System\FNDJAZl.exe
  2⤵
  PID:9340
- C:\Windows\System\BTjfefq.exe
  C:\Windows\System\BTjfefq.exe
  2⤵
  PID:9756
- C:\Windows\System\NEkBvsO.exe
  C:\Windows\System\NEkBvsO.exe
  2⤵
  PID:9492
- C:\Windows\System\Ougkluh.exe
  C:\Windows\System\Ougkluh.exe
  2⤵
  PID:10104
- C:\Windows\System\pAZLAge.exe
  C:\Windows\System\pAZLAge.exe
  2⤵
  PID:10440
- C:\Windows\System\sqJsHSm.exe
  C:\Windows\System\sqJsHSm.exe
  2⤵
  PID:10300
- C:\Windows\System\hryFMhw.exe
  C:\Windows\System\hryFMhw.exe
  2⤵
  PID:10360
- C:\Windows\System\aVdeDaN.exe
  C:\Windows\System\aVdeDaN.exe
  2⤵
  PID:10384
- C:\Windows\System\bOpmchF.exe
  C:\Windows\System\bOpmchF.exe
  2⤵
  PID:10420
- C:\Windows\System\ofOOzDB.exe
  C:\Windows\System\ofOOzDB.exe
  2⤵
  PID:10484
- C:\Windows\System\czqrRys.exe
  C:\Windows\System\czqrRys.exe
  2⤵
  PID:10548
- C:\Windows\System\aZZGsso.exe
  C:\Windows\System\aZZGsso.exe
  2⤵
  PID:10644
- C:\Windows\System\pZNUFrW.exe
  C:\Windows\System\pZNUFrW.exe
  2⤵
  PID:10724
- C:\Windows\System\wwqaSFL.exe
  C:\Windows\System\wwqaSFL.exe
  2⤵
  PID:10732
- C:\Windows\System\EPptKsc.exe
  C:\Windows\System\EPptKsc.exe
  2⤵
  PID:10704
- C:\Windows\System\xHaQZdd.exe
  C:\Windows\System\xHaQZdd.exe
  2⤵
  PID:10876
- C:\Windows\System\XCwPTlN.exe
  C:\Windows\System\XCwPTlN.exe
  2⤵
  PID:10936
- C:\Windows\System\XiGENrG.exe
  C:\Windows\System\XiGENrG.exe
  2⤵
  PID:11084
- C:\Windows\System\YydroYx.exe
  C:\Windows\System\YydroYx.exe
  2⤵
  PID:11156
- C:\Windows\System\CfZOncy.exe
  C:\Windows\System\CfZOncy.exe
  2⤵
  PID:11208
- C:\Windows\System\wJbWpxM.exe
  C:\Windows\System\wJbWpxM.exe
  2⤵
  PID:9992
- C:\Windows\System\SxujJJc.exe
  C:\Windows\System\SxujJJc.exe
  2⤵
  PID:10416
- C:\Windows\System\XczQmUF.exe
  C:\Windows\System\XczQmUF.exe
  2⤵
  PID:10252
- C:\Windows\System\QvyUBxI.exe
  C:\Windows\System\QvyUBxI.exe
  2⤵
  PID:10348
- C:\Windows\System\rdsGTft.exe
  C:\Windows\System\rdsGTft.exe
  2⤵
  PID:10572
- C:\Windows\System\GhCnGUr.exe
  C:\Windows\System\GhCnGUr.exe
  2⤵
  PID:10692
- C:\Windows\System\ojSUXZK.exe
  C:\Windows\System\ojSUXZK.exe
  2⤵
  PID:11004
- C:\Windows\System\eSmDHFf.exe
  C:\Windows\System\eSmDHFf.exe
  2⤵
  PID:11036
- C:\Windows\System\LmwNnPr.exe
  C:\Windows\System\LmwNnPr.exe
  2⤵
  PID:10992
- C:\Windows\System\XwrOPee.exe
  C:\Windows\System\XwrOPee.exe
  2⤵
  PID:11180
- C:\Windows\System\tEpegAS.exe
  C:\Windows\System\tEpegAS.exe
  2⤵
  PID:10332
- C:\Windows\System\ELYVrrY.exe
  C:\Windows\System\ELYVrrY.exe
  2⤵
  PID:10600
- C:\Windows\System\aHtAess.exe
  C:\Windows\System\aHtAess.exe
  2⤵
  PID:11224
- C:\Windows\System\UCOINFI.exe
  C:\Windows\System\UCOINFI.exe
  2⤵
  PID:11228
- C:\Windows\System\PAVuEkp.exe
  C:\Windows\System\PAVuEkp.exe
  2⤵
  PID:10204
- C:\Windows\System\PudMhzL.exe
  C:\Windows\System\PudMhzL.exe
  2⤵
  PID:10376
- C:\Windows\System\QqIDcDS.exe
  C:\Windows\System\QqIDcDS.exe
  2⤵
  PID:11288
- C:\Windows\System\gVJTYWB.exe
  C:\Windows\System\gVJTYWB.exe
  2⤵
  PID:11336
- C:\Windows\System\TJkdRDi.exe
  C:\Windows\System\TJkdRDi.exe
  2⤵
  PID:11364
- C:\Windows\System\DJIfsjJ.exe
  C:\Windows\System\DJIfsjJ.exe
  2⤵
  PID:11396
- C:\Windows\System\ruOairq.exe
  C:\Windows\System\ruOairq.exe
  2⤵
  PID:11424
- C:\Windows\System\ouvAVxc.exe
  C:\Windows\System\ouvAVxc.exe
  2⤵
  PID:11448
- C:\Windows\System\iVGVYjx.exe
  C:\Windows\System\iVGVYjx.exe
  2⤵
  PID:11464
- C:\Windows\System\ewrPPXT.exe
  C:\Windows\System\ewrPPXT.exe
  2⤵
  PID:11512
- C:\Windows\System\sFsFfER.exe
  C:\Windows\System\sFsFfER.exe
  2⤵
  PID:11548
- C:\Windows\System\uJkPvRp.exe
  C:\Windows\System\uJkPvRp.exe
  2⤵
  PID:11576
- C:\Windows\System\TizyscN.exe
  C:\Windows\System\TizyscN.exe
  2⤵
  PID:11600
- C:\Windows\System\FooqJsP.exe
  C:\Windows\System\FooqJsP.exe
  2⤵
  PID:11624
- C:\Windows\System\zCbWCSF.exe
  C:\Windows\System\zCbWCSF.exe
  2⤵
  PID:11688
- C:\Windows\System\asGrKEV.exe
  C:\Windows\System\asGrKEV.exe
  2⤵
  PID:11708
- C:\Windows\System\BqpENom.exe
  C:\Windows\System\BqpENom.exe
  2⤵
  PID:11732
- C:\Windows\System\EjajZBm.exe
  C:\Windows\System\EjajZBm.exe
  2⤵
  PID:11756
- C:\Windows\System\gRJUjmN.exe
  C:\Windows\System\gRJUjmN.exe
  2⤵
  PID:11772
- C:\Windows\System\sMFZlJC.exe
  C:\Windows\System\sMFZlJC.exe
  2⤵
  PID:11804
- C:\Windows\System\Ldmqvtr.exe
  C:\Windows\System\Ldmqvtr.exe
  2⤵
  PID:11836
- C:\Windows\System\RotLXcf.exe
  C:\Windows\System\RotLXcf.exe
  2⤵
  PID:11860
- C:\Windows\System\FHVjZsg.exe
  C:\Windows\System\FHVjZsg.exe
  2⤵
  PID:11884
- C:\Windows\System\FDBsFpZ.exe
  C:\Windows\System\FDBsFpZ.exe
  2⤵
  PID:11916
- C:\Windows\System\ORCpjzS.exe
  C:\Windows\System\ORCpjzS.exe
  2⤵
  PID:11940
- C:\Windows\System\ZJxeFTn.exe
  C:\Windows\System\ZJxeFTn.exe
  2⤵
  PID:11956
- C:\Windows\System\pTirNeM.exe
  C:\Windows\System\pTirNeM.exe
  2⤵
  PID:11984
- C:\Windows\System\gEILrtr.exe
  C:\Windows\System\gEILrtr.exe
  2⤵
  PID:12024
- C:\Windows\System\OYJJiKq.exe
  C:\Windows\System\OYJJiKq.exe
  2⤵
  PID:12040
- C:\Windows\System\AvhWfxl.exe
  C:\Windows\System\AvhWfxl.exe
  2⤵
  PID:12060
- C:\Windows\System\nbOrqpa.exe
  C:\Windows\System\nbOrqpa.exe
  2⤵
  PID:12120
- C:\Windows\System\ycrnhiX.exe
  C:\Windows\System\ycrnhiX.exe
  2⤵
  PID:12140
- C:\Windows\System\dNzmEkE.exe
  C:\Windows\System\dNzmEkE.exe
  2⤵
  PID:12164
- C:\Windows\System\aABOcUE.exe
  C:\Windows\System\aABOcUE.exe
  2⤵
  PID:12184
- C:\Windows\System\fECCzHu.exe
  C:\Windows\System\fECCzHu.exe
  2⤵
  PID:12228
- C:\Windows\System\gWVnksB.exe
  C:\Windows\System\gWVnksB.exe
  2⤵
  PID:12248
- C:\Windows\System\tJWexfr.exe
  C:\Windows\System\tJWexfr.exe
  2⤵
  PID:12272
- C:\Windows\System\SjyyjLi.exe
  C:\Windows\System\SjyyjLi.exe
  2⤵
  PID:1964
- C:\Windows\System\FgUrjlJ.exe
  C:\Windows\System\FgUrjlJ.exe
  2⤵
  PID:5052
- C:\Windows\System\ioyMtjN.exe
  C:\Windows\System\ioyMtjN.exe
  2⤵
  PID:11388
- C:\Windows\System\XCpEdoA.exe
  C:\Windows\System\XCpEdoA.exe
  2⤵
  PID:11484
- C:\Windows\System\jFHqBUW.exe
  C:\Windows\System\jFHqBUW.exe
  2⤵
  PID:11528
- C:\Windows\System\VvWzCkV.exe
  C:\Windows\System\VvWzCkV.exe
  2⤵
  PID:11540
- C:\Windows\System\ZVqGaTe.exe
  C:\Windows\System\ZVqGaTe.exe
  2⤵
  PID:11700
- C:\Windows\System\yCWPELw.exe
  C:\Windows\System\yCWPELw.exe
  2⤵
  PID:11728
- C:\Windows\System\uvMQVoB.exe
  C:\Windows\System\uvMQVoB.exe
  2⤵
  PID:11816
- C:\Windows\System\RurrcDl.exe
  C:\Windows\System\RurrcDl.exe
  2⤵
  PID:11852
- C:\Windows\System\SaeKmGS.exe
  C:\Windows\System\SaeKmGS.exe
  2⤵
  PID:11876
- C:\Windows\System\wtzbSfc.exe
  C:\Windows\System\wtzbSfc.exe
  2⤵
  PID:12032
- C:\Windows\System\isHpBAc.exe
  C:\Windows\System\isHpBAc.exe
  2⤵
  PID:12052
- C:\Windows\System\ADuPoyA.exe
  C:\Windows\System\ADuPoyA.exe
  2⤵
  PID:12136
- C:\Windows\System\PTSMlBz.exe
  C:\Windows\System\PTSMlBz.exe
  2⤵
  PID:12212
- C:\Windows\System\rTbqoYu.exe
  C:\Windows\System\rTbqoYu.exe
  2⤵
  PID:12284
- C:\Windows\System\lNVsdjd.exe
  C:\Windows\System\lNVsdjd.exe
  2⤵
  PID:11356
- C:\Windows\System\qehDjbx.exe
  C:\Windows\System\qehDjbx.exe
  2⤵
  PID:11492
- C:\Windows\System\sSesbYO.exe
  C:\Windows\System\sSesbYO.exe
  2⤵
  PID:11592
- C:\Windows\System\cAjTDGD.exe
  C:\Windows\System\cAjTDGD.exe
  2⤵
  PID:11824
- C:\Windows\System\uwnMFTE.exe
  C:\Windows\System\uwnMFTE.exe
  2⤵
  PID:11872
- C:\Windows\System\OzwXOJU.exe
  C:\Windows\System\OzwXOJU.exe
  2⤵
  PID:12220
- C:\Windows\System\KIZsjlp.exe
  C:\Windows\System\KIZsjlp.exe
  2⤵
  PID:12204
- C:\Windows\System\knOcIwD.exe
  C:\Windows\System\knOcIwD.exe
  2⤵
  PID:1084
- C:\Windows\System\KrmtRan.exe
  C:\Windows\System\KrmtRan.exe
  2⤵
  PID:11456
- C:\Windows\System\fAHTAsS.exe
  C:\Windows\System\fAHTAsS.exe
  2⤵
  PID:3148
- C:\Windows\System\ZnDbalE.exe
  C:\Windows\System\ZnDbalE.exe
  2⤵
  PID:11680
- C:\Windows\System\EZZGKMQ.exe
  C:\Windows\System\EZZGKMQ.exe
  2⤵
  PID:2528
- C:\Windows\System\eHmSvou.exe
  C:\Windows\System\eHmSvou.exe
  2⤵
  PID:3900
- C:\Windows\System\UPIGlEq.exe
  C:\Windows\System\UPIGlEq.exe
  2⤵
  PID:11800
- C:\Windows\System\UccIWLU.exe
  C:\Windows\System\UccIWLU.exe
  2⤵
  PID:12312
- C:\Windows\System\UjuJnKb.exe
  C:\Windows\System\UjuJnKb.exe
  2⤵
  PID:12364
- C:\Windows\System\bvfZygx.exe
  C:\Windows\System\bvfZygx.exe
  2⤵
  PID:12388
- C:\Windows\System\WcivMRl.exe
  C:\Windows\System\WcivMRl.exe
  2⤵
  PID:12404
- C:\Windows\System\XRBSeow.exe
  C:\Windows\System\XRBSeow.exe
  2⤵
  PID:12444
- C:\Windows\System\KGfqDtp.exe
  C:\Windows\System\KGfqDtp.exe
  2⤵
  PID:12464
- C:\Windows\System\glPqiRU.exe
  C:\Windows\System\glPqiRU.exe
  2⤵
  PID:12508
- C:\Windows\System\wvuXSvh.exe
  C:\Windows\System\wvuXSvh.exe
  2⤵
  PID:12532
- C:\Windows\System\xDuaQpP.exe
  C:\Windows\System\xDuaQpP.exe
  2⤵
  PID:12556
- C:\Windows\System\gzYFzbp.exe
  C:\Windows\System\gzYFzbp.exe
  2⤵
  PID:12576
- C:\Windows\System\hnhTMOk.exe
  C:\Windows\System\hnhTMOk.exe
  2⤵
  PID:12600
- C:\Windows\System\UaGfnla.exe
  C:\Windows\System\UaGfnla.exe
  2⤵
  PID:12620
- C:\Windows\System\WIygYsi.exe
  C:\Windows\System\WIygYsi.exe
  2⤵
  PID:12644
- C:\Windows\System\xmsqIsP.exe
  C:\Windows\System\xmsqIsP.exe
  2⤵
  PID:12680
- C:\Windows\System\MqXYrRk.exe
  C:\Windows\System\MqXYrRk.exe
  2⤵
  PID:12700
- C:\Windows\System\OcfIuGF.exe
  C:\Windows\System\OcfIuGF.exe
  2⤵
  PID:12728
- C:\Windows\System\oupLRxB.exe
  C:\Windows\System\oupLRxB.exe
  2⤵
  PID:12752
- C:\Windows\System\oNLfXzX.exe
  C:\Windows\System\oNLfXzX.exe
  2⤵
  PID:12772
- C:\Windows\System\SvxhAnm.exe
  C:\Windows\System\SvxhAnm.exe
  2⤵
  PID:12828
- C:\Windows\System\RlIiWyU.exe
  C:\Windows\System\RlIiWyU.exe
  2⤵
  PID:12852
- C:\Windows\System\gyMVcUP.exe
  C:\Windows\System\gyMVcUP.exe
  2⤵
  PID:12872
- C:\Windows\System\AEKEDCz.exe
  C:\Windows\System\AEKEDCz.exe
  2⤵
  PID:12892
- C:\Windows\System\eDRZyAq.exe
  C:\Windows\System\eDRZyAq.exe
  2⤵
  PID:12928
- C:\Windows\System\oAyDlQb.exe
  C:\Windows\System\oAyDlQb.exe
  2⤵
  PID:12964
- C:\Windows\System\wBkFkJx.exe
  C:\Windows\System\wBkFkJx.exe
  2⤵
  PID:12996
- C:\Windows\System\ttUceNQ.exe
  C:\Windows\System\ttUceNQ.exe
  2⤵
  PID:13020
- C:\Windows\System\fOiBoEI.exe
  C:\Windows\System\fOiBoEI.exe
  2⤵
  PID:13044
- C:\Windows\System\CisEQYk.exe
  C:\Windows\System\CisEQYk.exe
  2⤵
  PID:13064
- C:\Windows\System\aEVTjbE.exe
  C:\Windows\System\aEVTjbE.exe
  2⤵
  PID:13084
- C:\Windows\System\ypXszlQ.exe
  C:\Windows\System\ypXszlQ.exe
  2⤵
  PID:13144
- C:\Windows\System\MohCrps.exe
  C:\Windows\System\MohCrps.exe
  2⤵
  PID:13164
- C:\Windows\System\qrECXnp.exe
  C:\Windows\System\qrECXnp.exe
  2⤵
  PID:13200
- C:\Windows\System\XMbZCpy.exe
  C:\Windows\System\XMbZCpy.exe
  2⤵
  PID:13224
- C:\Windows\System\QcqONFD.exe
  C:\Windows\System\QcqONFD.exe
  2⤵
  PID:13240
- C:\Windows\System\OgtGNJD.exe
  C:\Windows\System\OgtGNJD.exe
  2⤵
  PID:13288
- C:\Windows\System\Qzisrkz.exe
  C:\Windows\System\Qzisrkz.exe
  2⤵
  PID:13304
- C:\Windows\System\XFvLBUV.exe
  C:\Windows\System\XFvLBUV.exe
  2⤵
  PID:11640
- C:\Windows\System\dBJbncA.exe
  C:\Windows\System\dBJbncA.exe
  2⤵
  PID:12376
- C:\Windows\System\tgUgRgy.exe
  C:\Windows\System\tgUgRgy.exe
  2⤵
  PID:2004
- C:\Windows\System\iavzIjJ.exe
  C:\Windows\System\iavzIjJ.exe
  2⤵
  PID:12740
- C:\Windows\System\LNfxpVu.exe
  C:\Windows\System\LNfxpVu.exe
  2⤵
  PID:12804
- C:\Windows\System\sOgLDmq.exe
  C:\Windows\System\sOgLDmq.exe
  2⤵
  PID:12864
- C:\Windows\System\HbtYEeV.exe
  C:\Windows\System\HbtYEeV.exe
  2⤵
  PID:12948
- C:\Windows\System\qBEIDpK.exe
  C:\Windows\System\qBEIDpK.exe
  2⤵
  PID:13012
- C:\Windows\System\eVsWfBj.exe
  C:\Windows\System\eVsWfBj.exe
  2⤵
  PID:13056
- C:\Windows\System\ZgrBcUX.exe
  C:\Windows\System\ZgrBcUX.exe
  2⤵
  PID:13096
- C:\Windows\System\wWQITTR.exe
  C:\Windows\System\wWQITTR.exe
  2⤵
  PID:13208
- C:\Windows\System\FSxlJvk.exe
  C:\Windows\System\FSxlJvk.exe
  2⤵
  PID:13232
- C:\Windows\System\mcLswLi.exe
  C:\Windows\System\mcLswLi.exe
  2⤵
  PID:12840
- C:\Windows\System\cIrWRdj.exe
  C:\Windows\System\cIrWRdj.exe
  2⤵
  PID:13040
- C:\Windows\System\mliNeLn.exe
  C:\Windows\System\mliNeLn.exe
  2⤵
  PID:12716
- C:\Windows\System\KBXrUyk.exe
  C:\Windows\System\KBXrUyk.exe
  2⤵
  PID:3984
- C:\Windows\System\zyMwlRD.exe
  C:\Windows\System\zyMwlRD.exe
  2⤵
  PID:12868
- C:\Windows\System\EhMIwkX.exe
  C:\Windows\System\EhMIwkX.exe
  2⤵
  PID:3608
- C:\Windows\System\RmINnRs.exe
  C:\Windows\System\RmINnRs.exe
  2⤵
  PID:13008
- C:\Windows\System\PkypIYF.exe
  C:\Windows\System\PkypIYF.exe
  2⤵
  PID:1200
- C:\Windows\System\FLNYSyi.exe
  C:\Windows\System\FLNYSyi.exe
  2⤵
  PID:1700
- C:\Windows\System\EImNlRx.exe
  C:\Windows\System\EImNlRx.exe
  2⤵
  PID:12924
- C:\Windows\System\uTEvKHW.exe
  C:\Windows\System\uTEvKHW.exe
  2⤵
  PID:11752
- C:\Windows\System\pNBvnIS.exe
  C:\Windows\System\pNBvnIS.exe
  2⤵
  PID:3400
- C:\Windows\System\thqSXzU.exe
  C:\Windows\System\thqSXzU.exe
  2⤵
  PID:3808
- C:\Windows\System\JWOTlSA.exe
  C:\Windows\System\JWOTlSA.exe
  2⤵
  PID:12372
- C:\Windows\System\xerIkiM.exe
  C:\Windows\System\xerIkiM.exe
  2⤵
  PID:12592
- C:\Windows\System\FBYFJSw.exe
  C:\Windows\System\FBYFJSw.exe
  2⤵
  PID:2964
- C:\Windows\System\efVfqAv.exe
  C:\Windows\System\efVfqAv.exe
  2⤵
  PID:12672
- C:\Windows\System\mNaSIUg.exe
  C:\Windows\System\mNaSIUg.exe
  2⤵
  PID:4004
- C:\Windows\System\ZLoyOur.exe
  C:\Windows\System\ZLoyOur.exe
  2⤵
  PID:3292
- C:\Windows\System\jdJUasE.exe
  C:\Windows\System\jdJUasE.exe
  2⤵
  PID:828
- C:\Windows\System\dIUamal.exe
  C:\Windows\System\dIUamal.exe
  2⤵
  PID:3556
- C:\Windows\System\atXyjvy.exe
  C:\Windows\System\atXyjvy.exe
  2⤵
  PID:2008
- C:\Windows\System\ChcDZGQ.exe
  C:\Windows\System\ChcDZGQ.exe
  2⤵
  PID:3604
- C:\Windows\System\LTlPdms.exe
  C:\Windows\System\LTlPdms.exe
  2⤵
  PID:7356
- C:\Windows\System\aEPhppw.exe
  C:\Windows\System\aEPhppw.exe
  2⤵
  PID:2440
- C:\Windows\System\gLQKIar.exe
  C:\Windows\System\gLQKIar.exe
  2⤵
  PID:12460
- C:\Windows\System\xvHMEsp.exe
  C:\Windows\System\xvHMEsp.exe
  2⤵
  PID:3376
- C:\Windows\System\fXOXSQe.exe
  C:\Windows\System\fXOXSQe.exe
  2⤵
  PID:7716
- C:\Windows\System\BxOjAHe.exe
  C:\Windows\System\BxOjAHe.exe
  2⤵
  PID:1460
- C:\Windows\System\xswhvzY.exe
  C:\Windows\System\xswhvzY.exe
  2⤵
  PID:4320
- C:\Windows\System\HxTQifP.exe
  C:\Windows\System\HxTQifP.exe
  2⤵
  PID:13724
- C:\Windows\System\gbUIicV.exe
  C:\Windows\System\gbUIicV.exe
  2⤵
  PID:13780
- C:\Windows\System\NufQsEQ.exe
  C:\Windows\System\NufQsEQ.exe
  2⤵
  PID:13860
- C:\Windows\System\LpCRRgS.exe
  C:\Windows\System\LpCRRgS.exe
  2⤵
  PID:13896
- C:\Windows\System\zCMcvSJ.exe
  C:\Windows\System\zCMcvSJ.exe
  2⤵
  PID:13972
- C:\Windows\System\yvomSxT.exe
  C:\Windows\System\yvomSxT.exe
  2⤵
  PID:14048
- C:\Windows\System\qCChWgy.exe
  C:\Windows\System\qCChWgy.exe
  2⤵
  PID:14092
- C:\Windows\System\ELAxaPx.exe
  C:\Windows\System\ELAxaPx.exe
  2⤵
  PID:14124
- C:\Windows\System\FVGuUnS.exe
  C:\Windows\System\FVGuUnS.exe
  2⤵
  PID:14184
- C:\Windows\System\SMxDMfE.exe
  C:\Windows\System\SMxDMfE.exe
  2⤵
  PID:14260
- C:\Windows\System\yfAugTg.exe
  C:\Windows\System\yfAugTg.exe
  2⤵
  PID:14288
- C:\Windows\System\tMfpHgD.exe
  C:\Windows\System\tMfpHgD.exe
  2⤵
  PID:14320
- C:\Windows\System\RRMiVVg.exe
  C:\Windows\System\RRMiVVg.exe
  2⤵
  PID:4124
- C:\Windows\System\XPnOzZG.exe
  C:\Windows\System\XPnOzZG.exe
  2⤵
  PID:8752
- C:\Windows\System\YkMaUWr.exe
  C:\Windows\System\YkMaUWr.exe
  2⤵
  PID:8888
- C:\Windows\System\uNsDIQP.exe
  C:\Windows\System\uNsDIQP.exe
  2⤵
  PID:3164
- C:\Windows\System\FmkZckH.exe
  C:\Windows\System\FmkZckH.exe
  2⤵
  PID:2580
- C:\Windows\System\eaFMBPJ.exe
  C:\Windows\System\eaFMBPJ.exe
  2⤵
  PID:8996
- C:\Windows\System\gmSFxhS.exe
  C:\Windows\System\gmSFxhS.exe
  2⤵
  PID:2980
- C:\Windows\System\YgGivsx.exe
  C:\Windows\System\YgGivsx.exe
  2⤵
  PID:7416
- C:\Windows\System\ByPyyVo.exe
  C:\Windows\System\ByPyyVo.exe
  2⤵
  PID:4644
- C:\Windows\System\GWHFpoM.exe
  C:\Windows\System\GWHFpoM.exe
  2⤵
  PID:6588
- C:\Windows\System\AkFtuwU.exe
  C:\Windows\System\AkFtuwU.exe
  2⤵
  PID:3708
- C:\Windows\System\VjVingo.exe
  C:\Windows\System\VjVingo.exe
  2⤵
  PID:8748
- C:\Windows\System\aXmCrMY.exe
  C:\Windows\System\aXmCrMY.exe
  2⤵
  PID:4340
- C:\Windows\System\hDeRGpW.exe
  C:\Windows\System\hDeRGpW.exe
  2⤵
  PID:2892
- C:\Windows\System\QFRYiJW.exe
  C:\Windows\System\QFRYiJW.exe
  2⤵
  PID:3744
- C:\Windows\System\JBxGLZz.exe
  C:\Windows\System\JBxGLZz.exe
  2⤵
  PID:8600
- C:\Windows\System\GNOLxIF.exe
  C:\Windows\System\GNOLxIF.exe
  2⤵
  PID:1980
- C:\Windows\System\GMhBMIA.exe
  C:\Windows\System\GMhBMIA.exe
  2⤵
  PID:13344
- C:\Windows\System\FRzVkAr.exe
  C:\Windows\System\FRzVkAr.exe
  2⤵
  PID:13380
- C:\Windows\System\TDCLKvp.exe
  C:\Windows\System\TDCLKvp.exe
  2⤵
  PID:13420
- C:\Windows\System\YFWptsK.exe
  C:\Windows\System\YFWptsK.exe
  2⤵
  PID:13440
- C:\Windows\System\pRMLGKp.exe
  C:\Windows\System\pRMLGKp.exe
  2⤵
  PID:13468
- C:\Windows\System\cmoEIeC.exe
  C:\Windows\System\cmoEIeC.exe
  2⤵
  PID:13500
- C:\Windows\System\dyIBAAO.exe
  C:\Windows\System\dyIBAAO.exe
  2⤵
  PID:13528
- C:\Windows\System\lfgGGll.exe
  C:\Windows\System\lfgGGll.exe
  2⤵
  PID:13564
- C:\Windows\System\WKptikT.exe
  C:\Windows\System\WKptikT.exe
  2⤵
  PID:13604
- C:\Windows\System\szSebVG.exe
  C:\Windows\System\szSebVG.exe
  2⤵
  PID:13632
- C:\Windows\System\ETEbPrn.exe
  C:\Windows\System\ETEbPrn.exe
  2⤵
  PID:13668
- C:\Windows\System\cziYdnE.exe
  C:\Windows\System\cziYdnE.exe
  2⤵
  PID:13788
- C:\Windows\System\EBlpCsI.exe
  C:\Windows\System\EBlpCsI.exe
  2⤵
  PID:3536
- C:\Windows\System\aJsscSd.exe
  C:\Windows\System\aJsscSd.exe
  2⤵
  PID:13812
- C:\Windows\System\SwcGHJT.exe
  C:\Windows\System\SwcGHJT.exe
  2⤵
  PID:13828
- C:\Windows\System\vqbHJwV.exe
  C:\Windows\System\vqbHJwV.exe
  2⤵
  PID:13768
- C:\Windows\System\wkXZMNp.exe
  C:\Windows\System\wkXZMNp.exe
  2⤵
  PID:13772
- C:\Windows\System\mhQTzJm.exe
  C:\Windows\System\mhQTzJm.exe
  2⤵
  PID:13844
- C:\Windows\System\TKnbVgM.exe
  C:\Windows\System\TKnbVgM.exe
  2⤵
  PID:13856
- C:\Windows\System\xmtiBWV.exe
  C:\Windows\System\xmtiBWV.exe
  2⤵
  PID:13764
- C:\Windows\System\bYArcXG.exe
  C:\Windows\System\bYArcXG.exe
  2⤵
  PID:2456
- C:\Windows\System\bjSZniz.exe
  C:\Windows\System\bjSZniz.exe
  2⤵
  PID:13876
- C:\Windows\System\eExUJml.exe
  C:\Windows\System\eExUJml.exe
  2⤵
  PID:3832
- C:\Windows\System\nkHcnWB.exe
  C:\Windows\System\nkHcnWB.exe
  2⤵
  PID:5100
- C:\Windows\System\iDReTWi.exe
  C:\Windows\System\iDReTWi.exe
  2⤵
  PID:4788
- C:\Windows\System\YcAwgkA.exe
  C:\Windows\System\YcAwgkA.exe
  2⤵
  PID:2784
- C:\Windows\System\yAdpEHO.exe
  C:\Windows\System\yAdpEHO.exe
  2⤵
  PID:540
- C:\Windows\System\PsasYgK.exe
  C:\Windows\System\PsasYgK.exe
  2⤵
  PID:4332
- C:\Windows\System\yNyDJMm.exe
  C:\Windows\System\yNyDJMm.exe
  2⤵
  PID:3852
- C:\Windows\System\vXmkPeZ.exe
  C:\Windows\System\vXmkPeZ.exe
  2⤵
  PID:1940
- C:\Windows\System\oWQRvXq.exe
  C:\Windows\System\oWQRvXq.exe
  2⤵
  PID:5172
- C:\Windows\System\RzjmlRk.exe
  C:\Windows\System\RzjmlRk.exe
  2⤵
  PID:13892
- C:\Windows\System\xGVubjH.exe
  C:\Windows\System\xGVubjH.exe
  2⤵
  PID:5220
- C:\Windows\System\JBPnDge.exe
  C:\Windows\System\JBPnDge.exe
  2⤵
  PID:13888
- C:\Windows\System\xtFIzoW.exe
  C:\Windows\System\xtFIzoW.exe
  2⤵
  PID:10096
- C:\Windows\System\NiiKhfB.exe
  C:\Windows\System\NiiKhfB.exe
  2⤵
  PID:10184
- C:\Windows\System\hSTuFBS.exe
  C:\Windows\System\hSTuFBS.exe
  2⤵
  PID:10236
- C:\Windows\System\MUoWRJa.exe
  C:\Windows\System\MUoWRJa.exe
  2⤵
  PID:5408
- C:\Windows\System\oIFRmoo.exe
  C:\Windows\System\oIFRmoo.exe
  2⤵
  PID:9356
- C:\Windows\System\iuYNgbV.exe
  C:\Windows\System\iuYNgbV.exe
  2⤵
  PID:5324
- C:\Windows\System\AjMwkUp.exe
  C:\Windows\System\AjMwkUp.exe
  2⤵
  PID:5380
- C:\Windows\System\wRNsXzB.exe
  C:\Windows\System\wRNsXzB.exe
  2⤵
  PID:9496
- C:\Windows\System\mXIRoVG.exe
  C:\Windows\System\mXIRoVG.exe
  2⤵
  PID:13916
- C:\Windows\System\ieevBCG.exe
  C:\Windows\System\ieevBCG.exe
  2⤵
  PID:13952
- C:\Windows\System\zvpiKNE.exe
  C:\Windows\System\zvpiKNE.exe
  2⤵
  PID:13980
- C:\Windows\System\wqoCaaK.exe
  C:\Windows\System\wqoCaaK.exe
  2⤵
  PID:5508
- C:\Windows\System\BqLllpb.exe
  C:\Windows\System\BqLllpb.exe
  2⤵
  PID:14020
- C:\Windows\System\zstsfmJ.exe
  C:\Windows\System\zstsfmJ.exe
  2⤵
  PID:14100
- C:\Windows\System\HzeOSVX.exe
  C:\Windows\System\HzeOSVX.exe
  2⤵
  PID:5576
- C:\Windows\System\eVKAcSq.exe
  C:\Windows\System\eVKAcSq.exe
  2⤵
  PID:5604
- C:\Windows\System\rtnBHLC.exe
  C:\Windows\System\rtnBHLC.exe
  2⤵
  PID:9640
- C:\Windows\System\SaMpEpf.exe
  C:\Windows\System\SaMpEpf.exe
  2⤵
  PID:14136
- C:\Windows\System\hTiWTlK.exe
  C:\Windows\System\hTiWTlK.exe
  2⤵
  PID:5752
- C:\Windows\System\dTWKAQM.exe
  C:\Windows\System\dTWKAQM.exe
  2⤵
  PID:5688
- C:\Windows\System\YbEEDQH.exe
  C:\Windows\System\YbEEDQH.exe
  2⤵
  PID:5808
- C:\Windows\System\tSddhVT.exe
  C:\Windows\System\tSddhVT.exe
  2⤵
  PID:11064
- C:\Windows\System\wkUAwTx.exe
  C:\Windows\System\wkUAwTx.exe
  2⤵
  PID:11112
- C:\Windows\System\VtFzjld.exe
  C:\Windows\System\VtFzjld.exe
  2⤵
  PID:2588
- C:\Windows\System\PIKDhqO.exe
  C:\Windows\System\PIKDhqO.exe
  2⤵
  PID:3600
- C:\Windows\System\AnpbCZL.exe
  C:\Windows\System\AnpbCZL.exe
  2⤵
  PID:11244
- C:\Windows\System\IPAVNSZ.exe
  C:\Windows\System\IPAVNSZ.exe
  2⤵
  PID:12800
- C:\Windows\System\VzlxfiE.exe
  C:\Windows\System\VzlxfiE.exe
  2⤵
  PID:3224
- C:\Windows\System\ciJQhvD.exe
  C:\Windows\System\ciJQhvD.exe
  2⤵
  PID:9856
- C:\Windows\System\PXYwIgg.exe
  C:\Windows\System\PXYwIgg.exe
  2⤵
  PID:8784
- C:\Windows\System\mxluGMv.exe
  C:\Windows\System\mxluGMv.exe
  2⤵
  PID:8688
- C:\Windows\System\feaulmE.exe
  C:\Windows\System\feaulmE.exe
  2⤵
  PID:1904
- C:\Windows\System\Apzvafb.exe
  C:\Windows\System\Apzvafb.exe
  2⤵
  PID:5360
- C:\Windows\System\ukgPWpR.exe
  C:\Windows\System\ukgPWpR.exe
  2⤵
  PID:4384
- C:\Windows\System\JWawEmU.exe
  C:\Windows\System\JWawEmU.exe
  2⤵
  PID:5416
- C:\Windows\System\BsFHLpR.exe
  C:\Windows\System\BsFHLpR.exe
  2⤵
  PID:5388
- C:\Windows\System\dWrDZyh.exe
  C:\Windows\System\dWrDZyh.exe
  2⤵
  PID:116
- C:\Windows\System\hmDHtKd.exe
  C:\Windows\System\hmDHtKd.exe
  2⤵
  PID:2704
- C:\Windows\System\PvaxodT.exe
  C:\Windows\System\PvaxodT.exe
  2⤵
  PID:4664
- C:\Windows\System\ukEMmNp.exe
  C:\Windows\System\ukEMmNp.exe
  2⤵
  PID:5588
- C:\Windows\System\LEsLXuE.exe
  C:\Windows\System\LEsLXuE.exe
  2⤵
  PID:7184
- C:\Windows\System\bkdThkM.exe
  C:\Windows\System\bkdThkM.exe
  2⤵
  PID:9956
- C:\Windows\System\lDNsVeb.exe
  C:\Windows\System\lDNsVeb.exe
  2⤵
  PID:5956
- C:\Windows\System\fhaveQe.exe
  C:\Windows\System\fhaveQe.exe
  2⤵
  PID:5776
- C:\Windows\System\LVSZyqa.exe
  C:\Windows\System\LVSZyqa.exe
  2⤵
  PID:10400
- C:\Windows\System\vyxCzbp.exe
  C:\Windows\System\vyxCzbp.exe
  2⤵
  PID:11152
- C:\Windows\System\qkGJJmf.exe
  C:\Windows\System\qkGJJmf.exe
  2⤵
  PID:7732
- C:\Windows\System\ScjjWHr.exe
  C:\Windows\System\ScjjWHr.exe
  2⤵
  PID:5868
- C:\Windows\System\HVQkgmO.exe
  C:\Windows\System\HVQkgmO.exe
  2⤵
  PID:13320
- C:\Windows\System\NtfIpGU.exe
  C:\Windows\System\NtfIpGU.exe
  2⤵
  PID:13340
- C:\Windows\System\ZzqlVqt.exe
  C:\Windows\System\ZzqlVqt.exe
  2⤵
  PID:13968
- C:\Windows\System\GUeHUut.exe
  C:\Windows\System\GUeHUut.exe
  2⤵
  PID:6308
- C:\Windows\System\EpXrgEZ.exe
  C:\Windows\System\EpXrgEZ.exe
  2⤵
  PID:5548
- C:\Windows\System\IzMqPmc.exe
  C:\Windows\System\IzMqPmc.exe
  2⤵
  PID:14084
- C:\Windows\System\zmQsCUp.exe
  C:\Windows\System\zmQsCUp.exe
  2⤵
  PID:14032
- C:\Windows\System\OoOtTow.exe
  C:\Windows\System\OoOtTow.exe
  2⤵
  PID:5564
- C:\Windows\System\ZKZbQdg.exe
  C:\Windows\System\ZKZbQdg.exe
  2⤵
  PID:5732
- C:\Windows\System\ncVheLi.exe
  C:\Windows\System\ncVheLi.exe
  2⤵
  PID:14088
- C:\Windows\System\FYIGuZt.exe
  C:\Windows\System\FYIGuZt.exe
  2⤵
  PID:1368
- C:\Windows\System\TjYHkue.exe
  C:\Windows\System\TjYHkue.exe
  2⤵
  PID:14156
- C:\Windows\System\IxzzqFS.exe
  C:\Windows\System\IxzzqFS.exe
  2⤵
  PID:6688
- C:\Windows\System\FSSpzPu.exe
  C:\Windows\System\FSSpzPu.exe
  2⤵
  PID:6816
- C:\Windows\System\CHYHcgf.exe
  C:\Windows\System\CHYHcgf.exe
  2⤵
  PID:12844
- C:\Windows\System\aboKrsl.exe
  C:\Windows\System\aboKrsl.exe
  2⤵
  PID:6828
- C:\Windows\System\ClIbnrX.exe
  C:\Windows\System\ClIbnrX.exe
  2⤵
  PID:5820
- C:\Windows\System\GvuuDXz.exe
  C:\Windows\System\GvuuDXz.exe
  2⤵
  PID:5780
- C:\Windows\System\jwuRHTy.exe
  C:\Windows\System\jwuRHTy.exe
  2⤵
  PID:6812
- C:\Windows\System\XGoZfle.exe
  C:\Windows\System\XGoZfle.exe
  2⤵
  PID:6116
- C:\Windows\System\bshpSAV.exe
  C:\Windows\System\bshpSAV.exe
  2⤵
  PID:11076
- C:\Windows\System\SXxaEkB.exe
  C:\Windows\System\SXxaEkB.exe
  2⤵
  PID:11240
- C:\Windows\System\oebOeQp.exe
  C:\Windows\System\oebOeQp.exe
  2⤵
  PID:8060
- C:\Windows\System\exOSUzs.exe
  C:\Windows\System\exOSUzs.exe
  2⤵
  PID:1156
- C:\Windows\System\LAUyKxb.exe
  C:\Windows\System\LAUyKxb.exe
  2⤵
  PID:14208
- C:\Windows\System\KHBWrQD.exe
  C:\Windows\System\KHBWrQD.exe
  2⤵
  PID:6972
- C:\Windows\System\VNTfenb.exe
  C:\Windows\System\VNTfenb.exe
  2⤵
  PID:6944
- C:\Windows\System\REYXBXl.exe
  C:\Windows\System\REYXBXl.exe
  2⤵
  PID:6984
- C:\Windows\System\WuNQCum.exe
  C:\Windows\System\WuNQCum.exe
  2⤵
  PID:6916
- C:\Windows\System\hBLIEEz.exe
  C:\Windows\System\hBLIEEz.exe
  2⤵
  PID:11100
- C:\Windows\System\hrELtPy.exe
  C:\Windows\System\hrELtPy.exe
  2⤵
  PID:8
- C:\Windows\System\hFZFbao.exe
  C:\Windows\System\hFZFbao.exe
  2⤵
  PID:9284
- C:\Windows\System\bSWMWlI.exe
  C:\Windows\System\bSWMWlI.exe
  2⤵
  PID:7904
- C:\Windows\System\eTQawMx.exe
  C:\Windows\System\eTQawMx.exe
  2⤵
  PID:6964
- C:\Windows\System\JvYeAfW.exe
  C:\Windows\System\JvYeAfW.exe
  2⤵
  PID:5840
- C:\Windows\System\xcFQkxr.exe
  C:\Windows\System\xcFQkxr.exe
  2⤵
  PID:1684
- C:\Windows\System\cNjBFIQ.exe
  C:\Windows\System\cNjBFIQ.exe
  2⤵
  PID:6704
- C:\Windows\System\KIpqupq.exe
  C:\Windows\System\KIpqupq.exe
  2⤵
  PID:7032
- C:\Windows\System\xFxpIQe.exe
  C:\Windows\System\xFxpIQe.exe
  2⤵
  PID:7232
- C:\Windows\System\LsWzjud.exe
  C:\Windows\System\LsWzjud.exe
  2⤵
  PID:6192
- C:\Windows\System\AyKlcNV.exe
  C:\Windows\System\AyKlcNV.exe
  2⤵
  PID:2088
- C:\Windows\System\ernpfJL.exe
  C:\Windows\System\ernpfJL.exe
  2⤵
  PID:6200
- C:\Windows\System\jNNLsjH.exe
  C:\Windows\System\jNNLsjH.exe
  2⤵
  PID:13748
- C:\Windows\System\MddOlqk.exe
  C:\Windows\System\MddOlqk.exe
  2⤵
  PID:12072
- C:\Windows\System\lsHuZpT.exe
  C:\Windows\System\lsHuZpT.exe
  2⤵
  PID:13824
- C:\Windows\System\iYAhujs.exe
  C:\Windows\System\iYAhujs.exe
  2⤵
  PID:760
- C:\Windows\System\wRQVZiz.exe
  C:\Windows\System\wRQVZiz.exe
  2⤵
  PID:6408
- C:\Windows\System\advXsIQ.exe
  C:\Windows\System\advXsIQ.exe
  2⤵
  PID:13560
- C:\Windows\System\hUEFbVT.exe
  C:\Windows\System\hUEFbVT.exe
  2⤵
  PID:6744
- C:\Windows\System\mjWWvUZ.exe
  C:\Windows\System\mjWWvUZ.exe
  2⤵
  PID:7672
- C:\Windows\System\xtmQRdi.exe
  C:\Windows\System\xtmQRdi.exe
  2⤵
  PID:372
- C:\Windows\System\tOVCruZ.exe
  C:\Windows\System\tOVCruZ.exe
  2⤵
  PID:7684
- C:\Windows\System\iLcTEQc.exe
  C:\Windows\System\iLcTEQc.exe
  2⤵
  PID:13648
- C:\Windows\System\BvnnCGJ.exe
  C:\Windows\System\BvnnCGJ.exe
  2⤵
  PID:7696
- C:\Windows\System\aJbmeNW.exe
  C:\Windows\System\aJbmeNW.exe
  2⤵
  PID:6168
- C:\Windows\System\dgsWIZI.exe
  C:\Windows\System\dgsWIZI.exe
  2⤵
  PID:4728
- C:\Windows\System\WIPRUPb.exe
  C:\Windows\System\WIPRUPb.exe
  2⤵
  PID:11260
- C:\Windows\System\wxEydLy.exe
  C:\Windows\System\wxEydLy.exe
  2⤵
  PID:2720
- C:\Windows\System\sDJdXYr.exe
  C:\Windows\System\sDJdXYr.exe
  2⤵
  PID:8812
- C:\Windows\System\jWgTVAA.exe
  C:\Windows\System\jWgTVAA.exe
  2⤵
  PID:8952
- C:\Windows\System\gcHMozJ.exe
  C:\Windows\System\gcHMozJ.exe
  2⤵
  PID:6884
- C:\Windows\System\gJsYbbU.exe
  C:\Windows\System\gJsYbbU.exe
  2⤵
  PID:6924
- C:\Windows\System\lwImKRv.exe
  C:\Windows\System\lwImKRv.exe
  2⤵
  PID:9080
- C:\Windows\System\IpYqotj.exe
  C:\Windows\System\IpYqotj.exe
  2⤵
  PID:6504
- C:\Windows\System\iMEqAHK.exe
  C:\Windows\System\iMEqAHK.exe
  2⤵
  PID:2512
- C:\Windows\System\FAJjaYd.exe
  C:\Windows\System\FAJjaYd.exe
  2⤵
  PID:4496
- C:\Windows\System\LXpfBur.exe
  C:\Windows\System\LXpfBur.exe
  2⤵
  PID:9180
- C:\Windows\System\TdZOqsZ.exe
  C:\Windows\System\TdZOqsZ.exe
  2⤵
  PID:7056
- C:\Windows\System\vEUOymU.exe
  C:\Windows\System\vEUOymU.exe
  2⤵
  PID:8440
- C:\Windows\System\VgHzqSC.exe
  C:\Windows\System\VgHzqSC.exe
  2⤵
  PID:6920
- C:\Windows\System\fOvbeoB.exe
  C:\Windows\System\fOvbeoB.exe
  2⤵
  PID:13392
- C:\Windows\System\ozGmchs.exe
  C:\Windows\System\ozGmchs.exe
  2⤵
  PID:8692
- C:\Windows\System\XIBaZWo.exe
  C:\Windows\System\XIBaZWo.exe
  2⤵
  PID:14296
- C:\Windows\System\eIjoBjT.exe
  C:\Windows\System\eIjoBjT.exe
  2⤵
  PID:8808
- C:\Windows\System\llfAWyH.exe
  C:\Windows\System\llfAWyH.exe
  2⤵
  PID:6852
- C:\Windows\System\KIqLCBw.exe
  C:\Windows\System\KIqLCBw.exe
  2⤵
  PID:9152
- C:\Windows\System\xbwcwzJ.exe
  C:\Windows\System\xbwcwzJ.exe
  2⤵
  PID:6988
- C:\Windows\System\iQbzEhb.exe
  C:\Windows\System\iQbzEhb.exe
  2⤵
  PID:9204
- C:\Windows\System\BQnmeKs.exe
  C:\Windows\System\BQnmeKs.exe
  2⤵
  PID:8624
- C:\Windows\System\UoupeIb.exe
  C:\Windows\System\UoupeIb.exe
  2⤵
  PID:8484
- C:\Windows\System\FyKPUYV.exe
  C:\Windows\System\FyKPUYV.exe
  2⤵
  PID:8892
- C:\Windows\System\aMmLhle.exe
  C:\Windows\System\aMmLhle.exe
  2⤵
  PID:9172
- C:\Windows\System\hpqyshS.exe
  C:\Windows\System\hpqyshS.exe
  2⤵
  PID:9088
- C:\Windows\System\PIAhBLr.exe
  C:\Windows\System\PIAhBLr.exe
  2⤵
  PID:6736
- C:\Windows\System\avynoga.exe
  C:\Windows\System\avynoga.exe
  2⤵
  PID:9388
- C:\Windows\System\aPMymNl.exe
  C:\Windows\System\aPMymNl.exe
  2⤵
  PID:6536
- C:\Windows\System\SCRKlLO.exe
  C:\Windows\System\SCRKlLO.exe
  2⤵
  PID:5092
- C:\Windows\System\GIZrKDf.exe
  C:\Windows\System\GIZrKDf.exe
  2⤵
  PID:9524
- C:\Windows\System\jVjYFrr.exe
  C:\Windows\System\jVjYFrr.exe
  2⤵
  PID:5276
- C:\Windows\System\AwMKysd.exe
  C:\Windows\System\AwMKysd.exe
  2⤵
  PID:9576
- C:\Windows\System\kAbcyhq.exe
  C:\Windows\System\kAbcyhq.exe
  2⤵
  PID:5076
- C:\Windows\System\oaDmsDq.exe
  C:\Windows\System\oaDmsDq.exe
  2⤵
  PID:9656
- C:\Windows\System\MsgipfQ.exe
  C:\Windows\System\MsgipfQ.exe
  2⤵
  PID:5060
- C:\Windows\System\EFggkKw.exe
  C:\Windows\System\EFggkKw.exe
  2⤵
  PID:9680
- C:\Windows\System\eDOdUvm.exe
  C:\Windows\System\eDOdUvm.exe
  2⤵
  PID:4472
- C:\Windows\System\xfvhVmq.exe
  C:\Windows\System\xfvhVmq.exe
  2⤵
  PID:9800
- C:\Windows\System\NLYBGAm.exe
  C:\Windows\System\NLYBGAm.exe
  2⤵
  PID:9840
- C:\Windows\System\ZMAjNVF.exe
  C:\Windows\System\ZMAjNVF.exe
  2⤵
  PID:9872
- C:\Windows\System\WdwJzhS.exe
  C:\Windows\System\WdwJzhS.exe
  2⤵
  PID:9932
- C:\Windows\System\niUvEhQ.exe
  C:\Windows\System\niUvEhQ.exe
  2⤵
  PID:9976
- C:\Windows\System\pehNvBg.exe
  C:\Windows\System\pehNvBg.exe
  2⤵
  PID:13536
- C:\Windows\System\LUyjixM.exe
  C:\Windows\System\LUyjixM.exe
  2⤵
  PID:11792
- C:\Windows\System\EPWXQTe.exe
  C:\Windows\System\EPWXQTe.exe
  2⤵
  PID:1948
- C:\Windows\System\FVFLqrN.exe
  C:\Windows\System\FVFLqrN.exe
  2⤵
  PID:6160
- C:\Windows\System\LYitPnC.exe
  C:\Windows\System\LYitPnC.exe
  2⤵
  PID:6284
- C:\Windows\System\WPtQwKB.exe
  C:\Windows\System\WPtQwKB.exe
  2⤵
  PID:9196
- C:\Windows\System\vsTdUAd.exe
  C:\Windows\System\vsTdUAd.exe
  2⤵
  PID:8252
- C:\Windows\System\bnAFzAN.exe
  C:\Windows\System\bnAFzAN.exe
  2⤵
  PID:8228
- C:\Windows\System\yNDDgnC.exe
  C:\Windows\System\yNDDgnC.exe
  2⤵
  PID:9296
- C:\Windows\System\lLCgObT.exe
  C:\Windows\System\lLCgObT.exe
  2⤵
  PID:7884
- C:\Windows\System\dCzgZOl.exe
  C:\Windows\System\dCzgZOl.exe
  2⤵
  PID:13576
- C:\Windows\System\meqMyXs.exe
  C:\Windows\System\meqMyXs.exe
  2⤵
  PID:9620
- C:\Windows\System\rHEgAtA.exe
  C:\Windows\System\rHEgAtA.exe
  2⤵
  PID:7096
- C:\Windows\System\amDiqmz.exe
  C:\Windows\System\amDiqmz.exe
  2⤵
  PID:7928
- C:\Windows\System\dnzjttw.exe
  C:\Windows\System\dnzjttw.exe
  2⤵
  PID:9372
- C:\Windows\System\rwFDEIn.exe
  C:\Windows\System\rwFDEIn.exe
  2⤵
  PID:9544
- C:\Windows\System\bjnbyvX.exe
  C:\Windows\System\bjnbyvX.exe
  2⤵
  PID:9512
- C:\Windows\System\NSILFkM.exe
  C:\Windows\System\NSILFkM.exe
  2⤵
  PID:9708
- C:\Windows\System\cevMtLV.exe
  C:\Windows\System\cevMtLV.exe
  2⤵
  PID:6840
- C:\Windows\System\QaBHkBj.exe
  C:\Windows\System\QaBHkBj.exe
  2⤵
  PID:9828
- C:\Windows\System\uFWweOT.exe
  C:\Windows\System\uFWweOT.exe
  2⤵
  PID:9780
- C:\Windows\System\kjPqKgR.exe
  C:\Windows\System\kjPqKgR.exe
  2⤵
  PID:10112
- C:\Windows\System\jagFXaC.exe
  C:\Windows\System\jagFXaC.exe
  2⤵
  PID:9948
- C:\Windows\System\eKNoBOH.exe
  C:\Windows\System\eKNoBOH.exe
  2⤵
  PID:10196
- C:\Windows\System\yBtpJQz.exe
  C:\Windows\System\yBtpJQz.exe
  2⤵
  PID:7272
- C:\Windows\System\Vdxtubb.exe
  C:\Windows\System\Vdxtubb.exe
  2⤵
  PID:1944
- C:\Windows\System\EgWlcuk.exe
  C:\Windows\System\EgWlcuk.exe
  2⤵
  PID:10084
- C:\Windows\System\ZTCgdXn.exe
  C:\Windows\System\ZTCgdXn.exe
  2⤵
  PID:9796
- C:\Windows\System\DjFlUdY.exe
  C:\Windows\System\DjFlUdY.exe
  2⤵
  PID:7376
- C:\Windows\System\iLmzrwQ.exe
  C:\Windows\System\iLmzrwQ.exe
  2⤵
  PID:4580
- C:\Windows\System\SSywDeA.exe
  C:\Windows\System\SSywDeA.exe
  2⤵
  PID:7892
- C:\Windows\System\TOoWZkj.exe
  C:\Windows\System\TOoWZkj.exe
  2⤵
  PID:13660
- C:\Windows\System\nRegnAy.exe
  C:\Windows\System\nRegnAy.exe
  2⤵
  PID:10448
- C:\Windows\System\OQDTbOc.exe
  C:\Windows\System\OQDTbOc.exe
  2⤵
  PID:7064
- C:\Windows\System\OtNwOKw.exe
  C:\Windows\System\OtNwOKw.exe
  2⤵
  PID:6280
- C:\Windows\System\qHodIWD.exe
  C:\Windows\System\qHodIWD.exe
  2⤵
  PID:9792
- C:\Windows\System\wSZuXEy.exe
  C:\Windows\System\wSZuXEy.exe
  2⤵
  PID:10620
- C:\Windows\System\ntkXUqW.exe
  C:\Windows\System\ntkXUqW.exe
  2⤵
  PID:10612
- C:\Windows\System\JAMlscR.exe
  C:\Windows\System\JAMlscR.exe
  2⤵
  PID:5472
- C:\Windows\System\nszAVKA.exe
  C:\Windows\System\nszAVKA.exe
  2⤵
  PID:4044
- C:\Windows\System\OnjRdZJ.exe
  C:\Windows\System\OnjRdZJ.exe
  2⤵
  PID:11080
- C:\Windows\System\IkRwELI.exe
  C:\Windows\System\IkRwELI.exe
  2⤵
  PID:10720
- C:\Windows\System\TNyWgDz.exe
  C:\Windows\System\TNyWgDz.exe
  2⤵
  PID:10728
- C:\Windows\System\OitbYos.exe
  C:\Windows\System\OitbYos.exe
  2⤵
  PID:8144
- C:\Windows\System\PMssePS.exe
  C:\Windows\System\PMssePS.exe
  2⤵
  PID:10836
- C:\Windows\System\lpZCDuf.exe
  C:\Windows\System\lpZCDuf.exe
  2⤵
  PID:4804
- C:\Windows\System\wPtfbTa.exe
  C:\Windows\System\wPtfbTa.exe
  2⤵
  PID:10844
- C:\Windows\System\bOsyceu.exe
  C:\Windows\System\bOsyceu.exe
  2⤵
  PID:10848
- C:\Windows\System\JcOoVQP.exe
  C:\Windows\System\JcOoVQP.exe
  2⤵
  PID:10896
- C:\Windows\System\vJcNTyI.exe
  C:\Windows\System\vJcNTyI.exe
  2⤵
  PID:3052
- C:\Windows\System\omkGgUZ.exe
  C:\Windows\System\omkGgUZ.exe
  2⤵
  PID:10868
- C:\Windows\System\FdxMwvK.exe
  C:\Windows\System\FdxMwvK.exe
  2⤵
  PID:11008
- C:\Windows\System\FSirpfc.exe
  C:\Windows\System\FSirpfc.exe
  2⤵
  PID:11248
- C:\Windows\System\iNGTGGV.exe
  C:\Windows\System\iNGTGGV.exe
  2⤵
  PID:7676
- C:\Windows\System\cdQMPbl.exe
  C:\Windows\System\cdQMPbl.exe
  2⤵
  PID:10036
- C:\Windows\System\qVWtYAE.exe
  C:\Windows\System\qVWtYAE.exe
  2⤵
  PID:13524
- C:\Windows\System\bExXMIu.exe
  C:\Windows\System\bExXMIu.exe
  2⤵
  PID:4060
- C:\Windows\System\AqtjmTp.exe
  C:\Windows\System\AqtjmTp.exe
  2⤵
  PID:7872
- C:\Windows\System\OnfwlKB.exe
  C:\Windows\System\OnfwlKB.exe
  2⤵
  PID:13644
- C:\Windows\System\hTWlRiM.exe
  C:\Windows\System\hTWlRiM.exe
  2⤵
  PID:6500
- C:\Windows\System\mxWujqv.exe
  C:\Windows\System\mxWujqv.exe
  2⤵
  PID:4748
- C:\Windows\System\WZzGTUm.exe
  C:\Windows\System\WZzGTUm.exe
  2⤵
  PID:10616
- C:\Windows\System\LVaERnG.exe
  C:\Windows\System\LVaERnG.exe
  2⤵
  PID:10136
- C:\Windows\System\cvPMRWe.exe
  C:\Windows\System\cvPMRWe.exe
  2⤵
  PID:10888
- C:\Windows\System\DofJKlV.exe
  C:\Windows\System\DofJKlV.exe
  2⤵
  PID:10788
- C:\Windows\System\VzdrhJa.exe
  C:\Windows\System\VzdrhJa.exe
  2⤵
  PID:7556
- C:\Windows\System\yduKQZn.exe
  C:\Windows\System\yduKQZn.exe
  2⤵
  PID:7344
- C:\Windows\System\EERrPsU.exe
  C:\Windows\System\EERrPsU.exe
  2⤵
  PID:11104
- C:\Windows\System\VaSVXSE.exe
  C:\Windows\System\VaSVXSE.exe
  2⤵
  PID:9672
- C:\Windows\System\JsyFJid.exe
  C:\Windows\System\JsyFJid.exe
  2⤵
  PID:10464
- C:\Windows\System\jGqJEZP.exe
  C:\Windows\System\jGqJEZP.exe
  2⤵
  PID:10796
- C:\Windows\System\nCvxyPM.exe
  C:\Windows\System\nCvxyPM.exe
  2⤵
  PID:11108
- C:\Windows\System\bgUzqFp.exe
  C:\Windows\System\bgUzqFp.exe
  2⤵
  PID:5536
- C:\Windows\System\xQJPprW.exe
  C:\Windows\System\xQJPprW.exe
  2⤵
  PID:9936
- C:\Windows\System\czdsawV.exe
  C:\Windows\System\czdsawV.exe
  2⤵
  PID:10544
- C:\Windows\System\GuTDbJU.exe
  C:\Windows\System\GuTDbJU.exe
  2⤵
  PID:10588
- C:\Windows\System\xzsUmTT.exe
  C:\Windows\System\xzsUmTT.exe
  2⤵
  PID:7308
- C:\Windows\System\rBczFaT.exe
  C:\Windows\System\rBczFaT.exe
  2⤵
  PID:8392
- C:\Windows\System\rumyIVV.exe
  C:\Windows\System\rumyIVV.exe
  2⤵
  PID:11320
- C:\Windows\System\kWBolhz.exe
  C:\Windows\System\kWBolhz.exe
  2⤵
  PID:11380
- C:\Windows\System\xxXKmFB.exe
  C:\Windows\System\xxXKmFB.exe
  2⤵
  PID:11372
- C:\Windows\System\GjQmgVH.exe
  C:\Windows\System\GjQmgVH.exe
  2⤵
  PID:11444
- C:\Windows\System\dQfwRXv.exe
  C:\Windows\System\dQfwRXv.exe
  2⤵
  PID:6836
- C:\Windows\System\pSEqXBR.exe
  C:\Windows\System\pSEqXBR.exe
  2⤵
  PID:11524
- C:\Windows\System\eqZvAjN.exe
  C:\Windows\System\eqZvAjN.exe
  2⤵
  PID:8140
- C:\Windows\System\eUtUMjK.exe
  C:\Windows\System\eUtUMjK.exe
  2⤵
  PID:4552
- C:\Windows\System\mGgtqRs.exe
  C:\Windows\System\mGgtqRs.exe
  2⤵
  PID:8628
- C:\Windows\System\zjiGFjN.exe
  C:\Windows\System\zjiGFjN.exe
  2⤵
  PID:7264
- C:\Windows\System\lQMGVZd.exe
  C:\Windows\System\lQMGVZd.exe
  2⤵
  PID:7360
- C:\Windows\System\fcMdMje.exe
  C:\Windows\System\fcMdMje.exe
  2⤵
  PID:1496
- C:\Windows\System\xAjVHWn.exe
  C:\Windows\System\xAjVHWn.exe
  2⤵
  PID:10328
- C:\Windows\System\EUiJoCK.exe
  C:\Windows\System\EUiJoCK.exe
  2⤵
  PID:14352
- C:\Windows\System\TDMFRaf.exe
  C:\Windows\System\TDMFRaf.exe
  2⤵
  PID:14368
- C:\Windows\System\bKbldqo.exe
  C:\Windows\System\bKbldqo.exe
  2⤵
  PID:14384
- C:\Windows\System\ZTkkcCW.exe
  C:\Windows\System\ZTkkcCW.exe
  2⤵
  PID:14404
- C:\Windows\System\NgKjUXW.exe
  C:\Windows\System\NgKjUXW.exe
  2⤵
  PID:14420
- C:\Windows\System\vZVEqPI.exe
  C:\Windows\System\vZVEqPI.exe
  2⤵
  PID:14436
- C:\Windows\System\RqEXnmC.exe
  C:\Windows\System\RqEXnmC.exe
  2⤵
  PID:14452
- C:\Windows\System\HxTlrPg.exe
  C:\Windows\System\HxTlrPg.exe
  2⤵
  PID:14468
- C:\Windows\System\mJXginf.exe
  C:\Windows\System\mJXginf.exe
  2⤵
  PID:14484
- C:\Windows\System\zIRvVRZ.exe
  C:\Windows\System\zIRvVRZ.exe
  2⤵
  PID:14500
- C:\Windows\System\HpWQAyy.exe
  C:\Windows\System\HpWQAyy.exe
  2⤵
  PID:14516
- C:\Windows\System\OBChwZf.exe
  C:\Windows\System\OBChwZf.exe
  2⤵
  PID:14532
- C:\Windows\System\rJDLohW.exe
  C:\Windows\System\rJDLohW.exe
  2⤵
  PID:14548
- C:\Windows\System\YovcoLY.exe
  C:\Windows\System\YovcoLY.exe
  2⤵
  PID:14564
- C:\Windows\System\KuVQOVo.exe
  C:\Windows\System\KuVQOVo.exe
  2⤵
  PID:14580
- C:\Windows\System\geUnXOb.exe
  C:\Windows\System\geUnXOb.exe
  2⤵
  PID:14596
- C:\Windows\System\omiEEBW.exe
  C:\Windows\System\omiEEBW.exe
  2⤵
  PID:14612
- C:\Windows\System\MdCHQEn.exe
  C:\Windows\System\MdCHQEn.exe
  2⤵
  PID:14628
- C:\Windows\System\eWkaydJ.exe
  C:\Windows\System\eWkaydJ.exe
  2⤵
  PID:14644
- C:\Windows\System\cwFrptJ.exe
  C:\Windows\System\cwFrptJ.exe
  2⤵
  PID:14660
- C:\Windows\System\JFnRfwj.exe
  C:\Windows\System\JFnRfwj.exe
  2⤵
  PID:14676
- C:\Windows\System\iSblltj.exe
  C:\Windows\System\iSblltj.exe
  2⤵
  PID:14696
- C:\Windows\System\cdysHHe.exe
  C:\Windows\System\cdysHHe.exe
  2⤵
  PID:14712
- C:\Windows\System\kemAwrx.exe
  C:\Windows\System\kemAwrx.exe
  2⤵
  PID:14728
- C:\Windows\System\KMqvAzc.exe
  C:\Windows\System\KMqvAzc.exe
  2⤵
  PID:14748
- C:\Windows\System\azAQFNy.exe
  C:\Windows\System\azAQFNy.exe
  2⤵
  PID:14764
- C:\Windows\System\NnQRGnj.exe
  C:\Windows\System\NnQRGnj.exe
  2⤵
  PID:14780
- C:\Windows\System\gdLPgiT.exe
  C:\Windows\System\gdLPgiT.exe
  2⤵
  PID:14796
- C:\Windows\System\qbAaQzw.exe
  C:\Windows\System\qbAaQzw.exe
  2⤵
  PID:14812
- C:\Windows\System\qurrIBg.exe
  C:\Windows\System\qurrIBg.exe
  2⤵
  PID:14828
- C:\Windows\System\QSVNnhR.exe
  C:\Windows\System\QSVNnhR.exe
  2⤵
  PID:14844
- C:\Windows\System\dPkYWuo.exe
  C:\Windows\System\dPkYWuo.exe
  2⤵
  PID:14860
- C:\Windows\System\ipnsIad.exe
  C:\Windows\System\ipnsIad.exe
  2⤵
  PID:14876
- C:\Windows\System\pygFIOZ.exe
  C:\Windows\System\pygFIOZ.exe
  2⤵
  PID:14892
- C:\Windows\System\yyCqORR.exe
  C:\Windows\System\yyCqORR.exe
  2⤵
  PID:14908
- C:\Windows\System\VXJNBRF.exe
  C:\Windows\System\VXJNBRF.exe
  2⤵
  PID:14924
- C:\Windows\System\kcdWPWW.exe
  C:\Windows\System\kcdWPWW.exe
  2⤵
  PID:14944
- C:\Windows\System\OEAzdiZ.exe
  C:\Windows\System\OEAzdiZ.exe
  2⤵
  PID:15168
- C:\Windows\System\ksVqeqo.exe
  C:\Windows\System\ksVqeqo.exe
  2⤵
  PID:8212
- C:\Windows\System\fvemiEO.exe
  C:\Windows\System\fvemiEO.exe
  2⤵
  PID:9252
- C:\Windows\System\wSnxjBn.exe
  C:\Windows\System\wSnxjBn.exe
  2⤵
  PID:11668
- C:\Windows\System\VURTcgE.exe
  C:\Windows\System\VURTcgE.exe
  2⤵
  PID:12384
- C:\Windows\System\usHKsvS.exe
  C:\Windows\System\usHKsvS.exe
  2⤵
  PID:7784
- C:\Windows\System\paPVuLU.exe
  C:\Windows\System\paPVuLU.exe
  2⤵
  PID:15268
- C:\Windows\System\yBBGupV.exe
  C:\Windows\System\yBBGupV.exe
  2⤵
  PID:12760
- C:\Windows\System\VZvaWvo.exe
  C:\Windows\System\VZvaWvo.exe
  2⤵
  PID:12792
- C:\Windows\System\dvOsOzY.exe
  C:\Windows\System\dvOsOzY.exe
  2⤵
  PID:12940
- C:\Windows\System\igbJHYq.exe
  C:\Windows\System\igbJHYq.exe
  2⤵
  PID:15328
- C:\Windows\System\TnxZOLr.exe
  C:\Windows\System\TnxZOLr.exe
  2⤵
  PID:10480
- C:\Windows\System\VqjtYTz.exe
  C:\Windows\System\VqjtYTz.exe
  2⤵
  PID:4796
- C:\Windows\System\wcpqwbE.exe
  C:\Windows\System\wcpqwbE.exe
  2⤵
  PID:10164
- C:\Windows\System\pwrPpCu.exe
  C:\Windows\System\pwrPpCu.exe
  2⤵
  PID:11012
- C:\Windows\System\zNYfnYZ.exe
  C:\Windows\System\zNYfnYZ.exe
  2⤵
  PID:15240
- C:\Windows\System\fFhNdUf.exe
  C:\Windows\System\fFhNdUf.exe
  2⤵
  PID:12944
- C:\Windows\System\cuRXBKG.exe
  C:\Windows\System\cuRXBKG.exe
  2⤵
  PID:14036
- C:\Windows\System\YqzoaFe.exe
  C:\Windows\System\YqzoaFe.exe
  2⤵
  PID:13508
- C:\Windows\System\KgAZUVb.exe
  C:\Windows\System\KgAZUVb.exe
  2⤵
  PID:10024
- C:\Windows\System\UjXIaaQ.exe
  C:\Windows\System\UjXIaaQ.exe
  2⤵
  PID:9836
- C:\Windows\System\TxfzTIR.exe
  C:\Windows\System\TxfzTIR.exe
  2⤵
  PID:12796
- C:\Windows\System\DNBbovD.exe
  C:\Windows\System\DNBbovD.exe
  2⤵
  PID:13132
- C:\Windows\System\bDaZFtU.exe
  C:\Windows\System\bDaZFtU.exe
  2⤵
  PID:9584
- C:\Windows\System\Empenmv.exe
  C:\Windows\System\Empenmv.exe
  2⤵
  PID:7180
- C:\Windows\System\GkMxQbc.exe
  C:\Windows\System\GkMxQbc.exe
  2⤵
  PID:10752
- C:\Windows\System\hAsJGYs.exe
  C:\Windows\System\hAsJGYs.exe
  2⤵
  PID:10268
- C:\Windows\System\nrPlucF.exe
  C:\Windows\System\nrPlucF.exe
  2⤵
  PID:7296
- C:\Windows\System\GGUmbZw.exe
  C:\Windows\System\GGUmbZw.exe
  2⤵
  PID:1180
- C:\Windows\System\KyAToal.exe
  C:\Windows\System\KyAToal.exe
  2⤵
  PID:7848
- C:\Windows\System\BqYgYSH.exe
  C:\Windows\System\BqYgYSH.exe
  2⤵
  PID:7628
- C:\Windows\System\mxcNMDn.exe
  C:\Windows\System\mxcNMDn.exe
  2⤵
  PID:6316
- C:\Windows\System\niWULpu.exe
  C:\Windows\System\niWULpu.exe
  2⤵
  PID:10980
- C:\Windows\System\IlIFWjL.exe
  C:\Windows\System\IlIFWjL.exe
  2⤵
  PID:14492
- C:\Windows\System\DltwgiV.exe
  C:\Windows\System\DltwgiV.exe
  2⤵
  PID:14968
- C:\Windows\System\OOYGjIZ.exe
  C:\Windows\System\OOYGjIZ.exe
  2⤵
  PID:12344
- C:\Windows\System\VikhMIO.exe
  C:\Windows\System\VikhMIO.exe
  2⤵
  PID:11908
- C:\Windows\System\WKuKkBN.exe
  C:\Windows\System\WKuKkBN.exe
  2⤵
  PID:12900
- C:\Windows\System\HgmRcao.exe
  C:\Windows\System\HgmRcao.exe
  2⤵
  PID:1744
- C:\Windows\System\eiEuAOx.exe
  C:\Windows\System\eiEuAOx.exe
  2⤵
  PID:4476
- C:\Windows\System\DIYPeJm.exe
  C:\Windows\System\DIYPeJm.exe
  2⤵
  PID:12192
- C:\Windows\System\oTXTnHM.exe
  C:\Windows\System\oTXTnHM.exe
  2⤵
  PID:12436
- C:\Windows\System\HnKRiPp.exe
  C:\Windows\System\HnKRiPp.exe
  2⤵
  PID:12780
- C:\Windows\System\IxFIapj.exe
  C:\Windows\System\IxFIapj.exe
  2⤵
  PID:12480
- C:\Windows\System\vKnGyEb.exe
  C:\Windows\System\vKnGyEb.exe
  2⤵
  PID:2420
- C:\Windows\System\yvrDmqx.exe
  C:\Windows\System\yvrDmqx.exe
  2⤵
  PID:4372
- C:\Windows\System\weOqVbI.exe
  C:\Windows\System\weOqVbI.exe
  2⤵
  PID:15084
- C:\Windows\System\mDmYvRd.exe
  C:\Windows\System\mDmYvRd.exe
  2⤵
  PID:13172
- C:\Windows\System\mbltvtX.exe
  C:\Windows\System\mbltvtX.exe
  2⤵
  PID:10140
- C:\Windows\System\KIOxpZN.exe
  C:\Windows\System\KIOxpZN.exe
  2⤵
  PID:14856
- C:\Windows\System\KqLrRsj.exe
  C:\Windows\System\KqLrRsj.exe
  2⤵
  PID:15204
- C:\Windows\System\DRyqbbS.exe
  C:\Windows\System\DRyqbbS.exe
  2⤵
  PID:13072
- C:\Windows\System\loKZCyb.exe
  C:\Windows\System\loKZCyb.exe
  2⤵
  PID:8240
- C:\Windows\System\MIekbVr.exe
  C:\Windows\System\MIekbVr.exe
  2⤵
  PID:1828
- C:\Windows\System\EaDJrIR.exe
  C:\Windows\System\EaDJrIR.exe
  2⤵
  PID:6864
- C:\Windows\System\OCvshdm.exe
  C:\Windows\System\OCvshdm.exe
  2⤵
  PID:10808
- C:\Windows\System\JHDOELq.exe
  C:\Windows\System\JHDOELq.exe
  2⤵
  PID:14956
- C:\Windows\System\VECWCEJ.exe
  C:\Windows\System\VECWCEJ.exe
  2⤵
  PID:10772
- C:\Windows\System\SPppLpu.exe
  C:\Windows\System\SPppLpu.exe
  2⤵
  PID:11896
- C:\Windows\System\ThpxpnC.exe
  C:\Windows\System\ThpxpnC.exe
  2⤵
  PID:9048
- C:\Windows\System\PLxNuUF.exe
  C:\Windows\System\PLxNuUF.exe
  2⤵
  PID:8900
- C:\Windows\System\QkkzpFd.exe
  C:\Windows\System\QkkzpFd.exe
  2⤵
  PID:13924
- C:\Windows\System\PXaeljL.exe
  C:\Windows\System\PXaeljL.exe
  2⤵
  PID:2328

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wiijwuwx.ewz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BGPNyxL.exe

Filesize
1.7MB

MD5
0cb940aae98d080bf9e5388ab38f7e7d

SHA1
e67ce382d67a34fab18eaea1b8f0444175d2f326

SHA256
ab72f7bc70f8f285c25eac09ea389410514dd0ffe3f50029de42d53171c7e569

SHA512
4a0352718523ee3c85ca3559c1bb247841cf972aab4cee6c41ec57ae251f111095cee0bf8b1dad9c907edf97ff7cb1c22a64cfb9f146c486e9b3981cc50d7b3d

Download Submit
C:\Windows\System\BoHTieI.exe

Filesize
1.7MB

MD5
f235fb5dd58335c35b8d858f729e1431

SHA1
c24e2b183ec4bb104525cb6dfe2e4f52c0035108

SHA256
3dd168df5be8f4daeb166f9605ae883ca78980030df8d0166f2399bf473afff5

SHA512
67524aafdaedf3d4760c8e78c209073e694eabe6c315b049749e5127abb09de1e5f00593b1fe05ec40f4472fe2bda8ada7c261bfcec8a76332a0319198a89351

Download Submit
C:\Windows\System\CoImhoJ.exe

Filesize
1.7MB

MD5
85125af0ec6dac4c200420683352207f

SHA1
6d07820377c0c5e46959cc3b73b323b2f302577b

SHA256
0d2447d45f7dc95694cbd82030cab7dfe9bde172f0ad42eb93d2f524fd4afc1f

SHA512
55ccb61c6adfe4d090f641acf930c4b4555a4649163cc3e4629e6dbad60e52e6cf3a6c65d4fb9fca0d7718e5fad9fe832d4abd8680c8b93b4c0db9eb70885ca4

Download Submit
C:\Windows\System\DNkaBsH.exe

Filesize
1.7MB

MD5
0c9f865fa954cd0bf3564efefe8625ee

SHA1
4f50b879927a7d76a00d9fe3005a3c0d0596e9bb

SHA256
169f576b8d72acc9ac79427ca6e778ae356068238ccd9ed9f5c85a25af45b379

SHA512
428cab2b8f76850f473ecc3cf6a48e71ecbe5de3aaeea24358cc0cc797319bb11e99ec82a9720972a5b8bd8c7e89eb5fcad750a9f42707ce410563c4ffa15151

Download Submit
C:\Windows\System\EJuCaTy.exe

Filesize
1.7MB

MD5
44c679e83e6b22cac86d732f94724c33

SHA1
b01bf74639b0df8ca00248047b5e10293582c7ef

SHA256
e1446bb3062d4598e2929ee96b90f0b8d004728508e3750f78cb6e933277db2b

SHA512
75d13db303fcb8cdeacd09b129d4086d6a3e21d652951e4c4ec24961b565955a757d8d66924fd5de20f339cd538c657854a1270a5d258d09c45f5ac273551022

Download Submit
C:\Windows\System\IBmgRDr.exe

Filesize
1.7MB

MD5
c2af6a8adaaf0ab7ac6ebd9c9eb26889

SHA1
d6fe060c1f9de6c4c6c8706c17e2e7a69c098653

SHA256
d17db7cc3668bb349ac3dfc085dafd4570dfcc4cdbb3ab31f701f3b2f505638c

SHA512
e10a6577a292fc3ab46111db703dfa2a4a2e16d027b0ffc6606174624484120861f820e1db9a2555f6ae16571b60b050093cf25771067c06cd7efea264587c70

Download Submit
C:\Windows\System\IPzhtHi.exe

Filesize
1.7MB

MD5
77758f6bc760ade0918edb27e86f0932

SHA1
203ce03ef11f03a4c9dc9da090d44692c78fcd41

SHA256
04ea11b1251eaac43adad1db7be07fac6fcc5026b3ec56d01a75bf1040436651

SHA512
1425c824cd50a53641e3d9020fdb48aed7dfc39d89a9e40f95111ad6a9ee19bd7e66fdcf23f59b2d00f4c4a5169bb14c7ff6fd890afeedf0dc1670a58d3648fc

Download Submit
C:\Windows\System\IzvMTmp.exe

Filesize
1.7MB

MD5
9de1d9c8bff78b2d268ddf18846cf203

SHA1
328e87c0ab1362e9d703da6beeb505dc2cba8f0a

SHA256
0c69bf9c44d0979721681a7a8969c3ab5962d403ba804eb59c58857d4fb88b98

SHA512
2c2529d2bf13c5a4aa7e94196142070e9f8e5bf0835b81cd90beeec57a6a5c85e3b1649f5ae8b3f72a7237929a68e0e618bf4ea497635776ef2285efc2aaa663

Download Submit
C:\Windows\System\KlXgCWI.exe

Filesize
1.7MB

MD5
3fe882f3c43ef524a1a90f448f65b2fc

SHA1
af608541c4b196145e5736bef0e2181a9a0bc9ae

SHA256
422d99aaa82371a40c052789e21b2d4bcfbe90e7d5dd4330f15c5d52e9581708

SHA512
f412305824f14b3afc6e17873afc6259a76f5e272394e0e5d0367b0c8113ff3d0a53f7f2e62850aa65397025a7c85bae99ec36f88338c1c7cfd6bde043d909a7

Download Submit
C:\Windows\System\OepPNzx.exe

Filesize
8B

MD5
66d7e297b90fe34ca06f598960896d19

SHA1
0433321fa0d916440f15cdee91c3e93318197dee

SHA256
62c8848e8576ee6bb1b62b04fa3898ea9c1bff1c6df8e2421efa77ab49fa4456

SHA512
4abb742b6807bc5e9c1f07c9bd2c9a15b441e3a0f7a9715e62b9a71c659b66c03f5bdd4961bd675100bab1c61778e8b524a13e9a54f36d441aeb74ce1a0b5e73

Download Submit
C:\Windows\System\RiqAcUl.exe

Filesize
1.7MB

MD5
efe45cf8ff32c95b831e096be853c89d

SHA1
332dd55d1f1bc7ff6e40105d3d847bb139ffa6b7

SHA256
e7cd30f9ba270febeadbc3afb21c2083b930a3f998c865bd449c18078d6b21f4

SHA512
64227f6b17e2c746fc8ae148306ec696ff9ad17cc1671d629275385236bab2498d075bb9c33f4c7f6e0ff2894f9cd58299e9c923bea160af1d84809bc066c19d

Download Submit
C:\Windows\System\SeQWNNb.exe

Filesize
1.7MB

MD5
bf98382a1414fd0ac7285584d6b1b224

SHA1
9182c63e93f4af96ba9505b91a666157dc838e60

SHA256
30384de3f022b280a0ee49b16a3dd241ef112d9c08ef819828fb859aa022376a

SHA512
0404ee1e7e81b976b561267f297998562c945f995bfaa0d8bd0d20289b27fbb5e2260c882a0b805680e2d741ead1734684c755f0b83985002f137618fd674144

Download Submit
C:\Windows\System\UJnKuGS.exe

Filesize
1.7MB

MD5
b7458199895f5b0769be119b4b630a3f

SHA1
c3465747462d97c872f6a09d15386fe75dd20c77

SHA256
f7893e0ac63c4fb14ddd435a8d37e685a4cb6609d7342c40ecb58583ed43e5ba

SHA512
46a36a3a9de8a22a795b62bdaa7e7a24c2957d0b861b5157aefdac70e332dd350e832c3929a6637046c313687a8f377d46c6a6f1eadddbe514ee985562a7996e

Download Submit
C:\Windows\System\WMkRyMq.exe

Filesize
1.7MB

MD5
95b3b1b9cce8426cd0cabf266c119b20

SHA1
261977e0bba1d4009b220e6362e76bc89defc424

SHA256
ea71f371ee408f481927605ec9e28f02dc17dc7b97c4de1ad0dcd68dc821e05a

SHA512
cb0481528a412a8da50899fc76c11a4a8020a5140d96bce0cfcfe5fc7377965bb5b26978d3c6edd78106e328a6a9e49ad3341e9f8e32335db00c78efd57159cd

Download Submit
C:\Windows\System\WuGZSqZ.exe

Filesize
1.7MB

MD5
456da5d36f0e58d094b33741437648f2

SHA1
17a6f3aa63e090c29d9b87ba96b4687f415ee241

SHA256
7a8dfb3a76143916edf7525ba8d40532312bb3f6162f2fd82ccd915723279769

SHA512
17bd2b797359f46476a25b045cb721d2a948f59c03b819602d47111addac5a3b1d2e13984ca353ab414e1053b17aec76b2ec20adbb2490ed05d450a14da43173

Download Submit
C:\Windows\System\ZFfLxNs.exe

Filesize
1.7MB

MD5
44d89d2908fa4ff64b1137f9ac1d5b8f

SHA1
42aee476871e7d2eaef937d43f14f14c575b0fa5

SHA256
1c077755c4a03da370cf44c34dad5ed3660934e97a783e82de9939187e7816e4

SHA512
376cec3404e198dfad9d689f57e4e0d5f4af135149ba34d351d88ae03dbb5283adb5faa1f048fe88a59e197802ee1eabc1129f97f7f61bed264f9251a02a6dc6

Download Submit
C:\Windows\System\ZHvMvmS.exe

Filesize
1.7MB

MD5
7b8becd9a485da3e3b7e446f2c26cf11

SHA1
f418705a325c13372fd325e7947a1e3c473dce60

SHA256
d52db034aaf77870499243c492ac2794473938096a3d9525660c8fb23cd00246

SHA512
781f0def348ff5caaaa0ac1f450be0f2d1a7127d12ee77d58ccac50a15c6582a78d9710c82e718747cb0a2ea009f9823adff1dd21bbe3309f80c611dbae1382a

Download Submit
C:\Windows\System\aVeJExJ.exe

Filesize
1.7MB

MD5
9e52766925b85783b143113688c2a210

SHA1
b54e37c4528fecb878aff8726aa6a77b5b8a1937

SHA256
eed6e2ea2a7c469a538fdf5353e9cb3b09187b0b613d9951d4165a557dbd1c6e

SHA512
688db480345d409d1dd1744d1418d9647a3a811ce9a42f0105f7afc7f486adefb93c3c3739170f7b7fb4dd48777e6828f97e7249577dc99ab496ec8dea021c87

Download Submit
C:\Windows\System\dAZpSmu.exe

Filesize
1.7MB

MD5
b4f2be2b21d11519f416903b1ba75de9

SHA1
4fd43cf9d17e37b4f27c90e92003143b9ace3cfa

SHA256
79e560b74f6183819ec56b323a9b55cb616145ee033255eeae87855eb9f85783

SHA512
3ace669298dc4a34f6436a696648ad47475149ce5d0ef8cdf3b278052a386201e08b9657b1fad29ce38d6e5af10ee28dd8d517c0f980084dd4026505038751c7

Download Submit
C:\Windows\System\dROcDoA.exe

Filesize
1.7MB

MD5
29ac80a3e4c4ddf18b634cc6391a298d

SHA1
a20f48a394cbb304ae519e9825a30bdc167fe8ee

SHA256
ad3de50f1d1dcd0c43f8233612588bcc7f68f64ac74c77ac5538652327532c84

SHA512
6e75244e8c94664ad9a2495eb8bef8597312661167bd7bac121afe5fb8b3dc9cc90ad4f569a39b58aed41214fc5c0b1d78d45d260fd8a710d8e80979a31bcd82

Download Submit
C:\Windows\System\fOWDBMl.exe

Filesize
1.7MB

MD5
af68881439d2928d6f4d141ac45b1909

SHA1
4ba2eb86ea473c742f6f0105a6d2fc96b1b3e97f

SHA256
5a5a9443d9ea546d1120086fbc465a33cf4c9aa7b1107d4d2c63ef510a0f2984

SHA512
6de9403e3e53b9c2a3aa07fa5966aafb8d4897dd4cae800bf283ea53f12095fdd25451e45946ebf76a193235c289ebf3f6dc0e451b75a3ea93121e106eafbf30

Download Submit
C:\Windows\System\hUjDAJF.exe

Filesize
1.7MB

MD5
18be586b387d766e8f39a33326d9ab20

SHA1
b9344ea52621ff76c71597ebe0a381c3871d46dc

SHA256
5dd03cd79624d1bae294f8294c9d91fb16fcd3631fda6287fc9865c367d2d084

SHA512
60c888d9c7852b8eee79444dc87dab170dbceae011e4a1f3a7c1bb74d15a757f21b2104cf095079f0d80a8c4ec7ec7082ac8e7318a8f1c802befb01d9c442ee8

Download Submit
C:\Windows\System\knKVAMo.exe

Filesize
1.7MB

MD5
8d6b88d1af4c45a88c2c2d779a3a1697

SHA1
466dd54f1fc82330502a25186409d7dbaa6ec229

SHA256
170b9dcc6464c3faab0ffb9cd96d66b949804a12060afac009bf7e91fde09c25

SHA512
073648b584839251784531db221e0e579675cb28a80eb6f8cf56dafa95907431b546785a82ee041968ae31fd91ea38baef6ac49d352d5d705f12f18a1fadd08c

Download Submit
C:\Windows\System\kngKrMZ.exe

Filesize
1.7MB

MD5
29e8636fc776eba5a93c2230da6a091c

SHA1
ef72a8f72a5f38c089d2132c913928e9fbc6375c

SHA256
3463fbde0e31e4701ce27018bbcfb415d9db55ed88ff7114c8ff4b92ed5e48f4

SHA512
b27bb19a21c286b31120f862690c28456101912ddadb1cd13f33fd28cfe0cc3113b71ce278e43d98065a42856b0f980b2c050c83d79a03c8f366a6b7b530a3b1

Download Submit
C:\Windows\System\lbfFXSC.exe

Filesize
1.7MB

MD5
73b07b7a8f9c3ff3940f252aaefe6624

SHA1
ee4eceb663eae20f674bd511298e58741f4a5828

SHA256
028dc82569eb80ecad2896a1b6bd355988c18c3db17c092dd100a3a8c8030a3a

SHA512
f9b36cfb61e138e0135d30e9723728cad4bdd4f52cefeaf0a9f2b8e4aadf46995db6439993d454db54e42dcf4d57c9c8524752a63c06e74a03aa180a9b2e4220

Download Submit
C:\Windows\System\njcgiPm.exe

Filesize
1.7MB

MD5
6b209fd7a39fc22bbafba915b4c4ca99

SHA1
1252d22a5ab18754b4720621238e27a0f4f52242

SHA256
7aba987411553088101e0768a60e509933dc35ff7ece2963e0925ada595d9d6c

SHA512
01c303203976c6f40295d796af8bf134b3ab5d05199afceda739e4a266002de313cad82ffbb021d813567093f43e37b314a29fcaebda58bc6f31420395288efb

Download Submit
C:\Windows\System\otAMlhR.exe

Filesize
1.7MB

MD5
58d39839a02c4bd62d6c6071348fd70c

SHA1
bb7bf8458e990af631dc00f4a9775e2bd7328266

SHA256
a5c9f2750b4148e6c2754b816cbed37cdbf8cec36f3ad91e75f5854384663696

SHA512
0a00aba936bdcdbe18dd9d0ed6720350a4d118dae4ddaf71a5a99ad0c00e432f76ddc75cb307de994b937b5fc6aa598d05e7e047e81188219900ac9bca9a86f6

Download Submit
C:\Windows\System\qAbDNiC.exe

Filesize
1.7MB

MD5
acdefbaadcbcfe363de40c2b32a6b92f

SHA1
09c722a4cf69167758e23cf1da0fc1492a6ca7b6

SHA256
533a5ce6b8b5b98177f13ba779bb752e4395485209967131fdf57650b8c8d4fb

SHA512
c1eac30f916af13cea68ddc43fa1ce274a0c8c043ace7fceff69675284e9ee29fc6e2ebecf6da659494175bdd38e1b8572709b8f0acfb38f9b169de5724569f9

Download Submit
C:\Windows\System\rDKiqnB.exe

Filesize
1.7MB

MD5
a14f5375b8e47c8b71713992f12dd601

SHA1
00375b9f5f7925dec76393200dabb168649a98e5

SHA256
fc5c2ab903520f99ea9080747fbd0dec5390db5836e90a37432650b74adabc4d

SHA512
46705ea9f53287852ae459609d33f993dc74b60b5610092b918f671d4428159165f5218d5bf9232b442211aac6fce0543e76402be11cd11a4d355fb2b20c38b3

Download Submit
C:\Windows\System\rWlKVum.exe

Filesize
1.7MB

MD5
7960e692f67b670791d5580e0b0efdd6

SHA1
5336c1b1b81f8ef8b5f669497078d8d9d11c4110

SHA256
43bba86b82e79ad71c7ff3c0c03c0dc9bfee5809eb655dc3d839e5fb939bc9a4

SHA512
4f729c70d4046afb5d4910c7d2c41a782aa228bb0bed5ba1dcee6bf9190e75328a5b19bd6dcd99d2082b37c01312558fddaef402d1aa337816f8e03a9b3d78bd

Download Submit
C:\Windows\System\uRBCYcV.exe

Filesize
1.7MB

MD5
c00a95cc11ceca3291107776c8f786ea

SHA1
b773f72ce3fb3f031c811d749e44b072d94ba9b6

SHA256
a2425ef90c65b2e8dc2943929d579cd9ae63268573fda595612b57734775561f

SHA512
7b2a90114d259d6718e8889cf0e0e42a648ffa05234a3422c1991f23678ac8da0d9ee4cb2ce45145f6535d35319b27a830283228517306e6412935fbfac7d152

Download Submit
C:\Windows\System\uzGJJKy.exe

Filesize
1.7MB

MD5
676f8d112857d29ff57cb5b5cb39f528

SHA1
47dd197186222d0e055f3845a8a98c8218e2cadd

SHA256
f8ffd56da4f2a5a758c5bc13dda30b45ef8e84f90123fce89c26462a242592d6

SHA512
c61156a90857fe59ff71fba7d068c1d9a82aa0bba91074f02f057363f9c62d4913e71b0281444ead7651fa6c5be3c64e0a86e9961b3335c9770de22bac4b74c0

Download Submit
C:\Windows\System\vlecHxZ.exe

Filesize
1.7MB

MD5
3f363d524a164f9d2b13dcb4c44ee1e5

SHA1
6cb8da093fb4efd4d8a5b8bd1d1973d02b0ec42b

SHA256
75822cccc116f73e008b4bc8435b54ce769c8d1554c25a94e6dd7a24d4969563

SHA512
24a19e2d4046478781e43a2f7f03261e64627708958479eb72432cbe16e1fd4ccaadb9cf5c562fb96318a44924beef0f5ef67bb6fbce35b7d48794bea4454962

Download Submit
C:\Windows\System\wZALzvE.exe

Filesize
1.7MB

MD5
4d9a43ba4e9a86a3d5b1b58072bd3cff

SHA1
a9f427a09d5fd7c0bed171cfe2d16893d423d9c0

SHA256
921d3a26fab10d0c7978c44835a9bd20641abcc6edf91a280d4cf6907147001f

SHA512
d816c75dbb2ae14a033955d708f78c3dc96a3a655acaf54b2b3ae628dd3733dd111b1c3df331dac2651e1d414b1a8c8bb2b5dded156d32c77e8efde86d05786a

Download Submit
memory/952-35-0x00007FF7E8340000-0x00007FF7E8732000-memory.dmp

Filesize
3.9MB

Download
memory/980-4306-0x00007FF62A830000-0x00007FF62AC22000-memory.dmp

Filesize
3.9MB

Download
memory/980-582-0x00007FF62A830000-0x00007FF62AC22000-memory.dmp

Filesize
3.9MB

Download
memory/1304-4302-0x00007FF6F5620000-0x00007FF6F5A12000-memory.dmp

Filesize
3.9MB

Download
memory/1304-547-0x00007FF6F5620000-0x00007FF6F5A12000-memory.dmp

Filesize
3.9MB

Download
memory/1320-41-0x00007FF6F57F0000-0x00007FF6F5BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1328-546-0x00007FF744D70000-0x00007FF745162000-memory.dmp

Filesize
3.9MB

Download
memory/1328-4298-0x00007FF744D70000-0x00007FF745162000-memory.dmp

Filesize
3.9MB

Download
memory/1548-57-0x00007FF7D89B0000-0x00007FF7D8DA2000-memory.dmp

Filesize
3.9MB

Download
memory/1584-4301-0x00007FF7AF280000-0x00007FF7AF672000-memory.dmp

Filesize
3.9MB

Download
memory/1584-564-0x00007FF7AF280000-0x00007FF7AF672000-memory.dmp

Filesize
3.9MB

Download
memory/1876-524-0x00007FF75C9C0000-0x00007FF75CDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-3201-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp

Filesize
3.9MB

Download
memory/2072-68-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp

Filesize
3.9MB

Download
memory/2080-499-0x00007FF6A6F60000-0x00007FF6A7352000-memory.dmp

Filesize
3.9MB

Download
memory/2204-0-0x00007FF7687F0000-0x00007FF768BE2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-1-0x0000018230950000-0x0000018230960000-memory.dmp

Filesize
64KB

Download
memory/2452-4304-0x00007FF723C20000-0x00007FF724012000-memory.dmp

Filesize
3.9MB

Download
memory/2452-560-0x00007FF723C20000-0x00007FF724012000-memory.dmp

Filesize
3.9MB

Download
memory/2524-518-0x00007FF6D8040000-0x00007FF6D8432000-memory.dmp

Filesize
3.9MB

Download
memory/2524-4294-0x00007FF6D8040000-0x00007FF6D8432000-memory.dmp

Filesize
3.9MB

Download
memory/2532-33-0x0000019F51D40000-0x0000019F51D50000-memory.dmp

Filesize
64KB

Download
memory/2532-36-0x0000019F51D40000-0x0000019F51D50000-memory.dmp

Filesize
64KB

Download
memory/2532-32-0x00007FFF27E70000-0x00007FFF28931000-memory.dmp

Filesize
10.8MB

Download
memory/2532-61-0x0000019F51D10000-0x0000019F51D32000-memory.dmp

Filesize
136KB

Download
memory/2648-76-0x00007FF68B440000-0x00007FF68B832000-memory.dmp

Filesize
3.9MB

Download
memory/2812-4793-0x00007FF6670B0000-0x00007FF6674A2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-79-0x00007FF6670B0000-0x00007FF6674A2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-509-0x00007FF633880000-0x00007FF633C72000-memory.dmp

Filesize
3.9MB

Download
memory/3192-4246-0x00007FF633880000-0x00007FF633C72000-memory.dmp

Filesize
3.9MB

Download
memory/3196-46-0x00007FF66EA60000-0x00007FF66EE52000-memory.dmp

Filesize
3.9MB

Download
memory/3272-72-0x00007FF7B5290000-0x00007FF7B5682000-memory.dmp

Filesize
3.9MB

Download
memory/4408-2841-0x00007FF7AB080000-0x00007FF7AB472000-memory.dmp

Filesize
3.9MB

Download
memory/4408-13-0x00007FF7AB080000-0x00007FF7AB472000-memory.dmp

Filesize
3.9MB

Download
memory/4576-62-0x00007FF66F550000-0x00007FF66F942000-memory.dmp

Filesize
3.9MB

Download
memory/4820-513-0x00007FF7C3030000-0x00007FF7C3422000-memory.dmp

Filesize
3.9MB

Download
memory/5032-58-0x00007FF7CA4D0000-0x00007FF7CA8C2000-memory.dmp

Filesize
3.9MB

Download