xmrig | 3d9c9a03529af4963eef1ce5fede07c44f9425abb91ccf15f046b2d0363dca78

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
Size

2.1MB
MD5

09e32f1ce2e5a213385f52e1c1c137e4
SHA1

118538d9caae6b823b046aea544b8a87aee9d27c
SHA256

3d9c9a03529af4963eef1ce5fede07c44f9425abb91ccf15f046b2d0363dca78
SHA512

9704eb3d766bf4ae03fd729bdcc022bcab5db292094a4541ee6f1281151c27314ac6f820f998b23dc12805f04d4b0e91d44390631becaa289d84e16f7a297eec
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafnmo5mYN/:NABM

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/3552-68-0x00007FF7A6EF0000-0x00007FF7A72E2000-memory.dmp	xmrig
behavioral2/memory/1360-73-0x00007FF79ED70000-0x00007FF79F162000-memory.dmp	xmrig
behavioral2/memory/4228-98-0x00007FF70BEE0000-0x00007FF70C2D2000-memory.dmp	xmrig
behavioral2/memory/4812-102-0x00007FF730B50000-0x00007FF730F42000-memory.dmp	xmrig
behavioral2/memory/1400-94-0x00007FF7618D0000-0x00007FF761CC2000-memory.dmp	xmrig
behavioral2/memory/3216-90-0x00007FF60B290000-0x00007FF60B682000-memory.dmp	xmrig
behavioral2/memory/4200-86-0x00007FF77AB40000-0x00007FF77AF32000-memory.dmp	xmrig
behavioral2/memory/4624-85-0x00007FF7078B0000-0x00007FF707CA2000-memory.dmp	xmrig
behavioral2/memory/4080-79-0x00007FF6B3A60000-0x00007FF6B3E52000-memory.dmp	xmrig
behavioral2/memory/316-80-0x00007FF694070000-0x00007FF694462000-memory.dmp	xmrig
behavioral2/memory/1468-72-0x00007FF7766C0000-0x00007FF776AB2000-memory.dmp	xmrig
behavioral2/memory/2936-4264-0x00007FF6751F0000-0x00007FF6755E2000-memory.dmp	xmrig
behavioral2/memory/808-4275-0x00007FF76A950000-0x00007FF76AD42000-memory.dmp	xmrig
behavioral2/memory/1504-4268-0x00007FF7E0130000-0x00007FF7E0522000-memory.dmp	xmrig
behavioral2/memory/1956-4266-0x00007FF611F20000-0x00007FF612312000-memory.dmp	xmrig
behavioral2/memory/1468-4328-0x00007FF7766C0000-0x00007FF776AB2000-memory.dmp	xmrig
behavioral2/memory/3552-4335-0x00007FF7A6EF0000-0x00007FF7A72E2000-memory.dmp	xmrig
behavioral2/memory/4228-4340-0x00007FF70BEE0000-0x00007FF70C2D2000-memory.dmp	xmrig
behavioral2/memory/4080-4344-0x00007FF6B3A60000-0x00007FF6B3E52000-memory.dmp	xmrig
behavioral2/memory/316-4353-0x00007FF694070000-0x00007FF694462000-memory.dmp	xmrig
behavioral2/memory/4812-4359-0x00007FF730B50000-0x00007FF730F42000-memory.dmp	xmrig
behavioral2/memory/1360-4350-0x00007FF79ED70000-0x00007FF79F162000-memory.dmp	xmrig
behavioral2/memory/4624-4348-0x00007FF7078B0000-0x00007FF707CA2000-memory.dmp	xmrig
behavioral2/memory/3216-4370-0x00007FF60B290000-0x00007FF60B682000-memory.dmp	xmrig
behavioral2/memory/4200-4368-0x00007FF77AB40000-0x00007FF77AF32000-memory.dmp	xmrig
behavioral2/memory/1400-4363-0x00007FF7618D0000-0x00007FF761CC2000-memory.dmp	xmrig
behavioral2/memory/2860-4960-0x00007FF608ED0000-0x00007FF6092C2000-memory.dmp	xmrig
behavioral2/memory/3960-4963-0x00007FF73BA90000-0x00007FF73BE82000-memory.dmp	xmrig
behavioral2/memory/2216-4964-0x00007FF66F5A0000-0x00007FF66F992000-memory.dmp	xmrig
behavioral2/memory/1376-4966-0x00007FF6FF570000-0x00007FF6FF962000-memory.dmp	xmrig
behavioral2/memory/3960-6407-0x00007FF73BA90000-0x00007FF73BE82000-memory.dmp	xmrig
behavioral2/memory/1376-6433-0x00007FF6FF570000-0x00007FF6FF962000-memory.dmp	xmrig
behavioral2/memory/4580-6436-0x00007FF7FB490000-0x00007FF7FB882000-memory.dmp	xmrig
behavioral2/memory/2216-6631-0x00007FF66F5A0000-0x00007FF66F992000-memory.dmp	xmrig
behavioral2/memory/4772-6679-0x00007FF6363E0000-0x00007FF6367D2000-memory.dmp	xmrig
behavioral2/memory/808-6645-0x00007FF76A950000-0x00007FF76AD42000-memory.dmp	xmrig
behavioral2/memory/1956-6634-0x00007FF611F20000-0x00007FF612312000-memory.dmp	xmrig
behavioral2/memory/2860-6917-0x00007FF608ED0000-0x00007FF6092C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4228	mhozMFE.exe
3552	AbctPdA.exe
1468	YBXoasw.exe
1360	yyppdGF.exe
4080	wlREOtj.exe
316	KUwtIuy.exe
4624	CKfeQUt.exe
4812	nVcLIWJ.exe
4200	sUNQxTH.exe
3216	HGNNyux.exe
1400	HvlMuVq.exe
2936	DmXhxXw.exe
1956	ZtYKPEp.exe
1504	lcTlMzj.exe
808	NRAoaNE.exe
4772	yZeqDwC.exe
4580	MafKHqe.exe
2860	JANQMpL.exe
3960	aeaCjZT.exe
2216	TTFQtby.exe
1376	VNVtFPy.exe
4084	WRtzOOs.exe
228	UPYnWff.exe
4512	kfCSacn.exe
3184	fJGBSjY.exe
3616	FKMLGfK.exe
2180	mXdqjWK.exe
3508	uVHIOib.exe
1716	OtKKPnc.exe
1844	LyySidn.exe
1876	hMehWHC.exe
1708	sahVtAo.exe
1028	AKvTGpC.exe
4600	PjEuHiO.exe
3968	dvhTBGO.exe
2244	MzBXaso.exe
1112	vzWegzQ.exe
2888	DESsphj.exe
3484	XEnjxUf.exe
4788	EicMhFz.exe
3996	bYqKPZK.exe
516	clKkMCx.exe
1792	oyegIpd.exe
3676	pTANtpj.exe
3284	WXTGHHp.exe
2168	iWLHUqF.exe
2568	CpdJIkJ.exe
4184	cvtOYMJ.exe
2932	KRgXISg.exe
4456	ykhSBga.exe
1100	DZkrEDX.exe
4376	aSEsqGu.exe
624	yodCJEw.exe
2744	XzJWyRG.exe
4392	pqbIuJp.exe
4872	QUFYtpv.exe
4792	dQcIVqF.exe
3372	wxTXJWt.exe
2344	IeovFkk.exe
4032	plBJgtg.exe
3396	fgleZdR.exe
5112	JQgyxDR.exe
736	hSyTzbe.exe
3048	QlQnkMQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1156-0-0x00007FF7A8A20000-0x00007FF7A8E12000-memory.dmp	upx
behavioral2/files/0x000a000000023bc2-6.dat	upx
behavioral2/files/0x000d000000023bb9-7.dat	upx
behavioral2/files/0x000a000000023bc1-15.dat	upx
behavioral2/files/0x000a000000023bc4-25.dat	upx
behavioral2/files/0x000a000000023bc9-59.dat	upx
behavioral2/files/0x000b000000023bcb-65.dat	upx
behavioral2/memory/3552-68-0x00007FF7A6EF0000-0x00007FF7A72E2000-memory.dmp	upx
behavioral2/memory/1360-73-0x00007FF79ED70000-0x00007FF79F162000-memory.dmp	upx
behavioral2/files/0x000b000000023bca-87.dat	upx
behavioral2/memory/4228-98-0x00007FF70BEE0000-0x00007FF70C2D2000-memory.dmp	upx
behavioral2/memory/2936-106-0x00007FF6751F0000-0x00007FF6755E2000-memory.dmp	upx
behavioral2/memory/1504-114-0x00007FF7E0130000-0x00007FF7E0522000-memory.dmp	upx
behavioral2/files/0x000a000000023bd7-131.dat	upx
behavioral2/files/0x000a000000023bde-155.dat	upx
behavioral2/files/0x000e000000023bf1-173.dat	upx
behavioral2/files/0x0008000000023c3f-215.dat	upx
behavioral2/files/0x0008000000023c3e-212.dat	upx
behavioral2/files/0x0008000000023c3d-209.dat	upx
behavioral2/files/0x0008000000023c3c-206.dat	upx
behavioral2/files/0x0008000000023c0d-203.dat	upx
behavioral2/files/0x0008000000023c0c-200.dat	upx
behavioral2/files/0x0008000000023c0b-197.dat	upx
behavioral2/files/0x0008000000023c0a-194.dat	upx
behavioral2/files/0x0008000000023c07-191.dat	upx
behavioral2/files/0x000e000000023c05-188.dat	upx
behavioral2/files/0x0009000000023c01-185.dat	upx
behavioral2/files/0x0009000000023c00-182.dat	upx
behavioral2/files/0x0009000000023bff-179.dat	upx
behavioral2/files/0x0008000000023bfa-176.dat	upx
behavioral2/files/0x000a000000023bea-170.dat	upx
behavioral2/files/0x000b000000023be2-167.dat	upx
behavioral2/files/0x000b000000023be1-164.dat	upx
behavioral2/files/0x000b000000023be0-161.dat	upx
behavioral2/files/0x000a000000023bdf-158.dat	upx
behavioral2/files/0x000a000000023bdd-152.dat	upx
behavioral2/files/0x000a000000023bdc-149.dat	upx
behavioral2/files/0x000a000000023bdb-146.dat	upx
behavioral2/files/0x000a000000023bda-143.dat	upx
behavioral2/memory/1376-142-0x00007FF6FF570000-0x00007FF6FF962000-memory.dmp	upx
behavioral2/files/0x000a000000023bd9-139.dat	upx
behavioral2/memory/2216-138-0x00007FF66F5A0000-0x00007FF66F992000-memory.dmp	upx
behavioral2/files/0x000a000000023bd8-135.dat	upx
behavioral2/memory/3960-134-0x00007FF73BA90000-0x00007FF73BE82000-memory.dmp	upx
behavioral2/memory/2860-130-0x00007FF608ED0000-0x00007FF6092C2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd6-127.dat	upx
behavioral2/memory/4580-126-0x00007FF7FB490000-0x00007FF7FB882000-memory.dmp	upx
behavioral2/files/0x000a000000023bd5-123.dat	upx
behavioral2/memory/4772-122-0x00007FF6363E0000-0x00007FF6367D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd4-119.dat	upx
behavioral2/memory/808-118-0x00007FF76A950000-0x00007FF76AD42000-memory.dmp	upx
behavioral2/files/0x000a000000023bd3-115.dat	upx
behavioral2/files/0x000a000000023bd2-111.dat	upx
behavioral2/memory/1956-110-0x00007FF611F20000-0x00007FF612312000-memory.dmp	upx
behavioral2/files/0x000a000000023bd1-107.dat	upx
behavioral2/files/0x000a000000023bd0-103.dat	upx
behavioral2/memory/4812-102-0x00007FF730B50000-0x00007FF730F42000-memory.dmp	upx
behavioral2/files/0x000a000000023bcf-99.dat	upx
behavioral2/files/0x000a000000023bce-95.dat	upx
behavioral2/memory/1400-94-0x00007FF7618D0000-0x00007FF761CC2000-memory.dmp	upx
behavioral2/files/0x000b000000023bbe-91.dat	upx
behavioral2/memory/3216-90-0x00007FF60B290000-0x00007FF60B682000-memory.dmp	upx
behavioral2/memory/4200-86-0x00007FF77AB40000-0x00007FF77AF32000-memory.dmp	upx
behavioral2/memory/4624-85-0x00007FF7078B0000-0x00007FF707CA2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xdcyjVL.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\AmOmohu.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\nmCQPmZ.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\ooLFtus.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\gqCnnrc.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\lnQxvpR.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\uRLCgrS.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\EtbwhOG.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\oodVEgG.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\GwhgRtH.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\NTNWBeM.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\lySPWRq.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\gmXFRgd.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\IKcjvlm.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\WBFsgza.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\xIlALxV.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\nReHTlH.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\qJujSAf.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\zbHlSIe.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\MjPduWN.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\OjRwPZR.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\FeKbKEe.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\yTWXEdA.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\EJcKNjL.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\ZSnZOwJ.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\yuclYqg.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\hfglRfC.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\LSRkWrK.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\aWldxwf.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\QsImVku.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\CPlxJAv.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\BOFRyQT.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\CpIUCqp.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\qRvOqlP.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\WfaoIli.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\tYjmkvs.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\kNFUJZt.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\JLwUAJy.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\CdOIrdj.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\mTgaCvh.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\gwyZIpl.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\dFnsMFK.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\PPRWTJN.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\bLEjHlV.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\NyWTFAE.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\jpMHLTr.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\npOAuza.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\cYaRJnw.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\vgaWZJW.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\mRFHUEK.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\AAWRWPO.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\PmceqzI.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\njSbHEU.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\oXVIGQJ.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\OBoVMtW.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\kXHVJvf.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\xlgDUyA.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\OnOPTwX.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\TrKFEzE.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\REbFejD.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\ZqWcFQl.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\tIeVKxI.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\OHSQGnH.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\vBZjsfl.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3140	powershell.exe
3140	powershell.exe
3140	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeCreateGlobalPrivilege	13248	dwm.exe
Token: SeChangeNotifyPrivilege	13248	dwm.exe
Token: 33	13248	dwm.exe
Token: SeIncBasePriorityPrivilege	13248	dwm.exe
Token: SeCreateGlobalPrivilege	12828	dwm.exe
Token: SeChangeNotifyPrivilege	12828	dwm.exe
Token: 33	12828	dwm.exe
Token: SeIncBasePriorityPrivilege	12828	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 3140	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	84
PID 1156 wrote to memory of 3140	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	84
PID 1156 wrote to memory of 4228	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	85
PID 1156 wrote to memory of 4228	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	85
PID 1156 wrote to memory of 3552	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	86
PID 1156 wrote to memory of 3552	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	86
PID 1156 wrote to memory of 1468	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	87
PID 1156 wrote to memory of 1468	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	87
PID 1156 wrote to memory of 1360	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	88
PID 1156 wrote to memory of 1360	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	88
PID 1156 wrote to memory of 4080	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	89
PID 1156 wrote to memory of 4080	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	89
PID 1156 wrote to memory of 316	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	90
PID 1156 wrote to memory of 316	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	90
PID 1156 wrote to memory of 4624	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	91
PID 1156 wrote to memory of 4624	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	91
PID 1156 wrote to memory of 4812	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	92
PID 1156 wrote to memory of 4812	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	92
PID 1156 wrote to memory of 4200	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	93
PID 1156 wrote to memory of 4200	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	93
PID 1156 wrote to memory of 3216	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	94
PID 1156 wrote to memory of 3216	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	94
PID 1156 wrote to memory of 1400	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	95
PID 1156 wrote to memory of 1400	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	95
PID 1156 wrote to memory of 2936	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	96
PID 1156 wrote to memory of 2936	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	96
PID 1156 wrote to memory of 1956	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	97
PID 1156 wrote to memory of 1956	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	97
PID 1156 wrote to memory of 1504	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	98
PID 1156 wrote to memory of 1504	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	98
PID 1156 wrote to memory of 808	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	99
PID 1156 wrote to memory of 808	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	99
PID 1156 wrote to memory of 4772	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	100
PID 1156 wrote to memory of 4772	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	100
PID 1156 wrote to memory of 4580	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	101
PID 1156 wrote to memory of 4580	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	101
PID 1156 wrote to memory of 2860	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	102
PID 1156 wrote to memory of 2860	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	102
PID 1156 wrote to memory of 3960	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	103
PID 1156 wrote to memory of 3960	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	103
PID 1156 wrote to memory of 2216	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	104
PID 1156 wrote to memory of 2216	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	104
PID 1156 wrote to memory of 1376	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	105
PID 1156 wrote to memory of 1376	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	105
PID 1156 wrote to memory of 4084	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	106
PID 1156 wrote to memory of 4084	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	106
PID 1156 wrote to memory of 228	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	107
PID 1156 wrote to memory of 228	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	107
PID 1156 wrote to memory of 4512	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	108
PID 1156 wrote to memory of 4512	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	108
PID 1156 wrote to memory of 3184	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	109
PID 1156 wrote to memory of 3184	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	109
PID 1156 wrote to memory of 3616	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	110
PID 1156 wrote to memory of 3616	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	110
PID 1156 wrote to memory of 2180	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	111
PID 1156 wrote to memory of 2180	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	111
PID 1156 wrote to memory of 3508	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	112
PID 1156 wrote to memory of 3508	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	112
PID 1156 wrote to memory of 1716	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	113
PID 1156 wrote to memory of 1716	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	113
PID 1156 wrote to memory of 1844	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	114
PID 1156 wrote to memory of 1844	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	114
PID 1156 wrote to memory of 1876	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	115
PID 1156 wrote to memory of 1876	1156	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3140
- C:\Windows\System\mhozMFE.exe
  C:\Windows\System\mhozMFE.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\AbctPdA.exe
  C:\Windows\System\AbctPdA.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\YBXoasw.exe
  C:\Windows\System\YBXoasw.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\yyppdGF.exe
  C:\Windows\System\yyppdGF.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\wlREOtj.exe
  C:\Windows\System\wlREOtj.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\KUwtIuy.exe
  C:\Windows\System\KUwtIuy.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\CKfeQUt.exe
  C:\Windows\System\CKfeQUt.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\nVcLIWJ.exe
  C:\Windows\System\nVcLIWJ.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\sUNQxTH.exe
  C:\Windows\System\sUNQxTH.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\HGNNyux.exe
  C:\Windows\System\HGNNyux.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\HvlMuVq.exe
  C:\Windows\System\HvlMuVq.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\DmXhxXw.exe
  C:\Windows\System\DmXhxXw.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\ZtYKPEp.exe
  C:\Windows\System\ZtYKPEp.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\lcTlMzj.exe
  C:\Windows\System\lcTlMzj.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\NRAoaNE.exe
  C:\Windows\System\NRAoaNE.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\yZeqDwC.exe
  C:\Windows\System\yZeqDwC.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\MafKHqe.exe
  C:\Windows\System\MafKHqe.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\JANQMpL.exe
  C:\Windows\System\JANQMpL.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\aeaCjZT.exe
  C:\Windows\System\aeaCjZT.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\TTFQtby.exe
  C:\Windows\System\TTFQtby.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\VNVtFPy.exe
  C:\Windows\System\VNVtFPy.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\WRtzOOs.exe
  C:\Windows\System\WRtzOOs.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\UPYnWff.exe
  C:\Windows\System\UPYnWff.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\kfCSacn.exe
  C:\Windows\System\kfCSacn.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\fJGBSjY.exe
  C:\Windows\System\fJGBSjY.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\FKMLGfK.exe
  C:\Windows\System\FKMLGfK.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\mXdqjWK.exe
  C:\Windows\System\mXdqjWK.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\uVHIOib.exe
  C:\Windows\System\uVHIOib.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\OtKKPnc.exe
  C:\Windows\System\OtKKPnc.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\LyySidn.exe
  C:\Windows\System\LyySidn.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\hMehWHC.exe
  C:\Windows\System\hMehWHC.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\sahVtAo.exe
  C:\Windows\System\sahVtAo.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\AKvTGpC.exe
  C:\Windows\System\AKvTGpC.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\PjEuHiO.exe
  C:\Windows\System\PjEuHiO.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\dvhTBGO.exe
  C:\Windows\System\dvhTBGO.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\MzBXaso.exe
  C:\Windows\System\MzBXaso.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\vzWegzQ.exe
  C:\Windows\System\vzWegzQ.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\DESsphj.exe
  C:\Windows\System\DESsphj.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\XEnjxUf.exe
  C:\Windows\System\XEnjxUf.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\EicMhFz.exe
  C:\Windows\System\EicMhFz.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\bYqKPZK.exe
  C:\Windows\System\bYqKPZK.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\clKkMCx.exe
  C:\Windows\System\clKkMCx.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\oyegIpd.exe
  C:\Windows\System\oyegIpd.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\pTANtpj.exe
  C:\Windows\System\pTANtpj.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\WXTGHHp.exe
  C:\Windows\System\WXTGHHp.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\iWLHUqF.exe
  C:\Windows\System\iWLHUqF.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\CpdJIkJ.exe
  C:\Windows\System\CpdJIkJ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\cvtOYMJ.exe
  C:\Windows\System\cvtOYMJ.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\KRgXISg.exe
  C:\Windows\System\KRgXISg.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\ykhSBga.exe
  C:\Windows\System\ykhSBga.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\DZkrEDX.exe
  C:\Windows\System\DZkrEDX.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\aSEsqGu.exe
  C:\Windows\System\aSEsqGu.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\yodCJEw.exe
  C:\Windows\System\yodCJEw.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\XzJWyRG.exe
  C:\Windows\System\XzJWyRG.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\pqbIuJp.exe
  C:\Windows\System\pqbIuJp.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\QUFYtpv.exe
  C:\Windows\System\QUFYtpv.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\dQcIVqF.exe
  C:\Windows\System\dQcIVqF.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\wxTXJWt.exe
  C:\Windows\System\wxTXJWt.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\IeovFkk.exe
  C:\Windows\System\IeovFkk.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\plBJgtg.exe
  C:\Windows\System\plBJgtg.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\fgleZdR.exe
  C:\Windows\System\fgleZdR.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\JQgyxDR.exe
  C:\Windows\System\JQgyxDR.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\hSyTzbe.exe
  C:\Windows\System\hSyTzbe.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\QlQnkMQ.exe
  C:\Windows\System\QlQnkMQ.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\qEsajSV.exe
  C:\Windows\System\qEsajSV.exe
  2⤵
  PID:5080
- C:\Windows\System\vcJVDIz.exe
  C:\Windows\System\vcJVDIz.exe
  2⤵
  PID:4112
- C:\Windows\System\wKzgoqT.exe
  C:\Windows\System\wKzgoqT.exe
  2⤵
  PID:4288
- C:\Windows\System\HUXzpXY.exe
  C:\Windows\System\HUXzpXY.exe
  2⤵
  PID:2240
- C:\Windows\System\QZmdKpP.exe
  C:\Windows\System\QZmdKpP.exe
  2⤵
  PID:2036
- C:\Windows\System\oOeRYKi.exe
  C:\Windows\System\oOeRYKi.exe
  2⤵
  PID:1472
- C:\Windows\System\zfhSLPB.exe
  C:\Windows\System\zfhSLPB.exe
  2⤵
  PID:4808
- C:\Windows\System\KGBxovm.exe
  C:\Windows\System\KGBxovm.exe
  2⤵
  PID:2016
- C:\Windows\System\QaCnAyn.exe
  C:\Windows\System\QaCnAyn.exe
  2⤵
  PID:2544
- C:\Windows\System\FpsScpg.exe
  C:\Windows\System\FpsScpg.exe
  2⤵
  PID:60
- C:\Windows\System\eUzlmVJ.exe
  C:\Windows\System\eUzlmVJ.exe
  2⤵
  PID:1968
- C:\Windows\System\YQOJTUZ.exe
  C:\Windows\System\YQOJTUZ.exe
  2⤵
  PID:1812
- C:\Windows\System\CHngwFk.exe
  C:\Windows\System\CHngwFk.exe
  2⤵
  PID:1572
- C:\Windows\System\xVdkHMo.exe
  C:\Windows\System\xVdkHMo.exe
  2⤵
  PID:5068
- C:\Windows\System\onCqqfQ.exe
  C:\Windows\System\onCqqfQ.exe
  2⤵
  PID:5096
- C:\Windows\System\aLDVPAk.exe
  C:\Windows\System\aLDVPAk.exe
  2⤵
  PID:2996
- C:\Windows\System\ZeeMdNR.exe
  C:\Windows\System\ZeeMdNR.exe
  2⤵
  PID:5004
- C:\Windows\System\fcrLZDy.exe
  C:\Windows\System\fcrLZDy.exe
  2⤵
  PID:1576
- C:\Windows\System\sElwMId.exe
  C:\Windows\System\sElwMId.exe
  2⤵
  PID:4368
- C:\Windows\System\zoIHTMB.exe
  C:\Windows\System\zoIHTMB.exe
  2⤵
  PID:1604
- C:\Windows\System\KCbhKhl.exe
  C:\Windows\System\KCbhKhl.exe
  2⤵
  PID:4116
- C:\Windows\System\woCJegq.exe
  C:\Windows\System\woCJegq.exe
  2⤵
  PID:4604
- C:\Windows\System\vKinFZN.exe
  C:\Windows\System\vKinFZN.exe
  2⤵
  PID:4280
- C:\Windows\System\mmFMQTF.exe
  C:\Windows\System\mmFMQTF.exe
  2⤵
  PID:3440
- C:\Windows\System\dajsJtm.exe
  C:\Windows\System\dajsJtm.exe
  2⤵
  PID:4696
- C:\Windows\System\oceMnFy.exe
  C:\Windows\System\oceMnFy.exe
  2⤵
  PID:4348
- C:\Windows\System\RDpkVht.exe
  C:\Windows\System\RDpkVht.exe
  2⤵
  PID:748
- C:\Windows\System\NjOgJCq.exe
  C:\Windows\System\NjOgJCq.exe
  2⤵
  PID:3188
- C:\Windows\System\fRvguWf.exe
  C:\Windows\System\fRvguWf.exe
  2⤵
  PID:2836
- C:\Windows\System\xFkIhNy.exe
  C:\Windows\System\xFkIhNy.exe
  2⤵
  PID:2984
- C:\Windows\System\tQDfqQv.exe
  C:\Windows\System\tQDfqQv.exe
  2⤵
  PID:2448
- C:\Windows\System\uFrCTeV.exe
  C:\Windows\System\uFrCTeV.exe
  2⤵
  PID:1228
- C:\Windows\System\nCTGiwQ.exe
  C:\Windows\System\nCTGiwQ.exe
  2⤵
  PID:3176
- C:\Windows\System\yqinoAb.exe
  C:\Windows\System\yqinoAb.exe
  2⤵
  PID:512
- C:\Windows\System\ePtTITw.exe
  C:\Windows\System\ePtTITw.exe
  2⤵
  PID:2380
- C:\Windows\System\lSDZCMA.exe
  C:\Windows\System\lSDZCMA.exe
  2⤵
  PID:4180
- C:\Windows\System\tnqqLEx.exe
  C:\Windows\System\tnqqLEx.exe
  2⤵
  PID:3244
- C:\Windows\System\QAAIOsU.exe
  C:\Windows\System\QAAIOsU.exe
  2⤵
  PID:3240
- C:\Windows\System\xxrSGfi.exe
  C:\Windows\System\xxrSGfi.exe
  2⤵
  PID:4524
- C:\Windows\System\nReHTlH.exe
  C:\Windows\System\nReHTlH.exe
  2⤵
  PID:3628
- C:\Windows\System\FSVTYtV.exe
  C:\Windows\System\FSVTYtV.exe
  2⤵
  PID:1724
- C:\Windows\System\hYYrCSL.exe
  C:\Windows\System\hYYrCSL.exe
  2⤵
  PID:1816
- C:\Windows\System\NbjEXdU.exe
  C:\Windows\System\NbjEXdU.exe
  2⤵
  PID:3004
- C:\Windows\System\DtVHzqX.exe
  C:\Windows\System\DtVHzqX.exe
  2⤵
  PID:4320
- C:\Windows\System\AEXtane.exe
  C:\Windows\System\AEXtane.exe
  2⤵
  PID:4268
- C:\Windows\System\IqHgGDh.exe
  C:\Windows\System\IqHgGDh.exe
  2⤵
  PID:448
- C:\Windows\System\AxOccee.exe
  C:\Windows\System\AxOccee.exe
  2⤵
  PID:720
- C:\Windows\System\TWqvwmY.exe
  C:\Windows\System\TWqvwmY.exe
  2⤵
  PID:4500
- C:\Windows\System\SLbNXYk.exe
  C:\Windows\System\SLbNXYk.exe
  2⤵
  PID:1428
- C:\Windows\System\EKYmsRO.exe
  C:\Windows\System\EKYmsRO.exe
  2⤵
  PID:4620
- C:\Windows\System\hhMFXgn.exe
  C:\Windows\System\hhMFXgn.exe
  2⤵
  PID:2024
- C:\Windows\System\VNUrsWu.exe
  C:\Windows\System\VNUrsWu.exe
  2⤵
  PID:4996
- C:\Windows\System\yFblEzz.exe
  C:\Windows\System\yFblEzz.exe
  2⤵
  PID:2832
- C:\Windows\System\wcfwSuA.exe
  C:\Windows\System\wcfwSuA.exe
  2⤵
  PID:4744
- C:\Windows\System\JVjWDIW.exe
  C:\Windows\System\JVjWDIW.exe
  2⤵
  PID:4936
- C:\Windows\System\jmlyhTu.exe
  C:\Windows\System\jmlyhTu.exe
  2⤵
  PID:4484
- C:\Windows\System\UMvpSUy.exe
  C:\Windows\System\UMvpSUy.exe
  2⤵
  PID:2348
- C:\Windows\System\tbYSZKs.exe
  C:\Windows\System\tbYSZKs.exe
  2⤵
  PID:3152
- C:\Windows\System\iakYbMb.exe
  C:\Windows\System\iakYbMb.exe
  2⤵
  PID:1924
- C:\Windows\System\OWumtia.exe
  C:\Windows\System\OWumtia.exe
  2⤵
  PID:3220
- C:\Windows\System\wWydlca.exe
  C:\Windows\System\wWydlca.exe
  2⤵
  PID:2508
- C:\Windows\System\NmZnPbX.exe
  C:\Windows\System\NmZnPbX.exe
  2⤵
  PID:3392
- C:\Windows\System\wHmFrbh.exe
  C:\Windows\System\wHmFrbh.exe
  2⤵
  PID:2500
- C:\Windows\System\NFRXREB.exe
  C:\Windows\System\NFRXREB.exe
  2⤵
  PID:1544
- C:\Windows\System\RxMMDvs.exe
  C:\Windows\System\RxMMDvs.exe
  2⤵
  PID:816
- C:\Windows\System\bRfbRSN.exe
  C:\Windows\System\bRfbRSN.exe
  2⤵
  PID:1752
- C:\Windows\System\pgkpFuL.exe
  C:\Windows\System\pgkpFuL.exe
  2⤵
  PID:5128
- C:\Windows\System\XsZFWJV.exe
  C:\Windows\System\XsZFWJV.exe
  2⤵
  PID:5144
- C:\Windows\System\MRGNEMc.exe
  C:\Windows\System\MRGNEMc.exe
  2⤵
  PID:5160
- C:\Windows\System\AiEoGaH.exe
  C:\Windows\System\AiEoGaH.exe
  2⤵
  PID:5176
- C:\Windows\System\LuTTeTK.exe
  C:\Windows\System\LuTTeTK.exe
  2⤵
  PID:5192
- C:\Windows\System\CXIJYCg.exe
  C:\Windows\System\CXIJYCg.exe
  2⤵
  PID:5208
- C:\Windows\System\bQDSHdV.exe
  C:\Windows\System\bQDSHdV.exe
  2⤵
  PID:5224
- C:\Windows\System\EBCcGmq.exe
  C:\Windows\System\EBCcGmq.exe
  2⤵
  PID:5240
- C:\Windows\System\maDlISY.exe
  C:\Windows\System\maDlISY.exe
  2⤵
  PID:5256
- C:\Windows\System\cOBlcZM.exe
  C:\Windows\System\cOBlcZM.exe
  2⤵
  PID:5272
- C:\Windows\System\xRQhocX.exe
  C:\Windows\System\xRQhocX.exe
  2⤵
  PID:5288
- C:\Windows\System\MkEGLVk.exe
  C:\Windows\System\MkEGLVk.exe
  2⤵
  PID:5304
- C:\Windows\System\uAXxDzS.exe
  C:\Windows\System\uAXxDzS.exe
  2⤵
  PID:5320
- C:\Windows\System\vSKlfbv.exe
  C:\Windows\System\vSKlfbv.exe
  2⤵
  PID:5336
- C:\Windows\System\JhhqVBx.exe
  C:\Windows\System\JhhqVBx.exe
  2⤵
  PID:5352
- C:\Windows\System\STHhZLk.exe
  C:\Windows\System\STHhZLk.exe
  2⤵
  PID:5368
- C:\Windows\System\SWWKBxu.exe
  C:\Windows\System\SWWKBxu.exe
  2⤵
  PID:5384
- C:\Windows\System\aUEmBTJ.exe
  C:\Windows\System\aUEmBTJ.exe
  2⤵
  PID:5400
- C:\Windows\System\WvPTJFF.exe
  C:\Windows\System\WvPTJFF.exe
  2⤵
  PID:5416
- C:\Windows\System\KarHbrN.exe
  C:\Windows\System\KarHbrN.exe
  2⤵
  PID:5432
- C:\Windows\System\EpMDJcl.exe
  C:\Windows\System\EpMDJcl.exe
  2⤵
  PID:5448
- C:\Windows\System\lySPWRq.exe
  C:\Windows\System\lySPWRq.exe
  2⤵
  PID:5464
- C:\Windows\System\GCMDZjW.exe
  C:\Windows\System\GCMDZjW.exe
  2⤵
  PID:5480
- C:\Windows\System\zniKXXZ.exe
  C:\Windows\System\zniKXXZ.exe
  2⤵
  PID:5496
- C:\Windows\System\OnLsnqF.exe
  C:\Windows\System\OnLsnqF.exe
  2⤵
  PID:5512
- C:\Windows\System\bDBIRLM.exe
  C:\Windows\System\bDBIRLM.exe
  2⤵
  PID:5528
- C:\Windows\System\tWpTXUm.exe
  C:\Windows\System\tWpTXUm.exe
  2⤵
  PID:5544
- C:\Windows\System\zTaPGZI.exe
  C:\Windows\System\zTaPGZI.exe
  2⤵
  PID:5560
- C:\Windows\System\vTPMmej.exe
  C:\Windows\System\vTPMmej.exe
  2⤵
  PID:5576
- C:\Windows\System\FZmYHOT.exe
  C:\Windows\System\FZmYHOT.exe
  2⤵
  PID:5592
- C:\Windows\System\OpLZnEx.exe
  C:\Windows\System\OpLZnEx.exe
  2⤵
  PID:5608
- C:\Windows\System\yqBBEdP.exe
  C:\Windows\System\yqBBEdP.exe
  2⤵
  PID:5624
- C:\Windows\System\Iboxaal.exe
  C:\Windows\System\Iboxaal.exe
  2⤵
  PID:5640
- C:\Windows\System\ZLqjcYC.exe
  C:\Windows\System\ZLqjcYC.exe
  2⤵
  PID:5656
- C:\Windows\System\tPhwJEh.exe
  C:\Windows\System\tPhwJEh.exe
  2⤵
  PID:5672
- C:\Windows\System\IdaDEiD.exe
  C:\Windows\System\IdaDEiD.exe
  2⤵
  PID:5688
- C:\Windows\System\LTHoYHK.exe
  C:\Windows\System\LTHoYHK.exe
  2⤵
  PID:5704
- C:\Windows\System\cZqsQDO.exe
  C:\Windows\System\cZqsQDO.exe
  2⤵
  PID:5720
- C:\Windows\System\ePEoyEC.exe
  C:\Windows\System\ePEoyEC.exe
  2⤵
  PID:5736
- C:\Windows\System\zsIMfpm.exe
  C:\Windows\System\zsIMfpm.exe
  2⤵
  PID:5752
- C:\Windows\System\Iluumwb.exe
  C:\Windows\System\Iluumwb.exe
  2⤵
  PID:5768
- C:\Windows\System\ZqWcFQl.exe
  C:\Windows\System\ZqWcFQl.exe
  2⤵
  PID:5784
- C:\Windows\System\kINSjCb.exe
  C:\Windows\System\kINSjCb.exe
  2⤵
  PID:5800
- C:\Windows\System\BofwIVU.exe
  C:\Windows\System\BofwIVU.exe
  2⤵
  PID:5816
- C:\Windows\System\mTgaCvh.exe
  C:\Windows\System\mTgaCvh.exe
  2⤵
  PID:5832
- C:\Windows\System\Oxgibij.exe
  C:\Windows\System\Oxgibij.exe
  2⤵
  PID:5848
- C:\Windows\System\BXqbPiW.exe
  C:\Windows\System\BXqbPiW.exe
  2⤵
  PID:5864
- C:\Windows\System\IUNQOhL.exe
  C:\Windows\System\IUNQOhL.exe
  2⤵
  PID:5880
- C:\Windows\System\kCuQRRb.exe
  C:\Windows\System\kCuQRRb.exe
  2⤵
  PID:5896
- C:\Windows\System\sOrmrLf.exe
  C:\Windows\System\sOrmrLf.exe
  2⤵
  PID:5912
- C:\Windows\System\QHqZTBH.exe
  C:\Windows\System\QHqZTBH.exe
  2⤵
  PID:5928
- C:\Windows\System\RLQOwTU.exe
  C:\Windows\System\RLQOwTU.exe
  2⤵
  PID:5944
- C:\Windows\System\YSPIqfF.exe
  C:\Windows\System\YSPIqfF.exe
  2⤵
  PID:5960
- C:\Windows\System\ngvzjpW.exe
  C:\Windows\System\ngvzjpW.exe
  2⤵
  PID:5976
- C:\Windows\System\HriOYDp.exe
  C:\Windows\System\HriOYDp.exe
  2⤵
  PID:5992
- C:\Windows\System\rifcNwo.exe
  C:\Windows\System\rifcNwo.exe
  2⤵
  PID:6008
- C:\Windows\System\VPdWAXf.exe
  C:\Windows\System\VPdWAXf.exe
  2⤵
  PID:6024
- C:\Windows\System\pxfIIrf.exe
  C:\Windows\System\pxfIIrf.exe
  2⤵
  PID:6040
- C:\Windows\System\CBuKwpz.exe
  C:\Windows\System\CBuKwpz.exe
  2⤵
  PID:6056
- C:\Windows\System\rjdbCsA.exe
  C:\Windows\System\rjdbCsA.exe
  2⤵
  PID:6072
- C:\Windows\System\mDKaXTO.exe
  C:\Windows\System\mDKaXTO.exe
  2⤵
  PID:6088
- C:\Windows\System\LhcwVSX.exe
  C:\Windows\System\LhcwVSX.exe
  2⤵
  PID:6104
- C:\Windows\System\zuQfVWZ.exe
  C:\Windows\System\zuQfVWZ.exe
  2⤵
  PID:6120
- C:\Windows\System\MAoSPio.exe
  C:\Windows\System\MAoSPio.exe
  2⤵
  PID:6136
- C:\Windows\System\kfwUYFn.exe
  C:\Windows\System\kfwUYFn.exe
  2⤵
  PID:4412
- C:\Windows\System\nrYDQQA.exe
  C:\Windows\System\nrYDQQA.exe
  2⤵
  PID:4224
- C:\Windows\System\yCMqGBl.exe
  C:\Windows\System\yCMqGBl.exe
  2⤵
  PID:4396
- C:\Windows\System\XNWrBAD.exe
  C:\Windows\System\XNWrBAD.exe
  2⤵
  PID:2916
- C:\Windows\System\dMBWXTe.exe
  C:\Windows\System\dMBWXTe.exe
  2⤵
  PID:4532
- C:\Windows\System\fGSHScu.exe
  C:\Windows\System\fGSHScu.exe
  2⤵
  PID:3712
- C:\Windows\System\JDodsaB.exe
  C:\Windows\System\JDodsaB.exe
  2⤵
  PID:4988
- C:\Windows\System\RZBUajR.exe
  C:\Windows\System\RZBUajR.exe
  2⤵
  PID:1728
- C:\Windows\System\jIYJTbX.exe
  C:\Windows\System\jIYJTbX.exe
  2⤵
  PID:2796
- C:\Windows\System\UWgElnJ.exe
  C:\Windows\System\UWgElnJ.exe
  2⤵
  PID:3248
- C:\Windows\System\FZWCHaK.exe
  C:\Windows\System\FZWCHaK.exe
  2⤵
  PID:1212
- C:\Windows\System\LOGZYnh.exe
  C:\Windows\System\LOGZYnh.exe
  2⤵
  PID:5136
- C:\Windows\System\TQwTlzi.exe
  C:\Windows\System\TQwTlzi.exe
  2⤵
  PID:5168
- C:\Windows\System\tmLetYK.exe
  C:\Windows\System\tmLetYK.exe
  2⤵
  PID:5200
- C:\Windows\System\ELUzxqA.exe
  C:\Windows\System\ELUzxqA.exe
  2⤵
  PID:5232
- C:\Windows\System\nQivVSX.exe
  C:\Windows\System\nQivVSX.exe
  2⤵
  PID:5264
- C:\Windows\System\KdtiUks.exe
  C:\Windows\System\KdtiUks.exe
  2⤵
  PID:5296
- C:\Windows\System\obfpNCE.exe
  C:\Windows\System\obfpNCE.exe
  2⤵
  PID:5328
- C:\Windows\System\yVeWgcR.exe
  C:\Windows\System\yVeWgcR.exe
  2⤵
  PID:5360
- C:\Windows\System\WLQRBWO.exe
  C:\Windows\System\WLQRBWO.exe
  2⤵
  PID:5392
- C:\Windows\System\NZyrivv.exe
  C:\Windows\System\NZyrivv.exe
  2⤵
  PID:5424
- C:\Windows\System\myUAuyA.exe
  C:\Windows\System\myUAuyA.exe
  2⤵
  PID:5456
- C:\Windows\System\mkeRCvI.exe
  C:\Windows\System\mkeRCvI.exe
  2⤵
  PID:5488
- C:\Windows\System\kqbubDF.exe
  C:\Windows\System\kqbubDF.exe
  2⤵
  PID:5520
- C:\Windows\System\zRExEWZ.exe
  C:\Windows\System\zRExEWZ.exe
  2⤵
  PID:4880
- C:\Windows\System\ERpzmAo.exe
  C:\Windows\System\ERpzmAo.exe
  2⤵
  PID:5572
- C:\Windows\System\MXplgBl.exe
  C:\Windows\System\MXplgBl.exe
  2⤵
  PID:5604
- C:\Windows\System\jfttTvo.exe
  C:\Windows\System\jfttTvo.exe
  2⤵
  PID:5636
- C:\Windows\System\togJDwN.exe
  C:\Windows\System\togJDwN.exe
  2⤵
  PID:5664
- C:\Windows\System\CpIUCqp.exe
  C:\Windows\System\CpIUCqp.exe
  2⤵
  PID:5696
- C:\Windows\System\sXXfxZb.exe
  C:\Windows\System\sXXfxZb.exe
  2⤵
  PID:5728
- C:\Windows\System\gnzxvog.exe
  C:\Windows\System\gnzxvog.exe
  2⤵
  PID:5760
- C:\Windows\System\bENFgRT.exe
  C:\Windows\System\bENFgRT.exe
  2⤵
  PID:5792
- C:\Windows\System\gIgdjBj.exe
  C:\Windows\System\gIgdjBj.exe
  2⤵
  PID:5824
- C:\Windows\System\VlSUnii.exe
  C:\Windows\System\VlSUnii.exe
  2⤵
  PID:5844
- C:\Windows\System\LOghYyg.exe
  C:\Windows\System\LOghYyg.exe
  2⤵
  PID:5876
- C:\Windows\System\LNEKvDJ.exe
  C:\Windows\System\LNEKvDJ.exe
  2⤵
  PID:5908
- C:\Windows\System\Ohcqghu.exe
  C:\Windows\System\Ohcqghu.exe
  2⤵
  PID:5940
- C:\Windows\System\ySrttlZ.exe
  C:\Windows\System\ySrttlZ.exe
  2⤵
  PID:5968
- C:\Windows\System\qYPvDPk.exe
  C:\Windows\System\qYPvDPk.exe
  2⤵
  PID:6000
- C:\Windows\System\EjrSDqu.exe
  C:\Windows\System\EjrSDqu.exe
  2⤵
  PID:6020
- C:\Windows\System\VRcCRLV.exe
  C:\Windows\System\VRcCRLV.exe
  2⤵
  PID:6052
- C:\Windows\System\YethXHM.exe
  C:\Windows\System\YethXHM.exe
  2⤵
  PID:6084
- C:\Windows\System\KFcgUvY.exe
  C:\Windows\System\KFcgUvY.exe
  2⤵
  PID:6116
- C:\Windows\System\uwlQUmS.exe
  C:\Windows\System\uwlQUmS.exe
  2⤵
  PID:4248
- C:\Windows\System\vwUalVV.exe
  C:\Windows\System\vwUalVV.exe
  2⤵
  PID:3476
- C:\Windows\System\wOxMshC.exe
  C:\Windows\System\wOxMshC.exe
  2⤵
  PID:3680
- C:\Windows\System\FnZzzLU.exe
  C:\Windows\System\FnZzzLU.exe
  2⤵
  PID:1688
- C:\Windows\System\ZnvhqMP.exe
  C:\Windows\System\ZnvhqMP.exe
  2⤵
  PID:2148
- C:\Windows\System\mGbAzYv.exe
  C:\Windows\System\mGbAzYv.exe
  2⤵
  PID:2904
- C:\Windows\System\LBHDhRb.exe
  C:\Windows\System\LBHDhRb.exe
  2⤵
  PID:5152
- C:\Windows\System\dtZEXcT.exe
  C:\Windows\System\dtZEXcT.exe
  2⤵
  PID:5216
- C:\Windows\System\GKUWJeq.exe
  C:\Windows\System\GKUWJeq.exe
  2⤵
  PID:5280
- C:\Windows\System\IWbAFRV.exe
  C:\Windows\System\IWbAFRV.exe
  2⤵
  PID:5344
- C:\Windows\System\gRyGQbz.exe
  C:\Windows\System\gRyGQbz.exe
  2⤵
  PID:5408
- C:\Windows\System\WGobkOw.exe
  C:\Windows\System\WGobkOw.exe
  2⤵
  PID:5444
- C:\Windows\System\VZAzdok.exe
  C:\Windows\System\VZAzdok.exe
  2⤵
  PID:5508
- C:\Windows\System\DbNRUgC.exe
  C:\Windows\System\DbNRUgC.exe
  2⤵
  PID:5556
- C:\Windows\System\KdHwzAt.exe
  C:\Windows\System\KdHwzAt.exe
  2⤵
  PID:5620
- C:\Windows\System\RbSruxL.exe
  C:\Windows\System\RbSruxL.exe
  2⤵
  PID:5680
- C:\Windows\System\EifvZzo.exe
  C:\Windows\System\EifvZzo.exe
  2⤵
  PID:2136
- C:\Windows\System\KWcPQeh.exe
  C:\Windows\System\KWcPQeh.exe
  2⤵
  PID:5776
- C:\Windows\System\YEcJDNZ.exe
  C:\Windows\System\YEcJDNZ.exe
  2⤵
  PID:5812
- C:\Windows\System\Onfrghn.exe
  C:\Windows\System\Onfrghn.exe
  2⤵
  PID:5872
- C:\Windows\System\QnWoXGf.exe
  C:\Windows\System\QnWoXGf.exe
  2⤵
  PID:5936
- C:\Windows\System\BxDlYft.exe
  C:\Windows\System\BxDlYft.exe
  2⤵
  PID:5984
- C:\Windows\System\RHUkLVG.exe
  C:\Windows\System\RHUkLVG.exe
  2⤵
  PID:6036
- C:\Windows\System\iHhOBJB.exe
  C:\Windows\System\iHhOBJB.exe
  2⤵
  PID:6100
- C:\Windows\System\jtLehUI.exe
  C:\Windows\System\jtLehUI.exe
  2⤵
  PID:4768
- C:\Windows\System\hANiUZr.exe
  C:\Windows\System\hANiUZr.exe
  2⤵
  PID:4716
- C:\Windows\System\zmWDmin.exe
  C:\Windows\System\zmWDmin.exe
  2⤵
  PID:3412
- C:\Windows\System\mlmJaiM.exe
  C:\Windows\System\mlmJaiM.exe
  2⤵
  PID:5124
- C:\Windows\System\uzgoIqS.exe
  C:\Windows\System\uzgoIqS.exe
  2⤵
  PID:5252
- C:\Windows\System\KkkAfSt.exe
  C:\Windows\System\KkkAfSt.exe
  2⤵
  PID:5380
- C:\Windows\System\tFjKVmF.exe
  C:\Windows\System\tFjKVmF.exe
  2⤵
  PID:6152
- C:\Windows\System\FOJKHqd.exe
  C:\Windows\System\FOJKHqd.exe
  2⤵
  PID:6168
- C:\Windows\System\PGWtssF.exe
  C:\Windows\System\PGWtssF.exe
  2⤵
  PID:6184
- C:\Windows\System\gybJrQh.exe
  C:\Windows\System\gybJrQh.exe
  2⤵
  PID:6200
- C:\Windows\System\aonkTHh.exe
  C:\Windows\System\aonkTHh.exe
  2⤵
  PID:6216
- C:\Windows\System\oZGDLoS.exe
  C:\Windows\System\oZGDLoS.exe
  2⤵
  PID:6232
- C:\Windows\System\LNXIPGu.exe
  C:\Windows\System\LNXIPGu.exe
  2⤵
  PID:6248
- C:\Windows\System\qMPTNFN.exe
  C:\Windows\System\qMPTNFN.exe
  2⤵
  PID:6264
- C:\Windows\System\bAirRFZ.exe
  C:\Windows\System\bAirRFZ.exe
  2⤵
  PID:6280
- C:\Windows\System\ZTOvICa.exe
  C:\Windows\System\ZTOvICa.exe
  2⤵
  PID:6296
- C:\Windows\System\QtsncAn.exe
  C:\Windows\System\QtsncAn.exe
  2⤵
  PID:6312
- C:\Windows\System\TPVrFRm.exe
  C:\Windows\System\TPVrFRm.exe
  2⤵
  PID:6328
- C:\Windows\System\NKvLIzh.exe
  C:\Windows\System\NKvLIzh.exe
  2⤵
  PID:6344
- C:\Windows\System\myPYpVV.exe
  C:\Windows\System\myPYpVV.exe
  2⤵
  PID:6360
- C:\Windows\System\KTKYsxq.exe
  C:\Windows\System\KTKYsxq.exe
  2⤵
  PID:6376
- C:\Windows\System\onImFuK.exe
  C:\Windows\System\onImFuK.exe
  2⤵
  PID:6392
- C:\Windows\System\YxAAkYJ.exe
  C:\Windows\System\YxAAkYJ.exe
  2⤵
  PID:6408
- C:\Windows\System\nWgaSkS.exe
  C:\Windows\System\nWgaSkS.exe
  2⤵
  PID:6424
- C:\Windows\System\qUsuebx.exe
  C:\Windows\System\qUsuebx.exe
  2⤵
  PID:6440
- C:\Windows\System\nvsKJbr.exe
  C:\Windows\System\nvsKJbr.exe
  2⤵
  PID:6456
- C:\Windows\System\UPrBoaX.exe
  C:\Windows\System\UPrBoaX.exe
  2⤵
  PID:6472
- C:\Windows\System\PcnzaPx.exe
  C:\Windows\System\PcnzaPx.exe
  2⤵
  PID:6488
- C:\Windows\System\HWwukmV.exe
  C:\Windows\System\HWwukmV.exe
  2⤵
  PID:6504
- C:\Windows\System\ezzmXjl.exe
  C:\Windows\System\ezzmXjl.exe
  2⤵
  PID:6520
- C:\Windows\System\HedSToD.exe
  C:\Windows\System\HedSToD.exe
  2⤵
  PID:6536
- C:\Windows\System\VJrcMaD.exe
  C:\Windows\System\VJrcMaD.exe
  2⤵
  PID:6552
- C:\Windows\System\etgTsFS.exe
  C:\Windows\System\etgTsFS.exe
  2⤵
  PID:6568
- C:\Windows\System\FyVqzVm.exe
  C:\Windows\System\FyVqzVm.exe
  2⤵
  PID:6584
- C:\Windows\System\xPXBumK.exe
  C:\Windows\System\xPXBumK.exe
  2⤵
  PID:6600
- C:\Windows\System\OxPXWnT.exe
  C:\Windows\System\OxPXWnT.exe
  2⤵
  PID:6616
- C:\Windows\System\JyeroHB.exe
  C:\Windows\System\JyeroHB.exe
  2⤵
  PID:6632
- C:\Windows\System\hTtyeuM.exe
  C:\Windows\System\hTtyeuM.exe
  2⤵
  PID:6648
- C:\Windows\System\NMnxLPl.exe
  C:\Windows\System\NMnxLPl.exe
  2⤵
  PID:6664
- C:\Windows\System\BwFMRuf.exe
  C:\Windows\System\BwFMRuf.exe
  2⤵
  PID:6680
- C:\Windows\System\OcXeshe.exe
  C:\Windows\System\OcXeshe.exe
  2⤵
  PID:6696
- C:\Windows\System\gpjgXXd.exe
  C:\Windows\System\gpjgXXd.exe
  2⤵
  PID:6712
- C:\Windows\System\dEphOME.exe
  C:\Windows\System\dEphOME.exe
  2⤵
  PID:6728
- C:\Windows\System\jmuAzoh.exe
  C:\Windows\System\jmuAzoh.exe
  2⤵
  PID:6744
- C:\Windows\System\OVhgKpD.exe
  C:\Windows\System\OVhgKpD.exe
  2⤵
  PID:6760
- C:\Windows\System\rhnCUSt.exe
  C:\Windows\System\rhnCUSt.exe
  2⤵
  PID:6776
- C:\Windows\System\rkjnXAz.exe
  C:\Windows\System\rkjnXAz.exe
  2⤵
  PID:6792
- C:\Windows\System\UeKJWfM.exe
  C:\Windows\System\UeKJWfM.exe
  2⤵
  PID:6808
- C:\Windows\System\LtwHeTG.exe
  C:\Windows\System\LtwHeTG.exe
  2⤵
  PID:6824
- C:\Windows\System\uVZUKbx.exe
  C:\Windows\System\uVZUKbx.exe
  2⤵
  PID:6840
- C:\Windows\System\ZVtOFva.exe
  C:\Windows\System\ZVtOFva.exe
  2⤵
  PID:6856
- C:\Windows\System\LKXveZc.exe
  C:\Windows\System\LKXveZc.exe
  2⤵
  PID:6872
- C:\Windows\System\DvOAMks.exe
  C:\Windows\System\DvOAMks.exe
  2⤵
  PID:6888
- C:\Windows\System\pMqmJeT.exe
  C:\Windows\System\pMqmJeT.exe
  2⤵
  PID:6904
- C:\Windows\System\jNnwsXW.exe
  C:\Windows\System\jNnwsXW.exe
  2⤵
  PID:6920
- C:\Windows\System\mdCDjcV.exe
  C:\Windows\System\mdCDjcV.exe
  2⤵
  PID:6936
- C:\Windows\System\kTUvMUJ.exe
  C:\Windows\System\kTUvMUJ.exe
  2⤵
  PID:6952
- C:\Windows\System\mvXrSBj.exe
  C:\Windows\System\mvXrSBj.exe
  2⤵
  PID:6968
- C:\Windows\System\ROIWfEv.exe
  C:\Windows\System\ROIWfEv.exe
  2⤵
  PID:6984
- C:\Windows\System\qCgZwyC.exe
  C:\Windows\System\qCgZwyC.exe
  2⤵
  PID:7000
- C:\Windows\System\ADWPiij.exe
  C:\Windows\System\ADWPiij.exe
  2⤵
  PID:7016
- C:\Windows\System\jNBmUzp.exe
  C:\Windows\System\jNBmUzp.exe
  2⤵
  PID:7032
- C:\Windows\System\VuSsvzf.exe
  C:\Windows\System\VuSsvzf.exe
  2⤵
  PID:7048
- C:\Windows\System\obnAyoe.exe
  C:\Windows\System\obnAyoe.exe
  2⤵
  PID:7064
- C:\Windows\System\AgOhEBA.exe
  C:\Windows\System\AgOhEBA.exe
  2⤵
  PID:7080
- C:\Windows\System\QIzXVYF.exe
  C:\Windows\System\QIzXVYF.exe
  2⤵
  PID:7096
- C:\Windows\System\XbXNxsv.exe
  C:\Windows\System\XbXNxsv.exe
  2⤵
  PID:7112
- C:\Windows\System\hPuIcXT.exe
  C:\Windows\System\hPuIcXT.exe
  2⤵
  PID:7128
- C:\Windows\System\CmrQgsu.exe
  C:\Windows\System\CmrQgsu.exe
  2⤵
  PID:7144
- C:\Windows\System\DuAmCBG.exe
  C:\Windows\System\DuAmCBG.exe
  2⤵
  PID:7160
- C:\Windows\System\vpLjOFZ.exe
  C:\Windows\System\vpLjOFZ.exe
  2⤵
  PID:3692
- C:\Windows\System\eFTgyJu.exe
  C:\Windows\System\eFTgyJu.exe
  2⤵
  PID:5588
- C:\Windows\System\SjUacBB.exe
  C:\Windows\System\SjUacBB.exe
  2⤵
  PID:876
- C:\Windows\System\ASIqErI.exe
  C:\Windows\System\ASIqErI.exe
  2⤵
  PID:5748
- C:\Windows\System\TDmxaZV.exe
  C:\Windows\System\TDmxaZV.exe
  2⤵
  PID:5860
- C:\Windows\System\bSJtJoZ.exe
  C:\Windows\System\bSJtJoZ.exe
  2⤵
  PID:5924
- C:\Windows\System\ZNrIlvE.exe
  C:\Windows\System\ZNrIlvE.exe
  2⤵
  PID:6016
- C:\Windows\System\yQDhPZA.exe
  C:\Windows\System\yQDhPZA.exe
  2⤵
  PID:6132
- C:\Windows\System\lrVCeVh.exe
  C:\Windows\System\lrVCeVh.exe
  2⤵
  PID:1364
- C:\Windows\System\kJLAhmE.exe
  C:\Windows\System\kJLAhmE.exe
  2⤵
  PID:5248
- C:\Windows\System\jDHivYO.exe
  C:\Windows\System\jDHivYO.exe
  2⤵
  PID:6148
- C:\Windows\System\eFAPsvD.exe
  C:\Windows\System\eFAPsvD.exe
  2⤵
  PID:6180
- C:\Windows\System\ABJtHPA.exe
  C:\Windows\System\ABJtHPA.exe
  2⤵
  PID:6212
- C:\Windows\System\xmpziqx.exe
  C:\Windows\System\xmpziqx.exe
  2⤵
  PID:6244
- C:\Windows\System\OpvoDaW.exe
  C:\Windows\System\OpvoDaW.exe
  2⤵
  PID:6276
- C:\Windows\System\HjMlVZi.exe
  C:\Windows\System\HjMlVZi.exe
  2⤵
  PID:6308
- C:\Windows\System\GIIwzms.exe
  C:\Windows\System\GIIwzms.exe
  2⤵
  PID:6336
- C:\Windows\System\ZkqUVTP.exe
  C:\Windows\System\ZkqUVTP.exe
  2⤵
  PID:6368
- C:\Windows\System\eXVqtLH.exe
  C:\Windows\System\eXVqtLH.exe
  2⤵
  PID:6400
- C:\Windows\System\iseBLwZ.exe
  C:\Windows\System\iseBLwZ.exe
  2⤵
  PID:6420
- C:\Windows\System\wNDigIa.exe
  C:\Windows\System\wNDigIa.exe
  2⤵
  PID:6452
- C:\Windows\System\TyJKXbL.exe
  C:\Windows\System\TyJKXbL.exe
  2⤵
  PID:6484
- C:\Windows\System\sdRJUBH.exe
  C:\Windows\System\sdRJUBH.exe
  2⤵
  PID:6516
- C:\Windows\System\IsyTMRa.exe
  C:\Windows\System\IsyTMRa.exe
  2⤵
  PID:6548
- C:\Windows\System\NhWBPrw.exe
  C:\Windows\System\NhWBPrw.exe
  2⤵
  PID:6580
- C:\Windows\System\yeFamro.exe
  C:\Windows\System\yeFamro.exe
  2⤵
  PID:6608
- C:\Windows\System\NopwFGV.exe
  C:\Windows\System\NopwFGV.exe
  2⤵
  PID:4528
- C:\Windows\System\cYjUdPq.exe
  C:\Windows\System\cYjUdPq.exe
  2⤵
  PID:6656
- C:\Windows\System\nkeADQN.exe
  C:\Windows\System\nkeADQN.exe
  2⤵
  PID:6676
- C:\Windows\System\bXycYqe.exe
  C:\Windows\System\bXycYqe.exe
  2⤵
  PID:6708
- C:\Windows\System\rGLKkqo.exe
  C:\Windows\System\rGLKkqo.exe
  2⤵
  PID:6740
- C:\Windows\System\UsXbgRg.exe
  C:\Windows\System\UsXbgRg.exe
  2⤵
  PID:6772
- C:\Windows\System\wnzfmxH.exe
  C:\Windows\System\wnzfmxH.exe
  2⤵
  PID:6804
- C:\Windows\System\TvxjnGk.exe
  C:\Windows\System\TvxjnGk.exe
  2⤵
  PID:6836
- C:\Windows\System\QutbZQD.exe
  C:\Windows\System\QutbZQD.exe
  2⤵
  PID:6864
- C:\Windows\System\neTojvM.exe
  C:\Windows\System\neTojvM.exe
  2⤵
  PID:6896
- C:\Windows\System\KkYhGMI.exe
  C:\Windows\System\KkYhGMI.exe
  2⤵
  PID:1020
- C:\Windows\System\eSuzmTb.exe
  C:\Windows\System\eSuzmTb.exe
  2⤵
  PID:6944
- C:\Windows\System\poWwipz.exe
  C:\Windows\System\poWwipz.exe
  2⤵
  PID:6976
- C:\Windows\System\nGXEWwB.exe
  C:\Windows\System\nGXEWwB.exe
  2⤵
  PID:7008
- C:\Windows\System\LMFsLpj.exe
  C:\Windows\System\LMFsLpj.exe
  2⤵
  PID:7040
- C:\Windows\System\aCMCfxi.exe
  C:\Windows\System\aCMCfxi.exe
  2⤵
  PID:7072
- C:\Windows\System\QCBwIcX.exe
  C:\Windows\System\QCBwIcX.exe
  2⤵
  PID:1676
- C:\Windows\System\VdRFmYx.exe
  C:\Windows\System\VdRFmYx.exe
  2⤵
  PID:7124
- C:\Windows\System\NEVtDUA.exe
  C:\Windows\System\NEVtDUA.exe
  2⤵
  PID:7152
- C:\Windows\System\kTcpXoA.exe
  C:\Windows\System\kTcpXoA.exe
  2⤵
  PID:5540
- C:\Windows\System\NGWUrLY.exe
  C:\Windows\System\NGWUrLY.exe
  2⤵
  PID:5716
- C:\Windows\System\SLouXVu.exe
  C:\Windows\System\SLouXVu.exe
  2⤵
  PID:5840
- C:\Windows\System\VuNVpUX.exe
  C:\Windows\System\VuNVpUX.exe
  2⤵
  PID:3388
- C:\Windows\System\bmnWBSU.exe
  C:\Windows\System\bmnWBSU.exe
  2⤵
  PID:964
- C:\Windows\System\TvcjFak.exe
  C:\Windows\System\TvcjFak.exe
  2⤵
  PID:5376
- C:\Windows\System\byVVnjp.exe
  C:\Windows\System\byVVnjp.exe
  2⤵
  PID:6196
- C:\Windows\System\gGZgMFe.exe
  C:\Windows\System\gGZgMFe.exe
  2⤵
  PID:6240
- C:\Windows\System\iybGbmS.exe
  C:\Windows\System\iybGbmS.exe
  2⤵
  PID:6292
- C:\Windows\System\WshOTFT.exe
  C:\Windows\System\WshOTFT.exe
  2⤵
  PID:6324
- C:\Windows\System\UIUeisD.exe
  C:\Windows\System\UIUeisD.exe
  2⤵
  PID:6384
- C:\Windows\System\DAGKOEI.exe
  C:\Windows\System\DAGKOEI.exe
  2⤵
  PID:6416
- C:\Windows\System\UKGaQzw.exe
  C:\Windows\System\UKGaQzw.exe
  2⤵
  PID:6480
- C:\Windows\System\ZWcIcEC.exe
  C:\Windows\System\ZWcIcEC.exe
  2⤵
  PID:6544
- C:\Windows\System\VMmOASz.exe
  C:\Windows\System\VMmOASz.exe
  2⤵
  PID:6592
- C:\Windows\System\POFehmZ.exe
  C:\Windows\System\POFehmZ.exe
  2⤵
  PID:6624
- C:\Windows\System\VNXYarW.exe
  C:\Windows\System\VNXYarW.exe
  2⤵
  PID:1124
- C:\Windows\System\LujGDMJ.exe
  C:\Windows\System\LujGDMJ.exe
  2⤵
  PID:1208
- C:\Windows\System\oabpvdK.exe
  C:\Windows\System\oabpvdK.exe
  2⤵
  PID:3756
- C:\Windows\System\PmceqzI.exe
  C:\Windows\System\PmceqzI.exe
  2⤵
  PID:6724
- C:\Windows\System\SSiljNC.exe
  C:\Windows\System\SSiljNC.exe
  2⤵
  PID:6756
- C:\Windows\System\cHaDaPw.exe
  C:\Windows\System\cHaDaPw.exe
  2⤵
  PID:5064
- C:\Windows\System\ynUVANH.exe
  C:\Windows\System\ynUVANH.exe
  2⤵
  PID:6832
- C:\Windows\System\bsOpufG.exe
  C:\Windows\System\bsOpufG.exe
  2⤵
  PID:5060
- C:\Windows\System\eNZRezh.exe
  C:\Windows\System\eNZRezh.exe
  2⤵
  PID:1204
- C:\Windows\System\QKQRCXy.exe
  C:\Windows\System\QKQRCXy.exe
  2⤵
  PID:6932
- C:\Windows\System\ifzHOqd.exe
  C:\Windows\System\ifzHOqd.exe
  2⤵
  PID:6992
- C:\Windows\System\FPSiCwV.exe
  C:\Windows\System\FPSiCwV.exe
  2⤵
  PID:7028
- C:\Windows\System\pFtoOAU.exe
  C:\Windows\System\pFtoOAU.exe
  2⤵
  PID:7060
- C:\Windows\System\tztMUVq.exe
  C:\Windows\System\tztMUVq.exe
  2⤵
  PID:7092
- C:\Windows\System\SjChZLh.exe
  C:\Windows\System\SjChZLh.exe
  2⤵
  PID:1260
- C:\Windows\System\hjOeHVw.exe
  C:\Windows\System\hjOeHVw.exe
  2⤵
  PID:5652
- C:\Windows\System\FbCInOx.exe
  C:\Windows\System\FbCInOx.exe
  2⤵
  PID:5956
- C:\Windows\System\bpqCpWu.exe
  C:\Windows\System\bpqCpWu.exe
  2⤵
  PID:5188
- C:\Windows\System\VVQXCAo.exe
  C:\Windows\System\VVQXCAo.exe
  2⤵
  PID:6228
- C:\Windows\System\ojfaRuL.exe
  C:\Windows\System\ojfaRuL.exe
  2⤵
  PID:6320
- C:\Windows\System\LUVpyGl.exe
  C:\Windows\System\LUVpyGl.exe
  2⤵
  PID:2132
- C:\Windows\System\BgmOKHD.exe
  C:\Windows\System\BgmOKHD.exe
  2⤵
  PID:6532
- C:\Windows\System\ZPqSvHn.exe
  C:\Windows\System\ZPqSvHn.exe
  2⤵
  PID:1836
- C:\Windows\System\DXojlPf.exe
  C:\Windows\System\DXojlPf.exe
  2⤵
  PID:2692
- C:\Windows\System\IoxnYbY.exe
  C:\Windows\System\IoxnYbY.exe
  2⤵
  PID:6704
- C:\Windows\System\LoRmLrB.exe
  C:\Windows\System\LoRmLrB.exe
  2⤵
  PID:6788
- C:\Windows\System\gUBzesc.exe
  C:\Windows\System\gUBzesc.exe
  2⤵
  PID:6852
- C:\Windows\System\NUWhZWt.exe
  C:\Windows\System\NUWhZWt.exe
  2⤵
  PID:6928
- C:\Windows\System\nPcrMMc.exe
  C:\Windows\System\nPcrMMc.exe
  2⤵
  PID:7024
- C:\Windows\System\PFZhsdu.exe
  C:\Windows\System\PFZhsdu.exe
  2⤵
  PID:7088
- C:\Windows\System\qaMvXEm.exe
  C:\Windows\System\qaMvXEm.exe
  2⤵
  PID:5504
- C:\Windows\System\wLmYiKi.exe
  C:\Windows\System\wLmYiKi.exe
  2⤵
  PID:6128
- C:\Windows\System\idTAqLR.exe
  C:\Windows\System\idTAqLR.exe
  2⤵
  PID:3420
- C:\Windows\System\zbebvzQ.exe
  C:\Windows\System\zbebvzQ.exe
  2⤵
  PID:6356
- C:\Windows\System\WfxbneH.exe
  C:\Windows\System\WfxbneH.exe
  2⤵
  PID:1380
- C:\Windows\System\UitXDWQ.exe
  C:\Windows\System\UitXDWQ.exe
  2⤵
  PID:1492
- C:\Windows\System\FkmSGuC.exe
  C:\Windows\System\FkmSGuC.exe
  2⤵
  PID:7120
- C:\Windows\System\WPHgXdH.exe
  C:\Windows\System\WPHgXdH.exe
  2⤵
  PID:5808
- C:\Windows\System\bXeBbBP.exe
  C:\Windows\System\bXeBbBP.exe
  2⤵
  PID:3700
- C:\Windows\System\KXUFSVq.exe
  C:\Windows\System\KXUFSVq.exe
  2⤵
  PID:2360
- C:\Windows\System\DDrzlVg.exe
  C:\Windows\System\DDrzlVg.exe
  2⤵
  PID:6468
- C:\Windows\System\UPVqxkj.exe
  C:\Windows\System\UPVqxkj.exe
  2⤵
  PID:2892
- C:\Windows\System\iSfNuHI.exe
  C:\Windows\System\iSfNuHI.exe
  2⤵
  PID:116
- C:\Windows\System\WgMXTmP.exe
  C:\Windows\System\WgMXTmP.exe
  2⤵
  PID:3108
- C:\Windows\System\XrWbFRn.exe
  C:\Windows\System\XrWbFRn.exe
  2⤵
  PID:4920
- C:\Windows\System\TCFUnRH.exe
  C:\Windows\System\TCFUnRH.exe
  2⤵
  PID:4176
- C:\Windows\System\xWrwloB.exe
  C:\Windows\System\xWrwloB.exe
  2⤵
  PID:6304
- C:\Windows\System\EiJgOlY.exe
  C:\Windows\System\EiJgOlY.exe
  2⤵
  PID:3200
- C:\Windows\System\ToPhrNs.exe
  C:\Windows\System\ToPhrNs.exe
  2⤵
  PID:4508
- C:\Windows\System\JRgcIgV.exe
  C:\Windows\System\JRgcIgV.exe
  2⤵
  PID:4536
- C:\Windows\System\qRySrkj.exe
  C:\Windows\System\qRySrkj.exe
  2⤵
  PID:4416
- C:\Windows\System\UoIgoAN.exe
  C:\Windows\System\UoIgoAN.exe
  2⤵
  PID:1712
- C:\Windows\System\GmoskOF.exe
  C:\Windows\System\GmoskOF.exe
  2⤵
  PID:7176
- C:\Windows\System\SGRbOJO.exe
  C:\Windows\System\SGRbOJO.exe
  2⤵
  PID:7192
- C:\Windows\System\pYIxrbg.exe
  C:\Windows\System\pYIxrbg.exe
  2⤵
  PID:7208
- C:\Windows\System\nMNFSeI.exe
  C:\Windows\System\nMNFSeI.exe
  2⤵
  PID:7224
- C:\Windows\System\ErgvFRN.exe
  C:\Windows\System\ErgvFRN.exe
  2⤵
  PID:7240
- C:\Windows\System\dFlwzPT.exe
  C:\Windows\System\dFlwzPT.exe
  2⤵
  PID:7256
- C:\Windows\System\cRguplW.exe
  C:\Windows\System\cRguplW.exe
  2⤵
  PID:7272
- C:\Windows\System\lMBOUwZ.exe
  C:\Windows\System\lMBOUwZ.exe
  2⤵
  PID:7716
- C:\Windows\System\YcsDjjM.exe
  C:\Windows\System\YcsDjjM.exe
  2⤵
  PID:9376
- C:\Windows\System\oHryVqq.exe
  C:\Windows\System\oHryVqq.exe
  2⤵
  PID:9396
- C:\Windows\System\XIomwSp.exe
  C:\Windows\System\XIomwSp.exe
  2⤵
  PID:9424
- C:\Windows\System\ecDMyJh.exe
  C:\Windows\System\ecDMyJh.exe
  2⤵
  PID:9448
- C:\Windows\System\qHnvXOt.exe
  C:\Windows\System\qHnvXOt.exe
  2⤵
  PID:9476
- C:\Windows\System\InplSnV.exe
  C:\Windows\System\InplSnV.exe
  2⤵
  PID:9500
- C:\Windows\System\DETTcaw.exe
  C:\Windows\System\DETTcaw.exe
  2⤵
  PID:11384
- C:\Windows\System\PQDOuzI.exe
  C:\Windows\System\PQDOuzI.exe
  2⤵
  PID:11420
- C:\Windows\System\BrxpMZE.exe
  C:\Windows\System\BrxpMZE.exe
  2⤵
  PID:11444
- C:\Windows\System\KNsIlyw.exe
  C:\Windows\System\KNsIlyw.exe
  2⤵
  PID:11468
- C:\Windows\System\sFGRvxD.exe
  C:\Windows\System\sFGRvxD.exe
  2⤵
  PID:11496
- C:\Windows\System\WtBZbOl.exe
  C:\Windows\System\WtBZbOl.exe
  2⤵
  PID:11512
- C:\Windows\System\zIwKmUY.exe
  C:\Windows\System\zIwKmUY.exe
  2⤵
  PID:11536
- C:\Windows\System\tjUASVd.exe
  C:\Windows\System\tjUASVd.exe
  2⤵
  PID:11560
- C:\Windows\System\dojEOXE.exe
  C:\Windows\System\dojEOXE.exe
  2⤵
  PID:11584
- C:\Windows\System\GHRohau.exe
  C:\Windows\System\GHRohau.exe
  2⤵
  PID:11616
- C:\Windows\System\WEqFdeJ.exe
  C:\Windows\System\WEqFdeJ.exe
  2⤵
  PID:11652
- C:\Windows\System\urwvhTR.exe
  C:\Windows\System\urwvhTR.exe
  2⤵
  PID:11788
- C:\Windows\System\nFpBKbM.exe
  C:\Windows\System\nFpBKbM.exe
  2⤵
  PID:11904
- C:\Windows\System\JosXJGX.exe
  C:\Windows\System\JosXJGX.exe
  2⤵
  PID:12008
- C:\Windows\System\adYnvFV.exe
  C:\Windows\System\adYnvFV.exe
  2⤵
  PID:12108
- C:\Windows\System\porSqVD.exe
  C:\Windows\System\porSqVD.exe
  2⤵
  PID:9928
- C:\Windows\System\rqXVrrE.exe
  C:\Windows\System\rqXVrrE.exe
  2⤵
  PID:8300
- C:\Windows\System\kDEaCVX.exe
  C:\Windows\System\kDEaCVX.exe
  2⤵
  PID:7348
- C:\Windows\System\sLEVIyh.exe
  C:\Windows\System\sLEVIyh.exe
  2⤵
  PID:7404
- C:\Windows\System\vUrOMbB.exe
  C:\Windows\System\vUrOMbB.exe
  2⤵
  PID:7484
- C:\Windows\System\SCtFjda.exe
  C:\Windows\System\SCtFjda.exe
  2⤵
  PID:7556
- C:\Windows\System\qTZoIyS.exe
  C:\Windows\System\qTZoIyS.exe
  2⤵
  PID:11592
- C:\Windows\System\aPkWwlV.exe
  C:\Windows\System\aPkWwlV.exe
  2⤵
  PID:10244
- C:\Windows\System\ivuwlos.exe
  C:\Windows\System\ivuwlos.exe
  2⤵
  PID:7816
- C:\Windows\System\YjETtwR.exe
  C:\Windows\System\YjETtwR.exe
  2⤵
  PID:7960
- C:\Windows\System\CQbnDvj.exe
  C:\Windows\System\CQbnDvj.exe
  2⤵
  PID:7992
- C:\Windows\System\eGfBsyR.exe
  C:\Windows\System\eGfBsyR.exe
  2⤵
  PID:8032
- C:\Windows\System\cNaxcAN.exe
  C:\Windows\System\cNaxcAN.exe
  2⤵
  PID:8112
- C:\Windows\System\EtDUnoi.exe
  C:\Windows\System\EtDUnoi.exe
  2⤵
  PID:8152
- C:\Windows\System\sQWuWRS.exe
  C:\Windows\System\sQWuWRS.exe
  2⤵
  PID:3136
- C:\Windows\System\VQBlWXM.exe
  C:\Windows\System\VQBlWXM.exe
  2⤵
  PID:8588
- C:\Windows\System\nkkhBgL.exe
  C:\Windows\System\nkkhBgL.exe
  2⤵
  PID:8700
- C:\Windows\System\TZjLvSE.exe
  C:\Windows\System\TZjLvSE.exe
  2⤵
  PID:8788
- C:\Windows\System\ASKMkqO.exe
  C:\Windows\System\ASKMkqO.exe
  2⤵
  PID:8836
- C:\Windows\System\qDLsajL.exe
  C:\Windows\System\qDLsajL.exe
  2⤵
  PID:8876
- C:\Windows\System\HOVgmep.exe
  C:\Windows\System\HOVgmep.exe
  2⤵
  PID:8924
- C:\Windows\System\EWLghfW.exe
  C:\Windows\System\EWLghfW.exe
  2⤵
  PID:8980
- C:\Windows\System\pxrccrj.exe
  C:\Windows\System\pxrccrj.exe
  2⤵
  PID:9052
- C:\Windows\System\AsnBWyd.exe
  C:\Windows\System\AsnBWyd.exe
  2⤵
  PID:8524
- C:\Windows\System\NXaqypL.exe
  C:\Windows\System\NXaqypL.exe
  2⤵
  PID:11292
- C:\Windows\System\BUrOiTw.exe
  C:\Windows\System\BUrOiTw.exe
  2⤵
  PID:9392
- C:\Windows\System\RNioBYU.exe
  C:\Windows\System\RNioBYU.exe
  2⤵
  PID:9440
- C:\Windows\System\TkPPURG.exe
  C:\Windows\System\TkPPURG.exe
  2⤵
  PID:9544
- C:\Windows\System\WVCAPwl.exe
  C:\Windows\System\WVCAPwl.exe
  2⤵
  PID:10216
- C:\Windows\System\PTTwozx.exe
  C:\Windows\System\PTTwozx.exe
  2⤵
  PID:10252
- C:\Windows\System\iCtXqQa.exe
  C:\Windows\System\iCtXqQa.exe
  2⤵
  PID:10292
- C:\Windows\System\DmUSaxM.exe
  C:\Windows\System\DmUSaxM.exe
  2⤵
  PID:10356
- C:\Windows\System\SykThgp.exe
  C:\Windows\System\SykThgp.exe
  2⤵
  PID:9856
- C:\Windows\System\lKsOXon.exe
  C:\Windows\System\lKsOXon.exe
  2⤵
  PID:10136
- C:\Windows\System\cOCUvSO.exe
  C:\Windows\System\cOCUvSO.exe
  2⤵
  PID:2648
- C:\Windows\System\wgxXpWR.exe
  C:\Windows\System\wgxXpWR.exe
  2⤵
  PID:11528
- C:\Windows\System\ILSWZAl.exe
  C:\Windows\System\ILSWZAl.exe
  2⤵
  PID:11572
- C:\Windows\System\MUtSTju.exe
  C:\Windows\System\MUtSTju.exe
  2⤵
  PID:11764
- C:\Windows\System\wGilkPQ.exe
  C:\Windows\System\wGilkPQ.exe
  2⤵
  PID:12236
- C:\Windows\System\SUUbXqd.exe
  C:\Windows\System\SUUbXqd.exe
  2⤵
  PID:10168
- C:\Windows\System\irIHXzr.exe
  C:\Windows\System\irIHXzr.exe
  2⤵
  PID:7396
- C:\Windows\System\TFLmtng.exe
  C:\Windows\System\TFLmtng.exe
  2⤵
  PID:7596
- C:\Windows\System\MEBvCOP.exe
  C:\Windows\System\MEBvCOP.exe
  2⤵
  PID:7232
- C:\Windows\System\EsDIHXj.exe
  C:\Windows\System\EsDIHXj.exe
  2⤵
  PID:3488
- C:\Windows\System\eCGIMCA.exe
  C:\Windows\System\eCGIMCA.exe
  2⤵
  PID:11476
- C:\Windows\System\BVsEeGb.exe
  C:\Windows\System\BVsEeGb.exe
  2⤵
  PID:9568
- C:\Windows\System\bFNUxIw.exe
  C:\Windows\System\bFNUxIw.exe
  2⤵
  PID:10472
- C:\Windows\System\YudWzDQ.exe
  C:\Windows\System\YudWzDQ.exe
  2⤵
  PID:8008
- C:\Windows\System\gomOrdY.exe
  C:\Windows\System\gomOrdY.exe
  2⤵
  PID:6912
- C:\Windows\System\exvcLbE.exe
  C:\Windows\System\exvcLbE.exe
  2⤵
  PID:8136
- C:\Windows\System\AWRgwOz.exe
  C:\Windows\System\AWRgwOz.exe
  2⤵
  PID:8724
- C:\Windows\System\vZMWjyY.exe
  C:\Windows\System\vZMWjyY.exe
  2⤵
  PID:8860
- C:\Windows\System\CCuUYpX.exe
  C:\Windows\System\CCuUYpX.exe
  2⤵
  PID:9076
- C:\Windows\System\gkyztLi.exe
  C:\Windows\System\gkyztLi.exe
  2⤵
  PID:8420
- C:\Windows\System\FwZspCL.exe
  C:\Windows\System\FwZspCL.exe
  2⤵
  PID:9472
- C:\Windows\System\FvRllAA.exe
  C:\Windows\System\FvRllAA.exe
  2⤵
  PID:10120
- C:\Windows\System\CtqUhtj.exe
  C:\Windows\System\CtqUhtj.exe
  2⤵
  PID:10276
- C:\Windows\System\nQLhnGS.exe
  C:\Windows\System\nQLhnGS.exe
  2⤵
  PID:10376
- C:\Windows\System\HdmvvKa.exe
  C:\Windows\System\HdmvvKa.exe
  2⤵
  PID:11552
- C:\Windows\System\GGEZwgq.exe
  C:\Windows\System\GGEZwgq.exe
  2⤵
  PID:8236
- C:\Windows\System\SJHJUGy.exe
  C:\Windows\System\SJHJUGy.exe
  2⤵
  PID:8460
- C:\Windows\System\RJyeSMW.exe
  C:\Windows\System\RJyeSMW.exe
  2⤵
  PID:1060
- C:\Windows\System\REiMMxY.exe
  C:\Windows\System\REiMMxY.exe
  2⤵
  PID:7508
- C:\Windows\System\dnAzhyh.exe
  C:\Windows\System\dnAzhyh.exe
  2⤵
  PID:11392
- C:\Windows\System\RFSrGec.exe
  C:\Windows\System\RFSrGec.exe
  2⤵
  PID:8024
- C:\Windows\System\XyjCusv.exe
  C:\Windows\System\XyjCusv.exe
  2⤵
  PID:10712
- C:\Windows\System\QkvjqWr.exe
  C:\Windows\System\QkvjqWr.exe
  2⤵
  PID:8812
- C:\Windows\System\oQbVPqQ.exe
  C:\Windows\System\oQbVPqQ.exe
  2⤵
  PID:12116
- C:\Windows\System\AfExzVd.exe
  C:\Windows\System\AfExzVd.exe
  2⤵
  PID:11524
- C:\Windows\System\kKJRGFU.exe
  C:\Windows\System\kKJRGFU.exe
  2⤵
  PID:4020
- C:\Windows\System\PtRszqT.exe
  C:\Windows\System\PtRszqT.exe
  2⤵
  PID:8340
- C:\Windows\System\ZHAuXpD.exe
  C:\Windows\System\ZHAuXpD.exe
  2⤵
  PID:7548
- C:\Windows\System\TkicKjO.exe
  C:\Windows\System\TkicKjO.exe
  2⤵
  PID:7976
- C:\Windows\System\qwzrasw.exe
  C:\Windows\System\qwzrasw.exe
  2⤵
  PID:10340
- C:\Windows\System\gUfjkWw.exe
  C:\Windows\System\gUfjkWw.exe
  2⤵
  PID:11520
- C:\Windows\System\FjOJpZl.exe
  C:\Windows\System\FjOJpZl.exe
  2⤵
  PID:8396
- C:\Windows\System\kLTJFcj.exe
  C:\Windows\System\kLTJFcj.exe
  2⤵
  PID:9344
- C:\Windows\System\LNQHPXW.exe
  C:\Windows\System\LNQHPXW.exe
  2⤵
  PID:12292
- C:\Windows\System\YQyNfNz.exe
  C:\Windows\System\YQyNfNz.exe
  2⤵
  PID:12332
- C:\Windows\System\ibyPGyM.exe
  C:\Windows\System\ibyPGyM.exe
  2⤵
  PID:12352
- C:\Windows\System\BlzJmjX.exe
  C:\Windows\System\BlzJmjX.exe
  2⤵
  PID:12380
- C:\Windows\System\shlKxYT.exe
  C:\Windows\System\shlKxYT.exe
  2⤵
  PID:12404
- C:\Windows\System\WXwnMAc.exe
  C:\Windows\System\WXwnMAc.exe
  2⤵
  PID:12424
- C:\Windows\System\VFwWPIP.exe
  C:\Windows\System\VFwWPIP.exe
  2⤵
  PID:12448
- C:\Windows\System\PIXAzrg.exe
  C:\Windows\System\PIXAzrg.exe
  2⤵
  PID:12464
- C:\Windows\System\bUmdbnS.exe
  C:\Windows\System\bUmdbnS.exe
  2⤵
  PID:12528
- C:\Windows\System\nFfwDBp.exe
  C:\Windows\System\nFfwDBp.exe
  2⤵
  PID:12564
- C:\Windows\System\POFZzxP.exe
  C:\Windows\System\POFZzxP.exe
  2⤵
  PID:12592
- C:\Windows\System\bbZzXFA.exe
  C:\Windows\System\bbZzXFA.exe
  2⤵
  PID:12616
- C:\Windows\System\GhrLcni.exe
  C:\Windows\System\GhrLcni.exe
  2⤵
  PID:12640
- C:\Windows\System\hCnaPio.exe
  C:\Windows\System\hCnaPio.exe
  2⤵
  PID:12656
- C:\Windows\System\vvhDUSX.exe
  C:\Windows\System\vvhDUSX.exe
  2⤵
  PID:12712
- C:\Windows\System\wWvEkSx.exe
  C:\Windows\System\wWvEkSx.exe
  2⤵
  PID:12732
- C:\Windows\System\JUWqdQJ.exe
  C:\Windows\System\JUWqdQJ.exe
  2⤵
  PID:12752
- C:\Windows\System\bZNyXSa.exe
  C:\Windows\System\bZNyXSa.exe
  2⤵
  PID:12776
- C:\Windows\System\INsOQjo.exe
  C:\Windows\System\INsOQjo.exe
  2⤵
  PID:12816
- C:\Windows\System\rKOzBLO.exe
  C:\Windows\System\rKOzBLO.exe
  2⤵
  PID:12836
- C:\Windows\System\jlqhxtA.exe
  C:\Windows\System\jlqhxtA.exe
  2⤵
  PID:12872
- C:\Windows\System\dRGfBDU.exe
  C:\Windows\System\dRGfBDU.exe
  2⤵
  PID:12900
- C:\Windows\System\CxCxrav.exe
  C:\Windows\System\CxCxrav.exe
  2⤵
  PID:12940
- C:\Windows\System\yInwXXa.exe
  C:\Windows\System\yInwXXa.exe
  2⤵
  PID:13096
- C:\Windows\System\tfFyChx.exe
  C:\Windows\System\tfFyChx.exe
  2⤵
  PID:12896
- C:\Windows\System\sSHAbfr.exe
  C:\Windows\System\sSHAbfr.exe
  2⤵
  PID:7460
- C:\Windows\System\EOUZHkb.exe
  C:\Windows\System\EOUZHkb.exe
  2⤵
  PID:8972
- C:\Windows\System\KRdKpFl.exe
  C:\Windows\System\KRdKpFl.exe
  2⤵
  PID:12420
- C:\Windows\System\rpQfefu.exe
  C:\Windows\System\rpQfefu.exe
  2⤵
  PID:12792
- C:\Windows\System\DlEYvBA.exe
  C:\Windows\System\DlEYvBA.exe
  2⤵
  PID:1396
- C:\Windows\System\wQHfFzi.exe
  C:\Windows\System\wQHfFzi.exe
  2⤵
  PID:13216
- C:\Windows\System\UyYbcyZ.exe
  C:\Windows\System\UyYbcyZ.exe
  2⤵
  PID:12316
- C:\Windows\System\oRLycfF.exe
  C:\Windows\System\oRLycfF.exe
  2⤵
  PID:12804
- C:\Windows\System\nAPWdEz.exe
  C:\Windows\System\nAPWdEz.exe
  2⤵
  PID:12888
- C:\Windows\System\ZIpdVBU.exe
  C:\Windows\System\ZIpdVBU.exe
  2⤵
  PID:12972
- C:\Windows\System\AWjBPHZ.exe
  C:\Windows\System\AWjBPHZ.exe
  2⤵
  PID:13044
- C:\Windows\System\EouJpkm.exe
  C:\Windows\System\EouJpkm.exe
  2⤵
  PID:13028
- C:\Windows\System\CfDUsFu.exe
  C:\Windows\System\CfDUsFu.exe
  2⤵
  PID:13052
- C:\Windows\System\jXtGnYj.exe
  C:\Windows\System\jXtGnYj.exe
  2⤵
  PID:12964
- C:\Windows\System\nIVDKBO.exe
  C:\Windows\System\nIVDKBO.exe
  2⤵
  PID:4264
- C:\Windows\System\UmySpyc.exe
  C:\Windows\System\UmySpyc.exe
  2⤵
  PID:888
- C:\Windows\System\nuqdcow.exe
  C:\Windows\System\nuqdcow.exe
  2⤵
  PID:13012
- C:\Windows\System\yLtsFjo.exe
  C:\Windows\System\yLtsFjo.exe
  2⤵
  PID:12848
- C:\Windows\System\WfycRHI.exe
  C:\Windows\System\WfycRHI.exe
  2⤵
  PID:1552
- C:\Windows\System\yCHGZHl.exe
  C:\Windows\System\yCHGZHl.exe
  2⤵
  PID:13004
- C:\Windows\System\KmXJdfA.exe
  C:\Windows\System\KmXJdfA.exe
  2⤵
  PID:744
- C:\Windows\System\QNveYPk.exe
  C:\Windows\System\QNveYPk.exe
  2⤵
  PID:13108
- C:\Windows\System\yuEIdZB.exe
  C:\Windows\System\yuEIdZB.exe
  2⤵
  PID:12684
- C:\Windows\System\FeKbKEe.exe
  C:\Windows\System\FeKbKEe.exe
  2⤵
  PID:13172
- C:\Windows\System\YICBiCH.exe
  C:\Windows\System\YICBiCH.exe
  2⤵
  PID:13116
- C:\Windows\System\VKWqVAA.exe
  C:\Windows\System\VKWqVAA.exe
  2⤵
  PID:13192
- C:\Windows\System\UtrMghY.exe
  C:\Windows\System\UtrMghY.exe
  2⤵
  PID:1068
- C:\Windows\System\gcQeAsS.exe
  C:\Windows\System\gcQeAsS.exe
  2⤵
  PID:1268
- C:\Windows\System\XYGzecC.exe
  C:\Windows\System\XYGzecC.exe
  2⤵
  PID:3972
- C:\Windows\System\riznhvU.exe
  C:\Windows\System\riznhvU.exe
  2⤵
  PID:10432
- C:\Windows\System\QTMUCsr.exe
  C:\Windows\System\QTMUCsr.exe
  2⤵
  PID:12604
- C:\Windows\System\UCxVfiB.exe
  C:\Windows\System\UCxVfiB.exe
  2⤵
  PID:12748
- C:\Windows\System\yTxSfYj.exe
  C:\Windows\System\yTxSfYj.exe
  2⤵
  PID:12800
- C:\Windows\System\HXctCGM.exe
  C:\Windows\System\HXctCGM.exe
  2⤵
  PID:12728
- C:\Windows\System\ugIjUdP.exe
  C:\Windows\System\ugIjUdP.exe
  2⤵
  PID:12400
- C:\Windows\System\JmVpjyg.exe
  C:\Windows\System\JmVpjyg.exe
  2⤵
  PID:13292
- C:\Windows\System\IzVdfOl.exe
  C:\Windows\System\IzVdfOl.exe
  2⤵
  PID:12540
- C:\Windows\System\cXAcGZp.exe
  C:\Windows\System\cXAcGZp.exe
  2⤵
  PID:4356
- C:\Windows\System\DoNUukk.exe
  C:\Windows\System\DoNUukk.exe
  2⤵
  PID:1964
- C:\Windows\System\MCVtqOd.exe
  C:\Windows\System\MCVtqOd.exe
  2⤵
  PID:10696
- C:\Windows\System\igPphMh.exe
  C:\Windows\System\igPphMh.exe
  2⤵
  PID:2260
- C:\Windows\System\CIsSNfU.exe
  C:\Windows\System\CIsSNfU.exe
  2⤵
  PID:1004
- C:\Windows\System\IgpHzgT.exe
  C:\Windows\System\IgpHzgT.exe
  2⤵
  PID:6884
- C:\Windows\System\dxWyxpf.exe
  C:\Windows\System\dxWyxpf.exe
  2⤵
  PID:8580
- C:\Windows\System\vSMDrfO.exe
  C:\Windows\System\vSMDrfO.exe
  2⤵
  PID:8764
- C:\Windows\System\djfaNvB.exe
  C:\Windows\System\djfaNvB.exe
  2⤵
  PID:12772
- C:\Windows\System\sntyYwd.exe
  C:\Windows\System\sntyYwd.exe
  2⤵
  PID:12916
- C:\Windows\System\fcutsGZ.exe
  C:\Windows\System\fcutsGZ.exe
  2⤵
  PID:13068
- C:\Windows\System\tKqqkoW.exe
  C:\Windows\System\tKqqkoW.exe
  2⤵
  PID:12976
- C:\Windows\System\MTohPCh.exe
  C:\Windows\System\MTohPCh.exe
  2⤵
  PID:2688
- C:\Windows\System\SxlWsgO.exe
  C:\Windows\System\SxlWsgO.exe
  2⤵
  PID:13124
- C:\Windows\System\infYQZo.exe
  C:\Windows\System\infYQZo.exe
  2⤵
  PID:13072
- C:\Windows\System\lBJDWKX.exe
  C:\Windows\System\lBJDWKX.exe
  2⤵
  PID:12988
- C:\Windows\System\uYbHEyc.exe
  C:\Windows\System\uYbHEyc.exe
  2⤵
  PID:13140
- C:\Windows\System\LIwrTmS.exe
  C:\Windows\System\LIwrTmS.exe
  2⤵
  PID:13148
- C:\Windows\System\rRLEvhg.exe
  C:\Windows\System\rRLEvhg.exe
  2⤵
  PID:1420
- C:\Windows\System\HpVxDcM.exe
  C:\Windows\System\HpVxDcM.exe
  2⤵
  PID:13136
- C:\Windows\System\auvcDGm.exe
  C:\Windows\System\auvcDGm.exe
  2⤵
  PID:13268
- C:\Windows\System\qIrLzfX.exe
  C:\Windows\System\qIrLzfX.exe
  2⤵
  PID:1180
- C:\Windows\System\CpZuZtU.exe
  C:\Windows\System\CpZuZtU.exe
  2⤵
  PID:12308
- C:\Windows\System\FtJGbQQ.exe
  C:\Windows\System\FtJGbQQ.exe
  2⤵
  PID:12720
- C:\Windows\System\ljAUYsF.exe
  C:\Windows\System\ljAUYsF.exe
  2⤵
  PID:12412
- C:\Windows\System\wkSfJZj.exe
  C:\Windows\System\wkSfJZj.exe
  2⤵
  PID:12460
- C:\Windows\System\FwXkCjg.exe
  C:\Windows\System\FwXkCjg.exe
  2⤵
  PID:12432
- C:\Windows\System\eyAuPAA.exe
  C:\Windows\System\eyAuPAA.exe
  2⤵
  PID:4364
- C:\Windows\System\BesRqLa.exe
  C:\Windows\System\BesRqLa.exe
  2⤵
  PID:9340
- C:\Windows\System\mjMyxbG.exe
  C:\Windows\System\mjMyxbG.exe
  2⤵
  PID:6820
- C:\Windows\System\UgVjmNb.exe
  C:\Windows\System\UgVjmNb.exe
  2⤵
  PID:13000
- C:\Windows\System\lvMDwvk.exe
  C:\Windows\System\lvMDwvk.exe
  2⤵
  PID:13060
- C:\Windows\System\evFCklB.exe
  C:\Windows\System\evFCklB.exe
  2⤵
  PID:12960
- C:\Windows\System\LvHpmaC.exe
  C:\Windows\System\LvHpmaC.exe
  2⤵
  PID:13120
- C:\Windows\System\FwhgEOJ.exe
  C:\Windows\System\FwhgEOJ.exe
  2⤵
  PID:13024
- C:\Windows\System\QJMpZGw.exe
  C:\Windows\System\QJMpZGw.exe
  2⤵
  PID:1224
- C:\Windows\System\KCqHXQX.exe
  C:\Windows\System\KCqHXQX.exe
  2⤵
  PID:3940
- C:\Windows\System\FEtKUXp.exe
  C:\Windows\System\FEtKUXp.exe
  2⤵
  PID:13152
- C:\Windows\System\XEulYIT.exe
  C:\Windows\System\XEulYIT.exe
  2⤵
  PID:12500
- C:\Windows\System\pIxUFIp.exe
  C:\Windows\System\pIxUFIp.exe
  2⤵
  PID:2600
- C:\Windows\System\ikfzIsk.exe
  C:\Windows\System\ikfzIsk.exe
  2⤵
  PID:7840
- C:\Windows\System\MjBZcJi.exe
  C:\Windows\System\MjBZcJi.exe
  2⤵
  PID:13084
- C:\Windows\System\PsMdMVj.exe
  C:\Windows\System\PsMdMVj.exe
  2⤵
  PID:3728
- C:\Windows\System\fKTILSV.exe
  C:\Windows\System\fKTILSV.exe
  2⤵
  PID:384
- C:\Windows\System\matdTXE.exe
  C:\Windows\System\matdTXE.exe
  2⤵
  PID:12516
- C:\Windows\System\hxXDMsq.exe
  C:\Windows\System\hxXDMsq.exe
  2⤵
  PID:4692
- C:\Windows\System\DbcCAEX.exe
  C:\Windows\System\DbcCAEX.exe
  2⤵
  PID:13036
- C:\Windows\System\ApziGwN.exe
  C:\Windows\System\ApziGwN.exe
  2⤵
  PID:13176
- C:\Windows\System\QILqfqE.exe
  C:\Windows\System\QILqfqE.exe
  2⤵
  PID:3012
- C:\Windows\System\ldhbduW.exe
  C:\Windows\System\ldhbduW.exe
  2⤵
  PID:13156
- C:\Windows\System\gDzPCKT.exe
  C:\Windows\System\gDzPCKT.exe
  2⤵
  PID:6768
- C:\Windows\System\vKRQOao.exe
  C:\Windows\System\vKRQOao.exe
  2⤵
  PID:1580
- C:\Windows\System\lReIQUE.exe
  C:\Windows\System\lReIQUE.exe
  2⤵
  PID:13328
- C:\Windows\System\liccOxp.exe
  C:\Windows\System\liccOxp.exe
  2⤵
  PID:13344
- C:\Windows\System\JbRJDIL.exe
  C:\Windows\System\JbRJDIL.exe
  2⤵
  PID:13360
- C:\Windows\System\SyYkSFM.exe
  C:\Windows\System\SyYkSFM.exe
  2⤵
  PID:13376
- C:\Windows\System\TrSQyBa.exe
  C:\Windows\System\TrSQyBa.exe
  2⤵
  PID:13392
- C:\Windows\System\GcVofGH.exe
  C:\Windows\System\GcVofGH.exe
  2⤵
  PID:13408
- C:\Windows\System\qOqKnwu.exe
  C:\Windows\System\qOqKnwu.exe
  2⤵
  PID:13424
- C:\Windows\System\BXukpmy.exe
  C:\Windows\System\BXukpmy.exe
  2⤵
  PID:13440
- C:\Windows\System\wplmUKk.exe
  C:\Windows\System\wplmUKk.exe
  2⤵
  PID:13456
- C:\Windows\System\oOdVKec.exe
  C:\Windows\System\oOdVKec.exe
  2⤵
  PID:13472
- C:\Windows\System\VHttDfI.exe
  C:\Windows\System\VHttDfI.exe
  2⤵
  PID:13488
- C:\Windows\System\QuoaoQn.exe
  C:\Windows\System\QuoaoQn.exe
  2⤵
  PID:13504
- C:\Windows\System\YldrEor.exe
  C:\Windows\System\YldrEor.exe
  2⤵
  PID:13520
- C:\Windows\System\uXYZvFC.exe
  C:\Windows\System\uXYZvFC.exe
  2⤵
  PID:13536
- C:\Windows\System\mXuotYp.exe
  C:\Windows\System\mXuotYp.exe
  2⤵
  PID:13552
- C:\Windows\System\ItkWuXI.exe
  C:\Windows\System\ItkWuXI.exe
  2⤵
  PID:13568
- C:\Windows\System\eJJJDuz.exe
  C:\Windows\System\eJJJDuz.exe
  2⤵
  PID:13584
- C:\Windows\System\BWvCpBE.exe
  C:\Windows\System\BWvCpBE.exe
  2⤵
  PID:13600
- C:\Windows\System\NGiRyeW.exe
  C:\Windows\System\NGiRyeW.exe
  2⤵
  PID:13616
- C:\Windows\System\zckCeco.exe
  C:\Windows\System\zckCeco.exe
  2⤵
  PID:13632
- C:\Windows\System\kzlxsAc.exe
  C:\Windows\System\kzlxsAc.exe
  2⤵
  PID:13648
- C:\Windows\System\gBdNSje.exe
  C:\Windows\System\gBdNSje.exe
  2⤵
  PID:13664
- C:\Windows\System\hhAqwFH.exe
  C:\Windows\System\hhAqwFH.exe
  2⤵
  PID:13680
- C:\Windows\System\KvWiOgH.exe
  C:\Windows\System\KvWiOgH.exe
  2⤵
  PID:13696
- C:\Windows\System\xehuToU.exe
  C:\Windows\System\xehuToU.exe
  2⤵
  PID:13712
- C:\Windows\System\CdsCKgU.exe
  C:\Windows\System\CdsCKgU.exe
  2⤵
  PID:13728
- C:\Windows\System\iOYKLSG.exe
  C:\Windows\System\iOYKLSG.exe
  2⤵
  PID:13744
- C:\Windows\System\GrxaXjR.exe
  C:\Windows\System\GrxaXjR.exe
  2⤵
  PID:13760
- C:\Windows\System\ocuUuzz.exe
  C:\Windows\System\ocuUuzz.exe
  2⤵
  PID:13780
- C:\Windows\System\vNvpedR.exe
  C:\Windows\System\vNvpedR.exe
  2⤵
  PID:13796
- C:\Windows\System\kYGsuqd.exe
  C:\Windows\System\kYGsuqd.exe
  2⤵
  PID:13812
- C:\Windows\System\OekvXhn.exe
  C:\Windows\System\OekvXhn.exe
  2⤵
  PID:13828
- C:\Windows\System\FrXuaSa.exe
  C:\Windows\System\FrXuaSa.exe
  2⤵
  PID:13844
- C:\Windows\System\nBFszTG.exe
  C:\Windows\System\nBFszTG.exe
  2⤵
  PID:13860
- C:\Windows\System\HynYebX.exe
  C:\Windows\System\HynYebX.exe
  2⤵
  PID:13876
- C:\Windows\System\VYlZljY.exe
  C:\Windows\System\VYlZljY.exe
  2⤵
  PID:13892
- C:\Windows\System\NgIvyXt.exe
  C:\Windows\System\NgIvyXt.exe
  2⤵
  PID:13908
- C:\Windows\System\hwyoGQL.exe
  C:\Windows\System\hwyoGQL.exe
  2⤵
  PID:13924
- C:\Windows\System\fdFTPan.exe
  C:\Windows\System\fdFTPan.exe
  2⤵
  PID:13940
- C:\Windows\System\lDjpAkN.exe
  C:\Windows\System\lDjpAkN.exe
  2⤵
  PID:14072
- C:\Windows\System\iCOwfkP.exe
  C:\Windows\System\iCOwfkP.exe
  2⤵
  PID:13952
- C:\Windows\System\PcBOZSk.exe
  C:\Windows\System\PcBOZSk.exe
  2⤵
  PID:14012
- C:\Windows\System\FKjWXSH.exe
  C:\Windows\System\FKjWXSH.exe
  2⤵
  PID:14024
- C:\Windows\System\fopMyno.exe
  C:\Windows\System\fopMyno.exe
  2⤵
  PID:14044
- C:\Windows\System\ZxcYSFZ.exe
  C:\Windows\System\ZxcYSFZ.exe
  2⤵
  PID:14060
- C:\Windows\System\yZVbTWH.exe
  C:\Windows\System\yZVbTWH.exe
  2⤵
  PID:14088
- C:\Windows\System\LPpUMBB.exe
  C:\Windows\System\LPpUMBB.exe
  2⤵
  PID:14100
- C:\Windows\System\RTCNOhC.exe
  C:\Windows\System\RTCNOhC.exe
  2⤵
  PID:14116
- C:\Windows\System\PsLVsYW.exe
  C:\Windows\System\PsLVsYW.exe
  2⤵
  PID:14132
- C:\Windows\System\onwfVHX.exe
  C:\Windows\System\onwfVHX.exe
  2⤵
  PID:14148
- C:\Windows\System\KRRShgs.exe
  C:\Windows\System\KRRShgs.exe
  2⤵
  PID:14164
- C:\Windows\System\JNjjmZQ.exe
  C:\Windows\System\JNjjmZQ.exe
  2⤵
  PID:14180
- C:\Windows\System\xAwmeAm.exe
  C:\Windows\System\xAwmeAm.exe
  2⤵
  PID:14196
- C:\Windows\System\UPMStEu.exe
  C:\Windows\System\UPMStEu.exe
  2⤵
  PID:14212
- C:\Windows\System\ZOfYMyr.exe
  C:\Windows\System\ZOfYMyr.exe
  2⤵
  PID:14228
- C:\Windows\System\ufcefnz.exe
  C:\Windows\System\ufcefnz.exe
  2⤵
  PID:14244
- C:\Windows\System\FphZDnF.exe
  C:\Windows\System\FphZDnF.exe
  2⤵
  PID:14260
- C:\Windows\System\VhKStRq.exe
  C:\Windows\System\VhKStRq.exe
  2⤵
  PID:1940
- C:\Windows\System\BDEupxw.exe
  C:\Windows\System\BDEupxw.exe
  2⤵
  PID:3564
- C:\Windows\System\qklUQXI.exe
  C:\Windows\System\qklUQXI.exe
  2⤵
  PID:14280
- C:\Windows\System\JlbjRNQ.exe
  C:\Windows\System\JlbjRNQ.exe
  2⤵
  PID:14272
- C:\Windows\System\JBdnlRg.exe
  C:\Windows\System\JBdnlRg.exe
  2⤵
  PID:14292
- C:\Windows\System\OgDmRei.exe
  C:\Windows\System\OgDmRei.exe
  2⤵
  PID:14328
- C:\Windows\System\VYNwcMY.exe
  C:\Windows\System\VYNwcMY.exe
  2⤵
  PID:13340
- C:\Windows\System\VYninON.exe
  C:\Windows\System\VYninON.exe
  2⤵
  PID:13372
- C:\Windows\System\gsynPcX.exe
  C:\Windows\System\gsynPcX.exe
  2⤵
  PID:13404
- C:\Windows\System\lmxhsJP.exe
  C:\Windows\System\lmxhsJP.exe
  2⤵
  PID:13436
- C:\Windows\System\VpDYHhQ.exe
  C:\Windows\System\VpDYHhQ.exe
  2⤵
  PID:13468
- C:\Windows\System\JFrQUUg.exe
  C:\Windows\System\JFrQUUg.exe
  2⤵
  PID:13500
- C:\Windows\System\UxJduAb.exe
  C:\Windows\System\UxJduAb.exe
  2⤵
  PID:13532
- C:\Windows\System\KGywziE.exe
  C:\Windows\System\KGywziE.exe
  2⤵
  PID:13560
- C:\Windows\System\KmIFVzA.exe
  C:\Windows\System\KmIFVzA.exe
  2⤵
  PID:13580
- C:\Windows\System\vqWmNKz.exe
  C:\Windows\System\vqWmNKz.exe
  2⤵
  PID:13612
- C:\Windows\System\vFpoFWE.exe
  C:\Windows\System\vFpoFWE.exe
  2⤵
  PID:13644
- C:\Windows\System\LLJtMKB.exe
  C:\Windows\System\LLJtMKB.exe
  2⤵
  PID:13688
- C:\Windows\System\zBwatka.exe
  C:\Windows\System\zBwatka.exe
  2⤵
  PID:13720
- C:\Windows\System\zCoSWJu.exe
  C:\Windows\System\zCoSWJu.exe
  2⤵
  PID:13756
- C:\Windows\System\ltuCEdu.exe
  C:\Windows\System\ltuCEdu.exe
  2⤵
  PID:13788
- C:\Windows\System\FbrVmzl.exe
  C:\Windows\System\FbrVmzl.exe
  2⤵
  PID:13792
- C:\Windows\System\evoGoyn.exe
  C:\Windows\System\evoGoyn.exe
  2⤵
  PID:13856
- C:\Windows\System\qsdKccQ.exe
  C:\Windows\System\qsdKccQ.exe
  2⤵
  PID:13888
- C:\Windows\System\wczxqlG.exe
  C:\Windows\System\wczxqlG.exe
  2⤵
  PID:13932
- C:\Windows\System\mwnPsMs.exe
  C:\Windows\System\mwnPsMs.exe
  2⤵
  PID:13356
- C:\Windows\System\Knanvrk.exe
  C:\Windows\System\Knanvrk.exe
  2⤵
  PID:13420
- C:\Windows\System\NdqtxnA.exe
  C:\Windows\System\NdqtxnA.exe
  2⤵
  PID:13484
- C:\Windows\System\GyUGudB.exe
  C:\Windows\System\GyUGudB.exe
  2⤵
  PID:13576
- C:\Windows\System\DuSgcGF.exe
  C:\Windows\System\DuSgcGF.exe
  2⤵
  PID:13776
- C:\Windows\System\wXclsaf.exe
  C:\Windows\System\wXclsaf.exe
  2⤵
  PID:1944
- C:\Windows\System\FhGxHpr.exe
  C:\Windows\System\FhGxHpr.exe
  2⤵
  PID:13704
- C:\Windows\System\tAARiEt.exe
  C:\Windows\System\tAARiEt.exe
  2⤵
  PID:13740
- C:\Windows\System\VzsTXTx.exe
  C:\Windows\System\VzsTXTx.exe
  2⤵
  PID:13852
- C:\Windows\System\zaBCJoK.exe
  C:\Windows\System\zaBCJoK.exe
  2⤵
  PID:13920
- C:\Windows\System\xpwtEty.exe
  C:\Windows\System\xpwtEty.exe
  2⤵
  PID:14004
- C:\Windows\System\iVymgeL.exe
  C:\Windows\System\iVymgeL.exe
  2⤵
  PID:13988
- C:\Windows\System\qSYuxOO.exe
  C:\Windows\System\qSYuxOO.exe
  2⤵
  PID:13972
- C:\Windows\System\zfZgYrx.exe
  C:\Windows\System\zfZgYrx.exe
  2⤵
  PID:14036
- C:\Windows\System\GycAKCn.exe
  C:\Windows\System\GycAKCn.exe
  2⤵
  PID:14068
- C:\Windows\System\BJJCrCg.exe
  C:\Windows\System\BJJCrCg.exe
  2⤵
  PID:14108
- C:\Windows\System\uwmFFDs.exe
  C:\Windows\System\uwmFFDs.exe
  2⤵
  PID:14140
- C:\Windows\System\hfFTUIP.exe
  C:\Windows\System\hfFTUIP.exe
  2⤵
  PID:14172
- C:\Windows\System\IPGbBkq.exe
  C:\Windows\System\IPGbBkq.exe
  2⤵
  PID:14204
- C:\Windows\System\rJvMVVu.exe
  C:\Windows\System\rJvMVVu.exe
  2⤵
  PID:14236
- C:\Windows\System\OdwDLgR.exe
  C:\Windows\System\OdwDLgR.exe
  2⤵
  PID:14268
- C:\Windows\System\OMYyXaT.exe
  C:\Windows\System\OMYyXaT.exe
  2⤵
  PID:3608
- C:\Windows\System\fBtsoov.exe
  C:\Windows\System\fBtsoov.exe
  2⤵
  PID:3568
- C:\Windows\System\UqiVuHb.exe
  C:\Windows\System\UqiVuHb.exe
  2⤵
  PID:13324
- C:\Windows\System\kKjlWdx.exe
  C:\Windows\System\kKjlWdx.exe
  2⤵
  PID:13452
- C:\Windows\System\szejkTB.exe
  C:\Windows\System\szejkTB.exe
  2⤵
  PID:14028
- C:\Windows\System\RuXNpKB.exe
  C:\Windows\System\RuXNpKB.exe
  2⤵
  PID:13676
- C:\Windows\System\jiqwYyQ.exe
  C:\Windows\System\jiqwYyQ.exe
  2⤵
  PID:13516
- C:\Windows\System\MemfZlE.exe
  C:\Windows\System\MemfZlE.exe
  2⤵
  PID:13840
- C:\Windows\System\borXPRe.exe
  C:\Windows\System\borXPRe.exe
  2⤵
  PID:13960
- C:\Windows\System\xxTUaXJ.exe
  C:\Windows\System\xxTUaXJ.exe
  2⤵
  PID:13996
- C:\Windows\System\jkwfUEi.exe
  C:\Windows\System\jkwfUEi.exe
  2⤵
  PID:14056
- C:\Windows\System\lkvzmmm.exe
  C:\Windows\System\lkvzmmm.exe
  2⤵
  PID:14160
- C:\Windows\System\GeEXwCI.exe
  C:\Windows\System\GeEXwCI.exe
  2⤵
  PID:14224
- C:\Windows\System\HroPCSM.exe
  C:\Windows\System\HroPCSM.exe
  2⤵
  PID:14288
- C:\Windows\System\JjgOXRI.exe
  C:\Windows\System\JjgOXRI.exe
  2⤵
  PID:13400
- C:\Windows\System\mlWkHAu.exe
  C:\Windows\System\mlWkHAu.exe
  2⤵
  PID:13548
- C:\Windows\System\sjizIsc.exe
  C:\Windows\System\sjizIsc.exe
  2⤵
  PID:14052
- C:\Windows\System\fzsYQSs.exe
  C:\Windows\System\fzsYQSs.exe
  2⤵
  PID:3328
- C:\Windows\System\VZBONxd.exe
  C:\Windows\System\VZBONxd.exe
  2⤵
  PID:14320
- C:\Windows\System\sATXaRS.exe
  C:\Windows\System\sATXaRS.exe
  2⤵
  PID:3948
- C:\Windows\System\uxgnfkN.exe
  C:\Windows\System\uxgnfkN.exe
  2⤵
  PID:13916
- C:\Windows\System\WaVaQst.exe
  C:\Windows\System\WaVaQst.exe
  2⤵
  PID:1980
- C:\Windows\System\UoErQvq.exe
  C:\Windows\System\UoErQvq.exe
  2⤵
  PID:14220
- C:\Windows\System\UqNzLQH.exe
  C:\Windows\System\UqNzLQH.exe
  2⤵
  PID:3256
- C:\Windows\System\sROzrfx.exe
  C:\Windows\System\sROzrfx.exe
  2⤵
  PID:5048
- C:\Windows\System\AbgSANi.exe
  C:\Windows\System\AbgSANi.exe
  2⤵
  PID:14192
- C:\Windows\System\nUQbePt.exe
  C:\Windows\System\nUQbePt.exe
  2⤵
  PID:4216
- C:\Windows\System\QtabZiQ.exe
  C:\Windows\System\QtabZiQ.exe
  2⤵
  PID:5000
- C:\Windows\System\RSmixKX.exe
  C:\Windows\System\RSmixKX.exe
  2⤵
  PID:1748
- C:\Windows\System\PJvlvdJ.exe
  C:\Windows\System\PJvlvdJ.exe
  2⤵
  PID:14020
- C:\Windows\System\mfIyfuh.exe
  C:\Windows\System\mfIyfuh.exe
  2⤵
  PID:13672
- C:\Windows\System\AmOmohu.exe
  C:\Windows\System\AmOmohu.exe
  2⤵
  PID:13984
- C:\Windows\System\DzprPNN.exe
  C:\Windows\System\DzprPNN.exe
  2⤵
  PID:14128
- C:\Windows\System\pILDpFm.exe
  C:\Windows\System\pILDpFm.exe
  2⤵
  PID:4612
- C:\Windows\System\ocClMOD.exe
  C:\Windows\System\ocClMOD.exe
  2⤵
  PID:856
- C:\Windows\System\tqLMMnC.exe
  C:\Windows\System\tqLMMnC.exe
  2⤵
  PID:14256
- C:\Windows\System\DuttNvB.exe
  C:\Windows\System\DuttNvB.exe
  2⤵
  PID:3060
- C:\Windows\System\TODqtWw.exe
  C:\Windows\System\TODqtWw.exe
  2⤵
  PID:13956
- C:\Windows\System\ShaYTsx.exe
  C:\Windows\System\ShaYTsx.exe
  2⤵
  PID:4876
- C:\Windows\System\kORBBkM.exe
  C:\Windows\System\kORBBkM.exe
  2⤵
  PID:14352
- C:\Windows\System\QFlWGMd.exe
  C:\Windows\System\QFlWGMd.exe
  2⤵
  PID:14368
- C:\Windows\System\WwvrkmQ.exe
  C:\Windows\System\WwvrkmQ.exe
  2⤵
  PID:14384
- C:\Windows\System\jDkbDbJ.exe
  C:\Windows\System\jDkbDbJ.exe
  2⤵
  PID:14400
- C:\Windows\System\ujCjIhi.exe
  C:\Windows\System\ujCjIhi.exe
  2⤵
  PID:14416
- C:\Windows\System\PLlFdsJ.exe
  C:\Windows\System\PLlFdsJ.exe
  2⤵
  PID:14432
- C:\Windows\System\sPMLObo.exe
  C:\Windows\System\sPMLObo.exe
  2⤵
  PID:14448
- C:\Windows\System\YSifkZd.exe
  C:\Windows\System\YSifkZd.exe
  2⤵
  PID:14464
- C:\Windows\System\bTOnRsu.exe
  C:\Windows\System\bTOnRsu.exe
  2⤵
  PID:14480
- C:\Windows\System\QuXtqJX.exe
  C:\Windows\System\QuXtqJX.exe
  2⤵
  PID:14496
- C:\Windows\System\vAjklHp.exe
  C:\Windows\System\vAjklHp.exe
  2⤵
  PID:14516
- C:\Windows\System\cKughBE.exe
  C:\Windows\System\cKughBE.exe
  2⤵
  PID:14532
- C:\Windows\System\dUXsrys.exe
  C:\Windows\System\dUXsrys.exe
  2⤵
  PID:14548
- C:\Windows\System\isrYYiX.exe
  C:\Windows\System\isrYYiX.exe
  2⤵
  PID:14564
- C:\Windows\System\bSotnDh.exe
  C:\Windows\System\bSotnDh.exe
  2⤵
  PID:14580
- C:\Windows\System\FWgLaed.exe
  C:\Windows\System\FWgLaed.exe
  2⤵
  PID:14596
- C:\Windows\System\yABSZoZ.exe
  C:\Windows\System\yABSZoZ.exe
  2⤵
  PID:14632
- C:\Windows\System\ZzvfvFQ.exe
  C:\Windows\System\ZzvfvFQ.exe
  2⤵
  PID:14656
- C:\Windows\System\udvCFlR.exe
  C:\Windows\System\udvCFlR.exe
  2⤵
  PID:14672
- C:\Windows\System\TiTUtAo.exe
  C:\Windows\System\TiTUtAo.exe
  2⤵
  PID:14688
- C:\Windows\System\umrZbkE.exe
  C:\Windows\System\umrZbkE.exe
  2⤵
  PID:14708
- C:\Windows\System\AlAuCMv.exe
  C:\Windows\System\AlAuCMv.exe
  2⤵
  PID:14732
- C:\Windows\System\ihjwXPP.exe
  C:\Windows\System\ihjwXPP.exe
  2⤵
  PID:14852
- C:\Windows\System\JWSvONy.exe
  C:\Windows\System\JWSvONy.exe
  2⤵
  PID:14868
- C:\Windows\System\QMcWOZX.exe
  C:\Windows\System\QMcWOZX.exe
  2⤵
  PID:14884
- C:\Windows\System\FxWKTzo.exe
  C:\Windows\System\FxWKTzo.exe
  2⤵
  PID:14900
- C:\Windows\System\NeaPWnc.exe
  C:\Windows\System\NeaPWnc.exe
  2⤵
  PID:14920
- C:\Windows\System\dPFQCbs.exe
  C:\Windows\System\dPFQCbs.exe
  2⤵
  PID:14984
- C:\Windows\System\ucXQWEb.exe
  C:\Windows\System\ucXQWEb.exe
  2⤵
  PID:15012
- C:\Windows\System\bXxQVCC.exe
  C:\Windows\System\bXxQVCC.exe
  2⤵
  PID:15028
- C:\Windows\System\UGPQTKt.exe
  C:\Windows\System\UGPQTKt.exe
  2⤵
  PID:15044
- C:\Windows\System\RhXHcvs.exe
  C:\Windows\System\RhXHcvs.exe
  2⤵
  PID:15104
- C:\Windows\System\gAzRGrx.exe
  C:\Windows\System\gAzRGrx.exe
  2⤵
  PID:15120
- C:\Windows\System\UtBJJKT.exe
  C:\Windows\System\UtBJJKT.exe
  2⤵
  PID:15136
- C:\Windows\System\mVkByxN.exe
  C:\Windows\System\mVkByxN.exe
  2⤵
  PID:15152
- C:\Windows\System\RIfCAqo.exe
  C:\Windows\System\RIfCAqo.exe
  2⤵
  PID:15168
- C:\Windows\System\kiaxeRq.exe
  C:\Windows\System\kiaxeRq.exe
  2⤵
  PID:15188
- C:\Windows\System\JVkBnoP.exe
  C:\Windows\System\JVkBnoP.exe
  2⤵
  PID:15216
- C:\Windows\System\fLcXkWZ.exe
  C:\Windows\System\fLcXkWZ.exe
  2⤵
  PID:15236
- C:\Windows\System\aHOvpNE.exe
  C:\Windows\System\aHOvpNE.exe
  2⤵
  PID:15252
- C:\Windows\System\VySTUMZ.exe
  C:\Windows\System\VySTUMZ.exe
  2⤵
  PID:15272
- C:\Windows\System\UhpDiID.exe
  C:\Windows\System\UhpDiID.exe
  2⤵
  PID:15288
- C:\Windows\System\ChXzvjk.exe
  C:\Windows\System\ChXzvjk.exe
  2⤵
  PID:15304
- C:\Windows\System\AMAHWXc.exe
  C:\Windows\System\AMAHWXc.exe
  2⤵
  PID:15320
- C:\Windows\System\BaXxzgK.exe
  C:\Windows\System\BaXxzgK.exe
  2⤵
  PID:15336
- C:\Windows\System\vnpzYSb.exe
  C:\Windows\System\vnpzYSb.exe
  2⤵
  PID:14392
- C:\Windows\System\ZNWWLku.exe
  C:\Windows\System\ZNWWLku.exe
  2⤵
  PID:14424
- C:\Windows\System\TFpmitx.exe
  C:\Windows\System\TFpmitx.exe
  2⤵
  PID:2848
- C:\Windows\System\URVnUaE.exe
  C:\Windows\System\URVnUaE.exe
  2⤵
  PID:14488
- C:\Windows\System\vkpHMpN.exe
  C:\Windows\System\vkpHMpN.exe
  2⤵
  PID:14524
- C:\Windows\System\VDgXZCj.exe
  C:\Windows\System\VDgXZCj.exe
  2⤵
  PID:14560
- C:\Windows\System\ixgWuVK.exe
  C:\Windows\System\ixgWuVK.exe
  2⤵
  PID:14628
- C:\Windows\System\nRwptXI.exe
  C:\Windows\System\nRwptXI.exe
  2⤵
  PID:14720
- C:\Windows\System\ZiVilXj.exe
  C:\Windows\System\ZiVilXj.exe
  2⤵
  PID:14764
- C:\Windows\System\udypqFv.exe
  C:\Windows\System\udypqFv.exe
  2⤵
  PID:14788
- C:\Windows\System\BufGUfs.exe
  C:\Windows\System\BufGUfs.exe
  2⤵
  PID:14824
- C:\Windows\System\HzBZTRy.exe
  C:\Windows\System\HzBZTRy.exe
  2⤵
  PID:14792
- C:\Windows\System\XWMkXwT.exe
  C:\Windows\System\XWMkXwT.exe
  2⤵
  PID:14728
- C:\Windows\System\IgErrao.exe
  C:\Windows\System\IgErrao.exe
  2⤵
  PID:14752
- C:\Windows\System\jzCQUzb.exe
  C:\Windows\System\jzCQUzb.exe
  2⤵
  PID:14952
- C:\Windows\System\IJsSUZo.exe
  C:\Windows\System\IJsSUZo.exe
  2⤵
  PID:14956
- C:\Windows\System\xNOtkYl.exe
  C:\Windows\System\xNOtkYl.exe
  2⤵
  PID:14908
- C:\Windows\System\dCpLQCk.exe
  C:\Windows\System\dCpLQCk.exe
  2⤵
  PID:15344
- C:\Windows\System\xCdBfyU.exe
  C:\Windows\System\xCdBfyU.exe
  2⤵
  PID:14860
- C:\Windows\System\VyFOxtF.exe
  C:\Windows\System\VyFOxtF.exe
  2⤵
  PID:14972
- C:\Windows\System\YtBhjlt.exe
  C:\Windows\System\YtBhjlt.exe
  2⤵
  PID:14916
- C:\Windows\System\kFaMNmk.exe
  C:\Windows\System\kFaMNmk.exe
  2⤵
  PID:4540
- C:\Windows\System\CfUnlzW.exe
  C:\Windows\System\CfUnlzW.exe
  2⤵
  PID:15088
- C:\Windows\System\UhHLMNX.exe
  C:\Windows\System\UhHLMNX.exe
  2⤵
  PID:15100
- C:\Windows\System\HKKjhDg.exe
  C:\Windows\System\HKKjhDg.exe
  2⤵
  PID:15132
- C:\Windows\System\EgHqzxE.exe
  C:\Windows\System\EgHqzxE.exe
  2⤵
  PID:15164
- C:\Windows\System\hWkpLwL.exe
  C:\Windows\System\hWkpLwL.exe
  2⤵
  PID:15212
- C:\Windows\System\ubLKNKd.exe
  C:\Windows\System\ubLKNKd.exe
  2⤵
  PID:15248
- C:\Windows\System\eDWbyWM.exe
  C:\Windows\System\eDWbyWM.exe
  2⤵
  PID:15284
- C:\Windows\System\oupLYTh.exe
  C:\Windows\System\oupLYTh.exe
  2⤵
  PID:15316
- C:\Windows\System\EJrfLTZ.exe
  C:\Windows\System\EJrfLTZ.exe
  2⤵
  PID:14380
- C:\Windows\System\lxYwWuS.exe
  C:\Windows\System\lxYwWuS.exe
  2⤵
  PID:14460
- C:\Windows\System\czUwIPT.exe
  C:\Windows\System\czUwIPT.exe
  2⤵
  PID:14512
- C:\Windows\System\qJbvUwh.exe
  C:\Windows\System\qJbvUwh.exe
  2⤵
  PID:14604
- C:\Windows\System\fztuJyu.exe
  C:\Windows\System\fztuJyu.exe
  2⤵
  PID:14756
- C:\Windows\System\VBjUJOI.exe
  C:\Windows\System\VBjUJOI.exe
  2⤵
  PID:14820
- C:\Windows\System\fRYUcHv.exe
  C:\Windows\System\fRYUcHv.exe
  2⤵
  PID:15352
- C:\Windows\System\pKbpFjW.exe
  C:\Windows\System\pKbpFjW.exe
  2⤵
  PID:14776
- C:\Windows\System\puURTJN.exe
  C:\Windows\System\puURTJN.exe
  2⤵
  PID:14376
- C:\Windows\System\NBhwDPF.exe
  C:\Windows\System\NBhwDPF.exe
  2⤵
  PID:14960
- C:\Windows\System\QFnruyF.exe
  C:\Windows\System\QFnruyF.exe
  2⤵
  PID:15040
- C:\Windows\System\NxXoaAP.exe
  C:\Windows\System\NxXoaAP.exe
  2⤵
  PID:15056
- C:\Windows\System\uRLCgrS.exe
  C:\Windows\System\uRLCgrS.exe
  2⤵
  PID:15128
- C:\Windows\System\BJVoPzx.exe
  C:\Windows\System\BJVoPzx.exe
  2⤵
  PID:15208
- C:\Windows\System\BhwXLwd.exe
  C:\Windows\System\BhwXLwd.exe
  2⤵
  PID:15280
- C:\Windows\System\ZIEWtxN.exe
  C:\Windows\System\ZIEWtxN.exe
  2⤵
  PID:14348
- C:\Windows\System\jmMLNTi.exe
  C:\Windows\System\jmMLNTi.exe
  2⤵
  PID:14504
- C:\Windows\System\lECXeqw.exe
  C:\Windows\System\lECXeqw.exe
  2⤵
  PID:14748
- C:\Windows\System\AbkBXzV.exe
  C:\Windows\System\AbkBXzV.exe
  2⤵
  PID:14780
- C:\Windows\System\qOrelwa.exe
  C:\Windows\System\qOrelwa.exe
  2⤵
  PID:14964
- C:\Windows\System\aYtIeuJ.exe
  C:\Windows\System\aYtIeuJ.exe
  2⤵
  PID:14540
- C:\Windows\System\SASseux.exe
  C:\Windows\System\SASseux.exe
  2⤵
  PID:12508
- C:\Windows\System\oiFgdMp.exe
  C:\Windows\System\oiFgdMp.exe
  2⤵
  PID:13056
- C:\Windows\System\fPbeEzF.exe
  C:\Windows\System\fPbeEzF.exe
  2⤵
  PID:15096
- C:\Windows\System\ERExZdF.exe
  C:\Windows\System\ERExZdF.exe
  2⤵
  PID:15160
- C:\Windows\System\pMGBqjR.exe
  C:\Windows\System\pMGBqjR.exe
  2⤵
  PID:12536
- C:\Windows\System\EXnrkUB.exe
  C:\Windows\System\EXnrkUB.exe
  2⤵
  PID:7300
- C:\Windows\System\vNOrzLB.exe
  C:\Windows\System\vNOrzLB.exe
  2⤵
  PID:10308
- C:\Windows\System\BMLSloV.exe
  C:\Windows\System\BMLSloV.exe
  2⤵
  PID:10284
- C:\Windows\System\PNlbLlx.exe
  C:\Windows\System\PNlbLlx.exe
  2⤵
  PID:4740
- C:\Windows\System\XuSSZyB.exe
  C:\Windows\System\XuSSZyB.exe
  2⤵
  PID:7312
- C:\Windows\System\FbvSjOp.exe
  C:\Windows\System\FbvSjOp.exe
  2⤵
  PID:15268
- C:\Windows\System\OEWpYJI.exe
  C:\Windows\System\OEWpYJI.exe
  2⤵
  PID:15020
- C:\Windows\System\zVJGQwb.exe
  C:\Windows\System\zVJGQwb.exe
  2⤵
  PID:9176
- C:\Windows\System\PSNHfXb.exe
  C:\Windows\System\PSNHfXb.exe
  2⤵
  PID:13276
- C:\Windows\System\hmPOmqb.exe
  C:\Windows\System\hmPOmqb.exe
  2⤵
  PID:2700
- C:\Windows\System\yiopedJ.exe
  C:\Windows\System\yiopedJ.exe
  2⤵
  PID:12676
- C:\Windows\System\ZhTXQSo.exe
  C:\Windows\System\ZhTXQSo.exe
  2⤵
  PID:9204
- C:\Windows\System\QvUpMSe.exe
  C:\Windows\System\QvUpMSe.exe
  2⤵
  PID:9208
- C:\Windows\System\FqVfxYF.exe
  C:\Windows\System\FqVfxYF.exe
  2⤵
  PID:3132
- C:\Windows\System\BQcqAzn.exe
  C:\Windows\System\BQcqAzn.exe
  2⤵
  PID:4824
- C:\Windows\System\WApQMtA.exe
  C:\Windows\System\WApQMtA.exe
  2⤵
  PID:7448
- C:\Windows\System\mxAkReg.exe
  C:\Windows\System\mxAkReg.exe
  2⤵
  PID:15312
- C:\Windows\System\LgzWcOO.exe
  C:\Windows\System\LgzWcOO.exe
  2⤵
  PID:7488
- C:\Windows\System\QejhLiU.exe
  C:\Windows\System\QejhLiU.exe
  2⤵
  PID:7512
- C:\Windows\System\yhhQRjk.exe
  C:\Windows\System\yhhQRjk.exe
  2⤵
  PID:7528
- C:\Windows\System\wEBtxgL.exe
  C:\Windows\System\wEBtxgL.exe
  2⤵
  PID:9456
- C:\Windows\System\hpcMuNl.exe
  C:\Windows\System\hpcMuNl.exe
  2⤵
  PID:8756
- C:\Windows\System\ZkSPubX.exe
  C:\Windows\System\ZkSPubX.exe
  2⤵
  PID:7544
- C:\Windows\System\DkhUjhD.exe
  C:\Windows\System\DkhUjhD.exe
  2⤵
  PID:7568
- C:\Windows\System\NZdRnIU.exe
  C:\Windows\System\NZdRnIU.exe
  2⤵
  PID:9284
- C:\Windows\System\sGWVSqB.exe
  C:\Windows\System\sGWVSqB.exe
  2⤵
  PID:7344
- C:\Windows\System\bvVVCTV.exe
  C:\Windows\System\bvVVCTV.exe
  2⤵
  PID:7352
- C:\Windows\System\gFOmeey.exe
  C:\Windows\System\gFOmeey.exe
  2⤵
  PID:9300
- C:\Windows\System\XIfClrQ.exe
  C:\Windows\System\XIfClrQ.exe
  2⤵
  PID:7648
- C:\Windows\System\aezNFMz.exe
  C:\Windows\System\aezNFMz.exe
  2⤵
  PID:7680
- C:\Windows\System\knkAWyx.exe
  C:\Windows\System\knkAWyx.exe
  2⤵
  PID:7436
- C:\Windows\System\SOvRZIL.exe
  C:\Windows\System\SOvRZIL.exe
  2⤵
  PID:7768
- C:\Windows\System\ZCJlVWz.exe
  C:\Windows\System\ZCJlVWz.exe
  2⤵
  PID:10488
- C:\Windows\System\ivhZDWR.exe
  C:\Windows\System\ivhZDWR.exe
  2⤵
  PID:7724
- C:\Windows\System\ytNJSAA.exe
  C:\Windows\System\ytNJSAA.exe
  2⤵
  PID:10468
- C:\Windows\System\fIIAfJZ.exe
  C:\Windows\System\fIIAfJZ.exe
  2⤵
  PID:10460
- C:\Windows\System\HZWaCkM.exe
  C:\Windows\System\HZWaCkM.exe
  2⤵
  PID:7804
- C:\Windows\System\zbfuaTw.exe
  C:\Windows\System\zbfuaTw.exe
  2⤵
  PID:10492
- C:\Windows\System\FVChAfG.exe
  C:\Windows\System\FVChAfG.exe
  2⤵
  PID:10500
- C:\Windows\System\yCWXdxU.exe
  C:\Windows\System\yCWXdxU.exe
  2⤵
  PID:9224
- C:\Windows\System\mKYydOW.exe
  C:\Windows\System\mKYydOW.exe
  2⤵
  PID:7868
- C:\Windows\System\qHvxCBP.exe
  C:\Windows\System\qHvxCBP.exe
  2⤵
  PID:10520
- C:\Windows\System\ielCGvM.exe
  C:\Windows\System\ielCGvM.exe
  2⤵
  PID:9276
- C:\Windows\System\hyLcMDU.exe
  C:\Windows\System\hyLcMDU.exe
  2⤵
  PID:10528
- C:\Windows\System\EaPZjDv.exe
  C:\Windows\System\EaPZjDv.exe
  2⤵
  PID:9260
- C:\Windows\System\iuawKjk.exe
  C:\Windows\System\iuawKjk.exe
  2⤵
  PID:7948
- C:\Windows\System\qYxCoPx.exe
  C:\Windows\System\qYxCoPx.exe
  2⤵
  PID:7972
- C:\Windows\System\iPGTpcS.exe
  C:\Windows\System\iPGTpcS.exe
  2⤵
  PID:7980
- C:\Windows\System\QUutNOf.exe
  C:\Windows\System\QUutNOf.exe
  2⤵
  PID:9296
- C:\Windows\System\sRUvUEx.exe
  C:\Windows\System\sRUvUEx.exe
  2⤵
  PID:8012
- C:\Windows\System\nMShVFx.exe
  C:\Windows\System\nMShVFx.exe
  2⤵
  PID:8148
- C:\Windows\System\ovacbMa.exe
  C:\Windows\System\ovacbMa.exe
  2⤵
  PID:8372
- C:\Windows\System\GUoLDTK.exe
  C:\Windows\System\GUoLDTK.exe
  2⤵
  PID:8068
- C:\Windows\System\yxGACyE.exe
  C:\Windows\System\yxGACyE.exe
  2⤵
  PID:8084
- C:\Windows\System\mTLNVrg.exe
  C:\Windows\System\mTLNVrg.exe
  2⤵
  PID:7400
- C:\Windows\System\cUGaCKP.exe
  C:\Windows\System\cUGaCKP.exe
  2⤵
  PID:8116
- C:\Windows\System\eOraEWe.exe
  C:\Windows\System\eOraEWe.exe
  2⤵
  PID:10636
- C:\Windows\System\HtQgIUX.exe
  C:\Windows\System\HtQgIUX.exe
  2⤵
  PID:10504
- C:\Windows\System\IMeMNnQ.exe
  C:\Windows\System\IMeMNnQ.exe
  2⤵
  PID:8172
- C:\Windows\System\gVhfFvq.exe
  C:\Windows\System\gVhfFvq.exe
  2⤵
  PID:10736
- C:\Windows\System\nigseUd.exe
  C:\Windows\System\nigseUd.exe
  2⤵
  PID:7480
- C:\Windows\System\SQXIXmd.exe
  C:\Windows\System\SQXIXmd.exe
  2⤵
  PID:10740
- C:\Windows\System\zmrixzm.exe
  C:\Windows\System\zmrixzm.exe
  2⤵
  PID:7204
- C:\Windows\System\oCfOOIt.exe
  C:\Windows\System\oCfOOIt.exe
  2⤵
  PID:7252
- C:\Windows\System\EwGNMjB.exe
  C:\Windows\System\EwGNMjB.exe
  2⤵
  PID:7268
- C:\Windows\System\yWxSEUA.exe
  C:\Windows\System\yWxSEUA.exe
  2⤵
  PID:10532
- C:\Windows\System\oYiDBKn.exe
  C:\Windows\System\oYiDBKn.exe
  2⤵
  PID:8360
- C:\Windows\System\bQVGgNb.exe
  C:\Windows\System\bQVGgNb.exe
  2⤵
  PID:7624
- C:\Windows\System\eZcdETs.exe
  C:\Windows\System\eZcdETs.exe
  2⤵
  PID:9332
- C:\Windows\System\PHDuofS.exe
  C:\Windows\System\PHDuofS.exe
  2⤵
  PID:8392
- C:\Windows\System\MuJzsbi.exe
  C:\Windows\System\MuJzsbi.exe
  2⤵
  PID:10988
- C:\Windows\System\Bhatbln.exe
  C:\Windows\System\Bhatbln.exe
  2⤵
  PID:7584
- C:\Windows\System\ioNkVVz.exe
  C:\Windows\System\ioNkVVz.exe
  2⤵
  PID:8424
- C:\Windows\System\mqXJBNL.exe
  C:\Windows\System\mqXJBNL.exe
  2⤵
  PID:8448
- C:\Windows\System\hZjQsrr.exe
  C:\Windows\System\hZjQsrr.exe
  2⤵
  PID:10608
- C:\Windows\System\socUkjv.exe
  C:\Windows\System\socUkjv.exe
  2⤵
  PID:8456
- C:\Windows\System\LWTUuxM.exe
  C:\Windows\System\LWTUuxM.exe
  2⤵
  PID:7924
- C:\Windows\System\abManyN.exe
  C:\Windows\System\abManyN.exe
  2⤵
  PID:8496
- C:\Windows\System\LsTFsml.exe
  C:\Windows\System\LsTFsml.exe
  2⤵
  PID:8512
- C:\Windows\System\yWQyqFb.exe
  C:\Windows\System\yWQyqFb.exe
  2⤵
  PID:10944
- C:\Windows\System\ukxsmZP.exe
  C:\Windows\System\ukxsmZP.exe
  2⤵
  PID:12680
- C:\Windows\System\MjpOszl.exe
  C:\Windows\System\MjpOszl.exe
  2⤵
  PID:12284
- C:\Windows\System\CTOjbns.exe
  C:\Windows\System\CTOjbns.exe
  2⤵
  PID:8124
- C:\Windows\System\BdWQnrA.exe
  C:\Windows\System\BdWQnrA.exe
  2⤵
  PID:7860
- C:\Windows\System\SNvPkSI.exe
  C:\Windows\System\SNvPkSI.exe
  2⤵
  PID:10516
- C:\Windows\System\wzJmYhv.exe
  C:\Windows\System\wzJmYhv.exe
  2⤵
  PID:8816
- C:\Windows\System\LaXYzCn.exe
  C:\Windows\System\LaXYzCn.exe
  2⤵
  PID:8020
- C:\Windows\System\dAAPUkV.exe
  C:\Windows\System\dAAPUkV.exe
  2⤵
  PID:8648
- C:\Windows\System\cIpMtaO.exe
  C:\Windows\System\cIpMtaO.exe
  2⤵
  PID:8052
- C:\Windows\System\NBDrgFT.exe
  C:\Windows\System\NBDrgFT.exe
  2⤵
  PID:12968
- C:\Windows\System\CPhpsUK.exe
  C:\Windows\System\CPhpsUK.exe
  2⤵
  PID:8684
- C:\Windows\System\aMPvlqS.exe
  C:\Windows\System\aMPvlqS.exe
  2⤵
  PID:7672
- C:\Windows\System\UlSHpxW.exe
  C:\Windows\System\UlSHpxW.exe
  2⤵
  PID:9032
- C:\Windows\System\rWJCYCi.exe
  C:\Windows\System\rWJCYCi.exe
  2⤵
  PID:9056
- C:\Windows\System\onJYzNK.exe
  C:\Windows\System\onJYzNK.exe
  2⤵
  PID:7288
- C:\Windows\System\VzHFiVi.exe
  C:\Windows\System\VzHFiVi.exe
  2⤵
  PID:8792
- C:\Windows\System\YVOBpBW.exe
  C:\Windows\System\YVOBpBW.exe
  2⤵
  PID:9336
- C:\Windows\System\napJvyx.exe
  C:\Windows\System\napJvyx.exe
  2⤵
  PID:8800
- C:\Windows\System\lXalDWa.exe
  C:\Windows\System\lXalDWa.exe
  2⤵
  PID:11088
- C:\Windows\System\XnhDvuQ.exe
  C:\Windows\System\XnhDvuQ.exe
  2⤵
  PID:11108
- C:\Windows\System\CruhrAz.exe
  C:\Windows\System\CruhrAz.exe
  2⤵
  PID:8848
- C:\Windows\System\WsPDuxl.exe
  C:\Windows\System\WsPDuxl.exe
  2⤵
  PID:8864
- C:\Windows\System\qxGoQzO.exe
  C:\Windows\System\qxGoQzO.exe
  2⤵
  PID:10652
- C:\Windows\System\NMtEUYa.exe
  C:\Windows\System\NMtEUYa.exe
  2⤵
  PID:8904
- C:\Windows\System\KgrIWcb.exe
  C:\Windows\System\KgrIWcb.exe
  2⤵
  PID:8656
- C:\Windows\System\wvvTegz.exe
  C:\Windows\System\wvvTegz.exe
  2⤵
  PID:11192
- C:\Windows\System\SBoOquz.exe
  C:\Windows\System\SBoOquz.exe
  2⤵
  PID:8976
- C:\Windows\System\YbmYwnm.exe
  C:\Windows\System\YbmYwnm.exe
  2⤵
  PID:9016
- C:\Windows\System\NKULMjq.exe
  C:\Windows\System\NKULMjq.exe
  2⤵
  PID:8712
- C:\Windows\System\vdLlUIn.exe
  C:\Windows\System\vdLlUIn.exe
  2⤵
  PID:11260
- C:\Windows\System\hnTMREj.exe
  C:\Windows\System\hnTMREj.exe
  2⤵
  PID:676

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13248

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:12828

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:12992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ndyusht.psv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AKvTGpC.exe

Filesize
2.1MB

MD5
f91c79d3f7cc47b41090304c10924c4c

SHA1
f556f9d4addf499fc8fd13936c86f62016eabb28

SHA256
82b7ef067fe487c5da5ac5939e180b1a146312a554385d471acc705c9f4b4e42

SHA512
81cef3a2ecdd7e32643bc8c578298681f2a29ebc3a350720d858b5c09a5c1d20ba6d76655845bbfb1c3c0df9523e957521a43f751488e59131539cb8131d7bd1

Download Submit
C:\Windows\System\AbctPdA.exe

Filesize
2.1MB

MD5
d0f34ad322bb24fe8a1d42d09314601b

SHA1
6805a79e5815c923d6d46b13cbae303c4bf540c3

SHA256
20f1ecd4cb3b4b85cad2fde1aecf324680a641471659d9975bb778cead693586

SHA512
6df5a2d7d02afc8a43abaa0c555f18d0a93296d47ed16170daae73c8bc72cdd859a29b7b2960bbb6884a22ef806210f6c47144ae2ba665f7317625789f03c294

Download Submit
C:\Windows\System\CKfeQUt.exe

Filesize
2.1MB

MD5
614c81a594ac6f5508efe87f198e426f

SHA1
9f4987e40bcab792d52db13992dca310b732ccc1

SHA256
3927edc64f29d96d88304131ea23960bb0b8c0527d27b528345c959d6c70a2e2

SHA512
739af5eb872fce68d4efcef3c2c72b1d18a0aa4d3e6e2fe35c8663592218cad4f721445dc4a1d9e1a7be506d27dfc31f75bb39282138ed92e06e57276c72867e

Download Submit
C:\Windows\System\CpdJIkJ.exe

Filesize
2.2MB

MD5
953871635eb0da9960a5981d960cda4e

SHA1
d925c305cc375fb7d55778de741a20f9153d6600

SHA256
6ecc0d541c54445e4cec3dbe5dd3958037e28ec34e8408c7d54fbea45cbbcabd

SHA512
9ec527da351698e0169673e4bd1cbb2f83ba6329b88a1bdac68694796d7638e36dcb2c5a670ba18b7f684d22ff60cf72135e1625361d4b8444b13fa08694d6ce

Download Submit
C:\Windows\System\DESsphj.exe

Filesize
2.1MB

MD5
a18764f213dc1b04c6660aafb04029b0

SHA1
6c5209478114bd2ec2d647e898086e075648762b

SHA256
e597089891b5142e3cbef09be96c88d499db8f01df67e94d68e7ca1fa5c4e041

SHA512
0253113758f57d19f40e77422d71ed15037af51de7baa0a6340354438abf1f4ee13f38c316daa1f6bfa8aabab666f94e0a7270a112ead2012a8e1a04e4981780

Download Submit
C:\Windows\System\DZkrEDX.exe

Filesize
2.2MB

MD5
d1b9c5203651f49c604cf8b4d5634b08

SHA1
9315902d07edb8d15c9b0b7ee46f8ad38802df0f

SHA256
02c07b823426f49e17c087c504b87b1f05d1c767847d12867005d9fe98dc3b35

SHA512
3619cdbef55118f27322953b4ab26c48bf800f9e8d69fb4193542e587a1541eb8ee464d0853fe0b1496f282151f894aef776fba9c7f94d4312b81dddb475d3ee

Download Submit
C:\Windows\System\DmXhxXw.exe

Filesize
2.1MB

MD5
3d045dd3d27ca69b18d468f43e9135da

SHA1
21a8ad2fcbdb17bd793629f7630a8b4d7c204049

SHA256
eecd6a91dbd1914489c95202ecde6c12fceb4a3f80464fd70f536ff953cf77e8

SHA512
1a18e96b290c73a0054974fa2b8376a9ff3fcab852e9db4d4960021c79b9b553e108ca9a8d774e01fde51688d66de63633c5055d887d178d52b780b65e710bf3

Download Submit
C:\Windows\System\EicMhFz.exe

Filesize
2.1MB

MD5
22133caa5742758dc2502386edcab2e9

SHA1
81f57cc19f683639cd6055ecbbde5d049126f948

SHA256
31fffaaf2ed0fa39f70a775418f872e538b1e4b1ad28c6a16c3c8d74228ecc91

SHA512
6d7df07b4b66de6a6c4d4a61d6cfb2fc8d0aa83cef14478395090f64280dab3770cf248d2676f0432e6cdf526e530f9f87ec992fe0695d70c43a9ec98ca870d4

Download Submit
C:\Windows\System\FKMLGfK.exe

Filesize
2.1MB

MD5
fccd09c513c0983aa3550eeb94aa7c4a

SHA1
dad9901062af0d20cbeb8fd62e6933a03288f783

SHA256
ff68a0c17e517be8471d61ccf35f390615313a364fa47ab8e67b5bd8831e16f4

SHA512
64a7ad1b371af8be43a9c9c706e9e3c2a560370b4d78abdc11e93761d87a690884992907e770d93fc7527b8ca32ec75ae794923ebe90b18ebf36479905bb1576

Download Submit
C:\Windows\System\HGNNyux.exe

Filesize
2.1MB

MD5
233ddbf24f5f3150c09f80aea8e88dd2

SHA1
d13049e47faef6412f86ce022803b6d143741cfe

SHA256
ec011c8d5ab960d55e1af98f5b2bb7ea7da2811cd3e9540ed702ec6d78a9aa62

SHA512
6d0e03b5960507bb47e61b05dc732b0787ceb094ea6e5fbeb9eabd0a12a1cccbf43c5ca1f386e8de9f124ca5e2f218529be674d9cea8a775a8f70230be5e68ab

Download Submit
C:\Windows\System\HvlMuVq.exe

Filesize
2.1MB

MD5
df8c8e9041bde042a1e9d2874bc5f391

SHA1
a1e65e7bbbf5645fb560b8d78082ccaa01ec118a

SHA256
e3cdc14cd89de3ffc0e6f2a2f5553380198410c403a22f165ae118d79e567e3e

SHA512
7fa08af7f2658314bae92041e68d8f46db6e6f5b21cf21dad628573a0772d635ec6fcad9772c9ea8372b801e326f4bd45e92a5cb4e553aa70860ee92896b68e7

Download Submit
C:\Windows\System\JANQMpL.exe

Filesize
2.1MB

MD5
dc301203cfa640544379fb2ceeee8c90

SHA1
604d727b2d6fe206031112bc8322bb7ad433b5d3

SHA256
fa027d3bd80189037bb18077be85ad523ebf721184a952fc6b433ee627eaac99

SHA512
58e2a70be3a2bef8b1e20f055745f1640e41d9724ac2038817b5822b6971fb0657df44d571366dab996160e16e892c66548af2e77ab98824f0b656bfa177e9c6

Download Submit
C:\Windows\System\KRgXISg.exe

Filesize
2.2MB

MD5
fcaad79cfa8023716a39076540349d18

SHA1
8a0e395d7f386676ec6e161f7730fe4ec49abef1

SHA256
6ea2a89f076dec835df49e6d819bfe9e956059c0f9d9074221f3626013318713

SHA512
a08522535f21f2537fbd50568df9dee3d23c36ee49d22c13f8fade99c1f8d58e5b512c7db5daf118fa02d93d9ea484e48a41534ba3c6acef7538bfd15faaa698

Download Submit
C:\Windows\System\KUwtIuy.exe

Filesize
2.1MB

MD5
8213eba58bbbecc08f8c87c259787061

SHA1
f017f293953868fe8e6fa5366c6e57d03cea74a3

SHA256
249fc58b1b8b591d3add101bd791a2b31089a5ce873842b9f882c6f3fe5c1368

SHA512
09e8c02c85a500f7d373d212f90747b7930fe7f5d1ec0155e9dc2202ec73d5f571de043a617396d5ff8d90aba830a6c9df1864d501f38291c5b87baef9486fc0

Download Submit
C:\Windows\System\LyySidn.exe

Filesize
2.1MB

MD5
c97fe96a473c83572222b0ab04687317

SHA1
2f1daaa9938a93b2b62f58663af31fc99e1bd02f

SHA256
264c394922606447e023e0c4ca07cc2c4abaa0837564a071b570dc5175a7e7e5

SHA512
5963cb5f423dc25fb3556de53c11b4a45dae5aaaf9fe8c0d83e3333233805bdaa68b32bc3bcb9698d2e44dc741aa66650d766f00e451b909e087fb80848b7990

Download Submit
C:\Windows\System\MafKHqe.exe

Filesize
2.1MB

MD5
44aeed2374ab69c118375c07e2727148

SHA1
cbb9aa963e0a133a99fa27a427f484340831afd4

SHA256
4ee375c57f579291f42c8f3baec7bd7e3db86ad278fc211cae607474559b5877

SHA512
9f4d6293a8a53f5fa2f8da1928bbde516fec0da394d213fb092b8e1d11c983ff2a9ef5a51d45fff1e29cb45455e803077ce913c8dfc17865708e831ebb9215b6

Download Submit
C:\Windows\System\MzBXaso.exe

Filesize
2.1MB

MD5
62ab614387e12a34a96d9ddea1194b9a

SHA1
6eb9b5967ccc7e2c4ad47b9ceef5f192ecdbefa5

SHA256
22476fc02d3211c77669f7954b3182d413cc95dcd73c79eedcc2994cb9dfa14e

SHA512
12963143848ddc20dd93d97561ffba1ff683d0ee5d86c0526ed2c371494c523ab1a3c730b3c05b0d48dc515e026658d7fafa14e5c7526e2c8edf25df448f8494

Download Submit
C:\Windows\System\NRAoaNE.exe

Filesize
2.1MB

MD5
9fff87e589bfbdb00ab538fc75f70f27

SHA1
0e1f5a5c36fde6a1e701e1c8d7e7a7e0bec6211c

SHA256
f93e1397ccec3c33f9b4a2339c42b1f68115b12ce143bb1d5bf59b9854e5a442

SHA512
07656f9b65da44a4811f6bbe1f48d2e5c5bbc04ad4827b0a49831b9b38a9bbc1919462f6d4f84db94c57be32004f200d3c9a291697b40cf1eebf8521f81d43b9

Download Submit
C:\Windows\System\OtKKPnc.exe

Filesize
2.1MB

MD5
83107695afa87e1390dcb0a34b3682b5

SHA1
e4b00e02bad76317f5843d63c1ab29afc2cb1ba7

SHA256
0412845fc8494b88d7bdfb980c59edc65b435203bd80873464699c2f7bbae93e

SHA512
7e172544a48964fb8f7e981179ed82a85d01d15233d9f55eecffe7470774cf077968013911d83808934c0133de479eefabb3296eccdfe190a5fd9311180f107a

Download Submit
C:\Windows\System\PjEuHiO.exe

Filesize
2.1MB

MD5
a82404463b90b2154a28752a9c345178

SHA1
7b867b774ee81a3b560dee03bbe3ccb97e22b05b

SHA256
69df779d7a9b56012d630edd444b7b5c531b70624f34b0b7d8e12166938fbce4

SHA512
622953c1bb2f6dd490c84ef13600b525756d012e064472c3f81970fead28b755740a94ed204e5e51f8814685877cb5e1c72790abac1de2b130941026df959185

Download Submit
C:\Windows\System\TTFQtby.exe

Filesize
2.1MB

MD5
4bd70e075e0945bce39dc32d838de780

SHA1
150d5d81cf60a941fd5898ff43020ac0f9dcdfe8

SHA256
37721e162dbeb4b37f4c771546a69c95909c0aecbeec3188fb1e221fa948e0d8

SHA512
081575fe7c0e760ae63f0bb060ec6ccd201f469875f9aad0123e66e150fcb05e3641c34d92a95b66ff9b91d0384b91b91a6ad3e840553d9c26c3a12dd6064a5d

Download Submit
C:\Windows\System\UPYnWff.exe

Filesize
2.1MB

MD5
ee508f1f3c74a12ec982a8a621672b2b

SHA1
83506fc3e8c5f6f1186b69152c2860e0e6dd6a16

SHA256
bc93308bd6c21da849f40f371558acf695e10f9e40af559c703aded133e8bdba

SHA512
d709a3b1ae3bf673a3d08dcbaa9e9bd7eea288d834086d826cdbe3a65b9f67ed2985c5220f5278a3f5d8be1b2e4df5b378aa0126827a6259705090be365a696b

Download Submit
C:\Windows\System\VNVtFPy.exe

Filesize
2.1MB

MD5
dc6793f7e3c6c1d5ee182f90bce24ece

SHA1
c4530139b59e687f5fa0a26d26831047dc8763bb

SHA256
a2a08ae9c54fb4ce5fbf13e04420e90bd7b445e81607e005c8108f5de9537846

SHA512
aaabf3748b0df203efd2eaed9830b200e9305ef608fb2525fe0928ded4067bad3fb58156b62739fa3f5ac13ca11d9b33a93aeec9640f483b32bdf1ce5b16a6b0

Download Submit
C:\Windows\System\WRtzOOs.exe

Filesize
2.1MB

MD5
f8a4e0a85c2ae775bce6e6e8c6816df0

SHA1
4a59da9f87f25a1b4cc8b6fe748e92f61ac7c194

SHA256
0c04894f83bce748e32488d46fd8d6775f3d61713a5d3c3b1bb8a37cbaae422f

SHA512
fdd446009354f0453a4ed5b48906dcff2c0b273e3c9c0c078c93e7e436df7cc085af78fcb024b5264dcdf5509fb1c8ee9394e6515a37da6829452177313a3f19

Download Submit
C:\Windows\System\WXTGHHp.exe

Filesize
2.2MB

MD5
8fd3035cc3fe9fc8fb4b2a41fc794497

SHA1
0d41abc77f7aa5236b7ed91837f04627b73f2580

SHA256
3142121c5492d7fd3fb463c9bc8e6f1cdc343503f150bde67c0c0b0aa7feb2dd

SHA512
27e976333d823dc64746307b01719e7ba8ac7901d625546182fe117882989e8e689dafdc7356d215f025d445501f7be095471a3b79fb4af4c29a0d6f87a20e25

Download Submit
C:\Windows\System\XEnjxUf.exe

Filesize
2.1MB

MD5
2d8810baba0c72ffaef352a8e4c86ef9

SHA1
19817d86d8e986a2feb36af52f5173a5a8c7e0e4

SHA256
ed77d6085ee05958f47e071359680e06659380dd2a2f6b4788eb5739dc0e733b

SHA512
c653574ffdd6a48c9cd7ada4e9b1a2e7d9e50a0bd8925ad3c371bd1fdb99aa3646db24f48c39603959dc68dc47706be1979b2828cd9c7634ce9b6713149e281a

Download Submit
C:\Windows\System\YBXoasw.exe

Filesize
2.1MB

MD5
828b73bc5420ca74353154756bd05868

SHA1
f53f71c5a3780f919a17562672749967321eb4d7

SHA256
1975d122619ad47bd81324528ff979ac80851ea4777eeca8ad2b46a7a1b6f73a

SHA512
fbb7a1f501e27f0e0ac0827139879fdc5e2dba1ad20aa041d6df2e84159d5c7d4291ef3e2ee0d4f10f114e3bc2ad4f5db135945c938e3536c04fad2f8a2cee99

Download Submit
C:\Windows\System\ZtYKPEp.exe

Filesize
2.1MB

MD5
31eb1dd7ed8236a729b62d4f772c6206

SHA1
228b6e2427a277b5d7c67c46aa54b14c160c4a28

SHA256
a2e74b54d9816e5d9c0112a4a8959beefb048b1f762a53d497b70ec6c36721ae

SHA512
91cb03199efb7324574cdd325adcccb431410e26df3faf1b5210d7e54372786c824de35344058950c26514e6908b14a2fe4303f47ebd8aa65d7675ea96695898

Download Submit
C:\Windows\System\aSEsqGu.exe

Filesize
2.2MB

MD5
9f7e9fcaf9a4f7918edaff3311c5b817

SHA1
2a8afcb00497989a1c01b5275b36082f2582a609

SHA256
c4cae9c76421b0dd787b28124ebd5ae86ebbbfbd83591ecdf9314ac8adce68d7

SHA512
71ef404e5bdcafade1f3d6f6417279aeb0f656539f76c459559b16d0565982132625ed9022e65c1fcf2a6400f3dca9776a39f0c398d8c952e1c7d6aef36473c2

Download Submit
C:\Windows\System\aeaCjZT.exe

Filesize
2.1MB

MD5
62bd6c9c934ac66ae129a098e0e5b884

SHA1
6aff103ad9659d63c379740fb19de6489fe2803b

SHA256
f0b77089092639aa571a31abafdf8e4508b2ebb64520561576c9a21976727176

SHA512
53de9367a7126e478b5f3db6b7e574502af586c63b93e38040000f415085815af3e19c6ffaf7997b2e427dd14e3b5bd49af43dc112c79451504b9a5ccecd3c15

Download Submit
C:\Windows\System\bYqKPZK.exe

Filesize
2.1MB

MD5
0faa8cef0f4bdde38a207b04a0e3c29c

SHA1
bd4e3679ee133013609391aa22e83170864b6869

SHA256
6bb7c8ead66806134b6c2e261166f0649c3a2a360470e434f8f6ab785944f8ca

SHA512
abdd008e6a52a68e9953542390b78a4e46f287f6e2f4de9758569c0dae4422ca08b3fa5b2c04af7c4c9966320c7df1849bfd425adf3b8e05e33df14c85a0b119

Download Submit
C:\Windows\System\clKkMCx.exe

Filesize
2.1MB

MD5
ce2b790606812787b62d2e0c41f4887a

SHA1
f225c3d5746014a6564eddff51edecf2d6e4dbfc

SHA256
fa908b23e31a4bfd22faa5a96289ca1a7a42c0460c307ed4cb6d22df7d0fe076

SHA512
39a6a7045edaeeccd90df04baac25055cccc900dfb456f8ca7d50e1c5f54b90361b91528e718baf1b24702b6bf329fc0c394c0fdfa9fe7dcc5ffe871232ad8cb

Download Submit
C:\Windows\System\cvtOYMJ.exe

Filesize
2.2MB

MD5
48df476d86f61d2bca20da7485996a38

SHA1
25dce076ef19d11529d0472bee86cd60209a2779

SHA256
c1c0a105796c42a444e51f707d9703e57b2cd7145a1eb3bccc62bf8fc95f7428

SHA512
11af0dd56f930d21bb5d822390a9555bcebc27ac6b99e30041dbc0c52432bd954a56ae2d2bb45bffd21bdb9410f7d19ac4bf6b733c9d5d5ed7d691bfe49f15a5

Download Submit
C:\Windows\System\dvhTBGO.exe

Filesize
2.1MB

MD5
e96448c26ec7f3aad59ccbb64f37a42e

SHA1
5527c6b34220901229390f3bb420f31badde6be3

SHA256
20462ad0e91cc9a85f50c7ca03c96f91c9b25936a7a22c3672b690bff731c39c

SHA512
33a2ab08604c638578f2468b9858b473536e488a16cedb3e587df5c054e64e539cf7176a532f1b03d1bba14a454c760796f4d5362924bd6fdcfd94c8b5d4367d

Download Submit
C:\Windows\System\fJGBSjY.exe

Filesize
2.1MB

MD5
e5a2c1882008908b91d5bf1a3082e0fe

SHA1
0c044691b6f4200361e930af2146a732615baec6

SHA256
05e433a46d710518c1cccf02eb881cdfa3ad3fcb3c3df5862619dbc4585d33c2

SHA512
b7abf54d05a99253a8ab5e56290df3b3136c6610bad0bb8b18b4d11713d801b07b3dc30c3906e4058a9e37592723545a104b93e3d9f0896a7e219de48c68701c

Download Submit
C:\Windows\System\hMehWHC.exe

Filesize
2.1MB

MD5
2bdbc5efa7035dc7d74fbc26b921977f

SHA1
122c96a69aef5470f7b16ff20fc69e0cfeedb54d

SHA256
fbc0defe149ef3cbd7b37f170e64f09a8e2fb47a74f940e8d0ba19242dfbb439

SHA512
33d9df7ae7930a1e9b33587fd2a7314d7883c8976a79f8570c84456cc4c862bc21a48ebefdcfd78111a99763f584980b6ad3162d0f4cb3eb275613b9385834a5

Download Submit
C:\Windows\System\iWLHUqF.exe

Filesize
2.2MB

MD5
d8d4b2d3c98ca1135a5a129548a8d796

SHA1
10414ca8212e5d4c7cdcbafb1bf9912f65e230fb

SHA256
cef3fe9d9db3a0f7ef3a9f414e71f96c3b08a0a02047ef19b3abe08f369967a7

SHA512
a8889ef0449f7369412281b29512fae29b5a49197f9e3c95c254189b01b9ede47d11405aae0c35bcede8649a95312fab81dc49800e81818a5159745e71e337fc

Download Submit
C:\Windows\System\kOUUWXu.exe

Filesize
8B

MD5
2adac273ce248e8d242a4b12f749bb46

SHA1
300bd2c60c669d978305195f11eaf26c73d9e457

SHA256
5a695799bf8f73300a4f9c4a59fd25b209a2457abf1051a262d540e520557456

SHA512
011941b215532355e8e4d21af78180da68d2fe04927118ebe818ec14ec4bfb6a7a2d9aaa01fdfd0cd2c6dc84968b5f642ccf10cc92c29aa0e1d06bcf6f120232

Download Submit
C:\Windows\System\kfCSacn.exe

Filesize
2.1MB

MD5
bf88d11b5af8b24b2f0610d4098eb1e7

SHA1
eddd3c1eee759417fe13c1bd73435641662e5b6f

SHA256
77b058cc4ea8ed078276b889aff9514c33185f8da340c5f51072374d8787a19a

SHA512
8143e76760b8f5244ff4f2d10d62f56cd7b7224fe9e51ab3f27dcf02700436c3e35ff6c4a52cb9bbf90ece3a1e1b5c06c0333e1329d02c3e2e88b0d8d5b8e9ac

Download Submit
C:\Windows\System\lcTlMzj.exe

Filesize
2.1MB

MD5
b421f37cdadd3265d4967e7a65868fff

SHA1
f97e1107971d086bf9f34f5a8051931c577c63e7

SHA256
a9cd98622fec331487b284aacfd96a876a8786ec83f5efac500304958eef129c

SHA512
b9f55e7acb992233a33eb5589e0f562325352ffff510b78a7301dabd2632a20549bb7d516bdbf808586510b91efee52b7fb3e91917930b1541c6f47d30923bee

Download Submit
C:\Windows\System\mXdqjWK.exe

Filesize
2.1MB

MD5
6bcc9a29e07ea406fcaac9fb9fb388da

SHA1
d3fd735e8b6ba0ffbbaa9986b7fda153bc1670cf

SHA256
dfa5e3bd16fb7729c112400446bbb82232b4e6e98513c6dba2c5de67bda51da4

SHA512
71b2d867145919cce8877b4d595e2e8c8732b545550482eace2b3201a7906c170ba1945dfee9a9ad6f7d0705c31c1baaff498eaf5f35561056f42427605b71d6

Download Submit
C:\Windows\System\mhozMFE.exe

Filesize
2.1MB

MD5
d456a6cdcbd1e5c8e631831ffdaa259b

SHA1
0854918b7681dca6823a5846dcede56d0ed0333b

SHA256
3d7fe69376132faa596df7ea0f3d8c21b201e0240e0b806ce558b8cbbaaf740f

SHA512
ca793c5fda17d16de854433ea9fdb6a540fcfbf6d3c5e517fb5420c61d26d5228e72e76b79f043afc0543cd3c33f18ec427133da11bac7861ed72d93767e8aa3

Download Submit
C:\Windows\System\nVcLIWJ.exe

Filesize
2.1MB

MD5
34bcd2a9fa259ce6c827213042bc1f27

SHA1
0278400d44336bf92d172958a75bdd665f1de17b

SHA256
06a980f93375063427ff0e01c228318903335eeac15fb602fc60da2923093d59

SHA512
5172d064efb60731270a2ef1b522ad6e4a4d7c79d558b827408bad3505ff0e7fea8bda9bc182d983cfbaaeec74327083726c0892ff152fa76f72b528cf37782d

Download Submit
C:\Windows\System\oyegIpd.exe

Filesize
2.1MB

MD5
6a3036c20615695aca3095363168418d

SHA1
5990aab99f2e0d1a38286ae44c8bc53a3936df10

SHA256
9fe4ca7ceaf977617deb9f396431135b8e107f8252aff4835f25b5cdb4a923d3

SHA512
d7b783476357527cf02527f8bd54bf3fbc8209fb2cde46783ee73164b1529a126204a0754460b8e00aae32b30d45b1d327c7fd4bc748d385726b9fdd26e71f80

Download Submit
C:\Windows\System\pTANtpj.exe

Filesize
2.2MB

MD5
007c7e3c782a95101ebf77f37a6202b3

SHA1
d4efe8cc9044ed5b70ae079e18316726ab6d4bb4

SHA256
d4121f6d7979dbde6b222d983b56ebf0e5ad712c9e50810d344eb10970b18699

SHA512
9497fa5469e40fcf5f5d011a56c39b21262918cfd19d4c260589b874e9f9ea234aa87a616d5553354ec3146ffa1055becfb7d12083db74d7b58d57fc4e4f4a29

Download Submit
C:\Windows\System\sUNQxTH.exe

Filesize
2.1MB

MD5
470554d931ed9364ff0d06463c2476b7

SHA1
64a3cad0f4477f2ba00acfdff77585ef4007ebd5

SHA256
993b316280a30ff911d8e65085969e07be05591e72438b629179be1d7f6a4ad0

SHA512
ec46f81ad011f03c501b0926fd6abe88d8507bc765b30b32b010c98dcdec2b6cc87e78515f906de1ca7fb21bff84634846b9adb4089983557c3caafe9501f13e

Download Submit
C:\Windows\System\sahVtAo.exe

Filesize
2.1MB

MD5
338e5673c09e6a7f6c2dafad945d646d

SHA1
dcec05529d43e6c90f32e7a49a42caf324a58186

SHA256
f15e635270ae27af10c93353ca0cc4f03a14b1ab3bbfbbc91e5cf14ed41e48c6

SHA512
2e284f3a69efcc6971f4349ade2e4d11fe4e3e1b5d0fcf4cad043d7b15d48bc20b38fea1c6f2570e3ccb5ae2db4ffa52744b808ebd7618e79d96cdb48870e75a

Download Submit
C:\Windows\System\uVHIOib.exe

Filesize
2.1MB

MD5
e9ae307f897671784bf83df53b83c3b9

SHA1
36064836200cca139fc449b64aee31ea98e965cc

SHA256
eec7be0a0b18e6d78a58a1d05ca64b8cbedaee514e7541ead31bebccf4773c87

SHA512
78329924241d270a17e43eb5ab1fab84474064c71062e36ce4d4176b3aa69f589e79daebead88426f4761b14eff6e778465baab73aeee0060b411ee10f6e823b

Download Submit
C:\Windows\System\vzWegzQ.exe

Filesize
2.1MB

MD5
5d7c0dfece40513ff004d03861fd19b1

SHA1
fe1e78d646868ca93b7bfeb4c7a733296d4431d9

SHA256
d956be934cf7c8bb8ee77bfccf0ce61c35f11929ac82afb00cd91e264edf6640

SHA512
31c5c27747c6e760ef1320f49f157380de45f528df533841186bce7396317cd6cb56ab0193837c16047160740c22aaf59ef7573a3ba909d5439a70d2db688c11

Download Submit
C:\Windows\System\wlREOtj.exe

Filesize
2.1MB

MD5
bad32182899931e1a63ec944d0510b12

SHA1
b2ffbcf8bb34397d2fc650bd98665885ab7dfb7e

SHA256
4a20fd4a52ad1b35be2c850f7542b5a3c49b6801252d6b0cfc1ebe30de66d322

SHA512
6cd5d414e419bf634378b2d6675f869bde667d1b5d12a8b4c0380980f10c7c653e91d9ab16780441b8c3c8f6e7d7883b8b52719fbf9393187c269e83278aa4b7

Download Submit
C:\Windows\System\yZeqDwC.exe

Filesize
2.1MB

MD5
50b84388814e0eb2d1ebfb42f6085149

SHA1
264047322e23a09a9bf788de6bb008f18938cdbc

SHA256
4e96331684634aef73cbe9a120aefb73c2690857f36336e327d8bb12808b8573

SHA512
1f33f63e224d10209e49a9c16900718c90245935fe7112600e80d86b38abeacd1be198adae1a8f3d2fa3a885d94a4c0009cd8dffa70e6c10fb23ead9dafc1175

Download Submit
C:\Windows\System\ykhSBga.exe

Filesize
2.2MB

MD5
2fefa408bc8db1266d6678d8b88d0890

SHA1
6f3342043bb580d256596a9c39a5d75d7eab357f

SHA256
28e7e402647d8d3965dc20405990b06607f174ecf7d878dc84686ca513c00ecc

SHA512
b971e1729eed2cf21df870582f68b5acf00062c19e9297be9f0978e6eafa4694285b1841fe8b257e558a915150c2c0929603c44efdbf3bfd586c0b643e72cfbd

Download Submit
C:\Windows\System\yyppdGF.exe

Filesize
2.1MB

MD5
c979c27bfc28d134da36aa6bb1608478

SHA1
76f5b8a79be41c2e9b1ed5fbdb3c3a03895859be

SHA256
a2e62a0737fd246635247aa39b721ba918230b24bb19e692266eddf2c73af273

SHA512
32f338b2df04b2447be53cb8170bccd23de0a2dfa10a9a70dd7fd231c8a0d2d5fe584498e7dd49f430c23c4e0d44e1dc6049ae6daab0052d127a24dcae91021d

Download Submit
memory/316-80-0x00007FF694070000-0x00007FF694462000-memory.dmp

Filesize
3.9MB

Download
memory/316-4353-0x00007FF694070000-0x00007FF694462000-memory.dmp

Filesize
3.9MB

Download
memory/808-118-0x00007FF76A950000-0x00007FF76AD42000-memory.dmp

Filesize
3.9MB

Download
memory/808-4275-0x00007FF76A950000-0x00007FF76AD42000-memory.dmp

Filesize
3.9MB

Download
memory/808-6645-0x00007FF76A950000-0x00007FF76AD42000-memory.dmp

Filesize
3.9MB

Download
memory/1156-0-0x00007FF7A8A20000-0x00007FF7A8E12000-memory.dmp

Filesize
3.9MB

Download
memory/1156-1-0x000001D93EEE0000-0x000001D93EEF0000-memory.dmp

Filesize
64KB

Download
memory/1360-4350-0x00007FF79ED70000-0x00007FF79F162000-memory.dmp

Filesize
3.9MB

Download
memory/1360-73-0x00007FF79ED70000-0x00007FF79F162000-memory.dmp

Filesize
3.9MB

Download
memory/1376-6433-0x00007FF6FF570000-0x00007FF6FF962000-memory.dmp

Filesize
3.9MB

Download
memory/1376-4966-0x00007FF6FF570000-0x00007FF6FF962000-memory.dmp

Filesize
3.9MB

Download
memory/1376-142-0x00007FF6FF570000-0x00007FF6FF962000-memory.dmp

Filesize
3.9MB

Download
memory/1400-4363-0x00007FF7618D0000-0x00007FF761CC2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-94-0x00007FF7618D0000-0x00007FF761CC2000-memory.dmp

Filesize
3.9MB

Download
memory/1468-4328-0x00007FF7766C0000-0x00007FF776AB2000-memory.dmp

Filesize
3.9MB

Download
memory/1468-72-0x00007FF7766C0000-0x00007FF776AB2000-memory.dmp

Filesize
3.9MB

Download
memory/1504-114-0x00007FF7E0130000-0x00007FF7E0522000-memory.dmp

Filesize
3.9MB

Download
memory/1504-4268-0x00007FF7E0130000-0x00007FF7E0522000-memory.dmp

Filesize
3.9MB

Download
memory/1956-4266-0x00007FF611F20000-0x00007FF612312000-memory.dmp

Filesize
3.9MB

Download
memory/1956-6634-0x00007FF611F20000-0x00007FF612312000-memory.dmp

Filesize
3.9MB

Download
memory/1956-110-0x00007FF611F20000-0x00007FF612312000-memory.dmp

Filesize
3.9MB

Download
memory/2216-138-0x00007FF66F5A0000-0x00007FF66F992000-memory.dmp

Filesize
3.9MB

Download
memory/2216-6631-0x00007FF66F5A0000-0x00007FF66F992000-memory.dmp

Filesize
3.9MB

Download
memory/2216-4964-0x00007FF66F5A0000-0x00007FF66F992000-memory.dmp

Filesize
3.9MB

Download
memory/2860-6917-0x00007FF608ED0000-0x00007FF6092C2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-130-0x00007FF608ED0000-0x00007FF6092C2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-4960-0x00007FF608ED0000-0x00007FF6092C2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-4264-0x00007FF6751F0000-0x00007FF6755E2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-106-0x00007FF6751F0000-0x00007FF6755E2000-memory.dmp

Filesize
3.9MB

Download
memory/3140-52-0x0000023C71F30000-0x0000023C71F52000-memory.dmp

Filesize
136KB

Download
memory/3140-40-0x00007FFEDAF60000-0x00007FFEDBA21000-memory.dmp

Filesize
10.8MB

Download
memory/3140-54-0x0000023C71FA0000-0x0000023C71FB0000-memory.dmp

Filesize
64KB

Download
memory/3140-53-0x0000023C71FA0000-0x0000023C71FB0000-memory.dmp

Filesize
64KB

Download
memory/3216-90-0x00007FF60B290000-0x00007FF60B682000-memory.dmp

Filesize
3.9MB

Download
memory/3216-4370-0x00007FF60B290000-0x00007FF60B682000-memory.dmp

Filesize
3.9MB

Download
memory/3552-68-0x00007FF7A6EF0000-0x00007FF7A72E2000-memory.dmp

Filesize
3.9MB

Download
memory/3552-4335-0x00007FF7A6EF0000-0x00007FF7A72E2000-memory.dmp

Filesize
3.9MB

Download
memory/3960-4963-0x00007FF73BA90000-0x00007FF73BE82000-memory.dmp

Filesize
3.9MB

Download
memory/3960-134-0x00007FF73BA90000-0x00007FF73BE82000-memory.dmp

Filesize
3.9MB

Download
memory/3960-6407-0x00007FF73BA90000-0x00007FF73BE82000-memory.dmp

Filesize
3.9MB

Download
memory/4080-4344-0x00007FF6B3A60000-0x00007FF6B3E52000-memory.dmp

Filesize
3.9MB

Download
memory/4080-79-0x00007FF6B3A60000-0x00007FF6B3E52000-memory.dmp

Filesize
3.9MB

Download
memory/4200-4368-0x00007FF77AB40000-0x00007FF77AF32000-memory.dmp

Filesize
3.9MB

Download
memory/4200-86-0x00007FF77AB40000-0x00007FF77AF32000-memory.dmp

Filesize
3.9MB

Download
memory/4228-98-0x00007FF70BEE0000-0x00007FF70C2D2000-memory.dmp

Filesize
3.9MB

Download
memory/4228-4340-0x00007FF70BEE0000-0x00007FF70C2D2000-memory.dmp

Filesize
3.9MB

Download
memory/4580-6436-0x00007FF7FB490000-0x00007FF7FB882000-memory.dmp

Filesize
3.9MB

Download
memory/4580-126-0x00007FF7FB490000-0x00007FF7FB882000-memory.dmp

Filesize
3.9MB

Download
memory/4624-85-0x00007FF7078B0000-0x00007FF707CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4624-4348-0x00007FF7078B0000-0x00007FF707CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4772-6679-0x00007FF6363E0000-0x00007FF6367D2000-memory.dmp

Filesize
3.9MB

Download
memory/4772-122-0x00007FF6363E0000-0x00007FF6367D2000-memory.dmp

Filesize
3.9MB

Download
memory/4812-4359-0x00007FF730B50000-0x00007FF730F42000-memory.dmp

Filesize
3.9MB

Download
memory/4812-102-0x00007FF730B50000-0x00007FF730F42000-memory.dmp

Filesize
3.9MB

Download