xmrig | 67ed44ce8fa724500c31b2d7cdc539da29851598c9435ed5657fcf56657230b4

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
Size

1.9MB
MD5

09eb18ef1f23088b08abd153d3bcdc8e
SHA1

8d21090724e1c2070912c77fa644e7c15cacf762
SHA256

67ed44ce8fa724500c31b2d7cdc539da29851598c9435ed5657fcf56657230b4
SHA512

2a26f23033da6700a34c34f64f403b356ba6d8973713e45a66001909a6001fd4d21caac2d2320cf7f5e364ae9697759d980e3389dda5aad9d40d85b44a691de2
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1:NABo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/1528-196-0x00007FF6BE080000-0x00007FF6BE472000-memory.dmp	xmrig
behavioral2/memory/656-237-0x00007FF677780000-0x00007FF677B72000-memory.dmp	xmrig
behavioral2/memory/3796-1157-0x00007FF7B1A70000-0x00007FF7B1E62000-memory.dmp	xmrig
behavioral2/memory/1800-1153-0x00007FF679C30000-0x00007FF67A022000-memory.dmp	xmrig
behavioral2/memory/5032-981-0x00007FF787D50000-0x00007FF788142000-memory.dmp	xmrig
behavioral2/memory/4528-978-0x00007FF690B40000-0x00007FF690F32000-memory.dmp	xmrig
behavioral2/memory/540-859-0x00007FF7E2DB0000-0x00007FF7E31A2000-memory.dmp	xmrig
behavioral2/memory/2156-527-0x00007FF7DDCA0000-0x00007FF7DE092000-memory.dmp	xmrig
behavioral2/memory/3404-465-0x00007FF6B14C0000-0x00007FF6B18B2000-memory.dmp	xmrig
behavioral2/memory/1792-389-0x00007FF6B4FB0000-0x00007FF6B53A2000-memory.dmp	xmrig
behavioral2/memory/4376-386-0x00007FF73FA50000-0x00007FF73FE42000-memory.dmp	xmrig
behavioral2/memory/1540-338-0x00007FF6842A0000-0x00007FF684692000-memory.dmp	xmrig
behavioral2/memory/1972-304-0x00007FF721280000-0x00007FF721672000-memory.dmp	xmrig
behavioral2/memory/3828-297-0x00007FF661850000-0x00007FF661C42000-memory.dmp	xmrig
behavioral2/memory/5100-162-0x00007FF789E30000-0x00007FF78A222000-memory.dmp	xmrig
behavioral2/memory/3764-26-0x00007FF733480000-0x00007FF733872000-memory.dmp	xmrig
behavioral2/memory/3764-5050-0x00007FF733480000-0x00007FF733872000-memory.dmp	xmrig
behavioral2/memory/2596-5061-0x00007FF7DDA20000-0x00007FF7DDE12000-memory.dmp	xmrig
behavioral2/memory/540-5058-0x00007FF7E2DB0000-0x00007FF7E31A2000-memory.dmp	xmrig
behavioral2/memory/4528-5065-0x00007FF690B40000-0x00007FF690F32000-memory.dmp	xmrig
behavioral2/memory/2904-5069-0x00007FF66DA70000-0x00007FF66DE62000-memory.dmp	xmrig
behavioral2/memory/1800-5074-0x00007FF679C30000-0x00007FF67A022000-memory.dmp	xmrig
behavioral2/memory/5100-5083-0x00007FF789E30000-0x00007FF78A222000-memory.dmp	xmrig
behavioral2/memory/5032-5071-0x00007FF787D50000-0x00007FF788142000-memory.dmp	xmrig
behavioral2/memory/3404-5107-0x00007FF6B14C0000-0x00007FF6B18B2000-memory.dmp	xmrig
behavioral2/memory/4376-5142-0x00007FF73FA50000-0x00007FF73FE42000-memory.dmp	xmrig
behavioral2/memory/1972-5130-0x00007FF721280000-0x00007FF721672000-memory.dmp	xmrig
behavioral2/memory/1540-5122-0x00007FF6842A0000-0x00007FF684692000-memory.dmp	xmrig
behavioral2/memory/3828-5114-0x00007FF661850000-0x00007FF661C42000-memory.dmp	xmrig
behavioral2/memory/2156-5112-0x00007FF7DDCA0000-0x00007FF7DE092000-memory.dmp	xmrig
behavioral2/memory/656-5111-0x00007FF677780000-0x00007FF677B72000-memory.dmp	xmrig
behavioral2/memory/3796-5101-0x00007FF7B1A70000-0x00007FF7B1E62000-memory.dmp	xmrig
behavioral2/memory/1792-5105-0x00007FF6B4FB0000-0x00007FF6B53A2000-memory.dmp	xmrig
behavioral2/memory/4308-5096-0x00007FF7C4940000-0x00007FF7C4D32000-memory.dmp	xmrig
behavioral2/memory/2284-5092-0x00007FF6B3650000-0x00007FF6B3A42000-memory.dmp	xmrig
behavioral2/memory/1528-5085-0x00007FF6BE080000-0x00007FF6BE472000-memory.dmp	xmrig
behavioral2/memory/3148-5666-0x00007FF66B3A0000-0x00007FF66B792000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1436	MlJUOWr.exe
3764	qrVAQDs.exe
540	UjgToCG.exe
4308	WFGwfnW.exe
2596	zSkkBEo.exe
4528	RZhhZAJ.exe
2904	TjpULbq.exe
5032	BQgwqWU.exe
1800	ZDrdQND.exe
2284	ZiukMLr.exe
5100	hxSGEOd.exe
1528	tAualEA.exe
656	XuwSCDh.exe
3828	tdKIUGi.exe
1972	PhKqBVN.exe
1540	FEgPopx.exe
4376	DYpAnWB.exe
1792	qolGUBV.exe
3404	bZOBZEz.exe
2156	YirEaPi.exe
3796	WEpwpci.exe
1944	deEjfLb.exe
4320	NVdhEvA.exe
4412	oSgwzeg.exe
4312	GAKbMXU.exe
4636	gMNcvXv.exe
2184	WuTAAcT.exe
3992	lDvrdjM.exe
4284	MiCRgLu.exe
1684	DtLGruF.exe
4204	QevsTLM.exe
4572	lVNvdot.exe
4420	zRjhTqX.exe
3644	DEmwDTg.exe
2008	BxLQGbk.exe
4788	FUgDQVz.exe
1988	UwzNrzM.exe
3740	kKZlbon.exe
1820	niifvsX.exe
872	WcxCFxJ.exe
2660	XvhRIrv.exe
3328	EwIPniR.exe
2460	aKYqsib.exe
3400	jrqWJty.exe
4708	pyvyrlF.exe
3460	XLtrRFN.exe
3296	HOsqMuO.exe
2256	pDlLSPi.exe
4544	SSMzYac.exe
5040	UwFbtZH.exe
4576	lLrtbFc.exe
2372	wRzYMKq.exe
4648	JAonhPW.exe
3268	kJoXRsN.exe
4152	zVWiogI.exe
1240	DTaEnCA.exe
5092	OyReZYp.exe
3696	vLUTHre.exe
3316	nRZTeML.exe
628	sFrevez.exe
4696	aLcdHgh.exe
1764	FVhZTyF.exe
1776	ItTdfzk.exe
2004	KMtfPWl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3148-0-0x00007FF66B3A0000-0x00007FF66B792000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-8.dat	upx
behavioral2/files/0x000d000000023b5c-5.dat	upx
behavioral2/files/0x000a000000023ba7-22.dat	upx
behavioral2/files/0x000a000000023ba9-32.dat	upx
behavioral2/memory/2596-42-0x00007FF7DDA20000-0x00007FF7DDE12000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-72.dat	upx
behavioral2/files/0x0031000000023bb7-92.dat	upx
behavioral2/files/0x000a000000023bbb-192.dat	upx
behavioral2/memory/1528-196-0x00007FF6BE080000-0x00007FF6BE472000-memory.dmp	upx
behavioral2/memory/656-237-0x00007FF677780000-0x00007FF677B72000-memory.dmp	upx
behavioral2/memory/3796-1157-0x00007FF7B1A70000-0x00007FF7B1E62000-memory.dmp	upx
behavioral2/memory/1800-1153-0x00007FF679C30000-0x00007FF67A022000-memory.dmp	upx
behavioral2/memory/5032-981-0x00007FF787D50000-0x00007FF788142000-memory.dmp	upx
behavioral2/memory/4528-978-0x00007FF690B40000-0x00007FF690F32000-memory.dmp	upx
behavioral2/memory/540-859-0x00007FF7E2DB0000-0x00007FF7E31A2000-memory.dmp	upx
behavioral2/memory/2156-527-0x00007FF7DDCA0000-0x00007FF7DE092000-memory.dmp	upx
behavioral2/memory/3404-465-0x00007FF6B14C0000-0x00007FF6B18B2000-memory.dmp	upx
behavioral2/memory/1792-389-0x00007FF6B4FB0000-0x00007FF6B53A2000-memory.dmp	upx
behavioral2/memory/4376-386-0x00007FF73FA50000-0x00007FF73FE42000-memory.dmp	upx
behavioral2/memory/1540-338-0x00007FF6842A0000-0x00007FF684692000-memory.dmp	upx
behavioral2/memory/1972-304-0x00007FF721280000-0x00007FF721672000-memory.dmp	upx
behavioral2/memory/3828-297-0x00007FF661850000-0x00007FF661C42000-memory.dmp	upx
behavioral2/files/0x000a000000023bc2-187.dat	upx
behavioral2/files/0x000a000000023bcb-184.dat	upx
behavioral2/files/0x000a000000023bca-177.dat	upx
behavioral2/files/0x000a000000023bc9-176.dat	upx
behavioral2/files/0x000a000000023bc8-173.dat	upx
behavioral2/files/0x000a000000023bbf-170.dat	upx
behavioral2/files/0x000a000000023bc7-169.dat	upx
behavioral2/files/0x000a000000023bb4-167.dat	upx
behavioral2/files/0x000a000000023bb5-165.dat	upx
behavioral2/memory/5100-162-0x00007FF789E30000-0x00007FF78A222000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-157.dat	upx
behavioral2/files/0x000a000000023bc4-156.dat	upx
behavioral2/files/0x000a000000023bc3-155.dat	upx
behavioral2/files/0x000a000000023bc1-186.dat	upx
behavioral2/files/0x000a000000023bba-180.dat	upx
behavioral2/files/0x000a000000023bc0-140.dat	upx
behavioral2/files/0x0031000000023bb8-133.dat	upx
behavioral2/files/0x000a000000023bbe-130.dat	upx
behavioral2/files/0x000a000000023bc6-166.dat	upx
behavioral2/files/0x000a000000023bbd-129.dat	upx
behavioral2/files/0x000a000000023bbc-128.dat	upx
behavioral2/memory/2284-122-0x00007FF6B3650000-0x00007FF6B3A42000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-110.dat	upx
behavioral2/files/0x000a000000023bb9-109.dat	upx
behavioral2/files/0x000a000000023bb0-137.dat	upx
behavioral2/files/0x000a000000023bac-103.dat	upx
behavioral2/files/0x000a000000023baf-98.dat	upx
behavioral2/files/0x000a000000023bae-91.dat	upx
behavioral2/files/0x000a000000023bad-85.dat	upx
behavioral2/files/0x000a000000023bab-79.dat	upx
behavioral2/files/0x000a000000023bb3-76.dat	upx
behavioral2/memory/2904-65-0x00007FF66DA70000-0x00007FF66DE62000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-62.dat	upx
behavioral2/files/0x000a000000023ba8-44.dat	upx
behavioral2/memory/3764-26-0x00007FF733480000-0x00007FF733872000-memory.dmp	upx
behavioral2/memory/4308-29-0x00007FF7C4940000-0x00007FF7C4D32000-memory.dmp	upx
behavioral2/memory/1436-16-0x00007FF724870000-0x00007FF724C62000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-14.dat	upx
behavioral2/memory/3764-5050-0x00007FF733480000-0x00007FF733872000-memory.dmp	upx
behavioral2/memory/2596-5061-0x00007FF7DDA20000-0x00007FF7DDE12000-memory.dmp	upx
behavioral2/memory/540-5058-0x00007FF7E2DB0000-0x00007FF7E31A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LakDyBy.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\syNWoVm.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\VBPjRBt.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\XHYCQpC.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\qcIHcla.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\CfJJzZs.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\nIzbwXf.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\fNecLqF.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\zObJdbK.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\hNiRwcG.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\HYbYFDL.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\JHbsjwh.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\BCODESi.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\yXyJXpk.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\lSyvofh.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\xuNlkZv.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\YFRrpnl.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\sDVUvit.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\UsbWtYi.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\zDUzYLl.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\uLaZkkb.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\jlArQak.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\tEezTzZ.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\RvXPFgU.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\oFuyuwa.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\vfpuILs.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\pEGZsVU.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\dYHYqll.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\fdcgiqD.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\qoVvjdI.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\VLRDaZz.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\wpIyIRq.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\lHkIAOp.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\qGmwwZX.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\hQPUhdC.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\uWuDtUn.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\oNuoTdk.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\ruexZMI.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\DgXENfy.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\pJcBPIi.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\rhtjAXZ.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\cKpOdxT.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\WiaKUAB.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\SoNZyRG.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\OtFyAIx.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\IBBmEpD.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\KGzALBB.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\GGTaBit.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\MErHJNk.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\cBAObfI.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\WcDEepx.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\LSDYfZx.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\OqCLrSv.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\VJIPABG.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\WmJIbft.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\lYFVlrd.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\fNqQeYp.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\VJzGdSx.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\MnPIcRV.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\zkcJIQM.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\rWtJSCL.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\KXqRrgC.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\KgKHnXG.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
File created	C:\Windows\System\kgNFGTK.exe	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	Process not Found

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2424	powershell.exe
2424	powershell.exe
2424	powershell.exe
2424	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeLockMemoryPrivilege	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
15624	Process not Found
14240	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 2424	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	87
PID 3148 wrote to memory of 2424	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	87
PID 3148 wrote to memory of 1436	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	88
PID 3148 wrote to memory of 1436	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	88
PID 3148 wrote to memory of 3764	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	89
PID 3148 wrote to memory of 3764	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	89
PID 3148 wrote to memory of 540	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	90
PID 3148 wrote to memory of 540	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	90
PID 3148 wrote to memory of 4308	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	91
PID 3148 wrote to memory of 4308	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	91
PID 3148 wrote to memory of 2596	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	92
PID 3148 wrote to memory of 2596	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	92
PID 3148 wrote to memory of 4528	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	93
PID 3148 wrote to memory of 4528	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	93
PID 3148 wrote to memory of 2904	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	94
PID 3148 wrote to memory of 2904	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	94
PID 3148 wrote to memory of 5032	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	95
PID 3148 wrote to memory of 5032	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	95
PID 3148 wrote to memory of 1528	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	96
PID 3148 wrote to memory of 1528	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	96
PID 3148 wrote to memory of 1800	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	97
PID 3148 wrote to memory of 1800	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	97
PID 3148 wrote to memory of 2284	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	98
PID 3148 wrote to memory of 2284	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	98
PID 3148 wrote to memory of 5100	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	99
PID 3148 wrote to memory of 5100	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	99
PID 3148 wrote to memory of 1792	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	100
PID 3148 wrote to memory of 1792	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	100
PID 3148 wrote to memory of 656	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	101
PID 3148 wrote to memory of 656	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	101
PID 3148 wrote to memory of 3828	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	102
PID 3148 wrote to memory of 3828	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	102
PID 3148 wrote to memory of 1972	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	103
PID 3148 wrote to memory of 1972	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	103
PID 3148 wrote to memory of 1540	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	104
PID 3148 wrote to memory of 1540	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	104
PID 3148 wrote to memory of 4376	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	105
PID 3148 wrote to memory of 4376	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	105
PID 3148 wrote to memory of 3404	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	106
PID 3148 wrote to memory of 3404	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	106
PID 3148 wrote to memory of 2156	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	107
PID 3148 wrote to memory of 2156	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	107
PID 3148 wrote to memory of 3796	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	108
PID 3148 wrote to memory of 3796	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	108
PID 3148 wrote to memory of 1944	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	109
PID 3148 wrote to memory of 1944	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	109
PID 3148 wrote to memory of 4320	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	110
PID 3148 wrote to memory of 4320	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	110
PID 3148 wrote to memory of 4412	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	111
PID 3148 wrote to memory of 4412	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	111
PID 3148 wrote to memory of 4312	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	112
PID 3148 wrote to memory of 4312	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	112
PID 3148 wrote to memory of 4636	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	113
PID 3148 wrote to memory of 4636	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	113
PID 3148 wrote to memory of 2184	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	114
PID 3148 wrote to memory of 2184	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	114
PID 3148 wrote to memory of 3992	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	115
PID 3148 wrote to memory of 3992	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	115
PID 3148 wrote to memory of 4284	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	116
PID 3148 wrote to memory of 4284	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	116
PID 3148 wrote to memory of 1684	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	117
PID 3148 wrote to memory of 1684	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	117
PID 3148 wrote to memory of 4204	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	118
PID 3148 wrote to memory of 4204	3148	09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09eb18ef1f23088b08abd153d3bcdc8e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\System\MlJUOWr.exe
  C:\Windows\System\MlJUOWr.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\qrVAQDs.exe
  C:\Windows\System\qrVAQDs.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\UjgToCG.exe
  C:\Windows\System\UjgToCG.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\WFGwfnW.exe
  C:\Windows\System\WFGwfnW.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\zSkkBEo.exe
  C:\Windows\System\zSkkBEo.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\RZhhZAJ.exe
  C:\Windows\System\RZhhZAJ.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\TjpULbq.exe
  C:\Windows\System\TjpULbq.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\BQgwqWU.exe
  C:\Windows\System\BQgwqWU.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\tAualEA.exe
  C:\Windows\System\tAualEA.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\ZDrdQND.exe
  C:\Windows\System\ZDrdQND.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\ZiukMLr.exe
  C:\Windows\System\ZiukMLr.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\hxSGEOd.exe
  C:\Windows\System\hxSGEOd.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\qolGUBV.exe
  C:\Windows\System\qolGUBV.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\XuwSCDh.exe
  C:\Windows\System\XuwSCDh.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\tdKIUGi.exe
  C:\Windows\System\tdKIUGi.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\PhKqBVN.exe
  C:\Windows\System\PhKqBVN.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\FEgPopx.exe
  C:\Windows\System\FEgPopx.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\DYpAnWB.exe
  C:\Windows\System\DYpAnWB.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\bZOBZEz.exe
  C:\Windows\System\bZOBZEz.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\YirEaPi.exe
  C:\Windows\System\YirEaPi.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\WEpwpci.exe
  C:\Windows\System\WEpwpci.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\deEjfLb.exe
  C:\Windows\System\deEjfLb.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\NVdhEvA.exe
  C:\Windows\System\NVdhEvA.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\oSgwzeg.exe
  C:\Windows\System\oSgwzeg.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\GAKbMXU.exe
  C:\Windows\System\GAKbMXU.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\gMNcvXv.exe
  C:\Windows\System\gMNcvXv.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\WuTAAcT.exe
  C:\Windows\System\WuTAAcT.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\lDvrdjM.exe
  C:\Windows\System\lDvrdjM.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\MiCRgLu.exe
  C:\Windows\System\MiCRgLu.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\DtLGruF.exe
  C:\Windows\System\DtLGruF.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\QevsTLM.exe
  C:\Windows\System\QevsTLM.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\lVNvdot.exe
  C:\Windows\System\lVNvdot.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\zRjhTqX.exe
  C:\Windows\System\zRjhTqX.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\XvhRIrv.exe
  C:\Windows\System\XvhRIrv.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\DEmwDTg.exe
  C:\Windows\System\DEmwDTg.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\BxLQGbk.exe
  C:\Windows\System\BxLQGbk.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\FUgDQVz.exe
  C:\Windows\System\FUgDQVz.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\UwzNrzM.exe
  C:\Windows\System\UwzNrzM.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\kKZlbon.exe
  C:\Windows\System\kKZlbon.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\niifvsX.exe
  C:\Windows\System\niifvsX.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\WcxCFxJ.exe
  C:\Windows\System\WcxCFxJ.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\EwIPniR.exe
  C:\Windows\System\EwIPniR.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\aKYqsib.exe
  C:\Windows\System\aKYqsib.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\jrqWJty.exe
  C:\Windows\System\jrqWJty.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\pyvyrlF.exe
  C:\Windows\System\pyvyrlF.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\XLtrRFN.exe
  C:\Windows\System\XLtrRFN.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\HOsqMuO.exe
  C:\Windows\System\HOsqMuO.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\SSMzYac.exe
  C:\Windows\System\SSMzYac.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\pDlLSPi.exe
  C:\Windows\System\pDlLSPi.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\FVhZTyF.exe
  C:\Windows\System\FVhZTyF.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\UwFbtZH.exe
  C:\Windows\System\UwFbtZH.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\lLrtbFc.exe
  C:\Windows\System\lLrtbFc.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\wRzYMKq.exe
  C:\Windows\System\wRzYMKq.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\JAonhPW.exe
  C:\Windows\System\JAonhPW.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\kJoXRsN.exe
  C:\Windows\System\kJoXRsN.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\zVWiogI.exe
  C:\Windows\System\zVWiogI.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\DTaEnCA.exe
  C:\Windows\System\DTaEnCA.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\OyReZYp.exe
  C:\Windows\System\OyReZYp.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\vLUTHre.exe
  C:\Windows\System\vLUTHre.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\nRZTeML.exe
  C:\Windows\System\nRZTeML.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\sFrevez.exe
  C:\Windows\System\sFrevez.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\aLcdHgh.exe
  C:\Windows\System\aLcdHgh.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\fJbFpoI.exe
  C:\Windows\System\fJbFpoI.exe
  2⤵
  PID:2064
- C:\Windows\System\ItTdfzk.exe
  C:\Windows\System\ItTdfzk.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\KMtfPWl.exe
  C:\Windows\System\KMtfPWl.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\WiaKUAB.exe
  C:\Windows\System\WiaKUAB.exe
  2⤵
  PID:3676
- C:\Windows\System\dcWCXgl.exe
  C:\Windows\System\dcWCXgl.exe
  2⤵
  PID:2136
- C:\Windows\System\IICZQvO.exe
  C:\Windows\System\IICZQvO.exe
  2⤵
  PID:3508
- C:\Windows\System\EprKExB.exe
  C:\Windows\System\EprKExB.exe
  2⤵
  PID:5008
- C:\Windows\System\qjrabhk.exe
  C:\Windows\System\qjrabhk.exe
  2⤵
  PID:4040
- C:\Windows\System\obyptIk.exe
  C:\Windows\System\obyptIk.exe
  2⤵
  PID:4864
- C:\Windows\System\OpmkrNT.exe
  C:\Windows\System\OpmkrNT.exe
  2⤵
  PID:5104
- C:\Windows\System\JAbAMcx.exe
  C:\Windows\System\JAbAMcx.exe
  2⤵
  PID:1184
- C:\Windows\System\fJPTRoA.exe
  C:\Windows\System\fJPTRoA.exe
  2⤵
  PID:1908
- C:\Windows\System\qoWUgUN.exe
  C:\Windows\System\qoWUgUN.exe
  2⤵
  PID:1084
- C:\Windows\System\AXbcdiP.exe
  C:\Windows\System\AXbcdiP.exe
  2⤵
  PID:4352
- C:\Windows\System\zLSAjgo.exe
  C:\Windows\System\zLSAjgo.exe
  2⤵
  PID:824
- C:\Windows\System\hoCNkLC.exe
  C:\Windows\System\hoCNkLC.exe
  2⤵
  PID:4704
- C:\Windows\System\qcWWpUZ.exe
  C:\Windows\System\qcWWpUZ.exe
  2⤵
  PID:5128
- C:\Windows\System\IsIFwRK.exe
  C:\Windows\System\IsIFwRK.exe
  2⤵
  PID:5148
- C:\Windows\System\EbXPkXm.exe
  C:\Windows\System\EbXPkXm.exe
  2⤵
  PID:5164
- C:\Windows\System\bEEcSET.exe
  C:\Windows\System\bEEcSET.exe
  2⤵
  PID:5180
- C:\Windows\System\pBzMtxt.exe
  C:\Windows\System\pBzMtxt.exe
  2⤵
  PID:5196
- C:\Windows\System\BwglYiJ.exe
  C:\Windows\System\BwglYiJ.exe
  2⤵
  PID:5212
- C:\Windows\System\CmIquyT.exe
  C:\Windows\System\CmIquyT.exe
  2⤵
  PID:5228
- C:\Windows\System\zcxVIJo.exe
  C:\Windows\System\zcxVIJo.exe
  2⤵
  PID:5248
- C:\Windows\System\oCyAXht.exe
  C:\Windows\System\oCyAXht.exe
  2⤵
  PID:5264
- C:\Windows\System\ekMlqCU.exe
  C:\Windows\System\ekMlqCU.exe
  2⤵
  PID:5280
- C:\Windows\System\IpsEvIs.exe
  C:\Windows\System\IpsEvIs.exe
  2⤵
  PID:5296
- C:\Windows\System\zwkpnMS.exe
  C:\Windows\System\zwkpnMS.exe
  2⤵
  PID:5328
- C:\Windows\System\IFazrzb.exe
  C:\Windows\System\IFazrzb.exe
  2⤵
  PID:5348
- C:\Windows\System\fSlsjFh.exe
  C:\Windows\System\fSlsjFh.exe
  2⤵
  PID:5380
- C:\Windows\System\NVEtBLC.exe
  C:\Windows\System\NVEtBLC.exe
  2⤵
  PID:5404
- C:\Windows\System\YUGPenh.exe
  C:\Windows\System\YUGPenh.exe
  2⤵
  PID:5448
- C:\Windows\System\aBnbhtV.exe
  C:\Windows\System\aBnbhtV.exe
  2⤵
  PID:5472
- C:\Windows\System\VsJeZQl.exe
  C:\Windows\System\VsJeZQl.exe
  2⤵
  PID:5492
- C:\Windows\System\dGBRyeU.exe
  C:\Windows\System\dGBRyeU.exe
  2⤵
  PID:5532
- C:\Windows\System\VREReIv.exe
  C:\Windows\System\VREReIv.exe
  2⤵
  PID:5548
- C:\Windows\System\RYuNVxm.exe
  C:\Windows\System\RYuNVxm.exe
  2⤵
  PID:5584
- C:\Windows\System\bfUawyC.exe
  C:\Windows\System\bfUawyC.exe
  2⤵
  PID:5604
- C:\Windows\System\lZyNIlF.exe
  C:\Windows\System\lZyNIlF.exe
  2⤵
  PID:5628
- C:\Windows\System\FUebtgF.exe
  C:\Windows\System\FUebtgF.exe
  2⤵
  PID:5644
- C:\Windows\System\TeQkISt.exe
  C:\Windows\System\TeQkISt.exe
  2⤵
  PID:5668
- C:\Windows\System\mpCweTZ.exe
  C:\Windows\System\mpCweTZ.exe
  2⤵
  PID:5692
- C:\Windows\System\BEBzqTW.exe
  C:\Windows\System\BEBzqTW.exe
  2⤵
  PID:5720
- C:\Windows\System\uYEZVCT.exe
  C:\Windows\System\uYEZVCT.exe
  2⤵
  PID:5744
- C:\Windows\System\ktPukpa.exe
  C:\Windows\System\ktPukpa.exe
  2⤵
  PID:5764
- C:\Windows\System\RVierLc.exe
  C:\Windows\System\RVierLc.exe
  2⤵
  PID:5824
- C:\Windows\System\MERycUH.exe
  C:\Windows\System\MERycUH.exe
  2⤵
  PID:5848
- C:\Windows\System\oNeRDKi.exe
  C:\Windows\System\oNeRDKi.exe
  2⤵
  PID:5868
- C:\Windows\System\MXxZbAr.exe
  C:\Windows\System\MXxZbAr.exe
  2⤵
  PID:5884
- C:\Windows\System\GXKhIkV.exe
  C:\Windows\System\GXKhIkV.exe
  2⤵
  PID:5900
- C:\Windows\System\pEGsUAw.exe
  C:\Windows\System\pEGsUAw.exe
  2⤵
  PID:5920
- C:\Windows\System\rpvbMAG.exe
  C:\Windows\System\rpvbMAG.exe
  2⤵
  PID:5940
- C:\Windows\System\TbIwPHk.exe
  C:\Windows\System\TbIwPHk.exe
  2⤵
  PID:5960
- C:\Windows\System\LHWDXPe.exe
  C:\Windows\System\LHWDXPe.exe
  2⤵
  PID:5980
- C:\Windows\System\IZLutOI.exe
  C:\Windows\System\IZLutOI.exe
  2⤵
  PID:6004
- C:\Windows\System\IZPeYNG.exe
  C:\Windows\System\IZPeYNG.exe
  2⤵
  PID:6020
- C:\Windows\System\CLwKIrT.exe
  C:\Windows\System\CLwKIrT.exe
  2⤵
  PID:6044
- C:\Windows\System\GusBGIT.exe
  C:\Windows\System\GusBGIT.exe
  2⤵
  PID:6072
- C:\Windows\System\UgHTlVs.exe
  C:\Windows\System\UgHTlVs.exe
  2⤵
  PID:6088
- C:\Windows\System\VoQDGOV.exe
  C:\Windows\System\VoQDGOV.exe
  2⤵
  PID:6116
- C:\Windows\System\FcCqScE.exe
  C:\Windows\System\FcCqScE.exe
  2⤵
  PID:64
- C:\Windows\System\YsNisbI.exe
  C:\Windows\System\YsNisbI.exe
  2⤵
  PID:4540
- C:\Windows\System\zTYfCfO.exe
  C:\Windows\System\zTYfCfO.exe
  2⤵
  PID:980
- C:\Windows\System\dWShqCV.exe
  C:\Windows\System\dWShqCV.exe
  2⤵
  PID:4244
- C:\Windows\System\WjEGjmf.exe
  C:\Windows\System\WjEGjmf.exe
  2⤵
  PID:3744
- C:\Windows\System\XFWQstB.exe
  C:\Windows\System\XFWQstB.exe
  2⤵
  PID:3100
- C:\Windows\System\sHPTveg.exe
  C:\Windows\System\sHPTveg.exe
  2⤵
  PID:5372
- C:\Windows\System\KIjkWBs.exe
  C:\Windows\System\KIjkWBs.exe
  2⤵
  PID:2924
- C:\Windows\System\sYPRjPC.exe
  C:\Windows\System\sYPRjPC.exe
  2⤵
  PID:5480
- C:\Windows\System\TdxwUiC.exe
  C:\Windows\System\TdxwUiC.exe
  2⤵
  PID:3504
- C:\Windows\System\IzqYwLQ.exe
  C:\Windows\System\IzqYwLQ.exe
  2⤵
  PID:2192
- C:\Windows\System\RJfwTpc.exe
  C:\Windows\System\RJfwTpc.exe
  2⤵
  PID:4928
- C:\Windows\System\avMrOvD.exe
  C:\Windows\System\avMrOvD.exe
  2⤵
  PID:5616
- C:\Windows\System\TwovtkM.exe
  C:\Windows\System\TwovtkM.exe
  2⤵
  PID:5396
- C:\Windows\System\uMPDpmO.exe
  C:\Windows\System\uMPDpmO.exe
  2⤵
  PID:2376
- C:\Windows\System\MTHdPub.exe
  C:\Windows\System\MTHdPub.exe
  2⤵
  PID:4232
- C:\Windows\System\TItYgtO.exe
  C:\Windows\System\TItYgtO.exe
  2⤵
  PID:3396
- C:\Windows\System\htLcmNV.exe
  C:\Windows\System\htLcmNV.exe
  2⤵
  PID:5160
- C:\Windows\System\DoKNekK.exe
  C:\Windows\System\DoKNekK.exe
  2⤵
  PID:5204
- C:\Windows\System\VfKudRL.exe
  C:\Windows\System\VfKudRL.exe
  2⤵
  PID:6164
- C:\Windows\System\FrZeqBA.exe
  C:\Windows\System\FrZeqBA.exe
  2⤵
  PID:6184
- C:\Windows\System\gWHPFZN.exe
  C:\Windows\System\gWHPFZN.exe
  2⤵
  PID:6204
- C:\Windows\System\LDRQwDS.exe
  C:\Windows\System\LDRQwDS.exe
  2⤵
  PID:6252
- C:\Windows\System\bzQQZCr.exe
  C:\Windows\System\bzQQZCr.exe
  2⤵
  PID:6280
- C:\Windows\System\TvIjVKJ.exe
  C:\Windows\System\TvIjVKJ.exe
  2⤵
  PID:6296
- C:\Windows\System\PnYjifF.exe
  C:\Windows\System\PnYjifF.exe
  2⤵
  PID:6312
- C:\Windows\System\RIRNHQt.exe
  C:\Windows\System\RIRNHQt.exe
  2⤵
  PID:6336
- C:\Windows\System\zjAFpKW.exe
  C:\Windows\System\zjAFpKW.exe
  2⤵
  PID:6356
- C:\Windows\System\YseJUiK.exe
  C:\Windows\System\YseJUiK.exe
  2⤵
  PID:6372
- C:\Windows\System\WHdmiTe.exe
  C:\Windows\System\WHdmiTe.exe
  2⤵
  PID:6400
- C:\Windows\System\nSkyBkA.exe
  C:\Windows\System\nSkyBkA.exe
  2⤵
  PID:6424
- C:\Windows\System\pvzlVQi.exe
  C:\Windows\System\pvzlVQi.exe
  2⤵
  PID:6440
- C:\Windows\System\RDIGLGR.exe
  C:\Windows\System\RDIGLGR.exe
  2⤵
  PID:6464
- C:\Windows\System\WShyZuC.exe
  C:\Windows\System\WShyZuC.exe
  2⤵
  PID:6480
- C:\Windows\System\dDyZjEg.exe
  C:\Windows\System\dDyZjEg.exe
  2⤵
  PID:6508
- C:\Windows\System\uPbfPbl.exe
  C:\Windows\System\uPbfPbl.exe
  2⤵
  PID:6528
- C:\Windows\System\yMoRBTy.exe
  C:\Windows\System\yMoRBTy.exe
  2⤵
  PID:6548
- C:\Windows\System\fNcGvpP.exe
  C:\Windows\System\fNcGvpP.exe
  2⤵
  PID:6572
- C:\Windows\System\wssyTtY.exe
  C:\Windows\System\wssyTtY.exe
  2⤵
  PID:6592
- C:\Windows\System\abQNKGJ.exe
  C:\Windows\System\abQNKGJ.exe
  2⤵
  PID:6616
- C:\Windows\System\KLdlnAS.exe
  C:\Windows\System\KLdlnAS.exe
  2⤵
  PID:6636
- C:\Windows\System\XiciGYr.exe
  C:\Windows\System\XiciGYr.exe
  2⤵
  PID:6668
- C:\Windows\System\VUGKdRy.exe
  C:\Windows\System\VUGKdRy.exe
  2⤵
  PID:6684
- C:\Windows\System\Ipquvrf.exe
  C:\Windows\System\Ipquvrf.exe
  2⤵
  PID:6704
- C:\Windows\System\UHmutfE.exe
  C:\Windows\System\UHmutfE.exe
  2⤵
  PID:6724
- C:\Windows\System\BYmpPLB.exe
  C:\Windows\System\BYmpPLB.exe
  2⤵
  PID:6748
- C:\Windows\System\gtQBLWc.exe
  C:\Windows\System\gtQBLWc.exe
  2⤵
  PID:6764
- C:\Windows\System\HSQrzjn.exe
  C:\Windows\System\HSQrzjn.exe
  2⤵
  PID:6992
- C:\Windows\System\UOXaZFs.exe
  C:\Windows\System\UOXaZFs.exe
  2⤵
  PID:7012
- C:\Windows\System\xsARzXG.exe
  C:\Windows\System\xsARzXG.exe
  2⤵
  PID:7032
- C:\Windows\System\itruCMA.exe
  C:\Windows\System\itruCMA.exe
  2⤵
  PID:7048
- C:\Windows\System\fciYrFj.exe
  C:\Windows\System\fciYrFj.exe
  2⤵
  PID:7072
- C:\Windows\System\vJISCzM.exe
  C:\Windows\System\vJISCzM.exe
  2⤵
  PID:7092
- C:\Windows\System\ayBXtXh.exe
  C:\Windows\System\ayBXtXh.exe
  2⤵
  PID:7112
- C:\Windows\System\peoDZnv.exe
  C:\Windows\System\peoDZnv.exe
  2⤵
  PID:7140
- C:\Windows\System\krYNSjd.exe
  C:\Windows\System\krYNSjd.exe
  2⤵
  PID:7160
- C:\Windows\System\KNgVehn.exe
  C:\Windows\System\KNgVehn.exe
  2⤵
  PID:5240
- C:\Windows\System\SoDBiQo.exe
  C:\Windows\System\SoDBiQo.exe
  2⤵
  PID:5344
- C:\Windows\System\WQEFTek.exe
  C:\Windows\System\WQEFTek.exe
  2⤵
  PID:5640
- C:\Windows\System\IqrvaBx.exe
  C:\Windows\System\IqrvaBx.exe
  2⤵
  PID:5660
- C:\Windows\System\ElvdNqU.exe
  C:\Windows\System\ElvdNqU.exe
  2⤵
  PID:5428
- C:\Windows\System\ltuQkJw.exe
  C:\Windows\System\ltuQkJw.exe
  2⤵
  PID:3856
- C:\Windows\System\NCXUDWB.exe
  C:\Windows\System\NCXUDWB.exe
  2⤵
  PID:5504
- C:\Windows\System\nQPHMOe.exe
  C:\Windows\System\nQPHMOe.exe
  2⤵
  PID:5540
- C:\Windows\System\ubJlyKL.exe
  C:\Windows\System\ubJlyKL.exe
  2⤵
  PID:2092
- C:\Windows\System\hUwfxxB.exe
  C:\Windows\System\hUwfxxB.exe
  2⤵
  PID:4780
- C:\Windows\System\UpgBPEU.exe
  C:\Windows\System\UpgBPEU.exe
  2⤵
  PID:6632
- C:\Windows\System\GWNDbLN.exe
  C:\Windows\System\GWNDbLN.exe
  2⤵
  PID:3392
- C:\Windows\System\mVfcJDC.exe
  C:\Windows\System\mVfcJDC.exe
  2⤵
  PID:6744
- C:\Windows\System\dEmTesA.exe
  C:\Windows\System\dEmTesA.exe
  2⤵
  PID:5832
- C:\Windows\System\PYXBmkG.exe
  C:\Windows\System\PYXBmkG.exe
  2⤵
  PID:5860
- C:\Windows\System\hFpuobu.exe
  C:\Windows\System\hFpuobu.exe
  2⤵
  PID:5892
- C:\Windows\System\vKofoaq.exe
  C:\Windows\System\vKofoaq.exe
  2⤵
  PID:5936
- C:\Windows\System\bKlUWTO.exe
  C:\Windows\System\bKlUWTO.exe
  2⤵
  PID:5988
- C:\Windows\System\MQBJRRO.exe
  C:\Windows\System\MQBJRRO.exe
  2⤵
  PID:6028
- C:\Windows\System\UIFojgr.exe
  C:\Windows\System\UIFojgr.exe
  2⤵
  PID:6080
- C:\Windows\System\JlhXStl.exe
  C:\Windows\System\JlhXStl.exe
  2⤵
  PID:6956
- C:\Windows\System\TqbmgwY.exe
  C:\Windows\System\TqbmgwY.exe
  2⤵
  PID:7176
- C:\Windows\System\bJpBhLP.exe
  C:\Windows\System\bJpBhLP.exe
  2⤵
  PID:7208
- C:\Windows\System\dzHWKio.exe
  C:\Windows\System\dzHWKio.exe
  2⤵
  PID:7232
- C:\Windows\System\zXhMqvp.exe
  C:\Windows\System\zXhMqvp.exe
  2⤵
  PID:7260
- C:\Windows\System\vpIFKTL.exe
  C:\Windows\System\vpIFKTL.exe
  2⤵
  PID:7280
- C:\Windows\System\XImTnsq.exe
  C:\Windows\System\XImTnsq.exe
  2⤵
  PID:7296
- C:\Windows\System\WuhIFmd.exe
  C:\Windows\System\WuhIFmd.exe
  2⤵
  PID:7320
- C:\Windows\System\IDtouYz.exe
  C:\Windows\System\IDtouYz.exe
  2⤵
  PID:7348
- C:\Windows\System\zSVhKCK.exe
  C:\Windows\System\zSVhKCK.exe
  2⤵
  PID:7364
- C:\Windows\System\MXcUaRf.exe
  C:\Windows\System\MXcUaRf.exe
  2⤵
  PID:7388
- C:\Windows\System\aAnYuuw.exe
  C:\Windows\System\aAnYuuw.exe
  2⤵
  PID:7412
- C:\Windows\System\DMaVitG.exe
  C:\Windows\System\DMaVitG.exe
  2⤵
  PID:7432
- C:\Windows\System\ymCyuXl.exe
  C:\Windows\System\ymCyuXl.exe
  2⤵
  PID:7448
- C:\Windows\System\bIdrqmG.exe
  C:\Windows\System\bIdrqmG.exe
  2⤵
  PID:7472
- C:\Windows\System\PCuSIJX.exe
  C:\Windows\System\PCuSIJX.exe
  2⤵
  PID:7504
- C:\Windows\System\GqvftGY.exe
  C:\Windows\System\GqvftGY.exe
  2⤵
  PID:7532
- C:\Windows\System\SqZvMga.exe
  C:\Windows\System\SqZvMga.exe
  2⤵
  PID:7548
- C:\Windows\System\zImObHd.exe
  C:\Windows\System\zImObHd.exe
  2⤵
  PID:7568
- C:\Windows\System\qoGRPiN.exe
  C:\Windows\System\qoGRPiN.exe
  2⤵
  PID:7584
- C:\Windows\System\mMPhrud.exe
  C:\Windows\System\mMPhrud.exe
  2⤵
  PID:7612
- C:\Windows\System\ufrpFer.exe
  C:\Windows\System\ufrpFer.exe
  2⤵
  PID:7628
- C:\Windows\System\gYpwiqw.exe
  C:\Windows\System\gYpwiqw.exe
  2⤵
  PID:7648
- C:\Windows\System\tbunQmR.exe
  C:\Windows\System\tbunQmR.exe
  2⤵
  PID:7664
- C:\Windows\System\bEUsFWb.exe
  C:\Windows\System\bEUsFWb.exe
  2⤵
  PID:7680
- C:\Windows\System\hxgxmis.exe
  C:\Windows\System\hxgxmis.exe
  2⤵
  PID:7712
- C:\Windows\System\IiVdPuN.exe
  C:\Windows\System\IiVdPuN.exe
  2⤵
  PID:7732
- C:\Windows\System\zPvEzpO.exe
  C:\Windows\System\zPvEzpO.exe
  2⤵
  PID:7752
- C:\Windows\System\itkCbzp.exe
  C:\Windows\System\itkCbzp.exe
  2⤵
  PID:7776
- C:\Windows\System\fJxHShO.exe
  C:\Windows\System\fJxHShO.exe
  2⤵
  PID:7796
- C:\Windows\System\sSZzXZQ.exe
  C:\Windows\System\sSZzXZQ.exe
  2⤵
  PID:7820
- C:\Windows\System\wrVHZpo.exe
  C:\Windows\System\wrVHZpo.exe
  2⤵
  PID:7840
- C:\Windows\System\lYaBtqC.exe
  C:\Windows\System\lYaBtqC.exe
  2⤵
  PID:7864
- C:\Windows\System\yRaSpvI.exe
  C:\Windows\System\yRaSpvI.exe
  2⤵
  PID:7880
- C:\Windows\System\EOBGrtJ.exe
  C:\Windows\System\EOBGrtJ.exe
  2⤵
  PID:7900
- C:\Windows\System\vjYYTpW.exe
  C:\Windows\System\vjYYTpW.exe
  2⤵
  PID:7916
- C:\Windows\System\vCnZXJA.exe
  C:\Windows\System\vCnZXJA.exe
  2⤵
  PID:7940
- C:\Windows\System\NExpHeU.exe
  C:\Windows\System\NExpHeU.exe
  2⤵
  PID:7956
- C:\Windows\System\vwuZBFD.exe
  C:\Windows\System\vwuZBFD.exe
  2⤵
  PID:7980
- C:\Windows\System\qgTaXbU.exe
  C:\Windows\System\qgTaXbU.exe
  2⤵
  PID:8000
- C:\Windows\System\vDeQXqB.exe
  C:\Windows\System\vDeQXqB.exe
  2⤵
  PID:8016
- C:\Windows\System\QPvBnGH.exe
  C:\Windows\System\QPvBnGH.exe
  2⤵
  PID:8040
- C:\Windows\System\iJdTRZa.exe
  C:\Windows\System\iJdTRZa.exe
  2⤵
  PID:8064
- C:\Windows\System\kzBOtKO.exe
  C:\Windows\System\kzBOtKO.exe
  2⤵
  PID:8084
- C:\Windows\System\MxbZmHs.exe
  C:\Windows\System\MxbZmHs.exe
  2⤵
  PID:8104
- C:\Windows\System\qBGaMHW.exe
  C:\Windows\System\qBGaMHW.exe
  2⤵
  PID:8128
- C:\Windows\System\chEuGbZ.exe
  C:\Windows\System\chEuGbZ.exe
  2⤵
  PID:8144
- C:\Windows\System\FXddjrd.exe
  C:\Windows\System\FXddjrd.exe
  2⤵
  PID:8176
- C:\Windows\System\szTvCPK.exe
  C:\Windows\System\szTvCPK.exe
  2⤵
  PID:7024
- C:\Windows\System\mCgmofv.exe
  C:\Windows\System\mCgmofv.exe
  2⤵
  PID:7068
- C:\Windows\System\URsrkyV.exe
  C:\Windows\System\URsrkyV.exe
  2⤵
  PID:7104
- C:\Windows\System\IvGbHGq.exe
  C:\Windows\System\IvGbHGq.exe
  2⤵
  PID:6696
- C:\Windows\System\iRrbrQk.exe
  C:\Windows\System\iRrbrQk.exe
  2⤵
  PID:6760
- C:\Windows\System\gRldBCf.exe
  C:\Windows\System\gRldBCf.exe
  2⤵
  PID:5664
- C:\Windows\System\thwSYej.exe
  C:\Windows\System\thwSYej.exe
  2⤵
  PID:5488
- C:\Windows\System\wnLnoLd.exe
  C:\Windows\System\wnLnoLd.exe
  2⤵
  PID:5188
- C:\Windows\System\svYwLqu.exe
  C:\Windows\System\svYwLqu.exe
  2⤵
  PID:6176
- C:\Windows\System\vheOeru.exe
  C:\Windows\System\vheOeru.exe
  2⤵
  PID:6224
- C:\Windows\System\wYFdkgV.exe
  C:\Windows\System\wYFdkgV.exe
  2⤵
  PID:6288
- C:\Windows\System\HUaDsyR.exe
  C:\Windows\System\HUaDsyR.exe
  2⤵
  PID:6332
- C:\Windows\System\VbCtvBf.exe
  C:\Windows\System\VbCtvBf.exe
  2⤵
  PID:6396
- C:\Windows\System\oowaEnW.exe
  C:\Windows\System\oowaEnW.exe
  2⤵
  PID:6432
- C:\Windows\System\KbkhcAB.exe
  C:\Windows\System\KbkhcAB.exe
  2⤵
  PID:6476
- C:\Windows\System\tUdWZtH.exe
  C:\Windows\System\tUdWZtH.exe
  2⤵
  PID:6520
- C:\Windows\System\taIdhWc.exe
  C:\Windows\System\taIdhWc.exe
  2⤵
  PID:6952
- C:\Windows\System\GmdgFBJ.exe
  C:\Windows\System\GmdgFBJ.exe
  2⤵
  PID:6040
- C:\Windows\System\mXUcRXl.exe
  C:\Windows\System\mXUcRXl.exe
  2⤵
  PID:6976
- C:\Windows\System\VxvrfCg.exe
  C:\Windows\System\VxvrfCg.exe
  2⤵
  PID:7008
- C:\Windows\System\elFnwKy.exe
  C:\Windows\System\elFnwKy.exe
  2⤵
  PID:7064
- C:\Windows\System\vZEQdAa.exe
  C:\Windows\System\vZEQdAa.exe
  2⤵
  PID:5236
- C:\Windows\System\efXEdNn.exe
  C:\Windows\System\efXEdNn.exe
  2⤵
  PID:6676
- C:\Windows\System\MxVQdZG.exe
  C:\Windows\System\MxVQdZG.exe
  2⤵
  PID:6712
- C:\Windows\System\pETTNxe.exe
  C:\Windows\System\pETTNxe.exe
  2⤵
  PID:7360
- C:\Windows\System\NtArBzZ.exe
  C:\Windows\System\NtArBzZ.exe
  2⤵
  PID:7400
- C:\Windows\System\yQuUwWI.exe
  C:\Windows\System\yQuUwWI.exe
  2⤵
  PID:4336
- C:\Windows\System\ckqvQpA.exe
  C:\Windows\System\ckqvQpA.exe
  2⤵
  PID:7456
- C:\Windows\System\rQzHFwn.exe
  C:\Windows\System\rQzHFwn.exe
  2⤵
  PID:900
- C:\Windows\System\nqOsCVF.exe
  C:\Windows\System\nqOsCVF.exe
  2⤵
  PID:1280
- C:\Windows\System\FHRMBNl.exe
  C:\Windows\System\FHRMBNl.exe
  2⤵
  PID:5528
- C:\Windows\System\ZiFxnbx.exe
  C:\Windows\System\ZiFxnbx.exe
  2⤵
  PID:8216
- C:\Windows\System\oVWXpoR.exe
  C:\Windows\System\oVWXpoR.exe
  2⤵
  PID:8232
- C:\Windows\System\hHxPiWI.exe
  C:\Windows\System\hHxPiWI.exe
  2⤵
  PID:8248
- C:\Windows\System\wPTPHQN.exe
  C:\Windows\System\wPTPHQN.exe
  2⤵
  PID:8264
- C:\Windows\System\zIlNHQC.exe
  C:\Windows\System\zIlNHQC.exe
  2⤵
  PID:8280
- C:\Windows\System\SvOjNPc.exe
  C:\Windows\System\SvOjNPc.exe
  2⤵
  PID:8320
- C:\Windows\System\wkjatsY.exe
  C:\Windows\System\wkjatsY.exe
  2⤵
  PID:8344
- C:\Windows\System\LbHvKYH.exe
  C:\Windows\System\LbHvKYH.exe
  2⤵
  PID:8360
- C:\Windows\System\dMvGFbV.exe
  C:\Windows\System\dMvGFbV.exe
  2⤵
  PID:8384
- C:\Windows\System\ZhyIrVx.exe
  C:\Windows\System\ZhyIrVx.exe
  2⤵
  PID:8400
- C:\Windows\System\ygfjCfy.exe
  C:\Windows\System\ygfjCfy.exe
  2⤵
  PID:8420
- C:\Windows\System\ZBshHeC.exe
  C:\Windows\System\ZBshHeC.exe
  2⤵
  PID:8440
- C:\Windows\System\mSyPGwA.exe
  C:\Windows\System\mSyPGwA.exe
  2⤵
  PID:8464
- C:\Windows\System\GFchATJ.exe
  C:\Windows\System\GFchATJ.exe
  2⤵
  PID:8488
- C:\Windows\System\hBltRMM.exe
  C:\Windows\System\hBltRMM.exe
  2⤵
  PID:8508
- C:\Windows\System\SGEHirA.exe
  C:\Windows\System\SGEHirA.exe
  2⤵
  PID:8532
- C:\Windows\System\dZmBBtq.exe
  C:\Windows\System\dZmBBtq.exe
  2⤵
  PID:8548
- C:\Windows\System\cTMBIwt.exe
  C:\Windows\System\cTMBIwt.exe
  2⤵
  PID:8568
- C:\Windows\System\DpbaoUE.exe
  C:\Windows\System\DpbaoUE.exe
  2⤵
  PID:8588
- C:\Windows\System\mgAbfGf.exe
  C:\Windows\System\mgAbfGf.exe
  2⤵
  PID:8608
- C:\Windows\System\STYRYAC.exe
  C:\Windows\System\STYRYAC.exe
  2⤵
  PID:8624
- C:\Windows\System\yNuJCKu.exe
  C:\Windows\System\yNuJCKu.exe
  2⤵
  PID:8648
- C:\Windows\System\HgQqBEH.exe
  C:\Windows\System\HgQqBEH.exe
  2⤵
  PID:8668
- C:\Windows\System\nGhzOqU.exe
  C:\Windows\System\nGhzOqU.exe
  2⤵
  PID:8692
- C:\Windows\System\TcfQqoe.exe
  C:\Windows\System\TcfQqoe.exe
  2⤵
  PID:8720
- C:\Windows\System\tKpAoPH.exe
  C:\Windows\System\tKpAoPH.exe
  2⤵
  PID:8740
- C:\Windows\System\isyOKCD.exe
  C:\Windows\System\isyOKCD.exe
  2⤵
  PID:8760
- C:\Windows\System\oEYVgWJ.exe
  C:\Windows\System\oEYVgWJ.exe
  2⤵
  PID:8788
- C:\Windows\System\wDvzazl.exe
  C:\Windows\System\wDvzazl.exe
  2⤵
  PID:8808
- C:\Windows\System\OszJriP.exe
  C:\Windows\System\OszJriP.exe
  2⤵
  PID:8828
- C:\Windows\System\zPnkZpM.exe
  C:\Windows\System\zPnkZpM.exe
  2⤵
  PID:8856
- C:\Windows\System\BFQwnNB.exe
  C:\Windows\System\BFQwnNB.exe
  2⤵
  PID:8884
- C:\Windows\System\bGCFLdE.exe
  C:\Windows\System\bGCFLdE.exe
  2⤵
  PID:8900
- C:\Windows\System\hjBKNOH.exe
  C:\Windows\System\hjBKNOH.exe
  2⤵
  PID:8920
- C:\Windows\System\WbrlSlU.exe
  C:\Windows\System\WbrlSlU.exe
  2⤵
  PID:8944
- C:\Windows\System\EoTnMtS.exe
  C:\Windows\System\EoTnMtS.exe
  2⤵
  PID:8972
- C:\Windows\System\cQlLDqc.exe
  C:\Windows\System\cQlLDqc.exe
  2⤵
  PID:8996
- C:\Windows\System\tFeVezU.exe
  C:\Windows\System\tFeVezU.exe
  2⤵
  PID:9016
- C:\Windows\System\svIRxGs.exe
  C:\Windows\System\svIRxGs.exe
  2⤵
  PID:9044
- C:\Windows\System\pnRqrAE.exe
  C:\Windows\System\pnRqrAE.exe
  2⤵
  PID:9068
- C:\Windows\System\KsrkHVW.exe
  C:\Windows\System\KsrkHVW.exe
  2⤵
  PID:9084
- C:\Windows\System\Cifpjvl.exe
  C:\Windows\System\Cifpjvl.exe
  2⤵
  PID:9104
- C:\Windows\System\XRxIiPd.exe
  C:\Windows\System\XRxIiPd.exe
  2⤵
  PID:9124
- C:\Windows\System\iOyCFjU.exe
  C:\Windows\System\iOyCFjU.exe
  2⤵
  PID:9152
- C:\Windows\System\sSIgxxb.exe
  C:\Windows\System\sSIgxxb.exe
  2⤵
  PID:9172
- C:\Windows\System\WnTvySn.exe
  C:\Windows\System\WnTvySn.exe
  2⤵
  PID:9196
- C:\Windows\System\HyAJxNu.exe
  C:\Windows\System\HyAJxNu.exe
  2⤵
  PID:7636
- C:\Windows\System\MwEakoC.exe
  C:\Windows\System\MwEakoC.exe
  2⤵
  PID:6852
- C:\Windows\System\WlvlDNa.exe
  C:\Windows\System\WlvlDNa.exe
  2⤵
  PID:7748
- C:\Windows\System\GtlwAtq.exe
  C:\Windows\System\GtlwAtq.exe
  2⤵
  PID:7808
- C:\Windows\System\UtviamF.exe
  C:\Windows\System\UtviamF.exe
  2⤵
  PID:7912
- C:\Windows\System\ndecolj.exe
  C:\Windows\System\ndecolj.exe
  2⤵
  PID:8028
- C:\Windows\System\kKkwweF.exe
  C:\Windows\System\kKkwweF.exe
  2⤵
  PID:8100
- C:\Windows\System\odcuIFZ.exe
  C:\Windows\System\odcuIFZ.exe
  2⤵
  PID:8164
- C:\Windows\System\zVdYHvk.exe
  C:\Windows\System\zVdYHvk.exe
  2⤵
  PID:7044
- C:\Windows\System\TkXwIrT.exe
  C:\Windows\System\TkXwIrT.exe
  2⤵
  PID:5712
- C:\Windows\System\XuAGHXw.exe
  C:\Windows\System\XuAGHXw.exe
  2⤵
  PID:7244
- C:\Windows\System\LZAMziS.exe
  C:\Windows\System\LZAMziS.exe
  2⤵
  PID:7152
- C:\Windows\System\ffmINeW.exe
  C:\Windows\System\ffmINeW.exe
  2⤵
  PID:7516
- C:\Windows\System\hZarhyQ.exe
  C:\Windows\System\hZarhyQ.exe
  2⤵
  PID:4520
- C:\Windows\System\kvWqDCi.exe
  C:\Windows\System\kvWqDCi.exe
  2⤵
  PID:8452
- C:\Windows\System\NmFZtjB.exe
  C:\Windows\System\NmFZtjB.exe
  2⤵
  PID:8472
- C:\Windows\System\JqALZmO.exe
  C:\Windows\System\JqALZmO.exe
  2⤵
  PID:7828
- C:\Windows\System\xcZtexe.exe
  C:\Windows\System\xcZtexe.exe
  2⤵
  PID:9228
- C:\Windows\System\wfDSkkz.exe
  C:\Windows\System\wfDSkkz.exe
  2⤵
  PID:9252
- C:\Windows\System\IlsJlJv.exe
  C:\Windows\System\IlsJlJv.exe
  2⤵
  PID:9268
- C:\Windows\System\riuXawU.exe
  C:\Windows\System\riuXawU.exe
  2⤵
  PID:9284
- C:\Windows\System\bqdKbca.exe
  C:\Windows\System\bqdKbca.exe
  2⤵
  PID:9304
- C:\Windows\System\qLNBInJ.exe
  C:\Windows\System\qLNBInJ.exe
  2⤵
  PID:9328
- C:\Windows\System\FFZZhwp.exe
  C:\Windows\System\FFZZhwp.exe
  2⤵
  PID:9352
- C:\Windows\System\myhBQQK.exe
  C:\Windows\System\myhBQQK.exe
  2⤵
  PID:9368
- C:\Windows\System\IlyVDyT.exe
  C:\Windows\System\IlyVDyT.exe
  2⤵
  PID:9396
- C:\Windows\System\HSyGkGm.exe
  C:\Windows\System\HSyGkGm.exe
  2⤵
  PID:9420
- C:\Windows\System\gnyWlCu.exe
  C:\Windows\System\gnyWlCu.exe
  2⤵
  PID:9440
- C:\Windows\System\WJztXev.exe
  C:\Windows\System\WJztXev.exe
  2⤵
  PID:9468
- C:\Windows\System\zJOrdZL.exe
  C:\Windows\System\zJOrdZL.exe
  2⤵
  PID:9492
- C:\Windows\System\pLCmRrd.exe
  C:\Windows\System\pLCmRrd.exe
  2⤵
  PID:9512
- C:\Windows\System\gYQFCwg.exe
  C:\Windows\System\gYQFCwg.exe
  2⤵
  PID:9536
- C:\Windows\System\EuqCgyW.exe
  C:\Windows\System\EuqCgyW.exe
  2⤵
  PID:9560
- C:\Windows\System\XdMEqJb.exe
  C:\Windows\System\XdMEqJb.exe
  2⤵
  PID:9584
- C:\Windows\System\LQFlIVU.exe
  C:\Windows\System\LQFlIVU.exe
  2⤵
  PID:9604
- C:\Windows\System\YNYjWpA.exe
  C:\Windows\System\YNYjWpA.exe
  2⤵
  PID:9628
- C:\Windows\System\DHDasyX.exe
  C:\Windows\System\DHDasyX.exe
  2⤵
  PID:9652
- C:\Windows\System\FCtrlxJ.exe
  C:\Windows\System\FCtrlxJ.exe
  2⤵
  PID:9676
- C:\Windows\System\JSdNvCZ.exe
  C:\Windows\System\JSdNvCZ.exe
  2⤵
  PID:9696
- C:\Windows\System\wDCDGne.exe
  C:\Windows\System\wDCDGne.exe
  2⤵
  PID:9724
- C:\Windows\System\mBQyjAd.exe
  C:\Windows\System\mBQyjAd.exe
  2⤵
  PID:9744
- C:\Windows\System\mqLqfYD.exe
  C:\Windows\System\mqLqfYD.exe
  2⤵
  PID:9768
- C:\Windows\System\gsMdoTn.exe
  C:\Windows\System\gsMdoTn.exe
  2⤵
  PID:9788
- C:\Windows\System\PebmXnc.exe
  C:\Windows\System\PebmXnc.exe
  2⤵
  PID:9816
- C:\Windows\System\bepYCCu.exe
  C:\Windows\System\bepYCCu.exe
  2⤵
  PID:9836
- C:\Windows\System\sItYnVs.exe
  C:\Windows\System\sItYnVs.exe
  2⤵
  PID:9856
- C:\Windows\System\iZkszvi.exe
  C:\Windows\System\iZkszvi.exe
  2⤵
  PID:9888
- C:\Windows\System\WiqshKE.exe
  C:\Windows\System\WiqshKE.exe
  2⤵
  PID:9908
- C:\Windows\System\lySMKli.exe
  C:\Windows\System\lySMKli.exe
  2⤵
  PID:9932
- C:\Windows\System\ZQlFgXD.exe
  C:\Windows\System\ZQlFgXD.exe
  2⤵
  PID:9956
- C:\Windows\System\XxtmGNo.exe
  C:\Windows\System\XxtmGNo.exe
  2⤵
  PID:9972
- C:\Windows\System\MvCuwBJ.exe
  C:\Windows\System\MvCuwBJ.exe
  2⤵
  PID:9996
- C:\Windows\System\amWmsMH.exe
  C:\Windows\System\amWmsMH.exe
  2⤵
  PID:10016
- C:\Windows\System\tjRxPOn.exe
  C:\Windows\System\tjRxPOn.exe
  2⤵
  PID:10036
- C:\Windows\System\rcAHpDk.exe
  C:\Windows\System\rcAHpDk.exe
  2⤵
  PID:10060
- C:\Windows\System\kBFbZnm.exe
  C:\Windows\System\kBFbZnm.exe
  2⤵
  PID:10080
- C:\Windows\System\BpCvrQO.exe
  C:\Windows\System\BpCvrQO.exe
  2⤵
  PID:10100
- C:\Windows\System\QFevLrs.exe
  C:\Windows\System\QFevLrs.exe
  2⤵
  PID:10120
- C:\Windows\System\aOGbCmy.exe
  C:\Windows\System\aOGbCmy.exe
  2⤵
  PID:10140
- C:\Windows\System\euIsWId.exe
  C:\Windows\System\euIsWId.exe
  2⤵
  PID:10160
- C:\Windows\System\fndSonj.exe
  C:\Windows\System\fndSonj.exe
  2⤵
  PID:10184
- C:\Windows\System\VoQEdpf.exe
  C:\Windows\System\VoQEdpf.exe
  2⤵
  PID:10200
- C:\Windows\System\wfRVmNm.exe
  C:\Windows\System\wfRVmNm.exe
  2⤵
  PID:10224
- C:\Windows\System\ehdsnmZ.exe
  C:\Windows\System\ehdsnmZ.exe
  2⤵
  PID:7876
- C:\Windows\System\eFbypSj.exe
  C:\Windows\System\eFbypSj.exe
  2⤵
  PID:8644
- C:\Windows\System\EdLZAwa.exe
  C:\Windows\System\EdLZAwa.exe
  2⤵
  PID:8048
- C:\Windows\System\BeXmcUG.exe
  C:\Windows\System\BeXmcUG.exe
  2⤵
  PID:8736
- C:\Windows\System\pcwBlft.exe
  C:\Windows\System\pcwBlft.exe
  2⤵
  PID:6056
- C:\Windows\System\eXCEkET.exe
  C:\Windows\System\eXCEkET.exe
  2⤵
  PID:7192
- C:\Windows\System\IwWLKGU.exe
  C:\Windows\System\IwWLKGU.exe
  2⤵
  PID:7204
- C:\Windows\System\lqAETIJ.exe
  C:\Windows\System\lqAETIJ.exe
  2⤵
  PID:9052
- C:\Windows\System\VYQMRdy.exe
  C:\Windows\System\VYQMRdy.exe
  2⤵
  PID:6160
- C:\Windows\System\EbtmUIX.exe
  C:\Windows\System\EbtmUIX.exe
  2⤵
  PID:7328
- C:\Windows\System\sYwQYhZ.exe
  C:\Windows\System\sYwQYhZ.exe
  2⤵
  PID:6412
- C:\Windows\System\bzERdch.exe
  C:\Windows\System\bzERdch.exe
  2⤵
  PID:6472
- C:\Windows\System\hzPmgZJ.exe
  C:\Windows\System\hzPmgZJ.exe
  2⤵
  PID:8076
- C:\Windows\System\LjhFCMR.exe
  C:\Windows\System\LjhFCMR.exe
  2⤵
  PID:6968
- C:\Windows\System\FbkjFly.exe
  C:\Windows\System\FbkjFly.exe
  2⤵
  PID:5412
- C:\Windows\System\BsmgrTr.exe
  C:\Windows\System\BsmgrTr.exe
  2⤵
  PID:7380
- C:\Windows\System\LzfyJbt.exe
  C:\Windows\System\LzfyJbt.exe
  2⤵
  PID:4472
- C:\Windows\System\gHdTnyG.exe
  C:\Windows\System\gHdTnyG.exe
  2⤵
  PID:7604
- C:\Windows\System\NcKCgyR.exe
  C:\Windows\System\NcKCgyR.exe
  2⤵
  PID:7672
- C:\Windows\System\wcLsFvV.exe
  C:\Windows\System\wcLsFvV.exe
  2⤵
  PID:7488
- C:\Windows\System\FJsZXxp.exe
  C:\Windows\System\FJsZXxp.exe
  2⤵
  PID:8500
- C:\Windows\System\MhuLDjK.exe
  C:\Windows\System\MhuLDjK.exe
  2⤵
  PID:7764
- C:\Windows\System\SmWnFPv.exe
  C:\Windows\System\SmWnFPv.exe
  2⤵
  PID:9224
- C:\Windows\System\dUMUaua.exe
  C:\Windows\System\dUMUaua.exe
  2⤵
  PID:8584
- C:\Windows\System\DxEKNqb.exe
  C:\Windows\System\DxEKNqb.exe
  2⤵
  PID:9280
- C:\Windows\System\eQieePA.exe
  C:\Windows\System\eQieePA.exe
  2⤵
  PID:10256
- C:\Windows\System\VmtPSKa.exe
  C:\Windows\System\VmtPSKa.exe
  2⤵
  PID:10280
- C:\Windows\System\ZkbwalH.exe
  C:\Windows\System\ZkbwalH.exe
  2⤵
  PID:10304
- C:\Windows\System\ABMOats.exe
  C:\Windows\System\ABMOats.exe
  2⤵
  PID:10324
- C:\Windows\System\ZNzDBIG.exe
  C:\Windows\System\ZNzDBIG.exe
  2⤵
  PID:10348
- C:\Windows\System\eJhmruw.exe
  C:\Windows\System\eJhmruw.exe
  2⤵
  PID:10368
- C:\Windows\System\rHGsVXL.exe
  C:\Windows\System\rHGsVXL.exe
  2⤵
  PID:10388
- C:\Windows\System\SKPUBZJ.exe
  C:\Windows\System\SKPUBZJ.exe
  2⤵
  PID:10412
- C:\Windows\System\EbCHmaQ.exe
  C:\Windows\System\EbCHmaQ.exe
  2⤵
  PID:10440
- C:\Windows\System\HDnTfvA.exe
  C:\Windows\System\HDnTfvA.exe
  2⤵
  PID:10468
- C:\Windows\System\bzTjjHO.exe
  C:\Windows\System\bzTjjHO.exe
  2⤵
  PID:10488
- C:\Windows\System\dpeHPIG.exe
  C:\Windows\System\dpeHPIG.exe
  2⤵
  PID:10508
- C:\Windows\System\NkYlNgQ.exe
  C:\Windows\System\NkYlNgQ.exe
  2⤵
  PID:10532
- C:\Windows\System\AhYEOXq.exe
  C:\Windows\System\AhYEOXq.exe
  2⤵
  PID:10560
- C:\Windows\System\eLtBKml.exe
  C:\Windows\System\eLtBKml.exe
  2⤵
  PID:10588
- C:\Windows\System\MTqSElp.exe
  C:\Windows\System\MTqSElp.exe
  2⤵
  PID:10608
- C:\Windows\System\KOjakHQ.exe
  C:\Windows\System\KOjakHQ.exe
  2⤵
  PID:10640
- C:\Windows\System\RiyYaCs.exe
  C:\Windows\System\RiyYaCs.exe
  2⤵
  PID:10656
- C:\Windows\System\fJozBZZ.exe
  C:\Windows\System\fJozBZZ.exe
  2⤵
  PID:10680
- C:\Windows\System\mOzxWtG.exe
  C:\Windows\System\mOzxWtG.exe
  2⤵
  PID:10700
- C:\Windows\System\TcYUEje.exe
  C:\Windows\System\TcYUEje.exe
  2⤵
  PID:10724
- C:\Windows\System\FwENwPL.exe
  C:\Windows\System\FwENwPL.exe
  2⤵
  PID:10748
- C:\Windows\System\EdCwyFJ.exe
  C:\Windows\System\EdCwyFJ.exe
  2⤵
  PID:10772
- C:\Windows\System\NmmLZGP.exe
  C:\Windows\System\NmmLZGP.exe
  2⤵
  PID:10792
- C:\Windows\System\wRohhIF.exe
  C:\Windows\System\wRohhIF.exe
  2⤵
  PID:10824
- C:\Windows\System\YhZZLiM.exe
  C:\Windows\System\YhZZLiM.exe
  2⤵
  PID:10844
- C:\Windows\System\sYZtFPk.exe
  C:\Windows\System\sYZtFPk.exe
  2⤵
  PID:10864
- C:\Windows\System\rHlsCRX.exe
  C:\Windows\System\rHlsCRX.exe
  2⤵
  PID:10888
- C:\Windows\System\kTsIPTN.exe
  C:\Windows\System\kTsIPTN.exe
  2⤵
  PID:10908
- C:\Windows\System\nANoJOf.exe
  C:\Windows\System\nANoJOf.exe
  2⤵
  PID:10928
- C:\Windows\System\lvMefNj.exe
  C:\Windows\System\lvMefNj.exe
  2⤵
  PID:10952
- C:\Windows\System\ZukkGbS.exe
  C:\Windows\System\ZukkGbS.exe
  2⤵
  PID:10976
- C:\Windows\System\QXtaFcb.exe
  C:\Windows\System\QXtaFcb.exe
  2⤵
  PID:11000
- C:\Windows\System\qUzmMfe.exe
  C:\Windows\System\qUzmMfe.exe
  2⤵
  PID:11016
- C:\Windows\System\rAGMsOn.exe
  C:\Windows\System\rAGMsOn.exe
  2⤵
  PID:11044
- C:\Windows\System\avjRJHw.exe
  C:\Windows\System\avjRJHw.exe
  2⤵
  PID:11068
- C:\Windows\System\KFNofhr.exe
  C:\Windows\System\KFNofhr.exe
  2⤵
  PID:11088
- C:\Windows\System\FidVMCi.exe
  C:\Windows\System\FidVMCi.exe
  2⤵
  PID:11112
- C:\Windows\System\QWPZpSg.exe
  C:\Windows\System\QWPZpSg.exe
  2⤵
  PID:11140
- C:\Windows\System\tSbJoUA.exe
  C:\Windows\System\tSbJoUA.exe
  2⤵
  PID:11164
- C:\Windows\System\rggFhGr.exe
  C:\Windows\System\rggFhGr.exe
  2⤵
  PID:11192
- C:\Windows\System\IAvJahE.exe
  C:\Windows\System\IAvJahE.exe
  2⤵
  PID:11208
- C:\Windows\System\FcdAwZi.exe
  C:\Windows\System\FcdAwZi.exe
  2⤵
  PID:11232
- C:\Windows\System\AoRYOoE.exe
  C:\Windows\System\AoRYOoE.exe
  2⤵
  PID:11256
- C:\Windows\System\OvxlgXr.exe
  C:\Windows\System\OvxlgXr.exe
  2⤵
  PID:9376
- C:\Windows\System\ujFKLtu.exe
  C:\Windows\System\ujFKLtu.exe
  2⤵
  PID:8708
- C:\Windows\System\TEtgfGL.exe
  C:\Windows\System\TEtgfGL.exe
  2⤵
  PID:8796
- C:\Windows\System\VtQrDhK.exe
  C:\Windows\System\VtQrDhK.exe
  2⤵
  PID:9624
- C:\Windows\System\HAHKZId.exe
  C:\Windows\System\HAHKZId.exe
  2⤵
  PID:9660
- C:\Windows\System\EHBMpUy.exe
  C:\Windows\System\EHBMpUy.exe
  2⤵
  PID:8928
- C:\Windows\System\cAnWyPL.exe
  C:\Windows\System\cAnWyPL.exe
  2⤵
  PID:9064
- C:\Windows\System\VeHGYeN.exe
  C:\Windows\System\VeHGYeN.exe
  2⤵
  PID:7248
- C:\Windows\System\faUVMIL.exe
  C:\Windows\System\faUVMIL.exe
  2⤵
  PID:5176
- C:\Windows\System\OeRJgmD.exe
  C:\Windows\System\OeRJgmD.exe
  2⤵
  PID:6196
- C:\Windows\System\IwdKktt.exe
  C:\Windows\System\IwdKktt.exe
  2⤵
  PID:7720
- C:\Windows\System\ELtDzQD.exe
  C:\Windows\System\ELtDzQD.exe
  2⤵
  PID:9944
- C:\Windows\System\PFnlMUT.exe
  C:\Windows\System\PFnlMUT.exe
  2⤵
  PID:9980
- C:\Windows\System\nbPvofO.exe
  C:\Windows\System\nbPvofO.exe
  2⤵
  PID:10072
- C:\Windows\System\xOVoJZD.exe
  C:\Windows\System\xOVoJZD.exe
  2⤵
  PID:10076
- C:\Windows\System\vmtiAXb.exe
  C:\Windows\System\vmtiAXb.exe
  2⤵
  PID:10116
- C:\Windows\System\wanKFzP.exe
  C:\Windows\System\wanKFzP.exe
  2⤵
  PID:10172
- C:\Windows\System\LnhdLYc.exe
  C:\Windows\System\LnhdLYc.exe
  2⤵
  PID:11280
- C:\Windows\System\HswnRvi.exe
  C:\Windows\System\HswnRvi.exe
  2⤵
  PID:11304
- C:\Windows\System\wITfCxw.exe
  C:\Windows\System\wITfCxw.exe
  2⤵
  PID:11344
- C:\Windows\System\DXcALtF.exe
  C:\Windows\System\DXcALtF.exe
  2⤵
  PID:11392
- C:\Windows\System\RxIZRiT.exe
  C:\Windows\System\RxIZRiT.exe
  2⤵
  PID:11416
- C:\Windows\System\duWjEuz.exe
  C:\Windows\System\duWjEuz.exe
  2⤵
  PID:11440
- C:\Windows\System\JHtsGsG.exe
  C:\Windows\System\JHtsGsG.exe
  2⤵
  PID:11468
- C:\Windows\System\UTLEpEL.exe
  C:\Windows\System\UTLEpEL.exe
  2⤵
  PID:11484
- C:\Windows\System\nCngIhF.exe
  C:\Windows\System\nCngIhF.exe
  2⤵
  PID:11508
- C:\Windows\System\ghCCLgM.exe
  C:\Windows\System\ghCCLgM.exe
  2⤵
  PID:11524
- C:\Windows\System\jabnVTU.exe
  C:\Windows\System\jabnVTU.exe
  2⤵
  PID:11544
- C:\Windows\System\SdEreBX.exe
  C:\Windows\System\SdEreBX.exe
  2⤵
  PID:11568
- C:\Windows\System\bTbLRry.exe
  C:\Windows\System\bTbLRry.exe
  2⤵
  PID:11600
- C:\Windows\System\bfuKNDw.exe
  C:\Windows\System\bfuKNDw.exe
  2⤵
  PID:11616
- C:\Windows\System\LFCIbeZ.exe
  C:\Windows\System\LFCIbeZ.exe
  2⤵
  PID:11636
- C:\Windows\System\XblAXHP.exe
  C:\Windows\System\XblAXHP.exe
  2⤵
  PID:11660
- C:\Windows\System\JRNevIw.exe
  C:\Windows\System\JRNevIw.exe
  2⤵
  PID:11684
- C:\Windows\System\DuGRmSc.exe
  C:\Windows\System\DuGRmSc.exe
  2⤵
  PID:11708
- C:\Windows\System\gKPEjEZ.exe
  C:\Windows\System\gKPEjEZ.exe
  2⤵
  PID:11728
- C:\Windows\System\TBAREZP.exe
  C:\Windows\System\TBAREZP.exe
  2⤵
  PID:11748
- C:\Windows\System\uXddSlj.exe
  C:\Windows\System\uXddSlj.exe
  2⤵
  PID:11768
- C:\Windows\System\PnCTuST.exe
  C:\Windows\System\PnCTuST.exe
  2⤵
  PID:11788
- C:\Windows\System\Tzhywqf.exe
  C:\Windows\System\Tzhywqf.exe
  2⤵
  PID:11812
- C:\Windows\System\KoPMWVQ.exe
  C:\Windows\System\KoPMWVQ.exe
  2⤵
  PID:11836
- C:\Windows\System\nBCTVjC.exe
  C:\Windows\System\nBCTVjC.exe
  2⤵
  PID:11864
- C:\Windows\System\VYgUGPq.exe
  C:\Windows\System\VYgUGPq.exe
  2⤵
  PID:11892
- C:\Windows\System\sBSKlXJ.exe
  C:\Windows\System\sBSKlXJ.exe
  2⤵
  PID:11916
- C:\Windows\System\BVvQACj.exe
  C:\Windows\System\BVvQACj.exe
  2⤵
  PID:11944
- C:\Windows\System\OZyqXJq.exe
  C:\Windows\System\OZyqXJq.exe
  2⤵
  PID:11964
- C:\Windows\System\hkQmCgA.exe
  C:\Windows\System\hkQmCgA.exe
  2⤵
  PID:11996
- C:\Windows\System\jxOwnJR.exe
  C:\Windows\System\jxOwnJR.exe
  2⤵
  PID:12016
- C:\Windows\System\ekndsPA.exe
  C:\Windows\System\ekndsPA.exe
  2⤵
  PID:12036
- C:\Windows\System\yMGxTpU.exe
  C:\Windows\System\yMGxTpU.exe
  2⤵
  PID:12060
- C:\Windows\System\ecLAnDz.exe
  C:\Windows\System\ecLAnDz.exe
  2⤵
  PID:12080
- C:\Windows\System\mfjxkMQ.exe
  C:\Windows\System\mfjxkMQ.exe
  2⤵
  PID:12104
- C:\Windows\System\TDzLeDF.exe
  C:\Windows\System\TDzLeDF.exe
  2⤵
  PID:12124
- C:\Windows\System\IbAGmbR.exe
  C:\Windows\System\IbAGmbR.exe
  2⤵
  PID:12144
- C:\Windows\System\RPoqVos.exe
  C:\Windows\System\RPoqVos.exe
  2⤵
  PID:12164
- C:\Windows\System\cgxXSoo.exe
  C:\Windows\System\cgxXSoo.exe
  2⤵
  PID:12188
- C:\Windows\System\AclRPKh.exe
  C:\Windows\System\AclRPKh.exe
  2⤵
  PID:12208
- C:\Windows\System\ShATXxN.exe
  C:\Windows\System\ShATXxN.exe
  2⤵
  PID:12224
- C:\Windows\System\uAFdNLM.exe
  C:\Windows\System\uAFdNLM.exe
  2⤵
  PID:12276
- C:\Windows\System\bBxWnOK.exe
  C:\Windows\System\bBxWnOK.exe
  2⤵
  PID:8208
- C:\Windows\System\dYTRnwU.exe
  C:\Windows\System\dYTRnwU.exe
  2⤵
  PID:8228
- C:\Windows\System\LtvMFPn.exe
  C:\Windows\System\LtvMFPn.exe
  2⤵
  PID:8260
- C:\Windows\System\KCaYkJC.exe
  C:\Windows\System\KCaYkJC.exe
  2⤵
  PID:8288
- C:\Windows\System\NshUmXb.exe
  C:\Windows\System\NshUmXb.exe
  2⤵
  PID:8352
- C:\Windows\System\meoeFml.exe
  C:\Windows\System\meoeFml.exe
  2⤵
  PID:8376
- C:\Windows\System\GzhwnkU.exe
  C:\Windows\System\GzhwnkU.exe
  2⤵
  PID:8428
- C:\Windows\System\rpdXUIv.exe
  C:\Windows\System\rpdXUIv.exe
  2⤵
  PID:7520
- C:\Windows\System\lFREyeL.exe
  C:\Windows\System\lFREyeL.exe
  2⤵
  PID:8524
- C:\Windows\System\vXffMfk.exe
  C:\Windows\System\vXffMfk.exe
  2⤵
  PID:5556
- C:\Windows\System\nYWPwng.exe
  C:\Windows\System\nYWPwng.exe
  2⤵
  PID:9264
- C:\Windows\System\vqgRpRF.exe
  C:\Windows\System\vqgRpRF.exe
  2⤵
  PID:10332
- C:\Windows\System\TpCgsfd.exe
  C:\Windows\System\TpCgsfd.exe
  2⤵
  PID:10404
- C:\Windows\System\prbRbcC.exe
  C:\Windows\System\prbRbcC.exe
  2⤵
  PID:8140
- C:\Windows\System\VFrwKus.exe
  C:\Windows\System\VFrwKus.exe
  2⤵
  PID:12304
- C:\Windows\System\uDdIzHZ.exe
  C:\Windows\System\uDdIzHZ.exe
  2⤵
  PID:12324
- C:\Windows\System\QlXIWdI.exe
  C:\Windows\System\QlXIWdI.exe
  2⤵
  PID:12344
- C:\Windows\System\RXoJsRn.exe
  C:\Windows\System\RXoJsRn.exe
  2⤵
  PID:12368
- C:\Windows\System\JEQTUhm.exe
  C:\Windows\System\JEQTUhm.exe
  2⤵
  PID:12396
- C:\Windows\System\gYBGoJd.exe
  C:\Windows\System\gYBGoJd.exe
  2⤵
  PID:12416
- C:\Windows\System\KbxURkh.exe
  C:\Windows\System\KbxURkh.exe
  2⤵
  PID:12444
- C:\Windows\System\DFgtoPR.exe
  C:\Windows\System\DFgtoPR.exe
  2⤵
  PID:12468
- C:\Windows\System\dgqpIQd.exe
  C:\Windows\System\dgqpIQd.exe
  2⤵
  PID:12492
- C:\Windows\System\MfXFdTb.exe
  C:\Windows\System\MfXFdTb.exe
  2⤵
  PID:12512
- C:\Windows\System\UeGUEQH.exe
  C:\Windows\System\UeGUEQH.exe
  2⤵
  PID:12532
- C:\Windows\System\FnVkgeD.exe
  C:\Windows\System\FnVkgeD.exe
  2⤵
  PID:12560
- C:\Windows\System\UrPmGyq.exe
  C:\Windows\System\UrPmGyq.exe
  2⤵
  PID:12580
- C:\Windows\System\BiUUUZo.exe
  C:\Windows\System\BiUUUZo.exe
  2⤵
  PID:12596
- C:\Windows\System\rffXNRL.exe
  C:\Windows\System\rffXNRL.exe
  2⤵
  PID:12616
- C:\Windows\System\lozdpcq.exe
  C:\Windows\System\lozdpcq.exe
  2⤵
  PID:12640
- C:\Windows\System\VgHaosn.exe
  C:\Windows\System\VgHaosn.exe
  2⤵
  PID:12664
- C:\Windows\System\YadYpyr.exe
  C:\Windows\System\YadYpyr.exe
  2⤵
  PID:12688
- C:\Windows\System\rpnJSeN.exe
  C:\Windows\System\rpnJSeN.exe
  2⤵
  PID:12712
- C:\Windows\System\MvUsmHO.exe
  C:\Windows\System\MvUsmHO.exe
  2⤵
  PID:12736
- C:\Windows\System\taLiVmf.exe
  C:\Windows\System\taLiVmf.exe
  2⤵
  PID:12760
- C:\Windows\System\hsQPVyC.exe
  C:\Windows\System\hsQPVyC.exe
  2⤵
  PID:12788
- C:\Windows\System\OatoSil.exe
  C:\Windows\System\OatoSil.exe
  2⤵
  PID:12808
- C:\Windows\System\YOiriPs.exe
  C:\Windows\System\YOiriPs.exe
  2⤵
  PID:12824
- C:\Windows\System\zioLTwr.exe
  C:\Windows\System\zioLTwr.exe
  2⤵
  PID:12848
- C:\Windows\System\OcLYALB.exe
  C:\Windows\System\OcLYALB.exe
  2⤵
  PID:12872
- C:\Windows\System\XzjNmrA.exe
  C:\Windows\System\XzjNmrA.exe
  2⤵
  PID:12896
- C:\Windows\System\pzrFjtq.exe
  C:\Windows\System\pzrFjtq.exe
  2⤵
  PID:12924
- C:\Windows\System\fwsWPNJ.exe
  C:\Windows\System\fwsWPNJ.exe
  2⤵
  PID:12944
- C:\Windows\System\YuOAFpV.exe
  C:\Windows\System\YuOAFpV.exe
  2⤵
  PID:12972
- C:\Windows\System\gYhwhxZ.exe
  C:\Windows\System\gYhwhxZ.exe
  2⤵
  PID:12992
- C:\Windows\System\QfKIWLx.exe
  C:\Windows\System\QfKIWLx.exe
  2⤵
  PID:13016
- C:\Windows\System\tDlYVSJ.exe
  C:\Windows\System\tDlYVSJ.exe
  2⤵
  PID:13040
- C:\Windows\System\EayPTOe.exe
  C:\Windows\System\EayPTOe.exe
  2⤵
  PID:13068
- C:\Windows\System\auWYHNE.exe
  C:\Windows\System\auWYHNE.exe
  2⤵
  PID:13088
- C:\Windows\System\KOpBVCa.exe
  C:\Windows\System\KOpBVCa.exe
  2⤵
  PID:13112
- C:\Windows\System\zALCXty.exe
  C:\Windows\System\zALCXty.exe
  2⤵
  PID:13132
- C:\Windows\System\oddUXgE.exe
  C:\Windows\System\oddUXgE.exe
  2⤵
  PID:13156
- C:\Windows\System\xmhqzDv.exe
  C:\Windows\System\xmhqzDv.exe
  2⤵
  PID:13176
- C:\Windows\System\nGWVJHK.exe
  C:\Windows\System\nGWVJHK.exe
  2⤵
  PID:13200
- C:\Windows\System\SaSorKq.exe
  C:\Windows\System\SaSorKq.exe
  2⤵
  PID:13224
- C:\Windows\System\DgzWYey.exe
  C:\Windows\System\DgzWYey.exe
  2⤵
  PID:13244
- C:\Windows\System\myPpbxA.exe
  C:\Windows\System\myPpbxA.exe
  2⤵
  PID:13264
- C:\Windows\System\MjmKhdL.exe
  C:\Windows\System\MjmKhdL.exe
  2⤵
  PID:13284
- C:\Windows\System\McxVJwX.exe
  C:\Windows\System\McxVJwX.exe
  2⤵
  PID:13308
- C:\Windows\System\DudQUgo.exe
  C:\Windows\System\DudQUgo.exe
  2⤵
  PID:11352
- C:\Windows\System\ITntXxx.exe
  C:\Windows\System\ITntXxx.exe
  2⤵
  PID:7224
- C:\Windows\System\OTWfkPD.exe
  C:\Windows\System\OTWfkPD.exe
  2⤵
  PID:10948
- C:\Windows\System\XGsuMPp.exe
  C:\Windows\System\XGsuMPp.exe
  2⤵
  PID:9208
- C:\Windows\System\XfYEooF.exe
  C:\Windows\System\XfYEooF.exe
  2⤵
  PID:11096
- C:\Windows\System\WwwqfBv.exe
  C:\Windows\System\WwwqfBv.exe
  2⤵
  PID:11172
- C:\Windows\System\zidvfVg.exe
  C:\Windows\System\zidvfVg.exe
  2⤵
  PID:11224
- C:\Windows\System\LGiRxYc.exe
  C:\Windows\System\LGiRxYc.exe
  2⤵
  PID:9340
- C:\Windows\System\yiDfFFM.exe
  C:\Windows\System\yiDfFFM.exe
  2⤵
  PID:10028
- C:\Windows\System\fWbXynA.exe
  C:\Windows\System\fWbXynA.exe
  2⤵
  PID:12088
- C:\Windows\System\jHTwqLO.exe
  C:\Windows\System\jHTwqLO.exe
  2⤵
  PID:12032
- C:\Windows\System\kZnpRUs.exe
  C:\Windows\System\kZnpRUs.exe
  2⤵
  PID:7812
- C:\Windows\System\nzFUJio.exe
  C:\Windows\System\nzFUJio.exe
  2⤵
  PID:11956
- C:\Windows\System\xKzpnnf.exe
  C:\Windows\System\xKzpnnf.exe
  2⤵
  PID:11912
- C:\Windows\System\yfKBNCt.exe
  C:\Windows\System\yfKBNCt.exe
  2⤵
  PID:11844
- C:\Windows\System\WVdcDAn.exe
  C:\Windows\System\WVdcDAn.exe
  2⤵
  PID:7512
- C:\Windows\System\VLYdQBA.exe
  C:\Windows\System\VLYdQBA.exe
  2⤵
  PID:8416
- C:\Windows\System\Jefwocq.exe
  C:\Windows\System\Jefwocq.exe
  2⤵
  PID:8564
- C:\Windows\System\FusqeDY.exe
  C:\Windows\System\FusqeDY.exe
  2⤵
  PID:7848
- C:\Windows\System\YaaMVRF.exe
  C:\Windows\System\YaaMVRF.exe
  2⤵
  PID:12316
- C:\Windows\System\VdFSFOq.exe
  C:\Windows\System\VdFSFOq.exe
  2⤵
  PID:12408
- C:\Windows\System\SOzjBXo.exe
  C:\Windows\System\SOzjBXo.exe
  2⤵
  PID:12452
- C:\Windows\System\xjmDZLJ.exe
  C:\Windows\System\xjmDZLJ.exe
  2⤵
  PID:12612
- C:\Windows\System\itZlbBi.exe
  C:\Windows\System\itZlbBi.exe
  2⤵
  PID:12676
- C:\Windows\System\xjKkCxm.exe
  C:\Windows\System\xjKkCxm.exe
  2⤵
  PID:10356
- C:\Windows\System\XmCHEmF.exe
  C:\Windows\System\XmCHEmF.exe
  2⤵
  PID:12988
- C:\Windows\System\ntkDLer.exe
  C:\Windows\System\ntkDLer.exe
  2⤵
  PID:13148
- C:\Windows\System\OqVpLHB.exe
  C:\Windows\System\OqVpLHB.exe
  2⤵
  PID:13300
- C:\Windows\System\wrKYxva.exe
  C:\Windows\System\wrKYxva.exe
  2⤵
  PID:9612
- C:\Windows\System\MmCsYwt.exe
  C:\Windows\System\MmCsYwt.exe
  2⤵
  PID:9740
- C:\Windows\System\FVutlsF.exe
  C:\Windows\System\FVutlsF.exe
  2⤵
  PID:9132
- C:\Windows\System\kDpgCCo.exe
  C:\Windows\System\kDpgCCo.exe
  2⤵
  PID:12500
- C:\Windows\System\VISIUNB.exe
  C:\Windows\System\VISIUNB.exe
  2⤵
  PID:7888
- C:\Windows\System\NbLxihj.exe
  C:\Windows\System\NbLxihj.exe
  2⤵
  PID:7964
- C:\Windows\System\FXeplSd.exe
  C:\Windows\System\FXeplSd.exe
  2⤵
  PID:9096
- C:\Windows\System\aLKcufr.exe
  C:\Windows\System\aLKcufr.exe
  2⤵
  PID:9164
- C:\Windows\System\YVaNXoq.exe
  C:\Windows\System\YVaNXoq.exe
  2⤵
  PID:3476
- C:\Windows\System\PndNhBE.exe
  C:\Windows\System\PndNhBE.exe
  2⤵
  PID:2864
- C:\Windows\System\vswSzjl.exe
  C:\Windows\System\vswSzjl.exe
  2⤵
  PID:10012
- C:\Windows\System\esQsTLq.exe
  C:\Windows\System\esQsTLq.exe
  2⤵
  PID:5468
- C:\Windows\System\fdhxMHL.exe
  C:\Windows\System\fdhxMHL.exe
  2⤵
  PID:6604
- C:\Windows\System\uDhLBHH.exe
  C:\Windows\System\uDhLBHH.exe
  2⤵
  PID:11872
- C:\Windows\System\YbgZegt.exe
  C:\Windows\System\YbgZegt.exe
  2⤵
  PID:13188
- C:\Windows\System\pIMMGSQ.exe
  C:\Windows\System\pIMMGSQ.exe
  2⤵
  PID:1072
- C:\Windows\System\LVbVwwL.exe
  C:\Windows\System\LVbVwwL.exe
  2⤵
  PID:3748
- C:\Windows\System\WowrkKM.exe
  C:\Windows\System\WowrkKM.exe
  2⤵
  PID:11796
- C:\Windows\System\KIwctuN.exe
  C:\Windows\System\KIwctuN.exe
  2⤵
  PID:4360
- C:\Windows\System\dveaRgc.exe
  C:\Windows\System\dveaRgc.exe
  2⤵
  PID:1108
- C:\Windows\System\HkzcoeX.exe
  C:\Windows\System\HkzcoeX.exe
  2⤵
  PID:1728
- C:\Windows\System\fuzGzGQ.exe
  C:\Windows\System\fuzGzGQ.exe
  2⤵
  PID:4076
- C:\Windows\System\bHztUPh.exe
  C:\Windows\System\bHztUPh.exe
  2⤵
  PID:6780
- C:\Windows\System\UunYYrS.exe
  C:\Windows\System\UunYYrS.exe
  2⤵
  PID:2828
- C:\Windows\System\ZIIpaVf.exe
  C:\Windows\System\ZIIpaVf.exe
  2⤵
  PID:9144
- C:\Windows\System\JQwVZwi.exe
  C:\Windows\System\JQwVZwi.exe
  2⤵
  PID:11248
- C:\Windows\System\qWPmNBy.exe
  C:\Windows\System\qWPmNBy.exe
  2⤵
  PID:12008
- C:\Windows\System\WyViTvB.exe
  C:\Windows\System\WyViTvB.exe
  2⤵
  PID:11652
- C:\Windows\System\OlLNlXP.exe
  C:\Windows\System\OlLNlXP.exe
  2⤵
  PID:4424
- C:\Windows\System\qpBVUrw.exe
  C:\Windows\System\qpBVUrw.exe
  2⤵
  PID:7356
- C:\Windows\System\KqKptzJ.exe
  C:\Windows\System\KqKptzJ.exe
  2⤵
  PID:9012
- C:\Windows\System\SWfxqDM.exe
  C:\Windows\System\SWfxqDM.exe
  2⤵
  PID:11744
- C:\Windows\System\nBBCtkC.exe
  C:\Windows\System\nBBCtkC.exe
  2⤵
  PID:12012
- C:\Windows\System\ruaKTdP.exe
  C:\Windows\System\ruaKTdP.exe
  2⤵
  PID:5952
- C:\Windows\System\whaPVAN.exe
  C:\Windows\System\whaPVAN.exe
  2⤵
  PID:10540
- C:\Windows\System\QagDjMQ.exe
  C:\Windows\System\QagDjMQ.exe
  2⤵
  PID:12832
- C:\Windows\System\xKzJyCO.exe
  C:\Windows\System\xKzJyCO.exe
  2⤵
  PID:1048
- C:\Windows\System\leXoPCJ.exe
  C:\Windows\System\leXoPCJ.exe
  2⤵
  PID:1840
- C:\Windows\System\TfIuQfv.exe
  C:\Windows\System\TfIuQfv.exe
  2⤵
  PID:9548
- C:\Windows\System\DTuJXBI.exe
  C:\Windows\System\DTuJXBI.exe
  2⤵
  PID:9872
- C:\Windows\System\pHvYhbp.exe
  C:\Windows\System\pHvYhbp.exe
  2⤵
  PID:6644
- C:\Windows\System\xwajeeU.exe
  C:\Windows\System\xwajeeU.exe
  2⤵
  PID:772
- C:\Windows\System\VdtPjHc.exe
  C:\Windows\System\VdtPjHc.exe
  2⤵
  PID:4964
- C:\Windows\System\kvlANYV.exe
  C:\Windows\System\kvlANYV.exe
  2⤵
  PID:13060
- C:\Windows\System\nFvnFlu.exe
  C:\Windows\System\nFvnFlu.exe
  2⤵
  PID:12264
- C:\Windows\System\pXwgIjv.exe
  C:\Windows\System\pXwgIjv.exe
  2⤵
  PID:12252
- C:\Windows\System\IqQLkvx.exe
  C:\Windows\System\IqQLkvx.exe
  2⤵
  PID:12464
- C:\Windows\System\kgCnBwj.exe
  C:\Windows\System\kgCnBwj.exe
  2⤵
  PID:10740
- C:\Windows\System\bMfVoRR.exe
  C:\Windows\System\bMfVoRR.exe
  2⤵
  PID:10500
- C:\Windows\System\xtCiLkj.exe
  C:\Windows\System\xtCiLkj.exe
  2⤵
  PID:10624
- C:\Windows\System\PMAYFAR.exe
  C:\Windows\System\PMAYFAR.exe
  2⤵
  PID:12436
- C:\Windows\System\oCfbpEx.exe
  C:\Windows\System\oCfbpEx.exe
  2⤵
  PID:8328
- C:\Windows\System\gWBUXzZ.exe
  C:\Windows\System\gWBUXzZ.exe
  2⤵
  PID:12176
- C:\Windows\System\QMUYrLn.exe
  C:\Windows\System\QMUYrLn.exe
  2⤵
  PID:9276
- C:\Windows\System\AFUIQdH.exe
  C:\Windows\System\AFUIQdH.exe
  2⤵
  PID:1060
- C:\Windows\System\YFBfVYr.exe
  C:\Windows\System\YFBfVYr.exe
  2⤵
  PID:11356
- C:\Windows\System\wHrhapC.exe
  C:\Windows\System\wHrhapC.exe
  2⤵
  PID:11108
- C:\Windows\System\EVcxKwN.exe
  C:\Windows\System\EVcxKwN.exe
  2⤵
  PID:9336
- C:\Windows\System\rnhHJUj.exe
  C:\Windows\System\rnhHJUj.exe
  2⤵
  PID:5520
- C:\Windows\System\OUQOrMy.exe
  C:\Windows\System\OUQOrMy.exe
  2⤵
  PID:12772
- C:\Windows\System\gxfVTNQ.exe
  C:\Windows\System\gxfVTNQ.exe
  2⤵
  PID:10616
- C:\Windows\System\JbJytOk.exe
  C:\Windows\System\JbJytOk.exe
  2⤵
  PID:8680
- C:\Windows\System\AHSgcFd.exe
  C:\Windows\System\AHSgcFd.exe
  2⤵
  PID:13272
- C:\Windows\System\mghHtQW.exe
  C:\Windows\System\mghHtQW.exe
  2⤵
  PID:11064
- C:\Windows\System\cpWJSfd.exe
  C:\Windows\System\cpWJSfd.exe
  2⤵
  PID:11428
- C:\Windows\System\SsvehUG.exe
  C:\Windows\System\SsvehUG.exe
  2⤵
  PID:8968
- C:\Windows\System\csJWxKx.exe
  C:\Windows\System\csJWxKx.exe
  2⤵
  PID:12352
- C:\Windows\System\QewvKnc.exe
  C:\Windows\System\QewvKnc.exe
  2⤵
  PID:2508
- C:\Windows\System\gfjYjGH.exe
  C:\Windows\System\gfjYjGH.exe
  2⤵
  PID:12768
- C:\Windows\System\gAOOveG.exe
  C:\Windows\System\gAOOveG.exe
  2⤵
  PID:13076
- C:\Windows\System\LFsPjsC.exe
  C:\Windows\System\LFsPjsC.exe
  2⤵
  PID:4020
- C:\Windows\System\kPjNjxX.exe
  C:\Windows\System\kPjNjxX.exe
  2⤵
  PID:6172
- C:\Windows\System\HiEcpMw.exe
  C:\Windows\System\HiEcpMw.exe
  2⤵
  PID:13324
- C:\Windows\System\GaCgldY.exe
  C:\Windows\System\GaCgldY.exe
  2⤵
  PID:13348
- C:\Windows\System\invlJIF.exe
  C:\Windows\System\invlJIF.exe
  2⤵
  PID:13368
- C:\Windows\System\vbDowDu.exe
  C:\Windows\System\vbDowDu.exe
  2⤵
  PID:13392
- C:\Windows\System\RLdpNJW.exe
  C:\Windows\System\RLdpNJW.exe
  2⤵
  PID:13412
- C:\Windows\System\hjMtDOK.exe
  C:\Windows\System\hjMtDOK.exe
  2⤵
  PID:13432
- C:\Windows\System\fodAJyQ.exe
  C:\Windows\System\fodAJyQ.exe
  2⤵
  PID:13448
- C:\Windows\System\OAPfBzX.exe
  C:\Windows\System\OAPfBzX.exe
  2⤵
  PID:13468
- C:\Windows\System\wauieQy.exe
  C:\Windows\System\wauieQy.exe
  2⤵
  PID:13488
- C:\Windows\System\rMrkNfT.exe
  C:\Windows\System\rMrkNfT.exe
  2⤵
  PID:13512
- C:\Windows\System\QHHOiMr.exe
  C:\Windows\System\QHHOiMr.exe
  2⤵
  PID:13528
- C:\Windows\System\lCeuSMC.exe
  C:\Windows\System\lCeuSMC.exe
  2⤵
  PID:13548
- C:\Windows\System\eUTERAF.exe
  C:\Windows\System\eUTERAF.exe
  2⤵
  PID:13568
- C:\Windows\System\zHjEtbD.exe
  C:\Windows\System\zHjEtbD.exe
  2⤵
  PID:13596
- C:\Windows\System\PAijeIR.exe
  C:\Windows\System\PAijeIR.exe
  2⤵
  PID:13620
- C:\Windows\System\lERoKwf.exe
  C:\Windows\System\lERoKwf.exe
  2⤵
  PID:13656
- C:\Windows\System\vFdMNPQ.exe
  C:\Windows\System\vFdMNPQ.exe
  2⤵
  PID:13676
- C:\Windows\System\VYWceEt.exe
  C:\Windows\System\VYWceEt.exe
  2⤵
  PID:13704
- C:\Windows\System\CouLMIZ.exe
  C:\Windows\System\CouLMIZ.exe
  2⤵
  PID:13724
- C:\Windows\System\qJPzIsz.exe
  C:\Windows\System\qJPzIsz.exe
  2⤵
  PID:13752
- C:\Windows\System\ZibFHoq.exe
  C:\Windows\System\ZibFHoq.exe
  2⤵
  PID:13776
- C:\Windows\System\qaRTvAS.exe
  C:\Windows\System\qaRTvAS.exe
  2⤵
  PID:13800
- C:\Windows\System\qdjhhpa.exe
  C:\Windows\System\qdjhhpa.exe
  2⤵
  PID:13828
- C:\Windows\System\VjeHNqG.exe
  C:\Windows\System\VjeHNqG.exe
  2⤵
  PID:13848
- C:\Windows\System\dqmJgUT.exe
  C:\Windows\System\dqmJgUT.exe
  2⤵
  PID:13872
- C:\Windows\System\LTgDojt.exe
  C:\Windows\System\LTgDojt.exe
  2⤵
  PID:13892
- C:\Windows\System\rgESRji.exe
  C:\Windows\System\rgESRji.exe
  2⤵
  PID:13912
- C:\Windows\System\JInoLpA.exe
  C:\Windows\System\JInoLpA.exe
  2⤵
  PID:13936
- C:\Windows\System\KUVFXyr.exe
  C:\Windows\System\KUVFXyr.exe
  2⤵
  PID:13960
- C:\Windows\System\BRDOWpe.exe
  C:\Windows\System\BRDOWpe.exe
  2⤵
  PID:13980
- C:\Windows\System\JCFIdmn.exe
  C:\Windows\System\JCFIdmn.exe
  2⤵
  PID:14004
- C:\Windows\System\oYewwDT.exe
  C:\Windows\System\oYewwDT.exe
  2⤵
  PID:14024
- C:\Windows\System\ocvEEpS.exe
  C:\Windows\System\ocvEEpS.exe
  2⤵
  PID:14048
- C:\Windows\System\rbkViqz.exe
  C:\Windows\System\rbkViqz.exe
  2⤵
  PID:14072
- C:\Windows\System\yqnwLWd.exe
  C:\Windows\System\yqnwLWd.exe
  2⤵
  PID:14092
- C:\Windows\System\FRQmUak.exe
  C:\Windows\System\FRQmUak.exe
  2⤵
  PID:14112
- C:\Windows\System\YhTvkeJ.exe
  C:\Windows\System\YhTvkeJ.exe
  2⤵
  PID:14132
- C:\Windows\System\PQraeiW.exe
  C:\Windows\System\PQraeiW.exe
  2⤵
  PID:14152
- C:\Windows\System\FktzOHc.exe
  C:\Windows\System\FktzOHc.exe
  2⤵
  PID:14168
- C:\Windows\System\IeFwhNr.exe
  C:\Windows\System\IeFwhNr.exe
  2⤵
  PID:14188
- C:\Windows\System\YWQveVX.exe
  C:\Windows\System\YWQveVX.exe
  2⤵
  PID:432
- C:\Windows\System\OOFtznY.exe
  C:\Windows\System\OOFtznY.exe
  2⤵
  PID:10808
- C:\Windows\System\ZspMeTH.exe
  C:\Windows\System\ZspMeTH.exe
  2⤵
  PID:14044
- C:\Windows\System\CHdbRwo.exe
  C:\Windows\System\CHdbRwo.exe
  2⤵
  PID:8516
- C:\Windows\System\mogasGP.exe
  C:\Windows\System\mogasGP.exe
  2⤵
  PID:13692
- C:\Windows\System\FhQvVXO.exe
  C:\Windows\System\FhQvVXO.exe
  2⤵
  PID:3120
- C:\Windows\System\AfNvcAS.exe
  C:\Windows\System\AfNvcAS.exe
  2⤵
  PID:14264
- C:\Windows\System\LNUkUYz.exe
  C:\Windows\System\LNUkUYz.exe
  2⤵
  PID:13476
- C:\Windows\System\kvkcxmA.exe
  C:\Windows\System\kvkcxmA.exe
  2⤵
  PID:5244
- C:\Windows\System\lLFOUGQ.exe
  C:\Windows\System\lLFOUGQ.exe
  2⤵
  PID:1192
- C:\Windows\System\txzkzTg.exe
  C:\Windows\System\txzkzTg.exe
  2⤵
  PID:12856
- C:\Windows\System\nrFuMru.exe
  C:\Windows\System\nrFuMru.exe
  2⤵
  PID:7892
- C:\Windows\System\QauUMrs.exe
  C:\Windows\System\QauUMrs.exe
  2⤵
  PID:408
- C:\Windows\System\RTVAmXO.exe
  C:\Windows\System\RTVAmXO.exe
  2⤵
  PID:2592
- C:\Windows\System\bidYwlx.exe
  C:\Windows\System\bidYwlx.exe
  2⤵
  PID:11720
- C:\Windows\System\rhjCUmo.exe
  C:\Windows\System\rhjCUmo.exe
  2⤵
  PID:13640
- C:\Windows\System\zxDJiHZ.exe
  C:\Windows\System\zxDJiHZ.exe
  2⤵
  PID:13380
- C:\Windows\System\BWqgwZS.exe
  C:\Windows\System\BWqgwZS.exe
  2⤵
  PID:14216
- C:\Windows\System\FxoyuiL.exe
  C:\Windows\System\FxoyuiL.exe
  2⤵
  PID:8620
- C:\Windows\System\zcrPTdd.exe
  C:\Windows\System\zcrPTdd.exe
  2⤵
  PID:13844
- C:\Windows\System\rDQktRR.exe
  C:\Windows\System\rDQktRR.exe
  2⤵
  PID:13764
- C:\Windows\System\PCymCAu.exe
  C:\Windows\System\PCymCAu.exe
  2⤵
  PID:10220
- C:\Windows\System\CHUPbEA.exe
  C:\Windows\System\CHUPbEA.exe
  2⤵
  PID:13508
- C:\Windows\System\miylOAw.exe
  C:\Windows\System\miylOAw.exe
  2⤵
  PID:12236
- C:\Windows\System\mkZZDdk.exe
  C:\Windows\System\mkZZDdk.exe
  2⤵
  PID:3232
- C:\Windows\System\LPfINgZ.exe
  C:\Windows\System\LPfINgZ.exe
  2⤵
  PID:13440
- C:\Windows\System\mOYKxhL.exe
  C:\Windows\System\mOYKxhL.exe
  2⤵
  PID:13544
- C:\Windows\System\fDprQBa.exe
  C:\Windows\System\fDprQBa.exe
  2⤵
  PID:13584
- C:\Windows\System\TIvExrm.exe
  C:\Windows\System\TIvExrm.exe
  2⤵
  PID:12384
- C:\Windows\System\WsRKRni.exe
  C:\Windows\System\WsRKRni.exe
  2⤵
  PID:13864
- C:\Windows\System\kptQmVj.exe
  C:\Windows\System\kptQmVj.exe
  2⤵
  PID:13920
- C:\Windows\System\dIldSKE.exe
  C:\Windows\System\dIldSKE.exe
  2⤵
  PID:13820
- C:\Windows\System\NhDfOWM.exe
  C:\Windows\System\NhDfOWM.exe
  2⤵
  PID:13520
- C:\Windows\System\eSSxiew.exe
  C:\Windows\System\eSSxiew.exe
  2⤵
  PID:10112
- C:\Windows\System\VHvwbwz.exe
  C:\Windows\System\VHvwbwz.exe
  2⤵
  PID:10528
- C:\Windows\System\SvksALE.exe
  C:\Windows\System\SvksALE.exe
  2⤵
  PID:9576
- C:\Windows\System\yiWgzwT.exe
  C:\Windows\System\yiWgzwT.exe
  2⤵
  PID:10672
- C:\Windows\System\kCySLxJ.exe
  C:\Windows\System\kCySLxJ.exe
  2⤵
  PID:13808
- C:\Windows\System\pFLiOOj.exe
  C:\Windows\System\pFLiOOj.exe
  2⤵
  PID:13616
- C:\Windows\System\YwuCrYc.exe
  C:\Windows\System\YwuCrYc.exe
  2⤵
  PID:13540
- C:\Windows\System\hkcGVXF.exe
  C:\Windows\System\hkcGVXF.exe
  2⤵
  PID:2400
- C:\Windows\System\pjnhqGK.exe
  C:\Windows\System\pjnhqGK.exe
  2⤵
  PID:12136
- C:\Windows\System\UkconMc.exe
  C:\Windows\System\UkconMc.exe
  2⤵
  PID:928
- C:\Windows\System\RfmiQkd.exe
  C:\Windows\System\RfmiQkd.exe
  2⤵
  PID:13748
- C:\Windows\System\RmHjjLp.exe
  C:\Windows\System\RmHjjLp.exe
  2⤵
  PID:12508
- C:\Windows\System\ggbAnrH.exe
  C:\Windows\System\ggbAnrH.exe
  2⤵
  PID:10452
- C:\Windows\System\HIvBhpy.exe
  C:\Windows\System\HIvBhpy.exe
  2⤵
  PID:9780
- C:\Windows\System\QlqiILC.exe
  C:\Windows\System\QlqiILC.exe
  2⤵
  PID:10092
- C:\Windows\System\qBzWWwe.exe
  C:\Windows\System\qBzWWwe.exe
  2⤵
  PID:13384
- C:\Windows\System\dGOQrWT.exe
  C:\Windows\System\dGOQrWT.exe
  2⤵
  PID:13408
- C:\Windows\System\Cowprwo.exe
  C:\Windows\System\Cowprwo.exe
  2⤵
  PID:13908
- C:\Windows\System\HCNqjJd.exe
  C:\Windows\System\HCNqjJd.exe
  2⤵
  PID:14208
- C:\Windows\System\JfOvOFD.exe
  C:\Windows\System\JfOvOFD.exe
  2⤵
  PID:13944
- C:\Windows\System\bvuqbUA.exe
  C:\Windows\System\bvuqbUA.exe
  2⤵
  PID:4444
- C:\Windows\System\EbEjUDb.exe
  C:\Windows\System\EbEjUDb.exe
  2⤵
  PID:12440
- C:\Windows\System\nDbnBgl.exe
  C:\Windows\System\nDbnBgl.exe
  2⤵
  PID:14104
- C:\Windows\System\PBsbpPE.exe
  C:\Windows\System\PBsbpPE.exe
  2⤵
  PID:13696
- C:\Windows\System\FwPGRyB.exe
  C:\Windows\System\FwPGRyB.exe
  2⤵
  PID:4476
- C:\Windows\System\PjqLKwY.exe
  C:\Windows\System\PjqLKwY.exe
  2⤵
  PID:13608
- C:\Windows\System\qEhjZlj.exe
  C:\Windows\System\qEhjZlj.exe
  2⤵
  PID:9292
- C:\Windows\System\AhsUyHM.exe
  C:\Windows\System\AhsUyHM.exe
  2⤵
  PID:4500
- C:\Windows\System\NhpksVb.exe
  C:\Windows\System\NhpksVb.exe
  2⤵
  PID:11176
- C:\Windows\System\YDIgdUf.exe
  C:\Windows\System\YDIgdUf.exe
  2⤵
  PID:13444
- C:\Windows\System\rwARQzI.exe
  C:\Windows\System\rwARQzI.exe
  2⤵
  PID:468
- C:\Windows\System\OYmIjgn.exe
  C:\Windows\System\OYmIjgn.exe
  2⤵
  PID:14224
- C:\Windows\System\vAzIoqf.exe
  C:\Windows\System\vAzIoqf.exe
  2⤵
  PID:13684
- C:\Windows\System\VAKFQlR.exe
  C:\Windows\System\VAKFQlR.exe
  2⤵
  PID:3652
- C:\Windows\System\BYaEspv.exe
  C:\Windows\System\BYaEspv.exe
  2⤵
  PID:2476
- C:\Windows\System\VegFtQQ.exe
  C:\Windows\System\VegFtQQ.exe
  2⤵
  PID:6828
- C:\Windows\System\zTWZNEn.exe
  C:\Windows\System\zTWZNEn.exe
  2⤵
  PID:11024
- C:\Windows\System\OhRRkxa.exe
  C:\Windows\System\OhRRkxa.exe
  2⤵
  PID:13424
- C:\Windows\System\bbhuwXQ.exe
  C:\Windows\System\bbhuwXQ.exe
  2⤵
  PID:9296
- C:\Windows\System\hnedpqD.exe
  C:\Windows\System\hnedpqD.exe
  2⤵
  PID:1272
- C:\Windows\System\TSOUFqz.exe
  C:\Windows\System\TSOUFqz.exe
  2⤵
  PID:4940
- C:\Windows\System\HoiXLKx.exe
  C:\Windows\System\HoiXLKx.exe
  2⤵
  PID:3376
- C:\Windows\System\kDBbFJx.exe
  C:\Windows\System\kDBbFJx.exe
  2⤵
  PID:3076
- C:\Windows\System\KyNhnhP.exe
  C:\Windows\System\KyNhnhP.exe
  2⤵
  PID:3668
- C:\Windows\System\aagMjvT.exe
  C:\Windows\System\aagMjvT.exe
  2⤵
  PID:3608
- C:\Windows\System\BjmmVtR.exe
  C:\Windows\System\BjmmVtR.exe
  2⤵
  PID:4852
- C:\Windows\System\jQvxJnQ.exe
  C:\Windows\System\jQvxJnQ.exe
  2⤵
  PID:3944
- C:\Windows\System\JMgxcpo.exe
  C:\Windows\System\JMgxcpo.exe
  2⤵
  PID:4772
- C:\Windows\System\bFhmgwj.exe
  C:\Windows\System\bFhmgwj.exe
  2⤵
  PID:2688
- C:\Windows\System\tcXSwjk.exe
  C:\Windows\System\tcXSwjk.exe
  2⤵
  PID:7676
- C:\Windows\System\VzYtPlK.exe
  C:\Windows\System\VzYtPlK.exe
  2⤵
  PID:12752
- C:\Windows\System\UumjQhn.exe
  C:\Windows\System\UumjQhn.exe
  2⤵
  PID:11808
- C:\Windows\System\wsLylYI.exe
  C:\Windows\System\wsLylYI.exe
  2⤵
  PID:12460
- C:\Windows\System\OXwrSnH.exe
  C:\Windows\System\OXwrSnH.exe
  2⤵
  PID:8560
- C:\Windows\System\JjFzOMH.exe
  C:\Windows\System\JjFzOMH.exe
  2⤵
  PID:6460
- C:\Windows\System\TcyWuFz.exe
  C:\Windows\System\TcyWuFz.exe
  2⤵
  PID:12248
- C:\Windows\System\mZUauSv.exe
  C:\Windows\System\mZUauSv.exe
  2⤵
  PID:7692
- C:\Windows\System\vLlpfzN.exe
  C:\Windows\System\vLlpfzN.exe
  2⤵
  PID:12576
- C:\Windows\System\VUUktDg.exe
  C:\Windows\System\VUUktDg.exe
  2⤵
  PID:12804
- C:\Windows\System\HuxSEJa.exe
  C:\Windows\System\HuxSEJa.exe
  2⤵
  PID:13236
- C:\Windows\System\ojiZZsa.exe
  C:\Windows\System\ojiZZsa.exe
  2⤵
  PID:6200
- C:\Windows\System\RfTLyEK.exe
  C:\Windows\System\RfTLyEK.exe
  2⤵
  PID:11452
- C:\Windows\System\ALSpjmM.exe
  C:\Windows\System\ALSpjmM.exe
  2⤵
  PID:11480
- C:\Windows\System\dZcsRjo.exe
  C:\Windows\System\dZcsRjo.exe
  2⤵
  PID:11596
- C:\Windows\System\BISlUqZ.exe
  C:\Windows\System\BISlUqZ.exe
  2⤵
  PID:11980
- C:\Windows\System\mfWKHAW.exe
  C:\Windows\System\mfWKHAW.exe
  2⤵
  PID:12140
- C:\Windows\System\yFgnqmU.exe
  C:\Windows\System\yFgnqmU.exe
  2⤵
  PID:5432
- C:\Windows\System\GWywPxr.exe
  C:\Windows\System\GWywPxr.exe
  2⤵
  PID:6060
- C:\Windows\System\zmXkZtb.exe
  C:\Windows\System\zmXkZtb.exe
  2⤵
  PID:3520
- C:\Windows\System\oSdjquB.exe
  C:\Windows\System\oSdjquB.exe
  2⤵
  PID:5804
- C:\Windows\System\rxqBrvZ.exe
  C:\Windows\System\rxqBrvZ.exe
  2⤵
  PID:5996
- C:\Windows\System\HpDlRAZ.exe
  C:\Windows\System\HpDlRAZ.exe
  2⤵
  PID:13604
- C:\Windows\System\KEVNIQY.exe
  C:\Windows\System\KEVNIQY.exe
  2⤵
  PID:6068
- C:\Windows\System\znVPKRl.exe
  C:\Windows\System\znVPKRl.exe
  2⤵
  PID:5772
- C:\Windows\System\VjHkadN.exe
  C:\Windows\System\VjHkadN.exe
  2⤵
  PID:3780
- C:\Windows\System\PHDrPAO.exe
  C:\Windows\System\PHDrPAO.exe
  2⤵
  PID:6556
- C:\Windows\System\SEjOKyn.exe
  C:\Windows\System\SEjOKyn.exe
  2⤵
  PID:6000
- C:\Windows\System\bFTjOPq.exe
  C:\Windows\System\bFTjOPq.exe
  2⤵
  PID:4176
- C:\Windows\System\lWIfDyH.exe
  C:\Windows\System\lWIfDyH.exe
  2⤵
  PID:5416
- C:\Windows\System\kioHPBL.exe
  C:\Windows\System\kioHPBL.exe
  2⤵
  PID:3156
- C:\Windows\System\pUMVpDB.exe
  C:\Windows\System\pUMVpDB.exe
  2⤵
  PID:2984
- C:\Windows\System\pPdlkki.exe
  C:\Windows\System\pPdlkki.exe
  2⤵
  PID:12724
- C:\Windows\System\kFzheSP.exe
  C:\Windows\System\kFzheSP.exe
  2⤵
  PID:6492
- C:\Windows\System\otXZipF.exe
  C:\Windows\System\otXZipF.exe
  2⤵
  PID:6872
- C:\Windows\System\WdMevNr.exe
  C:\Windows\System\WdMevNr.exe
  2⤵
  PID:6820
- C:\Windows\System\Obusjcx.exe
  C:\Windows\System\Obusjcx.exe
  2⤵
  PID:12756
- C:\Windows\System\TUyqoEP.exe
  C:\Windows\System\TUyqoEP.exe
  2⤵
  PID:12952
- C:\Windows\System\YZHajxC.exe
  C:\Windows\System\YZHajxC.exe
  2⤵
  PID:10264
- C:\Windows\System\lSHWCUr.exe
  C:\Windows\System\lSHWCUr.exe
  2⤵
  PID:13000
- C:\Windows\System\tzcTaPd.exe
  C:\Windows\System\tzcTaPd.exe
  2⤵
  PID:5356
- C:\Windows\System\yRFfTIz.exe
  C:\Windows\System\yRFfTIz.exe
  2⤵
  PID:13220
- C:\Windows\System\AuUtaGK.exe
  C:\Windows\System\AuUtaGK.exe
  2⤵
  PID:6840
- C:\Windows\System\GeDflVz.exe
  C:\Windows\System\GeDflVz.exe
  2⤵
  PID:6900
- C:\Windows\System\WxjKXiu.exe
  C:\Windows\System\WxjKXiu.exe
  2⤵
  PID:5612
- C:\Windows\System\ALMGwzz.exe
  C:\Windows\System\ALMGwzz.exe
  2⤵
  PID:4584
- C:\Windows\System\jDlHDyv.exe
  C:\Windows\System\jDlHDyv.exe
  2⤵
  PID:7252
- C:\Windows\System\woJVGHp.exe
  C:\Windows\System\woJVGHp.exe
  2⤵
  PID:11700
- C:\Windows\System\HjEVuHa.exe
  C:\Windows\System\HjEVuHa.exe
  2⤵
  PID:12120
- C:\Windows\System\WFedFKH.exe
  C:\Windows\System\WFedFKH.exe
  2⤵
  PID:7256
- C:\Windows\System\QLlEpjl.exe
  C:\Windows\System\QLlEpjl.exe
  2⤵
  PID:6420
- C:\Windows\System\SMWctUU.exe
  C:\Windows\System\SMWctUU.exe
  2⤵
  PID:5688
- C:\Windows\System\PoOtoEF.exe
  C:\Windows\System\PoOtoEF.exe
  2⤵
  PID:6784
- C:\Windows\System\rFgSduZ.exe
  C:\Windows\System\rFgSduZ.exe
  2⤵
  PID:1652
- C:\Windows\System\umdvGZX.exe
  C:\Windows\System\umdvGZX.exe
  2⤵
  PID:5460
- C:\Windows\System\AEHEBiH.exe
  C:\Windows\System\AEHEBiH.exe
  2⤵
  PID:6260
- C:\Windows\System\OxFBinS.exe
  C:\Windows\System\OxFBinS.exe
  2⤵
  PID:4428
- C:\Windows\System\nXpAlMn.exe
  C:\Windows\System\nXpAlMn.exe
  2⤵
  PID:5576
- C:\Windows\System\zMWXKiw.exe
  C:\Windows\System\zMWXKiw.exe
  2⤵
  PID:7376
- C:\Windows\System\OZBTJQQ.exe
  C:\Windows\System\OZBTJQQ.exe
  2⤵
  PID:6732
- C:\Windows\System\EWoFtlU.exe
  C:\Windows\System\EWoFtlU.exe
  2⤵
  PID:7136
- C:\Windows\System\QJYApyO.exe
  C:\Windows\System\QJYApyO.exe
  2⤵
  PID:10252
- C:\Windows\System\zzJDgbF.exe
  C:\Windows\System\zzJDgbF.exe
  2⤵
  PID:3704
- C:\Windows\System\eZNZHJP.exe
  C:\Windows\System\eZNZHJP.exe
  2⤵
  PID:10288
- C:\Windows\System\ZrHMVpV.exe
  C:\Windows\System\ZrHMVpV.exe
  2⤵
  PID:2264
- C:\Windows\System\HIkhedw.exe
  C:\Windows\System\HIkhedw.exe
  2⤵
  PID:10648
- C:\Windows\System\TLQpSJw.exe
  C:\Windows\System\TLQpSJw.exe
  2⤵
  PID:6896
- C:\Windows\System\tlhvYoh.exe
  C:\Windows\System\tlhvYoh.exe
  2⤵
  PID:8576
- C:\Windows\System\ykUhzah.exe
  C:\Windows\System\ykUhzah.exe
  2⤵
  PID:8072
- C:\Windows\System\zUCNDEI.exe
  C:\Windows\System\zUCNDEI.exe
  2⤵
  PID:6776
- C:\Windows\System\QCNSvrO.exe
  C:\Windows\System\QCNSvrO.exe
  2⤵
  PID:12816
- C:\Windows\System\JJzvWAo.exe
  C:\Windows\System\JJzvWAo.exe
  2⤵
  PID:7088
- C:\Windows\System\sxLCHNf.exe
  C:\Windows\System\sxLCHNf.exe
  2⤵
  PID:6140
- C:\Windows\System\xxZyUsm.exe
  C:\Windows\System\xxZyUsm.exe
  2⤵
  PID:6544
- C:\Windows\System\EoFeAWu.exe
  C:\Windows\System\EoFeAWu.exe
  2⤵
  PID:11584
- C:\Windows\System\IsQmuIq.exe
  C:\Windows\System\IsQmuIq.exe
  2⤵
  PID:3924
- C:\Windows\System\kjkxMhd.exe
  C:\Windows\System\kjkxMhd.exe
  2⤵
  PID:5336
- C:\Windows\System\gEyDPen.exe
  C:\Windows\System\gEyDPen.exe
  2⤵
  PID:7524
- C:\Windows\System\nxQizXP.exe
  C:\Windows\System\nxQizXP.exe
  2⤵
  PID:8212
- C:\Windows\System\mFEcGJg.exe
  C:\Windows\System\mFEcGJg.exe
  2⤵
  PID:7564
- C:\Windows\System\BbeqbdJ.exe
  C:\Windows\System\BbeqbdJ.exe
  2⤵
  PID:8156
- C:\Windows\System\aQnYZNz.exe
  C:\Windows\System\aQnYZNz.exe
  2⤵
  PID:7292
- C:\Windows\System\zNqbOnw.exe
  C:\Windows\System\zNqbOnw.exe
  2⤵
  PID:9240
- C:\Windows\System\jUgeKDa.exe
  C:\Windows\System\jUgeKDa.exe
  2⤵
  PID:6608
- C:\Windows\System\tACdTdj.exe
  C:\Windows\System\tACdTdj.exe
  2⤵
  PID:548
- C:\Windows\System\AffUCJF.exe
  C:\Windows\System\AffUCJF.exe
  2⤵
  PID:14144
- C:\Windows\System\TnltDWZ.exe
  C:\Windows\System\TnltDWZ.exe
  2⤵
  PID:9004
- C:\Windows\System\tEIVrbz.exe
  C:\Windows\System\tEIVrbz.exe
  2⤵
  PID:9036
- C:\Windows\System\BXTmOWC.exe
  C:\Windows\System\BXTmOWC.exe
  2⤵
  PID:8412
- C:\Windows\System\hKHfmlt.exe
  C:\Windows\System\hKHfmlt.exe
  2⤵
  PID:9848
- C:\Windows\System\ElFDEKR.exe
  C:\Windows\System\ElFDEKR.exe
  2⤵
  PID:13012
- C:\Windows\System\YFwvACN.exe
  C:\Windows\System\YFwvACN.exe
  2⤵
  PID:8824
- C:\Windows\System\xjrKlOt.exe
  C:\Windows\System\xjrKlOt.exe
  2⤵
  PID:7976
- C:\Windows\System\CmhPPtB.exe
  C:\Windows\System\CmhPPtB.exe
  2⤵
  PID:5420
- C:\Windows\System\faGQZVP.exe
  C:\Windows\System\faGQZVP.exe
  2⤵
  PID:9460
- C:\Windows\System\ZvZiZaK.exe
  C:\Windows\System\ZvZiZaK.exe
  2⤵
  PID:6864
- C:\Windows\System\ePjLfky.exe
  C:\Windows\System\ePjLfky.exe
  2⤵
  PID:9520
- C:\Windows\System\HoCxouI.exe
  C:\Windows\System\HoCxouI.exe
  2⤵
  PID:10568
- C:\Windows\System\Fovzvch.exe
  C:\Windows\System\Fovzvch.exe
  2⤵
  PID:6796
- C:\Windows\System\IvnGdiG.exe
  C:\Windows\System\IvnGdiG.exe
  2⤵
  PID:9684
- C:\Windows\System\eNPVeTo.exe
  C:\Windows\System\eNPVeTo.exe
  2⤵
  PID:9732
- C:\Windows\System\BJxInhm.exe
  C:\Windows\System\BJxInhm.exe
  2⤵
  PID:9896
- C:\Windows\System\YlKTQfJ.exe
  C:\Windows\System\YlKTQfJ.exe
  2⤵
  PID:4036
- C:\Windows\System\SIQwBpw.exe
  C:\Windows\System\SIQwBpw.exe
  2⤵
  PID:10024
- C:\Windows\System\CARGaBQ.exe
  C:\Windows\System\CARGaBQ.exe
  2⤵
  PID:5456
- C:\Windows\System\WyLCLCX.exe
  C:\Windows\System\WyLCLCX.exe
  2⤵
  PID:7492
- C:\Windows\System\BLpHMEa.exe
  C:\Windows\System\BLpHMEa.exe
  2⤵
  PID:8480
- C:\Windows\System\iekqJJQ.exe
  C:\Windows\System\iekqJJQ.exe
  2⤵
  PID:2196
- C:\Windows\System\EmPEERz.exe
  C:\Windows\System\EmPEERz.exe
  2⤵
  PID:9180
- C:\Windows\System\znzlVLy.exe
  C:\Windows\System\znzlVLy.exe
  2⤵
  PID:11012
- C:\Windows\System\ionJXNV.exe
  C:\Windows\System\ionJXNV.exe
  2⤵
  PID:7000
- C:\Windows\System\ExjeVzG.exe
  C:\Windows\System\ExjeVzG.exe
  2⤵
  PID:5340
- C:\Windows\System\YsJMbRY.exe
  C:\Windows\System\YsJMbRY.exe
  2⤵
  PID:9532
- C:\Windows\System\senmHHV.exe
  C:\Windows\System\senmHHV.exe
  2⤵
  PID:7428
- C:\Windows\System\nsobKci.exe
  C:\Windows\System\nsobKci.exe
  2⤵
  PID:12156
- C:\Windows\System\qvNhYPp.exe
  C:\Windows\System\qvNhYPp.exe
  2⤵
  PID:7288
- C:\Windows\System\JGoGqZs.exe
  C:\Windows\System\JGoGqZs.exe
  2⤵
  PID:6612
- C:\Windows\System\pYCweWz.exe
  C:\Windows\System\pYCweWz.exe
  2⤵
  PID:8224
- C:\Windows\System\BfPoTAU.exe
  C:\Windows\System\BfPoTAU.exe
  2⤵
  PID:12892
- C:\Windows\System\ZyMRmvS.exe
  C:\Windows\System\ZyMRmvS.exe
  2⤵
  PID:4340
- C:\Windows\System\vtXJtkv.exe
  C:\Windows\System\vtXJtkv.exe
  2⤵
  PID:9380
- C:\Windows\System\eWKeCxl.exe
  C:\Windows\System\eWKeCxl.exe
  2⤵
  PID:10736
- C:\Windows\System\xGNxcht.exe
  C:\Windows\System\xGNxcht.exe
  2⤵
  PID:8684
- C:\Windows\System\IswxmlO.exe
  C:\Windows\System\IswxmlO.exe
  2⤵
  PID:10992
- C:\Windows\System\wqKNCzr.exe
  C:\Windows\System\wqKNCzr.exe
  2⤵
  PID:13004
- C:\Windows\System\UrwBcBp.exe
  C:\Windows\System\UrwBcBp.exe
  2⤵
  PID:13064
- C:\Windows\System\sDsbkyv.exe
  C:\Windows\System\sDsbkyv.exe
  2⤵
  PID:9920
- C:\Windows\System\pcDMAUG.exe
  C:\Windows\System\pcDMAUG.exe
  2⤵
  PID:8152
- C:\Windows\System\XTOpDjv.exe
  C:\Windows\System\XTOpDjv.exe
  2⤵
  PID:11124
- C:\Windows\System\UNOWDYt.exe
  C:\Windows\System\UNOWDYt.exe
  2⤵
  PID:5756
- C:\Windows\System\yEqASyf.exe
  C:\Windows\System\yEqASyf.exe
  2⤵
  PID:8908
- C:\Windows\System\Tfhbgnr.exe
  C:\Windows\System\Tfhbgnr.exe
  2⤵
  PID:9900
- C:\Windows\System\SZlIHWu.exe
  C:\Windows\System\SZlIHWu.exe
  2⤵
  PID:5736
- C:\Windows\System\ObOigrC.exe
  C:\Windows\System\ObOigrC.exe
  2⤵
  PID:11340
- C:\Windows\System\gxwZTgL.exe
  C:\Windows\System\gxwZTgL.exe
  2⤵
  PID:7500
- C:\Windows\System\AlnlwkY.exe
  C:\Windows\System\AlnlwkY.exe
  2⤵
  PID:7948
- C:\Windows\System\zpMWTTi.exe
  C:\Windows\System\zpMWTTi.exe
  2⤵
  PID:7768
- C:\Windows\System\axoElmY.exe
  C:\Windows\System\axoElmY.exe
  2⤵
  PID:11940
- C:\Windows\System\EFnijcg.exe
  C:\Windows\System\EFnijcg.exe
  2⤵
  PID:11500
- C:\Windows\System\TicyjXg.exe
  C:\Windows\System\TicyjXg.exe
  2⤵
  PID:10944
- C:\Windows\System\sKPYMXy.exe
  C:\Windows\System\sKPYMXy.exe
  2⤵
  PID:11704
- C:\Windows\System\OvFksCn.exe
  C:\Windows\System\OvFksCn.exe
  2⤵
  PID:10852
- C:\Windows\System\Xrojdnv.exe
  C:\Windows\System\Xrojdnv.exe
  2⤵
  PID:11852
- C:\Windows\System\ORvwKFX.exe
  C:\Windows\System\ORvwKFX.exe
  2⤵
  PID:10712
- C:\Windows\System\LBhTSBJ.exe
  C:\Windows\System\LBhTSBJ.exe
  2⤵
  PID:10052
- C:\Windows\System\NDXWzdl.exe
  C:\Windows\System\NDXWzdl.exe
  2⤵
  PID:12152
- C:\Windows\System\ZkTDffM.exe
  C:\Windows\System\ZkTDffM.exe
  2⤵
  PID:10400
- C:\Windows\System\dPgDbEO.exe
  C:\Windows\System\dPgDbEO.exe
  2⤵
  PID:12968
- C:\Windows\System\KasgSbb.exe
  C:\Windows\System\KasgSbb.exe
  2⤵
  PID:10520
- C:\Windows\System\XHTCVux.exe
  C:\Windows\System\XHTCVux.exe
  2⤵
  PID:4460
- C:\Windows\System\dzKPgBT.exe
  C:\Windows\System\dzKPgBT.exe
  2⤵
  PID:10964
- C:\Windows\System\YEoujrS.exe
  C:\Windows\System\YEoujrS.exe
  2⤵
  PID:10148
- C:\Windows\System\VSBwVOt.exe
  C:\Windows\System\VSBwVOt.exe
  2⤵
  PID:7340
- C:\Windows\System\wGpkdiM.exe
  C:\Windows\System\wGpkdiM.exe
  2⤵
  PID:5812
- C:\Windows\System\yjFTKND.exe
  C:\Windows\System\yjFTKND.exe
  2⤵
  PID:11244
- C:\Windows\System\tsjWFvM.exe
  C:\Windows\System\tsjWFvM.exe
  2⤵
  PID:10136
- C:\Windows\System\SUkeRbP.exe
  C:\Windows\System\SUkeRbP.exe
  2⤵
  PID:13632
- C:\Windows\System\wblCKop.exe
  C:\Windows\System\wblCKop.exe
  2⤵
  PID:13256
- C:\Windows\System\VDvEvFf.exe
  C:\Windows\System\VDvEvFf.exe
  2⤵
  PID:7172
- C:\Windows\System\cqUgLlH.exe
  C:\Windows\System\cqUgLlH.exe
  2⤵
  PID:9452
- C:\Windows\System\psIPPMC.exe
  C:\Windows\System\psIPPMC.exe
  2⤵
  PID:13120
- C:\Windows\System\fDeuxnd.exe
  C:\Windows\System\fDeuxnd.exe
  2⤵
  PID:8984
- C:\Windows\System\GulCzMI.exe
  C:\Windows\System\GulCzMI.exe
  2⤵
  PID:5792
- C:\Windows\System\neByKjv.exe
  C:\Windows\System\neByKjv.exe
  2⤵
  PID:6328
- C:\Windows\System\nOMOqwr.exe
  C:\Windows\System\nOMOqwr.exe
  2⤵
  PID:11432
- C:\Windows\System\agHwaWD.exe
  C:\Windows\System\agHwaWD.exe
  2⤵
  PID:11556
- C:\Windows\System\fbJrAIC.exe
  C:\Windows\System\fbJrAIC.exe
  2⤵
  PID:9080
- C:\Windows\System\Tmaiucr.exe
  C:\Windows\System\Tmaiucr.exe
  2⤵
  PID:11972
- C:\Windows\System\pbWHaej.exe
  C:\Windows\System\pbWHaej.exe
  2⤵
  PID:10804
- C:\Windows\System\bOOrtNl.exe
  C:\Windows\System\bOOrtNl.exe
  2⤵
  PID:12548
- C:\Windows\System\pssaDaq.exe
  C:\Windows\System\pssaDaq.exe
  2⤵
  PID:12684
- C:\Windows\System\nTgzqcm.exe
  C:\Windows\System\nTgzqcm.exe
  2⤵
  PID:6972
- C:\Windows\System\NLccwSA.exe
  C:\Windows\System\NLccwSA.exe
  2⤵
  PID:8436
- C:\Windows\System\xNmUVfn.exe
  C:\Windows\System\xNmUVfn.exe
  2⤵
  PID:8912
- C:\Windows\System\nCvFQTX.exe
  C:\Windows\System\nCvFQTX.exe
  2⤵
  PID:10836
- C:\Windows\System\JQnsiIe.exe
  C:\Windows\System\JQnsiIe.exe
  2⤵
  PID:13644
- C:\Windows\System\XLegBjb.exe
  C:\Windows\System\XLegBjb.exe
  2⤵
  PID:7600
- C:\Windows\System\SCpgoXO.exe
  C:\Windows\System\SCpgoXO.exe
  2⤵
  PID:5956
- C:\Windows\System\ndDfKjG.exe
  C:\Windows\System\ndDfKjG.exe
  2⤵
  PID:9076
- C:\Windows\System\ZYipUqI.exe
  C:\Windows\System\ZYipUqI.exe
  2⤵
  PID:5388
- C:\Windows\System\mQPjufb.exe
  C:\Windows\System\mQPjufb.exe
  2⤵
  PID:9112
- C:\Windows\System\GsMdKwO.exe
  C:\Windows\System\GsMdKwO.exe
  2⤵
  PID:11296
- C:\Windows\System\PqAoduG.exe
  C:\Windows\System\PqAoduG.exe
  2⤵
  PID:13216
- C:\Windows\System\OgPCBqk.exe
  C:\Windows\System\OgPCBqk.exe
  2⤵
  PID:6364
- C:\Windows\System\eaoEtVu.exe
  C:\Windows\System\eaoEtVu.exe
  2⤵
  PID:11464
- C:\Windows\System\CxcQmbl.exe
  C:\Windows\System\CxcQmbl.exe
  2⤵
  PID:9596
- C:\Windows\System\XMpAvJk.exe
  C:\Windows\System\XMpAvJk.exe
  2⤵
  PID:1740
- C:\Windows\System\QuDdUFx.exe
  C:\Windows\System\QuDdUFx.exe
  2⤵
  PID:1928
- C:\Windows\System\ghZNeSB.exe
  C:\Windows\System\ghZNeSB.exe
  2⤵
  PID:12332
- C:\Windows\System\inbFAXN.exe
  C:\Windows\System\inbFAXN.exe
  2⤵
  PID:10108
- C:\Windows\System\DRrOUvS.exe
  C:\Windows\System\DRrOUvS.exe
  2⤵
  PID:7276
- C:\Windows\System\tffUDlU.exe
  C:\Windows\System\tffUDlU.exe
  2⤵
  PID:1912
- C:\Windows\System\rpIpABH.exe
  C:\Windows\System\rpIpABH.exe
  2⤵
  PID:11992
- C:\Windows\System\yBErqvF.exe
  C:\Windows\System\yBErqvF.exe
  2⤵
  PID:3964
- C:\Windows\System\Woubheq.exe
  C:\Windows\System\Woubheq.exe
  2⤵
  PID:14388
- C:\Windows\System\ETVKLuy.exe
  C:\Windows\System\ETVKLuy.exe
  2⤵
  PID:14404
- C:\Windows\System\fCAMcHK.exe
  C:\Windows\System\fCAMcHK.exe
  2⤵
  PID:14420
- C:\Windows\System\MjiZJiJ.exe
  C:\Windows\System\MjiZJiJ.exe
  2⤵
  PID:14440
- C:\Windows\System\iKpCfRg.exe
  C:\Windows\System\iKpCfRg.exe
  2⤵
  PID:14456
- C:\Windows\System\fwIDIFL.exe
  C:\Windows\System\fwIDIFL.exe
  2⤵
  PID:14500
- C:\Windows\System\lSEBEsG.exe
  C:\Windows\System\lSEBEsG.exe
  2⤵
  PID:14552
- C:\Windows\System\CJXjtCk.exe
  C:\Windows\System\CJXjtCk.exe
  2⤵
  PID:14616
- C:\Windows\System\JtOLknt.exe
  C:\Windows\System\JtOLknt.exe
  2⤵
  PID:14652
- C:\Windows\System\jeEwTiG.exe
  C:\Windows\System\jeEwTiG.exe
  2⤵
  PID:14684
- C:\Windows\System\kJOfqvv.exe
  C:\Windows\System\kJOfqvv.exe
  2⤵
  PID:14700
- C:\Windows\System\jPPwpRt.exe
  C:\Windows\System\jPPwpRt.exe
  2⤵
  PID:14728
- C:\Windows\System\iGiGvXx.exe
  C:\Windows\System\iGiGvXx.exe
  2⤵
  PID:14760
- C:\Windows\System\HcfcVzx.exe
  C:\Windows\System\HcfcVzx.exe
  2⤵
  PID:14788
- C:\Windows\System\XkbPGYT.exe
  C:\Windows\System\XkbPGYT.exe
  2⤵
  PID:14816
- C:\Windows\System\ZdItzEl.exe
  C:\Windows\System\ZdItzEl.exe
  2⤵
  PID:14852
- C:\Windows\System\GapgOtA.exe
  C:\Windows\System\GapgOtA.exe
  2⤵
  PID:14884
- C:\Windows\System\lBEORRY.exe
  C:\Windows\System\lBEORRY.exe
  2⤵
  PID:14912
- C:\Windows\System\goQkXFz.exe
  C:\Windows\System\goQkXFz.exe
  2⤵
  PID:14944
- C:\Windows\System\YwuObuf.exe
  C:\Windows\System\YwuObuf.exe
  2⤵
  PID:14972
- C:\Windows\System\ikTwiPS.exe
  C:\Windows\System\ikTwiPS.exe
  2⤵
  PID:15000
- C:\Windows\System\MLlwuRA.exe
  C:\Windows\System\MLlwuRA.exe
  2⤵
  PID:15028
- C:\Windows\System\cWpMUTE.exe
  C:\Windows\System\cWpMUTE.exe
  2⤵
  PID:15056
- C:\Windows\System\oEAJWBi.exe
  C:\Windows\System\oEAJWBi.exe
  2⤵
  PID:15084
- C:\Windows\System\vVBxOqw.exe
  C:\Windows\System\vVBxOqw.exe
  2⤵
  PID:15112
- C:\Windows\System\MMCsPXb.exe
  C:\Windows\System\MMCsPXb.exe
  2⤵
  PID:15148
- C:\Windows\System\YhuTwdU.exe
  C:\Windows\System\YhuTwdU.exe
  2⤵
  PID:15180
- C:\Windows\System\FKHbGSh.exe
  C:\Windows\System\FKHbGSh.exe
  2⤵
  PID:15196
- C:\Windows\System\BKvmJJd.exe
  C:\Windows\System\BKvmJJd.exe
  2⤵
  PID:15212
- C:\Windows\System\cNrSnzq.exe
  C:\Windows\System\cNrSnzq.exe
  2⤵
  PID:15228
- C:\Windows\System\jvzeWjc.exe
  C:\Windows\System\jvzeWjc.exe
  2⤵
  PID:15244
- C:\Windows\System\zFMIjhh.exe
  C:\Windows\System\zFMIjhh.exe
  2⤵
  PID:15284

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 720 -p 13148 -ip 13148
1⤵
PID:13640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w5grxxog.fbu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BQgwqWU.exe

Filesize
1.9MB

MD5
6cc782a845b5c270f76f248d3e2cf8d5

SHA1
802569824f637e70fa3aa380d74f2d2a9be74220

SHA256
06241114d7b94214d122c0bb40c7e695d6882325cf0ecb9b8ec5b1c8f1f02da5

SHA512
335cd5bb970a0732b34217de78d073cac57e125860c15ec44078e1445b16b03bb1acc61bf29812d216737a7ee4ddd40b9aeef639ba64cbecaa985b3b1e3492cd

Download Submit
C:\Windows\System\BxLQGbk.exe

Filesize
1.9MB

MD5
0cfa878a086e1bfaff7f28596f3b0174

SHA1
3066a02af9a38befa877eddd81d883ae0184b06f

SHA256
433c2af0ae339251e81af76719f7bd67f504037e7e59bcd3290e2f4cc903e99a

SHA512
e4209c73da3d547ac92efff3fe13e36aa6fdba162ddf11dbdc24e0ee9507b28d723e07661fbb459274f1616dcdea251aa7de672353021d68aacf379a2acbb9a3

Download Submit
C:\Windows\System\DEmwDTg.exe

Filesize
1.9MB

MD5
93e0bfddf545c0138430def446b990a5

SHA1
86106b835292e9597c4cb2ac6bea0b24426ae498

SHA256
826ebfc77c3477c0d188f468503febf720c606a1eb9922e245af8e70491a2f5b

SHA512
12c2f8cafb92d99588b82fa88d689ed523cdc435fc01619abe2b33936763e686720f3c9aa0033c200e9f07ef5a2c9d5f12a772c167c6289a672b5f4f6db58cbe

Download Submit
C:\Windows\System\DYpAnWB.exe

Filesize
1.9MB

MD5
072baeb30fcf136bd8ce5bb92ec57b9f

SHA1
f226d3c2aef370114a2b01ec7007ba917af124ac

SHA256
55598d43c35dc309a7b7fc032c10327a76d888afad70e2cd23ce33df098f8889

SHA512
74c107c0ea4c289926decb604c67f3b1147de29257e44696e14bf917f02c66329775c3ed9db7a49efb37ffa355e36b88b54059f4fd1ec99df09888918023c797

Download Submit
C:\Windows\System\DtLGruF.exe

Filesize
1.9MB

MD5
96e7198dec1d7da98698649d35b0c1a2

SHA1
3f9155bfe1632bfcc16e99f8fc102f175cf25987

SHA256
4bd5ae4d0487a9fc3861108152447cc41e407240efc1f38151809923310c66f4

SHA512
c6a66ca7c23d9db60b21ddd1412e92666aa1b3bd8cf420a7b04fdbb2242f9cd9521e490876c1afecad93836ee5372990b5c272f5614ab6dcf7556e9b569a7ec8

Download Submit
C:\Windows\System\FEgPopx.exe

Filesize
1.9MB

MD5
b7bbddb64be450ac1d87a3373a39f98c

SHA1
8911effaec4b655aaa8ca261f42d8feeb12ddddf

SHA256
985b407ee628db68ab663dfe631cee6d8b82ad55a97c22c91275ae919cb55b15

SHA512
1ff6f4aaa18ee3468cfcd3d48677e7e8b4d11862e064d4d0666f18230c84c9520e01a6780c7407c9d0823bc9f4a3da9a6563aea472f17dd76575f5de24535a07

Download Submit
C:\Windows\System\FUgDQVz.exe

Filesize
1.9MB

MD5
a359f1570e5c56f81a4382b4fe65f5f2

SHA1
f4174c4e8b02f50928a9c617dcb65411c9bae3df

SHA256
21fcccfb4b1e92124fc8ac2c99afa865637ccfc9979ac19825d800b68eb37375

SHA512
e13db170d803e0f184801c023a7fe58b82f3e20b191fc92f9430d9b63eb85f38a988ff28f35f56056ef91f293c45acceecf544ca8948584fd3851f1d159c293c

Download Submit
C:\Windows\System\GAKbMXU.exe

Filesize
1.9MB

MD5
e68ea4aaa8b5b19ebe85356d65d12a37

SHA1
df174e4c8653943a6935a7e72aa4991d9d8ae336

SHA256
b9d9272dc737218adae59ca728ec74591f1b9c58a210453c425a505fafb60538

SHA512
3b92bcfc6a3990c8b6c395e03fd3bab8fc5d2fc0db9e280d7b2659802afda7c705deb9127100f18dcb8df46d5e20b14c5173d19967eb2d1756e4e9b07dda0c68

Download Submit
C:\Windows\System\MiCRgLu.exe

Filesize
1.9MB

MD5
12462960c6eebd70734bd20899469388

SHA1
d1429d86bd86259725553ff14de3fc55ca4bab70

SHA256
c5b3fec5ded47b85d021e344162c70bf6ad0936e9a4c7242e92d621c63c0f24e

SHA512
24a98f01f6537bf60bddd5e7b0eb27b482cdd83d3cc52409ad75a89f3bf81bf8ed17474744cf3743859a4dee91ab6ab7d89e71cc4d25be20d7d97d5adb81fd8f

Download Submit
C:\Windows\System\MlJUOWr.exe

Filesize
1.9MB

MD5
bd2e178cf446f951c3a890824898bae3

SHA1
20d74c23a1fd6803250dd6dd44cf30cf039ac770

SHA256
e9da023fdced13fc6522b4bd4d32ed222b9cb3b0b5e5af628a51e541fe4805c3

SHA512
2414231a036e4b663b51a6285bc6b5ddf7191837821c112a407c0ac1c546004e9133068cda83f6d77f097cbf36f2b6990e479e8d40df9bda2dcdf354c952244b

Download Submit
C:\Windows\System\NVdhEvA.exe

Filesize
1.9MB

MD5
6741ec0b9ee330ed15814ce013dc60f3

SHA1
2c3e958f2a7c8e12440aa0b995c24e1d14caf23f

SHA256
8d1620f603076b1e10c4353b4a01f3647a9c9e44466d6a57512b516787abbf0a

SHA512
7642f8d33fd16b3da06c0dbbfede7a54bdbc06b4f7c38552e67d9dc86c76e2efc644ac352eb998bc55cfdd7893783e20e630a3573c12b988834cb84b48e541e9

Download Submit
C:\Windows\System\PhKqBVN.exe

Filesize
1.9MB

MD5
fc5fda85ddbc09fde00ec64a42d1ead6

SHA1
595a2d80e97cba8ae0caa9a59e9bbd9f8c0c2877

SHA256
dedbb4f24bf6c9436cb5479357ac925730ebb9acfee61e314c75bf3456d6f933

SHA512
2ff7cc255bfc2b569403238b884ab9de9e16a92bb87a5999231a12a705dc6591a876881cd7649aa97e851d2f9ee942f003dc899aa53b1c16ed601ac6bfa2217a

Download Submit
C:\Windows\System\QevsTLM.exe

Filesize
1.9MB

MD5
a41d082c230b0aaed8894eecaeaccbe2

SHA1
68c0b398be630fd6c3bfd2ce0bf5b1d90c6db0cb

SHA256
f66b8be5703644a984493358c7735b85eb1e2549882bfae62d6d4a237caf8525

SHA512
0836806da4fe62278b45a3fb7580d9c643e694871801cdef1773ddb41f621d295d7bbb379eb1fc23c2c56a25a8ca5fc608ff471c71adbacfb27025bac05124ca

Download Submit
C:\Windows\System\RZhhZAJ.exe

Filesize
1.9MB

MD5
5b519c458c9235d466611aab3ff5aa25

SHA1
bafd89a946b550ee0443423e1afdc507d714be14

SHA256
546fbcfcb46f5ed93e4b1d9354f46d1540ebb44f339f3eb6dbdcb707bc2528e5

SHA512
d7cbacffa6848ba880e35660c221453c59ebed385da242c62e9356f87fd2b4651d722abe995a815776d5b06bad2d76317de84176bf59a8ca88ccc52bbc8c0257

Download Submit
C:\Windows\System\TjpULbq.exe

Filesize
1.9MB

MD5
1af902fa474da03184b9895a09e28945

SHA1
d9d0fc4ae191ea421a0f91b6bbc19bb52a31ec7e

SHA256
c8203636dadfa818cdb7f1bbcebf6b02c059992aa9b10509e8e9e67350cb7e98

SHA512
5442cb3fe45c972e3e618aca697357a6256121616d4f33f1ca96235cbedcb2a6e2ca35790161967476b28a5edd632cf6f6069f8c1a1e99465736a9b24b8433b8

Download Submit
C:\Windows\System\UjgToCG.exe

Filesize
1.9MB

MD5
8483e498716c0c967fa722a30c0bb42c

SHA1
70392fd5446d0eb307206bc11e4e31c01f87fcde

SHA256
37557ee8b03204b7f73b81fe12301fe8195f4f898e479edf112034f6d0609e4a

SHA512
e27eae9bfa478c8660a85903e13802b19c6ae3358f4902c0ebc7585c99595488bfe0f5bbf9a1b3f5869f476b9015fc4a424636c4b2954bf46f25740e86579d23

Download Submit
C:\Windows\System\UwzNrzM.exe

Filesize
1.9MB

MD5
d3730088f794bf7616add7006d321a72

SHA1
d4455b7a597c41420d4db642d4aec92d94d5653d

SHA256
78d71e1e9b6751d567c5ad9cad8a2039597831550c7a85b4d37db08bcc302f07

SHA512
8553f3e23e273eec3a78c74549bf9ecf6d154200f83885cfbd4e42054ae07950dd86bdba4acd8d5783a2dcd86777f8a6f3db3af43b539d2f7016301f8a7a1363

Download Submit
C:\Windows\System\WEpwpci.exe

Filesize
1.9MB

MD5
c4bee0825a826dc41782b04f57aeabf2

SHA1
eb01221b18efdcd32c4f7f6d80ea3ee9fc57c0d4

SHA256
cdfd9b505330f42f0309423f0b09cb6a93b767e7c9d469e4b0142f36339b3e3b

SHA512
a632616d326223d817407052db18fa1ca96762076633c6774d8a158055e2adafc91cda1d6942d618a92e8b152ebee596836a1e767451d185c6e9a7c9eaf80efb

Download Submit
C:\Windows\System\WFGwfnW.exe

Filesize
1.9MB

MD5
36ae2283f7e4bb82c02017252caabf5d

SHA1
e0e0b2205967989b632a11c2bcb9b4eeaf879005

SHA256
e45e86551429738aa00f5ccf1b16b2be88d927362ca4e6c737355179b7cd2981

SHA512
2200a7e7c52599574609003cd22aefc9827703e5c91c201ea411c1ccc18f03cd0f21854423427ee6686121eadfe4459d8206dc3adb12f9d6a7f53331e978fc4c

Download Submit
C:\Windows\System\WuTAAcT.exe

Filesize
1.9MB

MD5
ab9151194a2bad418991e3c662449810

SHA1
ffb889510643cc82cf3a4dd8dd3ed9668c95aa30

SHA256
06e963fa00b092d1792fae113549edde49dd754522de2101b4791cecdf7ad5c3

SHA512
d1082b6aaccaca7e62ef51acbea9aa999f587bbfe8e41754c0a9943375576432ec1688ce5d54adf71a0e854278a1f72e0e5b07fc235054869aa32b51b00d99f6

Download Submit
C:\Windows\System\XuwSCDh.exe

Filesize
1.9MB

MD5
80b771e6a6f581655ba1c402e027d9e4

SHA1
90834bf5bde07b41d07fbbc8e80b5d8d3326c1d2

SHA256
e2c6b5845170ec611c4e3d7d8e4640fb470423c1a38ef9d1a162ff7d1167ac39

SHA512
cea09f59e5d241cf06af375c433fec73dc164bf06462d457d34922f359e09ab4c593090205a69d313069736fedcd129c0cc19d191bae9add480465b3f6cf9e2b

Download Submit
C:\Windows\System\YirEaPi.exe

Filesize
1.9MB

MD5
107d1359ef74b445d61eefe9da52f8f6

SHA1
e40eee28e6d72f9ac766e634a29999c8623ff974

SHA256
474af8972643182a3c87910c70934d7000f38e0b49b8681dced383b694a5ce04

SHA512
556b5c1042696317cb0a240e04eedfcf54d6db9e6e8bc458b848c506f4dc94d454bc42d9b5936b277e150a50109198c31caec279d92bac707f97f8c5b394abf7

Download Submit
C:\Windows\System\ZDrdQND.exe

Filesize
1.9MB

MD5
2961ed3d57e7c1500e15ddb9ee22bace

SHA1
2d1722eef0ad168bebd16f3f65f25f9793d73df0

SHA256
eeb53be80c7a25398740826f04ab7dafc7c04a1d8af6fdc10d73769749d62ab3

SHA512
d2edcd8de1a5caf5185a790268680dda3cf3a578ebb0ddf7d955d9a6fe717191d8a403dcddfcb2d13b931ebb12073fa2c663ab0b2a7af8beb8893286766534a4

Download Submit
C:\Windows\System\ZiukMLr.exe

Filesize
1.9MB

MD5
eca36f5b671b33ab438cef6d1828c1ef

SHA1
5c203de61711a825ec56063e7e152fdbce4e9d4a

SHA256
39cdb1956e9af093789f41ca96abdb5be4381c56d03cf484dd504ee8eac5f1f8

SHA512
d16ee84ab96644d7471c2813a225c8a57fdef52bd308bd93ed3a8da9098e8c95164dbaaaa3f52aedad8db5108c70a287d7a600a3828f84ff7b5f9a493ee2caa4

Download Submit
C:\Windows\System\bZOBZEz.exe

Filesize
1.9MB

MD5
a14b4883b5bba29287de5049df8fb837

SHA1
bba0119f1e01d38b29e19678ba0e4eb8d88ef367

SHA256
514a31b11e3732ceebfef730fd580f3077227a99ab18468bf908adcdb4dd3df8

SHA512
336b40c6041728ef161b723c5f018d5fc9d53a6e29d9108762a6c0d69e2fdf845c30bf3913547a572bdd7f5665845afd9e12f99f361f70ca0cdb3c250d6e7f80

Download Submit
C:\Windows\System\deEjfLb.exe

Filesize
1.9MB

MD5
03a6b817ee598d2a89bae608bfe90d4b

SHA1
4aea7f3be121ece3cf89abc68cd82a0fdf340e69

SHA256
5cafa53bba8f464fbcf10f334244121ca1cbdee32f161d0555384541ee167104

SHA512
611c63c4635ea4bcd5b74d6d56462841c83fa0bab5511f62fb719260ca44683a9d3b0b25c1975be4f532683452af0858c65226101b2cd79e3bd5ddb9d659436d

Download Submit
C:\Windows\System\faapybE.exe

Filesize
18B

MD5
5db3df0964e5c695675f39e99d1f288b

SHA1
84b597ea47f1f6b13b223cbb576a55e47a79cfaa

SHA256
15f5f6f9d4846d3bfaf7f8740e9c849aebfecfea6fc86fee82eb18d6ec03fd9f

SHA512
f71b3480e977c4ca4affaaec3f3bd31e3598fdd986ea7bafee42b5d6a8676e69449256bbab19fc0cc61412a454871e6b79cebb0c5e3610b9e98c4f089888aa18

Download Submit
C:\Windows\System\gMNcvXv.exe

Filesize
1.9MB

MD5
445c6f8d225617992cac88c71a9f3326

SHA1
e7b774c02e17c9e027742de90952840b3aba8117

SHA256
919c97423f268f8e325553745dece2aeee61be3199ef3ada9059d3c4f8c42b96

SHA512
c4cc01dd1fc99f490d2d09ac427400f8a1a3bc1b8ed7ade769cc5725b3fa3bc18c15e2bb74456230bcce275e86b104c121ffefd3738afbab25057fd8df5ec905

Download Submit
C:\Windows\System\hxSGEOd.exe

Filesize
1.9MB

MD5
0d2a7e9069157a035408ca9042029a8a

SHA1
efe8daf72338babe3ebf95f1240aef1d435a13fe

SHA256
6db557ea76203d801beecd0bebc7e37034adbaa357c07a2fec38f8e03cc757fe

SHA512
9a1ec3604991d89e8c02f4533e4af4797749ac36fd86a86c91d349abe5456cd74dbd0e3ce613c2058fae8c78c8eaa5ee3002f58dcba5e98aa6076a5476a8f7a2

Download Submit
C:\Windows\System\kKZlbon.exe

Filesize
1.9MB

MD5
b16bd15e040ad11daa7d674eacea5aa9

SHA1
01670461cebad4460800b70cd777f3efa1e89da8

SHA256
b582edf51d43a15343d4399656249b8404fc734e70b6dfa68dd7e0cccd4b18ca

SHA512
15034a86f9516dba37a911f55f41979c9debffb6f80847f4f0ac0bfc0bd484438a56826b880eee3a0d0be91cd7bafe612ffa4739d3389d7df6062d388c76d867

Download Submit
C:\Windows\System\lDvrdjM.exe

Filesize
1.9MB

MD5
a7ea7718b1cc1501fb1c9b7f78f49206

SHA1
8be987600d879f8e586cff201edb77c7442e4441

SHA256
7e0b29adf089cc36e174e5c5587a1fcc913e7a6f69046632b244c442dd894515

SHA512
69c92db3ad98686cc01b9b380b6055d2cb102bd450cc21a5d3e3222fadbc638b7c175b6e646a5f16660b068e1f21ca50f096045c4e8a994c71ee728a309f0e81

Download Submit
C:\Windows\System\lVNvdot.exe

Filesize
1.9MB

MD5
800fe563a41a9bd6d6beeb3d741eb63d

SHA1
7d35c57fdb8688b4492cc1559cd935a515776e89

SHA256
57b199d75a17e2ae633a07b0beadc24608ca77f316ada2458e2ad7a229ddc053

SHA512
a765783bfac07acdcdf137a35d3f05446f4ff162f8986980c4f4d20cccbf839bf4be15b7f121fa19e6c0cc66d59db3b2f671cadfc13ff2ce744515f12c0799e7

Download Submit
C:\Windows\System\niifvsX.exe

Filesize
1.9MB

MD5
c238ceee036264d40df13c79a6de78e0

SHA1
24431b6541eda36118b997767d7d7432a68be975

SHA256
8f98c7a108559b98f8cfa46aa129201ac7a7f1a6a7b538bfdcf4f4f696ae8f0c

SHA512
7af781827965f7c03c4c37ff54e318431b8c25ebc457ca1e66ebe26ea0e600b4b784aeef768e6eb0eecbe926dfd03e9490d3353c2b0a7c512cb9f6090059874d

Download Submit
C:\Windows\System\oSgwzeg.exe

Filesize
1.9MB

MD5
592959af0ec4b9e5695ebda55302ce1d

SHA1
e46504fb21628933aeb5e2f0e5175eb61bf29fcd

SHA256
1e13d21cab07b579b5d0e752059cd46d20e67f22eaa316999b0d6c858e207ff3

SHA512
42e8bc4a2f111a494a35bb415ed089db01fdc377f610aa3a71c3b306c041b757699f2aeb1e108f8affd03a6c833bdd09f7630d20ff01d1e907e88160beef6948

Download Submit
C:\Windows\System\qCBeELQ.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\qolGUBV.exe

Filesize
1.9MB

MD5
1d5a841077d49fd48906ffc07069badc

SHA1
0828be412249b5bb1f649b9c4e4400659aff14dc

SHA256
4db0f2a2a7908f66e028d6a1043117b1ef82c6ea893e594d05b885d57ca3bad6

SHA512
41d385d5a3c3edec836ba56d28d59ac74acc9354aeed2bdfe38e6943bb728b96d00b81a1f45359041751c0495336dd7c254581102e6cf52c8df96ac0ee9ed5f5

Download Submit
C:\Windows\System\qrVAQDs.exe

Filesize
1.9MB

MD5
0e88c1b5999932a557f070605cd3ef7e

SHA1
abac83095402c2646d3de03edcf3a04f203528b3

SHA256
c6a32b71416ba23c9c4f75b723b40f15fb98a0fd4a99964ef74db51dc9538e7c

SHA512
7a98a86703f9489cc32613b7a06ba6bee1afdfb38286bb5e0b6e97d6a0fe8b7e18a33507ab9833a26ad7d965d25a175aa6544b99db1889b879224df70471786c

Download Submit
C:\Windows\System\tAualEA.exe

Filesize
1.9MB

MD5
f86a02408506c29298208409697217c6

SHA1
ab8ba2f651dfdb115a5f7e0a269988f48645a2dc

SHA256
dc340a7f4aa4727639059d7e29f5b389d474f2a4ce395c3d2ecfa716e67eb696

SHA512
4ae070696b1a5836e21ad2edf5a14fdffee420c01b4aa224ce8594930ecffd19171cffa5333c823dbf5279915b960c2cba16334b5648d15f910e6b15f8594f39

Download Submit
C:\Windows\System\tdKIUGi.exe

Filesize
1.9MB

MD5
6b6ddfd175001661ee3f10786c62fb08

SHA1
f4d1fdccbbb165ca70bcd380602d97cd7bc5d852

SHA256
008ed18d5a284e8f668ffae7ca38f4888d1cb3b35135902860857e021d4a0222

SHA512
71da06bb687d22e859c773a1399f4301d98b1450aee14d76b454ab2adad0aef10519918e8d1dd843daecc4d2b1a90b01cd92da515c261a9ebd218df62e74d0ee

Download Submit
C:\Windows\System\zRjhTqX.exe

Filesize
1.9MB

MD5
b7a32e3b0e848f78448b43ade8edc5d1

SHA1
e30a7466f7e09cae061c8be3dba31bad9dc364de

SHA256
f4a397d4012ffc134c3df0fba67211afa84798ef3cb4e7d417ca3c74b6cc15be

SHA512
d47609efe3d66c8a5eaa751502aa7e81cb167c70e90ecc46fc1288e505a3c8d42863742c08f48c1b009a0dd9debedb7eef2b26b2779f45cbb705aa893bf9c7d8

Download Submit
C:\Windows\System\zSkkBEo.exe

Filesize
1.9MB

MD5
d588f5545d512da29b37d03d1912d56c

SHA1
bd9f880304205e235313b0d2b36c73027c2ac784

SHA256
0e311d79a5672adc92375e46624528d34da946aac92a1199fb767ab968a62029

SHA512
882215b65e55b169e349b9049658d93b356bdc6ca11f47ee09f4da08e2b0f53a709760787504a06bf1b1079b0fd07bfc72584bae1a845cbbfcc399d59197d475

Download Submit
memory/540-5058-0x00007FF7E2DB0000-0x00007FF7E31A2000-memory.dmp

Filesize
3.9MB

Download
memory/540-859-0x00007FF7E2DB0000-0x00007FF7E31A2000-memory.dmp

Filesize
3.9MB

Download
memory/656-5111-0x00007FF677780000-0x00007FF677B72000-memory.dmp

Filesize
3.9MB

Download
memory/656-237-0x00007FF677780000-0x00007FF677B72000-memory.dmp

Filesize
3.9MB

Download
memory/1436-16-0x00007FF724870000-0x00007FF724C62000-memory.dmp

Filesize
3.9MB

Download
memory/1528-5085-0x00007FF6BE080000-0x00007FF6BE472000-memory.dmp

Filesize
3.9MB

Download
memory/1528-196-0x00007FF6BE080000-0x00007FF6BE472000-memory.dmp

Filesize
3.9MB

Download
memory/1540-5122-0x00007FF6842A0000-0x00007FF684692000-memory.dmp

Filesize
3.9MB

Download
memory/1540-338-0x00007FF6842A0000-0x00007FF684692000-memory.dmp

Filesize
3.9MB

Download
memory/1792-389-0x00007FF6B4FB0000-0x00007FF6B53A2000-memory.dmp

Filesize
3.9MB

Download
memory/1792-5105-0x00007FF6B4FB0000-0x00007FF6B53A2000-memory.dmp

Filesize
3.9MB

Download
memory/1800-1153-0x00007FF679C30000-0x00007FF67A022000-memory.dmp

Filesize
3.9MB

Download
memory/1800-5074-0x00007FF679C30000-0x00007FF67A022000-memory.dmp

Filesize
3.9MB

Download
memory/1972-5130-0x00007FF721280000-0x00007FF721672000-memory.dmp

Filesize
3.9MB

Download
memory/1972-304-0x00007FF721280000-0x00007FF721672000-memory.dmp

Filesize
3.9MB

Download
memory/2156-527-0x00007FF7DDCA0000-0x00007FF7DE092000-memory.dmp

Filesize
3.9MB

Download
memory/2156-5112-0x00007FF7DDCA0000-0x00007FF7DE092000-memory.dmp

Filesize
3.9MB

Download
memory/2284-122-0x00007FF6B3650000-0x00007FF6B3A42000-memory.dmp

Filesize
3.9MB

Download
memory/2284-5092-0x00007FF6B3650000-0x00007FF6B3A42000-memory.dmp

Filesize
3.9MB

Download
memory/2424-17-0x000001F3B2930000-0x000001F3B2940000-memory.dmp

Filesize
64KB

Download
memory/2424-323-0x000001F3B28D0000-0x000001F3B28F2000-memory.dmp

Filesize
136KB

Download
memory/2424-702-0x00007FFE337B0000-0x00007FFE34271000-memory.dmp

Filesize
10.8MB

Download
memory/2424-93-0x000001F3B2930000-0x000001F3B2940000-memory.dmp

Filesize
64KB

Download
memory/2596-42-0x00007FF7DDA20000-0x00007FF7DDE12000-memory.dmp

Filesize
3.9MB

Download
memory/2596-5061-0x00007FF7DDA20000-0x00007FF7DDE12000-memory.dmp

Filesize
3.9MB

Download
memory/2904-5069-0x00007FF66DA70000-0x00007FF66DE62000-memory.dmp

Filesize
3.9MB

Download
memory/2904-65-0x00007FF66DA70000-0x00007FF66DE62000-memory.dmp

Filesize
3.9MB

Download
memory/3148-1-0x000002BFE2850000-0x000002BFE2860000-memory.dmp

Filesize
64KB

Download
memory/3148-5666-0x00007FF66B3A0000-0x00007FF66B792000-memory.dmp

Filesize
3.9MB

Download
memory/3148-0-0x00007FF66B3A0000-0x00007FF66B792000-memory.dmp

Filesize
3.9MB

Download
memory/3404-5107-0x00007FF6B14C0000-0x00007FF6B18B2000-memory.dmp

Filesize
3.9MB

Download
memory/3404-465-0x00007FF6B14C0000-0x00007FF6B18B2000-memory.dmp

Filesize
3.9MB

Download
memory/3764-26-0x00007FF733480000-0x00007FF733872000-memory.dmp

Filesize
3.9MB

Download
memory/3764-5050-0x00007FF733480000-0x00007FF733872000-memory.dmp

Filesize
3.9MB

Download
memory/3796-1157-0x00007FF7B1A70000-0x00007FF7B1E62000-memory.dmp

Filesize
3.9MB

Download
memory/3796-5101-0x00007FF7B1A70000-0x00007FF7B1E62000-memory.dmp

Filesize
3.9MB

Download
memory/3828-5114-0x00007FF661850000-0x00007FF661C42000-memory.dmp

Filesize
3.9MB

Download
memory/3828-297-0x00007FF661850000-0x00007FF661C42000-memory.dmp

Filesize
3.9MB

Download
memory/4308-5096-0x00007FF7C4940000-0x00007FF7C4D32000-memory.dmp

Filesize
3.9MB

Download
memory/4308-29-0x00007FF7C4940000-0x00007FF7C4D32000-memory.dmp

Filesize
3.9MB

Download
memory/4376-386-0x00007FF73FA50000-0x00007FF73FE42000-memory.dmp

Filesize
3.9MB

Download
memory/4376-5142-0x00007FF73FA50000-0x00007FF73FE42000-memory.dmp

Filesize
3.9MB

Download
memory/4528-978-0x00007FF690B40000-0x00007FF690F32000-memory.dmp

Filesize
3.9MB

Download
memory/4528-5065-0x00007FF690B40000-0x00007FF690F32000-memory.dmp

Filesize
3.9MB

Download
memory/5032-981-0x00007FF787D50000-0x00007FF788142000-memory.dmp

Filesize
3.9MB

Download
memory/5032-5071-0x00007FF787D50000-0x00007FF788142000-memory.dmp

Filesize
3.9MB

Download
memory/5100-162-0x00007FF789E30000-0x00007FF78A222000-memory.dmp

Filesize
3.9MB

Download
memory/5100-5083-0x00007FF789E30000-0x00007FF78A222000-memory.dmp

Filesize
3.9MB

Download