xmrig | c8bc2db45c1119b32ad906bb8a31bd72ce768f503dffd04bd86ecf5e21bcd7cd

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
Size

2.0MB
MD5

0af70b5706a342671735a7ff319194f7
SHA1

42432f9e08f5d6bd24aed5572df6fdb11737aa1d
SHA256

c8bc2db45c1119b32ad906bb8a31bd72ce768f503dffd04bd86ecf5e21bcd7cd
SHA512

7263fc944718d9aeb282555a75c58c0e2050568caa33958e8f04fa40c1a0de9501a0cf2fc41d9c4ea13dbc37ae899834e2efcd34baa7e001edb906d8065bf5bb
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1nfx:NABG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral2/memory/3152-49-0x00007FF65D8B0000-0x00007FF65DCA2000-memory.dmp	xmrig
behavioral2/memory/376-98-0x00007FF7DE4B0000-0x00007FF7DE8A2000-memory.dmp	xmrig
behavioral2/memory/3876-129-0x00007FF69B430000-0x00007FF69B822000-memory.dmp	xmrig
behavioral2/memory/4488-128-0x00007FF78FF50000-0x00007FF790342000-memory.dmp	xmrig
behavioral2/memory/3952-127-0x00007FF6225A0000-0x00007FF622992000-memory.dmp	xmrig
behavioral2/memory/4216-124-0x00007FF6F1120000-0x00007FF6F1512000-memory.dmp	xmrig
behavioral2/memory/1812-123-0x00007FF748680000-0x00007FF748A72000-memory.dmp	xmrig
behavioral2/memory/4608-122-0x00007FF6B4940000-0x00007FF6B4D32000-memory.dmp	xmrig
behavioral2/memory/3828-116-0x00007FF6BFDE0000-0x00007FF6C01D2000-memory.dmp	xmrig
behavioral2/memory/1668-108-0x00007FF790610000-0x00007FF790A02000-memory.dmp	xmrig
behavioral2/memory/2852-104-0x00007FF7362A0000-0x00007FF736692000-memory.dmp	xmrig
behavioral2/memory/3972-103-0x00007FF75CD90000-0x00007FF75D182000-memory.dmp	xmrig
behavioral2/memory/1064-80-0x00007FF71E5A0000-0x00007FF71E992000-memory.dmp	xmrig
behavioral2/memory/5096-76-0x00007FF7FD7E0000-0x00007FF7FDBD2000-memory.dmp	xmrig
behavioral2/memory/1008-68-0x00007FF73D350000-0x00007FF73D742000-memory.dmp	xmrig
behavioral2/memory/1564-67-0x00007FF724CE0000-0x00007FF7250D2000-memory.dmp	xmrig
behavioral2/memory/2932-60-0x00007FF7908F0000-0x00007FF790CE2000-memory.dmp	xmrig
behavioral2/memory/4440-141-0x00007FF6765A0000-0x00007FF676992000-memory.dmp	xmrig
behavioral2/memory/3996-158-0x00007FF75A7E0000-0x00007FF75ABD2000-memory.dmp	xmrig
behavioral2/memory/4804-2935-0x00007FF6BC110000-0x00007FF6BC502000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1108	KfYZxcS.exe
376	xTuQTyO.exe
3152	TAutPFJ.exe
2932	EEGpCfV.exe
1564	QSyvKSD.exe
1008	griBAMi.exe
5096	yRZyyZB.exe
3972	tpcwmMU.exe
2852	eQNVgog.exe
1064	lrMNBeg.exe
1668	SgsNZUy.exe
4804	vLjVMep.exe
3828	TSDYheW.exe
1812	GXCNWIw.exe
4216	gjavbnf.exe
4608	OPidUZz.exe
3952	fxDaezR.exe
4488	CpmnJiO.exe
3876	WtNHrln.exe
4440	khepqvy.exe
3996	jnbHOqy.exe
2524	PIATdyJ.exe
3408	QSzTpvj.exe
1496	okPmMaM.exe
4920	VXomAUy.exe
864	aUrrXTk.exe
2384	UzGxANw.exe
4996	UIAiWrg.exe
2512	mdpxfDj.exe
2668	TzKAjyt.exe
3196	VDQBkwM.exe
2392	XvvMikP.exe
3312	tjwtfyS.exe
4388	UqNKdDF.exe
3208	bqaPVWT.exe
2004	SMvTDaE.exe
3956	asWqDeU.exe
5088	wCHfbPK.exe
4084	iTFHIcF.exe
4396	RRTvuXi.exe
2044	CYStSVa.exe
3092	bwcfiHb.exe
4352	DXzEdzC.exe
3000	krcYFBq.exe
3836	JPtWhkx.exe
736	JzZlodY.exe
2840	vBFBVGE.exe
3556	ewYLoEB.exe
2204	DJOqphS.exe
4452	ivaynZd.exe
316	buxwfSL.exe
3872	EkJTPAb.exe
2348	JyOTaRi.exe
3176	IAzLvCw.exe
2124	rOEQlkn.exe
2408	PCEzScg.exe
4252	OycUGJy.exe
1084	MGFKqeG.exe
5040	cqHQGDW.exe
2600	KoLOfjn.exe
8	TYhOdhR.exe
1048	RZmYXQp.exe
804	gFYOJda.exe
1852	MbNLdOg.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2532-0-0x00007FF796A40000-0x00007FF796E32000-memory.dmp	upx
behavioral2/memory/1108-10-0x00007FF607390000-0x00007FF607782000-memory.dmp	upx
behavioral2/files/0x000a000000023b90-7.dat	upx
behavioral2/files/0x000a000000023b8f-13.dat	upx
behavioral2/files/0x000b000000023b8e-19.dat	upx
behavioral2/files/0x000a000000023b92-22.dat	upx
behavioral2/files/0x000a000000023b93-54.dat	upx
behavioral2/memory/3152-49-0x00007FF65D8B0000-0x00007FF65DCA2000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-48.dat	upx
behavioral2/files/0x000a000000023b94-35.dat	upx
behavioral2/files/0x000a000000023b91-25.dat	upx
behavioral2/files/0x000a000000023b98-74.dat	upx
behavioral2/memory/4804-84-0x00007FF6BC110000-0x00007FF6BC502000-memory.dmp	upx
behavioral2/memory/376-98-0x00007FF7DE4B0000-0x00007FF7DE8A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-105.dat	upx
behavioral2/files/0x000a000000023b9e-113.dat	upx
behavioral2/files/0x000a000000023b9f-125.dat	upx
behavioral2/memory/3876-129-0x00007FF69B430000-0x00007FF69B822000-memory.dmp	upx
behavioral2/memory/4488-128-0x00007FF78FF50000-0x00007FF790342000-memory.dmp	upx
behavioral2/memory/3952-127-0x00007FF6225A0000-0x00007FF622992000-memory.dmp	upx
behavioral2/memory/4216-124-0x00007FF6F1120000-0x00007FF6F1512000-memory.dmp	upx
behavioral2/memory/1812-123-0x00007FF748680000-0x00007FF748A72000-memory.dmp	upx
behavioral2/memory/4608-122-0x00007FF6B4940000-0x00007FF6B4D32000-memory.dmp	upx
behavioral2/memory/3828-116-0x00007FF6BFDE0000-0x00007FF6C01D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-111.dat	upx
behavioral2/files/0x000b000000023b8c-109.dat	upx
behavioral2/memory/1668-108-0x00007FF790610000-0x00007FF790A02000-memory.dmp	upx
behavioral2/memory/2852-104-0x00007FF7362A0000-0x00007FF736692000-memory.dmp	upx
behavioral2/memory/3972-103-0x00007FF75CD90000-0x00007FF75D182000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-93.dat	upx
behavioral2/files/0x000b000000023b96-92.dat	upx
behavioral2/files/0x000a000000023b9a-87.dat	upx
behavioral2/files/0x000a000000023b99-85.dat	upx
behavioral2/memory/1064-80-0x00007FF71E5A0000-0x00007FF71E992000-memory.dmp	upx
behavioral2/memory/5096-76-0x00007FF7FD7E0000-0x00007FF7FDBD2000-memory.dmp	upx
behavioral2/memory/1008-68-0x00007FF73D350000-0x00007FF73D742000-memory.dmp	upx
behavioral2/memory/1564-67-0x00007FF724CE0000-0x00007FF7250D2000-memory.dmp	upx
behavioral2/files/0x000b000000023b97-61.dat	upx
behavioral2/memory/2932-60-0x00007FF7908F0000-0x00007FF790CE2000-memory.dmp	upx
behavioral2/memory/4440-141-0x00007FF6765A0000-0x00007FF676992000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-142.dat	upx
behavioral2/files/0x000a000000023ba2-154.dat	upx
behavioral2/files/0x000a000000023ba4-161.dat	upx
behavioral2/files/0x000a000000023ba7-170.dat	upx
behavioral2/files/0x000a000000023ba6-165.dat	upx
behavioral2/files/0x000a000000023ba5-159.dat	upx
behavioral2/memory/3996-158-0x00007FF75A7E0000-0x00007FF75ABD2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-145.dat	upx
behavioral2/files/0x000a000000023ba0-133.dat	upx
behavioral2/files/0x000a000000023ba8-174.dat	upx
behavioral2/files/0x000a000000023ba9-178.dat	upx
behavioral2/files/0x000a000000023baa-185.dat	upx
behavioral2/files/0x000a000000023bab-190.dat	upx
behavioral2/files/0x000a000000023bac-194.dat	upx
behavioral2/memory/4804-2935-0x00007FF6BC110000-0x00007FF6BC502000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aKatPHd.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\ddoGbsx.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\bHYkGdz.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\vPppfVq.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\uILRVGd.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\wzoyaik.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\bdUybko.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\sRLuOIW.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\RsEYAdw.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\eVDSrtm.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\oPKBOAi.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\QSiJrph.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\GarkbdU.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\CRxZitG.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\FzslfgX.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\npvMbOV.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\PfLmOmB.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\rfmcSOt.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\TNedDCh.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\dvxIUFs.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\ugSSuDu.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\KaCyMfD.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\YyUaBfe.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\QbAsuCP.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\XAIpYdy.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\HKksLYt.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\rllMJvr.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\shefPaY.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\lLSbzLk.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\fWmxrCV.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\xKOrHUZ.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\qrClsWE.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\UnvnMzB.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\unHHbNC.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\gNlTojr.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\DPNnhlL.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\MYgqlSE.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\WHPAdVh.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\fzIsahC.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\YKxdbKB.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\HeImvKm.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\AMVHpUm.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\SxmOfHr.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\aCUINPe.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\XLOgDQB.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\awXfEYy.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\qCmomJD.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\wJlFSjD.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\PTAFGlR.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\gwTplYI.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\TTHktHV.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\xpZFlZQ.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\yYZzkNn.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\kxmPWcE.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\bokPyDO.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\CavMcAz.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\fablkmO.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\zbuYAQx.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\kJBkzAV.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\LSbdylU.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\TQRaQsQ.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\TfQockL.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\HtrRYbj.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
File created	C:\Windows\System\XwreNWZ.exe	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1764	powershell.exe
1764	powershell.exe
1764	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeCreateGlobalPrivilege	13612	dwm.exe
Token: SeChangeNotifyPrivilege	13612	dwm.exe
Token: 33	13612	dwm.exe
Token: SeIncBasePriorityPrivilege	13612	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1764	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	84
PID 2532 wrote to memory of 1764	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	84
PID 2532 wrote to memory of 1108	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	85
PID 2532 wrote to memory of 1108	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	85
PID 2532 wrote to memory of 376	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	86
PID 2532 wrote to memory of 376	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	86
PID 2532 wrote to memory of 3152	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	87
PID 2532 wrote to memory of 3152	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	87
PID 2532 wrote to memory of 2932	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	88
PID 2532 wrote to memory of 2932	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	88
PID 2532 wrote to memory of 1564	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	89
PID 2532 wrote to memory of 1564	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	89
PID 2532 wrote to memory of 1008	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	90
PID 2532 wrote to memory of 1008	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	90
PID 2532 wrote to memory of 5096	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	91
PID 2532 wrote to memory of 5096	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	91
PID 2532 wrote to memory of 3972	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	92
PID 2532 wrote to memory of 3972	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	92
PID 2532 wrote to memory of 2852	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	93
PID 2532 wrote to memory of 2852	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	93
PID 2532 wrote to memory of 1064	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	94
PID 2532 wrote to memory of 1064	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	94
PID 2532 wrote to memory of 1668	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	95
PID 2532 wrote to memory of 1668	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	95
PID 2532 wrote to memory of 4804	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	96
PID 2532 wrote to memory of 4804	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	96
PID 2532 wrote to memory of 3828	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	97
PID 2532 wrote to memory of 3828	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	97
PID 2532 wrote to memory of 1812	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	98
PID 2532 wrote to memory of 1812	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	98
PID 2532 wrote to memory of 4216	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	99
PID 2532 wrote to memory of 4216	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	99
PID 2532 wrote to memory of 4608	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	100
PID 2532 wrote to memory of 4608	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	100
PID 2532 wrote to memory of 3952	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	101
PID 2532 wrote to memory of 3952	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	101
PID 2532 wrote to memory of 4488	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	102
PID 2532 wrote to memory of 4488	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	102
PID 2532 wrote to memory of 3876	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	103
PID 2532 wrote to memory of 3876	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	103
PID 2532 wrote to memory of 4440	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	104
PID 2532 wrote to memory of 4440	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	104
PID 2532 wrote to memory of 3996	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	105
PID 2532 wrote to memory of 3996	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	105
PID 2532 wrote to memory of 2524	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	106
PID 2532 wrote to memory of 2524	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	106
PID 2532 wrote to memory of 3408	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	107
PID 2532 wrote to memory of 3408	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	107
PID 2532 wrote to memory of 1496	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	108
PID 2532 wrote to memory of 1496	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	108
PID 2532 wrote to memory of 4920	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	109
PID 2532 wrote to memory of 4920	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	109
PID 2532 wrote to memory of 864	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	110
PID 2532 wrote to memory of 864	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	110
PID 2532 wrote to memory of 2384	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	111
PID 2532 wrote to memory of 2384	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	111
PID 2532 wrote to memory of 4996	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	113
PID 2532 wrote to memory of 4996	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	113
PID 2532 wrote to memory of 2512	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	115
PID 2532 wrote to memory of 2512	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	115
PID 2532 wrote to memory of 2668	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	116
PID 2532 wrote to memory of 2668	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	116
PID 2532 wrote to memory of 3196	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	117
PID 2532 wrote to memory of 3196	2532	0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0af70b5706a342671735a7ff319194f7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\System\KfYZxcS.exe
  C:\Windows\System\KfYZxcS.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\xTuQTyO.exe
  C:\Windows\System\xTuQTyO.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\TAutPFJ.exe
  C:\Windows\System\TAutPFJ.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\EEGpCfV.exe
  C:\Windows\System\EEGpCfV.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\QSyvKSD.exe
  C:\Windows\System\QSyvKSD.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\griBAMi.exe
  C:\Windows\System\griBAMi.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\yRZyyZB.exe
  C:\Windows\System\yRZyyZB.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\tpcwmMU.exe
  C:\Windows\System\tpcwmMU.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\eQNVgog.exe
  C:\Windows\System\eQNVgog.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\lrMNBeg.exe
  C:\Windows\System\lrMNBeg.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\SgsNZUy.exe
  C:\Windows\System\SgsNZUy.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\vLjVMep.exe
  C:\Windows\System\vLjVMep.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\TSDYheW.exe
  C:\Windows\System\TSDYheW.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\GXCNWIw.exe
  C:\Windows\System\GXCNWIw.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\gjavbnf.exe
  C:\Windows\System\gjavbnf.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\OPidUZz.exe
  C:\Windows\System\OPidUZz.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\fxDaezR.exe
  C:\Windows\System\fxDaezR.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\CpmnJiO.exe
  C:\Windows\System\CpmnJiO.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\WtNHrln.exe
  C:\Windows\System\WtNHrln.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\khepqvy.exe
  C:\Windows\System\khepqvy.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\jnbHOqy.exe
  C:\Windows\System\jnbHOqy.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\PIATdyJ.exe
  C:\Windows\System\PIATdyJ.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\QSzTpvj.exe
  C:\Windows\System\QSzTpvj.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\okPmMaM.exe
  C:\Windows\System\okPmMaM.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\VXomAUy.exe
  C:\Windows\System\VXomAUy.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\aUrrXTk.exe
  C:\Windows\System\aUrrXTk.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\UzGxANw.exe
  C:\Windows\System\UzGxANw.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\UIAiWrg.exe
  C:\Windows\System\UIAiWrg.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\mdpxfDj.exe
  C:\Windows\System\mdpxfDj.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\TzKAjyt.exe
  C:\Windows\System\TzKAjyt.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\VDQBkwM.exe
  C:\Windows\System\VDQBkwM.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\XvvMikP.exe
  C:\Windows\System\XvvMikP.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\UqNKdDF.exe
  C:\Windows\System\UqNKdDF.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\tjwtfyS.exe
  C:\Windows\System\tjwtfyS.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\bqaPVWT.exe
  C:\Windows\System\bqaPVWT.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\SMvTDaE.exe
  C:\Windows\System\SMvTDaE.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\asWqDeU.exe
  C:\Windows\System\asWqDeU.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\wCHfbPK.exe
  C:\Windows\System\wCHfbPK.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\iTFHIcF.exe
  C:\Windows\System\iTFHIcF.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\RRTvuXi.exe
  C:\Windows\System\RRTvuXi.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\CYStSVa.exe
  C:\Windows\System\CYStSVa.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\bwcfiHb.exe
  C:\Windows\System\bwcfiHb.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\DXzEdzC.exe
  C:\Windows\System\DXzEdzC.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\krcYFBq.exe
  C:\Windows\System\krcYFBq.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\JPtWhkx.exe
  C:\Windows\System\JPtWhkx.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\JzZlodY.exe
  C:\Windows\System\JzZlodY.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\vBFBVGE.exe
  C:\Windows\System\vBFBVGE.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\ewYLoEB.exe
  C:\Windows\System\ewYLoEB.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\DJOqphS.exe
  C:\Windows\System\DJOqphS.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\ivaynZd.exe
  C:\Windows\System\ivaynZd.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\buxwfSL.exe
  C:\Windows\System\buxwfSL.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\EkJTPAb.exe
  C:\Windows\System\EkJTPAb.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\JyOTaRi.exe
  C:\Windows\System\JyOTaRi.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\IAzLvCw.exe
  C:\Windows\System\IAzLvCw.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\rOEQlkn.exe
  C:\Windows\System\rOEQlkn.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\PCEzScg.exe
  C:\Windows\System\PCEzScg.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\OycUGJy.exe
  C:\Windows\System\OycUGJy.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\MGFKqeG.exe
  C:\Windows\System\MGFKqeG.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\cqHQGDW.exe
  C:\Windows\System\cqHQGDW.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\KoLOfjn.exe
  C:\Windows\System\KoLOfjn.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\TYhOdhR.exe
  C:\Windows\System\TYhOdhR.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\RZmYXQp.exe
  C:\Windows\System\RZmYXQp.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\gFYOJda.exe
  C:\Windows\System\gFYOJda.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\MbNLdOg.exe
  C:\Windows\System\MbNLdOg.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\yLOSIcG.exe
  C:\Windows\System\yLOSIcG.exe
  2⤵
  PID:2244
- C:\Windows\System\BkGbvmR.exe
  C:\Windows\System\BkGbvmR.exe
  2⤵
  PID:4356
- C:\Windows\System\IVzpmya.exe
  C:\Windows\System\IVzpmya.exe
  2⤵
  PID:3628
- C:\Windows\System\TogZrKL.exe
  C:\Windows\System\TogZrKL.exe
  2⤵
  PID:5024
- C:\Windows\System\KaREnFB.exe
  C:\Windows\System\KaREnFB.exe
  2⤵
  PID:1476
- C:\Windows\System\nBdTBXD.exe
  C:\Windows\System\nBdTBXD.exe
  2⤵
  PID:2416
- C:\Windows\System\nztKQiR.exe
  C:\Windows\System\nztKQiR.exe
  2⤵
  PID:2644
- C:\Windows\System\pYZejTw.exe
  C:\Windows\System\pYZejTw.exe
  2⤵
  PID:1656
- C:\Windows\System\VMZewcK.exe
  C:\Windows\System\VMZewcK.exe
  2⤵
  PID:4824
- C:\Windows\System\CIWzYYR.exe
  C:\Windows\System\CIWzYYR.exe
  2⤵
  PID:3884
- C:\Windows\System\eeBcFOC.exe
  C:\Windows\System\eeBcFOC.exe
  2⤵
  PID:4404
- C:\Windows\System\qGjsAha.exe
  C:\Windows\System\qGjsAha.exe
  2⤵
  PID:4032
- C:\Windows\System\KBECqdq.exe
  C:\Windows\System\KBECqdq.exe
  2⤵
  PID:3368
- C:\Windows\System\rDZdALO.exe
  C:\Windows\System\rDZdALO.exe
  2⤵
  PID:2256
- C:\Windows\System\uPqgAnn.exe
  C:\Windows\System\uPqgAnn.exe
  2⤵
  PID:3624
- C:\Windows\System\nEonscN.exe
  C:\Windows\System\nEonscN.exe
  2⤵
  PID:3024
- C:\Windows\System\QJjfCpz.exe
  C:\Windows\System\QJjfCpz.exe
  2⤵
  PID:2528
- C:\Windows\System\rPgZGeA.exe
  C:\Windows\System\rPgZGeA.exe
  2⤵
  PID:3232
- C:\Windows\System\SDjUlcg.exe
  C:\Windows\System\SDjUlcg.exe
  2⤵
  PID:1160
- C:\Windows\System\tDTnSZs.exe
  C:\Windows\System\tDTnSZs.exe
  2⤵
  PID:3632
- C:\Windows\System\UYDRnst.exe
  C:\Windows\System\UYDRnst.exe
  2⤵
  PID:4740
- C:\Windows\System\aiJMPKJ.exe
  C:\Windows\System\aiJMPKJ.exe
  2⤵
  PID:904
- C:\Windows\System\uxiAVLq.exe
  C:\Windows\System\uxiAVLq.exe
  2⤵
  PID:532
- C:\Windows\System\dtxlLuC.exe
  C:\Windows\System\dtxlLuC.exe
  2⤵
  PID:216
- C:\Windows\System\xjrTKPT.exe
  C:\Windows\System\xjrTKPT.exe
  2⤵
  PID:4328
- C:\Windows\System\cZcgISQ.exe
  C:\Windows\System\cZcgISQ.exe
  2⤵
  PID:3648
- C:\Windows\System\NACCqVj.exe
  C:\Windows\System\NACCqVj.exe
  2⤵
  PID:3812
- C:\Windows\System\oUzmYhs.exe
  C:\Windows\System\oUzmYhs.exe
  2⤵
  PID:5144
- C:\Windows\System\KLklQAa.exe
  C:\Windows\System\KLklQAa.exe
  2⤵
  PID:5172
- C:\Windows\System\NkktqTe.exe
  C:\Windows\System\NkktqTe.exe
  2⤵
  PID:5188
- C:\Windows\System\TqVSmmu.exe
  C:\Windows\System\TqVSmmu.exe
  2⤵
  PID:5228
- C:\Windows\System\zeCnDqG.exe
  C:\Windows\System\zeCnDqG.exe
  2⤵
  PID:5268
- C:\Windows\System\fXElXtP.exe
  C:\Windows\System\fXElXtP.exe
  2⤵
  PID:5288
- C:\Windows\System\cmyznNw.exe
  C:\Windows\System\cmyznNw.exe
  2⤵
  PID:5332
- C:\Windows\System\EClJEZS.exe
  C:\Windows\System\EClJEZS.exe
  2⤵
  PID:5348
- C:\Windows\System\LmFhAXX.exe
  C:\Windows\System\LmFhAXX.exe
  2⤵
  PID:5364
- C:\Windows\System\ZQIvyCS.exe
  C:\Windows\System\ZQIvyCS.exe
  2⤵
  PID:5408
- C:\Windows\System\JNrewwR.exe
  C:\Windows\System\JNrewwR.exe
  2⤵
  PID:5424
- C:\Windows\System\rcEfUst.exe
  C:\Windows\System\rcEfUst.exe
  2⤵
  PID:5452
- C:\Windows\System\katvzxd.exe
  C:\Windows\System\katvzxd.exe
  2⤵
  PID:5468
- C:\Windows\System\xvtWjFD.exe
  C:\Windows\System\xvtWjFD.exe
  2⤵
  PID:5492
- C:\Windows\System\pxNeUZN.exe
  C:\Windows\System\pxNeUZN.exe
  2⤵
  PID:5512
- C:\Windows\System\gNbnHzm.exe
  C:\Windows\System\gNbnHzm.exe
  2⤵
  PID:5564
- C:\Windows\System\bNbCvEC.exe
  C:\Windows\System\bNbCvEC.exe
  2⤵
  PID:5588
- C:\Windows\System\PAIbGqc.exe
  C:\Windows\System\PAIbGqc.exe
  2⤵
  PID:5628
- C:\Windows\System\yjnhvny.exe
  C:\Windows\System\yjnhvny.exe
  2⤵
  PID:5644
- C:\Windows\System\DZZcyzJ.exe
  C:\Windows\System\DZZcyzJ.exe
  2⤵
  PID:5664
- C:\Windows\System\kKiRWsH.exe
  C:\Windows\System\kKiRWsH.exe
  2⤵
  PID:5704
- C:\Windows\System\KejsIYK.exe
  C:\Windows\System\KejsIYK.exe
  2⤵
  PID:5728
- C:\Windows\System\lLlqwou.exe
  C:\Windows\System\lLlqwou.exe
  2⤵
  PID:5748
- C:\Windows\System\yWgTRAv.exe
  C:\Windows\System\yWgTRAv.exe
  2⤵
  PID:5776
- C:\Windows\System\rbXPeFj.exe
  C:\Windows\System\rbXPeFj.exe
  2⤵
  PID:5804
- C:\Windows\System\AnBJVVK.exe
  C:\Windows\System\AnBJVVK.exe
  2⤵
  PID:5820
- C:\Windows\System\VvhukRZ.exe
  C:\Windows\System\VvhukRZ.exe
  2⤵
  PID:5844
- C:\Windows\System\BXpISgi.exe
  C:\Windows\System\BXpISgi.exe
  2⤵
  PID:5876
- C:\Windows\System\XZgRgDi.exe
  C:\Windows\System\XZgRgDi.exe
  2⤵
  PID:5908
- C:\Windows\System\vNRJhgX.exe
  C:\Windows\System\vNRJhgX.exe
  2⤵
  PID:5932
- C:\Windows\System\gXycaGH.exe
  C:\Windows\System\gXycaGH.exe
  2⤵
  PID:5968
- C:\Windows\System\PfCuyLe.exe
  C:\Windows\System\PfCuyLe.exe
  2⤵
  PID:6004
- C:\Windows\System\XTcxqxS.exe
  C:\Windows\System\XTcxqxS.exe
  2⤵
  PID:6028
- C:\Windows\System\qsmdegO.exe
  C:\Windows\System\qsmdegO.exe
  2⤵
  PID:6056
- C:\Windows\System\XdrcwSG.exe
  C:\Windows\System\XdrcwSG.exe
  2⤵
  PID:6092
- C:\Windows\System\QNCNTEG.exe
  C:\Windows\System\QNCNTEG.exe
  2⤵
  PID:6108
- C:\Windows\System\ahffkpE.exe
  C:\Windows\System\ahffkpE.exe
  2⤵
  PID:6128
- C:\Windows\System\vBuuCze.exe
  C:\Windows\System\vBuuCze.exe
  2⤵
  PID:4724
- C:\Windows\System\ngmwwbO.exe
  C:\Windows\System\ngmwwbO.exe
  2⤵
  PID:3688
- C:\Windows\System\XvcHpFk.exe
  C:\Windows\System\XvcHpFk.exe
  2⤵
  PID:5180
- C:\Windows\System\KaGEEpQ.exe
  C:\Windows\System\KaGEEpQ.exe
  2⤵
  PID:5212
- C:\Windows\System\eivWQaI.exe
  C:\Windows\System\eivWQaI.exe
  2⤵
  PID:5300
- C:\Windows\System\PlCzqtQ.exe
  C:\Windows\System\PlCzqtQ.exe
  2⤵
  PID:996
- C:\Windows\System\xHbNtfJ.exe
  C:\Windows\System\xHbNtfJ.exe
  2⤵
  PID:5380
- C:\Windows\System\oTJEOhi.exe
  C:\Windows\System\oTJEOhi.exe
  2⤵
  PID:5420
- C:\Windows\System\dxiCvNL.exe
  C:\Windows\System\dxiCvNL.exe
  2⤵
  PID:5584
- C:\Windows\System\eZDCgLA.exe
  C:\Windows\System\eZDCgLA.exe
  2⤵
  PID:5676
- C:\Windows\System\IYJjpKP.exe
  C:\Windows\System\IYJjpKP.exe
  2⤵
  PID:5792
- C:\Windows\System\NPpOHIC.exe
  C:\Windows\System\NPpOHIC.exe
  2⤵
  PID:5856
- C:\Windows\System\gYNlWbn.exe
  C:\Windows\System\gYNlWbn.exe
  2⤵
  PID:5888
- C:\Windows\System\NCnwYZA.exe
  C:\Windows\System\NCnwYZA.exe
  2⤵
  PID:5928
- C:\Windows\System\kwTZhDT.exe
  C:\Windows\System\kwTZhDT.exe
  2⤵
  PID:5952
- C:\Windows\System\yRKKtko.exe
  C:\Windows\System\yRKKtko.exe
  2⤵
  PID:6040
- C:\Windows\System\JfdPEbQ.exe
  C:\Windows\System\JfdPEbQ.exe
  2⤵
  PID:6136
- C:\Windows\System\GWezwwj.exe
  C:\Windows\System\GWezwwj.exe
  2⤵
  PID:5136
- C:\Windows\System\oAQdfCW.exe
  C:\Windows\System\oAQdfCW.exe
  2⤵
  PID:5548
- C:\Windows\System\erVftQl.exe
  C:\Windows\System\erVftQl.exe
  2⤵
  PID:5400
- C:\Windows\System\kJCswRB.exe
  C:\Windows\System\kJCswRB.exe
  2⤵
  PID:5540
- C:\Windows\System\WhnUgvI.exe
  C:\Windows\System\WhnUgvI.exe
  2⤵
  PID:5836
- C:\Windows\System\ZhmQAft.exe
  C:\Windows\System\ZhmQAft.exe
  2⤵
  PID:5828
- C:\Windows\System\sOYOiEe.exe
  C:\Windows\System\sOYOiEe.exe
  2⤵
  PID:6100
- C:\Windows\System\ClrIvWj.exe
  C:\Windows\System\ClrIvWj.exe
  2⤵
  PID:6124
- C:\Windows\System\aJYzyPy.exe
  C:\Windows\System\aJYzyPy.exe
  2⤵
  PID:5816
- C:\Windows\System\JlNlkKk.exe
  C:\Windows\System\JlNlkKk.exe
  2⤵
  PID:5636
- C:\Windows\System\xFjZMkT.exe
  C:\Windows\System\xFjZMkT.exe
  2⤵
  PID:5356
- C:\Windows\System\gsWbPOV.exe
  C:\Windows\System\gsWbPOV.exe
  2⤵
  PID:6164
- C:\Windows\System\YIUBQZj.exe
  C:\Windows\System\YIUBQZj.exe
  2⤵
  PID:6184
- C:\Windows\System\NfcWTEz.exe
  C:\Windows\System\NfcWTEz.exe
  2⤵
  PID:6212
- C:\Windows\System\ywNXsLe.exe
  C:\Windows\System\ywNXsLe.exe
  2⤵
  PID:6232
- C:\Windows\System\mudnoXJ.exe
  C:\Windows\System\mudnoXJ.exe
  2⤵
  PID:6252
- C:\Windows\System\SYfOYuU.exe
  C:\Windows\System\SYfOYuU.exe
  2⤵
  PID:6296
- C:\Windows\System\upYtTvL.exe
  C:\Windows\System\upYtTvL.exe
  2⤵
  PID:6340
- C:\Windows\System\QVoJPby.exe
  C:\Windows\System\QVoJPby.exe
  2⤵
  PID:6380
- C:\Windows\System\GUGNtUC.exe
  C:\Windows\System\GUGNtUC.exe
  2⤵
  PID:6400
- C:\Windows\System\DPpYDwk.exe
  C:\Windows\System\DPpYDwk.exe
  2⤵
  PID:6420
- C:\Windows\System\JMxGSxZ.exe
  C:\Windows\System\JMxGSxZ.exe
  2⤵
  PID:6460
- C:\Windows\System\GzQUWde.exe
  C:\Windows\System\GzQUWde.exe
  2⤵
  PID:6476
- C:\Windows\System\RgFtvyt.exe
  C:\Windows\System\RgFtvyt.exe
  2⤵
  PID:6524
- C:\Windows\System\ujvluyF.exe
  C:\Windows\System\ujvluyF.exe
  2⤵
  PID:6548
- C:\Windows\System\TDrDSAl.exe
  C:\Windows\System\TDrDSAl.exe
  2⤵
  PID:6568
- C:\Windows\System\qevoPYa.exe
  C:\Windows\System\qevoPYa.exe
  2⤵
  PID:6588
- C:\Windows\System\chKpHPg.exe
  C:\Windows\System\chKpHPg.exe
  2⤵
  PID:6616
- C:\Windows\System\gpkzZSX.exe
  C:\Windows\System\gpkzZSX.exe
  2⤵
  PID:6644
- C:\Windows\System\bwXTVpv.exe
  C:\Windows\System\bwXTVpv.exe
  2⤵
  PID:6668
- C:\Windows\System\tbbIKev.exe
  C:\Windows\System\tbbIKev.exe
  2⤵
  PID:6684
- C:\Windows\System\pEtCmEl.exe
  C:\Windows\System\pEtCmEl.exe
  2⤵
  PID:6704
- C:\Windows\System\fUxEixQ.exe
  C:\Windows\System\fUxEixQ.exe
  2⤵
  PID:6756
- C:\Windows\System\QyLaPVo.exe
  C:\Windows\System\QyLaPVo.exe
  2⤵
  PID:6796
- C:\Windows\System\uHOdJul.exe
  C:\Windows\System\uHOdJul.exe
  2⤵
  PID:6816
- C:\Windows\System\dFIBEyP.exe
  C:\Windows\System\dFIBEyP.exe
  2⤵
  PID:6840
- C:\Windows\System\AUMYRUS.exe
  C:\Windows\System\AUMYRUS.exe
  2⤵
  PID:6860
- C:\Windows\System\cDkQjgl.exe
  C:\Windows\System\cDkQjgl.exe
  2⤵
  PID:6916
- C:\Windows\System\SgwUIAh.exe
  C:\Windows\System\SgwUIAh.exe
  2⤵
  PID:6936
- C:\Windows\System\wukBPcf.exe
  C:\Windows\System\wukBPcf.exe
  2⤵
  PID:6952
- C:\Windows\System\qzSPGEm.exe
  C:\Windows\System\qzSPGEm.exe
  2⤵
  PID:7000
- C:\Windows\System\cUCCbqs.exe
  C:\Windows\System\cUCCbqs.exe
  2⤵
  PID:7016
- C:\Windows\System\fgfgwYJ.exe
  C:\Windows\System\fgfgwYJ.exe
  2⤵
  PID:7036
- C:\Windows\System\QDuhJpJ.exe
  C:\Windows\System\QDuhJpJ.exe
  2⤵
  PID:7084
- C:\Windows\System\WQNLXvT.exe
  C:\Windows\System\WQNLXvT.exe
  2⤵
  PID:7104
- C:\Windows\System\pIizncN.exe
  C:\Windows\System\pIizncN.exe
  2⤵
  PID:7120
- C:\Windows\System\CHSTXfR.exe
  C:\Windows\System\CHSTXfR.exe
  2⤵
  PID:7156
- C:\Windows\System\oKcmCrN.exe
  C:\Windows\System\oKcmCrN.exe
  2⤵
  PID:4948
- C:\Windows\System\kNRlNHg.exe
  C:\Windows\System\kNRlNHg.exe
  2⤵
  PID:6208
- C:\Windows\System\NtBZhiI.exe
  C:\Windows\System\NtBZhiI.exe
  2⤵
  PID:6280
- C:\Windows\System\CaPiSbh.exe
  C:\Windows\System\CaPiSbh.exe
  2⤵
  PID:6324
- C:\Windows\System\dyNZKpo.exe
  C:\Windows\System\dyNZKpo.exe
  2⤵
  PID:6376
- C:\Windows\System\fjpPYoR.exe
  C:\Windows\System\fjpPYoR.exe
  2⤵
  PID:6452
- C:\Windows\System\TKaglUd.exe
  C:\Windows\System\TKaglUd.exe
  2⤵
  PID:6468
- C:\Windows\System\aSFEoUp.exe
  C:\Windows\System\aSFEoUp.exe
  2⤵
  PID:6560
- C:\Windows\System\FNlBQBY.exe
  C:\Windows\System\FNlBQBY.exe
  2⤵
  PID:6676
- C:\Windows\System\QXcHFFM.exe
  C:\Windows\System\QXcHFFM.exe
  2⤵
  PID:6788
- C:\Windows\System\pGlkKlz.exe
  C:\Windows\System\pGlkKlz.exe
  2⤵
  PID:6836
- C:\Windows\System\ZaVglnK.exe
  C:\Windows\System\ZaVglnK.exe
  2⤵
  PID:6884
- C:\Windows\System\IoBdsrn.exe
  C:\Windows\System\IoBdsrn.exe
  2⤵
  PID:6928
- C:\Windows\System\nrWurAh.exe
  C:\Windows\System\nrWurAh.exe
  2⤵
  PID:6948
- C:\Windows\System\zUKJQSG.exe
  C:\Windows\System\zUKJQSG.exe
  2⤵
  PID:6972
- C:\Windows\System\MXnGDrB.exe
  C:\Windows\System\MXnGDrB.exe
  2⤵
  PID:7012
- C:\Windows\System\WCACJoi.exe
  C:\Windows\System\WCACJoi.exe
  2⤵
  PID:7052
- C:\Windows\System\TRbjnUU.exe
  C:\Windows\System\TRbjnUU.exe
  2⤵
  PID:7164
- C:\Windows\System\Jehbmdy.exe
  C:\Windows\System\Jehbmdy.exe
  2⤵
  PID:6228
- C:\Windows\System\AVFjajB.exe
  C:\Windows\System\AVFjajB.exe
  2⤵
  PID:6288
- C:\Windows\System\WOFcqET.exe
  C:\Windows\System\WOFcqET.exe
  2⤵
  PID:6656
- C:\Windows\System\yDbQjsj.exe
  C:\Windows\System\yDbQjsj.exe
  2⤵
  PID:6904
- C:\Windows\System\gwAfmfn.exe
  C:\Windows\System\gwAfmfn.exe
  2⤵
  PID:6260
- C:\Windows\System\mDmAiXw.exe
  C:\Windows\System\mDmAiXw.exe
  2⤵
  PID:7100
- C:\Windows\System\olQsOKH.exe
  C:\Windows\System\olQsOKH.exe
  2⤵
  PID:6504
- C:\Windows\System\BtECdHq.exe
  C:\Windows\System\BtECdHq.exe
  2⤵
  PID:6696
- C:\Windows\System\rScFLyO.exe
  C:\Windows\System\rScFLyO.exe
  2⤵
  PID:7028
- C:\Windows\System\yxhTLiy.exe
  C:\Windows\System\yxhTLiy.exe
  2⤵
  PID:6652
- C:\Windows\System\VJgtJGT.exe
  C:\Windows\System\VJgtJGT.exe
  2⤵
  PID:7172
- C:\Windows\System\LdWUNmf.exe
  C:\Windows\System\LdWUNmf.exe
  2⤵
  PID:7236
- C:\Windows\System\cTYKHxk.exe
  C:\Windows\System\cTYKHxk.exe
  2⤵
  PID:7260
- C:\Windows\System\IfzIhZF.exe
  C:\Windows\System\IfzIhZF.exe
  2⤵
  PID:7280
- C:\Windows\System\mUXQEAu.exe
  C:\Windows\System\mUXQEAu.exe
  2⤵
  PID:7320
- C:\Windows\System\ujYmGMJ.exe
  C:\Windows\System\ujYmGMJ.exe
  2⤵
  PID:7340
- C:\Windows\System\wBrCXHu.exe
  C:\Windows\System\wBrCXHu.exe
  2⤵
  PID:7364
- C:\Windows\System\OuWlFos.exe
  C:\Windows\System\OuWlFos.exe
  2⤵
  PID:7380
- C:\Windows\System\ikEdtlD.exe
  C:\Windows\System\ikEdtlD.exe
  2⤵
  PID:7412
- C:\Windows\System\iCRdxlj.exe
  C:\Windows\System\iCRdxlj.exe
  2⤵
  PID:7460
- C:\Windows\System\PlnPjmA.exe
  C:\Windows\System\PlnPjmA.exe
  2⤵
  PID:7480
- C:\Windows\System\nRNCBoI.exe
  C:\Windows\System\nRNCBoI.exe
  2⤵
  PID:7512
- C:\Windows\System\iunIqqq.exe
  C:\Windows\System\iunIqqq.exe
  2⤵
  PID:7532
- C:\Windows\System\hUEmlhe.exe
  C:\Windows\System\hUEmlhe.exe
  2⤵
  PID:7552
- C:\Windows\System\RNrMBkh.exe
  C:\Windows\System\RNrMBkh.exe
  2⤵
  PID:7576
- C:\Windows\System\fQlFRHS.exe
  C:\Windows\System\fQlFRHS.exe
  2⤵
  PID:7604
- C:\Windows\System\UHYHBWu.exe
  C:\Windows\System\UHYHBWu.exe
  2⤵
  PID:7624
- C:\Windows\System\bcCRJAF.exe
  C:\Windows\System\bcCRJAF.exe
  2⤵
  PID:7680
- C:\Windows\System\YhvMrPU.exe
  C:\Windows\System\YhvMrPU.exe
  2⤵
  PID:7708
- C:\Windows\System\wEQVVOp.exe
  C:\Windows\System\wEQVVOp.exe
  2⤵
  PID:7724
- C:\Windows\System\tVJnuMB.exe
  C:\Windows\System\tVJnuMB.exe
  2⤵
  PID:7744
- C:\Windows\System\AFUepcf.exe
  C:\Windows\System\AFUepcf.exe
  2⤵
  PID:7788
- C:\Windows\System\oeJcnbr.exe
  C:\Windows\System\oeJcnbr.exe
  2⤵
  PID:7812
- C:\Windows\System\uOmPFfE.exe
  C:\Windows\System\uOmPFfE.exe
  2⤵
  PID:7836
- C:\Windows\System\pyjapWK.exe
  C:\Windows\System\pyjapWK.exe
  2⤵
  PID:7864
- C:\Windows\System\KLRYrfK.exe
  C:\Windows\System\KLRYrfK.exe
  2⤵
  PID:7888
- C:\Windows\System\UtduRgD.exe
  C:\Windows\System\UtduRgD.exe
  2⤵
  PID:7928
- C:\Windows\System\zoMJsjR.exe
  C:\Windows\System\zoMJsjR.exe
  2⤵
  PID:7960
- C:\Windows\System\iSwVLzT.exe
  C:\Windows\System\iSwVLzT.exe
  2⤵
  PID:7988
- C:\Windows\System\LoOzngC.exe
  C:\Windows\System\LoOzngC.exe
  2⤵
  PID:8020
- C:\Windows\System\sOcWUjH.exe
  C:\Windows\System\sOcWUjH.exe
  2⤵
  PID:8036
- C:\Windows\System\BnAdsOs.exe
  C:\Windows\System\BnAdsOs.exe
  2⤵
  PID:8076
- C:\Windows\System\sjJWkJl.exe
  C:\Windows\System\sjJWkJl.exe
  2⤵
  PID:8100
- C:\Windows\System\isKmZJn.exe
  C:\Windows\System\isKmZJn.exe
  2⤵
  PID:8120
- C:\Windows\System\nUXoCUM.exe
  C:\Windows\System\nUXoCUM.exe
  2⤵
  PID:8152
- C:\Windows\System\ZOgtDiZ.exe
  C:\Windows\System\ZOgtDiZ.exe
  2⤵
  PID:8188
- C:\Windows\System\ikrQhfo.exe
  C:\Windows\System\ikrQhfo.exe
  2⤵
  PID:6716
- C:\Windows\System\MWcsXFo.exe
  C:\Windows\System\MWcsXFo.exe
  2⤵
  PID:7204
- C:\Windows\System\eDhAyNh.exe
  C:\Windows\System\eDhAyNh.exe
  2⤵
  PID:7276
- C:\Windows\System\aZlHouB.exe
  C:\Windows\System\aZlHouB.exe
  2⤵
  PID:7316
- C:\Windows\System\KWSFEDj.exe
  C:\Windows\System\KWSFEDj.exe
  2⤵
  PID:7400
- C:\Windows\System\QMBNKXh.exe
  C:\Windows\System\QMBNKXh.exe
  2⤵
  PID:7456
- C:\Windows\System\NSDJUhg.exe
  C:\Windows\System\NSDJUhg.exe
  2⤵
  PID:7520
- C:\Windows\System\WOJEgRS.exe
  C:\Windows\System\WOJEgRS.exe
  2⤵
  PID:7572
- C:\Windows\System\mDyPoOV.exe
  C:\Windows\System\mDyPoOV.exe
  2⤵
  PID:7652
- C:\Windows\System\MABQaVK.exe
  C:\Windows\System\MABQaVK.exe
  2⤵
  PID:7740
- C:\Windows\System\wMxZLhb.exe
  C:\Windows\System\wMxZLhb.exe
  2⤵
  PID:7764
- C:\Windows\System\mgagVai.exe
  C:\Windows\System\mgagVai.exe
  2⤵
  PID:7776
- C:\Windows\System\nzsDmdr.exe
  C:\Windows\System\nzsDmdr.exe
  2⤵
  PID:7916
- C:\Windows\System\KOPIsfG.exe
  C:\Windows\System\KOPIsfG.exe
  2⤵
  PID:8004
- C:\Windows\System\vqXsVKt.exe
  C:\Windows\System\vqXsVKt.exe
  2⤵
  PID:8028
- C:\Windows\System\FwIbVgv.exe
  C:\Windows\System\FwIbVgv.exe
  2⤵
  PID:8140
- C:\Windows\System\wItQMya.exe
  C:\Windows\System\wItQMya.exe
  2⤵
  PID:8136
- C:\Windows\System\voYAeyW.exe
  C:\Windows\System\voYAeyW.exe
  2⤵
  PID:6700
- C:\Windows\System\wMdvafE.exe
  C:\Windows\System\wMdvafE.exe
  2⤵
  PID:7396
- C:\Windows\System\OlurWOq.exe
  C:\Windows\System\OlurWOq.exe
  2⤵
  PID:7376
- C:\Windows\System\LcPRwZz.exe
  C:\Windows\System\LcPRwZz.exe
  2⤵
  PID:7600
- C:\Windows\System\sjZKtRV.exe
  C:\Windows\System\sjZKtRV.exe
  2⤵
  PID:7620
- C:\Windows\System\MpntiHl.exe
  C:\Windows\System\MpntiHl.exe
  2⤵
  PID:7852
- C:\Windows\System\rVHvXlU.exe
  C:\Windows\System\rVHvXlU.exe
  2⤵
  PID:7968
- C:\Windows\System\yojvnJi.exe
  C:\Windows\System\yojvnJi.exe
  2⤵
  PID:7548
- C:\Windows\System\LCwbYoH.exe
  C:\Windows\System\LCwbYoH.exe
  2⤵
  PID:7504
- C:\Windows\System\gfOOSpT.exe
  C:\Windows\System\gfOOSpT.exe
  2⤵
  PID:8184
- C:\Windows\System\MnEcpIo.exe
  C:\Windows\System\MnEcpIo.exe
  2⤵
  PID:8016
- C:\Windows\System\RnqxxRW.exe
  C:\Windows\System\RnqxxRW.exe
  2⤵
  PID:7248
- C:\Windows\System\LcFKgAb.exe
  C:\Windows\System\LcFKgAb.exe
  2⤵
  PID:8212
- C:\Windows\System\IsGttXJ.exe
  C:\Windows\System\IsGttXJ.exe
  2⤵
  PID:8236
- C:\Windows\System\MtgbYql.exe
  C:\Windows\System\MtgbYql.exe
  2⤵
  PID:8264
- C:\Windows\System\OnoQauH.exe
  C:\Windows\System\OnoQauH.exe
  2⤵
  PID:8284
- C:\Windows\System\ZyxvMdU.exe
  C:\Windows\System\ZyxvMdU.exe
  2⤵
  PID:8316
- C:\Windows\System\EOJQshS.exe
  C:\Windows\System\EOJQshS.exe
  2⤵
  PID:8348
- C:\Windows\System\tWJUWWn.exe
  C:\Windows\System\tWJUWWn.exe
  2⤵
  PID:8376
- C:\Windows\System\FYFdGDK.exe
  C:\Windows\System\FYFdGDK.exe
  2⤵
  PID:8400
- C:\Windows\System\FECFiKJ.exe
  C:\Windows\System\FECFiKJ.exe
  2⤵
  PID:8452
- C:\Windows\System\elfEXsb.exe
  C:\Windows\System\elfEXsb.exe
  2⤵
  PID:8472
- C:\Windows\System\OSzGJsc.exe
  C:\Windows\System\OSzGJsc.exe
  2⤵
  PID:8520
- C:\Windows\System\rvvafHC.exe
  C:\Windows\System\rvvafHC.exe
  2⤵
  PID:8552
- C:\Windows\System\nCYEkWB.exe
  C:\Windows\System\nCYEkWB.exe
  2⤵
  PID:8568
- C:\Windows\System\qHTDkNG.exe
  C:\Windows\System\qHTDkNG.exe
  2⤵
  PID:8588
- C:\Windows\System\YptFvCN.exe
  C:\Windows\System\YptFvCN.exe
  2⤵
  PID:8612
- C:\Windows\System\KduHADy.exe
  C:\Windows\System\KduHADy.exe
  2⤵
  PID:8656
- C:\Windows\System\WGdSsPC.exe
  C:\Windows\System\WGdSsPC.exe
  2⤵
  PID:8680
- C:\Windows\System\mgwdUZB.exe
  C:\Windows\System\mgwdUZB.exe
  2⤵
  PID:8696
- C:\Windows\System\GSxTCQs.exe
  C:\Windows\System\GSxTCQs.exe
  2⤵
  PID:8716
- C:\Windows\System\FMHTxoT.exe
  C:\Windows\System\FMHTxoT.exe
  2⤵
  PID:8744
- C:\Windows\System\IubdguQ.exe
  C:\Windows\System\IubdguQ.exe
  2⤵
  PID:8788
- C:\Windows\System\riDOvkQ.exe
  C:\Windows\System\riDOvkQ.exe
  2⤵
  PID:8820
- C:\Windows\System\rMtDpwK.exe
  C:\Windows\System\rMtDpwK.exe
  2⤵
  PID:8836
- C:\Windows\System\fLlrRYO.exe
  C:\Windows\System\fLlrRYO.exe
  2⤵
  PID:8864
- C:\Windows\System\OsIEFCW.exe
  C:\Windows\System\OsIEFCW.exe
  2⤵
  PID:8892
- C:\Windows\System\ohjcjcl.exe
  C:\Windows\System\ohjcjcl.exe
  2⤵
  PID:8924
- C:\Windows\System\nLDCZMr.exe
  C:\Windows\System\nLDCZMr.exe
  2⤵
  PID:8964
- C:\Windows\System\AzKvKzS.exe
  C:\Windows\System\AzKvKzS.exe
  2⤵
  PID:8988
- C:\Windows\System\nExAdvJ.exe
  C:\Windows\System\nExAdvJ.exe
  2⤵
  PID:9008
- C:\Windows\System\WvTYSGc.exe
  C:\Windows\System\WvTYSGc.exe
  2⤵
  PID:9052
- C:\Windows\System\XweqHcC.exe
  C:\Windows\System\XweqHcC.exe
  2⤵
  PID:9080
- C:\Windows\System\zKJoEmb.exe
  C:\Windows\System\zKJoEmb.exe
  2⤵
  PID:9096
- C:\Windows\System\OGwnmjT.exe
  C:\Windows\System\OGwnmjT.exe
  2⤵
  PID:9120
- C:\Windows\System\pzGwrgL.exe
  C:\Windows\System\pzGwrgL.exe
  2⤵
  PID:9160
- C:\Windows\System\vMlQIQR.exe
  C:\Windows\System\vMlQIQR.exe
  2⤵
  PID:9192
- C:\Windows\System\VMYyLvn.exe
  C:\Windows\System\VMYyLvn.exe
  2⤵
  PID:8220
- C:\Windows\System\mzjflFy.exe
  C:\Windows\System\mzjflFy.exe
  2⤵
  PID:8244
- C:\Windows\System\GhlxfqU.exe
  C:\Windows\System\GhlxfqU.exe
  2⤵
  PID:8280
- C:\Windows\System\jRFQAet.exe
  C:\Windows\System\jRFQAet.exe
  2⤵
  PID:8340
- C:\Windows\System\Kvcavaf.exe
  C:\Windows\System\Kvcavaf.exe
  2⤵
  PID:8396
- C:\Windows\System\ymPDaXu.exe
  C:\Windows\System\ymPDaXu.exe
  2⤵
  PID:8496
- C:\Windows\System\ZhGlxaa.exe
  C:\Windows\System\ZhGlxaa.exe
  2⤵
  PID:8536
- C:\Windows\System\thgOkVh.exe
  C:\Windows\System\thgOkVh.exe
  2⤵
  PID:8604
- C:\Windows\System\YbMEzqt.exe
  C:\Windows\System\YbMEzqt.exe
  2⤵
  PID:8648
- C:\Windows\System\vetLgXa.exe
  C:\Windows\System\vetLgXa.exe
  2⤵
  PID:8848
- C:\Windows\System\OPEcJYm.exe
  C:\Windows\System\OPEcJYm.exe
  2⤵
  PID:8828
- C:\Windows\System\rTwEDCR.exe
  C:\Windows\System\rTwEDCR.exe
  2⤵
  PID:8940
- C:\Windows\System\tLspBJe.exe
  C:\Windows\System\tLspBJe.exe
  2⤵
  PID:9028
- C:\Windows\System\aPFsVCr.exe
  C:\Windows\System\aPFsVCr.exe
  2⤵
  PID:9092
- C:\Windows\System\LOhyNSH.exe
  C:\Windows\System\LOhyNSH.exe
  2⤵
  PID:9112
- C:\Windows\System\YmIJgnj.exe
  C:\Windows\System\YmIJgnj.exe
  2⤵
  PID:9152
- C:\Windows\System\roTObUX.exe
  C:\Windows\System\roTObUX.exe
  2⤵
  PID:8228
- C:\Windows\System\SzkOVre.exe
  C:\Windows\System\SzkOVre.exe
  2⤵
  PID:8480
- C:\Windows\System\LXpQGPL.exe
  C:\Windows\System\LXpQGPL.exe
  2⤵
  PID:8668
- C:\Windows\System\BvFtFNx.exe
  C:\Windows\System\BvFtFNx.exe
  2⤵
  PID:8740
- C:\Windows\System\rBJwDMc.exe
  C:\Windows\System\rBJwDMc.exe
  2⤵
  PID:8816
- C:\Windows\System\xRMASun.exe
  C:\Windows\System\xRMASun.exe
  2⤵
  PID:9004
- C:\Windows\System\sIoKZjr.exe
  C:\Windows\System\sIoKZjr.exe
  2⤵
  PID:9116
- C:\Windows\System\GekXIiN.exe
  C:\Windows\System\GekXIiN.exe
  2⤵
  PID:8416
- C:\Windows\System\gUMhPZO.exe
  C:\Windows\System\gUMhPZO.exe
  2⤵
  PID:8712
- C:\Windows\System\QHXtMgi.exe
  C:\Windows\System\QHXtMgi.exe
  2⤵
  PID:9000
- C:\Windows\System\EBpYSJZ.exe
  C:\Windows\System\EBpYSJZ.exe
  2⤵
  PID:7488
- C:\Windows\System\mjpQSnS.exe
  C:\Windows\System\mjpQSnS.exe
  2⤵
  PID:9236
- C:\Windows\System\jFLyBpX.exe
  C:\Windows\System\jFLyBpX.exe
  2⤵
  PID:9260
- C:\Windows\System\wGePSqX.exe
  C:\Windows\System\wGePSqX.exe
  2⤵
  PID:9280
- C:\Windows\System\UQdzyZl.exe
  C:\Windows\System\UQdzyZl.exe
  2⤵
  PID:9308
- C:\Windows\System\fgWKbAO.exe
  C:\Windows\System\fgWKbAO.exe
  2⤵
  PID:9348
- C:\Windows\System\vhRPTAr.exe
  C:\Windows\System\vhRPTAr.exe
  2⤵
  PID:9384
- C:\Windows\System\XlalTAY.exe
  C:\Windows\System\XlalTAY.exe
  2⤵
  PID:9424
- C:\Windows\System\HKXrWqM.exe
  C:\Windows\System\HKXrWqM.exe
  2⤵
  PID:9448
- C:\Windows\System\IHdCCXo.exe
  C:\Windows\System\IHdCCXo.exe
  2⤵
  PID:9468
- C:\Windows\System\OZubXUj.exe
  C:\Windows\System\OZubXUj.exe
  2⤵
  PID:9492
- C:\Windows\System\RnoYCAH.exe
  C:\Windows\System\RnoYCAH.exe
  2⤵
  PID:9516
- C:\Windows\System\ZOMkhZy.exe
  C:\Windows\System\ZOMkhZy.exe
  2⤵
  PID:9532
- C:\Windows\System\QfkGJzG.exe
  C:\Windows\System\QfkGJzG.exe
  2⤵
  PID:9556
- C:\Windows\System\pykijYq.exe
  C:\Windows\System\pykijYq.exe
  2⤵
  PID:9604
- C:\Windows\System\wkALNJZ.exe
  C:\Windows\System\wkALNJZ.exe
  2⤵
  PID:9628
- C:\Windows\System\RKCioNu.exe
  C:\Windows\System\RKCioNu.exe
  2⤵
  PID:9652
- C:\Windows\System\ZDrUzms.exe
  C:\Windows\System\ZDrUzms.exe
  2⤵
  PID:9668
- C:\Windows\System\DGbFjuH.exe
  C:\Windows\System\DGbFjuH.exe
  2⤵
  PID:9688
- C:\Windows\System\ebmiCqW.exe
  C:\Windows\System\ebmiCqW.exe
  2⤵
  PID:9748
- C:\Windows\System\RhHIkvh.exe
  C:\Windows\System\RhHIkvh.exe
  2⤵
  PID:9768
- C:\Windows\System\DYFVDcR.exe
  C:\Windows\System\DYFVDcR.exe
  2⤵
  PID:9788
- C:\Windows\System\ypiyCga.exe
  C:\Windows\System\ypiyCga.exe
  2⤵
  PID:9808
- C:\Windows\System\WbNykVn.exe
  C:\Windows\System\WbNykVn.exe
  2⤵
  PID:9848
- C:\Windows\System\UKJRzbK.exe
  C:\Windows\System\UKJRzbK.exe
  2⤵
  PID:9884
- C:\Windows\System\xbprDZo.exe
  C:\Windows\System\xbprDZo.exe
  2⤵
  PID:9908
- C:\Windows\System\IlvKXYM.exe
  C:\Windows\System\IlvKXYM.exe
  2⤵
  PID:9928
- C:\Windows\System\abwoVde.exe
  C:\Windows\System\abwoVde.exe
  2⤵
  PID:9980
- C:\Windows\System\ALjBDMj.exe
  C:\Windows\System\ALjBDMj.exe
  2⤵
  PID:10000
- C:\Windows\System\OiWlCHr.exe
  C:\Windows\System\OiWlCHr.exe
  2⤵
  PID:10028
- C:\Windows\System\TzWlQzN.exe
  C:\Windows\System\TzWlQzN.exe
  2⤵
  PID:10048
- C:\Windows\System\ptwiPrw.exe
  C:\Windows\System\ptwiPrw.exe
  2⤵
  PID:10076
- C:\Windows\System\jZQWkgb.exe
  C:\Windows\System\jZQWkgb.exe
  2⤵
  PID:10096
- C:\Windows\System\ineqJLA.exe
  C:\Windows\System\ineqJLA.exe
  2⤵
  PID:10140
- C:\Windows\System\hScPICS.exe
  C:\Windows\System\hScPICS.exe
  2⤵
  PID:10164
- C:\Windows\System\TDXsRhW.exe
  C:\Windows\System\TDXsRhW.exe
  2⤵
  PID:10192
- C:\Windows\System\fYaMzYB.exe
  C:\Windows\System\fYaMzYB.exe
  2⤵
  PID:10232
- C:\Windows\System\jPyclbg.exe
  C:\Windows\System\jPyclbg.exe
  2⤵
  PID:8384
- C:\Windows\System\krzjHXd.exe
  C:\Windows\System\krzjHXd.exe
  2⤵
  PID:9288
- C:\Windows\System\PUJUgPd.exe
  C:\Windows\System\PUJUgPd.exe
  2⤵
  PID:9420
- C:\Windows\System\cjRCEdl.exe
  C:\Windows\System\cjRCEdl.exe
  2⤵
  PID:9480
- C:\Windows\System\xYSnnlp.exe
  C:\Windows\System\xYSnnlp.exe
  2⤵
  PID:9524
- C:\Windows\System\NTcUzgM.exe
  C:\Windows\System\NTcUzgM.exe
  2⤵
  PID:9600
- C:\Windows\System\AXaABqF.exe
  C:\Windows\System\AXaABqF.exe
  2⤵
  PID:9712
- C:\Windows\System\hJexhMF.exe
  C:\Windows\System\hJexhMF.exe
  2⤵
  PID:9756
- C:\Windows\System\KtrJYzN.exe
  C:\Windows\System\KtrJYzN.exe
  2⤵
  PID:9800
- C:\Windows\System\WlYBQvF.exe
  C:\Windows\System\WlYBQvF.exe
  2⤵
  PID:9864
- C:\Windows\System\lUFieHz.exe
  C:\Windows\System\lUFieHz.exe
  2⤵
  PID:9916
- C:\Windows\System\jlPsjpu.exe
  C:\Windows\System\jlPsjpu.exe
  2⤵
  PID:9964
- C:\Windows\System\xZEWBVI.exe
  C:\Windows\System\xZEWBVI.exe
  2⤵
  PID:10044
- C:\Windows\System\JTLxZnq.exe
  C:\Windows\System\JTLxZnq.exe
  2⤵
  PID:10148
- C:\Windows\System\qiZYnpb.exe
  C:\Windows\System\qiZYnpb.exe
  2⤵
  PID:9248
- C:\Windows\System\flofMGZ.exe
  C:\Windows\System\flofMGZ.exe
  2⤵
  PID:9360
- C:\Windows\System\iMMoHhd.exe
  C:\Windows\System\iMMoHhd.exe
  2⤵
  PID:9380
- C:\Windows\System\fDPKbWX.exe
  C:\Windows\System\fDPKbWX.exe
  2⤵
  PID:9400
- C:\Windows\System\cSEdyts.exe
  C:\Windows\System\cSEdyts.exe
  2⤵
  PID:9840
- C:\Windows\System\bdUybko.exe
  C:\Windows\System\bdUybko.exe
  2⤵
  PID:9820
- C:\Windows\System\ZnGSfdN.exe
  C:\Windows\System\ZnGSfdN.exe
  2⤵
  PID:9996
- C:\Windows\System\pLPvbdL.exe
  C:\Windows\System\pLPvbdL.exe
  2⤵
  PID:10220
- C:\Windows\System\kNhcKIE.exe
  C:\Windows\System\kNhcKIE.exe
  2⤵
  PID:9320
- C:\Windows\System\xqDTOos.exe
  C:\Windows\System\xqDTOos.exe
  2⤵
  PID:9368
- C:\Windows\System\AQVsZgH.exe
  C:\Windows\System\AQVsZgH.exe
  2⤵
  PID:9776
- C:\Windows\System\MTHSGNY.exe
  C:\Windows\System\MTHSGNY.exe
  2⤵
  PID:9952
- C:\Windows\System\UEucNxj.exe
  C:\Windows\System\UEucNxj.exe
  2⤵
  PID:10260
- C:\Windows\System\WCebnrc.exe
  C:\Windows\System\WCebnrc.exe
  2⤵
  PID:10328
- C:\Windows\System\ZOokslg.exe
  C:\Windows\System\ZOokslg.exe
  2⤵
  PID:10352
- C:\Windows\System\sXIENQF.exe
  C:\Windows\System\sXIENQF.exe
  2⤵
  PID:10376
- C:\Windows\System\JisrOoS.exe
  C:\Windows\System\JisrOoS.exe
  2⤵
  PID:10392
- C:\Windows\System\JOPkVoB.exe
  C:\Windows\System\JOPkVoB.exe
  2⤵
  PID:10424
- C:\Windows\System\BPLbeVF.exe
  C:\Windows\System\BPLbeVF.exe
  2⤵
  PID:10460
- C:\Windows\System\hAFBGCP.exe
  C:\Windows\System\hAFBGCP.exe
  2⤵
  PID:10480
- C:\Windows\System\nQSYelb.exe
  C:\Windows\System\nQSYelb.exe
  2⤵
  PID:10508
- C:\Windows\System\cGIHckT.exe
  C:\Windows\System\cGIHckT.exe
  2⤵
  PID:10532
- C:\Windows\System\IHDDIYa.exe
  C:\Windows\System\IHDDIYa.exe
  2⤵
  PID:10548
- C:\Windows\System\WaOmhXC.exe
  C:\Windows\System\WaOmhXC.exe
  2⤵
  PID:10604
- C:\Windows\System\KltLApY.exe
  C:\Windows\System\KltLApY.exe
  2⤵
  PID:10632
- C:\Windows\System\GeoriKM.exe
  C:\Windows\System\GeoriKM.exe
  2⤵
  PID:10656
- C:\Windows\System\BRMASQl.exe
  C:\Windows\System\BRMASQl.exe
  2⤵
  PID:10680
- C:\Windows\System\LYHOtVK.exe
  C:\Windows\System\LYHOtVK.exe
  2⤵
  PID:10696
- C:\Windows\System\jmocdmH.exe
  C:\Windows\System\jmocdmH.exe
  2⤵
  PID:10724
- C:\Windows\System\nAEnxTL.exe
  C:\Windows\System\nAEnxTL.exe
  2⤵
  PID:10744
- C:\Windows\System\EYWGJxf.exe
  C:\Windows\System\EYWGJxf.exe
  2⤵
  PID:10772
- C:\Windows\System\eQwLSXq.exe
  C:\Windows\System\eQwLSXq.exe
  2⤵
  PID:10824
- C:\Windows\System\WxtdOVz.exe
  C:\Windows\System\WxtdOVz.exe
  2⤵
  PID:10848
- C:\Windows\System\YRQveZR.exe
  C:\Windows\System\YRQveZR.exe
  2⤵
  PID:10904
- C:\Windows\System\mOhdJSw.exe
  C:\Windows\System\mOhdJSw.exe
  2⤵
  PID:10920
- C:\Windows\System\ExKoOYo.exe
  C:\Windows\System\ExKoOYo.exe
  2⤵
  PID:10940
- C:\Windows\System\vYfnlDQ.exe
  C:\Windows\System\vYfnlDQ.exe
  2⤵
  PID:10964
- C:\Windows\System\wTuJoEO.exe
  C:\Windows\System\wTuJoEO.exe
  2⤵
  PID:11004
- C:\Windows\System\PYOSozZ.exe
  C:\Windows\System\PYOSozZ.exe
  2⤵
  PID:11048
- C:\Windows\System\kzQbBjU.exe
  C:\Windows\System\kzQbBjU.exe
  2⤵
  PID:11072
- C:\Windows\System\jglOQBm.exe
  C:\Windows\System\jglOQBm.exe
  2⤵
  PID:11092
- C:\Windows\System\ekkdiVg.exe
  C:\Windows\System\ekkdiVg.exe
  2⤵
  PID:11108
- C:\Windows\System\bOxVhMJ.exe
  C:\Windows\System\bOxVhMJ.exe
  2⤵
  PID:11128
- C:\Windows\System\OkTyEjQ.exe
  C:\Windows\System\OkTyEjQ.exe
  2⤵
  PID:11172
- C:\Windows\System\OuzyGKG.exe
  C:\Windows\System\OuzyGKG.exe
  2⤵
  PID:11204
- C:\Windows\System\zWKanLr.exe
  C:\Windows\System\zWKanLr.exe
  2⤵
  PID:11224
- C:\Windows\System\RUvVVxS.exe
  C:\Windows\System\RUvVVxS.exe
  2⤵
  PID:11248
- C:\Windows\System\xCPUZvI.exe
  C:\Windows\System\xCPUZvI.exe
  2⤵
  PID:10012
- C:\Windows\System\FaoYTTW.exe
  C:\Windows\System\FaoYTTW.exe
  2⤵
  PID:9504
- C:\Windows\System\aeQCisj.exe
  C:\Windows\System\aeQCisj.exe
  2⤵
  PID:10364
- C:\Windows\System\yKnazJg.exe
  C:\Windows\System\yKnazJg.exe
  2⤵
  PID:10348
- C:\Windows\System\ksrfWLP.exe
  C:\Windows\System\ksrfWLP.exe
  2⤵
  PID:10416
- C:\Windows\System\GVDOEHK.exe
  C:\Windows\System\GVDOEHK.exe
  2⤵
  PID:10524
- C:\Windows\System\UmQpzCb.exe
  C:\Windows\System\UmQpzCb.exe
  2⤵
  PID:10488
- C:\Windows\System\PhxWIsM.exe
  C:\Windows\System\PhxWIsM.exe
  2⤵
  PID:10600
- C:\Windows\System\qMZcPYP.exe
  C:\Windows\System\qMZcPYP.exe
  2⤵
  PID:10740
- C:\Windows\System\TaoQatx.exe
  C:\Windows\System\TaoQatx.exe
  2⤵
  PID:10764
- C:\Windows\System\dowkDlD.exe
  C:\Windows\System\dowkDlD.exe
  2⤵
  PID:10840
- C:\Windows\System\SIxhZrH.exe
  C:\Windows\System\SIxhZrH.exe
  2⤵
  PID:10888
- C:\Windows\System\USykwEd.exe
  C:\Windows\System\USykwEd.exe
  2⤵
  PID:10932
- C:\Windows\System\SyZnuVq.exe
  C:\Windows\System\SyZnuVq.exe
  2⤵
  PID:10984
- C:\Windows\System\qoJhvbY.exe
  C:\Windows\System\qoJhvbY.exe
  2⤵
  PID:11040
- C:\Windows\System\UVGItZq.exe
  C:\Windows\System\UVGItZq.exe
  2⤵
  PID:11080
- C:\Windows\System\gDxGZnr.exe
  C:\Windows\System\gDxGZnr.exe
  2⤵
  PID:11180
- C:\Windows\System\evXuhUH.exe
  C:\Windows\System\evXuhUH.exe
  2⤵
  PID:11200
- C:\Windows\System\tNOAZvH.exe
  C:\Windows\System\tNOAZvH.exe
  2⤵
  PID:9804
- C:\Windows\System\bKgFfot.exe
  C:\Windows\System\bKgFfot.exe
  2⤵
  PID:10308
- C:\Windows\System\HbYyXpj.exe
  C:\Windows\System\HbYyXpj.exe
  2⤵
  PID:10456
- C:\Windows\System\gtwxnKz.exe
  C:\Windows\System\gtwxnKz.exe
  2⤵
  PID:10640
- C:\Windows\System\PrvNgEL.exe
  C:\Windows\System\PrvNgEL.exe
  2⤵
  PID:10712
- C:\Windows\System\uxlHHYc.exe
  C:\Windows\System\uxlHHYc.exe
  2⤵
  PID:10732
- C:\Windows\System\SswsAcQ.exe
  C:\Windows\System\SswsAcQ.exe
  2⤵
  PID:10856
- C:\Windows\System\jMkkMlq.exe
  C:\Windows\System\jMkkMlq.exe
  2⤵
  PID:11124
- C:\Windows\System\vdvuWgV.exe
  C:\Windows\System\vdvuWgV.exe
  2⤵
  PID:9252
- C:\Windows\System\NVtvUcI.exe
  C:\Windows\System\NVtvUcI.exe
  2⤵
  PID:10516
- C:\Windows\System\bcXDwtL.exe
  C:\Windows\System\bcXDwtL.exe
  2⤵
  PID:9744
- C:\Windows\System\KxMEehN.exe
  C:\Windows\System\KxMEehN.exe
  2⤵
  PID:11300
- C:\Windows\System\fQkQxwF.exe
  C:\Windows\System\fQkQxwF.exe
  2⤵
  PID:11328
- C:\Windows\System\NiEjSIm.exe
  C:\Windows\System\NiEjSIm.exe
  2⤵
  PID:11360
- C:\Windows\System\vJoLeJl.exe
  C:\Windows\System\vJoLeJl.exe
  2⤵
  PID:11388
- C:\Windows\System\PooHtuF.exe
  C:\Windows\System\PooHtuF.exe
  2⤵
  PID:11408
- C:\Windows\System\TulQzyF.exe
  C:\Windows\System\TulQzyF.exe
  2⤵
  PID:11448
- C:\Windows\System\ReXlikS.exe
  C:\Windows\System\ReXlikS.exe
  2⤵
  PID:11468
- C:\Windows\System\DSKvIFL.exe
  C:\Windows\System\DSKvIFL.exe
  2⤵
  PID:11492
- C:\Windows\System\dnhlqhS.exe
  C:\Windows\System\dnhlqhS.exe
  2⤵
  PID:11544
- C:\Windows\System\EbZAeYE.exe
  C:\Windows\System\EbZAeYE.exe
  2⤵
  PID:11564
- C:\Windows\System\lVHIAaj.exe
  C:\Windows\System\lVHIAaj.exe
  2⤵
  PID:11584
- C:\Windows\System\tyXeYrd.exe
  C:\Windows\System\tyXeYrd.exe
  2⤵
  PID:11604
- C:\Windows\System\HFPYwaq.exe
  C:\Windows\System\HFPYwaq.exe
  2⤵
  PID:11640
- C:\Windows\System\foYauIy.exe
  C:\Windows\System\foYauIy.exe
  2⤵
  PID:11684
- C:\Windows\System\EDpGnrZ.exe
  C:\Windows\System\EDpGnrZ.exe
  2⤵
  PID:11708
- C:\Windows\System\qjHyjuZ.exe
  C:\Windows\System\qjHyjuZ.exe
  2⤵
  PID:11728
- C:\Windows\System\VIbxvdv.exe
  C:\Windows\System\VIbxvdv.exe
  2⤵
  PID:11752
- C:\Windows\System\gHGEHDR.exe
  C:\Windows\System\gHGEHDR.exe
  2⤵
  PID:11768
- C:\Windows\System\efmMPxt.exe
  C:\Windows\System\efmMPxt.exe
  2⤵
  PID:11808
- C:\Windows\System\ZuEqXfC.exe
  C:\Windows\System\ZuEqXfC.exe
  2⤵
  PID:11856
- C:\Windows\System\vleXpha.exe
  C:\Windows\System\vleXpha.exe
  2⤵
  PID:11876
- C:\Windows\System\PamVjTY.exe
  C:\Windows\System\PamVjTY.exe
  2⤵
  PID:11904
- C:\Windows\System\cwBuzrE.exe
  C:\Windows\System\cwBuzrE.exe
  2⤵
  PID:11940
- C:\Windows\System\bWRldYZ.exe
  C:\Windows\System\bWRldYZ.exe
  2⤵
  PID:11956
- C:\Windows\System\apYaSDO.exe
  C:\Windows\System\apYaSDO.exe
  2⤵
  PID:11984
- C:\Windows\System\DvDjKnc.exe
  C:\Windows\System\DvDjKnc.exe
  2⤵
  PID:12008
- C:\Windows\System\VPNorki.exe
  C:\Windows\System\VPNorki.exe
  2⤵
  PID:12028
- C:\Windows\System\ysJoMHR.exe
  C:\Windows\System\ysJoMHR.exe
  2⤵
  PID:12048
- C:\Windows\System\oPRzVIN.exe
  C:\Windows\System\oPRzVIN.exe
  2⤵
  PID:12068
- C:\Windows\System\ginsjZM.exe
  C:\Windows\System\ginsjZM.exe
  2⤵
  PID:12128
- C:\Windows\System\vmDiHUI.exe
  C:\Windows\System\vmDiHUI.exe
  2⤵
  PID:12148
- C:\Windows\System\fACxLjy.exe
  C:\Windows\System\fACxLjy.exe
  2⤵
  PID:12168
- C:\Windows\System\xzpHKjd.exe
  C:\Windows\System\xzpHKjd.exe
  2⤵
  PID:12204
- C:\Windows\System\FUTfrJp.exe
  C:\Windows\System\FUTfrJp.exe
  2⤵
  PID:12228
- C:\Windows\System\JIWQscv.exe
  C:\Windows\System\JIWQscv.exe
  2⤵
  PID:12260
- C:\Windows\System\giJiqfe.exe
  C:\Windows\System\giJiqfe.exe
  2⤵
  PID:12280
- C:\Windows\System\DzXTPdc.exe
  C:\Windows\System\DzXTPdc.exe
  2⤵
  PID:10952
- C:\Windows\System\ubvwUos.exe
  C:\Windows\System\ubvwUos.exe
  2⤵
  PID:11276
- C:\Windows\System\XBXABFN.exe
  C:\Windows\System\XBXABFN.exe
  2⤵
  PID:11220
- C:\Windows\System\ZzBmLnM.exe
  C:\Windows\System\ZzBmLnM.exe
  2⤵
  PID:11400
- C:\Windows\System\IPgVRWE.exe
  C:\Windows\System\IPgVRWE.exe
  2⤵
  PID:11480
- C:\Windows\System\MYfdSOr.exe
  C:\Windows\System\MYfdSOr.exe
  2⤵
  PID:11440
- C:\Windows\System\uEBgIIP.exe
  C:\Windows\System\uEBgIIP.exe
  2⤵
  PID:11596
- C:\Windows\System\SJlowaw.exe
  C:\Windows\System\SJlowaw.exe
  2⤵
  PID:11624
- C:\Windows\System\amyDOhH.exe
  C:\Windows\System\amyDOhH.exe
  2⤵
  PID:11676
- C:\Windows\System\etENQrx.exe
  C:\Windows\System\etENQrx.exe
  2⤵
  PID:11788
- C:\Windows\System\oEPnrBj.exe
  C:\Windows\System\oEPnrBj.exe
  2⤵
  PID:3696
- C:\Windows\System\YItfGNE.exe
  C:\Windows\System\YItfGNE.exe
  2⤵
  PID:11900
- C:\Windows\System\BYANZGi.exe
  C:\Windows\System\BYANZGi.exe
  2⤵
  PID:11948
- C:\Windows\System\EbnUGVP.exe
  C:\Windows\System\EbnUGVP.exe
  2⤵
  PID:12016
- C:\Windows\System\TbSdjRk.exe
  C:\Windows\System\TbSdjRk.exe
  2⤵
  PID:12108
- C:\Windows\System\hDDsdaG.exe
  C:\Windows\System\hDDsdaG.exe
  2⤵
  PID:12104
- C:\Windows\System\cfeMBLP.exe
  C:\Windows\System\cfeMBLP.exe
  2⤵
  PID:8580
- C:\Windows\System\TfZjxfY.exe
  C:\Windows\System\TfZjxfY.exe
  2⤵
  PID:3136
- C:\Windows\System\qcrSUOe.exe
  C:\Windows\System\qcrSUOe.exe
  2⤵
  PID:12268
- C:\Windows\System\jRYVVjK.exe
  C:\Windows\System\jRYVVjK.exe
  2⤵
  PID:11028
- C:\Windows\System\ecQWYJk.exe
  C:\Windows\System\ecQWYJk.exe
  2⤵
  PID:11312
- C:\Windows\System\BOqZSyX.exe
  C:\Windows\System\BOqZSyX.exe
  2⤵
  PID:11416
- C:\Windows\System\DGIOdoT.exe
  C:\Windows\System\DGIOdoT.exe
  2⤵
  PID:11560
- C:\Windows\System\qWlCFWm.exe
  C:\Windows\System\qWlCFWm.exe
  2⤵
  PID:11844
- C:\Windows\System\zMUDMzi.exe
  C:\Windows\System\zMUDMzi.exe
  2⤵
  PID:12112
- C:\Windows\System\tjRpdtG.exe
  C:\Windows\System\tjRpdtG.exe
  2⤵
  PID:2248
- C:\Windows\System\sfJSPLq.exe
  C:\Windows\System\sfJSPLq.exe
  2⤵
  PID:3096
- C:\Windows\System\ovwusth.exe
  C:\Windows\System\ovwusth.exe
  2⤵
  PID:4248
- C:\Windows\System\bmuVofl.exe
  C:\Windows\System\bmuVofl.exe
  2⤵
  PID:12272
- C:\Windows\System\rmBlruY.exe
  C:\Windows\System\rmBlruY.exe
  2⤵
  PID:10988
- C:\Windows\System\xxqombb.exe
  C:\Windows\System\xxqombb.exe
  2⤵
  PID:11376
- C:\Windows\System\KDsDosD.exe
  C:\Windows\System\KDsDosD.exe
  2⤵
  PID:11516
- C:\Windows\System\ZfCxzdT.exe
  C:\Windows\System\ZfCxzdT.exe
  2⤵
  PID:12056
- C:\Windows\System\dIafckg.exe
  C:\Windows\System\dIafckg.exe
  2⤵
  PID:12252
- C:\Windows\System\ERnLHVN.exe
  C:\Windows\System\ERnLHVN.exe
  2⤵
  PID:11760
- C:\Windows\System\yugTlra.exe
  C:\Windows\System\yugTlra.exe
  2⤵
  PID:5016
- C:\Windows\System\vbJbXaw.exe
  C:\Windows\System\vbJbXaw.exe
  2⤵
  PID:12328
- C:\Windows\System\nPqfqHv.exe
  C:\Windows\System\nPqfqHv.exe
  2⤵
  PID:12348
- C:\Windows\System\GlIjgrY.exe
  C:\Windows\System\GlIjgrY.exe
  2⤵
  PID:12368
- C:\Windows\System\eTyvfSP.exe
  C:\Windows\System\eTyvfSP.exe
  2⤵
  PID:12392
- C:\Windows\System\tHmBYoe.exe
  C:\Windows\System\tHmBYoe.exe
  2⤵
  PID:12420
- C:\Windows\System\soHHUKn.exe
  C:\Windows\System\soHHUKn.exe
  2⤵
  PID:12440
- C:\Windows\System\OlpGREw.exe
  C:\Windows\System\OlpGREw.exe
  2⤵
  PID:12464
- C:\Windows\System\CtZIaLw.exe
  C:\Windows\System\CtZIaLw.exe
  2⤵
  PID:12512
- C:\Windows\System\BGKoZPg.exe
  C:\Windows\System\BGKoZPg.exe
  2⤵
  PID:12540
- C:\Windows\System\XyMrdhV.exe
  C:\Windows\System\XyMrdhV.exe
  2⤵
  PID:12560
- C:\Windows\System\SQlcTJn.exe
  C:\Windows\System\SQlcTJn.exe
  2⤵
  PID:12588
- C:\Windows\System\hhYzscs.exe
  C:\Windows\System\hhYzscs.exe
  2⤵
  PID:12628
- C:\Windows\System\BAsdOMu.exe
  C:\Windows\System\BAsdOMu.exe
  2⤵
  PID:12648
- C:\Windows\System\oOCeKWX.exe
  C:\Windows\System\oOCeKWX.exe
  2⤵
  PID:12676
- C:\Windows\System\NqkVGRq.exe
  C:\Windows\System\NqkVGRq.exe
  2⤵
  PID:12708
- C:\Windows\System\qFxVeRi.exe
  C:\Windows\System\qFxVeRi.exe
  2⤵
  PID:12728
- C:\Windows\System\AvWyIFW.exe
  C:\Windows\System\AvWyIFW.exe
  2⤵
  PID:12748
- C:\Windows\System\wwwmJUX.exe
  C:\Windows\System\wwwmJUX.exe
  2⤵
  PID:12784
- C:\Windows\System\ZtGltKX.exe
  C:\Windows\System\ZtGltKX.exe
  2⤵
  PID:12800
- C:\Windows\System\XWSunpI.exe
  C:\Windows\System\XWSunpI.exe
  2⤵
  PID:12836
- C:\Windows\System\mNqYhYD.exe
  C:\Windows\System\mNqYhYD.exe
  2⤵
  PID:12860
- C:\Windows\System\nXsCzqx.exe
  C:\Windows\System\nXsCzqx.exe
  2⤵
  PID:12892
- C:\Windows\System\RWBMXdN.exe
  C:\Windows\System\RWBMXdN.exe
  2⤵
  PID:12932
- C:\Windows\System\viiMADc.exe
  C:\Windows\System\viiMADc.exe
  2⤵
  PID:12956
- C:\Windows\System\Xlrwiye.exe
  C:\Windows\System\Xlrwiye.exe
  2⤵
  PID:12976
- C:\Windows\System\OmYZDQJ.exe
  C:\Windows\System\OmYZDQJ.exe
  2⤵
  PID:12996
- C:\Windows\System\SdbRdjM.exe
  C:\Windows\System\SdbRdjM.exe
  2⤵
  PID:13024
- C:\Windows\System\dGzQYpb.exe
  C:\Windows\System\dGzQYpb.exe
  2⤵
  PID:13052
- C:\Windows\System\OOQRmQH.exe
  C:\Windows\System\OOQRmQH.exe
  2⤵
  PID:13088
- C:\Windows\System\nqdlIZN.exe
  C:\Windows\System\nqdlIZN.exe
  2⤵
  PID:13108
- C:\Windows\System\LUfbczY.exe
  C:\Windows\System\LUfbczY.exe
  2⤵
  PID:13128
- C:\Windows\System\qQEgPoN.exe
  C:\Windows\System\qQEgPoN.exe
  2⤵
  PID:13156
- C:\Windows\System\JMehOas.exe
  C:\Windows\System\JMehOas.exe
  2⤵
  PID:13212
- C:\Windows\System\GnmWdsc.exe
  C:\Windows\System\GnmWdsc.exe
  2⤵
  PID:13236
- C:\Windows\System\JxchbUJ.exe
  C:\Windows\System\JxchbUJ.exe
  2⤵
  PID:13252
- C:\Windows\System\MWMOJKm.exe
  C:\Windows\System\MWMOJKm.exe
  2⤵
  PID:13276
- C:\Windows\System\LFnGNIC.exe
  C:\Windows\System\LFnGNIC.exe
  2⤵
  PID:13308
- C:\Windows\System\MYJGbMO.exe
  C:\Windows\System\MYJGbMO.exe
  2⤵
  PID:2172
- C:\Windows\System\ucZZqJc.exe
  C:\Windows\System\ucZZqJc.exe
  2⤵
  PID:12360
- C:\Windows\System\QtORzrD.exe
  C:\Windows\System\QtORzrD.exe
  2⤵
  PID:12452
- C:\Windows\System\gCwYCCF.exe
  C:\Windows\System\gCwYCCF.exe
  2⤵
  PID:12832
- C:\Windows\System\aRRKeEo.exe
  C:\Windows\System\aRRKeEo.exe
  2⤵
  PID:12852
- C:\Windows\System\esPyWtd.exe
  C:\Windows\System\esPyWtd.exe
  2⤵
  PID:12908
- C:\Windows\System\NxFoESt.exe
  C:\Windows\System\NxFoESt.exe
  2⤵
  PID:12940
- C:\Windows\System\XoehlxD.exe
  C:\Windows\System\XoehlxD.exe
  2⤵
  PID:12968
- C:\Windows\System\boeoqYg.exe
  C:\Windows\System\boeoqYg.exe
  2⤵
  PID:13012
- C:\Windows\System\bOgvXxV.exe
  C:\Windows\System\bOgvXxV.exe
  2⤵
  PID:13044
- C:\Windows\System\eHToDFp.exe
  C:\Windows\System\eHToDFp.exe
  2⤵
  PID:13076
- C:\Windows\System\vzyFecA.exe
  C:\Windows\System\vzyFecA.exe
  2⤵
  PID:13124
- C:\Windows\System\taRYxzu.exe
  C:\Windows\System\taRYxzu.exe
  2⤵
  PID:13176
- C:\Windows\System\MEkFyTv.exe
  C:\Windows\System\MEkFyTv.exe
  2⤵
  PID:12736
- C:\Windows\System\SZTXoJN.exe
  C:\Windows\System\SZTXoJN.exe
  2⤵
  PID:12584
- C:\Windows\System\JSJzLJe.exe
  C:\Windows\System\JSJzLJe.exe
  2⤵
  PID:13196
- C:\Windows\System\xMRBEVp.exe
  C:\Windows\System\xMRBEVp.exe
  2⤵
  PID:13104
- C:\Windows\System\oCYdgmt.exe
  C:\Windows\System\oCYdgmt.exe
  2⤵
  PID:13288
- C:\Windows\System\mwawSro.exe
  C:\Windows\System\mwawSro.exe
  2⤵
  PID:4092
- C:\Windows\System\Iswfcjv.exe
  C:\Windows\System\Iswfcjv.exe
  2⤵
  PID:12772
- C:\Windows\System\qzmfUJp.exe
  C:\Windows\System\qzmfUJp.exe
  2⤵
  PID:13360
- C:\Windows\System\eZdwVoY.exe
  C:\Windows\System\eZdwVoY.exe
  2⤵
  PID:13376
- C:\Windows\System\mGmMVRC.exe
  C:\Windows\System\mGmMVRC.exe
  2⤵
  PID:13404
- C:\Windows\System\wHIQpIy.exe
  C:\Windows\System\wHIQpIy.exe
  2⤵
  PID:13420
- C:\Windows\System\BuLdHQl.exe
  C:\Windows\System\BuLdHQl.exe
  2⤵
  PID:13436
- C:\Windows\System\ctXAbRG.exe
  C:\Windows\System\ctXAbRG.exe
  2⤵
  PID:13472
- C:\Windows\System\VlMZUCO.exe
  C:\Windows\System\VlMZUCO.exe
  2⤵
  PID:13564
- C:\Windows\System\LGjTPzu.exe
  C:\Windows\System\LGjTPzu.exe
  2⤵
  PID:13864
- C:\Windows\System\QhTXaGC.exe
  C:\Windows\System\QhTXaGC.exe
  2⤵
  PID:13880
- C:\Windows\System\mNWqYVb.exe
  C:\Windows\System\mNWqYVb.exe
  2⤵
  PID:13912
- C:\Windows\System\gOqjFkx.exe
  C:\Windows\System\gOqjFkx.exe
  2⤵
  PID:13932
- C:\Windows\System\YeRDWOu.exe
  C:\Windows\System\YeRDWOu.exe
  2⤵
  PID:13964
- C:\Windows\System\uiboQrH.exe
  C:\Windows\System\uiboQrH.exe
  2⤵
  PID:13336
- C:\Windows\System\xNwbZdS.exe
  C:\Windows\System\xNwbZdS.exe
  2⤵
  PID:13372
- C:\Windows\System\grcYTaz.exe
  C:\Windows\System\grcYTaz.exe
  2⤵
  PID:13560
- C:\Windows\System\qGmNTBX.exe
  C:\Windows\System\qGmNTBX.exe
  2⤵
  PID:13576
- C:\Windows\System\HbrEpIb.exe
  C:\Windows\System\HbrEpIb.exe
  2⤵
  PID:6064
- C:\Windows\System\WwXOVQH.exe
  C:\Windows\System\WwXOVQH.exe
  2⤵
  PID:13636
- C:\Windows\System\hHczLMr.exe
  C:\Windows\System\hHczLMr.exe
  2⤵
  PID:7656
- C:\Windows\System\DJySJCI.exe
  C:\Windows\System\DJySJCI.exe
  2⤵
  PID:12488
- C:\Windows\System\GEbbjSl.exe
  C:\Windows\System\GEbbjSl.exe
  2⤵
  PID:5316
- C:\Windows\System\CtndTSR.exe
  C:\Windows\System\CtndTSR.exe
  2⤵
  PID:212
- C:\Windows\System\VexJyQx.exe
  C:\Windows\System\VexJyQx.exe
  2⤵
  PID:8012
- C:\Windows\System\QgqfcsQ.exe
  C:\Windows\System\QgqfcsQ.exe
  2⤵
  PID:8808
- C:\Windows\System\IgIzkHg.exe
  C:\Windows\System\IgIzkHg.exe
  2⤵
  PID:6512
- C:\Windows\System\jHIJvEW.exe
  C:\Windows\System\jHIJvEW.exe
  2⤵
  PID:5312
- C:\Windows\System\UjLYnnF.exe
  C:\Windows\System\UjLYnnF.exe
  2⤵
  PID:5304
- C:\Windows\System\BrIbrnI.exe
  C:\Windows\System\BrIbrnI.exe
  2⤵
  PID:2640
- C:\Windows\System\JRgbImS.exe
  C:\Windows\System\JRgbImS.exe
  2⤵
  PID:12756
- C:\Windows\System\qLrZFcX.exe
  C:\Windows\System\qLrZFcX.exe
  2⤵
  PID:8800
- C:\Windows\System\KTaNjsC.exe
  C:\Windows\System\KTaNjsC.exe
  2⤵
  PID:9724
- C:\Windows\System\swxQTVW.exe
  C:\Windows\System\swxQTVW.exe
  2⤵
  PID:8776
- C:\Windows\System\zRYRuiQ.exe
  C:\Windows\System\zRYRuiQ.exe
  2⤵
  PID:13676
- C:\Windows\System\buvRMaj.exe
  C:\Windows\System\buvRMaj.exe
  2⤵
  PID:13996
- C:\Windows\System\aoFjxaH.exe
  C:\Windows\System\aoFjxaH.exe
  2⤵
  PID:5208
- C:\Windows\System\gZwkceF.exe
  C:\Windows\System\gZwkceF.exe
  2⤵
  PID:10084
- C:\Windows\System\vtlPlJJ.exe
  C:\Windows\System\vtlPlJJ.exe
  2⤵
  PID:7256
- C:\Windows\System\JIGabPW.exe
  C:\Windows\System\JIGabPW.exe
  2⤵
  PID:8976
- C:\Windows\System\tUlIvNs.exe
  C:\Windows\System\tUlIvNs.exe
  2⤵
  PID:14132
- C:\Windows\System\gQLtPRz.exe
  C:\Windows\System\gQLtPRz.exe
  2⤵
  PID:2584
- C:\Windows\System\JCjLdJL.exe
  C:\Windows\System\JCjLdJL.exe
  2⤵
  PID:7304
- C:\Windows\System\xYnHAzF.exe
  C:\Windows\System\xYnHAzF.exe
  2⤵
  PID:14136
- C:\Windows\System\yFoEOOg.exe
  C:\Windows\System\yFoEOOg.exe
  2⤵
  PID:9904
- C:\Windows\System\UrCMNLm.exe
  C:\Windows\System\UrCMNLm.exe
  2⤵
  PID:8276
- C:\Windows\System\CpWdtge.exe
  C:\Windows\System\CpWdtge.exe
  2⤵
  PID:8072
- C:\Windows\System\PYJOnFL.exe
  C:\Windows\System\PYJOnFL.exe
  2⤵
  PID:4892
- C:\Windows\System\aqUCbke.exe
  C:\Windows\System\aqUCbke.exe
  2⤵
  PID:14176
- C:\Windows\System\qMLZaeu.exe
  C:\Windows\System\qMLZaeu.exe
  2⤵
  PID:8672
- C:\Windows\System\oRMrfCb.exe
  C:\Windows\System\oRMrfCb.exe
  2⤵
  PID:14220
- C:\Windows\System\fAMmmbB.exe
  C:\Windows\System\fAMmmbB.exe
  2⤵
  PID:10292
- C:\Windows\System\jZULSIC.exe
  C:\Windows\System\jZULSIC.exe
  2⤵
  PID:8460
- C:\Windows\System\tkwXjKK.exe
  C:\Windows\System\tkwXjKK.exe
  2⤵
  PID:14272
- C:\Windows\System\dDspOWQ.exe
  C:\Windows\System\dDspOWQ.exe
  2⤵
  PID:2800
- C:\Windows\System\UVBkJlN.exe
  C:\Windows\System\UVBkJlN.exe
  2⤵
  PID:8488
- C:\Windows\System\MjPnBTR.exe
  C:\Windows\System\MjPnBTR.exe
  2⤵
  PID:7496
- C:\Windows\System\qFaogpw.exe
  C:\Windows\System\qFaogpw.exe
  2⤵
  PID:6368
- C:\Windows\System\wDvOsfU.exe
  C:\Windows\System\wDvOsfU.exe
  2⤵
  PID:8532
- C:\Windows\System\NimLGnF.exe
  C:\Windows\System\NimLGnF.exe
  2⤵
  PID:4008
- C:\Windows\System\rIoALTy.exe
  C:\Windows\System\rIoALTy.exe
  2⤵
  PID:5248
- C:\Windows\System\VuBQqZB.exe
  C:\Windows\System\VuBQqZB.exe
  2⤵
  PID:14332
- C:\Windows\System\TYwhYOk.exe
  C:\Windows\System\TYwhYOk.exe
  2⤵
  PID:10584
- C:\Windows\System\epjubNA.exe
  C:\Windows\System\epjubNA.exe
  2⤵
  PID:2012
- C:\Windows\System\YHfLLzk.exe
  C:\Windows\System\YHfLLzk.exe
  2⤵
  PID:8644
- C:\Windows\System\qAnKrpl.exe
  C:\Windows\System\qAnKrpl.exe
  2⤵
  PID:6532
- C:\Windows\System\tkJyIfl.exe
  C:\Windows\System\tkJyIfl.exe
  2⤵
  PID:10708
- C:\Windows\System\aYbQgKR.exe
  C:\Windows\System\aYbQgKR.exe
  2⤵
  PID:10752
- C:\Windows\System\OBDNyFR.exe
  C:\Windows\System\OBDNyFR.exe
  2⤵
  PID:2656
- C:\Windows\System\jtHmGYA.exe
  C:\Windows\System\jtHmGYA.exe
  2⤵
  PID:10804
- C:\Windows\System\RrIyotS.exe
  C:\Windows\System\RrIyotS.exe
  2⤵
  PID:9704
- C:\Windows\System\TsYWmuQ.exe
  C:\Windows\System\TsYWmuQ.exe
  2⤵
  PID:10876
- C:\Windows\System\aCAUzdy.exe
  C:\Windows\System\aCAUzdy.exe
  2⤵
  PID:12604
- C:\Windows\System\ntZshvC.exe
  C:\Windows\System\ntZshvC.exe
  2⤵
  PID:12700
- C:\Windows\System\whIbvoh.exe
  C:\Windows\System\whIbvoh.exe
  2⤵
  PID:12924
- C:\Windows\System\StHAjZg.exe
  C:\Windows\System\StHAjZg.exe
  2⤵
  PID:8124
- C:\Windows\System\lphAbQs.exe
  C:\Windows\System\lphAbQs.exe
  2⤵
  PID:2812
- C:\Windows\System\DIcSqMb.exe
  C:\Windows\System\DIcSqMb.exe
  2⤵
  PID:13352
- C:\Windows\System\NibdnRV.exe
  C:\Windows\System\NibdnRV.exe
  2⤵
  PID:10980
- C:\Windows\System\TKBahBa.exe
  C:\Windows\System\TKBahBa.exe
  2⤵
  PID:4424
- C:\Windows\System\qtHWIjE.exe
  C:\Windows\System\qtHWIjE.exe
  2⤵
  PID:11016
- C:\Windows\System\VXYeybX.exe
  C:\Windows\System\VXYeybX.exe
  2⤵
  PID:13292
- C:\Windows\System\mpwNQfN.exe
  C:\Windows\System\mpwNQfN.exe
  2⤵
  PID:11068
- C:\Windows\System\TTkkzNb.exe
  C:\Windows\System\TTkkzNb.exe
  2⤵
  PID:10036
- C:\Windows\System\XOfKQYQ.exe
  C:\Windows\System\XOfKQYQ.exe
  2⤵
  PID:6764
- C:\Windows\System\fNdrGPg.exe
  C:\Windows\System\fNdrGPg.exe
  2⤵
  PID:13428
- C:\Windows\System\uzPessE.exe
  C:\Windows\System\uzPessE.exe
  2⤵
  PID:392
- C:\Windows\System\GzawsZJ.exe
  C:\Windows\System\GzawsZJ.exe
  2⤵
  PID:13500
- C:\Windows\System\JdOrGPf.exe
  C:\Windows\System\JdOrGPf.exe
  2⤵
  PID:6804
- C:\Windows\System\ZDhjLHP.exe
  C:\Windows\System\ZDhjLHP.exe
  2⤵
  PID:5904
- C:\Windows\System\afESeYk.exe
  C:\Windows\System\afESeYk.exe
  2⤵
  PID:9272
- C:\Windows\System\itnVUkH.exe
  C:\Windows\System\itnVUkH.exe
  2⤵
  PID:1144
- C:\Windows\System\kzrZmUF.exe
  C:\Windows\System\kzrZmUF.exe
  2⤵
  PID:1272
- C:\Windows\System\PqirJRb.exe
  C:\Windows\System\PqirJRb.exe
  2⤵
  PID:9208
- C:\Windows\System\HnsijHL.exe
  C:\Windows\System\HnsijHL.exe
  2⤵
  PID:6852
- C:\Windows\System\mrfkZAp.exe
  C:\Windows\System\mrfkZAp.exe
  2⤵
  PID:7688
- C:\Windows\System\YJEahdK.exe
  C:\Windows\System\YJEahdK.exe
  2⤵
  PID:6996
- C:\Windows\System\spcseAF.exe
  C:\Windows\System\spcseAF.exe
  2⤵
  PID:4732
- C:\Windows\System\WrrooiP.exe
  C:\Windows\System\WrrooiP.exe
  2⤵
  PID:10784
- C:\Windows\System\UZKhiSd.exe
  C:\Windows\System\UZKhiSd.exe
  2⤵
  PID:7952
- C:\Windows\System\qnxisAt.exe
  C:\Windows\System\qnxisAt.exe
  2⤵
  PID:4152
- C:\Windows\System\BcViWTk.exe
  C:\Windows\System\BcViWTk.exe
  2⤵
  PID:2760
- C:\Windows\System\kFbyUkP.exe
  C:\Windows\System\kFbyUkP.exe
  2⤵
  PID:1948
- C:\Windows\System\KVdWZsm.exe
  C:\Windows\System\KVdWZsm.exe
  2⤵
  PID:3460
- C:\Windows\System\AiGBQah.exe
  C:\Windows\System\AiGBQah.exe
  2⤵
  PID:388
- C:\Windows\System\BPkCjkP.exe
  C:\Windows\System\BPkCjkP.exe
  2⤵
  PID:8108
- C:\Windows\System\tlTIPVl.exe
  C:\Windows\System\tlTIPVl.exe
  2⤵
  PID:13872
- C:\Windows\System\aUudmkS.exe
  C:\Windows\System\aUudmkS.exe
  2⤵
  PID:13928
- C:\Windows\System\JshaYlb.exe
  C:\Windows\System\JshaYlb.exe
  2⤵
  PID:13936
- C:\Windows\System\jCOMXag.exe
  C:\Windows\System\jCOMXag.exe
  2⤵
  PID:13960
- C:\Windows\System\JRNOPXw.exe
  C:\Windows\System\JRNOPXw.exe
  2⤵
  PID:1876
- C:\Windows\System\ZVuJjVV.exe
  C:\Windows\System\ZVuJjVV.exe
  2⤵
  PID:1032
- C:\Windows\System\bgWUTRO.exe
  C:\Windows\System\bgWUTRO.exe
  2⤵
  PID:7644
- C:\Windows\System\JJGVRLd.exe
  C:\Windows\System\JJGVRLd.exe
  2⤵
  PID:3132
- C:\Windows\System\iSkKuEG.exe
  C:\Windows\System\iSkKuEG.exe
  2⤵
  PID:14060
- C:\Windows\System\QIEsxkg.exe
  C:\Windows\System\QIEsxkg.exe
  2⤵
  PID:11508
- C:\Windows\System\ZZmxjgM.exe
  C:\Windows\System\ZZmxjgM.exe
  2⤵
  PID:11836
- C:\Windows\System\MnueyXx.exe
  C:\Windows\System\MnueyXx.exe
  2⤵
  PID:11912
- C:\Windows\System\TiVSdyK.exe
  C:\Windows\System\TiVSdyK.exe
  2⤵
  PID:4380
- C:\Windows\System\uHUUlBr.exe
  C:\Windows\System\uHUUlBr.exe
  2⤵
  PID:5104
- C:\Windows\System\xIMuxLT.exe
  C:\Windows\System\xIMuxLT.exe
  2⤵
  PID:7232
- C:\Windows\System\QMcXOjR.exe
  C:\Windows\System\QMcXOjR.exe
  2⤵
  PID:11784
- C:\Windows\System\BDknzLS.exe
  C:\Windows\System\BDknzLS.exe
  2⤵
  PID:3668
- C:\Windows\System\XAlZdCb.exe
  C:\Windows\System\XAlZdCb.exe
  2⤵
  PID:7732
- C:\Windows\System\vYSmHGe.exe
  C:\Windows\System\vYSmHGe.exe
  2⤵
  PID:8428
- C:\Windows\System\kWxvsrr.exe
  C:\Windows\System\kWxvsrr.exe
  2⤵
  PID:14104
- C:\Windows\System\CuKSxAh.exe
  C:\Windows\System\CuKSxAh.exe
  2⤵
  PID:12000
- C:\Windows\System\mtueWaE.exe
  C:\Windows\System\mtueWaE.exe
  2⤵
  PID:5112
- C:\Windows\System\TJzQKbn.exe
  C:\Windows\System\TJzQKbn.exe
  2⤵
  PID:3040
- C:\Windows\System\NYJfWbZ.exe
  C:\Windows\System\NYJfWbZ.exe
  2⤵
  PID:5020
- C:\Windows\System\TKUEUsg.exe
  C:\Windows\System\TKUEUsg.exe
  2⤵
  PID:3640
- C:\Windows\System\lDfFItG.exe
  C:\Windows\System\lDfFItG.exe
  2⤵
  PID:1772
- C:\Windows\System\NrVERiA.exe
  C:\Windows\System\NrVERiA.exe
  2⤵
  PID:14128
- C:\Windows\System\tDjHorq.exe
  C:\Windows\System\tDjHorq.exe
  2⤵
  PID:3780
- C:\Windows\System\ZPSRDoa.exe
  C:\Windows\System\ZPSRDoa.exe
  2⤵
  PID:5700
- C:\Windows\System\keGftgM.exe
  C:\Windows\System\keGftgM.exe
  2⤵
  PID:7196
- C:\Windows\System\SlATPpb.exe
  C:\Windows\System\SlATPpb.exe
  2⤵
  PID:3752
- C:\Windows\System\QWliLlb.exe
  C:\Windows\System\QWliLlb.exe
  2⤵
  PID:9104
- C:\Windows\System\ocPWRuW.exe
  C:\Windows\System\ocPWRuW.exe
  2⤵
  PID:5528
- C:\Windows\System\GUkJVsw.exe
  C:\Windows\System\GUkJVsw.exe
  2⤵
  PID:14164
- C:\Windows\System\UIdHahz.exe
  C:\Windows\System\UIdHahz.exe
  2⤵
  PID:14216
- C:\Windows\System\sGpxKyL.exe
  C:\Windows\System\sGpxKyL.exe
  2⤵
  PID:3880
- C:\Windows\System\yMGEHyr.exe
  C:\Windows\System\yMGEHyr.exe
  2⤵
  PID:8388
- C:\Windows\System\UKfwzlt.exe
  C:\Windows\System\UKfwzlt.exe
  2⤵
  PID:5976
- C:\Windows\System\uSekIBq.exe
  C:\Windows\System\uSekIBq.exe
  2⤵
  PID:14212
- C:\Windows\System\eocqFlh.exe
  C:\Windows\System\eocqFlh.exe
  2⤵
  PID:3448
- C:\Windows\System\SpQvKVZ.exe
  C:\Windows\System\SpQvKVZ.exe
  2⤵
  PID:7432
- C:\Windows\System\CMvJccy.exe
  C:\Windows\System\CMvJccy.exe
  2⤵
  PID:2036
- C:\Windows\System\qNFogMX.exe
  C:\Windows\System\qNFogMX.exe
  2⤵
  PID:5256
- C:\Windows\System\WFFvhqW.exe
  C:\Windows\System\WFFvhqW.exe
  2⤵
  PID:5604
- C:\Windows\System\vSqOHcA.exe
  C:\Windows\System\vSqOHcA.exe
  2⤵
  PID:9356
- C:\Windows\System\IiYoxKO.exe
  C:\Windows\System\IiYoxKO.exe
  2⤵
  PID:5724
- C:\Windows\System\HUroEud.exe
  C:\Windows\System\HUroEud.exe
  2⤵
  PID:5464
- C:\Windows\System\HoyUXPc.exe
  C:\Windows\System\HoyUXPc.exe
  2⤵
  PID:1068
- C:\Windows\System\PwbUZFF.exe
  C:\Windows\System\PwbUZFF.exe
  2⤵
  PID:8504
- C:\Windows\System\zHMsDrb.exe
  C:\Windows\System\zHMsDrb.exe
  2⤵
  PID:5124
- C:\Windows\System\IzPIXol.exe
  C:\Windows\System\IzPIXol.exe
  2⤵
  PID:6080
- C:\Windows\System\UBqUOir.exe
  C:\Windows\System\UBqUOir.exe
  2⤵
  PID:5692
- C:\Windows\System\rvhhKhN.exe
  C:\Windows\System\rvhhKhN.exe
  2⤵
  PID:8608
- C:\Windows\System\saanqxi.exe
  C:\Windows\System\saanqxi.exe
  2⤵
  PID:4836
- C:\Windows\System\KHNbHRW.exe
  C:\Windows\System\KHNbHRW.exe
  2⤵
  PID:5476
- C:\Windows\System\RcohKLj.exe
  C:\Windows\System\RcohKLj.exe
  2⤵
  PID:7648
- C:\Windows\System\uMXxbbn.exe
  C:\Windows\System\uMXxbbn.exe
  2⤵
  PID:10572
- C:\Windows\System\wWpMdEm.exe
  C:\Windows\System\wWpMdEm.exe
  2⤵
  PID:7660
- C:\Windows\System\nHoQWxW.exe
  C:\Windows\System\nHoQWxW.exe
  2⤵
  PID:10672
- C:\Windows\System\TTHktHV.exe
  C:\Windows\System\TTHktHV.exe
  2⤵
  PID:9588
- C:\Windows\System\LELGTDu.exe
  C:\Windows\System\LELGTDu.exe
  2⤵
  PID:9580
- C:\Windows\System\WPlgaoC.exe
  C:\Windows\System\WPlgaoC.exe
  2⤵
  PID:6436
- C:\Windows\System\pCtKyVy.exe
  C:\Windows\System\pCtKyVy.exe
  2⤵
  PID:6312
- C:\Windows\System\rNoOHBk.exe
  C:\Windows\System\rNoOHBk.exe
  2⤵
  PID:10836
- C:\Windows\System\lxlYZMN.exe
  C:\Windows\System\lxlYZMN.exe
  2⤵
  PID:6544
- C:\Windows\System\RihWord.exe
  C:\Windows\System\RihWord.exe
  2⤵
  PID:12336
- C:\Windows\System\vcEjJja.exe
  C:\Windows\System\vcEjJja.exe
  2⤵
  PID:12724
- C:\Windows\System\unbmTry.exe
  C:\Windows\System\unbmTry.exe
  2⤵
  PID:13896
- C:\Windows\System\eZrTgyz.exe
  C:\Windows\System\eZrTgyz.exe
  2⤵
  PID:12716
- C:\Windows\System\fgxrBdV.exe
  C:\Windows\System\fgxrBdV.exe
  2⤵
  PID:13316
- C:\Windows\System\lECyuDz.exe
  C:\Windows\System\lECyuDz.exe
  2⤵
  PID:8984
- C:\Windows\System\VazlfJi.exe
  C:\Windows\System\VazlfJi.exe
  2⤵
  PID:6772
- C:\Windows\System\vhlMDhk.exe
  C:\Windows\System\vhlMDhk.exe
  2⤵
  PID:2996
- C:\Windows\System\gnKTrqk.exe
  C:\Windows\System\gnKTrqk.exe
  2⤵
  PID:11056
- C:\Windows\System\FusGKzU.exe
  C:\Windows\System\FusGKzU.exe
  2⤵
  PID:3612
- C:\Windows\System\DDcymMH.exe
  C:\Windows\System\DDcymMH.exe
  2⤵
  PID:7188
- C:\Windows\System\KklyVjF.exe
  C:\Windows\System\KklyVjF.exe
  2⤵
  PID:6192
- C:\Windows\System\jngSntH.exe
  C:\Windows\System\jngSntH.exe
  2⤵
  PID:10180
- C:\Windows\System\rhcGRYh.exe
  C:\Windows\System\rhcGRYh.exe
  2⤵
  PID:9128
- C:\Windows\System\TewKcqH.exe
  C:\Windows\System\TewKcqH.exe
  2⤵
  PID:6248
- C:\Windows\System\ekNevCD.exe
  C:\Windows\System\ekNevCD.exe
  2⤵
  PID:1800
- C:\Windows\System\vJfUoKR.exe
  C:\Windows\System\vJfUoKR.exe
  2⤵
  PID:6536
- C:\Windows\System\TplehAp.exe
  C:\Windows\System\TplehAp.exe
  2⤵
  PID:1188
- C:\Windows\System\LHVckrs.exe
  C:\Windows\System\LHVckrs.exe
  2⤵
  PID:7068
- C:\Windows\System\bgfsign.exe
  C:\Windows\System\bgfsign.exe
  2⤵
  PID:5964
- C:\Windows\System\WudxquK.exe
  C:\Windows\System\WudxquK.exe
  2⤵
  PID:6564
- C:\Windows\System\AqlmwoZ.exe
  C:\Windows\System\AqlmwoZ.exe
  2⤵
  PID:9620
- C:\Windows\System\xDCUVHJ.exe
  C:\Windows\System\xDCUVHJ.exe
  2⤵
  PID:7032
- C:\Windows\System\gFIoBYF.exe
  C:\Windows\System\gFIoBYF.exe
  2⤵
  PID:6824
- C:\Windows\System\NqBOEhf.exe
  C:\Windows\System\NqBOEhf.exe
  2⤵
  PID:7024
- C:\Windows\System\fjlGbRi.exe
  C:\Windows\System\fjlGbRi.exe
  2⤵
  PID:6156
- C:\Windows\System\rGMNYpq.exe
  C:\Windows\System\rGMNYpq.exe
  2⤵
  PID:8688
- C:\Windows\System\ndYNtRH.exe
  C:\Windows\System\ndYNtRH.exe
  2⤵
  PID:6540
- C:\Windows\System\VlTTKKT.exe
  C:\Windows\System\VlTTKKT.exe
  2⤵
  PID:13804
- C:\Windows\System\UbGXuWV.exe
  C:\Windows\System\UbGXuWV.exe
  2⤵
  PID:13836
- C:\Windows\System\PKpRJQX.exe
  C:\Windows\System\PKpRJQX.exe
  2⤵
  PID:4468
- C:\Windows\System\gpXDIzV.exe
  C:\Windows\System\gpXDIzV.exe
  2⤵
  PID:4272
- C:\Windows\System\kSkLvrV.exe
  C:\Windows\System\kSkLvrV.exe
  2⤵
  PID:14024
- C:\Windows\System\SYadXxk.exe
  C:\Windows\System\SYadXxk.exe
  2⤵
  PID:7900
- C:\Windows\System\VtCjVwy.exe
  C:\Windows\System\VtCjVwy.exe
  2⤵
  PID:7144
- C:\Windows\System\oRosaYe.exe
  C:\Windows\System\oRosaYe.exe
  2⤵
  PID:6152
- C:\Windows\System\jnuBIIq.exe
  C:\Windows\System\jnuBIIq.exe
  2⤵
  PID:12220
- C:\Windows\System\HeoqLzh.exe
  C:\Windows\System\HeoqLzh.exe
  2⤵
  PID:6908
- C:\Windows\System\FQnGzjU.exe
  C:\Windows\System\FQnGzjU.exe
  2⤵
  PID:8256
- C:\Windows\System\aTFMSqE.exe
  C:\Windows\System\aTFMSqE.exe
  2⤵
  PID:11952
- C:\Windows\System\aFsCAJP.exe
  C:\Windows\System\aFsCAJP.exe
  2⤵
  PID:4768
- C:\Windows\System\NcrgBCJ.exe
  C:\Windows\System\NcrgBCJ.exe
  2⤵
  PID:2240
- C:\Windows\System\hBWVGYX.exe
  C:\Windows\System\hBWVGYX.exe
  2⤵
  PID:4260
- C:\Windows\System\tfLPnSh.exe
  C:\Windows\System\tfLPnSh.exe
  2⤵
  PID:14160
- C:\Windows\System\FyRTHkt.exe
  C:\Windows\System\FyRTHkt.exe
  2⤵
  PID:7148
- C:\Windows\System\yiXyhpE.exe
  C:\Windows\System\yiXyhpE.exe
  2⤵
  PID:5680
- C:\Windows\System\UDqhLlG.exe
  C:\Windows\System\UDqhLlG.exe
  2⤵
  PID:2232
- C:\Windows\System\QOHAuWx.exe
  C:\Windows\System\QOHAuWx.exe
  2⤵
  PID:7308
- C:\Windows\System\RcfmKEo.exe
  C:\Windows\System\RcfmKEo.exe
  2⤵
  PID:5044
- C:\Windows\System\DgsxhoL.exe
  C:\Windows\System\DgsxhoL.exe
  2⤵
  PID:12312
- C:\Windows\System\wYKItON.exe
  C:\Windows\System\wYKItON.exe
  2⤵
  PID:8444
- C:\Windows\System\JuRpNbf.exe
  C:\Windows\System\JuRpNbf.exe
  2⤵
  PID:12572
- C:\Windows\System\KJOcJJl.exe
  C:\Windows\System\KJOcJJl.exe
  2⤵
  PID:14172
- C:\Windows\System\xPsMdvr.exe
  C:\Windows\System\xPsMdvr.exe
  2⤵
  PID:5152
- C:\Windows\System\pbfGhrm.exe
  C:\Windows\System\pbfGhrm.exe
  2⤵
  PID:5580
- C:\Windows\System\BefwbGR.exe
  C:\Windows\System\BefwbGR.exe
  2⤵
  PID:9336
- C:\Windows\System\FCvHyCb.exe
  C:\Windows\System\FCvHyCb.exe
  2⤵
  PID:14260
- C:\Windows\System\fdAtqwh.exe
  C:\Windows\System\fdAtqwh.exe
  2⤵
  PID:5344
- C:\Windows\System\wfKHNbF.exe
  C:\Windows\System\wfKHNbF.exe
  2⤵
  PID:10596
- C:\Windows\System\fSxGZoh.exe
  C:\Windows\System\fSxGZoh.exe
  2⤵
  PID:9032
- C:\Windows\System\PvpgILs.exe
  C:\Windows\System\PvpgILs.exe
  2⤵
  PID:7844
- C:\Windows\System\PObwzVw.exe
  C:\Windows\System\PObwzVw.exe
  2⤵
  PID:12872
- C:\Windows\System\yzzjKHd.exe
  C:\Windows\System\yzzjKHd.exe
  2⤵
  PID:4020
- C:\Windows\System\MKvuumz.exe
  C:\Windows\System\MKvuumz.exe
  2⤵
  PID:7136
- C:\Windows\System\ywKcSbQ.exe
  C:\Windows\System\ywKcSbQ.exe
  2⤵
  PID:7544
- C:\Windows\System\JxHtzVP.exe
  C:\Windows\System\JxHtzVP.exe
  2⤵
  PID:3268
- C:\Windows\System\QpsiQIW.exe
  C:\Windows\System\QpsiQIW.exe
  2⤵
  PID:5720
- C:\Windows\System\VEcNVny.exe
  C:\Windows\System\VEcNVny.exe
  2⤵
  PID:6880
- C:\Windows\System\swQCUbc.exe
  C:\Windows\System\swQCUbc.exe
  2⤵
  PID:808
- C:\Windows\System\lDtotJM.exe
  C:\Windows\System\lDtotJM.exe
  2⤵
  PID:7348
- C:\Windows\System\KdPVwQX.exe
  C:\Windows\System\KdPVwQX.exe
  2⤵
  PID:6596
- C:\Windows\System\BlCcVio.exe
  C:\Windows\System\BlCcVio.exe
  2⤵
  PID:6584
- C:\Windows\System\ElyqNlR.exe
  C:\Windows\System\ElyqNlR.exe
  2⤵
  PID:13672
- C:\Windows\System\GgzVKBD.exe
  C:\Windows\System\GgzVKBD.exe
  2⤵
  PID:1248
- C:\Windows\System\iwUJLDz.exe
  C:\Windows\System\iwUJLDz.exe
  2⤵
  PID:6960
- C:\Windows\System\TFHPYNQ.exe
  C:\Windows\System\TFHPYNQ.exe
  2⤵
  PID:12340
- C:\Windows\System\BEQRezJ.exe
  C:\Windows\System\BEQRezJ.exe
  2⤵
  PID:9500
- C:\Windows\System\TQjFUiU.exe
  C:\Windows\System\TQjFUiU.exe
  2⤵
  PID:3336
- C:\Windows\System\BfIFyqm.exe
  C:\Windows\System\BfIFyqm.exe
  2⤵
  PID:7784
- C:\Windows\System\WzwQZEG.exe
  C:\Windows\System\WzwQZEG.exe
  2⤵
  PID:928
- C:\Windows\System\cSkbSfg.exe
  C:\Windows\System\cSkbSfg.exe
  2⤵
  PID:12144
- C:\Windows\System\WfssYlz.exe
  C:\Windows\System\WfssYlz.exe
  2⤵
  PID:2848
- C:\Windows\System\tRhzGXQ.exe
  C:\Windows\System\tRhzGXQ.exe
  2⤵
  PID:11924
- C:\Windows\System\lZKhHRm.exe
  C:\Windows\System\lZKhHRm.exe
  2⤵
  PID:9064
- C:\Windows\System\lIRxsVT.exe
  C:\Windows\System\lIRxsVT.exe
  2⤵
  PID:12916
- C:\Windows\System\KKaLiuh.exe
  C:\Windows\System\KKaLiuh.exe
  2⤵
  PID:5028
- C:\Windows\System\XlSNEbq.exe
  C:\Windows\System\XlSNEbq.exe
  2⤵
  PID:8332
- C:\Windows\System\taYukPx.exe
  C:\Windows\System\taYukPx.exe
  2⤵
  PID:10172
- C:\Windows\System\IbqHgHd.exe
  C:\Windows\System\IbqHgHd.exe
  2⤵
  PID:10176
- C:\Windows\System\eblZCsD.exe
  C:\Windows\System\eblZCsD.exe
  2⤵
  PID:7700
- C:\Windows\System\IiiFNmh.exe
  C:\Windows\System\IiiFNmh.exe
  2⤵
  PID:2972
- C:\Windows\System\SjEVTqo.exe
  C:\Windows\System\SjEVTqo.exe
  2⤵
  PID:2984
- C:\Windows\System\dNecxek.exe
  C:\Windows\System\dNecxek.exe
  2⤵
  PID:7292
- C:\Windows\System\XwEaFRL.exe
  C:\Windows\System\XwEaFRL.exe
  2⤵
  PID:5560
- C:\Windows\System\wkSMeFR.exe
  C:\Windows\System\wkSMeFR.exe
  2⤵
  PID:10528
- C:\Windows\System\rinZtWv.exe
  C:\Windows\System\rinZtWv.exe
  2⤵
  PID:9296
- C:\Windows\System\UkGtUfC.exe
  C:\Windows\System\UkGtUfC.exe
  2⤵
  PID:10312
- C:\Windows\System\sBrQKgR.exe
  C:\Windows\System\sBrQKgR.exe
  2⤵
  PID:8728
- C:\Windows\System\dVDWZwv.exe
  C:\Windows\System\dVDWZwv.exe
  2⤵
  PID:5524
- C:\Windows\System\PCcfZzK.exe
  C:\Windows\System\PCcfZzK.exe
  2⤵
  PID:4896
- C:\Windows\System\PCJceGD.exe
  C:\Windows\System\PCJceGD.exe
  2⤵
  PID:5520
- C:\Windows\System\mpMAOSY.exe
  C:\Windows\System\mpMAOSY.exe
  2⤵
  PID:2860
- C:\Windows\System\tzsOUnz.exe
  C:\Windows\System\tzsOUnz.exe
  2⤵
  PID:10432
- C:\Windows\System\cJvDnqh.exe
  C:\Windows\System\cJvDnqh.exe
  2⤵
  PID:6116
- C:\Windows\System\LUoXXPA.exe
  C:\Windows\System\LUoXXPA.exe
  2⤵
  PID:5184
- C:\Windows\System\fxWWxoh.exe
  C:\Windows\System\fxWWxoh.exe
  2⤵
  PID:8708
- C:\Windows\System\XvIRFFf.exe
  C:\Windows\System\XvIRFFf.exe
  2⤵
  PID:6348
- C:\Windows\System\IAuUKgz.exe
  C:\Windows\System\IAuUKgz.exe
  2⤵
  PID:10864
- C:\Windows\System\SbsQbcn.exe
  C:\Windows\System\SbsQbcn.exe
  2⤵
  PID:12972
- C:\Windows\System\HLVTGGf.exe
  C:\Windows\System\HLVTGGf.exe
  2⤵
  PID:11240
- C:\Windows\System\aaZymsJ.exe
  C:\Windows\System\aaZymsJ.exe
  2⤵
  PID:10008
- C:\Windows\System\oVHSpNP.exe
  C:\Windows\System\oVHSpNP.exe
  2⤵
  PID:6912
- C:\Windows\System\JkRVkZx.exe
  C:\Windows\System\JkRVkZx.exe
  2⤵
  PID:11084
- C:\Windows\System\erpwFLE.exe
  C:\Windows\System\erpwFLE.exe
  2⤵
  PID:7184
- C:\Windows\System\kpfGKRa.exe
  C:\Windows\System\kpfGKRa.exe
  2⤵
  PID:10792
- C:\Windows\System\EwMkoTu.exe
  C:\Windows\System\EwMkoTu.exe
  2⤵
  PID:5596
- C:\Windows\System\naifOXT.exe
  C:\Windows\System\naifOXT.exe
  2⤵
  PID:11464
- C:\Windows\System\qTixfmx.exe
  C:\Windows\System\qTixfmx.exe
  2⤵
  PID:11936
- C:\Windows\System\mBEwzoO.exe
  C:\Windows\System\mBEwzoO.exe
  2⤵
  PID:9276
- C:\Windows\System\IFPpEFn.exe
  C:\Windows\System\IFPpEFn.exe
  2⤵
  PID:11592
- C:\Windows\System\UmDmcvJ.exe
  C:\Windows\System\UmDmcvJ.exe
  2⤵
  PID:11824
- C:\Windows\System\nYoHQLf.exe
  C:\Windows\System\nYoHQLf.exe
  2⤵
  PID:10024
- C:\Windows\System\WEuEjCL.exe
  C:\Windows\System\WEuEjCL.exe
  2⤵
  PID:2016
- C:\Windows\System\iEOSfSE.exe
  C:\Windows\System\iEOSfSE.exe
  2⤵
  PID:11792
- C:\Windows\System\vziCfBY.exe
  C:\Windows\System\vziCfBY.exe
  2⤵
  PID:12116
- C:\Windows\System\IpglMuS.exe
  C:\Windows\System\IpglMuS.exe
  2⤵
  PID:12216
- C:\Windows\System\YXIICiH.exe
  C:\Windows\System\YXIICiH.exe
  2⤵
  PID:12180
- C:\Windows\System\blJNMIk.exe
  C:\Windows\System\blJNMIk.exe
  2⤵
  PID:12024
- C:\Windows\System\hFtqjYD.exe
  C:\Windows\System\hFtqjYD.exe
  2⤵
  PID:7780
- C:\Windows\System\fXqGmNu.exe
  C:\Windows\System\fXqGmNu.exe
  2⤵
  PID:12156
- C:\Windows\System\yAyxnUR.exe
  C:\Windows\System\yAyxnUR.exe
  2⤵
  PID:11372
- C:\Windows\System\yOPeZVK.exe
  C:\Windows\System\yOPeZVK.exe
  2⤵
  PID:4620
- C:\Windows\System\CRXgFRW.exe
  C:\Windows\System\CRXgFRW.exe
  2⤵
  PID:10812
- C:\Windows\System\TijrsNO.exe
  C:\Windows\System\TijrsNO.exe
  2⤵
  PID:5536
- C:\Windows\System\uImZuAU.exe
  C:\Windows\System\uImZuAU.exe
  2⤵
  PID:10408
- C:\Windows\System\NPQRptv.exe
  C:\Windows\System\NPQRptv.exe
  2⤵
  PID:10560
- C:\Windows\System\LuhNyBr.exe
  C:\Windows\System\LuhNyBr.exe
  2⤵
  PID:12188
- C:\Windows\System\SgmKsrB.exe
  C:\Windows\System\SgmKsrB.exe
  2⤵
  PID:8296
- C:\Windows\System\QWPGjiy.exe
  C:\Windows\System\QWPGjiy.exe
  2⤵
  PID:11736
- C:\Windows\System\hlkEHYc.exe
  C:\Windows\System\hlkEHYc.exe
  2⤵
  PID:11556
- C:\Windows\System\hqVfTdn.exe
  C:\Windows\System\hqVfTdn.exe
  2⤵
  PID:11848
- C:\Windows\System\ZzYtTdA.exe
  C:\Windows\System\ZzYtTdA.exe
  2⤵
  PID:10268
- C:\Windows\System\zPBAHHQ.exe
  C:\Windows\System\zPBAHHQ.exe
  2⤵
  PID:8760
- C:\Windows\System\OvyTIBo.exe
  C:\Windows\System\OvyTIBo.exe
  2⤵
  PID:8952
- C:\Windows\System\TOvBcuA.exe
  C:\Windows\System\TOvBcuA.exe
  2⤵
  PID:11428
- C:\Windows\System\YCMUVWr.exe
  C:\Windows\System\YCMUVWr.exe
  2⤵
  PID:2356
- C:\Windows\System\igqExtL.exe
  C:\Windows\System\igqExtL.exe
  2⤵
  PID:10648
- C:\Windows\System\dxQzMXF.exe
  C:\Windows\System\dxQzMXF.exe
  2⤵
  PID:11012
- C:\Windows\System\MPWTnfK.exe
  C:\Windows\System\MPWTnfK.exe
  2⤵
  PID:11700
- C:\Windows\System\CmJAjVt.exe
  C:\Windows\System\CmJAjVt.exe
  2⤵
  PID:12376
- C:\Windows\System\bPEiqlU.exe
  C:\Windows\System\bPEiqlU.exe
  2⤵
  PID:7936
- C:\Windows\System\afpKcRv.exe
  C:\Windows\System\afpKcRv.exe
  2⤵
  PID:528
- C:\Windows\System\jASkPWg.exe
  C:\Windows\System\jASkPWg.exe
  2⤵
  PID:2660
- C:\Windows\System\UZhnySW.exe
  C:\Windows\System\UZhnySW.exe
  2⤵
  PID:10716
- C:\Windows\System\Jwkknuz.exe
  C:\Windows\System\Jwkknuz.exe
  2⤵
  PID:10188
- C:\Windows\System\PwatlAa.exe
  C:\Windows\System\PwatlAa.exe
  2⤵
  PID:12808
- C:\Windows\System\tmxTByU.exe
  C:\Windows\System\tmxTByU.exe
  2⤵
  PID:11636
- C:\Windows\System\IBEeksG.exe
  C:\Windows\System\IBEeksG.exe
  2⤵
  PID:11620
- C:\Windows\System\iWHgIiP.exe
  C:\Windows\System\iWHgIiP.exe
  2⤵
  PID:13032
- C:\Windows\System\KlkKIJk.exe
  C:\Windows\System\KlkKIJk.exe
  2⤵
  PID:12040
- C:\Windows\System\xEnLtZs.exe
  C:\Windows\System\xEnLtZs.exe
  2⤵
  PID:13164
- C:\Windows\System\OQRCLSM.exe
  C:\Windows\System\OQRCLSM.exe
  2⤵
  PID:13064
- C:\Windows\System\JvqUroj.exe
  C:\Windows\System\JvqUroj.exe
  2⤵
  PID:9184
- C:\Windows\System\JJCTzQm.exe
  C:\Windows\System\JJCTzQm.exe
  2⤵
  PID:13068
- C:\Windows\System\udFgyLy.exe
  C:\Windows\System\udFgyLy.exe
  2⤵
  PID:10452
- C:\Windows\System\mDjTQfc.exe
  C:\Windows\System\mDjTQfc.exe
  2⤵
  PID:12920
- C:\Windows\System\vNozpwv.exe
  C:\Windows\System\vNozpwv.exe
  2⤵
  PID:9140
- C:\Windows\System\HxhQiFF.exe
  C:\Windows\System\HxhQiFF.exe
  2⤵
  PID:11744
- C:\Windows\System\PLGsmqa.exe
  C:\Windows\System\PLGsmqa.exe
  2⤵
  PID:11552
- C:\Windows\System\VPmyOtU.exe
  C:\Windows\System\VPmyOtU.exe
  2⤵
  PID:10324
- C:\Windows\System\Nmqbpld.exe
  C:\Windows\System\Nmqbpld.exe
  2⤵
  PID:14280
- C:\Windows\System\xsMRYUd.exe
  C:\Windows\System\xsMRYUd.exe
  2⤵
  PID:8932
- C:\Windows\System\vyHndLk.exe
  C:\Windows\System\vyHndLk.exe
  2⤵
  PID:8600
- C:\Windows\System\RXNRegP.exe
  C:\Windows\System\RXNRegP.exe
  2⤵
  PID:8620
- C:\Windows\System\VkyTtbI.exe
  C:\Windows\System\VkyTtbI.exe
  2⤵
  PID:12528
- C:\Windows\System\MFMvBIc.exe
  C:\Windows\System\MFMvBIc.exe
  2⤵
  PID:12496
- C:\Windows\System\PHWIGEL.exe
  C:\Windows\System\PHWIGEL.exe
  2⤵
  PID:10540
- C:\Windows\System\lXbdPxA.exe
  C:\Windows\System\lXbdPxA.exe
  2⤵
  PID:12668
- C:\Windows\System\IecqYPC.exe
  C:\Windows\System\IecqYPC.exe
  2⤵
  PID:12296
- C:\Windows\System\wCZkiDy.exe
  C:\Windows\System\wCZkiDy.exe
  2⤵
  PID:12476
- C:\Windows\System\wgDNYlg.exe
  C:\Windows\System\wgDNYlg.exe
  2⤵
  PID:10040
- C:\Windows\System\FeHHcNf.exe
  C:\Windows\System\FeHHcNf.exe
  2⤵
  PID:13084
- C:\Windows\System\ImHlxGy.exe
  C:\Windows\System\ImHlxGy.exe
  2⤵
  PID:13264
- C:\Windows\System\rthdTDO.exe
  C:\Windows\System\rthdTDO.exe
  2⤵
  PID:13116
- C:\Windows\System\FwSpBow.exe
  C:\Windows\System\FwSpBow.exe
  2⤵
  PID:12448
- C:\Windows\System\HFtcTAI.exe
  C:\Windows\System\HFtcTAI.exe
  2⤵
  PID:10108
- C:\Windows\System\mGOIuMc.exe
  C:\Windows\System\mGOIuMc.exe
  2⤵
  PID:12020
- C:\Windows\System\NAGCYVB.exe
  C:\Windows\System\NAGCYVB.exe
  2⤵
  PID:13888
- C:\Windows\System\GBffwCM.exe
  C:\Windows\System\GBffwCM.exe
  2⤵
  PID:13944
- C:\Windows\System\dDjPtwC.exe
  C:\Windows\System\dDjPtwC.exe
  2⤵
  PID:12080
- C:\Windows\System\DTceIuh.exe
  C:\Windows\System\DTceIuh.exe
  2⤵
  PID:3280
- C:\Windows\System\KEcLrUI.exe
  C:\Windows\System\KEcLrUI.exe
  2⤵
  PID:12316
- C:\Windows\System\hRbsEiD.exe
  C:\Windows\System\hRbsEiD.exe
  2⤵
  PID:12952
- C:\Windows\System\tuDhgxh.exe
  C:\Windows\System\tuDhgxh.exe
  2⤵
  PID:10664
- C:\Windows\System\cHhWbTm.exe
  C:\Windows\System\cHhWbTm.exe
  2⤵
  PID:12612
- C:\Windows\System\YPNQKQb.exe
  C:\Windows\System\YPNQKQb.exe
  2⤵
  PID:6900
- C:\Windows\System\OLPwMSq.exe
  C:\Windows\System\OLPwMSq.exe
  2⤵
  PID:13188
- C:\Windows\System\yQvlqCA.exe
  C:\Windows\System\yQvlqCA.exe
  2⤵
  PID:5484
- C:\Windows\System\jOPWDmb.exe
  C:\Windows\System\jOPWDmb.exe
  2⤵
  PID:12552
- C:\Windows\System\CJuNPwU.exe
  C:\Windows\System\CJuNPwU.exe
  2⤵
  PID:9936
- C:\Windows\System\LWbgfzB.exe
  C:\Windows\System\LWbgfzB.exe
  2⤵
  PID:11680
- C:\Windows\System\JkCygnx.exe
  C:\Windows\System\JkCygnx.exe
  2⤵
  PID:10820
- C:\Windows\System\RyIyofP.exe
  C:\Windows\System\RyIyofP.exe
  2⤵
  PID:10228
- C:\Windows\System\FYbFtAt.exe
  C:\Windows\System\FYbFtAt.exe
  2⤵
  PID:14376
- C:\Windows\System\uZPfuKC.exe
  C:\Windows\System\uZPfuKC.exe
  2⤵
  PID:14408
- C:\Windows\System\IZosJac.exe
  C:\Windows\System\IZosJac.exe
  2⤵
  PID:14440
- C:\Windows\System\kLeToZs.exe
  C:\Windows\System\kLeToZs.exe
  2⤵
  PID:14460
- C:\Windows\System\ezaJOyt.exe
  C:\Windows\System\ezaJOyt.exe
  2⤵
  PID:14492
- C:\Windows\System\cptEmNI.exe
  C:\Windows\System\cptEmNI.exe
  2⤵
  PID:14524
- C:\Windows\System\fukXoNW.exe
  C:\Windows\System\fukXoNW.exe
  2⤵
  PID:14544
- C:\Windows\System\MEkDarg.exe
  C:\Windows\System\MEkDarg.exe
  2⤵
  PID:14576
- C:\Windows\System\ecQVMvJ.exe
  C:\Windows\System\ecQVMvJ.exe
  2⤵
  PID:14600
- C:\Windows\System\rILMQJw.exe
  C:\Windows\System\rILMQJw.exe
  2⤵
  PID:14632
- C:\Windows\System\EIzywyt.exe
  C:\Windows\System\EIzywyt.exe
  2⤵
  PID:14656
- C:\Windows\System\kzxEoDX.exe
  C:\Windows\System\kzxEoDX.exe
  2⤵
  PID:14692
- C:\Windows\System\aivFGrE.exe
  C:\Windows\System\aivFGrE.exe
  2⤵
  PID:14720
- C:\Windows\System\ZUNNyZz.exe
  C:\Windows\System\ZUNNyZz.exe
  2⤵
  PID:14740
- C:\Windows\System\poHzcYE.exe
  C:\Windows\System\poHzcYE.exe
  2⤵
  PID:14768
- C:\Windows\System\uOuxwWz.exe
  C:\Windows\System\uOuxwWz.exe
  2⤵
  PID:14804
- C:\Windows\System\lsfliwp.exe
  C:\Windows\System\lsfliwp.exe
  2⤵
  PID:14836
- C:\Windows\System\IsktHsL.exe
  C:\Windows\System\IsktHsL.exe
  2⤵
  PID:14852
- C:\Windows\System\bAaZSZN.exe
  C:\Windows\System\bAaZSZN.exe
  2⤵
  PID:14868
- C:\Windows\System\usSPYBS.exe
  C:\Windows\System\usSPYBS.exe
  2⤵
  PID:14884
- C:\Windows\System\khippQz.exe
  C:\Windows\System\khippQz.exe
  2⤵
  PID:14904
- C:\Windows\System\YkSVaPC.exe
  C:\Windows\System\YkSVaPC.exe
  2⤵
  PID:14932
- C:\Windows\System\TEwuRrF.exe
  C:\Windows\System\TEwuRrF.exe
  2⤵
  PID:14984
- C:\Windows\System\UxVTSmy.exe
  C:\Windows\System\UxVTSmy.exe
  2⤵
  PID:15020
- C:\Windows\System\QcHfddr.exe
  C:\Windows\System\QcHfddr.exe
  2⤵
  PID:15048
- C:\Windows\System\wKucTUr.exe
  C:\Windows\System\wKucTUr.exe
  2⤵
  PID:15084
- C:\Windows\System\AMZtyEx.exe
  C:\Windows\System\AMZtyEx.exe
  2⤵
  PID:15104
- C:\Windows\System\rqXfqWP.exe
  C:\Windows\System\rqXfqWP.exe
  2⤵
  PID:15132
- C:\Windows\System\VCArGLA.exe
  C:\Windows\System\VCArGLA.exe
  2⤵
  PID:15160
- C:\Windows\System\EVvptew.exe
  C:\Windows\System\EVvptew.exe
  2⤵
  PID:15188
- C:\Windows\System\nyLdchy.exe
  C:\Windows\System\nyLdchy.exe
  2⤵
  PID:15228
- C:\Windows\System\OGtnfoG.exe
  C:\Windows\System\OGtnfoG.exe
  2⤵
  PID:15248
- C:\Windows\System\UbdmuBI.exe
  C:\Windows\System\UbdmuBI.exe
  2⤵
  PID:15288
- C:\Windows\System\vBbIEBv.exe
  C:\Windows\System\vBbIEBv.exe
  2⤵
  PID:15312
- C:\Windows\System\JXIPLrQ.exe
  C:\Windows\System\JXIPLrQ.exe
  2⤵
  PID:15340
- C:\Windows\System\GhqQjQw.exe
  C:\Windows\System\GhqQjQw.exe
  2⤵
  PID:11324
- C:\Windows\System\rGmZDaU.exe
  C:\Windows\System\rGmZDaU.exe
  2⤵
  PID:13184
- C:\Windows\System\CmFrsoy.exe
  C:\Windows\System\CmFrsoy.exe
  2⤵
  PID:14432
- C:\Windows\System\nQmljuy.exe
  C:\Windows\System\nQmljuy.exe
  2⤵
  PID:14480
- C:\Windows\System\PNKZfFU.exe
  C:\Windows\System\PNKZfFU.exe
  2⤵
  PID:14516
- C:\Windows\System\fGRwgJK.exe
  C:\Windows\System\fGRwgJK.exe
  2⤵
  PID:14568
- C:\Windows\System\JjtcwWX.exe
  C:\Windows\System\JjtcwWX.exe
  2⤵
  PID:14648
- C:\Windows\System\KcmcNmC.exe
  C:\Windows\System\KcmcNmC.exe
  2⤵
  PID:14712
- C:\Windows\System\AeeLHtT.exe
  C:\Windows\System\AeeLHtT.exe
  2⤵
  PID:14812
- C:\Windows\System\VyTOQox.exe
  C:\Windows\System\VyTOQox.exe
  2⤵
  PID:14876
- C:\Windows\System\HmwUSqE.exe
  C:\Windows\System\HmwUSqE.exe
  2⤵
  PID:14924

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13612

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xf0fhtdf.b5m.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CpmnJiO.exe

Filesize
2.0MB

MD5
162030c59a92a7118eb17e69905c6773

SHA1
8df5daf9e83fe39df7019663a00809bc434f620c

SHA256
21588db11f92a90321c33da80aa519795c9969e89937491a0972e1ec666c2503

SHA512
9f90689b204a1bdf1ea0fffec959014bf1078e5d2b6c6209a3a2114904686e690a34c89b2b40e0d68470f4efec820f712b68f9b2f368eeddfb4cdeadd3d47f89

Download Submit
C:\Windows\System\EEGpCfV.exe

Filesize
2.0MB

MD5
c491906be414214d8e120738743fb518

SHA1
51b945a27218dbb1753c3617cf6c15928a0a9894

SHA256
66ae04a49987911491b0153300e427e8d84da2325bd454d81e321909b13e0ce5

SHA512
4ae28710eb1852ec781b3712022765cf38f319441181b16eae5729db0760e4445edcede91d5901688173666f24b76805c9c725eaecefeecb9c1e43e8435e2fa9

Download Submit
C:\Windows\System\GXCNWIw.exe

Filesize
2.0MB

MD5
148de96d2d009df40a56dd3dcbb914c2

SHA1
893f1daf7eed3218d846042e2c1b03bd4cdd1c8e

SHA256
aac4e15db68c150cb9a0e0b4b6e201ca0823e90d834f80676a5bae9260f253c9

SHA512
0ccff1627d3cb6dc942a0df1a3a13487a8309c0d95cfea428167cf752d3dfc2f57367fd2375814c7d373cd9e65d782cf73a77e534464ea2f06e978ded8651b52

Download Submit
C:\Windows\System\JkqjlOf.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\KfYZxcS.exe

Filesize
2.0MB

MD5
4a10c275ec1b5e43ce84510267222362

SHA1
f3ce3b666d027abbcd0fbcf0ac7d5d39701ad146

SHA256
fe7078746d01b5bb6ea32570638b4a9c3a07334d962b562d8826a2b82f301e23

SHA512
c89a79c5c6209f9ca3f171f250c5ca14a0b46362fe15df544078f209a71142e222459ff6492ab3d4c298636bd8e9881fe791c05a0d19b47afb3987032f19abd1

Download Submit
C:\Windows\System\OPidUZz.exe

Filesize
2.0MB

MD5
16f81b47801c044f9dc39a8d6b02c19a

SHA1
81c459f0384908f1af1ca9ced3a5ba8121f4426b

SHA256
3931db47ba6d99d698d6441914e3276518d44aed1f43c86a996d0419ca83dcb6

SHA512
3119b7596f2f5b45653280bca823e5078ed0e3a8f46f2a5f20268f54d82ee60d0f02e6a229dd3a8ece1f6b9e4fdf17a7fe8678140c81c6b4f83d1cc49487d84f

Download Submit
C:\Windows\System\PIATdyJ.exe

Filesize
2.0MB

MD5
3f9c38b9d767142aac3d46a14f9de0d3

SHA1
a3629f770d41964a3f5527f5b1f590e3fe56614f

SHA256
289fa8a3a1776e42101636fe5b43a2fea5bfdb5ff7d89099b294f5722232e053

SHA512
f160241778f9dae7ca9f9c2601ee8883cd35d3cf13eb2129791ddee13272c2a4bded6306b47440db7fec648df8445eca26de5f59c85cbb8a74ded6aa18681de0

Download Submit
C:\Windows\System\QSyvKSD.exe

Filesize
2.0MB

MD5
b625441f7128e2f2c0a79a10b616cb95

SHA1
011f38946a3f75132771c5a0f96c8b9ada775288

SHA256
7804bb81ed0f589836435f497f5fcbb109fd7770c4fc6c4c67c3fbf22b3b5876

SHA512
9c2997829f140cad55e2d1676ff70d33a7d9cf95b7fb0571f738d66d3f076abaefff37464c39d9be8fd5397b95e0ddeb38d1ef71e9530744a69d39d1de9b3f3e

Download Submit
C:\Windows\System\QSzTpvj.exe

Filesize
2.0MB

MD5
604443c13aa89fcf1989c3c7d918f17b

SHA1
c0b352cfdab319d57743c934ce6cd820115a6297

SHA256
c72a4ed0f9898d69304823b19b1ea0ea1d78b679ddbd5c45cda1c217c4e1d901

SHA512
a718cb9bec57195cab659cbeeb395a578cf81f32b765968d563bb56617d77947e38d1af5cd224bca8f4f6162e6e6568914d56ba0abee16ddc848ace24d834040

Download Submit
C:\Windows\System\SgsNZUy.exe

Filesize
2.0MB

MD5
49ecd10c50d98836884c9d0e723376cb

SHA1
e86c882464487297ec681835d7c58a365e27042e

SHA256
6c556119a0ce0d168de87d04112d088f4edc82e549ba58ecd2837f65138d5015

SHA512
344e3f2a8f902b8939ce62a4248f3610f613dcb0ba6296b152644b0908c44228c2bcdca0df0640690666d2b324598d8dc79a86ca34604ac7f439850e5b0c058e

Download Submit
C:\Windows\System\TAutPFJ.exe

Filesize
2.0MB

MD5
1a0bd2dfdd4fc5b9226c47b97cd2ffa2

SHA1
8860bf290e156ec8caca5687fa9e126808756355

SHA256
dcb2c8712aee3051dbf6d7ab676615915848825469605c3ebe69c572b3eac458

SHA512
b358128ffe142c7a553d5189a423c985a67b97380267dbe5235575f5c6882402ebebb70bd34e84f23f18711497982c386fea8eb5538853654b6a10cc3d96d4db

Download Submit
C:\Windows\System\TSDYheW.exe

Filesize
2.0MB

MD5
68d71cd68b9a571a08525a6a002894b3

SHA1
8f61cd20bb1dd3d65970c3d6be304b7b69bdc490

SHA256
05b0a474db976003c113e2ebbf3076474f4c7048c29a37461711c4fefab0c785

SHA512
5cb37d56719c666f124ea9fc58040722d806b7e156f071587c9c0580be65a6dcf33c34a6f603b6a6c3bf1326531442f76b3c5412fac3dd2b0a3c095e4e98eb6c

Download Submit
C:\Windows\System\TzKAjyt.exe

Filesize
2.0MB

MD5
2d47765080179af8b55c2babb804fdc9

SHA1
d25cc8d90f0347fc9001f16d18c9613faf0f5b67

SHA256
ff47b59164e60796f83e1365cd6cbdc75b7ba5af583a6e49b0cbd994ac363caa

SHA512
ae0eea61de96761f91fd7eb0f7312ad96d6317083ebdba1a6a75024702d6539fa2a2c43ee8b482fce6e0094db704256f521add22eede4f4074a75bccf17ac2d5

Download Submit
C:\Windows\System\UIAiWrg.exe

Filesize
2.0MB

MD5
2d0d7168cede76f5a5235c6db9d4a3a1

SHA1
687eb1f86febe76b9419317dcb07ca4fa75af83d

SHA256
1d00927e36c484098e937502772c44d6686f6ce75766605be3aa6f74dcf7648b

SHA512
13920fdc220345b040d121cbd9e2cf7bc9057673c2275eb7f3c40bdefe0dc0d8d49f218c64a029facbc139f0e3e69f7e69f655c0456328b2a8128da557936058

Download Submit
C:\Windows\System\UzGxANw.exe

Filesize
2.0MB

MD5
b7e9a33d3368f8e0f4499a74031c5720

SHA1
4bd63f020f0808507fddf2f2eb7310433073c76b

SHA256
139b5111d997f4454c91d03392d0268f82a5e3704959de23132c25fba17aeabc

SHA512
37338b2f70d36406e970a80895946d3f693cd84d0fed0e08750c5e05785304260a1ff89c5ae1c1775ff9d6f7897102b221c8ebab3d538966fc8dd6b895636b51

Download Submit
C:\Windows\System\VDQBkwM.exe

Filesize
2.0MB

MD5
d79a628d8a8456d372e4a68a248fea81

SHA1
d6e08f1740ea4e57028c9c7bace01b7a288d2261

SHA256
d15a3eeb84dc29047c5b6489aa2d2773cb2cd405d79b5e0e065d1bbeecc18fda

SHA512
3951b59fd591dbaa832b32cecc72fa5f2f10f6d0c743b24d7759e95a0081489e80b50feb479ab0dfdedef3a91028d51547c74278fb3b2daeaf3fcd8bf24d63c0

Download Submit
C:\Windows\System\VXomAUy.exe

Filesize
2.0MB

MD5
9b4b11ef26c534fbaa19425a05437b4b

SHA1
cc2d054fd31c4eb4878388ec4c15b04a79d0e544

SHA256
fecb3f2e9d1cb21e64d1bc90e6dd629c2bd2fae7f6707da507f17325e3b7ddf1

SHA512
da7fd5cafbeaf34b3c7d2f803fc56f951c91963e5a7445a2b3a4d7efe277c903e3db5701328e4315cbc1e24ca9611035dc6fa4b7758f7467bb1d9d86db6077f1

Download Submit
C:\Windows\System\WtNHrln.exe

Filesize
2.0MB

MD5
4c200d0598886adb863e38f287a4c2be

SHA1
62de8978d168c46622118fb7bf14c574c0759bdb

SHA256
0344bc817ee400dcad58afc45ae55a602cf7b4ea4e59878e03b6e7388a4d9517

SHA512
6217bbec4726a500bb73cdcf9f7afb7acce692ec774a417a09e31cac68dec91c730e25495117c5280e05439188e03834d35a8cc06422703b0e0530a3ff37b13b

Download Submit
C:\Windows\System\XvvMikP.exe

Filesize
2.0MB

MD5
bcacb9380dfcc7ea9d4d4de1d30ebe2c

SHA1
9147f3ad5954b101115131ea8cdd76a26456990f

SHA256
1e16aef9c06e370fc881b1b3c28ab1d9ed9856471f692c234f06df062fb96b4b

SHA512
5c4f884c5e8c8bad3d5df9106c806eb523d5d4485283f18afd43ddbbdc373a26e86004c2ac1f79e23c6c947c32fd244c89e237d1109f1a60d11aa282019e94d7

Download Submit
C:\Windows\System\aUrrXTk.exe

Filesize
2.0MB

MD5
bce051f9601148240fec73a4194fff87

SHA1
db25ee68b9b44987470b5ce04a37d2989bf14518

SHA256
c1906fd6b0b32fd0699f105d1342470f904d752014f6206634da7f66c5556263

SHA512
6570b4a09dfb46569048fe47e9f95322d3a7f7008bde54c4ff79a7393db901b5478513c37691c5632c23b7ff6c61ea2a873da697a958f9552c7ef1c9fb1ad3c9

Download Submit
C:\Windows\System\eQNVgog.exe

Filesize
2.0MB

MD5
13ef4ca75bba295a0529be0bff0c0512

SHA1
8dd626592504277c3f6fa0a83dc30565bfa48a5f

SHA256
8605f4d2978778e297ada20ca8780d924c871d6b8f75ed2385ac01f50c9bd2d7

SHA512
b2fd0dae607ab956397edfe1c17bada2016e5886a50874bb38c81149ab1425203d977524c076ccc4a3c8534013fc9ead43c978b24d14a4ffe28556604021884c

Download Submit
C:\Windows\System\fxDaezR.exe

Filesize
2.0MB

MD5
8d8788332913662b7942d5563fd91ae1

SHA1
af4cea81befc95db341647584b2d2fa74a9cd6ef

SHA256
5702ab093b6d7972dda32d7da743c7114b732c8d4e2ec4da3b387c1644562e85

SHA512
bfa43bb536e22f13c1e6d491447c4452d4af3c313e425ff09c8f7f0b013f96aa08ba3e333540c9d4b0866b49460b66965f034b454ca0ddfd29e42f1bdd9f7a1e

Download Submit
C:\Windows\System\gjavbnf.exe

Filesize
2.0MB

MD5
926c3d2d94914c8cdd6f167a1d19001d

SHA1
0b8ffabe7c64518dff57cdeee85a9653370cef96

SHA256
5bd0136766b2120d8a7ab7a4ce47c7294eaf6f6f2e9635b358e7603fa9884108

SHA512
a4926dd5bc70daeb45c2b2ce038498b4edfa9cc6b9ed3c364a97c0c96b38d6ae9b1d5db6866048507ed2abe7efe82344101e7b29ea6ff1254d55364d45c020ac

Download Submit
C:\Windows\System\griBAMi.exe

Filesize
2.0MB

MD5
ea1b9304b2b3027572044228b8ccce2a

SHA1
4c97406aa552874b7a92c7fe253ab0f04d0a7c7b

SHA256
e937aba1299ff5aea14d856e7fb8eeb744fed7d52a464269aafe63f9f816cec8

SHA512
0515d2f2fc0151ec50da35f2c249a82c179976f4277f0dec255cd080c83d4d76fefa4d635dafe2283bc45c8c171cf91aba7d334ad65281163fdd66e26ac82b40

Download Submit
C:\Windows\System\jnbHOqy.exe

Filesize
2.0MB

MD5
46c0e0b4a34bbbca3c3e99e70b561c4a

SHA1
d9deb5ca881922653ff4d5d1d4fbe539d4d62172

SHA256
c5cb226d91a3b27c4e9342d785c7fde11ca2b13d6a1a08c9801910bed4b9f42f

SHA512
0948d07af43db351f093d3872e4f489dac6c5094fa561bebd7b54ae8b6d5a173e6ce03e4535ceb56ff8c3417647fc4447ce378d031f4eb3310d7c6149c568445

Download Submit
C:\Windows\System\khepqvy.exe

Filesize
2.0MB

MD5
4ed2376ffdad13b6e37efc198d8b7ebc

SHA1
2dda1326d19aa3de0901e3bde429a4c248b585f6

SHA256
c296efd8c7a6bb01f35cc75e2ff963b8b04ab46588263755ae83d71ed8a1dc30

SHA512
76ae8c5a9ed3c91506f51e445f6f93a347b2694310fcc70b54b6897c67c01da43ef963ccf8bd23d7724aaf21a2d0c588568b775a0ac995f76b912f484ba6c24d

Download Submit
C:\Windows\System\lrMNBeg.exe

Filesize
2.0MB

MD5
c163da0ea640a359b212f1f0b64b4368

SHA1
d294e1abe5a6976e6e91fca8e3896644a1afbab0

SHA256
8e277a28bf7b90d305c63a7b7085745fca25cb565b3dae0b90ec155b1b7bafbc

SHA512
998b8ff9bc44ceaffe9506b20fa47736cfd77f9c6694fa2d5d66d2f313549700fbaeff480397cde30dac8cc44de8bda4c5c909dea6484d991e25369f2d63c18e

Download Submit
C:\Windows\System\mdpxfDj.exe

Filesize
2.0MB

MD5
d854a3cc37b396a8ee5a66ae1650b837

SHA1
f2ddd4da5fbe13b3cf6864496aaf404476dd3aab

SHA256
d5ef45899abf7a656f86f035da4d01994a8284aa60766b9921ec327cbf524a8a

SHA512
ffddaefc3acc1a354467103daa4e6619c55312ffd5de97984c0f9bd9c5b7cabb4b6845474b4f76991ec82624a19bc58181545694ba897f9ea7cec757f1c161f1

Download Submit
C:\Windows\System\nxJCXbu.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\okPmMaM.exe

Filesize
2.0MB

MD5
1e3a7be0f3c92a093a860d47d975d64d

SHA1
e344cd6610da5114918f56faacff9f55fb8edeb4

SHA256
0eb7fc2070da932c067739ba5f75914b18b1a19ad6ef0c1109d03b29f3f4f2f1

SHA512
cbc1b7a05d8bca7e25c64b668e2a8560ad821c2839a274af8352634c678f824db977939887bdbc55322b29a65c39847fbda4bef68bf52069b2b03777fed94966

Download Submit
C:\Windows\System\tpcwmMU.exe

Filesize
2.0MB

MD5
b1ecf3e80ef781eaaea14d5a5d0cb8b8

SHA1
7451b0d6cfa4799cadd80427f3a140acc5bc42eb

SHA256
cf7a76001a8f752b16438cea28ecf61be9749952d18ab611b2fcfb8b9f73aa90

SHA512
3c41ee75d51c0bc9bdfc93bccded709fcd20191e7967c7d82c3025da27dbf9370dda4c2ff02094bd024d6348cf15ab8076403ae86b641f62aff5c6dab77e2944

Download Submit
C:\Windows\System\vLjVMep.exe

Filesize
2.0MB

MD5
28679eb344423a537d7f6e2d4ccbd605

SHA1
081f554a9ee8945e71973230dc29f4f6f529a11c

SHA256
9a9c7c5ec86bad1f953c771ac9194be338a5f51c049fa2e3418c1823c8c825d0

SHA512
e6d79f09785d75bd9b74106976a5b9912aeac3afbc8dd928fc308f3712c5587a0b6d673005d459fec0ba10d4ca2e53962c40873d35c7418c9493c8bc257ae567

Download Submit
C:\Windows\System\xTuQTyO.exe

Filesize
2.0MB

MD5
c3a97b400e46fe7f9e492e55133875c1

SHA1
cdf5e3a9d22b1bafc0894188a44b6862938a831b

SHA256
c218b300d116b20121e6149d2a8c56322effabd5fe77871083e7d659d9f1ca10

SHA512
02d4ad6dc65adecbfa9bab4bcb5a25d6b17717f9f57b0972e97c69478844d50fc874935e7d3d1d6a1473286bc57a676d2ceacd62a1f1b5a7909d9eca6ecf9ddd

Download Submit
C:\Windows\System\yRZyyZB.exe

Filesize
2.0MB

MD5
0f78cb0e7a2600c41208f5fad051ac5d

SHA1
1082c993cf497ed832b1d45b2617561a0aea0403

SHA256
b8259824f58d31fd1f2eebdbd7503d52fd83f44c7036eb05ece99b96b4154420

SHA512
f410f8e01701aeac8339ebbc6f416bb77d1258eea3222ed5cc7ba3395dcbe2c83192cc776eb70d33acdf15334acd185b9ba87372b6de63ed33a8270a9182c680

Download Submit
memory/376-98-0x00007FF7DE4B0000-0x00007FF7DE8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1008-68-0x00007FF73D350000-0x00007FF73D742000-memory.dmp

Filesize
3.9MB

Download
memory/1064-80-0x00007FF71E5A0000-0x00007FF71E992000-memory.dmp

Filesize
3.9MB

Download
memory/1108-10-0x00007FF607390000-0x00007FF607782000-memory.dmp

Filesize
3.9MB

Download
memory/1564-67-0x00007FF724CE0000-0x00007FF7250D2000-memory.dmp

Filesize
3.9MB

Download
memory/1668-108-0x00007FF790610000-0x00007FF790A02000-memory.dmp

Filesize
3.9MB

Download
memory/1764-69-0x000001834F9E0000-0x000001834FA02000-memory.dmp

Filesize
136KB

Download
memory/1764-45-0x00007FFA18F40000-0x00007FFA19A01000-memory.dmp

Filesize
10.8MB

Download
memory/1764-1699-0x00007FFA18F40000-0x00007FFA19A01000-memory.dmp

Filesize
10.8MB

Download
memory/1764-11-0x000001834F6F0000-0x000001834F700000-memory.dmp

Filesize
64KB

Download
memory/1764-62-0x000001834F6F0000-0x000001834F700000-memory.dmp

Filesize
64KB

Download
memory/1812-123-0x00007FF748680000-0x00007FF748A72000-memory.dmp

Filesize
3.9MB

Download
memory/2532-1-0x000002FA49DA0000-0x000002FA49DB0000-memory.dmp

Filesize
64KB

Download
memory/2532-0-0x00007FF796A40000-0x00007FF796E32000-memory.dmp

Filesize
3.9MB

Download
memory/2852-104-0x00007FF7362A0000-0x00007FF736692000-memory.dmp

Filesize
3.9MB

Download
memory/2932-60-0x00007FF7908F0000-0x00007FF790CE2000-memory.dmp

Filesize
3.9MB

Download
memory/3152-49-0x00007FF65D8B0000-0x00007FF65DCA2000-memory.dmp

Filesize
3.9MB

Download
memory/3828-116-0x00007FF6BFDE0000-0x00007FF6C01D2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-129-0x00007FF69B430000-0x00007FF69B822000-memory.dmp

Filesize
3.9MB

Download
memory/3952-127-0x00007FF6225A0000-0x00007FF622992000-memory.dmp

Filesize
3.9MB

Download
memory/3972-103-0x00007FF75CD90000-0x00007FF75D182000-memory.dmp

Filesize
3.9MB

Download
memory/3996-158-0x00007FF75A7E0000-0x00007FF75ABD2000-memory.dmp

Filesize
3.9MB

Download
memory/4216-124-0x00007FF6F1120000-0x00007FF6F1512000-memory.dmp

Filesize
3.9MB

Download
memory/4440-141-0x00007FF6765A0000-0x00007FF676992000-memory.dmp

Filesize
3.9MB

Download
memory/4488-128-0x00007FF78FF50000-0x00007FF790342000-memory.dmp

Filesize
3.9MB

Download
memory/4608-122-0x00007FF6B4940000-0x00007FF6B4D32000-memory.dmp

Filesize
3.9MB

Download
memory/4804-84-0x00007FF6BC110000-0x00007FF6BC502000-memory.dmp

Filesize
3.9MB

Download
memory/4804-2935-0x00007FF6BC110000-0x00007FF6BC502000-memory.dmp

Filesize
3.9MB

Download
memory/5096-76-0x00007FF7FD7E0000-0x00007FF7FDBD2000-memory.dmp

Filesize
3.9MB

Download