xmrig | 67d371f1bd16c8b3a374fec86d09754d6e6a07646da594beb4d00f917219b08d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
Size

2.2MB
MD5

0c459e71a4bf6c0a890556703a3a8d7d
SHA1

afda37951bb12e1a82813089512856a707d02431
SHA256

67d371f1bd16c8b3a374fec86d09754d6e6a07646da594beb4d00f917219b08d
SHA512

93840bb574908e74a0827a831ec59cc20a0554312060147ffedc2d87db45ca558a9389821d7dc21e279da5e55cc030e7e161951677afe1c0273f583a0523488c
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfK:NAB9

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral2/memory/3964-49-0x00007FF6662D0000-0x00007FF6666C2000-memory.dmp	xmrig
behavioral2/memory/2172-59-0x00007FF751330000-0x00007FF751722000-memory.dmp	xmrig
behavioral2/memory/1996-114-0x00007FF66E670000-0x00007FF66EA62000-memory.dmp	xmrig
behavioral2/memory/4760-152-0x00007FF6FC5C0000-0x00007FF6FC9B2000-memory.dmp	xmrig
behavioral2/memory/1044-164-0x00007FF7D0F80000-0x00007FF7D1372000-memory.dmp	xmrig
behavioral2/memory/4340-177-0x00007FF68D840000-0x00007FF68DC32000-memory.dmp	xmrig
behavioral2/memory/2884-171-0x00007FF65AC80000-0x00007FF65B072000-memory.dmp	xmrig
behavioral2/memory/428-165-0x00007FF713AF0000-0x00007FF713EE2000-memory.dmp	xmrig
behavioral2/memory/4112-158-0x00007FF78A470000-0x00007FF78A862000-memory.dmp	xmrig
behavioral2/memory/1788-146-0x00007FF6F93C0000-0x00007FF6F97B2000-memory.dmp	xmrig
behavioral2/memory/1780-140-0x00007FF682740000-0x00007FF682B32000-memory.dmp	xmrig
behavioral2/memory/2472-134-0x00007FF647480000-0x00007FF647872000-memory.dmp	xmrig
behavioral2/memory/696-133-0x00007FF636480000-0x00007FF636872000-memory.dmp	xmrig
behavioral2/memory/1900-129-0x00007FF7000A0000-0x00007FF700492000-memory.dmp	xmrig
behavioral2/memory/3128-125-0x00007FF7C3830000-0x00007FF7C3C22000-memory.dmp	xmrig
behavioral2/memory/4352-120-0x00007FF7FF790000-0x00007FF7FFB82000-memory.dmp	xmrig
behavioral2/memory/2612-117-0x00007FF75AFF0000-0x00007FF75B3E2000-memory.dmp	xmrig
behavioral2/memory/2224-115-0x00007FF67E770000-0x00007FF67EB62000-memory.dmp	xmrig
behavioral2/memory/448-110-0x00007FF740610000-0x00007FF740A02000-memory.dmp	xmrig
behavioral2/memory/4316-87-0x00007FF776120000-0x00007FF776512000-memory.dmp	xmrig
behavioral2/memory/1908-79-0x00007FF77C280000-0x00007FF77C672000-memory.dmp	xmrig
behavioral2/memory/3752-64-0x00007FF723780000-0x00007FF723B72000-memory.dmp	xmrig
behavioral2/memory/4256-44-0x00007FF7FC570000-0x00007FF7FC962000-memory.dmp	xmrig
behavioral2/memory/4932-3154-0x00007FF7FAB40000-0x00007FF7FAF32000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	3996	powershell.exe
9	3996	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4256	vsksAjt.exe
2172	YiFruEX.exe
3964	artwDLL.exe
3752	VhnYZSk.exe
1908	nPyMpyw.exe
4932	onZOOHq.exe
4316	vLSoxfr.exe
3128	rrbWsnr.exe
448	UiTvNZR.exe
1900	dcDYkGZ.exe
1996	Xmhmnin.exe
696	rJKtzon.exe
2224	QzSvgOA.exe
2472	FRYnLxH.exe
2612	TuObSnR.exe
1780	KOvzHFH.exe
4352	hitRfsr.exe
1788	sPXBdlw.exe
4760	KEXwBCF.exe
4112	RPWbigO.exe
1044	jqKGFho.exe
428	jZAwFsn.exe
2884	wHYYiaz.exe
4340	EIzpeJi.exe
3156	PEHJsqu.exe
1708	ENQtKMs.exe
2168	WeZrxSl.exe
1056	WngfrBD.exe
3116	gWTIZmN.exe
836	NYHCUaf.exe
880	joEZsMc.exe
2412	BOxvtxx.exe
3408	SGPOYGS.exe
2640	uZelIPQ.exe
3208	xGJtilR.exe
1540	vipNRys.exe
704	wgErqlT.exe
4516	JhfcqMS.exe
4764	orKcNjL.exe
4068	iIEUHLM.exe
1504	wCahfNx.exe
3912	xhzfPhw.exe
5000	uSgsyfr.exe
2220	ZSGocFG.exe
2096	RdyQbxI.exe
1248	QWNwcZP.exe
3780	sklxeOS.exe
2124	KJzDuRa.exe
3704	cJGvSxi.exe
3336	ZsWQtHX.exe
3084	CjKAXwi.exe
2880	QyCwvPJ.exe
3976	qtnPJPm.exe
4604	qRnFVPZ.exe
4944	FIpwQcw.exe
2404	KritTgY.exe
5056	JHhkZvd.exe
2336	MuSMbxC.exe
1060	QajySFf.exe
4984	oQQKjiM.exe
4336	yAFiPSd.exe
1932	dVmrGon.exe
3536	hohxzan.exe
5144	CFgBfLR.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4832-0-0x00007FF65DFB0000-0x00007FF65E3A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-8.dat	upx
behavioral2/files/0x000a000000023bc4-14.dat	upx
behavioral2/files/0x000b000000023bc0-10.dat	upx
behavioral2/files/0x000a000000023bc6-22.dat	upx
behavioral2/files/0x000a000000023bc7-37.dat	upx
behavioral2/memory/3964-49-0x00007FF6662D0000-0x00007FF6666C2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcb-54.dat	upx
behavioral2/memory/2172-59-0x00007FF751330000-0x00007FF751722000-memory.dmp	upx
behavioral2/files/0x000b000000023bc8-68.dat	upx
behavioral2/files/0x000a000000023bcf-83.dat	upx
behavioral2/files/0x000a000000023bd1-94.dat	upx
behavioral2/files/0x000a000000023bd2-107.dat	upx
behavioral2/memory/1996-114-0x00007FF66E670000-0x00007FF66EA62000-memory.dmp	upx
behavioral2/files/0x000a000000023bd4-116.dat	upx
behavioral2/files/0x000a000000023bd5-126.dat	upx
behavioral2/files/0x000a000000023bd7-137.dat	upx
behavioral2/memory/4760-152-0x00007FF6FC5C0000-0x00007FF6FC9B2000-memory.dmp	upx
behavioral2/memory/1044-164-0x00007FF7D0F80000-0x00007FF7D1372000-memory.dmp	upx
behavioral2/files/0x000b000000023be0-190.dat	upx
behavioral2/files/0x000e000000023bef-200.dat	upx
behavioral2/files/0x000a000000023be8-195.dat	upx
behavioral2/files/0x000b000000023bdf-193.dat	upx
behavioral2/files/0x000b000000023bde-188.dat	upx
behavioral2/files/0x000a000000023bdd-183.dat	upx
behavioral2/files/0x000a000000023bdc-178.dat	upx
behavioral2/memory/4340-177-0x00007FF68D840000-0x00007FF68DC32000-memory.dmp	upx
behavioral2/files/0x000a000000023bdb-172.dat	upx
behavioral2/memory/2884-171-0x00007FF65AC80000-0x00007FF65B072000-memory.dmp	upx
behavioral2/files/0x000a000000023bda-166.dat	upx
behavioral2/memory/428-165-0x00007FF713AF0000-0x00007FF713EE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd9-159.dat	upx
behavioral2/memory/4112-158-0x00007FF78A470000-0x00007FF78A862000-memory.dmp	upx
behavioral2/files/0x000a000000023bd8-153.dat	upx
behavioral2/memory/1788-146-0x00007FF6F93C0000-0x00007FF6F97B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd6-141.dat	upx
behavioral2/memory/1780-140-0x00007FF682740000-0x00007FF682B32000-memory.dmp	upx
behavioral2/memory/2472-134-0x00007FF647480000-0x00007FF647872000-memory.dmp	upx
behavioral2/memory/696-133-0x00007FF636480000-0x00007FF636872000-memory.dmp	upx
behavioral2/memory/1900-129-0x00007FF7000A0000-0x00007FF700492000-memory.dmp	upx
behavioral2/memory/3128-125-0x00007FF7C3830000-0x00007FF7C3C22000-memory.dmp	upx
behavioral2/memory/4352-120-0x00007FF7FF790000-0x00007FF7FFB82000-memory.dmp	upx
behavioral2/files/0x000a000000023bd3-118.dat	upx
behavioral2/memory/2612-117-0x00007FF75AFF0000-0x00007FF75B3E2000-memory.dmp	upx
behavioral2/memory/2224-115-0x00007FF67E770000-0x00007FF67EB62000-memory.dmp	upx
behavioral2/memory/448-110-0x00007FF740610000-0x00007FF740A02000-memory.dmp	upx
behavioral2/files/0x000a000000023bd0-100.dat	upx
behavioral2/files/0x000b000000023bc1-96.dat	upx
behavioral2/files/0x000a000000023bce-92.dat	upx
behavioral2/memory/4316-87-0x00007FF776120000-0x00007FF776512000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-82.dat	upx
behavioral2/memory/1908-79-0x00007FF77C280000-0x00007FF77C672000-memory.dmp	upx
behavioral2/files/0x000a000000023bcc-76.dat	upx
behavioral2/memory/3752-64-0x00007FF723780000-0x00007FF723B72000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-57.dat	upx
behavioral2/memory/4932-53-0x00007FF7FAB40000-0x00007FF7FAF32000-memory.dmp	upx
behavioral2/files/0x000b000000023bc9-47.dat	upx
behavioral2/memory/4256-44-0x00007FF7FC570000-0x00007FF7FC962000-memory.dmp	upx
behavioral2/memory/4932-3154-0x00007FF7FAB40000-0x00007FF7FAF32000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KIHtAsd.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\KqqzeLc.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\mLiLtiK.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ybouOWj.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\WnnSEuM.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\EhFMUjk.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ZGJYYxP.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ECtShSO.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\boxnBCQ.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\aLYjpiY.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\IfoevyM.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ucQPbKm.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\eQlifwQ.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\HRikRrH.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\XxAnXhM.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\oUpnZxt.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\hkXptny.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\eIBoGzX.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\SOpIdtN.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\hkYamYW.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\zcMacZJ.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\VAsNikg.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\eSbyNgq.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\TVxMDCW.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\EsZyWvT.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\gCmfMDU.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\xLiufmr.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\qTpbyfS.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\lSyphEx.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\zhtdJRX.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\TffSzVR.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\TvkzMRk.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\PjQPemV.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\DzlkmCD.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\iXSJpIA.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\iLvpVdZ.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\xffoYIo.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\YYYdWDS.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\GalZkxN.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ZUWeQtW.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\hcScXCj.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\csKsGXb.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\uBFTRfH.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\xdIakaE.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\bczBREu.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\NKeEOOt.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\hwvdNAh.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\yUNIgku.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\tONPDmU.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\BArpRHO.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\bdmEzQO.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ZuYwlvz.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\DwEivXf.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\icPDrbZ.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\BrUTxwP.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\NGwhqAf.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\BBZevsS.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ygqzgXk.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\niQoEtW.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\mmJtnWm.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\hGFFrlQ.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ZePfUoL.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\qNGnwZg.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\NlPZdeZ.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3996	powershell.exe
3996	powershell.exe
3996	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeLockMemoryPrivilege	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3104	dwm.exe
Token: SeChangeNotifyPrivilege	3104	dwm.exe
Token: 33	3104	dwm.exe
Token: SeIncBasePriorityPrivilege	3104	dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
13900	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3996	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	87
PID 4832 wrote to memory of 3996	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	87
PID 4832 wrote to memory of 4256	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	88
PID 4832 wrote to memory of 4256	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	88
PID 4832 wrote to memory of 2172	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	89
PID 4832 wrote to memory of 2172	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	89
PID 4832 wrote to memory of 3964	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	90
PID 4832 wrote to memory of 3964	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	90
PID 4832 wrote to memory of 3752	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	91
PID 4832 wrote to memory of 3752	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	91
PID 4832 wrote to memory of 1908	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	92
PID 4832 wrote to memory of 1908	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	92
PID 4832 wrote to memory of 4932	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	93
PID 4832 wrote to memory of 4932	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	93
PID 4832 wrote to memory of 4316	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	94
PID 4832 wrote to memory of 4316	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	94
PID 4832 wrote to memory of 3128	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	95
PID 4832 wrote to memory of 3128	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	95
PID 4832 wrote to memory of 448	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	96
PID 4832 wrote to memory of 448	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	96
PID 4832 wrote to memory of 1900	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	97
PID 4832 wrote to memory of 1900	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	97
PID 4832 wrote to memory of 1996	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	98
PID 4832 wrote to memory of 1996	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	98
PID 4832 wrote to memory of 2472	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	99
PID 4832 wrote to memory of 2472	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	99
PID 4832 wrote to memory of 696	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	100
PID 4832 wrote to memory of 696	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	100
PID 4832 wrote to memory of 2224	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	101
PID 4832 wrote to memory of 2224	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	101
PID 4832 wrote to memory of 2612	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	102
PID 4832 wrote to memory of 2612	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	102
PID 4832 wrote to memory of 1780	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	103
PID 4832 wrote to memory of 1780	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	103
PID 4832 wrote to memory of 4352	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	104
PID 4832 wrote to memory of 4352	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	104
PID 4832 wrote to memory of 1788	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	105
PID 4832 wrote to memory of 1788	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	105
PID 4832 wrote to memory of 4760	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	106
PID 4832 wrote to memory of 4760	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	106
PID 4832 wrote to memory of 4112	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	107
PID 4832 wrote to memory of 4112	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	107
PID 4832 wrote to memory of 1044	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	108
PID 4832 wrote to memory of 1044	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	108
PID 4832 wrote to memory of 428	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	109
PID 4832 wrote to memory of 428	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	109
PID 4832 wrote to memory of 2884	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	110
PID 4832 wrote to memory of 2884	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	110
PID 4832 wrote to memory of 4340	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	111
PID 4832 wrote to memory of 4340	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	111
PID 4832 wrote to memory of 3156	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	112
PID 4832 wrote to memory of 3156	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	112
PID 4832 wrote to memory of 1708	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	113
PID 4832 wrote to memory of 1708	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	113
PID 4832 wrote to memory of 2168	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	114
PID 4832 wrote to memory of 2168	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	114
PID 4832 wrote to memory of 1056	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	115
PID 4832 wrote to memory of 1056	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	115
PID 4832 wrote to memory of 3116	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	116
PID 4832 wrote to memory of 3116	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	116
PID 4832 wrote to memory of 836	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	117
PID 4832 wrote to memory of 836	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	117
PID 4832 wrote to memory of 880	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	118
PID 4832 wrote to memory of 880	4832	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3996
- C:\Windows\System\vsksAjt.exe
  C:\Windows\System\vsksAjt.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\YiFruEX.exe
  C:\Windows\System\YiFruEX.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\artwDLL.exe
  C:\Windows\System\artwDLL.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\VhnYZSk.exe
  C:\Windows\System\VhnYZSk.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\nPyMpyw.exe
  C:\Windows\System\nPyMpyw.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\onZOOHq.exe
  C:\Windows\System\onZOOHq.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\vLSoxfr.exe
  C:\Windows\System\vLSoxfr.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\rrbWsnr.exe
  C:\Windows\System\rrbWsnr.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\UiTvNZR.exe
  C:\Windows\System\UiTvNZR.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\dcDYkGZ.exe
  C:\Windows\System\dcDYkGZ.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\Xmhmnin.exe
  C:\Windows\System\Xmhmnin.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\FRYnLxH.exe
  C:\Windows\System\FRYnLxH.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\rJKtzon.exe
  C:\Windows\System\rJKtzon.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\QzSvgOA.exe
  C:\Windows\System\QzSvgOA.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\TuObSnR.exe
  C:\Windows\System\TuObSnR.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\KOvzHFH.exe
  C:\Windows\System\KOvzHFH.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\hitRfsr.exe
  C:\Windows\System\hitRfsr.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\sPXBdlw.exe
  C:\Windows\System\sPXBdlw.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\KEXwBCF.exe
  C:\Windows\System\KEXwBCF.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\RPWbigO.exe
  C:\Windows\System\RPWbigO.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\jqKGFho.exe
  C:\Windows\System\jqKGFho.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\jZAwFsn.exe
  C:\Windows\System\jZAwFsn.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\wHYYiaz.exe
  C:\Windows\System\wHYYiaz.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\EIzpeJi.exe
  C:\Windows\System\EIzpeJi.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\PEHJsqu.exe
  C:\Windows\System\PEHJsqu.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\ENQtKMs.exe
  C:\Windows\System\ENQtKMs.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\WeZrxSl.exe
  C:\Windows\System\WeZrxSl.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\WngfrBD.exe
  C:\Windows\System\WngfrBD.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\gWTIZmN.exe
  C:\Windows\System\gWTIZmN.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\NYHCUaf.exe
  C:\Windows\System\NYHCUaf.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\joEZsMc.exe
  C:\Windows\System\joEZsMc.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\BOxvtxx.exe
  C:\Windows\System\BOxvtxx.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\SGPOYGS.exe
  C:\Windows\System\SGPOYGS.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\uZelIPQ.exe
  C:\Windows\System\uZelIPQ.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\xGJtilR.exe
  C:\Windows\System\xGJtilR.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\vipNRys.exe
  C:\Windows\System\vipNRys.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\wgErqlT.exe
  C:\Windows\System\wgErqlT.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\JhfcqMS.exe
  C:\Windows\System\JhfcqMS.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\orKcNjL.exe
  C:\Windows\System\orKcNjL.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\iIEUHLM.exe
  C:\Windows\System\iIEUHLM.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\wCahfNx.exe
  C:\Windows\System\wCahfNx.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\xhzfPhw.exe
  C:\Windows\System\xhzfPhw.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\uSgsyfr.exe
  C:\Windows\System\uSgsyfr.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\ZSGocFG.exe
  C:\Windows\System\ZSGocFG.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\RdyQbxI.exe
  C:\Windows\System\RdyQbxI.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\QWNwcZP.exe
  C:\Windows\System\QWNwcZP.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\sklxeOS.exe
  C:\Windows\System\sklxeOS.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\KJzDuRa.exe
  C:\Windows\System\KJzDuRa.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\cJGvSxi.exe
  C:\Windows\System\cJGvSxi.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\ZsWQtHX.exe
  C:\Windows\System\ZsWQtHX.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\CjKAXwi.exe
  C:\Windows\System\CjKAXwi.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\QyCwvPJ.exe
  C:\Windows\System\QyCwvPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\qtnPJPm.exe
  C:\Windows\System\qtnPJPm.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\qRnFVPZ.exe
  C:\Windows\System\qRnFVPZ.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\FIpwQcw.exe
  C:\Windows\System\FIpwQcw.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\KritTgY.exe
  C:\Windows\System\KritTgY.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\JHhkZvd.exe
  C:\Windows\System\JHhkZvd.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\MuSMbxC.exe
  C:\Windows\System\MuSMbxC.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\QajySFf.exe
  C:\Windows\System\QajySFf.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\oQQKjiM.exe
  C:\Windows\System\oQQKjiM.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\yAFiPSd.exe
  C:\Windows\System\yAFiPSd.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\dVmrGon.exe
  C:\Windows\System\dVmrGon.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\hohxzan.exe
  C:\Windows\System\hohxzan.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\CFgBfLR.exe
  C:\Windows\System\CFgBfLR.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\XLrDkZt.exe
  C:\Windows\System\XLrDkZt.exe
  2⤵
  PID:5172
- C:\Windows\System\MoFICZS.exe
  C:\Windows\System\MoFICZS.exe
  2⤵
  PID:5196
- C:\Windows\System\zXbzaGI.exe
  C:\Windows\System\zXbzaGI.exe
  2⤵
  PID:5224
- C:\Windows\System\vWDFSyd.exe
  C:\Windows\System\vWDFSyd.exe
  2⤵
  PID:5252
- C:\Windows\System\VllnKXu.exe
  C:\Windows\System\VllnKXu.exe
  2⤵
  PID:5284
- C:\Windows\System\Gysljvj.exe
  C:\Windows\System\Gysljvj.exe
  2⤵
  PID:5312
- C:\Windows\System\kkaGciM.exe
  C:\Windows\System\kkaGciM.exe
  2⤵
  PID:5340
- C:\Windows\System\jfrppcX.exe
  C:\Windows\System\jfrppcX.exe
  2⤵
  PID:5364
- C:\Windows\System\YYjCGQM.exe
  C:\Windows\System\YYjCGQM.exe
  2⤵
  PID:5396
- C:\Windows\System\RXgUHVx.exe
  C:\Windows\System\RXgUHVx.exe
  2⤵
  PID:5424
- C:\Windows\System\vCDHPjn.exe
  C:\Windows\System\vCDHPjn.exe
  2⤵
  PID:5452
- C:\Windows\System\nigzzCI.exe
  C:\Windows\System\nigzzCI.exe
  2⤵
  PID:5480
- C:\Windows\System\PrDZAOP.exe
  C:\Windows\System\PrDZAOP.exe
  2⤵
  PID:5508
- C:\Windows\System\gpCVFSh.exe
  C:\Windows\System\gpCVFSh.exe
  2⤵
  PID:5536
- C:\Windows\System\acmHAFO.exe
  C:\Windows\System\acmHAFO.exe
  2⤵
  PID:5564
- C:\Windows\System\jdduvxE.exe
  C:\Windows\System\jdduvxE.exe
  2⤵
  PID:5588
- C:\Windows\System\ZoxhzYt.exe
  C:\Windows\System\ZoxhzYt.exe
  2⤵
  PID:5620
- C:\Windows\System\AjIQeXV.exe
  C:\Windows\System\AjIQeXV.exe
  2⤵
  PID:5648
- C:\Windows\System\HVJrPku.exe
  C:\Windows\System\HVJrPku.exe
  2⤵
  PID:5676
- C:\Windows\System\lqeCSMD.exe
  C:\Windows\System\lqeCSMD.exe
  2⤵
  PID:5704
- C:\Windows\System\dFayiub.exe
  C:\Windows\System\dFayiub.exe
  2⤵
  PID:5732
- C:\Windows\System\ucQPbKm.exe
  C:\Windows\System\ucQPbKm.exe
  2⤵
  PID:5760
- C:\Windows\System\CEnASIz.exe
  C:\Windows\System\CEnASIz.exe
  2⤵
  PID:5788
- C:\Windows\System\AjRGUrk.exe
  C:\Windows\System\AjRGUrk.exe
  2⤵
  PID:5816
- C:\Windows\System\gfGdeMU.exe
  C:\Windows\System\gfGdeMU.exe
  2⤵
  PID:5844
- C:\Windows\System\WbILndY.exe
  C:\Windows\System\WbILndY.exe
  2⤵
  PID:5872
- C:\Windows\System\zFKXHMU.exe
  C:\Windows\System\zFKXHMU.exe
  2⤵
  PID:5900
- C:\Windows\System\uYKwYJG.exe
  C:\Windows\System\uYKwYJG.exe
  2⤵
  PID:5928
- C:\Windows\System\xSmzDIU.exe
  C:\Windows\System\xSmzDIU.exe
  2⤵
  PID:5956
- C:\Windows\System\fHlNfZb.exe
  C:\Windows\System\fHlNfZb.exe
  2⤵
  PID:5984
- C:\Windows\System\GmmkLcS.exe
  C:\Windows\System\GmmkLcS.exe
  2⤵
  PID:6012
- C:\Windows\System\hhjMREA.exe
  C:\Windows\System\hhjMREA.exe
  2⤵
  PID:6040
- C:\Windows\System\pybDvut.exe
  C:\Windows\System\pybDvut.exe
  2⤵
  PID:6064
- C:\Windows\System\ZhoEsPS.exe
  C:\Windows\System\ZhoEsPS.exe
  2⤵
  PID:6088
- C:\Windows\System\pEleyfx.exe
  C:\Windows\System\pEleyfx.exe
  2⤵
  PID:6124
- C:\Windows\System\zFOoywD.exe
  C:\Windows\System\zFOoywD.exe
  2⤵
  PID:2736
- C:\Windows\System\kzzrFIa.exe
  C:\Windows\System\kzzrFIa.exe
  2⤵
  PID:4488
- C:\Windows\System\eiOJPSZ.exe
  C:\Windows\System\eiOJPSZ.exe
  2⤵
  PID:3008
- C:\Windows\System\WiyqGmU.exe
  C:\Windows\System\WiyqGmU.exe
  2⤵
  PID:1344
- C:\Windows\System\ZyKiQqy.exe
  C:\Windows\System\ZyKiQqy.exe
  2⤵
  PID:5128
- C:\Windows\System\wjZAFIU.exe
  C:\Windows\System\wjZAFIU.exe
  2⤵
  PID:5184
- C:\Windows\System\OTozQZJ.exe
  C:\Windows\System\OTozQZJ.exe
  2⤵
  PID:5244
- C:\Windows\System\rfhqYdo.exe
  C:\Windows\System\rfhqYdo.exe
  2⤵
  PID:5304
- C:\Windows\System\oyRopGu.exe
  C:\Windows\System\oyRopGu.exe
  2⤵
  PID:5384
- C:\Windows\System\sxlPJTf.exe
  C:\Windows\System\sxlPJTf.exe
  2⤵
  PID:5444
- C:\Windows\System\lfHBLtx.exe
  C:\Windows\System\lfHBLtx.exe
  2⤵
  PID:5496
- C:\Windows\System\skWenyc.exe
  C:\Windows\System\skWenyc.exe
  2⤵
  PID:5556
- C:\Windows\System\EMEPIyU.exe
  C:\Windows\System\EMEPIyU.exe
  2⤵
  PID:5612
- C:\Windows\System\zcXsubr.exe
  C:\Windows\System\zcXsubr.exe
  2⤵
  PID:5668
- C:\Windows\System\kyWquUr.exe
  C:\Windows\System\kyWquUr.exe
  2⤵
  PID:5744
- C:\Windows\System\dVORKNe.exe
  C:\Windows\System\dVORKNe.exe
  2⤵
  PID:5808
- C:\Windows\System\XHXFfZI.exe
  C:\Windows\System\XHXFfZI.exe
  2⤵
  PID:5864
- C:\Windows\System\VUjAIyC.exe
  C:\Windows\System\VUjAIyC.exe
  2⤵
  PID:5944
- C:\Windows\System\nVkZKHa.exe
  C:\Windows\System\nVkZKHa.exe
  2⤵
  PID:6000
- C:\Windows\System\kATbqyL.exe
  C:\Windows\System\kATbqyL.exe
  2⤵
  PID:6056
- C:\Windows\System\GHhVpIV.exe
  C:\Windows\System\GHhVpIV.exe
  2⤵
  PID:6116
- C:\Windows\System\GoPstZa.exe
  C:\Windows\System\GoPstZa.exe
  2⤵
  PID:2648
- C:\Windows\System\TIeHvbr.exe
  C:\Windows\System\TIeHvbr.exe
  2⤵
  PID:2212
- C:\Windows\System\jGuGuEY.exe
  C:\Windows\System\jGuGuEY.exe
  2⤵
  PID:5164
- C:\Windows\System\EchrGVT.exe
  C:\Windows\System\EchrGVT.exe
  2⤵
  PID:5352
- C:\Windows\System\pKKcNQe.exe
  C:\Windows\System\pKKcNQe.exe
  2⤵
  PID:4016
- C:\Windows\System\vPDgCTn.exe
  C:\Windows\System\vPDgCTn.exe
  2⤵
  PID:5548
- C:\Windows\System\lvzDBQL.exe
  C:\Windows\System\lvzDBQL.exe
  2⤵
  PID:5660
- C:\Windows\System\TVSmZQI.exe
  C:\Windows\System\TVSmZQI.exe
  2⤵
  PID:5836
- C:\Windows\System\pMIaufV.exe
  C:\Windows\System\pMIaufV.exe
  2⤵
  PID:5972
- C:\Windows\System\hiYiCgm.exe
  C:\Windows\System\hiYiCgm.exe
  2⤵
  PID:6084
- C:\Windows\System\zrYmGQP.exe
  C:\Windows\System\zrYmGQP.exe
  2⤵
  PID:5044
- C:\Windows\System\eWqmanu.exe
  C:\Windows\System\eWqmanu.exe
  2⤵
  PID:5156
- C:\Windows\System\hYoDMfm.exe
  C:\Windows\System\hYoDMfm.exe
  2⤵
  PID:6148
- C:\Windows\System\OoVvuHH.exe
  C:\Windows\System\OoVvuHH.exe
  2⤵
  PID:6176
- C:\Windows\System\eHdAmqE.exe
  C:\Windows\System\eHdAmqE.exe
  2⤵
  PID:6204
- C:\Windows\System\NIHdOqw.exe
  C:\Windows\System\NIHdOqw.exe
  2⤵
  PID:6232
- C:\Windows\System\EMFlduK.exe
  C:\Windows\System\EMFlduK.exe
  2⤵
  PID:6260
- C:\Windows\System\ESNZWyQ.exe
  C:\Windows\System\ESNZWyQ.exe
  2⤵
  PID:6288
- C:\Windows\System\yvbBUtR.exe
  C:\Windows\System\yvbBUtR.exe
  2⤵
  PID:6316
- C:\Windows\System\qchnRCM.exe
  C:\Windows\System\qchnRCM.exe
  2⤵
  PID:6344
- C:\Windows\System\VAAXpqh.exe
  C:\Windows\System\VAAXpqh.exe
  2⤵
  PID:6372
- C:\Windows\System\JxjRNSP.exe
  C:\Windows\System\JxjRNSP.exe
  2⤵
  PID:6400
- C:\Windows\System\QwUqZHu.exe
  C:\Windows\System\QwUqZHu.exe
  2⤵
  PID:6428
- C:\Windows\System\uMKGXUX.exe
  C:\Windows\System\uMKGXUX.exe
  2⤵
  PID:6456
- C:\Windows\System\jpDXiUr.exe
  C:\Windows\System\jpDXiUr.exe
  2⤵
  PID:6484
- C:\Windows\System\KDawTOk.exe
  C:\Windows\System\KDawTOk.exe
  2⤵
  PID:6512
- C:\Windows\System\JxmWOPd.exe
  C:\Windows\System\JxmWOPd.exe
  2⤵
  PID:6540
- C:\Windows\System\mXzZplP.exe
  C:\Windows\System\mXzZplP.exe
  2⤵
  PID:6564
- C:\Windows\System\hVmIwVg.exe
  C:\Windows\System\hVmIwVg.exe
  2⤵
  PID:6596
- C:\Windows\System\umCgzYB.exe
  C:\Windows\System\umCgzYB.exe
  2⤵
  PID:6620
- C:\Windows\System\RvcSCaW.exe
  C:\Windows\System\RvcSCaW.exe
  2⤵
  PID:6652
- C:\Windows\System\HNTJvOY.exe
  C:\Windows\System\HNTJvOY.exe
  2⤵
  PID:6676
- C:\Windows\System\FXnkzGE.exe
  C:\Windows\System\FXnkzGE.exe
  2⤵
  PID:6708
- C:\Windows\System\zRUbxwu.exe
  C:\Windows\System\zRUbxwu.exe
  2⤵
  PID:6736
- C:\Windows\System\gNBUSUa.exe
  C:\Windows\System\gNBUSUa.exe
  2⤵
  PID:6764
- C:\Windows\System\WXmxcIJ.exe
  C:\Windows\System\WXmxcIJ.exe
  2⤵
  PID:6792
- C:\Windows\System\cuVnuVU.exe
  C:\Windows\System\cuVnuVU.exe
  2⤵
  PID:6820
- C:\Windows\System\RoIKYcP.exe
  C:\Windows\System\RoIKYcP.exe
  2⤵
  PID:6844
- C:\Windows\System\EupDIcY.exe
  C:\Windows\System\EupDIcY.exe
  2⤵
  PID:6876
- C:\Windows\System\zxZNtug.exe
  C:\Windows\System\zxZNtug.exe
  2⤵
  PID:6904
- C:\Windows\System\sskstiz.exe
  C:\Windows\System\sskstiz.exe
  2⤵
  PID:6932
- C:\Windows\System\OdRsUlh.exe
  C:\Windows\System\OdRsUlh.exe
  2⤵
  PID:6960
- C:\Windows\System\BjlYKwi.exe
  C:\Windows\System\BjlYKwi.exe
  2⤵
  PID:6988
- C:\Windows\System\AyleJyS.exe
  C:\Windows\System\AyleJyS.exe
  2⤵
  PID:7016
- C:\Windows\System\OtVYNcq.exe
  C:\Windows\System\OtVYNcq.exe
  2⤵
  PID:7044
- C:\Windows\System\Exowalz.exe
  C:\Windows\System\Exowalz.exe
  2⤵
  PID:7072
- C:\Windows\System\QcXfJyU.exe
  C:\Windows\System\QcXfJyU.exe
  2⤵
  PID:7100
- C:\Windows\System\zVsAqAO.exe
  C:\Windows\System\zVsAqAO.exe
  2⤵
  PID:7128
- C:\Windows\System\kSeOJzl.exe
  C:\Windows\System\kSeOJzl.exe
  2⤵
  PID:7156
- C:\Windows\System\GmsgKDc.exe
  C:\Windows\System\GmsgKDc.exe
  2⤵
  PID:5524
- C:\Windows\System\XvmoHhf.exe
  C:\Windows\System\XvmoHhf.exe
  2⤵
  PID:5912
- C:\Windows\System\PApTojJ.exe
  C:\Windows\System\PApTojJ.exe
  2⤵
  PID:4820
- C:\Windows\System\iFMoCGA.exe
  C:\Windows\System\iFMoCGA.exe
  2⤵
  PID:4716
- C:\Windows\System\WGvlIVy.exe
  C:\Windows\System\WGvlIVy.exe
  2⤵
  PID:6164
- C:\Windows\System\xVtLXCy.exe
  C:\Windows\System\xVtLXCy.exe
  2⤵
  PID:6224
- C:\Windows\System\oCxMjFk.exe
  C:\Windows\System\oCxMjFk.exe
  2⤵
  PID:5028
- C:\Windows\System\PpuowJH.exe
  C:\Windows\System\PpuowJH.exe
  2⤵
  PID:6328
- C:\Windows\System\aUARPqE.exe
  C:\Windows\System\aUARPqE.exe
  2⤵
  PID:6364
- C:\Windows\System\bcZvxkU.exe
  C:\Windows\System\bcZvxkU.exe
  2⤵
  PID:2824
- C:\Windows\System\KhidEDe.exe
  C:\Windows\System\KhidEDe.exe
  2⤵
  PID:6476
- C:\Windows\System\OMiqYew.exe
  C:\Windows\System\OMiqYew.exe
  2⤵
  PID:6532
- C:\Windows\System\JfjUaQS.exe
  C:\Windows\System\JfjUaQS.exe
  2⤵
  PID:6588
- C:\Windows\System\rqeZmBW.exe
  C:\Windows\System\rqeZmBW.exe
  2⤵
  PID:6640
- C:\Windows\System\kURuwDk.exe
  C:\Windows\System\kURuwDk.exe
  2⤵
  PID:6700
- C:\Windows\System\PMWWfHT.exe
  C:\Windows\System\PMWWfHT.exe
  2⤵
  PID:6752
- C:\Windows\System\Vymoyjd.exe
  C:\Windows\System\Vymoyjd.exe
  2⤵
  PID:1196
- C:\Windows\System\BOyszBi.exe
  C:\Windows\System\BOyszBi.exe
  2⤵
  PID:6944
- C:\Windows\System\cWAjLxR.exe
  C:\Windows\System\cWAjLxR.exe
  2⤵
  PID:6976
- C:\Windows\System\vomCssF.exe
  C:\Windows\System\vomCssF.exe
  2⤵
  PID:7004
- C:\Windows\System\xOhtNiv.exe
  C:\Windows\System\xOhtNiv.exe
  2⤵
  PID:2268
- C:\Windows\System\PzPbSGP.exe
  C:\Windows\System\PzPbSGP.exe
  2⤵
  PID:7084
- C:\Windows\System\TNkQgjR.exe
  C:\Windows\System\TNkQgjR.exe
  2⤵
  PID:7140
- C:\Windows\System\jeKYDOB.exe
  C:\Windows\System\jeKYDOB.exe
  2⤵
  PID:1096
- C:\Windows\System\ONbtnmk.exe
  C:\Windows\System\ONbtnmk.exe
  2⤵
  PID:6140
- C:\Windows\System\azabuvH.exe
  C:\Windows\System\azabuvH.exe
  2⤵
  PID:5412
- C:\Windows\System\tsulkjG.exe
  C:\Windows\System\tsulkjG.exe
  2⤵
  PID:4836
- C:\Windows\System\IjyVKof.exe
  C:\Windows\System\IjyVKof.exe
  2⤵
  PID:6336
- C:\Windows\System\uMjMxoY.exe
  C:\Windows\System\uMjMxoY.exe
  2⤵
  PID:6448
- C:\Windows\System\lnBlWFs.exe
  C:\Windows\System\lnBlWFs.exe
  2⤵
  PID:6524
- C:\Windows\System\yQTiYHr.exe
  C:\Windows\System\yQTiYHr.exe
  2⤵
  PID:6636
- C:\Windows\System\ZPtqvNz.exe
  C:\Windows\System\ZPtqvNz.exe
  2⤵
  PID:6724
- C:\Windows\System\pVSeChX.exe
  C:\Windows\System\pVSeChX.exe
  2⤵
  PID:3824
- C:\Windows\System\PcgExqB.exe
  C:\Windows\System\PcgExqB.exe
  2⤵
  PID:1000
- C:\Windows\System\ipoyaHz.exe
  C:\Windows\System\ipoyaHz.exe
  2⤵
  PID:3188
- C:\Windows\System\eOZyrhF.exe
  C:\Windows\System\eOZyrhF.exe
  2⤵
  PID:1604
- C:\Windows\System\DnBpMWY.exe
  C:\Windows\System\DnBpMWY.exe
  2⤵
  PID:868
- C:\Windows\System\gibFUtS.exe
  C:\Windows\System\gibFUtS.exe
  2⤵
  PID:5360
- C:\Windows\System\jjioEcj.exe
  C:\Windows\System\jjioEcj.exe
  2⤵
  PID:6504
- C:\Windows\System\NTrFnUR.exe
  C:\Windows\System\NTrFnUR.exe
  2⤵
  PID:6300
- C:\Windows\System\noSdFYs.exe
  C:\Windows\System\noSdFYs.exe
  2⤵
  PID:6580
- C:\Windows\System\TlPXaVu.exe
  C:\Windows\System\TlPXaVu.exe
  2⤵
  PID:632
- C:\Windows\System\bbLyqZX.exe
  C:\Windows\System\bbLyqZX.exe
  2⤵
  PID:1144
- C:\Windows\System\whpbCvr.exe
  C:\Windows\System\whpbCvr.exe
  2⤵
  PID:7120
- C:\Windows\System\eFytifX.exe
  C:\Windows\System\eFytifX.exe
  2⤵
  PID:2160
- C:\Windows\System\pNuccVl.exe
  C:\Windows\System\pNuccVl.exe
  2⤵
  PID:6972
- C:\Windows\System\BUIsanZ.exe
  C:\Windows\System\BUIsanZ.exe
  2⤵
  PID:3004
- C:\Windows\System\PqdSKsx.exe
  C:\Windows\System\PqdSKsx.exe
  2⤵
  PID:6280
- C:\Windows\System\GjfMXMx.exe
  C:\Windows\System\GjfMXMx.exe
  2⤵
  PID:7184
- C:\Windows\System\bFRzdHR.exe
  C:\Windows\System\bFRzdHR.exe
  2⤵
  PID:7228
- C:\Windows\System\OhvMjsI.exe
  C:\Windows\System\OhvMjsI.exe
  2⤵
  PID:7252
- C:\Windows\System\NezcRkS.exe
  C:\Windows\System\NezcRkS.exe
  2⤵
  PID:7272
- C:\Windows\System\UvxGwzD.exe
  C:\Windows\System\UvxGwzD.exe
  2⤵
  PID:7324
- C:\Windows\System\wQSSwxK.exe
  C:\Windows\System\wQSSwxK.exe
  2⤵
  PID:7344
- C:\Windows\System\lpHsGie.exe
  C:\Windows\System\lpHsGie.exe
  2⤵
  PID:7368
- C:\Windows\System\grvXtSB.exe
  C:\Windows\System\grvXtSB.exe
  2⤵
  PID:7392
- C:\Windows\System\mtuCRaR.exe
  C:\Windows\System\mtuCRaR.exe
  2⤵
  PID:7412
- C:\Windows\System\bpEDaiV.exe
  C:\Windows\System\bpEDaiV.exe
  2⤵
  PID:7448
- C:\Windows\System\VdmHbFw.exe
  C:\Windows\System\VdmHbFw.exe
  2⤵
  PID:7480
- C:\Windows\System\ukzmuHw.exe
  C:\Windows\System\ukzmuHw.exe
  2⤵
  PID:7504
- C:\Windows\System\KpbXfrp.exe
  C:\Windows\System\KpbXfrp.exe
  2⤵
  PID:7528
- C:\Windows\System\ngmsmFg.exe
  C:\Windows\System\ngmsmFg.exe
  2⤵
  PID:7548
- C:\Windows\System\HXZQREM.exe
  C:\Windows\System\HXZQREM.exe
  2⤵
  PID:7568
- C:\Windows\System\tjJjxev.exe
  C:\Windows\System\tjJjxev.exe
  2⤵
  PID:7592
- C:\Windows\System\ZtRvgYd.exe
  C:\Windows\System\ZtRvgYd.exe
  2⤵
  PID:7624
- C:\Windows\System\eIiAqnA.exe
  C:\Windows\System\eIiAqnA.exe
  2⤵
  PID:7648
- C:\Windows\System\LsSKnvB.exe
  C:\Windows\System\LsSKnvB.exe
  2⤵
  PID:7676
- C:\Windows\System\mVyZBTu.exe
  C:\Windows\System\mVyZBTu.exe
  2⤵
  PID:7704
- C:\Windows\System\kvRMwpr.exe
  C:\Windows\System\kvRMwpr.exe
  2⤵
  PID:7740
- C:\Windows\System\vIxvmXY.exe
  C:\Windows\System\vIxvmXY.exe
  2⤵
  PID:7768
- C:\Windows\System\zFJWqvR.exe
  C:\Windows\System\zFJWqvR.exe
  2⤵
  PID:7796
- C:\Windows\System\IRODJHa.exe
  C:\Windows\System\IRODJHa.exe
  2⤵
  PID:7824
- C:\Windows\System\PyPsFHr.exe
  C:\Windows\System\PyPsFHr.exe
  2⤵
  PID:7852
- C:\Windows\System\sOoTFVL.exe
  C:\Windows\System\sOoTFVL.exe
  2⤵
  PID:7876
- C:\Windows\System\uJOERGk.exe
  C:\Windows\System\uJOERGk.exe
  2⤵
  PID:7896
- C:\Windows\System\jUmJdsg.exe
  C:\Windows\System\jUmJdsg.exe
  2⤵
  PID:7936
- C:\Windows\System\UzLrMQe.exe
  C:\Windows\System\UzLrMQe.exe
  2⤵
  PID:7956
- C:\Windows\System\rznyiDd.exe
  C:\Windows\System\rznyiDd.exe
  2⤵
  PID:8004
- C:\Windows\System\FloQcfw.exe
  C:\Windows\System\FloQcfw.exe
  2⤵
  PID:8040
- C:\Windows\System\BqLUsZv.exe
  C:\Windows\System\BqLUsZv.exe
  2⤵
  PID:8060
- C:\Windows\System\uIhFbcl.exe
  C:\Windows\System\uIhFbcl.exe
  2⤵
  PID:8084
- C:\Windows\System\JZJrlFq.exe
  C:\Windows\System\JZJrlFq.exe
  2⤵
  PID:8116
- C:\Windows\System\hDAmvpo.exe
  C:\Windows\System\hDAmvpo.exe
  2⤵
  PID:8140
- C:\Windows\System\wOzyQFO.exe
  C:\Windows\System\wOzyQFO.exe
  2⤵
  PID:8156
- C:\Windows\System\FUZRKxX.exe
  C:\Windows\System\FUZRKxX.exe
  2⤵
  PID:8176
- C:\Windows\System\BiFTaMy.exe
  C:\Windows\System\BiFTaMy.exe
  2⤵
  PID:6728
- C:\Windows\System\JBhEMgD.exe
  C:\Windows\System\JBhEMgD.exe
  2⤵
  PID:7220
- C:\Windows\System\RXOdGsh.exe
  C:\Windows\System\RXOdGsh.exe
  2⤵
  PID:7304
- C:\Windows\System\ZLRlcBw.exe
  C:\Windows\System\ZLRlcBw.exe
  2⤵
  PID:7436
- C:\Windows\System\TMahbVJ.exe
  C:\Windows\System\TMahbVJ.exe
  2⤵
  PID:7500
- C:\Windows\System\VUfsJLW.exe
  C:\Windows\System\VUfsJLW.exe
  2⤵
  PID:7564
- C:\Windows\System\OSAvpMG.exe
  C:\Windows\System\OSAvpMG.exe
  2⤵
  PID:7608
- C:\Windows\System\eKLUGEs.exe
  C:\Windows\System\eKLUGEs.exe
  2⤵
  PID:7616
- C:\Windows\System\IqiIRBc.exe
  C:\Windows\System\IqiIRBc.exe
  2⤵
  PID:7760
- C:\Windows\System\WpyRvus.exe
  C:\Windows\System\WpyRvus.exe
  2⤵
  PID:7820
- C:\Windows\System\SjGXToU.exe
  C:\Windows\System\SjGXToU.exe
  2⤵
  PID:7864
- C:\Windows\System\SESxvPN.exe
  C:\Windows\System\SESxvPN.exe
  2⤵
  PID:7996
- C:\Windows\System\TEgUfRy.exe
  C:\Windows\System\TEgUfRy.exe
  2⤵
  PID:8068
- C:\Windows\System\KUQcCsG.exe
  C:\Windows\System\KUQcCsG.exe
  2⤵
  PID:8108
- C:\Windows\System\lUxCqhK.exe
  C:\Windows\System\lUxCqhK.exe
  2⤵
  PID:1012
- C:\Windows\System\NDBgZWU.exe
  C:\Windows\System\NDBgZWU.exe
  2⤵
  PID:7240
- C:\Windows\System\kDAGGbB.exe
  C:\Windows\System\kDAGGbB.exe
  2⤵
  PID:7300
- C:\Windows\System\DGjyGGd.exe
  C:\Windows\System\DGjyGGd.exe
  2⤵
  PID:7644
- C:\Windows\System\UXMCUtu.exe
  C:\Windows\System\UXMCUtu.exe
  2⤵
  PID:7640
- C:\Windows\System\PkPboQC.exe
  C:\Windows\System\PkPboQC.exe
  2⤵
  PID:8032
- C:\Windows\System\rCoqKRU.exe
  C:\Windows\System\rCoqKRU.exe
  2⤵
  PID:8052
- C:\Windows\System\NEkLVqT.exe
  C:\Windows\System\NEkLVqT.exe
  2⤵
  PID:7312
- C:\Windows\System\Ctoydeb.exe
  C:\Windows\System\Ctoydeb.exe
  2⤵
  PID:7588
- C:\Windows\System\qGLhwld.exe
  C:\Windows\System\qGLhwld.exe
  2⤵
  PID:7732
- C:\Windows\System\tEGIogf.exe
  C:\Windows\System\tEGIogf.exe
  2⤵
  PID:7176
- C:\Windows\System\FLFcOzw.exe
  C:\Windows\System\FLFcOzw.exe
  2⤵
  PID:7804
- C:\Windows\System\mPEssCJ.exe
  C:\Windows\System\mPEssCJ.exe
  2⤵
  PID:8208
- C:\Windows\System\UlKfyXG.exe
  C:\Windows\System\UlKfyXG.exe
  2⤵
  PID:8240
- C:\Windows\System\UQweRka.exe
  C:\Windows\System\UQweRka.exe
  2⤵
  PID:8288
- C:\Windows\System\kcqrMAu.exe
  C:\Windows\System\kcqrMAu.exe
  2⤵
  PID:8320
- C:\Windows\System\VGtrhhK.exe
  C:\Windows\System\VGtrhhK.exe
  2⤵
  PID:8348
- C:\Windows\System\PAMGHrr.exe
  C:\Windows\System\PAMGHrr.exe
  2⤵
  PID:8368
- C:\Windows\System\sQQvrFj.exe
  C:\Windows\System\sQQvrFj.exe
  2⤵
  PID:8384
- C:\Windows\System\oZkYwcN.exe
  C:\Windows\System\oZkYwcN.exe
  2⤵
  PID:8404
- C:\Windows\System\RpIqnPa.exe
  C:\Windows\System\RpIqnPa.exe
  2⤵
  PID:8448
- C:\Windows\System\ISGJLYA.exe
  C:\Windows\System\ISGJLYA.exe
  2⤵
  PID:8468
- C:\Windows\System\DsiAgvS.exe
  C:\Windows\System\DsiAgvS.exe
  2⤵
  PID:8488
- C:\Windows\System\AWZAfjV.exe
  C:\Windows\System\AWZAfjV.exe
  2⤵
  PID:8536
- C:\Windows\System\lDpxXAw.exe
  C:\Windows\System\lDpxXAw.exe
  2⤵
  PID:8564
- C:\Windows\System\hMrgcyH.exe
  C:\Windows\System\hMrgcyH.exe
  2⤵
  PID:8588
- C:\Windows\System\Peuzvpz.exe
  C:\Windows\System\Peuzvpz.exe
  2⤵
  PID:8620
- C:\Windows\System\iiKpMan.exe
  C:\Windows\System\iiKpMan.exe
  2⤵
  PID:8648
- C:\Windows\System\LbhHGVw.exe
  C:\Windows\System\LbhHGVw.exe
  2⤵
  PID:8668
- C:\Windows\System\vcleHmb.exe
  C:\Windows\System\vcleHmb.exe
  2⤵
  PID:8692
- C:\Windows\System\LROVKje.exe
  C:\Windows\System\LROVKje.exe
  2⤵
  PID:8736
- C:\Windows\System\PiGPbgD.exe
  C:\Windows\System\PiGPbgD.exe
  2⤵
  PID:8752
- C:\Windows\System\whkzQzn.exe
  C:\Windows\System\whkzQzn.exe
  2⤵
  PID:8800
- C:\Windows\System\PnQnadk.exe
  C:\Windows\System\PnQnadk.exe
  2⤵
  PID:8816
- C:\Windows\System\FafmXzl.exe
  C:\Windows\System\FafmXzl.exe
  2⤵
  PID:8836
- C:\Windows\System\MduRSmE.exe
  C:\Windows\System\MduRSmE.exe
  2⤵
  PID:8884
- C:\Windows\System\FGYGoGW.exe
  C:\Windows\System\FGYGoGW.exe
  2⤵
  PID:8900
- C:\Windows\System\WNVhQiw.exe
  C:\Windows\System\WNVhQiw.exe
  2⤵
  PID:8920
- C:\Windows\System\PBLvtUQ.exe
  C:\Windows\System\PBLvtUQ.exe
  2⤵
  PID:8944
- C:\Windows\System\iUoukIy.exe
  C:\Windows\System\iUoukIy.exe
  2⤵
  PID:8964
- C:\Windows\System\akASmRR.exe
  C:\Windows\System\akASmRR.exe
  2⤵
  PID:8984
- C:\Windows\System\fedgxpe.exe
  C:\Windows\System\fedgxpe.exe
  2⤵
  PID:9060
- C:\Windows\System\opqWImo.exe
  C:\Windows\System\opqWImo.exe
  2⤵
  PID:9076
- C:\Windows\System\dGrvcyR.exe
  C:\Windows\System\dGrvcyR.exe
  2⤵
  PID:9096
- C:\Windows\System\UuptTbv.exe
  C:\Windows\System\UuptTbv.exe
  2⤵
  PID:9144
- C:\Windows\System\tSMwIQD.exe
  C:\Windows\System\tSMwIQD.exe
  2⤵
  PID:9164
- C:\Windows\System\UJYPjPQ.exe
  C:\Windows\System\UJYPjPQ.exe
  2⤵
  PID:9188
- C:\Windows\System\HdRQmhZ.exe
  C:\Windows\System\HdRQmhZ.exe
  2⤵
  PID:7860
- C:\Windows\System\oNHHUpd.exe
  C:\Windows\System\oNHHUpd.exe
  2⤵
  PID:8216
- C:\Windows\System\YsuseoX.exe
  C:\Windows\System\YsuseoX.exe
  2⤵
  PID:8256
- C:\Windows\System\bvcuUrV.exe
  C:\Windows\System\bvcuUrV.exe
  2⤵
  PID:8328
- C:\Windows\System\apaMoPw.exe
  C:\Windows\System\apaMoPw.exe
  2⤵
  PID:8396
- C:\Windows\System\QaTxAGU.exe
  C:\Windows\System\QaTxAGU.exe
  2⤵
  PID:8480
- C:\Windows\System\blvKyKJ.exe
  C:\Windows\System\blvKyKJ.exe
  2⤵
  PID:8516
- C:\Windows\System\ftrglko.exe
  C:\Windows\System\ftrglko.exe
  2⤵
  PID:8560
- C:\Windows\System\FqqCREC.exe
  C:\Windows\System\FqqCREC.exe
  2⤵
  PID:8632
- C:\Windows\System\HRKbEuS.exe
  C:\Windows\System\HRKbEuS.exe
  2⤵
  PID:8676
- C:\Windows\System\viEjppL.exe
  C:\Windows\System\viEjppL.exe
  2⤵
  PID:8724
- C:\Windows\System\golPLtP.exe
  C:\Windows\System\golPLtP.exe
  2⤵
  PID:8864
- C:\Windows\System\oORAbPW.exe
  C:\Windows\System\oORAbPW.exe
  2⤵
  PID:8908
- C:\Windows\System\cmdjugp.exe
  C:\Windows\System\cmdjugp.exe
  2⤵
  PID:9004
- C:\Windows\System\MXKtYSY.exe
  C:\Windows\System\MXKtYSY.exe
  2⤵
  PID:8980
- C:\Windows\System\tdoepvV.exe
  C:\Windows\System\tdoepvV.exe
  2⤵
  PID:9156
- C:\Windows\System\fNGxghB.exe
  C:\Windows\System\fNGxghB.exe
  2⤵
  PID:9204
- C:\Windows\System\XfZvZgR.exe
  C:\Windows\System\XfZvZgR.exe
  2⤵
  PID:8284
- C:\Windows\System\syHGsrB.exe
  C:\Windows\System\syHGsrB.exe
  2⤵
  PID:8360
- C:\Windows\System\QKjbPKo.exe
  C:\Windows\System\QKjbPKo.exe
  2⤵
  PID:8524
- C:\Windows\System\apqKEbR.exe
  C:\Windows\System\apqKEbR.exe
  2⤵
  PID:8812
- C:\Windows\System\nWTeeNn.exe
  C:\Windows\System\nWTeeNn.exe
  2⤵
  PID:8708
- C:\Windows\System\yoLzLqJ.exe
  C:\Windows\System\yoLzLqJ.exe
  2⤵
  PID:9068
- C:\Windows\System\xbIhXUk.exe
  C:\Windows\System\xbIhXUk.exe
  2⤵
  PID:8960
- C:\Windows\System\kAeLTyH.exe
  C:\Windows\System\kAeLTyH.exe
  2⤵
  PID:8200
- C:\Windows\System\mtmLNQN.exe
  C:\Windows\System\mtmLNQN.exe
  2⤵
  PID:8424
- C:\Windows\System\MyGQwUm.exe
  C:\Windows\System\MyGQwUm.exe
  2⤵
  PID:8644
- C:\Windows\System\WKkcEWK.exe
  C:\Windows\System\WKkcEWK.exe
  2⤵
  PID:9236
- C:\Windows\System\MeCKLsE.exe
  C:\Windows\System\MeCKLsE.exe
  2⤵
  PID:9276
- C:\Windows\System\duigtoZ.exe
  C:\Windows\System\duigtoZ.exe
  2⤵
  PID:9304
- C:\Windows\System\kvhauMw.exe
  C:\Windows\System\kvhauMw.exe
  2⤵
  PID:9328
- C:\Windows\System\gYGzCWs.exe
  C:\Windows\System\gYGzCWs.exe
  2⤵
  PID:9352
- C:\Windows\System\iiSJQkD.exe
  C:\Windows\System\iiSJQkD.exe
  2⤵
  PID:9388
- C:\Windows\System\gmXqNQf.exe
  C:\Windows\System\gmXqNQf.exe
  2⤵
  PID:9420
- C:\Windows\System\IDItsOu.exe
  C:\Windows\System\IDItsOu.exe
  2⤵
  PID:9448
- C:\Windows\System\BmQXMiw.exe
  C:\Windows\System\BmQXMiw.exe
  2⤵
  PID:9488
- C:\Windows\System\XJtpbka.exe
  C:\Windows\System\XJtpbka.exe
  2⤵
  PID:9504
- C:\Windows\System\riGYJTT.exe
  C:\Windows\System\riGYJTT.exe
  2⤵
  PID:9524
- C:\Windows\System\BSSINJg.exe
  C:\Windows\System\BSSINJg.exe
  2⤵
  PID:9548
- C:\Windows\System\fqxNKVE.exe
  C:\Windows\System\fqxNKVE.exe
  2⤵
  PID:9592
- C:\Windows\System\GlJzCeH.exe
  C:\Windows\System\GlJzCeH.exe
  2⤵
  PID:9608
- C:\Windows\System\fubhhnd.exe
  C:\Windows\System\fubhhnd.exe
  2⤵
  PID:9636
- C:\Windows\System\ZRttHNw.exe
  C:\Windows\System\ZRttHNw.exe
  2⤵
  PID:9660
- C:\Windows\System\LakmxVf.exe
  C:\Windows\System\LakmxVf.exe
  2⤵
  PID:9684
- C:\Windows\System\IdSqAWM.exe
  C:\Windows\System\IdSqAWM.exe
  2⤵
  PID:9708
- C:\Windows\System\hQGWPIY.exe
  C:\Windows\System\hQGWPIY.exe
  2⤵
  PID:9736
- C:\Windows\System\DAwzXXj.exe
  C:\Windows\System\DAwzXXj.exe
  2⤵
  PID:9796
- C:\Windows\System\TmJHjFt.exe
  C:\Windows\System\TmJHjFt.exe
  2⤵
  PID:9820
- C:\Windows\System\QybAzRy.exe
  C:\Windows\System\QybAzRy.exe
  2⤵
  PID:9840
- C:\Windows\System\SlinroI.exe
  C:\Windows\System\SlinroI.exe
  2⤵
  PID:9884
- C:\Windows\System\mJAcHKc.exe
  C:\Windows\System\mJAcHKc.exe
  2⤵
  PID:9904
- C:\Windows\System\kqWkbUG.exe
  C:\Windows\System\kqWkbUG.exe
  2⤵
  PID:9920
- C:\Windows\System\sUtKXYY.exe
  C:\Windows\System\sUtKXYY.exe
  2⤵
  PID:9944
- C:\Windows\System\uGUzukk.exe
  C:\Windows\System\uGUzukk.exe
  2⤵
  PID:9964
- C:\Windows\System\zjnXgja.exe
  C:\Windows\System\zjnXgja.exe
  2⤵
  PID:9992
- C:\Windows\System\podhSVj.exe
  C:\Windows\System\podhSVj.exe
  2⤵
  PID:10012
- C:\Windows\System\nhzQJzL.exe
  C:\Windows\System\nhzQJzL.exe
  2⤵
  PID:10060
- C:\Windows\System\fAHfkLL.exe
  C:\Windows\System\fAHfkLL.exe
  2⤵
  PID:10092
- C:\Windows\System\yLxNVCt.exe
  C:\Windows\System\yLxNVCt.exe
  2⤵
  PID:10140
- C:\Windows\System\pOuyYBu.exe
  C:\Windows\System\pOuyYBu.exe
  2⤵
  PID:10188
- C:\Windows\System\jvZjhWZ.exe
  C:\Windows\System\jvZjhWZ.exe
  2⤵
  PID:9256
- C:\Windows\System\YwFRNBu.exe
  C:\Windows\System\YwFRNBu.exe
  2⤵
  PID:9300
- C:\Windows\System\eBaICmm.exe
  C:\Windows\System\eBaICmm.exe
  2⤵
  PID:3376
- C:\Windows\System\JhatCKH.exe
  C:\Windows\System\JhatCKH.exe
  2⤵
  PID:9380
- C:\Windows\System\xuleDln.exe
  C:\Windows\System\xuleDln.exe
  2⤵
  PID:9428
- C:\Windows\System\qTKIFoV.exe
  C:\Windows\System\qTKIFoV.exe
  2⤵
  PID:9440
- C:\Windows\System\JGtPdUq.exe
  C:\Windows\System\JGtPdUq.exe
  2⤵
  PID:9468
- C:\Windows\System\SzJAUGo.exe
  C:\Windows\System\SzJAUGo.exe
  2⤵
  PID:9520
- C:\Windows\System\GyDidku.exe
  C:\Windows\System\GyDidku.exe
  2⤵
  PID:9576
- C:\Windows\System\YnupNZz.exe
  C:\Windows\System\YnupNZz.exe
  2⤵
  PID:9572
- C:\Windows\System\vEtANWQ.exe
  C:\Windows\System\vEtANWQ.exe
  2⤵
  PID:9644
- C:\Windows\System\eNjwPKN.exe
  C:\Windows\System\eNjwPKN.exe
  2⤵
  PID:9672
- C:\Windows\System\qyfLzdt.exe
  C:\Windows\System\qyfLzdt.exe
  2⤵
  PID:9696
- C:\Windows\System\GYfEMTk.exe
  C:\Windows\System\GYfEMTk.exe
  2⤵
  PID:9752
- C:\Windows\System\BEbegpa.exe
  C:\Windows\System\BEbegpa.exe
  2⤵
  PID:2816
- C:\Windows\System\IzqhfBi.exe
  C:\Windows\System\IzqhfBi.exe
  2⤵
  PID:9892
- C:\Windows\System\dHzwfXC.exe
  C:\Windows\System\dHzwfXC.exe
  2⤵
  PID:10048
- C:\Windows\System\bSNygbe.exe
  C:\Windows\System\bSNygbe.exe
  2⤵
  PID:10112
- C:\Windows\System\SeBKCYp.exe
  C:\Windows\System\SeBKCYp.exe
  2⤵
  PID:10108
- C:\Windows\System\iuvYIGC.exe
  C:\Windows\System\iuvYIGC.exe
  2⤵
  PID:9500
- C:\Windows\System\shOFtOr.exe
  C:\Windows\System\shOFtOr.exe
  2⤵
  PID:3832
- C:\Windows\System\QpQFhIB.exe
  C:\Windows\System\QpQFhIB.exe
  2⤵
  PID:9656
- C:\Windows\System\kvzXzbU.exe
  C:\Windows\System\kvzXzbU.exe
  2⤵
  PID:9692
- C:\Windows\System\KqLTytz.exe
  C:\Windows\System\KqLTytz.exe
  2⤵
  PID:3300
- C:\Windows\System\fouXfWa.exe
  C:\Windows\System\fouXfWa.exe
  2⤵
  PID:10228
- C:\Windows\System\PurtLaU.exe
  C:\Windows\System\PurtLaU.exe
  2⤵
  PID:9828
- C:\Windows\System\CdiPHuO.exe
  C:\Windows\System\CdiPHuO.exe
  2⤵
  PID:9292
- C:\Windows\System\eTMpYYZ.exe
  C:\Windows\System\eTMpYYZ.exe
  2⤵
  PID:9960
- C:\Windows\System\nSOigLa.exe
  C:\Windows\System\nSOigLa.exe
  2⤵
  PID:10008
- C:\Windows\System\VdBlNHA.exe
  C:\Windows\System\VdBlNHA.exe
  2⤵
  PID:9464
- C:\Windows\System\asqWvbT.exe
  C:\Windows\System\asqWvbT.exe
  2⤵
  PID:9912
- C:\Windows\System\oivDllT.exe
  C:\Windows\System\oivDllT.exe
  2⤵
  PID:9880
- C:\Windows\System\FhGJIgX.exe
  C:\Windows\System\FhGJIgX.exe
  2⤵
  PID:10072
- C:\Windows\System\FTVARas.exe
  C:\Windows\System\FTVARas.exe
  2⤵
  PID:10220
- C:\Windows\System\PKHGmXt.exe
  C:\Windows\System\PKHGmXt.exe
  2⤵
  PID:468
- C:\Windows\System\XABRTDQ.exe
  C:\Windows\System\XABRTDQ.exe
  2⤵
  PID:9348
- C:\Windows\System\QKNOKsg.exe
  C:\Windows\System\QKNOKsg.exe
  2⤵
  PID:10252
- C:\Windows\System\FHAaeJe.exe
  C:\Windows\System\FHAaeJe.exe
  2⤵
  PID:10276
- C:\Windows\System\IYejEOF.exe
  C:\Windows\System\IYejEOF.exe
  2⤵
  PID:10300
- C:\Windows\System\SiOjkeF.exe
  C:\Windows\System\SiOjkeF.exe
  2⤵
  PID:10328
- C:\Windows\System\IuJPqzR.exe
  C:\Windows\System\IuJPqzR.exe
  2⤵
  PID:10352
- C:\Windows\System\xwuQdon.exe
  C:\Windows\System\xwuQdon.exe
  2⤵
  PID:10392
- C:\Windows\System\RHpRsLd.exe
  C:\Windows\System\RHpRsLd.exe
  2⤵
  PID:10412
- C:\Windows\System\VdXcgmI.exe
  C:\Windows\System\VdXcgmI.exe
  2⤵
  PID:10460
- C:\Windows\System\aSuyvlQ.exe
  C:\Windows\System\aSuyvlQ.exe
  2⤵
  PID:10476
- C:\Windows\System\oxAPbgA.exe
  C:\Windows\System\oxAPbgA.exe
  2⤵
  PID:10516
- C:\Windows\System\dBptAbF.exe
  C:\Windows\System\dBptAbF.exe
  2⤵
  PID:10540
- C:\Windows\System\olwXzQJ.exe
  C:\Windows\System\olwXzQJ.exe
  2⤵
  PID:10560
- C:\Windows\System\wciaYsb.exe
  C:\Windows\System\wciaYsb.exe
  2⤵
  PID:10580
- C:\Windows\System\sYaReAB.exe
  C:\Windows\System\sYaReAB.exe
  2⤵
  PID:10604
- C:\Windows\System\ZnEYnlJ.exe
  C:\Windows\System\ZnEYnlJ.exe
  2⤵
  PID:10632
- C:\Windows\System\VXheoBT.exe
  C:\Windows\System\VXheoBT.exe
  2⤵
  PID:10652
- C:\Windows\System\aYNMlqI.exe
  C:\Windows\System\aYNMlqI.exe
  2⤵
  PID:10676
- C:\Windows\System\GmLAgQL.exe
  C:\Windows\System\GmLAgQL.exe
  2⤵
  PID:10736
- C:\Windows\System\uUTFjqT.exe
  C:\Windows\System\uUTFjqT.exe
  2⤵
  PID:10768
- C:\Windows\System\MTLqaUK.exe
  C:\Windows\System\MTLqaUK.exe
  2⤵
  PID:10784
- C:\Windows\System\HvBPoIC.exe
  C:\Windows\System\HvBPoIC.exe
  2⤵
  PID:10804
- C:\Windows\System\IgJofvP.exe
  C:\Windows\System\IgJofvP.exe
  2⤵
  PID:10820
- C:\Windows\System\LCJOsOy.exe
  C:\Windows\System\LCJOsOy.exe
  2⤵
  PID:10848
- C:\Windows\System\qqfAYkv.exe
  C:\Windows\System\qqfAYkv.exe
  2⤵
  PID:10864
- C:\Windows\System\EDIMpOs.exe
  C:\Windows\System\EDIMpOs.exe
  2⤵
  PID:10924
- C:\Windows\System\bAJmDEP.exe
  C:\Windows\System\bAJmDEP.exe
  2⤵
  PID:10952
- C:\Windows\System\ehOhrfs.exe
  C:\Windows\System\ehOhrfs.exe
  2⤵
  PID:10972
- C:\Windows\System\jpIgnQf.exe
  C:\Windows\System\jpIgnQf.exe
  2⤵
  PID:11008
- C:\Windows\System\ggwcTBS.exe
  C:\Windows\System\ggwcTBS.exe
  2⤵
  PID:11024
- C:\Windows\System\EADxCUO.exe
  C:\Windows\System\EADxCUO.exe
  2⤵
  PID:11044
- C:\Windows\System\zbERoDT.exe
  C:\Windows\System\zbERoDT.exe
  2⤵
  PID:11068
- C:\Windows\System\iJNLOok.exe
  C:\Windows\System\iJNLOok.exe
  2⤵
  PID:11096
- C:\Windows\System\YdWiLls.exe
  C:\Windows\System\YdWiLls.exe
  2⤵
  PID:11128
- C:\Windows\System\uVBgqkK.exe
  C:\Windows\System\uVBgqkK.exe
  2⤵
  PID:11156
- C:\Windows\System\abWoawg.exe
  C:\Windows\System\abWoawg.exe
  2⤵
  PID:11172
- C:\Windows\System\qwjpzsC.exe
  C:\Windows\System\qwjpzsC.exe
  2⤵
  PID:11192
- C:\Windows\System\gWDMijF.exe
  C:\Windows\System\gWDMijF.exe
  2⤵
  PID:11252
- C:\Windows\System\FfPLsMZ.exe
  C:\Windows\System\FfPLsMZ.exe
  2⤵
  PID:10248
- C:\Windows\System\OLCDgQo.exe
  C:\Windows\System\OLCDgQo.exe
  2⤵
  PID:10284
- C:\Windows\System\HavBSOc.exe
  C:\Windows\System\HavBSOc.exe
  2⤵
  PID:10372
- C:\Windows\System\wBOcYuv.exe
  C:\Windows\System\wBOcYuv.exe
  2⤵
  PID:10408
- C:\Windows\System\AXAaFlI.exe
  C:\Windows\System\AXAaFlI.exe
  2⤵
  PID:10452
- C:\Windows\System\PMgzYmJ.exe
  C:\Windows\System\PMgzYmJ.exe
  2⤵
  PID:10576
- C:\Windows\System\BslDiwg.exe
  C:\Windows\System\BslDiwg.exe
  2⤵
  PID:3088
- C:\Windows\System\swxOsUn.exe
  C:\Windows\System\swxOsUn.exe
  2⤵
  PID:1432
- C:\Windows\System\uVkMMbS.exe
  C:\Windows\System\uVkMMbS.exe
  2⤵
  PID:10660
- C:\Windows\System\uawRFIj.exe
  C:\Windows\System\uawRFIj.exe
  2⤵
  PID:10744
- C:\Windows\System\WAOIAvo.exe
  C:\Windows\System\WAOIAvo.exe
  2⤵
  PID:10760
- C:\Windows\System\OOMAMLt.exe
  C:\Windows\System\OOMAMLt.exe
  2⤵
  PID:10836
- C:\Windows\System\TYXcqLv.exe
  C:\Windows\System\TYXcqLv.exe
  2⤵
  PID:10920
- C:\Windows\System\UtArMoQ.exe
  C:\Windows\System\UtArMoQ.exe
  2⤵
  PID:11004
- C:\Windows\System\DVJdQDB.exe
  C:\Windows\System\DVJdQDB.exe
  2⤵
  PID:11020
- C:\Windows\System\DApRzLp.exe
  C:\Windows\System\DApRzLp.exe
  2⤵
  PID:11140
- C:\Windows\System\fFhnznY.exe
  C:\Windows\System\fFhnznY.exe
  2⤵
  PID:11168
- C:\Windows\System\WCyVLYF.exe
  C:\Windows\System\WCyVLYF.exe
  2⤵
  PID:11260
- C:\Windows\System\WskDKyh.exe
  C:\Windows\System\WskDKyh.exe
  2⤵
  PID:11240
- C:\Windows\System\HicwccY.exe
  C:\Windows\System\HicwccY.exe
  2⤵
  PID:10404
- C:\Windows\System\WdOJOZV.exe
  C:\Windows\System\WdOJOZV.exe
  2⤵
  PID:10548
- C:\Windows\System\ELQIVFc.exe
  C:\Windows\System\ELQIVFc.exe
  2⤵
  PID:10624
- C:\Windows\System\WAEFecx.exe
  C:\Windows\System\WAEFecx.exe
  2⤵
  PID:10732
- C:\Windows\System\KMyhuSS.exe
  C:\Windows\System\KMyhuSS.exe
  2⤵
  PID:10892
- C:\Windows\System\NHNzDJn.exe
  C:\Windows\System\NHNzDJn.exe
  2⤵
  PID:11016
- C:\Windows\System\potAeNy.exe
  C:\Windows\System\potAeNy.exe
  2⤵
  PID:9312
- C:\Windows\System\xduHVmG.exe
  C:\Windows\System\xduHVmG.exe
  2⤵
  PID:10644
- C:\Windows\System\PXIqvMl.exe
  C:\Windows\System\PXIqvMl.exe
  2⤵
  PID:9804
- C:\Windows\System\xLlAIAO.exe
  C:\Windows\System\xLlAIAO.exe
  2⤵
  PID:10968
- C:\Windows\System\yrRkXhP.exe
  C:\Windows\System\yrRkXhP.exe
  2⤵
  PID:11276
- C:\Windows\System\cUhJXXB.exe
  C:\Windows\System\cUhJXXB.exe
  2⤵
  PID:11304
- C:\Windows\System\EWxKpTZ.exe
  C:\Windows\System\EWxKpTZ.exe
  2⤵
  PID:11376
- C:\Windows\System\XUgYHxc.exe
  C:\Windows\System\XUgYHxc.exe
  2⤵
  PID:11396
- C:\Windows\System\DsZLwMk.exe
  C:\Windows\System\DsZLwMk.exe
  2⤵
  PID:11412
- C:\Windows\System\NsggXtS.exe
  C:\Windows\System\NsggXtS.exe
  2⤵
  PID:11428
- C:\Windows\System\yaZQYos.exe
  C:\Windows\System\yaZQYos.exe
  2⤵
  PID:11448
- C:\Windows\System\TlUhWwo.exe
  C:\Windows\System\TlUhWwo.exe
  2⤵
  PID:11468
- C:\Windows\System\ROXwImy.exe
  C:\Windows\System\ROXwImy.exe
  2⤵
  PID:11488
- C:\Windows\System\FBZYbdM.exe
  C:\Windows\System\FBZYbdM.exe
  2⤵
  PID:11512
- C:\Windows\System\TAeCRpn.exe
  C:\Windows\System\TAeCRpn.exe
  2⤵
  PID:11596
- C:\Windows\System\sOrPzXI.exe
  C:\Windows\System\sOrPzXI.exe
  2⤵
  PID:11616
- C:\Windows\System\fbnzIuo.exe
  C:\Windows\System\fbnzIuo.exe
  2⤵
  PID:11664
- C:\Windows\System\ScTqeYG.exe
  C:\Windows\System\ScTqeYG.exe
  2⤵
  PID:11684
- C:\Windows\System\tNlziXK.exe
  C:\Windows\System\tNlziXK.exe
  2⤵
  PID:11724
- C:\Windows\System\NGcuQGQ.exe
  C:\Windows\System\NGcuQGQ.exe
  2⤵
  PID:11748
- C:\Windows\System\PCSZRrv.exe
  C:\Windows\System\PCSZRrv.exe
  2⤵
  PID:11764
- C:\Windows\System\UvWSPRK.exe
  C:\Windows\System\UvWSPRK.exe
  2⤵
  PID:11792
- C:\Windows\System\IzYVyay.exe
  C:\Windows\System\IzYVyay.exe
  2⤵
  PID:11816
- C:\Windows\System\jvkjqmx.exe
  C:\Windows\System\jvkjqmx.exe
  2⤵
  PID:11836
- C:\Windows\System\CNWrdkg.exe
  C:\Windows\System\CNWrdkg.exe
  2⤵
  PID:11864
- C:\Windows\System\xhocGaJ.exe
  C:\Windows\System\xhocGaJ.exe
  2⤵
  PID:11884
- C:\Windows\System\TEXAAZg.exe
  C:\Windows\System\TEXAAZg.exe
  2⤵
  PID:11924
- C:\Windows\System\CMSmOrR.exe
  C:\Windows\System\CMSmOrR.exe
  2⤵
  PID:11976
- C:\Windows\System\HShAAbP.exe
  C:\Windows\System\HShAAbP.exe
  2⤵
  PID:12004
- C:\Windows\System\NiwGFbo.exe
  C:\Windows\System\NiwGFbo.exe
  2⤵
  PID:12028
- C:\Windows\System\nFBLRex.exe
  C:\Windows\System\nFBLRex.exe
  2⤵
  PID:12056
- C:\Windows\System\wzbbdSg.exe
  C:\Windows\System\wzbbdSg.exe
  2⤵
  PID:12084
- C:\Windows\System\iyarUZi.exe
  C:\Windows\System\iyarUZi.exe
  2⤵
  PID:12112
- C:\Windows\System\kmumiUi.exe
  C:\Windows\System\kmumiUi.exe
  2⤵
  PID:12140
- C:\Windows\System\TSoGRVF.exe
  C:\Windows\System\TSoGRVF.exe
  2⤵
  PID:12168
- C:\Windows\System\mEcwYqa.exe
  C:\Windows\System\mEcwYqa.exe
  2⤵
  PID:12196
- C:\Windows\System\wFMxOLS.exe
  C:\Windows\System\wFMxOLS.exe
  2⤵
  PID:12240
- C:\Windows\System\WnfxdLg.exe
  C:\Windows\System\WnfxdLg.exe
  2⤵
  PID:12256
- C:\Windows\System\lrDsAxa.exe
  C:\Windows\System\lrDsAxa.exe
  2⤵
  PID:12276
- C:\Windows\System\ykdFyeL.exe
  C:\Windows\System\ykdFyeL.exe
  2⤵
  PID:11184
- C:\Windows\System\zCnkAYy.exe
  C:\Windows\System\zCnkAYy.exe
  2⤵
  PID:11268
- C:\Windows\System\jPGYVEh.exe
  C:\Windows\System\jPGYVEh.exe
  2⤵
  PID:11368
- C:\Windows\System\DhynTbm.exe
  C:\Windows\System\DhynTbm.exe
  2⤵
  PID:1132
- C:\Windows\System\EawRvVl.exe
  C:\Windows\System\EawRvVl.exe
  2⤵
  PID:11464
- C:\Windows\System\uaGYkPQ.exe
  C:\Windows\System\uaGYkPQ.exe
  2⤵
  PID:11556
- C:\Windows\System\HcJrDxn.exe
  C:\Windows\System\HcJrDxn.exe
  2⤵
  PID:11536
- C:\Windows\System\ieaFJDy.exe
  C:\Windows\System\ieaFJDy.exe
  2⤵
  PID:11640
- C:\Windows\System\majxTCx.exe
  C:\Windows\System\majxTCx.exe
  2⤵
  PID:11680
- C:\Windows\System\EKXkYhb.exe
  C:\Windows\System\EKXkYhb.exe
  2⤵
  PID:11760
- C:\Windows\System\dNNMQrQ.exe
  C:\Windows\System\dNNMQrQ.exe
  2⤵
  PID:11832
- C:\Windows\System\FVHXiwT.exe
  C:\Windows\System\FVHXiwT.exe
  2⤵
  PID:11876
- C:\Windows\System\FaupTwX.exe
  C:\Windows\System\FaupTwX.exe
  2⤵
  PID:12016
- C:\Windows\System\hyTCnxj.exe
  C:\Windows\System\hyTCnxj.exe
  2⤵
  PID:12048
- C:\Windows\System\KKxzcuH.exe
  C:\Windows\System\KKxzcuH.exe
  2⤵
  PID:12160
- C:\Windows\System\iTMEvyp.exe
  C:\Windows\System\iTMEvyp.exe
  2⤵
  PID:12188
- C:\Windows\System\NSJUawU.exe
  C:\Windows\System\NSJUawU.exe
  2⤵
  PID:12228
- C:\Windows\System\MLRQINK.exe
  C:\Windows\System\MLRQINK.exe
  2⤵
  PID:11228
- C:\Windows\System\dxztNPp.exe
  C:\Windows\System\dxztNPp.exe
  2⤵
  PID:11436
- C:\Windows\System\LckdilH.exe
  C:\Windows\System\LckdilH.exe
  2⤵
  PID:11388
- C:\Windows\System\OBYtUNw.exe
  C:\Windows\System\OBYtUNw.exe
  2⤵
  PID:11528
- C:\Windows\System\LNYohJY.exe
  C:\Windows\System\LNYohJY.exe
  2⤵
  PID:11824
- C:\Windows\System\VoKaFTS.exe
  C:\Windows\System\VoKaFTS.exe
  2⤵
  PID:11740
- C:\Windows\System\gvRGIiM.exe
  C:\Windows\System\gvRGIiM.exe
  2⤵
  PID:11180
- C:\Windows\System\OoPdDYi.exe
  C:\Windows\System\OoPdDYi.exe
  2⤵
  PID:12124
- C:\Windows\System\NbnDkUW.exe
  C:\Windows\System\NbnDkUW.exe
  2⤵
  PID:12272
- C:\Windows\System\JtsjcDt.exe
  C:\Windows\System\JtsjcDt.exe
  2⤵
  PID:11300
- C:\Windows\System\jbepDIC.exe
  C:\Windows\System\jbepDIC.exe
  2⤵
  PID:11784
- C:\Windows\System\YMSzOGh.exe
  C:\Windows\System\YMSzOGh.exe
  2⤵
  PID:12284
- C:\Windows\System\oROAIxJ.exe
  C:\Windows\System\oROAIxJ.exe
  2⤵
  PID:4368
- C:\Windows\System\jxenIsF.exe
  C:\Windows\System\jxenIsF.exe
  2⤵
  PID:11480
- C:\Windows\System\ejxruVn.exe
  C:\Windows\System\ejxruVn.exe
  2⤵
  PID:12320
- C:\Windows\System\HPHsQln.exe
  C:\Windows\System\HPHsQln.exe
  2⤵
  PID:12344
- C:\Windows\System\EpfmcPp.exe
  C:\Windows\System\EpfmcPp.exe
  2⤵
  PID:12368
- C:\Windows\System\Qflpvit.exe
  C:\Windows\System\Qflpvit.exe
  2⤵
  PID:12424
- C:\Windows\System\ynaNiLw.exe
  C:\Windows\System\ynaNiLw.exe
  2⤵
  PID:12440
- C:\Windows\System\UoZJSNa.exe
  C:\Windows\System\UoZJSNa.exe
  2⤵
  PID:12464
- C:\Windows\System\bJqTvhW.exe
  C:\Windows\System\bJqTvhW.exe
  2⤵
  PID:12492
- C:\Windows\System\zckwSVa.exe
  C:\Windows\System\zckwSVa.exe
  2⤵
  PID:12516
- C:\Windows\System\kzWLLDd.exe
  C:\Windows\System\kzWLLDd.exe
  2⤵
  PID:12540
- C:\Windows\System\oydvQTQ.exe
  C:\Windows\System\oydvQTQ.exe
  2⤵
  PID:12572
- C:\Windows\System\fmBztdR.exe
  C:\Windows\System\fmBztdR.exe
  2⤵
  PID:12588
- C:\Windows\System\WeSHJJW.exe
  C:\Windows\System\WeSHJJW.exe
  2⤵
  PID:12604
- C:\Windows\System\DHbltdr.exe
  C:\Windows\System\DHbltdr.exe
  2⤵
  PID:12644
- C:\Windows\System\qjxZeeH.exe
  C:\Windows\System\qjxZeeH.exe
  2⤵
  PID:12672
- C:\Windows\System\oGIUaAy.exe
  C:\Windows\System\oGIUaAy.exe
  2⤵
  PID:12704
- C:\Windows\System\VpaeHmS.exe
  C:\Windows\System\VpaeHmS.exe
  2⤵
  PID:12732
- C:\Windows\System\kOGlZOr.exe
  C:\Windows\System\kOGlZOr.exe
  2⤵
  PID:12760
- C:\Windows\System\PBtKUBb.exe
  C:\Windows\System\PBtKUBb.exe
  2⤵
  PID:12780
- C:\Windows\System\SNEWhnc.exe
  C:\Windows\System\SNEWhnc.exe
  2⤵
  PID:12988
- C:\Windows\System\vxDFxSy.exe
  C:\Windows\System\vxDFxSy.exe
  2⤵
  PID:13044
- C:\Windows\System\HjKQHvs.exe
  C:\Windows\System\HjKQHvs.exe
  2⤵
  PID:13068
- C:\Windows\System\WlTRLtg.exe
  C:\Windows\System\WlTRLtg.exe
  2⤵
  PID:13088
- C:\Windows\System\VssvPpX.exe
  C:\Windows\System\VssvPpX.exe
  2⤵
  PID:13228
- C:\Windows\System\wpnKYek.exe
  C:\Windows\System\wpnKYek.exe
  2⤵
  PID:12888
- C:\Windows\System\rGdkEPP.exe
  C:\Windows\System\rGdkEPP.exe
  2⤵
  PID:13020
- C:\Windows\System\bSZEksn.exe
  C:\Windows\System\bSZEksn.exe
  2⤵
  PID:13060
- C:\Windows\System\xCfLlYc.exe
  C:\Windows\System\xCfLlYc.exe
  2⤵
  PID:12996
- C:\Windows\System\dHidCan.exe
  C:\Windows\System\dHidCan.exe
  2⤵
  PID:13052
- C:\Windows\System\qKcJWZU.exe
  C:\Windows\System\qKcJWZU.exe
  2⤵
  PID:13200
- C:\Windows\System\MoHHDCW.exe
  C:\Windows\System\MoHHDCW.exe
  2⤵
  PID:13284
- C:\Windows\System\sSfFdLg.exe
  C:\Windows\System\sSfFdLg.exe
  2⤵
  PID:13300
- C:\Windows\System\fxhHKQq.exe
  C:\Windows\System\fxhHKQq.exe
  2⤵
  PID:13304
- C:\Windows\System\KUxbUVI.exe
  C:\Windows\System\KUxbUVI.exe
  2⤵
  PID:13136
- C:\Windows\System\yGcARKf.exe
  C:\Windows\System\yGcARKf.exe
  2⤵
  PID:13196
- C:\Windows\System\vhcygGg.exe
  C:\Windows\System\vhcygGg.exe
  2⤵
  PID:13168
- C:\Windows\System\CIYIiyV.exe
  C:\Windows\System\CIYIiyV.exe
  2⤵
  PID:13256
- C:\Windows\System\LLdSvBK.exe
  C:\Windows\System\LLdSvBK.exe
  2⤵
  PID:12336
- C:\Windows\System\wFQLvIX.exe
  C:\Windows\System\wFQLvIX.exe
  2⤵
  PID:12452
- C:\Windows\System\DTFizss.exe
  C:\Windows\System\DTFizss.exe
  2⤵
  PID:12508
- C:\Windows\System\xPvpcsH.exe
  C:\Windows\System\xPvpcsH.exe
  2⤵
  PID:12560
- C:\Windows\System\rDzqstZ.exe
  C:\Windows\System\rDzqstZ.exe
  2⤵
  PID:12640
- C:\Windows\System\CzydKje.exe
  C:\Windows\System\CzydKje.exe
  2⤵
  PID:13148
- C:\Windows\System\bvLTiLK.exe
  C:\Windows\System\bvLTiLK.exe
  2⤵
  PID:2608
- C:\Windows\System\GnEqOYu.exe
  C:\Windows\System\GnEqOYu.exe
  2⤵
  PID:12868
- C:\Windows\System\WxpziFl.exe
  C:\Windows\System\WxpziFl.exe
  2⤵
  PID:12936
- C:\Windows\System\UzOBZsA.exe
  C:\Windows\System\UzOBZsA.exe
  2⤵
  PID:12944
- C:\Windows\System\LrTxNpd.exe
  C:\Windows\System\LrTxNpd.exe
  2⤵
  PID:13016
- C:\Windows\System\GbwkJmj.exe
  C:\Windows\System\GbwkJmj.exe
  2⤵
  PID:372
- C:\Windows\System\AwWWZlt.exe
  C:\Windows\System\AwWWZlt.exe
  2⤵
  PID:1120
- C:\Windows\System\pNQeMsV.exe
  C:\Windows\System\pNQeMsV.exe
  2⤵
  PID:12932
- C:\Windows\System\kvLveQh.exe
  C:\Windows\System\kvLveQh.exe
  2⤵
  PID:12532
- C:\Windows\System\NEoUYJN.exe
  C:\Windows\System\NEoUYJN.exe
  2⤵
  PID:12948
- C:\Windows\System\HlAnuYt.exe
  C:\Windows\System\HlAnuYt.exe
  2⤵
  PID:12840
- C:\Windows\System\OqoZMha.exe
  C:\Windows\System\OqoZMha.exe
  2⤵
  PID:12824
- C:\Windows\System\HepfnHL.exe
  C:\Windows\System\HepfnHL.exe
  2⤵
  PID:12864
- C:\Windows\System\wyJyCnR.exe
  C:\Windows\System\wyJyCnR.exe
  2⤵
  PID:2468
- C:\Windows\System\LcbQSue.exe
  C:\Windows\System\LcbQSue.exe
  2⤵
  PID:5432
- C:\Windows\System\ruOLvuJ.exe
  C:\Windows\System\ruOLvuJ.exe
  2⤵
  PID:2344
- C:\Windows\System\GrJBtjH.exe
  C:\Windows\System\GrJBtjH.exe
  2⤵
  PID:12316
- C:\Windows\System\UvanxlG.exe
  C:\Windows\System\UvanxlG.exe
  2⤵
  PID:4976
- C:\Windows\System\dpMilNi.exe
  C:\Windows\System\dpMilNi.exe
  2⤵
  PID:12624
- C:\Windows\System\zaldzWp.exe
  C:\Windows\System\zaldzWp.exe
  2⤵
  PID:12384
- C:\Windows\System\hTClPKV.exe
  C:\Windows\System\hTClPKV.exe
  2⤵
  PID:12728
- C:\Windows\System\kFHMyrp.exe
  C:\Windows\System\kFHMyrp.exe
  2⤵
  PID:60
- C:\Windows\System\kXqFGYw.exe
  C:\Windows\System\kXqFGYw.exe
  2⤵
  PID:12872
- C:\Windows\System\GDgVJtj.exe
  C:\Windows\System\GDgVJtj.exe
  2⤵
  PID:3040
- C:\Windows\System\sJgXKuF.exe
  C:\Windows\System\sJgXKuF.exe
  2⤵
  PID:592
- C:\Windows\System\OjEwSPu.exe
  C:\Windows\System\OjEwSPu.exe
  2⤵
  PID:1192
- C:\Windows\System\tmtGQUy.exe
  C:\Windows\System\tmtGQUy.exe
  2⤵
  PID:3988
- C:\Windows\System\UDFMVjR.exe
  C:\Windows\System\UDFMVjR.exe
  2⤵
  PID:232
- C:\Windows\System\xsijmEs.exe
  C:\Windows\System\xsijmEs.exe
  2⤵
  PID:4208
- C:\Windows\System\VcDqnXu.exe
  C:\Windows\System\VcDqnXu.exe
  2⤵
  PID:2200
- C:\Windows\System\BflYePu.exe
  C:\Windows\System\BflYePu.exe
  2⤵
  PID:1452
- C:\Windows\System\MwJgqkz.exe
  C:\Windows\System\MwJgqkz.exe
  2⤵
  PID:6952
- C:\Windows\System\JjxdWKt.exe
  C:\Windows\System\JjxdWKt.exe
  2⤵
  PID:1816
- C:\Windows\System\LiSkjvA.exe
  C:\Windows\System\LiSkjvA.exe
  2⤵
  PID:12744
- C:\Windows\System\NzVSODl.exe
  C:\Windows\System\NzVSODl.exe
  2⤵
  PID:1520
- C:\Windows\System\LMYSViH.exe
  C:\Windows\System\LMYSViH.exe
  2⤵
  PID:916
- C:\Windows\System\UhpeLMS.exe
  C:\Windows\System\UhpeLMS.exe
  2⤵
  PID:7468
- C:\Windows\System\qgiWith.exe
  C:\Windows\System\qgiWith.exe
  2⤵
  PID:6412
- C:\Windows\System\YNkRjlC.exe
  C:\Windows\System\YNkRjlC.exe
  2⤵
  PID:5072
- C:\Windows\System\oIWkhxw.exe
  C:\Windows\System\oIWkhxw.exe
  2⤵
  PID:7752
- C:\Windows\System\WDdVDtb.exe
  C:\Windows\System\WDdVDtb.exe
  2⤵
  PID:4012
- C:\Windows\System\kuEIWlb.exe
  C:\Windows\System\kuEIWlb.exe
  2⤵
  PID:12856
- C:\Windows\System\NHPeBcQ.exe
  C:\Windows\System\NHPeBcQ.exe
  2⤵
  PID:1232
- C:\Windows\System\vGHJeZN.exe
  C:\Windows\System\vGHJeZN.exe
  2⤵
  PID:832
- C:\Windows\System\xOHxqEI.exe
  C:\Windows\System\xOHxqEI.exe
  2⤵
  PID:2928
- C:\Windows\System\tmaXhPC.exe
  C:\Windows\System\tmaXhPC.exe
  2⤵
  PID:3664
- C:\Windows\System\OJMvISW.exe
  C:\Windows\System\OJMvISW.exe
  2⤵
  PID:7296
- C:\Windows\System\yrZyWsX.exe
  C:\Windows\System\yrZyWsX.exe
  2⤵
  PID:12916
- C:\Windows\System\depDejF.exe
  C:\Windows\System\depDejF.exe
  2⤵
  PID:7424
- C:\Windows\System\CRErYpK.exe
  C:\Windows\System\CRErYpK.exe
  2⤵
  PID:4888
- C:\Windows\System\fQPZiIp.exe
  C:\Windows\System\fQPZiIp.exe
  2⤵
  PID:2684
- C:\Windows\System\SFKudBc.exe
  C:\Windows\System\SFKudBc.exe
  2⤵
  PID:1768
- C:\Windows\System\bVGVfek.exe
  C:\Windows\System\bVGVfek.exe
  2⤵
  PID:7892
- C:\Windows\System\TfKivoU.exe
  C:\Windows\System\TfKivoU.exe
  2⤵
  PID:7028
- C:\Windows\System\AqStEso.exe
  C:\Windows\System\AqStEso.exe
  2⤵
  PID:2188
- C:\Windows\System\VNGuiIA.exe
  C:\Windows\System\VNGuiIA.exe
  2⤵
  PID:4404
- C:\Windows\System\FFClqVI.exe
  C:\Windows\System\FFClqVI.exe
  2⤵
  PID:7180
- C:\Windows\System\JBBITjj.exe
  C:\Windows\System\JBBITjj.exe
  2⤵
  PID:7428
- C:\Windows\System\UCxZBhe.exe
  C:\Windows\System\UCxZBhe.exe
  2⤵
  PID:3592
- C:\Windows\System\hzpzZzS.exe
  C:\Windows\System\hzpzZzS.exe
  2⤵
  PID:7980
- C:\Windows\System\lqGcGyA.exe
  C:\Windows\System\lqGcGyA.exe
  2⤵
  PID:7496
- C:\Windows\System\SoxJBMO.exe
  C:\Windows\System\SoxJBMO.exe
  2⤵
  PID:2012
- C:\Windows\System\kZxJLLv.exe
  C:\Windows\System\kZxJLLv.exe
  2⤵
  PID:2380
- C:\Windows\System\XslJeEq.exe
  C:\Windows\System\XslJeEq.exe
  2⤵
  PID:8104
- C:\Windows\System\zslFfrd.exe
  C:\Windows\System\zslFfrd.exe
  2⤵
  PID:8308
- C:\Windows\System\RyvKIvx.exe
  C:\Windows\System\RyvKIvx.exe
  2⤵
  PID:8412
- C:\Windows\System\IOyBjFs.exe
  C:\Windows\System\IOyBjFs.exe
  2⤵
  PID:8580
- C:\Windows\System\npzfwDp.exe
  C:\Windows\System\npzfwDp.exe
  2⤵
  PID:7212
- C:\Windows\System\tuZnEWN.exe
  C:\Windows\System\tuZnEWN.exe
  2⤵
  PID:7216
- C:\Windows\System\xSGYuRN.exe
  C:\Windows\System\xSGYuRN.exe
  2⤵
  PID:4728
- C:\Windows\System\SRCMCDz.exe
  C:\Windows\System\SRCMCDz.exe
  2⤵
  PID:5124
- C:\Windows\System\SxfwZaN.exe
  C:\Windows\System\SxfwZaN.exe
  2⤵
  PID:3724
- C:\Windows\System\wyUnvgt.exe
  C:\Windows\System\wyUnvgt.exe
  2⤵
  PID:8232
- C:\Windows\System\wndEKVO.exe
  C:\Windows\System\wndEKVO.exe
  2⤵
  PID:2068
- C:\Windows\System\SvIXuwD.exe
  C:\Windows\System\SvIXuwD.exe
  2⤵
  PID:1260
- C:\Windows\System\BLIhUvf.exe
  C:\Windows\System\BLIhUvf.exe
  2⤵
  PID:13112
- C:\Windows\System\AiTHlJz.exe
  C:\Windows\System\AiTHlJz.exe
  2⤵
  PID:12712
- C:\Windows\System\nAGsYUE.exe
  C:\Windows\System\nAGsYUE.exe
  2⤵
  PID:12972
- C:\Windows\System\FTmXOCX.exe
  C:\Windows\System\FTmXOCX.exe
  2⤵
  PID:8112
- C:\Windows\System\qjQrOeO.exe
  C:\Windows\System\qjQrOeO.exe
  2⤵
  PID:1040
- C:\Windows\System\vhxcFvv.exe
  C:\Windows\System\vhxcFvv.exe
  2⤵
  PID:5600
- C:\Windows\System\MQvONrD.exe
  C:\Windows\System\MQvONrD.exe
  2⤵
  PID:8856
- C:\Windows\System\kQFTRUx.exe
  C:\Windows\System\kQFTRUx.exe
  2⤵
  PID:3692
- C:\Windows\System\aYGxgkq.exe
  C:\Windows\System\aYGxgkq.exe
  2⤵
  PID:3420
- C:\Windows\System\UbnRcCW.exe
  C:\Windows\System\UbnRcCW.exe
  2⤵
  PID:8196
- C:\Windows\System\sidrwAA.exe
  C:\Windows\System\sidrwAA.exe
  2⤵
  PID:8276
- C:\Windows\System\SwQNtkw.exe
  C:\Windows\System\SwQNtkw.exe
  2⤵
  PID:5596
- C:\Windows\System\ySxrrXj.exe
  C:\Windows\System\ySxrrXj.exe
  2⤵
  PID:8688
- C:\Windows\System\TOlsPHM.exe
  C:\Windows\System\TOlsPHM.exe
  2⤵
  PID:5628
- C:\Windows\System\EIiWdpZ.exe
  C:\Windows\System\EIiWdpZ.exe
  2⤵
  PID:5684
- C:\Windows\System\LcWUtkJ.exe
  C:\Windows\System\LcWUtkJ.exe
  2⤵
  PID:9128
- C:\Windows\System\mxYiPGo.exe
  C:\Windows\System\mxYiPGo.exe
  2⤵
  PID:9200
- C:\Windows\System\kHznvNU.exe
  C:\Windows\System\kHznvNU.exe
  2⤵
  PID:7148
- C:\Windows\System\JCcKIxL.exe
  C:\Windows\System\JCcKIxL.exe
  2⤵
  PID:8544
- C:\Windows\System\zmbkCgj.exe
  C:\Windows\System\zmbkCgj.exe
  2⤵
  PID:7664
- C:\Windows\System\Gkbvgeu.exe
  C:\Windows\System\Gkbvgeu.exe
  2⤵
  PID:5896
- C:\Windows\System\fQuOLzV.exe
  C:\Windows\System\fQuOLzV.exe
  2⤵
  PID:5308
- C:\Windows\System\uTxjiAy.exe
  C:\Windows\System\uTxjiAy.exe
  2⤵
  PID:5924
- C:\Windows\System\OpqxJvX.exe
  C:\Windows\System\OpqxJvX.exe
  2⤵
  PID:5804
- C:\Windows\System\KoNGTEO.exe
  C:\Windows\System\KoNGTEO.exe
  2⤵
  PID:6392
- C:\Windows\System\shkyRSG.exe
  C:\Windows\System\shkyRSG.exe
  2⤵
  PID:10572
- C:\Windows\System\lTrgmfg.exe
  C:\Windows\System\lTrgmfg.exe
  2⤵
  PID:5516
- C:\Windows\System\zQhjXZA.exe
  C:\Windows\System\zQhjXZA.exe
  2⤵
  PID:10752
- C:\Windows\System\XahkOPJ.exe
  C:\Windows\System\XahkOPJ.exe
  2⤵
  PID:1712
- C:\Windows\System\iewuGaM.exe
  C:\Windows\System\iewuGaM.exe
  2⤵
  PID:5300
- C:\Windows\System\aeMXiCh.exe
  C:\Windows\System\aeMXiCh.exe
  2⤵
  PID:9408
- C:\Windows\System\uSwbGMF.exe
  C:\Windows\System\uSwbGMF.exe
  2⤵
  PID:1748
- C:\Windows\System\bKmzRUb.exe
  C:\Windows\System\bKmzRUb.exe
  2⤵
  PID:10932
- C:\Windows\System\GkoMfrr.exe
  C:\Windows\System\GkoMfrr.exe
  2⤵
  PID:8852
- C:\Windows\System\FgWbnhw.exe
  C:\Windows\System\FgWbnhw.exe
  2⤵
  PID:9728
- C:\Windows\System\cppkcRK.exe
  C:\Windows\System\cppkcRK.exe
  2⤵
  PID:2796
- C:\Windows\System\haxsXgK.exe
  C:\Windows\System\haxsXgK.exe
  2⤵
  PID:6156
- C:\Windows\System\RledeyH.exe
  C:\Windows\System\RledeyH.exe
  2⤵
  PID:6200
- C:\Windows\System\JlFqepB.exe
  C:\Windows\System\JlFqepB.exe
  2⤵
  PID:2772
- C:\Windows\System\fpqISJT.exe
  C:\Windows\System\fpqISJT.exe
  2⤵
  PID:5768
- C:\Windows\System\ibhOzPX.exe
  C:\Windows\System\ibhOzPX.exe
  2⤵
  PID:6268
- C:\Windows\System\XLVSlwz.exe
  C:\Windows\System\XLVSlwz.exe
  2⤵
  PID:6340
- C:\Windows\System\SZEmUzE.exe
  C:\Windows\System\SZEmUzE.exe
  2⤵
  PID:6396
- C:\Windows\System\EMRFvvw.exe
  C:\Windows\System\EMRFvvw.exe
  2⤵
  PID:4396
- C:\Windows\System\ZABLNvj.exe
  C:\Windows\System\ZABLNvj.exe
  2⤵
  PID:5936
- C:\Windows\System\UhkjlFp.exe
  C:\Windows\System\UhkjlFp.exe
  2⤵
  PID:10536
- C:\Windows\System\wGVumhX.exe
  C:\Windows\System\wGVumhX.exe
  2⤵
  PID:6104
- C:\Windows\System\DRjlIwc.exe
  C:\Windows\System\DRjlIwc.exe
  2⤵
  PID:3148
- C:\Windows\System\dbgMrlq.exe
  C:\Windows\System\dbgMrlq.exe
  2⤵
  PID:4684
- C:\Windows\System\NayPEWT.exe
  C:\Windows\System\NayPEWT.exe
  2⤵
  PID:5860
- C:\Windows\System\vPSohxq.exe
  C:\Windows\System\vPSohxq.exe
  2⤵
  PID:5168
- C:\Windows\System\ojRfhlA.exe
  C:\Windows\System\ojRfhlA.exe
  2⤵
  PID:9704
- C:\Windows\System\TYqzLxT.exe
  C:\Windows\System\TYqzLxT.exe
  2⤵
  PID:5712
- C:\Windows\System\GtSYJJY.exe
  C:\Windows\System\GtSYJJY.exe
  2⤵
  PID:5332
- C:\Windows\System\bgnGcLU.exe
  C:\Windows\System\bgnGcLU.exe
  2⤵
  PID:9152
- C:\Windows\System\ysnKSKZ.exe
  C:\Windows\System\ysnKSKZ.exe
  2⤵
  PID:7152
- C:\Windows\System\PneAbsd.exe
  C:\Windows\System\PneAbsd.exe
  2⤵
  PID:3304
- C:\Windows\System\PrUpRCG.exe
  C:\Windows\System\PrUpRCG.exe
  2⤵
  PID:332
- C:\Windows\System\ZptzRTv.exe
  C:\Windows\System\ZptzRTv.exe
  2⤵
  PID:3324
- C:\Windows\System\huRkQQO.exe
  C:\Windows\System\huRkQQO.exe
  2⤵
  PID:6188
- C:\Windows\System\mAJEEdt.exe
  C:\Windows\System\mAJEEdt.exe
  2⤵
  PID:12796
- C:\Windows\System\dArZyDY.exe
  C:\Windows\System\dArZyDY.exe
  2⤵
  PID:5824
- C:\Windows\System\QZdFyGQ.exe
  C:\Windows\System\QZdFyGQ.exe
  2⤵
  PID:6420
- C:\Windows\System\swKnvsP.exe
  C:\Windows\System\swKnvsP.exe
  2⤵
  PID:6472
- C:\Windows\System\BiimxcB.exe
  C:\Windows\System\BiimxcB.exe
  2⤵
  PID:6528
- C:\Windows\System\fsGUBhM.exe
  C:\Windows\System\fsGUBhM.exe
  2⤵
  PID:6520
- C:\Windows\System\YigIuHc.exe
  C:\Windows\System\YigIuHc.exe
  2⤵
  PID:8420
- C:\Windows\System\HSjwWoT.exe
  C:\Windows\System\HSjwWoT.exe
  2⤵
  PID:11660
- C:\Windows\System\qTPvFBP.exe
  C:\Windows\System\qTPvFBP.exe
  2⤵
  PID:6720
- C:\Windows\System\xHBwyKA.exe
  C:\Windows\System\xHBwyKA.exe
  2⤵
  PID:6836
- C:\Windows\System\ccCofIn.exe
  C:\Windows\System\ccCofIn.exe
  2⤵
  PID:6048
- C:\Windows\System\IfPYqXj.exe
  C:\Windows\System\IfPYqXj.exe
  2⤵
  PID:6716
- C:\Windows\System\smpqEFt.exe
  C:\Windows\System\smpqEFt.exe
  2⤵
  PID:6828
- C:\Windows\System\OyxWppK.exe
  C:\Windows\System\OyxWppK.exe
  2⤵
  PID:6928
- C:\Windows\System\lnOnZkm.exe
  C:\Windows\System\lnOnZkm.exe
  2⤵
  PID:6760
- C:\Windows\System\sFoPZJk.exe
  C:\Windows\System\sFoPZJk.exe
  2⤵
  PID:3228
- C:\Windows\System\bnyPhtS.exe
  C:\Windows\System\bnyPhtS.exe
  2⤵
  PID:6076
- C:\Windows\System\JESPwsW.exe
  C:\Windows\System\JESPwsW.exe
  2⤵
  PID:11844
- C:\Windows\System\PRmxNBP.exe
  C:\Windows\System\PRmxNBP.exe
  2⤵
  PID:5436
- C:\Windows\System\goEZaKN.exe
  C:\Windows\System\goEZaKN.exe
  2⤵
  PID:8872
- C:\Windows\System\OZlWess.exe
  C:\Windows\System\OZlWess.exe
  2⤵
  PID:4448
- C:\Windows\System\NZIGVgK.exe
  C:\Windows\System\NZIGVgK.exe
  2⤵
  PID:7024
- C:\Windows\System\SanUpSo.exe
  C:\Windows\System\SanUpSo.exe
  2⤵
  PID:5968
- C:\Windows\System\BTWgVKM.exe
  C:\Windows\System\BTWgVKM.exe
  2⤵
  PID:9196
- C:\Windows\System\Jyrjtbr.exe
  C:\Windows\System\Jyrjtbr.exe
  2⤵
  PID:5780
- C:\Windows\System\deJzGUi.exe
  C:\Windows\System\deJzGUi.exe
  2⤵
  PID:6360
- C:\Windows\System\SLelGIj.exe
  C:\Windows\System\SLelGIj.exe
  2⤵
  PID:5320
- C:\Windows\System\fgOMJOu.exe
  C:\Windows\System\fgOMJOu.exe
  2⤵
  PID:2792
- C:\Windows\System\HHyDHGT.exe
  C:\Windows\System\HHyDHGT.exe
  2⤵
  PID:2812
- C:\Windows\System\tiRsUxO.exe
  C:\Windows\System\tiRsUxO.exe
  2⤵
  PID:6480
- C:\Windows\System\veGKowz.exe
  C:\Windows\System\veGKowz.exe
  2⤵
  PID:12220
- C:\Windows\System\mFUMZfv.exe
  C:\Windows\System\mFUMZfv.exe
  2⤵
  PID:7236
- C:\Windows\System\XGinvPJ.exe
  C:\Windows\System\XGinvPJ.exe
  2⤵
  PID:7316
- C:\Windows\System\cWetzQc.exe
  C:\Windows\System\cWetzQc.exe
  2⤵
  PID:5940
- C:\Windows\System\mWlBBKL.exe
  C:\Windows\System\mWlBBKL.exe
  2⤵
  PID:5996
- C:\Windows\System\spBPpng.exe
  C:\Windows\System\spBPpng.exe
  2⤵
  PID:7320
- C:\Windows\System\wbkxuoe.exe
  C:\Windows\System\wbkxuoe.exe
  2⤵
  PID:2852
- C:\Windows\System\BLdlqvK.exe
  C:\Windows\System\BLdlqvK.exe
  2⤵
  PID:11736
- C:\Windows\System\OQHcGMS.exe
  C:\Windows\System\OQHcGMS.exe
  2⤵
  PID:10524
- C:\Windows\System\EYLFHfl.exe
  C:\Windows\System\EYLFHfl.exe
  2⤵
  PID:6628
- C:\Windows\System\TBZRPCf.exe
  C:\Windows\System\TBZRPCf.exe
  2⤵
  PID:440
- C:\Windows\System\tHywVxr.exe
  C:\Windows\System\tHywVxr.exe
  2⤵
  PID:11188
- C:\Windows\System\FHIoMcV.exe
  C:\Windows\System\FHIoMcV.exe
  2⤵
  PID:7460
- C:\Windows\System\qfDAygi.exe
  C:\Windows\System\qfDAygi.exe
  2⤵
  PID:12356
- C:\Windows\System\qINkWVg.exe
  C:\Windows\System\qINkWVg.exe
  2⤵
  PID:11944
- C:\Windows\System\ZHVaykX.exe
  C:\Windows\System\ZHVaykX.exe
  2⤵
  PID:7012
- C:\Windows\System\CLtCitf.exe
  C:\Windows\System\CLtCitf.exe
  2⤵
  PID:8700
- C:\Windows\System\vVYwuQW.exe
  C:\Windows\System\vVYwuQW.exe
  2⤵
  PID:7040
- C:\Windows\System\URAinUR.exe
  C:\Windows\System\URAinUR.exe
  2⤵
  PID:6996
- C:\Windows\System\lDxsltA.exe
  C:\Windows\System\lDxsltA.exe
  2⤵
  PID:2988
- C:\Windows\System\jqVBJzi.exe
  C:\Windows\System\jqVBJzi.exe
  2⤵
  PID:7968
- C:\Windows\System\dPZwEqc.exe
  C:\Windows\System\dPZwEqc.exe
  2⤵
  PID:3184
- C:\Windows\System\sOkKmSf.exe
  C:\Windows\System\sOkKmSf.exe
  2⤵
  PID:7068
- C:\Windows\System\eaggOzp.exe
  C:\Windows\System\eaggOzp.exe
  2⤵
  PID:12800
- C:\Windows\System\ttiYLWo.exe
  C:\Windows\System\ttiYLWo.exe
  2⤵
  PID:6100
- C:\Windows\System\hUzUzXG.exe
  C:\Windows\System\hUzUzXG.exe
  2⤵
  PID:3236
- C:\Windows\System\FydcZEu.exe
  C:\Windows\System\FydcZEu.exe
  2⤵
  PID:7288
- C:\Windows\System\jjSCIUe.exe
  C:\Windows\System\jjSCIUe.exe
  2⤵
  PID:7520
- C:\Windows\System\ciYCLHF.exe
  C:\Windows\System\ciYCLHF.exe
  2⤵
  PID:7688
- C:\Windows\System\hhbnYvT.exe
  C:\Windows\System\hhbnYvT.exe
  2⤵
  PID:7336
- C:\Windows\System\FrvqwmM.exe
  C:\Windows\System\FrvqwmM.exe
  2⤵
  PID:3900
- C:\Windows\System\sWFyUxl.exe
  C:\Windows\System\sWFyUxl.exe
  2⤵
  PID:5636
- C:\Windows\System\Lailpjn.exe
  C:\Windows\System\Lailpjn.exe
  2⤵
  PID:8684
- C:\Windows\System\HuzzmIM.exe
  C:\Windows\System\HuzzmIM.exe
  2⤵
  PID:6220
- C:\Windows\System\imCGRCv.exe
  C:\Windows\System\imCGRCv.exe
  2⤵
  PID:10264
- C:\Windows\System\NCYQiLA.exe
  C:\Windows\System\NCYQiLA.exe
  2⤵
  PID:10488
- C:\Windows\System\vsKhWNs.exe
  C:\Windows\System\vsKhWNs.exe
  2⤵
  PID:5376
- C:\Windows\System\FwNSJfp.exe
  C:\Windows\System\FwNSJfp.exe
  2⤵
  PID:10312
- C:\Windows\System\aSWZFmf.exe
  C:\Windows\System\aSWZFmf.exe
  2⤵
  PID:12308
- C:\Windows\System\TjoZXPd.exe
  C:\Windows\System\TjoZXPd.exe
  2⤵
  PID:8224
- C:\Windows\System\OzPnhXM.exe
  C:\Windows\System\OzPnhXM.exe
  2⤵
  PID:7000
- C:\Windows\System\FWEtODM.exe
  C:\Windows\System\FWEtODM.exe
  2⤵
  PID:7764
- C:\Windows\System\junsyCE.exe
  C:\Windows\System\junsyCE.exe
  2⤵
  PID:6060
- C:\Windows\System\WicAMee.exe
  C:\Windows\System\WicAMee.exe
  2⤵
  PID:7380
- C:\Windows\System\bTLhhLy.exe
  C:\Windows\System\bTLhhLy.exe
  2⤵
  PID:8436
- C:\Windows\System\wMxisHR.exe
  C:\Windows\System\wMxisHR.exe
  2⤵
  PID:7116
- C:\Windows\System\QyrHrZD.exe
  C:\Windows\System\QyrHrZD.exe
  2⤵
  PID:8732
- C:\Windows\System\hWXLtpQ.exe
  C:\Windows\System\hWXLtpQ.exe
  2⤵
  PID:8508
- C:\Windows\System\clmyUqF.exe
  C:\Windows\System\clmyUqF.exe
  2⤵
  PID:9864
- C:\Windows\System\MFmQjGU.exe
  C:\Windows\System\MFmQjGU.exe
  2⤵
  PID:5328
- C:\Windows\System\mdwcHIo.exe
  C:\Windows\System\mdwcHIo.exe
  2⤵
  PID:5604
- C:\Windows\System\yyLwnVZ.exe
  C:\Windows\System\yyLwnVZ.exe
  2⤵
  PID:7756
- C:\Windows\System\EtovJem.exe
  C:\Windows\System\EtovJem.exe
  2⤵
  PID:2432
- C:\Windows\System\bFsjmzt.exe
  C:\Windows\System\bFsjmzt.exe
  2⤵
  PID:8096
- C:\Windows\System\EJLpzPS.exe
  C:\Windows\System\EJLpzPS.exe
  2⤵
  PID:13248
- C:\Windows\System\NKZhgdr.exe
  C:\Windows\System\NKZhgdr.exe
  2⤵
  PID:7952
- C:\Windows\System\nQjSYfM.exe
  C:\Windows\System\nQjSYfM.exe
  2⤵
  PID:7332
- C:\Windows\System\izPTlCJ.exe
  C:\Windows\System\izPTlCJ.exe
  2⤵
  PID:12096
- C:\Windows\System\ATskuSU.exe
  C:\Windows\System\ATskuSU.exe
  2⤵
  PID:7388
- C:\Windows\System\uVVkyLJ.exe
  C:\Windows\System\uVVkyLJ.exe
  2⤵
  PID:13080
- C:\Windows\System\QsvNahW.exe
  C:\Windows\System\QsvNahW.exe
  2⤵
  PID:7260
- C:\Windows\System\PwsFJPv.exe
  C:\Windows\System\PwsFJPv.exe
  2⤵
  PID:8744
- C:\Windows\System\ztTFdlD.exe
  C:\Windows\System\ztTFdlD.exe
  2⤵
  PID:2416
- C:\Windows\System\mMhaArf.exe
  C:\Windows\System\mMhaArf.exe
  2⤵
  PID:13140
- C:\Windows\System\okqbBFN.exe
  C:\Windows\System\okqbBFN.exe
  2⤵
  PID:13260
- C:\Windows\System\oNMoqeD.exe
  C:\Windows\System\oNMoqeD.exe
  2⤵
  PID:8780
- C:\Windows\System\SvdLHlj.exe
  C:\Windows\System\SvdLHlj.exe
  2⤵
  PID:9136
- C:\Windows\System\AESXhxE.exe
  C:\Windows\System\AESXhxE.exe
  2⤵
  PID:8456
- C:\Windows\System\BlieeYr.exe
  C:\Windows\System\BlieeYr.exe
  2⤵
  PID:8512
- C:\Windows\System\oomkOgF.exe
  C:\Windows\System\oomkOgF.exe
  2⤵
  PID:8400
- C:\Windows\System\YRvjrlo.exe
  C:\Windows\System\YRvjrlo.exe
  2⤵
  PID:12360
- C:\Windows\System\PtlUyGb.exe
  C:\Windows\System\PtlUyGb.exe
  2⤵
  PID:8020
- C:\Windows\System\wASttgM.exe
  C:\Windows\System\wASttgM.exe
  2⤵
  PID:8876
- C:\Windows\System\ZIShKMn.exe
  C:\Windows\System\ZIShKMn.exe
  2⤵
  PID:6940
- C:\Windows\System\PSsADuG.exe
  C:\Windows\System\PSsADuG.exe
  2⤵
  PID:11000
- C:\Windows\System\spbNdbM.exe
  C:\Windows\System\spbNdbM.exe
  2⤵
  PID:8164
- C:\Windows\System\PzfAmmZ.exe
  C:\Windows\System\PzfAmmZ.exe
  2⤵
  PID:9384
- C:\Windows\System\lRuvSme.exe
  C:\Windows\System\lRuvSme.exe
  2⤵
  PID:9436
- C:\Windows\System\FTNoKBZ.exe
  C:\Windows\System\FTNoKBZ.exe
  2⤵
  PID:10272
- C:\Windows\System\JIHzUQf.exe
  C:\Windows\System\JIHzUQf.exe
  2⤵
  PID:9876
- C:\Windows\System\ADVbnTH.exe
  C:\Windows\System\ADVbnTH.exe
  2⤵
  PID:3932
- C:\Windows\System\bRxhVfu.exe
  C:\Windows\System\bRxhVfu.exe
  2⤵
  PID:9032
- C:\Windows\System\bCSeJGH.exe
  C:\Windows\System\bCSeJGH.exe
  2⤵
  PID:8844
- C:\Windows\System\sOansez.exe
  C:\Windows\System\sOansez.exe
  2⤵
  PID:9744
- C:\Windows\System\UtuDKGh.exe
  C:\Windows\System\UtuDKGh.exe
  2⤵
  PID:10020
- C:\Windows\System\GKGfSgX.exe
  C:\Windows\System\GKGfSgX.exe
  2⤵
  PID:10068
- C:\Windows\System\OTXNJqQ.exe
  C:\Windows\System\OTXNJqQ.exe
  2⤵
  PID:11964
- C:\Windows\System\sHiPFZb.exe
  C:\Windows\System\sHiPFZb.exe
  2⤵
  PID:11604
- C:\Windows\System\asedqdN.exe
  C:\Windows\System\asedqdN.exe
  2⤵
  PID:6664
- C:\Windows\System\nfqsvXO.exe
  C:\Windows\System\nfqsvXO.exe
  2⤵
  PID:9284
- C:\Windows\System\wqXWoyV.exe
  C:\Windows\System\wqXWoyV.exe
  2⤵
  PID:3280
- C:\Windows\System\mhEdvcw.exe
  C:\Windows\System\mhEdvcw.exe
  2⤵
  PID:10172
- C:\Windows\System\kAYUHOv.exe
  C:\Windows\System\kAYUHOv.exe
  2⤵
  PID:7604
- C:\Windows\System\QmoSrGM.exe
  C:\Windows\System\QmoSrGM.exe
  2⤵
  PID:10168
- C:\Windows\System\uFWexpj.exe
  C:\Windows\System\uFWexpj.exe
  2⤵
  PID:9584
- C:\Windows\System\uLSIeeM.exe
  C:\Windows\System\uLSIeeM.exe
  2⤵
  PID:13440
- C:\Windows\System\FLtLJiI.exe
  C:\Windows\System\FLtLJiI.exe
  2⤵
  PID:13468
- C:\Windows\System\UArGcBS.exe
  C:\Windows\System\UArGcBS.exe
  2⤵
  PID:13504
- C:\Windows\System\jgUpUto.exe
  C:\Windows\System\jgUpUto.exe
  2⤵
  PID:13536
- C:\Windows\System\FCgiMTx.exe
  C:\Windows\System\FCgiMTx.exe
  2⤵
  PID:13564
- C:\Windows\System\TdVLByv.exe
  C:\Windows\System\TdVLByv.exe
  2⤵
  PID:13584
- C:\Windows\System\JRHcQvY.exe
  C:\Windows\System\JRHcQvY.exe
  2⤵
  PID:13636
- C:\Windows\System\qRxTMZi.exe
  C:\Windows\System\qRxTMZi.exe
  2⤵
  PID:13652
- C:\Windows\System\HtrenvO.exe
  C:\Windows\System\HtrenvO.exe
  2⤵
  PID:13704
- C:\Windows\System\TVivYor.exe
  C:\Windows\System\TVivYor.exe
  2⤵
  PID:13832
- C:\Windows\System\XalzIhM.exe
  C:\Windows\System\XalzIhM.exe
  2⤵
  PID:13848
- C:\Windows\System\IRwnUWN.exe
  C:\Windows\System\IRwnUWN.exe
  2⤵
  PID:13892
- C:\Windows\System\CfSrnQG.exe
  C:\Windows\System\CfSrnQG.exe
  2⤵
  PID:14048
- C:\Windows\System\rMOsXhx.exe
  C:\Windows\System\rMOsXhx.exe
  2⤵
  PID:14096
- C:\Windows\System\eSWMjHl.exe
  C:\Windows\System\eSWMjHl.exe
  2⤵
  PID:14144
- C:\Windows\System\tIANWxS.exe
  C:\Windows\System\tIANWxS.exe
  2⤵
  PID:14168
- C:\Windows\System\KNRAtsj.exe
  C:\Windows\System\KNRAtsj.exe
  2⤵
  PID:14204
- C:\Windows\System\fQQxsDN.exe
  C:\Windows\System\fQQxsDN.exe
  2⤵
  PID:14236
- C:\Windows\System\sHXtKrN.exe
  C:\Windows\System\sHXtKrN.exe
  2⤵
  PID:14260
- C:\Windows\System\zJlrJfH.exe
  C:\Windows\System\zJlrJfH.exe
  2⤵
  PID:14292
- C:\Windows\System\ZOknnRq.exe
  C:\Windows\System\ZOknnRq.exe
  2⤵
  PID:14312
- C:\Windows\System\FfaewUf.exe
  C:\Windows\System\FfaewUf.exe
  2⤵
  PID:9396
- C:\Windows\System\duBaFwq.exe
  C:\Windows\System\duBaFwq.exe
  2⤵
  PID:8728
- C:\Windows\System\qcbkHRp.exe
  C:\Windows\System\qcbkHRp.exe
  2⤵
  PID:9560
- C:\Windows\System\ljPDGlu.exe
  C:\Windows\System\ljPDGlu.exe
  2⤵
  PID:7432
- C:\Windows\System\EhbbEpT.exe
  C:\Windows\System\EhbbEpT.exe
  2⤵
  PID:9124
- C:\Windows\System\WhpFfLU.exe
  C:\Windows\System\WhpFfLU.exe
  2⤵
  PID:9756
- C:\Windows\System\bJKDaEF.exe
  C:\Windows\System\bJKDaEF.exe
  2⤵
  PID:9916
- C:\Windows\System\qWSlXHG.exe
  C:\Windows\System\qWSlXHG.exe
  2⤵
  PID:7056
- C:\Windows\System\TaWrtKU.exe
  C:\Windows\System\TaWrtKU.exe
  2⤵
  PID:9808
- C:\Windows\System\pWVfvHd.exe
  C:\Windows\System\pWVfvHd.exe
  2⤵
  PID:4960
- C:\Windows\System\SydOlcZ.exe
  C:\Windows\System\SydOlcZ.exe
  2⤵
  PID:13412
- C:\Windows\System\EIwJkjo.exe
  C:\Windows\System\EIwJkjo.exe
  2⤵
  PID:6572
- C:\Windows\System\DraffUd.exe
  C:\Windows\System\DraffUd.exe
  2⤵
  PID:3272
- C:\Windows\System\hwQDEFd.exe
  C:\Windows\System\hwQDEFd.exe
  2⤵
  PID:10208
- C:\Windows\System\FJPQyGw.exe
  C:\Windows\System\FJPQyGw.exe
  2⤵
  PID:9980
- C:\Windows\System\vueRczO.exe
  C:\Windows\System\vueRczO.exe
  2⤵
  PID:13436
- C:\Windows\System\mFKkjRI.exe
  C:\Windows\System\mFKkjRI.exe
  2⤵
  PID:13476
- C:\Windows\System\ZDcnXMK.exe
  C:\Windows\System\ZDcnXMK.exe
  2⤵
  PID:13512
- C:\Windows\System\TlNtqqd.exe
  C:\Windows\System\TlNtqqd.exe
  2⤵
  PID:13552
- C:\Windows\System\CPrUZPl.exe
  C:\Windows\System\CPrUZPl.exe
  2⤵
  PID:13332
- C:\Windows\System\FfdNskQ.exe
  C:\Windows\System\FfdNskQ.exe
  2⤵
  PID:13364
- C:\Windows\System\pvuKzGa.exe
  C:\Windows\System\pvuKzGa.exe
  2⤵
  PID:13840
- C:\Windows\System\psmQHhd.exe
  C:\Windows\System\psmQHhd.exe
  2⤵
  PID:10376
- C:\Windows\System\bdzumuo.exe
  C:\Windows\System\bdzumuo.exe
  2⤵
  PID:14124
- C:\Windows\System\uQUaQew.exe
  C:\Windows\System\uQUaQew.exe
  2⤵
  PID:13788
- C:\Windows\System\FniTdwu.exe
  C:\Windows\System\FniTdwu.exe
  2⤵
  PID:10988
- C:\Windows\System\csAnUpv.exe
  C:\Windows\System\csAnUpv.exe
  2⤵
  PID:11248
- C:\Windows\System\nlLuRLM.exe
  C:\Windows\System\nlLuRLM.exe
  2⤵
  PID:9288
- C:\Windows\System\JtFTGsC.exe
  C:\Windows\System\JtFTGsC.exe
  2⤵
  PID:14272
- C:\Windows\System\fTOZsOs.exe
  C:\Windows\System\fTOZsOs.exe
  2⤵
  PID:10000
- C:\Windows\System\zzOIDeK.exe
  C:\Windows\System\zzOIDeK.exe
  2⤵
  PID:10512
- C:\Windows\System\FTweQBV.exe
  C:\Windows\System\FTweQBV.exe
  2⤵
  PID:1296
- C:\Windows\System\hayvecE.exe
  C:\Windows\System\hayvecE.exe
  2⤵
  PID:10104
- C:\Windows\System\QSQLjoS.exe
  C:\Windows\System\QSQLjoS.exe
  2⤵
  PID:13396
- C:\Windows\System\kHHXZMM.exe
  C:\Windows\System\kHHXZMM.exe
  2⤵
  PID:3364
- C:\Windows\System\XUHEHey.exe
  C:\Windows\System\XUHEHey.exe
  2⤵
  PID:13320
- C:\Windows\System\tXjOHht.exe
  C:\Windows\System\tXjOHht.exe
  2⤵
  PID:13660
- C:\Windows\System\pZGUXos.exe
  C:\Windows\System\pZGUXos.exe
  2⤵
  PID:10884
- C:\Windows\System\hqeWJgI.exe
  C:\Windows\System\hqeWJgI.exe
  2⤵
  PID:13464
- C:\Windows\System\wVXkycY.exe
  C:\Windows\System\wVXkycY.exe
  2⤵
  PID:8660
- C:\Windows\System\pWhURwy.exe
  C:\Windows\System\pWhURwy.exe
  2⤵
  PID:9732
- C:\Windows\System\VEbnVjN.exe
  C:\Windows\System\VEbnVjN.exe
  2⤵
  PID:11124
- C:\Windows\System\zhuhXtI.exe
  C:\Windows\System\zhuhXtI.exe
  2⤵
  PID:11340
- C:\Windows\System\RByYLxi.exe
  C:\Windows\System\RByYLxi.exe
  2⤵
  PID:13532
- C:\Windows\System\SerGZhf.exe
  C:\Windows\System\SerGZhf.exe
  2⤵
  PID:11364
- C:\Windows\System\BoWyDSh.exe
  C:\Windows\System\BoWyDSh.exe
  2⤵
  PID:13388
- C:\Windows\System\ZTRVLPq.exe
  C:\Windows\System\ZTRVLPq.exe
  2⤵
  PID:14028
- C:\Windows\System\gMRAgTk.exe
  C:\Windows\System\gMRAgTk.exe
  2⤵
  PID:10504
- C:\Windows\System\cYumnvW.exe
  C:\Windows\System\cYumnvW.exe
  2⤵
  PID:11552
- C:\Windows\System\bHzwXGb.exe
  C:\Windows\System\bHzwXGb.exe
  2⤵
  PID:11348
- C:\Windows\System\hisNzwE.exe
  C:\Windows\System\hisNzwE.exe
  2⤵
  PID:14000
- C:\Windows\System\sDYquRo.exe
  C:\Windows\System\sDYquRo.exe
  2⤵
  PID:14112
- C:\Windows\System\QBtTYij.exe
  C:\Windows\System\QBtTYij.exe
  2⤵
  PID:11520
- C:\Windows\System\lsrRPzj.exe
  C:\Windows\System\lsrRPzj.exe
  2⤵
  PID:14320
- C:\Windows\System\KuPoxsj.exe
  C:\Windows\System\KuPoxsj.exe
  2⤵
  PID:10368
- C:\Windows\System\eWBmXYJ.exe
  C:\Windows\System\eWBmXYJ.exe
  2⤵
  PID:11200
- C:\Windows\System\NpmVRzd.exe
  C:\Windows\System\NpmVRzd.exe
  2⤵
  PID:11568
- C:\Windows\System\kFKTKZZ.exe
  C:\Windows\System\kFKTKZZ.exe
  2⤵
  PID:14056
- C:\Windows\System\qBVSfpn.exe
  C:\Windows\System\qBVSfpn.exe
  2⤵
  PID:11932
- C:\Windows\System\wQrrEaa.exe
  C:\Windows\System\wQrrEaa.exe
  2⤵
  PID:7720
- C:\Windows\System\aKzbVdO.exe
  C:\Windows\System\aKzbVdO.exe
  2⤵
  PID:10152
- C:\Windows\System\QnUtGVQ.exe
  C:\Windows\System\QnUtGVQ.exe
  2⤵
  PID:11904
- C:\Windows\System\CvsMitt.exe
  C:\Windows\System\CvsMitt.exe
  2⤵
  PID:11216
- C:\Windows\System\qVliHpM.exe
  C:\Windows\System\qVliHpM.exe
  2⤵
  PID:13748
- C:\Windows\System\kNGvtJs.exe
  C:\Windows\System\kNGvtJs.exe
  2⤵
  PID:12148
- C:\Windows\System\sMJDzUX.exe
  C:\Windows\System\sMJDzUX.exe
  2⤵
  PID:10672
- C:\Windows\System\EFjKLRa.exe
  C:\Windows\System\EFjKLRa.exe
  2⤵
  PID:5048
- C:\Windows\System\PtCWwrE.exe
  C:\Windows\System\PtCWwrE.exe
  2⤵
  PID:13488
- C:\Windows\System\vdgAxTf.exe
  C:\Windows\System\vdgAxTf.exe
  2⤵
  PID:13696
- C:\Windows\System\dSuTHoZ.exe
  C:\Windows\System\dSuTHoZ.exe
  2⤵
  PID:9532
- C:\Windows\System\NzmrhZy.exe
  C:\Windows\System\NzmrhZy.exe
  2⤵
  PID:11164
- C:\Windows\System\iCCOVXR.exe
  C:\Windows\System\iCCOVXR.exe
  2⤵
  PID:11444
- C:\Windows\System\qwSmbBT.exe
  C:\Windows\System\qwSmbBT.exe
  2⤵
  PID:13680
- C:\Windows\System\gILiIhK.exe
  C:\Windows\System\gILiIhK.exe
  2⤵
  PID:10896
- C:\Windows\System\YpKDtUJ.exe
  C:\Windows\System\YpKDtUJ.exe
  2⤵
  PID:10428
- C:\Windows\System\MQYBLhY.exe
  C:\Windows\System\MQYBLhY.exe
  2⤵
  PID:11584
- C:\Windows\System\taDnHTn.exe
  C:\Windows\System\taDnHTn.exe
  2⤵
  PID:11996
- C:\Windows\System\ZlTOQJS.exe
  C:\Windows\System\ZlTOQJS.exe
  2⤵
  PID:12104
- C:\Windows\System\akGIkFt.exe
  C:\Windows\System\akGIkFt.exe
  2⤵
  PID:4508
- C:\Windows\System\iaDvMim.exe
  C:\Windows\System\iaDvMim.exe
  2⤵
  PID:11588
- C:\Windows\System\rNccGEx.exe
  C:\Windows\System\rNccGEx.exe
  2⤵
  PID:11828
- C:\Windows\System\vXZrfmH.exe
  C:\Windows\System\vXZrfmH.exe
  2⤵
  PID:13580
- C:\Windows\System\yEoaWkb.exe
  C:\Windows\System\yEoaWkb.exe
  2⤵
  PID:11384
- C:\Windows\System\CKrOUea.exe
  C:\Windows\System\CKrOUea.exe
  2⤵
  PID:11580
- C:\Windows\System\FdltYcu.exe
  C:\Windows\System\FdltYcu.exe
  2⤵
  PID:14276
- C:\Windows\System\fRpBsAY.exe
  C:\Windows\System\fRpBsAY.exe
  2⤵
  PID:5992
- C:\Windows\System\DOOFOPZ.exe
  C:\Windows\System\DOOFOPZ.exe
  2⤵
  PID:10812
- C:\Windows\System\wXwDEWt.exe
  C:\Windows\System\wXwDEWt.exe
  2⤵
  PID:11780
- C:\Windows\System\GezFlwg.exe
  C:\Windows\System\GezFlwg.exe
  2⤵
  PID:10844
- C:\Windows\System\KXtxnAz.exe
  C:\Windows\System\KXtxnAz.exe
  2⤵
  PID:10792
- C:\Windows\System\KAwSHKb.exe
  C:\Windows\System\KAwSHKb.exe
  2⤵
  PID:7928
- C:\Windows\System\CrZahAx.exe
  C:\Windows\System\CrZahAx.exe
  2⤵
  PID:7908
- C:\Windows\System\qOevdTe.exe
  C:\Windows\System\qOevdTe.exe
  2⤵
  PID:11548
- C:\Windows\System\CYGhlaI.exe
  C:\Windows\System\CYGhlaI.exe
  2⤵
  PID:14160
- C:\Windows\System\ExAjoxk.exe
  C:\Windows\System\ExAjoxk.exe
  2⤵
  PID:14256
- C:\Windows\System\CbNUhDt.exe
  C:\Windows\System\CbNUhDt.exe
  2⤵
  PID:12716
- C:\Windows\System\ASHVxwz.exe
  C:\Windows\System\ASHVxwz.exe
  2⤵
  PID:12300
- C:\Windows\System\gCcAGrl.exe
  C:\Windows\System\gCcAGrl.exe
  2⤵
  PID:12392
- C:\Windows\System\VdTlWBi.exe
  C:\Windows\System\VdTlWBi.exe
  2⤵
  PID:13040
- C:\Windows\System\jylOkVJ.exe
  C:\Windows\System\jylOkVJ.exe
  2⤵
  PID:10088
- C:\Windows\System\wUnfJuy.exe
  C:\Windows\System\wUnfJuy.exe
  2⤵
  PID:11056
- C:\Windows\System\SBislKw.exe
  C:\Windows\System\SBislKw.exe
  2⤵
  PID:12612
- C:\Windows\System\qKbPJYD.exe
  C:\Windows\System\qKbPJYD.exe
  2⤵
  PID:14360
- C:\Windows\System\Rhhfntf.exe
  C:\Windows\System\Rhhfntf.exe
  2⤵
  PID:14392
- C:\Windows\System\LcVSjoc.exe
  C:\Windows\System\LcVSjoc.exe
  2⤵
  PID:14424
- C:\Windows\System\uuMVayD.exe
  C:\Windows\System\uuMVayD.exe
  2⤵
  PID:14440
- C:\Windows\System\SvtEmBn.exe
  C:\Windows\System\SvtEmBn.exe
  2⤵
  PID:14456
- C:\Windows\System\FzDZfnh.exe
  C:\Windows\System\FzDZfnh.exe
  2⤵
  PID:14472
- C:\Windows\System\GjCrTog.exe
  C:\Windows\System\GjCrTog.exe
  2⤵
  PID:14488
- C:\Windows\System\pfOMTpz.exe
  C:\Windows\System\pfOMTpz.exe
  2⤵
  PID:14504
- C:\Windows\System\tWTzkUL.exe
  C:\Windows\System\tWTzkUL.exe
  2⤵
  PID:14520
- C:\Windows\System\BqllMMa.exe
  C:\Windows\System\BqllMMa.exe
  2⤵
  PID:14536
- C:\Windows\System\nyMrUSZ.exe
  C:\Windows\System\nyMrUSZ.exe
  2⤵
  PID:14552
- C:\Windows\System\tBIZYUC.exe
  C:\Windows\System\tBIZYUC.exe
  2⤵
  PID:14580
- C:\Windows\System\Gnaanon.exe
  C:\Windows\System\Gnaanon.exe
  2⤵
  PID:14632
- C:\Windows\System\rysvAqp.exe
  C:\Windows\System\rysvAqp.exe
  2⤵
  PID:14652
- C:\Windows\System\brcCdhv.exe
  C:\Windows\System\brcCdhv.exe
  2⤵
  PID:14688
- C:\Windows\System\ddZmjlk.exe
  C:\Windows\System\ddZmjlk.exe
  2⤵
  PID:14712
- C:\Windows\System\ZKkXdBw.exe
  C:\Windows\System\ZKkXdBw.exe
  2⤵
  PID:14736
- C:\Windows\System\ZcLtQUV.exe
  C:\Windows\System\ZcLtQUV.exe
  2⤵
  PID:14800
- C:\Windows\System\EakjVHl.exe
  C:\Windows\System\EakjVHl.exe
  2⤵
  PID:14832
- C:\Windows\System\QAIkgzW.exe
  C:\Windows\System\QAIkgzW.exe
  2⤵
  PID:14852
- C:\Windows\System\pQLnAbP.exe
  C:\Windows\System\pQLnAbP.exe
  2⤵
  PID:14868
- C:\Windows\System\QlCIeCR.exe
  C:\Windows\System\QlCIeCR.exe
  2⤵
  PID:14904
- C:\Windows\System\MGqcTka.exe
  C:\Windows\System\MGqcTka.exe
  2⤵
  PID:14936
- C:\Windows\System\rVVVcPa.exe
  C:\Windows\System\rVVVcPa.exe
  2⤵
  PID:14968
- C:\Windows\System\WZhyPlM.exe
  C:\Windows\System\WZhyPlM.exe
  2⤵
  PID:15000
- C:\Windows\System\HqnEdrl.exe
  C:\Windows\System\HqnEdrl.exe
  2⤵
  PID:15108
- C:\Windows\System\vgUBGwF.exe
  C:\Windows\System\vgUBGwF.exe
  2⤵
  PID:15140
- C:\Windows\System\siyKhCk.exe
  C:\Windows\System\siyKhCk.exe
  2⤵
  PID:15172
- C:\Windows\System\gtTMpxN.exe
  C:\Windows\System\gtTMpxN.exe
  2⤵
  PID:15192
- C:\Windows\System\RHkgwzj.exe
  C:\Windows\System\RHkgwzj.exe
  2⤵
  PID:15212
- C:\Windows\System\pDQsHmG.exe
  C:\Windows\System\pDQsHmG.exe
  2⤵
  PID:15228
- C:\Windows\System\vuIcreE.exe
  C:\Windows\System\vuIcreE.exe
  2⤵
  PID:15248
- C:\Windows\System\LGtdPcM.exe
  C:\Windows\System\LGtdPcM.exe
  2⤵
  PID:15280
- C:\Windows\System\sRLHkdC.exe
  C:\Windows\System\sRLHkdC.exe
  2⤵
  PID:12680
- C:\Windows\System\TLFaQmm.exe
  C:\Windows\System\TLFaQmm.exe
  2⤵
  PID:11800
- C:\Windows\System\sTvgpGA.exe
  C:\Windows\System\sTvgpGA.exe
  2⤵
  PID:11732
- C:\Windows\System\pLMgbQX.exe
  C:\Windows\System\pLMgbQX.exe
  2⤵
  PID:14448
- C:\Windows\System\EQDHwOF.exe
  C:\Windows\System\EQDHwOF.exe
  2⤵
  PID:10964
- C:\Windows\System\vbcPLnL.exe
  C:\Windows\System\vbcPLnL.exe
  2⤵
  PID:11812
- C:\Windows\System\dmXFpCZ.exe
  C:\Windows\System\dmXFpCZ.exe
  2⤵
  PID:14560
- C:\Windows\System\APMEBLX.exe
  C:\Windows\System\APMEBLX.exe
  2⤵
  PID:10336
- C:\Windows\System\XxPwNRA.exe
  C:\Windows\System\XxPwNRA.exe
  2⤵
  PID:13944
- C:\Windows\System\CfUCACO.exe
  C:\Windows\System\CfUCACO.exe
  2⤵
  PID:10340
- C:\Windows\System\iUQFqYh.exe
  C:\Windows\System\iUQFqYh.exe
  2⤵
  PID:14596
- C:\Windows\System\DGTbrOE.exe
  C:\Windows\System\DGTbrOE.exe
  2⤵
  PID:14828
- C:\Windows\System\zZZmNJc.exe
  C:\Windows\System\zZZmNJc.exe
  2⤵
  PID:14860
- C:\Windows\System\LXOyMLj.exe
  C:\Windows\System\LXOyMLj.exe
  2⤵
  PID:15124
- C:\Windows\System\LuLvmty.exe
  C:\Windows\System\LuLvmty.exe
  2⤵
  PID:11776
- C:\Windows\System\sHXtlPt.exe
  C:\Windows\System\sHXtlPt.exe
  2⤵
  PID:14468
- C:\Windows\System\CGUaicr.exe
  C:\Windows\System\CGUaicr.exe
  2⤵
  PID:12180
- C:\Windows\System\hlGBuhd.exe
  C:\Windows\System\hlGBuhd.exe
  2⤵
  PID:13344

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13180

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:13900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3la00wvo.ygw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BOxvtxx.exe

Filesize
2.2MB

MD5
16b2d44b58ed5390cad44e4c461195d4

SHA1
f21d487027b9c386ef8ad323d909afc1c66a25e6

SHA256
01e63d2e956e83afcb803eadeba25029a7df6bb02e1eae39cda229eaf8b380a3

SHA512
a1689f23cd47309f449392f52cada8ad63ee535a12f6b4520cc8d0b05d8990b652c9f544c22e01de8edccd8a15db88f072414d3ac6b59fea68fb116496034201

Download Submit
C:\Windows\System\EIzpeJi.exe

Filesize
2.2MB

MD5
d1853c239d005380caa879280c62a3c1

SHA1
ada4ad338221c75a3a619cde582295d31a0f143c

SHA256
181145d3fa5bb0543109873362f2299bc123aba265e957ac39a08887bd94fd6a

SHA512
7190619ccabd79d4c26af1cd6c17c38a8d8b856cbd9610b343983b58123ba9bb365f1837901d227674d540b56a3d13312f4e750cad03ed5fc867e5f8e32f5bf0

Download Submit
C:\Windows\System\ENQtKMs.exe

Filesize
2.2MB

MD5
fb748715e02ad1e5cac9eb8e7422f7ed

SHA1
e3ed37679004433310535adc604b0e9cdc7dd62c

SHA256
4c30cfdbe723b92f7a024af7bb96d3a1e86967927ae6e6935d21325e5dd43e11

SHA512
d0fe6371b6558a1f7db968c4fd524537ec4a4aa8654acb57efe4831a050b6ca82a0f6885bd25c7bbf55cc4af0c0649cf188f6ff54a3d04424f7dfc8ae74b5fee

Download Submit
C:\Windows\System\FRYnLxH.exe

Filesize
2.2MB

MD5
ae5bc7a7f44846b66e243c3323595670

SHA1
0189874074d77eeccb8bec0c2f53a190c52f65c2

SHA256
25492d0607167d9166710e53b104bf9e265d1511d3a7c8f52d21ca34aebaf873

SHA512
1bc23e5f01927ee7e2a96ad3e7d610c4b0d37f148ce1a2c1fba96a4ea1b9e52d81c95602394ad123f46f2a127b8514bb05336e706eb3be2a2043902c0769cd79

Download Submit
C:\Windows\System\KEXwBCF.exe

Filesize
2.2MB

MD5
a89fe5b7a9f1dee2954036af32da0a6b

SHA1
40e84bef380a355e66eac2a31b9476fe060ef617

SHA256
c2bf3d129688ed82f7c316d33fa97c5d9396447d685cbfb5721a62bd6d6a6ac5

SHA512
fd1e5ae80dd78f0ca80e9c6d4baf9c118143fb03edccd1ac1f355d9355748a9d23a83416f7b6f476fa3128867cabd05453e83fa69b87a3fdd1cf111715285bd3

Download Submit
C:\Windows\System\KOvzHFH.exe

Filesize
2.2MB

MD5
2842bc4e649a807a2f9a99d9fcee4375

SHA1
be59e3d3dea9187eba0fb776b73ce746f8e04697

SHA256
d58599b335ce83abc8d2d4cdf45949df1c04f137421e320701822bf58aca05ee

SHA512
f63c5176ccb33fae9b8be4b7daa3d688112919d9822587def7a2e4565a78d0031dee4bf15c593b024ed0c11971b4a1396bedae68b64fb02473d287b79b4cd1ba

Download Submit
C:\Windows\System\NYHCUaf.exe

Filesize
2.2MB

MD5
0dcd83675b664660c03541dc13f3212d

SHA1
3c4885dd83978854211ec12e1813a4b8b3cc69b0

SHA256
f02f0b5bd2dcac920cdeaa8452d7452a345f96b486f3e2fcca181c5b450e6809

SHA512
b5634ac647866f61a03972582fdf39adf0c098e90f54ab4d8b1b041876031088c480e327741cdc30b35c6d3c52e9df5fa927e728b958947856384e7994d59ea1

Download Submit
C:\Windows\System\PEHJsqu.exe

Filesize
2.2MB

MD5
5f92107d4f7729ae50a88b991866422f

SHA1
bf8b9ddd5074cf165f9ca6ed3787da97a50206d8

SHA256
305483cdaed54753225143a6498fe86cc1e67d736631eb2a259923b36324ea0a

SHA512
2a1832f434d0941526626e9b6e1d62ef126edb1777ddd8d1c6c3478e6b6469ed2de5c924a2e0326188f2cfed8d2b325a1d8fd12d13154a783cb9f4ca475aa4dc

Download Submit
C:\Windows\System\QzSvgOA.exe

Filesize
2.2MB

MD5
d8b16b398464c53e4ddc58b7c1a5052f

SHA1
ac378395d0cd3541e8e6f3a95283e77610b9c514

SHA256
3b82ad638b9fc68b871a65b93d7d68a9bc121780e714a99c543b0f86e3497a47

SHA512
b2b37b6ac5af77437206d287319f69e81ab8c351ff9ff0f8621f1a30e6c6c88680b5b4666566f5e2b9818157fc8874b312715926669fa29bc3997834b16a6a61

Download Submit
C:\Windows\System\RPWbigO.exe

Filesize
2.2MB

MD5
4cc34d16e7d2deaf40d47e25586a937f

SHA1
3aff6003b8afde83e764a0bcfc98ba5eb6a0e73b

SHA256
d6c489f6c5b09412d4ab21a65aad0f5bbcd1badd11b543738b32cd9c80551bc8

SHA512
c483746bd34f52c2fe79897c433a05324868440be101ec9130913c0f09f173002241d2b2bf86a69c38b82be8c13d7d0030186266563ed5a884b83c9ff202f88f

Download Submit
C:\Windows\System\SGPOYGS.exe

Filesize
2.2MB

MD5
5b2a66b8cb48a77b2acc7627eeade204

SHA1
78e5694d8aa6a576bb9244e4310ac4ae4d7e6ec8

SHA256
1f833829df415ffc4be2fea8a6a7896fe32ff37370e60a118129e86d47acc4ee

SHA512
51872ba82d6e36f1bd5e6c1e90a41aeee45e81d5992724d447eedc1133945de03c66c315cd829cce01a6ea3b5dc348d4554880f6dc484c7e952827df85be5b7c

Download Submit
C:\Windows\System\TuObSnR.exe

Filesize
2.2MB

MD5
20a8c57bc744fac9249b0e874fcd93e2

SHA1
571e9ed43e715388a26391b688875f8c1c768635

SHA256
e048be8d22ec9633ef5fcd1a6deca91942594140f1c3c2081fef28110fc7c133

SHA512
6555f6db3c801c849fce0708838047765962cba09d21e0e7ac067165abd8d8d3b0562f95b17691a9b7fe49abb03a057d5e5579b52e3a8bcb71aee4a25aa3306f

Download Submit
C:\Windows\System\UiTvNZR.exe

Filesize
2.2MB

MD5
23f53a44db363abd18108ddb97a74f91

SHA1
f5b14571bd46a21d0c95f645dd3dc66e40df64ce

SHA256
824ab4a785d41605a9133f86b82859539e1beba5c45b428d2d1714e3d8b7ab4a

SHA512
de3844ab99d662a30b7daf9cd2560d036d8a19a9494d8604489655690d618f2df090269a70820d935ab8186d916b806ba7b37b639417c1b5d05945db545357ca

Download Submit
C:\Windows\System\VhnYZSk.exe

Filesize
2.2MB

MD5
9df28011a6db4e234efeaa4fa26cbd11

SHA1
e01616ff7b780fdaed984a78dd6c0443f56f6128

SHA256
03eb7a02ca3fd6585621adeaf6d619f4f4417f3d7642179ca2fa393e6baf857f

SHA512
4589b0eba31c7b757da296bb0c2c4dc492d538f04181824290875e87ea7ed677c92cfd5cbe12831a33dd5f0c0df0606545f625bc695ddcb4a1c505ccbb3f6f65

Download Submit
C:\Windows\System\WeZrxSl.exe

Filesize
2.2MB

MD5
5960d1ba3d691634ab0f459456ff9e42

SHA1
41417ce9499c9d73337873a601bb0be46254b127

SHA256
a6f747d7b3b2a81f99575d13dfd23f8e5860a08184e446d178b93e6a9d26d0a8

SHA512
6740b7a55c72b00453198b5acd67db0b62920ce7f661326ec1e22a14b08f04a4b292e3f980f695fb2f6471b03586982925a3209251267cfd27388fda8d060f56

Download Submit
C:\Windows\System\WngfrBD.exe

Filesize
2.2MB

MD5
582539e46186c59953d96c5dfdfc2114

SHA1
7c833ebbaca2d0692f8343aec37f0933e0824345

SHA256
d7e7c2554c1680cbf045e7f5a8774dcb2b84a45292e04d43b7132388cdf38093

SHA512
2f5e16095a6bb8e2e427da2428f2be39b9934707edc7ae08a2ac4fd48b4294f14a49ea695301cea107f1efe89d00d98b6ba43e0c5a6894df5236daec3f9576aa

Download Submit
C:\Windows\System\Xmhmnin.exe

Filesize
2.2MB

MD5
2fd287bd94f6d3b3fb5a8ac75de06f95

SHA1
50557aa982240879d80a0801c8d1708baa65dc44

SHA256
217e1afb39cbc1cd9576725b4bf73214d7137b710ce487bdceefb73b34034f40

SHA512
29349d15daba80a981fafcc6689cb900f4c03783c08ccb0ec21536177db6ec9cb73f6c4934cb9014101f6f87c7f535a8b2424cfd3de356d9b9a637c1827c1425

Download Submit
C:\Windows\System\YiFruEX.exe

Filesize
2.2MB

MD5
1ae3476579005b42a590651a28f8ebb2

SHA1
d9e7ad150cc7f62df58c659fe6dee35241fc46bb

SHA256
835563e14973c05a983a7f1ecafedd494a375eacc3276344da8888130fa93f92

SHA512
af24cd748a5f3956da762828356f43325bb5ee0bae258c8adcd5b6d79d975efed19149938915c9f7d2175abd51c7a4efeaee3003f991f2cdf440acd3a44dfa75

Download Submit
C:\Windows\System\artwDLL.exe

Filesize
2.2MB

MD5
356cf58b922153edcb1b183e1ac041eb

SHA1
01cb1b31515b675dd16bd05147bd8162b3438474

SHA256
3598fd3f4051c7abaaaf28989770cfb2bdeacbce45307e11743f69c83c391d6f

SHA512
e43176d127c751f85253637e919df0d1fdabae8218e6c23ee9095d1c9b0f70b3266311d1bf3da36723ce3146b151e92a6ab67ff2902c38c43fbb4aa4d1c457be

Download Submit
C:\Windows\System\dcDYkGZ.exe

Filesize
2.2MB

MD5
61c9a3e6bcd53230001602a37fc6eca7

SHA1
ae699985103df2199fcc196244fe60ef6f87df50

SHA256
91499ef43f4607b51774a8f57dbafbcb5c08f8fff9272820c4c88782182fbf55

SHA512
2a32193a6827f2c0f54565e624b12a29080cba69c907043801fc33a3771c588b62e77eb96a5dd967a7ac0fc7b05a8c284c37ca8085727c7c6a5fba50170ae4b1

Download Submit
C:\Windows\System\gWTIZmN.exe

Filesize
2.2MB

MD5
54ebd8c144491becf2a3cc1cc9ceed05

SHA1
f065e6e7af15f4b8bea187ce6d9515ef5b425249

SHA256
1f9b25d81c055add0a0272d3836899bf2fcb7e4fcec63d2f09cb7300043fa7c3

SHA512
be33706d54b215abd438fe9faa2f06ff839215d96621dd86b5dd766a06a25b23f33de74652d966fb8e915801cc992c6c47f9df41afeb2e6b54dd3117ced88d8e

Download Submit
C:\Windows\System\hitRfsr.exe

Filesize
2.2MB

MD5
84dec9b2ad97e1606454f4e6b6f8b3b1

SHA1
035604258401b00440b258f341f7d8d258f55f64

SHA256
cbb2fdadf29a49cfe46663e2633c3c760b731b5e0f8e10a1188ba1e133d9bbc1

SHA512
b729a4ea6b0225302a8bfa221f635627da3834692a1ad44f66e9402b3db0036b6301e925cd1a67da6e0489213fbe7d1281abb5ca00b5cc6a9b43a371159df08e

Download Submit
C:\Windows\System\jZAwFsn.exe

Filesize
2.2MB

MD5
812c0b81ba4263336352ff260915802f

SHA1
6a4f9d6f6b19f4576ee1dfcb2defd074a0260f90

SHA256
8cc64ec8603eff14ae07dd5455cdab49d048c1d17882ccb13dd9170097574a9e

SHA512
6712b8d5b2e061be427105c225ef99ae9ebbbbdfd0c256b4092c0703cf0b3dddc91303200d19c70852a3ab33bedd1797feb1f4d2e8673d49efa0638e6399414a

Download Submit
C:\Windows\System\joEZsMc.exe

Filesize
2.2MB

MD5
149be472fc7396fac44a1e5091c779b9

SHA1
86dfe8a2f4febd4c6ea01a44913773c35228bbeb

SHA256
6e8b9f4ce7cc688a814fed16cf960b1712ffaad2a7b0dcf0fbc46d2e1281ab62

SHA512
7a95735cdff834ba7477c512a359d980ba7a044a18438d312ef55ef7cbf2bcc3bf17409fef148fc39e72a57b9ec9f47ed4dc689170f93d82940d234efb9e52b2

Download Submit
C:\Windows\System\jqKGFho.exe

Filesize
2.2MB

MD5
5dd9b00e1a0390405417ae50cef5e093

SHA1
461192e25bb00d9160045a800cd647841b368033

SHA256
0d6578d5d178e2e2649e94790c781928ab30f74302b08452d589e8c82fb11017

SHA512
57b110ce42f84588658e6977bd7fb9446982520e8bc3a534d5b5bcc65692b985f67777f8a9eb34e364152af9554008b8bbd199ecd7fb996809f4047658a546d5

Download Submit
C:\Windows\System\nPyMpyw.exe

Filesize
2.2MB

MD5
eae599692dd274bc095c3917219fbab9

SHA1
a104cbb22f299b3168f69960c931fd765756dda9

SHA256
6d1c68ac5a4601bf6186ea4f2294c9088cc8585205a500491a77420fd234ce76

SHA512
afe6770c50ce810a15ea84a6e5536425ceb2c6e8a30fcb197cf1ce31387fc58f2aae45bffaddff6e294460d58b4d3fc977ee301b912c31833722f09b1c407708

Download Submit
C:\Windows\System\onZOOHq.exe

Filesize
2.2MB

MD5
10137303cf4dd5e166307eacb9ebbed5

SHA1
8afb4a084aa8b8f5bd196cbae511ba9d0267be54

SHA256
c2ca07c0cb198ea87b399358a65411ff1e87ac5d3670f1f9f6d55c1d5b7030a0

SHA512
d04ebeb0ea503703cf5b50923453917d26070c170cdc07ce5eb817a7d1648186f98886e39509366e52604126d8b4304531c80d78040e5be0f30d74a838b302cc

Download Submit
C:\Windows\System\rJKtzon.exe

Filesize
2.2MB

MD5
adab7c104ec35303f86fa232f118713a

SHA1
a14e7b088e6c0b36d291625b6c5a939cb31af545

SHA256
ac369c23b8dc54dd828713e65eb5c6d8404a17c421ca15f2fbdadc539536d2e5

SHA512
832e71dc5e2a7f599004c06d53f3c6453cfd068625d35a2d9447d33daa165e4180d29dc1ef474817c4b0a36a5c37694c490ccee42c673760e373e5f7177d72c6

Download Submit
C:\Windows\System\rrbWsnr.exe

Filesize
2.2MB

MD5
9e5c5d88691c39af0c9eae9e02abc353

SHA1
45ab0e6a801c80cc9e96d7ddf1cbb197eba58c8e

SHA256
4615162acde5073f5bbe5251ed9ec7dbd3bbffdb3ae79ee8cd977e5e2909495f

SHA512
efef6c5735acf0018aa0e921a60d2225e7aeb23b0650afbf3a92c3573ff3dab81afda807e244d5fc9a0d81374262c95d376333412ab30a26569db95778092184

Download Submit
C:\Windows\System\sPXBdlw.exe

Filesize
2.2MB

MD5
5a0068754a98619f4a9c3478ac215a2d

SHA1
36d55076e730695a9e569436b7dadfaedebbc635

SHA256
68bace7422bced868d8ed9c2e90c60c533f44507d7c82804cecb80d73956cc74

SHA512
86742414d440ed57fe59f4e83b86b2336054e36251578b1ee35060c50c76442e702d00e5f104c87ab0b10d96381eda442e915592da5d5ff087a205d851306351

Download Submit
C:\Windows\System\vLSoxfr.exe

Filesize
2.2MB

MD5
ebf326c715663a72dcee2dd4829cc73d

SHA1
196deba90c2dd905a33b626486d35463ab80c8e4

SHA256
c93b6a250927bd131f76a6006a885a329de99c4d8099219aa2a0cef36d931df4

SHA512
c751ca06d4d6b60cc3af8d87fe1d594495430d88a5688d7fe4671d3592fc800562cab4292f7de355314cc453859ea98baf0c790a11f04242b82169f5c5631641

Download Submit
C:\Windows\System\vsksAjt.exe

Filesize
2.2MB

MD5
cb37cb798d42f56023d1ee4ff63e9732

SHA1
678be9cecb0dcb7e71fc5fcc35ece6f13d2ab4d5

SHA256
363f543c4e7c0b9e7272897f7118f1b220d0fa51eb814ad0e05b2b3e78f026c8

SHA512
bf220f74f61f247f4ca2f6fe7ded1ef71565c0f32fbc9169aeef022ab249654d881d6b58258b2eafad6ccee0efeddf374e3a4dbae8d26b34cb261d191a760650

Download Submit
C:\Windows\System\wHYYiaz.exe

Filesize
2.2MB

MD5
01d5ba12ca2a7df3168a759556cc83ab

SHA1
3af9679ed4e1df318fec7ca6453aa56e2f7d42f6

SHA256
852db573128a3d00005a67f2b4bf371913f5e79a25a2c6796b31ca6a637b431d

SHA512
07fd5a42b3c689f7317b1f231b2bdf89a622e5fc7c72958a0f8b1e01398c3b4c0c4045beda2973687d518b415984a4f8cb98cf7334712695dd0d4df148eb98cc

Download Submit
C:\Windows\System\yqRcROl.exe

Filesize
18B

MD5
35bde48c57b79a5e0ea0718733e62371

SHA1
41d2e344c30d7af2c472ba7a6ded43f0a9d6d4c2

SHA256
407b155a736cda52f1eb2b18d7fea9e028f3f4f796230535df591f3124a679c0

SHA512
a6c519b6e0f42a0f961fc4c0161e01dfb018e01d40d6b50a2a61a6cfeffa9e0fa78a3d1bb24269ec827e815cd0942de8d545ba7f93aa13de1bab78f87b543dba

Download Submit
memory/428-165-0x00007FF713AF0000-0x00007FF713EE2000-memory.dmp

Filesize
3.9MB

Download
memory/448-110-0x00007FF740610000-0x00007FF740A02000-memory.dmp

Filesize
3.9MB

Download
memory/696-133-0x00007FF636480000-0x00007FF636872000-memory.dmp

Filesize
3.9MB

Download
memory/1044-164-0x00007FF7D0F80000-0x00007FF7D1372000-memory.dmp

Filesize
3.9MB

Download
memory/1780-140-0x00007FF682740000-0x00007FF682B32000-memory.dmp

Filesize
3.9MB

Download
memory/1788-146-0x00007FF6F93C0000-0x00007FF6F97B2000-memory.dmp

Filesize
3.9MB

Download
memory/1900-129-0x00007FF7000A0000-0x00007FF700492000-memory.dmp

Filesize
3.9MB

Download
memory/1908-79-0x00007FF77C280000-0x00007FF77C672000-memory.dmp

Filesize
3.9MB

Download
memory/1996-114-0x00007FF66E670000-0x00007FF66EA62000-memory.dmp

Filesize
3.9MB

Download
memory/2172-59-0x00007FF751330000-0x00007FF751722000-memory.dmp

Filesize
3.9MB

Download
memory/2224-115-0x00007FF67E770000-0x00007FF67EB62000-memory.dmp

Filesize
3.9MB

Download
memory/2472-134-0x00007FF647480000-0x00007FF647872000-memory.dmp

Filesize
3.9MB

Download
memory/2612-117-0x00007FF75AFF0000-0x00007FF75B3E2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-171-0x00007FF65AC80000-0x00007FF65B072000-memory.dmp

Filesize
3.9MB

Download
memory/3128-125-0x00007FF7C3830000-0x00007FF7C3C22000-memory.dmp

Filesize
3.9MB

Download
memory/3752-64-0x00007FF723780000-0x00007FF723B72000-memory.dmp

Filesize
3.9MB

Download
memory/3964-49-0x00007FF6662D0000-0x00007FF6666C2000-memory.dmp

Filesize
3.9MB

Download
memory/3996-34-0x00007FFA16B80000-0x00007FFA17641000-memory.dmp

Filesize
10.8MB

Download
memory/3996-393-0x00000200DE840000-0x00000200DEFE6000-memory.dmp

Filesize
7.6MB

Download
memory/3996-6-0x00007FFA16B83000-0x00007FFA16B85000-memory.dmp

Filesize
8KB

Download
memory/3996-41-0x00000200C3840000-0x00000200C3862000-memory.dmp

Filesize
136KB

Download
memory/3996-17-0x00007FFA16B80000-0x00007FFA17641000-memory.dmp

Filesize
10.8MB

Download
memory/4112-158-0x00007FF78A470000-0x00007FF78A862000-memory.dmp

Filesize
3.9MB

Download
memory/4256-44-0x00007FF7FC570000-0x00007FF7FC962000-memory.dmp

Filesize
3.9MB

Download
memory/4316-87-0x00007FF776120000-0x00007FF776512000-memory.dmp

Filesize
3.9MB

Download
memory/4340-177-0x00007FF68D840000-0x00007FF68DC32000-memory.dmp

Filesize
3.9MB

Download
memory/4352-120-0x00007FF7FF790000-0x00007FF7FFB82000-memory.dmp

Filesize
3.9MB

Download
memory/4760-152-0x00007FF6FC5C0000-0x00007FF6FC9B2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-0-0x00007FF65DFB0000-0x00007FF65E3A2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-1-0x0000018B7C6F0000-0x0000018B7C700000-memory.dmp

Filesize
64KB

Download
memory/4932-53-0x00007FF7FAB40000-0x00007FF7FAF32000-memory.dmp

Filesize
3.9MB

Download
memory/4932-3154-0x00007FF7FAB40000-0x00007FF7FAF32000-memory.dmp

Filesize
3.9MB

Download