xmrig | 07e15ea44f9df0384be1b8467a181384803284d8c4be2ec8e61c95853c6ffaba

Analysis

max time kernel
155s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
Size

1.8MB
MD5

0082092e8ddd209a12d23d72581f7e13
SHA1

5d9b8b4a3721bc023e1a9b26bd795c51e60dbb1d
SHA256

07e15ea44f9df0384be1b8467a181384803284d8c4be2ec8e61c95853c6ffaba
SHA512

5474a45e72670be117d840b8221af50377b1dd3be0fe8a82cd3f6247df7adc9a25d8adbf945bcaa6127702024e4b8827f37c4f55c1eaa417264486ca4386445d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl5:NABm

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 51 IoCs

miner

resource	yara_rule
behavioral2/memory/1812-102-0x00007FF76B8F0000-0x00007FF76BCE2000-memory.dmp	xmrig
behavioral2/memory/3100-115-0x00007FF7498F0000-0x00007FF749CE2000-memory.dmp	xmrig
behavioral2/memory/1032-125-0x00007FF6D4590000-0x00007FF6D4982000-memory.dmp	xmrig
behavioral2/memory/636-134-0x00007FF7A0180000-0x00007FF7A0572000-memory.dmp	xmrig
behavioral2/memory/4176-136-0x00007FF73F640000-0x00007FF73FA32000-memory.dmp	xmrig
behavioral2/memory/4052-139-0x00007FF6DD800000-0x00007FF6DDBF2000-memory.dmp	xmrig
behavioral2/memory/4484-137-0x00007FF736A40000-0x00007FF736E32000-memory.dmp	xmrig
behavioral2/memory/3648-250-0x00007FF699910000-0x00007FF699D02000-memory.dmp	xmrig
behavioral2/memory/4196-253-0x00007FF7B75D0000-0x00007FF7B79C2000-memory.dmp	xmrig
behavioral2/memory/4836-256-0x00007FF7D21C0000-0x00007FF7D25B2000-memory.dmp	xmrig
behavioral2/memory/756-255-0x00007FF7F0350000-0x00007FF7F0742000-memory.dmp	xmrig
behavioral2/memory/1860-257-0x00007FF674A40000-0x00007FF674E32000-memory.dmp	xmrig
behavioral2/memory/3652-260-0x00007FF69C310000-0x00007FF69C702000-memory.dmp	xmrig
behavioral2/memory/1776-261-0x00007FF670300000-0x00007FF6706F2000-memory.dmp	xmrig
behavioral2/memory/2828-263-0x00007FF67AC80000-0x00007FF67B072000-memory.dmp	xmrig
behavioral2/memory/3868-262-0x00007FF6D6200000-0x00007FF6D65F2000-memory.dmp	xmrig
behavioral2/memory/1248-259-0x00007FF60F830000-0x00007FF60FC22000-memory.dmp	xmrig
behavioral2/memory/1752-270-0x00007FF7CA5D0000-0x00007FF7CA9C2000-memory.dmp	xmrig
behavioral2/memory/2284-274-0x00007FF6306D0000-0x00007FF630AC2000-memory.dmp	xmrig
behavioral2/memory/2176-276-0x00007FF7FD4D0000-0x00007FF7FD8C2000-memory.dmp	xmrig
behavioral2/memory/4724-279-0x00007FF6030F0000-0x00007FF6034E2000-memory.dmp	xmrig
behavioral2/memory/5092-275-0x00007FF728A50000-0x00007FF728E42000-memory.dmp	xmrig
behavioral2/memory/4984-283-0x00007FF6F8CC0000-0x00007FF6F90B2000-memory.dmp	xmrig
behavioral2/memory/4492-282-0x00007FF6600A0000-0x00007FF660492000-memory.dmp	xmrig
behavioral2/memory/1504-258-0x00007FF68ED20000-0x00007FF68F112000-memory.dmp	xmrig
behavioral2/memory/3784-287-0x00007FF656A40000-0x00007FF656E32000-memory.dmp	xmrig
behavioral2/memory/3456-254-0x00007FF760560000-0x00007FF760952000-memory.dmp	xmrig
behavioral2/memory/4604-252-0x00007FF7CA660000-0x00007FF7CAA52000-memory.dmp	xmrig
behavioral2/memory/4772-293-0x00007FF7436A0000-0x00007FF743A92000-memory.dmp	xmrig
behavioral2/memory/732-292-0x00007FF630260000-0x00007FF630652000-memory.dmp	xmrig
behavioral2/memory/2716-296-0x00007FF6CDF80000-0x00007FF6CE372000-memory.dmp	xmrig
behavioral2/memory/4740-299-0x00007FF741890000-0x00007FF741C82000-memory.dmp	xmrig
behavioral2/memory/3372-302-0x00007FF67F9A0000-0x00007FF67FD92000-memory.dmp	xmrig
behavioral2/memory/1492-304-0x00007FF6D3180000-0x00007FF6D3572000-memory.dmp	xmrig
behavioral2/memory/4648-306-0x00007FF709920000-0x00007FF709D12000-memory.dmp	xmrig
behavioral2/memory/3884-305-0x00007FF7B3780000-0x00007FF7B3B72000-memory.dmp	xmrig
behavioral2/memory/1968-298-0x00007FF636180000-0x00007FF636572000-memory.dmp	xmrig
behavioral2/memory/3336-251-0x00007FF6BA360000-0x00007FF6BA752000-memory.dmp	xmrig
behavioral2/memory/3676-135-0x00007FF6CFFF0000-0x00007FF6D03E2000-memory.dmp	xmrig
behavioral2/memory/2232-133-0x00007FF6268E0000-0x00007FF626CD2000-memory.dmp	xmrig
behavioral2/memory/4392-130-0x00007FF691770000-0x00007FF691B62000-memory.dmp	xmrig
behavioral2/memory/3904-128-0x00007FF79AA80000-0x00007FF79AE72000-memory.dmp	xmrig
behavioral2/memory/3104-120-0x00007FF648580000-0x00007FF648972000-memory.dmp	xmrig
behavioral2/memory/1648-111-0x00007FF719D70000-0x00007FF71A162000-memory.dmp	xmrig
behavioral2/memory/452-97-0x00007FF762C20000-0x00007FF763012000-memory.dmp	xmrig
behavioral2/memory/1552-87-0x00007FF736740000-0x00007FF736B32000-memory.dmp	xmrig
behavioral2/memory/3712-86-0x00007FF630BA0000-0x00007FF630F92000-memory.dmp	xmrig
behavioral2/memory/2152-82-0x00007FF72CE30000-0x00007FF72D222000-memory.dmp	xmrig
behavioral2/memory/2860-67-0x00007FF6BBB40000-0x00007FF6BBF32000-memory.dmp	xmrig
behavioral2/memory/4732-64-0x00007FF7EDD30000-0x00007FF7EE122000-memory.dmp	xmrig
behavioral2/memory/2384-61-0x00007FF6DC940000-0x00007FF6DCD32000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	5004	powershell.exe
9	5004	powershell.exe

Executes dropped EXE 51 IoCs

pid	Process
3104	HARNdws.exe
2384	bnXMcBR.exe
4732	HbsAZJl.exe
2860	CwxOsFz.exe
2152	MapHtcc.exe
3712	glIPpzM.exe
1552	JoAZJzR.exe
452	HdWCMlg.exe
1032	wHkYIHr.exe
3904	jgdFVah.exe
4392	RPTbKfR.exe
2232	tLTwleq.exe
1812	WDyJSar.exe
1648	qnOCJFu.exe
636	OsSUVgQ.exe
3100	MHvATFM.exe
3676	CvFGnfw.exe
4176	lwavArZ.exe
3644	zytKQKx.exe
4484	QBSAEvb.exe
4052	camqwBN.exe
3648	ucAzIhS.exe
3336	XNXubhT.exe
4604	nhFhnAS.exe
4196	ymiDbGb.exe
3456	qtckukk.exe
756	TtUaMCT.exe
1860	RSZTarb.exe
1504	JTopdxB.exe
1248	YOGuOCK.exe
3652	KZCImgy.exe
1776	BPfMEKV.exe
3868	iXltkfx.exe
2828	yTDRMRH.exe
1752	ZOaDhTJ.exe
2284	PqufuFz.exe
5092	EnJJSuD.exe
2176	Jriztjh.exe
4724	wyAMtWB.exe
4492	WSdRHRa.exe
4984	AFEYvDR.exe
3784	yxGGIgd.exe
732	SeQKbOY.exe
4772	GSUuNyW.exe
2716	FHbdzHN.exe
1968	KwxiASV.exe
4740	FXzREhD.exe
3372	CdLoXWe.exe
1492	DdrOPOP.exe
3884	YJUnwYN.exe
4648	frdFxAc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4836-0-0x00007FF7D21C0000-0x00007FF7D25B2000-memory.dmp	upx
behavioral2/files/0x0008000000023261-4.dat	upx
behavioral2/files/0x0008000000023264-10.dat	upx
behavioral2/files/0x0008000000023267-9.dat	upx
behavioral2/files/0x0008000000023265-30.dat	upx
behavioral2/files/0x0009000000023269-35.dat	upx
behavioral2/files/0x000800000002326a-39.dat	upx
behavioral2/files/0x000700000002326c-50.dat	upx
behavioral2/files/0x000700000002326d-65.dat	upx
behavioral2/files/0x000700000002326f-68.dat	upx
behavioral2/files/0x0007000000023270-77.dat	upx
behavioral2/files/0x0007000000023272-85.dat	upx
behavioral2/files/0x0007000000023274-98.dat	upx
behavioral2/memory/1812-102-0x00007FF76B8F0000-0x00007FF76BCE2000-memory.dmp	upx
behavioral2/files/0x0007000000023276-114.dat	upx
behavioral2/memory/3100-115-0x00007FF7498F0000-0x00007FF749CE2000-memory.dmp	upx
behavioral2/memory/1032-125-0x00007FF6D4590000-0x00007FF6D4982000-memory.dmp	upx
behavioral2/files/0x0007000000023279-129.dat	upx
behavioral2/memory/636-134-0x00007FF7A0180000-0x00007FF7A0572000-memory.dmp	upx
behavioral2/memory/4176-136-0x00007FF73F640000-0x00007FF73FA32000-memory.dmp	upx
behavioral2/memory/3644-138-0x00007FF755360000-0x00007FF755752000-memory.dmp	upx
behavioral2/memory/4052-139-0x00007FF6DD800000-0x00007FF6DDBF2000-memory.dmp	upx
behavioral2/files/0x000700000002327a-143.dat	upx
behavioral2/memory/4484-137-0x00007FF736A40000-0x00007FF736E32000-memory.dmp	upx
behavioral2/files/0x000700000002327b-151.dat	upx
behavioral2/files/0x000700000002327d-157.dat	upx
behavioral2/files/0x000700000002327f-168.dat	upx
behavioral2/files/0x0007000000023280-176.dat	upx
behavioral2/memory/3648-250-0x00007FF699910000-0x00007FF699D02000-memory.dmp	upx
behavioral2/memory/4196-253-0x00007FF7B75D0000-0x00007FF7B79C2000-memory.dmp	upx
behavioral2/memory/4836-256-0x00007FF7D21C0000-0x00007FF7D25B2000-memory.dmp	upx
behavioral2/memory/756-255-0x00007FF7F0350000-0x00007FF7F0742000-memory.dmp	upx
behavioral2/memory/1860-257-0x00007FF674A40000-0x00007FF674E32000-memory.dmp	upx
behavioral2/memory/3652-260-0x00007FF69C310000-0x00007FF69C702000-memory.dmp	upx
behavioral2/memory/1776-261-0x00007FF670300000-0x00007FF6706F2000-memory.dmp	upx
behavioral2/memory/2828-263-0x00007FF67AC80000-0x00007FF67B072000-memory.dmp	upx
behavioral2/memory/3868-262-0x00007FF6D6200000-0x00007FF6D65F2000-memory.dmp	upx
behavioral2/memory/1248-259-0x00007FF60F830000-0x00007FF60FC22000-memory.dmp	upx
behavioral2/memory/1752-270-0x00007FF7CA5D0000-0x00007FF7CA9C2000-memory.dmp	upx
behavioral2/memory/2284-274-0x00007FF6306D0000-0x00007FF630AC2000-memory.dmp	upx
behavioral2/memory/2176-276-0x00007FF7FD4D0000-0x00007FF7FD8C2000-memory.dmp	upx
behavioral2/memory/4724-279-0x00007FF6030F0000-0x00007FF6034E2000-memory.dmp	upx
behavioral2/memory/5092-275-0x00007FF728A50000-0x00007FF728E42000-memory.dmp	upx
behavioral2/memory/4984-283-0x00007FF6F8CC0000-0x00007FF6F90B2000-memory.dmp	upx
behavioral2/memory/4492-282-0x00007FF6600A0000-0x00007FF660492000-memory.dmp	upx
behavioral2/memory/1504-258-0x00007FF68ED20000-0x00007FF68F112000-memory.dmp	upx
behavioral2/memory/3784-287-0x00007FF656A40000-0x00007FF656E32000-memory.dmp	upx
behavioral2/memory/3456-254-0x00007FF760560000-0x00007FF760952000-memory.dmp	upx
behavioral2/memory/4604-252-0x00007FF7CA660000-0x00007FF7CAA52000-memory.dmp	upx
behavioral2/memory/4772-293-0x00007FF7436A0000-0x00007FF743A92000-memory.dmp	upx
behavioral2/memory/732-292-0x00007FF630260000-0x00007FF630652000-memory.dmp	upx
behavioral2/memory/2716-296-0x00007FF6CDF80000-0x00007FF6CE372000-memory.dmp	upx
behavioral2/memory/4740-299-0x00007FF741890000-0x00007FF741C82000-memory.dmp	upx
behavioral2/memory/3372-302-0x00007FF67F9A0000-0x00007FF67FD92000-memory.dmp	upx
behavioral2/memory/1492-304-0x00007FF6D3180000-0x00007FF6D3572000-memory.dmp	upx
behavioral2/memory/4648-306-0x00007FF709920000-0x00007FF709D12000-memory.dmp	upx
behavioral2/memory/4988-308-0x00007FF7657F0000-0x00007FF765BE2000-memory.dmp	upx
behavioral2/memory/3884-305-0x00007FF7B3780000-0x00007FF7B3B72000-memory.dmp	upx
behavioral2/memory/1968-298-0x00007FF636180000-0x00007FF636572000-memory.dmp	upx
behavioral2/memory/3336-251-0x00007FF6BA360000-0x00007FF6BA752000-memory.dmp	upx
behavioral2/files/0x0007000000023284-196.dat	upx
behavioral2/files/0x0007000000023285-195.dat	upx
behavioral2/files/0x0007000000023283-191.dat	upx
behavioral2/files/0x0007000000023282-185.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 52 IoCs

description	ioc	Process
File created	C:\Windows\System\MapHtcc.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\WSdRHRa.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\GSUuNyW.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\pjiSTpu.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\YOGuOCK.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\KZCImgy.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\SeQKbOY.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\CwxOsFz.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\lwavArZ.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\ymiDbGb.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\qtckukk.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\PqufuFz.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\yxGGIgd.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\frdFxAc.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\HdWCMlg.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\tLTwleq.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\WDyJSar.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\XNXubhT.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\BPfMEKV.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\Jriztjh.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\wHkYIHr.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\KwxiASV.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\RSZTarb.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\yTDRMRH.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\FHbdzHN.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\ZOaDhTJ.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\CvFGnfw.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\zytKQKx.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\HbsAZJl.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\wyAMtWB.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\YJUnwYN.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\JoAZJzR.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\qnOCJFu.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\ucAzIhS.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\JTopdxB.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\iXltkfx.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\bnXMcBR.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\camqwBN.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\CdLoXWe.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\QBSAEvb.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\nhFhnAS.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\HARNdws.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\glIPpzM.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\MHvATFM.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\OsSUVgQ.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\TtUaMCT.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\AFEYvDR.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\FXzREhD.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\jgdFVah.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\RPTbKfR.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\EnJJSuD.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
File created	C:\Windows\System\DdrOPOP.exe	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	powershell.exe
5004	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeLockMemoryPrivilege	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 5004	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	90
PID 4836 wrote to memory of 5004	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	90
PID 4836 wrote to memory of 3104	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	91
PID 4836 wrote to memory of 3104	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	91
PID 4836 wrote to memory of 2384	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	92
PID 4836 wrote to memory of 2384	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	92
PID 4836 wrote to memory of 4732	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	93
PID 4836 wrote to memory of 4732	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	93
PID 4836 wrote to memory of 2860	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	94
PID 4836 wrote to memory of 2860	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	94
PID 4836 wrote to memory of 2152	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	95
PID 4836 wrote to memory of 2152	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	95
PID 4836 wrote to memory of 3712	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	96
PID 4836 wrote to memory of 3712	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	96
PID 4836 wrote to memory of 1552	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	97
PID 4836 wrote to memory of 1552	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	97
PID 4836 wrote to memory of 452	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	98
PID 4836 wrote to memory of 452	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	98
PID 4836 wrote to memory of 1032	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	99
PID 4836 wrote to memory of 1032	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	99
PID 4836 wrote to memory of 3904	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	100
PID 4836 wrote to memory of 3904	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	100
PID 4836 wrote to memory of 4392	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	101
PID 4836 wrote to memory of 4392	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	101
PID 4836 wrote to memory of 2232	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	102
PID 4836 wrote to memory of 2232	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	102
PID 4836 wrote to memory of 1812	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	103
PID 4836 wrote to memory of 1812	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	103
PID 4836 wrote to memory of 1648	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	104
PID 4836 wrote to memory of 1648	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	104
PID 4836 wrote to memory of 636	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	105
PID 4836 wrote to memory of 636	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	105
PID 4836 wrote to memory of 3100	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	106
PID 4836 wrote to memory of 3100	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	106
PID 4836 wrote to memory of 3676	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	107
PID 4836 wrote to memory of 3676	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	107
PID 4836 wrote to memory of 4176	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	108
PID 4836 wrote to memory of 4176	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	108
PID 4836 wrote to memory of 3644	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	109
PID 4836 wrote to memory of 3644	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	109
PID 4836 wrote to memory of 4484	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	110
PID 4836 wrote to memory of 4484	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	110
PID 4836 wrote to memory of 4052	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	111
PID 4836 wrote to memory of 4052	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	111
PID 4836 wrote to memory of 3648	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	112
PID 4836 wrote to memory of 3648	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	112
PID 4836 wrote to memory of 3336	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	113
PID 4836 wrote to memory of 3336	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	113
PID 4836 wrote to memory of 4604	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	114
PID 4836 wrote to memory of 4604	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	114
PID 4836 wrote to memory of 4196	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	115
PID 4836 wrote to memory of 4196	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	115
PID 4836 wrote to memory of 3456	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	116
PID 4836 wrote to memory of 3456	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	116
PID 4836 wrote to memory of 756	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	117
PID 4836 wrote to memory of 756	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	117
PID 4836 wrote to memory of 1860	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	118
PID 4836 wrote to memory of 1860	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	118
PID 4836 wrote to memory of 1504	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	119
PID 4836 wrote to memory of 1504	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	119
PID 4836 wrote to memory of 1248	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	120
PID 4836 wrote to memory of 1248	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	120
PID 4836 wrote to memory of 3652	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	121
PID 4836 wrote to memory of 3652	4836	0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe	121

C:\Users\Admin\AppData\Local\Temp\0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0082092e8ddd209a12d23d72581f7e13_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\System\HARNdws.exe
  C:\Windows\System\HARNdws.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\bnXMcBR.exe
  C:\Windows\System\bnXMcBR.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\HbsAZJl.exe
  C:\Windows\System\HbsAZJl.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\CwxOsFz.exe
  C:\Windows\System\CwxOsFz.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\MapHtcc.exe
  C:\Windows\System\MapHtcc.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\glIPpzM.exe
  C:\Windows\System\glIPpzM.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\JoAZJzR.exe
  C:\Windows\System\JoAZJzR.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\HdWCMlg.exe
  C:\Windows\System\HdWCMlg.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\wHkYIHr.exe
  C:\Windows\System\wHkYIHr.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\jgdFVah.exe
  C:\Windows\System\jgdFVah.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\RPTbKfR.exe
  C:\Windows\System\RPTbKfR.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\tLTwleq.exe
  C:\Windows\System\tLTwleq.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\WDyJSar.exe
  C:\Windows\System\WDyJSar.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\qnOCJFu.exe
  C:\Windows\System\qnOCJFu.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\OsSUVgQ.exe
  C:\Windows\System\OsSUVgQ.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\MHvATFM.exe
  C:\Windows\System\MHvATFM.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\CvFGnfw.exe
  C:\Windows\System\CvFGnfw.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\lwavArZ.exe
  C:\Windows\System\lwavArZ.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\zytKQKx.exe
  C:\Windows\System\zytKQKx.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\QBSAEvb.exe
  C:\Windows\System\QBSAEvb.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\camqwBN.exe
  C:\Windows\System\camqwBN.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\ucAzIhS.exe
  C:\Windows\System\ucAzIhS.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\XNXubhT.exe
  C:\Windows\System\XNXubhT.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\nhFhnAS.exe
  C:\Windows\System\nhFhnAS.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\ymiDbGb.exe
  C:\Windows\System\ymiDbGb.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\qtckukk.exe
  C:\Windows\System\qtckukk.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\TtUaMCT.exe
  C:\Windows\System\TtUaMCT.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\RSZTarb.exe
  C:\Windows\System\RSZTarb.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\JTopdxB.exe
  C:\Windows\System\JTopdxB.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\YOGuOCK.exe
  C:\Windows\System\YOGuOCK.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\KZCImgy.exe
  C:\Windows\System\KZCImgy.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\BPfMEKV.exe
  C:\Windows\System\BPfMEKV.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\iXltkfx.exe
  C:\Windows\System\iXltkfx.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\yTDRMRH.exe
  C:\Windows\System\yTDRMRH.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\ZOaDhTJ.exe
  C:\Windows\System\ZOaDhTJ.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\PqufuFz.exe
  C:\Windows\System\PqufuFz.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\EnJJSuD.exe
  C:\Windows\System\EnJJSuD.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\Jriztjh.exe
  C:\Windows\System\Jriztjh.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\wyAMtWB.exe
  C:\Windows\System\wyAMtWB.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\WSdRHRa.exe
  C:\Windows\System\WSdRHRa.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\AFEYvDR.exe
  C:\Windows\System\AFEYvDR.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\yxGGIgd.exe
  C:\Windows\System\yxGGIgd.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\SeQKbOY.exe
  C:\Windows\System\SeQKbOY.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\GSUuNyW.exe
  C:\Windows\System\GSUuNyW.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\FHbdzHN.exe
  C:\Windows\System\FHbdzHN.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\KwxiASV.exe
  C:\Windows\System\KwxiASV.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\FXzREhD.exe
  C:\Windows\System\FXzREhD.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\CdLoXWe.exe
  C:\Windows\System\CdLoXWe.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\DdrOPOP.exe
  C:\Windows\System\DdrOPOP.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\YJUnwYN.exe
  C:\Windows\System\YJUnwYN.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\frdFxAc.exe
  C:\Windows\System\frdFxAc.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\pjiSTpu.exe
  C:\Windows\System\pjiSTpu.exe
  2⤵
  PID:4988
- C:\Windows\System\iEmqSsc.exe
  C:\Windows\System\iEmqSsc.exe
  2⤵
  PID:2348
- C:\Windows\System\VOnvhFF.exe
  C:\Windows\System\VOnvhFF.exe
  2⤵
  PID:4960
- C:\Windows\System\QICpyIQ.exe
  C:\Windows\System\QICpyIQ.exe
  2⤵
  PID:2236
- C:\Windows\System\HABnFGX.exe
  C:\Windows\System\HABnFGX.exe
  2⤵
  PID:2240
- C:\Windows\System\meEtoZe.exe
  C:\Windows\System\meEtoZe.exe
  2⤵
  PID:2372
- C:\Windows\System\binesCu.exe
  C:\Windows\System\binesCu.exe
  2⤵
  PID:4620
- C:\Windows\System\wwQPYKk.exe
  C:\Windows\System\wwQPYKk.exe
  2⤵
  PID:1120
- C:\Windows\System\dDMDAHO.exe
  C:\Windows\System\dDMDAHO.exe
  2⤵
  PID:4032
- C:\Windows\System\awrkeFd.exe
  C:\Windows\System\awrkeFd.exe
  2⤵
  PID:3860
- C:\Windows\System\NjBmEQW.exe
  C:\Windows\System\NjBmEQW.exe
  2⤵
  PID:4564
- C:\Windows\System\zMFsCSG.exe
  C:\Windows\System\zMFsCSG.exe
  2⤵
  PID:464
- C:\Windows\System\yGuSFxW.exe
  C:\Windows\System\yGuSFxW.exe
  2⤵
  PID:2356
- C:\Windows\System\vWhaSQr.exe
  C:\Windows\System\vWhaSQr.exe
  2⤵
  PID:972
- C:\Windows\System\nWkhTVV.exe
  C:\Windows\System\nWkhTVV.exe
  2⤵
  PID:1432
- C:\Windows\System\acDISXi.exe
  C:\Windows\System\acDISXi.exe
  2⤵
  PID:2824
- C:\Windows\System\PsvgqhQ.exe
  C:\Windows\System\PsvgqhQ.exe
  2⤵
  PID:3216
- C:\Windows\System\vKaMfwi.exe
  C:\Windows\System\vKaMfwi.exe
  2⤵
  PID:1684
- C:\Windows\System\wqjhQNb.exe
  C:\Windows\System\wqjhQNb.exe
  2⤵
  PID:1076
- C:\Windows\System\dcurymN.exe
  C:\Windows\System\dcurymN.exe
  2⤵
  PID:2648
- C:\Windows\System\ioytAoI.exe
  C:\Windows\System\ioytAoI.exe
  2⤵
  PID:512
- C:\Windows\System\EXdhXfT.exe
  C:\Windows\System\EXdhXfT.exe
  2⤵
  PID:432
- C:\Windows\System\yevWSDb.exe
  C:\Windows\System\yevWSDb.exe
  2⤵
  PID:5152
- C:\Windows\System\QTkneRy.exe
  C:\Windows\System\QTkneRy.exe
  2⤵
  PID:5180
- C:\Windows\System\JZjekBm.exe
  C:\Windows\System\JZjekBm.exe
  2⤵
  PID:5204
- C:\Windows\System\wdVpxpc.exe
  C:\Windows\System\wdVpxpc.exe
  2⤵
  PID:5224
- C:\Windows\System\utNLeWC.exe
  C:\Windows\System\utNLeWC.exe
  2⤵
  PID:5256
- C:\Windows\System\NpHoPvY.exe
  C:\Windows\System\NpHoPvY.exe
  2⤵
  PID:5292
- C:\Windows\System\ZzgQYSm.exe
  C:\Windows\System\ZzgQYSm.exe
  2⤵
  PID:5340
- C:\Windows\System\lmOZXCM.exe
  C:\Windows\System\lmOZXCM.exe
  2⤵
  PID:5360
- C:\Windows\System\lvlHRhj.exe
  C:\Windows\System\lvlHRhj.exe
  2⤵
  PID:5404
- C:\Windows\System\odPoMIa.exe
  C:\Windows\System\odPoMIa.exe
  2⤵
  PID:5420
- C:\Windows\System\TEbxwIU.exe
  C:\Windows\System\TEbxwIU.exe
  2⤵
  PID:5440
- C:\Windows\System\FdEidKI.exe
  C:\Windows\System\FdEidKI.exe
  2⤵
  PID:5484
- C:\Windows\System\RFAWfiP.exe
  C:\Windows\System\RFAWfiP.exe
  2⤵
  PID:5504
- C:\Windows\System\UonCFfG.exe
  C:\Windows\System\UonCFfG.exe
  2⤵
  PID:5544
- C:\Windows\System\OkOwPxF.exe
  C:\Windows\System\OkOwPxF.exe
  2⤵
  PID:5568
- C:\Windows\System\bZNPbCV.exe
  C:\Windows\System\bZNPbCV.exe
  2⤵
  PID:5584
- C:\Windows\System\qAJdZMd.exe
  C:\Windows\System\qAJdZMd.exe
  2⤵
  PID:5600
- C:\Windows\System\OqMTBvL.exe
  C:\Windows\System\OqMTBvL.exe
  2⤵
  PID:5624
- C:\Windows\System\BenIGfx.exe
  C:\Windows\System\BenIGfx.exe
  2⤵
  PID:5640
- C:\Windows\System\chgVkPv.exe
  C:\Windows\System\chgVkPv.exe
  2⤵
  PID:5672
- C:\Windows\System\UCrVknp.exe
  C:\Windows\System\UCrVknp.exe
  2⤵
  PID:5692
- C:\Windows\System\gXYtALP.exe
  C:\Windows\System\gXYtALP.exe
  2⤵
  PID:5708
- C:\Windows\System\yGsTQcU.exe
  C:\Windows\System\yGsTQcU.exe
  2⤵
  PID:5728
- C:\Windows\System\XphXmYt.exe
  C:\Windows\System\XphXmYt.exe
  2⤵
  PID:5772
- C:\Windows\System\wPxrbnx.exe
  C:\Windows\System\wPxrbnx.exe
  2⤵
  PID:5800
- C:\Windows\System\egBhGfA.exe
  C:\Windows\System\egBhGfA.exe
  2⤵
  PID:5820
- C:\Windows\System\uOoaWnh.exe
  C:\Windows\System\uOoaWnh.exe
  2⤵
  PID:5836
- C:\Windows\System\jHJmJSa.exe
  C:\Windows\System\jHJmJSa.exe
  2⤵
  PID:5856
- C:\Windows\System\KMdSKOh.exe
  C:\Windows\System\KMdSKOh.exe
  2⤵
  PID:5912
- C:\Windows\System\QsIxmHY.exe
  C:\Windows\System\QsIxmHY.exe
  2⤵
  PID:5932
- C:\Windows\System\fWqRLSd.exe
  C:\Windows\System\fWqRLSd.exe
  2⤵
  PID:5952
- C:\Windows\System\MTjPHaD.exe
  C:\Windows\System\MTjPHaD.exe
  2⤵
  PID:5972
- C:\Windows\System\ePLFuJn.exe
  C:\Windows\System\ePLFuJn.exe
  2⤵
  PID:5992
- C:\Windows\System\tpQREQU.exe
  C:\Windows\System\tpQREQU.exe
  2⤵
  PID:6008
- C:\Windows\System\temiIFF.exe
  C:\Windows\System\temiIFF.exe
  2⤵
  PID:6096
- C:\Windows\System\CanTmoA.exe
  C:\Windows\System\CanTmoA.exe
  2⤵
  PID:6116
- C:\Windows\System\BwCmZSI.exe
  C:\Windows\System\BwCmZSI.exe
  2⤵
  PID:6132
- C:\Windows\System\xIpGcGD.exe
  C:\Windows\System\xIpGcGD.exe
  2⤵
  PID:4560
- C:\Windows\System\IIjcRgw.exe
  C:\Windows\System\IIjcRgw.exe
  2⤵
  PID:5220
- C:\Windows\System\XFcBFLz.exe
  C:\Windows\System\XFcBFLz.exe
  2⤵
  PID:5200
- C:\Windows\System\HJUpTVk.exe
  C:\Windows\System\HJUpTVk.exe
  2⤵
  PID:5316
- C:\Windows\System\qHbNUwX.exe
  C:\Windows\System\qHbNUwX.exe
  2⤵
  PID:5348
- C:\Windows\System\hKuwiEH.exe
  C:\Windows\System\hKuwiEH.exe
  2⤵
  PID:5352
- C:\Windows\System\QSuewmX.exe
  C:\Windows\System\QSuewmX.exe
  2⤵
  PID:5412
- C:\Windows\System\mnHvysX.exe
  C:\Windows\System\mnHvysX.exe
  2⤵
  PID:5500
- C:\Windows\System\EgwwACt.exe
  C:\Windows\System\EgwwACt.exe
  2⤵
  PID:5472
- C:\Windows\System\UbsbBZs.exe
  C:\Windows\System\UbsbBZs.exe
  2⤵
  PID:5552
- C:\Windows\System\OzNDkoA.exe
  C:\Windows\System\OzNDkoA.exe
  2⤵
  PID:5596
- C:\Windows\System\DQnyoyb.exe
  C:\Windows\System\DQnyoyb.exe
  2⤵
  PID:5612
- C:\Windows\System\loenHXQ.exe
  C:\Windows\System\loenHXQ.exe
  2⤵
  PID:5168
- C:\Windows\System\JlsKIer.exe
  C:\Windows\System\JlsKIer.exe
  2⤵
  PID:5688
- C:\Windows\System\ODcalgV.exe
  C:\Windows\System\ODcalgV.exe
  2⤵
  PID:5724
- C:\Windows\System\MZUomsb.exe
  C:\Windows\System\MZUomsb.exe
  2⤵
  PID:5808
- C:\Windows\System\jtvvCyk.exe
  C:\Windows\System\jtvvCyk.exe
  2⤵
  PID:5740
- C:\Windows\System\zciVCLV.exe
  C:\Windows\System\zciVCLV.exe
  2⤵
  PID:5984
- C:\Windows\System\tEJYyGP.exe
  C:\Windows\System\tEJYyGP.exe
  2⤵
  PID:1692
- C:\Windows\System\sbjoWKt.exe
  C:\Windows\System\sbjoWKt.exe
  2⤵
  PID:5852
- C:\Windows\System\JHTcVNn.exe
  C:\Windows\System\JHTcVNn.exe
  2⤵
  PID:5960
- C:\Windows\System\zocTKzD.exe
  C:\Windows\System\zocTKzD.exe
  2⤵
  PID:6128
- C:\Windows\System\iJkJbMt.exe
  C:\Windows\System\iJkJbMt.exe
  2⤵
  PID:6048
- C:\Windows\System\iKukopE.exe
  C:\Windows\System\iKukopE.exe
  2⤵
  PID:6072
- C:\Windows\System\UEYKkmP.exe
  C:\Windows\System\UEYKkmP.exe
  2⤵
  PID:6032
- C:\Windows\System\pBwbjzJ.exe
  C:\Windows\System\pBwbjzJ.exe
  2⤵
  PID:4428
- C:\Windows\System\rkezvpl.exe
  C:\Windows\System\rkezvpl.exe
  2⤵
  PID:5468
- C:\Windows\System\GXQRSVU.exe
  C:\Windows\System\GXQRSVU.exe
  2⤵
  PID:5580
- C:\Windows\System\khEasvW.exe
  C:\Windows\System\khEasvW.exe
  2⤵
  PID:5192
- C:\Windows\System\imDOLKY.exe
  C:\Windows\System\imDOLKY.exe
  2⤵
  PID:1652
- C:\Windows\System\eqCAyQE.exe
  C:\Windows\System\eqCAyQE.exe
  2⤵
  PID:1980
- C:\Windows\System\vLESUBb.exe
  C:\Windows\System\vLESUBb.exe
  2⤵
  PID:5812
- C:\Windows\System\ipouNBd.exe
  C:\Windows\System\ipouNBd.exe
  2⤵
  PID:6152
- C:\Windows\System\jdnvPzT.exe
  C:\Windows\System\jdnvPzT.exe
  2⤵
  PID:6172
- C:\Windows\System\yFHIsQR.exe
  C:\Windows\System\yFHIsQR.exe
  2⤵
  PID:6200
- C:\Windows\System\qHNfAkp.exe
  C:\Windows\System\qHNfAkp.exe
  2⤵
  PID:6236
- C:\Windows\System\ZGPeiqX.exe
  C:\Windows\System\ZGPeiqX.exe
  2⤵
  PID:6252
- C:\Windows\System\wPnQKkK.exe
  C:\Windows\System\wPnQKkK.exe
  2⤵
  PID:6280
- C:\Windows\System\kKbuZPL.exe
  C:\Windows\System\kKbuZPL.exe
  2⤵
  PID:6300
- C:\Windows\System\LTYbXiZ.exe
  C:\Windows\System\LTYbXiZ.exe
  2⤵
  PID:6320
- C:\Windows\System\rGTHMQy.exe
  C:\Windows\System\rGTHMQy.exe
  2⤵
  PID:6336
- C:\Windows\System\xxuCLeT.exe
  C:\Windows\System\xxuCLeT.exe
  2⤵
  PID:6360
- C:\Windows\System\ezIDokx.exe
  C:\Windows\System\ezIDokx.exe
  2⤵
  PID:6376
- C:\Windows\System\jlgNqtJ.exe
  C:\Windows\System\jlgNqtJ.exe
  2⤵
  PID:6400
- C:\Windows\System\XdeSlVS.exe
  C:\Windows\System\XdeSlVS.exe
  2⤵
  PID:6416
- C:\Windows\System\kZZNLhi.exe
  C:\Windows\System\kZZNLhi.exe
  2⤵
  PID:6440
- C:\Windows\System\WtaLjUK.exe
  C:\Windows\System\WtaLjUK.exe
  2⤵
  PID:6464
- C:\Windows\System\CCoeXqE.exe
  C:\Windows\System\CCoeXqE.exe
  2⤵
  PID:6672
- C:\Windows\System\hAeUCgS.exe
  C:\Windows\System\hAeUCgS.exe
  2⤵
  PID:6692
- C:\Windows\System\DLchrSG.exe
  C:\Windows\System\DLchrSG.exe
  2⤵
  PID:6708
- C:\Windows\System\uwsteDF.exe
  C:\Windows\System\uwsteDF.exe
  2⤵
  PID:6728
- C:\Windows\System\fdkcgqK.exe
  C:\Windows\System\fdkcgqK.exe
  2⤵
  PID:6756
- C:\Windows\System\rNGqlPT.exe
  C:\Windows\System\rNGqlPT.exe
  2⤵
  PID:6776
- C:\Windows\System\LetSwSh.exe
  C:\Windows\System\LetSwSh.exe
  2⤵
  PID:6800
- C:\Windows\System\PBCiTmA.exe
  C:\Windows\System\PBCiTmA.exe
  2⤵
  PID:6816
- C:\Windows\System\hlfCsnf.exe
  C:\Windows\System\hlfCsnf.exe
  2⤵
  PID:6836
- C:\Windows\System\qjzeoGZ.exe
  C:\Windows\System\qjzeoGZ.exe
  2⤵
  PID:6852
- C:\Windows\System\MsExJXL.exe
  C:\Windows\System\MsExJXL.exe
  2⤵
  PID:6888
- C:\Windows\System\OOdgjjM.exe
  C:\Windows\System\OOdgjjM.exe
  2⤵
  PID:6904
- C:\Windows\System\eyigOCc.exe
  C:\Windows\System\eyigOCc.exe
  2⤵
  PID:6924
- C:\Windows\System\UrOITyw.exe
  C:\Windows\System\UrOITyw.exe
  2⤵
  PID:6944
- C:\Windows\System\OKsQEtC.exe
  C:\Windows\System\OKsQEtC.exe
  2⤵
  PID:6960
- C:\Windows\System\mEFLfyK.exe
  C:\Windows\System\mEFLfyK.exe
  2⤵
  PID:6980
- C:\Windows\System\KkPTTTU.exe
  C:\Windows\System\KkPTTTU.exe
  2⤵
  PID:7004
- C:\Windows\System\EIpcAZa.exe
  C:\Windows\System\EIpcAZa.exe
  2⤵
  PID:7020
- C:\Windows\System\KCQPyZp.exe
  C:\Windows\System\KCQPyZp.exe
  2⤵
  PID:7044
- C:\Windows\System\CUYtVJS.exe
  C:\Windows\System\CUYtVJS.exe
  2⤵
  PID:7060
- C:\Windows\System\GqoOaxs.exe
  C:\Windows\System\GqoOaxs.exe
  2⤵
  PID:7088
- C:\Windows\System\ZtcEWPq.exe
  C:\Windows\System\ZtcEWPq.exe
  2⤵
  PID:7104
- C:\Windows\System\AFuvGpi.exe
  C:\Windows\System\AFuvGpi.exe
  2⤵
  PID:7124
- C:\Windows\System\LegdxnW.exe
  C:\Windows\System\LegdxnW.exe
  2⤵
  PID:7156
- C:\Windows\System\ppSQRoW.exe
  C:\Windows\System\ppSQRoW.exe
  2⤵
  PID:1624
- C:\Windows\System\TcqIvGY.exe
  C:\Windows\System\TcqIvGY.exe
  2⤵
  PID:4456
- C:\Windows\System\KRoHUYs.exe
  C:\Windows\System\KRoHUYs.exe
  2⤵
  PID:5720
- C:\Windows\System\EXtalRi.exe
  C:\Windows\System\EXtalRi.exe
  2⤵
  PID:6272
- C:\Windows\System\lUMyCDj.exe
  C:\Windows\System\lUMyCDj.exe
  2⤵
  PID:6448
- C:\Windows\System\BejqAQH.exe
  C:\Windows\System\BejqAQH.exe
  2⤵
  PID:5780
- C:\Windows\System\SvoaFfq.exe
  C:\Windows\System\SvoaFfq.exe
  2⤵
  PID:5240
- C:\Windows\System\DAqmWXR.exe
  C:\Windows\System\DAqmWXR.exe
  2⤵
  PID:6124
- C:\Windows\System\iLbQFqa.exe
  C:\Windows\System\iLbQFqa.exe
  2⤵
  PID:6052
- C:\Windows\System\NHJqSoQ.exe
  C:\Windows\System\NHJqSoQ.exe
  2⤵
  PID:5236
- C:\Windows\System\AwYOHhn.exe
  C:\Windows\System\AwYOHhn.exe
  2⤵
  PID:6556
- C:\Windows\System\izcLUfh.exe
  C:\Windows\System\izcLUfh.exe
  2⤵
  PID:6328
- C:\Windows\System\mGfnaXk.exe
  C:\Windows\System\mGfnaXk.exe
  2⤵
  PID:6412
- C:\Windows\System\EZRnsfg.exe
  C:\Windows\System\EZRnsfg.exe
  2⤵
  PID:5684
- C:\Windows\System\GIlkNLf.exe
  C:\Windows\System\GIlkNLf.exe
  2⤵
  PID:5528
- C:\Windows\System\KuABtYb.exe
  C:\Windows\System\KuABtYb.exe
  2⤵
  PID:6188
- C:\Windows\System\LvJgscf.exe
  C:\Windows\System\LvJgscf.exe
  2⤵
  PID:6512
- C:\Windows\System\RcSeiUS.exe
  C:\Windows\System\RcSeiUS.exe
  2⤵
  PID:6792
- C:\Windows\System\pEzQgvN.exe
  C:\Windows\System\pEzQgvN.exe
  2⤵
  PID:6848
- C:\Windows\System\slKWXAY.exe
  C:\Windows\System\slKWXAY.exe
  2⤵
  PID:6264
- C:\Windows\System\mRNjMqx.exe
  C:\Windows\System\mRNjMqx.exe
  2⤵
  PID:6916
- C:\Windows\System\YGhYJtG.exe
  C:\Windows\System\YGhYJtG.exe
  2⤵
  PID:6344
- C:\Windows\System\nIbaDRT.exe
  C:\Windows\System\nIbaDRT.exe
  2⤵
  PID:6968
- C:\Windows\System\mdUqrgo.exe
  C:\Windows\System\mdUqrgo.exe
  2⤵
  PID:6996
- C:\Windows\System\EinCGJO.exe
  C:\Windows\System\EinCGJO.exe
  2⤵
  PID:7180
- C:\Windows\System\aeBUUlg.exe
  C:\Windows\System\aeBUUlg.exe
  2⤵
  PID:7200
- C:\Windows\System\pmTqtFl.exe
  C:\Windows\System\pmTqtFl.exe
  2⤵
  PID:7220
- C:\Windows\System\zxzkiUk.exe
  C:\Windows\System\zxzkiUk.exe
  2⤵
  PID:7244
- C:\Windows\System\YyGqROe.exe
  C:\Windows\System\YyGqROe.exe
  2⤵
  PID:7344
- C:\Windows\System\LNQmXsY.exe
  C:\Windows\System\LNQmXsY.exe
  2⤵
  PID:7364
- C:\Windows\System\pWbEjqS.exe
  C:\Windows\System\pWbEjqS.exe
  2⤵
  PID:7384
- C:\Windows\System\DWThTcC.exe
  C:\Windows\System\DWThTcC.exe
  2⤵
  PID:7408
- C:\Windows\System\fWXwgIe.exe
  C:\Windows\System\fWXwgIe.exe
  2⤵
  PID:7428
- C:\Windows\System\pICunbk.exe
  C:\Windows\System\pICunbk.exe
  2⤵
  PID:7448
- C:\Windows\System\KMGDVbN.exe
  C:\Windows\System\KMGDVbN.exe
  2⤵
  PID:7472
- C:\Windows\System\sWuhZwj.exe
  C:\Windows\System\sWuhZwj.exe
  2⤵
  PID:7492
- C:\Windows\System\AQwdNdR.exe
  C:\Windows\System\AQwdNdR.exe
  2⤵
  PID:7512
- C:\Windows\System\syNdAeF.exe
  C:\Windows\System\syNdAeF.exe
  2⤵
  PID:7532
- C:\Windows\System\hdDUscP.exe
  C:\Windows\System\hdDUscP.exe
  2⤵
  PID:7556
- C:\Windows\System\aodJkyE.exe
  C:\Windows\System\aodJkyE.exe
  2⤵
  PID:7572
- C:\Windows\System\PTokWom.exe
  C:\Windows\System\PTokWom.exe
  2⤵
  PID:7592
- C:\Windows\System\EikwBvK.exe
  C:\Windows\System\EikwBvK.exe
  2⤵
  PID:7616
- C:\Windows\System\wisyNNE.exe
  C:\Windows\System\wisyNNE.exe
  2⤵
  PID:7636
- C:\Windows\System\AGXxFRQ.exe
  C:\Windows\System\AGXxFRQ.exe
  2⤵
  PID:7660
- C:\Windows\System\DdxtIpL.exe
  C:\Windows\System\DdxtIpL.exe
  2⤵
  PID:7676
- C:\Windows\System\BQJuKDu.exe
  C:\Windows\System\BQJuKDu.exe
  2⤵
  PID:7700
- C:\Windows\System\raxnybO.exe
  C:\Windows\System\raxnybO.exe
  2⤵
  PID:7720
- C:\Windows\System\jIyezWJ.exe
  C:\Windows\System\jIyezWJ.exe
  2⤵
  PID:7736
- C:\Windows\System\TSmDLfz.exe
  C:\Windows\System\TSmDLfz.exe
  2⤵
  PID:7756
- C:\Windows\System\SdbFGcP.exe
  C:\Windows\System\SdbFGcP.exe
  2⤵
  PID:7776
- C:\Windows\System\HJZMCJN.exe
  C:\Windows\System\HJZMCJN.exe
  2⤵
  PID:7792
- C:\Windows\System\yAwOrai.exe
  C:\Windows\System\yAwOrai.exe
  2⤵
  PID:7816
- C:\Windows\System\qMGGCsl.exe
  C:\Windows\System\qMGGCsl.exe
  2⤵
  PID:7840
- C:\Windows\System\JCqVtxA.exe
  C:\Windows\System\JCqVtxA.exe
  2⤵
  PID:7860
- C:\Windows\System\KWdnYrE.exe
  C:\Windows\System\KWdnYrE.exe
  2⤵
  PID:7880
- C:\Windows\System\UszfWnY.exe
  C:\Windows\System\UszfWnY.exe
  2⤵
  PID:7896
- C:\Windows\System\pwYyajm.exe
  C:\Windows\System\pwYyajm.exe
  2⤵
  PID:7916
- C:\Windows\System\FhqXpuN.exe
  C:\Windows\System\FhqXpuN.exe
  2⤵
  PID:7932
- C:\Windows\System\pdzVJjO.exe
  C:\Windows\System\pdzVJjO.exe
  2⤵
  PID:7960
- C:\Windows\System\EsUCkWi.exe
  C:\Windows\System\EsUCkWi.exe
  2⤵
  PID:7976
- C:\Windows\System\mezmriD.exe
  C:\Windows\System\mezmriD.exe
  2⤵
  PID:8004
- C:\Windows\System\dZyeOjc.exe
  C:\Windows\System\dZyeOjc.exe
  2⤵
  PID:8028
- C:\Windows\System\eRuPCgb.exe
  C:\Windows\System\eRuPCgb.exe
  2⤵
  PID:8044
- C:\Windows\System\fxMQRwg.exe
  C:\Windows\System\fxMQRwg.exe
  2⤵
  PID:8064
- C:\Windows\System\HUZHIzn.exe
  C:\Windows\System\HUZHIzn.exe
  2⤵
  PID:8092
- C:\Windows\System\sJLVHIl.exe
  C:\Windows\System\sJLVHIl.exe
  2⤵
  PID:8108
- C:\Windows\System\YBNqKMj.exe
  C:\Windows\System\YBNqKMj.exe
  2⤵
  PID:8128
- C:\Windows\System\KUhTPRD.exe
  C:\Windows\System\KUhTPRD.exe
  2⤵
  PID:8152
- C:\Windows\System\aOXxTzD.exe
  C:\Windows\System\aOXxTzD.exe
  2⤵
  PID:8176
- C:\Windows\System\jmBsgBB.exe
  C:\Windows\System\jmBsgBB.exe
  2⤵
  PID:7096
- C:\Windows\System\PRDPHOq.exe
  C:\Windows\System\PRDPHOq.exe
  2⤵
  PID:6492
- C:\Windows\System\JMjxLnx.exe
  C:\Windows\System\JMjxLnx.exe
  2⤵
  PID:4252
- C:\Windows\System\upZINDy.exe
  C:\Windows\System\upZINDy.exe
  2⤵
  PID:3656
- C:\Windows\System\CNuyIth.exe
  C:\Windows\System\CNuyIth.exe
  2⤵
  PID:5844
- C:\Windows\System\OtMPaQJ.exe
  C:\Windows\System\OtMPaQJ.exe
  2⤵
  PID:3708
- C:\Windows\System\JtPjiRI.exe
  C:\Windows\System\JtPjiRI.exe
  2⤵
  PID:6612
- C:\Windows\System\IfBhusH.exe
  C:\Windows\System\IfBhusH.exe
  2⤵
  PID:7016
- C:\Windows\System\VJtxYhZ.exe
  C:\Windows\System\VJtxYhZ.exe
  2⤵
  PID:7056
- C:\Windows\System\nASSiSq.exe
  C:\Windows\System\nASSiSq.exe
  2⤵
  PID:7216
- C:\Windows\System\eFmgfYg.exe
  C:\Windows\System\eFmgfYg.exe
  2⤵
  PID:5392
- C:\Windows\System\WhfuBYf.exe
  C:\Windows\System\WhfuBYf.exe
  2⤵
  PID:5848
- C:\Windows\System\RxPPoxr.exe
  C:\Windows\System\RxPPoxr.exe
  2⤵
  PID:7380
- C:\Windows\System\OeoBgaQ.exe
  C:\Windows\System\OeoBgaQ.exe
  2⤵
  PID:6660
- C:\Windows\System\sVyvoiV.exe
  C:\Windows\System\sVyvoiV.exe
  2⤵
  PID:7372
- C:\Windows\System\XKEBAwS.exe
  C:\Windows\System\XKEBAwS.exe
  2⤵
  PID:6368
- C:\Windows\System\YwzJkEK.exe
  C:\Windows\System\YwzJkEK.exe
  2⤵
  PID:6316
- C:\Windows\System\Gamswzg.exe
  C:\Windows\System\Gamswzg.exe
  2⤵
  PID:4908
- C:\Windows\System\CesPefc.exe
  C:\Windows\System\CesPefc.exe
  2⤵
  PID:7416
- C:\Windows\System\PcxfZgD.exe
  C:\Windows\System\PcxfZgD.exe
  2⤵
  PID:8212
- C:\Windows\System\kCpQAzx.exe
  C:\Windows\System\kCpQAzx.exe
  2⤵
  PID:8236
- C:\Windows\System\kkRvuSl.exe
  C:\Windows\System\kkRvuSl.exe
  2⤵
  PID:8260
- C:\Windows\System\egKRUCR.exe
  C:\Windows\System\egKRUCR.exe
  2⤵
  PID:8280
- C:\Windows\System\ynOHpJv.exe
  C:\Windows\System\ynOHpJv.exe
  2⤵
  PID:8296
- C:\Windows\System\lCzifew.exe
  C:\Windows\System\lCzifew.exe
  2⤵
  PID:8320
- C:\Windows\System\bVHNuWf.exe
  C:\Windows\System\bVHNuWf.exe
  2⤵
  PID:8340
- C:\Windows\System\DDhyQel.exe
  C:\Windows\System\DDhyQel.exe
  2⤵
  PID:8356
- C:\Windows\System\LsWzxQj.exe
  C:\Windows\System\LsWzxQj.exe
  2⤵
  PID:8380
- C:\Windows\System\KzNtXwn.exe
  C:\Windows\System\KzNtXwn.exe
  2⤵
  PID:8396
- C:\Windows\System\CpFjaxz.exe
  C:\Windows\System\CpFjaxz.exe
  2⤵
  PID:8420
- C:\Windows\System\ptcYTry.exe
  C:\Windows\System\ptcYTry.exe
  2⤵
  PID:8436
- C:\Windows\System\GNNnMKV.exe
  C:\Windows\System\GNNnMKV.exe
  2⤵
  PID:8460
- C:\Windows\System\SxCrFzA.exe
  C:\Windows\System\SxCrFzA.exe
  2⤵
  PID:8480
- C:\Windows\System\tmUMeKX.exe
  C:\Windows\System\tmUMeKX.exe
  2⤵
  PID:8504
- C:\Windows\System\uQnqjTR.exe
  C:\Windows\System\uQnqjTR.exe
  2⤵
  PID:8524
- C:\Windows\System\bDcrKDl.exe
  C:\Windows\System\bDcrKDl.exe
  2⤵
  PID:8548
- C:\Windows\System\nMxtRVY.exe
  C:\Windows\System\nMxtRVY.exe
  2⤵
  PID:8576
- C:\Windows\System\KTvSVbq.exe
  C:\Windows\System\KTvSVbq.exe
  2⤵
  PID:8596
- C:\Windows\System\hRulmMw.exe
  C:\Windows\System\hRulmMw.exe
  2⤵
  PID:8616
- C:\Windows\System\EkYEfok.exe
  C:\Windows\System\EkYEfok.exe
  2⤵
  PID:8640
- C:\Windows\System\YctmifM.exe
  C:\Windows\System\YctmifM.exe
  2⤵
  PID:8660
- C:\Windows\System\dTetRTt.exe
  C:\Windows\System\dTetRTt.exe
  2⤵
  PID:8684
- C:\Windows\System\keOkZLH.exe
  C:\Windows\System\keOkZLH.exe
  2⤵
  PID:8700
- C:\Windows\System\kPzRGYE.exe
  C:\Windows\System\kPzRGYE.exe
  2⤵
  PID:8920
- C:\Windows\System\WEqBhTr.exe
  C:\Windows\System\WEqBhTr.exe
  2⤵
  PID:8936
- C:\Windows\System\OnaOZKe.exe
  C:\Windows\System\OnaOZKe.exe
  2⤵
  PID:8952
- C:\Windows\System\uvNFcjF.exe
  C:\Windows\System\uvNFcjF.exe
  2⤵
  PID:8968
- C:\Windows\System\MEEoASx.exe
  C:\Windows\System\MEEoASx.exe
  2⤵
  PID:8984
- C:\Windows\System\ikrGeLQ.exe
  C:\Windows\System\ikrGeLQ.exe
  2⤵
  PID:9000
- C:\Windows\System\QeqHpQQ.exe
  C:\Windows\System\QeqHpQQ.exe
  2⤵
  PID:9020
- C:\Windows\System\SiUuVVd.exe
  C:\Windows\System\SiUuVVd.exe
  2⤵
  PID:9040
- C:\Windows\System\gdQJJtp.exe
  C:\Windows\System\gdQJJtp.exe
  2⤵
  PID:9056
- C:\Windows\System\VeWrXJP.exe
  C:\Windows\System\VeWrXJP.exe
  2⤵
  PID:9076
- C:\Windows\System\MHcCLAX.exe
  C:\Windows\System\MHcCLAX.exe
  2⤵
  PID:9096
- C:\Windows\System\ozXEBxP.exe
  C:\Windows\System\ozXEBxP.exe
  2⤵
  PID:9116
- C:\Windows\System\XsfNmTa.exe
  C:\Windows\System\XsfNmTa.exe
  2⤵
  PID:9140
- C:\Windows\System\GbOjVQu.exe
  C:\Windows\System\GbOjVQu.exe
  2⤵
  PID:9160
- C:\Windows\System\achpvJt.exe
  C:\Windows\System\achpvJt.exe
  2⤵
  PID:9180
- C:\Windows\System\TNBxIVD.exe
  C:\Windows\System\TNBxIVD.exe
  2⤵
  PID:9200
- C:\Windows\System\vOkibYa.exe
  C:\Windows\System\vOkibYa.exe
  2⤵
  PID:7672
- C:\Windows\System\AlcbfoD.exe
  C:\Windows\System\AlcbfoD.exe
  2⤵
  PID:6548
- C:\Windows\System\ILhrqnn.exe
  C:\Windows\System\ILhrqnn.exe
  2⤵
  PID:7748
- C:\Windows\System\RNJIJWJ.exe
  C:\Windows\System\RNJIJWJ.exe
  2⤵
  PID:6384
- C:\Windows\System\RyrzjUm.exe
  C:\Windows\System\RyrzjUm.exe
  2⤵
  PID:7188
- C:\Windows\System\loNhSPw.exe
  C:\Windows\System\loNhSPw.exe
  2⤵
  PID:7928
- C:\Windows\System\WXKClft.exe
  C:\Windows\System\WXKClft.exe
  2⤵
  PID:7968
- C:\Windows\System\XhhIOfE.exe
  C:\Windows\System\XhhIOfE.exe
  2⤵
  PID:7280
- C:\Windows\System\lsnuhFo.exe
  C:\Windows\System\lsnuhFo.exe
  2⤵
  PID:2120
- C:\Windows\System\OHTMmDk.exe
  C:\Windows\System\OHTMmDk.exe
  2⤵
  PID:7324
- C:\Windows\System\JipHznz.exe
  C:\Windows\System\JipHznz.exe
  2⤵
  PID:6572
- C:\Windows\System\HQZgRuB.exe
  C:\Windows\System\HQZgRuB.exe
  2⤵
  PID:7600
- C:\Windows\System\LjceEVC.exe
  C:\Windows\System\LjceEVC.exe
  2⤵
  PID:7356
- C:\Windows\System\myaaIrZ.exe
  C:\Windows\System\myaaIrZ.exe
  2⤵
  PID:7628
- C:\Windows\System\yZChfqp.exe
  C:\Windows\System\yZChfqp.exe
  2⤵
  PID:8244
- C:\Windows\System\fiWWbVh.exe
  C:\Windows\System\fiWWbVh.exe
  2⤵
  PID:8272
- C:\Windows\System\cWUEzXJ.exe
  C:\Windows\System\cWUEzXJ.exe
  2⤵
  PID:8312
- C:\Windows\System\wRnGwTa.exe
  C:\Windows\System\wRnGwTa.exe
  2⤵
  PID:8348
- C:\Windows\System\vynwzRP.exe
  C:\Windows\System\vynwzRP.exe
  2⤵
  PID:7764
- C:\Windows\System\jSGJtmv.exe
  C:\Windows\System\jSGJtmv.exe
  2⤵
  PID:8592
- C:\Windows\System\UhdGMiq.exe
  C:\Windows\System\UhdGMiq.exe
  2⤵
  PID:6952
- C:\Windows\System\dJHNGqB.exe
  C:\Windows\System\dJHNGqB.exe
  2⤵
  PID:8728
- C:\Windows\System\whhqJKD.exe
  C:\Windows\System\whhqJKD.exe
  2⤵
  PID:8740
- C:\Windows\System\ehdXTTz.exe
  C:\Windows\System\ehdXTTz.exe
  2⤵
  PID:8104
- C:\Windows\System\EjTNldZ.exe
  C:\Windows\System\EjTNldZ.exe
  2⤵
  PID:7236
- C:\Windows\System\OzVxkLD.exe
  C:\Windows\System\OzVxkLD.exe
  2⤵
  PID:6688
- C:\Windows\System\AthgFsC.exe
  C:\Windows\System\AthgFsC.exe
  2⤵
  PID:8168
- C:\Windows\System\jQuQLqY.exe
  C:\Windows\System\jQuQLqY.exe
  2⤵
  PID:8336
- C:\Windows\System\hlSEkgj.exe
  C:\Windows\System\hlSEkgj.exe
  2⤵
  PID:8536
- C:\Windows\System\EtPpxoc.exe
  C:\Windows\System\EtPpxoc.exe
  2⤵
  PID:8652
- C:\Windows\System\dlyTVcy.exe
  C:\Windows\System\dlyTVcy.exe
  2⤵
  PID:7120
- C:\Windows\System\LzFnofn.exe
  C:\Windows\System\LzFnofn.exe
  2⤵
  PID:5428
- C:\Windows\System\oKArLWH.exe
  C:\Windows\System\oKArLWH.exe
  2⤵
  PID:8588
- C:\Windows\System\tRQuzfo.exe
  C:\Windows\System\tRQuzfo.exe
  2⤵
  PID:8516
- C:\Windows\System\cQxihic.exe
  C:\Windows\System\cQxihic.exe
  2⤵
  PID:8416
- C:\Windows\System\IsdQWLX.exe
  C:\Windows\System\IsdQWLX.exe
  2⤵
  PID:8368
- C:\Windows\System\ZxVdwiA.exe
  C:\Windows\System\ZxVdwiA.exe
  2⤵
  PID:6312
- C:\Windows\System\ozJAcZi.exe
  C:\Windows\System\ozJAcZi.exe
  2⤵
  PID:6768
- C:\Windows\System\PyhtEnU.exe
  C:\Windows\System\PyhtEnU.exe
  2⤵
  PID:8680
- C:\Windows\System\yDxCqRr.exe
  C:\Windows\System\yDxCqRr.exe
  2⤵
  PID:3136
- C:\Windows\System\dIogjdK.exe
  C:\Windows\System\dIogjdK.exe
  2⤵
  PID:8712
- C:\Windows\System\IWSbxxE.exe
  C:\Windows\System\IWSbxxE.exe
  2⤵
  PID:8944
- C:\Windows\System\dybucCT.exe
  C:\Windows\System\dybucCT.exe
  2⤵
  PID:9236
- C:\Windows\System\srkrHea.exe
  C:\Windows\System\srkrHea.exe
  2⤵
  PID:9252
- C:\Windows\System\VEcTFrF.exe
  C:\Windows\System\VEcTFrF.exe
  2⤵
  PID:9272
- C:\Windows\System\XvfMdnS.exe
  C:\Windows\System\XvfMdnS.exe
  2⤵
  PID:9296
- C:\Windows\System\uDOQURi.exe
  C:\Windows\System\uDOQURi.exe
  2⤵
  PID:9312
- C:\Windows\System\VnwuXzk.exe
  C:\Windows\System\VnwuXzk.exe
  2⤵
  PID:9328
- C:\Windows\System\PNpoaoD.exe
  C:\Windows\System\PNpoaoD.exe
  2⤵
  PID:9348
- C:\Windows\System\wyUSRNB.exe
  C:\Windows\System\wyUSRNB.exe
  2⤵
  PID:9368
- C:\Windows\System\RACrHMv.exe
  C:\Windows\System\RACrHMv.exe
  2⤵
  PID:9388
- C:\Windows\System\fuDhuiK.exe
  C:\Windows\System\fuDhuiK.exe
  2⤵
  PID:9408
- C:\Windows\System\ZSUEcXt.exe
  C:\Windows\System\ZSUEcXt.exe
  2⤵
  PID:9428
- C:\Windows\System\noySBVP.exe
  C:\Windows\System\noySBVP.exe
  2⤵
  PID:9448
- C:\Windows\System\FuTFzTt.exe
  C:\Windows\System\FuTFzTt.exe
  2⤵
  PID:9468
- C:\Windows\System\duSkxje.exe
  C:\Windows\System\duSkxje.exe
  2⤵
  PID:9492
- C:\Windows\System\VCfKxRS.exe
  C:\Windows\System\VCfKxRS.exe
  2⤵
  PID:9516
- C:\Windows\System\zDOIWOJ.exe
  C:\Windows\System\zDOIWOJ.exe
  2⤵
  PID:9532
- C:\Windows\System\MyHWsyr.exe
  C:\Windows\System\MyHWsyr.exe
  2⤵
  PID:9556
- C:\Windows\System\zvSLiGK.exe
  C:\Windows\System\zvSLiGK.exe
  2⤵
  PID:9576
- C:\Windows\System\MIssYcc.exe
  C:\Windows\System\MIssYcc.exe
  2⤵
  PID:9604
- C:\Windows\System\ncTruIQ.exe
  C:\Windows\System\ncTruIQ.exe
  2⤵
  PID:9620
- C:\Windows\System\UTQMYsl.exe
  C:\Windows\System\UTQMYsl.exe
  2⤵
  PID:9640
- C:\Windows\System\TELJNnQ.exe
  C:\Windows\System\TELJNnQ.exe
  2⤵
  PID:9660
- C:\Windows\System\SMmSnDu.exe
  C:\Windows\System\SMmSnDu.exe
  2⤵
  PID:9684
- C:\Windows\System\mCIaYyz.exe
  C:\Windows\System\mCIaYyz.exe
  2⤵
  PID:9708
- C:\Windows\System\nDxQATK.exe
  C:\Windows\System\nDxQATK.exe
  2⤵
  PID:9724
- C:\Windows\System\QWYXoiE.exe
  C:\Windows\System\QWYXoiE.exe
  2⤵
  PID:9744
- C:\Windows\System\EhiUJll.exe
  C:\Windows\System\EhiUJll.exe
  2⤵
  PID:9768
- C:\Windows\System\gtiaXMq.exe
  C:\Windows\System\gtiaXMq.exe
  2⤵
  PID:9788
- C:\Windows\System\cpJJDSJ.exe
  C:\Windows\System\cpJJDSJ.exe
  2⤵
  PID:9808
- C:\Windows\System\qtQVbiI.exe
  C:\Windows\System\qtQVbiI.exe
  2⤵
  PID:9828
- C:\Windows\System\TLExSOL.exe
  C:\Windows\System\TLExSOL.exe
  2⤵
  PID:9844
- C:\Windows\System\oYYeooQ.exe
  C:\Windows\System\oYYeooQ.exe
  2⤵
  PID:9868
- C:\Windows\System\AcsyTtE.exe
  C:\Windows\System\AcsyTtE.exe
  2⤵
  PID:9884
- C:\Windows\System\DvfzMMP.exe
  C:\Windows\System\DvfzMMP.exe
  2⤵
  PID:9908
- C:\Windows\System\KolHBeQ.exe
  C:\Windows\System\KolHBeQ.exe
  2⤵
  PID:9936
- C:\Windows\System\LydCWdk.exe
  C:\Windows\System\LydCWdk.exe
  2⤵
  PID:9960
- C:\Windows\System\ZxyVYZa.exe
  C:\Windows\System\ZxyVYZa.exe
  2⤵
  PID:9980
- C:\Windows\System\FBPIJxS.exe
  C:\Windows\System\FBPIJxS.exe
  2⤵
  PID:10000
- C:\Windows\System\VfSoBDd.exe
  C:\Windows\System\VfSoBDd.exe
  2⤵
  PID:10020
- C:\Windows\System\daoFskG.exe
  C:\Windows\System\daoFskG.exe
  2⤵
  PID:10040
- C:\Windows\System\xTHjwhu.exe
  C:\Windows\System\xTHjwhu.exe
  2⤵
  PID:10060
- C:\Windows\System\MHFjDID.exe
  C:\Windows\System\MHFjDID.exe
  2⤵
  PID:10076
- C:\Windows\System\vKsGVLS.exe
  C:\Windows\System\vKsGVLS.exe
  2⤵
  PID:10096
- C:\Windows\System\HglsPtY.exe
  C:\Windows\System\HglsPtY.exe
  2⤵
  PID:10120
- C:\Windows\System\YrMaPUn.exe
  C:\Windows\System\YrMaPUn.exe
  2⤵
  PID:10140
- C:\Windows\System\zKAnLji.exe
  C:\Windows\System\zKAnLji.exe
  2⤵
  PID:10160
- C:\Windows\System\FRkMRRB.exe
  C:\Windows\System\FRkMRRB.exe
  2⤵
  PID:10176
- C:\Windows\System\pEIKRJj.exe
  C:\Windows\System\pEIKRJj.exe
  2⤵
  PID:10196
- C:\Windows\System\IYCsriO.exe
  C:\Windows\System\IYCsriO.exe
  2⤵
  PID:10216
- C:\Windows\System\ncBIeAk.exe
  C:\Windows\System\ncBIeAk.exe
  2⤵
  PID:10236
- C:\Windows\System\QeRgKzA.exe
  C:\Windows\System\QeRgKzA.exe
  2⤵
  PID:9028
- C:\Windows\System\EfentaD.exe
  C:\Windows\System\EfentaD.exe
  2⤵
  PID:9084
- C:\Windows\System\dUgOJEr.exe
  C:\Windows\System\dUgOJEr.exe
  2⤵
  PID:684
- C:\Windows\System\QsrnOFs.exe
  C:\Windows\System\QsrnOFs.exe
  2⤵
  PID:9212
- C:\Windows\System\BATUxWD.exe
  C:\Windows\System\BATUxWD.exe
  2⤵
  PID:7528
- C:\Windows\System\fwaIkQv.exe
  C:\Windows\System\fwaIkQv.exe
  2⤵
  PID:8204
- C:\Windows\System\StadDkF.exe
  C:\Windows\System\StadDkF.exe
  2⤵
  PID:7696
- C:\Windows\System\uPyhFup.exe
  C:\Windows\System\uPyhFup.exe
  2⤵
  PID:7788
- C:\Windows\System\MemlQfL.exe
  C:\Windows\System\MemlQfL.exe
  2⤵
  PID:8748
- C:\Windows\System\bWFsXSH.exe
  C:\Windows\System\bWFsXSH.exe
  2⤵
  PID:8708
- C:\Windows\System\sCRrrdX.exe
  C:\Windows\System\sCRrrdX.exe
  2⤵
  PID:8476
- C:\Windows\System\kbuFXLT.exe
  C:\Windows\System\kbuFXLT.exe
  2⤵
  PID:10260
- C:\Windows\System\KJAtMoQ.exe
  C:\Windows\System\KJAtMoQ.exe
  2⤵
  PID:10276
- C:\Windows\System\fcuCqWp.exe
  C:\Windows\System\fcuCqWp.exe
  2⤵
  PID:10300
- C:\Windows\System\ELkNWFo.exe
  C:\Windows\System\ELkNWFo.exe
  2⤵
  PID:10320
- C:\Windows\System\emOCYBx.exe
  C:\Windows\System\emOCYBx.exe
  2⤵
  PID:10340
- C:\Windows\System\aLyphiR.exe
  C:\Windows\System\aLyphiR.exe
  2⤵
  PID:10364
- C:\Windows\System\PgDCqUX.exe
  C:\Windows\System\PgDCqUX.exe
  2⤵
  PID:10384
- C:\Windows\System\eQaxkIc.exe
  C:\Windows\System\eQaxkIc.exe
  2⤵
  PID:10404
- C:\Windows\System\nhgTDcU.exe
  C:\Windows\System\nhgTDcU.exe
  2⤵
  PID:10424
- C:\Windows\System\ZOeoDFL.exe
  C:\Windows\System\ZOeoDFL.exe
  2⤵
  PID:10440
- C:\Windows\System\kViEdxg.exe
  C:\Windows\System\kViEdxg.exe
  2⤵
  PID:10464
- C:\Windows\System\OXLAYhg.exe
  C:\Windows\System\OXLAYhg.exe
  2⤵
  PID:10488
- C:\Windows\System\oqwPVrZ.exe
  C:\Windows\System\oqwPVrZ.exe
  2⤵
  PID:10504
- C:\Windows\System\cqJrblt.exe
  C:\Windows\System\cqJrblt.exe
  2⤵
  PID:10524
- C:\Windows\System\xmHQDQh.exe
  C:\Windows\System\xmHQDQh.exe
  2⤵
  PID:10544
- C:\Windows\System\BTLnNHw.exe
  C:\Windows\System\BTLnNHw.exe
  2⤵
  PID:10564
- C:\Windows\System\sEmxBYL.exe
  C:\Windows\System\sEmxBYL.exe
  2⤵
  PID:10584
- C:\Windows\System\QSbnFft.exe
  C:\Windows\System\QSbnFft.exe
  2⤵
  PID:10612
- C:\Windows\System\Ukhrhpm.exe
  C:\Windows\System\Ukhrhpm.exe
  2⤵
  PID:10636
- C:\Windows\System\kIjWDcP.exe
  C:\Windows\System\kIjWDcP.exe
  2⤵
  PID:10652
- C:\Windows\System\lHBbUar.exe
  C:\Windows\System\lHBbUar.exe
  2⤵
  PID:10680
- C:\Windows\System\GagZFpm.exe
  C:\Windows\System\GagZFpm.exe
  2⤵
  PID:10712
- C:\Windows\System\NSWvKUu.exe
  C:\Windows\System\NSWvKUu.exe
  2⤵
  PID:10728
- C:\Windows\System\mbPQGxz.exe
  C:\Windows\System\mbPQGxz.exe
  2⤵
  PID:10756
- C:\Windows\System\REoBIxi.exe
  C:\Windows\System\REoBIxi.exe
  2⤵
  PID:10776
- C:\Windows\System\gHwIolI.exe
  C:\Windows\System\gHwIolI.exe
  2⤵
  PID:10792
- C:\Windows\System\czQbhyg.exe
  C:\Windows\System\czQbhyg.exe
  2⤵
  PID:10812
- C:\Windows\System\kugMimI.exe
  C:\Windows\System\kugMimI.exe
  2⤵
  PID:10832
- C:\Windows\System\ZvTmgMW.exe
  C:\Windows\System\ZvTmgMW.exe
  2⤵
  PID:10848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
    3⤵
    PID:4344
- - C:\Windows\System\Jqxhojo.exe
    C:\Windows\System\Jqxhojo.exe
    3⤵
    PID:12224
- - C:\Windows\System\NszpPkj.exe
    C:\Windows\System\NszpPkj.exe
    3⤵
    PID:13036
- - C:\Windows\System\AhCmCHZ.exe
    C:\Windows\System\AhCmCHZ.exe
    3⤵
    PID:13100
- - C:\Windows\System\pTpVglJ.exe
    C:\Windows\System\pTpVglJ.exe
    3⤵
    PID:13128
- - C:\Windows\System\QgfbafT.exe
    C:\Windows\System\QgfbafT.exe
    3⤵
    PID:13164
- - C:\Windows\System\VPrmCsL.exe
    C:\Windows\System\VPrmCsL.exe
    3⤵
    PID:13188
- - C:\Windows\System\mMQyxGB.exe
    C:\Windows\System\mMQyxGB.exe
    3⤵
    PID:13232
- - C:\Windows\System\AJsgerQ.exe
    C:\Windows\System\AJsgerQ.exe
    3⤵
    PID:13260
- - C:\Windows\System\JeLJsTd.exe
    C:\Windows\System\JeLJsTd.exe
    3⤵
    PID:13292
- - C:\Windows\System\DQtjBTd.exe
    C:\Windows\System\DQtjBTd.exe
    3⤵
    PID:12196
- - C:\Windows\System\wKOcJAw.exe
    C:\Windows\System\wKOcJAw.exe
    3⤵
    PID:12164
- - C:\Windows\System\TRsUnjK.exe
    C:\Windows\System\TRsUnjK.exe
    3⤵
    PID:11224
- - C:\Windows\System\FPJzkFe.exe
    C:\Windows\System\FPJzkFe.exe
    3⤵
    PID:12388
- - C:\Windows\System\sdrFOWp.exe
    C:\Windows\System\sdrFOWp.exe
    3⤵
    PID:4064
- - C:\Windows\System\qzkPCgf.exe
    C:\Windows\System\qzkPCgf.exe
    3⤵
    PID:8392
- - C:\Windows\System\eRALaLG.exe
    C:\Windows\System\eRALaLG.exe
    3⤵
    PID:2592
- - C:\Windows\System\zwXmGPp.exe
    C:\Windows\System\zwXmGPp.exe
    3⤵
    PID:12628
- - C:\Windows\System\dIqGWCD.exe
    C:\Windows\System\dIqGWCD.exe
    3⤵
    PID:13408
- - C:\Windows\System\eRllZXC.exe
    C:\Windows\System\eRllZXC.exe
    3⤵
    PID:13468
- - C:\Windows\System\gMLZZRz.exe
    C:\Windows\System\gMLZZRz.exe
    3⤵
    PID:13848
- - C:\Windows\System\KQUnYWZ.exe
    C:\Windows\System\KQUnYWZ.exe
    3⤵
    PID:14076
- - C:\Windows\System\BnrTbpq.exe
    C:\Windows\System\BnrTbpq.exe
    3⤵
    PID:14296
- - C:\Windows\System\wUhVzha.exe
    C:\Windows\System\wUhVzha.exe
    3⤵
    PID:11996
- - C:\Windows\System\RXiMODv.exe
    C:\Windows\System\RXiMODv.exe
    3⤵
    PID:1444
- - C:\Windows\System\QdGEbai.exe
    C:\Windows\System\QdGEbai.exe
    3⤵
    PID:11632
- - C:\Windows\System\qzUKoqd.exe
    C:\Windows\System\qzUKoqd.exe
    3⤵
    PID:12764
- - C:\Windows\System\epBcJXu.exe
    C:\Windows\System\epBcJXu.exe
    3⤵
    PID:4116
- - C:\Windows\System\whVtFyi.exe
    C:\Windows\System\whVtFyi.exe
    3⤵
    PID:12272
- - C:\Windows\System\MoymAZy.exe
    C:\Windows\System\MoymAZy.exe
    3⤵
    PID:12888
- - C:\Windows\System\luHTZGt.exe
    C:\Windows\System\luHTZGt.exe
    3⤵
    PID:12340
- - C:\Windows\System\LooUbLE.exe
    C:\Windows\System\LooUbLE.exe
    3⤵
    PID:12784
- - C:\Windows\System\XJyluzE.exe
    C:\Windows\System\XJyluzE.exe
    3⤵
    PID:12920
- - C:\Windows\System\XSaYklv.exe
    C:\Windows\System\XSaYklv.exe
    3⤵
    PID:12520
- - C:\Windows\System\NAtCSeZ.exe
    C:\Windows\System\NAtCSeZ.exe
    3⤵
    PID:12528
- - C:\Windows\System\QRhRjvJ.exe
    C:\Windows\System\QRhRjvJ.exe
    3⤵
    PID:13096
- - C:\Windows\System\bOOIjZU.exe
    C:\Windows\System\bOOIjZU.exe
    3⤵
    PID:13476
- - C:\Windows\System\HLaeCuP.exe
    C:\Windows\System\HLaeCuP.exe
    3⤵
    PID:13228
- - C:\Windows\System\AqIkgrW.exe
    C:\Windows\System\AqIkgrW.exe
    3⤵
    PID:11540
- - C:\Windows\System\iLTKXdw.exe
    C:\Windows\System\iLTKXdw.exe
    3⤵
    PID:4956
- - C:\Windows\System\XqbJvPR.exe
    C:\Windows\System\XqbJvPR.exe
    3⤵
    PID:13636
- - C:\Windows\System\TJvUBqK.exe
    C:\Windows\System\TJvUBqK.exe
    3⤵
    PID:12356
- - C:\Windows\System\PoRYOyA.exe
    C:\Windows\System\PoRYOyA.exe
    3⤵
    PID:12180
- - C:\Windows\System\JDWqbni.exe
    C:\Windows\System\JDWqbni.exe
    3⤵
    PID:13640
- - C:\Windows\System\TwClJtC.exe
    C:\Windows\System\TwClJtC.exe
    3⤵
    PID:12404
- - C:\Windows\System\lCfMUkJ.exe
    C:\Windows\System\lCfMUkJ.exe
    3⤵
    PID:13888
- - C:\Windows\System\aAMLFXj.exe
    C:\Windows\System\aAMLFXj.exe
    3⤵
    PID:13652
- - C:\Windows\System\KWKncMu.exe
    C:\Windows\System\KWKncMu.exe
    3⤵
    PID:9668
- - C:\Windows\System\ElKSaDF.exe
    C:\Windows\System\ElKSaDF.exe
    3⤵
    PID:12468
- - C:\Windows\System\OCYjwfn.exe
    C:\Windows\System\OCYjwfn.exe
    3⤵
    PID:13728
- - C:\Windows\System\itXAFQX.exe
    C:\Windows\System\itXAFQX.exe
    3⤵
    PID:12836
- - C:\Windows\System\clraJPz.exe
    C:\Windows\System\clraJPz.exe
    3⤵
    PID:13980
- - C:\Windows\System\rhjBfHq.exe
    C:\Windows\System\rhjBfHq.exe
    3⤵
    PID:13360
- - C:\Windows\System\LPSkcQU.exe
    C:\Windows\System\LPSkcQU.exe
    3⤵
    PID:13872
- - C:\Windows\System\tyCQgzz.exe
    C:\Windows\System\tyCQgzz.exe
    3⤵
    PID:14144
- - C:\Windows\System\IOwRqkC.exe
    C:\Windows\System\IOwRqkC.exe
    3⤵
    PID:7260
- - C:\Windows\System\hQRZeTM.exe
    C:\Windows\System\hQRZeTM.exe
    3⤵
    PID:12876
- - C:\Windows\System\ECxLApc.exe
    C:\Windows\System\ECxLApc.exe
    3⤵
    PID:13696
- - C:\Windows\System\eUekPrY.exe
    C:\Windows\System\eUekPrY.exe
    3⤵
    PID:12884
- - C:\Windows\System\VrkZuiw.exe
    C:\Windows\System\VrkZuiw.exe
    3⤵
    PID:13404
- - C:\Windows\System\pBUYogV.exe
    C:\Windows\System\pBUYogV.exe
    3⤵
    PID:11524
- - C:\Windows\System\uGVdxWZ.exe
    C:\Windows\System\uGVdxWZ.exe
    3⤵
    PID:1548
- - C:\Windows\System\uaXvLEg.exe
    C:\Windows\System\uaXvLEg.exe
    3⤵
    PID:1780
- - C:\Windows\System\AxDjFdY.exe
    C:\Windows\System\AxDjFdY.exe
    3⤵
    PID:11588
- - C:\Windows\System\tgHezFy.exe
    C:\Windows\System\tgHezFy.exe
    3⤵
    PID:1876
- - C:\Windows\System\FJRXmGy.exe
    C:\Windows\System\FJRXmGy.exe
    3⤵
    PID:12660
- - C:\Windows\System\zQqGokO.exe
    C:\Windows\System\zQqGokO.exe
    3⤵
    PID:12820
- - C:\Windows\System\RbNwMZU.exe
    C:\Windows\System\RbNwMZU.exe
    3⤵
    PID:10460
- - C:\Windows\System\RrUBUUU.exe
    C:\Windows\System\RrUBUUU.exe
    3⤵
    PID:14264
- - C:\Windows\System\SVDdzqT.exe
    C:\Windows\System\SVDdzqT.exe
    3⤵
    PID:5564
- - C:\Windows\System\JLWFBzJ.exe
    C:\Windows\System\JLWFBzJ.exe
    3⤵
    PID:13724
- - C:\Windows\System\OcUrqLM.exe
    C:\Windows\System\OcUrqLM.exe
    3⤵
    PID:13340
- - C:\Windows\System\BhPPGWI.exe
    C:\Windows\System\BhPPGWI.exe
    3⤵
    PID:13628
- - C:\Windows\System\XqSnLgk.exe
    C:\Windows\System\XqSnLgk.exe
    3⤵
    PID:11548
- - C:\Windows\System\FMgePAH.exe
    C:\Windows\System\FMgePAH.exe
    3⤵
    PID:14628
- - C:\Windows\System\JOpNcbi.exe
    C:\Windows\System\JOpNcbi.exe
    3⤵
    PID:14792
- - C:\Windows\System\MjemWxz.exe
    C:\Windows\System\MjemWxz.exe
    3⤵
    PID:14808
- - C:\Windows\System\prTgyes.exe
    C:\Windows\System\prTgyes.exe
    3⤵
    PID:14880
- - C:\Windows\System\zGJqOTu.exe
    C:\Windows\System\zGJqOTu.exe
    3⤵
    PID:14928
- - C:\Windows\System\GhylFhe.exe
    C:\Windows\System\GhylFhe.exe
    3⤵
    PID:14956
- - C:\Windows\System\RKhKsPj.exe
    C:\Windows\System\RKhKsPj.exe
    3⤵
    PID:14988
- - C:\Windows\System\HUcaUTS.exe
    C:\Windows\System\HUcaUTS.exe
    3⤵
    PID:15004
- - C:\Windows\System\DdFpFIX.exe
    C:\Windows\System\DdFpFIX.exe
    3⤵
    PID:15020
- - C:\Windows\System\BPNYxMq.exe
    C:\Windows\System\BPNYxMq.exe
    3⤵
    PID:15036
- - C:\Windows\System\qeSeUKp.exe
    C:\Windows\System\qeSeUKp.exe
    3⤵
    PID:15056
- - C:\Windows\System\CoWREnU.exe
    C:\Windows\System\CoWREnU.exe
    3⤵
    PID:15076
- - C:\Windows\System\pZiXkeH.exe
    C:\Windows\System\pZiXkeH.exe
    3⤵
    PID:15112
- - C:\Windows\System\owGxvvR.exe
    C:\Windows\System\owGxvvR.exe
    3⤵
    PID:15128
- - C:\Windows\System\NCdnUaf.exe
    C:\Windows\System\NCdnUaf.exe
    3⤵
    PID:15148
- - C:\Windows\System\CkdYrxx.exe
    C:\Windows\System\CkdYrxx.exe
    3⤵
    PID:15168
- - C:\Windows\System\NJfTxFv.exe
    C:\Windows\System\NJfTxFv.exe
    3⤵
    PID:5368
- - C:\Windows\System\kcchRvB.exe
    C:\Windows\System\kcchRvB.exe
    3⤵
    PID:3288
- - C:\Windows\System\DLGQOIM.exe
    C:\Windows\System\DLGQOIM.exe
    3⤵
    PID:11888
- - C:\Windows\System\HKQIPLM.exe
    C:\Windows\System\HKQIPLM.exe
    3⤵
    PID:8624
- - C:\Windows\System\BpqAvLg.exe
    C:\Windows\System\BpqAvLg.exe
    3⤵
    PID:6064
- - C:\Windows\System\fmGighB.exe
    C:\Windows\System\fmGighB.exe
    3⤵
    PID:5376
- - C:\Windows\System\ztAUKOt.exe
    C:\Windows\System\ztAUKOt.exe
    3⤵
    PID:12024
- - C:\Windows\System\PommgNL.exe
    C:\Windows\System\PommgNL.exe
    3⤵
    PID:5520
- - C:\Windows\System\fJiFMyy.exe
    C:\Windows\System\fJiFMyy.exe
    3⤵
    PID:14372
- - C:\Windows\System\Gyjklwn.exe
    C:\Windows\System\Gyjklwn.exe
    3⤵
    PID:5164
- - C:\Windows\System\qxmSCRC.exe
    C:\Windows\System\qxmSCRC.exe
    3⤵
    PID:11636
- - C:\Windows\System\iVyqQDd.exe
    C:\Windows\System\iVyqQDd.exe
    3⤵
    PID:2228
- - C:\Windows\System\HgcsQTV.exe
    C:\Windows\System\HgcsQTV.exe
    3⤵
    PID:13180
- - C:\Windows\System\ydYmENO.exe
    C:\Windows\System\ydYmENO.exe
    3⤵
    PID:5524
- - C:\Windows\System\iIcSpdx.exe
    C:\Windows\System\iIcSpdx.exe
    3⤵
    PID:12972
- - C:\Windows\System\lBkxXjW.exe
    C:\Windows\System\lBkxXjW.exe
    3⤵
    PID:2964
- - C:\Windows\System\eYtljrT.exe
    C:\Windows\System\eYtljrT.exe
    3⤵
    PID:14440
- - C:\Windows\System\IIYzdKH.exe
    C:\Windows\System\IIYzdKH.exe
    3⤵
    PID:1436
- - C:\Windows\System\OsAbdCT.exe
    C:\Windows\System\OsAbdCT.exe
    3⤵
    PID:1080
- - C:\Windows\System\JhyiJpC.exe
    C:\Windows\System\JhyiJpC.exe
    3⤵
    PID:5792
- - C:\Windows\System\tkvmBgy.exe
    C:\Windows\System\tkvmBgy.exe
    3⤵
    PID:7552
- - C:\Windows\System\DTNjVjR.exe
    C:\Windows\System\DTNjVjR.exe
    3⤵
    PID:7444
- - C:\Windows\System\NcgRTKP.exe
    C:\Windows\System\NcgRTKP.exe
    3⤵
    PID:7804
- - C:\Windows\System\tcZZrCo.exe
    C:\Windows\System\tcZZrCo.exe
    3⤵
    PID:5464
- - C:\Windows\System\Bhkbecc.exe
    C:\Windows\System\Bhkbecc.exe
    3⤵
    PID:7520
- - C:\Windows\System\XsgOwFA.exe
    C:\Windows\System\XsgOwFA.exe
    3⤵
    PID:5384
- - C:\Windows\System\zJWWmfI.exe
    C:\Windows\System\zJWWmfI.exe
    3⤵
    PID:6040
- - C:\Windows\System\iBpHOyx.exe
    C:\Windows\System\iBpHOyx.exe
    3⤵
    PID:15308
- - C:\Windows\System\AkUzlrP.exe
    C:\Windows\System\AkUzlrP.exe
    3⤵
    PID:6140
- - C:\Windows\System\VOTrEEZ.exe
    C:\Windows\System\VOTrEEZ.exe
    3⤵
    PID:14768
- - C:\Windows\System\ZZaghUS.exe
    C:\Windows\System\ZZaghUS.exe
    3⤵
    PID:14388
- - C:\Windows\System\wvWRZrE.exe
    C:\Windows\System\wvWRZrE.exe
    3⤵
    PID:14748
- - C:\Windows\System\hKzUmHY.exe
    C:\Windows\System\hKzUmHY.exe
    3⤵
    PID:6880
- - C:\Windows\System\dZPJrhX.exe
    C:\Windows\System\dZPJrhX.exe
    3⤵
    PID:2832
- - C:\Windows\System\PhKmXvg.exe
    C:\Windows\System\PhKmXvg.exe
    3⤵
    PID:6260
- - C:\Windows\System\rUevLRV.exe
    C:\Windows\System\rUevLRV.exe
    3⤵
    PID:15032
- - C:\Windows\System\SaiPixf.exe
    C:\Windows\System\SaiPixf.exe
    3⤵
    PID:4056
- - C:\Windows\System\DRQeEgv.exe
    C:\Windows\System\DRQeEgv.exe
    3⤵
    PID:7072
- - C:\Windows\System\PqFdoqP.exe
    C:\Windows\System\PqFdoqP.exe
    3⤵
    PID:9584
- - C:\Windows\System\RgQJQzA.exe
    C:\Windows\System\RgQJQzA.exe
    3⤵
    PID:8020
- - C:\Windows\System\fVBQpdR.exe
    C:\Windows\System\fVBQpdR.exe
    3⤵
    PID:15156
- - C:\Windows\System\TDyiTyU.exe
    C:\Windows\System\TDyiTyU.exe
    3⤵
    PID:9104
- - C:\Windows\System\rLTctVJ.exe
    C:\Windows\System\rLTctVJ.exe
    3⤵
    PID:14092
- - C:\Windows\System\JdpFyko.exe
    C:\Windows\System\JdpFyko.exe
    3⤵
    PID:14556
- - C:\Windows\System\yOJyJLD.exe
    C:\Windows\System\yOJyJLD.exe
    3⤵
    PID:5680
- - C:\Windows\System\kkHQNzd.exe
    C:\Windows\System\kkHQNzd.exe
    3⤵
    PID:6044
- - C:\Windows\System\MGlSTGA.exe
    C:\Windows\System\MGlSTGA.exe
    3⤵
    PID:6456
- - C:\Windows\System\JfEwChT.exe
    C:\Windows\System\JfEwChT.exe
    3⤵
    PID:15120
- - C:\Windows\System\giDmSkF.exe
    C:\Windows\System\giDmSkF.exe
    3⤵
    PID:14724
- - C:\Windows\System\iUCdpNN.exe
    C:\Windows\System\iUCdpNN.exe
    3⤵
    PID:15352
- - C:\Windows\System\vZPZMRI.exe
    C:\Windows\System\vZPZMRI.exe
    3⤵
    PID:8828
- - C:\Windows\System\IuJwECQ.exe
    C:\Windows\System\IuJwECQ.exe
    3⤵
    PID:7460
- - C:\Windows\System\imeTimv.exe
    C:\Windows\System\imeTimv.exe
    3⤵
    PID:14948
- - C:\Windows\System\UInUNXc.exe
    C:\Windows\System\UInUNXc.exe
    3⤵
    PID:15348
- - C:\Windows\System\AdOxvgg.exe
    C:\Windows\System\AdOxvgg.exe
    3⤵
    PID:13972
- - C:\Windows\System\CDSOHby.exe
    C:\Windows\System\CDSOHby.exe
    3⤵
    PID:7580
- - C:\Windows\System\nOQIZTJ.exe
    C:\Windows\System\nOQIZTJ.exe
    3⤵
    PID:6436
- - C:\Windows\System\aiKiItm.exe
    C:\Windows\System\aiKiItm.exe
    3⤵
    PID:15096
- - C:\Windows\System\jhxsOuQ.exe
    C:\Windows\System\jhxsOuQ.exe
    3⤵
    PID:6592
- - C:\Windows\System\cLVOseK.exe
    C:\Windows\System\cLVOseK.exe
    3⤵
    PID:9224
- - C:\Windows\System\JTMRXHY.exe
    C:\Windows\System\JTMRXHY.exe
    3⤵
    PID:8780
- - C:\Windows\System\BFzKnwg.exe
    C:\Windows\System\BFzKnwg.exe
    3⤵
    PID:8860
- - C:\Windows\System\msvCOqi.exe
    C:\Windows\System\msvCOqi.exe
    3⤵
    PID:624
- - C:\Windows\System\zYfBaVK.exe
    C:\Windows\System\zYfBaVK.exe
    3⤵
    PID:9696
- - C:\Windows\System\pVzBIKk.exe
    C:\Windows\System\pVzBIKk.exe
    3⤵
    PID:14976
- - C:\Windows\System\JnTamtJ.exe
    C:\Windows\System\JnTamtJ.exe
    3⤵
    PID:15216
- - C:\Windows\System\MRuXaMo.exe
    C:\Windows\System\MRuXaMo.exe
    3⤵
    PID:10948
- - C:\Windows\System\oYxeIoZ.exe
    C:\Windows\System\oYxeIoZ.exe
    3⤵
    PID:9856
- - C:\Windows\System\YmiPPAV.exe
    C:\Windows\System\YmiPPAV.exe
    3⤵
    PID:11232
- - C:\Windows\System\erbJeLy.exe
    C:\Windows\System\erbJeLy.exe
    3⤵
    PID:11216
- - C:\Windows\System\RfblPpG.exe
    C:\Windows\System\RfblPpG.exe
    3⤵
    PID:5244
- - C:\Windows\System\ppoXPla.exe
    C:\Windows\System\ppoXPla.exe
    3⤵
    PID:13876
- - C:\Windows\System\YXvkiNW.exe
    C:\Windows\System\YXvkiNW.exe
    3⤵
    PID:8184
- - C:\Windows\System\JuYvjVI.exe
    C:\Windows\System\JuYvjVI.exe
    3⤵
    PID:15584
- - C:\Windows\System\kXKKBPr.exe
    C:\Windows\System\kXKKBPr.exe
    3⤵
    PID:15700
- - C:\Windows\System\QMrrtaF.exe
    C:\Windows\System\QMrrtaF.exe
    3⤵
    PID:15716
- - C:\Windows\System\yPaCuPx.exe
    C:\Windows\System\yPaCuPx.exe
    3⤵
    PID:15736
- - C:\Windows\System\bCdliJB.exe
    C:\Windows\System\bCdliJB.exe
    3⤵
    PID:15756
- - C:\Windows\System\ircUrgB.exe
    C:\Windows\System\ircUrgB.exe
    3⤵
    PID:15772
- - C:\Windows\System\hakOuLE.exe
    C:\Windows\System\hakOuLE.exe
    3⤵
    PID:15792
- - C:\Windows\System\PepoZqh.exe
    C:\Windows\System\PepoZqh.exe
    3⤵
    PID:15808
- - C:\Windows\System\SQJLikA.exe
    C:\Windows\System\SQJLikA.exe
    3⤵
    PID:15828
- - C:\Windows\System\rrqCMVq.exe
    C:\Windows\System\rrqCMVq.exe
    3⤵
    PID:15852
- - C:\Windows\System\TVdEpRR.exe
    C:\Windows\System\TVdEpRR.exe
    3⤵
    PID:3364
- - C:\Windows\System\dIMqkJV.exe
    C:\Windows\System\dIMqkJV.exe
    3⤵
    PID:15436
- - C:\Windows\System\qXzaRsI.exe
    C:\Windows\System\qXzaRsI.exe
    3⤵
    PID:8036
- - C:\Windows\System\SbhRRzz.exe
    C:\Windows\System\SbhRRzz.exe
    3⤵
    PID:7684
- - C:\Windows\System\EjjXmlT.exe
    C:\Windows\System\EjjXmlT.exe
    3⤵
    PID:6988
- - C:\Windows\System\VZvqFIX.exe
    C:\Windows\System\VZvqFIX.exe
    3⤵
    PID:9540
- - C:\Windows\System\UQfEkfi.exe
    C:\Windows\System\UQfEkfi.exe
    3⤵
    PID:6288
- - C:\Windows\System\jrKKRLH.exe
    C:\Windows\System\jrKKRLH.exe
    3⤵
    PID:16080
- - C:\Windows\System\jZZvSjd.exe
    C:\Windows\System\jZZvSjd.exe
    3⤵
    PID:16112
- - C:\Windows\System\HpyYgKg.exe
    C:\Windows\System\HpyYgKg.exe
    3⤵
    PID:16280
- - C:\Windows\System\jxBqINt.exe
    C:\Windows\System\jxBqINt.exe
    3⤵
    PID:16300
- - C:\Windows\System\vgZckoi.exe
    C:\Windows\System\vgZckoi.exe
    3⤵
    PID:16360
- - C:\Windows\System\UEQFtQZ.exe
    C:\Windows\System\UEQFtQZ.exe
    3⤵
    PID:8172
- - C:\Windows\System\HNDOYEL.exe
    C:\Windows\System\HNDOYEL.exe
    3⤵
    PID:6724
- - C:\Windows\System\hSfYqRX.exe
    C:\Windows\System\hSfYqRX.exe
    3⤵
    PID:8844
- - C:\Windows\System\dALzjUc.exe
    C:\Windows\System\dALzjUc.exe
    3⤵
    PID:7940
- - C:\Windows\System\ECdTljX.exe
    C:\Windows\System\ECdTljX.exe
    3⤵
    PID:5892
- - C:\Windows\System\aXItUXs.exe
    C:\Windows\System\aXItUXs.exe
    3⤵
    PID:14864
- - C:\Windows\System\WbNeVBE.exe
    C:\Windows\System\WbNeVBE.exe
    3⤵
    PID:3688
- - C:\Windows\System\CRTwXOY.exe
    C:\Windows\System\CRTwXOY.exe
    3⤵
    PID:11140
- - C:\Windows\System\IYzudKy.exe
    C:\Windows\System\IYzudKy.exe
    3⤵
    PID:16236
- - C:\Windows\System\itILezP.exe
    C:\Windows\System\itILezP.exe
    3⤵
    PID:13648
- - C:\Windows\System\XUsJVpX.exe
    C:\Windows\System\XUsJVpX.exe
    3⤵
    PID:11248
- - C:\Windows\System\ydyHmxZ.exe
    C:\Windows\System\ydyHmxZ.exe
    3⤵
    PID:184
- - C:\Windows\System\yySHtRK.exe
    C:\Windows\System\yySHtRK.exe
    3⤵
    PID:15424
- - C:\Windows\System\GidZRiR.exe
    C:\Windows\System\GidZRiR.exe
    3⤵
    PID:8992
- - C:\Windows\System\OmSJDJi.exe
    C:\Windows\System\OmSJDJi.exe
    3⤵
    PID:15508
- - C:\Windows\System\nsJQJAn.exe
    C:\Windows\System\nsJQJAn.exe
    3⤵
    PID:4040
- - C:\Windows\System\fPxzSqw.exe
    C:\Windows\System\fPxzSqw.exe
    3⤵
    PID:11640
- - C:\Windows\System\xpnoeuM.exe
    C:\Windows\System\xpnoeuM.exe
    3⤵
    PID:10332
- - C:\Windows\System\aeHamte.exe
    C:\Windows\System\aeHamte.exe
    3⤵
    PID:11112
- - C:\Windows\System\CoJrYiE.exe
    C:\Windows\System\CoJrYiE.exe
    3⤵
    PID:2280
- - C:\Windows\System\VMayZgd.exe
    C:\Windows\System\VMayZgd.exe
    3⤵
    PID:9464
- - C:\Windows\System\vuUYzQf.exe
    C:\Windows\System\vuUYzQf.exe
    3⤵
    PID:7300
- - C:\Windows\System\zSJpBTr.exe
    C:\Windows\System\zSJpBTr.exe
    3⤵
    PID:12792
- - C:\Windows\System\SvahpVv.exe
    C:\Windows\System\SvahpVv.exe
    3⤵
    PID:456
- - C:\Windows\System\TBIRTVR.exe
    C:\Windows\System\TBIRTVR.exe
    3⤵
    PID:8768
- - C:\Windows\System\TUUNPIn.exe
    C:\Windows\System\TUUNPIn.exe
    3⤵
    PID:10700
- - C:\Windows\System\TGIepmw.exe
    C:\Windows\System\TGIepmw.exe
    3⤵
    PID:4548
- - C:\Windows\System\JGaaoJp.exe
    C:\Windows\System\JGaaoJp.exe
    3⤵
    PID:11856
- - C:\Windows\System\auGamQn.exe
    C:\Windows\System\auGamQn.exe
    3⤵
    PID:11436
- - C:\Windows\System\pnEmbqv.exe
    C:\Windows\System\pnEmbqv.exe
    3⤵
    PID:9896
- - C:\Windows\System\qhgPNTe.exe
    C:\Windows\System\qhgPNTe.exe
    3⤵
    PID:11836
- - C:\Windows\System\QPppzQG.exe
    C:\Windows\System\QPppzQG.exe
    3⤵
    PID:12844
- - C:\Windows\System\yNbbuhq.exe
    C:\Windows\System\yNbbuhq.exe
    3⤵
    PID:10736
- - C:\Windows\System\ApRcjCm.exe
    C:\Windows\System\ApRcjCm.exe
    3⤵
    PID:10708
- - C:\Windows\System\lXuTbaq.exe
    C:\Windows\System\lXuTbaq.exe
    3⤵
    PID:4192
- - C:\Windows\System\OlQQxFM.exe
    C:\Windows\System\OlQQxFM.exe
    3⤵
    PID:1660
- - C:\Windows\System\mqVvfAQ.exe
    C:\Windows\System\mqVvfAQ.exe
    3⤵
    PID:11340
- - C:\Windows\System\FNCrtjG.exe
    C:\Windows\System\FNCrtjG.exe
    3⤵
    PID:11752
- - C:\Windows\System\nOIbmzy.exe
    C:\Windows\System\nOIbmzy.exe
    3⤵
    PID:5948
- - C:\Windows\System\TLyCKoO.exe
    C:\Windows\System\TLyCKoO.exe
    3⤵
    PID:7000
- - C:\Windows\System\DzPNwBr.exe
    C:\Windows\System\DzPNwBr.exe
    3⤵
    PID:15980
- - C:\Windows\System\CPcELgV.exe
    C:\Windows\System\CPcELgV.exe
    3⤵
    PID:14592
- - C:\Windows\System\SEcARAR.exe
    C:\Windows\System\SEcARAR.exe
    3⤵
    PID:9932
- - C:\Windows\System\bwfkjls.exe
    C:\Windows\System\bwfkjls.exe
    3⤵
    PID:15484
- - C:\Windows\System\TSKSmzQ.exe
    C:\Windows\System\TSKSmzQ.exe
    3⤵
    PID:1028
- - C:\Windows\System\mmkKZhz.exe
    C:\Windows\System\mmkKZhz.exe
    3⤵
    PID:16136
- - C:\Windows\System\PjoUQHP.exe
    C:\Windows\System\PjoUQHP.exe
    3⤵
    PID:9228
- - C:\Windows\System\IpQGOsn.exe
    C:\Windows\System\IpQGOsn.exe
    3⤵
    PID:14800
- - C:\Windows\System\OlxVwQX.exe
    C:\Windows\System\OlxVwQX.exe
    3⤵
    PID:1168
- - C:\Windows\System\brjMulS.exe
    C:\Windows\System\brjMulS.exe
    3⤵
    PID:15712
- - C:\Windows\System\YyLnDHk.exe
    C:\Windows\System\YyLnDHk.exe
    3⤵
    PID:8948
- - C:\Windows\System\kyZxuKw.exe
    C:\Windows\System\kyZxuKw.exe
    3⤵
    PID:10372
- - C:\Windows\System\yneRKCw.exe
    C:\Windows\System\yneRKCw.exe
    3⤵
    PID:10624
- - C:\Windows\System\OJZVjfV.exe
    C:\Windows\System\OJZVjfV.exe
    3⤵
    PID:8500
- - C:\Windows\System\CsPbwrh.exe
    C:\Windows\System\CsPbwrh.exe
    3⤵
    PID:11900
- - C:\Windows\System\WJsmXZa.exe
    C:\Windows\System\WJsmXZa.exe
    3⤵
    PID:8604
- - C:\Windows\System\rEwJDtj.exe
    C:\Windows\System\rEwJDtj.exe
    3⤵
    PID:9324
- - C:\Windows\System\HNZSUbz.exe
    C:\Windows\System\HNZSUbz.exe
    3⤵
    PID:8188
- - C:\Windows\System\SMLexGP.exe
    C:\Windows\System\SMLexGP.exe
    3⤵
    PID:10932
- - C:\Windows\System\ENrAssb.exe
    C:\Windows\System\ENrAssb.exe
    3⤵
    PID:15596
- - C:\Windows\System\PpgAfiI.exe
    C:\Windows\System\PpgAfiI.exe
    3⤵
    PID:12968
- - C:\Windows\System\PHACcMT.exe
    C:\Windows\System\PHACcMT.exe
    3⤵
    PID:6872
- - C:\Windows\System\TNyltZx.exe
    C:\Windows\System\TNyltZx.exe
    3⤵
    PID:13456
- - C:\Windows\System\hqLULpO.exe
    C:\Windows\System\hqLULpO.exe
    3⤵
    PID:13024
- - C:\Windows\System\KJvZdOG.exe
    C:\Windows\System\KJvZdOG.exe
    3⤵
    PID:1100
- - C:\Windows\System\GARxKcS.exe
    C:\Windows\System\GARxKcS.exe
    3⤵
    PID:15788
- - C:\Windows\System\fqwmPJr.exe
    C:\Windows\System\fqwmPJr.exe
    3⤵
    PID:12368
- - C:\Windows\System\OQvloJU.exe
    C:\Windows\System\OQvloJU.exe
    3⤵
    PID:10480
- - C:\Windows\System\Zyscqij.exe
    C:\Windows\System\Zyscqij.exe
    3⤵
    PID:15780
- - C:\Windows\System\rUZiIbf.exe
    C:\Windows\System\rUZiIbf.exe
    3⤵
    PID:6784
- - C:\Windows\System\ZeHjzSP.exe
    C:\Windows\System\ZeHjzSP.exe
    3⤵
    PID:15848
- - C:\Windows\System\AShINIG.exe
    C:\Windows\System\AShINIG.exe
    3⤵
    PID:12124
- - C:\Windows\System\SoknwWC.exe
    C:\Windows\System\SoknwWC.exe
    3⤵
    PID:11644
- - C:\Windows\System\UnUwecO.exe
    C:\Windows\System\UnUwecO.exe
    3⤵
    PID:16316
- - C:\Windows\System\myrHKSi.exe
    C:\Windows\System\myrHKSi.exe
    3⤵
    PID:3332
- - C:\Windows\System\jFRwzJB.exe
    C:\Windows\System\jFRwzJB.exe
    3⤵
    PID:11320
- - C:\Windows\System\PpZFJhP.exe
    C:\Windows\System\PpZFJhP.exe
    3⤵
    PID:11344
- - C:\Windows\System\YsHXCVT.exe
    C:\Windows\System\YsHXCVT.exe
    3⤵
    PID:11408
- - C:\Windows\System\pnorADh.exe
    C:\Windows\System\pnorADh.exe
    3⤵
    PID:12136
- - C:\Windows\System\eIajMHd.exe
    C:\Windows\System\eIajMHd.exe
    3⤵
    PID:5144
- - C:\Windows\System\LaMfKMw.exe
    C:\Windows\System\LaMfKMw.exe
    3⤵
    PID:15440
- - C:\Windows\System\rCPDClb.exe
    C:\Windows\System\rCPDClb.exe
    3⤵
    PID:10668
- - C:\Windows\System\yxkInoV.exe
    C:\Windows\System\yxkInoV.exe
    3⤵
    PID:10500
- - C:\Windows\System\DjEVAfp.exe
    C:\Windows\System\DjEVAfp.exe
    3⤵
    PID:5656
- - C:\Windows\System\ezQYhuS.exe
    C:\Windows\System\ezQYhuS.exe
    3⤵
    PID:15620
- - C:\Windows\System\uyVBgAV.exe
    C:\Windows\System\uyVBgAV.exe
    3⤵
    PID:11124
- - C:\Windows\System\muolZbR.exe
    C:\Windows\System\muolZbR.exe
    3⤵
    PID:11168
- - C:\Windows\System\ZCkwueU.exe
    C:\Windows\System\ZCkwueU.exe
    3⤵
    PID:16104
- - C:\Windows\System\GTzUBHG.exe
    C:\Windows\System\GTzUBHG.exe
    3⤵
    PID:11500
- - C:\Windows\System\wrJBATs.exe
    C:\Windows\System\wrJBATs.exe
    3⤵
    PID:11504
- - C:\Windows\System\kXowTjj.exe
    C:\Windows\System\kXowTjj.exe
    3⤵
    PID:8024
- - C:\Windows\System\qSpgMFw.exe
    C:\Windows\System\qSpgMFw.exe
    3⤵
    PID:13092
- - C:\Windows\System\GkOMZOY.exe
    C:\Windows\System\GkOMZOY.exe
    3⤵
    PID:11560
- - C:\Windows\System\hndbngz.exe
    C:\Windows\System\hndbngz.exe
    3⤵
    PID:10672
- - C:\Windows\System\OZouJoq.exe
    C:\Windows\System\OZouJoq.exe
    3⤵
    PID:9944
- - C:\Windows\System\CuDVWDD.exe
    C:\Windows\System\CuDVWDD.exe
    3⤵
    PID:11064
- - C:\Windows\System\VcFRFAe.exe
    C:\Windows\System\VcFRFAe.exe
    3⤵
    PID:15220
- - C:\Windows\System\QCsgzCv.exe
    C:\Windows\System\QCsgzCv.exe
    3⤵
    PID:14236
- - C:\Windows\System\RSWkaTh.exe
    C:\Windows\System\RSWkaTh.exe
    3⤵
    PID:15952
- - C:\Windows\System\Vxvhukg.exe
    C:\Windows\System\Vxvhukg.exe
    3⤵
    PID:11080
- - C:\Windows\System\NHjrMER.exe
    C:\Windows\System\NHjrMER.exe
    3⤵
    PID:12000
- - C:\Windows\System\gGgNwro.exe
    C:\Windows\System\gGgNwro.exe
    3⤵
    PID:15672
- - C:\Windows\System\mbXlNDO.exe
    C:\Windows\System\mbXlNDO.exe
    3⤵
    PID:15328
- - C:\Windows\System\izXkWiT.exe
    C:\Windows\System\izXkWiT.exe
    3⤵
    PID:11796
- - C:\Windows\System\YIMFwnr.exe
    C:\Windows\System\YIMFwnr.exe
    3⤵
    PID:12088
- - C:\Windows\System\raDwznH.exe
    C:\Windows\System\raDwznH.exe
    3⤵
    PID:5076
- - C:\Windows\System\obXxSrV.exe
    C:\Windows\System\obXxSrV.exe
    3⤵
    PID:12032
- - C:\Windows\System\oiGpdMH.exe
    C:\Windows\System\oiGpdMH.exe
    3⤵
    PID:13156
- - C:\Windows\System\gHyJsnj.exe
    C:\Windows\System\gHyJsnj.exe
    3⤵
    PID:13940
- - C:\Windows\System\oFewvDe.exe
    C:\Windows\System\oFewvDe.exe
    3⤵
    PID:13496
- - C:\Windows\System\BtZVOqm.exe
    C:\Windows\System\BtZVOqm.exe
    3⤵
    PID:12996
- - C:\Windows\System\LaFpFFu.exe
    C:\Windows\System\LaFpFFu.exe
    3⤵
    PID:13704
- - C:\Windows\System\ssurjqO.exe
    C:\Windows\System\ssurjqO.exe
    3⤵
    PID:13744
- C:\Windows\System\HtBkqSY.exe
  C:\Windows\System\HtBkqSY.exe
  2⤵
  PID:10868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
    3⤵
    PID:8388
- - C:\Windows\System\aWnxFWB.exe
    C:\Windows\System\aWnxFWB.exe
    3⤵
    PID:11564
- - C:\Windows\System\HFaDXnq.exe
    C:\Windows\System\HFaDXnq.exe
    3⤵
    PID:516
- - C:\Windows\System\WNWocpj.exe
    C:\Windows\System\WNWocpj.exe
    3⤵
    PID:11048
- - C:\Windows\System\lTYbpJn.exe
    C:\Windows\System\lTYbpJn.exe
    3⤵
    PID:11932
- - C:\Windows\System\XsdQlwc.exe
    C:\Windows\System\XsdQlwc.exe
    3⤵
    PID:11516
- - C:\Windows\System\pWuEOYw.exe
    C:\Windows\System\pWuEOYw.exe
    3⤵
    PID:2540
- - C:\Windows\System\epSsMey.exe
    C:\Windows\System\epSsMey.exe
    3⤵
    PID:11824
- - C:\Windows\System\NVOceuy.exe
    C:\Windows\System\NVOceuy.exe
    3⤵
    PID:11944
- - C:\Windows\System\houpnFc.exe
    C:\Windows\System\houpnFc.exe
    3⤵
    PID:11984
- - C:\Windows\System\qApgTRW.exe
    C:\Windows\System\qApgTRW.exe
    3⤵
    PID:12016
- - C:\Windows\System\dNRkqXI.exe
    C:\Windows\System\dNRkqXI.exe
    3⤵
    PID:12188
- - C:\Windows\System\nKtenwa.exe
    C:\Windows\System\nKtenwa.exe
    3⤵
    PID:12276
- - C:\Windows\System\jjbAGqZ.exe
    C:\Windows\System\jjbAGqZ.exe
    3⤵
    PID:12000
- - C:\Windows\System\npUhHTc.exe
    C:\Windows\System\npUhHTc.exe
    3⤵
    PID:12172
- - C:\Windows\System\rdJwrOP.exe
    C:\Windows\System\rdJwrOP.exe
    3⤵
    PID:12216
- - C:\Windows\System\HuaYDDI.exe
    C:\Windows\System\HuaYDDI.exe
    3⤵
    PID:6956
- - C:\Windows\System\mSkxqmt.exe
    C:\Windows\System\mSkxqmt.exe
    3⤵
    PID:11568
- - C:\Windows\System\WJXGiUx.exe
    C:\Windows\System\WJXGiUx.exe
    3⤵
    PID:11500
- - C:\Windows\System\nxEKKEp.exe
    C:\Windows\System\nxEKKEp.exe
    3⤵
    PID:11808
- - C:\Windows\System\gIgUraA.exe
    C:\Windows\System\gIgUraA.exe
    3⤵
    PID:12600
- - C:\Windows\System\BqZnrzX.exe
    C:\Windows\System\BqZnrzX.exe
    3⤵
    PID:12620
- - C:\Windows\System\sLhexFc.exe
    C:\Windows\System\sLhexFc.exe
    3⤵
    PID:12640
- - C:\Windows\System\fGBzLuf.exe
    C:\Windows\System\fGBzLuf.exe
    3⤵
    PID:12656
- - C:\Windows\System\SMBdtkl.exe
    C:\Windows\System\SMBdtkl.exe
    3⤵
    PID:12672
- - C:\Windows\System\kjVMtWi.exe
    C:\Windows\System\kjVMtWi.exe
    3⤵
    PID:12692
- - C:\Windows\System\ldwuynD.exe
    C:\Windows\System\ldwuynD.exe
    3⤵
    PID:12708
- - C:\Windows\System\QTpsMPL.exe
    C:\Windows\System\QTpsMPL.exe
    3⤵
    PID:12728
- - C:\Windows\System\tEqNMhW.exe
    C:\Windows\System\tEqNMhW.exe
    3⤵
    PID:12744
- - C:\Windows\System\WIexRqF.exe
    C:\Windows\System\WIexRqF.exe
    3⤵
    PID:12768
- - C:\Windows\System\BumYyoM.exe
    C:\Windows\System\BumYyoM.exe
    3⤵
    PID:12788
- - C:\Windows\System\mKMRQUb.exe
    C:\Windows\System\mKMRQUb.exe
    3⤵
    PID:12804
- - C:\Windows\System\VYhJlbR.exe
    C:\Windows\System\VYhJlbR.exe
    3⤵
    PID:12820
- - C:\Windows\System\zCSQOos.exe
    C:\Windows\System\zCSQOos.exe
    3⤵
    PID:12840
- - C:\Windows\System\lSHbWiS.exe
    C:\Windows\System\lSHbWiS.exe
    3⤵
    PID:12860
- - C:\Windows\System\ivrRtyh.exe
    C:\Windows\System\ivrRtyh.exe
    3⤵
    PID:12896
- - C:\Windows\System\UEEyoVf.exe
    C:\Windows\System\UEEyoVf.exe
    3⤵
    PID:12912
- - C:\Windows\System\LybYdsz.exe
    C:\Windows\System\LybYdsz.exe
    3⤵
    PID:12928
- - C:\Windows\System\WNWuPTv.exe
    C:\Windows\System\WNWuPTv.exe
    3⤵
    PID:12944
- - C:\Windows\System\VuCSJvt.exe
    C:\Windows\System\VuCSJvt.exe
    3⤵
    PID:12976
- - C:\Windows\System\tGbesvr.exe
    C:\Windows\System\tGbesvr.exe
    3⤵
    PID:13000
- - C:\Windows\System\lGANwiK.exe
    C:\Windows\System\lGANwiK.exe
    3⤵
    PID:13020
- - C:\Windows\System\MpAkqku.exe
    C:\Windows\System\MpAkqku.exe
    3⤵
    PID:13052
- - C:\Windows\System\HRmZIXw.exe
    C:\Windows\System\HRmZIXw.exe
    3⤵
    PID:13088
- - C:\Windows\System\CnHDhKt.exe
    C:\Windows\System\CnHDhKt.exe
    3⤵
    PID:13116
- - C:\Windows\System\LVMJwzO.exe
    C:\Windows\System\LVMJwzO.exe
    3⤵
    PID:13156
- - C:\Windows\System\jUMqyxB.exe
    C:\Windows\System\jUMqyxB.exe
    3⤵
    PID:13196
- - C:\Windows\System\uMzBXWp.exe
    C:\Windows\System\uMzBXWp.exe
    3⤵
    PID:13220
- - C:\Windows\System\BEVMuhZ.exe
    C:\Windows\System\BEVMuhZ.exe
    3⤵
    PID:13244
- - C:\Windows\System\djkDNJm.exe
    C:\Windows\System\djkDNJm.exe
    3⤵
    PID:13276
- - C:\Windows\System\DTfIyjp.exe
    C:\Windows\System\DTfIyjp.exe
    3⤵
    PID:13308
- - C:\Windows\System\fYUuxoj.exe
    C:\Windows\System\fYUuxoj.exe
    3⤵
    PID:11888
- - C:\Windows\System\bADnGSN.exe
    C:\Windows\System\bADnGSN.exe
    3⤵
    PID:12372
- - C:\Windows\System\vFXnTcQ.exe
    C:\Windows\System\vFXnTcQ.exe
    3⤵
    PID:11968
- - C:\Windows\System\cWIFyvn.exe
    C:\Windows\System\cWIFyvn.exe
    3⤵
    PID:12460
- - C:\Windows\System\fjsREUL.exe
    C:\Windows\System\fjsREUL.exe
    3⤵
    PID:12472
- - C:\Windows\System\jLQtcUt.exe
    C:\Windows\System\jLQtcUt.exe
    3⤵
    PID:13332
- - C:\Windows\System\ybikHdN.exe
    C:\Windows\System\ybikHdN.exe
    3⤵
    PID:13416
- - C:\Windows\System\fNSsFow.exe
    C:\Windows\System\fNSsFow.exe
    3⤵
    PID:13452
- - C:\Windows\System\eOPYdEZ.exe
    C:\Windows\System\eOPYdEZ.exe
    3⤵
    PID:13256
- - C:\Windows\System\hElAGpM.exe
    C:\Windows\System\hElAGpM.exe
    3⤵
    PID:12740
- - C:\Windows\System\sBkXaUG.exe
    C:\Windows\System\sBkXaUG.exe
    3⤵
    PID:1880
- - C:\Windows\System\SJBlaju.exe
    C:\Windows\System\SJBlaju.exe
    3⤵
    PID:13080
- - C:\Windows\System\WsMdhDh.exe
    C:\Windows\System\WsMdhDh.exe
    3⤵
    PID:13140
- - C:\Windows\System\loURRPU.exe
    C:\Windows\System\loURRPU.exe
    3⤵
    PID:13152
- - C:\Windows\System\sIHeZEx.exe
    C:\Windows\System\sIHeZEx.exe
    3⤵
    PID:13272
- - C:\Windows\System\SrPDTAF.exe
    C:\Windows\System\SrPDTAF.exe
    3⤵
    PID:11612
- - C:\Windows\System\waUtizx.exe
    C:\Windows\System\waUtizx.exe
    3⤵
    PID:12348
- - C:\Windows\System\PMujyis.exe
    C:\Windows\System\PMujyis.exe
    3⤵
    PID:13596
- - C:\Windows\System\TDdGjMh.exe
    C:\Windows\System\TDdGjMh.exe
    3⤵
    PID:13600
- - C:\Windows\System\EeKaSqV.exe
    C:\Windows\System\EeKaSqV.exe
    3⤵
    PID:2996
- - C:\Windows\System\dvtsiNU.exe
    C:\Windows\System\dvtsiNU.exe
    3⤵
    PID:11656
- - C:\Windows\System\TUzQiad.exe
    C:\Windows\System\TUzQiad.exe
    3⤵
    PID:12724
- - C:\Windows\System\QSfAPYx.exe
    C:\Windows\System\QSfAPYx.exe
    3⤵
    PID:13112
- C:\Windows\System\zPlFPKP.exe
  C:\Windows\System\zPlFPKP.exe
  2⤵
  PID:10888
- C:\Windows\System\AULCXbS.exe
  C:\Windows\System\AULCXbS.exe
  2⤵
  PID:10912
- C:\Windows\System\CDKeHKe.exe
  C:\Windows\System\CDKeHKe.exe
  2⤵
  PID:10940
- C:\Windows\System\HpqFMsJ.exe
  C:\Windows\System\HpqFMsJ.exe
  2⤵
  PID:10960
- C:\Windows\System\RrAqnvC.exe
  C:\Windows\System\RrAqnvC.exe
  2⤵
  PID:10980
- C:\Windows\System\fYcJygN.exe
  C:\Windows\System\fYcJygN.exe
  2⤵
  PID:11000
- C:\Windows\System\XCZushg.exe
  C:\Windows\System\XCZushg.exe
  2⤵
  PID:8328
- C:\Windows\System\eMkSEHa.exe
  C:\Windows\System\eMkSEHa.exe
  2⤵
  PID:5032
- C:\Windows\System\JkNlrnz.exe
  C:\Windows\System\JkNlrnz.exe
  2⤵
  PID:2812
- C:\Windows\System\yuRGyyN.exe
  C:\Windows\System\yuRGyyN.exe
  2⤵
  PID:9196
- C:\Windows\System\YKJwLqa.exe
  C:\Windows\System\YKJwLqa.exe
  2⤵
  PID:6900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
    3⤵
    PID:11496
- C:\Windows\System\otaRMqi.exe
  C:\Windows\System\otaRMqi.exe
  2⤵
  PID:9588
- C:\Windows\System\hHgiEzg.exe
  C:\Windows\System\hHgiEzg.exe
  2⤵
  PID:1352
- C:\Windows\System\zHRxcFN.exe
  C:\Windows\System\zHRxcFN.exe
  2⤵
  PID:7144
- C:\Windows\System\AtonGph.exe
  C:\Windows\System\AtonGph.exe
  2⤵
  PID:11072
- C:\Windows\System\xdkVOZu.exe
  C:\Windows\System\xdkVOZu.exe
  2⤵
  PID:11108
- C:\Windows\System\mxMSuHW.exe
  C:\Windows\System\mxMSuHW.exe
  2⤵
  PID:4516
- C:\Windows\System\rxKXWIJ.exe
  C:\Windows\System\rxKXWIJ.exe
  2⤵
  PID:10136
- C:\Windows\System\FlxJCXV.exe
  C:\Windows\System\FlxJCXV.exe
  2⤵
  PID:10148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
    3⤵
    PID:2196
- C:\Windows\System\AwBUVuH.exe
  C:\Windows\System\AwBUVuH.exe
  2⤵
  PID:6408
- C:\Windows\System\kVkCaCY.exe
  C:\Windows\System\kVkCaCY.exe
  2⤵
  PID:11200
- C:\Windows\System\lUBrvka.exe
  C:\Windows\System\lUBrvka.exe
  2⤵
  PID:8612
- C:\Windows\System\aQfZeAB.exe
  C:\Windows\System\aQfZeAB.exe
  2⤵
  PID:10376
- C:\Windows\System\JidHWPf.exe
  C:\Windows\System\JidHWPf.exe
  2⤵
  PID:6424
- C:\Windows\System\AaZYNJT.exe
  C:\Windows\System\AaZYNJT.exe
  2⤵
  PID:10752
- C:\Windows\System\TIPTlnx.exe
  C:\Windows\System\TIPTlnx.exe
  2⤵
  PID:9836
- C:\Windows\System\ZEaTDrS.exe
  C:\Windows\System\ZEaTDrS.exe
  2⤵
  PID:9988
- C:\Windows\System\MfEmgUa.exe
  C:\Windows\System\MfEmgUa.exe
  2⤵
  PID:10048
- C:\Windows\System\wzIDGwP.exe
  C:\Windows\System\wzIDGwP.exe
  2⤵
  PID:10072
- C:\Windows\System\VtWjcuN.exe
  C:\Windows\System\VtWjcuN.exe
  2⤵
  PID:10116
- C:\Windows\System\iujvZDN.exe
  C:\Windows\System\iujvZDN.exe
  2⤵
  PID:2268
- C:\Windows\System\cCItGUJ.exe
  C:\Windows\System\cCItGUJ.exe
  2⤵
  PID:2108
- C:\Windows\System\PsKbIEp.exe
  C:\Windows\System\PsKbIEp.exe
  2⤵
  PID:1456
- C:\Windows\System\wjeKHxj.exe
  C:\Windows\System\wjeKHxj.exe
  2⤵
  PID:368
- C:\Windows\System\KyMYqxg.exe
  C:\Windows\System\KyMYqxg.exe
  2⤵
  PID:4420
- C:\Windows\System\GtfQaao.exe
  C:\Windows\System\GtfQaao.exe
  2⤵
  PID:1180
- C:\Windows\System\hCGKwaw.exe
  C:\Windows\System\hCGKwaw.exe
  2⤵
  PID:396
- C:\Windows\System\MfDuCkR.exe
  C:\Windows\System\MfDuCkR.exe
  2⤵
  PID:11164
- C:\Windows\System\CdDqSDe.exe
  C:\Windows\System\CdDqSDe.exe
  2⤵
  PID:9068
- C:\Windows\System\lbeGcFs.exe
  C:\Windows\System\lbeGcFs.exe
  2⤵
  PID:10248
- C:\Windows\System\zjszmUA.exe
  C:\Windows\System\zjszmUA.exe
  2⤵
  PID:9504
- C:\Windows\System\ksNnUKj.exe
  C:\Windows\System\ksNnUKj.exe
  2⤵
  PID:9616
- C:\Windows\System\WNirpJk.exe
  C:\Windows\System\WNirpJk.exe
  2⤵
  PID:4944
- C:\Windows\System\KsPCkZN.exe
  C:\Windows\System\KsPCkZN.exe
  2⤵
  PID:9920
- C:\Windows\System\rUcPSHU.exe
  C:\Windows\System\rUcPSHU.exe
  2⤵
  PID:2432
- C:\Windows\System\TsyvjjI.exe
  C:\Windows\System\TsyvjjI.exe
  2⤵
  PID:10560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
    3⤵
    PID:7260
- C:\Windows\System\PtElwaS.exe
  C:\Windows\System\PtElwaS.exe
  2⤵
  PID:9524
- C:\Windows\System\XMkKJHc.exe
  C:\Windows\System\XMkKJHc.exe
  2⤵
  PID:10172
- C:\Windows\System\kKRmUzc.exe
  C:\Windows\System\kKRmUzc.exe
  2⤵
  PID:7752
- C:\Windows\System\HvXPQel.exe
  C:\Windows\System\HvXPQel.exe
  2⤵
  PID:7340
- C:\Windows\System\MhMpzfQ.exe
  C:\Windows\System\MhMpzfQ.exe
  2⤵
  PID:2548
- C:\Windows\System\XnZqeIa.exe
  C:\Windows\System\XnZqeIa.exe
  2⤵
  PID:10928
- C:\Windows\System\YRceMfU.exe
  C:\Windows\System\YRceMfU.exe
  2⤵
  PID:4384
- C:\Windows\System\qowExeW.exe
  C:\Windows\System\qowExeW.exe
  2⤵
  PID:9952
- C:\Windows\System\dPvEGHu.exe
  C:\Windows\System\dPvEGHu.exe
  2⤵
  PID:10108
- C:\Windows\System\ECNqkLQ.exe
  C:\Windows\System\ECNqkLQ.exe
  2⤵
  PID:10056
- C:\Windows\System\MXbFhpn.exe
  C:\Windows\System\MXbFhpn.exe
  2⤵
  PID:10392
- C:\Windows\System\BHZMVdW.exe
  C:\Windows\System\BHZMVdW.exe
  2⤵
  PID:10536
- C:\Windows\System\ybicqKH.exe
  C:\Windows\System\ybicqKH.exe
  2⤵
  PID:10676
- C:\Windows\System\YRWndcv.exe
  C:\Windows\System\YRWndcv.exe
  2⤵
  PID:11692
- C:\Windows\System\QQEYzNA.exe
  C:\Windows\System\QQEYzNA.exe
  2⤵
  PID:11720
- C:\Windows\System\dqQkNem.exe
  C:\Windows\System\dqQkNem.exe
  2⤵
  PID:11740
- C:\Windows\System\VpaPszI.exe
  C:\Windows\System\VpaPszI.exe
  2⤵
  PID:11764
- C:\Windows\System\QwvIRbi.exe
  C:\Windows\System\QwvIRbi.exe
  2⤵
  PID:11788
- C:\Windows\System\HsVUxMw.exe
  C:\Windows\System\HsVUxMw.exe
  2⤵
  PID:11812
- C:\Windows\System\TWxQrnd.exe
  C:\Windows\System\TWxQrnd.exe
  2⤵
  PID:11828
- C:\Windows\System\yqYeyWs.exe
  C:\Windows\System\yqYeyWs.exe
  2⤵
  PID:11848
- C:\Windows\System\OUKOSNP.exe
  C:\Windows\System\OUKOSNP.exe
  2⤵
  PID:11872
- C:\Windows\System\wpcbngO.exe
  C:\Windows\System\wpcbngO.exe
  2⤵
  PID:11892
- C:\Windows\System\EfqmgDB.exe
  C:\Windows\System\EfqmgDB.exe
  2⤵
  PID:11916
- C:\Windows\System\eskTNTc.exe
  C:\Windows\System\eskTNTc.exe
  2⤵
  PID:13064
- C:\Windows\System\WMjrsJD.exe
  C:\Windows\System\WMjrsJD.exe
  2⤵
  PID:13424
- C:\Windows\System\NLKBOZw.exe
  C:\Windows\System\NLKBOZw.exe
  2⤵
  PID:13828
- C:\Windows\System\MvzlmHP.exe
  C:\Windows\System\MvzlmHP.exe
  2⤵
  PID:13856
- C:\Windows\System\Ruqyrxm.exe
  C:\Windows\System\Ruqyrxm.exe
  2⤵
  PID:13880
- C:\Windows\System\fnEUrxz.exe
  C:\Windows\System\fnEUrxz.exe
  2⤵
  PID:14084
- C:\Windows\System\sAmPOik.exe
  C:\Windows\System\sAmPOik.exe
  2⤵
  PID:12584
- C:\Windows\System\rVcowzE.exe
  C:\Windows\System\rVcowzE.exe
  2⤵
  PID:12664
- C:\Windows\System\ubUzCYD.exe
  C:\Windows\System\ubUzCYD.exe
  2⤵
  PID:14224
- C:\Windows\System\YoNXJeq.exe
  C:\Windows\System\YoNXJeq.exe
  2⤵
  PID:13532
- C:\Windows\System\eWoomLK.exe
  C:\Windows\System\eWoomLK.exe
  2⤵
  PID:14244
- C:\Windows\System\mkxTsUJ.exe
  C:\Windows\System\mkxTsUJ.exe
  2⤵
  PID:12300
- C:\Windows\System\YaLwAHS.exe
  C:\Windows\System\YaLwAHS.exe
  2⤵
  PID:12344
- C:\Windows\System\fxriBEw.exe
  C:\Windows\System\fxriBEw.exe
  2⤵
  PID:12012
- C:\Windows\System\IiUmplF.exe
  C:\Windows\System\IiUmplF.exe
  2⤵
  PID:12608
- C:\Windows\System\aNOZNLe.exe
  C:\Windows\System\aNOZNLe.exe
  2⤵
  PID:1288
- C:\Windows\System\MIxZZNf.exe
  C:\Windows\System\MIxZZNf.exe
  2⤵
  PID:11616
- C:\Windows\System\VFtxTZr.exe
  C:\Windows\System\VFtxTZr.exe
  2⤵
  PID:14240
- C:\Windows\System\qeZwnHt.exe
  C:\Windows\System\qeZwnHt.exe
  2⤵
  PID:9376
- C:\Windows\System\rCeBkDP.exe
  C:\Windows\System\rCeBkDP.exe
  2⤵
  PID:13504
- C:\Windows\System\OonnJZy.exe
  C:\Windows\System\OonnJZy.exe
  2⤵
  PID:2948
- C:\Windows\System\kvUmDKH.exe
  C:\Windows\System\kvUmDKH.exe
  2⤵
  PID:13332
- C:\Windows\System\IXHDGHr.exe
  C:\Windows\System\IXHDGHr.exe
  2⤵
  PID:12308
- C:\Windows\System\RhgOUvB.exe
  C:\Windows\System\RhgOUvB.exe
  2⤵
  PID:13840
- C:\Windows\System\KyMXuDc.exe
  C:\Windows\System\KyMXuDc.exe
  2⤵
  PID:13788
- C:\Windows\System\IAikyxu.exe
  C:\Windows\System\IAikyxu.exe
  2⤵
  PID:1512
- C:\Windows\System\RUUssMJ.exe
  C:\Windows\System\RUUssMJ.exe
  2⤵
  PID:14232
- C:\Windows\System\TPneUqf.exe
  C:\Windows\System\TPneUqf.exe
  2⤵
  PID:11672
- C:\Windows\System\GvwXleD.exe
  C:\Windows\System\GvwXleD.exe
  2⤵
  PID:5320
- C:\Windows\System\ofswHEq.exe
  C:\Windows\System\ofswHEq.exe
  2⤵
  PID:5304
- C:\Windows\System\KfuALzI.exe
  C:\Windows\System\KfuALzI.exe
  2⤵
  PID:2804
- C:\Windows\System\EBTZsvd.exe
  C:\Windows\System\EBTZsvd.exe
  2⤵
  PID:11488
- C:\Windows\System\XheQoAm.exe
  C:\Windows\System\XheQoAm.exe
  2⤵
  PID:13208
- C:\Windows\System\SzhlFLW.exe
  C:\Windows\System\SzhlFLW.exe
  2⤵
  PID:13776
- C:\Windows\System\GXzEvaL.exe
  C:\Windows\System\GXzEvaL.exe
  2⤵
  PID:12192
- C:\Windows\System\JkmSsTJ.exe
  C:\Windows\System\JkmSsTJ.exe
  2⤵
  PID:14444
- C:\Windows\System\MKDYOGf.exe
  C:\Windows\System\MKDYOGf.exe
  2⤵
  PID:14684
- C:\Windows\System\oeCaboj.exe
  C:\Windows\System\oeCaboj.exe
  2⤵
  PID:14936
- C:\Windows\System\OSZydOb.exe
  C:\Windows\System\OSZydOb.exe
  2⤵
  PID:14968
- C:\Windows\System\NcxPPeC.exe
  C:\Windows\System\NcxPPeC.exe
  2⤵
  PID:2428
- C:\Windows\System\VjLWnOM.exe
  C:\Windows\System\VjLWnOM.exe
  2⤵
  PID:14356
- C:\Windows\System\cxgycYt.exe
  C:\Windows\System\cxgycYt.exe
  2⤵
  PID:5480
- C:\Windows\System\cwmnuhO.exe
  C:\Windows\System\cwmnuhO.exe
  2⤵
  PID:12824
- C:\Windows\System\GguqTGL.exe
  C:\Windows\System\GguqTGL.exe
  2⤵
  PID:12768
- C:\Windows\System\iTvsKdm.exe
  C:\Windows\System\iTvsKdm.exe
  2⤵
  PID:14620
- C:\Windows\System\muJcUXc.exe
  C:\Windows\System\muJcUXc.exe
  2⤵
  PID:5536
- C:\Windows\System\QDHEgbx.exe
  C:\Windows\System\QDHEgbx.exe
  2⤵
  PID:5816
- C:\Windows\System\JopQAmR.exe
  C:\Windows\System\JopQAmR.exe
  2⤵
  PID:13112
- C:\Windows\System\tnAWurZ.exe
  C:\Windows\System\tnAWurZ.exe
  2⤵
  PID:6524
- C:\Windows\System\BGUpdOf.exe
  C:\Windows\System\BGUpdOf.exe
  2⤵
  PID:14728
- C:\Windows\System\hxQZKla.exe
  C:\Windows\System\hxQZKla.exe
  2⤵
  PID:6196
- C:\Windows\System\chkvhGu.exe
  C:\Windows\System\chkvhGu.exe
  2⤵
  PID:15124
- C:\Windows\System\tcMPfjZ.exe
  C:\Windows\System\tcMPfjZ.exe
  2⤵
  PID:7140
- C:\Windows\System\pzWcmbM.exe
  C:\Windows\System\pzWcmbM.exe
  2⤵
  PID:6668
- C:\Windows\System\xFQoHcm.exe
  C:\Windows\System\xFQoHcm.exe
  2⤵
  PID:6276
- C:\Windows\System\qHfTBXa.exe
  C:\Windows\System\qHfTBXa.exe
  2⤵
  PID:15288
- C:\Windows\System\BKewyfk.exe
  C:\Windows\System\BKewyfk.exe
  2⤵
  PID:15356
- C:\Windows\System\DkYZuGN.exe
  C:\Windows\System\DkYZuGN.exe
  2⤵
  PID:14852
- C:\Windows\System\hBJaYZY.exe
  C:\Windows\System\hBJaYZY.exe
  2⤵
  PID:14872
- C:\Windows\System\NsbxBFG.exe
  C:\Windows\System\NsbxBFG.exe
  2⤵
  PID:11520
- C:\Windows\System\ZxWIbzi.exe
  C:\Windows\System\ZxWIbzi.exe
  2⤵
  PID:14964
- C:\Windows\System\xzJPCZX.exe
  C:\Windows\System\xzJPCZX.exe
  2⤵
  PID:15100
- C:\Windows\System\QxmMnWu.exe
  C:\Windows\System\QxmMnWu.exe
  2⤵
  PID:7852
- C:\Windows\System\qdeDuXu.exe
  C:\Windows\System\qdeDuXu.exe
  2⤵
  PID:15244
- C:\Windows\System\xIDEaIO.exe
  C:\Windows\System\xIDEaIO.exe
  2⤵
  PID:15280
- C:\Windows\System\CVBAxqJ.exe
  C:\Windows\System\CVBAxqJ.exe
  2⤵
  PID:6744
- C:\Windows\System\vNmRcqs.exe
  C:\Windows\System\vNmRcqs.exe
  2⤵
  PID:6640
- C:\Windows\System\CKQdxWa.exe
  C:\Windows\System\CKQdxWa.exe
  2⤵
  PID:6084
- C:\Windows\System\FSDstJe.exe
  C:\Windows\System\FSDstJe.exe
  2⤵
  PID:5252
- C:\Windows\System\doAudbv.exe
  C:\Windows\System\doAudbv.exe
  2⤵
  PID:5864
- C:\Windows\System\yaTMkKH.exe
  C:\Windows\System\yaTMkKH.exe
  2⤵
  PID:12212
- C:\Windows\System\clEjNOT.exe
  C:\Windows\System\clEjNOT.exe
  2⤵
  PID:15064
- C:\Windows\System\irGRpFM.exe
  C:\Windows\System\irGRpFM.exe
  2⤵
  PID:14892
- C:\Windows\System\QHRvsxs.exe
  C:\Windows\System\QHRvsxs.exe
  2⤵
  PID:7404
- C:\Windows\System\AUiobmh.exe
  C:\Windows\System\AUiobmh.exe
  2⤵
  PID:7904
- C:\Windows\System\hXyAHUY.exe
  C:\Windows\System\hXyAHUY.exe
  2⤵
  PID:7332
- C:\Windows\System\uHFMNEn.exe
  C:\Windows\System\uHFMNEn.exe
  2⤵
  PID:15184
- C:\Windows\System\JujTqrl.exe
  C:\Windows\System\JujTqrl.exe
  2⤵
  PID:13032
- C:\Windows\System\JCdEwun.exe
  C:\Windows\System\JCdEwun.exe
  2⤵
  PID:15232
- C:\Windows\System\KEYYTQi.exe
  C:\Windows\System\KEYYTQi.exe
  2⤵
  PID:8820
- C:\Windows\System\STosvAB.exe
  C:\Windows\System\STosvAB.exe
  2⤵
  PID:15968
- C:\Windows\System\FjGWkwa.exe
  C:\Windows\System\FjGWkwa.exe
  2⤵
  PID:15984
- C:\Windows\System\BShizJD.exe
  C:\Windows\System\BShizJD.exe
  2⤵
  PID:16000
- C:\Windows\System\wLMBlBH.exe
  C:\Windows\System\wLMBlBH.exe
  2⤵
  PID:16016
- C:\Windows\System\naPEdpB.exe
  C:\Windows\System\naPEdpB.exe
  2⤵
  PID:16032
- C:\Windows\System\ZgQlYBG.exe
  C:\Windows\System\ZgQlYBG.exe
  2⤵
  PID:16048
- C:\Windows\System\fWbxdpo.exe
  C:\Windows\System\fWbxdpo.exe
  2⤵
  PID:16064
- C:\Windows\System\RXoToSZ.exe
  C:\Windows\System\RXoToSZ.exe
  2⤵
  PID:16084
- C:\Windows\System\upJvamk.exe
  C:\Windows\System\upJvamk.exe
  2⤵
  PID:16124
- C:\Windows\System\oILNanC.exe
  C:\Windows\System\oILNanC.exe
  2⤵
  PID:16156
- C:\Windows\System\oKjdoLf.exe
  C:\Windows\System\oKjdoLf.exe
  2⤵
  PID:16200
- C:\Windows\System\WePHhUx.exe
  C:\Windows\System\WePHhUx.exe
  2⤵
  PID:16256
- C:\Windows\System\MKXTqKr.exe
  C:\Windows\System\MKXTqKr.exe
  2⤵
  PID:16272
- C:\Windows\System\HvNakIW.exe
  C:\Windows\System\HvNakIW.exe
  2⤵
  PID:13752
- C:\Windows\System\IyzebbY.exe
  C:\Windows\System\IyzebbY.exe
  2⤵
  PID:15068
- C:\Windows\System\JWwCCVc.exe
  C:\Windows\System\JWwCCVc.exe
  2⤵
  PID:15504
- C:\Windows\System\WLkTowq.exe
  C:\Windows\System\WLkTowq.exe
  2⤵
  PID:15964
- C:\Windows\System\GTJdUse.exe
  C:\Windows\System\GTJdUse.exe
  2⤵
  PID:16024
- C:\Windows\System\KYXrWOB.exe
  C:\Windows\System\KYXrWOB.exe
  2⤵
  PID:15648
- C:\Windows\System\GHCZWfb.exe
  C:\Windows\System\GHCZWfb.exe
  2⤵
  PID:15748
- C:\Windows\System\XKZxtcu.exe
  C:\Windows\System\XKZxtcu.exe
  2⤵
  PID:11056
- C:\Windows\System\rxfYNsg.exe
  C:\Windows\System\rxfYNsg.exe
  2⤵
  PID:7136
- C:\Windows\System\nukzpyH.exe
  C:\Windows\System\nukzpyH.exe
  2⤵
  PID:11028
- C:\Windows\System\iADqtJQ.exe
  C:\Windows\System\iADqtJQ.exe
  2⤵
  PID:9016
- C:\Windows\System\iBUTzhi.exe
  C:\Windows\System\iBUTzhi.exe
  2⤵
  PID:2500
- C:\Windows\System\SQNUOVo.exe
  C:\Windows\System\SQNUOVo.exe
  2⤵
  PID:9700
- C:\Windows\System\kgeMKcD.exe
  C:\Windows\System\kgeMKcD.exe
  2⤵
  PID:11444
- C:\Windows\System\efigclk.exe
  C:\Windows\System\efigclk.exe
  2⤵
  PID:1796
- C:\Windows\System\ZLrGqex.exe
  C:\Windows\System\ZLrGqex.exe
  2⤵
  PID:12680
- C:\Windows\System\TiOgZdZ.exe
  C:\Windows\System\TiOgZdZ.exe
  2⤵
  PID:10996
- C:\Windows\System\YvOrBuK.exe
  C:\Windows\System\YvOrBuK.exe
  2⤵
  PID:9880
- C:\Windows\System\cbnesZT.exe
  C:\Windows\System\cbnesZT.exe
  2⤵
  PID:948
- C:\Windows\System\hdnaMWB.exe
  C:\Windows\System\hdnaMWB.exe
  2⤵
  PID:1500
- C:\Windows\System\yoLaava.exe
  C:\Windows\System\yoLaava.exe
  2⤵
  PID:13120
- C:\Windows\System\pAfqNHE.exe
  C:\Windows\System\pAfqNHE.exe
  2⤵
  PID:3076
- C:\Windows\System\ixsyoSe.exe
  C:\Windows\System\ixsyoSe.exe
  2⤵
  PID:9064
- C:\Windows\System\rMxSnZz.exe
  C:\Windows\System\rMxSnZz.exe
  2⤵
  PID:16228
- C:\Windows\System\tCUVTXE.exe
  C:\Windows\System\tCUVTXE.exe
  2⤵
  PID:9680
- C:\Windows\System\foWEihh.exe
  C:\Windows\System\foWEihh.exe
  2⤵
  PID:12580
- C:\Windows\System\RTCQXbi.exe
  C:\Windows\System\RTCQXbi.exe
  2⤵
  PID:10724
- C:\Windows\System\xDCvseV.exe
  C:\Windows\System\xDCvseV.exe
  2⤵
  PID:11728
- C:\Windows\System\NAgCTRa.exe
  C:\Windows\System\NAgCTRa.exe
  2⤵
  PID:11884
- C:\Windows\System\YRSzIil.exe
  C:\Windows\System\YRSzIil.exe
  2⤵
  PID:15824
- C:\Windows\System\XjDebCi.exe
  C:\Windows\System\XjDebCi.exe
  2⤵
  PID:11452
- C:\Windows\System\BmHpwyW.exe
  C:\Windows\System\BmHpwyW.exe
  2⤵
  PID:15864
- C:\Windows\System\zWQDnUi.exe
  C:\Windows\System\zWQDnUi.exe
  2⤵
  PID:11840
- C:\Windows\System\WbxPuBq.exe
  C:\Windows\System\WbxPuBq.exe
  2⤵
  PID:10720
- C:\Windows\System\TnaaOCl.exe
  C:\Windows\System\TnaaOCl.exe
  2⤵
  PID:7692
- C:\Windows\System\lIBHChZ.exe
  C:\Windows\System\lIBHChZ.exe
  2⤵
  PID:6552
- C:\Windows\System\CiJOJDU.exe
  C:\Windows\System\CiJOJDU.exe
  2⤵
  PID:10896
- C:\Windows\System\FiDCKCX.exe
  C:\Windows\System\FiDCKCX.exe
  2⤵
  PID:9012
- C:\Windows\System\xkJleMn.exe
  C:\Windows\System\xkJleMn.exe
  2⤵
  PID:15284
- C:\Windows\System\HFTEreo.exe
  C:\Windows\System\HFTEreo.exe
  2⤵
  PID:10456
- C:\Windows\System\iVwRmyS.exe
  C:\Windows\System\iVwRmyS.exe
  2⤵
  PID:11328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kctivyas.baf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BPfMEKV.exe

Filesize
1.8MB

MD5
2ca73fbf542d1fd1238973fbb89accbf

SHA1
425621b567b09084dc2e73615d36bf923fd7fe31

SHA256
937b7fbbc3d99ad3e7527e3ffa6460a289415f2456190633c63fc1d99435630a

SHA512
a032b1e227dced8b830e6e9900b641eafba8e3e41da854d5a72b86869815d9aabce1a51b69a78fc2b8238ba3907d2de8d40957bd3b31f51629249eb8c1bccb16

Download Submit
C:\Windows\System\CvFGnfw.exe

Filesize
1.8MB

MD5
e555ede7cc5bbfbab349205c3bdd9acf

SHA1
cef6bdcd3eb0bd3243e90efa6f66eaf36890b723

SHA256
86e26df26a26dd56bbb316da5984dba68953b360aa6ec5cfe0701c8b5bd090cf

SHA512
8de97757ee1474ce83cdef5ef76fd04ecd7321eac384a6984e0be089ae076e183fbb8c395de198a9c8c23e1f656c980d48a48eaad42ae8d3c1e340cd76da452c

Download Submit
C:\Windows\System\CwxOsFz.exe

Filesize
1.8MB

MD5
957515e40cd41655a9283bbc1ba0c43e

SHA1
c57623379063f55bb2507ff6c033998c1f075bb8

SHA256
f79f55c504d869fda6672fe23870e74f1f93acd30b53b2b317d1f5d6aea11acc

SHA512
20bd4d7d86c0648638412c02afc657cf5978c459ad5e0c49d43510371390c02779b22776bee908a60ccc4ae03a0e5183b2f4d423377c4df63c57442d6ad77443

Download Submit
C:\Windows\System\HARNdws.exe

Filesize
1.8MB

MD5
1ad66327ae0af73c7fe7774580febff2

SHA1
db6da52be9d09c30916b3339288acae843f43877

SHA256
ec3446bd20d3a2fb887a6533a7ff4d48f41afbe865dbc6f7a3ac57e1feb00fd4

SHA512
bfc4ad6c001f85c64045e2c7013fdd2c569846b2f6ddabab999a00effb04f57cc885852ae87b42b4a82e8215e0c932589810df7d812f0ad204cbf3c81da33fe5

Download Submit
C:\Windows\System\HbsAZJl.exe

Filesize
1.8MB

MD5
667e78ed588ea982f706aa68c153bc45

SHA1
d3a5d6a351577f6ff2b6d05ab437e2f1365a8813

SHA256
b90cf00c6ec60fbc2f7fdf3ae3112bad023254b5d497987b896d524a7b1c0b8d

SHA512
6c4442bfcf0af90d3d0260aeda30d46c668ee9524ace647beacdee7e79b2640dae35c515cb98443d765995174ad8b911563d3a134942c8c74b66747eff7d0f14

Download Submit
C:\Windows\System\HdWCMlg.exe

Filesize
1.8MB

MD5
c20a09c0f9bde34d12379a8edabccb71

SHA1
349f21950f8b218cd4e8ca0bf5b0ee503b870d51

SHA256
77a76b27a49a97583c1a806177eaf0dbb5da256462825bc3be6315185cd0c223

SHA512
c11192871731aa0878d2a81da04c79241b92a31e47209ca50e5c9f77ba2cedae79e20a10963ae3ef1ab53349bf7e5d21422703ee426ac164ca930970d2e6b013

Download Submit
C:\Windows\System\JTopdxB.exe

Filesize
1.8MB

MD5
60b54a4b7521683cd89a932ffebb0708

SHA1
c793cca8ed19792297395a4dff18bd896ac9215a

SHA256
582bea9d4ebdcbd25298102046197b71b93c31c848fd878a439edeb066c9059b

SHA512
069c955af7818230bb0fd87a8e43289046b343131f4804f6da64b4728df4923766c600a0af8c589fc261eec57031dcc50fd93619bbe65096d05a10cfe9bce498

Download Submit
C:\Windows\System\JoAZJzR.exe

Filesize
1.8MB

MD5
420c27ec6f3013a388db3178f1b1e9de

SHA1
87eec3f3478f892c58398ae1634a46a43e898366

SHA256
9d3f4c60f8b2dec21f11a93f4030a679e84008023b173989c92b7746e9c838a0

SHA512
9bf3fe41469adb3a2799df8f67770e40725f1b93eca50bd57f4c7723aeb7285daa9b136834657cd27509f726331e7cb4d9ff1f256d9e7ed0d5698d7851a3fa90

Download Submit
C:\Windows\System\KZCImgy.exe

Filesize
1.8MB

MD5
0e3e9935f212dd82d694ebb21c475d43

SHA1
c66268ebb9fd74ecd988a9aae5b0243430f95309

SHA256
04e267496c99641066c199c0c74b1a9240d117965bb5955b374d238ab2a9d235

SHA512
c326181dd0e23a510d9ee1a961701759566e4a945209978e56e432eefc9bff0edd6afd0baa75812a4451407d724e1dac8df94ec9b97df3a00a741b01f9e85623

Download Submit
C:\Windows\System\MHvATFM.exe

Filesize
1.8MB

MD5
9e2d31b0fa8541474bd14fbe834d68da

SHA1
47c2e304be3c56b1ec45875c4674cbc64cba8387

SHA256
7a3da44630c7e411f681e0bb7de2de8f89c3f4d6ba08c1bd5c9c56becdc70ada

SHA512
9692bededa6e333192bfe796e3a634dbf7d941b1ecb249394224c59928bb46d69a8b39aafb00993a0006f5e56d65211f596a9769f462b83f942f8e1fbcf1d26d

Download Submit
C:\Windows\System\MapHtcc.exe

Filesize
1.8MB

MD5
82a145ff44ec9a91be15b40fcca2df2d

SHA1
60e953a587c3dbdecb79bbcbf26d067d0af770d3

SHA256
54023702bc87a3b8d451370e723a8b5ed5bfdc59caed22e4ceaccd69941fafd3

SHA512
509c822e1acb92e0a3eab787e6281f21b9ed348f8cfdbcc3e941ceab94cca8a374f9b51827b5e08fba288d858e1f34d2abaffa07156bba695840f4ec2edee635

Download Submit
C:\Windows\System\OsSUVgQ.exe

Filesize
1.8MB

MD5
95fe5434e1a32dab77f80d3ad9675416

SHA1
8f903ff768c320fb97ca373ea58effedc357bbd3

SHA256
83fee4fb265131667964190af5d380b84316089f5a31d5bf178a57353e502c1b

SHA512
e7f6347c7779ed4d6399c9b1c8fc40af3785b4643d87f3e68a3b427e58995b63ef12951e133eb23008ff44516ef9dce0fdccc3a46a99dece903cf403b1f8cf21

Download Submit
C:\Windows\System\QBSAEvb.exe

Filesize
1.8MB

MD5
5bb179edf06d3371ff681159e847b10b

SHA1
c8cd96e14d0ebf4f09dfcd0b5b9271640b796799

SHA256
9de0e7a3422037856143bbc750812d2575696a39668d480ff9f684ffd13dbdc1

SHA512
cd5d0c390697c52e0606dff6c3516f6b7af0945ca3b0367cc91763120f760742bd9372600f485d3a53ea06784adb29a683d51ab982849311acb70d0f07a1a2ba

Download Submit
C:\Windows\System\RPTbKfR.exe

Filesize
1.8MB

MD5
5a600ed7bf3caef70cb4c03788987497

SHA1
508e124530bba8987dd653325c2769f1d8a4a0f5

SHA256
98e08733a7ea87ed790b5a6d2eefc6a872a5b3bae1a5eec5a0733a85c9945a94

SHA512
26bbf5c99f31eac8d22c3396d0627b6dbc8b1e34329e5d427a3d09c11a2c1a0e30dd46ddb7f79b742ab5f566c5d96ea1eba8a0a8abee4882063e47dab6129744

Download Submit
C:\Windows\System\RSZTarb.exe

Filesize
1.8MB

MD5
794c006315d98be68c2318aa7c3e78fe

SHA1
19cc0e15f14cb7b368f255424d5b44273ca7db1d

SHA256
36fe003d16f9a4a10afe426f3beebf2afd33fefe8300563fc22880a8972fc157

SHA512
25c720846a0e552631f032eff9660312ab708f2d78014c6d920cdd955c8e325e3a976738092e46316b11d6c81c9d9cc5a8af3e7ffc9e06d14afadce8ee3d52d9

Download Submit
C:\Windows\System\TtUaMCT.exe

Filesize
1.8MB

MD5
f5158c23ee18870f6cd0e7c68f3a5c6f

SHA1
dfe208ce2953fd7446d3e83a545842944c22df4c

SHA256
ce55599baff19c67bce1ad208da0588402f1a8dd0d25ed602b14d71e2198e027

SHA512
4791b824a7923ff7df285e22cea6df5b9ad9d3f4870b9291e6d91978c55e94556b8136674ad356f246311d941f1793db107354da1ca52978caecc6d963f921b8

Download Submit
C:\Windows\System\WDyJSar.exe

Filesize
1.8MB

MD5
1f96e67f997956c5bb691d560a96acff

SHA1
60b3750b5b94ecce585d34be6c6be05a71477e16

SHA256
b13d455f01a5d6e0ec99a6628d022b92ca22bc4ad2af17f357d5d7edc681b92b

SHA512
a4fe3437cd6fdfebd58cf53f82d44b38238f8f7beb7a7512cdd3eb0b5add5d9507e36d92a8637fa3079ce8feea50df64de1918f0dd153a9ec6f9281ed45c4d02

Download Submit
C:\Windows\System\XNXubhT.exe

Filesize
1.8MB

MD5
5a8cef6226362506a3f8185d6743f866

SHA1
3180895af6cdb89750a50cedde4ede6fca3d899b

SHA256
2c3a1f60f004926c4d1eefbd74f38e1753096a10af8b143f84b01de893397c70

SHA512
b1d1a8681078d3e1b13873f8d832ed93a8cb5c814d42132d10bf59d0d2fa2036f46a1fa6fa1c771d1406fa5b46b5e9987e1d987e24a30dc65b4abb63dbf3ffa9

Download Submit
C:\Windows\System\YOGuOCK.exe

Filesize
1.8MB

MD5
775265b23b20c50c0760ca8e1a311316

SHA1
f6a0608c80bdfb0f4a65dd06a3193208283eaf17

SHA256
318ca1ae83e12163a4a13ac0905dfad5d6f81fdc764054cb51cc93bf79a2cd2f

SHA512
f746cda45f0cf8430736644e1a8c399c96708ddcb4ac59260cf644dc82436f2508062b7bb21793bf07f0186e95096d35352ca268c933efdd968de30863271abc

Download Submit
C:\Windows\System\bnXMcBR.exe

Filesize
1.8MB

MD5
56c5537fbfdaff2b1dd9c1e064204913

SHA1
62ce894a39ef0c0703ceb265c4e7520b7cac9d82

SHA256
7ffb87fb74bbd2f9846b730fb5f034c76f1fdf2fc4ac519714567e1dd8bcb84f

SHA512
6f9f7c9cf805f2b4e895d04671d0df895603ee029f21da249d5e4f360ab1bc04a876559a773383301b78eafb2440101bc9406248c27091be6cbac1c2fe71e9e4

Download Submit
C:\Windows\System\camqwBN.exe

Filesize
1.8MB

MD5
31372683f99e404c5bbf1980a82f8f36

SHA1
0d9303e685f5c3d4ad4e42f44a921b0af1f6dcd8

SHA256
76b5d44b117ed723562816fd38ec7b9c01304203b8fe65f5f435c4dbc10ee128

SHA512
a0fa02a5261b1af43ea4b41b3cbee7d46cf5c30dc45ff2c90a3564f5e8e9da8ecbde44a757c3a5b9bab47654dea38a3e5c97244bb5e2d7e39b07030312506ecb

Download Submit
C:\Windows\System\glIPpzM.exe

Filesize
1.8MB

MD5
fa4fbb16a20ce298830c537d5f5ea550

SHA1
dfd2e57b72bfaed3685fde824e8701fd42611207

SHA256
185f65134bcbaab7fb0ad5e4cda22a5b2f97384ce8fd02d09ea9f2589738b1b5

SHA512
8284faf4846a6508be46178731b0723d262806b254d881c189518bf4e52c64a4b693111e8fa6a7123f8207ebc4f8dd13b113bd833e9f6cff214e4e83d10ea270

Download Submit
C:\Windows\System\iXltkfx.exe

Filesize
1.9MB

MD5
eb82d63b0b4744c5dcd7c2c5f335901d

SHA1
5d265a5516f383a3f8bf5ef9e077b24c586e2958

SHA256
f76ad22842ecfaf44d37cecdddd302e33b52aa0e099464baa4259cc71f6c5160

SHA512
7c601ec0757f2d4a40da09ed45f2170ab3c6410043b116e8bb95e269e0bee18cf4d5c4dad9bb0386a136b01782becb4c7edefb49f3d809db0aaf0a2776cddb33

Download Submit
C:\Windows\System\jgdFVah.exe

Filesize
1.8MB

MD5
13991573ffba62e472a2bb405a1f7b3d

SHA1
5b870fa4a434cee3e4a6122cb6d7ca843a8b69df

SHA256
6b4f36bf4b763e15faa7cc0f6e1e96f64a3b4220b1d10ac57fec783daca3ff02

SHA512
cd6ff6c07b1fae993c847ab62412bbaf3b66ec7df44e408db523c88c30d5e25e78d667c714777b12b6a6c7d97e806048658b2a3a49f3d8ac73c1fa1654735844

Download Submit
C:\Windows\System\lwavArZ.exe

Filesize
1.8MB

MD5
84ac4d62f6f7c58303af4889a39740f3

SHA1
5251a0ce614089e16fcfd5d81ed49ffc4d2b8c9e

SHA256
7d44b33ac09d852c4f3a81ea52ebbddd006292f1096819018a984be32ee9a09f

SHA512
cc09a33a4e62428f62893ada2ae489843d7c4f1407c3ada7fecfe60a4329ec0a3158dadfe52b5a9e9e054e4ce509064fcfd51996c4ca0d65959a25885f3bdf88

Download Submit
C:\Windows\System\nhFhnAS.exe

Filesize
1.8MB

MD5
b1516b37ca4ebbc2339a418db65536cc

SHA1
ac34e5410bb9e7eb357ccde23eb54e6cf5c6aed1

SHA256
434fdc4b68271da83d368e34055a966b3a3d097dbfae3fd8c14fbfae7bbcc458

SHA512
2b94bb12f6f59d210565c4c72bab329f844f0be98931289e01dec34aefacdb9d9191be12f1552ac09e2d11911217395057c66a826230fb3288aa241c16478666

Download Submit
C:\Windows\System\qnOCJFu.exe

Filesize
1.8MB

MD5
f22b5fe69b2f0fa8fc001be8136007e4

SHA1
354df9afd35a4ebe1537a6c7b7a0734db2990a6a

SHA256
3756683fdea79f7b1be3d871ba180b42a0768829d821c0176b7126bac56de5ee

SHA512
d3f19f40a72f9d5f09a6685677b3a7c6f1dd07571489d0ca31de203bca3880c8da3954d4a1826c4a120de5b039e1df0350dfea4f1b52e82b5033503259a4cc30

Download Submit
C:\Windows\System\qtckukk.exe

Filesize
1.8MB

MD5
e604e764149215177084736fc715fcc2

SHA1
1e82dfc878ca1f62302cf30da3cad2ef7d018b1e

SHA256
9e758cf4cb8cb01730fa893fc592ddb8c3ab8a3469bfbeff3bec41df81f1f4c7

SHA512
fe98675541b0d358bbe792d23248b5be865a5dc4182eb2d3f47ac256a1e25344df8f31c10d802d420179de9d9635f86b94e8018c3d69e61530cddbc497b12486

Download Submit
C:\Windows\System\tLTwleq.exe

Filesize
1.8MB

MD5
1d25286b977dbe563aa98a21d4120b05

SHA1
19af7e87c38f8c4ab73468eb8bb54fda78cd9371

SHA256
355319ddd99f25de3ccf48b4abdf3b356d3a7c42528b5c9c2e5f6c44d7eddab7

SHA512
884a2fbe3fde9e270d2544423ca6ce98c4a9dc233cdf567d51c005e3022d6c3eef3adc988c7971738d845f2c141a95f8efb1a904df9396536161c57209c8dd03

Download Submit
C:\Windows\System\ucAzIhS.exe

Filesize
1.8MB

MD5
1807e658a9ed70a79686505499da6388

SHA1
67d5a2969da0d0314d47c3a7e3ef18a2186c6775

SHA256
a85084f688c5925d9267969c3d8ceca74820ab3a014338ccfdb29258cd948214

SHA512
b5117c77c670b304f7ac45953c31d35252600a0e8e6987bd0fbb7f231e2463e85c7d0b08e79d8b50a235456dea98c7f1eae9146e0d891e567e45c955b3728e38

Download Submit
C:\Windows\System\wHkYIHr.exe

Filesize
1.8MB

MD5
93f1f5311a85cb134013350b98ce03b2

SHA1
3dd4ea5e9dbc53ab2407073b969940c76b976b02

SHA256
d69b5cba398ef1abf60ad58dbcfd93a5c217057e235d053d8dea7b1d5ba05b37

SHA512
6347d6cb3308cb0dbdcc352782dea0c5dd248adab6635515a4d8b3f95e50cb5988afad9c354ef9fc57e247b8ec0ceb95b0af6fb07b78d1e52e07f19a99ffd78c

Download Submit
C:\Windows\System\ymiDbGb.exe

Filesize
1.8MB

MD5
9fcd6edf7981442bcce935ec91101077

SHA1
39a5bec57b70031a391a8677a7c58ddf49ffb543

SHA256
657dd0384707fa4217909f2c4b331e24e070da7712615e282cd6a831a1fb27a9

SHA512
a7beb8942af9d2f85019fb3a528abb30cf5449b3ab6f4335626736c40306c8d90fafd20269a56f68f9c4c0fd1738044f9479821c1d32d79428c610f704499b6e

Download Submit
C:\Windows\System\zytKQKx.exe

Filesize
1.8MB

MD5
768e4c897a9d79b8de020706b3ec0343

SHA1
2c59ec92e2083e58759bc8f869258e71d6dc521c

SHA256
1c3d358de0316f0c7c00e8ec51ea0cf60dfdfd2862f3118fa1a11c72b986b1a7

SHA512
aadec49c29390a573ad57f2531ce6e80325f82dad1c013ce0f8b6305fc015f03c3caa41dba463de2ff8cfa1c5958e9576a2e0d7391922543171aef09680deeb6

Download Submit
memory/452-97-0x00007FF762C20000-0x00007FF763012000-memory.dmp

Filesize
3.9MB

Download
memory/636-134-0x00007FF7A0180000-0x00007FF7A0572000-memory.dmp

Filesize
3.9MB

Download
memory/732-292-0x00007FF630260000-0x00007FF630652000-memory.dmp

Filesize
3.9MB

Download
memory/756-255-0x00007FF7F0350000-0x00007FF7F0742000-memory.dmp

Filesize
3.9MB

Download
memory/1032-125-0x00007FF6D4590000-0x00007FF6D4982000-memory.dmp

Filesize
3.9MB

Download
memory/1248-259-0x00007FF60F830000-0x00007FF60FC22000-memory.dmp

Filesize
3.9MB

Download
memory/1492-304-0x00007FF6D3180000-0x00007FF6D3572000-memory.dmp

Filesize
3.9MB

Download
memory/1504-258-0x00007FF68ED20000-0x00007FF68F112000-memory.dmp

Filesize
3.9MB

Download
memory/1552-87-0x00007FF736740000-0x00007FF736B32000-memory.dmp

Filesize
3.9MB

Download
memory/1648-111-0x00007FF719D70000-0x00007FF71A162000-memory.dmp

Filesize
3.9MB

Download
memory/1752-270-0x00007FF7CA5D0000-0x00007FF7CA9C2000-memory.dmp

Filesize
3.9MB

Download
memory/1776-261-0x00007FF670300000-0x00007FF6706F2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-102-0x00007FF76B8F0000-0x00007FF76BCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-257-0x00007FF674A40000-0x00007FF674E32000-memory.dmp

Filesize
3.9MB

Download
memory/1968-298-0x00007FF636180000-0x00007FF636572000-memory.dmp

Filesize
3.9MB

Download
memory/2152-82-0x00007FF72CE30000-0x00007FF72D222000-memory.dmp

Filesize
3.9MB

Download
memory/2176-276-0x00007FF7FD4D0000-0x00007FF7FD8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-133-0x00007FF6268E0000-0x00007FF626CD2000-memory.dmp

Filesize
3.9MB

Download
memory/2284-274-0x00007FF6306D0000-0x00007FF630AC2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-61-0x00007FF6DC940000-0x00007FF6DCD32000-memory.dmp

Filesize
3.9MB

Download
memory/2716-296-0x00007FF6CDF80000-0x00007FF6CE372000-memory.dmp

Filesize
3.9MB

Download
memory/2828-263-0x00007FF67AC80000-0x00007FF67B072000-memory.dmp

Filesize
3.9MB

Download
memory/2860-67-0x00007FF6BBB40000-0x00007FF6BBF32000-memory.dmp

Filesize
3.9MB

Download
memory/3100-115-0x00007FF7498F0000-0x00007FF749CE2000-memory.dmp

Filesize
3.9MB

Download
memory/3104-120-0x00007FF648580000-0x00007FF648972000-memory.dmp

Filesize
3.9MB

Download
memory/3336-251-0x00007FF6BA360000-0x00007FF6BA752000-memory.dmp

Filesize
3.9MB

Download
memory/3372-302-0x00007FF67F9A0000-0x00007FF67FD92000-memory.dmp

Filesize
3.9MB

Download
memory/3456-254-0x00007FF760560000-0x00007FF760952000-memory.dmp

Filesize
3.9MB

Download
memory/3644-138-0x00007FF755360000-0x00007FF755752000-memory.dmp

Filesize
3.9MB

Download
memory/3648-250-0x00007FF699910000-0x00007FF699D02000-memory.dmp

Filesize
3.9MB

Download
memory/3652-260-0x00007FF69C310000-0x00007FF69C702000-memory.dmp

Filesize
3.9MB

Download
memory/3676-135-0x00007FF6CFFF0000-0x00007FF6D03E2000-memory.dmp

Filesize
3.9MB

Download
memory/3712-86-0x00007FF630BA0000-0x00007FF630F92000-memory.dmp

Filesize
3.9MB

Download
memory/3784-287-0x00007FF656A40000-0x00007FF656E32000-memory.dmp

Filesize
3.9MB

Download
memory/3868-262-0x00007FF6D6200000-0x00007FF6D65F2000-memory.dmp

Filesize
3.9MB

Download
memory/3884-305-0x00007FF7B3780000-0x00007FF7B3B72000-memory.dmp

Filesize
3.9MB

Download
memory/3904-128-0x00007FF79AA80000-0x00007FF79AE72000-memory.dmp

Filesize
3.9MB

Download
memory/4052-139-0x00007FF6DD800000-0x00007FF6DDBF2000-memory.dmp

Filesize
3.9MB

Download
memory/4176-136-0x00007FF73F640000-0x00007FF73FA32000-memory.dmp

Filesize
3.9MB

Download
memory/4196-253-0x00007FF7B75D0000-0x00007FF7B79C2000-memory.dmp

Filesize
3.9MB

Download
memory/4384-1817-0x00007FF6C9CD0000-0x00007FF6CA0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4392-130-0x00007FF691770000-0x00007FF691B62000-memory.dmp

Filesize
3.9MB

Download
memory/4484-137-0x00007FF736A40000-0x00007FF736E32000-memory.dmp

Filesize
3.9MB

Download
memory/4492-282-0x00007FF6600A0000-0x00007FF660492000-memory.dmp

Filesize
3.9MB

Download
memory/4604-252-0x00007FF7CA660000-0x00007FF7CAA52000-memory.dmp

Filesize
3.9MB

Download
memory/4648-306-0x00007FF709920000-0x00007FF709D12000-memory.dmp

Filesize
3.9MB

Download
memory/4724-279-0x00007FF6030F0000-0x00007FF6034E2000-memory.dmp

Filesize
3.9MB

Download
memory/4732-64-0x00007FF7EDD30000-0x00007FF7EE122000-memory.dmp

Filesize
3.9MB

Download
memory/4740-299-0x00007FF741890000-0x00007FF741C82000-memory.dmp

Filesize
3.9MB

Download
memory/4772-293-0x00007FF7436A0000-0x00007FF743A92000-memory.dmp

Filesize
3.9MB

Download
memory/4836-0-0x00007FF7D21C0000-0x00007FF7D25B2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-1-0x0000022D51480000-0x0000022D51490000-memory.dmp

Filesize
64KB

Download
memory/4836-256-0x00007FF7D21C0000-0x00007FF7D25B2000-memory.dmp

Filesize
3.9MB

Download
memory/4984-283-0x00007FF6F8CC0000-0x00007FF6F90B2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-308-0x00007FF7657F0000-0x00007FF765BE2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-52-0x0000017421DC0000-0x0000017421DD0000-memory.dmp

Filesize
64KB

Download
memory/5004-32-0x0000017422780000-0x00000174227A2000-memory.dmp

Filesize
136KB

Download
memory/5004-56-0x0000017421DC0000-0x0000017421DD0000-memory.dmp

Filesize
64KB

Download
memory/5004-48-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmp

Filesize
10.8MB

Download
memory/5004-310-0x0000017423520000-0x0000017423CC6000-memory.dmp

Filesize
7.6MB

Download
memory/5092-275-0x00007FF728A50000-0x00007FF728E42000-memory.dmp

Filesize
3.9MB

Download
memory/10060-1775-0x00007FF62A5A0000-0x00007FF62A992000-memory.dmp

Filesize
3.9MB

Download
memory/10392-1861-0x00007FF6A4180000-0x00007FF6A4572000-memory.dmp

Filesize
3.9MB

Download
memory/10676-1776-0x00007FF7618A0000-0x00007FF761C92000-memory.dmp

Filesize
3.9MB

Download
memory/11200-1862-0x00007FF649030000-0x00007FF649422000-memory.dmp

Filesize
3.9MB

Download
memory/11848-1788-0x00007FF70AA00000-0x00007FF70ADF2000-memory.dmp

Filesize
3.9MB

Download