xmrig | 83bf528f53caf08ce760eb1b7442bf1f14706577203a93f0fc38a0a0bbd8a839

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
Size

2.1MB
MD5

05fd15844f04a6e2fcfa4c3a89d45399
SHA1

25dcbcee177d46eff9befc09302f79af97256240
SHA256

83bf528f53caf08ce760eb1b7442bf1f14706577203a93f0fc38a0a0bbd8a839
SHA512

33c0b7a4e073a465596841342617154ebbfb3823040e6a405b8d5e8c907c48b8949997032e2de7b1f6062c085e39699ee56e74c0a023f544a18d4b6a948a54bd
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrP:NABy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/4752-409-0x00007FF6586B0000-0x00007FF658AA2000-memory.dmp	xmrig
behavioral2/memory/1332-489-0x00007FF6CEC40000-0x00007FF6CF032000-memory.dmp	xmrig
behavioral2/memory/3400-493-0x00007FF68E1D0000-0x00007FF68E5C2000-memory.dmp	xmrig
behavioral2/memory/3744-492-0x00007FF7D7DB0000-0x00007FF7D81A2000-memory.dmp	xmrig
behavioral2/memory/1452-491-0x00007FF794290000-0x00007FF794682000-memory.dmp	xmrig
behavioral2/memory/4892-490-0x00007FF7355F0000-0x00007FF7359E2000-memory.dmp	xmrig
behavioral2/memory/4760-488-0x00007FF726890000-0x00007FF726C82000-memory.dmp	xmrig
behavioral2/memory/1328-487-0x00007FF7D3F10000-0x00007FF7D4302000-memory.dmp	xmrig
behavioral2/memory/368-486-0x00007FF60E370000-0x00007FF60E762000-memory.dmp	xmrig
behavioral2/memory/3000-484-0x00007FF73DF10000-0x00007FF73E302000-memory.dmp	xmrig
behavioral2/memory/1184-371-0x00007FF6440C0000-0x00007FF6444B2000-memory.dmp	xmrig
behavioral2/memory/2724-347-0x00007FF7774F0000-0x00007FF7778E2000-memory.dmp	xmrig
behavioral2/memory/4984-344-0x00007FF781410000-0x00007FF781802000-memory.dmp	xmrig
behavioral2/memory/3124-296-0x00007FF6FB650000-0x00007FF6FBA42000-memory.dmp	xmrig
behavioral2/memory/4020-255-0x00007FF6DD550000-0x00007FF6DD942000-memory.dmp	xmrig
behavioral2/memory/2608-231-0x00007FF6A0B10000-0x00007FF6A0F02000-memory.dmp	xmrig
behavioral2/memory/3184-222-0x00007FF6A1A90000-0x00007FF6A1E82000-memory.dmp	xmrig
behavioral2/memory/3028-174-0x00007FF7E9560000-0x00007FF7E9952000-memory.dmp	xmrig
behavioral2/memory/4260-171-0x00007FF63E6F0000-0x00007FF63EAE2000-memory.dmp	xmrig
behavioral2/memory/4728-131-0x00007FF6B49F0000-0x00007FF6B4DE2000-memory.dmp	xmrig
behavioral2/memory/4256-3041-0x00007FF69B890000-0x00007FF69BC82000-memory.dmp	xmrig
behavioral2/memory/3744-3043-0x00007FF7D7DB0000-0x00007FF7D81A2000-memory.dmp	xmrig
behavioral2/memory/3028-3045-0x00007FF7E9560000-0x00007FF7E9952000-memory.dmp	xmrig
behavioral2/memory/4728-3047-0x00007FF6B49F0000-0x00007FF6B4DE2000-memory.dmp	xmrig
behavioral2/memory/2608-3049-0x00007FF6A0B10000-0x00007FF6A0F02000-memory.dmp	xmrig
behavioral2/memory/4020-3057-0x00007FF6DD550000-0x00007FF6DD942000-memory.dmp	xmrig
behavioral2/memory/368-3059-0x00007FF60E370000-0x00007FF60E762000-memory.dmp	xmrig
behavioral2/memory/3184-3055-0x00007FF6A1A90000-0x00007FF6A1E82000-memory.dmp	xmrig
behavioral2/memory/3000-3053-0x00007FF73DF10000-0x00007FF73E302000-memory.dmp	xmrig
behavioral2/memory/4260-3052-0x00007FF63E6F0000-0x00007FF63EAE2000-memory.dmp	xmrig
behavioral2/memory/1452-3087-0x00007FF794290000-0x00007FF794682000-memory.dmp	xmrig
behavioral2/memory/1328-3084-0x00007FF7D3F10000-0x00007FF7D4302000-memory.dmp	xmrig
behavioral2/memory/3124-3081-0x00007FF6FB650000-0x00007FF6FBA42000-memory.dmp	xmrig
behavioral2/memory/4892-3078-0x00007FF7355F0000-0x00007FF7359E2000-memory.dmp	xmrig
behavioral2/memory/4752-3073-0x00007FF6586B0000-0x00007FF658AA2000-memory.dmp	xmrig
behavioral2/memory/4760-3083-0x00007FF726890000-0x00007FF726C82000-memory.dmp	xmrig
behavioral2/memory/1332-3069-0x00007FF6CEC40000-0x00007FF6CF032000-memory.dmp	xmrig
behavioral2/memory/3400-3068-0x00007FF68E1D0000-0x00007FF68E5C2000-memory.dmp	xmrig
behavioral2/memory/1184-3065-0x00007FF6440C0000-0x00007FF6444B2000-memory.dmp	xmrig
behavioral2/memory/4984-3072-0x00007FF781410000-0x00007FF781802000-memory.dmp	xmrig
behavioral2/memory/2724-3064-0x00007FF7774F0000-0x00007FF7778E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4256	HjIDGbZ.exe
3744	DWrCFmD.exe
4728	MwrXeSG.exe
4260	rzbeVDO.exe
3028	hKHuyzZ.exe
3184	fOWFRSB.exe
2608	CAYRhss.exe
3400	hskeyTw.exe
4020	mdGTwKZ.exe
3124	mfYmBNe.exe
4984	jfMiiSQ.exe
2724	vtKGdvp.exe
1184	gCuhWEA.exe
4752	WjwWACf.exe
3000	vNsOaDC.exe
368	kxNNacK.exe
1328	RBvjxyW.exe
4760	WGbxqmL.exe
1332	XyHjarI.exe
4892	IQSjSFv.exe
1452	xciwviM.exe
3520	gzGbPea.exe
2912	nLLkovN.exe
4788	txZrTwE.exe
2668	IueHSYM.exe
1568	SerjMdl.exe
4004	BYyPfIq.exe
3188	USqgQlL.exe
4480	hShAWVv.exe
2840	cgzcSKj.exe
1748	oYNsrqO.exe
1020	FJsgTVo.exe
2348	veNSNZr.exe
2172	XHUvDzS.exe
2708	QJzBJnq.exe
1656	McNECbR.exe
2328	SIgtAPM.exe
468	VPWSYfO.exe
3920	tIUOZuj.exe
456	IGkxMdQ.exe
1320	MIAPgax.exe
1440	NhfvgpU.exe
2972	CIRUqcJ.exe
2264	zFGXkCY.exe
2500	hixhcld.exe
3156	dKgVZgN.exe
664	dDCMNJa.exe
4960	hTgSehe.exe
2540	aAaGNgX.exe
5064	JajDudy.exe
4088	PxWoBeS.exe
532	hjUijtH.exe
3936	mcKIgAy.exe
868	nrUdpXP.exe
4024	syBLUgH.exe
936	Vjnozul.exe
4296	XIWbyNU.exe
2304	mtFcAAM.exe
708	xajmCWg.exe
812	suyRzBG.exe
1304	TfuqqzN.exe
3596	GosVkws.exe
2688	KUJfwni.exe
3480	QJOsXum.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1472-0-0x00007FF74A6F0000-0x00007FF74AAE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-39.dat	upx
behavioral2/files/0x000a000000023baf-68.dat	upx
behavioral2/files/0x000a000000023bb3-89.dat	upx
behavioral2/files/0x000a000000023bb8-154.dat	upx
behavioral2/files/0x000a000000023bb9-187.dat	upx
behavioral2/memory/4752-409-0x00007FF6586B0000-0x00007FF658AA2000-memory.dmp	upx
behavioral2/memory/1332-489-0x00007FF6CEC40000-0x00007FF6CF032000-memory.dmp	upx
behavioral2/memory/3400-493-0x00007FF68E1D0000-0x00007FF68E5C2000-memory.dmp	upx
behavioral2/memory/3744-492-0x00007FF7D7DB0000-0x00007FF7D81A2000-memory.dmp	upx
behavioral2/memory/1452-491-0x00007FF794290000-0x00007FF794682000-memory.dmp	upx
behavioral2/memory/4892-490-0x00007FF7355F0000-0x00007FF7359E2000-memory.dmp	upx
behavioral2/memory/4760-488-0x00007FF726890000-0x00007FF726C82000-memory.dmp	upx
behavioral2/memory/1328-487-0x00007FF7D3F10000-0x00007FF7D4302000-memory.dmp	upx
behavioral2/memory/368-486-0x00007FF60E370000-0x00007FF60E762000-memory.dmp	upx
behavioral2/memory/3000-484-0x00007FF73DF10000-0x00007FF73E302000-memory.dmp	upx
behavioral2/memory/1184-371-0x00007FF6440C0000-0x00007FF6444B2000-memory.dmp	upx
behavioral2/memory/2724-347-0x00007FF7774F0000-0x00007FF7778E2000-memory.dmp	upx
behavioral2/memory/4984-344-0x00007FF781410000-0x00007FF781802000-memory.dmp	upx
behavioral2/memory/3124-296-0x00007FF6FB650000-0x00007FF6FBA42000-memory.dmp	upx
behavioral2/memory/4020-255-0x00007FF6DD550000-0x00007FF6DD942000-memory.dmp	upx
behavioral2/memory/2608-231-0x00007FF6A0B10000-0x00007FF6A0F02000-memory.dmp	upx
behavioral2/memory/3184-222-0x00007FF6A1A90000-0x00007FF6A1E82000-memory.dmp	upx
behavioral2/files/0x000a000000023bc9-191.dat	upx
behavioral2/files/0x000a000000023bc8-184.dat	upx
behavioral2/files/0x000a000000023bc6-179.dat	upx
behavioral2/files/0x000b000000023ba2-178.dat	upx
behavioral2/files/0x0031000000023bb6-175.dat	upx
behavioral2/memory/3028-174-0x00007FF7E9560000-0x00007FF7E9952000-memory.dmp	upx
behavioral2/memory/4260-171-0x00007FF63E6F0000-0x00007FF63EAE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-166.dat	upx
behavioral2/files/0x000a000000023bc4-165.dat	upx
behavioral2/files/0x000a000000023bba-161.dat	upx
behavioral2/files/0x000a000000023bc2-151.dat	upx
behavioral2/files/0x000a000000023bc7-183.dat	upx
behavioral2/files/0x0031000000023bb5-134.dat	upx
behavioral2/memory/4728-131-0x00007FF6B49F0000-0x00007FF6B4DE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc0-127.dat	upx
behavioral2/files/0x000a000000023bbf-126.dat	upx
behavioral2/files/0x000a000000023bbd-124.dat	upx
behavioral2/files/0x000a000000023bc3-158.dat	upx
behavioral2/files/0x0031000000023bb4-120.dat	upx
behavioral2/files/0x000a000000023bbc-119.dat	upx
behavioral2/files/0x000a000000023bb1-115.dat	upx
behavioral2/files/0x000a000000023bb7-136.dat	upx
behavioral2/files/0x000a000000023bc1-135.dat	upx
behavioral2/files/0x000a000000023bae-110.dat	upx
behavioral2/files/0x000a000000023bbb-100.dat	upx
behavioral2/files/0x000a000000023bbe-125.dat	upx
behavioral2/files/0x000a000000023bad-95.dat	upx
behavioral2/files/0x000a000000023bb0-113.dat	upx
behavioral2/files/0x000a000000023bb2-71.dat	upx
behavioral2/files/0x000a000000023ba8-58.dat	upx
behavioral2/files/0x000a000000023ba7-57.dat	upx
behavioral2/files/0x000a000000023ba9-53.dat	upx
behavioral2/files/0x000a000000023bac-50.dat	upx
behavioral2/files/0x000a000000023baa-36.dat	upx
behavioral2/files/0x000a000000023ba5-25.dat	upx
behavioral2/memory/4256-22-0x00007FF69B890000-0x00007FF69BC82000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-17.dat	upx
behavioral2/files/0x000c000000023ba0-6.dat	upx
behavioral2/memory/4256-3041-0x00007FF69B890000-0x00007FF69BC82000-memory.dmp	upx
behavioral2/memory/3744-3043-0x00007FF7D7DB0000-0x00007FF7D81A2000-memory.dmp	upx
behavioral2/memory/3028-3045-0x00007FF7E9560000-0x00007FF7E9952000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VdTnVSL.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\KvNpslf.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\IooZbDO.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\IcMVZai.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\iuZOKtG.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\OspAyWd.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\Jkvlfzz.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\EiYTkRr.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\IuDNccl.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\SKQwgzs.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\bEKQedD.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\nePFNLk.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\JIXtSpn.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\gSMISVP.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\xOZdRBQ.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\ziOVRPH.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\WNybMfP.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\JSTyotf.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\FPOKqFX.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\lLWFDaf.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\ywzLBZH.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\SfzujDF.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\IDjeIrm.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\zsyGeWR.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\RreTKCh.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\vphduGn.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\hERfgea.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\BYyPfIq.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\UBVndKP.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\CiIuZyP.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\bvXzZSR.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\BlrbBbM.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\AZDhYei.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\ivrUJvV.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\wlpGArY.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\nrgIjPZ.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\eOEqBYn.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\pnJRmPm.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\eFykoDL.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\UrTVrph.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\KjLpfAG.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\OyohgQy.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\ifUpImO.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\epeAFAi.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\zUajRxg.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\bTcrTur.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\aABKLtj.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\MxwHvXz.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\YwwOrPg.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\aQqGQMO.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\lRPaELQ.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\XGYdunn.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\hMDKLrg.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\YifEvfM.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\jfchpDo.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\GdFdaoY.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\mHcnfHm.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\MTrOvRi.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\oSjJibO.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\KYIMerZ.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\ntQaKBt.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\BcTosSk.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\pjHMFEo.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
File created	C:\Windows\System\qRZWMZu.exe	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
Token: SeDebugPrivilege	1636	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1636	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	84
PID 1472 wrote to memory of 1636	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	84
PID 1472 wrote to memory of 4256	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	85
PID 1472 wrote to memory of 4256	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	85
PID 1472 wrote to memory of 3028	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	86
PID 1472 wrote to memory of 3028	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	86
PID 1472 wrote to memory of 3744	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	87
PID 1472 wrote to memory of 3744	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	87
PID 1472 wrote to memory of 4728	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	88
PID 1472 wrote to memory of 4728	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	88
PID 1472 wrote to memory of 4260	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	89
PID 1472 wrote to memory of 4260	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	89
PID 1472 wrote to memory of 3184	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	90
PID 1472 wrote to memory of 3184	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	90
PID 1472 wrote to memory of 2608	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	91
PID 1472 wrote to memory of 2608	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	91
PID 1472 wrote to memory of 3400	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	92
PID 1472 wrote to memory of 3400	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	92
PID 1472 wrote to memory of 4020	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	93
PID 1472 wrote to memory of 4020	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	93
PID 1472 wrote to memory of 3124	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	94
PID 1472 wrote to memory of 3124	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	94
PID 1472 wrote to memory of 4984	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	95
PID 1472 wrote to memory of 4984	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	95
PID 1472 wrote to memory of 2724	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	96
PID 1472 wrote to memory of 2724	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	96
PID 1472 wrote to memory of 1184	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	97
PID 1472 wrote to memory of 1184	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	97
PID 1472 wrote to memory of 4752	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	98
PID 1472 wrote to memory of 4752	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	98
PID 1472 wrote to memory of 3000	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	99
PID 1472 wrote to memory of 3000	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	99
PID 1472 wrote to memory of 368	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	100
PID 1472 wrote to memory of 368	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	100
PID 1472 wrote to memory of 1328	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	101
PID 1472 wrote to memory of 1328	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	101
PID 1472 wrote to memory of 4760	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	102
PID 1472 wrote to memory of 4760	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	102
PID 1472 wrote to memory of 4788	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	103
PID 1472 wrote to memory of 4788	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	103
PID 1472 wrote to memory of 1332	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	104
PID 1472 wrote to memory of 1332	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	104
PID 1472 wrote to memory of 4892	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	105
PID 1472 wrote to memory of 4892	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	105
PID 1472 wrote to memory of 1452	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	106
PID 1472 wrote to memory of 1452	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	106
PID 1472 wrote to memory of 3520	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	107
PID 1472 wrote to memory of 3520	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	107
PID 1472 wrote to memory of 2912	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	108
PID 1472 wrote to memory of 2912	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	108
PID 1472 wrote to memory of 2668	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	109
PID 1472 wrote to memory of 2668	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	109
PID 1472 wrote to memory of 1568	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	110
PID 1472 wrote to memory of 1568	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	110
PID 1472 wrote to memory of 4004	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	111
PID 1472 wrote to memory of 4004	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	111
PID 1472 wrote to memory of 3188	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	112
PID 1472 wrote to memory of 3188	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	112
PID 1472 wrote to memory of 4480	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	113
PID 1472 wrote to memory of 4480	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	113
PID 1472 wrote to memory of 2840	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	114
PID 1472 wrote to memory of 2840	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	114
PID 1472 wrote to memory of 1748	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	115
PID 1472 wrote to memory of 1748	1472	05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05fd15844f04a6e2fcfa4c3a89d45399_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\System\HjIDGbZ.exe
  C:\Windows\System\HjIDGbZ.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\hKHuyzZ.exe
  C:\Windows\System\hKHuyzZ.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\DWrCFmD.exe
  C:\Windows\System\DWrCFmD.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\MwrXeSG.exe
  C:\Windows\System\MwrXeSG.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\rzbeVDO.exe
  C:\Windows\System\rzbeVDO.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\fOWFRSB.exe
  C:\Windows\System\fOWFRSB.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\CAYRhss.exe
  C:\Windows\System\CAYRhss.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\hskeyTw.exe
  C:\Windows\System\hskeyTw.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\mdGTwKZ.exe
  C:\Windows\System\mdGTwKZ.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\mfYmBNe.exe
  C:\Windows\System\mfYmBNe.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\jfMiiSQ.exe
  C:\Windows\System\jfMiiSQ.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\vtKGdvp.exe
  C:\Windows\System\vtKGdvp.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\gCuhWEA.exe
  C:\Windows\System\gCuhWEA.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\WjwWACf.exe
  C:\Windows\System\WjwWACf.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\vNsOaDC.exe
  C:\Windows\System\vNsOaDC.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\kxNNacK.exe
  C:\Windows\System\kxNNacK.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\RBvjxyW.exe
  C:\Windows\System\RBvjxyW.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\WGbxqmL.exe
  C:\Windows\System\WGbxqmL.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\txZrTwE.exe
  C:\Windows\System\txZrTwE.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\XyHjarI.exe
  C:\Windows\System\XyHjarI.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\IQSjSFv.exe
  C:\Windows\System\IQSjSFv.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\xciwviM.exe
  C:\Windows\System\xciwviM.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\gzGbPea.exe
  C:\Windows\System\gzGbPea.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\nLLkovN.exe
  C:\Windows\System\nLLkovN.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\IueHSYM.exe
  C:\Windows\System\IueHSYM.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\SerjMdl.exe
  C:\Windows\System\SerjMdl.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\BYyPfIq.exe
  C:\Windows\System\BYyPfIq.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\USqgQlL.exe
  C:\Windows\System\USqgQlL.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\hShAWVv.exe
  C:\Windows\System\hShAWVv.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\cgzcSKj.exe
  C:\Windows\System\cgzcSKj.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\oYNsrqO.exe
  C:\Windows\System\oYNsrqO.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\FJsgTVo.exe
  C:\Windows\System\FJsgTVo.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\veNSNZr.exe
  C:\Windows\System\veNSNZr.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\XHUvDzS.exe
  C:\Windows\System\XHUvDzS.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\QJzBJnq.exe
  C:\Windows\System\QJzBJnq.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\McNECbR.exe
  C:\Windows\System\McNECbR.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\SIgtAPM.exe
  C:\Windows\System\SIgtAPM.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\VPWSYfO.exe
  C:\Windows\System\VPWSYfO.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\tIUOZuj.exe
  C:\Windows\System\tIUOZuj.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\IGkxMdQ.exe
  C:\Windows\System\IGkxMdQ.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\MIAPgax.exe
  C:\Windows\System\MIAPgax.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\NhfvgpU.exe
  C:\Windows\System\NhfvgpU.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\CIRUqcJ.exe
  C:\Windows\System\CIRUqcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\Vjnozul.exe
  C:\Windows\System\Vjnozul.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\zFGXkCY.exe
  C:\Windows\System\zFGXkCY.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\hixhcld.exe
  C:\Windows\System\hixhcld.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\dKgVZgN.exe
  C:\Windows\System\dKgVZgN.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\dDCMNJa.exe
  C:\Windows\System\dDCMNJa.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\hTgSehe.exe
  C:\Windows\System\hTgSehe.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\aAaGNgX.exe
  C:\Windows\System\aAaGNgX.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\JajDudy.exe
  C:\Windows\System\JajDudy.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\PxWoBeS.exe
  C:\Windows\System\PxWoBeS.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\hjUijtH.exe
  C:\Windows\System\hjUijtH.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\mcKIgAy.exe
  C:\Windows\System\mcKIgAy.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\nrUdpXP.exe
  C:\Windows\System\nrUdpXP.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\syBLUgH.exe
  C:\Windows\System\syBLUgH.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\XIWbyNU.exe
  C:\Windows\System\XIWbyNU.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\mtFcAAM.exe
  C:\Windows\System\mtFcAAM.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\xajmCWg.exe
  C:\Windows\System\xajmCWg.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\suyRzBG.exe
  C:\Windows\System\suyRzBG.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\TfuqqzN.exe
  C:\Windows\System\TfuqqzN.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\GosVkws.exe
  C:\Windows\System\GosVkws.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\KUJfwni.exe
  C:\Windows\System\KUJfwni.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\QJOsXum.exe
  C:\Windows\System\QJOsXum.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\ivrUJvV.exe
  C:\Windows\System\ivrUJvV.exe
  2⤵
  PID:4200
- C:\Windows\System\TWVpMBi.exe
  C:\Windows\System\TWVpMBi.exe
  2⤵
  PID:436
- C:\Windows\System\qinZxvK.exe
  C:\Windows\System\qinZxvK.exe
  2⤵
  PID:4512
- C:\Windows\System\QzIFgPI.exe
  C:\Windows\System\QzIFgPI.exe
  2⤵
  PID:3436
- C:\Windows\System\XyInvhP.exe
  C:\Windows\System\XyInvhP.exe
  2⤵
  PID:1124
- C:\Windows\System\CiIuZyP.exe
  C:\Windows\System\CiIuZyP.exe
  2⤵
  PID:2680
- C:\Windows\System\SFmRSlt.exe
  C:\Windows\System\SFmRSlt.exe
  2⤵
  PID:4288
- C:\Windows\System\GJOmhog.exe
  C:\Windows\System\GJOmhog.exe
  2⤵
  PID:5004
- C:\Windows\System\puYDWFx.exe
  C:\Windows\System\puYDWFx.exe
  2⤵
  PID:4968
- C:\Windows\System\fGzAZoV.exe
  C:\Windows\System\fGzAZoV.exe
  2⤵
  PID:5140
- C:\Windows\System\ZPAdRUU.exe
  C:\Windows\System\ZPAdRUU.exe
  2⤵
  PID:5168
- C:\Windows\System\iFNIZnH.exe
  C:\Windows\System\iFNIZnH.exe
  2⤵
  PID:5192
- C:\Windows\System\pnJRmPm.exe
  C:\Windows\System\pnJRmPm.exe
  2⤵
  PID:5208
- C:\Windows\System\wjUpaYN.exe
  C:\Windows\System\wjUpaYN.exe
  2⤵
  PID:5232
- C:\Windows\System\RMTzPll.exe
  C:\Windows\System\RMTzPll.exe
  2⤵
  PID:5248
- C:\Windows\System\pMEAttR.exe
  C:\Windows\System\pMEAttR.exe
  2⤵
  PID:5268
- C:\Windows\System\dNppjJX.exe
  C:\Windows\System\dNppjJX.exe
  2⤵
  PID:5288
- C:\Windows\System\KyOBuYI.exe
  C:\Windows\System\KyOBuYI.exe
  2⤵
  PID:5304
- C:\Windows\System\BnEMrnF.exe
  C:\Windows\System\BnEMrnF.exe
  2⤵
  PID:5324
- C:\Windows\System\tZRTAhZ.exe
  C:\Windows\System\tZRTAhZ.exe
  2⤵
  PID:5340
- C:\Windows\System\VdTnVSL.exe
  C:\Windows\System\VdTnVSL.exe
  2⤵
  PID:5360
- C:\Windows\System\AceCKib.exe
  C:\Windows\System\AceCKib.exe
  2⤵
  PID:5392
- C:\Windows\System\iooQDIt.exe
  C:\Windows\System\iooQDIt.exe
  2⤵
  PID:5412
- C:\Windows\System\mnaqQwQ.exe
  C:\Windows\System\mnaqQwQ.exe
  2⤵
  PID:5436
- C:\Windows\System\InLBgoO.exe
  C:\Windows\System\InLBgoO.exe
  2⤵
  PID:5460
- C:\Windows\System\yCrfEtV.exe
  C:\Windows\System\yCrfEtV.exe
  2⤵
  PID:5484
- C:\Windows\System\rhUFjgi.exe
  C:\Windows\System\rhUFjgi.exe
  2⤵
  PID:5504
- C:\Windows\System\kOBrFab.exe
  C:\Windows\System\kOBrFab.exe
  2⤵
  PID:5520
- C:\Windows\System\RkiCfBI.exe
  C:\Windows\System\RkiCfBI.exe
  2⤵
  PID:5548
- C:\Windows\System\zMaIUgD.exe
  C:\Windows\System\zMaIUgD.exe
  2⤵
  PID:5568
- C:\Windows\System\zKvRrzh.exe
  C:\Windows\System\zKvRrzh.exe
  2⤵
  PID:5612
- C:\Windows\System\oGjraKx.exe
  C:\Windows\System\oGjraKx.exe
  2⤵
  PID:5632
- C:\Windows\System\NXfSsjc.exe
  C:\Windows\System\NXfSsjc.exe
  2⤵
  PID:5648
- C:\Windows\System\VdSCWvp.exe
  C:\Windows\System\VdSCWvp.exe
  2⤵
  PID:5664
- C:\Windows\System\nmnwGuR.exe
  C:\Windows\System\nmnwGuR.exe
  2⤵
  PID:5688
- C:\Windows\System\SDNNDtX.exe
  C:\Windows\System\SDNNDtX.exe
  2⤵
  PID:5752
- C:\Windows\System\guPYSlY.exe
  C:\Windows\System\guPYSlY.exe
  2⤵
  PID:5768
- C:\Windows\System\jYPhcRQ.exe
  C:\Windows\System\jYPhcRQ.exe
  2⤵
  PID:5808
- C:\Windows\System\anAXrSV.exe
  C:\Windows\System\anAXrSV.exe
  2⤵
  PID:5824
- C:\Windows\System\ksyBMMN.exe
  C:\Windows\System\ksyBMMN.exe
  2⤵
  PID:5844
- C:\Windows\System\bTLIsgb.exe
  C:\Windows\System\bTLIsgb.exe
  2⤵
  PID:5868
- C:\Windows\System\krzfcAJ.exe
  C:\Windows\System\krzfcAJ.exe
  2⤵
  PID:5884
- C:\Windows\System\ZUONHDI.exe
  C:\Windows\System\ZUONHDI.exe
  2⤵
  PID:5900
- C:\Windows\System\BdEXFaF.exe
  C:\Windows\System\BdEXFaF.exe
  2⤵
  PID:5916
- C:\Windows\System\pkNvkEC.exe
  C:\Windows\System\pkNvkEC.exe
  2⤵
  PID:5944
- C:\Windows\System\jYxVcil.exe
  C:\Windows\System\jYxVcil.exe
  2⤵
  PID:5960
- C:\Windows\System\iqWBOPc.exe
  C:\Windows\System\iqWBOPc.exe
  2⤵
  PID:5980
- C:\Windows\System\jhQFGCg.exe
  C:\Windows\System\jhQFGCg.exe
  2⤵
  PID:6024
- C:\Windows\System\PHVqECr.exe
  C:\Windows\System\PHVqECr.exe
  2⤵
  PID:6044
- C:\Windows\System\GxFehJt.exe
  C:\Windows\System\GxFehJt.exe
  2⤵
  PID:6064
- C:\Windows\System\lpyIees.exe
  C:\Windows\System\lpyIees.exe
  2⤵
  PID:6084
- C:\Windows\System\wxzPDFT.exe
  C:\Windows\System\wxzPDFT.exe
  2⤵
  PID:6108
- C:\Windows\System\ELftcLy.exe
  C:\Windows\System\ELftcLy.exe
  2⤵
  PID:6132
- C:\Windows\System\IspNjJO.exe
  C:\Windows\System\IspNjJO.exe
  2⤵
  PID:3720
- C:\Windows\System\JDfYTII.exe
  C:\Windows\System\JDfYTII.exe
  2⤵
  PID:2036
- C:\Windows\System\jTTYhgY.exe
  C:\Windows\System\jTTYhgY.exe
  2⤵
  PID:4564
- C:\Windows\System\MbVqGwQ.exe
  C:\Windows\System\MbVqGwQ.exe
  2⤵
  PID:4432
- C:\Windows\System\QgsOOYb.exe
  C:\Windows\System\QgsOOYb.exe
  2⤵
  PID:516
- C:\Windows\System\onqdqvs.exe
  C:\Windows\System\onqdqvs.exe
  2⤵
  PID:4916
- C:\Windows\System\VAeWNis.exe
  C:\Windows\System\VAeWNis.exe
  2⤵
  PID:680
- C:\Windows\System\XtzrLpj.exe
  C:\Windows\System\XtzrLpj.exe
  2⤵
  PID:4348
- C:\Windows\System\CCQiIKF.exe
  C:\Windows\System\CCQiIKF.exe
  2⤵
  PID:1432
- C:\Windows\System\EKOLIOp.exe
  C:\Windows\System\EKOLIOp.exe
  2⤵
  PID:1808
- C:\Windows\System\gSLVgbq.exe
  C:\Windows\System\gSLVgbq.exe
  2⤵
  PID:1660
- C:\Windows\System\PUUgsey.exe
  C:\Windows\System\PUUgsey.exe
  2⤵
  PID:1516
- C:\Windows\System\cdLTccS.exe
  C:\Windows\System\cdLTccS.exe
  2⤵
  PID:3644
- C:\Windows\System\JRzfPkj.exe
  C:\Windows\System\JRzfPkj.exe
  2⤵
  PID:5016
- C:\Windows\System\MhbgsGz.exe
  C:\Windows\System\MhbgsGz.exe
  2⤵
  PID:1464
- C:\Windows\System\SPlfboz.exe
  C:\Windows\System\SPlfboz.exe
  2⤵
  PID:3168
- C:\Windows\System\SwsUFNq.exe
  C:\Windows\System\SwsUFNq.exe
  2⤵
  PID:5180
- C:\Windows\System\kyWHdNB.exe
  C:\Windows\System\kyWHdNB.exe
  2⤵
  PID:5244
- C:\Windows\System\BggmFur.exe
  C:\Windows\System\BggmFur.exe
  2⤵
  PID:5300
- C:\Windows\System\ifUpImO.exe
  C:\Windows\System\ifUpImO.exe
  2⤵
  PID:5356
- C:\Windows\System\jgZOTku.exe
  C:\Windows\System\jgZOTku.exe
  2⤵
  PID:5408
- C:\Windows\System\ieIYIIl.exe
  C:\Windows\System\ieIYIIl.exe
  2⤵
  PID:5468
- C:\Windows\System\uWHklrx.exe
  C:\Windows\System\uWHklrx.exe
  2⤵
  PID:5516
- C:\Windows\System\KYdRrkO.exe
  C:\Windows\System\KYdRrkO.exe
  2⤵
  PID:6060
- C:\Windows\System\bAxlYQO.exe
  C:\Windows\System\bAxlYQO.exe
  2⤵
  PID:4000
- C:\Windows\System\lbotMVE.exe
  C:\Windows\System\lbotMVE.exe
  2⤵
  PID:6172
- C:\Windows\System\lNcXFAO.exe
  C:\Windows\System\lNcXFAO.exe
  2⤵
  PID:6220
- C:\Windows\System\CxdZgUB.exe
  C:\Windows\System\CxdZgUB.exe
  2⤵
  PID:6244
- C:\Windows\System\ypyBjrH.exe
  C:\Windows\System\ypyBjrH.exe
  2⤵
  PID:6264
- C:\Windows\System\VwjewiD.exe
  C:\Windows\System\VwjewiD.exe
  2⤵
  PID:6288
- C:\Windows\System\wZlRKqK.exe
  C:\Windows\System\wZlRKqK.exe
  2⤵
  PID:6304
- C:\Windows\System\SVbjZIN.exe
  C:\Windows\System\SVbjZIN.exe
  2⤵
  PID:6464
- C:\Windows\System\xMItMdT.exe
  C:\Windows\System\xMItMdT.exe
  2⤵
  PID:6480
- C:\Windows\System\FJkXKxM.exe
  C:\Windows\System\FJkXKxM.exe
  2⤵
  PID:6496
- C:\Windows\System\pKdmNia.exe
  C:\Windows\System\pKdmNia.exe
  2⤵
  PID:6512
- C:\Windows\System\ONnBldF.exe
  C:\Windows\System\ONnBldF.exe
  2⤵
  PID:6528
- C:\Windows\System\aEQHYyf.exe
  C:\Windows\System\aEQHYyf.exe
  2⤵
  PID:6544
- C:\Windows\System\EEWGJdd.exe
  C:\Windows\System\EEWGJdd.exe
  2⤵
  PID:6560
- C:\Windows\System\qyuFcWD.exe
  C:\Windows\System\qyuFcWD.exe
  2⤵
  PID:6576
- C:\Windows\System\sMyXter.exe
  C:\Windows\System\sMyXter.exe
  2⤵
  PID:6592
- C:\Windows\System\vZLGdZD.exe
  C:\Windows\System\vZLGdZD.exe
  2⤵
  PID:6608
- C:\Windows\System\vtfEDQR.exe
  C:\Windows\System\vtfEDQR.exe
  2⤵
  PID:6628
- C:\Windows\System\eGvdivd.exe
  C:\Windows\System\eGvdivd.exe
  2⤵
  PID:6712
- C:\Windows\System\EADNKbM.exe
  C:\Windows\System\EADNKbM.exe
  2⤵
  PID:6728
- C:\Windows\System\hNUQCwx.exe
  C:\Windows\System\hNUQCwx.exe
  2⤵
  PID:6744
- C:\Windows\System\JSTyotf.exe
  C:\Windows\System\JSTyotf.exe
  2⤵
  PID:6764
- C:\Windows\System\mqnjoqu.exe
  C:\Windows\System\mqnjoqu.exe
  2⤵
  PID:6796
- C:\Windows\System\AGSGItL.exe
  C:\Windows\System\AGSGItL.exe
  2⤵
  PID:6816
- C:\Windows\System\ZiiTLpz.exe
  C:\Windows\System\ZiiTLpz.exe
  2⤵
  PID:6836
- C:\Windows\System\AjVNcuw.exe
  C:\Windows\System\AjVNcuw.exe
  2⤵
  PID:6852
- C:\Windows\System\zBkREIt.exe
  C:\Windows\System\zBkREIt.exe
  2⤵
  PID:6868
- C:\Windows\System\YbELDMu.exe
  C:\Windows\System\YbELDMu.exe
  2⤵
  PID:6892
- C:\Windows\System\dAQeQkK.exe
  C:\Windows\System\dAQeQkK.exe
  2⤵
  PID:6912
- C:\Windows\System\sCculjF.exe
  C:\Windows\System\sCculjF.exe
  2⤵
  PID:6948
- C:\Windows\System\GovMudF.exe
  C:\Windows\System\GovMudF.exe
  2⤵
  PID:6980
- C:\Windows\System\NuxnpLn.exe
  C:\Windows\System\NuxnpLn.exe
  2⤵
  PID:7000
- C:\Windows\System\mbgCrGZ.exe
  C:\Windows\System\mbgCrGZ.exe
  2⤵
  PID:7024
- C:\Windows\System\EOCLKpH.exe
  C:\Windows\System\EOCLKpH.exe
  2⤵
  PID:7044
- C:\Windows\System\tFtZdpI.exe
  C:\Windows\System\tFtZdpI.exe
  2⤵
  PID:7068
- C:\Windows\System\qIEJpSs.exe
  C:\Windows\System\qIEJpSs.exe
  2⤵
  PID:7092
- C:\Windows\System\ZJotvCd.exe
  C:\Windows\System\ZJotvCd.exe
  2⤵
  PID:7120
- C:\Windows\System\czulUgz.exe
  C:\Windows\System\czulUgz.exe
  2⤵
  PID:7140
- C:\Windows\System\iJqgpbs.exe
  C:\Windows\System\iJqgpbs.exe
  2⤵
  PID:7164
- C:\Windows\System\Tjxbbdj.exe
  C:\Windows\System\Tjxbbdj.exe
  2⤵
  PID:5628
- C:\Windows\System\nlODphl.exe
  C:\Windows\System\nlODphl.exe
  2⤵
  PID:5676
- C:\Windows\System\IzfPAEx.exe
  C:\Windows\System\IzfPAEx.exe
  2⤵
  PID:5712
- C:\Windows\System\EAyBqcX.exe
  C:\Windows\System\EAyBqcX.exe
  2⤵
  PID:5832
- C:\Windows\System\yfJihBV.exe
  C:\Windows\System\yfJihBV.exe
  2⤵
  PID:5892
- C:\Windows\System\JerLtJU.exe
  C:\Windows\System\JerLtJU.exe
  2⤵
  PID:5952
- C:\Windows\System\vCSbSYJ.exe
  C:\Windows\System\vCSbSYJ.exe
  2⤵
  PID:6020
- C:\Windows\System\fIFoCJW.exe
  C:\Windows\System\fIFoCJW.exe
  2⤵
  PID:512
- C:\Windows\System\azfUuPw.exe
  C:\Windows\System\azfUuPw.exe
  2⤵
  PID:4744
- C:\Windows\System\vdyJnvT.exe
  C:\Windows\System\vdyJnvT.exe
  2⤵
  PID:5216
- C:\Windows\System\qBlFLQp.exe
  C:\Windows\System\qBlFLQp.exe
  2⤵
  PID:5936
- C:\Windows\System\oNZJflN.exe
  C:\Windows\System\oNZJflN.exe
  2⤵
  PID:6164
- C:\Windows\System\oSjJibO.exe
  C:\Windows\System\oSjJibO.exe
  2⤵
  PID:6252
- C:\Windows\System\gTKpxrE.exe
  C:\Windows\System\gTKpxrE.exe
  2⤵
  PID:2324
- C:\Windows\System\yuHduSa.exe
  C:\Windows\System\yuHduSa.exe
  2⤵
  PID:5296
- C:\Windows\System\rRVtYEB.exe
  C:\Windows\System\rRVtYEB.exe
  2⤵
  PID:5404
- C:\Windows\System\cHtLQXA.exe
  C:\Windows\System\cHtLQXA.exe
  2⤵
  PID:5536
- C:\Windows\System\gSpVkvw.exe
  C:\Windows\System\gSpVkvw.exe
  2⤵
  PID:6152
- C:\Windows\System\PgYKMsW.exe
  C:\Windows\System\PgYKMsW.exe
  2⤵
  PID:6260
- C:\Windows\System\wOSVGgv.exe
  C:\Windows\System\wOSVGgv.exe
  2⤵
  PID:6788
- C:\Windows\System\jJPJNum.exe
  C:\Windows\System\jJPJNum.exe
  2⤵
  PID:7188
- C:\Windows\System\SUAcrkh.exe
  C:\Windows\System\SUAcrkh.exe
  2⤵
  PID:7204
- C:\Windows\System\nMYTZsJ.exe
  C:\Windows\System\nMYTZsJ.exe
  2⤵
  PID:7228
- C:\Windows\System\onbSzcL.exe
  C:\Windows\System\onbSzcL.exe
  2⤵
  PID:7260
- C:\Windows\System\KvNpslf.exe
  C:\Windows\System\KvNpslf.exe
  2⤵
  PID:7304
- C:\Windows\System\TxNsBfo.exe
  C:\Windows\System\TxNsBfo.exe
  2⤵
  PID:7340
- C:\Windows\System\tUoRwIX.exe
  C:\Windows\System\tUoRwIX.exe
  2⤵
  PID:7384
- C:\Windows\System\ghUhSCS.exe
  C:\Windows\System\ghUhSCS.exe
  2⤵
  PID:7416
- C:\Windows\System\wuGSNRK.exe
  C:\Windows\System\wuGSNRK.exe
  2⤵
  PID:7436
- C:\Windows\System\FqRwJSg.exe
  C:\Windows\System\FqRwJSg.exe
  2⤵
  PID:7456
- C:\Windows\System\zzqCGig.exe
  C:\Windows\System\zzqCGig.exe
  2⤵
  PID:7472
- C:\Windows\System\IOThTlo.exe
  C:\Windows\System\IOThTlo.exe
  2⤵
  PID:7524
- C:\Windows\System\GcUTqfF.exe
  C:\Windows\System\GcUTqfF.exe
  2⤵
  PID:7540
- C:\Windows\System\OFUuWWu.exe
  C:\Windows\System\OFUuWWu.exe
  2⤵
  PID:7556
- C:\Windows\System\dbSsxgK.exe
  C:\Windows\System\dbSsxgK.exe
  2⤵
  PID:7572
- C:\Windows\System\OUsnEJO.exe
  C:\Windows\System\OUsnEJO.exe
  2⤵
  PID:7588
- C:\Windows\System\ZXAGeWI.exe
  C:\Windows\System\ZXAGeWI.exe
  2⤵
  PID:7604
- C:\Windows\System\BtcOxTm.exe
  C:\Windows\System\BtcOxTm.exe
  2⤵
  PID:7620
- C:\Windows\System\sSYSwuJ.exe
  C:\Windows\System\sSYSwuJ.exe
  2⤵
  PID:7644
- C:\Windows\System\oYWAmwr.exe
  C:\Windows\System\oYWAmwr.exe
  2⤵
  PID:7660
- C:\Windows\System\nqjDQPt.exe
  C:\Windows\System\nqjDQPt.exe
  2⤵
  PID:7688
- C:\Windows\System\FPOKqFX.exe
  C:\Windows\System\FPOKqFX.exe
  2⤵
  PID:7712
- C:\Windows\System\sQlZNmu.exe
  C:\Windows\System\sQlZNmu.exe
  2⤵
  PID:7728
- C:\Windows\System\jdHcrJX.exe
  C:\Windows\System\jdHcrJX.exe
  2⤵
  PID:7764
- C:\Windows\System\QylcPyk.exe
  C:\Windows\System\QylcPyk.exe
  2⤵
  PID:7784
- C:\Windows\System\BkTaDJM.exe
  C:\Windows\System\BkTaDJM.exe
  2⤵
  PID:7808
- C:\Windows\System\ONTvsqf.exe
  C:\Windows\System\ONTvsqf.exe
  2⤵
  PID:7828
- C:\Windows\System\yqgLDxc.exe
  C:\Windows\System\yqgLDxc.exe
  2⤵
  PID:7852
- C:\Windows\System\gVkrIoH.exe
  C:\Windows\System\gVkrIoH.exe
  2⤵
  PID:7876
- C:\Windows\System\xAqKyQe.exe
  C:\Windows\System\xAqKyQe.exe
  2⤵
  PID:7892
- C:\Windows\System\kDktkcH.exe
  C:\Windows\System\kDktkcH.exe
  2⤵
  PID:7916
- C:\Windows\System\JYqkGxm.exe
  C:\Windows\System\JYqkGxm.exe
  2⤵
  PID:7948
- C:\Windows\System\ajHkWQU.exe
  C:\Windows\System\ajHkWQU.exe
  2⤵
  PID:7964
- C:\Windows\System\eYtOGoE.exe
  C:\Windows\System\eYtOGoE.exe
  2⤵
  PID:7992
- C:\Windows\System\eLCasEE.exe
  C:\Windows\System\eLCasEE.exe
  2⤵
  PID:8012
- C:\Windows\System\oXwTqKp.exe
  C:\Windows\System\oXwTqKp.exe
  2⤵
  PID:8056
- C:\Windows\System\sScHEWa.exe
  C:\Windows\System\sScHEWa.exe
  2⤵
  PID:8072
- C:\Windows\System\fCJJlpp.exe
  C:\Windows\System\fCJJlpp.exe
  2⤵
  PID:8088
- C:\Windows\System\kuJmVdG.exe
  C:\Windows\System\kuJmVdG.exe
  2⤵
  PID:8104
- C:\Windows\System\SIXtkkX.exe
  C:\Windows\System\SIXtkkX.exe
  2⤵
  PID:8120
- C:\Windows\System\ahMtxAC.exe
  C:\Windows\System\ahMtxAC.exe
  2⤵
  PID:8148
- C:\Windows\System\AsUYNwg.exe
  C:\Windows\System\AsUYNwg.exe
  2⤵
  PID:8164
- C:\Windows\System\abBOrat.exe
  C:\Windows\System\abBOrat.exe
  2⤵
  PID:8188
- C:\Windows\System\MybrNIV.exe
  C:\Windows\System\MybrNIV.exe
  2⤵
  PID:5656
- C:\Windows\System\IVwwjRK.exe
  C:\Windows\System\IVwwjRK.exe
  2⤵
  PID:5740
- C:\Windows\System\LWuOmMN.exe
  C:\Windows\System\LWuOmMN.exe
  2⤵
  PID:6216
- C:\Windows\System\FbalEPp.exe
  C:\Windows\System\FbalEPp.exe
  2⤵
  PID:5700
- C:\Windows\System\xOZdRBQ.exe
  C:\Windows\System\xOZdRBQ.exe
  2⤵
  PID:6488
- C:\Windows\System\dIwBYhZ.exe
  C:\Windows\System\dIwBYhZ.exe
  2⤵
  PID:6536
- C:\Windows\System\ZKhMBDK.exe
  C:\Windows\System\ZKhMBDK.exe
  2⤵
  PID:6572
- C:\Windows\System\YviSMpd.exe
  C:\Windows\System\YviSMpd.exe
  2⤵
  PID:6624
- C:\Windows\System\eTxYdTM.exe
  C:\Windows\System\eTxYdTM.exe
  2⤵
  PID:6724
- C:\Windows\System\USMgVzq.exe
  C:\Windows\System\USMgVzq.exe
  2⤵
  PID:6776
- C:\Windows\System\tRnCxex.exe
  C:\Windows\System\tRnCxex.exe
  2⤵
  PID:6824
- C:\Windows\System\epeAFAi.exe
  C:\Windows\System\epeAFAi.exe
  2⤵
  PID:6884
- C:\Windows\System\OPLZjzm.exe
  C:\Windows\System\OPLZjzm.exe
  2⤵
  PID:6944
- C:\Windows\System\vYhXbDX.exe
  C:\Windows\System\vYhXbDX.exe
  2⤵
  PID:6992
- C:\Windows\System\zvMXCnL.exe
  C:\Windows\System\zvMXCnL.exe
  2⤵
  PID:7052
- C:\Windows\System\PireKMj.exe
  C:\Windows\System\PireKMj.exe
  2⤵
  PID:7084
- C:\Windows\System\qZQEXsb.exe
  C:\Windows\System\qZQEXsb.exe
  2⤵
  PID:7132
- C:\Windows\System\FmLqWME.exe
  C:\Windows\System\FmLqWME.exe
  2⤵
  PID:5596
- C:\Windows\System\SgtrxLf.exe
  C:\Windows\System\SgtrxLf.exe
  2⤵
  PID:5932
- C:\Windows\System\rjdjeFj.exe
  C:\Windows\System\rjdjeFj.exe
  2⤵
  PID:2000
- C:\Windows\System\lfEpkzy.exe
  C:\Windows\System\lfEpkzy.exe
  2⤵
  PID:5424
- C:\Windows\System\ywzLBZH.exe
  C:\Windows\System\ywzLBZH.exe
  2⤵
  PID:4280
- C:\Windows\System\MzztThO.exe
  C:\Windows\System\MzztThO.exe
  2⤵
  PID:2964
- C:\Windows\System\qQItzhD.exe
  C:\Windows\System\qQItzhD.exe
  2⤵
  PID:6140
- C:\Windows\System\uZFhhNN.exe
  C:\Windows\System\uZFhhNN.exe
  2⤵
  PID:6236
- C:\Windows\System\lMYAPan.exe
  C:\Windows\System\lMYAPan.exe
  2⤵
  PID:7176
- C:\Windows\System\YLzDJda.exe
  C:\Windows\System\YLzDJda.exe
  2⤵
  PID:7200
- C:\Windows\System\jFBLneq.exe
  C:\Windows\System\jFBLneq.exe
  2⤵
  PID:7240
- C:\Windows\System\yLUfcGj.exe
  C:\Windows\System\yLUfcGj.exe
  2⤵
  PID:7292
- C:\Windows\System\jQiVdcU.exe
  C:\Windows\System\jQiVdcU.exe
  2⤵
  PID:7372
- C:\Windows\System\rqRiwmQ.exe
  C:\Windows\System\rqRiwmQ.exe
  2⤵
  PID:7428
- C:\Windows\System\RIabdPa.exe
  C:\Windows\System\RIabdPa.exe
  2⤵
  PID:7452
- C:\Windows\System\SfzujDF.exe
  C:\Windows\System\SfzujDF.exe
  2⤵
  PID:7484
- C:\Windows\System\xlZaxyz.exe
  C:\Windows\System\xlZaxyz.exe
  2⤵
  PID:8196
- C:\Windows\System\RHTsmeG.exe
  C:\Windows\System\RHTsmeG.exe
  2⤵
  PID:8212
- C:\Windows\System\yaWOyqh.exe
  C:\Windows\System\yaWOyqh.exe
  2⤵
  PID:8232
- C:\Windows\System\akLTjww.exe
  C:\Windows\System\akLTjww.exe
  2⤵
  PID:8248
- C:\Windows\System\ESwZGdi.exe
  C:\Windows\System\ESwZGdi.exe
  2⤵
  PID:8268
- C:\Windows\System\XJxVAxg.exe
  C:\Windows\System\XJxVAxg.exe
  2⤵
  PID:8300
- C:\Windows\System\TrKmtEA.exe
  C:\Windows\System\TrKmtEA.exe
  2⤵
  PID:8320
- C:\Windows\System\IKLEoVf.exe
  C:\Windows\System\IKLEoVf.exe
  2⤵
  PID:8344
- C:\Windows\System\BTMnxQQ.exe
  C:\Windows\System\BTMnxQQ.exe
  2⤵
  PID:8368
- C:\Windows\System\npcnmAD.exe
  C:\Windows\System\npcnmAD.exe
  2⤵
  PID:8392
- C:\Windows\System\GcRbrgm.exe
  C:\Windows\System\GcRbrgm.exe
  2⤵
  PID:8416
- C:\Windows\System\ziOVRPH.exe
  C:\Windows\System\ziOVRPH.exe
  2⤵
  PID:8440
- C:\Windows\System\VJuqYbJ.exe
  C:\Windows\System\VJuqYbJ.exe
  2⤵
  PID:8460
- C:\Windows\System\DeFQekZ.exe
  C:\Windows\System\DeFQekZ.exe
  2⤵
  PID:8484
- C:\Windows\System\qqDRECp.exe
  C:\Windows\System\qqDRECp.exe
  2⤵
  PID:8504
- C:\Windows\System\AaCpCuW.exe
  C:\Windows\System\AaCpCuW.exe
  2⤵
  PID:8532
- C:\Windows\System\DPkwEZy.exe
  C:\Windows\System\DPkwEZy.exe
  2⤵
  PID:8552
- C:\Windows\System\mPJrrZY.exe
  C:\Windows\System\mPJrrZY.exe
  2⤵
  PID:8576
- C:\Windows\System\wAiXkIC.exe
  C:\Windows\System\wAiXkIC.exe
  2⤵
  PID:8592
- C:\Windows\System\CWgPkOC.exe
  C:\Windows\System\CWgPkOC.exe
  2⤵
  PID:8608
- C:\Windows\System\aABKLtj.exe
  C:\Windows\System\aABKLtj.exe
  2⤵
  PID:8624
- C:\Windows\System\OeGpllk.exe
  C:\Windows\System\OeGpllk.exe
  2⤵
  PID:8644
- C:\Windows\System\TqIGFpB.exe
  C:\Windows\System\TqIGFpB.exe
  2⤵
  PID:8660
- C:\Windows\System\bvXzZSR.exe
  C:\Windows\System\bvXzZSR.exe
  2⤵
  PID:8676
- C:\Windows\System\TtQpjmT.exe
  C:\Windows\System\TtQpjmT.exe
  2⤵
  PID:8692
- C:\Windows\System\hnMejOp.exe
  C:\Windows\System\hnMejOp.exe
  2⤵
  PID:8712
- C:\Windows\System\YkCKEsx.exe
  C:\Windows\System\YkCKEsx.exe
  2⤵
  PID:8728
- C:\Windows\System\ValJxvo.exe
  C:\Windows\System\ValJxvo.exe
  2⤵
  PID:8760
- C:\Windows\System\UrfPoZj.exe
  C:\Windows\System\UrfPoZj.exe
  2⤵
  PID:8780
- C:\Windows\System\NpvXVKc.exe
  C:\Windows\System\NpvXVKc.exe
  2⤵
  PID:8800
- C:\Windows\System\jWgOSxc.exe
  C:\Windows\System\jWgOSxc.exe
  2⤵
  PID:8824
- C:\Windows\System\wUCDcDn.exe
  C:\Windows\System\wUCDcDn.exe
  2⤵
  PID:8844
- C:\Windows\System\FlPlosw.exe
  C:\Windows\System\FlPlosw.exe
  2⤵
  PID:8860
- C:\Windows\System\AETXmVJ.exe
  C:\Windows\System\AETXmVJ.exe
  2⤵
  PID:8880
- C:\Windows\System\XkgYfMO.exe
  C:\Windows\System\XkgYfMO.exe
  2⤵
  PID:8908
- C:\Windows\System\BcVppSX.exe
  C:\Windows\System\BcVppSX.exe
  2⤵
  PID:8924
- C:\Windows\System\OFBIJnK.exe
  C:\Windows\System\OFBIJnK.exe
  2⤵
  PID:8948
- C:\Windows\System\JpUhuVP.exe
  C:\Windows\System\JpUhuVP.exe
  2⤵
  PID:8968
- C:\Windows\System\BfXQLfS.exe
  C:\Windows\System\BfXQLfS.exe
  2⤵
  PID:8988
- C:\Windows\System\rbUZoXf.exe
  C:\Windows\System\rbUZoXf.exe
  2⤵
  PID:9012
- C:\Windows\System\lBhkCrK.exe
  C:\Windows\System\lBhkCrK.exe
  2⤵
  PID:9028
- C:\Windows\System\cpxQHPj.exe
  C:\Windows\System\cpxQHPj.exe
  2⤵
  PID:9052
- C:\Windows\System\OKhNWzm.exe
  C:\Windows\System\OKhNWzm.exe
  2⤵
  PID:9080
- C:\Windows\System\oTpdoGq.exe
  C:\Windows\System\oTpdoGq.exe
  2⤵
  PID:9096
- C:\Windows\System\XwgbayP.exe
  C:\Windows\System\XwgbayP.exe
  2⤵
  PID:9120
- C:\Windows\System\tOnBtgx.exe
  C:\Windows\System\tOnBtgx.exe
  2⤵
  PID:9140
- C:\Windows\System\vxornQi.exe
  C:\Windows\System\vxornQi.exe
  2⤵
  PID:9168
- C:\Windows\System\iVuJGzy.exe
  C:\Windows\System\iVuJGzy.exe
  2⤵
  PID:9192
- C:\Windows\System\WzMxGBe.exe
  C:\Windows\System\WzMxGBe.exe
  2⤵
  PID:9212
- C:\Windows\System\dnHyaWy.exe
  C:\Windows\System\dnHyaWy.exe
  2⤵
  PID:7548
- C:\Windows\System\YqwdqdY.exe
  C:\Windows\System\YqwdqdY.exe
  2⤵
  PID:7652
- C:\Windows\System\SWWHnrK.exe
  C:\Windows\System\SWWHnrK.exe
  2⤵
  PID:7736
- C:\Windows\System\ODdqEmg.exe
  C:\Windows\System\ODdqEmg.exe
  2⤵
  PID:7792
- C:\Windows\System\iUuhYuS.exe
  C:\Windows\System\iUuhYuS.exe
  2⤵
  PID:7924
- C:\Windows\System\JvobKOc.exe
  C:\Windows\System\JvobKOc.exe
  2⤵
  PID:8284
- C:\Windows\System\GPpyGkg.exe
  C:\Windows\System\GPpyGkg.exe
  2⤵
  PID:8336
- C:\Windows\System\zQIDkQl.exe
  C:\Windows\System\zQIDkQl.exe
  2⤵
  PID:8384
- C:\Windows\System\OpTVsKg.exe
  C:\Windows\System\OpTVsKg.exe
  2⤵
  PID:8428
- C:\Windows\System\WmRDFTW.exe
  C:\Windows\System\WmRDFTW.exe
  2⤵
  PID:8492
- C:\Windows\System\opIILFX.exe
  C:\Windows\System\opIILFX.exe
  2⤵
  PID:7972
- C:\Windows\System\HKEurvZ.exe
  C:\Windows\System\HKEurvZ.exe
  2⤵
  PID:8024
- C:\Windows\System\QtYpkTd.exe
  C:\Windows\System\QtYpkTd.exe
  2⤵
  PID:8100
- C:\Windows\System\adJvqMj.exe
  C:\Windows\System\adJvqMj.exe
  2⤵
  PID:8160
- C:\Windows\System\ckRNyAL.exe
  C:\Windows\System\ckRNyAL.exe
  2⤵
  PID:7036
- C:\Windows\System\cFTZwqA.exe
  C:\Windows\System\cFTZwqA.exe
  2⤵
  PID:5660
- C:\Windows\System\UhTcipq.exe
  C:\Windows\System\UhTcipq.exe
  2⤵
  PID:6552
- C:\Windows\System\UOsKnKo.exe
  C:\Windows\System\UOsKnKo.exe
  2⤵
  PID:6760
- C:\Windows\System\WnqmUDZ.exe
  C:\Windows\System\WnqmUDZ.exe
  2⤵
  PID:6988
- C:\Windows\System\xxCuFPh.exe
  C:\Windows\System\xxCuFPh.exe
  2⤵
  PID:7080
- C:\Windows\System\YrWMEDo.exe
  C:\Windows\System\YrWMEDo.exe
  2⤵
  PID:5444
- C:\Windows\System\anYymfQ.exe
  C:\Windows\System\anYymfQ.exe
  2⤵
  PID:7628
- C:\Windows\System\BwzXMxD.exe
  C:\Windows\System\BwzXMxD.exe
  2⤵
  PID:5876
- C:\Windows\System\CbFzSTx.exe
  C:\Windows\System\CbFzSTx.exe
  2⤵
  PID:6832
- C:\Windows\System\nDvmkJX.exe
  C:\Windows\System\nDvmkJX.exe
  2⤵
  PID:6508
- C:\Windows\System\hxXXIAC.exe
  C:\Windows\System\hxXXIAC.exe
  2⤵
  PID:8156
- C:\Windows\System\auzTtqJ.exe
  C:\Windows\System\auzTtqJ.exe
  2⤵
  PID:8020
- C:\Windows\System\IooZbDO.exe
  C:\Windows\System\IooZbDO.exe
  2⤵
  PID:7908
- C:\Windows\System\NmUtRXI.exe
  C:\Windows\System\NmUtRXI.exe
  2⤵
  PID:3244
- C:\Windows\System\OGoyqkq.exe
  C:\Windows\System\OGoyqkq.exe
  2⤵
  PID:9220
- C:\Windows\System\zTvcvnt.exe
  C:\Windows\System\zTvcvnt.exe
  2⤵
  PID:9240
- C:\Windows\System\NwnRKSD.exe
  C:\Windows\System\NwnRKSD.exe
  2⤵
  PID:9264
- C:\Windows\System\ISixLKv.exe
  C:\Windows\System\ISixLKv.exe
  2⤵
  PID:9284
- C:\Windows\System\iiGGKbZ.exe
  C:\Windows\System\iiGGKbZ.exe
  2⤵
  PID:9308
- C:\Windows\System\WKmlQkv.exe
  C:\Windows\System\WKmlQkv.exe
  2⤵
  PID:9332
- C:\Windows\System\Oiwegiq.exe
  C:\Windows\System\Oiwegiq.exe
  2⤵
  PID:9356
- C:\Windows\System\UTzbtHr.exe
  C:\Windows\System\UTzbtHr.exe
  2⤵
  PID:9380
- C:\Windows\System\HpPqCSE.exe
  C:\Windows\System\HpPqCSE.exe
  2⤵
  PID:9404
- C:\Windows\System\zMIULoZ.exe
  C:\Windows\System\zMIULoZ.exe
  2⤵
  PID:9428
- C:\Windows\System\puAkkCG.exe
  C:\Windows\System\puAkkCG.exe
  2⤵
  PID:9448
- C:\Windows\System\sTRUfFZ.exe
  C:\Windows\System\sTRUfFZ.exe
  2⤵
  PID:9472
- C:\Windows\System\KpwxhSg.exe
  C:\Windows\System\KpwxhSg.exe
  2⤵
  PID:9496
- C:\Windows\System\IvTYnsi.exe
  C:\Windows\System\IvTYnsi.exe
  2⤵
  PID:9520
- C:\Windows\System\ntQaKBt.exe
  C:\Windows\System\ntQaKBt.exe
  2⤵
  PID:9536
- C:\Windows\System\WtPFKdD.exe
  C:\Windows\System\WtPFKdD.exe
  2⤵
  PID:9560
- C:\Windows\System\AAUyfgW.exe
  C:\Windows\System\AAUyfgW.exe
  2⤵
  PID:9584
- C:\Windows\System\iqjAfJI.exe
  C:\Windows\System\iqjAfJI.exe
  2⤵
  PID:9608
- C:\Windows\System\VoLqmJf.exe
  C:\Windows\System\VoLqmJf.exe
  2⤵
  PID:9628
- C:\Windows\System\mbDORVJ.exe
  C:\Windows\System\mbDORVJ.exe
  2⤵
  PID:9656
- C:\Windows\System\KyvBtcY.exe
  C:\Windows\System\KyvBtcY.exe
  2⤵
  PID:9680
- C:\Windows\System\ksUkuUw.exe
  C:\Windows\System\ksUkuUw.exe
  2⤵
  PID:9708
- C:\Windows\System\zrYOdND.exe
  C:\Windows\System\zrYOdND.exe
  2⤵
  PID:9728
- C:\Windows\System\AavygAO.exe
  C:\Windows\System\AavygAO.exe
  2⤵
  PID:9748
- C:\Windows\System\ZSHxXOe.exe
  C:\Windows\System\ZSHxXOe.exe
  2⤵
  PID:9776
- C:\Windows\System\IQVBXGd.exe
  C:\Windows\System\IQVBXGd.exe
  2⤵
  PID:9808
- C:\Windows\System\KuyLwcF.exe
  C:\Windows\System\KuyLwcF.exe
  2⤵
  PID:9824
- C:\Windows\System\cKWnbYZ.exe
  C:\Windows\System\cKWnbYZ.exe
  2⤵
  PID:9844
- C:\Windows\System\AzWQbMy.exe
  C:\Windows\System\AzWQbMy.exe
  2⤵
  PID:9868
- C:\Windows\System\JavoCNr.exe
  C:\Windows\System\JavoCNr.exe
  2⤵
  PID:9888
- C:\Windows\System\sHWlCHY.exe
  C:\Windows\System\sHWlCHY.exe
  2⤵
  PID:9916
- C:\Windows\System\mEOmqFl.exe
  C:\Windows\System\mEOmqFl.exe
  2⤵
  PID:9936
- C:\Windows\System\iuQcZnk.exe
  C:\Windows\System\iuQcZnk.exe
  2⤵
  PID:9956
- C:\Windows\System\bKarHFU.exe
  C:\Windows\System\bKarHFU.exe
  2⤵
  PID:9976
- C:\Windows\System\NKJgKiK.exe
  C:\Windows\System\NKJgKiK.exe
  2⤵
  PID:9992
- C:\Windows\System\eHDXakd.exe
  C:\Windows\System\eHDXakd.exe
  2⤵
  PID:10024
- C:\Windows\System\yaYJODZ.exe
  C:\Windows\System\yaYJODZ.exe
  2⤵
  PID:10040
- C:\Windows\System\WzlOsDt.exe
  C:\Windows\System\WzlOsDt.exe
  2⤵
  PID:10060
- C:\Windows\System\qzmDGix.exe
  C:\Windows\System\qzmDGix.exe
  2⤵
  PID:10084
- C:\Windows\System\qJNqnQT.exe
  C:\Windows\System\qJNqnQT.exe
  2⤵
  PID:10104
- C:\Windows\System\iYsEOMi.exe
  C:\Windows\System\iYsEOMi.exe
  2⤵
  PID:10132
- C:\Windows\System\XKoxmOm.exe
  C:\Windows\System\XKoxmOm.exe
  2⤵
  PID:10156
- C:\Windows\System\YLUtZvJ.exe
  C:\Windows\System\YLUtZvJ.exe
  2⤵
  PID:10172
- C:\Windows\System\CxBYydT.exe
  C:\Windows\System\CxBYydT.exe
  2⤵
  PID:10196
- C:\Windows\System\mJrMiql.exe
  C:\Windows\System\mJrMiql.exe
  2⤵
  PID:10212
- C:\Windows\System\IEIxXmZ.exe
  C:\Windows\System\IEIxXmZ.exe
  2⤵
  PID:10236
- C:\Windows\System\YNEUpcn.exe
  C:\Windows\System\YNEUpcn.exe
  2⤵
  PID:8984
- C:\Windows\System\cmgDpYl.exe
  C:\Windows\System\cmgDpYl.exe
  2⤵
  PID:9148
- C:\Windows\System\hchCXCq.exe
  C:\Windows\System\hchCXCq.exe
  2⤵
  PID:9176
- C:\Windows\System\krpxMjs.exe
  C:\Windows\System\krpxMjs.exe
  2⤵
  PID:8276
- C:\Windows\System\xLMoJLu.exe
  C:\Windows\System\xLMoJLu.exe
  2⤵
  PID:8404
- C:\Windows\System\NAWypCm.exe
  C:\Windows\System\NAWypCm.exe
  2⤵
  PID:8472
- C:\Windows\System\cucMfNU.exe
  C:\Windows\System\cucMfNU.exe
  2⤵
  PID:8704
- C:\Windows\System\JkSShsL.exe
  C:\Windows\System\JkSShsL.exe
  2⤵
  PID:6300
- C:\Windows\System\wtiErgI.exe
  C:\Windows\System\wtiErgI.exe
  2⤵
  PID:7248
- C:\Windows\System\QIziUWu.exe
  C:\Windows\System\QIziUWu.exe
  2⤵
  PID:7412
- C:\Windows\System\LZDxMuD.exe
  C:\Windows\System\LZDxMuD.exe
  2⤵
  PID:6120
- C:\Windows\System\zoRbwbc.exe
  C:\Windows\System\zoRbwbc.exe
  2⤵
  PID:6756
- C:\Windows\System\qyCiNal.exe
  C:\Windows\System\qyCiNal.exe
  2⤵
  PID:6864
- C:\Windows\System\DHtfOlD.exe
  C:\Windows\System\DHtfOlD.exe
  2⤵
  PID:7956
- C:\Windows\System\yrfgMTL.exe
  C:\Windows\System\yrfgMTL.exe
  2⤵
  PID:10244
- C:\Windows\System\kEjstSy.exe
  C:\Windows\System\kEjstSy.exe
  2⤵
  PID:10268
- C:\Windows\System\zcNtitu.exe
  C:\Windows\System\zcNtitu.exe
  2⤵
  PID:10292
- C:\Windows\System\uBHmaOd.exe
  C:\Windows\System\uBHmaOd.exe
  2⤵
  PID:10316
- C:\Windows\System\AVVKtas.exe
  C:\Windows\System\AVVKtas.exe
  2⤵
  PID:10336
- C:\Windows\System\LYqRQCk.exe
  C:\Windows\System\LYqRQCk.exe
  2⤵
  PID:10364
- C:\Windows\System\SXKOFgj.exe
  C:\Windows\System\SXKOFgj.exe
  2⤵
  PID:10388
- C:\Windows\System\biWhzku.exe
  C:\Windows\System\biWhzku.exe
  2⤵
  PID:10412
- C:\Windows\System\loQvURU.exe
  C:\Windows\System\loQvURU.exe
  2⤵
  PID:10432
- C:\Windows\System\GphMlbT.exe
  C:\Windows\System\GphMlbT.exe
  2⤵
  PID:10452
- C:\Windows\System\rESEgRN.exe
  C:\Windows\System\rESEgRN.exe
  2⤵
  PID:10480
- C:\Windows\System\HKsJORv.exe
  C:\Windows\System\HKsJORv.exe
  2⤵
  PID:10504
- C:\Windows\System\TVddBty.exe
  C:\Windows\System\TVddBty.exe
  2⤵
  PID:10524
- C:\Windows\System\ViEcBBG.exe
  C:\Windows\System\ViEcBBG.exe
  2⤵
  PID:10548
- C:\Windows\System\tPkCqrb.exe
  C:\Windows\System\tPkCqrb.exe
  2⤵
  PID:10572
- C:\Windows\System\MZAEXYh.exe
  C:\Windows\System\MZAEXYh.exe
  2⤵
  PID:10592
- C:\Windows\System\QwJVaOc.exe
  C:\Windows\System\QwJVaOc.exe
  2⤵
  PID:10624
- C:\Windows\System\XShftxX.exe
  C:\Windows\System\XShftxX.exe
  2⤵
  PID:10640
- C:\Windows\System\OwYzAjP.exe
  C:\Windows\System\OwYzAjP.exe
  2⤵
  PID:10660
- C:\Windows\System\lnXbUFX.exe
  C:\Windows\System\lnXbUFX.exe
  2⤵
  PID:10684
- C:\Windows\System\PUzRqhK.exe
  C:\Windows\System\PUzRqhK.exe
  2⤵
  PID:10700
- C:\Windows\System\AgTwQSm.exe
  C:\Windows\System\AgTwQSm.exe
  2⤵
  PID:10724
- C:\Windows\System\cayXlGJ.exe
  C:\Windows\System\cayXlGJ.exe
  2⤵
  PID:10744
- C:\Windows\System\aiZqUkZ.exe
  C:\Windows\System\aiZqUkZ.exe
  2⤵
  PID:10768
- C:\Windows\System\OQYzjSh.exe
  C:\Windows\System\OQYzjSh.exe
  2⤵
  PID:10800
- C:\Windows\System\XzYDpvc.exe
  C:\Windows\System\XzYDpvc.exe
  2⤵
  PID:10816
- C:\Windows\System\StJNFAU.exe
  C:\Windows\System\StJNFAU.exe
  2⤵
  PID:10848
- C:\Windows\System\yLmSIzn.exe
  C:\Windows\System\yLmSIzn.exe
  2⤵
  PID:10868
- C:\Windows\System\IbTyouM.exe
  C:\Windows\System\IbTyouM.exe
  2⤵
  PID:10888
- C:\Windows\System\PSEpIUz.exe
  C:\Windows\System\PSEpIUz.exe
  2⤵
  PID:10908
- C:\Windows\System\NezzHdK.exe
  C:\Windows\System\NezzHdK.exe
  2⤵
  PID:10928
- C:\Windows\System\VIFByrA.exe
  C:\Windows\System\VIFByrA.exe
  2⤵
  PID:10952
- C:\Windows\System\zsSguML.exe
  C:\Windows\System\zsSguML.exe
  2⤵
  PID:10972
- C:\Windows\System\xMxiNxS.exe
  C:\Windows\System\xMxiNxS.exe
  2⤵
  PID:10996
- C:\Windows\System\WDdlczx.exe
  C:\Windows\System\WDdlczx.exe
  2⤵
  PID:11020
- C:\Windows\System\HEEznuX.exe
  C:\Windows\System\HEEznuX.exe
  2⤵
  PID:11040
- C:\Windows\System\EaZMtcz.exe
  C:\Windows\System\EaZMtcz.exe
  2⤵
  PID:11064
- C:\Windows\System\uwAmLpb.exe
  C:\Windows\System\uwAmLpb.exe
  2⤵
  PID:11088
- C:\Windows\System\AFWXXAA.exe
  C:\Windows\System\AFWXXAA.exe
  2⤵
  PID:11108
- C:\Windows\System\sgheRMg.exe
  C:\Windows\System\sgheRMg.exe
  2⤵
  PID:11128
- C:\Windows\System\xrDTGAK.exe
  C:\Windows\System\xrDTGAK.exe
  2⤵
  PID:11152
- C:\Windows\System\BoTUdAu.exe
  C:\Windows\System\BoTUdAu.exe
  2⤵
  PID:11172
- C:\Windows\System\McFZQEa.exe
  C:\Windows\System\McFZQEa.exe
  2⤵
  PID:11192
- C:\Windows\System\qjQmWrD.exe
  C:\Windows\System\qjQmWrD.exe
  2⤵
  PID:11216
- C:\Windows\System\bolhTbj.exe
  C:\Windows\System\bolhTbj.exe
  2⤵
  PID:11240
- C:\Windows\System\lqQNhSk.exe
  C:\Windows\System\lqQNhSk.exe
  2⤵
  PID:9256
- C:\Windows\System\MxwHvXz.exe
  C:\Windows\System\MxwHvXz.exe
  2⤵
  PID:9324
- C:\Windows\System\yohVvDZ.exe
  C:\Windows\System\yohVvDZ.exe
  2⤵
  PID:9420
- C:\Windows\System\zIDrmPt.exe
  C:\Windows\System\zIDrmPt.exe
  2⤵
  PID:9480
- C:\Windows\System\szAeZjh.exe
  C:\Windows\System\szAeZjh.exe
  2⤵
  PID:8220
- C:\Windows\System\SEOEWvp.exe
  C:\Windows\System\SEOEWvp.exe
  2⤵
  PID:9652
- C:\Windows\System\fuolwWm.exe
  C:\Windows\System\fuolwWm.exe
  2⤵
  PID:9036
- C:\Windows\System\gBoWywv.exe
  C:\Windows\System\gBoWywv.exe
  2⤵
  PID:9060
- C:\Windows\System\NGsnJtu.exe
  C:\Windows\System\NGsnJtu.exe
  2⤵
  PID:9736
- C:\Windows\System\lAJaXgX.exe
  C:\Windows\System\lAJaXgX.exe
  2⤵
  PID:9088
- C:\Windows\System\XcftCyW.exe
  C:\Windows\System\XcftCyW.exe
  2⤵
  PID:8260
- C:\Windows\System\MivrWLP.exe
  C:\Windows\System\MivrWLP.exe
  2⤵
  PID:9200
- C:\Windows\System\jwxZgBr.exe
  C:\Windows\System\jwxZgBr.exe
  2⤵
  PID:9928
- C:\Windows\System\juZowfE.exe
  C:\Windows\System\juZowfE.exe
  2⤵
  PID:7672
- C:\Windows\System\wHhcCGy.exe
  C:\Windows\System\wHhcCGy.exe
  2⤵
  PID:10036
- C:\Windows\System\IxVMgyw.exe
  C:\Windows\System\IxVMgyw.exe
  2⤵
  PID:7480
- C:\Windows\System\GLZAfQs.exe
  C:\Windows\System\GLZAfQs.exe
  2⤵
  PID:10080
- C:\Windows\System\NLvlERD.exe
  C:\Windows\System\NLvlERD.exe
  2⤵
  PID:11296
- C:\Windows\System\BWFNXvT.exe
  C:\Windows\System\BWFNXvT.exe
  2⤵
  PID:11312
- C:\Windows\System\XFmPToP.exe
  C:\Windows\System\XFmPToP.exe
  2⤵
  PID:11340
- C:\Windows\System\WRjwXKk.exe
  C:\Windows\System\WRjwXKk.exe
  2⤵
  PID:11364
- C:\Windows\System\ElLDcnT.exe
  C:\Windows\System\ElLDcnT.exe
  2⤵
  PID:11380
- C:\Windows\System\KyWvQmw.exe
  C:\Windows\System\KyWvQmw.exe
  2⤵
  PID:11404
- C:\Windows\System\OWJSJdZ.exe
  C:\Windows\System\OWJSJdZ.exe
  2⤵
  PID:11452
- C:\Windows\System\AafLAfS.exe
  C:\Windows\System\AafLAfS.exe
  2⤵
  PID:11472
- C:\Windows\System\HwKOtGQ.exe
  C:\Windows\System\HwKOtGQ.exe
  2⤵
  PID:11492
- C:\Windows\System\nvrXWmG.exe
  C:\Windows\System\nvrXWmG.exe
  2⤵
  PID:11508
- C:\Windows\System\ELQakBM.exe
  C:\Windows\System\ELQakBM.exe
  2⤵
  PID:11524
- C:\Windows\System\oXXlLKN.exe
  C:\Windows\System\oXXlLKN.exe
  2⤵
  PID:11548
- C:\Windows\System\ubCnKbw.exe
  C:\Windows\System\ubCnKbw.exe
  2⤵
  PID:11568
- C:\Windows\System\AgVHIoK.exe
  C:\Windows\System\AgVHIoK.exe
  2⤵
  PID:11588
- C:\Windows\System\BhgQtsF.exe
  C:\Windows\System\BhgQtsF.exe
  2⤵
  PID:11608
- C:\Windows\System\TkVRJpq.exe
  C:\Windows\System\TkVRJpq.exe
  2⤵
  PID:11628
- C:\Windows\System\JxBsxpK.exe
  C:\Windows\System\JxBsxpK.exe
  2⤵
  PID:11644
- C:\Windows\System\NTlaKdC.exe
  C:\Windows\System\NTlaKdC.exe
  2⤵
  PID:11676
- C:\Windows\System\cLcmmRI.exe
  C:\Windows\System\cLcmmRI.exe
  2⤵
  PID:11692
- C:\Windows\System\IcMVZai.exe
  C:\Windows\System\IcMVZai.exe
  2⤵
  PID:11708
- C:\Windows\System\rgZeEIB.exe
  C:\Windows\System\rgZeEIB.exe
  2⤵
  PID:11736
- C:\Windows\System\MBfUPBK.exe
  C:\Windows\System\MBfUPBK.exe
  2⤵
  PID:11756
- C:\Windows\System\yPDgths.exe
  C:\Windows\System\yPDgths.exe
  2⤵
  PID:11780
- C:\Windows\System\vAwwJNw.exe
  C:\Windows\System\vAwwJNw.exe
  2⤵
  PID:11796
- C:\Windows\System\WimPpnV.exe
  C:\Windows\System\WimPpnV.exe
  2⤵
  PID:11824
- C:\Windows\System\qCcgRZl.exe
  C:\Windows\System\qCcgRZl.exe
  2⤵
  PID:11848
- C:\Windows\System\DvETDPa.exe
  C:\Windows\System\DvETDPa.exe
  2⤵
  PID:11876
- C:\Windows\System\gEHqkSJ.exe
  C:\Windows\System\gEHqkSJ.exe
  2⤵
  PID:11892
- C:\Windows\System\GUtlEbe.exe
  C:\Windows\System\GUtlEbe.exe
  2⤵
  PID:11908
- C:\Windows\System\OBatMrH.exe
  C:\Windows\System\OBatMrH.exe
  2⤵
  PID:11924
- C:\Windows\System\uvEnqqw.exe
  C:\Windows\System\uvEnqqw.exe
  2⤵
  PID:11940
- C:\Windows\System\TENgkkq.exe
  C:\Windows\System\TENgkkq.exe
  2⤵
  PID:11960
- C:\Windows\System\QEkZjLk.exe
  C:\Windows\System\QEkZjLk.exe
  2⤵
  PID:11976
- C:\Windows\System\ceVAphm.exe
  C:\Windows\System\ceVAphm.exe
  2⤵
  PID:12000
- C:\Windows\System\TPzSpbP.exe
  C:\Windows\System\TPzSpbP.exe
  2⤵
  PID:12016
- C:\Windows\System\AYQdxOY.exe
  C:\Windows\System\AYQdxOY.exe
  2⤵
  PID:12040
- C:\Windows\System\RwDephC.exe
  C:\Windows\System\RwDephC.exe
  2⤵
  PID:12064
- C:\Windows\System\WfcjddE.exe
  C:\Windows\System\WfcjddE.exe
  2⤵
  PID:12084
- C:\Windows\System\aZukdNN.exe
  C:\Windows\System\aZukdNN.exe
  2⤵
  PID:12108
- C:\Windows\System\uXocTIW.exe
  C:\Windows\System\uXocTIW.exe
  2⤵
  PID:12128
- C:\Windows\System\GOwBezV.exe
  C:\Windows\System\GOwBezV.exe
  2⤵
  PID:12148
- C:\Windows\System\WNybMfP.exe
  C:\Windows\System\WNybMfP.exe
  2⤵
  PID:12172
- C:\Windows\System\qMErwMo.exe
  C:\Windows\System\qMErwMo.exe
  2⤵
  PID:12196
- C:\Windows\System\znWBIRB.exe
  C:\Windows\System\znWBIRB.exe
  2⤵
  PID:12228
- C:\Windows\System\zlRxYhw.exe
  C:\Windows\System\zlRxYhw.exe
  2⤵
  PID:12252
- C:\Windows\System\gZDtXyJ.exe
  C:\Windows\System\gZDtXyJ.exe
  2⤵
  PID:12268
- C:\Windows\System\DHFamWF.exe
  C:\Windows\System\DHFamWF.exe
  2⤵
  PID:8600
- C:\Windows\System\oeHfrFj.exe
  C:\Windows\System\oeHfrFj.exe
  2⤵
  PID:8636
- C:\Windows\System\YpVlPXU.exe
  C:\Windows\System\YpVlPXU.exe
  2⤵
  PID:8652
- C:\Windows\System\gFoLbXP.exe
  C:\Windows\System\gFoLbXP.exe
  2⤵
  PID:8708
- C:\Windows\System\ObFDxIM.exe
  C:\Windows\System\ObFDxIM.exe
  2⤵
  PID:2636
- C:\Windows\System\rckWfdX.exe
  C:\Windows\System\rckWfdX.exe
  2⤵
  PID:4604
- C:\Windows\System\ioTRWxr.exe
  C:\Windows\System\ioTRWxr.exe
  2⤵
  PID:9232
- C:\Windows\System\pocSsJm.exe
  C:\Windows\System\pocSsJm.exe
  2⤵
  PID:9300
- C:\Windows\System\ShYVuQG.exe
  C:\Windows\System\ShYVuQG.exe
  2⤵
  PID:9340
- C:\Windows\System\HesrZqg.exe
  C:\Windows\System\HesrZqg.exe
  2⤵
  PID:10380
- C:\Windows\System\ZoXoxuW.exe
  C:\Windows\System\ZoXoxuW.exe
  2⤵
  PID:10460
- C:\Windows\System\aQqGQMO.exe
  C:\Windows\System\aQqGQMO.exe
  2⤵
  PID:10496
- C:\Windows\System\GMfAYTK.exe
  C:\Windows\System\GMfAYTK.exe
  2⤵
  PID:9468
- C:\Windows\System\XCtroXC.exe
  C:\Windows\System\XCtroXC.exe
  2⤵
  PID:10588
- C:\Windows\System\nMhJcBz.exe
  C:\Windows\System\nMhJcBz.exe
  2⤵
  PID:9532
- C:\Windows\System\GZqJRTZ.exe
  C:\Windows\System\GZqJRTZ.exe
  2⤵
  PID:10636
- C:\Windows\System\wNEHhGQ.exe
  C:\Windows\System\wNEHhGQ.exe
  2⤵
  PID:9716
- C:\Windows\System\DQvPdwJ.exe
  C:\Windows\System\DQvPdwJ.exe
  2⤵
  PID:10836
- C:\Windows\System\LfAsNVf.exe
  C:\Windows\System\LfAsNVf.exe
  2⤵
  PID:9852
- C:\Windows\System\cjzJjMo.exe
  C:\Windows\System\cjzJjMo.exe
  2⤵
  PID:10964
- C:\Windows\System\WnGkRwQ.exe
  C:\Windows\System\WnGkRwQ.exe
  2⤵
  PID:11116
- C:\Windows\System\yVPsmLh.exe
  C:\Windows\System\yVPsmLh.exe
  2⤵
  PID:11212
- C:\Windows\System\mSUHsWg.exe
  C:\Windows\System\mSUHsWg.exe
  2⤵
  PID:7804
- C:\Windows\System\VGxfrTi.exe
  C:\Windows\System\VGxfrTi.exe
  2⤵
  PID:1648
- C:\Windows\System\LGiaSQb.exe
  C:\Windows\System\LGiaSQb.exe
  2⤵
  PID:12344
- C:\Windows\System\KJmkXnp.exe
  C:\Windows\System\KJmkXnp.exe
  2⤵
  PID:12368
- C:\Windows\System\eRlSqln.exe
  C:\Windows\System\eRlSqln.exe
  2⤵
  PID:12388
- C:\Windows\System\xMGWzWp.exe
  C:\Windows\System\xMGWzWp.exe
  2⤵
  PID:12408
- C:\Windows\System\VeqmwQb.exe
  C:\Windows\System\VeqmwQb.exe
  2⤵
  PID:12432
- C:\Windows\System\mvCDXqV.exe
  C:\Windows\System\mvCDXqV.exe
  2⤵
  PID:12452
- C:\Windows\System\puIQwjs.exe
  C:\Windows\System\puIQwjs.exe
  2⤵
  PID:12476
- C:\Windows\System\wtiwPYT.exe
  C:\Windows\System\wtiwPYT.exe
  2⤵
  PID:12496
- C:\Windows\System\KfmXKvf.exe
  C:\Windows\System\KfmXKvf.exe
  2⤵
  PID:12512
- C:\Windows\System\jaJfdTH.exe
  C:\Windows\System\jaJfdTH.exe
  2⤵
  PID:12528
- C:\Windows\System\QLlGhHY.exe
  C:\Windows\System\QLlGhHY.exe
  2⤵
  PID:12544
- C:\Windows\System\zmhxcVS.exe
  C:\Windows\System\zmhxcVS.exe
  2⤵
  PID:12560
- C:\Windows\System\FfFxRzf.exe
  C:\Windows\System\FfFxRzf.exe
  2⤵
  PID:12576
- C:\Windows\System\sUCUbEr.exe
  C:\Windows\System\sUCUbEr.exe
  2⤵
  PID:12596
- C:\Windows\System\FIACEvX.exe
  C:\Windows\System\FIACEvX.exe
  2⤵
  PID:12616
- C:\Windows\System\ysfpfOT.exe
  C:\Windows\System\ysfpfOT.exe
  2⤵
  PID:12640
- C:\Windows\System\ndDjFXA.exe
  C:\Windows\System\ndDjFXA.exe
  2⤵
  PID:12660
- C:\Windows\System\kcILxTa.exe
  C:\Windows\System\kcILxTa.exe
  2⤵
  PID:12684
- C:\Windows\System\DVRajdf.exe
  C:\Windows\System\DVRajdf.exe
  2⤵
  PID:12704
- C:\Windows\System\UWWgagd.exe
  C:\Windows\System\UWWgagd.exe
  2⤵
  PID:12728
- C:\Windows\System\xPNpXLQ.exe
  C:\Windows\System\xPNpXLQ.exe
  2⤵
  PID:12748
- C:\Windows\System\VkHIhWp.exe
  C:\Windows\System\VkHIhWp.exe
  2⤵
  PID:12772
- C:\Windows\System\nsWbpYv.exe
  C:\Windows\System\nsWbpYv.exe
  2⤵
  PID:12792
- C:\Windows\System\ubhlucE.exe
  C:\Windows\System\ubhlucE.exe
  2⤵
  PID:12816
- C:\Windows\System\QWhzBHW.exe
  C:\Windows\System\QWhzBHW.exe
  2⤵
  PID:12836
- C:\Windows\System\fnUIEjB.exe
  C:\Windows\System\fnUIEjB.exe
  2⤵
  PID:12856
- C:\Windows\System\ahGgRBZ.exe
  C:\Windows\System\ahGgRBZ.exe
  2⤵
  PID:12876
- C:\Windows\System\DhUsfJF.exe
  C:\Windows\System\DhUsfJF.exe
  2⤵
  PID:12896
- C:\Windows\System\IaTSLcs.exe
  C:\Windows\System\IaTSLcs.exe
  2⤵
  PID:12916
- C:\Windows\System\KbCnuTM.exe
  C:\Windows\System\KbCnuTM.exe
  2⤵
  PID:12940
- C:\Windows\System\BGPwmGz.exe
  C:\Windows\System\BGPwmGz.exe
  2⤵
  PID:12964
- C:\Windows\System\FMbDFoW.exe
  C:\Windows\System\FMbDFoW.exe
  2⤵
  PID:12992
- C:\Windows\System\SqPojiY.exe
  C:\Windows\System\SqPojiY.exe
  2⤵
  PID:13012
- C:\Windows\System\SeiTqVx.exe
  C:\Windows\System\SeiTqVx.exe
  2⤵
  PID:13032
- C:\Windows\System\jZdWSuH.exe
  C:\Windows\System\jZdWSuH.exe
  2⤵
  PID:13056
- C:\Windows\System\umwVtkP.exe
  C:\Windows\System\umwVtkP.exe
  2⤵
  PID:13084
- C:\Windows\System\DiQEpid.exe
  C:\Windows\System\DiQEpid.exe
  2⤵
  PID:13100
- C:\Windows\System\VIBCMPu.exe
  C:\Windows\System\VIBCMPu.exe
  2⤵
  PID:13124
- C:\Windows\System\kHonIVl.exe
  C:\Windows\System\kHonIVl.exe
  2⤵
  PID:13148
- C:\Windows\System\qprINaB.exe
  C:\Windows\System\qprINaB.exe
  2⤵
  PID:13168
- C:\Windows\System\GAquxyy.exe
  C:\Windows\System\GAquxyy.exe
  2⤵
  PID:13188
- C:\Windows\System\IDjeIrm.exe
  C:\Windows\System\IDjeIrm.exe
  2⤵
  PID:13212
- C:\Windows\System\KTVCjju.exe
  C:\Windows\System\KTVCjju.exe
  2⤵
  PID:13236
- C:\Windows\System\PmAvzOK.exe
  C:\Windows\System\PmAvzOK.exe
  2⤵
  PID:13252
- C:\Windows\System\VnNBMWY.exe
  C:\Windows\System\VnNBMWY.exe
  2⤵
  PID:13276
- C:\Windows\System\JcdCbjf.exe
  C:\Windows\System\JcdCbjf.exe
  2⤵
  PID:13300
- C:\Windows\System\YIUXHLL.exe
  C:\Windows\System\YIUXHLL.exe
  2⤵
  PID:8008
- C:\Windows\System\hTsiLZH.exe
  C:\Windows\System\hTsiLZH.exe
  2⤵
  PID:9900
- C:\Windows\System\GHJUmvA.exe
  C:\Windows\System\GHJUmvA.exe
  2⤵
  PID:9924
- C:\Windows\System\KtpmLbv.exe
  C:\Windows\System\KtpmLbv.exe
  2⤵
  PID:8332
- C:\Windows\System\WmkqZrr.exe
  C:\Windows\System\WmkqZrr.exe
  2⤵
  PID:9672
- C:\Windows\System\QrCOLga.exe
  C:\Windows\System\QrCOLga.exe
  2⤵
  PID:12292
- C:\Windows\System\EmtjfsW.exe
  C:\Windows\System\EmtjfsW.exe
  2⤵
  PID:11516
- C:\Windows\System\NTsStgn.exe
  C:\Windows\System\NTsStgn.exe
  2⤵
  PID:9352
- C:\Windows\System\VlRRwMS.exe
  C:\Windows\System\VlRRwMS.exe
  2⤵
  PID:10256
- C:\Windows\System\Oewphew.exe
  C:\Windows\System\Oewphew.exe
  2⤵
  PID:9504
- C:\Windows\System\FoCROgJ.exe
  C:\Windows\System\FoCROgJ.exe
  2⤵
  PID:4052
- C:\Windows\System\yQLQArF.exe
  C:\Windows\System\yQLQArF.exe
  2⤵
  PID:10424
- C:\Windows\System\XuwcCtO.exe
  C:\Windows\System\XuwcCtO.exe
  2⤵
  PID:9568
- C:\Windows\System\gzeiyar.exe
  C:\Windows\System\gzeiyar.exe
  2⤵
  PID:12352
- C:\Windows\System\JQakrnw.exe
  C:\Windows\System\JQakrnw.exe
  2⤵
  PID:12400
- C:\Windows\System\yBLBVGe.exe
  C:\Windows\System\yBLBVGe.exe
  2⤵
  PID:12444
- C:\Windows\System\gLRlDOJ.exe
  C:\Windows\System\gLRlDOJ.exe
  2⤵
  PID:12712
- C:\Windows\System\iXAvLCe.exe
  C:\Windows\System\iXAvLCe.exe
  2⤵
  PID:12812
- C:\Windows\System\jsaMOAD.exe
  C:\Windows\System\jsaMOAD.exe
  2⤵
  PID:8776
- C:\Windows\System\bbZJmAe.exe
  C:\Windows\System\bbZJmAe.exe
  2⤵
  PID:10308
- C:\Windows\System\JqUfAhr.exe
  C:\Windows\System\JqUfAhr.exe
  2⤵
  PID:10488
- C:\Windows\System\vIXgCzJ.exe
  C:\Windows\System\vIXgCzJ.exe
  2⤵
  PID:9528
- C:\Windows\System\AMPGAoy.exe
  C:\Windows\System\AMPGAoy.exe
  2⤵
  PID:9788
- C:\Windows\System\ATPOKfR.exe
  C:\Windows\System\ATPOKfR.exe
  2⤵
  PID:9944
- C:\Windows\System\GzBoCtm.exe
  C:\Windows\System\GzBoCtm.exe
  2⤵
  PID:10148
- C:\Windows\System\mHcnfHm.exe
  C:\Windows\System\mHcnfHm.exe
  2⤵
  PID:10180
- C:\Windows\System\yrYvHYt.exe
  C:\Windows\System\yrYvHYt.exe
  2⤵
  PID:7196
- C:\Windows\System\TEZdphY.exe
  C:\Windows\System\TEZdphY.exe
  2⤵
  PID:1436
- C:\Windows\System\yFTOaBk.exe
  C:\Windows\System\yFTOaBk.exe
  2⤵
  PID:12852
- C:\Windows\System\qKyJthx.exe
  C:\Windows\System\qKyJthx.exe
  2⤵
  PID:4924
- C:\Windows\System\Oqxdhbd.exe
  C:\Windows\System\Oqxdhbd.exe
  2⤵
  PID:12720
- C:\Windows\System\fyDodji.exe
  C:\Windows\System\fyDodji.exe
  2⤵
  PID:1108
- C:\Windows\System\DCGenVi.exe
  C:\Windows\System\DCGenVi.exe
  2⤵
  PID:11236
- C:\Windows\System\WLLOyjs.exe
  C:\Windows\System\WLLOyjs.exe
  2⤵
  PID:2932
- C:\Windows\System\vijVzGe.exe
  C:\Windows\System\vijVzGe.exe
  2⤵
  PID:10720
- C:\Windows\System\PTuqTtD.exe
  C:\Windows\System\PTuqTtD.exe
  2⤵
  PID:10128
- C:\Windows\System\qIPYolU.exe
  C:\Windows\System\qIPYolU.exe
  2⤵
  PID:11376
- C:\Windows\System\HmHODpb.exe
  C:\Windows\System\HmHODpb.exe
  2⤵
  PID:11448
- C:\Windows\System\vidzDjV.exe
  C:\Windows\System\vidzDjV.exe
  2⤵
  PID:11560
- C:\Windows\System\uLOTcoX.exe
  C:\Windows\System\uLOTcoX.exe
  2⤵
  PID:920
- C:\Windows\System\BTnEwpV.exe
  C:\Windows\System\BTnEwpV.exe
  2⤵
  PID:12788
- C:\Windows\System\eVjwoSY.exe
  C:\Windows\System\eVjwoSY.exe
  2⤵
  PID:13144
- C:\Windows\System\nuaAzTN.exe
  C:\Windows\System\nuaAzTN.exe
  2⤵
  PID:9640
- C:\Windows\System\VLIbuSA.exe
  C:\Windows\System\VLIbuSA.exe
  2⤵
  PID:4380
- C:\Windows\System\fQSBjUK.exe
  C:\Windows\System\fQSBjUK.exe
  2⤵
  PID:11280
- C:\Windows\System\QgOSMpB.exe
  C:\Windows\System\QgOSMpB.exe
  2⤵
  PID:12212
- C:\Windows\System\ardamYA.exe
  C:\Windows\System\ardamYA.exe
  2⤵
  PID:1744
- C:\Windows\System\RBMeseJ.exe
  C:\Windows\System\RBMeseJ.exe
  2⤵
  PID:4580
- C:\Windows\System\ollLpck.exe
  C:\Windows\System\ollLpck.exe
  2⤵
  PID:4452
- C:\Windows\System\UrTVrph.exe
  C:\Windows\System\UrTVrph.exe
  2⤵
  PID:11640
- C:\Windows\System\YlfZDTf.exe
  C:\Windows\System\YlfZDTf.exe
  2⤵
  PID:10988
- C:\Windows\System\yPQeODa.exe
  C:\Windows\System\yPQeODa.exe
  2⤵
  PID:13292
- C:\Windows\System\oFWxyxd.exe
  C:\Windows\System\oFWxyxd.exe
  2⤵
  PID:816
- C:\Windows\System\FfifYBp.exe
  C:\Windows\System\FfifYBp.exe
  2⤵
  PID:11252
- C:\Windows\System\CqSUZEB.exe
  C:\Windows\System\CqSUZEB.exe
  2⤵
  PID:9396
- C:\Windows\System\uFyJLHy.exe
  C:\Windows\System\uFyJLHy.exe
  2⤵
  PID:9704
- C:\Windows\System\eSwwPHH.exe
  C:\Windows\System\eSwwPHH.exe
  2⤵
  PID:9092
- C:\Windows\System\BlrbBbM.exe
  C:\Windows\System\BlrbBbM.exe
  2⤵
  PID:11284
- C:\Windows\System\MjRzkvw.exe
  C:\Windows\System\MjRzkvw.exe
  2⤵
  PID:11732
- C:\Windows\System\IoQHusw.exe
  C:\Windows\System\IoQHusw.exe
  2⤵
  PID:12416
- C:\Windows\System\TCraaSl.exe
  C:\Windows\System\TCraaSl.exe
  2⤵
  PID:12484
- C:\Windows\System\JEHHLWr.exe
  C:\Windows\System\JEHHLWr.exe
  2⤵
  PID:12676
- C:\Windows\System\QOxrfnT.exe
  C:\Windows\System\QOxrfnT.exe
  2⤵
  PID:11584
- C:\Windows\System\ZrBUbdH.exe
  C:\Windows\System\ZrBUbdH.exe
  2⤵
  PID:13092
- C:\Windows\System\apgIIAf.exe
  C:\Windows\System\apgIIAf.exe
  2⤵
  PID:3828
- C:\Windows\System\hlTDlKx.exe
  C:\Windows\System\hlTDlKx.exe
  2⤵
  PID:11788
- C:\Windows\System\SGyFJEU.exe
  C:\Windows\System\SGyFJEU.exe
  2⤵
  PID:11144
- C:\Windows\System\XYmBRVf.exe
  C:\Windows\System\XYmBRVf.exe
  2⤵
  PID:11968
- C:\Windows\System\Jkvlfzz.exe
  C:\Windows\System\Jkvlfzz.exe
  2⤵
  PID:11184
- C:\Windows\System\JoDvfme.exe
  C:\Windows\System\JoDvfme.exe
  2⤵
  PID:9516
- C:\Windows\System\JBywqbJ.exe
  C:\Windows\System\JBywqbJ.exe
  2⤵
  PID:10204
- C:\Windows\System\ZNRPMkT.exe
  C:\Windows\System\ZNRPMkT.exe
  2⤵
  PID:12104
- C:\Windows\System\HYoWMNM.exe
  C:\Windows\System\HYoWMNM.exe
  2⤵
  PID:12144
- C:\Windows\System\tmxZPNU.exe
  C:\Windows\System\tmxZPNU.exe
  2⤵
  PID:12244
- C:\Windows\System\iuZOKtG.exe
  C:\Windows\System\iuZOKtG.exe
  2⤵
  PID:4560
- C:\Windows\System\AbBBHWq.exe
  C:\Windows\System\AbBBHWq.exe
  2⤵
  PID:2952
- C:\Windows\System\NdmHbVq.exe
  C:\Windows\System\NdmHbVq.exe
  2⤵
  PID:9076
- C:\Windows\System\EvQBFLL.exe
  C:\Windows\System\EvQBFLL.exe
  2⤵
  PID:8500
- C:\Windows\System\wvoxNzr.exe
  C:\Windows\System\wvoxNzr.exe
  2⤵
  PID:12428
- C:\Windows\System\swlRMmR.exe
  C:\Windows\System\swlRMmR.exe
  2⤵
  PID:12908
- C:\Windows\System\QIdAxJy.exe
  C:\Windows\System\QIdAxJy.exe
  2⤵
  PID:12592
- C:\Windows\System\SRtTuoh.exe
  C:\Windows\System\SRtTuoh.exe
  2⤵
  PID:11480
- C:\Windows\System\xfAmCId.exe
  C:\Windows\System\xfAmCId.exe
  2⤵
  PID:3792
- C:\Windows\System\YMUhhPO.exe
  C:\Windows\System\YMUhhPO.exe
  2⤵
  PID:9836
- C:\Windows\System\nrGiHkd.exe
  C:\Windows\System\nrGiHkd.exe
  2⤵
  PID:11032
- C:\Windows\System\JkQKHYy.exe
  C:\Windows\System\JkQKHYy.exe
  2⤵
  PID:11724
- C:\Windows\System\bwmKCVi.exe
  C:\Windows\System\bwmKCVi.exe
  2⤵
  PID:10004
- C:\Windows\System\GdrtveF.exe
  C:\Windows\System\GdrtveF.exe
  2⤵
  PID:12504
- C:\Windows\System\bKaGfcM.exe
  C:\Windows\System\bKaGfcM.exe
  2⤵
  PID:12888
- C:\Windows\System\SKRNvlA.exe
  C:\Windows\System\SKRNvlA.exe
  2⤵
  PID:9184
- C:\Windows\System\jaZQIrf.exe
  C:\Windows\System\jaZQIrf.exe
  2⤵
  PID:12848
- C:\Windows\System\iKqTBMO.exe
  C:\Windows\System\iKqTBMO.exe
  2⤵
  PID:11072
- C:\Windows\System\VWpSNpF.exe
  C:\Windows\System\VWpSNpF.exe
  2⤵
  PID:8224
- C:\Windows\System\kjLMmMY.exe
  C:\Windows\System\kjLMmMY.exe
  2⤵
  PID:12204
- C:\Windows\System\uoWjYJQ.exe
  C:\Windows\System\uoWjYJQ.exe
  2⤵
  PID:12672
- C:\Windows\System\AARujSL.exe
  C:\Windows\System\AARujSL.exe
  2⤵
  PID:8244
- C:\Windows\System\hVGofrl.exe
  C:\Windows\System\hVGofrl.exe
  2⤵
  PID:12140
- C:\Windows\System\dqcLgxe.exe
  C:\Windows\System\dqcLgxe.exe
  2⤵
  PID:12332
- C:\Windows\System\DflHISA.exe
  C:\Windows\System\DflHISA.exe
  2⤵
  PID:10992
- C:\Windows\System\XHbBcNV.exe
  C:\Windows\System\XHbBcNV.exe
  2⤵
  PID:9548
- C:\Windows\System\tAqduuV.exe
  C:\Windows\System\tAqduuV.exe
  2⤵
  PID:10944
- C:\Windows\System\BPguQnZ.exe
  C:\Windows\System\BPguQnZ.exe
  2⤵
  PID:9668
- C:\Windows\System\BxgZJeO.exe
  C:\Windows\System\BxgZJeO.exe
  2⤵
  PID:2396
- C:\Windows\System\QOOZDCy.exe
  C:\Windows\System\QOOZDCy.exe
  2⤵
  PID:11272
- C:\Windows\System\wBuLuiL.exe
  C:\Windows\System\wBuLuiL.exe
  2⤵
  PID:5056
- C:\Windows\System\EiYTkRr.exe
  C:\Windows\System\EiYTkRr.exe
  2⤵
  PID:12972
- C:\Windows\System\iiwrlyO.exe
  C:\Windows\System\iiwrlyO.exe
  2⤵
  PID:10676
- C:\Windows\System\MexEqhS.exe
  C:\Windows\System\MexEqhS.exe
  2⤵
  PID:13080
- C:\Windows\System\SYvfsEz.exe
  C:\Windows\System\SYvfsEz.exe
  2⤵
  PID:13332
- C:\Windows\System\HPCOdEA.exe
  C:\Windows\System\HPCOdEA.exe
  2⤵
  PID:13356
- C:\Windows\System\HfvVthJ.exe
  C:\Windows\System\HfvVthJ.exe
  2⤵
  PID:13380
- C:\Windows\System\PjHuDIq.exe
  C:\Windows\System\PjHuDIq.exe
  2⤵
  PID:13404
- C:\Windows\System\cJtjuMH.exe
  C:\Windows\System\cJtjuMH.exe
  2⤵
  PID:13528
- C:\Windows\System\PdCdVko.exe
  C:\Windows\System\PdCdVko.exe
  2⤵
  PID:13564
- C:\Windows\System\obAaXkr.exe
  C:\Windows\System\obAaXkr.exe
  2⤵
  PID:13592
- C:\Windows\System\cmkRwTc.exe
  C:\Windows\System\cmkRwTc.exe
  2⤵
  PID:13620
- C:\Windows\System\qXTAyLO.exe
  C:\Windows\System\qXTAyLO.exe
  2⤵
  PID:13640
- C:\Windows\System\gmYmxRb.exe
  C:\Windows\System\gmYmxRb.exe
  2⤵
  PID:13664
- C:\Windows\System\jPPXlAB.exe
  C:\Windows\System\jPPXlAB.exe
  2⤵
  PID:13688
- C:\Windows\System\wdfRpSq.exe
  C:\Windows\System\wdfRpSq.exe
  2⤵
  PID:13716
- C:\Windows\System\zsyGeWR.exe
  C:\Windows\System\zsyGeWR.exe
  2⤵
  PID:13740
- C:\Windows\System\CkWWBsc.exe
  C:\Windows\System\CkWWBsc.exe
  2⤵
  PID:13756
- C:\Windows\System\gfcokaH.exe
  C:\Windows\System\gfcokaH.exe
  2⤵
  PID:13780
- C:\Windows\System\EQyaCNC.exe
  C:\Windows\System\EQyaCNC.exe
  2⤵
  PID:13800
- C:\Windows\System\sIemeBX.exe
  C:\Windows\System\sIemeBX.exe
  2⤵
  PID:13816
- C:\Windows\System\tyYptNH.exe
  C:\Windows\System\tyYptNH.exe
  2⤵
  PID:13836
- C:\Windows\System\LMXmHST.exe
  C:\Windows\System\LMXmHST.exe
  2⤵
  PID:13856
- C:\Windows\System\lmyAhfB.exe
  C:\Windows\System\lmyAhfB.exe
  2⤵
  PID:13884
- C:\Windows\System\EAuVEjy.exe
  C:\Windows\System\EAuVEjy.exe
  2⤵
  PID:13900
- C:\Windows\System\HXdPaiF.exe
  C:\Windows\System\HXdPaiF.exe
  2⤵
  PID:13916
- C:\Windows\System\eKHHHex.exe
  C:\Windows\System\eKHHHex.exe
  2⤵
  PID:13948
- C:\Windows\System\mnSNgAV.exe
  C:\Windows\System\mnSNgAV.exe
  2⤵
  PID:14016
- C:\Windows\System\MUQAVaI.exe
  C:\Windows\System\MUQAVaI.exe
  2⤵
  PID:14056
- C:\Windows\System\QXZvkjK.exe
  C:\Windows\System\QXZvkjK.exe
  2⤵
  PID:3504
- C:\Windows\System\tvCuOPB.exe
  C:\Windows\System\tvCuOPB.exe
  2⤵
  PID:11948
- C:\Windows\System\tnukiCH.exe
  C:\Windows\System\tnukiCH.exe
  2⤵
  PID:3352
- C:\Windows\System\jTxyhwr.exe
  C:\Windows\System\jTxyhwr.exe
  2⤵
  PID:12864
- C:\Windows\System\RKhmRVD.exe
  C:\Windows\System\RKhmRVD.exe
  2⤵
  PID:8980
- C:\Windows\System\PmrNrAc.exe
  C:\Windows\System\PmrNrAc.exe
  2⤵
  PID:12524
- C:\Windows\System\YyzpUKU.exe
  C:\Windows\System\YyzpUKU.exe
  2⤵
  PID:13288
- C:\Windows\System\zUajRxg.exe
  C:\Windows\System\zUajRxg.exe
  2⤵
  PID:13808
- C:\Windows\System\zOCKqwy.exe
  C:\Windows\System\zOCKqwy.exe
  2⤵
  PID:13864
- C:\Windows\System\imTftbx.exe
  C:\Windows\System\imTftbx.exe
  2⤵
  PID:12932
- C:\Windows\System\RxiAYDu.exe
  C:\Windows\System\RxiAYDu.exe
  2⤵
  PID:13956
- C:\Windows\System\OREDQCg.exe
  C:\Windows\System\OREDQCg.exe
  2⤵
  PID:4272
- C:\Windows\System\pyMLeaB.exe
  C:\Windows\System\pyMLeaB.exe
  2⤵
  PID:13372
- C:\Windows\System\kzGmqbH.exe
  C:\Windows\System\kzGmqbH.exe
  2⤵
  PID:3704
- C:\Windows\System\dvKcyDb.exe
  C:\Windows\System\dvKcyDb.exe
  2⤵
  PID:13696
- C:\Windows\System\ANtTXZS.exe
  C:\Windows\System\ANtTXZS.exe
  2⤵
  PID:13768
- C:\Windows\System\sOlLXzd.exe
  C:\Windows\System\sOlLXzd.exe
  2⤵
  PID:14232
- C:\Windows\System\zkCjVnW.exe
  C:\Windows\System\zkCjVnW.exe
  2⤵
  PID:4028
- C:\Windows\System\FyUpOli.exe
  C:\Windows\System\FyUpOli.exe
  2⤵
  PID:9044
- C:\Windows\System\KuhqMfX.exe
  C:\Windows\System\KuhqMfX.exe
  2⤵
  PID:12188
- C:\Windows\System\kdrIFus.exe
  C:\Windows\System\kdrIFus.exe
  2⤵
  PID:13524
- C:\Windows\System\zaDCHUq.exe
  C:\Windows\System\zaDCHUq.exe
  2⤵
  PID:10616
- C:\Windows\System\qWgkXim.exe
  C:\Windows\System\qWgkXim.exe
  2⤵
  PID:13368
- C:\Windows\System\UJNQjJr.exe
  C:\Windows\System\UJNQjJr.exe
  2⤵
  PID:14036
- C:\Windows\System\YUthLxR.exe
  C:\Windows\System\YUthLxR.exe
  2⤵
  PID:11328
- C:\Windows\System\UHzDEsL.exe
  C:\Windows\System\UHzDEsL.exe
  2⤵
  PID:14276
- C:\Windows\System\YwwOrPg.exe
  C:\Windows\System\YwwOrPg.exe
  2⤵
  PID:13392
- C:\Windows\System\SqYTccf.exe
  C:\Windows\System\SqYTccf.exe
  2⤵
  PID:13764
- C:\Windows\System\zOWdigW.exe
  C:\Windows\System\zOWdigW.exe
  2⤵
  PID:14252
- C:\Windows\System\GNgUqTY.exe
  C:\Windows\System\GNgUqTY.exe
  2⤵
  PID:6444
- C:\Windows\System\OspAyWd.exe
  C:\Windows\System\OspAyWd.exe
  2⤵
  PID:14108
- C:\Windows\System\GMDapgg.exe
  C:\Windows\System\GMDapgg.exe
  2⤵
  PID:14216
- C:\Windows\System\fsSBxFx.exe
  C:\Windows\System\fsSBxFx.exe
  2⤵
  PID:14152
- C:\Windows\System\zTxjfrm.exe
  C:\Windows\System\zTxjfrm.exe
  2⤵
  PID:14112
- C:\Windows\System\YUSCcSv.exe
  C:\Windows\System\YUSCcSv.exe
  2⤵
  PID:14176
- C:\Windows\System\ZvmCwYS.exe
  C:\Windows\System\ZvmCwYS.exe
  2⤵
  PID:3908
- C:\Windows\System\JaJRSju.exe
  C:\Windows\System\JaJRSju.exe
  2⤵
  PID:7864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xepdl02h.zr5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BYyPfIq.exe

Filesize
2.1MB

MD5
01a0af18c54c6b68b21857208cb5bacf

SHA1
6abb97d385d15bff4dd81ecf3ca454dffc7629a2

SHA256
cb30fa67cbe2b2ad5dff38230a288d56450c49c8f84742c3c42629c443e309c5

SHA512
c476eac4df12b376ea51cf92af381a127c8702bea8bfc298a039d38ed04b83c5afd62e0597926a919f3aa8b2196f640b9d0f471b28aa9490637319c1f9cedd1e

Download Submit
C:\Windows\System\CAYRhss.exe

Filesize
2.1MB

MD5
edea245f5d990321802e421f50f91631

SHA1
f4216903b8614f0a43a35926f93ca8e1fb02b647

SHA256
f45e71a92a3dbee6029d0bf716c7ee220290602e5c85c93036d036c70e04fa3c

SHA512
1c6492abeff8b958f1e7d592b565010f4793508d8fa127903d6b61b4dc545cf3fed10cdc3749dab61eb973f5c938bc56bc979168e83f5eac6095ea780b75a794

Download Submit
C:\Windows\System\DWrCFmD.exe

Filesize
2.1MB

MD5
1930a0a8b2747771a09254c9d3c17c68

SHA1
a57713b929f0c0bb4a967492669514892f8cbb58

SHA256
9b02d4c60b310feb8d4530c9cd908bd1981b2c287634233d5e0f9d5e5a2123fc

SHA512
2e6065a269777f9d8f5a36a33e01256362cfdf7e1bf3e10b4529491d0dfec847d1a095d67f9efc685038dd5c945dda5ca45a91dbb89c24e9617d06a2316d293b

Download Submit
C:\Windows\System\FJsgTVo.exe

Filesize
2.1MB

MD5
9f4dd87e3f19d21c6cd247689350e942

SHA1
d643c5f386b7985f02e4e966fba2a775b0247a3c

SHA256
395089b1d87f33293a8da6e33c7b2153b7634aad73db7ddfbfa4022e4b4a8000

SHA512
0cf1b3f25ee354f8dad55ad071f0b49c29b114fdcc7166636f7cbd63369fb25170a4affbf324e6ee96b1b494a77028daab23609de9196c1dd621dfc568177abc

Download Submit
C:\Windows\System\HjIDGbZ.exe

Filesize
2.1MB

MD5
92d5973d07d6cdcedfd7478460673375

SHA1
42c5bfa16c76dbbe0494ea5fd4bb9634a5b074ff

SHA256
513e263b724b9018a91c6f95036d25360d3b058a8a8985edb6dd1944cd681d17

SHA512
d878397044b185b019ecba96dc6674f5b99cb8c6fbcb6d19e0a8332eb19e8bf4b4f49a7313affd57d0aa246f550c25f0abb7bacafa8466f2621f88943c8be3bd

Download Submit
C:\Windows\System\IQSjSFv.exe

Filesize
2.1MB

MD5
81327a7930eb4df9dbaabb358f59844e

SHA1
991cf1a9421260d193a1730dd4757497a477e5e5

SHA256
3c4b4999121543b8c54e0a8635c2e2036f99835c9a7c6069d9cf3b851a67ef37

SHA512
83b669dc5ea47a2774980ec5ceeff10e851d90d2aceabb3e0fb6b0b06b7e066351adfa1180a3446ef2d3605a50ca9aead786ab94043c42c9cc06cdd1be2a7b78

Download Submit
C:\Windows\System\IueHSYM.exe

Filesize
2.1MB

MD5
eeede0b795d7960bf0225a8a60c238de

SHA1
8682af0e6209dc4ab9f2b463195bcfe17d645aa0

SHA256
c63dc063517bb889c0069fe3eb7adeab058b8dc2c31d94375a795149115b2d36

SHA512
e153afa92a0e4cc84a255f4de7faffd7a3b85067f4102d2fff77da28b81829f751d0220208fdc94ccb8071af4abc98e2362a41d729a93ef15dae33f81cb14ad4

Download Submit
C:\Windows\System\McNECbR.exe

Filesize
2.1MB

MD5
a4759d0d867e9f2d545dd39e03b050ac

SHA1
ce7bebf82e791174779c154ad04389769658a164

SHA256
52c4c3b88d1efe46106e9a69e892175fb00bf4163872c293ffae2de8cbe6a780

SHA512
41002f5f911730bdea75a21d3925ddd394f5af190e2347a33143af1c2bebce5ce1de4c3e1b9d440d2a2faf0f21557426b0ef7743e3a72da5847d09266da0463a

Download Submit
C:\Windows\System\MwrXeSG.exe

Filesize
2.1MB

MD5
ef940c0066cd29906b3050aa2546a432

SHA1
347f4c3913b4ae34ddefb8da726f849429f99803

SHA256
68a367f85161a0dcd56776ba7eab0a707487408c75981aaf66cc0914ef50a20e

SHA512
8abe9beea6d07772750d5ad742f24ba9ec3241c057d10d3fe9c10198de75cd13c3f6abeba34f83399ecc6ceba4242ade3c9e5cd08c99ead31d4ac7a44066eb53

Download Submit
C:\Windows\System\QJzBJnq.exe

Filesize
2.1MB

MD5
bf91576ce0348cdaa99e7a583f51c666

SHA1
93f474542b20fe00ee66678fc1e6b23c7f38f24c

SHA256
9652a32849a0407486933e8dad4be4bd898fce7883a8f9451e2a5e24add1558d

SHA512
7073785a493e517eb7744dd693a5c835bf4cf8d68631acad1d6e34a004f4e4350b571d88bf551b13bb78f49a91dfc11d9b6137960e771aad9577ce31b941fd02

Download Submit
C:\Windows\System\RBvjxyW.exe

Filesize
2.1MB

MD5
47c8305ff9bf51335ae3a4fbd98fd216

SHA1
ef7b397563adc23a2d2a6019bb5e6663fab018df

SHA256
29b0fb92d88160ee7d7e1e7efca62cf76738558754ef9ea97e6a5c456a5d248e

SHA512
cb92ef077e6e5af8359e954dcc20d96c28c995a4a830d366f7b1511ad9958fe037feb7d9219b1d7619ee8d7653d42c2f5da4eaf092829a7ecaac8a7976edbede

Download Submit
C:\Windows\System\SIgtAPM.exe

Filesize
2.1MB

MD5
53e787910535fd604224c4bdce523198

SHA1
e1ab40d8bb447f8fd6d613027ca584ac0d87fe35

SHA256
f15668885a96e7f9885ff38ad221e3f6f2d054c820dffd8a0f9003246a898d72

SHA512
12c51fb29eb6318b6212baa6e89c03def19b1f4bea2ee23a7f5126f69b90ee8eca826ae7320435c00acf89e9a32b435f28bd7eab9f619ac9f67b0a35486a322e

Download Submit
C:\Windows\System\SerjMdl.exe

Filesize
2.1MB

MD5
4ac3c41080495a6fa466a7de8f3465c2

SHA1
b8fab04c11c9fba94be768e7d3f9dcd6532cd720

SHA256
ce4235213ba0c65e6e1702c6f6fe551ba7c1acf4a27b2af5440b982518cdbdd0

SHA512
64e4aa90598d8e0cd29e3f11f45853461c84bbbf1cf919d2da6641589e819e32f0ff64e3b4e8298a4e390f4a760dad9af05f2bd1e68d076bc8f84e18735c2f8f

Download Submit
C:\Windows\System\USqgQlL.exe

Filesize
2.1MB

MD5
722d14f746e555b8b51f7b1fa6db534d

SHA1
456132144fbc541933b08ba33cbc62ca6496c6b4

SHA256
2a54c629bf4a49c90b4cb436f5e86678720424ef3833d91dc1e359d031923dd7

SHA512
1569875b0dc33ace431247dddfc4ce81d70fcb88351d9fd24fb87e559ecc693be00a2629b0241e93e796356bbb931f65275e6ef1ec463e9c7a71ca073697eaad

Download Submit
C:\Windows\System\VPWSYfO.exe

Filesize
2.1MB

MD5
9ba3df0998881f96d3f0314be77e7da7

SHA1
7ae48397c486ed8417ef11f80a09a2af4120280e

SHA256
3d246f0d4d94fc9f3b3e9ecfb70a671b8b85870b0d89f9a9f522177a370213e2

SHA512
66e548a7b54315a0c252df1b740f3b38a2539d3ea9871d487f6d768ea0edb7d2eff2bb4fb322aa74d13d1d078465ae412280f715aa76087595d5c0c2d11837ef

Download Submit
C:\Windows\System\WGbxqmL.exe

Filesize
2.1MB

MD5
d11545dcc666a31eba1ee08c079346df

SHA1
2a0f32a36a83302924d2f13800f033346606bceb

SHA256
a945f2f84e88cdab1195642f8b35e4235413af73c77a2198adbd1d98636f6d2b

SHA512
1938fb9976641b83c6d269e2aa902832d2ed92f49e2c050d8b7fcac6329a98df6ca75378fd9cc40ba83679808ab826ac64276ba808d820c703cb80d588654452

Download Submit
C:\Windows\System\WjwWACf.exe

Filesize
2.1MB

MD5
f4a12c19b8dfb46fecf1443b2b61b010

SHA1
50dc039769401b007108b58ffed65348aaa0e1b1

SHA256
95f4e4f73eafbdf44ebc5bedb26477a10f0506f0a5640149ea1158bd74a6d739

SHA512
11cc968333245c0d65e4697f20fb220df7558c969e5066ed58ed4ad5ef2612eb1c3e63103d66a6f80950fd6f24c5b4622d17f478aa062919c431601f679dba9e

Download Submit
C:\Windows\System\XHUvDzS.exe

Filesize
2.1MB

MD5
a2fae4030cb8612acededaf2e2063a23

SHA1
49d3b6c3da1b378b80f7aaccf0ad228a118ddbf2

SHA256
9c6844e10ca0379bb2e50649a068414f6f92774d1112149c2ba7bcf6df087d1d

SHA512
31d2760e85d4d2928e9d459f94cc8029cd246f754897a30b85d1787929bcde3696fa03927b9aa6cd2dd8eba44285c6a3db6ceed6949caff28a0d9f0dd74e3b52

Download Submit
C:\Windows\System\XyHjarI.exe

Filesize
2.1MB

MD5
f8e87bb76ec646a9343b2a53e6fe69ee

SHA1
c429b86d082aaa326048c8e9ca3f8ad8d6124eb2

SHA256
90f514651465131a675284f224045a32d5c09eb2a8e060b6fdd0884efd379db2

SHA512
a99c725dca1e296ecf3d89f3a43a21a234be3e52f038a6faba8253348814d78d268c40ee56033af4d097760c1bf4a7c90df03696cf05375161fdefcdfcabcd0d

Download Submit
C:\Windows\System\ZBmxYko.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\System\cgzcSKj.exe

Filesize
2.1MB

MD5
37312ad7eaba8f02d496950b4e026ac0

SHA1
31931b24e2a2dbe58de17bb7ee9a3033e5b65740

SHA256
a197200c7373874f1f9b4a6bfd6907967be312b8fcb0dd2e4aad90a71d249473

SHA512
bd91c5a161c4e3920b80a9e0a460c92689a7d5ba2b4f60937bd25013c0f8676623cd4ce7d27b334b65c35b08e45470c1f2edb2996c170a906ba19bb62713580b

Download Submit
C:\Windows\System\fOWFRSB.exe

Filesize
2.1MB

MD5
b1b3340af046eafdd59ddae706a02827

SHA1
9bfcd1f5c75fc652a3bcf3965a0730514d9c3889

SHA256
f7bc3a8a3db676a7838e56f26bbd431923122a270c71d47a6eb0f56b8c2da405

SHA512
f5e2b09e59c7c99e522e9812e09f6bb480ca0de8b66c67331d5c63359688fe1cd3ebacf69e67947c7e49c377cd4ce0e0f2a401c14c7be979ced54c1c72021e3e

Download Submit
C:\Windows\System\gCuhWEA.exe

Filesize
2.1MB

MD5
ac581365e9b55b0aa30ab2548ec3446d

SHA1
b35b7be8ab69bb28a41a928c6cb7b11ed1a6db41

SHA256
cb9ca7a504136fb2276dc291bd60cf2c10612263a22f44781593f4f2a102dc50

SHA512
7420f5ad5be1b5b16fc312e663b0d99d07fb06f8f0017250b555837f231f92e5f74fe0458a258ee7b6216555f93b2e1544e8d7f91f6b344fa9ca5e52cbff31fe

Download Submit
C:\Windows\System\gzGbPea.exe

Filesize
2.1MB

MD5
b49c414a3ecbdf3f49a109c46adfd393

SHA1
03b11344a08d380731ed59c55b938003f4cac1cd

SHA256
400d0e11ba400829e19086371bf0bd64b618a2e702194b8e039d6e1a906ca5e7

SHA512
d0e3560e0a39fcbba1f26bc4725de796862af66b9e1de54fd18fa92c3b37f51a40d8c2a870f64bab3363b7d6286e3671593c478f3c62031da4b68ad39242cc49

Download Submit
C:\Windows\System\hKHuyzZ.exe

Filesize
2.1MB

MD5
3754c100b8e6e33282d21c3a21271ceb

SHA1
2ad050f0523e20034c118016fef15906d8f3b534

SHA256
9151f12fbe2da70d01809b62ba55545d6e3a45dd67882561202d4ff437c8c01e

SHA512
d8173bbc50853a3855af2a1831ef018c6253b28e326b66f4bbf085469454339766b58dc75c1afb4739ea23d1d56ea7ca57160a0b453e59345c82e7f869c4308a

Download Submit
C:\Windows\System\hShAWVv.exe

Filesize
2.1MB

MD5
9627209e7aef278624f00c6b1978f6db

SHA1
1de68ad373d080402296c42eb800494aeac69498

SHA256
c45f2597c17ef4ded10a8babbfe8626288ffe87a21b953249ff37015d6d66f70

SHA512
109e82ddd66d1057d8692c775169c306284b708fe934fc24a412544cb5fb3328ad54afd9cba69d182ec226dd0975518a5e7458ab94af0b844657633500211a46

Download Submit
C:\Windows\System\hskeyTw.exe

Filesize
2.1MB

MD5
2855497609e5104e59fedae540f2c2a8

SHA1
d199a903e4e8c45014d1dc6fabe3ca8a492feb16

SHA256
8cd7d06eaf51d13ba0a1b01097e88067358f0f1a8540ae01180d2a0f8045f881

SHA512
2b2df9944387d367349e5130594dccc3a24b12bd27c23253b4536bd402e12b0d4207e8e868e1e420153c7bd43fa90af71b05169d95b9a39c890647b4491f1c54

Download Submit
C:\Windows\System\jfMiiSQ.exe

Filesize
2.1MB

MD5
4715d80f4823cdab04fb8a694158b373

SHA1
b6b4194e362db56eb388efd624cdb8dde1f35166

SHA256
b0620e4e30ec702d7a2e55e0292e8114695c3d1ee77847624e5f4f7c650eb219

SHA512
54d25ecca4d63c14da4e84bcc61d7922429159db13634e90bb095c0c4d78122950993ff0eb9abad623a500f8d920fde5b9437d10ce9db78ecaac068b52064dea

Download Submit
C:\Windows\System\kxNNacK.exe

Filesize
2.1MB

MD5
fe57320a6cee78679179560c3ec20464

SHA1
32198966d8d2ed2e50eae3c52b04e365c02261f5

SHA256
d8c6e5b3f50f65813628a080ffa5c412171a07f4879d665a6f340b85a3296caf

SHA512
69637db5f17f444648bdbdac15f915c630aeb3d19dcc7692abf057e725de20c55589a90229265802a4f843b6e654835041f9158fd80ef2bdd406890ac5cbf397

Download Submit
C:\Windows\System\mdGTwKZ.exe

Filesize
2.1MB

MD5
bc324efa36656966c33c04f4dc58e94a

SHA1
43eb5a6b734ceec83083924f581d901d3437b7a2

SHA256
d06dcc4b0fdebd57275020f603e333637da202a9e257f2555985dda7f0e695e7

SHA512
8a98d77ebcb3d6ba9b20a220da22c4a98e17b11cc4fd393979f42f9ac201a5c90e357bc1a462eecb43db0a89fc5947cd4cbcc86643509d52d0fd1fbc8034f705

Download Submit
C:\Windows\System\mfYmBNe.exe

Filesize
2.1MB

MD5
bb6c20c3cc63053692fa277ba1823551

SHA1
909c0d5233d958af007d8a0b4b71403cc6e4165b

SHA256
ba20c86cd08587cbc07db8b32ea4407e0e6a9284c21273d0e4e09adc7d1be199

SHA512
15971cc81cb5fc6d1698f6fa1e05d10bc7c7babbacad9a1777a5351f7eef47a1d27eadabfae8d55d8d8f4e8d8586c37d5191f31a4e05ac1820f83af3a25320bf

Download Submit
C:\Windows\System\nLLkovN.exe

Filesize
2.1MB

MD5
e7dd7626c92046c57cd602a8afe56ab1

SHA1
5e0778a79786cc5e586aced5fee332dc16a8f753

SHA256
d452f88ce400bedf0bcb23112ceb33756880ab91227f79e7f9619d056afe802d

SHA512
6d4a7f017313b7b03f77be160d9243cb34c21fb8e528699c848e58a7c83901b02a82590ecd5444919d9dfe13dbdb5c949b4532ef2a1aaa87147d847431a5881d

Download Submit
C:\Windows\System\oYNsrqO.exe

Filesize
2.1MB

MD5
615a8fc4814b30bb188ed71011c877da

SHA1
6a71966de5e0515bfdf6b1b3efdfe7c0a740b5ed

SHA256
18044ea2b8aabdcb51e229100c046ccff39dafbbdf03a324d8926978276cc9ac

SHA512
cdd676b291e4b0c852406358c5d40d4103b10470c16ce69f44ddeec33f42a5f46ed7bba9e24098867694f5e6bba2f630c0a75ff1b3ae4df359bbb28d5437566e

Download Submit
C:\Windows\System\rzbeVDO.exe

Filesize
2.1MB

MD5
fd1c805271619973320b0ea8287dd9f9

SHA1
9b0bccb95ce76e24b9e7936661cb751a34dc1fb9

SHA256
48174ec8cb6e6c7e1d7ead47e7da41ca1d22a79fb3ad14b7cdfd68cbf9d4af62

SHA512
975d1877e91c35fb188d49e5783635cca5f0d73f7ee4e525f073d05ac414b75716831c0e0341d802d94096fb02fb0d21a04a6e11ffc88a501471b926fa2c87f0

Download Submit
C:\Windows\System\tIUOZuj.exe

Filesize
2.1MB

MD5
8513c831285a380374d0102e0e44876a

SHA1
d6d107e39369e1ee480046b51362f60a54178bcb

SHA256
b80653e58e73b10955208e5d43df0143c71adbcd61428eb68322eb26e0b21686

SHA512
4d25817915b5ea7ba26a489df5457bfe9af138325edab1a6e4c8036b2ee16b4e9defdd8113ed5cd9ed81f27169da16880c78341826f3be8a393136584437cccd

Download Submit
C:\Windows\System\txZrTwE.exe

Filesize
2.1MB

MD5
0f1fb8d04349c137fba8a6bb141d7967

SHA1
57a89b4b5587bbcb0e2ae0532a45daf0bd0b935a

SHA256
2cd6e66e4584a3995716fe763b1fecb3dfa2d01d2ad975a864e4607f5648612b

SHA512
17dd70a2ec8a70462321d5f57fb465893708aa14dd2e50a8fd05d38b79d4d74e8960f730960e2a282861b9f3af594d075e6cf926114e7e9372842a346e363cc7

Download Submit
C:\Windows\System\vNsOaDC.exe

Filesize
2.1MB

MD5
6b1ffb4c90443115fedaa86ba8351a54

SHA1
bf6174dad6608b6803dbc262092fe5b37ffb2b49

SHA256
2cc079378bccbeb3f912ec844bee650b43781fa6c02ad2c56c8eddf2d5f22574

SHA512
704bc02877540b087cd03ec79df40554632c15f8c9084e0fc8a9a0f01da934cbc39e5828e06e583cc020bf8e4eca62b8f3d02a81cc7043bae05d0fe2fa81bcd3

Download Submit
C:\Windows\System\veNSNZr.exe

Filesize
2.1MB

MD5
d65c34472c1fc0d65d75aa0cafe0bbb3

SHA1
3886058690f938b73151beda3d894b372d416bd7

SHA256
5207a546d814979ba2acd3b3ff1d468b2530dc2fde98e8b1799463c60d0c2c98

SHA512
46b49365cfaa9b1de5b60d456998dff2aa94ba1eb40ae7fbbaffd00266587a50eff645ebcdef30a4f4e234706f689fd269753cbe58b86bfa6c3cc72590324976

Download Submit
C:\Windows\System\vtKGdvp.exe

Filesize
2.1MB

MD5
1a07a86be1ef7ed2c20e26af84a71a0b

SHA1
e1ad9fc2c9f109e08f013e16b439f54465c3cbec

SHA256
1b0f2c8cd9dd13cecc8f7222bbc1fb1ad136ecb03670f9bab6796d6001c5fc86

SHA512
9d5f424176572d49f1099357c5c813beec2bb19b19fccfcb739476ba6724a72195353cb2350bf8994e5259a0fb26050835f59f01917da9f7d6d41a66eef75c49

Download Submit
C:\Windows\System\xciwviM.exe

Filesize
2.1MB

MD5
92fd649f2268086dac914059e3cf24e1

SHA1
3fc855c506d62e08f6bc9edf0ad4f1d7e157c72c

SHA256
d236408828d094045de73cb031351c6a20c385f81686ac8f5f9514fb5ab6139c

SHA512
e998786b219e7fe8f925ffcdffc0ed8ad8452a7cf09d1ed2395c51a77610655e82c5b36f0345cf401cbdc66ad13112494e2eb08cc167d5504dcc27822fdb2518

Download Submit
memory/368-3059-0x00007FF60E370000-0x00007FF60E762000-memory.dmp

Filesize
3.9MB

Download
memory/368-486-0x00007FF60E370000-0x00007FF60E762000-memory.dmp

Filesize
3.9MB

Download
memory/1184-371-0x00007FF6440C0000-0x00007FF6444B2000-memory.dmp

Filesize
3.9MB

Download
memory/1184-3065-0x00007FF6440C0000-0x00007FF6444B2000-memory.dmp

Filesize
3.9MB

Download
memory/1328-487-0x00007FF7D3F10000-0x00007FF7D4302000-memory.dmp

Filesize
3.9MB

Download
memory/1328-3084-0x00007FF7D3F10000-0x00007FF7D4302000-memory.dmp

Filesize
3.9MB

Download
memory/1332-489-0x00007FF6CEC40000-0x00007FF6CF032000-memory.dmp

Filesize
3.9MB

Download
memory/1332-3069-0x00007FF6CEC40000-0x00007FF6CF032000-memory.dmp

Filesize
3.9MB

Download
memory/1452-491-0x00007FF794290000-0x00007FF794682000-memory.dmp

Filesize
3.9MB

Download
memory/1452-3087-0x00007FF794290000-0x00007FF794682000-memory.dmp

Filesize
3.9MB

Download
memory/1472-0-0x00007FF74A6F0000-0x00007FF74AAE2000-memory.dmp

Filesize
3.9MB

Download
memory/1472-1-0x000001C65D3D0000-0x000001C65D3E0000-memory.dmp

Filesize
64KB

Download
memory/1636-215-0x000001AE26270000-0x000001AE26280000-memory.dmp

Filesize
64KB

Download
memory/1636-106-0x00007FF825A10000-0x00007FF8264D1000-memory.dmp

Filesize
10.8MB

Download
memory/1636-349-0x000001AE26220000-0x000001AE26242000-memory.dmp

Filesize
136KB

Download
memory/1636-216-0x000001AE26270000-0x000001AE26280000-memory.dmp

Filesize
64KB

Download
memory/2608-3049-0x00007FF6A0B10000-0x00007FF6A0F02000-memory.dmp

Filesize
3.9MB

Download
memory/2608-231-0x00007FF6A0B10000-0x00007FF6A0F02000-memory.dmp

Filesize
3.9MB

Download
memory/2724-347-0x00007FF7774F0000-0x00007FF7778E2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-3064-0x00007FF7774F0000-0x00007FF7778E2000-memory.dmp

Filesize
3.9MB

Download
memory/3000-484-0x00007FF73DF10000-0x00007FF73E302000-memory.dmp

Filesize
3.9MB

Download
memory/3000-3053-0x00007FF73DF10000-0x00007FF73E302000-memory.dmp

Filesize
3.9MB

Download
memory/3028-174-0x00007FF7E9560000-0x00007FF7E9952000-memory.dmp

Filesize
3.9MB

Download
memory/3028-3045-0x00007FF7E9560000-0x00007FF7E9952000-memory.dmp

Filesize
3.9MB

Download
memory/3124-3081-0x00007FF6FB650000-0x00007FF6FBA42000-memory.dmp

Filesize
3.9MB

Download
memory/3124-296-0x00007FF6FB650000-0x00007FF6FBA42000-memory.dmp

Filesize
3.9MB

Download
memory/3184-222-0x00007FF6A1A90000-0x00007FF6A1E82000-memory.dmp

Filesize
3.9MB

Download
memory/3184-3055-0x00007FF6A1A90000-0x00007FF6A1E82000-memory.dmp

Filesize
3.9MB

Download
memory/3400-3068-0x00007FF68E1D0000-0x00007FF68E5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3400-493-0x00007FF68E1D0000-0x00007FF68E5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3744-492-0x00007FF7D7DB0000-0x00007FF7D81A2000-memory.dmp

Filesize
3.9MB

Download
memory/3744-3043-0x00007FF7D7DB0000-0x00007FF7D81A2000-memory.dmp

Filesize
3.9MB

Download
memory/4020-3057-0x00007FF6DD550000-0x00007FF6DD942000-memory.dmp

Filesize
3.9MB

Download
memory/4020-255-0x00007FF6DD550000-0x00007FF6DD942000-memory.dmp

Filesize
3.9MB

Download
memory/4256-3041-0x00007FF69B890000-0x00007FF69BC82000-memory.dmp

Filesize
3.9MB

Download
memory/4256-22-0x00007FF69B890000-0x00007FF69BC82000-memory.dmp

Filesize
3.9MB

Download
memory/4260-171-0x00007FF63E6F0000-0x00007FF63EAE2000-memory.dmp

Filesize
3.9MB

Download
memory/4260-3052-0x00007FF63E6F0000-0x00007FF63EAE2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-3047-0x00007FF6B49F0000-0x00007FF6B4DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-131-0x00007FF6B49F0000-0x00007FF6B4DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4752-3073-0x00007FF6586B0000-0x00007FF658AA2000-memory.dmp

Filesize
3.9MB

Download
memory/4752-409-0x00007FF6586B0000-0x00007FF658AA2000-memory.dmp

Filesize
3.9MB

Download
memory/4760-3083-0x00007FF726890000-0x00007FF726C82000-memory.dmp

Filesize
3.9MB

Download
memory/4760-488-0x00007FF726890000-0x00007FF726C82000-memory.dmp

Filesize
3.9MB

Download
memory/4892-490-0x00007FF7355F0000-0x00007FF7359E2000-memory.dmp

Filesize
3.9MB

Download
memory/4892-3078-0x00007FF7355F0000-0x00007FF7359E2000-memory.dmp

Filesize
3.9MB

Download
memory/4984-344-0x00007FF781410000-0x00007FF781802000-memory.dmp

Filesize
3.9MB

Download
memory/4984-3072-0x00007FF781410000-0x00007FF781802000-memory.dmp

Filesize
3.9MB

Download