xmrig | dfc266cb297cebe4dd3928cdf083d8165f0b2634955a57d56ee85fd842415a93

Analysis

max time kernel
68s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
Size

1.9MB
MD5

06d53b3ef3a61503294488abf6fc8c78
SHA1

78e63d38417e503d86af2532edca3b169306d542
SHA256

dfc266cb297cebe4dd3928cdf083d8165f0b2634955a57d56ee85fd842415a93
SHA512

b52511112109af14ad85e41f52649deab4226bb1070f420fe6a7dadb3dd079cc805268ccde2d101f25732acd7cd6cd7da462ad421e2e3ca13181fe5c8de44ea2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlx/p:NABE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/memory/5116-115-0x00007FF696A60000-0x00007FF696E52000-memory.dmp	xmrig
behavioral2/memory/2192-201-0x00007FF717C90000-0x00007FF718082000-memory.dmp	xmrig
behavioral2/memory/4260-220-0x00007FF79E5E0000-0x00007FF79E9D2000-memory.dmp	xmrig
behavioral2/memory/4180-221-0x00007FF602140000-0x00007FF602532000-memory.dmp	xmrig
behavioral2/memory/4016-223-0x00007FF68BE30000-0x00007FF68C222000-memory.dmp	xmrig
behavioral2/memory/3240-224-0x00007FF701EB0000-0x00007FF7022A2000-memory.dmp	xmrig
behavioral2/memory/1576-227-0x00007FF758170000-0x00007FF758562000-memory.dmp	xmrig
behavioral2/memory/952-228-0x00007FF764280000-0x00007FF764672000-memory.dmp	xmrig
behavioral2/memory/1288-222-0x00007FF6F4A10000-0x00007FF6F4E02000-memory.dmp	xmrig
behavioral2/memory/2472-219-0x00007FF6FC330000-0x00007FF6FC722000-memory.dmp	xmrig
behavioral2/memory/3756-218-0x00007FF6FCF10000-0x00007FF6FD302000-memory.dmp	xmrig
behavioral2/memory/3364-149-0x00007FF7DFD60000-0x00007FF7E0152000-memory.dmp	xmrig
behavioral2/memory/3336-379-0x00007FF625A80000-0x00007FF625E72000-memory.dmp	xmrig
behavioral2/memory/4616-392-0x00007FF685470000-0x00007FF685862000-memory.dmp	xmrig
behavioral2/memory/3716-552-0x00007FF7A15D0000-0x00007FF7A19C2000-memory.dmp	xmrig
behavioral2/memory/3068-3346-0x00007FF67C630000-0x00007FF67CA22000-memory.dmp	xmrig
behavioral2/memory/784-3348-0x00007FF671980000-0x00007FF671D72000-memory.dmp	xmrig
behavioral2/memory/2192-3351-0x00007FF717C90000-0x00007FF718082000-memory.dmp	xmrig
behavioral2/memory/3336-3352-0x00007FF625A80000-0x00007FF625E72000-memory.dmp	xmrig
behavioral2/memory/2540-3355-0x00007FF690A60000-0x00007FF690E52000-memory.dmp	xmrig
behavioral2/memory/2472-3360-0x00007FF6FC330000-0x00007FF6FC722000-memory.dmp	xmrig
behavioral2/memory/5116-3368-0x00007FF696A60000-0x00007FF696E52000-memory.dmp	xmrig
behavioral2/memory/1288-3372-0x00007FF6F4A10000-0x00007FF6F4E02000-memory.dmp	xmrig
behavioral2/memory/4616-3374-0x00007FF685470000-0x00007FF685862000-memory.dmp	xmrig
behavioral2/memory/3716-3371-0x00007FF7A15D0000-0x00007FF7A19C2000-memory.dmp	xmrig
behavioral2/memory/4180-3367-0x00007FF602140000-0x00007FF602532000-memory.dmp	xmrig
behavioral2/memory/3756-3365-0x00007FF6FCF10000-0x00007FF6FD302000-memory.dmp	xmrig
behavioral2/memory/4260-3363-0x00007FF79E5E0000-0x00007FF79E9D2000-memory.dmp	xmrig
behavioral2/memory/3364-3358-0x00007FF7DFD60000-0x00007FF7E0152000-memory.dmp	xmrig
behavioral2/memory/2872-3356-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp	xmrig
behavioral2/memory/3240-3386-0x00007FF701EB0000-0x00007FF7022A2000-memory.dmp	xmrig
behavioral2/memory/952-3390-0x00007FF764280000-0x00007FF764672000-memory.dmp	xmrig
behavioral2/memory/4016-3384-0x00007FF68BE30000-0x00007FF68C222000-memory.dmp	xmrig
behavioral2/memory/1576-3381-0x00007FF758170000-0x00007FF758562000-memory.dmp	xmrig
behavioral2/memory/4904-3517-0x00007FF68A520000-0x00007FF68A912000-memory.dmp	xmrig
behavioral2/memory/4940-3520-0x00007FF79B410000-0x00007FF79B802000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3068	DKfmzgi.exe
784	XtHBRDL.exe
3336	JfVXFuP.exe
2540	xuRGZXx.exe
2872	DUwGHpS.exe
5116	imsIJQt.exe
3364	gIBnUGo.exe
2192	JnhIczD.exe
3756	mMrabPv.exe
4616	xKlWfqZ.exe
2472	TcngfGU.exe
4260	eXunyOx.exe
4180	kfGKkrL.exe
3716	tYyWliP.exe
1288	GMDsGmN.exe
4016	FqCrlap.exe
3240	BXubGlQ.exe
4940	lMarNTM.exe
4904	ajWRnQl.exe
1576	wJZGFBB.exe
952	XTwoIol.exe
1460	zaydJcD.exe
1868	HEQooNk.exe
3808	yXnXqUD.exe
364	jGkuwpJ.exe
4688	xNnPiza.exe
1292	GKaosbD.exe
448	VxmgbLP.exe
1084	RoHQjRO.exe
3312	ekQqJpg.exe
1904	EWxRuWi.exe
3056	eupWpxT.exe
60	FaikQst.exe
1968	gnhkdso.exe
1984	GzZthab.exe
4696	RrPlWFx.exe
3696	lObkifz.exe
3944	iSXBRab.exe
3608	iUNQTSH.exe
4932	MGruTha.exe
4564	BXUPbJv.exe
2732	UgGWCOt.exe
1236	VLJoBai.exe
4388	WwdycUu.exe
3272	cmrqfhT.exe
4296	QDsSGSD.exe
2352	BiMbVKr.exe
3856	ofXSmGC.exe
1588	xBSsFnw.exe
808	vPxYdSM.exe
3520	nVCKsqf.exe
5012	ndJfQnV.exe
3768	eSJDrhd.exe
4528	enMasMI.exe
2956	WssFDYg.exe
3428	VyEDNBv.exe
112	XLhWKXL.exe
4332	dosiVGG.exe
3220	TjuJkfh.exe
4468	qLOWGXU.exe
1836	FsDRVjw.exe
4956	VERsRni.exe
2220	YQztAok.exe
2320	LTHdlwV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2848-0-0x00007FF7F84E0000-0x00007FF7F88D2000-memory.dmp	upx
behavioral2/files/0x000b000000023b96-5.dat	upx
behavioral2/memory/2540-46-0x00007FF690A60000-0x00007FF690E52000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-102.dat	upx
behavioral2/files/0x0031000000023bb5-134.dat	upx
behavioral2/files/0x000a000000023bb9-138.dat	upx
behavioral2/files/0x000a000000023bb8-137.dat	upx
behavioral2/files/0x0031000000023bb7-136.dat	upx
behavioral2/files/0x000a000000023baf-162.dat	upx
behavioral2/files/0x000a000000023bae-161.dat	upx
behavioral2/files/0x000a000000023bb4-133.dat	upx
behavioral2/files/0x000a000000023ba9-131.dat	upx
behavioral2/files/0x000a000000023bb3-128.dat	upx
behavioral2/files/0x000a000000023bb0-124.dat	upx
behavioral2/files/0x000a000000023ba2-118.dat	upx
behavioral2/memory/5116-115-0x00007FF696A60000-0x00007FF696E52000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-112.dat	upx
behavioral2/files/0x000a000000023bac-111.dat	upx
behavioral2/files/0x000a000000023bab-110.dat	upx
behavioral2/files/0x000a000000023baa-109.dat	upx
behavioral2/files/0x0031000000023bb6-135.dat	upx
behavioral2/files/0x000a000000023ba8-99.dat	upx
behavioral2/files/0x000a000000023ba4-91.dat	upx
behavioral2/files/0x000a000000023ba7-88.dat	upx
behavioral2/files/0x000a000000023ba1-85.dat	upx
behavioral2/files/0x000a000000023b9b-80.dat	upx
behavioral2/memory/2872-77-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-70.dat	upx
behavioral2/files/0x000a000000023b9e-63.dat	upx
behavioral2/files/0x000a000000023ba3-90.dat	upx
behavioral2/files/0x000a000000023b9f-64.dat	upx
behavioral2/files/0x000a000000023b9d-62.dat	upx
behavioral2/files/0x000a000000023b9c-44.dat	upx
behavioral2/files/0x000a000000023bbc-192.dat	upx
behavioral2/memory/2192-201-0x00007FF717C90000-0x00007FF718082000-memory.dmp	upx
behavioral2/memory/4260-220-0x00007FF79E5E0000-0x00007FF79E9D2000-memory.dmp	upx
behavioral2/memory/4180-221-0x00007FF602140000-0x00007FF602532000-memory.dmp	upx
behavioral2/memory/4016-223-0x00007FF68BE30000-0x00007FF68C222000-memory.dmp	upx
behavioral2/memory/3240-224-0x00007FF701EB0000-0x00007FF7022A2000-memory.dmp	upx
behavioral2/memory/4904-226-0x00007FF68A520000-0x00007FF68A912000-memory.dmp	upx
behavioral2/memory/1576-227-0x00007FF758170000-0x00007FF758562000-memory.dmp	upx
behavioral2/memory/952-228-0x00007FF764280000-0x00007FF764672000-memory.dmp	upx
behavioral2/memory/4940-225-0x00007FF79B410000-0x00007FF79B802000-memory.dmp	upx
behavioral2/memory/1288-222-0x00007FF6F4A10000-0x00007FF6F4E02000-memory.dmp	upx
behavioral2/memory/2472-219-0x00007FF6FC330000-0x00007FF6FC722000-memory.dmp	upx
behavioral2/memory/3756-218-0x00007FF6FCF10000-0x00007FF6FD302000-memory.dmp	upx
behavioral2/files/0x000a000000023bc0-196.dat	upx
behavioral2/files/0x000a000000023bbb-189.dat	upx
behavioral2/files/0x000a000000023bbf-195.dat	upx
behavioral2/files/0x000a000000023bbe-194.dat	upx
behavioral2/files/0x000a000000023bbd-193.dat	upx
behavioral2/files/0x000a000000023bba-154.dat	upx
behavioral2/files/0x000a000000023bb2-153.dat	upx
behavioral2/files/0x000a000000023bb1-152.dat	upx
behavioral2/memory/3364-149-0x00007FF7DFD60000-0x00007FF7E0152000-memory.dmp	upx
behavioral2/memory/784-39-0x00007FF671980000-0x00007FF671D72000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-33.dat	upx
behavioral2/files/0x000a000000023b9a-26.dat	upx
behavioral2/memory/3068-23-0x00007FF67C630000-0x00007FF67CA22000-memory.dmp	upx
behavioral2/memory/3336-379-0x00007FF625A80000-0x00007FF625E72000-memory.dmp	upx
behavioral2/memory/4616-392-0x00007FF685470000-0x00007FF685862000-memory.dmp	upx
behavioral2/memory/3716-552-0x00007FF7A15D0000-0x00007FF7A19C2000-memory.dmp	upx
behavioral2/memory/3068-3346-0x00007FF67C630000-0x00007FF67CA22000-memory.dmp	upx
behavioral2/memory/784-3348-0x00007FF671980000-0x00007FF671D72000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kyMLXJP.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\xmyrdgl.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\GeQtxxO.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\kswJgkL.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\vhedSqp.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\XSvkZrA.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\qwbCYHX.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\TnsYwaB.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\ARpSizu.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\SLIDQov.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\FIgXOGo.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\wDLAYdo.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\XLhWKXL.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\GENUBjN.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\nZCjRDk.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\CYFYeFs.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\yuXICRL.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\LzeKCua.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\nYwAbfJ.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\JxqopJw.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\nvHYDDZ.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\WbKQVTK.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\rukfQzZ.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\vKgLgJs.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\WJliaiB.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\DgWAOXb.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\ekbRjpd.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\VhGoFND.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\RRnahpt.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\OTeYgDX.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\aWgeewM.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\aJlYGcK.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\SzjpMac.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\EisLFeo.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\EWxHedl.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\mnLBqHZ.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\nJkUMhy.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\fEppuTd.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\vhAfjfp.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\VmfEajV.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\QiqTYZY.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\PVyhCfK.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\MMugNpM.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\yQFnlNM.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\YbuKBxb.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\OamvptE.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\CmeqOtr.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\EIjKrQv.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\gfMveLO.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\SDeoVgY.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\fCjLnvC.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\oOyITBN.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\tZnLAXU.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\KWrlIXZ.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\OzvsesR.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\RnRWaws.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\NGJYchM.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\QQRLKWr.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\DZqzPRF.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\TARVHoH.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\cYEBaej.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\BoiPBrv.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\uVOlpUO.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
File created	C:\Windows\System\UPlsNic.exe	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
428	powershell.exe
428	powershell.exe
428	powershell.exe
428	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	428	powershell.exe
Token: SeLockMemoryPrivilege	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 428	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	84
PID 2848 wrote to memory of 428	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	84
PID 2848 wrote to memory of 3068	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	85
PID 2848 wrote to memory of 3068	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	85
PID 2848 wrote to memory of 784	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	86
PID 2848 wrote to memory of 784	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	86
PID 2848 wrote to memory of 3364	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	87
PID 2848 wrote to memory of 3364	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	87
PID 2848 wrote to memory of 3336	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	88
PID 2848 wrote to memory of 3336	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	88
PID 2848 wrote to memory of 2540	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	89
PID 2848 wrote to memory of 2540	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	89
PID 2848 wrote to memory of 2872	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	90
PID 2848 wrote to memory of 2872	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	90
PID 2848 wrote to memory of 5116	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	91
PID 2848 wrote to memory of 5116	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	91
PID 2848 wrote to memory of 2192	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	92
PID 2848 wrote to memory of 2192	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	92
PID 2848 wrote to memory of 3756	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	93
PID 2848 wrote to memory of 3756	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	93
PID 2848 wrote to memory of 4616	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	94
PID 2848 wrote to memory of 4616	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	94
PID 2848 wrote to memory of 2472	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	95
PID 2848 wrote to memory of 2472	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	95
PID 2848 wrote to memory of 4260	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	96
PID 2848 wrote to memory of 4260	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	96
PID 2848 wrote to memory of 4016	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	97
PID 2848 wrote to memory of 4016	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	97
PID 2848 wrote to memory of 4180	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	98
PID 2848 wrote to memory of 4180	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	98
PID 2848 wrote to memory of 3716	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	99
PID 2848 wrote to memory of 3716	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	99
PID 2848 wrote to memory of 1288	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	100
PID 2848 wrote to memory of 1288	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	100
PID 2848 wrote to memory of 364	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	101
PID 2848 wrote to memory of 364	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	101
PID 2848 wrote to memory of 3240	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	102
PID 2848 wrote to memory of 3240	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	102
PID 2848 wrote to memory of 4940	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	103
PID 2848 wrote to memory of 4940	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	103
PID 2848 wrote to memory of 4904	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	104
PID 2848 wrote to memory of 4904	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	104
PID 2848 wrote to memory of 1576	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	105
PID 2848 wrote to memory of 1576	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	105
PID 2848 wrote to memory of 952	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	106
PID 2848 wrote to memory of 952	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	106
PID 2848 wrote to memory of 1460	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	107
PID 2848 wrote to memory of 1460	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	107
PID 2848 wrote to memory of 1868	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	108
PID 2848 wrote to memory of 1868	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	108
PID 2848 wrote to memory of 3056	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	109
PID 2848 wrote to memory of 3056	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	109
PID 2848 wrote to memory of 60	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	110
PID 2848 wrote to memory of 60	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	110
PID 2848 wrote to memory of 3808	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	111
PID 2848 wrote to memory of 3808	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	111
PID 2848 wrote to memory of 4688	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	112
PID 2848 wrote to memory of 4688	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	112
PID 2848 wrote to memory of 1292	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	113
PID 2848 wrote to memory of 1292	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	113
PID 2848 wrote to memory of 448	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	114
PID 2848 wrote to memory of 448	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	114
PID 2848 wrote to memory of 1084	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	115
PID 2848 wrote to memory of 1084	2848	06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06d53b3ef3a61503294488abf6fc8c78_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:428
- C:\Windows\System\DKfmzgi.exe
  C:\Windows\System\DKfmzgi.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\XtHBRDL.exe
  C:\Windows\System\XtHBRDL.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\gIBnUGo.exe
  C:\Windows\System\gIBnUGo.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\JfVXFuP.exe
  C:\Windows\System\JfVXFuP.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\xuRGZXx.exe
  C:\Windows\System\xuRGZXx.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\DUwGHpS.exe
  C:\Windows\System\DUwGHpS.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\imsIJQt.exe
  C:\Windows\System\imsIJQt.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\JnhIczD.exe
  C:\Windows\System\JnhIczD.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\mMrabPv.exe
  C:\Windows\System\mMrabPv.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\xKlWfqZ.exe
  C:\Windows\System\xKlWfqZ.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\TcngfGU.exe
  C:\Windows\System\TcngfGU.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\eXunyOx.exe
  C:\Windows\System\eXunyOx.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\FqCrlap.exe
  C:\Windows\System\FqCrlap.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\kfGKkrL.exe
  C:\Windows\System\kfGKkrL.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\tYyWliP.exe
  C:\Windows\System\tYyWliP.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\GMDsGmN.exe
  C:\Windows\System\GMDsGmN.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\jGkuwpJ.exe
  C:\Windows\System\jGkuwpJ.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\BXubGlQ.exe
  C:\Windows\System\BXubGlQ.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\lMarNTM.exe
  C:\Windows\System\lMarNTM.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\ajWRnQl.exe
  C:\Windows\System\ajWRnQl.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\wJZGFBB.exe
  C:\Windows\System\wJZGFBB.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\XTwoIol.exe
  C:\Windows\System\XTwoIol.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\zaydJcD.exe
  C:\Windows\System\zaydJcD.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\HEQooNk.exe
  C:\Windows\System\HEQooNk.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\eupWpxT.exe
  C:\Windows\System\eupWpxT.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\FaikQst.exe
  C:\Windows\System\FaikQst.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\yXnXqUD.exe
  C:\Windows\System\yXnXqUD.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\xNnPiza.exe
  C:\Windows\System\xNnPiza.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\GKaosbD.exe
  C:\Windows\System\GKaosbD.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\VxmgbLP.exe
  C:\Windows\System\VxmgbLP.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\RoHQjRO.exe
  C:\Windows\System\RoHQjRO.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\ekQqJpg.exe
  C:\Windows\System\ekQqJpg.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\EWxRuWi.exe
  C:\Windows\System\EWxRuWi.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\gnhkdso.exe
  C:\Windows\System\gnhkdso.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\GzZthab.exe
  C:\Windows\System\GzZthab.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\RrPlWFx.exe
  C:\Windows\System\RrPlWFx.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\lObkifz.exe
  C:\Windows\System\lObkifz.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\iSXBRab.exe
  C:\Windows\System\iSXBRab.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\iUNQTSH.exe
  C:\Windows\System\iUNQTSH.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\MGruTha.exe
  C:\Windows\System\MGruTha.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\BXUPbJv.exe
  C:\Windows\System\BXUPbJv.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\UgGWCOt.exe
  C:\Windows\System\UgGWCOt.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\ndJfQnV.exe
  C:\Windows\System\ndJfQnV.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\VLJoBai.exe
  C:\Windows\System\VLJoBai.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\WwdycUu.exe
  C:\Windows\System\WwdycUu.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\cmrqfhT.exe
  C:\Windows\System\cmrqfhT.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\QDsSGSD.exe
  C:\Windows\System\QDsSGSD.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\BiMbVKr.exe
  C:\Windows\System\BiMbVKr.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\ofXSmGC.exe
  C:\Windows\System\ofXSmGC.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\xBSsFnw.exe
  C:\Windows\System\xBSsFnw.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\vPxYdSM.exe
  C:\Windows\System\vPxYdSM.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\nVCKsqf.exe
  C:\Windows\System\nVCKsqf.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\eSJDrhd.exe
  C:\Windows\System\eSJDrhd.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\enMasMI.exe
  C:\Windows\System\enMasMI.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\WssFDYg.exe
  C:\Windows\System\WssFDYg.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\VyEDNBv.exe
  C:\Windows\System\VyEDNBv.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\XLhWKXL.exe
  C:\Windows\System\XLhWKXL.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\dosiVGG.exe
  C:\Windows\System\dosiVGG.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\TjuJkfh.exe
  C:\Windows\System\TjuJkfh.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\qLOWGXU.exe
  C:\Windows\System\qLOWGXU.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\FsDRVjw.exe
  C:\Windows\System\FsDRVjw.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\VERsRni.exe
  C:\Windows\System\VERsRni.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\YQztAok.exe
  C:\Windows\System\YQztAok.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\LTHdlwV.exe
  C:\Windows\System\LTHdlwV.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\dKxtEAa.exe
  C:\Windows\System\dKxtEAa.exe
  2⤵
  PID:2600
- C:\Windows\System\hAoYbZZ.exe
  C:\Windows\System\hAoYbZZ.exe
  2⤵
  PID:4592
- C:\Windows\System\rZOhQiS.exe
  C:\Windows\System\rZOhQiS.exe
  2⤵
  PID:3408
- C:\Windows\System\CSfoxLx.exe
  C:\Windows\System\CSfoxLx.exe
  2⤵
  PID:1820
- C:\Windows\System\PJBzTCP.exe
  C:\Windows\System\PJBzTCP.exe
  2⤵
  PID:4156
- C:\Windows\System\NBZGduZ.exe
  C:\Windows\System\NBZGduZ.exe
  2⤵
  PID:4304
- C:\Windows\System\hRUMTGt.exe
  C:\Windows\System\hRUMTGt.exe
  2⤵
  PID:2664
- C:\Windows\System\IeoLAtz.exe
  C:\Windows\System\IeoLAtz.exe
  2⤵
  PID:3660
- C:\Windows\System\BTxWvsA.exe
  C:\Windows\System\BTxWvsA.exe
  2⤵
  PID:2740
- C:\Windows\System\LHenknR.exe
  C:\Windows\System\LHenknR.exe
  2⤵
  PID:1508
- C:\Windows\System\hQkmqbc.exe
  C:\Windows\System\hQkmqbc.exe
  2⤵
  PID:4768
- C:\Windows\System\biqnRRn.exe
  C:\Windows\System\biqnRRn.exe
  2⤵
  PID:1992
- C:\Windows\System\pCmKZVH.exe
  C:\Windows\System\pCmKZVH.exe
  2⤵
  PID:3008
- C:\Windows\System\BqsDJwa.exe
  C:\Windows\System\BqsDJwa.exe
  2⤵
  PID:4224
- C:\Windows\System\SrbFJUi.exe
  C:\Windows\System\SrbFJUi.exe
  2⤵
  PID:4880
- C:\Windows\System\PEXLSnx.exe
  C:\Windows\System\PEXLSnx.exe
  2⤵
  PID:5024
- C:\Windows\System\jNiaQBj.exe
  C:\Windows\System\jNiaQBj.exe
  2⤵
  PID:4836
- C:\Windows\System\DoRYrUS.exe
  C:\Windows\System\DoRYrUS.exe
  2⤵
  PID:920
- C:\Windows\System\ubrZSDB.exe
  C:\Windows\System\ubrZSDB.exe
  2⤵
  PID:4852
- C:\Windows\System\SMhdNHz.exe
  C:\Windows\System\SMhdNHz.exe
  2⤵
  PID:4488
- C:\Windows\System\kAbbstu.exe
  C:\Windows\System\kAbbstu.exe
  2⤵
  PID:4396
- C:\Windows\System\CcoCqme.exe
  C:\Windows\System\CcoCqme.exe
  2⤵
  PID:3804
- C:\Windows\System\bueXdcj.exe
  C:\Windows\System\bueXdcj.exe
  2⤵
  PID:1052
- C:\Windows\System\nEJsahJ.exe
  C:\Windows\System\nEJsahJ.exe
  2⤵
  PID:3172
- C:\Windows\System\fhIpaUH.exe
  C:\Windows\System\fhIpaUH.exe
  2⤵
  PID:2596
- C:\Windows\System\jgOwlfm.exe
  C:\Windows\System\jgOwlfm.exe
  2⤵
  PID:4444
- C:\Windows\System\BAjwtIU.exe
  C:\Windows\System\BAjwtIU.exe
  2⤵
  PID:4492
- C:\Windows\System\siwSmrc.exe
  C:\Windows\System\siwSmrc.exe
  2⤵
  PID:2332
- C:\Windows\System\prcNiAC.exe
  C:\Windows\System\prcNiAC.exe
  2⤵
  PID:4080
- C:\Windows\System\UxtzVap.exe
  C:\Windows\System\UxtzVap.exe
  2⤵
  PID:5136
- C:\Windows\System\LQsQHbL.exe
  C:\Windows\System\LQsQHbL.exe
  2⤵
  PID:5152
- C:\Windows\System\CIazOik.exe
  C:\Windows\System\CIazOik.exe
  2⤵
  PID:5168
- C:\Windows\System\rkMEIhQ.exe
  C:\Windows\System\rkMEIhQ.exe
  2⤵
  PID:5184
- C:\Windows\System\MNQpiyt.exe
  C:\Windows\System\MNQpiyt.exe
  2⤵
  PID:5272
- C:\Windows\System\PLsuRfY.exe
  C:\Windows\System\PLsuRfY.exe
  2⤵
  PID:5292
- C:\Windows\System\XdBbIMG.exe
  C:\Windows\System\XdBbIMG.exe
  2⤵
  PID:5312
- C:\Windows\System\GeQtxxO.exe
  C:\Windows\System\GeQtxxO.exe
  2⤵
  PID:5336
- C:\Windows\System\EatLFzI.exe
  C:\Windows\System\EatLFzI.exe
  2⤵
  PID:5360
- C:\Windows\System\fLsXJiL.exe
  C:\Windows\System\fLsXJiL.exe
  2⤵
  PID:5384
- C:\Windows\System\psPKBEW.exe
  C:\Windows\System\psPKBEW.exe
  2⤵
  PID:5412
- C:\Windows\System\DqhmTgA.exe
  C:\Windows\System\DqhmTgA.exe
  2⤵
  PID:5436
- C:\Windows\System\GWkuwxm.exe
  C:\Windows\System\GWkuwxm.exe
  2⤵
  PID:5472
- C:\Windows\System\RWXFQbW.exe
  C:\Windows\System\RWXFQbW.exe
  2⤵
  PID:5504
- C:\Windows\System\wXJeMft.exe
  C:\Windows\System\wXJeMft.exe
  2⤵
  PID:5524
- C:\Windows\System\TIzHHPL.exe
  C:\Windows\System\TIzHHPL.exe
  2⤵
  PID:5564
- C:\Windows\System\oORpAUq.exe
  C:\Windows\System\oORpAUq.exe
  2⤵
  PID:5592
- C:\Windows\System\SNnyEPo.exe
  C:\Windows\System\SNnyEPo.exe
  2⤵
  PID:5608
- C:\Windows\System\JOYSKxs.exe
  C:\Windows\System\JOYSKxs.exe
  2⤵
  PID:5624
- C:\Windows\System\oxebUem.exe
  C:\Windows\System\oxebUem.exe
  2⤵
  PID:5640
- C:\Windows\System\tEvKpbC.exe
  C:\Windows\System\tEvKpbC.exe
  2⤵
  PID:5668
- C:\Windows\System\aSlFJLc.exe
  C:\Windows\System\aSlFJLc.exe
  2⤵
  PID:5688
- C:\Windows\System\XxOXDZz.exe
  C:\Windows\System\XxOXDZz.exe
  2⤵
  PID:5708
- C:\Windows\System\SyvZMjY.exe
  C:\Windows\System\SyvZMjY.exe
  2⤵
  PID:5724
- C:\Windows\System\NGJYchM.exe
  C:\Windows\System\NGJYchM.exe
  2⤵
  PID:5752
- C:\Windows\System\OULqOug.exe
  C:\Windows\System\OULqOug.exe
  2⤵
  PID:5768
- C:\Windows\System\CZSCVBr.exe
  C:\Windows\System\CZSCVBr.exe
  2⤵
  PID:5788
- C:\Windows\System\XiXnPfP.exe
  C:\Windows\System\XiXnPfP.exe
  2⤵
  PID:5812
- C:\Windows\System\XjdNOgd.exe
  C:\Windows\System\XjdNOgd.exe
  2⤵
  PID:5836
- C:\Windows\System\GaTdDRA.exe
  C:\Windows\System\GaTdDRA.exe
  2⤵
  PID:5860
- C:\Windows\System\fEmbaxd.exe
  C:\Windows\System\fEmbaxd.exe
  2⤵
  PID:5876
- C:\Windows\System\uQvMGUG.exe
  C:\Windows\System\uQvMGUG.exe
  2⤵
  PID:5900
- C:\Windows\System\ncvqTbM.exe
  C:\Windows\System\ncvqTbM.exe
  2⤵
  PID:5924
- C:\Windows\System\LmcmNeD.exe
  C:\Windows\System\LmcmNeD.exe
  2⤵
  PID:5944
- C:\Windows\System\qvJJnUm.exe
  C:\Windows\System\qvJJnUm.exe
  2⤵
  PID:5960
- C:\Windows\System\wOmtcfC.exe
  C:\Windows\System\wOmtcfC.exe
  2⤵
  PID:5984
- C:\Windows\System\yWBjTQh.exe
  C:\Windows\System\yWBjTQh.exe
  2⤵
  PID:6000
- C:\Windows\System\CBsHKkG.exe
  C:\Windows\System\CBsHKkG.exe
  2⤵
  PID:6028
- C:\Windows\System\cayqBWD.exe
  C:\Windows\System\cayqBWD.exe
  2⤵
  PID:6052
- C:\Windows\System\jyCHjnT.exe
  C:\Windows\System\jyCHjnT.exe
  2⤵
  PID:6076
- C:\Windows\System\PWHcTKE.exe
  C:\Windows\System\PWHcTKE.exe
  2⤵
  PID:6092
- C:\Windows\System\ZgiRdAy.exe
  C:\Windows\System\ZgiRdAy.exe
  2⤵
  PID:6116
- C:\Windows\System\zIqNFwO.exe
  C:\Windows\System\zIqNFwO.exe
  2⤵
  PID:6140
- C:\Windows\System\txdrHwh.exe
  C:\Windows\System\txdrHwh.exe
  2⤵
  PID:2892
- C:\Windows\System\kyMLXJP.exe
  C:\Windows\System\kyMLXJP.exe
  2⤵
  PID:2288
- C:\Windows\System\jGCvGpq.exe
  C:\Windows\System\jGCvGpq.exe
  2⤵
  PID:4924
- C:\Windows\System\JvFpcfS.exe
  C:\Windows\System\JvFpcfS.exe
  2⤵
  PID:4700
- C:\Windows\System\HhWNulz.exe
  C:\Windows\System\HhWNulz.exe
  2⤵
  PID:4728
- C:\Windows\System\LdJZyYB.exe
  C:\Windows\System\LdJZyYB.exe
  2⤵
  PID:5536
- C:\Windows\System\cAPRIMR.exe
  C:\Windows\System\cAPRIMR.exe
  2⤵
  PID:3860
- C:\Windows\System\HSsfDxD.exe
  C:\Windows\System\HSsfDxD.exe
  2⤵
  PID:5088
- C:\Windows\System\kJSvENh.exe
  C:\Windows\System\kJSvENh.exe
  2⤵
  PID:3888
- C:\Windows\System\EmkgBUH.exe
  C:\Windows\System\EmkgBUH.exe
  2⤵
  PID:4092
- C:\Windows\System\qCtvkYo.exe
  C:\Windows\System\qCtvkYo.exe
  2⤵
  PID:5264
- C:\Windows\System\fiuzvBS.exe
  C:\Windows\System\fiuzvBS.exe
  2⤵
  PID:5288
- C:\Windows\System\sosgpdG.exe
  C:\Windows\System\sosgpdG.exe
  2⤵
  PID:5324
- C:\Windows\System\KSWlwqs.exe
  C:\Windows\System\KSWlwqs.exe
  2⤵
  PID:5352
- C:\Windows\System\tzYGvLu.exe
  C:\Windows\System\tzYGvLu.exe
  2⤵
  PID:3244
- C:\Windows\System\RatQldo.exe
  C:\Windows\System\RatQldo.exe
  2⤵
  PID:3168
- C:\Windows\System\utUZSxH.exe
  C:\Windows\System\utUZSxH.exe
  2⤵
  PID:5404
- C:\Windows\System\BNbDfHa.exe
  C:\Windows\System\BNbDfHa.exe
  2⤵
  PID:3404
- C:\Windows\System\HcMwwsw.exe
  C:\Windows\System\HcMwwsw.exe
  2⤵
  PID:5460
- C:\Windows\System\gLHeJbl.exe
  C:\Windows\System\gLHeJbl.exe
  2⤵
  PID:5512
- C:\Windows\System\YbuKBxb.exe
  C:\Windows\System\YbuKBxb.exe
  2⤵
  PID:820
- C:\Windows\System\gOfsSsv.exe
  C:\Windows\System\gOfsSsv.exe
  2⤵
  PID:5580
- C:\Windows\System\yontywA.exe
  C:\Windows\System\yontywA.exe
  2⤵
  PID:4848
- C:\Windows\System\wSEPsQi.exe
  C:\Windows\System\wSEPsQi.exe
  2⤵
  PID:508
- C:\Windows\System\TqCFWre.exe
  C:\Windows\System\TqCFWre.exe
  2⤵
  PID:2056
- C:\Windows\System\rbnNBxE.exe
  C:\Windows\System\rbnNBxE.exe
  2⤵
  PID:5124
- C:\Windows\System\DmMulRE.exe
  C:\Windows\System\DmMulRE.exe
  2⤵
  PID:5164
- C:\Windows\System\FrKytji.exe
  C:\Windows\System\FrKytji.exe
  2⤵
  PID:6172
- C:\Windows\System\GRkxdIC.exe
  C:\Windows\System\GRkxdIC.exe
  2⤵
  PID:6192
- C:\Windows\System\TushcOx.exe
  C:\Windows\System\TushcOx.exe
  2⤵
  PID:6208
- C:\Windows\System\RnRWaws.exe
  C:\Windows\System\RnRWaws.exe
  2⤵
  PID:6232
- C:\Windows\System\VVovEnz.exe
  C:\Windows\System\VVovEnz.exe
  2⤵
  PID:6252
- C:\Windows\System\dhRWGZx.exe
  C:\Windows\System\dhRWGZx.exe
  2⤵
  PID:6276
- C:\Windows\System\efiaLtt.exe
  C:\Windows\System\efiaLtt.exe
  2⤵
  PID:6296
- C:\Windows\System\KhFeMzh.exe
  C:\Windows\System\KhFeMzh.exe
  2⤵
  PID:6320
- C:\Windows\System\doivaGv.exe
  C:\Windows\System\doivaGv.exe
  2⤵
  PID:6336
- C:\Windows\System\HKdLegz.exe
  C:\Windows\System\HKdLegz.exe
  2⤵
  PID:6372
- C:\Windows\System\sFBHYmh.exe
  C:\Windows\System\sFBHYmh.exe
  2⤵
  PID:6400
- C:\Windows\System\IEnblTu.exe
  C:\Windows\System\IEnblTu.exe
  2⤵
  PID:6416
- C:\Windows\System\IeJFDaP.exe
  C:\Windows\System\IeJFDaP.exe
  2⤵
  PID:6440
- C:\Windows\System\KjPClRT.exe
  C:\Windows\System\KjPClRT.exe
  2⤵
  PID:6472
- C:\Windows\System\LWsdJrp.exe
  C:\Windows\System\LWsdJrp.exe
  2⤵
  PID:6492
- C:\Windows\System\bPgBtPe.exe
  C:\Windows\System\bPgBtPe.exe
  2⤵
  PID:6512
- C:\Windows\System\hdESGSP.exe
  C:\Windows\System\hdESGSP.exe
  2⤵
  PID:6532
- C:\Windows\System\JAIeRtg.exe
  C:\Windows\System\JAIeRtg.exe
  2⤵
  PID:6560
- C:\Windows\System\xqIIsZj.exe
  C:\Windows\System\xqIIsZj.exe
  2⤵
  PID:6580
- C:\Windows\System\SRJQMuL.exe
  C:\Windows\System\SRJQMuL.exe
  2⤵
  PID:6600
- C:\Windows\System\qDVkLdh.exe
  C:\Windows\System\qDVkLdh.exe
  2⤵
  PID:6624
- C:\Windows\System\QHHmvKn.exe
  C:\Windows\System\QHHmvKn.exe
  2⤵
  PID:6648
- C:\Windows\System\gmVwoeN.exe
  C:\Windows\System\gmVwoeN.exe
  2⤵
  PID:6664
- C:\Windows\System\gDsdzwk.exe
  C:\Windows\System\gDsdzwk.exe
  2⤵
  PID:6688
- C:\Windows\System\KewOhlH.exe
  C:\Windows\System\KewOhlH.exe
  2⤵
  PID:6712
- C:\Windows\System\ujnmrpZ.exe
  C:\Windows\System\ujnmrpZ.exe
  2⤵
  PID:6728
- C:\Windows\System\BpsSgrG.exe
  C:\Windows\System\BpsSgrG.exe
  2⤵
  PID:6752
- C:\Windows\System\LJQtCOj.exe
  C:\Windows\System\LJQtCOj.exe
  2⤵
  PID:6772
- C:\Windows\System\kPWpiEg.exe
  C:\Windows\System\kPWpiEg.exe
  2⤵
  PID:6792
- C:\Windows\System\xuJDLMf.exe
  C:\Windows\System\xuJDLMf.exe
  2⤵
  PID:6816
- C:\Windows\System\aDyRYXP.exe
  C:\Windows\System\aDyRYXP.exe
  2⤵
  PID:6840
- C:\Windows\System\XDlRpiB.exe
  C:\Windows\System\XDlRpiB.exe
  2⤵
  PID:6856
- C:\Windows\System\XHEHHvx.exe
  C:\Windows\System\XHEHHvx.exe
  2⤵
  PID:6880
- C:\Windows\System\vuDbzUx.exe
  C:\Windows\System\vuDbzUx.exe
  2⤵
  PID:6900
- C:\Windows\System\fAczoFX.exe
  C:\Windows\System\fAczoFX.exe
  2⤵
  PID:6920
- C:\Windows\System\pwSragi.exe
  C:\Windows\System\pwSragi.exe
  2⤵
  PID:6944
- C:\Windows\System\dIFDvwC.exe
  C:\Windows\System\dIFDvwC.exe
  2⤵
  PID:6968
- C:\Windows\System\ehkLhbi.exe
  C:\Windows\System\ehkLhbi.exe
  2⤵
  PID:6984
- C:\Windows\System\wUaDCLf.exe
  C:\Windows\System\wUaDCLf.exe
  2⤵
  PID:7008
- C:\Windows\System\vfosjQC.exe
  C:\Windows\System\vfosjQC.exe
  2⤵
  PID:7032
- C:\Windows\System\kjxMGno.exe
  C:\Windows\System\kjxMGno.exe
  2⤵
  PID:7052
- C:\Windows\System\diKjAOq.exe
  C:\Windows\System\diKjAOq.exe
  2⤵
  PID:7076
- C:\Windows\System\qahFhbg.exe
  C:\Windows\System\qahFhbg.exe
  2⤵
  PID:7096
- C:\Windows\System\vhAfjfp.exe
  C:\Windows\System\vhAfjfp.exe
  2⤵
  PID:7116
- C:\Windows\System\OjFGyTn.exe
  C:\Windows\System\OjFGyTn.exe
  2⤵
  PID:7140
- C:\Windows\System\aGBHTXT.exe
  C:\Windows\System\aGBHTXT.exe
  2⤵
  PID:7164
- C:\Windows\System\gsHYoUB.exe
  C:\Windows\System\gsHYoUB.exe
  2⤵
  PID:5956
- C:\Windows\System\pbudHVx.exe
  C:\Windows\System\pbudHVx.exe
  2⤵
  PID:6040
- C:\Windows\System\lNyXPFs.exe
  C:\Windows\System\lNyXPFs.exe
  2⤵
  PID:5680
- C:\Windows\System\SgGlXyD.exe
  C:\Windows\System\SgGlXyD.exe
  2⤵
  PID:5532
- C:\Windows\System\zUyyYux.exe
  C:\Windows\System\zUyyYux.exe
  2⤵
  PID:5636
- C:\Windows\System\QEljttm.exe
  C:\Windows\System\QEljttm.exe
  2⤵
  PID:5784
- C:\Windows\System\WLSkiup.exe
  C:\Windows\System\WLSkiup.exe
  2⤵
  PID:3604
- C:\Windows\System\lSvXKKX.exe
  C:\Windows\System\lSvXKKX.exe
  2⤵
  PID:6228
- C:\Windows\System\dhYyScH.exe
  C:\Windows\System\dhYyScH.exe
  2⤵
  PID:5664
- C:\Windows\System\kTVUoFl.exe
  C:\Windows\System\kTVUoFl.exe
  2⤵
  PID:6412
- C:\Windows\System\NhxXwxL.exe
  C:\Windows\System\NhxXwxL.exe
  2⤵
  PID:7192
- C:\Windows\System\lJoKBnO.exe
  C:\Windows\System\lJoKBnO.exe
  2⤵
  PID:7212
- C:\Windows\System\ybqKrsp.exe
  C:\Windows\System\ybqKrsp.exe
  2⤵
  PID:7236
- C:\Windows\System\XxMlVUG.exe
  C:\Windows\System\XxMlVUG.exe
  2⤵
  PID:7256
- C:\Windows\System\ySFzEjF.exe
  C:\Windows\System\ySFzEjF.exe
  2⤵
  PID:7272
- C:\Windows\System\INOUmod.exe
  C:\Windows\System\INOUmod.exe
  2⤵
  PID:7288
- C:\Windows\System\kDGVQtB.exe
  C:\Windows\System\kDGVQtB.exe
  2⤵
  PID:7312
- C:\Windows\System\SoPOaHG.exe
  C:\Windows\System\SoPOaHG.exe
  2⤵
  PID:7332
- C:\Windows\System\UWtztsS.exe
  C:\Windows\System\UWtztsS.exe
  2⤵
  PID:7348
- C:\Windows\System\VqBNObN.exe
  C:\Windows\System\VqBNObN.exe
  2⤵
  PID:7368
- C:\Windows\System\TyOqrwq.exe
  C:\Windows\System\TyOqrwq.exe
  2⤵
  PID:7392
- C:\Windows\System\lEYkPGU.exe
  C:\Windows\System\lEYkPGU.exe
  2⤵
  PID:7408
- C:\Windows\System\ZdluBrH.exe
  C:\Windows\System\ZdluBrH.exe
  2⤵
  PID:7432
- C:\Windows\System\ppeIkFa.exe
  C:\Windows\System\ppeIkFa.exe
  2⤵
  PID:7456
- C:\Windows\System\FScCkWm.exe
  C:\Windows\System\FScCkWm.exe
  2⤵
  PID:7480
- C:\Windows\System\WsXfigO.exe
  C:\Windows\System\WsXfigO.exe
  2⤵
  PID:7508
- C:\Windows\System\SpKBbLO.exe
  C:\Windows\System\SpKBbLO.exe
  2⤵
  PID:7536
- C:\Windows\System\enoTvtk.exe
  C:\Windows\System\enoTvtk.exe
  2⤵
  PID:7564
- C:\Windows\System\uKUFDWE.exe
  C:\Windows\System\uKUFDWE.exe
  2⤵
  PID:7588
- C:\Windows\System\UnqmdFP.exe
  C:\Windows\System\UnqmdFP.exe
  2⤵
  PID:7604
- C:\Windows\System\bIesCGg.exe
  C:\Windows\System\bIesCGg.exe
  2⤵
  PID:7632
- C:\Windows\System\EmLeiWj.exe
  C:\Windows\System\EmLeiWj.exe
  2⤵
  PID:7656
- C:\Windows\System\xzFTrjv.exe
  C:\Windows\System\xzFTrjv.exe
  2⤵
  PID:7684
- C:\Windows\System\QkUgPZi.exe
  C:\Windows\System\QkUgPZi.exe
  2⤵
  PID:7716
- C:\Windows\System\oeoWMyM.exe
  C:\Windows\System\oeoWMyM.exe
  2⤵
  PID:7752
- C:\Windows\System\HVSfHVr.exe
  C:\Windows\System\HVSfHVr.exe
  2⤵
  PID:7768
- C:\Windows\System\LTZaGMW.exe
  C:\Windows\System\LTZaGMW.exe
  2⤵
  PID:7792
- C:\Windows\System\MPcsdZP.exe
  C:\Windows\System\MPcsdZP.exe
  2⤵
  PID:7812
- C:\Windows\System\lPzleKV.exe
  C:\Windows\System\lPzleKV.exe
  2⤵
  PID:7832
- C:\Windows\System\GftTKED.exe
  C:\Windows\System\GftTKED.exe
  2⤵
  PID:7852
- C:\Windows\System\QiqTYZY.exe
  C:\Windows\System\QiqTYZY.exe
  2⤵
  PID:7872
- C:\Windows\System\sTQxYvD.exe
  C:\Windows\System\sTQxYvD.exe
  2⤵
  PID:7896
- C:\Windows\System\aZduPBp.exe
  C:\Windows\System\aZduPBp.exe
  2⤵
  PID:7912
- C:\Windows\System\tgrYKjP.exe
  C:\Windows\System\tgrYKjP.exe
  2⤵
  PID:7936
- C:\Windows\System\RPbHsgI.exe
  C:\Windows\System\RPbHsgI.exe
  2⤵
  PID:7956
- C:\Windows\System\gxKdORu.exe
  C:\Windows\System\gxKdORu.exe
  2⤵
  PID:7980
- C:\Windows\System\NEYtSdB.exe
  C:\Windows\System\NEYtSdB.exe
  2⤵
  PID:8008
- C:\Windows\System\vbGmFMb.exe
  C:\Windows\System\vbGmFMb.exe
  2⤵
  PID:8024
- C:\Windows\System\lrbvVGL.exe
  C:\Windows\System\lrbvVGL.exe
  2⤵
  PID:8040
- C:\Windows\System\UEznBkq.exe
  C:\Windows\System\UEznBkq.exe
  2⤵
  PID:8060
- C:\Windows\System\rYMRdEs.exe
  C:\Windows\System\rYMRdEs.exe
  2⤵
  PID:8084
- C:\Windows\System\tNgjBtZ.exe
  C:\Windows\System\tNgjBtZ.exe
  2⤵
  PID:8108
- C:\Windows\System\InTssXn.exe
  C:\Windows\System\InTssXn.exe
  2⤵
  PID:8128
- C:\Windows\System\LFQfeGT.exe
  C:\Windows\System\LFQfeGT.exe
  2⤵
  PID:8144
- C:\Windows\System\OzvsesR.exe
  C:\Windows\System\OzvsesR.exe
  2⤵
  PID:8164
- C:\Windows\System\YhgMvEr.exe
  C:\Windows\System\YhgMvEr.exe
  2⤵
  PID:8188
- C:\Windows\System\rhMjPKa.exe
  C:\Windows\System\rhMjPKa.exe
  2⤵
  PID:1520
- C:\Windows\System\DTahCYs.exe
  C:\Windows\System\DTahCYs.exe
  2⤵
  PID:1100
- C:\Windows\System\MtsBXqv.exe
  C:\Windows\System\MtsBXqv.exe
  2⤵
  PID:1972
- C:\Windows\System\imShLHC.exe
  C:\Windows\System\imShLHC.exe
  2⤵
  PID:6500
- C:\Windows\System\HymvgdT.exe
  C:\Windows\System\HymvgdT.exe
  2⤵
  PID:5420
- C:\Windows\System\vKgLgJs.exe
  C:\Windows\System\vKgLgJs.exe
  2⤵
  PID:5820
- C:\Windows\System\wKCNRiS.exe
  C:\Windows\System\wKCNRiS.exe
  2⤵
  PID:5848
- C:\Windows\System\JzpbBEi.exe
  C:\Windows\System\JzpbBEi.exe
  2⤵
  PID:5896
- C:\Windows\System\XorExxW.exe
  C:\Windows\System\XorExxW.exe
  2⤵
  PID:6632
- C:\Windows\System\sOszTnA.exe
  C:\Windows\System\sOszTnA.exe
  2⤵
  PID:6912
- C:\Windows\System\tojImAS.exe
  C:\Windows\System\tojImAS.exe
  2⤵
  PID:6956
- C:\Windows\System\TyoWyAj.exe
  C:\Windows\System\TyoWyAj.exe
  2⤵
  PID:7084
- C:\Windows\System\NDVZwkO.exe
  C:\Windows\System\NDVZwkO.exe
  2⤵
  PID:7124
- C:\Windows\System\xenCCRe.exe
  C:\Windows\System\xenCCRe.exe
  2⤵
  PID:6272
- C:\Windows\System\bPCHfzx.exe
  C:\Windows\System\bPCHfzx.exe
  2⤵
  PID:6048
- C:\Windows\System\dPImIUv.exe
  C:\Windows\System\dPImIUv.exe
  2⤵
  PID:6084
- C:\Windows\System\JLxAKJf.exe
  C:\Windows\System\JLxAKJf.exe
  2⤵
  PID:6128
- C:\Windows\System\RYugOvJ.exe
  C:\Windows\System\RYugOvJ.exe
  2⤵
  PID:6364
- C:\Windows\System\DgQjeFU.exe
  C:\Windows\System\DgQjeFU.exe
  2⤵
  PID:6224
- C:\Windows\System\aNOmTeX.exe
  C:\Windows\System\aNOmTeX.exe
  2⤵
  PID:7208
- C:\Windows\System\kFUeevr.exe
  C:\Windows\System\kFUeevr.exe
  2⤵
  PID:5268
- C:\Windows\System\wjTSGaL.exe
  C:\Windows\System\wjTSGaL.exe
  2⤵
  PID:7244
- C:\Windows\System\fZDvRKr.exe
  C:\Windows\System\fZDvRKr.exe
  2⤵
  PID:5356
- C:\Windows\System\ihIwuPn.exe
  C:\Windows\System\ihIwuPn.exe
  2⤵
  PID:4888
- C:\Windows\System\JCdJYpw.exe
  C:\Windows\System\JCdJYpw.exe
  2⤵
  PID:7324
- C:\Windows\System\IkfRNSx.exe
  C:\Windows\System\IkfRNSx.exe
  2⤵
  PID:6568
- C:\Windows\System\xBCCoTD.exe
  C:\Windows\System\xBCCoTD.exe
  2⤵
  PID:6572
- C:\Windows\System\vCmUUvL.exe
  C:\Windows\System\vCmUUvL.exe
  2⤵
  PID:5720
- C:\Windows\System\NYqMcVU.exe
  C:\Windows\System\NYqMcVU.exe
  2⤵
  PID:5732
- C:\Windows\System\VRdvutZ.exe
  C:\Windows\System\VRdvutZ.exe
  2⤵
  PID:6152
- C:\Windows\System\rzFtSPx.exe
  C:\Windows\System\rzFtSPx.exe
  2⤵
  PID:6684
- C:\Windows\System\FdacOLH.exe
  C:\Windows\System\FdacOLH.exe
  2⤵
  PID:6724
- C:\Windows\System\EEiWxkF.exe
  C:\Windows\System\EEiWxkF.exe
  2⤵
  PID:6788
- C:\Windows\System\ZYxHxeR.exe
  C:\Windows\System\ZYxHxeR.exe
  2⤵
  PID:6824
- C:\Windows\System\NXAJUoY.exe
  C:\Windows\System\NXAJUoY.exe
  2⤵
  PID:6872
- C:\Windows\System\wuKfIyw.exe
  C:\Windows\System\wuKfIyw.exe
  2⤵
  PID:7596
- C:\Windows\System\xbcCBYD.exe
  C:\Windows\System\xbcCBYD.exe
  2⤵
  PID:7624
- C:\Windows\System\ZHCqYGF.exe
  C:\Windows\System\ZHCqYGF.exe
  2⤵
  PID:6260
- C:\Windows\System\IdPXSok.exe
  C:\Windows\System\IdPXSok.exe
  2⤵
  PID:7908
- C:\Windows\System\EisLFeo.exe
  C:\Windows\System\EisLFeo.exe
  2⤵
  PID:6344
- C:\Windows\System\ZbDgqQn.exe
  C:\Windows\System\ZbDgqQn.exe
  2⤵
  PID:6436
- C:\Windows\System\MnkYePk.exe
  C:\Windows\System\MnkYePk.exe
  2⤵
  PID:5832
- C:\Windows\System\QEPgxQo.exe
  C:\Windows\System\QEPgxQo.exe
  2⤵
  PID:5892
- C:\Windows\System\EYATfFP.exe
  C:\Windows\System\EYATfFP.exe
  2⤵
  PID:8216
- C:\Windows\System\etBWnxq.exe
  C:\Windows\System\etBWnxq.exe
  2⤵
  PID:8232
- C:\Windows\System\LFOJKev.exe
  C:\Windows\System\LFOJKev.exe
  2⤵
  PID:8252
- C:\Windows\System\UuuOKQE.exe
  C:\Windows\System\UuuOKQE.exe
  2⤵
  PID:8268
- C:\Windows\System\NlNBIUf.exe
  C:\Windows\System\NlNBIUf.exe
  2⤵
  PID:8288
- C:\Windows\System\kWfloQJ.exe
  C:\Windows\System\kWfloQJ.exe
  2⤵
  PID:8304
- C:\Windows\System\wWppaLs.exe
  C:\Windows\System\wWppaLs.exe
  2⤵
  PID:8328
- C:\Windows\System\XADsczy.exe
  C:\Windows\System\XADsczy.exe
  2⤵
  PID:8352
- C:\Windows\System\TEwSOSM.exe
  C:\Windows\System\TEwSOSM.exe
  2⤵
  PID:8376
- C:\Windows\System\uJjmrlO.exe
  C:\Windows\System\uJjmrlO.exe
  2⤵
  PID:8396
- C:\Windows\System\WxjXVru.exe
  C:\Windows\System\WxjXVru.exe
  2⤵
  PID:8416
- C:\Windows\System\KhWIUuc.exe
  C:\Windows\System\KhWIUuc.exe
  2⤵
  PID:8440
- C:\Windows\System\GNhPCTs.exe
  C:\Windows\System\GNhPCTs.exe
  2⤵
  PID:8460
- C:\Windows\System\ApUwpHh.exe
  C:\Windows\System\ApUwpHh.exe
  2⤵
  PID:8484
- C:\Windows\System\rcVYmQI.exe
  C:\Windows\System\rcVYmQI.exe
  2⤵
  PID:8508
- C:\Windows\System\guikiLe.exe
  C:\Windows\System\guikiLe.exe
  2⤵
  PID:8528
- C:\Windows\System\DWxWErn.exe
  C:\Windows\System\DWxWErn.exe
  2⤵
  PID:8548
- C:\Windows\System\OncffPm.exe
  C:\Windows\System\OncffPm.exe
  2⤵
  PID:8572
- C:\Windows\System\GPItRfU.exe
  C:\Windows\System\GPItRfU.exe
  2⤵
  PID:8588
- C:\Windows\System\eMOpuNa.exe
  C:\Windows\System\eMOpuNa.exe
  2⤵
  PID:8612
- C:\Windows\System\kJTOcUd.exe
  C:\Windows\System\kJTOcUd.exe
  2⤵
  PID:8636
- C:\Windows\System\doKGJGO.exe
  C:\Windows\System\doKGJGO.exe
  2⤵
  PID:8656
- C:\Windows\System\SlspNAI.exe
  C:\Windows\System\SlspNAI.exe
  2⤵
  PID:8680
- C:\Windows\System\hfBQnUS.exe
  C:\Windows\System\hfBQnUS.exe
  2⤵
  PID:8704
- C:\Windows\System\qVbmzxJ.exe
  C:\Windows\System\qVbmzxJ.exe
  2⤵
  PID:8724
- C:\Windows\System\goxKWpm.exe
  C:\Windows\System\goxKWpm.exe
  2⤵
  PID:8744
- C:\Windows\System\JxqopJw.exe
  C:\Windows\System\JxqopJw.exe
  2⤵
  PID:8764
- C:\Windows\System\NITDeiq.exe
  C:\Windows\System\NITDeiq.exe
  2⤵
  PID:8784
- C:\Windows\System\ZhoumvQ.exe
  C:\Windows\System\ZhoumvQ.exe
  2⤵
  PID:8804
- C:\Windows\System\VTSnSeB.exe
  C:\Windows\System\VTSnSeB.exe
  2⤵
  PID:8820
- C:\Windows\System\JgywsRC.exe
  C:\Windows\System\JgywsRC.exe
  2⤵
  PID:8840
- C:\Windows\System\ZYTnlyh.exe
  C:\Windows\System\ZYTnlyh.exe
  2⤵
  PID:8864
- C:\Windows\System\grOamqs.exe
  C:\Windows\System\grOamqs.exe
  2⤵
  PID:8884
- C:\Windows\System\sbpFDFE.exe
  C:\Windows\System\sbpFDFE.exe
  2⤵
  PID:8908
- C:\Windows\System\GgAWpoK.exe
  C:\Windows\System\GgAWpoK.exe
  2⤵
  PID:8924
- C:\Windows\System\jBniipC.exe
  C:\Windows\System\jBniipC.exe
  2⤵
  PID:8948
- C:\Windows\System\XNcLGmQ.exe
  C:\Windows\System\XNcLGmQ.exe
  2⤵
  PID:8972
- C:\Windows\System\gwqCPrh.exe
  C:\Windows\System\gwqCPrh.exe
  2⤵
  PID:8988
- C:\Windows\System\QcPLpNP.exe
  C:\Windows\System\QcPLpNP.exe
  2⤵
  PID:9012
- C:\Windows\System\nnCYCdq.exe
  C:\Windows\System\nnCYCdq.exe
  2⤵
  PID:9036
- C:\Windows\System\GZZBhlS.exe
  C:\Windows\System\GZZBhlS.exe
  2⤵
  PID:9060
- C:\Windows\System\QHAkBRx.exe
  C:\Windows\System\QHAkBRx.exe
  2⤵
  PID:9080
- C:\Windows\System\fOJlWHV.exe
  C:\Windows\System\fOJlWHV.exe
  2⤵
  PID:9096
- C:\Windows\System\bXtefuX.exe
  C:\Windows\System\bXtefuX.exe
  2⤵
  PID:9124
- C:\Windows\System\CZBqhpi.exe
  C:\Windows\System\CZBqhpi.exe
  2⤵
  PID:9148
- C:\Windows\System\hHsUGRC.exe
  C:\Windows\System\hHsUGRC.exe
  2⤵
  PID:9168
- C:\Windows\System\RvvIcFr.exe
  C:\Windows\System\RvvIcFr.exe
  2⤵
  PID:9192
- C:\Windows\System\jJJXmiD.exe
  C:\Windows\System\jJJXmiD.exe
  2⤵
  PID:9212
- C:\Windows\System\RMXfkja.exe
  C:\Windows\System\RMXfkja.exe
  2⤵
  PID:6480
- C:\Windows\System\fhEnRUR.exe
  C:\Windows\System\fhEnRUR.exe
  2⤵
  PID:548
- C:\Windows\System\DyAfBAe.exe
  C:\Windows\System\DyAfBAe.exe
  2⤵
  PID:5744
- C:\Windows\System\NMGsNwB.exe
  C:\Windows\System\NMGsNwB.exe
  2⤵
  PID:916
- C:\Windows\System\feUdOYw.exe
  C:\Windows\System\feUdOYw.exe
  2⤵
  PID:6672
- C:\Windows\System\mkoxTeD.exe
  C:\Windows\System\mkoxTeD.exe
  2⤵
  PID:6768
- C:\Windows\System\UsjgtsS.exe
  C:\Windows\System\UsjgtsS.exe
  2⤵
  PID:6992
- C:\Windows\System\QNYmHjb.exe
  C:\Windows\System\QNYmHjb.exe
  2⤵
  PID:7024
- C:\Windows\System\mMYqbxu.exe
  C:\Windows\System\mMYqbxu.exe
  2⤵
  PID:5952
- C:\Windows\System\tJewSKf.exe
  C:\Windows\System\tJewSKf.exe
  2⤵
  PID:5980
- C:\Windows\System\bIRIniy.exe
  C:\Windows\System\bIRIniy.exe
  2⤵
  PID:5516
- C:\Windows\System\hBEtcSx.exe
  C:\Windows\System\hBEtcSx.exe
  2⤵
  PID:5716
- C:\Windows\System\wWAfsZw.exe
  C:\Windows\System\wWAfsZw.exe
  2⤵
  PID:5760
- C:\Windows\System\dpcpxyR.exe
  C:\Windows\System\dpcpxyR.exe
  2⤵
  PID:8124
- C:\Windows\System\TkHmOep.exe
  C:\Windows\System\TkHmOep.exe
  2⤵
  PID:7188
- C:\Windows\System\VefMZdR.exe
  C:\Windows\System\VefMZdR.exe
  2⤵
  PID:9232
- C:\Windows\System\oeLnDtq.exe
  C:\Windows\System\oeLnDtq.exe
  2⤵
  PID:9252
- C:\Windows\System\Zjabopp.exe
  C:\Windows\System\Zjabopp.exe
  2⤵
  PID:9268
- C:\Windows\System\eMqUhCb.exe
  C:\Windows\System\eMqUhCb.exe
  2⤵
  PID:9288
- C:\Windows\System\hEVrTCE.exe
  C:\Windows\System\hEVrTCE.exe
  2⤵
  PID:9312
- C:\Windows\System\hvXQSek.exe
  C:\Windows\System\hvXQSek.exe
  2⤵
  PID:9332
- C:\Windows\System\mYxjupU.exe
  C:\Windows\System\mYxjupU.exe
  2⤵
  PID:9368
- C:\Windows\System\onnsuwO.exe
  C:\Windows\System\onnsuwO.exe
  2⤵
  PID:9392
- C:\Windows\System\wbskkfM.exe
  C:\Windows\System\wbskkfM.exe
  2⤵
  PID:9412
- C:\Windows\System\JbEnbRK.exe
  C:\Windows\System\JbEnbRK.exe
  2⤵
  PID:9440
- C:\Windows\System\dwaqNMF.exe
  C:\Windows\System\dwaqNMF.exe
  2⤵
  PID:9460
- C:\Windows\System\VaBbHvh.exe
  C:\Windows\System\VaBbHvh.exe
  2⤵
  PID:9476
- C:\Windows\System\dIdnSth.exe
  C:\Windows\System\dIdnSth.exe
  2⤵
  PID:9496
- C:\Windows\System\ufWSXMZ.exe
  C:\Windows\System\ufWSXMZ.exe
  2⤵
  PID:9516
- C:\Windows\System\uVOlpUO.exe
  C:\Windows\System\uVOlpUO.exe
  2⤵
  PID:9536
- C:\Windows\System\KWrlIXZ.exe
  C:\Windows\System\KWrlIXZ.exe
  2⤵
  PID:9560
- C:\Windows\System\OcaxiQV.exe
  C:\Windows\System\OcaxiQV.exe
  2⤵
  PID:9576
- C:\Windows\System\USexsyv.exe
  C:\Windows\System\USexsyv.exe
  2⤵
  PID:9600
- C:\Windows\System\ljbAmZK.exe
  C:\Windows\System\ljbAmZK.exe
  2⤵
  PID:9620
- C:\Windows\System\ClCRnLd.exe
  C:\Windows\System\ClCRnLd.exe
  2⤵
  PID:9644
- C:\Windows\System\BpJWcel.exe
  C:\Windows\System\BpJWcel.exe
  2⤵
  PID:9664
- C:\Windows\System\UPMqsqW.exe
  C:\Windows\System\UPMqsqW.exe
  2⤵
  PID:9688
- C:\Windows\System\qJAhoyw.exe
  C:\Windows\System\qJAhoyw.exe
  2⤵
  PID:9712
- C:\Windows\System\UyCpiAv.exe
  C:\Windows\System\UyCpiAv.exe
  2⤵
  PID:9736
- C:\Windows\System\nigoywF.exe
  C:\Windows\System\nigoywF.exe
  2⤵
  PID:9760
- C:\Windows\System\JKHfksa.exe
  C:\Windows\System\JKHfksa.exe
  2⤵
  PID:9780
- C:\Windows\System\LyPzDMe.exe
  C:\Windows\System\LyPzDMe.exe
  2⤵
  PID:9800
- C:\Windows\System\LQxXtIo.exe
  C:\Windows\System\LQxXtIo.exe
  2⤵
  PID:9820
- C:\Windows\System\RRwZAuZ.exe
  C:\Windows\System\RRwZAuZ.exe
  2⤵
  PID:9848
- C:\Windows\System\CEFSKtH.exe
  C:\Windows\System\CEFSKtH.exe
  2⤵
  PID:9868
- C:\Windows\System\CIhegVG.exe
  C:\Windows\System\CIhegVG.exe
  2⤵
  PID:9892
- C:\Windows\System\WlgQvUN.exe
  C:\Windows\System\WlgQvUN.exe
  2⤵
  PID:9924
- C:\Windows\System\ntMETaM.exe
  C:\Windows\System\ntMETaM.exe
  2⤵
  PID:9940
- C:\Windows\System\EOxKnVc.exe
  C:\Windows\System\EOxKnVc.exe
  2⤵
  PID:9964
- C:\Windows\System\pjUTxca.exe
  C:\Windows\System\pjUTxca.exe
  2⤵
  PID:9996
- C:\Windows\System\MArQkeC.exe
  C:\Windows\System\MArQkeC.exe
  2⤵
  PID:10012
- C:\Windows\System\mWwJhQa.exe
  C:\Windows\System\mWwJhQa.exe
  2⤵
  PID:10036
- C:\Windows\System\aLRVnyY.exe
  C:\Windows\System\aLRVnyY.exe
  2⤵
  PID:10056
- C:\Windows\System\iLjcaVp.exe
  C:\Windows\System\iLjcaVp.exe
  2⤵
  PID:10080
- C:\Windows\System\vWEKxAb.exe
  C:\Windows\System\vWEKxAb.exe
  2⤵
  PID:10100
- C:\Windows\System\HjFGqCs.exe
  C:\Windows\System\HjFGqCs.exe
  2⤵
  PID:10120
- C:\Windows\System\YvHglEX.exe
  C:\Windows\System\YvHglEX.exe
  2⤵
  PID:10144
- C:\Windows\System\teOvbpI.exe
  C:\Windows\System\teOvbpI.exe
  2⤵
  PID:10160
- C:\Windows\System\bdQRifP.exe
  C:\Windows\System\bdQRifP.exe
  2⤵
  PID:10188
- C:\Windows\System\egApqiW.exe
  C:\Windows\System\egApqiW.exe
  2⤵
  PID:10208
- C:\Windows\System\WBvSXmo.exe
  C:\Windows\System\WBvSXmo.exe
  2⤵
  PID:10232
- C:\Windows\System\kDMrpfR.exe
  C:\Windows\System\kDMrpfR.exe
  2⤵
  PID:5776
- C:\Windows\System\iQbmFOD.exe
  C:\Windows\System\iQbmFOD.exe
  2⤵
  PID:8228
- C:\Windows\System\CCqFwDo.exe
  C:\Windows\System\CCqFwDo.exe
  2⤵
  PID:8320
- C:\Windows\System\ptByIAP.exe
  C:\Windows\System\ptByIAP.exe
  2⤵
  PID:8364
- C:\Windows\System\LoEolmD.exe
  C:\Windows\System\LoEolmD.exe
  2⤵
  PID:8404
- C:\Windows\System\NBmlHlD.exe
  C:\Windows\System\NBmlHlD.exe
  2⤵
  PID:8480
- C:\Windows\System\lvfrxSr.exe
  C:\Windows\System\lvfrxSr.exe
  2⤵
  PID:8540
- C:\Windows\System\KDrQCcW.exe
  C:\Windows\System\KDrQCcW.exe
  2⤵
  PID:8624
- C:\Windows\System\CfiTLsy.exe
  C:\Windows\System\CfiTLsy.exe
  2⤵
  PID:1960
- C:\Windows\System\ROtzWHy.exe
  C:\Windows\System\ROtzWHy.exe
  2⤵
  PID:8692
- C:\Windows\System\JxKluci.exe
  C:\Windows\System\JxKluci.exe
  2⤵
  PID:7492
- C:\Windows\System\mpnFfXh.exe
  C:\Windows\System\mpnFfXh.exe
  2⤵
  PID:7844
- C:\Windows\System\qrXoDOS.exe
  C:\Windows\System\qrXoDOS.exe
  2⤵
  PID:5128
- C:\Windows\System\CROssAQ.exe
  C:\Windows\System\CROssAQ.exe
  2⤵
  PID:6316
- C:\Windows\System\dzOfKkF.exe
  C:\Windows\System\dzOfKkF.exe
  2⤵
  PID:2484
- C:\Windows\System\WvuMJmV.exe
  C:\Windows\System\WvuMJmV.exe
  2⤵
  PID:4780
- C:\Windows\System\MVuOOBN.exe
  C:\Windows\System\MVuOOBN.exe
  2⤵
  PID:6456
- C:\Windows\System\BgTBzdX.exe
  C:\Windows\System\BgTBzdX.exe
  2⤵
  PID:8736
- C:\Windows\System\DhaqxQu.exe
  C:\Windows\System\DhaqxQu.exe
  2⤵
  PID:8792
- C:\Windows\System\DjRaJKH.exe
  C:\Windows\System\DjRaJKH.exe
  2⤵
  PID:8816
- C:\Windows\System\GVuFfsB.exe
  C:\Windows\System\GVuFfsB.exe
  2⤵
  PID:7280
- C:\Windows\System\PEkFgZH.exe
  C:\Windows\System\PEkFgZH.exe
  2⤵
  PID:8860
- C:\Windows\System\pQAQhVD.exe
  C:\Windows\System\pQAQhVD.exe
  2⤵
  PID:8892
- C:\Windows\System\aWgeewM.exe
  C:\Windows\System\aWgeewM.exe
  2⤵
  PID:8956
- C:\Windows\System\cNeFJtd.exe
  C:\Windows\System\cNeFJtd.exe
  2⤵
  PID:9092
- C:\Windows\System\SSUCKhf.exe
  C:\Windows\System\SSUCKhf.exe
  2⤵
  PID:9176
- C:\Windows\System\oLKqMSC.exe
  C:\Windows\System\oLKqMSC.exe
  2⤵
  PID:9208
- C:\Windows\System\RgFElde.exe
  C:\Windows\System\RgFElde.exe
  2⤵
  PID:5160
- C:\Windows\System\gvcoiiX.exe
  C:\Windows\System\gvcoiiX.exe
  2⤵
  PID:5304
- C:\Windows\System\pLCEASV.exe
  C:\Windows\System\pLCEASV.exe
  2⤵
  PID:10248
- C:\Windows\System\EmbSazo.exe
  C:\Windows\System\EmbSazo.exe
  2⤵
  PID:10276
- C:\Windows\System\LOyCGkN.exe
  C:\Windows\System\LOyCGkN.exe
  2⤵
  PID:10296
- C:\Windows\System\aJfaeaw.exe
  C:\Windows\System\aJfaeaw.exe
  2⤵
  PID:10312
- C:\Windows\System\ovpFEAM.exe
  C:\Windows\System\ovpFEAM.exe
  2⤵
  PID:10332
- C:\Windows\System\WnAApRs.exe
  C:\Windows\System\WnAApRs.exe
  2⤵
  PID:10348
- C:\Windows\System\kYfrZxG.exe
  C:\Windows\System\kYfrZxG.exe
  2⤵
  PID:10372
- C:\Windows\System\lYIariy.exe
  C:\Windows\System\lYIariy.exe
  2⤵
  PID:10396
- C:\Windows\System\sjruQuW.exe
  C:\Windows\System\sjruQuW.exe
  2⤵
  PID:10412
- C:\Windows\System\fPYjGQD.exe
  C:\Windows\System\fPYjGQD.exe
  2⤵
  PID:10428
- C:\Windows\System\WEfsjnk.exe
  C:\Windows\System\WEfsjnk.exe
  2⤵
  PID:10452
- C:\Windows\System\iSnrIPV.exe
  C:\Windows\System\iSnrIPV.exe
  2⤵
  PID:10472
- C:\Windows\System\JNYJDOn.exe
  C:\Windows\System\JNYJDOn.exe
  2⤵
  PID:10496
- C:\Windows\System\OpmRQzY.exe
  C:\Windows\System\OpmRQzY.exe
  2⤵
  PID:10520
- C:\Windows\System\HWUojnt.exe
  C:\Windows\System\HWUojnt.exe
  2⤵
  PID:10536
- C:\Windows\System\OsPyrpF.exe
  C:\Windows\System\OsPyrpF.exe
  2⤵
  PID:10560
- C:\Windows\System\XLbDctM.exe
  C:\Windows\System\XLbDctM.exe
  2⤵
  PID:10580
- C:\Windows\System\ARpSizu.exe
  C:\Windows\System\ARpSizu.exe
  2⤵
  PID:10600
- C:\Windows\System\RfUQxha.exe
  C:\Windows\System\RfUQxha.exe
  2⤵
  PID:10624
- C:\Windows\System\PsFNUfR.exe
  C:\Windows\System\PsFNUfR.exe
  2⤵
  PID:10648
- C:\Windows\System\ddyRKgb.exe
  C:\Windows\System\ddyRKgb.exe
  2⤵
  PID:10672
- C:\Windows\System\hqoSkJm.exe
  C:\Windows\System\hqoSkJm.exe
  2⤵
  PID:10692
- C:\Windows\System\GwfRFla.exe
  C:\Windows\System\GwfRFla.exe
  2⤵
  PID:10720
- C:\Windows\System\GcIqGOb.exe
  C:\Windows\System\GcIqGOb.exe
  2⤵
  PID:10740
- C:\Windows\System\gbUffma.exe
  C:\Windows\System\gbUffma.exe
  2⤵
  PID:10760
- C:\Windows\System\wdtnaDs.exe
  C:\Windows\System\wdtnaDs.exe
  2⤵
  PID:10780
- C:\Windows\System\WaQqnQt.exe
  C:\Windows\System\WaQqnQt.exe
  2⤵
  PID:10804
- C:\Windows\System\HVJZtln.exe
  C:\Windows\System\HVJZtln.exe
  2⤵
  PID:10828
- C:\Windows\System\lraBuHR.exe
  C:\Windows\System\lraBuHR.exe
  2⤵
  PID:10844
- C:\Windows\System\pYPaJLm.exe
  C:\Windows\System\pYPaJLm.exe
  2⤵
  PID:10868
- C:\Windows\System\ejuClZf.exe
  C:\Windows\System\ejuClZf.exe
  2⤵
  PID:10900
- C:\Windows\System\nWagDAP.exe
  C:\Windows\System\nWagDAP.exe
  2⤵
  PID:10920
- C:\Windows\System\okuHtNl.exe
  C:\Windows\System\okuHtNl.exe
  2⤵
  PID:10944
- C:\Windows\System\QPuzqHC.exe
  C:\Windows\System\QPuzqHC.exe
  2⤵
  PID:10964
- C:\Windows\System\sfHbElH.exe
  C:\Windows\System\sfHbElH.exe
  2⤵
  PID:10988
- C:\Windows\System\jSwCltr.exe
  C:\Windows\System\jSwCltr.exe
  2⤵
  PID:11008
- C:\Windows\System\dAjBXqh.exe
  C:\Windows\System\dAjBXqh.exe
  2⤵
  PID:11032
- C:\Windows\System\qMdoRmR.exe
  C:\Windows\System\qMdoRmR.exe
  2⤵
  PID:11056
- C:\Windows\System\txmYWKn.exe
  C:\Windows\System\txmYWKn.exe
  2⤵
  PID:11076
- C:\Windows\System\YHaHEqB.exe
  C:\Windows\System\YHaHEqB.exe
  2⤵
  PID:11092
- C:\Windows\System\VwthcZA.exe
  C:\Windows\System\VwthcZA.exe
  2⤵
  PID:11112
- C:\Windows\System\tBUdeds.exe
  C:\Windows\System\tBUdeds.exe
  2⤵
  PID:11140
- C:\Windows\System\qGtdVGk.exe
  C:\Windows\System\qGtdVGk.exe
  2⤵
  PID:11160
- C:\Windows\System\KNBtoYk.exe
  C:\Windows\System\KNBtoYk.exe
  2⤵
  PID:11180
- C:\Windows\System\ynLvJPn.exe
  C:\Windows\System\ynLvJPn.exe
  2⤵
  PID:11200
- C:\Windows\System\PonxcEt.exe
  C:\Windows\System\PonxcEt.exe
  2⤵
  PID:11220
- C:\Windows\System\igJswfP.exe
  C:\Windows\System\igJswfP.exe
  2⤵
  PID:11248
- C:\Windows\System\wGyNuAG.exe
  C:\Windows\System\wGyNuAG.exe
  2⤵
  PID:7784
- C:\Windows\System\uPRplNC.exe
  C:\Windows\System\uPRplNC.exe
  2⤵
  PID:5392
- C:\Windows\System\IXXUBLz.exe
  C:\Windows\System\IXXUBLz.exe
  2⤵
  PID:7920
- C:\Windows\System\BsqSmiK.exe
  C:\Windows\System\BsqSmiK.exe
  2⤵
  PID:7948
- C:\Windows\System\OsTjdUH.exe
  C:\Windows\System\OsTjdUH.exe
  2⤵
  PID:7580
- C:\Windows\System\mXgDBxk.exe
  C:\Windows\System\mXgDBxk.exe
  2⤵
  PID:7652
- C:\Windows\System\WVjVTra.exe
  C:\Windows\System\WVjVTra.exe
  2⤵
  PID:8056
- C:\Windows\System\dKPWQoC.exe
  C:\Windows\System\dKPWQoC.exe
  2⤵
  PID:8156
- C:\Windows\System\lYkxupN.exe
  C:\Windows\System\lYkxupN.exe
  2⤵
  PID:6460
- C:\Windows\System\mwIvVXz.exe
  C:\Windows\System\mwIvVXz.exe
  2⤵
  PID:9220
- C:\Windows\System\FXrwIZY.exe
  C:\Windows\System\FXrwIZY.exe
  2⤵
  PID:9276
- C:\Windows\System\QpeJdYV.exe
  C:\Windows\System\QpeJdYV.exe
  2⤵
  PID:6952
- C:\Windows\System\kMXSNPE.exe
  C:\Windows\System\kMXSNPE.exe
  2⤵
  PID:6244
- C:\Windows\System\TpplsPr.exe
  C:\Windows\System\TpplsPr.exe
  2⤵
  PID:5912
- C:\Windows\System\UMTomQI.exe
  C:\Windows\System\UMTomQI.exe
  2⤵
  PID:9360
- C:\Windows\System\YYeglaJ.exe
  C:\Windows\System\YYeglaJ.exe
  2⤵
  PID:9380
- C:\Windows\System\UfjsLqm.exe
  C:\Windows\System\UfjsLqm.exe
  2⤵
  PID:9484
- C:\Windows\System\jNoGAIh.exe
  C:\Windows\System\jNoGAIh.exe
  2⤵
  PID:9548
- C:\Windows\System\JSloGjO.exe
  C:\Windows\System\JSloGjO.exe
  2⤵
  PID:9628
- C:\Windows\System\xenEZGy.exe
  C:\Windows\System\xenEZGy.exe
  2⤵
  PID:9720
- C:\Windows\System\urBGQwF.exe
  C:\Windows\System\urBGQwF.exe
  2⤵
  PID:8496
- C:\Windows\System\BqftYpm.exe
  C:\Windows\System\BqftYpm.exe
  2⤵
  PID:9812
- C:\Windows\System\azlJrQb.exe
  C:\Windows\System\azlJrQb.exe
  2⤵
  PID:9884
- C:\Windows\System\nRpJvxi.exe
  C:\Windows\System\nRpJvxi.exe
  2⤵
  PID:9956
- C:\Windows\System\bZrdkSV.exe
  C:\Windows\System\bZrdkSV.exe
  2⤵
  PID:8608
- C:\Windows\System\qHNghXP.exe
  C:\Windows\System\qHNghXP.exe
  2⤵
  PID:5492
- C:\Windows\System\UNrGKzu.exe
  C:\Windows\System\UNrGKzu.exe
  2⤵
  PID:10116
- C:\Windows\System\gLofSKa.exe
  C:\Windows\System\gLofSKa.exe
  2⤵
  PID:1892
- C:\Windows\System\WZNxKpY.exe
  C:\Windows\System\WZNxKpY.exe
  2⤵
  PID:4648
- C:\Windows\System\pnHUWcm.exe
  C:\Windows\System\pnHUWcm.exe
  2⤵
  PID:11276
- C:\Windows\System\XlBpNgj.exe
  C:\Windows\System\XlBpNgj.exe
  2⤵
  PID:11292
- C:\Windows\System\UNMoyXO.exe
  C:\Windows\System\UNMoyXO.exe
  2⤵
  PID:11308
- C:\Windows\System\LbcyaRx.exe
  C:\Windows\System\LbcyaRx.exe
  2⤵
  PID:11328
- C:\Windows\System\Arsqyms.exe
  C:\Windows\System\Arsqyms.exe
  2⤵
  PID:11348
- C:\Windows\System\TLbsWFs.exe
  C:\Windows\System\TLbsWFs.exe
  2⤵
  PID:11368
- C:\Windows\System\wzZjMwB.exe
  C:\Windows\System\wzZjMwB.exe
  2⤵
  PID:11396
- C:\Windows\System\HzlrBHW.exe
  C:\Windows\System\HzlrBHW.exe
  2⤵
  PID:11416
- C:\Windows\System\AzQILEq.exe
  C:\Windows\System\AzQILEq.exe
  2⤵
  PID:11456
- C:\Windows\System\BouSkWd.exe
  C:\Windows\System\BouSkWd.exe
  2⤵
  PID:11480
- C:\Windows\System\YxWEZJK.exe
  C:\Windows\System\YxWEZJK.exe
  2⤵
  PID:11500
- C:\Windows\System\pCbrfuN.exe
  C:\Windows\System\pCbrfuN.exe
  2⤵
  PID:11520
- C:\Windows\System\cQjowYq.exe
  C:\Windows\System\cQjowYq.exe
  2⤵
  PID:11548
- C:\Windows\System\xUehwrY.exe
  C:\Windows\System\xUehwrY.exe
  2⤵
  PID:11564
- C:\Windows\System\KeaziRm.exe
  C:\Windows\System\KeaziRm.exe
  2⤵
  PID:11588
- C:\Windows\System\PqaKeQj.exe
  C:\Windows\System\PqaKeQj.exe
  2⤵
  PID:11612
- C:\Windows\System\KPDLALh.exe
  C:\Windows\System\KPDLALh.exe
  2⤵
  PID:11632
- C:\Windows\System\MZHAXyd.exe
  C:\Windows\System\MZHAXyd.exe
  2⤵
  PID:11656
- C:\Windows\System\vrYxLCo.exe
  C:\Windows\System\vrYxLCo.exe
  2⤵
  PID:11676
- C:\Windows\System\ifVDzKF.exe
  C:\Windows\System\ifVDzKF.exe
  2⤵
  PID:11692
- C:\Windows\System\CpJuHWD.exe
  C:\Windows\System\CpJuHWD.exe
  2⤵
  PID:11716
- C:\Windows\System\VYtVLZg.exe
  C:\Windows\System\VYtVLZg.exe
  2⤵
  PID:11736
- C:\Windows\System\HZaWcbO.exe
  C:\Windows\System\HZaWcbO.exe
  2⤵
  PID:11756
- C:\Windows\System\ELvgKvP.exe
  C:\Windows\System\ELvgKvP.exe
  2⤵
  PID:11776
- C:\Windows\System\gnfjagZ.exe
  C:\Windows\System\gnfjagZ.exe
  2⤵
  PID:11796
- C:\Windows\System\Hiqhwky.exe
  C:\Windows\System\Hiqhwky.exe
  2⤵
  PID:11812
- C:\Windows\System\jzgGsYA.exe
  C:\Windows\System\jzgGsYA.exe
  2⤵
  PID:11832
- C:\Windows\System\CjHoeaL.exe
  C:\Windows\System\CjHoeaL.exe
  2⤵
  PID:11856
- C:\Windows\System\uLXXIje.exe
  C:\Windows\System\uLXXIje.exe
  2⤵
  PID:11880
- C:\Windows\System\MGCHEYS.exe
  C:\Windows\System\MGCHEYS.exe
  2⤵
  PID:11904
- C:\Windows\System\MsFPbLF.exe
  C:\Windows\System\MsFPbLF.exe
  2⤵
  PID:11928
- C:\Windows\System\pdTvCjk.exe
  C:\Windows\System\pdTvCjk.exe
  2⤵
  PID:11952
- C:\Windows\System\NWCKczz.exe
  C:\Windows\System\NWCKczz.exe
  2⤵
  PID:11972
- C:\Windows\System\OVNctrp.exe
  C:\Windows\System\OVNctrp.exe
  2⤵
  PID:11992
- C:\Windows\System\xawmOrn.exe
  C:\Windows\System\xawmOrn.exe
  2⤵
  PID:12012
- C:\Windows\System\XVjEZiK.exe
  C:\Windows\System\XVjEZiK.exe
  2⤵
  PID:12040
- C:\Windows\System\DVKwsMA.exe
  C:\Windows\System\DVKwsMA.exe
  2⤵
  PID:12060
- C:\Windows\System\uTohSrH.exe
  C:\Windows\System\uTohSrH.exe
  2⤵
  PID:12080
- C:\Windows\System\tKsmqhv.exe
  C:\Windows\System\tKsmqhv.exe
  2⤵
  PID:12108
- C:\Windows\System\MWFDEIL.exe
  C:\Windows\System\MWFDEIL.exe
  2⤵
  PID:12132
- C:\Windows\System\fEUFEhi.exe
  C:\Windows\System\fEUFEhi.exe
  2⤵
  PID:12160
- C:\Windows\System\LReJdQv.exe
  C:\Windows\System\LReJdQv.exe
  2⤵
  PID:12176
- C:\Windows\System\bsKlwzr.exe
  C:\Windows\System\bsKlwzr.exe
  2⤵
  PID:12200
- C:\Windows\System\IIHLsVR.exe
  C:\Windows\System\IIHLsVR.exe
  2⤵
  PID:12224
- C:\Windows\System\NAqPKbr.exe
  C:\Windows\System\NAqPKbr.exe
  2⤵
  PID:12252
- C:\Windows\System\IALLRBX.exe
  C:\Windows\System\IALLRBX.exe
  2⤵
  PID:12272
- C:\Windows\System\IljBUKq.exe
  C:\Windows\System\IljBUKq.exe
  2⤵
  PID:6292
- C:\Windows\System\EWxHedl.exe
  C:\Windows\System\EWxHedl.exe
  2⤵
  PID:8796
- C:\Windows\System\YOrXSRw.exe
  C:\Windows\System\YOrXSRw.exe
  2⤵
  PID:8536
- C:\Windows\System\NKKRMlD.exe
  C:\Windows\System\NKKRMlD.exe
  2⤵
  PID:7464
- C:\Windows\System\jbGkVjJ.exe
  C:\Windows\System\jbGkVjJ.exe
  2⤵
  PID:9004
- C:\Windows\System\GEMNatV.exe
  C:\Windows\System\GEMNatV.exe
  2⤵
  PID:4672
- C:\Windows\System\BwNLooR.exe
  C:\Windows\System\BwNLooR.exe
  2⤵
  PID:9164
- C:\Windows\System\WlMKYbF.exe
  C:\Windows\System\WlMKYbF.exe
  2⤵
  PID:8836
- C:\Windows\System\FyPUfzH.exe
  C:\Windows\System\FyPUfzH.exe
  2⤵
  PID:1284
- C:\Windows\System\NjXqEHc.exe
  C:\Windows\System\NjXqEHc.exe
  2⤵
  PID:10256
- C:\Windows\System\JABJmjt.exe
  C:\Windows\System\JABJmjt.exe
  2⤵
  PID:10368
- C:\Windows\System\sfbHkpO.exe
  C:\Windows\System\sfbHkpO.exe
  2⤵
  PID:6620
- C:\Windows\System\NtSLWOV.exe
  C:\Windows\System\NtSLWOV.exe
  2⤵
  PID:10492
- C:\Windows\System\FTtTjBB.exe
  C:\Windows\System\FTtTjBB.exe
  2⤵
  PID:10528
- C:\Windows\System\uCqpoSI.exe
  C:\Windows\System\uCqpoSI.exe
  2⤵
  PID:10568
- C:\Windows\System\VxzCKSn.exe
  C:\Windows\System\VxzCKSn.exe
  2⤵
  PID:10620
- C:\Windows\System\cmjsbRv.exe
  C:\Windows\System\cmjsbRv.exe
  2⤵
  PID:10708
- C:\Windows\System\xCUHcHZ.exe
  C:\Windows\System\xCUHcHZ.exe
  2⤵
  PID:7884
- C:\Windows\System\QQRLKWr.exe
  C:\Windows\System\QQRLKWr.exe
  2⤵
  PID:12308
- C:\Windows\System\EGOamIS.exe
  C:\Windows\System\EGOamIS.exe
  2⤵
  PID:12324
- C:\Windows\System\JuBYXLl.exe
  C:\Windows\System\JuBYXLl.exe
  2⤵
  PID:12340
- C:\Windows\System\JzMrIPx.exe
  C:\Windows\System\JzMrIPx.exe
  2⤵
  PID:12360
- C:\Windows\System\SoyRXQU.exe
  C:\Windows\System\SoyRXQU.exe
  2⤵
  PID:12380
- C:\Windows\System\wDIwUXx.exe
  C:\Windows\System\wDIwUXx.exe
  2⤵
  PID:12396
- C:\Windows\System\tXsgWCw.exe
  C:\Windows\System\tXsgWCw.exe
  2⤵
  PID:12424
- C:\Windows\System\VgJleDy.exe
  C:\Windows\System\VgJleDy.exe
  2⤵
  PID:12448
- C:\Windows\System\SkGkdJw.exe
  C:\Windows\System\SkGkdJw.exe
  2⤵
  PID:12472
- C:\Windows\System\mTmLDus.exe
  C:\Windows\System\mTmLDus.exe
  2⤵
  PID:12492
- C:\Windows\System\RkMfpqE.exe
  C:\Windows\System\RkMfpqE.exe
  2⤵
  PID:12508
- C:\Windows\System\JskiaJH.exe
  C:\Windows\System\JskiaJH.exe
  2⤵
  PID:12524
- C:\Windows\System\yVwXQaz.exe
  C:\Windows\System\yVwXQaz.exe
  2⤵
  PID:12544
- C:\Windows\System\VcMjTLe.exe
  C:\Windows\System\VcMjTLe.exe
  2⤵
  PID:12564
- C:\Windows\System\VqyLkBa.exe
  C:\Windows\System\VqyLkBa.exe
  2⤵
  PID:12588
- C:\Windows\System\fdMDvtC.exe
  C:\Windows\System\fdMDvtC.exe
  2⤵
  PID:12612
- C:\Windows\System\mBhMLoH.exe
  C:\Windows\System\mBhMLoH.exe
  2⤵
  PID:12636
- C:\Windows\System\svFMxIb.exe
  C:\Windows\System\svFMxIb.exe
  2⤵
  PID:12656
- C:\Windows\System\IdTfKzs.exe
  C:\Windows\System\IdTfKzs.exe
  2⤵
  PID:12676
- C:\Windows\System\mYlXCSo.exe
  C:\Windows\System\mYlXCSo.exe
  2⤵
  PID:12700
- C:\Windows\System\RGnjQRp.exe
  C:\Windows\System\RGnjQRp.exe
  2⤵
  PID:12720
- C:\Windows\System\FVDXefB.exe
  C:\Windows\System\FVDXefB.exe
  2⤵
  PID:12744
- C:\Windows\System\HPriQju.exe
  C:\Windows\System\HPriQju.exe
  2⤵
  PID:12764
- C:\Windows\System\lDTyUmR.exe
  C:\Windows\System\lDTyUmR.exe
  2⤵
  PID:12792
- C:\Windows\System\JZYQyKc.exe
  C:\Windows\System\JZYQyKc.exe
  2⤵
  PID:12812
- C:\Windows\System\RcewXtb.exe
  C:\Windows\System\RcewXtb.exe
  2⤵
  PID:12828
- C:\Windows\System\RYJkMXE.exe
  C:\Windows\System\RYJkMXE.exe
  2⤵
  PID:12848
- C:\Windows\System\xbVCbjJ.exe
  C:\Windows\System\xbVCbjJ.exe
  2⤵
  PID:12872
- C:\Windows\System\cELmbAX.exe
  C:\Windows\System\cELmbAX.exe
  2⤵
  PID:12896
- C:\Windows\System\yGLEIza.exe
  C:\Windows\System\yGLEIza.exe
  2⤵
  PID:12916
- C:\Windows\System\uIwvDXX.exe
  C:\Windows\System\uIwvDXX.exe
  2⤵
  PID:12940
- C:\Windows\System\gQCJxIO.exe
  C:\Windows\System\gQCJxIO.exe
  2⤵
  PID:12960
- C:\Windows\System\gAYYBoJ.exe
  C:\Windows\System\gAYYBoJ.exe
  2⤵
  PID:12980
- C:\Windows\System\txnjKuv.exe
  C:\Windows\System\txnjKuv.exe
  2⤵
  PID:6112
- C:\Windows\System\HNcrkKm.exe
  C:\Windows\System\HNcrkKm.exe
  2⤵
  PID:12820
- C:\Windows\System\gkIfehf.exe
  C:\Windows\System\gkIfehf.exe
  2⤵
  PID:12868
- C:\Windows\System\pbfbEkF.exe
  C:\Windows\System\pbfbEkF.exe
  2⤵
  PID:9572
- C:\Windows\System\ZCAuzKm.exe
  C:\Windows\System\ZCAuzKm.exe
  2⤵
  PID:10004
- C:\Windows\System\cuvOcYN.exe
  C:\Windows\System\cuvOcYN.exe
  2⤵
  PID:10028
- C:\Windows\System\vxFOAau.exe
  C:\Windows\System\vxFOAau.exe
  2⤵
  PID:8580
- C:\Windows\System\fWXjGHl.exe
  C:\Windows\System\fWXjGHl.exe
  2⤵
  PID:8700
- C:\Windows\System\kvBhyOV.exe
  C:\Windows\System\kvBhyOV.exe
  2⤵
  PID:4336
- C:\Windows\System\fANTTur.exe
  C:\Windows\System\fANTTur.exe
  2⤵
  PID:8752
- C:\Windows\System\rZEMUUV.exe
  C:\Windows\System\rZEMUUV.exe
  2⤵
  PID:11896
- C:\Windows\System\ORurqaA.exe
  C:\Windows\System\ORurqaA.exe
  2⤵
  PID:11984
- C:\Windows\System\hhmrSns.exe
  C:\Windows\System\hhmrSns.exe
  2⤵
  PID:9120
- C:\Windows\System\QPuhDQT.exe
  C:\Windows\System\QPuhDQT.exe
  2⤵
  PID:12184
- C:\Windows\System\fvLmlEJ.exe
  C:\Windows\System\fvLmlEJ.exe
  2⤵
  PID:10244
- C:\Windows\System\XFhuOOW.exe
  C:\Windows\System\XFhuOOW.exe
  2⤵
  PID:10304
- C:\Windows\System\JfqXmOa.exe
  C:\Windows\System\JfqXmOa.exe
  2⤵
  PID:9160
- C:\Windows\System\RbPjhgM.exe
  C:\Windows\System\RbPjhgM.exe
  2⤵
  PID:11072
- C:\Windows\System\MWWbdfy.exe
  C:\Windows\System\MWWbdfy.exe
  2⤵
  PID:9492
- C:\Windows\System\giiwbOx.exe
  C:\Windows\System\giiwbOx.exe
  2⤵
  PID:11320
- C:\Windows\System\tutGdnU.exe
  C:\Windows\System\tutGdnU.exe
  2⤵
  PID:7360
- C:\Windows\System\kcXmrDL.exe
  C:\Windows\System\kcXmrDL.exe
  2⤵
  PID:11652
- C:\Windows\System\IXhYQxZ.exe
  C:\Windows\System\IXhYQxZ.exe
  2⤵
  PID:10684
- C:\Windows\System\YZxBKgH.exe
  C:\Windows\System\YZxBKgH.exe
  2⤵
  PID:11196
- C:\Windows\System\TTJyzkV.exe
  C:\Windows\System\TTJyzkV.exe
  2⤵
  PID:9248
- C:\Windows\System\RaayUAu.exe
  C:\Windows\System\RaayUAu.exe
  2⤵
  PID:7364
- C:\Windows\System\dGSgoXk.exe
  C:\Windows\System\dGSgoXk.exe
  2⤵
  PID:12652
- C:\Windows\System\ufFHbVA.exe
  C:\Windows\System\ufFHbVA.exe
  2⤵
  PID:12732
- C:\Windows\System\YsgdCIf.exe
  C:\Windows\System\YsgdCIf.exe
  2⤵
  PID:12908
- C:\Windows\System\qiiyjuE.exe
  C:\Windows\System\qiiyjuE.exe
  2⤵
  PID:7676
- C:\Windows\System\IssamLJ.exe
  C:\Windows\System\IssamLJ.exe
  2⤵
  PID:12956
- C:\Windows\System\WtbVDwg.exe
  C:\Windows\System\WtbVDwg.exe
  2⤵
  PID:10664
- C:\Windows\System\cqVTvnq.exe
  C:\Windows\System\cqVTvnq.exe
  2⤵
  PID:12348
- C:\Windows\System\vmogoFN.exe
  C:\Windows\System\vmogoFN.exe
  2⤵
  PID:9468
- C:\Windows\System\eaQBjqW.exe
  C:\Windows\System\eaQBjqW.exe
  2⤵
  PID:1996
- C:\Windows\System\JZhTUBT.exe
  C:\Windows\System\JZhTUBT.exe
  2⤵
  PID:9228
- C:\Windows\System\dpbjcGW.exe
  C:\Windows\System\dpbjcGW.exe
  2⤵
  PID:12260
- C:\Windows\System\iPtZEGQ.exe
  C:\Windows\System\iPtZEGQ.exe
  2⤵
  PID:12628
- C:\Windows\System\nvHYDDZ.exe
  C:\Windows\System\nvHYDDZ.exe
  2⤵
  PID:12708
- C:\Windows\System\SOJnqxN.exe
  C:\Windows\System\SOJnqxN.exe
  2⤵
  PID:13080
- C:\Windows\System\PFNNBWt.exe
  C:\Windows\System\PFNNBWt.exe
  2⤵
  PID:9408
- C:\Windows\System\EPrAzEx.exe
  C:\Windows\System\EPrAzEx.exe
  2⤵
  PID:12580
- C:\Windows\System\DeUxEmG.exe
  C:\Windows\System\DeUxEmG.exe
  2⤵
  PID:3656
- C:\Windows\System\GsVssHx.exe
  C:\Windows\System\GsVssHx.exe
  2⤵
  PID:9936
- C:\Windows\System\etforDm.exe
  C:\Windows\System\etforDm.exe
  2⤵
  PID:9776
- C:\Windows\System\lPjHtEo.exe
  C:\Windows\System\lPjHtEo.exe
  2⤵
  PID:11840
- C:\Windows\System\tZgphnL.exe
  C:\Windows\System\tZgphnL.exe
  2⤵
  PID:13092
- C:\Windows\System\nYwAbfJ.exe
  C:\Windows\System\nYwAbfJ.exe
  2⤵
  PID:12216
- C:\Windows\System\kfrkUBN.exe
  C:\Windows\System\kfrkUBN.exe
  2⤵
  PID:12244
- C:\Windows\System\IVaExGX.exe
  C:\Windows\System\IVaExGX.exe
  2⤵
  PID:10344
- C:\Windows\System\CYvNFXh.exe
  C:\Windows\System\CYvNFXh.exe
  2⤵
  PID:9544
- C:\Windows\System\lqVxlax.exe
  C:\Windows\System\lqVxlax.exe
  2⤵
  PID:10836
- C:\Windows\System\SROBLkW.exe
  C:\Windows\System\SROBLkW.exe
  2⤵
  PID:8312
- C:\Windows\System\Fvdyrit.exe
  C:\Windows\System\Fvdyrit.exe
  2⤵
  PID:9828
- C:\Windows\System\nMNDyZr.exe
  C:\Windows\System\nMNDyZr.exe
  2⤵
  PID:13076
- C:\Windows\System\CTJmNXs.exe
  C:\Windows\System\CTJmNXs.exe
  2⤵
  PID:2340
- C:\Windows\System\OamvptE.exe
  C:\Windows\System\OamvptE.exe
  2⤵
  PID:11492
- C:\Windows\System\xnPWirJ.exe
  C:\Windows\System\xnPWirJ.exe
  2⤵
  PID:1436
- C:\Windows\System\xHjOFsg.exe
  C:\Windows\System\xHjOFsg.exe
  2⤵
  PID:11960
- C:\Windows\System\UUgrzHC.exe
  C:\Windows\System\UUgrzHC.exe
  2⤵
  PID:9020
- C:\Windows\System\SruMZNn.exe
  C:\Windows\System\SruMZNn.exe
  2⤵
  PID:5884
- C:\Windows\System\xIMgxXN.exe
  C:\Windows\System\xIMgxXN.exe
  2⤵
  PID:12824
- C:\Windows\System\qwbCYHX.exe
  C:\Windows\System\qwbCYHX.exe
  2⤵
  PID:10616
- C:\Windows\System\UPlsNic.exe
  C:\Windows\System\UPlsNic.exe
  2⤵
  PID:10876
- C:\Windows\System\NQsUNwy.exe
  C:\Windows\System\NQsUNwy.exe
  2⤵
  PID:8120
- C:\Windows\System\OwpZOWL.exe
  C:\Windows\System\OwpZOWL.exe
  2⤵
  PID:9792
- C:\Windows\System\nxFEXkq.exe
  C:\Windows\System\nxFEXkq.exe
  2⤵
  PID:11828
- C:\Windows\System\OkhNArc.exe
  C:\Windows\System\OkhNArc.exe
  2⤵
  PID:13192
- C:\Windows\System\NCHlJQv.exe
  C:\Windows\System\NCHlJQv.exe
  2⤵
  PID:10268
- C:\Windows\System\MdLkYxq.exe
  C:\Windows\System\MdLkYxq.exe
  2⤵
  PID:11336
- C:\Windows\System\sHVHtYO.exe
  C:\Windows\System\sHVHtYO.exe
  2⤵
  PID:7700
- C:\Windows\System\SDeoVgY.exe
  C:\Windows\System\SDeoVgY.exe
  2⤵
  PID:12220
- C:\Windows\System\fZTYmqD.exe
  C:\Windows\System\fZTYmqD.exe
  2⤵
  PID:2384
- C:\Windows\System\IfIxPQp.exe
  C:\Windows\System\IfIxPQp.exe
  2⤵
  PID:10224
- C:\Windows\System\JCBJUSv.exe
  C:\Windows\System\JCBJUSv.exe
  2⤵
  PID:9948
- C:\Windows\System\KpHuwTT.exe
  C:\Windows\System\KpHuwTT.exe
  2⤵
  PID:12416
- C:\Windows\System\CLamHkz.exe
  C:\Windows\System\CLamHkz.exe
  2⤵
  PID:9472
- C:\Windows\System\ELTgtMD.exe
  C:\Windows\System\ELTgtMD.exe
  2⤵
  PID:10468
- C:\Windows\System\ugLSdnV.exe
  C:\Windows\System\ugLSdnV.exe
  2⤵
  PID:13208
- C:\Windows\System\rFMmyoj.exe
  C:\Windows\System\rFMmyoj.exe
  2⤵
  PID:6980
- C:\Windows\System\bIofqvz.exe
  C:\Windows\System\bIofqvz.exe
  2⤵
  PID:10776
- C:\Windows\System\rEgdNRy.exe
  C:\Windows\System\rEgdNRy.exe
  2⤵
  PID:13316
- C:\Windows\System\tPoQUKm.exe
  C:\Windows\System\tPoQUKm.exe
  2⤵
  PID:13332
- C:\Windows\System\vOKmhaA.exe
  C:\Windows\System\vOKmhaA.exe
  2⤵
  PID:13352
- C:\Windows\System\oXaHvjw.exe
  C:\Windows\System\oXaHvjw.exe
  2⤵
  PID:13368
- C:\Windows\System\EyfjPYD.exe
  C:\Windows\System\EyfjPYD.exe
  2⤵
  PID:13384
- C:\Windows\System\gKpjjeF.exe
  C:\Windows\System\gKpjjeF.exe
  2⤵
  PID:13404
- C:\Windows\System\uRYwGcW.exe
  C:\Windows\System\uRYwGcW.exe
  2⤵
  PID:13420
- C:\Windows\System\UvvuvIU.exe
  C:\Windows\System\UvvuvIU.exe
  2⤵
  PID:13436
- C:\Windows\System\AbctIfg.exe
  C:\Windows\System\AbctIfg.exe
  2⤵
  PID:13452
- C:\Windows\System\gXcbgcQ.exe
  C:\Windows\System\gXcbgcQ.exe
  2⤵
  PID:13468
- C:\Windows\System\Ayyttdk.exe
  C:\Windows\System\Ayyttdk.exe
  2⤵
  PID:13484
- C:\Windows\System\SnoDGEL.exe
  C:\Windows\System\SnoDGEL.exe
  2⤵
  PID:13500
- C:\Windows\System\iRUVidt.exe
  C:\Windows\System\iRUVidt.exe
  2⤵
  PID:13516
- C:\Windows\System\hgMazmw.exe
  C:\Windows\System\hgMazmw.exe
  2⤵
  PID:13536
- C:\Windows\System\EPfFyDR.exe
  C:\Windows\System\EPfFyDR.exe
  2⤵
  PID:13556
- C:\Windows\System\wRsOUoA.exe
  C:\Windows\System\wRsOUoA.exe
  2⤵
  PID:13580
- C:\Windows\System\YYLjwuV.exe
  C:\Windows\System\YYLjwuV.exe
  2⤵
  PID:13600
- C:\Windows\System\RzCCdgu.exe
  C:\Windows\System\RzCCdgu.exe
  2⤵
  PID:13624
- C:\Windows\System\iyMCQNZ.exe
  C:\Windows\System\iyMCQNZ.exe
  2⤵
  PID:13648
- C:\Windows\System\qZIgOcq.exe
  C:\Windows\System\qZIgOcq.exe
  2⤵
  PID:13668
- C:\Windows\System\rFzGioX.exe
  C:\Windows\System\rFzGioX.exe
  2⤵
  PID:13684
- C:\Windows\System\wOdLXzA.exe
  C:\Windows\System\wOdLXzA.exe
  2⤵
  PID:13704
- C:\Windows\System\zmNDqEC.exe
  C:\Windows\System\zmNDqEC.exe
  2⤵
  PID:13724
- C:\Windows\System\ohfIBBj.exe
  C:\Windows\System\ohfIBBj.exe
  2⤵
  PID:13744
- C:\Windows\System\VsUINvo.exe
  C:\Windows\System\VsUINvo.exe
  2⤵
  PID:13768
- C:\Windows\System\EzQweQK.exe
  C:\Windows\System\EzQweQK.exe
  2⤵
  PID:13784
- C:\Windows\System\yuXICRL.exe
  C:\Windows\System\yuXICRL.exe
  2⤵
  PID:13804
- C:\Windows\System\bNUTQqv.exe
  C:\Windows\System\bNUTQqv.exe
  2⤵
  PID:13824
- C:\Windows\System\ekjyKrc.exe
  C:\Windows\System\ekjyKrc.exe
  2⤵
  PID:13844
- C:\Windows\System\adhtIBQ.exe
  C:\Windows\System\adhtIBQ.exe
  2⤵
  PID:13864
- C:\Windows\System\GViOPvJ.exe
  C:\Windows\System\GViOPvJ.exe
  2⤵
  PID:13884
- C:\Windows\System\drMgyxx.exe
  C:\Windows\System\drMgyxx.exe
  2⤵
  PID:13908
- C:\Windows\System\ibPFTOS.exe
  C:\Windows\System\ibPFTOS.exe
  2⤵
  PID:13932
- C:\Windows\System\TnfAUlc.exe
  C:\Windows\System\TnfAUlc.exe
  2⤵
  PID:13952
- C:\Windows\System\mCZEmcq.exe
  C:\Windows\System\mCZEmcq.exe
  2⤵
  PID:13972
- C:\Windows\System\LDBkCrt.exe
  C:\Windows\System\LDBkCrt.exe
  2⤵
  PID:13988
- C:\Windows\System\ORFfpMx.exe
  C:\Windows\System\ORFfpMx.exe
  2⤵
  PID:14012
- C:\Windows\System\YaNZuen.exe
  C:\Windows\System\YaNZuen.exe
  2⤵
  PID:14028
- C:\Windows\System\lHvqnEN.exe
  C:\Windows\System\lHvqnEN.exe
  2⤵
  PID:14052
- C:\Windows\System\irIbsgN.exe
  C:\Windows\System\irIbsgN.exe
  2⤵
  PID:14072
- C:\Windows\System\GMGiFoB.exe
  C:\Windows\System\GMGiFoB.exe
  2⤵
  PID:14088
- C:\Windows\System\SEIePSd.exe
  C:\Windows\System\SEIePSd.exe
  2⤵
  PID:14104
- C:\Windows\System\GyEALzj.exe
  C:\Windows\System\GyEALzj.exe
  2⤵
  PID:14120
- C:\Windows\System\ZjqXTlg.exe
  C:\Windows\System\ZjqXTlg.exe
  2⤵
  PID:14140
- C:\Windows\System\RRnahpt.exe
  C:\Windows\System\RRnahpt.exe
  2⤵
  PID:14164
- C:\Windows\System\KnpGQLq.exe
  C:\Windows\System\KnpGQLq.exe
  2⤵
  PID:14136
- C:\Windows\System\OCvGrib.exe
  C:\Windows\System\OCvGrib.exe
  2⤵
  PID:14188
- C:\Windows\System\KznxuoF.exe
  C:\Windows\System\KznxuoF.exe
  2⤵
  PID:14224
- C:\Windows\System\eZzRODr.exe
  C:\Windows\System\eZzRODr.exe
  2⤵
  PID:13940
- C:\Windows\System\DgcnAYu.exe
  C:\Windows\System\DgcnAYu.exe
  2⤵
  PID:13984
- C:\Windows\System\TNyoUfc.exe
  C:\Windows\System\TNyoUfc.exe
  2⤵
  PID:14068
- C:\Windows\System\ZFZiVwP.exe
  C:\Windows\System\ZFZiVwP.exe
  2⤵
  PID:4980
- C:\Windows\System\NbKCajb.exe
  C:\Windows\System\NbKCajb.exe
  2⤵
  PID:13432
- C:\Windows\System\ekbRjpd.exe
  C:\Windows\System\ekbRjpd.exe
  2⤵
  PID:11892
- C:\Windows\System\zcnmSOG.exe
  C:\Windows\System\zcnmSOG.exe
  2⤵
  PID:10048
- C:\Windows\System\ExikUtJ.exe
  C:\Windows\System\ExikUtJ.exe
  2⤵
  PID:7048
- C:\Windows\System\fWFpiHm.exe
  C:\Windows\System\fWFpiHm.exe
  2⤵
  PID:13544
- C:\Windows\System\oUZmJOy.exe
  C:\Windows\System\oUZmJOy.exe
  2⤵
  PID:13816
- C:\Windows\System\EOSilPe.exe
  C:\Windows\System\EOSilPe.exe
  2⤵
  PID:13720
- C:\Windows\System\FqsnPOu.exe
  C:\Windows\System\FqsnPOu.exe
  2⤵
  PID:12884
- C:\Windows\System\KeRpcjq.exe
  C:\Windows\System\KeRpcjq.exe
  2⤵
  PID:14288
- C:\Windows\System\xrsYHSy.exe
  C:\Windows\System\xrsYHSy.exe
  2⤵
  PID:11772
- C:\Windows\System\lFhGTyM.exe
  C:\Windows\System\lFhGTyM.exe
  2⤵
  PID:14300
- C:\Windows\System\WAJVOZe.exe
  C:\Windows\System\WAJVOZe.exe
  2⤵
  PID:13448
- C:\Windows\System\MPHHeTs.exe
  C:\Windows\System\MPHHeTs.exe
  2⤵
  PID:12844
- C:\Windows\System\taVDbNg.exe
  C:\Windows\System\taVDbNg.exe
  2⤵
  PID:9528
- C:\Windows\System\rYhDqqU.exe
  C:\Windows\System\rYhDqqU.exe
  2⤵
  PID:13760
- C:\Windows\System\saNSTik.exe
  C:\Windows\System\saNSTik.exe
  2⤵
  PID:14332
- C:\Windows\System\GkYxofy.exe
  C:\Windows\System\GkYxofy.exe
  2⤵
  PID:12716
- C:\Windows\System\YhaJcAz.exe
  C:\Windows\System\YhaJcAz.exe
  2⤵
  PID:13756
- C:\Windows\System\FSaBNun.exe
  C:\Windows\System\FSaBNun.exe
  2⤵
  PID:11476
- C:\Windows\System\pjqaLap.exe
  C:\Windows\System\pjqaLap.exe
  2⤵
  PID:14348
- C:\Windows\System\IMVBnxb.exe
  C:\Windows\System\IMVBnxb.exe
  2⤵
  PID:14520
- C:\Windows\System\mVsCmQR.exe
  C:\Windows\System\mVsCmQR.exe
  2⤵
  PID:14548
- C:\Windows\System\LOdOcKH.exe
  C:\Windows\System\LOdOcKH.exe
  2⤵
  PID:14572
- C:\Windows\System\bvFOTXF.exe
  C:\Windows\System\bvFOTXF.exe
  2⤵
  PID:14600
- C:\Windows\System\DAJYFUq.exe
  C:\Windows\System\DAJYFUq.exe
  2⤵
  PID:14620
- C:\Windows\System\FxqJJah.exe
  C:\Windows\System\FxqJJah.exe
  2⤵
  PID:14640
- C:\Windows\System\LrqAcQu.exe
  C:\Windows\System\LrqAcQu.exe
  2⤵
  PID:14656
- C:\Windows\System\ltCuUGk.exe
  C:\Windows\System\ltCuUGk.exe
  2⤵
  PID:14672
- C:\Windows\System\mXeGXft.exe
  C:\Windows\System\mXeGXft.exe
  2⤵
  PID:14700
- C:\Windows\System\BGwtoIw.exe
  C:\Windows\System\BGwtoIw.exe
  2⤵
  PID:14736
- C:\Windows\System\tZnLAXU.exe
  C:\Windows\System\tZnLAXU.exe
  2⤵
  PID:14760
- C:\Windows\System\aImZHVP.exe
  C:\Windows\System\aImZHVP.exe
  2⤵
  PID:14784
- C:\Windows\System\AEQrTBl.exe
  C:\Windows\System\AEQrTBl.exe
  2⤵
  PID:14812
- C:\Windows\System\oWaTqJE.exe
  C:\Windows\System\oWaTqJE.exe
  2⤵
  PID:14828
- C:\Windows\System\XGYUqaj.exe
  C:\Windows\System\XGYUqaj.exe
  2⤵
  PID:14856
- C:\Windows\System\fNNQGeb.exe
  C:\Windows\System\fNNQGeb.exe
  2⤵
  PID:14880
- C:\Windows\System\sFkNgBK.exe
  C:\Windows\System\sFkNgBK.exe
  2⤵
  PID:14908
- C:\Windows\System\JrmYEOl.exe
  C:\Windows\System\JrmYEOl.exe
  2⤵
  PID:14928
- C:\Windows\System\fNRuoeN.exe
  C:\Windows\System\fNRuoeN.exe
  2⤵
  PID:14948
- C:\Windows\System\bRDlyRD.exe
  C:\Windows\System\bRDlyRD.exe
  2⤵
  PID:14972
- C:\Windows\System\fgGCqjn.exe
  C:\Windows\System\fgGCqjn.exe
  2⤵
  PID:15000
- C:\Windows\System\rUXmJEF.exe
  C:\Windows\System\rUXmJEF.exe
  2⤵
  PID:15016
- C:\Windows\System\CmeqOtr.exe
  C:\Windows\System\CmeqOtr.exe
  2⤵
  PID:15032
- C:\Windows\System\MfJrqPJ.exe
  C:\Windows\System\MfJrqPJ.exe
  2⤵
  PID:15052
- C:\Windows\System\HVZBzjF.exe
  C:\Windows\System\HVZBzjF.exe
  2⤵
  PID:15068
- C:\Windows\System\TLKPIIX.exe
  C:\Windows\System\TLKPIIX.exe
  2⤵
  PID:15092
- C:\Windows\System\lkKTnzW.exe
  C:\Windows\System\lkKTnzW.exe
  2⤵
  PID:15168
- C:\Windows\System\pCIvSQI.exe
  C:\Windows\System\pCIvSQI.exe
  2⤵
  PID:15192
- C:\Windows\System\YGqKLSJ.exe
  C:\Windows\System\YGqKLSJ.exe
  2⤵
  PID:15228
- C:\Windows\System\oKgniKi.exe
  C:\Windows\System\oKgniKi.exe
  2⤵
  PID:15256
- C:\Windows\System\pcCRWwn.exe
  C:\Windows\System\pcCRWwn.exe
  2⤵
  PID:15276
- C:\Windows\System\cyyCjTU.exe
  C:\Windows\System\cyyCjTU.exe
  2⤵
  PID:15300
- C:\Windows\System\HsFZCrp.exe
  C:\Windows\System\HsFZCrp.exe
  2⤵
  PID:15320
- C:\Windows\System\NuiVDkK.exe
  C:\Windows\System\NuiVDkK.exe
  2⤵
  PID:14744
- C:\Windows\System\ZOxHpDm.exe
  C:\Windows\System\ZOxHpDm.exe
  2⤵
  PID:14448
- C:\Windows\System\RVYGSYf.exe
  C:\Windows\System\RVYGSYf.exe
  2⤵
  PID:14824
- C:\Windows\System\jSryzyH.exe
  C:\Windows\System\jSryzyH.exe
  2⤵
  PID:14892
- C:\Windows\System\LQqpxCo.exe
  C:\Windows\System\LQqpxCo.exe
  2⤵
  PID:8180
- C:\Windows\System\GWOBEpT.exe
  C:\Windows\System\GWOBEpT.exe
  2⤵
  PID:14956
- C:\Windows\System\OWqKOVj.exe
  C:\Windows\System\OWqKOVj.exe
  2⤵
  PID:14992
- C:\Windows\System\CtWXzHR.exe
  C:\Windows\System\CtWXzHR.exe
  2⤵
  PID:14796
- C:\Windows\System\cxGJotK.exe
  C:\Windows\System\cxGJotK.exe
  2⤵
  PID:14916
- C:\Windows\System\IybKTGe.exe
  C:\Windows\System\IybKTGe.exe
  2⤵
  PID:13872
- C:\Windows\System\uUZxxGz.exe
  C:\Windows\System\uUZxxGz.exe
  2⤵
  PID:14220
- C:\Windows\System\kYLECmR.exe
  C:\Windows\System\kYLECmR.exe
  2⤵
  PID:14988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w0rwbbme.0io.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BXubGlQ.exe

Filesize
1.9MB

MD5
85ffa35b9483873122a3afc939f083f2

SHA1
23c5b95cdd9bf968ad4682c5ecc7cd30620aebed

SHA256
f011770235b580f1517ad2d03e58730042539b695481f3597b3276f924075109

SHA512
50563d7436e68fbe87fa054d90bad8406d91e98e331cd60052e9fb0b96eb185eefe7b6974de344dabb6a86185eacebe5d76a534ed34f4b540d828ec69dd8e83a

Download Submit
C:\Windows\System\DKfmzgi.exe

Filesize
1.9MB

MD5
29cc13e063ce9e65b39902d01718074a

SHA1
2050738bf48bf8956639d5929c0c13d88cde5086

SHA256
c75f2314e52859313ffbbca1ac0efd4451e514147058ac99934ad2331f7850b9

SHA512
5110c85927331096487c87d176b859a93e75c4306b58d9f27057f888fc7bdbc5bc840fcfdefcfcdde953d993df0a190e460f1d0442b31f73ceb85096115bbbde

Download Submit
C:\Windows\System\DUwGHpS.exe

Filesize
1.9MB

MD5
9675c0898d662fb528e26bd72bb9ffb3

SHA1
7d0e8de995ff142ec8d594a23a43fec4f509b552

SHA256
54c53ab7ab850bfff5822408a0811e5baa3902d468901362bd3b1397481abc01

SHA512
8928cd5348cfab4b5519fa3560dbf3f8717e55c71094c1e46e98a2990c5ef4533bdbd47329e489d38caeaa0e650de2a933349d911e05c28e731ff285d3a8f1bb

Download Submit
C:\Windows\System\EWxRuWi.exe

Filesize
1.9MB

MD5
3abb763cc014e73b67f0a4f0f82926d9

SHA1
2a9d0dd1c14d376f9f2a5a146857d1f29df8ccf1

SHA256
42dd8394c45ab698e36d50da0cdc3e08fee3d7e7ab3ca860ca00a6c5b3ea6638

SHA512
d01bdb36f43dfbafa00e0f17fd8a20b6db76fe6d59d18eb3bd949370703bef94d1c31ebe215db2b28d76d3318751f6a02ddd0dee727db680f05d529b79e71082

Download Submit
C:\Windows\System\FaikQst.exe

Filesize
1.9MB

MD5
0ceff94071c210c71d94927ce693c5f0

SHA1
56d303980459db05c73635a1e1ba8afc65749178

SHA256
a11279a721694589fc71df16470e55a581f494ba11a930cf550c4b5d502b0f7d

SHA512
d18e09dfb92a86ddcfd2cc0d2987eb9f432101d5b72b00aa9621615ee13d0fd98f32287096a7880822480c3c2a0e3f6c211a6094f0f0ee2e0f9831b64480a627

Download Submit
C:\Windows\System\FqCrlap.exe

Filesize
1.9MB

MD5
0675c78ee8f6b138ea454cdb9904ea3c

SHA1
1d5a714d2129b3d07fec157372b875b5ac375528

SHA256
676a5764255f142653910c81e2d7442f89b7245aec34dd677ab3ee630b500ef0

SHA512
686b8b2d91acc7da91c7885df01f29321de7374cd40b049fd60d44813665d588fddbfbcc94054cd515bb1c709036fc6e3fb413edab93538c11a370cdbdc8f7ab

Download Submit
C:\Windows\System\GKaosbD.exe

Filesize
1.9MB

MD5
eb68e8c220f56929e94b7dafc0423863

SHA1
85962e4d4c70afe3f47bca012267ed66394f4191

SHA256
6124f4e171c6d30359065208939648e97adc4bc02c30a1a044666245ff46edde

SHA512
e3321ea8bf16fb79c4d5c699d6e4dce3701757386145583becfcb62d46266ad22f1db4b19bbb6d7f7456f847bf549bba551291baea4b6df1ee9168e32063ee65

Download Submit
C:\Windows\System\GMDsGmN.exe

Filesize
1.9MB

MD5
100d1cc4dde99055e8dc177ee3beb403

SHA1
49554b2b19452652b631c7bd132cf7a0a636bbdb

SHA256
bd7b9694048e1c790211cc983baa46bf0629674437df3f7b7ef5b1e4101e79df

SHA512
a99ef90101fd661398089043f892fa62fcbd24a16e5eb9d7c061665fb3dda349a84535645a40e5cbd8a967ffa922109588bf39c0771c63a13ebe79bd986f75b6

Download Submit
C:\Windows\System\GzZthab.exe

Filesize
1.9MB

MD5
1a871a26aae5ea4aad896faacf7b19d1

SHA1
ed0412b1b83de14e96ac34c87fde2d9395775558

SHA256
f2f9c158cf827d79c8673e1b343273e5ffea2b97b32a3d5c3965ba32c3184d22

SHA512
bdeff066591330de92f50b7b6eb7edbf3b696be290fa06669b913543dda856b430e9ddc4d40013d392e0b1a6f8df8dfa22e063de3df8de55da7eeb7d28ae4d09

Download Submit
C:\Windows\System\HEQooNk.exe

Filesize
1.9MB

MD5
bae75f6cca607ac167bd1477b9cffc87

SHA1
7c1a1fc01f530f152978f49dc48999f83d477dae

SHA256
dfc03902dec5452a64f8bd63417db2a03ccc4215afc18a6159b1140d9272b5ce

SHA512
0aac9de5f977428a6a3b39360189bcbd122f6b853156b0543141b7c64efa85324983965acc48b1d6fcb44521b8d7c3130bc7b7733fcd3ac0c00451670a5b1b68

Download Submit
C:\Windows\System\JfVXFuP.exe

Filesize
1.9MB

MD5
c5ae692044cd5f746ba4d78b79258b8a

SHA1
458d3c7b2e77ffc6f62b7fff9c12bb65e8b34db8

SHA256
ec9ac02ada299aef98c4111cc30e368cb96c9889b51f01d717974e114fe08c23

SHA512
27b5ad5654a31c4d19dccc3deea5951a40c07f7ad71915e86eab2a41462abc70ff9afe2e7dff8694b6cfc4347a3eee1f6f26961f78403733c0abee783c8e25a7

Download Submit
C:\Windows\System\JnhIczD.exe

Filesize
1.9MB

MD5
73547ebbf31cbcf1da369a24761867a4

SHA1
9a94266340a135155c5a672cecab42cbf2c66563

SHA256
13d6d22e839cff3192cef4e6ed851e5dbd835c2eb224f8e7910719c8ecf7c03a

SHA512
bd1ea229b614868c6559dfca89a8d8c589feeacdede007449891730fd3b63252e8f60b6614220e6e37b2f9cdca2413751c0c67969da52e171c0cc42b96720216

Download Submit
C:\Windows\System\MGruTha.exe

Filesize
1.9MB

MD5
907f2ce9af37e927d2dfbeff2310ed09

SHA1
b86de7c0d39e1cedd0620f34ab62f11312b0596d

SHA256
6c894e5a81614225243caee40599b2b6c77da4db9f3c16e5d2bd593d4437c31e

SHA512
ca6cea89806813dcfa89f2331ea13153de4743bffd558a8adf35a2f20154ccb1cc23a029cc6c8a6ea0fbed8d789b367531fea71c48e892f7eea55c7d2fe5fb67

Download Submit
C:\Windows\System\RoHQjRO.exe

Filesize
1.9MB

MD5
2b0a8904ba64f0b6ee818dab0941861b

SHA1
d4cb0d87ec776823906d3609ca2c01fd9199b50c

SHA256
8a75e392406f84725290181f88b209820e193ddb14cd797fbf2954738f7cc6a7

SHA512
470498cccb41b568001f519136cc661f536aa91f524d40307da20b45807cab0c556fbbcb5f7475fc0d70abfe138166b67e9f5b8e698295238016bb5908ee4f3f

Download Submit
C:\Windows\System\RrPlWFx.exe

Filesize
1.9MB

MD5
eb0aa19385c905d79698aabbd6ce70bf

SHA1
1fd330d925245debfe6806d84aacc4a0a31096e5

SHA256
0e0e2780269da910a87e4d34c6431bea01aa6b920ec78e7323897f2ccb4b06bb

SHA512
89788fd446801461de0fa8478e12ab174099f7b19f3094c7bfb969c1a3bd5b92e229875bdf4e5c34ddf2248dac78bb3d1282dad7a13137a67f37efa493c2fd30

Download Submit
C:\Windows\System\TcngfGU.exe

Filesize
1.9MB

MD5
e96423135a507d61b59ed6741af75d39

SHA1
19d7fdff0d02ca2a8acc2b81f5632fc7f9ddcc3b

SHA256
70365bc085cdc94490b4bd4ed398db171ded915a8ecff3cb43ff3b4c189b5079

SHA512
989dfd951f8e45243b5105f5b00762b4d6eb810292b55092235ea967344913e6139e7453811e07fbd49ebd342ec884cf218ae89638ecd75ea79f2ba4f53090a5

Download Submit
C:\Windows\System\VxmgbLP.exe

Filesize
1.9MB

MD5
c3532e063d677bab2a9b3744e8c0fafc

SHA1
8b2488c6ffdab9785a08c5e8a6bdd74edbb82b51

SHA256
2d868d702a1d98d59b3cd14a57e2753c11e06239cabbfedb95e3936903a3e8dc

SHA512
109b49dafc27ccdf05e7260e30db9d6a4fb23a3c2552a6342de92be79652f46d7dda97dee79b0d1dc99151961ab117d4006a4a941ebf331a53f5342817849baa

Download Submit
C:\Windows\System\XTwoIol.exe

Filesize
1.9MB

MD5
50143f0c697e03fffcc2b6cf367aae6f

SHA1
8cc3103bc5096c3b66156ca166ffab3af7c7837e

SHA256
8bee3c3120076a14b4522bfe8e47d46101615c93d102672d64af56573f40ecb8

SHA512
b4722975cc4ea889106c3e13ba4371ff682dadda805c6ffb9ad3d4f0547fe045ac6f368d0bf527da52425c88e838e5bd3d4c46fbe94e64dbb4b8af78d297f338

Download Submit
C:\Windows\System\XtHBRDL.exe

Filesize
1.9MB

MD5
7f4a61ce6d9436dbbfbd36757c862bbc

SHA1
630d02c91cff2ec63b9c4f8a20b27f98e4fa59d5

SHA256
be4ad4e08ca681288368212dd6525974d7d695569eb5decb6774ebd622cb6e1e

SHA512
b2f67af05b27befb34b4d88c232507398f67f042d441fb2d8848a7aad0aaed994dd780b9dd30426d25c7444c5f5a8bebe6c3464c3662e9bc03599cc1e5b9ae88

Download Submit
C:\Windows\System\ajWRnQl.exe

Filesize
1.9MB

MD5
b1656f55730608e4fe80c079aae03a5a

SHA1
6cbb7682b01bd0829a11ab31baa03ce62a5ff8d8

SHA256
ffbc48a1b259c76e38cef82d2d0a8baeb48671fa8d4d03dc98bd98719139adea

SHA512
b1c8dc27a04b99760bbc6c94f02a0683849620023af67898c7c8f6e58c20d0987a6447c0bc261aa7eb34762b19c2791d179789496b03f54a783db2fc3f3ffbad

Download Submit
C:\Windows\System\eXunyOx.exe

Filesize
1.9MB

MD5
82cfeb226393a8077ffff8646da57951

SHA1
dfed075ad5a46b9427e992a8aae61d81f1a36565

SHA256
d400f10b508f760944f590788d6944390312a7db3752a9506d85d4aac1b25131

SHA512
b42372406bec9c13742a2043f08edb5010218947f75e2939d7b60a2091f9b772aa5a759416c420a4eae513981be89e54935b029a4d4f288fda62590854453f8a

Download Submit
C:\Windows\System\ekQqJpg.exe

Filesize
1.9MB

MD5
54a929e535125c42ebb788ccd3d99f0b

SHA1
f0ca242b518e6dd6d91914a7b8b30cfc627eae30

SHA256
ee649e08f672a331d1e83615b10656bc0e6a7be082337d2043d17b6b711251ab

SHA512
9a06ac7433989d23524e1bb4948777f780dd64d9b5caead04820d81095b8886816e61ae68cfb325ef05a276243c82d61c59f40b84c370cd298e3d9f3e1b0281e

Download Submit
C:\Windows\System\eupWpxT.exe

Filesize
1.9MB

MD5
b27c114b116a51c7d4ab7ca0932b71d7

SHA1
920789cf1f3f9309d7483569d145b5206113e028

SHA256
791fdec538ca3b1b4108de81b57413fc7f360b0475271407bc2a6d69c7e1ad7c

SHA512
4d1a741456e423d11a75852b2a45619b9bbaaafb80fa53435ecb5abc8c46fa5abe3c58a1c8e3c076eb2246fd4a802084b57982225200d37a53c2bd2dce051d40

Download Submit
C:\Windows\System\gIBnUGo.exe

Filesize
1.9MB

MD5
3b42e20723b5422abfc09937588cd8fe

SHA1
3bcb2040f6519a53e5346469d3a94332391c39df

SHA256
e6db3a674b7b5bf3411bc96869b0120f79e881428dd3945d5506b1e55cc61188

SHA512
1ec1b937ac48270de7667d5321d998c363367f04fdd78d67b35a86353d7885ed78d0a5c869a26629f8d0191dff5b588386ee2bc062ed5f657718dde5fe72ddd0

Download Submit
C:\Windows\System\gnhkdso.exe

Filesize
1.9MB

MD5
13d63a54a6f67968543e4c11930822f9

SHA1
853535c066ec83abcc8482833fa0ed0fa7642728

SHA256
4a21b586fa725f1e744fc70a4806b6d8a5a87a4ad6e97a70c83485f77756cdfc

SHA512
fc9e1132ba6f59252b153d7a42f220f6c2888eabecfe6668366fdd437286f2918b0914366a4db355f3515e4147ee0f309851c220c422f429b70b5833f3e152b3

Download Submit
C:\Windows\System\iSXBRab.exe

Filesize
1.9MB

MD5
989ec93cca1fecc7fb14594c384ff7b9

SHA1
a0395425703ec9295ab50842def3f47ecbfa7894

SHA256
1049d7b148beb3004c3729a356788620c31702c2d009e4050b8af2eaeaa7aad9

SHA512
de4e0872899803a0fd08b1fda3407c566c3ed10a2b083beba4c65b9b5ff800564cdcd71b8f635879f7cc7cdd0bba61cd735f478006c110efbb152ee689403306

Download Submit
C:\Windows\System\iUNQTSH.exe

Filesize
1.9MB

MD5
ac1c96b30518db2a13c35e81f34f85e9

SHA1
a33a7ba86b1a179d30db4f4d3a1c8ad8a3fc9867

SHA256
7c5e96466df8bf306c727e07efd6255e5a628dbda3c897a928738a7f769f2fa2

SHA512
0ae03d3cdeb7a2f2480172ab69699e0bdf4c9290a2ff82c2c8dc4a96ab7ae82efb2144b4a0b03aeeca0012bbec51286f4d8d086ac5a08b639d279767e263e8df

Download Submit
C:\Windows\System\imsIJQt.exe

Filesize
1.9MB

MD5
15bcff9f911068bd8da1913d42997112

SHA1
52e58adf4fb77968de1d7eaf8b074961b41f96a6

SHA256
c9bbbb4d126de1ffc7105739013dd526db7f0bdcb3b099e26c5c65872577738a

SHA512
d88d3e60f571beed0218e1d4a13870ff5ec5ca92a9cec8999bcad72e878b0c5cf9f57d9f5a3456b3c6480181922e5fad4926b1eec918e2d4388827b4c28954f6

Download Submit
C:\Windows\System\jGkuwpJ.exe

Filesize
1.9MB

MD5
0db63a15d61b761a4b8cdd48e82a27bf

SHA1
67b8118306a7b0b23c29d86fbd8ca6462164c16b

SHA256
3973e8f5a6fbce04267fafaaa388d12854f7064a5c59989aba22e7fa4f315240

SHA512
a44ddb72c7a05fcb882b51509271cb550c823f0f71d226c20392b87494134e0446a837a7dc81d759bfc8995c24fa79cadcb1131cb59b9918081e599873b48e70

Download Submit
C:\Windows\System\kfGKkrL.exe

Filesize
1.9MB

MD5
7ccb42ae52a651bd489e4390914128bb

SHA1
f4394552a35d256bad3bff034ee5c5947110ef5b

SHA256
243a1d62e287d0890c4afc4d01bf89c76761d18a4abbd94af6fc024388ca700c

SHA512
f6bd5358403446b3ad6b65915fa79fe70484a71e51209fa46a1af468d9de6fa393dbc5fe78a780957eaa726e9462ead46eaf479d0153f94307286db39234da1f

Download Submit
C:\Windows\System\lMarNTM.exe

Filesize
1.9MB

MD5
782b7d22714545090b876b030833f460

SHA1
e8678d87b5a91a4785ad95b083d8c51cdebb375d

SHA256
09c4c8e7081ebd3df0c34ec7cc073f58f174615d8c53d5fe9bb26a16bfb12cc9

SHA512
c2fb564ff519c585297fed745978361a61311c4d20b45448c86ba57c638882467bc022992544bec2674c608771c42e611d3c9c1043daab77569d9c8446142768

Download Submit
C:\Windows\System\lObkifz.exe

Filesize
1.9MB

MD5
dd45411ed2dd454a22984e6d9b241c7c

SHA1
3934f314b816f87cd23d9f3aee4c183de5716d4e

SHA256
7c12dc968fb614c8c8115da7b2948f6ce76500a50b00d6c730d9ca5f96898c1d

SHA512
236ad138ac5e8ca5aa30d329503d23db1f4c7aafb70bb0b6ef3fd4aae955df6da08cbb9962bbeba646f3af19e8cfa53c80fd2d9cf99131a3d93cef4a448b19e2

Download Submit
C:\Windows\System\mMrabPv.exe

Filesize
1.9MB

MD5
095a432d08d7d55923f5f0c5fcd45e12

SHA1
d983d986e0b14e886d639544989fb7f140cadcac

SHA256
548e392341c67fb87a4cb97cfeaf582b6ba79c8285173df61ede33ccf25aa1a3

SHA512
436a782a5ff9be7444605cba642b29c29d30848fe10015893622011b296f1985442d96a8a6ef2a509938bbad269ca3e2bb6baa7e1abeb940143668952936286c

Download Submit
C:\Windows\System\ohfmUgu.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\tYyWliP.exe

Filesize
1.9MB

MD5
d5f9064d85ada6e139f7a3fefb7df169

SHA1
baecf5f73813ef4bd7fff43e23df9da5111b4be1

SHA256
ed5768898fbc8afb28e524878c4234f53e05bd609ee1fff4de51fca49c25179d

SHA512
9e4ad71146e9fc7b042cea7cc36bc646d85067d901daad2fe43e90663b7428551d8335308b021377edc4ddb66b307d942298a65dc8fc14f8c1ef5bd054c69721

Download Submit
C:\Windows\System\wJZGFBB.exe

Filesize
1.9MB

MD5
ca722b7c516657c12f88cc5e97ecb24d

SHA1
433cbd8bd0cb78375b632baf6b2c448d112eaaba

SHA256
6845e70789b6941f75104fc9cdcb053995639d7d23386e3b4bfdb6b2e2bf7661

SHA512
8e957dd3572ae0ad0f0d3bd32ee853faa72f27ac25b9d6c8b16b00e7115fc68681f1df6fb81d791a906a216e2a366c9bfc3c7c411bc2f180a8ee99360a978edd

Download Submit
C:\Windows\System\xKlWfqZ.exe

Filesize
1.9MB

MD5
da4360934b294bc77ccfe80fb8496f9f

SHA1
2ec0b0ad643915a67964bfbf6b31ca6f83765974

SHA256
1d8ee7f47bda54a44e881533a71d11cd552d027b6dd14d7ad492fd5810478b58

SHA512
6ef140c90a4afe2b2254c699c6d8e9ad3203e2ac8f58c4fdff996efe8ffb1229f8138f2694c5be4a38190ff02cf03a861a756ab2deee442a2050e7f7ca5116bb

Download Submit
C:\Windows\System\xNnPiza.exe

Filesize
1.9MB

MD5
da5a46e1f03e0943bb73037d6bede8bf

SHA1
ae285115818c3723759d72e6c3ab0c6fc8422146

SHA256
f48bf1f0fc1b15c56389640cdc569f36e9a316331362bbc46c1f6005597bd611

SHA512
f04a7b395fb2659018bcb64a6a13d7da57c82a7b49d595b39f758798ef69e848a1b0c2218948dbe25800d9994ebc743718510df09b16a4f50d515388217707c7

Download Submit
C:\Windows\System\xuRGZXx.exe

Filesize
1.9MB

MD5
ba62d3e63559e19c15bda80154a9f011

SHA1
b210c3182d296238c7689e2e1d14e295a48dcce8

SHA256
2d759dbbe725a4c795c367a977cb0ca185f2e2159e664534a8c55255eda1599b

SHA512
ba91a3f5be56546fbbb9bfcaa3458d7cb8fb24024b26ef88810ff81331ed29257700e9b34718b276860b71a4e1da308386b656aa430de8d2c12d4d681bd49180

Download Submit
C:\Windows\System\yXnXqUD.exe

Filesize
1.9MB

MD5
3d78c9d2b9c5a8e7335c6ccf99cb46d7

SHA1
00f586a6789a4448965a1335020e3433f5cc2218

SHA256
3b535eb4551707abac4018b0fe5e01ec472da757be95d3efeb2390d336040885

SHA512
a17e5ece3655ef83fb889ee8ea9a063bbc190ef1e300502d7cd1b6f557afde6cbc23eba1f8e6dbb2c1c8912e1245be37e532650078bda4dee3f492a92bc0eb2c

Download Submit
C:\Windows\System\zaydJcD.exe

Filesize
1.9MB

MD5
56e0580458e6fcb7c999b9651eb57354

SHA1
038fa2179aa8c985f7c601ebc277c79da116c08a

SHA256
fe16f259e02ba01fd899adad8dd009fee455d6f929b2c93a80fa4ae2f9f0abc3

SHA512
57bb4699a5f32d8f1b9df2482f31f38cd5c2fa1fd8b9808a75ebd60dc6d7632c7c10314b75620afc28a2f2e799c488243981c78bd5ca36854a638dcae97c3c12

Download Submit
memory/428-270-0x0000019E783E0000-0x0000019E78402000-memory.dmp

Filesize
136KB

Download
memory/428-40-0x0000019E77990000-0x0000019E779A0000-memory.dmp

Filesize
64KB

Download
memory/428-313-0x00007FF8F36C0000-0x00007FF8F4181000-memory.dmp

Filesize
10.8MB

Download
memory/428-41-0x0000019E77990000-0x0000019E779A0000-memory.dmp

Filesize
64KB

Download
memory/784-39-0x00007FF671980000-0x00007FF671D72000-memory.dmp

Filesize
3.9MB

Download
memory/784-3348-0x00007FF671980000-0x00007FF671D72000-memory.dmp

Filesize
3.9MB

Download
memory/952-3390-0x00007FF764280000-0x00007FF764672000-memory.dmp

Filesize
3.9MB

Download
memory/952-228-0x00007FF764280000-0x00007FF764672000-memory.dmp

Filesize
3.9MB

Download
memory/1288-222-0x00007FF6F4A10000-0x00007FF6F4E02000-memory.dmp

Filesize
3.9MB

Download
memory/1288-3372-0x00007FF6F4A10000-0x00007FF6F4E02000-memory.dmp

Filesize
3.9MB

Download
memory/1576-3381-0x00007FF758170000-0x00007FF758562000-memory.dmp

Filesize
3.9MB

Download
memory/1576-227-0x00007FF758170000-0x00007FF758562000-memory.dmp

Filesize
3.9MB

Download
memory/2192-3351-0x00007FF717C90000-0x00007FF718082000-memory.dmp

Filesize
3.9MB

Download
memory/2192-201-0x00007FF717C90000-0x00007FF718082000-memory.dmp

Filesize
3.9MB

Download
memory/2472-219-0x00007FF6FC330000-0x00007FF6FC722000-memory.dmp

Filesize
3.9MB

Download
memory/2472-3360-0x00007FF6FC330000-0x00007FF6FC722000-memory.dmp

Filesize
3.9MB

Download
memory/2540-3355-0x00007FF690A60000-0x00007FF690E52000-memory.dmp

Filesize
3.9MB

Download
memory/2540-46-0x00007FF690A60000-0x00007FF690E52000-memory.dmp

Filesize
3.9MB

Download
memory/2848-0-0x00007FF7F84E0000-0x00007FF7F88D2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-1-0x000001D7CA3F0000-0x000001D7CA400000-memory.dmp

Filesize
64KB

Download
memory/2872-77-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp

Filesize
3.9MB

Download
memory/2872-3356-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp

Filesize
3.9MB

Download
memory/3068-23-0x00007FF67C630000-0x00007FF67CA22000-memory.dmp

Filesize
3.9MB

Download
memory/3068-3346-0x00007FF67C630000-0x00007FF67CA22000-memory.dmp

Filesize
3.9MB

Download
memory/3240-224-0x00007FF701EB0000-0x00007FF7022A2000-memory.dmp

Filesize
3.9MB

Download
memory/3240-3386-0x00007FF701EB0000-0x00007FF7022A2000-memory.dmp

Filesize
3.9MB

Download
memory/3336-379-0x00007FF625A80000-0x00007FF625E72000-memory.dmp

Filesize
3.9MB

Download
memory/3336-3352-0x00007FF625A80000-0x00007FF625E72000-memory.dmp

Filesize
3.9MB

Download
memory/3364-149-0x00007FF7DFD60000-0x00007FF7E0152000-memory.dmp

Filesize
3.9MB

Download
memory/3364-3358-0x00007FF7DFD60000-0x00007FF7E0152000-memory.dmp

Filesize
3.9MB

Download
memory/3716-552-0x00007FF7A15D0000-0x00007FF7A19C2000-memory.dmp

Filesize
3.9MB

Download
memory/3716-3371-0x00007FF7A15D0000-0x00007FF7A19C2000-memory.dmp

Filesize
3.9MB

Download
memory/3756-3365-0x00007FF6FCF10000-0x00007FF6FD302000-memory.dmp

Filesize
3.9MB

Download
memory/3756-218-0x00007FF6FCF10000-0x00007FF6FD302000-memory.dmp

Filesize
3.9MB

Download
memory/4016-3384-0x00007FF68BE30000-0x00007FF68C222000-memory.dmp

Filesize
3.9MB

Download
memory/4016-223-0x00007FF68BE30000-0x00007FF68C222000-memory.dmp

Filesize
3.9MB

Download
memory/4180-221-0x00007FF602140000-0x00007FF602532000-memory.dmp

Filesize
3.9MB

Download
memory/4180-3367-0x00007FF602140000-0x00007FF602532000-memory.dmp

Filesize
3.9MB

Download
memory/4260-220-0x00007FF79E5E0000-0x00007FF79E9D2000-memory.dmp

Filesize
3.9MB

Download
memory/4260-3363-0x00007FF79E5E0000-0x00007FF79E9D2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-3374-0x00007FF685470000-0x00007FF685862000-memory.dmp

Filesize
3.9MB

Download
memory/4616-392-0x00007FF685470000-0x00007FF685862000-memory.dmp

Filesize
3.9MB

Download
memory/4904-226-0x00007FF68A520000-0x00007FF68A912000-memory.dmp

Filesize
3.9MB

Download
memory/4904-3517-0x00007FF68A520000-0x00007FF68A912000-memory.dmp

Filesize
3.9MB

Download
memory/4940-225-0x00007FF79B410000-0x00007FF79B802000-memory.dmp

Filesize
3.9MB

Download
memory/4940-3520-0x00007FF79B410000-0x00007FF79B802000-memory.dmp

Filesize
3.9MB

Download
memory/5116-3368-0x00007FF696A60000-0x00007FF696E52000-memory.dmp

Filesize
3.9MB

Download
memory/5116-115-0x00007FF696A60000-0x00007FF696E52000-memory.dmp

Filesize
3.9MB

Download