xmrig | 7e33570c1a14089e66f7b543118da4541d677e8fae67227fe57e97a73883c846

Analysis

max time kernel
127s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
Size

1.4MB
MD5

11f6688130affd4ec9dc739d403f3d7f
SHA1

5ae33fb319062156886b21d0fcb4e26404507170
SHA256

7e33570c1a14089e66f7b543118da4541d677e8fae67227fe57e97a73883c846
SHA512

b9d135ed345fa11587ff240d1ca2b99c28c40b82daca5036c073ba35f8c6e090c26cd5c3aecd2828ef29b0085573e120e4019318923e0fd6f1528b305fbef15b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwm:Lz071uv4BPMkibTIA5CJR

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/1284-1573-0x00007FF647C40000-0x00007FF648032000-memory.dmp	xmrig
behavioral2/memory/1172-1362-0x00007FF658000000-0x00007FF6583F2000-memory.dmp	xmrig
behavioral2/memory/2320-1070-0x00007FF6AE5B0000-0x00007FF6AE9A2000-memory.dmp	xmrig
behavioral2/memory/3184-1069-0x00007FF6E06E0000-0x00007FF6E0AD2000-memory.dmp	xmrig
behavioral2/memory/4304-744-0x00007FF684070000-0x00007FF684462000-memory.dmp	xmrig
behavioral2/memory/1732-743-0x00007FF658C20000-0x00007FF659012000-memory.dmp	xmrig
behavioral2/memory/2272-741-0x00007FF6A9310000-0x00007FF6A9702000-memory.dmp	xmrig
behavioral2/memory/2516-740-0x00007FF7C0070000-0x00007FF7C0462000-memory.dmp	xmrig
behavioral2/memory/3968-739-0x00007FF632C60000-0x00007FF633052000-memory.dmp	xmrig
behavioral2/memory/4704-738-0x00007FF74BED0000-0x00007FF74C2C2000-memory.dmp	xmrig
behavioral2/memory/808-737-0x00007FF61FB30000-0x00007FF61FF22000-memory.dmp	xmrig
behavioral2/memory/1824-736-0x00007FF65CB70000-0x00007FF65CF62000-memory.dmp	xmrig
behavioral2/memory/2568-735-0x00007FF6FAD10000-0x00007FF6FB102000-memory.dmp	xmrig
behavioral2/memory/3008-320-0x00007FF7F2870000-0x00007FF7F2C62000-memory.dmp	xmrig
behavioral2/memory/2124-226-0x00007FF7A45A0000-0x00007FF7A4992000-memory.dmp	xmrig
behavioral2/memory/2392-168-0x00007FF79C330000-0x00007FF79C722000-memory.dmp	xmrig
behavioral2/memory/2032-110-0x00007FF628FC0000-0x00007FF6293B2000-memory.dmp	xmrig
behavioral2/memory/5056-57-0x00007FF73DA30000-0x00007FF73DE22000-memory.dmp	xmrig
behavioral2/memory/1416-2968-0x00007FF619470000-0x00007FF619862000-memory.dmp	xmrig
behavioral2/memory/3012-3036-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp	xmrig
behavioral2/memory/2032-3038-0x00007FF628FC0000-0x00007FF6293B2000-memory.dmp	xmrig
behavioral2/memory/5056-3078-0x00007FF73DA30000-0x00007FF73DE22000-memory.dmp	xmrig
behavioral2/memory/2568-3092-0x00007FF6FAD10000-0x00007FF6FB102000-memory.dmp	xmrig
behavioral2/memory/2124-3094-0x00007FF7A45A0000-0x00007FF7A4992000-memory.dmp	xmrig
behavioral2/memory/3184-3097-0x00007FF6E06E0000-0x00007FF6E0AD2000-memory.dmp	xmrig
behavioral2/memory/1824-3100-0x00007FF65CB70000-0x00007FF65CF62000-memory.dmp	xmrig
behavioral2/memory/808-3102-0x00007FF61FB30000-0x00007FF61FF22000-memory.dmp	xmrig
behavioral2/memory/3008-3090-0x00007FF7F2870000-0x00007FF7F2C62000-memory.dmp	xmrig
behavioral2/memory/2392-3080-0x00007FF79C330000-0x00007FF79C722000-memory.dmp	xmrig
behavioral2/memory/2988-3127-0x00007FF7EBB80000-0x00007FF7EBF72000-memory.dmp	xmrig
behavioral2/memory/5084-3129-0x00007FF7C25D0000-0x00007FF7C29C2000-memory.dmp	xmrig
behavioral2/memory/1172-3148-0x00007FF658000000-0x00007FF6583F2000-memory.dmp	xmrig
behavioral2/memory/4304-3142-0x00007FF684070000-0x00007FF684462000-memory.dmp	xmrig
behavioral2/memory/1732-3139-0x00007FF658C20000-0x00007FF659012000-memory.dmp	xmrig
behavioral2/memory/4704-3130-0x00007FF74BED0000-0x00007FF74C2C2000-memory.dmp	xmrig
behavioral2/memory/3968-3118-0x00007FF632C60000-0x00007FF633052000-memory.dmp	xmrig
behavioral2/memory/1284-3138-0x00007FF647C40000-0x00007FF648032000-memory.dmp	xmrig
behavioral2/memory/2320-3120-0x00007FF6AE5B0000-0x00007FF6AE9A2000-memory.dmp	xmrig
behavioral2/memory/2516-3116-0x00007FF7C0070000-0x00007FF7C0462000-memory.dmp	xmrig
behavioral2/memory/2272-3113-0x00007FF6A9310000-0x00007FF6A9702000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1228	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3012	RFIarSH.exe
5056	xWUonSk.exe
2032	npOsuNf.exe
2392	cMeYmhE.exe
2124	nWxmrGP.exe
3008	ZdxiuaR.exe
2568	ZyaYdcA.exe
2016	PJNhDbZ.exe
2884	BkaTVIS.exe
1824	mgNDokK.exe
808	wTeITPC.exe
4704	NssqZzU.exe
3968	zUKENBO.exe
2516	dFKjkYw.exe
2272	rSdAFJx.exe
1732	fgawTPj.exe
4304	fmXyqze.exe
3184	pYqvshJ.exe
2320	gErMYBJ.exe
2988	wrweqXo.exe
5084	YxShxHU.exe
1172	UQooUHF.exe
1284	nCPSeuU.exe
2536	yOADNSl.exe
4532	wUADVSY.exe
4348	NnfMDKT.exe
3688	UAQWVaz.exe
4068	HJZuyOk.exe
964	tafYlvZ.exe
4332	uEfDJKQ.exe
2296	emZBOwp.exe
992	lAwsTZg.exe
2692	yjKbWHB.exe
2316	JWAryJH.exe
4520	edxiVBU.exe
4768	YotFwLf.exe
3484	pFFdjFJ.exe
3700	OGRPOUO.exe
2120	RLaTNGI.exe
2248	bfkBpQq.exe
3300	nJGkRWB.exe
2856	RFgXQeZ.exe
512	NUHXdDj.exe
788	EsxrzWZ.exe
3552	bTEYMJy.exe
4072	dKwJUyE.exe
5076	mmQAxJi.exe
2780	ehkzkRl.exe
972	JMgEHwV.exe
2736	wSaupTR.exe
4772	skvwASL.exe
2912	qSpGTmG.exe
452	TIdNeHn.exe
2352	XmFioTb.exe
1848	LMnXSfY.exe
1004	ZEsRUVU.exe
2084	eYiCoRX.exe
4720	aSiWLcw.exe
4396	caoywuW.exe
1448	SRRVfhr.exe
2324	oWuoyOk.exe
1660	yGUKpVk.exe
1836	FiEhxMn.exe
2584	BhuUhdO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1416-0-0x00007FF619470000-0x00007FF619862000-memory.dmp	upx
behavioral2/files/0x000b000000023b79-5.dat	upx
behavioral2/files/0x000a000000023b7f-19.dat	upx
behavioral2/files/0x000a000000023b82-35.dat	upx
behavioral2/memory/1284-1573-0x00007FF647C40000-0x00007FF648032000-memory.dmp	upx
behavioral2/memory/1172-1362-0x00007FF658000000-0x00007FF6583F2000-memory.dmp	upx
behavioral2/memory/2320-1070-0x00007FF6AE5B0000-0x00007FF6AE9A2000-memory.dmp	upx
behavioral2/memory/3184-1069-0x00007FF6E06E0000-0x00007FF6E0AD2000-memory.dmp	upx
behavioral2/memory/4304-744-0x00007FF684070000-0x00007FF684462000-memory.dmp	upx
behavioral2/memory/1732-743-0x00007FF658C20000-0x00007FF659012000-memory.dmp	upx
behavioral2/memory/2272-741-0x00007FF6A9310000-0x00007FF6A9702000-memory.dmp	upx
behavioral2/memory/2516-740-0x00007FF7C0070000-0x00007FF7C0462000-memory.dmp	upx
behavioral2/memory/3968-739-0x00007FF632C60000-0x00007FF633052000-memory.dmp	upx
behavioral2/memory/4704-738-0x00007FF74BED0000-0x00007FF74C2C2000-memory.dmp	upx
behavioral2/memory/808-737-0x00007FF61FB30000-0x00007FF61FF22000-memory.dmp	upx
behavioral2/memory/1824-736-0x00007FF65CB70000-0x00007FF65CF62000-memory.dmp	upx
behavioral2/memory/2568-735-0x00007FF6FAD10000-0x00007FF6FB102000-memory.dmp	upx
behavioral2/memory/3008-320-0x00007FF7F2870000-0x00007FF7F2C62000-memory.dmp	upx
behavioral2/memory/2124-226-0x00007FF7A45A0000-0x00007FF7A4992000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-212.dat	upx
behavioral2/files/0x000a000000023ba4-209.dat	upx
behavioral2/files/0x000a000000023b9b-203.dat	upx
behavioral2/files/0x000a000000023b8f-199.dat	upx
behavioral2/files/0x000a000000023b8e-197.dat	upx
behavioral2/files/0x000a000000023ba3-196.dat	upx
behavioral2/files/0x000a000000023ba2-195.dat	upx
behavioral2/files/0x000a000000023ba1-192.dat	upx
behavioral2/files/0x000a000000023b97-188.dat	upx
behavioral2/files/0x000a000000023b8d-186.dat	upx
behavioral2/files/0x000a000000023b8c-181.dat	upx
behavioral2/files/0x000a000000023b8b-178.dat	upx
behavioral2/files/0x000a000000023b95-177.dat	upx
behavioral2/files/0x000a000000023b89-172.dat	upx
behavioral2/memory/2392-168-0x00007FF79C330000-0x00007FF79C722000-memory.dmp	upx
behavioral2/files/0x000a000000023b88-160.dat	upx
behavioral2/files/0x000a000000023ba0-157.dat	upx
behavioral2/files/0x000a000000023b9e-153.dat	upx
behavioral2/files/0x000a000000023b9d-151.dat	upx
behavioral2/files/0x000a000000023b9c-149.dat	upx
behavioral2/files/0x000a000000023b87-142.dat	upx
behavioral2/files/0x000a000000023b86-139.dat	upx
behavioral2/files/0x000a000000023b85-135.dat	upx
behavioral2/files/0x000a000000023b90-202.dat	upx
behavioral2/files/0x000a000000023b9a-133.dat	upx
behavioral2/files/0x000a000000023b99-132.dat	upx
behavioral2/files/0x000a000000023b98-131.dat	upx
behavioral2/files/0x000a000000023b83-127.dat	upx
behavioral2/files/0x000a000000023b96-118.dat	upx
behavioral2/files/0x000a000000023b94-116.dat	upx
behavioral2/files/0x000a000000023b9f-156.dat	upx
behavioral2/files/0x000a000000023b92-98.dat	upx
behavioral2/files/0x000a000000023b91-97.dat	upx
behavioral2/files/0x000a000000023b84-123.dat	upx
behavioral2/files/0x000a000000023b81-85.dat	upx
behavioral2/files/0x000a000000023b80-74.dat	upx
behavioral2/files/0x000a000000023b93-115.dat	upx
behavioral2/files/0x000a000000023b8a-71.dat	upx
behavioral2/memory/2032-110-0x00007FF628FC0000-0x00007FF6293B2000-memory.dmp	upx
behavioral2/memory/5056-57-0x00007FF73DA30000-0x00007FF73DE22000-memory.dmp	upx
behavioral2/files/0x000a000000023b7e-38.dat	upx
behavioral2/files/0x000a000000023b7d-21.dat	upx
behavioral2/memory/3012-14-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp	upx
behavioral2/memory/1416-2968-0x00007FF619470000-0x00007FF619862000-memory.dmp	upx
behavioral2/memory/3012-3036-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JqQvirb.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\XMnHXyw.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\OsmTkDu.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\FiEhxMn.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\vMFQKrf.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\TQqpCiW.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\QGcwtyo.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\AciCnRm.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\UuLZgqW.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\kCWVKsg.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\wDwiUOq.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\SvWanYY.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\uRSUrpC.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\AcfpzXR.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\JAiNmhR.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\CXKKSzm.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\xmVPMjf.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\QdrNmFz.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\GvlhOsv.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\EuKZpCd.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\BhColzD.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\lUXEzcN.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\yYguDsH.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\yWIvFMX.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\aPrZgWD.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\BhuUhdO.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\QmCmBJG.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\bUeWWsA.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\YUqmiJW.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\dInCeTJ.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\tRtlbYl.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\luSUMRL.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\NUHXdDj.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\VDXLWvl.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\SmzdaLe.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\vaLkWvK.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\aPvIlzd.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\UhhrNYR.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\jUkirwa.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\QNnnheX.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\FwpTqjs.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\HYvbOyF.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\bfeViGf.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\tsjStef.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\lckEGSQ.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\aguqIaS.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\DFNJkMs.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\acUBWmP.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\PlCWLNO.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\aFiNbJk.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\cMAYDjD.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\UQooUHF.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\VEoUiud.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\clLUTQJ.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\TsQBVPH.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\uecyOyE.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\MqIIZzA.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\OwSTlxQ.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\jMwlxIq.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\TjbRftK.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\VTVvKAL.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\jhcLtGP.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\OPXoIKr.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\fLwVwwc.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1228	powershell.exe
1228	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeLockMemoryPrivilege	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1228	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	86
PID 1416 wrote to memory of 1228	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	86
PID 1416 wrote to memory of 3012	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	87
PID 1416 wrote to memory of 3012	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	87
PID 1416 wrote to memory of 5056	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	88
PID 1416 wrote to memory of 5056	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	88
PID 1416 wrote to memory of 2032	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	89
PID 1416 wrote to memory of 2032	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	89
PID 1416 wrote to memory of 2392	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	90
PID 1416 wrote to memory of 2392	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	90
PID 1416 wrote to memory of 2124	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	91
PID 1416 wrote to memory of 2124	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	91
PID 1416 wrote to memory of 3008	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	92
PID 1416 wrote to memory of 3008	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	92
PID 1416 wrote to memory of 2568	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	93
PID 1416 wrote to memory of 2568	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	93
PID 1416 wrote to memory of 3184	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	94
PID 1416 wrote to memory of 3184	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	94
PID 1416 wrote to memory of 2016	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	95
PID 1416 wrote to memory of 2016	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	95
PID 1416 wrote to memory of 2884	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	96
PID 1416 wrote to memory of 2884	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	96
PID 1416 wrote to memory of 1824	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	97
PID 1416 wrote to memory of 1824	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	97
PID 1416 wrote to memory of 808	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	98
PID 1416 wrote to memory of 808	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	98
PID 1416 wrote to memory of 4704	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	99
PID 1416 wrote to memory of 4704	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	99
PID 1416 wrote to memory of 3968	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	100
PID 1416 wrote to memory of 3968	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	100
PID 1416 wrote to memory of 2516	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	101
PID 1416 wrote to memory of 2516	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	101
PID 1416 wrote to memory of 2272	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	102
PID 1416 wrote to memory of 2272	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	102
PID 1416 wrote to memory of 1732	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	103
PID 1416 wrote to memory of 1732	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	103
PID 1416 wrote to memory of 4304	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	104
PID 1416 wrote to memory of 4304	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	104
PID 1416 wrote to memory of 2320	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	105
PID 1416 wrote to memory of 2320	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	105
PID 1416 wrote to memory of 2988	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	106
PID 1416 wrote to memory of 2988	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	106
PID 1416 wrote to memory of 5084	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	107
PID 1416 wrote to memory of 5084	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	107
PID 1416 wrote to memory of 1172	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	108
PID 1416 wrote to memory of 1172	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	108
PID 1416 wrote to memory of 1284	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	109
PID 1416 wrote to memory of 1284	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	109
PID 1416 wrote to memory of 2536	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	110
PID 1416 wrote to memory of 2536	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	110
PID 1416 wrote to memory of 4532	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	111
PID 1416 wrote to memory of 4532	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	111
PID 1416 wrote to memory of 3484	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	112
PID 1416 wrote to memory of 3484	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	112
PID 1416 wrote to memory of 4348	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	113
PID 1416 wrote to memory of 4348	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	113
PID 1416 wrote to memory of 3688	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	114
PID 1416 wrote to memory of 3688	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	114
PID 1416 wrote to memory of 4068	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	115
PID 1416 wrote to memory of 4068	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	115
PID 1416 wrote to memory of 964	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	116
PID 1416 wrote to memory of 964	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	116
PID 1416 wrote to memory of 4332	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	117
PID 1416 wrote to memory of 4332	1416	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1228
- C:\Windows\System\RFIarSH.exe
  C:\Windows\System\RFIarSH.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\xWUonSk.exe
  C:\Windows\System\xWUonSk.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\npOsuNf.exe
  C:\Windows\System\npOsuNf.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\cMeYmhE.exe
  C:\Windows\System\cMeYmhE.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\nWxmrGP.exe
  C:\Windows\System\nWxmrGP.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\ZdxiuaR.exe
  C:\Windows\System\ZdxiuaR.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\ZyaYdcA.exe
  C:\Windows\System\ZyaYdcA.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\pYqvshJ.exe
  C:\Windows\System\pYqvshJ.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\PJNhDbZ.exe
  C:\Windows\System\PJNhDbZ.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\BkaTVIS.exe
  C:\Windows\System\BkaTVIS.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\mgNDokK.exe
  C:\Windows\System\mgNDokK.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\wTeITPC.exe
  C:\Windows\System\wTeITPC.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\NssqZzU.exe
  C:\Windows\System\NssqZzU.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\zUKENBO.exe
  C:\Windows\System\zUKENBO.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\dFKjkYw.exe
  C:\Windows\System\dFKjkYw.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\rSdAFJx.exe
  C:\Windows\System\rSdAFJx.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\fgawTPj.exe
  C:\Windows\System\fgawTPj.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\fmXyqze.exe
  C:\Windows\System\fmXyqze.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\gErMYBJ.exe
  C:\Windows\System\gErMYBJ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\wrweqXo.exe
  C:\Windows\System\wrweqXo.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\YxShxHU.exe
  C:\Windows\System\YxShxHU.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\UQooUHF.exe
  C:\Windows\System\UQooUHF.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\nCPSeuU.exe
  C:\Windows\System\nCPSeuU.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\yOADNSl.exe
  C:\Windows\System\yOADNSl.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\wUADVSY.exe
  C:\Windows\System\wUADVSY.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\pFFdjFJ.exe
  C:\Windows\System\pFFdjFJ.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\NnfMDKT.exe
  C:\Windows\System\NnfMDKT.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\UAQWVaz.exe
  C:\Windows\System\UAQWVaz.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\HJZuyOk.exe
  C:\Windows\System\HJZuyOk.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\tafYlvZ.exe
  C:\Windows\System\tafYlvZ.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\uEfDJKQ.exe
  C:\Windows\System\uEfDJKQ.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\emZBOwp.exe
  C:\Windows\System\emZBOwp.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\lAwsTZg.exe
  C:\Windows\System\lAwsTZg.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\yjKbWHB.exe
  C:\Windows\System\yjKbWHB.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\JWAryJH.exe
  C:\Windows\System\JWAryJH.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\edxiVBU.exe
  C:\Windows\System\edxiVBU.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\YotFwLf.exe
  C:\Windows\System\YotFwLf.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\OGRPOUO.exe
  C:\Windows\System\OGRPOUO.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\RLaTNGI.exe
  C:\Windows\System\RLaTNGI.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\bfkBpQq.exe
  C:\Windows\System\bfkBpQq.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\nJGkRWB.exe
  C:\Windows\System\nJGkRWB.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\RFgXQeZ.exe
  C:\Windows\System\RFgXQeZ.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\NUHXdDj.exe
  C:\Windows\System\NUHXdDj.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\EsxrzWZ.exe
  C:\Windows\System\EsxrzWZ.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\bTEYMJy.exe
  C:\Windows\System\bTEYMJy.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\dKwJUyE.exe
  C:\Windows\System\dKwJUyE.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\mmQAxJi.exe
  C:\Windows\System\mmQAxJi.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\ehkzkRl.exe
  C:\Windows\System\ehkzkRl.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\JMgEHwV.exe
  C:\Windows\System\JMgEHwV.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\wSaupTR.exe
  C:\Windows\System\wSaupTR.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\skvwASL.exe
  C:\Windows\System\skvwASL.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\qSpGTmG.exe
  C:\Windows\System\qSpGTmG.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\TIdNeHn.exe
  C:\Windows\System\TIdNeHn.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\XmFioTb.exe
  C:\Windows\System\XmFioTb.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\LMnXSfY.exe
  C:\Windows\System\LMnXSfY.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\ZEsRUVU.exe
  C:\Windows\System\ZEsRUVU.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\eYiCoRX.exe
  C:\Windows\System\eYiCoRX.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\mTMEqgq.exe
  C:\Windows\System\mTMEqgq.exe
  2⤵
  PID:4196
- C:\Windows\System\lhbjoPn.exe
  C:\Windows\System\lhbjoPn.exe
  2⤵
  PID:2444
- C:\Windows\System\bMMASRU.exe
  C:\Windows\System\bMMASRU.exe
  2⤵
  PID:2952
- C:\Windows\System\aSiWLcw.exe
  C:\Windows\System\aSiWLcw.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\caoywuW.exe
  C:\Windows\System\caoywuW.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\SRRVfhr.exe
  C:\Windows\System\SRRVfhr.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\oWuoyOk.exe
  C:\Windows\System\oWuoyOk.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\yGUKpVk.exe
  C:\Windows\System\yGUKpVk.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\FiEhxMn.exe
  C:\Windows\System\FiEhxMn.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\BhuUhdO.exe
  C:\Windows\System\BhuUhdO.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\Hlfnbeo.exe
  C:\Windows\System\Hlfnbeo.exe
  2⤵
  PID:5072
- C:\Windows\System\jqPeaeZ.exe
  C:\Windows\System\jqPeaeZ.exe
  2⤵
  PID:1268
- C:\Windows\System\AzMfnHR.exe
  C:\Windows\System\AzMfnHR.exe
  2⤵
  PID:2960
- C:\Windows\System\xfskfpj.exe
  C:\Windows\System\xfskfpj.exe
  2⤵
  PID:4276
- C:\Windows\System\yNvaaJJ.exe
  C:\Windows\System\yNvaaJJ.exe
  2⤵
  PID:3168
- C:\Windows\System\JtePPUW.exe
  C:\Windows\System\JtePPUW.exe
  2⤵
  PID:5008
- C:\Windows\System\zIXRrJm.exe
  C:\Windows\System\zIXRrJm.exe
  2⤵
  PID:3632
- C:\Windows\System\QNnnheX.exe
  C:\Windows\System\QNnnheX.exe
  2⤵
  PID:4188
- C:\Windows\System\gjCsQZE.exe
  C:\Windows\System\gjCsQZE.exe
  2⤵
  PID:4184
- C:\Windows\System\gUsxlcc.exe
  C:\Windows\System\gUsxlcc.exe
  2⤵
  PID:5148
- C:\Windows\System\SdJKDCq.exe
  C:\Windows\System\SdJKDCq.exe
  2⤵
  PID:5172
- C:\Windows\System\TjGfGQe.exe
  C:\Windows\System\TjGfGQe.exe
  2⤵
  PID:5192
- C:\Windows\System\NGfJrBS.exe
  C:\Windows\System\NGfJrBS.exe
  2⤵
  PID:5208
- C:\Windows\System\nNilEFs.exe
  C:\Windows\System\nNilEFs.exe
  2⤵
  PID:5224
- C:\Windows\System\aguqIaS.exe
  C:\Windows\System\aguqIaS.exe
  2⤵
  PID:5244
- C:\Windows\System\IRZVNAi.exe
  C:\Windows\System\IRZVNAi.exe
  2⤵
  PID:5264
- C:\Windows\System\MuEjIMi.exe
  C:\Windows\System\MuEjIMi.exe
  2⤵
  PID:5284
- C:\Windows\System\muIDyzG.exe
  C:\Windows\System\muIDyzG.exe
  2⤵
  PID:5304
- C:\Windows\System\uiXRAmW.exe
  C:\Windows\System\uiXRAmW.exe
  2⤵
  PID:5332
- C:\Windows\System\qjGwJaZ.exe
  C:\Windows\System\qjGwJaZ.exe
  2⤵
  PID:5348
- C:\Windows\System\GOOcnky.exe
  C:\Windows\System\GOOcnky.exe
  2⤵
  PID:5368
- C:\Windows\System\tCazVun.exe
  C:\Windows\System\tCazVun.exe
  2⤵
  PID:5392
- C:\Windows\System\ctSvSjn.exe
  C:\Windows\System\ctSvSjn.exe
  2⤵
  PID:5412
- C:\Windows\System\wMbklCb.exe
  C:\Windows\System\wMbklCb.exe
  2⤵
  PID:5432
- C:\Windows\System\JVIPCvO.exe
  C:\Windows\System\JVIPCvO.exe
  2⤵
  PID:5452
- C:\Windows\System\RjtlZcJ.exe
  C:\Windows\System\RjtlZcJ.exe
  2⤵
  PID:5472
- C:\Windows\System\HUTXHjy.exe
  C:\Windows\System\HUTXHjy.exe
  2⤵
  PID:5496
- C:\Windows\System\rinjTta.exe
  C:\Windows\System\rinjTta.exe
  2⤵
  PID:5516
- C:\Windows\System\bPKofcC.exe
  C:\Windows\System\bPKofcC.exe
  2⤵
  PID:5532
- C:\Windows\System\ZzuXhvr.exe
  C:\Windows\System\ZzuXhvr.exe
  2⤵
  PID:5560
- C:\Windows\System\WGRkBlE.exe
  C:\Windows\System\WGRkBlE.exe
  2⤵
  PID:5576
- C:\Windows\System\YiTqKZx.exe
  C:\Windows\System\YiTqKZx.exe
  2⤵
  PID:5596
- C:\Windows\System\hxojndO.exe
  C:\Windows\System\hxojndO.exe
  2⤵
  PID:5616
- C:\Windows\System\rdMrWFT.exe
  C:\Windows\System\rdMrWFT.exe
  2⤵
  PID:5632
- C:\Windows\System\ceurTnw.exe
  C:\Windows\System\ceurTnw.exe
  2⤵
  PID:5660
- C:\Windows\System\GowXSIA.exe
  C:\Windows\System\GowXSIA.exe
  2⤵
  PID:5680
- C:\Windows\System\kzkTtdu.exe
  C:\Windows\System\kzkTtdu.exe
  2⤵
  PID:5700
- C:\Windows\System\BGKSgIg.exe
  C:\Windows\System\BGKSgIg.exe
  2⤵
  PID:5720
- C:\Windows\System\pKeveEr.exe
  C:\Windows\System\pKeveEr.exe
  2⤵
  PID:5756
- C:\Windows\System\ZuKZarK.exe
  C:\Windows\System\ZuKZarK.exe
  2⤵
  PID:5776
- C:\Windows\System\ythcuUA.exe
  C:\Windows\System\ythcuUA.exe
  2⤵
  PID:5796
- C:\Windows\System\iWzMZqu.exe
  C:\Windows\System\iWzMZqu.exe
  2⤵
  PID:5812
- C:\Windows\System\FzTMhAp.exe
  C:\Windows\System\FzTMhAp.exe
  2⤵
  PID:5832
- C:\Windows\System\faKbQQD.exe
  C:\Windows\System\faKbQQD.exe
  2⤵
  PID:5848
- C:\Windows\System\faLmaTE.exe
  C:\Windows\System\faLmaTE.exe
  2⤵
  PID:5868
- C:\Windows\System\MTiTAhM.exe
  C:\Windows\System\MTiTAhM.exe
  2⤵
  PID:5888
- C:\Windows\System\MnoNYqA.exe
  C:\Windows\System\MnoNYqA.exe
  2⤵
  PID:5912
- C:\Windows\System\ExltGpA.exe
  C:\Windows\System\ExltGpA.exe
  2⤵
  PID:5932
- C:\Windows\System\tsjStef.exe
  C:\Windows\System\tsjStef.exe
  2⤵
  PID:5948
- C:\Windows\System\EHAQaJf.exe
  C:\Windows\System\EHAQaJf.exe
  2⤵
  PID:5976
- C:\Windows\System\QmCmBJG.exe
  C:\Windows\System\QmCmBJG.exe
  2⤵
  PID:6000
- C:\Windows\System\UutVjIO.exe
  C:\Windows\System\UutVjIO.exe
  2⤵
  PID:6020
- C:\Windows\System\lSNWwOZ.exe
  C:\Windows\System\lSNWwOZ.exe
  2⤵
  PID:6044
- C:\Windows\System\MGLCrCK.exe
  C:\Windows\System\MGLCrCK.exe
  2⤵
  PID:6060
- C:\Windows\System\DEHUkhm.exe
  C:\Windows\System\DEHUkhm.exe
  2⤵
  PID:6076
- C:\Windows\System\eqzZNBw.exe
  C:\Windows\System\eqzZNBw.exe
  2⤵
  PID:6096
- C:\Windows\System\paMmFro.exe
  C:\Windows\System\paMmFro.exe
  2⤵
  PID:6112
- C:\Windows\System\MLiUAWc.exe
  C:\Windows\System\MLiUAWc.exe
  2⤵
  PID:6136
- C:\Windows\System\PAUSczc.exe
  C:\Windows\System\PAUSczc.exe
  2⤵
  PID:3200
- C:\Windows\System\CNXEJPB.exe
  C:\Windows\System\CNXEJPB.exe
  2⤵
  PID:2980
- C:\Windows\System\nwtBGQH.exe
  C:\Windows\System\nwtBGQH.exe
  2⤵
  PID:2432
- C:\Windows\System\SjDEzHK.exe
  C:\Windows\System\SjDEzHK.exe
  2⤵
  PID:4280
- C:\Windows\System\SHlxhGJ.exe
  C:\Windows\System\SHlxhGJ.exe
  2⤵
  PID:4968
- C:\Windows\System\VgsDGJl.exe
  C:\Windows\System\VgsDGJl.exe
  2⤵
  PID:4588
- C:\Windows\System\xTUTRdZ.exe
  C:\Windows\System\xTUTRdZ.exe
  2⤵
  PID:2456
- C:\Windows\System\YcUNcuP.exe
  C:\Windows\System\YcUNcuP.exe
  2⤵
  PID:5260
- C:\Windows\System\yFnulFz.exe
  C:\Windows\System\yFnulFz.exe
  2⤵
  PID:5312
- C:\Windows\System\wjxNqsA.exe
  C:\Windows\System\wjxNqsA.exe
  2⤵
  PID:5344
- C:\Windows\System\jZXjDOJ.exe
  C:\Windows\System\jZXjDOJ.exe
  2⤵
  PID:4928
- C:\Windows\System\dmPqYyJ.exe
  C:\Windows\System\dmPqYyJ.exe
  2⤵
  PID:4024
- C:\Windows\System\qTRjsJp.exe
  C:\Windows\System\qTRjsJp.exe
  2⤵
  PID:4272
- C:\Windows\System\XcwTwwQ.exe
  C:\Windows\System\XcwTwwQ.exe
  2⤵
  PID:5524
- C:\Windows\System\UcVeZoT.exe
  C:\Windows\System\UcVeZoT.exe
  2⤵
  PID:1912
- C:\Windows\System\XxGAANE.exe
  C:\Windows\System\XxGAANE.exe
  2⤵
  PID:6148
- C:\Windows\System\KKQCCks.exe
  C:\Windows\System\KKQCCks.exe
  2⤵
  PID:6164
- C:\Windows\System\rWyAGPe.exe
  C:\Windows\System\rWyAGPe.exe
  2⤵
  PID:6184
- C:\Windows\System\wMTpYWX.exe
  C:\Windows\System\wMTpYWX.exe
  2⤵
  PID:6200
- C:\Windows\System\pySCRdS.exe
  C:\Windows\System\pySCRdS.exe
  2⤵
  PID:6220
- C:\Windows\System\GkwFcZZ.exe
  C:\Windows\System\GkwFcZZ.exe
  2⤵
  PID:6236
- C:\Windows\System\gIZgYjg.exe
  C:\Windows\System\gIZgYjg.exe
  2⤵
  PID:6252
- C:\Windows\System\GmvNLQJ.exe
  C:\Windows\System\GmvNLQJ.exe
  2⤵
  PID:6272
- C:\Windows\System\ZewcKEU.exe
  C:\Windows\System\ZewcKEU.exe
  2⤵
  PID:6288
- C:\Windows\System\WUyMBjP.exe
  C:\Windows\System\WUyMBjP.exe
  2⤵
  PID:6308
- C:\Windows\System\tZMKctD.exe
  C:\Windows\System\tZMKctD.exe
  2⤵
  PID:6324
- C:\Windows\System\qkmpjNT.exe
  C:\Windows\System\qkmpjNT.exe
  2⤵
  PID:6348
- C:\Windows\System\YDPLWwv.exe
  C:\Windows\System\YDPLWwv.exe
  2⤵
  PID:6364
- C:\Windows\System\DbGdcGk.exe
  C:\Windows\System\DbGdcGk.exe
  2⤵
  PID:6384
- C:\Windows\System\TPVwtmO.exe
  C:\Windows\System\TPVwtmO.exe
  2⤵
  PID:6400
- C:\Windows\System\IzdiEaK.exe
  C:\Windows\System\IzdiEaK.exe
  2⤵
  PID:6420
- C:\Windows\System\wDwiUOq.exe
  C:\Windows\System\wDwiUOq.exe
  2⤵
  PID:6440
- C:\Windows\System\YCvcqpp.exe
  C:\Windows\System\YCvcqpp.exe
  2⤵
  PID:6456
- C:\Windows\System\nUGUGiD.exe
  C:\Windows\System\nUGUGiD.exe
  2⤵
  PID:6472
- C:\Windows\System\cGpGTQD.exe
  C:\Windows\System\cGpGTQD.exe
  2⤵
  PID:6488
- C:\Windows\System\cWUfIQI.exe
  C:\Windows\System\cWUfIQI.exe
  2⤵
  PID:6520
- C:\Windows\System\PSEIjoe.exe
  C:\Windows\System\PSEIjoe.exe
  2⤵
  PID:6544
- C:\Windows\System\HkMJFVc.exe
  C:\Windows\System\HkMJFVc.exe
  2⤵
  PID:6560
- C:\Windows\System\LAHVZTO.exe
  C:\Windows\System\LAHVZTO.exe
  2⤵
  PID:6584
- C:\Windows\System\aYOjXzu.exe
  C:\Windows\System\aYOjXzu.exe
  2⤵
  PID:6600
- C:\Windows\System\lOfsttJ.exe
  C:\Windows\System\lOfsttJ.exe
  2⤵
  PID:6632
- C:\Windows\System\isZJvQu.exe
  C:\Windows\System\isZJvQu.exe
  2⤵
  PID:6656
- C:\Windows\System\amXwLdC.exe
  C:\Windows\System\amXwLdC.exe
  2⤵
  PID:6672
- C:\Windows\System\yCPyzjj.exe
  C:\Windows\System\yCPyzjj.exe
  2⤵
  PID:6688
- C:\Windows\System\TecCuTV.exe
  C:\Windows\System\TecCuTV.exe
  2⤵
  PID:6708
- C:\Windows\System\DPPuUTV.exe
  C:\Windows\System\DPPuUTV.exe
  2⤵
  PID:6724
- C:\Windows\System\zmACqtk.exe
  C:\Windows\System\zmACqtk.exe
  2⤵
  PID:6744
- C:\Windows\System\mmwSpHW.exe
  C:\Windows\System\mmwSpHW.exe
  2⤵
  PID:6764
- C:\Windows\System\vMFQKrf.exe
  C:\Windows\System\vMFQKrf.exe
  2⤵
  PID:6784
- C:\Windows\System\vmzyYFO.exe
  C:\Windows\System\vmzyYFO.exe
  2⤵
  PID:6824
- C:\Windows\System\lVUEmFv.exe
  C:\Windows\System\lVUEmFv.exe
  2⤵
  PID:6868
- C:\Windows\System\KibPCMK.exe
  C:\Windows\System\KibPCMK.exe
  2⤵
  PID:6900
- C:\Windows\System\UiBIJyo.exe
  C:\Windows\System\UiBIJyo.exe
  2⤵
  PID:6920
- C:\Windows\System\IrsEjYt.exe
  C:\Windows\System\IrsEjYt.exe
  2⤵
  PID:6936
- C:\Windows\System\zRIaAtx.exe
  C:\Windows\System\zRIaAtx.exe
  2⤵
  PID:6960
- C:\Windows\System\ZERaWHq.exe
  C:\Windows\System\ZERaWHq.exe
  2⤵
  PID:6992
- C:\Windows\System\gvfoqxS.exe
  C:\Windows\System\gvfoqxS.exe
  2⤵
  PID:7008
- C:\Windows\System\sLrcwMB.exe
  C:\Windows\System\sLrcwMB.exe
  2⤵
  PID:7028
- C:\Windows\System\CTjOGoS.exe
  C:\Windows\System\CTjOGoS.exe
  2⤵
  PID:7044
- C:\Windows\System\tTQHeRz.exe
  C:\Windows\System\tTQHeRz.exe
  2⤵
  PID:7064
- C:\Windows\System\cnPWhOR.exe
  C:\Windows\System\cnPWhOR.exe
  2⤵
  PID:7084
- C:\Windows\System\jiqNULF.exe
  C:\Windows\System\jiqNULF.exe
  2⤵
  PID:7104
- C:\Windows\System\SIJVlnJ.exe
  C:\Windows\System\SIJVlnJ.exe
  2⤵
  PID:7128
- C:\Windows\System\PCnJAQp.exe
  C:\Windows\System\PCnJAQp.exe
  2⤵
  PID:7144
- C:\Windows\System\xKDAeLU.exe
  C:\Windows\System\xKDAeLU.exe
  2⤵
  PID:3340
- C:\Windows\System\VupcMqg.exe
  C:\Windows\System\VupcMqg.exe
  2⤵
  PID:4568
- C:\Windows\System\GBJEVni.exe
  C:\Windows\System\GBJEVni.exe
  2⤵
  PID:5708
- C:\Windows\System\AgnCCit.exe
  C:\Windows\System\AgnCCit.exe
  2⤵
  PID:5732
- C:\Windows\System\XPbZIpb.exe
  C:\Windows\System\XPbZIpb.exe
  2⤵
  PID:664
- C:\Windows\System\QdrNmFz.exe
  C:\Windows\System\QdrNmFz.exe
  2⤵
  PID:5804
- C:\Windows\System\aVlEnKz.exe
  C:\Windows\System\aVlEnKz.exe
  2⤵
  PID:5876
- C:\Windows\System\hwqHUjZ.exe
  C:\Windows\System\hwqHUjZ.exe
  2⤵
  PID:5924
- C:\Windows\System\eDaGTyS.exe
  C:\Windows\System\eDaGTyS.exe
  2⤵
  PID:4476
- C:\Windows\System\tIOXuxr.exe
  C:\Windows\System\tIOXuxr.exe
  2⤵
  PID:5136
- C:\Windows\System\RiUwHWd.exe
  C:\Windows\System\RiUwHWd.exe
  2⤵
  PID:5156
- C:\Windows\System\DXbvVrO.exe
  C:\Windows\System\DXbvVrO.exe
  2⤵
  PID:3808
- C:\Windows\System\OjQLcKZ.exe
  C:\Windows\System\OjQLcKZ.exe
  2⤵
  PID:4356
- C:\Windows\System\DauWitl.exe
  C:\Windows\System\DauWitl.exe
  2⤵
  PID:5380
- C:\Windows\System\OJoYvyQ.exe
  C:\Windows\System\OJoYvyQ.exe
  2⤵
  PID:1020
- C:\Windows\System\kxqKdCX.exe
  C:\Windows\System\kxqKdCX.exe
  2⤵
  PID:3844
- C:\Windows\System\ufaaqdP.exe
  C:\Windows\System\ufaaqdP.exe
  2⤵
  PID:5588
- C:\Windows\System\LMqCePX.exe
  C:\Windows\System\LMqCePX.exe
  2⤵
  PID:5612
- C:\Windows\System\ogcRIuP.exe
  C:\Windows\System\ogcRIuP.exe
  2⤵
  PID:408
- C:\Windows\System\GzRtfvu.exe
  C:\Windows\System\GzRtfvu.exe
  2⤵
  PID:6192
- C:\Windows\System\qzvjfBU.exe
  C:\Windows\System\qzvjfBU.exe
  2⤵
  PID:7192
- C:\Windows\System\ZiXvOml.exe
  C:\Windows\System\ZiXvOml.exe
  2⤵
  PID:7208
- C:\Windows\System\MSdlCdS.exe
  C:\Windows\System\MSdlCdS.exe
  2⤵
  PID:7232
- C:\Windows\System\NwaohIe.exe
  C:\Windows\System\NwaohIe.exe
  2⤵
  PID:7248
- C:\Windows\System\taoESKj.exe
  C:\Windows\System\taoESKj.exe
  2⤵
  PID:7276
- C:\Windows\System\GiZeImn.exe
  C:\Windows\System\GiZeImn.exe
  2⤵
  PID:7292
- C:\Windows\System\zocEvjI.exe
  C:\Windows\System\zocEvjI.exe
  2⤵
  PID:7316
- C:\Windows\System\ntIFvoh.exe
  C:\Windows\System\ntIFvoh.exe
  2⤵
  PID:7332
- C:\Windows\System\TDPtMBV.exe
  C:\Windows\System\TDPtMBV.exe
  2⤵
  PID:7352
- C:\Windows\System\PkAOAKM.exe
  C:\Windows\System\PkAOAKM.exe
  2⤵
  PID:7368
- C:\Windows\System\yBIGGzt.exe
  C:\Windows\System\yBIGGzt.exe
  2⤵
  PID:7400
- C:\Windows\System\btMLwgO.exe
  C:\Windows\System\btMLwgO.exe
  2⤵
  PID:7420
- C:\Windows\System\jEKuWpp.exe
  C:\Windows\System\jEKuWpp.exe
  2⤵
  PID:7436
- C:\Windows\System\RCeOpJg.exe
  C:\Windows\System\RCeOpJg.exe
  2⤵
  PID:7456
- C:\Windows\System\WYWzpYv.exe
  C:\Windows\System\WYWzpYv.exe
  2⤵
  PID:7476
- C:\Windows\System\aJlUHui.exe
  C:\Windows\System\aJlUHui.exe
  2⤵
  PID:7496
- C:\Windows\System\RNOTfek.exe
  C:\Windows\System\RNOTfek.exe
  2⤵
  PID:7516
- C:\Windows\System\AkSXyZN.exe
  C:\Windows\System\AkSXyZN.exe
  2⤵
  PID:7536
- C:\Windows\System\aQORDnj.exe
  C:\Windows\System\aQORDnj.exe
  2⤵
  PID:7556
- C:\Windows\System\VptXGla.exe
  C:\Windows\System\VptXGla.exe
  2⤵
  PID:7576
- C:\Windows\System\ZjXGMxq.exe
  C:\Windows\System\ZjXGMxq.exe
  2⤵
  PID:7592
- C:\Windows\System\pNtExfx.exe
  C:\Windows\System\pNtExfx.exe
  2⤵
  PID:7620
- C:\Windows\System\YOqYwCq.exe
  C:\Windows\System\YOqYwCq.exe
  2⤵
  PID:7636
- C:\Windows\System\ibKHCJd.exe
  C:\Windows\System\ibKHCJd.exe
  2⤵
  PID:7652
- C:\Windows\System\dTBsZCG.exe
  C:\Windows\System\dTBsZCG.exe
  2⤵
  PID:7676
- C:\Windows\System\RhKyynY.exe
  C:\Windows\System\RhKyynY.exe
  2⤵
  PID:7692
- C:\Windows\System\SmzdaLe.exe
  C:\Windows\System\SmzdaLe.exe
  2⤵
  PID:7712
- C:\Windows\System\TpeDrgB.exe
  C:\Windows\System\TpeDrgB.exe
  2⤵
  PID:7732
- C:\Windows\System\INPVQpH.exe
  C:\Windows\System\INPVQpH.exe
  2⤵
  PID:7760
- C:\Windows\System\SzpzkJu.exe
  C:\Windows\System\SzpzkJu.exe
  2⤵
  PID:7784
- C:\Windows\System\nqCQdAZ.exe
  C:\Windows\System\nqCQdAZ.exe
  2⤵
  PID:7800
- C:\Windows\System\ipIQsho.exe
  C:\Windows\System\ipIQsho.exe
  2⤵
  PID:7820
- C:\Windows\System\przGRpy.exe
  C:\Windows\System\przGRpy.exe
  2⤵
  PID:7856
- C:\Windows\System\OYYzezO.exe
  C:\Windows\System\OYYzezO.exe
  2⤵
  PID:7872
- C:\Windows\System\AXYEIld.exe
  C:\Windows\System\AXYEIld.exe
  2⤵
  PID:7892
- C:\Windows\System\vCDYUmC.exe
  C:\Windows\System\vCDYUmC.exe
  2⤵
  PID:7912
- C:\Windows\System\qzvGfXV.exe
  C:\Windows\System\qzvGfXV.exe
  2⤵
  PID:7936
- C:\Windows\System\ahUImaJ.exe
  C:\Windows\System\ahUImaJ.exe
  2⤵
  PID:7952
- C:\Windows\System\vfDYOiC.exe
  C:\Windows\System\vfDYOiC.exe
  2⤵
  PID:7972
- C:\Windows\System\NtdBRrG.exe
  C:\Windows\System\NtdBRrG.exe
  2⤵
  PID:7996
- C:\Windows\System\yMFUJfc.exe
  C:\Windows\System\yMFUJfc.exe
  2⤵
  PID:8020
- C:\Windows\System\yRCebpd.exe
  C:\Windows\System\yRCebpd.exe
  2⤵
  PID:8036
- C:\Windows\System\FucSKFZ.exe
  C:\Windows\System\FucSKFZ.exe
  2⤵
  PID:8064
- C:\Windows\System\bratGSZ.exe
  C:\Windows\System\bratGSZ.exe
  2⤵
  PID:8080
- C:\Windows\System\JUeOAcZ.exe
  C:\Windows\System\JUeOAcZ.exe
  2⤵
  PID:8096
- C:\Windows\System\mmudUME.exe
  C:\Windows\System\mmudUME.exe
  2⤵
  PID:8120
- C:\Windows\System\fneHvRc.exe
  C:\Windows\System\fneHvRc.exe
  2⤵
  PID:8140
- C:\Windows\System\hxSKuwj.exe
  C:\Windows\System\hxSKuwj.exe
  2⤵
  PID:8160
- C:\Windows\System\tNkDyXN.exe
  C:\Windows\System\tNkDyXN.exe
  2⤵
  PID:8180
- C:\Windows\System\tIISVNE.exe
  C:\Windows\System\tIISVNE.exe
  2⤵
  PID:6208
- C:\Windows\System\pyWuddP.exe
  C:\Windows\System\pyWuddP.exe
  2⤵
  PID:1868
- C:\Windows\System\nOOUezu.exe
  C:\Windows\System\nOOUezu.exe
  2⤵
  PID:6296
- C:\Windows\System\BOAuWha.exe
  C:\Windows\System\BOAuWha.exe
  2⤵
  PID:5808
- C:\Windows\System\lgWfOdX.exe
  C:\Windows\System\lgWfOdX.exe
  2⤵
  PID:6416
- C:\Windows\System\suuYJLJ.exe
  C:\Windows\System\suuYJLJ.exe
  2⤵
  PID:5128
- C:\Windows\System\EwiojOE.exe
  C:\Windows\System\EwiojOE.exe
  2⤵
  PID:6720
- C:\Windows\System\GaSnOzM.exe
  C:\Windows\System\GaSnOzM.exe
  2⤵
  PID:5200
- C:\Windows\System\PVlcTTu.exe
  C:\Windows\System\PVlcTTu.exe
  2⤵
  PID:5256
- C:\Windows\System\jGvUeJK.exe
  C:\Windows\System\jGvUeJK.exe
  2⤵
  PID:6860
- C:\Windows\System\QPzCsvG.exe
  C:\Windows\System\QPzCsvG.exe
  2⤵
  PID:6888
- C:\Windows\System\wQkQCsD.exe
  C:\Windows\System\wQkQCsD.exe
  2⤵
  PID:4540
- C:\Windows\System\JWlZjiW.exe
  C:\Windows\System\JWlZjiW.exe
  2⤵
  PID:7092
- C:\Windows\System\NuXHWqX.exe
  C:\Windows\System\NuXHWqX.exe
  2⤵
  PID:5484
- C:\Windows\System\mYIRKXk.exe
  C:\Windows\System\mYIRKXk.exe
  2⤵
  PID:8212
- C:\Windows\System\zTAEYAD.exe
  C:\Windows\System\zTAEYAD.exe
  2⤵
  PID:8432
- C:\Windows\System\DJDZqmt.exe
  C:\Windows\System\DJDZqmt.exe
  2⤵
  PID:8448
- C:\Windows\System\gRMZKVV.exe
  C:\Windows\System\gRMZKVV.exe
  2⤵
  PID:8464
- C:\Windows\System\VTVvKAL.exe
  C:\Windows\System\VTVvKAL.exe
  2⤵
  PID:8480
- C:\Windows\System\PFudAgg.exe
  C:\Windows\System\PFudAgg.exe
  2⤵
  PID:8496
- C:\Windows\System\JIHWotQ.exe
  C:\Windows\System\JIHWotQ.exe
  2⤵
  PID:8512
- C:\Windows\System\xurTJAc.exe
  C:\Windows\System\xurTJAc.exe
  2⤵
  PID:8528
- C:\Windows\System\XPowxSl.exe
  C:\Windows\System\XPowxSl.exe
  2⤵
  PID:8544
- C:\Windows\System\PelhzoK.exe
  C:\Windows\System\PelhzoK.exe
  2⤵
  PID:8560
- C:\Windows\System\LHRMxGP.exe
  C:\Windows\System\LHRMxGP.exe
  2⤵
  PID:8576
- C:\Windows\System\TPECNql.exe
  C:\Windows\System\TPECNql.exe
  2⤵
  PID:8600
- C:\Windows\System\TBVLMWJ.exe
  C:\Windows\System\TBVLMWJ.exe
  2⤵
  PID:8616
- C:\Windows\System\caxxOgD.exe
  C:\Windows\System\caxxOgD.exe
  2⤵
  PID:8640
- C:\Windows\System\JhhmViY.exe
  C:\Windows\System\JhhmViY.exe
  2⤵
  PID:8660
- C:\Windows\System\pUtLilP.exe
  C:\Windows\System\pUtLilP.exe
  2⤵
  PID:8680
- C:\Windows\System\OkdvbXy.exe
  C:\Windows\System\OkdvbXy.exe
  2⤵
  PID:8700
- C:\Windows\System\HGNlCRC.exe
  C:\Windows\System\HGNlCRC.exe
  2⤵
  PID:8724
- C:\Windows\System\gSWEaNf.exe
  C:\Windows\System\gSWEaNf.exe
  2⤵
  PID:8740
- C:\Windows\System\RYgemBK.exe
  C:\Windows\System\RYgemBK.exe
  2⤵
  PID:8760
- C:\Windows\System\GclisIx.exe
  C:\Windows\System\GclisIx.exe
  2⤵
  PID:8776
- C:\Windows\System\fDrWTnu.exe
  C:\Windows\System\fDrWTnu.exe
  2⤵
  PID:8796
- C:\Windows\System\GGhkMbS.exe
  C:\Windows\System\GGhkMbS.exe
  2⤵
  PID:8816
- C:\Windows\System\vpUjLLZ.exe
  C:\Windows\System\vpUjLLZ.exe
  2⤵
  PID:8836
- C:\Windows\System\RkKtnFE.exe
  C:\Windows\System\RkKtnFE.exe
  2⤵
  PID:8852
- C:\Windows\System\TjbRftK.exe
  C:\Windows\System\TjbRftK.exe
  2⤵
  PID:8872
- C:\Windows\System\zaPyCfG.exe
  C:\Windows\System\zaPyCfG.exe
  2⤵
  PID:8892
- C:\Windows\System\hAllTgt.exe
  C:\Windows\System\hAllTgt.exe
  2⤵
  PID:8912
- C:\Windows\System\UWiAAWX.exe
  C:\Windows\System\UWiAAWX.exe
  2⤵
  PID:8932
- C:\Windows\System\XWZPPlQ.exe
  C:\Windows\System\XWZPPlQ.exe
  2⤵
  PID:8948
- C:\Windows\System\THqZVSE.exe
  C:\Windows\System\THqZVSE.exe
  2⤵
  PID:8972
- C:\Windows\System\aRaMnSX.exe
  C:\Windows\System\aRaMnSX.exe
  2⤵
  PID:8988
- C:\Windows\System\tERnvdF.exe
  C:\Windows\System\tERnvdF.exe
  2⤵
  PID:9012
- C:\Windows\System\amSLzpV.exe
  C:\Windows\System\amSLzpV.exe
  2⤵
  PID:9028
- C:\Windows\System\UjbgvGP.exe
  C:\Windows\System\UjbgvGP.exe
  2⤵
  PID:9048
- C:\Windows\System\TFwzIwi.exe
  C:\Windows\System\TFwzIwi.exe
  2⤵
  PID:9064
- C:\Windows\System\CbbIRwB.exe
  C:\Windows\System\CbbIRwB.exe
  2⤵
  PID:9080
- C:\Windows\System\HcHSisF.exe
  C:\Windows\System\HcHSisF.exe
  2⤵
  PID:9100
- C:\Windows\System\DXlJhCM.exe
  C:\Windows\System\DXlJhCM.exe
  2⤵
  PID:9120
- C:\Windows\System\hANfFrO.exe
  C:\Windows\System\hANfFrO.exe
  2⤵
  PID:9136
- C:\Windows\System\zHJhymG.exe
  C:\Windows\System\zHJhymG.exe
  2⤵
  PID:9152
- C:\Windows\System\xUsqzAD.exe
  C:\Windows\System\xUsqzAD.exe
  2⤵
  PID:9172
- C:\Windows\System\kdIpfnV.exe
  C:\Windows\System\kdIpfnV.exe
  2⤵
  PID:9192
- C:\Windows\System\PIsDrql.exe
  C:\Windows\System\PIsDrql.exe
  2⤵
  PID:9208
- C:\Windows\System\InCQKMU.exe
  C:\Windows\System\InCQKMU.exe
  2⤵
  PID:5572
- C:\Windows\System\kHtKmcw.exe
  C:\Windows\System\kHtKmcw.exe
  2⤵
  PID:5628
- C:\Windows\System\qfXrIgn.exe
  C:\Windows\System\qfXrIgn.exe
  2⤵
  PID:5784
- C:\Windows\System\owmULUm.exe
  C:\Windows\System\owmULUm.exe
  2⤵
  PID:5900
- C:\Windows\System\lCYXmom.exe
  C:\Windows\System\lCYXmom.exe
  2⤵
  PID:5996
- C:\Windows\System\TQqpCiW.exe
  C:\Windows\System\TQqpCiW.exe
  2⤵
  PID:6072
- C:\Windows\System\amDTKdq.exe
  C:\Windows\System\amDTKdq.exe
  2⤵
  PID:3696
- C:\Windows\System\XkmVJyx.exe
  C:\Windows\System\XkmVJyx.exe
  2⤵
  PID:4384
- C:\Windows\System\OnHFMYT.exe
  C:\Windows\System\OnHFMYT.exe
  2⤵
  PID:3232
- C:\Windows\System\TYGYSmF.exe
  C:\Windows\System\TYGYSmF.exe
  2⤵
  PID:3428
- C:\Windows\System\oFmnLGk.exe
  C:\Windows\System\oFmnLGk.exe
  2⤵
  PID:5360
- C:\Windows\System\bUeWWsA.exe
  C:\Windows\System\bUeWWsA.exe
  2⤵
  PID:2436
- C:\Windows\System\ctqrdTw.exe
  C:\Windows\System\ctqrdTw.exe
  2⤵
  PID:6160
- C:\Windows\System\zPUejYi.exe
  C:\Windows\System\zPUejYi.exe
  2⤵
  PID:6244
- C:\Windows\System\ovetvqG.exe
  C:\Windows\System\ovetvqG.exe
  2⤵
  PID:6392
- C:\Windows\System\fzxRpvL.exe
  C:\Windows\System\fzxRpvL.exe
  2⤵
  PID:6436
- C:\Windows\System\SvWanYY.exe
  C:\Windows\System\SvWanYY.exe
  2⤵
  PID:6504
- C:\Windows\System\hlazbti.exe
  C:\Windows\System\hlazbti.exe
  2⤵
  PID:6568
- C:\Windows\System\adnWAeL.exe
  C:\Windows\System\adnWAeL.exe
  2⤵
  PID:6608
- C:\Windows\System\SiUADvf.exe
  C:\Windows\System\SiUADvf.exe
  2⤵
  PID:6668
- C:\Windows\System\wKKCRVL.exe
  C:\Windows\System\wKKCRVL.exe
  2⤵
  PID:6740
- C:\Windows\System\NZOhIYV.exe
  C:\Windows\System\NZOhIYV.exe
  2⤵
  PID:6780
- C:\Windows\System\BnoHxhi.exe
  C:\Windows\System\BnoHxhi.exe
  2⤵
  PID:6840
- C:\Windows\System\iVibiPV.exe
  C:\Windows\System\iVibiPV.exe
  2⤵
  PID:6932
- C:\Windows\System\GlyBSdX.exe
  C:\Windows\System\GlyBSdX.exe
  2⤵
  PID:6984
- C:\Windows\System\bvgMnYn.exe
  C:\Windows\System\bvgMnYn.exe
  2⤵
  PID:7052
- C:\Windows\System\QGcwtyo.exe
  C:\Windows\System\QGcwtyo.exe
  2⤵
  PID:7080
- C:\Windows\System\UzTYNCU.exe
  C:\Windows\System\UzTYNCU.exe
  2⤵
  PID:232
- C:\Windows\System\jVdsEjm.exe
  C:\Windows\System\jVdsEjm.exe
  2⤵
  PID:2448
- C:\Windows\System\MGmzJvX.exe
  C:\Windows\System\MGmzJvX.exe
  2⤵
  PID:7256
- C:\Windows\System\cJrptKt.exe
  C:\Windows\System\cJrptKt.exe
  2⤵
  PID:7396
- C:\Windows\System\uxfwQMe.exe
  C:\Windows\System\uxfwQMe.exe
  2⤵
  PID:7708
- C:\Windows\System\sYlpKcB.exe
  C:\Windows\System\sYlpKcB.exe
  2⤵
  PID:7884
- C:\Windows\System\RtHpXcr.exe
  C:\Windows\System\RtHpXcr.exe
  2⤵
  PID:8136
- C:\Windows\System\tkjHJBh.exe
  C:\Windows\System\tkjHJBh.exe
  2⤵
  PID:5880
- C:\Windows\System\sxROeWD.exe
  C:\Windows\System\sxROeWD.exe
  2⤵
  PID:8268
- C:\Windows\System\VHCmrKE.exe
  C:\Windows\System\VHCmrKE.exe
  2⤵
  PID:5840
- C:\Windows\System\KNSPEoP.exe
  C:\Windows\System\KNSPEoP.exe
  2⤵
  PID:5968
- C:\Windows\System\iPTDBSw.exe
  C:\Windows\System\iPTDBSw.exe
  2⤵
  PID:4712
- C:\Windows\System\ajCYuJv.exe
  C:\Windows\System\ajCYuJv.exe
  2⤵
  PID:5668
- C:\Windows\System\HuboVjP.exe
  C:\Windows\System\HuboVjP.exe
  2⤵
  PID:7240
- C:\Windows\System\YAfWXPD.exe
  C:\Windows\System\YAfWXPD.exe
  2⤵
  PID:7288
- C:\Windows\System\KHtBXeh.exe
  C:\Windows\System\KHtBXeh.exe
  2⤵
  PID:7388
- C:\Windows\System\rOrKGXE.exe
  C:\Windows\System\rOrKGXE.exe
  2⤵
  PID:7508
- C:\Windows\System\aptgvHY.exe
  C:\Windows\System\aptgvHY.exe
  2⤵
  PID:7584
- C:\Windows\System\KdLOzEX.exe
  C:\Windows\System\KdLOzEX.exe
  2⤵
  PID:7668
- C:\Windows\System\OlJoBfE.exe
  C:\Windows\System\OlJoBfE.exe
  2⤵
  PID:7812
- C:\Windows\System\phDexPK.exe
  C:\Windows\System\phDexPK.exe
  2⤵
  PID:7880
- C:\Windows\System\ShYDoHG.exe
  C:\Windows\System\ShYDoHG.exe
  2⤵
  PID:7948
- C:\Windows\System\hUSDmbo.exe
  C:\Windows\System\hUSDmbo.exe
  2⤵
  PID:8016
- C:\Windows\System\vkqcvuI.exe
  C:\Windows\System\vkqcvuI.exe
  2⤵
  PID:8168
- C:\Windows\System\tWbrLhc.exe
  C:\Windows\System\tWbrLhc.exe
  2⤵
  PID:6284
- C:\Windows\System\LwlufWP.exe
  C:\Windows\System\LwlufWP.exe
  2⤵
  PID:9228
- C:\Windows\System\QoXfdtX.exe
  C:\Windows\System\QoXfdtX.exe
  2⤵
  PID:9244
- C:\Windows\System\aPrZgWD.exe
  C:\Windows\System\aPrZgWD.exe
  2⤵
  PID:9268
- C:\Windows\System\VXMAthl.exe
  C:\Windows\System\VXMAthl.exe
  2⤵
  PID:9284
- C:\Windows\System\FGtMUzr.exe
  C:\Windows\System\FGtMUzr.exe
  2⤵
  PID:9312
- C:\Windows\System\DMWPNTG.exe
  C:\Windows\System\DMWPNTG.exe
  2⤵
  PID:9328
- C:\Windows\System\XhObNog.exe
  C:\Windows\System\XhObNog.exe
  2⤵
  PID:9344
- C:\Windows\System\IvpgzFC.exe
  C:\Windows\System\IvpgzFC.exe
  2⤵
  PID:9364
- C:\Windows\System\QhVRDkM.exe
  C:\Windows\System\QhVRDkM.exe
  2⤵
  PID:9380
- C:\Windows\System\EZZWgJh.exe
  C:\Windows\System\EZZWgJh.exe
  2⤵
  PID:9400
- C:\Windows\System\UHDjrpp.exe
  C:\Windows\System\UHDjrpp.exe
  2⤵
  PID:9420
- C:\Windows\System\XCLeUsU.exe
  C:\Windows\System\XCLeUsU.exe
  2⤵
  PID:9436
- C:\Windows\System\NgseirH.exe
  C:\Windows\System\NgseirH.exe
  2⤵
  PID:9460
- C:\Windows\System\mxbXKVw.exe
  C:\Windows\System\mxbXKVw.exe
  2⤵
  PID:9484
- C:\Windows\System\pvjKBvn.exe
  C:\Windows\System\pvjKBvn.exe
  2⤵
  PID:9504
- C:\Windows\System\VnGtKKz.exe
  C:\Windows\System\VnGtKKz.exe
  2⤵
  PID:9524
- C:\Windows\System\jEiUnOu.exe
  C:\Windows\System\jEiUnOu.exe
  2⤵
  PID:9544
- C:\Windows\System\POtWddL.exe
  C:\Windows\System\POtWddL.exe
  2⤵
  PID:9564
- C:\Windows\System\ktbyCeH.exe
  C:\Windows\System\ktbyCeH.exe
  2⤵
  PID:9584
- C:\Windows\System\nmFSFik.exe
  C:\Windows\System\nmFSFik.exe
  2⤵
  PID:9604
- C:\Windows\System\RRmoEkD.exe
  C:\Windows\System\RRmoEkD.exe
  2⤵
  PID:9624
- C:\Windows\System\fzDUqpB.exe
  C:\Windows\System\fzDUqpB.exe
  2⤵
  PID:9652
- C:\Windows\System\hiaRteQ.exe
  C:\Windows\System\hiaRteQ.exe
  2⤵
  PID:9668
- C:\Windows\System\vEcoGdi.exe
  C:\Windows\System\vEcoGdi.exe
  2⤵
  PID:9688
- C:\Windows\System\nuMGBOx.exe
  C:\Windows\System\nuMGBOx.exe
  2⤵
  PID:9712
- C:\Windows\System\ZCVUqJE.exe
  C:\Windows\System\ZCVUqJE.exe
  2⤵
  PID:9732
- C:\Windows\System\yDxFZcp.exe
  C:\Windows\System\yDxFZcp.exe
  2⤵
  PID:9752
- C:\Windows\System\tYPyZrc.exe
  C:\Windows\System\tYPyZrc.exe
  2⤵
  PID:9776
- C:\Windows\System\ktiyguf.exe
  C:\Windows\System\ktiyguf.exe
  2⤵
  PID:9800
- C:\Windows\System\MHjrQYi.exe
  C:\Windows\System\MHjrQYi.exe
  2⤵
  PID:9824
- C:\Windows\System\BkeTOZV.exe
  C:\Windows\System\BkeTOZV.exe
  2⤵
  PID:9844
- C:\Windows\System\IxelbUD.exe
  C:\Windows\System\IxelbUD.exe
  2⤵
  PID:9864
- C:\Windows\System\hzFANqg.exe
  C:\Windows\System\hzFANqg.exe
  2⤵
  PID:9888
- C:\Windows\System\juCRqUP.exe
  C:\Windows\System\juCRqUP.exe
  2⤵
  PID:9908
- C:\Windows\System\UbrrjVR.exe
  C:\Windows\System\UbrrjVR.exe
  2⤵
  PID:9928
- C:\Windows\System\TJPOgfL.exe
  C:\Windows\System\TJPOgfL.exe
  2⤵
  PID:9956
- C:\Windows\System\bVEWpyY.exe
  C:\Windows\System\bVEWpyY.exe
  2⤵
  PID:9972
- C:\Windows\System\CyqLGFz.exe
  C:\Windows\System\CyqLGFz.exe
  2⤵
  PID:10008
- C:\Windows\System\gEETDVk.exe
  C:\Windows\System\gEETDVk.exe
  2⤵
  PID:10024
- C:\Windows\System\DFNJkMs.exe
  C:\Windows\System\DFNJkMs.exe
  2⤵
  PID:10040
- C:\Windows\System\poEJrJV.exe
  C:\Windows\System\poEJrJV.exe
  2⤵
  PID:10056
- C:\Windows\System\uFAhBeH.exe
  C:\Windows\System\uFAhBeH.exe
  2⤵
  PID:10132
- C:\Windows\System\iwERwma.exe
  C:\Windows\System\iwERwma.exe
  2⤵
  PID:10152
- C:\Windows\System\TXeksrm.exe
  C:\Windows\System\TXeksrm.exe
  2⤵
  PID:10176
- C:\Windows\System\FwpTqjs.exe
  C:\Windows\System\FwpTqjs.exe
  2⤵
  PID:10200
- C:\Windows\System\onBaNHA.exe
  C:\Windows\System\onBaNHA.exe
  2⤵
  PID:10224
- C:\Windows\System\jOGgymc.exe
  C:\Windows\System\jOGgymc.exe
  2⤵
  PID:6844
- C:\Windows\System\IpSloia.exe
  C:\Windows\System\IpSloia.exe
  2⤵
  PID:8440
- C:\Windows\System\njeixXL.exe
  C:\Windows\System\njeixXL.exe
  2⤵
  PID:5340
- C:\Windows\System\xuobgOM.exe
  C:\Windows\System\xuobgOM.exe
  2⤵
  PID:8828
- C:\Windows\System\MNWzCCd.exe
  C:\Windows\System\MNWzCCd.exe
  2⤵
  PID:7312
- C:\Windows\System\mPMzKcV.exe
  C:\Windows\System\mPMzKcV.exe
  2⤵
  PID:9092
- C:\Windows\System\NpfBwxq.exe
  C:\Windows\System\NpfBwxq.exe
  2⤵
  PID:9116
- C:\Windows\System\cFGUDFC.exe
  C:\Windows\System\cFGUDFC.exe
  2⤵
  PID:10252
- C:\Windows\System\JExjbDp.exe
  C:\Windows\System\JExjbDp.exe
  2⤵
  PID:10272
- C:\Windows\System\nlXbWcS.exe
  C:\Windows\System\nlXbWcS.exe
  2⤵
  PID:10288
- C:\Windows\System\SrMVFnb.exe
  C:\Windows\System\SrMVFnb.exe
  2⤵
  PID:10308
- C:\Windows\System\mlYFWTv.exe
  C:\Windows\System\mlYFWTv.exe
  2⤵
  PID:10332
- C:\Windows\System\eWwmOQN.exe
  C:\Windows\System\eWwmOQN.exe
  2⤵
  PID:10352
- C:\Windows\System\JmNhLEd.exe
  C:\Windows\System\JmNhLEd.exe
  2⤵
  PID:10372
- C:\Windows\System\sGvWGYc.exe
  C:\Windows\System\sGvWGYc.exe
  2⤵
  PID:10400
- C:\Windows\System\SVXvpAw.exe
  C:\Windows\System\SVXvpAw.exe
  2⤵
  PID:10416
- C:\Windows\System\GReAVUN.exe
  C:\Windows\System\GReAVUN.exe
  2⤵
  PID:10436
- C:\Windows\System\dOSmiIi.exe
  C:\Windows\System\dOSmiIi.exe
  2⤵
  PID:10460
- C:\Windows\System\jftvXqv.exe
  C:\Windows\System\jftvXqv.exe
  2⤵
  PID:10480
- C:\Windows\System\PPGyZVM.exe
  C:\Windows\System\PPGyZVM.exe
  2⤵
  PID:10500
- C:\Windows\System\ZyQFPWa.exe
  C:\Windows\System\ZyQFPWa.exe
  2⤵
  PID:10520
- C:\Windows\System\ZdfVmQW.exe
  C:\Windows\System\ZdfVmQW.exe
  2⤵
  PID:10540
- C:\Windows\System\lzIvymB.exe
  C:\Windows\System\lzIvymB.exe
  2⤵
  PID:10556
- C:\Windows\System\RliNQnS.exe
  C:\Windows\System\RliNQnS.exe
  2⤵
  PID:10576
- C:\Windows\System\JfKvxVR.exe
  C:\Windows\System\JfKvxVR.exe
  2⤵
  PID:10592
- C:\Windows\System\TtGEEnS.exe
  C:\Windows\System\TtGEEnS.exe
  2⤵
  PID:10612
- C:\Windows\System\vYVvcfw.exe
  C:\Windows\System\vYVvcfw.exe
  2⤵
  PID:10632
- C:\Windows\System\sJsdzWr.exe
  C:\Windows\System\sJsdzWr.exe
  2⤵
  PID:10652
- C:\Windows\System\AgwNtcg.exe
  C:\Windows\System\AgwNtcg.exe
  2⤵
  PID:10676
- C:\Windows\System\WsJWrsQ.exe
  C:\Windows\System\WsJWrsQ.exe
  2⤵
  PID:10696
- C:\Windows\System\aIUMcZG.exe
  C:\Windows\System\aIUMcZG.exe
  2⤵
  PID:10720
- C:\Windows\System\ystpORO.exe
  C:\Windows\System\ystpORO.exe
  2⤵
  PID:10740
- C:\Windows\System\WwziavE.exe
  C:\Windows\System\WwziavE.exe
  2⤵
  PID:10760
- C:\Windows\System\DkZZEFs.exe
  C:\Windows\System\DkZZEFs.exe
  2⤵
  PID:10788
- C:\Windows\System\ohIrgqw.exe
  C:\Windows\System\ohIrgqw.exe
  2⤵
  PID:10808
- C:\Windows\System\CLaGKIs.exe
  C:\Windows\System\CLaGKIs.exe
  2⤵
  PID:10832
- C:\Windows\System\erhddzb.exe
  C:\Windows\System\erhddzb.exe
  2⤵
  PID:10852
- C:\Windows\System\GclHSPd.exe
  C:\Windows\System\GclHSPd.exe
  2⤵
  PID:10876
- C:\Windows\System\JmLLiJn.exe
  C:\Windows\System\JmLLiJn.exe
  2⤵
  PID:10900
- C:\Windows\System\aKcYqLm.exe
  C:\Windows\System\aKcYqLm.exe
  2⤵
  PID:10920
- C:\Windows\System\RDlkPAx.exe
  C:\Windows\System\RDlkPAx.exe
  2⤵
  PID:10940
- C:\Windows\System\LuIScGN.exe
  C:\Windows\System\LuIScGN.exe
  2⤵
  PID:10960
- C:\Windows\System\cTjfwnE.exe
  C:\Windows\System\cTjfwnE.exe
  2⤵
  PID:10976
- C:\Windows\System\vrfVYiq.exe
  C:\Windows\System\vrfVYiq.exe
  2⤵
  PID:10996
- C:\Windows\System\ANysZeE.exe
  C:\Windows\System\ANysZeE.exe
  2⤵
  PID:11020
- C:\Windows\System\NmltmFA.exe
  C:\Windows\System\NmltmFA.exe
  2⤵
  PID:11036
- C:\Windows\System\rhcADHg.exe
  C:\Windows\System\rhcADHg.exe
  2⤵
  PID:11060
- C:\Windows\System\mUcQuuj.exe
  C:\Windows\System\mUcQuuj.exe
  2⤵
  PID:11080
- C:\Windows\System\LPMCEaV.exe
  C:\Windows\System\LPMCEaV.exe
  2⤵
  PID:11104
- C:\Windows\System\OJGtJBO.exe
  C:\Windows\System\OJGtJBO.exe
  2⤵
  PID:11128
- C:\Windows\System\xhqUidz.exe
  C:\Windows\System\xhqUidz.exe
  2⤵
  PID:11148
- C:\Windows\System\CMorHEg.exe
  C:\Windows\System\CMorHEg.exe
  2⤵
  PID:11168
- C:\Windows\System\PFTqTYZ.exe
  C:\Windows\System\PFTqTYZ.exe
  2⤵
  PID:11188
- C:\Windows\System\nlQSZZa.exe
  C:\Windows\System\nlQSZZa.exe
  2⤵
  PID:11208
- C:\Windows\System\egcvCHA.exe
  C:\Windows\System\egcvCHA.exe
  2⤵
  PID:11228
- C:\Windows\System\TZPImlh.exe
  C:\Windows\System\TZPImlh.exe
  2⤵
  PID:11248
- C:\Windows\System\EOcTRrz.exe
  C:\Windows\System\EOcTRrz.exe
  2⤵
  PID:7468
- C:\Windows\System\WKBBmSL.exe
  C:\Windows\System\WKBBmSL.exe
  2⤵
  PID:7528
- C:\Windows\System\iGMfLui.exe
  C:\Windows\System\iGMfLui.exe
  2⤵
  PID:7628
- C:\Windows\System\gZzSDpC.exe
  C:\Windows\System\gZzSDpC.exe
  2⤵
  PID:6808
- C:\Windows\System\gCZYpDb.exe
  C:\Windows\System\gCZYpDb.exe
  2⤵
  PID:7792
- C:\Windows\System\khwoRdX.exe
  C:\Windows\System\khwoRdX.exe
  2⤵
  PID:7864
- C:\Windows\System\HLUEiRC.exe
  C:\Windows\System\HLUEiRC.exe
  2⤵
  PID:6704
- C:\Windows\System\paPxfYb.exe
  C:\Windows\System\paPxfYb.exe
  2⤵
  PID:6948
- C:\Windows\System\jVHjUZE.exe
  C:\Windows\System\jVHjUZE.exe
  2⤵
  PID:7060
- C:\Windows\System\krqqRjN.exe
  C:\Windows\System\krqqRjN.exe
  2⤵
  PID:5640
- C:\Windows\System\fiCYWOA.exe
  C:\Windows\System\fiCYWOA.exe
  2⤵
  PID:7848
- C:\Windows\System\WNkrXNE.exe
  C:\Windows\System\WNkrXNE.exe
  2⤵
  PID:5920
- C:\Windows\System\yaLdWXN.exe
  C:\Windows\System\yaLdWXN.exe
  2⤵
  PID:5648
- C:\Windows\System\ZMZzHYV.exe
  C:\Windows\System\ZMZzHYV.exe
  2⤵
  PID:1728
- C:\Windows\System\PzVdGcf.exe
  C:\Windows\System\PzVdGcf.exe
  2⤵
  PID:7984
- C:\Windows\System\uqZvEpS.exe
  C:\Windows\System\uqZvEpS.exe
  2⤵
  PID:9252
- C:\Windows\System\WdofsKL.exe
  C:\Windows\System\WdofsKL.exe
  2⤵
  PID:5408
- C:\Windows\System\QymAGmV.exe
  C:\Windows\System\QymAGmV.exe
  2⤵
  PID:11280
- C:\Windows\System\AciCnRm.exe
  C:\Windows\System\AciCnRm.exe
  2⤵
  PID:11296
- C:\Windows\System\DHHkjWm.exe
  C:\Windows\System\DHHkjWm.exe
  2⤵
  PID:11316
- C:\Windows\System\zVtDKIC.exe
  C:\Windows\System\zVtDKIC.exe
  2⤵
  PID:11340
- C:\Windows\System\bzegiDR.exe
  C:\Windows\System\bzegiDR.exe
  2⤵
  PID:11356
- C:\Windows\System\MdosXmt.exe
  C:\Windows\System\MdosXmt.exe
  2⤵
  PID:11380
- C:\Windows\System\xvQlyiH.exe
  C:\Windows\System\xvQlyiH.exe
  2⤵
  PID:11404
- C:\Windows\System\LGulgrD.exe
  C:\Windows\System\LGulgrD.exe
  2⤵
  PID:11424
- C:\Windows\System\qPTXgnG.exe
  C:\Windows\System\qPTXgnG.exe
  2⤵
  PID:11448
- C:\Windows\System\mLMxIzs.exe
  C:\Windows\System\mLMxIzs.exe
  2⤵
  PID:11468
- C:\Windows\System\uRSUrpC.exe
  C:\Windows\System\uRSUrpC.exe
  2⤵
  PID:11492
- C:\Windows\System\JYTksNJ.exe
  C:\Windows\System\JYTksNJ.exe
  2⤵
  PID:11512
- C:\Windows\System\kzarlpA.exe
  C:\Windows\System\kzarlpA.exe
  2⤵
  PID:11536
- C:\Windows\System\lmZpyVf.exe
  C:\Windows\System\lmZpyVf.exe
  2⤵
  PID:11556
- C:\Windows\System\GyYAAay.exe
  C:\Windows\System\GyYAAay.exe
  2⤵
  PID:11572
- C:\Windows\System\epaQlPU.exe
  C:\Windows\System\epaQlPU.exe
  2⤵
  PID:11604
- C:\Windows\System\PAskTVN.exe
  C:\Windows\System\PAskTVN.exe
  2⤵
  PID:11620
- C:\Windows\System\peAezpl.exe
  C:\Windows\System\peAezpl.exe
  2⤵
  PID:11640
- C:\Windows\System\VasoZLx.exe
  C:\Windows\System\VasoZLx.exe
  2⤵
  PID:11664
- C:\Windows\System\kajBeWX.exe
  C:\Windows\System\kajBeWX.exe
  2⤵
  PID:11688
- C:\Windows\System\cjbGqbe.exe
  C:\Windows\System\cjbGqbe.exe
  2⤵
  PID:11708
- C:\Windows\System\gCBBsEl.exe
  C:\Windows\System\gCBBsEl.exe
  2⤵
  PID:11728
- C:\Windows\System\JGbAKHC.exe
  C:\Windows\System\JGbAKHC.exe
  2⤵
  PID:11756
- C:\Windows\System\OtPIgtf.exe
  C:\Windows\System\OtPIgtf.exe
  2⤵
  PID:11772
- C:\Windows\System\yjpEgoZ.exe
  C:\Windows\System\yjpEgoZ.exe
  2⤵
  PID:11792
- C:\Windows\System\MDWEyQI.exe
  C:\Windows\System\MDWEyQI.exe
  2⤵
  PID:11812
- C:\Windows\System\bhNNqbs.exe
  C:\Windows\System\bhNNqbs.exe
  2⤵
  PID:11832
- C:\Windows\System\haNOSDT.exe
  C:\Windows\System\haNOSDT.exe
  2⤵
  PID:11852
- C:\Windows\System\EawSTrM.exe
  C:\Windows\System\EawSTrM.exe
  2⤵
  PID:11872
- C:\Windows\System\epZMTST.exe
  C:\Windows\System\epZMTST.exe
  2⤵
  PID:11888
- C:\Windows\System\nBZBoOu.exe
  C:\Windows\System\nBZBoOu.exe
  2⤵
  PID:11908
- C:\Windows\System\XIcsicP.exe
  C:\Windows\System\XIcsicP.exe
  2⤵
  PID:11924
- C:\Windows\System\oeFKNni.exe
  C:\Windows\System\oeFKNni.exe
  2⤵
  PID:11940
- C:\Windows\System\bhBBdiN.exe
  C:\Windows\System\bhBBdiN.exe
  2⤵
  PID:11956
- C:\Windows\System\mmnFNEj.exe
  C:\Windows\System\mmnFNEj.exe
  2⤵
  PID:11976
- C:\Windows\System\nZoWJVv.exe
  C:\Windows\System\nZoWJVv.exe
  2⤵
  PID:12000
- C:\Windows\System\dPKeLVd.exe
  C:\Windows\System\dPKeLVd.exe
  2⤵
  PID:12020
- C:\Windows\System\WzctyNe.exe
  C:\Windows\System\WzctyNe.exe
  2⤵
  PID:12040
- C:\Windows\System\DmUiRdC.exe
  C:\Windows\System\DmUiRdC.exe
  2⤵
  PID:12060
- C:\Windows\System\PKBdsJr.exe
  C:\Windows\System\PKBdsJr.exe
  2⤵
  PID:12160
- C:\Windows\System\lckEGSQ.exe
  C:\Windows\System\lckEGSQ.exe
  2⤵
  PID:12176
- C:\Windows\System\DagQbJD.exe
  C:\Windows\System\DagQbJD.exe
  2⤵
  PID:12192
- C:\Windows\System\ydfhzYh.exe
  C:\Windows\System\ydfhzYh.exe
  2⤵
  PID:12208
- C:\Windows\System\zVZRCUM.exe
  C:\Windows\System\zVZRCUM.exe
  2⤵
  PID:12224
- C:\Windows\System\dhZvUtv.exe
  C:\Windows\System\dhZvUtv.exe
  2⤵
  PID:12240
- C:\Windows\System\AguOOwP.exe
  C:\Windows\System\AguOOwP.exe
  2⤵
  PID:12260
- C:\Windows\System\AcfpzXR.exe
  C:\Windows\System\AcfpzXR.exe
  2⤵
  PID:12276
- C:\Windows\System\asQQQKn.exe
  C:\Windows\System\asQQQKn.exe
  2⤵
  PID:5480
- C:\Windows\System\bsTgqdW.exe
  C:\Windows\System\bsTgqdW.exe
  2⤵
  PID:9456
- C:\Windows\System\NIjOIxE.exe
  C:\Windows\System\NIjOIxE.exe
  2⤵
  PID:9632
- C:\Windows\System\bggeFgS.exe
  C:\Windows\System\bggeFgS.exe
  2⤵
  PID:9704
- C:\Windows\System\TVZaBLI.exe
  C:\Windows\System\TVZaBLI.exe
  2⤵
  PID:9816
- C:\Windows\System\fsWhSUt.exe
  C:\Windows\System\fsWhSUt.exe
  2⤵
  PID:9884
- C:\Windows\System\moEBgoR.exe
  C:\Windows\System\moEBgoR.exe
  2⤵
  PID:9984
- C:\Windows\System\mpAESHQ.exe
  C:\Windows\System\mpAESHQ.exe
  2⤵
  PID:5688
- C:\Windows\System\SwtvOLu.exe
  C:\Windows\System\SwtvOLu.exe
  2⤵
  PID:5944
- C:\Windows\System\hcrjdcU.exe
  C:\Windows\System\hcrjdcU.exe
  2⤵
  PID:5672
- C:\Windows\System\WeRPhsX.exe
  C:\Windows\System\WeRPhsX.exe
  2⤵
  PID:4904
- C:\Windows\System\uuCdYVI.exe
  C:\Windows\System\uuCdYVI.exe
  2⤵
  PID:8824
- C:\Windows\System\ecyqdwR.exe
  C:\Windows\System\ecyqdwR.exe
  2⤵
  PID:9000
- C:\Windows\System\KoFYJPG.exe
  C:\Windows\System\KoFYJPG.exe
  2⤵
  PID:10244
- C:\Windows\System\yzIRnTd.exe
  C:\Windows\System\yzIRnTd.exe
  2⤵
  PID:12308
- C:\Windows\System\zjEzysU.exe
  C:\Windows\System\zjEzysU.exe
  2⤵
  PID:12328
- C:\Windows\System\FyOjdDO.exe
  C:\Windows\System\FyOjdDO.exe
  2⤵
  PID:12348
- C:\Windows\System\hdesYnu.exe
  C:\Windows\System\hdesYnu.exe
  2⤵
  PID:12372
- C:\Windows\System\VqoVKBs.exe
  C:\Windows\System\VqoVKBs.exe
  2⤵
  PID:12392
- C:\Windows\System\cIXGLeC.exe
  C:\Windows\System\cIXGLeC.exe
  2⤵
  PID:12416
- C:\Windows\System\UeoHtZD.exe
  C:\Windows\System\UeoHtZD.exe
  2⤵
  PID:12436
- C:\Windows\System\vBDltwP.exe
  C:\Windows\System\vBDltwP.exe
  2⤵
  PID:12456
- C:\Windows\System\jifBLoO.exe
  C:\Windows\System\jifBLoO.exe
  2⤵
  PID:12476
- C:\Windows\System\DxIgvDj.exe
  C:\Windows\System\DxIgvDj.exe
  2⤵
  PID:12500
- C:\Windows\System\njJHnqg.exe
  C:\Windows\System\njJHnqg.exe
  2⤵
  PID:12520
- C:\Windows\System\bLNPUWP.exe
  C:\Windows\System\bLNPUWP.exe
  2⤵
  PID:12540
- C:\Windows\System\snssCLn.exe
  C:\Windows\System\snssCLn.exe
  2⤵
  PID:12560
- C:\Windows\System\CtUSMJr.exe
  C:\Windows\System\CtUSMJr.exe
  2⤵
  PID:12580
- C:\Windows\System\GromgNA.exe
  C:\Windows\System\GromgNA.exe
  2⤵
  PID:12596
- C:\Windows\System\CpxXrUM.exe
  C:\Windows\System\CpxXrUM.exe
  2⤵
  PID:12616
- C:\Windows\System\SUbGtMk.exe
  C:\Windows\System\SUbGtMk.exe
  2⤵
  PID:12644
- C:\Windows\System\RbngxrV.exe
  C:\Windows\System\RbngxrV.exe
  2⤵
  PID:12668
- C:\Windows\System\BTClzEx.exe
  C:\Windows\System\BTClzEx.exe
  2⤵
  PID:12688
- C:\Windows\System\QeFiFcb.exe
  C:\Windows\System\QeFiFcb.exe
  2⤵
  PID:12704
- C:\Windows\System\GNHpmBA.exe
  C:\Windows\System\GNHpmBA.exe
  2⤵
  PID:12724
- C:\Windows\System\KCCxKhK.exe
  C:\Windows\System\KCCxKhK.exe
  2⤵
  PID:12744
- C:\Windows\System\irrZhtC.exe
  C:\Windows\System\irrZhtC.exe
  2⤵
  PID:12768
- C:\Windows\System\kZVEBIF.exe
  C:\Windows\System\kZVEBIF.exe
  2⤵
  PID:12784
- C:\Windows\System\LiIQIbL.exe
  C:\Windows\System\LiIQIbL.exe
  2⤵
  PID:12804
- C:\Windows\System\vtgYPnk.exe
  C:\Windows\System\vtgYPnk.exe
  2⤵
  PID:12824
- C:\Windows\System\ECqWfeQ.exe
  C:\Windows\System\ECqWfeQ.exe
  2⤵
  PID:12840
- C:\Windows\System\WAbOjbt.exe
  C:\Windows\System\WAbOjbt.exe
  2⤵
  PID:12856
- C:\Windows\System\mhXldlN.exe
  C:\Windows\System\mhXldlN.exe
  2⤵
  PID:12872
- C:\Windows\System\INWXFeI.exe
  C:\Windows\System\INWXFeI.exe
  2⤵
  PID:12892
- C:\Windows\System\tEyPCIP.exe
  C:\Windows\System\tEyPCIP.exe
  2⤵
  PID:12912
- C:\Windows\System\RVaqxFg.exe
  C:\Windows\System\RVaqxFg.exe
  2⤵
  PID:12928
- C:\Windows\System\rBpBjDO.exe
  C:\Windows\System\rBpBjDO.exe
  2⤵
  PID:12944
- C:\Windows\System\AoFkSrX.exe
  C:\Windows\System\AoFkSrX.exe
  2⤵
  PID:12964
- C:\Windows\System\USqddeY.exe
  C:\Windows\System\USqddeY.exe
  2⤵
  PID:12984
- C:\Windows\System\WwclYFo.exe
  C:\Windows\System\WwclYFo.exe
  2⤵
  PID:13008
- C:\Windows\System\imnRufH.exe
  C:\Windows\System\imnRufH.exe
  2⤵
  PID:13028
- C:\Windows\System\pIUJgBJ.exe
  C:\Windows\System\pIUJgBJ.exe
  2⤵
  PID:13048
- C:\Windows\System\KoDkngy.exe
  C:\Windows\System\KoDkngy.exe
  2⤵
  PID:13072
- C:\Windows\System\HJeXono.exe
  C:\Windows\System\HJeXono.exe
  2⤵
  PID:13092
- C:\Windows\System\mLxuzvv.exe
  C:\Windows\System\mLxuzvv.exe
  2⤵
  PID:13108
- C:\Windows\System\uokGgTn.exe
  C:\Windows\System\uokGgTn.exe
  2⤵
  PID:13128
- C:\Windows\System\ehmmrum.exe
  C:\Windows\System\ehmmrum.exe
  2⤵
  PID:13148
- C:\Windows\System\ktXSprW.exe
  C:\Windows\System\ktXSprW.exe
  2⤵
  PID:13168
- C:\Windows\System\IMNRRoB.exe
  C:\Windows\System\IMNRRoB.exe
  2⤵
  PID:13192
- C:\Windows\System\uYsCugG.exe
  C:\Windows\System\uYsCugG.exe
  2⤵
  PID:13208
- C:\Windows\System\IsJKvcj.exe
  C:\Windows\System\IsJKvcj.exe
  2⤵
  PID:13232
- C:\Windows\System\numNrnu.exe
  C:\Windows\System\numNrnu.exe
  2⤵
  PID:13256
- C:\Windows\System\sWpJohu.exe
  C:\Windows\System\sWpJohu.exe
  2⤵
  PID:13276
- C:\Windows\System\WzfUsTK.exe
  C:\Windows\System\WzfUsTK.exe
  2⤵
  PID:13296
- C:\Windows\System\nzciIuj.exe
  C:\Windows\System\nzciIuj.exe
  2⤵
  PID:8668
- C:\Windows\System\nchfRSg.exe
  C:\Windows\System\nchfRSg.exe
  2⤵
  PID:712
- C:\Windows\System\fcRdhhH.exe
  C:\Windows\System\fcRdhhH.exe
  2⤵
  PID:1068
- C:\Windows\System\NrRuORe.exe
  C:\Windows\System\NrRuORe.exe
  2⤵
  PID:12140
- C:\Windows\System\WIWgwCZ.exe
  C:\Windows\System\WIWgwCZ.exe
  2⤵
  PID:1920
- C:\Windows\System\nLHvpng.exe
  C:\Windows\System\nLHvpng.exe
  2⤵
  PID:11240
- C:\Windows\System\acUBWmP.exe
  C:\Windows\System\acUBWmP.exe
  2⤵
  PID:6684
- C:\Windows\System\FkZbpRa.exe
  C:\Windows\System\FkZbpRa.exe
  2⤵
  PID:8028
- C:\Windows\System\IPYDHcm.exe
  C:\Windows\System\IPYDHcm.exe
  2⤵
  PID:11272
- C:\Windows\System\JAiNmhR.exe
  C:\Windows\System\JAiNmhR.exe
  2⤵
  PID:12188
- C:\Windows\System\ePZbwXB.exe
  C:\Windows\System\ePZbwXB.exe
  2⤵
  PID:12272
- C:\Windows\System\wbFHtCx.exe
  C:\Windows\System\wbFHtCx.exe
  2⤵
  PID:9444
- C:\Windows\System\VEoUiud.exe
  C:\Windows\System\VEoUiud.exe
  2⤵
  PID:9876
- C:\Windows\System\XAkFvPf.exe
  C:\Windows\System\XAkFvPf.exe
  2⤵
  PID:5376
- C:\Windows\System\dLTrCXh.exe
  C:\Windows\System\dLTrCXh.exe
  2⤵
  PID:7304
- C:\Windows\System\ScIVHOQ.exe
  C:\Windows\System\ScIVHOQ.exe
  2⤵
  PID:12324
- C:\Windows\System\bWjlvEU.exe
  C:\Windows\System\bWjlvEU.exe
  2⤵
  PID:12388
- C:\Windows\System\Tysympr.exe
  C:\Windows\System\Tysympr.exe
  2⤵
  PID:12432
- C:\Windows\System\ISQKkyy.exe
  C:\Windows\System\ISQKkyy.exe
  2⤵
  PID:12492
- C:\Windows\System\YwTQQpX.exe
  C:\Windows\System\YwTQQpX.exe
  2⤵
  PID:11788
- C:\Windows\System\JIkXocY.exe
  C:\Windows\System\JIkXocY.exe
  2⤵
  PID:12572
- C:\Windows\System\UulYzVE.exe
  C:\Windows\System\UulYzVE.exe
  2⤵
  PID:12640
- C:\Windows\System\PlCWLNO.exe
  C:\Windows\System\PlCWLNO.exe
  2⤵
  PID:12700
- C:\Windows\System\RMKHMMp.exe
  C:\Windows\System\RMKHMMp.exe
  2⤵
  PID:12756
- C:\Windows\System\aeCcToG.exe
  C:\Windows\System\aeCcToG.exe
  2⤵
  PID:12816
- C:\Windows\System\YDWPiWZ.exe
  C:\Windows\System\YDWPiWZ.exe
  2⤵
  PID:12884
- C:\Windows\System\UajgmFd.exe
  C:\Windows\System\UajgmFd.exe
  2⤵
  PID:12956
- C:\Windows\System\eZDmIXs.exe
  C:\Windows\System\eZDmIXs.exe
  2⤵
  PID:13004
- C:\Windows\System\BUPDjNu.exe
  C:\Windows\System\BUPDjNu.exe
  2⤵
  PID:13044
- C:\Windows\System\gSQUfJN.exe
  C:\Windows\System\gSQUfJN.exe
  2⤵
  PID:9820
- C:\Windows\System\XUrPTQz.exe
  C:\Windows\System\XUrPTQz.exe
  2⤵
  PID:13292
- C:\Windows\System\TTlLJhR.exe
  C:\Windows\System\TTlLJhR.exe
  2⤵
  PID:13188
- C:\Windows\System\lBhHqKL.exe
  C:\Windows\System\lBhHqKL.exe
  2⤵
  PID:4444
- C:\Windows\System\BkdynSo.exe
  C:\Windows\System\BkdynSo.exe
  2⤵
  PID:10872
- C:\Windows\System\KeKTCLq.exe
  C:\Windows\System\KeKTCLq.exe
  2⤵
  PID:1764
- C:\Windows\System\BTvXFor.exe
  C:\Windows\System\BTvXFor.exe
  2⤵
  PID:10516
- C:\Windows\System\NmqiQfo.exe
  C:\Windows\System\NmqiQfo.exe
  2⤵
  PID:10324
- C:\Windows\System\IeubTtJ.exe
  C:\Windows\System\IeubTtJ.exe
  2⤵
  PID:12636
- C:\Windows\System\WnOQrXz.exe
  C:\Windows\System\WnOQrXz.exe
  2⤵
  PID:12248
- C:\Windows\System\WUrKCKs.exe
  C:\Windows\System\WUrKCKs.exe
  2⤵
  PID:12068
- C:\Windows\System\oNGKqPm.exe
  C:\Windows\System\oNGKqPm.exe
  2⤵
  PID:11968
- C:\Windows\System\JJLVvqf.exe
  C:\Windows\System\JJLVvqf.exe
  2⤵
  PID:11880
- C:\Windows\System\cFgOjTl.exe
  C:\Windows\System\cFgOjTl.exe
  2⤵
  PID:11720
- C:\Windows\System\FdfXxzS.exe
  C:\Windows\System\FdfXxzS.exe
  2⤵
  PID:11564
- C:\Windows\System\mOiVwGR.exe
  C:\Windows\System\mOiVwGR.exe
  2⤵
  PID:11484
- C:\Windows\System\DRLlJAc.exe
  C:\Windows\System\DRLlJAc.exe
  2⤵
  PID:11328
- C:\Windows\System\AzdrPxf.exe
  C:\Windows\System\AzdrPxf.exe
  2⤵
  PID:9236
- C:\Windows\System\oTbUWSH.exe
  C:\Windows\System\oTbUWSH.exe
  2⤵
  PID:4560
- C:\Windows\System\JUgeuVw.exe
  C:\Windows\System\JUgeuVw.exe
  2⤵
  PID:3812
- C:\Windows\System\NoZQaoH.exe
  C:\Windows\System\NoZQaoH.exe
  2⤵
  PID:9792
- C:\Windows\System\LxPJnWU.exe
  C:\Windows\System\LxPJnWU.exe
  2⤵
  PID:8752
- C:\Windows\System\GlXLwcZ.exe
  C:\Windows\System\GlXLwcZ.exe
  2⤵
  PID:8848
- C:\Windows\System\zBjSAkr.exe
  C:\Windows\System\zBjSAkr.exe
  2⤵
  PID:9896
- C:\Windows\System\zDxJbBe.exe
  C:\Windows\System\zDxJbBe.exe
  2⤵
  PID:10688
- C:\Windows\System\XFYrQUV.exe
  C:\Windows\System\XFYrQUV.exe
  2⤵
  PID:13532
- C:\Windows\System\cwPZSpC.exe
  C:\Windows\System\cwPZSpC.exe
  2⤵
  PID:13548
- C:\Windows\System\SaFnCqu.exe
  C:\Windows\System\SaFnCqu.exe
  2⤵
  PID:13564
- C:\Windows\System\JSapbWe.exe
  C:\Windows\System\JSapbWe.exe
  2⤵
  PID:13580
- C:\Windows\System\jGxpnCj.exe
  C:\Windows\System\jGxpnCj.exe
  2⤵
  PID:13596
- C:\Windows\System\sSVwwdZ.exe
  C:\Windows\System\sSVwwdZ.exe
  2⤵
  PID:13612
- C:\Windows\System\GlKyuVl.exe
  C:\Windows\System\GlKyuVl.exe
  2⤵
  PID:13628
- C:\Windows\System\AjCtTYS.exe
  C:\Windows\System\AjCtTYS.exe
  2⤵
  PID:13644
- C:\Windows\System\WSxiOsx.exe
  C:\Windows\System\WSxiOsx.exe
  2⤵
  PID:13660
- C:\Windows\System\eFMtbUN.exe
  C:\Windows\System\eFMtbUN.exe
  2⤵
  PID:13676
- C:\Windows\System\vCPAyxK.exe
  C:\Windows\System\vCPAyxK.exe
  2⤵
  PID:13692
- C:\Windows\System\DEvRCam.exe
  C:\Windows\System\DEvRCam.exe
  2⤵
  PID:13708
- C:\Windows\System\QDhEUfY.exe
  C:\Windows\System\QDhEUfY.exe
  2⤵
  PID:13724
- C:\Windows\System\MATMVki.exe
  C:\Windows\System\MATMVki.exe
  2⤵
  PID:13740
- C:\Windows\System\oLUcNud.exe
  C:\Windows\System\oLUcNud.exe
  2⤵
  PID:13756
- C:\Windows\System\xFCDMpG.exe
  C:\Windows\System\xFCDMpG.exe
  2⤵
  PID:13772
- C:\Windows\System\KodEntR.exe
  C:\Windows\System\KodEntR.exe
  2⤵
  PID:13788
- C:\Windows\System\YUqmiJW.exe
  C:\Windows\System\YUqmiJW.exe
  2⤵
  PID:13804
- C:\Windows\System\nfVDSgb.exe
  C:\Windows\System\nfVDSgb.exe
  2⤵
  PID:13820
- C:\Windows\System\lTagzuc.exe
  C:\Windows\System\lTagzuc.exe
  2⤵
  PID:13836
- C:\Windows\System\QZVwhHU.exe
  C:\Windows\System\QZVwhHU.exe
  2⤵
  PID:13852
- C:\Windows\System\UuLZgqW.exe
  C:\Windows\System\UuLZgqW.exe
  2⤵
  PID:13868
- C:\Windows\System\MMVTtNc.exe
  C:\Windows\System\MMVTtNc.exe
  2⤵
  PID:13884
- C:\Windows\System\vtVIHos.exe
  C:\Windows\System\vtVIHos.exe
  2⤵
  PID:13900
- C:\Windows\System\TBKvBes.exe
  C:\Windows\System\TBKvBes.exe
  2⤵
  PID:13916
- C:\Windows\System\XhBJJjZ.exe
  C:\Windows\System\XhBJJjZ.exe
  2⤵
  PID:13932
- C:\Windows\System\shtHtmg.exe
  C:\Windows\System\shtHtmg.exe
  2⤵
  PID:13948
- C:\Windows\System\kMKwRgu.exe
  C:\Windows\System\kMKwRgu.exe
  2⤵
  PID:13964
- C:\Windows\System\hTqYthJ.exe
  C:\Windows\System\hTqYthJ.exe
  2⤵
  PID:13980
- C:\Windows\System\SGaiygf.exe
  C:\Windows\System\SGaiygf.exe
  2⤵
  PID:13996
- C:\Windows\System\gWnGlcC.exe
  C:\Windows\System\gWnGlcC.exe
  2⤵
  PID:14012
- C:\Windows\System\clLUTQJ.exe
  C:\Windows\System\clLUTQJ.exe
  2⤵
  PID:14028
- C:\Windows\System\zWMFAok.exe
  C:\Windows\System\zWMFAok.exe
  2⤵
  PID:14044
- C:\Windows\System\ALYcEvi.exe
  C:\Windows\System\ALYcEvi.exe
  2⤵
  PID:14060
- C:\Windows\System\DFnVknf.exe
  C:\Windows\System\DFnVknf.exe
  2⤵
  PID:14076
- C:\Windows\System\tplbREB.exe
  C:\Windows\System\tplbREB.exe
  2⤵
  PID:14092
- C:\Windows\System\mrLBMNj.exe
  C:\Windows\System\mrLBMNj.exe
  2⤵
  PID:14108
- C:\Windows\System\pidNuEI.exe
  C:\Windows\System\pidNuEI.exe
  2⤵
  PID:14124
- C:\Windows\System\AvgXkbS.exe
  C:\Windows\System\AvgXkbS.exe
  2⤵
  PID:14140
- C:\Windows\System\dInCeTJ.exe
  C:\Windows\System\dInCeTJ.exe
  2⤵
  PID:14156
- C:\Windows\System\kXsfiTi.exe
  C:\Windows\System\kXsfiTi.exe
  2⤵
  PID:14172
- C:\Windows\System\zVraHZR.exe
  C:\Windows\System\zVraHZR.exe
  2⤵
  PID:14188
- C:\Windows\System\PriZBHf.exe
  C:\Windows\System\PriZBHf.exe
  2⤵
  PID:14204
- C:\Windows\System\BOQiDAv.exe
  C:\Windows\System\BOQiDAv.exe
  2⤵
  PID:14220
- C:\Windows\System\KLQWJyL.exe
  C:\Windows\System\KLQWJyL.exe
  2⤵
  PID:14236
- C:\Windows\System\QTWzSpU.exe
  C:\Windows\System\QTWzSpU.exe
  2⤵
  PID:14256
- C:\Windows\System\GvlhOsv.exe
  C:\Windows\System\GvlhOsv.exe
  2⤵
  PID:14276
- C:\Windows\System\LHeXsTa.exe
  C:\Windows\System\LHeXsTa.exe
  2⤵
  PID:14292
- C:\Windows\System\MzbkOTu.exe
  C:\Windows\System\MzbkOTu.exe
  2⤵
  PID:14312
- C:\Windows\System\pZslbXr.exe
  C:\Windows\System\pZslbXr.exe
  2⤵
  PID:14332
- C:\Windows\System\jhcLtGP.exe
  C:\Windows\System\jhcLtGP.exe
  2⤵
  PID:10284
- C:\Windows\System\fRPNXvl.exe
  C:\Windows\System\fRPNXvl.exe
  2⤵
  PID:10388
- C:\Windows\System\JdwsjyC.exe
  C:\Windows\System\JdwsjyC.exe
  2⤵
  PID:11952
- C:\Windows\System\bjkcDDy.exe
  C:\Windows\System\bjkcDDy.exe
  2⤵
  PID:5024
- C:\Windows\System\HTKVamS.exe
  C:\Windows\System\HTKVamS.exe
  2⤵
  PID:10412
- C:\Windows\System\zbFpFFR.exe
  C:\Windows\System\zbFpFFR.exe
  2⤵
  PID:14404
- C:\Windows\System\HmTppQo.exe
  C:\Windows\System\HmTppQo.exe
  2⤵
  PID:14420
- C:\Windows\System\GgJnqzl.exe
  C:\Windows\System\GgJnqzl.exe
  2⤵
  PID:14616
- C:\Windows\System\RIXjcVQ.exe
  C:\Windows\System\RIXjcVQ.exe
  2⤵
  PID:14632
- C:\Windows\System\ZMthBzL.exe
  C:\Windows\System\ZMthBzL.exe
  2⤵
  PID:14648
- C:\Windows\System\wFRIDwn.exe
  C:\Windows\System\wFRIDwn.exe
  2⤵
  PID:14736
- C:\Windows\System\xtdDhiX.exe
  C:\Windows\System\xtdDhiX.exe
  2⤵
  PID:14752
- C:\Windows\System\kcDAUvt.exe
  C:\Windows\System\kcDAUvt.exe
  2⤵
  PID:14768
- C:\Windows\System\uTnYPnB.exe
  C:\Windows\System\uTnYPnB.exe
  2⤵
  PID:14792
- C:\Windows\System\InBjOQT.exe
  C:\Windows\System\InBjOQT.exe
  2⤵
  PID:14808
- C:\Windows\System\YFpnPDW.exe
  C:\Windows\System\YFpnPDW.exe
  2⤵
  PID:14828
- C:\Windows\System\OpQZTKM.exe
  C:\Windows\System\OpQZTKM.exe
  2⤵
  PID:14844
- C:\Windows\System\LLYBZWz.exe
  C:\Windows\System\LLYBZWz.exe
  2⤵
  PID:14860
- C:\Windows\System\xapiUFS.exe
  C:\Windows\System\xapiUFS.exe
  2⤵
  PID:14876
- C:\Windows\System\YrvJctE.exe
  C:\Windows\System\YrvJctE.exe
  2⤵
  PID:14400
- C:\Windows\System\eSiTeWH.exe
  C:\Windows\System\eSiTeWH.exe
  2⤵
  PID:10304
- C:\Windows\System\JsZYmcv.exe
  C:\Windows\System\JsZYmcv.exe
  2⤵
  PID:13288
- C:\Windows\System\PFYHxcg.exe
  C:\Windows\System\PFYHxcg.exe
  2⤵
  PID:4016
- C:\Windows\System\qZSQKyk.exe
  C:\Windows\System\qZSQKyk.exe
  2⤵
  PID:10120
- C:\Windows\System\eSIEQqv.exe
  C:\Windows\System\eSIEQqv.exe
  2⤵
  PID:13328
- C:\Windows\System\RuZBHUk.exe
  C:\Windows\System\RuZBHUk.exe
  2⤵
  PID:13372
- C:\Windows\System\BfTkrpN.exe
  C:\Windows\System\BfTkrpN.exe
  2⤵
  PID:14668
- C:\Windows\System\DUInpWQ.exe
  C:\Windows\System\DUInpWQ.exe
  2⤵
  PID:13592
- C:\Windows\System\PpOzSTK.exe
  C:\Windows\System\PpOzSTK.exe
  2⤵
  PID:13668
- C:\Windows\System\EnTbOMI.exe
  C:\Windows\System\EnTbOMI.exe
  2⤵
  PID:13832
- C:\Windows\System\XkoZxlh.exe
  C:\Windows\System\XkoZxlh.exe
  2⤵
  PID:13940
- C:\Windows\System\ZnzAPEL.exe
  C:\Windows\System\ZnzAPEL.exe
  2⤵
  PID:14020
- C:\Windows\System\TxFtxvQ.exe
  C:\Windows\System\TxFtxvQ.exe
  2⤵
  PID:15060
- C:\Windows\System\XTiimKX.exe
  C:\Windows\System\XTiimKX.exe
  2⤵
  PID:15084
- C:\Windows\System\mLRdVjh.exe
  C:\Windows\System\mLRdVjh.exe
  2⤵
  PID:15140
- C:\Windows\System\pVkejLc.exe
  C:\Windows\System\pVkejLc.exe
  2⤵
  PID:14444
- C:\Windows\System\MqIIZzA.exe
  C:\Windows\System\MqIIZzA.exe
  2⤵
  PID:14476
- C:\Windows\System\WIurJer.exe
  C:\Windows\System\WIurJer.exe
  2⤵
  PID:14488
- C:\Windows\System\HBmpCdc.exe
  C:\Windows\System\HBmpCdc.exe
  2⤵
  PID:14604
- C:\Windows\System\vOdQxtz.exe
  C:\Windows\System\vOdQxtz.exe
  2⤵
  PID:14700
- C:\Windows\System\agOXMbc.exe
  C:\Windows\System\agOXMbc.exe
  2⤵
  PID:14716
- C:\Windows\System\lEKSVal.exe
  C:\Windows\System\lEKSVal.exe
  2⤵
  PID:9796
- C:\Windows\System\NSULqNy.exe
  C:\Windows\System\NSULqNy.exe
  2⤵
  PID:15236
- C:\Windows\System\DNUZqLa.exe
  C:\Windows\System\DNUZqLa.exe
  2⤵
  PID:15240
- C:\Windows\System\styBQLk.exe
  C:\Windows\System\styBQLk.exe
  2⤵
  PID:14272
- C:\Windows\System\nHkvLgl.exe
  C:\Windows\System\nHkvLgl.exe
  2⤵
  PID:10072
- C:\Windows\System\OWaZPwA.exe
  C:\Windows\System\OWaZPwA.exe
  2⤵
  PID:3896
- C:\Windows\System\JhJvsGA.exe
  C:\Windows\System\JhJvsGA.exe
  2⤵
  PID:8624
- C:\Windows\System\KQKEPik.exe
  C:\Windows\System\KQKEPik.exe
  2⤵
  PID:10708
- C:\Windows\System\stuhTGM.exe
  C:\Windows\System\stuhTGM.exe
  2⤵
  PID:14416
- C:\Windows\System\jiiZThl.exe
  C:\Windows\System\jiiZThl.exe
  2⤵
  PID:11140
- C:\Windows\System\iSaCigo.exe
  C:\Windows\System\iSaCigo.exe
  2⤵
  PID:13336
- C:\Windows\System\uUVpsWr.exe
  C:\Windows\System\uUVpsWr.exe
  2⤵
  PID:11568
- C:\Windows\System\smdbWvz.exe
  C:\Windows\System\smdbWvz.exe
  2⤵
  PID:11896
- C:\Windows\System\JFfGaue.exe
  C:\Windows\System\JFfGaue.exe
  2⤵
  PID:9112
- C:\Windows\System\yYguDsH.exe
  C:\Windows\System\yYguDsH.exe
  2⤵
  PID:6320
- C:\Windows\System\rpeTpel.exe
  C:\Windows\System\rpeTpel.exe
  2⤵
  PID:12168
- C:\Windows\System\vygpsST.exe
  C:\Windows\System\vygpsST.exe
  2⤵
  PID:13144
- C:\Windows\System\HvCrNTe.exe
  C:\Windows\System\HvCrNTe.exe
  2⤵
  PID:11612
- C:\Windows\System\ssqyXhk.exe
  C:\Windows\System\ssqyXhk.exe
  2⤵
  PID:680
- C:\Windows\System\aqnBSQn.exe
  C:\Windows\System\aqnBSQn.exe
  2⤵
  PID:10528
- C:\Windows\System\CiQeyxT.exe
  C:\Windows\System\CiQeyxT.exe
  2⤵
  PID:11288
- C:\Windows\System\ojDUJju.exe
  C:\Windows\System\ojDUJju.exe
  2⤵
  PID:15112
- C:\Windows\System\hjzsDTH.exe
  C:\Windows\System\hjzsDTH.exe
  2⤵
  PID:15132
- C:\Windows\System\mUBgyVX.exe
  C:\Windows\System\mUBgyVX.exe
  2⤵
  PID:14896
- C:\Windows\System\vcUEZlY.exe
  C:\Windows\System\vcUEZlY.exe
  2⤵
  PID:15092
- C:\Windows\System\fXBRHKo.exe
  C:\Windows\System\fXBRHKo.exe
  2⤵
  PID:5044
- C:\Windows\System\uvtfpsG.exe
  C:\Windows\System\uvtfpsG.exe
  2⤵
  PID:12624
- C:\Windows\System\MiJinpX.exe
  C:\Windows\System\MiJinpX.exe
  2⤵
  PID:15160
- C:\Windows\System\ullucLs.exe
  C:\Windows\System\ullucLs.exe
  2⤵
  PID:15192
- C:\Windows\System\EgeHKQM.exe
  C:\Windows\System\EgeHKQM.exe
  2⤵
  PID:15268
- C:\Windows\System\zKheAqq.exe
  C:\Windows\System\zKheAqq.exe
  2⤵
  PID:15156
- C:\Windows\System\MBrwcWU.exe
  C:\Windows\System\MBrwcWU.exe
  2⤵
  PID:13624
- C:\Windows\System\XxfMWQV.exe
  C:\Windows\System\XxfMWQV.exe
  2⤵
  PID:15208
- C:\Windows\System\qrmpaBa.exe
  C:\Windows\System\qrmpaBa.exe
  2⤵
  PID:9340
- C:\Windows\System\czqDjPJ.exe
  C:\Windows\System\czqDjPJ.exe
  2⤵
  PID:8756
- C:\Windows\System\fLwVwwc.exe
  C:\Windows\System\fLwVwwc.exe
  2⤵
  PID:15336
- C:\Windows\System\GgeQtmW.exe
  C:\Windows\System\GgeQtmW.exe
  2⤵
  PID:4636
- C:\Windows\System\nSCMQEi.exe
  C:\Windows\System\nSCMQEi.exe
  2⤵
  PID:1864
- C:\Windows\System\YSViuHd.exe
  C:\Windows\System\YSViuHd.exe
  2⤵
  PID:14084
- C:\Windows\System\pYipDmN.exe
  C:\Windows\System\pYipDmN.exe
  2⤵
  PID:10892
- C:\Windows\System\jbYyHqR.exe
  C:\Windows\System\jbYyHqR.exe
  2⤵
  PID:15184
- C:\Windows\System\tMwxuLW.exe
  C:\Windows\System\tMwxuLW.exe
  2⤵
  PID:7980
- C:\Windows\System\TjTmzgt.exe
  C:\Windows\System\TjTmzgt.exe
  2⤵
  PID:10548
- C:\Windows\System\qsHJalp.exe
  C:\Windows\System\qsHJalp.exe
  2⤵
  PID:3180
- C:\Windows\System\agblGZj.exe
  C:\Windows\System\agblGZj.exe
  2⤵
  PID:14088
- C:\Windows\System\ebQEyga.exe
  C:\Windows\System\ebQEyga.exe
  2⤵
  PID:14916
- C:\Windows\System\ZQRkchX.exe
  C:\Windows\System\ZQRkchX.exe
  2⤵
  PID:11500
- C:\Windows\System\IRDHJlE.exe
  C:\Windows\System\IRDHJlE.exe
  2⤵
  PID:12200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zlcwyhd5.my0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BkaTVIS.exe

Filesize
1.4MB

MD5
24a71ea43d6dd3058cfd60cafc4cc690

SHA1
54af3e90e91ee518553dac4bfe912e03673be809

SHA256
ba3387998ef72b50d6d6ec1c0099084d706d2f4974695c6ef274fd50348fd809

SHA512
d033d16f82a01dd998d4a9c273c645da9b42ac0417e92356cc7856f6c4700f209b1797471528e41137038882f69b202f5abdbf7b4d51180b397b97a4f0a5ef02

Download Submit
C:\Windows\System\HJZuyOk.exe

Filesize
1.4MB

MD5
8006b8eb43a0c957cd1d1e02a56931e6

SHA1
66c3f2c9ec0fefbfb2c9d18c2a17dff92247c67a

SHA256
b9bd0c09dfab87cd595ab36762a82b40290a8c37f8c5d652bffc4c437ad060e7

SHA512
f5deb8f2c1c37f88dbeacb42c8c65a1debf61c0bc73a424985c5109efe6b8c4366870b068875c0fca2b502bbd8c51bf45a6e86e33aecb3e0f1d6b37e592245d9

Download Submit
C:\Windows\System\JWAryJH.exe

Filesize
1.4MB

MD5
0c41d142ffd48a49a6438bc29021fd99

SHA1
f490f8cc2778ed816d3224f5c0c529a1931b9b7d

SHA256
21123d287d6c135d490caf14d2a546e2fa00f53cda4f83215e4b23779aff3fe3

SHA512
9130a75d84238997f3029acb02c40b446d1514cd0a771503bfce64d770ae627328a1fd6faaba0677852bb74147f4c2155e32cf03f44898e5f6dd4ec1086b77ed

Download Submit
C:\Windows\System\NnfMDKT.exe

Filesize
1.4MB

MD5
1bbc6ae7811f48ac7749e1878544022c

SHA1
86bc9733cefdd38ca89565fa8cc132bc9a956c75

SHA256
afcbf178ccbdaa64858d84624b6bb3d644ec0b822e09d74debe48344ff73cc05

SHA512
a6b2deabc6b7f9fc9fca5a03386cc64c164d270b35fa5f48223648f16759303ae347de4fe3524fef0d10acb5e5903df8a931123c5dbca534a8bfa662647ddff2

Download Submit
C:\Windows\System\NssqZzU.exe

Filesize
1.4MB

MD5
8f8d49172ae688b7c9dfce27fa9db200

SHA1
73d703be15274d083fcf5be29432dd6284e86ba0

SHA256
6a11ae1a6be439769565425b5d8ab048045ebb946a5445ca9a543d453c2d8e78

SHA512
54db58503f4c030051b85d00ca6f3b0d76a58514553fc643fb981622325c139c784a313193131231cd5854b997f7a761dfb08af844806dff0b3af2f588fcf1da

Download Submit
C:\Windows\System\OGRPOUO.exe

Filesize
1.4MB

MD5
49277fb0291205df220324b67e095ae2

SHA1
8c342e5299baa6bd1b1719ccfd3d80b21cdce07e

SHA256
47c7c1feaf9e45788d794beacfce2538fb4278b0958bd0af853631fe3a5adf42

SHA512
6c456e34be2eb0a49a1e1824bfaf55ec4cfa034e4bfc5d35a29011bb6614aabbaf1e45ee8b4e832f710ac5ad0de3259ac409046426c0f4c62a6ee549b1d4a280

Download Submit
C:\Windows\System\PJNhDbZ.exe

Filesize
1.4MB

MD5
4b4d54c4b7560dadd3391bc229afdd13

SHA1
2f928f6572ae5e0521342f0fec7db7c50e2c188e

SHA256
b09ff31a1e97d8886ad137164433eddc105ac1d364009a585295ff45dad07971

SHA512
f2128799f80d841b11d2661bef267704ee3139da3c4eb9d3d0821d5fb31fae394c09149fd29bf7d7dccb4ebda9e8a1915405a99bfc3ec55f1e44d438601e7602

Download Submit
C:\Windows\System\RFIarSH.exe

Filesize
1.4MB

MD5
a3e614228b36a77fad01e311291f63a2

SHA1
f6de5a184d221ec5608c19637f4f96395f967386

SHA256
b256a2d18c363972e58b85211a61843e687b6305b8e99c705d985495f64d7534

SHA512
fc773a2b7403c17c14f774e5282e66a165dc574080a54a3e22f5a0ff21ccffc9b6380626fda1d463cc2355fea91d11a1a4f3d8e9c91d1dc71776d53c8bec52c0

Download Submit
C:\Windows\System\RFgXQeZ.exe

Filesize
1.4MB

MD5
97f6a8147a1a010b0fa05083ee787e87

SHA1
a4f2cb38277c2ecb77f0bfad5687e595833ccd46

SHA256
995f9ab128bdc4dea847264cce186bcbdc0a03f11a6163c7b40013d6ac0f4339

SHA512
ed9bc7a3c52af9703206f284051ca4b559b6c59c6c148bc80054678f21b3b8ccdd33c58cdd7a5d517de911826563d330a764a958c3badcadb2d55066a4579b07

Download Submit
C:\Windows\System\RLaTNGI.exe

Filesize
1.4MB

MD5
f2f2a78999d9002117e6f53911e11d2e

SHA1
a49e72b5d49d195841df61473dbe845e81eddcc0

SHA256
b784a70afaf2173995faba2c18997d9982d0bd879550b8943582386369c6a0bf

SHA512
b56b4c65142ef91d3aa2a2dbbffc23fb413b9e6c8a407acf3e5c09ad2ab4df3ebed90684fcadd255f44688320e1cba46f4cc65371596f900d51dea6c6847a2f3

Download Submit
C:\Windows\System\UAQWVaz.exe

Filesize
1.4MB

MD5
3f27e94efa94c94bea3087bcac2dd8df

SHA1
938a3f6ab8dddabafc67c451ed1232faa86ade31

SHA256
d242eb87f5838662ff8af9655fcb755c76107e4ed98a6bdc6a843e477db7434f

SHA512
e3807a1f6549e02cf393d12296c42ecabb37e91109a123b12dbfaa49879765b0114dff398a4adc8f70f9ba6be726f61a5225a44dc4fdd28eec557e086399d9b9

Download Submit
C:\Windows\System\UQooUHF.exe

Filesize
1.4MB

MD5
1e909d75b4277254050ba57c6ba4318e

SHA1
a3f8a6f30154b01e7c797f21ab34b4f37366fd8a

SHA256
60670036d43671f50bdc26111c225ee04e626085a0347316d8b7c0be371fd160

SHA512
f3c3fea6969dda005de6ec40192e8f23cb1abec5409f956d3c6438c5bd2e6b9dc61254b5536cc26765bf9d76bbfa3d54a72a46a874bb5a151d749e2ad357d0f1

Download Submit
C:\Windows\System\YotFwLf.exe

Filesize
1.4MB

MD5
dbe41170c5321299c56cc34618db274c

SHA1
1dc7d9aa7711c6bc2477032439c3a49b26cfa287

SHA256
f92babfefe257f7aee134f20f21e8dcb289d5a8a66b5bc3df1c2a690a0f0f14a

SHA512
4e140ec97d89b3d81d0faae2c35fdda5994c90aee6cd42924c98c343e0b676d2bff19cdeb9f31b5d1a37df3d6ea654ac6628b035c5276d4e90b7f2ddb2ea9332

Download Submit
C:\Windows\System\YxShxHU.exe

Filesize
1.4MB

MD5
4291d75bde0a2a2532d00929f7209ff5

SHA1
746a41543f79bd7926b4d872b7ea3422a07ad6a4

SHA256
bb5bb9dd479e04d45b9966a68d752170c0f5c9cf4a509461930f509c33d8753b

SHA512
99598cc39bc1ebee6d0cea7bf1c9f77758908b5a380ce5d4eb185447b2571950e38c9d291520eff4dc55370bc83034b58206966accaa398ccdcc39eb4c6d80a0

Download Submit
C:\Windows\System\ZdxiuaR.exe

Filesize
1.4MB

MD5
1cbb0fd6b035e71432918a1478f47e87

SHA1
b8406e8dcb521b4ab5382a51d72e8b33900975a7

SHA256
556496fd9054044adb4b4b14aee37a32e8bae767d166f2a14cf5356d15e0e1e4

SHA512
6b2c8fde06b9421eb32db0b196f05e18946dcf9d1ec5a28f51dc53d0e86796a8d2ac44d0ce20ec2d01307c4c001775b8f15bead572a8ef6fbbe73ec3b5c699cf

Download Submit
C:\Windows\System\ZyaYdcA.exe

Filesize
1.4MB

MD5
eb4caf603dab1c8028c65197e738f1c5

SHA1
4221f9a90e5243b95a4c8c3b9d06574b25a54518

SHA256
7fbe9d5192dc48f34ad3807778209cae56c87631a61d69c17049345b70b4c970

SHA512
3c6297cfd750561a8dc03657cf9bc535ce128d0c1dfc9aa292bc3f900a3b1cd1e32c0c46339dcd6973f4954fdc9a72dd7c37b0dc8c15246c1d235c9f8157a110

Download Submit
C:\Windows\System\bfkBpQq.exe

Filesize
1.4MB

MD5
a1afe97c1ac26ddc57f66ef8ee20a3ae

SHA1
ff7236c33271ce6707289e7e0bcb868af8fd94f2

SHA256
6a09ae0ec749030928ac5ae2acfc710c7d71a7f398518966b46a63fc94bffa7b

SHA512
0f6b6e6caf819db2544e2c6c0d0d16db6e1cd0bd50aff0c42d70312a6518f2e58a1ece4a6eebb6c7e4322f76d25dada561a8a1512bcb88c1bd2369ba21d7c40b

Download Submit
C:\Windows\System\cMeYmhE.exe

Filesize
1.4MB

MD5
a4e7ac2883b2d8f26eab813addd21028

SHA1
89a113c1d5d8a186bd9d3b923f4bc490bc3888c6

SHA256
13032b1f79122d38ade84a91222c5ce65f05468f430232057cb6121021acb1cb

SHA512
79160ca03f7b5bc13eb98353196d140b7ccc1c255982601a18c98f46ab5fd5944f688ad35495d5db654b9cbaaa2bc31d98e196f673fef8ef04103e9d38373262

Download Submit
C:\Windows\System\dFKjkYw.exe

Filesize
1.4MB

MD5
958c33cfa058f7675a507fddb57e0760

SHA1
d1425de52755a15f59d6f39f1ec07c9b9bb25bcb

SHA256
06ec9a20e3a6da42727793733f296436c05ef8bcfad18691a01870e6f0a8b766

SHA512
31358cd6138f1bb72f4cac954078be46d1de3a347ef635058b7d4a0298360467be4ff6b9954b5ee9a138c392e14cf64179a5a027cbe6c7726f0d6f009c4fdcd8

Download Submit
C:\Windows\System\edxiVBU.exe

Filesize
1.4MB

MD5
ab9ad2ea25fe614b41dd5e306ddd1d1e

SHA1
7793c3787b635fa0c89b22a968812da13bf1ac4b

SHA256
5856acadd7e1522123b7350076bf093d197db8b1499dc44b0d87a69871738486

SHA512
a82c3e4c8bdeadd1fa6990d8671d5c8ed5962f76a96ef85039c819d5f0b94da646e5930623f453a08f8ba6bf93dfc4d11743b67507fe5dd3b0393d42173337eb

Download Submit
C:\Windows\System\emZBOwp.exe

Filesize
1.4MB

MD5
b302f575f15eb7802fd29a60f0a587b5

SHA1
9f8cb5a4ae67d1839a8d281fddcafcf610e6252d

SHA256
f552e28031c1da78a5413e2195a72728ab7b30b5de51cd988b069a4818976cab

SHA512
3d062b7f9941c6454ebc6c83513bb5df48bb3bf2f36587bde8f5ec5b7b62a3e754e6e019a01ba7b6c29311f396317b21f992c0478bbf7da1863af8890a2a94d9

Download Submit
C:\Windows\System\fgawTPj.exe

Filesize
1.4MB

MD5
7b804ac95ac275e7795b05fe63457393

SHA1
0b8eab399d524fa7da88e7762d323f1a7d2a5ed9

SHA256
b161d144aa20b14d59177fc85ca5604a9e4d7f00014b1cac3932ea295417232d

SHA512
89d10cae9a4c8d60aa5d6ed1803fbc40e577eb3d71b543dd74d360cd9ff038c3c734f17b7e4596deac6a81e4a9a8b5c3c7a154a1ca465e1de1fa5c863d7cb634

Download Submit
C:\Windows\System\fmXyqze.exe

Filesize
1.4MB

MD5
7af98a8d513468f9b48104474bcd32f2

SHA1
cecfb9cfb1b3416f50815b01c4c2cf74a4b4ad00

SHA256
82811cf52795a8b7b4bb8556aeb25476ed35637982b468a086ab0d229983723c

SHA512
b33044277f6fa675f0a281b8e83ba77c6c70956a01e1b3288d55e7896155c71b8bd778e59a974305254a174446ba94ee3f973818a574ef36b8642d3f0cbdd4fc

Download Submit
C:\Windows\System\gErMYBJ.exe

Filesize
1.4MB

MD5
f4300b3ec3e81cf7b64c10d962169c36

SHA1
9cf3dd75a6489545d92f29487fbd932d29288720

SHA256
3292ada0a98dae698e5b0ebe50a5589f411498bd38efec99fb93c27a3cf3d3ff

SHA512
275b92215a551df704248c556ef4161efea7e5b620b5684f9b54e31f07c0dd4d3470d8e40057f1269af90a41eb069b01fe59c7eda4e0699ef2bad889a6a7728d

Download Submit
C:\Windows\System\lAwsTZg.exe

Filesize
1.4MB

MD5
929a8b789dac4401533b2d0940714c32

SHA1
70b99ce440202d72e21174b846a3185d655a52d0

SHA256
0ed982f56b1d6fdfb731550d0eb5174c586c4e150f6354003f6fe510d593ff59

SHA512
544ebb225cc29794e81b248f3dd898bdcb0ec9d20c39136c71ab650c9c0c45b6b5e6f9a78bc6bb9936c66966e6f41bda5889ea02eaa80e3ed10d6d055a73612f

Download Submit
C:\Windows\System\mgNDokK.exe

Filesize
1.4MB

MD5
6155e8d2867100f7e8eaabfcd6dac90e

SHA1
ada8a4b20b26cfab0bdfa7f3af1473f2a44a06bf

SHA256
d3a6a649f9c2eb7d590dc021fb2879ffb3a2f530a36b4c6980b7c80bc11ac8c8

SHA512
a67eee63f55d04e764f5fe41313f354033197947c6b68cb560a5f67902353821819cd748e4987ef86964eeb1701e27c97e5d3a2e3306ae4512c11498548e7109

Download Submit
C:\Windows\System\nCPSeuU.exe

Filesize
1.4MB

MD5
c4510833d1420cf4fb9bcda8895475ce

SHA1
dd8badd3401e14c1055b632068d93c93768e9ec1

SHA256
288741ba488fbc2b9fc3a9ea081b8b0fa78e9cacbe3652a5176a1f60cff00766

SHA512
8f1d2a8a01a33979ad1dbb31afdc35fba6dd36481e4b90d8c48302a310cb37064224535cf519e44f5ad85b86342f2dbd38c62b3a7178f6a7c1905476a15b647b

Download Submit
C:\Windows\System\nJGkRWB.exe

Filesize
1.4MB

MD5
78f4c67ec00e3fb7c49d38e6bf5801de

SHA1
faa057a7862ee8b64503765df775601d9bde04d4

SHA256
f3e74f53ba9b9422ecb2421b39515a10cd30ea257e29bc415fe2d272c5e78789

SHA512
8db4f744b5eb6a7420340232ce528c364a180bf0c2f3c8a6839da596bf31be2e4fd9fc937592a858a85788ff15ca7923cc0718b3f4142c3223b436e92441d813

Download Submit
C:\Windows\System\nWxmrGP.exe

Filesize
1.4MB

MD5
f9740ce052ded8564b56fb55fd4d38a2

SHA1
827fa0491e6c6bbad132776822e048ab84fb651d

SHA256
2d1732c430f6b32e3ffbf5ae0f56a393dc7938d03867d712e7af9b797491da17

SHA512
a98a78538ba6709f90a344afaf1eea87432450644db80d7f6f95cc32bdf802f5ee57278013adc7c8d8de9a75be90a1ea5ddcf019c72fa0d26352802b349e07c6

Download Submit
C:\Windows\System\npOsuNf.exe

Filesize
1.4MB

MD5
d2faf59cc77197740f107bd784625a13

SHA1
1ebaf865f235a04a1a0bca0723ed3e060d154e57

SHA256
9d37c797b59cfb85501ce9f684e3e54d1533eb58bede6c5a2469bb4b08fcdc76

SHA512
d222faff5583a6d3be88adfe6160b645ac7834fd709fa2dfe106f94c03bbbd2762191570baae87963b9129f877a1050859fc5c2a2e80bacd81a5b21146d67184

Download Submit
C:\Windows\System\pFFdjFJ.exe

Filesize
1.4MB

MD5
43f4006f8e48af91fdb883e23cf2f3e1

SHA1
34df515d83aa1c2bad684b65640728016e736176

SHA256
a9b383429bff280efaac657a34e891b6e16cac20ef1710217c007ce427182545

SHA512
9bebedc7b60b6d2eda7b1c13094fe93e0b334694160d785af48c6c9c340cd24dd165a76af172d344e6d3babd7157aebe4cdd8655c4a8dda276bd68ba0cfba2f2

Download Submit
C:\Windows\System\pYqvshJ.exe

Filesize
1.4MB

MD5
e41e8b79b6e8d1bf3e72d766157c2a37

SHA1
0e098b1fcd0bd7f6d92d8d255ce30855677aca2f

SHA256
04081292818993177c29789145a9d3631f205ca7d73e200921c03831629e30ad

SHA512
e9cb14a07ff54e7f00697d1f96b04aec0b26110c9762b1b2f0be97c40c924334b352b3f26cc80cddc98f009aef1ff08a368b17aac9cbda8af01b6240c05eaa07

Download Submit
C:\Windows\System\rSdAFJx.exe

Filesize
1.4MB

MD5
82882910f6f424eb9f1614783199a6b7

SHA1
ad2c29697d8ef45dc6c7f57d98901b644cc16d49

SHA256
b837eb10f688f5165e9afd304af5711154176ea70484d3901f3d29d79bfee758

SHA512
1084bc1006f0c7d5d5aafbae0d8b5d807b9b4f53dd2e9e59e00f9cd60c478a08779b81da4d1e909efb2a4a82a431bf5e2474de7b42c47798e46ec4cff5ea8ccb

Download Submit
C:\Windows\System\tafYlvZ.exe

Filesize
1.4MB

MD5
b8889391dd6c8103002f48ac057be9ba

SHA1
d54adca94c8c31f45917afd1d96eeb40d14aedeb

SHA256
74a4145be73b764674f27c276a14210cca83e78ba1dfeda30e1b4924021c4311

SHA512
681cf0dbeed8737cb7830173c1eb0353545d8aec56923407f535a1a1e8f1cbc9bd96bad4f68b6c4a489b2da2e0243893f3c40b58b7f7724e86c6ec7b305146a7

Download Submit
C:\Windows\System\uEfDJKQ.exe

Filesize
1.4MB

MD5
c694d13efb563d95438c20e9f56df492

SHA1
f2aa14512fae7475eafebdfbf0325c94225566f7

SHA256
fdee53c809f0c7dd3356f920d54604040b644793ffe3ca1d7477fc70621dadda

SHA512
f825e73bfcb950006610f53be02532d4c185dd0a85a5112d5bc3e53a253fd5f062b9c57f9b594f964f0fd918512cff22fba6bf6064e3f44257ac3bc6006e286a

Download Submit
C:\Windows\System\wTeITPC.exe

Filesize
1.4MB

MD5
dbb5b834a06ec45b3765f4c0bae684b6

SHA1
b816e4efecfd8b82aa1c434a0957a84eaf51841f

SHA256
36ec343c9b0f5ce7949ecc8eb282f9beb4eb28f2b9338434d6c65569bb707e02

SHA512
8da63f85af784f279a0486e98d3149a1df0b8d47862d0e56beeef69d001f09ff87777891bb13b6460678688610511faabe9cafa18e6e462c18fd6d6c4a17327d

Download Submit
C:\Windows\System\wUADVSY.exe

Filesize
1.4MB

MD5
80eeed1aff0043403915389df9e0aded

SHA1
de1ac442fd74e55cdb46add9fa4b0634d0d92fd9

SHA256
bf37d36f333ed3c2a09fdc389fc6587b8aabfb8ef88dfabc003fdf869b71c988

SHA512
97ae2eb4f3008121448c6f7086039eed98a45dd5a51aaddf6a988b3e97b67d6f2e98e3f87d4e6a5d140d2b21ad630b39df1917f9377a87590fad9ef3a48c2a96

Download Submit
C:\Windows\System\wrweqXo.exe

Filesize
1.4MB

MD5
45de5bd9569d5744400de0cfd8c12668

SHA1
9c82902f0fe93df0b3185e7a59b09a00cbe9da2e

SHA256
0fa47e237e511168aa84819d4bac2175d2f7f49ad961668f66b665030e488119

SHA512
b78f592a52cda20cc7df8fcce70a25e9cba9004b20d1c978dee631923f323d0ce9f5019adc327a4340f2ae9a2ec9e121524a41c4d0aeb5dacc1c75d0db4a5bee

Download Submit
C:\Windows\System\xWUonSk.exe

Filesize
1.4MB

MD5
7fc79d7dd1f4d182b31b77aed71e7041

SHA1
19d137c09d2c42d16a69f7a23550d0d01e63df15

SHA256
7b93b8e0d0335108172894f7e1b00f08fbff56c9a874733c1e6f11f296c50e71

SHA512
e4727e3a31e8b75126df433bc2ed3f15882a8540556381dd9c050708891938e01c984a95a8fd12fd7a7b995f27a6a990d71e102e125dd57a8d0e098d50eb9d79

Download Submit
C:\Windows\System\yOADNSl.exe

Filesize
1.4MB

MD5
fa95dca1a31ac636e11de1da11ac2d08

SHA1
848c7efff504f3e8c8d0ab7e7127ec7c027c3d22

SHA256
bf24aaf32ee784d3c33c03fef23fa1e00cab9cd90cedf99a0f1fa1931411e5a2

SHA512
b59c55ea52070b3b3947b707ec1b858f42f1e586fc9e605f80e47cd515a965637a2ca3bcab4a75d163bed40dcce5384dde25bd42f34ad0d610368e95b2cb8c58

Download Submit
C:\Windows\System\yjKbWHB.exe

Filesize
1.4MB

MD5
c5d9234478e286d668cd7bf09f5a7f7b

SHA1
f56a5005552881d69a8232c28d3340adacac5788

SHA256
e2f8573bd72f8e8872f21c714908400854b5dffef31c8dc2f70714e71edff0d2

SHA512
2a92031d8b2cefde8d39f4c2e496d6510a13e4ff57b956834773e802ccf796ac75593bd76f3354d85348e7e7740085af9a33c2ec190a9649fe8f0d50a7286172

Download Submit
C:\Windows\System\zUKENBO.exe

Filesize
1.4MB

MD5
3163a7d1476abce415388f29d9783094

SHA1
49ec23225aaa5cdcfce5feb3c637a9811ef73473

SHA256
ee95fe68cff201252b41af4bf44f1eaf9580833d3f89a00783e5c68d4c37275c

SHA512
0fc3974f776138617bbbccf5bf207b9df852bbb2846749112723859be9bfb3d189970bd7a1955a99c74a469b6b9e54e2db97c1aca182560832baf0c43f240bc8

Download Submit
memory/808-3102-0x00007FF61FB30000-0x00007FF61FF22000-memory.dmp

Filesize
3.9MB

Download
memory/808-737-0x00007FF61FB30000-0x00007FF61FF22000-memory.dmp

Filesize
3.9MB

Download
memory/1172-3148-0x00007FF658000000-0x00007FF6583F2000-memory.dmp

Filesize
3.9MB

Download
memory/1172-1362-0x00007FF658000000-0x00007FF6583F2000-memory.dmp

Filesize
3.9MB

Download
memory/1228-321-0x00007FFA95063000-0x00007FFA95065000-memory.dmp

Filesize
8KB

Download
memory/1228-734-0x00007FFA95060000-0x00007FFA95B21000-memory.dmp

Filesize
10.8MB

Download
memory/1228-1068-0x000001A7405F0000-0x000001A740612000-memory.dmp

Filesize
136KB

Download
memory/1228-2120-0x00007FFA95060000-0x00007FFA95B21000-memory.dmp

Filesize
10.8MB

Download
memory/1228-632-0x00007FFA95060000-0x00007FFA95B21000-memory.dmp

Filesize
10.8MB

Download
memory/1284-3138-0x00007FF647C40000-0x00007FF648032000-memory.dmp

Filesize
3.9MB

Download
memory/1284-1573-0x00007FF647C40000-0x00007FF648032000-memory.dmp

Filesize
3.9MB

Download
memory/1416-2968-0x00007FF619470000-0x00007FF619862000-memory.dmp

Filesize
3.9MB

Download
memory/1416-0-0x00007FF619470000-0x00007FF619862000-memory.dmp

Filesize
3.9MB

Download
memory/1416-1-0x0000027C65D50000-0x0000027C65D60000-memory.dmp

Filesize
64KB

Download
memory/1732-3139-0x00007FF658C20000-0x00007FF659012000-memory.dmp

Filesize
3.9MB

Download
memory/1732-743-0x00007FF658C20000-0x00007FF659012000-memory.dmp

Filesize
3.9MB

Download
memory/1824-736-0x00007FF65CB70000-0x00007FF65CF62000-memory.dmp

Filesize
3.9MB

Download
memory/1824-3100-0x00007FF65CB70000-0x00007FF65CF62000-memory.dmp

Filesize
3.9MB

Download
memory/2032-110-0x00007FF628FC0000-0x00007FF6293B2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-3038-0x00007FF628FC0000-0x00007FF6293B2000-memory.dmp

Filesize
3.9MB

Download
memory/2124-226-0x00007FF7A45A0000-0x00007FF7A4992000-memory.dmp

Filesize
3.9MB

Download
memory/2124-3094-0x00007FF7A45A0000-0x00007FF7A4992000-memory.dmp

Filesize
3.9MB

Download
memory/2272-741-0x00007FF6A9310000-0x00007FF6A9702000-memory.dmp

Filesize
3.9MB

Download
memory/2272-3113-0x00007FF6A9310000-0x00007FF6A9702000-memory.dmp

Filesize
3.9MB

Download
memory/2320-1070-0x00007FF6AE5B0000-0x00007FF6AE9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-3120-0x00007FF6AE5B0000-0x00007FF6AE9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-3080-0x00007FF79C330000-0x00007FF79C722000-memory.dmp

Filesize
3.9MB

Download
memory/2392-168-0x00007FF79C330000-0x00007FF79C722000-memory.dmp

Filesize
3.9MB

Download
memory/2516-740-0x00007FF7C0070000-0x00007FF7C0462000-memory.dmp

Filesize
3.9MB

Download
memory/2516-3116-0x00007FF7C0070000-0x00007FF7C0462000-memory.dmp

Filesize
3.9MB

Download
memory/2568-735-0x00007FF6FAD10000-0x00007FF6FB102000-memory.dmp

Filesize
3.9MB

Download
memory/2568-3092-0x00007FF6FAD10000-0x00007FF6FB102000-memory.dmp

Filesize
3.9MB

Download
memory/2988-3127-0x00007FF7EBB80000-0x00007FF7EBF72000-memory.dmp

Filesize
3.9MB

Download
memory/3008-3090-0x00007FF7F2870000-0x00007FF7F2C62000-memory.dmp

Filesize
3.9MB

Download
memory/3008-320-0x00007FF7F2870000-0x00007FF7F2C62000-memory.dmp

Filesize
3.9MB

Download
memory/3012-3036-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-14-0x00007FF6AF4B0000-0x00007FF6AF8A2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-1069-0x00007FF6E06E0000-0x00007FF6E0AD2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-3097-0x00007FF6E06E0000-0x00007FF6E0AD2000-memory.dmp

Filesize
3.9MB

Download
memory/3968-739-0x00007FF632C60000-0x00007FF633052000-memory.dmp

Filesize
3.9MB

Download
memory/3968-3118-0x00007FF632C60000-0x00007FF633052000-memory.dmp

Filesize
3.9MB

Download
memory/4304-3142-0x00007FF684070000-0x00007FF684462000-memory.dmp

Filesize
3.9MB

Download
memory/4304-744-0x00007FF684070000-0x00007FF684462000-memory.dmp

Filesize
3.9MB

Download
memory/4704-3130-0x00007FF74BED0000-0x00007FF74C2C2000-memory.dmp

Filesize
3.9MB

Download
memory/4704-738-0x00007FF74BED0000-0x00007FF74C2C2000-memory.dmp

Filesize
3.9MB

Download
memory/5056-3078-0x00007FF73DA30000-0x00007FF73DE22000-memory.dmp

Filesize
3.9MB

Download
memory/5056-57-0x00007FF73DA30000-0x00007FF73DE22000-memory.dmp

Filesize
3.9MB

Download
memory/5084-3129-0x00007FF7C25D0000-0x00007FF7C29C2000-memory.dmp

Filesize
3.9MB

Download