xmrig | 40079724dbdf62f70139682c7b7e021d8b419c4de4a4771c37dd92b08707bd79

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
Size

2.2MB
MD5

0d2acde3160fbfbe2a155efd3260d00f
SHA1

e5e1a91bb672a6188d0705f1e9da3b049c2f2b13
SHA256

40079724dbdf62f70139682c7b7e021d8b419c4de4a4771c37dd92b08707bd79
SHA512

3fe38c41205a874c681efbcc2f365f17ff7ea14bf3beeeac9532d88fba273bbad779f92f09ff4cc739fbe493a3982a7fbde4642f5a919e16eaf56082337acacb
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfq:NAB9

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/2692-239-0x00007FF7CC280000-0x00007FF7CC672000-memory.dmp	xmrig
behavioral2/memory/860-203-0x00007FF747680000-0x00007FF747A72000-memory.dmp	xmrig
behavioral2/memory/4400-162-0x00007FF7036A0000-0x00007FF703A92000-memory.dmp	xmrig
behavioral2/memory/4960-283-0x00007FF775310000-0x00007FF775702000-memory.dmp	xmrig
behavioral2/memory/1488-80-0x00007FF62C9F0000-0x00007FF62CDE2000-memory.dmp	xmrig
behavioral2/memory/2268-292-0x00007FF6FDEC0000-0x00007FF6FE2B2000-memory.dmp	xmrig
behavioral2/memory/396-402-0x00007FF729D00000-0x00007FF72A0F2000-memory.dmp	xmrig
behavioral2/memory/5060-406-0x00007FF79A9E0000-0x00007FF79ADD2000-memory.dmp	xmrig
behavioral2/memory/1968-1033-0x00007FF664300000-0x00007FF6646F2000-memory.dmp	xmrig
behavioral2/memory/1164-1423-0x00007FF74E4F0000-0x00007FF74E8E2000-memory.dmp	xmrig
behavioral2/memory/3852-1493-0x00007FF675C60000-0x00007FF676052000-memory.dmp	xmrig
behavioral2/memory/3568-1491-0x00007FF6D6C40000-0x00007FF6D7032000-memory.dmp	xmrig
behavioral2/memory/1688-1422-0x00007FF7734C0000-0x00007FF7738B2000-memory.dmp	xmrig
behavioral2/memory/4452-1420-0x00007FF65FFE0000-0x00007FF6603D2000-memory.dmp	xmrig
behavioral2/memory/4092-1218-0x00007FF6192D0000-0x00007FF6196C2000-memory.dmp	xmrig
behavioral2/memory/3236-1215-0x00007FF69F700000-0x00007FF69FAF2000-memory.dmp	xmrig
behavioral2/memory/2636-1212-0x00007FF61C010000-0x00007FF61C402000-memory.dmp	xmrig
behavioral2/memory/4168-1030-0x00007FF6419A0000-0x00007FF641D92000-memory.dmp	xmrig
behavioral2/memory/4540-912-0x00007FF7798B0000-0x00007FF779CA2000-memory.dmp	xmrig
behavioral2/memory/4672-445-0x00007FF6FD100000-0x00007FF6FD4F2000-memory.dmp	xmrig
behavioral2/memory/5036-335-0x00007FF6EF4F0000-0x00007FF6EF8E2000-memory.dmp	xmrig
behavioral2/memory/2852-3007-0x00007FF7D2660000-0x00007FF7D2A52000-memory.dmp	xmrig
behavioral2/memory/1488-3011-0x00007FF62C9F0000-0x00007FF62CDE2000-memory.dmp	xmrig
behavioral2/memory/3568-3010-0x00007FF6D6C40000-0x00007FF6D7032000-memory.dmp	xmrig
behavioral2/memory/2692-3016-0x00007FF7CC280000-0x00007FF7CC672000-memory.dmp	xmrig
behavioral2/memory/2268-3017-0x00007FF6FDEC0000-0x00007FF6FE2B2000-memory.dmp	xmrig
behavioral2/memory/3852-3025-0x00007FF675C60000-0x00007FF676052000-memory.dmp	xmrig
behavioral2/memory/4168-3031-0x00007FF6419A0000-0x00007FF641D92000-memory.dmp	xmrig
behavioral2/memory/396-3030-0x00007FF729D00000-0x00007FF72A0F2000-memory.dmp	xmrig
behavioral2/memory/5036-3028-0x00007FF6EF4F0000-0x00007FF6EF8E2000-memory.dmp	xmrig
behavioral2/memory/860-3022-0x00007FF747680000-0x00007FF747A72000-memory.dmp	xmrig
behavioral2/memory/4400-3024-0x00007FF7036A0000-0x00007FF703A92000-memory.dmp	xmrig
behavioral2/memory/5060-3020-0x00007FF79A9E0000-0x00007FF79ADD2000-memory.dmp	xmrig
behavioral2/memory/4960-3015-0x00007FF775310000-0x00007FF775702000-memory.dmp	xmrig
behavioral2/memory/4452-3054-0x00007FF65FFE0000-0x00007FF6603D2000-memory.dmp	xmrig
behavioral2/memory/2636-3061-0x00007FF61C010000-0x00007FF61C402000-memory.dmp	xmrig
behavioral2/memory/4540-3073-0x00007FF7798B0000-0x00007FF779CA2000-memory.dmp	xmrig
behavioral2/memory/4672-3072-0x00007FF6FD100000-0x00007FF6FD4F2000-memory.dmp	xmrig
behavioral2/memory/3236-3056-0x00007FF69F700000-0x00007FF69FAF2000-memory.dmp	xmrig
behavioral2/memory/1968-3052-0x00007FF664300000-0x00007FF6646F2000-memory.dmp	xmrig
behavioral2/memory/4092-3075-0x00007FF6192D0000-0x00007FF6196C2000-memory.dmp	xmrig
behavioral2/memory/1164-3064-0x00007FF74E4F0000-0x00007FF74E8E2000-memory.dmp	xmrig
behavioral2/memory/1688-3042-0x00007FF7734C0000-0x00007FF7738B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2852	cZHMNOp.exe
3568	ksRACku.exe
1488	BKMBebB.exe
4400	kcfyrBx.exe
860	WkKSjZi.exe
2692	sfrZdNz.exe
4960	rThiJWv.exe
2268	umtnQeb.exe
5036	kDZZnwH.exe
396	hbSxGWI.exe
3852	SkCWyvD.exe
5060	jvyyyyE.exe
4672	gUJPxsS.exe
4540	AXItPKw.exe
4168	wYyDDuh.exe
1968	CJzMnVI.exe
2252	MgQyTAh.exe
2636	nqRXkal.exe
3236	CnHdGjQ.exe
4092	NnwFduL.exe
4452	OoItIfB.exe
3684	RejUFby.exe
1688	TAEIemL.exe
1164	mFKfaJh.exe
3848	ATPklfW.exe
1528	ivGTmEH.exe
2532	uGtvzxA.exe
552	EqROUef.exe
1908	CsQHRLn.exe
1920	ZboJCXZ.exe
936	xszVUbQ.exe
1448	zuuGByh.exe
2192	HThEAIP.exe
1592	pdCsLMS.exe
1612	hoCBcXC.exe
2372	DhBuMXh.exe
2016	uvyCLbx.exe
1912	VQgkrlr.exe
208	CCzknye.exe
1132	oSBppdI.exe
2932	ysstXAt.exe
3560	azOdveB.exe
2976	vubCAkT.exe
3844	dBMdokU.exe
1536	UVSTIkn.exe
968	vpylKmB.exe
4684	wFgTbTC.exe
452	XvuzRHF.exe
4516	dgLQMrB.exe
3104	xILQuks.exe
4564	cmAnRbF.exe
2032	GIVaEJH.exe
1680	fmGstKP.exe
3192	ArWbVfe.exe
4228	DnqFADL.exe
2068	rBGbPgT.exe
632	FVoVBuD.exe
2696	rTAJAZB.exe
4848	BMjclMU.exe
996	Jmlnstj.exe
4640	GCvYiBE.exe
3548	rjdJGtn.exe
2480	IaUwIUd.exe
5004	IUOoUZu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4344-0-0x00007FF7CD470000-0x00007FF7CD862000-memory.dmp	upx
behavioral2/files/0x000b000000023b99-5.dat	upx
behavioral2/files/0x000a000000023b9e-7.dat	upx
behavioral2/files/0x000a000000023b9d-12.dat	upx
behavioral2/files/0x000a000000023ba0-27.dat	upx
behavioral2/files/0x000a000000023b9f-26.dat	upx
behavioral2/memory/2852-8-0x00007FF7D2660000-0x00007FF7D2A52000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-30.dat	upx
behavioral2/files/0x000a000000023ba5-107.dat	upx
behavioral2/files/0x000a000000023baf-134.dat	upx
behavioral2/files/0x000a000000023bbe-179.dat	upx
behavioral2/memory/2692-239-0x00007FF7CC280000-0x00007FF7CC672000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-189.dat	upx
behavioral2/files/0x000a000000023bc2-188.dat	upx
behavioral2/files/0x000a000000023bc1-187.dat	upx
behavioral2/files/0x000b000000023b9a-185.dat	upx
behavioral2/files/0x000a000000023bc0-184.dat	upx
behavioral2/files/0x000a000000023bbf-182.dat	upx
behavioral2/files/0x000a000000023bbd-178.dat	upx
behavioral2/files/0x000a000000023bad-172.dat	upx
behavioral2/memory/860-203-0x00007FF747680000-0x00007FF747A72000-memory.dmp	upx
behavioral2/files/0x0032000000023bb4-169.dat	upx
behavioral2/files/0x000a000000023bac-167.dat	upx
behavioral2/files/0x000a000000023bc3-195.dat	upx
behavioral2/files/0x000a000000023bb1-164.dat	upx
behavioral2/memory/4400-162-0x00007FF7036A0000-0x00007FF703A92000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-155.dat	upx
behavioral2/files/0x000a000000023bb9-152.dat	upx
behavioral2/files/0x000a000000023bb0-148.dat	upx
behavioral2/files/0x000a000000023bab-144.dat	upx
behavioral2/files/0x000a000000023bb8-137.dat	upx
behavioral2/files/0x000a000000023ba9-136.dat	upx
behavioral2/files/0x000a000000023bb7-133.dat	upx
behavioral2/files/0x000a000000023bbc-176.dat	upx
behavioral2/files/0x000a000000023bae-129.dat	upx
behavioral2/files/0x0031000000023bb5-127.dat	upx
behavioral2/files/0x000a000000023bbb-165.dat	upx
behavioral2/files/0x000a000000023baa-113.dat	upx
behavioral2/files/0x0031000000023bb6-130.dat	upx
behavioral2/files/0x000a000000023ba4-100.dat	upx
behavioral2/files/0x000a000000023ba8-98.dat	upx
behavioral2/memory/4960-283-0x00007FF775310000-0x00007FF775702000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-83.dat	upx
behavioral2/memory/1488-80-0x00007FF62C9F0000-0x00007FF62CDE2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-69.dat	upx
behavioral2/files/0x000a000000023ba7-64.dat	upx
behavioral2/files/0x000a000000023ba2-63.dat	upx
behavioral2/memory/2268-292-0x00007FF6FDEC0000-0x00007FF6FE2B2000-memory.dmp	upx
behavioral2/memory/396-402-0x00007FF729D00000-0x00007FF72A0F2000-memory.dmp	upx
behavioral2/memory/5060-406-0x00007FF79A9E0000-0x00007FF79ADD2000-memory.dmp	upx
behavioral2/memory/1968-1033-0x00007FF664300000-0x00007FF6646F2000-memory.dmp	upx
behavioral2/memory/1164-1423-0x00007FF74E4F0000-0x00007FF74E8E2000-memory.dmp	upx
behavioral2/memory/3852-1493-0x00007FF675C60000-0x00007FF676052000-memory.dmp	upx
behavioral2/memory/3568-1491-0x00007FF6D6C40000-0x00007FF6D7032000-memory.dmp	upx
behavioral2/memory/1688-1422-0x00007FF7734C0000-0x00007FF7738B2000-memory.dmp	upx
behavioral2/memory/4452-1420-0x00007FF65FFE0000-0x00007FF6603D2000-memory.dmp	upx
behavioral2/memory/4092-1218-0x00007FF6192D0000-0x00007FF6196C2000-memory.dmp	upx
behavioral2/memory/3236-1215-0x00007FF69F700000-0x00007FF69FAF2000-memory.dmp	upx
behavioral2/memory/2636-1212-0x00007FF61C010000-0x00007FF61C402000-memory.dmp	upx
behavioral2/memory/4168-1030-0x00007FF6419A0000-0x00007FF641D92000-memory.dmp	upx
behavioral2/memory/4540-912-0x00007FF7798B0000-0x00007FF779CA2000-memory.dmp	upx
behavioral2/memory/4672-445-0x00007FF6FD100000-0x00007FF6FD4F2000-memory.dmp	upx
behavioral2/memory/5036-335-0x00007FF6EF4F0000-0x00007FF6EF8E2000-memory.dmp	upx
behavioral2/memory/2852-3007-0x00007FF7D2660000-0x00007FF7D2A52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TyazdIn.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\gQZLREH.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\qzSIRXS.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\TQgXvJJ.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\Gpjedgh.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\YfbxCos.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\YOafIDb.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\umwQsUd.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\arJUqCo.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\OhANrIn.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\WBIGCUP.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\aFxvOcb.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\DVPSkLr.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\yArWJmM.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\OGEozcL.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\gzgBzwc.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\dUsRWmE.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\sUagemh.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\ETTMSlC.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\axfiSWu.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\gPDyVXk.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\sHbmAXu.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\HRuTCdf.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\Vqddlrn.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\xGnCKIr.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\ZfnsQST.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\BcZQiIQ.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\gyztuhh.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\YzobYxM.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\XIXqnGC.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\YWtxFEC.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\VCKDvGL.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\OoItIfB.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\GSdpbXa.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\JDMUBUV.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\YfPFMwM.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\sdABHCl.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\xQxeweh.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\utFSrBz.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\McjvqpR.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\GQifTRt.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\cUTvCIb.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\opLGIgp.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\lmGidDt.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\TmVNdHr.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\XmXvMey.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\lhViImk.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\dnQnyGY.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\PtgYgiT.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\NxukZxL.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\jvKAQkh.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\MKpuKGs.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\FUfHKNZ.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\QTFVGbu.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\slQjawU.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\MRjqKck.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\zZfCfzQ.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\ivGTmEH.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\SQjZYAo.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\KpbTKGn.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\GDZUKDn.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\GZYPAdf.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\QzctRAx.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\YcXFyln.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
Token: SeDebugPrivilege	4808	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4808	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	85
PID 4344 wrote to memory of 4808	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	85
PID 4344 wrote to memory of 2852	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	86
PID 4344 wrote to memory of 2852	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	86
PID 4344 wrote to memory of 3568	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	87
PID 4344 wrote to memory of 3568	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	87
PID 4344 wrote to memory of 1488	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	88
PID 4344 wrote to memory of 1488	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	88
PID 4344 wrote to memory of 4400	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	89
PID 4344 wrote to memory of 4400	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	89
PID 4344 wrote to memory of 860	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	90
PID 4344 wrote to memory of 860	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	90
PID 4344 wrote to memory of 2692	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	91
PID 4344 wrote to memory of 2692	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	91
PID 4344 wrote to memory of 4960	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	92
PID 4344 wrote to memory of 4960	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	92
PID 4344 wrote to memory of 2268	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	93
PID 4344 wrote to memory of 2268	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	93
PID 4344 wrote to memory of 5036	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	94
PID 4344 wrote to memory of 5036	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	94
PID 4344 wrote to memory of 396	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	95
PID 4344 wrote to memory of 396	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	95
PID 4344 wrote to memory of 3852	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	96
PID 4344 wrote to memory of 3852	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	96
PID 4344 wrote to memory of 5060	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	97
PID 4344 wrote to memory of 5060	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	97
PID 4344 wrote to memory of 4672	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	98
PID 4344 wrote to memory of 4672	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	98
PID 4344 wrote to memory of 4540	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	99
PID 4344 wrote to memory of 4540	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	99
PID 4344 wrote to memory of 4168	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	100
PID 4344 wrote to memory of 4168	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	100
PID 4344 wrote to memory of 1968	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	101
PID 4344 wrote to memory of 1968	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	101
PID 4344 wrote to memory of 2252	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	102
PID 4344 wrote to memory of 2252	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	102
PID 4344 wrote to memory of 2636	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	103
PID 4344 wrote to memory of 2636	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	103
PID 4344 wrote to memory of 3236	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	104
PID 4344 wrote to memory of 3236	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	104
PID 4344 wrote to memory of 4092	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	105
PID 4344 wrote to memory of 4092	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	105
PID 4344 wrote to memory of 4452	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	106
PID 4344 wrote to memory of 4452	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	106
PID 4344 wrote to memory of 1908	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	107
PID 4344 wrote to memory of 1908	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	107
PID 4344 wrote to memory of 3684	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	108
PID 4344 wrote to memory of 3684	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	108
PID 4344 wrote to memory of 1688	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	109
PID 4344 wrote to memory of 1688	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	109
PID 4344 wrote to memory of 1164	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	110
PID 4344 wrote to memory of 1164	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	110
PID 4344 wrote to memory of 3848	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	111
PID 4344 wrote to memory of 3848	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	111
PID 4344 wrote to memory of 1528	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	112
PID 4344 wrote to memory of 1528	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	112
PID 4344 wrote to memory of 2532	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	113
PID 4344 wrote to memory of 2532	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	113
PID 4344 wrote to memory of 552	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	114
PID 4344 wrote to memory of 552	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	114
PID 4344 wrote to memory of 1920	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	115
PID 4344 wrote to memory of 1920	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	115
PID 4344 wrote to memory of 936	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	116
PID 4344 wrote to memory of 936	4344	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\System\cZHMNOp.exe
  C:\Windows\System\cZHMNOp.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\ksRACku.exe
  C:\Windows\System\ksRACku.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\BKMBebB.exe
  C:\Windows\System\BKMBebB.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\kcfyrBx.exe
  C:\Windows\System\kcfyrBx.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\WkKSjZi.exe
  C:\Windows\System\WkKSjZi.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\sfrZdNz.exe
  C:\Windows\System\sfrZdNz.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\rThiJWv.exe
  C:\Windows\System\rThiJWv.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\umtnQeb.exe
  C:\Windows\System\umtnQeb.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\kDZZnwH.exe
  C:\Windows\System\kDZZnwH.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\hbSxGWI.exe
  C:\Windows\System\hbSxGWI.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\SkCWyvD.exe
  C:\Windows\System\SkCWyvD.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\jvyyyyE.exe
  C:\Windows\System\jvyyyyE.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\gUJPxsS.exe
  C:\Windows\System\gUJPxsS.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\AXItPKw.exe
  C:\Windows\System\AXItPKw.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\wYyDDuh.exe
  C:\Windows\System\wYyDDuh.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\CJzMnVI.exe
  C:\Windows\System\CJzMnVI.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\MgQyTAh.exe
  C:\Windows\System\MgQyTAh.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\nqRXkal.exe
  C:\Windows\System\nqRXkal.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\CnHdGjQ.exe
  C:\Windows\System\CnHdGjQ.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\NnwFduL.exe
  C:\Windows\System\NnwFduL.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\OoItIfB.exe
  C:\Windows\System\OoItIfB.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\CsQHRLn.exe
  C:\Windows\System\CsQHRLn.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\RejUFby.exe
  C:\Windows\System\RejUFby.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\TAEIemL.exe
  C:\Windows\System\TAEIemL.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\mFKfaJh.exe
  C:\Windows\System\mFKfaJh.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\ATPklfW.exe
  C:\Windows\System\ATPklfW.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\ivGTmEH.exe
  C:\Windows\System\ivGTmEH.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\uGtvzxA.exe
  C:\Windows\System\uGtvzxA.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\EqROUef.exe
  C:\Windows\System\EqROUef.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\ZboJCXZ.exe
  C:\Windows\System\ZboJCXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\xszVUbQ.exe
  C:\Windows\System\xszVUbQ.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\zuuGByh.exe
  C:\Windows\System\zuuGByh.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\HThEAIP.exe
  C:\Windows\System\HThEAIP.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\pdCsLMS.exe
  C:\Windows\System\pdCsLMS.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\hoCBcXC.exe
  C:\Windows\System\hoCBcXC.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\DhBuMXh.exe
  C:\Windows\System\DhBuMXh.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\uvyCLbx.exe
  C:\Windows\System\uvyCLbx.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\VQgkrlr.exe
  C:\Windows\System\VQgkrlr.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\CCzknye.exe
  C:\Windows\System\CCzknye.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\oSBppdI.exe
  C:\Windows\System\oSBppdI.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\ysstXAt.exe
  C:\Windows\System\ysstXAt.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\azOdveB.exe
  C:\Windows\System\azOdveB.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\vubCAkT.exe
  C:\Windows\System\vubCAkT.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\dBMdokU.exe
  C:\Windows\System\dBMdokU.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\UVSTIkn.exe
  C:\Windows\System\UVSTIkn.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\vpylKmB.exe
  C:\Windows\System\vpylKmB.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\wFgTbTC.exe
  C:\Windows\System\wFgTbTC.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\XvuzRHF.exe
  C:\Windows\System\XvuzRHF.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\dgLQMrB.exe
  C:\Windows\System\dgLQMrB.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\xILQuks.exe
  C:\Windows\System\xILQuks.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\cmAnRbF.exe
  C:\Windows\System\cmAnRbF.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\GIVaEJH.exe
  C:\Windows\System\GIVaEJH.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\fmGstKP.exe
  C:\Windows\System\fmGstKP.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\ArWbVfe.exe
  C:\Windows\System\ArWbVfe.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\DnqFADL.exe
  C:\Windows\System\DnqFADL.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\rBGbPgT.exe
  C:\Windows\System\rBGbPgT.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\FVoVBuD.exe
  C:\Windows\System\FVoVBuD.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\xwnypqZ.exe
  C:\Windows\System\xwnypqZ.exe
  2⤵
  PID:4872
- C:\Windows\System\rTAJAZB.exe
  C:\Windows\System\rTAJAZB.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\BMjclMU.exe
  C:\Windows\System\BMjclMU.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\Jmlnstj.exe
  C:\Windows\System\Jmlnstj.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\GCvYiBE.exe
  C:\Windows\System\GCvYiBE.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\rjdJGtn.exe
  C:\Windows\System\rjdJGtn.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\IaUwIUd.exe
  C:\Windows\System\IaUwIUd.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\HqqvLvy.exe
  C:\Windows\System\HqqvLvy.exe
  2⤵
  PID:408
- C:\Windows\System\hpfjKmj.exe
  C:\Windows\System\hpfjKmj.exe
  2⤵
  PID:1008
- C:\Windows\System\IUOoUZu.exe
  C:\Windows\System\IUOoUZu.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\uYXwUqI.exe
  C:\Windows\System\uYXwUqI.exe
  2⤵
  PID:3220
- C:\Windows\System\okjkgrU.exe
  C:\Windows\System\okjkgrU.exe
  2⤵
  PID:2432
- C:\Windows\System\yGMJZCC.exe
  C:\Windows\System\yGMJZCC.exe
  2⤵
  PID:2460
- C:\Windows\System\RbPTWkC.exe
  C:\Windows\System\RbPTWkC.exe
  2⤵
  PID:1924
- C:\Windows\System\gbJxRNS.exe
  C:\Windows\System\gbJxRNS.exe
  2⤵
  PID:3628
- C:\Windows\System\GMvdHwZ.exe
  C:\Windows\System\GMvdHwZ.exe
  2⤵
  PID:1812
- C:\Windows\System\DysaHRL.exe
  C:\Windows\System\DysaHRL.exe
  2⤵
  PID:4152
- C:\Windows\System\uGkFQLe.exe
  C:\Windows\System\uGkFQLe.exe
  2⤵
  PID:5124
- C:\Windows\System\fYhOVXk.exe
  C:\Windows\System\fYhOVXk.exe
  2⤵
  PID:5140
- C:\Windows\System\HDCqaTl.exe
  C:\Windows\System\HDCqaTl.exe
  2⤵
  PID:5160
- C:\Windows\System\wisRIJf.exe
  C:\Windows\System\wisRIJf.exe
  2⤵
  PID:5176
- C:\Windows\System\TyazdIn.exe
  C:\Windows\System\TyazdIn.exe
  2⤵
  PID:5212
- C:\Windows\System\AkhjawS.exe
  C:\Windows\System\AkhjawS.exe
  2⤵
  PID:5236
- C:\Windows\System\xnaGqFB.exe
  C:\Windows\System\xnaGqFB.exe
  2⤵
  PID:5348
- C:\Windows\System\AGpzPYy.exe
  C:\Windows\System\AGpzPYy.exe
  2⤵
  PID:5400
- C:\Windows\System\zOKzAng.exe
  C:\Windows\System\zOKzAng.exe
  2⤵
  PID:5468
- C:\Windows\System\DQCFIMj.exe
  C:\Windows\System\DQCFIMj.exe
  2⤵
  PID:5484
- C:\Windows\System\MizLwwG.exe
  C:\Windows\System\MizLwwG.exe
  2⤵
  PID:5500
- C:\Windows\System\pGATCvB.exe
  C:\Windows\System\pGATCvB.exe
  2⤵
  PID:5520
- C:\Windows\System\OKOyrZI.exe
  C:\Windows\System\OKOyrZI.exe
  2⤵
  PID:5536
- C:\Windows\System\eIyahob.exe
  C:\Windows\System\eIyahob.exe
  2⤵
  PID:5560
- C:\Windows\System\PtZwHES.exe
  C:\Windows\System\PtZwHES.exe
  2⤵
  PID:5580
- C:\Windows\System\sfxjSar.exe
  C:\Windows\System\sfxjSar.exe
  2⤵
  PID:5604
- C:\Windows\System\ApgnEZk.exe
  C:\Windows\System\ApgnEZk.exe
  2⤵
  PID:5620
- C:\Windows\System\dAtMDar.exe
  C:\Windows\System\dAtMDar.exe
  2⤵
  PID:5644
- C:\Windows\System\HbIucZy.exe
  C:\Windows\System\HbIucZy.exe
  2⤵
  PID:5668
- C:\Windows\System\fClScuM.exe
  C:\Windows\System\fClScuM.exe
  2⤵
  PID:5692
- C:\Windows\System\KsHkqBc.exe
  C:\Windows\System\KsHkqBc.exe
  2⤵
  PID:5712
- C:\Windows\System\MvaMjzz.exe
  C:\Windows\System\MvaMjzz.exe
  2⤵
  PID:5732
- C:\Windows\System\UjlmJlj.exe
  C:\Windows\System\UjlmJlj.exe
  2⤵
  PID:5768
- C:\Windows\System\ceKPGPP.exe
  C:\Windows\System\ceKPGPP.exe
  2⤵
  PID:5788
- C:\Windows\System\WCnftzr.exe
  C:\Windows\System\WCnftzr.exe
  2⤵
  PID:5844
- C:\Windows\System\SQjZYAo.exe
  C:\Windows\System\SQjZYAo.exe
  2⤵
  PID:5868
- C:\Windows\System\MNhNShZ.exe
  C:\Windows\System\MNhNShZ.exe
  2⤵
  PID:5896
- C:\Windows\System\YzvVSCB.exe
  C:\Windows\System\YzvVSCB.exe
  2⤵
  PID:5928
- C:\Windows\System\wPNdpze.exe
  C:\Windows\System\wPNdpze.exe
  2⤵
  PID:5948
- C:\Windows\System\yYcKpFn.exe
  C:\Windows\System\yYcKpFn.exe
  2⤵
  PID:5988
- C:\Windows\System\wqmVPaA.exe
  C:\Windows\System\wqmVPaA.exe
  2⤵
  PID:6016
- C:\Windows\System\AMaTKQq.exe
  C:\Windows\System\AMaTKQq.exe
  2⤵
  PID:6040
- C:\Windows\System\EeLZUcU.exe
  C:\Windows\System\EeLZUcU.exe
  2⤵
  PID:6060
- C:\Windows\System\FoTNDnE.exe
  C:\Windows\System\FoTNDnE.exe
  2⤵
  PID:6080
- C:\Windows\System\FvutNRG.exe
  C:\Windows\System\FvutNRG.exe
  2⤵
  PID:6112
- C:\Windows\System\ClZQXXZ.exe
  C:\Windows\System\ClZQXXZ.exe
  2⤵
  PID:6128
- C:\Windows\System\ROJEvGz.exe
  C:\Windows\System\ROJEvGz.exe
  2⤵
  PID:2524
- C:\Windows\System\eZuHGlB.exe
  C:\Windows\System\eZuHGlB.exe
  2⤵
  PID:5052
- C:\Windows\System\QzXtsHU.exe
  C:\Windows\System\QzXtsHU.exe
  2⤵
  PID:4312
- C:\Windows\System\YwPgkom.exe
  C:\Windows\System\YwPgkom.exe
  2⤵
  PID:848
- C:\Windows\System\MCGErkW.exe
  C:\Windows\System\MCGErkW.exe
  2⤵
  PID:3856
- C:\Windows\System\aYRgigC.exe
  C:\Windows\System\aYRgigC.exe
  2⤵
  PID:3396
- C:\Windows\System\RauCBmO.exe
  C:\Windows\System\RauCBmO.exe
  2⤵
  PID:4292
- C:\Windows\System\xVoAggX.exe
  C:\Windows\System\xVoAggX.exe
  2⤵
  PID:1152
- C:\Windows\System\brpjnLH.exe
  C:\Windows\System\brpjnLH.exe
  2⤵
  PID:4944
- C:\Windows\System\NagxufH.exe
  C:\Windows\System\NagxufH.exe
  2⤵
  PID:5276
- C:\Windows\System\xebqfQO.exe
  C:\Windows\System\xebqfQO.exe
  2⤵
  PID:4904
- C:\Windows\System\xSTyEVF.exe
  C:\Windows\System\xSTyEVF.exe
  2⤵
  PID:4048
- C:\Windows\System\pnzJXBA.exe
  C:\Windows\System\pnzJXBA.exe
  2⤵
  PID:5076
- C:\Windows\System\vGvtxMU.exe
  C:\Windows\System\vGvtxMU.exe
  2⤵
  PID:4556
- C:\Windows\System\qYTObJv.exe
  C:\Windows\System\qYTObJv.exe
  2⤵
  PID:5184
- C:\Windows\System\giIlITU.exe
  C:\Windows\System\giIlITU.exe
  2⤵
  PID:1784
- C:\Windows\System\ijfKevK.exe
  C:\Windows\System\ijfKevK.exe
  2⤵
  PID:748
- C:\Windows\System\yhtzeJV.exe
  C:\Windows\System\yhtzeJV.exe
  2⤵
  PID:4508
- C:\Windows\System\mBMzepp.exe
  C:\Windows\System\mBMzepp.exe
  2⤵
  PID:4992
- C:\Windows\System\yiHtRzk.exe
  C:\Windows\System\yiHtRzk.exe
  2⤵
  PID:3752
- C:\Windows\System\sTmesuI.exe
  C:\Windows\System\sTmesuI.exe
  2⤵
  PID:3456
- C:\Windows\System\vvjmrgl.exe
  C:\Windows\System\vvjmrgl.exe
  2⤵
  PID:2044
- C:\Windows\System\LATwxAt.exe
  C:\Windows\System\LATwxAt.exe
  2⤵
  PID:2084
- C:\Windows\System\TJYMSsj.exe
  C:\Windows\System\TJYMSsj.exe
  2⤵
  PID:4460
- C:\Windows\System\iVJcNvr.exe
  C:\Windows\System\iVJcNvr.exe
  2⤵
  PID:1000
- C:\Windows\System\wJbdxyd.exe
  C:\Windows\System\wJbdxyd.exe
  2⤵
  PID:1932
- C:\Windows\System\XPlBDEB.exe
  C:\Windows\System\XPlBDEB.exe
  2⤵
  PID:3268
- C:\Windows\System\GSdpbXa.exe
  C:\Windows\System\GSdpbXa.exe
  2⤵
  PID:4624
- C:\Windows\System\QstcpWZ.exe
  C:\Windows\System\QstcpWZ.exe
  2⤵
  PID:2464
- C:\Windows\System\mYwCFxO.exe
  C:\Windows\System\mYwCFxO.exe
  2⤵
  PID:5044
- C:\Windows\System\CGBEeVb.exe
  C:\Windows\System\CGBEeVb.exe
  2⤵
  PID:2472
- C:\Windows\System\XvDwGdF.exe
  C:\Windows\System\XvDwGdF.exe
  2⤵
  PID:5136
- C:\Windows\System\RKmCTPn.exe
  C:\Windows\System\RKmCTPn.exe
  2⤵
  PID:5168
- C:\Windows\System\jYRjRKd.exe
  C:\Windows\System\jYRjRKd.exe
  2⤵
  PID:5556
- C:\Windows\System\udZRhSa.exe
  C:\Windows\System\udZRhSa.exe
  2⤵
  PID:5628
- C:\Windows\System\KuEFJgc.exe
  C:\Windows\System\KuEFJgc.exe
  2⤵
  PID:5708
- C:\Windows\System\tObjtSV.exe
  C:\Windows\System\tObjtSV.exe
  2⤵
  PID:5780
- C:\Windows\System\XHkERsN.exe
  C:\Windows\System\XHkERsN.exe
  2⤵
  PID:5852
- C:\Windows\System\uNAWeUI.exe
  C:\Windows\System\uNAWeUI.exe
  2⤵
  PID:5416
- C:\Windows\System\oPlujlQ.exe
  C:\Windows\System\oPlujlQ.exe
  2⤵
  PID:5956
- C:\Windows\System\iDJDvcQ.exe
  C:\Windows\System\iDJDvcQ.exe
  2⤵
  PID:5460
- C:\Windows\System\utPeApP.exe
  C:\Windows\System\utPeApP.exe
  2⤵
  PID:6072
- C:\Windows\System\vYAZFdi.exe
  C:\Windows\System\vYAZFdi.exe
  2⤵
  PID:5544
- C:\Windows\System\lONTOYF.exe
  C:\Windows\System\lONTOYF.exe
  2⤵
  PID:3204
- C:\Windows\System\joxopVm.exe
  C:\Windows\System\joxopVm.exe
  2⤵
  PID:4432
- C:\Windows\System\vbRJwgU.exe
  C:\Windows\System\vbRJwgU.exe
  2⤵
  PID:5704
- C:\Windows\System\nKeMvym.exe
  C:\Windows\System\nKeMvym.exe
  2⤵
  PID:5728
- C:\Windows\System\dnFuzdF.exe
  C:\Windows\System\dnFuzdF.exe
  2⤵
  PID:4636
- C:\Windows\System\uzSHlDK.exe
  C:\Windows\System\uzSHlDK.exe
  2⤵
  PID:6088
- C:\Windows\System\zdYQLcS.exe
  C:\Windows\System\zdYQLcS.exe
  2⤵
  PID:1120
- C:\Windows\System\kRGnKfp.exe
  C:\Windows\System\kRGnKfp.exe
  2⤵
  PID:3208
- C:\Windows\System\cvVHpCs.exe
  C:\Windows\System\cvVHpCs.exe
  2⤵
  PID:220
- C:\Windows\System\RhjIJhd.exe
  C:\Windows\System\RhjIJhd.exe
  2⤵
  PID:5748
- C:\Windows\System\xKtRtnc.exe
  C:\Windows\System\xKtRtnc.exe
  2⤵
  PID:2304
- C:\Windows\System\ooRSMZB.exe
  C:\Windows\System\ooRSMZB.exe
  2⤵
  PID:3348
- C:\Windows\System\PkRSlpG.exe
  C:\Windows\System\PkRSlpG.exe
  2⤵
  PID:4112
- C:\Windows\System\JXnRgIg.exe
  C:\Windows\System\JXnRgIg.exe
  2⤵
  PID:412
- C:\Windows\System\guFNxsK.exe
  C:\Windows\System\guFNxsK.exe
  2⤵
  PID:6168
- C:\Windows\System\gLEBsFh.exe
  C:\Windows\System\gLEBsFh.exe
  2⤵
  PID:6188
- C:\Windows\System\gmMufxI.exe
  C:\Windows\System\gmMufxI.exe
  2⤵
  PID:6208
- C:\Windows\System\KPlSXmZ.exe
  C:\Windows\System\KPlSXmZ.exe
  2⤵
  PID:6236
- C:\Windows\System\chDMQTL.exe
  C:\Windows\System\chDMQTL.exe
  2⤵
  PID:6256
- C:\Windows\System\TTAyVUc.exe
  C:\Windows\System\TTAyVUc.exe
  2⤵
  PID:6276
- C:\Windows\System\ZcpPKpP.exe
  C:\Windows\System\ZcpPKpP.exe
  2⤵
  PID:6296
- C:\Windows\System\RurJAtW.exe
  C:\Windows\System\RurJAtW.exe
  2⤵
  PID:6316
- C:\Windows\System\pDLcSqC.exe
  C:\Windows\System\pDLcSqC.exe
  2⤵
  PID:6340
- C:\Windows\System\aoYemJQ.exe
  C:\Windows\System\aoYemJQ.exe
  2⤵
  PID:6360
- C:\Windows\System\AEkoFyE.exe
  C:\Windows\System\AEkoFyE.exe
  2⤵
  PID:6388
- C:\Windows\System\kSamPQq.exe
  C:\Windows\System\kSamPQq.exe
  2⤵
  PID:6412
- C:\Windows\System\omFttPr.exe
  C:\Windows\System\omFttPr.exe
  2⤵
  PID:6440
- C:\Windows\System\sHIrppa.exe
  C:\Windows\System\sHIrppa.exe
  2⤵
  PID:6456
- C:\Windows\System\iBrRgZJ.exe
  C:\Windows\System\iBrRgZJ.exe
  2⤵
  PID:6480
- C:\Windows\System\PmsUMUA.exe
  C:\Windows\System\PmsUMUA.exe
  2⤵
  PID:6504
- C:\Windows\System\PzDAsur.exe
  C:\Windows\System\PzDAsur.exe
  2⤵
  PID:6524
- C:\Windows\System\wHrmZTv.exe
  C:\Windows\System\wHrmZTv.exe
  2⤵
  PID:6544
- C:\Windows\System\ukFSRSU.exe
  C:\Windows\System\ukFSRSU.exe
  2⤵
  PID:6568
- C:\Windows\System\ooFHOAA.exe
  C:\Windows\System\ooFHOAA.exe
  2⤵
  PID:6592
- C:\Windows\System\NrwNzQH.exe
  C:\Windows\System\NrwNzQH.exe
  2⤵
  PID:6616
- C:\Windows\System\RzovuAy.exe
  C:\Windows\System\RzovuAy.exe
  2⤵
  PID:6636
- C:\Windows\System\xkkVIti.exe
  C:\Windows\System\xkkVIti.exe
  2⤵
  PID:6660
- C:\Windows\System\DlZPzZv.exe
  C:\Windows\System\DlZPzZv.exe
  2⤵
  PID:6684
- C:\Windows\System\ppgrMMu.exe
  C:\Windows\System\ppgrMMu.exe
  2⤵
  PID:6700
- C:\Windows\System\nrzyWUW.exe
  C:\Windows\System\nrzyWUW.exe
  2⤵
  PID:6728
- C:\Windows\System\pTpgDnt.exe
  C:\Windows\System\pTpgDnt.exe
  2⤵
  PID:6752
- C:\Windows\System\tCJpUqO.exe
  C:\Windows\System\tCJpUqO.exe
  2⤵
  PID:6768
- C:\Windows\System\XcLrenx.exe
  C:\Windows\System\XcLrenx.exe
  2⤵
  PID:6796
- C:\Windows\System\AZkycAD.exe
  C:\Windows\System\AZkycAD.exe
  2⤵
  PID:6820
- C:\Windows\System\XVdDQPO.exe
  C:\Windows\System\XVdDQPO.exe
  2⤵
  PID:6840
- C:\Windows\System\vCTgpma.exe
  C:\Windows\System\vCTgpma.exe
  2⤵
  PID:6864
- C:\Windows\System\ZMfmgSs.exe
  C:\Windows\System\ZMfmgSs.exe
  2⤵
  PID:6884
- C:\Windows\System\DSoAFFP.exe
  C:\Windows\System\DSoAFFP.exe
  2⤵
  PID:6900
- C:\Windows\System\PelxaHa.exe
  C:\Windows\System\PelxaHa.exe
  2⤵
  PID:6932
- C:\Windows\System\ajcGpMM.exe
  C:\Windows\System\ajcGpMM.exe
  2⤵
  PID:6960
- C:\Windows\System\NbXZuPC.exe
  C:\Windows\System\NbXZuPC.exe
  2⤵
  PID:6988
- C:\Windows\System\HSabFKm.exe
  C:\Windows\System\HSabFKm.exe
  2⤵
  PID:7012
- C:\Windows\System\RbXfdFU.exe
  C:\Windows\System\RbXfdFU.exe
  2⤵
  PID:7040
- C:\Windows\System\TxVhrbM.exe
  C:\Windows\System\TxVhrbM.exe
  2⤵
  PID:7060
- C:\Windows\System\AkkprKY.exe
  C:\Windows\System\AkkprKY.exe
  2⤵
  PID:7084
- C:\Windows\System\BWIEhvq.exe
  C:\Windows\System\BWIEhvq.exe
  2⤵
  PID:7104
- C:\Windows\System\xDRJZfS.exe
  C:\Windows\System\xDRJZfS.exe
  2⤵
  PID:7124
- C:\Windows\System\tCCUmXS.exe
  C:\Windows\System\tCCUmXS.exe
  2⤵
  PID:7156
- C:\Windows\System\nBWbznl.exe
  C:\Windows\System\nBWbznl.exe
  2⤵
  PID:5916
- C:\Windows\System\eMzvjqe.exe
  C:\Windows\System\eMzvjqe.exe
  2⤵
  PID:1564
- C:\Windows\System\OSGtSLm.exe
  C:\Windows\System\OSGtSLm.exe
  2⤵
  PID:5172
- C:\Windows\System\WEwNcsa.exe
  C:\Windows\System\WEwNcsa.exe
  2⤵
  PID:6140
- C:\Windows\System\QDlUyhP.exe
  C:\Windows\System\QDlUyhP.exe
  2⤵
  PID:5568
- C:\Windows\System\qmrdsac.exe
  C:\Windows\System\qmrdsac.exe
  2⤵
  PID:5864
- C:\Windows\System\KeUsJJy.exe
  C:\Windows\System\KeUsJJy.exe
  2⤵
  PID:3688
- C:\Windows\System\CLHLVjH.exe
  C:\Windows\System\CLHLVjH.exe
  2⤵
  PID:2612
- C:\Windows\System\YSWeivE.exe
  C:\Windows\System\YSWeivE.exe
  2⤵
  PID:4776
- C:\Windows\System\cEFnpDt.exe
  C:\Windows\System\cEFnpDt.exe
  2⤵
  PID:6176
- C:\Windows\System\ZSmpsdw.exe
  C:\Windows\System\ZSmpsdw.exe
  2⤵
  PID:6204
- C:\Windows\System\hFeeJCe.exe
  C:\Windows\System\hFeeJCe.exe
  2⤵
  PID:6252
- C:\Windows\System\uvkhXPN.exe
  C:\Windows\System\uvkhXPN.exe
  2⤵
  PID:6332
- C:\Windows\System\HXzfRmh.exe
  C:\Windows\System\HXzfRmh.exe
  2⤵
  PID:1432
- C:\Windows\System\ZSbliiZ.exe
  C:\Windows\System\ZSbliiZ.exe
  2⤵
  PID:6428
- C:\Windows\System\YZgVcme.exe
  C:\Windows\System\YZgVcme.exe
  2⤵
  PID:6476
- C:\Windows\System\XvXwnOj.exe
  C:\Windows\System\XvXwnOj.exe
  2⤵
  PID:5600
- C:\Windows\System\JDMUBUV.exe
  C:\Windows\System\JDMUBUV.exe
  2⤵
  PID:5636
- C:\Windows\System\hgcDmEQ.exe
  C:\Windows\System\hgcDmEQ.exe
  2⤵
  PID:6608
- C:\Windows\System\BRNdgRs.exe
  C:\Windows\System\BRNdgRs.exe
  2⤵
  PID:6656
- C:\Windows\System\sdABHCl.exe
  C:\Windows\System\sdABHCl.exe
  2⤵
  PID:5496
- C:\Windows\System\YrPkfkQ.exe
  C:\Windows\System\YrPkfkQ.exe
  2⤵
  PID:7188
- C:\Windows\System\JJwnokR.exe
  C:\Windows\System\JJwnokR.exe
  2⤵
  PID:7208
- C:\Windows\System\tdFMYzH.exe
  C:\Windows\System\tdFMYzH.exe
  2⤵
  PID:7228
- C:\Windows\System\CBmQdgI.exe
  C:\Windows\System\CBmQdgI.exe
  2⤵
  PID:7248
- C:\Windows\System\nLBAbuL.exe
  C:\Windows\System\nLBAbuL.exe
  2⤵
  PID:7280
- C:\Windows\System\GNIqlzf.exe
  C:\Windows\System\GNIqlzf.exe
  2⤵
  PID:7300
- C:\Windows\System\jYFefNj.exe
  C:\Windows\System\jYFefNj.exe
  2⤵
  PID:7316
- C:\Windows\System\KpbTKGn.exe
  C:\Windows\System\KpbTKGn.exe
  2⤵
  PID:7332
- C:\Windows\System\LwgbhKn.exe
  C:\Windows\System\LwgbhKn.exe
  2⤵
  PID:7348
- C:\Windows\System\WCofZqu.exe
  C:\Windows\System\WCofZqu.exe
  2⤵
  PID:7364
- C:\Windows\System\mPUnfXv.exe
  C:\Windows\System\mPUnfXv.exe
  2⤵
  PID:7380
- C:\Windows\System\ZrtKaYq.exe
  C:\Windows\System\ZrtKaYq.exe
  2⤵
  PID:7396
- C:\Windows\System\gotsUuO.exe
  C:\Windows\System\gotsUuO.exe
  2⤵
  PID:7412
- C:\Windows\System\hQSyxsO.exe
  C:\Windows\System\hQSyxsO.exe
  2⤵
  PID:7428
- C:\Windows\System\eUEllSb.exe
  C:\Windows\System\eUEllSb.exe
  2⤵
  PID:7448
- C:\Windows\System\TFpYivL.exe
  C:\Windows\System\TFpYivL.exe
  2⤵
  PID:7496
- C:\Windows\System\PSOKxud.exe
  C:\Windows\System\PSOKxud.exe
  2⤵
  PID:7516
- C:\Windows\System\NeQtlaX.exe
  C:\Windows\System\NeQtlaX.exe
  2⤵
  PID:7548
- C:\Windows\System\JCYXXeD.exe
  C:\Windows\System\JCYXXeD.exe
  2⤵
  PID:7564
- C:\Windows\System\dPMyaRf.exe
  C:\Windows\System\dPMyaRf.exe
  2⤵
  PID:7600
- C:\Windows\System\ByuJzyu.exe
  C:\Windows\System\ByuJzyu.exe
  2⤵
  PID:7620
- C:\Windows\System\NxJotTC.exe
  C:\Windows\System\NxJotTC.exe
  2⤵
  PID:7640
- C:\Windows\System\oynIeEf.exe
  C:\Windows\System\oynIeEf.exe
  2⤵
  PID:7672
- C:\Windows\System\ZiBxxzX.exe
  C:\Windows\System\ZiBxxzX.exe
  2⤵
  PID:7700
- C:\Windows\System\EwJojfF.exe
  C:\Windows\System\EwJojfF.exe
  2⤵
  PID:7720
- C:\Windows\System\cWONMJO.exe
  C:\Windows\System\cWONMJO.exe
  2⤵
  PID:7740
- C:\Windows\System\rKdlLQr.exe
  C:\Windows\System\rKdlLQr.exe
  2⤵
  PID:7760
- C:\Windows\System\nLLErWK.exe
  C:\Windows\System\nLLErWK.exe
  2⤵
  PID:7788
- C:\Windows\System\djABnyt.exe
  C:\Windows\System\djABnyt.exe
  2⤵
  PID:7816
- C:\Windows\System\blmqQLE.exe
  C:\Windows\System\blmqQLE.exe
  2⤵
  PID:7832
- C:\Windows\System\fxJEaSj.exe
  C:\Windows\System\fxJEaSj.exe
  2⤵
  PID:7856
- C:\Windows\System\XfRRedP.exe
  C:\Windows\System\XfRRedP.exe
  2⤵
  PID:7880
- C:\Windows\System\rGqLgqY.exe
  C:\Windows\System\rGqLgqY.exe
  2⤵
  PID:7900
- C:\Windows\System\UWyuRZp.exe
  C:\Windows\System\UWyuRZp.exe
  2⤵
  PID:7920
- C:\Windows\System\yvKtNYY.exe
  C:\Windows\System\yvKtNYY.exe
  2⤵
  PID:7944
- C:\Windows\System\WILUEaU.exe
  C:\Windows\System\WILUEaU.exe
  2⤵
  PID:7972
- C:\Windows\System\ZCdgvZQ.exe
  C:\Windows\System\ZCdgvZQ.exe
  2⤵
  PID:8000
- C:\Windows\System\KKSdmJV.exe
  C:\Windows\System\KKSdmJV.exe
  2⤵
  PID:8020
- C:\Windows\System\XDBccjs.exe
  C:\Windows\System\XDBccjs.exe
  2⤵
  PID:8048
- C:\Windows\System\ZlYZbpX.exe
  C:\Windows\System\ZlYZbpX.exe
  2⤵
  PID:8068
- C:\Windows\System\TZqCGWw.exe
  C:\Windows\System\TZqCGWw.exe
  2⤵
  PID:8088
- C:\Windows\System\sBPaZNg.exe
  C:\Windows\System\sBPaZNg.exe
  2⤵
  PID:8116
- C:\Windows\System\JoPrxbr.exe
  C:\Windows\System\JoPrxbr.exe
  2⤵
  PID:8136
- C:\Windows\System\WBIGCUP.exe
  C:\Windows\System\WBIGCUP.exe
  2⤵
  PID:8160
- C:\Windows\System\LbkqMHg.exe
  C:\Windows\System\LbkqMHg.exe
  2⤵
  PID:8184
- C:\Windows\System\jFfoNVm.exe
  C:\Windows\System\jFfoNVm.exe
  2⤵
  PID:6788
- C:\Windows\System\oLHBXYT.exe
  C:\Windows\System\oLHBXYT.exe
  2⤵
  PID:6008
- C:\Windows\System\GBCUPMX.exe
  C:\Windows\System\GBCUPMX.exe
  2⤵
  PID:2064
- C:\Windows\System\EmPBkbD.exe
  C:\Windows\System\EmPBkbD.exe
  2⤵
  PID:3652
- C:\Windows\System\ZDdbjJj.exe
  C:\Windows\System\ZDdbjJj.exe
  2⤵
  PID:7056
- C:\Windows\System\LzgDUwZ.exe
  C:\Windows\System\LzgDUwZ.exe
  2⤵
  PID:7164
- C:\Windows\System\wbSSSeZ.exe
  C:\Windows\System\wbSSSeZ.exe
  2⤵
  PID:6248
- C:\Windows\System\DwbMCxN.exe
  C:\Windows\System\DwbMCxN.exe
  2⤵
  PID:1324
- C:\Windows\System\lgexliZ.exe
  C:\Windows\System\lgexliZ.exe
  2⤵
  PID:4324
- C:\Windows\System\rpiVWxF.exe
  C:\Windows\System\rpiVWxF.exe
  2⤵
  PID:6576
- C:\Windows\System\nOeQRsM.exe
  C:\Windows\System\nOeQRsM.exe
  2⤵
  PID:6520
- C:\Windows\System\ZfnsQST.exe
  C:\Windows\System\ZfnsQST.exe
  2⤵
  PID:6580
- C:\Windows\System\nYikPOS.exe
  C:\Windows\System\nYikPOS.exe
  2⤵
  PID:716
- C:\Windows\System\htQNDVg.exe
  C:\Windows\System\htQNDVg.exe
  2⤵
  PID:4876
- C:\Windows\System\HatfOxL.exe
  C:\Windows\System\HatfOxL.exe
  2⤵
  PID:5884
- C:\Windows\System\MzZoelZ.exe
  C:\Windows\System\MzZoelZ.exe
  2⤵
  PID:8200
- C:\Windows\System\VvrUIPd.exe
  C:\Windows\System\VvrUIPd.exe
  2⤵
  PID:8224
- C:\Windows\System\QOLhafa.exe
  C:\Windows\System\QOLhafa.exe
  2⤵
  PID:8244
- C:\Windows\System\IUdDFuk.exe
  C:\Windows\System\IUdDFuk.exe
  2⤵
  PID:8264
- C:\Windows\System\PBZbaMx.exe
  C:\Windows\System\PBZbaMx.exe
  2⤵
  PID:8284
- C:\Windows\System\MMaKEiG.exe
  C:\Windows\System\MMaKEiG.exe
  2⤵
  PID:8304
- C:\Windows\System\Nnncdrc.exe
  C:\Windows\System\Nnncdrc.exe
  2⤵
  PID:8324
- C:\Windows\System\mQanomE.exe
  C:\Windows\System\mQanomE.exe
  2⤵
  PID:8340
- C:\Windows\System\HgfPVvm.exe
  C:\Windows\System\HgfPVvm.exe
  2⤵
  PID:8356
- C:\Windows\System\vhAciCO.exe
  C:\Windows\System\vhAciCO.exe
  2⤵
  PID:8372
- C:\Windows\System\ZRnaWhe.exe
  C:\Windows\System\ZRnaWhe.exe
  2⤵
  PID:8388
- C:\Windows\System\UZVfcsg.exe
  C:\Windows\System\UZVfcsg.exe
  2⤵
  PID:8404
- C:\Windows\System\TilPtBE.exe
  C:\Windows\System\TilPtBE.exe
  2⤵
  PID:8420
- C:\Windows\System\YcWnpNg.exe
  C:\Windows\System\YcWnpNg.exe
  2⤵
  PID:8440
- C:\Windows\System\BcZQiIQ.exe
  C:\Windows\System\BcZQiIQ.exe
  2⤵
  PID:8456
- C:\Windows\System\mvlLPwD.exe
  C:\Windows\System\mvlLPwD.exe
  2⤵
  PID:8480
- C:\Windows\System\KeXQKrq.exe
  C:\Windows\System\KeXQKrq.exe
  2⤵
  PID:8516
- C:\Windows\System\UhtvrDl.exe
  C:\Windows\System\UhtvrDl.exe
  2⤵
  PID:8536
- C:\Windows\System\opLGIgp.exe
  C:\Windows\System\opLGIgp.exe
  2⤵
  PID:8560
- C:\Windows\System\QsxLqDD.exe
  C:\Windows\System\QsxLqDD.exe
  2⤵
  PID:8584
- C:\Windows\System\xzGuSKi.exe
  C:\Windows\System\xzGuSKi.exe
  2⤵
  PID:8604
- C:\Windows\System\cqKRpxb.exe
  C:\Windows\System\cqKRpxb.exe
  2⤵
  PID:8628
- C:\Windows\System\OAmMUKv.exe
  C:\Windows\System\OAmMUKv.exe
  2⤵
  PID:8656
- C:\Windows\System\llRBinC.exe
  C:\Windows\System\llRBinC.exe
  2⤵
  PID:8676
- C:\Windows\System\iGfVIua.exe
  C:\Windows\System\iGfVIua.exe
  2⤵
  PID:8700
- C:\Windows\System\RtyXHqw.exe
  C:\Windows\System\RtyXHqw.exe
  2⤵
  PID:8728
- C:\Windows\System\TSBIdMY.exe
  C:\Windows\System\TSBIdMY.exe
  2⤵
  PID:8748
- C:\Windows\System\HIsFOrc.exe
  C:\Windows\System\HIsFOrc.exe
  2⤵
  PID:8768
- C:\Windows\System\cvMuVzj.exe
  C:\Windows\System\cvMuVzj.exe
  2⤵
  PID:8796
- C:\Windows\System\FdATEef.exe
  C:\Windows\System\FdATEef.exe
  2⤵
  PID:8820
- C:\Windows\System\mXEwYhx.exe
  C:\Windows\System\mXEwYhx.exe
  2⤵
  PID:8844
- C:\Windows\System\BWfsBei.exe
  C:\Windows\System\BWfsBei.exe
  2⤵
  PID:8868
- C:\Windows\System\stOyZjv.exe
  C:\Windows\System\stOyZjv.exe
  2⤵
  PID:8888
- C:\Windows\System\VPLsMvT.exe
  C:\Windows\System\VPLsMvT.exe
  2⤵
  PID:8912
- C:\Windows\System\urvLQOi.exe
  C:\Windows\System\urvLQOi.exe
  2⤵
  PID:8932
- C:\Windows\System\DexOsPX.exe
  C:\Windows\System\DexOsPX.exe
  2⤵
  PID:8956
- C:\Windows\System\NKlesUm.exe
  C:\Windows\System\NKlesUm.exe
  2⤵
  PID:9156
- C:\Windows\System\LUZiOfR.exe
  C:\Windows\System\LUZiOfR.exe
  2⤵
  PID:6856
- C:\Windows\System\iIVpzjc.exe
  C:\Windows\System\iIVpzjc.exe
  2⤵
  PID:6912
- C:\Windows\System\XUqvLCU.exe
  C:\Windows\System\XUqvLCU.exe
  2⤵
  PID:6928
- C:\Windows\System\FDGmhrv.exe
  C:\Windows\System\FDGmhrv.exe
  2⤵
  PID:6948
- C:\Windows\System\WvSPXnh.exe
  C:\Windows\System\WvSPXnh.exe
  2⤵
  PID:6976
- C:\Windows\System\KfGyecr.exe
  C:\Windows\System\KfGyecr.exe
  2⤵
  PID:6996
- C:\Windows\System\MjrunWu.exe
  C:\Windows\System\MjrunWu.exe
  2⤵
  PID:7528
- C:\Windows\System\pvNolpE.exe
  C:\Windows\System\pvNolpE.exe
  2⤵
  PID:7632
- C:\Windows\System\SjoBgCv.exe
  C:\Windows\System\SjoBgCv.exe
  2⤵
  PID:7120
- C:\Windows\System\PVOPIOP.exe
  C:\Windows\System\PVOPIOP.exe
  2⤵
  PID:7776
- C:\Windows\System\YcXFyln.exe
  C:\Windows\System\YcXFyln.exe
  2⤵
  PID:6324
- C:\Windows\System\ZogGoqe.exe
  C:\Windows\System\ZogGoqe.exe
  2⤵
  PID:5740
- C:\Windows\System\DRweWMs.exe
  C:\Windows\System\DRweWMs.exe
  2⤵
  PID:7952
- C:\Windows\System\WBHqWke.exe
  C:\Windows\System\WBHqWke.exe
  2⤵
  PID:6488
- C:\Windows\System\BIpBrJc.exe
  C:\Windows\System\BIpBrJc.exe
  2⤵
  PID:8060
- C:\Windows\System\hFGVqJN.exe
  C:\Windows\System\hFGVqJN.exe
  2⤵
  PID:6352
- C:\Windows\System\xVUQMzp.exe
  C:\Windows\System\xVUQMzp.exe
  2⤵
  PID:8108
- C:\Windows\System\BYLxeAe.exe
  C:\Windows\System\BYLxeAe.exe
  2⤵
  PID:6420
- C:\Windows\System\rOjpmKJ.exe
  C:\Windows\System\rOjpmKJ.exe
  2⤵
  PID:6496
- C:\Windows\System\Wgvvqfl.exe
  C:\Windows\System\Wgvvqfl.exe
  2⤵
  PID:4700
- C:\Windows\System\IFDAMow.exe
  C:\Windows\System\IFDAMow.exe
  2⤵
  PID:6680
- C:\Windows\System\cgWPAly.exe
  C:\Windows\System\cgWPAly.exe
  2⤵
  PID:7984
- C:\Windows\System\xKvFLkj.exe
  C:\Windows\System\xKvFLkj.exe
  2⤵
  PID:6836
- C:\Windows\System\rZQbFqc.exe
  C:\Windows\System\rZQbFqc.exe
  2⤵
  PID:4100
- C:\Windows\System\qoPOXEU.exe
  C:\Windows\System\qoPOXEU.exe
  2⤵
  PID:7216
- C:\Windows\System\fmaWMUO.exe
  C:\Windows\System\fmaWMUO.exe
  2⤵
  PID:7372
- C:\Windows\System\DjcRnCm.exe
  C:\Windows\System\DjcRnCm.exe
  2⤵
  PID:8256
- C:\Windows\System\foUaROp.exe
  C:\Windows\System\foUaROp.exe
  2⤵
  PID:8352
- C:\Windows\System\ZdesbIb.exe
  C:\Windows\System\ZdesbIb.exe
  2⤵
  PID:8396
- C:\Windows\System\TFKwMiK.exe
  C:\Windows\System\TFKwMiK.exe
  2⤵
  PID:8452
- C:\Windows\System\aFxvOcb.exe
  C:\Windows\System\aFxvOcb.exe
  2⤵
  PID:8580
- C:\Windows\System\RJoGvMN.exe
  C:\Windows\System\RJoGvMN.exe
  2⤵
  PID:8664
- C:\Windows\System\TnLqnnw.exe
  C:\Windows\System\TnLqnnw.exe
  2⤵
  PID:8736
- C:\Windows\System\KWrBqxG.exe
  C:\Windows\System\KWrBqxG.exe
  2⤵
  PID:5132
- C:\Windows\System\jhZlcEJ.exe
  C:\Windows\System\jhZlcEJ.exe
  2⤵
  PID:8808
- C:\Windows\System\FpDkqKF.exe
  C:\Windows\System\FpDkqKF.exe
  2⤵
  PID:8836
- C:\Windows\System\KUwCwCL.exe
  C:\Windows\System\KUwCwCL.exe
  2⤵
  PID:8880
- C:\Windows\System\ecVuuKb.exe
  C:\Windows\System\ecVuuKb.exe
  2⤵
  PID:7840
- C:\Windows\System\QAIRORx.exe
  C:\Windows\System\QAIRORx.exe
  2⤵
  PID:9244
- C:\Windows\System\uUqmeAT.exe
  C:\Windows\System\uUqmeAT.exe
  2⤵
  PID:9272
- C:\Windows\System\YqmAYTT.exe
  C:\Windows\System\YqmAYTT.exe
  2⤵
  PID:9296
- C:\Windows\System\OWfQpEl.exe
  C:\Windows\System\OWfQpEl.exe
  2⤵
  PID:9324
- C:\Windows\System\udyPCWP.exe
  C:\Windows\System\udyPCWP.exe
  2⤵
  PID:9368
- C:\Windows\System\kZTRIlG.exe
  C:\Windows\System\kZTRIlG.exe
  2⤵
  PID:9392
- C:\Windows\System\SJEHOGC.exe
  C:\Windows\System\SJEHOGC.exe
  2⤵
  PID:9424
- C:\Windows\System\dUqmgjd.exe
  C:\Windows\System\dUqmgjd.exe
  2⤵
  PID:9452
- C:\Windows\System\ufivalQ.exe
  C:\Windows\System\ufivalQ.exe
  2⤵
  PID:9472
- C:\Windows\System\xQxeweh.exe
  C:\Windows\System\xQxeweh.exe
  2⤵
  PID:9496
- C:\Windows\System\JpuyQaW.exe
  C:\Windows\System\JpuyQaW.exe
  2⤵
  PID:9520
- C:\Windows\System\xzynkdT.exe
  C:\Windows\System\xzynkdT.exe
  2⤵
  PID:9548
- C:\Windows\System\MiNJHRH.exe
  C:\Windows\System\MiNJHRH.exe
  2⤵
  PID:9568
- C:\Windows\System\wnCesRa.exe
  C:\Windows\System\wnCesRa.exe
  2⤵
  PID:9584
- C:\Windows\System\LLfCzuk.exe
  C:\Windows\System\LLfCzuk.exe
  2⤵
  PID:9604
- C:\Windows\System\KsfsycQ.exe
  C:\Windows\System\KsfsycQ.exe
  2⤵
  PID:9628
- C:\Windows\System\deCitjR.exe
  C:\Windows\System\deCitjR.exe
  2⤵
  PID:9656
- C:\Windows\System\GFHAMLu.exe
  C:\Windows\System\GFHAMLu.exe
  2⤵
  PID:9688
- C:\Windows\System\jxgzbpk.exe
  C:\Windows\System\jxgzbpk.exe
  2⤵
  PID:9716
- C:\Windows\System\TEZDtdr.exe
  C:\Windows\System\TEZDtdr.exe
  2⤵
  PID:9740
- C:\Windows\System\TvEpILU.exe
  C:\Windows\System\TvEpILU.exe
  2⤵
  PID:9764
- C:\Windows\System\sUagemh.exe
  C:\Windows\System\sUagemh.exe
  2⤵
  PID:9792
- C:\Windows\System\LIsuyvl.exe
  C:\Windows\System\LIsuyvl.exe
  2⤵
  PID:9812
- C:\Windows\System\voSjXrb.exe
  C:\Windows\System\voSjXrb.exe
  2⤵
  PID:9832
- C:\Windows\System\fncYYXS.exe
  C:\Windows\System\fncYYXS.exe
  2⤵
  PID:9856
- C:\Windows\System\nTnVuXO.exe
  C:\Windows\System\nTnVuXO.exe
  2⤵
  PID:9888
- C:\Windows\System\jSXzvLY.exe
  C:\Windows\System\jSXzvLY.exe
  2⤵
  PID:9908
- C:\Windows\System\klGktVH.exe
  C:\Windows\System\klGktVH.exe
  2⤵
  PID:9936
- C:\Windows\System\yDiFHjO.exe
  C:\Windows\System\yDiFHjO.exe
  2⤵
  PID:9964
- C:\Windows\System\BRGGyoa.exe
  C:\Windows\System\BRGGyoa.exe
  2⤵
  PID:9984
- C:\Windows\System\dLeNulv.exe
  C:\Windows\System\dLeNulv.exe
  2⤵
  PID:10004
- C:\Windows\System\NxukZxL.exe
  C:\Windows\System\NxukZxL.exe
  2⤵
  PID:10028
- C:\Windows\System\gZMNnmR.exe
  C:\Windows\System\gZMNnmR.exe
  2⤵
  PID:10052
- C:\Windows\System\FgQedUW.exe
  C:\Windows\System\FgQedUW.exe
  2⤵
  PID:10076
- C:\Windows\System\gyztuhh.exe
  C:\Windows\System\gyztuhh.exe
  2⤵
  PID:10100
- C:\Windows\System\SIICRbN.exe
  C:\Windows\System\SIICRbN.exe
  2⤵
  PID:10120
- C:\Windows\System\uWtfjvK.exe
  C:\Windows\System\uWtfjvK.exe
  2⤵
  PID:10144
- C:\Windows\System\IhJYGsM.exe
  C:\Windows\System\IhJYGsM.exe
  2⤵
  PID:10168
- C:\Windows\System\XlxIkEQ.exe
  C:\Windows\System\XlxIkEQ.exe
  2⤵
  PID:10192
- C:\Windows\System\DheiyRa.exe
  C:\Windows\System\DheiyRa.exe
  2⤵
  PID:10212
- C:\Windows\System\KkmciAQ.exe
  C:\Windows\System\KkmciAQ.exe
  2⤵
  PID:10232
- C:\Windows\System\VbCAQQd.exe
  C:\Windows\System\VbCAQQd.exe
  2⤵
  PID:6224
- C:\Windows\System\azlfErW.exe
  C:\Windows\System\azlfErW.exe
  2⤵
  PID:8156
- C:\Windows\System\QlwVkug.exe
  C:\Windows\System\QlwVkug.exe
  2⤵
  PID:6652
- C:\Windows\System\mhQoYfH.exe
  C:\Windows\System\mhQoYfH.exe
  2⤵
  PID:9192
- C:\Windows\System\DhJHizF.exe
  C:\Windows\System\DhJHizF.exe
  2⤵
  PID:7912
- C:\Windows\System\CFwaoKF.exe
  C:\Windows\System\CFwaoKF.exe
  2⤵
  PID:6944
- C:\Windows\System\FtbRDZA.exe
  C:\Windows\System\FtbRDZA.exe
  2⤵
  PID:8220
- C:\Windows\System\oudjgDq.exe
  C:\Windows\System\oudjgDq.exe
  2⤵
  PID:7716
- C:\Windows\System\nyxHXGW.exe
  C:\Windows\System\nyxHXGW.exe
  2⤵
  PID:7328
- C:\Windows\System\LkjpmBZ.exe
  C:\Windows\System\LkjpmBZ.exe
  2⤵
  PID:8276
- C:\Windows\System\CEyIxYs.exe
  C:\Windows\System\CEyIxYs.exe
  2⤵
  PID:8432
- C:\Windows\System\KQWbQSb.exe
  C:\Windows\System\KQWbQSb.exe
  2⤵
  PID:8448
- C:\Windows\System\XRhlMAt.exe
  C:\Windows\System\XRhlMAt.exe
  2⤵
  PID:8492
- C:\Windows\System\VVlsTlw.exe
  C:\Windows\System\VVlsTlw.exe
  2⤵
  PID:6632
- C:\Windows\System\YzobYxM.exe
  C:\Windows\System\YzobYxM.exe
  2⤵
  PID:7572
- C:\Windows\System\NRqAKeH.exe
  C:\Windows\System\NRqAKeH.exe
  2⤵
  PID:8596
- C:\Windows\System\GgXgxdT.exe
  C:\Windows\System\GgXgxdT.exe
  2⤵
  PID:8616
- C:\Windows\System\DsdcxuO.exe
  C:\Windows\System\DsdcxuO.exe
  2⤵
  PID:10248
- C:\Windows\System\YhSZJmU.exe
  C:\Windows\System\YhSZJmU.exe
  2⤵
  PID:10276
- C:\Windows\System\iJZrpyQ.exe
  C:\Windows\System\iJZrpyQ.exe
  2⤵
  PID:10300
- C:\Windows\System\wbyHvgo.exe
  C:\Windows\System\wbyHvgo.exe
  2⤵
  PID:10324
- C:\Windows\System\tVEHDiJ.exe
  C:\Windows\System\tVEHDiJ.exe
  2⤵
  PID:10340
- C:\Windows\System\iWfaUAO.exe
  C:\Windows\System\iWfaUAO.exe
  2⤵
  PID:10364
- C:\Windows\System\wxGZysu.exe
  C:\Windows\System\wxGZysu.exe
  2⤵
  PID:10388
- C:\Windows\System\ULLGEUk.exe
  C:\Windows\System\ULLGEUk.exe
  2⤵
  PID:10412
- C:\Windows\System\VZMYJLJ.exe
  C:\Windows\System\VZMYJLJ.exe
  2⤵
  PID:10436
- C:\Windows\System\vhcRiOa.exe
  C:\Windows\System\vhcRiOa.exe
  2⤵
  PID:10456
- C:\Windows\System\cCSzCkM.exe
  C:\Windows\System\cCSzCkM.exe
  2⤵
  PID:10480
- C:\Windows\System\MEWIYrX.exe
  C:\Windows\System\MEWIYrX.exe
  2⤵
  PID:10504
- C:\Windows\System\XIXqnGC.exe
  C:\Windows\System\XIXqnGC.exe
  2⤵
  PID:10528
- C:\Windows\System\GteuhDi.exe
  C:\Windows\System\GteuhDi.exe
  2⤵
  PID:10548
- C:\Windows\System\FrisxKU.exe
  C:\Windows\System\FrisxKU.exe
  2⤵
  PID:10572
- C:\Windows\System\xzBtfHe.exe
  C:\Windows\System\xzBtfHe.exe
  2⤵
  PID:10600
- C:\Windows\System\eKIheWa.exe
  C:\Windows\System\eKIheWa.exe
  2⤵
  PID:10616
- C:\Windows\System\kGMATjL.exe
  C:\Windows\System\kGMATjL.exe
  2⤵
  PID:10632
- C:\Windows\System\KyiEhAi.exe
  C:\Windows\System\KyiEhAi.exe
  2⤵
  PID:10652
- C:\Windows\System\fQvqDKm.exe
  C:\Windows\System\fQvqDKm.exe
  2⤵
  PID:10676
- C:\Windows\System\JsEAzLS.exe
  C:\Windows\System\JsEAzLS.exe
  2⤵
  PID:10700
- C:\Windows\System\gUJYENy.exe
  C:\Windows\System\gUJYENy.exe
  2⤵
  PID:10720
- C:\Windows\System\loZZAlP.exe
  C:\Windows\System\loZZAlP.exe
  2⤵
  PID:10744
- C:\Windows\System\UdqRxYY.exe
  C:\Windows\System\UdqRxYY.exe
  2⤵
  PID:10772
- C:\Windows\System\mJbdOzC.exe
  C:\Windows\System\mJbdOzC.exe
  2⤵
  PID:10792
- C:\Windows\System\gecVijZ.exe
  C:\Windows\System\gecVijZ.exe
  2⤵
  PID:10816
- C:\Windows\System\reckUAU.exe
  C:\Windows\System\reckUAU.exe
  2⤵
  PID:10840
- C:\Windows\System\hPUgqsk.exe
  C:\Windows\System\hPUgqsk.exe
  2⤵
  PID:10864
- C:\Windows\System\jvKAQkh.exe
  C:\Windows\System\jvKAQkh.exe
  2⤵
  PID:10884
- C:\Windows\System\hfcFXpK.exe
  C:\Windows\System\hfcFXpK.exe
  2⤵
  PID:10908
- C:\Windows\System\AQAIYRG.exe
  C:\Windows\System\AQAIYRG.exe
  2⤵
  PID:10928
- C:\Windows\System\TsiLgSl.exe
  C:\Windows\System\TsiLgSl.exe
  2⤵
  PID:10948
- C:\Windows\System\IQmdWFE.exe
  C:\Windows\System\IQmdWFE.exe
  2⤵
  PID:10972
- C:\Windows\System\rmmMhtH.exe
  C:\Windows\System\rmmMhtH.exe
  2⤵
  PID:11000
- C:\Windows\System\JwKLdgj.exe
  C:\Windows\System\JwKLdgj.exe
  2⤵
  PID:11024
- C:\Windows\System\OPIgRnV.exe
  C:\Windows\System\OPIgRnV.exe
  2⤵
  PID:11048
- C:\Windows\System\fxuSprO.exe
  C:\Windows\System\fxuSprO.exe
  2⤵
  PID:11080
- C:\Windows\System\rfiZpLZ.exe
  C:\Windows\System\rfiZpLZ.exe
  2⤵
  PID:11100
- C:\Windows\System\FoHppFd.exe
  C:\Windows\System\FoHppFd.exe
  2⤵
  PID:11120
- C:\Windows\System\BrnfZoe.exe
  C:\Windows\System\BrnfZoe.exe
  2⤵
  PID:11140
- C:\Windows\System\HZwrACr.exe
  C:\Windows\System\HZwrACr.exe
  2⤵
  PID:11164
- C:\Windows\System\lbTauHW.exe
  C:\Windows\System\lbTauHW.exe
  2⤵
  PID:11184
- C:\Windows\System\yyAgadm.exe
  C:\Windows\System\yyAgadm.exe
  2⤵
  PID:11204
- C:\Windows\System\oilEURm.exe
  C:\Windows\System\oilEURm.exe
  2⤵
  PID:11228
- C:\Windows\System\pvDRjcf.exe
  C:\Windows\System\pvDRjcf.exe
  2⤵
  PID:11248
- C:\Windows\System\OsWpsLx.exe
  C:\Windows\System\OsWpsLx.exe
  2⤵
  PID:7684
- C:\Windows\System\swhQBzF.exe
  C:\Windows\System\swhQBzF.exe
  2⤵
  PID:7808
- C:\Windows\System\RjqzMws.exe
  C:\Windows\System\RjqzMws.exe
  2⤵
  PID:7828
- C:\Windows\System\QSUjQyo.exe
  C:\Windows\System\QSUjQyo.exe
  2⤵
  PID:7876
- C:\Windows\System\sHbmAXu.exe
  C:\Windows\System\sHbmAXu.exe
  2⤵
  PID:9232
- C:\Windows\System\rVobHEn.exe
  C:\Windows\System\rVobHEn.exe
  2⤵
  PID:1556
- C:\Windows\System\oqhNkah.exe
  C:\Windows\System\oqhNkah.exe
  2⤵
  PID:6156
- C:\Windows\System\nrZAIsw.exe
  C:\Windows\System\nrZAIsw.exe
  2⤵
  PID:9448
- C:\Windows\System\YpTuEDV.exe
  C:\Windows\System\YpTuEDV.exe
  2⤵
  PID:9512
- C:\Windows\System\QjKvAIm.exe
  C:\Windows\System\QjKvAIm.exe
  2⤵
  PID:9564
- C:\Windows\System\vKSaqgH.exe
  C:\Windows\System\vKSaqgH.exe
  2⤵
  PID:9600
- C:\Windows\System\hUlFkAb.exe
  C:\Windows\System\hUlFkAb.exe
  2⤵
  PID:8104
- C:\Windows\System\KSoNgcX.exe
  C:\Windows\System\KSoNgcX.exe
  2⤵
  PID:6452
- C:\Windows\System\ljxprEG.exe
  C:\Windows\System\ljxprEG.exe
  2⤵
  PID:7388
- C:\Windows\System\JjEulqF.exe
  C:\Windows\System\JjEulqF.exe
  2⤵
  PID:7224
- C:\Windows\System\fHVntib.exe
  C:\Windows\System\fHVntib.exe
  2⤵
  PID:7612
- C:\Windows\System\lIfipRt.exe
  C:\Windows\System\lIfipRt.exe
  2⤵
  PID:7116
- C:\Windows\System\tXCiJCX.exe
  C:\Windows\System\tXCiJCX.exe
  2⤵
  PID:10024
- C:\Windows\System\uayOYby.exe
  C:\Windows\System\uayOYby.exe
  2⤵
  PID:10092
- C:\Windows\System\lJWbicr.exe
  C:\Windows\System\lJWbicr.exe
  2⤵
  PID:10180
- C:\Windows\System\MhuZbeq.exe
  C:\Windows\System\MhuZbeq.exe
  2⤵
  PID:7996
- C:\Windows\System\cshBzme.exe
  C:\Windows\System\cshBzme.exe
  2⤵
  PID:11292
- C:\Windows\System\syzjecX.exe
  C:\Windows\System\syzjecX.exe
  2⤵
  PID:11316
- C:\Windows\System\DpIwnbu.exe
  C:\Windows\System\DpIwnbu.exe
  2⤵
  PID:11340
- C:\Windows\System\KnexDTk.exe
  C:\Windows\System\KnexDTk.exe
  2⤵
  PID:11364
- C:\Windows\System\RqeWKig.exe
  C:\Windows\System\RqeWKig.exe
  2⤵
  PID:11388
- C:\Windows\System\RKIRcIb.exe
  C:\Windows\System\RKIRcIb.exe
  2⤵
  PID:12044
- C:\Windows\System\DRwlueo.exe
  C:\Windows\System\DRwlueo.exe
  2⤵
  PID:12064
- C:\Windows\System\FAmwbUz.exe
  C:\Windows\System\FAmwbUz.exe
  2⤵
  PID:12088
- C:\Windows\System\yenfnSY.exe
  C:\Windows\System\yenfnSY.exe
  2⤵
  PID:12108
- C:\Windows\System\xMXknTH.exe
  C:\Windows\System\xMXknTH.exe
  2⤵
  PID:12128
- C:\Windows\System\DVPSkLr.exe
  C:\Windows\System\DVPSkLr.exe
  2⤵
  PID:12148
- C:\Windows\System\tdpdTna.exe
  C:\Windows\System\tdpdTna.exe
  2⤵
  PID:12172
- C:\Windows\System\ejxjHih.exe
  C:\Windows\System\ejxjHih.exe
  2⤵
  PID:12200
- C:\Windows\System\sAJQPFh.exe
  C:\Windows\System\sAJQPFh.exe
  2⤵
  PID:12220
- C:\Windows\System\ZHwOHYK.exe
  C:\Windows\System\ZHwOHYK.exe
  2⤵
  PID:12236
- C:\Windows\System\teUepLn.exe
  C:\Windows\System\teUepLn.exe
  2⤵
  PID:12260
- C:\Windows\System\rEHTdPP.exe
  C:\Windows\System\rEHTdPP.exe
  2⤵
  PID:12280
- C:\Windows\System\vBnyNiO.exe
  C:\Windows\System\vBnyNiO.exe
  2⤵
  PID:6028
- C:\Windows\System\tblyEAn.exe
  C:\Windows\System\tblyEAn.exe
  2⤵
  PID:8472
- C:\Windows\System\BccvTiy.exe
  C:\Windows\System\BccvTiy.exe
  2⤵
  PID:8500
- C:\Windows\System\yArWJmM.exe
  C:\Windows\System\yArWJmM.exe
  2⤵
  PID:8176
- C:\Windows\System\utFSrBz.exe
  C:\Windows\System\utFSrBz.exe
  2⤵
  PID:7468
- C:\Windows\System\OGEozcL.exe
  C:\Windows\System\OGEozcL.exe
  2⤵
  PID:10312
- C:\Windows\System\LwpgNfE.exe
  C:\Windows\System\LwpgNfE.exe
  2⤵
  PID:8568
- C:\Windows\System\DJNANeW.exe
  C:\Windows\System\DJNANeW.exe
  2⤵
  PID:8760
- C:\Windows\System\nbwmldS.exe
  C:\Windows\System\nbwmldS.exe
  2⤵
  PID:10472
- C:\Windows\System\TVPlYCO.exe
  C:\Windows\System\TVPlYCO.exe
  2⤵
  PID:7852
- C:\Windows\System\FxLkgHs.exe
  C:\Windows\System\FxLkgHs.exe
  2⤵
  PID:9384
- C:\Windows\System\zVrKfjh.exe
  C:\Windows\System\zVrKfjh.exe
  2⤵
  PID:11152
- C:\Windows\System\bDlEIKK.exe
  C:\Windows\System\bDlEIKK.exe
  2⤵
  PID:7408
- C:\Windows\System\SwgmJuI.exe
  C:\Windows\System\SwgmJuI.exe
  2⤵
  PID:8984
- C:\Windows\System\vNTBZYr.exe
  C:\Windows\System\vNTBZYr.exe
  2⤵
  PID:9868
- C:\Windows\System\foiFjdy.exe
  C:\Windows\System\foiFjdy.exe
  2⤵
  PID:9972
- C:\Windows\System\RqrjAxR.exe
  C:\Windows\System\RqrjAxR.exe
  2⤵
  PID:10088
- C:\Windows\System\tDiXyuU.exe
  C:\Windows\System\tDiXyuU.exe
  2⤵
  PID:10204
- C:\Windows\System\QLPyGuC.exe
  C:\Windows\System\QLPyGuC.exe
  2⤵
  PID:11312
- C:\Windows\System\LbcDifw.exe
  C:\Windows\System\LbcDifw.exe
  2⤵
  PID:7344
- C:\Windows\System\whyErNc.exe
  C:\Windows\System\whyErNc.exe
  2⤵
  PID:6668
- C:\Windows\System\YJgnMHW.exe
  C:\Windows\System\YJgnMHW.exe
  2⤵
  PID:11432
- C:\Windows\System\SSJXuZD.exe
  C:\Windows\System\SSJXuZD.exe
  2⤵
  PID:8556
- C:\Windows\System\Gpjedgh.exe
  C:\Windows\System\Gpjedgh.exe
  2⤵
  PID:10288
- C:\Windows\System\yJbRNkl.exe
  C:\Windows\System\yJbRNkl.exe
  2⤵
  PID:10468
- C:\Windows\System\vMIzPJb.exe
  C:\Windows\System\vMIzPJb.exe
  2⤵
  PID:11588
- C:\Windows\System\lqxJzye.exe
  C:\Windows\System\lqxJzye.exe
  2⤵
  PID:10544
- C:\Windows\System\HdOSakJ.exe
  C:\Windows\System\HdOSakJ.exe
  2⤵
  PID:9280
- C:\Windows\System\juqmNYk.exe
  C:\Windows\System\juqmNYk.exe
  2⤵
  PID:10668
- C:\Windows\System\EldwKom.exe
  C:\Windows\System\EldwKom.exe
  2⤵
  PID:9432
- C:\Windows\System\yhgZASg.exe
  C:\Windows\System\yhgZASg.exe
  2⤵
  PID:9668
- C:\Windows\System\MNdSTWB.exe
  C:\Windows\System\MNdSTWB.exe
  2⤵
  PID:9800
- C:\Windows\System\rNMFmTl.exe
  C:\Windows\System\rNMFmTl.exe
  2⤵
  PID:8416
- C:\Windows\System\PgPeXgu.exe
  C:\Windows\System\PgPeXgu.exe
  2⤵
  PID:8972
- C:\Windows\System\Xckvhow.exe
  C:\Windows\System\Xckvhow.exe
  2⤵
  PID:9400
- C:\Windows\System\lVUEfQZ.exe
  C:\Windows\System\lVUEfQZ.exe
  2⤵
  PID:9976
- C:\Windows\System\thctita.exe
  C:\Windows\System\thctita.exe
  2⤵
  PID:9616
- C:\Windows\System\TuUXVaA.exe
  C:\Windows\System\TuUXVaA.exe
  2⤵
  PID:9924
- C:\Windows\System\rkgnfyN.exe
  C:\Windows\System\rkgnfyN.exe
  2⤵
  PID:10164
- C:\Windows\System\GcwGHqr.exe
  C:\Windows\System\GcwGHqr.exe
  2⤵
  PID:10060
- C:\Windows\System\MJVVmOu.exe
  C:\Windows\System\MJVVmOu.exe
  2⤵
  PID:10200
- C:\Windows\System\kpQiXQg.exe
  C:\Windows\System\kpQiXQg.exe
  2⤵
  PID:11272
- C:\Windows\System\QnKEfqH.exe
  C:\Windows\System\QnKEfqH.exe
  2⤵
  PID:12004
- C:\Windows\System\msXzYMa.exe
  C:\Windows\System\msXzYMa.exe
  2⤵
  PID:11352
- C:\Windows\System\efRrQVE.exe
  C:\Windows\System\efRrQVE.exe
  2⤵
  PID:7440
- C:\Windows\System\LiVsrYN.exe
  C:\Windows\System\LiVsrYN.exe
  2⤵
  PID:12300
- C:\Windows\System\JSlkZUk.exe
  C:\Windows\System\JSlkZUk.exe
  2⤵
  PID:12324
- C:\Windows\System\CdVrWya.exe
  C:\Windows\System\CdVrWya.exe
  2⤵
  PID:12340
- C:\Windows\System\JZqddfO.exe
  C:\Windows\System\JZqddfO.exe
  2⤵
  PID:12364
- C:\Windows\System\UPEpBZd.exe
  C:\Windows\System\UPEpBZd.exe
  2⤵
  PID:12392
- C:\Windows\System\wSosLlH.exe
  C:\Windows\System\wSosLlH.exe
  2⤵
  PID:12412
- C:\Windows\System\UMdRVLx.exe
  C:\Windows\System\UMdRVLx.exe
  2⤵
  PID:12436
- C:\Windows\System\SLhEYhx.exe
  C:\Windows\System\SLhEYhx.exe
  2⤵
  PID:12460
- C:\Windows\System\CFzjCwG.exe
  C:\Windows\System\CFzjCwG.exe
  2⤵
  PID:12480
- C:\Windows\System\NwfAqjZ.exe
  C:\Windows\System\NwfAqjZ.exe
  2⤵
  PID:12500
- C:\Windows\System\nAoGhid.exe
  C:\Windows\System\nAoGhid.exe
  2⤵
  PID:12524
- C:\Windows\System\fQmqGRg.exe
  C:\Windows\System\fQmqGRg.exe
  2⤵
  PID:12552
- C:\Windows\System\ulykbAz.exe
  C:\Windows\System\ulykbAz.exe
  2⤵
  PID:12568
- C:\Windows\System\wApgqIc.exe
  C:\Windows\System\wApgqIc.exe
  2⤵
  PID:12584
- C:\Windows\System\jkBgAsi.exe
  C:\Windows\System\jkBgAsi.exe
  2⤵
  PID:12604
- C:\Windows\System\GcZqpQn.exe
  C:\Windows\System\GcZqpQn.exe
  2⤵
  PID:12620
- C:\Windows\System\VpvNvKO.exe
  C:\Windows\System\VpvNvKO.exe
  2⤵
  PID:12640
- C:\Windows\System\nbehuuL.exe
  C:\Windows\System\nbehuuL.exe
  2⤵
  PID:12656
- C:\Windows\System\bhAZNDK.exe
  C:\Windows\System\bhAZNDK.exe
  2⤵
  PID:12676
- C:\Windows\System\gswhyFi.exe
  C:\Windows\System\gswhyFi.exe
  2⤵
  PID:12692
- C:\Windows\System\ppewLdp.exe
  C:\Windows\System\ppewLdp.exe
  2⤵
  PID:12716
- C:\Windows\System\xuyevlw.exe
  C:\Windows\System\xuyevlw.exe
  2⤵
  PID:12744
- C:\Windows\System\ETTMSlC.exe
  C:\Windows\System\ETTMSlC.exe
  2⤵
  PID:12768
- C:\Windows\System\yapnRAl.exe
  C:\Windows\System\yapnRAl.exe
  2⤵
  PID:12792
- C:\Windows\System\cvHxIPZ.exe
  C:\Windows\System\cvHxIPZ.exe
  2⤵
  PID:12816
- C:\Windows\System\jXwhLHC.exe
  C:\Windows\System\jXwhLHC.exe
  2⤵
  PID:12844
- C:\Windows\System\qSqfvcS.exe
  C:\Windows\System\qSqfvcS.exe
  2⤵
  PID:12868
- C:\Windows\System\yMjBgIh.exe
  C:\Windows\System\yMjBgIh.exe
  2⤵
  PID:12888
- C:\Windows\System\OGZyBNr.exe
  C:\Windows\System\OGZyBNr.exe
  2⤵
  PID:12916
- C:\Windows\System\kJmWHyz.exe
  C:\Windows\System\kJmWHyz.exe
  2⤵
  PID:12940
- C:\Windows\System\XMwtUad.exe
  C:\Windows\System\XMwtUad.exe
  2⤵
  PID:12960
- C:\Windows\System\IYFQkRd.exe
  C:\Windows\System\IYFQkRd.exe
  2⤵
  PID:7272
- C:\Windows\System\usjYsxV.exe
  C:\Windows\System\usjYsxV.exe
  2⤵
  PID:11212
- C:\Windows\System\YYRvRJw.exe
  C:\Windows\System\YYRvRJw.exe
  2⤵
  PID:7956
- C:\Windows\System\KRwxHSf.exe
  C:\Windows\System\KRwxHSf.exe
  2⤵
  PID:12668
- C:\Windows\System\CbgyREh.exe
  C:\Windows\System\CbgyREh.exe
  2⤵
  PID:12708
- C:\Windows\System\iSkPYHW.exe
  C:\Windows\System\iSkPYHW.exe
  2⤵
  PID:12784
- C:\Windows\System\IGpJMBA.exe
  C:\Windows\System\IGpJMBA.exe
  2⤵
  PID:11532
- C:\Windows\System\iZqIDRp.exe
  C:\Windows\System\iZqIDRp.exe
  2⤵
  PID:11660
- C:\Windows\System\MxmTiBm.exe
  C:\Windows\System\MxmTiBm.exe
  2⤵
  PID:11172
- C:\Windows\System\UdBXgmv.exe
  C:\Windows\System\UdBXgmv.exe
  2⤵
  PID:9840
- C:\Windows\System\axfiSWu.exe
  C:\Windows\System\axfiSWu.exe
  2⤵
  PID:8464
- C:\Windows\System\wRtYYZt.exe
  C:\Windows\System\wRtYYZt.exe
  2⤵
  PID:8804
- C:\Windows\System\JXWjutY.exe
  C:\Windows\System\JXWjutY.exe
  2⤵
  PID:8876
- C:\Windows\System\YfPFMwM.exe
  C:\Windows\System\YfPFMwM.exe
  2⤵
  PID:10992
- C:\Windows\System\ZHRcGCq.exe
  C:\Windows\System\ZHRcGCq.exe
  2⤵
  PID:9780
- C:\Windows\System\nmLWgiV.exe
  C:\Windows\System\nmLWgiV.exe
  2⤵
  PID:8948
- C:\Windows\System\NlokSIg.exe
  C:\Windows\System\NlokSIg.exe
  2⤵
  PID:7988
- C:\Windows\System\NGwZgTG.exe
  C:\Windows\System\NGwZgTG.exe
  2⤵
  PID:9592
- C:\Windows\System\CfADTrW.exe
  C:\Windows\System\CfADTrW.exe
  2⤵
  PID:10136
- C:\Windows\System\iKGJimI.exe
  C:\Windows\System\iKGJimI.exe
  2⤵
  PID:13232
- C:\Windows\System\UUepmxZ.exe
  C:\Windows\System\UUepmxZ.exe
  2⤵
  PID:3048
- C:\Windows\System\yaTBWFT.exe
  C:\Windows\System\yaTBWFT.exe
  2⤵
  PID:10380
- C:\Windows\System\YfbxCos.exe
  C:\Windows\System\YfbxCos.exe
  2⤵
  PID:10332
- C:\Windows\System\HRuTCdf.exe
  C:\Windows\System\HRuTCdf.exe
  2⤵
  PID:7560
- C:\Windows\System\DiBIQtu.exe
  C:\Windows\System\DiBIQtu.exe
  2⤵
  PID:10660
- C:\Windows\System\mGMXpzt.exe
  C:\Windows\System\mGMXpzt.exe
  2⤵
  PID:1572
- C:\Windows\System\zABdjQS.exe
  C:\Windows\System\zABdjQS.exe
  2⤵
  PID:11136
- C:\Windows\System\YveVeAW.exe
  C:\Windows\System\YveVeAW.exe
  2⤵
  PID:12616
- C:\Windows\System\LHHnYTk.exe
  C:\Windows\System\LHHnYTk.exe
  2⤵
  PID:12860
- C:\Windows\System\PcsPIOr.exe
  C:\Windows\System\PcsPIOr.exe
  2⤵
  PID:12984
- C:\Windows\System\IojQFUS.exe
  C:\Windows\System\IojQFUS.exe
  2⤵
  PID:10872
- C:\Windows\System\wsdaFQd.exe
  C:\Windows\System\wsdaFQd.exe
  2⤵
  PID:11132
- C:\Windows\System\KYUpRJk.exe
  C:\Windows\System\KYUpRJk.exe
  2⤵
  PID:8196
- C:\Windows\System\HuacksP.exe
  C:\Windows\System\HuacksP.exe
  2⤵
  PID:10784
- C:\Windows\System\mWqmxZr.exe
  C:\Windows\System\mWqmxZr.exe
  2⤵
  PID:8488
- C:\Windows\System\plVRLpn.exe
  C:\Windows\System\plVRLpn.exe
  2⤵
  PID:400
- C:\Windows\System\Cfsykqj.exe
  C:\Windows\System\Cfsykqj.exe
  2⤵
  PID:12912
- C:\Windows\System\KHdluNR.exe
  C:\Windows\System\KHdluNR.exe
  2⤵
  PID:13076
- C:\Windows\System\GaknKJl.exe
  C:\Windows\System\GaknKJl.exe
  2⤵
  PID:10916
- C:\Windows\System\yTptuBH.exe
  C:\Windows\System\yTptuBH.exe
  2⤵
  PID:12120
- C:\Windows\System\DNAHhMM.exe
  C:\Windows\System\DNAHhMM.exe
  2⤵
  PID:7308
- C:\Windows\System\ROqaYDy.exe
  C:\Windows\System\ROqaYDy.exe
  2⤵
  PID:11224
- C:\Windows\System\pfFGlFT.exe
  C:\Windows\System\pfFGlFT.exe
  2⤵
  PID:6896
- C:\Windows\System\yMkKUJh.exe
  C:\Windows\System\yMkKUJh.exe
  2⤵
  PID:12540
- C:\Windows\System\ZBxocZo.exe
  C:\Windows\System\ZBxocZo.exe
  2⤵
  PID:12612
- C:\Windows\System\PWZngrb.exe
  C:\Windows\System\PWZngrb.exe
  2⤵
  PID:1956
- C:\Windows\System\vWPatPG.exe
  C:\Windows\System\vWPatPG.exe
  2⤵
  PID:12764
- C:\Windows\System\GcghFBG.exe
  C:\Windows\System\GcghFBG.exe
  2⤵
  PID:8552
- C:\Windows\System\WzkulqL.exe
  C:\Windows\System\WzkulqL.exe
  2⤵
  PID:11776
- C:\Windows\System\AqWNbQD.exe
  C:\Windows\System\AqWNbQD.exe
  2⤵
  PID:12880
- C:\Windows\System\NhhMFKo.exe
  C:\Windows\System\NhhMFKo.exe
  2⤵
  PID:3352
- C:\Windows\System\UCiLcZE.exe
  C:\Windows\System\UCiLcZE.exe
  2⤵
  PID:12072
- C:\Windows\System\KTJUHWL.exe
  C:\Windows\System\KTJUHWL.exe
  2⤵
  PID:7588
- C:\Windows\System\tbyYDyE.exe
  C:\Windows\System\tbyYDyE.exe
  2⤵
  PID:8924
- C:\Windows\System\UFjBlma.exe
  C:\Windows\System\UFjBlma.exe
  2⤵
  PID:9680
- C:\Windows\System\fuAfrQa.exe
  C:\Windows\System\fuAfrQa.exe
  2⤵
  PID:12268
- C:\Windows\System\kznWkzh.exe
  C:\Windows\System\kznWkzh.exe
  2⤵
  PID:12824
- C:\Windows\System\MZWhAmG.exe
  C:\Windows\System\MZWhAmG.exe
  2⤵
  PID:7960
- C:\Windows\System\eLIdYIa.exe
  C:\Windows\System\eLIdYIa.exe
  2⤵
  PID:10208
- C:\Windows\System\GkkgDkH.exe
  C:\Windows\System\GkkgDkH.exe
  2⤵
  PID:13004
- C:\Windows\System\YOafIDb.exe
  C:\Windows\System\YOafIDb.exe
  2⤵
  PID:8056
- C:\Windows\System\ZTSWUpT.exe
  C:\Windows\System\ZTSWUpT.exe
  2⤵
  PID:11764
- C:\Windows\System\pfjDHRa.exe
  C:\Windows\System\pfjDHRa.exe
  2⤵
  PID:12032
- C:\Windows\System\OboPcUf.exe
  C:\Windows\System\OboPcUf.exe
  2⤵
  PID:5080
- C:\Windows\System\YwvgVAr.exe
  C:\Windows\System\YwvgVAr.exe
  2⤵
  PID:12052
- C:\Windows\System\ILiEchZ.exe
  C:\Windows\System\ILiEchZ.exe
  2⤵
  PID:12428
- C:\Windows\System\ErSmiXp.exe
  C:\Windows\System\ErSmiXp.exe
  2⤵
  PID:12936
- C:\Windows\System\AVASnHw.exe
  C:\Windows\System\AVASnHw.exe
  2⤵
  PID:12216
- C:\Windows\System\JCgdROw.exe
  C:\Windows\System\JCgdROw.exe
  2⤵
  PID:11176
- C:\Windows\System\auaCmyv.exe
  C:\Windows\System\auaCmyv.exe
  2⤵
  PID:8016
- C:\Windows\System\qILyZLn.exe
  C:\Windows\System\qILyZLn.exe
  2⤵
  PID:7356
- C:\Windows\System\JNzSUnE.exe
  C:\Windows\System\JNzSUnE.exe
  2⤵
  PID:12476
- C:\Windows\System\oWXtrkS.exe
  C:\Windows\System\oWXtrkS.exe
  2⤵
  PID:12600
- C:\Windows\System\MQfXCWY.exe
  C:\Windows\System\MQfXCWY.exe
  2⤵
  PID:12124
- C:\Windows\System\MdCAqmP.exe
  C:\Windows\System\MdCAqmP.exe
  2⤵
  PID:8436
- C:\Windows\System\UKzkQRs.exe
  C:\Windows\System\UKzkQRs.exe
  2⤵
  PID:11128
- C:\Windows\System\SifFBEF.exe
  C:\Windows\System\SifFBEF.exe
  2⤵
  PID:11376
- C:\Windows\System\NSluSnF.exe
  C:\Windows\System\NSluSnF.exe
  2⤵
  PID:12564
- C:\Windows\System\gwKwksE.exe
  C:\Windows\System\gwKwksE.exe
  2⤵
  PID:13456
- C:\Windows\System\MGxLHzF.exe
  C:\Windows\System\MGxLHzF.exe
  2⤵
  PID:13544
- C:\Windows\System\jPbDkTu.exe
  C:\Windows\System\jPbDkTu.exe
  2⤵
  PID:13684
- C:\Windows\System\keKAKNB.exe
  C:\Windows\System\keKAKNB.exe
  2⤵
  PID:13720
- C:\Windows\System\RxQSWLn.exe
  C:\Windows\System\RxQSWLn.exe
  2⤵
  PID:13780
- C:\Windows\System\qQOeiFl.exe
  C:\Windows\System\qQOeiFl.exe
  2⤵
  PID:13796
- C:\Windows\System\UDsBAgf.exe
  C:\Windows\System\UDsBAgf.exe
  2⤵
  PID:13824
- C:\Windows\System\xUJhDtF.exe
  C:\Windows\System\xUJhDtF.exe
  2⤵
  PID:13844
- C:\Windows\System\OcgNJel.exe
  C:\Windows\System\OcgNJel.exe
  2⤵
  PID:13884
- C:\Windows\System\xkEODum.exe
  C:\Windows\System\xkEODum.exe
  2⤵
  PID:13900
- C:\Windows\System\Vqddlrn.exe
  C:\Windows\System\Vqddlrn.exe
  2⤵
  PID:13924
- C:\Windows\System\aylKgTG.exe
  C:\Windows\System\aylKgTG.exe
  2⤵
  PID:13940
- C:\Windows\System\VHJlEvR.exe
  C:\Windows\System\VHJlEvR.exe
  2⤵
  PID:13976
- C:\Windows\System\eEGEZrd.exe
  C:\Windows\System\eEGEZrd.exe
  2⤵
  PID:14048
- C:\Windows\System\FlFwATe.exe
  C:\Windows\System\FlFwATe.exe
  2⤵
  PID:14064
- C:\Windows\System\aoKnGPY.exe
  C:\Windows\System\aoKnGPY.exe
  2⤵
  PID:12908
- C:\Windows\System\tMEnFNz.exe
  C:\Windows\System\tMEnFNz.exe
  2⤵
  PID:7616
- C:\Windows\System\JWOKezI.exe
  C:\Windows\System\JWOKezI.exe
  2⤵
  PID:1696
- C:\Windows\System\yDWAVRf.exe
  C:\Windows\System\yDWAVRf.exe
  2⤵
  PID:11932
- C:\Windows\System\BihAMNO.exe
  C:\Windows\System\BihAMNO.exe
  2⤵
  PID:13336
- C:\Windows\System\LfvMmul.exe
  C:\Windows\System\LfvMmul.exe
  2⤵
  PID:13540
- C:\Windows\System\VtfmFCm.exe
  C:\Windows\System\VtfmFCm.exe
  2⤵
  PID:13764
- C:\Windows\System\CNowlnx.exe
  C:\Windows\System\CNowlnx.exe
  2⤵
  PID:9352
- C:\Windows\System\VuMzeYZ.exe
  C:\Windows\System\VuMzeYZ.exe
  2⤵
  PID:10944
- C:\Windows\System\yifIzIU.exe
  C:\Windows\System\yifIzIU.exe
  2⤵
  PID:13404
- C:\Windows\System\MWefKVF.exe
  C:\Windows\System\MWefKVF.exe
  2⤵
  PID:9916
- C:\Windows\System\BzAScAg.exe
  C:\Windows\System\BzAScAg.exe
  2⤵
  PID:12060
- C:\Windows\System\hyUfpfI.exe
  C:\Windows\System\hyUfpfI.exe
  2⤵
  PID:13420
- C:\Windows\System\EMzxRof.exe
  C:\Windows\System\EMzxRof.exe
  2⤵
  PID:13348
- C:\Windows\System\JuNNRJt.exe
  C:\Windows\System\JuNNRJt.exe
  2⤵
  PID:11852
- C:\Windows\System\bNvNTpx.exe
  C:\Windows\System\bNvNTpx.exe
  2⤵
  PID:10048
- C:\Windows\System\RaDuyyo.exe
  C:\Windows\System\RaDuyyo.exe
  2⤵
  PID:548
- C:\Windows\System\RCOMoja.exe
  C:\Windows\System\RCOMoja.exe
  2⤵
  PID:5452
- C:\Windows\System\uHjVEYw.exe
  C:\Windows\System\uHjVEYw.exe
  2⤵
  PID:13132
- C:\Windows\System\zNCVujh.exe
  C:\Windows\System\zNCVujh.exe
  2⤵
  PID:14264
- C:\Windows\System\SbjMPpd.exe
  C:\Windows\System\SbjMPpd.exe
  2⤵
  PID:11900
- C:\Windows\System\LfvCewG.exe
  C:\Windows\System\LfvCewG.exe
  2⤵
  PID:10848
- C:\Windows\System\bRSkySH.exe
  C:\Windows\System\bRSkySH.exe
  2⤵
  PID:7648
- C:\Windows\System\hwyRCJP.exe
  C:\Windows\System\hwyRCJP.exe
  2⤵
  PID:14188
- C:\Windows\System\CkXwzjh.exe
  C:\Windows\System\CkXwzjh.exe
  2⤵
  PID:11548
- C:\Windows\System\GZYPAdf.exe
  C:\Windows\System\GZYPAdf.exe
  2⤵
  PID:13344
- C:\Windows\System\sxaSkYq.exe
  C:\Windows\System\sxaSkYq.exe
  2⤵
  PID:14160
- C:\Windows\System\qGtalKS.exe
  C:\Windows\System\qGtalKS.exe
  2⤵
  PID:7460
- C:\Windows\System\REocgFa.exe
  C:\Windows\System\REocgFa.exe
  2⤵
  PID:11200
- C:\Windows\System\EvBiaHi.exe
  C:\Windows\System\EvBiaHi.exe
  2⤵
  PID:4996
- C:\Windows\System\MHhswwG.exe
  C:\Windows\System\MHhswwG.exe
  2⤵
  PID:13648
- C:\Windows\System\RebVntU.exe
  C:\Windows\System\RebVntU.exe
  2⤵
  PID:8744
- C:\Windows\System\mADUJZD.exe
  C:\Windows\System\mADUJZD.exe
  2⤵
  PID:14008
- C:\Windows\System\lDGOnAP.exe
  C:\Windows\System\lDGOnAP.exe
  2⤵
  PID:13048
- C:\Windows\System\UpUpvPG.exe
  C:\Windows\System\UpUpvPG.exe
  2⤵
  PID:14096
- C:\Windows\System\mLbjLvq.exe
  C:\Windows\System\mLbjLvq.exe
  2⤵
  PID:11412
- C:\Windows\System\DcTTqeF.exe
  C:\Windows\System\DcTTqeF.exe
  2⤵
  PID:13948
- C:\Windows\System\wkvtLcD.exe
  C:\Windows\System\wkvtLcD.exe
  2⤵
  PID:13736
- C:\Windows\System\OBScykU.exe
  C:\Windows\System\OBScykU.exe
  2⤵
  PID:7536
- C:\Windows\System\iRflDAh.exe
  C:\Windows\System\iRflDAh.exe
  2⤵
  PID:13836
- C:\Windows\System\rbbXaWw.exe
  C:\Windows\System\rbbXaWw.exe
  2⤵
  PID:13708
- C:\Windows\System\RDOdRhC.exe
  C:\Windows\System\RDOdRhC.exe
  2⤵
  PID:14200
- C:\Windows\System\BfjEivF.exe
  C:\Windows\System\BfjEivF.exe
  2⤵
  PID:13932
- C:\Windows\System\wwgMNLI.exe
  C:\Windows\System\wwgMNLI.exe
  2⤵
  PID:13468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aowmmkwz.aiz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ATPklfW.exe

Filesize
2.2MB

MD5
ce90d640287505d79eff8d8f0c75da81

SHA1
c9b7478d12a6b09ae9c639409fc9c446f151cac6

SHA256
e08f455e956c53f6f618618366d28802ff7ce73e8288744187814a6c192a5ebf

SHA512
350835020e891a5a7305bd5a850b831f88fa7716442f21f30b4778ab5e30f1a519bc9895f9336328d8a5d2b48c6472393d0765a5727a4b298d732acb22a98b87

Download Submit
C:\Windows\System\AXItPKw.exe

Filesize
2.2MB

MD5
2b1816ec9eafde80779576d7a55bea2d

SHA1
1728b0f238202c5066760b96435fb4f0aa363cce

SHA256
f3933021f64482643c632dabc390c209c24ae1401c3ef0c72efc48de1a5332fe

SHA512
7666b1b15501d3cd21f81c081c1ba01a918aed5cd718b46efe7f8715d0f35600d855a981b0c679716e18abd4456fe6bbcf2e0b3f1bf044dffb92c324880bc7c7

Download Submit
C:\Windows\System\BKMBebB.exe

Filesize
2.2MB

MD5
6f35e4be8ac38a7d7ea680c2a15605bb

SHA1
14e2ada7ad7716b928addefb6b04c08291265120

SHA256
dcaa21186f3c30d882695cc90d83f7a91ee018582dc5ca21499347b3489395c8

SHA512
d408ffe41aad42756b9a0dc0859be40a12aebeaf9c948ca1fc1f1f1fa22025de2806530efb2f02ec91211e255679f596e3d7d560dc838f60dddb7ebaa0720fd1

Download Submit
C:\Windows\System\CCzknye.exe

Filesize
2.2MB

MD5
cd77dfefdd5d54c9967404e48b5cd09a

SHA1
d8405bd9366f2ac2262f8249e3eb5a498da131f3

SHA256
fec0f20a710188917ac4eb515e68401141e25da70787480a3937ef97c4643f79

SHA512
403cb29bba55a0155e9dada17edbdf3afb4d74aa416ca07500dbe9258315d6c365db002af1055a1bcce75ee9ba5b5a5aa198e85d43303fbb6461431553feca44

Download Submit
C:\Windows\System\CJzMnVI.exe

Filesize
2.2MB

MD5
d552e8b4da0a1b1150e667e25ecb8526

SHA1
2dbe76f6cc4a4337da5ca2c4d56ea9fe1c2b6e69

SHA256
c0dc9e85cbaaad9585a55faf355ee6a10102dcb8dee332fe8590f110ebf08314

SHA512
ad4e10af16e8e4af54d38db969d8c95c3cd4fe15235273b01396cdcd46ddac15764c34d667307c0c4c2e04525f085af245d56b992b9afa107c411ab79bf35ebd

Download Submit
C:\Windows\System\CnHdGjQ.exe

Filesize
2.2MB

MD5
636ac7a1f54d80b65a43d66c1b372d30

SHA1
33d49c68d056fa0a48f69dcb210ce79fb269a54e

SHA256
1d7aea398f89641f81b65301bc28f0dd33f2c039e7c08a7a0e7aa9783e6a5fc1

SHA512
5ac5c3d1f453fe02a64330f8af9bbb33b2cd40c5e5df996fde869ad6e87f25fee373dc02a07228432c2075f8b4a54655066912e3d8e6e13f82c2a02ff1db5977

Download Submit
C:\Windows\System\CsQHRLn.exe

Filesize
2.2MB

MD5
67150c3aca72ae266e5632466d68f93c

SHA1
d67aeccb5bba9a80921a8df2f4d74e5ea114d829

SHA256
ed4b55409846136e2f8ee672a4fbc783626f2c732e14efdc691ccc028f96c757

SHA512
3b112605b32116055ccdf29165d7c1f88bc567679b87030cad756f9b6ad0e88afed0fb5e1edf76ceefd73707f2b6767c2e8ebdae8ff9cf36449f2cdd329c1233

Download Submit
C:\Windows\System\DhBuMXh.exe

Filesize
2.2MB

MD5
e55cb2e66321229e030d52b91627391d

SHA1
69f542b78164f793d41a8f6740a5014a77b10624

SHA256
4694ca85637344bfda0572f1628bdfaeb9229fb4fa22bab1d9d489553f3553e1

SHA512
9dc84e09b6247ab9b38e7094cf01bf703a970a3e8dc73799d267526b613bd50a2e92625e89e2cda35d6c5ef4bd1520f07a794cd70a4cd388d9491bcf1db55dcd

Download Submit
C:\Windows\System\EqROUef.exe

Filesize
2.2MB

MD5
18f5ff504b17affc7a343abcfbf1d62a

SHA1
7885bb3ff4a1fc559a8ba2228d0405bfe4a69fe6

SHA256
a831932ec35b2af190a3bc839bd1a44095ed3595727098e4c536c82d93849164

SHA512
8a611d6bfe26fa77fbf04c7259150f20f7e8db8cc27d6e03c56b94764a316c5d4682a733b942b87f5cbcd88d8cb6aee92e634f83552105b65189818a2aad71e5

Download Submit
C:\Windows\System\HThEAIP.exe

Filesize
2.2MB

MD5
0bee048d16a8fd1700ffa0cd7d4510e8

SHA1
64155c982d89c849b2ebe0d1a4208b081001758f

SHA256
0bb09bc8877d4900eb1ea6ec2b3a18ba20d86c11e92ece9adef29440eafa3026

SHA512
9c73aee5fdcca9fd177619d5dc7f131b02c2d8a8ac5bef6850d2f7379df64cdda82b44758e351a07966d070a9aabc731c0379f73282fa4fd58963cbecc3ba478

Download Submit
C:\Windows\System\MgQyTAh.exe

Filesize
2.2MB

MD5
cd13675f2d59b29cefd87948285a8693

SHA1
ab7fe3423ad43eafa2009249d5395b8ef0460341

SHA256
f3c60b5d6aa6be772a1cc71ea717add63149c88389b70e0eaf28790b8d965119

SHA512
72f62abde8bf1ec81107bc8290b6ea2f162aed1a88913ad197c20f822cc9b3b8722fa68c5022d8693f0c47459c45e73acb26f2000d454c75f07eabf41f5e5903

Download Submit
C:\Windows\System\NnwFduL.exe

Filesize
2.2MB

MD5
a6d3748dbbfd98e1ca8528a71ae2f92b

SHA1
2ef5c0b7f530320b743362f2596fc594cfad1940

SHA256
06a4196afd5782b56d24d93764088ae1056ce88ecd2aac1fabc64906289cbd59

SHA512
93a1b1bf248de88e11cb419f71b4169a4e80a70493e884c98dd084564bdb64a73a60a2770aef24ac2efe8ffede634937497c32c94daa2142bb60deedb63e1433

Download Submit
C:\Windows\System\OoItIfB.exe

Filesize
2.2MB

MD5
57c067276a2f7c51876f3a2d983d759c

SHA1
6b0fdcd51c1ebe9c9040e6ffbf16a883ec3828ae

SHA256
9458ee7065c71b428d81fbe6b73d5c110ee6e327dd68389bb8a1a11e7f961dc4

SHA512
e400790f399a359096483e50fed8418a1586b758c6335d223661729f812e58f41e3b6ab2dc7a058da367b2d3bf23fc95b9f1f3737211de2a76e223a674888ccc

Download Submit
C:\Windows\System\RejUFby.exe

Filesize
2.2MB

MD5
64f63ac38437a0677b34e68823e12583

SHA1
8674a67efd580697c33ec35620e21408472fbfe0

SHA256
b7b4d57ec03ec3ee8cf0da47c955c3f13411babf5de00a0127cd740baa3326f9

SHA512
f8bc2857fb47127cc19beeb632254985cd09720a8682d6cb54037d70ba6c207128066e32d69e5e3cc4746742f693bc17da9b1763d6fb06d1f0a22a32ef891440

Download Submit
C:\Windows\System\SkCWyvD.exe

Filesize
2.2MB

MD5
c1d2d51190ad764abb7ea31998f1e46a

SHA1
a7f1efbdf0142c8679895b0d149caa78727c8e6a

SHA256
798b6b2d5cd21601c799857f495afaf1e7cc919d12d9502fd93cad9f5ccb3d65

SHA512
037392c735a4a374b983004510c7b56fb9022df92a62519975ed676a4d9feb83536652085e5fe41c56d0922a7e3f79f18114942b1bbe16e288c98493d1216f0b

Download Submit
C:\Windows\System\TAEIemL.exe

Filesize
2.2MB

MD5
102b3a5c19ce9ffc0de5afbefac66300

SHA1
b628c349ef5226026b9e239efebd2b16ef1ce84f

SHA256
17a86e5b0ed97de8d966ca68235cabb4bca75bb43aba99ccb05710a6c4f22365

SHA512
8b54802d14a5dfc709b339d6a2201257a7bd0773c9d7419ee9d6e0c47e50b6f94a42df3ce201f9a8dfd74451475d3aad63884e32389138341d7e5cdb4088a347

Download Submit
C:\Windows\System\VQgkrlr.exe

Filesize
2.2MB

MD5
27302786fd63ce2fc45deec04781423a

SHA1
5c2ecdbbbc2b7c2822878e8b4f2412874c155579

SHA256
bc88d3ef473ba903dae043bda59e1e8eb88545f67a8b3cf8a1542377d3c452bf

SHA512
e7253a37e15f479b9f9c39a3e82fc849c1b7d701f72c50752a90353f959e67fc94503c95ef171bc5f4ec64c4160812b7218305bc040475661cc139ed122d1647

Download Submit
C:\Windows\System\WkKSjZi.exe

Filesize
2.2MB

MD5
d9f7127282a41792b57d11ed11bcc9f2

SHA1
cf84f28f07310b61ac77cfadcd64ad4fe02bf89a

SHA256
046907ffa95152f3d5671d909a8e7a422c6fa8f92beb9d149836d38b49dfeb3f

SHA512
9aeec0de01ca9b399fae7e0f76cf90065cd3f06e7caab7446b012a5458943b76150d420ecd713220d7238411dded8bc22b2dafd3550f886999588d0267a1f1d5

Download Submit
C:\Windows\System\ZboJCXZ.exe

Filesize
2.2MB

MD5
d091a48bec5ea5dcb199d6466c1d07fd

SHA1
24e770c80cd476c2ff653af6dd19f1c7ed0dda56

SHA256
91307cfe192d889a4eaaa31c7d189f03e8ded08a9678827c207388c715c928d9

SHA512
a284c2dcc2350ea4954287c414b09b6d95cefb9389c7fadf433f18760a8af1ee0c151ecdbc2f07d3190ad1d6f58dddfce9584636e109d5bd4e06fed0ed0d4f29

Download Submit
C:\Windows\System\cZHMNOp.exe

Filesize
2.2MB

MD5
f2d022157bb37e71b7a8c0d58d10f180

SHA1
e8dfd7c6ec2b3c7274cb18c9c48b551d8aad95ed

SHA256
a495f4ec15bff092a6fce6887a19dbe31a06c14f0353dc723e0e8eb29fc41956

SHA512
dedb06725466703c57876e680e72f9e4acc5b3948862a944284b27a72b95708d1c8c39e03277229a775a52d1788f9d56f63698e4a54859ac3685f2193aada8f7

Download Submit
C:\Windows\System\gUJPxsS.exe

Filesize
2.2MB

MD5
719fc56c46e91b82cb6ab6769431779c

SHA1
cdcb522144997980077173343f33f77626595264

SHA256
cf98c88574561bf1565dfa01838b58897640f5bf6931380a12737baf40d58449

SHA512
1bf684bef8ef5bf588917efd6ec01594628e587a56c7e6803bb62595dd081d64b5da6cb81cadc48d66a813c2f3123f34afe9061158a5a80290b6c23a663118a1

Download Submit
C:\Windows\System\hbSxGWI.exe

Filesize
2.2MB

MD5
c5dba9962944de180e124de64a137d8e

SHA1
005eb8da443fd65bcd816080d8532e37ad69cd83

SHA256
14cde44438db1f698ab551ed2fd30b70609a44b7259f0eb805bd94bf2c06f015

SHA512
914790105566fb3481ceb096ec34cbe787c612ecbc826fee910407f4a2f9706cb4906d2defc40531dbe7cd0aa16e082d8e6088062ac1ac441837213ed76265f8

Download Submit
C:\Windows\System\hoCBcXC.exe

Filesize
2.2MB

MD5
7dddeab40f9d5241ad4c151d7e70ae71

SHA1
e9ed7baaf70c0f0f5565a4eaeed19c4ca491853a

SHA256
9def9e035029926dd3091c17c1b9770c1e9de3b5e7ace1536327d3d191196e67

SHA512
23929f38162d8cd69b8c9251ec6afd75b5bcebd8cd33efbd82ec2cadb08990933c44dc408ba8f92cd15defab7f031942906acb9650e874a087fd1f0812a929ab

Download Submit
C:\Windows\System\ivGTmEH.exe

Filesize
2.2MB

MD5
8316ee5196f040b63a5a06a456780e6c

SHA1
500ab3d3baaedd0d613529b4bf61d6e616764fbb

SHA256
78c06fff7875d72073df073f66bf737ee3a168a559794fcd0efe0aa2637d1ab8

SHA512
a6344902381a0279d553d17bc6d323b9d8e1aebd99290ef76df298f22c0142e18d5057fb449593dc56ba44153c61d2cdc0bff439087a32e5299d6c4d4fbf8307

Download Submit
C:\Windows\System\jvyyyyE.exe

Filesize
2.2MB

MD5
7429bd40b6f1d40e1002f3051fc3bc1a

SHA1
0bd641e394db2e0f3fb166d9370a97bd34b04c86

SHA256
9350faec7d334d16ae60576d9e124a16afb13bfbe78aa1668951d92ae4256bfc

SHA512
5cbca3f6c25a529d1d3e4559633e976493a5595ade97d40c2a8949a036534e2618ba69cbd02cbba2f345ed915b2fbc5b9c448a109573c7f1fd1d821ac3935b73

Download Submit
C:\Windows\System\kDZZnwH.exe

Filesize
2.2MB

MD5
c90be77e0642a0b11a5d30f08c02aa73

SHA1
e73199455600f0a6e5301ec92a5ee3f6db8417ca

SHA256
f91d8bde15eb93fbfdd5411f3d7594200f0eca54f7a5e4a0978b19307b1b2cfd

SHA512
448230b685dc251710a009108176d8119f428acfff35a628e17da6a798cd1a61cfb6507ff00bf65aac030b503b9812719917713677d4da4fb20ceb6ec015e9dd

Download Submit
C:\Windows\System\kcfyrBx.exe

Filesize
2.2MB

MD5
dcfbc6c7a88dc57288103e4727169034

SHA1
88768b163268cc4155c1e364b300f69ccab2ac05

SHA256
0f8ab4d404a23579f494eed043db0bec18a0a1b39b01afe92b5895b787232a88

SHA512
80ec27bc8402b9ce522a1fa5dfd25901e2865ad10e8197e20328fa90347b81e618f8e8b353400c11edc8058b9f4238b902c3676b4f2a13137cc6cdb993f76e83

Download Submit
C:\Windows\System\ksRACku.exe

Filesize
2.2MB

MD5
93811becc6bc47f62e9312ab2f7da463

SHA1
a21a8992c8edb003825d90690733fdc416136f8b

SHA256
65ce86294be6f1d0d0250d6710fe0a3cc229c9a66d3374b82258f4a529afad27

SHA512
60a88dcb686d15679278548571e5541bdba7f9a3e9f55644f99351058809e8b9cff0dd5b179a5cb4252844ebae153dfccba482c6f5a4983585ee8c4402f229da

Download Submit
C:\Windows\System\mFKfaJh.exe

Filesize
2.2MB

MD5
0e95909ced9f21fb4c21b3b0776c68fc

SHA1
814530bec54e39827035aa204f51a496a48e8545

SHA256
cfa800d309f5cfdb2b842eba5ef72fd80accfe79f25bd0a0ec08b9f16a8212c3

SHA512
99922ef5492dc96d0b4d37d0ae838eddb49e5f114f06522667f45ca91292dee1f5bd15025b9bddb847160782dd410f99bd99f3ffc06f4cfc8d78336408e56b46

Download Submit
C:\Windows\System\novzJys.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\nqRXkal.exe

Filesize
2.2MB

MD5
b6e8eb2caf2252ff9eb2a892e762b719

SHA1
7d29653c70e1a75b9e109cda77cd16b7835d0246

SHA256
b7a87574fad80a037e05c00d1a959ff3c7460a53a81ca6af41756b1d4198498d

SHA512
baf318ca5083daa8230cfc2f42e38b904007864821444459319939be3211d710f9a860796ae597fedbb706e911bf0880ac44838955f246072cff2cd9ff471f73

Download Submit
C:\Windows\System\oSBppdI.exe

Filesize
2.2MB

MD5
b0a947889dfc2ef0b697be257bb2f0ee

SHA1
6705740bdcc870ecd2b9fbb296ce365795fcc25a

SHA256
b956dedcfb105eb60f3417fe4d53a77a99d28880a8d00a6fe96b5559a0259445

SHA512
417b194be6fb3e87eb184f511423a52d9c9d947841e1e075873e188e175fcb60f9705fc7dd4602065549329702bcd9dca60360edcb1a274bc1d0d9fde65889eb

Download Submit
C:\Windows\System\pdCsLMS.exe

Filesize
2.2MB

MD5
b27090a72649ba3f812910b16bac0390

SHA1
20f809e39a52d01b80747f572acbf9f27164857c

SHA256
f904be31b25e32fe975a3a420ffc5fef2906116f537c71831549f27df772b52c

SHA512
d2af4b3ef8bb40d1cdc035ead08b01fa776d0e7456b39e9ef93b84fca67ae24faf4c0cb5b4d19e504fe7dfb4dfe1a5bf2059068b08db34b03c767d6298980daa

Download Submit
C:\Windows\System\rThiJWv.exe

Filesize
2.2MB

MD5
ad30cc87a44b3ec367238e155762d994

SHA1
6aceb2f85116d6bd252bcafaa349564e470e8563

SHA256
129acbf122ab41e1d19588b3f921252dc36f8fface19fc2b7209bcd1c1e04646

SHA512
71acbec3b5a6027a4831e52193f001bb4cbbaab49b824b796c0f93d3f9910e43f92878711afbdbc30efe036f99becdee297c8c18c5b6def88b0b384462389780

Download Submit
C:\Windows\System\sfrZdNz.exe

Filesize
2.2MB

MD5
b5c319c12fdf22dc6ee04db05dd66d5a

SHA1
f822b464cfad3011c1352a66a04b4303a7755b81

SHA256
8aa03aaa27245483bd8fa12272a7b42c7aefe6f6e2151d2f86b571ab9b79013f

SHA512
1c35f9dbe88f705a6d7255749292892bd3979ae1cb150d5223ed6c69e18532166c69a25fd246257beb6487406873c0e7885b8ec7d97058d0d63a88b253e1a5b9

Download Submit
C:\Windows\System\uGtvzxA.exe

Filesize
2.2MB

MD5
682fc2b5f7502baf8ca01acbc2af1af5

SHA1
9d5b7ab04af88bfd42a0b018f19f3447c40d0657

SHA256
de1124d794a8b7545aa5f39d0038e8c3b8b1ef21581034b65dacd4003fd9c825

SHA512
3810165b08d51bcec8783935fe49be895fa716b1488d7d9997115c91e001a1624cfdc91ef0f3241667a798062be8b9202b084805b695cad70e51693f7538082b

Download Submit
C:\Windows\System\umtnQeb.exe

Filesize
2.2MB

MD5
deda4614e5053a567b49ba76fda8384d

SHA1
bce7ab92dc31504d161c05f8f5b5c6313d0f9e93

SHA256
2051cdb36c125cd9d138ffcb804031a4388adc190c8e6d73b062106e93db91fa

SHA512
767a64b065802d94afb8eba95338498965adfe63c143d0c8843ec2c4f20e04d7f5b395d5f49b2f65469c41213be18dcd0494906a05bd6cd8416dda85f921a839

Download Submit
C:\Windows\System\uvyCLbx.exe

Filesize
2.2MB

MD5
7f6f426ab31357c129a84f3d9a80008f

SHA1
cb4646a6f0db4c913e9d497ce097cf9e21bc10ff

SHA256
6bc74720cb4e77552923ffdcf5a4e8f490d613226777e704a45896cc29c989e3

SHA512
862b743cc04e424e69c7a5022d97b4fcf2438145f6002becb9b00acb0bf5a719f6fe33fc69f469f4023f370571710b5e78cffcb24cee9f948632ffcc10046241

Download Submit
C:\Windows\System\wYyDDuh.exe

Filesize
2.2MB

MD5
b94ce30c36ddbfbc62c5417c89812ac3

SHA1
4f5d173559f43052e869ec4eca4a960b3e4c599a

SHA256
3c27894a2c1c7e1b968f9a11c5c4ac0fdcbc4f531e270f08591caf16fdadd456

SHA512
1003ae839888789cfd757999c69b84e8408eb20c7a9762ef2cf3b3fef04082227453a5acf70b4b8ebf8fbc12dc42cc24008052f57a972a72f659d746f417491e

Download Submit
C:\Windows\System\xszVUbQ.exe

Filesize
2.2MB

MD5
d1f737469c0ba9aee23ccf1557bad123

SHA1
ab264a9534691f6519e0c5fb2304b85de3f39b3a

SHA256
fda3f9be32a1ceed555cdb5c1e1c871f44266b373d786c43a6bbb1b7337e9d07

SHA512
2c935e886a2cb85bcdd57a99dd18e3ebe6cdc2026b8837dfcb2abd9902a72dabc91d936764bf354e0822d097c7c0c401171485b331a8aa86889abd269dd15605

Download Submit
C:\Windows\System\zuuGByh.exe

Filesize
2.2MB

MD5
6385a9c21f852b7c7b80fbb4ee0a20cc

SHA1
766ee0ec27cb2c42b8e5adf6c039eb7a2775b646

SHA256
33e69130aa10abe19f38b2efe46fe2d20ba40c72e7388ca623004300d65bb76b

SHA512
82500a62c5b222360885814d0912b6cfd59151cd4bcf5c91730e42b6025c03c4904eb5cb78b8432f249e743d50eee522644fa86f3710a46b95740dff8d694dd3

Download Submit
memory/396-3030-0x00007FF729D00000-0x00007FF72A0F2000-memory.dmp

Filesize
3.9MB

Download
memory/396-402-0x00007FF729D00000-0x00007FF72A0F2000-memory.dmp

Filesize
3.9MB

Download
memory/860-3022-0x00007FF747680000-0x00007FF747A72000-memory.dmp

Filesize
3.9MB

Download
memory/860-203-0x00007FF747680000-0x00007FF747A72000-memory.dmp

Filesize
3.9MB

Download
memory/1164-3064-0x00007FF74E4F0000-0x00007FF74E8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1164-1423-0x00007FF74E4F0000-0x00007FF74E8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1488-80-0x00007FF62C9F0000-0x00007FF62CDE2000-memory.dmp

Filesize
3.9MB

Download
memory/1488-3011-0x00007FF62C9F0000-0x00007FF62CDE2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-1422-0x00007FF7734C0000-0x00007FF7738B2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-3042-0x00007FF7734C0000-0x00007FF7738B2000-memory.dmp

Filesize
3.9MB

Download
memory/1968-3052-0x00007FF664300000-0x00007FF6646F2000-memory.dmp

Filesize
3.9MB

Download
memory/1968-1033-0x00007FF664300000-0x00007FF6646F2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-3017-0x00007FF6FDEC0000-0x00007FF6FE2B2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-292-0x00007FF6FDEC0000-0x00007FF6FE2B2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-3061-0x00007FF61C010000-0x00007FF61C402000-memory.dmp

Filesize
3.9MB

Download
memory/2636-1212-0x00007FF61C010000-0x00007FF61C402000-memory.dmp

Filesize
3.9MB

Download
memory/2692-3016-0x00007FF7CC280000-0x00007FF7CC672000-memory.dmp

Filesize
3.9MB

Download
memory/2692-239-0x00007FF7CC280000-0x00007FF7CC672000-memory.dmp

Filesize
3.9MB

Download
memory/2852-8-0x00007FF7D2660000-0x00007FF7D2A52000-memory.dmp

Filesize
3.9MB

Download
memory/2852-3007-0x00007FF7D2660000-0x00007FF7D2A52000-memory.dmp

Filesize
3.9MB

Download
memory/3236-3056-0x00007FF69F700000-0x00007FF69FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3236-1215-0x00007FF69F700000-0x00007FF69FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3568-1491-0x00007FF6D6C40000-0x00007FF6D7032000-memory.dmp

Filesize
3.9MB

Download
memory/3568-3010-0x00007FF6D6C40000-0x00007FF6D7032000-memory.dmp

Filesize
3.9MB

Download
memory/3852-3025-0x00007FF675C60000-0x00007FF676052000-memory.dmp

Filesize
3.9MB

Download
memory/3852-1493-0x00007FF675C60000-0x00007FF676052000-memory.dmp

Filesize
3.9MB

Download
memory/4092-1218-0x00007FF6192D0000-0x00007FF6196C2000-memory.dmp

Filesize
3.9MB

Download
memory/4092-3075-0x00007FF6192D0000-0x00007FF6196C2000-memory.dmp

Filesize
3.9MB

Download
memory/4168-1030-0x00007FF6419A0000-0x00007FF641D92000-memory.dmp

Filesize
3.9MB

Download
memory/4168-3031-0x00007FF6419A0000-0x00007FF641D92000-memory.dmp

Filesize
3.9MB

Download
memory/4344-1-0x00000214E98A0000-0x00000214E98B0000-memory.dmp

Filesize
64KB

Download
memory/4344-0-0x00007FF7CD470000-0x00007FF7CD862000-memory.dmp

Filesize
3.9MB

Download
memory/4400-3024-0x00007FF7036A0000-0x00007FF703A92000-memory.dmp

Filesize
3.9MB

Download
memory/4400-162-0x00007FF7036A0000-0x00007FF703A92000-memory.dmp

Filesize
3.9MB

Download
memory/4452-1420-0x00007FF65FFE0000-0x00007FF6603D2000-memory.dmp

Filesize
3.9MB

Download
memory/4452-3054-0x00007FF65FFE0000-0x00007FF6603D2000-memory.dmp

Filesize
3.9MB

Download
memory/4540-912-0x00007FF7798B0000-0x00007FF779CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4540-3073-0x00007FF7798B0000-0x00007FF779CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4672-3072-0x00007FF6FD100000-0x00007FF6FD4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4672-445-0x00007FF6FD100000-0x00007FF6FD4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4808-57-0x00007FFD04870000-0x00007FFD05331000-memory.dmp

Filesize
10.8MB

Download
memory/4808-219-0x00000225723B0000-0x00000225723D2000-memory.dmp

Filesize
136KB

Download
memory/4808-9-0x00007FFD04873000-0x00007FFD04875000-memory.dmp

Filesize
8KB

Download
memory/4960-283-0x00007FF775310000-0x00007FF775702000-memory.dmp

Filesize
3.9MB

Download
memory/4960-3015-0x00007FF775310000-0x00007FF775702000-memory.dmp

Filesize
3.9MB

Download
memory/5036-3028-0x00007FF6EF4F0000-0x00007FF6EF8E2000-memory.dmp

Filesize
3.9MB

Download
memory/5036-335-0x00007FF6EF4F0000-0x00007FF6EF8E2000-memory.dmp

Filesize
3.9MB

Download
memory/5060-3020-0x00007FF79A9E0000-0x00007FF79ADD2000-memory.dmp

Filesize
3.9MB

Download
memory/5060-406-0x00007FF79A9E0000-0x00007FF79ADD2000-memory.dmp

Filesize
3.9MB

Download