xmrig | 69abddb237e60d90bcf87e781d2dfae62ff89233e1bcc944825f447a7caf4859

Analysis

max time kernel
150s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
Size

2.8MB
MD5

05e7ee1b4fe6a2ad2b92de71c552ad19
SHA1

32a3a6bc7eed9d11650e964156a8b1e6d17c6339
SHA256

69abddb237e60d90bcf87e781d2dfae62ff89233e1bcc944825f447a7caf4859
SHA512

cceac9bc7082849ab643d55c190c4e9e30e20b0e75fbcd6faa72304138d14a8c305454d9758856f823e738c9f4f0baad7e87ba990471a076b9ce28c9b8cc7111
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5I/e:NABJ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/2416-119-0x00007FF784E40000-0x00007FF785232000-memory.dmp	xmrig
behavioral2/memory/2888-228-0x00007FF6C3AC0000-0x00007FF6C3EB2000-memory.dmp	xmrig
behavioral2/memory/4396-281-0x00007FF60B590000-0x00007FF60B982000-memory.dmp	xmrig
behavioral2/memory/2932-323-0x00007FF64E270000-0x00007FF64E662000-memory.dmp	xmrig
behavioral2/memory/1328-330-0x00007FF781930000-0x00007FF781D22000-memory.dmp	xmrig
behavioral2/memory/1688-329-0x00007FF743250000-0x00007FF743642000-memory.dmp	xmrig
behavioral2/memory/3140-328-0x00007FF7283B0000-0x00007FF7287A2000-memory.dmp	xmrig
behavioral2/memory/3816-327-0x00007FF7BF490000-0x00007FF7BF882000-memory.dmp	xmrig
behavioral2/memory/3780-326-0x00007FF79DBE0000-0x00007FF79DFD2000-memory.dmp	xmrig
behavioral2/memory/2012-325-0x00007FF772A30000-0x00007FF772E22000-memory.dmp	xmrig
behavioral2/memory/3512-312-0x00007FF7E7030000-0x00007FF7E7422000-memory.dmp	xmrig
behavioral2/memory/4864-278-0x00007FF604300000-0x00007FF6046F2000-memory.dmp	xmrig
behavioral2/memory/3696-262-0x00007FF628960000-0x00007FF628D52000-memory.dmp	xmrig
behavioral2/memory/1368-253-0x00007FF642030000-0x00007FF642422000-memory.dmp	xmrig
behavioral2/memory/1656-213-0x00007FF79E720000-0x00007FF79EB12000-memory.dmp	xmrig
behavioral2/memory/512-182-0x00007FF79B590000-0x00007FF79B982000-memory.dmp	xmrig
behavioral2/memory/4016-157-0x00007FF790AC0000-0x00007FF790EB2000-memory.dmp	xmrig
behavioral2/memory/924-113-0x00007FF71D1A0000-0x00007FF71D592000-memory.dmp	xmrig
behavioral2/memory/712-102-0x00007FF675720000-0x00007FF675B12000-memory.dmp	xmrig
behavioral2/memory/5092-91-0x00007FF789C70000-0x00007FF78A062000-memory.dmp	xmrig
behavioral2/memory/2576-80-0x00007FF62A990000-0x00007FF62AD82000-memory.dmp	xmrig
behavioral2/memory/712-3774-0x00007FF675720000-0x00007FF675B12000-memory.dmp	xmrig
behavioral2/memory/1656-3791-0x00007FF79E720000-0x00007FF79EB12000-memory.dmp	xmrig
behavioral2/memory/4864-3873-0x00007FF604300000-0x00007FF6046F2000-memory.dmp	xmrig
behavioral2/memory/1688-3866-0x00007FF743250000-0x00007FF743642000-memory.dmp	xmrig
behavioral2/memory/3512-3859-0x00007FF7E7030000-0x00007FF7E7422000-memory.dmp	xmrig
behavioral2/memory/2932-3848-0x00007FF64E270000-0x00007FF64E662000-memory.dmp	xmrig
behavioral2/memory/3140-3840-0x00007FF7283B0000-0x00007FF7287A2000-memory.dmp	xmrig
behavioral2/memory/4396-3836-0x00007FF60B590000-0x00007FF60B982000-memory.dmp	xmrig
behavioral2/memory/1368-3832-0x00007FF642030000-0x00007FF642422000-memory.dmp	xmrig
behavioral2/memory/512-3822-0x00007FF79B590000-0x00007FF79B982000-memory.dmp	xmrig
behavioral2/memory/2416-3806-0x00007FF784E40000-0x00007FF785232000-memory.dmp	xmrig
behavioral2/memory/2012-3934-0x00007FF772A30000-0x00007FF772E22000-memory.dmp	xmrig
behavioral2/memory/3780-3896-0x00007FF79DBE0000-0x00007FF79DFD2000-memory.dmp	xmrig
behavioral2/memory/2888-3802-0x00007FF6C3AC0000-0x00007FF6C3EB2000-memory.dmp	xmrig
behavioral2/memory/3696-3795-0x00007FF628960000-0x00007FF628D52000-memory.dmp	xmrig
behavioral2/memory/924-3783-0x00007FF71D1A0000-0x00007FF71D592000-memory.dmp	xmrig
behavioral2/memory/4028-4264-0x00007FF74F430000-0x00007FF74F822000-memory.dmp	xmrig
behavioral2/memory/1328-4145-0x00007FF781930000-0x00007FF781D22000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2576	UEzjBJY.exe
5092	pHAbdkJ.exe
712	RmSprdO.exe
924	LTjMTzp.exe
2416	VBLtdTb.exe
4016	JqICwCr.exe
512	tLOwiMI.exe
1656	vQvjJYB.exe
2888	JSdFDeR.exe
1368	BUVQpkX.exe
3696	KsTUjWY.exe
3816	UNDcdAr.exe
4864	kSXGVlb.exe
3140	zyoNHJs.exe
4396	WWZgibF.exe
3512	kFVjEMi.exe
1688	vdXvMDQ.exe
2932	zhcRnkX.exe
1328	VxAvfte.exe
2012	nlqqbRw.exe
3780	aePZYOv.exe
1476	OHtpixC.exe
460	KjHwLBo.exe
2548	gXQdidD.exe
4796	YptfNAl.exe
1572	nIrgLDF.exe
1324	fStBfAI.exe
1240	bMwJctf.exe
1076	LyCeGdL.exe
1396	CaeIApr.exe
1820	XlILnRU.exe
3960	LDQTsvv.exe
2236	ueClpzC.exe
4840	FCMTbPR.exe
2360	UUNiFpm.exe
1444	zXAjioC.exe
4680	YQFXLaQ.exe
2504	pkQybQv.exe
1020	cfGJrWb.exe
1580	yCKLsnB.exe
5020	heinrnW.exe
2164	sYukkmf.exe
4880	AGcVRSw.exe
3452	pmtpgSX.exe
1308	yyfOEKq.exe
428	TJsTsTz.exe
4424	EhSMQXw.exe
3632	NtizrAW.exe
2292	qQdbWoC.exe
4472	zuCNPdb.exe
3648	ZQYYYKl.exe
3504	giMiVSq.exe
3952	ACCZmoA.exe
4504	TgVOYox.exe
1392	wMWDZwm.exe
1436	HvEqNGG.exe
4244	aCXNCJh.exe
3048	mrhilrc.exe
744	pilSIfi.exe
2884	eGVQxXZ.exe
4348	AUFjIsy.exe
400	aCEIlrQ.exe
2108	MfQCftE.exe
1856	gUFVVIp.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4028-0-0x00007FF74F430000-0x00007FF74F822000-memory.dmp	upx
behavioral2/files/0x000c000000023ba8-5.dat	upx
behavioral2/files/0x000a000000023baf-8.dat	upx
behavioral2/files/0x000a000000023bb0-16.dat	upx
behavioral2/files/0x0031000000023bb8-47.dat	upx
behavioral2/files/0x000a000000023bb3-71.dat	upx
behavioral2/files/0x000a000000023bb9-84.dat	upx
behavioral2/files/0x000a000000023bbc-92.dat	upx
behavioral2/files/0x000a000000023bc0-105.dat	upx
behavioral2/memory/2416-119-0x00007FF784E40000-0x00007FF785232000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-170.dat	upx
behavioral2/memory/2888-228-0x00007FF6C3AC0000-0x00007FF6C3EB2000-memory.dmp	upx
behavioral2/memory/4396-281-0x00007FF60B590000-0x00007FF60B982000-memory.dmp	upx
behavioral2/memory/2932-323-0x00007FF64E270000-0x00007FF64E662000-memory.dmp	upx
behavioral2/memory/1328-330-0x00007FF781930000-0x00007FF781D22000-memory.dmp	upx
behavioral2/memory/1688-329-0x00007FF743250000-0x00007FF743642000-memory.dmp	upx
behavioral2/memory/3140-328-0x00007FF7283B0000-0x00007FF7287A2000-memory.dmp	upx
behavioral2/memory/3816-327-0x00007FF7BF490000-0x00007FF7BF882000-memory.dmp	upx
behavioral2/memory/3780-326-0x00007FF79DBE0000-0x00007FF79DFD2000-memory.dmp	upx
behavioral2/memory/2012-325-0x00007FF772A30000-0x00007FF772E22000-memory.dmp	upx
behavioral2/memory/3512-312-0x00007FF7E7030000-0x00007FF7E7422000-memory.dmp	upx
behavioral2/memory/4864-278-0x00007FF604300000-0x00007FF6046F2000-memory.dmp	upx
behavioral2/memory/3696-262-0x00007FF628960000-0x00007FF628D52000-memory.dmp	upx
behavioral2/memory/1368-253-0x00007FF642030000-0x00007FF642422000-memory.dmp	upx
behavioral2/memory/1656-213-0x00007FF79E720000-0x00007FF79EB12000-memory.dmp	upx
behavioral2/files/0x000a000000023bcc-197.dat	upx
behavioral2/files/0x000a000000023bc4-193.dat	upx
behavioral2/files/0x000a000000023bd3-192.dat	upx
behavioral2/files/0x000a000000023bd2-191.dat	upx
behavioral2/files/0x000a000000023bd1-186.dat	upx
behavioral2/files/0x0032000000023bb6-184.dat	upx
behavioral2/files/0x000a000000023bd0-180.dat	upx
behavioral2/files/0x000a000000023bc3-178.dat	upx
behavioral2/files/0x000a000000023bcf-177.dat	upx
behavioral2/files/0x000a000000023bce-176.dat	upx
behavioral2/files/0x000a000000023bcb-166.dat	upx
behavioral2/files/0x000c000000023bac-189.dat	upx
behavioral2/memory/512-182-0x00007FF79B590000-0x00007FF79B982000-memory.dmp	upx
behavioral2/files/0x000a000000023bc9-158.dat	upx
behavioral2/memory/4016-157-0x00007FF790AC0000-0x00007FF790EB2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc8-154.dat	upx
behavioral2/files/0x000a000000023bc1-148.dat	upx
behavioral2/files/0x000a000000023bc7-147.dat	upx
behavioral2/files/0x000a000000023bc6-144.dat	upx
behavioral2/files/0x000a000000023bcd-171.dat	upx
behavioral2/files/0x000a000000023bca-163.dat	upx
behavioral2/files/0x000a000000023bc2-159.dat	upx
behavioral2/files/0x000a000000023bbf-118.dat	upx
behavioral2/memory/924-113-0x00007FF71D1A0000-0x00007FF71D592000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-110.dat	upx
behavioral2/memory/712-102-0x00007FF675720000-0x00007FF675B12000-memory.dmp	upx
behavioral2/files/0x0032000000023bb7-99.dat	upx
behavioral2/memory/5092-91-0x00007FF789C70000-0x00007FF78A062000-memory.dmp	upx
behavioral2/files/0x000a000000023bbe-87.dat	upx
behavioral2/files/0x000a000000023bbd-86.dat	upx
behavioral2/memory/2576-80-0x00007FF62A990000-0x00007FF62AD82000-memory.dmp	upx
behavioral2/files/0x000a000000023bb4-75.dat	upx
behavioral2/files/0x000a000000023bb2-68.dat	upx
behavioral2/files/0x000a000000023bba-62.dat	upx
behavioral2/files/0x000a000000023bb5-56.dat	upx
behavioral2/files/0x000a000000023bb1-52.dat	upx
behavioral2/memory/712-3774-0x00007FF675720000-0x00007FF675B12000-memory.dmp	upx
behavioral2/memory/1656-3791-0x00007FF79E720000-0x00007FF79EB12000-memory.dmp	upx
behavioral2/memory/4864-3873-0x00007FF604300000-0x00007FF6046F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HGJfQfP.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\BVlylaB.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\oeDeNpS.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\tcLgFtV.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\pLougmz.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\AAFsJec.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\RQHNLCf.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\JHItVWB.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\TJWdHHL.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\YcfycOx.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\qTEkDhk.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\aXSIwUv.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\NfQwbOr.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\vmMezub.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\qBMBxVJ.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\tCvudsa.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\tEOKXGf.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\rPypsyB.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\wlQOlUF.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\yiqafUK.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\TuWgALA.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\eCFAsWd.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\RgwmxEx.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\GTOSapZ.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\eHlJFXQ.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\yMKoFBM.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\wHbvkRH.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\SzwLath.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\tHUqrDh.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\PMywvuy.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\SDjOWoz.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\ACCZmoA.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\sRCsfQu.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\WMWMXGg.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\dIVyArS.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\BNfvTzs.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\BhvWCvL.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\zusWaQf.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\aKezAwZ.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\ShRmVhx.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\BUITeVd.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\uIACJDy.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\bkbRHzE.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\WPlEwiU.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\emyOrGZ.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\PJStdJW.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\IZFMyHU.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\KXUemge.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\MkStHKk.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\PCamviD.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\TyvMSuv.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\zhgdMLx.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\zTykWmV.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\jCIHsGW.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\KtKWdap.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\hBqlFPG.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\KkkxWbU.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\kzVHQAj.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\ZiBrwDq.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\OHUuCUD.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\TJsTsTz.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\amxDSnW.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\DUYhLNC.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
File created	C:\Windows\System\SqRWduF.exe	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
8052	Process not Found
9556	Process not Found
10616	Process not Found
8312	Process not Found
9468	Process not Found
9940	Process not Found
10128	Process not Found
10260	Process not Found
9384	Process not Found
10992	Process not Found
11056	Process not Found
12460	Process not Found
10624	Process not Found
12332	Process not Found
12360	Process not Found
12380	Process not Found
12400	Process not Found
12484	Process not Found
12432	Process not Found
12540	Process not Found
12556	Process not Found
12584	Process not Found
12664	Process not Found
12608	Process not Found
12832	Process not Found
12808	Process not Found
12780	Process not Found
12852	Process not Found
12880	Process not Found
12900	Process not Found
12924	Process not Found
12972	Process not Found
13252	Process not Found
13220	Process not Found
11904	Process not Found
11424	Process not Found
12956	Process not Found
11828	Process not Found
10564	Process not Found
12620	Process not Found
11760	Process not Found
11224	Process not Found
9544	Process not Found
11536	Process not Found
3908	Process not Found
12960	Process not Found
12140	Process not Found
11404	Process not Found
1852	Process not Found
12144	Process not Found
13168	Process not Found
11976	Process not Found
9696	Process not Found
11656	Process not Found
4860	Process not Found
11900	Process not Found
5800	Process not Found
10872	Process not Found
11256	Process not Found
4000	Process not Found
3312	Process not Found
5508	Process not Found
2092	Process not Found
5512	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeLockMemoryPrivilege	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	5508	dwm.exe
Token: SeChangeNotifyPrivilege	5508	dwm.exe
Token: 33	5508	dwm.exe
Token: SeIncBasePriorityPrivilege	5508	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3924	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	84
PID 4028 wrote to memory of 3924	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	84
PID 4028 wrote to memory of 2576	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	85
PID 4028 wrote to memory of 2576	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	85
PID 4028 wrote to memory of 5092	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	86
PID 4028 wrote to memory of 5092	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	86
PID 4028 wrote to memory of 712	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	87
PID 4028 wrote to memory of 712	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	87
PID 4028 wrote to memory of 924	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	88
PID 4028 wrote to memory of 924	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	88
PID 4028 wrote to memory of 2416	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	89
PID 4028 wrote to memory of 2416	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	89
PID 4028 wrote to memory of 4016	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	90
PID 4028 wrote to memory of 4016	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	90
PID 4028 wrote to memory of 512	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	91
PID 4028 wrote to memory of 512	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	91
PID 4028 wrote to memory of 1656	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	92
PID 4028 wrote to memory of 1656	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	92
PID 4028 wrote to memory of 2888	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	93
PID 4028 wrote to memory of 2888	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	93
PID 4028 wrote to memory of 1368	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	94
PID 4028 wrote to memory of 1368	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	94
PID 4028 wrote to memory of 3696	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	95
PID 4028 wrote to memory of 3696	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	95
PID 4028 wrote to memory of 3816	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	96
PID 4028 wrote to memory of 3816	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	96
PID 4028 wrote to memory of 4864	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	97
PID 4028 wrote to memory of 4864	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	97
PID 4028 wrote to memory of 1688	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	98
PID 4028 wrote to memory of 1688	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	98
PID 4028 wrote to memory of 3140	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	99
PID 4028 wrote to memory of 3140	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	99
PID 4028 wrote to memory of 4396	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	100
PID 4028 wrote to memory of 4396	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	100
PID 4028 wrote to memory of 3512	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	101
PID 4028 wrote to memory of 3512	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	101
PID 4028 wrote to memory of 2932	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	102
PID 4028 wrote to memory of 2932	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	102
PID 4028 wrote to memory of 1328	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	103
PID 4028 wrote to memory of 1328	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	103
PID 4028 wrote to memory of 2012	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	104
PID 4028 wrote to memory of 2012	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	104
PID 4028 wrote to memory of 3780	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	105
PID 4028 wrote to memory of 3780	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	105
PID 4028 wrote to memory of 1476	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	106
PID 4028 wrote to memory of 1476	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	106
PID 4028 wrote to memory of 460	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	107
PID 4028 wrote to memory of 460	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	107
PID 4028 wrote to memory of 2548	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	108
PID 4028 wrote to memory of 2548	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	108
PID 4028 wrote to memory of 4796	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	109
PID 4028 wrote to memory of 4796	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	109
PID 4028 wrote to memory of 1572	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	110
PID 4028 wrote to memory of 1572	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	110
PID 4028 wrote to memory of 1324	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	111
PID 4028 wrote to memory of 1324	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	111
PID 4028 wrote to memory of 1240	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	112
PID 4028 wrote to memory of 1240	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	112
PID 4028 wrote to memory of 1076	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	113
PID 4028 wrote to memory of 1076	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	113
PID 4028 wrote to memory of 1396	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	114
PID 4028 wrote to memory of 1396	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	114
PID 4028 wrote to memory of 1820	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	115
PID 4028 wrote to memory of 1820	4028	05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05e7ee1b4fe6a2ad2b92de71c552ad19_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3924
- C:\Windows\System\UEzjBJY.exe
  C:\Windows\System\UEzjBJY.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\pHAbdkJ.exe
  C:\Windows\System\pHAbdkJ.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\RmSprdO.exe
  C:\Windows\System\RmSprdO.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\LTjMTzp.exe
  C:\Windows\System\LTjMTzp.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\VBLtdTb.exe
  C:\Windows\System\VBLtdTb.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\JqICwCr.exe
  C:\Windows\System\JqICwCr.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\tLOwiMI.exe
  C:\Windows\System\tLOwiMI.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\vQvjJYB.exe
  C:\Windows\System\vQvjJYB.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\JSdFDeR.exe
  C:\Windows\System\JSdFDeR.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\BUVQpkX.exe
  C:\Windows\System\BUVQpkX.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\KsTUjWY.exe
  C:\Windows\System\KsTUjWY.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\UNDcdAr.exe
  C:\Windows\System\UNDcdAr.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\kSXGVlb.exe
  C:\Windows\System\kSXGVlb.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\vdXvMDQ.exe
  C:\Windows\System\vdXvMDQ.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\zyoNHJs.exe
  C:\Windows\System\zyoNHJs.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\WWZgibF.exe
  C:\Windows\System\WWZgibF.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\kFVjEMi.exe
  C:\Windows\System\kFVjEMi.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\zhcRnkX.exe
  C:\Windows\System\zhcRnkX.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\VxAvfte.exe
  C:\Windows\System\VxAvfte.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\nlqqbRw.exe
  C:\Windows\System\nlqqbRw.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\aePZYOv.exe
  C:\Windows\System\aePZYOv.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\OHtpixC.exe
  C:\Windows\System\OHtpixC.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\KjHwLBo.exe
  C:\Windows\System\KjHwLBo.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\gXQdidD.exe
  C:\Windows\System\gXQdidD.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\YptfNAl.exe
  C:\Windows\System\YptfNAl.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\nIrgLDF.exe
  C:\Windows\System\nIrgLDF.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\fStBfAI.exe
  C:\Windows\System\fStBfAI.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\bMwJctf.exe
  C:\Windows\System\bMwJctf.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\LyCeGdL.exe
  C:\Windows\System\LyCeGdL.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\CaeIApr.exe
  C:\Windows\System\CaeIApr.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\XlILnRU.exe
  C:\Windows\System\XlILnRU.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\cfGJrWb.exe
  C:\Windows\System\cfGJrWb.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\LDQTsvv.exe
  C:\Windows\System\LDQTsvv.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\ueClpzC.exe
  C:\Windows\System\ueClpzC.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\FCMTbPR.exe
  C:\Windows\System\FCMTbPR.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\UUNiFpm.exe
  C:\Windows\System\UUNiFpm.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\zXAjioC.exe
  C:\Windows\System\zXAjioC.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\YQFXLaQ.exe
  C:\Windows\System\YQFXLaQ.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\pkQybQv.exe
  C:\Windows\System\pkQybQv.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\yCKLsnB.exe
  C:\Windows\System\yCKLsnB.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\TJsTsTz.exe
  C:\Windows\System\TJsTsTz.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\heinrnW.exe
  C:\Windows\System\heinrnW.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\sYukkmf.exe
  C:\Windows\System\sYukkmf.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\AGcVRSw.exe
  C:\Windows\System\AGcVRSw.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\pmtpgSX.exe
  C:\Windows\System\pmtpgSX.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\yyfOEKq.exe
  C:\Windows\System\yyfOEKq.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\EhSMQXw.exe
  C:\Windows\System\EhSMQXw.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\NtizrAW.exe
  C:\Windows\System\NtizrAW.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\qQdbWoC.exe
  C:\Windows\System\qQdbWoC.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\zuCNPdb.exe
  C:\Windows\System\zuCNPdb.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\ZQYYYKl.exe
  C:\Windows\System\ZQYYYKl.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\giMiVSq.exe
  C:\Windows\System\giMiVSq.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\ACCZmoA.exe
  C:\Windows\System\ACCZmoA.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\TgVOYox.exe
  C:\Windows\System\TgVOYox.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\wMWDZwm.exe
  C:\Windows\System\wMWDZwm.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\HvEqNGG.exe
  C:\Windows\System\HvEqNGG.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\aCXNCJh.exe
  C:\Windows\System\aCXNCJh.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\mrhilrc.exe
  C:\Windows\System\mrhilrc.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\pilSIfi.exe
  C:\Windows\System\pilSIfi.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\eGVQxXZ.exe
  C:\Windows\System\eGVQxXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\AUFjIsy.exe
  C:\Windows\System\AUFjIsy.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\aCEIlrQ.exe
  C:\Windows\System\aCEIlrQ.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\MfQCftE.exe
  C:\Windows\System\MfQCftE.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\gUFVVIp.exe
  C:\Windows\System\gUFVVIp.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\RqnMdOh.exe
  C:\Windows\System\RqnMdOh.exe
  2⤵
  PID:964
- C:\Windows\System\OfSIKee.exe
  C:\Windows\System\OfSIKee.exe
  2⤵
  PID:4448
- C:\Windows\System\IAhJXtb.exe
  C:\Windows\System\IAhJXtb.exe
  2⤵
  PID:2256
- C:\Windows\System\AAlrrQJ.exe
  C:\Windows\System\AAlrrQJ.exe
  2⤵
  PID:2752
- C:\Windows\System\bGnpmVA.exe
  C:\Windows\System\bGnpmVA.exe
  2⤵
  PID:3124
- C:\Windows\System\FhAhScZ.exe
  C:\Windows\System\FhAhScZ.exe
  2⤵
  PID:4812
- C:\Windows\System\jgXxSaU.exe
  C:\Windows\System\jgXxSaU.exe
  2⤵
  PID:4980
- C:\Windows\System\DQipVgO.exe
  C:\Windows\System\DQipVgO.exe
  2⤵
  PID:4516
- C:\Windows\System\oYdYauR.exe
  C:\Windows\System\oYdYauR.exe
  2⤵
  PID:3020
- C:\Windows\System\xHOGKle.exe
  C:\Windows\System\xHOGKle.exe
  2⤵
  PID:2700
- C:\Windows\System\xMSIApM.exe
  C:\Windows\System\xMSIApM.exe
  2⤵
  PID:4368
- C:\Windows\System\GlHylMr.exe
  C:\Windows\System\GlHylMr.exe
  2⤵
  PID:1380
- C:\Windows\System\yYGFWba.exe
  C:\Windows\System\yYGFWba.exe
  2⤵
  PID:2852
- C:\Windows\System\hPDsUTk.exe
  C:\Windows\System\hPDsUTk.exe
  2⤵
  PID:2992
- C:\Windows\System\ydAHnwc.exe
  C:\Windows\System\ydAHnwc.exe
  2⤵
  PID:1740
- C:\Windows\System\cqmIIrD.exe
  C:\Windows\System\cqmIIrD.exe
  2⤵
  PID:5124
- C:\Windows\System\FUMqdsn.exe
  C:\Windows\System\FUMqdsn.exe
  2⤵
  PID:5148
- C:\Windows\System\VIprtcd.exe
  C:\Windows\System\VIprtcd.exe
  2⤵
  PID:5168
- C:\Windows\System\SzwLath.exe
  C:\Windows\System\SzwLath.exe
  2⤵
  PID:5212
- C:\Windows\System\GIWtRzp.exe
  C:\Windows\System\GIWtRzp.exe
  2⤵
  PID:5228
- C:\Windows\System\cVRGwkA.exe
  C:\Windows\System\cVRGwkA.exe
  2⤵
  PID:5548
- C:\Windows\System\OCVaoKQ.exe
  C:\Windows\System\OCVaoKQ.exe
  2⤵
  PID:5632
- C:\Windows\System\SZohkbs.exe
  C:\Windows\System\SZohkbs.exe
  2⤵
  PID:5648
- C:\Windows\System\xRuUzuZ.exe
  C:\Windows\System\xRuUzuZ.exe
  2⤵
  PID:5664
- C:\Windows\System\pwOTxHK.exe
  C:\Windows\System\pwOTxHK.exe
  2⤵
  PID:5680
- C:\Windows\System\sXUbCal.exe
  C:\Windows\System\sXUbCal.exe
  2⤵
  PID:5696
- C:\Windows\System\HlFvtIF.exe
  C:\Windows\System\HlFvtIF.exe
  2⤵
  PID:5712
- C:\Windows\System\JZhuScn.exe
  C:\Windows\System\JZhuScn.exe
  2⤵
  PID:5860
- C:\Windows\System\SHcOnFi.exe
  C:\Windows\System\SHcOnFi.exe
  2⤵
  PID:5880
- C:\Windows\System\UhSIlJD.exe
  C:\Windows\System\UhSIlJD.exe
  2⤵
  PID:5908
- C:\Windows\System\vgPjnnk.exe
  C:\Windows\System\vgPjnnk.exe
  2⤵
  PID:5928
- C:\Windows\System\qladdKd.exe
  C:\Windows\System\qladdKd.exe
  2⤵
  PID:5952
- C:\Windows\System\aAQiTiW.exe
  C:\Windows\System\aAQiTiW.exe
  2⤵
  PID:5976
- C:\Windows\System\KpJbTyG.exe
  C:\Windows\System\KpJbTyG.exe
  2⤵
  PID:6000
- C:\Windows\System\OzwgLgY.exe
  C:\Windows\System\OzwgLgY.exe
  2⤵
  PID:6024
- C:\Windows\System\nDcVYdu.exe
  C:\Windows\System\nDcVYdu.exe
  2⤵
  PID:6048
- C:\Windows\System\aKLSxos.exe
  C:\Windows\System\aKLSxos.exe
  2⤵
  PID:6076
- C:\Windows\System\CqGRQMU.exe
  C:\Windows\System\CqGRQMU.exe
  2⤵
  PID:6100
- C:\Windows\System\vVgsXMS.exe
  C:\Windows\System\vVgsXMS.exe
  2⤵
  PID:6124
- C:\Windows\System\tBrNwjF.exe
  C:\Windows\System\tBrNwjF.exe
  2⤵
  PID:2536
- C:\Windows\System\aXSIwUv.exe
  C:\Windows\System\aXSIwUv.exe
  2⤵
  PID:2540
- C:\Windows\System\OqyahDR.exe
  C:\Windows\System\OqyahDR.exe
  2⤵
  PID:1208
- C:\Windows\System\URnPKnu.exe
  C:\Windows\System\URnPKnu.exe
  2⤵
  PID:1772
- C:\Windows\System\RTnMujH.exe
  C:\Windows\System\RTnMujH.exe
  2⤵
  PID:4888
- C:\Windows\System\WohFgFh.exe
  C:\Windows\System\WohFgFh.exe
  2⤵
  PID:4960
- C:\Windows\System\UNVUsoJ.exe
  C:\Windows\System\UNVUsoJ.exe
  2⤵
  PID:692
- C:\Windows\System\leitDWS.exe
  C:\Windows\System\leitDWS.exe
  2⤵
  PID:4456
- C:\Windows\System\AOCxLvF.exe
  C:\Windows\System\AOCxLvF.exe
  2⤵
  PID:2592
- C:\Windows\System\FVMxBLZ.exe
  C:\Windows\System\FVMxBLZ.exe
  2⤵
  PID:3116
- C:\Windows\System\Ylxfllw.exe
  C:\Windows\System\Ylxfllw.exe
  2⤵
  PID:4296
- C:\Windows\System\dWGAiqy.exe
  C:\Windows\System\dWGAiqy.exe
  2⤵
  PID:5132
- C:\Windows\System\hcYBCzN.exe
  C:\Windows\System\hcYBCzN.exe
  2⤵
  PID:5176
- C:\Windows\System\zLUwcdp.exe
  C:\Windows\System\zLUwcdp.exe
  2⤵
  PID:5236
- C:\Windows\System\putuNJk.exe
  C:\Windows\System\putuNJk.exe
  2⤵
  PID:5064
- C:\Windows\System\YyeRHcG.exe
  C:\Windows\System\YyeRHcG.exe
  2⤵
  PID:5528
- C:\Windows\System\uZgtZnW.exe
  C:\Windows\System\uZgtZnW.exe
  2⤵
  PID:5556
- C:\Windows\System\KRxFTed.exe
  C:\Windows\System\KRxFTed.exe
  2⤵
  PID:5596
- C:\Windows\System\FTRcmIc.exe
  C:\Windows\System\FTRcmIc.exe
  2⤵
  PID:5616
- C:\Windows\System\CTImczD.exe
  C:\Windows\System\CTImczD.exe
  2⤵
  PID:5676
- C:\Windows\System\ExQTnkk.exe
  C:\Windows\System\ExQTnkk.exe
  2⤵
  PID:5736
- C:\Windows\System\lZhXtlf.exe
  C:\Windows\System\lZhXtlf.exe
  2⤵
  PID:1168
- C:\Windows\System\NOWFfNf.exe
  C:\Windows\System\NOWFfNf.exe
  2⤵
  PID:2976
- C:\Windows\System\dkniXbW.exe
  C:\Windows\System\dkniXbW.exe
  2⤵
  PID:4972
- C:\Windows\System\KjAHlji.exe
  C:\Windows\System\KjAHlji.exe
  2⤵
  PID:1912
- C:\Windows\System\JifbPBZ.exe
  C:\Windows\System\JifbPBZ.exe
  2⤵
  PID:4376
- C:\Windows\System\xanVfmh.exe
  C:\Windows\System\xanVfmh.exe
  2⤵
  PID:5072
- C:\Windows\System\wommXHY.exe
  C:\Windows\System\wommXHY.exe
  2⤵
  PID:2000
- C:\Windows\System\AmREUce.exe
  C:\Windows\System\AmREUce.exe
  2⤵
  PID:3464
- C:\Windows\System\PKlqrLL.exe
  C:\Windows\System\PKlqrLL.exe
  2⤵
  PID:2724
- C:\Windows\System\RVtOxqR.exe
  C:\Windows\System\RVtOxqR.exe
  2⤵
  PID:3492
- C:\Windows\System\mdZgfrS.exe
  C:\Windows\System\mdZgfrS.exe
  2⤵
  PID:4588
- C:\Windows\System\IqYfMtB.exe
  C:\Windows\System\IqYfMtB.exe
  2⤵
  PID:720
- C:\Windows\System\PTmmSxI.exe
  C:\Windows\System\PTmmSxI.exe
  2⤵
  PID:4556
- C:\Windows\System\jxJQmPh.exe
  C:\Windows\System\jxJQmPh.exe
  2⤵
  PID:3616
- C:\Windows\System\NbHZkQA.exe
  C:\Windows\System\NbHZkQA.exe
  2⤵
  PID:4068
- C:\Windows\System\WSUWOWU.exe
  C:\Windows\System\WSUWOWU.exe
  2⤵
  PID:5852
- C:\Windows\System\hSbwWTW.exe
  C:\Windows\System\hSbwWTW.exe
  2⤵
  PID:5964
- C:\Windows\System\LeviFXm.exe
  C:\Windows\System\LeviFXm.exe
  2⤵
  PID:5996
- C:\Windows\System\lowDtXv.exe
  C:\Windows\System\lowDtXv.exe
  2⤵
  PID:6120
- C:\Windows\System\sRCsfQu.exe
  C:\Windows\System\sRCsfQu.exe
  2⤵
  PID:2356
- C:\Windows\System\ZDwojmn.exe
  C:\Windows\System\ZDwojmn.exe
  2⤵
  PID:2064
- C:\Windows\System\MhuWXRz.exe
  C:\Windows\System\MhuWXRz.exe
  2⤵
  PID:1292
- C:\Windows\System\dlvPlRQ.exe
  C:\Windows\System\dlvPlRQ.exe
  2⤵
  PID:1224
- C:\Windows\System\cRDHszp.exe
  C:\Windows\System\cRDHszp.exe
  2⤵
  PID:5160
- C:\Windows\System\bDbnlnq.exe
  C:\Windows\System\bDbnlnq.exe
  2⤵
  PID:5536
- C:\Windows\System\GjxqIrI.exe
  C:\Windows\System\GjxqIrI.exe
  2⤵
  PID:1412
- C:\Windows\System\JsuEOMH.exe
  C:\Windows\System\JsuEOMH.exe
  2⤵
  PID:5584
- C:\Windows\System\HiMXgVH.exe
  C:\Windows\System\HiMXgVH.exe
  2⤵
  PID:5768
- C:\Windows\System\NxTYrtl.exe
  C:\Windows\System\NxTYrtl.exe
  2⤵
  PID:3180
- C:\Windows\System\cUwXsmN.exe
  C:\Windows\System\cUwXsmN.exe
  2⤵
  PID:5108
- C:\Windows\System\JsLeEiC.exe
  C:\Windows\System\JsLeEiC.exe
  2⤵
  PID:5660
- C:\Windows\System\uIWKlKh.exe
  C:\Windows\System\uIWKlKh.exe
  2⤵
  PID:1248
- C:\Windows\System\GbeqZSK.exe
  C:\Windows\System\GbeqZSK.exe
  2⤵
  PID:652
- C:\Windows\System\nFmmolK.exe
  C:\Windows\System\nFmmolK.exe
  2⤵
  PID:5900
- C:\Windows\System\qQWyOUe.exe
  C:\Windows\System\qQWyOUe.exe
  2⤵
  PID:2328
- C:\Windows\System\JagAHzW.exe
  C:\Windows\System\JagAHzW.exe
  2⤵
  PID:6092
- C:\Windows\System\cmVoPxv.exe
  C:\Windows\System\cmVoPxv.exe
  2⤵
  PID:4340
- C:\Windows\System\AQPgUua.exe
  C:\Windows\System\AQPgUua.exe
  2⤵
  PID:5624
- C:\Windows\System\hjjVqiA.exe
  C:\Windows\System\hjjVqiA.exe
  2⤵
  PID:1148
- C:\Windows\System\RwwFUdl.exe
  C:\Windows\System\RwwFUdl.exe
  2⤵
  PID:1564
- C:\Windows\System\brZFjSr.exe
  C:\Windows\System\brZFjSr.exe
  2⤵
  PID:3404
- C:\Windows\System\fJvIeyC.exe
  C:\Windows\System\fJvIeyC.exe
  2⤵
  PID:5872
- C:\Windows\System\yYANRzw.exe
  C:\Windows\System\yYANRzw.exe
  2⤵
  PID:6132
- C:\Windows\System\lXifbdu.exe
  C:\Windows\System\lXifbdu.exe
  2⤵
  PID:5708
- C:\Windows\System\tbZDpwZ.exe
  C:\Windows\System\tbZDpwZ.exe
  2⤵
  PID:6172
- C:\Windows\System\RSUmssZ.exe
  C:\Windows\System\RSUmssZ.exe
  2⤵
  PID:6196
- C:\Windows\System\ZaEKIBD.exe
  C:\Windows\System\ZaEKIBD.exe
  2⤵
  PID:6216
- C:\Windows\System\RhrZxvg.exe
  C:\Windows\System\RhrZxvg.exe
  2⤵
  PID:6236
- C:\Windows\System\kdUEANz.exe
  C:\Windows\System\kdUEANz.exe
  2⤵
  PID:6260
- C:\Windows\System\FwAzyJv.exe
  C:\Windows\System\FwAzyJv.exe
  2⤵
  PID:6284
- C:\Windows\System\KQWUkoC.exe
  C:\Windows\System\KQWUkoC.exe
  2⤵
  PID:6308
- C:\Windows\System\hTCbvGM.exe
  C:\Windows\System\hTCbvGM.exe
  2⤵
  PID:6340
- C:\Windows\System\PrMaiFG.exe
  C:\Windows\System\PrMaiFG.exe
  2⤵
  PID:6360
- C:\Windows\System\aebannk.exe
  C:\Windows\System\aebannk.exe
  2⤵
  PID:6384
- C:\Windows\System\OXGoRbk.exe
  C:\Windows\System\OXGoRbk.exe
  2⤵
  PID:6508
- C:\Windows\System\BrxSAjx.exe
  C:\Windows\System\BrxSAjx.exe
  2⤵
  PID:6528
- C:\Windows\System\vuZefGv.exe
  C:\Windows\System\vuZefGv.exe
  2⤵
  PID:6552
- C:\Windows\System\vVZMghm.exe
  C:\Windows\System\vVZMghm.exe
  2⤵
  PID:6576
- C:\Windows\System\vuyZurU.exe
  C:\Windows\System\vuyZurU.exe
  2⤵
  PID:6612
- C:\Windows\System\TyvMSuv.exe
  C:\Windows\System\TyvMSuv.exe
  2⤵
  PID:6640
- C:\Windows\System\GjxMeWc.exe
  C:\Windows\System\GjxMeWc.exe
  2⤵
  PID:6664
- C:\Windows\System\hWJRubR.exe
  C:\Windows\System\hWJRubR.exe
  2⤵
  PID:6700
- C:\Windows\System\gUtDcfs.exe
  C:\Windows\System\gUtDcfs.exe
  2⤵
  PID:6720
- C:\Windows\System\JkQvroC.exe
  C:\Windows\System\JkQvroC.exe
  2⤵
  PID:6740
- C:\Windows\System\ctXMWqF.exe
  C:\Windows\System\ctXMWqF.exe
  2⤵
  PID:6760
- C:\Windows\System\fbgkuuy.exe
  C:\Windows\System\fbgkuuy.exe
  2⤵
  PID:6784
- C:\Windows\System\GKrPoXV.exe
  C:\Windows\System\GKrPoXV.exe
  2⤵
  PID:6800
- C:\Windows\System\Hyaxxnt.exe
  C:\Windows\System\Hyaxxnt.exe
  2⤵
  PID:6824
- C:\Windows\System\BqcsOAQ.exe
  C:\Windows\System\BqcsOAQ.exe
  2⤵
  PID:6848
- C:\Windows\System\GYmLUrD.exe
  C:\Windows\System\GYmLUrD.exe
  2⤵
  PID:6872
- C:\Windows\System\FYanihn.exe
  C:\Windows\System\FYanihn.exe
  2⤵
  PID:6900
- C:\Windows\System\RddYfjz.exe
  C:\Windows\System\RddYfjz.exe
  2⤵
  PID:6924
- C:\Windows\System\xlCKjze.exe
  C:\Windows\System\xlCKjze.exe
  2⤵
  PID:6956
- C:\Windows\System\czrkObl.exe
  C:\Windows\System\czrkObl.exe
  2⤵
  PID:6988
- C:\Windows\System\gsgGOkX.exe
  C:\Windows\System\gsgGOkX.exe
  2⤵
  PID:7012
- C:\Windows\System\owxVnjk.exe
  C:\Windows\System\owxVnjk.exe
  2⤵
  PID:7040
- C:\Windows\System\qfcetid.exe
  C:\Windows\System\qfcetid.exe
  2⤵
  PID:7072
- C:\Windows\System\fafJuKE.exe
  C:\Windows\System\fafJuKE.exe
  2⤵
  PID:7104
- C:\Windows\System\MpDqItE.exe
  C:\Windows\System\MpDqItE.exe
  2⤵
  PID:7124
- C:\Windows\System\DBGsygN.exe
  C:\Windows\System\DBGsygN.exe
  2⤵
  PID:7156
- C:\Windows\System\iyUQCca.exe
  C:\Windows\System\iyUQCca.exe
  2⤵
  PID:4592
- C:\Windows\System\snMXYeT.exe
  C:\Windows\System\snMXYeT.exe
  2⤵
  PID:4832
- C:\Windows\System\YBAtltJ.exe
  C:\Windows\System\YBAtltJ.exe
  2⤵
  PID:5868
- C:\Windows\System\uwNzcix.exe
  C:\Windows\System\uwNzcix.exe
  2⤵
  PID:4088
- C:\Windows\System\lgILbjB.exe
  C:\Windows\System\lgILbjB.exe
  2⤵
  PID:6324
- C:\Windows\System\FGhYFzu.exe
  C:\Windows\System\FGhYFzu.exe
  2⤵
  PID:6180
- C:\Windows\System\FxBTroB.exe
  C:\Windows\System\FxBTroB.exe
  2⤵
  PID:6536
- C:\Windows\System\GqMfBTr.exe
  C:\Windows\System\GqMfBTr.exe
  2⤵
  PID:6304
- C:\Windows\System\gYibZzA.exe
  C:\Windows\System\gYibZzA.exe
  2⤵
  PID:6328
- C:\Windows\System\NAtzBqH.exe
  C:\Windows\System\NAtzBqH.exe
  2⤵
  PID:6416
- C:\Windows\System\goZEOEB.exe
  C:\Windows\System\goZEOEB.exe
  2⤵
  PID:6464
- C:\Windows\System\KLsmIwq.exe
  C:\Windows\System\KLsmIwq.exe
  2⤵
  PID:7000
- C:\Windows\System\knIMbvP.exe
  C:\Windows\System\knIMbvP.exe
  2⤵
  PID:6736
- C:\Windows\System\MtTHeou.exe
  C:\Windows\System\MtTHeou.exe
  2⤵
  PID:7064
- C:\Windows\System\ciHhddH.exe
  C:\Windows\System\ciHhddH.exe
  2⤵
  PID:6568
- C:\Windows\System\sssXKgO.exe
  C:\Windows\System\sssXKgO.exe
  2⤵
  PID:6716
- C:\Windows\System\QzOXlIK.exe
  C:\Windows\System\QzOXlIK.exe
  2⤵
  PID:6832
- C:\Windows\System\VPfbkYz.exe
  C:\Windows\System\VPfbkYz.exe
  2⤵
  PID:6920
- C:\Windows\System\cZqPidP.exe
  C:\Windows\System\cZqPidP.exe
  2⤵
  PID:3644
- C:\Windows\System\iKtQZtR.exe
  C:\Windows\System\iKtQZtR.exe
  2⤵
  PID:7180
- C:\Windows\System\CZWBxAD.exe
  C:\Windows\System\CZWBxAD.exe
  2⤵
  PID:7200
- C:\Windows\System\HdISxEI.exe
  C:\Windows\System\HdISxEI.exe
  2⤵
  PID:7224
- C:\Windows\System\BKMyJhI.exe
  C:\Windows\System\BKMyJhI.exe
  2⤵
  PID:7252
- C:\Windows\System\rFoYpTL.exe
  C:\Windows\System\rFoYpTL.exe
  2⤵
  PID:7276
- C:\Windows\System\mMxzhwS.exe
  C:\Windows\System\mMxzhwS.exe
  2⤵
  PID:7304
- C:\Windows\System\QMpmSeu.exe
  C:\Windows\System\QMpmSeu.exe
  2⤵
  PID:7336
- C:\Windows\System\rjBvAtE.exe
  C:\Windows\System\rjBvAtE.exe
  2⤵
  PID:7368
- C:\Windows\System\PAEluTT.exe
  C:\Windows\System\PAEluTT.exe
  2⤵
  PID:7388
- C:\Windows\System\LAFMILx.exe
  C:\Windows\System\LAFMILx.exe
  2⤵
  PID:7416
- C:\Windows\System\ZZeSVWd.exe
  C:\Windows\System\ZZeSVWd.exe
  2⤵
  PID:7436
- C:\Windows\System\cqftqwI.exe
  C:\Windows\System\cqftqwI.exe
  2⤵
  PID:7452
- C:\Windows\System\WUfEVKc.exe
  C:\Windows\System\WUfEVKc.exe
  2⤵
  PID:7476
- C:\Windows\System\YlOYMSF.exe
  C:\Windows\System\YlOYMSF.exe
  2⤵
  PID:7500
- C:\Windows\System\GdnxKCz.exe
  C:\Windows\System\GdnxKCz.exe
  2⤵
  PID:7524
- C:\Windows\System\mvHSTBl.exe
  C:\Windows\System\mvHSTBl.exe
  2⤵
  PID:7548
- C:\Windows\System\rvHxLrj.exe
  C:\Windows\System\rvHxLrj.exe
  2⤵
  PID:7568
- C:\Windows\System\lKpcVGl.exe
  C:\Windows\System\lKpcVGl.exe
  2⤵
  PID:7588
- C:\Windows\System\qSDERdC.exe
  C:\Windows\System\qSDERdC.exe
  2⤵
  PID:7608
- C:\Windows\System\NfQwbOr.exe
  C:\Windows\System\NfQwbOr.exe
  2⤵
  PID:7632
- C:\Windows\System\hPqRoTp.exe
  C:\Windows\System\hPqRoTp.exe
  2⤵
  PID:7656
- C:\Windows\System\qEAdgRZ.exe
  C:\Windows\System\qEAdgRZ.exe
  2⤵
  PID:7680
- C:\Windows\System\sZKJAcS.exe
  C:\Windows\System\sZKJAcS.exe
  2⤵
  PID:7708
- C:\Windows\System\dKLPTsh.exe
  C:\Windows\System\dKLPTsh.exe
  2⤵
  PID:7736
- C:\Windows\System\RWEglWt.exe
  C:\Windows\System\RWEglWt.exe
  2⤵
  PID:7756
- C:\Windows\System\hdRcDFV.exe
  C:\Windows\System\hdRcDFV.exe
  2⤵
  PID:7780
- C:\Windows\System\rJmHSIG.exe
  C:\Windows\System\rJmHSIG.exe
  2⤵
  PID:7808
- C:\Windows\System\djFcclG.exe
  C:\Windows\System\djFcclG.exe
  2⤵
  PID:7832
- C:\Windows\System\CMAGZPq.exe
  C:\Windows\System\CMAGZPq.exe
  2⤵
  PID:7852
- C:\Windows\System\ZIhMHxk.exe
  C:\Windows\System\ZIhMHxk.exe
  2⤵
  PID:7884
- C:\Windows\System\ZlAaYqq.exe
  C:\Windows\System\ZlAaYqq.exe
  2⤵
  PID:7904
- C:\Windows\System\OGzffbg.exe
  C:\Windows\System\OGzffbg.exe
  2⤵
  PID:7928
- C:\Windows\System\JHaTMnz.exe
  C:\Windows\System\JHaTMnz.exe
  2⤵
  PID:7952
- C:\Windows\System\JkmnTJB.exe
  C:\Windows\System\JkmnTJB.exe
  2⤵
  PID:7976
- C:\Windows\System\IpsNxxL.exe
  C:\Windows\System\IpsNxxL.exe
  2⤵
  PID:8008
- C:\Windows\System\hawdBxV.exe
  C:\Windows\System\hawdBxV.exe
  2⤵
  PID:8040
- C:\Windows\System\chNmLFW.exe
  C:\Windows\System\chNmLFW.exe
  2⤵
  PID:8064
- C:\Windows\System\tvOzjAF.exe
  C:\Windows\System\tvOzjAF.exe
  2⤵
  PID:8084
- C:\Windows\System\DRldVHK.exe
  C:\Windows\System\DRldVHK.exe
  2⤵
  PID:8120
- C:\Windows\System\RsPpKrT.exe
  C:\Windows\System\RsPpKrT.exe
  2⤵
  PID:8148
- C:\Windows\System\spwbSWj.exe
  C:\Windows\System\spwbSWj.exe
  2⤵
  PID:8172
- C:\Windows\System\UtahQzV.exe
  C:\Windows\System\UtahQzV.exe
  2⤵
  PID:7116
- C:\Windows\System\AKAzuyF.exe
  C:\Windows\System\AKAzuyF.exe
  2⤵
  PID:3496
- C:\Windows\System\jjtfbqZ.exe
  C:\Windows\System\jjtfbqZ.exe
  2⤵
  PID:6476
- C:\Windows\System\qVNgOxU.exe
  C:\Windows\System\qVNgOxU.exe
  2⤵
  PID:6648
- C:\Windows\System\xmPvCFD.exe
  C:\Windows\System\xmPvCFD.exe
  2⤵
  PID:6768
- C:\Windows\System\hcuKlsy.exe
  C:\Windows\System\hcuKlsy.exe
  2⤵
  PID:5052
- C:\Windows\System\GTOSapZ.exe
  C:\Windows\System\GTOSapZ.exe
  2⤵
  PID:6796
- C:\Windows\System\ZRmnWJJ.exe
  C:\Windows\System\ZRmnWJJ.exe
  2⤵
  PID:6212
- C:\Windows\System\BOZhUYW.exe
  C:\Windows\System\BOZhUYW.exe
  2⤵
  PID:6292
- C:\Windows\System\UGWLnKW.exe
  C:\Windows\System\UGWLnKW.exe
  2⤵
  PID:7268
- C:\Windows\System\ewBzNjq.exe
  C:\Windows\System\ewBzNjq.exe
  2⤵
  PID:7316
- C:\Windows\System\QNdyAar.exe
  C:\Windows\System\QNdyAar.exe
  2⤵
  PID:7376
- C:\Windows\System\jsRQpkD.exe
  C:\Windows\System\jsRQpkD.exe
  2⤵
  PID:6948
- C:\Windows\System\IrDWgpJ.exe
  C:\Windows\System\IrDWgpJ.exe
  2⤵
  PID:7292
- C:\Windows\System\KlYvsPh.exe
  C:\Windows\System\KlYvsPh.exe
  2⤵
  PID:7508
- C:\Windows\System\IyTprNS.exe
  C:\Windows\System\IyTprNS.exe
  2⤵
  PID:7404
- C:\Windows\System\MhqmQPo.exe
  C:\Windows\System\MhqmQPo.exe
  2⤵
  PID:7664
- C:\Windows\System\fpoPojw.exe
  C:\Windows\System\fpoPojw.exe
  2⤵
  PID:7444
- C:\Windows\System\dXygzpe.exe
  C:\Windows\System\dXygzpe.exe
  2⤵
  PID:7796
- C:\Windows\System\sRvzIEO.exe
  C:\Windows\System\sRvzIEO.exe
  2⤵
  PID:7848
- C:\Windows\System\rFIUqbf.exe
  C:\Windows\System\rFIUqbf.exe
  2⤵
  PID:7544
- C:\Windows\System\bBVpCpf.exe
  C:\Windows\System\bBVpCpf.exe
  2⤵
  PID:7944
- C:\Windows\System\izyqjkj.exe
  C:\Windows\System\izyqjkj.exe
  2⤵
  PID:7580
- C:\Windows\System\JltQitg.exe
  C:\Windows\System\JltQitg.exe
  2⤵
  PID:8076
- C:\Windows\System\nZArJxC.exe
  C:\Windows\System\nZArJxC.exe
  2⤵
  PID:7472
- C:\Windows\System\MeLPJSR.exe
  C:\Windows\System\MeLPJSR.exe
  2⤵
  PID:7772
- C:\Windows\System\vkbzAuO.exe
  C:\Windows\System\vkbzAuO.exe
  2⤵
  PID:6192
- C:\Windows\System\hYFxRZj.exe
  C:\Windows\System\hYFxRZj.exe
  2⤵
  PID:6460
- C:\Windows\System\iIJGXgm.exe
  C:\Windows\System\iIJGXgm.exe
  2⤵
  PID:7048
- C:\Windows\System\JJPuvpR.exe
  C:\Windows\System\JJPuvpR.exe
  2⤵
  PID:7628
- C:\Windows\System\FbOzSyL.exe
  C:\Windows\System\FbOzSyL.exe
  2⤵
  PID:2876
- C:\Windows\System\jJUfsvx.exe
  C:\Windows\System\jJUfsvx.exe
  2⤵
  PID:7844
- C:\Windows\System\RipgNCJ.exe
  C:\Windows\System\RipgNCJ.exe
  2⤵
  PID:8224
- C:\Windows\System\jTpOHJR.exe
  C:\Windows\System\jTpOHJR.exe
  2⤵
  PID:8248
- C:\Windows\System\lZZwccd.exe
  C:\Windows\System\lZZwccd.exe
  2⤵
  PID:8268
- C:\Windows\System\xcEJGcm.exe
  C:\Windows\System\xcEJGcm.exe
  2⤵
  PID:8292
- C:\Windows\System\mxaDjRR.exe
  C:\Windows\System\mxaDjRR.exe
  2⤵
  PID:8320
- C:\Windows\System\fzzRndi.exe
  C:\Windows\System\fzzRndi.exe
  2⤵
  PID:8340
- C:\Windows\System\zLlJLBq.exe
  C:\Windows\System\zLlJLBq.exe
  2⤵
  PID:8368
- C:\Windows\System\guQfOwP.exe
  C:\Windows\System\guQfOwP.exe
  2⤵
  PID:8396
- C:\Windows\System\KPSpFGU.exe
  C:\Windows\System\KPSpFGU.exe
  2⤵
  PID:8420
- C:\Windows\System\fGKPGNo.exe
  C:\Windows\System\fGKPGNo.exe
  2⤵
  PID:8452
- C:\Windows\System\RiWMESu.exe
  C:\Windows\System\RiWMESu.exe
  2⤵
  PID:8480
- C:\Windows\System\ccdmCJL.exe
  C:\Windows\System\ccdmCJL.exe
  2⤵
  PID:8508
- C:\Windows\System\xmmwmNE.exe
  C:\Windows\System\xmmwmNE.exe
  2⤵
  PID:8528
- C:\Windows\System\VCcLWeR.exe
  C:\Windows\System\VCcLWeR.exe
  2⤵
  PID:8556
- C:\Windows\System\fYcfetE.exe
  C:\Windows\System\fYcfetE.exe
  2⤵
  PID:8584
- C:\Windows\System\CJcTlbH.exe
  C:\Windows\System\CJcTlbH.exe
  2⤵
  PID:8608
- C:\Windows\System\csZftrR.exe
  C:\Windows\System\csZftrR.exe
  2⤵
  PID:8636
- C:\Windows\System\CnHpBFI.exe
  C:\Windows\System\CnHpBFI.exe
  2⤵
  PID:8672
- C:\Windows\System\vKXdDfx.exe
  C:\Windows\System\vKXdDfx.exe
  2⤵
  PID:8696
- C:\Windows\System\LOhfclF.exe
  C:\Windows\System\LOhfclF.exe
  2⤵
  PID:8716
- C:\Windows\System\rWRlfMk.exe
  C:\Windows\System\rWRlfMk.exe
  2⤵
  PID:8740
- C:\Windows\System\qoQVilG.exe
  C:\Windows\System\qoQVilG.exe
  2⤵
  PID:8764
- C:\Windows\System\OWodvfJ.exe
  C:\Windows\System\OWodvfJ.exe
  2⤵
  PID:8788
- C:\Windows\System\wMKRERb.exe
  C:\Windows\System\wMKRERb.exe
  2⤵
  PID:8812
- C:\Windows\System\ASoMyyB.exe
  C:\Windows\System\ASoMyyB.exe
  2⤵
  PID:9040
- C:\Windows\System\vBZCJcr.exe
  C:\Windows\System\vBZCJcr.exe
  2⤵
  PID:9076
- C:\Windows\System\ZMduvOF.exe
  C:\Windows\System\ZMduvOF.exe
  2⤵
  PID:9104
- C:\Windows\System\sHWtVTP.exe
  C:\Windows\System\sHWtVTP.exe
  2⤵
  PID:9124
- C:\Windows\System\CNFQGyt.exe
  C:\Windows\System\CNFQGyt.exe
  2⤵
  PID:9148
- C:\Windows\System\epYFder.exe
  C:\Windows\System\epYFder.exe
  2⤵
  PID:9168
- C:\Windows\System\CFWXECB.exe
  C:\Windows\System\CFWXECB.exe
  2⤵
  PID:9192
- C:\Windows\System\nJyyAXU.exe
  C:\Windows\System\nJyyAXU.exe
  2⤵
  PID:9212
- C:\Windows\System\KkkxWbU.exe
  C:\Windows\System\KkkxWbU.exe
  2⤵
  PID:7148
- C:\Windows\System\ySThtQi.exe
  C:\Windows\System\ySThtQi.exe
  2⤵
  PID:8032
- C:\Windows\System\NzmwvhL.exe
  C:\Windows\System\NzmwvhL.exe
  2⤵
  PID:7868
- C:\Windows\System\KKsDBFy.exe
  C:\Windows\System\KKsDBFy.exe
  2⤵
  PID:7984
- C:\Windows\System\mZUXxMx.exe
  C:\Windows\System\mZUXxMx.exe
  2⤵
  PID:7704
- C:\Windows\System\ZCYnfBI.exe
  C:\Windows\System\ZCYnfBI.exe
  2⤵
  PID:6972
- C:\Windows\System\QpsoBJE.exe
  C:\Windows\System\QpsoBJE.exe
  2⤵
  PID:7240
- C:\Windows\System\GKyYfNW.exe
  C:\Windows\System\GKyYfNW.exe
  2⤵
  PID:8204
- C:\Windows\System\kJTNHjW.exe
  C:\Windows\System\kJTNHjW.exe
  2⤵
  PID:8264
- C:\Windows\System\kdiqITO.exe
  C:\Windows\System\kdiqITO.exe
  2⤵
  PID:7560
- C:\Windows\System\GrUAWzv.exe
  C:\Windows\System\GrUAWzv.exe
  2⤵
  PID:8440
- C:\Windows\System\xwUKJwj.exe
  C:\Windows\System\xwUKJwj.exe
  2⤵
  PID:7988
- C:\Windows\System\YzGFMXW.exe
  C:\Windows\System\YzGFMXW.exe
  2⤵
  PID:4224
- C:\Windows\System\GDlUBbZ.exe
  C:\Windows\System\GDlUBbZ.exe
  2⤵
  PID:8644
- C:\Windows\System\AHcIPew.exe
  C:\Windows\System\AHcIPew.exe
  2⤵
  PID:8680
- C:\Windows\System\PNwBCmP.exe
  C:\Windows\System\PNwBCmP.exe
  2⤵
  PID:8732
- C:\Windows\System\PNpNnXf.exe
  C:\Windows\System\PNpNnXf.exe
  2⤵
  PID:8772
- C:\Windows\System\fpYftKa.exe
  C:\Windows\System\fpYftKa.exe
  2⤵
  PID:7716
- C:\Windows\System\wEYnkCR.exe
  C:\Windows\System\wEYnkCR.exe
  2⤵
  PID:8184
- C:\Windows\System\BTutwMk.exe
  C:\Windows\System\BTutwMk.exe
  2⤵
  PID:8572
- C:\Windows\System\UnSkiAV.exe
  C:\Windows\System\UnSkiAV.exe
  2⤵
  PID:8284
- C:\Windows\System\oRjyJWi.exe
  C:\Windows\System\oRjyJWi.exe
  2⤵
  PID:8976
- C:\Windows\System\MOILfLa.exe
  C:\Windows\System\MOILfLa.exe
  2⤵
  PID:8496
- C:\Windows\System\KAQZjJk.exe
  C:\Windows\System\KAQZjJk.exe
  2⤵
  PID:9200
- C:\Windows\System\Qrvvulz.exe
  C:\Windows\System\Qrvvulz.exe
  2⤵
  PID:7728
- C:\Windows\System\qWhVBGk.exe
  C:\Windows\System\qWhVBGk.exe
  2⤵
  PID:8288
- C:\Windows\System\jKSJyLD.exe
  C:\Windows\System\jKSJyLD.exe
  2⤵
  PID:9240
- C:\Windows\System\aImwqie.exe
  C:\Windows\System\aImwqie.exe
  2⤵
  PID:9264
- C:\Windows\System\gHaFoUX.exe
  C:\Windows\System\gHaFoUX.exe
  2⤵
  PID:9280
- C:\Windows\System\ugXsOYb.exe
  C:\Windows\System\ugXsOYb.exe
  2⤵
  PID:9312
- C:\Windows\System\iFYukbg.exe
  C:\Windows\System\iFYukbg.exe
  2⤵
  PID:9332
- C:\Windows\System\cADGeAb.exe
  C:\Windows\System\cADGeAb.exe
  2⤵
  PID:9360
- C:\Windows\System\vhCtbjO.exe
  C:\Windows\System\vhCtbjO.exe
  2⤵
  PID:9412
- C:\Windows\System\OMEucRv.exe
  C:\Windows\System\OMEucRv.exe
  2⤵
  PID:9432
- C:\Windows\System\LzBfxSv.exe
  C:\Windows\System\LzBfxSv.exe
  2⤵
  PID:9456
- C:\Windows\System\dVdlaqj.exe
  C:\Windows\System\dVdlaqj.exe
  2⤵
  PID:9476
- C:\Windows\System\FLJHeMI.exe
  C:\Windows\System\FLJHeMI.exe
  2⤵
  PID:9496
- C:\Windows\System\TaDQekf.exe
  C:\Windows\System\TaDQekf.exe
  2⤵
  PID:9524
- C:\Windows\System\aFHvExC.exe
  C:\Windows\System\aFHvExC.exe
  2⤵
  PID:9548
- C:\Windows\System\lgzNBrc.exe
  C:\Windows\System\lgzNBrc.exe
  2⤵
  PID:9568
- C:\Windows\System\rcwQeRh.exe
  C:\Windows\System\rcwQeRh.exe
  2⤵
  PID:9592
- C:\Windows\System\WYECvaC.exe
  C:\Windows\System\WYECvaC.exe
  2⤵
  PID:9616
- C:\Windows\System\zgGhqHi.exe
  C:\Windows\System\zgGhqHi.exe
  2⤵
  PID:9636
- C:\Windows\System\TmfOJvz.exe
  C:\Windows\System\TmfOJvz.exe
  2⤵
  PID:9660
- C:\Windows\System\GrOXPWY.exe
  C:\Windows\System\GrOXPWY.exe
  2⤵
  PID:9684
- C:\Windows\System\lBqAtfi.exe
  C:\Windows\System\lBqAtfi.exe
  2⤵
  PID:9704
- C:\Windows\System\BbGhaBj.exe
  C:\Windows\System\BbGhaBj.exe
  2⤵
  PID:9728
- C:\Windows\System\HPTKYOq.exe
  C:\Windows\System\HPTKYOq.exe
  2⤵
  PID:9756
- C:\Windows\System\HgWIIsD.exe
  C:\Windows\System\HgWIIsD.exe
  2⤵
  PID:9780
- C:\Windows\System\nnqPErS.exe
  C:\Windows\System\nnqPErS.exe
  2⤵
  PID:9812
- C:\Windows\System\aUAqCzM.exe
  C:\Windows\System\aUAqCzM.exe
  2⤵
  PID:9840
- C:\Windows\System\PAmmUKr.exe
  C:\Windows\System\PAmmUKr.exe
  2⤵
  PID:9860
- C:\Windows\System\KsLWDJE.exe
  C:\Windows\System\KsLWDJE.exe
  2⤵
  PID:9884
- C:\Windows\System\jwsXvYY.exe
  C:\Windows\System\jwsXvYY.exe
  2⤵
  PID:9912
- C:\Windows\System\RERWlhh.exe
  C:\Windows\System\RERWlhh.exe
  2⤵
  PID:9932
- C:\Windows\System\RADLSBP.exe
  C:\Windows\System\RADLSBP.exe
  2⤵
  PID:9960
- C:\Windows\System\nmfUOCc.exe
  C:\Windows\System\nmfUOCc.exe
  2⤵
  PID:9988
- C:\Windows\System\hxAMJYE.exe
  C:\Windows\System\hxAMJYE.exe
  2⤵
  PID:10016
- C:\Windows\System\YBNzxEF.exe
  C:\Windows\System\YBNzxEF.exe
  2⤵
  PID:10036
- C:\Windows\System\flMzlzQ.exe
  C:\Windows\System\flMzlzQ.exe
  2⤵
  PID:10064
- C:\Windows\System\wZGmZRq.exe
  C:\Windows\System\wZGmZRq.exe
  2⤵
  PID:10092
- C:\Windows\System\oOfajoK.exe
  C:\Windows\System\oOfajoK.exe
  2⤵
  PID:10116
- C:\Windows\System\nvDCPAO.exe
  C:\Windows\System\nvDCPAO.exe
  2⤵
  PID:10152
- C:\Windows\System\LwiUuEE.exe
  C:\Windows\System\LwiUuEE.exe
  2⤵
  PID:10172
- C:\Windows\System\gPYHVuh.exe
  C:\Windows\System\gPYHVuh.exe
  2⤵
  PID:10200
- C:\Windows\System\jEtAMbv.exe
  C:\Windows\System\jEtAMbv.exe
  2⤵
  PID:7564
- C:\Windows\System\YzyJdZF.exe
  C:\Windows\System\YzyJdZF.exe
  2⤵
  PID:8628
- C:\Windows\System\RffjBwu.exe
  C:\Windows\System\RffjBwu.exe
  2⤵
  PID:8664
- C:\Windows\System\kzVHQAj.exe
  C:\Windows\System\kzVHQAj.exe
  2⤵
  PID:9136
- C:\Windows\System\JaiTCxR.exe
  C:\Windows\System\JaiTCxR.exe
  2⤵
  PID:4392
- C:\Windows\System\hZeBZUx.exe
  C:\Windows\System\hZeBZUx.exe
  2⤵
  PID:8428
- C:\Windows\System\FxEMMDb.exe
  C:\Windows\System\FxEMMDb.exe
  2⤵
  PID:8196
- C:\Windows\System\fFNbzio.exe
  C:\Windows\System\fFNbzio.exe
  2⤵
  PID:9248
- C:\Windows\System\FndVwUf.exe
  C:\Windows\System\FndVwUf.exe
  2⤵
  PID:9000
- C:\Windows\System\qhBcXsW.exe
  C:\Windows\System\qhBcXsW.exe
  2⤵
  PID:9272
- C:\Windows\System\OZvVfJt.exe
  C:\Windows\System\OZvVfJt.exe
  2⤵
  PID:8348
- C:\Windows\System\exCuHCi.exe
  C:\Windows\System\exCuHCi.exe
  2⤵
  PID:9176
- C:\Windows\System\QEjAPMU.exe
  C:\Windows\System\QEjAPMU.exe
  2⤵
  PID:7652
- C:\Windows\System\qPQAYwJ.exe
  C:\Windows\System\qPQAYwJ.exe
  2⤵
  PID:8100
- C:\Windows\System\jnEwplU.exe
  C:\Windows\System\jnEwplU.exe
  2⤵
  PID:1084
- C:\Windows\System\BmZvEOl.exe
  C:\Windows\System\BmZvEOl.exe
  2⤵
  PID:9352
- C:\Windows\System\tTabGLR.exe
  C:\Windows\System\tTabGLR.exe
  2⤵
  PID:8580
- C:\Windows\System\pXUKltE.exe
  C:\Windows\System\pXUKltE.exe
  2⤵
  PID:9440
- C:\Windows\System\xGONhDp.exe
  C:\Windows\System\xGONhDp.exe
  2⤵
  PID:9520
- C:\Windows\System\aUFJidX.exe
  C:\Windows\System\aUFJidX.exe
  2⤵
  PID:9576
- C:\Windows\System\ByuFaaj.exe
  C:\Windows\System\ByuFaaj.exe
  2⤵
  PID:9628
- C:\Windows\System\SOdeIRn.exe
  C:\Windows\System\SOdeIRn.exe
  2⤵
  PID:9748
- C:\Windows\System\EZtRMbc.exe
  C:\Windows\System\EZtRMbc.exe
  2⤵
  PID:9836
- C:\Windows\System\FVSmtZr.exe
  C:\Windows\System\FVSmtZr.exe
  2⤵
  PID:9424
- C:\Windows\System\bteTAbL.exe
  C:\Windows\System\bteTAbL.exe
  2⤵
  PID:9188
- C:\Windows\System\gmzGImK.exe
  C:\Windows\System\gmzGImK.exe
  2⤵
  PID:9260
- C:\Windows\System\XtodYuA.exe
  C:\Windows\System\XtodYuA.exe
  2⤵
  PID:9448
- C:\Windows\System\nxzJRCU.exe
  C:\Windows\System\nxzJRCU.exe
  2⤵
  PID:9584
- C:\Windows\System\OXWdHuc.exe
  C:\Windows\System\OXWdHuc.exe
  2⤵
  PID:9656
- C:\Windows\System\WPubpCd.exe
  C:\Windows\System\WPubpCd.exe
  2⤵
  PID:9764
- C:\Windows\System\nzBUMOP.exe
  C:\Windows\System\nzBUMOP.exe
  2⤵
  PID:10252
- C:\Windows\System\JewEjEP.exe
  C:\Windows\System\JewEjEP.exe
  2⤵
  PID:10276
- C:\Windows\System\nclKVCY.exe
  C:\Windows\System\nclKVCY.exe
  2⤵
  PID:10300
- C:\Windows\System\LQdWdsG.exe
  C:\Windows\System\LQdWdsG.exe
  2⤵
  PID:10324
- C:\Windows\System\ogjKPbf.exe
  C:\Windows\System\ogjKPbf.exe
  2⤵
  PID:10352
- C:\Windows\System\aFPDFlV.exe
  C:\Windows\System\aFPDFlV.exe
  2⤵
  PID:10372
- C:\Windows\System\HmAkPef.exe
  C:\Windows\System\HmAkPef.exe
  2⤵
  PID:10404
- C:\Windows\System\yzSCsLt.exe
  C:\Windows\System\yzSCsLt.exe
  2⤵
  PID:10428
- C:\Windows\System\phdITXm.exe
  C:\Windows\System\phdITXm.exe
  2⤵
  PID:10456
- C:\Windows\System\MPeZSXQ.exe
  C:\Windows\System\MPeZSXQ.exe
  2⤵
  PID:10484
- C:\Windows\System\KWsBEAW.exe
  C:\Windows\System\KWsBEAW.exe
  2⤵
  PID:10508
- C:\Windows\System\vJxpaBL.exe
  C:\Windows\System\vJxpaBL.exe
  2⤵
  PID:10536
- C:\Windows\System\GRbLikC.exe
  C:\Windows\System\GRbLikC.exe
  2⤵
  PID:10552
- C:\Windows\System\VyJDIgo.exe
  C:\Windows\System\VyJDIgo.exe
  2⤵
  PID:10576
- C:\Windows\System\pUdTKEO.exe
  C:\Windows\System\pUdTKEO.exe
  2⤵
  PID:10604
- C:\Windows\System\jzRJIRX.exe
  C:\Windows\System\jzRJIRX.exe
  2⤵
  PID:10628
- C:\Windows\System\rhcKbJR.exe
  C:\Windows\System\rhcKbJR.exe
  2⤵
  PID:10652
- C:\Windows\System\xWQXixl.exe
  C:\Windows\System\xWQXixl.exe
  2⤵
  PID:10680
- C:\Windows\System\tHUqrDh.exe
  C:\Windows\System\tHUqrDh.exe
  2⤵
  PID:10700
- C:\Windows\System\HxEQIoo.exe
  C:\Windows\System\HxEQIoo.exe
  2⤵
  PID:10732
- C:\Windows\System\nAsPbCb.exe
  C:\Windows\System\nAsPbCb.exe
  2⤵
  PID:10756
- C:\Windows\System\cQcHuXE.exe
  C:\Windows\System\cQcHuXE.exe
  2⤵
  PID:10780
- C:\Windows\System\kuNPVSZ.exe
  C:\Windows\System\kuNPVSZ.exe
  2⤵
  PID:10800
- C:\Windows\System\VzfEtWr.exe
  C:\Windows\System\VzfEtWr.exe
  2⤵
  PID:10828
- C:\Windows\System\wHciRFD.exe
  C:\Windows\System\wHciRFD.exe
  2⤵
  PID:10856
- C:\Windows\System\evfBIZl.exe
  C:\Windows\System\evfBIZl.exe
  2⤵
  PID:10880
- C:\Windows\System\QHSyUNV.exe
  C:\Windows\System\QHSyUNV.exe
  2⤵
  PID:10900
- C:\Windows\System\UpTNjUu.exe
  C:\Windows\System\UpTNjUu.exe
  2⤵
  PID:10924
- C:\Windows\System\NFnXCTm.exe
  C:\Windows\System\NFnXCTm.exe
  2⤵
  PID:10948
- C:\Windows\System\BpaDkaw.exe
  C:\Windows\System\BpaDkaw.exe
  2⤵
  PID:10964
- C:\Windows\System\SjnFaNc.exe
  C:\Windows\System\SjnFaNc.exe
  2⤵
  PID:10980
- C:\Windows\System\fOvYUNd.exe
  C:\Windows\System\fOvYUNd.exe
  2⤵
  PID:11008
- C:\Windows\System\ZiBrwDq.exe
  C:\Windows\System\ZiBrwDq.exe
  2⤵
  PID:11024
- C:\Windows\System\lEoQmcF.exe
  C:\Windows\System\lEoQmcF.exe
  2⤵
  PID:11044
- C:\Windows\System\lqpurCe.exe
  C:\Windows\System\lqpurCe.exe
  2⤵
  PID:11060
- C:\Windows\System\wVduAnI.exe
  C:\Windows\System\wVduAnI.exe
  2⤵
  PID:11080
- C:\Windows\System\ELUirGN.exe
  C:\Windows\System\ELUirGN.exe
  2⤵
  PID:11104
- C:\Windows\System\IEvbOqe.exe
  C:\Windows\System\IEvbOqe.exe
  2⤵
  PID:11132
- C:\Windows\System\pDOIsZg.exe
  C:\Windows\System\pDOIsZg.exe
  2⤵
  PID:11152
- C:\Windows\System\nCaATGl.exe
  C:\Windows\System\nCaATGl.exe
  2⤵
  PID:11176
- C:\Windows\System\pMJgYZN.exe
  C:\Windows\System\pMJgYZN.exe
  2⤵
  PID:11204
- C:\Windows\System\FKEjesF.exe
  C:\Windows\System\FKEjesF.exe
  2⤵
  PID:11240
- C:\Windows\System\xFLwVPp.exe
  C:\Windows\System\xFLwVPp.exe
  2⤵
  PID:11260
- C:\Windows\System\RWNdgXF.exe
  C:\Windows\System\RWNdgXF.exe
  2⤵
  PID:8804
- C:\Windows\System\nvSVPSt.exe
  C:\Windows\System\nvSVPSt.exe
  2⤵
  PID:9084
- C:\Windows\System\VCYEmnT.exe
  C:\Windows\System\VCYEmnT.exe
  2⤵
  PID:8132
- C:\Windows\System\CmmOvgN.exe
  C:\Windows\System\CmmOvgN.exe
  2⤵
  PID:9508
- C:\Windows\System\cjhhTht.exe
  C:\Windows\System\cjhhTht.exe
  2⤵
  PID:9800
- C:\Windows\System\VwvgMlx.exe
  C:\Windows\System\VwvgMlx.exe
  2⤵
  PID:9900
- C:\Windows\System\TkpLWka.exe
  C:\Windows\System\TkpLWka.exe
  2⤵
  PID:9676
- C:\Windows\System\MFvTjVU.exe
  C:\Windows\System\MFvTjVU.exe
  2⤵
  PID:10056
- C:\Windows\System\LJDONAk.exe
  C:\Windows\System\LJDONAk.exe
  2⤵
  PID:9632
- C:\Windows\System\RCGDdlN.exe
  C:\Windows\System\RCGDdlN.exe
  2⤵
  PID:9588
- C:\Windows\System\bcImZPa.exe
  C:\Windows\System\bcImZPa.exe
  2⤵
  PID:8356
- C:\Windows\System\NkGKFiz.exe
  C:\Windows\System\NkGKFiz.exe
  2⤵
  PID:9048
- C:\Windows\System\vvATyue.exe
  C:\Windows\System\vvATyue.exe
  2⤵
  PID:7996
- C:\Windows\System\bGAJEqJ.exe
  C:\Windows\System\bGAJEqJ.exe
  2⤵
  PID:9560
- C:\Windows\System\JAmqqjq.exe
  C:\Windows\System\JAmqqjq.exe
  2⤵
  PID:10660
- C:\Windows\System\cnRdMtb.exe
  C:\Windows\System\cnRdMtb.exe
  2⤵
  PID:10720
- C:\Windows\System\ryCgeKh.exe
  C:\Windows\System\ryCgeKh.exe
  2⤵
  PID:10772
- C:\Windows\System\rQjMohQ.exe
  C:\Windows\System\rQjMohQ.exe
  2⤵
  PID:10792
- C:\Windows\System\QqmYyNq.exe
  C:\Windows\System\QqmYyNq.exe
  2⤵
  PID:5876
- C:\Windows\System\mLPrRiL.exe
  C:\Windows\System\mLPrRiL.exe
  2⤵
  PID:10896
- C:\Windows\System\LzyCzVz.exe
  C:\Windows\System\LzyCzVz.exe
  2⤵
  PID:10944
- C:\Windows\System\gJRrCOe.exe
  C:\Windows\System\gJRrCOe.exe
  2⤵
  PID:10384
- C:\Windows\System\uPGaxUW.exe
  C:\Windows\System\uPGaxUW.exe
  2⤵
  PID:11276
- C:\Windows\System\aXdLFQb.exe
  C:\Windows\System\aXdLFQb.exe
  2⤵
  PID:11304
- C:\Windows\System\QsCWmQx.exe
  C:\Windows\System\QsCWmQx.exe
  2⤵
  PID:11324
- C:\Windows\System\yQyehSd.exe
  C:\Windows\System\yQyehSd.exe
  2⤵
  PID:11356
- C:\Windows\System\RmjTTzi.exe
  C:\Windows\System\RmjTTzi.exe
  2⤵
  PID:11384
- C:\Windows\System\momeZDi.exe
  C:\Windows\System\momeZDi.exe
  2⤵
  PID:11408
- C:\Windows\System\ojBURpa.exe
  C:\Windows\System\ojBURpa.exe
  2⤵
  PID:11436
- C:\Windows\System\KWNutIk.exe
  C:\Windows\System\KWNutIk.exe
  2⤵
  PID:11464
- C:\Windows\System\EHNMrUf.exe
  C:\Windows\System\EHNMrUf.exe
  2⤵
  PID:11484
- C:\Windows\System\ZTqwMUd.exe
  C:\Windows\System\ZTqwMUd.exe
  2⤵
  PID:11504
- C:\Windows\System\UGWWbIQ.exe
  C:\Windows\System\UGWWbIQ.exe
  2⤵
  PID:11528
- C:\Windows\System\kSjPRkw.exe
  C:\Windows\System\kSjPRkw.exe
  2⤵
  PID:11556
- C:\Windows\System\KBjCYDl.exe
  C:\Windows\System\KBjCYDl.exe
  2⤵
  PID:11572
- C:\Windows\System\plgkFvl.exe
  C:\Windows\System\plgkFvl.exe
  2⤵
  PID:11592
- C:\Windows\System\UIATLbn.exe
  C:\Windows\System\UIATLbn.exe
  2⤵
  PID:11608
- C:\Windows\System\MFomhSd.exe
  C:\Windows\System\MFomhSd.exe
  2⤵
  PID:11624
- C:\Windows\System\nJXwVIg.exe
  C:\Windows\System\nJXwVIg.exe
  2⤵
  PID:11644
- C:\Windows\System\lWIcVjp.exe
  C:\Windows\System\lWIcVjp.exe
  2⤵
  PID:11664
- C:\Windows\System\KFOhneJ.exe
  C:\Windows\System\KFOhneJ.exe
  2⤵
  PID:11680
- C:\Windows\System\yhfaDOu.exe
  C:\Windows\System\yhfaDOu.exe
  2⤵
  PID:11696
- C:\Windows\System\LsYwxSa.exe
  C:\Windows\System\LsYwxSa.exe
  2⤵
  PID:11716
- C:\Windows\System\gwLBEGQ.exe
  C:\Windows\System\gwLBEGQ.exe
  2⤵
  PID:11740
- C:\Windows\System\cLmcDDA.exe
  C:\Windows\System\cLmcDDA.exe
  2⤵
  PID:11768
- C:\Windows\System\dNfcTqZ.exe
  C:\Windows\System\dNfcTqZ.exe
  2⤵
  PID:11788
- C:\Windows\System\YZfFXjt.exe
  C:\Windows\System\YZfFXjt.exe
  2⤵
  PID:11812
- C:\Windows\System\ctmhnUj.exe
  C:\Windows\System\ctmhnUj.exe
  2⤵
  PID:11836
- C:\Windows\System\mkIrEMv.exe
  C:\Windows\System\mkIrEMv.exe
  2⤵
  PID:11856
- C:\Windows\System\QGuCdNE.exe
  C:\Windows\System\QGuCdNE.exe
  2⤵
  PID:11884
- C:\Windows\System\avYsGXm.exe
  C:\Windows\System\avYsGXm.exe
  2⤵
  PID:11908
- C:\Windows\System\suQnrBY.exe
  C:\Windows\System\suQnrBY.exe
  2⤵
  PID:11940
- C:\Windows\System\sOtQXNX.exe
  C:\Windows\System\sOtQXNX.exe
  2⤵
  PID:11960
- C:\Windows\System\wnWxBfg.exe
  C:\Windows\System\wnWxBfg.exe
  2⤵
  PID:11984
- C:\Windows\System\qGcfUqb.exe
  C:\Windows\System\qGcfUqb.exe
  2⤵
  PID:12004
- C:\Windows\System\EzkwVzZ.exe
  C:\Windows\System\EzkwVzZ.exe
  2⤵
  PID:12032
- C:\Windows\System\uzaUKJg.exe
  C:\Windows\System\uzaUKJg.exe
  2⤵
  PID:12060
- C:\Windows\System\KTZuaLX.exe
  C:\Windows\System\KTZuaLX.exe
  2⤵
  PID:12080
- C:\Windows\System\VFVbQkh.exe
  C:\Windows\System\VFVbQkh.exe
  2⤵
  PID:12104
- C:\Windows\System\YlSzfvO.exe
  C:\Windows\System\YlSzfvO.exe
  2⤵
  PID:12128
- C:\Windows\System\fVxQXcU.exe
  C:\Windows\System\fVxQXcU.exe
  2⤵
  PID:12148
- C:\Windows\System\XmRhMln.exe
  C:\Windows\System\XmRhMln.exe
  2⤵
  PID:12180
- C:\Windows\System\joLdmNN.exe
  C:\Windows\System\joLdmNN.exe
  2⤵
  PID:12204
- C:\Windows\System\qpbHJPb.exe
  C:\Windows\System\qpbHJPb.exe
  2⤵
  PID:12232
- C:\Windows\System\phThkTc.exe
  C:\Windows\System\phThkTc.exe
  2⤵
  PID:12260
- C:\Windows\System\baXAEZY.exe
  C:\Windows\System\baXAEZY.exe
  2⤵
  PID:12280
- C:\Windows\System\rTRRMUI.exe
  C:\Windows\System\rTRRMUI.exe
  2⤵
  PID:8052
- C:\Windows\System\ABeygTN.exe
  C:\Windows\System\ABeygTN.exe
  2⤵
  PID:11172
- C:\Windows\System\pJjsbYA.exe
  C:\Windows\System\pJjsbYA.exe
  2⤵
  PID:10528
- C:\Windows\System\BkcQGek.exe
  C:\Windows\System\BkcQGek.exe
  2⤵
  PID:9556
- C:\Windows\System\FruOaZJ.exe
  C:\Windows\System\FruOaZJ.exe
  2⤵
  PID:10616
- C:\Windows\System\BNXMvUU.exe
  C:\Windows\System\BNXMvUU.exe
  2⤵
  PID:8312
- C:\Windows\System\aHNVJht.exe
  C:\Windows\System\aHNVJht.exe
  2⤵
  PID:9468
- C:\Windows\System\sQzrVKD.exe
  C:\Windows\System\sQzrVKD.exe
  2⤵
  PID:9940
- C:\Windows\System\ITlAIDu.exe
  C:\Windows\System\ITlAIDu.exe
  2⤵
  PID:10128
- C:\Windows\System\lniNCgO.exe
  C:\Windows\System\lniNCgO.exe
  2⤵
  PID:10260
- C:\Windows\System\rCjHyCd.exe
  C:\Windows\System\rCjHyCd.exe
  2⤵
  PID:10368
- C:\Windows\System\cBvekeb.exe
  C:\Windows\System\cBvekeb.exe
  2⤵
  PID:9680
- C:\Windows\System\JVDBMZH.exe
  C:\Windows\System\JVDBMZH.exe
  2⤵
  PID:10340
- C:\Windows\System\EYnYCUP.exe
  C:\Windows\System\EYnYCUP.exe
  2⤵
  PID:10988
- C:\Windows\System\gdtebfs.exe
  C:\Windows\System\gdtebfs.exe
  2⤵
  PID:11052
- C:\Windows\System\XzHxmvL.exe
  C:\Windows\System\XzHxmvL.exe
  2⤵
  PID:11072
- C:\Windows\System\TCkvGxU.exe
  C:\Windows\System\TCkvGxU.exe
  2⤵
  PID:11376
- C:\Windows\System\xZwUlKY.exe
  C:\Windows\System\xZwUlKY.exe
  2⤵
  PID:11212
- C:\Windows\System\msZzKKl.exe
  C:\Windows\System\msZzKKl.exe
  2⤵
  PID:11548
- C:\Windows\System\uNAGvGT.exe
  C:\Windows\System\uNAGvGT.exe
  2⤵
  PID:8408
- C:\Windows\System\uFRuwvo.exe
  C:\Windows\System\uFRuwvo.exe
  2⤵
  PID:11616
- C:\Windows\System\rSPbpwi.exe
  C:\Windows\System\rSPbpwi.exe
  2⤵
  PID:11676
- C:\Windows\System\TLTdRJt.exe
  C:\Windows\System\TLTdRJt.exe
  2⤵
  PID:10676
- C:\Windows\System\hoZEOlO.exe
  C:\Windows\System\hoZEOlO.exe
  2⤵
  PID:10004
- C:\Windows\System\xuxrBCQ.exe
  C:\Windows\System\xuxrBCQ.exe
  2⤵
  PID:12292
- C:\Windows\System\dyEfpnD.exe
  C:\Windows\System\dyEfpnD.exe
  2⤵
  PID:12308
- C:\Windows\System\PMywvuy.exe
  C:\Windows\System\PMywvuy.exe
  2⤵
  PID:12328
- C:\Windows\System\QtcNjHD.exe
  C:\Windows\System\QtcNjHD.exe
  2⤵
  PID:12356
- C:\Windows\System\EwZhmdL.exe
  C:\Windows\System\EwZhmdL.exe
  2⤵
  PID:12376
- C:\Windows\System\UnkDXoK.exe
  C:\Windows\System\UnkDXoK.exe
  2⤵
  PID:12400
- C:\Windows\System\rdarTUm.exe
  C:\Windows\System\rdarTUm.exe
  2⤵
  PID:12428
- C:\Windows\System\KEvQdDh.exe
  C:\Windows\System\KEvQdDh.exe
  2⤵
  PID:12456
- C:\Windows\System\QPLBtTT.exe
  C:\Windows\System\QPLBtTT.exe
  2⤵
  PID:12480
- C:\Windows\System\cPULNKe.exe
  C:\Windows\System\cPULNKe.exe
  2⤵
  PID:12508
- C:\Windows\System\tGwYkNx.exe
  C:\Windows\System\tGwYkNx.exe
  2⤵
  PID:12536
- C:\Windows\System\WFzmfHB.exe
  C:\Windows\System\WFzmfHB.exe
  2⤵
  PID:12552
- C:\Windows\System\JxCkBHb.exe
  C:\Windows\System\JxCkBHb.exe
  2⤵
  PID:12580
- C:\Windows\System\DJfPrJN.exe
  C:\Windows\System\DJfPrJN.exe
  2⤵
  PID:12604
- C:\Windows\System\XQLnYFC.exe
  C:\Windows\System\XQLnYFC.exe
  2⤵
  PID:12632
- C:\Windows\System\uzPTUlc.exe
  C:\Windows\System\uzPTUlc.exe
  2⤵
  PID:12660
- C:\Windows\System\DuzFcWH.exe
  C:\Windows\System\DuzFcWH.exe
  2⤵
  PID:12680
- C:\Windows\System\oUKpJue.exe
  C:\Windows\System\oUKpJue.exe
  2⤵
  PID:12712
- C:\Windows\System\KoaThms.exe
  C:\Windows\System\KoaThms.exe
  2⤵
  PID:12736
- C:\Windows\System\TfUbgBL.exe
  C:\Windows\System\TfUbgBL.exe
  2⤵
  PID:12756
- C:\Windows\System\JMgPolo.exe
  C:\Windows\System\JMgPolo.exe
  2⤵
  PID:12776
- C:\Windows\System\DaxHOkK.exe
  C:\Windows\System\DaxHOkK.exe
  2⤵
  PID:12808
- C:\Windows\System\JHItVWB.exe
  C:\Windows\System\JHItVWB.exe
  2⤵
  PID:12828
- C:\Windows\System\xIKGGDU.exe
  C:\Windows\System\xIKGGDU.exe
  2⤵
  PID:12848
- C:\Windows\System\qlNiIWt.exe
  C:\Windows\System\qlNiIWt.exe
  2⤵
  PID:12876
- C:\Windows\System\hedaONL.exe
  C:\Windows\System\hedaONL.exe
  2⤵
  PID:12896
- C:\Windows\System\fALCsQU.exe
  C:\Windows\System\fALCsQU.exe
  2⤵
  PID:12920
- C:\Windows\System\VzzIWUP.exe
  C:\Windows\System\VzzIWUP.exe
  2⤵
  PID:12940
- C:\Windows\System\PZegYqQ.exe
  C:\Windows\System\PZegYqQ.exe
  2⤵
  PID:12968
- C:\Windows\System\NvWfjNA.exe
  C:\Windows\System\NvWfjNA.exe
  2⤵
  PID:13216
- C:\Windows\System\aUhpgEQ.exe
  C:\Windows\System\aUhpgEQ.exe
  2⤵
  PID:13248
- C:\Windows\System\BsiVvYX.exe
  C:\Windows\System\BsiVvYX.exe
  2⤵
  PID:13300
- C:\Windows\System\FJXKriH.exe
  C:\Windows\System\FJXKriH.exe
  2⤵
  PID:11424
- C:\Windows\System\VrfjfZK.exe
  C:\Windows\System\VrfjfZK.exe
  2⤵
  PID:12916
- C:\Windows\System\ozqCJlP.exe
  C:\Windows\System\ozqCJlP.exe
  2⤵
  PID:10696
- C:\Windows\System\wwyKEQh.exe
  C:\Windows\System\wwyKEQh.exe
  2⤵
  PID:12792
- C:\Windows\System\pApCCNe.exe
  C:\Windows\System\pApCCNe.exe
  2⤵
  PID:12952
- C:\Windows\System\ZXtQdPO.exe
  C:\Windows\System\ZXtQdPO.exe
  2⤵
  PID:11828
- C:\Windows\System\fSrpfVB.exe
  C:\Windows\System\fSrpfVB.exe
  2⤵
  PID:12120
- C:\Windows\System\MWnRXjH.exe
  C:\Windows\System\MWnRXjH.exe
  2⤵
  PID:10560
- C:\Windows\System\lkzRaeM.exe
  C:\Windows\System\lkzRaeM.exe
  2⤵
  PID:10844
- C:\Windows\System\BhvWCvL.exe
  C:\Windows\System\BhvWCvL.exe
  2⤵
  PID:13228
- C:\Windows\System\JHaTFju.exe
  C:\Windows\System\JHaTFju.exe
  2⤵
  PID:10308
- C:\Windows\System\aDMsfOp.exe
  C:\Windows\System\aDMsfOp.exe
  2⤵
  PID:3708
- C:\Windows\System\EEyrVnr.exe
  C:\Windows\System\EEyrVnr.exe
  2⤵
  PID:11312
- C:\Windows\System\zhgdMLx.exe
  C:\Windows\System\zhgdMLx.exe
  2⤵
  PID:11760
- C:\Windows\System\DlCKeYp.exe
  C:\Windows\System\DlCKeYp.exe
  2⤵
  PID:12464
- C:\Windows\System\PTWYlXd.exe
  C:\Windows\System\PTWYlXd.exe
  2⤵
  PID:12596
- C:\Windows\System\cUerdiZ.exe
  C:\Windows\System\cUerdiZ.exe
  2⤵
  PID:12732
- C:\Windows\System\tnJGtrf.exe
  C:\Windows\System\tnJGtrf.exe
  2⤵
  PID:12868
- C:\Windows\System\MJduFVY.exe
  C:\Windows\System\MJduFVY.exe
  2⤵
  PID:13280
- C:\Windows\System\TcMZlCG.exe
  C:\Windows\System\TcMZlCG.exe
  2⤵
  PID:9724
- C:\Windows\System\vTKGOoI.exe
  C:\Windows\System\vTKGOoI.exe
  2⤵
  PID:10500
- C:\Windows\System\hKyeMUW.exe
  C:\Windows\System\hKyeMUW.exe
  2⤵
  PID:11344
- C:\Windows\System\AyLdbQL.exe
  C:\Windows\System\AyLdbQL.exe
  2⤵
  PID:7828
- C:\Windows\System\XjRZfqU.exe
  C:\Windows\System\XjRZfqU.exe
  2⤵
  PID:11416
- C:\Windows\System\tFntZHM.exe
  C:\Windows\System\tFntZHM.exe
  2⤵
  PID:13192
- C:\Windows\System\bZiBXnV.exe
  C:\Windows\System\bZiBXnV.exe
  2⤵
  PID:6776
- C:\Windows\System\DXpRerK.exe
  C:\Windows\System\DXpRerK.exe
  2⤵
  PID:5628
- C:\Windows\System\AncMsAi.exe
  C:\Windows\System\AncMsAi.exe
  2⤵
  PID:11032
- C:\Windows\System\wUCBaPo.exe
  C:\Windows\System\wUCBaPo.exe
  2⤵
  PID:11444
- C:\Windows\System\JoObnck.exe
  C:\Windows\System\JoObnck.exe
  2⤵
  PID:11520
- C:\Windows\System\PTGucVK.exe
  C:\Windows\System\PTGucVK.exe
  2⤵
  PID:11732
- C:\Windows\System\nAeqQjR.exe
  C:\Windows\System\nAeqQjR.exe
  2⤵
  PID:11852
- C:\Windows\System\JiPaQOA.exe
  C:\Windows\System\JiPaQOA.exe
  2⤵
  PID:12244
- C:\Windows\System\TttFpRf.exe
  C:\Windows\System\TttFpRf.exe
  2⤵
  PID:12936
- C:\Windows\System\FeDxcCu.exe
  C:\Windows\System\FeDxcCu.exe
  2⤵
  PID:12500
- C:\Windows\System\ZbtRnCA.exe
  C:\Windows\System\ZbtRnCA.exe
  2⤵
  PID:11692
- C:\Windows\System\raYqtce.exe
  C:\Windows\System\raYqtce.exe
  2⤵
  PID:10892
- C:\Windows\System\KIIhjyt.exe
  C:\Windows\System\KIIhjyt.exe
  2⤵
  PID:10940
- C:\Windows\System\EJzllyV.exe
  C:\Windows\System\EJzllyV.exe
  2⤵
  PID:12412
- C:\Windows\System\LWYTErB.exe
  C:\Windows\System\LWYTErB.exe
  2⤵
  PID:12728
- C:\Windows\System\DtTtRBh.exe
  C:\Windows\System\DtTtRBh.exe
  2⤵
  PID:10132
- C:\Windows\System\HeuyrKA.exe
  C:\Windows\System\HeuyrKA.exe
  2⤵
  PID:12772
- C:\Windows\System\vJwoOTE.exe
  C:\Windows\System\vJwoOTE.exe
  2⤵
  PID:12668
- C:\Windows\System\OgOFvGA.exe
  C:\Windows\System\OgOFvGA.exe
  2⤵
  PID:10668
- C:\Windows\System\SpvkCzu.exe
  C:\Windows\System\SpvkCzu.exe
  2⤵
  PID:7532
- C:\Windows\System\wMIaJDH.exe
  C:\Windows\System\wMIaJDH.exe
  2⤵
  PID:12272
- C:\Windows\System\ioASaZf.exe
  C:\Windows\System\ioASaZf.exe
  2⤵
  PID:12844
- C:\Windows\System\oJKdbyB.exe
  C:\Windows\System\oJKdbyB.exe
  2⤵
  PID:9876
- C:\Windows\System\IKSghaI.exe
  C:\Windows\System\IKSghaI.exe
  2⤵
  PID:10044
- C:\Windows\System\aPEhbgO.exe
  C:\Windows\System\aPEhbgO.exe
  2⤵
  PID:13268
- C:\Windows\System\WjKEaxm.exe
  C:\Windows\System\WjKEaxm.exe
  2⤵
  PID:1484
- C:\Windows\System\GvMmnvk.exe
  C:\Windows\System\GvMmnvk.exe
  2⤵
  PID:12488
- C:\Windows\System\olPVQbK.exe
  C:\Windows\System\olPVQbK.exe
  2⤵
  PID:10708
- C:\Windows\System\pNmzPEU.exe
  C:\Windows\System\pNmzPEU.exe
  2⤵
  PID:10648
- C:\Windows\System\GbCJyrq.exe
  C:\Windows\System\GbCJyrq.exe
  2⤵
  PID:12368
- C:\Windows\System\QgzgBIK.exe
  C:\Windows\System\QgzgBIK.exe
  2⤵
  PID:11736
- C:\Windows\System\EeZdOZd.exe
  C:\Windows\System\EeZdOZd.exe
  2⤵
  PID:12316
- C:\Windows\System\ZQiBfMn.exe
  C:\Windows\System\ZQiBfMn.exe
  2⤵
  PID:6572
- C:\Windows\System\KjNUkot.exe
  C:\Windows\System\KjNUkot.exe
  2⤵
  PID:11000
- C:\Windows\System\rWamEax.exe
  C:\Windows\System\rWamEax.exe
  2⤵
  PID:4420
- C:\Windows\System\ROXOBzz.exe
  C:\Windows\System\ROXOBzz.exe
  2⤵
  PID:5564
- C:\Windows\System\YqSGlxi.exe
  C:\Windows\System\YqSGlxi.exe
  2⤵
  PID:12948
- C:\Windows\System\lkOVQTP.exe
  C:\Windows\System\lkOVQTP.exe
  2⤵
  PID:5800
- C:\Windows\System\IQdXPzI.exe
  C:\Windows\System\IQdXPzI.exe
  2⤵
  PID:11496
- C:\Windows\System\gFvIplg.exe
  C:\Windows\System\gFvIplg.exe
  2⤵
  PID:10872
- C:\Windows\System\HuhGUQq.exe
  C:\Windows\System\HuhGUQq.exe
  2⤵
  PID:4428
- C:\Windows\System\lFnKUas.exe
  C:\Windows\System\lFnKUas.exe
  2⤵
  PID:12416
- C:\Windows\System\tjeNTpg.exe
  C:\Windows\System\tjeNTpg.exe
  2⤵
  PID:13156
- C:\Windows\System\dpZrXdu.exe
  C:\Windows\System\dpZrXdu.exe
  2⤵
  PID:11784
- C:\Windows\System\KMWDUyY.exe
  C:\Windows\System\KMWDUyY.exe
  2⤵
  PID:11124
- C:\Windows\System\quDwToC.exe
  C:\Windows\System\quDwToC.exe
  2⤵
  PID:11068
- C:\Windows\System\OyGpkyC.exe
  C:\Windows\System\OyGpkyC.exe
  2⤵
  PID:12216
- C:\Windows\System\dZojYLO.exe
  C:\Windows\System\dZojYLO.exe
  2⤵
  PID:12040
- C:\Windows\System\IYdTawe.exe
  C:\Windows\System\IYdTawe.exe
  2⤵
  PID:12892
- C:\Windows\System\xJNSwPZ.exe
  C:\Windows\System\xJNSwPZ.exe
  2⤵
  PID:12044
- C:\Windows\System\blccDhZ.exe
  C:\Windows\System\blccDhZ.exe
  2⤵
  PID:5504
- C:\Windows\System\JmwZnoJ.exe
  C:\Windows\System\JmwZnoJ.exe
  2⤵
  PID:5516
- C:\Windows\System\tseDzLf.exe
  C:\Windows\System\tseDzLf.exe
  2⤵
  PID:3192
- C:\Windows\System\BjNVdYg.exe
  C:\Windows\System\BjNVdYg.exe
  2⤵
  PID:4192
- C:\Windows\System\eqqkaIF.exe
  C:\Windows\System\eqqkaIF.exe
  2⤵
  PID:11316
- C:\Windows\System\WMWMXGg.exe
  C:\Windows\System\WMWMXGg.exe
  2⤵
  PID:5512
- C:\Windows\System\mGXyDae.exe
  C:\Windows\System\mGXyDae.exe
  2⤵
  PID:5456
- C:\Windows\System\LWVVUYT.exe
  C:\Windows\System\LWVVUYT.exe
  2⤵
  PID:3332
- C:\Windows\System\mCsWQDr.exe
  C:\Windows\System\mCsWQDr.exe
  2⤵
  PID:1092
- C:\Windows\System\FrncCmQ.exe
  C:\Windows\System\FrncCmQ.exe
  2⤵
  PID:824
- C:\Windows\System\KQwnaAn.exe
  C:\Windows\System\KQwnaAn.exe
  2⤵
  PID:3164
- C:\Windows\System\ZhacLGL.exe
  C:\Windows\System\ZhacLGL.exe
  2⤵
  PID:2092
- C:\Windows\System\anFMhqY.exe
  C:\Windows\System\anFMhqY.exe
  2⤵
  PID:556
- C:\Windows\System\VtGKNSs.exe
  C:\Windows\System\VtGKNSs.exe
  2⤵
  PID:4236
- C:\Windows\System\JJWQSYM.exe
  C:\Windows\System\JJWQSYM.exe
  2⤵
  PID:4116
- C:\Windows\System\hPTqOFI.exe
  C:\Windows\System\hPTqOFI.exe
  2⤵
  PID:4112
- C:\Windows\System\FZDmuoQ.exe
  C:\Windows\System\FZDmuoQ.exe
  2⤵
  PID:5032
- C:\Windows\System\eSMdtgT.exe
  C:\Windows\System\eSMdtgT.exe
  2⤵
  PID:4772
- C:\Windows\System\vTGxhbA.exe
  C:\Windows\System\vTGxhbA.exe
  2⤵
  PID:5508
- C:\Windows\System\dxPqNhx.exe
  C:\Windows\System\dxPqNhx.exe
  2⤵
  PID:4232
- C:\Windows\System\ioIzgUy.exe
  C:\Windows\System\ioIzgUy.exe
  2⤵
  PID:2760
- C:\Windows\System\ZRyLWql.exe
  C:\Windows\System\ZRyLWql.exe
  2⤵
  PID:3508
- C:\Windows\System\PsmGNHB.exe
  C:\Windows\System\PsmGNHB.exe
  2⤵
  PID:2784
- C:\Windows\System\UjRIQen.exe
  C:\Windows\System\UjRIQen.exe
  2⤵
  PID:528
- C:\Windows\System\eWnGUrQ.exe
  C:\Windows\System\eWnGUrQ.exe
  2⤵
  PID:2688
- C:\Windows\System\XXvTVHM.exe
  C:\Windows\System\XXvTVHM.exe
  2⤵
  PID:2780
- C:\Windows\System\IjTFDLP.exe
  C:\Windows\System\IjTFDLP.exe
  2⤵
  PID:4060
- C:\Windows\System\MstBbMK.exe
  C:\Windows\System\MstBbMK.exe
  2⤵
  PID:4248
- C:\Windows\System\FMALQHb.exe
  C:\Windows\System\FMALQHb.exe
  2⤵
  PID:4056
- C:\Windows\System\pILqejs.exe
  C:\Windows\System\pILqejs.exe
  2⤵
  PID:6940
- C:\Windows\System\lEZWxsC.exe
  C:\Windows\System\lEZWxsC.exe
  2⤵
  PID:4500
- C:\Windows\System\qxELyaB.exe
  C:\Windows\System\qxELyaB.exe
  2⤵
  PID:4092
- C:\Windows\System\AeguQKy.exe
  C:\Windows\System\AeguQKy.exe
  2⤵
  PID:1200
- C:\Windows\System\TYcSBCt.exe
  C:\Windows\System\TYcSBCt.exe
  2⤵
  PID:4108
- C:\Windows\System\NFkDKyW.exe
  C:\Windows\System\NFkDKyW.exe
  2⤵
  PID:4104
- C:\Windows\System\uDePgGH.exe
  C:\Windows\System\uDePgGH.exe
  2⤵
  PID:5036
- C:\Windows\System\uaRpVzn.exe
  C:\Windows\System\uaRpVzn.exe
  2⤵
  PID:13328
- C:\Windows\System\TkUfUmW.exe
  C:\Windows\System\TkUfUmW.exe
  2⤵
  PID:13384
- C:\Windows\System\UCPThoD.exe
  C:\Windows\System\UCPThoD.exe
  2⤵
  PID:13400
- C:\Windows\System\yTfyLwS.exe
  C:\Windows\System\yTfyLwS.exe
  2⤵
  PID:13424
- C:\Windows\System\nlVBMgI.exe
  C:\Windows\System\nlVBMgI.exe
  2⤵
  PID:13448
- C:\Windows\System\VXkKUeL.exe
  C:\Windows\System\VXkKUeL.exe
  2⤵
  PID:13480
- C:\Windows\System\MiKpVed.exe
  C:\Windows\System\MiKpVed.exe
  2⤵
  PID:13496
- C:\Windows\System\VviTgQw.exe
  C:\Windows\System\VviTgQw.exe
  2⤵
  PID:13520
- C:\Windows\System\WzMrSsn.exe
  C:\Windows\System\WzMrSsn.exe
  2⤵
  PID:13572
- C:\Windows\System\srbownW.exe
  C:\Windows\System\srbownW.exe
  2⤵
  PID:13612
- C:\Windows\System\wPdSUif.exe
  C:\Windows\System\wPdSUif.exe
  2⤵
  PID:13644
- C:\Windows\System\XgKXdWK.exe
  C:\Windows\System\XgKXdWK.exe
  2⤵
  PID:14000
- C:\Windows\System\BkOZbzg.exe
  C:\Windows\System\BkOZbzg.exe
  2⤵
  PID:14156
- C:\Windows\System\diJfWEm.exe
  C:\Windows\System\diJfWEm.exe
  2⤵
  PID:14176
- C:\Windows\System\UyPbPcr.exe
  C:\Windows\System\UyPbPcr.exe
  2⤵
  PID:14248
- C:\Windows\System\KyljHOK.exe
  C:\Windows\System\KyljHOK.exe
  2⤵
  PID:14264
- C:\Windows\System\LQufScK.exe
  C:\Windows\System\LQufScK.exe
  2⤵
  PID:14284
- C:\Windows\System\HbRZNpY.exe
  C:\Windows\System\HbRZNpY.exe
  2⤵
  PID:14312
- C:\Windows\System\XTcmiRs.exe
  C:\Windows\System\XTcmiRs.exe
  2⤵
  PID:14324
- C:\Windows\System\KfzsPMF.exe
  C:\Windows\System\KfzsPMF.exe
  2⤵
  PID:13316
- C:\Windows\System\DocKRQg.exe
  C:\Windows\System\DocKRQg.exe
  2⤵
  PID:13360
- C:\Windows\System\ThheNqX.exe
  C:\Windows\System\ThheNqX.exe
  2⤵
  PID:13376
- C:\Windows\System\CHQTehO.exe
  C:\Windows\System\CHQTehO.exe
  2⤵
  PID:13444
- C:\Windows\System\tBaJGGj.exe
  C:\Windows\System\tBaJGGj.exe
  2⤵
  PID:13464
- C:\Windows\System\gejXkWl.exe
  C:\Windows\System\gejXkWl.exe
  2⤵
  PID:13536
- C:\Windows\System\hBqlFPG.exe
  C:\Windows\System\hBqlFPG.exe
  2⤵
  PID:13548
- C:\Windows\System\OhVHSSp.exe
  C:\Windows\System\OhVHSSp.exe
  2⤵
  PID:13592
- C:\Windows\System\vGRWVrU.exe
  C:\Windows\System\vGRWVrU.exe
  2⤵
  PID:13628
- C:\Windows\System\RvFfOZQ.exe
  C:\Windows\System\RvFfOZQ.exe
  2⤵
  PID:13668
- C:\Windows\System\HFLSVHy.exe
  C:\Windows\System\HFLSVHy.exe
  2⤵
  PID:13688
- C:\Windows\System\xXlfncH.exe
  C:\Windows\System\xXlfncH.exe
  2⤵
  PID:13716
- C:\Windows\System\OKpfxhT.exe
  C:\Windows\System\OKpfxhT.exe
  2⤵
  PID:13744
- C:\Windows\System\aaOYQid.exe
  C:\Windows\System\aaOYQid.exe
  2⤵
  PID:13768
- C:\Windows\System\DrenHgB.exe
  C:\Windows\System\DrenHgB.exe
  2⤵
  PID:13796
- C:\Windows\System\bzhogxQ.exe
  C:\Windows\System\bzhogxQ.exe
  2⤵
  PID:13824
- C:\Windows\System\PmTGtRy.exe
  C:\Windows\System\PmTGtRy.exe
  2⤵
  PID:13844
- C:\Windows\System\eVVoxRd.exe
  C:\Windows\System\eVVoxRd.exe
  2⤵
  PID:2120
- C:\Windows\System\eCqMWDW.exe
  C:\Windows\System\eCqMWDW.exe
  2⤵
  PID:4512
- C:\Windows\System\KRReffw.exe
  C:\Windows\System\KRReffw.exe
  2⤵
  PID:13852
- C:\Windows\System\RchBgeO.exe
  C:\Windows\System\RchBgeO.exe
  2⤵
  PID:13904
- C:\Windows\System\iyWIkne.exe
  C:\Windows\System\iyWIkne.exe
  2⤵
  PID:13932
- C:\Windows\System\BsWYCVJ.exe
  C:\Windows\System\BsWYCVJ.exe
  2⤵
  PID:13960
- C:\Windows\System\bRjuQuv.exe
  C:\Windows\System\bRjuQuv.exe
  2⤵
  PID:5084
- C:\Windows\System\QZZrKQM.exe
  C:\Windows\System\QZZrKQM.exe
  2⤵
  PID:5100
- C:\Windows\System\ZTqOJFi.exe
  C:\Windows\System\ZTqOJFi.exe
  2⤵
  PID:5720
- C:\Windows\System\uyOzqyN.exe
  C:\Windows\System\uyOzqyN.exe
  2⤵
  PID:13988
- C:\Windows\System\ZxJzTZY.exe
  C:\Windows\System\ZxJzTZY.exe
  2⤵
  PID:2624
- C:\Windows\System\VJMmMlw.exe
  C:\Windows\System\VJMmMlw.exe
  2⤵
  PID:4316
- C:\Windows\System\iawfZej.exe
  C:\Windows\System\iawfZej.exe
  2⤵
  PID:14028
- C:\Windows\System\ItbgqIE.exe
  C:\Windows\System\ItbgqIE.exe
  2⤵
  PID:14064
- C:\Windows\System\pBbtJUF.exe
  C:\Windows\System\pBbtJUF.exe
  2⤵
  PID:14092
- C:\Windows\System\jcvDFEL.exe
  C:\Windows\System\jcvDFEL.exe
  2⤵
  PID:14108
- C:\Windows\System\QCoCLcI.exe
  C:\Windows\System\QCoCLcI.exe
  2⤵
  PID:14140
- C:\Windows\System\LAPfZLZ.exe
  C:\Windows\System\LAPfZLZ.exe
  2⤵
  PID:14212
- C:\Windows\System\OhbICUy.exe
  C:\Windows\System\OhbICUy.exe
  2⤵
  PID:14228
- C:\Windows\System\kBetMro.exe
  C:\Windows\System\kBetMro.exe
  2⤵
  PID:3280
- C:\Windows\System\rHaMgaE.exe
  C:\Windows\System\rHaMgaE.exe
  2⤵
  PID:14280
- C:\Windows\System\PWSvADD.exe
  C:\Windows\System\PWSvADD.exe
  2⤵
  PID:14296
- C:\Windows\System\hXxwKxO.exe
  C:\Windows\System\hXxwKxO.exe
  2⤵
  PID:4644
- C:\Windows\System\qwXzPwC.exe
  C:\Windows\System\qwXzPwC.exe
  2⤵
  PID:2100
- C:\Windows\System\GojeeGD.exe
  C:\Windows\System\GojeeGD.exe
  2⤵
  PID:13408
- C:\Windows\System\mECOEJF.exe
  C:\Windows\System\mECOEJF.exe
  2⤵
  PID:13460
- C:\Windows\System\IuZwGTb.exe
  C:\Windows\System\IuZwGTb.exe
  2⤵
  PID:13624
- C:\Windows\System\WmHxztr.exe
  C:\Windows\System\WmHxztr.exe
  2⤵
  PID:3240
- C:\Windows\System\wxOhsEe.exe
  C:\Windows\System\wxOhsEe.exe
  2⤵
  PID:13652
- C:\Windows\System\YHGhfpH.exe
  C:\Windows\System\YHGhfpH.exe
  2⤵
  PID:13684
- C:\Windows\System\bVHenBD.exe
  C:\Windows\System\bVHenBD.exe
  2⤵
  PID:13532
- C:\Windows\System\QlbXACz.exe
  C:\Windows\System\QlbXACz.exe
  2⤵
  PID:2860
- C:\Windows\System\puyETlK.exe
  C:\Windows\System\puyETlK.exe
  2⤵
  PID:13604
- C:\Windows\System\xGKWpNv.exe
  C:\Windows\System\xGKWpNv.exe
  2⤵
  PID:13700
- C:\Windows\System\pOkVXBz.exe
  C:\Windows\System\pOkVXBz.exe
  2⤵
  PID:2996
- C:\Windows\System\kAeRPQP.exe
  C:\Windows\System\kAeRPQP.exe
  2⤵
  PID:2636
- C:\Windows\System\dPJPMiZ.exe
  C:\Windows\System\dPJPMiZ.exe
  2⤵
  PID:4768
- C:\Windows\System\TYAHqfv.exe
  C:\Windows\System\TYAHqfv.exe
  2⤵
  PID:1048
- C:\Windows\System\MOqWeSJ.exe
  C:\Windows\System\MOqWeSJ.exe
  2⤵
  PID:13820
- C:\Windows\System\oAJujxa.exe
  C:\Windows\System\oAJujxa.exe
  2⤵
  PID:3428
- C:\Windows\System\IWzeGqr.exe
  C:\Windows\System\IWzeGqr.exe
  2⤵
  PID:13888
- C:\Windows\System\cYPrMQc.exe
  C:\Windows\System\cYPrMQc.exe
  2⤵
  PID:4788
- C:\Windows\System\sMaHdVE.exe
  C:\Windows\System\sMaHdVE.exe
  2⤵
  PID:14016
- C:\Windows\System\fPaXpPQ.exe
  C:\Windows\System\fPaXpPQ.exe
  2⤵
  PID:14072
- C:\Windows\System\nwIdlik.exe
  C:\Windows\System\nwIdlik.exe
  2⤵
  PID:14192
- C:\Windows\System\BGaYPiL.exe
  C:\Windows\System\BGaYPiL.exe
  2⤵
  PID:14152
- C:\Windows\System\DIsYtOB.exe
  C:\Windows\System\DIsYtOB.exe
  2⤵
  PID:14208
- C:\Windows\System\oQWOKeJ.exe
  C:\Windows\System\oQWOKeJ.exe
  2⤵
  PID:4808
- C:\Windows\System\tkCIxsb.exe
  C:\Windows\System\tkCIxsb.exe
  2⤵
  PID:13340
- C:\Windows\System\nyGgSxr.exe
  C:\Windows\System\nyGgSxr.exe
  2⤵
  PID:3384
- C:\Windows\System\MEkNUNp.exe
  C:\Windows\System\MEkNUNp.exe
  2⤵
  PID:13920

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5508

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:64

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:6784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:12004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jg5uqifp.lba.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BUVQpkX.exe

Filesize
2.8MB

MD5
d9f08b189f698053d5ac4da72c79251c

SHA1
fd7b8b0d0399d6764d9d261609e9f88b2114ca46

SHA256
881f3f4e856d4b57fd02be0b4ccfb91f5951e54cea19c686c8b4ac5bf951e3f1

SHA512
5266dce7a698ba269e885cf068495195919608de6db47450f9a8b71a30075c6efd1a13f633d0f3c5a320e666addeb7132c2eaf5370c2fd93ae0c11052bbc1467

Download Submit
C:\Windows\System\CaeIApr.exe

Filesize
2.8MB

MD5
505a25c5a8acd49f345ebeba611e3db3

SHA1
b7adf3288262068a6c4c23f144227aaf90c6c736

SHA256
da93bd2fa5483282b4b427e15e62994f38dbb0680b7f404e244f9e5305104561

SHA512
f1d4d7068e656c3b77c541ee4ba952bf2ed217f32f9287dc9fbc2062ac5db09a9fabea1381924ad91171f9641de861fb77423e1267d9025c82784a6d9e46e369

Download Submit
C:\Windows\System\FCMTbPR.exe

Filesize
2.8MB

MD5
478b1df9a3e34b74d0e771e821438e4c

SHA1
98a7e19fe215df86ca65cf7fd94b14e7f71cf514

SHA256
032fb7491a609754273a09aadc43fa271abc811636747166538bf6f38ac1258e

SHA512
c2d40b67f6778dd29b337706ea21dfb56afaef0c45dca9c203a3c9d88665f2a0f1d79200dbc7fb636e4cea99784cc3d264b2cca407eb08f81d31b3f13a816913

Download Submit
C:\Windows\System\JSdFDeR.exe

Filesize
2.8MB

MD5
ad4cdd9a5fc3b667250173a09ae4737f

SHA1
28888f5df1dcb3fd6e856cd9838cd3a7de33bf20

SHA256
a9386b393b6eb805ca2b1717d99ed03b06707d8b8b1ac4494345a3a8f8259385

SHA512
d096630d2bc12f2637e3e310dc2d12e013bc246cf5c35dbdd687321e5beb9410b841b0ce4da1463aa38f5721095e14b511ba01af3992c0660f053a44d30db032

Download Submit
C:\Windows\System\JqICwCr.exe

Filesize
2.8MB

MD5
2d137ab449106357e5db578cd09004e3

SHA1
f67a0cc591166324cdfe54acb26205e5ac73ac8a

SHA256
2c56a095079ceebebc9b7620923964f3d8e77bccb0c014e8e9cb6565002ebeec

SHA512
70fe50d8dea0499263b7ad60497e58b9093caaf51daf384cb49089bb60b9c24f252382b58628efcf73778eaa6370b4be2adda3db29952e6fc02c040dc9fdff28

Download Submit
C:\Windows\System\KjHwLBo.exe

Filesize
2.8MB

MD5
99eac5ffd06a2205bed5251fbed2f25e

SHA1
7981697c017a3e098f52738a72b6ed919910937f

SHA256
27f8aa0bffaea1ec51297b27e4e78a33351e9248cff521ce6f46b127b4870659

SHA512
f2774147aaa5b548bf25f09f31cb6a1f13bcaef45dfed643d44a67e8b4336830d956c88ce6aff9f17e9c7b71089eba19f73fa5303806ad6a88cf09f8a3782b1a

Download Submit
C:\Windows\System\KsTUjWY.exe

Filesize
2.8MB

MD5
fb053d7b1aea15dc65728bc804e90a87

SHA1
1ca92f4146a0827a8f5fd19d2f7acf6372722b0b

SHA256
3c691dc1b2abe70f28392fffdfe2a527bdde25203dc21470b0a43a3e60ce2aaa

SHA512
8afd071e3c837be1ce081baec0719ce583cc22e434220604a0f33a0181a91117b91bf3bf1c40d84e7a85e1bc68a1ab8fb63f0a0380bc58338c6e9013f8cb044f

Download Submit
C:\Windows\System\LDQTsvv.exe

Filesize
2.8MB

MD5
aaf2b40b6c52016f84145516ccf73bce

SHA1
920f6209ed999b576f07288631c1c49b58ea491f

SHA256
85d426ea951c4d699d0fdba7cf59f1140cec0ad06dc9cc47602aaa66452943da

SHA512
96ce6ae9da41a14bfe5610939db302cf3e300875aff12cb68fc785ba02cc6e733484ee9cb60cc00278ac63d3e64d040d8f2bee7a531a1e9ecca7e9f3210d6f2e

Download Submit
C:\Windows\System\LTjMTzp.exe

Filesize
2.8MB

MD5
00de80e0d495671ad28774b980a60945

SHA1
f7ce32c44360bf95168b5306e29290fa6a717103

SHA256
26dd540c4072c6a5d06008d71fc658a7a105df1575fbcd77c518662c14858fde

SHA512
706ec76ae4bfed54a0fcd78b0d969ef47f0b6c10e50acfe242ce7fc6086e4d86410e52e2e18bfd9e527f3fcd9928c227f4b6aa1ea99d0b6c7fa7c9a7467fb735

Download Submit
C:\Windows\System\LyCeGdL.exe

Filesize
2.8MB

MD5
a5cb8e95d91892b8ed092605ac27773a

SHA1
f5645fd50e3800931670bb831f0fb102af33e5d2

SHA256
862ab992d4bbe80102d1b5a1292b6285a8d51c5fcf48905f4870ccdf7f452c38

SHA512
78dc851fc7775fbd87e351c5406381442323d60296df139ecc83738702fb870d5e0d82f12e94306b22758ab71ecedb6fdc9c11962d05486005d7894d750b1704

Download Submit
C:\Windows\System\OHtpixC.exe

Filesize
2.8MB

MD5
357fcb243910e2d7929ab2c628496e57

SHA1
ba3594fbdd9202b7a6d2f9fd3a936078ca6ff017

SHA256
4af3bea4b9a25f607cccd3890c7e27e10b242bf3e59ba8b8438f8125482c5b7a

SHA512
023f2d5bc89cfada62acafaafc1db16c3e95ff2c27c229b1222992c44f472444211a752300ab15613bd096d17762f84c21e8cba7bf51f7ffb2fac9f6acf64675

Download Submit
C:\Windows\System\RmSprdO.exe

Filesize
2.8MB

MD5
e6d9160bfa6ee7914473deecd85d340c

SHA1
6808b7c85792f37741f1cbdfd520ae09c6573965

SHA256
a3de15a4aeef97f1e440e5b999c9438c1045b0c6f959bb9a8ff1687f3cb28995

SHA512
30ee9a7914354d55c9345bf42082c2bf266d6d493448709aae320363c37635a6fdadf21a8969dcce4125b5ee1cd683a4d7ba9d9c663b4facb13df8dd026e2cca

Download Submit
C:\Windows\System\UEzjBJY.exe

Filesize
2.8MB

MD5
c7060a4fa6350498cd2fa81185ed81d5

SHA1
7450ce29aa87fee0402594f7a3d6ca65a332c695

SHA256
dbdcdbe49a57da2913f1225d762ad1eb526ee8f54e72df123873d069bfcc5355

SHA512
7dacecb851daf761124a5d36d13fcdc7c692dc19c0f3347df9e6154172aa7e15d3e609768360325757f7b5c551ad50e0ee470eb0e7fac69b66d3060ce4e30db9

Download Submit
C:\Windows\System\UNDcdAr.exe

Filesize
2.8MB

MD5
c4f9c0f9ff99e9c599834aa084942ad1

SHA1
18dc8a328acbe5177886c6f71645612c83ebec4d

SHA256
96da32a36291d6eda23f984be555624d332ae4f3b4d8849b55fe7d3d497e030c

SHA512
2876e67358ec4583b08ed39612f431971b0b788f494ebd4ca41b6af21852b1c1f54db57e53e7662bfa580b85000b41dc52967bae9736b86f03d2d853e9694f34

Download Submit
C:\Windows\System\UUNiFpm.exe

Filesize
2.8MB

MD5
7ab3a8cae739bd0575e5be5a7cd5ad46

SHA1
6dcb95599d02679a193665abf5a1067a7cfb8e9f

SHA256
ad5844ca1324dff6854357072676d67f88a275aacf665d668e51497669748f45

SHA512
ee08ddfd128f669a37bdecdd93afdb514321bbaee1c797a682a57f3353ccd1ba5c5cccacd3ff780605eb652d843a53a9b9916d2636dcc68e0a9adb2dda78b404

Download Submit
C:\Windows\System\VBLtdTb.exe

Filesize
2.8MB

MD5
8ea98d24585e867e45fb0ab38ef8f830

SHA1
30637d56f22443a4521410bedeb592835ac1ec6b

SHA256
830ee0b4acefae46c6c652e83019ce281eb2d511c853497f2d8ef198a3a69803

SHA512
d72f98c7f72b2b4ea277b8419772c14dfbfe55517974bac50c0c6873159c8e6b48551824a7fe4d95143a6d014afe2b7c4a14492c02b9a143bf62d3ff5d3a477f

Download Submit
C:\Windows\System\VxAvfte.exe

Filesize
2.8MB

MD5
bb7d0ef7e1a71ba60d7216e812ca4810

SHA1
59679b291f6ede0e8c988f788d367f5789de37de

SHA256
0b541d1c1aeb537476c5a8fca7d5bb471a8c6619529ea235714a4013b4c1b30f

SHA512
93f515d7ba3920850fa3dc4f52f01b7ad3ea8b2a8edc821a855feaa8e2d6267bfba032c48a86abbf25d046f8e2330dfe2b61b630dac7cb20ac132f9ba8a6de4c

Download Submit
C:\Windows\System\WWZgibF.exe

Filesize
2.8MB

MD5
1aa10f6cabac87870d7d4aba3417b514

SHA1
5284060c7c4c2a00c5934a1255a9bc00104656ee

SHA256
fff43f0d6c347f93cc9c184f846a1962d69a564ebf3c13393b7e4dd80e8dcd44

SHA512
a076d098ae835015bd7e25955bcaebd347e9a1f72b348c3e01b5abe9c7da5a677d11912810b770bfbbb72816d44033790591687b37a4e5510e4f38241bb0d62a

Download Submit
C:\Windows\System\XlILnRU.exe

Filesize
2.8MB

MD5
1fe20055d560eea0027a8806b25bcd37

SHA1
b0af79ede8df916a41695d025479da3c9f5d3177

SHA256
202913577dc040356cd3966767c3d6bd5c33351000e1cc58e78f5788348c4aad

SHA512
b906a319f33f3239b4b61bbd0646b3ee810a5e5ee285f65b858d70a790d72f253b1092a1c23ee3d3eceeeb13a7e2b306197b51f88cabea2dfd28e4ef7c0d4bac

Download Submit
C:\Windows\System\YQFXLaQ.exe

Filesize
2.8MB

MD5
bcf6ce2cf9e3ad1e42a57231ff8f871e

SHA1
2bb6df74b18fdea44bb40ffa8427429655aa8d3c

SHA256
7eb8c698e64f4dbeb80290f82c00c70c823242ecb88ab4c5418247039de52acc

SHA512
e49430aa236f581d783b110c2cd6fbfa97fb753a1429d3d7c4477a82d93fa6bd8e9b582ce8b291358d6b258334ad0c7be355405bc6a7f6c8defe3ca1fe5311ca

Download Submit
C:\Windows\System\YptfNAl.exe

Filesize
2.8MB

MD5
6f75ba1cab5454aa7ea8a36efd7df880

SHA1
345659670ec6f0d26bbdaba5587390ce4e3b7e52

SHA256
b2f6133b275254b24a4bde48cc20b81744313590bb17674e8456f22edb206b8d

SHA512
86e1d91e7b82192982aad782ed42d5d6f3f67806c878083d911957838e7b97e4897036bd2a0d2da5c21e884143e95f2a80764c658d63a25dd19d1fdda64cb3bb

Download Submit
C:\Windows\System\aePZYOv.exe

Filesize
2.8MB

MD5
38197126b500e00e0e7c56f1a3288725

SHA1
1e883081a930c25f7eb7f126fd5ff8f5b56af781

SHA256
a38e29e100620a50db41bc89d5d34b03276565b8da2f2bc370120c778028adf7

SHA512
6b96ef2a391c41505f59c4a65f1c078cc29348e98311527f88307d40d134e7e2afb4f8779c7d81baa4cc36cb4ac384bdc003242124da0f0322876d3681ab6996

Download Submit
C:\Windows\System\bMwJctf.exe

Filesize
2.8MB

MD5
4ea4f38e1939049e178f51e3261d026c

SHA1
b8ef44686e8bf0ad50a14114765e5eb93c2b77ee

SHA256
145d08c54d9231d98c58737e9d281a2ce4ec9e656fcd305b1a4af9f351df2ff9

SHA512
6f221dcdfdbbc39335aa1acd908b40b3f0a5bf4e059fcd455ab51c3b561d3ff05fe1dd43bb294238bdc3a63d7c47066feca7966e113c4f7d1817758ada5e3570

Download Submit
C:\Windows\System\cLJLORi.exe

Filesize
18B

MD5
3df17311bc0795afa0f8baedb284b58e

SHA1
0e0e1e2966fd4f257a0a87ec1a94371ddcd65ab3

SHA256
7becc7f3a33a815bbf562f45d6cd1323eaaebcf2da88329df7e1d872ff16449f

SHA512
5f0916962f1c38b0f4d4cb584d30e7922e57ace79f1075d3fc18f674694248abb3d97308dfdc428b10b4d414e7e5d4ac9774fecee2f966264fd982310698e5e2

Download Submit
C:\Windows\System\cfGJrWb.exe

Filesize
2.8MB

MD5
54f3d80af15d0a04c99abd4735130cae

SHA1
d278b86ccd2b68d627a8727957fb85e82100c698

SHA256
fac56dd6133b80d4cc0e372c2fdd8c7b3b95a858da356ea77f4a120064801828

SHA512
4b14f6a82c7e0c90b294268a3adb901246a4b3aaacaa20f9c8b6fe1570feff023143345ec66782a9892d4dca0004d75948b642d89f87eeec01e4dfa70ab457c7

Download Submit
C:\Windows\System\fStBfAI.exe

Filesize
2.8MB

MD5
15f6686a478408747fceff033cae64c8

SHA1
936160d213dc70fd4f6220a6039ccada2db5cbb1

SHA256
6c072a41029fcaba12dfec54fb7a9fe81ab355fa5cdb12a27973c70ac0129b80

SHA512
53777d1bebd58f44587dcb61475975b3737778613a2a3eef099a9387a7e7c4f2d4de38fe4468fa01e676712330271c0ae644341da7fef0573b9273e9ba75e6f1

Download Submit
C:\Windows\System\gXQdidD.exe

Filesize
2.8MB

MD5
d2b962341990176fe8afa7fd3aaa45ca

SHA1
b57d1fd23113824eb72ab39cc298e67e0771125d

SHA256
2d7f3330e91f54764373fb4d8db2db6c221ec8cb2f73f3bdeba5fcc4efc7f908

SHA512
d7721961776d6f8429d7336771ecbdd6b8a87e994e1378b954ff05611d65dd700ed3cd2911599b66e6d3ad6d9ebec03e72803cb91340b61c9d1012c9b2621757

Download Submit
C:\Windows\System\kFVjEMi.exe

Filesize
2.8MB

MD5
dbbc4982326863399ded63f6e4c35c62

SHA1
6a46bc01a6eb9ee25c7c62768ac596ed6cd06417

SHA256
e126e267d092ef68fce7ea0003491d582f69e51e41a95688e4541804fdac969d

SHA512
5175b608ba81c6577d6c1299aee18db06439d3dcb8e4f13b6cb72bb2832916e091427b31d032b473a629a38fdf22e0f3d950931606cd3f47995c462cda55cf91

Download Submit
C:\Windows\System\kSXGVlb.exe

Filesize
2.8MB

MD5
df76eaa6653c5fb78140a15bc671ac1e

SHA1
c38e71feef38b45ce7806e66ee3421e16bcc2d84

SHA256
bcff64c404ac00d7e8d117491bf2768930562a6234ab9c701bcbf19cb21e71b9

SHA512
bb2e7467a3bc7bfe015bd76ea007b93c5f34370c0f3eeba08cbb3f4cad113b93f3b472c03296caca4f6511f2dc544026124c5b6cd3bddbdaa1cd1298a884d055

Download Submit
C:\Windows\System\mwHZxoF.exe

Filesize
8B

MD5
b2496acc5e17e2c67abf0e50b34299c5

SHA1
e4d3a01a7b24014db52a37c4589da1d759e5cc01

SHA256
c1d0a5469aea2b6129f1befd08eacde0c0a8692b1b5daa6dcde087be41f93473

SHA512
ef684a29718cef3f70c3e4fcbaeffb53bbda0c6389282a7b2bddfe4ab783804c217814821e0c2a754448b3cb6bb99b294f93749f85fd1748233def0d92fa8251

Download Submit
C:\Windows\System\nIrgLDF.exe

Filesize
2.8MB

MD5
5a7e64cb3b2372c55042ac5302a1bb2e

SHA1
42140a824e5d4878c768c8d02c6d3224c969a0ba

SHA256
854364b1e7fb877406aa8f834b15726fb78497fc6a5dd923498bd666a5ab5e21

SHA512
1606abe0ca282c569aaa1e550b0ed0577152908ce95c9aebb2aa707ad6d02c2937345b3aaa97dd2990fb95ceea8634f2d30bf361acc4e51bb366aef9780de9ff

Download Submit
C:\Windows\System\nlqqbRw.exe

Filesize
2.8MB

MD5
26e4efcdf1d082a5cb8cd57691ca1248

SHA1
d2697b0e5db10cbaca597155f8fbcc670ed91a91

SHA256
3d0ee3daaeb2286b5ddf01b495e7bd740282daa97129a7b7e4299e1e35f1e3ef

SHA512
155d6c498f48de2dd83b37d8ec43aa6e4c28a42ccc35ca8902affa9c8f4c99637fe60d9c929e6102201d122991f3f90e0d152800766bdfbd4ca690e6b355b1f8

Download Submit
C:\Windows\System\pHAbdkJ.exe

Filesize
2.8MB

MD5
a28dfd24d21615765ec1246f2bd86150

SHA1
55e6607e21e836e773c1efcf0b667df972d77e92

SHA256
0611735175495eab4e53f5cc1c0131ffcf3e8e4693cc8c9ba3e68a581114908d

SHA512
3301df0e58f1c12cd8d14c8c73964496c63b09666b951a5d13d4396cd454dc8bad6e41dbc5c4a0a625874d8f1144ded76728fa5eda36be3b531730667c03aecc

Download Submit
C:\Windows\System\pkQybQv.exe

Filesize
2.8MB

MD5
b3a93022460a780cb566eb4acaf8dba5

SHA1
2595af1bd8896fb0e59fc0ef40117fe4a48f3188

SHA256
6206240e4b7f47df2e1b24b64573cbb0d94ebbca04d87d8f896b3478f06a00b7

SHA512
c29dfd0342813feeb32fe72e82b2e63a3899a881dc911af880e180ae36a5a5ce8c8e684940c948354a4c94d3661fbfc2acb25316e8c6c9b319ba69f5c822164a

Download Submit
C:\Windows\System\tLOwiMI.exe

Filesize
2.8MB

MD5
e81cf9f560a39d8266ae0024b139025e

SHA1
b224286087ac50841a48d9a89ae30c36ef636bda

SHA256
aa35deee0d26ab791a91c5638948e9903f007f441f74fe95e753c530132c0e47

SHA512
240b4e61f6cd03581f9ec9d02ba51268c1e965173dee9a6efe1e41ea041c8d6d6b8c06bd57e9674266cb6bfe33b3a91569ed394139ddc9820263f1d007116370

Download Submit
C:\Windows\System\ueClpzC.exe

Filesize
2.8MB

MD5
5cf6afad10a65d1792f9a03eff792348

SHA1
96155e9841a4497e7277d5ea8384cfdc4c07d0e8

SHA256
952c9b3d73f8def6643aec395a38aaf89cab3446b5feb5ec3c71632f3e822484

SHA512
51eeff26dcdc9b4dce3f75188bbb74c625a95c73dfa3b0d6e34729e25d9bae079eac49a272644ad5e97e6a951ba3197643bbd9f25bf77d444a936592e6556828

Download Submit
C:\Windows\System\vQvjJYB.exe

Filesize
2.8MB

MD5
e5449785faf26f1201b8a5fea70169ff

SHA1
3106c9cd32f986952e542cabb0aa950d633d9974

SHA256
cb607b84e492ad7e618592e9b5c1da043c47fd6020046182dc2a4b33eb2b2592

SHA512
ef504e0dcb3adccef355fc69de7b6314ad65982ed175e4c47fd8485fe2a9d17a762d8360ba9e783bac6e056462233d50934a4eb00a5afbd40120d35086876054

Download Submit
C:\Windows\System\vdXvMDQ.exe

Filesize
2.8MB

MD5
7402b94004102cd6a3858f017e069cc3

SHA1
9fc9b4e0395c578ca99ff3889ec4ce6fabd116ab

SHA256
bb5ab51d3143d37373de38ffb0552e809170dd11ea0d02b22aaca6a371f1f53b

SHA512
b4864a5c739284f0cb2bfc3cfe9af1a90374112a031048a70e098183052353eb9b8c2fbdfdf70d23a66ca0f62c5a9cbdc8dc4854ad3d0a9a8b1983794b0eb0a7

Download Submit
C:\Windows\System\zXAjioC.exe

Filesize
2.8MB

MD5
5f50d09089e49c16ca5f81180dec81e5

SHA1
4a89837a38288c203d1d1815b7e1a7bbd072b93a

SHA256
9a886d081492644e57d305651cf4bba09b1d8e05821bb54da518d961f9466276

SHA512
326ae643cac7f2f5e4221487491d17aed789450e9cc5113b086ec698e58e981637036a32cf1a7b6ac5f03ec625ec8b0f04066326d0adaf39d192cf3858f9fd09

Download Submit
C:\Windows\System\zhcRnkX.exe

Filesize
2.8MB

MD5
a5e04fe0f5a260e0b09807550ab889c0

SHA1
9f8fe58ed05115dbadb9beef236db8279872d692

SHA256
59d8b9f916e583fe38ea3107747873651f92996ea6916cbbaeda1b46f1e4ef4c

SHA512
7e2ea92eb8f149ab7c4e11bb1760f855086d05b8bfae6738367f5401d11ba12ac695ba38bab61ac21c709a1e37b3f46577886718228d5c511ce5306e9fb8a8f8

Download Submit
C:\Windows\System\zyoNHJs.exe

Filesize
2.8MB

MD5
78f7300a2d4ce2472ed2f3c677aa02cf

SHA1
568399e6ec06e8aae5439d7781b161c29905c37f

SHA256
e308cd70a073f012f9c9a6d02901404207ff6256594739eaf0f3acc0ee270ae8

SHA512
42576f461be635776031ad27871c368a5ee7942bf3679bbf50979186844d928b8f895b2ce50b05df6d4d6837c6b7ebca359b130ed2588266f646a45e9a6a8dbd

Download Submit
memory/512-182-0x00007FF79B590000-0x00007FF79B982000-memory.dmp

Filesize
3.9MB

Download
memory/512-3822-0x00007FF79B590000-0x00007FF79B982000-memory.dmp

Filesize
3.9MB

Download
memory/712-3774-0x00007FF675720000-0x00007FF675B12000-memory.dmp

Filesize
3.9MB

Download
memory/712-102-0x00007FF675720000-0x00007FF675B12000-memory.dmp

Filesize
3.9MB

Download
memory/924-3783-0x00007FF71D1A0000-0x00007FF71D592000-memory.dmp

Filesize
3.9MB

Download
memory/924-113-0x00007FF71D1A0000-0x00007FF71D592000-memory.dmp

Filesize
3.9MB

Download
memory/1328-330-0x00007FF781930000-0x00007FF781D22000-memory.dmp

Filesize
3.9MB

Download
memory/1328-4145-0x00007FF781930000-0x00007FF781D22000-memory.dmp

Filesize
3.9MB

Download
memory/1368-253-0x00007FF642030000-0x00007FF642422000-memory.dmp

Filesize
3.9MB

Download
memory/1368-3832-0x00007FF642030000-0x00007FF642422000-memory.dmp

Filesize
3.9MB

Download
memory/1656-213-0x00007FF79E720000-0x00007FF79EB12000-memory.dmp

Filesize
3.9MB

Download
memory/1656-3791-0x00007FF79E720000-0x00007FF79EB12000-memory.dmp

Filesize
3.9MB

Download
memory/1688-329-0x00007FF743250000-0x00007FF743642000-memory.dmp

Filesize
3.9MB

Download
memory/1688-3866-0x00007FF743250000-0x00007FF743642000-memory.dmp

Filesize
3.9MB

Download
memory/2012-325-0x00007FF772A30000-0x00007FF772E22000-memory.dmp

Filesize
3.9MB

Download
memory/2012-3934-0x00007FF772A30000-0x00007FF772E22000-memory.dmp

Filesize
3.9MB

Download
memory/2416-3806-0x00007FF784E40000-0x00007FF785232000-memory.dmp

Filesize
3.9MB

Download
memory/2416-119-0x00007FF784E40000-0x00007FF785232000-memory.dmp

Filesize
3.9MB

Download
memory/2576-80-0x00007FF62A990000-0x00007FF62AD82000-memory.dmp

Filesize
3.9MB

Download
memory/2888-228-0x00007FF6C3AC0000-0x00007FF6C3EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-3802-0x00007FF6C3AC0000-0x00007FF6C3EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-3848-0x00007FF64E270000-0x00007FF64E662000-memory.dmp

Filesize
3.9MB

Download
memory/2932-323-0x00007FF64E270000-0x00007FF64E662000-memory.dmp

Filesize
3.9MB

Download
memory/3140-3840-0x00007FF7283B0000-0x00007FF7287A2000-memory.dmp

Filesize
3.9MB

Download
memory/3140-328-0x00007FF7283B0000-0x00007FF7287A2000-memory.dmp

Filesize
3.9MB

Download
memory/3512-312-0x00007FF7E7030000-0x00007FF7E7422000-memory.dmp

Filesize
3.9MB

Download
memory/3512-3859-0x00007FF7E7030000-0x00007FF7E7422000-memory.dmp

Filesize
3.9MB

Download
memory/3696-262-0x00007FF628960000-0x00007FF628D52000-memory.dmp

Filesize
3.9MB

Download
memory/3696-3795-0x00007FF628960000-0x00007FF628D52000-memory.dmp

Filesize
3.9MB

Download
memory/3780-3896-0x00007FF79DBE0000-0x00007FF79DFD2000-memory.dmp

Filesize
3.9MB

Download
memory/3780-326-0x00007FF79DBE0000-0x00007FF79DFD2000-memory.dmp

Filesize
3.9MB

Download
memory/3816-327-0x00007FF7BF490000-0x00007FF7BF882000-memory.dmp

Filesize
3.9MB

Download
memory/3924-63-0x00000181DF020000-0x00000181DF030000-memory.dmp

Filesize
64KB

Download
memory/3924-42-0x00000181F7650000-0x00000181F7672000-memory.dmp

Filesize
136KB

Download
memory/3924-60-0x00007FFF35FD0000-0x00007FFF36A91000-memory.dmp

Filesize
10.8MB

Download
memory/4016-157-0x00007FF790AC0000-0x00007FF790EB2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-0-0x00007FF74F430000-0x00007FF74F822000-memory.dmp

Filesize
3.9MB

Download
memory/4028-1-0x000001A49A8E0000-0x000001A49A8F0000-memory.dmp

Filesize
64KB

Download
memory/4028-4264-0x00007FF74F430000-0x00007FF74F822000-memory.dmp

Filesize
3.9MB

Download
memory/4396-3836-0x00007FF60B590000-0x00007FF60B982000-memory.dmp

Filesize
3.9MB

Download
memory/4396-281-0x00007FF60B590000-0x00007FF60B982000-memory.dmp

Filesize
3.9MB

Download
memory/4864-3873-0x00007FF604300000-0x00007FF6046F2000-memory.dmp

Filesize
3.9MB

Download
memory/4864-278-0x00007FF604300000-0x00007FF6046F2000-memory.dmp

Filesize
3.9MB

Download
memory/5092-91-0x00007FF789C70000-0x00007FF78A062000-memory.dmp

Filesize
3.9MB

Download