xmrig | 7f426cc552fb8fa050b7f0ef516060ff59c29c71ab9582b25a0bedb67c8b8ddc

Analysis

max time kernel
150s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
Size

2.1MB
MD5

9d29787878dbac06f0a7091d3f24c47c
SHA1

11438f9c2e79a46962a5e5df0b50b49ac672d83a
SHA256

7f426cc552fb8fa050b7f0ef516060ff59c29c71ab9582b25a0bedb67c8b8ddc
SHA512

9de171fcc6ca83706435c3c8d8fad6a2b1932208c44d0cfcd6bdeab75035ca61bd73d64919e6bc09657888e3b23bfcb77b040fcd02b6d2bc94dc22f6089560bf
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMG:NAB+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral2/memory/1312-10-0x00007FF778540000-0x00007FF778932000-memory.dmp	xmrig
behavioral2/memory/4540-54-0x00007FF6652A0000-0x00007FF665692000-memory.dmp	xmrig
behavioral2/memory/1224-86-0x00007FF67D700000-0x00007FF67DAF2000-memory.dmp	xmrig
behavioral2/memory/2992-96-0x00007FF6DE7A0000-0x00007FF6DEB92000-memory.dmp	xmrig
behavioral2/memory/2304-95-0x00007FF741EF0000-0x00007FF7422E2000-memory.dmp	xmrig
behavioral2/memory/4448-85-0x00007FF6F8A60000-0x00007FF6F8E52000-memory.dmp	xmrig
behavioral2/memory/1008-80-0x00007FF7AAC60000-0x00007FF7AB052000-memory.dmp	xmrig
behavioral2/memory/4280-75-0x00007FF6835C0000-0x00007FF6839B2000-memory.dmp	xmrig
behavioral2/memory/3520-68-0x00007FF743CF0000-0x00007FF7440E2000-memory.dmp	xmrig
behavioral2/memory/3172-58-0x00007FF671460000-0x00007FF671852000-memory.dmp	xmrig
behavioral2/memory/3680-55-0x00007FF74EE40000-0x00007FF74F232000-memory.dmp	xmrig
behavioral2/memory/4080-129-0x00007FF63AD50000-0x00007FF63B142000-memory.dmp	xmrig
behavioral2/memory/3376-355-0x00007FF6EA300000-0x00007FF6EA6F2000-memory.dmp	xmrig
behavioral2/memory/3764-361-0x00007FF652E30000-0x00007FF653222000-memory.dmp	xmrig
behavioral2/memory/3504-354-0x00007FF768CF0000-0x00007FF7690E2000-memory.dmp	xmrig
behavioral2/memory/4124-117-0x00007FF720E10000-0x00007FF721202000-memory.dmp	xmrig
behavioral2/memory/4268-1471-0x00007FF78D2E0000-0x00007FF78D6D2000-memory.dmp	xmrig
behavioral2/memory/1272-2015-0x00007FF6EFFD0000-0x00007FF6F03C2000-memory.dmp	xmrig
behavioral2/memory/392-2344-0x00007FF658A60000-0x00007FF658E52000-memory.dmp	xmrig
behavioral2/memory/4856-3098-0x00007FF73FFF0000-0x00007FF7403E2000-memory.dmp	xmrig
behavioral2/memory/2988-4162-0x00007FF6A8980000-0x00007FF6A8D72000-memory.dmp	xmrig
behavioral2/memory/3144-4165-0x00007FF65CBD0000-0x00007FF65CFC2000-memory.dmp	xmrig
behavioral2/memory/4268-5162-0x00007FF78D2E0000-0x00007FF78D6D2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1684	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1312	hJeDpLr.exe
3520	izRPCZk.exe
4540	ZrwWwQr.exe
3680	YDHCikV.exe
3172	ZyqAcjP.exe
4280	xijCMdM.exe
1008	AenzLFv.exe
4448	uwSPdtp.exe
1272	FZZJlqV.exe
2304	AmILLsg.exe
1224	LCYdMjW.exe
2992	eeHjmDo.exe
392	fuRzRqC.exe
2080	kDIGvCR.exe
4856	KmuGruN.exe
4124	jBjqutv.exe
4080	DFyFIGj.exe
4996	Kqcfnva.exe
2988	mnLEVyb.exe
3504	wExPEsk.exe
3144	rPkgpuk.exe
3376	rUzpoKP.exe
3796	xINrMQc.exe
3764	OgrzgTH.exe
4008	SKjbPeY.exe
3732	dyGGRJg.exe
1080	uwhgouS.exe
2768	AtUDplQ.exe
1968	UOLiNBD.exe
232	UmXKZTx.exe
1156	LNFKvEC.exe
3412	vHmhlJX.exe
3272	WmziHmU.exe
4224	CiotRCS.exe
4520	ivvjCoZ.exe
404	bPkcVcj.exe
4664	mTrmZKY.exe
984	XoOYOmK.exe
3792	EfvBsWi.exe
1624	ZOQGbPM.exe
1724	RoqafPA.exe
3576	KnxjeJB.exe
3404	CjIQasY.exe
3044	uSLjisv.exe
3180	BHfDvfc.exe
1160	muTOeRK.exe
3360	OeHEJHg.exe
8	fFEqdTw.exe
1568	hPgIczk.exe
2808	YjgcLEg.exe
1792	SLsthrf.exe
3216	kmDNSAI.exe
2396	CCfAMMH.exe
1988	YwpfsRx.exe
4760	LbQWxEv.exe
3448	rohISoj.exe
428	lBhinLH.exe
3748	nggBkps.exe
4968	zeOqMsL.exe
4524	QoplQzB.exe
2596	LdStPqK.exe
2240	vrpNBgZ.exe
2036	SzjkjUt.exe
1460	fFAiVPe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4268-0-0x00007FF78D2E0000-0x00007FF78D6D2000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-4.dat	upx
behavioral2/files/0x00070000000233ed-9.dat	upx
behavioral2/files/0x00070000000233ee-20.dat	upx
behavioral2/files/0x00070000000233ec-16.dat	upx
behavioral2/memory/1312-10-0x00007FF778540000-0x00007FF778932000-memory.dmp	upx
behavioral2/files/0x00070000000233f0-32.dat	upx
behavioral2/memory/4540-54-0x00007FF6652A0000-0x00007FF665692000-memory.dmp	upx
behavioral2/files/0x00080000000233f3-57.dat	upx
behavioral2/files/0x00080000000233f2-76.dat	upx
behavioral2/files/0x00070000000233f7-82.dat	upx
behavioral2/memory/1224-86-0x00007FF67D700000-0x00007FF67DAF2000-memory.dmp	upx
behavioral2/memory/392-91-0x00007FF658A60000-0x00007FF658E52000-memory.dmp	upx
behavioral2/memory/2992-96-0x00007FF6DE7A0000-0x00007FF6DEB92000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-98.dat	upx
behavioral2/memory/2080-97-0x00007FF66C6E0000-0x00007FF66CAD2000-memory.dmp	upx
behavioral2/memory/2304-95-0x00007FF741EF0000-0x00007FF7422E2000-memory.dmp	upx
behavioral2/memory/4448-85-0x00007FF6F8A60000-0x00007FF6F8E52000-memory.dmp	upx
behavioral2/files/0x00070000000233f6-87.dat	upx
behavioral2/files/0x00070000000233f5-83.dat	upx
behavioral2/memory/1008-80-0x00007FF7AAC60000-0x00007FF7AB052000-memory.dmp	upx
behavioral2/memory/4280-75-0x00007FF6835C0000-0x00007FF6839B2000-memory.dmp	upx
behavioral2/memory/3520-68-0x00007FF743CF0000-0x00007FF7440E2000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-64.dat	upx
behavioral2/files/0x00070000000233f1-60.dat	upx
behavioral2/memory/1272-59-0x00007FF6EFFD0000-0x00007FF6F03C2000-memory.dmp	upx
behavioral2/memory/3172-58-0x00007FF671460000-0x00007FF671852000-memory.dmp	upx
behavioral2/memory/3680-55-0x00007FF74EE40000-0x00007FF74F232000-memory.dmp	upx
behavioral2/files/0x00070000000233ef-31.dat	upx
behavioral2/files/0x00080000000233e9-103.dat	upx
behavioral2/files/0x000800000001e92c-106.dat	upx
behavioral2/files/0x0005000000022ac6-115.dat	upx
behavioral2/files/0x0004000000022ac3-120.dat	upx
behavioral2/files/0x00070000000233f9-130.dat	upx
behavioral2/memory/4080-129-0x00007FF63AD50000-0x00007FF63B142000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-140.dat	upx
behavioral2/files/0x00070000000233fb-139.dat	upx
behavioral2/files/0x00070000000233fe-156.dat	upx
behavioral2/files/0x00070000000233fd-162.dat	upx
behavioral2/files/0x00070000000233ff-164.dat	upx
behavioral2/files/0x0007000000023400-169.dat	upx
behavioral2/memory/3796-346-0x00007FF6E7450000-0x00007FF6E7842000-memory.dmp	upx
behavioral2/memory/3376-355-0x00007FF6EA300000-0x00007FF6EA6F2000-memory.dmp	upx
behavioral2/memory/3764-361-0x00007FF652E30000-0x00007FF653222000-memory.dmp	upx
behavioral2/memory/3504-354-0x00007FF768CF0000-0x00007FF7690E2000-memory.dmp	upx
behavioral2/files/0x0007000000023406-196.dat	upx
behavioral2/files/0x0007000000023404-194.dat	upx
behavioral2/files/0x0007000000023405-191.dat	upx
behavioral2/files/0x0007000000023403-189.dat	upx
behavioral2/files/0x0007000000023402-182.dat	upx
behavioral2/files/0x0007000000023401-177.dat	upx
behavioral2/memory/3144-148-0x00007FF65CBD0000-0x00007FF65CFC2000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-143.dat	upx
behavioral2/memory/2988-141-0x00007FF6A8980000-0x00007FF6A8D72000-memory.dmp	upx
behavioral2/files/0x000e000000023359-136.dat	upx
behavioral2/memory/4996-123-0x00007FF6AB590000-0x00007FF6AB982000-memory.dmp	upx
behavioral2/memory/4124-117-0x00007FF720E10000-0x00007FF721202000-memory.dmp	upx
behavioral2/memory/4856-111-0x00007FF73FFF0000-0x00007FF7403E2000-memory.dmp	upx
behavioral2/memory/4268-1471-0x00007FF78D2E0000-0x00007FF78D6D2000-memory.dmp	upx
behavioral2/memory/1272-2015-0x00007FF6EFFD0000-0x00007FF6F03C2000-memory.dmp	upx
behavioral2/memory/392-2344-0x00007FF658A60000-0x00007FF658E52000-memory.dmp	upx
behavioral2/memory/4856-3098-0x00007FF73FFF0000-0x00007FF7403E2000-memory.dmp	upx
behavioral2/memory/2988-4162-0x00007FF6A8980000-0x00007FF6A8D72000-memory.dmp	upx
behavioral2/memory/3144-4165-0x00007FF65CBD0000-0x00007FF65CFC2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vQiemFL.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\emnPoWZ.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\NELkvDj.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\VAuUPbP.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\LmcBNah.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\OBibpap.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\bZRWDny.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\Tgroaec.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\OMStjEb.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\URcSxtm.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\cFdDevR.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\beSTTva.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\dHpWRsS.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\cyJUNnE.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\VObFWWD.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\JgLvLmG.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\pBSRuHn.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\TZYhBcs.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\fmhdAAE.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\HGVHaVT.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\thAEZTQ.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\VtBnNYn.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\yQYZPls.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\PwNcpZj.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\Nzvpsna.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\vEkhRME.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\hsfbJdP.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\HuPUyUv.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\kTDLXxE.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\AvzPogM.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\aKYYcep.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\kipWRWu.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\NXAORyk.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\dEqzdDg.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\gmVxezd.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\bUoLiag.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\eyZHJYG.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\KGuaYWo.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\YUnsMES.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\HwHFGoP.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\FdlAEag.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\WeKxdbP.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\UpVmFpk.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\PguDgNN.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\tFybLzh.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\QjFhqhm.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\dnhVduF.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\lWbwWAs.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\ghLjtEX.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\rnsKFOp.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\ApzgpvJ.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\kUeSpnc.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\WpGMhOB.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\cSvZUpf.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\TXGFVyT.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\etfyLHV.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\jipQVat.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\XUvZVjN.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\JXhGgcA.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\ZeRnzBj.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\VbCSGBc.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\srTCKqA.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\ZjWDzoY.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\lLDPzVW.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3536	Process not Found
4296	Process not Found
4332	Process not Found
3600	Process not Found
4324	Process not Found
4020	Process not Found
13984	Process not Found
3228	Process not Found
3136	Process not Found
3660	Process not Found
740	Process not Found
4376	Process not Found
4036	Process not Found
10224	Process not Found
4732	Process not Found
5496	Process not Found
4000	Process not Found
11448	Process not Found
11336	Process not Found
4148	Process not Found
4244	Process not Found
4508	Process not Found
2852	Process not Found
3476	Process not Found
5660	Process not Found
1612	Process not Found
5152	Process not Found
5000	Process not Found
1516	Process not Found
5696	Process not Found
780	Process not Found
2016	Process not Found
5648	Process not Found
5636	Process not Found
220	Process not Found
3188	Process not Found
6180	Process not Found
3132	Process not Found
4884	Process not Found
2168	Process not Found
6044	Process not Found
4468	Process not Found
5888	Process not Found
448	Process not Found
5868	Process not Found
6172	Process not Found
5488	Process not Found
5476	Process not Found
6244	Process not Found
6260	Process not Found
6292	Process not Found
6496	Process not Found
6544	Process not Found
3108	Process not Found
5492	Process not Found
2280	Process not Found
4072	Process not Found
2612	Process not Found
1984	Process not Found
2248	Process not Found
1496	Process not Found
5992	Process not Found
228	Process not Found
5136	Process not Found

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeCreateGlobalPrivilege	13612	dwm.exe
Token: SeChangeNotifyPrivilege	13612	dwm.exe
Token: 33	13612	dwm.exe
Token: SeIncBasePriorityPrivilege	13612	dwm.exe
Token: SeCreateGlobalPrivilege	13404	dwm.exe
Token: SeChangeNotifyPrivilege	13404	dwm.exe
Token: 33	13404	dwm.exe
Token: SeIncBasePriorityPrivilege	13404	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 1684	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	83
PID 4268 wrote to memory of 1684	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	83
PID 4268 wrote to memory of 1312	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	84
PID 4268 wrote to memory of 1312	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	84
PID 4268 wrote to memory of 3520	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	86
PID 4268 wrote to memory of 3520	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	86
PID 4268 wrote to memory of 4540	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	87
PID 4268 wrote to memory of 4540	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	87
PID 4268 wrote to memory of 3680	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	88
PID 4268 wrote to memory of 3680	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	88
PID 4268 wrote to memory of 3172	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	89
PID 4268 wrote to memory of 3172	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	89
PID 4268 wrote to memory of 4280	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	90
PID 4268 wrote to memory of 4280	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	90
PID 4268 wrote to memory of 1008	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	91
PID 4268 wrote to memory of 1008	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	91
PID 4268 wrote to memory of 4448	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	92
PID 4268 wrote to memory of 4448	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	92
PID 4268 wrote to memory of 1272	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	93
PID 4268 wrote to memory of 1272	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	93
PID 4268 wrote to memory of 1224	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	94
PID 4268 wrote to memory of 1224	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	94
PID 4268 wrote to memory of 2304	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	95
PID 4268 wrote to memory of 2304	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	95
PID 4268 wrote to memory of 2992	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	96
PID 4268 wrote to memory of 2992	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	96
PID 4268 wrote to memory of 392	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	97
PID 4268 wrote to memory of 392	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	97
PID 4268 wrote to memory of 2080	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	98
PID 4268 wrote to memory of 2080	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	98
PID 4268 wrote to memory of 4856	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	99
PID 4268 wrote to memory of 4856	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	99
PID 4268 wrote to memory of 4124	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	102
PID 4268 wrote to memory of 4124	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	102
PID 4268 wrote to memory of 4080	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	103
PID 4268 wrote to memory of 4080	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	103
PID 4268 wrote to memory of 4996	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	104
PID 4268 wrote to memory of 4996	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	104
PID 4268 wrote to memory of 2988	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	105
PID 4268 wrote to memory of 2988	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	105
PID 4268 wrote to memory of 3504	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	106
PID 4268 wrote to memory of 3504	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	106
PID 4268 wrote to memory of 3144	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	107
PID 4268 wrote to memory of 3144	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	107
PID 4268 wrote to memory of 3376	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	108
PID 4268 wrote to memory of 3376	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	108
PID 4268 wrote to memory of 3796	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	109
PID 4268 wrote to memory of 3796	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	109
PID 4268 wrote to memory of 3764	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	110
PID 4268 wrote to memory of 3764	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	110
PID 4268 wrote to memory of 4008	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	111
PID 4268 wrote to memory of 4008	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	111
PID 4268 wrote to memory of 3732	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	112
PID 4268 wrote to memory of 3732	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	112
PID 4268 wrote to memory of 1080	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	113
PID 4268 wrote to memory of 1080	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	113
PID 4268 wrote to memory of 2768	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	114
PID 4268 wrote to memory of 2768	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	114
PID 4268 wrote to memory of 1968	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	115
PID 4268 wrote to memory of 1968	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	115
PID 4268 wrote to memory of 232	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	116
PID 4268 wrote to memory of 232	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	116
PID 4268 wrote to memory of 1156	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	117
PID 4268 wrote to memory of 1156	4268	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1684
- C:\Windows\System\hJeDpLr.exe
  C:\Windows\System\hJeDpLr.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\izRPCZk.exe
  C:\Windows\System\izRPCZk.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\ZrwWwQr.exe
  C:\Windows\System\ZrwWwQr.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\YDHCikV.exe
  C:\Windows\System\YDHCikV.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\ZyqAcjP.exe
  C:\Windows\System\ZyqAcjP.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\xijCMdM.exe
  C:\Windows\System\xijCMdM.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\AenzLFv.exe
  C:\Windows\System\AenzLFv.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\uwSPdtp.exe
  C:\Windows\System\uwSPdtp.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\FZZJlqV.exe
  C:\Windows\System\FZZJlqV.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\LCYdMjW.exe
  C:\Windows\System\LCYdMjW.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\AmILLsg.exe
  C:\Windows\System\AmILLsg.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\eeHjmDo.exe
  C:\Windows\System\eeHjmDo.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\fuRzRqC.exe
  C:\Windows\System\fuRzRqC.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\kDIGvCR.exe
  C:\Windows\System\kDIGvCR.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\KmuGruN.exe
  C:\Windows\System\KmuGruN.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\jBjqutv.exe
  C:\Windows\System\jBjqutv.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\DFyFIGj.exe
  C:\Windows\System\DFyFIGj.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\Kqcfnva.exe
  C:\Windows\System\Kqcfnva.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\mnLEVyb.exe
  C:\Windows\System\mnLEVyb.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\wExPEsk.exe
  C:\Windows\System\wExPEsk.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\rPkgpuk.exe
  C:\Windows\System\rPkgpuk.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\rUzpoKP.exe
  C:\Windows\System\rUzpoKP.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\xINrMQc.exe
  C:\Windows\System\xINrMQc.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\OgrzgTH.exe
  C:\Windows\System\OgrzgTH.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\SKjbPeY.exe
  C:\Windows\System\SKjbPeY.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\dyGGRJg.exe
  C:\Windows\System\dyGGRJg.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\uwhgouS.exe
  C:\Windows\System\uwhgouS.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\AtUDplQ.exe
  C:\Windows\System\AtUDplQ.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\UOLiNBD.exe
  C:\Windows\System\UOLiNBD.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\UmXKZTx.exe
  C:\Windows\System\UmXKZTx.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\LNFKvEC.exe
  C:\Windows\System\LNFKvEC.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\vHmhlJX.exe
  C:\Windows\System\vHmhlJX.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\WmziHmU.exe
  C:\Windows\System\WmziHmU.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\CiotRCS.exe
  C:\Windows\System\CiotRCS.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\ivvjCoZ.exe
  C:\Windows\System\ivvjCoZ.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\bPkcVcj.exe
  C:\Windows\System\bPkcVcj.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\mTrmZKY.exe
  C:\Windows\System\mTrmZKY.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\XoOYOmK.exe
  C:\Windows\System\XoOYOmK.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\EfvBsWi.exe
  C:\Windows\System\EfvBsWi.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\ZOQGbPM.exe
  C:\Windows\System\ZOQGbPM.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\RoqafPA.exe
  C:\Windows\System\RoqafPA.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\KnxjeJB.exe
  C:\Windows\System\KnxjeJB.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\CjIQasY.exe
  C:\Windows\System\CjIQasY.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\uSLjisv.exe
  C:\Windows\System\uSLjisv.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\BHfDvfc.exe
  C:\Windows\System\BHfDvfc.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\muTOeRK.exe
  C:\Windows\System\muTOeRK.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\OeHEJHg.exe
  C:\Windows\System\OeHEJHg.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\fFEqdTw.exe
  C:\Windows\System\fFEqdTw.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\hPgIczk.exe
  C:\Windows\System\hPgIczk.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\YjgcLEg.exe
  C:\Windows\System\YjgcLEg.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\SLsthrf.exe
  C:\Windows\System\SLsthrf.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\kmDNSAI.exe
  C:\Windows\System\kmDNSAI.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\CCfAMMH.exe
  C:\Windows\System\CCfAMMH.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\YwpfsRx.exe
  C:\Windows\System\YwpfsRx.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\LbQWxEv.exe
  C:\Windows\System\LbQWxEv.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\rohISoj.exe
  C:\Windows\System\rohISoj.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\lBhinLH.exe
  C:\Windows\System\lBhinLH.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\nggBkps.exe
  C:\Windows\System\nggBkps.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\zeOqMsL.exe
  C:\Windows\System\zeOqMsL.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\QoplQzB.exe
  C:\Windows\System\QoplQzB.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\LdStPqK.exe
  C:\Windows\System\LdStPqK.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\vrpNBgZ.exe
  C:\Windows\System\vrpNBgZ.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\SzjkjUt.exe
  C:\Windows\System\SzjkjUt.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\fFAiVPe.exe
  C:\Windows\System\fFAiVPe.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\APXsyHD.exe
  C:\Windows\System\APXsyHD.exe
  2⤵
  PID:2064
- C:\Windows\System\nfGCmEi.exe
  C:\Windows\System\nfGCmEi.exe
  2⤵
  PID:2764
- C:\Windows\System\gZoOmRm.exe
  C:\Windows\System\gZoOmRm.exe
  2⤵
  PID:4004
- C:\Windows\System\XuueZiX.exe
  C:\Windows\System\XuueZiX.exe
  2⤵
  PID:1068
- C:\Windows\System\uCFJWUq.exe
  C:\Windows\System\uCFJWUq.exe
  2⤵
  PID:4552
- C:\Windows\System\BqlzJtx.exe
  C:\Windows\System\BqlzJtx.exe
  2⤵
  PID:968
- C:\Windows\System\vPLTBUG.exe
  C:\Windows\System\vPLTBUG.exe
  2⤵
  PID:4812
- C:\Windows\System\uDmMILD.exe
  C:\Windows\System\uDmMILD.exe
  2⤵
  PID:704
- C:\Windows\System\WPuLHHx.exe
  C:\Windows\System\WPuLHHx.exe
  2⤵
  PID:748
- C:\Windows\System\frqMqwI.exe
  C:\Windows\System\frqMqwI.exe
  2⤵
  PID:1096
- C:\Windows\System\MJJOccJ.exe
  C:\Windows\System\MJJOccJ.exe
  2⤵
  PID:1696
- C:\Windows\System\oAnOOCH.exe
  C:\Windows\System\oAnOOCH.exe
  2⤵
  PID:372
- C:\Windows\System\jiUWiFt.exe
  C:\Windows\System\jiUWiFt.exe
  2⤵
  PID:5140
- C:\Windows\System\BpNzmne.exe
  C:\Windows\System\BpNzmne.exe
  2⤵
  PID:5168
- C:\Windows\System\AlIgONf.exe
  C:\Windows\System\AlIgONf.exe
  2⤵
  PID:5196
- C:\Windows\System\aLnkmWM.exe
  C:\Windows\System\aLnkmWM.exe
  2⤵
  PID:5224
- C:\Windows\System\YXFYDZW.exe
  C:\Windows\System\YXFYDZW.exe
  2⤵
  PID:5252
- C:\Windows\System\FBwqGTy.exe
  C:\Windows\System\FBwqGTy.exe
  2⤵
  PID:5276
- C:\Windows\System\BaoGHLn.exe
  C:\Windows\System\BaoGHLn.exe
  2⤵
  PID:5308
- C:\Windows\System\CRRpTgf.exe
  C:\Windows\System\CRRpTgf.exe
  2⤵
  PID:5336
- C:\Windows\System\olRjNgx.exe
  C:\Windows\System\olRjNgx.exe
  2⤵
  PID:5380
- C:\Windows\System\UZfPjxv.exe
  C:\Windows\System\UZfPjxv.exe
  2⤵
  PID:5420
- C:\Windows\System\ibpxgYY.exe
  C:\Windows\System\ibpxgYY.exe
  2⤵
  PID:5456
- C:\Windows\System\Qmqoclc.exe
  C:\Windows\System\Qmqoclc.exe
  2⤵
  PID:5480
- C:\Windows\System\ZaHvzKk.exe
  C:\Windows\System\ZaHvzKk.exe
  2⤵
  PID:5508
- C:\Windows\System\BnkFSIq.exe
  C:\Windows\System\BnkFSIq.exe
  2⤵
  PID:5532
- C:\Windows\System\BffwZvv.exe
  C:\Windows\System\BffwZvv.exe
  2⤵
  PID:5548
- C:\Windows\System\EkIEUwI.exe
  C:\Windows\System\EkIEUwI.exe
  2⤵
  PID:5584
- C:\Windows\System\KNdAEBJ.exe
  C:\Windows\System\KNdAEBJ.exe
  2⤵
  PID:5616
- C:\Windows\System\CLPQEHF.exe
  C:\Windows\System\CLPQEHF.exe
  2⤵
  PID:5664
- C:\Windows\System\qMCBouK.exe
  C:\Windows\System\qMCBouK.exe
  2⤵
  PID:5680
- C:\Windows\System\HfPRhrv.exe
  C:\Windows\System\HfPRhrv.exe
  2⤵
  PID:5716
- C:\Windows\System\yHDbKKo.exe
  C:\Windows\System\yHDbKKo.exe
  2⤵
  PID:5760
- C:\Windows\System\Rayxkeo.exe
  C:\Windows\System\Rayxkeo.exe
  2⤵
  PID:5776
- C:\Windows\System\vNnzfnJ.exe
  C:\Windows\System\vNnzfnJ.exe
  2⤵
  PID:5816
- C:\Windows\System\rEVrFfF.exe
  C:\Windows\System\rEVrFfF.exe
  2⤵
  PID:5852
- C:\Windows\System\FKbKIep.exe
  C:\Windows\System\FKbKIep.exe
  2⤵
  PID:5872
- C:\Windows\System\TXGFVyT.exe
  C:\Windows\System\TXGFVyT.exe
  2⤵
  PID:5896
- C:\Windows\System\BhgjZEz.exe
  C:\Windows\System\BhgjZEz.exe
  2⤵
  PID:5920
- C:\Windows\System\SxUfrJG.exe
  C:\Windows\System\SxUfrJG.exe
  2⤵
  PID:5952
- C:\Windows\System\AeUVkCO.exe
  C:\Windows\System\AeUVkCO.exe
  2⤵
  PID:5972
- C:\Windows\System\yvVsEdC.exe
  C:\Windows\System\yvVsEdC.exe
  2⤵
  PID:6004
- C:\Windows\System\aMYqQXr.exe
  C:\Windows\System\aMYqQXr.exe
  2⤵
  PID:6036
- C:\Windows\System\mcwDCFM.exe
  C:\Windows\System\mcwDCFM.exe
  2⤵
  PID:6068
- C:\Windows\System\rPWbCzE.exe
  C:\Windows\System\rPWbCzE.exe
  2⤵
  PID:6088
- C:\Windows\System\xKZYBcE.exe
  C:\Windows\System\xKZYBcE.exe
  2⤵
  PID:6108
- C:\Windows\System\cgAWduK.exe
  C:\Windows\System\cgAWduK.exe
  2⤵
  PID:6136
- C:\Windows\System\WxhKAjc.exe
  C:\Windows\System\WxhKAjc.exe
  2⤵
  PID:2816
- C:\Windows\System\SYSiNiD.exe
  C:\Windows\System\SYSiNiD.exe
  2⤵
  PID:2560
- C:\Windows\System\ZmQPgtR.exe
  C:\Windows\System\ZmQPgtR.exe
  2⤵
  PID:2448
- C:\Windows\System\LOJnBVw.exe
  C:\Windows\System\LOJnBVw.exe
  2⤵
  PID:5180
- C:\Windows\System\XCpLaXy.exe
  C:\Windows\System\XCpLaXy.exe
  2⤵
  PID:5212
- C:\Windows\System\PqxmIBX.exe
  C:\Windows\System\PqxmIBX.exe
  2⤵
  PID:5292
- C:\Windows\System\RjYdQoB.exe
  C:\Windows\System\RjYdQoB.exe
  2⤵
  PID:3580
- C:\Windows\System\CfUOQuI.exe
  C:\Windows\System\CfUOQuI.exe
  2⤵
  PID:5324
- C:\Windows\System\SqIBIoB.exe
  C:\Windows\System\SqIBIoB.exe
  2⤵
  PID:1292
- C:\Windows\System\LZmDnOB.exe
  C:\Windows\System\LZmDnOB.exe
  2⤵
  PID:5396
- C:\Windows\System\CTEmdAt.exe
  C:\Windows\System\CTEmdAt.exe
  2⤵
  PID:4184
- C:\Windows\System\JHmYRpe.exe
  C:\Windows\System\JHmYRpe.exe
  2⤵
  PID:5468
- C:\Windows\System\KkZsaYK.exe
  C:\Windows\System\KkZsaYK.exe
  2⤵
  PID:5528
- C:\Windows\System\jgwoIPd.exe
  C:\Windows\System\jgwoIPd.exe
  2⤵
  PID:5544
- C:\Windows\System\sNiZCnf.exe
  C:\Windows\System\sNiZCnf.exe
  2⤵
  PID:2376
- C:\Windows\System\OBibpap.exe
  C:\Windows\System\OBibpap.exe
  2⤵
  PID:1344
- C:\Windows\System\qXTJyLV.exe
  C:\Windows\System\qXTJyLV.exe
  2⤵
  PID:5708
- C:\Windows\System\wPBtmyC.exe
  C:\Windows\System\wPBtmyC.exe
  2⤵
  PID:5772
- C:\Windows\System\PbHmTht.exe
  C:\Windows\System\PbHmTht.exe
  2⤵
  PID:5864
- C:\Windows\System\KPzvpdy.exe
  C:\Windows\System\KPzvpdy.exe
  2⤵
  PID:5932
- C:\Windows\System\jyatqxM.exe
  C:\Windows\System\jyatqxM.exe
  2⤵
  PID:6024
- C:\Windows\System\wmTcNky.exe
  C:\Windows\System\wmTcNky.exe
  2⤵
  PID:6060
- C:\Windows\System\aMpkdGS.exe
  C:\Windows\System\aMpkdGS.exe
  2⤵
  PID:6084
- C:\Windows\System\GqhCBoB.exe
  C:\Windows\System\GqhCBoB.exe
  2⤵
  PID:6104
- C:\Windows\System\BLpzmim.exe
  C:\Windows\System\BLpzmim.exe
  2⤵
  PID:4532
- C:\Windows\System\nDtAWEJ.exe
  C:\Windows\System\nDtAWEJ.exe
  2⤵
  PID:5296
- C:\Windows\System\nBXstsj.exe
  C:\Windows\System\nBXstsj.exe
  2⤵
  PID:3868
- C:\Windows\System\gEHiTRr.exe
  C:\Windows\System\gEHiTRr.exe
  2⤵
  PID:5372
- C:\Windows\System\vwhMZti.exe
  C:\Windows\System\vwhMZti.exe
  2⤵
  PID:5768
- C:\Windows\System\KCrGPZK.exe
  C:\Windows\System\KCrGPZK.exe
  2⤵
  PID:4580
- C:\Windows\System\eGbGZTB.exe
  C:\Windows\System\eGbGZTB.exe
  2⤵
  PID:5072
- C:\Windows\System\HGHOAIk.exe
  C:\Windows\System\HGHOAIk.exe
  2⤵
  PID:3664
- C:\Windows\System\AOlcamg.exe
  C:\Windows\System\AOlcamg.exe
  2⤵
  PID:4596
- C:\Windows\System\JPuJRzg.exe
  C:\Windows\System\JPuJRzg.exe
  2⤵
  PID:2328
- C:\Windows\System\vEstBJB.exe
  C:\Windows\System\vEstBJB.exe
  2⤵
  PID:5360
- C:\Windows\System\jSdELyl.exe
  C:\Windows\System\jSdELyl.exe
  2⤵
  PID:5264
- C:\Windows\System\Fopjwjd.exe
  C:\Windows\System\Fopjwjd.exe
  2⤵
  PID:532
- C:\Windows\System\jXRIxkw.exe
  C:\Windows\System\jXRIxkw.exe
  2⤵
  PID:2436
- C:\Windows\System\xrRswom.exe
  C:\Windows\System\xrRswom.exe
  2⤵
  PID:5540
- C:\Windows\System\zDqLrzz.exe
  C:\Windows\System\zDqLrzz.exe
  2⤵
  PID:4656
- C:\Windows\System\oxDphSn.exe
  C:\Windows\System\oxDphSn.exe
  2⤵
  PID:6196
- C:\Windows\System\IjxZibL.exe
  C:\Windows\System\IjxZibL.exe
  2⤵
  PID:6212
- C:\Windows\System\nIRBsqm.exe
  C:\Windows\System\nIRBsqm.exe
  2⤵
  PID:6232
- C:\Windows\System\HiAAnQF.exe
  C:\Windows\System\HiAAnQF.exe
  2⤵
  PID:6272
- C:\Windows\System\dBpcJkz.exe
  C:\Windows\System\dBpcJkz.exe
  2⤵
  PID:6296
- C:\Windows\System\CDboDzC.exe
  C:\Windows\System\CDboDzC.exe
  2⤵
  PID:6316
- C:\Windows\System\dFBRcsJ.exe
  C:\Windows\System\dFBRcsJ.exe
  2⤵
  PID:6356
- C:\Windows\System\qKYILEe.exe
  C:\Windows\System\qKYILEe.exe
  2⤵
  PID:6380
- C:\Windows\System\RfobnDQ.exe
  C:\Windows\System\RfobnDQ.exe
  2⤵
  PID:6408
- C:\Windows\System\vWBDwND.exe
  C:\Windows\System\vWBDwND.exe
  2⤵
  PID:6428
- C:\Windows\System\eSLJTco.exe
  C:\Windows\System\eSLJTco.exe
  2⤵
  PID:6448
- C:\Windows\System\CsuZkvZ.exe
  C:\Windows\System\CsuZkvZ.exe
  2⤵
  PID:6484
- C:\Windows\System\LEwlIhu.exe
  C:\Windows\System\LEwlIhu.exe
  2⤵
  PID:6520
- C:\Windows\System\DMPvnRM.exe
  C:\Windows\System\DMPvnRM.exe
  2⤵
  PID:6548
- C:\Windows\System\EEtumnv.exe
  C:\Windows\System\EEtumnv.exe
  2⤵
  PID:6568
- C:\Windows\System\ONSQVtM.exe
  C:\Windows\System\ONSQVtM.exe
  2⤵
  PID:6612
- C:\Windows\System\mJmOcGP.exe
  C:\Windows\System\mJmOcGP.exe
  2⤵
  PID:6632
- C:\Windows\System\kLTIzlD.exe
  C:\Windows\System\kLTIzlD.exe
  2⤵
  PID:6656
- C:\Windows\System\JCMifgg.exe
  C:\Windows\System\JCMifgg.exe
  2⤵
  PID:6688
- C:\Windows\System\ZVfsWXc.exe
  C:\Windows\System\ZVfsWXc.exe
  2⤵
  PID:6708
- C:\Windows\System\bFXHcXN.exe
  C:\Windows\System\bFXHcXN.exe
  2⤵
  PID:6736
- C:\Windows\System\zDNIpMu.exe
  C:\Windows\System\zDNIpMu.exe
  2⤵
  PID:6752
- C:\Windows\System\oAwdySK.exe
  C:\Windows\System\oAwdySK.exe
  2⤵
  PID:6776
- C:\Windows\System\jUKncpf.exe
  C:\Windows\System\jUKncpf.exe
  2⤵
  PID:6796
- C:\Windows\System\DNtglaG.exe
  C:\Windows\System\DNtglaG.exe
  2⤵
  PID:6832
- C:\Windows\System\PguDgNN.exe
  C:\Windows\System\PguDgNN.exe
  2⤵
  PID:6872
- C:\Windows\System\fuorNcw.exe
  C:\Windows\System\fuorNcw.exe
  2⤵
  PID:6892
- C:\Windows\System\CppmrZK.exe
  C:\Windows\System\CppmrZK.exe
  2⤵
  PID:6928
- C:\Windows\System\uYxkUvc.exe
  C:\Windows\System\uYxkUvc.exe
  2⤵
  PID:6968
- C:\Windows\System\ZbbGcQM.exe
  C:\Windows\System\ZbbGcQM.exe
  2⤵
  PID:6996
- C:\Windows\System\ndxSXok.exe
  C:\Windows\System\ndxSXok.exe
  2⤵
  PID:7016
- C:\Windows\System\eAmAXMk.exe
  C:\Windows\System\eAmAXMk.exe
  2⤵
  PID:7056
- C:\Windows\System\flBXrOI.exe
  C:\Windows\System\flBXrOI.exe
  2⤵
  PID:7080
- C:\Windows\System\BQlPgtH.exe
  C:\Windows\System\BQlPgtH.exe
  2⤵
  PID:7108
- C:\Windows\System\rPTRwhc.exe
  C:\Windows\System\rPTRwhc.exe
  2⤵
  PID:7128
- C:\Windows\System\eAxLHUQ.exe
  C:\Windows\System\eAxLHUQ.exe
  2⤵
  PID:7148
- C:\Windows\System\FvPFyWj.exe
  C:\Windows\System\FvPFyWj.exe
  2⤵
  PID:4880
- C:\Windows\System\QntEyiX.exe
  C:\Windows\System\QntEyiX.exe
  2⤵
  PID:6176
- C:\Windows\System\hMFAyWM.exe
  C:\Windows\System\hMFAyWM.exe
  2⤵
  PID:2752
- C:\Windows\System\eSHluhJ.exe
  C:\Windows\System\eSHluhJ.exe
  2⤵
  PID:6264
- C:\Windows\System\UVtNYuN.exe
  C:\Windows\System\UVtNYuN.exe
  2⤵
  PID:6348
- C:\Windows\System\pJVdxSx.exe
  C:\Windows\System\pJVdxSx.exe
  2⤵
  PID:6420
- C:\Windows\System\BjYzoIV.exe
  C:\Windows\System\BjYzoIV.exe
  2⤵
  PID:6480
- C:\Windows\System\bWrmZbv.exe
  C:\Windows\System\bWrmZbv.exe
  2⤵
  PID:6556
- C:\Windows\System\zREqusJ.exe
  C:\Windows\System\zREqusJ.exe
  2⤵
  PID:6604
- C:\Windows\System\SucTdFc.exe
  C:\Windows\System\SucTdFc.exe
  2⤵
  PID:6640
- C:\Windows\System\LUGfzie.exe
  C:\Windows\System\LUGfzie.exe
  2⤵
  PID:6704
- C:\Windows\System\KjEpQMU.exe
  C:\Windows\System\KjEpQMU.exe
  2⤵
  PID:6768
- C:\Windows\System\CLkCqkr.exe
  C:\Windows\System\CLkCqkr.exe
  2⤵
  PID:6880
- C:\Windows\System\aVVYZBY.exe
  C:\Windows\System\aVVYZBY.exe
  2⤵
  PID:6924
- C:\Windows\System\laokIFg.exe
  C:\Windows\System\laokIFg.exe
  2⤵
  PID:6964
- C:\Windows\System\FbYciBK.exe
  C:\Windows\System\FbYciBK.exe
  2⤵
  PID:7008
- C:\Windows\System\GaVBOtl.exe
  C:\Windows\System\GaVBOtl.exe
  2⤵
  PID:7076
- C:\Windows\System\cCJwZwE.exe
  C:\Windows\System\cCJwZwE.exe
  2⤵
  PID:7124
- C:\Windows\System\XFPFmwF.exe
  C:\Windows\System\XFPFmwF.exe
  2⤵
  PID:4156
- C:\Windows\System\WVVKgDl.exe
  C:\Windows\System\WVVKgDl.exe
  2⤵
  PID:2684
- C:\Windows\System\EMskGTg.exe
  C:\Windows\System\EMskGTg.exe
  2⤵
  PID:6416
- C:\Windows\System\XKtquKO.exe
  C:\Windows\System\XKtquKO.exe
  2⤵
  PID:6652
- C:\Windows\System\bLwSIWg.exe
  C:\Windows\System\bLwSIWg.exe
  2⤵
  PID:6784
- C:\Windows\System\bRtsuLM.exe
  C:\Windows\System\bRtsuLM.exe
  2⤵
  PID:6828
- C:\Windows\System\lBkbYDT.exe
  C:\Windows\System\lBkbYDT.exe
  2⤵
  PID:6944
- C:\Windows\System\RlwuSCw.exe
  C:\Windows\System\RlwuSCw.exe
  2⤵
  PID:6288
- C:\Windows\System\UQdhYsB.exe
  C:\Windows\System\UQdhYsB.exe
  2⤵
  PID:6308
- C:\Windows\System\FiBHUXt.exe
  C:\Windows\System\FiBHUXt.exe
  2⤵
  PID:6868
- C:\Windows\System\bnpUbpH.exe
  C:\Windows\System\bnpUbpH.exe
  2⤵
  PID:5472
- C:\Windows\System\tzdLHEr.exe
  C:\Windows\System\tzdLHEr.exe
  2⤵
  PID:6352
- C:\Windows\System\zKaOHOb.exe
  C:\Windows\System\zKaOHOb.exe
  2⤵
  PID:6224
- C:\Windows\System\jxBVdSN.exe
  C:\Windows\System\jxBVdSN.exe
  2⤵
  PID:7176
- C:\Windows\System\ShgLlfV.exe
  C:\Windows\System\ShgLlfV.exe
  2⤵
  PID:7204
- C:\Windows\System\NXIdnMw.exe
  C:\Windows\System\NXIdnMw.exe
  2⤵
  PID:7224
- C:\Windows\System\hiFOkcs.exe
  C:\Windows\System\hiFOkcs.exe
  2⤵
  PID:7244
- C:\Windows\System\KSvdVbm.exe
  C:\Windows\System\KSvdVbm.exe
  2⤵
  PID:7276
- C:\Windows\System\qwEhElA.exe
  C:\Windows\System\qwEhElA.exe
  2⤵
  PID:7320
- C:\Windows\System\QXgrcJC.exe
  C:\Windows\System\QXgrcJC.exe
  2⤵
  PID:7380
- C:\Windows\System\qSTjTgh.exe
  C:\Windows\System\qSTjTgh.exe
  2⤵
  PID:7408
- C:\Windows\System\YaRoeGc.exe
  C:\Windows\System\YaRoeGc.exe
  2⤵
  PID:7444
- C:\Windows\System\jNJfKAL.exe
  C:\Windows\System\jNJfKAL.exe
  2⤵
  PID:7464
- C:\Windows\System\AGfZnFl.exe
  C:\Windows\System\AGfZnFl.exe
  2⤵
  PID:7488
- C:\Windows\System\ajxRhLb.exe
  C:\Windows\System\ajxRhLb.exe
  2⤵
  PID:7508
- C:\Windows\System\AXDQTjM.exe
  C:\Windows\System\AXDQTjM.exe
  2⤵
  PID:7556
- C:\Windows\System\lgluiYw.exe
  C:\Windows\System\lgluiYw.exe
  2⤵
  PID:7572
- C:\Windows\System\cfsRRUY.exe
  C:\Windows\System\cfsRRUY.exe
  2⤵
  PID:7592
- C:\Windows\System\WWTOHMc.exe
  C:\Windows\System\WWTOHMc.exe
  2⤵
  PID:7624
- C:\Windows\System\OWqIZGy.exe
  C:\Windows\System\OWqIZGy.exe
  2⤵
  PID:7652
- C:\Windows\System\IYPuUkO.exe
  C:\Windows\System\IYPuUkO.exe
  2⤵
  PID:7672
- C:\Windows\System\qfnaiMF.exe
  C:\Windows\System\qfnaiMF.exe
  2⤵
  PID:7692
- C:\Windows\System\nIdmORr.exe
  C:\Windows\System\nIdmORr.exe
  2⤵
  PID:7720
- C:\Windows\System\umCzuFz.exe
  C:\Windows\System\umCzuFz.exe
  2⤵
  PID:7760
- C:\Windows\System\HSxfuGW.exe
  C:\Windows\System\HSxfuGW.exe
  2⤵
  PID:7788
- C:\Windows\System\lizzaQD.exe
  C:\Windows\System\lizzaQD.exe
  2⤵
  PID:7804
- C:\Windows\System\ldEYzah.exe
  C:\Windows\System\ldEYzah.exe
  2⤵
  PID:7824
- C:\Windows\System\XFRyBTa.exe
  C:\Windows\System\XFRyBTa.exe
  2⤵
  PID:7844
- C:\Windows\System\hsaUizO.exe
  C:\Windows\System\hsaUizO.exe
  2⤵
  PID:7904
- C:\Windows\System\zvweBuH.exe
  C:\Windows\System\zvweBuH.exe
  2⤵
  PID:7920
- C:\Windows\System\WEEiQDb.exe
  C:\Windows\System\WEEiQDb.exe
  2⤵
  PID:7952
- C:\Windows\System\WEmaDyd.exe
  C:\Windows\System\WEmaDyd.exe
  2⤵
  PID:7968
- C:\Windows\System\vsPHHWV.exe
  C:\Windows\System\vsPHHWV.exe
  2⤵
  PID:7988
- C:\Windows\System\zZZOlVw.exe
  C:\Windows\System\zZZOlVw.exe
  2⤵
  PID:8012
- C:\Windows\System\LKRAOoY.exe
  C:\Windows\System\LKRAOoY.exe
  2⤵
  PID:8044
- C:\Windows\System\iJYHdZG.exe
  C:\Windows\System\iJYHdZG.exe
  2⤵
  PID:8068
- C:\Windows\System\RYrWCkn.exe
  C:\Windows\System\RYrWCkn.exe
  2⤵
  PID:8092
- C:\Windows\System\pyeGorC.exe
  C:\Windows\System\pyeGorC.exe
  2⤵
  PID:8116
- C:\Windows\System\fGlXFkB.exe
  C:\Windows\System\fGlXFkB.exe
  2⤵
  PID:8140
- C:\Windows\System\ytdilDt.exe
  C:\Windows\System\ytdilDt.exe
  2⤵
  PID:8160
- C:\Windows\System\AIbOCAn.exe
  C:\Windows\System\AIbOCAn.exe
  2⤵
  PID:7252
- C:\Windows\System\HRvcvqw.exe
  C:\Windows\System\HRvcvqw.exe
  2⤵
  PID:7288
- C:\Windows\System\uQEqHRH.exe
  C:\Windows\System\uQEqHRH.exe
  2⤵
  PID:7332
- C:\Windows\System\SYupBmT.exe
  C:\Windows\System\SYupBmT.exe
  2⤵
  PID:7388
- C:\Windows\System\kJnDdPi.exe
  C:\Windows\System\kJnDdPi.exe
  2⤵
  PID:7588
- C:\Windows\System\CvioNJv.exe
  C:\Windows\System\CvioNJv.exe
  2⤵
  PID:7644
- C:\Windows\System\NaxSYXS.exe
  C:\Windows\System\NaxSYXS.exe
  2⤵
  PID:7668
- C:\Windows\System\eyZHJYG.exe
  C:\Windows\System\eyZHJYG.exe
  2⤵
  PID:7756
- C:\Windows\System\yeSPKfW.exe
  C:\Windows\System\yeSPKfW.exe
  2⤵
  PID:7872
- C:\Windows\System\ABaTqeD.exe
  C:\Windows\System\ABaTqeD.exe
  2⤵
  PID:7912
- C:\Windows\System\NYAqQtT.exe
  C:\Windows\System\NYAqQtT.exe
  2⤵
  PID:8032
- C:\Windows\System\uSZOxDX.exe
  C:\Windows\System\uSZOxDX.exe
  2⤵
  PID:8060
- C:\Windows\System\CCCiSVX.exe
  C:\Windows\System\CCCiSVX.exe
  2⤵
  PID:8124
- C:\Windows\System\IqHOTJx.exe
  C:\Windows\System\IqHOTJx.exe
  2⤵
  PID:8176
- C:\Windows\System\JjFLJFI.exe
  C:\Windows\System\JjFLJFI.exe
  2⤵
  PID:7216
- C:\Windows\System\ZyAWTGq.exe
  C:\Windows\System\ZyAWTGq.exe
  2⤵
  PID:7504
- C:\Windows\System\LvSBIbj.exe
  C:\Windows\System\LvSBIbj.exe
  2⤵
  PID:7608
- C:\Windows\System\KnxuFFE.exe
  C:\Windows\System\KnxuFFE.exe
  2⤵
  PID:7820
- C:\Windows\System\trrrpxC.exe
  C:\Windows\System\trrrpxC.exe
  2⤵
  PID:7752
- C:\Windows\System\yQpkvWE.exe
  C:\Windows\System\yQpkvWE.exe
  2⤵
  PID:7944
- C:\Windows\System\pIzPaLB.exe
  C:\Windows\System\pIzPaLB.exe
  2⤵
  PID:7856
- C:\Windows\System\CwrZzuJ.exe
  C:\Windows\System\CwrZzuJ.exe
  2⤵
  PID:7980
- C:\Windows\System\CrScTrA.exe
  C:\Windows\System\CrScTrA.exe
  2⤵
  PID:8148
- C:\Windows\System\MvhmQDL.exe
  C:\Windows\System\MvhmQDL.exe
  2⤵
  PID:7712
- C:\Windows\System\ZOygRfV.exe
  C:\Windows\System\ZOygRfV.exe
  2⤵
  PID:7172
- C:\Windows\System\JdSYLah.exe
  C:\Windows\System\JdSYLah.exe
  2⤵
  PID:7832
- C:\Windows\System\HHyUGtO.exe
  C:\Windows\System\HHyUGtO.exe
  2⤵
  PID:7568
- C:\Windows\System\WxuwYGL.exe
  C:\Windows\System\WxuwYGL.exe
  2⤵
  PID:8220
- C:\Windows\System\AnYeYnI.exe
  C:\Windows\System\AnYeYnI.exe
  2⤵
  PID:8268
- C:\Windows\System\TulLoOA.exe
  C:\Windows\System\TulLoOA.exe
  2⤵
  PID:8288
- C:\Windows\System\dRGKKRT.exe
  C:\Windows\System\dRGKKRT.exe
  2⤵
  PID:8316
- C:\Windows\System\DnZeOZR.exe
  C:\Windows\System\DnZeOZR.exe
  2⤵
  PID:8340
- C:\Windows\System\WgglXpk.exe
  C:\Windows\System\WgglXpk.exe
  2⤵
  PID:8360
- C:\Windows\System\SzARPZQ.exe
  C:\Windows\System\SzARPZQ.exe
  2⤵
  PID:8380
- C:\Windows\System\srfSjWg.exe
  C:\Windows\System\srfSjWg.exe
  2⤵
  PID:8412
- C:\Windows\System\thAEZTQ.exe
  C:\Windows\System\thAEZTQ.exe
  2⤵
  PID:8448
- C:\Windows\System\tNzfqDv.exe
  C:\Windows\System\tNzfqDv.exe
  2⤵
  PID:8468
- C:\Windows\System\LJaQbQn.exe
  C:\Windows\System\LJaQbQn.exe
  2⤵
  PID:8492
- C:\Windows\System\MYDXIYC.exe
  C:\Windows\System\MYDXIYC.exe
  2⤵
  PID:8520
- C:\Windows\System\zDgMECt.exe
  C:\Windows\System\zDgMECt.exe
  2⤵
  PID:8572
- C:\Windows\System\SsTrspM.exe
  C:\Windows\System\SsTrspM.exe
  2⤵
  PID:8596
- C:\Windows\System\RcHedvN.exe
  C:\Windows\System\RcHedvN.exe
  2⤵
  PID:8640
- C:\Windows\System\aBFKvHp.exe
  C:\Windows\System\aBFKvHp.exe
  2⤵
  PID:8668
- C:\Windows\System\mPcpFXO.exe
  C:\Windows\System\mPcpFXO.exe
  2⤵
  PID:8692
- C:\Windows\System\iWpgYiW.exe
  C:\Windows\System\iWpgYiW.exe
  2⤵
  PID:8732
- C:\Windows\System\TnxFvyC.exe
  C:\Windows\System\TnxFvyC.exe
  2⤵
  PID:8748
- C:\Windows\System\oSUNJAY.exe
  C:\Windows\System\oSUNJAY.exe
  2⤵
  PID:8772
- C:\Windows\System\jDcbXcc.exe
  C:\Windows\System\jDcbXcc.exe
  2⤵
  PID:8796
- C:\Windows\System\ZeRnzBj.exe
  C:\Windows\System\ZeRnzBj.exe
  2⤵
  PID:8820
- C:\Windows\System\AWOujfE.exe
  C:\Windows\System\AWOujfE.exe
  2⤵
  PID:8844
- C:\Windows\System\pUjflmT.exe
  C:\Windows\System\pUjflmT.exe
  2⤵
  PID:8860
- C:\Windows\System\wwRjQUH.exe
  C:\Windows\System\wwRjQUH.exe
  2⤵
  PID:8888
- C:\Windows\System\yGBzJXn.exe
  C:\Windows\System\yGBzJXn.exe
  2⤵
  PID:8908
- C:\Windows\System\nQxMLxL.exe
  C:\Windows\System\nQxMLxL.exe
  2⤵
  PID:8952
- C:\Windows\System\hmsRoHd.exe
  C:\Windows\System\hmsRoHd.exe
  2⤵
  PID:9000
- C:\Windows\System\zSvfDUN.exe
  C:\Windows\System\zSvfDUN.exe
  2⤵
  PID:9028
- C:\Windows\System\iOUzwsA.exe
  C:\Windows\System\iOUzwsA.exe
  2⤵
  PID:9052
- C:\Windows\System\bHTNgcc.exe
  C:\Windows\System\bHTNgcc.exe
  2⤵
  PID:9072
- C:\Windows\System\euAtKxK.exe
  C:\Windows\System\euAtKxK.exe
  2⤵
  PID:9088
- C:\Windows\System\JPmsEwT.exe
  C:\Windows\System\JPmsEwT.exe
  2⤵
  PID:9144
- C:\Windows\System\pCAOsJb.exe
  C:\Windows\System\pCAOsJb.exe
  2⤵
  PID:9176
- C:\Windows\System\URnwLfC.exe
  C:\Windows\System\URnwLfC.exe
  2⤵
  PID:9192
- C:\Windows\System\iqrkbLy.exe
  C:\Windows\System\iqrkbLy.exe
  2⤵
  PID:9212
- C:\Windows\System\wZpucJE.exe
  C:\Windows\System\wZpucJE.exe
  2⤵
  PID:8256
- C:\Windows\System\TKNVELj.exe
  C:\Windows\System\TKNVELj.exe
  2⤵
  PID:8276
- C:\Windows\System\xojOLau.exe
  C:\Windows\System\xojOLau.exe
  2⤵
  PID:8348
- C:\Windows\System\qEwdFwj.exe
  C:\Windows\System\qEwdFwj.exe
  2⤵
  PID:8404
- C:\Windows\System\sbNNykc.exe
  C:\Windows\System\sbNNykc.exe
  2⤵
  PID:8440
- C:\Windows\System\WkVTryi.exe
  C:\Windows\System\WkVTryi.exe
  2⤵
  PID:8504
- C:\Windows\System\ArSeaXw.exe
  C:\Windows\System\ArSeaXw.exe
  2⤵
  PID:8616
- C:\Windows\System\HyCIgXR.exe
  C:\Windows\System\HyCIgXR.exe
  2⤵
  PID:8540
- C:\Windows\System\LHgfekQ.exe
  C:\Windows\System\LHgfekQ.exe
  2⤵
  PID:8740
- C:\Windows\System\ZScoGtG.exe
  C:\Windows\System\ZScoGtG.exe
  2⤵
  PID:8904
- C:\Windows\System\InOBuAq.exe
  C:\Windows\System\InOBuAq.exe
  2⤵
  PID:8856
- C:\Windows\System\tmUFonv.exe
  C:\Windows\System\tmUFonv.exe
  2⤵
  PID:8968
- C:\Windows\System\xeRpyau.exe
  C:\Windows\System\xeRpyau.exe
  2⤵
  PID:8996
- C:\Windows\System\WUoOlZl.exe
  C:\Windows\System\WUoOlZl.exe
  2⤵
  PID:9164
- C:\Windows\System\TLAezPH.exe
  C:\Windows\System\TLAezPH.exe
  2⤵
  PID:9184
- C:\Windows\System\cqFwHie.exe
  C:\Windows\System\cqFwHie.exe
  2⤵
  PID:8232
- C:\Windows\System\StIVVmq.exe
  C:\Windows\System\StIVVmq.exe
  2⤵
  PID:8376
- C:\Windows\System\FJvYFRH.exe
  C:\Windows\System\FJvYFRH.exe
  2⤵
  PID:8712
- C:\Windows\System\NuPxjoN.exe
  C:\Windows\System\NuPxjoN.exe
  2⤵
  PID:8780
- C:\Windows\System\fmSiWdx.exe
  C:\Windows\System\fmSiWdx.exe
  2⤵
  PID:8900
- C:\Windows\System\MQJqwUz.exe
  C:\Windows\System\MQJqwUz.exe
  2⤵
  PID:9008
- C:\Windows\System\VihWLrW.exe
  C:\Windows\System\VihWLrW.exe
  2⤵
  PID:9080
- C:\Windows\System\BmappBp.exe
  C:\Windows\System\BmappBp.exe
  2⤵
  PID:8304
- C:\Windows\System\ijZzMbm.exe
  C:\Windows\System\ijZzMbm.exe
  2⤵
  PID:8868
- C:\Windows\System\DNnJHIh.exe
  C:\Windows\System\DNnJHIh.exe
  2⤵
  PID:8436
- C:\Windows\System\hdTxvyt.exe
  C:\Windows\System\hdTxvyt.exe
  2⤵
  PID:8556
- C:\Windows\System\vhdQZXc.exe
  C:\Windows\System\vhdQZXc.exe
  2⤵
  PID:9232
- C:\Windows\System\FherGBr.exe
  C:\Windows\System\FherGBr.exe
  2⤵
  PID:9264
- C:\Windows\System\cMWcPky.exe
  C:\Windows\System\cMWcPky.exe
  2⤵
  PID:9288
- C:\Windows\System\jreLtnG.exe
  C:\Windows\System\jreLtnG.exe
  2⤵
  PID:9316
- C:\Windows\System\HpJaFGJ.exe
  C:\Windows\System\HpJaFGJ.exe
  2⤵
  PID:9340
- C:\Windows\System\mxNBraF.exe
  C:\Windows\System\mxNBraF.exe
  2⤵
  PID:9376
- C:\Windows\System\NnUGyoo.exe
  C:\Windows\System\NnUGyoo.exe
  2⤵
  PID:9412
- C:\Windows\System\wJLSGAb.exe
  C:\Windows\System\wJLSGAb.exe
  2⤵
  PID:9456
- C:\Windows\System\sUeHsxv.exe
  C:\Windows\System\sUeHsxv.exe
  2⤵
  PID:9476
- C:\Windows\System\VjHCAOA.exe
  C:\Windows\System\VjHCAOA.exe
  2⤵
  PID:9496
- C:\Windows\System\QTPRoym.exe
  C:\Windows\System\QTPRoym.exe
  2⤵
  PID:9524
- C:\Windows\System\jXDHVXD.exe
  C:\Windows\System\jXDHVXD.exe
  2⤵
  PID:9556
- C:\Windows\System\djEBtJa.exe
  C:\Windows\System\djEBtJa.exe
  2⤵
  PID:9580
- C:\Windows\System\CMKdZlC.exe
  C:\Windows\System\CMKdZlC.exe
  2⤵
  PID:9600
- C:\Windows\System\eSkejcw.exe
  C:\Windows\System\eSkejcw.exe
  2⤵
  PID:9660
- C:\Windows\System\ikpVvQJ.exe
  C:\Windows\System\ikpVvQJ.exe
  2⤵
  PID:9692
- C:\Windows\System\PrLiQnN.exe
  C:\Windows\System\PrLiQnN.exe
  2⤵
  PID:9708
- C:\Windows\System\tRjUYkk.exe
  C:\Windows\System\tRjUYkk.exe
  2⤵
  PID:9728
- C:\Windows\System\IRvTCuc.exe
  C:\Windows\System\IRvTCuc.exe
  2⤵
  PID:9752
- C:\Windows\System\tNMKCsO.exe
  C:\Windows\System\tNMKCsO.exe
  2⤵
  PID:9768
- C:\Windows\System\PcOBoqp.exe
  C:\Windows\System\PcOBoqp.exe
  2⤵
  PID:9816
- C:\Windows\System\JDMoLrE.exe
  C:\Windows\System\JDMoLrE.exe
  2⤵
  PID:9852
- C:\Windows\System\vxzJiAo.exe
  C:\Windows\System\vxzJiAo.exe
  2⤵
  PID:9876
- C:\Windows\System\yHFQCCu.exe
  C:\Windows\System\yHFQCCu.exe
  2⤵
  PID:9896
- C:\Windows\System\srfNmKm.exe
  C:\Windows\System\srfNmKm.exe
  2⤵
  PID:9924
- C:\Windows\System\LISWJMD.exe
  C:\Windows\System\LISWJMD.exe
  2⤵
  PID:9956
- C:\Windows\System\fkMyjmC.exe
  C:\Windows\System\fkMyjmC.exe
  2⤵
  PID:10000
- C:\Windows\System\DzFKcfk.exe
  C:\Windows\System\DzFKcfk.exe
  2⤵
  PID:10016
- C:\Windows\System\BsqKhGJ.exe
  C:\Windows\System\BsqKhGJ.exe
  2⤵
  PID:10044
- C:\Windows\System\xqNznbL.exe
  C:\Windows\System\xqNznbL.exe
  2⤵
  PID:10084
- C:\Windows\System\cuKnBiw.exe
  C:\Windows\System\cuKnBiw.exe
  2⤵
  PID:10100
- C:\Windows\System\EFMMNcI.exe
  C:\Windows\System\EFMMNcI.exe
  2⤵
  PID:10120
- C:\Windows\System\CADOWbF.exe
  C:\Windows\System\CADOWbF.exe
  2⤵
  PID:10160
- C:\Windows\System\jOBDCAB.exe
  C:\Windows\System\jOBDCAB.exe
  2⤵
  PID:10192
- C:\Windows\System\WMRCgKZ.exe
  C:\Windows\System\WMRCgKZ.exe
  2⤵
  PID:10212
- C:\Windows\System\WXTxQnD.exe
  C:\Windows\System\WXTxQnD.exe
  2⤵
  PID:9040
- C:\Windows\System\iVTsjcQ.exe
  C:\Windows\System\iVTsjcQ.exe
  2⤵
  PID:9248
- C:\Windows\System\ZEnITGa.exe
  C:\Windows\System\ZEnITGa.exe
  2⤵
  PID:9312
- C:\Windows\System\qEHxowL.exe
  C:\Windows\System\qEHxowL.exe
  2⤵
  PID:9364
- C:\Windows\System\FNjccMU.exe
  C:\Windows\System\FNjccMU.exe
  2⤵
  PID:9464
- C:\Windows\System\bUoLiag.exe
  C:\Windows\System\bUoLiag.exe
  2⤵
  PID:9532
- C:\Windows\System\UJkudds.exe
  C:\Windows\System\UJkudds.exe
  2⤵
  PID:9572
- C:\Windows\System\RaDrLsm.exe
  C:\Windows\System\RaDrLsm.exe
  2⤵
  PID:9616
- C:\Windows\System\ExTKHpS.exe
  C:\Windows\System\ExTKHpS.exe
  2⤵
  PID:9704
- C:\Windows\System\yMPdsHm.exe
  C:\Windows\System\yMPdsHm.exe
  2⤵
  PID:9720
- C:\Windows\System\SxYVywE.exe
  C:\Windows\System\SxYVywE.exe
  2⤵
  PID:9764
- C:\Windows\System\VvMLIVV.exe
  C:\Windows\System\VvMLIVV.exe
  2⤵
  PID:9844
- C:\Windows\System\KuqDLZo.exe
  C:\Windows\System\KuqDLZo.exe
  2⤵
  PID:9892
- C:\Windows\System\UIPDIFc.exe
  C:\Windows\System\UIPDIFc.exe
  2⤵
  PID:9952
- C:\Windows\System\yEkRCzZ.exe
  C:\Windows\System\yEkRCzZ.exe
  2⤵
  PID:10012
- C:\Windows\System\HpZGCNL.exe
  C:\Windows\System\HpZGCNL.exe
  2⤵
  PID:10068
- C:\Windows\System\TlccqAf.exe
  C:\Windows\System\TlccqAf.exe
  2⤵
  PID:10144
- C:\Windows\System\cDGPLoy.exe
  C:\Windows\System\cDGPLoy.exe
  2⤵
  PID:10184
- C:\Windows\System\LoyQkvY.exe
  C:\Windows\System\LoyQkvY.exe
  2⤵
  PID:9308
- C:\Windows\System\PXybFZe.exe
  C:\Windows\System\PXybFZe.exe
  2⤵
  PID:9520
- C:\Windows\System\xcVrYpl.exe
  C:\Windows\System\xcVrYpl.exe
  2⤵
  PID:672
- C:\Windows\System\JvPLXvG.exe
  C:\Windows\System\JvPLXvG.exe
  2⤵
  PID:9700
- C:\Windows\System\XyBaHoW.exe
  C:\Windows\System\XyBaHoW.exe
  2⤵
  PID:9996
- C:\Windows\System\cYEliPS.exe
  C:\Windows\System\cYEliPS.exe
  2⤵
  PID:10112
- C:\Windows\System\PlEkLTa.exe
  C:\Windows\System\PlEkLTa.exe
  2⤵
  PID:9360
- C:\Windows\System\bxwXURm.exe
  C:\Windows\System\bxwXURm.exe
  2⤵
  PID:9888
- C:\Windows\System\yelRQbY.exe
  C:\Windows\System\yelRQbY.exe
  2⤵
  PID:9656
- C:\Windows\System\bGnLscv.exe
  C:\Windows\System\bGnLscv.exe
  2⤵
  PID:9240
- C:\Windows\System\AsEPDzq.exe
  C:\Windows\System\AsEPDzq.exe
  2⤵
  PID:10248
- C:\Windows\System\dnRbSEG.exe
  C:\Windows\System\dnRbSEG.exe
  2⤵
  PID:10268
- C:\Windows\System\xvGQWrF.exe
  C:\Windows\System\xvGQWrF.exe
  2⤵
  PID:10288
- C:\Windows\System\ZnWxPhD.exe
  C:\Windows\System\ZnWxPhD.exe
  2⤵
  PID:10312
- C:\Windows\System\SoWQBjv.exe
  C:\Windows\System\SoWQBjv.exe
  2⤵
  PID:10336
- C:\Windows\System\mddqXRU.exe
  C:\Windows\System\mddqXRU.exe
  2⤵
  PID:10364
- C:\Windows\System\XwhPrXI.exe
  C:\Windows\System\XwhPrXI.exe
  2⤵
  PID:10400
- C:\Windows\System\bBUovWH.exe
  C:\Windows\System\bBUovWH.exe
  2⤵
  PID:10444
- C:\Windows\System\FaLwicj.exe
  C:\Windows\System\FaLwicj.exe
  2⤵
  PID:10468
- C:\Windows\System\XAWYkVA.exe
  C:\Windows\System\XAWYkVA.exe
  2⤵
  PID:10488
- C:\Windows\System\JQXYKNf.exe
  C:\Windows\System\JQXYKNf.exe
  2⤵
  PID:10512
- C:\Windows\System\CSFHcjZ.exe
  C:\Windows\System\CSFHcjZ.exe
  2⤵
  PID:10556
- C:\Windows\System\BPJmquP.exe
  C:\Windows\System\BPJmquP.exe
  2⤵
  PID:10588
- C:\Windows\System\mqvaLEI.exe
  C:\Windows\System\mqvaLEI.exe
  2⤵
  PID:10608
- C:\Windows\System\OFLNgiJ.exe
  C:\Windows\System\OFLNgiJ.exe
  2⤵
  PID:10632
- C:\Windows\System\eeBrlSA.exe
  C:\Windows\System\eeBrlSA.exe
  2⤵
  PID:10660
- C:\Windows\System\IcaBPxb.exe
  C:\Windows\System\IcaBPxb.exe
  2⤵
  PID:10680
- C:\Windows\System\hJRdSml.exe
  C:\Windows\System\hJRdSml.exe
  2⤵
  PID:10696
- C:\Windows\System\OxpyBTF.exe
  C:\Windows\System\OxpyBTF.exe
  2⤵
  PID:10716
- C:\Windows\System\xHsefvn.exe
  C:\Windows\System\xHsefvn.exe
  2⤵
  PID:10740
- C:\Windows\System\MvtWWeV.exe
  C:\Windows\System\MvtWWeV.exe
  2⤵
  PID:10796
- C:\Windows\System\ugTrKod.exe
  C:\Windows\System\ugTrKod.exe
  2⤵
  PID:10824
- C:\Windows\System\rViaHiI.exe
  C:\Windows\System\rViaHiI.exe
  2⤵
  PID:10840
- C:\Windows\System\pOEHLPj.exe
  C:\Windows\System\pOEHLPj.exe
  2⤵
  PID:10896
- C:\Windows\System\BMYWcRn.exe
  C:\Windows\System\BMYWcRn.exe
  2⤵
  PID:10916
- C:\Windows\System\UIRCDlK.exe
  C:\Windows\System\UIRCDlK.exe
  2⤵
  PID:10932
- C:\Windows\System\lUErNgR.exe
  C:\Windows\System\lUErNgR.exe
  2⤵
  PID:10948
- C:\Windows\System\gwPhTrT.exe
  C:\Windows\System\gwPhTrT.exe
  2⤵
  PID:11000
- C:\Windows\System\xBLLFEp.exe
  C:\Windows\System\xBLLFEp.exe
  2⤵
  PID:11036
- C:\Windows\System\XlaWcSl.exe
  C:\Windows\System\XlaWcSl.exe
  2⤵
  PID:11060
- C:\Windows\System\RktVgHF.exe
  C:\Windows\System\RktVgHF.exe
  2⤵
  PID:11076
- C:\Windows\System\bkqDSZs.exe
  C:\Windows\System\bkqDSZs.exe
  2⤵
  PID:11112
- C:\Windows\System\QUhjCre.exe
  C:\Windows\System\QUhjCre.exe
  2⤵
  PID:11132
- C:\Windows\System\DTgPSvI.exe
  C:\Windows\System\DTgPSvI.exe
  2⤵
  PID:11164
- C:\Windows\System\feHyCWK.exe
  C:\Windows\System\feHyCWK.exe
  2⤵
  PID:11188
- C:\Windows\System\VGayQCR.exe
  C:\Windows\System\VGayQCR.exe
  2⤵
  PID:11224
- C:\Windows\System\nKXvbtK.exe
  C:\Windows\System\nKXvbtK.exe
  2⤵
  PID:11240
- C:\Windows\System\aUXYjgI.exe
  C:\Windows\System\aUXYjgI.exe
  2⤵
  PID:10264
- C:\Windows\System\lgYcWSi.exe
  C:\Windows\System\lgYcWSi.exe
  2⤵
  PID:10296
- C:\Windows\System\wBWYjeR.exe
  C:\Windows\System\wBWYjeR.exe
  2⤵
  PID:10524
- C:\Windows\System\RAQtUYP.exe
  C:\Windows\System\RAQtUYP.exe
  2⤵
  PID:10580
- C:\Windows\System\jLicfzy.exe
  C:\Windows\System\jLicfzy.exe
  2⤵
  PID:10600
- C:\Windows\System\xBzMJZr.exe
  C:\Windows\System\xBzMJZr.exe
  2⤵
  PID:10668
- C:\Windows\System\oNVWBGS.exe
  C:\Windows\System\oNVWBGS.exe
  2⤵
  PID:10672
- C:\Windows\System\LYABGRy.exe
  C:\Windows\System\LYABGRy.exe
  2⤵
  PID:10708
- C:\Windows\System\yBLVKRj.exe
  C:\Windows\System\yBLVKRj.exe
  2⤵
  PID:10752
- C:\Windows\System\ONsFjFz.exe
  C:\Windows\System\ONsFjFz.exe
  2⤵
  PID:10804
- C:\Windows\System\vQiemFL.exe
  C:\Windows\System\vQiemFL.exe
  2⤵
  PID:10888
- C:\Windows\System\WejLRnn.exe
  C:\Windows\System\WejLRnn.exe
  2⤵
  PID:10908
- C:\Windows\System\IKOvtPC.exe
  C:\Windows\System\IKOvtPC.exe
  2⤵
  PID:10924
- C:\Windows\System\LGISDhE.exe
  C:\Windows\System\LGISDhE.exe
  2⤵
  PID:10940
- C:\Windows\System\PpRowhl.exe
  C:\Windows\System\PpRowhl.exe
  2⤵
  PID:10988
- C:\Windows\System\VbCSGBc.exe
  C:\Windows\System\VbCSGBc.exe
  2⤵
  PID:11032
- C:\Windows\System\IEiRbMf.exe
  C:\Windows\System\IEiRbMf.exe
  2⤵
  PID:11128
- C:\Windows\System\LnxYIUm.exe
  C:\Windows\System\LnxYIUm.exe
  2⤵
  PID:11092
- C:\Windows\System\ASKkAdh.exe
  C:\Windows\System\ASKkAdh.exe
  2⤵
  PID:11144
- C:\Windows\System\EfewTDk.exe
  C:\Windows\System\EfewTDk.exe
  2⤵
  PID:11236
- C:\Windows\System\duAECPK.exe
  C:\Windows\System\duAECPK.exe
  2⤵
  PID:10328
- C:\Windows\System\lOrPBRA.exe
  C:\Windows\System\lOrPBRA.exe
  2⤵
  PID:10604
- C:\Windows\System\HkDRYlY.exe
  C:\Windows\System\HkDRYlY.exe
  2⤵
  PID:11068
- C:\Windows\System\NTRNNEX.exe
  C:\Windows\System\NTRNNEX.exe
  2⤵
  PID:11284
- C:\Windows\System\kgaZXQs.exe
  C:\Windows\System\kgaZXQs.exe
  2⤵
  PID:11312
- C:\Windows\System\bgAmeLy.exe
  C:\Windows\System\bgAmeLy.exe
  2⤵
  PID:11328
- C:\Windows\System\PlcoVIg.exe
  C:\Windows\System\PlcoVIg.exe
  2⤵
  PID:11356
- C:\Windows\System\RvIaDnZ.exe
  C:\Windows\System\RvIaDnZ.exe
  2⤵
  PID:11376
- C:\Windows\System\srTCKqA.exe
  C:\Windows\System\srTCKqA.exe
  2⤵
  PID:11404
- C:\Windows\System\YZFRDAh.exe
  C:\Windows\System\YZFRDAh.exe
  2⤵
  PID:11428
- C:\Windows\System\bLlmswh.exe
  C:\Windows\System\bLlmswh.exe
  2⤵
  PID:11452
- C:\Windows\System\yhrXzjM.exe
  C:\Windows\System\yhrXzjM.exe
  2⤵
  PID:11496
- C:\Windows\System\AUZfOVQ.exe
  C:\Windows\System\AUZfOVQ.exe
  2⤵
  PID:11516
- C:\Windows\System\yuYspVd.exe
  C:\Windows\System\yuYspVd.exe
  2⤵
  PID:11556
- C:\Windows\System\mZeWIlh.exe
  C:\Windows\System\mZeWIlh.exe
  2⤵
  PID:11576
- C:\Windows\System\hvtvizJ.exe
  C:\Windows\System\hvtvizJ.exe
  2⤵
  PID:11600
- C:\Windows\System\LJscHuG.exe
  C:\Windows\System\LJscHuG.exe
  2⤵
  PID:11616
- C:\Windows\System\TVWKoli.exe
  C:\Windows\System\TVWKoli.exe
  2⤵
  PID:11632
- C:\Windows\System\PRjvkeC.exe
  C:\Windows\System\PRjvkeC.exe
  2⤵
  PID:11684
- C:\Windows\System\gBgfetW.exe
  C:\Windows\System\gBgfetW.exe
  2⤵
  PID:11712
- C:\Windows\System\BdxFxNX.exe
  C:\Windows\System\BdxFxNX.exe
  2⤵
  PID:11752
- C:\Windows\System\SZihCPb.exe
  C:\Windows\System\SZihCPb.exe
  2⤵
  PID:11788
- C:\Windows\System\ThDgKJf.exe
  C:\Windows\System\ThDgKJf.exe
  2⤵
  PID:11824
- C:\Windows\System\igbhTEL.exe
  C:\Windows\System\igbhTEL.exe
  2⤵
  PID:11856
- C:\Windows\System\MlpvmKN.exe
  C:\Windows\System\MlpvmKN.exe
  2⤵
  PID:11872
- C:\Windows\System\mFSaAoP.exe
  C:\Windows\System\mFSaAoP.exe
  2⤵
  PID:11892
- C:\Windows\System\woaqNmk.exe
  C:\Windows\System\woaqNmk.exe
  2⤵
  PID:11940
- C:\Windows\System\UmgBdEI.exe
  C:\Windows\System\UmgBdEI.exe
  2⤵
  PID:11960
- C:\Windows\System\blYWREn.exe
  C:\Windows\System\blYWREn.exe
  2⤵
  PID:11980
- C:\Windows\System\ZyCraBU.exe
  C:\Windows\System\ZyCraBU.exe
  2⤵
  PID:12012
- C:\Windows\System\vkrsfvi.exe
  C:\Windows\System\vkrsfvi.exe
  2⤵
  PID:12032
- C:\Windows\System\AdqaAmt.exe
  C:\Windows\System\AdqaAmt.exe
  2⤵
  PID:12052
- C:\Windows\System\NyFnUUH.exe
  C:\Windows\System\NyFnUUH.exe
  2⤵
  PID:12072
- C:\Windows\System\goioByE.exe
  C:\Windows\System\goioByE.exe
  2⤵
  PID:12092
- C:\Windows\System\IQaWwJl.exe
  C:\Windows\System\IQaWwJl.exe
  2⤵
  PID:12124
- C:\Windows\System\XqngJsZ.exe
  C:\Windows\System\XqngJsZ.exe
  2⤵
  PID:12168
- C:\Windows\System\GmunMEP.exe
  C:\Windows\System\GmunMEP.exe
  2⤵
  PID:12196
- C:\Windows\System\DAahQfH.exe
  C:\Windows\System\DAahQfH.exe
  2⤵
  PID:12232
- C:\Windows\System\BokVhfb.exe
  C:\Windows\System\BokVhfb.exe
  2⤵
  PID:12272
- C:\Windows\System\LgdbBbO.exe
  C:\Windows\System\LgdbBbO.exe
  2⤵
  PID:10480
- C:\Windows\System\YRTndeo.exe
  C:\Windows\System\YRTndeo.exe
  2⤵
  PID:10912
- C:\Windows\System\FakqQhB.exe
  C:\Windows\System\FakqQhB.exe
  2⤵
  PID:11276
- C:\Windows\System\fgMKRjS.exe
  C:\Windows\System\fgMKRjS.exe
  2⤵
  PID:11320
- C:\Windows\System\avdQBMp.exe
  C:\Windows\System\avdQBMp.exe
  2⤵
  PID:11372
- C:\Windows\System\FULqUqR.exe
  C:\Windows\System\FULqUqR.exe
  2⤵
  PID:11464
- C:\Windows\System\BGzjbpO.exe
  C:\Windows\System\BGzjbpO.exe
  2⤵
  PID:11592
- C:\Windows\System\DxbBdtj.exe
  C:\Windows\System\DxbBdtj.exe
  2⤵
  PID:11624
- C:\Windows\System\orAGQNk.exe
  C:\Windows\System\orAGQNk.exe
  2⤵
  PID:4424
- C:\Windows\System\fbbLvrH.exe
  C:\Windows\System\fbbLvrH.exe
  2⤵
  PID:11656
- C:\Windows\System\xeSrJLI.exe
  C:\Windows\System\xeSrJLI.exe
  2⤵
  PID:11768
- C:\Windows\System\awGSAvE.exe
  C:\Windows\System\awGSAvE.exe
  2⤵
  PID:11836
- C:\Windows\System\iJOGHAp.exe
  C:\Windows\System\iJOGHAp.exe
  2⤵
  PID:11108
- C:\Windows\System\QyLmsNo.exe
  C:\Windows\System\QyLmsNo.exe
  2⤵
  PID:11952
- C:\Windows\System\SIZVGGV.exe
  C:\Windows\System\SIZVGGV.exe
  2⤵
  PID:11988
- C:\Windows\System\eIZIGSr.exe
  C:\Windows\System\eIZIGSr.exe
  2⤵
  PID:12068
- C:\Windows\System\kqgQAbk.exe
  C:\Windows\System\kqgQAbk.exe
  2⤵
  PID:12084
- C:\Windows\System\ebefNEv.exe
  C:\Windows\System\ebefNEv.exe
  2⤵
  PID:12136
- C:\Windows\System\mMvdKVR.exe
  C:\Windows\System\mMvdKVR.exe
  2⤵
  PID:12208
- C:\Windows\System\qpQqaXp.exe
  C:\Windows\System\qpQqaXp.exe
  2⤵
  PID:12284
- C:\Windows\System\jAGTkxN.exe
  C:\Windows\System\jAGTkxN.exe
  2⤵
  PID:11308
- C:\Windows\System\jovAwxG.exe
  C:\Windows\System\jovAwxG.exe
  2⤵
  PID:11420
- C:\Windows\System\MZtKOag.exe
  C:\Windows\System\MZtKOag.exe
  2⤵
  PID:11660
- C:\Windows\System\bcfxJZk.exe
  C:\Windows\System\bcfxJZk.exe
  2⤵
  PID:11816
- C:\Windows\System\ZiCyLjt.exe
  C:\Windows\System\ZiCyLjt.exe
  2⤵
  PID:4188
- C:\Windows\System\KjuQEmD.exe
  C:\Windows\System\KjuQEmD.exe
  2⤵
  PID:12108
- C:\Windows\System\ueRaIRQ.exe
  C:\Windows\System\ueRaIRQ.exe
  2⤵
  PID:12188
- C:\Windows\System\oMlqnRn.exe
  C:\Windows\System\oMlqnRn.exe
  2⤵
  PID:10460
- C:\Windows\System\vafVmMP.exe
  C:\Windows\System\vafVmMP.exe
  2⤵
  PID:11368
- C:\Windows\System\TrAdDdg.exe
  C:\Windows\System\TrAdDdg.exe
  2⤵
  PID:11628
- C:\Windows\System\wTfSHzH.exe
  C:\Windows\System\wTfSHzH.exe
  2⤵
  PID:12020
- C:\Windows\System\kTDLXxE.exe
  C:\Windows\System\kTDLXxE.exe
  2⤵
  PID:12220
- C:\Windows\System\NaYKnBp.exe
  C:\Windows\System\NaYKnBp.exe
  2⤵
  PID:11596
- C:\Windows\System\vdDXQYd.exe
  C:\Windows\System\vdDXQYd.exe
  2⤵
  PID:4648
- C:\Windows\System\WvsUZLC.exe
  C:\Windows\System\WvsUZLC.exe
  2⤵
  PID:12300
- C:\Windows\System\dHpWRsS.exe
  C:\Windows\System\dHpWRsS.exe
  2⤵
  PID:12324
- C:\Windows\System\WfSSgbR.exe
  C:\Windows\System\WfSSgbR.exe
  2⤵
  PID:12360
- C:\Windows\System\kEsGJgq.exe
  C:\Windows\System\kEsGJgq.exe
  2⤵
  PID:12380
- C:\Windows\System\wpTIhiH.exe
  C:\Windows\System\wpTIhiH.exe
  2⤵
  PID:12408
- C:\Windows\System\JneoHwT.exe
  C:\Windows\System\JneoHwT.exe
  2⤵
  PID:12452
- C:\Windows\System\vkQbXbQ.exe
  C:\Windows\System\vkQbXbQ.exe
  2⤵
  PID:12480
- C:\Windows\System\LxLHwCT.exe
  C:\Windows\System\LxLHwCT.exe
  2⤵
  PID:12512
- C:\Windows\System\cqEezUc.exe
  C:\Windows\System\cqEezUc.exe
  2⤵
  PID:12544
- C:\Windows\System\icYjJTE.exe
  C:\Windows\System\icYjJTE.exe
  2⤵
  PID:12568
- C:\Windows\System\YppARtl.exe
  C:\Windows\System\YppARtl.exe
  2⤵
  PID:12584
- C:\Windows\System\XwatIRP.exe
  C:\Windows\System\XwatIRP.exe
  2⤵
  PID:12600
- C:\Windows\System\OHCMvMh.exe
  C:\Windows\System\OHCMvMh.exe
  2⤵
  PID:12616
- C:\Windows\System\wuAkJfF.exe
  C:\Windows\System\wuAkJfF.exe
  2⤵
  PID:12636
- C:\Windows\System\dRILcJh.exe
  C:\Windows\System\dRILcJh.exe
  2⤵
  PID:12668
- C:\Windows\System\cGukJaA.exe
  C:\Windows\System\cGukJaA.exe
  2⤵
  PID:12736
- C:\Windows\System\UtvDybT.exe
  C:\Windows\System\UtvDybT.exe
  2⤵
  PID:12784
- C:\Windows\System\bqbUzfL.exe
  C:\Windows\System\bqbUzfL.exe
  2⤵
  PID:12804
- C:\Windows\System\dkQcriL.exe
  C:\Windows\System\dkQcriL.exe
  2⤵
  PID:12828
- C:\Windows\System\zSwBcGT.exe
  C:\Windows\System\zSwBcGT.exe
  2⤵
  PID:12852
- C:\Windows\System\sovfnVn.exe
  C:\Windows\System\sovfnVn.exe
  2⤵
  PID:12876
- C:\Windows\System\NlvTuzN.exe
  C:\Windows\System\NlvTuzN.exe
  2⤵
  PID:12900
- C:\Windows\System\USZCcpt.exe
  C:\Windows\System\USZCcpt.exe
  2⤵
  PID:12916
- C:\Windows\System\CifLTwL.exe
  C:\Windows\System\CifLTwL.exe
  2⤵
  PID:12964
- C:\Windows\System\TYnLOSZ.exe
  C:\Windows\System\TYnLOSZ.exe
  2⤵
  PID:12988
- C:\Windows\System\vYMElyF.exe
  C:\Windows\System\vYMElyF.exe
  2⤵
  PID:13040
- C:\Windows\System\aZgQLVx.exe
  C:\Windows\System\aZgQLVx.exe
  2⤵
  PID:13056
- C:\Windows\System\RDNxsnS.exe
  C:\Windows\System\RDNxsnS.exe
  2⤵
  PID:13084
- C:\Windows\System\ovcNuXE.exe
  C:\Windows\System\ovcNuXE.exe
  2⤵
  PID:13112
- C:\Windows\System\lKgjzKZ.exe
  C:\Windows\System\lKgjzKZ.exe
  2⤵
  PID:13128
- C:\Windows\System\srsErir.exe
  C:\Windows\System\srsErir.exe
  2⤵
  PID:13148
- C:\Windows\System\iIQenqX.exe
  C:\Windows\System\iIQenqX.exe
  2⤵
  PID:13168
- C:\Windows\System\yCVvufF.exe
  C:\Windows\System\yCVvufF.exe
  2⤵
  PID:13188
- C:\Windows\System\ktoYHbF.exe
  C:\Windows\System\ktoYHbF.exe
  2⤵
  PID:13204
- C:\Windows\System\EjlBZqY.exe
  C:\Windows\System\EjlBZqY.exe
  2⤵
  PID:13224
- C:\Windows\System\PQOhylw.exe
  C:\Windows\System\PQOhylw.exe
  2⤵
  PID:13252
- C:\Windows\System\mKIYXYJ.exe
  C:\Windows\System\mKIYXYJ.exe
  2⤵
  PID:13288
- C:\Windows\System\bGyWKkJ.exe
  C:\Windows\System\bGyWKkJ.exe
  2⤵
  PID:12296
- C:\Windows\System\JyoBOlu.exe
  C:\Windows\System\JyoBOlu.exe
  2⤵
  PID:12376
- C:\Windows\System\bKdWWgw.exe
  C:\Windows\System\bKdWWgw.exe
  2⤵
  PID:12460
- C:\Windows\System\jnMfPey.exe
  C:\Windows\System\jnMfPey.exe
  2⤵
  PID:12508
- C:\Windows\System\CrzXLtH.exe
  C:\Windows\System\CrzXLtH.exe
  2⤵
  PID:12532
- C:\Windows\System\OYWafMr.exe
  C:\Windows\System\OYWafMr.exe
  2⤵
  PID:12564
- C:\Windows\System\lHqFkkI.exe
  C:\Windows\System\lHqFkkI.exe
  2⤵
  PID:12704
- C:\Windows\System\bxQDZTf.exe
  C:\Windows\System\bxQDZTf.exe
  2⤵
  PID:3264
- C:\Windows\System\KGuaYWo.exe
  C:\Windows\System\KGuaYWo.exe
  2⤵
  PID:3720
- C:\Windows\System\pbEGzhv.exe
  C:\Windows\System\pbEGzhv.exe
  2⤵
  PID:12796
- C:\Windows\System\zGsOzWk.exe
  C:\Windows\System\zGsOzWk.exe
  2⤵
  PID:12884
- C:\Windows\System\cyJUNnE.exe
  C:\Windows\System\cyJUNnE.exe
  2⤵
  PID:12972
- C:\Windows\System\DQrWJre.exe
  C:\Windows\System\DQrWJre.exe
  2⤵
  PID:13036
- C:\Windows\System\SDTzVZN.exe
  C:\Windows\System\SDTzVZN.exe
  2⤵
  PID:13072
- C:\Windows\System\YlbwiMW.exe
  C:\Windows\System\YlbwiMW.exe
  2⤵
  PID:13108
- C:\Windows\System\FxrcKLd.exe
  C:\Windows\System\FxrcKLd.exe
  2⤵
  PID:13180
- C:\Windows\System\CoyMaBH.exe
  C:\Windows\System\CoyMaBH.exe
  2⤵
  PID:13268
- C:\Windows\System\VJKdfZs.exe
  C:\Windows\System\VJKdfZs.exe
  2⤵
  PID:13300
- C:\Windows\System\ADTIweq.exe
  C:\Windows\System\ADTIweq.exe
  2⤵
  PID:13232
- C:\Windows\System\OyahHee.exe
  C:\Windows\System\OyahHee.exe
  2⤵
  PID:12344
- C:\Windows\System\UYfdunQ.exe
  C:\Windows\System\UYfdunQ.exe
  2⤵
  PID:12628
- C:\Windows\System\nscIKxz.exe
  C:\Windows\System\nscIKxz.exe
  2⤵
  PID:12580
- C:\Windows\System\haNdzcG.exe
  C:\Windows\System\haNdzcG.exe
  2⤵
  PID:4196
- C:\Windows\System\ImzeiyW.exe
  C:\Windows\System\ImzeiyW.exe
  2⤵
  PID:13104
- C:\Windows\System\emZFIJu.exe
  C:\Windows\System\emZFIJu.exe
  2⤵
  PID:13280
- C:\Windows\System\Hdjunbh.exe
  C:\Windows\System\Hdjunbh.exe
  2⤵
  PID:13080
- C:\Windows\System\pHWuspb.exe
  C:\Windows\System\pHWuspb.exe
  2⤵
  PID:12488
- C:\Windows\System\UDjvAZw.exe
  C:\Windows\System\UDjvAZw.exe
  2⤵
  PID:4708
- C:\Windows\System\GgbMdRO.exe
  C:\Windows\System\GgbMdRO.exe
  2⤵
  PID:4980
- C:\Windows\System\xYqRDsg.exe
  C:\Windows\System\xYqRDsg.exe
  2⤵
  PID:12732
- C:\Windows\System\hjnwTjo.exe
  C:\Windows\System\hjnwTjo.exe
  2⤵
  PID:4488
- C:\Windows\System\vIwhIvM.exe
  C:\Windows\System\vIwhIvM.exe
  2⤵
  PID:13624
- C:\Windows\System\salsYQY.exe
  C:\Windows\System\salsYQY.exe
  2⤵
  PID:13648
- C:\Windows\System\eyKojrf.exe
  C:\Windows\System\eyKojrf.exe
  2⤵
  PID:13668
- C:\Windows\System\rbwjLLt.exe
  C:\Windows\System\rbwjLLt.exe
  2⤵
  PID:13708
- C:\Windows\System\KGkjqQo.exe
  C:\Windows\System\KGkjqQo.exe
  2⤵
  PID:13780
- C:\Windows\System\RIIJcrC.exe
  C:\Windows\System\RIIJcrC.exe
  2⤵
  PID:13536
- C:\Windows\System\aPcRvik.exe
  C:\Windows\System\aPcRvik.exe
  2⤵
  PID:13560
- C:\Windows\System\VDjqfaj.exe
  C:\Windows\System\VDjqfaj.exe
  2⤵
  PID:13572
- C:\Windows\System\rnsKFOp.exe
  C:\Windows\System\rnsKFOp.exe
  2⤵
  PID:1232
- C:\Windows\System\abkpdlE.exe
  C:\Windows\System\abkpdlE.exe
  2⤵
  PID:1208
- C:\Windows\System\EbbhNLV.exe
  C:\Windows\System\EbbhNLV.exe
  2⤵
  PID:13944
- C:\Windows\System\kMFiNpX.exe
  C:\Windows\System\kMFiNpX.exe
  2⤵
  PID:13992
- C:\Windows\System\TSelFXg.exe
  C:\Windows\System\TSelFXg.exe
  2⤵
  PID:14012
- C:\Windows\System\bKHTwcl.exe
  C:\Windows\System\bKHTwcl.exe
  2⤵
  PID:14052
- C:\Windows\System\ZTtQkVy.exe
  C:\Windows\System\ZTtQkVy.exe
  2⤵
  PID:14060
- C:\Windows\System\cebWrZt.exe
  C:\Windows\System\cebWrZt.exe
  2⤵
  PID:14084
- C:\Windows\System\YohbKxq.exe
  C:\Windows\System\YohbKxq.exe
  2⤵
  PID:14132
- C:\Windows\System\NdeYjnV.exe
  C:\Windows\System\NdeYjnV.exe
  2⤵
  PID:14140
- C:\Windows\System\ybVraxI.exe
  C:\Windows\System\ybVraxI.exe
  2⤵
  PID:14192
- C:\Windows\System\pFZEgmF.exe
  C:\Windows\System\pFZEgmF.exe
  2⤵
  PID:14212
- C:\Windows\System\xrAvBzY.exe
  C:\Windows\System\xrAvBzY.exe
  2⤵
  PID:14240
- C:\Windows\System\CabqQbk.exe
  C:\Windows\System\CabqQbk.exe
  2⤵
  PID:14256
- C:\Windows\System\MXDOCxv.exe
  C:\Windows\System\MXDOCxv.exe
  2⤵
  PID:14288
- C:\Windows\System\eFwmvXs.exe
  C:\Windows\System\eFwmvXs.exe
  2⤵
  PID:14308
- C:\Windows\System\KtLkOLf.exe
  C:\Windows\System\KtLkOLf.exe
  2⤵
  PID:13120
- C:\Windows\System\HcIjGuy.exe
  C:\Windows\System\HcIjGuy.exe
  2⤵
  PID:13324
- C:\Windows\System\FkGMFfL.exe
  C:\Windows\System\FkGMFfL.exe
  2⤵
  PID:13344
- C:\Windows\System\JFBvgpn.exe
  C:\Windows\System\JFBvgpn.exe
  2⤵
  PID:13356
- C:\Windows\System\sviiQuW.exe
  C:\Windows\System\sviiQuW.exe
  2⤵
  PID:4868
- C:\Windows\System\EVGKbni.exe
  C:\Windows\System\EVGKbni.exe
  2⤵
  PID:2644
- C:\Windows\System\zuDYrpy.exe
  C:\Windows\System\zuDYrpy.exe
  2⤵
  PID:13376
- C:\Windows\System\JgMiZEN.exe
  C:\Windows\System\JgMiZEN.exe
  2⤵
  PID:988
- C:\Windows\System\IlwMvnv.exe
  C:\Windows\System\IlwMvnv.exe
  2⤵
  PID:13616
- C:\Windows\System\DNwJZgw.exe
  C:\Windows\System\DNwJZgw.exe
  2⤵
  PID:13768
- C:\Windows\System\iTnZtOb.exe
  C:\Windows\System\iTnZtOb.exe
  2⤵
  PID:13452
- C:\Windows\System\ctWMsOg.exe
  C:\Windows\System\ctWMsOg.exe
  2⤵
  PID:13552
- C:\Windows\System\RBCMbRf.exe
  C:\Windows\System\RBCMbRf.exe
  2⤵
  PID:13448
- C:\Windows\System\bAGkZvW.exe
  C:\Windows\System\bAGkZvW.exe
  2⤵
  PID:13440
- C:\Windows\System\bWXoBVg.exe
  C:\Windows\System\bWXoBVg.exe
  2⤵
  PID:13524
- C:\Windows\System\wEYFhNF.exe
  C:\Windows\System\wEYFhNF.exe
  2⤵
  PID:824
- C:\Windows\System\XltClRd.exe
  C:\Windows\System\XltClRd.exe
  2⤵
  PID:3080
- C:\Windows\System\FDeBYTv.exe
  C:\Windows\System\FDeBYTv.exe
  2⤵
  PID:3356
- C:\Windows\System\vZpKixv.exe
  C:\Windows\System\vZpKixv.exe
  2⤵
  PID:2364
- C:\Windows\System\SPGXCis.exe
  C:\Windows\System\SPGXCis.exe
  2⤵
  PID:2660
- C:\Windows\System\JhDkDBz.exe
  C:\Windows\System\JhDkDBz.exe
  2⤵
  PID:612
- C:\Windows\System\PxllrjX.exe
  C:\Windows\System\PxllrjX.exe
  2⤵
  PID:13820
- C:\Windows\System\bTivFYV.exe
  C:\Windows\System\bTivFYV.exe
  2⤵
  PID:13812
- C:\Windows\System\YSYLLAD.exe
  C:\Windows\System\YSYLLAD.exe
  2⤵
  PID:13824
- C:\Windows\System\mVntqYu.exe
  C:\Windows\System\mVntqYu.exe
  2⤵
  PID:2008
- C:\Windows\System\TOsDKJS.exe
  C:\Windows\System\TOsDKJS.exe
  2⤵
  PID:13900
- C:\Windows\System\VAuUPbP.exe
  C:\Windows\System\VAuUPbP.exe
  2⤵
  PID:4360
- C:\Windows\System\NfbUBvR.exe
  C:\Windows\System\NfbUBvR.exe
  2⤵
  PID:4452
- C:\Windows\System\iQooNEO.exe
  C:\Windows\System\iQooNEO.exe
  2⤵
  PID:2084
- C:\Windows\System\GdAPqxE.exe
  C:\Windows\System\GdAPqxE.exe
  2⤵
  PID:14072
- C:\Windows\System\tvqwqql.exe
  C:\Windows\System\tvqwqql.exe
  2⤵
  PID:14136
- C:\Windows\System\qnLlxJn.exe
  C:\Windows\System\qnLlxJn.exe
  2⤵
  PID:13592
- C:\Windows\System\lakpsMe.exe
  C:\Windows\System\lakpsMe.exe
  2⤵
  PID:13836
- C:\Windows\System\HgiuJcv.exe
  C:\Windows\System\HgiuJcv.exe
  2⤵
  PID:13852
- C:\Windows\System\BsDjMeO.exe
  C:\Windows\System\BsDjMeO.exe
  2⤵
  PID:13892
- C:\Windows\System\QuGCUoN.exe
  C:\Windows\System\QuGCUoN.exe
  2⤵
  PID:4228
- C:\Windows\System\hBRJVOG.exe
  C:\Windows\System\hBRJVOG.exe
  2⤵
  PID:4764
- C:\Windows\System\voYEaIp.exe
  C:\Windows\System\voYEaIp.exe
  2⤵
  PID:4768
- C:\Windows\System\SOmDCeg.exe
  C:\Windows\System\SOmDCeg.exe
  2⤵
  PID:3560
- C:\Windows\System\SPLqgyd.exe
  C:\Windows\System\SPLqgyd.exe
  2⤵
  PID:14156
- C:\Windows\System\ITwkquK.exe
  C:\Windows\System\ITwkquK.exe
  2⤵
  PID:14108
- C:\Windows\System\zljKVpU.exe
  C:\Windows\System\zljKVpU.exe
  2⤵
  PID:13476
- C:\Windows\System\aGekSmH.exe
  C:\Windows\System\aGekSmH.exe
  2⤵
  PID:13492
- C:\Windows\System\aULxsJV.exe
  C:\Windows\System\aULxsJV.exe
  2⤵
  PID:3392
- C:\Windows\System\DeIOkKm.exe
  C:\Windows\System\DeIOkKm.exe
  2⤵
  PID:3676

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13612

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l5ty2piz.o1w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AenzLFv.exe

Filesize
2.1MB

MD5
d9bd19012962938e6b12e2ae3eef7ffa

SHA1
3325d8b54b747ac442b6c9c90b79afd6f35f817b

SHA256
30cabea6b10429fd495cd12a8ec59dcbde916ca3bbcc08fc1abc2db07287e55b

SHA512
ef9ba153a779a1875b739dcdd9fb440732aef3181d139c3bf77467a0f05b93585e3476f05370b23162d8d15c027be46c6bb5c5863788baa91be4853a02d67601

Download Submit
C:\Windows\System\AmILLsg.exe

Filesize
2.1MB

MD5
e227231701ff6c264b1f9d4b21605449

SHA1
d53521ac42d102bcc32417d96cb23d27f3e09120

SHA256
ebb334c36c573463a2858cf113c70caa44928355cb0a663febecc47084230b55

SHA512
a98571647c9053022187617db211a5314161e39a4adfa1680bb87fb74213d0097b7b0a3f27ff96e5379e3db5e72080f6aae892f666fd94a29bbdb0a7593acda1

Download Submit
C:\Windows\System\AtUDplQ.exe

Filesize
2.1MB

MD5
058726aa2e70a482fb57aa845b26048a

SHA1
aa1fbdf71513794e262a2ed8eb803d00834a623c

SHA256
c839e4ba0e5c600bd3b13fe0424ac9aafeebe58bc3f95ffc88310daeb9b27a7a

SHA512
ff6a3c056744296fb33fcc3fce2764b5d83b9b993d01d6cb4c6c09a37be78c2e0c5ac549e3b9608b0714f73237313ad89fc8f2599104e321bf9bea61cb2ff922

Download Submit
C:\Windows\System\DFyFIGj.exe

Filesize
2.1MB

MD5
e8e96c10baa133cc865ce3b2d1df112e

SHA1
e3a38fc6d9487043e3cdf3fd25e50fcf999dd0cc

SHA256
4f0d980d36c6c62ea93019ebabd261dc734f4733f36d387610b1c8ae4ddc5017

SHA512
2f25219c9254d090faba19a769d61c0599727031d7633340f9a1d4e6ae67ff896b994eaaa73dea28b7ba5c301bf7bd7bf02f3bac6a67a6886f4edc311998821c

Download Submit
C:\Windows\System\FZZJlqV.exe

Filesize
2.1MB

MD5
486ab2d0e029b76936e0bacf41fe7cba

SHA1
2b84f45cededf7cf9d7f3e1f33f699a042520e53

SHA256
65ef1595f77cddcd11a0086b964fc98db6eec80c6d09627c99688788fc8db874

SHA512
d252d2a67e31790819bfbc69db2688a12e8fc1b79253a163ae2b15f9698848e25edbc1277ebe562c4a9b368de4dc2139ae54fb8b0021b281786f576bbda21802

Download Submit
C:\Windows\System\KmuGruN.exe

Filesize
2.1MB

MD5
28c7b3ea25756d1f25e233eef48f46d1

SHA1
c60eb0409d3a417c4ea7316b1387db8db764ed75

SHA256
26502e223c386f471ebacfbf0046cbb2338fd630ba366a894ead671a61177062

SHA512
ef96c0c20a17e9f61df8dece56eb79a3ab2d399542a14cb8839418edc4295fbf157bcd75cecfb991393b50567d649d592156a29495cbeff799a85c7baee7014f

Download Submit
C:\Windows\System\Kqcfnva.exe

Filesize
2.1MB

MD5
fedc75dfcc847e6c01d48f16708f1d14

SHA1
ed0c78948c5b602ffa8d7797ee4c8985c24c8012

SHA256
d79f2f57f5edea9dca1fb780c30b6e18e6638f1ebcd6ba31659ca7fec2966d4c

SHA512
09ff09c9e5b6c69c2c45fcb3401d622e851067bc6c89379846ec5f73eb62955aa8ca32584385753e7be693c6032be40429ced8bca56c0781744c7686a2cf9265

Download Submit
C:\Windows\System\LCYdMjW.exe

Filesize
2.1MB

MD5
fb4aefb69a2ae65f436bac200775bccb

SHA1
86af79ad029431518ac553053874cf71b42e165c

SHA256
93989102df7f310f731c8e72cb51cd6bd92ad54e6c8c51d29f9978e9e796e254

SHA512
cdf62b127dedbfd3843602b8e2a0c452d9e4368de0b6b5d668f7637253f2364077f52b700c4ecf1d860f42ac9dec162c090dbbceeba5d4fda9a6091c5b014452

Download Submit
C:\Windows\System\LNFKvEC.exe

Filesize
2.1MB

MD5
c25a1c5792d091fa819785d0a43e4432

SHA1
210e5469168748a93f10e761cc971d1cec8fde03

SHA256
803466a330fc7f36c3b7e71222c0c41056ce0f7292eb5172b3e1ff815c312296

SHA512
385e41ba0b59df2f9e145192b666f8c542ef98cc1dce09d2ac7cee09e9fcc7c259a38794d88d89bc1adb7fd0b3d22ed5f01fac411c6b7fcc3c5f8f2e2d2cf700

Download Submit
C:\Windows\System\OgrzgTH.exe

Filesize
2.1MB

MD5
315e3fd426e4c069e38df623dc7528c4

SHA1
79aa731fa5358dce122aedf8c31d3ae3b6f39d0b

SHA256
990d81ba37dd9260bfab7a65fd437edfaf97af71fdd6456aef7468e5ebfc10b3

SHA512
46fb2ee1ccf2109cc109f6f26b769e13d015bfcd72ef50dbe83e26a6b3948d63d902647d1c5f1830687b3e0c367ba64913cd7c037d4824b42d44fb79fe031c32

Download Submit
C:\Windows\System\SKjbPeY.exe

Filesize
2.1MB

MD5
b90c4048776c78e03e99d579226e2399

SHA1
7a3111e70230691e135cfec5ff3708d5e6025034

SHA256
f02f5fdccf4f5303954a1515f0a9d1381e82a4b28391dac7c74e0090f83037e0

SHA512
879f24f9796dcbb05f99e0cc7c6e972d9384d7deba2dd3da11259f792a555855183b47b595068b25ed972f3eccb6b7f4ea9e30e3d6222ae9fada197edcdf6615

Download Submit
C:\Windows\System\UOLiNBD.exe

Filesize
2.1MB

MD5
b2abf867cc6d0cfca33add7c9f4a38a1

SHA1
2ec77023a4c7300bc2c7c6e6546a79822df233b4

SHA256
0e8879be9ecc3acada227b2b1951f1373fdcfc48649b80f056953b151718b089

SHA512
c8ed7b151508c52d076b52a85566e0013c6cb832fe5f3529e171270a78f799650c403248561dcab672de4f9ac6a0c46835ab504f7a13362b45936b6da2e40e27

Download Submit
C:\Windows\System\UmXKZTx.exe

Filesize
2.1MB

MD5
750aa132103cef7e13f314ccfac50731

SHA1
136c71a6cb8a500e98dc2c01d844534986976ddc

SHA256
5c54bff4d4efbf0db306564dca3b2dfe5fe7b6545403ada727b352a216e47669

SHA512
7ee00837410a8a24fe21e57068c2f72b19db826a36b5935deb8ce54ccf7e61fb9be096d9e4722bda2ea674f5779425981a56e2919201751642d31f0f11c0343e

Download Submit
C:\Windows\System\WmziHmU.exe

Filesize
2.1MB

MD5
41c4ed0bde0940be1670eb38e898c56f

SHA1
790f2a5db01986f1f25891f286bb466dc268499a

SHA256
0853c4b2989c0f974c968ee92f284ead7c3714452452eb0aa74f7a8a36537c53

SHA512
a9b545a5287f28f70e9c4b640ff716928b790b5befd5317cdb44151ee34b18641e045ccd30b91e59d0aa681498dd54135f09027d52b27223319cc0456821b378

Download Submit
C:\Windows\System\YDHCikV.exe

Filesize
2.1MB

MD5
ab0f7bd9f1bb9cda96f3c486eb856dfc

SHA1
d3e6ad02a34d3cedf752f62214169cb1d0f488b4

SHA256
9ac1ed587eb3c3e43f2c40a3ceffe2f9e9124542d6bb23de14d7d41a2bd8403d

SHA512
2c82229d106b8c916ded42d62706889b3de43e25f01ce535aa76bdded74725dba41c049cd594f3a352073808987bbaca7e53d498d1adafc01064c7315bcea2ee

Download Submit
C:\Windows\System\Zimxgel.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\ZrwWwQr.exe

Filesize
2.1MB

MD5
dc257136fa651fe69285b8afb6276969

SHA1
556ad279c0740c90824941058b83c9fd8dd9bc25

SHA256
a218a8463125b0fe8636841bec64c08f13313a371e649939b4f5f92d229eb4c0

SHA512
9b8be16351e31b18b27866d955a1263eff7da616b0f315d65ae0db758be0ad4d277d984f3e93514d17401d83fce19a20b2c7618330c95398ff6a0e9781d01af0

Download Submit
C:\Windows\System\ZyqAcjP.exe

Filesize
2.1MB

MD5
9528a4c68775eafc049d132512c2dce1

SHA1
827dead409d53be54d6b9e1d1b36749a510f1367

SHA256
96dce391c01cd75072fd070334423e295024d5fcf8e9d7b67963ab0f907f3897

SHA512
7576c0ac8e6cd05685fd967d70fccaea44593f62b2c99f65d29e999a9eb43b841b9ab7e5f23442de211433c10b0990efd1e3e307f5d326d59c36cd26d942e8b7

Download Submit
C:\Windows\System\dyGGRJg.exe

Filesize
2.1MB

MD5
9521da5535238eccee7ac6b17a29499f

SHA1
0ab14d7a45dd5cc035e763414ea9e8329e686f28

SHA256
655614582055eb304b70a0c3b4bac0fe2268e73ea0262e9218ecafea6e3b2260

SHA512
26cbbccf9c6558ff70741d52aff2a00f76f6de899b78485f81b654477be6a3f418cbdf2c7fbb05c1b1e62bd835ff2e14fea7021f21f972c102cdafb4bb054a1d

Download Submit
C:\Windows\System\eeHjmDo.exe

Filesize
2.1MB

MD5
5e47cc9144161473492c9de3a190b4de

SHA1
bb9f0c2d8cfd228cc90caa98fd57177541ca381a

SHA256
e3a14bdbf8484e023a63730d30f045f9bafd8f3f705307111d56eff63a5c46fb

SHA512
b314e1f62aebc18678cc3807167563b4fa294375b8258fdb3f5f8466e9cb9ff395628d0bfa61192adb000c0ceefa7f1c43812cfe842f10279e962ec5e4c5def7

Download Submit
C:\Windows\System\fuRzRqC.exe

Filesize
2.1MB

MD5
216e19a1963bf1e0fa8621795f398dcf

SHA1
f2dcca920e6b966fa18694487b8b0b36d572cc24

SHA256
cd47b8fcd65faeb0d5110a33153a4633a36cbd678e4b6d2be05c363ca17641b6

SHA512
4ded5e162a451f47e73d4eff2592360b77e8b960cc1976b3230c7dc8e0252016741ff235563e671be88bfb39a3e0b493344d37514f8398d9db643bd3677cd5a3

Download Submit
C:\Windows\System\hJeDpLr.exe

Filesize
2.1MB

MD5
58aeca42556ecd3cb8f8615f9158f9bb

SHA1
a27a532abb6b7550c3dc2361b0a3c4e44819ad30

SHA256
f69a4801ca3c0d0c138b4a04f8bbb16c45eed17cb36d79f118c608f813ee9725

SHA512
b48a5f8c4375c87bce1a1ddfa963249ecaec48397535150f8ab63d5ef69a8ed98c47f2d86863fe06897c0aa3a778492fabfe3574ee3abd3ae87aeeaa8152ac82

Download Submit
C:\Windows\System\izRPCZk.exe

Filesize
2.1MB

MD5
1ceadb97900107ef5979a70c64e5c9d7

SHA1
c2e4b05da2bd976d093fca2fb1f05df213889982

SHA256
394e992c50a780d5754456f22283c2ac20d3b491ce2a0e2208ff9e156c4973bc

SHA512
f459ebb3e710ed5a479a9ca3e05f088c43d7ad6eb036c70fb37bcf0d63dc816efa917cb253e3842113b3bc59882b57e8597174a8467287640f2afdc458dd9426

Download Submit
C:\Windows\System\jBjqutv.exe

Filesize
2.1MB

MD5
7f29f8a12645fbc0a6b5b3c9a81c0653

SHA1
584384851db69c40a15dba5eb0261c07fdc0ddc8

SHA256
19abef220c5011d289955f99a57301885c00e813a372209843d52896a663f796

SHA512
b87b53ae1a68fc342fd7b72c03336138a1d6ba191cb530806c55cd3a728e29d95c44c41e8f71f281576e39371b8f2d383447600a7aa7358085463f061a263611

Download Submit
C:\Windows\System\kDIGvCR.exe

Filesize
2.1MB

MD5
7bc94975fe8fabf53317f68a3d95dd98

SHA1
7f1f3ad3119f7781d30dc9bececea202becf082b

SHA256
ce1accb34c35c12dcda7349813e837666dbeb4fd79777ffdd99d9600a557fa68

SHA512
c0746f23079f0d99cf7ee86bf3e8599c9f7980c6b73bb816863efe60e3600f482837efde8bb1fabdbb4b7700bd04b173e3d30a48f26a848ce89d43cad42ab5b5

Download Submit
C:\Windows\System\mnLEVyb.exe

Filesize
2.1MB

MD5
78fedb20cb05f5489b2c1fb8973d1cbc

SHA1
4ace5c3dd8e18d2654a0844d56b820642add2381

SHA256
ac274a3a99b2bac559582f4fb5513f73e395e0084f678c876967f77dcad36af1

SHA512
0131e8deec53b6abb178cd956b97b1a75818594c803503026c0f004763467f1aea406a6d0ad47cec8b7592bef99b0ad0d0f0b0c35e546fe8e8143a73ec1ffc01

Download Submit
C:\Windows\System\rPkgpuk.exe

Filesize
2.1MB

MD5
e20d11d4a8fc1aff2be2541b07566727

SHA1
e98aebf463f763601c0f02bf609a3957debe7250

SHA256
38c6b79e05a00d67baebc6d145356c8fb1183b39f45ab256fcc66446591904e6

SHA512
1e5ea3e28489d37b51af9596723e7971bcf2b8aef4787207ecb6fbc7f239c0249e9dbe71110007a07e13143a09bd6b183cd5d6c90b2183b0f42550859c22911a

Download Submit
C:\Windows\System\rUzpoKP.exe

Filesize
2.1MB

MD5
5736cdbf3ad80ff5fc4ef0354666a594

SHA1
2d574c10cf58a744fb8bd7d1f00b0dd5812670b7

SHA256
8bf0b48b8c6d931192ae1cd015bfeed2b268392d20afe6c3dee293a0659224a0

SHA512
9f5f2421e16f3b79c613c7b16aed424196d3d35f2e3e25524ff8b89a5ff8514a126912c145d69f1e076bab02b28f5e6cfb5dd6d9780b0ff064f42d751f14f262

Download Submit
C:\Windows\System\uwSPdtp.exe

Filesize
2.1MB

MD5
0072727b51be7bfdff8ea59f9da8f1d0

SHA1
7bf4a713a481d3466d5f9b1f335e50a44a95d853

SHA256
d2078c599e1c93ce40ae9611fefc05d800d954dc37f4d754d0b2a4d395fcab58

SHA512
7b429adb02c298a0838c38ad1172ba6e3e5d3a76c94b10ffa1b7d4c610a620ba5805b6ff647886c954a33c362979820e00c64ba00c3a219df2cc762484af0c7c

Download Submit
C:\Windows\System\uwhgouS.exe

Filesize
2.1MB

MD5
b87dfe8c82b3266311608009733a2fef

SHA1
febe31d5b6805b022e73e55152895945ae372891

SHA256
02f321f0e803148398623770c26f5d323ef28579647201f2fc625d982f82fd91

SHA512
cbfa7024b3d0b50ac163d805d72572cff8ee727a919606ad902198e1655e06cfeb28cd9ac516cff21ffb212b916d6b94156c16e09f8fde6f0edb702d912ee268

Download Submit
C:\Windows\System\vHmhlJX.exe

Filesize
2.1MB

MD5
64bc06a223f2765686c2119613327433

SHA1
7a6723e405c4ae4ca2ad704adb302ef75b4b7407

SHA256
e7797f6d29d19765fac2f095640661c556c20dea15c7b93dd9b90709527123d6

SHA512
6e9df1342692caa8bbfdcb10977f6e86b723d38cd9fa0c889eb5a3563fe1259f15297cecbc19bf70609345dc5ad506d0154ac6ba95952516e8f69d19e061f918

Download Submit
C:\Windows\System\wExPEsk.exe

Filesize
2.1MB

MD5
330e5673a6a17e4e76a1334a5007351d

SHA1
f3fba67c142157d5885c29961e19feffcbbc45fa

SHA256
d6b8db106d55df266206249d8fa050e83740614e49606968dcbe59496c27effa

SHA512
5ae3c994c44f50838e6a89e93d79277cb41a2709d5dbb77e82ec64c8bb907bf5625a560664315d885f907acb71013eadb35bd18931c50051d55f8c03c36d0243

Download Submit
C:\Windows\System\xINrMQc.exe

Filesize
2.1MB

MD5
9f0581a811f40e1e377f12f80ce828ee

SHA1
9635f7f9e605ae49a31007507c73fa938f08a5b3

SHA256
fc5e6cd92b7a7851360e7d64706d8f1a6fd0d96ebc94a4d8deebd0cb034920f0

SHA512
4ec8d1a92c3ffdcf61affeb71160fd6b61e9d576639a539b568d67f2c8a74256cce12c32f69b3e5f4540ffa82ccacb3d6652939884bfd0dbbbadf044a881a785

Download Submit
C:\Windows\System\xijCMdM.exe

Filesize
2.1MB

MD5
014f5971e9dd390e785e95cf9f790b6c

SHA1
de34bbb8a909fffa9bdf9826ce67ffb14e61a4f2

SHA256
9c9a6c9864cc951c05379631e70225cacccb9e06c8993b4780b2958789a4f9d1

SHA512
1a3c4e68cb6072a99868270a20b405bd3c2dd1d8bfd724e603b84ecde1d37927422fb99d8bb02aaf15f0c5a36e771b421e7e91ec5f097824125d9baf95c289f3

Download Submit
memory/392-2344-0x00007FF658A60000-0x00007FF658E52000-memory.dmp

Filesize
3.9MB

Download
memory/392-91-0x00007FF658A60000-0x00007FF658E52000-memory.dmp

Filesize
3.9MB

Download
memory/1008-80-0x00007FF7AAC60000-0x00007FF7AB052000-memory.dmp

Filesize
3.9MB

Download
memory/1224-86-0x00007FF67D700000-0x00007FF67DAF2000-memory.dmp

Filesize
3.9MB

Download
memory/1272-2015-0x00007FF6EFFD0000-0x00007FF6F03C2000-memory.dmp

Filesize
3.9MB

Download
memory/1272-59-0x00007FF6EFFD0000-0x00007FF6F03C2000-memory.dmp

Filesize
3.9MB

Download
memory/1312-10-0x00007FF778540000-0x00007FF778932000-memory.dmp

Filesize
3.9MB

Download
memory/1684-43-0x0000013E64430000-0x0000013E64452000-memory.dmp

Filesize
136KB

Download
memory/1684-909-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp

Filesize
10.8MB

Download
memory/1684-44-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp

Filesize
10.8MB

Download
memory/1684-11-0x00007FFEE9C43000-0x00007FFEE9C45000-memory.dmp

Filesize
8KB

Download
memory/1684-1782-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp

Filesize
10.8MB

Download
memory/1684-24-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp

Filesize
10.8MB

Download
memory/1684-1511-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp

Filesize
10.8MB

Download
memory/2080-97-0x00007FF66C6E0000-0x00007FF66CAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-95-0x00007FF741EF0000-0x00007FF7422E2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-4162-0x00007FF6A8980000-0x00007FF6A8D72000-memory.dmp

Filesize
3.9MB

Download
memory/2988-141-0x00007FF6A8980000-0x00007FF6A8D72000-memory.dmp

Filesize
3.9MB

Download
memory/2992-96-0x00007FF6DE7A0000-0x00007FF6DEB92000-memory.dmp

Filesize
3.9MB

Download
memory/3144-148-0x00007FF65CBD0000-0x00007FF65CFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3144-4165-0x00007FF65CBD0000-0x00007FF65CFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3172-58-0x00007FF671460000-0x00007FF671852000-memory.dmp

Filesize
3.9MB

Download
memory/3376-355-0x00007FF6EA300000-0x00007FF6EA6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-354-0x00007FF768CF0000-0x00007FF7690E2000-memory.dmp

Filesize
3.9MB

Download
memory/3520-68-0x00007FF743CF0000-0x00007FF7440E2000-memory.dmp

Filesize
3.9MB

Download
memory/3680-55-0x00007FF74EE40000-0x00007FF74F232000-memory.dmp

Filesize
3.9MB

Download
memory/3764-361-0x00007FF652E30000-0x00007FF653222000-memory.dmp

Filesize
3.9MB

Download
memory/3796-346-0x00007FF6E7450000-0x00007FF6E7842000-memory.dmp

Filesize
3.9MB

Download
memory/4080-129-0x00007FF63AD50000-0x00007FF63B142000-memory.dmp

Filesize
3.9MB

Download
memory/4124-117-0x00007FF720E10000-0x00007FF721202000-memory.dmp

Filesize
3.9MB

Download
memory/4268-1471-0x00007FF78D2E0000-0x00007FF78D6D2000-memory.dmp

Filesize
3.9MB

Download
memory/4268-1-0x0000018350670000-0x0000018350680000-memory.dmp

Filesize
64KB

Download
memory/4268-5162-0x00007FF78D2E0000-0x00007FF78D6D2000-memory.dmp

Filesize
3.9MB

Download
memory/4268-0-0x00007FF78D2E0000-0x00007FF78D6D2000-memory.dmp

Filesize
3.9MB

Download
memory/4280-75-0x00007FF6835C0000-0x00007FF6839B2000-memory.dmp

Filesize
3.9MB

Download
memory/4448-85-0x00007FF6F8A60000-0x00007FF6F8E52000-memory.dmp

Filesize
3.9MB

Download
memory/4540-54-0x00007FF6652A0000-0x00007FF665692000-memory.dmp

Filesize
3.9MB

Download
memory/4856-111-0x00007FF73FFF0000-0x00007FF7403E2000-memory.dmp

Filesize
3.9MB

Download
memory/4856-3098-0x00007FF73FFF0000-0x00007FF7403E2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-123-0x00007FF6AB590000-0x00007FF6AB982000-memory.dmp

Filesize
3.9MB

Download