xmrig | f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07

Analysis

max time kernel
91s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
Size

1.5MB
MD5

3ddc7180abc25821677cef02df964b1b
SHA1

715de240e3015a34de7ea0945958255a8f7cd5d5
SHA256

f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07
SHA512

9b020a344c1f0f9aeaa543c9d9c33d9cf28ce7ae4006e8e5301734ea8bd176d956bb995c1cf37945c7d77976534194beb0c8c9ab11ccf1764018d57f07f6672c
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY3W7qE8TrWhBya+l3a+pH8TOQvW:Lz071uv4BPMkibTIA53WjoWya+lK6H5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects executables containing URLs to raw contents of a Github gist 13 IoCs

resource	yara_rule
behavioral2/memory/876-460-0x00007FF7204D0000-0x00007FF7208C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4616-505-0x00007FF755030000-0x00007FF755422000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3196-506-0x00007FF68E550000-0x00007FF68E942000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3208-405-0x00007FF6074F0000-0x00007FF6078E2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/5064-508-0x00007FF761D50000-0x00007FF762142000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2324-509-0x00007FF7C23F0000-0x00007FF7C27E2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2032-511-0x00007FF66A500000-0x00007FF66A8F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2228-512-0x00007FF6CF230000-0x00007FF6CF622000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2820-1111-0x00007FF76DC10000-0x00007FF76E002000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1692-3261-0x00007FF76D830000-0x00007FF76DC22000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1964-3275-0x00007FF6C6C30000-0x00007FF6C7022000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2336-513-0x00007FF70F410000-0x00007FF70F802000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3056-507-0x00007FF6B6880000-0x00007FF6B6C72000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral2/files/0x000700000002342d-149.dat	UPX
behavioral2/memory/4616-505-0x00007FF755030000-0x00007FF755422000-memory.dmp	UPX
behavioral2/memory/3196-506-0x00007FF68E550000-0x00007FF68E942000-memory.dmp	UPX
behavioral2/memory/5064-508-0x00007FF761D50000-0x00007FF762142000-memory.dmp	UPX
behavioral2/memory/2324-509-0x00007FF7C23F0000-0x00007FF7C27E2000-memory.dmp	UPX
behavioral2/memory/2820-1111-0x00007FF76DC10000-0x00007FF76E002000-memory.dmp	UPX
behavioral2/files/0x0007000000023411-10.dat	UPX

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral2/memory/876-460-0x00007FF7204D0000-0x00007FF7208C2000-memory.dmp	xmrig
behavioral2/memory/4616-505-0x00007FF755030000-0x00007FF755422000-memory.dmp	xmrig
behavioral2/memory/3196-506-0x00007FF68E550000-0x00007FF68E942000-memory.dmp	xmrig
behavioral2/memory/3208-405-0x00007FF6074F0000-0x00007FF6078E2000-memory.dmp	xmrig
behavioral2/memory/5064-508-0x00007FF761D50000-0x00007FF762142000-memory.dmp	xmrig
behavioral2/memory/2324-509-0x00007FF7C23F0000-0x00007FF7C27E2000-memory.dmp	xmrig
behavioral2/memory/2032-511-0x00007FF66A500000-0x00007FF66A8F2000-memory.dmp	xmrig
behavioral2/memory/2228-512-0x00007FF6CF230000-0x00007FF6CF622000-memory.dmp	xmrig
behavioral2/memory/2820-1111-0x00007FF76DC10000-0x00007FF76E002000-memory.dmp	xmrig
behavioral2/memory/1692-3261-0x00007FF76D830000-0x00007FF76DC22000-memory.dmp	xmrig
behavioral2/memory/1964-3275-0x00007FF6C6C30000-0x00007FF6C7022000-memory.dmp	xmrig
behavioral2/memory/2336-513-0x00007FF70F410000-0x00007FF70F802000-memory.dmp	xmrig
behavioral2/memory/3056-507-0x00007FF6B6880000-0x00007FF6B6C72000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5104	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2836	YMdaoVv.exe
2908	JcaUxrF.exe
4348	eXxOctS.exe
4772	jBTuETj.exe
1692	DYHXSkA.exe
1672	rkxAYab.exe
3208	exCPfjM.exe
876	VkTMaXv.exe
4616	pCqcibl.exe
3196	OGAtRmt.exe
3056	kNciWzK.exe
5064	EDJzbng.exe
2324	kdKOuPQ.exe
1964	REnFYsN.exe
2032	IZLMLeq.exe
2228	DJpNMsu.exe
2336	hMAfaoB.exe
436	BClQkXs.exe
1012	OkTHRNo.exe
2820	MEaUoEr.exe
4804	KRHrKgP.exe
1436	JDiCbUy.exe
3632	VgOSkPi.exe
3984	xKhQitC.exe
2368	DCkQLQS.exe
1916	lkfwxMn.exe
1404	dpNHUAG.exe
4740	IXmFVZN.exe
1844	WpxCtsF.exe
2348	Lwszhkx.exe
1920	KgQqkIR.exe
760	FxjDBvV.exe
1860	KUbwHwT.exe
1588	pYiYdSJ.exe
4604	jFhewMO.exe
4508	PLALVDg.exe
1788	EQEwRwN.exe
5048	DvRLOFj.exe
4356	EgzcuXo.exe
2308	PEKOBga.exe
1276	CFIsgeS.exe
1912	bIVINXp.exe
3096	LhXxEQJ.exe
2656	mgfjuOO.exe
4968	SogFgEm.exe
2256	zTRXLCj.exe
2948	zTQoHyz.exe
1256	dKTeKtd.exe
3512	dBncAIk.exe
3880	sCLLoFY.exe
2816	FRXygpt.exe
1856	dBlvXDi.exe
1748	lvSrvKE.exe
4908	eVBtEEk.exe
4360	QmoQelU.exe
5108	ZhSTHEZ.exe
2496	wchhCGx.exe
2024	XluFFqQ.exe
3712	TCkBmch.exe
1512	KqLAeMt.exe
1216	xTXuyha.exe
396	zMUAWem.exe
2424	URDWXut.exe
2960	RTQABuF.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4704-0-0x00007FF7B21F0000-0x00007FF7B25E2000-memory.dmp	upx
behavioral2/files/0x0007000000023411-22.dat	upx
behavioral2/files/0x0007000000023418-111.dat	upx
behavioral2/files/0x000700000002342d-149.dat	upx
behavioral2/memory/4772-278-0x00007FF7A8530000-0x00007FF7A8922000-memory.dmp	upx
behavioral2/memory/876-460-0x00007FF7204D0000-0x00007FF7208C2000-memory.dmp	upx
behavioral2/memory/4616-505-0x00007FF755030000-0x00007FF755422000-memory.dmp	upx
behavioral2/memory/3196-506-0x00007FF68E550000-0x00007FF68E942000-memory.dmp	upx
behavioral2/memory/3208-405-0x00007FF6074F0000-0x00007FF6078E2000-memory.dmp	upx
behavioral2/memory/1672-348-0x00007FF7D7780000-0x00007FF7D7B72000-memory.dmp	upx
behavioral2/memory/5064-508-0x00007FF761D50000-0x00007FF762142000-memory.dmp	upx
behavioral2/memory/2324-509-0x00007FF7C23F0000-0x00007FF7C27E2000-memory.dmp	upx
behavioral2/memory/2032-511-0x00007FF66A500000-0x00007FF66A8F2000-memory.dmp	upx
behavioral2/memory/2228-512-0x00007FF6CF230000-0x00007FF6CF622000-memory.dmp	upx
behavioral2/memory/4804-1114-0x00007FF711AC0000-0x00007FF711EB2000-memory.dmp	upx
behavioral2/memory/2820-1111-0x00007FF76DC10000-0x00007FF76E002000-memory.dmp	upx
behavioral2/memory/1012-869-0x00007FF6A2DE0000-0x00007FF6A31D2000-memory.dmp	upx
behavioral2/memory/436-785-0x00007FF69BDD0000-0x00007FF69C1C2000-memory.dmp	upx
behavioral2/memory/4348-3255-0x00007FF603860000-0x00007FF603C52000-memory.dmp	upx
behavioral2/memory/4772-3259-0x00007FF7A8530000-0x00007FF7A8922000-memory.dmp	upx
behavioral2/memory/1692-3261-0x00007FF76D830000-0x00007FF76DC22000-memory.dmp	upx
behavioral2/memory/1672-3263-0x00007FF7D7780000-0x00007FF7D7B72000-memory.dmp	upx
behavioral2/memory/5064-3267-0x00007FF761D50000-0x00007FF762142000-memory.dmp	upx
behavioral2/memory/876-3265-0x00007FF7204D0000-0x00007FF7208C2000-memory.dmp	upx
behavioral2/memory/1012-3269-0x00007FF6A2DE0000-0x00007FF6A31D2000-memory.dmp	upx
behavioral2/memory/3208-3257-0x00007FF6074F0000-0x00007FF6078E2000-memory.dmp	upx
behavioral2/memory/2908-3254-0x00007FF619150000-0x00007FF619542000-memory.dmp	upx
behavioral2/memory/3056-3277-0x00007FF6B6880000-0x00007FF6B6C72000-memory.dmp	upx
behavioral2/memory/4616-3279-0x00007FF755030000-0x00007FF755422000-memory.dmp	upx
behavioral2/memory/2336-3282-0x00007FF70F410000-0x00007FF70F802000-memory.dmp	upx
behavioral2/memory/2820-3286-0x00007FF76DC10000-0x00007FF76E002000-memory.dmp	upx
behavioral2/memory/4804-3299-0x00007FF711AC0000-0x00007FF711EB2000-memory.dmp	upx
behavioral2/memory/436-3293-0x00007FF69BDD0000-0x00007FF69C1C2000-memory.dmp	upx
behavioral2/memory/2228-3290-0x00007FF6CF230000-0x00007FF6CF622000-memory.dmp	upx
behavioral2/memory/2324-3284-0x00007FF7C23F0000-0x00007FF7C27E2000-memory.dmp	upx
behavioral2/memory/1964-3275-0x00007FF6C6C30000-0x00007FF6C7022000-memory.dmp	upx
behavioral2/memory/2032-3273-0x00007FF66A500000-0x00007FF66A8F2000-memory.dmp	upx
behavioral2/memory/3196-3271-0x00007FF68E550000-0x00007FF68E942000-memory.dmp	upx
behavioral2/memory/2336-513-0x00007FF70F410000-0x00007FF70F802000-memory.dmp	upx
behavioral2/memory/1964-510-0x00007FF6C6C30000-0x00007FF6C7022000-memory.dmp	upx
behavioral2/memory/3056-507-0x00007FF6B6880000-0x00007FF6B6C72000-memory.dmp	upx
behavioral2/memory/1692-309-0x00007FF76D830000-0x00007FF76DC22000-memory.dmp	upx
behavioral2/memory/4348-255-0x00007FF603860000-0x00007FF603C52000-memory.dmp	upx
behavioral2/memory/2908-237-0x00007FF619150000-0x00007FF619542000-memory.dmp	upx
behavioral2/files/0x0007000000023419-118.dat	upx
behavioral2/files/0x0007000000023411-10.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FqYFKTd.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\vxwhoVm.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\dpQdFUb.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\WznEByV.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\zBXWTvg.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\PLpbTRb.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\BUpPWfp.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\SMUeFQp.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\yseWDyJ.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\dvvXeuR.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\gEIaYPe.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\csipLer.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\XYvmMYq.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\DmSgads.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\JeLyDXp.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\WqfEXTT.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\RLwjDiY.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\CvmYqvj.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\QBvNMXZ.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\TTygtqr.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\lEUdpzx.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\bOlpANm.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\VgOSkPi.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\iwTmeRv.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\XwSeDBH.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\htrEeJZ.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\hOvwFgC.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\ntgQtMl.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\CSoVdEx.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\JrgPuUz.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\SbFSKbu.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\MENxBoU.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\vnaPBHE.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\jaRrHJQ.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\eGjsKwE.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\UmJdNqi.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\pfeYhgo.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\odWVUET.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\sTjkYhw.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\Xwwwikl.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\VoWlSRo.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\cnvbmMu.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\srpCQDf.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\IXmFVZN.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\cVRjsDs.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\PgENoML.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\rACIHGh.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\PZgaWrd.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\fxyifNM.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\wSbsjsC.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\HgfhFNl.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\fbDwsaP.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\NoXZmYg.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\cfnIPNq.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\oPtGWEo.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\HajPqjr.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\XNJfFbs.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\PrcXsAV.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\BqVjbRY.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\sNlPGjX.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\Fxnlpzs.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\LzgaRjl.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\xMmDYPq.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
File created	C:\Windows\System\hEbKSop.exe	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5104	powershell.exe
5104	powershell.exe
5104	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeLockMemoryPrivilege	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 5104	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	84
PID 4704 wrote to memory of 5104	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	84
PID 4704 wrote to memory of 2836	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	85
PID 4704 wrote to memory of 2836	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	85
PID 4704 wrote to memory of 2908	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	86
PID 4704 wrote to memory of 2908	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	86
PID 4704 wrote to memory of 4348	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	87
PID 4704 wrote to memory of 4348	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	87
PID 4704 wrote to memory of 1692	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	88
PID 4704 wrote to memory of 1692	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	88
PID 4704 wrote to memory of 4772	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	89
PID 4704 wrote to memory of 4772	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	89
PID 4704 wrote to memory of 1672	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	90
PID 4704 wrote to memory of 1672	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	90
PID 4704 wrote to memory of 3208	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	91
PID 4704 wrote to memory of 3208	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	91
PID 4704 wrote to memory of 876	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	92
PID 4704 wrote to memory of 876	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	92
PID 4704 wrote to memory of 4616	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	93
PID 4704 wrote to memory of 4616	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	93
PID 4704 wrote to memory of 2032	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	94
PID 4704 wrote to memory of 2032	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	94
PID 4704 wrote to memory of 3196	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	95
PID 4704 wrote to memory of 3196	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	95
PID 4704 wrote to memory of 3056	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	96
PID 4704 wrote to memory of 3056	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	96
PID 4704 wrote to memory of 5064	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	97
PID 4704 wrote to memory of 5064	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	97
PID 4704 wrote to memory of 2324	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	98
PID 4704 wrote to memory of 2324	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	98
PID 4704 wrote to memory of 1964	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	99
PID 4704 wrote to memory of 1964	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	99
PID 4704 wrote to memory of 2228	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	100
PID 4704 wrote to memory of 2228	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	100
PID 4704 wrote to memory of 2336	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	101
PID 4704 wrote to memory of 2336	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	101
PID 4704 wrote to memory of 436	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	102
PID 4704 wrote to memory of 436	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	102
PID 4704 wrote to memory of 1012	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	103
PID 4704 wrote to memory of 1012	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	103
PID 4704 wrote to memory of 2820	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	104
PID 4704 wrote to memory of 2820	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	104
PID 4704 wrote to memory of 4804	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	105
PID 4704 wrote to memory of 4804	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	105
PID 4704 wrote to memory of 1436	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	106
PID 4704 wrote to memory of 1436	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	106
PID 4704 wrote to memory of 3632	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	107
PID 4704 wrote to memory of 3632	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	107
PID 4704 wrote to memory of 3984	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	108
PID 4704 wrote to memory of 3984	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	108
PID 4704 wrote to memory of 2368	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	109
PID 4704 wrote to memory of 2368	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	109
PID 4704 wrote to memory of 4604	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	110
PID 4704 wrote to memory of 4604	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	110
PID 4704 wrote to memory of 1916	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	111
PID 4704 wrote to memory of 1916	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	111
PID 4704 wrote to memory of 1404	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	112
PID 4704 wrote to memory of 1404	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	112
PID 4704 wrote to memory of 4740	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	113
PID 4704 wrote to memory of 4740	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	113
PID 4704 wrote to memory of 1844	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	114
PID 4704 wrote to memory of 1844	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	114
PID 4704 wrote to memory of 2348	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	115
PID 4704 wrote to memory of 2348	4704	f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe	115

C:\Users\Admin\AppData\Local\Temp\f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe
"C:\Users\Admin\AppData\Local\Temp\f2e3e48fbbdbc7146b6907d914993784fd45bd949bce12cbe16750f5e256ae07.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- C:\Windows\System\YMdaoVv.exe
  C:\Windows\System\YMdaoVv.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\JcaUxrF.exe
  C:\Windows\System\JcaUxrF.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\eXxOctS.exe
  C:\Windows\System\eXxOctS.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\DYHXSkA.exe
  C:\Windows\System\DYHXSkA.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\jBTuETj.exe
  C:\Windows\System\jBTuETj.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\rkxAYab.exe
  C:\Windows\System\rkxAYab.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\exCPfjM.exe
  C:\Windows\System\exCPfjM.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\VkTMaXv.exe
  C:\Windows\System\VkTMaXv.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\pCqcibl.exe
  C:\Windows\System\pCqcibl.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\IZLMLeq.exe
  C:\Windows\System\IZLMLeq.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\OGAtRmt.exe
  C:\Windows\System\OGAtRmt.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\kNciWzK.exe
  C:\Windows\System\kNciWzK.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\EDJzbng.exe
  C:\Windows\System\EDJzbng.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\kdKOuPQ.exe
  C:\Windows\System\kdKOuPQ.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\REnFYsN.exe
  C:\Windows\System\REnFYsN.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\DJpNMsu.exe
  C:\Windows\System\DJpNMsu.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\hMAfaoB.exe
  C:\Windows\System\hMAfaoB.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\BClQkXs.exe
  C:\Windows\System\BClQkXs.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\OkTHRNo.exe
  C:\Windows\System\OkTHRNo.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\MEaUoEr.exe
  C:\Windows\System\MEaUoEr.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\KRHrKgP.exe
  C:\Windows\System\KRHrKgP.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\JDiCbUy.exe
  C:\Windows\System\JDiCbUy.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\VgOSkPi.exe
  C:\Windows\System\VgOSkPi.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\xKhQitC.exe
  C:\Windows\System\xKhQitC.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\DCkQLQS.exe
  C:\Windows\System\DCkQLQS.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\jFhewMO.exe
  C:\Windows\System\jFhewMO.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\lkfwxMn.exe
  C:\Windows\System\lkfwxMn.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\dpNHUAG.exe
  C:\Windows\System\dpNHUAG.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\IXmFVZN.exe
  C:\Windows\System\IXmFVZN.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\WpxCtsF.exe
  C:\Windows\System\WpxCtsF.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\Lwszhkx.exe
  C:\Windows\System\Lwszhkx.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\KgQqkIR.exe
  C:\Windows\System\KgQqkIR.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\FxjDBvV.exe
  C:\Windows\System\FxjDBvV.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\KUbwHwT.exe
  C:\Windows\System\KUbwHwT.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\pYiYdSJ.exe
  C:\Windows\System\pYiYdSJ.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\PLALVDg.exe
  C:\Windows\System\PLALVDg.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\EQEwRwN.exe
  C:\Windows\System\EQEwRwN.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\DvRLOFj.exe
  C:\Windows\System\DvRLOFj.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\EgzcuXo.exe
  C:\Windows\System\EgzcuXo.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\PEKOBga.exe
  C:\Windows\System\PEKOBga.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\sCLLoFY.exe
  C:\Windows\System\sCLLoFY.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\CFIsgeS.exe
  C:\Windows\System\CFIsgeS.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\bIVINXp.exe
  C:\Windows\System\bIVINXp.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\LhXxEQJ.exe
  C:\Windows\System\LhXxEQJ.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\mgfjuOO.exe
  C:\Windows\System\mgfjuOO.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\SogFgEm.exe
  C:\Windows\System\SogFgEm.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\zTRXLCj.exe
  C:\Windows\System\zTRXLCj.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\zTQoHyz.exe
  C:\Windows\System\zTQoHyz.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\dKTeKtd.exe
  C:\Windows\System\dKTeKtd.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\FRXygpt.exe
  C:\Windows\System\FRXygpt.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\dBncAIk.exe
  C:\Windows\System\dBncAIk.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\dBlvXDi.exe
  C:\Windows\System\dBlvXDi.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\eVBtEEk.exe
  C:\Windows\System\eVBtEEk.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\lvSrvKE.exe
  C:\Windows\System\lvSrvKE.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\QmoQelU.exe
  C:\Windows\System\QmoQelU.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\ZhSTHEZ.exe
  C:\Windows\System\ZhSTHEZ.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\wchhCGx.exe
  C:\Windows\System\wchhCGx.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\XluFFqQ.exe
  C:\Windows\System\XluFFqQ.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\TCkBmch.exe
  C:\Windows\System\TCkBmch.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\KqLAeMt.exe
  C:\Windows\System\KqLAeMt.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\xTXuyha.exe
  C:\Windows\System\xTXuyha.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\zMUAWem.exe
  C:\Windows\System\zMUAWem.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\URDWXut.exe
  C:\Windows\System\URDWXut.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\RTQABuF.exe
  C:\Windows\System\RTQABuF.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\idNtIcV.exe
  C:\Windows\System\idNtIcV.exe
  2⤵
  PID:1820
- C:\Windows\System\GfUpDlg.exe
  C:\Windows\System\GfUpDlg.exe
  2⤵
  PID:3492
- C:\Windows\System\bRJjKeI.exe
  C:\Windows\System\bRJjKeI.exe
  2⤵
  PID:1308
- C:\Windows\System\wxfUbmN.exe
  C:\Windows\System\wxfUbmN.exe
  2⤵
  PID:2980
- C:\Windows\System\zalbSxa.exe
  C:\Windows\System\zalbSxa.exe
  2⤵
  PID:3360
- C:\Windows\System\PtPiygz.exe
  C:\Windows\System\PtPiygz.exe
  2⤵
  PID:1104
- C:\Windows\System\mJdpfCs.exe
  C:\Windows\System\mJdpfCs.exe
  2⤵
  PID:2140
- C:\Windows\System\NBJHfnD.exe
  C:\Windows\System\NBJHfnD.exe
  2⤵
  PID:3744
- C:\Windows\System\LGdYebY.exe
  C:\Windows\System\LGdYebY.exe
  2⤵
  PID:1316
- C:\Windows\System\UpCbXrD.exe
  C:\Windows\System\UpCbXrD.exe
  2⤵
  PID:4844
- C:\Windows\System\ZqdtFQY.exe
  C:\Windows\System\ZqdtFQY.exe
  2⤵
  PID:3904
- C:\Windows\System\drPazzH.exe
  C:\Windows\System\drPazzH.exe
  2⤵
  PID:2484
- C:\Windows\System\nZKDWUD.exe
  C:\Windows\System\nZKDWUD.exe
  2⤵
  PID:1816
- C:\Windows\System\crWlagf.exe
  C:\Windows\System\crWlagf.exe
  2⤵
  PID:4572
- C:\Windows\System\soXqeOQ.exe
  C:\Windows\System\soXqeOQ.exe
  2⤵
  PID:3248
- C:\Windows\System\EadRgiR.exe
  C:\Windows\System\EadRgiR.exe
  2⤵
  PID:4832
- C:\Windows\System\gRbbmfo.exe
  C:\Windows\System\gRbbmfo.exe
  2⤵
  PID:1092
- C:\Windows\System\BqVjbRY.exe
  C:\Windows\System\BqVjbRY.exe
  2⤵
  PID:468
- C:\Windows\System\UgPMfqY.exe
  C:\Windows\System\UgPMfqY.exe
  2⤵
  PID:4920
- C:\Windows\System\QvokPho.exe
  C:\Windows\System\QvokPho.exe
  2⤵
  PID:944
- C:\Windows\System\eGtltmZ.exe
  C:\Windows\System\eGtltmZ.exe
  2⤵
  PID:5140
- C:\Windows\System\vISqwGY.exe
  C:\Windows\System\vISqwGY.exe
  2⤵
  PID:5160
- C:\Windows\System\zARWgXc.exe
  C:\Windows\System\zARWgXc.exe
  2⤵
  PID:5180
- C:\Windows\System\hwUQdGO.exe
  C:\Windows\System\hwUQdGO.exe
  2⤵
  PID:5200
- C:\Windows\System\vzgWLiY.exe
  C:\Windows\System\vzgWLiY.exe
  2⤵
  PID:5216
- C:\Windows\System\EHzAzXk.exe
  C:\Windows\System\EHzAzXk.exe
  2⤵
  PID:5236
- C:\Windows\System\Rxfjtsk.exe
  C:\Windows\System\Rxfjtsk.exe
  2⤵
  PID:5264
- C:\Windows\System\APlyhqq.exe
  C:\Windows\System\APlyhqq.exe
  2⤵
  PID:5280
- C:\Windows\System\fWyafUR.exe
  C:\Windows\System\fWyafUR.exe
  2⤵
  PID:5304
- C:\Windows\System\YIxvSvo.exe
  C:\Windows\System\YIxvSvo.exe
  2⤵
  PID:5328
- C:\Windows\System\SAMibTS.exe
  C:\Windows\System\SAMibTS.exe
  2⤵
  PID:5352
- C:\Windows\System\iBUWmHI.exe
  C:\Windows\System\iBUWmHI.exe
  2⤵
  PID:5372
- C:\Windows\System\DNcTzUh.exe
  C:\Windows\System\DNcTzUh.exe
  2⤵
  PID:5400
- C:\Windows\System\IfOzziw.exe
  C:\Windows\System\IfOzziw.exe
  2⤵
  PID:5416
- C:\Windows\System\rZdmhbO.exe
  C:\Windows\System\rZdmhbO.exe
  2⤵
  PID:5436
- C:\Windows\System\hzFlkNr.exe
  C:\Windows\System\hzFlkNr.exe
  2⤵
  PID:5456
- C:\Windows\System\AKSFHNt.exe
  C:\Windows\System\AKSFHNt.exe
  2⤵
  PID:5480
- C:\Windows\System\PaDWxaB.exe
  C:\Windows\System\PaDWxaB.exe
  2⤵
  PID:5508
- C:\Windows\System\eDFZpbo.exe
  C:\Windows\System\eDFZpbo.exe
  2⤵
  PID:5528
- C:\Windows\System\lIqWsth.exe
  C:\Windows\System\lIqWsth.exe
  2⤵
  PID:5544
- C:\Windows\System\Yyyebpq.exe
  C:\Windows\System\Yyyebpq.exe
  2⤵
  PID:5572
- C:\Windows\System\yOODZtM.exe
  C:\Windows\System\yOODZtM.exe
  2⤵
  PID:5588
- C:\Windows\System\yiJvCjJ.exe
  C:\Windows\System\yiJvCjJ.exe
  2⤵
  PID:5612
- C:\Windows\System\TyVPTCO.exe
  C:\Windows\System\TyVPTCO.exe
  2⤵
  PID:5636
- C:\Windows\System\mSHMTMc.exe
  C:\Windows\System\mSHMTMc.exe
  2⤵
  PID:5652
- C:\Windows\System\kHPecuq.exe
  C:\Windows\System\kHPecuq.exe
  2⤵
  PID:5676
- C:\Windows\System\eGjsKwE.exe
  C:\Windows\System\eGjsKwE.exe
  2⤵
  PID:5700
- C:\Windows\System\UKTDosT.exe
  C:\Windows\System\UKTDosT.exe
  2⤵
  PID:5720
- C:\Windows\System\QuwzXXn.exe
  C:\Windows\System\QuwzXXn.exe
  2⤵
  PID:5740
- C:\Windows\System\rgtqiov.exe
  C:\Windows\System\rgtqiov.exe
  2⤵
  PID:5756
- C:\Windows\System\sViXFFj.exe
  C:\Windows\System\sViXFFj.exe
  2⤵
  PID:5780
- C:\Windows\System\KGnEboJ.exe
  C:\Windows\System\KGnEboJ.exe
  2⤵
  PID:5800
- C:\Windows\System\dfInHpf.exe
  C:\Windows\System\dfInHpf.exe
  2⤵
  PID:5824
- C:\Windows\System\HajPqjr.exe
  C:\Windows\System\HajPqjr.exe
  2⤵
  PID:5844
- C:\Windows\System\kGSCqKD.exe
  C:\Windows\System\kGSCqKD.exe
  2⤵
  PID:5864
- C:\Windows\System\TWLtAtv.exe
  C:\Windows\System\TWLtAtv.exe
  2⤵
  PID:5880
- C:\Windows\System\jtwTGoC.exe
  C:\Windows\System\jtwTGoC.exe
  2⤵
  PID:5904
- C:\Windows\System\rQIapzX.exe
  C:\Windows\System\rQIapzX.exe
  2⤵
  PID:5920
- C:\Windows\System\PhocuiH.exe
  C:\Windows\System\PhocuiH.exe
  2⤵
  PID:5944
- C:\Windows\System\whulXYF.exe
  C:\Windows\System\whulXYF.exe
  2⤵
  PID:5964
- C:\Windows\System\dGIpSMd.exe
  C:\Windows\System\dGIpSMd.exe
  2⤵
  PID:5980
- C:\Windows\System\rYPoHWt.exe
  C:\Windows\System\rYPoHWt.exe
  2⤵
  PID:6012
- C:\Windows\System\IzwWlAr.exe
  C:\Windows\System\IzwWlAr.exe
  2⤵
  PID:6040
- C:\Windows\System\NRkUwjp.exe
  C:\Windows\System\NRkUwjp.exe
  2⤵
  PID:6068
- C:\Windows\System\cDnNYpS.exe
  C:\Windows\System\cDnNYpS.exe
  2⤵
  PID:6084
- C:\Windows\System\CBipFzV.exe
  C:\Windows\System\CBipFzV.exe
  2⤵
  PID:6108
- C:\Windows\System\yJKbNET.exe
  C:\Windows\System\yJKbNET.exe
  2⤵
  PID:6124
- C:\Windows\System\zniKgvm.exe
  C:\Windows\System\zniKgvm.exe
  2⤵
  PID:2360
- C:\Windows\System\PJXrkTf.exe
  C:\Windows\System\PJXrkTf.exe
  2⤵
  PID:3032
- C:\Windows\System\kWqWKbD.exe
  C:\Windows\System\kWqWKbD.exe
  2⤵
  PID:1932
- C:\Windows\System\iYvsKYQ.exe
  C:\Windows\System\iYvsKYQ.exe
  2⤵
  PID:4036
- C:\Windows\System\VAONkMk.exe
  C:\Windows\System\VAONkMk.exe
  2⤵
  PID:2708
- C:\Windows\System\fnyWdVW.exe
  C:\Windows\System\fnyWdVW.exe
  2⤵
  PID:5208
- C:\Windows\System\MkYRhBW.exe
  C:\Windows\System\MkYRhBW.exe
  2⤵
  PID:5232
- C:\Windows\System\MMWJaqV.exe
  C:\Windows\System\MMWJaqV.exe
  2⤵
  PID:4452
- C:\Windows\System\vFgEWvg.exe
  C:\Windows\System\vFgEWvg.exe
  2⤵
  PID:5296
- C:\Windows\System\FqYFKTd.exe
  C:\Windows\System\FqYFKTd.exe
  2⤵
  PID:5344
- C:\Windows\System\trIRlkn.exe
  C:\Windows\System\trIRlkn.exe
  2⤵
  PID:3088
- C:\Windows\System\nxOtPrG.exe
  C:\Windows\System\nxOtPrG.exe
  2⤵
  PID:5152
- C:\Windows\System\kKUISqe.exe
  C:\Windows\System\kKUISqe.exe
  2⤵
  PID:5644
- C:\Windows\System\oAxNpRc.exe
  C:\Windows\System\oAxNpRc.exe
  2⤵
  PID:5932
- C:\Windows\System\ZQlxUdp.exe
  C:\Windows\System\ZQlxUdp.exe
  2⤵
  PID:5136
- C:\Windows\System\tPoEqin.exe
  C:\Windows\System\tPoEqin.exe
  2⤵
  PID:6148
- C:\Windows\System\eTsatQx.exe
  C:\Windows\System\eTsatQx.exe
  2⤵
  PID:6168
- C:\Windows\System\MJknFVy.exe
  C:\Windows\System\MJknFVy.exe
  2⤵
  PID:6188
- C:\Windows\System\FGhfcSS.exe
  C:\Windows\System\FGhfcSS.exe
  2⤵
  PID:6208
- C:\Windows\System\WtbEgCz.exe
  C:\Windows\System\WtbEgCz.exe
  2⤵
  PID:6224
- C:\Windows\System\EMjYZIo.exe
  C:\Windows\System\EMjYZIo.exe
  2⤵
  PID:6252
- C:\Windows\System\RaCzbJF.exe
  C:\Windows\System\RaCzbJF.exe
  2⤵
  PID:6268
- C:\Windows\System\UwMFgno.exe
  C:\Windows\System\UwMFgno.exe
  2⤵
  PID:6292
- C:\Windows\System\JRbaupP.exe
  C:\Windows\System\JRbaupP.exe
  2⤵
  PID:6308
- C:\Windows\System\ZrHxNPi.exe
  C:\Windows\System\ZrHxNPi.exe
  2⤵
  PID:6332
- C:\Windows\System\swdeNXP.exe
  C:\Windows\System\swdeNXP.exe
  2⤵
  PID:6348
- C:\Windows\System\LFXhCNi.exe
  C:\Windows\System\LFXhCNi.exe
  2⤵
  PID:6372
- C:\Windows\System\LxuCHYS.exe
  C:\Windows\System\LxuCHYS.exe
  2⤵
  PID:6388
- C:\Windows\System\pRNKWHc.exe
  C:\Windows\System\pRNKWHc.exe
  2⤵
  PID:6412
- C:\Windows\System\ClrQHRo.exe
  C:\Windows\System\ClrQHRo.exe
  2⤵
  PID:6624
- C:\Windows\System\KAOpMEU.exe
  C:\Windows\System\KAOpMEU.exe
  2⤵
  PID:6640
- C:\Windows\System\gQsRTNs.exe
  C:\Windows\System\gQsRTNs.exe
  2⤵
  PID:6656
- C:\Windows\System\kjZIGVy.exe
  C:\Windows\System\kjZIGVy.exe
  2⤵
  PID:6672
- C:\Windows\System\jnUFKlv.exe
  C:\Windows\System\jnUFKlv.exe
  2⤵
  PID:6708
- C:\Windows\System\RJrPvlv.exe
  C:\Windows\System\RJrPvlv.exe
  2⤵
  PID:6788
- C:\Windows\System\GUxOQub.exe
  C:\Windows\System\GUxOQub.exe
  2⤵
  PID:6808
- C:\Windows\System\OPdyEql.exe
  C:\Windows\System\OPdyEql.exe
  2⤵
  PID:6824
- C:\Windows\System\SIbHGBo.exe
  C:\Windows\System\SIbHGBo.exe
  2⤵
  PID:6840
- C:\Windows\System\lflJflw.exe
  C:\Windows\System\lflJflw.exe
  2⤵
  PID:6856
- C:\Windows\System\oierfIf.exe
  C:\Windows\System\oierfIf.exe
  2⤵
  PID:6876
- C:\Windows\System\sNlPGjX.exe
  C:\Windows\System\sNlPGjX.exe
  2⤵
  PID:6896
- C:\Windows\System\OyWkSeZ.exe
  C:\Windows\System\OyWkSeZ.exe
  2⤵
  PID:6916
- C:\Windows\System\vToVSHG.exe
  C:\Windows\System\vToVSHG.exe
  2⤵
  PID:6940
- C:\Windows\System\OhqgsUo.exe
  C:\Windows\System\OhqgsUo.exe
  2⤵
  PID:6964
- C:\Windows\System\ATfaHVB.exe
  C:\Windows\System\ATfaHVB.exe
  2⤵
  PID:6992
- C:\Windows\System\RHWWUoE.exe
  C:\Windows\System\RHWWUoE.exe
  2⤵
  PID:7008
- C:\Windows\System\ASffZIY.exe
  C:\Windows\System\ASffZIY.exe
  2⤵
  PID:7032
- C:\Windows\System\zaBVXKQ.exe
  C:\Windows\System\zaBVXKQ.exe
  2⤵
  PID:7048
- C:\Windows\System\tsYyjiE.exe
  C:\Windows\System\tsYyjiE.exe
  2⤵
  PID:7076
- C:\Windows\System\fMjsAuF.exe
  C:\Windows\System\fMjsAuF.exe
  2⤵
  PID:7096
- C:\Windows\System\CuDRobb.exe
  C:\Windows\System\CuDRobb.exe
  2⤵
  PID:7120
- C:\Windows\System\mArHKbu.exe
  C:\Windows\System\mArHKbu.exe
  2⤵
  PID:7140
- C:\Windows\System\otIXrDI.exe
  C:\Windows\System\otIXrDI.exe
  2⤵
  PID:7164
- C:\Windows\System\zkdilhc.exe
  C:\Windows\System\zkdilhc.exe
  2⤵
  PID:5972
- C:\Windows\System\LiNXuqA.exe
  C:\Windows\System\LiNXuqA.exe
  2⤵
  PID:5552
- C:\Windows\System\WOgizRD.exe
  C:\Windows\System\WOgizRD.exe
  2⤵
  PID:5668
- C:\Windows\System\DVTjaXJ.exe
  C:\Windows\System\DVTjaXJ.exe
  2⤵
  PID:5392
- C:\Windows\System\onRDTgm.exe
  C:\Windows\System\onRDTgm.exe
  2⤵
  PID:5956
- C:\Windows\System\RoAtuVQ.exe
  C:\Windows\System\RoAtuVQ.exe
  2⤵
  PID:5684
- C:\Windows\System\aKbPjtO.exe
  C:\Windows\System\aKbPjtO.exe
  2⤵
  PID:5732
- C:\Windows\System\YuBMgVa.exe
  C:\Windows\System\YuBMgVa.exe
  2⤵
  PID:5752
- C:\Windows\System\ciLvmEA.exe
  C:\Windows\System\ciLvmEA.exe
  2⤵
  PID:5796
- C:\Windows\System\oqQtVGj.exe
  C:\Windows\System\oqQtVGj.exe
  2⤵
  PID:5852
- C:\Windows\System\Njbjlet.exe
  C:\Windows\System\Njbjlet.exe
  2⤵
  PID:5892
- C:\Windows\System\StmKTKj.exe
  C:\Windows\System\StmKTKj.exe
  2⤵
  PID:5988
- C:\Windows\System\xotrkWK.exe
  C:\Windows\System\xotrkWK.exe
  2⤵
  PID:6456
- C:\Windows\System\bUnzCWH.exe
  C:\Windows\System\bUnzCWH.exe
  2⤵
  PID:6524
- C:\Windows\System\odWVUET.exe
  C:\Windows\System\odWVUET.exe
  2⤵
  PID:6396
- C:\Windows\System\jPDuzdo.exe
  C:\Windows\System\jPDuzdo.exe
  2⤵
  PID:5632
- C:\Windows\System\fxyifNM.exe
  C:\Windows\System\fxyifNM.exe
  2⤵
  PID:4764
- C:\Windows\System\WazaTjD.exe
  C:\Windows\System\WazaTjD.exe
  2⤵
  PID:4560
- C:\Windows\System\uFjtxVo.exe
  C:\Windows\System\uFjtxVo.exe
  2⤵
  PID:4280
- C:\Windows\System\zLIjwhq.exe
  C:\Windows\System\zLIjwhq.exe
  2⤵
  PID:6080
- C:\Windows\System\eKxojOp.exe
  C:\Windows\System\eKxojOp.exe
  2⤵
  PID:3500
- C:\Windows\System\PLYbTzj.exe
  C:\Windows\System\PLYbTzj.exe
  2⤵
  PID:5316
- C:\Windows\System\HSTpGiF.exe
  C:\Windows\System\HSTpGiF.exe
  2⤵
  PID:5896
- C:\Windows\System\gxMrKOB.exe
  C:\Windows\System\gxMrKOB.exe
  2⤵
  PID:5452
- C:\Windows\System\VDNdnBT.exe
  C:\Windows\System\VDNdnBT.exe
  2⤵
  PID:6204
- C:\Windows\System\sacLytI.exe
  C:\Windows\System\sacLytI.exe
  2⤵
  PID:6248
- C:\Windows\System\eMZNCYr.exe
  C:\Windows\System\eMZNCYr.exe
  2⤵
  PID:6300
- C:\Windows\System\lPOlCiK.exe
  C:\Windows\System\lPOlCiK.exe
  2⤵
  PID:6340
- C:\Windows\System\SjzkaUJ.exe
  C:\Windows\System\SjzkaUJ.exe
  2⤵
  PID:6380
- C:\Windows\System\FYKKYuA.exe
  C:\Windows\System\FYKKYuA.exe
  2⤵
  PID:7176
- C:\Windows\System\HfrnLwC.exe
  C:\Windows\System\HfrnLwC.exe
  2⤵
  PID:7192
- C:\Windows\System\euSTuvw.exe
  C:\Windows\System\euSTuvw.exe
  2⤵
  PID:7208
- C:\Windows\System\rMuNKsO.exe
  C:\Windows\System\rMuNKsO.exe
  2⤵
  PID:7224
- C:\Windows\System\IfmNdXn.exe
  C:\Windows\System\IfmNdXn.exe
  2⤵
  PID:7244
- C:\Windows\System\TozkbGk.exe
  C:\Windows\System\TozkbGk.exe
  2⤵
  PID:7264
- C:\Windows\System\DzjjEfv.exe
  C:\Windows\System\DzjjEfv.exe
  2⤵
  PID:7288
- C:\Windows\System\hwcfEjr.exe
  C:\Windows\System\hwcfEjr.exe
  2⤵
  PID:7304
- C:\Windows\System\PyPtZVd.exe
  C:\Windows\System\PyPtZVd.exe
  2⤵
  PID:7328
- C:\Windows\System\dXfwGYL.exe
  C:\Windows\System\dXfwGYL.exe
  2⤵
  PID:7344
- C:\Windows\System\MjdOGXL.exe
  C:\Windows\System\MjdOGXL.exe
  2⤵
  PID:7368
- C:\Windows\System\PuNPTss.exe
  C:\Windows\System\PuNPTss.exe
  2⤵
  PID:7392
- C:\Windows\System\qUWeaEO.exe
  C:\Windows\System\qUWeaEO.exe
  2⤵
  PID:7408
- C:\Windows\System\BOyjpwZ.exe
  C:\Windows\System\BOyjpwZ.exe
  2⤵
  PID:7432
- C:\Windows\System\ZHGtvwd.exe
  C:\Windows\System\ZHGtvwd.exe
  2⤵
  PID:7448
- C:\Windows\System\KTmZjvD.exe
  C:\Windows\System\KTmZjvD.exe
  2⤵
  PID:7464
- C:\Windows\System\gaOtcTp.exe
  C:\Windows\System\gaOtcTp.exe
  2⤵
  PID:7484
- C:\Windows\System\WcUudUb.exe
  C:\Windows\System\WcUudUb.exe
  2⤵
  PID:7528
- C:\Windows\System\yYcBpjE.exe
  C:\Windows\System\yYcBpjE.exe
  2⤵
  PID:7556
- C:\Windows\System\NaVmbri.exe
  C:\Windows\System\NaVmbri.exe
  2⤵
  PID:7592
- C:\Windows\System\biLmyGq.exe
  C:\Windows\System\biLmyGq.exe
  2⤵
  PID:7608
- C:\Windows\System\FAICLNU.exe
  C:\Windows\System\FAICLNU.exe
  2⤵
  PID:7628
- C:\Windows\System\yQARoyc.exe
  C:\Windows\System\yQARoyc.exe
  2⤵
  PID:7644
- C:\Windows\System\ENJkmNc.exe
  C:\Windows\System\ENJkmNc.exe
  2⤵
  PID:7660
- C:\Windows\System\AnfyMrW.exe
  C:\Windows\System\AnfyMrW.exe
  2⤵
  PID:7684
- C:\Windows\System\zMYZhCF.exe
  C:\Windows\System\zMYZhCF.exe
  2⤵
  PID:7708
- C:\Windows\System\gHzFyYh.exe
  C:\Windows\System\gHzFyYh.exe
  2⤵
  PID:7732
- C:\Windows\System\nwnCrjy.exe
  C:\Windows\System\nwnCrjy.exe
  2⤵
  PID:7764
- C:\Windows\System\QjZyOUa.exe
  C:\Windows\System\QjZyOUa.exe
  2⤵
  PID:7788
- C:\Windows\System\JrgPuUz.exe
  C:\Windows\System\JrgPuUz.exe
  2⤵
  PID:7820
- C:\Windows\System\wnDuZMH.exe
  C:\Windows\System\wnDuZMH.exe
  2⤵
  PID:7848
- C:\Windows\System\kPSZefR.exe
  C:\Windows\System\kPSZefR.exe
  2⤵
  PID:7876
- C:\Windows\System\uztxxGA.exe
  C:\Windows\System\uztxxGA.exe
  2⤵
  PID:7908
- C:\Windows\System\JSydcCh.exe
  C:\Windows\System\JSydcCh.exe
  2⤵
  PID:7948
- C:\Windows\System\HTmsOOD.exe
  C:\Windows\System\HTmsOOD.exe
  2⤵
  PID:7968
- C:\Windows\System\IDYHgZh.exe
  C:\Windows\System\IDYHgZh.exe
  2⤵
  PID:7992
- C:\Windows\System\unrTtIY.exe
  C:\Windows\System\unrTtIY.exe
  2⤵
  PID:8012
- C:\Windows\System\cCkUOBp.exe
  C:\Windows\System\cCkUOBp.exe
  2⤵
  PID:8032
- C:\Windows\System\YpWEpgC.exe
  C:\Windows\System\YpWEpgC.exe
  2⤵
  PID:8048
- C:\Windows\System\OfGFFZR.exe
  C:\Windows\System\OfGFFZR.exe
  2⤵
  PID:8064
- C:\Windows\System\gCAoVXb.exe
  C:\Windows\System\gCAoVXb.exe
  2⤵
  PID:8080
- C:\Windows\System\QCBdAUh.exe
  C:\Windows\System\QCBdAUh.exe
  2⤵
  PID:8096
- C:\Windows\System\xmSwhsy.exe
  C:\Windows\System\xmSwhsy.exe
  2⤵
  PID:8144
- C:\Windows\System\RaVLnzp.exe
  C:\Windows\System\RaVLnzp.exe
  2⤵
  PID:8168
- C:\Windows\System\npSttxQ.exe
  C:\Windows\System\npSttxQ.exe
  2⤵
  PID:8184
- C:\Windows\System\vUrLPpZ.exe
  C:\Windows\System\vUrLPpZ.exe
  2⤵
  PID:6760
- C:\Windows\System\ngFUFUM.exe
  C:\Windows\System\ngFUFUM.exe
  2⤵
  PID:6872
- C:\Windows\System\PQnzNWP.exe
  C:\Windows\System\PQnzNWP.exe
  2⤵
  PID:4692
- C:\Windows\System\yHnSxbP.exe
  C:\Windows\System\yHnSxbP.exe
  2⤵
  PID:6220
- C:\Windows\System\ouXnZPD.exe
  C:\Windows\System\ouXnZPD.exe
  2⤵
  PID:8212
- C:\Windows\System\VHoLLzB.exe
  C:\Windows\System\VHoLLzB.exe
  2⤵
  PID:8232
- C:\Windows\System\ITELwhv.exe
  C:\Windows\System\ITELwhv.exe
  2⤵
  PID:8248
- C:\Windows\System\kiisDme.exe
  C:\Windows\System\kiisDme.exe
  2⤵
  PID:8276
- C:\Windows\System\TpcgsVy.exe
  C:\Windows\System\TpcgsVy.exe
  2⤵
  PID:8300
- C:\Windows\System\sPGPyyX.exe
  C:\Windows\System\sPGPyyX.exe
  2⤵
  PID:8320
- C:\Windows\System\uICWJVG.exe
  C:\Windows\System\uICWJVG.exe
  2⤵
  PID:8340
- C:\Windows\System\CXaixcT.exe
  C:\Windows\System\CXaixcT.exe
  2⤵
  PID:8356
- C:\Windows\System\VEOHpcQ.exe
  C:\Windows\System\VEOHpcQ.exe
  2⤵
  PID:8372
- C:\Windows\System\zirtanu.exe
  C:\Windows\System\zirtanu.exe
  2⤵
  PID:8392
- C:\Windows\System\LyqCUoX.exe
  C:\Windows\System\LyqCUoX.exe
  2⤵
  PID:8412
- C:\Windows\System\qdAERuu.exe
  C:\Windows\System\qdAERuu.exe
  2⤵
  PID:8428
- C:\Windows\System\NsyQoON.exe
  C:\Windows\System\NsyQoON.exe
  2⤵
  PID:8444
- C:\Windows\System\pUqaSTX.exe
  C:\Windows\System\pUqaSTX.exe
  2⤵
  PID:8464
- C:\Windows\System\uPXcQcF.exe
  C:\Windows\System\uPXcQcF.exe
  2⤵
  PID:8484
- C:\Windows\System\SbFSKbu.exe
  C:\Windows\System\SbFSKbu.exe
  2⤵
  PID:8504
- C:\Windows\System\wZRQFNR.exe
  C:\Windows\System\wZRQFNR.exe
  2⤵
  PID:8520
- C:\Windows\System\jwGykqS.exe
  C:\Windows\System\jwGykqS.exe
  2⤵
  PID:8536
- C:\Windows\System\bUMwHVM.exe
  C:\Windows\System\bUMwHVM.exe
  2⤵
  PID:8552
- C:\Windows\System\GtwKkkz.exe
  C:\Windows\System\GtwKkkz.exe
  2⤵
  PID:8568
- C:\Windows\System\xavKuMT.exe
  C:\Windows\System\xavKuMT.exe
  2⤵
  PID:8592
- C:\Windows\System\ibVmyZr.exe
  C:\Windows\System\ibVmyZr.exe
  2⤵
  PID:8616
- C:\Windows\System\pjMLRoR.exe
  C:\Windows\System\pjMLRoR.exe
  2⤵
  PID:8632
- C:\Windows\System\EMWbbsw.exe
  C:\Windows\System\EMWbbsw.exe
  2⤵
  PID:8656
- C:\Windows\System\XNJfFbs.exe
  C:\Windows\System\XNJfFbs.exe
  2⤵
  PID:8676
- C:\Windows\System\hYaNzQz.exe
  C:\Windows\System\hYaNzQz.exe
  2⤵
  PID:8696
- C:\Windows\System\gYMMaFQ.exe
  C:\Windows\System\gYMMaFQ.exe
  2⤵
  PID:8716
- C:\Windows\System\yiqMhvm.exe
  C:\Windows\System\yiqMhvm.exe
  2⤵
  PID:8732
- C:\Windows\System\EqlAFfY.exe
  C:\Windows\System\EqlAFfY.exe
  2⤵
  PID:8748
- C:\Windows\System\qtybnRM.exe
  C:\Windows\System\qtybnRM.exe
  2⤵
  PID:8764
- C:\Windows\System\vxwhoVm.exe
  C:\Windows\System\vxwhoVm.exe
  2⤵
  PID:8780
- C:\Windows\System\kLGowzv.exe
  C:\Windows\System\kLGowzv.exe
  2⤵
  PID:8796
- C:\Windows\System\gagXCof.exe
  C:\Windows\System\gagXCof.exe
  2⤵
  PID:8816
- C:\Windows\System\tQIEwOU.exe
  C:\Windows\System\tQIEwOU.exe
  2⤵
  PID:8832
- C:\Windows\System\REqBAvt.exe
  C:\Windows\System\REqBAvt.exe
  2⤵
  PID:8852
- C:\Windows\System\tfKvqTu.exe
  C:\Windows\System\tfKvqTu.exe
  2⤵
  PID:8868
- C:\Windows\System\qxFxrvO.exe
  C:\Windows\System\qxFxrvO.exe
  2⤵
  PID:8888
- C:\Windows\System\dzVliAe.exe
  C:\Windows\System\dzVliAe.exe
  2⤵
  PID:8908
- C:\Windows\System\STxwjxR.exe
  C:\Windows\System\STxwjxR.exe
  2⤵
  PID:8924
- C:\Windows\System\VMAYhmG.exe
  C:\Windows\System\VMAYhmG.exe
  2⤵
  PID:8944
- C:\Windows\System\dkAYSAe.exe
  C:\Windows\System\dkAYSAe.exe
  2⤵
  PID:8964
- C:\Windows\System\uOSfXPP.exe
  C:\Windows\System\uOSfXPP.exe
  2⤵
  PID:8984
- C:\Windows\System\OuSQiGc.exe
  C:\Windows\System\OuSQiGc.exe
  2⤵
  PID:9004
- C:\Windows\System\QOPmHxr.exe
  C:\Windows\System\QOPmHxr.exe
  2⤵
  PID:9024
- C:\Windows\System\uiTIaOV.exe
  C:\Windows\System\uiTIaOV.exe
  2⤵
  PID:9048
- C:\Windows\System\prdsPMO.exe
  C:\Windows\System\prdsPMO.exe
  2⤵
  PID:9064
- C:\Windows\System\otZecWP.exe
  C:\Windows\System\otZecWP.exe
  2⤵
  PID:9092
- C:\Windows\System\YglqpXo.exe
  C:\Windows\System\YglqpXo.exe
  2⤵
  PID:9108
- C:\Windows\System\NoXZmYg.exe
  C:\Windows\System\NoXZmYg.exe
  2⤵
  PID:9124
- C:\Windows\System\iAvtraZ.exe
  C:\Windows\System\iAvtraZ.exe
  2⤵
  PID:9144
- C:\Windows\System\abidlbr.exe
  C:\Windows\System\abidlbr.exe
  2⤵
  PID:9164
- C:\Windows\System\wWhzMQd.exe
  C:\Windows\System\wWhzMQd.exe
  2⤵
  PID:9188
- C:\Windows\System\VBcuRdt.exe
  C:\Windows\System\VBcuRdt.exe
  2⤵
  PID:9208
- C:\Windows\System\NFgFzfC.exe
  C:\Windows\System\NFgFzfC.exe
  2⤵
  PID:7232
- C:\Windows\System\sxcnICr.exe
  C:\Windows\System\sxcnICr.exe
  2⤵
  PID:7444
- C:\Windows\System\IAqVTry.exe
  C:\Windows\System\IAqVTry.exe
  2⤵
  PID:1740
- C:\Windows\System\riERlKz.exe
  C:\Windows\System\riERlKz.exe
  2⤵
  PID:6888
- C:\Windows\System\joGPnHj.exe
  C:\Windows\System\joGPnHj.exe
  2⤵
  PID:7108
- C:\Windows\System\IOZQQsj.exe
  C:\Windows\System\IOZQQsj.exe
  2⤵
  PID:5816
- C:\Windows\System\czUEXSn.exe
  C:\Windows\System\czUEXSn.exe
  2⤵
  PID:6116
- C:\Windows\System\ccIiBZj.exe
  C:\Windows\System\ccIiBZj.exe
  2⤵
  PID:5248
- C:\Windows\System\JQCrHVZ.exe
  C:\Windows\System\JQCrHVZ.exe
  2⤵
  PID:8164
- C:\Windows\System\cgVLfvP.exe
  C:\Windows\System\cgVLfvP.exe
  2⤵
  PID:7216
- C:\Windows\System\HKETTjb.exe
  C:\Windows\System\HKETTjb.exe
  2⤵
  PID:8364
- C:\Windows\System\MkrjFUD.exe
  C:\Windows\System\MkrjFUD.exe
  2⤵
  PID:6664
- C:\Windows\System\OPiAciV.exe
  C:\Windows\System\OPiAciV.exe
  2⤵
  PID:6776
- C:\Windows\System\ryEGETl.exe
  C:\Windows\System\ryEGETl.exe
  2⤵
  PID:6820
- C:\Windows\System\VJABfVn.exe
  C:\Windows\System\VJABfVn.exe
  2⤵
  PID:6852
- C:\Windows\System\jAtSVpp.exe
  C:\Windows\System\jAtSVpp.exe
  2⤵
  PID:6932
- C:\Windows\System\WipRrVd.exe
  C:\Windows\System\WipRrVd.exe
  2⤵
  PID:6972
- C:\Windows\System\ZZgQdKy.exe
  C:\Windows\System\ZZgQdKy.exe
  2⤵
  PID:7028
- C:\Windows\System\aMyblsL.exe
  C:\Windows\System\aMyblsL.exe
  2⤵
  PID:9236
- C:\Windows\System\jmnHHhv.exe
  C:\Windows\System\jmnHHhv.exe
  2⤵
  PID:9252
- C:\Windows\System\JyHzfIN.exe
  C:\Windows\System\JyHzfIN.exe
  2⤵
  PID:9276
- C:\Windows\System\LKqMhdT.exe
  C:\Windows\System\LKqMhdT.exe
  2⤵
  PID:9292
- C:\Windows\System\XAxaNnl.exe
  C:\Windows\System\XAxaNnl.exe
  2⤵
  PID:9316
- C:\Windows\System\wSbsjsC.exe
  C:\Windows\System\wSbsjsC.exe
  2⤵
  PID:9336
- C:\Windows\System\bqsdtWU.exe
  C:\Windows\System\bqsdtWU.exe
  2⤵
  PID:9356
- C:\Windows\System\uiGtrUo.exe
  C:\Windows\System\uiGtrUo.exe
  2⤵
  PID:9380
- C:\Windows\System\oaqIYEQ.exe
  C:\Windows\System\oaqIYEQ.exe
  2⤵
  PID:9396
- C:\Windows\System\PgxmWkc.exe
  C:\Windows\System\PgxmWkc.exe
  2⤵
  PID:9420
- C:\Windows\System\csipLer.exe
  C:\Windows\System\csipLer.exe
  2⤵
  PID:9436
- C:\Windows\System\oklFYUR.exe
  C:\Windows\System\oklFYUR.exe
  2⤵
  PID:9464
- C:\Windows\System\YWuFMSq.exe
  C:\Windows\System\YWuFMSq.exe
  2⤵
  PID:9480
- C:\Windows\System\aGsrGDM.exe
  C:\Windows\System\aGsrGDM.exe
  2⤵
  PID:9504
- C:\Windows\System\KsROgmU.exe
  C:\Windows\System\KsROgmU.exe
  2⤵
  PID:9520
- C:\Windows\System\khfmLRC.exe
  C:\Windows\System\khfmLRC.exe
  2⤵
  PID:9544
- C:\Windows\System\GqfCYxn.exe
  C:\Windows\System\GqfCYxn.exe
  2⤵
  PID:9560
- C:\Windows\System\PLmMHwU.exe
  C:\Windows\System\PLmMHwU.exe
  2⤵
  PID:9584
- C:\Windows\System\aPfMyiW.exe
  C:\Windows\System\aPfMyiW.exe
  2⤵
  PID:9604
- C:\Windows\System\rmtycRk.exe
  C:\Windows\System\rmtycRk.exe
  2⤵
  PID:9624
- C:\Windows\System\NnWhSQE.exe
  C:\Windows\System\NnWhSQE.exe
  2⤵
  PID:9644
- C:\Windows\System\myZRqbN.exe
  C:\Windows\System\myZRqbN.exe
  2⤵
  PID:9664
- C:\Windows\System\VmknuFT.exe
  C:\Windows\System\VmknuFT.exe
  2⤵
  PID:9688
- C:\Windows\System\ohScLbW.exe
  C:\Windows\System\ohScLbW.exe
  2⤵
  PID:9704
- C:\Windows\System\qUxyMKR.exe
  C:\Windows\System\qUxyMKR.exe
  2⤵
  PID:9724
- C:\Windows\System\DMHmKfA.exe
  C:\Windows\System\DMHmKfA.exe
  2⤵
  PID:9744
- C:\Windows\System\zHPDTsL.exe
  C:\Windows\System\zHPDTsL.exe
  2⤵
  PID:9760
- C:\Windows\System\WvhrwPw.exe
  C:\Windows\System\WvhrwPw.exe
  2⤵
  PID:9784
- C:\Windows\System\lfRwDZs.exe
  C:\Windows\System\lfRwDZs.exe
  2⤵
  PID:9808
- C:\Windows\System\ZtmTQSv.exe
  C:\Windows\System\ZtmTQSv.exe
  2⤵
  PID:9828
- C:\Windows\System\iwTmeRv.exe
  C:\Windows\System\iwTmeRv.exe
  2⤵
  PID:9852
- C:\Windows\System\jjEoFus.exe
  C:\Windows\System\jjEoFus.exe
  2⤵
  PID:9868
- C:\Windows\System\ohrsRTe.exe
  C:\Windows\System\ohrsRTe.exe
  2⤵
  PID:9892
- C:\Windows\System\IluAJzH.exe
  C:\Windows\System\IluAJzH.exe
  2⤵
  PID:9912
- C:\Windows\System\fvONRnw.exe
  C:\Windows\System\fvONRnw.exe
  2⤵
  PID:9932
- C:\Windows\System\mYvXcjS.exe
  C:\Windows\System\mYvXcjS.exe
  2⤵
  PID:9948
- C:\Windows\System\uAZdKHR.exe
  C:\Windows\System\uAZdKHR.exe
  2⤵
  PID:9964
- C:\Windows\System\OQiCnht.exe
  C:\Windows\System\OQiCnht.exe
  2⤵
  PID:9980
- C:\Windows\System\jTswMDq.exe
  C:\Windows\System\jTswMDq.exe
  2⤵
  PID:9996
- C:\Windows\System\sddCcYr.exe
  C:\Windows\System\sddCcYr.exe
  2⤵
  PID:10020
- C:\Windows\System\rFwgkmQ.exe
  C:\Windows\System\rFwgkmQ.exe
  2⤵
  PID:10044
- C:\Windows\System\SrymKkL.exe
  C:\Windows\System\SrymKkL.exe
  2⤵
  PID:10060
- C:\Windows\System\onxSJOw.exe
  C:\Windows\System\onxSJOw.exe
  2⤵
  PID:10084
- C:\Windows\System\tntRGIQ.exe
  C:\Windows\System\tntRGIQ.exe
  2⤵
  PID:10104
- C:\Windows\System\dwDPxPV.exe
  C:\Windows\System\dwDPxPV.exe
  2⤵
  PID:10124
- C:\Windows\System\OzljSFf.exe
  C:\Windows\System\OzljSFf.exe
  2⤵
  PID:10144
- C:\Windows\System\IjLloqr.exe
  C:\Windows\System\IjLloqr.exe
  2⤵
  PID:10164
- C:\Windows\System\sCWRZDS.exe
  C:\Windows\System\sCWRZDS.exe
  2⤵
  PID:10184
- C:\Windows\System\dapLbKt.exe
  C:\Windows\System\dapLbKt.exe
  2⤵
  PID:10204
- C:\Windows\System\oHaHwuO.exe
  C:\Windows\System\oHaHwuO.exe
  2⤵
  PID:10232
- C:\Windows\System\XhzZSjb.exe
  C:\Windows\System\XhzZSjb.exe
  2⤵
  PID:7068
- C:\Windows\System\DeELQrZ.exe
  C:\Windows\System\DeELQrZ.exe
  2⤵
  PID:7812
- C:\Windows\System\YvKvGOh.exe
  C:\Windows\System\YvKvGOh.exe
  2⤵
  PID:5960
- C:\Windows\System\gLyZwJL.exe
  C:\Windows\System\gLyZwJL.exe
  2⤵
  PID:5536
- C:\Windows\System\QIoQgpX.exe
  C:\Windows\System\QIoQgpX.exe
  2⤵
  PID:5384
- C:\Windows\System\dSImKYU.exe
  C:\Windows\System\dSImKYU.exe
  2⤵
  PID:7864
- C:\Windows\System\tqsdUpU.exe
  C:\Windows\System\tqsdUpU.exe
  2⤵
  PID:5712
- C:\Windows\System\RWgJJII.exe
  C:\Windows\System\RWgJJII.exe
  2⤵
  PID:5840
- C:\Windows\System\VhYJelb.exe
  C:\Windows\System\VhYJelb.exe
  2⤵
  PID:6508
- C:\Windows\System\TJaKPXM.exe
  C:\Windows\System\TJaKPXM.exe
  2⤵
  PID:6512
- C:\Windows\System\BSvZhhG.exe
  C:\Windows\System\BSvZhhG.exe
  2⤵
  PID:1688
- C:\Windows\System\apzQreX.exe
  C:\Windows\System\apzQreX.exe
  2⤵
  PID:8708
- C:\Windows\System\ZfPNLje.exe
  C:\Windows\System\ZfPNLje.exe
  2⤵
  PID:4168
- C:\Windows\System\XReVxic.exe
  C:\Windows\System\XReVxic.exe
  2⤵
  PID:4724
- C:\Windows\System\bugSxiH.exe
  C:\Windows\System\bugSxiH.exe
  2⤵
  PID:5624
- C:\Windows\System\zlOIgcm.exe
  C:\Windows\System\zlOIgcm.exe
  2⤵
  PID:6264
- C:\Windows\System\CdXhuyD.exe
  C:\Windows\System\CdXhuyD.exe
  2⤵
  PID:6324
- C:\Windows\System\nrsNodj.exe
  C:\Windows\System\nrsNodj.exe
  2⤵
  PID:8808
- C:\Windows\System\DdBeWxD.exe
  C:\Windows\System\DdBeWxD.exe
  2⤵
  PID:8840
- C:\Windows\System\WroqyUZ.exe
  C:\Windows\System\WroqyUZ.exe
  2⤵
  PID:7128
- C:\Windows\System\hAkhAIi.exe
  C:\Windows\System\hAkhAIi.exe
  2⤵
  PID:6408
- C:\Windows\System\tMeFAWB.exe
  C:\Windows\System\tMeFAWB.exe
  2⤵
  PID:8880
- C:\Windows\System\nOCvVDT.exe
  C:\Windows\System\nOCvVDT.exe
  2⤵
  PID:7280
- C:\Windows\System\yrjvyWE.exe
  C:\Windows\System\yrjvyWE.exe
  2⤵
  PID:7336
- C:\Windows\System\EWRLUWp.exe
  C:\Windows\System\EWRLUWp.exe
  2⤵
  PID:7364
- C:\Windows\System\KETEpjb.exe
  C:\Windows\System\KETEpjb.exe
  2⤵
  PID:7416
- C:\Windows\System\dpQdFUb.exe
  C:\Windows\System\dpQdFUb.exe
  2⤵
  PID:8336
- C:\Windows\System\qkQdvaj.exe
  C:\Windows\System\qkQdvaj.exe
  2⤵
  PID:7476
- C:\Windows\System\fqMlcuU.exe
  C:\Windows\System\fqMlcuU.exe
  2⤵
  PID:9104
- C:\Windows\System\SNTaizQ.exe
  C:\Windows\System\SNTaizQ.exe
  2⤵
  PID:8384
- C:\Windows\System\etKDhJO.exe
  C:\Windows\System\etKDhJO.exe
  2⤵
  PID:7536
- C:\Windows\System\EbAOwMV.exe
  C:\Windows\System\EbAOwMV.exe
  2⤵
  PID:7588
- C:\Windows\System\uSUXKgD.exe
  C:\Windows\System\uSUXKgD.exe
  2⤵
  PID:7624
- C:\Windows\System\XZZCmYg.exe
  C:\Windows\System\XZZCmYg.exe
  2⤵
  PID:10244
- C:\Windows\System\TPGaDxN.exe
  C:\Windows\System\TPGaDxN.exe
  2⤵
  PID:10272
- C:\Windows\System\cHwuInx.exe
  C:\Windows\System\cHwuInx.exe
  2⤵
  PID:10436
- C:\Windows\System\EloJMkX.exe
  C:\Windows\System\EloJMkX.exe
  2⤵
  PID:10464
- C:\Windows\System\HBFjCzd.exe
  C:\Windows\System\HBFjCzd.exe
  2⤵
  PID:10488
- C:\Windows\System\wbytmoE.exe
  C:\Windows\System\wbytmoE.exe
  2⤵
  PID:10508
- C:\Windows\System\XCvvdII.exe
  C:\Windows\System\XCvvdII.exe
  2⤵
  PID:10532
- C:\Windows\System\wwnJYkU.exe
  C:\Windows\System\wwnJYkU.exe
  2⤵
  PID:10556
- C:\Windows\System\AjmWaVK.exe
  C:\Windows\System\AjmWaVK.exe
  2⤵
  PID:10572
- C:\Windows\System\ZiQgdHY.exe
  C:\Windows\System\ZiQgdHY.exe
  2⤵
  PID:10596
- C:\Windows\System\YzElWJy.exe
  C:\Windows\System\YzElWJy.exe
  2⤵
  PID:10616
- C:\Windows\System\ntgQtMl.exe
  C:\Windows\System\ntgQtMl.exe
  2⤵
  PID:10636
- C:\Windows\System\COIbsjd.exe
  C:\Windows\System\COIbsjd.exe
  2⤵
  PID:10660
- C:\Windows\System\AvNJdTO.exe
  C:\Windows\System\AvNJdTO.exe
  2⤵
  PID:10684
- C:\Windows\System\FLGWsGE.exe
  C:\Windows\System\FLGWsGE.exe
  2⤵
  PID:10704
- C:\Windows\System\IXWXQfe.exe
  C:\Windows\System\IXWXQfe.exe
  2⤵
  PID:10724
- C:\Windows\System\jLuUBmU.exe
  C:\Windows\System\jLuUBmU.exe
  2⤵
  PID:10740
- C:\Windows\System\wUXnKFW.exe
  C:\Windows\System\wUXnKFW.exe
  2⤵
  PID:10768
- C:\Windows\System\eoRSZwi.exe
  C:\Windows\System\eoRSZwi.exe
  2⤵
  PID:10788
- C:\Windows\System\iPptYUx.exe
  C:\Windows\System\iPptYUx.exe
  2⤵
  PID:10808
- C:\Windows\System\SMUeFQp.exe
  C:\Windows\System\SMUeFQp.exe
  2⤵
  PID:10824
- C:\Windows\System\iQkNeBp.exe
  C:\Windows\System\iQkNeBp.exe
  2⤵
  PID:10848
- C:\Windows\System\YrztmPa.exe
  C:\Windows\System\YrztmPa.exe
  2⤵
  PID:10868
- C:\Windows\System\CBLGoax.exe
  C:\Windows\System\CBLGoax.exe
  2⤵
  PID:10888
- C:\Windows\System\eojrNkO.exe
  C:\Windows\System\eojrNkO.exe
  2⤵
  PID:10908
- C:\Windows\System\iFZqegr.exe
  C:\Windows\System\iFZqegr.exe
  2⤵
  PID:10932
- C:\Windows\System\hbtobTX.exe
  C:\Windows\System\hbtobTX.exe
  2⤵
  PID:10952
- C:\Windows\System\slYuUfY.exe
  C:\Windows\System\slYuUfY.exe
  2⤵
  PID:10972
- C:\Windows\System\whomKOM.exe
  C:\Windows\System\whomKOM.exe
  2⤵
  PID:10992
- C:\Windows\System\DlPjULI.exe
  C:\Windows\System\DlPjULI.exe
  2⤵
  PID:11016
- C:\Windows\System\NRlCWpq.exe
  C:\Windows\System\NRlCWpq.exe
  2⤵
  PID:11036
- C:\Windows\System\KJkACcd.exe
  C:\Windows\System\KJkACcd.exe
  2⤵
  PID:11056
- C:\Windows\System\PElAuVP.exe
  C:\Windows\System\PElAuVP.exe
  2⤵
  PID:11080
- C:\Windows\System\wOIZOQk.exe
  C:\Windows\System\wOIZOQk.exe
  2⤵
  PID:11100
- C:\Windows\System\rgPMtZK.exe
  C:\Windows\System\rgPMtZK.exe
  2⤵
  PID:11120
- C:\Windows\System\cVRjsDs.exe
  C:\Windows\System\cVRjsDs.exe
  2⤵
  PID:11140
- C:\Windows\System\cuyFXdA.exe
  C:\Windows\System\cuyFXdA.exe
  2⤵
  PID:11164
- C:\Windows\System\QiOZcOo.exe
  C:\Windows\System\QiOZcOo.exe
  2⤵
  PID:11188
- C:\Windows\System\IRocvnY.exe
  C:\Windows\System\IRocvnY.exe
  2⤵
  PID:11208
- C:\Windows\System\MhNVtxj.exe
  C:\Windows\System\MhNVtxj.exe
  2⤵
  PID:11228
- C:\Windows\System\zdaEhbn.exe
  C:\Windows\System\zdaEhbn.exe
  2⤵
  PID:11248
- C:\Windows\System\svbpsCD.exe
  C:\Windows\System\svbpsCD.exe
  2⤵
  PID:7640
- C:\Windows\System\oMIGmgb.exe
  C:\Windows\System\oMIGmgb.exe
  2⤵
  PID:7696
- C:\Windows\System\pUfLWvE.exe
  C:\Windows\System\pUfLWvE.exe
  2⤵
  PID:4076
- C:\Windows\System\FTYCXIF.exe
  C:\Windows\System\FTYCXIF.exe
  2⤵
  PID:7724
- C:\Windows\System\lYwCkIX.exe
  C:\Windows\System\lYwCkIX.exe
  2⤵
  PID:7480
- C:\Windows\System\wtTzIyl.exe
  C:\Windows\System\wtTzIyl.exe
  2⤵
  PID:8480
- C:\Windows\System\iiTWRlS.exe
  C:\Windows\System\iiTWRlS.exe
  2⤵
  PID:6912
- C:\Windows\System\lNFrfwP.exe
  C:\Windows\System\lNFrfwP.exe
  2⤵
  PID:7780
- C:\Windows\System\ittHMfP.exe
  C:\Windows\System\ittHMfP.exe
  2⤵
  PID:9428
- C:\Windows\System\rThpHgS.exe
  C:\Windows\System\rThpHgS.exe
  2⤵
  PID:9528
- C:\Windows\System\UDfLhhv.exe
  C:\Windows\System\UDfLhhv.exe
  2⤵
  PID:9552
- C:\Windows\System\jklBxvV.exe
  C:\Windows\System\jklBxvV.exe
  2⤵
  PID:9620
- C:\Windows\System\ADzNZgp.exe
  C:\Windows\System\ADzNZgp.exe
  2⤵
  PID:7932
- C:\Windows\System\nLvQaaT.exe
  C:\Windows\System\nLvQaaT.exe
  2⤵
  PID:7960
- C:\Windows\System\GHVVtjB.exe
  C:\Windows\System\GHVVtjB.exe
  2⤵
  PID:8608
- C:\Windows\System\JiMtkLJ.exe
  C:\Windows\System\JiMtkLJ.exe
  2⤵
  PID:8004
- C:\Windows\System\RLeIHbm.exe
  C:\Windows\System\RLeIHbm.exe
  2⤵
  PID:8692
- C:\Windows\System\dmhlSRM.exe
  C:\Windows\System\dmhlSRM.exe
  2⤵
  PID:8076
- C:\Windows\System\KUwxIoh.exe
  C:\Windows\System\KUwxIoh.exe
  2⤵
  PID:9780
- C:\Windows\System\TgLMCGx.exe
  C:\Windows\System\TgLMCGx.exe
  2⤵
  PID:9820
- C:\Windows\System\XYvmMYq.exe
  C:\Windows\System\XYvmMYq.exe
  2⤵
  PID:9988
- C:\Windows\System\zbtWQCj.exe
  C:\Windows\System\zbtWQCj.exe
  2⤵
  PID:10032
- C:\Windows\System\wWFlPfG.exe
  C:\Windows\System\wWFlPfG.exe
  2⤵
  PID:8204
- C:\Windows\System\MZHLmKA.exe
  C:\Windows\System\MZHLmKA.exe
  2⤵
  PID:11284
- C:\Windows\System\clbeObP.exe
  C:\Windows\System\clbeObP.exe
  2⤵
  PID:11308
- C:\Windows\System\JMDLPEu.exe
  C:\Windows\System\JMDLPEu.exe
  2⤵
  PID:11328
- C:\Windows\System\FQmACtr.exe
  C:\Windows\System\FQmACtr.exe
  2⤵
  PID:11352
- C:\Windows\System\SzMyrTJ.exe
  C:\Windows\System\SzMyrTJ.exe
  2⤵
  PID:11372
- C:\Windows\System\UpZxwQy.exe
  C:\Windows\System\UpZxwQy.exe
  2⤵
  PID:11392
- C:\Windows\System\wyCxbIw.exe
  C:\Windows\System\wyCxbIw.exe
  2⤵
  PID:11412
- C:\Windows\System\VYfHWkH.exe
  C:\Windows\System\VYfHWkH.exe
  2⤵
  PID:11436
- C:\Windows\System\YIJbkBF.exe
  C:\Windows\System\YIJbkBF.exe
  2⤵
  PID:11460
- C:\Windows\System\vYnwtKb.exe
  C:\Windows\System\vYnwtKb.exe
  2⤵
  PID:11480
- C:\Windows\System\WcJjyZH.exe
  C:\Windows\System\WcJjyZH.exe
  2⤵
  PID:11500
- C:\Windows\System\eCfdMun.exe
  C:\Windows\System\eCfdMun.exe
  2⤵
  PID:11524
- C:\Windows\System\pIEacZI.exe
  C:\Windows\System\pIEacZI.exe
  2⤵
  PID:11544
- C:\Windows\System\pesErpK.exe
  C:\Windows\System\pesErpK.exe
  2⤵
  PID:11564
- C:\Windows\System\OdEWKTV.exe
  C:\Windows\System\OdEWKTV.exe
  2⤵
  PID:11584
- C:\Windows\System\AyuskQD.exe
  C:\Windows\System\AyuskQD.exe
  2⤵
  PID:11604
- C:\Windows\System\hbTPZAe.exe
  C:\Windows\System\hbTPZAe.exe
  2⤵
  PID:11624
- C:\Windows\System\xzetrAF.exe
  C:\Windows\System\xzetrAF.exe
  2⤵
  PID:11652
- C:\Windows\System\MDUzxRC.exe
  C:\Windows\System\MDUzxRC.exe
  2⤵
  PID:11668
- C:\Windows\System\iVBkzEd.exe
  C:\Windows\System\iVBkzEd.exe
  2⤵
  PID:11692
- C:\Windows\System\AOQtrct.exe
  C:\Windows\System\AOQtrct.exe
  2⤵
  PID:11712
- C:\Windows\System\bbGnYKl.exe
  C:\Windows\System\bbGnYKl.exe
  2⤵
  PID:11740
- C:\Windows\System\gHrlVJi.exe
  C:\Windows\System\gHrlVJi.exe
  2⤵
  PID:11760
- C:\Windows\System\eCFKkMF.exe
  C:\Windows\System\eCFKkMF.exe
  2⤵
  PID:11780
- C:\Windows\System\IKjSoGg.exe
  C:\Windows\System\IKjSoGg.exe
  2⤵
  PID:11796
- C:\Windows\System\tAvNtJb.exe
  C:\Windows\System\tAvNtJb.exe
  2⤵
  PID:11832
- C:\Windows\System\kNaViRC.exe
  C:\Windows\System\kNaViRC.exe
  2⤵
  PID:11880
- C:\Windows\System\tPsZUGV.exe
  C:\Windows\System\tPsZUGV.exe
  2⤵
  PID:11908
- C:\Windows\System\HwyeFRQ.exe
  C:\Windows\System\HwyeFRQ.exe
  2⤵
  PID:11928
- C:\Windows\System\SJXwPbH.exe
  C:\Windows\System\SJXwPbH.exe
  2⤵
  PID:11948
- C:\Windows\System\YzPzQTF.exe
  C:\Windows\System\YzPzQTF.exe
  2⤵
  PID:11968
- C:\Windows\System\RfNmotJ.exe
  C:\Windows\System\RfNmotJ.exe
  2⤵
  PID:11984
- C:\Windows\System\hxzGsCh.exe
  C:\Windows\System\hxzGsCh.exe
  2⤵
  PID:12008
- C:\Windows\System\iYznrGR.exe
  C:\Windows\System\iYznrGR.exe
  2⤵
  PID:12028
- C:\Windows\System\NTMKvTG.exe
  C:\Windows\System\NTMKvTG.exe
  2⤵
  PID:12048
- C:\Windows\System\emYHjTO.exe
  C:\Windows\System\emYHjTO.exe
  2⤵
  PID:12072
- C:\Windows\System\CuBHInK.exe
  C:\Windows\System\CuBHInK.exe
  2⤵
  PID:12092
- C:\Windows\System\oESijKB.exe
  C:\Windows\System\oESijKB.exe
  2⤵
  PID:12108
- C:\Windows\System\LEGFRwt.exe
  C:\Windows\System\LEGFRwt.exe
  2⤵
  PID:12132
- C:\Windows\System\mIbduFZ.exe
  C:\Windows\System\mIbduFZ.exe
  2⤵
  PID:12148
- C:\Windows\System\JSQUTYa.exe
  C:\Windows\System\JSQUTYa.exe
  2⤵
  PID:12176
- C:\Windows\System\yhONATn.exe
  C:\Windows\System\yhONATn.exe
  2⤵
  PID:12192
- C:\Windows\System\qnaAWWx.exe
  C:\Windows\System\qnaAWWx.exe
  2⤵
  PID:12220
- C:\Windows\System\iahWIna.exe
  C:\Windows\System\iahWIna.exe
  2⤵
  PID:12236
- C:\Windows\System\JUaqaKL.exe
  C:\Windows\System\JUaqaKL.exe
  2⤵
  PID:12252
- C:\Windows\System\NzvMyDb.exe
  C:\Windows\System\NzvMyDb.exe
  2⤵
  PID:12276
- C:\Windows\System\uOyrkaQ.exe
  C:\Windows\System\uOyrkaQ.exe
  2⤵
  PID:8224
- C:\Windows\System\tmLPugo.exe
  C:\Windows\System\tmLPugo.exe
  2⤵
  PID:8244
- C:\Windows\System\IHHicuX.exe
  C:\Windows\System\IHHicuX.exe
  2⤵
  PID:5836
- C:\Windows\System\QTGHQfd.exe
  C:\Windows\System\QTGHQfd.exe
  2⤵
  PID:6008
- C:\Windows\System\PBTXBkl.exe
  C:\Windows\System\PBTXBkl.exe
  2⤵
  PID:8916
- C:\Windows\System\dDszuwR.exe
  C:\Windows\System\dDszuwR.exe
  2⤵
  PID:6120
- C:\Windows\System\cjhcYOe.exe
  C:\Windows\System\cjhcYOe.exe
  2⤵
  PID:9100
- C:\Windows\System\RkHXoZE.exe
  C:\Windows\System\RkHXoZE.exe
  2⤵
  PID:7360
- C:\Windows\System\RQdkcxW.exe
  C:\Windows\System\RQdkcxW.exe
  2⤵
  PID:9160
- C:\Windows\System\oLFrYZc.exe
  C:\Windows\System\oLFrYZc.exe
  2⤵
  PID:9172
- C:\Windows\System\JMTTibv.exe
  C:\Windows\System\JMTTibv.exe
  2⤵
  PID:10264
- C:\Windows\System\wDAfDXr.exe
  C:\Windows\System\wDAfDXr.exe
  2⤵
  PID:12304
- C:\Windows\System\riFGBSw.exe
  C:\Windows\System\riFGBSw.exe
  2⤵
  PID:12324
- C:\Windows\System\tLnOjNi.exe
  C:\Windows\System\tLnOjNi.exe
  2⤵
  PID:12348
- C:\Windows\System\fpzbbpI.exe
  C:\Windows\System\fpzbbpI.exe
  2⤵
  PID:12372
- C:\Windows\System\oICSbxR.exe
  C:\Windows\System\oICSbxR.exe
  2⤵
  PID:12400
- C:\Windows\System\WbksPQY.exe
  C:\Windows\System\WbksPQY.exe
  2⤵
  PID:12424
- C:\Windows\System\uCWLFqr.exe
  C:\Windows\System\uCWLFqr.exe
  2⤵
  PID:12448
- C:\Windows\System\GFiyxaQ.exe
  C:\Windows\System\GFiyxaQ.exe
  2⤵
  PID:12464
- C:\Windows\System\MSTWCVv.exe
  C:\Windows\System\MSTWCVv.exe
  2⤵
  PID:12492
- C:\Windows\System\EvTTDWh.exe
  C:\Windows\System\EvTTDWh.exe
  2⤵
  PID:12512
- C:\Windows\System\zcmhKJS.exe
  C:\Windows\System\zcmhKJS.exe
  2⤵
  PID:12548
- C:\Windows\System\YHqQBXU.exe
  C:\Windows\System\YHqQBXU.exe
  2⤵
  PID:12584
- C:\Windows\System\oNijlXp.exe
  C:\Windows\System\oNijlXp.exe
  2⤵
  PID:12600
- C:\Windows\System\GFXBFft.exe
  C:\Windows\System\GFXBFft.exe
  2⤵
  PID:12632
- C:\Windows\System\tSPFpJk.exe
  C:\Windows\System\tSPFpJk.exe
  2⤵
  PID:12648
- C:\Windows\System\wpTKlEU.exe
  C:\Windows\System\wpTKlEU.exe
  2⤵
  PID:12672
- C:\Windows\System\tAWceKL.exe
  C:\Windows\System\tAWceKL.exe
  2⤵
  PID:12688
- C:\Windows\System\PQrsfeO.exe
  C:\Windows\System\PQrsfeO.exe
  2⤵
  PID:12704
- C:\Windows\System\asVXZuJ.exe
  C:\Windows\System\asVXZuJ.exe
  2⤵
  PID:12724
- C:\Windows\System\gQwYtTx.exe
  C:\Windows\System\gQwYtTx.exe
  2⤵
  PID:12748
- C:\Windows\System\rFWZsOf.exe
  C:\Windows\System\rFWZsOf.exe
  2⤵
  PID:12780
- C:\Windows\System\pTNzjrC.exe
  C:\Windows\System\pTNzjrC.exe
  2⤵
  PID:12800
- C:\Windows\System\SXToCmp.exe
  C:\Windows\System\SXToCmp.exe
  2⤵
  PID:12820
- C:\Windows\System\sTjkYhw.exe
  C:\Windows\System\sTjkYhw.exe
  2⤵
  PID:12840
- C:\Windows\System\BJADhrK.exe
  C:\Windows\System\BJADhrK.exe
  2⤵
  PID:12860
- C:\Windows\System\etYLdOE.exe
  C:\Windows\System\etYLdOE.exe
  2⤵
  PID:12880
- C:\Windows\System\XbLoqeV.exe
  C:\Windows\System\XbLoqeV.exe
  2⤵
  PID:12904
- C:\Windows\System\NOIMrZX.exe
  C:\Windows\System\NOIMrZX.exe
  2⤵
  PID:12920
- C:\Windows\System\tqTaJpu.exe
  C:\Windows\System\tqTaJpu.exe
  2⤵
  PID:12944
- C:\Windows\System\kwAjnVR.exe
  C:\Windows\System\kwAjnVR.exe
  2⤵
  PID:12968
- C:\Windows\System\pxjRFyX.exe
  C:\Windows\System\pxjRFyX.exe
  2⤵
  PID:12984
- C:\Windows\System\WoFnGTK.exe
  C:\Windows\System\WoFnGTK.exe
  2⤵
  PID:13008
- C:\Windows\System\Itpstfx.exe
  C:\Windows\System\Itpstfx.exe
  2⤵
  PID:13024
- C:\Windows\System\eiLdCMm.exe
  C:\Windows\System\eiLdCMm.exe
  2⤵
  PID:13048
- C:\Windows\System\nHyNycW.exe
  C:\Windows\System\nHyNycW.exe
  2⤵
  PID:13072
- C:\Windows\System\pEkmscW.exe
  C:\Windows\System\pEkmscW.exe
  2⤵
  PID:13092
- C:\Windows\System\OKRQhiT.exe
  C:\Windows\System\OKRQhiT.exe
  2⤵
  PID:13116
- C:\Windows\System\QqXexgE.exe
  C:\Windows\System\QqXexgE.exe
  2⤵
  PID:13136
- C:\Windows\System\WUHDyLY.exe
  C:\Windows\System\WUHDyLY.exe
  2⤵
  PID:13152
- C:\Windows\System\zwQeRFQ.exe
  C:\Windows\System\zwQeRFQ.exe
  2⤵
  PID:13176
- C:\Windows\System\AsZlxwd.exe
  C:\Windows\System\AsZlxwd.exe
  2⤵
  PID:13196
- C:\Windows\System\DmSgads.exe
  C:\Windows\System\DmSgads.exe
  2⤵
  PID:13220
- C:\Windows\System\YJCpFKQ.exe
  C:\Windows\System\YJCpFKQ.exe
  2⤵
  PID:13240
- C:\Windows\System\kPIZfGu.exe
  C:\Windows\System\kPIZfGu.exe
  2⤵
  PID:13264
- C:\Windows\System\JtoJqYq.exe
  C:\Windows\System\JtoJqYq.exe
  2⤵
  PID:13280
- C:\Windows\System\whmcOMN.exe
  C:\Windows\System\whmcOMN.exe
  2⤵
  PID:13308
- C:\Windows\System\kGBgPvF.exe
  C:\Windows\System\kGBgPvF.exe
  2⤵
  PID:10304
- C:\Windows\System\srNhEtZ.exe
  C:\Windows\System\srNhEtZ.exe
  2⤵
  PID:5772
- C:\Windows\System\YXNxBFY.exe
  C:\Windows\System\YXNxBFY.exe
  2⤵
  PID:6652
- C:\Windows\System\WnMFPlx.exe
  C:\Windows\System\WnMFPlx.exe
  2⤵
  PID:9312
- C:\Windows\System\sUOrNwE.exe
  C:\Windows\System\sUOrNwE.exe
  2⤵
  PID:10516
- C:\Windows\System\tzQjutz.exe
  C:\Windows\System\tzQjutz.exe
  2⤵
  PID:10564
- C:\Windows\System\ajQjnGY.exe
  C:\Windows\System\ajQjnGY.exe
  2⤵
  PID:10652
- C:\Windows\System\pvcZudT.exe
  C:\Windows\System\pvcZudT.exe
  2⤵
  PID:10700
- C:\Windows\System\PoIoUAv.exe
  C:\Windows\System\PoIoUAv.exe
  2⤵
  PID:10760
- C:\Windows\System\gpjzhSY.exe
  C:\Windows\System\gpjzhSY.exe
  2⤵
  PID:10804
- C:\Windows\System\aMyuouB.exe
  C:\Windows\System\aMyuouB.exe
  2⤵
  PID:8648
- C:\Windows\System\aOotIpG.exe
  C:\Windows\System\aOotIpG.exe
  2⤵
  PID:9716
- C:\Windows\System\DzCsSeP.exe
  C:\Windows\System\DzCsSeP.exe
  2⤵
  PID:10988
- C:\Windows\System\JFNLEVF.exe
  C:\Windows\System\JFNLEVF.exe
  2⤵
  PID:11068
- C:\Windows\System\ScbPxnx.exe
  C:\Windows\System\ScbPxnx.exe
  2⤵
  PID:13692
- C:\Windows\System\wHtjzrq.exe
  C:\Windows\System\wHtjzrq.exe
  2⤵
  PID:13716
- C:\Windows\System\xXZtJew.exe
  C:\Windows\System\xXZtJew.exe
  2⤵
  PID:13732
- C:\Windows\System\tBPcQyH.exe
  C:\Windows\System\tBPcQyH.exe
  2⤵
  PID:13748
- C:\Windows\System\nkNHpHT.exe
  C:\Windows\System\nkNHpHT.exe
  2⤵
  PID:13768
- C:\Windows\System\hdbdfcx.exe
  C:\Windows\System\hdbdfcx.exe
  2⤵
  PID:13784
- C:\Windows\System\ArPqKuE.exe
  C:\Windows\System\ArPqKuE.exe
  2⤵
  PID:13800
- C:\Windows\System\qzbejVi.exe
  C:\Windows\System\qzbejVi.exe
  2⤵
  PID:12340
- C:\Windows\System\JqlnKDx.exe
  C:\Windows\System\JqlnKDx.exe
  2⤵
  PID:12736
- C:\Windows\System\FEVwXSG.exe
  C:\Windows\System\FEVwXSG.exe
  2⤵
  PID:10460
- C:\Windows\System\mhnfZAg.exe
  C:\Windows\System\mhnfZAg.exe
  2⤵
  PID:10624
- C:\Windows\System\lzguGSh.exe
  C:\Windows\System\lzguGSh.exe
  2⤵
  PID:10732
- C:\Windows\System\JhrtkTt.exe
  C:\Windows\System\JhrtkTt.exe
  2⤵
  PID:10864
- C:\Windows\System\zWQtISh.exe
  C:\Windows\System\zWQtISh.exe
  2⤵
  PID:10948
- C:\Windows\System\SoumwMn.exe
  C:\Windows\System\SoumwMn.exe
  2⤵
  PID:11032
- C:\Windows\System\KEXxuFb.exe
  C:\Windows\System\KEXxuFb.exe
  2⤵
  PID:11136
- C:\Windows\System\hIQCofg.exe
  C:\Windows\System\hIQCofg.exe
  2⤵
  PID:11220
- C:\Windows\System\TKkxFkb.exe
  C:\Windows\System\TKkxFkb.exe
  2⤵
  PID:7704
- C:\Windows\System\gczfrsw.exe
  C:\Windows\System\gczfrsw.exe
  2⤵
  PID:6680
- C:\Windows\System\MsBRpel.exe
  C:\Windows\System\MsBRpel.exe
  2⤵
  PID:13436
- C:\Windows\System\qPfPfHo.exe
  C:\Windows\System\qPfPfHo.exe
  2⤵
  PID:9636
- C:\Windows\System\HybpLwv.exe
  C:\Windows\System\HybpLwv.exe
  2⤵
  PID:11364
- C:\Windows\System\SJKgcFv.exe
  C:\Windows\System\SJKgcFv.exe
  2⤵
  PID:13568
- C:\Windows\System\SdpQhPG.exe
  C:\Windows\System\SdpQhPG.exe
  2⤵
  PID:13576
- C:\Windows\System\SzfrNQo.exe
  C:\Windows\System\SzfrNQo.exe
  2⤵
  PID:13592
- C:\Windows\System\iqIerxA.exe
  C:\Windows\System\iqIerxA.exe
  2⤵
  PID:11612
- C:\Windows\System\OoYTjLC.exe
  C:\Windows\System\OoYTjLC.exe
  2⤵
  PID:11684
- C:\Windows\System\rCxUPsv.exe
  C:\Windows\System\rCxUPsv.exe
  2⤵
  PID:11804
- C:\Windows\System\XVGazYO.exe
  C:\Windows\System\XVGazYO.exe
  2⤵
  PID:11840
- C:\Windows\System\JtvIdrv.exe
  C:\Windows\System\JtvIdrv.exe
  2⤵
  PID:11856
- C:\Windows\System\gLvGxFB.exe
  C:\Windows\System\gLvGxFB.exe
  2⤵
  PID:12572
- C:\Windows\System\ulDxYWc.exe
  C:\Windows\System\ulDxYWc.exe
  2⤵
  PID:12644
- C:\Windows\System\ELEVRtt.exe
  C:\Windows\System\ELEVRtt.exe
  2⤵
  PID:12712
- C:\Windows\System\rXgPvLz.exe
  C:\Windows\System\rXgPvLz.exe
  2⤵
  PID:12792
- C:\Windows\System\LtzOkVp.exe
  C:\Windows\System\LtzOkVp.exe
  2⤵
  PID:13928
- C:\Windows\System\GRnpwwA.exe
  C:\Windows\System\GRnpwwA.exe
  2⤵
  PID:14280
- C:\Windows\System\GtwNbNO.exe
  C:\Windows\System\GtwNbNO.exe
  2⤵
  PID:14164
- C:\Windows\System\BxTXfdn.exe
  C:\Windows\System\BxTXfdn.exe
  2⤵
  PID:1504
- C:\Windows\System\WlyHrEt.exe
  C:\Windows\System\WlyHrEt.exe
  2⤵
  PID:60
- C:\Windows\System\bxuitIX.exe
  C:\Windows\System\bxuitIX.exe
  2⤵
  PID:7256
- C:\Windows\System\EfqPWnC.exe
  C:\Windows\System\EfqPWnC.exe
  2⤵
  PID:11636
- C:\Windows\System\HcyOTcg.exe
  C:\Windows\System\HcyOTcg.exe
  2⤵
  PID:12344
- C:\Windows\System\uloTkEW.exe
  C:\Windows\System\uloTkEW.exe
  2⤵
  PID:11388
- C:\Windows\System\WFEggpF.exe
  C:\Windows\System\WFEggpF.exe
  2⤵
  PID:7680
- C:\Windows\System\eWDWOIU.exe
  C:\Windows\System\eWDWOIU.exe
  2⤵
  PID:7872
- C:\Windows\System\TGXLUiT.exe
  C:\Windows\System\TGXLUiT.exe
  2⤵
  PID:7220
- C:\Windows\System\doQWoIq.exe
  C:\Windows\System\doQWoIq.exe
  2⤵
  PID:11428
- C:\Windows\System\paHWeAe.exe
  C:\Windows\System\paHWeAe.exe
  2⤵
  PID:11488
- C:\Windows\System\jQJcYFh.exe
  C:\Windows\System\jQJcYFh.exe
  2⤵
  PID:14224
- C:\Windows\System\rtAWmBF.exe
  C:\Windows\System\rtAWmBF.exe
  2⤵
  PID:10292
- C:\Windows\System\awTTfbU.exe
  C:\Windows\System\awTTfbU.exe
  2⤵
  PID:5912
- C:\Windows\System\dYarlGJ.exe
  C:\Windows\System\dYarlGJ.exe
  2⤵
  PID:3432
- C:\Windows\System\dbWuUoH.exe
  C:\Windows\System\dbWuUoH.exe
  2⤵
  PID:11204
- C:\Windows\System\VjoBPXj.exe
  C:\Windows\System\VjoBPXj.exe
  2⤵
  PID:10896
- C:\Windows\System\REVWNpe.exe
  C:\Windows\System\REVWNpe.exe
  2⤵
  PID:9736
- C:\Windows\System\czxFVmr.exe
  C:\Windows\System\czxFVmr.exe
  2⤵
  PID:11116
- C:\Windows\System\IKWHABd.exe
  C:\Windows\System\IKWHABd.exe
  2⤵
  PID:12036
- C:\Windows\System\WGhNQjM.exe
  C:\Windows\System\WGhNQjM.exe
  2⤵
  PID:14268
- C:\Windows\System\GivMdIR.exe
  C:\Windows\System\GivMdIR.exe
  2⤵
  PID:13248
- C:\Windows\System\gkfDeru.exe
  C:\Windows\System\gkfDeru.exe
  2⤵
  PID:11772
- C:\Windows\System\JOraxyJ.exe
  C:\Windows\System\JOraxyJ.exe
  2⤵
  PID:780
- C:\Windows\System\BINfSgs.exe
  C:\Windows\System\BINfSgs.exe
  2⤵
  PID:11956
- C:\Windows\System\PrwExOD.exe
  C:\Windows\System\PrwExOD.exe
  2⤵
  PID:13620
- C:\Windows\System\icDuXCY.exe
  C:\Windows\System\icDuXCY.exe
  2⤵
  PID:10924
- C:\Windows\System\AeuglNF.exe
  C:\Windows\System\AeuglNF.exe
  2⤵
  PID:12896
- C:\Windows\System\FrRNjnl.exe
  C:\Windows\System\FrRNjnl.exe
  2⤵
  PID:8864
- C:\Windows\System\fZWkhoL.exe
  C:\Windows\System\fZWkhoL.exe
  2⤵
  PID:8772
- C:\Windows\System\eqiDFKc.exe
  C:\Windows\System\eqiDFKc.exe
  2⤵
  PID:11492
- C:\Windows\System\TgZbrCH.exe
  C:\Windows\System\TgZbrCH.exe
  2⤵
  PID:13160
- C:\Windows\System\rNnXBZE.exe
  C:\Windows\System\rNnXBZE.exe
  2⤵
  PID:11092
- C:\Windows\System\dAwCamU.exe
  C:\Windows\System\dAwCamU.exe
  2⤵
  PID:10860
- C:\Windows\System\RLYytFZ.exe
  C:\Windows\System\RLYytFZ.exe
  2⤵
  PID:12828
- C:\Windows\System\OqIIvum.exe
  C:\Windows\System\OqIIvum.exe
  2⤵
  PID:12664
- C:\Windows\System\onHAWlG.exe
  C:\Windows\System\onHAWlG.exe
  2⤵
  PID:14092
- C:\Windows\System\ssxTRJa.exe
  C:\Windows\System\ssxTRJa.exe
  2⤵
  PID:11748
- C:\Windows\System\CzorQuo.exe
  C:\Windows\System\CzorQuo.exe
  2⤵
  PID:11664
- C:\Windows\System\lEUdpzx.exe
  C:\Windows\System\lEUdpzx.exe
  2⤵
  PID:13700
- C:\Windows\System\mxrKFIP.exe
  C:\Windows\System\mxrKFIP.exe
  2⤵
  PID:6572
- C:\Windows\System\NhcUEwf.exe
  C:\Windows\System\NhcUEwf.exe
  2⤵
  PID:9924
- C:\Windows\System\YxlBrRJ.exe
  C:\Windows\System\YxlBrRJ.exe
  2⤵
  PID:11180

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 8096 -ip 8096
1⤵
PID:11748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ocz3h3qy.avz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\IZLMLeq.exe

Filesize
192KB

MD5
3c72dbc23a6622fc0ba13a655fe73cb7

SHA1
6400c6610e252688e509f655c0c1742cd3e76fe5

SHA256
60d46b68e2dec4dd54b3b98e2936c740b0a81687ef7e61fcba1931ad2151177b

SHA512
3a7f13d7a9e5345a11dd9caea7215ff9ce8b932aed2a7f40bd5687fae6e2d3d8e292fd0a0419fc98b97394994c5924266d8190f3af6015bdcdaf26d71a97a6cc

Download Submit
C:\Windows\System\JcaUxrF.exe

Filesize
1.2MB

MD5
449320e84b7c24b80e1d1a1a2804526b

SHA1
2b1abb7081c202feb78768560eab052016e6e0f1

SHA256
94d50c525ba394d9d14bcd6ffa2d094e389b6f496200dd389f2981d5a6a8ab14

SHA512
21bd599866926e95cd162ba15aeebde5f3dac7505cf5a4e398aafa0ffd315bfff0ed5cd471a0f73f1714c0eb858b1294261af9a02a9787b40932ef766b1f393a

Download Submit
C:\Windows\System\JcaUxrF.exe

Filesize
448KB

MD5
2264ad6cf2c3feda241e32c18cc63613

SHA1
6cf1d5079287ae747430510102276a5d8553f195

SHA256
aab1acd918f567ff34b418fd2971ffb7ad7f9284ea4d62c517c015f2e4f1d70f

SHA512
51d3f07b3e2d80ac627998a5fc071e41f8cd34e52e9d27ee547393019213fb2b53ce77d281d07d4df20e449416034194d3a784391c6fc788a552c1cba010098f

Download Submit
C:\Windows\System\WpxCtsF.exe

Filesize
832KB

MD5
5a44f7cdb1383926341c50c0b001559c

SHA1
072604877b2958c577c586d14139d39f012c00dc

SHA256
b75baa9dc61a064a9b06da3e5924cf08262f544320736d419b68b7e009465f5a

SHA512
30a6a06711e9a2cdc19340bf113bead6e9cba8ddda330cd10bd1e6eff2082327b1e5ffa8ccbfcf381b643fb74eb238f08dbcab8fcd9bf4de72412df3047a6c30

Download Submit
C:\Windows\System\nhAlOsW.exe

Filesize
8B

MD5
438c415b84fb7ccafacc0a09f9db21bf

SHA1
0ba291a82409b85280b72cddaa9a85efe1969946

SHA256
812617365870397d66346db9fc004e4a257242df5d09daa94af1b52721a02313

SHA512
a9403a83564f7907c4d75484a8b1a884211042f12bc9fb2ecf8f22f3cf830d9c62c0ef5603b990f366d0e7e69b7ae21ca24191731027b79845e0db0cf1e961ec

Download Submit
C:\Windows\System\pCqcibl.exe

Filesize
128KB

MD5
4faadaeab68805f04a3264b24b4484e7

SHA1
1506c8fa28d842c0dbf87aa4fae07f0c1d21c224

SHA256
023ac7fc351f6d2e4691b22c68fbc17c1895254a67982bf0958242ced6e67f29

SHA512
933034705851d18a168ec6a4a2f7a5330c92a605b28011dc44e331b0baa53be92639772e268a3dcd0b9551cd627b9185e234399894d0a898c1ae6ffdbb38edec

Download Submit
memory/436-3293-0x00007FF69BDD0000-0x00007FF69C1C2000-memory.dmp

Filesize
3.9MB

Download
memory/436-785-0x00007FF69BDD0000-0x00007FF69C1C2000-memory.dmp

Filesize
3.9MB

Download
memory/876-3265-0x00007FF7204D0000-0x00007FF7208C2000-memory.dmp

Filesize
3.9MB

Download
memory/876-460-0x00007FF7204D0000-0x00007FF7208C2000-memory.dmp

Filesize
3.9MB

Download
memory/1012-3269-0x00007FF6A2DE0000-0x00007FF6A31D2000-memory.dmp

Filesize
3.9MB

Download
memory/1012-869-0x00007FF6A2DE0000-0x00007FF6A31D2000-memory.dmp

Filesize
3.9MB

Download
memory/1672-348-0x00007FF7D7780000-0x00007FF7D7B72000-memory.dmp

Filesize
3.9MB

Download
memory/1672-3263-0x00007FF7D7780000-0x00007FF7D7B72000-memory.dmp

Filesize
3.9MB

Download
memory/1692-3261-0x00007FF76D830000-0x00007FF76DC22000-memory.dmp

Filesize
3.9MB

Download
memory/1692-309-0x00007FF76D830000-0x00007FF76DC22000-memory.dmp

Filesize
3.9MB

Download
memory/1964-3275-0x00007FF6C6C30000-0x00007FF6C7022000-memory.dmp

Filesize
3.9MB

Download
memory/1964-510-0x00007FF6C6C30000-0x00007FF6C7022000-memory.dmp

Filesize
3.9MB

Download
memory/2032-3273-0x00007FF66A500000-0x00007FF66A8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-511-0x00007FF66A500000-0x00007FF66A8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2228-3290-0x00007FF6CF230000-0x00007FF6CF622000-memory.dmp

Filesize
3.9MB

Download
memory/2228-512-0x00007FF6CF230000-0x00007FF6CF622000-memory.dmp

Filesize
3.9MB

Download
memory/2324-3284-0x00007FF7C23F0000-0x00007FF7C27E2000-memory.dmp

Filesize
3.9MB

Download
memory/2324-509-0x00007FF7C23F0000-0x00007FF7C27E2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-513-0x00007FF70F410000-0x00007FF70F802000-memory.dmp

Filesize
3.9MB

Download
memory/2336-3282-0x00007FF70F410000-0x00007FF70F802000-memory.dmp

Filesize
3.9MB

Download
memory/2820-1111-0x00007FF76DC10000-0x00007FF76E002000-memory.dmp

Filesize
3.9MB

Download
memory/2820-3286-0x00007FF76DC10000-0x00007FF76E002000-memory.dmp

Filesize
3.9MB

Download
memory/2908-3254-0x00007FF619150000-0x00007FF619542000-memory.dmp

Filesize
3.9MB

Download
memory/2908-237-0x00007FF619150000-0x00007FF619542000-memory.dmp

Filesize
3.9MB

Download
memory/3056-3277-0x00007FF6B6880000-0x00007FF6B6C72000-memory.dmp

Filesize
3.9MB

Download
memory/3056-507-0x00007FF6B6880000-0x00007FF6B6C72000-memory.dmp

Filesize
3.9MB

Download
memory/3196-506-0x00007FF68E550000-0x00007FF68E942000-memory.dmp

Filesize
3.9MB

Download
memory/3196-3271-0x00007FF68E550000-0x00007FF68E942000-memory.dmp

Filesize
3.9MB

Download
memory/3208-3257-0x00007FF6074F0000-0x00007FF6078E2000-memory.dmp

Filesize
3.9MB

Download
memory/3208-405-0x00007FF6074F0000-0x00007FF6078E2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-3255-0x00007FF603860000-0x00007FF603C52000-memory.dmp

Filesize
3.9MB

Download
memory/4348-255-0x00007FF603860000-0x00007FF603C52000-memory.dmp

Filesize
3.9MB

Download
memory/4616-505-0x00007FF755030000-0x00007FF755422000-memory.dmp

Filesize
3.9MB

Download
memory/4616-3279-0x00007FF755030000-0x00007FF755422000-memory.dmp

Filesize
3.9MB

Download
memory/4704-0-0x00007FF7B21F0000-0x00007FF7B25E2000-memory.dmp

Filesize
3.9MB

Download
memory/4704-1-0x000002543EB10000-0x000002543EB20000-memory.dmp

Filesize
64KB

Download
memory/4772-3259-0x00007FF7A8530000-0x00007FF7A8922000-memory.dmp

Filesize
3.9MB

Download
memory/4772-278-0x00007FF7A8530000-0x00007FF7A8922000-memory.dmp

Filesize
3.9MB

Download
memory/4804-3299-0x00007FF711AC0000-0x00007FF711EB2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-1114-0x00007FF711AC0000-0x00007FF711EB2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-508-0x00007FF761D50000-0x00007FF762142000-memory.dmp

Filesize
3.9MB

Download
memory/5064-3267-0x00007FF761D50000-0x00007FF762142000-memory.dmp

Filesize
3.9MB

Download
memory/5104-211-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

Filesize
10.8MB

Download
memory/5104-70-0x0000017572270000-0x0000017572292000-memory.dmp

Filesize
136KB

Download
memory/5104-87-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

Filesize
10.8MB

Download
memory/5104-7-0x00007FFFC7ED3000-0x00007FFFC7ED5000-memory.dmp

Filesize
8KB

Download