xmrig | 60402931ebbf00f7bb849b6489d3b964d3c388569f853f7b6b11b34dbbb7f27e

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4305e4da58b4a27ebb12ce7a2c1413c0.exe
Size

1.8MB
MD5

4305e4da58b4a27ebb12ce7a2c1413c0
SHA1

893aad41217a00815cc532a8d3b3993e5ed350ef
SHA256

60402931ebbf00f7bb849b6489d3b964d3c388569f853f7b6b11b34dbbb7f27e
SHA512

033b28409674f0505dbe94811173ac099fd1a9fc1e1cfd6a8402310a6c126e69a4cbe9736c284c476a8bee9c514c44e530e93169f72511e5649931fdc1f42c12
SSDEEP

49152:Lz071uv4BPMkyW10/w16BvZX71Fq86zpK:NABI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3152-296-0x00007FF721E30000-0x00007FF722222000-memory.dmp	xmrig
behavioral2/memory/224-344-0x00007FF7A84C0000-0x00007FF7A88B2000-memory.dmp	xmrig
behavioral2/memory/1116-371-0x00007FF7EACD0000-0x00007FF7EB0C2000-memory.dmp	xmrig
behavioral2/memory/1144-380-0x00007FF788B40000-0x00007FF788F32000-memory.dmp	xmrig
behavioral2/memory/3944-379-0x00007FF7B85F0000-0x00007FF7B89E2000-memory.dmp	xmrig
behavioral2/memory/452-378-0x00007FF725A80000-0x00007FF725E72000-memory.dmp	xmrig
behavioral2/memory/3776-377-0x00007FF60FAC0000-0x00007FF60FEB2000-memory.dmp	xmrig
behavioral2/memory/4728-375-0x00007FF79EB70000-0x00007FF79EF62000-memory.dmp	xmrig
behavioral2/memory/2420-374-0x00007FF6BFE70000-0x00007FF6C0262000-memory.dmp	xmrig
behavioral2/memory/1956-373-0x00007FF7D3B90000-0x00007FF7D3F82000-memory.dmp	xmrig
behavioral2/memory/4780-372-0x00007FF6B32D0000-0x00007FF6B36C2000-memory.dmp	xmrig
behavioral2/memory/8-370-0x00007FF68D120000-0x00007FF68D512000-memory.dmp	xmrig
behavioral2/memory/1848-369-0x00007FF7A1000000-0x00007FF7A13F2000-memory.dmp	xmrig
behavioral2/memory/3872-368-0x00007FF6F8240000-0x00007FF6F8632000-memory.dmp	xmrig
behavioral2/memory/208-367-0x00007FF736590000-0x00007FF736982000-memory.dmp	xmrig
behavioral2/memory/1012-295-0x00007FF7D8090000-0x00007FF7D8482000-memory.dmp	xmrig
behavioral2/memory/5012-270-0x00007FF764A50000-0x00007FF764E42000-memory.dmp	xmrig
behavioral2/memory/1488-229-0x00007FF7AA580000-0x00007FF7AA972000-memory.dmp	xmrig
behavioral2/memory/3228-200-0x00007FF607BB0000-0x00007FF607FA2000-memory.dmp	xmrig
behavioral2/memory/532-199-0x00007FF766940000-0x00007FF766D32000-memory.dmp	xmrig
behavioral2/memory/3440-154-0x00007FF684710000-0x00007FF684B02000-memory.dmp	xmrig
behavioral2/memory/912-103-0x00007FF651390000-0x00007FF651782000-memory.dmp	xmrig
behavioral2/memory/972-62-0x00007FF676890000-0x00007FF676C82000-memory.dmp	xmrig
behavioral2/memory/4100-14-0x00007FF6AC6C0000-0x00007FF6ACAB2000-memory.dmp	xmrig
behavioral2/memory/4100-4194-0x00007FF6AC6C0000-0x00007FF6ACAB2000-memory.dmp	xmrig
behavioral2/memory/4728-4196-0x00007FF79EB70000-0x00007FF79EF62000-memory.dmp	xmrig
behavioral2/memory/3440-4199-0x00007FF684710000-0x00007FF684B02000-memory.dmp	xmrig
behavioral2/memory/3776-4200-0x00007FF60FAC0000-0x00007FF60FEB2000-memory.dmp	xmrig
behavioral2/memory/972-4203-0x00007FF676890000-0x00007FF676C82000-memory.dmp	xmrig
behavioral2/memory/532-4204-0x00007FF766940000-0x00007FF766D32000-memory.dmp	xmrig
behavioral2/memory/912-4206-0x00007FF651390000-0x00007FF651782000-memory.dmp	xmrig
behavioral2/memory/1488-4211-0x00007FF7AA580000-0x00007FF7AA972000-memory.dmp	xmrig
behavioral2/memory/3228-4214-0x00007FF607BB0000-0x00007FF607FA2000-memory.dmp	xmrig
behavioral2/memory/3872-4216-0x00007FF6F8240000-0x00007FF6F8632000-memory.dmp	xmrig
behavioral2/memory/1012-4220-0x00007FF7D8090000-0x00007FF7D8482000-memory.dmp	xmrig
behavioral2/memory/3944-4219-0x00007FF7B85F0000-0x00007FF7B89E2000-memory.dmp	xmrig
behavioral2/memory/224-4222-0x00007FF7A84C0000-0x00007FF7A88B2000-memory.dmp	xmrig
behavioral2/memory/208-4224-0x00007FF736590000-0x00007FF736982000-memory.dmp	xmrig
behavioral2/memory/452-4213-0x00007FF725A80000-0x00007FF725E72000-memory.dmp	xmrig
behavioral2/memory/5012-4209-0x00007FF764A50000-0x00007FF764E42000-memory.dmp	xmrig
behavioral2/memory/1144-4250-0x00007FF788B40000-0x00007FF788F32000-memory.dmp	xmrig
behavioral2/memory/4780-4241-0x00007FF6B32D0000-0x00007FF6B36C2000-memory.dmp	xmrig
behavioral2/memory/1848-4249-0x00007FF7A1000000-0x00007FF7A13F2000-memory.dmp	xmrig
behavioral2/memory/8-4244-0x00007FF68D120000-0x00007FF68D512000-memory.dmp	xmrig
behavioral2/memory/2420-4243-0x00007FF6BFE70000-0x00007FF6C0262000-memory.dmp	xmrig
behavioral2/memory/3152-4236-0x00007FF721E30000-0x00007FF722222000-memory.dmp	xmrig
behavioral2/memory/1956-4233-0x00007FF7D3B90000-0x00007FF7D3F82000-memory.dmp	xmrig
behavioral2/memory/1116-4231-0x00007FF7EACD0000-0x00007FF7EB0C2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3592	powershell.exe
5	3592	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3592	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4100	bZeJMNb.exe
4728	zexuxNH.exe
3776	bPmXtyS.exe
972	ukWYPAi.exe
912	eJPDVmD.exe
3440	oTEDrKC.exe
532	sAcNWEO.exe
3228	fpwOSkj.exe
1488	jteThyW.exe
452	UlDBjXu.exe
5012	SAatuDN.exe
1012	FGBPDeH.exe
3152	cJGBroQ.exe
224	KpsobmF.exe
3944	EWxdeDd.exe
208	UAWsEBL.exe
3872	EOQRItz.exe
1848	EJsrDBh.exe
1144	iiXAHWi.exe
8	kwdqUiy.exe
1116	IKxmCqM.exe
4780	GJWWKmg.exe
1956	tJBfWtV.exe
2420	UiRKhuw.exe
2320	AXovFeb.exe
1796	CkjNRpZ.exe
2152	fbeyBdG.exe
4484	ZufguMJ.exe
4564	ykxIBzQ.exe
1760	wTkJjec.exe
1756	abhNtDl.exe
3512	GiJGkSX.exe
4052	niNHqsT.exe
2064	ULwIHkw.exe
2968	kcbiBPc.exe
2944	WinjsTx.exe
3820	EpHHTgn.exe
3552	UnvZqLj.exe
3768	chFPiQB.exe
2008	VqRKvvC.exe
2988	tsBJEim.exe
1980	ZubyJud.exe
3296	FEgGZqh.exe
4200	vrGdqNh.exe
184	WSgUdTI.exe
4952	UTqAVvt.exe
1480	cnvPTkH.exe
4036	Tmtevap.exe
1964	vlIJqzY.exe
2384	RlbngmQ.exe
4748	VQqqegG.exe
1896	wmeztdH.exe
2476	qXTwBMA.exe
2788	sVWcfcr.exe
4864	CPPvFAy.exe
2824	xHKkTQq.exe
4592	ZhADNKg.exe
4700	kKuxhfr.exe
4344	DorLnUD.exe
4348	QIihUWt.exe
3728	FFKmaNh.exe
4664	YkQEsPu.exe
3060	cDeAkHa.exe
4548	LhsDfyG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1204-0-0x00007FF69EE50000-0x00007FF69F242000-memory.dmp	upx
behavioral2/files/0x000700000002325a-5.dat	upx
behavioral2/files/0x000800000002343f-13.dat	upx
behavioral2/files/0x0007000000023440-18.dat	upx
behavioral2/files/0x0007000000023441-26.dat	upx
behavioral2/files/0x0007000000023442-41.dat	upx
behavioral2/files/0x000700000002344a-132.dat	upx
behavioral2/memory/3152-296-0x00007FF721E30000-0x00007FF722222000-memory.dmp	upx
behavioral2/memory/224-344-0x00007FF7A84C0000-0x00007FF7A88B2000-memory.dmp	upx
behavioral2/memory/1116-371-0x00007FF7EACD0000-0x00007FF7EB0C2000-memory.dmp	upx
behavioral2/memory/1144-380-0x00007FF788B40000-0x00007FF788F32000-memory.dmp	upx
behavioral2/memory/3944-379-0x00007FF7B85F0000-0x00007FF7B89E2000-memory.dmp	upx
behavioral2/memory/452-378-0x00007FF725A80000-0x00007FF725E72000-memory.dmp	upx
behavioral2/memory/3776-377-0x00007FF60FAC0000-0x00007FF60FEB2000-memory.dmp	upx
behavioral2/memory/4728-375-0x00007FF79EB70000-0x00007FF79EF62000-memory.dmp	upx
behavioral2/memory/2420-374-0x00007FF6BFE70000-0x00007FF6C0262000-memory.dmp	upx
behavioral2/memory/1956-373-0x00007FF7D3B90000-0x00007FF7D3F82000-memory.dmp	upx
behavioral2/memory/4780-372-0x00007FF6B32D0000-0x00007FF6B36C2000-memory.dmp	upx
behavioral2/memory/8-370-0x00007FF68D120000-0x00007FF68D512000-memory.dmp	upx
behavioral2/memory/1848-369-0x00007FF7A1000000-0x00007FF7A13F2000-memory.dmp	upx
behavioral2/memory/3872-368-0x00007FF6F8240000-0x00007FF6F8632000-memory.dmp	upx
behavioral2/memory/208-367-0x00007FF736590000-0x00007FF736982000-memory.dmp	upx
behavioral2/memory/1012-295-0x00007FF7D8090000-0x00007FF7D8482000-memory.dmp	upx
behavioral2/memory/5012-270-0x00007FF764A50000-0x00007FF764E42000-memory.dmp	upx
behavioral2/memory/1488-229-0x00007FF7AA580000-0x00007FF7AA972000-memory.dmp	upx
behavioral2/files/0x000700000002345c-203.dat	upx
behavioral2/memory/3228-200-0x00007FF607BB0000-0x00007FF607FA2000-memory.dmp	upx
behavioral2/memory/532-199-0x00007FF766940000-0x00007FF766D32000-memory.dmp	upx
behavioral2/files/0x0007000000023465-198.dat	upx
behavioral2/files/0x0007000000023464-197.dat	upx
behavioral2/files/0x0007000000023463-196.dat	upx
behavioral2/files/0x0007000000023462-195.dat	upx
behavioral2/files/0x0007000000023458-190.dat	upx
behavioral2/files/0x0007000000023461-188.dat	upx
behavioral2/files/0x0007000000023457-186.dat	upx
behavioral2/files/0x0007000000023460-185.dat	upx
behavioral2/files/0x000700000002345e-181.dat	upx
behavioral2/files/0x000700000002345d-173.dat	upx
behavioral2/files/0x000700000002344f-167.dat	upx
behavioral2/files/0x0008000000023453-166.dat	upx
behavioral2/files/0x000700000002345b-165.dat	upx
behavioral2/files/0x0007000000023450-157.dat	upx
behavioral2/files/0x000700000002345a-156.dat	upx
behavioral2/memory/3440-154-0x00007FF684710000-0x00007FF684B02000-memory.dmp	upx
behavioral2/files/0x0007000000023459-149.dat	upx
behavioral2/files/0x000700000002344d-141.dat	upx
behavioral2/files/0x000700000002345f-182.dat	upx
behavioral2/files/0x0007000000023456-134.dat	upx
behavioral2/files/0x0007000000023455-133.dat	upx
behavioral2/files/0x0007000000023454-130.dat	upx
behavioral2/files/0x0007000000023451-177.dat	upx
behavioral2/files/0x000700000002344e-118.dat	upx
behavioral2/memory/912-103-0x00007FF651390000-0x00007FF651782000-memory.dmp	upx
behavioral2/files/0x000700000002344c-97.dat	upx
behavioral2/files/0x0007000000023448-80.dat	upx
behavioral2/files/0x000700000002344b-106.dat	upx
behavioral2/files/0x0007000000023447-69.dat	upx
behavioral2/files/0x0007000000023445-66.dat	upx
behavioral2/files/0x0007000000023449-73.dat	upx
behavioral2/memory/972-62-0x00007FF676890000-0x00007FF676C82000-memory.dmp	upx
behavioral2/files/0x0007000000023446-55.dat	upx
behavioral2/files/0x0007000000023444-45.dat	upx
behavioral2/files/0x0007000000023443-30.dat	upx
behavioral2/memory/4100-14-0x00007FF6AC6C0000-0x00007FF6ACAB2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uZYcJxI.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\jaaYapQ.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\FgsVBCL.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\NaUPinw.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\fpGPVtV.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\NqycPxp.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\LFZIEAW.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\mYuPvPd.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\tCHGyFX.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\hqwBBfa.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\jteThyW.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\yInkShC.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\trvKtFV.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\VQupycN.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\xFkZuZH.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\vXXCIEa.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\dbZbMCD.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\PoFqcDO.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\OfhXmUQ.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\nzTPkcm.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\IMqgFRK.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\ldQfQNW.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\EpaeIzU.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\fjDZHJE.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\baRvQOq.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\IzSpWPR.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\cxzHqNI.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\lfrqMor.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\pzWIQsl.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\CeVkoGy.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\IHaWCXz.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\GTsDFtw.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\NIMenLR.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\KJXxxQO.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\NZizQDP.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\WEWVrLO.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\KyfjwpS.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\drJiCSz.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\iixsWvP.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\rfJYRcA.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\ltHBBzs.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\UHWDwxC.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\KXnmoiG.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\AvbxhYC.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\EFELwLX.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\BLIdVue.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\TUWHbRt.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\eHGEjZQ.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\ijdvahE.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\LWWQkZu.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\OlRZWTA.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\yYTOIJt.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\DeUrupy.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\ZqjKfuA.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\JoJvvIX.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\loGafnG.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\NvcAxgk.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\spBGRGT.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\MQmrUan.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\juWmInA.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\kaQjDMv.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\RxsFXFZ.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\EfqVEeK.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\iBwMGjP.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe
Token: SeLockMemoryPrivilege	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe
Token: SeDebugPrivilege	3592	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 3592	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	83
PID 1204 wrote to memory of 3592	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	83
PID 1204 wrote to memory of 4100	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	84
PID 1204 wrote to memory of 4100	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	84
PID 1204 wrote to memory of 4728	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	85
PID 1204 wrote to memory of 4728	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	85
PID 1204 wrote to memory of 3776	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	86
PID 1204 wrote to memory of 3776	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	86
PID 1204 wrote to memory of 972	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	87
PID 1204 wrote to memory of 972	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	87
PID 1204 wrote to memory of 912	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	88
PID 1204 wrote to memory of 912	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	88
PID 1204 wrote to memory of 3440	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	89
PID 1204 wrote to memory of 3440	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	89
PID 1204 wrote to memory of 532	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	90
PID 1204 wrote to memory of 532	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	90
PID 1204 wrote to memory of 3228	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	91
PID 1204 wrote to memory of 3228	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	91
PID 1204 wrote to memory of 1488	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	92
PID 1204 wrote to memory of 1488	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	92
PID 1204 wrote to memory of 452	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	93
PID 1204 wrote to memory of 452	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	93
PID 1204 wrote to memory of 5012	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	94
PID 1204 wrote to memory of 5012	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	94
PID 1204 wrote to memory of 1012	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	95
PID 1204 wrote to memory of 1012	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	95
PID 1204 wrote to memory of 3152	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	96
PID 1204 wrote to memory of 3152	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	96
PID 1204 wrote to memory of 224	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	97
PID 1204 wrote to memory of 224	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	97
PID 1204 wrote to memory of 3944	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	98
PID 1204 wrote to memory of 3944	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	98
PID 1204 wrote to memory of 208	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	99
PID 1204 wrote to memory of 208	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	99
PID 1204 wrote to memory of 3872	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	100
PID 1204 wrote to memory of 3872	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	100
PID 1204 wrote to memory of 1848	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	101
PID 1204 wrote to memory of 1848	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	101
PID 1204 wrote to memory of 1144	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	102
PID 1204 wrote to memory of 1144	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	102
PID 1204 wrote to memory of 8	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	103
PID 1204 wrote to memory of 8	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	103
PID 1204 wrote to memory of 1116	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	104
PID 1204 wrote to memory of 1116	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	104
PID 1204 wrote to memory of 4780	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	105
PID 1204 wrote to memory of 4780	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	105
PID 1204 wrote to memory of 1956	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	106
PID 1204 wrote to memory of 1956	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	106
PID 1204 wrote to memory of 2420	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	107
PID 1204 wrote to memory of 2420	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	107
PID 1204 wrote to memory of 2320	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	108
PID 1204 wrote to memory of 2320	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	108
PID 1204 wrote to memory of 1796	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	109
PID 1204 wrote to memory of 1796	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	109
PID 1204 wrote to memory of 2152	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	110
PID 1204 wrote to memory of 2152	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	110
PID 1204 wrote to memory of 4484	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	111
PID 1204 wrote to memory of 4484	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	111
PID 1204 wrote to memory of 4564	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	112
PID 1204 wrote to memory of 4564	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	112
PID 1204 wrote to memory of 1760	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	113
PID 1204 wrote to memory of 1760	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	113
PID 1204 wrote to memory of 1756	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	114
PID 1204 wrote to memory of 1756	1204	4305e4da58b4a27ebb12ce7a2c1413c0.exe	114

C:\Users\Admin\AppData\Local\Temp\4305e4da58b4a27ebb12ce7a2c1413c0.exe
"C:\Users\Admin\AppData\Local\Temp\4305e4da58b4a27ebb12ce7a2c1413c0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3592
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3592" "2984" "2920" "2988" "0" "0" "2992" "0" "0" "0" "0" "0"
    3⤵
    PID:10680
- C:\Windows\System\bZeJMNb.exe
  C:\Windows\System\bZeJMNb.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\zexuxNH.exe
  C:\Windows\System\zexuxNH.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\bPmXtyS.exe
  C:\Windows\System\bPmXtyS.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\ukWYPAi.exe
  C:\Windows\System\ukWYPAi.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\eJPDVmD.exe
  C:\Windows\System\eJPDVmD.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\oTEDrKC.exe
  C:\Windows\System\oTEDrKC.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\sAcNWEO.exe
  C:\Windows\System\sAcNWEO.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\fpwOSkj.exe
  C:\Windows\System\fpwOSkj.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\jteThyW.exe
  C:\Windows\System\jteThyW.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\UlDBjXu.exe
  C:\Windows\System\UlDBjXu.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\SAatuDN.exe
  C:\Windows\System\SAatuDN.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\FGBPDeH.exe
  C:\Windows\System\FGBPDeH.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\cJGBroQ.exe
  C:\Windows\System\cJGBroQ.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\KpsobmF.exe
  C:\Windows\System\KpsobmF.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\EWxdeDd.exe
  C:\Windows\System\EWxdeDd.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\UAWsEBL.exe
  C:\Windows\System\UAWsEBL.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\EOQRItz.exe
  C:\Windows\System\EOQRItz.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\EJsrDBh.exe
  C:\Windows\System\EJsrDBh.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\iiXAHWi.exe
  C:\Windows\System\iiXAHWi.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\kwdqUiy.exe
  C:\Windows\System\kwdqUiy.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\IKxmCqM.exe
  C:\Windows\System\IKxmCqM.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\GJWWKmg.exe
  C:\Windows\System\GJWWKmg.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\tJBfWtV.exe
  C:\Windows\System\tJBfWtV.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\UiRKhuw.exe
  C:\Windows\System\UiRKhuw.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\AXovFeb.exe
  C:\Windows\System\AXovFeb.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\CkjNRpZ.exe
  C:\Windows\System\CkjNRpZ.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\fbeyBdG.exe
  C:\Windows\System\fbeyBdG.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\ZufguMJ.exe
  C:\Windows\System\ZufguMJ.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\ykxIBzQ.exe
  C:\Windows\System\ykxIBzQ.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\wTkJjec.exe
  C:\Windows\System\wTkJjec.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\abhNtDl.exe
  C:\Windows\System\abhNtDl.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\GiJGkSX.exe
  C:\Windows\System\GiJGkSX.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\niNHqsT.exe
  C:\Windows\System\niNHqsT.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\ULwIHkw.exe
  C:\Windows\System\ULwIHkw.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\kcbiBPc.exe
  C:\Windows\System\kcbiBPc.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\Tmtevap.exe
  C:\Windows\System\Tmtevap.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\WinjsTx.exe
  C:\Windows\System\WinjsTx.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\EpHHTgn.exe
  C:\Windows\System\EpHHTgn.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\UnvZqLj.exe
  C:\Windows\System\UnvZqLj.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\chFPiQB.exe
  C:\Windows\System\chFPiQB.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\VqRKvvC.exe
  C:\Windows\System\VqRKvvC.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\tsBJEim.exe
  C:\Windows\System\tsBJEim.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\ZubyJud.exe
  C:\Windows\System\ZubyJud.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\FEgGZqh.exe
  C:\Windows\System\FEgGZqh.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\vrGdqNh.exe
  C:\Windows\System\vrGdqNh.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\WSgUdTI.exe
  C:\Windows\System\WSgUdTI.exe
  2⤵
  - Executes dropped EXE
  PID:184
- C:\Windows\System\UTqAVvt.exe
  C:\Windows\System\UTqAVvt.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\cnvPTkH.exe
  C:\Windows\System\cnvPTkH.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\vlIJqzY.exe
  C:\Windows\System\vlIJqzY.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\RlbngmQ.exe
  C:\Windows\System\RlbngmQ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\VQqqegG.exe
  C:\Windows\System\VQqqegG.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\wmeztdH.exe
  C:\Windows\System\wmeztdH.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\qXTwBMA.exe
  C:\Windows\System\qXTwBMA.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\sVWcfcr.exe
  C:\Windows\System\sVWcfcr.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\CPPvFAy.exe
  C:\Windows\System\CPPvFAy.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\xHKkTQq.exe
  C:\Windows\System\xHKkTQq.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ZhADNKg.exe
  C:\Windows\System\ZhADNKg.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\kKuxhfr.exe
  C:\Windows\System\kKuxhfr.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\DorLnUD.exe
  C:\Windows\System\DorLnUD.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\QIihUWt.exe
  C:\Windows\System\QIihUWt.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\FFKmaNh.exe
  C:\Windows\System\FFKmaNh.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\YkQEsPu.exe
  C:\Windows\System\YkQEsPu.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\cDeAkHa.exe
  C:\Windows\System\cDeAkHa.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\LhsDfyG.exe
  C:\Windows\System\LhsDfyG.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\dkXveTG.exe
  C:\Windows\System\dkXveTG.exe
  2⤵
  PID:3116
- C:\Windows\System\WYtIUHl.exe
  C:\Windows\System\WYtIUHl.exe
  2⤵
  PID:3380
- C:\Windows\System\OlHCzqk.exe
  C:\Windows\System\OlHCzqk.exe
  2⤵
  PID:2132
- C:\Windows\System\NfrSfxj.exe
  C:\Windows\System\NfrSfxj.exe
  2⤵
  PID:1864
- C:\Windows\System\LYZXwaZ.exe
  C:\Windows\System\LYZXwaZ.exe
  2⤵
  PID:1076
- C:\Windows\System\uItgJbL.exe
  C:\Windows\System\uItgJbL.exe
  2⤵
  PID:3680
- C:\Windows\System\kHzrvuL.exe
  C:\Windows\System\kHzrvuL.exe
  2⤵
  PID:4928
- C:\Windows\System\jcfKYef.exe
  C:\Windows\System\jcfKYef.exe
  2⤵
  PID:4412
- C:\Windows\System\dJfYUjN.exe
  C:\Windows\System\dJfYUjN.exe
  2⤵
  PID:4252
- C:\Windows\System\VVqGPxu.exe
  C:\Windows\System\VVqGPxu.exe
  2⤵
  PID:3632
- C:\Windows\System\ZEBWVyK.exe
  C:\Windows\System\ZEBWVyK.exe
  2⤵
  PID:772
- C:\Windows\System\hyoPHVF.exe
  C:\Windows\System\hyoPHVF.exe
  2⤵
  PID:1656
- C:\Windows\System\DRRKqqs.exe
  C:\Windows\System\DRRKqqs.exe
  2⤵
  PID:5092
- C:\Windows\System\jOgMipe.exe
  C:\Windows\System\jOgMipe.exe
  2⤵
  PID:3180
- C:\Windows\System\ioDAjFA.exe
  C:\Windows\System\ioDAjFA.exe
  2⤵
  PID:4248
- C:\Windows\System\VQkodsf.exe
  C:\Windows\System\VQkodsf.exe
  2⤵
  PID:3612
- C:\Windows\System\koUxwVN.exe
  C:\Windows\System\koUxwVN.exe
  2⤵
  PID:3748
- C:\Windows\System\tdnPZTM.exe
  C:\Windows\System\tdnPZTM.exe
  2⤵
  PID:2340
- C:\Windows\System\aoRnlsn.exe
  C:\Windows\System\aoRnlsn.exe
  2⤵
  PID:3956
- C:\Windows\System\fMqBZHk.exe
  C:\Windows\System\fMqBZHk.exe
  2⤵
  PID:644
- C:\Windows\System\amlzDFF.exe
  C:\Windows\System\amlzDFF.exe
  2⤵
  PID:3256
- C:\Windows\System\RRKympt.exe
  C:\Windows\System\RRKympt.exe
  2⤵
  PID:552
- C:\Windows\System\MoUyiZe.exe
  C:\Windows\System\MoUyiZe.exe
  2⤵
  PID:1840
- C:\Windows\System\rsCbmgb.exe
  C:\Windows\System\rsCbmgb.exe
  2⤵
  PID:4892
- C:\Windows\System\IwhcQRn.exe
  C:\Windows\System\IwhcQRn.exe
  2⤵
  PID:5136
- C:\Windows\System\ynHJccy.exe
  C:\Windows\System\ynHJccy.exe
  2⤵
  PID:5172
- C:\Windows\System\ZSxiEmw.exe
  C:\Windows\System\ZSxiEmw.exe
  2⤵
  PID:5192
- C:\Windows\System\ERZlhCI.exe
  C:\Windows\System\ERZlhCI.exe
  2⤵
  PID:5208
- C:\Windows\System\DlvzbpP.exe
  C:\Windows\System\DlvzbpP.exe
  2⤵
  PID:5236
- C:\Windows\System\HhkleXl.exe
  C:\Windows\System\HhkleXl.exe
  2⤵
  PID:5264
- C:\Windows\System\SoWIwfY.exe
  C:\Windows\System\SoWIwfY.exe
  2⤵
  PID:5284
- C:\Windows\System\pzSTDci.exe
  C:\Windows\System\pzSTDci.exe
  2⤵
  PID:5300
- C:\Windows\System\vxCFHHb.exe
  C:\Windows\System\vxCFHHb.exe
  2⤵
  PID:5316
- C:\Windows\System\eGggqsB.exe
  C:\Windows\System\eGggqsB.exe
  2⤵
  PID:5332
- C:\Windows\System\mfFSSRA.exe
  C:\Windows\System\mfFSSRA.exe
  2⤵
  PID:5348
- C:\Windows\System\HJasGtj.exe
  C:\Windows\System\HJasGtj.exe
  2⤵
  PID:5368
- C:\Windows\System\PATDsrs.exe
  C:\Windows\System\PATDsrs.exe
  2⤵
  PID:5388
- C:\Windows\System\MKccIHu.exe
  C:\Windows\System\MKccIHu.exe
  2⤵
  PID:5408
- C:\Windows\System\IXUxzkD.exe
  C:\Windows\System\IXUxzkD.exe
  2⤵
  PID:5436
- C:\Windows\System\umJsjMW.exe
  C:\Windows\System\umJsjMW.exe
  2⤵
  PID:5456
- C:\Windows\System\GYMdbDY.exe
  C:\Windows\System\GYMdbDY.exe
  2⤵
  PID:5480
- C:\Windows\System\yAnpUoh.exe
  C:\Windows\System\yAnpUoh.exe
  2⤵
  PID:5504
- C:\Windows\System\oJgbixG.exe
  C:\Windows\System\oJgbixG.exe
  2⤵
  PID:5528
- C:\Windows\System\xlYFqIz.exe
  C:\Windows\System\xlYFqIz.exe
  2⤵
  PID:5548
- C:\Windows\System\gYyPwRf.exe
  C:\Windows\System\gYyPwRf.exe
  2⤵
  PID:5624
- C:\Windows\System\mKGeAZE.exe
  C:\Windows\System\mKGeAZE.exe
  2⤵
  PID:5828
- C:\Windows\System\bpXQQqF.exe
  C:\Windows\System\bpXQQqF.exe
  2⤵
  PID:6132
- C:\Windows\System\VSMiiMT.exe
  C:\Windows\System\VSMiiMT.exe
  2⤵
  PID:4056
- C:\Windows\System\zzYydIf.exe
  C:\Windows\System\zzYydIf.exe
  2⤵
  PID:2212
- C:\Windows\System\pKeRpqw.exe
  C:\Windows\System\pKeRpqw.exe
  2⤵
  PID:3688
- C:\Windows\System\HzQXwUd.exe
  C:\Windows\System\HzQXwUd.exe
  2⤵
  PID:2624
- C:\Windows\System\sKjXUjx.exe
  C:\Windows\System\sKjXUjx.exe
  2⤵
  PID:4504
- C:\Windows\System\UySsPbq.exe
  C:\Windows\System\UySsPbq.exe
  2⤵
  PID:1624
- C:\Windows\System\pSSdFkY.exe
  C:\Windows\System\pSSdFkY.exe
  2⤵
  PID:4968
- C:\Windows\System\wrcMxgS.exe
  C:\Windows\System\wrcMxgS.exe
  2⤵
  PID:4500
- C:\Windows\System\xFVTOcX.exe
  C:\Windows\System\xFVTOcX.exe
  2⤵
  PID:880
- C:\Windows\System\wfDnQRb.exe
  C:\Windows\System\wfDnQRb.exe
  2⤵
  PID:3492
- C:\Windows\System\cIJcBuL.exe
  C:\Windows\System\cIJcBuL.exe
  2⤵
  PID:4760
- C:\Windows\System\xORPAMl.exe
  C:\Windows\System\xORPAMl.exe
  2⤵
  PID:4284
- C:\Windows\System\qOiYzEi.exe
  C:\Windows\System\qOiYzEi.exe
  2⤵
  PID:3724
- C:\Windows\System\QwVujyv.exe
  C:\Windows\System\QwVujyv.exe
  2⤵
  PID:5416
- C:\Windows\System\uElLbXq.exe
  C:\Windows\System\uElLbXq.exe
  2⤵
  PID:1904
- C:\Windows\System\pnvfpkZ.exe
  C:\Windows\System\pnvfpkZ.exe
  2⤵
  PID:5384
- C:\Windows\System\WUYPEIU.exe
  C:\Windows\System\WUYPEIU.exe
  2⤵
  PID:5568
- C:\Windows\System\ZUDNYsz.exe
  C:\Windows\System\ZUDNYsz.exe
  2⤵
  PID:5432
- C:\Windows\System\GxNNNpA.exe
  C:\Windows\System\GxNNNpA.exe
  2⤵
  PID:4004
- C:\Windows\System\iltozWn.exe
  C:\Windows\System\iltozWn.exe
  2⤵
  PID:6160
- C:\Windows\System\aOvFpph.exe
  C:\Windows\System\aOvFpph.exe
  2⤵
  PID:6180
- C:\Windows\System\MFkGVCI.exe
  C:\Windows\System\MFkGVCI.exe
  2⤵
  PID:6200
- C:\Windows\System\SyFDITC.exe
  C:\Windows\System\SyFDITC.exe
  2⤵
  PID:6216
- C:\Windows\System\gtOusyd.exe
  C:\Windows\System\gtOusyd.exe
  2⤵
  PID:6356
- C:\Windows\System\EKblZkW.exe
  C:\Windows\System\EKblZkW.exe
  2⤵
  PID:6380
- C:\Windows\System\VSYOhiK.exe
  C:\Windows\System\VSYOhiK.exe
  2⤵
  PID:6400
- C:\Windows\System\OwnGcjV.exe
  C:\Windows\System\OwnGcjV.exe
  2⤵
  PID:6424
- C:\Windows\System\UStDTiv.exe
  C:\Windows\System\UStDTiv.exe
  2⤵
  PID:6440
- C:\Windows\System\siGJkbt.exe
  C:\Windows\System\siGJkbt.exe
  2⤵
  PID:6584
- C:\Windows\System\rHVawYI.exe
  C:\Windows\System\rHVawYI.exe
  2⤵
  PID:6604
- C:\Windows\System\iQHopuF.exe
  C:\Windows\System\iQHopuF.exe
  2⤵
  PID:6628
- C:\Windows\System\LmMxsNi.exe
  C:\Windows\System\LmMxsNi.exe
  2⤵
  PID:6648
- C:\Windows\System\fWEDlPG.exe
  C:\Windows\System\fWEDlPG.exe
  2⤵
  PID:6668
- C:\Windows\System\mbnXtvx.exe
  C:\Windows\System\mbnXtvx.exe
  2⤵
  PID:6692
- C:\Windows\System\fqzyxei.exe
  C:\Windows\System\fqzyxei.exe
  2⤵
  PID:6716
- C:\Windows\System\WMwRKGo.exe
  C:\Windows\System\WMwRKGo.exe
  2⤵
  PID:6748
- C:\Windows\System\UoTFeaj.exe
  C:\Windows\System\UoTFeaj.exe
  2⤵
  PID:6780
- C:\Windows\System\AHirGQe.exe
  C:\Windows\System\AHirGQe.exe
  2⤵
  PID:6876
- C:\Windows\System\YWJETuw.exe
  C:\Windows\System\YWJETuw.exe
  2⤵
  PID:6900
- C:\Windows\System\Cmvdrod.exe
  C:\Windows\System\Cmvdrod.exe
  2⤵
  PID:6916
- C:\Windows\System\RTOsJWm.exe
  C:\Windows\System\RTOsJWm.exe
  2⤵
  PID:6956
- C:\Windows\System\DgmHkDw.exe
  C:\Windows\System\DgmHkDw.exe
  2⤵
  PID:6976
- C:\Windows\System\PURneTG.exe
  C:\Windows\System\PURneTG.exe
  2⤵
  PID:7000
- C:\Windows\System\TrNBiyi.exe
  C:\Windows\System\TrNBiyi.exe
  2⤵
  PID:7020
- C:\Windows\System\tlvLEWI.exe
  C:\Windows\System\tlvLEWI.exe
  2⤵
  PID:7040
- C:\Windows\System\gVXdsjD.exe
  C:\Windows\System\gVXdsjD.exe
  2⤵
  PID:7068
- C:\Windows\System\FHwygvA.exe
  C:\Windows\System\FHwygvA.exe
  2⤵
  PID:5936
- C:\Windows\System\lBaEkhx.exe
  C:\Windows\System\lBaEkhx.exe
  2⤵
  PID:5952
- C:\Windows\System\EBAHlic.exe
  C:\Windows\System\EBAHlic.exe
  2⤵
  PID:5976
- C:\Windows\System\kAHEQdZ.exe
  C:\Windows\System\kAHEQdZ.exe
  2⤵
  PID:6000
- C:\Windows\System\cUZHrxx.exe
  C:\Windows\System\cUZHrxx.exe
  2⤵
  PID:6020
- C:\Windows\System\IogGKbZ.exe
  C:\Windows\System\IogGKbZ.exe
  2⤵
  PID:6040
- C:\Windows\System\yAmPRGW.exe
  C:\Windows\System\yAmPRGW.exe
  2⤵
  PID:5148
- C:\Windows\System\ZZxNnjC.exe
  C:\Windows\System\ZZxNnjC.exe
  2⤵
  PID:3576
- C:\Windows\System\OEkPdnO.exe
  C:\Windows\System\OEkPdnO.exe
  2⤵
  PID:5180
- C:\Windows\System\fQJHdfB.exe
  C:\Windows\System\fQJHdfB.exe
  2⤵
  PID:2544
- C:\Windows\System\BpWlWwX.exe
  C:\Windows\System\BpWlWwX.exe
  2⤵
  PID:2136
- C:\Windows\System\hDjqgyE.exe
  C:\Windows\System\hDjqgyE.exe
  2⤵
  PID:2292
- C:\Windows\System\QmHRnKo.exe
  C:\Windows\System\QmHRnKo.exe
  2⤵
  PID:5124
- C:\Windows\System\kufOJMK.exe
  C:\Windows\System\kufOJMK.exe
  2⤵
  PID:1312
- C:\Windows\System\DrQueRB.exe
  C:\Windows\System\DrQueRB.exe
  2⤵
  PID:6148
- C:\Windows\System\SLCFqyQ.exe
  C:\Windows\System\SLCFqyQ.exe
  2⤵
  PID:5488
- C:\Windows\System\YGzZcZV.exe
  C:\Windows\System\YGzZcZV.exe
  2⤵
  PID:5380
- C:\Windows\System\CfhNkkz.exe
  C:\Windows\System\CfhNkkz.exe
  2⤵
  PID:6224
- C:\Windows\System\jbjRLnG.exe
  C:\Windows\System\jbjRLnG.exe
  2⤵
  PID:5420
- C:\Windows\System\bWztUQY.exe
  C:\Windows\System\bWztUQY.exe
  2⤵
  PID:6416
- C:\Windows\System\ltHBBzs.exe
  C:\Windows\System\ltHBBzs.exe
  2⤵
  PID:6464
- C:\Windows\System\RLFqAoP.exe
  C:\Windows\System\RLFqAoP.exe
  2⤵
  PID:6528
- C:\Windows\System\yGEPjEW.exe
  C:\Windows\System\yGEPjEW.exe
  2⤵
  PID:6552
- C:\Windows\System\qLCrQSP.exe
  C:\Windows\System\qLCrQSP.exe
  2⤵
  PID:6580
- C:\Windows\System\VSxrIaQ.exe
  C:\Windows\System\VSxrIaQ.exe
  2⤵
  PID:6644
- C:\Windows\System\WcJhqNE.exe
  C:\Windows\System\WcJhqNE.exe
  2⤵
  PID:6688
- C:\Windows\System\GRJeBkw.exe
  C:\Windows\System\GRJeBkw.exe
  2⤵
  PID:6728
- C:\Windows\System\ueFAQhL.exe
  C:\Windows\System\ueFAQhL.exe
  2⤵
  PID:3496
- C:\Windows\System\hoGebiD.exe
  C:\Windows\System\hoGebiD.exe
  2⤵
  PID:6908
- C:\Windows\System\QVgOGoq.exe
  C:\Windows\System\QVgOGoq.exe
  2⤵
  PID:6968
- C:\Windows\System\SgiVwHa.exe
  C:\Windows\System\SgiVwHa.exe
  2⤵
  PID:7016
- C:\Windows\System\MslWnew.exe
  C:\Windows\System\MslWnew.exe
  2⤵
  PID:7056
- C:\Windows\System\jQfymqY.exe
  C:\Windows\System\jQfymqY.exe
  2⤵
  PID:7100
- C:\Windows\System\ZMzXjzP.exe
  C:\Windows\System\ZMzXjzP.exe
  2⤵
  PID:3124
- C:\Windows\System\eJlnDjn.exe
  C:\Windows\System\eJlnDjn.exe
  2⤵
  PID:2908
- C:\Windows\System\cTIVgbt.exe
  C:\Windows\System\cTIVgbt.exe
  2⤵
  PID:5888
- C:\Windows\System\mvgZmQG.exe
  C:\Windows\System\mvgZmQG.exe
  2⤵
  PID:5920
- C:\Windows\System\jIxBWSx.exe
  C:\Windows\System\jIxBWSx.exe
  2⤵
  PID:5964
- C:\Windows\System\KRjMbXx.exe
  C:\Windows\System\KRjMbXx.exe
  2⤵
  PID:6008
- C:\Windows\System\mQFARXm.exe
  C:\Windows\System\mQFARXm.exe
  2⤵
  PID:6052
- C:\Windows\System\asRKrwT.exe
  C:\Windows\System\asRKrwT.exe
  2⤵
  PID:2024
- C:\Windows\System\eQxqWQK.exe
  C:\Windows\System\eQxqWQK.exe
  2⤵
  PID:5724
- C:\Windows\System\BSRjIat.exe
  C:\Windows\System\BSRjIat.exe
  2⤵
  PID:5796
- C:\Windows\System\PXMlyHx.exe
  C:\Windows\System\PXMlyHx.exe
  2⤵
  PID:3788
- C:\Windows\System\IRuhJtP.exe
  C:\Windows\System\IRuhJtP.exe
  2⤵
  PID:872
- C:\Windows\System\cmfOrtf.exe
  C:\Windows\System\cmfOrtf.exe
  2⤵
  PID:1408
- C:\Windows\System\FqXQFDn.exe
  C:\Windows\System\FqXQFDn.exe
  2⤵
  PID:60
- C:\Windows\System\Xvrdtbf.exe
  C:\Windows\System\Xvrdtbf.exe
  2⤵
  PID:3540
- C:\Windows\System\AnSSRRh.exe
  C:\Windows\System\AnSSRRh.exe
  2⤵
  PID:4992
- C:\Windows\System\bjNaWAY.exe
  C:\Windows\System\bjNaWAY.exe
  2⤵
  PID:764
- C:\Windows\System\uOiRgPi.exe
  C:\Windows\System\uOiRgPi.exe
  2⤵
  PID:5048
- C:\Windows\System\rxrGqTn.exe
  C:\Windows\System\rxrGqTn.exe
  2⤵
  PID:4888
- C:\Windows\System\SmMokEE.exe
  C:\Windows\System\SmMokEE.exe
  2⤵
  PID:4140
- C:\Windows\System\DpBSpwA.exe
  C:\Windows\System\DpBSpwA.exe
  2⤵
  PID:2404
- C:\Windows\System\gsIOEEp.exe
  C:\Windows\System\gsIOEEp.exe
  2⤵
  PID:5636
- C:\Windows\System\LTFGQQX.exe
  C:\Windows\System\LTFGQQX.exe
  2⤵
  PID:5632
- C:\Windows\System\ZPIGVtU.exe
  C:\Windows\System\ZPIGVtU.exe
  2⤵
  PID:5648
- C:\Windows\System\HNehQoC.exe
  C:\Windows\System\HNehQoC.exe
  2⤵
  PID:1544
- C:\Windows\System\RwbYbwN.exe
  C:\Windows\System\RwbYbwN.exe
  2⤵
  PID:2156
- C:\Windows\System\EpaeIzU.exe
  C:\Windows\System\EpaeIzU.exe
  2⤵
  PID:396
- C:\Windows\System\IkExSCB.exe
  C:\Windows\System\IkExSCB.exe
  2⤵
  PID:5540
- C:\Windows\System\nJnbmWH.exe
  C:\Windows\System\nJnbmWH.exe
  2⤵
  PID:6212
- C:\Windows\System\RNwqxNn.exe
  C:\Windows\System\RNwqxNn.exe
  2⤵
  PID:5544
- C:\Windows\System\fHwWbCm.exe
  C:\Windows\System\fHwWbCm.exe
  2⤵
  PID:6388
- C:\Windows\System\xxHsfAp.exe
  C:\Windows\System\xxHsfAp.exe
  2⤵
  PID:6724
- C:\Windows\System\iyCcMRn.exe
  C:\Windows\System\iyCcMRn.exe
  2⤵
  PID:6892
- C:\Windows\System\zVEyBle.exe
  C:\Windows\System\zVEyBle.exe
  2⤵
  PID:6572
- C:\Windows\System\pQPktBk.exe
  C:\Windows\System\pQPktBk.exe
  2⤵
  PID:7092
- C:\Windows\System\ajktGdl.exe
  C:\Windows\System\ajktGdl.exe
  2⤵
  PID:5880
- C:\Windows\System\jooJsxs.exe
  C:\Windows\System\jooJsxs.exe
  2⤵
  PID:6964
- C:\Windows\System\XYKIlly.exe
  C:\Windows\System\XYKIlly.exe
  2⤵
  PID:1056
- C:\Windows\System\bzNXcoI.exe
  C:\Windows\System\bzNXcoI.exe
  2⤵
  PID:7076
- C:\Windows\System\GqADCmb.exe
  C:\Windows\System\GqADCmb.exe
  2⤵
  PID:380
- C:\Windows\System\wxmqrsM.exe
  C:\Windows\System\wxmqrsM.exe
  2⤵
  PID:4980
- C:\Windows\System\AiABhFo.exe
  C:\Windows\System\AiABhFo.exe
  2⤵
  PID:1876
- C:\Windows\System\TSFwKWR.exe
  C:\Windows\System\TSFwKWR.exe
  2⤵
  PID:5764
- C:\Windows\System\ziRjlhj.exe
  C:\Windows\System\ziRjlhj.exe
  2⤵
  PID:5652
- C:\Windows\System\pCQlKMy.exe
  C:\Windows\System\pCQlKMy.exe
  2⤵
  PID:5872
- C:\Windows\System\PdTDIYC.exe
  C:\Windows\System\PdTDIYC.exe
  2⤵
  PID:5364
- C:\Windows\System\UgFumCh.exe
  C:\Windows\System\UgFumCh.exe
  2⤵
  PID:6796
- C:\Windows\System\ZScOtPQ.exe
  C:\Windows\System\ZScOtPQ.exe
  2⤵
  PID:3264
- C:\Windows\System\HwxroLG.exe
  C:\Windows\System\HwxroLG.exe
  2⤵
  PID:3388
- C:\Windows\System\SagHjjR.exe
  C:\Windows\System\SagHjjR.exe
  2⤵
  PID:7184
- C:\Windows\System\BUSQHxu.exe
  C:\Windows\System\BUSQHxu.exe
  2⤵
  PID:7208
- C:\Windows\System\SiGpXLA.exe
  C:\Windows\System\SiGpXLA.exe
  2⤵
  PID:7232
- C:\Windows\System\QyrVPQd.exe
  C:\Windows\System\QyrVPQd.exe
  2⤵
  PID:7252
- C:\Windows\System\jHZZsGE.exe
  C:\Windows\System\jHZZsGE.exe
  2⤵
  PID:7272
- C:\Windows\System\WFwOTZf.exe
  C:\Windows\System\WFwOTZf.exe
  2⤵
  PID:7300
- C:\Windows\System\PDsmQSR.exe
  C:\Windows\System\PDsmQSR.exe
  2⤵
  PID:7320
- C:\Windows\System\mFhgAZb.exe
  C:\Windows\System\mFhgAZb.exe
  2⤵
  PID:7344
- C:\Windows\System\kwXDecV.exe
  C:\Windows\System\kwXDecV.exe
  2⤵
  PID:7368
- C:\Windows\System\uJQyVUF.exe
  C:\Windows\System\uJQyVUF.exe
  2⤵
  PID:7392
- C:\Windows\System\LzcwNxy.exe
  C:\Windows\System\LzcwNxy.exe
  2⤵
  PID:7416
- C:\Windows\System\bDdLIBn.exe
  C:\Windows\System\bDdLIBn.exe
  2⤵
  PID:7444
- C:\Windows\System\FaFmogb.exe
  C:\Windows\System\FaFmogb.exe
  2⤵
  PID:7464
- C:\Windows\System\pTnQuLt.exe
  C:\Windows\System\pTnQuLt.exe
  2⤵
  PID:7664
- C:\Windows\System\jIortTU.exe
  C:\Windows\System\jIortTU.exe
  2⤵
  PID:7684
- C:\Windows\System\kxzMOsm.exe
  C:\Windows\System\kxzMOsm.exe
  2⤵
  PID:7708
- C:\Windows\System\OJIhgxA.exe
  C:\Windows\System\OJIhgxA.exe
  2⤵
  PID:7736
- C:\Windows\System\efEaUIF.exe
  C:\Windows\System\efEaUIF.exe
  2⤵
  PID:7768
- C:\Windows\System\rEAtxab.exe
  C:\Windows\System\rEAtxab.exe
  2⤵
  PID:7792
- C:\Windows\System\RQWBjuX.exe
  C:\Windows\System\RQWBjuX.exe
  2⤵
  PID:7848
- C:\Windows\System\hQqupfa.exe
  C:\Windows\System\hQqupfa.exe
  2⤵
  PID:7868
- C:\Windows\System\sBnRczL.exe
  C:\Windows\System\sBnRczL.exe
  2⤵
  PID:7892
- C:\Windows\System\jyhCfIe.exe
  C:\Windows\System\jyhCfIe.exe
  2⤵
  PID:7916
- C:\Windows\System\CWUHNIL.exe
  C:\Windows\System\CWUHNIL.exe
  2⤵
  PID:7940
- C:\Windows\System\jUcVesQ.exe
  C:\Windows\System\jUcVesQ.exe
  2⤵
  PID:7956
- C:\Windows\System\hPMlgeN.exe
  C:\Windows\System\hPMlgeN.exe
  2⤵
  PID:7976
- C:\Windows\System\Lornccq.exe
  C:\Windows\System\Lornccq.exe
  2⤵
  PID:7996
- C:\Windows\System\FRShiFb.exe
  C:\Windows\System\FRShiFb.exe
  2⤵
  PID:8020
- C:\Windows\System\leAMvZf.exe
  C:\Windows\System\leAMvZf.exe
  2⤵
  PID:8040
- C:\Windows\System\fOKUctu.exe
  C:\Windows\System\fOKUctu.exe
  2⤵
  PID:8060
- C:\Windows\System\oRJJWKD.exe
  C:\Windows\System\oRJJWKD.exe
  2⤵
  PID:8100
- C:\Windows\System\lxeBtNR.exe
  C:\Windows\System\lxeBtNR.exe
  2⤵
  PID:8120
- C:\Windows\System\loFjdek.exe
  C:\Windows\System\loFjdek.exe
  2⤵
  PID:8136
- C:\Windows\System\eoFmEda.exe
  C:\Windows\System\eoFmEda.exe
  2⤵
  PID:8160
- C:\Windows\System\BcIByjJ.exe
  C:\Windows\System\BcIByjJ.exe
  2⤵
  PID:8184
- C:\Windows\System\lNUGDWr.exe
  C:\Windows\System\lNUGDWr.exe
  2⤵
  PID:988
- C:\Windows\System\uBxATfw.exe
  C:\Windows\System\uBxATfw.exe
  2⤵
  PID:6996
- C:\Windows\System\SlSYYXw.exe
  C:\Windows\System\SlSYYXw.exe
  2⤵
  PID:1536
- C:\Windows\System\YAvinym.exe
  C:\Windows\System\YAvinym.exe
  2⤵
  PID:5492
- C:\Windows\System\esQLCjU.exe
  C:\Windows\System\esQLCjU.exe
  2⤵
  PID:3732
- C:\Windows\System\VcWXvnc.exe
  C:\Windows\System\VcWXvnc.exe
  2⤵
  PID:7312
- C:\Windows\System\ceijFFw.exe
  C:\Windows\System\ceijFFw.exe
  2⤵
  PID:3088
- C:\Windows\System\uhtKhGB.exe
  C:\Windows\System\uhtKhGB.exe
  2⤵
  PID:7412
- C:\Windows\System\miPRAXY.exe
  C:\Windows\System\miPRAXY.exe
  2⤵
  PID:7492
- C:\Windows\System\DhVmmxC.exe
  C:\Windows\System\DhVmmxC.exe
  2⤵
  PID:7192
- C:\Windows\System\yGTmRER.exe
  C:\Windows\System\yGTmRER.exe
  2⤵
  PID:7580
- C:\Windows\System\FbWXboP.exe
  C:\Windows\System\FbWXboP.exe
  2⤵
  PID:7388
- C:\Windows\System\WHletbz.exe
  C:\Windows\System\WHletbz.exe
  2⤵
  PID:7456
- C:\Windows\System\gIqAwTs.exe
  C:\Windows\System\gIqAwTs.exe
  2⤵
  PID:7776
- C:\Windows\System\wUaarrB.exe
  C:\Windows\System\wUaarrB.exe
  2⤵
  PID:7200
- C:\Windows\System\KVtixid.exe
  C:\Windows\System\KVtixid.exe
  2⤵
  PID:7248
- C:\Windows\System\zZurhrY.exe
  C:\Windows\System\zZurhrY.exe
  2⤵
  PID:7356
- C:\Windows\System\QLRhWuh.exe
  C:\Windows\System\QLRhWuh.exe
  2⤵
  PID:7408
- C:\Windows\System\ZXSMogt.exe
  C:\Windows\System\ZXSMogt.exe
  2⤵
  PID:7968
- C:\Windows\System\RQbQlbG.exe
  C:\Windows\System\RQbQlbG.exe
  2⤵
  PID:8108
- C:\Windows\System\IRadbHk.exe
  C:\Windows\System\IRadbHk.exe
  2⤵
  PID:8128
- C:\Windows\System\dZNrqtE.exe
  C:\Windows\System\dZNrqtE.exe
  2⤵
  PID:8196
- C:\Windows\System\sMrukMp.exe
  C:\Windows\System\sMrukMp.exe
  2⤵
  PID:8220
- C:\Windows\System\CkkJhnR.exe
  C:\Windows\System\CkkJhnR.exe
  2⤵
  PID:8240
- C:\Windows\System\OvarDra.exe
  C:\Windows\System\OvarDra.exe
  2⤵
  PID:8264
- C:\Windows\System\GAGpexQ.exe
  C:\Windows\System\GAGpexQ.exe
  2⤵
  PID:8292
- C:\Windows\System\PoFqcDO.exe
  C:\Windows\System\PoFqcDO.exe
  2⤵
  PID:8308
- C:\Windows\System\xqRLmnZ.exe
  C:\Windows\System\xqRLmnZ.exe
  2⤵
  PID:8336
- C:\Windows\System\OumqBRX.exe
  C:\Windows\System\OumqBRX.exe
  2⤵
  PID:8360
- C:\Windows\System\CnukSyL.exe
  C:\Windows\System\CnukSyL.exe
  2⤵
  PID:8384
- C:\Windows\System\ZDNxocP.exe
  C:\Windows\System\ZDNxocP.exe
  2⤵
  PID:8404
- C:\Windows\System\PFaYwUL.exe
  C:\Windows\System\PFaYwUL.exe
  2⤵
  PID:8424
- C:\Windows\System\UHWDwxC.exe
  C:\Windows\System\UHWDwxC.exe
  2⤵
  PID:8448
- C:\Windows\System\TvhoBXk.exe
  C:\Windows\System\TvhoBXk.exe
  2⤵
  PID:8472
- C:\Windows\System\JqgIQNw.exe
  C:\Windows\System\JqgIQNw.exe
  2⤵
  PID:8496
- C:\Windows\System\AIqPdIY.exe
  C:\Windows\System\AIqPdIY.exe
  2⤵
  PID:8520
- C:\Windows\System\YlOUODw.exe
  C:\Windows\System\YlOUODw.exe
  2⤵
  PID:8552
- C:\Windows\System\ypnUKMR.exe
  C:\Windows\System\ypnUKMR.exe
  2⤵
  PID:8584
- C:\Windows\System\WEtRCZZ.exe
  C:\Windows\System\WEtRCZZ.exe
  2⤵
  PID:8600
- C:\Windows\System\JcjQFQZ.exe
  C:\Windows\System\JcjQFQZ.exe
  2⤵
  PID:8620
- C:\Windows\System\kzQwwlI.exe
  C:\Windows\System\kzQwwlI.exe
  2⤵
  PID:8644
- C:\Windows\System\PYQpZYi.exe
  C:\Windows\System\PYQpZYi.exe
  2⤵
  PID:8664
- C:\Windows\System\qgfKnDR.exe
  C:\Windows\System\qgfKnDR.exe
  2⤵
  PID:8684
- C:\Windows\System\igwEOdh.exe
  C:\Windows\System\igwEOdh.exe
  2⤵
  PID:8712
- C:\Windows\System\VumPxra.exe
  C:\Windows\System\VumPxra.exe
  2⤵
  PID:8732
- C:\Windows\System\KrljdES.exe
  C:\Windows\System\KrljdES.exe
  2⤵
  PID:8756
- C:\Windows\System\eCfUUzD.exe
  C:\Windows\System\eCfUUzD.exe
  2⤵
  PID:8776
- C:\Windows\System\pOBEmdF.exe
  C:\Windows\System\pOBEmdF.exe
  2⤵
  PID:8796
- C:\Windows\System\HrRprTU.exe
  C:\Windows\System\HrRprTU.exe
  2⤵
  PID:8820
- C:\Windows\System\XUFUMBK.exe
  C:\Windows\System\XUFUMBK.exe
  2⤵
  PID:8840
- C:\Windows\System\XRvWNPN.exe
  C:\Windows\System\XRvWNPN.exe
  2⤵
  PID:8860
- C:\Windows\System\oscMTKu.exe
  C:\Windows\System\oscMTKu.exe
  2⤵
  PID:8884
- C:\Windows\System\WxqtIOT.exe
  C:\Windows\System\WxqtIOT.exe
  2⤵
  PID:8900
- C:\Windows\System\loVNWvu.exe
  C:\Windows\System\loVNWvu.exe
  2⤵
  PID:8924
- C:\Windows\System\xkILWEf.exe
  C:\Windows\System\xkILWEf.exe
  2⤵
  PID:8952
- C:\Windows\System\PFVkCaY.exe
  C:\Windows\System\PFVkCaY.exe
  2⤵
  PID:8968
- C:\Windows\System\SxLegkX.exe
  C:\Windows\System\SxLegkX.exe
  2⤵
  PID:8988
- C:\Windows\System\HGhBVZg.exe
  C:\Windows\System\HGhBVZg.exe
  2⤵
  PID:9016
- C:\Windows\System\laDxeII.exe
  C:\Windows\System\laDxeII.exe
  2⤵
  PID:9036
- C:\Windows\System\HjcpIOD.exe
  C:\Windows\System\HjcpIOD.exe
  2⤵
  PID:9060
- C:\Windows\System\WUqUQED.exe
  C:\Windows\System\WUqUQED.exe
  2⤵
  PID:9080
- C:\Windows\System\pUWvVan.exe
  C:\Windows\System\pUWvVan.exe
  2⤵
  PID:9100
- C:\Windows\System\MeooXSr.exe
  C:\Windows\System\MeooXSr.exe
  2⤵
  PID:9124
- C:\Windows\System\lwFdSmG.exe
  C:\Windows\System\lwFdSmG.exe
  2⤵
  PID:9148
- C:\Windows\System\jrhSwVv.exe
  C:\Windows\System\jrhSwVv.exe
  2⤵
  PID:9176
- C:\Windows\System\jxFEmxc.exe
  C:\Windows\System\jxFEmxc.exe
  2⤵
  PID:9200
- C:\Windows\System\LhRNPOc.exe
  C:\Windows\System\LhRNPOc.exe
  2⤵
  PID:4868
- C:\Windows\System\GBJrGpV.exe
  C:\Windows\System\GBJrGpV.exe
  2⤵
  PID:7172
- C:\Windows\System\weiNNAI.exe
  C:\Windows\System\weiNNAI.exe
  2⤵
  PID:2764
- C:\Windows\System\lCPpSRK.exe
  C:\Windows\System\lCPpSRK.exe
  2⤵
  PID:7864
- C:\Windows\System\XvGQLZr.exe
  C:\Windows\System\XvGQLZr.exe
  2⤵
  PID:7600
- C:\Windows\System\BVDKKFH.exe
  C:\Windows\System\BVDKKFH.exe
  2⤵
  PID:7936
- C:\Windows\System\jxwpaoY.exe
  C:\Windows\System\jxwpaoY.exe
  2⤵
  PID:7692
- C:\Windows\System\IyCTDoc.exe
  C:\Windows\System\IyCTDoc.exe
  2⤵
  PID:7724
- C:\Windows\System\VwDtmnv.exe
  C:\Windows\System\VwDtmnv.exe
  2⤵
  PID:7380
- C:\Windows\System\aeMvQmv.exe
  C:\Windows\System\aeMvQmv.exe
  2⤵
  PID:8212
- C:\Windows\System\oIlRaQE.exe
  C:\Windows\System\oIlRaQE.exe
  2⤵
  PID:8272
- C:\Windows\System\dVdqWKd.exe
  C:\Windows\System\dVdqWKd.exe
  2⤵
  PID:5064
- C:\Windows\System\hDCgifj.exe
  C:\Windows\System\hDCgifj.exe
  2⤵
  PID:8348
- C:\Windows\System\qscWCnY.exe
  C:\Windows\System\qscWCnY.exe
  2⤵
  PID:7240
- C:\Windows\System\DdaMkuT.exe
  C:\Windows\System\DdaMkuT.exe
  2⤵
  PID:7952
- C:\Windows\System\CLkIEhV.exe
  C:\Windows\System\CLkIEhV.exe
  2⤵
  PID:7804
- C:\Windows\System\lyhgLxe.exe
  C:\Windows\System\lyhgLxe.exe
  2⤵
  PID:8068
- C:\Windows\System\bCiqbxT.exe
  C:\Windows\System\bCiqbxT.exe
  2⤵
  PID:8640
- C:\Windows\System\LWiqORP.exe
  C:\Windows\System\LWiqORP.exe
  2⤵
  PID:8676
- C:\Windows\System\JyudeOs.exe
  C:\Windows\System\JyudeOs.exe
  2⤵
  PID:8748
- C:\Windows\System\nLwOuNR.exe
  C:\Windows\System\nLwOuNR.exe
  2⤵
  PID:8252
- C:\Windows\System\WMVSgCX.exe
  C:\Windows\System\WMVSgCX.exe
  2⤵
  PID:4820
- C:\Windows\System\vPutmXx.exe
  C:\Windows\System\vPutmXx.exe
  2⤵
  PID:8324
- C:\Windows\System\IOVVNZs.exe
  C:\Windows\System\IOVVNZs.exe
  2⤵
  PID:9240
- C:\Windows\System\zRTxaoa.exe
  C:\Windows\System\zRTxaoa.exe
  2⤵
  PID:9264
- C:\Windows\System\TTJObVX.exe
  C:\Windows\System\TTJObVX.exe
  2⤵
  PID:9284
- C:\Windows\System\cxWzShW.exe
  C:\Windows\System\cxWzShW.exe
  2⤵
  PID:9308
- C:\Windows\System\iCiMXCu.exe
  C:\Windows\System\iCiMXCu.exe
  2⤵
  PID:9328
- C:\Windows\System\VKDDBuw.exe
  C:\Windows\System\VKDDBuw.exe
  2⤵
  PID:9356
- C:\Windows\System\ZuUWQxO.exe
  C:\Windows\System\ZuUWQxO.exe
  2⤵
  PID:9384
- C:\Windows\System\tOHPEhc.exe
  C:\Windows\System\tOHPEhc.exe
  2⤵
  PID:9404
- C:\Windows\System\lEZgayF.exe
  C:\Windows\System\lEZgayF.exe
  2⤵
  PID:9424
- C:\Windows\System\KptMVMI.exe
  C:\Windows\System\KptMVMI.exe
  2⤵
  PID:9448
- C:\Windows\System\buggeFU.exe
  C:\Windows\System\buggeFU.exe
  2⤵
  PID:9472
- C:\Windows\System\VKRKpXr.exe
  C:\Windows\System\VKRKpXr.exe
  2⤵
  PID:9492
- C:\Windows\System\pborIVp.exe
  C:\Windows\System\pborIVp.exe
  2⤵
  PID:9508
- C:\Windows\System\offpAAS.exe
  C:\Windows\System\offpAAS.exe
  2⤵
  PID:9536
- C:\Windows\System\QyNUbgM.exe
  C:\Windows\System\QyNUbgM.exe
  2⤵
  PID:9560
- C:\Windows\System\sxUcGiE.exe
  C:\Windows\System\sxUcGiE.exe
  2⤵
  PID:9580
- C:\Windows\System\riDtfiy.exe
  C:\Windows\System\riDtfiy.exe
  2⤵
  PID:9604
- C:\Windows\System\MvgnPEF.exe
  C:\Windows\System\MvgnPEF.exe
  2⤵
  PID:9624
- C:\Windows\System\zNprGuf.exe
  C:\Windows\System\zNprGuf.exe
  2⤵
  PID:9648
- C:\Windows\System\lnFuItQ.exe
  C:\Windows\System\lnFuItQ.exe
  2⤵
  PID:9668
- C:\Windows\System\vGbYULL.exe
  C:\Windows\System\vGbYULL.exe
  2⤵
  PID:9692
- C:\Windows\System\BKmvxYi.exe
  C:\Windows\System\BKmvxYi.exe
  2⤵
  PID:9716
- C:\Windows\System\jrRVHEp.exe
  C:\Windows\System\jrRVHEp.exe
  2⤵
  PID:9736
- C:\Windows\System\FDWAyjR.exe
  C:\Windows\System\FDWAyjR.exe
  2⤵
  PID:9756
- C:\Windows\System\avsrYya.exe
  C:\Windows\System\avsrYya.exe
  2⤵
  PID:9776
- C:\Windows\System\XqFZpAV.exe
  C:\Windows\System\XqFZpAV.exe
  2⤵
  PID:9800
- C:\Windows\System\zWrTder.exe
  C:\Windows\System\zWrTder.exe
  2⤵
  PID:9824
- C:\Windows\System\PgXpEjY.exe
  C:\Windows\System\PgXpEjY.exe
  2⤵
  PID:9844
- C:\Windows\System\UPwVNRE.exe
  C:\Windows\System\UPwVNRE.exe
  2⤵
  PID:9872
- C:\Windows\System\TRDpFvj.exe
  C:\Windows\System\TRDpFvj.exe
  2⤵
  PID:9896
- C:\Windows\System\LoMZmVB.exe
  C:\Windows\System\LoMZmVB.exe
  2⤵
  PID:9916
- C:\Windows\System\AQSHcEm.exe
  C:\Windows\System\AQSHcEm.exe
  2⤵
  PID:9936
- C:\Windows\System\IHKLMjO.exe
  C:\Windows\System\IHKLMjO.exe
  2⤵
  PID:9964
- C:\Windows\System\LhiGrjC.exe
  C:\Windows\System\LhiGrjC.exe
  2⤵
  PID:9984
- C:\Windows\System\VaCSSrQ.exe
  C:\Windows\System\VaCSSrQ.exe
  2⤵
  PID:10004
- C:\Windows\System\BSydEhu.exe
  C:\Windows\System\BSydEhu.exe
  2⤵
  PID:10024
- C:\Windows\System\ZmxPTqU.exe
  C:\Windows\System\ZmxPTqU.exe
  2⤵
  PID:10048
- C:\Windows\System\IhGKGJK.exe
  C:\Windows\System\IhGKGJK.exe
  2⤵
  PID:10072
- C:\Windows\System\tXcZxpz.exe
  C:\Windows\System\tXcZxpz.exe
  2⤵
  PID:10092
- C:\Windows\System\yLTEXfF.exe
  C:\Windows\System\yLTEXfF.exe
  2⤵
  PID:10116
- C:\Windows\System\vmIEaBa.exe
  C:\Windows\System\vmIEaBa.exe
  2⤵
  PID:10136
- C:\Windows\System\XXFxdKQ.exe
  C:\Windows\System\XXFxdKQ.exe
  2⤵
  PID:10164
- C:\Windows\System\TKXNVLf.exe
  C:\Windows\System\TKXNVLf.exe
  2⤵
  PID:10180
- C:\Windows\System\oZkdcjF.exe
  C:\Windows\System\oZkdcjF.exe
  2⤵
  PID:10204
- C:\Windows\System\aFZeEsP.exe
  C:\Windows\System\aFZeEsP.exe
  2⤵
  PID:10224
- C:\Windows\System\kgZPhzj.exe
  C:\Windows\System\kgZPhzj.exe
  2⤵
  PID:8380
- C:\Windows\System\kfzByBy.exe
  C:\Windows\System\kfzByBy.exe
  2⤵
  PID:7428
- C:\Windows\System\MDLldQY.exe
  C:\Windows\System\MDLldQY.exe
  2⤵
  PID:8456
- C:\Windows\System\AmvqGBP.exe
  C:\Windows\System\AmvqGBP.exe
  2⤵
  PID:9248
- C:\Windows\System\tZhsNOV.exe
  C:\Windows\System\tZhsNOV.exe
  2⤵
  PID:9272
- C:\Windows\System\HQSxhGl.exe
  C:\Windows\System\HQSxhGl.exe
  2⤵
  PID:9348
- C:\Windows\System\iJbusGj.exe
  C:\Windows\System\iJbusGj.exe
  2⤵
  PID:9376
- C:\Windows\System\qXaaKdW.exe
  C:\Windows\System\qXaaKdW.exe
  2⤵
  PID:8980
- C:\Windows\System\RnpoqZP.exe
  C:\Windows\System\RnpoqZP.exe
  2⤵
  PID:9416
- C:\Windows\System\eiYhJMK.exe
  C:\Windows\System\eiYhJMK.exe
  2⤵
  PID:8440
- C:\Windows\System\YSgouEW.exe
  C:\Windows\System\YSgouEW.exe
  2⤵
  PID:9072
- C:\Windows\System\ryKYemS.exe
  C:\Windows\System\ryKYemS.exe
  2⤵
  PID:8468
- C:\Windows\System\tzyvIhP.exe
  C:\Windows\System\tzyvIhP.exe
  2⤵
  PID:9516
- C:\Windows\System\EcJKnOW.exe
  C:\Windows\System\EcJKnOW.exe
  2⤵
  PID:8512
- C:\Windows\System\oHSEjkb.exe
  C:\Windows\System\oHSEjkb.exe
  2⤵
  PID:7860
- C:\Windows\System\riKGwGc.exe
  C:\Windows\System\riKGwGc.exe
  2⤵
  PID:9688
- C:\Windows\System\lTavCwY.exe
  C:\Windows\System\lTavCwY.exe
  2⤵
  PID:9732
- C:\Windows\System\mibGCok.exe
  C:\Windows\System\mibGCok.exe
  2⤵
  PID:9768
- C:\Windows\System\xlnVjvw.exe
  C:\Windows\System\xlnVjvw.exe
  2⤵
  PID:9812
- C:\Windows\System\QQfucOm.exe
  C:\Windows\System\QQfucOm.exe
  2⤵
  PID:8032
- C:\Windows\System\fxarChO.exe
  C:\Windows\System\fxarChO.exe
  2⤵
  PID:9996
- C:\Windows\System\obhimuD.exe
  C:\Windows\System\obhimuD.exe
  2⤵
  PID:8208
- C:\Windows\System\xDRsEzr.exe
  C:\Windows\System\xDRsEzr.exe
  2⤵
  PID:8916
- C:\Windows\System\msTbDWX.exe
  C:\Windows\System\msTbDWX.exe
  2⤵
  PID:9136
- C:\Windows\System\LZNiOOA.exe
  C:\Windows\System\LZNiOOA.exe
  2⤵
  PID:9596
- C:\Windows\System\cCQXWqt.exe
  C:\Windows\System\cCQXWqt.exe
  2⤵
  PID:9748
- C:\Windows\System\mLmnXek.exe
  C:\Windows\System\mLmnXek.exe
  2⤵
  PID:10264
- C:\Windows\System\CschhGI.exe
  C:\Windows\System\CschhGI.exe
  2⤵
  PID:10292
- C:\Windows\System\LLUcMoL.exe
  C:\Windows\System\LLUcMoL.exe
  2⤵
  PID:10324
- C:\Windows\System\VjmLLrK.exe
  C:\Windows\System\VjmLLrK.exe
  2⤵
  PID:10344
- C:\Windows\System\lLBsRJH.exe
  C:\Windows\System\lLBsRJH.exe
  2⤵
  PID:10364
- C:\Windows\System\NwzGZKk.exe
  C:\Windows\System\NwzGZKk.exe
  2⤵
  PID:10392
- C:\Windows\System\AyouiNp.exe
  C:\Windows\System\AyouiNp.exe
  2⤵
  PID:10428
- C:\Windows\System\czHrRAO.exe
  C:\Windows\System\czHrRAO.exe
  2⤵
  PID:10448
- C:\Windows\System\GJqfXDc.exe
  C:\Windows\System\GJqfXDc.exe
  2⤵
  PID:10484
- C:\Windows\System\mRNGqaI.exe
  C:\Windows\System\mRNGqaI.exe
  2⤵
  PID:10512
- C:\Windows\System\GNjnyRV.exe
  C:\Windows\System\GNjnyRV.exe
  2⤵
  PID:10536
- C:\Windows\System\GpIPgBE.exe
  C:\Windows\System\GpIPgBE.exe
  2⤵
  PID:10560
- C:\Windows\System\HBgHBwc.exe
  C:\Windows\System\HBgHBwc.exe
  2⤵
  PID:10580
- C:\Windows\System\tEXsRib.exe
  C:\Windows\System\tEXsRib.exe
  2⤵
  PID:10600
- C:\Windows\System\ietnzzT.exe
  C:\Windows\System\ietnzzT.exe
  2⤵
  PID:10620
- C:\Windows\System\maRKZzS.exe
  C:\Windows\System\maRKZzS.exe
  2⤵
  PID:10640
- C:\Windows\System\YGMlzEu.exe
  C:\Windows\System\YGMlzEu.exe
  2⤵
  PID:10668
- C:\Windows\System\xDvzAIV.exe
  C:\Windows\System\xDvzAIV.exe
  2⤵
  PID:10684
- C:\Windows\System\PWYUQwG.exe
  C:\Windows\System\PWYUQwG.exe
  2⤵
  PID:10708
- C:\Windows\System\RQdjOMT.exe
  C:\Windows\System\RQdjOMT.exe
  2⤵
  PID:10732
- C:\Windows\System\gDVZFBD.exe
  C:\Windows\System\gDVZFBD.exe
  2⤵
  PID:10748
- C:\Windows\System\IjUDqIp.exe
  C:\Windows\System\IjUDqIp.exe
  2⤵
  PID:10924
- C:\Windows\System\cjeFMBc.exe
  C:\Windows\System\cjeFMBc.exe
  2⤵
  PID:10960
- C:\Windows\System\rumElkD.exe
  C:\Windows\System\rumElkD.exe
  2⤵
  PID:10980
- C:\Windows\System\TJaTfMl.exe
  C:\Windows\System\TJaTfMl.exe
  2⤵
  PID:11000
- C:\Windows\System\IneWAQO.exe
  C:\Windows\System\IneWAQO.exe
  2⤵
  PID:11032
- C:\Windows\System\NqyuSuI.exe
  C:\Windows\System\NqyuSuI.exe
  2⤵
  PID:11052
- C:\Windows\System\VAIIEPS.exe
  C:\Windows\System\VAIIEPS.exe
  2⤵
  PID:11068
- C:\Windows\System\HIJDsIb.exe
  C:\Windows\System\HIJDsIb.exe
  2⤵
  PID:11092
- C:\Windows\System\GPVRxim.exe
  C:\Windows\System\GPVRxim.exe
  2⤵
  PID:11112
- C:\Windows\System\bMEaidG.exe
  C:\Windows\System\bMEaidG.exe
  2⤵
  PID:11132
- C:\Windows\System\ObUwSAw.exe
  C:\Windows\System\ObUwSAw.exe
  2⤵
  PID:11156
- C:\Windows\System\demZVeY.exe
  C:\Windows\System\demZVeY.exe
  2⤵
  PID:11184
- C:\Windows\System\NTQSWTC.exe
  C:\Windows\System\NTQSWTC.exe
  2⤵
  PID:11208
- C:\Windows\System\RQapdWT.exe
  C:\Windows\System\RQapdWT.exe
  2⤵
  PID:11236
- C:\Windows\System\eoAUBWV.exe
  C:\Windows\System\eoAUBWV.exe
  2⤵
  PID:11256
- C:\Windows\System\kUhmrAp.exe
  C:\Windows\System\kUhmrAp.exe
  2⤵
  PID:9888
- C:\Windows\System\sHMjcnN.exe
  C:\Windows\System\sHMjcnN.exe
  2⤵
  PID:9976
- C:\Windows\System\UZYnjLI.exe
  C:\Windows\System\UZYnjLI.exe
  2⤵
  PID:9352
- C:\Windows\System\YPtQERc.exe
  C:\Windows\System\YPtQERc.exe
  2⤵
  PID:10232
- C:\Windows\System\WmoTwpQ.exe
  C:\Windows\System\WmoTwpQ.exe
  2⤵
  PID:9044
- C:\Windows\System\WXOxMoE.exe
  C:\Windows\System\WXOxMoE.exe
  2⤵
  PID:9292
- C:\Windows\System\qrBlzNS.exe
  C:\Windows\System\qrBlzNS.exe
  2⤵
  PID:8960
- C:\Windows\System\qDUXzEY.exe
  C:\Windows\System\qDUXzEY.exe
  2⤵
  PID:9552
- C:\Windows\System\ZeCzjzE.exe
  C:\Windows\System\ZeCzjzE.exe
  2⤵
  PID:9636
- C:\Windows\System\wsxutkn.exe
  C:\Windows\System\wsxutkn.exe
  2⤵
  PID:10044
- C:\Windows\System\APvZqpl.exe
  C:\Windows\System\APvZqpl.exe
  2⤵
  PID:5676
- C:\Windows\System\XOtIHVp.exe
  C:\Windows\System\XOtIHVp.exe
  2⤵
  PID:8680
- C:\Windows\System\WWXDKnM.exe
  C:\Windows\System\WWXDKnM.exe
  2⤵
  PID:8492
- C:\Windows\System\HORZgSx.exe
  C:\Windows\System\HORZgSx.exe
  2⤵
  PID:10528
- C:\Windows\System\JNYpQOX.exe
  C:\Windows\System\JNYpQOX.exe
  2⤵
  PID:11288
- C:\Windows\System\XnHOnOe.exe
  C:\Windows\System\XnHOnOe.exe
  2⤵
  PID:11312
- C:\Windows\System\gQlkMuw.exe
  C:\Windows\System\gQlkMuw.exe
  2⤵
  PID:11340
- C:\Windows\System\ZDTvVzL.exe
  C:\Windows\System\ZDTvVzL.exe
  2⤵
  PID:11360
- C:\Windows\System\JaiKZgs.exe
  C:\Windows\System\JaiKZgs.exe
  2⤵
  PID:11380
- C:\Windows\System\nPopiTZ.exe
  C:\Windows\System\nPopiTZ.exe
  2⤵
  PID:11404
- C:\Windows\System\AUSQfDX.exe
  C:\Windows\System\AUSQfDX.exe
  2⤵
  PID:11452
- C:\Windows\System\zrZcwJd.exe
  C:\Windows\System\zrZcwJd.exe
  2⤵
  PID:11500
- C:\Windows\System\IrodIqZ.exe
  C:\Windows\System\IrodIqZ.exe
  2⤵
  PID:11524
- C:\Windows\System\UMNudpd.exe
  C:\Windows\System\UMNudpd.exe
  2⤵
  PID:11548
- C:\Windows\System\UZRrHPp.exe
  C:\Windows\System\UZRrHPp.exe
  2⤵
  PID:11568
- C:\Windows\System\kXGaZCx.exe
  C:\Windows\System\kXGaZCx.exe
  2⤵
  PID:11588
- C:\Windows\System\XsyKNgl.exe
  C:\Windows\System\XsyKNgl.exe
  2⤵
  PID:11616
- C:\Windows\System\EztbzDH.exe
  C:\Windows\System\EztbzDH.exe
  2⤵
  PID:11636
- C:\Windows\System\sPPWIDt.exe
  C:\Windows\System\sPPWIDt.exe
  2⤵
  PID:11652
- C:\Windows\System\ydDzXBY.exe
  C:\Windows\System\ydDzXBY.exe
  2⤵
  PID:11668
- C:\Windows\System\xKsjhsq.exe
  C:\Windows\System\xKsjhsq.exe
  2⤵
  PID:11684
- C:\Windows\System\aMHWeYp.exe
  C:\Windows\System\aMHWeYp.exe
  2⤵
  PID:11700
- C:\Windows\System\QRALVRx.exe
  C:\Windows\System\QRALVRx.exe
  2⤵
  PID:11716
- C:\Windows\System\xPsMVvo.exe
  C:\Windows\System\xPsMVvo.exe
  2⤵
  PID:11732
- C:\Windows\System\LZpRVZV.exe
  C:\Windows\System\LZpRVZV.exe
  2⤵
  PID:11748
- C:\Windows\System\YmoApME.exe
  C:\Windows\System\YmoApME.exe
  2⤵
  PID:11764
- C:\Windows\System\wcptzwY.exe
  C:\Windows\System\wcptzwY.exe
  2⤵
  PID:11780
- C:\Windows\System\cXvMVkn.exe
  C:\Windows\System\cXvMVkn.exe
  2⤵
  PID:11808
- C:\Windows\System\JgvOPeF.exe
  C:\Windows\System\JgvOPeF.exe
  2⤵
  PID:11832
- C:\Windows\System\RWQIqCO.exe
  C:\Windows\System\RWQIqCO.exe
  2⤵
  PID:11856
- C:\Windows\System\QGONyee.exe
  C:\Windows\System\QGONyee.exe
  2⤵
  PID:11884
- C:\Windows\System\UMEHJBc.exe
  C:\Windows\System\UMEHJBc.exe
  2⤵
  PID:11916
- C:\Windows\System\vivZlUd.exe
  C:\Windows\System\vivZlUd.exe
  2⤵
  PID:11932
- C:\Windows\System\mTcqrSm.exe
  C:\Windows\System\mTcqrSm.exe
  2⤵
  PID:11960
- C:\Windows\System\ozUOrFq.exe
  C:\Windows\System\ozUOrFq.exe
  2⤵
  PID:11980
- C:\Windows\System\efRpFcB.exe
  C:\Windows\System\efRpFcB.exe
  2⤵
  PID:11996
- C:\Windows\System\AYJCBdm.exe
  C:\Windows\System\AYJCBdm.exe
  2⤵
  PID:12016
- C:\Windows\System\NvcAxgk.exe
  C:\Windows\System\NvcAxgk.exe
  2⤵
  PID:12044
- C:\Windows\System\jjmDqyb.exe
  C:\Windows\System\jjmDqyb.exe
  2⤵
  PID:12068
- C:\Windows\System\sOexPfG.exe
  C:\Windows\System\sOexPfG.exe
  2⤵
  PID:12088
- C:\Windows\System\UwVORFj.exe
  C:\Windows\System\UwVORFj.exe
  2⤵
  PID:12104
- C:\Windows\System\lRRHCDH.exe
  C:\Windows\System\lRRHCDH.exe
  2⤵
  PID:12128
- C:\Windows\System\iAcKpQf.exe
  C:\Windows\System\iAcKpQf.exe
  2⤵
  PID:12148
- C:\Windows\System\acFuNiI.exe
  C:\Windows\System\acFuNiI.exe
  2⤵
  PID:12176
- C:\Windows\System\EtQgwNB.exe
  C:\Windows\System\EtQgwNB.exe
  2⤵
  PID:12200
- C:\Windows\System\ojRIvcX.exe
  C:\Windows\System\ojRIvcX.exe
  2⤵
  PID:12220
- C:\Windows\System\IHovptS.exe
  C:\Windows\System\IHovptS.exe
  2⤵
  PID:12244
- C:\Windows\System\cRvHEKr.exe
  C:\Windows\System\cRvHEKr.exe
  2⤵
  PID:12260
- C:\Windows\System\hfVamsc.exe
  C:\Windows\System\hfVamsc.exe
  2⤵
  PID:10568
- C:\Windows\System\EqqCubs.exe
  C:\Windows\System\EqqCubs.exe
  2⤵
  PID:10632
- C:\Windows\System\RKUWulC.exe
  C:\Windows\System\RKUWulC.exe
  2⤵
  PID:10156
- C:\Windows\System\OPjJwPf.exe
  C:\Windows\System\OPjJwPf.exe
  2⤵
  PID:10728
- C:\Windows\System\fCWnAKi.exe
  C:\Windows\System\fCWnAKi.exe
  2⤵
  PID:10804
- C:\Windows\System\UJKhNEu.exe
  C:\Windows\System\UJKhNEu.exe
  2⤵
  PID:10236
- C:\Windows\System\hMyQgbh.exe
  C:\Windows\System\hMyQgbh.exe
  2⤵
  PID:9068
- C:\Windows\System\vjOavtt.exe
  C:\Windows\System\vjOavtt.exe
  2⤵
  PID:9772
- C:\Windows\System\uCWYHes.exe
  C:\Windows\System\uCWYHes.exe
  2⤵
  PID:9840
- C:\Windows\System\AVklSpe.exe
  C:\Windows\System\AVklSpe.exe
  2⤵
  PID:8564
- C:\Windows\System\wXOJxKH.exe
  C:\Windows\System\wXOJxKH.exe
  2⤵
  PID:10032
- C:\Windows\System\fnumctC.exe
  C:\Windows\System\fnumctC.exe
  2⤵
  PID:9184
- C:\Windows\System\nveSbYg.exe
  C:\Windows\System\nveSbYg.exe
  2⤵
  PID:7928
- C:\Windows\System\PihvlQN.exe
  C:\Windows\System\PihvlQN.exe
  2⤵
  PID:10188
- C:\Windows\System\MQoJaym.exe
  C:\Windows\System\MQoJaym.exe
  2⤵
  PID:9464
- C:\Windows\System\TfRMCjr.exe
  C:\Windows\System\TfRMCjr.exe
  2⤵
  PID:9504
- C:\Windows\System\OfhXmUQ.exe
  C:\Windows\System\OfhXmUQ.exe
  2⤵
  PID:9704
- C:\Windows\System\JUFBMeb.exe
  C:\Windows\System\JUFBMeb.exe
  2⤵
  PID:8700
- C:\Windows\System\gwzOaqi.exe
  C:\Windows\System\gwzOaqi.exe
  2⤵
  PID:10532
- C:\Windows\System\uamzgwK.exe
  C:\Windows\System\uamzgwK.exe
  2⤵
  PID:11304
- C:\Windows\System\GWneXfz.exe
  C:\Windows\System\GWneXfz.exe
  2⤵
  PID:11324
- C:\Windows\System\kVBgQnc.exe
  C:\Windows\System\kVBgQnc.exe
  2⤵
  PID:11356
- C:\Windows\System\OaPoJyE.exe
  C:\Windows\System\OaPoJyE.exe
  2⤵
  PID:11400
- C:\Windows\System\jXeSwMW.exe
  C:\Windows\System\jXeSwMW.exe
  2⤵
  PID:10764
- C:\Windows\System\UVrRObu.exe
  C:\Windows\System\UVrRObu.exe
  2⤵
  PID:10836
- C:\Windows\System\FVBDduK.exe
  C:\Windows\System\FVBDduK.exe
  2⤵
  PID:10892
- C:\Windows\System\ASPPabx.exe
  C:\Windows\System\ASPPabx.exe
  2⤵
  PID:9008
- C:\Windows\System\JdvvdjR.exe
  C:\Windows\System\JdvvdjR.exe
  2⤵
  PID:11644
- C:\Windows\System\WniRpXk.exe
  C:\Windows\System\WniRpXk.exe
  2⤵
  PID:11708
- C:\Windows\System\uhUAQJQ.exe
  C:\Windows\System\uhUAQJQ.exe
  2⤵
  PID:11824
- C:\Windows\System\mAkLLho.exe
  C:\Windows\System\mAkLLho.exe
  2⤵
  PID:11852
- C:\Windows\System\qJzXGWG.exe
  C:\Windows\System\qJzXGWG.exe
  2⤵
  PID:10992
- C:\Windows\System\KrPbvXr.exe
  C:\Windows\System\KrPbvXr.exe
  2⤵
  PID:12292
- C:\Windows\System\LbnbKMp.exe
  C:\Windows\System\LbnbKMp.exe
  2⤵
  PID:12308
- C:\Windows\System\CEFloHV.exe
  C:\Windows\System\CEFloHV.exe
  2⤵
  PID:12324
- C:\Windows\System\UOqzbKT.exe
  C:\Windows\System\UOqzbKT.exe
  2⤵
  PID:12340
- C:\Windows\System\DfWJBfh.exe
  C:\Windows\System\DfWJBfh.exe
  2⤵
  PID:12356
- C:\Windows\System\dGQTZHO.exe
  C:\Windows\System\dGQTZHO.exe
  2⤵
  PID:12372
- C:\Windows\System\BOOEhDB.exe
  C:\Windows\System\BOOEhDB.exe
  2⤵
  PID:12388
- C:\Windows\System\WEWVrLO.exe
  C:\Windows\System\WEWVrLO.exe
  2⤵
  PID:12404
- C:\Windows\System\FFdJdaT.exe
  C:\Windows\System\FFdJdaT.exe
  2⤵
  PID:12420
- C:\Windows\System\djmVbEe.exe
  C:\Windows\System\djmVbEe.exe
  2⤵
  PID:12436
- C:\Windows\System\LsCjWxr.exe
  C:\Windows\System\LsCjWxr.exe
  2⤵
  PID:12452
- C:\Windows\System\AiULlkk.exe
  C:\Windows\System\AiULlkk.exe
  2⤵
  PID:12476
- C:\Windows\System\FtxwbPI.exe
  C:\Windows\System\FtxwbPI.exe
  2⤵
  PID:12496
- C:\Windows\System\ljXXVGh.exe
  C:\Windows\System\ljXXVGh.exe
  2⤵
  PID:12532
- C:\Windows\System\wIAonmh.exe
  C:\Windows\System\wIAonmh.exe
  2⤵
  PID:12556
- C:\Windows\System\jmUtoAE.exe
  C:\Windows\System\jmUtoAE.exe
  2⤵
  PID:12580
- C:\Windows\System\FiBfAwZ.exe
  C:\Windows\System\FiBfAwZ.exe
  2⤵
  PID:12600
- C:\Windows\System\uqoRLtC.exe
  C:\Windows\System\uqoRLtC.exe
  2⤵
  PID:12624
- C:\Windows\System\FyNaymW.exe
  C:\Windows\System\FyNaymW.exe
  2⤵
  PID:12644
- C:\Windows\System\WbWrvPC.exe
  C:\Windows\System\WbWrvPC.exe
  2⤵
  PID:12672
- C:\Windows\System\ZUzXVuW.exe
  C:\Windows\System\ZUzXVuW.exe
  2⤵
  PID:12692
- C:\Windows\System\gdRKkWe.exe
  C:\Windows\System\gdRKkWe.exe
  2⤵
  PID:12708
- C:\Windows\System\NiCaYpN.exe
  C:\Windows\System\NiCaYpN.exe
  2⤵
  PID:12728
- C:\Windows\System\lKeyuan.exe
  C:\Windows\System\lKeyuan.exe
  2⤵
  PID:12752
- C:\Windows\System\ydvDdDw.exe
  C:\Windows\System\ydvDdDw.exe
  2⤵
  PID:12776
- C:\Windows\System\LzxNSeM.exe
  C:\Windows\System\LzxNSeM.exe
  2⤵
  PID:12804
- C:\Windows\System\CtDghEN.exe
  C:\Windows\System\CtDghEN.exe
  2⤵
  PID:12824
- C:\Windows\System\LQhURrU.exe
  C:\Windows\System\LQhURrU.exe
  2⤵
  PID:12852
- C:\Windows\System\giPCUgK.exe
  C:\Windows\System\giPCUgK.exe
  2⤵
  PID:12876
- C:\Windows\System\eauMXox.exe
  C:\Windows\System\eauMXox.exe
  2⤵
  PID:12896
- C:\Windows\System\LZfLPwP.exe
  C:\Windows\System\LZfLPwP.exe
  2⤵
  PID:12920
- C:\Windows\System\OuyoLms.exe
  C:\Windows\System\OuyoLms.exe
  2⤵
  PID:12936
- C:\Windows\System\dcNtrLX.exe
  C:\Windows\System\dcNtrLX.exe
  2⤵
  PID:12636
- C:\Windows\System\JqCAHeL.exe
  C:\Windows\System\JqCAHeL.exe
  2⤵
  PID:13000
- C:\Windows\System\oyvksyt.exe
  C:\Windows\System\oyvksyt.exe
  2⤵
  PID:11064
- C:\Windows\System\KCwmeBD.exe
  C:\Windows\System\KCwmeBD.exe
  2⤵
  PID:13048
- C:\Windows\System\uNwUyGd.exe
  C:\Windows\System\uNwUyGd.exe
  2⤵
  PID:10520
- C:\Windows\System\EvhleGJ.exe
  C:\Windows\System\EvhleGJ.exe
  2⤵
  PID:13132
- C:\Windows\System\XPrAccf.exe
  C:\Windows\System\XPrAccf.exe
  2⤵
  PID:9304
- C:\Windows\System\DWQPEtI.exe
  C:\Windows\System\DWQPEtI.exe
  2⤵
  PID:13200
- C:\Windows\System\erNWaAe.exe
  C:\Windows\System\erNWaAe.exe
  2⤵
  PID:13208
- C:\Windows\System\dgePjnF.exe
  C:\Windows\System\dgePjnF.exe
  2⤵
  PID:12564
- C:\Windows\System\tImjXxv.exe
  C:\Windows\System\tImjXxv.exe
  2⤵
  PID:13244
- C:\Windows\System\FndDncl.exe
  C:\Windows\System\FndDncl.exe
  2⤵
  PID:8480
- C:\Windows\System\wGankux.exe
  C:\Windows\System\wGankux.exe
  2⤵
  PID:13284
- C:\Windows\System\eKmlOUt.exe
  C:\Windows\System\eKmlOUt.exe
  2⤵
  PID:11988
- C:\Windows\System\dFGIvyh.exe
  C:\Windows\System\dFGIvyh.exe
  2⤵
  PID:13192
- C:\Windows\System\SYgPmyB.exe
  C:\Windows\System\SYgPmyB.exe
  2⤵
  PID:12096
- C:\Windows\System\DUCNaij.exe
  C:\Windows\System\DUCNaij.exe
  2⤵
  PID:11444
- C:\Windows\System\vgTsOOy.exe
  C:\Windows\System\vgTsOOy.exe
  2⤵
  PID:13036
- C:\Windows\System\RlHkvzS.exe
  C:\Windows\System\RlHkvzS.exe
  2⤵
  PID:12788
- C:\Windows\System\eYGnqVk.exe
  C:\Windows\System\eYGnqVk.exe
  2⤵
  PID:13280
- C:\Windows\System\RwUvQlB.exe
  C:\Windows\System\RwUvQlB.exe
  2⤵
  PID:11048
- C:\Windows\System\JRnrWxF.exe
  C:\Windows\System\JRnrWxF.exe
  2⤵
  PID:10260
- C:\Windows\System\hlCSTBm.exe
  C:\Windows\System\hlCSTBm.exe
  2⤵
  PID:7748
- C:\Windows\System\mKLKOqW.exe
  C:\Windows\System\mKLKOqW.exe
  2⤵
  PID:10352
- C:\Windows\System\lbTEedE.exe
  C:\Windows\System\lbTEedE.exe
  2⤵
  PID:11596
- C:\Windows\System\VRzBYCM.exe
  C:\Windows\System\VRzBYCM.exe
  2⤵
  PID:12816
- C:\Windows\System\nncrUeq.exe
  C:\Windows\System\nncrUeq.exe
  2⤵
  PID:3860
- C:\Windows\System\VIxEaeg.exe
  C:\Windows\System\VIxEaeg.exe
  2⤵
  PID:10132
- C:\Windows\System\AHGRhke.exe
  C:\Windows\System\AHGRhke.exe
  2⤵
  PID:13076
- C:\Windows\System\WYKdAFN.exe
  C:\Windows\System\WYKdAFN.exe
  2⤵
  PID:13296
- C:\Windows\System\WcMgeKv.exe
  C:\Windows\System\WcMgeKv.exe
  2⤵
  PID:12700
- C:\Windows\System\uuHnYOJ.exe
  C:\Windows\System\uuHnYOJ.exe
  2⤵
  PID:4324
- C:\Windows\System\dXWVkSI.exe
  C:\Windows\System\dXWVkSI.exe
  2⤵
  PID:11244
- C:\Windows\System\eRYVLbw.exe
  C:\Windows\System\eRYVLbw.exe
  2⤵
  PID:11756
- C:\Windows\System\ikXFATh.exe
  C:\Windows\System\ikXFATh.exe
  2⤵
  PID:13028
- C:\Windows\System\VWoACwv.exe
  C:\Windows\System\VWoACwv.exe
  2⤵
  PID:9972
- C:\Windows\System\fyPcjmv.exe
  C:\Windows\System\fyPcjmv.exe
  2⤵
  PID:11896
- C:\Windows\System\lRJGVWX.exe
  C:\Windows\System\lRJGVWX.exe
  2⤵
  PID:11696
- C:\Windows\System\wqhjrpc.exe
  C:\Windows\System\wqhjrpc.exe
  2⤵
  PID:12140
- C:\Windows\System\yxaSyQd.exe
  C:\Windows\System\yxaSyQd.exe
  2⤵
  PID:10596
- C:\Windows\System\vmrHqqO.exe
  C:\Windows\System\vmrHqqO.exe
  2⤵
  PID:13108
- C:\Windows\System\zguendv.exe
  C:\Windows\System\zguendv.exe
  2⤵
  PID:12008
- C:\Windows\System\FaxZBkf.exe
  C:\Windows\System\FaxZBkf.exe
  2⤵
  PID:10860
- C:\Windows\System\eACUOUJ.exe
  C:\Windows\System\eACUOUJ.exe
  2⤵
  PID:11044
- C:\Windows\System\MPzvdmz.exe
  C:\Windows\System\MPzvdmz.exe
  2⤵
  PID:11516
- C:\Windows\System\raXpTRN.exe
  C:\Windows\System\raXpTRN.exe
  2⤵
  PID:12992
- C:\Windows\System\FAfmXaZ.exe
  C:\Windows\System\FAfmXaZ.exe
  2⤵
  PID:13044
- C:\Windows\System\TdedbFM.exe
  C:\Windows\System\TdedbFM.exe
  2⤵
  PID:5472
- C:\Windows\System\guaahqy.exe
  C:\Windows\System\guaahqy.exe
  2⤵
  PID:12592
- C:\Windows\System\lEomQiu.exe
  C:\Windows\System\lEomQiu.exe
  2⤵
  PID:10996
- C:\Windows\System\pOwVDEl.exe
  C:\Windows\System\pOwVDEl.exe
  2⤵
  PID:5108
- C:\Windows\System\GWRPFzo.exe
  C:\Windows\System\GWRPFzo.exe
  2⤵
  PID:12720
- C:\Windows\System\TLtMzdF.exe
  C:\Windows\System\TLtMzdF.exe
  2⤵
  PID:10968
- C:\Windows\System\UTSdqgO.exe
  C:\Windows\System\UTSdqgO.exe
  2⤵
  PID:12056
- C:\Windows\System\eneZpYn.exe
  C:\Windows\System\eneZpYn.exe
  2⤵
  PID:12212
- C:\Windows\System\lGUILQC.exe
  C:\Windows\System\lGUILQC.exe
  2⤵
  PID:12336
- C:\Windows\System\wWpVNsQ.exe
  C:\Windows\System\wWpVNsQ.exe
  2⤵
  PID:13084
- C:\Windows\System\OTTxwLg.exe
  C:\Windows\System\OTTxwLg.exe
  2⤵
  PID:11228
- C:\Windows\System\qoppyml.exe
  C:\Windows\System\qoppyml.exe
  2⤵
  PID:4568
- C:\Windows\System\rEeFnRc.exe
  C:\Windows\System\rEeFnRc.exe
  2⤵
  PID:11180
- C:\Windows\System\FgsVBCL.exe
  C:\Windows\System\FgsVBCL.exe
  2⤵
  PID:13104
- C:\Windows\System\iirWnLX.exe
  C:\Windows\System\iirWnLX.exe
  2⤵
  PID:12820
- C:\Windows\System\GCkgaaP.exe
  C:\Windows\System\GCkgaaP.exe
  2⤵
  PID:2036
- C:\Windows\System\DYmEWri.exe
  C:\Windows\System\DYmEWri.exe
  2⤵
  PID:3196
- C:\Windows\System\CxTuPQz.exe
  C:\Windows\System\CxTuPQz.exe
  2⤵
  PID:2884
- C:\Windows\System\gqGUBwI.exe
  C:\Windows\System\gqGUBwI.exe
  2⤵
  PID:11864
- C:\Windows\System\YiMynNX.exe
  C:\Windows\System\YiMynNX.exe
  2⤵
  PID:12868
- C:\Windows\System\MgOAtzG.exe
  C:\Windows\System\MgOAtzG.exe
  2⤵
  PID:10788
- C:\Windows\System\gLWXmhl.exe
  C:\Windows\System\gLWXmhl.exe
  2⤵
  PID:11176
- C:\Windows\System\wGlJoic.exe
  C:\Windows\System\wGlJoic.exe
  2⤵
  PID:12680
- C:\Windows\System\VAZQQWq.exe
  C:\Windows\System\VAZQQWq.exe
  2⤵
  PID:10016
- C:\Windows\System\OBccjhl.exe
  C:\Windows\System\OBccjhl.exe
  2⤵
  PID:7568
- C:\Windows\System\ropwPwv.exe
  C:\Windows\System\ropwPwv.exe
  2⤵
  PID:12620
- C:\Windows\System\REdNdoT.exe
  C:\Windows\System\REdNdoT.exe
  2⤵
  PID:3568
- C:\Windows\System\noRlsqf.exe
  C:\Windows\System\noRlsqf.exe
  2⤵
  PID:12032
- C:\Windows\System\XYEXDRA.exe
  C:\Windows\System\XYEXDRA.exe
  2⤵
  PID:3248
- C:\Windows\System\mhHugru.exe
  C:\Windows\System\mhHugru.exe
  2⤵
  PID:2892
- C:\Windows\System\TfqzHmL.exe
  C:\Windows\System\TfqzHmL.exe
  2⤵
  PID:4740
- C:\Windows\System\LFZIEAW.exe
  C:\Windows\System\LFZIEAW.exe
  2⤵
  PID:4904
- C:\Windows\System\MDSOZrg.exe
  C:\Windows\System\MDSOZrg.exe
  2⤵
  PID:1932
- C:\Windows\System\JXdSyaF.exe
  C:\Windows\System\JXdSyaF.exe
  2⤵
  PID:11564
- C:\Windows\System\VsyrFpR.exe
  C:\Windows\System\VsyrFpR.exe
  2⤵
  PID:10700
- C:\Windows\System\kKKetLl.exe
  C:\Windows\System\kKKetLl.exe
  2⤵
  PID:9340
- C:\Windows\System\hDZAkhq.exe
  C:\Windows\System\hDZAkhq.exe
  2⤵
  PID:11584
- C:\Windows\System\uSqZgGF.exe
  C:\Windows\System\uSqZgGF.exe
  2⤵
  PID:13228
- C:\Windows\System\QtUmVsG.exe
  C:\Windows\System\QtUmVsG.exe
  2⤵
  PID:1456
- C:\Windows\System\YjQSlFr.exe
  C:\Windows\System\YjQSlFr.exe
  2⤵
  PID:12240
- C:\Windows\System\fMYHEcj.exe
  C:\Windows\System\fMYHEcj.exe
  2⤵
  PID:5820
- C:\Windows\System\wGDfzfA.exe
  C:\Windows\System\wGDfzfA.exe
  2⤵
  PID:6016
- C:\Windows\System\JucsGhE.exe
  C:\Windows\System\JucsGhE.exe
  2⤵
  PID:13216
- C:\Windows\System\XlTtFin.exe
  C:\Windows\System\XlTtFin.exe
  2⤵
  PID:13012
- C:\Windows\System\DmFcmUd.exe
  C:\Windows\System\DmFcmUd.exe
  2⤵
  PID:4576
- C:\Windows\System\VoStRSA.exe
  C:\Windows\System\VoStRSA.exe
  2⤵
  PID:3432
- C:\Windows\System\lhhKWqU.exe
  C:\Windows\System\lhhKWqU.exe
  2⤵
  PID:8728
- C:\Windows\System\VLahuxK.exe
  C:\Windows\System\VLahuxK.exe
  2⤵
  PID:1348
- C:\Windows\System\QUZMwIg.exe
  C:\Windows\System\QUZMwIg.exe
  2⤵
  PID:3596
- C:\Windows\System\IhugtLJ.exe
  C:\Windows\System\IhugtLJ.exe
  2⤵
  PID:12276
- C:\Windows\System\FuQTwHt.exe
  C:\Windows\System\FuQTwHt.exe
  2⤵
  PID:13320
- C:\Windows\System\xffkMiP.exe
  C:\Windows\System\xffkMiP.exe
  2⤵
  PID:13336
- C:\Windows\System\EvyZppr.exe
  C:\Windows\System\EvyZppr.exe
  2⤵
  PID:13352
- C:\Windows\System\sKVEvRE.exe
  C:\Windows\System\sKVEvRE.exe
  2⤵
  PID:13368
- C:\Windows\System\WeNbBuW.exe
  C:\Windows\System\WeNbBuW.exe
  2⤵
  PID:13384
- C:\Windows\System\XoVsJTC.exe
  C:\Windows\System\XoVsJTC.exe
  2⤵
  PID:13400
- C:\Windows\System\IZuIFdP.exe
  C:\Windows\System\IZuIFdP.exe
  2⤵
  PID:13416
- C:\Windows\System\dJiGgDN.exe
  C:\Windows\System\dJiGgDN.exe
  2⤵
  PID:13432
- C:\Windows\System\kaQjDMv.exe
  C:\Windows\System\kaQjDMv.exe
  2⤵
  PID:13448
- C:\Windows\System\ZhcgmoM.exe
  C:\Windows\System\ZhcgmoM.exe
  2⤵
  PID:13464
- C:\Windows\System\XWhjNns.exe
  C:\Windows\System\XWhjNns.exe
  2⤵
  PID:13480
- C:\Windows\System\SsPhDbo.exe
  C:\Windows\System\SsPhDbo.exe
  2⤵
  PID:13496
- C:\Windows\System\GwDuuba.exe
  C:\Windows\System\GwDuuba.exe
  2⤵
  PID:13512
- C:\Windows\System\ebyTUuh.exe
  C:\Windows\System\ebyTUuh.exe
  2⤵
  PID:13532
- C:\Windows\System\OOzgiVS.exe
  C:\Windows\System\OOzgiVS.exe
  2⤵
  PID:13548
- C:\Windows\System\YwSXoJG.exe
  C:\Windows\System\YwSXoJG.exe
  2⤵
  PID:13564
- C:\Windows\System\LURgNqD.exe
  C:\Windows\System\LURgNqD.exe
  2⤵
  PID:13580
- C:\Windows\System\DxwrPMN.exe
  C:\Windows\System\DxwrPMN.exe
  2⤵
  PID:13596
- C:\Windows\System\xkrWOMa.exe
  C:\Windows\System\xkrWOMa.exe
  2⤵
  PID:13612
- C:\Windows\System\oEAIUkX.exe
  C:\Windows\System\oEAIUkX.exe
  2⤵
  PID:13628
- C:\Windows\System\zFXknZA.exe
  C:\Windows\System\zFXknZA.exe
  2⤵
  PID:13644
- C:\Windows\System\lXsJttk.exe
  C:\Windows\System\lXsJttk.exe
  2⤵
  PID:13660
- C:\Windows\System\ZPamdNP.exe
  C:\Windows\System\ZPamdNP.exe
  2⤵
  PID:13676
- C:\Windows\System\UQcPpNy.exe
  C:\Windows\System\UQcPpNy.exe
  2⤵
  PID:13692
- C:\Windows\System\OwtUDfn.exe
  C:\Windows\System\OwtUDfn.exe
  2⤵
  PID:13708
- C:\Windows\System\DLmFtSO.exe
  C:\Windows\System\DLmFtSO.exe
  2⤵
  PID:13724
- C:\Windows\System\PRZLLgV.exe
  C:\Windows\System\PRZLLgV.exe
  2⤵
  PID:13740
- C:\Windows\System\nwEweEV.exe
  C:\Windows\System\nwEweEV.exe
  2⤵
  PID:13756
- C:\Windows\System\tSQaBCf.exe
  C:\Windows\System\tSQaBCf.exe
  2⤵
  PID:13772
- C:\Windows\System\LBxLMms.exe
  C:\Windows\System\LBxLMms.exe
  2⤵
  PID:13788
- C:\Windows\System\jyMaCEm.exe
  C:\Windows\System\jyMaCEm.exe
  2⤵
  PID:13804
- C:\Windows\System\GHMHOaA.exe
  C:\Windows\System\GHMHOaA.exe
  2⤵
  PID:13820
- C:\Windows\System\zIPqPVM.exe
  C:\Windows\System\zIPqPVM.exe
  2⤵
  PID:13836
- C:\Windows\System\DtsYFbp.exe
  C:\Windows\System\DtsYFbp.exe
  2⤵
  PID:13852
- C:\Windows\System\YKohnxl.exe
  C:\Windows\System\YKohnxl.exe
  2⤵
  PID:13868
- C:\Windows\System\UXHxEch.exe
  C:\Windows\System\UXHxEch.exe
  2⤵
  PID:13884
- C:\Windows\System\lISUUAX.exe
  C:\Windows\System\lISUUAX.exe
  2⤵
  PID:13900
- C:\Windows\System\pIpHRqQ.exe
  C:\Windows\System\pIpHRqQ.exe
  2⤵
  PID:13916
- C:\Windows\System\RsZrGTE.exe
  C:\Windows\System\RsZrGTE.exe
  2⤵
  PID:13932
- C:\Windows\System\JsqffXb.exe
  C:\Windows\System\JsqffXb.exe
  2⤵
  PID:13948
- C:\Windows\System\uCuMBDM.exe
  C:\Windows\System\uCuMBDM.exe
  2⤵
  PID:13964
- C:\Windows\System\Rzoytbl.exe
  C:\Windows\System\Rzoytbl.exe
  2⤵
  PID:13980
- C:\Windows\System\kiciOCS.exe
  C:\Windows\System\kiciOCS.exe
  2⤵
  PID:13996
- C:\Windows\System\JjBbNTb.exe
  C:\Windows\System\JjBbNTb.exe
  2⤵
  PID:14012
- C:\Windows\System\OUIDMwk.exe
  C:\Windows\System\OUIDMwk.exe
  2⤵
  PID:14028
- C:\Windows\System\rEzRUbz.exe
  C:\Windows\System\rEzRUbz.exe
  2⤵
  PID:14044
- C:\Windows\System\HDaYXrY.exe
  C:\Windows\System\HDaYXrY.exe
  2⤵
  PID:14060
- C:\Windows\System\xKHbijm.exe
  C:\Windows\System\xKHbijm.exe
  2⤵
  PID:14076
- C:\Windows\System\gEqQDYW.exe
  C:\Windows\System\gEqQDYW.exe
  2⤵
  PID:14092
- C:\Windows\System\VafXHfW.exe
  C:\Windows\System\VafXHfW.exe
  2⤵
  PID:14108
- C:\Windows\System\mfJAqpS.exe
  C:\Windows\System\mfJAqpS.exe
  2⤵
  PID:14124
- C:\Windows\System\puyFZuh.exe
  C:\Windows\System\puyFZuh.exe
  2⤵
  PID:14140
- C:\Windows\System\SIEuQmH.exe
  C:\Windows\System\SIEuQmH.exe
  2⤵
  PID:14156
- C:\Windows\System\FSAAqgL.exe
  C:\Windows\System\FSAAqgL.exe
  2⤵
  PID:14172
- C:\Windows\System\DLDvRlM.exe
  C:\Windows\System\DLDvRlM.exe
  2⤵
  PID:14188
- C:\Windows\System\JfItnMS.exe
  C:\Windows\System\JfItnMS.exe
  2⤵
  PID:14204
- C:\Windows\System\NpzEViR.exe
  C:\Windows\System\NpzEViR.exe
  2⤵
  PID:14220
- C:\Windows\System\kDPVTGt.exe
  C:\Windows\System\kDPVTGt.exe
  2⤵
  PID:14236
- C:\Windows\System\SPNzmkV.exe
  C:\Windows\System\SPNzmkV.exe
  2⤵
  PID:14252
- C:\Windows\System\OOhbvGB.exe
  C:\Windows\System\OOhbvGB.exe
  2⤵
  PID:14296
- C:\Windows\System\EVhOxci.exe
  C:\Windows\System\EVhOxci.exe
  2⤵
  PID:14320
- C:\Windows\System\wFFrpVy.exe
  C:\Windows\System\wFFrpVy.exe
  2⤵
  PID:13332
- C:\Windows\System\kUQTNZu.exe
  C:\Windows\System\kUQTNZu.exe
  2⤵
  PID:13380
- C:\Windows\System\dUEDpJY.exe
  C:\Windows\System\dUEDpJY.exe
  2⤵
  PID:13424
- C:\Windows\System\PVOoHSh.exe
  C:\Windows\System\PVOoHSh.exe
  2⤵
  PID:3244
- C:\Windows\System\WGqBpJp.exe
  C:\Windows\System\WGqBpJp.exe
  2⤵
  PID:13476
- C:\Windows\System\IODLYdH.exe
  C:\Windows\System\IODLYdH.exe
  2⤵
  PID:13508
- C:\Windows\System\tRhkdpL.exe
  C:\Windows\System\tRhkdpL.exe
  2⤵
  PID:13572
- C:\Windows\System\fLTTTrX.exe
  C:\Windows\System\fLTTTrX.exe
  2⤵
  PID:13636
- C:\Windows\System\sLDwsTL.exe
  C:\Windows\System\sLDwsTL.exe
  2⤵
  PID:13748
- C:\Windows\System\aNyKQba.exe
  C:\Windows\System\aNyKQba.exe
  2⤵
  PID:13780
- C:\Windows\System\lhzjrPk.exe
  C:\Windows\System\lhzjrPk.exe
  2⤵
  PID:13816
- C:\Windows\System\arjDaYy.exe
  C:\Windows\System\arjDaYy.exe
  2⤵
  PID:13848
- C:\Windows\System\gaQTIkZ.exe
  C:\Windows\System\gaQTIkZ.exe
  2⤵
  PID:13892
- C:\Windows\System\mYuPvPd.exe
  C:\Windows\System\mYuPvPd.exe
  2⤵
  PID:13924
- C:\Windows\System\wDpONZL.exe
  C:\Windows\System\wDpONZL.exe
  2⤵
  PID:13956
- C:\Windows\System\IMwUeGr.exe
  C:\Windows\System\IMwUeGr.exe
  2⤵
  PID:13988
- C:\Windows\System\GbEMRQv.exe
  C:\Windows\System\GbEMRQv.exe
  2⤵
  PID:14020
- C:\Windows\System\VIPLqsg.exe
  C:\Windows\System\VIPLqsg.exe
  2⤵
  PID:14052
- C:\Windows\System\YuNBuaZ.exe
  C:\Windows\System\YuNBuaZ.exe
  2⤵
  PID:14100
- C:\Windows\System\tZRJvkh.exe
  C:\Windows\System\tZRJvkh.exe
  2⤵
  PID:14120
- C:\Windows\System\XFPvxFu.exe
  C:\Windows\System\XFPvxFu.exe
  2⤵
  PID:14152
- C:\Windows\System\VNoaVuI.exe
  C:\Windows\System\VNoaVuI.exe
  2⤵
  PID:14184
- C:\Windows\System\RMNGkkD.exe
  C:\Windows\System\RMNGkkD.exe
  2⤵
  PID:14216
- C:\Windows\System\eNotoLv.exe
  C:\Windows\System\eNotoLv.exe
  2⤵
  PID:14248
- C:\Windows\System\sJOllUH.exe
  C:\Windows\System\sJOllUH.exe
  2⤵
  PID:14276
- C:\Windows\System\TSwoivc.exe
  C:\Windows\System\TSwoivc.exe
  2⤵
  PID:14268
- C:\Windows\System\LNBwlnl.exe
  C:\Windows\System\LNBwlnl.exe
  2⤵
  PID:13316
- C:\Windows\System\AqaixVP.exe
  C:\Windows\System\AqaixVP.exe
  2⤵
  PID:13412
- C:\Windows\System\iOcCtFK.exe
  C:\Windows\System\iOcCtFK.exe
  2⤵
  PID:13472
- C:\Windows\System\LimgpYJ.exe
  C:\Windows\System\LimgpYJ.exe
  2⤵
  PID:13800
- C:\Windows\System\UjeWxfb.exe
  C:\Windows\System\UjeWxfb.exe
  2⤵
  PID:13864
- C:\Windows\System\nGslAFB.exe
  C:\Windows\System\nGslAFB.exe
  2⤵
  PID:13908
- C:\Windows\System\RxsFXFZ.exe
  C:\Windows\System\RxsFXFZ.exe
  2⤵
  PID:732
- C:\Windows\System\AcBiVYO.exe
  C:\Windows\System\AcBiVYO.exe
  2⤵
  PID:14036
- C:\Windows\System\kdiPrPx.exe
  C:\Windows\System\kdiPrPx.exe
  2⤵
  PID:14116
- C:\Windows\System\sZgrLnK.exe
  C:\Windows\System\sZgrLnK.exe
  2⤵
  PID:14232
- C:\Windows\System\qgTUVwT.exe
  C:\Windows\System\qgTUVwT.exe
  2⤵
  PID:14260
- C:\Windows\System\LXtKzvO.exe
  C:\Windows\System\LXtKzvO.exe
  2⤵
  PID:13376
- C:\Windows\System\TlFCoDT.exe
  C:\Windows\System\TlFCoDT.exe
  2⤵
  PID:13768
- C:\Windows\System\YrtkjcG.exe
  C:\Windows\System\YrtkjcG.exe
  2⤵
  PID:13880
- C:\Windows\System\HnptnSf.exe
  C:\Windows\System\HnptnSf.exe
  2⤵
  PID:14088
- C:\Windows\System\yEEIYzg.exe
  C:\Windows\System\yEEIYzg.exe
  2⤵
  PID:14328
- C:\Windows\System\dZVbOBy.exe
  C:\Windows\System\dZVbOBy.exe
  2⤵
  PID:13940
- C:\Windows\System\fDrursu.exe
  C:\Windows\System\fDrursu.exe
  2⤵
  PID:13764
- C:\Windows\System\tndJoeP.exe
  C:\Windows\System\tndJoeP.exe
  2⤵
  PID:3448
- C:\Windows\System\AAoojfS.exe
  C:\Windows\System\AAoojfS.exe
  2⤵
  PID:14352
- C:\Windows\System\ToHYvXH.exe
  C:\Windows\System\ToHYvXH.exe
  2⤵
  PID:14368
- C:\Windows\System\mhQAQtd.exe
  C:\Windows\System\mhQAQtd.exe
  2⤵
  PID:14384
- C:\Windows\System\fkxmyUS.exe
  C:\Windows\System\fkxmyUS.exe
  2⤵
  PID:14400
- C:\Windows\System\ocIbEBh.exe
  C:\Windows\System\ocIbEBh.exe
  2⤵
  PID:14420
- C:\Windows\System\erfOqqT.exe
  C:\Windows\System\erfOqqT.exe
  2⤵
  PID:14436
- C:\Windows\System\zaugqhl.exe
  C:\Windows\System\zaugqhl.exe
  2⤵
  PID:14452
- C:\Windows\System\HLelhyD.exe
  C:\Windows\System\HLelhyD.exe
  2⤵
  PID:14468
- C:\Windows\System\KxCgZCU.exe
  C:\Windows\System\KxCgZCU.exe
  2⤵
  PID:14488
- C:\Windows\System\odScvqc.exe
  C:\Windows\System\odScvqc.exe
  2⤵
  PID:14504
- C:\Windows\System\KWTMrXw.exe
  C:\Windows\System\KWTMrXw.exe
  2⤵
  PID:14532
- C:\Windows\System\OUZiAQq.exe
  C:\Windows\System\OUZiAQq.exe
  2⤵
  PID:14552
- C:\Windows\System\MaFXOtB.exe
  C:\Windows\System\MaFXOtB.exe
  2⤵
  PID:14572
- C:\Windows\System\mAgYnrF.exe
  C:\Windows\System\mAgYnrF.exe
  2⤵
  PID:14628
- C:\Windows\System\aDWQVfg.exe
  C:\Windows\System\aDWQVfg.exe
  2⤵
  PID:14644
- C:\Windows\System\rBGcVMU.exe
  C:\Windows\System\rBGcVMU.exe
  2⤵
  PID:14676
- C:\Windows\System\DTJJeEo.exe
  C:\Windows\System\DTJJeEo.exe
  2⤵
  PID:14696
- C:\Windows\System\zLoQGCo.exe
  C:\Windows\System\zLoQGCo.exe
  2⤵
  PID:14712
- C:\Windows\System\HtvXlpr.exe
  C:\Windows\System\HtvXlpr.exe
  2⤵
  PID:14744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w0r31odq.y1q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AXovFeb.exe

Filesize
1.9MB

MD5
ee0a26689d4463fa9d62c01683b8f315

SHA1
20551b4ee21e36621eeb32543bf402fa1204438a

SHA256
9e19c8f8cc732acdd35baf6152c7f1215e135f4421661cffef0d14c74bc76a03

SHA512
fc87b3e8b5552edbc8c304938a8f74de0e212dd09eaa84474619c3eec9594220b6660a4b6be3c6f6c194be28a220f6c055506c4e3a671bf65dff921a07cd74a4

Download Submit
C:\Windows\System\CkjNRpZ.exe

Filesize
1.9MB

MD5
b69f9e2e3ad816bf6b93156b92535369

SHA1
858ebf118030d4ada54ed48d8399a56e87dc9296

SHA256
54d51de0b93c3af46d3644cc5f47a218fe16f54e5b0a0194de8da67900c0da4f

SHA512
69b2a3e6364ddb9c813d15bee38f51642c548f75d8b5a6d83588a85a9b96a0cb261a8a02a0fd858cf5071925d9aee5fbe47a7c982205603ebe4c28651aebf61f

Download Submit
C:\Windows\System\EJsrDBh.exe

Filesize
1.9MB

MD5
d4def7edb655ed429b3159150b186c60

SHA1
b13a478cb2ce7235deccdcfb4e6cbe69211fa671

SHA256
e277fb18b0f1b9231ded68d47849f3931909a948888d96a28087d01606db094e

SHA512
b0fdb67470881a0263ea40fe7ac3aed9ca2ba3ef1141b7d033dea11f018cc723ca8f4860d0cf8994e933d15bdfb38de00e409280829fdd10010349b989cd9b13

Download Submit
C:\Windows\System\EOQRItz.exe

Filesize
1.9MB

MD5
d657aef8e4377f6d83dec0bf76a191fc

SHA1
d7a8aea991dd03926c89e7b738de4ecf47869cd7

SHA256
a1401db052d743de327ffa6fb9d528ecbee91a0cb73d0a8ef95ac635f7e008c2

SHA512
4d5886e59d1beef77faa42ec3add2c76891f5c54e2f7d29ab6bdf176ea84d03484886b1bb02f9cd27c447bd72176e612374998c3abfb50986b3868c6f72c273b

Download Submit
C:\Windows\System\EWxdeDd.exe

Filesize
1.9MB

MD5
21ee1c4840f662b4b7ec1e8c4c76201e

SHA1
59ae02e72dcec0999a8365a5b3cb72cb5040506e

SHA256
a7f6405c83d237f727488973b9e5fa6d7ed3503260a414a982b6395658a4f732

SHA512
4c43afa83166c92f19766db4cebaa72262dbf860e13994182f34e3d5747636eb642b85f03c537b86f9061b9660cac0bcff6889d88da2c0995986841edd4abfdc

Download Submit
C:\Windows\System\EpHHTgn.exe

Filesize
1.9MB

MD5
22bc5563fd74524a602228c44dfbf08f

SHA1
03d8d2ce0dc05cb7cfbcb7ea5648d36fb5580056

SHA256
13910592f42a0774c21fb082b6188f983678d44c263737ebd7b72a9d75ccdacc

SHA512
8b722381497e98fbe75b0ccbe74ebf9dd6e579bb40d0a410ec8149cabd72c8a2f0eb25027932d9d221093ea857247237d521b0662a4435272b5de098c4aae7ad

Download Submit
C:\Windows\System\FGBPDeH.exe

Filesize
1.9MB

MD5
5ba33c1910729cc5154e966f0c4c8db9

SHA1
f211979b8c1a5e868380686615cc425f85870932

SHA256
fc2d81b7bd44b3a03f37e756d0487cc9193a33f97984e536cedc844eddac8777

SHA512
5f2a421924f226fce6d6fce772cbfa202348393f9e55f6881637c79fc4154471756a0c14ebdcdee72ad9594e27b841bec37e042a00c0f2a557a29820207d3905

Download Submit
C:\Windows\System\GJWWKmg.exe

Filesize
1.9MB

MD5
c4701015c74ebdc07c4f842c3725459e

SHA1
f0d74c9c9d008689e2758d04df24dc84f5ade526

SHA256
570d7079f23c1293ea49a98edf64de9b45dfe0ea5320fb630554cf5bebfc32ed

SHA512
3f680220677dcd9dc896180dcd23f135ba9cb8f6a0d719e967e6146f2c40025a23419e5c99ad858b1fa2aa847dc22d3a88788d98075789cc31c4d7bc40fb0a0b

Download Submit
C:\Windows\System\GiJGkSX.exe

Filesize
1.9MB

MD5
8a6ac049c8975102aa9fb498b965b417

SHA1
135a688cdd23305f91ad5c3922ff09eaefd1d16e

SHA256
503023024ba2dc75a4f9bddec5185ec2e06160ea0052fd5f7ec9632fdb809edc

SHA512
68ae24804b49d34afb4cd394f68ea585a9bf50f80d91255062a5d3f9802455bb86b9ae81a21555147ae7a22b25f0194815a8a70391e0e60d70559328ce3122a4

Download Submit
C:\Windows\System\IKxmCqM.exe

Filesize
1.9MB

MD5
653d45d18ff386facd84a187ea91aa41

SHA1
b7936915077e8940d49a60a10b04191704379947

SHA256
8a1bd8286b008234268c4c6f219401dc8350e0eb83c020503faee6883d831430

SHA512
969ab6c34360b22201844aa4a56ed67e4bf10b98c112642bb21604f8c311f04292096b76f5767399c951aae9f73370091628b284e99b63fcfecd7176bf42feeb

Download Submit
C:\Windows\System\KpsobmF.exe

Filesize
1.9MB

MD5
f17540fac965350da06c79d3e4c64a50

SHA1
121a2acc466d5791b114625a51a84f09eba4973c

SHA256
b53ce8e47a19526c53031f675cf686033d4a4df568eb7f42d17d0c87628590d6

SHA512
9536a97d2d89ca5709c1f0701ac73d45eceec5b343e25935b362f3dea9b7bc16ca713eb69e6a60f3e9603dbd3f3e69f6e17299d0970411313c545e30cdd083ff

Download Submit
C:\Windows\System\SAatuDN.exe

Filesize
1.9MB

MD5
8d47a07b6781ae48f2a80fe52cffb464

SHA1
724c2d3ff8ba601bea7d0d575a95299315e1ad26

SHA256
fbe9cc0d6e92c12cb361a7d74ff83447993b5c103219a5c1f64be197f1172aae

SHA512
b0d8dd3e9d297f0072e24f5c54ec8cf76e2da920f7948f2ea9f45c51ef4c4a86db112327a15b95928ec6467556b6046e6b79fbc130c8386f26e98b0fde98f782

Download Submit
C:\Windows\System\UAWsEBL.exe

Filesize
1.9MB

MD5
9a508dbc6a9a06cf16d30d4694bd21a7

SHA1
106b2d6b30687f24412f9ad0001dc7d7778a8bc8

SHA256
d65d1b690ea4033abea16de91ff0ca895d92839a8f6383ea98f01e0f26808aef

SHA512
70d11c85a54955f8c5dd458d9d3c692efbbcc44f0d9924c98560a4480c881f8b20bce2d9fd1708b9eec63a9d7e8cf828203dc7eb70dd136b4aade9a116ea414b

Download Submit
C:\Windows\System\ULwIHkw.exe

Filesize
1.9MB

MD5
5dc01d8244a884051202c4841a61256c

SHA1
eb3d5ef7cbb8a714f46cbaff98894b78717fed7e

SHA256
a8eddc8c893e043e514d867fe366fa1a14f02efd207421780b0414fac9a4cea6

SHA512
29570e8b6a28b6900bd3ba33f77a627baab4f4d0b40f6b0e29c62ad6dd1b4a8693ce9b8d1419f40916b143b4c6998ef5a51ce376ea29d3d494ed65b79f59b64a

Download Submit
C:\Windows\System\UiRKhuw.exe

Filesize
1.9MB

MD5
138b177988714d61a9b722e863d18a01

SHA1
bd172fed06db11aee481fc812abde6579bb7182e

SHA256
9c257d10932abfa05b226b9eabc1b9360253ce98a87ecd2245981e351dbb4573

SHA512
70ffced60fee4261947e55e40b31343672800edbb90b664ba72ad9440c31f8f5c07573345ff40400c9e90ccad682e169a5257822f60ce5cda2b567836f04d083

Download Submit
C:\Windows\System\UlDBjXu.exe

Filesize
1.9MB

MD5
9731de3f2d49a77592500a71c2ad1026

SHA1
03d9d15886367d8143ae25be313457c226519f41

SHA256
103ba895ba8630b4a8ba2d0ac0c317296c742022dc66014eadc95c54969bf9b5

SHA512
62573e202685e1ae6843ac7e483fb801483af9dd8aab8b6b5b1a12721896bc113e385a737a602d6a0d5f2368a72fb7039e429107b94c33884128efb3aa6f1ef8

Download Submit
C:\Windows\System\UnvZqLj.exe

Filesize
1.9MB

MD5
f344af3023cb9114d9c85485b0f588a5

SHA1
36e63bdd1874a15e6e5a9d41cad29831c7b30df6

SHA256
cbe8e8e055f87c06b45c769528d9b1702d2e5af24a335c7980acb07656a78d12

SHA512
82c25710a1a0839590539aec485bb5c571f7b3915b7f46fa22a7faee83dd6469ea450f5804d4909b5098fb25c12fa82674e1ebdabdd36f1e6a8a44edc6785f8c

Download Submit
C:\Windows\System\WinjsTx.exe

Filesize
1.9MB

MD5
7158c5f9814ed5d411bfc42ca8520faa

SHA1
3d14b177d4d809644bed25e4d98e51b42e055dbd

SHA256
1b21c75b77edf4ff33bbf3de98fcdf5aece9720091237dde070b58fadb58a9c0

SHA512
1d9d55a03ada4198129fe9bd74ac4b0c5b730c89b0608559ffb8437ca43e7a3c4d4064201bcc79074494dea6850843a9177c792e84c6d043787d7e3480d0c3fc

Download Submit
C:\Windows\System\ZufguMJ.exe

Filesize
1.9MB

MD5
ee033a876e249014ffb8ba6e82688d8a

SHA1
f20fb315b0963ed243fde1073cd3eb577fbb6b0c

SHA256
199d1a5d8faaf05c5dafdf10e21effd23b451a950cd14d7186b71e2ac5b367b5

SHA512
ed80e6b41cf79163c53d428b334f6b279219bb3e8dff2a86214febcc093cfd398321ee476c371ef6d8f6c6d2271e4497205c6d159756b7937516171687e4e65f

Download Submit
C:\Windows\System\abhNtDl.exe

Filesize
1.9MB

MD5
862db434fd9b3f3a37a36a0a0797d926

SHA1
6b3ad0a937e12387c173c8f5300ab391550a0d1d

SHA256
8a6fed1a05b22c2e5978d6ac84d7b2228ea97e4650e8eca18b9c9cf15d3aed75

SHA512
89e1faa195b646ec3e6913970520fd6013ec13f58011bb21eaa42f6dc25b0f884dd5d1b77303ce47b3c1bdab24f892a05cc141d287d33d713b3ada3871824b14

Download Submit
C:\Windows\System\bPmXtyS.exe

Filesize
1.9MB

MD5
dc280ca0dd0a7757d84ab0df3d8f40b9

SHA1
03154e86ec7ce3b90933eecebc2cd0f44ad0c426

SHA256
81e234943ec74071b2e1b1ed8b008b5e7bbc728af8092a4cca50e18b42549a7b

SHA512
553249241c1ee21d4af38ba39a2f2d4d212afd2486d2684a587423ef85d8f999f2a86d1218fc2d182eb50f2e10367a54770fc8902326ac17f8841efc3541a4ee

Download Submit
C:\Windows\System\bZeJMNb.exe

Filesize
1.8MB

MD5
2314c2228a171ffbf1f982c4032cf514

SHA1
521cfbadbf33ef0bfe524da68ccfbe1d9798b47f

SHA256
876c1456d3be78c425e061757b77662064502ec7ee1bb36ad22400c7571c1fa9

SHA512
1b26698e44a1cff96976250e1ecf1b0892246229426d8b5f772275dbe3be19dfe93276b9d6703711c50697e32c722501fd5c9f0912af9315b69d34569380b526

Download Submit
C:\Windows\System\cJGBroQ.exe

Filesize
1.9MB

MD5
075a36da82316e14f42f6e7ec3645fd9

SHA1
992faa485fee771c02d28753a2d3399c52cc438e

SHA256
e5ff80d5107efd3709becb2390e8e501cb647a7b318bca9c4b581fa3e8bbaed1

SHA512
26606c81b6c68b25a8aebdbec674fc248bce887ccaaab83bbdf3beb15fdb0f62398fe90178ff2161b59415083f8516eb0c4f693c3e4240fc98e873438c34557a

Download Submit
C:\Windows\System\chFPiQB.exe

Filesize
1.9MB

MD5
2b0880832db621b569918c3f5ee8ee5d

SHA1
a0d22e023400ccc89accbe5ed137c75acfbac6eb

SHA256
52d00f1dc806f02bfe9b1814c04b885b04614a6c156299101286f88ed576f716

SHA512
50c1875dd778986db57cf96c9efd0b36cf6b6d85ca3c468c628d9ac923026e58daf354a244129f51e6b890ade4b0934cfaeb30bb1e8e1e7ad93811d287d51a10

Download Submit
C:\Windows\System\eJPDVmD.exe

Filesize
1.9MB

MD5
67fca89d53fcdf424604e8965532689b

SHA1
84eb10d31a50b8a7f59fc482c7a13ce7af4a02fe

SHA256
9d297e8c4fbe94bd80d18d57450c5e5dd0dc4da8b73ab0e64ef6daadce3532e7

SHA512
238c74e5511785f208764c17977f22e70e82efa7ca0d9bae62e7046ea249efb1d4129ff135ead2d8e933fdc757fda6edf3a56d7709a9e89795cd43157d254bf2

Download Submit
C:\Windows\System\fbeyBdG.exe

Filesize
1.9MB

MD5
0976bd64e6723daa846d8f4f165d75ef

SHA1
52a8e02f3cd160d5b1f3233640669044dc591329

SHA256
c1f70c554064ce9c731fe5918f21cd7e19d2f7f622322a33fdd569f971003097

SHA512
81fb431f2eba6ff4563be0a8a7c96aff883cf0c26834851e98cacb85507bcbe49accfae83d2c2d8cbf63be803277dcea67e15b448d03745c14f451a05e18ba94

Download Submit
C:\Windows\System\fpwOSkj.exe

Filesize
1.9MB

MD5
dea864ec01cd9b62fb9e5f68b9c5dad9

SHA1
8c2fa78b7473673680f33475cc49e17521b98cc9

SHA256
d6b1589f6083bddf40ce7e7cd5d40015e0681c7696e9bab94579b83644287c62

SHA512
441109135a4093c9172bf3180e432469c78737a66147e0f4f216e6ea0a5534ca13bc88a27ceb120d9a768a6bde5d528aa4499baed6aa4a676c546738e83c5552

Download Submit
C:\Windows\System\iiXAHWi.exe

Filesize
1.9MB

MD5
16562564bac328ef9cad57c404c0f3b9

SHA1
da5cf0d63ab69846459ce1f94a9689057f44905c

SHA256
fd93564438d731232c880d127a9b068357cb04a6192491e82e40503fe89fde28

SHA512
0a4200d1909380f5585027a33db73d7acdfda0e196f9e3c3b927b2df0c0f91ce95b5687cc8a58e641c1b761ce2d89785753b848b28fe507c107a4d927aaf2b2d

Download Submit
C:\Windows\System\jteThyW.exe

Filesize
1.9MB

MD5
9db40524d395a9fb2f92a6d02b5d1d35

SHA1
1f2e330eed78b83f55c5dda08ef056133b5f7c2f

SHA256
e9155bcb8381f4e931ac3d50fe952f36b86e5ef7ee5691a933c127c8da8da502

SHA512
aaaa971605484d0a261a9d151c40dbe3e6169cd506da1776b896b8cd557c72c60b12ba99c6b4917dda4233e481f995c806fec91266d701368ca45928b32c915b

Download Submit
C:\Windows\System\kcbiBPc.exe

Filesize
1.9MB

MD5
9505f21495f9212651a25d9040b90907

SHA1
da3f767517a72d2c8fe0eb8c17ca472b939fe5f6

SHA256
f7ee0d370e77152a2eca154ccf164c8031ea5f672db05583326774f318855056

SHA512
995fe831750c6999c173d538b82901a288406a24c86bfc9a19236e530070619f0539ea67969126743db75528767c8f518d8ffad0acaa729668b91d4c9f38bf07

Download Submit
C:\Windows\System\kwdqUiy.exe

Filesize
1.9MB

MD5
dddce9f635e065bd3c1f51cc424ac076

SHA1
f713f8ccb3e5dd7831acc6f1f94789c73ff8f077

SHA256
4c74c483415be42979e21ad818657ed60f292949b6d0e576b881ecb718090b2b

SHA512
56c8d697287963daed084cc80ea0408c957a49d95f262cbaf1351e672fa02268bc828e2c55505358824d825e33324c112f74550396c097af56edbf880064fe79

Download Submit
C:\Windows\System\niNHqsT.exe

Filesize
1.9MB

MD5
7fd84e69e54f600c6e4e6901ff660058

SHA1
6c1dd64a7a6b6843dc72026c78da2bd5e9247190

SHA256
94628188f00c0fb1ccbbd69d2e7b69342cf87cd4de9c55019a54e86ecb4f894c

SHA512
671cc4f111c78a8dfc30010e8930fbbc90bc94a0f99004e26afc87327551d3ff9060d4c74195853e2314b9963e21bd671b84af2a8273d75077dc847b15b31b78

Download Submit
C:\Windows\System\oTEDrKC.exe

Filesize
1.9MB

MD5
2548be7e60b92989e2aa44bde4845de1

SHA1
203472d8cf575a1508a3fdbb9c8749dcad91b58a

SHA256
f6dae69c9dadb41d94c3ec80ed0578fcca810fe15ddd19a4bf1d5f1e9fa485d7

SHA512
f60e68c2d3300989d955f6ca6131abb020e5ff4cdd14a836bb0c2153f8a4b31185f0f0bc9813e853e9682fb23b5841cff7f0de4109d3d4d240ce92633526ee1a

Download Submit
C:\Windows\System\sAcNWEO.exe

Filesize
1.9MB

MD5
d81bde216090bea036efeefff17c6474

SHA1
3c9bf8ca3d7f6bada12fa0b8f4cc5d3dcb86c71d

SHA256
60a637630c8d8f2578fa28ec7147fe3386988d6da1ecfb801a1820c2d4b83c56

SHA512
872b6d4006695e2830d8b9c56426576e5e7e7e022c3f39ca0dada21667703cff4b6776ef37104a3e151571fcafad00a711fddfe50ad5e483e7ece8e0534b96d4

Download Submit
C:\Windows\System\tJBfWtV.exe

Filesize
1.9MB

MD5
adbc047be2d36d1af3ba371946f68df0

SHA1
d29a541192c1560d72b47a8f166469701e7308ee

SHA256
ece576a30efbeef5251fdbd9a0e2884240502d8264eda312e63be380fa8ffe3a

SHA512
4c8ec927938a5dbe038d62487c37b0dfeab01c94f157b3ffc05465a533cce8df64f1fd00a194273dfda05e1b1996eaccc7f3b334fc8af1e2d09caf194990e4ca

Download Submit
C:\Windows\System\ukWYPAi.exe

Filesize
1.9MB

MD5
5996ea4a8e14018bb12f8e9cc98bae8f

SHA1
a129f6b2624cc876e2ea68f9c5e4e4b86786c69e

SHA256
a8e95ef9b0cf74d219c678c93678f6cbab35d5c19963aee7b369f29844a5000a

SHA512
7a52e6972a1234fbd14d574994dda595ceaeb92fde34d95ae395eae4b4ca15424169154acbcb34efb983e5bfb44c7d691edfa30c545da769e6d8ec0690cdd680

Download Submit
C:\Windows\System\wTkJjec.exe

Filesize
1.9MB

MD5
da139b151738b5b53b5cbdf5fdb6d66d

SHA1
39a520eae1b95e9030a1f8dd739f921a65015274

SHA256
d53de125836e7ca3562de2ec568be70ccb1c14b46164abf70fddaecfd72c0e08

SHA512
8d899dbd78fcd51be7590ecf26f8921f1dfdcb806450a1e6faf847ed5422e36c83ff01da7ee545c2210fc1d050ed49897c0b2fa2bd2ec2bad5edfd7587c8a279

Download Submit
C:\Windows\System\ykxIBzQ.exe

Filesize
1.9MB

MD5
3aa857c5ca81e223ee080222dd8457c7

SHA1
7f664b81c979c26c53e74f66cf6bffc8c5f51cc0

SHA256
a78b9c67708bcb6b7af48f8949a2dc6bb3b32c696db52c562dbb15c0c7f49016

SHA512
ef2af8bae1344b50db0bb5632de5ff876e0ae916a4b61fd24038f8b4e8fb845d3a2f15edbd87b844fd714da1eb6490c5f6e44bdd87ccd05e38814a8b96edd4ed

Download Submit
C:\Windows\System\zTjqcQW.exe

Filesize
8B

MD5
bbb5190eff45a62c43cde634094759c0

SHA1
45cda8be7c649ba00340a832715a0757e8ce9b9b

SHA256
4b7c7c791bd2893e065fd5e4934dccf3152aeac2fce4808132b05acefb80891a

SHA512
213d190bfff285fb6040740f8a61d201e24cba89077f90495986109a6840ce2f9df148c3ae6f113d24bbce88876d227a01aea3f25c0103630fa1669df46f16db

Download Submit
C:\Windows\System\zexuxNH.exe

Filesize
1.8MB

MD5
22af8c443e1cce4905a4a599a854631d

SHA1
50b9602804a6dccae37f0cbc0a814e14fc20e16f

SHA256
0f66c96f5515475cbc5641a440e211851fdcc8c9d34bfdb7428a4312edd98721

SHA512
57bddb2e1fcc6254a9e1a18cb6b4d3d8a745c97f9e30930ca2c842dc5c9f51fdf24207510656e5781a77bedd81159ebf879e217b7ad0690022f44fdc7db637be

Download Submit
memory/8-4244-0x00007FF68D120000-0x00007FF68D512000-memory.dmp

Filesize
3.9MB

Download
memory/8-370-0x00007FF68D120000-0x00007FF68D512000-memory.dmp

Filesize
3.9MB

Download
memory/208-367-0x00007FF736590000-0x00007FF736982000-memory.dmp

Filesize
3.9MB

Download
memory/208-4224-0x00007FF736590000-0x00007FF736982000-memory.dmp

Filesize
3.9MB

Download
memory/224-344-0x00007FF7A84C0000-0x00007FF7A88B2000-memory.dmp

Filesize
3.9MB

Download
memory/224-4222-0x00007FF7A84C0000-0x00007FF7A88B2000-memory.dmp

Filesize
3.9MB

Download
memory/452-4213-0x00007FF725A80000-0x00007FF725E72000-memory.dmp

Filesize
3.9MB

Download
memory/452-378-0x00007FF725A80000-0x00007FF725E72000-memory.dmp

Filesize
3.9MB

Download
memory/532-199-0x00007FF766940000-0x00007FF766D32000-memory.dmp

Filesize
3.9MB

Download
memory/532-4204-0x00007FF766940000-0x00007FF766D32000-memory.dmp

Filesize
3.9MB

Download
memory/912-4206-0x00007FF651390000-0x00007FF651782000-memory.dmp

Filesize
3.9MB

Download
memory/912-103-0x00007FF651390000-0x00007FF651782000-memory.dmp

Filesize
3.9MB

Download
memory/972-62-0x00007FF676890000-0x00007FF676C82000-memory.dmp

Filesize
3.9MB

Download
memory/972-4203-0x00007FF676890000-0x00007FF676C82000-memory.dmp

Filesize
3.9MB

Download
memory/1012-295-0x00007FF7D8090000-0x00007FF7D8482000-memory.dmp

Filesize
3.9MB

Download
memory/1012-4220-0x00007FF7D8090000-0x00007FF7D8482000-memory.dmp

Filesize
3.9MB

Download
memory/1116-4231-0x00007FF7EACD0000-0x00007FF7EB0C2000-memory.dmp

Filesize
3.9MB

Download
memory/1116-371-0x00007FF7EACD0000-0x00007FF7EB0C2000-memory.dmp

Filesize
3.9MB

Download
memory/1144-380-0x00007FF788B40000-0x00007FF788F32000-memory.dmp

Filesize
3.9MB

Download
memory/1144-4250-0x00007FF788B40000-0x00007FF788F32000-memory.dmp

Filesize
3.9MB

Download
memory/1204-1-0x0000019FD1030000-0x0000019FD1040000-memory.dmp

Filesize
64KB

Download
memory/1204-0-0x00007FF69EE50000-0x00007FF69F242000-memory.dmp

Filesize
3.9MB

Download
memory/1488-229-0x00007FF7AA580000-0x00007FF7AA972000-memory.dmp

Filesize
3.9MB

Download
memory/1488-4211-0x00007FF7AA580000-0x00007FF7AA972000-memory.dmp

Filesize
3.9MB

Download
memory/1848-369-0x00007FF7A1000000-0x00007FF7A13F2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-4249-0x00007FF7A1000000-0x00007FF7A13F2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-373-0x00007FF7D3B90000-0x00007FF7D3F82000-memory.dmp

Filesize
3.9MB

Download
memory/1956-4233-0x00007FF7D3B90000-0x00007FF7D3F82000-memory.dmp

Filesize
3.9MB

Download
memory/2420-374-0x00007FF6BFE70000-0x00007FF6C0262000-memory.dmp

Filesize
3.9MB

Download
memory/2420-4243-0x00007FF6BFE70000-0x00007FF6C0262000-memory.dmp

Filesize
3.9MB

Download
memory/3152-4236-0x00007FF721E30000-0x00007FF722222000-memory.dmp

Filesize
3.9MB

Download
memory/3152-296-0x00007FF721E30000-0x00007FF722222000-memory.dmp

Filesize
3.9MB

Download
memory/3228-200-0x00007FF607BB0000-0x00007FF607FA2000-memory.dmp

Filesize
3.9MB

Download
memory/3228-4214-0x00007FF607BB0000-0x00007FF607FA2000-memory.dmp

Filesize
3.9MB

Download
memory/3440-4199-0x00007FF684710000-0x00007FF684B02000-memory.dmp

Filesize
3.9MB

Download
memory/3440-154-0x00007FF684710000-0x00007FF684B02000-memory.dmp

Filesize
3.9MB

Download
memory/3592-52-0x00007FF8CD020000-0x00007FF8CDAE1000-memory.dmp

Filesize
10.8MB

Download
memory/3592-17-0x00007FF8CD023000-0x00007FF8CD025000-memory.dmp

Filesize
8KB

Download
memory/3592-376-0x00007FF8CD020000-0x00007FF8CDAE1000-memory.dmp

Filesize
10.8MB

Download
memory/3592-95-0x000001ECB0070000-0x000001ECB0092000-memory.dmp

Filesize
136KB

Download
memory/3776-377-0x00007FF60FAC0000-0x00007FF60FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/3776-4200-0x00007FF60FAC0000-0x00007FF60FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/3872-4216-0x00007FF6F8240000-0x00007FF6F8632000-memory.dmp

Filesize
3.9MB

Download
memory/3872-368-0x00007FF6F8240000-0x00007FF6F8632000-memory.dmp

Filesize
3.9MB

Download
memory/3944-4219-0x00007FF7B85F0000-0x00007FF7B89E2000-memory.dmp

Filesize
3.9MB

Download
memory/3944-379-0x00007FF7B85F0000-0x00007FF7B89E2000-memory.dmp

Filesize
3.9MB

Download
memory/4100-14-0x00007FF6AC6C0000-0x00007FF6ACAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4100-4194-0x00007FF6AC6C0000-0x00007FF6ACAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-375-0x00007FF79EB70000-0x00007FF79EF62000-memory.dmp

Filesize
3.9MB

Download
memory/4728-4196-0x00007FF79EB70000-0x00007FF79EF62000-memory.dmp

Filesize
3.9MB

Download
memory/4780-4241-0x00007FF6B32D0000-0x00007FF6B36C2000-memory.dmp

Filesize
3.9MB

Download
memory/4780-372-0x00007FF6B32D0000-0x00007FF6B36C2000-memory.dmp

Filesize
3.9MB

Download
memory/5012-4209-0x00007FF764A50000-0x00007FF764E42000-memory.dmp

Filesize
3.9MB

Download
memory/5012-270-0x00007FF764A50000-0x00007FF764E42000-memory.dmp

Filesize
3.9MB

Download