xmrig | 326c34f027603caacb14b06ffa4e366a71bef55f68bfc135a696f6a6198f166e

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 03:26 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2635c6e24c5e0499294ac08a27fbdb30N.exe
Size

1.7MB
MD5

2635c6e24c5e0499294ac08a27fbdb30
SHA1

9c6a1ba0fc0669bc821b27777e82d03bedc5e433
SHA256

326c34f027603caacb14b06ffa4e366a71bef55f68bfc135a696f6a6198f166e
SHA512

ecf67b29dd82d87c681fbf4efea2f1e1a0cb41f099b2f1a23b1c8482fcb98bea79ad300cf7a8188cf3769fd669ce3fecd2a4f553763e01e0be59bc4cf249d5ef
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXru5:Lz071uv4BPMkFfdgIZohteLMxRgu2m+e

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/2276-86-0x00007FF640F40000-0x00007FF641332000-memory.dmp	xmrig
behavioral2/memory/2960-208-0x00007FF7D0050000-0x00007FF7D0442000-memory.dmp	xmrig
behavioral2/memory/4780-351-0x00007FF6F47C0000-0x00007FF6F4BB2000-memory.dmp	xmrig
behavioral2/memory/1972-373-0x00007FF74DBF0000-0x00007FF74DFE2000-memory.dmp	xmrig
behavioral2/memory/4832-411-0x00007FF729840000-0x00007FF729C32000-memory.dmp	xmrig
behavioral2/memory/1904-430-0x00007FF664280000-0x00007FF664672000-memory.dmp	xmrig
behavioral2/memory/1508-429-0x00007FF771D20000-0x00007FF772112000-memory.dmp	xmrig
behavioral2/memory/4976-418-0x00007FF7122B0000-0x00007FF7126A2000-memory.dmp	xmrig
behavioral2/memory/4508-409-0x00007FF705060000-0x00007FF705452000-memory.dmp	xmrig
behavioral2/memory/3236-406-0x00007FF6095D0000-0x00007FF6099C2000-memory.dmp	xmrig
behavioral2/memory/4648-370-0x00007FF669780000-0x00007FF669B72000-memory.dmp	xmrig
behavioral2/memory/3252-315-0x00007FF717C00000-0x00007FF717FF2000-memory.dmp	xmrig
behavioral2/memory/1164-314-0x00007FF63CAA0000-0x00007FF63CE92000-memory.dmp	xmrig
behavioral2/memory/244-272-0x00007FF7399E0000-0x00007FF739DD2000-memory.dmp	xmrig
behavioral2/memory/4816-232-0x00007FF6A4570000-0x00007FF6A4962000-memory.dmp	xmrig
behavioral2/memory/216-209-0x00007FF6D9D20000-0x00007FF6DA112000-memory.dmp	xmrig
behavioral2/memory/2836-180-0x00007FF7E4E80000-0x00007FF7E5272000-memory.dmp	xmrig
behavioral2/memory/4180-20-0x00007FF6C55B0000-0x00007FF6C59A2000-memory.dmp	xmrig
behavioral2/memory/5032-3797-0x00007FF79C420000-0x00007FF79C812000-memory.dmp	xmrig
behavioral2/memory/2508-3805-0x00007FF6ADF40000-0x00007FF6AE332000-memory.dmp	xmrig
behavioral2/memory/2276-3804-0x00007FF640F40000-0x00007FF641332000-memory.dmp	xmrig
behavioral2/memory/2836-3811-0x00007FF7E4E80000-0x00007FF7E5272000-memory.dmp	xmrig
behavioral2/memory/4832-3815-0x00007FF729840000-0x00007FF729C32000-memory.dmp	xmrig
behavioral2/memory/4976-3823-0x00007FF7122B0000-0x00007FF7126A2000-memory.dmp	xmrig
behavioral2/memory/1364-3849-0x00007FF6851B0000-0x00007FF6855A2000-memory.dmp	xmrig
behavioral2/memory/4780-3867-0x00007FF6F47C0000-0x00007FF6F4BB2000-memory.dmp	xmrig
behavioral2/memory/1972-3863-0x00007FF74DBF0000-0x00007FF74DFE2000-memory.dmp	xmrig
behavioral2/memory/1508-3861-0x00007FF771D20000-0x00007FF772112000-memory.dmp	xmrig
behavioral2/memory/3252-3855-0x00007FF717C00000-0x00007FF717FF2000-memory.dmp	xmrig
behavioral2/memory/216-3853-0x00007FF6D9D20000-0x00007FF6DA112000-memory.dmp	xmrig
behavioral2/memory/1164-3845-0x00007FF63CAA0000-0x00007FF63CE92000-memory.dmp	xmrig
behavioral2/memory/4280-3841-0x00007FF6C4E70000-0x00007FF6C5262000-memory.dmp	xmrig
behavioral2/memory/4816-3835-0x00007FF6A4570000-0x00007FF6A4962000-memory.dmp	xmrig
behavioral2/memory/2960-3829-0x00007FF7D0050000-0x00007FF7D0442000-memory.dmp	xmrig
behavioral2/memory/1772-3817-0x00007FF7D78B0000-0x00007FF7D7CA2000-memory.dmp	xmrig
behavioral2/memory/1904-3884-0x00007FF664280000-0x00007FF664672000-memory.dmp	xmrig
behavioral2/memory/244-3891-0x00007FF7399E0000-0x00007FF739DD2000-memory.dmp	xmrig
behavioral2/memory/4648-3882-0x00007FF669780000-0x00007FF669B72000-memory.dmp	xmrig
behavioral2/memory/3236-4011-0x00007FF6095D0000-0x00007FF6099C2000-memory.dmp	xmrig
behavioral2/memory/956-4611-0x00007FF720760000-0x00007FF720B52000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2136	powershell.exe
5	2136	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2136	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1036	NRsQcqO.exe
4180	gIdNqiX.exe
4508	zJPrblT.exe
5032	nXATenV.exe
2508	RbCFEtA.exe
1772	zSAmooX.exe
4832	TzpVHwj.exe
4976	dxRVnlx.exe
2276	ITRFyOf.exe
4280	oOHRjcM.exe
1364	iVULsVr.exe
2836	KKeVajD.exe
2960	KnADDMh.exe
216	zLpMyQZ.exe
4816	GdwAZzc.exe
1508	YUanYvF.exe
244	TkfEIQX.exe
1164	UEUiMpy.exe
3252	vloWeJp.exe
4780	vznPqYt.exe
1904	amqdOhN.exe
4648	TGvmOKt.exe
1972	IQvPeoY.exe
3236	KXKcCAQ.exe
3464	sjSiEVu.exe
636	dcpDelM.exe
2696	hnNevrN.exe
3596	ZxQKQLO.exe
4912	uUWZzzd.exe
668	bDcXpOQ.exe
4376	PAmiicC.exe
4924	dfjYLzr.exe
5044	dRYAvCG.exe
3980	RomHnzE.exe
3140	qnGjtui.exe
4916	oVrpHiJ.exe
4784	nHjjDUE.exe
2912	IsIqhYU.exe
4856	UjRTKSD.exe
1668	fCXirsx.exe
3696	cPjrvNZ.exe
4216	zebeSYX.exe
1860	FeZUbgK.exe
1716	dfLSstp.exe
1724	OmWvJoI.exe
4008	WCygopj.exe
2808	QGgSgXN.exe
3020	laIAMvT.exe
4624	QMWXhzO.exe
2164	ywgUsOW.exe
3396	KsMIdIR.exe
1448	qIEQWxd.exe
3844	GcMlnJr.exe
4084	EEXJzfK.exe
2004	BCQLTcJ.exe
3068	ughOIBj.exe
808	KHnUtVW.exe
1868	UQSrOWE.exe
2928	QxUNbfl.exe
3612	fyLHpqa.exe
4400	AzkOUcC.exe
4520	vMWcEKJ.exe
456	RkOXFvO.exe
2568	JZEbaPS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/956-0-0x00007FF720760000-0x00007FF720B52000-memory.dmp	upx
behavioral2/files/0x000700000002345c-7.dat	upx
behavioral2/files/0x0006000000023252-5.dat	upx
behavioral2/files/0x0007000000023461-44.dat	upx
behavioral2/files/0x0007000000023465-59.dat	upx
behavioral2/files/0x000700000002345d-40.dat	upx
behavioral2/memory/2508-34-0x00007FF6ADF40000-0x00007FF6AE332000-memory.dmp	upx
behavioral2/files/0x0007000000023460-33.dat	upx
behavioral2/memory/5032-29-0x00007FF79C420000-0x00007FF79C812000-memory.dmp	upx
behavioral2/memory/2276-86-0x00007FF640F40000-0x00007FF641332000-memory.dmp	upx
behavioral2/files/0x000700000002346e-108.dat	upx
behavioral2/files/0x0007000000023476-149.dat	upx
behavioral2/memory/2960-208-0x00007FF7D0050000-0x00007FF7D0442000-memory.dmp	upx
behavioral2/memory/4780-351-0x00007FF6F47C0000-0x00007FF6F4BB2000-memory.dmp	upx
behavioral2/memory/1972-373-0x00007FF74DBF0000-0x00007FF74DFE2000-memory.dmp	upx
behavioral2/memory/4832-411-0x00007FF729840000-0x00007FF729C32000-memory.dmp	upx
behavioral2/memory/1904-430-0x00007FF664280000-0x00007FF664672000-memory.dmp	upx
behavioral2/memory/1508-429-0x00007FF771D20000-0x00007FF772112000-memory.dmp	upx
behavioral2/memory/4976-418-0x00007FF7122B0000-0x00007FF7126A2000-memory.dmp	upx
behavioral2/memory/4508-409-0x00007FF705060000-0x00007FF705452000-memory.dmp	upx
behavioral2/memory/3236-406-0x00007FF6095D0000-0x00007FF6099C2000-memory.dmp	upx
behavioral2/memory/4648-370-0x00007FF669780000-0x00007FF669B72000-memory.dmp	upx
behavioral2/memory/3252-315-0x00007FF717C00000-0x00007FF717FF2000-memory.dmp	upx
behavioral2/memory/1164-314-0x00007FF63CAA0000-0x00007FF63CE92000-memory.dmp	upx
behavioral2/memory/244-272-0x00007FF7399E0000-0x00007FF739DD2000-memory.dmp	upx
behavioral2/memory/4816-232-0x00007FF6A4570000-0x00007FF6A4962000-memory.dmp	upx
behavioral2/memory/216-209-0x00007FF6D9D20000-0x00007FF6DA112000-memory.dmp	upx
behavioral2/files/0x0007000000023481-183.dat	upx
behavioral2/memory/2836-180-0x00007FF7E4E80000-0x00007FF7E5272000-memory.dmp	upx
behavioral2/files/0x0007000000023480-179.dat	upx
behavioral2/files/0x000700000002347f-176.dat	upx
behavioral2/files/0x000700000002347e-173.dat	upx
behavioral2/files/0x000700000002347d-172.dat	upx
behavioral2/files/0x000700000002347c-171.dat	upx
behavioral2/files/0x0007000000023474-169.dat	upx
behavioral2/files/0x000700000002347b-168.dat	upx
behavioral2/files/0x000700000002347a-167.dat	upx
behavioral2/files/0x0007000000023473-165.dat	upx
behavioral2/files/0x0008000000023459-164.dat	upx
behavioral2/files/0x0007000000023479-162.dat	upx
behavioral2/files/0x0007000000023478-161.dat	upx
behavioral2/memory/1364-154-0x00007FF6851B0000-0x00007FF6855A2000-memory.dmp	upx
behavioral2/files/0x0007000000023477-153.dat	upx
behavioral2/files/0x0007000000023475-146.dat	upx
behavioral2/files/0x000700000002346d-141.dat	upx
behavioral2/files/0x000700000002346c-133.dat	upx
behavioral2/files/0x0007000000023472-123.dat	upx
behavioral2/files/0x0007000000023471-122.dat	upx
behavioral2/files/0x0007000000023470-121.dat	upx
behavioral2/files/0x0007000000023463-119.dat	upx
behavioral2/files/0x000700000002346f-117.dat	upx
behavioral2/files/0x0007000000023469-116.dat	upx
behavioral2/files/0x000700000002346a-157.dat	upx
behavioral2/memory/4280-114-0x00007FF6C4E70000-0x00007FF6C5262000-memory.dmp	upx
behavioral2/files/0x0007000000023468-107.dat	upx
behavioral2/files/0x0007000000023467-103.dat	upx
behavioral2/files/0x0007000000023464-99.dat	upx
behavioral2/files/0x0007000000023466-89.dat	upx
behavioral2/files/0x000700000002346b-88.dat	upx
behavioral2/memory/1772-83-0x00007FF7D78B0000-0x00007FF7D7CA2000-memory.dmp	upx
behavioral2/files/0x000700000002345f-74.dat	upx
behavioral2/files/0x000700000002345e-55.dat	upx
behavioral2/files/0x0007000000023462-49.dat	upx
behavioral2/memory/4180-20-0x00007FF6C55B0000-0x00007FF6C59A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PMYsAyR.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\UNuVFyL.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\RzFaMhf.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\XMxXZKk.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\kOBbGjW.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\AhKdjjF.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\fRyLxIJ.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\OnwSrZJ.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\JabPvHa.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\qFRzEuf.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\QolMXiE.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\KLztMds.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\pLhiOft.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\mRSkJZt.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\RTyOAnO.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\jswAynB.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\ADcfNEp.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\kjonCCP.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\jgfkaXW.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\HlWYoWH.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\DWgjHit.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\qlAOPEh.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\ZLcLdsR.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\BIcoaaB.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\wMQbUoe.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\IqGmUck.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\tkLjabo.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\vDCWUyS.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\IHedWrF.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\alqXPvp.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\IlqgEuQ.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\YeqjyoV.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\NzNDmVR.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\wNOUbtu.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\WaylsFz.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\xqxRPJY.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\CyEkoIU.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\MtuLeeG.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\OqmPTVC.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\prtEAQX.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\FKZxkxV.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\kugaKff.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\hCoBbux.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\CpWHpXJ.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\yXgxQbw.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\MfSAUck.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\YdGcZjO.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\bZEzCGw.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\iKKrmUu.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\LwSZdsa.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\pIbOSgI.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\SVYVqPL.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\EcdCgZl.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\pFMvnZE.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\SCGifDB.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\NZizKHe.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\piRCqmF.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\AezRIHG.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\rDhQogv.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\WmYuTdf.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\UBKTvmq.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\GvOfBvd.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\OPRlUjt.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\qIBWtQw.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2136	powershell.exe
2136	powershell.exe
2136	powershell.exe
2136	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeLockMemoryPrivilege	956	2635c6e24c5e0499294ac08a27fbdb30N.exe
Token: SeLockMemoryPrivilege	956	2635c6e24c5e0499294ac08a27fbdb30N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2136	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	83
PID 956 wrote to memory of 2136	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	83
PID 956 wrote to memory of 1036	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	84
PID 956 wrote to memory of 1036	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	84
PID 956 wrote to memory of 4180	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	85
PID 956 wrote to memory of 4180	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	85
PID 956 wrote to memory of 4508	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	87
PID 956 wrote to memory of 4508	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	87
PID 956 wrote to memory of 5032	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	88
PID 956 wrote to memory of 5032	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	88
PID 956 wrote to memory of 2508	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	89
PID 956 wrote to memory of 2508	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	89
PID 956 wrote to memory of 1772	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	90
PID 956 wrote to memory of 1772	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	90
PID 956 wrote to memory of 4832	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	91
PID 956 wrote to memory of 4832	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	91
PID 956 wrote to memory of 4976	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	92
PID 956 wrote to memory of 4976	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	92
PID 956 wrote to memory of 2276	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	93
PID 956 wrote to memory of 2276	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	93
PID 956 wrote to memory of 4280	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	94
PID 956 wrote to memory of 4280	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	94
PID 956 wrote to memory of 1364	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	95
PID 956 wrote to memory of 1364	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	95
PID 956 wrote to memory of 2836	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	96
PID 956 wrote to memory of 2836	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	96
PID 956 wrote to memory of 2960	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	97
PID 956 wrote to memory of 2960	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	97
PID 956 wrote to memory of 216	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	98
PID 956 wrote to memory of 216	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	98
PID 956 wrote to memory of 4816	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	99
PID 956 wrote to memory of 4816	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	99
PID 956 wrote to memory of 1904	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	100
PID 956 wrote to memory of 1904	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	100
PID 956 wrote to memory of 1508	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	101
PID 956 wrote to memory of 1508	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	101
PID 956 wrote to memory of 244	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	102
PID 956 wrote to memory of 244	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	102
PID 956 wrote to memory of 1164	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	103
PID 956 wrote to memory of 1164	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	103
PID 956 wrote to memory of 3252	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	104
PID 956 wrote to memory of 3252	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	104
PID 956 wrote to memory of 4780	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	105
PID 956 wrote to memory of 4780	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	105
PID 956 wrote to memory of 4648	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	106
PID 956 wrote to memory of 4648	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	106
PID 956 wrote to memory of 1972	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	107
PID 956 wrote to memory of 1972	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	107
PID 956 wrote to memory of 3236	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	108
PID 956 wrote to memory of 3236	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	108
PID 956 wrote to memory of 3464	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	109
PID 956 wrote to memory of 3464	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	109
PID 956 wrote to memory of 636	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	110
PID 956 wrote to memory of 636	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	110
PID 956 wrote to memory of 2696	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	111
PID 956 wrote to memory of 2696	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	111
PID 956 wrote to memory of 3596	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	112
PID 956 wrote to memory of 3596	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	112
PID 956 wrote to memory of 4912	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	113
PID 956 wrote to memory of 4912	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	113
PID 956 wrote to memory of 668	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	114
PID 956 wrote to memory of 668	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	114
PID 956 wrote to memory of 4376	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	115
PID 956 wrote to memory of 4376	956	2635c6e24c5e0499294ac08a27fbdb30N.exe	115

C:\Users\Admin\AppData\Local\Temp\2635c6e24c5e0499294ac08a27fbdb30N.exe
"C:\Users\Admin\AppData\Local\Temp\2635c6e24c5e0499294ac08a27fbdb30N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\System\NRsQcqO.exe
  C:\Windows\System\NRsQcqO.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\gIdNqiX.exe
  C:\Windows\System\gIdNqiX.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\zJPrblT.exe
  C:\Windows\System\zJPrblT.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\nXATenV.exe
  C:\Windows\System\nXATenV.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\RbCFEtA.exe
  C:\Windows\System\RbCFEtA.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\zSAmooX.exe
  C:\Windows\System\zSAmooX.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\TzpVHwj.exe
  C:\Windows\System\TzpVHwj.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\dxRVnlx.exe
  C:\Windows\System\dxRVnlx.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\ITRFyOf.exe
  C:\Windows\System\ITRFyOf.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\oOHRjcM.exe
  C:\Windows\System\oOHRjcM.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\iVULsVr.exe
  C:\Windows\System\iVULsVr.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\KKeVajD.exe
  C:\Windows\System\KKeVajD.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\KnADDMh.exe
  C:\Windows\System\KnADDMh.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\zLpMyQZ.exe
  C:\Windows\System\zLpMyQZ.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\GdwAZzc.exe
  C:\Windows\System\GdwAZzc.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\amqdOhN.exe
  C:\Windows\System\amqdOhN.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\YUanYvF.exe
  C:\Windows\System\YUanYvF.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\TkfEIQX.exe
  C:\Windows\System\TkfEIQX.exe
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Windows\System\UEUiMpy.exe
  C:\Windows\System\UEUiMpy.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\vloWeJp.exe
  C:\Windows\System\vloWeJp.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\vznPqYt.exe
  C:\Windows\System\vznPqYt.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\TGvmOKt.exe
  C:\Windows\System\TGvmOKt.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\IQvPeoY.exe
  C:\Windows\System\IQvPeoY.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\KXKcCAQ.exe
  C:\Windows\System\KXKcCAQ.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\sjSiEVu.exe
  C:\Windows\System\sjSiEVu.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\dcpDelM.exe
  C:\Windows\System\dcpDelM.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\hnNevrN.exe
  C:\Windows\System\hnNevrN.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ZxQKQLO.exe
  C:\Windows\System\ZxQKQLO.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\uUWZzzd.exe
  C:\Windows\System\uUWZzzd.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\bDcXpOQ.exe
  C:\Windows\System\bDcXpOQ.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\PAmiicC.exe
  C:\Windows\System\PAmiicC.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\dfjYLzr.exe
  C:\Windows\System\dfjYLzr.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\dRYAvCG.exe
  C:\Windows\System\dRYAvCG.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\RomHnzE.exe
  C:\Windows\System\RomHnzE.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\qnGjtui.exe
  C:\Windows\System\qnGjtui.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\oVrpHiJ.exe
  C:\Windows\System\oVrpHiJ.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\nHjjDUE.exe
  C:\Windows\System\nHjjDUE.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\IsIqhYU.exe
  C:\Windows\System\IsIqhYU.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\UjRTKSD.exe
  C:\Windows\System\UjRTKSD.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\fCXirsx.exe
  C:\Windows\System\fCXirsx.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\cPjrvNZ.exe
  C:\Windows\System\cPjrvNZ.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\zebeSYX.exe
  C:\Windows\System\zebeSYX.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\FeZUbgK.exe
  C:\Windows\System\FeZUbgK.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\dfLSstp.exe
  C:\Windows\System\dfLSstp.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\OmWvJoI.exe
  C:\Windows\System\OmWvJoI.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\WCygopj.exe
  C:\Windows\System\WCygopj.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\QGgSgXN.exe
  C:\Windows\System\QGgSgXN.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\laIAMvT.exe
  C:\Windows\System\laIAMvT.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\QMWXhzO.exe
  C:\Windows\System\QMWXhzO.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\ywgUsOW.exe
  C:\Windows\System\ywgUsOW.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\KsMIdIR.exe
  C:\Windows\System\KsMIdIR.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\qIEQWxd.exe
  C:\Windows\System\qIEQWxd.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\GcMlnJr.exe
  C:\Windows\System\GcMlnJr.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\EEXJzfK.exe
  C:\Windows\System\EEXJzfK.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\BCQLTcJ.exe
  C:\Windows\System\BCQLTcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\ughOIBj.exe
  C:\Windows\System\ughOIBj.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\KHnUtVW.exe
  C:\Windows\System\KHnUtVW.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\UQSrOWE.exe
  C:\Windows\System\UQSrOWE.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\QxUNbfl.exe
  C:\Windows\System\QxUNbfl.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\fyLHpqa.exe
  C:\Windows\System\fyLHpqa.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\AzkOUcC.exe
  C:\Windows\System\AzkOUcC.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\vMWcEKJ.exe
  C:\Windows\System\vMWcEKJ.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\RkOXFvO.exe
  C:\Windows\System\RkOXFvO.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\JZEbaPS.exe
  C:\Windows\System\JZEbaPS.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\CmVPeDH.exe
  C:\Windows\System\CmVPeDH.exe
  2⤵
  PID:1532
- C:\Windows\System\uqEqWnr.exe
  C:\Windows\System\uqEqWnr.exe
  2⤵
  PID:3548
- C:\Windows\System\NvxDlRr.exe
  C:\Windows\System\NvxDlRr.exe
  2⤵
  PID:3460
- C:\Windows\System\vkCKUGR.exe
  C:\Windows\System\vkCKUGR.exe
  2⤵
  PID:1788
- C:\Windows\System\HvQFozd.exe
  C:\Windows\System\HvQFozd.exe
  2⤵
  PID:3636
- C:\Windows\System\mnBqkqx.exe
  C:\Windows\System\mnBqkqx.exe
  2⤵
  PID:100
- C:\Windows\System\JSZEIRv.exe
  C:\Windows\System\JSZEIRv.exe
  2⤵
  PID:1820
- C:\Windows\System\blgNXwm.exe
  C:\Windows\System\blgNXwm.exe
  2⤵
  PID:1444
- C:\Windows\System\RwPqEPs.exe
  C:\Windows\System\RwPqEPs.exe
  2⤵
  PID:4792
- C:\Windows\System\WoyOFqa.exe
  C:\Windows\System\WoyOFqa.exe
  2⤵
  PID:2268
- C:\Windows\System\PUywjrm.exe
  C:\Windows\System\PUywjrm.exe
  2⤵
  PID:1236
- C:\Windows\System\gAULkXW.exe
  C:\Windows\System\gAULkXW.exe
  2⤵
  PID:3144
- C:\Windows\System\GTpnmbQ.exe
  C:\Windows\System\GTpnmbQ.exe
  2⤵
  PID:1016
- C:\Windows\System\TaOxZFi.exe
  C:\Windows\System\TaOxZFi.exe
  2⤵
  PID:4536
- C:\Windows\System\dCHWUZH.exe
  C:\Windows\System\dCHWUZH.exe
  2⤵
  PID:2344
- C:\Windows\System\hNKkoUX.exe
  C:\Windows\System\hNKkoUX.exe
  2⤵
  PID:1180
- C:\Windows\System\QfdIXXo.exe
  C:\Windows\System\QfdIXXo.exe
  2⤵
  PID:4296
- C:\Windows\System\SIifDwS.exe
  C:\Windows\System\SIifDwS.exe
  2⤵
  PID:3868
- C:\Windows\System\AXhFPGg.exe
  C:\Windows\System\AXhFPGg.exe
  2⤵
  PID:4848
- C:\Windows\System\HWrkncr.exe
  C:\Windows\System\HWrkncr.exe
  2⤵
  PID:4108
- C:\Windows\System\xsBgQYA.exe
  C:\Windows\System\xsBgQYA.exe
  2⤵
  PID:4880
- C:\Windows\System\QNSryzI.exe
  C:\Windows\System\QNSryzI.exe
  2⤵
  PID:4052
- C:\Windows\System\ZOXkZDL.exe
  C:\Windows\System\ZOXkZDL.exe
  2⤵
  PID:1440
- C:\Windows\System\xOeWUnI.exe
  C:\Windows\System\xOeWUnI.exe
  2⤵
  PID:1536
- C:\Windows\System\AzwxMBV.exe
  C:\Windows\System\AzwxMBV.exe
  2⤵
  PID:5204
- C:\Windows\System\qBlmDbW.exe
  C:\Windows\System\qBlmDbW.exe
  2⤵
  PID:5228
- C:\Windows\System\DuVtKpA.exe
  C:\Windows\System\DuVtKpA.exe
  2⤵
  PID:5252
- C:\Windows\System\GxFyHzr.exe
  C:\Windows\System\GxFyHzr.exe
  2⤵
  PID:5276
- C:\Windows\System\EunvWZM.exe
  C:\Windows\System\EunvWZM.exe
  2⤵
  PID:5316
- C:\Windows\System\LVYdeaa.exe
  C:\Windows\System\LVYdeaa.exe
  2⤵
  PID:5340
- C:\Windows\System\IWbNVAJ.exe
  C:\Windows\System\IWbNVAJ.exe
  2⤵
  PID:5356
- C:\Windows\System\PkAgHgb.exe
  C:\Windows\System\PkAgHgb.exe
  2⤵
  PID:5384
- C:\Windows\System\VIvzsuY.exe
  C:\Windows\System\VIvzsuY.exe
  2⤵
  PID:5400
- C:\Windows\System\PZNyDVs.exe
  C:\Windows\System\PZNyDVs.exe
  2⤵
  PID:5576
- C:\Windows\System\PkUMDWi.exe
  C:\Windows\System\PkUMDWi.exe
  2⤵
  PID:5592
- C:\Windows\System\XPrgdcU.exe
  C:\Windows\System\XPrgdcU.exe
  2⤵
  PID:5612
- C:\Windows\System\Kzjzlgw.exe
  C:\Windows\System\Kzjzlgw.exe
  2⤵
  PID:5632
- C:\Windows\System\BHzmrlx.exe
  C:\Windows\System\BHzmrlx.exe
  2⤵
  PID:5652
- C:\Windows\System\bVikcXB.exe
  C:\Windows\System\bVikcXB.exe
  2⤵
  PID:5680
- C:\Windows\System\QAOnSkb.exe
  C:\Windows\System\QAOnSkb.exe
  2⤵
  PID:5700
- C:\Windows\System\EPZiBnM.exe
  C:\Windows\System\EPZiBnM.exe
  2⤵
  PID:5720
- C:\Windows\System\KwzCSrV.exe
  C:\Windows\System\KwzCSrV.exe
  2⤵
  PID:5752
- C:\Windows\System\bThYsfr.exe
  C:\Windows\System\bThYsfr.exe
  2⤵
  PID:5780
- C:\Windows\System\YVOnaCe.exe
  C:\Windows\System\YVOnaCe.exe
  2⤵
  PID:5796
- C:\Windows\System\Kdbcdnv.exe
  C:\Windows\System\Kdbcdnv.exe
  2⤵
  PID:5820
- C:\Windows\System\jpXHkDZ.exe
  C:\Windows\System\jpXHkDZ.exe
  2⤵
  PID:5844
- C:\Windows\System\CgFESML.exe
  C:\Windows\System\CgFESML.exe
  2⤵
  PID:5868
- C:\Windows\System\BfGWYAL.exe
  C:\Windows\System\BfGWYAL.exe
  2⤵
  PID:5884
- C:\Windows\System\acQsaio.exe
  C:\Windows\System\acQsaio.exe
  2⤵
  PID:5908
- C:\Windows\System\wbzEnHp.exe
  C:\Windows\System\wbzEnHp.exe
  2⤵
  PID:5416
- C:\Windows\System\RBJMVJD.exe
  C:\Windows\System\RBJMVJD.exe
  2⤵
  PID:4972
- C:\Windows\System\wCdvVDf.exe
  C:\Windows\System\wCdvVDf.exe
  2⤵
  PID:228
- C:\Windows\System\hKLZjnZ.exe
  C:\Windows\System\hKLZjnZ.exe
  2⤵
  PID:3368
- C:\Windows\System\PpcPHGP.exe
  C:\Windows\System\PpcPHGP.exe
  2⤵
  PID:2332
- C:\Windows\System\zIoarkN.exe
  C:\Windows\System\zIoarkN.exe
  2⤵
  PID:1200
- C:\Windows\System\vtoBnTk.exe
  C:\Windows\System\vtoBnTk.exe
  2⤵
  PID:4704
- C:\Windows\System\yrlyBGX.exe
  C:\Windows\System\yrlyBGX.exe
  2⤵
  PID:540
- C:\Windows\System\ZSchxFK.exe
  C:\Windows\System\ZSchxFK.exe
  2⤵
  PID:4992
- C:\Windows\System\DhygwDz.exe
  C:\Windows\System\DhygwDz.exe
  2⤵
  PID:4900
- C:\Windows\System\EfSalGh.exe
  C:\Windows\System\EfSalGh.exe
  2⤵
  PID:232
- C:\Windows\System\JMpmTCa.exe
  C:\Windows\System\JMpmTCa.exe
  2⤵
  PID:4676
- C:\Windows\System\LumVavx.exe
  C:\Windows\System\LumVavx.exe
  2⤵
  PID:2768
- C:\Windows\System\opmCkrE.exe
  C:\Windows\System\opmCkrE.exe
  2⤵
  PID:5168
- C:\Windows\System\lDOydlt.exe
  C:\Windows\System\lDOydlt.exe
  2⤵
  PID:5200
- C:\Windows\System\InjUuqI.exe
  C:\Windows\System\InjUuqI.exe
  2⤵
  PID:5236
- C:\Windows\System\zFCGHwP.exe
  C:\Windows\System\zFCGHwP.exe
  2⤵
  PID:5268
- C:\Windows\System\BXPBzIM.exe
  C:\Windows\System\BXPBzIM.exe
  2⤵
  PID:5300
- C:\Windows\System\boiitWD.exe
  C:\Windows\System\boiitWD.exe
  2⤵
  PID:5336
- C:\Windows\System\oQpUspg.exe
  C:\Windows\System\oQpUspg.exe
  2⤵
  PID:5376
- C:\Windows\System\dMPymiN.exe
  C:\Windows\System\dMPymiN.exe
  2⤵
  PID:5852
- C:\Windows\System\Ikefbea.exe
  C:\Windows\System\Ikefbea.exe
  2⤵
  PID:5816
- C:\Windows\System\PzCkmjo.exe
  C:\Windows\System\PzCkmjo.exe
  2⤵
  PID:5788
- C:\Windows\System\OhWDshF.exe
  C:\Windows\System\OhWDshF.exe
  2⤵
  PID:5748
- C:\Windows\System\PPcVSDC.exe
  C:\Windows\System\PPcVSDC.exe
  2⤵
  PID:5716
- C:\Windows\System\OdfDeYW.exe
  C:\Windows\System\OdfDeYW.exe
  2⤵
  PID:5676
- C:\Windows\System\HJshEdU.exe
  C:\Windows\System\HJshEdU.exe
  2⤵
  PID:5644
- C:\Windows\System\tswSiCd.exe
  C:\Windows\System\tswSiCd.exe
  2⤵
  PID:5608
- C:\Windows\System\UyLWOAB.exe
  C:\Windows\System\UyLWOAB.exe
  2⤵
  PID:5584
- C:\Windows\System\deLkVhE.exe
  C:\Windows\System\deLkVhE.exe
  2⤵
  PID:6164
- C:\Windows\System\mfeynDv.exe
  C:\Windows\System\mfeynDv.exe
  2⤵
  PID:6184
- C:\Windows\System\QtSVnkl.exe
  C:\Windows\System\QtSVnkl.exe
  2⤵
  PID:6204
- C:\Windows\System\sdxQXwF.exe
  C:\Windows\System\sdxQXwF.exe
  2⤵
  PID:6224
- C:\Windows\System\GTCTCbi.exe
  C:\Windows\System\GTCTCbi.exe
  2⤵
  PID:6244
- C:\Windows\System\oGuXipR.exe
  C:\Windows\System\oGuXipR.exe
  2⤵
  PID:6268
- C:\Windows\System\lySMWcV.exe
  C:\Windows\System\lySMWcV.exe
  2⤵
  PID:6288
- C:\Windows\System\dwSRpxV.exe
  C:\Windows\System\dwSRpxV.exe
  2⤵
  PID:6312
- C:\Windows\System\vnnFdoQ.exe
  C:\Windows\System\vnnFdoQ.exe
  2⤵
  PID:6328
- C:\Windows\System\ZOZaXpO.exe
  C:\Windows\System\ZOZaXpO.exe
  2⤵
  PID:6352
- C:\Windows\System\sLSZxDE.exe
  C:\Windows\System\sLSZxDE.exe
  2⤵
  PID:6368
- C:\Windows\System\IHNIoce.exe
  C:\Windows\System\IHNIoce.exe
  2⤵
  PID:6400
- C:\Windows\System\YaPXZLA.exe
  C:\Windows\System\YaPXZLA.exe
  2⤵
  PID:6424
- C:\Windows\System\kywbYUD.exe
  C:\Windows\System\kywbYUD.exe
  2⤵
  PID:6444
- C:\Windows\System\bqUzZfY.exe
  C:\Windows\System\bqUzZfY.exe
  2⤵
  PID:6468
- C:\Windows\System\afBoYkc.exe
  C:\Windows\System\afBoYkc.exe
  2⤵
  PID:6492
- C:\Windows\System\FoOgiur.exe
  C:\Windows\System\FoOgiur.exe
  2⤵
  PID:6508
- C:\Windows\System\YiELDIl.exe
  C:\Windows\System\YiELDIl.exe
  2⤵
  PID:6528
- C:\Windows\System\NfIgbbc.exe
  C:\Windows\System\NfIgbbc.exe
  2⤵
  PID:6544
- C:\Windows\System\nTSLAuo.exe
  C:\Windows\System\nTSLAuo.exe
  2⤵
  PID:6564
- C:\Windows\System\GfFzdFI.exe
  C:\Windows\System\GfFzdFI.exe
  2⤵
  PID:6840
- C:\Windows\System\JJVwAHG.exe
  C:\Windows\System\JJVwAHG.exe
  2⤵
  PID:6868
- C:\Windows\System\opCRcER.exe
  C:\Windows\System\opCRcER.exe
  2⤵
  PID:6888
- C:\Windows\System\ulDjswt.exe
  C:\Windows\System\ulDjswt.exe
  2⤵
  PID:6908
- C:\Windows\System\FzHBsaS.exe
  C:\Windows\System\FzHBsaS.exe
  2⤵
  PID:6928
- C:\Windows\System\rFgbCje.exe
  C:\Windows\System\rFgbCje.exe
  2⤵
  PID:7000
- C:\Windows\System\pYVCbmv.exe
  C:\Windows\System\pYVCbmv.exe
  2⤵
  PID:7016
- C:\Windows\System\gcPVxOP.exe
  C:\Windows\System\gcPVxOP.exe
  2⤵
  PID:7032
- C:\Windows\System\AZXaVHS.exe
  C:\Windows\System\AZXaVHS.exe
  2⤵
  PID:7048
- C:\Windows\System\rCiXLNO.exe
  C:\Windows\System\rCiXLNO.exe
  2⤵
  PID:7064
- C:\Windows\System\IpeJJmI.exe
  C:\Windows\System\IpeJJmI.exe
  2⤵
  PID:7080
- C:\Windows\System\kYtiqWm.exe
  C:\Windows\System\kYtiqWm.exe
  2⤵
  PID:7096
- C:\Windows\System\zOIvayU.exe
  C:\Windows\System\zOIvayU.exe
  2⤵
  PID:7112
- C:\Windows\System\kBvHEpV.exe
  C:\Windows\System\kBvHEpV.exe
  2⤵
  PID:7128
- C:\Windows\System\opPBuBF.exe
  C:\Windows\System\opPBuBF.exe
  2⤵
  PID:7144
- C:\Windows\System\NDJTqmN.exe
  C:\Windows\System\NDJTqmN.exe
  2⤵
  PID:7160
- C:\Windows\System\ykYvQRu.exe
  C:\Windows\System\ykYvQRu.exe
  2⤵
  PID:220
- C:\Windows\System\rIXmDac.exe
  C:\Windows\System\rIXmDac.exe
  2⤵
  PID:552
- C:\Windows\System\uxycQdF.exe
  C:\Windows\System\uxycQdF.exe
  2⤵
  PID:1852
- C:\Windows\System\utCZMDg.exe
  C:\Windows\System\utCZMDg.exe
  2⤵
  PID:3592
- C:\Windows\System\BttuYKY.exe
  C:\Windows\System\BttuYKY.exe
  2⤵
  PID:3952
- C:\Windows\System\TczzxoW.exe
  C:\Windows\System\TczzxoW.exe
  2⤵
  PID:1516
- C:\Windows\System\GyjLMpT.exe
  C:\Windows\System\GyjLMpT.exe
  2⤵
  PID:5192
- C:\Windows\System\pJFHVoI.exe
  C:\Windows\System\pJFHVoI.exe
  2⤵
  PID:5312
- C:\Windows\System\duGpVGh.exe
  C:\Windows\System\duGpVGh.exe
  2⤵
  PID:5876
- C:\Windows\System\SDNNgAX.exe
  C:\Windows\System\SDNNgAX.exe
  2⤵
  PID:5812
- C:\Windows\System\PDxjKDS.exe
  C:\Windows\System\PDxjKDS.exe
  2⤵
  PID:5740
- C:\Windows\System\qETqROM.exe
  C:\Windows\System\qETqROM.exe
  2⤵
  PID:6264
- C:\Windows\System\wYzWMQa.exe
  C:\Windows\System\wYzWMQa.exe
  2⤵
  PID:6324
- C:\Windows\System\PGYDzIN.exe
  C:\Windows\System\PGYDzIN.exe
  2⤵
  PID:6360
- C:\Windows\System\WnigEOM.exe
  C:\Windows\System\WnigEOM.exe
  2⤵
  PID:6408
- C:\Windows\System\mqzMbVY.exe
  C:\Windows\System\mqzMbVY.exe
  2⤵
  PID:6452
- C:\Windows\System\ygfSKgG.exe
  C:\Windows\System\ygfSKgG.exe
  2⤵
  PID:6500
- C:\Windows\System\AwaeXQd.exe
  C:\Windows\System\AwaeXQd.exe
  2⤵
  PID:6524
- C:\Windows\System\eiVRArH.exe
  C:\Windows\System\eiVRArH.exe
  2⤵
  PID:6560
- C:\Windows\System\cwxnuzt.exe
  C:\Windows\System\cwxnuzt.exe
  2⤵
  PID:7008
- C:\Windows\System\rWgbEqd.exe
  C:\Windows\System\rWgbEqd.exe
  2⤵
  PID:6768
- C:\Windows\System\VaPZiOI.exe
  C:\Windows\System\VaPZiOI.exe
  2⤵
  PID:6488
- C:\Windows\System\mNGFKiN.exe
  C:\Windows\System\mNGFKiN.exe
  2⤵
  PID:6896
- C:\Windows\System\qgerrQz.exe
  C:\Windows\System\qgerrQz.exe
  2⤵
  PID:6752
- C:\Windows\System\TQjxpKn.exe
  C:\Windows\System\TQjxpKn.exe
  2⤵
  PID:3872
- C:\Windows\System\OihliQW.exe
  C:\Windows\System\OihliQW.exe
  2⤵
  PID:7140
- C:\Windows\System\DnjEyYC.exe
  C:\Windows\System\DnjEyYC.exe
  2⤵
  PID:3312
- C:\Windows\System\tVufdQg.exe
  C:\Windows\System\tVufdQg.exe
  2⤵
  PID:1032
- C:\Windows\System\NWoTsyV.exe
  C:\Windows\System\NWoTsyV.exe
  2⤵
  PID:4692
- C:\Windows\System\yFBONdr.exe
  C:\Windows\System\yFBONdr.exe
  2⤵
  PID:1312
- C:\Windows\System\kcjXqKy.exe
  C:\Windows\System\kcjXqKy.exe
  2⤵
  PID:3384
- C:\Windows\System\HdbQiEe.exe
  C:\Windows\System\HdbQiEe.exe
  2⤵
  PID:372
- C:\Windows\System\zoRPuXS.exe
  C:\Windows\System\zoRPuXS.exe
  2⤵
  PID:1548
- C:\Windows\System\otjHvbJ.exe
  C:\Windows\System\otjHvbJ.exe
  2⤵
  PID:2140
- C:\Windows\System\vuqKsUT.exe
  C:\Windows\System\vuqKsUT.exe
  2⤵
  PID:3852
- C:\Windows\System\eejLNIN.exe
  C:\Windows\System\eejLNIN.exe
  2⤵
  PID:1616
- C:\Windows\System\NMYrEXQ.exe
  C:\Windows\System\NMYrEXQ.exe
  2⤵
  PID:992
- C:\Windows\System\kUQJlGM.exe
  C:\Windows\System\kUQJlGM.exe
  2⤵
  PID:1588
- C:\Windows\System\cGdNZrO.exe
  C:\Windows\System\cGdNZrO.exe
  2⤵
  PID:2572
- C:\Windows\System\QPEdmxb.exe
  C:\Windows\System\QPEdmxb.exe
  2⤵
  PID:3532
- C:\Windows\System\zotEoMa.exe
  C:\Windows\System\zotEoMa.exe
  2⤵
  PID:800
- C:\Windows\System\WtkwYvf.exe
  C:\Windows\System\WtkwYvf.exe
  2⤵
  PID:1828
- C:\Windows\System\BrUusMs.exe
  C:\Windows\System\BrUusMs.exe
  2⤵
  PID:5628
- C:\Windows\System\elrEdAs.exe
  C:\Windows\System\elrEdAs.exe
  2⤵
  PID:3176
- C:\Windows\System\HeRxyeB.exe
  C:\Windows\System\HeRxyeB.exe
  2⤵
  PID:4860
- C:\Windows\System\baOcMVH.exe
  C:\Windows\System\baOcMVH.exe
  2⤵
  PID:5620
- C:\Windows\System\NhSNgmL.exe
  C:\Windows\System\NhSNgmL.exe
  2⤵
  PID:5560
- C:\Windows\System\lWXCkGW.exe
  C:\Windows\System\lWXCkGW.exe
  2⤵
  PID:6816
- C:\Windows\System\ybNhYEX.exe
  C:\Windows\System\ybNhYEX.exe
  2⤵
  PID:4904
- C:\Windows\System\kPYtSTU.exe
  C:\Windows\System\kPYtSTU.exe
  2⤵
  PID:2728
- C:\Windows\System\LEwxiLf.exe
  C:\Windows\System\LEwxiLf.exe
  2⤵
  PID:7108
- C:\Windows\System\HPdsUMk.exe
  C:\Windows\System\HPdsUMk.exe
  2⤵
  PID:4288
- C:\Windows\System\MtuLeeG.exe
  C:\Windows\System\MtuLeeG.exe
  2⤵
  PID:3032
- C:\Windows\System\oHZimNe.exe
  C:\Windows\System\oHZimNe.exe
  2⤵
  PID:7184
- C:\Windows\System\OUCyezN.exe
  C:\Windows\System\OUCyezN.exe
  2⤵
  PID:7200
- C:\Windows\System\gqBWVJG.exe
  C:\Windows\System\gqBWVJG.exe
  2⤵
  PID:7220
- C:\Windows\System\aoprelF.exe
  C:\Windows\System\aoprelF.exe
  2⤵
  PID:7248
- C:\Windows\System\myQlWdl.exe
  C:\Windows\System\myQlWdl.exe
  2⤵
  PID:7264
- C:\Windows\System\cDhfRMG.exe
  C:\Windows\System\cDhfRMG.exe
  2⤵
  PID:7288
- C:\Windows\System\tHtdOLz.exe
  C:\Windows\System\tHtdOLz.exe
  2⤵
  PID:7308
- C:\Windows\System\dQrawOk.exe
  C:\Windows\System\dQrawOk.exe
  2⤵
  PID:7328
- C:\Windows\System\VosfFNI.exe
  C:\Windows\System\VosfFNI.exe
  2⤵
  PID:7344
- C:\Windows\System\yBDEzDJ.exe
  C:\Windows\System\yBDEzDJ.exe
  2⤵
  PID:7368
- C:\Windows\System\LBzEuKy.exe
  C:\Windows\System\LBzEuKy.exe
  2⤵
  PID:7388
- C:\Windows\System\ZgvhnVO.exe
  C:\Windows\System\ZgvhnVO.exe
  2⤵
  PID:7404
- C:\Windows\System\pCWOcPo.exe
  C:\Windows\System\pCWOcPo.exe
  2⤵
  PID:7428
- C:\Windows\System\xaoZECp.exe
  C:\Windows\System\xaoZECp.exe
  2⤵
  PID:7452
- C:\Windows\System\GZmHklc.exe
  C:\Windows\System\GZmHklc.exe
  2⤵
  PID:7472
- C:\Windows\System\renyYOZ.exe
  C:\Windows\System\renyYOZ.exe
  2⤵
  PID:7496
- C:\Windows\System\AhUPsml.exe
  C:\Windows\System\AhUPsml.exe
  2⤵
  PID:7516
- C:\Windows\System\SJLCRJX.exe
  C:\Windows\System\SJLCRJX.exe
  2⤵
  PID:7536
- C:\Windows\System\uaKzork.exe
  C:\Windows\System\uaKzork.exe
  2⤵
  PID:7568
- C:\Windows\System\tJeEzZp.exe
  C:\Windows\System\tJeEzZp.exe
  2⤵
  PID:7592
- C:\Windows\System\cGqsVAL.exe
  C:\Windows\System\cGqsVAL.exe
  2⤵
  PID:7612
- C:\Windows\System\MDIEdtD.exe
  C:\Windows\System\MDIEdtD.exe
  2⤵
  PID:7632
- C:\Windows\System\eyConeb.exe
  C:\Windows\System\eyConeb.exe
  2⤵
  PID:7652
- C:\Windows\System\LYFXran.exe
  C:\Windows\System\LYFXran.exe
  2⤵
  PID:7672
- C:\Windows\System\rzUspue.exe
  C:\Windows\System\rzUspue.exe
  2⤵
  PID:7692
- C:\Windows\System\RbjCEwj.exe
  C:\Windows\System\RbjCEwj.exe
  2⤵
  PID:7712
- C:\Windows\System\zYrxHBT.exe
  C:\Windows\System\zYrxHBT.exe
  2⤵
  PID:7736
- C:\Windows\System\qLvREHW.exe
  C:\Windows\System\qLvREHW.exe
  2⤵
  PID:7752
- C:\Windows\System\JzcXUce.exe
  C:\Windows\System\JzcXUce.exe
  2⤵
  PID:7780
- C:\Windows\System\LjlBhYU.exe
  C:\Windows\System\LjlBhYU.exe
  2⤵
  PID:7800
- C:\Windows\System\bkRNsWc.exe
  C:\Windows\System\bkRNsWc.exe
  2⤵
  PID:7820
- C:\Windows\System\yoYznCP.exe
  C:\Windows\System\yoYznCP.exe
  2⤵
  PID:7840
- C:\Windows\System\dTQpmQA.exe
  C:\Windows\System\dTQpmQA.exe
  2⤵
  PID:7864
- C:\Windows\System\nwvYKzo.exe
  C:\Windows\System\nwvYKzo.exe
  2⤵
  PID:7884
- C:\Windows\System\nWyQNJR.exe
  C:\Windows\System\nWyQNJR.exe
  2⤵
  PID:7904
- C:\Windows\System\zNqdAeF.exe
  C:\Windows\System\zNqdAeF.exe
  2⤵
  PID:7924
- C:\Windows\System\xPvsutS.exe
  C:\Windows\System\xPvsutS.exe
  2⤵
  PID:7948
- C:\Windows\System\ewysbSN.exe
  C:\Windows\System\ewysbSN.exe
  2⤵
  PID:7968
- C:\Windows\System\SHmBHmW.exe
  C:\Windows\System\SHmBHmW.exe
  2⤵
  PID:7988
- C:\Windows\System\YZCbVlN.exe
  C:\Windows\System\YZCbVlN.exe
  2⤵
  PID:8012
- C:\Windows\System\YqcFLXE.exe
  C:\Windows\System\YqcFLXE.exe
  2⤵
  PID:8052
- C:\Windows\System\gyGiCfu.exe
  C:\Windows\System\gyGiCfu.exe
  2⤵
  PID:8076
- C:\Windows\System\JVsbxLL.exe
  C:\Windows\System\JVsbxLL.exe
  2⤵
  PID:8100
- C:\Windows\System\psjGRrW.exe
  C:\Windows\System\psjGRrW.exe
  2⤵
  PID:8120
- C:\Windows\System\hVBbufB.exe
  C:\Windows\System\hVBbufB.exe
  2⤵
  PID:8144
- C:\Windows\System\fwGSzba.exe
  C:\Windows\System\fwGSzba.exe
  2⤵
  PID:8168
- C:\Windows\System\UcNmguZ.exe
  C:\Windows\System\UcNmguZ.exe
  2⤵
  PID:7324
- C:\Windows\System\nJjyEXE.exe
  C:\Windows\System\nJjyEXE.exe
  2⤵
  PID:4024
- C:\Windows\System\MjZSYvI.exe
  C:\Windows\System\MjZSYvI.exe
  2⤵
  PID:6096
- C:\Windows\System\QQeKzkC.exe
  C:\Windows\System\QQeKzkC.exe
  2⤵
  PID:7464
- C:\Windows\System\zpGIUaZ.exe
  C:\Windows\System\zpGIUaZ.exe
  2⤵
  PID:1888
- C:\Windows\System\oovDUwE.exe
  C:\Windows\System\oovDUwE.exe
  2⤵
  PID:7664
- C:\Windows\System\sBCmqbB.exe
  C:\Windows\System\sBCmqbB.exe
  2⤵
  PID:7724
- C:\Windows\System\ZrLAvpW.exe
  C:\Windows\System\ZrLAvpW.exe
  2⤵
  PID:7436
- C:\Windows\System\ObOggRM.exe
  C:\Windows\System\ObOggRM.exe
  2⤵
  PID:7556
- C:\Windows\System\FTWGMXK.exe
  C:\Windows\System\FTWGMXK.exe
  2⤵
  PID:7608
- C:\Windows\System\NQgPUtr.exe
  C:\Windows\System\NQgPUtr.exe
  2⤵
  PID:8088
- C:\Windows\System\RjRvvju.exe
  C:\Windows\System\RjRvvju.exe
  2⤵
  PID:8160
- C:\Windows\System\hDXBYON.exe
  C:\Windows\System\hDXBYON.exe
  2⤵
  PID:7776
- C:\Windows\System\dwkemHD.exe
  C:\Windows\System\dwkemHD.exe
  2⤵
  PID:4948
- C:\Windows\System\zkcCBOs.exe
  C:\Windows\System\zkcCBOs.exe
  2⤵
  PID:7852
- C:\Windows\System\ZGdRsie.exe
  C:\Windows\System\ZGdRsie.exe
  2⤵
  PID:7932
- C:\Windows\System\VlLmxZP.exe
  C:\Windows\System\VlLmxZP.exe
  2⤵
  PID:7508
- C:\Windows\System\jTiuWYu.exe
  C:\Windows\System\jTiuWYu.exe
  2⤵
  PID:6088
- C:\Windows\System\oXFnxTD.exe
  C:\Windows\System\oXFnxTD.exe
  2⤵
  PID:7680
- C:\Windows\System\vnbLvGt.exe
  C:\Windows\System\vnbLvGt.exe
  2⤵
  PID:8200
- C:\Windows\System\adfeAjW.exe
  C:\Windows\System\adfeAjW.exe
  2⤵
  PID:8224
- C:\Windows\System\SRCXMsa.exe
  C:\Windows\System\SRCXMsa.exe
  2⤵
  PID:8248
- C:\Windows\System\ZvqDEfT.exe
  C:\Windows\System\ZvqDEfT.exe
  2⤵
  PID:8264
- C:\Windows\System\TXWNmWi.exe
  C:\Windows\System\TXWNmWi.exe
  2⤵
  PID:8284
- C:\Windows\System\WlxKAyq.exe
  C:\Windows\System\WlxKAyq.exe
  2⤵
  PID:8316
- C:\Windows\System\vRUuAQb.exe
  C:\Windows\System\vRUuAQb.exe
  2⤵
  PID:8332
- C:\Windows\System\HCQxBJU.exe
  C:\Windows\System\HCQxBJU.exe
  2⤵
  PID:8352
- C:\Windows\System\tFITTCY.exe
  C:\Windows\System\tFITTCY.exe
  2⤵
  PID:8372
- C:\Windows\System\oZTMlhZ.exe
  C:\Windows\System\oZTMlhZ.exe
  2⤵
  PID:8392
- C:\Windows\System\PCJlTpX.exe
  C:\Windows\System\PCJlTpX.exe
  2⤵
  PID:8416
- C:\Windows\System\gXKmWyH.exe
  C:\Windows\System\gXKmWyH.exe
  2⤵
  PID:8436
- C:\Windows\System\KIIBozz.exe
  C:\Windows\System\KIIBozz.exe
  2⤵
  PID:8456
- C:\Windows\System\dFjDGyE.exe
  C:\Windows\System\dFjDGyE.exe
  2⤵
  PID:8476
- C:\Windows\System\BaOPSXS.exe
  C:\Windows\System\BaOPSXS.exe
  2⤵
  PID:8500
- C:\Windows\System\YXZizTB.exe
  C:\Windows\System\YXZizTB.exe
  2⤵
  PID:8520
- C:\Windows\System\Onkxvfd.exe
  C:\Windows\System\Onkxvfd.exe
  2⤵
  PID:8540
- C:\Windows\System\CFhxclU.exe
  C:\Windows\System\CFhxclU.exe
  2⤵
  PID:8564
- C:\Windows\System\bSkHwnn.exe
  C:\Windows\System\bSkHwnn.exe
  2⤵
  PID:8588
- C:\Windows\System\KxcxDNn.exe
  C:\Windows\System\KxcxDNn.exe
  2⤵
  PID:8608
- C:\Windows\System\bRvvtxu.exe
  C:\Windows\System\bRvvtxu.exe
  2⤵
  PID:8632
- C:\Windows\System\CLSDbZA.exe
  C:\Windows\System\CLSDbZA.exe
  2⤵
  PID:8648
- C:\Windows\System\zzUcEWc.exe
  C:\Windows\System\zzUcEWc.exe
  2⤵
  PID:8668
- C:\Windows\System\ZenbkUR.exe
  C:\Windows\System\ZenbkUR.exe
  2⤵
  PID:8688
- C:\Windows\System\vncIKnF.exe
  C:\Windows\System\vncIKnF.exe
  2⤵
  PID:8704
- C:\Windows\System\SkKBktS.exe
  C:\Windows\System\SkKBktS.exe
  2⤵
  PID:8728
- C:\Windows\System\kvWfXyW.exe
  C:\Windows\System\kvWfXyW.exe
  2⤵
  PID:8752
- C:\Windows\System\iyGlbhu.exe
  C:\Windows\System\iyGlbhu.exe
  2⤵
  PID:8768
- C:\Windows\System\eBPYFlS.exe
  C:\Windows\System\eBPYFlS.exe
  2⤵
  PID:8788
- C:\Windows\System\vDKAtSa.exe
  C:\Windows\System\vDKAtSa.exe
  2⤵
  PID:8808
- C:\Windows\System\BOUMsxL.exe
  C:\Windows\System\BOUMsxL.exe
  2⤵
  PID:8828
- C:\Windows\System\QGQAhCG.exe
  C:\Windows\System\QGQAhCG.exe
  2⤵
  PID:8852
- C:\Windows\System\MUKrIDX.exe
  C:\Windows\System\MUKrIDX.exe
  2⤵
  PID:8868
- C:\Windows\System\KKZHnJA.exe
  C:\Windows\System\KKZHnJA.exe
  2⤵
  PID:8888
- C:\Windows\System\YfJoUrV.exe
  C:\Windows\System\YfJoUrV.exe
  2⤵
  PID:8908
- C:\Windows\System\UfClggS.exe
  C:\Windows\System\UfClggS.exe
  2⤵
  PID:8932
- C:\Windows\System\njjTfId.exe
  C:\Windows\System\njjTfId.exe
  2⤵
  PID:8952
- C:\Windows\System\XtCoqFD.exe
  C:\Windows\System\XtCoqFD.exe
  2⤵
  PID:8980
- C:\Windows\System\IcWjtqM.exe
  C:\Windows\System\IcWjtqM.exe
  2⤵
  PID:8996
- C:\Windows\System\nQlHOVf.exe
  C:\Windows\System\nQlHOVf.exe
  2⤵
  PID:9024
- C:\Windows\System\QvCNlBs.exe
  C:\Windows\System\QvCNlBs.exe
  2⤵
  PID:9040
- C:\Windows\System\sYYcRiS.exe
  C:\Windows\System\sYYcRiS.exe
  2⤵
  PID:9060
- C:\Windows\System\OJZMNjE.exe
  C:\Windows\System\OJZMNjE.exe
  2⤵
  PID:9080
- C:\Windows\System\uLXzvoY.exe
  C:\Windows\System\uLXzvoY.exe
  2⤵
  PID:9096
- C:\Windows\System\CLQWRGa.exe
  C:\Windows\System\CLQWRGa.exe
  2⤵
  PID:9120
- C:\Windows\System\RFYetBQ.exe
  C:\Windows\System\RFYetBQ.exe
  2⤵
  PID:9136
- C:\Windows\System\tlfJnJu.exe
  C:\Windows\System\tlfJnJu.exe
  2⤵
  PID:9152
- C:\Windows\System\bsVTnoR.exe
  C:\Windows\System\bsVTnoR.exe
  2⤵
  PID:9168
- C:\Windows\System\ArHwbvj.exe
  C:\Windows\System\ArHwbvj.exe
  2⤵
  PID:9188
- C:\Windows\System\gtjCRSp.exe
  C:\Windows\System\gtjCRSp.exe
  2⤵
  PID:9208
- C:\Windows\System\XqvAvJE.exe
  C:\Windows\System\XqvAvJE.exe
  2⤵
  PID:7364
- C:\Windows\System\uEspiJy.exe
  C:\Windows\System\uEspiJy.exe
  2⤵
  PID:3480
- C:\Windows\System\KLZMCFp.exe
  C:\Windows\System\KLZMCFp.exe
  2⤵
  PID:8004
- C:\Windows\System\SEuxQcn.exe
  C:\Windows\System\SEuxQcn.exe
  2⤵
  PID:8140
- C:\Windows\System\XMbzoWh.exe
  C:\Windows\System\XMbzoWh.exe
  2⤵
  PID:5760
- C:\Windows\System\osJeJUE.exe
  C:\Windows\System\osJeJUE.exe
  2⤵
  PID:8196
- C:\Windows\System\KIVdhlE.exe
  C:\Windows\System\KIVdhlE.exe
  2⤵
  PID:7300
- C:\Windows\System\zGRyduV.exe
  C:\Windows\System\zGRyduV.exe
  2⤵
  PID:5108
- C:\Windows\System\SgLBNGw.exe
  C:\Windows\System\SgLBNGw.exe
  2⤵
  PID:7480
- C:\Windows\System\VldwfKw.exe
  C:\Windows\System\VldwfKw.exe
  2⤵
  PID:7580
- C:\Windows\System\JApXHhP.exe
  C:\Windows\System\JApXHhP.exe
  2⤵
  PID:8400
- C:\Windows\System\qqzNAtM.exe
  C:\Windows\System\qqzNAtM.exe
  2⤵
  PID:8452
- C:\Windows\System\WgHtZnY.exe
  C:\Windows\System\WgHtZnY.exe
  2⤵
  PID:7648
- C:\Windows\System\NoQrNNh.exe
  C:\Windows\System\NoQrNNh.exe
  2⤵
  PID:7796
- C:\Windows\System\siaBGyV.exe
  C:\Windows\System\siaBGyV.exe
  2⤵
  PID:7920
- C:\Windows\System\PuchwlA.exe
  C:\Windows\System\PuchwlA.exe
  2⤵
  PID:8644
- C:\Windows\System\JkqJpWs.exe
  C:\Windows\System\JkqJpWs.exe
  2⤵
  PID:8676
- C:\Windows\System\ADyiPSE.exe
  C:\Windows\System\ADyiPSE.exe
  2⤵
  PID:8236
- C:\Windows\System\zYrtaXi.exe
  C:\Windows\System\zYrtaXi.exe
  2⤵
  PID:8304
- C:\Windows\System\rraXMqt.exe
  C:\Windows\System\rraXMqt.exe
  2⤵
  PID:8324
- C:\Windows\System\kWSPKLe.exe
  C:\Windows\System\kWSPKLe.exe
  2⤵
  PID:8444
- C:\Windows\System\wNXemQJ.exe
  C:\Windows\System\wNXemQJ.exe
  2⤵
  PID:9232
- C:\Windows\System\jkGeFPX.exe
  C:\Windows\System\jkGeFPX.exe
  2⤵
  PID:9256
- C:\Windows\System\HuvDNQc.exe
  C:\Windows\System\HuvDNQc.exe
  2⤵
  PID:9272
- C:\Windows\System\SWjYbEK.exe
  C:\Windows\System\SWjYbEK.exe
  2⤵
  PID:9296
- C:\Windows\System\fTIbmOK.exe
  C:\Windows\System\fTIbmOK.exe
  2⤵
  PID:9320
- C:\Windows\System\udQkNDh.exe
  C:\Windows\System\udQkNDh.exe
  2⤵
  PID:9344
- C:\Windows\System\MstPSnq.exe
  C:\Windows\System\MstPSnq.exe
  2⤵
  PID:9364
- C:\Windows\System\vuKACib.exe
  C:\Windows\System\vuKACib.exe
  2⤵
  PID:9388
- C:\Windows\System\CnNAGYT.exe
  C:\Windows\System\CnNAGYT.exe
  2⤵
  PID:9404
- C:\Windows\System\OGbNMnz.exe
  C:\Windows\System\OGbNMnz.exe
  2⤵
  PID:9428
- C:\Windows\System\gxEOoje.exe
  C:\Windows\System\gxEOoje.exe
  2⤵
  PID:9448
- C:\Windows\System\LkyUZJR.exe
  C:\Windows\System\LkyUZJR.exe
  2⤵
  PID:9468
- C:\Windows\System\QwOmMoS.exe
  C:\Windows\System\QwOmMoS.exe
  2⤵
  PID:9484
- C:\Windows\System\kdctgRp.exe
  C:\Windows\System\kdctgRp.exe
  2⤵
  PID:9508
- C:\Windows\System\rsuilEo.exe
  C:\Windows\System\rsuilEo.exe
  2⤵
  PID:9536
- C:\Windows\System\vWcqzcT.exe
  C:\Windows\System\vWcqzcT.exe
  2⤵
  PID:9552
- C:\Windows\System\dyeQLlM.exe
  C:\Windows\System\dyeQLlM.exe
  2⤵
  PID:9576
- C:\Windows\System\ZyPfDkq.exe
  C:\Windows\System\ZyPfDkq.exe
  2⤵
  PID:9596
- C:\Windows\System\nugDQhL.exe
  C:\Windows\System\nugDQhL.exe
  2⤵
  PID:9616
- C:\Windows\System\wugPZMc.exe
  C:\Windows\System\wugPZMc.exe
  2⤵
  PID:9640
- C:\Windows\System\WoKPvAx.exe
  C:\Windows\System\WoKPvAx.exe
  2⤵
  PID:9664
- C:\Windows\System\zslRaKZ.exe
  C:\Windows\System\zslRaKZ.exe
  2⤵
  PID:9684
- C:\Windows\System\euofDVH.exe
  C:\Windows\System\euofDVH.exe
  2⤵
  PID:9704
- C:\Windows\System\UiuOMNj.exe
  C:\Windows\System\UiuOMNj.exe
  2⤵
  PID:9720
- C:\Windows\System\AWmlFkY.exe
  C:\Windows\System\AWmlFkY.exe
  2⤵
  PID:9744
- C:\Windows\System\lbBbRQk.exe
  C:\Windows\System\lbBbRQk.exe
  2⤵
  PID:9772
- C:\Windows\System\sQkNpFw.exe
  C:\Windows\System\sQkNpFw.exe
  2⤵
  PID:9788
- C:\Windows\System\kaqebDh.exe
  C:\Windows\System\kaqebDh.exe
  2⤵
  PID:9808
- C:\Windows\System\LTCiJIV.exe
  C:\Windows\System\LTCiJIV.exe
  2⤵
  PID:9832
- C:\Windows\System\LXHQnJW.exe
  C:\Windows\System\LXHQnJW.exe
  2⤵
  PID:9856
- C:\Windows\System\IPpvHOg.exe
  C:\Windows\System\IPpvHOg.exe
  2⤵
  PID:9872
- C:\Windows\System\gbmYigO.exe
  C:\Windows\System\gbmYigO.exe
  2⤵
  PID:9896
- C:\Windows\System\tUNXROS.exe
  C:\Windows\System\tUNXROS.exe
  2⤵
  PID:9916
- C:\Windows\System\hczVyQX.exe
  C:\Windows\System\hczVyQX.exe
  2⤵
  PID:9940
- C:\Windows\System\eknApNq.exe
  C:\Windows\System\eknApNq.exe
  2⤵
  PID:9960
- C:\Windows\System\kXyANuj.exe
  C:\Windows\System\kXyANuj.exe
  2⤵
  PID:9980
- C:\Windows\System\zWMNLsN.exe
  C:\Windows\System\zWMNLsN.exe
  2⤵
  PID:10000
- C:\Windows\System\OkGYkgs.exe
  C:\Windows\System\OkGYkgs.exe
  2⤵
  PID:10016
- C:\Windows\System\nGJasJW.exe
  C:\Windows\System\nGJasJW.exe
  2⤵
  PID:10036
- C:\Windows\System\vtwdwdU.exe
  C:\Windows\System\vtwdwdU.exe
  2⤵
  PID:10052
- C:\Windows\System\ovxuipb.exe
  C:\Windows\System\ovxuipb.exe
  2⤵
  PID:10072
- C:\Windows\System\csGGxfu.exe
  C:\Windows\System\csGGxfu.exe
  2⤵
  PID:10096
- C:\Windows\System\iiYOjpd.exe
  C:\Windows\System\iiYOjpd.exe
  2⤵
  PID:10116
- C:\Windows\System\MhWNXAt.exe
  C:\Windows\System\MhWNXAt.exe
  2⤵
  PID:10136
- C:\Windows\System\MXfULhn.exe
  C:\Windows\System\MXfULhn.exe
  2⤵
  PID:10160
- C:\Windows\System\qaanqRS.exe
  C:\Windows\System\qaanqRS.exe
  2⤵
  PID:10192
- C:\Windows\System\ftTKvFx.exe
  C:\Windows\System\ftTKvFx.exe
  2⤵
  PID:10208
- C:\Windows\System\plyhOno.exe
  C:\Windows\System\plyhOno.exe
  2⤵
  PID:10224
- C:\Windows\System\NZizKHe.exe
  C:\Windows\System\NZizKHe.exe
  2⤵
  PID:8948
- C:\Windows\System\eVGkUFs.exe
  C:\Windows\System\eVGkUFs.exe
  2⤵
  PID:9068
- C:\Windows\System\zTbdCGP.exe
  C:\Windows\System\zTbdCGP.exe
  2⤵
  PID:9128
- C:\Windows\System\GlwLoIS.exe
  C:\Windows\System\GlwLoIS.exe
  2⤵
  PID:9160
- C:\Windows\System\JBYCjDO.exe
  C:\Windows\System\JBYCjDO.exe
  2⤵
  PID:9204
- C:\Windows\System\vFkjizM.exe
  C:\Windows\System\vFkjizM.exe
  2⤵
  PID:7940
- C:\Windows\System\wzwUCCt.exe
  C:\Windows\System\wzwUCCt.exe
  2⤵
  PID:7384
- C:\Windows\System\dpthJMC.exe
  C:\Windows\System\dpthJMC.exe
  2⤵
  PID:8220
- C:\Windows\System\kEKlZWE.exe
  C:\Windows\System\kEKlZWE.exe
  2⤵
  PID:8784
- C:\Windows\System\JByfEoI.exe
  C:\Windows\System\JByfEoI.exe
  2⤵
  PID:8684
- C:\Windows\System\tgAuoPP.exe
  C:\Windows\System\tgAuoPP.exe
  2⤵
  PID:7400
- C:\Windows\System\SpNungP.exe
  C:\Windows\System\SpNungP.exe
  2⤵
  PID:9280
- C:\Windows\System\HmKhlTk.exe
  C:\Windows\System\HmKhlTk.exe
  2⤵
  PID:2044
- C:\Windows\System\qjXYTUr.exe
  C:\Windows\System\qjXYTUr.exe
  2⤵
  PID:9032
- C:\Windows\System\gFlRjAL.exe
  C:\Windows\System\gFlRjAL.exe
  2⤵
  PID:9056
- C:\Windows\System\SDdcrkH.exe
  C:\Windows\System\SDdcrkH.exe
  2⤵
  PID:3740
- C:\Windows\System\HZRWvvj.exe
  C:\Windows\System\HZRWvvj.exe
  2⤵
  PID:9412
- C:\Windows\System\ufCCVdE.exe
  C:\Windows\System\ufCCVdE.exe
  2⤵
  PID:10256
- C:\Windows\System\zJRcsuh.exe
  C:\Windows\System\zJRcsuh.exe
  2⤵
  PID:10276
- C:\Windows\System\skzCuTh.exe
  C:\Windows\System\skzCuTh.exe
  2⤵
  PID:10292
- C:\Windows\System\ScyRpUP.exe
  C:\Windows\System\ScyRpUP.exe
  2⤵
  PID:10312
- C:\Windows\System\veYpict.exe
  C:\Windows\System\veYpict.exe
  2⤵
  PID:10332
- C:\Windows\System\UfkHErT.exe
  C:\Windows\System\UfkHErT.exe
  2⤵
  PID:10360
- C:\Windows\System\ZaQjAOu.exe
  C:\Windows\System\ZaQjAOu.exe
  2⤵
  PID:10388
- C:\Windows\System\CoIoJUu.exe
  C:\Windows\System\CoIoJUu.exe
  2⤵
  PID:10416
- C:\Windows\System\qXeWfkX.exe
  C:\Windows\System\qXeWfkX.exe
  2⤵
  PID:10436
- C:\Windows\System\ITGuUtp.exe
  C:\Windows\System\ITGuUtp.exe
  2⤵
  PID:10460
- C:\Windows\System\VgDrvvo.exe
  C:\Windows\System\VgDrvvo.exe
  2⤵
  PID:10484
- C:\Windows\System\HzWnXoY.exe
  C:\Windows\System\HzWnXoY.exe
  2⤵
  PID:10516
- C:\Windows\System\zellwRu.exe
  C:\Windows\System\zellwRu.exe
  2⤵
  PID:10536
- C:\Windows\System\DNoKtOc.exe
  C:\Windows\System\DNoKtOc.exe
  2⤵
  PID:10568
- C:\Windows\System\vAhlETt.exe
  C:\Windows\System\vAhlETt.exe
  2⤵
  PID:10596
- C:\Windows\System\MAcwJGZ.exe
  C:\Windows\System\MAcwJGZ.exe
  2⤵
  PID:10612
- C:\Windows\System\QpfGhbO.exe
  C:\Windows\System\QpfGhbO.exe
  2⤵
  PID:10728
- C:\Windows\System\XZikRoF.exe
  C:\Windows\System\XZikRoF.exe
  2⤵
  PID:10788
- C:\Windows\System\npZXMur.exe
  C:\Windows\System\npZXMur.exe
  2⤵
  PID:10808
- C:\Windows\System\kfTufwL.exe
  C:\Windows\System\kfTufwL.exe
  2⤵
  PID:10824
- C:\Windows\System\KqWlDax.exe
  C:\Windows\System\KqWlDax.exe
  2⤵
  PID:10844
- C:\Windows\System\edYOQIX.exe
  C:\Windows\System\edYOQIX.exe
  2⤵
  PID:10860
- C:\Windows\System\HLRQFPy.exe
  C:\Windows\System\HLRQFPy.exe
  2⤵
  PID:10884
- C:\Windows\System\mwAdZFc.exe
  C:\Windows\System\mwAdZFc.exe
  2⤵
  PID:10904
- C:\Windows\System\rRqYsWl.exe
  C:\Windows\System\rRqYsWl.exe
  2⤵
  PID:10924
- C:\Windows\System\TDqhXAh.exe
  C:\Windows\System\TDqhXAh.exe
  2⤵
  PID:10948
- C:\Windows\System\OLjqDGb.exe
  C:\Windows\System\OLjqDGb.exe
  2⤵
  PID:10964
- C:\Windows\System\bmzLvaL.exe
  C:\Windows\System\bmzLvaL.exe
  2⤵
  PID:10980
- C:\Windows\System\UQXIkao.exe
  C:\Windows\System\UQXIkao.exe
  2⤵
  PID:10996
- C:\Windows\System\CFsDvhz.exe
  C:\Windows\System\CFsDvhz.exe
  2⤵
  PID:11012
- C:\Windows\System\AlAOagn.exe
  C:\Windows\System\AlAOagn.exe
  2⤵
  PID:11036
- C:\Windows\System\Zxhakjr.exe
  C:\Windows\System\Zxhakjr.exe
  2⤵
  PID:11056
- C:\Windows\System\RlBetNc.exe
  C:\Windows\System\RlBetNc.exe
  2⤵
  PID:11080
- C:\Windows\System\SOBbozT.exe
  C:\Windows\System\SOBbozT.exe
  2⤵
  PID:11096
- C:\Windows\System\NXOLEJz.exe
  C:\Windows\System\NXOLEJz.exe
  2⤵
  PID:11116
- C:\Windows\System\AABHogX.exe
  C:\Windows\System\AABHogX.exe
  2⤵
  PID:11132
- C:\Windows\System\VXygXyC.exe
  C:\Windows\System\VXygXyC.exe
  2⤵
  PID:11156
- C:\Windows\System\wvKSpHb.exe
  C:\Windows\System\wvKSpHb.exe
  2⤵
  PID:11180
- C:\Windows\System\xgyhLih.exe
  C:\Windows\System\xgyhLih.exe
  2⤵
  PID:11200
- C:\Windows\System\LzQzxRu.exe
  C:\Windows\System\LzQzxRu.exe
  2⤵
  PID:11220
- C:\Windows\System\EuqRBhY.exe
  C:\Windows\System\EuqRBhY.exe
  2⤵
  PID:11236
- C:\Windows\System\LMbixlu.exe
  C:\Windows\System\LMbixlu.exe
  2⤵
  PID:11256
- C:\Windows\System\LFxoiAb.exe
  C:\Windows\System\LFxoiAb.exe
  2⤵
  PID:9476
- C:\Windows\System\LVwQUea.exe
  C:\Windows\System\LVwQUea.exe
  2⤵
  PID:9184
- C:\Windows\System\ZuuVNFb.exe
  C:\Windows\System\ZuuVNFb.exe
  2⤵
  PID:9880
- C:\Windows\System\bhKZRzi.exe
  C:\Windows\System\bhKZRzi.exe
  2⤵
  PID:9932
- C:\Windows\System\jlaQiBy.exe
  C:\Windows\System\jlaQiBy.exe
  2⤵
  PID:8760
- C:\Windows\System\twpCCWh.exe
  C:\Windows\System\twpCCWh.exe
  2⤵
  PID:8824
- C:\Windows\System\DqQUWiY.exe
  C:\Windows\System\DqQUWiY.exe
  2⤵
  PID:7532
- C:\Windows\System\uhEEXtp.exe
  C:\Windows\System\uhEEXtp.exe
  2⤵
  PID:10080
- C:\Windows\System\vjdLnGu.exe
  C:\Windows\System\vjdLnGu.exe
  2⤵
  PID:10092
- C:\Windows\System\IdHpJLI.exe
  C:\Windows\System\IdHpJLI.exe
  2⤵
  PID:8972
- C:\Windows\System\zPHbdVX.exe
  C:\Windows\System\zPHbdVX.exe
  2⤵
  PID:8860
- C:\Windows\System\hgBEFcV.exe
  C:\Windows\System\hgBEFcV.exe
  2⤵
  PID:9292
- C:\Windows\System\tlQecTS.exe
  C:\Windows\System\tlQecTS.exe
  2⤵
  PID:9400
- C:\Windows\System\ysIuenB.exe
  C:\Windows\System\ysIuenB.exe
  2⤵
  PID:9424
- C:\Windows\System\KsEGErW.exe
  C:\Windows\System\KsEGErW.exe
  2⤵
  PID:9504
- C:\Windows\System\RcIqoQq.exe
  C:\Windows\System\RcIqoQq.exe
  2⤵
  PID:9592
- C:\Windows\System\ErwGQZg.exe
  C:\Windows\System\ErwGQZg.exe
  2⤵
  PID:9648
- C:\Windows\System\axIxQOo.exe
  C:\Windows\System\axIxQOo.exe
  2⤵
  PID:9680
- C:\Windows\System\CTqdjRq.exe
  C:\Windows\System\CTqdjRq.exe
  2⤵
  PID:9820
- C:\Windows\System\BWtvIMU.exe
  C:\Windows\System\BWtvIMU.exe
  2⤵
  PID:7284
- C:\Windows\System\Brpmynk.exe
  C:\Windows\System\Brpmynk.exe
  2⤵
  PID:9884
- C:\Windows\System\YHygwaP.exe
  C:\Windows\System\YHygwaP.exe
  2⤵
  PID:9912
- C:\Windows\System\kOGLvxl.exe
  C:\Windows\System\kOGLvxl.exe
  2⤵
  PID:9268
- C:\Windows\System\aSjwUQW.exe
  C:\Windows\System\aSjwUQW.exe
  2⤵
  PID:10716
- C:\Windows\System\czyeCyS.exe
  C:\Windows\System\czyeCyS.exe
  2⤵
  PID:10932
- C:\Windows\System\djuXNss.exe
  C:\Windows\System\djuXNss.exe
  2⤵
  PID:11064
- C:\Windows\System\DiehHrS.exe
  C:\Windows\System\DiehHrS.exe
  2⤵
  PID:11152
- C:\Windows\System\fZwkEkA.exe
  C:\Windows\System\fZwkEkA.exe
  2⤵
  PID:9520
- C:\Windows\System\bdGFowk.exe
  C:\Windows\System\bdGFowk.exe
  2⤵
  PID:11268
- C:\Windows\System\gvfbEkx.exe
  C:\Windows\System\gvfbEkx.exe
  2⤵
  PID:11288
- C:\Windows\System\yFybVvf.exe
  C:\Windows\System\yFybVvf.exe
  2⤵
  PID:11304
- C:\Windows\System\OmfVUSF.exe
  C:\Windows\System\OmfVUSF.exe
  2⤵
  PID:11320
- C:\Windows\System\VdbyVQt.exe
  C:\Windows\System\VdbyVQt.exe
  2⤵
  PID:11336
- C:\Windows\System\ZFcdIuG.exe
  C:\Windows\System\ZFcdIuG.exe
  2⤵
  PID:11352
- C:\Windows\System\wdZErls.exe
  C:\Windows\System\wdZErls.exe
  2⤵
  PID:11372
- C:\Windows\System\PFbCbQf.exe
  C:\Windows\System\PFbCbQf.exe
  2⤵
  PID:11388
- C:\Windows\System\HSYQjwT.exe
  C:\Windows\System\HSYQjwT.exe
  2⤵
  PID:11404
- C:\Windows\System\hThDsXy.exe
  C:\Windows\System\hThDsXy.exe
  2⤵
  PID:11424
- C:\Windows\System\CcPimLK.exe
  C:\Windows\System\CcPimLK.exe
  2⤵
  PID:11444
- C:\Windows\System\wOXMizc.exe
  C:\Windows\System\wOXMizc.exe
  2⤵
  PID:11468
- C:\Windows\System\DjdJTnn.exe
  C:\Windows\System\DjdJTnn.exe
  2⤵
  PID:11484
- C:\Windows\System\FVlJsWt.exe
  C:\Windows\System\FVlJsWt.exe
  2⤵
  PID:11504
- C:\Windows\System\boSocuC.exe
  C:\Windows\System\boSocuC.exe
  2⤵
  PID:11520
- C:\Windows\System\eYMjjeW.exe
  C:\Windows\System\eYMjjeW.exe
  2⤵
  PID:11536
- C:\Windows\System\njovxil.exe
  C:\Windows\System\njovxil.exe
  2⤵
  PID:11568
- C:\Windows\System\voNnuOB.exe
  C:\Windows\System\voNnuOB.exe
  2⤵
  PID:11584
- C:\Windows\System\EsYVYrw.exe
  C:\Windows\System\EsYVYrw.exe
  2⤵
  PID:11604
- C:\Windows\System\UkeoxLr.exe
  C:\Windows\System\UkeoxLr.exe
  2⤵
  PID:11624
- C:\Windows\System\ievlLRy.exe
  C:\Windows\System\ievlLRy.exe
  2⤵
  PID:11648
- C:\Windows\System\eNdWsKI.exe
  C:\Windows\System\eNdWsKI.exe
  2⤵
  PID:11664
- C:\Windows\System\YkdSMSv.exe
  C:\Windows\System\YkdSMSv.exe
  2⤵
  PID:11680
- C:\Windows\System\ziEYVtJ.exe
  C:\Windows\System\ziEYVtJ.exe
  2⤵
  PID:11696
- C:\Windows\System\MvycXtT.exe
  C:\Windows\System\MvycXtT.exe
  2⤵
  PID:11720
- C:\Windows\System\ksTQrUl.exe
  C:\Windows\System\ksTQrUl.exe
  2⤵
  PID:11744
- C:\Windows\System\GCMLHIU.exe
  C:\Windows\System\GCMLHIU.exe
  2⤵
  PID:11768
- C:\Windows\System\YtPMcNS.exe
  C:\Windows\System\YtPMcNS.exe
  2⤵
  PID:11796
- C:\Windows\System\AVFEkHY.exe
  C:\Windows\System\AVFEkHY.exe
  2⤵
  PID:11812
- C:\Windows\System\OqvxcTX.exe
  C:\Windows\System\OqvxcTX.exe
  2⤵
  PID:11840
- C:\Windows\System\KrOfSUO.exe
  C:\Windows\System\KrOfSUO.exe
  2⤵
  PID:11864
- C:\Windows\System\GzRQAbL.exe
  C:\Windows\System\GzRQAbL.exe
  2⤵
  PID:11888
- C:\Windows\System\osBvVVB.exe
  C:\Windows\System\osBvVVB.exe
  2⤵
  PID:11908
- C:\Windows\System\NtBzdxD.exe
  C:\Windows\System\NtBzdxD.exe
  2⤵
  PID:11928
- C:\Windows\System\pDDsPFJ.exe
  C:\Windows\System\pDDsPFJ.exe
  2⤵
  PID:11952
- C:\Windows\System\iRKnAUV.exe
  C:\Windows\System\iRKnAUV.exe
  2⤵
  PID:11976
- C:\Windows\System\UsOByfC.exe
  C:\Windows\System\UsOByfC.exe
  2⤵
  PID:11992
- C:\Windows\System\RzqYKdN.exe
  C:\Windows\System\RzqYKdN.exe
  2⤵
  PID:12016
- C:\Windows\System\ZoKxJJd.exe
  C:\Windows\System\ZoKxJJd.exe
  2⤵
  PID:12040
- C:\Windows\System\cdFvMvK.exe
  C:\Windows\System\cdFvMvK.exe
  2⤵
  PID:12064
- C:\Windows\System\BBbvcBv.exe
  C:\Windows\System\BBbvcBv.exe
  2⤵
  PID:12088
- C:\Windows\System\XYHQDZZ.exe
  C:\Windows\System\XYHQDZZ.exe
  2⤵
  PID:12112
- C:\Windows\System\nGUseVz.exe
  C:\Windows\System\nGUseVz.exe
  2⤵
  PID:12132
- C:\Windows\System\iVtADPF.exe
  C:\Windows\System\iVtADPF.exe
  2⤵
  PID:12152
- C:\Windows\System\ycRquzu.exe
  C:\Windows\System\ycRquzu.exe
  2⤵
  PID:12176
- C:\Windows\System\LFEJWHp.exe
  C:\Windows\System\LFEJWHp.exe
  2⤵
  PID:12200
- C:\Windows\System\lacwkTz.exe
  C:\Windows\System\lacwkTz.exe
  2⤵
  PID:12220
- C:\Windows\System\zMQBHxM.exe
  C:\Windows\System\zMQBHxM.exe
  2⤵
  PID:12240
- C:\Windows\System\YNFrgPK.exe
  C:\Windows\System\YNFrgPK.exe
  2⤵
  PID:12264
- C:\Windows\System\SywyukC.exe
  C:\Windows\System\SywyukC.exe
  2⤵
  PID:10344
- C:\Windows\System\cCimZZT.exe
  C:\Windows\System\cCimZZT.exe
  2⤵
  PID:9608
- C:\Windows\System\MCSURRT.exe
  C:\Windows\System\MCSURRT.exe
  2⤵
  PID:9868
- C:\Windows\System\VWVcmet.exe
  C:\Windows\System\VWVcmet.exe
  2⤵
  PID:9756
- C:\Windows\System\qorqeKy.exe
  C:\Windows\System\qorqeKy.exe
  2⤵
  PID:9764
- C:\Windows\System\xBMxQZG.exe
  C:\Windows\System\xBMxQZG.exe
  2⤵
  PID:9780
- C:\Windows\System\jrueWtU.exe
  C:\Windows\System\jrueWtU.exe
  2⤵
  PID:7996
- C:\Windows\System\jKbdaDI.exe
  C:\Windows\System\jKbdaDI.exe
  2⤵
  PID:10456
- C:\Windows\System\QDydBUj.exe
  C:\Windows\System\QDydBUj.exe
  2⤵
  PID:8988
- C:\Windows\System\PMYsAyR.exe
  C:\Windows\System\PMYsAyR.exe
  2⤵
  PID:10252
- C:\Windows\System\AIwXsNt.exe
  C:\Windows\System\AIwXsNt.exe
  2⤵
  PID:9628
- C:\Windows\System\SvJhnwD.exe
  C:\Windows\System\SvJhnwD.exe
  2⤵
  PID:10480
- C:\Windows\System\tPrSYlD.exe
  C:\Windows\System\tPrSYlD.exe
  2⤵
  PID:10560
- C:\Windows\System\NPXXUzs.exe
  C:\Windows\System\NPXXUzs.exe
  2⤵
  PID:9020
- C:\Windows\System\LDtqSCM.exe
  C:\Windows\System\LDtqSCM.exe
  2⤵
  PID:10684
- C:\Windows\System\SkCNOcS.exe
  C:\Windows\System\SkCNOcS.exe
  2⤵
  PID:12292
- C:\Windows\System\wIkYfDu.exe
  C:\Windows\System\wIkYfDu.exe
  2⤵
  PID:12316
- C:\Windows\System\DeoogwS.exe
  C:\Windows\System\DeoogwS.exe
  2⤵
  PID:12336
- C:\Windows\System\WTPeoqq.exe
  C:\Windows\System\WTPeoqq.exe
  2⤵
  PID:12352
- C:\Windows\System\YQyXPVG.exe
  C:\Windows\System\YQyXPVG.exe
  2⤵
  PID:12368
- C:\Windows\System\IHigoGW.exe
  C:\Windows\System\IHigoGW.exe
  2⤵
  PID:12384
- C:\Windows\System\PGAJXcP.exe
  C:\Windows\System\PGAJXcP.exe
  2⤵
  PID:12400
- C:\Windows\System\YhzzXxF.exe
  C:\Windows\System\YhzzXxF.exe
  2⤵
  PID:12416
- C:\Windows\System\YkLXUvD.exe
  C:\Windows\System\YkLXUvD.exe
  2⤵
  PID:12432
- C:\Windows\System\PVppYrF.exe
  C:\Windows\System\PVppYrF.exe
  2⤵
  PID:12448
- C:\Windows\System\pmZmlBt.exe
  C:\Windows\System\pmZmlBt.exe
  2⤵
  PID:12464
- C:\Windows\System\MlyqTdQ.exe
  C:\Windows\System\MlyqTdQ.exe
  2⤵
  PID:12480
- C:\Windows\System\lmIRSoA.exe
  C:\Windows\System\lmIRSoA.exe
  2⤵
  PID:12500
- C:\Windows\System\qGkBjmB.exe
  C:\Windows\System\qGkBjmB.exe
  2⤵
  PID:12524
- C:\Windows\System\GBpRtlJ.exe
  C:\Windows\System\GBpRtlJ.exe
  2⤵
  PID:12548
- C:\Windows\System\ZpWbnpt.exe
  C:\Windows\System\ZpWbnpt.exe
  2⤵
  PID:12568
- C:\Windows\System\uzFrncO.exe
  C:\Windows\System\uzFrncO.exe
  2⤵
  PID:12592
- C:\Windows\System\ORNUiyU.exe
  C:\Windows\System\ORNUiyU.exe
  2⤵
  PID:12612
- C:\Windows\System\iymnDFT.exe
  C:\Windows\System\iymnDFT.exe
  2⤵
  PID:12636
- C:\Windows\System\Uvmijqr.exe
  C:\Windows\System\Uvmijqr.exe
  2⤵
  PID:12660
- C:\Windows\System\oTuHjoG.exe
  C:\Windows\System\oTuHjoG.exe
  2⤵
  PID:12680
- C:\Windows\System\SstVDHE.exe
  C:\Windows\System\SstVDHE.exe
  2⤵
  PID:12700
- C:\Windows\System\WNXQZmn.exe
  C:\Windows\System\WNXQZmn.exe
  2⤵
  PID:12724
- C:\Windows\System\JSRVJvL.exe
  C:\Windows\System\JSRVJvL.exe
  2⤵
  PID:12744
- C:\Windows\System\xNWTzsP.exe
  C:\Windows\System\xNWTzsP.exe
  2⤵
  PID:12768
- C:\Windows\System\QoZECgI.exe
  C:\Windows\System\QoZECgI.exe
  2⤵
  PID:12784
- C:\Windows\System\XGkUqkv.exe
  C:\Windows\System\XGkUqkv.exe
  2⤵
  PID:12808
- C:\Windows\System\MangICd.exe
  C:\Windows\System\MangICd.exe
  2⤵
  PID:12832
- C:\Windows\System\JhbMpJb.exe
  C:\Windows\System\JhbMpJb.exe
  2⤵
  PID:12848
- C:\Windows\System\jXyZKjO.exe
  C:\Windows\System\jXyZKjO.exe
  2⤵
  PID:12872
- C:\Windows\System\UBRhJVm.exe
  C:\Windows\System\UBRhJVm.exe
  2⤵
  PID:12900
- C:\Windows\System\MTRCapG.exe
  C:\Windows\System\MTRCapG.exe
  2⤵
  PID:12924
- C:\Windows\System\aKJsAVM.exe
  C:\Windows\System\aKJsAVM.exe
  2⤵
  PID:12944
- C:\Windows\System\iFiOMqH.exe
  C:\Windows\System\iFiOMqH.exe
  2⤵
  PID:12972
- C:\Windows\System\NAHRhVq.exe
  C:\Windows\System\NAHRhVq.exe
  2⤵
  PID:13000
- C:\Windows\System\AIVzMKY.exe
  C:\Windows\System\AIVzMKY.exe
  2⤵
  PID:10992
- C:\Windows\System\qvTLLSC.exe
  C:\Windows\System\qvTLLSC.exe
  2⤵
  PID:9092
- C:\Windows\System\YIEGIOc.exe
  C:\Windows\System\YIEGIOc.exe
  2⤵
  PID:12856
- C:\Windows\System\tLehvwT.exe
  C:\Windows\System\tLehvwT.exe
  2⤵
  PID:11148
- C:\Windows\System\omLKMcu.exe
  C:\Windows\System\omLKMcu.exe
  2⤵
  PID:11640
- C:\Windows\System\wvYYZLb.exe
  C:\Windows\System\wvYYZLb.exe
  2⤵
  PID:13148
- C:\Windows\System\brUzNXL.exe
  C:\Windows\System\brUzNXL.exe
  2⤵
  PID:13144
- C:\Windows\System\kEtOpfS.exe
  C:\Windows\System\kEtOpfS.exe
  2⤵
  PID:9052
- C:\Windows\System\KOFBeLL.exe
  C:\Windows\System\KOFBeLL.exe
  2⤵
  PID:12036
- C:\Windows\System\WkQGeBv.exe
  C:\Windows\System\WkQGeBv.exe
  2⤵
  PID:10672
- C:\Windows\System\criZBzL.exe
  C:\Windows\System\criZBzL.exe
  2⤵
  PID:10668
- C:\Windows\System\zaZsNUh.exe
  C:\Windows\System\zaZsNUh.exe
  2⤵
  PID:10412
- C:\Windows\System\uKNCXLz.exe
  C:\Windows\System\uKNCXLz.exe
  2⤵
  PID:11560
- C:\Windows\System\DVtHrFs.exe
  C:\Windows\System\DVtHrFs.exe
  2⤵
  PID:11832
- C:\Windows\System\SFervjk.exe
  C:\Windows\System\SFervjk.exe
  2⤵
  PID:9952
- C:\Windows\System\woGcGDU.exe
  C:\Windows\System\woGcGDU.exe
  2⤵
  PID:10452
- C:\Windows\System\vwTZSXO.exe
  C:\Windows\System\vwTZSXO.exe
  2⤵
  PID:10284
- C:\Windows\System\mMKwAuo.exe
  C:\Windows\System\mMKwAuo.exe
  2⤵
  PID:9572
- C:\Windows\System\KyDHFhe.exe
  C:\Windows\System\KyDHFhe.exe
  2⤵
  PID:12312
- C:\Windows\System\YMPMehk.exe
  C:\Windows\System\YMPMehk.exe
  2⤵
  PID:12260
- C:\Windows\System\iefwGAR.exe
  C:\Windows\System\iefwGAR.exe
  2⤵
  PID:12032
- C:\Windows\System\WkBcrDG.exe
  C:\Windows\System\WkBcrDG.exe
  2⤵
  PID:12424
- C:\Windows\System\eTBqlrq.exe
  C:\Windows\System\eTBqlrq.exe
  2⤵
  PID:10608
- C:\Windows\System\fWOwbiK.exe
  C:\Windows\System\fWOwbiK.exe
  2⤵
  PID:3912
- C:\Windows\System\jYOQbMI.exe
  C:\Windows\System\jYOQbMI.exe
  2⤵
  PID:10768
- C:\Windows\System\RhrobKU.exe
  C:\Windows\System\RhrobKU.exe
  2⤵
  PID:10780
- C:\Windows\System\vJMNSXa.exe
  C:\Windows\System\vJMNSXa.exe
  2⤵
  PID:11984
- C:\Windows\System\EAoEOjh.exe
  C:\Windows\System\EAoEOjh.exe
  2⤵
  PID:12460
- C:\Windows\System\ugSmaab.exe
  C:\Windows\System\ugSmaab.exe
  2⤵
  PID:12492
- C:\Windows\System\tmBzOWi.exe
  C:\Windows\System\tmBzOWi.exe
  2⤵
  PID:11092
- C:\Windows\System\wPqIsQE.exe
  C:\Windows\System\wPqIsQE.exe
  2⤵
  PID:12564
- C:\Windows\System\FcIIxqJ.exe
  C:\Windows\System\FcIIxqJ.exe
  2⤵
  PID:10832
- C:\Windows\System\AFpftFn.exe
  C:\Windows\System\AFpftFn.exe
  2⤵
  PID:9924
- C:\Windows\System\auyokXZ.exe
  C:\Windows\System\auyokXZ.exe
  2⤵
  PID:11712
- C:\Windows\System\QWcNbUm.exe
  C:\Windows\System\QWcNbUm.exe
  2⤵
  PID:13200
- C:\Windows\System\sPuDzLW.exe
  C:\Windows\System\sPuDzLW.exe
  2⤵
  PID:11348
- C:\Windows\System\jxpQvqH.exe
  C:\Windows\System\jxpQvqH.exe
  2⤵
  PID:12764
- C:\Windows\System\LEaTqWL.exe
  C:\Windows\System\LEaTqWL.exe
  2⤵
  PID:12676
- C:\Windows\System\tRhgQGo.exe
  C:\Windows\System\tRhgQGo.exe
  2⤵
  PID:13112
- C:\Windows\System\GGvbjAr.exe
  C:\Windows\System\GGvbjAr.exe
  2⤵
  PID:13140
- C:\Windows\System\LeXozZR.exe
  C:\Windows\System\LeXozZR.exe
  2⤵
  PID:10852
- C:\Windows\System\uHksmld.exe
  C:\Windows\System\uHksmld.exe
  2⤵
  PID:3292
- C:\Windows\System\OxCqxOi.exe
  C:\Windows\System\OxCqxOi.exe
  2⤵
  PID:10428
- C:\Windows\System\hkOjKTI.exe
  C:\Windows\System\hkOjKTI.exe
  2⤵
  PID:8848
- C:\Windows\System\wpaLSfD.exe
  C:\Windows\System\wpaLSfD.exe
  2⤵
  PID:10896
- C:\Windows\System\qwwguWg.exe
  C:\Windows\System\qwwguWg.exe
  2⤵
  PID:6348
- C:\Windows\System\aKRnluy.exe
  C:\Windows\System\aKRnluy.exe
  2⤵
  PID:9976
- C:\Windows\System\QdUnEJa.exe
  C:\Windows\System\QdUnEJa.exe
  2⤵
  PID:13032
- C:\Windows\System\MUVfbrm.exe
  C:\Windows\System\MUVfbrm.exe
  2⤵
  PID:8820
- C:\Windows\System\WwhCEQV.exe
  C:\Windows\System\WwhCEQV.exe
  2⤵
  PID:10088
- C:\Windows\System\laxgGwY.exe
  C:\Windows\System\laxgGwY.exe
  2⤵
  PID:13208
- C:\Windows\System\kpLvhjF.exe
  C:\Windows\System\kpLvhjF.exe
  2⤵
  PID:10800
- C:\Windows\System\lWLpCEs.exe
  C:\Windows\System\lWLpCEs.exe
  2⤵
  PID:13040
- C:\Windows\System\yQuILmz.exe
  C:\Windows\System\yQuILmz.exe
  2⤵
  PID:12696
- C:\Windows\System\mfjnude.exe
  C:\Windows\System\mfjnude.exe
  2⤵
  PID:12740
- C:\Windows\System\FJNaljO.exe
  C:\Windows\System\FJNaljO.exe
  2⤵
  PID:11276
- C:\Windows\System\HDQbtiv.exe
  C:\Windows\System\HDQbtiv.exe
  2⤵
  PID:10776
- C:\Windows\System\CCBlWlt.exe
  C:\Windows\System\CCBlWlt.exe
  2⤵
  PID:3412
- C:\Windows\System\IowLxzP.exe
  C:\Windows\System\IowLxzP.exe
  2⤵
  PID:10816
- C:\Windows\System\kWOmnfg.exe
  C:\Windows\System\kWOmnfg.exe
  2⤵
  PID:9316
- C:\Windows\System\OqTQnzi.exe
  C:\Windows\System\OqTQnzi.exe
  2⤵
  PID:11872
- C:\Windows\System\LXjRyyB.exe
  C:\Windows\System\LXjRyyB.exe
  2⤵
  PID:11632
- C:\Windows\System\aWSvpVs.exe
  C:\Windows\System\aWSvpVs.exe
  2⤵
  PID:13048
- C:\Windows\System\TyGPddc.exe
  C:\Windows\System\TyGPddc.exe
  2⤵
  PID:6484
- C:\Windows\System\ZByywBk.exe
  C:\Windows\System\ZByywBk.exe
  2⤵
  PID:12824
- C:\Windows\System\KNeVeIP.exe
  C:\Windows\System\KNeVeIP.exe
  2⤵
  PID:2816
- C:\Windows\System\hZPVgDZ.exe
  C:\Windows\System\hZPVgDZ.exe
  2⤵
  PID:11280
- C:\Windows\System\yQDdQOx.exe
  C:\Windows\System\yQDdQOx.exe
  2⤵
  PID:12648
- C:\Windows\System\nNTdpyg.exe
  C:\Windows\System\nNTdpyg.exe
  2⤵
  PID:13164
- C:\Windows\System\rNfhatp.exe
  C:\Windows\System\rNfhatp.exe
  2⤵
  PID:13104
- C:\Windows\System\yXgxQbw.exe
  C:\Windows\System\yXgxQbw.exe
  2⤵
  PID:9716
- C:\Windows\System\VwDbUHT.exe
  C:\Windows\System\VwDbUHT.exe
  2⤵
  PID:12580
- C:\Windows\System\UaXqaEY.exe
  C:\Windows\System\UaXqaEY.exe
  2⤵
  PID:6296
- C:\Windows\System\aqVTxhJ.exe
  C:\Windows\System\aqVTxhJ.exe
  2⤵
  PID:10876
- C:\Windows\System\zuZkCEf.exe
  C:\Windows\System\zuZkCEf.exe
  2⤵
  PID:3408
- C:\Windows\System\yVWqdQT.exe
  C:\Windows\System\yVWqdQT.exe
  2⤵
  PID:3632
- C:\Windows\System\rQtsFqs.exe
  C:\Windows\System\rQtsFqs.exe
  2⤵
  PID:5828
- C:\Windows\System\DMPDiXR.exe
  C:\Windows\System\DMPDiXR.exe
  2⤵
  PID:12324
- C:\Windows\System\qpVdZib.exe
  C:\Windows\System\qpVdZib.exe
  2⤵
  PID:13196
- C:\Windows\System\ymceSZD.exe
  C:\Windows\System\ymceSZD.exe
  2⤵
  PID:4460
- C:\Windows\System\JGrsdEG.exe
  C:\Windows\System\JGrsdEG.exe
  2⤵
  PID:3100
- C:\Windows\System\bRXNcvn.exe
  C:\Windows\System\bRXNcvn.exe
  2⤵
  PID:3112
- C:\Windows\System\qstboRJ.exe
  C:\Windows\System\qstboRJ.exe
  2⤵
  PID:5364
- C:\Windows\System\xZTdQue.exe
  C:\Windows\System\xZTdQue.exe
  2⤵
  PID:3448
- C:\Windows\System\JLaCAfb.exe
  C:\Windows\System\JLaCAfb.exe
  2⤵
  PID:13332
- C:\Windows\System\FztOpGB.exe
  C:\Windows\System\FztOpGB.exe
  2⤵
  PID:13372
- C:\Windows\System\ntYqJwM.exe
  C:\Windows\System\ntYqJwM.exe
  2⤵
  PID:13392
- C:\Windows\System\ZCcmApj.exe
  C:\Windows\System\ZCcmApj.exe
  2⤵
  PID:13412
- C:\Windows\System\NpRFqAF.exe
  C:\Windows\System\NpRFqAF.exe
  2⤵
  PID:13440
- C:\Windows\System\BpeflCw.exe
  C:\Windows\System\BpeflCw.exe
  2⤵
  PID:13456
- C:\Windows\System\QYLQuKr.exe
  C:\Windows\System\QYLQuKr.exe
  2⤵
  PID:13472
- C:\Windows\System\QhkWrIX.exe
  C:\Windows\System\QhkWrIX.exe
  2⤵
  PID:13488
- C:\Windows\System\setAHIv.exe
  C:\Windows\System\setAHIv.exe
  2⤵
  PID:13504
- C:\Windows\System\DnXLXtV.exe
  C:\Windows\System\DnXLXtV.exe
  2⤵
  PID:13520
- C:\Windows\System\uBrUqiA.exe
  C:\Windows\System\uBrUqiA.exe
  2⤵
  PID:13536
- C:\Windows\System\hTXaRlm.exe
  C:\Windows\System\hTXaRlm.exe
  2⤵
  PID:13552
- C:\Windows\System\kSIFZDo.exe
  C:\Windows\System\kSIFZDo.exe
  2⤵
  PID:13568
- C:\Windows\System\nrufUuB.exe
  C:\Windows\System\nrufUuB.exe
  2⤵
  PID:13584
- C:\Windows\System\LRFJXNA.exe
  C:\Windows\System\LRFJXNA.exe
  2⤵
  PID:13600
- C:\Windows\System\ToSrcZS.exe
  C:\Windows\System\ToSrcZS.exe
  2⤵
  PID:13616
- C:\Windows\System\HtIcgdb.exe
  C:\Windows\System\HtIcgdb.exe
  2⤵
  PID:13636
- C:\Windows\System\JosFRrO.exe
  C:\Windows\System\JosFRrO.exe
  2⤵
  PID:13656
- C:\Windows\System\jXkrDsp.exe
  C:\Windows\System\jXkrDsp.exe
  2⤵
  PID:13672
- C:\Windows\System\jcqTcsd.exe
  C:\Windows\System\jcqTcsd.exe
  2⤵
  PID:13688
- C:\Windows\System\GxBiggi.exe
  C:\Windows\System\GxBiggi.exe
  2⤵
  PID:13704
- C:\Windows\System\SYZxPTs.exe
  C:\Windows\System\SYZxPTs.exe
  2⤵
  PID:13720
- C:\Windows\System\PJYtAZm.exe
  C:\Windows\System\PJYtAZm.exe
  2⤵
  PID:13736
- C:\Windows\System\fBUMALK.exe
  C:\Windows\System\fBUMALK.exe
  2⤵
  PID:13760
- C:\Windows\System\mZughIx.exe
  C:\Windows\System\mZughIx.exe
  2⤵
  PID:13796
- C:\Windows\System\NAtoSuf.exe
  C:\Windows\System\NAtoSuf.exe
  2⤵
  PID:13812
- C:\Windows\System\ZyElNzX.exe
  C:\Windows\System\ZyElNzX.exe
  2⤵
  PID:13840
- C:\Windows\System\FngvNBK.exe
  C:\Windows\System\FngvNBK.exe
  2⤵
  PID:13868
- C:\Windows\System\MXtapqA.exe
  C:\Windows\System\MXtapqA.exe
  2⤵
  PID:13884
- C:\Windows\System\ykRiMMO.exe
  C:\Windows\System\ykRiMMO.exe
  2⤵
  PID:13900
- C:\Windows\System\YFGcrrB.exe
  C:\Windows\System\YFGcrrB.exe
  2⤵
  PID:13916
- C:\Windows\System\AZTuvGe.exe
  C:\Windows\System\AZTuvGe.exe
  2⤵
  PID:13932
- C:\Windows\System\UwikJwv.exe
  C:\Windows\System\UwikJwv.exe
  2⤵
  PID:13948
- C:\Windows\System\UOVLWGB.exe
  C:\Windows\System\UOVLWGB.exe
  2⤵
  PID:13972
- C:\Windows\System\BVGJEmZ.exe
  C:\Windows\System\BVGJEmZ.exe
  2⤵
  PID:13988
- C:\Windows\System\wLMNZwU.exe
  C:\Windows\System\wLMNZwU.exe
  2⤵
  PID:14008
- C:\Windows\System\GxKmxWI.exe
  C:\Windows\System\GxKmxWI.exe
  2⤵
  PID:14024
- C:\Windows\System\jFcXlVi.exe
  C:\Windows\System\jFcXlVi.exe
  2⤵
  PID:14040
- C:\Windows\System\MhsyWlF.exe
  C:\Windows\System\MhsyWlF.exe
  2⤵
  PID:14056
- C:\Windows\System\lPoLDOk.exe
  C:\Windows\System\lPoLDOk.exe
  2⤵
  PID:14072
- C:\Windows\System\CUkJJtR.exe
  C:\Windows\System\CUkJJtR.exe
  2⤵
  PID:14088
- C:\Windows\System\ZYptpPO.exe
  C:\Windows\System\ZYptpPO.exe
  2⤵
  PID:14104
- C:\Windows\System\gGLVtKr.exe
  C:\Windows\System\gGLVtKr.exe
  2⤵
  PID:14160
- C:\Windows\System\FvKTlrQ.exe
  C:\Windows\System\FvKTlrQ.exe
  2⤵
  PID:14176
- C:\Windows\System\UCgAogG.exe
  C:\Windows\System\UCgAogG.exe
  2⤵
  PID:14192
- C:\Windows\System\bEOfvan.exe
  C:\Windows\System\bEOfvan.exe
  2⤵
  PID:14208
- C:\Windows\System\YWKoDQL.exe
  C:\Windows\System\YWKoDQL.exe
  2⤵
  PID:14224
- C:\Windows\System\sIjTgai.exe
  C:\Windows\System\sIjTgai.exe
  2⤵
  PID:14240
- C:\Windows\System\FBeANXb.exe
  C:\Windows\System\FBeANXb.exe
  2⤵
  PID:14256
- C:\Windows\System\GUYFvTO.exe
  C:\Windows\System\GUYFvTO.exe
  2⤵
  PID:14272
- C:\Windows\System\vKkSGGM.exe
  C:\Windows\System\vKkSGGM.exe
  2⤵
  PID:14288
- C:\Windows\System\DxWQvAJ.exe
  C:\Windows\System\DxWQvAJ.exe
  2⤵
  PID:14312
- C:\Windows\System\UXkVCvw.exe
  C:\Windows\System\UXkVCvw.exe
  2⤵
  PID:14328
- C:\Windows\System\JBUuXGk.exe
  C:\Windows\System\JBUuXGk.exe
  2⤵
  PID:5140
- C:\Windows\System\mChDaiu.exe
  C:\Windows\System\mChDaiu.exe
  2⤵
  PID:2948
- C:\Windows\System\zTtPmnL.exe
  C:\Windows\System\zTtPmnL.exe
  2⤵
  PID:11384
- C:\Windows\System\ylXXwcH.exe
  C:\Windows\System\ylXXwcH.exe
  2⤵
  PID:13268
- C:\Windows\System\LSYZQCO.exe
  C:\Windows\System\LSYZQCO.exe
  2⤵
  PID:13324
- C:\Windows\System\EucXtEe.exe
  C:\Windows\System\EucXtEe.exe
  2⤵
  PID:13344
- C:\Windows\System\IAOcbVN.exe
  C:\Windows\System\IAOcbVN.exe
  2⤵
  PID:13356
- C:\Windows\System\GDwLvcw.exe
  C:\Windows\System\GDwLvcw.exe
  2⤵
  PID:13384
- C:\Windows\System\rsanqJg.exe
  C:\Windows\System\rsanqJg.exe
  2⤵
  PID:14188
- C:\Windows\System\gUQNBGx.exe
  C:\Windows\System\gUQNBGx.exe
  2⤵
  PID:14304
- C:\Windows\System\URCXBJl.exe
  C:\Windows\System\URCXBJl.exe
  2⤵
  PID:4212
- C:\Windows\System\YoJNGqG.exe
  C:\Windows\System\YoJNGqG.exe
  2⤵
  PID:13644
- C:\Windows\System\qiBJHLY.exe
  C:\Windows\System\qiBJHLY.exe
  2⤵
  PID:4968
- C:\Windows\System\xBfrrFh.exe
  C:\Windows\System\xBfrrFh.exe
  2⤵
  PID:13368
- C:\Windows\System\UPxAgIZ.exe
  C:\Windows\System\UPxAgIZ.exe
  2⤵
  PID:13452
- C:\Windows\System\kUizugz.exe
  C:\Windows\System\kUizugz.exe
  2⤵
  PID:14112
- C:\Windows\System\QwAQFic.exe
  C:\Windows\System\QwAQFic.exe
  2⤵
  PID:13484
- C:\Windows\System\rHqDzNR.exe
  C:\Windows\System\rHqDzNR.exe
  2⤵
  PID:2464
- C:\Windows\System\YCMgNzZ.exe
  C:\Windows\System\YCMgNzZ.exe
  2⤵
  PID:13548
- C:\Windows\System\lrLURiS.exe
  C:\Windows\System\lrLURiS.exe
  2⤵
  PID:13560
- C:\Windows\System\vOxSQwy.exe
  C:\Windows\System\vOxSQwy.exe
  2⤵
  PID:13608
- C:\Windows\System\hPaVEXg.exe
  C:\Windows\System\hPaVEXg.exe
  2⤵
  PID:13664
- C:\Windows\System\UbYkuee.exe
  C:\Windows\System\UbYkuee.exe
  2⤵
  PID:13696
- C:\Windows\System\XJkCREJ.exe
  C:\Windows\System\XJkCREJ.exe
  2⤵
  PID:1892
- C:\Windows\System\ogCqaJR.exe
  C:\Windows\System\ogCqaJR.exe
  2⤵
  PID:13792
- C:\Windows\System\nMfXBBp.exe
  C:\Windows\System\nMfXBBp.exe
  2⤵
  PID:2704
- C:\Windows\System\oIjJxrd.exe
  C:\Windows\System\oIjJxrd.exe
  2⤵
  PID:2580
- C:\Windows\System\ytkGyap.exe
  C:\Windows\System\ytkGyap.exe
  2⤵
  PID:4572
- C:\Windows\System\XTwDcRx.exe
  C:\Windows\System\XTwDcRx.exe
  2⤵
  PID:4752
- C:\Windows\System\YvEStyX.exe
  C:\Windows\System\YvEStyX.exe
  2⤵
  PID:908
- C:\Windows\System\gNHEItL.exe
  C:\Windows\System\gNHEItL.exe
  2⤵
  PID:6712
- C:\Windows\System\aSQwPgL.exe
  C:\Windows\System\aSQwPgL.exe
  2⤵
  PID:3624
- C:\Windows\System\RaxwsHy.exe
  C:\Windows\System\RaxwsHy.exe
  2⤵
  PID:13432
- C:\Windows\System\bRMCLEn.exe
  C:\Windows\System\bRMCLEn.exe
  2⤵
  PID:13436
- C:\Windows\System\saLnVWA.exe
  C:\Windows\System\saLnVWA.exe
  2⤵
  PID:4484
- C:\Windows\System\ENZmhyT.exe
  C:\Windows\System\ENZmhyT.exe
  2⤵
  PID:13480
- C:\Windows\System\wBmqoMa.exe
  C:\Windows\System\wBmqoMa.exe
  2⤵
  PID:3940
- C:\Windows\System\pZkmpCi.exe
  C:\Windows\System\pZkmpCi.exe
  2⤵
  PID:13580
- C:\Windows\System\oDNXyBZ.exe
  C:\Windows\System\oDNXyBZ.exe
  2⤵
  PID:1984
- C:\Windows\System\GCJayDg.exe
  C:\Windows\System\GCJayDg.exe
  2⤵
  PID:13680
- C:\Windows\System\vNZWqKg.exe
  C:\Windows\System\vNZWqKg.exe
  2⤵
  PID:2600
- C:\Windows\System\IqGmUck.exe
  C:\Windows\System\IqGmUck.exe
  2⤵
  PID:3484
- C:\Windows\System\KRwbdUs.exe
  C:\Windows\System\KRwbdUs.exe
  2⤵
  PID:2504
- C:\Windows\System\jGFSLso.exe
  C:\Windows\System\jGFSLso.exe
  2⤵
  PID:3196
- C:\Windows\System\TmPoVvz.exe
  C:\Windows\System\TmPoVvz.exe
  2⤵
  PID:3224
- C:\Windows\System\wNKKLdp.exe
  C:\Windows\System\wNKKLdp.exe
  2⤵
  PID:5076
- C:\Windows\System\EKttRmI.exe
  C:\Windows\System\EKttRmI.exe
  2⤵
  PID:3936
- C:\Windows\System\GUkKOEG.exe
  C:\Windows\System\GUkKOEG.exe
  2⤵
  PID:1612
- C:\Windows\System\qvSulkg.exe
  C:\Windows\System\qvSulkg.exe
  2⤵
  PID:1924
- C:\Windows\System\OCpLrZF.exe
  C:\Windows\System\OCpLrZF.exe
  2⤵
  PID:4012
- C:\Windows\System\wQvOjEd.exe
  C:\Windows\System\wQvOjEd.exe
  2⤵
  PID:320
- C:\Windows\System\wUbqCEL.exe
  C:\Windows\System\wUbqCEL.exe
  2⤵
  PID:13880
- C:\Windows\System\yVNkzpG.exe
  C:\Windows\System\yVNkzpG.exe
  2⤵
  PID:13380
- C:\Windows\System\RzUqpPk.exe
  C:\Windows\System\RzUqpPk.exe
  2⤵
  PID:13768
- C:\Windows\System\EtRLCxv.exe
  C:\Windows\System\EtRLCxv.exe
  2⤵
  PID:6216
- C:\Windows\System\kjHOSZc.exe
  C:\Windows\System\kjHOSZc.exe
  2⤵
  PID:12780
- C:\Windows\System\WmYuTdf.exe
  C:\Windows\System\WmYuTdf.exe
  2⤵
  PID:5480
- C:\Windows\System\FOZbzVi.exe
  C:\Windows\System\FOZbzVi.exe
  2⤵
  PID:5264
- C:\Windows\System\AbQaAUA.exe
  C:\Windows\System\AbQaAUA.exe
  2⤵
  PID:13960
- C:\Windows\System\WLlRMky.exe
  C:\Windows\System\WLlRMky.exe
  2⤵
  PID:4876
- C:\Windows\System\cmgLPWo.exe
  C:\Windows\System\cmgLPWo.exe
  2⤵
  PID:4652
- C:\Windows\System\GnWewBE.exe
  C:\Windows\System\GnWewBE.exe
  2⤵
  PID:5732
- C:\Windows\System\cVluihv.exe
  C:\Windows\System\cVluihv.exe
  2⤵
  PID:1608
- C:\Windows\System\RlYZuHv.exe
  C:\Windows\System\RlYZuHv.exe
  2⤵
  PID:5952
- C:\Windows\System\tfvazeW.exe
  C:\Windows\System\tfvazeW.exe
  2⤵
  PID:2536
- C:\Windows\System\NKskzZq.exe
  C:\Windows\System\NKskzZq.exe
  2⤵
  PID:2256
- C:\Windows\System\jWBQmMh.exe
  C:\Windows\System\jWBQmMh.exe
  2⤵
  PID:516
- C:\Windows\System\wNOUbtu.exe
  C:\Windows\System\wNOUbtu.exe
  2⤵
  PID:2624
- C:\Windows\System\InEWqXO.exe
  C:\Windows\System\InEWqXO.exe
  2⤵
  PID:6000
- C:\Windows\System\iDeWYjc.exe
  C:\Windows\System\iDeWYjc.exe
  2⤵
  PID:5808
- C:\Windows\System\ATsjFmI.exe
  C:\Windows\System\ATsjFmI.exe
  2⤵
  PID:14264
- C:\Windows\System\RPEoFuh.exe
  C:\Windows\System\RPEoFuh.exe
  2⤵
  PID:2996
- C:\Windows\System\sJCoiss.exe
  C:\Windows\System\sJCoiss.exe
  2⤵
  PID:13564
- C:\Windows\System\icFKhkm.exe
  C:\Windows\System\icFKhkm.exe
  2⤵
  PID:14120
- C:\Windows\System\mIJJMsk.exe
  C:\Windows\System\mIJJMsk.exe
  2⤵
  PID:4028
- C:\Windows\System\fVJmCKj.exe
  C:\Windows\System\fVJmCKj.exe
  2⤵
  PID:14132
- C:\Windows\System\YKhoExG.exe
  C:\Windows\System\YKhoExG.exe
  2⤵
  PID:14324
- C:\Windows\System\ZfvBlFD.exe
  C:\Windows\System\ZfvBlFD.exe
  2⤵
  PID:2148
- C:\Windows\System\qFCNFci.exe
  C:\Windows\System\qFCNFci.exe
  2⤵
  PID:3496
- C:\Windows\System\EKkhpZR.exe
  C:\Windows\System\EKkhpZR.exe
  2⤵
  PID:13388
- C:\Windows\System\yoZlBTj.exe
  C:\Windows\System\yoZlBTj.exe
  2⤵
  PID:5992
- C:\Windows\System\lezwvFY.exe
  C:\Windows\System\lezwvFY.exe
  2⤵
  PID:12380
- C:\Windows\System\ETxbZcV.exe
  C:\Windows\System\ETxbZcV.exe
  2⤵
  PID:14068
- C:\Windows\System\aqPTYsP.exe
  C:\Windows\System\aqPTYsP.exe
  2⤵
  PID:4964
- C:\Windows\System\cWoVFFl.exe
  C:\Windows\System\cWoVFFl.exe
  2⤵
  PID:4640
- C:\Windows\System\cnwpyxu.exe
  C:\Windows\System\cnwpyxu.exe
  2⤵
  PID:2436
- C:\Windows\System\DopahBy.exe
  C:\Windows\System\DopahBy.exe
  2⤵
  PID:2812
- C:\Windows\System\MmXhaZS.exe
  C:\Windows\System\MmXhaZS.exe
  2⤵
  PID:14236
- C:\Windows\System\CuAZGra.exe
  C:\Windows\System\CuAZGra.exe
  2⤵
  PID:14320
- C:\Windows\System\sGnYZPg.exe
  C:\Windows\System\sGnYZPg.exe
  2⤵
  PID:3828
- C:\Windows\System\CYlOEpQ.exe
  C:\Windows\System\CYlOEpQ.exe
  2⤵
  PID:13512
- C:\Windows\System\kurlWpZ.exe
  C:\Windows\System\kurlWpZ.exe
  2⤵
  PID:13716
- C:\Windows\System\cyfOpzW.exe
  C:\Windows\System\cyfOpzW.exe
  2⤵
  PID:13824
- C:\Windows\System\DUnWbrk.exe
  C:\Windows\System\DUnWbrk.exe
  2⤵
  PID:5380
- C:\Windows\System\hESdJGg.exe
  C:\Windows\System\hESdJGg.exe
  2⤵
  PID:5328
- C:\Windows\System\sUIBAVL.exe
  C:\Windows\System\sUIBAVL.exe
  2⤵
  PID:2632
- C:\Windows\System\pNeuMty.exe
  C:\Windows\System\pNeuMty.exe
  2⤵
  PID:5428
- C:\Windows\System\JrAUEJi.exe
  C:\Windows\System\JrAUEJi.exe
  2⤵
  PID:5964
- C:\Windows\System\YwhaiSQ.exe
  C:\Windows\System\YwhaiSQ.exe
  2⤵
  PID:5164
- C:\Windows\System\FTYyEpS.exe
  C:\Windows\System\FTYyEpS.exe
  2⤵
  PID:5572
- C:\Windows\System\gBTYTgj.exe
  C:\Windows\System\gBTYTgj.exe
  2⤵
  PID:5932
- C:\Windows\System\vGZtArS.exe
  C:\Windows\System\vGZtArS.exe
  2⤵
  PID:5840
- C:\Windows\System\sLTaGNd.exe
  C:\Windows\System\sLTaGNd.exe
  2⤵
  PID:5472
- C:\Windows\System\RLBqgGS.exe
  C:\Windows\System\RLBqgGS.exe
  2⤵
  PID:6020
- C:\Windows\System\xVnovEr.exe
  C:\Windows\System\xVnovEr.exe
  2⤵
  PID:1020
- C:\Windows\System\KcqFpwl.exe
  C:\Windows\System\KcqFpwl.exe
  2⤵
  PID:5528
- C:\Windows\System\ePkdTTA.exe
  C:\Windows\System\ePkdTTA.exe
  2⤵
  PID:3108
- C:\Windows\System\XpZuCkT.exe
  C:\Windows\System\XpZuCkT.exe
  2⤵
  PID:5148
- C:\Windows\System\KwzMcIO.exe
  C:\Windows\System\KwzMcIO.exe
  2⤵
  PID:3588
- C:\Windows\System\zUhKuSb.exe
  C:\Windows\System\zUhKuSb.exe
  2⤵
  PID:5996
- C:\Windows\System\rlBIABC.exe
  C:\Windows\System\rlBIABC.exe
  2⤵
  PID:6012
- C:\Windows\System\dFXnwaW.exe
  C:\Windows\System\dFXnwaW.exe
  2⤵
  PID:6064
- C:\Windows\System\yhHiNAA.exe
  C:\Windows\System\yhHiNAA.exe
  2⤵
  PID:1940
- C:\Windows\System\LwLsbVm.exe
  C:\Windows\System\LwLsbVm.exe
  2⤵
  PID:2296
- C:\Windows\System\jCuenGM.exe
  C:\Windows\System\jCuenGM.exe
  2⤵
  PID:14280
- C:\Windows\System\dMSqvEi.exe
  C:\Windows\System\dMSqvEi.exe
  2⤵
  PID:2976
- C:\Windows\System\icxujmj.exe
  C:\Windows\System\icxujmj.exe
  2⤵
  PID:6128
- C:\Windows\System\BSCJmMm.exe
  C:\Windows\System\BSCJmMm.exe
  2⤵
  PID:14172
- C:\Windows\System\GeUlEZV.exe
  C:\Windows\System\GeUlEZV.exe
  2⤵
  PID:2412
- C:\Windows\System\eZCKIwu.exe
  C:\Windows\System\eZCKIwu.exe
  2⤵
  PID:5188
- C:\Windows\System\vRgGAmU.exe
  C:\Windows\System\vRgGAmU.exe
  2⤵
  PID:1796
- C:\Windows\System\zWoXUeX.exe
  C:\Windows\System\zWoXUeX.exe
  2⤵
  PID:812
- C:\Windows\System\JGHmmSY.exe
  C:\Windows\System\JGHmmSY.exe
  2⤵
  PID:3172
- C:\Windows\System\ijgXQrY.exe
  C:\Windows\System\ijgXQrY.exe
  2⤵
  PID:13576
- C:\Windows\System\zKngDsW.exe
  C:\Windows\System\zKngDsW.exe
  2⤵
  PID:5408
- C:\Windows\System\MtLsDNc.exe
  C:\Windows\System\MtLsDNc.exe
  2⤵
  PID:5084
- C:\Windows\System\nKrpJIg.exe
  C:\Windows\System\nKrpJIg.exe
  2⤵
  PID:5924
- C:\Windows\System\tHpuMAt.exe
  C:\Windows\System\tHpuMAt.exe
  2⤵
  PID:14148
- C:\Windows\System\vsGHtbI.exe
  C:\Windows\System\vsGHtbI.exe
  2⤵
  PID:5476
- C:\Windows\System\armOjfL.exe
  C:\Windows\System\armOjfL.exe
  2⤵
  PID:904
- C:\Windows\System\TldUklt.exe
  C:\Windows\System\TldUklt.exe
  2⤵
  PID:772
- C:\Windows\System\YIPtLLA.exe
  C:\Windows\System\YIPtLLA.exe
  2⤵
  PID:6600
- C:\Windows\System\enOwKvG.exe
  C:\Windows\System\enOwKvG.exe
  2⤵
  PID:13996
- C:\Windows\System\WivoRzK.exe
  C:\Windows\System\WivoRzK.exe
  2⤵
  PID:6580
- C:\Windows\System\erXDJHD.exe
  C:\Windows\System\erXDJHD.exe
  2⤵
  PID:804
- C:\Windows\System\VSDiYrA.exe
  C:\Windows\System\VSDiYrA.exe
  2⤵
  PID:13896
- C:\Windows\System\fRyLxIJ.exe
  C:\Windows\System\fRyLxIJ.exe
  2⤵
  PID:6596
- C:\Windows\System\hwpHUYD.exe
  C:\Windows\System\hwpHUYD.exe
  2⤵
  PID:14156
- C:\Windows\System\RhpqIvq.exe
  C:\Windows\System\RhpqIvq.exe
  2⤵
  PID:6604
- C:\Windows\System\tjlxcSv.exe
  C:\Windows\System\tjlxcSv.exe
  2⤵
  PID:13408
- C:\Windows\System\MtouexR.exe
  C:\Windows\System\MtouexR.exe
  2⤵
  PID:6152
- C:\Windows\System\cukSOAE.exe
  C:\Windows\System\cukSOAE.exe
  2⤵
  PID:6092
- C:\Windows\System\yqFzqtH.exe
  C:\Windows\System\yqFzqtH.exe
  2⤵
  PID:8960
- C:\Windows\System\tKxubkr.exe
  C:\Windows\System\tKxubkr.exe
  2⤵
  PID:3232
- C:\Windows\System\QmuJULo.exe
  C:\Windows\System\QmuJULo.exe
  2⤵
  PID:5296
- C:\Windows\System\wMPJHic.exe
  C:\Windows\System\wMPJHic.exe
  2⤵
  PID:2132
- C:\Windows\System\DZnousA.exe
  C:\Windows\System\DZnousA.exe
  2⤵
  PID:3388
- C:\Windows\System\UqlPFmO.exe
  C:\Windows\System\UqlPFmO.exe
  2⤵
  PID:6308
- C:\Windows\System\ndmkFLw.exe
  C:\Windows\System\ndmkFLw.exe
  2⤵
  PID:2036
- C:\Windows\System\aZyvSFa.exe
  C:\Windows\System\aZyvSFa.exe
  2⤵
  PID:4036
- C:\Windows\System\AlWcgRn.exe
  C:\Windows\System\AlWcgRn.exe
  2⤵
  PID:5516
- C:\Windows\System\DytDNak.exe
  C:\Windows\System\DytDNak.exe
  2⤵
  PID:6680
- C:\Windows\System\LeKDkZL.exe
  C:\Windows\System\LeKDkZL.exe
  2⤵
  PID:5488
- C:\Windows\System\moeuEGd.exe
  C:\Windows\System\moeuEGd.exe
  2⤵
  PID:5972
- C:\Windows\System\wRctNCx.exe
  C:\Windows\System\wRctNCx.exe
  2⤵
  PID:5944
- C:\Windows\System\yoXTAzx.exe
  C:\Windows\System\yoXTAzx.exe
  2⤵
  PID:6040
- C:\Windows\System\IzkUvns.exe
  C:\Windows\System\IzkUvns.exe
  2⤵
  PID:6704
- C:\Windows\System\FaKYHgX.exe
  C:\Windows\System\FaKYHgX.exe
  2⤵
  PID:6072
- C:\Windows\System\wnQbOjg.exe
  C:\Windows\System\wnQbOjg.exe
  2⤵
  PID:2124
- C:\Windows\System\sVLZdzI.exe
  C:\Windows\System\sVLZdzI.exe
  2⤵
  PID:4364
- C:\Windows\System\JIlTEOJ.exe
  C:\Windows\System\JIlTEOJ.exe
  2⤵
  PID:4504
- C:\Windows\System\VMkSZTm.exe
  C:\Windows\System\VMkSZTm.exe
  2⤵
  PID:6080
- C:\Windows\System\cQrbkmP.exe
  C:\Windows\System\cQrbkmP.exe
  2⤵
  PID:6028
- C:\Windows\System\RTkIIIA.exe
  C:\Windows\System\RTkIIIA.exe
  2⤵
  PID:14232
- C:\Windows\System\lNeGnxd.exe
  C:\Windows\System\lNeGnxd.exe
  2⤵
  PID:5172
- C:\Windows\System\mwuSkrC.exe
  C:\Windows\System\mwuSkrC.exe
  2⤵
  PID:5332
- C:\Windows\System\uaTxBny.exe
  C:\Windows\System\uaTxBny.exe
  2⤵
  PID:14064
- C:\Windows\System\pjIfGmN.exe
  C:\Windows\System\pjIfGmN.exe
  2⤵
  PID:4516
- C:\Windows\System\USFFbGA.exe
  C:\Windows\System\USFFbGA.exe
  2⤵
  PID:6860
- C:\Windows\System\qdJEuyf.exe
  C:\Windows\System\qdJEuyf.exe
  2⤵
  PID:12896
- C:\Windows\System\KGAYedb.exe
  C:\Windows\System\KGAYedb.exe
  2⤵
  PID:13908
- C:\Windows\System\XmGgXrg.exe
  C:\Windows\System\XmGgXrg.exe
  2⤵
  PID:1492
- C:\Windows\System\bltdMGF.exe
  C:\Windows\System\bltdMGF.exe
  2⤵
  PID:3892
- C:\Windows\System\aPpPEfz.exe
  C:\Windows\System\aPpPEfz.exe
  2⤵
  PID:4708
- C:\Windows\System\PvIAKNL.exe
  C:\Windows\System\PvIAKNL.exe
  2⤵
  PID:13732
- C:\Windows\System\VFCxSWT.exe
  C:\Windows\System\VFCxSWT.exe
  2⤵
  PID:14220
- C:\Windows\System\iZUdWIL.exe
  C:\Windows\System\iZUdWIL.exe
  2⤵
  PID:5544
- C:\Windows\System\luRRjHQ.exe
  C:\Windows\System\luRRjHQ.exe
  2⤵
  PID:14216
- C:\Windows\System\GVrddUe.exe
  C:\Windows\System\GVrddUe.exe
  2⤵
  PID:1136
- C:\Windows\System\GBCvcCo.exe
  C:\Windows\System\GBCvcCo.exe
  2⤵
  PID:6232
- C:\Windows\System\bjgCUoZ.exe
  C:\Windows\System\bjgCUoZ.exe
  2⤵
  PID:5916
- C:\Windows\System\NaoKhpA.exe
  C:\Windows\System\NaoKhpA.exe
  2⤵
  PID:6636
- C:\Windows\System\yOmkjSl.exe
  C:\Windows\System\yOmkjSl.exe
  2⤵
  PID:6824
- C:\Windows\System\WjPjtAY.exe
  C:\Windows\System\WjPjtAY.exe
  2⤵
  PID:6660
- C:\Windows\System\gxUIDdU.exe
  C:\Windows\System\gxUIDdU.exe
  2⤵
  PID:2844
- C:\Windows\System\KoiGNYf.exe
  C:\Windows\System\KoiGNYf.exe
  2⤵
  PID:2252
- C:\Windows\System\FRmExrn.exe
  C:\Windows\System\FRmExrn.exe
  2⤵
  PID:6236
- C:\Windows\System\GcUEIBZ.exe
  C:\Windows\System\GcUEIBZ.exe
  2⤵
  PID:4996
- C:\Windows\System\XtLUSmw.exe
  C:\Windows\System\XtLUSmw.exe
  2⤵
  PID:6220
- C:\Windows\System\GotXkXj.exe
  C:\Windows\System\GotXkXj.exe
  2⤵
  PID:5216
- C:\Windows\System\SytZAct.exe
  C:\Windows\System\SytZAct.exe
  2⤵
  PID:5124
- C:\Windows\System\IkVDIfg.exe
  C:\Windows\System\IkVDIfg.exe
  2⤵
  PID:5948
- C:\Windows\System\huMSNcA.exe
  C:\Windows\System\huMSNcA.exe
  2⤵
  PID:6552
- C:\Windows\System\BUvwUaZ.exe
  C:\Windows\System\BUvwUaZ.exe
  2⤵
  PID:5936
- C:\Windows\System\Xlaivev.exe
  C:\Windows\System\Xlaivev.exe
  2⤵
  PID:6688
- C:\Windows\System\IcxMcPt.exe
  C:\Windows\System\IcxMcPt.exe
  2⤵
  PID:6972
- C:\Windows\System\mSOiNpq.exe
  C:\Windows\System\mSOiNpq.exe
  2⤵
  PID:4064
- C:\Windows\System\KTpLMmL.exe
  C:\Windows\System\KTpLMmL.exe
  2⤵
  PID:1916
- C:\Windows\System\WCUiUtv.exe
  C:\Windows\System\WCUiUtv.exe
  2⤵
  PID:5460
- C:\Windows\System\mLpkcuP.exe
  C:\Windows\System\mLpkcuP.exe
  2⤵
  PID:2032
- C:\Windows\System\ELDZNDm.exe
  C:\Windows\System\ELDZNDm.exe
  2⤵
  PID:6260
- C:\Windows\System\tPDAzcx.exe
  C:\Windows\System\tPDAzcx.exe
  2⤵
  PID:5128
- C:\Windows\System\XCZQaUj.exe
  C:\Windows\System\XCZQaUj.exe
  2⤵
  PID:5436
- C:\Windows\System\zWXKrwl.exe
  C:\Windows\System\zWXKrwl.exe
  2⤵
  PID:6124
- C:\Windows\System\Scupvdt.exe
  C:\Windows\System\Scupvdt.exe
  2⤵
  PID:6976
- C:\Windows\System\fHWFgLT.exe
  C:\Windows\System\fHWFgLT.exe
  2⤵
  PID:6804
- C:\Windows\System\nSLAivG.exe
  C:\Windows\System\nSLAivG.exe
  2⤵
  PID:2648
- C:\Windows\System\gqdwAgC.exe
  C:\Windows\System\gqdwAgC.exe
  2⤵
  PID:6728
- C:\Windows\System\SwEHgOQ.exe
  C:\Windows\System\SwEHgOQ.exe
  2⤵
  PID:13984
- C:\Windows\System\dSRaHAg.exe
  C:\Windows\System\dSRaHAg.exe
  2⤵
  PID:6996
- C:\Windows\System\VlqURKt.exe
  C:\Windows\System\VlqURKt.exe
  2⤵
  PID:6740
- C:\Windows\System\dIfmoWj.exe
  C:\Windows\System\dIfmoWj.exe
  2⤵
  PID:7060
- C:\Windows\System\LmuHqqN.exe
  C:\Windows\System\LmuHqqN.exe
  2⤵
  PID:14144
- C:\Windows\System\EbEPPhE.exe
  C:\Windows\System\EbEPPhE.exe
  2⤵
  PID:6984
- C:\Windows\System\rQtHSjh.exe
  C:\Windows\System\rQtHSjh.exe
  2⤵
  PID:2456
- C:\Windows\System\HZGdkpa.exe
  C:\Windows\System\HZGdkpa.exe
  2⤵
  PID:5444
- C:\Windows\System\sjEigqK.exe
  C:\Windows\System\sjEigqK.exe
  2⤵
  PID:5624
- C:\Windows\System\qQXbyfq.exe
  C:\Windows\System\qQXbyfq.exe
  2⤵
  PID:5588
- C:\Windows\System\OrsufjV.exe
  C:\Windows\System\OrsufjV.exe
  2⤵
  PID:5412
- C:\Windows\System\EznfMxr.exe
  C:\Windows\System\EznfMxr.exe
  2⤵
  PID:6476
- C:\Windows\System\VzUDIov.exe
  C:\Windows\System\VzUDIov.exe
  2⤵
  PID:7088
- C:\Windows\System\KGiYRta.exe
  C:\Windows\System\KGiYRta.exe
  2⤵
  PID:1880
- C:\Windows\System\pktpWuS.exe
  C:\Windows\System\pktpWuS.exe
  2⤵
  PID:1912
- C:\Windows\System\xCESRal.exe
  C:\Windows\System\xCESRal.exe
  2⤵
  PID:1044
- C:\Windows\System\dBkVLuP.exe
  C:\Windows\System\dBkVLuP.exe
  2⤵
  PID:4488
- C:\Windows\System\mkycBKK.exe
  C:\Windows\System\mkycBKK.exe
  2⤵
  PID:5224
- C:\Windows\System\oVKihgp.exe
  C:\Windows\System\oVKihgp.exe
  2⤵
  PID:2220
- C:\Windows\System\hcggefs.exe
  C:\Windows\System\hcggefs.exe
  2⤵
  PID:5260
- C:\Windows\System\IvgkGjY.exe
  C:\Windows\System\IvgkGjY.exe
  2⤵
  PID:3648
- C:\Windows\System\LzwxiNI.exe
  C:\Windows\System\LzwxiNI.exe
  2⤵
  PID:7056
- C:\Windows\System\ZpKtYRo.exe
  C:\Windows\System\ZpKtYRo.exe
  2⤵
  PID:14004
- C:\Windows\System\TSKHbLx.exe
  C:\Windows\System\TSKHbLx.exe
  2⤵
  PID:13532
- C:\Windows\System\FYQYMWE.exe
  C:\Windows\System\FYQYMWE.exe
  2⤵
  PID:13464
- C:\Windows\System\vFTzKNV.exe
  C:\Windows\System\vFTzKNV.exe
  2⤵
  PID:5012
- C:\Windows\System\mGUSbqt.exe
  C:\Windows\System\mGUSbqt.exe
  2⤵
  PID:876
- C:\Windows\System\XPTwhlX.exe
  C:\Windows\System\XPTwhlX.exe
  2⤵
  PID:6388
- C:\Windows\System\ZyWSeqB.exe
  C:\Windows\System\ZyWSeqB.exe
  2⤵
  PID:5504
- C:\Windows\System\ZEZXHHi.exe
  C:\Windows\System\ZEZXHHi.exe
  2⤵
  PID:5524
- C:\Windows\System\VRlYgti.exe
  C:\Windows\System\VRlYgti.exe
  2⤵
  PID:5468
- C:\Windows\System\PkXbPac.exe
  C:\Windows\System\PkXbPac.exe
  2⤵
  PID:6864
- C:\Windows\System\xuPSdvM.exe
  C:\Windows\System\xuPSdvM.exe
  2⤵
  PID:5136
- C:\Windows\System\NDwiSVv.exe
  C:\Windows\System\NDwiSVv.exe
  2⤵
  PID:5540
- C:\Windows\System\sZMhZsP.exe
  C:\Windows\System\sZMhZsP.exe
  2⤵
  PID:6772
- C:\Windows\System\XPurwct.exe
  C:\Windows\System\XPurwct.exe
  2⤵
  PID:6812
- C:\Windows\System\bQOxgIY.exe
  C:\Windows\System\bQOxgIY.exe
  2⤵
  PID:5064
- C:\Windows\System\xjPGBQY.exe
  C:\Windows\System\xjPGBQY.exe
  2⤵
  PID:6056
- C:\Windows\System\QRSmBAA.exe
  C:\Windows\System\QRSmBAA.exe
  2⤵
  PID:3656
- C:\Windows\System\nsnXaVa.exe
  C:\Windows\System\nsnXaVa.exe
  2⤵
  PID:740
- C:\Windows\System\xrpMHLG.exe
  C:\Windows\System\xrpMHLG.exe
  2⤵
  PID:5772
- C:\Windows\System\fqzFdLh.exe
  C:\Windows\System\fqzFdLh.exe
  2⤵
  PID:13928
- C:\Windows\System\squAfrx.exe
  C:\Windows\System\squAfrx.exe
  2⤵
  PID:7040
- C:\Windows\System\FKZHjWs.exe
  C:\Windows\System\FKZHjWs.exe
  2⤵
  PID:6304
- C:\Windows\System\dPTNYJD.exe
  C:\Windows\System\dPTNYJD.exe
  2⤵
  PID:2060
- C:\Windows\System\rUXAKJs.exe
  C:\Windows\System\rUXAKJs.exe
  2⤵
  PID:6856
- C:\Windows\System\spApCBT.exe
  C:\Windows\System\spApCBT.exe
  2⤵
  PID:5292
- C:\Windows\System\cwcvwbL.exe
  C:\Windows\System\cwcvwbL.exe
  2⤵
  PID:13364
- C:\Windows\System\KGwLmjT.exe
  C:\Windows\System\KGwLmjT.exe
  2⤵
  PID:13420
- C:\Windows\System\JgWWIus.exe
  C:\Windows\System\JgWWIus.exe
  2⤵
  PID:6320
- C:\Windows\System\urTqIfU.exe
  C:\Windows\System\urTqIfU.exe
  2⤵
  PID:6656
- C:\Windows\System\IRcxXbg.exe
  C:\Windows\System\IRcxXbg.exe
  2⤵
  PID:1344
- C:\Windows\System\cUWQsUr.exe
  C:\Windows\System\cUWQsUr.exe
  2⤵
  PID:6196
- C:\Windows\System\eMbtdUm.exe
  C:\Windows\System\eMbtdUm.exe
  2⤵
  PID:6700
- C:\Windows\System\obwKTgH.exe
  C:\Windows\System\obwKTgH.exe
  2⤵
  PID:6748
- C:\Windows\System\kAGnHdP.exe
  C:\Windows\System\kAGnHdP.exe
  2⤵
  PID:14344
- C:\Windows\System\mNwdPRB.exe
  C:\Windows\System\mNwdPRB.exe
  2⤵
  PID:14360
- C:\Windows\System\EMMRxhz.exe
  C:\Windows\System\EMMRxhz.exe
  2⤵
  PID:14376
- C:\Windows\System\wdmhmFO.exe
  C:\Windows\System\wdmhmFO.exe
  2⤵
  PID:14392
- C:\Windows\System\EuoVQmK.exe
  C:\Windows\System\EuoVQmK.exe
  2⤵
  PID:14408
- C:\Windows\System\lCOgXnJ.exe
  C:\Windows\System\lCOgXnJ.exe
  2⤵
  PID:14424
- C:\Windows\System\xYJyUIK.exe
  C:\Windows\System\xYJyUIK.exe
  2⤵
  PID:14440
- C:\Windows\System\GFoGWTF.exe
  C:\Windows\System\GFoGWTF.exe
  2⤵
  PID:14456
- C:\Windows\System\ttzetNy.exe
  C:\Windows\System\ttzetNy.exe
  2⤵
  PID:14472
- C:\Windows\System\TAXDSlr.exe
  C:\Windows\System\TAXDSlr.exe
  2⤵
  PID:14512
- C:\Windows\System\wqSrevx.exe
  C:\Windows\System\wqSrevx.exe
  2⤵
  PID:14556
- C:\Windows\System\wOpqVoY.exe
  C:\Windows\System\wOpqVoY.exe
  2⤵
  PID:14572
- C:\Windows\System\lGxbQRL.exe
  C:\Windows\System\lGxbQRL.exe
  2⤵
  PID:14588
- C:\Windows\System\unQulaK.exe
  C:\Windows\System\unQulaK.exe
  2⤵
  PID:14604
- C:\Windows\System\OnwSrZJ.exe
  C:\Windows\System\OnwSrZJ.exe
  2⤵
  PID:14620
- C:\Windows\System\HTzynZD.exe
  C:\Windows\System\HTzynZD.exe
  2⤵
  PID:14636
- C:\Windows\System\dvlQvFp.exe
  C:\Windows\System\dvlQvFp.exe
  2⤵
  PID:14652
- C:\Windows\System\ohsXtVo.exe
  C:\Windows\System\ohsXtVo.exe
  2⤵
  PID:14668
- C:\Windows\System\kECIBIw.exe
  C:\Windows\System\kECIBIw.exe
  2⤵
  PID:14696
- C:\Windows\System\kqABbqY.exe
  C:\Windows\System\kqABbqY.exe
  2⤵
  PID:14712
- C:\Windows\System\toQMdFc.exe
  C:\Windows\System\toQMdFc.exe
  2⤵
  PID:14732

Network

DNS

raw.githubusercontent.com

powershell.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN A

Response

raw.githubusercontent.com

IN A

185.199.110.133

raw.githubusercontent.com

IN A

185.199.111.133

raw.githubusercontent.com

IN A

185.199.109.133

raw.githubusercontent.com

IN A

185.199.108.133
GET

https://raw.githubusercontent.com/

powershell.exe

Remote address:

185.199.110.133:443

Request

GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
Host: raw.githubusercontent.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: keep-alive
Content-Length: 0
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Location: https://github.com/
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: D44C:24E9AA:3852D5:475CC8:668CA672
Accept-Ranges: bytes
Date: Tue, 09 Jul 2024 03:27:17 GMT
Via: 1.1 varnish
X-Served-By: cache-lon4252-LON
X-Cache: HIT
X-Cache-Hits: 0
X-Timer: S1720495637.472492,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: a49d0a8230ea42a6518c4926f91be0763bb1155f
Expires: Tue, 09 Jul 2024 03:32:17 GMT
Source-Age: 1951
DNS

github.com

powershell.exe

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.26.156.215
GET

https://github.com/

powershell.exe

Remote address:

20.26.156.215:443

Request

GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
Host: github.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: GitHub.com
Date: Tue, 09 Jul 2024 03:27:14 GMT
Content-Type: text/html; charset=utf-8
Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Language, Accept-Encoding, Accept, X-Requested-With
content-language: en-US
ETag: W/"99e5a5a4565af19c24a6e8dfa2321492"
Cache-Control: max-age=0, private, must-revalidate
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com/v1/engines/github-completion/completions *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com github.githubassets.com edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Set-Cookie: _gh_sess=ovQJf8owG6IftLwyqg6wd%2FULs4CCDBP8pMQnjxXunt%2FaGqDlY%2BPddb4lwiFXbMvN4IzJLUziJUs6nIxLL7pe7lobWpWY1hpUBguFsUPBW5yMag3XYNysw5GE0NrI9WM0fjpaGn14si8aTYcXibTcpppKHaFgRBS5ydlebzUvmsCbvUh1za3gxdIcMjIyY8%2BWHU6cMow0z9F0Y6EXjK8BBju8D6wQ1ydYg7ezMZnrgss%2FTk0UC6AXuTfXLE5zEQv3Z4vqaUoGVtWwhD%2Fzv8NY3Q%3D%3D--LLUjilodjk%2FZD%2FBz--vr%2Bsc5Ji2agrmbUCBPFoUg%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
Set-Cookie: _octo=GH1.1.1882081163.1720495638; Path=/; Domain=github.com; Expires=Wed, 09 Jul 2025 03:27:18 GMT; Secure; SameSite=Lax
Set-Cookie: logged_in=no; Path=/; Domain=github.com; Expires=Wed, 09 Jul 2025 03:27:18 GMT; HttpOnly; Secure; SameSite=Lax
Accept-Ranges: bytes
Transfer-Encoding: chunked
X-GitHub-Request-Id: C9FB:268798:1C29ED4:1FEAC09:668CAE16
DNS

133.110.199.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.110.199.185.in-addr.arpa

IN PTR

Response

133.110.199.185.in-addr.arpa

IN PTR

cdn-185-199-110-133githubcom
DNS

215.156.26.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

215.156.26.20.in-addr.arpa

IN PTR

Response

3.120.98.217:8080

2635c6e24c5e0499294ac08a27fbdb30N.exe

260 B
5
185.199.110.133:443

https://raw.githubusercontent.com/

tls, http

powershell.exe

835 B
4.9kB
8
9

HTTP Request

GET https://raw.githubusercontent.com/

HTTP Response

301
20.26.156.215:443

https://github.com/

tls, http

powershell.exe

5.3kB
263.0kB
105
192

HTTP Request

GET https://github.com/

HTTP Response

200
3.120.98.217:8080

2635c6e24c5e0499294ac08a27fbdb30N.exe

260 B
5
3.120.98.217:8080

2635c6e24c5e0499294ac08a27fbdb30N.exe

260 B
5
3.120.98.217:8080

2635c6e24c5e0499294ac08a27fbdb30N.exe

260 B
5
3.120.98.217:8080

2635c6e24c5e0499294ac08a27fbdb30N.exe

260 B
5
3.120.98.217:8080

2635c6e24c5e0499294ac08a27fbdb30N.exe

208 B
4

8.8.8.8:53

raw.githubusercontent.com

dns

powershell.exe

71 B
135 B
1
1

DNS Request

raw.githubusercontent.com

DNS Response

185.199.110.133

185.199.111.133

185.199.109.133

185.199.108.133
8.8.8.8:53

github.com

dns

powershell.exe

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.26.156.215
8.8.8.8:53

133.110.199.185.in-addr.arpa

dns

74 B
118 B
1
1

DNS Request

133.110.199.185.in-addr.arpa
8.8.8.8:53

215.156.26.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

215.156.26.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5md4wgqx.g1h.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\GdwAZzc.exe

Filesize
1.8MB

MD5
1d93dd7ea352edddeca3d6878f89745f

SHA1
47a72b0bcc6e9d855e785f0b90e1746d1d70ae7a

SHA256
5bd2b4f21928a3b233b092100830efa41459bcfd6a3a161bea59f18a7f263437

SHA512
8de88d6c915586197ada1eac749cafd54f01cb9ba89258249af78585284defb7397b2809c308767993761e935d753eaac02c3051bc96533fa6aba1dbb2747cbb

Download Submit
C:\Windows\System\IQvPeoY.exe

Filesize
1.8MB

MD5
4118332d5e826cc9dfd761a51e03a5d0

SHA1
a883f0ba90d1fc9a7003bca6bec9b5b4c1612c31

SHA256
6ea40de0c3d89f1a7ed015576284b856929b0653b9946bb79920a7af55b86c81

SHA512
a609e016bfe7010f334c832a8a9612964e6f24fba45e4e0835c68c97b00fe489cebcd085e34ac55d4227f02a14d6bc642873142a5e41d408775465f77b18be22

Download Submit
C:\Windows\System\ITRFyOf.exe

Filesize
1.8MB

MD5
41c8e0d40354c4cecebd2434041812f6

SHA1
6f8910198aae5a83a1a07ceecaf44e105ccd1227

SHA256
32be63e2c62a00968dda1611c46bb2f0cb0e13ac2b85d3f5464b23ac253f268a

SHA512
898ba0accb5478669219886f8e7cfbc7ea64c81ecdad6c3133fabe1dd86019e7524b82d6d72d14a3c76f21e3c0e36fca251a7e18e11a47d8f3c949b2fd8c50c1

Download Submit
C:\Windows\System\IsIqhYU.exe

Filesize
1.8MB

MD5
22208cd0da0f218c0a889e62e9befdc0

SHA1
57151721435d13a97e64967d694925f7d9a88e2b

SHA256
7acdb600a11f33c88ac7433ccc1d81bb55d8fcb890acf58cbc1a39918392d456

SHA512
f324cb668f95fcc44e46b9233e6f1d9e179cfe0567256125fdae70624216572229d88388e76bd207493eef17357e9dd9a71a93b517c0de18b63ce619fe7fbc65

Download Submit
C:\Windows\System\KKeVajD.exe

Filesize
1.8MB

MD5
667bcd15af7e6949eaf0261a6ca45661

SHA1
bb6279cc7ee3b777b437f780be195efdf62eb2b2

SHA256
2d139426d7567766980d1e83d1e0c02d9502953fa280d524b45dbf563d441f26

SHA512
5e79b08df97f19a351c2b8549a8b58b2f36c254853e6a75ef0669f295d7d9c3b2606f0f008a5d201ea36cea5871bc829d9f2068314e3e9ca99488d9fa9d9960a

Download Submit
C:\Windows\System\KXKcCAQ.exe

Filesize
1.8MB

MD5
3934cc586e647662536f74bc02d61afa

SHA1
b437f37f47eaec8dc7ec5fb9b36d6b9e979897d4

SHA256
2c4c517851c475e96cc5793e22cf472077cdd0a508dad9008e331c9c0963833c

SHA512
7c754ecaa20965934e32172593a6440a2082eeb12720315768bccc3c559686bb57dd8fbab8f3fe78ebfb9b3627ebc753fd2f060ce394d96cbbe2cc4c08605cd0

Download Submit
C:\Windows\System\KnADDMh.exe

Filesize
1.8MB

MD5
aae17859636178a7a15a9bde65ef77a6

SHA1
7b0d1d84e66adf63a27533cf7543c09a27a59e19

SHA256
916bb2c1de878f94dce303ee9d63bfe62c11d3ff5c8ece2f1ee2cb5822605fce

SHA512
be3fb32e241ecf9dd9ebf06e719e8a25740ab06c94ad3003fd2169f33bbb154da157b36b50aab0a5bcc5c3ffed1f68eeed2f9a861bd5148ca0517c60d8aff7eb

Download Submit
C:\Windows\System\NRsQcqO.exe

Filesize
1.7MB

MD5
2249e58691553b06944351dfdb0d9b46

SHA1
ea1ae7f8b4f3456bb40612469703823da55d3262

SHA256
9446096c5bc994db461706fe2b00c8a63cfc3d8b6c3c4bc82b215b0439a58a72

SHA512
3c20859e1a96497ea79339b58e51cf58377b33f7b75ffd9b97c94213d2c21db56f5cac51e7943b3084f85b21b4f4d688f06e6ab72e93ef42ba22f4ce0c5c7640

Download Submit
C:\Windows\System\PAmiicC.exe

Filesize
1.8MB

MD5
a1340844cbbae680bebce32cf995b37a

SHA1
77dc79a4505a7e6b9d11db0bfadaacf580ed4095

SHA256
7838852433a81e10aeb6ac5bba83dc4cafb7ad948dde75de81b0e698a4b4a5cf

SHA512
aeb37cb45562fb77a57e88ccb502e98505cb2b4f2cf0e7dadab585ad63a38b54f50c7c787538e84c9b05a79675dfac34e018f172a72267bc2aaa3d2163eb5689

Download Submit
C:\Windows\System\RbCFEtA.exe

Filesize
1.8MB

MD5
3e548b98ab85dd14cfab8fae52e04105

SHA1
caf5da26a8a4b9e45cf5f1cd4796cafc66ffddcb

SHA256
a11a75934e2304548196eff9fb867fbb6aebcffbc28e64e8ce9c6a4f2efb9a88

SHA512
ca8ad47c00845d1ac6f7465054f9217afebc08ca7cebbe868070bf02098e8409f30e41d734756c3f2f0f06459f3e633e9fdb1bb2ba6ac9840d826eb6400a5e5b

Download Submit
C:\Windows\System\RomHnzE.exe

Filesize
1.8MB

MD5
aebf64bbe5404cc619bbcb8502941ddc

SHA1
7a9a019d61839a845e4a9d65d6b2d0283cf5adf2

SHA256
abda6fb113615c857bc2b1d7d03dd9d7010ff68dcefe32a2642cf357a35771f0

SHA512
95d70fb73ae38b75ef200b307c77aa86713b341c6cea0791c3e857a332c3796108f774252451e549c118e747d2e72f46a7cbadff3fa2755a9a314e3bada46577

Download Submit
C:\Windows\System\TGvmOKt.exe

Filesize
1.8MB

MD5
7c410def959a707842c9a94775fa0546

SHA1
f5f096ac550086332c906233b88b17c11575a831

SHA256
f3511d28cfbc442a9d3b43b2b057a6b1c52939ae25bf8966eb7d67cc8f4913ef

SHA512
9a06a54a8f5b4fb0820cfaa4ef167d48f39ed9ac362c5dfbfe1ee986225d7e781349ebd11efdd6e3bd0939fb0d57865071f8f07bbbaac7b5ee4096397b728d7e

Download Submit
C:\Windows\System\TkfEIQX.exe

Filesize
1.8MB

MD5
aa5388f02b646d6f4e44a294bbac85e5

SHA1
5bfcaedbf2645bd52ecf4ca52ad5b02150530123

SHA256
b6b796ce0e6bb21140939325de397329401cea73fc1ce320f17013d699d98124

SHA512
4ffb423a9e677e4c1a884dd87f3c21bf1610558a1775506ede0307cd8c521d3695eaf716991bbf1339571d35efddb214707f4c4db32b909a8840d94b785db5f6

Download Submit
C:\Windows\System\TzpVHwj.exe

Filesize
1.8MB

MD5
e70becb571aa8f8f09ac90bda7fa6eab

SHA1
696cae19ec647add5e2ad0b201d90d5c2473a967

SHA256
99c5df1f66e239e1d584093b5d40cbf417a4028137ca747130e07197bcb30ea3

SHA512
531527e8cdaefe588a1bea60490167039b6fa4382a207437271061633b5b946c4b94c711014534dff3439a5eb486f47122f82cab605f030a426f69923507edcb

Download Submit
C:\Windows\System\UEUiMpy.exe

Filesize
1.8MB

MD5
552e104039260f965e036353d64228c2

SHA1
a801594bb41657818b3e9b00367de66a449de4e5

SHA256
a6d3d459d9e3e1d6195f64aabbcdb27159e34414776708527ca5d16f97a06e47

SHA512
042c4ef5eb32da3c19a1322928bafa71cc8d1af16c3cf904360347cb9a651ada95a1e7005c4b7580de1fe04980fca2675db5949d357c73bea983cb2a85931841

Download Submit
C:\Windows\System\UjRTKSD.exe

Filesize
1.8MB

MD5
b930cfce41834925fa2ca611f9206d34

SHA1
dff58f1908651d8581d83eef0e000222e7139352

SHA256
6fd6353659744be208d118bd815273f02096bf7b03219c1d01901f4c3de5d86d

SHA512
1b8def9794553a3a8d6c6a743854b301417d112fb784154f99b39a77e65c13733996270107ecab8543b3d698281d416cfee8e6d990a3e1bcedec4f06a37ec358

Download Submit
C:\Windows\System\WRXOreT.exe

Filesize
8B

MD5
fbef424b1922acb531e69f596a8b8921

SHA1
584ada3a02d95facb3db59252be930cc2019a07e

SHA256
9ba99dfe86f586665444906d4d6c065235a1faa079a57e34597feec2870450c4

SHA512
b7c856eeb52f1f5b978a86cc276964a598136109586a3999d60402c0885755b7f0a6e5ca90b5856e8f2e8d74fc885b0d7e257ea62c297369572d765724b94880

Download Submit
C:\Windows\System\YUanYvF.exe

Filesize
1.8MB

MD5
8de4448e32ccc69c98e551b69033d7e4

SHA1
7e1d518c6a0e2765aca1dc8ac50b5d0b7703a9d1

SHA256
ede69935afd70e934ec5b383b1068ebdbc8e5ba334b217b2969782d1143fac31

SHA512
7199a6583a0a6863188f4b870053c5dc6604de97319cdf427508545268ef42c5e27780e9f806f75b9e93ffd8c499bb0d7a7f13edde7faaba951cd7d68171be54

Download Submit
C:\Windows\System\ZxQKQLO.exe

Filesize
1.8MB

MD5
a10e6237840245d472d35c40489b6e0c

SHA1
aabcf49d4407930286fd7b032a2f4b168ee5d923

SHA256
b2a1c548cde5814bcd2cc0b446c12e4ef98141d3037894a441f351a0c1cec3e9

SHA512
2299e439f0748b7401372a4cfb332fb9f986fb29cac91c97c1ce27713faa4df5c76918fda155866ada31c06175240417bf0abfcaeba7fdde0c15ae048800b0d7

Download Submit
C:\Windows\System\amqdOhN.exe

Filesize
1.8MB

MD5
f85cb0da9487ccd820e0f38e9b410a4b

SHA1
9f6e80739fac36db41105bf23412e1dd3e176ecd

SHA256
ae699430518e85e98a572ec266dddc4cbd098c17b9b57131bb84411aff84261f

SHA512
d041cc32e91fa3a9d1b48a2238d283577a4d3a88e7e94b26bb0167464eabdf7992fb9f0a64f2cf472861590039abd9a20a427d3e9d9ea028722c242a7381e83c

Download Submit
C:\Windows\System\bDcXpOQ.exe

Filesize
1.8MB

MD5
eaf3c681718fcad227e1a4feed41ad16

SHA1
0a56a00fcf61762aee2ca643828e06a463e835cd

SHA256
2caed9d34323ee451def2eb3b0a970b67bf8670621c340f4b56d0b4a0dc66d62

SHA512
8e3ac8f60a0b1230afc95623335551971c5a3455299e631086113070b38a60533c41dde52e5b4f576b5447e35df71f4128f1fe014f25872c8d85dcb8839befc5

Download Submit
C:\Windows\System\cPjrvNZ.exe

Filesize
1.8MB

MD5
9d0f9197a00f6ea244b94e4c8570b1a8

SHA1
c39fb883dce28aa2fa247e90629ef0df638e5ec6

SHA256
f893b6e6e3eb20d50807fa2a39ba1f0d0193be53640f8802a8f100231f97b7ab

SHA512
25dca9768cbf12ebf58253eba981a25da7f7503f4cb7524ba16d035c6b86717a70fc1c2b925f9e0858c50f7c8163dc7b64c3a9bd02ba9280c0ac48fdea2182f2

Download Submit
C:\Windows\System\dRYAvCG.exe

Filesize
1.8MB

MD5
550ce0d1a20bb50fad18926c88fbf178

SHA1
8bada32c0f9044164a17dc9f7185ff63c5a8cddc

SHA256
73093660a91249b5de9fef109f521cb272d990391e1c79e9cf60da5a53acf0c3

SHA512
09f68fccd671ca4800ab5a8ca1c8e039b73bcb66353b808bf917d983756dfd256a91fd9a270f7a4424acf09025535b9fbab6e7833fc54411df830b8d318d10d8

Download Submit
C:\Windows\System\dcpDelM.exe

Filesize
1.8MB

MD5
7a503dddb488669c26bd043c76170b58

SHA1
f6318edd6aad158acf1d64097e3ef9c068d507b6

SHA256
2bc229645148e9c3aea1b0f59a332228e8a45102883407a4eee9d9deff3054e1

SHA512
cf6bfefc20444fcc04a9d813a53604178794a1be6a814706e0e0b6f8c311c594992d8179391080fea7b7c6551bab9bfe7636e07e7b588563a3b41c6708495102

Download Submit
C:\Windows\System\dfjYLzr.exe

Filesize
1.8MB

MD5
eebc4d7d429e7aa4bea26627ddc771a1

SHA1
dc0b55e0063aad833abcd80ef403b5f4c3139b47

SHA256
f6e8d01d186d7d97af1c59ee829fe5fc1af03b6ffe3e2db5be1b26074863b3d8

SHA512
ad1e8640292d90c88e0171edd4a6b39e6ba5003971d6fdcb69983d7481cf3f04c7e05d664d7b71604b398396ed13740e88c844e3874a92e8b9e5a85c7f0a99e7

Download Submit
C:\Windows\System\dxRVnlx.exe

Filesize
1.8MB

MD5
aca1ceb1d0873e6c062d2d646091cc19

SHA1
a55f5920238c92c8520a9d42ac1333482a0ca3da

SHA256
119b9382a5be57ca5e6248d84ca3c6c71968c9cfb6751e1c730f0a2b7297299b

SHA512
a9978fc7e3d71b5940d450092492f36d32c1da4988b0ce34af0d0bdb7c9fd804631a788cf2a6d4814220938302e6ab71bbd5aaea456cb7293807f7a71b4e0487

Download Submit
C:\Windows\System\fCXirsx.exe

Filesize
1.8MB

MD5
9737deb1c00d8cdfc515b39bb359c7e5

SHA1
c67899eb8c60d5e372e09d48e3f0a7bc9508e41d

SHA256
738b15a3423cdeeefe2a8ecd41f614a4ce2e43cfbd800de26acdaf8edb4f924a

SHA512
7212382bd4cf49a2a3fa0f14f761ee30836adf1e753e9ff0cdba33f0cd9bc02e8735387bd771bbf149fd4b61a052fd151c2eaaeb0bf8c64cc363a8b945192f6e

Download Submit
C:\Windows\System\gIdNqiX.exe

Filesize
1.7MB

MD5
d0c6472eabf0b5d71a39434a860a392f

SHA1
a4410d568e69faa9b7bf8bee1fc28e2e46a11c4e

SHA256
7203d9e2b8eb6014cab2d29bc3ff333070268eb9523170286b8cc9d4865d03e8

SHA512
c402155bf87d1460d002af6a73f32f7e10512bd52bf31149ec4054c87b08a5a8934945f8c0e90deed2766590d430a833d4c47b66367a81d57e850fbd80f5ada7

Download Submit
C:\Windows\System\hnNevrN.exe

Filesize
1.8MB

MD5
604100a582c2dad952390041ecb76dc5

SHA1
e538f8dfc578b4ec51bcf19c24e1ed1c6a908222

SHA256
515a85af5f40ff47c65635d495aabb54b58fb9039cd4d14aaaa008c3b36f970b

SHA512
a6127102301050d5c98b4d49b7c420f1327406653704a18fd56e62411469a0c5fefa886c6f334ec92a15698ca1379b329e563d4b3776f18776b48fa4a42983c5

Download Submit
C:\Windows\System\iVULsVr.exe

Filesize
1.8MB

MD5
00b4500139fb339659a56596a082b3d7

SHA1
099fcd2367f39624034deb23d94f1655a34697de

SHA256
49e206e5de2c9a795d03c37585f39531e2129154a62cafd5aabf554915065d86

SHA512
614da3a8a3438fb28946d468a880ce39d085ee2a5931ed23688b9c92317ea0ad0a6d8126f271784b856dde9206e3b0a59bff86a12134e86e967574cd56009db3

Download Submit
C:\Windows\System\nHjjDUE.exe

Filesize
1.8MB

MD5
c346a33037f70a0c20ea27ab76dc40db

SHA1
732dbd7e42d1dffe16d010535c9e1f0c90770f7d

SHA256
015be4cb425bbce0853c11217b3e1377ac77b541143ace1de6fdbef0b48309eb

SHA512
45e660fe37466ccae2d1dc1e3191de38ddcbb1016df7b61364ea21f3e40627a10d1246f3ad7df536484de1bfb7c85357c9115b47b04d9c6a551efd4ee3c53714

Download Submit
C:\Windows\System\nXATenV.exe

Filesize
1.7MB

MD5
9dca7e6e562388563ccb35a387acc694

SHA1
e1b5793070541ff28c990916437fa7065ea496c1

SHA256
9bc4df06eddcb6335d36d45112347881be56904d000a3f987d07576e1c5dbb09

SHA512
20dcac0e5cac2bf703557798f76d335f273bfd233da8eb760c87fb2ac5337fa3291959449503261f09fca840ad8e303810a67d7ddf201a804ce3c35eb228534c

Download Submit
C:\Windows\System\oOHRjcM.exe

Filesize
1.8MB

MD5
6b08c13c6e22c5944a1227218319fc69

SHA1
01ecef9ccec70f41a81187f600867bb4a6fcafc1

SHA256
cdae2b370c7d228f30b795e199f8bbc07f9e662401254328e3b5acf6b89d1146

SHA512
0a2e0b894047f13caa83a213280b6204f644ce569463bc68a830f43a482851b503498022adc62e1c3c9f2430da5378580302d52d8eba60cf16e0cf5b9bcb78c0

Download Submit
C:\Windows\System\oVrpHiJ.exe

Filesize
1.8MB

MD5
275cc517c874090ffd19f7fb28117a0b

SHA1
3092d85bf9c552008c71aab915f8f3d7e3e2d4bd

SHA256
0f371098b7461a99fb0e3ad5a5bcd00d5e308188e87ad0132edf2e2f8d652706

SHA512
ba28b15ff0665236abd260b28265ca3d385dec5370ab82bda3e88895d768ff97f3430e30a7710d9134d2da681916eab64b474e555add7a9d34a8c23f9e9cdb73

Download Submit
C:\Windows\System\qnGjtui.exe

Filesize
1.8MB

MD5
28440ee1dafeb7500636b6cb5f5fed31

SHA1
a187f2d286fe9e87362d64468df28a04fc2bec62

SHA256
11dcd15c521fabb1fd58abc345cfde373eb1b40f3667d834e9b66fe972de133e

SHA512
4bce7a4a38a70cdfe4cc2a140951f57481c023d43122a9f082616e2b943b9d2043c98e6b3bf6dcbafba5442aae93984c81039cf0d44572d50fb051818b7b295d

Download Submit
C:\Windows\System\sjSiEVu.exe

Filesize
1.8MB

MD5
a8eade0bc1e60594bd46d9aeee386192

SHA1
780c84ad843ec7a4f49a026e1986c60a4922cfde

SHA256
3d9f6663c061caa96c17bbbf1f5a0384e3bce7a83382b5c3f8b9e41f698fb26e

SHA512
f98f52d83c30acd4cf513be840914c90b3c36ddf3073103bec71fa4cd47b05dd9efadcd05ced81e7f81f33b2d35d2ccefc68797dde642db8340a4821b3458194

Download Submit
C:\Windows\System\uUWZzzd.exe

Filesize
1.8MB

MD5
5a21c7fc28f3fa555bc331b2f2533496

SHA1
e54caa8578d5679b29d9c7193071572032d7c1af

SHA256
a3d6db8b01bfc73513cee7d40499d60b0d044ef2045d248426e96410c1ea3936

SHA512
061b61b7eac114bd493ba222a8ad4d482400e433e0bd689996ff59afa8395c096b0034706e3b6450fca272ce0cbc0f901871fcf7e63dd31e25dc54d7499ace7d

Download Submit
C:\Windows\System\vloWeJp.exe

Filesize
1.8MB

MD5
650617fa412e6a2fcd05b2f6b5874255

SHA1
1e941faf094c9a4779618050d3df7f28a41e47b2

SHA256
e559cfaf93a6c4d2522f06c4812c260537ae2d911463b1c885ac9d0730bdb16d

SHA512
7cf6dfdd557854bd8ec00588abf96e0fba375a289355a896896904d68354f33e9e695dd019788a32da1257de66ee30275f3d1b0fc9fae6735aaf989ca014a8a1

Download Submit
C:\Windows\System\vznPqYt.exe

Filesize
1.8MB

MD5
cfec286f5b568dc0469a4c9e3a9ee01d

SHA1
42ac11b59276ae7bf3a359539155ca6d81168e0a

SHA256
e249b64874f2e1dc658ee91ba3421ba27cb337c5c24628dab154d8440385164e

SHA512
40498318fbdb9f5944f7abf788aecbf752643d2e43f7aa3e94168451971867c6e0ae26b3853d40987dde75643e90e0238fcc04403cc1aa56e36f74c8a55c7079

Download Submit
C:\Windows\System\zJPrblT.exe

Filesize
1.7MB

MD5
aa5db6d3b29c36d41fd598b29fcc95cc

SHA1
7dd4f108017c5f18160eb6ccf82645ec7cd9b743

SHA256
a51d96288cb8313777430413ddac68c0ff65453cd01cf782c7f2400bd0b8cb1b

SHA512
8bd1ba7b1ede84051da2bf1cbbebcd121234c93f943ef139ddafdb5a04bf33a87ed44b6dd02f18359935cb34ee6e371db7b751e9829c6fd47526c7572fb8221d

Download Submit
C:\Windows\System\zLpMyQZ.exe

Filesize
1.8MB

MD5
b76558bb0e59b9bad7796d096fb25fd8

SHA1
2e256a520c1819272618e7f2b6ab17facec0a96a

SHA256
6eaf76e6d9e17e81ccbeb5aca49159ae001de162fd4586599ec21159c1e19db0

SHA512
fac135267545056e33a5febb8aff6980ec2785665f647da3bfff7f8c54ae64b01dec3048720f829e505c9cca6c4be0c9a75e4e808e3bbb41eaf123684c28cf44

Download Submit
C:\Windows\System\zSAmooX.exe

Filesize
1.8MB

MD5
27cc6271f09053883763eb1a554698d6

SHA1
98d3d96965b4568a5a64f605a8d6c383ba1fa2a5

SHA256
bc9d957e3d9e319968154007acde65a84b7939266a01b06a34cdbe0754d7230d

SHA512
da85677dc263bcaa10bdfccb5df228b52714f8619be8753682d4cebd50ad4928772afa4d6db0c1ceea9347701188ceb6ad10dd11a169ba6c3a04c4bb130ffc8c

Download Submit
memory/216-3853-0x00007FF6D9D20000-0x00007FF6DA112000-memory.dmp

Filesize
3.9MB

Download
memory/216-209-0x00007FF6D9D20000-0x00007FF6DA112000-memory.dmp

Filesize
3.9MB

Download
memory/244-3891-0x00007FF7399E0000-0x00007FF739DD2000-memory.dmp

Filesize
3.9MB

Download
memory/244-272-0x00007FF7399E0000-0x00007FF739DD2000-memory.dmp

Filesize
3.9MB

Download
memory/956-1-0x000002692AEB0000-0x000002692AEC0000-memory.dmp

Filesize
64KB

Download
memory/956-0-0x00007FF720760000-0x00007FF720B52000-memory.dmp

Filesize
3.9MB

Download
memory/956-4611-0x00007FF720760000-0x00007FF720B52000-memory.dmp

Filesize
3.9MB

Download
memory/1036-11-0x00007FF60EC00000-0x00007FF60EFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1164-3845-0x00007FF63CAA0000-0x00007FF63CE92000-memory.dmp

Filesize
3.9MB

Download
memory/1164-314-0x00007FF63CAA0000-0x00007FF63CE92000-memory.dmp

Filesize
3.9MB

Download
memory/1364-154-0x00007FF6851B0000-0x00007FF6855A2000-memory.dmp

Filesize
3.9MB

Download
memory/1364-3849-0x00007FF6851B0000-0x00007FF6855A2000-memory.dmp

Filesize
3.9MB

Download
memory/1508-429-0x00007FF771D20000-0x00007FF772112000-memory.dmp

Filesize
3.9MB

Download
memory/1508-3861-0x00007FF771D20000-0x00007FF772112000-memory.dmp

Filesize
3.9MB

Download
memory/1772-83-0x00007FF7D78B0000-0x00007FF7D7CA2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-3817-0x00007FF7D78B0000-0x00007FF7D7CA2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-430-0x00007FF664280000-0x00007FF664672000-memory.dmp

Filesize
3.9MB

Download
memory/1904-3884-0x00007FF664280000-0x00007FF664672000-memory.dmp

Filesize
3.9MB

Download
memory/1972-3863-0x00007FF74DBF0000-0x00007FF74DFE2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-373-0x00007FF74DBF0000-0x00007FF74DFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-30-0x0000021858F20000-0x0000021858F30000-memory.dmp

Filesize
64KB

Download
memory/2136-697-0x0000021873EE0000-0x0000021874686000-memory.dmp

Filesize
7.6MB

Download
memory/2136-312-0x00000218731D0000-0x00000218731F2000-memory.dmp

Filesize
136KB

Download
memory/2136-410-0x00007FFFD2133000-0x00007FFFD2135000-memory.dmp

Filesize
8KB

Download
memory/2276-86-0x00007FF640F40000-0x00007FF641332000-memory.dmp

Filesize
3.9MB

Download
memory/2276-3804-0x00007FF640F40000-0x00007FF641332000-memory.dmp

Filesize
3.9MB

Download
memory/2508-34-0x00007FF6ADF40000-0x00007FF6AE332000-memory.dmp

Filesize
3.9MB

Download
memory/2508-3805-0x00007FF6ADF40000-0x00007FF6AE332000-memory.dmp

Filesize
3.9MB

Download
memory/2836-3811-0x00007FF7E4E80000-0x00007FF7E5272000-memory.dmp

Filesize
3.9MB

Download
memory/2836-180-0x00007FF7E4E80000-0x00007FF7E5272000-memory.dmp

Filesize
3.9MB

Download
memory/2960-208-0x00007FF7D0050000-0x00007FF7D0442000-memory.dmp

Filesize
3.9MB

Download
memory/2960-3829-0x00007FF7D0050000-0x00007FF7D0442000-memory.dmp

Filesize
3.9MB

Download
memory/3236-406-0x00007FF6095D0000-0x00007FF6099C2000-memory.dmp

Filesize
3.9MB

Download
memory/3236-4011-0x00007FF6095D0000-0x00007FF6099C2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-3855-0x00007FF717C00000-0x00007FF717FF2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-315-0x00007FF717C00000-0x00007FF717FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4180-20-0x00007FF6C55B0000-0x00007FF6C59A2000-memory.dmp

Filesize
3.9MB

Download
memory/4280-3841-0x00007FF6C4E70000-0x00007FF6C5262000-memory.dmp

Filesize
3.9MB

Download
memory/4280-114-0x00007FF6C4E70000-0x00007FF6C5262000-memory.dmp

Filesize
3.9MB

Download
memory/4508-409-0x00007FF705060000-0x00007FF705452000-memory.dmp

Filesize
3.9MB

Download
memory/4648-3882-0x00007FF669780000-0x00007FF669B72000-memory.dmp

Filesize
3.9MB

Download
memory/4648-370-0x00007FF669780000-0x00007FF669B72000-memory.dmp

Filesize
3.9MB

Download
memory/4780-3867-0x00007FF6F47C0000-0x00007FF6F4BB2000-memory.dmp

Filesize
3.9MB

Download
memory/4780-351-0x00007FF6F47C0000-0x00007FF6F4BB2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-232-0x00007FF6A4570000-0x00007FF6A4962000-memory.dmp

Filesize
3.9MB

Download
memory/4816-3835-0x00007FF6A4570000-0x00007FF6A4962000-memory.dmp

Filesize
3.9MB

Download
memory/4832-411-0x00007FF729840000-0x00007FF729C32000-memory.dmp

Filesize
3.9MB

Download
memory/4832-3815-0x00007FF729840000-0x00007FF729C32000-memory.dmp

Filesize
3.9MB

Download
memory/4976-418-0x00007FF7122B0000-0x00007FF7126A2000-memory.dmp

Filesize
3.9MB

Download
memory/4976-3823-0x00007FF7122B0000-0x00007FF7126A2000-memory.dmp

Filesize
3.9MB

Download
memory/5032-3797-0x00007FF79C420000-0x00007FF79C812000-memory.dmp

Filesize
3.9MB

Download
memory/5032-29-0x00007FF79C420000-0x00007FF79C812000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.