xmrig | 915f5f563b3ff5770f9a06e4cc6fd42a6b61fb51cc6e1d9fee95f01313cfc372

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53d4d8f56d3d6edcac1893628a00d920N.exe
Size

1.6MB
MD5

53d4d8f56d3d6edcac1893628a00d920
SHA1

36fdfe1006fa678766de8860d7eecacf190c0f98
SHA256

915f5f563b3ff5770f9a06e4cc6fd42a6b61fb51cc6e1d9fee95f01313cfc372
SHA512

c2e51cfc36cdc2fef96af1478c171468a57e02a3344d5350a3920f913e6958713391025eed9d9ba1f7d0c9c64312fb7cb0253be7e8b52d16aa899a8ec811e8dd
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCvH3z8RMC:Lz071uv4BPMkFfdgIZohteLPD8x

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1252-218-0x00007FF6174B0000-0x00007FF6178A2000-memory.dmp	xmrig
behavioral2/memory/184-266-0x00007FF64A120000-0x00007FF64A512000-memory.dmp	xmrig
behavioral2/memory/2852-274-0x00007FF6CD140000-0x00007FF6CD532000-memory.dmp	xmrig
behavioral2/memory/2080-346-0x00007FF6641D0000-0x00007FF6645C2000-memory.dmp	xmrig
behavioral2/memory/1640-388-0x00007FF6AAAF0000-0x00007FF6AAEE2000-memory.dmp	xmrig
behavioral2/memory/1836-394-0x00007FF699510000-0x00007FF699902000-memory.dmp	xmrig
behavioral2/memory/3244-398-0x00007FF6FFBA0000-0x00007FF6FFF92000-memory.dmp	xmrig
behavioral2/memory/2912-480-0x00007FF639850000-0x00007FF639C42000-memory.dmp	xmrig
behavioral2/memory/1072-521-0x00007FF7A0090000-0x00007FF7A0482000-memory.dmp	xmrig
behavioral2/memory/1592-536-0x00007FF742260000-0x00007FF742652000-memory.dmp	xmrig
behavioral2/memory/2248-535-0x00007FF6C9EA0000-0x00007FF6CA292000-memory.dmp	xmrig
behavioral2/memory/4744-534-0x00007FF6765B0000-0x00007FF6769A2000-memory.dmp	xmrig
behavioral2/memory/4412-533-0x00007FF7DC7F0000-0x00007FF7DCBE2000-memory.dmp	xmrig
behavioral2/memory/1812-532-0x00007FF786170000-0x00007FF786562000-memory.dmp	xmrig
behavioral2/memory/2860-531-0x00007FF6811D0000-0x00007FF6815C2000-memory.dmp	xmrig
behavioral2/memory/2812-530-0x00007FF76BA70000-0x00007FF76BE62000-memory.dmp	xmrig
behavioral2/memory/244-529-0x00007FF74AF00000-0x00007FF74B2F2000-memory.dmp	xmrig
behavioral2/memory/1196-370-0x00007FF6351D0000-0x00007FF6355C2000-memory.dmp	xmrig
behavioral2/memory/3588-319-0x00007FF765530000-0x00007FF765922000-memory.dmp	xmrig
behavioral2/memory/4488-260-0x00007FF749F10000-0x00007FF74A302000-memory.dmp	xmrig
behavioral2/memory/2164-174-0x00007FF75CBE0000-0x00007FF75CFD2000-memory.dmp	xmrig
behavioral2/memory/4292-137-0x00007FF7C4250000-0x00007FF7C4642000-memory.dmp	xmrig
behavioral2/memory/2236-105-0x00007FF7CB880000-0x00007FF7CBC72000-memory.dmp	xmrig
behavioral2/memory/2632-91-0x00007FF6D5C00000-0x00007FF6D5FF2000-memory.dmp	xmrig
behavioral2/memory/2860-3635-0x00007FF6811D0000-0x00007FF6815C2000-memory.dmp	xmrig
behavioral2/memory/2632-3637-0x00007FF6D5C00000-0x00007FF6D5FF2000-memory.dmp	xmrig
behavioral2/memory/1812-3641-0x00007FF786170000-0x00007FF786562000-memory.dmp	xmrig
behavioral2/memory/4488-3640-0x00007FF749F10000-0x00007FF74A302000-memory.dmp	xmrig
behavioral2/memory/4744-3656-0x00007FF6765B0000-0x00007FF6769A2000-memory.dmp	xmrig
behavioral2/memory/184-3667-0x00007FF64A120000-0x00007FF64A512000-memory.dmp	xmrig
behavioral2/memory/2080-3671-0x00007FF6641D0000-0x00007FF6645C2000-memory.dmp	xmrig
behavioral2/memory/2812-3680-0x00007FF76BA70000-0x00007FF76BE62000-memory.dmp	xmrig
behavioral2/memory/3244-3677-0x00007FF6FFBA0000-0x00007FF6FFF92000-memory.dmp	xmrig
behavioral2/memory/2248-3675-0x00007FF6C9EA0000-0x00007FF6CA292000-memory.dmp	xmrig
behavioral2/memory/1640-3673-0x00007FF6AAAF0000-0x00007FF6AAEE2000-memory.dmp	xmrig
behavioral2/memory/1072-3669-0x00007FF7A0090000-0x00007FF7A0482000-memory.dmp	xmrig
behavioral2/memory/2236-3666-0x00007FF7CB880000-0x00007FF7CBC72000-memory.dmp	xmrig
behavioral2/memory/4292-3664-0x00007FF7C4250000-0x00007FF7C4642000-memory.dmp	xmrig
behavioral2/memory/2164-3659-0x00007FF75CBE0000-0x00007FF75CFD2000-memory.dmp	xmrig
behavioral2/memory/1836-3654-0x00007FF699510000-0x00007FF699902000-memory.dmp	xmrig
behavioral2/memory/4412-3662-0x00007FF7DC7F0000-0x00007FF7DCBE2000-memory.dmp	xmrig
behavioral2/memory/2852-3649-0x00007FF6CD140000-0x00007FF6CD532000-memory.dmp	xmrig
behavioral2/memory/2912-3648-0x00007FF639850000-0x00007FF639C42000-memory.dmp	xmrig
behavioral2/memory/1592-3646-0x00007FF742260000-0x00007FF742652000-memory.dmp	xmrig
behavioral2/memory/1196-3657-0x00007FF6351D0000-0x00007FF6355C2000-memory.dmp	xmrig
behavioral2/memory/1252-3652-0x00007FF6174B0000-0x00007FF6178A2000-memory.dmp	xmrig
behavioral2/memory/3588-3644-0x00007FF765530000-0x00007FF765922000-memory.dmp	xmrig
behavioral2/memory/244-3719-0x00007FF74AF00000-0x00007FF74B2F2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1284	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2860	XoYcPWz.exe
1812	NmiSTcg.exe
2632	FfqpTNR.exe
2236	xklOHzb.exe
4292	QnHZqIx.exe
2164	WJUXFCi.exe
4412	GwdYdip.exe
1252	XhGybUc.exe
4488	iEcBMjy.exe
184	TdxuUBu.exe
2852	UFffMuu.exe
3588	IQKEwuB.exe
2080	YPOXvVg.exe
1196	VjgvDpH.exe
1640	EWdOsyu.exe
4744	GJDNQmI.exe
1836	oAWKcCu.exe
3244	cSnSGsu.exe
2912	KUnsJYI.exe
2248	kgTbaLl.exe
1592	eSUVhoD.exe
1072	XXLhomJ.exe
244	hEyhJVE.exe
2812	MqmYlFD.exe
5028	cEOMMfZ.exe
3272	gcBYPEY.exe
3816	kIPsvEb.exe
3968	DSzGyHL.exe
2744	zYtMCdD.exe
3384	UXrpSRq.exe
1064	PbzmDlr.exe
3444	eNThWLt.exe
1076	wgvvVBG.exe
4424	sYywHeh.exe
3348	TnrSClK.exe
2016	SFeohqP.exe
3232	YEMDLsT.exe
3880	zkfeOCB.exe
2020	ZkKpdeY.exe
436	uhyKvZE.exe
4992	nvoRdlt.exe
1664	QgbEliW.exe
3868	uXearod.exe
1408	RgAQqhX.exe
2872	httopeC.exe
2516	FMbJcnf.exe
3284	NvSrgeN.exe
3524	JUMZWaJ.exe
3780	KHQDsFx.exe
2576	AaVKyOU.exe
2160	FYqIBHE.exe
876	ckNtlgH.exe
2904	UxuTdvH.exe
4296	XMDHzmM.exe
3580	hYxVgYX.exe
2924	SxlvvIa.exe
404	CNyJnJe.exe
4472	vLpjmEQ.exe
4916	UmdEYpj.exe
4008	PXUzFjb.exe
4752	GQaYasJ.exe
4644	EvsFoqq.exe
4020	ekfBgjT.exe
3036	cpbHwUI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1016-0-0x00007FF63F7B0000-0x00007FF63FBA2000-memory.dmp	upx
behavioral2/files/0x00070000000234d5-8.dat	upx
behavioral2/files/0x00070000000234de-115.dat	upx
behavioral2/files/0x00070000000234f1-153.dat	upx
behavioral2/files/0x00070000000234ea-184.dat	upx
behavioral2/memory/1252-218-0x00007FF6174B0000-0x00007FF6178A2000-memory.dmp	upx
behavioral2/memory/184-266-0x00007FF64A120000-0x00007FF64A512000-memory.dmp	upx
behavioral2/memory/2852-274-0x00007FF6CD140000-0x00007FF6CD532000-memory.dmp	upx
behavioral2/memory/2080-346-0x00007FF6641D0000-0x00007FF6645C2000-memory.dmp	upx
behavioral2/memory/1640-388-0x00007FF6AAAF0000-0x00007FF6AAEE2000-memory.dmp	upx
behavioral2/memory/1836-394-0x00007FF699510000-0x00007FF699902000-memory.dmp	upx
behavioral2/memory/3244-398-0x00007FF6FFBA0000-0x00007FF6FFF92000-memory.dmp	upx
behavioral2/memory/2912-480-0x00007FF639850000-0x00007FF639C42000-memory.dmp	upx
behavioral2/memory/1072-521-0x00007FF7A0090000-0x00007FF7A0482000-memory.dmp	upx
behavioral2/memory/1592-536-0x00007FF742260000-0x00007FF742652000-memory.dmp	upx
behavioral2/memory/2248-535-0x00007FF6C9EA0000-0x00007FF6CA292000-memory.dmp	upx
behavioral2/memory/4744-534-0x00007FF6765B0000-0x00007FF6769A2000-memory.dmp	upx
behavioral2/memory/4412-533-0x00007FF7DC7F0000-0x00007FF7DCBE2000-memory.dmp	upx
behavioral2/memory/1812-532-0x00007FF786170000-0x00007FF786562000-memory.dmp	upx
behavioral2/memory/2860-531-0x00007FF6811D0000-0x00007FF6815C2000-memory.dmp	upx
behavioral2/memory/2812-530-0x00007FF76BA70000-0x00007FF76BE62000-memory.dmp	upx
behavioral2/memory/244-529-0x00007FF74AF00000-0x00007FF74B2F2000-memory.dmp	upx
behavioral2/memory/1196-370-0x00007FF6351D0000-0x00007FF6355C2000-memory.dmp	upx
behavioral2/memory/3588-319-0x00007FF765530000-0x00007FF765922000-memory.dmp	upx
behavioral2/memory/4488-260-0x00007FF749F10000-0x00007FF74A302000-memory.dmp	upx
behavioral2/files/0x00070000000234eb-208.dat	upx
behavioral2/files/0x00070000000234f2-203.dat	upx
behavioral2/files/0x00070000000234f8-177.dat	upx
behavioral2/memory/2164-174-0x00007FF75CBE0000-0x00007FF75CFD2000-memory.dmp	upx
behavioral2/files/0x00070000000234f7-167.dat	upx
behavioral2/files/0x00070000000234f6-166.dat	upx
behavioral2/files/0x00070000000234e6-164.dat	upx
behavioral2/files/0x00070000000234f5-158.dat	upx
behavioral2/files/0x00070000000234f0-152.dat	upx
behavioral2/files/0x00070000000234e9-183.dat	upx
behavioral2/files/0x00070000000234ef-150.dat	upx
behavioral2/files/0x00070000000234e8-146.dat	upx
behavioral2/files/0x00070000000234e4-145.dat	upx
behavioral2/files/0x00070000000234e3-140.dat	upx
behavioral2/memory/4292-137-0x00007FF7C4250000-0x00007FF7C4642000-memory.dmp	upx
behavioral2/files/0x00070000000234ee-136.dat	upx
behavioral2/files/0x00070000000234ed-135.dat	upx
behavioral2/files/0x00070000000234f4-157.dat	upx
behavioral2/files/0x00070000000234e2-131.dat	upx
behavioral2/files/0x00070000000234ec-130.dat	upx
behavioral2/files/0x00070000000234e1-128.dat	upx
behavioral2/files/0x00070000000234e0-124.dat	upx
behavioral2/files/0x00070000000234df-155.dat	upx
behavioral2/files/0x00070000000234e7-110.dat	upx
behavioral2/memory/2236-105-0x00007FF7CB880000-0x00007FF7CBC72000-memory.dmp	upx
behavioral2/files/0x00070000000234dd-101.dat	upx
behavioral2/files/0x00070000000234e5-94.dat	upx
behavioral2/memory/2632-91-0x00007FF6D5C00000-0x00007FF6D5FF2000-memory.dmp	upx
behavioral2/files/0x00070000000234d8-79.dat	upx
behavioral2/files/0x00070000000234d9-72.dat	upx
behavioral2/files/0x00070000000234da-83.dat	upx
behavioral2/files/0x00070000000234d7-60.dat	upx
behavioral2/files/0x00070000000234d6-53.dat	upx
behavioral2/files/0x00070000000234db-43.dat	upx
behavioral2/files/0x00070000000234dc-54.dat	upx
behavioral2/files/0x00080000000234d4-36.dat	upx
behavioral2/files/0x0009000000023472-14.dat	upx
behavioral2/memory/2860-3635-0x00007FF6811D0000-0x00007FF6815C2000-memory.dmp	upx
behavioral2/memory/2632-3637-0x00007FF6D5C00000-0x00007FF6D5FF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DETfduq.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\QfyvwQg.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\kEdpfCM.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\JukbWlR.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\CnuOVWG.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\dkYrOuX.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\gQQfgio.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\ajlWOth.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\ZUZVsWQ.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\quxSzLp.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\MroEMqq.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\BxLOzLK.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\FLwYJdR.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\KQlAjyR.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\uAQqiei.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\HaLtEZE.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\pwhGCde.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\oFRWADU.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\sdUxUii.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\gZBMIYx.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\zYTscay.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\ViEvXlc.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\PDZyFLH.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\FvYJpLd.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\aVuRgDO.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\awFPGwM.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\sPLVDsK.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\wpGikrv.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\VXATRMv.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\kTnTKyp.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\YAdVtNK.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\pTwpTVy.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\pkljeWG.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\UByJbwF.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\DqdADuj.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\yhQOMuW.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\VfTZhru.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\PKIrVnN.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\JvcPqaO.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\aEeXKMU.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\AaVKyOU.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\nvoRdlt.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\EREAgbY.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\XOqNukJ.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\rySbmOp.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\EjZjjFf.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\Jelmubk.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\UNhkRXO.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\qzCJAac.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\esGRLSs.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\lqAParS.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\oRuWFzv.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\QRvaJBl.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\uoSRPju.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\nLiZwlO.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\aQFukYx.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\SVXXCAn.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\GwdYdip.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\iLIYNPm.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\zAtreYy.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\shvErGh.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\tkJIzrX.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\DzRvyuy.exe	53d4d8f56d3d6edcac1893628a00d920N.exe
File created	C:\Windows\System\txcdyFt.exe	53d4d8f56d3d6edcac1893628a00d920N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1016	53d4d8f56d3d6edcac1893628a00d920N.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeLockMemoryPrivilege	1016	53d4d8f56d3d6edcac1893628a00d920N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1284	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	85
PID 1016 wrote to memory of 1284	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	85
PID 1016 wrote to memory of 2860	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	86
PID 1016 wrote to memory of 2860	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	86
PID 1016 wrote to memory of 1812	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	87
PID 1016 wrote to memory of 1812	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	87
PID 1016 wrote to memory of 2632	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	88
PID 1016 wrote to memory of 2632	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	88
PID 1016 wrote to memory of 2236	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	89
PID 1016 wrote to memory of 2236	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	89
PID 1016 wrote to memory of 4292	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	90
PID 1016 wrote to memory of 4292	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	90
PID 1016 wrote to memory of 2164	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	91
PID 1016 wrote to memory of 2164	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	91
PID 1016 wrote to memory of 4412	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	92
PID 1016 wrote to memory of 4412	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	92
PID 1016 wrote to memory of 1252	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	93
PID 1016 wrote to memory of 1252	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	93
PID 1016 wrote to memory of 4488	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	94
PID 1016 wrote to memory of 4488	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	94
PID 1016 wrote to memory of 184	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	95
PID 1016 wrote to memory of 184	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	95
PID 1016 wrote to memory of 2852	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	96
PID 1016 wrote to memory of 2852	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	96
PID 1016 wrote to memory of 3588	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	97
PID 1016 wrote to memory of 3588	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	97
PID 1016 wrote to memory of 2080	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	98
PID 1016 wrote to memory of 2080	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	98
PID 1016 wrote to memory of 1196	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	99
PID 1016 wrote to memory of 1196	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	99
PID 1016 wrote to memory of 1640	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	100
PID 1016 wrote to memory of 1640	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	100
PID 1016 wrote to memory of 4744	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	101
PID 1016 wrote to memory of 4744	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	101
PID 1016 wrote to memory of 1836	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	102
PID 1016 wrote to memory of 1836	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	102
PID 1016 wrote to memory of 3244	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	103
PID 1016 wrote to memory of 3244	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	103
PID 1016 wrote to memory of 2912	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	104
PID 1016 wrote to memory of 2912	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	104
PID 1016 wrote to memory of 2248	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	105
PID 1016 wrote to memory of 2248	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	105
PID 1016 wrote to memory of 1592	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	106
PID 1016 wrote to memory of 1592	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	106
PID 1016 wrote to memory of 1072	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	107
PID 1016 wrote to memory of 1072	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	107
PID 1016 wrote to memory of 244	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	108
PID 1016 wrote to memory of 244	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	108
PID 1016 wrote to memory of 2812	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	109
PID 1016 wrote to memory of 2812	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	109
PID 1016 wrote to memory of 5028	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	110
PID 1016 wrote to memory of 5028	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	110
PID 1016 wrote to memory of 3272	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	111
PID 1016 wrote to memory of 3272	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	111
PID 1016 wrote to memory of 3816	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	112
PID 1016 wrote to memory of 3816	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	112
PID 1016 wrote to memory of 3968	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	113
PID 1016 wrote to memory of 3968	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	113
PID 1016 wrote to memory of 2744	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	114
PID 1016 wrote to memory of 2744	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	114
PID 1016 wrote to memory of 3384	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	115
PID 1016 wrote to memory of 3384	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	115
PID 1016 wrote to memory of 1064	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	116
PID 1016 wrote to memory of 1064	1016	53d4d8f56d3d6edcac1893628a00d920N.exe	116

C:\Users\Admin\AppData\Local\Temp\53d4d8f56d3d6edcac1893628a00d920N.exe
"C:\Users\Admin\AppData\Local\Temp\53d4d8f56d3d6edcac1893628a00d920N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\System\XoYcPWz.exe
  C:\Windows\System\XoYcPWz.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\NmiSTcg.exe
  C:\Windows\System\NmiSTcg.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\FfqpTNR.exe
  C:\Windows\System\FfqpTNR.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\xklOHzb.exe
  C:\Windows\System\xklOHzb.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\QnHZqIx.exe
  C:\Windows\System\QnHZqIx.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\WJUXFCi.exe
  C:\Windows\System\WJUXFCi.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\GwdYdip.exe
  C:\Windows\System\GwdYdip.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\XhGybUc.exe
  C:\Windows\System\XhGybUc.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\iEcBMjy.exe
  C:\Windows\System\iEcBMjy.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\TdxuUBu.exe
  C:\Windows\System\TdxuUBu.exe
  2⤵
  - Executes dropped EXE
  PID:184
- C:\Windows\System\UFffMuu.exe
  C:\Windows\System\UFffMuu.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\IQKEwuB.exe
  C:\Windows\System\IQKEwuB.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\YPOXvVg.exe
  C:\Windows\System\YPOXvVg.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\VjgvDpH.exe
  C:\Windows\System\VjgvDpH.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\EWdOsyu.exe
  C:\Windows\System\EWdOsyu.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\GJDNQmI.exe
  C:\Windows\System\GJDNQmI.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\oAWKcCu.exe
  C:\Windows\System\oAWKcCu.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\cSnSGsu.exe
  C:\Windows\System\cSnSGsu.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\KUnsJYI.exe
  C:\Windows\System\KUnsJYI.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\kgTbaLl.exe
  C:\Windows\System\kgTbaLl.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\eSUVhoD.exe
  C:\Windows\System\eSUVhoD.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\XXLhomJ.exe
  C:\Windows\System\XXLhomJ.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\hEyhJVE.exe
  C:\Windows\System\hEyhJVE.exe
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Windows\System\MqmYlFD.exe
  C:\Windows\System\MqmYlFD.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\cEOMMfZ.exe
  C:\Windows\System\cEOMMfZ.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\gcBYPEY.exe
  C:\Windows\System\gcBYPEY.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\kIPsvEb.exe
  C:\Windows\System\kIPsvEb.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\DSzGyHL.exe
  C:\Windows\System\DSzGyHL.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\zYtMCdD.exe
  C:\Windows\System\zYtMCdD.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\UXrpSRq.exe
  C:\Windows\System\UXrpSRq.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\PbzmDlr.exe
  C:\Windows\System\PbzmDlr.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\eNThWLt.exe
  C:\Windows\System\eNThWLt.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\zkfeOCB.exe
  C:\Windows\System\zkfeOCB.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\wgvvVBG.exe
  C:\Windows\System\wgvvVBG.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\sYywHeh.exe
  C:\Windows\System\sYywHeh.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\TnrSClK.exe
  C:\Windows\System\TnrSClK.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\SFeohqP.exe
  C:\Windows\System\SFeohqP.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\YEMDLsT.exe
  C:\Windows\System\YEMDLsT.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\ZkKpdeY.exe
  C:\Windows\System\ZkKpdeY.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\uhyKvZE.exe
  C:\Windows\System\uhyKvZE.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\nvoRdlt.exe
  C:\Windows\System\nvoRdlt.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\QgbEliW.exe
  C:\Windows\System\QgbEliW.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\uXearod.exe
  C:\Windows\System\uXearod.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\RgAQqhX.exe
  C:\Windows\System\RgAQqhX.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\httopeC.exe
  C:\Windows\System\httopeC.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\FMbJcnf.exe
  C:\Windows\System\FMbJcnf.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\NvSrgeN.exe
  C:\Windows\System\NvSrgeN.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\JUMZWaJ.exe
  C:\Windows\System\JUMZWaJ.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\KHQDsFx.exe
  C:\Windows\System\KHQDsFx.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\AaVKyOU.exe
  C:\Windows\System\AaVKyOU.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\FYqIBHE.exe
  C:\Windows\System\FYqIBHE.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\ckNtlgH.exe
  C:\Windows\System\ckNtlgH.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\UxuTdvH.exe
  C:\Windows\System\UxuTdvH.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\XMDHzmM.exe
  C:\Windows\System\XMDHzmM.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\hYxVgYX.exe
  C:\Windows\System\hYxVgYX.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\SxlvvIa.exe
  C:\Windows\System\SxlvvIa.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\CNyJnJe.exe
  C:\Windows\System\CNyJnJe.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\vLpjmEQ.exe
  C:\Windows\System\vLpjmEQ.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\UmdEYpj.exe
  C:\Windows\System\UmdEYpj.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\PXUzFjb.exe
  C:\Windows\System\PXUzFjb.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\GQaYasJ.exe
  C:\Windows\System\GQaYasJ.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\EvsFoqq.exe
  C:\Windows\System\EvsFoqq.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\ekfBgjT.exe
  C:\Windows\System\ekfBgjT.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\cpbHwUI.exe
  C:\Windows\System\cpbHwUI.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\vfNFuYb.exe
  C:\Windows\System\vfNFuYb.exe
  2⤵
  PID:2480
- C:\Windows\System\APoXocV.exe
  C:\Windows\System\APoXocV.exe
  2⤵
  PID:2588
- C:\Windows\System\VVfbRSR.exe
  C:\Windows\System\VVfbRSR.exe
  2⤵
  PID:3536
- C:\Windows\System\BuUvjYy.exe
  C:\Windows\System\BuUvjYy.exe
  2⤵
  PID:4000
- C:\Windows\System\EmNapzc.exe
  C:\Windows\System\EmNapzc.exe
  2⤵
  PID:1068
- C:\Windows\System\bhUbpXl.exe
  C:\Windows\System\bhUbpXl.exe
  2⤵
  PID:4720
- C:\Windows\System\AqBSYDS.exe
  C:\Windows\System\AqBSYDS.exe
  2⤵
  PID:4976
- C:\Windows\System\BwRrSUm.exe
  C:\Windows\System\BwRrSUm.exe
  2⤵
  PID:1424
- C:\Windows\System\YeWLMoN.exe
  C:\Windows\System\YeWLMoN.exe
  2⤵
  PID:1380
- C:\Windows\System\aNGqrDM.exe
  C:\Windows\System\aNGqrDM.exe
  2⤵
  PID:2028
- C:\Windows\System\bZMDScF.exe
  C:\Windows\System\bZMDScF.exe
  2⤵
  PID:1992
- C:\Windows\System\qdNBPFl.exe
  C:\Windows\System\qdNBPFl.exe
  2⤵
  PID:3256
- C:\Windows\System\aINsdop.exe
  C:\Windows\System\aINsdop.exe
  2⤵
  PID:4448
- C:\Windows\System\rxrgrUQ.exe
  C:\Windows\System\rxrgrUQ.exe
  2⤵
  PID:4344
- C:\Windows\System\JukbWlR.exe
  C:\Windows\System\JukbWlR.exe
  2⤵
  PID:5136
- C:\Windows\System\SxBxXqk.exe
  C:\Windows\System\SxBxXqk.exe
  2⤵
  PID:5152
- C:\Windows\System\evEWYPj.exe
  C:\Windows\System\evEWYPj.exe
  2⤵
  PID:5192
- C:\Windows\System\clKsBhk.exe
  C:\Windows\System\clKsBhk.exe
  2⤵
  PID:5212
- C:\Windows\System\qDXioYX.exe
  C:\Windows\System\qDXioYX.exe
  2⤵
  PID:5232
- C:\Windows\System\qQpbWAL.exe
  C:\Windows\System\qQpbWAL.exe
  2⤵
  PID:5252
- C:\Windows\System\oiGpuXs.exe
  C:\Windows\System\oiGpuXs.exe
  2⤵
  PID:5272
- C:\Windows\System\JGsnhpR.exe
  C:\Windows\System\JGsnhpR.exe
  2⤵
  PID:5288
- C:\Windows\System\aXgniao.exe
  C:\Windows\System\aXgniao.exe
  2⤵
  PID:5308
- C:\Windows\System\EszuWTv.exe
  C:\Windows\System\EszuWTv.exe
  2⤵
  PID:5328
- C:\Windows\System\AAFhijO.exe
  C:\Windows\System\AAFhijO.exe
  2⤵
  PID:5348
- C:\Windows\System\LjlFJsZ.exe
  C:\Windows\System\LjlFJsZ.exe
  2⤵
  PID:5364
- C:\Windows\System\VHHVYUg.exe
  C:\Windows\System\VHHVYUg.exe
  2⤵
  PID:5384
- C:\Windows\System\gDOyjaR.exe
  C:\Windows\System\gDOyjaR.exe
  2⤵
  PID:5404
- C:\Windows\System\TrRGalK.exe
  C:\Windows\System\TrRGalK.exe
  2⤵
  PID:5432
- C:\Windows\System\QVgARTZ.exe
  C:\Windows\System\QVgARTZ.exe
  2⤵
  PID:5452
- C:\Windows\System\iLbWiyf.exe
  C:\Windows\System\iLbWiyf.exe
  2⤵
  PID:5676
- C:\Windows\System\HeedjnS.exe
  C:\Windows\System\HeedjnS.exe
  2⤵
  PID:5692
- C:\Windows\System\AJvFqzJ.exe
  C:\Windows\System\AJvFqzJ.exe
  2⤵
  PID:5716
- C:\Windows\System\IIpnZgJ.exe
  C:\Windows\System\IIpnZgJ.exe
  2⤵
  PID:5732
- C:\Windows\System\iQHWoqN.exe
  C:\Windows\System\iQHWoqN.exe
  2⤵
  PID:5748
- C:\Windows\System\TbipAkh.exe
  C:\Windows\System\TbipAkh.exe
  2⤵
  PID:5764
- C:\Windows\System\ewnWtqd.exe
  C:\Windows\System\ewnWtqd.exe
  2⤵
  PID:5780
- C:\Windows\System\mQXBIrz.exe
  C:\Windows\System\mQXBIrz.exe
  2⤵
  PID:5800
- C:\Windows\System\mZwUrJE.exe
  C:\Windows\System\mZwUrJE.exe
  2⤵
  PID:5816
- C:\Windows\System\beemsWs.exe
  C:\Windows\System\beemsWs.exe
  2⤵
  PID:5836
- C:\Windows\System\jOAMVGb.exe
  C:\Windows\System\jOAMVGb.exe
  2⤵
  PID:5852
- C:\Windows\System\HNfQZew.exe
  C:\Windows\System\HNfQZew.exe
  2⤵
  PID:5872
- C:\Windows\System\YQmzxMj.exe
  C:\Windows\System\YQmzxMj.exe
  2⤵
  PID:5888
- C:\Windows\System\ucoxolR.exe
  C:\Windows\System\ucoxolR.exe
  2⤵
  PID:5904
- C:\Windows\System\ZPYkSpt.exe
  C:\Windows\System\ZPYkSpt.exe
  2⤵
  PID:5920
- C:\Windows\System\KuopgOG.exe
  C:\Windows\System\KuopgOG.exe
  2⤵
  PID:5936
- C:\Windows\System\oNZugDE.exe
  C:\Windows\System\oNZugDE.exe
  2⤵
  PID:5952
- C:\Windows\System\ZwsnDIw.exe
  C:\Windows\System\ZwsnDIw.exe
  2⤵
  PID:5968
- C:\Windows\System\wExceMz.exe
  C:\Windows\System\wExceMz.exe
  2⤵
  PID:5988
- C:\Windows\System\qYRbUyg.exe
  C:\Windows\System\qYRbUyg.exe
  2⤵
  PID:6008
- C:\Windows\System\epeEbux.exe
  C:\Windows\System\epeEbux.exe
  2⤵
  PID:4536
- C:\Windows\System\fNjYSkl.exe
  C:\Windows\System\fNjYSkl.exe
  2⤵
  PID:1360
- C:\Windows\System\xebouPi.exe
  C:\Windows\System\xebouPi.exe
  2⤵
  PID:4452
- C:\Windows\System\ypSTuEB.exe
  C:\Windows\System\ypSTuEB.exe
  2⤵
  PID:924
- C:\Windows\System\MiMntGZ.exe
  C:\Windows\System\MiMntGZ.exe
  2⤵
  PID:1504
- C:\Windows\System\olVAaec.exe
  C:\Windows\System\olVAaec.exe
  2⤵
  PID:1548
- C:\Windows\System\BsbiSaN.exe
  C:\Windows\System\BsbiSaN.exe
  2⤵
  PID:2908
- C:\Windows\System\errhlWR.exe
  C:\Windows\System\errhlWR.exe
  2⤵
  PID:704
- C:\Windows\System\xuCTvjH.exe
  C:\Windows\System\xuCTvjH.exe
  2⤵
  PID:3512
- C:\Windows\System\uURvLez.exe
  C:\Windows\System\uURvLez.exe
  2⤵
  PID:216
- C:\Windows\System\QZalJXm.exe
  C:\Windows\System\QZalJXm.exe
  2⤵
  PID:4080
- C:\Windows\System\chbYfMA.exe
  C:\Windows\System\chbYfMA.exe
  2⤵
  PID:5148
- C:\Windows\System\iBHfmSn.exe
  C:\Windows\System\iBHfmSn.exe
  2⤵
  PID:5180
- C:\Windows\System\VfQdKyL.exe
  C:\Windows\System\VfQdKyL.exe
  2⤵
  PID:5208
- C:\Windows\System\xNdXLrn.exe
  C:\Windows\System\xNdXLrn.exe
  2⤵
  PID:5260
- C:\Windows\System\RZqLDUV.exe
  C:\Windows\System\RZqLDUV.exe
  2⤵
  PID:5284
- C:\Windows\System\MEYYtKL.exe
  C:\Windows\System\MEYYtKL.exe
  2⤵
  PID:5336
- C:\Windows\System\dzSICyR.exe
  C:\Windows\System\dzSICyR.exe
  2⤵
  PID:5360
- C:\Windows\System\EmoteoK.exe
  C:\Windows\System\EmoteoK.exe
  2⤵
  PID:5416
- C:\Windows\System\qTGQcxE.exe
  C:\Windows\System\qTGQcxE.exe
  2⤵
  PID:5460
- C:\Windows\System\knhNumA.exe
  C:\Windows\System\knhNumA.exe
  2⤵
  PID:5500
- C:\Windows\System\okpWlhw.exe
  C:\Windows\System\okpWlhw.exe
  2⤵
  PID:5540
- C:\Windows\System\oYuecKV.exe
  C:\Windows\System\oYuecKV.exe
  2⤵
  PID:5600
- C:\Windows\System\OiMHcxy.exe
  C:\Windows\System\OiMHcxy.exe
  2⤵
  PID:5724
- C:\Windows\System\hXKNNKq.exe
  C:\Windows\System\hXKNNKq.exe
  2⤵
  PID:5756
- C:\Windows\System\VmdqxlJ.exe
  C:\Windows\System\VmdqxlJ.exe
  2⤵
  PID:6164
- C:\Windows\System\xdHIICW.exe
  C:\Windows\System\xdHIICW.exe
  2⤵
  PID:6180
- C:\Windows\System\eiCoPfy.exe
  C:\Windows\System\eiCoPfy.exe
  2⤵
  PID:6204
- C:\Windows\System\RYzFcAB.exe
  C:\Windows\System\RYzFcAB.exe
  2⤵
  PID:6232
- C:\Windows\System\CioopiW.exe
  C:\Windows\System\CioopiW.exe
  2⤵
  PID:6248
- C:\Windows\System\FVQCIUV.exe
  C:\Windows\System\FVQCIUV.exe
  2⤵
  PID:6264
- C:\Windows\System\kapkXZe.exe
  C:\Windows\System\kapkXZe.exe
  2⤵
  PID:6372
- C:\Windows\System\tWPlBzl.exe
  C:\Windows\System\tWPlBzl.exe
  2⤵
  PID:6396
- C:\Windows\System\rDaEViN.exe
  C:\Windows\System\rDaEViN.exe
  2⤵
  PID:6412
- C:\Windows\System\drqYBMO.exe
  C:\Windows\System\drqYBMO.exe
  2⤵
  PID:6436
- C:\Windows\System\ONfaWum.exe
  C:\Windows\System\ONfaWum.exe
  2⤵
  PID:6452
- C:\Windows\System\QlJJDIw.exe
  C:\Windows\System\QlJJDIw.exe
  2⤵
  PID:6480
- C:\Windows\System\BvACUQG.exe
  C:\Windows\System\BvACUQG.exe
  2⤵
  PID:6504
- C:\Windows\System\qOMbBhw.exe
  C:\Windows\System\qOMbBhw.exe
  2⤵
  PID:6528
- C:\Windows\System\BLlcJLp.exe
  C:\Windows\System\BLlcJLp.exe
  2⤵
  PID:6552
- C:\Windows\System\XMPBLQM.exe
  C:\Windows\System\XMPBLQM.exe
  2⤵
  PID:6576
- C:\Windows\System\OcNOsxv.exe
  C:\Windows\System\OcNOsxv.exe
  2⤵
  PID:6592
- C:\Windows\System\kqROwDQ.exe
  C:\Windows\System\kqROwDQ.exe
  2⤵
  PID:6616
- C:\Windows\System\GnkAsWt.exe
  C:\Windows\System\GnkAsWt.exe
  2⤵
  PID:6632
- C:\Windows\System\jhaxqUc.exe
  C:\Windows\System\jhaxqUc.exe
  2⤵
  PID:6832
- C:\Windows\System\ngtnaTJ.exe
  C:\Windows\System\ngtnaTJ.exe
  2⤵
  PID:6864
- C:\Windows\System\HZalGBq.exe
  C:\Windows\System\HZalGBq.exe
  2⤵
  PID:6880
- C:\Windows\System\EZcCyDS.exe
  C:\Windows\System\EZcCyDS.exe
  2⤵
  PID:6908
- C:\Windows\System\TeVCjmB.exe
  C:\Windows\System\TeVCjmB.exe
  2⤵
  PID:6924
- C:\Windows\System\YdrUBth.exe
  C:\Windows\System\YdrUBth.exe
  2⤵
  PID:6948
- C:\Windows\System\KcYjXpj.exe
  C:\Windows\System\KcYjXpj.exe
  2⤵
  PID:6964
- C:\Windows\System\uQVUdEj.exe
  C:\Windows\System\uQVUdEj.exe
  2⤵
  PID:6988
- C:\Windows\System\VWYHEAI.exe
  C:\Windows\System\VWYHEAI.exe
  2⤵
  PID:7004
- C:\Windows\System\XZyIWtu.exe
  C:\Windows\System\XZyIWtu.exe
  2⤵
  PID:7028
- C:\Windows\System\CfCagVl.exe
  C:\Windows\System\CfCagVl.exe
  2⤵
  PID:7044
- C:\Windows\System\CmrbqIR.exe
  C:\Windows\System\CmrbqIR.exe
  2⤵
  PID:7072
- C:\Windows\System\yCuKqLk.exe
  C:\Windows\System\yCuKqLk.exe
  2⤵
  PID:7092
- C:\Windows\System\cUmGOOb.exe
  C:\Windows\System\cUmGOOb.exe
  2⤵
  PID:7112
- C:\Windows\System\JrDvwDj.exe
  C:\Windows\System\JrDvwDj.exe
  2⤵
  PID:7136
- C:\Windows\System\YDcusHz.exe
  C:\Windows\System\YDcusHz.exe
  2⤵
  PID:7152
- C:\Windows\System\gdSCfhI.exe
  C:\Windows\System\gdSCfhI.exe
  2⤵
  PID:5788
- C:\Windows\System\omFyxFS.exe
  C:\Windows\System\omFyxFS.exe
  2⤵
  PID:5824
- C:\Windows\System\NAZyEQp.exe
  C:\Windows\System\NAZyEQp.exe
  2⤵
  PID:5880
- C:\Windows\System\sHxaYuL.exe
  C:\Windows\System\sHxaYuL.exe
  2⤵
  PID:5916
- C:\Windows\System\DXvbeBI.exe
  C:\Windows\System\DXvbeBI.exe
  2⤵
  PID:5960
- C:\Windows\System\sSLLHRs.exe
  C:\Windows\System\sSLLHRs.exe
  2⤵
  PID:5984
- C:\Windows\System\CvpUWqM.exe
  C:\Windows\System\CvpUWqM.exe
  2⤵
  PID:2056
- C:\Windows\System\UNhkRXO.exe
  C:\Windows\System\UNhkRXO.exe
  2⤵
  PID:5144
- C:\Windows\System\lMyVWMQ.exe
  C:\Windows\System\lMyVWMQ.exe
  2⤵
  PID:3928
- C:\Windows\System\KirPvOQ.exe
  C:\Windows\System\KirPvOQ.exe
  2⤵
  PID:5356
- C:\Windows\System\ymzAgYu.exe
  C:\Windows\System\ymzAgYu.exe
  2⤵
  PID:5448
- C:\Windows\System\wUStmml.exe
  C:\Windows\System\wUStmml.exe
  2⤵
  PID:5684
- C:\Windows\System\CIhwKVS.exe
  C:\Windows\System\CIhwKVS.exe
  2⤵
  PID:6148
- C:\Windows\System\vNFPAnU.exe
  C:\Windows\System\vNFPAnU.exe
  2⤵
  PID:6088
- C:\Windows\System\ivSFKGt.exe
  C:\Windows\System\ivSFKGt.exe
  2⤵
  PID:6072
- C:\Windows\System\ADAgRYa.exe
  C:\Windows\System\ADAgRYa.exe
  2⤵
  PID:6128
- C:\Windows\System\cNlNfno.exe
  C:\Windows\System\cNlNfno.exe
  2⤵
  PID:4672
- C:\Windows\System\pZNoubK.exe
  C:\Windows\System\pZNoubK.exe
  2⤵
  PID:228
- C:\Windows\System\hLjYtDc.exe
  C:\Windows\System\hLjYtDc.exe
  2⤵
  PID:1756
- C:\Windows\System\nlSlHyz.exe
  C:\Windows\System\nlSlHyz.exe
  2⤵
  PID:4384
- C:\Windows\System\CMefTuH.exe
  C:\Windows\System\CMefTuH.exe
  2⤵
  PID:5132
- C:\Windows\System\cDTdcRR.exe
  C:\Windows\System\cDTdcRR.exe
  2⤵
  PID:5560
- C:\Windows\System\IrIzZYr.exe
  C:\Windows\System\IrIzZYr.exe
  2⤵
  PID:6176
- C:\Windows\System\HFXtHsB.exe
  C:\Windows\System\HFXtHsB.exe
  2⤵
  PID:6256
- C:\Windows\System\VDWUzuv.exe
  C:\Windows\System\VDWUzuv.exe
  2⤵
  PID:6324
- C:\Windows\System\iWafbwP.exe
  C:\Windows\System\iWafbwP.exe
  2⤵
  PID:6392
- C:\Windows\System\ppecLei.exe
  C:\Windows\System\ppecLei.exe
  2⤵
  PID:6432
- C:\Windows\System\BpLfnVy.exe
  C:\Windows\System\BpLfnVy.exe
  2⤵
  PID:6488
- C:\Windows\System\fpNuTjl.exe
  C:\Windows\System\fpNuTjl.exe
  2⤵
  PID:6524
- C:\Windows\System\vlVnDbF.exe
  C:\Windows\System\vlVnDbF.exe
  2⤵
  PID:6588
- C:\Windows\System\vnPeZTw.exe
  C:\Windows\System\vnPeZTw.exe
  2⤵
  PID:6628
- C:\Windows\System\XvDdigx.exe
  C:\Windows\System\XvDdigx.exe
  2⤵
  PID:6720
- C:\Windows\System\SmHzBZl.exe
  C:\Windows\System\SmHzBZl.exe
  2⤵
  PID:1092
- C:\Windows\System\tUEFfBL.exe
  C:\Windows\System\tUEFfBL.exe
  2⤵
  PID:1784
- C:\Windows\System\yzXJDPz.exe
  C:\Windows\System\yzXJDPz.exe
  2⤵
  PID:3020
- C:\Windows\System\DvmWlke.exe
  C:\Windows\System\DvmWlke.exe
  2⤵
  PID:4316
- C:\Windows\System\jDAurBR.exe
  C:\Windows\System\jDAurBR.exe
  2⤵
  PID:4064
- C:\Windows\System\MBCZDqZ.exe
  C:\Windows\System\MBCZDqZ.exe
  2⤵
  PID:2144
- C:\Windows\System\lluNxkU.exe
  C:\Windows\System\lluNxkU.exe
  2⤵
  PID:3532
- C:\Windows\System\sOMxHDo.exe
  C:\Windows\System\sOMxHDo.exe
  2⤵
  PID:3844
- C:\Windows\System\smwffzZ.exe
  C:\Windows\System\smwffzZ.exe
  2⤵
  PID:1340
- C:\Windows\System\pvKPAQH.exe
  C:\Windows\System\pvKPAQH.exe
  2⤵
  PID:4660
- C:\Windows\System\xUpUrfL.exe
  C:\Windows\System\xUpUrfL.exe
  2⤵
  PID:3360
- C:\Windows\System\jtmdjxw.exe
  C:\Windows\System\jtmdjxw.exe
  2⤵
  PID:1232
- C:\Windows\System\sWofAiq.exe
  C:\Windows\System\sWofAiq.exe
  2⤵
  PID:5088
- C:\Windows\System\uNSmVCe.exe
  C:\Windows\System\uNSmVCe.exe
  2⤵
  PID:6848
- C:\Windows\System\srmhvBh.exe
  C:\Windows\System\srmhvBh.exe
  2⤵
  PID:6892
- C:\Windows\System\GUHcTee.exe
  C:\Windows\System\GUHcTee.exe
  2⤵
  PID:7024
- C:\Windows\System\FvYJpLd.exe
  C:\Windows\System\FvYJpLd.exe
  2⤵
  PID:7060
- C:\Windows\System\LLVbipG.exe
  C:\Windows\System\LLVbipG.exe
  2⤵
  PID:7108
- C:\Windows\System\HAMhZcv.exe
  C:\Windows\System\HAMhZcv.exe
  2⤵
  PID:1920
- C:\Windows\System\PfsbRFy.exe
  C:\Windows\System\PfsbRFy.exe
  2⤵
  PID:7188
- C:\Windows\System\fpvMEVX.exe
  C:\Windows\System\fpvMEVX.exe
  2⤵
  PID:7204
- C:\Windows\System\InLfhvZ.exe
  C:\Windows\System\InLfhvZ.exe
  2⤵
  PID:7228
- C:\Windows\System\qqjlHbf.exe
  C:\Windows\System\qqjlHbf.exe
  2⤵
  PID:7248
- C:\Windows\System\UjxriKD.exe
  C:\Windows\System\UjxriKD.exe
  2⤵
  PID:7272
- C:\Windows\System\tGHyWVR.exe
  C:\Windows\System\tGHyWVR.exe
  2⤵
  PID:7292
- C:\Windows\System\HKzEXsb.exe
  C:\Windows\System\HKzEXsb.exe
  2⤵
  PID:7312
- C:\Windows\System\aAqtPVM.exe
  C:\Windows\System\aAqtPVM.exe
  2⤵
  PID:7328
- C:\Windows\System\ZRwYVyk.exe
  C:\Windows\System\ZRwYVyk.exe
  2⤵
  PID:7356
- C:\Windows\System\YRvwUiP.exe
  C:\Windows\System\YRvwUiP.exe
  2⤵
  PID:7372
- C:\Windows\System\RDWzQIy.exe
  C:\Windows\System\RDWzQIy.exe
  2⤵
  PID:7392
- C:\Windows\System\RojccTb.exe
  C:\Windows\System\RojccTb.exe
  2⤵
  PID:7412
- C:\Windows\System\sGKWTcg.exe
  C:\Windows\System\sGKWTcg.exe
  2⤵
  PID:7436
- C:\Windows\System\eMSSOVg.exe
  C:\Windows\System\eMSSOVg.exe
  2⤵
  PID:7452
- C:\Windows\System\zYTscay.exe
  C:\Windows\System\zYTscay.exe
  2⤵
  PID:7472
- C:\Windows\System\OenMdxo.exe
  C:\Windows\System\OenMdxo.exe
  2⤵
  PID:7492
- C:\Windows\System\RbdsGAI.exe
  C:\Windows\System\RbdsGAI.exe
  2⤵
  PID:7508
- C:\Windows\System\HeAfbKB.exe
  C:\Windows\System\HeAfbKB.exe
  2⤵
  PID:7532
- C:\Windows\System\LtGCPHb.exe
  C:\Windows\System\LtGCPHb.exe
  2⤵
  PID:7556
- C:\Windows\System\bOHmKDl.exe
  C:\Windows\System\bOHmKDl.exe
  2⤵
  PID:7580
- C:\Windows\System\nQhhsnn.exe
  C:\Windows\System\nQhhsnn.exe
  2⤵
  PID:7600
- C:\Windows\System\sQzXWkP.exe
  C:\Windows\System\sQzXWkP.exe
  2⤵
  PID:7616
- C:\Windows\System\colEeqD.exe
  C:\Windows\System\colEeqD.exe
  2⤵
  PID:7644
- C:\Windows\System\oEpNqzH.exe
  C:\Windows\System\oEpNqzH.exe
  2⤵
  PID:7668
- C:\Windows\System\GWNbEGH.exe
  C:\Windows\System\GWNbEGH.exe
  2⤵
  PID:7688
- C:\Windows\System\jSEXAdg.exe
  C:\Windows\System\jSEXAdg.exe
  2⤵
  PID:7708
- C:\Windows\System\qYoLZgB.exe
  C:\Windows\System\qYoLZgB.exe
  2⤵
  PID:7724
- C:\Windows\System\cinWsHP.exe
  C:\Windows\System\cinWsHP.exe
  2⤵
  PID:7740
- C:\Windows\System\jTEkUpl.exe
  C:\Windows\System\jTEkUpl.exe
  2⤵
  PID:7760
- C:\Windows\System\DUKncwu.exe
  C:\Windows\System\DUKncwu.exe
  2⤵
  PID:7780
- C:\Windows\System\thPNTTj.exe
  C:\Windows\System\thPNTTj.exe
  2⤵
  PID:7796
- C:\Windows\System\evcmmVe.exe
  C:\Windows\System\evcmmVe.exe
  2⤵
  PID:7820
- C:\Windows\System\AlSRtgM.exe
  C:\Windows\System\AlSRtgM.exe
  2⤵
  PID:7844
- C:\Windows\System\VuYcWsX.exe
  C:\Windows\System\VuYcWsX.exe
  2⤵
  PID:7868
- C:\Windows\System\UCTuLtF.exe
  C:\Windows\System\UCTuLtF.exe
  2⤵
  PID:7884
- C:\Windows\System\IBwuNMf.exe
  C:\Windows\System\IBwuNMf.exe
  2⤵
  PID:7904
- C:\Windows\System\lJqSFoa.exe
  C:\Windows\System\lJqSFoa.exe
  2⤵
  PID:7932
- C:\Windows\System\UazLETG.exe
  C:\Windows\System\UazLETG.exe
  2⤵
  PID:7952
- C:\Windows\System\vhrfOmi.exe
  C:\Windows\System\vhrfOmi.exe
  2⤵
  PID:7972
- C:\Windows\System\kiUDtyz.exe
  C:\Windows\System\kiUDtyz.exe
  2⤵
  PID:7988
- C:\Windows\System\EUaJHxZ.exe
  C:\Windows\System\EUaJHxZ.exe
  2⤵
  PID:8008
- C:\Windows\System\NRQoxTs.exe
  C:\Windows\System\NRQoxTs.exe
  2⤵
  PID:8028
- C:\Windows\System\mXHMhyr.exe
  C:\Windows\System\mXHMhyr.exe
  2⤵
  PID:8048
- C:\Windows\System\JCLCgLS.exe
  C:\Windows\System\JCLCgLS.exe
  2⤵
  PID:8072
- C:\Windows\System\KaaiBnQ.exe
  C:\Windows\System\KaaiBnQ.exe
  2⤵
  PID:8100
- C:\Windows\System\MHfkevy.exe
  C:\Windows\System\MHfkevy.exe
  2⤵
  PID:8116
- C:\Windows\System\szEEcfz.exe
  C:\Windows\System\szEEcfz.exe
  2⤵
  PID:8140
- C:\Windows\System\tLdlunG.exe
  C:\Windows\System\tLdlunG.exe
  2⤵
  PID:8164
- C:\Windows\System\aePDurp.exe
  C:\Windows\System\aePDurp.exe
  2⤵
  PID:8184
- C:\Windows\System\KsqKfKM.exe
  C:\Windows\System\KsqKfKM.exe
  2⤵
  PID:6888
- C:\Windows\System\UusWGnI.exe
  C:\Windows\System\UusWGnI.exe
  2⤵
  PID:6916
- C:\Windows\System\CNWUuAU.exe
  C:\Windows\System\CNWUuAU.exe
  2⤵
  PID:6172
- C:\Windows\System\cysMHFW.exe
  C:\Windows\System\cysMHFW.exe
  2⤵
  PID:6348
- C:\Windows\System\lGapLfO.exe
  C:\Windows\System\lGapLfO.exe
  2⤵
  PID:6568
- C:\Windows\System\EUZvVTT.exe
  C:\Windows\System\EUZvVTT.exe
  2⤵
  PID:6700
- C:\Windows\System\bxcmsHe.exe
  C:\Windows\System\bxcmsHe.exe
  2⤵
  PID:468
- C:\Windows\System\tYfEWKV.exe
  C:\Windows\System\tYfEWKV.exe
  2⤵
  PID:5948
- C:\Windows\System\kFxDCsr.exe
  C:\Windows\System\kFxDCsr.exe
  2⤵
  PID:5248
- C:\Windows\System\jQyyKgt.exe
  C:\Windows\System\jQyyKgt.exe
  2⤵
  PID:7052
- C:\Windows\System\vIXFsDw.exe
  C:\Windows\System\vIXFsDw.exe
  2⤵
  PID:7172
- C:\Windows\System\PkwYBcf.exe
  C:\Windows\System\PkwYBcf.exe
  2⤵
  PID:5412
- C:\Windows\System\BEUZojL.exe
  C:\Windows\System\BEUZojL.exe
  2⤵
  PID:7348
- C:\Windows\System\fAZCsvr.exe
  C:\Windows\System\fAZCsvr.exe
  2⤵
  PID:7448
- C:\Windows\System\hOoBfoK.exe
  C:\Windows\System\hOoBfoK.exe
  2⤵
  PID:7504
- C:\Windows\System\SuwuqWs.exe
  C:\Windows\System\SuwuqWs.exe
  2⤵
  PID:8196
- C:\Windows\System\LkCYyHX.exe
  C:\Windows\System\LkCYyHX.exe
  2⤵
  PID:8216
- C:\Windows\System\kwGShyu.exe
  C:\Windows\System\kwGShyu.exe
  2⤵
  PID:8236
- C:\Windows\System\xAZacMa.exe
  C:\Windows\System\xAZacMa.exe
  2⤵
  PID:8256
- C:\Windows\System\baQWagk.exe
  C:\Windows\System\baQWagk.exe
  2⤵
  PID:8272
- C:\Windows\System\vRJBDOH.exe
  C:\Windows\System\vRJBDOH.exe
  2⤵
  PID:8296
- C:\Windows\System\antjwOz.exe
  C:\Windows\System\antjwOz.exe
  2⤵
  PID:8312
- C:\Windows\System\rLOLFyH.exe
  C:\Windows\System\rLOLFyH.exe
  2⤵
  PID:8332
- C:\Windows\System\gFWbeoq.exe
  C:\Windows\System\gFWbeoq.exe
  2⤵
  PID:8352
- C:\Windows\System\apRMPbY.exe
  C:\Windows\System\apRMPbY.exe
  2⤵
  PID:8368
- C:\Windows\System\yReJVnS.exe
  C:\Windows\System\yReJVnS.exe
  2⤵
  PID:8392
- C:\Windows\System\lqAParS.exe
  C:\Windows\System\lqAParS.exe
  2⤵
  PID:8420
- C:\Windows\System\xFvrSDV.exe
  C:\Windows\System\xFvrSDV.exe
  2⤵
  PID:8440
- C:\Windows\System\lTJaZxV.exe
  C:\Windows\System\lTJaZxV.exe
  2⤵
  PID:8468
- C:\Windows\System\KYOEydN.exe
  C:\Windows\System\KYOEydN.exe
  2⤵
  PID:8488
- C:\Windows\System\mEgSJMf.exe
  C:\Windows\System\mEgSJMf.exe
  2⤵
  PID:8508
- C:\Windows\System\eILblmg.exe
  C:\Windows\System\eILblmg.exe
  2⤵
  PID:8528
- C:\Windows\System\LeWamnm.exe
  C:\Windows\System\LeWamnm.exe
  2⤵
  PID:8552
- C:\Windows\System\zYfpPer.exe
  C:\Windows\System\zYfpPer.exe
  2⤵
  PID:8568
- C:\Windows\System\rKuaxoR.exe
  C:\Windows\System\rKuaxoR.exe
  2⤵
  PID:8588
- C:\Windows\System\XyFqycK.exe
  C:\Windows\System\XyFqycK.exe
  2⤵
  PID:8612
- C:\Windows\System\wMfhCBn.exe
  C:\Windows\System\wMfhCBn.exe
  2⤵
  PID:8628
- C:\Windows\System\pYAbuwx.exe
  C:\Windows\System\pYAbuwx.exe
  2⤵
  PID:8664
- C:\Windows\System\AYWPTjt.exe
  C:\Windows\System\AYWPTjt.exe
  2⤵
  PID:8680
- C:\Windows\System\vRkoBpz.exe
  C:\Windows\System\vRkoBpz.exe
  2⤵
  PID:8716
- C:\Windows\System\nmsUjAc.exe
  C:\Windows\System\nmsUjAc.exe
  2⤵
  PID:8732
- C:\Windows\System\eDVzprL.exe
  C:\Windows\System\eDVzprL.exe
  2⤵
  PID:8760
- C:\Windows\System\BeJeIIk.exe
  C:\Windows\System\BeJeIIk.exe
  2⤵
  PID:8776
- C:\Windows\System\qHHcprp.exe
  C:\Windows\System\qHHcprp.exe
  2⤵
  PID:8796
- C:\Windows\System\UKKpVnI.exe
  C:\Windows\System\UKKpVnI.exe
  2⤵
  PID:8812
- C:\Windows\System\gOSJtKq.exe
  C:\Windows\System\gOSJtKq.exe
  2⤵
  PID:8832
- C:\Windows\System\hjMsyMJ.exe
  C:\Windows\System\hjMsyMJ.exe
  2⤵
  PID:8856
- C:\Windows\System\MrmnJkM.exe
  C:\Windows\System\MrmnJkM.exe
  2⤵
  PID:8876
- C:\Windows\System\PkILXON.exe
  C:\Windows\System\PkILXON.exe
  2⤵
  PID:8896
- C:\Windows\System\itJrdPq.exe
  C:\Windows\System\itJrdPq.exe
  2⤵
  PID:8916
- C:\Windows\System\TcBcrjl.exe
  C:\Windows\System\TcBcrjl.exe
  2⤵
  PID:8936
- C:\Windows\System\pNoXTyf.exe
  C:\Windows\System\pNoXTyf.exe
  2⤵
  PID:8956
- C:\Windows\System\dBSvJJa.exe
  C:\Windows\System\dBSvJJa.exe
  2⤵
  PID:8980
- C:\Windows\System\ogBZXAP.exe
  C:\Windows\System\ogBZXAP.exe
  2⤵
  PID:9000
- C:\Windows\System\AxkOMkV.exe
  C:\Windows\System\AxkOMkV.exe
  2⤵
  PID:9028
- C:\Windows\System\aVuRgDO.exe
  C:\Windows\System\aVuRgDO.exe
  2⤵
  PID:9044
- C:\Windows\System\yqkNqCl.exe
  C:\Windows\System\yqkNqCl.exe
  2⤵
  PID:9072
- C:\Windows\System\eloumqp.exe
  C:\Windows\System\eloumqp.exe
  2⤵
  PID:9088
- C:\Windows\System\iLIYNPm.exe
  C:\Windows\System\iLIYNPm.exe
  2⤵
  PID:9112
- C:\Windows\System\egUroWv.exe
  C:\Windows\System\egUroWv.exe
  2⤵
  PID:9132
- C:\Windows\System\AHpCDSL.exe
  C:\Windows\System\AHpCDSL.exe
  2⤵
  PID:9156
- C:\Windows\System\WTJFykJ.exe
  C:\Windows\System\WTJFykJ.exe
  2⤵
  PID:9176
- C:\Windows\System\JGdpccS.exe
  C:\Windows\System\JGdpccS.exe
  2⤵
  PID:9196
- C:\Windows\System\YaBtsEW.exe
  C:\Windows\System\YaBtsEW.exe
  2⤵
  PID:9212
- C:\Windows\System\MroEMqq.exe
  C:\Windows\System\MroEMqq.exe
  2⤵
  PID:7608
- C:\Windows\System\lqMvowc.exe
  C:\Windows\System\lqMvowc.exe
  2⤵
  PID:6972
- C:\Windows\System\CFTleKT.exe
  C:\Windows\System\CFTleKT.exe
  2⤵
  PID:7012
- C:\Windows\System\ZuffzJE.exe
  C:\Windows\System\ZuffzJE.exe
  2⤵
  PID:7124
- C:\Windows\System\URLLPFx.exe
  C:\Windows\System\URLLPFx.exe
  2⤵
  PID:6420
- C:\Windows\System\XyAOpdC.exe
  C:\Windows\System\XyAOpdC.exe
  2⤵
  PID:7752
- C:\Windows\System\xFPoyoe.exe
  C:\Windows\System\xFPoyoe.exe
  2⤵
  PID:7768
- C:\Windows\System\mYlqHbR.exe
  C:\Windows\System\mYlqHbR.exe
  2⤵
  PID:7960
- C:\Windows\System\gRkqmJP.exe
  C:\Windows\System\gRkqmJP.exe
  2⤵
  PID:7980
- C:\Windows\System\WuYjCvR.exe
  C:\Windows\System\WuYjCvR.exe
  2⤵
  PID:3432
- C:\Windows\System\XvxgHTS.exe
  C:\Windows\System\XvxgHTS.exe
  2⤵
  PID:8040
- C:\Windows\System\yMIHqqN.exe
  C:\Windows\System\yMIHqqN.exe
  2⤵
  PID:8080
- C:\Windows\System\TkbZuYV.exe
  C:\Windows\System\TkbZuYV.exe
  2⤵
  PID:8112
- C:\Windows\System\WZCXfYF.exe
  C:\Windows\System\WZCXfYF.exe
  2⤵
  PID:7088
- C:\Windows\System\tTnFOFU.exe
  C:\Windows\System\tTnFOFU.exe
  2⤵
  PID:6316
- C:\Windows\System\kWRHBWR.exe
  C:\Windows\System\kWRHBWR.exe
  2⤵
  PID:4028
- C:\Windows\System\rRpyyYO.exe
  C:\Windows\System\rRpyyYO.exe
  2⤵
  PID:7244
- C:\Windows\System\bMPhluv.exe
  C:\Windows\System\bMPhluv.exe
  2⤵
  PID:9244
- C:\Windows\System\ksgEuFX.exe
  C:\Windows\System\ksgEuFX.exe
  2⤵
  PID:9268
- C:\Windows\System\YzRhuwm.exe
  C:\Windows\System\YzRhuwm.exe
  2⤵
  PID:9288
- C:\Windows\System\WPmQnlJ.exe
  C:\Windows\System\WPmQnlJ.exe
  2⤵
  PID:9308
- C:\Windows\System\FtLEIrS.exe
  C:\Windows\System\FtLEIrS.exe
  2⤵
  PID:9332
- C:\Windows\System\qSEqwQb.exe
  C:\Windows\System\qSEqwQb.exe
  2⤵
  PID:9352
- C:\Windows\System\musMdQf.exe
  C:\Windows\System\musMdQf.exe
  2⤵
  PID:9372
- C:\Windows\System\jXjpFUx.exe
  C:\Windows\System\jXjpFUx.exe
  2⤵
  PID:9388
- C:\Windows\System\GqAaagC.exe
  C:\Windows\System\GqAaagC.exe
  2⤵
  PID:9404
- C:\Windows\System\cNRINmr.exe
  C:\Windows\System\cNRINmr.exe
  2⤵
  PID:9424
- C:\Windows\System\dHmkojz.exe
  C:\Windows\System\dHmkojz.exe
  2⤵
  PID:9448
- C:\Windows\System\ihnSfzj.exe
  C:\Windows\System\ihnSfzj.exe
  2⤵
  PID:9472
- C:\Windows\System\EFxDdsj.exe
  C:\Windows\System\EFxDdsj.exe
  2⤵
  PID:9492
- C:\Windows\System\TlbwqfP.exe
  C:\Windows\System\TlbwqfP.exe
  2⤵
  PID:9512
- C:\Windows\System\abVRubf.exe
  C:\Windows\System\abVRubf.exe
  2⤵
  PID:9532
- C:\Windows\System\njxjmjE.exe
  C:\Windows\System\njxjmjE.exe
  2⤵
  PID:9556
- C:\Windows\System\JKbEHqk.exe
  C:\Windows\System\JKbEHqk.exe
  2⤵
  PID:9576
- C:\Windows\System\PbewRdb.exe
  C:\Windows\System\PbewRdb.exe
  2⤵
  PID:9596
- C:\Windows\System\tjncEaR.exe
  C:\Windows\System\tjncEaR.exe
  2⤵
  PID:9616
- C:\Windows\System\WLJzqjn.exe
  C:\Windows\System\WLJzqjn.exe
  2⤵
  PID:9632
- C:\Windows\System\ilbEMuh.exe
  C:\Windows\System\ilbEMuh.exe
  2⤵
  PID:9660
- C:\Windows\System\uMGdsBr.exe
  C:\Windows\System\uMGdsBr.exe
  2⤵
  PID:9684
- C:\Windows\System\YWZKKvj.exe
  C:\Windows\System\YWZKKvj.exe
  2⤵
  PID:9704
- C:\Windows\System\HWUEbHz.exe
  C:\Windows\System\HWUEbHz.exe
  2⤵
  PID:9724
- C:\Windows\System\YRsMBql.exe
  C:\Windows\System\YRsMBql.exe
  2⤵
  PID:9740
- C:\Windows\System\zInTKIr.exe
  C:\Windows\System\zInTKIr.exe
  2⤵
  PID:9760
- C:\Windows\System\QKYwjip.exe
  C:\Windows\System\QKYwjip.exe
  2⤵
  PID:9784
- C:\Windows\System\CIMvRDn.exe
  C:\Windows\System\CIMvRDn.exe
  2⤵
  PID:9808
- C:\Windows\System\IEFTelI.exe
  C:\Windows\System\IEFTelI.exe
  2⤵
  PID:9828
- C:\Windows\System\CiOSOgo.exe
  C:\Windows\System\CiOSOgo.exe
  2⤵
  PID:9848
- C:\Windows\System\FeLHegn.exe
  C:\Windows\System\FeLHegn.exe
  2⤵
  PID:9872
- C:\Windows\System\pQztead.exe
  C:\Windows\System\pQztead.exe
  2⤵
  PID:9888
- C:\Windows\System\lGScKNU.exe
  C:\Windows\System\lGScKNU.exe
  2⤵
  PID:9912
- C:\Windows\System\WEvrmhN.exe
  C:\Windows\System\WEvrmhN.exe
  2⤵
  PID:9928
- C:\Windows\System\WYhNdYt.exe
  C:\Windows\System\WYhNdYt.exe
  2⤵
  PID:9964
- C:\Windows\System\bPgqxhz.exe
  C:\Windows\System\bPgqxhz.exe
  2⤵
  PID:9988
- C:\Windows\System\ZpMgZIf.exe
  C:\Windows\System\ZpMgZIf.exe
  2⤵
  PID:10008
- C:\Windows\System\GPDESSb.exe
  C:\Windows\System\GPDESSb.exe
  2⤵
  PID:10028
- C:\Windows\System\YSbrvBG.exe
  C:\Windows\System\YSbrvBG.exe
  2⤵
  PID:10048
- C:\Windows\System\nEBwMtI.exe
  C:\Windows\System\nEBwMtI.exe
  2⤵
  PID:10072
- C:\Windows\System\lyfXHKD.exe
  C:\Windows\System\lyfXHKD.exe
  2⤵
  PID:10092
- C:\Windows\System\vNNQuBt.exe
  C:\Windows\System\vNNQuBt.exe
  2⤵
  PID:10112
- C:\Windows\System\EeJcrCk.exe
  C:\Windows\System\EeJcrCk.exe
  2⤵
  PID:10136
- C:\Windows\System\KjyRbal.exe
  C:\Windows\System\KjyRbal.exe
  2⤵
  PID:10156
- C:\Windows\System\UVOkOsq.exe
  C:\Windows\System\UVOkOsq.exe
  2⤵
  PID:10176
- C:\Windows\System\btYhqWG.exe
  C:\Windows\System\btYhqWG.exe
  2⤵
  PID:10204
- C:\Windows\System\iLvifYy.exe
  C:\Windows\System\iLvifYy.exe
  2⤵
  PID:10220
- C:\Windows\System\lrrPrmy.exe
  C:\Windows\System\lrrPrmy.exe
  2⤵
  PID:5516
- C:\Windows\System\QKYRpbt.exe
  C:\Windows\System\QKYRpbt.exe
  2⤵
  PID:7340
- C:\Windows\System\lvJQzAY.exe
  C:\Windows\System\lvJQzAY.exe
  2⤵
  PID:5744
- C:\Windows\System\sVkPvyn.exe
  C:\Windows\System\sVkPvyn.exe
  2⤵
  PID:8208
- C:\Windows\System\JYbeOrH.exe
  C:\Windows\System\JYbeOrH.exe
  2⤵
  PID:8280
- C:\Windows\System\SJfOlnY.exe
  C:\Windows\System\SJfOlnY.exe
  2⤵
  PID:8324
- C:\Windows\System\ORDayCn.exe
  C:\Windows\System\ORDayCn.exe
  2⤵
  PID:5200
- C:\Windows\System\jYYeqyE.exe
  C:\Windows\System\jYYeqyE.exe
  2⤵
  PID:8500
- C:\Windows\System\AyCazpR.exe
  C:\Windows\System\AyCazpR.exe
  2⤵
  PID:6408
- C:\Windows\System\zAtreYy.exe
  C:\Windows\System\zAtreYy.exe
  2⤵
  PID:8604
- C:\Windows\System\dTowwOO.exe
  C:\Windows\System\dTowwOO.exe
  2⤵
  PID:7772
- C:\Windows\System\GyKMomU.exe
  C:\Windows\System\GyKMomU.exe
  2⤵
  PID:8724
- C:\Windows\System\eDsJADU.exe
  C:\Windows\System\eDsJADU.exe
  2⤵
  PID:10256
- C:\Windows\System\VQHlEIL.exe
  C:\Windows\System\VQHlEIL.exe
  2⤵
  PID:10280
- C:\Windows\System\nTYVoXA.exe
  C:\Windows\System\nTYVoXA.exe
  2⤵
  PID:10300
- C:\Windows\System\WTOWdBx.exe
  C:\Windows\System\WTOWdBx.exe
  2⤵
  PID:10324
- C:\Windows\System\rMVPnYs.exe
  C:\Windows\System\rMVPnYs.exe
  2⤵
  PID:10340
- C:\Windows\System\DvkVlLJ.exe
  C:\Windows\System\DvkVlLJ.exe
  2⤵
  PID:10364
- C:\Windows\System\LhQFvgv.exe
  C:\Windows\System\LhQFvgv.exe
  2⤵
  PID:10388
- C:\Windows\System\aAhttZc.exe
  C:\Windows\System\aAhttZc.exe
  2⤵
  PID:10408
- C:\Windows\System\bAtoPdU.exe
  C:\Windows\System\bAtoPdU.exe
  2⤵
  PID:10428
- C:\Windows\System\oRuWFzv.exe
  C:\Windows\System\oRuWFzv.exe
  2⤵
  PID:10456
- C:\Windows\System\rAwNRHM.exe
  C:\Windows\System\rAwNRHM.exe
  2⤵
  PID:10476
- C:\Windows\System\UdefZHq.exe
  C:\Windows\System\UdefZHq.exe
  2⤵
  PID:10496
- C:\Windows\System\bNSJwsw.exe
  C:\Windows\System\bNSJwsw.exe
  2⤵
  PID:10516
- C:\Windows\System\XzZYnpT.exe
  C:\Windows\System\XzZYnpT.exe
  2⤵
  PID:10532
- C:\Windows\System\ThGjCsT.exe
  C:\Windows\System\ThGjCsT.exe
  2⤵
  PID:10552
- C:\Windows\System\hAtBjUO.exe
  C:\Windows\System\hAtBjUO.exe
  2⤵
  PID:10588
- C:\Windows\System\QRvaJBl.exe
  C:\Windows\System\QRvaJBl.exe
  2⤵
  PID:10604
- C:\Windows\System\aTFPten.exe
  C:\Windows\System\aTFPten.exe
  2⤵
  PID:10628
- C:\Windows\System\adWiikz.exe
  C:\Windows\System\adWiikz.exe
  2⤵
  PID:10648
- C:\Windows\System\ODHAkro.exe
  C:\Windows\System\ODHAkro.exe
  2⤵
  PID:10668
- C:\Windows\System\yKoaoaO.exe
  C:\Windows\System\yKoaoaO.exe
  2⤵
  PID:10696
- C:\Windows\System\tbugCIx.exe
  C:\Windows\System\tbugCIx.exe
  2⤵
  PID:10712
- C:\Windows\System\OZyMbgH.exe
  C:\Windows\System\OZyMbgH.exe
  2⤵
  PID:10728
- C:\Windows\System\xLsRVpU.exe
  C:\Windows\System\xLsRVpU.exe
  2⤵
  PID:10744
- C:\Windows\System\aRButWR.exe
  C:\Windows\System\aRButWR.exe
  2⤵
  PID:10772
- C:\Windows\System\nPkfYHb.exe
  C:\Windows\System\nPkfYHb.exe
  2⤵
  PID:10796
- C:\Windows\System\JjUvpPa.exe
  C:\Windows\System\JjUvpPa.exe
  2⤵
  PID:10816
- C:\Windows\System\NjuDWAE.exe
  C:\Windows\System\NjuDWAE.exe
  2⤵
  PID:10836
- C:\Windows\System\foRlaUx.exe
  C:\Windows\System\foRlaUx.exe
  2⤵
  PID:10856
- C:\Windows\System\LOPFgnw.exe
  C:\Windows\System\LOPFgnw.exe
  2⤵
  PID:10876
- C:\Windows\System\juCbtWt.exe
  C:\Windows\System\juCbtWt.exe
  2⤵
  PID:10896
- C:\Windows\System\PsYQwam.exe
  C:\Windows\System\PsYQwam.exe
  2⤵
  PID:10916
- C:\Windows\System\eYplRIe.exe
  C:\Windows\System\eYplRIe.exe
  2⤵
  PID:10948
- C:\Windows\System\CPNroOp.exe
  C:\Windows\System\CPNroOp.exe
  2⤵
  PID:10964
- C:\Windows\System\UsSVmYg.exe
  C:\Windows\System\UsSVmYg.exe
  2⤵
  PID:10980
- C:\Windows\System\Uulxdjb.exe
  C:\Windows\System\Uulxdjb.exe
  2⤵
  PID:11012
- C:\Windows\System\mBkAuKM.exe
  C:\Windows\System\mBkAuKM.exe
  2⤵
  PID:11032
- C:\Windows\System\uXJeYhu.exe
  C:\Windows\System\uXJeYhu.exe
  2⤵
  PID:11048
- C:\Windows\System\kWNdjuN.exe
  C:\Windows\System\kWNdjuN.exe
  2⤵
  PID:11072
- C:\Windows\System\uChKeQE.exe
  C:\Windows\System\uChKeQE.exe
  2⤵
  PID:11088
- C:\Windows\System\TzceNZM.exe
  C:\Windows\System\TzceNZM.exe
  2⤵
  PID:11104
- C:\Windows\System\SIzyZAp.exe
  C:\Windows\System\SIzyZAp.exe
  2⤵
  PID:11124
- C:\Windows\System\KZhbzWG.exe
  C:\Windows\System\KZhbzWG.exe
  2⤵
  PID:11152
- C:\Windows\System\thsnQOY.exe
  C:\Windows\System\thsnQOY.exe
  2⤵
  PID:11172
- C:\Windows\System\kLeBkSf.exe
  C:\Windows\System\kLeBkSf.exe
  2⤵
  PID:11192
- C:\Windows\System\daNFTZm.exe
  C:\Windows\System\daNFTZm.exe
  2⤵
  PID:11212
- C:\Windows\System\Xokaujm.exe
  C:\Windows\System\Xokaujm.exe
  2⤵
  PID:11232
- C:\Windows\System\sPFhpAR.exe
  C:\Windows\System\sPFhpAR.exe
  2⤵
  PID:11260
- C:\Windows\System\RpNviMn.exe
  C:\Windows\System\RpNviMn.exe
  2⤵
  PID:2036
- C:\Windows\System\qbUOfEN.exe
  C:\Windows\System\qbUOfEN.exe
  2⤵
  PID:7984
- C:\Windows\System\nfxFMdv.exe
  C:\Windows\System\nfxFMdv.exe
  2⤵
  PID:8904
- C:\Windows\System\cRiQxIR.exe
  C:\Windows\System\cRiQxIR.exe
  2⤵
  PID:8948
- C:\Windows\System\SwLNAsR.exe
  C:\Windows\System\SwLNAsR.exe
  2⤵
  PID:8988
- C:\Windows\System\MseSCrr.exe
  C:\Windows\System\MseSCrr.exe
  2⤵
  PID:4504
- C:\Windows\System\xKLVVZE.exe
  C:\Windows\System\xKLVVZE.exe
  2⤵
  PID:1220
- C:\Windows\System\YikOOoD.exe
  C:\Windows\System\YikOOoD.exe
  2⤵
  PID:9124
- C:\Windows\System\DJNwxzD.exe
  C:\Windows\System\DJNwxzD.exe
  2⤵
  PID:9164
- C:\Windows\System\EREAgbY.exe
  C:\Windows\System\EREAgbY.exe
  2⤵
  PID:9208
- C:\Windows\System\sfvQjRM.exe
  C:\Windows\System\sfvQjRM.exe
  2⤵
  PID:7212
- C:\Windows\System\rnDjqdt.exe
  C:\Windows\System\rnDjqdt.exe
  2⤵
  PID:5980
- C:\Windows\System\jteYTEy.exe
  C:\Windows\System\jteYTEy.exe
  2⤵
  PID:1384
- C:\Windows\System\toJIFJL.exe
  C:\Windows\System\toJIFJL.exe
  2⤵
  PID:8128
- C:\Windows\System\oQXTKdp.exe
  C:\Windows\System\oQXTKdp.exe
  2⤵
  PID:7240
- C:\Windows\System\YjIkkfH.exe
  C:\Windows\System\YjIkkfH.exe
  2⤵
  PID:7404
- C:\Windows\System\GJQqyeo.exe
  C:\Windows\System\GJQqyeo.exe
  2⤵
  PID:9368
- C:\Windows\System\AbievPf.exe
  C:\Windows\System\AbievPf.exe
  2⤵
  PID:9504
- C:\Windows\System\CTQtyvc.exe
  C:\Windows\System\CTQtyvc.exe
  2⤵
  PID:9568
- C:\Windows\System\kOsjmET.exe
  C:\Windows\System\kOsjmET.exe
  2⤵
  PID:11284
- C:\Windows\System\qPeFyYp.exe
  C:\Windows\System\qPeFyYp.exe
  2⤵
  PID:11312
- C:\Windows\System\xiyYUhE.exe
  C:\Windows\System\xiyYUhE.exe
  2⤵
  PID:11512
- C:\Windows\System\pPBQdbm.exe
  C:\Windows\System\pPBQdbm.exe
  2⤵
  PID:11528
- C:\Windows\System\SrwYwQP.exe
  C:\Windows\System\SrwYwQP.exe
  2⤵
  PID:11552
- C:\Windows\System\aIGrXaE.exe
  C:\Windows\System\aIGrXaE.exe
  2⤵
  PID:11572
- C:\Windows\System\iaWfoOC.exe
  C:\Windows\System\iaWfoOC.exe
  2⤵
  PID:11588
- C:\Windows\System\OhHYrkV.exe
  C:\Windows\System\OhHYrkV.exe
  2⤵
  PID:11604
- C:\Windows\System\Bsmoyaw.exe
  C:\Windows\System\Bsmoyaw.exe
  2⤵
  PID:11620
- C:\Windows\System\cldzQTF.exe
  C:\Windows\System\cldzQTF.exe
  2⤵
  PID:11640
- C:\Windows\System\SWomrsp.exe
  C:\Windows\System\SWomrsp.exe
  2⤵
  PID:11656
- C:\Windows\System\BzpNMum.exe
  C:\Windows\System\BzpNMum.exe
  2⤵
  PID:11680
- C:\Windows\System\ApBLsGV.exe
  C:\Windows\System\ApBLsGV.exe
  2⤵
  PID:11700
- C:\Windows\System\thyWPNc.exe
  C:\Windows\System\thyWPNc.exe
  2⤵
  PID:11728
- C:\Windows\System\vShJLGN.exe
  C:\Windows\System\vShJLGN.exe
  2⤵
  PID:11748
- C:\Windows\System\yVSARqp.exe
  C:\Windows\System\yVSARqp.exe
  2⤵
  PID:11764
- C:\Windows\System\hrrqgus.exe
  C:\Windows\System\hrrqgus.exe
  2⤵
  PID:11788
- C:\Windows\System\tpcLbAq.exe
  C:\Windows\System\tpcLbAq.exe
  2⤵
  PID:11808
- C:\Windows\System\SDXjpWX.exe
  C:\Windows\System\SDXjpWX.exe
  2⤵
  PID:11828
- C:\Windows\System\loijGGX.exe
  C:\Windows\System\loijGGX.exe
  2⤵
  PID:11852
- C:\Windows\System\WHzGSKk.exe
  C:\Windows\System\WHzGSKk.exe
  2⤵
  PID:11868
- C:\Windows\System\XGxEnCK.exe
  C:\Windows\System\XGxEnCK.exe
  2⤵
  PID:11888
- C:\Windows\System\jBEFBfp.exe
  C:\Windows\System\jBEFBfp.exe
  2⤵
  PID:11908
- C:\Windows\System\uhxhhzN.exe
  C:\Windows\System\uhxhhzN.exe
  2⤵
  PID:11928
- C:\Windows\System\pavmbBZ.exe
  C:\Windows\System\pavmbBZ.exe
  2⤵
  PID:11948
- C:\Windows\System\ijbcexV.exe
  C:\Windows\System\ijbcexV.exe
  2⤵
  PID:11972
- C:\Windows\System\sezBwpM.exe
  C:\Windows\System\sezBwpM.exe
  2⤵
  PID:11996
- C:\Windows\System\XOqNukJ.exe
  C:\Windows\System\XOqNukJ.exe
  2⤵
  PID:12012
- C:\Windows\System\QdqcRDT.exe
  C:\Windows\System\QdqcRDT.exe
  2⤵
  PID:12032
- C:\Windows\System\jsULEqa.exe
  C:\Windows\System\jsULEqa.exe
  2⤵
  PID:12052
- C:\Windows\System\BYNNLfs.exe
  C:\Windows\System\BYNNLfs.exe
  2⤵
  PID:12076
- C:\Windows\System\AFGbamo.exe
  C:\Windows\System\AFGbamo.exe
  2⤵
  PID:12104
- C:\Windows\System\oDPxpdT.exe
  C:\Windows\System\oDPxpdT.exe
  2⤵
  PID:12120
- C:\Windows\System\LKRqcRq.exe
  C:\Windows\System\LKRqcRq.exe
  2⤵
  PID:12144
- C:\Windows\System\sPPvliu.exe
  C:\Windows\System\sPPvliu.exe
  2⤵
  PID:12164
- C:\Windows\System\WMQRqab.exe
  C:\Windows\System\WMQRqab.exe
  2⤵
  PID:12184
- C:\Windows\System\uLfrDhn.exe
  C:\Windows\System\uLfrDhn.exe
  2⤵
  PID:12204
- C:\Windows\System\VfTZhru.exe
  C:\Windows\System\VfTZhru.exe
  2⤵
  PID:12224
- C:\Windows\System\anjOqbK.exe
  C:\Windows\System\anjOqbK.exe
  2⤵
  PID:12248
- C:\Windows\System\TGuCsvm.exe
  C:\Windows\System\TGuCsvm.exe
  2⤵
  PID:12272
- C:\Windows\System\PttpTaG.exe
  C:\Windows\System\PttpTaG.exe
  2⤵
  PID:8320
- C:\Windows\System\QzcwRXL.exe
  C:\Windows\System\QzcwRXL.exe
  2⤵
  PID:7676
- C:\Windows\System\ywhnHgq.exe
  C:\Windows\System\ywhnHgq.exe
  2⤵
  PID:9820
- C:\Windows\System\YXaTzcm.exe
  C:\Windows\System\YXaTzcm.exe
  2⤵
  PID:8536
- C:\Windows\System\ZGfueqH.exe
  C:\Windows\System\ZGfueqH.exe
  2⤵
  PID:10040
- C:\Windows\System\GSndWqP.exe
  C:\Windows\System\GSndWqP.exe
  2⤵
  PID:10080
- C:\Windows\System\LHTByur.exe
  C:\Windows\System\LHTByur.exe
  2⤵
  PID:10104
- C:\Windows\System\UHZWKeg.exe
  C:\Windows\System\UHZWKeg.exe
  2⤵
  PID:7840
- C:\Windows\System\KRZVUvG.exe
  C:\Windows\System\KRZVUvG.exe
  2⤵
  PID:8672
- C:\Windows\System\XWbZiqq.exe
  C:\Windows\System\XWbZiqq.exe
  2⤵
  PID:6468
- C:\Windows\System\auXEvUd.exe
  C:\Windows\System\auXEvUd.exe
  2⤵
  PID:8744
- C:\Windows\System\YFeNhJX.exe
  C:\Windows\System\YFeNhJX.exe
  2⤵
  PID:10292
- C:\Windows\System\bPrWBjA.exe
  C:\Windows\System\bPrWBjA.exe
  2⤵
  PID:10348
- C:\Windows\System\LCtnEcD.exe
  C:\Windows\System\LCtnEcD.exe
  2⤵
  PID:8828
- C:\Windows\System\ejBVkfO.exe
  C:\Windows\System\ejBVkfO.exe
  2⤵
  PID:10544
- C:\Windows\System\QwhmTdC.exe
  C:\Windows\System\QwhmTdC.exe
  2⤵
  PID:2944
- C:\Windows\System\PSnfQXZ.exe
  C:\Windows\System\PSnfQXZ.exe
  2⤵
  PID:9188
- C:\Windows\System\uoSRPju.exe
  C:\Windows\System\uoSRPju.exe
  2⤵
  PID:10760
- C:\Windows\System\VwHRYIB.exe
  C:\Windows\System\VwHRYIB.exe
  2⤵
  PID:10844
- C:\Windows\System\SeHcBaD.exe
  C:\Windows\System\SeHcBaD.exe
  2⤵
  PID:7592
- C:\Windows\System\sALERhn.exe
  C:\Windows\System\sALERhn.exe
  2⤵
  PID:6160
- C:\Windows\System\pGfWXPo.exe
  C:\Windows\System\pGfWXPo.exe
  2⤵
  PID:10976
- C:\Windows\System\igElsNO.exe
  C:\Windows\System\igElsNO.exe
  2⤵
  PID:5976
- C:\Windows\System\yNrKfDE.exe
  C:\Windows\System\yNrKfDE.exe
  2⤵
  PID:11132
- C:\Windows\System\dRzjKNY.exe
  C:\Windows\System\dRzjKNY.exe
  2⤵
  PID:11200
- C:\Windows\System\AjLmrOs.exe
  C:\Windows\System\AjLmrOs.exe
  2⤵
  PID:12304
- C:\Windows\System\MzbIecX.exe
  C:\Windows\System\MzbIecX.exe
  2⤵
  PID:12328
- C:\Windows\System\vGORIsP.exe
  C:\Windows\System\vGORIsP.exe
  2⤵
  PID:12348
- C:\Windows\System\zipwrrv.exe
  C:\Windows\System\zipwrrv.exe
  2⤵
  PID:12368
- C:\Windows\System\zUfLrAQ.exe
  C:\Windows\System\zUfLrAQ.exe
  2⤵
  PID:12388
- C:\Windows\System\EHOewBJ.exe
  C:\Windows\System\EHOewBJ.exe
  2⤵
  PID:12404
- C:\Windows\System\euRvoBU.exe
  C:\Windows\System\euRvoBU.exe
  2⤵
  PID:12424
- C:\Windows\System\uMarJsN.exe
  C:\Windows\System\uMarJsN.exe
  2⤵
  PID:12444
- C:\Windows\System\oWWbWRl.exe
  C:\Windows\System\oWWbWRl.exe
  2⤵
  PID:12468
- C:\Windows\System\WJGgjUL.exe
  C:\Windows\System\WJGgjUL.exe
  2⤵
  PID:12488
- C:\Windows\System\rZEckev.exe
  C:\Windows\System\rZEckev.exe
  2⤵
  PID:12512
- C:\Windows\System\gkxImhZ.exe
  C:\Windows\System\gkxImhZ.exe
  2⤵
  PID:12532
- C:\Windows\System\mgfbQGf.exe
  C:\Windows\System\mgfbQGf.exe
  2⤵
  PID:12548
- C:\Windows\System\xCeqDOj.exe
  C:\Windows\System\xCeqDOj.exe
  2⤵
  PID:12564
- C:\Windows\System\kHuTVVe.exe
  C:\Windows\System\kHuTVVe.exe
  2⤵
  PID:12584
- C:\Windows\System\ZpyeWRT.exe
  C:\Windows\System\ZpyeWRT.exe
  2⤵
  PID:12600
- C:\Windows\System\UWIqgBd.exe
  C:\Windows\System\UWIqgBd.exe
  2⤵
  PID:12620
- C:\Windows\System\hyzrMiR.exe
  C:\Windows\System\hyzrMiR.exe
  2⤵
  PID:12644
- C:\Windows\System\oZwHDYB.exe
  C:\Windows\System\oZwHDYB.exe
  2⤵
  PID:12660
- C:\Windows\System\VhFUbfh.exe
  C:\Windows\System\VhFUbfh.exe
  2⤵
  PID:12684
- C:\Windows\System\NGEPNEp.exe
  C:\Windows\System\NGEPNEp.exe
  2⤵
  PID:12724
- C:\Windows\System\lKdDyUo.exe
  C:\Windows\System\lKdDyUo.exe
  2⤵
  PID:12744
- C:\Windows\System\nmjIOVV.exe
  C:\Windows\System\nmjIOVV.exe
  2⤵
  PID:11420
- C:\Windows\System\VkPoGhx.exe
  C:\Windows\System\VkPoGhx.exe
  2⤵
  PID:8648
- C:\Windows\System\gbUgDfW.exe
  C:\Windows\System\gbUgDfW.exe
  2⤵
  PID:9040
- C:\Windows\System\xUsWNyo.exe
  C:\Windows\System\xUsWNyo.exe
  2⤵
  PID:12700
- C:\Windows\System\SqWnlNg.exe
  C:\Windows\System\SqWnlNg.exe
  2⤵
  PID:9612
- C:\Windows\System\sdUxUii.exe
  C:\Windows\System\sdUxUii.exe
  2⤵
  PID:11824
- C:\Windows\System\tviJbHC.exe
  C:\Windows\System\tviJbHC.exe
  2⤵
  PID:10400
- C:\Windows\System\BawPwGH.exe
  C:\Windows\System\BawPwGH.exe
  2⤵
  PID:8596
- C:\Windows\System\HMFHIJv.exe
  C:\Windows\System\HMFHIJv.exe
  2⤵
  PID:10060
- C:\Windows\System\WNhKrNo.exe
  C:\Windows\System\WNhKrNo.exe
  2⤵
  PID:7656
- C:\Windows\System\nvHSLla.exe
  C:\Windows\System\nvHSLla.exe
  2⤵
  PID:12212
- C:\Windows\System\PNTtcVc.exe
  C:\Windows\System\PNTtcVc.exe
  2⤵
  PID:6876
- C:\Windows\System\qnQTIhm.exe
  C:\Windows\System\qnQTIhm.exe
  2⤵
  PID:11120
- C:\Windows\System\SNljRSv.exe
  C:\Windows\System\SNljRSv.exe
  2⤵
  PID:12340
- C:\Windows\System\EswwKzb.exe
  C:\Windows\System\EswwKzb.exe
  2⤵
  PID:12616
- C:\Windows\System\hwVJLWr.exe
  C:\Windows\System\hwVJLWr.exe
  2⤵
  PID:12740
- C:\Windows\System\yKKSnCQ.exe
  C:\Windows\System\yKKSnCQ.exe
  2⤵
  PID:12944
- C:\Windows\System\CSUZSVR.exe
  C:\Windows\System\CSUZSVR.exe
  2⤵
  PID:13124
- C:\Windows\System\SUUliUy.exe
  C:\Windows\System\SUUliUy.exe
  2⤵
  PID:9236
- C:\Windows\System\YZeLUDC.exe
  C:\Windows\System\YZeLUDC.exe
  2⤵
  PID:9304
- C:\Windows\System\IapILFy.exe
  C:\Windows\System\IapILFy.exe
  2⤵
  PID:9696
- C:\Windows\System\SYOYwTg.exe
  C:\Windows\System\SYOYwTg.exe
  2⤵
  PID:10164
- C:\Windows\System\rxxWjIl.exe
  C:\Windows\System\rxxWjIl.exe
  2⤵
  PID:7424
- C:\Windows\System\WHQDIIb.exe
  C:\Windows\System\WHQDIIb.exe
  2⤵
  PID:9320
- C:\Windows\System\MOSbCGQ.exe
  C:\Windows\System\MOSbCGQ.exe
  2⤵
  PID:8448
- C:\Windows\System\CKvTUgd.exe
  C:\Windows\System\CKvTUgd.exe
  2⤵
  PID:8564
- C:\Windows\System\PoTNuPu.exe
  C:\Windows\System\PoTNuPu.exe
  2⤵
  PID:10248
- C:\Windows\System\oWCOEiu.exe
  C:\Windows\System\oWCOEiu.exe
  2⤵
  PID:10484
- C:\Windows\System\FjVPYQL.exe
  C:\Windows\System\FjVPYQL.exe
  2⤵
  PID:8348
- C:\Windows\System\pQjSSFG.exe
  C:\Windows\System\pQjSSFG.exe
  2⤵
  PID:8304
- C:\Windows\System\KmtEwYs.exe
  C:\Windows\System\KmtEwYs.exe
  2⤵
  PID:9508
- C:\Windows\System\GxZgwfh.exe
  C:\Windows\System\GxZgwfh.exe
  2⤵
  PID:9652
- C:\Windows\System\HKKCOWU.exe
  C:\Windows\System\HKKCOWU.exe
  2⤵
  PID:12840
- C:\Windows\System\GFBeYQb.exe
  C:\Windows\System\GFBeYQb.exe
  2⤵
  PID:12820
- C:\Windows\System\SdRQbeB.exe
  C:\Windows\System\SdRQbeB.exe
  2⤵
  PID:10132
- C:\Windows\System\KFVcnso.exe
  C:\Windows\System\KFVcnso.exe
  2⤵
  PID:12752
- C:\Windows\System\RVdTnrk.exe
  C:\Windows\System\RVdTnrk.exe
  2⤵
  PID:10416
- C:\Windows\System\sdSyOpR.exe
  C:\Windows\System\sdSyOpR.exe
  2⤵
  PID:8844
- C:\Windows\System\HoOLGcw.exe
  C:\Windows\System\HoOLGcw.exe
  2⤵
  PID:11504
- C:\Windows\System\bAXNnDh.exe
  C:\Windows\System\bAXNnDh.exe
  2⤵
  PID:8944
- C:\Windows\System\aLjauyW.exe
  C:\Windows\System\aLjauyW.exe
  2⤵
  PID:6796
- C:\Windows\System\CCumeTZ.exe
  C:\Windows\System\CCumeTZ.exe
  2⤵
  PID:5812
- C:\Windows\System\AQJbdTo.exe
  C:\Windows\System\AQJbdTo.exe
  2⤵
  PID:1928
- C:\Windows\System\wxRFEHl.exe
  C:\Windows\System\wxRFEHl.exe
  2⤵
  PID:7964
- C:\Windows\System\yZeKXis.exe
  C:\Windows\System\yZeKXis.exe
  2⤵
  PID:4252
- C:\Windows\System\OekuSNG.exe
  C:\Windows\System\OekuSNG.exe
  2⤵
  PID:9280
- C:\Windows\System\DxIsRxp.exe
  C:\Windows\System\DxIsRxp.exe
  2⤵
  PID:12440
- C:\Windows\System\cFrmAOJ.exe
  C:\Windows\System\cFrmAOJ.exe
  2⤵
  PID:12336
- C:\Windows\System\YoCLCOI.exe
  C:\Windows\System\YoCLCOI.exe
  2⤵
  PID:6212
- C:\Windows\System\vKVsanA.exe
  C:\Windows\System\vKVsanA.exe
  2⤵
  PID:11940
- C:\Windows\System\hGDzqFg.exe
  C:\Windows\System\hGDzqFg.exe
  2⤵
  PID:10720
- C:\Windows\System\RETkTlO.exe
  C:\Windows\System\RETkTlO.exe
  2⤵
  PID:5844
- C:\Windows\System\hMTCLJQ.exe
  C:\Windows\System\hMTCLJQ.exe
  2⤵
  PID:7684
- C:\Windows\System\vLuYVBM.exe
  C:\Windows\System\vLuYVBM.exe
  2⤵
  PID:11760
- C:\Windows\System\CJRmccv.exe
  C:\Windows\System\CJRmccv.exe
  2⤵
  PID:10508
- C:\Windows\System\YgtUsjl.exe
  C:\Windows\System\YgtUsjl.exe
  2⤵
  PID:10600
- C:\Windows\System\gWWDCoH.exe
  C:\Windows\System\gWWDCoH.exe
  2⤵
  PID:11536
- C:\Windows\System\ebSYsVw.exe
  C:\Windows\System\ebSYsVw.exe
  2⤵
  PID:408
- C:\Windows\System\nEGvUgA.exe
  C:\Windows\System\nEGvUgA.exe
  2⤵
  PID:13024
- C:\Windows\System\tokOxOS.exe
  C:\Windows\System\tokOxOS.exe
  2⤵
  PID:10692
- C:\Windows\System\jkYELht.exe
  C:\Windows\System\jkYELht.exe
  2⤵
  PID:3656
- C:\Windows\System\pJVsEJV.exe
  C:\Windows\System\pJVsEJV.exe
  2⤵
  PID:9896
- C:\Windows\System\boIiSLw.exe
  C:\Windows\System\boIiSLw.exe
  2⤵
  PID:8416
- C:\Windows\System\HPiJjaJ.exe
  C:\Windows\System\HPiJjaJ.exe
  2⤵
  PID:10236
- C:\Windows\System\KFoCyKp.exe
  C:\Windows\System\KFoCyKp.exe
  2⤵
  PID:10704
- C:\Windows\System\CnuOVWG.exe
  C:\Windows\System\CnuOVWG.exe
  2⤵
  PID:8412
- C:\Windows\System\awFPGwM.exe
  C:\Windows\System\awFPGwM.exe
  2⤵
  PID:13136
- C:\Windows\System\yOPOhKr.exe
  C:\Windows\System\yOPOhKr.exe
  2⤵
  PID:8804
- C:\Windows\System\zlvmgrf.exe
  C:\Windows\System\zlvmgrf.exe
  2⤵
  PID:10736
- C:\Windows\System\iSATVjo.exe
  C:\Windows\System\iSATVjo.exe
  2⤵
  PID:13296
- C:\Windows\System\dHAbBBe.exe
  C:\Windows\System\dHAbBBe.exe
  2⤵
  PID:2692
- C:\Windows\System\lXYgwZf.exe
  C:\Windows\System\lXYgwZf.exe
  2⤵
  PID:11612
- C:\Windows\System\JCgETlf.exe
  C:\Windows\System\JCgETlf.exe
  2⤵
  PID:8084
- C:\Windows\System\pYLYtta.exe
  C:\Windows\System\pYLYtta.exe
  2⤵
  PID:10424
- C:\Windows\System\zWOErri.exe
  C:\Windows\System\zWOErri.exe
  2⤵
  PID:7916
- C:\Windows\System\jOvAaxY.exe
  C:\Windows\System\jOvAaxY.exe
  2⤵
  PID:9396
- C:\Windows\System\tWwgLfP.exe
  C:\Windows\System\tWwgLfP.exe
  2⤵
  PID:12152
- C:\Windows\System\mOAIbCY.exe
  C:\Windows\System\mOAIbCY.exe
  2⤵
  PID:9120
- C:\Windows\System\TsLoHIG.exe
  C:\Windows\System\TsLoHIG.exe
  2⤵
  PID:9252
- C:\Windows\System\CAQCWQc.exe
  C:\Windows\System\CAQCWQc.exe
  2⤵
  PID:9500
- C:\Windows\System\QhzpiWb.exe
  C:\Windows\System\QhzpiWb.exe
  2⤵
  PID:9020
- C:\Windows\System\PKIrVnN.exe
  C:\Windows\System\PKIrVnN.exe
  2⤵
  PID:10972
- C:\Windows\System\OBjwCrs.exe
  C:\Windows\System\OBjwCrs.exe
  2⤵
  PID:12464
- C:\Windows\System\RrVEJrL.exe
  C:\Windows\System\RrVEJrL.exe
  2⤵
  PID:9856
- C:\Windows\System\cnfqIYq.exe
  C:\Windows\System\cnfqIYq.exe
  2⤵
  PID:7596
- C:\Windows\System\dRJjcdY.exe
  C:\Windows\System\dRJjcdY.exe
  2⤵
  PID:12256
- C:\Windows\System\apYhOVG.exe
  C:\Windows\System\apYhOVG.exe
  2⤵
  PID:13280
- C:\Windows\System\iELWvrl.exe
  C:\Windows\System\iELWvrl.exe
  2⤵
  PID:10152
- C:\Windows\System\wtsohNc.exe
  C:\Windows\System\wtsohNc.exe
  2⤵
  PID:6004
- C:\Windows\System\rUYRzif.exe
  C:\Windows\System\rUYRzif.exe
  2⤵
  PID:7540
- C:\Windows\System\JjLRsNg.exe
  C:\Windows\System\JjLRsNg.exe
  2⤵
  PID:8232
- C:\Windows\System\svWlVrU.exe
  C:\Windows\System\svWlVrU.exe
  2⤵
  PID:12804
- C:\Windows\System\CFUulDm.exe
  C:\Windows\System\CFUulDm.exe
  2⤵
  PID:8172
- C:\Windows\System\PdFWzpw.exe
  C:\Windows\System\PdFWzpw.exe
  2⤵
  PID:13508
- C:\Windows\System\yecdVfg.exe
  C:\Windows\System\yecdVfg.exe
  2⤵
  PID:13572
- C:\Windows\System\NKgVboP.exe
  C:\Windows\System\NKgVboP.exe
  2⤵
  PID:13592
- C:\Windows\System\NVjbUNM.exe
  C:\Windows\System\NVjbUNM.exe
  2⤵
  PID:13608
- C:\Windows\System\pwhGCde.exe
  C:\Windows\System\pwhGCde.exe
  2⤵
  PID:13776
- C:\Windows\System\SOMJDBc.exe
  C:\Windows\System\SOMJDBc.exe
  2⤵
  PID:13800
- C:\Windows\System\SYOVfuq.exe
  C:\Windows\System\SYOVfuq.exe
  2⤵
  PID:13820
- C:\Windows\System\UJOifAj.exe
  C:\Windows\System\UJOifAj.exe
  2⤵
  PID:13836
- C:\Windows\System\EcGmiTJ.exe
  C:\Windows\System\EcGmiTJ.exe
  2⤵
  PID:13868
- C:\Windows\System\PWcGKAz.exe
  C:\Windows\System\PWcGKAz.exe
  2⤵
  PID:13884
- C:\Windows\System\vzrUHyf.exe
  C:\Windows\System\vzrUHyf.exe
  2⤵
  PID:13988
- C:\Windows\System\tkJIzrX.exe
  C:\Windows\System\tkJIzrX.exe
  2⤵
  PID:14012
- C:\Windows\System\BTFxaLJ.exe
  C:\Windows\System\BTFxaLJ.exe
  2⤵
  PID:14036
- C:\Windows\System\gGAhlFd.exe
  C:\Windows\System\gGAhlFd.exe
  2⤵
  PID:14056
- C:\Windows\System\XKYsPlx.exe
  C:\Windows\System\XKYsPlx.exe
  2⤵
  PID:14176
- C:\Windows\System\InUvSQe.exe
  C:\Windows\System\InUvSQe.exe
  2⤵
  PID:14196
- C:\Windows\System\hhNZwnD.exe
  C:\Windows\System\hhNZwnD.exe
  2⤵
  PID:14212
- C:\Windows\System\HsCEnSs.exe
  C:\Windows\System\HsCEnSs.exe
  2⤵
  PID:14240
- C:\Windows\System\iDxSSle.exe
  C:\Windows\System\iDxSSle.exe
  2⤵
  PID:14256
- C:\Windows\System\fHAImrY.exe
  C:\Windows\System\fHAImrY.exe
  2⤵
  PID:14276
- C:\Windows\System\FzMhFyv.exe
  C:\Windows\System\FzMhFyv.exe
  2⤵
  PID:14300
- C:\Windows\System\ByiUHrT.exe
  C:\Windows\System\ByiUHrT.exe
  2⤵
  PID:11756
- C:\Windows\System\aNxBSwf.exe
  C:\Windows\System\aNxBSwf.exe
  2⤵
  PID:12180
- C:\Windows\System\mRYlfjk.exe
  C:\Windows\System\mRYlfjk.exe
  2⤵
  PID:13308
- C:\Windows\System\xzpYpbi.exe
  C:\Windows\System\xzpYpbi.exe
  2⤵
  PID:10780
- C:\Windows\System\RdeceQT.exe
  C:\Windows\System\RdeceQT.exe
  2⤵
  PID:7264
- C:\Windows\System\tRaLtdo.exe
  C:\Windows\System\tRaLtdo.exe
  2⤵
  PID:11364
- C:\Windows\System\CRmfZKh.exe
  C:\Windows\System\CRmfZKh.exe
  2⤵
  PID:8180
- C:\Windows\System\axeZmTY.exe
  C:\Windows\System\axeZmTY.exe
  2⤵
  PID:13328
- C:\Windows\System\kkYVpPf.exe
  C:\Windows\System\kkYVpPf.exe
  2⤵
  PID:13352
- C:\Windows\System\BMYVaPM.exe
  C:\Windows\System\BMYVaPM.exe
  2⤵
  PID:13376
- C:\Windows\System\GmXhNJd.exe
  C:\Windows\System\GmXhNJd.exe
  2⤵
  PID:13404
- C:\Windows\System\pdtwsez.exe
  C:\Windows\System\pdtwsez.exe
  2⤵
  PID:13424
- C:\Windows\System\lbOPwXs.exe
  C:\Windows\System\lbOPwXs.exe
  2⤵
  PID:10036
- C:\Windows\System\nbrkNtn.exe
  C:\Windows\System\nbrkNtn.exe
  2⤵
  PID:9540
- C:\Windows\System\NmAAHRH.exe
  C:\Windows\System\NmAAHRH.exe
  2⤵
  PID:13452
- C:\Windows\System\luauSfq.exe
  C:\Windows\System\luauSfq.exe
  2⤵
  PID:13684
- C:\Windows\System\LwqbBJy.exe
  C:\Windows\System\LwqbBJy.exe
  2⤵
  PID:13736
- C:\Windows\System\YUPEsoI.exe
  C:\Windows\System\YUPEsoI.exe
  2⤵
  PID:13784
- C:\Windows\System\YNgAaKX.exe
  C:\Windows\System\YNgAaKX.exe
  2⤵
  PID:13808
- C:\Windows\System\KjXSNeM.exe
  C:\Windows\System\KjXSNeM.exe
  2⤵
  PID:13724
- C:\Windows\System\PKzPMDk.exe
  C:\Windows\System\PKzPMDk.exe
  2⤵
  PID:13760
- C:\Windows\System\QbCQrGs.exe
  C:\Windows\System\QbCQrGs.exe
  2⤵
  PID:13908
- C:\Windows\System\eazVtCw.exe
  C:\Windows\System\eazVtCw.exe
  2⤵
  PID:13848
- C:\Windows\System\siTQGuZ.exe
  C:\Windows\System\siTQGuZ.exe
  2⤵
  PID:13956
- C:\Windows\System\KyMKwKp.exe
  C:\Windows\System\KyMKwKp.exe
  2⤵
  PID:13984
- C:\Windows\System\SiEZpIK.exe
  C:\Windows\System\SiEZpIK.exe
  2⤵
  PID:14048
- C:\Windows\System\dIZTcTY.exe
  C:\Windows\System\dIZTcTY.exe
  2⤵
  PID:14108

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:13712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dds5av11.031.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DSzGyHL.exe

Filesize
1.6MB

MD5
cbbd5206305cdf0125f5724e3058a757

SHA1
85f8844ef116bfac6868f2083b4c3d28e2e49d26

SHA256
420d09a0194e7e24b32a101f931bff822feae78f7bd955af14fa80887ec23a90

SHA512
d2fb13dfbbf5a71b3cf0651a70e7e9b9d0c058b8588c48fb91ba1eb6e1fcb8d9d384a8ef38355f2ac3ed03c7a0d34210ec042278e42f47483a1d22ee66bb2ece

Download Submit
C:\Windows\System\EWdOsyu.exe

Filesize
1.6MB

MD5
bbc8cfc44149db26495796f173009858

SHA1
611fe1ab5c00327ced239641e6b1cdd6eea16093

SHA256
9a07b9776912273f7694c31b250c9859add89d1cbffec9e3f50b2b0f4527735e

SHA512
85840c424885630b1fd8074b44a3076be462f599ba5e5d456b15d390251b9df6591ac6662a0498d2a09a79461fca013919bca79f9273de882ae78deda36d96e5

Download Submit
C:\Windows\System\FfqpTNR.exe

Filesize
1.6MB

MD5
e15c6f3a32cb4c922d78265bed945cf4

SHA1
82b8dbea956d48c485f271db076c9cbc12a512cc

SHA256
170fbd5938e56e5ca8e3d53538463d0388ec4f0e9676d3143f31bbc40716f395

SHA512
356ade859e8617ead7ea949f661029d85ed28be117562e16b34344a0e336f2394593b78c47dab7df505fb6f1e5d98ca62afd3e8e0a547473e88ce9c3c680a531

Download Submit
C:\Windows\System\GJDNQmI.exe

Filesize
1.6MB

MD5
79eb9775e0ea6d35e3b9245126197193

SHA1
83a8d48922227f046d23223bcca33507896b6922

SHA256
6d03ce1443f844f065182c3a549a0868537b38ba9e45ed3966f9483639f2677f

SHA512
a12ccfb0ef169af1e4b60d16a01c2a835a6c70182e24039a900f7b85289feab62bb0285a69c6dbb49ff94a019094d761a85b430f385fad0ff255aa7e47478f7e

Download Submit
C:\Windows\System\GwdYdip.exe

Filesize
1.6MB

MD5
bec1fb9835419e3d88ad1d76b5f4066b

SHA1
1f39f4894f910d7d729df83f9d1e0fe60c93293d

SHA256
000989587c9774bc4e3bb0834ea4c73e4de577fd11a9df11e3550675b42bf7cf

SHA512
991ec990bf2b057e20db5ad409e76e4e279534eea7afc11f4a2c89f58d4249a23d6fb8e8b4846fa069ef357df8d2b45c594d1f9655fdc1742bd70dde1fa9a742

Download Submit
C:\Windows\System\IQKEwuB.exe

Filesize
1.6MB

MD5
aa4b9ade8965d85feb21a83b46cc76f6

SHA1
18ebd683332f099ad7930c5ad590521a0e858efb

SHA256
d39586899f79117ccc6935f6262d30268b4bb73ca1121b228a2816f9d0034de9

SHA512
a3da4009444a0040ccec8537706b3975ee5b94f4fd692535f8fcf6830d4f9b4450cecf50959cd2dbe1901d9b44cdcf89e93d47011d518365217575da71679599

Download Submit
C:\Windows\System\KUnsJYI.exe

Filesize
1.6MB

MD5
271cf101dedbc0b42f1cc2cd035c2753

SHA1
41769c1fe75380fd1c4c0d8b373adfd5b68ee37f

SHA256
271f9a504a3babe028eede41d7b42cbcf43b06b3464f0a9e4c1d833533b4af3c

SHA512
e3740a155a3b3bc8aec6bf08947dd7d38caf34782c8d2bf631534d1a3efca12f98e7aaf0b7c7d2bfef9325d4f2dfa9728060d495cf817e5714db22d4142c08a6

Download Submit
C:\Windows\System\MqmYlFD.exe

Filesize
1.6MB

MD5
1055a22cff4a38e46ec277b1c9dea8b7

SHA1
171e20e9b4ce57347a2772fb778d7d882812fd54

SHA256
ebbfecd38f3932a1e13323d1971ec9c2d5ea17c5e6ff00ef004b0d9b4e219e42

SHA512
7656f3b16e7760f2606d57a8f26570d9fe824e8fbd0ecf791104ca98958e0493eea8980bef038d7e75030128f773f86b652e9d3c34e15c5fc1450cdf088923ab

Download Submit
C:\Windows\System\NmiSTcg.exe

Filesize
1.6MB

MD5
525f58d386e79a10f02885aa398b8aa8

SHA1
39c6ee94f9eff897dffce3ff8641fde80cced1b9

SHA256
d3e7522baed68d2af80ca8085a19822ca282284b5456a49141e944fdc97ef982

SHA512
92942808c21dc963dae416c1b1a6923797b8519d5c1717bbafbfa92cfacf3c2380b9ebca6cb0ed68c55ff2063bc25df7975a7bdd09b9db6c03bdf46814d72050

Download Submit
C:\Windows\System\PCBaLHD.exe

Filesize
8B

MD5
b51f4f6ea566c7181d4d1f715615a414

SHA1
5f5d2057c3e793a449fbedd304d5084c92db621c

SHA256
efa8a7a6952ccabd712273da0ab5538682fcdaff585ff7604e7a4346286e9320

SHA512
cf70e5addae3f1995c350d8ead332088224d80c10cffe6e3f241ed79cc752dc79ee18c102b4cce11ffe47af43c22c4887cb7ff11f4d8c7bdc4456269c5638b1a

Download Submit
C:\Windows\System\PbzmDlr.exe

Filesize
1.6MB

MD5
bf46c2af240e9310ec1e89be47ec9ee9

SHA1
4ccd3a0e1c55332019f819baff7112e173427bd3

SHA256
a0b33c5f093cd74461102809d722e5b9b9d9e785f2944d5be6115d0de5ca2ef1

SHA512
0f043989e6528c035a1ace85f6a0e96cd41374cdc67020a3292985387aba5395e442033b2102fcc167a1932981551cbd2bdc356569ddb36b180ab9013c032073

Download Submit
C:\Windows\System\QnHZqIx.exe

Filesize
1.6MB

MD5
5cae9a7a35691d890b15b7f12c6f779d

SHA1
f219a23b3eda0dab764c943e12f532e400048ed0

SHA256
385a2e8d32fe051632a1b5352bde2d3210190c3272083cf9e28df6ce0480c670

SHA512
9246d4d289369d923a5e25a78820111a9fe48096656cb1d01d248341a2cf297b8ff2b3be16e8daa643f6771a25c92077253ab5a611ad372776d0a31b06b2af0a

Download Submit
C:\Windows\System\SFeohqP.exe

Filesize
1.6MB

MD5
1b6ea4bb4a3023c485777947d32eee2a

SHA1
c4a6c7ff9ffcad62337e66e70ba2acb178801d44

SHA256
e102f188d2dbd6654486bb8d63a9f9224d2a21e78fb497db971dee60cd30cde5

SHA512
fc13218a97bbd307d0d55c2985688bb75f2857fc09b5c4159dc8a38742d79b08844e5f1faa0a0278e90dbd0b3f23675ae1aaed45b261e0bb9dcba996d6ff975a

Download Submit
C:\Windows\System\TdxuUBu.exe

Filesize
1.6MB

MD5
f4582a05068059b0780102f6de3e9759

SHA1
db13be5e574007b77463dd72a47a1567d8ea314c

SHA256
29cde091990bf3aad3b0e3381741b9f3e801c55aa0021c32a04b3dc080e5c38d

SHA512
dcdc1a79e8f9c1600dfbd16ae4500a7e7ad1760812ce25687897ac6417074b99847a8b56a230ac233882341eee9cedbb200f93895a263c9f90bd37b62dd75405

Download Submit
C:\Windows\System\TnrSClK.exe

Filesize
1.6MB

MD5
49cd4350ba1eccd3ef8de8fa2bd225ae

SHA1
85ea4ed059221fa175928e04a3669a3e78039209

SHA256
9444933c11de8bd1b7d2bcdf9c2c980831b2bd910eb9e2c43514c5e4dd3353d6

SHA512
99e4cce78e12d2f8c0d3ea38f3ed2e90f28d6e623a6f2549c4a44e7b4c487a1fba7c74b4cdd7fef82bbb06840609bc0f29b9c20acc6c7168fc33bc01bd5aa7d4

Download Submit
C:\Windows\System\UFffMuu.exe

Filesize
1.6MB

MD5
e4910d960e54f1aaa0d89b876a83b14e

SHA1
67ca0fc459b3e3057bca3c83fd7c78a2528dd202

SHA256
ba69328eff8f4a0c9b9f659f7e965bb0ed62b528301d811897030361f0150ad3

SHA512
22bf08e9c997500bfd6a142749b9f711b0434a79ff738426022eefa6d0491f3a2d3d5dc4ea8416ed8df0cf05e61b315242a3d4eaade49fd4409451a4d44cbcb4

Download Submit
C:\Windows\System\UXrpSRq.exe

Filesize
1.6MB

MD5
d8be8abc988e306d06bb31f46fa245ff

SHA1
3ca8ad363264e5307eda4c5958232af1de492189

SHA256
726f173528d48ab5fed9d0953db6278cafe89d44cecc6052efdd5ec22d7d60a7

SHA512
f28aef4b120f57eb7e4f63ab3c60539222c16a46f29d5dab8f3a8745ee7a2d22a8af7c8ae30ed3f8f78d3fa5be22511cdc5dab5e0fd0b7d8edde05f0abc50075

Download Submit
C:\Windows\System\VjgvDpH.exe

Filesize
1.6MB

MD5
e4fe4564da1588efccddc76984060e95

SHA1
c837956942c71f83a788b99391c3db7bc6e00679

SHA256
e296b5314a35d6232e1efccc0642d2f5542dc7722b2cc9f256f5620196e49fbf

SHA512
8d1c027876c86e6d13498f04b80382439b452703c19ac40a0053b5559978c9d0e54f1a5b7989e6bbbfc6fa4d66816696368725b8c16ebfc513b1e9173a2cf9bc

Download Submit
C:\Windows\System\WJUXFCi.exe

Filesize
1.6MB

MD5
aedacef019bfe478bf45598b28ebc47a

SHA1
cff72120afff10b990f71d4ecd7165a90db17695

SHA256
43c026325533818e31d9d58e19c6e263c5bbac76659c2f7cc835c8130809df09

SHA512
8f50edfda7dd83d42160ca4c21ad4188c1ea8f50ac5645d76c51a435eb2e1bf4d8863439aa2f964cf2cf9187205c9e9441f3b4298cac4aa26b780ec8ec4dcade

Download Submit
C:\Windows\System\XXLhomJ.exe

Filesize
1.6MB

MD5
ea091f90c4304d0861b52de03f92acb5

SHA1
735f86a659b03a44302778b76af0d2b9a94f8eb8

SHA256
34315f75a1669bc795d7197f1cdd3e5d21d62c438824d75434d6a3dfb7b62bcc

SHA512
61dd2839490749021cb3c10b3fda1feefe51fdc3d7c9ed2d7fff662860d7fc21ac9067321667f8aba4f1cf6cfb73ea5f31bf4683eaf8ad373f880252b46e6630

Download Submit
C:\Windows\System\XhGybUc.exe

Filesize
1.6MB

MD5
10684077645d32d222a490b1e07a61ea

SHA1
a53f23509cb37e9f60a2bd1c95623c47adf3a0c7

SHA256
32c88bf7a384e178664b38e322a46d1f6fda57bd2b4a0b57d8f3d0e6bbaa0b68

SHA512
c2c151f4da9f360a8c145bc22bf6d171f2248df964a111c2da54d6ef9e97997d5224eeff947580c7c9ca26c86c39cae778a947e51393245c379c6d4f5c7bc550

Download Submit
C:\Windows\System\XoYcPWz.exe

Filesize
1.6MB

MD5
608bb10411dabf50a32c5303d1060f1c

SHA1
dedbdbea5385aba23fd58ccc22438ea0a391d07b

SHA256
c5b22280ff6e309d26e0836dc2a253daf0570ff92cc7d6fe0dac01168826ff0c

SHA512
63b6313bee59bf1d294acd5d9dc09aaeed1cbb0fc19c904ab2c7f79de397e8c490bbde382f10c128964a3c3288efa44e064e57fc439c5f1eee88c574ac1a9b4c

Download Submit
C:\Windows\System\YEMDLsT.exe

Filesize
1.6MB

MD5
d8958a0d0b69776fc72ba18f7aa46891

SHA1
9b30116783efce88e23f4c2b05034b9b6a2584fd

SHA256
af30d27a06ca6291a89ed3d7ac010e08dd29016ee23ad52a87d875f808318a58

SHA512
2e0fdbff7e8846f4423adbb69d042a980a01f4d98aa2c84d697106dcef48dfb418a92f08a14fcedc380dc6747575a752c28324cb4800aff20512ed4aea9bae2f

Download Submit
C:\Windows\System\YPOXvVg.exe

Filesize
1.6MB

MD5
2d6ac78f5b0961d343127d1037ec43e2

SHA1
7b83d373425adf2b1780b72ebd4e11a9916fd1a1

SHA256
9a5050e13f409231a6e2c2250ec6bec72759ba0691f38eb6350ed77fef95e316

SHA512
90158ac65f3c75e2858593a840f88e63482f88cc98a65eb6d69bf72d5be9844531f9c68ab8ad4bf49f9ffc4052161143429b601d4d6a45c0dafe5754e6717447

Download Submit
C:\Windows\System\cEOMMfZ.exe

Filesize
1.6MB

MD5
c44efbcb3c48b6a234cfc0513757c29b

SHA1
46f1dd4d07d6aa3e2f7f8e5624e916f4eb265aa2

SHA256
15deebd1451ac6a2aa2845945ab664ad1a69dc302a77d6f3ee5114650f70de56

SHA512
5cb880f05eb84ee56376f087f3bf4989f23788cdb9efccad5f1dc3ca9c1e540698dc7cec511458e71a712b0388fd3587e33e01eb96c0126471ad34ac76f92340

Download Submit
C:\Windows\System\cSnSGsu.exe

Filesize
1.6MB

MD5
223588026b35b9232dbd96c3bf767988

SHA1
d7833bfdf2fd6713206d4e3a3dac390a19b8aaff

SHA256
0edba4d9d342ae71be0a827c117701b196c7fa1f57452481990159bee6581755

SHA512
47eef6a477a92f8f413c2064660da5798d43e1a9a09c2cac90eead009bb5f64a901a2d6a06f918105172a5c93296c82953f66b12a3dafff6398da56b063a6a40

Download Submit
C:\Windows\System\eNThWLt.exe

Filesize
1.6MB

MD5
7c39b39774225ba9a438dbad84b205bf

SHA1
e27ce317c4d4aeeb8391c6c209eac510eb5fa6cf

SHA256
a85cfe237b8164a01a312d905afd525923301494dae9c9c53375518577ae471f

SHA512
6d8c83a61e8ec19c0a7980a41f2185884374f9e9a763824170589bdbab9c61e44b396be6fc863021d6d72ae69051e54dcdccde527e6866cb114b8d405dd9feb2

Download Submit
C:\Windows\System\eSUVhoD.exe

Filesize
1.6MB

MD5
03bc5737f9d6e23b8d3744d93be2616e

SHA1
b6acdec93261aa13f3e49beb279b4935c2a66ead

SHA256
3137d6f49916395bd6900a7ab3a789f21960b9667b8f647e306f7170d5ce80a7

SHA512
bdaf934eb3fb2c6edf263c464f6f0c3dbc839d4a28bf6f2a767b0b9e5b13ce136eeae2d852b1eb428b7988bc2b8486f200d0ddcc90c76e3500de48b5a4898f86

Download Submit
C:\Windows\System\gcBYPEY.exe

Filesize
1.6MB

MD5
b45ca41e5027b29f9ea0bc127bbb0f3b

SHA1
ff39261e3fe4acb98ed0756d449c8f42446963a1

SHA256
d2b1c1d89b5fd46b1384d8653e0b1df7d8358f99ce2b3296bdfdaa42f1c77b19

SHA512
dd3320ee4f26b4ee595f1957cc5044cad85fc85da805a0b39a9237df03a56e2ce1de7f4818a17c82fab1134b04b83f48b615cebc93bd6aeac7720cdcb88d862a

Download Submit
C:\Windows\System\hEyhJVE.exe

Filesize
1.6MB

MD5
3eca39600821e75a238cb8ad651857e5

SHA1
dcdb55235e59e57685b37917a8057e05a2df86fd

SHA256
cde5bff73b56a5c33f1eb1d6fee3c07a1f441d297443d0fe99f19ddf7fde6f73

SHA512
30dfa646a00e7ce3a0a9e57e11f9dc95ffbda24916a94434f9d68463c92463f113551e074e4a25577b749cb58869abc57b38253fe9ea2a24d837b17f7aef1ff5

Download Submit
C:\Windows\System\iEcBMjy.exe

Filesize
1.6MB

MD5
00525eda5a8c463593ea86c96419ac57

SHA1
65d3c468898ad660f1cdb7ad8a21bd41d374bb2f

SHA256
36cf0baba458c31ba9e72ec4aea42f2148bbc34f8869530c469acc190766aadf

SHA512
bcbc01253873b0ed6192454e3eea62f3f677ddf0aac323b3777fde8e50f656c6763f916019f7c963d03c165d95783bb86040c572820f1f324f14591402bfd3e7

Download Submit
C:\Windows\System\kIPsvEb.exe

Filesize
1.6MB

MD5
a6c687079e7cdce500584bb775babccd

SHA1
1ae9351afeb3d69fdb731cf0f81fcbce6ae268ea

SHA256
4bc9267f5251470a661e6d3f255cda4b4f88d93345882358820106d75d0e0c91

SHA512
3a624147bcbf7eaf441df5dc03d11477cce25ebe46dd89d0a9bc81b82721028951f9aab7761332cadac3669d61eacb35bd38f1b16a0ceabe4c06375001a238d9

Download Submit
C:\Windows\System\kgTbaLl.exe

Filesize
1.6MB

MD5
955c2fa2e431240e2441c989b3bf9339

SHA1
bf7a2d434d505bbdaf9a44e4b100313918abf6cb

SHA256
111b1276a97b38cc8efd27e970f2449959b020e3c0c5fc7912f51c7ee5a7e58d

SHA512
155a8e825526876b61f6f79cac60a344dcae93accf79fd0812ca026d3112fb207abe220c01198ca6d997fb3d01cf03e8285f2e84f835f17adfa418a2927106fc

Download Submit
C:\Windows\System\oAWKcCu.exe

Filesize
1.6MB

MD5
1b3ff3a6d3f455c475c1b165cdda3e42

SHA1
61d9392e9c74d5cde33d0906cd5850213fc249e4

SHA256
d090da58d75c9a77e59f3b30447d3d4d5bb65244154a5673cc65051100c92cd7

SHA512
e0fb974a8aca7b5b4de3783ae381ccb4d74c8762a39bc32f45ef0d8920a011a674654368ddb4829c70e6a18c92985e7934a648d9609646383c36cba00b210159

Download Submit
C:\Windows\System\sYywHeh.exe

Filesize
1.6MB

MD5
a3a0c4ef0fef6a3bd44d6736f76137ae

SHA1
a9a0e05b13d8873e40fe7024b4136cfb61f715d4

SHA256
bdcffd4230fec1c5ad92d27cc3b9bb6e065a01ebdbe034734658c23e84796af1

SHA512
392c1f21d1d6df4f8546c8b79af02d1ddccea30773ba037cc1beb439e390187d3440dcd9e0ab87786ab6a1bcbe8d4e1eef2336132f3742d7fcb4f976bb1f297b

Download Submit
C:\Windows\System\wgvvVBG.exe

Filesize
1.6MB

MD5
5cb4cce08c492aa4a69e70d48e29c492

SHA1
419b70403444acddc84dc9ad66224c51e0dd59bd

SHA256
475ed11833b1eacc322f5ed3841eec297e82b21f4b985dd69785111e3ea53b1b

SHA512
7483aca953bb9dd6b308ad213fbf51797f7753d8024e5fffdb6f251b1c771b87d18ce9a69455f26a80ca04e74e8754dd7fc9b006470438592e2631b69aebc31f

Download Submit
C:\Windows\System\xklOHzb.exe

Filesize
1.6MB

MD5
55f4289ef808289769bc89854cbb0316

SHA1
7fb6e08713d3d1b8dddf0b899b2310c8664ca7f9

SHA256
8c3b45d2c4734abaa7341737a3a8e99bb79729e929be408ebd62db98176ecdcf

SHA512
435d6c6895d5e4ec8ba3bd0c89195d95c4e75dd8c736b35ea9209e6691a98567245fabe39dd3673727d7191ec4129310a312460902b0b20019c95d922121d1f5

Download Submit
C:\Windows\System\zYtMCdD.exe

Filesize
1.6MB

MD5
fbaf951848169624f223a52886c1250f

SHA1
2e96e362c182425096d7ea8317b01f1a1606924c

SHA256
aafd3fae0591a97f0aaccd241fd45affe1e2aa99cb60eafa1c5762f93363a376

SHA512
0c87eeb1352f47b6ba39a596751abe060cc9f0d3afad95ee313b927c42ebb6b3de38dce97ce3a721626e7c09926a6cd076f5ef5caabe8416a27dd26342e637c6

Download Submit
memory/184-3667-0x00007FF64A120000-0x00007FF64A512000-memory.dmp

Filesize
3.9MB

Download
memory/184-266-0x00007FF64A120000-0x00007FF64A512000-memory.dmp

Filesize
3.9MB

Download
memory/244-3719-0x00007FF74AF00000-0x00007FF74B2F2000-memory.dmp

Filesize
3.9MB

Download
memory/244-529-0x00007FF74AF00000-0x00007FF74B2F2000-memory.dmp

Filesize
3.9MB

Download
memory/1016-1-0x0000024FE7AE0000-0x0000024FE7AF0000-memory.dmp

Filesize
64KB

Download
memory/1016-0-0x00007FF63F7B0000-0x00007FF63FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/1072-3669-0x00007FF7A0090000-0x00007FF7A0482000-memory.dmp

Filesize
3.9MB

Download
memory/1072-521-0x00007FF7A0090000-0x00007FF7A0482000-memory.dmp

Filesize
3.9MB

Download
memory/1196-370-0x00007FF6351D0000-0x00007FF6355C2000-memory.dmp

Filesize
3.9MB

Download
memory/1196-3657-0x00007FF6351D0000-0x00007FF6355C2000-memory.dmp

Filesize
3.9MB

Download
memory/1252-218-0x00007FF6174B0000-0x00007FF6178A2000-memory.dmp

Filesize
3.9MB

Download
memory/1252-3652-0x00007FF6174B0000-0x00007FF6178A2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-194-0x000001FD9B9C0000-0x000001FD9B9E2000-memory.dmp

Filesize
136KB

Download
memory/1284-26-0x00007FFA1EB80000-0x00007FFA1F641000-memory.dmp

Filesize
10.8MB

Download
memory/1284-6-0x00007FFA1EB83000-0x00007FFA1EB85000-memory.dmp

Filesize
8KB

Download
memory/1284-69-0x00007FFA1EB80000-0x00007FFA1F641000-memory.dmp

Filesize
10.8MB

Download
memory/1592-3646-0x00007FF742260000-0x00007FF742652000-memory.dmp

Filesize
3.9MB

Download
memory/1592-536-0x00007FF742260000-0x00007FF742652000-memory.dmp

Filesize
3.9MB

Download
memory/1640-3673-0x00007FF6AAAF0000-0x00007FF6AAEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1640-388-0x00007FF6AAAF0000-0x00007FF6AAEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-532-0x00007FF786170000-0x00007FF786562000-memory.dmp

Filesize
3.9MB

Download
memory/1812-3641-0x00007FF786170000-0x00007FF786562000-memory.dmp

Filesize
3.9MB

Download
memory/1836-3654-0x00007FF699510000-0x00007FF699902000-memory.dmp

Filesize
3.9MB

Download
memory/1836-394-0x00007FF699510000-0x00007FF699902000-memory.dmp

Filesize
3.9MB

Download
memory/2080-3671-0x00007FF6641D0000-0x00007FF6645C2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-346-0x00007FF6641D0000-0x00007FF6645C2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-3659-0x00007FF75CBE0000-0x00007FF75CFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-174-0x00007FF75CBE0000-0x00007FF75CFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2236-3666-0x00007FF7CB880000-0x00007FF7CBC72000-memory.dmp

Filesize
3.9MB

Download
memory/2236-105-0x00007FF7CB880000-0x00007FF7CBC72000-memory.dmp

Filesize
3.9MB

Download
memory/2248-535-0x00007FF6C9EA0000-0x00007FF6CA292000-memory.dmp

Filesize
3.9MB

Download
memory/2248-3675-0x00007FF6C9EA0000-0x00007FF6CA292000-memory.dmp

Filesize
3.9MB

Download
memory/2632-3637-0x00007FF6D5C00000-0x00007FF6D5FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-91-0x00007FF6D5C00000-0x00007FF6D5FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-530-0x00007FF76BA70000-0x00007FF76BE62000-memory.dmp

Filesize
3.9MB

Download
memory/2812-3680-0x00007FF76BA70000-0x00007FF76BE62000-memory.dmp

Filesize
3.9MB

Download
memory/2852-3649-0x00007FF6CD140000-0x00007FF6CD532000-memory.dmp

Filesize
3.9MB

Download
memory/2852-274-0x00007FF6CD140000-0x00007FF6CD532000-memory.dmp

Filesize
3.9MB

Download
memory/2860-531-0x00007FF6811D0000-0x00007FF6815C2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-3635-0x00007FF6811D0000-0x00007FF6815C2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-480-0x00007FF639850000-0x00007FF639C42000-memory.dmp

Filesize
3.9MB

Download
memory/2912-3648-0x00007FF639850000-0x00007FF639C42000-memory.dmp

Filesize
3.9MB

Download
memory/3244-3677-0x00007FF6FFBA0000-0x00007FF6FFF92000-memory.dmp

Filesize
3.9MB

Download
memory/3244-398-0x00007FF6FFBA0000-0x00007FF6FFF92000-memory.dmp

Filesize
3.9MB

Download
memory/3588-319-0x00007FF765530000-0x00007FF765922000-memory.dmp

Filesize
3.9MB

Download
memory/3588-3644-0x00007FF765530000-0x00007FF765922000-memory.dmp

Filesize
3.9MB

Download
memory/4292-3664-0x00007FF7C4250000-0x00007FF7C4642000-memory.dmp

Filesize
3.9MB

Download
memory/4292-137-0x00007FF7C4250000-0x00007FF7C4642000-memory.dmp

Filesize
3.9MB

Download
memory/4412-3662-0x00007FF7DC7F0000-0x00007FF7DCBE2000-memory.dmp

Filesize
3.9MB

Download
memory/4412-533-0x00007FF7DC7F0000-0x00007FF7DCBE2000-memory.dmp

Filesize
3.9MB

Download
memory/4488-3640-0x00007FF749F10000-0x00007FF74A302000-memory.dmp

Filesize
3.9MB

Download
memory/4488-260-0x00007FF749F10000-0x00007FF74A302000-memory.dmp

Filesize
3.9MB

Download
memory/4744-534-0x00007FF6765B0000-0x00007FF6769A2000-memory.dmp

Filesize
3.9MB

Download
memory/4744-3656-0x00007FF6765B0000-0x00007FF6769A2000-memory.dmp

Filesize
3.9MB

Download