xmrig | eabd43a3c7a39c5908b57e5d3a65f0afb2544f3201c1b356f689c522b8d4a895

Analysis

max time kernel
92s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b8e0c68ba256a1c7d5c143c7fb221050N.exe
Size

1.9MB
MD5

b8e0c68ba256a1c7d5c143c7fb221050
SHA1

5a0ff129b26d24f280bede9aa15d021b1982afbc
SHA256

eabd43a3c7a39c5908b57e5d3a65f0afb2544f3201c1b356f689c522b8d4a895
SHA512

8268873e636cef26d11d31c7163502eec03175fae2e623dc4f9f5ccc022906b41b6ed1a400ba8391c074944bda99941e3d5c3fe29caf60b58f805bce1dc1270e
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNI/TQ9f27dvapbkeyHdbKbTE:Lz071uv4BPMkFfdk2a2yKmkfHb/E7I

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/memory/1200-297-0x00007FF75F8E0000-0x00007FF75FCD2000-memory.dmp	xmrig
behavioral2/memory/3596-315-0x00007FF662F30000-0x00007FF663322000-memory.dmp	xmrig
behavioral2/memory/4912-319-0x00007FF6F3960000-0x00007FF6F3D52000-memory.dmp	xmrig
behavioral2/memory/2592-318-0x00007FF727C10000-0x00007FF728002000-memory.dmp	xmrig
behavioral2/memory/4380-317-0x00007FF695420000-0x00007FF695812000-memory.dmp	xmrig
behavioral2/memory/1084-316-0x00007FF6A9590000-0x00007FF6A9982000-memory.dmp	xmrig
behavioral2/memory/1624-313-0x00007FF630F70000-0x00007FF631362000-memory.dmp	xmrig
behavioral2/memory/1664-312-0x00007FF67B3E0000-0x00007FF67B7D2000-memory.dmp	xmrig
behavioral2/memory/3180-311-0x00007FF67C6C0000-0x00007FF67CAB2000-memory.dmp	xmrig
behavioral2/memory/1028-310-0x00007FF766780000-0x00007FF766B72000-memory.dmp	xmrig
behavioral2/memory/4708-309-0x00007FF65CEF0000-0x00007FF65D2E2000-memory.dmp	xmrig
behavioral2/memory/4348-298-0x00007FF69E6C0000-0x00007FF69EAB2000-memory.dmp	xmrig
behavioral2/memory/1148-296-0x00007FF7710C0000-0x00007FF7714B2000-memory.dmp	xmrig
behavioral2/memory/2872-294-0x00007FF6506F0000-0x00007FF650AE2000-memory.dmp	xmrig
behavioral2/memory/1736-235-0x00007FF789280000-0x00007FF789672000-memory.dmp	xmrig
behavioral2/memory/1332-199-0x00007FF6EB920000-0x00007FF6EBD12000-memory.dmp	xmrig
behavioral2/memory/3396-3777-0x00007FF76C930000-0x00007FF76CD22000-memory.dmp	xmrig
behavioral2/memory/4264-3780-0x00007FF79DBB0000-0x00007FF79DFA2000-memory.dmp	xmrig
behavioral2/memory/3596-3788-0x00007FF662F30000-0x00007FF663322000-memory.dmp	xmrig
behavioral2/memory/1084-3820-0x00007FF6A9590000-0x00007FF6A9982000-memory.dmp	xmrig
behavioral2/memory/4380-3828-0x00007FF695420000-0x00007FF695812000-memory.dmp	xmrig
behavioral2/memory/4508-3861-0x00007FF6FA000000-0x00007FF6FA3F2000-memory.dmp	xmrig
behavioral2/memory/4348-3920-0x00007FF69E6C0000-0x00007FF69EAB2000-memory.dmp	xmrig
behavioral2/memory/1148-3918-0x00007FF7710C0000-0x00007FF7714B2000-memory.dmp	xmrig
behavioral2/memory/3180-3894-0x00007FF67C6C0000-0x00007FF67CAB2000-memory.dmp	xmrig
behavioral2/memory/1200-3915-0x00007FF75F8E0000-0x00007FF75FCD2000-memory.dmp	xmrig
behavioral2/memory/1664-3910-0x00007FF67B3E0000-0x00007FF67B7D2000-memory.dmp	xmrig
behavioral2/memory/4912-3886-0x00007FF6F3960000-0x00007FF6F3D52000-memory.dmp	xmrig
behavioral2/memory/1028-3890-0x00007FF766780000-0x00007FF766B72000-memory.dmp	xmrig
behavioral2/memory/4708-3864-0x00007FF65CEF0000-0x00007FF65D2E2000-memory.dmp	xmrig
behavioral2/memory/1016-3854-0x00007FF63CA50000-0x00007FF63CE42000-memory.dmp	xmrig
behavioral2/memory/1624-3850-0x00007FF630F70000-0x00007FF631362000-memory.dmp	xmrig
behavioral2/memory/2872-3847-0x00007FF6506F0000-0x00007FF650AE2000-memory.dmp	xmrig
behavioral2/memory/2592-3857-0x00007FF727C10000-0x00007FF728002000-memory.dmp	xmrig
behavioral2/memory/1736-3839-0x00007FF789280000-0x00007FF789672000-memory.dmp	xmrig
behavioral2/memory/1332-3835-0x00007FF6EB920000-0x00007FF6EBD12000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
8	4728	powershell.exe
10	4728	powershell.exe
12	4728	powershell.exe
13	4728	powershell.exe
15	4728	powershell.exe
20	4728	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4728	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1128	mRLLcfT.exe
3668	ajGBVps.exe
3084	IhFhBex.exe
3396	YPNBNmP.exe
4264	ILRdCwO.exe
3596	lWIuDYk.exe
1084	nYyhRAi.exe
3272	OJjRcJA.exe
4380	tmrmoOV.exe
1016	RzBewAH.exe
4508	PwjEKsU.exe
2592	SLlhrEe.exe
1332	aMJnHOP.exe
1736	TprMtKq.exe
2872	XyhOseJ.exe
1148	YhUKGPP.exe
1200	yLiLMXv.exe
4348	XuRbxCP.exe
4708	sOGeTHl.exe
1028	PgHZvkM.exe
4912	CwEoeDH.exe
3180	CBYQPxy.exe
1664	ZemGbWO.exe
1624	JFVqaMH.exe
1108	RFLwBgO.exe
780	yZDRrdl.exe
1020	ASiIVUe.exe
980	qVfPBgH.exe
3720	XOHQnOC.exe
3916	KiIKxZQ.exe
4544	QgxvjyW.exe
1312	vzCCrtF.exe
1804	AVOwNFH.exe
3484	HBwhttw.exe
1252	HPHAZNF.exe
4412	fRWafho.exe
224	xpMQgId.exe
3852	kTtsOMa.exe
3572	kOoEhex.exe
4848	MapIgUk.exe
1768	uASgzeS.exe
1328	VQOYbCl.exe
3352	cKeYNfG.exe
2988	SroUuPu.exe
776	BCilFDp.exe
1408	QXbmGPs.exe
5112	SIprnSR.exe
1688	RYCNiIg.exe
1324	lBYlRvs.exe
4228	tKqGPGP.exe
4756	ToZPSRn.exe
5096	tBvkPnu.exe
2696	DVGeBJU.exe
2884	PBptvDc.exe
3172	QRlwtMZ.exe
3008	UIicLSv.exe
4004	ygoKcPz.exe
4540	EnyuKRD.exe
3236	SCnDRTc.exe
2612	bHxmlcJ.exe
1704	bcBzGCO.exe
4636	xcFOYbp.exe
3460	GwDnBnT.exe
2772	wsmBQPk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2968-0-0x00007FF6E8AD0000-0x00007FF6E8EC2000-memory.dmp	upx
behavioral2/files/0x00080000000234e9-18.dat	upx
behavioral2/files/0x00070000000234ee-7.dat	upx
behavioral2/files/0x00070000000234f7-68.dat	upx
behavioral2/memory/1200-297-0x00007FF75F8E0000-0x00007FF75FCD2000-memory.dmp	upx
behavioral2/memory/3596-315-0x00007FF662F30000-0x00007FF663322000-memory.dmp	upx
behavioral2/memory/4912-319-0x00007FF6F3960000-0x00007FF6F3D52000-memory.dmp	upx
behavioral2/memory/2592-318-0x00007FF727C10000-0x00007FF728002000-memory.dmp	upx
behavioral2/memory/4380-317-0x00007FF695420000-0x00007FF695812000-memory.dmp	upx
behavioral2/memory/1084-316-0x00007FF6A9590000-0x00007FF6A9982000-memory.dmp	upx
behavioral2/memory/1624-313-0x00007FF630F70000-0x00007FF631362000-memory.dmp	upx
behavioral2/memory/1664-312-0x00007FF67B3E0000-0x00007FF67B7D2000-memory.dmp	upx
behavioral2/memory/3180-311-0x00007FF67C6C0000-0x00007FF67CAB2000-memory.dmp	upx
behavioral2/memory/1028-310-0x00007FF766780000-0x00007FF766B72000-memory.dmp	upx
behavioral2/memory/4708-309-0x00007FF65CEF0000-0x00007FF65D2E2000-memory.dmp	upx
behavioral2/memory/4348-298-0x00007FF69E6C0000-0x00007FF69EAB2000-memory.dmp	upx
behavioral2/memory/1148-296-0x00007FF7710C0000-0x00007FF7714B2000-memory.dmp	upx
behavioral2/memory/2872-294-0x00007FF6506F0000-0x00007FF650AE2000-memory.dmp	upx
behavioral2/memory/1736-235-0x00007FF789280000-0x00007FF789672000-memory.dmp	upx
behavioral2/memory/1332-199-0x00007FF6EB920000-0x00007FF6EBD12000-memory.dmp	upx
behavioral2/files/0x0007000000023519-196.dat	upx
behavioral2/memory/4508-193-0x00007FF6FA000000-0x00007FF6FA3F2000-memory.dmp	upx
behavioral2/files/0x0007000000023518-192.dat	upx
behavioral2/files/0x0007000000023501-188.dat	upx
behavioral2/files/0x00070000000234f9-184.dat	upx
behavioral2/files/0x0007000000023517-183.dat	upx
behavioral2/files/0x0007000000023516-182.dat	upx
behavioral2/files/0x0007000000023514-180.dat	upx
behavioral2/files/0x0007000000023513-179.dat	upx
behavioral2/files/0x0007000000023512-178.dat	upx
behavioral2/files/0x00070000000234ff-173.dat	upx
behavioral2/files/0x000700000002350e-168.dat	upx
behavioral2/files/0x000700000002350d-165.dat	upx
behavioral2/files/0x000700000002350a-162.dat	upx
behavioral2/files/0x0007000000023509-161.dat	upx
behavioral2/memory/1016-154-0x00007FF63CA50000-0x00007FF63CE42000-memory.dmp	upx
behavioral2/files/0x0007000000023507-144.dat	upx
behavioral2/files/0x0007000000023500-143.dat	upx
behavioral2/files/0x0007000000023515-181.dat	upx
behavioral2/files/0x0007000000023511-177.dat	upx
behavioral2/files/0x00070000000234fa-137.dat	upx
behavioral2/files/0x00070000000234f8-136.dat	upx
behavioral2/files/0x00070000000234f4-130.dat	upx
behavioral2/files/0x0007000000023510-170.dat	upx
behavioral2/files/0x000700000002350f-169.dat	upx
behavioral2/files/0x00070000000234f6-121.dat	upx
behavioral2/files/0x0007000000023505-120.dat	upx
behavioral2/files/0x0007000000023504-117.dat	upx
behavioral2/files/0x000700000002350b-163.dat	upx
behavioral2/files/0x0007000000023502-109.dat	upx
behavioral2/files/0x00070000000234fb-153.dat	upx
behavioral2/files/0x0007000000023508-152.dat	upx
behavioral2/memory/3272-94-0x00007FF719030000-0x00007FF719422000-memory.dmp	upx
behavioral2/files/0x0007000000023506-129.dat	upx
behavioral2/files/0x00070000000234fe-90.dat	upx
behavioral2/files/0x00070000000234fc-88.dat	upx
behavioral2/files/0x00070000000234f5-111.dat	upx
behavioral2/files/0x0007000000023503-110.dat	upx
behavioral2/files/0x00070000000234f3-80.dat	upx
behavioral2/files/0x00070000000234fd-89.dat	upx
behavioral2/memory/4264-62-0x00007FF79DBB0000-0x00007FF79DFA2000-memory.dmp	upx
behavioral2/files/0x00070000000234f1-57.dat	upx
behavioral2/files/0x00070000000234f0-50.dat	upx
behavioral2/files/0x00070000000234f2-76.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aYcTwpT.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\OHKxMhE.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\SLJzuUE.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\VvInDWE.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\XRUYJHT.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\YdihOfO.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\oPrxtug.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\YAWNDmf.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\mcxSVkD.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\BLDDfTm.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\axRaQvb.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\KmSDyzD.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\cLbYhKd.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\OMUAgkF.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\wdaoPkw.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\HqukKnA.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\fspooRj.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\YBCUCgD.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\TNKLTPs.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\QeBODmz.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\leWmnQO.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\DVGeBJU.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\JAmqRVB.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\ZtTiQKs.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\EPNFgax.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\ZwjKRef.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\RoqViOv.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\vsyGnZY.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\uSbCuzR.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\vSKpreR.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\AhqTjyB.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\QitdeKy.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\HunomJA.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\HjyDvdr.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\WxoQWcP.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\pinZsbW.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\dawkeYF.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\oPZOqRL.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\CnNjGSQ.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\JsWeiad.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\tXBKkRG.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\AWPLWGg.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\TNxgbKJ.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\qBDKEaE.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\LhiVuBX.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\bHxyGrz.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\BYPrMFT.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\SNmgfXs.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\myWrdgx.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\mtyOeLM.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\xcFOYbp.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\wZpzWLf.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\PuLWClM.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\LxhfSVq.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\MnANBOq.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\yrCSOqO.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\xTPpfZy.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\hqYMpHR.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\aoEbBYz.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\EhuExDA.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\mCZKVxB.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\zUqjknM.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\uizkHmN.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe
File created	C:\Windows\System\GmuENJq.exe	b8e0c68ba256a1c7d5c143c7fb221050N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeLockMemoryPrivilege	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe
Token: SeLockMemoryPrivilege	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 4728	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	85
PID 2968 wrote to memory of 4728	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	85
PID 2968 wrote to memory of 1128	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	86
PID 2968 wrote to memory of 1128	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	86
PID 2968 wrote to memory of 3668	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	87
PID 2968 wrote to memory of 3668	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	87
PID 2968 wrote to memory of 3084	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	88
PID 2968 wrote to memory of 3084	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	88
PID 2968 wrote to memory of 3396	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	89
PID 2968 wrote to memory of 3396	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	89
PID 2968 wrote to memory of 4264	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	90
PID 2968 wrote to memory of 4264	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	90
PID 2968 wrote to memory of 3596	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	91
PID 2968 wrote to memory of 3596	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	91
PID 2968 wrote to memory of 1084	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	92
PID 2968 wrote to memory of 1084	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	92
PID 2968 wrote to memory of 3272	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	93
PID 2968 wrote to memory of 3272	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	93
PID 2968 wrote to memory of 4380	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	94
PID 2968 wrote to memory of 4380	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	94
PID 2968 wrote to memory of 1016	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	95
PID 2968 wrote to memory of 1016	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	95
PID 2968 wrote to memory of 4508	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	96
PID 2968 wrote to memory of 4508	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	96
PID 2968 wrote to memory of 2592	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	97
PID 2968 wrote to memory of 2592	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	97
PID 2968 wrote to memory of 1332	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	98
PID 2968 wrote to memory of 1332	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	98
PID 2968 wrote to memory of 1028	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	99
PID 2968 wrote to memory of 1028	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	99
PID 2968 wrote to memory of 1736	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	100
PID 2968 wrote to memory of 1736	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	100
PID 2968 wrote to memory of 2872	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	101
PID 2968 wrote to memory of 2872	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	101
PID 2968 wrote to memory of 1148	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	102
PID 2968 wrote to memory of 1148	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	102
PID 2968 wrote to memory of 1200	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	103
PID 2968 wrote to memory of 1200	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	103
PID 2968 wrote to memory of 4348	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	104
PID 2968 wrote to memory of 4348	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	104
PID 2968 wrote to memory of 4708	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	105
PID 2968 wrote to memory of 4708	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	105
PID 2968 wrote to memory of 1020	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	106
PID 2968 wrote to memory of 1020	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	106
PID 2968 wrote to memory of 4912	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	107
PID 2968 wrote to memory of 4912	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	107
PID 2968 wrote to memory of 3180	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	108
PID 2968 wrote to memory of 3180	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	108
PID 2968 wrote to memory of 1664	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	109
PID 2968 wrote to memory of 1664	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	109
PID 2968 wrote to memory of 1624	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	110
PID 2968 wrote to memory of 1624	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	110
PID 2968 wrote to memory of 1108	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	111
PID 2968 wrote to memory of 1108	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	111
PID 2968 wrote to memory of 780	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	112
PID 2968 wrote to memory of 780	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	112
PID 2968 wrote to memory of 980	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	113
PID 2968 wrote to memory of 980	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	113
PID 2968 wrote to memory of 3720	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	114
PID 2968 wrote to memory of 3720	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	114
PID 2968 wrote to memory of 3916	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	115
PID 2968 wrote to memory of 3916	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	115
PID 2968 wrote to memory of 4544	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	116
PID 2968 wrote to memory of 4544	2968	b8e0c68ba256a1c7d5c143c7fb221050N.exe	116

C:\Users\Admin\AppData\Local\Temp\b8e0c68ba256a1c7d5c143c7fb221050N.exe
"C:\Users\Admin\AppData\Local\Temp\b8e0c68ba256a1c7d5c143c7fb221050N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\System\mRLLcfT.exe
  C:\Windows\System\mRLLcfT.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\ajGBVps.exe
  C:\Windows\System\ajGBVps.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\IhFhBex.exe
  C:\Windows\System\IhFhBex.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\YPNBNmP.exe
  C:\Windows\System\YPNBNmP.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\ILRdCwO.exe
  C:\Windows\System\ILRdCwO.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\lWIuDYk.exe
  C:\Windows\System\lWIuDYk.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\nYyhRAi.exe
  C:\Windows\System\nYyhRAi.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\OJjRcJA.exe
  C:\Windows\System\OJjRcJA.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\tmrmoOV.exe
  C:\Windows\System\tmrmoOV.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\RzBewAH.exe
  C:\Windows\System\RzBewAH.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\PwjEKsU.exe
  C:\Windows\System\PwjEKsU.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\SLlhrEe.exe
  C:\Windows\System\SLlhrEe.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\aMJnHOP.exe
  C:\Windows\System\aMJnHOP.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\PgHZvkM.exe
  C:\Windows\System\PgHZvkM.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\TprMtKq.exe
  C:\Windows\System\TprMtKq.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\XyhOseJ.exe
  C:\Windows\System\XyhOseJ.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\YhUKGPP.exe
  C:\Windows\System\YhUKGPP.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\yLiLMXv.exe
  C:\Windows\System\yLiLMXv.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\XuRbxCP.exe
  C:\Windows\System\XuRbxCP.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\sOGeTHl.exe
  C:\Windows\System\sOGeTHl.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\ASiIVUe.exe
  C:\Windows\System\ASiIVUe.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\CwEoeDH.exe
  C:\Windows\System\CwEoeDH.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\CBYQPxy.exe
  C:\Windows\System\CBYQPxy.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\ZemGbWO.exe
  C:\Windows\System\ZemGbWO.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\JFVqaMH.exe
  C:\Windows\System\JFVqaMH.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\RFLwBgO.exe
  C:\Windows\System\RFLwBgO.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\yZDRrdl.exe
  C:\Windows\System\yZDRrdl.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\qVfPBgH.exe
  C:\Windows\System\qVfPBgH.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\XOHQnOC.exe
  C:\Windows\System\XOHQnOC.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\KiIKxZQ.exe
  C:\Windows\System\KiIKxZQ.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\QgxvjyW.exe
  C:\Windows\System\QgxvjyW.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\vzCCrtF.exe
  C:\Windows\System\vzCCrtF.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\SIprnSR.exe
  C:\Windows\System\SIprnSR.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\AVOwNFH.exe
  C:\Windows\System\AVOwNFH.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\HBwhttw.exe
  C:\Windows\System\HBwhttw.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\HPHAZNF.exe
  C:\Windows\System\HPHAZNF.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\fRWafho.exe
  C:\Windows\System\fRWafho.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\xpMQgId.exe
  C:\Windows\System\xpMQgId.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\kTtsOMa.exe
  C:\Windows\System\kTtsOMa.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\kOoEhex.exe
  C:\Windows\System\kOoEhex.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\MapIgUk.exe
  C:\Windows\System\MapIgUk.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\uASgzeS.exe
  C:\Windows\System\uASgzeS.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\VQOYbCl.exe
  C:\Windows\System\VQOYbCl.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\cKeYNfG.exe
  C:\Windows\System\cKeYNfG.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\SroUuPu.exe
  C:\Windows\System\SroUuPu.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\BCilFDp.exe
  C:\Windows\System\BCilFDp.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\QXbmGPs.exe
  C:\Windows\System\QXbmGPs.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\RYCNiIg.exe
  C:\Windows\System\RYCNiIg.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\lBYlRvs.exe
  C:\Windows\System\lBYlRvs.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\tKqGPGP.exe
  C:\Windows\System\tKqGPGP.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\ToZPSRn.exe
  C:\Windows\System\ToZPSRn.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\tBvkPnu.exe
  C:\Windows\System\tBvkPnu.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\DVGeBJU.exe
  C:\Windows\System\DVGeBJU.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\PBptvDc.exe
  C:\Windows\System\PBptvDc.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\QRlwtMZ.exe
  C:\Windows\System\QRlwtMZ.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\UIicLSv.exe
  C:\Windows\System\UIicLSv.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\ygoKcPz.exe
  C:\Windows\System\ygoKcPz.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\EnyuKRD.exe
  C:\Windows\System\EnyuKRD.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\SCnDRTc.exe
  C:\Windows\System\SCnDRTc.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\bHxmlcJ.exe
  C:\Windows\System\bHxmlcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\bcBzGCO.exe
  C:\Windows\System\bcBzGCO.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\xcFOYbp.exe
  C:\Windows\System\xcFOYbp.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\GwDnBnT.exe
  C:\Windows\System\GwDnBnT.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\wsmBQPk.exe
  C:\Windows\System\wsmBQPk.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\NkBWWcf.exe
  C:\Windows\System\NkBWWcf.exe
  2⤵
  PID:4312
- C:\Windows\System\gGSzbzA.exe
  C:\Windows\System\gGSzbzA.exe
  2⤵
  PID:3028
- C:\Windows\System\vPndput.exe
  C:\Windows\System\vPndput.exe
  2⤵
  PID:1612
- C:\Windows\System\VsmZRmN.exe
  C:\Windows\System\VsmZRmN.exe
  2⤵
  PID:2848
- C:\Windows\System\uvJFyfQ.exe
  C:\Windows\System\uvJFyfQ.exe
  2⤵
  PID:3036
- C:\Windows\System\EBcESFy.exe
  C:\Windows\System\EBcESFy.exe
  2⤵
  PID:4984
- C:\Windows\System\uWXEAZA.exe
  C:\Windows\System\uWXEAZA.exe
  2⤵
  PID:3524
- C:\Windows\System\ZPrBzwZ.exe
  C:\Windows\System\ZPrBzwZ.exe
  2⤵
  PID:3604
- C:\Windows\System\NkicihX.exe
  C:\Windows\System\NkicihX.exe
  2⤵
  PID:2376
- C:\Windows\System\gzHyyLb.exe
  C:\Windows\System\gzHyyLb.exe
  2⤵
  PID:2260
- C:\Windows\System\mdSVCye.exe
  C:\Windows\System\mdSVCye.exe
  2⤵
  PID:3288
- C:\Windows\System\DhnVPHB.exe
  C:\Windows\System\DhnVPHB.exe
  2⤵
  PID:3204
- C:\Windows\System\zjyvJaz.exe
  C:\Windows\System\zjyvJaz.exe
  2⤵
  PID:1952
- C:\Windows\System\uZDkhpj.exe
  C:\Windows\System\uZDkhpj.exe
  2⤵
  PID:2140
- C:\Windows\System\SNmgfXs.exe
  C:\Windows\System\SNmgfXs.exe
  2⤵
  PID:4340
- C:\Windows\System\BSoNwJq.exe
  C:\Windows\System\BSoNwJq.exe
  2⤵
  PID:4072
- C:\Windows\System\eBEZObL.exe
  C:\Windows\System\eBEZObL.exe
  2⤵
  PID:3940
- C:\Windows\System\WIyNjty.exe
  C:\Windows\System\WIyNjty.exe
  2⤵
  PID:4932
- C:\Windows\System\ClhcAnj.exe
  C:\Windows\System\ClhcAnj.exe
  2⤵
  PID:5128
- C:\Windows\System\KPTrGzZ.exe
  C:\Windows\System\KPTrGzZ.exe
  2⤵
  PID:5152
- C:\Windows\System\vkWwwNe.exe
  C:\Windows\System\vkWwwNe.exe
  2⤵
  PID:5192
- C:\Windows\System\gJuxmCd.exe
  C:\Windows\System\gJuxmCd.exe
  2⤵
  PID:5220
- C:\Windows\System\ZXUgRhB.exe
  C:\Windows\System\ZXUgRhB.exe
  2⤵
  PID:5240
- C:\Windows\System\jUByfFx.exe
  C:\Windows\System\jUByfFx.exe
  2⤵
  PID:6016
- C:\Windows\System\VaTMzrC.exe
  C:\Windows\System\VaTMzrC.exe
  2⤵
  PID:4772
- C:\Windows\System\zhGxBHF.exe
  C:\Windows\System\zhGxBHF.exe
  2⤵
  PID:1420
- C:\Windows\System\YGnGIMe.exe
  C:\Windows\System\YGnGIMe.exe
  2⤵
  PID:2052
- C:\Windows\System\rmYQfPv.exe
  C:\Windows\System\rmYQfPv.exe
  2⤵
  PID:4084
- C:\Windows\System\OXEDRmt.exe
  C:\Windows\System\OXEDRmt.exe
  2⤵
  PID:3328
- C:\Windows\System\pWyhvqU.exe
  C:\Windows\System\pWyhvqU.exe
  2⤵
  PID:2912
- C:\Windows\System\ZWKOfmM.exe
  C:\Windows\System\ZWKOfmM.exe
  2⤵
  PID:1972
- C:\Windows\System\JJgTvGQ.exe
  C:\Windows\System\JJgTvGQ.exe
  2⤵
  PID:656
- C:\Windows\System\CcFUenk.exe
  C:\Windows\System\CcFUenk.exe
  2⤵
  PID:2728
- C:\Windows\System\EzcgOQe.exe
  C:\Windows\System\EzcgOQe.exe
  2⤵
  PID:2428
- C:\Windows\System\rCsblWz.exe
  C:\Windows\System\rCsblWz.exe
  2⤵
  PID:640
- C:\Windows\System\MGuhCYF.exe
  C:\Windows\System\MGuhCYF.exe
  2⤵
  PID:4124
- C:\Windows\System\BeXKfXA.exe
  C:\Windows\System\BeXKfXA.exe
  2⤵
  PID:4232
- C:\Windows\System\YyFuNbt.exe
  C:\Windows\System\YyFuNbt.exe
  2⤵
  PID:4120
- C:\Windows\System\RepGdfB.exe
  C:\Windows\System\RepGdfB.exe
  2⤵
  PID:2596
- C:\Windows\System\xMCirCF.exe
  C:\Windows\System\xMCirCF.exe
  2⤵
  PID:1356
- C:\Windows\System\uMbVuJX.exe
  C:\Windows\System\uMbVuJX.exe
  2⤵
  PID:468
- C:\Windows\System\AiIUSja.exe
  C:\Windows\System\AiIUSja.exe
  2⤵
  PID:4648
- C:\Windows\System\LnJPETI.exe
  C:\Windows\System\LnJPETI.exe
  2⤵
  PID:2296
- C:\Windows\System\HMHfwfu.exe
  C:\Windows\System\HMHfwfu.exe
  2⤵
  PID:5176
- C:\Windows\System\xBbdvcp.exe
  C:\Windows\System\xBbdvcp.exe
  2⤵
  PID:5232
- C:\Windows\System\CThmbqo.exe
  C:\Windows\System\CThmbqo.exe
  2⤵
  PID:5144
- C:\Windows\System\negiiXw.exe
  C:\Windows\System\negiiXw.exe
  2⤵
  PID:5332
- C:\Windows\System\KyRvXaH.exe
  C:\Windows\System\KyRvXaH.exe
  2⤵
  PID:5500
- C:\Windows\System\QUVVKDS.exe
  C:\Windows\System\QUVVKDS.exe
  2⤵
  PID:2996
- C:\Windows\System\XmQlMoh.exe
  C:\Windows\System\XmQlMoh.exe
  2⤵
  PID:2508
- C:\Windows\System\DSrbDan.exe
  C:\Windows\System\DSrbDan.exe
  2⤵
  PID:2280
- C:\Windows\System\Hwqmsqc.exe
  C:\Windows\System\Hwqmsqc.exe
  2⤵
  PID:3440
- C:\Windows\System\JMKtMpN.exe
  C:\Windows\System\JMKtMpN.exe
  2⤵
  PID:5548
- C:\Windows\System\hsAiRtA.exe
  C:\Windows\System\hsAiRtA.exe
  2⤵
  PID:5576
- C:\Windows\System\lDwTrBN.exe
  C:\Windows\System\lDwTrBN.exe
  2⤵
  PID:5596
- C:\Windows\System\nxrytRZ.exe
  C:\Windows\System\nxrytRZ.exe
  2⤵
  PID:5616
- C:\Windows\System\hFssFQi.exe
  C:\Windows\System\hFssFQi.exe
  2⤵
  PID:5632
- C:\Windows\System\VkNXuSj.exe
  C:\Windows\System\VkNXuSj.exe
  2⤵
  PID:5648
- C:\Windows\System\nxYIDUj.exe
  C:\Windows\System\nxYIDUj.exe
  2⤵
  PID:5664
- C:\Windows\System\rkQlLQF.exe
  C:\Windows\System\rkQlLQF.exe
  2⤵
  PID:5680
- C:\Windows\System\DNgQzJn.exe
  C:\Windows\System\DNgQzJn.exe
  2⤵
  PID:5696
- C:\Windows\System\PViZFCp.exe
  C:\Windows\System\PViZFCp.exe
  2⤵
  PID:5716
- C:\Windows\System\gRxvaGH.exe
  C:\Windows\System\gRxvaGH.exe
  2⤵
  PID:5740
- C:\Windows\System\uPEaFXc.exe
  C:\Windows\System\uPEaFXc.exe
  2⤵
  PID:5764
- C:\Windows\System\texrPcz.exe
  C:\Windows\System\texrPcz.exe
  2⤵
  PID:5792
- C:\Windows\System\hnycrWX.exe
  C:\Windows\System\hnycrWX.exe
  2⤵
  PID:5808
- C:\Windows\System\YMNMfzu.exe
  C:\Windows\System\YMNMfzu.exe
  2⤵
  PID:4404
- C:\Windows\System\ytaHfoD.exe
  C:\Windows\System\ytaHfoD.exe
  2⤵
  PID:5836
- C:\Windows\System\jOyhzvs.exe
  C:\Windows\System\jOyhzvs.exe
  2⤵
  PID:5848
- C:\Windows\System\XsyDMUs.exe
  C:\Windows\System\XsyDMUs.exe
  2⤵
  PID:2896
- C:\Windows\System\mxLtWVz.exe
  C:\Windows\System\mxLtWVz.exe
  2⤵
  PID:5884
- C:\Windows\System\UlStUIU.exe
  C:\Windows\System\UlStUIU.exe
  2⤵
  PID:5892
- C:\Windows\System\rLTMIri.exe
  C:\Windows\System\rLTMIri.exe
  2⤵
  PID:4216
- C:\Windows\System\qrViKOw.exe
  C:\Windows\System\qrViKOw.exe
  2⤵
  PID:5928
- C:\Windows\System\kiGcvcW.exe
  C:\Windows\System\kiGcvcW.exe
  2⤵
  PID:5948
- C:\Windows\System\FcHzyMM.exe
  C:\Windows\System\FcHzyMM.exe
  2⤵
  PID:5400
- C:\Windows\System\gAkigjx.exe
  C:\Windows\System\gAkigjx.exe
  2⤵
  PID:5384
- C:\Windows\System\uTgYjuG.exe
  C:\Windows\System\uTgYjuG.exe
  2⤵
  PID:5236
- C:\Windows\System\lmkNYbC.exe
  C:\Windows\System\lmkNYbC.exe
  2⤵
  PID:5988
- C:\Windows\System\KVWKuBK.exe
  C:\Windows\System\KVWKuBK.exe
  2⤵
  PID:868
- C:\Windows\System\miJmJGf.exe
  C:\Windows\System\miJmJGf.exe
  2⤵
  PID:5064
- C:\Windows\System\ucTeDrT.exe
  C:\Windows\System\ucTeDrT.exe
  2⤵
  PID:2544
- C:\Windows\System\zGSiYpO.exe
  C:\Windows\System\zGSiYpO.exe
  2⤵
  PID:1692
- C:\Windows\System\EQPegll.exe
  C:\Windows\System\EQPegll.exe
  2⤵
  PID:3140
- C:\Windows\System\xAeqgDj.exe
  C:\Windows\System\xAeqgDj.exe
  2⤵
  PID:4272
- C:\Windows\System\ySBkmsk.exe
  C:\Windows\System\ySBkmsk.exe
  2⤵
  PID:5148
- C:\Windows\System\FFGZGwU.exe
  C:\Windows\System\FFGZGwU.exe
  2⤵
  PID:5160
- C:\Windows\System\fgUJbUv.exe
  C:\Windows\System\fgUJbUv.exe
  2⤵
  PID:5504
- C:\Windows\System\fcOsHBJ.exe
  C:\Windows\System\fcOsHBJ.exe
  2⤵
  PID:4920
- C:\Windows\System\fsJqyee.exe
  C:\Windows\System\fsJqyee.exe
  2⤵
  PID:2128
- C:\Windows\System\RykCfnW.exe
  C:\Windows\System\RykCfnW.exe
  2⤵
  PID:3096
- C:\Windows\System\CACmFET.exe
  C:\Windows\System\CACmFET.exe
  2⤵
  PID:4320
- C:\Windows\System\YHdeFah.exe
  C:\Windows\System\YHdeFah.exe
  2⤵
  PID:5708
- C:\Windows\System\dzquriQ.exe
  C:\Windows\System\dzquriQ.exe
  2⤵
  PID:5752
- C:\Windows\System\MZFSGMy.exe
  C:\Windows\System\MZFSGMy.exe
  2⤵
  PID:3340
- C:\Windows\System\HOlQoox.exe
  C:\Windows\System\HOlQoox.exe
  2⤵
  PID:5788
- C:\Windows\System\WheOMHm.exe
  C:\Windows\System\WheOMHm.exe
  2⤵
  PID:5568
- C:\Windows\System\zUqjknM.exe
  C:\Windows\System\zUqjknM.exe
  2⤵
  PID:5800
- C:\Windows\System\vyBlJbY.exe
  C:\Windows\System\vyBlJbY.exe
  2⤵
  PID:4744
- C:\Windows\System\umPXCZV.exe
  C:\Windows\System\umPXCZV.exe
  2⤵
  PID:1600
- C:\Windows\System\aiAWoxt.exe
  C:\Windows\System\aiAWoxt.exe
  2⤵
  PID:1940
- C:\Windows\System\MvgCRSu.exe
  C:\Windows\System\MvgCRSu.exe
  2⤵
  PID:5644
- C:\Windows\System\ExMRTrf.exe
  C:\Windows\System\ExMRTrf.exe
  2⤵
  PID:5364
- C:\Windows\System\uBjsWHr.exe
  C:\Windows\System\uBjsWHr.exe
  2⤵
  PID:3356
- C:\Windows\System\anznDcZ.exe
  C:\Windows\System\anznDcZ.exe
  2⤵
  PID:4764
- C:\Windows\System\KOeIChF.exe
  C:\Windows\System\KOeIChF.exe
  2⤵
  PID:5904
- C:\Windows\System\VtpnlYh.exe
  C:\Windows\System\VtpnlYh.exe
  2⤵
  PID:6164
- C:\Windows\System\UjCYTyd.exe
  C:\Windows\System\UjCYTyd.exe
  2⤵
  PID:6180
- C:\Windows\System\XRDmwdy.exe
  C:\Windows\System\XRDmwdy.exe
  2⤵
  PID:6208
- C:\Windows\System\pdBOdkb.exe
  C:\Windows\System\pdBOdkb.exe
  2⤵
  PID:6224
- C:\Windows\System\rVfccax.exe
  C:\Windows\System\rVfccax.exe
  2⤵
  PID:6252
- C:\Windows\System\bSjhxgD.exe
  C:\Windows\System\bSjhxgD.exe
  2⤵
  PID:6272
- C:\Windows\System\kLMOOxR.exe
  C:\Windows\System\kLMOOxR.exe
  2⤵
  PID:6300
- C:\Windows\System\PVuIWiJ.exe
  C:\Windows\System\PVuIWiJ.exe
  2⤵
  PID:6316
- C:\Windows\System\iaReyFo.exe
  C:\Windows\System\iaReyFo.exe
  2⤵
  PID:6340
- C:\Windows\System\GnGuckG.exe
  C:\Windows\System\GnGuckG.exe
  2⤵
  PID:6360
- C:\Windows\System\jqGANdI.exe
  C:\Windows\System\jqGANdI.exe
  2⤵
  PID:6376
- C:\Windows\System\UQluiCY.exe
  C:\Windows\System\UQluiCY.exe
  2⤵
  PID:6404
- C:\Windows\System\QxVKnyc.exe
  C:\Windows\System\QxVKnyc.exe
  2⤵
  PID:6424
- C:\Windows\System\dIsDZVS.exe
  C:\Windows\System\dIsDZVS.exe
  2⤵
  PID:6444
- C:\Windows\System\afLjdPy.exe
  C:\Windows\System\afLjdPy.exe
  2⤵
  PID:6472
- C:\Windows\System\ykHfXQS.exe
  C:\Windows\System\ykHfXQS.exe
  2⤵
  PID:6492
- C:\Windows\System\QaYUfVA.exe
  C:\Windows\System\QaYUfVA.exe
  2⤵
  PID:6520
- C:\Windows\System\UmmOcqp.exe
  C:\Windows\System\UmmOcqp.exe
  2⤵
  PID:6540
- C:\Windows\System\PkDhxan.exe
  C:\Windows\System\PkDhxan.exe
  2⤵
  PID:6564
- C:\Windows\System\BCpYRfR.exe
  C:\Windows\System\BCpYRfR.exe
  2⤵
  PID:6580
- C:\Windows\System\HqukKnA.exe
  C:\Windows\System\HqukKnA.exe
  2⤵
  PID:6604
- C:\Windows\System\PhRjSHO.exe
  C:\Windows\System\PhRjSHO.exe
  2⤵
  PID:6624
- C:\Windows\System\KWgePDE.exe
  C:\Windows\System\KWgePDE.exe
  2⤵
  PID:6660
- C:\Windows\System\OWyNsGP.exe
  C:\Windows\System\OWyNsGP.exe
  2⤵
  PID:6680
- C:\Windows\System\yHjwuVG.exe
  C:\Windows\System\yHjwuVG.exe
  2⤵
  PID:6708
- C:\Windows\System\xTciRAx.exe
  C:\Windows\System\xTciRAx.exe
  2⤵
  PID:6728
- C:\Windows\System\kbPgBAX.exe
  C:\Windows\System\kbPgBAX.exe
  2⤵
  PID:6752
- C:\Windows\System\UQaHaCm.exe
  C:\Windows\System\UQaHaCm.exe
  2⤵
  PID:6768
- C:\Windows\System\zNcvgvN.exe
  C:\Windows\System\zNcvgvN.exe
  2⤵
  PID:6792
- C:\Windows\System\GBdYRFd.exe
  C:\Windows\System\GBdYRFd.exe
  2⤵
  PID:6808
- C:\Windows\System\NSGJksQ.exe
  C:\Windows\System\NSGJksQ.exe
  2⤵
  PID:6832
- C:\Windows\System\jtjauio.exe
  C:\Windows\System\jtjauio.exe
  2⤵
  PID:6856
- C:\Windows\System\NpaYmIp.exe
  C:\Windows\System\NpaYmIp.exe
  2⤵
  PID:6876
- C:\Windows\System\xXNqsEA.exe
  C:\Windows\System\xXNqsEA.exe
  2⤵
  PID:6900
- C:\Windows\System\rkxJABZ.exe
  C:\Windows\System\rkxJABZ.exe
  2⤵
  PID:6920
- C:\Windows\System\nWcfMkp.exe
  C:\Windows\System\nWcfMkp.exe
  2⤵
  PID:6940
- C:\Windows\System\hYsLgZE.exe
  C:\Windows\System\hYsLgZE.exe
  2⤵
  PID:6972
- C:\Windows\System\WPJElez.exe
  C:\Windows\System\WPJElez.exe
  2⤵
  PID:7000
- C:\Windows\System\ejagWrA.exe
  C:\Windows\System\ejagWrA.exe
  2⤵
  PID:7020
- C:\Windows\System\kGTbQav.exe
  C:\Windows\System\kGTbQav.exe
  2⤵
  PID:7044
- C:\Windows\System\YySfBcq.exe
  C:\Windows\System\YySfBcq.exe
  2⤵
  PID:7064
- C:\Windows\System\sCwrCmN.exe
  C:\Windows\System\sCwrCmN.exe
  2⤵
  PID:7084
- C:\Windows\System\SziVKqE.exe
  C:\Windows\System\SziVKqE.exe
  2⤵
  PID:7104
- C:\Windows\System\CMvUVoe.exe
  C:\Windows\System\CMvUVoe.exe
  2⤵
  PID:7124
- C:\Windows\System\WgCsSSM.exe
  C:\Windows\System\WgCsSSM.exe
  2⤵
  PID:7148
- C:\Windows\System\funBpwW.exe
  C:\Windows\System\funBpwW.exe
  2⤵
  PID:5936
- C:\Windows\System\eiAiaRE.exe
  C:\Windows\System\eiAiaRE.exe
  2⤵
  PID:5380
- C:\Windows\System\vhoffDB.exe
  C:\Windows\System\vhoffDB.exe
  2⤵
  PID:968
- C:\Windows\System\VJpmLmA.exe
  C:\Windows\System\VJpmLmA.exe
  2⤵
  PID:3536
- C:\Windows\System\KmzNJkb.exe
  C:\Windows\System\KmzNJkb.exe
  2⤵
  PID:5544
- C:\Windows\System\xRipuCs.exe
  C:\Windows\System\xRipuCs.exe
  2⤵
  PID:5640
- C:\Windows\System\fRYEzQE.exe
  C:\Windows\System\fRYEzQE.exe
  2⤵
  PID:3840
- C:\Windows\System\kNPRntI.exe
  C:\Windows\System\kNPRntI.exe
  2⤵
  PID:5776
- C:\Windows\System\QJrknfs.exe
  C:\Windows\System\QJrknfs.exe
  2⤵
  PID:5900
- C:\Windows\System\orypyZh.exe
  C:\Windows\System\orypyZh.exe
  2⤵
  PID:5772
- C:\Windows\System\ijZGLXU.exe
  C:\Windows\System\ijZGLXU.exe
  2⤵
  PID:5952
- C:\Windows\System\FdNerlL.exe
  C:\Windows\System\FdNerlL.exe
  2⤵
  PID:6176
- C:\Windows\System\dOSjptV.exe
  C:\Windows\System\dOSjptV.exe
  2⤵
  PID:6216
- C:\Windows\System\ChRtvoN.exe
  C:\Windows\System\ChRtvoN.exe
  2⤵
  PID:7280
- C:\Windows\System\GVlXQfe.exe
  C:\Windows\System\GVlXQfe.exe
  2⤵
  PID:7364
- C:\Windows\System\ztUfIDq.exe
  C:\Windows\System\ztUfIDq.exe
  2⤵
  PID:7380
- C:\Windows\System\pAQFGoT.exe
  C:\Windows\System\pAQFGoT.exe
  2⤵
  PID:7396
- C:\Windows\System\jnxvzqj.exe
  C:\Windows\System\jnxvzqj.exe
  2⤵
  PID:7432
- C:\Windows\System\zNgAbju.exe
  C:\Windows\System\zNgAbju.exe
  2⤵
  PID:7448
- C:\Windows\System\ZVFGoJh.exe
  C:\Windows\System\ZVFGoJh.exe
  2⤵
  PID:7476
- C:\Windows\System\OWrWcrA.exe
  C:\Windows\System\OWrWcrA.exe
  2⤵
  PID:7496
- C:\Windows\System\gkGanHp.exe
  C:\Windows\System\gkGanHp.exe
  2⤵
  PID:7584
- C:\Windows\System\UoInlcO.exe
  C:\Windows\System\UoInlcO.exe
  2⤵
  PID:7620
- C:\Windows\System\klIjSbJ.exe
  C:\Windows\System\klIjSbJ.exe
  2⤵
  PID:7648
- C:\Windows\System\OZGXRLG.exe
  C:\Windows\System\OZGXRLG.exe
  2⤵
  PID:7676
- C:\Windows\System\VLFKxBw.exe
  C:\Windows\System\VLFKxBw.exe
  2⤵
  PID:7696
- C:\Windows\System\jvALeFb.exe
  C:\Windows\System\jvALeFb.exe
  2⤵
  PID:7716
- C:\Windows\System\JCAlKQE.exe
  C:\Windows\System\JCAlKQE.exe
  2⤵
  PID:7732
- C:\Windows\System\rMhsPIY.exe
  C:\Windows\System\rMhsPIY.exe
  2⤵
  PID:7752
- C:\Windows\System\YaSWDON.exe
  C:\Windows\System\YaSWDON.exe
  2⤵
  PID:7776
- C:\Windows\System\YUQHrSh.exe
  C:\Windows\System\YUQHrSh.exe
  2⤵
  PID:7800
- C:\Windows\System\kEsUThM.exe
  C:\Windows\System\kEsUThM.exe
  2⤵
  PID:7820
- C:\Windows\System\WCqxllU.exe
  C:\Windows\System\WCqxllU.exe
  2⤵
  PID:7840
- C:\Windows\System\PGQPYpp.exe
  C:\Windows\System\PGQPYpp.exe
  2⤵
  PID:7864
- C:\Windows\System\JTisiCm.exe
  C:\Windows\System\JTisiCm.exe
  2⤵
  PID:7884
- C:\Windows\System\XKtYjjT.exe
  C:\Windows\System\XKtYjjT.exe
  2⤵
  PID:7916
- C:\Windows\System\uBVkwvy.exe
  C:\Windows\System\uBVkwvy.exe
  2⤵
  PID:7944
- C:\Windows\System\uqeJczY.exe
  C:\Windows\System\uqeJczY.exe
  2⤵
  PID:7968
- C:\Windows\System\JYDelPx.exe
  C:\Windows\System\JYDelPx.exe
  2⤵
  PID:7988
- C:\Windows\System\rUALebw.exe
  C:\Windows\System\rUALebw.exe
  2⤵
  PID:8020
- C:\Windows\System\canXlge.exe
  C:\Windows\System\canXlge.exe
  2⤵
  PID:8044
- C:\Windows\System\QlVruYR.exe
  C:\Windows\System\QlVruYR.exe
  2⤵
  PID:8060
- C:\Windows\System\GJylJCe.exe
  C:\Windows\System\GJylJCe.exe
  2⤵
  PID:8076
- C:\Windows\System\adWOGTc.exe
  C:\Windows\System\adWOGTc.exe
  2⤵
  PID:8116
- C:\Windows\System\wZpzWLf.exe
  C:\Windows\System\wZpzWLf.exe
  2⤵
  PID:8140
- C:\Windows\System\zPQAgVg.exe
  C:\Windows\System\zPQAgVg.exe
  2⤵
  PID:8168
- C:\Windows\System\mAxqSSV.exe
  C:\Windows\System\mAxqSSV.exe
  2⤵
  PID:8184
- C:\Windows\System\hRrnsnM.exe
  C:\Windows\System\hRrnsnM.exe
  2⤵
  PID:7080
- C:\Windows\System\HExvgbQ.exe
  C:\Windows\System\HExvgbQ.exe
  2⤵
  PID:556
- C:\Windows\System\VezIkra.exe
  C:\Windows\System\VezIkra.exe
  2⤵
  PID:5388
- C:\Windows\System\UJVFMLu.exe
  C:\Windows\System\UJVFMLu.exe
  2⤵
  PID:7056
- C:\Windows\System\dmaPZIi.exe
  C:\Windows\System\dmaPZIi.exe
  2⤵
  PID:3704
- C:\Windows\System\RapvEHj.exe
  C:\Windows\System\RapvEHj.exe
  2⤵
  PID:5840
- C:\Windows\System\KmSDyzD.exe
  C:\Windows\System\KmSDyzD.exe
  2⤵
  PID:5408
- C:\Windows\System\ltCawqE.exe
  C:\Windows\System\ltCawqE.exe
  2⤵
  PID:416
- C:\Windows\System\vWugrtL.exe
  C:\Windows\System\vWugrtL.exe
  2⤵
  PID:6968
- C:\Windows\System\FrghtXP.exe
  C:\Windows\System\FrghtXP.exe
  2⤵
  PID:5688
- C:\Windows\System\LFcULvk.exe
  C:\Windows\System\LFcULvk.exe
  2⤵
  PID:7136
- C:\Windows\System\NrbIChA.exe
  C:\Windows\System\NrbIChA.exe
  2⤵
  PID:7408
- C:\Windows\System\AhLMoft.exe
  C:\Windows\System\AhLMoft.exe
  2⤵
  PID:7440
- C:\Windows\System\RRwxKCd.exe
  C:\Windows\System\RRwxKCd.exe
  2⤵
  PID:5868
- C:\Windows\System\nMurglm.exe
  C:\Windows\System\nMurglm.exe
  2⤵
  PID:4376
- C:\Windows\System\TjXOnDt.exe
  C:\Windows\System\TjXOnDt.exe
  2⤵
  PID:7100
- C:\Windows\System\gHQIuuM.exe
  C:\Windows\System\gHQIuuM.exe
  2⤵
  PID:5608
- C:\Windows\System\KovHocc.exe
  C:\Windows\System\KovHocc.exe
  2⤵
  PID:6004
- C:\Windows\System\BNPZRho.exe
  C:\Windows\System\BNPZRho.exe
  2⤵
  PID:4448
- C:\Windows\System\HSDPWnj.exe
  C:\Windows\System\HSDPWnj.exe
  2⤵
  PID:7296
- C:\Windows\System\wCmyfSU.exe
  C:\Windows\System\wCmyfSU.exe
  2⤵
  PID:7316
- C:\Windows\System\mNGjNaQ.exe
  C:\Windows\System\mNGjNaQ.exe
  2⤵
  PID:5888
- C:\Windows\System\CuIfXLo.exe
  C:\Windows\System\CuIfXLo.exe
  2⤵
  PID:7340
- C:\Windows\System\ZvpNSeF.exe
  C:\Windows\System\ZvpNSeF.exe
  2⤵
  PID:7376
- C:\Windows\System\AxmQVwf.exe
  C:\Windows\System\AxmQVwf.exe
  2⤵
  PID:7464
- C:\Windows\System\PvZkKXt.exe
  C:\Windows\System\PvZkKXt.exe
  2⤵
  PID:6312
- C:\Windows\System\jxYTGFf.exe
  C:\Windows\System\jxYTGFf.exe
  2⤵
  PID:6560
- C:\Windows\System\jZLcjMS.exe
  C:\Windows\System\jZLcjMS.exe
  2⤵
  PID:8016
- C:\Windows\System\zyaWNLw.exe
  C:\Windows\System\zyaWNLw.exe
  2⤵
  PID:7748
- C:\Windows\System\BSLxQXV.exe
  C:\Windows\System\BSLxQXV.exe
  2⤵
  PID:8152
- C:\Windows\System\FSyUzET.exe
  C:\Windows\System\FSyUzET.exe
  2⤵
  PID:7812
- C:\Windows\System\wQdDJDT.exe
  C:\Windows\System\wQdDJDT.exe
  2⤵
  PID:7904
- C:\Windows\System\AGXxMsc.exe
  C:\Windows\System\AGXxMsc.exe
  2⤵
  PID:7980
- C:\Windows\System\niOqTeZ.exe
  C:\Windows\System\niOqTeZ.exe
  2⤵
  PID:8208
- C:\Windows\System\BbGVbXa.exe
  C:\Windows\System\BbGVbXa.exe
  2⤵
  PID:8232
- C:\Windows\System\ObCDRWp.exe
  C:\Windows\System\ObCDRWp.exe
  2⤵
  PID:8256
- C:\Windows\System\tANpUPj.exe
  C:\Windows\System\tANpUPj.exe
  2⤵
  PID:8284
- C:\Windows\System\JXGNRTQ.exe
  C:\Windows\System\JXGNRTQ.exe
  2⤵
  PID:8300
- C:\Windows\System\QmtSTVb.exe
  C:\Windows\System\QmtSTVb.exe
  2⤵
  PID:8332
- C:\Windows\System\tctxhuq.exe
  C:\Windows\System\tctxhuq.exe
  2⤵
  PID:8352
- C:\Windows\System\GujpLjR.exe
  C:\Windows\System\GujpLjR.exe
  2⤵
  PID:8380
- C:\Windows\System\NvZfimS.exe
  C:\Windows\System\NvZfimS.exe
  2⤵
  PID:8404
- C:\Windows\System\jrFugRe.exe
  C:\Windows\System\jrFugRe.exe
  2⤵
  PID:8424
- C:\Windows\System\iLXVCdg.exe
  C:\Windows\System\iLXVCdg.exe
  2⤵
  PID:8452
- C:\Windows\System\iMnDfnt.exe
  C:\Windows\System\iMnDfnt.exe
  2⤵
  PID:8472
- C:\Windows\System\URujJHj.exe
  C:\Windows\System\URujJHj.exe
  2⤵
  PID:8492
- C:\Windows\System\cxKcGwV.exe
  C:\Windows\System\cxKcGwV.exe
  2⤵
  PID:8508
- C:\Windows\System\mRNNTYB.exe
  C:\Windows\System\mRNNTYB.exe
  2⤵
  PID:8528
- C:\Windows\System\VwhbGec.exe
  C:\Windows\System\VwhbGec.exe
  2⤵
  PID:8552
- C:\Windows\System\aDXVSyd.exe
  C:\Windows\System\aDXVSyd.exe
  2⤵
  PID:8568
- C:\Windows\System\hxSBCpc.exe
  C:\Windows\System\hxSBCpc.exe
  2⤵
  PID:8592
- C:\Windows\System\ohGMRdA.exe
  C:\Windows\System\ohGMRdA.exe
  2⤵
  PID:8612
- C:\Windows\System\StasgVE.exe
  C:\Windows\System\StasgVE.exe
  2⤵
  PID:8636
- C:\Windows\System\CwbUDXW.exe
  C:\Windows\System\CwbUDXW.exe
  2⤵
  PID:8652
- C:\Windows\System\QKyCgQY.exe
  C:\Windows\System\QKyCgQY.exe
  2⤵
  PID:8676
- C:\Windows\System\mvuhLlm.exe
  C:\Windows\System\mvuhLlm.exe
  2⤵
  PID:8696
- C:\Windows\System\AjRckag.exe
  C:\Windows\System\AjRckag.exe
  2⤵
  PID:8720
- C:\Windows\System\nNxjByR.exe
  C:\Windows\System\nNxjByR.exe
  2⤵
  PID:8740
- C:\Windows\System\sSXxEQd.exe
  C:\Windows\System\sSXxEQd.exe
  2⤵
  PID:8760
- C:\Windows\System\BavCADv.exe
  C:\Windows\System\BavCADv.exe
  2⤵
  PID:8776
- C:\Windows\System\RuBVkel.exe
  C:\Windows\System\RuBVkel.exe
  2⤵
  PID:8804
- C:\Windows\System\NBTVyha.exe
  C:\Windows\System\NBTVyha.exe
  2⤵
  PID:8836
- C:\Windows\System\uNZyove.exe
  C:\Windows\System\uNZyove.exe
  2⤵
  PID:8868
- C:\Windows\System\oRxuKlj.exe
  C:\Windows\System\oRxuKlj.exe
  2⤵
  PID:9084
- C:\Windows\System\kORZoyb.exe
  C:\Windows\System\kORZoyb.exe
  2⤵
  PID:9108
- C:\Windows\System\HFgdUNS.exe
  C:\Windows\System\HFgdUNS.exe
  2⤵
  PID:9136
- C:\Windows\System\peGJPVx.exe
  C:\Windows\System\peGJPVx.exe
  2⤵
  PID:9152
- C:\Windows\System\nAbAXom.exe
  C:\Windows\System\nAbAXom.exe
  2⤵
  PID:9180
- C:\Windows\System\pyepuYg.exe
  C:\Windows\System\pyepuYg.exe
  2⤵
  PID:9196
- C:\Windows\System\vvjhNkv.exe
  C:\Windows\System\vvjhNkv.exe
  2⤵
  PID:5212
- C:\Windows\System\sDUxsmA.exe
  C:\Windows\System\sDUxsmA.exe
  2⤵
  PID:8036
- C:\Windows\System\ANesvyz.exe
  C:\Windows\System\ANesvyz.exe
  2⤵
  PID:7492
- C:\Windows\System\NluSaJd.exe
  C:\Windows\System\NluSaJd.exe
  2⤵
  PID:2108
- C:\Windows\System\jyqmmlh.exe
  C:\Windows\System\jyqmmlh.exe
  2⤵
  PID:8100
- C:\Windows\System\uUopjCh.exe
  C:\Windows\System\uUopjCh.exe
  2⤵
  PID:7724
- C:\Windows\System\mPsoNNL.exe
  C:\Windows\System\mPsoNNL.exe
  2⤵
  PID:7600
- C:\Windows\System\TSoszDh.exe
  C:\Windows\System\TSoszDh.exe
  2⤵
  PID:7836
- C:\Windows\System\bgCdOom.exe
  C:\Windows\System\bgCdOom.exe
  2⤵
  PID:6988
- C:\Windows\System\SUaEImK.exe
  C:\Windows\System\SUaEImK.exe
  2⤵
  PID:8228
- C:\Windows\System\hyFVltL.exe
  C:\Windows\System\hyFVltL.exe
  2⤵
  PID:8000
- C:\Windows\System\APoKIhP.exe
  C:\Windows\System\APoKIhP.exe
  2⤵
  PID:8468
- C:\Windows\System\jYXOoyw.exe
  C:\Windows\System\jYXOoyw.exe
  2⤵
  PID:7568
- C:\Windows\System\alJyHSn.exe
  C:\Windows\System\alJyHSn.exe
  2⤵
  PID:8128
- C:\Windows\System\dsaTGZe.exe
  C:\Windows\System\dsaTGZe.exe
  2⤵
  PID:7060
- C:\Windows\System\qWbKpnP.exe
  C:\Windows\System\qWbKpnP.exe
  2⤵
  PID:8800
- C:\Windows\System\YtCOcrx.exe
  C:\Windows\System\YtCOcrx.exe
  2⤵
  PID:8852
- C:\Windows\System\ZmplKNn.exe
  C:\Windows\System\ZmplKNn.exe
  2⤵
  PID:7164
- C:\Windows\System\NWzTgFx.exe
  C:\Windows\System\NWzTgFx.exe
  2⤵
  PID:8908
- C:\Windows\System\iCsKJid.exe
  C:\Windows\System\iCsKJid.exe
  2⤵
  PID:8920
- C:\Windows\System\ysjEXzc.exe
  C:\Windows\System\ysjEXzc.exe
  2⤵
  PID:8948
- C:\Windows\System\fAQKqoS.exe
  C:\Windows\System\fAQKqoS.exe
  2⤵
  PID:8324
- C:\Windows\System\nVSGVxm.exe
  C:\Windows\System\nVSGVxm.exe
  2⤵
  PID:8388
- C:\Windows\System\wqbqFef.exe
  C:\Windows\System\wqbqFef.exe
  2⤵
  PID:2624
- C:\Windows\System\fwPMNka.exe
  C:\Windows\System\fwPMNka.exe
  2⤵
  PID:8440
- C:\Windows\System\LizXvkX.exe
  C:\Windows\System\LizXvkX.exe
  2⤵
  PID:9232
- C:\Windows\System\HjyDvdr.exe
  C:\Windows\System\HjyDvdr.exe
  2⤵
  PID:9248
- C:\Windows\System\qDDqcRH.exe
  C:\Windows\System\qDDqcRH.exe
  2⤵
  PID:9268
- C:\Windows\System\hzcSdEy.exe
  C:\Windows\System\hzcSdEy.exe
  2⤵
  PID:9284
- C:\Windows\System\BbgARKI.exe
  C:\Windows\System\BbgARKI.exe
  2⤵
  PID:9304
- C:\Windows\System\dQwOdFS.exe
  C:\Windows\System\dQwOdFS.exe
  2⤵
  PID:9328
- C:\Windows\System\sNtDqiW.exe
  C:\Windows\System\sNtDqiW.exe
  2⤵
  PID:9348
- C:\Windows\System\qjArcSQ.exe
  C:\Windows\System\qjArcSQ.exe
  2⤵
  PID:9368
- C:\Windows\System\QWpSlES.exe
  C:\Windows\System\QWpSlES.exe
  2⤵
  PID:9416
- C:\Windows\System\rAMSnQx.exe
  C:\Windows\System\rAMSnQx.exe
  2⤵
  PID:9440
- C:\Windows\System\hbEAPui.exe
  C:\Windows\System\hbEAPui.exe
  2⤵
  PID:9472
- C:\Windows\System\XDoovzJ.exe
  C:\Windows\System\XDoovzJ.exe
  2⤵
  PID:9492
- C:\Windows\System\WkKtBmJ.exe
  C:\Windows\System\WkKtBmJ.exe
  2⤵
  PID:9512
- C:\Windows\System\FmNDYJy.exe
  C:\Windows\System\FmNDYJy.exe
  2⤵
  PID:9536
- C:\Windows\System\nkZeNcJ.exe
  C:\Windows\System\nkZeNcJ.exe
  2⤵
  PID:9560
- C:\Windows\System\bahUGBV.exe
  C:\Windows\System\bahUGBV.exe
  2⤵
  PID:9580
- C:\Windows\System\TqidGCW.exe
  C:\Windows\System\TqidGCW.exe
  2⤵
  PID:9604
- C:\Windows\System\BGcNGlG.exe
  C:\Windows\System\BGcNGlG.exe
  2⤵
  PID:9624
- C:\Windows\System\rdEwQOL.exe
  C:\Windows\System\rdEwQOL.exe
  2⤵
  PID:9644
- C:\Windows\System\VmVZxTo.exe
  C:\Windows\System\VmVZxTo.exe
  2⤵
  PID:9672
- C:\Windows\System\tdTlTwQ.exe
  C:\Windows\System\tdTlTwQ.exe
  2⤵
  PID:9692
- C:\Windows\System\ypxLCtx.exe
  C:\Windows\System\ypxLCtx.exe
  2⤵
  PID:9708
- C:\Windows\System\UirEHsv.exe
  C:\Windows\System\UirEHsv.exe
  2⤵
  PID:9732
- C:\Windows\System\CIzWCdP.exe
  C:\Windows\System\CIzWCdP.exe
  2⤵
  PID:9752
- C:\Windows\System\NVytWWq.exe
  C:\Windows\System\NVytWWq.exe
  2⤵
  PID:9776
- C:\Windows\System\gSYityy.exe
  C:\Windows\System\gSYityy.exe
  2⤵
  PID:9796
- C:\Windows\System\fagOGvJ.exe
  C:\Windows\System\fagOGvJ.exe
  2⤵
  PID:9812
- C:\Windows\System\mHzeCAJ.exe
  C:\Windows\System\mHzeCAJ.exe
  2⤵
  PID:9836
- C:\Windows\System\MnANBOq.exe
  C:\Windows\System\MnANBOq.exe
  2⤵
  PID:9856
- C:\Windows\System\ryzZkla.exe
  C:\Windows\System\ryzZkla.exe
  2⤵
  PID:9876
- C:\Windows\System\jZwjixT.exe
  C:\Windows\System\jZwjixT.exe
  2⤵
  PID:9912
- C:\Windows\System\LInhlhY.exe
  C:\Windows\System\LInhlhY.exe
  2⤵
  PID:9932
- C:\Windows\System\IqzFBqv.exe
  C:\Windows\System\IqzFBqv.exe
  2⤵
  PID:9956
- C:\Windows\System\IXEjIOG.exe
  C:\Windows\System\IXEjIOG.exe
  2⤵
  PID:9972
- C:\Windows\System\MwJkfAG.exe
  C:\Windows\System\MwJkfAG.exe
  2⤵
  PID:9996
- C:\Windows\System\elosVzR.exe
  C:\Windows\System\elosVzR.exe
  2⤵
  PID:10016
- C:\Windows\System\rDInBqr.exe
  C:\Windows\System\rDInBqr.exe
  2⤵
  PID:10036
- C:\Windows\System\mGNjXSo.exe
  C:\Windows\System\mGNjXSo.exe
  2⤵
  PID:10060
- C:\Windows\System\zxaUIaJ.exe
  C:\Windows\System\zxaUIaJ.exe
  2⤵
  PID:10104
- C:\Windows\System\GcwpIkf.exe
  C:\Windows\System\GcwpIkf.exe
  2⤵
  PID:10120
- C:\Windows\System\tXBKkRG.exe
  C:\Windows\System\tXBKkRG.exe
  2⤵
  PID:10140
- C:\Windows\System\gZsvNUT.exe
  C:\Windows\System\gZsvNUT.exe
  2⤵
  PID:10160
- C:\Windows\System\NIQSzDI.exe
  C:\Windows\System\NIQSzDI.exe
  2⤵
  PID:10184
- C:\Windows\System\MHNChvp.exe
  C:\Windows\System\MHNChvp.exe
  2⤵
  PID:10204
- C:\Windows\System\qYfsqvG.exe
  C:\Windows\System\qYfsqvG.exe
  2⤵
  PID:10224
- C:\Windows\System\GxYsBap.exe
  C:\Windows\System\GxYsBap.exe
  2⤵
  PID:8524
- C:\Windows\System\BiIsUUY.exe
  C:\Windows\System\BiIsUUY.exe
  2⤵
  PID:8564
- C:\Windows\System\PUOrxdS.exe
  C:\Windows\System\PUOrxdS.exe
  2⤵
  PID:8604
- C:\Windows\System\JrnGgqR.exe
  C:\Windows\System\JrnGgqR.exe
  2⤵
  PID:8716
- C:\Windows\System\IiNmJpK.exe
  C:\Windows\System\IiNmJpK.exe
  2⤵
  PID:7712
- C:\Windows\System\RoqViOv.exe
  C:\Windows\System\RoqViOv.exe
  2⤵
  PID:9132
- C:\Windows\System\IWGsdnO.exe
  C:\Windows\System\IWGsdnO.exe
  2⤵
  PID:9172
- C:\Windows\System\Vdxdjyn.exe
  C:\Windows\System\Vdxdjyn.exe
  2⤵
  PID:9192
- C:\Windows\System\SSmiozw.exe
  C:\Windows\System\SSmiozw.exe
  2⤵
  PID:8008
- C:\Windows\System\nQYtsEj.exe
  C:\Windows\System\nQYtsEj.exe
  2⤵
  PID:7672
- C:\Windows\System\cZJeGOS.exe
  C:\Windows\System\cZJeGOS.exe
  2⤵
  PID:5600
- C:\Windows\System\YQjimoo.exe
  C:\Windows\System\YQjimoo.exe
  2⤵
  PID:5700
- C:\Windows\System\VKsWdsq.exe
  C:\Windows\System\VKsWdsq.exe
  2⤵
  PID:8264
- C:\Windows\System\lYMpsTo.exe
  C:\Windows\System\lYMpsTo.exe
  2⤵
  PID:7964
- C:\Windows\System\ZnFfMjm.exe
  C:\Windows\System\ZnFfMjm.exe
  2⤵
  PID:6400
- C:\Windows\System\QgOWpWh.exe
  C:\Windows\System\QgOWpWh.exe
  2⤵
  PID:8960
- C:\Windows\System\HMAArPw.exe
  C:\Windows\System\HMAArPw.exe
  2⤵
  PID:8888
- C:\Windows\System\UNceeeI.exe
  C:\Windows\System\UNceeeI.exe
  2⤵
  PID:8160
- C:\Windows\System\NCkFqMi.exe
  C:\Windows\System\NCkFqMi.exe
  2⤵
  PID:8480
- C:\Windows\System\kYZpNNl.exe
  C:\Windows\System\kYZpNNl.exe
  2⤵
  PID:8396
- C:\Windows\System\cDmObmI.exe
  C:\Windows\System\cDmObmI.exe
  2⤵
  PID:9256
- C:\Windows\System\EBSgegO.exe
  C:\Windows\System\EBSgegO.exe
  2⤵
  PID:9300
- C:\Windows\System\iKOmBTk.exe
  C:\Windows\System\iKOmBTk.exe
  2⤵
  PID:8608
- C:\Windows\System\FdttHYH.exe
  C:\Windows\System\FdttHYH.exe
  2⤵
  PID:8668
- C:\Windows\System\cLbYhKd.exe
  C:\Windows\System\cLbYhKd.exe
  2⤵
  PID:9056
- C:\Windows\System\eSlCgOg.exe
  C:\Windows\System\eSlCgOg.exe
  2⤵
  PID:10244
- C:\Windows\System\Llvyvzn.exe
  C:\Windows\System\Llvyvzn.exe
  2⤵
  PID:10260
- C:\Windows\System\OtBCPED.exe
  C:\Windows\System\OtBCPED.exe
  2⤵
  PID:10280
- C:\Windows\System\JdJERAN.exe
  C:\Windows\System\JdJERAN.exe
  2⤵
  PID:10304
- C:\Windows\System\ZsLASzf.exe
  C:\Windows\System\ZsLASzf.exe
  2⤵
  PID:10320
- C:\Windows\System\QWTImPS.exe
  C:\Windows\System\QWTImPS.exe
  2⤵
  PID:10344
- C:\Windows\System\mCCZWjA.exe
  C:\Windows\System\mCCZWjA.exe
  2⤵
  PID:10364
- C:\Windows\System\aAItjyH.exe
  C:\Windows\System\aAItjyH.exe
  2⤵
  PID:10384
- C:\Windows\System\XXYDYor.exe
  C:\Windows\System\XXYDYor.exe
  2⤵
  PID:10404
- C:\Windows\System\vsyGnZY.exe
  C:\Windows\System\vsyGnZY.exe
  2⤵
  PID:10424
- C:\Windows\System\hiDabNu.exe
  C:\Windows\System\hiDabNu.exe
  2⤵
  PID:10448
- C:\Windows\System\hkdXUhn.exe
  C:\Windows\System\hkdXUhn.exe
  2⤵
  PID:10464
- C:\Windows\System\GGCCtxP.exe
  C:\Windows\System\GGCCtxP.exe
  2⤵
  PID:10488
- C:\Windows\System\sgHxNOZ.exe
  C:\Windows\System\sgHxNOZ.exe
  2⤵
  PID:10508
- C:\Windows\System\WBWybGI.exe
  C:\Windows\System\WBWybGI.exe
  2⤵
  PID:10532
- C:\Windows\System\LzMnURP.exe
  C:\Windows\System\LzMnURP.exe
  2⤵
  PID:10556
- C:\Windows\System\BOAeyox.exe
  C:\Windows\System\BOAeyox.exe
  2⤵
  PID:10580
- C:\Windows\System\YkhxvCc.exe
  C:\Windows\System\YkhxvCc.exe
  2⤵
  PID:10600
- C:\Windows\System\mbZlopO.exe
  C:\Windows\System\mbZlopO.exe
  2⤵
  PID:10624
- C:\Windows\System\vezQVKb.exe
  C:\Windows\System\vezQVKb.exe
  2⤵
  PID:10640
- C:\Windows\System\qSQKbre.exe
  C:\Windows\System\qSQKbre.exe
  2⤵
  PID:10660
- C:\Windows\System\PnBpAPk.exe
  C:\Windows\System\PnBpAPk.exe
  2⤵
  PID:10680
- C:\Windows\System\GVDCmkX.exe
  C:\Windows\System\GVDCmkX.exe
  2⤵
  PID:10704
- C:\Windows\System\AMoJBbX.exe
  C:\Windows\System\AMoJBbX.exe
  2⤵
  PID:10724
- C:\Windows\System\lXOtSlH.exe
  C:\Windows\System\lXOtSlH.exe
  2⤵
  PID:10744
- C:\Windows\System\yBqvXEj.exe
  C:\Windows\System\yBqvXEj.exe
  2⤵
  PID:10764
- C:\Windows\System\ZmgTcxS.exe
  C:\Windows\System\ZmgTcxS.exe
  2⤵
  PID:10788
- C:\Windows\System\hVxDeHZ.exe
  C:\Windows\System\hVxDeHZ.exe
  2⤵
  PID:10812
- C:\Windows\System\KKDhtlV.exe
  C:\Windows\System\KKDhtlV.exe
  2⤵
  PID:10828
- C:\Windows\System\sDMJTTH.exe
  C:\Windows\System\sDMJTTH.exe
  2⤵
  PID:10848
- C:\Windows\System\mBvbWdW.exe
  C:\Windows\System\mBvbWdW.exe
  2⤵
  PID:10872
- C:\Windows\System\fWAZUQM.exe
  C:\Windows\System\fWAZUQM.exe
  2⤵
  PID:10896
- C:\Windows\System\hzaxPzs.exe
  C:\Windows\System\hzaxPzs.exe
  2⤵
  PID:10912
- C:\Windows\System\yRqjSSS.exe
  C:\Windows\System\yRqjSSS.exe
  2⤵
  PID:10928
- C:\Windows\System\Vtfctdf.exe
  C:\Windows\System\Vtfctdf.exe
  2⤵
  PID:10948
- C:\Windows\System\WyUIDWX.exe
  C:\Windows\System\WyUIDWX.exe
  2⤵
  PID:10996
- C:\Windows\System\mktDITL.exe
  C:\Windows\System\mktDITL.exe
  2⤵
  PID:11012
- C:\Windows\System\xLdCEvz.exe
  C:\Windows\System\xLdCEvz.exe
  2⤵
  PID:11032
- C:\Windows\System\fjHpQPD.exe
  C:\Windows\System\fjHpQPD.exe
  2⤵
  PID:11052
- C:\Windows\System\hWRbOjB.exe
  C:\Windows\System\hWRbOjB.exe
  2⤵
  PID:11076
- C:\Windows\System\LgBsKJZ.exe
  C:\Windows\System\LgBsKJZ.exe
  2⤵
  PID:11096
- C:\Windows\System\HskyDJb.exe
  C:\Windows\System\HskyDJb.exe
  2⤵
  PID:11116
- C:\Windows\System\HYbrqTp.exe
  C:\Windows\System\HYbrqTp.exe
  2⤵
  PID:11136
- C:\Windows\System\VKHRdsF.exe
  C:\Windows\System\VKHRdsF.exe
  2⤵
  PID:11156
- C:\Windows\System\ytnznvf.exe
  C:\Windows\System\ytnznvf.exe
  2⤵
  PID:11176
- C:\Windows\System\oTOaQyW.exe
  C:\Windows\System\oTOaQyW.exe
  2⤵
  PID:11200
- C:\Windows\System\EOHpDdr.exe
  C:\Windows\System\EOHpDdr.exe
  2⤵
  PID:11220
- C:\Windows\System\XOFhqlc.exe
  C:\Windows\System\XOFhqlc.exe
  2⤵
  PID:11248
- C:\Windows\System\YOZAsKd.exe
  C:\Windows\System\YOZAsKd.exe
  2⤵
  PID:9100
- C:\Windows\System\UKrcLZe.exe
  C:\Windows\System\UKrcLZe.exe
  2⤵
  PID:8752
- C:\Windows\System\eZFwPDr.exe
  C:\Windows\System\eZFwPDr.exe
  2⤵
  PID:9588
- C:\Windows\System\PmjHpBC.exe
  C:\Windows\System\PmjHpBC.exe
  2⤵
  PID:9640
- C:\Windows\System\dSCiSqP.exe
  C:\Windows\System\dSCiSqP.exe
  2⤵
  PID:9688
- C:\Windows\System\ChPqnBi.exe
  C:\Windows\System\ChPqnBi.exe
  2⤵
  PID:8816
- C:\Windows\System\GUmwHfQ.exe
  C:\Windows\System\GUmwHfQ.exe
  2⤵
  PID:9744
- C:\Windows\System\NxPJTRY.exe
  C:\Windows\System\NxPJTRY.exe
  2⤵
  PID:8880
- C:\Windows\System\bOFqweM.exe
  C:\Windows\System\bOFqweM.exe
  2⤵
  PID:9844
- C:\Windows\System\ZckIJyj.exe
  C:\Windows\System\ZckIJyj.exe
  2⤵
  PID:7668
- C:\Windows\System\pNaroKV.exe
  C:\Windows\System\pNaroKV.exe
  2⤵
  PID:8108
- C:\Windows\System\JwYmeFl.exe
  C:\Windows\System\JwYmeFl.exe
  2⤵
  PID:10008
- C:\Windows\System\IDffwqB.exe
  C:\Windows\System\IDffwqB.exe
  2⤵
  PID:10048
- C:\Windows\System\SEQOGDJ.exe
  C:\Windows\System\SEQOGDJ.exe
  2⤵
  PID:10212
- C:\Windows\System\XHzUHpa.exe
  C:\Windows\System\XHzUHpa.exe
  2⤵
  PID:8584
- C:\Windows\System\NIhWPOW.exe
  C:\Windows\System\NIhWPOW.exe
  2⤵
  PID:7792
- C:\Windows\System\AcRjryk.exe
  C:\Windows\System\AcRjryk.exe
  2⤵
  PID:9244
- C:\Windows\System\qzhOhbD.exe
  C:\Windows\System\qzhOhbD.exe
  2⤵
  PID:8904
- C:\Windows\System\UrdFmsv.exe
  C:\Windows\System\UrdFmsv.exe
  2⤵
  PID:8176
- C:\Windows\System\RCNXeiQ.exe
  C:\Windows\System\RCNXeiQ.exe
  2⤵
  PID:2892
- C:\Windows\System\iDhaYnA.exe
  C:\Windows\System\iDhaYnA.exe
  2⤵
  PID:9036
- C:\Windows\System\UTyAqpy.exe
  C:\Windows\System\UTyAqpy.exe
  2⤵
  PID:11268
- C:\Windows\System\TMPGWSf.exe
  C:\Windows\System\TMPGWSf.exe
  2⤵
  PID:11284
- C:\Windows\System\yUHqDwe.exe
  C:\Windows\System\yUHqDwe.exe
  2⤵
  PID:11308
- C:\Windows\System\xZjRVWf.exe
  C:\Windows\System\xZjRVWf.exe
  2⤵
  PID:11328
- C:\Windows\System\MXZqqsT.exe
  C:\Windows\System\MXZqqsT.exe
  2⤵
  PID:11348
- C:\Windows\System\qFMjVlX.exe
  C:\Windows\System\qFMjVlX.exe
  2⤵
  PID:11368
- C:\Windows\System\ZfEThLQ.exe
  C:\Windows\System\ZfEThLQ.exe
  2⤵
  PID:11384
- C:\Windows\System\eTtKCvQ.exe
  C:\Windows\System\eTtKCvQ.exe
  2⤵
  PID:11404
- C:\Windows\System\OtFVaYY.exe
  C:\Windows\System\OtFVaYY.exe
  2⤵
  PID:11424
- C:\Windows\System\fmcNnWc.exe
  C:\Windows\System\fmcNnWc.exe
  2⤵
  PID:11444
- C:\Windows\System\blMqiqg.exe
  C:\Windows\System\blMqiqg.exe
  2⤵
  PID:11464
- C:\Windows\System\lUORnMk.exe
  C:\Windows\System\lUORnMk.exe
  2⤵
  PID:11492
- C:\Windows\System\TtVqgGF.exe
  C:\Windows\System\TtVqgGF.exe
  2⤵
  PID:11508
- C:\Windows\System\xHlIYxw.exe
  C:\Windows\System\xHlIYxw.exe
  2⤵
  PID:11532
- C:\Windows\System\sXdYpQQ.exe
  C:\Windows\System\sXdYpQQ.exe
  2⤵
  PID:11548
- C:\Windows\System\vXXMLSr.exe
  C:\Windows\System\vXXMLSr.exe
  2⤵
  PID:11568
- C:\Windows\System\MjrocnM.exe
  C:\Windows\System\MjrocnM.exe
  2⤵
  PID:11592
- C:\Windows\System\gTMllXY.exe
  C:\Windows\System\gTMllXY.exe
  2⤵
  PID:11608
- C:\Windows\System\IVVEIBe.exe
  C:\Windows\System\IVVEIBe.exe
  2⤵
  PID:11628
- C:\Windows\System\yrCSOqO.exe
  C:\Windows\System\yrCSOqO.exe
  2⤵
  PID:11656
- C:\Windows\System\qtzjoOi.exe
  C:\Windows\System\qtzjoOi.exe
  2⤵
  PID:11676
- C:\Windows\System\ZAOEDxA.exe
  C:\Windows\System\ZAOEDxA.exe
  2⤵
  PID:11692
- C:\Windows\System\gMjcDNw.exe
  C:\Windows\System\gMjcDNw.exe
  2⤵
  PID:11716
- C:\Windows\System\whLvWEA.exe
  C:\Windows\System\whLvWEA.exe
  2⤵
  PID:11736
- C:\Windows\System\yUAnKbG.exe
  C:\Windows\System\yUAnKbG.exe
  2⤵
  PID:11756
- C:\Windows\System\mvBwuLh.exe
  C:\Windows\System\mvBwuLh.exe
  2⤵
  PID:11776
- C:\Windows\System\MdmXaTa.exe
  C:\Windows\System\MdmXaTa.exe
  2⤵
  PID:11800
- C:\Windows\System\mDynHmt.exe
  C:\Windows\System\mDynHmt.exe
  2⤵
  PID:11816
- C:\Windows\System\vADjUbq.exe
  C:\Windows\System\vADjUbq.exe
  2⤵
  PID:11840
- C:\Windows\System\UexpLVN.exe
  C:\Windows\System\UexpLVN.exe
  2⤵
  PID:11864
- C:\Windows\System\IQjWzWa.exe
  C:\Windows\System\IQjWzWa.exe
  2⤵
  PID:11884
- C:\Windows\System\clfOYiC.exe
  C:\Windows\System\clfOYiC.exe
  2⤵
  PID:11916
- C:\Windows\System\kWQCpiH.exe
  C:\Windows\System\kWQCpiH.exe
  2⤵
  PID:11936
- C:\Windows\System\BYaTKhA.exe
  C:\Windows\System\BYaTKhA.exe
  2⤵
  PID:11956
- C:\Windows\System\nuaOtRC.exe
  C:\Windows\System\nuaOtRC.exe
  2⤵
  PID:11976
- C:\Windows\System\PKOfJvg.exe
  C:\Windows\System\PKOfJvg.exe
  2⤵
  PID:12004
- C:\Windows\System\gNsDszE.exe
  C:\Windows\System\gNsDszE.exe
  2⤵
  PID:12024
- C:\Windows\System\TwondZA.exe
  C:\Windows\System\TwondZA.exe
  2⤵
  PID:12048
- C:\Windows\System\WbEpjhM.exe
  C:\Windows\System\WbEpjhM.exe
  2⤵
  PID:12068
- C:\Windows\System\JHtCjtg.exe
  C:\Windows\System\JHtCjtg.exe
  2⤵
  PID:12088
- C:\Windows\System\YrKXvNY.exe
  C:\Windows\System\YrKXvNY.exe
  2⤵
  PID:12112
- C:\Windows\System\YPDDSjj.exe
  C:\Windows\System\YPDDSjj.exe
  2⤵
  PID:12132
- C:\Windows\System\mgBsxQB.exe
  C:\Windows\System\mgBsxQB.exe
  2⤵
  PID:12148
- C:\Windows\System\bFiKipm.exe
  C:\Windows\System\bFiKipm.exe
  2⤵
  PID:12164
- C:\Windows\System\trSgfpz.exe
  C:\Windows\System\trSgfpz.exe
  2⤵
  PID:12180
- C:\Windows\System\TQbwKDh.exe
  C:\Windows\System\TQbwKDh.exe
  2⤵
  PID:12196
- C:\Windows\System\SvcucMX.exe
  C:\Windows\System\SvcucMX.exe
  2⤵
  PID:12212
- C:\Windows\System\uJqYEIO.exe
  C:\Windows\System\uJqYEIO.exe
  2⤵
  PID:12232
- C:\Windows\System\GRiUnSr.exe
  C:\Windows\System\GRiUnSr.exe
  2⤵
  PID:12260
- C:\Windows\System\RkAgYOj.exe
  C:\Windows\System\RkAgYOj.exe
  2⤵
  PID:12280
- C:\Windows\System\zKOiwwK.exe
  C:\Windows\System\zKOiwwK.exe
  2⤵
  PID:10272
- C:\Windows\System\dCiRXLS.exe
  C:\Windows\System\dCiRXLS.exe
  2⤵
  PID:9680
- C:\Windows\System\GYGsMfM.exe
  C:\Windows\System\GYGsMfM.exe
  2⤵
  PID:10496
- C:\Windows\System\ZUkgkMH.exe
  C:\Windows\System\ZUkgkMH.exe
  2⤵
  PID:10564
- C:\Windows\System\opkEpre.exe
  C:\Windows\System\opkEpre.exe
  2⤵
  PID:9788
- C:\Windows\System\qiixces.exe
  C:\Windows\System\qiixces.exe
  2⤵
  PID:10632
- C:\Windows\System\ZpSVjzk.exe
  C:\Windows\System\ZpSVjzk.exe
  2⤵
  PID:9908
- C:\Windows\System\JpEgDIN.exe
  C:\Windows\System\JpEgDIN.exe
  2⤵
  PID:7828
- C:\Windows\System\BpQstsl.exe
  C:\Windows\System\BpQstsl.exe
  2⤵
  PID:8504
- C:\Windows\System\AuVxsfW.exe
  C:\Windows\System\AuVxsfW.exe
  2⤵
  PID:8648
- C:\Windows\System\pNJwOxA.exe
  C:\Windows\System\pNJwOxA.exe
  2⤵
  PID:7612
- C:\Windows\System\RPdzXFh.exe
  C:\Windows\System\RPdzXFh.exe
  2⤵
  PID:10152
- C:\Windows\System\zMyYSgg.exe
  C:\Windows\System\zMyYSgg.exe
  2⤵
  PID:10964
- C:\Windows\System\hKEuKlF.exe
  C:\Windows\System\hKEuKlF.exe
  2⤵
  PID:10180
- C:\Windows\System\zbqQnnv.exe
  C:\Windows\System\zbqQnnv.exe
  2⤵
  PID:11092
- C:\Windows\System\OzfFpoG.exe
  C:\Windows\System\OzfFpoG.exe
  2⤵
  PID:12296
- C:\Windows\System\azKzUCf.exe
  C:\Windows\System\azKzUCf.exe
  2⤵
  PID:12312
- C:\Windows\System\vyHuyYV.exe
  C:\Windows\System\vyHuyYV.exe
  2⤵
  PID:12340
- C:\Windows\System\CyOEheV.exe
  C:\Windows\System\CyOEheV.exe
  2⤵
  PID:12360
- C:\Windows\System\zOsbxFT.exe
  C:\Windows\System\zOsbxFT.exe
  2⤵
  PID:12376
- C:\Windows\System\jmOkxkV.exe
  C:\Windows\System\jmOkxkV.exe
  2⤵
  PID:12400
- C:\Windows\System\zSDcZLk.exe
  C:\Windows\System\zSDcZLk.exe
  2⤵
  PID:12432
- C:\Windows\System\uoXMAMu.exe
  C:\Windows\System\uoXMAMu.exe
  2⤵
  PID:12448
- C:\Windows\System\OcXeZVs.exe
  C:\Windows\System\OcXeZVs.exe
  2⤵
  PID:12468
- C:\Windows\System\WxoQWcP.exe
  C:\Windows\System\WxoQWcP.exe
  2⤵
  PID:12492
- C:\Windows\System\kdrfBlu.exe
  C:\Windows\System\kdrfBlu.exe
  2⤵
  PID:12512
- C:\Windows\System\zfAxEAa.exe
  C:\Windows\System\zfAxEAa.exe
  2⤵
  PID:12540
- C:\Windows\System\MONqBxd.exe
  C:\Windows\System\MONqBxd.exe
  2⤵
  PID:12560
- C:\Windows\System\NkBhkJE.exe
  C:\Windows\System\NkBhkJE.exe
  2⤵
  PID:12576
- C:\Windows\System\BUxTinA.exe
  C:\Windows\System\BUxTinA.exe
  2⤵
  PID:12596
- C:\Windows\System\UUmHkbD.exe
  C:\Windows\System\UUmHkbD.exe
  2⤵
  PID:12616
- C:\Windows\System\ELcusKy.exe
  C:\Windows\System\ELcusKy.exe
  2⤵
  PID:12640
- C:\Windows\System\jsSjvhM.exe
  C:\Windows\System\jsSjvhM.exe
  2⤵
  PID:12660
- C:\Windows\System\hmVXczz.exe
  C:\Windows\System\hmVXczz.exe
  2⤵
  PID:12680
- C:\Windows\System\QfZoBqN.exe
  C:\Windows\System\QfZoBqN.exe
  2⤵
  PID:12704
- C:\Windows\System\AtECgdn.exe
  C:\Windows\System\AtECgdn.exe
  2⤵
  PID:12724
- C:\Windows\System\DrcybXz.exe
  C:\Windows\System\DrcybXz.exe
  2⤵
  PID:12740
- C:\Windows\System\YkFzeiL.exe
  C:\Windows\System\YkFzeiL.exe
  2⤵
  PID:12768
- C:\Windows\System\GYogyHc.exe
  C:\Windows\System\GYogyHc.exe
  2⤵
  PID:12784
- C:\Windows\System\watTiEs.exe
  C:\Windows\System\watTiEs.exe
  2⤵
  PID:12808
- C:\Windows\System\szpgtDP.exe
  C:\Windows\System\szpgtDP.exe
  2⤵
  PID:12832
- C:\Windows\System\qZvEwZU.exe
  C:\Windows\System\qZvEwZU.exe
  2⤵
  PID:12852
- C:\Windows\System\pTyjQLz.exe
  C:\Windows\System\pTyjQLz.exe
  2⤵
  PID:12872
- C:\Windows\System\SRDdiXq.exe
  C:\Windows\System\SRDdiXq.exe
  2⤵
  PID:12900
- C:\Windows\System\DFDIqmK.exe
  C:\Windows\System\DFDIqmK.exe
  2⤵
  PID:9324
- C:\Windows\System\CCplfwF.exe
  C:\Windows\System\CCplfwF.exe
  2⤵
  PID:10256
- C:\Windows\System\pdMJZtW.exe
  C:\Windows\System\pdMJZtW.exe
  2⤵
  PID:11364
- C:\Windows\System\jigkCEH.exe
  C:\Windows\System\jigkCEH.exe
  2⤵
  PID:13036
- C:\Windows\System\bUonwuD.exe
  C:\Windows\System\bUonwuD.exe
  2⤵
  PID:11460
- C:\Windows\System\lveeMBp.exe
  C:\Windows\System\lveeMBp.exe
  2⤵
  PID:11540
- C:\Windows\System\IfgfCTM.exe
  C:\Windows\System\IfgfCTM.exe
  2⤵
  PID:11620
- C:\Windows\System\RuxaCBn.exe
  C:\Windows\System\RuxaCBn.exe
  2⤵
  PID:10616
- C:\Windows\System\aLZHPuV.exe
  C:\Windows\System\aLZHPuV.exe
  2⤵
  PID:11892
- C:\Windows\System\myWrdgx.exe
  C:\Windows\System\myWrdgx.exe
  2⤵
  PID:10800
- C:\Windows\System\ueJwXHq.exe
  C:\Windows\System\ueJwXHq.exe
  2⤵
  PID:10868
- C:\Windows\System\MvEULpw.exe
  C:\Windows\System\MvEULpw.exe
  2⤵
  PID:10908
- C:\Windows\System\IiCXTIw.exe
  C:\Windows\System\IiCXTIw.exe
  2⤵
  PID:12272
- C:\Windows\System\aqmVAbt.exe
  C:\Windows\System\aqmVAbt.exe
  2⤵
  PID:9792
- C:\Windows\System\DemCEFW.exe
  C:\Windows\System\DemCEFW.exe
  2⤵
  PID:10524
- C:\Windows\System\RuVAJyF.exe
  C:\Windows\System\RuVAJyF.exe
  2⤵
  PID:11008
- C:\Windows\System\jnnwYdz.exe
  C:\Windows\System\jnnwYdz.exe
  2⤵
  PID:11236
- C:\Windows\System\FIQwgWV.exe
  C:\Windows\System\FIQwgWV.exe
  2⤵
  PID:11788
- C:\Windows\System\YqbYJfp.exe
  C:\Windows\System\YqbYJfp.exe
  2⤵
  PID:10540
- C:\Windows\System\GwgEKHg.exe
  C:\Windows\System\GwgEKHg.exe
  2⤵
  PID:11700
- C:\Windows\System\GoClkIE.exe
  C:\Windows\System\GoClkIE.exe
  2⤵
  PID:12332
- C:\Windows\System\yPDAEKw.exe
  C:\Windows\System\yPDAEKw.exe
  2⤵
  PID:10892
- C:\Windows\System\CpojVRE.exe
  C:\Windows\System\CpojVRE.exe
  2⤵
  PID:12552
- C:\Windows\System\vCDKTSi.exe
  C:\Windows\System\vCDKTSi.exe
  2⤵
  PID:12756
- C:\Windows\System\FnfVasx.exe
  C:\Windows\System\FnfVasx.exe
  2⤵
  PID:13080
- C:\Windows\System\TnBzRKl.exe
  C:\Windows\System\TnBzRKl.exe
  2⤵
  PID:10780
- C:\Windows\System\AWPLWGg.exe
  C:\Windows\System\AWPLWGg.exe
  2⤵
  PID:11968
- C:\Windows\System\qEfezki.exe
  C:\Windows\System\qEfezki.exe
  2⤵
  PID:12080
- C:\Windows\System\tSWwIOD.exe
  C:\Windows\System\tSWwIOD.exe
  2⤵
  PID:9852
- C:\Windows\System\rPaVIju.exe
  C:\Windows\System\rPaVIju.exe
  2⤵
  PID:11316
- C:\Windows\System\iggwTEc.exe
  C:\Windows\System\iggwTEc.exe
  2⤵
  PID:12968
- C:\Windows\System\tKepMaM.exe
  C:\Windows\System\tKepMaM.exe
  2⤵
  PID:11292
- C:\Windows\System\MKWVUkI.exe
  C:\Windows\System\MKWVUkI.exe
  2⤵
  PID:13024
- C:\Windows\System\zWGvTDN.exe
  C:\Windows\System\zWGvTDN.exe
  2⤵
  PID:11732
- C:\Windows\System\JNwsTmR.exe
  C:\Windows\System\JNwsTmR.exe
  2⤵
  PID:12888
- C:\Windows\System\DBcFSec.exe
  C:\Windows\System\DBcFSec.exe
  2⤵
  PID:10972
- C:\Windows\System\NopInEC.exe
  C:\Windows\System\NopInEC.exe
  2⤵
  PID:11108
- C:\Windows\System\vSPhyxh.exe
  C:\Windows\System\vSPhyxh.exe
  2⤵
  PID:10480
- C:\Windows\System\bBSCjnE.exe
  C:\Windows\System\bBSCjnE.exe
  2⤵
  PID:6868
- C:\Windows\System\XLwpfxG.exe
  C:\Windows\System\XLwpfxG.exe
  2⤵
  PID:12568
- C:\Windows\System\xMMNmSK.exe
  C:\Windows\System\xMMNmSK.exe
  2⤵
  PID:7936
- C:\Windows\System\RIaWazp.exe
  C:\Windows\System\RIaWazp.exe
  2⤵
  PID:5624
- C:\Windows\System\HGClzfE.exe
  C:\Windows\System\HGClzfE.exe
  2⤵
  PID:7488
- C:\Windows\System\OzHknnU.exe
  C:\Windows\System\OzHknnU.exe
  2⤵
  PID:8056
- C:\Windows\System\mtyOeLM.exe
  C:\Windows\System\mtyOeLM.exe
  2⤵
  PID:10772
- C:\Windows\System\gxnzQZj.exe
  C:\Windows\System\gxnzQZj.exe
  2⤵
  PID:9716
- C:\Windows\System\bgiPpLn.exe
  C:\Windows\System\bgiPpLn.exe
  2⤵
  PID:9484
- C:\Windows\System\UGTydqi.exe
  C:\Windows\System\UGTydqi.exe
  2⤵
  PID:12156
- C:\Windows\System\eYxmSlI.exe
  C:\Windows\System\eYxmSlI.exe
  2⤵
  PID:8028
- C:\Windows\System\DSeufda.exe
  C:\Windows\System\DSeufda.exe
  2⤵
  PID:1392
- C:\Windows\System\GbfKKiV.exe
  C:\Windows\System\GbfKKiV.exe
  2⤵
  PID:8204
- C:\Windows\System\OPbBcgZ.exe
  C:\Windows\System\OPbBcgZ.exe
  2⤵
  PID:9572
- C:\Windows\System\EcAVNHP.exe
  C:\Windows\System\EcAVNHP.exe
  2⤵
  PID:10840
- C:\Windows\System\cEcihbz.exe
  C:\Windows\System\cEcihbz.exe
  2⤵
  PID:10084
- C:\Windows\System\yKYyjTp.exe
  C:\Windows\System\yKYyjTp.exe
  2⤵
  PID:9596
- C:\Windows\System\mmjhtNz.exe
  C:\Windows\System\mmjhtNz.exe
  2⤵
  PID:9148
- C:\Windows\System\nkoanwl.exe
  C:\Windows\System\nkoanwl.exe
  2⤵
  PID:11064
- C:\Windows\System\MOGwigq.exe
  C:\Windows\System\MOGwigq.exe
  2⤵
  PID:9968
- C:\Windows\System\oBpYGrZ.exe
  C:\Windows\System\oBpYGrZ.exe
  2⤵
  PID:4292
- C:\Windows\System\FSFqSEX.exe
  C:\Windows\System\FSFqSEX.exe
  2⤵
  PID:12488
- C:\Windows\System\VbfrZQQ.exe
  C:\Windows\System\VbfrZQQ.exe
  2⤵
  PID:11440
- C:\Windows\System\YrprelV.exe
  C:\Windows\System\YrprelV.exe
  2⤵
  PID:9264
- C:\Windows\System\wXKHKmc.exe
  C:\Windows\System\wXKHKmc.exe
  2⤵
  PID:12044
- C:\Windows\System\mEknhTG.exe
  C:\Windows\System\mEknhTG.exe
  2⤵
  PID:6372
- C:\Windows\System\YBCUCgD.exe
  C:\Windows\System\YBCUCgD.exe
  2⤵
  PID:12864
- C:\Windows\System\dRoVPbN.exe
  C:\Windows\System\dRoVPbN.exe
  2⤵
  PID:3116
- C:\Windows\System\mogUJNd.exe
  C:\Windows\System\mogUJNd.exe
  2⤵
  PID:13292
- C:\Windows\System\FOrcLld.exe
  C:\Windows\System\FOrcLld.exe
  2⤵
  PID:9000
- C:\Windows\System\fzwURiZ.exe
  C:\Windows\System\fzwURiZ.exe
  2⤵
  PID:10336
- C:\Windows\System\KkXtxVO.exe
  C:\Windows\System\KkXtxVO.exe
  2⤵
  PID:13124
- C:\Windows\System\MIOYsaO.exe
  C:\Windows\System\MIOYsaO.exe
  2⤵
  PID:12696
- C:\Windows\System\VvInDWE.exe
  C:\Windows\System\VvInDWE.exe
  2⤵
  PID:10864
- C:\Windows\System\lnzcPff.exe
  C:\Windows\System\lnzcPff.exe
  2⤵
  PID:880
- C:\Windows\System\FcfulcE.exe
  C:\Windows\System\FcfulcE.exe
  2⤵
  PID:12736
- C:\Windows\System\chFbWjj.exe
  C:\Windows\System\chFbWjj.exe
  2⤵
  PID:2360
- C:\Windows\System\EiCNmaR.exe
  C:\Windows\System\EiCNmaR.exe
  2⤵
  PID:4888
- C:\Windows\System\rAGNcKA.exe
  C:\Windows\System\rAGNcKA.exe
  2⤵
  PID:2244
- C:\Windows\System\HtvjIsC.exe
  C:\Windows\System\HtvjIsC.exe
  2⤵
  PID:3128
- C:\Windows\System\LNmGVJI.exe
  C:\Windows\System\LNmGVJI.exe
  2⤵
  PID:644
- C:\Windows\System\EqVtcpW.exe
  C:\Windows\System\EqVtcpW.exe
  2⤵
  PID:4700
- C:\Windows\System\qMZYtKA.exe
  C:\Windows\System\qMZYtKA.exe
  2⤵
  PID:4748
- C:\Windows\System\cRAvHEm.exe
  C:\Windows\System\cRAvHEm.exe
  2⤵
  PID:4624
- C:\Windows\System\YuFKBth.exe
  C:\Windows\System\YuFKBth.exe
  2⤵
  PID:2216
- C:\Windows\System\ljqPDTG.exe
  C:\Windows\System\ljqPDTG.exe
  2⤵
  PID:11304
- C:\Windows\System\esMbyWX.exe
  C:\Windows\System\esMbyWX.exe
  2⤵
  PID:8712
- C:\Windows\System\eLcbkiU.exe
  C:\Windows\System\eLcbkiU.exe
  2⤵
  PID:928
- C:\Windows\System\PATFVPM.exe
  C:\Windows\System\PATFVPM.exe
  2⤵
  PID:4712
- C:\Windows\System\HunomJA.exe
  C:\Windows\System\HunomJA.exe
  2⤵
  PID:2208
- C:\Windows\System\GTaglpN.exe
  C:\Windows\System\GTaglpN.exe
  2⤵
  PID:3196
- C:\Windows\System\wPcqvbU.exe
  C:\Windows\System\wPcqvbU.exe
  2⤵
  PID:13324
- C:\Windows\System\WoQoIkE.exe
  C:\Windows\System\WoQoIkE.exe
  2⤵
  PID:13344
- C:\Windows\System\JVCUTEu.exe
  C:\Windows\System\JVCUTEu.exe
  2⤵
  PID:13388
- C:\Windows\System\bUQQwDo.exe
  C:\Windows\System\bUQQwDo.exe
  2⤵
  PID:13404
- C:\Windows\System\xKQdqzF.exe
  C:\Windows\System\xKQdqzF.exe
  2⤵
  PID:13424
- C:\Windows\System\IDrKKwy.exe
  C:\Windows\System\IDrKKwy.exe
  2⤵
  PID:13448
- C:\Windows\System\NbALdOd.exe
  C:\Windows\System\NbALdOd.exe
  2⤵
  PID:13488
- C:\Windows\System\mKqIPgp.exe
  C:\Windows\System\mKqIPgp.exe
  2⤵
  PID:13520
- C:\Windows\System\mLjAWXo.exe
  C:\Windows\System\mLjAWXo.exe
  2⤵
  PID:13536
- C:\Windows\System\aObHUrP.exe
  C:\Windows\System\aObHUrP.exe
  2⤵
  PID:13560
- C:\Windows\System\JmqwHmT.exe
  C:\Windows\System\JmqwHmT.exe
  2⤵
  PID:13624
- C:\Windows\System\FXBGvAC.exe
  C:\Windows\System\FXBGvAC.exe
  2⤵
  PID:13660
- C:\Windows\System\exHaczH.exe
  C:\Windows\System\exHaczH.exe
  2⤵
  PID:13748
- C:\Windows\System\mHFbHwQ.exe
  C:\Windows\System\mHFbHwQ.exe
  2⤵
  PID:13772
- C:\Windows\System\biLkXIC.exe
  C:\Windows\System\biLkXIC.exe
  2⤵
  PID:13896
- C:\Windows\System\WOENcAs.exe
  C:\Windows\System\WOENcAs.exe
  2⤵
  PID:13988
- C:\Windows\System\jNRiDCT.exe
  C:\Windows\System\jNRiDCT.exe
  2⤵
  PID:14008
- C:\Windows\System\mVexhEF.exe
  C:\Windows\System\mVexhEF.exe
  2⤵
  PID:14048
- C:\Windows\System\PwEfVnI.exe
  C:\Windows\System\PwEfVnI.exe
  2⤵
  PID:14132
- C:\Windows\System\koHBGvI.exe
  C:\Windows\System\koHBGvI.exe
  2⤵
  PID:14168
- C:\Windows\System\MCZsUam.exe
  C:\Windows\System\MCZsUam.exe
  2⤵
  PID:14196
- C:\Windows\System\MPsoKPS.exe
  C:\Windows\System\MPsoKPS.exe
  2⤵
  PID:14220
- C:\Windows\System\DEkMPEX.exe
  C:\Windows\System\DEkMPEX.exe
  2⤵
  PID:14292
- C:\Windows\System\DAXepiq.exe
  C:\Windows\System\DAXepiq.exe
  2⤵
  PID:14308
- C:\Windows\System\rDoUFXp.exe
  C:\Windows\System\rDoUFXp.exe
  2⤵
  PID:14328
- C:\Windows\System\GQDgEOm.exe
  C:\Windows\System\GQDgEOm.exe
  2⤵
  PID:4584
- C:\Windows\System\CkVHDfv.exe
  C:\Windows\System\CkVHDfv.exe
  2⤵
  PID:4908
- C:\Windows\System\TyOONhz.exe
  C:\Windows\System\TyOONhz.exe
  2⤵
  PID:3080
- C:\Windows\System\UkylcFS.exe
  C:\Windows\System\UkylcFS.exe
  2⤵
  PID:2572
- C:\Windows\System\LWTlSal.exe
  C:\Windows\System\LWTlSal.exe
  2⤵
  PID:13396
- C:\Windows\System\awUdGmP.exe
  C:\Windows\System\awUdGmP.exe
  2⤵
  PID:3588
- C:\Windows\System\TMkviGs.exe
  C:\Windows\System\TMkviGs.exe
  2⤵
  PID:13320
- C:\Windows\System\ZhDuSzo.exe
  C:\Windows\System\ZhDuSzo.exe
  2⤵
  PID:9428
- C:\Windows\System\IUcPdVW.exe
  C:\Windows\System\IUcPdVW.exe
  2⤵
  PID:13500
- C:\Windows\System\nuQYKKN.exe
  C:\Windows\System\nuQYKKN.exe
  2⤵
  PID:13568
- C:\Windows\System\SqQewUt.exe
  C:\Windows\System\SqQewUt.exe
  2⤵
  PID:13712
- C:\Windows\System\OcGaxsy.exe
  C:\Windows\System\OcGaxsy.exe
  2⤵
  PID:13440
- C:\Windows\System\EgraCjx.exe
  C:\Windows\System\EgraCjx.exe
  2⤵
  PID:2432
- C:\Windows\System\PkmlQRK.exe
  C:\Windows\System\PkmlQRK.exe
  2⤵
  PID:13476
- C:\Windows\System\OCPnciN.exe
  C:\Windows\System\OCPnciN.exe
  2⤵
  PID:13512
- C:\Windows\System\UgFBdgp.exe
  C:\Windows\System\UgFBdgp.exe
  2⤵
  PID:13584
- C:\Windows\System\PBGRmFb.exe
  C:\Windows\System\PBGRmFb.exe
  2⤵
  PID:13696
- C:\Windows\System\fssqqyE.exe
  C:\Windows\System\fssqqyE.exe
  2⤵
  PID:13652
- C:\Windows\System\iVAjvhL.exe
  C:\Windows\System\iVAjvhL.exe
  2⤵
  PID:13888
- C:\Windows\System\DfRuFDT.exe
  C:\Windows\System\DfRuFDT.exe
  2⤵
  PID:4552
- C:\Windows\System\VRggUyV.exe
  C:\Windows\System\VRggUyV.exe
  2⤵
  PID:13768
- C:\Windows\System\YiCYCIF.exe
  C:\Windows\System\YiCYCIF.exe
  2⤵
  PID:13804
- C:\Windows\System\HeWeQza.exe
  C:\Windows\System\HeWeQza.exe
  2⤵
  PID:13848
- C:\Windows\System\WMurNUk.exe
  C:\Windows\System\WMurNUk.exe
  2⤵
  PID:13876
- C:\Windows\System\IDoEUay.exe
  C:\Windows\System\IDoEUay.exe
  2⤵
  PID:13920
- C:\Windows\System\zcYqUmK.exe
  C:\Windows\System\zcYqUmK.exe
  2⤵
  PID:5168
- C:\Windows\System\xpYhMsE.exe
  C:\Windows\System\xpYhMsE.exe
  2⤵
  PID:5140
- C:\Windows\System\mPlPqUB.exe
  C:\Windows\System\mPlPqUB.exe
  2⤵
  PID:14140
- C:\Windows\System\LTqmQFX.exe
  C:\Windows\System\LTqmQFX.exe
  2⤵
  PID:14160
- C:\Windows\System\llGVFYg.exe
  C:\Windows\System\llGVFYg.exe
  2⤵
  PID:5260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lph32ct4.1uy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ASiIVUe.exe

Filesize
1.9MB

MD5
a3814b9077c2e2c240b633d492bff05f

SHA1
da5ff5a4c1408ab120a546a8bc4e17ae4e146a27

SHA256
d580ac8b72af272e9ebea8b41a6788591ce7fe2d949df5184ca08448e16383ba

SHA512
ecdb8dd30f687000232a5b860c8b5e95baa9fa6a74cd418a684f9a2ca353fd660a220053e43bef3b7f5e51f6bd0cf2ddd61a70ece42de3c048ebfee0da4d7d40

Download Submit
C:\Windows\System\AVOwNFH.exe

Filesize
1.9MB

MD5
d6da57f28cd8660583553d8e743d36ae

SHA1
e47fc63f22ca5f37194d82c1be3db211056f6a9f

SHA256
90c0a377618ab7dff9a86e87fd7959eb01e7a6938560f721a23c599d1a1bdbd9

SHA512
2f640abf32cbf5516f3db29beede82788e06078aa247acfee65e6a861ea398358d00b6e75636d6cda55d49d56411f80e102e60d4774c2b7a5f461b57c8fc7616

Download Submit
C:\Windows\System\BCilFDp.exe

Filesize
1.9MB

MD5
d28631b2fb52aadc6c311f1c3d77a7bf

SHA1
c259bbd93ce202e73417f57c28200c3897e1eae5

SHA256
9354abdc127d5cc6bed29b09bd06e9b70e68fd023c826d190eb8bc267710e104

SHA512
c828192a110cc95040ca3aebb76c476238c250ca6a431efaad4bdc62b51cd0d68e0ecdc933a91ccccfd318836c02b2c1d7250e6af0aa49a0c163912d810e1807

Download Submit
C:\Windows\System\CBYQPxy.exe

Filesize
1.9MB

MD5
51ab964c8cad0e210abeffafff276e90

SHA1
08d8e8a9de8843111bbee86498d275f0882940af

SHA256
7ef75ee98811a19e8106073c6be30962873960152275723605fe4bc55fd6870a

SHA512
4f0c2e704aa8217e7408247da6f42ebf827e8bec020ffbc66c17e6da9d9740277bef1d3905900fe755282ad19a9fe409db10bd11fc4d21429334a874fa65092a

Download Submit
C:\Windows\System\CwEoeDH.exe

Filesize
1.9MB

MD5
db13a267229ce133266a8cf99257bf6d

SHA1
9754578ec248981d15c84b644e801d2003b227b9

SHA256
3e082006126ef5d8793aa5ae5e2e000a30b555ad28cfcca549fbcf46d1e7dea9

SHA512
a99d1a9fbbba6531874d8f5158cfa19d7854bf6025928ae3995963e6518a1e730f55e62ac0a4066dbea05dd06e66e693c02469496fc7e8cd6ee19c67ba1884e5

Download Submit
C:\Windows\System\HBwhttw.exe

Filesize
1.9MB

MD5
d1b97aef5ea6e80c3437308d4da7ca3b

SHA1
b8ae8b9555d114474522ca97fd03d14b00a80b78

SHA256
6b39c0ca5327895e1c0927dee382b485e4eff2dde61400b2b0d74b169f46f7ce

SHA512
707b0c6fba22442af0b68efc642ff23fb5556d7dc090c5eb116a63fc8f9ce32ee2040d3fea006830720ed246da9aa5e83a949cd641a00b50504fe218885d7d74

Download Submit
C:\Windows\System\HPHAZNF.exe

Filesize
1.9MB

MD5
a5819ec149ec60e5d18da609c11ed263

SHA1
3c66671c34e5012dc03deadd25c7b4003a762e5c

SHA256
aa1cbaddd6a59413eb8236fb551620688f869cbf9a107e66ebab7e037f9c52d7

SHA512
8dbc98c862e84a640056f9f1d8f7057077c8487be6dc9ff84d18723004b7543cec73273b4c108098b14ad3be60bd97f1d34c0dfeae993d39b1151d505fb33166

Download Submit
C:\Windows\System\ILRdCwO.exe

Filesize
1.9MB

MD5
919e481873214cee6a6e754a0387b7f0

SHA1
3b805d2ff5dcd7f8b279b01f592726a96530f659

SHA256
7f31dcdf4950442e693527c3e419a3b6f0d5d555f0e6f57d35baa67459b4cca3

SHA512
458fc1aa2ee48b44d3df313a917b76fc09fa5e487b2fb67b037367944fc335e819a715fd87f48694e343c2f49a9fce5cef88aefedcf8ea309536d9130a7eecb8

Download Submit
C:\Windows\System\IhFhBex.exe

Filesize
1.9MB

MD5
1e3c464a693e7c0f572ad27de73e7d54

SHA1
0cc4d57b6c2fd699aa149d98ce08826ddc72f903

SHA256
433d84fd4fb15600b54c0b0ea51e6c4e8eed3f03930a92f242366af5540f6b11

SHA512
3cdddbf1762130a2c25162995bb17ac97f3fe9b650fb46e172ec5847d3211e8cc75111091e6c99d9bf6a77b08669b8d915839f7f3aa955c54ec04d368b4f54e1

Download Submit
C:\Windows\System\JFVqaMH.exe

Filesize
1.9MB

MD5
81284ebbc7424ae09293b09b0b6f2898

SHA1
b0bb7bcaaa8e4ec25b0fcce6688abba241b7d842

SHA256
f2f971b35065a59bd1c6821e6406d901d2399a0c9ed50b692653f3d8bccf2ebd

SHA512
7bc93988a755d51fc83e8e87c506a3db99801ee99e6d8e92214576e5b41623a9da7ee923e08a49e0190f72f66c312f91038e7e6a650e77ee61ffccdae4888711

Download Submit
C:\Windows\System\KiIKxZQ.exe

Filesize
1.9MB

MD5
d4d469c670b64ad6abe1fb173ea7b988

SHA1
79554c0a6860ed784e409a6e1cb750013f8903b3

SHA256
d119e56034d8fce5c382d3fb127ef5cd04ae90690a456db2db7310deae5b2975

SHA512
80117714d7c485302c2322a22accce75975edaae7b773fe4cb152f38470543e2b7035b9035445519cdf98f6cf08db5f8c6cd24f5d6edeadb1313e459e6d590c4

Download Submit
C:\Windows\System\MapIgUk.exe

Filesize
1.9MB

MD5
e41d4188dea1dd2d51b25151fe9acaa9

SHA1
b6f716832cf92b579c2fde58cc07dd03eff158b6

SHA256
f459e1ae356f8039eb881a3d4f7d2e7bdf2c6a4ca7e101cfd35c6b5355bdd4c3

SHA512
e1eed4c7ebf4eae0b5860ae25bb385989b48f65ac5af6939a2d9ba3b3f502c754578c67803da85c7dca37ab499e325161c545eaf528d6b585ecaba0df2133f0b

Download Submit
C:\Windows\System\OJjRcJA.exe

Filesize
1.9MB

MD5
1f1830d810c7f4292abfec0034041554

SHA1
55ad8875bb49b7044ced2e5094bcba80563f4026

SHA256
15281055fb66c60f09d4dce50ee942cb7f64d86529d30a90fedb78dc1c2b3528

SHA512
c0e27965a069d8cfb72c05eb6b4e3ae895a2f64166806a0a515a056bd8905444942681ca395f287aee9cca04f01cb330f697efc4a25c5469dc820e72cee97de6

Download Submit
C:\Windows\System\PgHZvkM.exe

Filesize
1.9MB

MD5
2ecdfe5a5e2cf826e7afc7c733cda275

SHA1
78c89b16e81680d984ecd84eefeaef4a6d8fae41

SHA256
414c5215506b8a469d936a5622056cf64a3c10de1169039e1acaf970c853409f

SHA512
dbeef8d6d1548666b96db62d38064fe565d286ed19940c3dfd476293a7350d808c3b28da7b7009c951820320ac99100f2129a6fb22fb9663df09bd608502fe4a

Download Submit
C:\Windows\System\PwjEKsU.exe

Filesize
1.9MB

MD5
5825266d76fe7678ff8bb75d34b79534

SHA1
b5a370861930668efe169d8a5e837e01a9f45b0b

SHA256
24dd6db6444ca50f0e77694b50007ea60a21484129c7d1d647d23c63e6c97531

SHA512
7c8eeda87a63c19e53ee3ec3b7a4b58ff7432bdf72e19f9a82572525c3b83b8a92cf13264855b979acbc48e1199c4dac39bf650a5916fb5fc02d397c492fda6a

Download Submit
C:\Windows\System\QgxvjyW.exe

Filesize
1.9MB

MD5
bab5571dc812bb93f088ae32f9e522ee

SHA1
c232d0805768354708b51db852739624277f77d8

SHA256
4c8a0bd905ff2e40fc2cb9d2bf544478eee12de37de922b68ef7639b9d98eb7c

SHA512
4b0d74577ca0ffc9744c2d1a295d0565e35f9d6b1136c991d8b25288569e807107e46237fb4c90b2d56b3623c24915728a3cb30fec2b310eed3736fe12aad529

Download Submit
C:\Windows\System\RFLwBgO.exe

Filesize
1.9MB

MD5
a741f36a2261bb74e9d9b3c99e0e8b4e

SHA1
9812108aa184200f4a33ddb228ced48efec6396c

SHA256
c40d3cbfc2483ee82cb59689bbfdae51b3a5b8ac94854f3f12cec49b7b434a69

SHA512
8ca2f8f70a37699b568437e73f0b439543ba5d930b668a05fca0fe990d5fbce2845aab24f4bf048a4a749cc8770fa52987c004f79c8723a34653125de4f232e6

Download Submit
C:\Windows\System\RzBewAH.exe

Filesize
1.9MB

MD5
77a469e1fe536a5c1028044ee5ef0663

SHA1
6787f581e246de40ccb0c0597e92260950413615

SHA256
9e446a6f82210f5b8ecd72a5b291bb59ec5837008c0e99921e92714b4856ec66

SHA512
3fb873438290ea370fb538345821781eabe979c9c921d3ad955dfec5ab91b2d09db87e89faa40a828a205b831cd5f485b404984bcd7d29b0171b8a699548ac28

Download Submit
C:\Windows\System\SLlhrEe.exe

Filesize
1.9MB

MD5
c49d7bbc7cf12898af5aa4273714959c

SHA1
06159806283adb5e48103d3adbcffe800c435bee

SHA256
9428cab323af6b54d9ffc2aab74737d92b222ddcfd93322e542e7bcc0971e9e9

SHA512
c56508084c9c7ea69fec754c63693a77e9fadf0b745acbaa630f3ad8316f6cb580cda5cf25c75c305104bb206e34d30a06c1f54ede84c916ea43c5d1d2abf127

Download Submit
C:\Windows\System\SroUuPu.exe

Filesize
1.9MB

MD5
9e7deea73e64fcf4af7b84dfc120c6d3

SHA1
c5dd1bd11165ac680ff533beaf22aa05891d36a3

SHA256
de444092ef2c909c5bb6d6821c1fea7e44ef687ee053a015415572e469728bb9

SHA512
2f5d82e317e77a5db026ff0cc5ae19a9c76006754afde2378622d9bfc23c6bc1981402a4500d24f634f2d592c7bb6d61f649d55e33df9418884b52d2ea5a01e5

Download Submit
C:\Windows\System\TprMtKq.exe

Filesize
1.9MB

MD5
fe84260444da687acb181067478c751e

SHA1
dcb689c5ed9ed4130a0e9062f6c3742ba8ddaf92

SHA256
2336be038542d8ad4e44b27ee868567943e812d97185e39f54bca8e8e52efaae

SHA512
cfa8a2686ac3f5631b8c5e8a3fab9d1d808267fb2483828690b0f986cfb50c67cf77bb616310f335ce7380db3e2a5b713857a229efcb084cd2551d6cb550cd99

Download Submit
C:\Windows\System\VQOYbCl.exe

Filesize
1.9MB

MD5
8c722291b08544eed2163a506e4588bc

SHA1
bae8bb377dc6e8ea7ebbabf7e81130b1a15d4a1f

SHA256
8bcf88178d66bb0c3f136ee616779fe336a5765ca871013bec8a73cb032a7de6

SHA512
1c477a4a39fa7c368d82b74ba7f7bfcc0a51323ea46471d71fa356618c461530fcb0b2bdb54efb5f015f00e7ae6649acefdb09d9d7cdfa64a5207636d499427e

Download Submit
C:\Windows\System\XOHQnOC.exe

Filesize
1.9MB

MD5
06234c7e88dd2bf99ff9e37eb86a7049

SHA1
dc3af48adee30a2b9542d7dc6a5afaa7b5596c5f

SHA256
973892b920fdf6f9b678d35ea238c977e3c49c48fadcde652cedee2d08c6a2a0

SHA512
4084ec0e5a6f7b0fb197c6a30fe5cd105e3fc0659dcb8f75617c586bdec74b6353db454d983a78b4e0f1be7c96598f0264c66c7f91362ee3d65fb260483f0796

Download Submit
C:\Windows\System\XuRbxCP.exe

Filesize
1.9MB

MD5
161b7624cf2cc85fc734c80dec752c2f

SHA1
ad32dc74ed6a96c1d7e8b342629f722666fb3300

SHA256
fb96c217ef5ad14b44c4c9d557c9996e727f4057f4402583c27c60bed19f0ddb

SHA512
89e0c783ea003cdfdf68f530b1e79ab990511e63980606aff3a13696ff69d44ebfb121084002db5ab51eacfffa3daa7fb40ef0b71f9b5a1268a92b9c634cfb69

Download Submit
C:\Windows\System\XyhOseJ.exe

Filesize
1.9MB

MD5
340c7500ea4e15417a987739f6ade601

SHA1
e38280ff9d9c111166e11aa5d60461c93dd2c242

SHA256
726c18c252b1684e907c4946a19d2e47e3572c7b34059a49350a38e67b1267cf

SHA512
b2650d3dc1ceb66d371d4ae4e56189a272806fd5856863eec9243a2b428c303deb251b2cf23daf16b2c4e86a4012cc249287780aa75c7f604e0fe65a6bcb85cb

Download Submit
C:\Windows\System\YPNBNmP.exe

Filesize
1.9MB

MD5
2c7359aa5e146002e2d9ceead8ff1129

SHA1
547931fef1a323379117abb9d9155ae23d1930b7

SHA256
fadef8f0a129c383374973cd71e99eaa494a943afa0971f4e730049587bd78e9

SHA512
a3a53763e5a7b2af056c51cab4a1150fac85de724f543492e20c922a6ba3c389cf6d3202c4e130b19cea0cbbde04a849fc1abca15a65d9e0586f1291a1ca76bd

Download Submit
C:\Windows\System\YhUKGPP.exe

Filesize
1.9MB

MD5
fcd97712800910ec9092ee07d13c7352

SHA1
94ad2a3e3b49bd6e9f01f14469024118ab2bc635

SHA256
75f992f2f27492a6333b7f157bca511f7d925971e2c4346a43ab284228d25dcd

SHA512
7b5337373d9fb01d7c5a0496efe623be83cd9afef2a41772500e5e3324db19d4e8fdb9b78009185b448e47a16a292fb8cfc36d256231ab6f1c86f81ea11159d4

Download Submit
C:\Windows\System\ZemGbWO.exe

Filesize
1.9MB

MD5
ad4d8b59f4a98d0899f797626fc0287a

SHA1
d73a5e73624327f1106d671f2a8798cfda3b5dbf

SHA256
7cb8f7c7400e562493a71f16adcc6d5d1890f3089fce00f55d5c5cecf3083266

SHA512
83caab33b956b26c3314d010f4a6597aa8aa5450c0ee1246c984a874066ad2a467e5e81d89e98d8065871dc15ea7d4300b8c70163af9feea3ad9834cd3d8418c

Download Submit
C:\Windows\System\aMJnHOP.exe

Filesize
1.9MB

MD5
c18b48f4575651eacde22474448d6823

SHA1
f4458625d83a369a88364bbb3d39ca99b4541dc2

SHA256
046bdad59fe5b737bac60b463c25e5973df84d3285ac56d2a2d0f6732fdd20c6

SHA512
546821917bbfbde1eff7182aa614ef37b2fcb934b6f533d0db6cd773e132489bb18c3124310c2071ff0cc296632a73b339eb55a53c393b579f1553ce63fa5c74

Download Submit
C:\Windows\System\ajGBVps.exe

Filesize
1.9MB

MD5
40fb582736535186df6af749c56451d9

SHA1
b1c68f335033a030721d46664446083d54605410

SHA256
52bab289b165b2a48c010bb51901a3d52ed8bf2474e9a18162627a7647f34b54

SHA512
c9de443d4e0ff19a773a42c431fa86820cb7b0ebba79c693a516a8b2c613ba3de94aed9d8a24fab59f2a1d314a9a634b44e6f494f091a729767c2721df08495a

Download Submit
C:\Windows\System\cKeYNfG.exe

Filesize
1.9MB

MD5
59c92b575482c6f9dfbc7b46a6d6855a

SHA1
3a1b8bed099a64022448130e8d0c827ae4abda13

SHA256
98587c621dfda8c7f5ba008705a216ba6f13b4549f56a15dcdc0909dbba798a7

SHA512
5a2823eeaaadf5924cab99da17cfc8938c233f6ea32193078d00114572288e57d78a8080f072ed83a1981c3233bfe1e1cb70c0eba3aafdb018ae17f53f59ff1a

Download Submit
C:\Windows\System\fRWafho.exe

Filesize
1.9MB

MD5
82925b217deae175b5d077d2a46a5ee3

SHA1
d7517c9f0922bce1ca3e15493aa47883a3292cad

SHA256
277d4fa56b36645ddf0a84ebfa604444dec16a6bf51e2af8310011b23907f2eb

SHA512
611a72d7a36d7a6e392faacf3a1b7358d07c8c1f68b670005865079a6495f45105899679db60028c3204479cd0df58f3d46506c9dbb2ed2ce274a6004e3a4e71

Download Submit
C:\Windows\System\kOoEhex.exe

Filesize
1.9MB

MD5
5a476b09e8e6a91a99c44566df752e3e

SHA1
b672aa6a3bd5b097b4359479604fabcc753b8002

SHA256
cb75be3c759d427dcc64be0b375d844cf233e0b864e1225050b2939be2621661

SHA512
16c5b05883ada21760cf8c7f56c2a00fe363658be4deae0fb39475286320a26847c91e553fe72d388a074020e90bbfe618c83fd67e0af34fb4496e37ed7259ce

Download Submit
C:\Windows\System\kTtsOMa.exe

Filesize
1.9MB

MD5
7e1e868dd5dff00f9dda7f9dfbc0a860

SHA1
8e27383b26512e309a6eed6045aae981a0f1cb7a

SHA256
1efc7aa39a4563de15c85c7b7f6c8add98c5a4b2ce48219e498a552ba1123ccd

SHA512
4dd469eb859157bbe1e3702f2f66db69f5250ae6e528fef00b5a832fc21827016b4cb77d24ed88a96347eafaa08738784900d766846ced0588955056695df480

Download Submit
C:\Windows\System\lWIuDYk.exe

Filesize
1.9MB

MD5
938edcd1a0d11744a82206954b61de13

SHA1
525786cf0be15cbeded89f98f34faa7fb1071252

SHA256
429d9fa60c485d3132773097b353432288bdfe35c1e5b708ac1de123bfdd1a40

SHA512
0c26b28d5c2c8f714ecf9edc4a92e86b2bf0e61951074878991c089c33ca5d8155fe61fa876e10f4f3025d933b5a14fa846c5990cb973fce4cdb9877487ca841

Download Submit
C:\Windows\System\mRLLcfT.exe

Filesize
1.9MB

MD5
045044eba9a88a43cce16a8401770f36

SHA1
0fc7742271da486316a293fc621facaca65b05e7

SHA256
32e7722deeba5e0c719fb48be8e09c42e91e9884598275c40930f2d41fbd8de4

SHA512
bc0c25e44bd0cc5b32e6db6d7eccc635fef2eb40d351a823e0b6b29352f9d897c9ef2fb207b306bad3e44b62f7073671b57b71a5ae65b491cd2b3a07534c54fa

Download Submit
C:\Windows\System\nYyhRAi.exe

Filesize
1.9MB

MD5
ca848440e4691040777322477408031b

SHA1
c847ced8e84fd6cd45fc28901366118fa2600600

SHA256
b4762a6d8d77111327169eafa5b83204ca2af700bda956ef53fde71a8943d33d

SHA512
0b88d4884f9dacbdcbcfb50e2307386dab511424edc3dc9b1d697ecc22d807f9cf82afaa38c5e190b49375dbe7feb713bc762ea6d84b468b8d45a0a83b53b740

Download Submit
C:\Windows\System\qVfPBgH.exe

Filesize
1.9MB

MD5
4cb28dac7abda78130f798d38026ed6b

SHA1
7f6eb130fa35819d107ca3138d767b9c841f6dea

SHA256
edd3b3641b3727cf47d5778bbf5fed3716f71e3bca06a0cc54fd0224d371de52

SHA512
0f6879c6ebd9838c6720aa5b72731d7d84dcebea3e123548b90d9de0289e6c7ce03033d7d2c3625e4a7d6f0b67fc8bf3e7f76d3d775a4af5408adaa086a58ebf

Download Submit
C:\Windows\System\qosFtWX.exe

Filesize
8B

MD5
89b49edfc15b320118dccc63dce276c0

SHA1
d6a182f9e8a009d8ebfef26a1c685fcf2b4f152a

SHA256
b80b4d5110187afa9e6d1cf3e2b0f3429a153e9d0c88c32cabdb6359e19204f1

SHA512
7177d9a15db58801e4f8b1c7970b405645f764452ade86d38cac06f6967fac62b12ef486104093e1892a28c57d2dd25b2fe393363d54d8f0cf2bd6688982c9c6

Download Submit
C:\Windows\System\sOGeTHl.exe

Filesize
1.9MB

MD5
e47b93c00cb38675d5ad99300fe9854d

SHA1
8cc415653e79631f30fa0ce8898502d38a78543e

SHA256
047b22daa20491b267e22a8f51ec3fa64d93a5cd68d109df3dfc565734ad6276

SHA512
16498cf2784d3b4df57d8f57a7d67658ca8d91a6c63b312bc1ef5dfc607b7f16e4ffa458ce2b3aaa470dba168178a76178378746958cea9e01cadad12ba7ac30

Download Submit
C:\Windows\System\tmrmoOV.exe

Filesize
1.9MB

MD5
a2c1137b355ba6e571cfd7141c6d0ebb

SHA1
0b173b0e5932bc0144c648957bc79076cb81138d

SHA256
84bd4953531473a7868a9ad9f5d15c672dbd65a018df3899ea630afa14b2d1cc

SHA512
d8b99e379695dc8f45fa17ab5fce7a4cd771259c15d8a388d2861552f9cffe151e06555ac4b8c34a1191b72970128658fc6d030e7de0fd98d83b188464888ca4

Download Submit
C:\Windows\System\uASgzeS.exe

Filesize
1.9MB

MD5
fa4b259a148b6f70129c7c433a69526d

SHA1
03b4cede3a11da98e47d08286ad460faab8c6cb7

SHA256
7b2e98a859f88ad2fecaec1d77cf67ba3c33ca42d0492c170eea49664e8653e2

SHA512
280c22311fe0fcde17ddb9f53f8d6287c934aec0ab5cfca3fa02612187c74fdedea72d188422e367f35fc8bd953a32d475a3c355f029464abc3733b9dbadb5e4

Download Submit
C:\Windows\System\vzCCrtF.exe

Filesize
1.9MB

MD5
2600029efdac4407dc7d533357d613c1

SHA1
7007516de28ca989a96815570354329599f2b8fe

SHA256
9255f480f3f1e68f477573edb6132f02eaaf6ec422e7d3defcf7428a45b34291

SHA512
6bfa8a499bb6964e20751f929f7877a4d3a176b9c27d0f79095444d891b80f044225e14c0b527449146ff90ea6d807a22c70fa2b3c5e18aea44ed766a5786c6b

Download Submit
C:\Windows\System\xpMQgId.exe

Filesize
1.9MB

MD5
f1d06ca592aa65888287b289aa6a0f4c

SHA1
08c159c73f4f8685dbb16df57bcdec3fc1836a5e

SHA256
9887c731dde6743d6c64978750976eed5b06c379af7603286fdc2dff94fcb0a1

SHA512
224500f71ae65019895dfb14889957d9191650162c1975f849506eb3646da93cb7eb642d3d6746fcea387015adc1a3ef5b2adda5768dc8147a5a001be8ec896e

Download Submit
C:\Windows\System\yLiLMXv.exe

Filesize
1.9MB

MD5
73752ef1bf6f41117e76665071aee5a4

SHA1
ffdc8f3f487d1d310f281ee13e903a0f03febbaa

SHA256
3a73d672eb437914079aacfc9a7c009da287f41873f360067f43dd3465ce7f2f

SHA512
b40a8e5efc6a0ee0ebf01c25a56e8c8b3bde8ef64cb23f8b724f099cb1f80f61297594ad421b8df1996aaeee2896e1a8b13fa66525b617eeb9058e7f85e43aa8

Download Submit
C:\Windows\System\yZDRrdl.exe

Filesize
1.9MB

MD5
b5d58b040c12d458b1684991469f953c

SHA1
756d3705c03565d28b694a078f5f3936ce8182e1

SHA256
50bf6b8380a0372d32f6bf00e31360c50585bc0b37dfb26a07a9aa360a7acfc7

SHA512
064989f8f2b767906ff4925190db36e46c40f005fbe78345beeb57ff8811da22339f8707ae990960177a30475c6c44e940a8b78d10c102d4b8fed1d92b00e541

Download Submit
memory/1016-3854-0x00007FF63CA50000-0x00007FF63CE42000-memory.dmp

Filesize
3.9MB

Download
memory/1016-154-0x00007FF63CA50000-0x00007FF63CE42000-memory.dmp

Filesize
3.9MB

Download
memory/1028-310-0x00007FF766780000-0x00007FF766B72000-memory.dmp

Filesize
3.9MB

Download
memory/1028-3890-0x00007FF766780000-0x00007FF766B72000-memory.dmp

Filesize
3.9MB

Download
memory/1084-316-0x00007FF6A9590000-0x00007FF6A9982000-memory.dmp

Filesize
3.9MB

Download
memory/1084-3820-0x00007FF6A9590000-0x00007FF6A9982000-memory.dmp

Filesize
3.9MB

Download
memory/1128-13-0x00007FF768930000-0x00007FF768D22000-memory.dmp

Filesize
3.9MB

Download
memory/1148-3918-0x00007FF7710C0000-0x00007FF7714B2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-296-0x00007FF7710C0000-0x00007FF7714B2000-memory.dmp

Filesize
3.9MB

Download
memory/1200-3915-0x00007FF75F8E0000-0x00007FF75FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1200-297-0x00007FF75F8E0000-0x00007FF75FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1332-199-0x00007FF6EB920000-0x00007FF6EBD12000-memory.dmp

Filesize
3.9MB

Download
memory/1332-3835-0x00007FF6EB920000-0x00007FF6EBD12000-memory.dmp

Filesize
3.9MB

Download
memory/1624-313-0x00007FF630F70000-0x00007FF631362000-memory.dmp

Filesize
3.9MB

Download
memory/1624-3850-0x00007FF630F70000-0x00007FF631362000-memory.dmp

Filesize
3.9MB

Download
memory/1664-312-0x00007FF67B3E0000-0x00007FF67B7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-3910-0x00007FF67B3E0000-0x00007FF67B7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-3839-0x00007FF789280000-0x00007FF789672000-memory.dmp

Filesize
3.9MB

Download
memory/1736-235-0x00007FF789280000-0x00007FF789672000-memory.dmp

Filesize
3.9MB

Download
memory/2592-3857-0x00007FF727C10000-0x00007FF728002000-memory.dmp

Filesize
3.9MB

Download
memory/2592-318-0x00007FF727C10000-0x00007FF728002000-memory.dmp

Filesize
3.9MB

Download
memory/2872-294-0x00007FF6506F0000-0x00007FF650AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-3847-0x00007FF6506F0000-0x00007FF650AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-0-0x00007FF6E8AD0000-0x00007FF6E8EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-1-0x000001936E1C0000-0x000001936E1D0000-memory.dmp

Filesize
64KB

Download
memory/3084-27-0x00007FF785980000-0x00007FF785D72000-memory.dmp

Filesize
3.9MB

Download
memory/3180-3894-0x00007FF67C6C0000-0x00007FF67CAB2000-memory.dmp

Filesize
3.9MB

Download
memory/3180-311-0x00007FF67C6C0000-0x00007FF67CAB2000-memory.dmp

Filesize
3.9MB

Download
memory/3272-94-0x00007FF719030000-0x00007FF719422000-memory.dmp

Filesize
3.9MB

Download
memory/3396-3777-0x00007FF76C930000-0x00007FF76CD22000-memory.dmp

Filesize
3.9MB

Download
memory/3396-36-0x00007FF76C930000-0x00007FF76CD22000-memory.dmp

Filesize
3.9MB

Download
memory/3596-3788-0x00007FF662F30000-0x00007FF663322000-memory.dmp

Filesize
3.9MB

Download
memory/3596-315-0x00007FF662F30000-0x00007FF663322000-memory.dmp

Filesize
3.9MB

Download
memory/3668-22-0x00007FF745210000-0x00007FF745602000-memory.dmp

Filesize
3.9MB

Download
memory/4264-3780-0x00007FF79DBB0000-0x00007FF79DFA2000-memory.dmp

Filesize
3.9MB

Download
memory/4264-62-0x00007FF79DBB0000-0x00007FF79DFA2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-298-0x00007FF69E6C0000-0x00007FF69EAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-3920-0x00007FF69E6C0000-0x00007FF69EAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4380-3828-0x00007FF695420000-0x00007FF695812000-memory.dmp

Filesize
3.9MB

Download
memory/4380-317-0x00007FF695420000-0x00007FF695812000-memory.dmp

Filesize
3.9MB

Download
memory/4508-3861-0x00007FF6FA000000-0x00007FF6FA3F2000-memory.dmp

Filesize
3.9MB

Download
memory/4508-193-0x00007FF6FA000000-0x00007FF6FA3F2000-memory.dmp

Filesize
3.9MB

Download
memory/4708-309-0x00007FF65CEF0000-0x00007FF65D2E2000-memory.dmp

Filesize
3.9MB

Download
memory/4708-3864-0x00007FF65CEF0000-0x00007FF65D2E2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-314-0x00007FFD378A3000-0x00007FFD378A5000-memory.dmp

Filesize
8KB

Download
memory/4728-23-0x000001CA4A380000-0x000001CA4A390000-memory.dmp

Filesize
64KB

Download
memory/4728-308-0x000001CA4A970000-0x000001CA4A992000-memory.dmp

Filesize
136KB

Download
memory/4728-320-0x000001CA4B4E0000-0x000001CA4BC86000-memory.dmp

Filesize
7.6MB

Download
memory/4728-4724-0x00007FFD378A3000-0x00007FFD378A5000-memory.dmp

Filesize
8KB

Download
memory/4912-3886-0x00007FF6F3960000-0x00007FF6F3D52000-memory.dmp

Filesize
3.9MB

Download
memory/4912-319-0x00007FF6F3960000-0x00007FF6F3D52000-memory.dmp

Filesize
3.9MB

Download