xmrig | 6a2df3a64ff9bab44280c9ac52df4b7d2c0f388667ce332641791e45bec74af4

Analysis

max time kernel
95s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac810ee3d8e70be2145e6d875525b6a0N.exe
Size

1.1MB
MD5

ac810ee3d8e70be2145e6d875525b6a0
SHA1

01570dbc6e087035e9bdf8fad9af5def35b5847e
SHA256

6a2df3a64ff9bab44280c9ac52df4b7d2c0f388667ce332641791e45bec74af4
SHA512

ddad40cfe99a032105622c1fc1c44b41fe319b98af22e817f8d208f90063db0fc33aa4c2e8a4e555abc5315c9efc5f0ee73431c69efab8797434ebf133a2c20f
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYEAhnraiJwULi:Lz071uv4BPMkibTIA5EAR2yLi

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4556-378-0x00007FF70E130000-0x00007FF70E522000-memory.dmp	xmrig
behavioral2/memory/772-391-0x00007FF7F2A00000-0x00007FF7F2DF2000-memory.dmp	xmrig
behavioral2/memory/3040-396-0x00007FF699B00000-0x00007FF699EF2000-memory.dmp	xmrig
behavioral2/memory/3708-404-0x00007FF640CD0000-0x00007FF6410C2000-memory.dmp	xmrig
behavioral2/memory/4152-406-0x00007FF7C47B0000-0x00007FF7C4BA2000-memory.dmp	xmrig
behavioral2/memory/3784-405-0x00007FF610830000-0x00007FF610C22000-memory.dmp	xmrig
behavioral2/memory/216-403-0x00007FF6F5830000-0x00007FF6F5C22000-memory.dmp	xmrig
behavioral2/memory/4208-402-0x00007FF6DD490000-0x00007FF6DD882000-memory.dmp	xmrig
behavioral2/memory/4900-401-0x00007FF77BD80000-0x00007FF77C172000-memory.dmp	xmrig
behavioral2/memory/4600-400-0x00007FF653F30000-0x00007FF654322000-memory.dmp	xmrig
behavioral2/memory/4412-399-0x00007FF6327C0000-0x00007FF632BB2000-memory.dmp	xmrig
behavioral2/memory/4988-398-0x00007FF77D550000-0x00007FF77D942000-memory.dmp	xmrig
behavioral2/memory/4960-397-0x00007FF7FC890000-0x00007FF7FCC82000-memory.dmp	xmrig
behavioral2/memory/1588-395-0x00007FF672810000-0x00007FF672C02000-memory.dmp	xmrig
behavioral2/memory/3420-394-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp	xmrig
behavioral2/memory/3844-393-0x00007FF7F8C30000-0x00007FF7F9022000-memory.dmp	xmrig
behavioral2/memory/4308-392-0x00007FF7BBFD0000-0x00007FF7BC3C2000-memory.dmp	xmrig
behavioral2/memory/5000-390-0x00007FF74F6E0000-0x00007FF74FAD2000-memory.dmp	xmrig
behavioral2/memory/1044-389-0x00007FF70EB50000-0x00007FF70EF42000-memory.dmp	xmrig
behavioral2/memory/4044-377-0x00007FF6999F0000-0x00007FF699DE2000-memory.dmp	xmrig
behavioral2/memory/3804-376-0x00007FF6A7700000-0x00007FF6A7AF2000-memory.dmp	xmrig
behavioral2/memory/3340-97-0x00007FF6BEBB0000-0x00007FF6BEFA2000-memory.dmp	xmrig
behavioral2/memory/3624-50-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp	xmrig
behavioral2/memory/2280-31-0x00007FF6CCF90000-0x00007FF6CD382000-memory.dmp	xmrig
behavioral2/memory/2280-3321-0x00007FF6CCF90000-0x00007FF6CD382000-memory.dmp	xmrig
behavioral2/memory/3624-3323-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp	xmrig
behavioral2/memory/3340-3325-0x00007FF6BEBB0000-0x00007FF6BEFA2000-memory.dmp	xmrig
behavioral2/memory/3708-3327-0x00007FF640CD0000-0x00007FF6410C2000-memory.dmp	xmrig
behavioral2/memory/3804-3329-0x00007FF6A7700000-0x00007FF6A7AF2000-memory.dmp	xmrig
behavioral2/memory/4556-3331-0x00007FF70E130000-0x00007FF70E522000-memory.dmp	xmrig
behavioral2/memory/1044-3334-0x00007FF70EB50000-0x00007FF70EF42000-memory.dmp	xmrig
behavioral2/memory/216-3335-0x00007FF6F5830000-0x00007FF6F5C22000-memory.dmp	xmrig
behavioral2/memory/3420-3337-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp	xmrig
behavioral2/memory/3784-3339-0x00007FF610830000-0x00007FF610C22000-memory.dmp	xmrig
behavioral2/memory/4960-3341-0x00007FF7FC890000-0x00007FF7FCC82000-memory.dmp	xmrig
behavioral2/memory/772-3346-0x00007FF7F2A00000-0x00007FF7F2DF2000-memory.dmp	xmrig
behavioral2/memory/4044-3345-0x00007FF6999F0000-0x00007FF699DE2000-memory.dmp	xmrig
behavioral2/memory/4988-3348-0x00007FF77D550000-0x00007FF77D942000-memory.dmp	xmrig
behavioral2/memory/4600-3350-0x00007FF653F30000-0x00007FF654322000-memory.dmp	xmrig
behavioral2/memory/4308-3353-0x00007FF7BBFD0000-0x00007FF7BC3C2000-memory.dmp	xmrig
behavioral2/memory/4412-3357-0x00007FF6327C0000-0x00007FF632BB2000-memory.dmp	xmrig
behavioral2/memory/3844-3362-0x00007FF7F8C30000-0x00007FF7F9022000-memory.dmp	xmrig
behavioral2/memory/5000-3364-0x00007FF74F6E0000-0x00007FF74FAD2000-memory.dmp	xmrig
behavioral2/memory/1588-3360-0x00007FF672810000-0x00007FF672C02000-memory.dmp	xmrig
behavioral2/memory/3040-3371-0x00007FF699B00000-0x00007FF699EF2000-memory.dmp	xmrig
behavioral2/memory/4900-3380-0x00007FF77BD80000-0x00007FF77C172000-memory.dmp	xmrig
behavioral2/memory/4152-3375-0x00007FF7C47B0000-0x00007FF7C4BA2000-memory.dmp	xmrig
behavioral2/memory/4208-3374-0x00007FF6DD490000-0x00007FF6DD882000-memory.dmp	xmrig

Blocklisted process makes network request 13 IoCs

flow	pid	Process
9	2908	powershell.exe
11	2908	powershell.exe
13	2908	powershell.exe
14	2908	powershell.exe
16	2908	powershell.exe
20	2908	powershell.exe
21	2908	powershell.exe
22	2908	powershell.exe
23	2908	powershell.exe
24	2908	powershell.exe
25	2908	powershell.exe
26	2908	powershell.exe
27	2908	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2908	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2280	vWcCTLp.exe
3624	WlqtOFt.exe
3340	wFoVTvl.exe
216	HoZXqkl.exe
3708	GZrQuck.exe
3804	kysBBMT.exe
4044	LxIUQmY.exe
4556	wyueUxT.exe
1044	PLiuEtV.exe
5000	LrsbIbr.exe
3784	ORLogWB.exe
772	ccoMHFE.exe
4308	HunglDO.exe
3844	kNZbXfj.exe
3420	ikzPqYW.exe
1588	PVKlrIX.exe
3040	CSKHKiH.exe
4960	KsFEZqY.exe
4152	apUQPBq.exe
4988	ngnDiBX.exe
4412	XTuLEwG.exe
4600	iGDXKmS.exe
4900	IMnUisu.exe
4208	kPBXfOj.exe
2320	OMZwfIU.exe
2332	HzcCpbF.exe
2128	yczXJjX.exe
4780	nTUstlp.exe
3096	AkcihLm.exe
2296	IECNCFC.exe
3672	GhbSfOx.exe
3524	odYKhyY.exe
64	qwTJZwj.exe
4376	VIusEKI.exe
3720	fKfdbPE.exe
4512	RyhOlDN.exe
4908	cZkVwUf.exe
2620	qhcapYR.exe
1948	dRInTGp.exe
2688	vuNYQYh.exe
4920	WdhysQO.exe
4056	OSMuztG.exe
4532	KDOwweb.exe
2032	YYgXDXH.exe
3356	sSmoPTe.exe
648	opdjjBH.exe
1228	HaybHyG.exe
3032	hzxFMax.exe
4192	xqqjuri.exe
1636	IuWCcHc.exe
952	PMRQnQc.exe
4228	bxQGYVI.exe
4288	LBlQHkz.exe
4492	IjiWxEc.exe
2924	COLKTUM.exe
4980	QcrZjip.exe
3024	GbkIbXp.exe
748	nGPNtDb.exe
3604	eahhsiJ.exe
3140	WwTocdq.exe
4072	AHWtPKj.exe
3264	njespNn.exe
3864	gvaAfDw.exe
640	KxNUqAh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/388-0-0x00007FF7B7240000-0x00007FF7B7632000-memory.dmp	upx
behavioral2/files/0x000700000002347c-32.dat	upx
behavioral2/files/0x0007000000023488-88.dat	upx
behavioral2/files/0x0007000000023483-125.dat	upx
behavioral2/files/0x000700000002349d-195.dat	upx
behavioral2/memory/4556-378-0x00007FF70E130000-0x00007FF70E522000-memory.dmp	upx
behavioral2/memory/772-391-0x00007FF7F2A00000-0x00007FF7F2DF2000-memory.dmp	upx
behavioral2/memory/3040-396-0x00007FF699B00000-0x00007FF699EF2000-memory.dmp	upx
behavioral2/memory/3708-404-0x00007FF640CD0000-0x00007FF6410C2000-memory.dmp	upx
behavioral2/memory/4152-406-0x00007FF7C47B0000-0x00007FF7C4BA2000-memory.dmp	upx
behavioral2/memory/3784-405-0x00007FF610830000-0x00007FF610C22000-memory.dmp	upx
behavioral2/memory/216-403-0x00007FF6F5830000-0x00007FF6F5C22000-memory.dmp	upx
behavioral2/memory/4208-402-0x00007FF6DD490000-0x00007FF6DD882000-memory.dmp	upx
behavioral2/memory/4900-401-0x00007FF77BD80000-0x00007FF77C172000-memory.dmp	upx
behavioral2/memory/4600-400-0x00007FF653F30000-0x00007FF654322000-memory.dmp	upx
behavioral2/memory/4412-399-0x00007FF6327C0000-0x00007FF632BB2000-memory.dmp	upx
behavioral2/memory/4988-398-0x00007FF77D550000-0x00007FF77D942000-memory.dmp	upx
behavioral2/memory/4960-397-0x00007FF7FC890000-0x00007FF7FCC82000-memory.dmp	upx
behavioral2/memory/1588-395-0x00007FF672810000-0x00007FF672C02000-memory.dmp	upx
behavioral2/memory/3420-394-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp	upx
behavioral2/memory/3844-393-0x00007FF7F8C30000-0x00007FF7F9022000-memory.dmp	upx
behavioral2/memory/4308-392-0x00007FF7BBFD0000-0x00007FF7BC3C2000-memory.dmp	upx
behavioral2/memory/5000-390-0x00007FF74F6E0000-0x00007FF74FAD2000-memory.dmp	upx
behavioral2/memory/1044-389-0x00007FF70EB50000-0x00007FF70EF42000-memory.dmp	upx
behavioral2/memory/4044-377-0x00007FF6999F0000-0x00007FF699DE2000-memory.dmp	upx
behavioral2/memory/3804-376-0x00007FF6A7700000-0x00007FF6A7AF2000-memory.dmp	upx
behavioral2/files/0x00070000000234a1-200.dat	upx
behavioral2/files/0x0007000000023493-199.dat	upx
behavioral2/files/0x00070000000234a0-198.dat	upx
behavioral2/files/0x000700000002349c-193.dat	upx
behavioral2/files/0x0007000000023486-191.dat	upx
behavioral2/files/0x0007000000023481-188.dat	upx
behavioral2/files/0x0007000000023485-187.dat	upx
behavioral2/files/0x0007000000023490-186.dat	upx
behavioral2/files/0x000700000002349a-182.dat	upx
behavioral2/files/0x0007000000023499-181.dat	upx
behavioral2/files/0x0007000000023498-172.dat	upx
behavioral2/files/0x000700000002348e-169.dat	upx
behavioral2/files/0x0007000000023497-162.dat	upx
behavioral2/files/0x000700000002348c-159.dat	upx
behavioral2/files/0x0007000000023496-152.dat	upx
behavioral2/files/0x000700000002347e-148.dat	upx
behavioral2/files/0x000700000002348a-143.dat	upx
behavioral2/files/0x0007000000023494-140.dat	upx
behavioral2/files/0x0007000000023495-139.dat	upx
behavioral2/files/0x0007000000023489-131.dat	upx
behavioral2/files/0x000700000002349f-197.dat	upx
behavioral2/files/0x000700000002349e-196.dat	upx
behavioral2/files/0x0007000000023492-121.dat	upx
behavioral2/files/0x000700000002349b-192.dat	upx
behavioral2/files/0x0007000000023491-117.dat	upx
behavioral2/files/0x000700000002348d-107.dat	upx
behavioral2/files/0x000700000002348b-102.dat	upx
behavioral2/files/0x0007000000023484-99.dat	upx
behavioral2/memory/3340-97-0x00007FF6BEBB0000-0x00007FF6BEFA2000-memory.dmp	upx
behavioral2/files/0x0007000000023482-89.dat	upx
behavioral2/files/0x0007000000023487-87.dat	upx
behavioral2/files/0x000700000002348f-112.dat	upx
behavioral2/files/0x000700000002347f-66.dat	upx
behavioral2/files/0x000700000002347d-58.dat	upx
behavioral2/memory/3624-50-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp	upx
behavioral2/files/0x000700000002347b-76.dat	upx
behavioral2/files/0x0007000000023480-70.dat	upx
behavioral2/files/0x000700000002347a-33.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wjKaqtY.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\gTHvmsg.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\DlPKILp.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\jvFFVeg.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\uOSBWLL.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\PcDzXJN.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\WAyYaVK.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\OFRNArg.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\RyaLrzs.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\zlgXvYR.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\EEVTwqC.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\bMHmahF.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\LOxuPeM.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\cqTXCGQ.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\EKHFPnt.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\qmZyMnW.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\ibbzqcX.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\ZgkKxFr.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\rPqFBwL.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\IECNCFC.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\ASTzWlU.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\xmDWsTr.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\RNyFsYd.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\atdnDAu.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\yBQRQfh.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\QhRkqWO.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\fYXxscB.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\LjkZrmR.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\QPVRmwO.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\xhFQziq.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\UhbTrtr.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\hukuAYv.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\RNKtqtv.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\kTqaesp.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\uCSoyZe.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\KskXtCc.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\SzvmbLJ.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\kNZbXfj.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\pyoFGpG.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\aZFMAyY.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\tlumHFS.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\NPyuYTn.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\AEBvBLe.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\FJzaZVG.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\WNnGsZP.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\OQiBbMN.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\zcJNhyZ.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\XAZvGMI.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\AIIVvKS.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\vBsdFXP.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\UlZyJjE.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\idEsPtC.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\QbDZUtq.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\xDxdyCR.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\yWZNwwS.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\WbJdCYq.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\XCJEEyk.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\KsFEZqY.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\WdhysQO.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\sAnSVSK.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\xypTZdt.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\vXzAMuE.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\iVINYYa.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe
File created	C:\Windows\System\umGkqOb.exe	ac810ee3d8e70be2145e6d875525b6a0N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeLockMemoryPrivilege	388	ac810ee3d8e70be2145e6d875525b6a0N.exe
Token: SeLockMemoryPrivilege	388	ac810ee3d8e70be2145e6d875525b6a0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2908	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	85
PID 388 wrote to memory of 2908	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	85
PID 388 wrote to memory of 2280	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	86
PID 388 wrote to memory of 2280	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	86
PID 388 wrote to memory of 3624	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	87
PID 388 wrote to memory of 3624	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	87
PID 388 wrote to memory of 3340	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	88
PID 388 wrote to memory of 3340	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	88
PID 388 wrote to memory of 216	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	89
PID 388 wrote to memory of 216	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	89
PID 388 wrote to memory of 3708	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	90
PID 388 wrote to memory of 3708	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	90
PID 388 wrote to memory of 3804	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	91
PID 388 wrote to memory of 3804	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	91
PID 388 wrote to memory of 4044	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	92
PID 388 wrote to memory of 4044	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	92
PID 388 wrote to memory of 4556	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	93
PID 388 wrote to memory of 4556	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	93
PID 388 wrote to memory of 1044	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	94
PID 388 wrote to memory of 1044	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	94
PID 388 wrote to memory of 5000	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	95
PID 388 wrote to memory of 5000	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	95
PID 388 wrote to memory of 3040	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	96
PID 388 wrote to memory of 3040	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	96
PID 388 wrote to memory of 3784	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	97
PID 388 wrote to memory of 3784	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	97
PID 388 wrote to memory of 772	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	98
PID 388 wrote to memory of 772	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	98
PID 388 wrote to memory of 4308	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	99
PID 388 wrote to memory of 4308	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	99
PID 388 wrote to memory of 3844	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	100
PID 388 wrote to memory of 3844	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	100
PID 388 wrote to memory of 3420	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	101
PID 388 wrote to memory of 3420	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	101
PID 388 wrote to memory of 1588	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	102
PID 388 wrote to memory of 1588	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	102
PID 388 wrote to memory of 4960	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	103
PID 388 wrote to memory of 4960	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	103
PID 388 wrote to memory of 3096	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	104
PID 388 wrote to memory of 3096	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	104
PID 388 wrote to memory of 4152	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	105
PID 388 wrote to memory of 4152	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	105
PID 388 wrote to memory of 4988	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	106
PID 388 wrote to memory of 4988	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	106
PID 388 wrote to memory of 4412	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	107
PID 388 wrote to memory of 4412	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	107
PID 388 wrote to memory of 4600	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	108
PID 388 wrote to memory of 4600	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	108
PID 388 wrote to memory of 4900	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	109
PID 388 wrote to memory of 4900	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	109
PID 388 wrote to memory of 3720	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	110
PID 388 wrote to memory of 3720	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	110
PID 388 wrote to memory of 4208	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	111
PID 388 wrote to memory of 4208	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	111
PID 388 wrote to memory of 2320	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	112
PID 388 wrote to memory of 2320	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	112
PID 388 wrote to memory of 2332	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	113
PID 388 wrote to memory of 2332	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	113
PID 388 wrote to memory of 2128	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	114
PID 388 wrote to memory of 2128	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	114
PID 388 wrote to memory of 4780	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	115
PID 388 wrote to memory of 4780	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	115
PID 388 wrote to memory of 2296	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	116
PID 388 wrote to memory of 2296	388	ac810ee3d8e70be2145e6d875525b6a0N.exe	116

C:\Users\Admin\AppData\Local\Temp\ac810ee3d8e70be2145e6d875525b6a0N.exe
"C:\Users\Admin\AppData\Local\Temp\ac810ee3d8e70be2145e6d875525b6a0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\System\vWcCTLp.exe
  C:\Windows\System\vWcCTLp.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\WlqtOFt.exe
  C:\Windows\System\WlqtOFt.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\wFoVTvl.exe
  C:\Windows\System\wFoVTvl.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\HoZXqkl.exe
  C:\Windows\System\HoZXqkl.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\GZrQuck.exe
  C:\Windows\System\GZrQuck.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\kysBBMT.exe
  C:\Windows\System\kysBBMT.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\LxIUQmY.exe
  C:\Windows\System\LxIUQmY.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\wyueUxT.exe
  C:\Windows\System\wyueUxT.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\PLiuEtV.exe
  C:\Windows\System\PLiuEtV.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\LrsbIbr.exe
  C:\Windows\System\LrsbIbr.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\CSKHKiH.exe
  C:\Windows\System\CSKHKiH.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\ORLogWB.exe
  C:\Windows\System\ORLogWB.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\ccoMHFE.exe
  C:\Windows\System\ccoMHFE.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\HunglDO.exe
  C:\Windows\System\HunglDO.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\kNZbXfj.exe
  C:\Windows\System\kNZbXfj.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\ikzPqYW.exe
  C:\Windows\System\ikzPqYW.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\PVKlrIX.exe
  C:\Windows\System\PVKlrIX.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\KsFEZqY.exe
  C:\Windows\System\KsFEZqY.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\AkcihLm.exe
  C:\Windows\System\AkcihLm.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\apUQPBq.exe
  C:\Windows\System\apUQPBq.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\ngnDiBX.exe
  C:\Windows\System\ngnDiBX.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\XTuLEwG.exe
  C:\Windows\System\XTuLEwG.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\iGDXKmS.exe
  C:\Windows\System\iGDXKmS.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\IMnUisu.exe
  C:\Windows\System\IMnUisu.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\fKfdbPE.exe
  C:\Windows\System\fKfdbPE.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\kPBXfOj.exe
  C:\Windows\System\kPBXfOj.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\OMZwfIU.exe
  C:\Windows\System\OMZwfIU.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\HzcCpbF.exe
  C:\Windows\System\HzcCpbF.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\yczXJjX.exe
  C:\Windows\System\yczXJjX.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\nTUstlp.exe
  C:\Windows\System\nTUstlp.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\IECNCFC.exe
  C:\Windows\System\IECNCFC.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\GhbSfOx.exe
  C:\Windows\System\GhbSfOx.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\odYKhyY.exe
  C:\Windows\System\odYKhyY.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\qwTJZwj.exe
  C:\Windows\System\qwTJZwj.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\VIusEKI.exe
  C:\Windows\System\VIusEKI.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\RyhOlDN.exe
  C:\Windows\System\RyhOlDN.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\cZkVwUf.exe
  C:\Windows\System\cZkVwUf.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\qhcapYR.exe
  C:\Windows\System\qhcapYR.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\dRInTGp.exe
  C:\Windows\System\dRInTGp.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\vuNYQYh.exe
  C:\Windows\System\vuNYQYh.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\WdhysQO.exe
  C:\Windows\System\WdhysQO.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\OSMuztG.exe
  C:\Windows\System\OSMuztG.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\KDOwweb.exe
  C:\Windows\System\KDOwweb.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\YYgXDXH.exe
  C:\Windows\System\YYgXDXH.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\sSmoPTe.exe
  C:\Windows\System\sSmoPTe.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\opdjjBH.exe
  C:\Windows\System\opdjjBH.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\HaybHyG.exe
  C:\Windows\System\HaybHyG.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\hzxFMax.exe
  C:\Windows\System\hzxFMax.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\xqqjuri.exe
  C:\Windows\System\xqqjuri.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\IuWCcHc.exe
  C:\Windows\System\IuWCcHc.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\PMRQnQc.exe
  C:\Windows\System\PMRQnQc.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\bxQGYVI.exe
  C:\Windows\System\bxQGYVI.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\LBlQHkz.exe
  C:\Windows\System\LBlQHkz.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\IjiWxEc.exe
  C:\Windows\System\IjiWxEc.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\COLKTUM.exe
  C:\Windows\System\COLKTUM.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\QcrZjip.exe
  C:\Windows\System\QcrZjip.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\GbkIbXp.exe
  C:\Windows\System\GbkIbXp.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\nGPNtDb.exe
  C:\Windows\System\nGPNtDb.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\eahhsiJ.exe
  C:\Windows\System\eahhsiJ.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\WwTocdq.exe
  C:\Windows\System\WwTocdq.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\AHWtPKj.exe
  C:\Windows\System\AHWtPKj.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\njespNn.exe
  C:\Windows\System\njespNn.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\gvaAfDw.exe
  C:\Windows\System\gvaAfDw.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\KxNUqAh.exe
  C:\Windows\System\KxNUqAh.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\ttorWlE.exe
  C:\Windows\System\ttorWlE.exe
  2⤵
  PID:1160
- C:\Windows\System\inlOqQh.exe
  C:\Windows\System\inlOqQh.exe
  2⤵
  PID:2884
- C:\Windows\System\aETZfqw.exe
  C:\Windows\System\aETZfqw.exe
  2⤵
  PID:4824
- C:\Windows\System\VcUqULn.exe
  C:\Windows\System\VcUqULn.exe
  2⤵
  PID:3312
- C:\Windows\System\tFrDysK.exe
  C:\Windows\System\tFrDysK.exe
  2⤵
  PID:3992
- C:\Windows\System\aEvQkxO.exe
  C:\Windows\System\aEvQkxO.exe
  2⤵
  PID:3544
- C:\Windows\System\voHtFmD.exe
  C:\Windows\System\voHtFmD.exe
  2⤵
  PID:3860
- C:\Windows\System\oUfbJgJ.exe
  C:\Windows\System\oUfbJgJ.exe
  2⤵
  PID:2976
- C:\Windows\System\DBJZpdD.exe
  C:\Windows\System\DBJZpdD.exe
  2⤵
  PID:4224
- C:\Windows\System\OiiXBeE.exe
  C:\Windows\System\OiiXBeE.exe
  2⤵
  PID:1760
- C:\Windows\System\lwwbnqj.exe
  C:\Windows\System\lwwbnqj.exe
  2⤵
  PID:4336
- C:\Windows\System\eOcWgIe.exe
  C:\Windows\System\eOcWgIe.exe
  2⤵
  PID:4156
- C:\Windows\System\kmiqeBV.exe
  C:\Windows\System\kmiqeBV.exe
  2⤵
  PID:2236
- C:\Windows\System\Dhskhtr.exe
  C:\Windows\System\Dhskhtr.exe
  2⤵
  PID:3252
- C:\Windows\System\xqAIduE.exe
  C:\Windows\System\xqAIduE.exe
  2⤵
  PID:1444
- C:\Windows\System\qfZuWWu.exe
  C:\Windows\System\qfZuWWu.exe
  2⤵
  PID:3716
- C:\Windows\System\LBwcTEG.exe
  C:\Windows\System\LBwcTEG.exe
  2⤵
  PID:3500
- C:\Windows\System\rHnEzHm.exe
  C:\Windows\System\rHnEzHm.exe
  2⤵
  PID:3200
- C:\Windows\System\crhfqKx.exe
  C:\Windows\System\crhfqKx.exe
  2⤵
  PID:5136
- C:\Windows\System\woafggK.exe
  C:\Windows\System\woafggK.exe
  2⤵
  PID:5156
- C:\Windows\System\zMBgvtx.exe
  C:\Windows\System\zMBgvtx.exe
  2⤵
  PID:5172
- C:\Windows\System\MaWoMXf.exe
  C:\Windows\System\MaWoMXf.exe
  2⤵
  PID:5212
- C:\Windows\System\NLcgBPx.exe
  C:\Windows\System\NLcgBPx.exe
  2⤵
  PID:5228
- C:\Windows\System\AsksKZW.exe
  C:\Windows\System\AsksKZW.exe
  2⤵
  PID:5252
- C:\Windows\System\amTHatb.exe
  C:\Windows\System\amTHatb.exe
  2⤵
  PID:5272
- C:\Windows\System\wxbrIVy.exe
  C:\Windows\System\wxbrIVy.exe
  2⤵
  PID:5288
- C:\Windows\System\nZrcQby.exe
  C:\Windows\System\nZrcQby.exe
  2⤵
  PID:5308
- C:\Windows\System\TezEDkX.exe
  C:\Windows\System\TezEDkX.exe
  2⤵
  PID:5324
- C:\Windows\System\XkEfYMm.exe
  C:\Windows\System\XkEfYMm.exe
  2⤵
  PID:5344
- C:\Windows\System\bNKQflC.exe
  C:\Windows\System\bNKQflC.exe
  2⤵
  PID:5360
- C:\Windows\System\KCmJYWB.exe
  C:\Windows\System\KCmJYWB.exe
  2⤵
  PID:5376
- C:\Windows\System\JhUydxK.exe
  C:\Windows\System\JhUydxK.exe
  2⤵
  PID:5396
- C:\Windows\System\vIAdfBT.exe
  C:\Windows\System\vIAdfBT.exe
  2⤵
  PID:5412
- C:\Windows\System\dqpmVyA.exe
  C:\Windows\System\dqpmVyA.exe
  2⤵
  PID:5428
- C:\Windows\System\GEmUgUF.exe
  C:\Windows\System\GEmUgUF.exe
  2⤵
  PID:5444
- C:\Windows\System\FHsXDHs.exe
  C:\Windows\System\FHsXDHs.exe
  2⤵
  PID:5464
- C:\Windows\System\JoChywE.exe
  C:\Windows\System\JoChywE.exe
  2⤵
  PID:5484
- C:\Windows\System\cvCnjPM.exe
  C:\Windows\System\cvCnjPM.exe
  2⤵
  PID:5500
- C:\Windows\System\pyoFGpG.exe
  C:\Windows\System\pyoFGpG.exe
  2⤵
  PID:5520
- C:\Windows\System\HdKdZKI.exe
  C:\Windows\System\HdKdZKI.exe
  2⤵
  PID:5536
- C:\Windows\System\LlBarTf.exe
  C:\Windows\System\LlBarTf.exe
  2⤵
  PID:5552
- C:\Windows\System\KdETiJG.exe
  C:\Windows\System\KdETiJG.exe
  2⤵
  PID:5568
- C:\Windows\System\TwPyfHm.exe
  C:\Windows\System\TwPyfHm.exe
  2⤵
  PID:5584
- C:\Windows\System\NrHOsdX.exe
  C:\Windows\System\NrHOsdX.exe
  2⤵
  PID:5604
- C:\Windows\System\kKTSXdg.exe
  C:\Windows\System\kKTSXdg.exe
  2⤵
  PID:5636
- C:\Windows\System\FzPwsbG.exe
  C:\Windows\System\FzPwsbG.exe
  2⤵
  PID:5672
- C:\Windows\System\abMbwaq.exe
  C:\Windows\System\abMbwaq.exe
  2⤵
  PID:5728
- C:\Windows\System\OVJBSxR.exe
  C:\Windows\System\OVJBSxR.exe
  2⤵
  PID:5744
- C:\Windows\System\HOXBNPB.exe
  C:\Windows\System\HOXBNPB.exe
  2⤵
  PID:5760
- C:\Windows\System\YLUKXfX.exe
  C:\Windows\System\YLUKXfX.exe
  2⤵
  PID:5784
- C:\Windows\System\rIlJJKo.exe
  C:\Windows\System\rIlJJKo.exe
  2⤵
  PID:5800
- C:\Windows\System\ENhkJps.exe
  C:\Windows\System\ENhkJps.exe
  2⤵
  PID:5828
- C:\Windows\System\fFFTnhl.exe
  C:\Windows\System\fFFTnhl.exe
  2⤵
  PID:5848
- C:\Windows\System\IeFeENa.exe
  C:\Windows\System\IeFeENa.exe
  2⤵
  PID:5864
- C:\Windows\System\ONpQAFN.exe
  C:\Windows\System\ONpQAFN.exe
  2⤵
  PID:5884
- C:\Windows\System\YhTFQdC.exe
  C:\Windows\System\YhTFQdC.exe
  2⤵
  PID:5900
- C:\Windows\System\OtpPIkt.exe
  C:\Windows\System\OtpPIkt.exe
  2⤵
  PID:5924
- C:\Windows\System\EbjmYiN.exe
  C:\Windows\System\EbjmYiN.exe
  2⤵
  PID:5940
- C:\Windows\System\wyxSfui.exe
  C:\Windows\System\wyxSfui.exe
  2⤵
  PID:4696
- C:\Windows\System\SZzyTte.exe
  C:\Windows\System\SZzyTte.exe
  2⤵
  PID:4344
- C:\Windows\System\YEyRiun.exe
  C:\Windows\System\YEyRiun.exe
  2⤵
  PID:5064
- C:\Windows\System\sbRkAZW.exe
  C:\Windows\System\sbRkAZW.exe
  2⤵
  PID:3640
- C:\Windows\System\mVhLthY.exe
  C:\Windows\System\mVhLthY.exe
  2⤵
  PID:1880
- C:\Windows\System\XsDOOzy.exe
  C:\Windows\System\XsDOOzy.exe
  2⤵
  PID:5384
- C:\Windows\System\rYPNQuo.exe
  C:\Windows\System\rYPNQuo.exe
  2⤵
  PID:5420
- C:\Windows\System\JXUjGBk.exe
  C:\Windows\System\JXUjGBk.exe
  2⤵
  PID:5452
- C:\Windows\System\SRLZoGy.exe
  C:\Windows\System\SRLZoGy.exe
  2⤵
  PID:5480
- C:\Windows\System\YhOHFgu.exe
  C:\Windows\System\YhOHFgu.exe
  2⤵
  PID:5512
- C:\Windows\System\YUzVHsi.exe
  C:\Windows\System\YUzVHsi.exe
  2⤵
  PID:5544
- C:\Windows\System\KaVwmZJ.exe
  C:\Windows\System\KaVwmZJ.exe
  2⤵
  PID:5576
- C:\Windows\System\MswoBnG.exe
  C:\Windows\System\MswoBnG.exe
  2⤵
  PID:5776
- C:\Windows\System\TRFfevK.exe
  C:\Windows\System\TRFfevK.exe
  2⤵
  PID:5812
- C:\Windows\System\VPptJna.exe
  C:\Windows\System\VPptJna.exe
  2⤵
  PID:5860
- C:\Windows\System\rgpKqKz.exe
  C:\Windows\System\rgpKqKz.exe
  2⤵
  PID:5908
- C:\Windows\System\DQamcvB.exe
  C:\Windows\System\DQamcvB.exe
  2⤵
  PID:5936
- C:\Windows\System\bIfunRg.exe
  C:\Windows\System\bIfunRg.exe
  2⤵
  PID:6000
- C:\Windows\System\jDPvnNc.exe
  C:\Windows\System\jDPvnNc.exe
  2⤵
  PID:6068
- C:\Windows\System\NuCFYiR.exe
  C:\Windows\System\NuCFYiR.exe
  2⤵
  PID:6100
- C:\Windows\System\LrVaBQA.exe
  C:\Windows\System\LrVaBQA.exe
  2⤵
  PID:6076
- C:\Windows\System\EdUITVV.exe
  C:\Windows\System\EdUITVV.exe
  2⤵
  PID:6104
- C:\Windows\System\jBPFJqw.exe
  C:\Windows\System\jBPFJqw.exe
  2⤵
  PID:1432
- C:\Windows\System\HFdQHCy.exe
  C:\Windows\System\HFdQHCy.exe
  2⤵
  PID:3220
- C:\Windows\System\XAVYMVm.exe
  C:\Windows\System\XAVYMVm.exe
  2⤵
  PID:1532
- C:\Windows\System\HMyQIlC.exe
  C:\Windows\System\HMyQIlC.exe
  2⤵
  PID:5044
- C:\Windows\System\lALBPqq.exe
  C:\Windows\System\lALBPqq.exe
  2⤵
  PID:792
- C:\Windows\System\KdFXqFl.exe
  C:\Windows\System\KdFXqFl.exe
  2⤵
  PID:1488
- C:\Windows\System\RJniLgI.exe
  C:\Windows\System\RJniLgI.exe
  2⤵
  PID:4564
- C:\Windows\System\YmdIvzo.exe
  C:\Windows\System\YmdIvzo.exe
  2⤵
  PID:4444
- C:\Windows\System\XPCzsiB.exe
  C:\Windows\System\XPCzsiB.exe
  2⤵
  PID:1952
- C:\Windows\System\TBxmOoU.exe
  C:\Windows\System\TBxmOoU.exe
  2⤵
  PID:5008
- C:\Windows\System\mhCwOLH.exe
  C:\Windows\System\mhCwOLH.exe
  2⤵
  PID:2404
- C:\Windows\System\IVHHkvM.exe
  C:\Windows\System\IVHHkvM.exe
  2⤵
  PID:3336
- C:\Windows\System\vXNfofz.exe
  C:\Windows\System\vXNfofz.exe
  2⤵
  PID:436
- C:\Windows\System\coCBIZo.exe
  C:\Windows\System\coCBIZo.exe
  2⤵
  PID:3612
- C:\Windows\System\bMHmahF.exe
  C:\Windows\System\bMHmahF.exe
  2⤵
  PID:6056
- C:\Windows\System\QbwOJSJ.exe
  C:\Windows\System\QbwOJSJ.exe
  2⤵
  PID:1068
- C:\Windows\System\sQWaVbb.exe
  C:\Windows\System\sQWaVbb.exe
  2⤵
  PID:468
- C:\Windows\System\QwALeBE.exe
  C:\Windows\System\QwALeBE.exe
  2⤵
  PID:4736
- C:\Windows\System\iDtseNc.exe
  C:\Windows\System\iDtseNc.exe
  2⤵
  PID:4472
- C:\Windows\System\zXwnkGf.exe
  C:\Windows\System\zXwnkGf.exe
  2⤵
  PID:6232
- C:\Windows\System\dvISxcH.exe
  C:\Windows\System\dvISxcH.exe
  2⤵
  PID:6340
- C:\Windows\System\uxrjEEf.exe
  C:\Windows\System\uxrjEEf.exe
  2⤵
  PID:6360
- C:\Windows\System\nsLczWL.exe
  C:\Windows\System\nsLczWL.exe
  2⤵
  PID:6376
- C:\Windows\System\ZjUJkYK.exe
  C:\Windows\System\ZjUJkYK.exe
  2⤵
  PID:6392
- C:\Windows\System\pGPjtkU.exe
  C:\Windows\System\pGPjtkU.exe
  2⤵
  PID:6408
- C:\Windows\System\JSMYeSJ.exe
  C:\Windows\System\JSMYeSJ.exe
  2⤵
  PID:6424
- C:\Windows\System\SUngHcL.exe
  C:\Windows\System\SUngHcL.exe
  2⤵
  PID:6440
- C:\Windows\System\CLrnZpK.exe
  C:\Windows\System\CLrnZpK.exe
  2⤵
  PID:6460
- C:\Windows\System\yUlPNTR.exe
  C:\Windows\System\yUlPNTR.exe
  2⤵
  PID:6476
- C:\Windows\System\PazuVnK.exe
  C:\Windows\System\PazuVnK.exe
  2⤵
  PID:6496
- C:\Windows\System\jBkNsoq.exe
  C:\Windows\System\jBkNsoq.exe
  2⤵
  PID:6512
- C:\Windows\System\ralpyIj.exe
  C:\Windows\System\ralpyIj.exe
  2⤵
  PID:6532
- C:\Windows\System\ruZcjnX.exe
  C:\Windows\System\ruZcjnX.exe
  2⤵
  PID:6552
- C:\Windows\System\QOKmnIQ.exe
  C:\Windows\System\QOKmnIQ.exe
  2⤵
  PID:6568
- C:\Windows\System\BneygUH.exe
  C:\Windows\System\BneygUH.exe
  2⤵
  PID:6588
- C:\Windows\System\exowtIM.exe
  C:\Windows\System\exowtIM.exe
  2⤵
  PID:6604
- C:\Windows\System\zcJNhyZ.exe
  C:\Windows\System\zcJNhyZ.exe
  2⤵
  PID:6624
- C:\Windows\System\oqacaod.exe
  C:\Windows\System\oqacaod.exe
  2⤵
  PID:6640
- C:\Windows\System\HuJbDJf.exe
  C:\Windows\System\HuJbDJf.exe
  2⤵
  PID:6656
- C:\Windows\System\EskEdBG.exe
  C:\Windows\System\EskEdBG.exe
  2⤵
  PID:6672
- C:\Windows\System\DwpDLAW.exe
  C:\Windows\System\DwpDLAW.exe
  2⤵
  PID:6692
- C:\Windows\System\VTfLteG.exe
  C:\Windows\System\VTfLteG.exe
  2⤵
  PID:6712
- C:\Windows\System\RhZIYqh.exe
  C:\Windows\System\RhZIYqh.exe
  2⤵
  PID:6728
- C:\Windows\System\HPVHFrq.exe
  C:\Windows\System\HPVHFrq.exe
  2⤵
  PID:6748
- C:\Windows\System\AovNvfJ.exe
  C:\Windows\System\AovNvfJ.exe
  2⤵
  PID:6764
- C:\Windows\System\dYSumoO.exe
  C:\Windows\System\dYSumoO.exe
  2⤵
  PID:6784
- C:\Windows\System\lvynCNj.exe
  C:\Windows\System\lvynCNj.exe
  2⤵
  PID:6800
- C:\Windows\System\DaioIMA.exe
  C:\Windows\System\DaioIMA.exe
  2⤵
  PID:6820
- C:\Windows\System\DQAxNVn.exe
  C:\Windows\System\DQAxNVn.exe
  2⤵
  PID:6836
- C:\Windows\System\XmrYQCQ.exe
  C:\Windows\System\XmrYQCQ.exe
  2⤵
  PID:6856
- C:\Windows\System\tiywyKW.exe
  C:\Windows\System\tiywyKW.exe
  2⤵
  PID:6872
- C:\Windows\System\EKixigZ.exe
  C:\Windows\System\EKixigZ.exe
  2⤵
  PID:6892
- C:\Windows\System\RhjLVdY.exe
  C:\Windows\System\RhjLVdY.exe
  2⤵
  PID:6908
- C:\Windows\System\XAZvGMI.exe
  C:\Windows\System\XAZvGMI.exe
  2⤵
  PID:6924
- C:\Windows\System\mwjdsIx.exe
  C:\Windows\System\mwjdsIx.exe
  2⤵
  PID:6940
- C:\Windows\System\twbTuTQ.exe
  C:\Windows\System\twbTuTQ.exe
  2⤵
  PID:6956
- C:\Windows\System\PzgLxbt.exe
  C:\Windows\System\PzgLxbt.exe
  2⤵
  PID:6972
- C:\Windows\System\LZTRhrA.exe
  C:\Windows\System\LZTRhrA.exe
  2⤵
  PID:6992
- C:\Windows\System\cIVyzNd.exe
  C:\Windows\System\cIVyzNd.exe
  2⤵
  PID:7008
- C:\Windows\System\aWhodIS.exe
  C:\Windows\System\aWhodIS.exe
  2⤵
  PID:7024
- C:\Windows\System\BalkBSO.exe
  C:\Windows\System\BalkBSO.exe
  2⤵
  PID:7040
- C:\Windows\System\MHfhmxO.exe
  C:\Windows\System\MHfhmxO.exe
  2⤵
  PID:7056
- C:\Windows\System\WUJTBMV.exe
  C:\Windows\System\WUJTBMV.exe
  2⤵
  PID:7072
- C:\Windows\System\uVuGQFC.exe
  C:\Windows\System\uVuGQFC.exe
  2⤵
  PID:7088
- C:\Windows\System\JKgPXyv.exe
  C:\Windows\System\JKgPXyv.exe
  2⤵
  PID:7104
- C:\Windows\System\aibkcBR.exe
  C:\Windows\System\aibkcBR.exe
  2⤵
  PID:7120
- C:\Windows\System\twCscCS.exe
  C:\Windows\System\twCscCS.exe
  2⤵
  PID:7136
- C:\Windows\System\UMYDDtG.exe
  C:\Windows\System\UMYDDtG.exe
  2⤵
  PID:7152
- C:\Windows\System\eGdFXgZ.exe
  C:\Windows\System\eGdFXgZ.exe
  2⤵
  PID:5476
- C:\Windows\System\aZFMAyY.exe
  C:\Windows\System\aZFMAyY.exe
  2⤵
  PID:5472
- C:\Windows\System\jcUKonQ.exe
  C:\Windows\System\jcUKonQ.exe
  2⤵
  PID:5600
- C:\Windows\System\brKLeZg.exe
  C:\Windows\System\brKLeZg.exe
  2⤵
  PID:5680
- C:\Windows\System\gAmEBRo.exe
  C:\Windows\System\gAmEBRo.exe
  2⤵
  PID:6092
- C:\Windows\System\JpDtVkT.exe
  C:\Windows\System\JpDtVkT.exe
  2⤵
  PID:4592
- C:\Windows\System\dPsbhMd.exe
  C:\Windows\System\dPsbhMd.exe
  2⤵
  PID:1980
- C:\Windows\System\ZtmdjJi.exe
  C:\Windows\System\ZtmdjJi.exe
  2⤵
  PID:7184
- C:\Windows\System\mUCXtmm.exe
  C:\Windows\System\mUCXtmm.exe
  2⤵
  PID:7200
- C:\Windows\System\GLtLjLJ.exe
  C:\Windows\System\GLtLjLJ.exe
  2⤵
  PID:7216
- C:\Windows\System\QLztOWw.exe
  C:\Windows\System\QLztOWw.exe
  2⤵
  PID:7232
- C:\Windows\System\tsxehCC.exe
  C:\Windows\System\tsxehCC.exe
  2⤵
  PID:7252
- C:\Windows\System\SMCRKbm.exe
  C:\Windows\System\SMCRKbm.exe
  2⤵
  PID:7268
- C:\Windows\System\KEDHAgq.exe
  C:\Windows\System\KEDHAgq.exe
  2⤵
  PID:7288
- C:\Windows\System\xhpjIUd.exe
  C:\Windows\System\xhpjIUd.exe
  2⤵
  PID:7304
- C:\Windows\System\mVzUcnK.exe
  C:\Windows\System\mVzUcnK.exe
  2⤵
  PID:7320
- C:\Windows\System\drDWKBJ.exe
  C:\Windows\System\drDWKBJ.exe
  2⤵
  PID:7344
- C:\Windows\System\uEOsdlG.exe
  C:\Windows\System\uEOsdlG.exe
  2⤵
  PID:7372
- C:\Windows\System\SvnNMtE.exe
  C:\Windows\System\SvnNMtE.exe
  2⤵
  PID:7392
- C:\Windows\System\fsGtUqW.exe
  C:\Windows\System\fsGtUqW.exe
  2⤵
  PID:7420
- C:\Windows\System\coXFSAR.exe
  C:\Windows\System\coXFSAR.exe
  2⤵
  PID:7444
- C:\Windows\System\HJAdUDN.exe
  C:\Windows\System\HJAdUDN.exe
  2⤵
  PID:7472
- C:\Windows\System\Nnfdpum.exe
  C:\Windows\System\Nnfdpum.exe
  2⤵
  PID:7504
- C:\Windows\System\BsVGgbC.exe
  C:\Windows\System\BsVGgbC.exe
  2⤵
  PID:7536
- C:\Windows\System\clnTXTv.exe
  C:\Windows\System\clnTXTv.exe
  2⤵
  PID:7552
- C:\Windows\System\rBYaQhJ.exe
  C:\Windows\System\rBYaQhJ.exe
  2⤵
  PID:7584
- C:\Windows\System\svbUPqr.exe
  C:\Windows\System\svbUPqr.exe
  2⤵
  PID:7604
- C:\Windows\System\KymxuQm.exe
  C:\Windows\System\KymxuQm.exe
  2⤵
  PID:7624
- C:\Windows\System\HghJdtW.exe
  C:\Windows\System\HghJdtW.exe
  2⤵
  PID:7640
- C:\Windows\System\uEEBMRY.exe
  C:\Windows\System\uEEBMRY.exe
  2⤵
  PID:7656
- C:\Windows\System\PofmIDz.exe
  C:\Windows\System\PofmIDz.exe
  2⤵
  PID:7672
- C:\Windows\System\FGGWfNs.exe
  C:\Windows\System\FGGWfNs.exe
  2⤵
  PID:7688
- C:\Windows\System\iWVTwUL.exe
  C:\Windows\System\iWVTwUL.exe
  2⤵
  PID:7704
- C:\Windows\System\qSpLXqz.exe
  C:\Windows\System\qSpLXqz.exe
  2⤵
  PID:7720
- C:\Windows\System\prznOvw.exe
  C:\Windows\System\prznOvw.exe
  2⤵
  PID:7736
- C:\Windows\System\Oehbgmn.exe
  C:\Windows\System\Oehbgmn.exe
  2⤵
  PID:7752
- C:\Windows\System\SwOFCSH.exe
  C:\Windows\System\SwOFCSH.exe
  2⤵
  PID:7768
- C:\Windows\System\wuIvaCx.exe
  C:\Windows\System\wuIvaCx.exe
  2⤵
  PID:7784
- C:\Windows\System\uOSBWLL.exe
  C:\Windows\System\uOSBWLL.exe
  2⤵
  PID:7800
- C:\Windows\System\mpwhnYW.exe
  C:\Windows\System\mpwhnYW.exe
  2⤵
  PID:7816
- C:\Windows\System\OugRYsl.exe
  C:\Windows\System\OugRYsl.exe
  2⤵
  PID:7844
- C:\Windows\System\gdJhrBJ.exe
  C:\Windows\System\gdJhrBJ.exe
  2⤵
  PID:7860
- C:\Windows\System\MbtQSoT.exe
  C:\Windows\System\MbtQSoT.exe
  2⤵
  PID:7880
- C:\Windows\System\yGQNjFw.exe
  C:\Windows\System\yGQNjFw.exe
  2⤵
  PID:7896
- C:\Windows\System\XgnKqqT.exe
  C:\Windows\System\XgnKqqT.exe
  2⤵
  PID:7920
- C:\Windows\System\IDmAevX.exe
  C:\Windows\System\IDmAevX.exe
  2⤵
  PID:7936
- C:\Windows\System\YoKXBDc.exe
  C:\Windows\System\YoKXBDc.exe
  2⤵
  PID:7956
- C:\Windows\System\lcAlRDc.exe
  C:\Windows\System\lcAlRDc.exe
  2⤵
  PID:7976
- C:\Windows\System\uVzNUaB.exe
  C:\Windows\System\uVzNUaB.exe
  2⤵
  PID:7996
- C:\Windows\System\VHanbqr.exe
  C:\Windows\System\VHanbqr.exe
  2⤵
  PID:8016
- C:\Windows\System\tdZLffc.exe
  C:\Windows\System\tdZLffc.exe
  2⤵
  PID:8036
- C:\Windows\System\COtjSMR.exe
  C:\Windows\System\COtjSMR.exe
  2⤵
  PID:8060
- C:\Windows\System\LOxuPeM.exe
  C:\Windows\System\LOxuPeM.exe
  2⤵
  PID:8080
- C:\Windows\System\PklPNpL.exe
  C:\Windows\System\PklPNpL.exe
  2⤵
  PID:8096
- C:\Windows\System\IejUkbf.exe
  C:\Windows\System\IejUkbf.exe
  2⤵
  PID:8116
- C:\Windows\System\Vkgceqk.exe
  C:\Windows\System\Vkgceqk.exe
  2⤵
  PID:8136
- C:\Windows\System\fYXxscB.exe
  C:\Windows\System\fYXxscB.exe
  2⤵
  PID:8152
- C:\Windows\System\sIiBHnD.exe
  C:\Windows\System\sIiBHnD.exe
  2⤵
  PID:8176
- C:\Windows\System\ijGtzeV.exe
  C:\Windows\System\ijGtzeV.exe
  2⤵
  PID:1936
- C:\Windows\System\TAFbQdF.exe
  C:\Windows\System\TAFbQdF.exe
  2⤵
  PID:5372
- C:\Windows\System\QYIfgqy.exe
  C:\Windows\System\QYIfgqy.exe
  2⤵
  PID:6372
- C:\Windows\System\QNpfWBF.exe
  C:\Windows\System\QNpfWBF.exe
  2⤵
  PID:5704
- C:\Windows\System\DffskDH.exe
  C:\Windows\System\DffskDH.exe
  2⤵
  PID:5768
- C:\Windows\System\ldxrRDe.exe
  C:\Windows\System\ldxrRDe.exe
  2⤵
  PID:6844
- C:\Windows\System\fjYYsDK.exe
  C:\Windows\System\fjYYsDK.exe
  2⤵
  PID:6848
- C:\Windows\System\CFbiVRu.exe
  C:\Windows\System\CFbiVRu.exe
  2⤵
  PID:5880
- C:\Windows\System\pXTrkFX.exe
  C:\Windows\System\pXTrkFX.exe
  2⤵
  PID:6864
- C:\Windows\System\hHqldca.exe
  C:\Windows\System\hHqldca.exe
  2⤵
  PID:3856
- C:\Windows\System\XuVrmDP.exe
  C:\Windows\System\XuVrmDP.exe
  2⤵
  PID:6988
- C:\Windows\System\CypzdhJ.exe
  C:\Windows\System\CypzdhJ.exe
  2⤵
  PID:6984
- C:\Windows\System\LbHluVO.exe
  C:\Windows\System\LbHluVO.exe
  2⤵
  PID:7096
- C:\Windows\System\cqTXCGQ.exe
  C:\Windows\System\cqTXCGQ.exe
  2⤵
  PID:5436
- C:\Windows\System\osjHQCb.exe
  C:\Windows\System\osjHQCb.exe
  2⤵
  PID:3744
- C:\Windows\System\SypHarD.exe
  C:\Windows\System\SypHarD.exe
  2⤵
  PID:7240
- C:\Windows\System\uGhBVrw.exe
  C:\Windows\System\uGhBVrw.exe
  2⤵
  PID:6008
- C:\Windows\System\SsxayEq.exe
  C:\Windows\System\SsxayEq.exe
  2⤵
  PID:6116
- C:\Windows\System\aZcBWyS.exe
  C:\Windows\System\aZcBWyS.exe
  2⤵
  PID:7336
- C:\Windows\System\nzSjLYx.exe
  C:\Windows\System\nzSjLYx.exe
  2⤵
  PID:4716
- C:\Windows\System\DpdqQXM.exe
  C:\Windows\System\DpdqQXM.exe
  2⤵
  PID:2716
- C:\Windows\System\ZfsbjPV.exe
  C:\Windows\System\ZfsbjPV.exe
  2⤵
  PID:2956
- C:\Windows\System\LrtdDjd.exe
  C:\Windows\System\LrtdDjd.exe
  2⤵
  PID:7432
- C:\Windows\System\iDnLYTC.exe
  C:\Windows\System\iDnLYTC.exe
  2⤵
  PID:7460
- C:\Windows\System\pGmccwe.exe
  C:\Windows\System\pGmccwe.exe
  2⤵
  PID:6356
- C:\Windows\System\kvMpkmU.exe
  C:\Windows\System\kvMpkmU.exe
  2⤵
  PID:7520
- C:\Windows\System\UyxViyC.exe
  C:\Windows\System\UyxViyC.exe
  2⤵
  PID:8200
- C:\Windows\System\scBJKdL.exe
  C:\Windows\System\scBJKdL.exe
  2⤵
  PID:8224
- C:\Windows\System\iYoNkwb.exe
  C:\Windows\System\iYoNkwb.exe
  2⤵
  PID:8252
- C:\Windows\System\SlBObEG.exe
  C:\Windows\System\SlBObEG.exe
  2⤵
  PID:8268
- C:\Windows\System\lIJMvHU.exe
  C:\Windows\System\lIJMvHU.exe
  2⤵
  PID:8300
- C:\Windows\System\nxsLfDt.exe
  C:\Windows\System\nxsLfDt.exe
  2⤵
  PID:8328
- C:\Windows\System\fdLRpxg.exe
  C:\Windows\System\fdLRpxg.exe
  2⤵
  PID:8344
- C:\Windows\System\gILAwkI.exe
  C:\Windows\System\gILAwkI.exe
  2⤵
  PID:8364
- C:\Windows\System\dScEOpR.exe
  C:\Windows\System\dScEOpR.exe
  2⤵
  PID:8380
- C:\Windows\System\IsGoDLZ.exe
  C:\Windows\System\IsGoDLZ.exe
  2⤵
  PID:8404
- C:\Windows\System\sAnSVSK.exe
  C:\Windows\System\sAnSVSK.exe
  2⤵
  PID:8420
- C:\Windows\System\drhtZZI.exe
  C:\Windows\System\drhtZZI.exe
  2⤵
  PID:8444
- C:\Windows\System\kaxdczb.exe
  C:\Windows\System\kaxdczb.exe
  2⤵
  PID:8472
- C:\Windows\System\BWXMoqp.exe
  C:\Windows\System\BWXMoqp.exe
  2⤵
  PID:8492
- C:\Windows\System\UsnRMMR.exe
  C:\Windows\System\UsnRMMR.exe
  2⤵
  PID:8512
- C:\Windows\System\YnONUwe.exe
  C:\Windows\System\YnONUwe.exe
  2⤵
  PID:8528
- C:\Windows\System\lMKVYLo.exe
  C:\Windows\System\lMKVYLo.exe
  2⤵
  PID:8548
- C:\Windows\System\rrkAhPu.exe
  C:\Windows\System\rrkAhPu.exe
  2⤵
  PID:8564
- C:\Windows\System\ByjlRBX.exe
  C:\Windows\System\ByjlRBX.exe
  2⤵
  PID:8580
- C:\Windows\System\RxqMzUe.exe
  C:\Windows\System\RxqMzUe.exe
  2⤵
  PID:8600
- C:\Windows\System\YEJAznH.exe
  C:\Windows\System\YEJAznH.exe
  2⤵
  PID:8620
- C:\Windows\System\ILvCUVh.exe
  C:\Windows\System\ILvCUVh.exe
  2⤵
  PID:8640
- C:\Windows\System\ZuWPhGv.exe
  C:\Windows\System\ZuWPhGv.exe
  2⤵
  PID:8656
- C:\Windows\System\shDfPLe.exe
  C:\Windows\System\shDfPLe.exe
  2⤵
  PID:8680
- C:\Windows\System\hFgdtuj.exe
  C:\Windows\System\hFgdtuj.exe
  2⤵
  PID:8696
- C:\Windows\System\dDlEiZQ.exe
  C:\Windows\System\dDlEiZQ.exe
  2⤵
  PID:8716
- C:\Windows\System\WSKuhwc.exe
  C:\Windows\System\WSKuhwc.exe
  2⤵
  PID:8736
- C:\Windows\System\bnkeAMY.exe
  C:\Windows\System\bnkeAMY.exe
  2⤵
  PID:8756
- C:\Windows\System\moIrowE.exe
  C:\Windows\System\moIrowE.exe
  2⤵
  PID:8776
- C:\Windows\System\dLOYqeu.exe
  C:\Windows\System\dLOYqeu.exe
  2⤵
  PID:8792
- C:\Windows\System\yTFmowQ.exe
  C:\Windows\System\yTFmowQ.exe
  2⤵
  PID:8820
- C:\Windows\System\vPzzLyc.exe
  C:\Windows\System\vPzzLyc.exe
  2⤵
  PID:8840
- C:\Windows\System\Hvlrpov.exe
  C:\Windows\System\Hvlrpov.exe
  2⤵
  PID:8860
- C:\Windows\System\NVwZLLB.exe
  C:\Windows\System\NVwZLLB.exe
  2⤵
  PID:8880
- C:\Windows\System\IuWDZuP.exe
  C:\Windows\System\IuWDZuP.exe
  2⤵
  PID:8904
- C:\Windows\System\KEBduHe.exe
  C:\Windows\System\KEBduHe.exe
  2⤵
  PID:8920
- C:\Windows\System\flhVQOn.exe
  C:\Windows\System\flhVQOn.exe
  2⤵
  PID:8936
- C:\Windows\System\NCDwAYZ.exe
  C:\Windows\System\NCDwAYZ.exe
  2⤵
  PID:8960
- C:\Windows\System\veaolfu.exe
  C:\Windows\System\veaolfu.exe
  2⤵
  PID:8976
- C:\Windows\System\POEQceC.exe
  C:\Windows\System\POEQceC.exe
  2⤵
  PID:9000
- C:\Windows\System\wueItUo.exe
  C:\Windows\System\wueItUo.exe
  2⤵
  PID:9016
- C:\Windows\System\tSrKtNL.exe
  C:\Windows\System\tSrKtNL.exe
  2⤵
  PID:9040
- C:\Windows\System\DMIoGgX.exe
  C:\Windows\System\DMIoGgX.exe
  2⤵
  PID:9056
- C:\Windows\System\gvfJroK.exe
  C:\Windows\System\gvfJroK.exe
  2⤵
  PID:9072
- C:\Windows\System\DGqMviF.exe
  C:\Windows\System\DGqMviF.exe
  2⤵
  PID:9096
- C:\Windows\System\DCMmxew.exe
  C:\Windows\System\DCMmxew.exe
  2⤵
  PID:9112
- C:\Windows\System\FOYCYFL.exe
  C:\Windows\System\FOYCYFL.exe
  2⤵
  PID:9136
- C:\Windows\System\SRIUSoH.exe
  C:\Windows\System\SRIUSoH.exe
  2⤵
  PID:9156
- C:\Windows\System\ztdrpnm.exe
  C:\Windows\System\ztdrpnm.exe
  2⤵
  PID:9172
- C:\Windows\System\LjkZrmR.exe
  C:\Windows\System\LjkZrmR.exe
  2⤵
  PID:9188
- C:\Windows\System\YqmcDvl.exe
  C:\Windows\System\YqmcDvl.exe
  2⤵
  PID:9212
- C:\Windows\System\IUeUZRm.exe
  C:\Windows\System\IUeUZRm.exe
  2⤵
  PID:6404
- C:\Windows\System\qiMOTeC.exe
  C:\Windows\System\qiMOTeC.exe
  2⤵
  PID:6436
- C:\Windows\System\WDklkPE.exe
  C:\Windows\System\WDklkPE.exe
  2⤵
  PID:6468
- C:\Windows\System\OLVTkCM.exe
  C:\Windows\System\OLVTkCM.exe
  2⤵
  PID:6508
- C:\Windows\System\pimFFiP.exe
  C:\Windows\System\pimFFiP.exe
  2⤵
  PID:6528
- C:\Windows\System\mCozFTC.exe
  C:\Windows\System\mCozFTC.exe
  2⤵
  PID:5652
- C:\Windows\System\vAOvzMD.exe
  C:\Windows\System\vAOvzMD.exe
  2⤵
  PID:6700
- C:\Windows\System\IodEJzV.exe
  C:\Windows\System\IodEJzV.exe
  2⤵
  PID:5688
- C:\Windows\System\mOHHBGo.exe
  C:\Windows\System\mOHHBGo.exe
  2⤵
  PID:6760
- C:\Windows\System\MpnheJC.exe
  C:\Windows\System\MpnheJC.exe
  2⤵
  PID:6884
- C:\Windows\System\InmTzhx.exe
  C:\Windows\System\InmTzhx.exe
  2⤵
  PID:6888
- C:\Windows\System\yeKFDFX.exe
  C:\Windows\System\yeKFDFX.exe
  2⤵
  PID:7652
- C:\Windows\System\wdeUyZo.exe
  C:\Windows\System\wdeUyZo.exe
  2⤵
  PID:2248
- C:\Windows\System\lpRrJoD.exe
  C:\Windows\System\lpRrJoD.exe
  2⤵
  PID:1668
- C:\Windows\System\AdRNCvs.exe
  C:\Windows\System\AdRNCvs.exe
  2⤵
  PID:4352
- C:\Windows\System\XkxNjnz.exe
  C:\Windows\System\XkxNjnz.exe
  2⤵
  PID:4248
- C:\Windows\System\jOwkNoK.exe
  C:\Windows\System\jOwkNoK.exe
  2⤵
  PID:4416
- C:\Windows\System\RXbwDHH.exe
  C:\Windows\System\RXbwDHH.exe
  2⤵
  PID:2728
- C:\Windows\System\hpXblHl.exe
  C:\Windows\System\hpXblHl.exe
  2⤵
  PID:2904
- C:\Windows\System\eQeXSoh.exe
  C:\Windows\System\eQeXSoh.exe
  2⤵
  PID:7000
- C:\Windows\System\mlIXnGE.exe
  C:\Windows\System\mlIXnGE.exe
  2⤵
  PID:7888
- C:\Windows\System\LolwtQA.exe
  C:\Windows\System\LolwtQA.exe
  2⤵
  PID:7928
- C:\Windows\System\VPInDuI.exe
  C:\Windows\System\VPInDuI.exe
  2⤵
  PID:7952
- C:\Windows\System\YvcNjyv.exe
  C:\Windows\System\YvcNjyv.exe
  2⤵
  PID:8004
- C:\Windows\System\exXKODN.exe
  C:\Windows\System\exXKODN.exe
  2⤵
  PID:8024
- C:\Windows\System\OwaqRLJ.exe
  C:\Windows\System\OwaqRLJ.exe
  2⤵
  PID:8092
- C:\Windows\System\hMOLfRk.exe
  C:\Windows\System\hMOLfRk.exe
  2⤵
  PID:8144
- C:\Windows\System\IatlVIr.exe
  C:\Windows\System\IatlVIr.exe
  2⤵
  PID:8188
- C:\Windows\System\ITHQmuE.exe
  C:\Windows\System\ITHQmuE.exe
  2⤵
  PID:9232
- C:\Windows\System\uBAatLB.exe
  C:\Windows\System\uBAatLB.exe
  2⤵
  PID:9248
- C:\Windows\System\xypTZdt.exe
  C:\Windows\System\xypTZdt.exe
  2⤵
  PID:9264
- C:\Windows\System\QBPpNHI.exe
  C:\Windows\System\QBPpNHI.exe
  2⤵
  PID:9280
- C:\Windows\System\mMmybza.exe
  C:\Windows\System\mMmybza.exe
  2⤵
  PID:9296
- C:\Windows\System\xviDfBX.exe
  C:\Windows\System\xviDfBX.exe
  2⤵
  PID:9312
- C:\Windows\System\ZKrJQUJ.exe
  C:\Windows\System\ZKrJQUJ.exe
  2⤵
  PID:9340
- C:\Windows\System\vbhoDij.exe
  C:\Windows\System\vbhoDij.exe
  2⤵
  PID:9368
- C:\Windows\System\avuDUlz.exe
  C:\Windows\System\avuDUlz.exe
  2⤵
  PID:9384
- C:\Windows\System\MvAyAxb.exe
  C:\Windows\System\MvAyAxb.exe
  2⤵
  PID:9408
- C:\Windows\System\EKkETAP.exe
  C:\Windows\System\EKkETAP.exe
  2⤵
  PID:9428
- C:\Windows\System\myOMXaX.exe
  C:\Windows\System\myOMXaX.exe
  2⤵
  PID:9444
- C:\Windows\System\zuuqSwD.exe
  C:\Windows\System\zuuqSwD.exe
  2⤵
  PID:9464
- C:\Windows\System\xtEQRyI.exe
  C:\Windows\System\xtEQRyI.exe
  2⤵
  PID:9484
- C:\Windows\System\xgxfEsm.exe
  C:\Windows\System\xgxfEsm.exe
  2⤵
  PID:9508
- C:\Windows\System\vdSzBVs.exe
  C:\Windows\System\vdSzBVs.exe
  2⤵
  PID:9528
- C:\Windows\System\mydmaUd.exe
  C:\Windows\System\mydmaUd.exe
  2⤵
  PID:9548
- C:\Windows\System\NAuSada.exe
  C:\Windows\System\NAuSada.exe
  2⤵
  PID:9564
- C:\Windows\System\fOCLJNw.exe
  C:\Windows\System\fOCLJNw.exe
  2⤵
  PID:9584
- C:\Windows\System\GGhdDtV.exe
  C:\Windows\System\GGhdDtV.exe
  2⤵
  PID:9604
- C:\Windows\System\wElveCQ.exe
  C:\Windows\System\wElveCQ.exe
  2⤵
  PID:9628
- C:\Windows\System\DVUYdVf.exe
  C:\Windows\System\DVUYdVf.exe
  2⤵
  PID:9644
- C:\Windows\System\DNKoLnb.exe
  C:\Windows\System\DNKoLnb.exe
  2⤵
  PID:9664
- C:\Windows\System\JpoNWfX.exe
  C:\Windows\System\JpoNWfX.exe
  2⤵
  PID:9684
- C:\Windows\System\iafdJrJ.exe
  C:\Windows\System\iafdJrJ.exe
  2⤵
  PID:9704
- C:\Windows\System\JhFLQkz.exe
  C:\Windows\System\JhFLQkz.exe
  2⤵
  PID:9728
- C:\Windows\System\KXmsRqo.exe
  C:\Windows\System\KXmsRqo.exe
  2⤵
  PID:9748
- C:\Windows\System\ncdrMel.exe
  C:\Windows\System\ncdrMel.exe
  2⤵
  PID:9772
- C:\Windows\System\IxEtMgr.exe
  C:\Windows\System\IxEtMgr.exe
  2⤵
  PID:9792
- C:\Windows\System\aAVPCpH.exe
  C:\Windows\System\aAVPCpH.exe
  2⤵
  PID:9816
- C:\Windows\System\qkfjAPX.exe
  C:\Windows\System\qkfjAPX.exe
  2⤵
  PID:9836
- C:\Windows\System\lvbXyIu.exe
  C:\Windows\System\lvbXyIu.exe
  2⤵
  PID:9856
- C:\Windows\System\GRFiAYt.exe
  C:\Windows\System\GRFiAYt.exe
  2⤵
  PID:9876
- C:\Windows\System\AIIVvKS.exe
  C:\Windows\System\AIIVvKS.exe
  2⤵
  PID:9892
- C:\Windows\System\ySezxAb.exe
  C:\Windows\System\ySezxAb.exe
  2⤵
  PID:9912
- C:\Windows\System\xwoKGGq.exe
  C:\Windows\System\xwoKGGq.exe
  2⤵
  PID:9932
- C:\Windows\System\JKrGaCM.exe
  C:\Windows\System\JKrGaCM.exe
  2⤵
  PID:9960
- C:\Windows\System\SfhoPTj.exe
  C:\Windows\System\SfhoPTj.exe
  2⤵
  PID:9976
- C:\Windows\System\EcQtaBy.exe
  C:\Windows\System\EcQtaBy.exe
  2⤵
  PID:9996
- C:\Windows\System\KXQLhTr.exe
  C:\Windows\System\KXQLhTr.exe
  2⤵
  PID:10012
- C:\Windows\System\MzDnckL.exe
  C:\Windows\System\MzDnckL.exe
  2⤵
  PID:10036
- C:\Windows\System\kEHqToy.exe
  C:\Windows\System\kEHqToy.exe
  2⤵
  PID:10056
- C:\Windows\System\icxiZRk.exe
  C:\Windows\System\icxiZRk.exe
  2⤵
  PID:10076
- C:\Windows\System\gFZeXDx.exe
  C:\Windows\System\gFZeXDx.exe
  2⤵
  PID:10096
- C:\Windows\System\gqkJLLg.exe
  C:\Windows\System\gqkJLLg.exe
  2⤵
  PID:10112
- C:\Windows\System\NVeMiQC.exe
  C:\Windows\System\NVeMiQC.exe
  2⤵
  PID:10132
- C:\Windows\System\fEnxlVl.exe
  C:\Windows\System\fEnxlVl.exe
  2⤵
  PID:10156
- C:\Windows\System\krxvOIR.exe
  C:\Windows\System\krxvOIR.exe
  2⤵
  PID:10176
- C:\Windows\System\jVsPliy.exe
  C:\Windows\System\jVsPliy.exe
  2⤵
  PID:10192
- C:\Windows\System\HQnWHzU.exe
  C:\Windows\System\HQnWHzU.exe
  2⤵
  PID:10216
- C:\Windows\System\zkiYjCC.exe
  C:\Windows\System\zkiYjCC.exe
  2⤵
  PID:6736
- C:\Windows\System\HPylsrM.exe
  C:\Windows\System\HPylsrM.exe
  2⤵
  PID:5756
- C:\Windows\System\BsVnCTr.exe
  C:\Windows\System\BsVnCTr.exe
  2⤵
  PID:7248
- C:\Windows\System\dPSzhgT.exe
  C:\Windows\System\dPSzhgT.exe
  2⤵
  PID:7284
- C:\Windows\System\ASTzWlU.exe
  C:\Windows\System\ASTzWlU.exe
  2⤵
  PID:6968
- C:\Windows\System\PcDzXJN.exe
  C:\Windows\System\PcDzXJN.exe
  2⤵
  PID:6136
- C:\Windows\System\vxVWjPr.exe
  C:\Windows\System\vxVWjPr.exe
  2⤵
  PID:3344
- C:\Windows\System\zwQiQSr.exe
  C:\Windows\System\zwQiQSr.exe
  2⤵
  PID:7192
- C:\Windows\System\BRTpHFC.exe
  C:\Windows\System\BRTpHFC.exe
  2⤵
  PID:7480
- C:\Windows\System\bomAKuu.exe
  C:\Windows\System\bomAKuu.exe
  2⤵
  PID:7456
- C:\Windows\System\wYKkeQd.exe
  C:\Windows\System\wYKkeQd.exe
  2⤵
  PID:7532
- C:\Windows\System\yqKXLvS.exe
  C:\Windows\System\yqKXLvS.exe
  2⤵
  PID:8288
- C:\Windows\System\iiUvWrG.exe
  C:\Windows\System\iiUvWrG.exe
  2⤵
  PID:6584
- C:\Windows\System\tdqLtGd.exe
  C:\Windows\System\tdqLtGd.exe
  2⤵
  PID:6668
- C:\Windows\System\QVQFMwc.exe
  C:\Windows\System\QVQFMwc.exe
  2⤵
  PID:8340
- C:\Windows\System\jOnBNeb.exe
  C:\Windows\System\jOnBNeb.exe
  2⤵
  PID:8360
- C:\Windows\System\aFVDKfa.exe
  C:\Windows\System\aFVDKfa.exe
  2⤵
  PID:6900
- C:\Windows\System\OCsliKM.exe
  C:\Windows\System\OCsliKM.exe
  2⤵
  PID:8468
- C:\Windows\System\rVpRCIm.exe
  C:\Windows\System\rVpRCIm.exe
  2⤵
  PID:7648
- C:\Windows\System\lqIegdO.exe
  C:\Windows\System\lqIegdO.exe
  2⤵
  PID:6952
- C:\Windows\System\jtgpyps.exe
  C:\Windows\System\jtgpyps.exe
  2⤵
  PID:10264
- C:\Windows\System\WwSPMBH.exe
  C:\Windows\System\WwSPMBH.exe
  2⤵
  PID:10284
- C:\Windows\System\WPRIGAq.exe
  C:\Windows\System\WPRIGAq.exe
  2⤵
  PID:10304
- C:\Windows\System\shZspbj.exe
  C:\Windows\System\shZspbj.exe
  2⤵
  PID:10320
- C:\Windows\System\vXwXRIc.exe
  C:\Windows\System\vXwXRIc.exe
  2⤵
  PID:10344
- C:\Windows\System\SpiuBlT.exe
  C:\Windows\System\SpiuBlT.exe
  2⤵
  PID:10360
- C:\Windows\System\DpiXDDP.exe
  C:\Windows\System\DpiXDDP.exe
  2⤵
  PID:10384
- C:\Windows\System\bddMQKv.exe
  C:\Windows\System\bddMQKv.exe
  2⤵
  PID:10400
- C:\Windows\System\qRBUBey.exe
  C:\Windows\System\qRBUBey.exe
  2⤵
  PID:10424
- C:\Windows\System\xQyyhIP.exe
  C:\Windows\System\xQyyhIP.exe
  2⤵
  PID:10440
- C:\Windows\System\VkfAFnt.exe
  C:\Windows\System\VkfAFnt.exe
  2⤵
  PID:10464
- C:\Windows\System\MmNyZku.exe
  C:\Windows\System\MmNyZku.exe
  2⤵
  PID:10484
- C:\Windows\System\gxxVoFO.exe
  C:\Windows\System\gxxVoFO.exe
  2⤵
  PID:10504
- C:\Windows\System\vTQCLRC.exe
  C:\Windows\System\vTQCLRC.exe
  2⤵
  PID:10524
- C:\Windows\System\DUXwtPO.exe
  C:\Windows\System\DUXwtPO.exe
  2⤵
  PID:10548
- C:\Windows\System\mDSsTRl.exe
  C:\Windows\System\mDSsTRl.exe
  2⤵
  PID:10568
- C:\Windows\System\TsUlmtV.exe
  C:\Windows\System\TsUlmtV.exe
  2⤵
  PID:10584
- C:\Windows\System\pGEQqGs.exe
  C:\Windows\System\pGEQqGs.exe
  2⤵
  PID:10604
- C:\Windows\System\MlmNAlq.exe
  C:\Windows\System\MlmNAlq.exe
  2⤵
  PID:10624
- C:\Windows\System\MUPcqDz.exe
  C:\Windows\System\MUPcqDz.exe
  2⤵
  PID:10640
- C:\Windows\System\hqceaIH.exe
  C:\Windows\System\hqceaIH.exe
  2⤵
  PID:10664
- C:\Windows\System\xmqmUhV.exe
  C:\Windows\System\xmqmUhV.exe
  2⤵
  PID:10680
- C:\Windows\System\gIemLyn.exe
  C:\Windows\System\gIemLyn.exe
  2⤵
  PID:10704
- C:\Windows\System\LVPRDiO.exe
  C:\Windows\System\LVPRDiO.exe
  2⤵
  PID:10732
- C:\Windows\System\OarLOiG.exe
  C:\Windows\System\OarLOiG.exe
  2⤵
  PID:10748
- C:\Windows\System\rMhBgde.exe
  C:\Windows\System\rMhBgde.exe
  2⤵
  PID:10776
- C:\Windows\System\CRCzyJy.exe
  C:\Windows\System\CRCzyJy.exe
  2⤵
  PID:10792
- C:\Windows\System\WIVphgp.exe
  C:\Windows\System\WIVphgp.exe
  2⤵
  PID:10816
- C:\Windows\System\Bnxsxew.exe
  C:\Windows\System\Bnxsxew.exe
  2⤵
  PID:10880
- C:\Windows\System\YJLbCto.exe
  C:\Windows\System\YJLbCto.exe
  2⤵
  PID:10904
- C:\Windows\System\YtLiazL.exe
  C:\Windows\System\YtLiazL.exe
  2⤵
  PID:10924
- C:\Windows\System\KHGvNxb.exe
  C:\Windows\System\KHGvNxb.exe
  2⤵
  PID:10940
- C:\Windows\System\WNPSWxQ.exe
  C:\Windows\System\WNPSWxQ.exe
  2⤵
  PID:10960
- C:\Windows\System\gpkkqXs.exe
  C:\Windows\System\gpkkqXs.exe
  2⤵
  PID:10984
- C:\Windows\System\uusRNEU.exe
  C:\Windows\System\uusRNEU.exe
  2⤵
  PID:11008
- C:\Windows\System\qTfbMOa.exe
  C:\Windows\System\qTfbMOa.exe
  2⤵
  PID:11028
- C:\Windows\System\sbktLrG.exe
  C:\Windows\System\sbktLrG.exe
  2⤵
  PID:11052
- C:\Windows\System\UJRkuwG.exe
  C:\Windows\System\UJRkuwG.exe
  2⤵
  PID:11072
- C:\Windows\System\PurxjfP.exe
  C:\Windows\System\PurxjfP.exe
  2⤵
  PID:11096
- C:\Windows\System\xNIqPkI.exe
  C:\Windows\System\xNIqPkI.exe
  2⤵
  PID:11112
- C:\Windows\System\DVKEGDc.exe
  C:\Windows\System\DVKEGDc.exe
  2⤵
  PID:11128
- C:\Windows\System\nYOiDbv.exe
  C:\Windows\System\nYOiDbv.exe
  2⤵
  PID:11156
- C:\Windows\System\hYeBVHC.exe
  C:\Windows\System\hYeBVHC.exe
  2⤵
  PID:11172
- C:\Windows\System\nMojQee.exe
  C:\Windows\System\nMojQee.exe
  2⤵
  PID:11192
- C:\Windows\System\VzTYVBv.exe
  C:\Windows\System\VzTYVBv.exe
  2⤵
  PID:11212
- C:\Windows\System\SUztanf.exe
  C:\Windows\System\SUztanf.exe
  2⤵
  PID:11236
- C:\Windows\System\FjTkqwf.exe
  C:\Windows\System\FjTkqwf.exe
  2⤵
  PID:11252
- C:\Windows\System\nnAWwiS.exe
  C:\Windows\System\nnAWwiS.exe
  2⤵
  PID:7748
- C:\Windows\System\IQlqGqA.exe
  C:\Windows\System\IQlqGqA.exe
  2⤵
  PID:8708
- C:\Windows\System\RNKtqtv.exe
  C:\Windows\System\RNKtqtv.exe
  2⤵
  PID:9152
- C:\Windows\System\GDiAEOb.exe
  C:\Windows\System\GDiAEOb.exe
  2⤵
  PID:6452
- C:\Windows\System\AndlaHa.exe
  C:\Windows\System\AndlaHa.exe
  2⤵
  PID:6564
- C:\Windows\System\EZJLppq.exe
  C:\Windows\System\EZJLppq.exe
  2⤵
  PID:6708
- C:\Windows\System\lvrLfjD.exe
  C:\Windows\System\lvrLfjD.exe
  2⤵
  PID:4236
- C:\Windows\System\EjkcCUm.exe
  C:\Windows\System\EjkcCUm.exe
  2⤵
  PID:3696
- C:\Windows\System\qCnLWPY.exe
  C:\Windows\System\qCnLWPY.exe
  2⤵
  PID:11276
- C:\Windows\System\xcURQbV.exe
  C:\Windows\System\xcURQbV.exe
  2⤵
  PID:11296
- C:\Windows\System\TEcGQHP.exe
  C:\Windows\System\TEcGQHP.exe
  2⤵
  PID:11312
- C:\Windows\System\niCXXrN.exe
  C:\Windows\System\niCXXrN.exe
  2⤵
  PID:11336
- C:\Windows\System\OFRNArg.exe
  C:\Windows\System\OFRNArg.exe
  2⤵
  PID:11352
- C:\Windows\System\qhCqhhZ.exe
  C:\Windows\System\qhCqhhZ.exe
  2⤵
  PID:11372
- C:\Windows\System\DSFAMiO.exe
  C:\Windows\System\DSFAMiO.exe
  2⤵
  PID:11392
- C:\Windows\System\yWZNwwS.exe
  C:\Windows\System\yWZNwwS.exe
  2⤵
  PID:11408
- C:\Windows\System\kzVECVm.exe
  C:\Windows\System\kzVECVm.exe
  2⤵
  PID:11428
- C:\Windows\System\qVUjUFI.exe
  C:\Windows\System\qVUjUFI.exe
  2⤵
  PID:11448
- C:\Windows\System\zWSfoWH.exe
  C:\Windows\System\zWSfoWH.exe
  2⤵
  PID:11464
- C:\Windows\System\yeUwlrX.exe
  C:\Windows\System\yeUwlrX.exe
  2⤵
  PID:11488
- C:\Windows\System\xEhwKbj.exe
  C:\Windows\System\xEhwKbj.exe
  2⤵
  PID:11512
- C:\Windows\System\xPneAsE.exe
  C:\Windows\System\xPneAsE.exe
  2⤵
  PID:11528
- C:\Windows\System\BGeAhwy.exe
  C:\Windows\System\BGeAhwy.exe
  2⤵
  PID:11552
- C:\Windows\System\xasRrIq.exe
  C:\Windows\System\xasRrIq.exe
  2⤵
  PID:11568
- C:\Windows\System\VwJhHpM.exe
  C:\Windows\System\VwJhHpM.exe
  2⤵
  PID:11584
- C:\Windows\System\lePSiBV.exe
  C:\Windows\System\lePSiBV.exe
  2⤵
  PID:11600
- C:\Windows\System\pjcLApv.exe
  C:\Windows\System\pjcLApv.exe
  2⤵
  PID:11620
- C:\Windows\System\CUSSCiO.exe
  C:\Windows\System\CUSSCiO.exe
  2⤵
  PID:11636
- C:\Windows\System\oAbosVh.exe
  C:\Windows\System\oAbosVh.exe
  2⤵
  PID:11660
- C:\Windows\System\MugKtMa.exe
  C:\Windows\System\MugKtMa.exe
  2⤵
  PID:11680
- C:\Windows\System\MUnknit.exe
  C:\Windows\System\MUnknit.exe
  2⤵
  PID:11696
- C:\Windows\System\bKPOaQB.exe
  C:\Windows\System\bKPOaQB.exe
  2⤵
  PID:11720
- C:\Windows\System\QfobfZd.exe
  C:\Windows\System\QfobfZd.exe
  2⤵
  PID:11736
- C:\Windows\System\TAnFnJL.exe
  C:\Windows\System\TAnFnJL.exe
  2⤵
  PID:11760
- C:\Windows\System\hCiFtzZ.exe
  C:\Windows\System\hCiFtzZ.exe
  2⤵
  PID:11780
- C:\Windows\System\lipVrsp.exe
  C:\Windows\System\lipVrsp.exe
  2⤵
  PID:11796
- C:\Windows\System\vhDyEhS.exe
  C:\Windows\System\vhDyEhS.exe
  2⤵
  PID:11812
- C:\Windows\System\kQPYRSY.exe
  C:\Windows\System\kQPYRSY.exe
  2⤵
  PID:11832
- C:\Windows\System\XLMcFRD.exe
  C:\Windows\System\XLMcFRD.exe
  2⤵
  PID:11852
- C:\Windows\System\qAHZSDc.exe
  C:\Windows\System\qAHZSDc.exe
  2⤵
  PID:11868
- C:\Windows\System\ZoGcVbI.exe
  C:\Windows\System\ZoGcVbI.exe
  2⤵
  PID:11888
- C:\Windows\System\ftqbvLk.exe
  C:\Windows\System\ftqbvLk.exe
  2⤵
  PID:11904
- C:\Windows\System\SOcFxGK.exe
  C:\Windows\System\SOcFxGK.exe
  2⤵
  PID:11928
- C:\Windows\System\MzwQCrZ.exe
  C:\Windows\System\MzwQCrZ.exe
  2⤵
  PID:11948
- C:\Windows\System\CkouSBJ.exe
  C:\Windows\System\CkouSBJ.exe
  2⤵
  PID:11968
- C:\Windows\System\nLwFStG.exe
  C:\Windows\System\nLwFStG.exe
  2⤵
  PID:11992
- C:\Windows\System\WAyYaVK.exe
  C:\Windows\System\WAyYaVK.exe
  2⤵
  PID:12008
- C:\Windows\System\bEIjCqx.exe
  C:\Windows\System\bEIjCqx.exe
  2⤵
  PID:12028
- C:\Windows\System\kpIRQbw.exe
  C:\Windows\System\kpIRQbw.exe
  2⤵
  PID:12056
- C:\Windows\System\irIwhMO.exe
  C:\Windows\System\irIwhMO.exe
  2⤵
  PID:12080
- C:\Windows\System\DDLrSGA.exe
  C:\Windows\System\DDLrSGA.exe
  2⤵
  PID:12104
- C:\Windows\System\XslrXfM.exe
  C:\Windows\System\XslrXfM.exe
  2⤵
  PID:12120
- C:\Windows\System\WyqSMka.exe
  C:\Windows\System\WyqSMka.exe
  2⤵
  PID:12140
- C:\Windows\System\NQYEXOq.exe
  C:\Windows\System\NQYEXOq.exe
  2⤵
  PID:12160
- C:\Windows\System\mEuKiyC.exe
  C:\Windows\System\mEuKiyC.exe
  2⤵
  PID:12184
- C:\Windows\System\YyNeDCH.exe
  C:\Windows\System\YyNeDCH.exe
  2⤵
  PID:12200
- C:\Windows\System\YDvgNAA.exe
  C:\Windows\System\YDvgNAA.exe
  2⤵
  PID:12224
- C:\Windows\System\kMkVmEE.exe
  C:\Windows\System\kMkVmEE.exe
  2⤵
  PID:12248
- C:\Windows\System\nKVwcPN.exe
  C:\Windows\System\nKVwcPN.exe
  2⤵
  PID:12264
- C:\Windows\System\eWZzPNM.exe
  C:\Windows\System\eWZzPNM.exe
  2⤵
  PID:6948
- C:\Windows\System\AVCypvf.exe
  C:\Windows\System\AVCypvf.exe
  2⤵
  PID:8032
- C:\Windows\System\PDEWwaW.exe
  C:\Windows\System\PDEWwaW.exe
  2⤵
  PID:5508
- C:\Windows\System\NcwsqAd.exe
  C:\Windows\System\NcwsqAd.exe
  2⤵
  PID:8108
- C:\Windows\System\OzczRHv.exe
  C:\Windows\System\OzczRHv.exe
  2⤵
  PID:8172
- C:\Windows\System\NhvNAdQ.exe
  C:\Windows\System\NhvNAdQ.exe
  2⤵
  PID:7992
- C:\Windows\System\dyGGRqA.exe
  C:\Windows\System\dyGGRqA.exe
  2⤵
  PID:8168
- C:\Windows\System\YSDQlPk.exe
  C:\Windows\System\YSDQlPk.exe
  2⤵
  PID:6816
- C:\Windows\System\hrXeOVJ.exe
  C:\Windows\System\hrXeOVJ.exe
  2⤵
  PID:3676
- C:\Windows\System\yEoiTiG.exe
  C:\Windows\System\yEoiTiG.exe
  2⤵
  PID:9288
- C:\Windows\System\mkcdsOY.exe
  C:\Windows\System\mkcdsOY.exe
  2⤵
  PID:9304
- C:\Windows\System\bawxQtq.exe
  C:\Windows\System\bawxQtq.exe
  2⤵
  PID:9396
- C:\Windows\System\YjYiwuu.exe
  C:\Windows\System\YjYiwuu.exe
  2⤵
  PID:9520
- C:\Windows\System\EocbnJt.exe
  C:\Windows\System\EocbnJt.exe
  2⤵
  PID:9620
- C:\Windows\System\obGxYmE.exe
  C:\Windows\System\obGxYmE.exe
  2⤵
  PID:9756
- C:\Windows\System\TMRXOah.exe
  C:\Windows\System\TMRXOah.exe
  2⤵
  PID:12308
- C:\Windows\System\pVDcIbN.exe
  C:\Windows\System\pVDcIbN.exe
  2⤵
  PID:12324
- C:\Windows\System\uTifSyi.exe
  C:\Windows\System\uTifSyi.exe
  2⤵
  PID:12344
- C:\Windows\System\uFfJkJS.exe
  C:\Windows\System\uFfJkJS.exe
  2⤵
  PID:12364
- C:\Windows\System\rUXrUyu.exe
  C:\Windows\System\rUXrUyu.exe
  2⤵
  PID:12384
- C:\Windows\System\unXvNOf.exe
  C:\Windows\System\unXvNOf.exe
  2⤵
  PID:12404
- C:\Windows\System\uuLNuRt.exe
  C:\Windows\System\uuLNuRt.exe
  2⤵
  PID:12424
- C:\Windows\System\mJeOljp.exe
  C:\Windows\System\mJeOljp.exe
  2⤵
  PID:12440
- C:\Windows\System\UMDgESD.exe
  C:\Windows\System\UMDgESD.exe
  2⤵
  PID:12464
- C:\Windows\System\YDPouce.exe
  C:\Windows\System\YDPouce.exe
  2⤵
  PID:12484
- C:\Windows\System\cQmNGNQ.exe
  C:\Windows\System\cQmNGNQ.exe
  2⤵
  PID:12500
- C:\Windows\System\GeTQoQp.exe
  C:\Windows\System\GeTQoQp.exe
  2⤵
  PID:12528
- C:\Windows\System\nGfZaEG.exe
  C:\Windows\System\nGfZaEG.exe
  2⤵
  PID:12548
- C:\Windows\System\QPVRmwO.exe
  C:\Windows\System\QPVRmwO.exe
  2⤵
  PID:12564
- C:\Windows\System\ldmZoWo.exe
  C:\Windows\System\ldmZoWo.exe
  2⤵
  PID:12584
- C:\Windows\System\pNMmWsZ.exe
  C:\Windows\System\pNMmWsZ.exe
  2⤵
  PID:12600
- C:\Windows\System\ecMFaJn.exe
  C:\Windows\System\ecMFaJn.exe
  2⤵
  PID:12620
- C:\Windows\System\DLQQgGN.exe
  C:\Windows\System\DLQQgGN.exe
  2⤵
  PID:12640
- C:\Windows\System\lvGLayJ.exe
  C:\Windows\System\lvGLayJ.exe
  2⤵
  PID:12656
- C:\Windows\System\baLSydU.exe
  C:\Windows\System\baLSydU.exe
  2⤵
  PID:12672
- C:\Windows\System\czCRlTd.exe
  C:\Windows\System\czCRlTd.exe
  2⤵
  PID:12688
- C:\Windows\System\gDttPvn.exe
  C:\Windows\System\gDttPvn.exe
  2⤵
  PID:12708
- C:\Windows\System\VLvFruz.exe
  C:\Windows\System\VLvFruz.exe
  2⤵
  PID:12724
- C:\Windows\System\hRduQYp.exe
  C:\Windows\System\hRduQYp.exe
  2⤵
  PID:12748
- C:\Windows\System\rMGXnHm.exe
  C:\Windows\System\rMGXnHm.exe
  2⤵
  PID:12764
- C:\Windows\System\WGURYUP.exe
  C:\Windows\System\WGURYUP.exe
  2⤵
  PID:12784
- C:\Windows\System\wViKFpJ.exe
  C:\Windows\System\wViKFpJ.exe
  2⤵
  PID:12800
- C:\Windows\System\KEpJctn.exe
  C:\Windows\System\KEpJctn.exe
  2⤵
  PID:12816
- C:\Windows\System\kndyzRD.exe
  C:\Windows\System\kndyzRD.exe
  2⤵
  PID:12840
- C:\Windows\System\lcGuADZ.exe
  C:\Windows\System\lcGuADZ.exe
  2⤵
  PID:12860
- C:\Windows\System\FyJBkgn.exe
  C:\Windows\System\FyJBkgn.exe
  2⤵
  PID:12880
- C:\Windows\System\doTmMXL.exe
  C:\Windows\System\doTmMXL.exe
  2⤵
  PID:12896
- C:\Windows\System\KQGTFwC.exe
  C:\Windows\System\KQGTFwC.exe
  2⤵
  PID:12916
- C:\Windows\System\icZRMli.exe
  C:\Windows\System\icZRMli.exe
  2⤵
  PID:12936
- C:\Windows\System\WGaBeLQ.exe
  C:\Windows\System\WGaBeLQ.exe
  2⤵
  PID:12952
- C:\Windows\System\fKvxgBC.exe
  C:\Windows\System\fKvxgBC.exe
  2⤵
  PID:12972
- C:\Windows\System\ntUgjgZ.exe
  C:\Windows\System\ntUgjgZ.exe
  2⤵
  PID:10200
- C:\Windows\System\BqAhWLB.exe
  C:\Windows\System\BqAhWLB.exe
  2⤵
  PID:12928
- C:\Windows\System\vWZIzJT.exe
  C:\Windows\System\vWZIzJT.exe
  2⤵
  PID:13000
- C:\Windows\System\GWcolLm.exe
  C:\Windows\System\GWcolLm.exe
  2⤵
  PID:8956
- C:\Windows\System\QUIuPaw.exe
  C:\Windows\System\QUIuPaw.exe
  2⤵
  PID:13120
- C:\Windows\System\XjObgNl.exe
  C:\Windows\System\XjObgNl.exe
  2⤵
  PID:10476
- C:\Windows\System\KRmzxBS.exe
  C:\Windows\System\KRmzxBS.exe
  2⤵
  PID:8848
- C:\Windows\System\ypJzubn.exe
  C:\Windows\System\ypJzubn.exe
  2⤵
  PID:4700
- C:\Windows\System\upLTUIn.exe
  C:\Windows\System\upLTUIn.exe
  2⤵
  PID:7568
- C:\Windows\System\KgNTJrI.exe
  C:\Windows\System\KgNTJrI.exe
  2⤵
  PID:9224
- C:\Windows\System\QhRkqWO.exe
  C:\Windows\System\QhRkqWO.exe
  2⤵
  PID:12716
- C:\Windows\System\fxbXTlD.exe
  C:\Windows\System\fxbXTlD.exe
  2⤵
  PID:8456
- C:\Windows\System\LTJhody.exe
  C:\Windows\System\LTJhody.exe
  2⤵
  PID:8372
- C:\Windows\System\sYWBGVg.exe
  C:\Windows\System\sYWBGVg.exe
  2⤵
  PID:7164
- C:\Windows\System\kPFSvlV.exe
  C:\Windows\System\kPFSvlV.exe
  2⤵
  PID:8596
- C:\Windows\System\YEeEYAF.exe
  C:\Windows\System\YEeEYAF.exe
  2⤵
  PID:8664
- C:\Windows\System\QtVzwWO.exe
  C:\Windows\System\QtVzwWO.exe
  2⤵
  PID:10564
- C:\Windows\System\JHZxCCR.exe
  C:\Windows\System\JHZxCCR.exe
  2⤵
  PID:12236
- C:\Windows\System\yxfpIpO.exe
  C:\Windows\System\yxfpIpO.exe
  2⤵
  PID:8048
- C:\Windows\System\OOnZohg.exe
  C:\Windows\System\OOnZohg.exe
  2⤵
  PID:10676
- C:\Windows\System\RJUziEF.exe
  C:\Windows\System\RJUziEF.exe
  2⤵
  PID:10756
- C:\Windows\System\pJbqsPg.exe
  C:\Windows\System\pJbqsPg.exe
  2⤵
  PID:8704
- C:\Windows\System\RZadBBp.exe
  C:\Windows\System\RZadBBp.exe
  2⤵
  PID:9024
- C:\Windows\System\NinlbbI.exe
  C:\Windows\System\NinlbbI.exe
  2⤵
  PID:9080
- C:\Windows\System\jitLpTz.exe
  C:\Windows\System\jitLpTz.exe
  2⤵
  PID:10888
- C:\Windows\System\yOUbzqV.exe
  C:\Windows\System\yOUbzqV.exe
  2⤵
  PID:11652
- C:\Windows\System\TqXadLi.exe
  C:\Windows\System\TqXadLi.exe
  2⤵
  PID:8888
- C:\Windows\System\ciVUzbP.exe
  C:\Windows\System\ciVUzbP.exe
  2⤵
  PID:10956
- C:\Windows\System\VmJNvvQ.exe
  C:\Windows\System\VmJNvvQ.exe
  2⤵
  PID:12192
- C:\Windows\System\ziHsaBL.exe
  C:\Windows\System\ziHsaBL.exe
  2⤵
  PID:11424
- C:\Windows\System\KRMZiTD.exe
  C:\Windows\System\KRMZiTD.exe
  2⤵
  PID:12064
- C:\Windows\System\tYhoRQn.exe
  C:\Windows\System\tYhoRQn.exe
  2⤵
  PID:11976
- C:\Windows\System\oCViCui.exe
  C:\Windows\System\oCViCui.exe
  2⤵
  PID:9064
- C:\Windows\System\AwSpSsj.exe
  C:\Windows\System\AwSpSsj.exe
  2⤵
  PID:12592
- C:\Windows\System\LrhuQFv.exe
  C:\Windows\System\LrhuQFv.exe
  2⤵
  PID:13184
- C:\Windows\System\lmYwXeR.exe
  C:\Windows\System\lmYwXeR.exe
  2⤵
  PID:10580
- C:\Windows\System\LCzYAdM.exe
  C:\Windows\System\LCzYAdM.exe
  2⤵
  PID:11712
- C:\Windows\System\Zegrubn.exe
  C:\Windows\System\Zegrubn.exe
  2⤵
  PID:9832
- C:\Windows\System\vTqSZmq.exe
  C:\Windows\System\vTqSZmq.exe
  2⤵
  PID:12400
- C:\Windows\System\VmAGYBB.exe
  C:\Windows\System\VmAGYBB.exe
  2⤵
  PID:13064
- C:\Windows\System\NdfEWqM.exe
  C:\Windows\System\NdfEWqM.exe
  2⤵
  PID:13288
- C:\Windows\System\HvZcbmn.exe
  C:\Windows\System\HvZcbmn.exe
  2⤵
  PID:9904
- C:\Windows\System\nRWaTub.exe
  C:\Windows\System\nRWaTub.exe
  2⤵
  PID:10432
- C:\Windows\System\iplGRWf.exe
  C:\Windows\System\iplGRWf.exe
  2⤵
  PID:6524
- C:\Windows\System\gTcTNte.exe
  C:\Windows\System\gTcTNte.exe
  2⤵
  PID:9460
- C:\Windows\System\hLTUqku.exe
  C:\Windows\System\hLTUqku.exe
  2⤵
  PID:11068
- C:\Windows\System\IDxuYrX.exe
  C:\Windows\System\IDxuYrX.exe
  2⤵
  PID:7148
- C:\Windows\System\hNWEAUU.exe
  C:\Windows\System\hNWEAUU.exe
  2⤵
  PID:8432
- C:\Windows\System\gVqpWlM.exe
  C:\Windows\System\gVqpWlM.exe
  2⤵
  PID:13148
- C:\Windows\System\shPrRiE.exe
  C:\Windows\System\shPrRiE.exe
  2⤵
  PID:11304
- C:\Windows\System\kUFfEpD.exe
  C:\Windows\System\kUFfEpD.exe
  2⤵
  PID:10472
- C:\Windows\System\rwvPEzV.exe
  C:\Windows\System\rwvPEzV.exe
  2⤵
  PID:7596
- C:\Windows\System\YWzQMbx.exe
  C:\Windows\System\YWzQMbx.exe
  2⤵
  PID:11164
- C:\Windows\System\fFcOhiU.exe
  C:\Windows\System\fFcOhiU.exe
  2⤵
  PID:9640
- C:\Windows\System\NCWLgTk.exe
  C:\Windows\System\NCWLgTk.exe
  2⤵
  PID:9968
- C:\Windows\System\WNnGsZP.exe
  C:\Windows\System\WNnGsZP.exe
  2⤵
  PID:9148
- C:\Windows\System\QdbTrDx.exe
  C:\Windows\System\QdbTrDx.exe
  2⤵
  PID:11772
- C:\Windows\System\STLMkwk.exe
  C:\Windows\System\STLMkwk.exe
  2⤵
  PID:13232
- C:\Windows\System\mogOJtg.exe
  C:\Windows\System\mogOJtg.exe
  2⤵
  PID:13068
- C:\Windows\System\TVzZsSL.exe
  C:\Windows\System\TVzZsSL.exe
  2⤵
  PID:10032
- C:\Windows\System\jhaUEnX.exe
  C:\Windows\System\jhaUEnX.exe
  2⤵
  PID:7616
- C:\Windows\System\JWUoWDC.exe
  C:\Windows\System\JWUoWDC.exe
  2⤵
  PID:8504
- C:\Windows\System\SMXYvIN.exe
  C:\Windows\System\SMXYvIN.exe
  2⤵
  PID:2120
- C:\Windows\System\qmZyMnW.exe
  C:\Windows\System\qmZyMnW.exe
  2⤵
  PID:13128
- C:\Windows\System\bGerftN.exe
  C:\Windows\System\bGerftN.exe
  2⤵
  PID:12316
- C:\Windows\System\tBehNPt.exe
  C:\Windows\System\tBehNPt.exe
  2⤵
  PID:9572
- C:\Windows\System\XwANrkg.exe
  C:\Windows\System\XwANrkg.exe
  2⤵
  PID:12852
- C:\Windows\System\axtHgiC.exe
  C:\Windows\System\axtHgiC.exe
  2⤵
  PID:13008
- C:\Windows\System\nEquFWF.exe
  C:\Windows\System\nEquFWF.exe
  2⤵
  PID:10520
- C:\Windows\System\WpTBjHg.exe
  C:\Windows\System\WpTBjHg.exe
  2⤵
  PID:13016
- C:\Windows\System\xzPofvU.exe
  C:\Windows\System\xzPofvU.exe
  2⤵
  PID:10920
- C:\Windows\System\ibbzqcX.exe
  C:\Windows\System\ibbzqcX.exe
  2⤵
  PID:10716
- C:\Windows\System\yzHZRsv.exe
  C:\Windows\System\yzHZRsv.exe
  2⤵
  PID:7144
- C:\Windows\System\tbPVgWL.exe
  C:\Windows\System\tbPVgWL.exe
  2⤵
  PID:7544
- C:\Windows\System\tzOCmDB.exe
  C:\Windows\System\tzOCmDB.exe
  2⤵
  PID:9716
- C:\Windows\System\UhbTrtr.exe
  C:\Windows\System\UhbTrtr.exe
  2⤵
  PID:13056
- C:\Windows\System\quEvtDQ.exe
  C:\Windows\System\quEvtDQ.exe
  2⤵
  PID:11500
- C:\Windows\System\hMIshrj.exe
  C:\Windows\System\hMIshrj.exe
  2⤵
  PID:7680
- C:\Windows\System\zgQxilI.exe
  C:\Windows\System\zgQxilI.exe
  2⤵
  PID:12432
- C:\Windows\System\Ynsugpi.exe
  C:\Windows\System\Ynsugpi.exe
  2⤵
  PID:11148
- C:\Windows\System\BTDYZPy.exe
  C:\Windows\System\BTDYZPy.exe
  2⤵
  PID:10460
- C:\Windows\System\kYNRxji.exe
  C:\Windows\System\kYNRxji.exe
  2⤵
  PID:11104
- C:\Windows\System\zFtsdTX.exe
  C:\Windows\System\zFtsdTX.exe
  2⤵
  PID:13144
- C:\Windows\System\xkXNxtR.exe
  C:\Windows\System\xkXNxtR.exe
  2⤵
  PID:6400
- C:\Windows\System\XhEjuby.exe
  C:\Windows\System\XhEjuby.exe
  2⤵
  PID:9652
- C:\Windows\System\dswBKmc.exe
  C:\Windows\System\dswBKmc.exe
  2⤵
  PID:12668
- C:\Windows\System\GNejePB.exe
  C:\Windows\System\GNejePB.exe
  2⤵
  PID:13076
- C:\Windows\System\KrVOxgN.exe
  C:\Windows\System\KrVOxgN.exe
  2⤵
  PID:9656
- C:\Windows\System\iiTvVas.exe
  C:\Windows\System\iiTvVas.exe
  2⤵
  PID:9744
- C:\Windows\System\WfwYnuz.exe
  C:\Windows\System\WfwYnuz.exe
  2⤵
  PID:12476
- C:\Windows\System\wJfVUzk.exe
  C:\Windows\System\wJfVUzk.exe
  2⤵
  PID:12888
- C:\Windows\System\eavOxUw.exe
  C:\Windows\System\eavOxUw.exe
  2⤵
  PID:8952
- C:\Windows\System\dUqhxbx.exe
  C:\Windows\System\dUqhxbx.exe
  2⤵
  PID:7352
- C:\Windows\System\peqkXax.exe
  C:\Windows\System\peqkXax.exe
  2⤵
  PID:8592
- C:\Windows\System\ajZnNWj.exe
  C:\Windows\System\ajZnNWj.exe
  2⤵
  PID:12460
- C:\Windows\System\JKbiOEj.exe
  C:\Windows\System\JKbiOEj.exe
  2⤵
  PID:13152
- C:\Windows\System\QtsAAds.exe
  C:\Windows\System\QtsAAds.exe
  2⤵
  PID:13444
- C:\Windows\System\TEkqUDS.exe
  C:\Windows\System\TEkqUDS.exe
  2⤵
  PID:13484
- C:\Windows\System\gFpgSip.exe
  C:\Windows\System\gFpgSip.exe
  2⤵
  PID:13916
- C:\Windows\System\hUbdeSj.exe
  C:\Windows\System\hUbdeSj.exe
  2⤵
  PID:13936
- C:\Windows\System\iJgdkcR.exe
  C:\Windows\System\iJgdkcR.exe
  2⤵
  PID:14080
- C:\Windows\System\TlOEMUm.exe
  C:\Windows\System\TlOEMUm.exe
  2⤵
  PID:13212
- C:\Windows\System\QZawdCu.exe
  C:\Windows\System\QZawdCu.exe
  2⤵
  PID:6904
- C:\Windows\System\PvVixRJ.exe
  C:\Windows\System\PvVixRJ.exe
  2⤵
  PID:13424
- C:\Windows\System\ZwxbIdy.exe
  C:\Windows\System\ZwxbIdy.exe
  2⤵
  PID:9724
- C:\Windows\System\uTYjyGE.exe
  C:\Windows\System\uTYjyGE.exe
  2⤵
  PID:13672
- C:\Windows\System\iOiaTVW.exe
  C:\Windows\System\iOiaTVW.exe
  2⤵
  PID:13708
- C:\Windows\System\AluIlTW.exe
  C:\Windows\System\AluIlTW.exe
  2⤵
  PID:13776
- C:\Windows\System\cISULYS.exe
  C:\Windows\System\cISULYS.exe
  2⤵
  PID:13796
- C:\Windows\System\OJgYFml.exe
  C:\Windows\System\OJgYFml.exe
  2⤵
  PID:13808
- C:\Windows\System\ENdcEko.exe
  C:\Windows\System\ENdcEko.exe
  2⤵
  PID:13860
- C:\Windows\System\gxfzrVJ.exe
  C:\Windows\System\gxfzrVJ.exe
  2⤵
  PID:13904
- C:\Windows\System\WvhYOFq.exe
  C:\Windows\System\WvhYOFq.exe
  2⤵
  PID:13960
- C:\Windows\System\oRFlRZY.exe
  C:\Windows\System\oRFlRZY.exe
  2⤵
  PID:14164
- C:\Windows\System\cDPqkQN.exe
  C:\Windows\System\cDPqkQN.exe
  2⤵
  PID:14100
- C:\Windows\System\nlgNLTw.exe
  C:\Windows\System\nlgNLTw.exe
  2⤵
  PID:12868
- C:\Windows\System\pgIguaP.exe
  C:\Windows\System\pgIguaP.exe
  2⤵
  PID:12280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0st5qv1m.m4f.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AkcihLm.exe

Filesize
1.1MB

MD5
dd189c7958c1bf88e49c01964bc7bf31

SHA1
badb67db0321bd5e5b05ecd2e5fc4370fc650373

SHA256
8386fb3d2055803fc965d1884564785b727c65e9b8ba9e201fbc8f445906aa22

SHA512
f9745bd44db8e674f7458f06a033ac6517f408eb828fd0bc79af191ba50f925c90d1e5754ec8f050ae2f2868b5a54af09b6e05bf79bcca29bd30f4b71eb699ba

Download Submit
C:\Windows\System\CSKHKiH.exe

Filesize
1.1MB

MD5
cce61c59e95e0f5ae0ad0eddc09ec8fe

SHA1
e2e09786932aac3310620af7a99e69f106278c8a

SHA256
92cf3ac0b07125ebb33ead254407a49191b98a39a5d92d5e528625db25e4001d

SHA512
57b3c1dc404a605d8bdc385c45823b8d77e5c3f986c7e62b419252e61e2b7656eb4efc20cd9ab1c100ca29859b7c98ef9d2121a22d163ced4db2690fa550f82e

Download Submit
C:\Windows\System\GZrQuck.exe

Filesize
1.1MB

MD5
70e67168547cd91b168030e89fc05864

SHA1
96efee62ad2f8ad6fff4a8294362de1cca0514ed

SHA256
b5016cccd8040f7de191b92464d367e8ffa7f8660761593c253469134736771c

SHA512
7390e28700d65cc1c5a4bc9017e85cc22c3824cde6842142df671a028acead29cd8564f8721d6b6a9125ce3c9a5faccd2a08294ea69dda3cbd3abc919c2bcf38

Download Submit
C:\Windows\System\GhbSfOx.exe

Filesize
1.1MB

MD5
bff72ac881b7cf9df695c190367a5ba3

SHA1
e43296f2598806ac41d10c3b8df64429a5826ce9

SHA256
18c666cd20612e9a356feeab0aa77bd53bb1f4bed6b93b9e64d35132b37df458

SHA512
1f48060f36bad5ce74ac167e01bed10d836393d38c16a3a4fc9a09406b08cb47b585bcf5cb1d5d129a21dd9a67de565cf64d5b27360ab3ce8214930d22c94786

Download Submit
C:\Windows\System\HoZXqkl.exe

Filesize
1.1MB

MD5
3bb3e95ba967db858bcbe718baa5362a

SHA1
41933a00a4c6df50276317ddf74db2c7af2a4b7f

SHA256
fbb12156b5ddf56cea737c15f0484e42891ddbe001b2ce06283f9ab28bc0dfa1

SHA512
4aacd75cc2b0f3fe5059af2b545cfdb8bc4c3e80d4e647e6615f50676160e41612fe724e3b5b1f4ae1068557a62706fe09dedc6cef77e417d05fffc575b329cb

Download Submit
C:\Windows\System\HunglDO.exe

Filesize
1.1MB

MD5
548b27ba89b7cb9cfd3dd2ac38e30d3e

SHA1
1db726313af0992b1e51ef056011e09c7b851d4a

SHA256
d3b6f5855382d56ec5d2d9b7c07b9460a07dfd6ff378891df5e2d6ce6c94a30f

SHA512
1aa460cdc27aae6644adac09aee4ca49aeaf91e048d73096741c075c3b8005e8f370383c7ecad42167aeb56cc776f4ac083430708e38172b922e96fc9df87417

Download Submit
C:\Windows\System\HzcCpbF.exe

Filesize
1.1MB

MD5
4ef376b1d65db7d8369ab8f20d260f06

SHA1
555552463a0e3858ba4f6e0ebeede938fe4b7c64

SHA256
a31c8391645a735e622d8cb53af2722c07ebc66cbf26fe369290bef017fce1e4

SHA512
405e9b874c3b1fc6c383c8df3921d8d6e0a36b429506264520d2a7c9990336f633fcb5172303dfc73d3018cf8830b773987b5151ef35c6a82137d07800e5c48d

Download Submit
C:\Windows\System\IECNCFC.exe

Filesize
1.1MB

MD5
97d3ef029fb73c587cc2424399c1d9f2

SHA1
2f61299f92197c88256864f24f98b400a478e711

SHA256
354193a6f398b292528c445c557c33d487cead0cac559cbfa20da8994a4404a5

SHA512
769d18c0687c134017a612b2e7ff0ba666c50dc77caefda73b19a2dcacc940d53c446f63de21aeabb9029d04bb71f85d0b7880e866e23c2225ffc282b2d6dec0

Download Submit
C:\Windows\System\IMnUisu.exe

Filesize
1.1MB

MD5
f63846770951b8c9947849f49a2cc31a

SHA1
e740375ff458cef4e6ad3d75145609e0f51f3fb5

SHA256
3f6458960a334f2de73066a2b95cfa61f420c4ac4d6bbf6b2bf208599e55a954

SHA512
b39c9c65d285a73e14594b440b3096f5392fe80ac4d08534508c233c43c4800937edf925c1e76fc827543478844a72e137d170b2765d3a6f3edc921617c8cb15

Download Submit
C:\Windows\System\KsFEZqY.exe

Filesize
1.1MB

MD5
30455c074f2a1fb820a74f868ee13226

SHA1
2aa4a1d08470515698250b8a8ca079e4778fce8b

SHA256
4e2778ca18e9acff771e4c50b6e77300b5c4e9e468e6f3be2766721b83214997

SHA512
35b62a3b6f698be3b8cada478650d7de786bec157ba51bfb33b693d858a22d1c2a95648f1a49e30700bb6570028db7edc285e09709f4dd0756b0ae3b05ebcf09

Download Submit
C:\Windows\System\LrsbIbr.exe

Filesize
1.1MB

MD5
24f21b0e6b58c13971d0cbe4b82bcbec

SHA1
92157c3b5c2fdb123aa6c4b1e4f02b7a72d94e9d

SHA256
e7547e9fc44d607d368f9e99486151796e7768e827bcdf116b892a850872dc18

SHA512
40da9b4e9990a36b219b73165e57b9eb07294a8504feb6025f7317f5e27a33d3fa80736850d547aae46fe9ce0905d10d88a2bb9a16a5b566cbecbf1dc2c8ee6a

Download Submit
C:\Windows\System\LxIUQmY.exe

Filesize
1.1MB

MD5
66af1837014b08e24025e6495d4f322e

SHA1
bcbf9f27144bce7ef73c27347436daa8c3bcd808

SHA256
2061f5c454a2f2baa910a39554114c01174d60feba20513cbed3bd66f4bf4493

SHA512
240aa32e94de128924f862e7089be3aa4fd8ab7946abb70b2510d7542683ee6fca253033636b73e6f955da2bd0b944584641a7280eaf94f61e5dcf7456fefd65

Download Submit
C:\Windows\System\OMZwfIU.exe

Filesize
1.1MB

MD5
d6770c4e1d31155cf2d63d63a681d53e

SHA1
712a37ae2ce05a8b895aa8c0f6871e80758ee9d0

SHA256
777de1dbfe3822e0b20343720b891e2e489d0480db3016112d2b49c6edd7a200

SHA512
bdaf788e9eb5eea3cf3fa036c11f31f62c1f0bc17fbcba153f7dd1af3e8e003fc47bc0feeb053a2288afc2d48688317ebb9c02b256931f95d0a0d120718ca6fe

Download Submit
C:\Windows\System\ORLogWB.exe

Filesize
1.1MB

MD5
801d1beefb9e88928987dce8866e5dc5

SHA1
bac787aa09ccae999e58613f7b37a8985145019e

SHA256
d29234f0f09b7539ce3bfb69c9759521e81bfa9d10c3c74b9a5bf41b7e759ab1

SHA512
8029020463260f847ba3d20cbc62d08c23c7cc613ce8e96d37b65a84cae65a173cc2abb52fd10fabc030d277b73ca23ec214fe8fe5d9a78a9eaa7de4b23e108d

Download Submit
C:\Windows\System\OSMuztG.exe

Filesize
1.1MB

MD5
a48e3083bb8fdbaec7e291144f1f5604

SHA1
c90980dcc88e371af7e570e4691139811a423c8d

SHA256
addf01d9c57c792974ee5f2896b64547a0384e073330c65e3c1e655551302fe6

SHA512
796323598856a1a8cb8bf98acbb7d1a06f56f072744f6c4bc161c1f2708710bffe6cebf94dac623b74f10df44870daaf7a9d24aa0d6bf96422746cbec7ba3e5b

Download Submit
C:\Windows\System\PLiuEtV.exe

Filesize
1.1MB

MD5
b1c95c3219d7d6a07b92ddfd09f96ce4

SHA1
52e5448ca4ff8077b8a4ab0a3599d5d4da5bc2d9

SHA256
e89063fd7390f58f53cd7bb44d2cc25ed50d195ab1cb6ff523b6fdb262923130

SHA512
2f3ee79c6929c20dce346b3c7b76647bc4cf48a0eb2d085693a9f144a1b284dde2e74475775462909b2e4d44b57b58357702cce5b5b39189657bd7c44982163d

Download Submit
C:\Windows\System\PVKlrIX.exe

Filesize
1.1MB

MD5
78e3cb47ef5efb62cfe04fe42851a98b

SHA1
c77709ecd8833e0343d03dd6f2f6a761b7f8f9c8

SHA256
caf870d72a309f4f3dbc490819b68987cac21eb833b1e8cdfbc68c3a187980db

SHA512
aff167167e9d97c1c1b4cbbb2288cc0a4877b68a46a482a6dbd5708362a08c0b62963794a9df19febd0546f4bb6b977d497b05f964d9c5c34d70dc1e57bb6058

Download Submit
C:\Windows\System\RyhOlDN.exe

Filesize
1.1MB

MD5
f3dd1702d6882a5882d728ad3ad77c65

SHA1
70992ca17c04a749532db49b681533541970270e

SHA256
c243b04ca1699eeb0421e7480ab38c9b0d730a65717ecb61bea019f8ac4bf44a

SHA512
c5a73a030d47aee2cb96b6b286465f1ff5369d74b0e375179cb9bd9b2e68da0790290d804c9daa555e4a45ccb5793a7e5a8fc217178c075e94816c4d3fe32ccb

Download Submit
C:\Windows\System\VIusEKI.exe

Filesize
1.1MB

MD5
a99832a4e73d4a1e1e998774980fff9f

SHA1
88394c9d34184fade4f31f6d2869da08d775643b

SHA256
d23b9247d8d1cc7ba7e3ef45c2e51440bd94a87238e9e532ad91a5828c7b6715

SHA512
b43955efc0d32bbe73c8011f8530c55eb29a2092fa832c14a2e6e814a32a8c2863b336091fe38dfbcd4f6997b2a203bef6c78dc0d4255ad5dbb6da7f982c8ea6

Download Submit
C:\Windows\System\WdhysQO.exe

Filesize
1.1MB

MD5
e50ae572a6465b3004d481601eb52321

SHA1
3e03246e783d05975af8260e887f5561b6c25707

SHA256
518da2b5f6bccb9e57afcda2950410ffc2a8e6a523736cc767de9a350efafde7

SHA512
7c52f5c430d7333b87301a9e2439383af8af82d8a84cf5d1d72dc1e25e8bef8033958e60130c1c0fc7ca2b0df666d2f43a820cf22b036a7293b3f9c985959992

Download Submit
C:\Windows\System\WlqtOFt.exe

Filesize
1.1MB

MD5
203763fd80ab45a65fb4eb7af73b1967

SHA1
9b4518ae1f84250a7e9e3919e1b2f035aa13f7ac

SHA256
ffa5312e22206638201c890d841fce4db5cbf360b005ae610e73d5b9518df3fb

SHA512
1711c7befd8e36a9a53981915d90175173b0615f3040ad6d309fe8cd88723ab8848e6ea78f9aab11891ceea9fd94667de7116deba53a3e6396dcd1cf866736fc

Download Submit
C:\Windows\System\XTuLEwG.exe

Filesize
1.1MB

MD5
66b3aa56167d814ce34de892141a95dd

SHA1
346f150cb4c6a9fcd868f52a490702cd593253ba

SHA256
ed25a8e6c049ae35a6ba0a6782204531238c3725b600ff377a0cf5acdb918717

SHA512
b220d390899cad9ef374779b0ebea522c002abe348772d4af02c383fd4d798f4eb34663d75ebcea92e53692772c390d8261de25340dc6c63063b37753608115b

Download Submit
C:\Windows\System\apUQPBq.exe

Filesize
1.1MB

MD5
8a345d395eb32a06c8116933231bfc8d

SHA1
974cb9a83de7d6344523514cbc6ca3cc142fbc5e

SHA256
5bf112172192ddb2b22c17a1faa170b1273c51eebc30c1c9357347461b1b33e6

SHA512
d90edb1db350c7086e610933ca2f81c51561805ce791fd96407b8011398f9889d5c0f83e816e0379ff78b97b6e8ce8e4abf4f5159fafa8232380f962e0ce98b3

Download Submit
C:\Windows\System\cZkVwUf.exe

Filesize
1.1MB

MD5
4d1b75fcd3e7f1e4c6eff8c5555b9c6a

SHA1
98d1af4a4c5d66888bee1f8b30737744f29e9d53

SHA256
48696814709449ec24aaa64d3fd8710c404b16e28d16945cd7bb2d54660fd530

SHA512
245b85d500bcf70381bcd56f073669de6da19ef9eca97e85a58cc22677dc5535948fdbe7e7f6e804b63460b58939fdd3f81c3304c74adee1cf4ef5a8155df206

Download Submit
C:\Windows\System\ccoMHFE.exe

Filesize
1.1MB

MD5
0efbf84fbc566eadb80b15806b5dab22

SHA1
a715f1c6357e3ccb2c7f205453d70ebfe0dfacc8

SHA256
6099f91e6af94d62e4cae1267f460b9017b75ee09f1d3dc062db4774cd22e3f7

SHA512
b1d2617e40740811d14b35865e8d268a2f9ba87d1528572c9500b9698cb275fe51b375146ba1fc813b0f045c2540c0d6a41d7e30ae17a53bd96af6f0f4de9d54

Download Submit
C:\Windows\System\dRInTGp.exe

Filesize
1.1MB

MD5
04f2757742b491dfb384778e14d03139

SHA1
f297e97f0b0196c91a0b7020c8b9590b0673ff1d

SHA256
a34b9decbb279efeee830be82d839b3a9f63c8e713ea9ca25efbb401d4ecf999

SHA512
b8b83af30e18de56298a37bb5c420669d81b5867c0782f9eee2f9149d93f2c3b6bc7e61fa7a1a6bc66bf53726fcbe3580392fe7a60652b3bd5f394303d9a535b

Download Submit
C:\Windows\System\fKfdbPE.exe

Filesize
1.1MB

MD5
9dc5f1c3643c363251938f314e95f7d8

SHA1
041c375358a178fb8e583e8b45778c07dd55cf3b

SHA256
7a34c7a32316b1f65802f10c2be709a96bd665b0e698f7c47f43d340ffcb63c3

SHA512
3e4be704b214480f7c58f1dd1b5e62e89f765d5bf552c4e47af4074f0e35c945fdb92d4a04f12304c526108942ae6ee0ee3f923140b710fabec4922844e93f7d

Download Submit
C:\Windows\System\iGDXKmS.exe

Filesize
1.1MB

MD5
ee261d50142195634f0b880ec5404d41

SHA1
84cd9382654d9bca86cebcc828d0edae3ec1544f

SHA256
70622b7542627015863cc934e4fa0fa536277c3b0e1e4de82de396f0b2a261d8

SHA512
91d5460fd29bc11e25cbe79dfbbd4c1eeb9ef99c1d3d48d7d7026675c82ca5234a9fbc5292ca0915600abb260f96f1377c0112520a45bfc22b8157f649576336

Download Submit
C:\Windows\System\ikzPqYW.exe

Filesize
1.1MB

MD5
ff85fd47b6e16db67e91bbbf09a43135

SHA1
6932faab61163deadf83af7ec70574fb5d77a5fd

SHA256
7475b2cb90f439b0bb0db8df91eae1222c649a6806df64459a9f280a6e3bd7a4

SHA512
1ae1bb24173f84303aa78fdcf1e8c226b9734678c8c7f6660fd00eeecd056b985f1ebad4acf98d98f74166dcd758a0cf2eb32f70242f027cebf3ac53badc1088

Download Submit
C:\Windows\System\kNZbXfj.exe

Filesize
1.1MB

MD5
8b93cdb31c0609f131d28a3cdc0fad5e

SHA1
e6c96e0f637ffe896711a60cc47eba5fe72bbe86

SHA256
befa5d19f8bac87e3ea127af262a9281984caf3de6f185ad96a22d5d9b77dc75

SHA512
7038abee7cbf707171d712cd1e069a38c6f6cff930a27c35a190485b53885fecad564e7215afe818ea1e1b9bcdd915cbe4e950117168809ee915ed22682f368f

Download Submit
C:\Windows\System\kPBXfOj.exe

Filesize
1.1MB

MD5
0e24c22402060d261063cbe2dad34c93

SHA1
ae35928b730f4c5b56484cc7aabef2d0d46e4562

SHA256
7bffc23b055c4a36cc99c9db73e240d36622117a9043e8965846ebf76f915ffb

SHA512
c3035ae40534001e0ec9890a340eca3d9b7a4c8d9791de8cf7dd0e20fac6f380fce1af3ddfabb538028197fdbdaf3f6c387b5f81aa92b45a23d6e98dd2a77fce

Download Submit
C:\Windows\System\kysBBMT.exe

Filesize
1.1MB

MD5
d722f19f71ba7ca5168c8652787aad0d

SHA1
3fd867b4bbf236cf92b345e68c96ad7a3c94a6e2

SHA256
e2c7ad4e90fe2fbaf35e01d8c5b2118a9f591ee054b473036d0298dd8e57aed3

SHA512
3e0ac2299c29e7af06dddd7d59e061408b6e733ddc261b52bf144b8231b1b7226584658a57c454c5bf3ac041ee19ffefbf721038cab22fec57bc99e3d11e5deb

Download Submit
C:\Windows\System\lDWGzDN.exe

Filesize
8B

MD5
3f458b29ef7624cdc2cfa6a59bac159b

SHA1
ebe319707098bf02e4618724a4069c12f3cd3883

SHA256
b37cfec6846306522b18e6ba9aebdcb2867401e4677b2f7bba68a977a6f9f632

SHA512
908c2b1ab7fa1c138d0e88e5c07006e3f65a3dabe5bc72058f61d1dbd1a02eea978d454894d5db8ce7025afc7879875f8b9c0b80c7242f56ac5112e2e3ac8100

Download Submit
C:\Windows\System\nTUstlp.exe

Filesize
1.1MB

MD5
4694fa567e604ba3b8ceeb64c9cc2127

SHA1
c3d94427a4eec1083eaf412879c2616cd6104f35

SHA256
d13763f1fe5ee7251142b087a70b514c93c5a7539e4383a4bbe5cd822062af96

SHA512
1089e26661de10d3d76ffa819780683df92d4971a7ce2a6b8e54ed22f22af464515cd1273436b1c2a4eb40a15b88972322384ba0f1a5a97f7df7e8d314882aea

Download Submit
C:\Windows\System\ngnDiBX.exe

Filesize
1.1MB

MD5
7c2f2bca1560fbcd185da0856b1a9954

SHA1
99a3a08a74da955a42dddff65f93f1228e8991b4

SHA256
f3823115dc4765c012a5209b5cc80e8fa6403b20eb335509313071dcdfe12e11

SHA512
2ebd51642fc4f41ea11a969090a7a4b40e07261e7915fdbbd8cd982c32a465f77bd9d645e7b398ea0a4b7551349c6c0efeb41abeeda400e572486d03bd17633c

Download Submit
C:\Windows\System\odYKhyY.exe

Filesize
1.1MB

MD5
69993a633fe19282005b04bd597b6471

SHA1
7a0e04e175ed34e5ff1a628a52615dc65e7d7618

SHA256
027fb8a9c67c7f5a080ae44af40a077e01cca36547bd4843d018c2ca703a6f3f

SHA512
216a3c8eed4174f7b1771c0b17e2e9c7a6dbd505a83d5721a8376c3df78da37652655fbc1f4d7349325dc395bc2503305a4574baa678e4f624f108121662b664

Download Submit
C:\Windows\System\qhcapYR.exe

Filesize
1.1MB

MD5
d7b854a34262ea7ee32982cf4d16901f

SHA1
d094c4de0a22ef840a07366aa948e842810900fc

SHA256
5941fd9e5172d6846dd8d1e6b8577f821611c7fc679a9ab4d880a7bc5b01591b

SHA512
995981d6c3258b5c1aeafdc04bff6c6992f6d7041b04ad596abcee34fdf6b0496610b131a680266ef3b04b04accfe4edaf7dc1a608ea2ed5797c745e0844ef1a

Download Submit
C:\Windows\System\qwTJZwj.exe

Filesize
1.1MB

MD5
134fd5487578e7995ef5d73e28e7cb3e

SHA1
63ea857c8a019b29ee589e964ffc25278a66b488

SHA256
f4ad71e20a7bd968449cbdbd7b159f5a28744e97fb16ca72de57783cc5ce8272

SHA512
f35def3c9fa5f466badc80e40a931b45812b685519eb21dd23320e79a9845f12a063e4c991c2ecc21295bb5fd264721d8f43580c3b35627ac43ae0e0e155b366

Download Submit
C:\Windows\System\vWcCTLp.exe

Filesize
1.1MB

MD5
9a3db996e80c86d395092dee23997661

SHA1
46e06bd51272d5615bb25d9b416d0be5ac38f56d

SHA256
4b3a4820dbf2a2042b6f4a246a7f44c3ae8191bd34c0ac0d05b32406b97648d7

SHA512
09bde78df1fdefda4866ce607081f27f6a6df9e8e19cf0bb6c2d14c8ce288f5385788aa84b4e5536e730c6d6e15111ff0b3be89ba85060a5c8d6a0f4405eb086

Download Submit
C:\Windows\System\vuNYQYh.exe

Filesize
1.1MB

MD5
14c07d41b3f1ec9ab79bee1973662514

SHA1
16c6f3e5f5c27ab192c7b19e9461e3d23a54842a

SHA256
d71493709955b7f23431dfd50ad89625508c76c42960ae6193fb0e7f45c081de

SHA512
39d1f891cfb227271359ab88d8731c0aa4aeb9896a2c848329ea71a8cd0789a94353a3eff4547bca131cf5265952bc2bc2396bec50ad6e513df56e6d09c2903f

Download Submit
C:\Windows\System\wFoVTvl.exe

Filesize
1.1MB

MD5
ed853b8adbe04dcce7cf727d2f251639

SHA1
1b7e313cd1f464002833dd932ae79b5fe20f6ede

SHA256
77ddb7c1b3817963e28b6541ac12eb8dc7ad575af0b265ab5263e137f72dfdce

SHA512
d30cfd60c44cc688fc0e272c742e1c55d3bc50413f4f06c1bc83ce4a69bf8f6f2031d188f6a5948b6a5577edcb862041ee65c826003359aa221dacf93bbdce0c

Download Submit
C:\Windows\System\wyueUxT.exe

Filesize
1.1MB

MD5
10db7051af3a2e84b402237cb57c0350

SHA1
4c3ec330ad1ec52d787dee1f3909f7a9ce4c7936

SHA256
bf16bbedd648a9d1b4e24d71020743d2b687d192b1b069d9e56735283737e8df

SHA512
d99af3a169f07c09e531f17257a7dc456e6b761c1230ef4ca6265f7a7664cd5acd826c7453145153f55855930b4ee2e59f4a95e6134ba44292068ea08640ee11

Download Submit
C:\Windows\System\yczXJjX.exe

Filesize
1.1MB

MD5
698c4ea87bc736ae45285051408bfef2

SHA1
e7b92dac03ef5d79c7f3048034dbce937bb3d18b

SHA256
0784770b098c520e9415ec698605773eb88526bc99c06a8d53e6184445e77e95

SHA512
272a3ea4168715243dd72947733ad2be092e1f2869b93b9645eefc2afbfd1d084fde0c8616a3fedc48d289aabc138a9173b63b2e25a86578f935e258ac6125c8

Download Submit
memory/216-403-0x00007FF6F5830000-0x00007FF6F5C22000-memory.dmp

Filesize
3.9MB

Download
memory/216-3335-0x00007FF6F5830000-0x00007FF6F5C22000-memory.dmp

Filesize
3.9MB

Download
memory/388-0-0x00007FF7B7240000-0x00007FF7B7632000-memory.dmp

Filesize
3.9MB

Download
memory/388-1-0x0000024E1A620000-0x0000024E1A630000-memory.dmp

Filesize
64KB

Download
memory/772-391-0x00007FF7F2A00000-0x00007FF7F2DF2000-memory.dmp

Filesize
3.9MB

Download
memory/772-3346-0x00007FF7F2A00000-0x00007FF7F2DF2000-memory.dmp

Filesize
3.9MB

Download
memory/1044-3334-0x00007FF70EB50000-0x00007FF70EF42000-memory.dmp

Filesize
3.9MB

Download
memory/1044-389-0x00007FF70EB50000-0x00007FF70EF42000-memory.dmp

Filesize
3.9MB

Download
memory/1588-3360-0x00007FF672810000-0x00007FF672C02000-memory.dmp

Filesize
3.9MB

Download
memory/1588-395-0x00007FF672810000-0x00007FF672C02000-memory.dmp

Filesize
3.9MB

Download
memory/2280-3321-0x00007FF6CCF90000-0x00007FF6CD382000-memory.dmp

Filesize
3.9MB

Download
memory/2280-31-0x00007FF6CCF90000-0x00007FF6CD382000-memory.dmp

Filesize
3.9MB

Download
memory/2908-3496-0x00007FFA42D10000-0x00007FFA437D1000-memory.dmp

Filesize
10.8MB

Download
memory/2908-388-0x0000018CA5EE0000-0x0000018CA5F02000-memory.dmp

Filesize
136KB

Download
memory/2908-407-0x0000018CA6AC0000-0x0000018CA7266000-memory.dmp

Filesize
7.6MB

Download
memory/2908-98-0x00007FFA42D13000-0x00007FFA42D15000-memory.dmp

Filesize
8KB

Download
memory/2908-3528-0x00007FFA42D13000-0x00007FFA42D15000-memory.dmp

Filesize
8KB

Download
memory/2908-336-0x00007FFA42D10000-0x00007FFA437D1000-memory.dmp

Filesize
10.8MB

Download
memory/2908-201-0x00007FFA42D10000-0x00007FFA437D1000-memory.dmp

Filesize
10.8MB

Download
memory/3040-396-0x00007FF699B00000-0x00007FF699EF2000-memory.dmp

Filesize
3.9MB

Download
memory/3040-3371-0x00007FF699B00000-0x00007FF699EF2000-memory.dmp

Filesize
3.9MB

Download
memory/3340-3325-0x00007FF6BEBB0000-0x00007FF6BEFA2000-memory.dmp

Filesize
3.9MB

Download
memory/3340-97-0x00007FF6BEBB0000-0x00007FF6BEFA2000-memory.dmp

Filesize
3.9MB

Download
memory/3420-3337-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp

Filesize
3.9MB

Download
memory/3420-394-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp

Filesize
3.9MB

Download
memory/3624-3323-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp

Filesize
3.9MB

Download
memory/3624-50-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp

Filesize
3.9MB

Download
memory/3708-404-0x00007FF640CD0000-0x00007FF6410C2000-memory.dmp

Filesize
3.9MB

Download
memory/3708-3327-0x00007FF640CD0000-0x00007FF6410C2000-memory.dmp

Filesize
3.9MB

Download
memory/3784-405-0x00007FF610830000-0x00007FF610C22000-memory.dmp

Filesize
3.9MB

Download
memory/3784-3339-0x00007FF610830000-0x00007FF610C22000-memory.dmp

Filesize
3.9MB

Download
memory/3804-3329-0x00007FF6A7700000-0x00007FF6A7AF2000-memory.dmp

Filesize
3.9MB

Download
memory/3804-376-0x00007FF6A7700000-0x00007FF6A7AF2000-memory.dmp

Filesize
3.9MB

Download
memory/3844-393-0x00007FF7F8C30000-0x00007FF7F9022000-memory.dmp

Filesize
3.9MB

Download
memory/3844-3362-0x00007FF7F8C30000-0x00007FF7F9022000-memory.dmp

Filesize
3.9MB

Download
memory/4044-3345-0x00007FF6999F0000-0x00007FF699DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4044-377-0x00007FF6999F0000-0x00007FF699DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4152-406-0x00007FF7C47B0000-0x00007FF7C4BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4152-3375-0x00007FF7C47B0000-0x00007FF7C4BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4208-3374-0x00007FF6DD490000-0x00007FF6DD882000-memory.dmp

Filesize
3.9MB

Download
memory/4208-402-0x00007FF6DD490000-0x00007FF6DD882000-memory.dmp

Filesize
3.9MB

Download
memory/4308-3353-0x00007FF7BBFD0000-0x00007FF7BC3C2000-memory.dmp

Filesize
3.9MB

Download
memory/4308-392-0x00007FF7BBFD0000-0x00007FF7BC3C2000-memory.dmp

Filesize
3.9MB

Download
memory/4412-3357-0x00007FF6327C0000-0x00007FF632BB2000-memory.dmp

Filesize
3.9MB

Download
memory/4412-399-0x00007FF6327C0000-0x00007FF632BB2000-memory.dmp

Filesize
3.9MB

Download
memory/4556-3331-0x00007FF70E130000-0x00007FF70E522000-memory.dmp

Filesize
3.9MB

Download
memory/4556-378-0x00007FF70E130000-0x00007FF70E522000-memory.dmp

Filesize
3.9MB

Download
memory/4600-400-0x00007FF653F30000-0x00007FF654322000-memory.dmp

Filesize
3.9MB

Download
memory/4600-3350-0x00007FF653F30000-0x00007FF654322000-memory.dmp

Filesize
3.9MB

Download
memory/4900-401-0x00007FF77BD80000-0x00007FF77C172000-memory.dmp

Filesize
3.9MB

Download
memory/4900-3380-0x00007FF77BD80000-0x00007FF77C172000-memory.dmp

Filesize
3.9MB

Download
memory/4960-397-0x00007FF7FC890000-0x00007FF7FCC82000-memory.dmp

Filesize
3.9MB

Download
memory/4960-3341-0x00007FF7FC890000-0x00007FF7FCC82000-memory.dmp

Filesize
3.9MB

Download
memory/4988-3348-0x00007FF77D550000-0x00007FF77D942000-memory.dmp

Filesize
3.9MB

Download
memory/4988-398-0x00007FF77D550000-0x00007FF77D942000-memory.dmp

Filesize
3.9MB

Download
memory/5000-3364-0x00007FF74F6E0000-0x00007FF74FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/5000-390-0x00007FF74F6E0000-0x00007FF74FAD2000-memory.dmp

Filesize
3.9MB

Download