xmrig | 695acc56d6a395dc91e0d52b50d6af2ce5aee2d34d7997b3a3797f82f8a075c2

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
Size

1.8MB
MD5

8d1ecfb1e8ed3582813a16c68f8ffb00
SHA1

184ce6f94725cf9fa0027a60f6cd04014982edd4
SHA256

695acc56d6a395dc91e0d52b50d6af2ce5aee2d34d7997b3a3797f82f8a075c2
SHA512

7369458ed7836be5df259a45e8b4a12445874bd06bc5d76cfcac1dc334d0b1cc8404c9647b3d7713e0e412ad4d98886acc31f188bd4313978276c702ccff8072
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCvHMJs2+fKOhO6nFy0:Lz071uv4BPMkFfdgIZohteLPCsXH00

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral2/memory/2860-594-0x00007FF6FB4F0000-0x00007FF6FB8E2000-memory.dmp	xmrig
behavioral2/memory/1164-611-0x00007FF7F4C10000-0x00007FF7F5002000-memory.dmp	xmrig
behavioral2/memory/4872-616-0x00007FF6D3BA0000-0x00007FF6D3F92000-memory.dmp	xmrig
behavioral2/memory/3228-703-0x00007FF6AE500000-0x00007FF6AE8F2000-memory.dmp	xmrig
behavioral2/memory/544-696-0x00007FF7A38D0000-0x00007FF7A3CC2000-memory.dmp	xmrig
behavioral2/memory/1200-675-0x00007FF690E50000-0x00007FF691242000-memory.dmp	xmrig
behavioral2/memory/4920-620-0x00007FF6BD570000-0x00007FF6BD962000-memory.dmp	xmrig
behavioral2/memory/2088-619-0x00007FF7C1D60000-0x00007FF7C2152000-memory.dmp	xmrig
behavioral2/memory/3696-618-0x00007FF725820000-0x00007FF725C12000-memory.dmp	xmrig
behavioral2/memory/5072-617-0x00007FF7D2EE0000-0x00007FF7D32D2000-memory.dmp	xmrig
behavioral2/memory/2728-615-0x00007FF6B9550000-0x00007FF6B9942000-memory.dmp	xmrig
behavioral2/memory/3256-614-0x00007FF62CAD0000-0x00007FF62CEC2000-memory.dmp	xmrig
behavioral2/memory/4752-613-0x00007FF726290000-0x00007FF726682000-memory.dmp	xmrig
behavioral2/memory/1972-612-0x00007FF689900000-0x00007FF689CF2000-memory.dmp	xmrig
behavioral2/memory/1736-610-0x00007FF6AA2D0000-0x00007FF6AA6C2000-memory.dmp	xmrig
behavioral2/memory/1716-485-0x00007FF68CB30000-0x00007FF68CF22000-memory.dmp	xmrig
behavioral2/memory/5108-395-0x00007FF630BF0000-0x00007FF630FE2000-memory.dmp	xmrig
behavioral2/memory/4760-211-0x00007FF651C10000-0x00007FF652002000-memory.dmp	xmrig
behavioral2/memory/2184-159-0x00007FF6740B0000-0x00007FF6744A2000-memory.dmp	xmrig
behavioral2/memory/2412-158-0x00007FF77CFC0000-0x00007FF77D3B2000-memory.dmp	xmrig
behavioral2/memory/3972-131-0x00007FF719D30000-0x00007FF71A122000-memory.dmp	xmrig
behavioral2/memory/2148-98-0x00007FF648290000-0x00007FF648682000-memory.dmp	xmrig
behavioral2/memory/4320-74-0x00007FF6A4280000-0x00007FF6A4672000-memory.dmp	xmrig
behavioral2/memory/4956-19-0x00007FF652530000-0x00007FF652922000-memory.dmp	xmrig
behavioral2/memory/4624-4132-0x00007FF7C3690000-0x00007FF7C3A82000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
948	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4956	DeBBDnI.exe
2088	XDdlvIy.exe
4320	eiLFuRx.exe
2148	juqGpbm.exe
4920	UGFKdeP.exe
3972	FZdFvRN.exe
2412	hiLDHSL.exe
2184	KJYNzNl.exe
4760	YwkCWJR.exe
5108	xPKNuuc.exe
1716	zdyaVJW.exe
2860	qvoWpDB.exe
1736	WhDBCsR.exe
1200	dnkJCFV.exe
544	SoYngZA.exe
1164	rNBfinR.exe
1972	knEHDWt.exe
4752	klXBakQ.exe
3256	PXoTStE.exe
2728	aqtIYoQ.exe
4872	ijcUGjM.exe
3228	DZntTTO.exe
5072	sfFTOlc.exe
3696	egMjLNi.exe
4576	dpIwLIh.exe
1628	wVPfZjK.exe
628	oOOjuNr.exe
4832	WaxXYLH.exe
3024	naKvtVx.exe
1316	qTELoVQ.exe
4860	SqgFkRX.exe
4888	cWxIKJv.exe
444	yyaigYf.exe
1720	jmGpYWC.exe
1048	QSooiOX.exe
2320	QFvXqbQ.exe
3456	SCQWZNQ.exe
1052	VYIyniO.exe
4368	UCcfNDH.exe
2832	qNuMAak.exe
4416	rXjCpXq.exe
3720	oEYBnlv.exe
2188	BVuXCrR.exe
2624	GtScJjV.exe
3776	EAciSnl.exe
1180	veDGcHG.exe
4480	PukiFID.exe
2420	oCYlcPE.exe
4336	fqpKPLu.exe
1772	qICOQMC.exe
4828	bAuAHNm.exe
4768	DExvQDR.exe
3700	vrgPzXZ.exe
836	ZtDNGHZ.exe
4120	CSwNbYr.exe
3708	lqotzQm.exe
4680	UOxeZYt.exe
4288	OsOULNT.exe
4104	pIteMPe.exe
4040	CGLLivQ.exe
3140	afMTwIA.exe
3304	eHWRGto.exe
3096	qmqsdTN.exe
4564	ZMPjoCi.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4624-0-0x00007FF7C3690000-0x00007FF7C3A82000-memory.dmp	upx
behavioral2/files/0x00090000000233bc-5.dat	upx
behavioral2/files/0x000700000002341a-9.dat	upx
behavioral2/files/0x000700000002341f-33.dat	upx
behavioral2/files/0x0007000000023421-55.dat	upx
behavioral2/files/0x0007000000023436-142.dat	upx
behavioral2/memory/2860-594-0x00007FF6FB4F0000-0x00007FF6FB8E2000-memory.dmp	upx
behavioral2/memory/1164-611-0x00007FF7F4C10000-0x00007FF7F5002000-memory.dmp	upx
behavioral2/memory/4872-616-0x00007FF6D3BA0000-0x00007FF6D3F92000-memory.dmp	upx
behavioral2/memory/3228-703-0x00007FF6AE500000-0x00007FF6AE8F2000-memory.dmp	upx
behavioral2/memory/544-696-0x00007FF7A38D0000-0x00007FF7A3CC2000-memory.dmp	upx
behavioral2/memory/1200-675-0x00007FF690E50000-0x00007FF691242000-memory.dmp	upx
behavioral2/memory/4920-620-0x00007FF6BD570000-0x00007FF6BD962000-memory.dmp	upx
behavioral2/memory/2088-619-0x00007FF7C1D60000-0x00007FF7C2152000-memory.dmp	upx
behavioral2/memory/3696-618-0x00007FF725820000-0x00007FF725C12000-memory.dmp	upx
behavioral2/memory/5072-617-0x00007FF7D2EE0000-0x00007FF7D32D2000-memory.dmp	upx
behavioral2/memory/2728-615-0x00007FF6B9550000-0x00007FF6B9942000-memory.dmp	upx
behavioral2/memory/3256-614-0x00007FF62CAD0000-0x00007FF62CEC2000-memory.dmp	upx
behavioral2/memory/4752-613-0x00007FF726290000-0x00007FF726682000-memory.dmp	upx
behavioral2/memory/1972-612-0x00007FF689900000-0x00007FF689CF2000-memory.dmp	upx
behavioral2/memory/1736-610-0x00007FF6AA2D0000-0x00007FF6AA6C2000-memory.dmp	upx
behavioral2/memory/1716-485-0x00007FF68CB30000-0x00007FF68CF22000-memory.dmp	upx
behavioral2/memory/5108-395-0x00007FF630BF0000-0x00007FF630FE2000-memory.dmp	upx
behavioral2/memory/4760-211-0x00007FF651C10000-0x00007FF652002000-memory.dmp	upx
behavioral2/files/0x000700000002342f-189.dat	upx
behavioral2/files/0x000700000002342b-183.dat	upx
behavioral2/files/0x000700000002342e-178.dat	upx
behavioral2/files/0x000700000002343e-176.dat	upx
behavioral2/files/0x000700000002343d-170.dat	upx
behavioral2/files/0x0007000000023434-166.dat	upx
behavioral2/files/0x0007000000023435-165.dat	upx
behavioral2/files/0x000700000002343b-163.dat	upx
behavioral2/files/0x000700000002343a-162.dat	upx
behavioral2/memory/2184-159-0x00007FF6740B0000-0x00007FF6744A2000-memory.dmp	upx
behavioral2/memory/2412-158-0x00007FF77CFC0000-0x00007FF77D3B2000-memory.dmp	upx
behavioral2/files/0x0007000000023439-157.dat	upx
behavioral2/files/0x0007000000023438-156.dat	upx
behavioral2/files/0x000700000002342a-155.dat	upx
behavioral2/files/0x0007000000023429-181.dat	upx
behavioral2/files/0x0007000000023424-147.dat	upx
behavioral2/files/0x0007000000023437-145.dat	upx
behavioral2/files/0x000700000002342d-144.dat	upx
behavioral2/files/0x0007000000023433-137.dat	upx
behavioral2/files/0x000700000002343c-164.dat	upx
behavioral2/memory/3972-131-0x00007FF719D30000-0x00007FF71A122000-memory.dmp	upx
behavioral2/files/0x0007000000023432-128.dat	upx
behavioral2/files/0x0007000000023431-127.dat	upx
behavioral2/files/0x0007000000023430-126.dat	upx
behavioral2/files/0x000700000002342c-124.dat	upx
behavioral2/files/0x0007000000023425-121.dat	upx
behavioral2/files/0x0007000000023428-152.dat	upx
behavioral2/files/0x0007000000023423-117.dat	upx
behavioral2/files/0x0007000000023422-106.dat	upx
behavioral2/files/0x0007000000023427-134.dat	upx
behavioral2/memory/2148-98-0x00007FF648290000-0x00007FF648682000-memory.dmp	upx
behavioral2/memory/4320-74-0x00007FF6A4280000-0x00007FF6A4672000-memory.dmp	upx
behavioral2/files/0x0007000000023426-67.dat	upx
behavioral2/files/0x000700000002341d-61.dat	upx
behavioral2/files/0x0007000000023420-79.dat	upx
behavioral2/files/0x000700000002341e-73.dat	upx
behavioral2/files/0x000700000002341b-43.dat	upx
behavioral2/files/0x000700000002341c-51.dat	upx
behavioral2/files/0x0008000000023419-27.dat	upx
behavioral2/memory/4956-19-0x00007FF652530000-0x00007FF652922000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eyrqdwY.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\aiQRKwy.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\EVrOsaY.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\UnRwUHo.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\CSvEAfl.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\DsSYNld.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\judYlaj.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\aKyeSoY.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\viJYdTx.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\DRMvvsq.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\qcpbqjP.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\JiHrEKQ.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\SDvOJai.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\lbLjwMs.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ykeeyIx.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\hkuAbTw.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\eTyjLOQ.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\IZnqjVF.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\acWNwiR.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\fOqRTSU.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\WmuxZbD.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\HKDGqjK.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\wKpcWZI.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\EAciSnl.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\TZOEWwd.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\JnazgKF.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\cbpxYPv.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ocVEZJW.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\vvACCBJ.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\spLXhgm.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\WQCQrtP.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\IKPiEAP.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\CNuJOCM.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\qxJRRUP.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\EartlqT.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\QCGDByJ.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\hWJeJFb.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\cskJHxQ.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\bgFNHIE.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\gsGmnLO.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\dqRAulU.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\LdFHcOh.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\SBYfsOU.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\hAxElxV.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\aaMBpKm.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\vyzAJcM.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\UmpKGFL.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\GwcYCIu.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\SdjMDkh.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\idGcuhF.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\awPgELn.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\VFPWEvL.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\uxGmIph.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\BOXuIux.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\FQFFOwv.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\tpyQQuG.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\zmmNMYv.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\DEciPsF.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\PKQlCfP.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\QIHQQkV.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\lkNcKoz.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ZajoZjN.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\xfKFMiR.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\DovYfok.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
10992	Process not Found
11192	Process not Found
11348	Process not Found
10836	Process not Found
2364	Process not Found
2576	Process not Found
8	Process not Found
9672	Process not Found
9676	Process not Found
9812	Process not Found
10864	Process not Found
12228	Process not Found
9896	Process not Found
12740	Process not Found
9608	Process not Found
9832	Process not Found
8008	Process not Found
9720	Process not Found
10324	Process not Found
11352	Process not Found
12568	Process not Found
12616	Process not Found
12692	Process not Found
12732	Process not Found
12764	Process not Found
12768	Process not Found
12772	Process not Found
12776	Process not Found
12780	Process not Found
12784	Process not Found
12792	Process not Found
12800	Process not Found
12804	Process not Found
13160	Process not Found
12824	Process not Found
12868	Process not Found
13200	Process not Found
12968	Process not Found
13028	Process not Found
12576	Process not Found
13048	Process not Found
13148	Process not Found
13164	Process not Found
13152	Process not Found
3660	Process not Found
13804	Process not Found
3628	Process not Found
1432	Process not Found
3120	Process not Found
4256	Process not Found
2176	Process not Found
1780	Process not Found
4656	Process not Found
14008	Process not Found
976	Process not Found
2396	Process not Found
3688	Process not Found
3100	Process not Found
1684	Process not Found
14112	Process not Found
1920	Process not Found
3548	Process not Found
2748	Process not Found
2544	Process not Found

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
Token: SeLockMemoryPrivilege	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
Token: SeDebugPrivilege	948	powershell.exe
Token: SeCreateGlobalPrivilege	11696	dwm.exe
Token: SeChangeNotifyPrivilege	11696	dwm.exe
Token: 33	11696	dwm.exe
Token: SeIncBasePriorityPrivilege	11696	dwm.exe
Token: SeCreateGlobalPrivilege	13520	dwm.exe
Token: SeChangeNotifyPrivilege	13520	dwm.exe
Token: 33	13520	dwm.exe
Token: SeIncBasePriorityPrivilege	13520	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 948	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	84
PID 4624 wrote to memory of 948	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	84
PID 4624 wrote to memory of 4956	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	85
PID 4624 wrote to memory of 4956	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	85
PID 4624 wrote to memory of 2088	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	86
PID 4624 wrote to memory of 2088	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	86
PID 4624 wrote to memory of 4320	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	87
PID 4624 wrote to memory of 4320	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	87
PID 4624 wrote to memory of 2148	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	88
PID 4624 wrote to memory of 2148	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	88
PID 4624 wrote to memory of 4920	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	89
PID 4624 wrote to memory of 4920	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	89
PID 4624 wrote to memory of 3972	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	90
PID 4624 wrote to memory of 3972	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	90
PID 4624 wrote to memory of 2412	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	91
PID 4624 wrote to memory of 2412	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	91
PID 4624 wrote to memory of 2184	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	92
PID 4624 wrote to memory of 2184	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	92
PID 4624 wrote to memory of 4760	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	93
PID 4624 wrote to memory of 4760	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	93
PID 4624 wrote to memory of 5108	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	94
PID 4624 wrote to memory of 5108	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	94
PID 4624 wrote to memory of 1716	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	95
PID 4624 wrote to memory of 1716	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	95
PID 4624 wrote to memory of 2860	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	96
PID 4624 wrote to memory of 2860	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	96
PID 4624 wrote to memory of 1972	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	97
PID 4624 wrote to memory of 1972	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	97
PID 4624 wrote to memory of 1736	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	98
PID 4624 wrote to memory of 1736	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	98
PID 4624 wrote to memory of 1200	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	99
PID 4624 wrote to memory of 1200	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	99
PID 4624 wrote to memory of 544	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	100
PID 4624 wrote to memory of 544	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	100
PID 4624 wrote to memory of 1164	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	101
PID 4624 wrote to memory of 1164	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	101
PID 4624 wrote to memory of 4752	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	102
PID 4624 wrote to memory of 4752	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	102
PID 4624 wrote to memory of 3256	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	103
PID 4624 wrote to memory of 3256	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	103
PID 4624 wrote to memory of 2728	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	104
PID 4624 wrote to memory of 2728	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	104
PID 4624 wrote to memory of 4872	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	105
PID 4624 wrote to memory of 4872	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	105
PID 4624 wrote to memory of 3228	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	106
PID 4624 wrote to memory of 3228	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	106
PID 4624 wrote to memory of 5072	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	107
PID 4624 wrote to memory of 5072	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	107
PID 4624 wrote to memory of 3696	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	108
PID 4624 wrote to memory of 3696	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	108
PID 4624 wrote to memory of 4576	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	109
PID 4624 wrote to memory of 4576	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	109
PID 4624 wrote to memory of 1628	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	110
PID 4624 wrote to memory of 1628	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	110
PID 4624 wrote to memory of 628	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	111
PID 4624 wrote to memory of 628	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	111
PID 4624 wrote to memory of 4832	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	112
PID 4624 wrote to memory of 4832	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	112
PID 4624 wrote to memory of 3024	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	113
PID 4624 wrote to memory of 3024	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	113
PID 4624 wrote to memory of 3456	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	114
PID 4624 wrote to memory of 3456	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	114
PID 4624 wrote to memory of 1316	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	115
PID 4624 wrote to memory of 1316	4624	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	115

C:\Users\Admin\AppData\Local\Temp\8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
"C:\Users\Admin\AppData\Local\Temp\8d1ecfb1e8ed3582813a16c68f8ffb00N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\System\DeBBDnI.exe
  C:\Windows\System\DeBBDnI.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\XDdlvIy.exe
  C:\Windows\System\XDdlvIy.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\eiLFuRx.exe
  C:\Windows\System\eiLFuRx.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\juqGpbm.exe
  C:\Windows\System\juqGpbm.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\UGFKdeP.exe
  C:\Windows\System\UGFKdeP.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\FZdFvRN.exe
  C:\Windows\System\FZdFvRN.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\hiLDHSL.exe
  C:\Windows\System\hiLDHSL.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\KJYNzNl.exe
  C:\Windows\System\KJYNzNl.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\YwkCWJR.exe
  C:\Windows\System\YwkCWJR.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\xPKNuuc.exe
  C:\Windows\System\xPKNuuc.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\zdyaVJW.exe
  C:\Windows\System\zdyaVJW.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\qvoWpDB.exe
  C:\Windows\System\qvoWpDB.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\knEHDWt.exe
  C:\Windows\System\knEHDWt.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\WhDBCsR.exe
  C:\Windows\System\WhDBCsR.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\dnkJCFV.exe
  C:\Windows\System\dnkJCFV.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\SoYngZA.exe
  C:\Windows\System\SoYngZA.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\rNBfinR.exe
  C:\Windows\System\rNBfinR.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\klXBakQ.exe
  C:\Windows\System\klXBakQ.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\PXoTStE.exe
  C:\Windows\System\PXoTStE.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\aqtIYoQ.exe
  C:\Windows\System\aqtIYoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\ijcUGjM.exe
  C:\Windows\System\ijcUGjM.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\DZntTTO.exe
  C:\Windows\System\DZntTTO.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\sfFTOlc.exe
  C:\Windows\System\sfFTOlc.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\egMjLNi.exe
  C:\Windows\System\egMjLNi.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\dpIwLIh.exe
  C:\Windows\System\dpIwLIh.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\wVPfZjK.exe
  C:\Windows\System\wVPfZjK.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\oOOjuNr.exe
  C:\Windows\System\oOOjuNr.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\WaxXYLH.exe
  C:\Windows\System\WaxXYLH.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\naKvtVx.exe
  C:\Windows\System\naKvtVx.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\SCQWZNQ.exe
  C:\Windows\System\SCQWZNQ.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\qTELoVQ.exe
  C:\Windows\System\qTELoVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\SqgFkRX.exe
  C:\Windows\System\SqgFkRX.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\cWxIKJv.exe
  C:\Windows\System\cWxIKJv.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\yyaigYf.exe
  C:\Windows\System\yyaigYf.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\jmGpYWC.exe
  C:\Windows\System\jmGpYWC.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\QSooiOX.exe
  C:\Windows\System\QSooiOX.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\QFvXqbQ.exe
  C:\Windows\System\QFvXqbQ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\VYIyniO.exe
  C:\Windows\System\VYIyniO.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\UCcfNDH.exe
  C:\Windows\System\UCcfNDH.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\EAciSnl.exe
  C:\Windows\System\EAciSnl.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\qNuMAak.exe
  C:\Windows\System\qNuMAak.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\rXjCpXq.exe
  C:\Windows\System\rXjCpXq.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\oEYBnlv.exe
  C:\Windows\System\oEYBnlv.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\BVuXCrR.exe
  C:\Windows\System\BVuXCrR.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\GtScJjV.exe
  C:\Windows\System\GtScJjV.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\veDGcHG.exe
  C:\Windows\System\veDGcHG.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\PukiFID.exe
  C:\Windows\System\PukiFID.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\oCYlcPE.exe
  C:\Windows\System\oCYlcPE.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\fqpKPLu.exe
  C:\Windows\System\fqpKPLu.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\qICOQMC.exe
  C:\Windows\System\qICOQMC.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\bAuAHNm.exe
  C:\Windows\System\bAuAHNm.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\DExvQDR.exe
  C:\Windows\System\DExvQDR.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\vrgPzXZ.exe
  C:\Windows\System\vrgPzXZ.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\ZtDNGHZ.exe
  C:\Windows\System\ZtDNGHZ.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\CSwNbYr.exe
  C:\Windows\System\CSwNbYr.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\lqotzQm.exe
  C:\Windows\System\lqotzQm.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\UOxeZYt.exe
  C:\Windows\System\UOxeZYt.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\OsOULNT.exe
  C:\Windows\System\OsOULNT.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\pIteMPe.exe
  C:\Windows\System\pIteMPe.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\CGLLivQ.exe
  C:\Windows\System\CGLLivQ.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\afMTwIA.exe
  C:\Windows\System\afMTwIA.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\eHWRGto.exe
  C:\Windows\System\eHWRGto.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\qmqsdTN.exe
  C:\Windows\System\qmqsdTN.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\ZMPjoCi.exe
  C:\Windows\System\ZMPjoCi.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\LUkPqxs.exe
  C:\Windows\System\LUkPqxs.exe
  2⤵
  PID:2068
- C:\Windows\System\yVxoUHF.exe
  C:\Windows\System\yVxoUHF.exe
  2⤵
  PID:1668
- C:\Windows\System\hWTNOjo.exe
  C:\Windows\System\hWTNOjo.exe
  2⤵
  PID:4556
- C:\Windows\System\EZlCxUe.exe
  C:\Windows\System\EZlCxUe.exe
  2⤵
  PID:1420
- C:\Windows\System\weGkIYa.exe
  C:\Windows\System\weGkIYa.exe
  2⤵
  PID:4708
- C:\Windows\System\WOqSIDt.exe
  C:\Windows\System\WOqSIDt.exe
  2⤵
  PID:4412
- C:\Windows\System\IrgyXSZ.exe
  C:\Windows\System\IrgyXSZ.exe
  2⤵
  PID:4868
- C:\Windows\System\Modqayn.exe
  C:\Windows\System\Modqayn.exe
  2⤵
  PID:2112
- C:\Windows\System\LhMfLgy.exe
  C:\Windows\System\LhMfLgy.exe
  2⤵
  PID:2944
- C:\Windows\System\fLYQgIi.exe
  C:\Windows\System\fLYQgIi.exe
  2⤵
  PID:4004
- C:\Windows\System\wYbzfkP.exe
  C:\Windows\System\wYbzfkP.exe
  2⤵
  PID:3996
- C:\Windows\System\FlbaLmH.exe
  C:\Windows\System\FlbaLmH.exe
  2⤵
  PID:1784
- C:\Windows\System\pNEtWkd.exe
  C:\Windows\System\pNEtWkd.exe
  2⤵
  PID:5100
- C:\Windows\System\yHEAYZN.exe
  C:\Windows\System\yHEAYZN.exe
  2⤵
  PID:5152
- C:\Windows\System\tpzNPEj.exe
  C:\Windows\System\tpzNPEj.exe
  2⤵
  PID:5168
- C:\Windows\System\YQQfPda.exe
  C:\Windows\System\YQQfPda.exe
  2⤵
  PID:5184
- C:\Windows\System\enoibFc.exe
  C:\Windows\System\enoibFc.exe
  2⤵
  PID:5200
- C:\Windows\System\pMPqHHy.exe
  C:\Windows\System\pMPqHHy.exe
  2⤵
  PID:5216
- C:\Windows\System\xexDcCn.exe
  C:\Windows\System\xexDcCn.exe
  2⤵
  PID:5240
- C:\Windows\System\XyPTzPO.exe
  C:\Windows\System\XyPTzPO.exe
  2⤵
  PID:5256
- C:\Windows\System\NbDWQxI.exe
  C:\Windows\System\NbDWQxI.exe
  2⤵
  PID:5284
- C:\Windows\System\DltKKdJ.exe
  C:\Windows\System\DltKKdJ.exe
  2⤵
  PID:5312
- C:\Windows\System\TpcTZbK.exe
  C:\Windows\System\TpcTZbK.exe
  2⤵
  PID:5332
- C:\Windows\System\FnJOKHn.exe
  C:\Windows\System\FnJOKHn.exe
  2⤵
  PID:5352
- C:\Windows\System\sKNXqrX.exe
  C:\Windows\System\sKNXqrX.exe
  2⤵
  PID:5372
- C:\Windows\System\oVSgkSX.exe
  C:\Windows\System\oVSgkSX.exe
  2⤵
  PID:5388
- C:\Windows\System\ESbuAlz.exe
  C:\Windows\System\ESbuAlz.exe
  2⤵
  PID:5408
- C:\Windows\System\lRiloHB.exe
  C:\Windows\System\lRiloHB.exe
  2⤵
  PID:5428
- C:\Windows\System\wEeynse.exe
  C:\Windows\System\wEeynse.exe
  2⤵
  PID:5472
- C:\Windows\System\ipXXyLB.exe
  C:\Windows\System\ipXXyLB.exe
  2⤵
  PID:5496
- C:\Windows\System\RsxsCot.exe
  C:\Windows\System\RsxsCot.exe
  2⤵
  PID:5516
- C:\Windows\System\cwXlGRO.exe
  C:\Windows\System\cwXlGRO.exe
  2⤵
  PID:5532
- C:\Windows\System\MJTmaUE.exe
  C:\Windows\System\MJTmaUE.exe
  2⤵
  PID:5556
- C:\Windows\System\vbvavak.exe
  C:\Windows\System\vbvavak.exe
  2⤵
  PID:5576
- C:\Windows\System\fJeSiTD.exe
  C:\Windows\System\fJeSiTD.exe
  2⤵
  PID:5604
- C:\Windows\System\BWvzDpY.exe
  C:\Windows\System\BWvzDpY.exe
  2⤵
  PID:5624
- C:\Windows\System\GtGEcvn.exe
  C:\Windows\System\GtGEcvn.exe
  2⤵
  PID:5656
- C:\Windows\System\aGlKFOn.exe
  C:\Windows\System\aGlKFOn.exe
  2⤵
  PID:5672
- C:\Windows\System\hOQUUAg.exe
  C:\Windows\System\hOQUUAg.exe
  2⤵
  PID:5692
- C:\Windows\System\KOmAIsR.exe
  C:\Windows\System\KOmAIsR.exe
  2⤵
  PID:5708
- C:\Windows\System\fAPjIto.exe
  C:\Windows\System\fAPjIto.exe
  2⤵
  PID:5740
- C:\Windows\System\USQnbSQ.exe
  C:\Windows\System\USQnbSQ.exe
  2⤵
  PID:5760
- C:\Windows\System\gvzNEdo.exe
  C:\Windows\System\gvzNEdo.exe
  2⤵
  PID:5784
- C:\Windows\System\Gzrpbba.exe
  C:\Windows\System\Gzrpbba.exe
  2⤵
  PID:5804
- C:\Windows\System\vwELeQj.exe
  C:\Windows\System\vwELeQj.exe
  2⤵
  PID:5828
- C:\Windows\System\wYKGCQZ.exe
  C:\Windows\System\wYKGCQZ.exe
  2⤵
  PID:5848
- C:\Windows\System\fNctLmW.exe
  C:\Windows\System\fNctLmW.exe
  2⤵
  PID:5864
- C:\Windows\System\JWccWJD.exe
  C:\Windows\System\JWccWJD.exe
  2⤵
  PID:5888
- C:\Windows\System\tZJIUXf.exe
  C:\Windows\System\tZJIUXf.exe
  2⤵
  PID:5908
- C:\Windows\System\HxsIrnB.exe
  C:\Windows\System\HxsIrnB.exe
  2⤵
  PID:5928
- C:\Windows\System\WlRcekT.exe
  C:\Windows\System\WlRcekT.exe
  2⤵
  PID:5952
- C:\Windows\System\ERcVwgo.exe
  C:\Windows\System\ERcVwgo.exe
  2⤵
  PID:5968
- C:\Windows\System\BHxgASp.exe
  C:\Windows\System\BHxgASp.exe
  2⤵
  PID:5988
- C:\Windows\System\tiKSpPK.exe
  C:\Windows\System\tiKSpPK.exe
  2⤵
  PID:6012
- C:\Windows\System\XfVTUGJ.exe
  C:\Windows\System\XfVTUGJ.exe
  2⤵
  PID:6028
- C:\Windows\System\lgCAIOQ.exe
  C:\Windows\System\lgCAIOQ.exe
  2⤵
  PID:6064
- C:\Windows\System\VPIvTQq.exe
  C:\Windows\System\VPIvTQq.exe
  2⤵
  PID:6088
- C:\Windows\System\lFoIemE.exe
  C:\Windows\System\lFoIemE.exe
  2⤵
  PID:6108
- C:\Windows\System\HQpsJAy.exe
  C:\Windows\System\HQpsJAy.exe
  2⤵
  PID:6128
- C:\Windows\System\fduAhMx.exe
  C:\Windows\System\fduAhMx.exe
  2⤵
  PID:4776
- C:\Windows\System\oiAXUtg.exe
  C:\Windows\System\oiAXUtg.exe
  2⤵
  PID:5020
- C:\Windows\System\fVzrmsA.exe
  C:\Windows\System\fVzrmsA.exe
  2⤵
  PID:4500
- C:\Windows\System\RVDMDRE.exe
  C:\Windows\System\RVDMDRE.exe
  2⤵
  PID:4496
- C:\Windows\System\GfNGave.exe
  C:\Windows\System\GfNGave.exe
  2⤵
  PID:2288
- C:\Windows\System\CpLYeHG.exe
  C:\Windows\System\CpLYeHG.exe
  2⤵
  PID:4808
- C:\Windows\System\jYgFEVc.exe
  C:\Windows\System\jYgFEVc.exe
  2⤵
  PID:3892
- C:\Windows\System\ZvgfBbn.exe
  C:\Windows\System\ZvgfBbn.exe
  2⤵
  PID:2376
- C:\Windows\System\wOhdKKF.exe
  C:\Windows\System\wOhdKKF.exe
  2⤵
  PID:3592
- C:\Windows\System\gvMTSEo.exe
  C:\Windows\System\gvMTSEo.exe
  2⤵
  PID:1924
- C:\Windows\System\DZkaTYT.exe
  C:\Windows\System\DZkaTYT.exe
  2⤵
  PID:5248
- C:\Windows\System\TLGMpcl.exe
  C:\Windows\System\TLGMpcl.exe
  2⤵
  PID:1228
- C:\Windows\System\PgtFmnG.exe
  C:\Windows\System\PgtFmnG.exe
  2⤵
  PID:3860
- C:\Windows\System\eEDclPB.exe
  C:\Windows\System\eEDclPB.exe
  2⤵
  PID:5512
- C:\Windows\System\OGMgqAA.exe
  C:\Windows\System\OGMgqAA.exe
  2⤵
  PID:1672
- C:\Windows\System\GjFCfZY.exe
  C:\Windows\System\GjFCfZY.exe
  2⤵
  PID:5584
- C:\Windows\System\sfrWWqC.exe
  C:\Windows\System\sfrWWqC.exe
  2⤵
  PID:6156
- C:\Windows\System\ibCBYwF.exe
  C:\Windows\System\ibCBYwF.exe
  2⤵
  PID:6180
- C:\Windows\System\dAlWcrQ.exe
  C:\Windows\System\dAlWcrQ.exe
  2⤵
  PID:6208
- C:\Windows\System\tNTEdJr.exe
  C:\Windows\System\tNTEdJr.exe
  2⤵
  PID:6232
- C:\Windows\System\TAPFpAB.exe
  C:\Windows\System\TAPFpAB.exe
  2⤵
  PID:6252
- C:\Windows\System\IjUcQbq.exe
  C:\Windows\System\IjUcQbq.exe
  2⤵
  PID:6284
- C:\Windows\System\zfBlHdf.exe
  C:\Windows\System\zfBlHdf.exe
  2⤵
  PID:6300
- C:\Windows\System\Bdgwxpi.exe
  C:\Windows\System\Bdgwxpi.exe
  2⤵
  PID:6340
- C:\Windows\System\EpGBUDS.exe
  C:\Windows\System\EpGBUDS.exe
  2⤵
  PID:6356
- C:\Windows\System\WvECsVQ.exe
  C:\Windows\System\WvECsVQ.exe
  2⤵
  PID:6384
- C:\Windows\System\bkUIeHj.exe
  C:\Windows\System\bkUIeHj.exe
  2⤵
  PID:6404
- C:\Windows\System\xZvzZNz.exe
  C:\Windows\System\xZvzZNz.exe
  2⤵
  PID:6436
- C:\Windows\System\Wfwaldb.exe
  C:\Windows\System\Wfwaldb.exe
  2⤵
  PID:6456
- C:\Windows\System\mWjVHLD.exe
  C:\Windows\System\mWjVHLD.exe
  2⤵
  PID:6472
- C:\Windows\System\mqjjOwc.exe
  C:\Windows\System\mqjjOwc.exe
  2⤵
  PID:6488
- C:\Windows\System\gKKHKsv.exe
  C:\Windows\System\gKKHKsv.exe
  2⤵
  PID:6512
- C:\Windows\System\YkPHeAd.exe
  C:\Windows\System\YkPHeAd.exe
  2⤵
  PID:6528
- C:\Windows\System\TekbFQp.exe
  C:\Windows\System\TekbFQp.exe
  2⤵
  PID:6544
- C:\Windows\System\sOeLoas.exe
  C:\Windows\System\sOeLoas.exe
  2⤵
  PID:6576
- C:\Windows\System\PwJQBlR.exe
  C:\Windows\System\PwJQBlR.exe
  2⤵
  PID:6600
- C:\Windows\System\TssLTIa.exe
  C:\Windows\System\TssLTIa.exe
  2⤵
  PID:6620
- C:\Windows\System\LLbfbhv.exe
  C:\Windows\System\LLbfbhv.exe
  2⤵
  PID:6640
- C:\Windows\System\AsPEATy.exe
  C:\Windows\System\AsPEATy.exe
  2⤵
  PID:6656
- C:\Windows\System\EwFMLTE.exe
  C:\Windows\System\EwFMLTE.exe
  2⤵
  PID:6680
- C:\Windows\System\BNGblts.exe
  C:\Windows\System\BNGblts.exe
  2⤵
  PID:6700
- C:\Windows\System\yeDWety.exe
  C:\Windows\System\yeDWety.exe
  2⤵
  PID:6720
- C:\Windows\System\SDvOJai.exe
  C:\Windows\System\SDvOJai.exe
  2⤵
  PID:6736
- C:\Windows\System\xhPIFOM.exe
  C:\Windows\System\xhPIFOM.exe
  2⤵
  PID:6752
- C:\Windows\System\OkHQQjC.exe
  C:\Windows\System\OkHQQjC.exe
  2⤵
  PID:6780
- C:\Windows\System\vnECppy.exe
  C:\Windows\System\vnECppy.exe
  2⤵
  PID:6800
- C:\Windows\System\BqYrEYG.exe
  C:\Windows\System\BqYrEYG.exe
  2⤵
  PID:6820
- C:\Windows\System\ZqZuEjJ.exe
  C:\Windows\System\ZqZuEjJ.exe
  2⤵
  PID:6840
- C:\Windows\System\mEtXYLk.exe
  C:\Windows\System\mEtXYLk.exe
  2⤵
  PID:6864
- C:\Windows\System\xBbvKDx.exe
  C:\Windows\System\xBbvKDx.exe
  2⤵
  PID:6888
- C:\Windows\System\QMpPkyD.exe
  C:\Windows\System\QMpPkyD.exe
  2⤵
  PID:6904
- C:\Windows\System\GaYhxgL.exe
  C:\Windows\System\GaYhxgL.exe
  2⤵
  PID:6924
- C:\Windows\System\OOCQkBl.exe
  C:\Windows\System\OOCQkBl.exe
  2⤵
  PID:6948
- C:\Windows\System\HOOjmgB.exe
  C:\Windows\System\HOOjmgB.exe
  2⤵
  PID:6964
- C:\Windows\System\iuTbgwI.exe
  C:\Windows\System\iuTbgwI.exe
  2⤵
  PID:6988
- C:\Windows\System\CupWRvc.exe
  C:\Windows\System\CupWRvc.exe
  2⤵
  PID:7008
- C:\Windows\System\QCGDByJ.exe
  C:\Windows\System\QCGDByJ.exe
  2⤵
  PID:7044
- C:\Windows\System\xnVeUsF.exe
  C:\Windows\System\xnVeUsF.exe
  2⤵
  PID:7072
- C:\Windows\System\wSoDFHo.exe
  C:\Windows\System\wSoDFHo.exe
  2⤵
  PID:7088
- C:\Windows\System\HnHNHNh.exe
  C:\Windows\System\HnHNHNh.exe
  2⤵
  PID:7108
- C:\Windows\System\WmuxZbD.exe
  C:\Windows\System\WmuxZbD.exe
  2⤵
  PID:7128
- C:\Windows\System\AKcTWBR.exe
  C:\Windows\System\AKcTWBR.exe
  2⤵
  PID:7152
- C:\Windows\System\hOUmkBx.exe
  C:\Windows\System\hOUmkBx.exe
  2⤵
  PID:4560
- C:\Windows\System\rdfMmce.exe
  C:\Windows\System\rdfMmce.exe
  2⤵
  PID:1204
- C:\Windows\System\PqibJhA.exe
  C:\Windows\System\PqibJhA.exe
  2⤵
  PID:5040
- C:\Windows\System\EnTdfZo.exe
  C:\Windows\System\EnTdfZo.exe
  2⤵
  PID:5844
- C:\Windows\System\jeciWHW.exe
  C:\Windows\System\jeciWHW.exe
  2⤵
  PID:5924
- C:\Windows\System\fWoQLkE.exe
  C:\Windows\System\fWoQLkE.exe
  2⤵
  PID:5960
- C:\Windows\System\sLFPmfS.exe
  C:\Windows\System\sLFPmfS.exe
  2⤵
  PID:1384
- C:\Windows\System\JsiSbeu.exe
  C:\Windows\System\JsiSbeu.exe
  2⤵
  PID:5344
- C:\Windows\System\lHBEvRo.exe
  C:\Windows\System\lHBEvRo.exe
  2⤵
  PID:6072
- C:\Windows\System\zNoKkea.exe
  C:\Windows\System\zNoKkea.exe
  2⤵
  PID:5420
- C:\Windows\System\PWoUgMF.exe
  C:\Windows\System\PWoUgMF.exe
  2⤵
  PID:1464
- C:\Windows\System\aYMgLDv.exe
  C:\Windows\System\aYMgLDv.exe
  2⤵
  PID:4548
- C:\Windows\System\PvySHbb.exe
  C:\Windows\System\PvySHbb.exe
  2⤵
  PID:2032
- C:\Windows\System\EVrOsaY.exe
  C:\Windows\System\EVrOsaY.exe
  2⤵
  PID:1948
- C:\Windows\System\jNyBIuQ.exe
  C:\Windows\System\jNyBIuQ.exe
  2⤵
  PID:5176
- C:\Windows\System\fxOYpWD.exe
  C:\Windows\System\fxOYpWD.exe
  2⤵
  PID:5208
- C:\Windows\System\mzLnbnG.exe
  C:\Windows\System\mzLnbnG.exe
  2⤵
  PID:5232
- C:\Windows\System\GLSaDlO.exe
  C:\Windows\System\GLSaDlO.exe
  2⤵
  PID:5872
- C:\Windows\System\mXWuCLQ.exe
  C:\Windows\System\mXWuCLQ.exe
  2⤵
  PID:6420
- C:\Windows\System\NGvSivt.exe
  C:\Windows\System\NGvSivt.exe
  2⤵
  PID:6468
- C:\Windows\System\rQOMthx.exe
  C:\Windows\System\rQOMthx.exe
  2⤵
  PID:6504
- C:\Windows\System\TULTURJ.exe
  C:\Windows\System\TULTURJ.exe
  2⤵
  PID:6540
- C:\Windows\System\PhoxjeE.exe
  C:\Windows\System\PhoxjeE.exe
  2⤵
  PID:5404
- C:\Windows\System\hutejeR.exe
  C:\Windows\System\hutejeR.exe
  2⤵
  PID:5436
- C:\Windows\System\beZRGeF.exe
  C:\Windows\System\beZRGeF.exe
  2⤵
  PID:5648
- C:\Windows\System\aRSjard.exe
  C:\Windows\System\aRSjard.exe
  2⤵
  PID:7232
- C:\Windows\System\gXknNXo.exe
  C:\Windows\System\gXknNXo.exe
  2⤵
  PID:7252
- C:\Windows\System\IbvYMAU.exe
  C:\Windows\System\IbvYMAU.exe
  2⤵
  PID:7412
- C:\Windows\System\RujlbdW.exe
  C:\Windows\System\RujlbdW.exe
  2⤵
  PID:7428
- C:\Windows\System\DgXvyMK.exe
  C:\Windows\System\DgXvyMK.exe
  2⤵
  PID:7448
- C:\Windows\System\nQuETgs.exe
  C:\Windows\System\nQuETgs.exe
  2⤵
  PID:7472
- C:\Windows\System\EowsZIV.exe
  C:\Windows\System\EowsZIV.exe
  2⤵
  PID:7488
- C:\Windows\System\UkOQUFO.exe
  C:\Windows\System\UkOQUFO.exe
  2⤵
  PID:7512
- C:\Windows\System\KjwyyCX.exe
  C:\Windows\System\KjwyyCX.exe
  2⤵
  PID:7536
- C:\Windows\System\pExhYmX.exe
  C:\Windows\System\pExhYmX.exe
  2⤵
  PID:7560
- C:\Windows\System\vtsFyYb.exe
  C:\Windows\System\vtsFyYb.exe
  2⤵
  PID:7576
- C:\Windows\System\iedPUWB.exe
  C:\Windows\System\iedPUWB.exe
  2⤵
  PID:7600
- C:\Windows\System\cTOcSGO.exe
  C:\Windows\System\cTOcSGO.exe
  2⤵
  PID:7624
- C:\Windows\System\wUXPLtN.exe
  C:\Windows\System\wUXPLtN.exe
  2⤵
  PID:7640
- C:\Windows\System\ljukUOc.exe
  C:\Windows\System\ljukUOc.exe
  2⤵
  PID:7664
- C:\Windows\System\LCxcNiD.exe
  C:\Windows\System\LCxcNiD.exe
  2⤵
  PID:7688
- C:\Windows\System\mYVcDBx.exe
  C:\Windows\System\mYVcDBx.exe
  2⤵
  PID:7704
- C:\Windows\System\XmOikia.exe
  C:\Windows\System\XmOikia.exe
  2⤵
  PID:7796
- C:\Windows\System\moLSSdJ.exe
  C:\Windows\System\moLSSdJ.exe
  2⤵
  PID:7820
- C:\Windows\System\aCNaVHf.exe
  C:\Windows\System\aCNaVHf.exe
  2⤵
  PID:7848
- C:\Windows\System\QPTDOMy.exe
  C:\Windows\System\QPTDOMy.exe
  2⤵
  PID:7864
- C:\Windows\System\bjONAma.exe
  C:\Windows\System\bjONAma.exe
  2⤵
  PID:7904
- C:\Windows\System\WQCQrtP.exe
  C:\Windows\System\WQCQrtP.exe
  2⤵
  PID:7928
- C:\Windows\System\UztUZEw.exe
  C:\Windows\System\UztUZEw.exe
  2⤵
  PID:7952
- C:\Windows\System\XXFFHFW.exe
  C:\Windows\System\XXFFHFW.exe
  2⤵
  PID:7980
- C:\Windows\System\yvGwHwx.exe
  C:\Windows\System\yvGwHwx.exe
  2⤵
  PID:8000
- C:\Windows\System\datRoSn.exe
  C:\Windows\System\datRoSn.exe
  2⤵
  PID:8040
- C:\Windows\System\ArUvEsC.exe
  C:\Windows\System\ArUvEsC.exe
  2⤵
  PID:8056
- C:\Windows\System\gKoQtEm.exe
  C:\Windows\System\gKoQtEm.exe
  2⤵
  PID:8080
- C:\Windows\System\ZIBSNQw.exe
  C:\Windows\System\ZIBSNQw.exe
  2⤵
  PID:8096
- C:\Windows\System\AOioFdq.exe
  C:\Windows\System\AOioFdq.exe
  2⤵
  PID:8112
- C:\Windows\System\KogMZQE.exe
  C:\Windows\System\KogMZQE.exe
  2⤵
  PID:8128
- C:\Windows\System\kQHerYV.exe
  C:\Windows\System\kQHerYV.exe
  2⤵
  PID:8144
- C:\Windows\System\oVNxwFk.exe
  C:\Windows\System\oVNxwFk.exe
  2⤵
  PID:8164
- C:\Windows\System\NAPfskV.exe
  C:\Windows\System\NAPfskV.exe
  2⤵
  PID:60
- C:\Windows\System\SdjMDkh.exe
  C:\Windows\System\SdjMDkh.exe
  2⤵
  PID:6936
- C:\Windows\System\dVICiwP.exe
  C:\Windows\System\dVICiwP.exe
  2⤵
  PID:7000
- C:\Windows\System\QJEgApx.exe
  C:\Windows\System\QJEgApx.exe
  2⤵
  PID:7080
- C:\Windows\System\vQrTnSW.exe
  C:\Windows\System\vQrTnSW.exe
  2⤵
  PID:7136
- C:\Windows\System\DoeZRrK.exe
  C:\Windows\System\DoeZRrK.exe
  2⤵
  PID:5296
- C:\Windows\System\PKQlCfP.exe
  C:\Windows\System\PKQlCfP.exe
  2⤵
  PID:4436
- C:\Windows\System\GepfiHZ.exe
  C:\Windows\System\GepfiHZ.exe
  2⤵
  PID:4080
- C:\Windows\System\YUUgOEY.exe
  C:\Windows\System\YUUgOEY.exe
  2⤵
  PID:6484
- C:\Windows\System\idZnUau.exe
  C:\Windows\System\idZnUau.exe
  2⤵
  PID:5360
- C:\Windows\System\UmBIwTf.exe
  C:\Windows\System\UmBIwTf.exe
  2⤵
  PID:7260
- C:\Windows\System\nTXKiSt.exe
  C:\Windows\System\nTXKiSt.exe
  2⤵
  PID:6500
- C:\Windows\System\ehBmGhk.exe
  C:\Windows\System\ehBmGhk.exe
  2⤵
  PID:6972
- C:\Windows\System\orYUlnk.exe
  C:\Windows\System\orYUlnk.exe
  2⤵
  PID:5552
- C:\Windows\System\aDCrJUx.exe
  C:\Windows\System\aDCrJUx.exe
  2⤵
  PID:7520
- C:\Windows\System\VdoPgrU.exe
  C:\Windows\System\VdoPgrU.exe
  2⤵
  PID:7592
- C:\Windows\System\FeDffNu.exe
  C:\Windows\System\FeDffNu.exe
  2⤵
  PID:5128
- C:\Windows\System\CoQCvSG.exe
  C:\Windows\System\CoQCvSG.exe
  2⤵
  PID:3760
- C:\Windows\System\QyRYoMJ.exe
  C:\Windows\System\QyRYoMJ.exe
  2⤵
  PID:4640
- C:\Windows\System\RuKTlnD.exe
  C:\Windows\System\RuKTlnD.exe
  2⤵
  PID:7196
- C:\Windows\System\AyuUuvi.exe
  C:\Windows\System\AyuUuvi.exe
  2⤵
  PID:6872
- C:\Windows\System\ocvGbNd.exe
  C:\Windows\System\ocvGbNd.exe
  2⤵
  PID:6788
- C:\Windows\System\jQZsWvX.exe
  C:\Windows\System\jQZsWvX.exe
  2⤵
  PID:3576
- C:\Windows\System\HGtWUIc.exe
  C:\Windows\System\HGtWUIc.exe
  2⤵
  PID:7544
- C:\Windows\System\xxtgCgO.exe
  C:\Windows\System\xxtgCgO.exe
  2⤵
  PID:2980
- C:\Windows\System\IKPiEAP.exe
  C:\Windows\System\IKPiEAP.exe
  2⤵
  PID:7944
- C:\Windows\System\NmXSZTd.exe
  C:\Windows\System\NmXSZTd.exe
  2⤵
  PID:8220
- C:\Windows\System\wrqCjmP.exe
  C:\Windows\System\wrqCjmP.exe
  2⤵
  PID:8236
- C:\Windows\System\erxwSez.exe
  C:\Windows\System\erxwSez.exe
  2⤵
  PID:8252
- C:\Windows\System\rrAfAFG.exe
  C:\Windows\System\rrAfAFG.exe
  2⤵
  PID:8272
- C:\Windows\System\IphvBrM.exe
  C:\Windows\System\IphvBrM.exe
  2⤵
  PID:8296
- C:\Windows\System\PTvFcgN.exe
  C:\Windows\System\PTvFcgN.exe
  2⤵
  PID:8320
- C:\Windows\System\LoULjtY.exe
  C:\Windows\System\LoULjtY.exe
  2⤵
  PID:8344
- C:\Windows\System\HKStZwE.exe
  C:\Windows\System\HKStZwE.exe
  2⤵
  PID:8364
- C:\Windows\System\XmTDEQU.exe
  C:\Windows\System\XmTDEQU.exe
  2⤵
  PID:8388
- C:\Windows\System\OddQkWA.exe
  C:\Windows\System\OddQkWA.exe
  2⤵
  PID:8412
- C:\Windows\System\klCFkSx.exe
  C:\Windows\System\klCFkSx.exe
  2⤵
  PID:8428
- C:\Windows\System\YijSVUP.exe
  C:\Windows\System\YijSVUP.exe
  2⤵
  PID:8444
- C:\Windows\System\FBDiyho.exe
  C:\Windows\System\FBDiyho.exe
  2⤵
  PID:8464
- C:\Windows\System\mcWGYUr.exe
  C:\Windows\System\mcWGYUr.exe
  2⤵
  PID:8480
- C:\Windows\System\oQmuTep.exe
  C:\Windows\System\oQmuTep.exe
  2⤵
  PID:8500
- C:\Windows\System\fRYXAuY.exe
  C:\Windows\System\fRYXAuY.exe
  2⤵
  PID:8532
- C:\Windows\System\VUvgbzm.exe
  C:\Windows\System\VUvgbzm.exe
  2⤵
  PID:8548
- C:\Windows\System\epBFiNl.exe
  C:\Windows\System\epBFiNl.exe
  2⤵
  PID:8568
- C:\Windows\System\yKNoPAT.exe
  C:\Windows\System\yKNoPAT.exe
  2⤵
  PID:8776
- C:\Windows\System\qIpdRAJ.exe
  C:\Windows\System\qIpdRAJ.exe
  2⤵
  PID:8808
- C:\Windows\System\WpMGqOy.exe
  C:\Windows\System\WpMGqOy.exe
  2⤵
  PID:8828
- C:\Windows\System\RuGoEvl.exe
  C:\Windows\System\RuGoEvl.exe
  2⤵
  PID:8852
- C:\Windows\System\zqRHWso.exe
  C:\Windows\System\zqRHWso.exe
  2⤵
  PID:9000
- C:\Windows\System\EELauUu.exe
  C:\Windows\System\EELauUu.exe
  2⤵
  PID:9016
- C:\Windows\System\CzmfRLB.exe
  C:\Windows\System\CzmfRLB.exe
  2⤵
  PID:9032
- C:\Windows\System\VHLQnXz.exe
  C:\Windows\System\VHLQnXz.exe
  2⤵
  PID:9048
- C:\Windows\System\ErLaSJh.exe
  C:\Windows\System\ErLaSJh.exe
  2⤵
  PID:9064
- C:\Windows\System\gMRLovn.exe
  C:\Windows\System\gMRLovn.exe
  2⤵
  PID:9084
- C:\Windows\System\OTqqmQY.exe
  C:\Windows\System\OTqqmQY.exe
  2⤵
  PID:9100
- C:\Windows\System\gZjKnyQ.exe
  C:\Windows\System\gZjKnyQ.exe
  2⤵
  PID:9116
- C:\Windows\System\pzwgSKR.exe
  C:\Windows\System\pzwgSKR.exe
  2⤵
  PID:9168
- C:\Windows\System\jgriRAU.exe
  C:\Windows\System\jgriRAU.exe
  2⤵
  PID:9184
- C:\Windows\System\hJseOLc.exe
  C:\Windows\System\hJseOLc.exe
  2⤵
  PID:9204
- C:\Windows\System\VGnONBz.exe
  C:\Windows\System\VGnONBz.exe
  2⤵
  PID:7420
- C:\Windows\System\XRGqxPQ.exe
  C:\Windows\System\XRGqxPQ.exe
  2⤵
  PID:7468
- C:\Windows\System\jDMnUfA.exe
  C:\Windows\System\jDMnUfA.exe
  2⤵
  PID:7528
- C:\Windows\System\KfLHoAG.exe
  C:\Windows\System\KfLHoAG.exe
  2⤵
  PID:7584
- C:\Windows\System\WebaLIC.exe
  C:\Windows\System\WebaLIC.exe
  2⤵
  PID:7772
- C:\Windows\System\LBYJOnJ.exe
  C:\Windows\System\LBYJOnJ.exe
  2⤵
  PID:7788
- C:\Windows\System\QrWANyw.exe
  C:\Windows\System\QrWANyw.exe
  2⤵
  PID:7832
- C:\Windows\System\zSOMLAz.exe
  C:\Windows\System\zSOMLAz.exe
  2⤵
  PID:7900
- C:\Windows\System\wJhMvHs.exe
  C:\Windows\System\wJhMvHs.exe
  2⤵
  PID:7992
- C:\Windows\System\pUnHMUV.exe
  C:\Windows\System\pUnHMUV.exe
  2⤵
  PID:8048
- C:\Windows\System\hWeSyMk.exe
  C:\Windows\System\hWeSyMk.exe
  2⤵
  PID:8092
- C:\Windows\System\MIaNpwj.exe
  C:\Windows\System\MIaNpwj.exe
  2⤵
  PID:6448
- C:\Windows\System\xRsiIKt.exe
  C:\Windows\System\xRsiIKt.exe
  2⤵
  PID:6192
- C:\Windows\System\miAdAdV.exe
  C:\Windows\System\miAdAdV.exe
  2⤵
  PID:4784
- C:\Windows\System\lDeRfTE.exe
  C:\Windows\System\lDeRfTE.exe
  2⤵
  PID:2720
- C:\Windows\System\ERGkvXg.exe
  C:\Windows\System\ERGkvXg.exe
  2⤵
  PID:6912
- C:\Windows\System\zoEqZPV.exe
  C:\Windows\System\zoEqZPV.exe
  2⤵
  PID:7064
- C:\Windows\System\fCNnBCQ.exe
  C:\Windows\System\fCNnBCQ.exe
  2⤵
  PID:5304
- C:\Windows\System\xQRqLUb.exe
  C:\Windows\System\xQRqLUb.exe
  2⤵
  PID:6312
- C:\Windows\System\aKyeSoY.exe
  C:\Windows\System\aKyeSoY.exe
  2⤵
  PID:6692
- C:\Windows\System\TektFuJ.exe
  C:\Windows\System\TektFuJ.exe
  2⤵
  PID:2668
- C:\Windows\System\VxsffCt.exe
  C:\Windows\System\VxsffCt.exe
  2⤵
  PID:3580
- C:\Windows\System\kTytxOi.exe
  C:\Windows\System\kTytxOi.exe
  2⤵
  PID:6716
- C:\Windows\System\AKjBBTz.exe
  C:\Windows\System\AKjBBTz.exe
  2⤵
  PID:4532
- C:\Windows\System\nYcrNYW.exe
  C:\Windows\System\nYcrNYW.exe
  2⤵
  PID:8264
- C:\Windows\System\klhkcAw.exe
  C:\Windows\System\klhkcAw.exe
  2⤵
  PID:8332
- C:\Windows\System\uFqIqif.exe
  C:\Windows\System\uFqIqif.exe
  2⤵
  PID:8384
- C:\Windows\System\oxunnwp.exe
  C:\Windows\System\oxunnwp.exe
  2⤵
  PID:8228
- C:\Windows\System\fHpRWmO.exe
  C:\Windows\System\fHpRWmO.exe
  2⤵
  PID:8872
- C:\Windows\System\ZRuNxwa.exe
  C:\Windows\System\ZRuNxwa.exe
  2⤵
  PID:7104
- C:\Windows\System\MmsfjMo.exe
  C:\Windows\System\MmsfjMo.exe
  2⤵
  PID:8900
- C:\Windows\System\GuTUqpD.exe
  C:\Windows\System\GuTUqpD.exe
  2⤵
  PID:9028
- C:\Windows\System\LpjsDJC.exe
  C:\Windows\System\LpjsDJC.exe
  2⤵
  PID:9072
- C:\Windows\System\lfJRjai.exe
  C:\Windows\System\lfJRjai.exe
  2⤵
  PID:732
- C:\Windows\System\xYJiJXI.exe
  C:\Windows\System\xYJiJXI.exe
  2⤵
  PID:7988
- C:\Windows\System\fOqRTSU.exe
  C:\Windows\System\fOqRTSU.exe
  2⤵
  PID:9164
- C:\Windows\System\tyiWcub.exe
  C:\Windows\System\tyiWcub.exe
  2⤵
  PID:7404
- C:\Windows\System\QOzIZlg.exe
  C:\Windows\System\QOzIZlg.exe
  2⤵
  PID:9144
- C:\Windows\System\gpdRwwo.exe
  C:\Windows\System\gpdRwwo.exe
  2⤵
  PID:9224
- C:\Windows\System\SWqqPYX.exe
  C:\Windows\System\SWqqPYX.exe
  2⤵
  PID:9244
- C:\Windows\System\CHnhAvV.exe
  C:\Windows\System\CHnhAvV.exe
  2⤵
  PID:9260
- C:\Windows\System\QJLrwMf.exe
  C:\Windows\System\QJLrwMf.exe
  2⤵
  PID:9276
- C:\Windows\System\BJSuVCR.exe
  C:\Windows\System\BJSuVCR.exe
  2⤵
  PID:9296
- C:\Windows\System\lLJgowh.exe
  C:\Windows\System\lLJgowh.exe
  2⤵
  PID:9316
- C:\Windows\System\GqMPBry.exe
  C:\Windows\System\GqMPBry.exe
  2⤵
  PID:9340
- C:\Windows\System\SkSHKnQ.exe
  C:\Windows\System\SkSHKnQ.exe
  2⤵
  PID:9364
- C:\Windows\System\Pfgemua.exe
  C:\Windows\System\Pfgemua.exe
  2⤵
  PID:9384
- C:\Windows\System\QYIzWNM.exe
  C:\Windows\System\QYIzWNM.exe
  2⤵
  PID:9408
- C:\Windows\System\wSIERXd.exe
  C:\Windows\System\wSIERXd.exe
  2⤵
  PID:9436
- C:\Windows\System\CUctLaU.exe
  C:\Windows\System\CUctLaU.exe
  2⤵
  PID:9456
- C:\Windows\System\TzLQgBv.exe
  C:\Windows\System\TzLQgBv.exe
  2⤵
  PID:9488
- C:\Windows\System\aCFWIOg.exe
  C:\Windows\System\aCFWIOg.exe
  2⤵
  PID:9516
- C:\Windows\System\isRGFlX.exe
  C:\Windows\System\isRGFlX.exe
  2⤵
  PID:9544
- C:\Windows\System\KJkPxab.exe
  C:\Windows\System\KJkPxab.exe
  2⤵
  PID:9560
- C:\Windows\System\WohNlOw.exe
  C:\Windows\System\WohNlOw.exe
  2⤵
  PID:9580
- C:\Windows\System\DmKmoGL.exe
  C:\Windows\System\DmKmoGL.exe
  2⤵
  PID:9660
- C:\Windows\System\QTSpdSs.exe
  C:\Windows\System\QTSpdSs.exe
  2⤵
  PID:9680
- C:\Windows\System\OqNTWym.exe
  C:\Windows\System\OqNTWym.exe
  2⤵
  PID:9700
- C:\Windows\System\OGbPDxB.exe
  C:\Windows\System\OGbPDxB.exe
  2⤵
  PID:9724
- C:\Windows\System\aFeIPKS.exe
  C:\Windows\System\aFeIPKS.exe
  2⤵
  PID:9748
- C:\Windows\System\qadacEp.exe
  C:\Windows\System\qadacEp.exe
  2⤵
  PID:9776
- C:\Windows\System\iZmODqo.exe
  C:\Windows\System\iZmODqo.exe
  2⤵
  PID:9796
- C:\Windows\System\AwXdusw.exe
  C:\Windows\System\AwXdusw.exe
  2⤵
  PID:9816
- C:\Windows\System\mbgcIQD.exe
  C:\Windows\System\mbgcIQD.exe
  2⤵
  PID:9840
- C:\Windows\System\OYHIYdW.exe
  C:\Windows\System\OYHIYdW.exe
  2⤵
  PID:9860
- C:\Windows\System\TOzfnet.exe
  C:\Windows\System\TOzfnet.exe
  2⤵
  PID:9888
- C:\Windows\System\lCqnDYg.exe
  C:\Windows\System\lCqnDYg.exe
  2⤵
  PID:9908
- C:\Windows\System\qSaKMyY.exe
  C:\Windows\System\qSaKMyY.exe
  2⤵
  PID:9928
- C:\Windows\System\YfKXkoJ.exe
  C:\Windows\System\YfKXkoJ.exe
  2⤵
  PID:9948
- C:\Windows\System\GTCwwUN.exe
  C:\Windows\System\GTCwwUN.exe
  2⤵
  PID:9968
- C:\Windows\System\MfiwZoh.exe
  C:\Windows\System\MfiwZoh.exe
  2⤵
  PID:9996
- C:\Windows\System\YuIZhVm.exe
  C:\Windows\System\YuIZhVm.exe
  2⤵
  PID:10012
- C:\Windows\System\AJjixDf.exe
  C:\Windows\System\AJjixDf.exe
  2⤵
  PID:10032
- C:\Windows\System\brvyjay.exe
  C:\Windows\System\brvyjay.exe
  2⤵
  PID:10080
- C:\Windows\System\IpwdhvG.exe
  C:\Windows\System\IpwdhvG.exe
  2⤵
  PID:10100
- C:\Windows\System\vXjJnwc.exe
  C:\Windows\System\vXjJnwc.exe
  2⤵
  PID:10124
- C:\Windows\System\WakFndy.exe
  C:\Windows\System\WakFndy.exe
  2⤵
  PID:10148
- C:\Windows\System\hAxElxV.exe
  C:\Windows\System\hAxElxV.exe
  2⤵
  PID:10164
- C:\Windows\System\yksCjIF.exe
  C:\Windows\System\yksCjIF.exe
  2⤵
  PID:10192
- C:\Windows\System\bqvbqTC.exe
  C:\Windows\System\bqvbqTC.exe
  2⤵
  PID:10212
- C:\Windows\System\ZqWEaHe.exe
  C:\Windows\System\ZqWEaHe.exe
  2⤵
  PID:10232
- C:\Windows\System\LJIXeCG.exe
  C:\Windows\System\LJIXeCG.exe
  2⤵
  PID:8888
- C:\Windows\System\aaASHgz.exe
  C:\Windows\System\aaASHgz.exe
  2⤵
  PID:8408
- C:\Windows\System\zpcmuro.exe
  C:\Windows\System\zpcmuro.exe
  2⤵
  PID:3192
- C:\Windows\System\vmbTGaw.exe
  C:\Windows\System\vmbTGaw.exe
  2⤵
  PID:1444
- C:\Windows\System\KwKVttB.exe
  C:\Windows\System\KwKVttB.exe
  2⤵
  PID:7828
- C:\Windows\System\hxkQoGc.exe
  C:\Windows\System\hxkQoGc.exe
  2⤵
  PID:9180
- C:\Windows\System\nQBuTPY.exe
  C:\Windows\System\nQBuTPY.exe
  2⤵
  PID:7116
- C:\Windows\System\njQEVyo.exe
  C:\Windows\System\njQEVyo.exe
  2⤵
  PID:9272
- C:\Windows\System\vyVHnZQ.exe
  C:\Windows\System\vyVHnZQ.exe
  2⤵
  PID:9332
- C:\Windows\System\aYTHggu.exe
  C:\Windows\System\aYTHggu.exe
  2⤵
  PID:8292
- C:\Windows\System\HDVdIQz.exe
  C:\Windows\System\HDVdIQz.exe
  2⤵
  PID:9496
- C:\Windows\System\KzMfSMy.exe
  C:\Windows\System\KzMfSMy.exe
  2⤵
  PID:8472
- C:\Windows\System\HNdvQfr.exe
  C:\Windows\System\HNdvQfr.exe
  2⤵
  PID:8356
- C:\Windows\System\LiWkLUH.exe
  C:\Windows\System\LiWkLUH.exe
  2⤵
  PID:8360
- C:\Windows\System\mUTeBMI.exe
  C:\Windows\System\mUTeBMI.exe
  2⤵
  PID:6880
- C:\Windows\System\iwHpVqF.exe
  C:\Windows\System\iwHpVqF.exe
  2⤵
  PID:6960
- C:\Windows\System\IyCeNXE.exe
  C:\Windows\System\IyCeNXE.exe
  2⤵
  PID:8124
- C:\Windows\System\nFwPJLy.exe
  C:\Windows\System\nFwPJLy.exe
  2⤵
  PID:9696
- C:\Windows\System\jcaNBgr.exe
  C:\Windows\System\jcaNBgr.exe
  2⤵
  PID:9324
- C:\Windows\System\fQxLlQY.exe
  C:\Windows\System\fQxLlQY.exe
  2⤵
  PID:9872
- C:\Windows\System\RIMuXYw.exe
  C:\Windows\System\RIMuXYw.exe
  2⤵
  PID:9960
- C:\Windows\System\IWkpxhK.exe
  C:\Windows\System\IWkpxhK.exe
  2⤵
  PID:10040
- C:\Windows\System\BNSEkNk.exe
  C:\Windows\System\BNSEkNk.exe
  2⤵
  PID:7896
- C:\Windows\System\vaqzsLC.exe
  C:\Windows\System\vaqzsLC.exe
  2⤵
  PID:9012
- C:\Windows\System\ObZAlfT.exe
  C:\Windows\System\ObZAlfT.exe
  2⤵
  PID:9092
- C:\Windows\System\jsLDcna.exe
  C:\Windows\System\jsLDcna.exe
  2⤵
  PID:8064
- C:\Windows\System\qKEkyhx.exe
  C:\Windows\System\qKEkyhx.exe
  2⤵
  PID:9200
- C:\Windows\System\hSBjrny.exe
  C:\Windows\System\hSBjrny.exe
  2⤵
  PID:3768
- C:\Windows\System\VBcjIuW.exe
  C:\Windows\System\VBcjIuW.exe
  2⤵
  PID:9256
- C:\Windows\System\SbbZUMh.exe
  C:\Windows\System\SbbZUMh.exe
  2⤵
  PID:10264
- C:\Windows\System\DiZeuQk.exe
  C:\Windows\System\DiZeuQk.exe
  2⤵
  PID:10284
- C:\Windows\System\MECIecy.exe
  C:\Windows\System\MECIecy.exe
  2⤵
  PID:10304
- C:\Windows\System\mgMQANb.exe
  C:\Windows\System\mgMQANb.exe
  2⤵
  PID:10328
- C:\Windows\System\FXoBWAt.exe
  C:\Windows\System\FXoBWAt.exe
  2⤵
  PID:10360
- C:\Windows\System\gEJPSgx.exe
  C:\Windows\System\gEJPSgx.exe
  2⤵
  PID:10380
- C:\Windows\System\OyVIcXb.exe
  C:\Windows\System\OyVIcXb.exe
  2⤵
  PID:10404
- C:\Windows\System\llqjXqi.exe
  C:\Windows\System\llqjXqi.exe
  2⤵
  PID:10428
- C:\Windows\System\Provktf.exe
  C:\Windows\System\Provktf.exe
  2⤵
  PID:10448
- C:\Windows\System\HImQhzz.exe
  C:\Windows\System\HImQhzz.exe
  2⤵
  PID:10468
- C:\Windows\System\MEXvaMQ.exe
  C:\Windows\System\MEXvaMQ.exe
  2⤵
  PID:10492
- C:\Windows\System\CHLUcUR.exe
  C:\Windows\System\CHLUcUR.exe
  2⤵
  PID:10516
- C:\Windows\System\EJyxJBU.exe
  C:\Windows\System\EJyxJBU.exe
  2⤵
  PID:10536
- C:\Windows\System\UnRwUHo.exe
  C:\Windows\System\UnRwUHo.exe
  2⤵
  PID:10564
- C:\Windows\System\vVLfOLQ.exe
  C:\Windows\System\vVLfOLQ.exe
  2⤵
  PID:10580
- C:\Windows\System\FkqAoAO.exe
  C:\Windows\System\FkqAoAO.exe
  2⤵
  PID:10600
- C:\Windows\System\ZXaYdES.exe
  C:\Windows\System\ZXaYdES.exe
  2⤵
  PID:10624
- C:\Windows\System\BTUGPJx.exe
  C:\Windows\System\BTUGPJx.exe
  2⤵
  PID:10652
- C:\Windows\System\wnFTmkN.exe
  C:\Windows\System\wnFTmkN.exe
  2⤵
  PID:10668
- C:\Windows\System\tWHcxJc.exe
  C:\Windows\System\tWHcxJc.exe
  2⤵
  PID:10692
- C:\Windows\System\ICudNAg.exe
  C:\Windows\System\ICudNAg.exe
  2⤵
  PID:10712
- C:\Windows\System\rCXWzrJ.exe
  C:\Windows\System\rCXWzrJ.exe
  2⤵
  PID:10732
- C:\Windows\System\lBdIZBD.exe
  C:\Windows\System\lBdIZBD.exe
  2⤵
  PID:10752
- C:\Windows\System\uSmuVMq.exe
  C:\Windows\System\uSmuVMq.exe
  2⤵
  PID:10768
- C:\Windows\System\MGhUGzI.exe
  C:\Windows\System\MGhUGzI.exe
  2⤵
  PID:10784
- C:\Windows\System\soSFwqO.exe
  C:\Windows\System\soSFwqO.exe
  2⤵
  PID:10800
- C:\Windows\System\aaMBpKm.exe
  C:\Windows\System\aaMBpKm.exe
  2⤵
  PID:10820
- C:\Windows\System\XAjlztW.exe
  C:\Windows\System\XAjlztW.exe
  2⤵
  PID:10840
- C:\Windows\System\pxgdoxv.exe
  C:\Windows\System\pxgdoxv.exe
  2⤵
  PID:10868
- C:\Windows\System\viJYdTx.exe
  C:\Windows\System\viJYdTx.exe
  2⤵
  PID:10884
- C:\Windows\System\XCUHcZW.exe
  C:\Windows\System\XCUHcZW.exe
  2⤵
  PID:10908
- C:\Windows\System\gzsAlou.exe
  C:\Windows\System\gzsAlou.exe
  2⤵
  PID:10928
- C:\Windows\System\bPifVqv.exe
  C:\Windows\System\bPifVqv.exe
  2⤵
  PID:11108
- C:\Windows\System\tuYNOEk.exe
  C:\Windows\System\tuYNOEk.exe
  2⤵
  PID:11140
- C:\Windows\System\DojocFG.exe
  C:\Windows\System\DojocFG.exe
  2⤵
  PID:11164
- C:\Windows\System\GSMiXAn.exe
  C:\Windows\System\GSMiXAn.exe
  2⤵
  PID:11184
- C:\Windows\System\QIKXjjD.exe
  C:\Windows\System\QIKXjjD.exe
  2⤵
  PID:11208
- C:\Windows\System\RlEMlFz.exe
  C:\Windows\System\RlEMlFz.exe
  2⤵
  PID:11232
- C:\Windows\System\zkbRRTB.exe
  C:\Windows\System\zkbRRTB.exe
  2⤵
  PID:11252
- C:\Windows\System\YAXxDDA.exe
  C:\Windows\System\YAXxDDA.exe
  2⤵
  PID:10108
- C:\Windows\System\KJTCMLV.exe
  C:\Windows\System\KJTCMLV.exe
  2⤵
  PID:10156
- C:\Windows\System\FZLyCgb.exe
  C:\Windows\System\FZLyCgb.exe
  2⤵
  PID:9764
- C:\Windows\System\AuSHUIL.exe
  C:\Windows\System\AuSHUIL.exe
  2⤵
  PID:9396
- C:\Windows\System\djxeLzu.exe
  C:\Windows\System\djxeLzu.exe
  2⤵
  PID:4568
- C:\Windows\System\vmisBCR.exe
  C:\Windows\System\vmisBCR.exe
  2⤵
  PID:9504
- C:\Windows\System\jJaXgOU.exe
  C:\Windows\System\jJaXgOU.exe
  2⤵
  PID:9528
- C:\Windows\System\IGspzjs.exe
  C:\Windows\System\IGspzjs.exe
  2⤵
  PID:9432
- C:\Windows\System\TiiWGEz.exe
  C:\Windows\System\TiiWGEz.exe
  2⤵
  PID:8260
- C:\Windows\System\WsctlhU.exe
  C:\Windows\System\WsctlhU.exe
  2⤵
  PID:10720
- C:\Windows\System\RWbIAvq.exe
  C:\Windows\System\RWbIAvq.exe
  2⤵
  PID:10792
- C:\Windows\System\vbwabPw.exe
  C:\Windows\System\vbwabPw.exe
  2⤵
  PID:9400
- C:\Windows\System\pnDbUYs.exe
  C:\Windows\System\pnDbUYs.exe
  2⤵
  PID:9464
- C:\Windows\System\DvoiReg.exe
  C:\Windows\System\DvoiReg.exe
  2⤵
  PID:9944
- C:\Windows\System\ZuYmeIf.exe
  C:\Windows\System\ZuYmeIf.exe
  2⤵
  PID:4260
- C:\Windows\System\nUUPTrC.exe
  C:\Windows\System\nUUPTrC.exe
  2⤵
  PID:4728
- C:\Windows\System\sjAmblJ.exe
  C:\Windows\System\sjAmblJ.exe
  2⤵
  PID:9992
- C:\Windows\System\DikgKey.exe
  C:\Windows\System\DikgKey.exe
  2⤵
  PID:10052
- C:\Windows\System\mSCjRbs.exe
  C:\Windows\System\mSCjRbs.exe
  2⤵
  PID:10132
- C:\Windows\System\ZJcgKlP.exe
  C:\Windows\System\ZJcgKlP.exe
  2⤵
  PID:10180
- C:\Windows\System\QgXJoKK.exe
  C:\Windows\System\QgXJoKK.exe
  2⤵
  PID:2888
- C:\Windows\System\OsvbSOY.exe
  C:\Windows\System\OsvbSOY.exe
  2⤵
  PID:8592
- C:\Windows\System\BSOxflG.exe
  C:\Windows\System\BSOxflG.exe
  2⤵
  PID:7632
- C:\Windows\System\rlPwunp.exe
  C:\Windows\System\rlPwunp.exe
  2⤵
  PID:11160
- C:\Windows\System\irlcmQt.exe
  C:\Windows\System\irlcmQt.exe
  2⤵
  PID:10684
- C:\Windows\System\dtfoQmr.exe
  C:\Windows\System\dtfoQmr.exe
  2⤵
  PID:11240
- C:\Windows\System\RzntbEO.exe
  C:\Windows\System\RzntbEO.exe
  2⤵
  PID:10760
- C:\Windows\System\xDxPDgO.exe
  C:\Windows\System\xDxPDgO.exe
  2⤵
  PID:11272
- C:\Windows\System\wfUobBh.exe
  C:\Windows\System\wfUobBh.exe
  2⤵
  PID:11288
- C:\Windows\System\YPWjvOX.exe
  C:\Windows\System\YPWjvOX.exe
  2⤵
  PID:11308
- C:\Windows\System\mCCJGRv.exe
  C:\Windows\System\mCCJGRv.exe
  2⤵
  PID:11324
- C:\Windows\System\BFtNzqe.exe
  C:\Windows\System\BFtNzqe.exe
  2⤵
  PID:11340
- C:\Windows\System\CZymgpq.exe
  C:\Windows\System\CZymgpq.exe
  2⤵
  PID:11364
- C:\Windows\System\DVaZtIN.exe
  C:\Windows\System\DVaZtIN.exe
  2⤵
  PID:11388
- C:\Windows\System\HgebTbd.exe
  C:\Windows\System\HgebTbd.exe
  2⤵
  PID:11408
- C:\Windows\System\GRWCWdS.exe
  C:\Windows\System\GRWCWdS.exe
  2⤵
  PID:11428
- C:\Windows\System\KSNcPHG.exe
  C:\Windows\System\KSNcPHG.exe
  2⤵
  PID:11452
- C:\Windows\System\bYIAikv.exe
  C:\Windows\System\bYIAikv.exe
  2⤵
  PID:11472
- C:\Windows\System\iidqfTl.exe
  C:\Windows\System\iidqfTl.exe
  2⤵
  PID:11496
- C:\Windows\System\rHYTCuN.exe
  C:\Windows\System\rHYTCuN.exe
  2⤵
  PID:11520
- C:\Windows\System\gMsNfcp.exe
  C:\Windows\System\gMsNfcp.exe
  2⤵
  PID:11540
- C:\Windows\System\VAWneJG.exe
  C:\Windows\System\VAWneJG.exe
  2⤵
  PID:11560
- C:\Windows\System\kKsTgWU.exe
  C:\Windows\System\kKsTgWU.exe
  2⤵
  PID:11584
- C:\Windows\System\XDOgkeJ.exe
  C:\Windows\System\XDOgkeJ.exe
  2⤵
  PID:11608
- C:\Windows\System\adQElhZ.exe
  C:\Windows\System\adQElhZ.exe
  2⤵
  PID:11632
- C:\Windows\System\cSkNGWg.exe
  C:\Windows\System\cSkNGWg.exe
  2⤵
  PID:11656
- C:\Windows\System\VrWgBXz.exe
  C:\Windows\System\VrWgBXz.exe
  2⤵
  PID:11688
- C:\Windows\System\dzkMoyj.exe
  C:\Windows\System\dzkMoyj.exe
  2⤵
  PID:11716
- C:\Windows\System\jNNUxXS.exe
  C:\Windows\System\jNNUxXS.exe
  2⤵
  PID:11740
- C:\Windows\System\SjwLcyp.exe
  C:\Windows\System\SjwLcyp.exe
  2⤵
  PID:11764
- C:\Windows\System\zlgxkcF.exe
  C:\Windows\System\zlgxkcF.exe
  2⤵
  PID:11796
- C:\Windows\System\AMybFsp.exe
  C:\Windows\System\AMybFsp.exe
  2⤵
  PID:11816
- C:\Windows\System\ypLPYZH.exe
  C:\Windows\System\ypLPYZH.exe
  2⤵
  PID:11836
- C:\Windows\System\vdjfRet.exe
  C:\Windows\System\vdjfRet.exe
  2⤵
  PID:11860
- C:\Windows\System\MqeItAe.exe
  C:\Windows\System\MqeItAe.exe
  2⤵
  PID:11884
- C:\Windows\System\ahoNNSY.exe
  C:\Windows\System\ahoNNSY.exe
  2⤵
  PID:11900
- C:\Windows\System\RzaqExT.exe
  C:\Windows\System\RzaqExT.exe
  2⤵
  PID:11924
- C:\Windows\System\ftnbPwM.exe
  C:\Windows\System\ftnbPwM.exe
  2⤵
  PID:11948
- C:\Windows\System\fIVMguT.exe
  C:\Windows\System\fIVMguT.exe
  2⤵
  PID:11968
- C:\Windows\System\brGVUaq.exe
  C:\Windows\System\brGVUaq.exe
  2⤵
  PID:11988
- C:\Windows\System\ATApSGF.exe
  C:\Windows\System\ATApSGF.exe
  2⤵
  PID:12012
- C:\Windows\System\YuBiawD.exe
  C:\Windows\System\YuBiawD.exe
  2⤵
  PID:12036
- C:\Windows\System\YiKDHpf.exe
  C:\Windows\System\YiKDHpf.exe
  2⤵
  PID:12056
- C:\Windows\System\ChUuZZh.exe
  C:\Windows\System\ChUuZZh.exe
  2⤵
  PID:12076
- C:\Windows\System\jImCrjs.exe
  C:\Windows\System\jImCrjs.exe
  2⤵
  PID:12096
- C:\Windows\System\ZQJMSFE.exe
  C:\Windows\System\ZQJMSFE.exe
  2⤵
  PID:12116
- C:\Windows\System\WgJSnNJ.exe
  C:\Windows\System\WgJSnNJ.exe
  2⤵
  PID:12144
- C:\Windows\System\qBTwZor.exe
  C:\Windows\System\qBTwZor.exe
  2⤵
  PID:12168
- C:\Windows\System\eZZsQCi.exe
  C:\Windows\System\eZZsQCi.exe
  2⤵
  PID:12192
- C:\Windows\System\NODWCGH.exe
  C:\Windows\System\NODWCGH.exe
  2⤵
  PID:12216
- C:\Windows\System\cMhoALi.exe
  C:\Windows\System\cMhoALi.exe
  2⤵
  PID:12248
- C:\Windows\System\eXMjIrw.exe
  C:\Windows\System\eXMjIrw.exe
  2⤵
  PID:12272
- C:\Windows\System\TAhYzwE.exe
  C:\Windows\System\TAhYzwE.exe
  2⤵
  PID:9308
- C:\Windows\System\gklVYWM.exe
  C:\Windows\System\gklVYWM.exe
  2⤵
  PID:9556
- C:\Windows\System\fSQlBHH.exe
  C:\Windows\System\fSQlBHH.exe
  2⤵
  PID:1712
- C:\Windows\System\ZHrmsFP.exe
  C:\Windows\System\ZHrmsFP.exe
  2⤵
  PID:9836
- C:\Windows\System\GrTTMyS.exe
  C:\Windows\System\GrTTMyS.exe
  2⤵
  PID:7812
- C:\Windows\System\suQKosi.exe
  C:\Windows\System\suQKosi.exe
  2⤵
  PID:9060
- C:\Windows\System\nRwFevP.exe
  C:\Windows\System\nRwFevP.exe
  2⤵
  PID:8576
- C:\Windows\System\XDbDbHH.exe
  C:\Windows\System\XDbDbHH.exe
  2⤵
  PID:9252
- C:\Windows\System\zfxMSBF.exe
  C:\Windows\System\zfxMSBF.exe
  2⤵
  PID:10292
- C:\Windows\System\hVbTNUs.exe
  C:\Windows\System\hVbTNUs.exe
  2⤵
  PID:10344
- C:\Windows\System\bzbhMZy.exe
  C:\Windows\System\bzbhMZy.exe
  2⤵
  PID:10376
- C:\Windows\System\odcCIKk.exe
  C:\Windows\System\odcCIKk.exe
  2⤵
  PID:10436
- C:\Windows\System\ZXFNfmX.exe
  C:\Windows\System\ZXFNfmX.exe
  2⤵
  PID:10476
- C:\Windows\System\DRMvvsq.exe
  C:\Windows\System\DRMvvsq.exe
  2⤵
  PID:10548
- C:\Windows\System\cmaUzwr.exe
  C:\Windows\System\cmaUzwr.exe
  2⤵
  PID:10592
- C:\Windows\System\UHNzCQW.exe
  C:\Windows\System\UHNzCQW.exe
  2⤵
  PID:10620
- C:\Windows\System\LsjOmcs.exe
  C:\Windows\System\LsjOmcs.exe
  2⤵
  PID:10660
- C:\Windows\System\WqPuhkT.exe
  C:\Windows\System\WqPuhkT.exe
  2⤵
  PID:11100
- C:\Windows\System\abIzFwi.exe
  C:\Windows\System\abIzFwi.exe
  2⤵
  PID:10808
- C:\Windows\System\HKDGqjK.exe
  C:\Windows\System\HKDGqjK.exe
  2⤵
  PID:9940
- C:\Windows\System\ORsbWBJ.exe
  C:\Windows\System\ORsbWBJ.exe
  2⤵
  PID:11136
- C:\Windows\System\IsTKHyB.exe
  C:\Windows\System\IsTKHyB.exe
  2⤵
  PID:10184
- C:\Windows\System\WRhSKlZ.exe
  C:\Windows\System\WRhSKlZ.exe
  2⤵
  PID:7176
- C:\Windows\System\QkCyMqG.exe
  C:\Windows\System\QkCyMqG.exe
  2⤵
  PID:10740
- C:\Windows\System\wWIqsLl.exe
  C:\Windows\System\wWIqsLl.exe
  2⤵
  PID:12292
- C:\Windows\System\OJkzTwV.exe
  C:\Windows\System\OJkzTwV.exe
  2⤵
  PID:12308
- C:\Windows\System\lfbsmht.exe
  C:\Windows\System\lfbsmht.exe
  2⤵
  PID:12328
- C:\Windows\System\wXLwxBj.exe
  C:\Windows\System\wXLwxBj.exe
  2⤵
  PID:12348
- C:\Windows\System\RAPpXGN.exe
  C:\Windows\System\RAPpXGN.exe
  2⤵
  PID:12364
- C:\Windows\System\sUVhOZO.exe
  C:\Windows\System\sUVhOZO.exe
  2⤵
  PID:12384
- C:\Windows\System\SxzVOFT.exe
  C:\Windows\System\SxzVOFT.exe
  2⤵
  PID:12404
- C:\Windows\System\ioyXWyV.exe
  C:\Windows\System\ioyXWyV.exe
  2⤵
  PID:12420
- C:\Windows\System\JMMbpvw.exe
  C:\Windows\System\JMMbpvw.exe
  2⤵
  PID:12444
- C:\Windows\System\BkyxfDk.exe
  C:\Windows\System\BkyxfDk.exe
  2⤵
  PID:12468
- C:\Windows\System\hrFUxFi.exe
  C:\Windows\System\hrFUxFi.exe
  2⤵
  PID:12492
- C:\Windows\System\kHMSkeU.exe
  C:\Windows\System\kHMSkeU.exe
  2⤵
  PID:12516
- C:\Windows\System\ymNEJZY.exe
  C:\Windows\System\ymNEJZY.exe
  2⤵
  PID:12536
- C:\Windows\System\SrUOaIw.exe
  C:\Windows\System\SrUOaIw.exe
  2⤵
  PID:12556
- C:\Windows\System\osqIPNN.exe
  C:\Windows\System\osqIPNN.exe
  2⤵
  PID:12584
- C:\Windows\System\kbnckgo.exe
  C:\Windows\System\kbnckgo.exe
  2⤵
  PID:12608
- C:\Windows\System\NhOVsUf.exe
  C:\Windows\System\NhOVsUf.exe
  2⤵
  PID:12628
- C:\Windows\System\QLIZDmk.exe
  C:\Windows\System\QLIZDmk.exe
  2⤵
  PID:12648
- C:\Windows\System\iQqVlPu.exe
  C:\Windows\System\iQqVlPu.exe
  2⤵
  PID:12668
- C:\Windows\System\QOnJVcI.exe
  C:\Windows\System\QOnJVcI.exe
  2⤵
  PID:12696
- C:\Windows\System\RXvamFH.exe
  C:\Windows\System\RXvamFH.exe
  2⤵
  PID:12716
- C:\Windows\System\uWsjKdv.exe
  C:\Windows\System\uWsjKdv.exe
  2⤵
  PID:12748
- C:\Windows\System\GvdlhoP.exe
  C:\Windows\System\GvdlhoP.exe
  2⤵
  PID:12836
- C:\Windows\System\BigzcPU.exe
  C:\Windows\System\BigzcPU.exe
  2⤵
  PID:12852
- C:\Windows\System\dNxQwoH.exe
  C:\Windows\System\dNxQwoH.exe
  2⤵
  PID:12300
- C:\Windows\System\ONJbZWi.exe
  C:\Windows\System\ONJbZWi.exe
  2⤵
  PID:10700
- C:\Windows\System\bsYMaty.exe
  C:\Windows\System\bsYMaty.exe
  2⤵
  PID:10780
- C:\Windows\System\nMuigQq.exe
  C:\Windows\System\nMuigQq.exe
  2⤵
  PID:11304
- C:\Windows\System\EihqNwH.exe
  C:\Windows\System\EihqNwH.exe
  2⤵
  PID:12400
- C:\Windows\System\tKZqGGv.exe
  C:\Windows\System\tKZqGGv.exe
  2⤵
  PID:9376
- C:\Windows\System\BNbdUuB.exe
  C:\Windows\System\BNbdUuB.exe
  2⤵
  PID:11360
- C:\Windows\System\uxGmIph.exe
  C:\Windows\System\uxGmIph.exe
  2⤵
  PID:12460
- C:\Windows\System\CIVidCi.exe
  C:\Windows\System\CIVidCi.exe
  2⤵
  PID:12500
- C:\Windows\System\HqigtXQ.exe
  C:\Windows\System\HqigtXQ.exe
  2⤵
  PID:12244
- C:\Windows\System\gSLwMcY.exe
  C:\Windows\System\gSLwMcY.exe
  2⤵
  PID:13116
- C:\Windows\System\YYXwJKR.exe
  C:\Windows\System\YYXwJKR.exe
  2⤵
  PID:11628
- C:\Windows\System\iAQrmDT.exe
  C:\Windows\System\iAQrmDT.exe
  2⤵
  PID:11680
- C:\Windows\System\aslHAeR.exe
  C:\Windows\System\aslHAeR.exe
  2⤵
  PID:12916
- C:\Windows\System\FgKQlgw.exe
  C:\Windows\System\FgKQlgw.exe
  2⤵
  PID:13144
- C:\Windows\System\RCgsxul.exe
  C:\Windows\System\RCgsxul.exe
  2⤵
  PID:4672
- C:\Windows\System\GCiUuMn.exe
  C:\Windows\System\GCiUuMn.exe
  2⤵
  PID:2028
- C:\Windows\System\wwOpifW.exe
  C:\Windows\System\wwOpifW.exe
  2⤵
  PID:11536
- C:\Windows\System\fAAPmhg.exe
  C:\Windows\System\fAAPmhg.exe
  2⤵
  PID:12688
- C:\Windows\System\vJbKCWv.exe
  C:\Windows\System\vJbKCWv.exe
  2⤵
  PID:12184
- C:\Windows\System\rwSxNjd.exe
  C:\Windows\System\rwSxNjd.exe
  2⤵
  PID:9692
- C:\Windows\System\ECcmymd.exe
  C:\Windows\System\ECcmymd.exe
  2⤵
  PID:9716
- C:\Windows\System\zLGAcTk.exe
  C:\Windows\System\zLGAcTk.exe
  2⤵
  PID:11528
- C:\Windows\System\QLeeiTc.exe
  C:\Windows\System\QLeeiTc.exe
  2⤵
  PID:2000
- C:\Windows\System\CkYCMiG.exe
  C:\Windows\System\CkYCMiG.exe
  2⤵
  PID:11808
- C:\Windows\System\jUoJPCO.exe
  C:\Windows\System\jUoJPCO.exe
  2⤵
  PID:12336
- C:\Windows\System\aTLjLat.exe
  C:\Windows\System\aTLjLat.exe
  2⤵
  PID:7872
- C:\Windows\System\kUexgjs.exe
  C:\Windows\System\kUexgjs.exe
  2⤵
  PID:12436
- C:\Windows\System\ndbvnnR.exe
  C:\Windows\System\ndbvnnR.exe
  2⤵
  PID:11400
- C:\Windows\System\LDOpUjH.exe
  C:\Windows\System\LDOpUjH.exe
  2⤵
  PID:10676
- C:\Windows\System\VOPxpRl.exe
  C:\Windows\System\VOPxpRl.exe
  2⤵
  PID:10028
- C:\Windows\System\lMeIQid.exe
  C:\Windows\System\lMeIQid.exe
  2⤵
  PID:11964
- C:\Windows\System\PdjwSRV.exe
  C:\Windows\System\PdjwSRV.exe
  2⤵
  PID:11828
- C:\Windows\System\MbEGkZs.exe
  C:\Windows\System\MbEGkZs.exe
  2⤵
  PID:13196
- C:\Windows\System\KnqqCaZ.exe
  C:\Windows\System\KnqqCaZ.exe
  2⤵
  PID:13052
- C:\Windows\System\KCXERhF.exe
  C:\Windows\System\KCXERhF.exe
  2⤵
  PID:12988
- C:\Windows\System\rFRQWYn.exe
  C:\Windows\System\rFRQWYn.exe
  2⤵
  PID:12960
- C:\Windows\System\oSJidIs.exe
  C:\Windows\System\oSJidIs.exe
  2⤵
  PID:11260
- C:\Windows\System\ZFESRCR.exe
  C:\Windows\System\ZFESRCR.exe
  2⤵
  PID:11504
- C:\Windows\System\CSvEAfl.exe
  C:\Windows\System\CSvEAfl.exe
  2⤵
  PID:12508
- C:\Windows\System\kIDbozy.exe
  C:\Windows\System\kIDbozy.exe
  2⤵
  PID:11228
- C:\Windows\System\fMgkjuz.exe
  C:\Windows\System\fMgkjuz.exe
  2⤵
  PID:13080
- C:\Windows\System\eEGntdx.exe
  C:\Windows\System\eEGntdx.exe
  2⤵
  PID:7760
- C:\Windows\System\jCgPHly.exe
  C:\Windows\System\jCgPHly.exe
  2⤵
  PID:11128
- C:\Windows\System\XIhBxQY.exe
  C:\Windows\System\XIhBxQY.exe
  2⤵
  PID:11956
- C:\Windows\System\iSWDOzb.exe
  C:\Windows\System\iSWDOzb.exe
  2⤵
  PID:4216
- C:\Windows\System\jNcZaPC.exe
  C:\Windows\System\jNcZaPC.exe
  2⤵
  PID:13000
- C:\Windows\System\tpyQQuG.exe
  C:\Windows\System\tpyQQuG.exe
  2⤵
  PID:12524
- C:\Windows\System\HFDarzl.exe
  C:\Windows\System\HFDarzl.exe
  2⤵
  PID:11896
- C:\Windows\System\DieXLtC.exe
  C:\Windows\System\DieXLtC.exe
  2⤵
  PID:13288
- C:\Windows\System\dXkXids.exe
  C:\Windows\System\dXkXids.exe
  2⤵
  PID:12940
- C:\Windows\System\VDrUYRJ.exe
  C:\Windows\System\VDrUYRJ.exe
  2⤵
  PID:11336
- C:\Windows\System\KCAztOk.exe
  C:\Windows\System\KCAztOk.exe
  2⤵
  PID:13108
- C:\Windows\System\LlskImE.exe
  C:\Windows\System\LlskImE.exe
  2⤵
  PID:12268
- C:\Windows\System\pbGtTOr.exe
  C:\Windows\System\pbGtTOr.exe
  2⤵
  PID:12912
- C:\Windows\System\syDvoEI.exe
  C:\Windows\System\syDvoEI.exe
  2⤵
  PID:11480
- C:\Windows\System\mNgiUPP.exe
  C:\Windows\System\mNgiUPP.exe
  2⤵
  PID:1984
- C:\Windows\System\qrdErkc.exe
  C:\Windows\System\qrdErkc.exe
  2⤵
  PID:11960
- C:\Windows\System\AnWJvnq.exe
  C:\Windows\System\AnWJvnq.exe
  2⤵
  PID:8880
- C:\Windows\System\WJlyyDh.exe
  C:\Windows\System\WJlyyDh.exe
  2⤵
  PID:11908
- C:\Windows\System\eTxToNZ.exe
  C:\Windows\System\eTxToNZ.exe
  2⤵
  PID:7740
- C:\Windows\System\xAIjcRQ.exe
  C:\Windows\System\xAIjcRQ.exe
  2⤵
  PID:13272
- C:\Windows\System\KTBxWQv.exe
  C:\Windows\System\KTBxWQv.exe
  2⤵
  PID:2716
- C:\Windows\System\PAIIFyR.exe
  C:\Windows\System\PAIIFyR.exe
  2⤵
  PID:3556
- C:\Windows\System\KkcXSQI.exe
  C:\Windows\System\KkcXSQI.exe
  2⤵
  PID:6400
- C:\Windows\System\pPNoURa.exe
  C:\Windows\System\pPNoURa.exe
  2⤵
  PID:11200
- C:\Windows\System\jYeNBJJ.exe
  C:\Windows\System\jYeNBJJ.exe
  2⤵
  PID:3524
- C:\Windows\System\yeATvHn.exe
  C:\Windows\System\yeATvHn.exe
  2⤵
  PID:7400
- C:\Windows\System\QpBTZSf.exe
  C:\Windows\System\QpBTZSf.exe
  2⤵
  PID:432
- C:\Windows\System\rUOtzUk.exe
  C:\Windows\System\rUOtzUk.exe
  2⤵
  PID:3460
- C:\Windows\System\SeDmLAi.exe
  C:\Windows\System\SeDmLAi.exe
  2⤵
  PID:1852
- C:\Windows\System\dAbTAlA.exe
  C:\Windows\System\dAbTAlA.exe
  2⤵
  PID:13004
- C:\Windows\System\kVpTGsC.exe
  C:\Windows\System\kVpTGsC.exe
  2⤵
  PID:7160
- C:\Windows\System\saNWDQA.exe
  C:\Windows\System\saNWDQA.exe
  2⤵
  PID:6056
- C:\Windows\System\NogoPyj.exe
  C:\Windows\System\NogoPyj.exe
  2⤵
  PID:952
- C:\Windows\System\gfECUIn.exe
  C:\Windows\System\gfECUIn.exe
  2⤵
  PID:1232
- C:\Windows\System\DsgksTM.exe
  C:\Windows\System\DsgksTM.exe
  2⤵
  PID:1820
- C:\Windows\System\tkiNlLo.exe
  C:\Windows\System\tkiNlLo.exe
  2⤵
  PID:2516
- C:\Windows\System\MImBYIY.exe
  C:\Windows\System\MImBYIY.exe
  2⤵
  PID:13316
- C:\Windows\System\DrNhpYs.exe
  C:\Windows\System\DrNhpYs.exe
  2⤵
  PID:13332
- C:\Windows\System\EqeoQhS.exe
  C:\Windows\System\EqeoQhS.exe
  2⤵
  PID:13764
- C:\Windows\System\DTlTrKX.exe
  C:\Windows\System\DTlTrKX.exe
  2⤵
  PID:13780
- C:\Windows\System\VsgsSSu.exe
  C:\Windows\System\VsgsSSu.exe
  2⤵
  PID:13820
- C:\Windows\System\mdBoYIz.exe
  C:\Windows\System\mdBoYIz.exe
  2⤵
  PID:13852
- C:\Windows\System\JCLQnsD.exe
  C:\Windows\System\JCLQnsD.exe
  2⤵
  PID:13868
- C:\Windows\System\JVVgjgA.exe
  C:\Windows\System\JVVgjgA.exe
  2⤵
  PID:13892
- C:\Windows\System\viUTmkB.exe
  C:\Windows\System\viUTmkB.exe
  2⤵
  PID:13912
- C:\Windows\System\iXXygZg.exe
  C:\Windows\System\iXXygZg.exe
  2⤵
  PID:13932
- C:\Windows\System\EDNzLPV.exe
  C:\Windows\System\EDNzLPV.exe
  2⤵
  PID:13956
- C:\Windows\System\rDGNhjK.exe
  C:\Windows\System\rDGNhjK.exe
  2⤵
  PID:13984
- C:\Windows\System\VLefYQw.exe
  C:\Windows\System\VLefYQw.exe
  2⤵
  PID:14236
- C:\Windows\System\bDRmGSg.exe
  C:\Windows\System\bDRmGSg.exe
  2⤵
  PID:14256
- C:\Windows\System\idyLtSU.exe
  C:\Windows\System\idyLtSU.exe
  2⤵
  PID:14276
- C:\Windows\System\CZmBSif.exe
  C:\Windows\System\CZmBSif.exe
  2⤵
  PID:14292
- C:\Windows\System\jJRCwnA.exe
  C:\Windows\System\jJRCwnA.exe
  2⤵
  PID:14312
- C:\Windows\System\YVNFeyb.exe
  C:\Windows\System\YVNFeyb.exe
  2⤵
  PID:1472
- C:\Windows\System\SBYfsOU.exe
  C:\Windows\System\SBYfsOU.exe
  2⤵
  PID:13444
- C:\Windows\System\kkyPfcG.exe
  C:\Windows\System\kkyPfcG.exe
  2⤵
  PID:13372
- C:\Windows\System\ZSaQKAz.exe
  C:\Windows\System\ZSaQKAz.exe
  2⤵
  PID:13460
- C:\Windows\System\WfmEEMa.exe
  C:\Windows\System\WfmEEMa.exe
  2⤵
  PID:13492
- C:\Windows\System\AZIxzpr.exe
  C:\Windows\System\AZIxzpr.exe
  2⤵
  PID:13496
- C:\Windows\System\Mviivcy.exe
  C:\Windows\System\Mviivcy.exe
  2⤵
  PID:13608
- C:\Windows\System\dxYZmBr.exe
  C:\Windows\System\dxYZmBr.exe
  2⤵
  PID:13664
- C:\Windows\System\jbHjouZ.exe
  C:\Windows\System\jbHjouZ.exe
  2⤵
  PID:13648
- C:\Windows\System\hWJeJFb.exe
  C:\Windows\System\hWJeJFb.exe
  2⤵
  PID:13684
- C:\Windows\System\ooNonDK.exe
  C:\Windows\System\ooNonDK.exe
  2⤵
  PID:13636
- C:\Windows\System\vnUyZft.exe
  C:\Windows\System\vnUyZft.exe
  2⤵
  PID:13584
- C:\Windows\System\zLeJfUe.exe
  C:\Windows\System\zLeJfUe.exe
  2⤵
  PID:13752
- C:\Windows\System\aFrbTNr.exe
  C:\Windows\System\aFrbTNr.exe
  2⤵
  PID:13816
- C:\Windows\System\ikMSsUw.exe
  C:\Windows\System\ikMSsUw.exe
  2⤵
  PID:5880
- C:\Windows\System\JkupBbw.exe
  C:\Windows\System\JkupBbw.exe
  2⤵
  PID:13840
- C:\Windows\System\NKjFwXD.exe
  C:\Windows\System\NKjFwXD.exe
  2⤵
  PID:856
- C:\Windows\System\qcpbqjP.exe
  C:\Windows\System\qcpbqjP.exe
  2⤵
  PID:4840
- C:\Windows\System\sJHcpjO.exe
  C:\Windows\System\sJHcpjO.exe
  2⤵
  PID:13860
- C:\Windows\System\cffNowj.exe
  C:\Windows\System\cffNowj.exe
  2⤵
  PID:13900
- C:\Windows\System\YsNIsBi.exe
  C:\Windows\System\YsNIsBi.exe
  2⤵
  PID:13976
- C:\Windows\System\WkUZYYp.exe
  C:\Windows\System\WkUZYYp.exe
  2⤵
  PID:14304
- C:\Windows\System\NtLmkxM.exe
  C:\Windows\System\NtLmkxM.exe
  2⤵
  PID:1248
- C:\Windows\System\wcrKfAw.exe
  C:\Windows\System\wcrKfAw.exe
  2⤵
  PID:13340
- C:\Windows\System\mGtPyeB.exe
  C:\Windows\System\mGtPyeB.exe
  2⤵
  PID:13368
- C:\Windows\System\lOtJWxr.exe
  C:\Windows\System\lOtJWxr.exe
  2⤵
  PID:13364
- C:\Windows\System\UFnEKcY.exe
  C:\Windows\System\UFnEKcY.exe
  2⤵
  PID:13352
- C:\Windows\System\NtirDdY.exe
  C:\Windows\System\NtirDdY.exe
  2⤵
  PID:13536
- C:\Windows\System\LmVxLzP.exe
  C:\Windows\System\LmVxLzP.exe
  2⤵
  PID:13700
- C:\Windows\System\THLDMsH.exe
  C:\Windows\System\THLDMsH.exe
  2⤵
  PID:13596
- C:\Windows\System\HStZWfi.exe
  C:\Windows\System\HStZWfi.exe
  2⤵
  PID:13748
- C:\Windows\System\JlYYFFu.exe
  C:\Windows\System\JlYYFFu.exe
  2⤵
  PID:13808
- C:\Windows\System\OlzHURN.exe
  C:\Windows\System\OlzHURN.exe
  2⤵
  PID:13828
- C:\Windows\System\cskJHxQ.exe
  C:\Windows\System\cskJHxQ.exe
  2⤵
  PID:792
- C:\Windows\System\QEvEbqo.exe
  C:\Windows\System\QEvEbqo.exe
  2⤵
  PID:13876
- C:\Windows\System\yTGjgEl.exe
  C:\Windows\System\yTGjgEl.exe
  2⤵
  PID:13972
- C:\Windows\System\WmPOYSM.exe
  C:\Windows\System\WmPOYSM.exe
  2⤵
  PID:14040
- C:\Windows\System\fmKadpW.exe
  C:\Windows\System\fmKadpW.exe
  2⤵
  PID:13996
- C:\Windows\System\qLuBNZn.exe
  C:\Windows\System\qLuBNZn.exe
  2⤵
  PID:14124
- C:\Windows\System\UmpKGFL.exe
  C:\Windows\System\UmpKGFL.exe
  2⤵
  PID:13888
- C:\Windows\System\byvZaQN.exe
  C:\Windows\System\byvZaQN.exe
  2⤵
  PID:14144
- C:\Windows\System\vSIOtwf.exe
  C:\Windows\System\vSIOtwf.exe
  2⤵
  PID:4128
- C:\Windows\System\TZmliDu.exe
  C:\Windows\System\TZmliDu.exe
  2⤵
  PID:4200
- C:\Windows\System\iXtoyqo.exe
  C:\Windows\System\iXtoyqo.exe
  2⤵
  PID:14220
- C:\Windows\System\WDJJnYn.exe
  C:\Windows\System\WDJJnYn.exe
  2⤵
  PID:14248
- C:\Windows\System\xyrCAQe.exe
  C:\Windows\System\xyrCAQe.exe
  2⤵
  PID:14284
- C:\Windows\System\QqaUuGR.exe
  C:\Windows\System\QqaUuGR.exe
  2⤵
  PID:13428
- C:\Windows\System\azMRrHK.exe
  C:\Windows\System\azMRrHK.exe
  2⤵
  PID:13532
- C:\Windows\System\aiaskSj.exe
  C:\Windows\System\aiaskSj.exe
  2⤵
  PID:13476
- C:\Windows\System\vJHjAsh.exe
  C:\Windows\System\vJHjAsh.exe
  2⤵
  PID:13616
- C:\Windows\System\CGsQtVJ.exe
  C:\Windows\System\CGsQtVJ.exe
  2⤵
  PID:13676

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:11696

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:13520

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14228

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:11876

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13352

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:9592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:10976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4c0k5xzz.5ag.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DZntTTO.exe

Filesize
1.8MB

MD5
381fa09c1f0d164ea29505813d2f80d1

SHA1
3b8adb96d09694248e673395fdfa124946a0135e

SHA256
ec607dfeba44a3da30304f128890f1399bfea2c83bbc004ef195a98b9caf0f5d

SHA512
9a641302ebd477bf7a4afaac13b82b073e8d01b131e771bbdcf4082d1cf47d921dfb2c872ffda01672db359aeac61e7dcd5972d2bd7038b6571ea939958f41e2

Download Submit
C:\Windows\System\DeBBDnI.exe

Filesize
1.8MB

MD5
52ab702a2567a3a41221ae5cb53308a1

SHA1
3dcb925590ef8de7e21df7e034ef081fe882be16

SHA256
84989755e9ad90882efcf94367dfbeebde95204c75ef36f38c60c74aa25b94e8

SHA512
e856106d863851b08122fdc55b6d3cb6141c50c6722d14411aa2cf2af240838b9f1309058385796d190193960ad5eeb047f1117fff0040ecda67f1dc822b3011

Download Submit
C:\Windows\System\FZdFvRN.exe

Filesize
1.8MB

MD5
37d6f146b9823de6d22c201435d3fd7e

SHA1
ab483ff05838dbdb503f59ddac8286ebeb33ffe1

SHA256
a0957baf17417e55f44fa63ea8ca0eb766cf9e7ecbf4f3e02d9eabfe8d83d073

SHA512
290bc25407cf7ee974f2e3db9cd468e8d6054966b55b24b39f2623b216719b7227cc5a51150346d51216a8e3b508b5c3e9e411a8df49cd30dd2b50544347899a

Download Submit
C:\Windows\System\KJYNzNl.exe

Filesize
1.8MB

MD5
f4d8dab72514389608ae868f7cbd6d9b

SHA1
1d87eee3e02dec1bf5af68a18252266681d2ef12

SHA256
0bee383b4c11de0f5fcc1f9a4b61cf39197c1a9ec149a9dcaa18ea359a9c6036

SHA512
d252e13fde3f2651b7ba4be745f17b1eb92b90d59c324883c9cece9b66c3d69cf5a479cb8ed038072a8cb6de7f112703561971a58bf9e01a827567cfdcb1446b

Download Submit
C:\Windows\System\PXoTStE.exe

Filesize
1.8MB

MD5
22a31cdd7f35ba49d6c6c945e1fa7fe4

SHA1
b5b0630fadf4aa2c7b85d512e1cbc75555fdaa73

SHA256
daf20ee9d7f93cb90bfbf59f57c9dbfeafd4e182251ac07191335ca36378cfb5

SHA512
2d64ba081dd547d2a7a020d8617687a17e2c25013fe818acad4f2cf1cd195f51affb3a71f995c0a46ef7b41f8d03e3e2f8985744a0fda73b59934d8da5704fe5

Download Submit
C:\Windows\System\QFvXqbQ.exe

Filesize
1.8MB

MD5
a957d6e6e791394abf46c2d71f80bd7e

SHA1
19a16c733085cd6bdffe88456eb412fa7d08cd27

SHA256
b1bc6762a25a13ff2531249c239815c00eb823074d74b982399f1cd65019d11b

SHA512
be0497d59ecf099f36cc22077b3cf6bf1114c6015a869dfa840a7f9cd167708e182119ac64c73c4406cd43274c20422bb5b1faf01dfbb47280e444dc3493c1c5

Download Submit
C:\Windows\System\QSooiOX.exe

Filesize
1.8MB

MD5
57b7e3f5c8913a3c78c1cde5f5635d00

SHA1
7c293580816b4b35179903ac7eedfae3d8fc048f

SHA256
33e87a8a6c5fdbcd3fa760483c1addcb9429b2d76b5934a67ae6cb5c38c674c5

SHA512
6433ca72ec44a0af17cf18974f44ef9a6d16a3df1c7584b537b7a588f11b3aaaed53650c52d62bd09bc2cb5a2556a3d3c3276987ae2040860ed70c8aeeef59fa

Download Submit
C:\Windows\System\RNsWyiX.exe

Filesize
8B

MD5
77d7bf33fc4f12bfdb9e86136d3b03c4

SHA1
97d97c8d5ae00436ac2d2202db990baabc4e4d94

SHA256
a079985e5dcd4e5003f1d0cfa79ba591507ffd065b7459f4b6f1fe6835c1aebc

SHA512
31a189517e8f007e33c776dddb91ad4e752c628e5f64dec1a48a29302de6a9ffe3541221f6c58119e49f66669bc0b1de454057d727c5323655bbae427b0917a2

Download Submit
C:\Windows\System\SCQWZNQ.exe

Filesize
1.8MB

MD5
50dcda693f04b88eb9b71deeb7a157b4

SHA1
067653c15a9f63ec582b2d4f6f806e2384a51635

SHA256
c01271fb5c2f45528014d036d77406f4023e93ba8d88e8401ecfa434ecc6db0d

SHA512
1f4df6c1624b7ef3622d432a304935731f3ce05368a36651e8eb3190635d1d86f511ea913d6489c45941cfa2889f9e2f087623d49901a5596ea059810101365d

Download Submit
C:\Windows\System\SoYngZA.exe

Filesize
1.8MB

MD5
9b595b37639dd212de40d70d5adf8d1f

SHA1
76617fefce887d2c333d7737634f690fa0239eaa

SHA256
a8c1c4bc3c35aa4bbabda4ad02bd8bf5324b0b54616472301e4b047e5de02d8a

SHA512
485cf68d2d40a0d315c13bc6fbbb5bede9e2461ea9b09b9293ee57605efcccd39073c7c649c1c61bbdd72af248eaf9cfa255c32c6f18835f6b92afaf6e5d3235

Download Submit
C:\Windows\System\SqgFkRX.exe

Filesize
1.8MB

MD5
1ce2defd32c5c6b95a9f8de423bc3765

SHA1
7881f409023c369c54ccca0825e46217e81e239d

SHA256
a6c36adbcbc08a0ccbae7043a6b183031c0ef768198b2ba84e13bd6b0b238092

SHA512
d9b952c45493e547a28666ada65ffd1a1daddb9d8710f3f1ee05befc5d45363cbb9f26b431eecd90bd4647289f7823b7ad527e4ad67367a99ad22fb85fd86ac7

Download Submit
C:\Windows\System\UCcfNDH.exe

Filesize
1.8MB

MD5
0c2c17effb520ba5f60941170630a4d8

SHA1
86e887d2da05d514be4a7078b4c901a90c1d8b8c

SHA256
fabe4b89fba47ec51615e22626428abac6525aa6b8b31ebdae9700cb792330e0

SHA512
fbbd87d9f35e4c67d84b2868575672364e20079b4803959261bdeb504dce361294f8be804d70dd1daea690db17efa48951ff171213f8fe2dffe34cd2f6e96291

Download Submit
C:\Windows\System\UGFKdeP.exe

Filesize
1.8MB

MD5
3e5ad16ffa9d3dd8ec0d018bb9d8b312

SHA1
cc76c60b134dcd44fb0eea35648ad42394805b89

SHA256
e4cb8bf048ebe1a6ca737205ea38502cccb7bd51563f970d959a5683f71882fc

SHA512
131c8b1935fe4c6f01ac906204850cdd192ed97179f7fb56f79a1ec557ea679bb277446ed4d8a9e5ef307732de1967cd3a03ba8e05dd347423499fba2d46af35

Download Submit
C:\Windows\System\VYIyniO.exe

Filesize
1.8MB

MD5
35e7eccbcfccdd1c446f4619c9ff685d

SHA1
d4bc1e538f9f1072cbf39baefd80cad0a80107c5

SHA256
f230a1aa03492cf1ec4bac7fdc693dc916d4ee84c65e2598c7188d41e1bdabcd

SHA512
c5513ea5fe7f509a2c61aed6a3864bb335e970fabff9a8d5916b9f364f38c7cc15e56b18c97733953e8a126e674662eaa7b15564917a4dedfc3c94ad1459532a

Download Submit
C:\Windows\System\WaxXYLH.exe

Filesize
1.8MB

MD5
9d40664fc1f7c00dba278b687049233e

SHA1
a3fe657b316b78a14ecf9e02fbfbf38ff23e4e80

SHA256
25a5dca374868f183e53ee46fe339910e4ee44d8138f319f497a3baab4d3c3b2

SHA512
8f981dff214347b078b12c86a40b025d61b18886b8f064518f4ad4576ec37441afa22446638efea7478ba3807577fdb397214a2d288b25d5e160c2835849e404

Download Submit
C:\Windows\System\WhDBCsR.exe

Filesize
1.8MB

MD5
9506b693d2bb05889ba3fccb403e8154

SHA1
f6fcf9f6974380bf6488fc6ff3598fd0736c8512

SHA256
1a704473650aba6cbb444a6873d7ff277412b9d4dd436a5fbe1bf2e4e82596eb

SHA512
08089dabfceef5d5564e6593afddf1dc0e925d26b9583f728e999ef697eb618b634752ce14a4f8fc34e3bbf243fbedec411839be73a096841122f923b472277c

Download Submit
C:\Windows\System\XDdlvIy.exe

Filesize
1.8MB

MD5
cbfbf2c8ed4a6941acbed3626a3e4f27

SHA1
5bf4fbd6732b53c68905b217c313ccfd0fe337e1

SHA256
5cbf21d317d8d5f23179f6e9e88e184abbd3961a4e241aa91e09b1d5b00d445a

SHA512
322453d148281b3967a2fbe25b9108435d60bb5563782b0aec7c94bab51555797b21ceaff9f8dc87adb3ad7e2c7e60bbddcaa731ba4bf3d026ed9b53db3a506f

Download Submit
C:\Windows\System\YwkCWJR.exe

Filesize
1.8MB

MD5
5d221696983a50f93574021aa6b66aa6

SHA1
1d7ffa7100a179243f1f013d236bed82bfabe7d3

SHA256
3ddb0db08d86e1481ab9e4a8248cb283f3f3ad8fab4d45fcca73e9030692c051

SHA512
a97062e73c7233b20c3a46845aed8137b3f5935ccf721b36e537411ae41b46c6b7027a30a66badea03a2c220b4b74e15b09e904d4b535cd3d8a2d6fddb57f367

Download Submit
C:\Windows\System\aqtIYoQ.exe

Filesize
1.8MB

MD5
81582fcf04be16ec4ed78b54bf5df381

SHA1
692b75a7b7b712811b7576ea99d56f044eace48e

SHA256
abc7e717eea64f8fc0fafae273591c189452f73e07e4c9dec61fe246fc53715c

SHA512
681186fbf5e4afa00590c3e7a00204f096bfed720123ff1816fe3abf1b4e08ace6c2da4899c735be1a0ced78cb0b9b871e316dd855ffbddaf4f7f9ea2e1b7dc9

Download Submit
C:\Windows\System\cWxIKJv.exe

Filesize
1.8MB

MD5
eea12d7b71e5ac2c052ee2da7399e691

SHA1
0c3c44498536bb510e4765dea0932e15ae212b8d

SHA256
cb7fe47f98e8acf5519b62a652911ea186527229cd3c2dbd12515e2b38dc2e98

SHA512
af31a3d9936dde63b1f9a21600f35d3402058ad668e0c2bc2fa5c06ace5004e8c3de603a1513ae2d0513a519e385f018c8783c22fe9ee495fe8df1a4c0e37234

Download Submit
C:\Windows\System\dnkJCFV.exe

Filesize
1.8MB

MD5
82fa1b1fa266e113964a7d5ece7cf78a

SHA1
00fad72895e5be381afa9c647abd18c820273b28

SHA256
8dc03cf29252becdc202579e7b5f8f27874b67a4cc5a8dba3279c6d8b6639a5f

SHA512
9a4e481a10d01db880f699f8c347cdbe55ca8c6feb3a0e1c27f00d54691a23c70c76a1f58d381f5840c3218622dbbf881a687a2b66aa22d989c21205bdf51127

Download Submit
C:\Windows\System\dpIwLIh.exe

Filesize
1.8MB

MD5
1cfe3b0ba48a6c282b2177976bc26329

SHA1
c19966bdb91f519dfcb83e3bbb423ddd9522901d

SHA256
9474c2f21c6c4e54d00f074d192c16750b676175104c4953711529b6d7c83d54

SHA512
5d3682aea82d6f8ebdae7ef838c88d6239aed060996102f8b0059067dbe1eb30d238bb3cfab3a9014a913c1f12f1c27ce1abe7e7467e9388d74dbf6c0c396b44

Download Submit
C:\Windows\System\egMjLNi.exe

Filesize
1.8MB

MD5
5387124457e20dfdb3129398e8b6978c

SHA1
78397f42237795863ad10231f1a0aa26e0f89735

SHA256
fbd0aa8a1e9bae0963deab79a5d62e5856d7de7b1d990b7fd14d195342613cb8

SHA512
2f4dde655322c50142e2fff35f4996cebd98b02432cabe37f83160005d0f75ed3d00e7c215a60ddd05f85606111e8f36f0fa2d18de50d3a24bd58a9753efed1f

Download Submit
C:\Windows\System\eiLFuRx.exe

Filesize
1.8MB

MD5
1beac94f69c2a1cdda9cc6c585ce1598

SHA1
e173c4d8269ab6cc505ddd131cd8b9f08348c310

SHA256
a83cfe575257342e15c6be1b3cbfd4176fe22b91bd44e059c8f1a98323039932

SHA512
cfd762f83bb8c8cb5ea6449b5c493baf402cac7139597233a869ac0012c7ce940b591fa8d481dc5e350d8f93a80ca83b85636fd2c06d3f8e59e9a51bec7129c4

Download Submit
C:\Windows\System\hiLDHSL.exe

Filesize
1.8MB

MD5
1ac6671fce3e92b69ad77f7a94bc5a69

SHA1
290d222be028e6cb21cc59f2c34c109040146e5b

SHA256
524b8e91262487c9457df7225d8a0c0499584b528c10cdedba77a0f3bf69c86e

SHA512
515cc5cb059494e7ec7cb555bfdb5d2db20c56625e99df4c2991ba8acedc14412fcd092da0c8e26a9b75e9b68f6f5c90b703aa2e6226c84f761d5ff9311d20cc

Download Submit
C:\Windows\System\ijcUGjM.exe

Filesize
1.8MB

MD5
973aaee9794a442c790277c51dd0dd0e

SHA1
53e8f04fdc3ff00d483f4a247f649e233c261f30

SHA256
88eb58304d6b94dffc71231eea27e89d7208de9dd50f00c92948eb1d96327fef

SHA512
9e1c6f672e9179111a62bfad13ffeee0607a0cf0d503b19b7726047a73aa5ead67e27ee7b4382686f98ff95061f973e034dd86c494a6c6c66a6f24ecfb739b5f

Download Submit
C:\Windows\System\jmGpYWC.exe

Filesize
1.8MB

MD5
d98c19a8fe55a2b39f71fd9b161b0bb0

SHA1
1ad79f6cd9846c83d3a8dbff36aa4cbbc1e76fe0

SHA256
8c529765bd819e990932d4f64a16f0ff7f81a0bce62582826b3e715a23174845

SHA512
4feea409ae33c9c8f5ffdd29223deb0765ef4143095c874a7049a9dc0cb305046ab521ca6738faa0cf137d5cd3bebdec6a56ac5b37dbc244a77450c8eb93743a

Download Submit
C:\Windows\System\juqGpbm.exe

Filesize
1.8MB

MD5
aaeb481c278a9c5d9a870d0ad0d0ad3e

SHA1
26d9a5d5f64d3f9c93955b7ebdd7b00100a48710

SHA256
5ea0b9c48bfeb06c331933e00b1b24a6afe60b60539de5fffe2d0ce8596c9344

SHA512
165d58b981e9b3ba908f9528fb4b6c42d17c2798aca9b6cd6afc5f27b2069ad9af0f2d79ba43d4cdcee7c9525c0c6d691c3ba4f3d52be033a5276d90792335fd

Download Submit
C:\Windows\System\klXBakQ.exe

Filesize
1.8MB

MD5
3eb202045bc21437b318be2f4e7b774f

SHA1
34f44d45d6837577c2f62960cdc11028131f3f07

SHA256
eaa5850e4972b632d6c0d28ef44ceddbd4f6e7a540ac2cc881de7fd04deaffb5

SHA512
9429b18c2a8b3597ffd17d5b6a08d8615323c422d27bb820e33dc599ac6de947455d8a2200d5fd1596e7f29c9c6481c7c1f69e5b8dd1e5dcef04cb663c4392ea

Download Submit
C:\Windows\System\knEHDWt.exe

Filesize
1.8MB

MD5
ec10dd4aba1ba11412fb47895193f9c3

SHA1
62c7a368c2dda4e40f0f61d695c6933938322a61

SHA256
f8694561909cca4579eaf839ec481a3980edea07c8621b63e34107487b4fb3bd

SHA512
e36cdc1b9d5da03bf78f5add69c6ff61c3530eb147b099a49c9d96ea2a75e20fa2918517516e9cdeff3034a26361410aa371947757b347396e82966ccf922dc5

Download Submit
C:\Windows\System\naKvtVx.exe

Filesize
1.8MB

MD5
caffe65a5e8e51b4b260f19b5ed60122

SHA1
858eb762a6d1ea2f25efc0a9f6a670106caddbc7

SHA256
514e458aec74404d3bf630c468fd36c5f652a73fbcfc9bc3fa36a6315ef31c2e

SHA512
5ae34277a37cf521173f97e93160b334d4847a54225a1c5d558932abf4e3a99ba09bdf42ecefbf9915475ba004940a22e5fb63cdbf52f45def450110eb49a264

Download Submit
C:\Windows\System\oOOjuNr.exe

Filesize
1.8MB

MD5
b0c5d09fd59fad25dd60798941a1ceaa

SHA1
f7aa53d4d87429eed772356d381211659977b73b

SHA256
5a447991e74d25c692ec045897ca9e6520a38dc6d1e3cd29d161b8224c6544f1

SHA512
d6ffd87386dab475b5230a4f4880314858a252207953b11faa4cda8d5b72b70685b275418ea6191a69bd574e73bc17c31495faf8c352f3df1b5e100e98288a44

Download Submit
C:\Windows\System\qTELoVQ.exe

Filesize
1.8MB

MD5
a4168282f63be694b7c8213b046863d5

SHA1
7fa59dcf5195edb4b1c6c42599adf03ec793da34

SHA256
fc011757235d28b30d0023015a479d25d04b6a7da5e320664a36d19977eacf7e

SHA512
d775cf841c1a4cae7a2aee2e06ce6c61d502a7b9a384aab39b789650219c24cc7a2cac8819cdaf425057108c0546cabd1bafc921ac73517198d838dacd28c66d

Download Submit
C:\Windows\System\qvoWpDB.exe

Filesize
1.8MB

MD5
504e1b82459b9286147771894ce1db8a

SHA1
96d65d4c4fba362be00f98aaba6783383ceed55f

SHA256
31d89b153b9dfef165eb2d3994b188017ba3bde601a400ebce38b23cfd070133

SHA512
32f783dd1b332ef00603df5716834afe01c4a6366c91fc2fd789fad1ee7d11bc19e8b35caf242ae909b7d9c42a42a08af732e43eb6a64cbd557afb42453851f2

Download Submit
C:\Windows\System\rNBfinR.exe

Filesize
1.8MB

MD5
e5f9fdfd651150af4935399954d5fd43

SHA1
5047bd41181bb9d64fe72f3747b2f63375a3cbf2

SHA256
36d6551ad6db32a48f810f2667cebfbab700d270893396527c7085ed270ef76d

SHA512
7ece5d9bcc70140439e067fbbe203e39ec3e39f21d0c4b447badb12cd0504cf1e5384c522bd4d0c381364628e652d1618e02874df52a3d633437377360e242e6

Download Submit
C:\Windows\System\sfFTOlc.exe

Filesize
1.8MB

MD5
539f19f5ccf182ea208596c56b9d8574

SHA1
14c8c08f98dc09efca8f6a0e95831a19e378910f

SHA256
79237823d9128d11d38f4fb9fb1e8c2c86a9c54c8d6b9f6b6ae4a1c4b0c1978d

SHA512
ab6b6c550f509d47b285aa6066bedb603d3cc8946fe024334fe443930661b18f599f65824ddfba7989a565b5cc42c134ea501fd5e381b93192cd617db44fad77

Download Submit
C:\Windows\System\wVPfZjK.exe

Filesize
1.8MB

MD5
4093a46af7446748abc10c67803111d8

SHA1
4d861598af85b7393e5e92786d8b8c0d698d819e

SHA256
0d14901c55e84243b7df3acb135b7495f45c2aeb61ec411438aa0c6b6961a6c0

SHA512
3407838847abdddb149b92b40a11e5ef4cf610b326fe7453d28a4f1159c6a916ab7a6b8da05c4ee9f920cdcc15bba3825724e0386b889e4dfe8c95ca24fbab21

Download Submit
C:\Windows\System\xPKNuuc.exe

Filesize
1.8MB

MD5
5f6dac04aa6631bc53933717b60b3e7c

SHA1
c92e96415fcbe2e965b1add13f0746d7152d0b4c

SHA256
3953933b0641d8a08ca2961a9ab309845ffedaad84d6509f04033a9e5dac9f96

SHA512
dcae58f3fa33cee20b566eddc2e7650308483f39bc15dc3eba359c676a109b619f02a5513d3af8b81cffd6b124ef3558277836a620b9772fc6613dc184111b62

Download Submit
C:\Windows\System\yyaigYf.exe

Filesize
1.8MB

MD5
f0774ab789d2c276c12a01e9e7d0a8b5

SHA1
bf9c9175fbc3bb32353364de806552e31b5c1c3f

SHA256
2568e44654e1dfa12fd250135797349d70b0f32b9e18682549a1612c03b11559

SHA512
4931a560d48013305ed6c44fcbce39c41be14267ce4b1c4e80d3296b9dc718f464303133c5358170f57d0bf87a0fb2774e49b60e390ee0764cbb8060c033ca8b

Download Submit
C:\Windows\System\zdyaVJW.exe

Filesize
1.8MB

MD5
c253b66e1272602f62aa1d7c994caed7

SHA1
ad31742a606da5c799f63f449bf852531f841e82

SHA256
378749a3ef048f01b89cd804ccf068815d69fb8e1070476ebad3f77e6b8a665d

SHA512
937c16b192ec193e4b104830fc11b9338817ed0e613154d841b1e314c32f944638c96ffc549e3d49e3549cd0bfc7b9881621b6666bdd414a6ed9ca26b53362a1

Download Submit
memory/544-696-0x00007FF7A38D0000-0x00007FF7A3CC2000-memory.dmp

Filesize
3.9MB

Download
memory/948-2053-0x00007FFDEB620000-0x00007FFDEC0E1000-memory.dmp

Filesize
10.8MB

Download
memory/948-63-0x00007FFDEB620000-0x00007FFDEC0E1000-memory.dmp

Filesize
10.8MB

Download
memory/948-20-0x00007FFDEB623000-0x00007FFDEB625000-memory.dmp

Filesize
8KB

Download
memory/948-323-0x00000204BE880000-0x00000204BE8A2000-memory.dmp

Filesize
136KB

Download
memory/948-297-0x00007FFDEB620000-0x00007FFDEC0E1000-memory.dmp

Filesize
10.8MB

Download
memory/1164-611-0x00007FF7F4C10000-0x00007FF7F5002000-memory.dmp

Filesize
3.9MB

Download
memory/1200-675-0x00007FF690E50000-0x00007FF691242000-memory.dmp

Filesize
3.9MB

Download
memory/1716-485-0x00007FF68CB30000-0x00007FF68CF22000-memory.dmp

Filesize
3.9MB

Download
memory/1736-610-0x00007FF6AA2D0000-0x00007FF6AA6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-612-0x00007FF689900000-0x00007FF689CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-619-0x00007FF7C1D60000-0x00007FF7C2152000-memory.dmp

Filesize
3.9MB

Download
memory/2148-98-0x00007FF648290000-0x00007FF648682000-memory.dmp

Filesize
3.9MB

Download
memory/2184-159-0x00007FF6740B0000-0x00007FF6744A2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-158-0x00007FF77CFC0000-0x00007FF77D3B2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-615-0x00007FF6B9550000-0x00007FF6B9942000-memory.dmp

Filesize
3.9MB

Download
memory/2860-594-0x00007FF6FB4F0000-0x00007FF6FB8E2000-memory.dmp

Filesize
3.9MB

Download
memory/3228-703-0x00007FF6AE500000-0x00007FF6AE8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3256-614-0x00007FF62CAD0000-0x00007FF62CEC2000-memory.dmp

Filesize
3.9MB

Download
memory/3696-618-0x00007FF725820000-0x00007FF725C12000-memory.dmp

Filesize
3.9MB

Download
memory/3972-131-0x00007FF719D30000-0x00007FF71A122000-memory.dmp

Filesize
3.9MB

Download
memory/4320-74-0x00007FF6A4280000-0x00007FF6A4672000-memory.dmp

Filesize
3.9MB

Download
memory/4624-0-0x00007FF7C3690000-0x00007FF7C3A82000-memory.dmp

Filesize
3.9MB

Download
memory/4624-1-0x000001286AFE0000-0x000001286AFF0000-memory.dmp

Filesize
64KB

Download
memory/4624-4132-0x00007FF7C3690000-0x00007FF7C3A82000-memory.dmp

Filesize
3.9MB

Download
memory/4752-613-0x00007FF726290000-0x00007FF726682000-memory.dmp

Filesize
3.9MB

Download
memory/4760-211-0x00007FF651C10000-0x00007FF652002000-memory.dmp

Filesize
3.9MB

Download
memory/4872-616-0x00007FF6D3BA0000-0x00007FF6D3F92000-memory.dmp

Filesize
3.9MB

Download
memory/4920-620-0x00007FF6BD570000-0x00007FF6BD962000-memory.dmp

Filesize
3.9MB

Download
memory/4956-19-0x00007FF652530000-0x00007FF652922000-memory.dmp

Filesize
3.9MB

Download
memory/5072-617-0x00007FF7D2EE0000-0x00007FF7D32D2000-memory.dmp

Filesize
3.9MB

Download
memory/5108-395-0x00007FF630BF0000-0x00007FF630FE2000-memory.dmp

Filesize
3.9MB

Download