xmrig | ed7b84f8ee64595e8d7af44da857eaf40e131fd1bddb6fdef72223a6027a5ffb

Analysis

max time kernel
90s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbcd113629aa0992d714e94019b66c60N.exe
Size

1.3MB
MD5

bbcd113629aa0992d714e94019b66c60
SHA1

0995805dbd593880f6ec4e335f9e0764456ba5d8
SHA256

ed7b84f8ee64595e8d7af44da857eaf40e131fd1bddb6fdef72223a6027a5ffb
SHA512

78aeece50a149bf6bf2864217ce905cc97d172324e34f931f59f316dd72032b444775e233de6907db8ef687bbbf0356b24a9cea150023038a573d3b2b5f0528e
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZ2nywSUHNDcyZU:Lz071uv4BPMkibTIA5JnIyKNNU

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/1612-608-0x00007FF700770000-0x00007FF700B62000-memory.dmp	xmrig
behavioral2/memory/3988-764-0x00007FF731AE0000-0x00007FF731ED2000-memory.dmp	xmrig
behavioral2/memory/3408-770-0x00007FF7AE5D0000-0x00007FF7AE9C2000-memory.dmp	xmrig
behavioral2/memory/4124-775-0x00007FF612CC0000-0x00007FF6130B2000-memory.dmp	xmrig
behavioral2/memory/5004-777-0x00007FF63D1A0000-0x00007FF63D592000-memory.dmp	xmrig
behavioral2/memory/1480-776-0x00007FF7DCD70000-0x00007FF7DD162000-memory.dmp	xmrig
behavioral2/memory/3552-774-0x00007FF613AF0000-0x00007FF613EE2000-memory.dmp	xmrig
behavioral2/memory/756-773-0x00007FF677D10000-0x00007FF678102000-memory.dmp	xmrig
behavioral2/memory/3188-772-0x00007FF651C20000-0x00007FF652012000-memory.dmp	xmrig
behavioral2/memory/3456-771-0x00007FF7A9720000-0x00007FF7A9B12000-memory.dmp	xmrig
behavioral2/memory/3044-769-0x00007FF62D030000-0x00007FF62D422000-memory.dmp	xmrig
behavioral2/memory/1088-768-0x00007FF7519F0000-0x00007FF751DE2000-memory.dmp	xmrig
behavioral2/memory/3196-767-0x00007FF652170000-0x00007FF652562000-memory.dmp	xmrig
behavioral2/memory/2656-766-0x00007FF7C0810000-0x00007FF7C0C02000-memory.dmp	xmrig
behavioral2/memory/2232-599-0x00007FF66A140000-0x00007FF66A532000-memory.dmp	xmrig
behavioral2/memory/4748-464-0x00007FF666E30000-0x00007FF667222000-memory.dmp	xmrig
behavioral2/memory/2636-323-0x00007FF66DD40000-0x00007FF66E132000-memory.dmp	xmrig
behavioral2/memory/1248-259-0x00007FF735230000-0x00007FF735622000-memory.dmp	xmrig
behavioral2/memory/4288-208-0x00007FF7820E0000-0x00007FF7824D2000-memory.dmp	xmrig
behavioral2/memory/2180-87-0x00007FF7F6F40000-0x00007FF7F7332000-memory.dmp	xmrig
behavioral2/memory/684-52-0x00007FF711290000-0x00007FF711682000-memory.dmp	xmrig
behavioral2/memory/2888-2456-0x00007FF66D5F0000-0x00007FF66D9E2000-memory.dmp	xmrig
behavioral2/memory/3380-2464-0x00007FF7DF880000-0x00007FF7DFC72000-memory.dmp	xmrig
behavioral2/memory/3048-2971-0x00007FF7AF420000-0x00007FF7AF812000-memory.dmp	xmrig
behavioral2/memory/3380-2972-0x00007FF7DF880000-0x00007FF7DFC72000-memory.dmp	xmrig
behavioral2/memory/684-2974-0x00007FF711290000-0x00007FF711682000-memory.dmp	xmrig
behavioral2/memory/1480-2976-0x00007FF7DCD70000-0x00007FF7DD162000-memory.dmp	xmrig
behavioral2/memory/2180-2978-0x00007FF7F6F40000-0x00007FF7F7332000-memory.dmp	xmrig
behavioral2/memory/4124-2988-0x00007FF612CC0000-0x00007FF6130B2000-memory.dmp	xmrig
behavioral2/memory/2232-2990-0x00007FF66A140000-0x00007FF66A532000-memory.dmp	xmrig
behavioral2/memory/4288-2992-0x00007FF7820E0000-0x00007FF7824D2000-memory.dmp	xmrig
behavioral2/memory/5004-2994-0x00007FF63D1A0000-0x00007FF63D592000-memory.dmp	xmrig
behavioral2/memory/3044-2996-0x00007FF62D030000-0x00007FF62D422000-memory.dmp	xmrig
behavioral2/memory/1248-3019-0x00007FF735230000-0x00007FF735622000-memory.dmp	xmrig
behavioral2/memory/3188-3027-0x00007FF651C20000-0x00007FF652012000-memory.dmp	xmrig
behavioral2/memory/3552-3026-0x00007FF613AF0000-0x00007FF613EE2000-memory.dmp	xmrig
behavioral2/memory/1612-3024-0x00007FF700770000-0x00007FF700B62000-memory.dmp	xmrig
behavioral2/memory/3408-3015-0x00007FF7AE5D0000-0x00007FF7AE9C2000-memory.dmp	xmrig
behavioral2/memory/3196-3011-0x00007FF652170000-0x00007FF652562000-memory.dmp	xmrig
behavioral2/memory/1088-3010-0x00007FF7519F0000-0x00007FF751DE2000-memory.dmp	xmrig
behavioral2/memory/2636-3017-0x00007FF66DD40000-0x00007FF66E132000-memory.dmp	xmrig
behavioral2/memory/3600-3006-0x00007FF7174F0000-0x00007FF7178E2000-memory.dmp	xmrig
behavioral2/memory/756-3004-0x00007FF677D10000-0x00007FF678102000-memory.dmp	xmrig
behavioral2/memory/3988-3013-0x00007FF731AE0000-0x00007FF731ED2000-memory.dmp	xmrig
behavioral2/memory/3456-3007-0x00007FF7A9720000-0x00007FF7A9B12000-memory.dmp	xmrig
behavioral2/memory/4748-3002-0x00007FF666E30000-0x00007FF667222000-memory.dmp	xmrig
behavioral2/memory/2656-2999-0x00007FF7C0810000-0x00007FF7C0C02000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2964	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3048	uZmZUMW.exe
3380	CCDBKpE.exe
684	lNcsbfs.exe
4124	qiFkPbv.exe
1480	rmcukat.exe
2180	yanMULv.exe
3600	SjedRBN.exe
4288	JnefVXb.exe
5004	WWrjGUs.exe
1248	uKYuSIo.exe
2636	wQYWUjW.exe
4748	qESGhJV.exe
2232	sdBYNYt.exe
1612	RWiruxx.exe
3988	hbTsWSm.exe
2656	EZdNOdz.exe
3196	yGEvArK.exe
1088	ZXIFJUS.exe
3044	BxeRUAW.exe
3408	WCQOgyR.exe
3456	TfifSJw.exe
3188	amvKGpJ.exe
756	TjbuaHi.exe
3552	XumQgrh.exe
3980	KbqOCNS.exe
440	GBuhccl.exe
4380	IwiIIiG.exe
3460	ypWgIiX.exe
1660	bnkqNOj.exe
4788	nleGYLJ.exe
2092	pINVsRD.exe
2932	WXEDiUW.exe
4592	EugvtsK.exe
2924	YvGUpxq.exe
3584	gakrMDq.exe
1456	sYgGpHV.exe
4420	nHaDeKI.exe
5072	ZHcRAmy.exe
4916	NrovacV.exe
3596	IWENHsb.exe
3500	OMUIGZC.exe
2672	tPuQGtH.exe
2552	XpFQaUE.exe
2304	oPReZic.exe
4672	rnWyvPT.exe
1888	OaQRAaJ.exe
4680	DryyEpU.exe
4580	uaWaSVN.exe
5032	VpxZpcT.exe
2440	ZFIcWWe.exe
2592	jJmFZVI.exe
4548	Kcgglku.exe
1884	CtnVMdE.exe
4908	omeBgVZ.exe
2364	EWxyYuK.exe
1736	fXIGFPw.exe
4448	JFnkHeD.exe
224	DpTXymU.exe
4984	dVJuGQR.exe
1476	sGzZxAk.exe
4956	EAXbTsb.exe
3436	QMUAXfz.exe
404	SRwatff.exe
4252	kXPySSM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2888-0-0x00007FF66D5F0000-0x00007FF66D9E2000-memory.dmp	upx
behavioral2/files/0x0007000000023478-6.dat	upx
behavioral2/files/0x000700000002347b-41.dat	upx
behavioral2/files/0x0007000000023489-98.dat	upx
behavioral2/files/0x0007000000023483-149.dat	upx
behavioral2/memory/1612-608-0x00007FF700770000-0x00007FF700B62000-memory.dmp	upx
behavioral2/memory/3988-764-0x00007FF731AE0000-0x00007FF731ED2000-memory.dmp	upx
behavioral2/memory/3408-770-0x00007FF7AE5D0000-0x00007FF7AE9C2000-memory.dmp	upx
behavioral2/memory/4124-775-0x00007FF612CC0000-0x00007FF6130B2000-memory.dmp	upx
behavioral2/memory/5004-777-0x00007FF63D1A0000-0x00007FF63D592000-memory.dmp	upx
behavioral2/memory/1480-776-0x00007FF7DCD70000-0x00007FF7DD162000-memory.dmp	upx
behavioral2/memory/3552-774-0x00007FF613AF0000-0x00007FF613EE2000-memory.dmp	upx
behavioral2/memory/756-773-0x00007FF677D10000-0x00007FF678102000-memory.dmp	upx
behavioral2/memory/3188-772-0x00007FF651C20000-0x00007FF652012000-memory.dmp	upx
behavioral2/memory/3456-771-0x00007FF7A9720000-0x00007FF7A9B12000-memory.dmp	upx
behavioral2/memory/3044-769-0x00007FF62D030000-0x00007FF62D422000-memory.dmp	upx
behavioral2/memory/1088-768-0x00007FF7519F0000-0x00007FF751DE2000-memory.dmp	upx
behavioral2/memory/3196-767-0x00007FF652170000-0x00007FF652562000-memory.dmp	upx
behavioral2/memory/2656-766-0x00007FF7C0810000-0x00007FF7C0C02000-memory.dmp	upx
behavioral2/memory/2232-599-0x00007FF66A140000-0x00007FF66A532000-memory.dmp	upx
behavioral2/memory/4748-464-0x00007FF666E30000-0x00007FF667222000-memory.dmp	upx
behavioral2/memory/2636-323-0x00007FF66DD40000-0x00007FF66E132000-memory.dmp	upx
behavioral2/memory/1248-259-0x00007FF735230000-0x00007FF735622000-memory.dmp	upx
behavioral2/files/0x0007000000023480-214.dat	upx
behavioral2/files/0x0007000000023487-211.dat	upx
behavioral2/files/0x000700000002347f-204.dat	upx
behavioral2/files/0x000700000002349f-198.dat	upx
behavioral2/files/0x000700000002349c-194.dat	upx
behavioral2/files/0x000700000002348f-192.dat	upx
behavioral2/files/0x0007000000023486-191.dat	upx
behavioral2/files/0x000700000002349b-187.dat	upx
behavioral2/files/0x000700000002348e-186.dat	upx
behavioral2/files/0x000700000002349a-185.dat	upx
behavioral2/files/0x000700000002348d-180.dat	upx
behavioral2/files/0x0007000000023484-177.dat	upx
behavioral2/files/0x000700000002347c-165.dat	upx
behavioral2/files/0x0007000000023496-163.dat	upx
behavioral2/files/0x0007000000023495-160.dat	upx
behavioral2/files/0x000700000002348b-156.dat	upx
behavioral2/files/0x0007000000023494-155.dat	upx
behavioral2/files/0x0007000000023493-141.dat	upx
behavioral2/files/0x0007000000023488-218.dat	upx
behavioral2/memory/4288-208-0x00007FF7820E0000-0x00007FF7824D2000-memory.dmp	upx
behavioral2/files/0x0007000000023481-137.dat	upx
behavioral2/files/0x0007000000023492-136.dat	upx
behavioral2/memory/3600-134-0x00007FF7174F0000-0x00007FF7178E2000-memory.dmp	upx
behavioral2/files/0x00070000000234a0-201.dat	upx
behavioral2/files/0x000700000002349e-197.dat	upx
behavioral2/files/0x000700000002349d-196.dat	upx
behavioral2/files/0x0007000000023490-124.dat	upx
behavioral2/files/0x0007000000023498-176.dat	upx
behavioral2/files/0x0007000000023497-173.dat	upx
behavioral2/files/0x000700000002348c-108.dat	upx
behavioral2/files/0x000700000002348a-103.dat	upx
behavioral2/files/0x0007000000023482-143.dat	upx
behavioral2/files/0x0007000000023491-133.dat	upx
behavioral2/memory/2180-87-0x00007FF7F6F40000-0x00007FF7F7332000-memory.dmp	upx
behavioral2/files/0x0007000000023485-77.dat	upx
behavioral2/files/0x000700000002347d-72.dat	upx
behavioral2/files/0x0007000000023479-55.dat	upx
behavioral2/files/0x000700000002347e-86.dat	upx
behavioral2/files/0x0007000000023477-27.dat	upx
behavioral2/memory/684-52-0x00007FF711290000-0x00007FF711682000-memory.dmp	upx
behavioral2/memory/3380-49-0x00007FF7DF880000-0x00007FF7DFC72000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aUofKEo.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\TCIEKyy.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\sREjeRB.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\svaiuBE.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\vKDqBDL.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\MXugUVe.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\SgaVGkQ.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\AqFUhlP.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\FGJQygx.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\SoQnkAs.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\VpqpnVM.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\RJmnhCM.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\QCXjfym.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\LCpZhhz.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\gCGxWNU.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\fXIGFPw.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\hucDQPL.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\EYsOzHO.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\ykoEHzC.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\fKSmGJg.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\ZXIFJUS.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\wehrnOC.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\JFuiwDQ.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\JZsBONv.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\duiavvQ.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\YAJUcRu.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\qiFkPbv.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\TWZMdae.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\cFgpWpH.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\UlOhnAy.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\WuKjzUt.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\szdUrfw.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\QtHdiWK.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\edYfxoh.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\mrALDpS.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\qSwKkRO.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\QGFSiJL.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\cBIeKJu.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\yqLWCJx.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\UBEoylL.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\yUJfJgo.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\GNnmLRn.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\JiWWeEx.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\HnrTnLu.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\OrEztou.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\cfIrHtQ.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\vvPpySJ.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\UixRYAl.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\hNqsmTB.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\fQwdDZk.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\CdUpRlb.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\teWHmER.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\DwuGNxR.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\xfyDwug.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\cFycvoX.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\sAfTcmF.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\vqGUuFD.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\RvyesFO.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\jWptzMh.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\ZABTqLd.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\PXvSmSG.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\XIJBWvu.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\CjzbZFh.exe	bbcd113629aa0992d714e94019b66c60N.exe
File created	C:\Windows\System\pHybgqc.exe	bbcd113629aa0992d714e94019b66c60N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2964	powershell.exe
2964	powershell.exe
2964	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2888	bbcd113629aa0992d714e94019b66c60N.exe
Token: SeLockMemoryPrivilege	2888	bbcd113629aa0992d714e94019b66c60N.exe
Token: SeDebugPrivilege	2964	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2964	2888	bbcd113629aa0992d714e94019b66c60N.exe	87
PID 2888 wrote to memory of 2964	2888	bbcd113629aa0992d714e94019b66c60N.exe	87
PID 2888 wrote to memory of 3380	2888	bbcd113629aa0992d714e94019b66c60N.exe	88
PID 2888 wrote to memory of 3380	2888	bbcd113629aa0992d714e94019b66c60N.exe	88
PID 2888 wrote to memory of 3048	2888	bbcd113629aa0992d714e94019b66c60N.exe	89
PID 2888 wrote to memory of 3048	2888	bbcd113629aa0992d714e94019b66c60N.exe	89
PID 2888 wrote to memory of 684	2888	bbcd113629aa0992d714e94019b66c60N.exe	90
PID 2888 wrote to memory of 684	2888	bbcd113629aa0992d714e94019b66c60N.exe	90
PID 2888 wrote to memory of 1480	2888	bbcd113629aa0992d714e94019b66c60N.exe	91
PID 2888 wrote to memory of 1480	2888	bbcd113629aa0992d714e94019b66c60N.exe	91
PID 2888 wrote to memory of 4124	2888	bbcd113629aa0992d714e94019b66c60N.exe	92
PID 2888 wrote to memory of 4124	2888	bbcd113629aa0992d714e94019b66c60N.exe	92
PID 2888 wrote to memory of 2180	2888	bbcd113629aa0992d714e94019b66c60N.exe	93
PID 2888 wrote to memory of 2180	2888	bbcd113629aa0992d714e94019b66c60N.exe	93
PID 2888 wrote to memory of 3600	2888	bbcd113629aa0992d714e94019b66c60N.exe	94
PID 2888 wrote to memory of 3600	2888	bbcd113629aa0992d714e94019b66c60N.exe	94
PID 2888 wrote to memory of 4288	2888	bbcd113629aa0992d714e94019b66c60N.exe	95
PID 2888 wrote to memory of 4288	2888	bbcd113629aa0992d714e94019b66c60N.exe	95
PID 2888 wrote to memory of 1612	2888	bbcd113629aa0992d714e94019b66c60N.exe	96
PID 2888 wrote to memory of 1612	2888	bbcd113629aa0992d714e94019b66c60N.exe	96
PID 2888 wrote to memory of 3988	2888	bbcd113629aa0992d714e94019b66c60N.exe	97
PID 2888 wrote to memory of 3988	2888	bbcd113629aa0992d714e94019b66c60N.exe	97
PID 2888 wrote to memory of 2656	2888	bbcd113629aa0992d714e94019b66c60N.exe	98
PID 2888 wrote to memory of 2656	2888	bbcd113629aa0992d714e94019b66c60N.exe	98
PID 2888 wrote to memory of 5004	2888	bbcd113629aa0992d714e94019b66c60N.exe	99
PID 2888 wrote to memory of 5004	2888	bbcd113629aa0992d714e94019b66c60N.exe	99
PID 2888 wrote to memory of 1248	2888	bbcd113629aa0992d714e94019b66c60N.exe	100
PID 2888 wrote to memory of 1248	2888	bbcd113629aa0992d714e94019b66c60N.exe	100
PID 2888 wrote to memory of 2636	2888	bbcd113629aa0992d714e94019b66c60N.exe	101
PID 2888 wrote to memory of 2636	2888	bbcd113629aa0992d714e94019b66c60N.exe	101
PID 2888 wrote to memory of 4748	2888	bbcd113629aa0992d714e94019b66c60N.exe	102
PID 2888 wrote to memory of 4748	2888	bbcd113629aa0992d714e94019b66c60N.exe	102
PID 2888 wrote to memory of 2232	2888	bbcd113629aa0992d714e94019b66c60N.exe	103
PID 2888 wrote to memory of 2232	2888	bbcd113629aa0992d714e94019b66c60N.exe	103
PID 2888 wrote to memory of 3552	2888	bbcd113629aa0992d714e94019b66c60N.exe	104
PID 2888 wrote to memory of 3552	2888	bbcd113629aa0992d714e94019b66c60N.exe	104
PID 2888 wrote to memory of 3196	2888	bbcd113629aa0992d714e94019b66c60N.exe	105
PID 2888 wrote to memory of 3196	2888	bbcd113629aa0992d714e94019b66c60N.exe	105
PID 2888 wrote to memory of 1088	2888	bbcd113629aa0992d714e94019b66c60N.exe	106
PID 2888 wrote to memory of 1088	2888	bbcd113629aa0992d714e94019b66c60N.exe	106
PID 2888 wrote to memory of 3044	2888	bbcd113629aa0992d714e94019b66c60N.exe	107
PID 2888 wrote to memory of 3044	2888	bbcd113629aa0992d714e94019b66c60N.exe	107
PID 2888 wrote to memory of 3408	2888	bbcd113629aa0992d714e94019b66c60N.exe	108
PID 2888 wrote to memory of 3408	2888	bbcd113629aa0992d714e94019b66c60N.exe	108
PID 2888 wrote to memory of 3456	2888	bbcd113629aa0992d714e94019b66c60N.exe	109
PID 2888 wrote to memory of 3456	2888	bbcd113629aa0992d714e94019b66c60N.exe	109
PID 2888 wrote to memory of 3188	2888	bbcd113629aa0992d714e94019b66c60N.exe	110
PID 2888 wrote to memory of 3188	2888	bbcd113629aa0992d714e94019b66c60N.exe	110
PID 2888 wrote to memory of 756	2888	bbcd113629aa0992d714e94019b66c60N.exe	111
PID 2888 wrote to memory of 756	2888	bbcd113629aa0992d714e94019b66c60N.exe	111
PID 2888 wrote to memory of 3584	2888	bbcd113629aa0992d714e94019b66c60N.exe	112
PID 2888 wrote to memory of 3584	2888	bbcd113629aa0992d714e94019b66c60N.exe	112
PID 2888 wrote to memory of 4420	2888	bbcd113629aa0992d714e94019b66c60N.exe	113
PID 2888 wrote to memory of 4420	2888	bbcd113629aa0992d714e94019b66c60N.exe	113
PID 2888 wrote to memory of 3980	2888	bbcd113629aa0992d714e94019b66c60N.exe	114
PID 2888 wrote to memory of 3980	2888	bbcd113629aa0992d714e94019b66c60N.exe	114
PID 2888 wrote to memory of 440	2888	bbcd113629aa0992d714e94019b66c60N.exe	115
PID 2888 wrote to memory of 440	2888	bbcd113629aa0992d714e94019b66c60N.exe	115
PID 2888 wrote to memory of 4380	2888	bbcd113629aa0992d714e94019b66c60N.exe	116
PID 2888 wrote to memory of 4380	2888	bbcd113629aa0992d714e94019b66c60N.exe	116
PID 2888 wrote to memory of 3460	2888	bbcd113629aa0992d714e94019b66c60N.exe	117
PID 2888 wrote to memory of 3460	2888	bbcd113629aa0992d714e94019b66c60N.exe	117
PID 2888 wrote to memory of 1660	2888	bbcd113629aa0992d714e94019b66c60N.exe	118
PID 2888 wrote to memory of 1660	2888	bbcd113629aa0992d714e94019b66c60N.exe	118

C:\Users\Admin\AppData\Local\Temp\bbcd113629aa0992d714e94019b66c60N.exe
"C:\Users\Admin\AppData\Local\Temp\bbcd113629aa0992d714e94019b66c60N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\System\CCDBKpE.exe
  C:\Windows\System\CCDBKpE.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\uZmZUMW.exe
  C:\Windows\System\uZmZUMW.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\lNcsbfs.exe
  C:\Windows\System\lNcsbfs.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\rmcukat.exe
  C:\Windows\System\rmcukat.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\qiFkPbv.exe
  C:\Windows\System\qiFkPbv.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\yanMULv.exe
  C:\Windows\System\yanMULv.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\SjedRBN.exe
  C:\Windows\System\SjedRBN.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\JnefVXb.exe
  C:\Windows\System\JnefVXb.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\RWiruxx.exe
  C:\Windows\System\RWiruxx.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\hbTsWSm.exe
  C:\Windows\System\hbTsWSm.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\EZdNOdz.exe
  C:\Windows\System\EZdNOdz.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\WWrjGUs.exe
  C:\Windows\System\WWrjGUs.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\uKYuSIo.exe
  C:\Windows\System\uKYuSIo.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\wQYWUjW.exe
  C:\Windows\System\wQYWUjW.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\qESGhJV.exe
  C:\Windows\System\qESGhJV.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\sdBYNYt.exe
  C:\Windows\System\sdBYNYt.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\XumQgrh.exe
  C:\Windows\System\XumQgrh.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\yGEvArK.exe
  C:\Windows\System\yGEvArK.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\ZXIFJUS.exe
  C:\Windows\System\ZXIFJUS.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\BxeRUAW.exe
  C:\Windows\System\BxeRUAW.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\WCQOgyR.exe
  C:\Windows\System\WCQOgyR.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\TfifSJw.exe
  C:\Windows\System\TfifSJw.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\amvKGpJ.exe
  C:\Windows\System\amvKGpJ.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\TjbuaHi.exe
  C:\Windows\System\TjbuaHi.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\gakrMDq.exe
  C:\Windows\System\gakrMDq.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\nHaDeKI.exe
  C:\Windows\System\nHaDeKI.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\KbqOCNS.exe
  C:\Windows\System\KbqOCNS.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\GBuhccl.exe
  C:\Windows\System\GBuhccl.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\IwiIIiG.exe
  C:\Windows\System\IwiIIiG.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\ypWgIiX.exe
  C:\Windows\System\ypWgIiX.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\bnkqNOj.exe
  C:\Windows\System\bnkqNOj.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\nleGYLJ.exe
  C:\Windows\System\nleGYLJ.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\pINVsRD.exe
  C:\Windows\System\pINVsRD.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\WXEDiUW.exe
  C:\Windows\System\WXEDiUW.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\EugvtsK.exe
  C:\Windows\System\EugvtsK.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\CtnVMdE.exe
  C:\Windows\System\CtnVMdE.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\YvGUpxq.exe
  C:\Windows\System\YvGUpxq.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\sYgGpHV.exe
  C:\Windows\System\sYgGpHV.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\ZHcRAmy.exe
  C:\Windows\System\ZHcRAmy.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\NrovacV.exe
  C:\Windows\System\NrovacV.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\IWENHsb.exe
  C:\Windows\System\IWENHsb.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\OMUIGZC.exe
  C:\Windows\System\OMUIGZC.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\tPuQGtH.exe
  C:\Windows\System\tPuQGtH.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\QMUAXfz.exe
  C:\Windows\System\QMUAXfz.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\XpFQaUE.exe
  C:\Windows\System\XpFQaUE.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\oPReZic.exe
  C:\Windows\System\oPReZic.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\rnWyvPT.exe
  C:\Windows\System\rnWyvPT.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\OaQRAaJ.exe
  C:\Windows\System\OaQRAaJ.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\DryyEpU.exe
  C:\Windows\System\DryyEpU.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\uaWaSVN.exe
  C:\Windows\System\uaWaSVN.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\VpxZpcT.exe
  C:\Windows\System\VpxZpcT.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\ZFIcWWe.exe
  C:\Windows\System\ZFIcWWe.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\jJmFZVI.exe
  C:\Windows\System\jJmFZVI.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\Kcgglku.exe
  C:\Windows\System\Kcgglku.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\omeBgVZ.exe
  C:\Windows\System\omeBgVZ.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\EWxyYuK.exe
  C:\Windows\System\EWxyYuK.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\fXIGFPw.exe
  C:\Windows\System\fXIGFPw.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\JFnkHeD.exe
  C:\Windows\System\JFnkHeD.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\DpTXymU.exe
  C:\Windows\System\DpTXymU.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\dVJuGQR.exe
  C:\Windows\System\dVJuGQR.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\sGzZxAk.exe
  C:\Windows\System\sGzZxAk.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\EAXbTsb.exe
  C:\Windows\System\EAXbTsb.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\BOCdsDR.exe
  C:\Windows\System\BOCdsDR.exe
  2⤵
  PID:1104
- C:\Windows\System\kDenamM.exe
  C:\Windows\System\kDenamM.exe
  2⤵
  PID:1716
- C:\Windows\System\SRwatff.exe
  C:\Windows\System\SRwatff.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\kXPySSM.exe
  C:\Windows\System\kXPySSM.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\lmVHxOy.exe
  C:\Windows\System\lmVHxOy.exe
  2⤵
  PID:4588
- C:\Windows\System\mcjPeHI.exe
  C:\Windows\System\mcjPeHI.exe
  2⤵
  PID:32
- C:\Windows\System\nxHnlCB.exe
  C:\Windows\System\nxHnlCB.exe
  2⤵
  PID:212
- C:\Windows\System\cShLFWD.exe
  C:\Windows\System\cShLFWD.exe
  2⤵
  PID:4244
- C:\Windows\System\VtnakEE.exe
  C:\Windows\System\VtnakEE.exe
  2⤵
  PID:3176
- C:\Windows\System\NjNbbcS.exe
  C:\Windows\System\NjNbbcS.exe
  2⤵
  PID:4536
- C:\Windows\System\FyjuKre.exe
  C:\Windows\System\FyjuKre.exe
  2⤵
  PID:1672
- C:\Windows\System\DcGcwOE.exe
  C:\Windows\System\DcGcwOE.exe
  2⤵
  PID:2188
- C:\Windows\System\WuauCCX.exe
  C:\Windows\System\WuauCCX.exe
  2⤵
  PID:4052
- C:\Windows\System\LUUFyvS.exe
  C:\Windows\System\LUUFyvS.exe
  2⤵
  PID:2120
- C:\Windows\System\NqYGtgH.exe
  C:\Windows\System\NqYGtgH.exe
  2⤵
  PID:540
- C:\Windows\System\ujoFUMf.exe
  C:\Windows\System\ujoFUMf.exe
  2⤵
  PID:1896
- C:\Windows\System\IMVDqWo.exe
  C:\Windows\System\IMVDqWo.exe
  2⤵
  PID:5116
- C:\Windows\System\PGxMLxr.exe
  C:\Windows\System\PGxMLxr.exe
  2⤵
  PID:3748
- C:\Windows\System\qadkHsm.exe
  C:\Windows\System\qadkHsm.exe
  2⤵
  PID:2076
- C:\Windows\System\vKDqBDL.exe
  C:\Windows\System\vKDqBDL.exe
  2⤵
  PID:3704
- C:\Windows\System\leyAgvo.exe
  C:\Windows\System\leyAgvo.exe
  2⤵
  PID:4396
- C:\Windows\System\wehrnOC.exe
  C:\Windows\System\wehrnOC.exe
  2⤵
  PID:5012
- C:\Windows\System\CzXZBSJ.exe
  C:\Windows\System\CzXZBSJ.exe
  2⤵
  PID:2568
- C:\Windows\System\MbBFDzO.exe
  C:\Windows\System\MbBFDzO.exe
  2⤵
  PID:908
- C:\Windows\System\NeXDpBf.exe
  C:\Windows\System\NeXDpBf.exe
  2⤵
  PID:884
- C:\Windows\System\CGMDoCE.exe
  C:\Windows\System\CGMDoCE.exe
  2⤵
  PID:3832
- C:\Windows\System\fPENrFb.exe
  C:\Windows\System\fPENrFb.exe
  2⤵
  PID:5132
- C:\Windows\System\BAYZNCP.exe
  C:\Windows\System\BAYZNCP.exe
  2⤵
  PID:5156
- C:\Windows\System\fPylmEV.exe
  C:\Windows\System\fPylmEV.exe
  2⤵
  PID:5172
- C:\Windows\System\epirAsj.exe
  C:\Windows\System\epirAsj.exe
  2⤵
  PID:5196
- C:\Windows\System\hoUFiUf.exe
  C:\Windows\System\hoUFiUf.exe
  2⤵
  PID:5216
- C:\Windows\System\iGNDUMv.exe
  C:\Windows\System\iGNDUMv.exe
  2⤵
  PID:5236
- C:\Windows\System\TsIZZCs.exe
  C:\Windows\System\TsIZZCs.exe
  2⤵
  PID:5256
- C:\Windows\System\ZbPTNtw.exe
  C:\Windows\System\ZbPTNtw.exe
  2⤵
  PID:5272
- C:\Windows\System\dyPCjAg.exe
  C:\Windows\System\dyPCjAg.exe
  2⤵
  PID:5304
- C:\Windows\System\glzOFUk.exe
  C:\Windows\System\glzOFUk.exe
  2⤵
  PID:5324
- C:\Windows\System\UQULMMM.exe
  C:\Windows\System\UQULMMM.exe
  2⤵
  PID:5344
- C:\Windows\System\YakGqzJ.exe
  C:\Windows\System\YakGqzJ.exe
  2⤵
  PID:5368
- C:\Windows\System\AUIeKfh.exe
  C:\Windows\System\AUIeKfh.exe
  2⤵
  PID:5384
- C:\Windows\System\CzjRbHj.exe
  C:\Windows\System\CzjRbHj.exe
  2⤵
  PID:5408
- C:\Windows\System\yWlkNYi.exe
  C:\Windows\System\yWlkNYi.exe
  2⤵
  PID:5424
- C:\Windows\System\lTlopfH.exe
  C:\Windows\System\lTlopfH.exe
  2⤵
  PID:5460
- C:\Windows\System\tSsZkZE.exe
  C:\Windows\System\tSsZkZE.exe
  2⤵
  PID:5480
- C:\Windows\System\arSmPqq.exe
  C:\Windows\System\arSmPqq.exe
  2⤵
  PID:5500
- C:\Windows\System\YmDQUKE.exe
  C:\Windows\System\YmDQUKE.exe
  2⤵
  PID:5524
- C:\Windows\System\GvIbVhm.exe
  C:\Windows\System\GvIbVhm.exe
  2⤵
  PID:5552
- C:\Windows\System\BCMBuZW.exe
  C:\Windows\System\BCMBuZW.exe
  2⤵
  PID:5588
- C:\Windows\System\acZbjaA.exe
  C:\Windows\System\acZbjaA.exe
  2⤵
  PID:5604
- C:\Windows\System\wDqnwNx.exe
  C:\Windows\System\wDqnwNx.exe
  2⤵
  PID:5628
- C:\Windows\System\oxYopLU.exe
  C:\Windows\System\oxYopLU.exe
  2⤵
  PID:5644
- C:\Windows\System\dfKiajA.exe
  C:\Windows\System\dfKiajA.exe
  2⤵
  PID:5672
- C:\Windows\System\PTPlgfN.exe
  C:\Windows\System\PTPlgfN.exe
  2⤵
  PID:5704
- C:\Windows\System\lIOlZRJ.exe
  C:\Windows\System\lIOlZRJ.exe
  2⤵
  PID:5720
- C:\Windows\System\HBlnBRs.exe
  C:\Windows\System\HBlnBRs.exe
  2⤵
  PID:5736
- C:\Windows\System\kAqPYkZ.exe
  C:\Windows\System\kAqPYkZ.exe
  2⤵
  PID:5760
- C:\Windows\System\yEpORfK.exe
  C:\Windows\System\yEpORfK.exe
  2⤵
  PID:5780
- C:\Windows\System\czRQRkM.exe
  C:\Windows\System\czRQRkM.exe
  2⤵
  PID:5796
- C:\Windows\System\udcAGnz.exe
  C:\Windows\System\udcAGnz.exe
  2⤵
  PID:5820
- C:\Windows\System\YJDGSUN.exe
  C:\Windows\System\YJDGSUN.exe
  2⤵
  PID:5836
- C:\Windows\System\JRJZIWD.exe
  C:\Windows\System\JRJZIWD.exe
  2⤵
  PID:5860
- C:\Windows\System\aJLltJU.exe
  C:\Windows\System\aJLltJU.exe
  2⤵
  PID:5880
- C:\Windows\System\migyYbD.exe
  C:\Windows\System\migyYbD.exe
  2⤵
  PID:5896
- C:\Windows\System\GXYfMzR.exe
  C:\Windows\System\GXYfMzR.exe
  2⤵
  PID:5924
- C:\Windows\System\pPCUaNb.exe
  C:\Windows\System\pPCUaNb.exe
  2⤵
  PID:5940
- C:\Windows\System\bSfkTAh.exe
  C:\Windows\System\bSfkTAh.exe
  2⤵
  PID:5968
- C:\Windows\System\TZsKpoV.exe
  C:\Windows\System\TZsKpoV.exe
  2⤵
  PID:5984
- C:\Windows\System\ALonYbX.exe
  C:\Windows\System\ALonYbX.exe
  2⤵
  PID:6004
- C:\Windows\System\SqgWuDe.exe
  C:\Windows\System\SqgWuDe.exe
  2⤵
  PID:6020
- C:\Windows\System\MhUglEX.exe
  C:\Windows\System\MhUglEX.exe
  2⤵
  PID:6036
- C:\Windows\System\PplAURc.exe
  C:\Windows\System\PplAURc.exe
  2⤵
  PID:6060
- C:\Windows\System\plBEcsa.exe
  C:\Windows\System\plBEcsa.exe
  2⤵
  PID:6084
- C:\Windows\System\BVNBCKn.exe
  C:\Windows\System\BVNBCKn.exe
  2⤵
  PID:6116
- C:\Windows\System\OeHwitk.exe
  C:\Windows\System\OeHwitk.exe
  2⤵
  PID:6132
- C:\Windows\System\xvUBTcn.exe
  C:\Windows\System\xvUBTcn.exe
  2⤵
  PID:1148
- C:\Windows\System\XwSctaU.exe
  C:\Windows\System\XwSctaU.exe
  2⤵
  PID:3816
- C:\Windows\System\ROlugHK.exe
  C:\Windows\System\ROlugHK.exe
  2⤵
  PID:4492
- C:\Windows\System\LLshcyd.exe
  C:\Windows\System\LLshcyd.exe
  2⤵
  PID:3472
- C:\Windows\System\hNfvZUh.exe
  C:\Windows\System\hNfvZUh.exe
  2⤵
  PID:3528
- C:\Windows\System\TUtUxjo.exe
  C:\Windows\System\TUtUxjo.exe
  2⤵
  PID:2732
- C:\Windows\System\JlnkJfM.exe
  C:\Windows\System\JlnkJfM.exe
  2⤵
  PID:3412
- C:\Windows\System\njmriYo.exe
  C:\Windows\System\njmriYo.exe
  2⤵
  PID:3920
- C:\Windows\System\XoNGjqQ.exe
  C:\Windows\System\XoNGjqQ.exe
  2⤵
  PID:3900
- C:\Windows\System\TZelBLs.exe
  C:\Windows\System\TZelBLs.exe
  2⤵
  PID:4732
- C:\Windows\System\PMDTEeD.exe
  C:\Windows\System\PMDTEeD.exe
  2⤵
  PID:5144
- C:\Windows\System\ROgwZxe.exe
  C:\Windows\System\ROgwZxe.exe
  2⤵
  PID:1952
- C:\Windows\System\GaDKKxa.exe
  C:\Windows\System\GaDKKxa.exe
  2⤵
  PID:4348
- C:\Windows\System\mNvLTZY.exe
  C:\Windows\System\mNvLTZY.exe
  2⤵
  PID:1160
- C:\Windows\System\bPzDjzh.exe
  C:\Windows\System\bPzDjzh.exe
  2⤵
  PID:5376
- C:\Windows\System\VRZMkKK.exe
  C:\Windows\System\VRZMkKK.exe
  2⤵
  PID:4832
- C:\Windows\System\gWxizMn.exe
  C:\Windows\System\gWxizMn.exe
  2⤵
  PID:3360
- C:\Windows\System\lXSAKMQ.exe
  C:\Windows\System\lXSAKMQ.exe
  2⤵
  PID:6148
- C:\Windows\System\jTeRRRY.exe
  C:\Windows\System\jTeRRRY.exe
  2⤵
  PID:6164
- C:\Windows\System\EtHnMvP.exe
  C:\Windows\System\EtHnMvP.exe
  2⤵
  PID:6188
- C:\Windows\System\snPZLlS.exe
  C:\Windows\System\snPZLlS.exe
  2⤵
  PID:6204
- C:\Windows\System\mCHdeJr.exe
  C:\Windows\System\mCHdeJr.exe
  2⤵
  PID:6228
- C:\Windows\System\tSKDsvD.exe
  C:\Windows\System\tSKDsvD.exe
  2⤵
  PID:6244
- C:\Windows\System\hoXdMMy.exe
  C:\Windows\System\hoXdMMy.exe
  2⤵
  PID:6268
- C:\Windows\System\GDlFrOj.exe
  C:\Windows\System\GDlFrOj.exe
  2⤵
  PID:6284
- C:\Windows\System\uogTign.exe
  C:\Windows\System\uogTign.exe
  2⤵
  PID:6304
- C:\Windows\System\ekGqBjh.exe
  C:\Windows\System\ekGqBjh.exe
  2⤵
  PID:6320
- C:\Windows\System\bwZxYUk.exe
  C:\Windows\System\bwZxYUk.exe
  2⤵
  PID:6340
- C:\Windows\System\cLPgIpf.exe
  C:\Windows\System\cLPgIpf.exe
  2⤵
  PID:6356
- C:\Windows\System\vTHCMBn.exe
  C:\Windows\System\vTHCMBn.exe
  2⤵
  PID:6384
- C:\Windows\System\BCQwvcp.exe
  C:\Windows\System\BCQwvcp.exe
  2⤵
  PID:6404
- C:\Windows\System\EAUcdEu.exe
  C:\Windows\System\EAUcdEu.exe
  2⤵
  PID:6428
- C:\Windows\System\QMeLmsz.exe
  C:\Windows\System\QMeLmsz.exe
  2⤵
  PID:6448
- C:\Windows\System\EubudaS.exe
  C:\Windows\System\EubudaS.exe
  2⤵
  PID:6468
- C:\Windows\System\WwqLRJo.exe
  C:\Windows\System\WwqLRJo.exe
  2⤵
  PID:6488
- C:\Windows\System\uGFCkxv.exe
  C:\Windows\System\uGFCkxv.exe
  2⤵
  PID:6504
- C:\Windows\System\RVyDvUB.exe
  C:\Windows\System\RVyDvUB.exe
  2⤵
  PID:6524
- C:\Windows\System\DNzYjSr.exe
  C:\Windows\System\DNzYjSr.exe
  2⤵
  PID:6544
- C:\Windows\System\aYjAlHa.exe
  C:\Windows\System\aYjAlHa.exe
  2⤵
  PID:6560
- C:\Windows\System\ZVVExoL.exe
  C:\Windows\System\ZVVExoL.exe
  2⤵
  PID:6584
- C:\Windows\System\hRxtoym.exe
  C:\Windows\System\hRxtoym.exe
  2⤵
  PID:6608
- C:\Windows\System\ABBjXXE.exe
  C:\Windows\System\ABBjXXE.exe
  2⤵
  PID:6628
- C:\Windows\System\XKFTQYR.exe
  C:\Windows\System\XKFTQYR.exe
  2⤵
  PID:6644
- C:\Windows\System\NBnCeUy.exe
  C:\Windows\System\NBnCeUy.exe
  2⤵
  PID:6668
- C:\Windows\System\XYINPlS.exe
  C:\Windows\System\XYINPlS.exe
  2⤵
  PID:6684
- C:\Windows\System\eZKExfx.exe
  C:\Windows\System\eZKExfx.exe
  2⤵
  PID:6712
- C:\Windows\System\vYgghPG.exe
  C:\Windows\System\vYgghPG.exe
  2⤵
  PID:6728
- C:\Windows\System\tzPQtbD.exe
  C:\Windows\System\tzPQtbD.exe
  2⤵
  PID:6752
- C:\Windows\System\YyMhSKC.exe
  C:\Windows\System\YyMhSKC.exe
  2⤵
  PID:6768
- C:\Windows\System\mrALDpS.exe
  C:\Windows\System\mrALDpS.exe
  2⤵
  PID:6796
- C:\Windows\System\VmrNnoy.exe
  C:\Windows\System\VmrNnoy.exe
  2⤵
  PID:6812
- C:\Windows\System\VlJqSjr.exe
  C:\Windows\System\VlJqSjr.exe
  2⤵
  PID:6836
- C:\Windows\System\sKxipie.exe
  C:\Windows\System\sKxipie.exe
  2⤵
  PID:6856
- C:\Windows\System\zFRwhlF.exe
  C:\Windows\System\zFRwhlF.exe
  2⤵
  PID:6872
- C:\Windows\System\pwiSMKo.exe
  C:\Windows\System\pwiSMKo.exe
  2⤵
  PID:6900
- C:\Windows\System\ceYonaN.exe
  C:\Windows\System\ceYonaN.exe
  2⤵
  PID:6916
- C:\Windows\System\WvyouIx.exe
  C:\Windows\System\WvyouIx.exe
  2⤵
  PID:6936
- C:\Windows\System\URWVnYI.exe
  C:\Windows\System\URWVnYI.exe
  2⤵
  PID:6956
- C:\Windows\System\fZmjnQS.exe
  C:\Windows\System\fZmjnQS.exe
  2⤵
  PID:6972
- C:\Windows\System\HhrjSpC.exe
  C:\Windows\System\HhrjSpC.exe
  2⤵
  PID:7000
- C:\Windows\System\eFuBFkc.exe
  C:\Windows\System\eFuBFkc.exe
  2⤵
  PID:7020
- C:\Windows\System\GWQDdlF.exe
  C:\Windows\System\GWQDdlF.exe
  2⤵
  PID:7036
- C:\Windows\System\mPcEDAE.exe
  C:\Windows\System\mPcEDAE.exe
  2⤵
  PID:7056
- C:\Windows\System\dmFNYzo.exe
  C:\Windows\System\dmFNYzo.exe
  2⤵
  PID:7072
- C:\Windows\System\UdgdcTT.exe
  C:\Windows\System\UdgdcTT.exe
  2⤵
  PID:7092
- C:\Windows\System\bWEbYqD.exe
  C:\Windows\System\bWEbYqD.exe
  2⤵
  PID:7116
- C:\Windows\System\GJpuyam.exe
  C:\Windows\System\GJpuyam.exe
  2⤵
  PID:7136
- C:\Windows\System\HSHirBq.exe
  C:\Windows\System\HSHirBq.exe
  2⤵
  PID:5468
- C:\Windows\System\hBllZmh.exe
  C:\Windows\System\hBllZmh.exe
  2⤵
  PID:5600
- C:\Windows\System\pnmoktU.exe
  C:\Windows\System\pnmoktU.exe
  2⤵
  PID:3912
- C:\Windows\System\qntTMPK.exe
  C:\Windows\System\qntTMPK.exe
  2⤵
  PID:5792
- C:\Windows\System\sNiMbkE.exe
  C:\Windows\System\sNiMbkE.exe
  2⤵
  PID:5916
- C:\Windows\System\SefWMtL.exe
  C:\Windows\System\SefWMtL.exe
  2⤵
  PID:5192
- C:\Windows\System\ZbmlWzf.exe
  C:\Windows\System\ZbmlWzf.exe
  2⤵
  PID:6044
- C:\Windows\System\nnnGQwm.exe
  C:\Windows\System\nnnGQwm.exe
  2⤵
  PID:5252
- C:\Windows\System\RXYvQqi.exe
  C:\Windows\System\RXYvQqi.exe
  2⤵
  PID:1524
- C:\Windows\System\QhLwYRe.exe
  C:\Windows\System\QhLwYRe.exe
  2⤵
  PID:4960
- C:\Windows\System\lkXbGqd.exe
  C:\Windows\System\lkXbGqd.exe
  2⤵
  PID:5420
- C:\Windows\System\fSkhmko.exe
  C:\Windows\System\fSkhmko.exe
  2⤵
  PID:4496
- C:\Windows\System\riemmwu.exe
  C:\Windows\System\riemmwu.exe
  2⤵
  PID:4140
- C:\Windows\System\ywXwMlS.exe
  C:\Windows\System\ywXwMlS.exe
  2⤵
  PID:5052
- C:\Windows\System\EKqehQN.exe
  C:\Windows\System\EKqehQN.exe
  2⤵
  PID:6212
- C:\Windows\System\AeRoPfM.exe
  C:\Windows\System\AeRoPfM.exe
  2⤵
  PID:6156
- C:\Windows\System\wotiIBj.exe
  C:\Windows\System\wotiIBj.exe
  2⤵
  PID:6328
- C:\Windows\System\bdMLiLZ.exe
  C:\Windows\System\bdMLiLZ.exe
  2⤵
  PID:7180
- C:\Windows\System\TYqiEsy.exe
  C:\Windows\System\TYqiEsy.exe
  2⤵
  PID:7200
- C:\Windows\System\JFuiwDQ.exe
  C:\Windows\System\JFuiwDQ.exe
  2⤵
  PID:7220
- C:\Windows\System\cjtVUCF.exe
  C:\Windows\System\cjtVUCF.exe
  2⤵
  PID:7240
- C:\Windows\System\nELCaao.exe
  C:\Windows\System\nELCaao.exe
  2⤵
  PID:7260
- C:\Windows\System\cdAItxW.exe
  C:\Windows\System\cdAItxW.exe
  2⤵
  PID:7276
- C:\Windows\System\bpbdvBE.exe
  C:\Windows\System\bpbdvBE.exe
  2⤵
  PID:7300
- C:\Windows\System\RkWhamW.exe
  C:\Windows\System\RkWhamW.exe
  2⤵
  PID:7320
- C:\Windows\System\JbRJdpu.exe
  C:\Windows\System\JbRJdpu.exe
  2⤵
  PID:7340
- C:\Windows\System\qnCAQho.exe
  C:\Windows\System\qnCAQho.exe
  2⤵
  PID:7368
- C:\Windows\System\xYovsiN.exe
  C:\Windows\System\xYovsiN.exe
  2⤵
  PID:7384
- C:\Windows\System\nOSPxUj.exe
  C:\Windows\System\nOSPxUj.exe
  2⤵
  PID:7404
- C:\Windows\System\jLNgsBi.exe
  C:\Windows\System\jLNgsBi.exe
  2⤵
  PID:7424
- C:\Windows\System\khoKydx.exe
  C:\Windows\System\khoKydx.exe
  2⤵
  PID:7448
- C:\Windows\System\lyWaKkq.exe
  C:\Windows\System\lyWaKkq.exe
  2⤵
  PID:7472
- C:\Windows\System\tHwSeYZ.exe
  C:\Windows\System\tHwSeYZ.exe
  2⤵
  PID:7508
- C:\Windows\System\RLTIsBl.exe
  C:\Windows\System\RLTIsBl.exe
  2⤵
  PID:7532
- C:\Windows\System\FYrhuhD.exe
  C:\Windows\System\FYrhuhD.exe
  2⤵
  PID:7552
- C:\Windows\System\wDwtvKs.exe
  C:\Windows\System\wDwtvKs.exe
  2⤵
  PID:7580
- C:\Windows\System\BfOAxUx.exe
  C:\Windows\System\BfOAxUx.exe
  2⤵
  PID:7596
- C:\Windows\System\JLGEsBL.exe
  C:\Windows\System\JLGEsBL.exe
  2⤵
  PID:7616
- C:\Windows\System\hDObRPx.exe
  C:\Windows\System\hDObRPx.exe
  2⤵
  PID:7636
- C:\Windows\System\XNMjhED.exe
  C:\Windows\System\XNMjhED.exe
  2⤵
  PID:7656
- C:\Windows\System\hKwSSmt.exe
  C:\Windows\System\hKwSSmt.exe
  2⤵
  PID:7676
- C:\Windows\System\dHijhKB.exe
  C:\Windows\System\dHijhKB.exe
  2⤵
  PID:7696
- C:\Windows\System\vnObzwY.exe
  C:\Windows\System\vnObzwY.exe
  2⤵
  PID:7716
- C:\Windows\System\mSCuApc.exe
  C:\Windows\System\mSCuApc.exe
  2⤵
  PID:7736
- C:\Windows\System\AObbVob.exe
  C:\Windows\System\AObbVob.exe
  2⤵
  PID:7760
- C:\Windows\System\yIYrEdv.exe
  C:\Windows\System\yIYrEdv.exe
  2⤵
  PID:7780
- C:\Windows\System\SoQnkAs.exe
  C:\Windows\System\SoQnkAs.exe
  2⤵
  PID:7796
- C:\Windows\System\UsHaUxP.exe
  C:\Windows\System\UsHaUxP.exe
  2⤵
  PID:7820
- C:\Windows\System\PLzcYBx.exe
  C:\Windows\System\PLzcYBx.exe
  2⤵
  PID:7836
- C:\Windows\System\JRZjWft.exe
  C:\Windows\System\JRZjWft.exe
  2⤵
  PID:7860
- C:\Windows\System\bjrbTrn.exe
  C:\Windows\System\bjrbTrn.exe
  2⤵
  PID:7880
- C:\Windows\System\aBifRRV.exe
  C:\Windows\System\aBifRRV.exe
  2⤵
  PID:7896
- C:\Windows\System\KATwqhu.exe
  C:\Windows\System\KATwqhu.exe
  2⤵
  PID:7916
- C:\Windows\System\BnwnUcP.exe
  C:\Windows\System\BnwnUcP.exe
  2⤵
  PID:7936
- C:\Windows\System\pNLyVdJ.exe
  C:\Windows\System\pNLyVdJ.exe
  2⤵
  PID:7956
- C:\Windows\System\oSxnpsA.exe
  C:\Windows\System\oSxnpsA.exe
  2⤵
  PID:7976
- C:\Windows\System\WSXIZJk.exe
  C:\Windows\System\WSXIZJk.exe
  2⤵
  PID:7996
- C:\Windows\System\mMBPbQl.exe
  C:\Windows\System\mMBPbQl.exe
  2⤵
  PID:8016
- C:\Windows\System\PAglIhI.exe
  C:\Windows\System\PAglIhI.exe
  2⤵
  PID:8036
- C:\Windows\System\iYJHHOa.exe
  C:\Windows\System\iYJHHOa.exe
  2⤵
  PID:8052
- C:\Windows\System\alavuqa.exe
  C:\Windows\System\alavuqa.exe
  2⤵
  PID:8076
- C:\Windows\System\bYgXbCZ.exe
  C:\Windows\System\bYgXbCZ.exe
  2⤵
  PID:8100
- C:\Windows\System\IuBFuHG.exe
  C:\Windows\System\IuBFuHG.exe
  2⤵
  PID:8116
- C:\Windows\System\bOxkZUA.exe
  C:\Windows\System\bOxkZUA.exe
  2⤵
  PID:8140
- C:\Windows\System\PqStfbl.exe
  C:\Windows\System\PqStfbl.exe
  2⤵
  PID:8164
- C:\Windows\System\CsNXbJe.exe
  C:\Windows\System\CsNXbJe.exe
  2⤵
  PID:8180
- C:\Windows\System\SUcuPSz.exe
  C:\Windows\System\SUcuPSz.exe
  2⤵
  PID:6368
- C:\Windows\System\oXpaAIE.exe
  C:\Windows\System\oXpaAIE.exe
  2⤵
  PID:6396
- C:\Windows\System\aHlxLEJ.exe
  C:\Windows\System\aHlxLEJ.exe
  2⤵
  PID:6456
- C:\Windows\System\UWgQzEF.exe
  C:\Windows\System\UWgQzEF.exe
  2⤵
  PID:4760
- C:\Windows\System\oBVlvUn.exe
  C:\Windows\System\oBVlvUn.exe
  2⤵
  PID:6636
- C:\Windows\System\HccPqmf.exe
  C:\Windows\System\HccPqmf.exe
  2⤵
  PID:6664
- C:\Windows\System\pJAMIKw.exe
  C:\Windows\System\pJAMIKw.exe
  2⤵
  PID:6760
- C:\Windows\System\xfizOCU.exe
  C:\Windows\System\xfizOCU.exe
  2⤵
  PID:6804
- C:\Windows\System\rFQYTXF.exe
  C:\Windows\System\rFQYTXF.exe
  2⤵
  PID:6828
- C:\Windows\System\dozTZWv.exe
  C:\Windows\System\dozTZWv.exe
  2⤵
  PID:6868
- C:\Windows\System\nXmPzgy.exe
  C:\Windows\System\nXmPzgy.exe
  2⤵
  PID:5224
- C:\Windows\System\UyCciFr.exe
  C:\Windows\System\UyCciFr.exe
  2⤵
  PID:6052
- C:\Windows\System\VpqpnVM.exe
  C:\Windows\System\VpqpnVM.exe
  2⤵
  PID:7008
- C:\Windows\System\xvZpuoy.exe
  C:\Windows\System\xvZpuoy.exe
  2⤵
  PID:7088
- C:\Windows\System\MYHUBzG.exe
  C:\Windows\System\MYHUBzG.exe
  2⤵
  PID:7124
- C:\Windows\System\IyLdBOY.exe
  C:\Windows\System\IyLdBOY.exe
  2⤵
  PID:5296
- C:\Windows\System\DLTOPcb.exe
  C:\Windows\System\DLTOPcb.exe
  2⤵
  PID:5352
- C:\Windows\System\nsJxPkO.exe
  C:\Windows\System\nsJxPkO.exe
  2⤵
  PID:1788
- C:\Windows\System\hlZFWmY.exe
  C:\Windows\System\hlZFWmY.exe
  2⤵
  PID:8336
- C:\Windows\System\DPmAweL.exe
  C:\Windows\System\DPmAweL.exe
  2⤵
  PID:8352
- C:\Windows\System\sdGOvYN.exe
  C:\Windows\System\sdGOvYN.exe
  2⤵
  PID:8724
- C:\Windows\System\LWYpGWW.exe
  C:\Windows\System\LWYpGWW.exe
  2⤵
  PID:8868
- C:\Windows\System\gRgISgP.exe
  C:\Windows\System\gRgISgP.exe
  2⤵
  PID:8972
- C:\Windows\System\UWWaute.exe
  C:\Windows\System\UWWaute.exe
  2⤵
  PID:9052
- C:\Windows\System\JnWJqtc.exe
  C:\Windows\System\JnWJqtc.exe
  2⤵
  PID:9092
- C:\Windows\System\rFTqIFA.exe
  C:\Windows\System\rFTqIFA.exe
  2⤵
  PID:9116
- C:\Windows\System\xfyDwug.exe
  C:\Windows\System\xfyDwug.exe
  2⤵
  PID:9136
- C:\Windows\System\WibUINo.exe
  C:\Windows\System\WibUINo.exe
  2⤵
  PID:9164
- C:\Windows\System\aUofKEo.exe
  C:\Windows\System\aUofKEo.exe
  2⤵
  PID:9180
- C:\Windows\System\MBnIbWu.exe
  C:\Windows\System\MBnIbWu.exe
  2⤵
  PID:9200
- C:\Windows\System\TCIEKyy.exe
  C:\Windows\System\TCIEKyy.exe
  2⤵
  PID:2596
- C:\Windows\System\oHDUEKW.exe
  C:\Windows\System\oHDUEKW.exe
  2⤵
  PID:9224
- C:\Windows\System\WtDUHId.exe
  C:\Windows\System\WtDUHId.exe
  2⤵
  PID:9244
- C:\Windows\System\npPasVf.exe
  C:\Windows\System\npPasVf.exe
  2⤵
  PID:9268
- C:\Windows\System\aIGhpNJ.exe
  C:\Windows\System\aIGhpNJ.exe
  2⤵
  PID:9284
- C:\Windows\System\mJhlWUi.exe
  C:\Windows\System\mJhlWUi.exe
  2⤵
  PID:9308
- C:\Windows\System\fIekGJz.exe
  C:\Windows\System\fIekGJz.exe
  2⤵
  PID:9324
- C:\Windows\System\XGLicvL.exe
  C:\Windows\System\XGLicvL.exe
  2⤵
  PID:9344
- C:\Windows\System\cFycvoX.exe
  C:\Windows\System\cFycvoX.exe
  2⤵
  PID:9360
- C:\Windows\System\slWGjgF.exe
  C:\Windows\System\slWGjgF.exe
  2⤵
  PID:9380
- C:\Windows\System\fKDcbAh.exe
  C:\Windows\System\fKDcbAh.exe
  2⤵
  PID:9400
- C:\Windows\System\foCMjjK.exe
  C:\Windows\System\foCMjjK.exe
  2⤵
  PID:9420
- C:\Windows\System\RJmnhCM.exe
  C:\Windows\System\RJmnhCM.exe
  2⤵
  PID:9440
- C:\Windows\System\kLFMvvM.exe
  C:\Windows\System\kLFMvvM.exe
  2⤵
  PID:9456
- C:\Windows\System\gwXgMQr.exe
  C:\Windows\System\gwXgMQr.exe
  2⤵
  PID:9476
- C:\Windows\System\PXvSmSG.exe
  C:\Windows\System\PXvSmSG.exe
  2⤵
  PID:9496
- C:\Windows\System\hVVxwSG.exe
  C:\Windows\System\hVVxwSG.exe
  2⤵
  PID:9516
- C:\Windows\System\qrbDfBl.exe
  C:\Windows\System\qrbDfBl.exe
  2⤵
  PID:9536
- C:\Windows\System\XPOIzjX.exe
  C:\Windows\System\XPOIzjX.exe
  2⤵
  PID:9552
- C:\Windows\System\UBEoylL.exe
  C:\Windows\System\UBEoylL.exe
  2⤵
  PID:9572
- C:\Windows\System\ZCskpOv.exe
  C:\Windows\System\ZCskpOv.exe
  2⤵
  PID:9592
- C:\Windows\System\fAIdNPY.exe
  C:\Windows\System\fAIdNPY.exe
  2⤵
  PID:9612
- C:\Windows\System\EhnfbgP.exe
  C:\Windows\System\EhnfbgP.exe
  2⤵
  PID:9632
- C:\Windows\System\ZogxpSJ.exe
  C:\Windows\System\ZogxpSJ.exe
  2⤵
  PID:9648
- C:\Windows\System\YMHMhgA.exe
  C:\Windows\System\YMHMhgA.exe
  2⤵
  PID:9668
- C:\Windows\System\vzHwDpn.exe
  C:\Windows\System\vzHwDpn.exe
  2⤵
  PID:9688
- C:\Windows\System\XYEEQcQ.exe
  C:\Windows\System\XYEEQcQ.exe
  2⤵
  PID:9708
- C:\Windows\System\rRhLzGo.exe
  C:\Windows\System\rRhLzGo.exe
  2⤵
  PID:9724
- C:\Windows\System\sDmEAvT.exe
  C:\Windows\System\sDmEAvT.exe
  2⤵
  PID:9744
- C:\Windows\System\FkhHUPS.exe
  C:\Windows\System\FkhHUPS.exe
  2⤵
  PID:9760
- C:\Windows\System\fGQcQdl.exe
  C:\Windows\System\fGQcQdl.exe
  2⤵
  PID:9780
- C:\Windows\System\oXqxBJW.exe
  C:\Windows\System\oXqxBJW.exe
  2⤵
  PID:9800
- C:\Windows\System\LbBTapH.exe
  C:\Windows\System\LbBTapH.exe
  2⤵
  PID:9816
- C:\Windows\System\NCEWKRz.exe
  C:\Windows\System\NCEWKRz.exe
  2⤵
  PID:9840
- C:\Windows\System\MZrzRvY.exe
  C:\Windows\System\MZrzRvY.exe
  2⤵
  PID:9856
- C:\Windows\System\wnrSrCn.exe
  C:\Windows\System\wnrSrCn.exe
  2⤵
  PID:9872
- C:\Windows\System\GDuiuqz.exe
  C:\Windows\System\GDuiuqz.exe
  2⤵
  PID:9888
- C:\Windows\System\GTnMYpZ.exe
  C:\Windows\System\GTnMYpZ.exe
  2⤵
  PID:9904
- C:\Windows\System\mhOqcKj.exe
  C:\Windows\System\mhOqcKj.exe
  2⤵
  PID:9920
- C:\Windows\System\vthTeOD.exe
  C:\Windows\System\vthTeOD.exe
  2⤵
  PID:9940
- C:\Windows\System\sREjeRB.exe
  C:\Windows\System\sREjeRB.exe
  2⤵
  PID:9956
- C:\Windows\System\TIstIpd.exe
  C:\Windows\System\TIstIpd.exe
  2⤵
  PID:9972
- C:\Windows\System\GzlISTv.exe
  C:\Windows\System\GzlISTv.exe
  2⤵
  PID:9988
- C:\Windows\System\AiBRAhc.exe
  C:\Windows\System\AiBRAhc.exe
  2⤵
  PID:10004
- C:\Windows\System\VrQVFwb.exe
  C:\Windows\System\VrQVFwb.exe
  2⤵
  PID:10020
- C:\Windows\System\SlVlOhe.exe
  C:\Windows\System\SlVlOhe.exe
  2⤵
  PID:10036
- C:\Windows\System\XGLspMa.exe
  C:\Windows\System\XGLspMa.exe
  2⤵
  PID:10056
- C:\Windows\System\CxRPIAD.exe
  C:\Windows\System\CxRPIAD.exe
  2⤵
  PID:10076
- C:\Windows\System\sNSQPTc.exe
  C:\Windows\System\sNSQPTc.exe
  2⤵
  PID:10096
- C:\Windows\System\HWNkTTA.exe
  C:\Windows\System\HWNkTTA.exe
  2⤵
  PID:10112
- C:\Windows\System\TYoEImH.exe
  C:\Windows\System\TYoEImH.exe
  2⤵
  PID:10132
- C:\Windows\System\CpiNurA.exe
  C:\Windows\System\CpiNurA.exe
  2⤵
  PID:10152
- C:\Windows\System\jiAZhXs.exe
  C:\Windows\System\jiAZhXs.exe
  2⤵
  PID:10180
- C:\Windows\System\XeGlHEd.exe
  C:\Windows\System\XeGlHEd.exe
  2⤵
  PID:10200
- C:\Windows\System\SYbXgXB.exe
  C:\Windows\System\SYbXgXB.exe
  2⤵
  PID:10220
- C:\Windows\System\gFRIjfC.exe
  C:\Windows\System\gFRIjfC.exe
  2⤵
  PID:7632
- C:\Windows\System\SgHEvNz.exe
  C:\Windows\System\SgHEvNz.exe
  2⤵
  PID:10244
- C:\Windows\System\UYpoDby.exe
  C:\Windows\System\UYpoDby.exe
  2⤵
  PID:10260
- C:\Windows\System\bBTvtsW.exe
  C:\Windows\System\bBTvtsW.exe
  2⤵
  PID:10284
- C:\Windows\System\jNINcNN.exe
  C:\Windows\System\jNINcNN.exe
  2⤵
  PID:10312
- C:\Windows\System\LrlfkJe.exe
  C:\Windows\System\LrlfkJe.exe
  2⤵
  PID:10340
- C:\Windows\System\wDTthog.exe
  C:\Windows\System\wDTthog.exe
  2⤵
  PID:10368
- C:\Windows\System\udiUOFw.exe
  C:\Windows\System\udiUOFw.exe
  2⤵
  PID:10388
- C:\Windows\System\DRArzTc.exe
  C:\Windows\System\DRArzTc.exe
  2⤵
  PID:10404
- C:\Windows\System\hFUVfLl.exe
  C:\Windows\System\hFUVfLl.exe
  2⤵
  PID:10424
- C:\Windows\System\YDRYJhE.exe
  C:\Windows\System\YDRYJhE.exe
  2⤵
  PID:10444
- C:\Windows\System\LLwWBGl.exe
  C:\Windows\System\LLwWBGl.exe
  2⤵
  PID:10460
- C:\Windows\System\TWZMdae.exe
  C:\Windows\System\TWZMdae.exe
  2⤵
  PID:10528
- C:\Windows\System\NwliYrY.exe
  C:\Windows\System\NwliYrY.exe
  2⤵
  PID:10544
- C:\Windows\System\SRPptNA.exe
  C:\Windows\System\SRPptNA.exe
  2⤵
  PID:10560
- C:\Windows\System\EolsasV.exe
  C:\Windows\System\EolsasV.exe
  2⤵
  PID:10576
- C:\Windows\System\ikPWEpi.exe
  C:\Windows\System\ikPWEpi.exe
  2⤵
  PID:10592
- C:\Windows\System\HhVcZVT.exe
  C:\Windows\System\HhVcZVT.exe
  2⤵
  PID:10608
- C:\Windows\System\NClNNXd.exe
  C:\Windows\System\NClNNXd.exe
  2⤵
  PID:10624
- C:\Windows\System\vydDNcs.exe
  C:\Windows\System\vydDNcs.exe
  2⤵
  PID:10640
- C:\Windows\System\RJNKePN.exe
  C:\Windows\System\RJNKePN.exe
  2⤵
  PID:10660
- C:\Windows\System\nzcHUNl.exe
  C:\Windows\System\nzcHUNl.exe
  2⤵
  PID:10676
- C:\Windows\System\VaaHcLr.exe
  C:\Windows\System\VaaHcLr.exe
  2⤵
  PID:10692
- C:\Windows\System\TTotwBa.exe
  C:\Windows\System\TTotwBa.exe
  2⤵
  PID:10708
- C:\Windows\System\hkLwyKs.exe
  C:\Windows\System\hkLwyKs.exe
  2⤵
  PID:10724
- C:\Windows\System\GtgQyaU.exe
  C:\Windows\System\GtgQyaU.exe
  2⤵
  PID:10740
- C:\Windows\System\yBsjDou.exe
  C:\Windows\System\yBsjDou.exe
  2⤵
  PID:10756
- C:\Windows\System\fwRnZHn.exe
  C:\Windows\System\fwRnZHn.exe
  2⤵
  PID:10776
- C:\Windows\System\YgEmHet.exe
  C:\Windows\System\YgEmHet.exe
  2⤵
  PID:10800
- C:\Windows\System\nqEALTJ.exe
  C:\Windows\System\nqEALTJ.exe
  2⤵
  PID:10816
- C:\Windows\System\NtUliVs.exe
  C:\Windows\System\NtUliVs.exe
  2⤵
  PID:10840
- C:\Windows\System\hgpVswN.exe
  C:\Windows\System\hgpVswN.exe
  2⤵
  PID:10860
- C:\Windows\System\dcwQPMt.exe
  C:\Windows\System\dcwQPMt.exe
  2⤵
  PID:10876
- C:\Windows\System\erYZrbX.exe
  C:\Windows\System\erYZrbX.exe
  2⤵
  PID:10932
- C:\Windows\System\DpkWofN.exe
  C:\Windows\System\DpkWofN.exe
  2⤵
  PID:10948
- C:\Windows\System\DcddCrc.exe
  C:\Windows\System\DcddCrc.exe
  2⤵
  PID:10964
- C:\Windows\System\BFoqyfL.exe
  C:\Windows\System\BFoqyfL.exe
  2⤵
  PID:10980
- C:\Windows\System\DxQOFMW.exe
  C:\Windows\System\DxQOFMW.exe
  2⤵
  PID:10996
- C:\Windows\System\bGPpaAK.exe
  C:\Windows\System\bGPpaAK.exe
  2⤵
  PID:11012
- C:\Windows\System\IdWzOZK.exe
  C:\Windows\System\IdWzOZK.exe
  2⤵
  PID:11028
- C:\Windows\System\gacbAiG.exe
  C:\Windows\System\gacbAiG.exe
  2⤵
  PID:11044
- C:\Windows\System\jReiKJw.exe
  C:\Windows\System\jReiKJw.exe
  2⤵
  PID:11060
- C:\Windows\System\mHiUcqI.exe
  C:\Windows\System\mHiUcqI.exe
  2⤵
  PID:11080
- C:\Windows\System\sjqREiA.exe
  C:\Windows\System\sjqREiA.exe
  2⤵
  PID:11100
- C:\Windows\System\pOFBqtb.exe
  C:\Windows\System\pOFBqtb.exe
  2⤵
  PID:11120
- C:\Windows\System\ozWjOZp.exe
  C:\Windows\System\ozWjOZp.exe
  2⤵
  PID:11140
- C:\Windows\System\cNmLSaB.exe
  C:\Windows\System\cNmLSaB.exe
  2⤵
  PID:11164
- C:\Windows\System\lQSroJv.exe
  C:\Windows\System\lQSroJv.exe
  2⤵
  PID:11184
- C:\Windows\System\mYXQTGh.exe
  C:\Windows\System\mYXQTGh.exe
  2⤵
  PID:11204
- C:\Windows\System\GVVgBjN.exe
  C:\Windows\System\GVVgBjN.exe
  2⤵
  PID:11220
- C:\Windows\System\vhEwdtA.exe
  C:\Windows\System\vhEwdtA.exe
  2⤵
  PID:11248
- C:\Windows\System\IxHCvTk.exe
  C:\Windows\System\IxHCvTk.exe
  2⤵
  PID:7892
- C:\Windows\System\JaBjTVl.exe
  C:\Windows\System\JaBjTVl.exe
  2⤵
  PID:8268
- C:\Windows\System\sXZviCN.exe
  C:\Windows\System\sXZviCN.exe
  2⤵
  PID:8288
- C:\Windows\System\DyJVULV.exe
  C:\Windows\System\DyJVULV.exe
  2⤵
  PID:1852
- C:\Windows\System\rHQTzkm.exe
  C:\Windows\System\rHQTzkm.exe
  2⤵
  PID:8300
- C:\Windows\System\SkKMqHX.exe
  C:\Windows\System\SkKMqHX.exe
  2⤵
  PID:7048
- C:\Windows\System\kkJqEyQ.exe
  C:\Windows\System\kkJqEyQ.exe
  2⤵
  PID:6784
- C:\Windows\System\DNlyJUN.exe
  C:\Windows\System\DNlyJUN.exe
  2⤵
  PID:6444
- C:\Windows\System\nBdgeDG.exe
  C:\Windows\System\nBdgeDG.exe
  2⤵
  PID:8108
- C:\Windows\System\LhewFKz.exe
  C:\Windows\System\LhewFKz.exe
  2⤵
  PID:8028
- C:\Windows\System\nXZVLJY.exe
  C:\Windows\System\nXZVLJY.exe
  2⤵
  PID:7908
- C:\Windows\System\TKCksuK.exe
  C:\Windows\System\TKCksuK.exe
  2⤵
  PID:7788
- C:\Windows\System\pTTNOMy.exe
  C:\Windows\System\pTTNOMy.exe
  2⤵
  PID:7688
- C:\Windows\System\QtHdiWK.exe
  C:\Windows\System\QtHdiWK.exe
  2⤵
  PID:7560
- C:\Windows\System\jACLmll.exe
  C:\Windows\System\jACLmll.exe
  2⤵
  PID:7464
- C:\Windows\System\WBPKjSa.exe
  C:\Windows\System\WBPKjSa.exe
  2⤵
  PID:7312
- C:\Windows\System\NgsQiyS.exe
  C:\Windows\System\NgsQiyS.exe
  2⤵
  PID:5996
- C:\Windows\System\JcAdTbq.exe
  C:\Windows\System\JcAdTbq.exe
  2⤵
  PID:7080
- C:\Windows\System\MGyDnpB.exe
  C:\Windows\System\MGyDnpB.exe
  2⤵
  PID:7420
- C:\Windows\System\mZnAMCf.exe
  C:\Windows\System\mZnAMCf.exe
  2⤵
  PID:7528
- C:\Windows\System\bZcVdvN.exe
  C:\Windows\System\bZcVdvN.exe
  2⤵
  PID:7732
- C:\Windows\System\RuWsMni.exe
  C:\Windows\System\RuWsMni.exe
  2⤵
  PID:8096
- C:\Windows\System\ySwTqLf.exe
  C:\Windows\System\ySwTqLf.exe
  2⤵
  PID:8136
- C:\Windows\System\FGqlsJW.exe
  C:\Windows\System\FGqlsJW.exe
  2⤵
  PID:6480
- C:\Windows\System\LKSVxro.exe
  C:\Windows\System\LKSVxro.exe
  2⤵
  PID:6824
- C:\Windows\System\qCOSSsm.exe
  C:\Windows\System\qCOSSsm.exe
  2⤵
  PID:5336
- C:\Windows\System\GvenbmV.exe
  C:\Windows\System\GvenbmV.exe
  2⤵
  PID:8200
- C:\Windows\System\FFjOiZc.exe
  C:\Windows\System\FFjOiZc.exe
  2⤵
  PID:8220
- C:\Windows\System\NvCJnLM.exe
  C:\Windows\System\NvCJnLM.exe
  2⤵
  PID:8240
- C:\Windows\System\xHTgmGI.exe
  C:\Windows\System\xHTgmGI.exe
  2⤵
  PID:8316
- C:\Windows\System\yqpeyou.exe
  C:\Windows\System\yqpeyou.exe
  2⤵
  PID:10752
- C:\Windows\System\oKSPmbO.exe
  C:\Windows\System\oKSPmbO.exe
  2⤵
  PID:10884
- C:\Windows\System\jscssjT.exe
  C:\Windows\System\jscssjT.exe
  2⤵
  PID:8524
- C:\Windows\System\hRTtwHs.exe
  C:\Windows\System\hRTtwHs.exe
  2⤵
  PID:4720
- C:\Windows\System\jfYuLaH.exe
  C:\Windows\System\jfYuLaH.exe
  2⤵
  PID:11284
- C:\Windows\System\acIUSPU.exe
  C:\Windows\System\acIUSPU.exe
  2⤵
  PID:11300
- C:\Windows\System\UBUKTHe.exe
  C:\Windows\System\UBUKTHe.exe
  2⤵
  PID:11320
- C:\Windows\System\XNgcQZd.exe
  C:\Windows\System\XNgcQZd.exe
  2⤵
  PID:11336
- C:\Windows\System\gGcdpFC.exe
  C:\Windows\System\gGcdpFC.exe
  2⤵
  PID:11360
- C:\Windows\System\rJUszcn.exe
  C:\Windows\System\rJUszcn.exe
  2⤵
  PID:11384
- C:\Windows\System\XjNYQec.exe
  C:\Windows\System\XjNYQec.exe
  2⤵
  PID:11400
- C:\Windows\System\CSYkQwI.exe
  C:\Windows\System\CSYkQwI.exe
  2⤵
  PID:11432
- C:\Windows\System\qSXAJOY.exe
  C:\Windows\System\qSXAJOY.exe
  2⤵
  PID:11456
- C:\Windows\System\KMwvKGu.exe
  C:\Windows\System\KMwvKGu.exe
  2⤵
  PID:11480
- C:\Windows\System\vZmjFZo.exe
  C:\Windows\System\vZmjFZo.exe
  2⤵
  PID:11504
- C:\Windows\System\gwMyvpc.exe
  C:\Windows\System\gwMyvpc.exe
  2⤵
  PID:11520
- C:\Windows\System\bDCtPQh.exe
  C:\Windows\System\bDCtPQh.exe
  2⤵
  PID:11544
- C:\Windows\System\gNPYcLs.exe
  C:\Windows\System\gNPYcLs.exe
  2⤵
  PID:11560
- C:\Windows\System\nqjVqMO.exe
  C:\Windows\System\nqjVqMO.exe
  2⤵
  PID:11584
- C:\Windows\System\uvttate.exe
  C:\Windows\System\uvttate.exe
  2⤵
  PID:11600
- C:\Windows\System\phBQxyd.exe
  C:\Windows\System\phBQxyd.exe
  2⤵
  PID:11624
- C:\Windows\System\xQdWuoA.exe
  C:\Windows\System\xQdWuoA.exe
  2⤵
  PID:11648
- C:\Windows\System\yTfarxf.exe
  C:\Windows\System\yTfarxf.exe
  2⤵
  PID:11664
- C:\Windows\System\INXrMGI.exe
  C:\Windows\System\INXrMGI.exe
  2⤵
  PID:11688
- C:\Windows\System\KwbgrhX.exe
  C:\Windows\System\KwbgrhX.exe
  2⤵
  PID:11716
- C:\Windows\System\xHmTSVH.exe
  C:\Windows\System\xHmTSVH.exe
  2⤵
  PID:11736
- C:\Windows\System\RvyesFO.exe
  C:\Windows\System\RvyesFO.exe
  2⤵
  PID:11760
- C:\Windows\System\NbBFAGn.exe
  C:\Windows\System\NbBFAGn.exe
  2⤵
  PID:11784
- C:\Windows\System\DFQgtQk.exe
  C:\Windows\System\DFQgtQk.exe
  2⤵
  PID:11800
- C:\Windows\System\NdODGeq.exe
  C:\Windows\System\NdODGeq.exe
  2⤵
  PID:11816
- C:\Windows\System\pnFbYGZ.exe
  C:\Windows\System\pnFbYGZ.exe
  2⤵
  PID:11832
- C:\Windows\System\oDCLmJH.exe
  C:\Windows\System\oDCLmJH.exe
  2⤵
  PID:11848
- C:\Windows\System\ZTTXCFL.exe
  C:\Windows\System\ZTTXCFL.exe
  2⤵
  PID:11864
- C:\Windows\System\kYPjaFr.exe
  C:\Windows\System\kYPjaFr.exe
  2⤵
  PID:11884
- C:\Windows\System\lVOuBFo.exe
  C:\Windows\System\lVOuBFo.exe
  2⤵
  PID:11900
- C:\Windows\System\cSQWZqe.exe
  C:\Windows\System\cSQWZqe.exe
  2⤵
  PID:11916
- C:\Windows\System\JZsBONv.exe
  C:\Windows\System\JZsBONv.exe
  2⤵
  PID:11932
- C:\Windows\System\fsxrLpN.exe
  C:\Windows\System\fsxrLpN.exe
  2⤵
  PID:11948
- C:\Windows\System\xvnWYli.exe
  C:\Windows\System\xvnWYli.exe
  2⤵
  PID:11964
- C:\Windows\System\GETPnqZ.exe
  C:\Windows\System\GETPnqZ.exe
  2⤵
  PID:11980
- C:\Windows\System\fbtuaBL.exe
  C:\Windows\System\fbtuaBL.exe
  2⤵
  PID:12004
- C:\Windows\System\ZfkVPrr.exe
  C:\Windows\System\ZfkVPrr.exe
  2⤵
  PID:12028
- C:\Windows\System\aMjeWLr.exe
  C:\Windows\System\aMjeWLr.exe
  2⤵
  PID:12048
- C:\Windows\System\WFdMjvG.exe
  C:\Windows\System\WFdMjvG.exe
  2⤵
  PID:12068
- C:\Windows\System\pmZpdkZ.exe
  C:\Windows\System\pmZpdkZ.exe
  2⤵
  PID:12084
- C:\Windows\System\OoPJeWO.exe
  C:\Windows\System\OoPJeWO.exe
  2⤵
  PID:12124
- C:\Windows\System\aYFHPpo.exe
  C:\Windows\System\aYFHPpo.exe
  2⤵
  PID:12140
- C:\Windows\System\vqGUuFD.exe
  C:\Windows\System\vqGUuFD.exe
  2⤵
  PID:12164
- C:\Windows\System\ZBWfeIC.exe
  C:\Windows\System\ZBWfeIC.exe
  2⤵
  PID:12184
- C:\Windows\System\aZgofiA.exe
  C:\Windows\System\aZgofiA.exe
  2⤵
  PID:12204
- C:\Windows\System\aleeonK.exe
  C:\Windows\System\aleeonK.exe
  2⤵
  PID:12224
- C:\Windows\System\sCjEuuk.exe
  C:\Windows\System\sCjEuuk.exe
  2⤵
  PID:12248
- C:\Windows\System\WMvHRqg.exe
  C:\Windows\System\WMvHRqg.exe
  2⤵
  PID:12268
- C:\Windows\System\sEbulko.exe
  C:\Windows\System\sEbulko.exe
  2⤵
  PID:12284
- C:\Windows\System\ehXykam.exe
  C:\Windows\System\ehXykam.exe
  2⤵
  PID:8704
- C:\Windows\System\iUdkXid.exe
  C:\Windows\System\iUdkXid.exe
  2⤵
  PID:9048
- C:\Windows\System\zzVgejz.exe
  C:\Windows\System\zzVgejz.exe
  2⤵
  PID:9084
- C:\Windows\System\QkySQCY.exe
  C:\Windows\System\QkySQCY.exe
  2⤵
  PID:9112
- C:\Windows\System\keYnWsu.exe
  C:\Windows\System\keYnWsu.exe
  2⤵
  PID:9144
- C:\Windows\System\OCJvCnm.exe
  C:\Windows\System\OCJvCnm.exe
  2⤵
  PID:9172
- C:\Windows\System\wuuVqTW.exe
  C:\Windows\System\wuuVqTW.exe
  2⤵
  PID:9208
- C:\Windows\System\lfLCplz.exe
  C:\Windows\System\lfLCplz.exe
  2⤵
  PID:9232
- C:\Windows\System\htGuOgY.exe
  C:\Windows\System\htGuOgY.exe
  2⤵
  PID:9260
- C:\Windows\System\vHkJWSV.exe
  C:\Windows\System\vHkJWSV.exe
  2⤵
  PID:9300
- C:\Windows\System\sIZaDXc.exe
  C:\Windows\System\sIZaDXc.exe
  2⤵
  PID:9332
- C:\Windows\System\MdLymkr.exe
  C:\Windows\System\MdLymkr.exe
  2⤵
  PID:9368
- C:\Windows\System\mqvLphg.exe
  C:\Windows\System\mqvLphg.exe
  2⤵
  PID:9416
- C:\Windows\System\SQzbSZs.exe
  C:\Windows\System\SQzbSZs.exe
  2⤵
  PID:9452
- C:\Windows\System\BHrzZfd.exe
  C:\Windows\System\BHrzZfd.exe
  2⤵
  PID:9488
- C:\Windows\System\SiDzjHk.exe
  C:\Windows\System\SiDzjHk.exe
  2⤵
  PID:9544
- C:\Windows\System\WjGLeja.exe
  C:\Windows\System\WjGLeja.exe
  2⤵
  PID:9580
- C:\Windows\System\pEuaDDR.exe
  C:\Windows\System\pEuaDDR.exe
  2⤵
  PID:9608
- C:\Windows\System\gYBxKnq.exe
  C:\Windows\System\gYBxKnq.exe
  2⤵
  PID:9644
- C:\Windows\System\lhyNudt.exe
  C:\Windows\System\lhyNudt.exe
  2⤵
  PID:9684
- C:\Windows\System\eShLpkt.exe
  C:\Windows\System\eShLpkt.exe
  2⤵
  PID:9732
- C:\Windows\System\yLCdAvQ.exe
  C:\Windows\System\yLCdAvQ.exe
  2⤵
  PID:9768
- C:\Windows\System\SVwcnlP.exe
  C:\Windows\System\SVwcnlP.exe
  2⤵
  PID:9808
- C:\Windows\System\XtRTzWC.exe
  C:\Windows\System\XtRTzWC.exe
  2⤵
  PID:9832
- C:\Windows\System\nOVtqYc.exe
  C:\Windows\System\nOVtqYc.exe
  2⤵
  PID:9884
- C:\Windows\System\MJFXsJJ.exe
  C:\Windows\System\MJFXsJJ.exe
  2⤵
  PID:9932
- C:\Windows\System\QVEnIBl.exe
  C:\Windows\System\QVEnIBl.exe
  2⤵
  PID:9964
- C:\Windows\System\mNJaPwY.exe
  C:\Windows\System\mNJaPwY.exe
  2⤵
  PID:10000
- C:\Windows\System\mJBjTBS.exe
  C:\Windows\System\mJBjTBS.exe
  2⤵
  PID:10044
- C:\Windows\System\zpBVEge.exe
  C:\Windows\System\zpBVEge.exe
  2⤵
  PID:10072
- C:\Windows\System\QFcOCCo.exe
  C:\Windows\System\QFcOCCo.exe
  2⤵
  PID:10108
- C:\Windows\System\CAAJcrZ.exe
  C:\Windows\System\CAAJcrZ.exe
  2⤵
  PID:10144
- C:\Windows\System\GACpQnA.exe
  C:\Windows\System\GACpQnA.exe
  2⤵
  PID:10188
- C:\Windows\System\syheZoV.exe
  C:\Windows\System\syheZoV.exe
  2⤵
  PID:10228
- C:\Windows\System\xUEUqIN.exe
  C:\Windows\System\xUEUqIN.exe
  2⤵
  PID:10300
- C:\Windows\System\xfNxHMq.exe
  C:\Windows\System\xfNxHMq.exe
  2⤵
  PID:12484
- C:\Windows\System\tPHBXLc.exe
  C:\Windows\System\tPHBXLc.exe
  2⤵
  PID:12500
- C:\Windows\System\SwLhSPg.exe
  C:\Windows\System\SwLhSPg.exe
  2⤵
  PID:12516
- C:\Windows\System\wPRdTVT.exe
  C:\Windows\System\wPRdTVT.exe
  2⤵
  PID:12532
- C:\Windows\System\CxKaLJH.exe
  C:\Windows\System\CxKaLJH.exe
  2⤵
  PID:12548
- C:\Windows\System\QdOYkXy.exe
  C:\Windows\System\QdOYkXy.exe
  2⤵
  PID:12564
- C:\Windows\System\XIJBWvu.exe
  C:\Windows\System\XIJBWvu.exe
  2⤵
  PID:12580
- C:\Windows\System\jKSIZxE.exe
  C:\Windows\System\jKSIZxE.exe
  2⤵
  PID:12596
- C:\Windows\System\jzlGbLH.exe
  C:\Windows\System\jzlGbLH.exe
  2⤵
  PID:12612
- C:\Windows\System\KqSJIam.exe
  C:\Windows\System\KqSJIam.exe
  2⤵
  PID:12628
- C:\Windows\System\cgaQHtE.exe
  C:\Windows\System\cgaQHtE.exe
  2⤵
  PID:12644
- C:\Windows\System\PKmDPRC.exe
  C:\Windows\System\PKmDPRC.exe
  2⤵
  PID:12660
- C:\Windows\System\zyOwAhd.exe
  C:\Windows\System\zyOwAhd.exe
  2⤵
  PID:12676
- C:\Windows\System\QlNJFKr.exe
  C:\Windows\System\QlNJFKr.exe
  2⤵
  PID:12692
- C:\Windows\System\FBtANnq.exe
  C:\Windows\System\FBtANnq.exe
  2⤵
  PID:12708
- C:\Windows\System\tEathuY.exe
  C:\Windows\System\tEathuY.exe
  2⤵
  PID:12724
- C:\Windows\System\MounwzJ.exe
  C:\Windows\System\MounwzJ.exe
  2⤵
  PID:12740
- C:\Windows\System\dIGKULT.exe
  C:\Windows\System\dIGKULT.exe
  2⤵
  PID:12756
- C:\Windows\System\KYiQtBO.exe
  C:\Windows\System\KYiQtBO.exe
  2⤵
  PID:12772
- C:\Windows\System\cFgpWpH.exe
  C:\Windows\System\cFgpWpH.exe
  2⤵
  PID:12788
- C:\Windows\System\FTIciyg.exe
  C:\Windows\System\FTIciyg.exe
  2⤵
  PID:12804
- C:\Windows\System\JtqZzYO.exe
  C:\Windows\System\JtqZzYO.exe
  2⤵
  PID:12820
- C:\Windows\System\mwyZQPg.exe
  C:\Windows\System\mwyZQPg.exe
  2⤵
  PID:12836
- C:\Windows\System\lnDiAHK.exe
  C:\Windows\System\lnDiAHK.exe
  2⤵
  PID:12852
- C:\Windows\System\HFTWKny.exe
  C:\Windows\System\HFTWKny.exe
  2⤵
  PID:12868
- C:\Windows\System\XKhjQXY.exe
  C:\Windows\System\XKhjQXY.exe
  2⤵
  PID:12884
- C:\Windows\System\VQAwZZG.exe
  C:\Windows\System\VQAwZZG.exe
  2⤵
  PID:12900
- C:\Windows\System\GFVXHUU.exe
  C:\Windows\System\GFVXHUU.exe
  2⤵
  PID:12916
- C:\Windows\System\VwpeXAh.exe
  C:\Windows\System\VwpeXAh.exe
  2⤵
  PID:12936
- C:\Windows\System\LAyXrek.exe
  C:\Windows\System\LAyXrek.exe
  2⤵
  PID:12956
- C:\Windows\System\ooAOzMc.exe
  C:\Windows\System\ooAOzMc.exe
  2⤵
  PID:12972
- C:\Windows\System\bajrgRH.exe
  C:\Windows\System\bajrgRH.exe
  2⤵
  PID:12988
- C:\Windows\System\NhgaDgv.exe
  C:\Windows\System\NhgaDgv.exe
  2⤵
  PID:13004
- C:\Windows\System\zfrrZrL.exe
  C:\Windows\System\zfrrZrL.exe
  2⤵
  PID:13020
- C:\Windows\System\QUblSbU.exe
  C:\Windows\System\QUblSbU.exe
  2⤵
  PID:13036
- C:\Windows\System\LXIKkMo.exe
  C:\Windows\System\LXIKkMo.exe
  2⤵
  PID:13052
- C:\Windows\System\PiLwRfl.exe
  C:\Windows\System\PiLwRfl.exe
  2⤵
  PID:13068
- C:\Windows\System\Kiwzyis.exe
  C:\Windows\System\Kiwzyis.exe
  2⤵
  PID:13112
- C:\Windows\System\VxJYPic.exe
  C:\Windows\System\VxJYPic.exe
  2⤵
  PID:13144
- C:\Windows\System\KfuQjKU.exe
  C:\Windows\System\KfuQjKU.exe
  2⤵
  PID:13164
- C:\Windows\System\NbttfbK.exe
  C:\Windows\System\NbttfbK.exe
  2⤵
  PID:13180
- C:\Windows\System\laDojeP.exe
  C:\Windows\System\laDojeP.exe
  2⤵
  PID:13204
- C:\Windows\System\liiCfQc.exe
  C:\Windows\System\liiCfQc.exe
  2⤵
  PID:13220
- C:\Windows\System\MOsjfNQ.exe
  C:\Windows\System\MOsjfNQ.exe
  2⤵
  PID:13240
- C:\Windows\System\yBvwwBf.exe
  C:\Windows\System\yBvwwBf.exe
  2⤵
  PID:13260
- C:\Windows\System\ufPgFPX.exe
  C:\Windows\System\ufPgFPX.exe
  2⤵
  PID:13280
- C:\Windows\System\aXNKAsn.exe
  C:\Windows\System\aXNKAsn.exe
  2⤵
  PID:13296
- C:\Windows\System\tvaikAp.exe
  C:\Windows\System\tvaikAp.exe
  2⤵
  PID:3640
- C:\Windows\System\xMHRlEL.exe
  C:\Windows\System\xMHRlEL.exe
  2⤵
  PID:11236
- C:\Windows\System\MfSsXNU.exe
  C:\Windows\System\MfSsXNU.exe
  2⤵
  PID:10872
- C:\Windows\System\DzWLUAx.exe
  C:\Windows\System\DzWLUAx.exe
  2⤵
  PID:10832
- C:\Windows\System\EwoVsGP.exe
  C:\Windows\System\EwoVsGP.exe
  2⤵
  PID:10772
- C:\Windows\System\seTRSGe.exe
  C:\Windows\System\seTRSGe.exe
  2⤵
  PID:11020
- C:\Windows\System\kHkHers.exe
  C:\Windows\System\kHkHers.exe
  2⤵
  PID:10656
- C:\Windows\System\jUvdPpg.exe
  C:\Windows\System\jUvdPpg.exe
  2⤵
  PID:10620
- C:\Windows\System\lbLqLlA.exe
  C:\Windows\System\lbLqLlA.exe
  2⤵
  PID:10584
- C:\Windows\System\iUKwfBo.exe
  C:\Windows\System\iUKwfBo.exe
  2⤵
  PID:10540
- C:\Windows\System\dkIHGht.exe
  C:\Windows\System\dkIHGht.exe
  2⤵
  PID:10512
- C:\Windows\System\zaUVrZr.exe
  C:\Windows\System\zaUVrZr.exe
  2⤵
  PID:5112
- C:\Windows\System\EcKoaTt.exe
  C:\Windows\System\EcKoaTt.exe
  2⤵
  PID:3128
- C:\Windows\System\fQwdDZk.exe
  C:\Windows\System\fQwdDZk.exe
  2⤵
  PID:1168
- C:\Windows\System\CjzbZFh.exe
  C:\Windows\System\CjzbZFh.exe
  2⤵
  PID:10920
- C:\Windows\System\MNgxACF.exe
  C:\Windows\System\MNgxACF.exe
  2⤵
  PID:10992
- C:\Windows\System\UcCbglp.exe
  C:\Windows\System\UcCbglp.exe
  2⤵
  PID:7812
- C:\Windows\System\jUNvvGq.exe
  C:\Windows\System\jUNvvGq.exe
  2⤵
  PID:12524
- C:\Windows\System\vdNAeKV.exe
  C:\Windows\System\vdNAeKV.exe
  2⤵
  PID:12604
- C:\Windows\System\CeIonTc.exe
  C:\Windows\System\CeIonTc.exe
  2⤵
  PID:12748
- C:\Windows\System\LOeWzys.exe
  C:\Windows\System\LOeWzys.exe
  2⤵
  PID:12864
- C:\Windows\System\RuimdzP.exe
  C:\Windows\System\RuimdzP.exe
  2⤵
  PID:8216
- C:\Windows\System\zzymBSP.exe
  C:\Windows\System\zzymBSP.exe
  2⤵
  PID:13140
- C:\Windows\System\MedgCuj.exe
  C:\Windows\System\MedgCuj.exe
  2⤵
  PID:13176
- C:\Windows\System\CiHNrFl.exe
  C:\Windows\System\CiHNrFl.exe
  2⤵
  PID:13232
- C:\Windows\System\FSVthyp.exe
  C:\Windows\System\FSVthyp.exe
  2⤵
  PID:13256
- C:\Windows\System\zdFkrZZ.exe
  C:\Windows\System\zdFkrZZ.exe
  2⤵
  PID:10848
- C:\Windows\System\qAqMUON.exe
  C:\Windows\System\qAqMUON.exe
  2⤵
  PID:10516
- C:\Windows\System\KpxWzgE.exe
  C:\Windows\System\KpxWzgE.exe
  2⤵
  PID:1164
- C:\Windows\System\nUNpuEV.exe
  C:\Windows\System\nUNpuEV.exe
  2⤵
  PID:3696
- C:\Windows\System\jThqMeV.exe
  C:\Windows\System\jThqMeV.exe
  2⤵
  PID:11088
- C:\Windows\System\rKHXZFh.exe
  C:\Windows\System\rKHXZFh.exe
  2⤵
  PID:7748
- C:\Windows\System\wjzxfwA.exe
  C:\Windows\System\wjzxfwA.exe
  2⤵
  PID:12912
- C:\Windows\System\OqPcpEm.exe
  C:\Windows\System\OqPcpEm.exe
  2⤵
  PID:13044
- C:\Windows\System\gvgFbrA.exe
  C:\Windows\System\gvgFbrA.exe
  2⤵
  PID:6892
- C:\Windows\System\yXbijoI.exe
  C:\Windows\System\yXbijoI.exe
  2⤵
  PID:11396
- C:\Windows\System\eBfbZvx.exe
  C:\Windows\System\eBfbZvx.exe
  2⤵
  PID:7728
- C:\Windows\System\MXugUVe.exe
  C:\Windows\System\MXugUVe.exe
  2⤵
  PID:11488
- C:\Windows\System\jLStWGV.exe
  C:\Windows\System\jLStWGV.exe
  2⤵
  PID:11528
- C:\Windows\System\DpVuluE.exe
  C:\Windows\System\DpVuluE.exe
  2⤵
  PID:11596
- C:\Windows\System\VShoAes.exe
  C:\Windows\System\VShoAes.exe
  2⤵
  PID:10808
- C:\Windows\System\gCBbEiJ.exe
  C:\Windows\System\gCBbEiJ.exe
  2⤵
  PID:11292
- C:\Windows\System\UpPrHfe.exe
  C:\Windows\System\UpPrHfe.exe
  2⤵
  PID:9156
- C:\Windows\System\yKZiUQV.exe
  C:\Windows\System\yKZiUQV.exe
  2⤵
  PID:4884
- C:\Windows\System\GHjVkdh.exe
  C:\Windows\System\GHjVkdh.exe
  2⤵
  PID:12112
- C:\Windows\System\XzUIbHT.exe
  C:\Windows\System\XzUIbHT.exe
  2⤵
  PID:11724
- C:\Windows\System\tyTbDqf.exe
  C:\Windows\System\tyTbDqf.exe
  2⤵
  PID:11976
- C:\Windows\System\JAUipYo.exe
  C:\Windows\System\JAUipYo.exe
  2⤵
  PID:9352
- C:\Windows\System\qYJUnic.exe
  C:\Windows\System\qYJUnic.exe
  2⤵
  PID:9276
- C:\Windows\System\OrEztou.exe
  C:\Windows\System\OrEztou.exe
  2⤵
  PID:11828
- C:\Windows\System\gDTGbwq.exe
  C:\Windows\System\gDTGbwq.exe
  2⤵
  PID:10268
- C:\Windows\System\GZpWckb.exe
  C:\Windows\System\GZpWckb.exe
  2⤵
  PID:10356
- C:\Windows\System\UlOhnAy.exe
  C:\Windows\System\UlOhnAy.exe
  2⤵
  PID:12044
- C:\Windows\System\jRcoaEO.exe
  C:\Windows\System\jRcoaEO.exe
  2⤵
  PID:12812
- C:\Windows\System\zxMPSMy.exe
  C:\Windows\System\zxMPSMy.exe
  2⤵
  PID:9100
- C:\Windows\System\MTuyQgC.exe
  C:\Windows\System\MTuyQgC.exe
  2⤵
  PID:13200
- C:\Windows\System\cqurrqy.exe
  C:\Windows\System\cqurrqy.exe
  2⤵
  PID:12704
- C:\Windows\System\DQKoEpM.exe
  C:\Windows\System\DQKoEpM.exe
  2⤵
  PID:11872
- C:\Windows\System\eLEZhsR.exe
  C:\Windows\System\eLEZhsR.exe
  2⤵
  PID:10324
- C:\Windows\System\jQfTKks.exe
  C:\Windows\System\jQfTKks.exe
  2⤵
  PID:13012
- C:\Windows\System\iAmvrjd.exe
  C:\Windows\System\iAmvrjd.exe
  2⤵
  PID:9524
- C:\Windows\System\SjokdLJ.exe
  C:\Windows\System\SjokdLJ.exe
  2⤵
  PID:10252
- C:\Windows\System\fUPTIRz.exe
  C:\Windows\System\fUPTIRz.exe
  2⤵
  PID:12796
- C:\Windows\System\BpFvido.exe
  C:\Windows\System\BpFvido.exe
  2⤵
  PID:10972
- C:\Windows\System\cNwdkXg.exe
  C:\Windows\System\cNwdkXg.exe
  2⤵
  PID:13288
- C:\Windows\System\wMKRfEW.exe
  C:\Windows\System\wMKRfEW.exe
  2⤵
  PID:10648
- C:\Windows\System\YuUfYqG.exe
  C:\Windows\System\YuUfYqG.exe
  2⤵
  PID:12512
- C:\Windows\System\nYAUErB.exe
  C:\Windows\System\nYAUErB.exe
  2⤵
  PID:12896
- C:\Windows\System\wzRwRUX.exe
  C:\Windows\System\wzRwRUX.exe
  2⤵
  PID:13252
- C:\Windows\System\zrJlnKH.exe
  C:\Windows\System\zrJlnKH.exe
  2⤵
  PID:4168
- C:\Windows\System\GkhgWmP.exe
  C:\Windows\System\GkhgWmP.exe
  2⤵
  PID:4484
- C:\Windows\System\xtlGtKp.exe
  C:\Windows\System\xtlGtKp.exe
  2⤵
  PID:10352
- C:\Windows\System\zAoNEcz.exe
  C:\Windows\System\zAoNEcz.exe
  2⤵
  PID:8188
- C:\Windows\System\GNnmLRn.exe
  C:\Windows\System\GNnmLRn.exe
  2⤵
  PID:7480
- C:\Windows\System\PUiVxgc.exe
  C:\Windows\System\PUiVxgc.exe
  2⤵
  PID:11540
- C:\Windows\System\aShTtFS.exe
  C:\Windows\System\aShTtFS.exe
  2⤵
  PID:11892
- C:\Windows\System\HXNzKGm.exe
  C:\Windows\System\HXNzKGm.exe
  2⤵
  PID:14264
- C:\Windows\System\gTmBTWh.exe
  C:\Windows\System\gTmBTWh.exe
  2⤵
  PID:14280
- C:\Windows\System\JLuLxsq.exe
  C:\Windows\System\JLuLxsq.exe
  2⤵
  PID:14300
- C:\Windows\System\KSaWSEy.exe
  C:\Windows\System\KSaWSEy.exe
  2⤵
  PID:14316
- C:\Windows\System\vZyFRIX.exe
  C:\Windows\System\vZyFRIX.exe
  2⤵
  PID:3320
- C:\Windows\System\svaiuBE.exe
  C:\Windows\System\svaiuBE.exe
  2⤵
  PID:10276
- C:\Windows\System\FszFENb.exe
  C:\Windows\System\FszFENb.exe
  2⤵
  PID:12720
- C:\Windows\System\LxfQtRh.exe
  C:\Windows\System\LxfQtRh.exe
  2⤵
  PID:11644
- C:\Windows\System\wVJgiTK.exe
  C:\Windows\System\wVJgiTK.exe
  2⤵
  PID:8
- C:\Windows\System\PcNOkfX.exe
  C:\Windows\System\PcNOkfX.exe
  2⤵
  PID:8808
- C:\Windows\System\QEigZZO.exe
  C:\Windows\System\QEigZZO.exe
  2⤵
  PID:9192
- C:\Windows\System\qdcyfLB.exe
  C:\Windows\System\qdcyfLB.exe
  2⤵
  PID:13336
- C:\Windows\System\BoOviPZ.exe
  C:\Windows\System\BoOviPZ.exe
  2⤵
  PID:11260
- C:\Windows\System\vUxDoFY.exe
  C:\Windows\System\vUxDoFY.exe
  2⤵
  PID:13132
- C:\Windows\System\VWNQIhU.exe
  C:\Windows\System\VWNQIhU.exe
  2⤵
  PID:12236
- C:\Windows\System\QHSRjaV.exe
  C:\Windows\System\QHSRjaV.exe
  2⤵
  PID:13156
- C:\Windows\System\YugUNAe.exe
  C:\Windows\System\YugUNAe.exe
  2⤵
  PID:9340
- C:\Windows\System\gfHWFhL.exe
  C:\Windows\System\gfHWFhL.exe
  2⤵
  PID:13788
- C:\Windows\System\vtloXPA.exe
  C:\Windows\System\vtloXPA.exe
  2⤵
  PID:13596
- C:\Windows\System\sTnBxdQ.exe
  C:\Windows\System\sTnBxdQ.exe
  2⤵
  PID:13576
- C:\Windows\System\jpZxTnk.exe
  C:\Windows\System\jpZxTnk.exe
  2⤵
  PID:13652
- C:\Windows\System\xtUnXfN.exe
  C:\Windows\System\xtUnXfN.exe
  2⤵
  PID:13916
- C:\Windows\System\xboDohN.exe
  C:\Windows\System\xboDohN.exe
  2⤵
  PID:13956
- C:\Windows\System\GYhuCkF.exe
  C:\Windows\System\GYhuCkF.exe
  2⤵
  PID:13672
- C:\Windows\System\VpwUsLi.exe
  C:\Windows\System\VpwUsLi.exe
  2⤵
  PID:14036
- C:\Windows\System\yKfQxjp.exe
  C:\Windows\System\yKfQxjp.exe
  2⤵
  PID:13928
- C:\Windows\System\vwtjAUF.exe
  C:\Windows\System\vwtjAUF.exe
  2⤵
  PID:14100
- C:\Windows\System\ZOCtuQl.exe
  C:\Windows\System\ZOCtuQl.exe
  2⤵
  PID:10904
- C:\Windows\System\JYSTcwB.exe
  C:\Windows\System\JYSTcwB.exe
  2⤵
  PID:13832
- C:\Windows\System\QNVuCJd.exe
  C:\Windows\System\QNVuCJd.exe
  2⤵
  PID:13696
- C:\Windows\System\pHybgqc.exe
  C:\Windows\System\pHybgqc.exe
  2⤵
  PID:13876
- C:\Windows\System\KMatCPU.exe
  C:\Windows\System\KMatCPU.exe
  2⤵
  PID:13424
- C:\Windows\System\JiWWeEx.exe
  C:\Windows\System\JiWWeEx.exe
  2⤵
  PID:14056
- C:\Windows\System\NLRDQLC.exe
  C:\Windows\System\NLRDQLC.exe
  2⤵
  PID:13976
- C:\Windows\System\kDeInLo.exe
  C:\Windows\System\kDeInLo.exe
  2⤵
  PID:14120
- C:\Windows\System\pLkRrcl.exe
  C:\Windows\System\pLkRrcl.exe
  2⤵
  PID:14148
- C:\Windows\System\HzfDGpR.exe
  C:\Windows\System\HzfDGpR.exe
  2⤵
  PID:14168
- C:\Windows\System\SuoyXCT.exe
  C:\Windows\System\SuoyXCT.exe
  2⤵
  PID:14204
- C:\Windows\System\BVGdUIE.exe
  C:\Windows\System\BVGdUIE.exe
  2⤵
  PID:14228
- C:\Windows\System\cNknEBb.exe
  C:\Windows\System\cNknEBb.exe
  2⤵
  PID:14248
- C:\Windows\System\YYIfPAw.exe
  C:\Windows\System\YYIfPAw.exe
  2⤵
  PID:14272
- C:\Windows\System\epdKebV.exe
  C:\Windows\System\epdKebV.exe
  2⤵
  PID:9316
- C:\Windows\System\ovKKOdv.exe
  C:\Windows\System\ovKKOdv.exe
  2⤵
  PID:10636
- C:\Windows\System\XleFNvD.exe
  C:\Windows\System\XleFNvD.exe
  2⤵
  PID:7612
- C:\Windows\System\YMsaqAp.exe
  C:\Windows\System\YMsaqAp.exe
  2⤵
  PID:4520
- C:\Windows\System\eYoFwYz.exe
  C:\Windows\System\eYoFwYz.exe
  2⤵
  PID:13388
- C:\Windows\System\oreBXaQ.exe
  C:\Windows\System\oreBXaQ.exe
  2⤵
  PID:5856
- C:\Windows\System\eEvnvUV.exe
  C:\Windows\System\eEvnvUV.exe
  2⤵
  PID:11376
- C:\Windows\System\zdZTIOO.exe
  C:\Windows\System\zdZTIOO.exe
  2⤵
  PID:5992
- C:\Windows\System\cTkWyyw.exe
  C:\Windows\System\cTkWyyw.exe
  2⤵
  PID:13604
- C:\Windows\System\tfscFHu.exe
  C:\Windows\System\tfscFHu.exe
  2⤵
  PID:10364
- C:\Windows\System\IYfPRrS.exe
  C:\Windows\System\IYfPRrS.exe
  2⤵
  PID:13612
- C:\Windows\System\rhhdSpS.exe
  C:\Windows\System\rhhdSpS.exe
  2⤵
  PID:2824
- C:\Windows\System\UyXltwa.exe
  C:\Windows\System\UyXltwa.exe
  2⤵
  PID:13764
- C:\Windows\System\VrYbZzp.exe
  C:\Windows\System\VrYbZzp.exe
  2⤵
  PID:13708
- C:\Windows\System\bZKAcDF.exe
  C:\Windows\System\bZKAcDF.exe
  2⤵
  PID:14288
- C:\Windows\System\KpUVzgM.exe
  C:\Windows\System\KpUVzgM.exe
  2⤵
  PID:13172
- C:\Windows\System\sFKVYcK.exe
  C:\Windows\System\sFKVYcK.exe
  2⤵
  PID:14292
- C:\Windows\System\bGuHiYK.exe
  C:\Windows\System\bGuHiYK.exe
  2⤵
  PID:10796
- C:\Windows\System\OljrPgJ.exe
  C:\Windows\System\OljrPgJ.exe
  2⤵
  PID:13796
- C:\Windows\System\guVkjrM.exe
  C:\Windows\System\guVkjrM.exe
  2⤵
  PID:13724
- C:\Windows\System\PXMPNTr.exe
  C:\Windows\System\PXMPNTr.exe
  2⤵
  PID:5844
- C:\Windows\System\ltOUCbM.exe
  C:\Windows\System\ltOUCbM.exe
  2⤵
  PID:14332
- C:\Windows\System\PJTkWRg.exe
  C:\Windows\System\PJTkWRg.exe
  2⤵
  PID:1460
- C:\Windows\System\NxjYfqg.exe
  C:\Windows\System\NxjYfqg.exe
  2⤵
  PID:7848
- C:\Windows\System\HIaOWLy.exe
  C:\Windows\System\HIaOWLy.exe
  2⤵
  PID:13136
- C:\Windows\System\VNpfCqk.exe
  C:\Windows\System\VNpfCqk.exe
  2⤵
  PID:13404
- C:\Windows\System\SQNPqnz.exe
  C:\Windows\System\SQNPqnz.exe
  2⤵
  PID:9296
- C:\Windows\System\pDGlEPc.exe
  C:\Windows\System\pDGlEPc.exe
  2⤵
  PID:11592
- C:\Windows\System\eyqGhWN.exe
  C:\Windows\System\eyqGhWN.exe
  2⤵
  PID:11704
- C:\Windows\System\wxQgupy.exe
  C:\Windows\System\wxQgupy.exe
  2⤵
  PID:13436
- C:\Windows\System\LhwNwwi.exe
  C:\Windows\System\LhwNwwi.exe
  2⤵
  PID:13460
- C:\Windows\System\BlmXmNZ.exe
  C:\Windows\System\BlmXmNZ.exe
  2⤵
  PID:4620
- C:\Windows\System\TzXOwkP.exe
  C:\Windows\System\TzXOwkP.exe
  2⤵
  PID:12460
- C:\Windows\System\QIEMkSv.exe
  C:\Windows\System\QIEMkSv.exe
  2⤵
  PID:14324
- C:\Windows\System\WixkZrB.exe
  C:\Windows\System\WixkZrB.exe
  2⤵
  PID:13332
- C:\Windows\System\hucDQPL.exe
  C:\Windows\System\hucDQPL.exe
  2⤵
  PID:13376
- C:\Windows\System\sCZleFv.exe
  C:\Windows\System\sCZleFv.exe
  2⤵
  PID:11608
- C:\Windows\System\BylwDDw.exe
  C:\Windows\System\BylwDDw.exe
  2⤵
  PID:13504
- C:\Windows\System\HtBuXHl.exe
  C:\Windows\System\HtBuXHl.exe
  2⤵
  PID:13720
- C:\Windows\System\deKnNCw.exe
  C:\Windows\System\deKnNCw.exe
  2⤵
  PID:13568
- C:\Windows\System\lRarcBY.exe
  C:\Windows\System\lRarcBY.exe
  2⤵
  PID:4728
- C:\Windows\System\vxNjNWk.exe
  C:\Windows\System\vxNjNWk.exe
  2⤵
  PID:13860
- C:\Windows\System\PRlCOlc.exe
  C:\Windows\System\PRlCOlc.exe
  2⤵
  PID:12080
- C:\Windows\System\GxCsaeG.exe
  C:\Windows\System\GxCsaeG.exe
  2⤵
  PID:13540
- C:\Windows\System\HEZzgDF.exe
  C:\Windows\System\HEZzgDF.exe
  2⤵
  PID:13524
- C:\Windows\System\ccIjosP.exe
  C:\Windows\System\ccIjosP.exe
  2⤵
  PID:5492
- C:\Windows\System\HwOWXuL.exe
  C:\Windows\System\HwOWXuL.exe
  2⤵
  PID:14212
- C:\Windows\System\lQGsxAH.exe
  C:\Windows\System\lQGsxAH.exe
  2⤵
  PID:13816

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 492 -p 11900 -ip 11900
1⤵
PID:8808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j0r01gfc.w21.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BxeRUAW.exe

Filesize
1.3MB

MD5
4e12df20a3d4a1d679a426dc9d4ad368

SHA1
a55b6412f70ada9c7024bdf54d51ee4feed74040

SHA256
24d17d0c3b291564ae602acb46f09bdad5ab417330ac12dee3657f973fc1c12b

SHA512
c70d376dfa050d5efa3cb3d4a2a4cee13cec8de16ff7a4e92071134aa1b1c55d5a5e0acddeafccdf6b1c8f1623cd652c00e4da3a4c3c40647c3b995df56f9009

Download Submit
C:\Windows\System\CCDBKpE.exe

Filesize
1.3MB

MD5
d6d3bc7c2e5485c85cd4b98d7b30f4db

SHA1
371fead937f3504aeb502df1ad45aae0faad16e1

SHA256
3b651219a382c4e067d32f2b43e00a9d7b4630f41bb6f416b8818e86ea8ba7a1

SHA512
10706dc1645ddc2afe8acb7f0a827eb27132e7a28d73b5c102d32575c3929fae251958d172ade1df394d368e913db4353955cc45e66229989b668873ffa9904e

Download Submit
C:\Windows\System\EZdNOdz.exe

Filesize
1.3MB

MD5
cfad541af015a51def96dc0c2856787b

SHA1
0b363d5fdff5642bf24dd5ac6587af7d05a252c2

SHA256
19707a1c54638866b68b375d7b851bc0a4dddd6fac330f37cb81582273aac45a

SHA512
d496a78cf55857e23b46671b86789179c80ead08e3f05cbdc9e821ccb2456900a19baf09355419ba521fa33372a0df532c7636f3b100a2b11ca9dc193fd37b68

Download Submit
C:\Windows\System\EugvtsK.exe

Filesize
1.3MB

MD5
825b1c9a24f842f9ca12c87d7a22ebab

SHA1
4c3f4b4f74567f6c16afb5b0ba34b84ee5b14969

SHA256
93a8d6d03370e641fc8ac976ea9b8b1c24374e0f9074143fb37fecbda2db1fbf

SHA512
6b95fd3de7ae0aeb49c30c712fec3537dc7af8e269413464275b5e6f9961b6558ed1a8ea6e5b968996b75213b9ec49a01be9da64f7ba3ca0b5e794ac0d4dbf5b

Download Submit
C:\Windows\System\GBuhccl.exe

Filesize
1.3MB

MD5
19e4034e1d2aa607dab5b5c2496fb345

SHA1
500aae002f3a3c321d482bdecfc2633f2d096708

SHA256
d1f5273298ea8ee1073d491147e103586c70081e32b930cd7cbfa29af8a37e1e

SHA512
cb5ab94919317cfa2cbb5b8cd296db9e3f6c2aca2ad0d659d00e054b97752c3f024e959aaa678450169ac1445d76d2219bccca90dfab1b79562c8c2623c5e08f

Download Submit
C:\Windows\System\IWENHsb.exe

Filesize
1.3MB

MD5
97b7c8542432e2b4144a4224be3f2c0a

SHA1
a7061d834df90e8c20176a2b350a8bc9639cccca

SHA256
5a4cc786c059506f3a4dfdc7f79d1728cf14299ed1abcd9d55f5cbf637f846df

SHA512
605b0f410fcf7f9db3f01766ca1340c7e0a79de54719b1545f1ff38dd0c69f9af6602bc0be2d8b61bd38f56365354344855f4df8ab2677277a01aa6c16542dd7

Download Submit
C:\Windows\System\IwiIIiG.exe

Filesize
1.3MB

MD5
c39333e3f3732ec395bbe47a58c64505

SHA1
d1692f034316916da4e6349305e29e412c623dfd

SHA256
46f1c99bbe87307fb0c75a4a330b03f7f014c46439f5e0c1c069ecfd9ae6dd2a

SHA512
f0178ef4cbd76f2ba931f59cca52f9c3367099d76b78cbdd6be60982491239a0b0f7fc2965d2927fd6142fdd83f97a9fcb0b578968f2346ffba2e66c96370c63

Download Submit
C:\Windows\System\JnefVXb.exe

Filesize
1.3MB

MD5
7955582badc7e1ee993186f57f1843ef

SHA1
f685fc4628a81ec2df069697b5aa8d3c0e0f6242

SHA256
19477db14ba5040d532089e40fb84920c9cd397b94e34780748debad2f23feb9

SHA512
657004508ab6fe1ba605797ac9d95279de1e9522510e2e5f53efc4d132203d4cdd403ea9bd563dc3b691217c43e672089a58c1319cce9e3d0659c37ede323b66

Download Submit
C:\Windows\System\KbqOCNS.exe

Filesize
1.3MB

MD5
a8e2e16cbb1f968dc1b99917541a0441

SHA1
93fa86dcae90bcb8d3a1f8bb764d601aefe1638c

SHA256
ec831a46a40f248caef42d50f77bdffe8b1966e6045737b13408282453abeae1

SHA512
12c1b5f4af47ea7ddf5c5827d67a7d723e3dc9db9c07623861ce188d982c706d23805fce5fc859f03aa914e866007f674584de88340b5bcc20a9b026f4229d54

Download Submit
C:\Windows\System\NrovacV.exe

Filesize
1.3MB

MD5
f95a8ad8b569c32a87c2178a2cd72936

SHA1
69bb6b228d1a47fc7d06b50700e35f6543ae96b2

SHA256
6d7a5d2dfaed0b3248499058e7f9348e519a3acd0a62f1c0de085ed4148dfc68

SHA512
85ea362d1c0d406f1104446bf025b879b659c1c2a3e324b2a471dd77cb04fd876485d9d7d19ddcc57b4f7dc0822ecc78dee70755d5704d3fa7d227ae1c9e2ac8

Download Submit
C:\Windows\System\OMUIGZC.exe

Filesize
1.3MB

MD5
fb40ad14ba386da1c7bfd7471effd39f

SHA1
5ee04dde03986a70ef72230d13613e4577ae3178

SHA256
9504f6430a38eeba86cf9b3cc2af4e3de08ab4a7f18a3b51f057f1673873767a

SHA512
875bad904f1b6929c59b43fe85f3a08ddecc315319f0d46a8fbb927e29d81bf1599d95698e23ab9e772274e4bc7353872287f76a8a72d9b2f158d7c9b608bf0b

Download Submit
C:\Windows\System\RWiruxx.exe

Filesize
1.3MB

MD5
e340be29972bf543c159b394b52b0c2c

SHA1
1369fe5cc2a5cdbd2ef9be20551cfccc9a600c2f

SHA256
0f627cabc6d198701824554d6da28d7f00c9a1ff802ab409e029d7a4939a8b5d

SHA512
41f3ea34afa0b413e626c7f1dea06ec365cb685bb19d2f7ff1180a493568d7d629bc8d9acb7a3526431e1b3ce24662637493b7f5ea4c1bfe6167942ce46cfea3

Download Submit
C:\Windows\System\SjedRBN.exe

Filesize
1.3MB

MD5
91eef7d30ec0ea466386f6e838ae5be5

SHA1
246de3e585b5549b6f0168ec7ea686132b6debb8

SHA256
bc796fd187fc53cf61a80c1fa43560225fee6adb5f6e0759f14b9fc7a6b7d5b3

SHA512
75287423bf1c734c6e52922e60e933ca7dc9582e156b963142dfd1a6705bbf4e26932b887ff088bba0769d055b9c54cdd96eb52d354635bb04ca82483831241f

Download Submit
C:\Windows\System\TfifSJw.exe

Filesize
1.3MB

MD5
1b74d2d4f61a3a229fc2afd1c752de1d

SHA1
60af3b56fa6fca0fba06eb3a1c656a2c1a303d58

SHA256
464eb6197970b0afdacb0af4623b1cfe76dce851cd4f2a9d0f3f376e8204bf4e

SHA512
239a2d2599c63c178cd2672d88d6d93f140c7954580b3786a125729d225f78c5f94456cd8db926843565cb68db01ec5ded3298a0cb43df7b36287d64dd03a9c1

Download Submit
C:\Windows\System\TjbuaHi.exe

Filesize
1.3MB

MD5
4f65dbe4526e72ad7281a9e7e6b8876e

SHA1
2a07c063c20ff0a881d7d22da786f564cc780ed6

SHA256
5c870b0ff2d44b3858005a7594ded12070220711c092345990d3042080a79f6c

SHA512
92f71de31362b9d94d25aaa9eb9db39b00cce778bcf2401ed5caa96036b2b76d921c5e8e1b87a275ef10cc5632db046de39de43bc9ca661ca73a27462127248c

Download Submit
C:\Windows\System\WCQOgyR.exe

Filesize
1.3MB

MD5
1b605bfa1ca7e3e2561f11d01f036d57

SHA1
336439ba8e1f590eec30d29163f6f22128d8479a

SHA256
282d6f516c3f838f1f85d880b5688f9a6d070be8eb58d3c2b1f9c4747784752b

SHA512
a34db95d132d8b55bf0ec37fd0459cb32bbd675d592365ae995062fbd3da314bcff1f0a3f810292405b44e887df07b502ebbe89007797643a46da32e8e374826

Download Submit
C:\Windows\System\WWrjGUs.exe

Filesize
1.3MB

MD5
36cc7d6109f9a8a6cf9474c1841c9740

SHA1
17cef76843eb09bf1415dcadf5954ffdf804a4a1

SHA256
4ff376e8789d66425f71c947f85b6aba8a4190c64ac53c9393ae6e1a4f22fd3f

SHA512
7596fafa77c8bcb61a2f12c195d6b9fedf04a4f28128bf9f99c8e90dc4716e0b8349a67a60feb40ea201680005240b0ac3e9db6136711e412dc5743501a59cfd

Download Submit
C:\Windows\System\WXEDiUW.exe

Filesize
1.3MB

MD5
9059d2f98dfda63b87cf9d9ba88db90c

SHA1
ac4a8e86c093c355062f3a04da08c4710559ad4a

SHA256
593d5f251496ecfae84a27216acbb055c78ddb1c8886e53fb9d7c7c84d5b6062

SHA512
05b52d25039042929e77a51ab40c9d266ada660bad3a60df893d73e14170a3a292473e028d47979af90f7790155bf82f7b922a131b2f4d98d6390a01b31cd80c

Download Submit
C:\Windows\System\XumQgrh.exe

Filesize
1.3MB

MD5
c2118c279651ecadfbacfc0eeb740a83

SHA1
e7e3b2d037b16661a03a0afde5690fe4b46c03b8

SHA256
7a884cdcaae008aaa99381754d515a9984565a5779c9e936378f243ccb732691

SHA512
a3552692458ddcef39ab0cac896cefff09079c573735d37ad32cb51bee10947f51aad021499b07761183ca634acc785136f79fe1e08c2e4d4587340df8b23639

Download Submit
C:\Windows\System\YvGUpxq.exe

Filesize
1.3MB

MD5
b52cd53f27b2451c104dbca3c11da29b

SHA1
a3cade3853e76370d30c151ad6d952fcc883315a

SHA256
b44ede3b8bcdcf5f077673ef5030065a42f9d947e474841224ddead270fb2613

SHA512
8bfbc4c16bcdc4c084f73ecaa0b4eb1f60a6303a20725c0218636bc386e0ba17493c7cd8629d315d21f698d145642e4bf29570133195d11da6d56b339c27cddc

Download Submit
C:\Windows\System\ZHcRAmy.exe

Filesize
1.3MB

MD5
0768ba9aa2636517bcf78b2e335ee09a

SHA1
cb5a041c54c138fa23d457b73dae44722bc93e48

SHA256
6a70f93ec8d52096c74f148e688be7aa92708aae9413e0646c172b13ebf29122

SHA512
c139860634f325a8551c3b1485711f9187309ead0a631353e87959bbd38edcba19e81c3769eb94d0de04676ef737390500e0a245f4161223dd3fc35fd9f47fca

Download Submit
C:\Windows\System\ZXIFJUS.exe

Filesize
1.3MB

MD5
a69628ac06f64efe24fa87bdf5bc9ae0

SHA1
7dfbc19fe21acc30ff59635fbcd1179956151799

SHA256
6b060ff7828cbe177753b38bd1a0451ca22e858be261fde7936393bdddbbccc7

SHA512
08fbd892db6c256db8028b61c2b1f501bd78ee1c8b7b13fa1ad3f5785c7bf224659d4fa0650ea447fb1390fbcbf44e2324415cc1dd877eea6b0188e807755ba5

Download Submit
C:\Windows\System\amvKGpJ.exe

Filesize
1.3MB

MD5
169c5b5401ba72d33a3bbedb089e6b88

SHA1
827bddee035c7dd382ef801a57c5a5f154f38fc9

SHA256
62e508b0f8da45b2079d49c9e63db7d0d76b32dbb8e4c634568761bd258c76f1

SHA512
6ec0ad2070f1308ebd984345aa675b5a79a91c803677e2fa02f0b1b98850e752396e3240c695df7a94d37f3d751addbcb326e7dfeae1fff1db3c28e16daf3b35

Download Submit
C:\Windows\System\bnkqNOj.exe

Filesize
1.3MB

MD5
e65dc7785579e50964ed46293aee89ea

SHA1
9bc52b5a961ddfe3afeb3f04c51cf70a827a8626

SHA256
0e16b2b167a00fc8fa0d7fca899d4818e37e90d7a0a24bf48a268ab7b0a20098

SHA512
02bdf390d87df07223860c9c49575b170f77524eac9527071d0574223a2fc06565db7707469f305aa17532ee6d990dd192b74f696712879a216ba1da8d93fbb9

Download Submit
C:\Windows\System\gakrMDq.exe

Filesize
1.3MB

MD5
f266e19f0690d4196764154c1b8a1cb2

SHA1
04b77765953288fb07a5279dec409b795f4c13c5

SHA256
c037b90e9b0dd1abb855d11e3e347701685efaf0e07d9c8850c9c0dccb24b34c

SHA512
c5a138eead5309b77d010c87b21b340117b6462a10b8b7540d214edcb6db3c1cac676fae0517e52bfc163c3a5628e67f35567e16c51f72f65ffdc98491872bba

Download Submit
C:\Windows\System\hbTsWSm.exe

Filesize
1.3MB

MD5
036d3834e31487d30de41a7b971eb152

SHA1
cc78ab8c73f5cc40df65c5b1fad590830e03b6a7

SHA256
ba4b8231b82f2755e821a7523bcd1826d5609cf8375807456a7f09f7ab57a997

SHA512
82043bf21c092f370569bdef8061190eb6b60760ea95e30fa51f1c744a64fa0130ff12b5601457e7f1a8598447ad598f81721962bc86fbf7c9326616d4870d91

Download Submit
C:\Windows\System\lNcsbfs.exe

Filesize
1.3MB

MD5
5aded8bf011b4976c80ca07de1f8abdc

SHA1
42ebf213dda50f91b28c66410a508f3523b0618c

SHA256
a12d7a01d160fef179d32cd7e22932bf9a2fe95c63903b81be3b29098077d8a0

SHA512
051a4a2b46fcf45e9946f9086876bc739e3dfe9ae29907058b5e38feef9eacb66dcbf2bfaa5fe1e835852bef6767e0cede340a7d12e621fea055f54c6aced765

Download Submit
C:\Windows\System\nHaDeKI.exe

Filesize
1.3MB

MD5
fe2f7aefa2f010fb9796f49aa7d7bfba

SHA1
359c6f25f861f59f58968a9f8ea473f0bcba7a5e

SHA256
3bba00a981bd092c2a53df57ea6ffa2bd57eaa96bb464cf87ee866c6268d9a68

SHA512
06cf7d1bdb882a59377c1c7ff951471cd8d4d44fe57be726ad6cb35af58366af7cbca41e5674d87a1e5e060bb06c705e68341958e644bb896f93990b55703447

Download Submit
C:\Windows\System\nleGYLJ.exe

Filesize
1.3MB

MD5
d895182736470e3a2ada215dd49c0ceb

SHA1
a31a320237e6f5946615a92c10832cb641248617

SHA256
62cfbb391b75ca1ff435992c9080f62570a2c920f87997fa4955c4f889350c17

SHA512
29b54ad3b1e30e180b6fd41040b1e6cd1d47fe279e7513abcf3bfb707b29543ae7c334a2f8cecccb1d662117ce16aa16525e197dd30333a52f1d163dbd86b53b

Download Submit
C:\Windows\System\pINVsRD.exe

Filesize
1.3MB

MD5
d6f3b7d0989c5399c38894fe535aadc1

SHA1
7ae2987c28b0f2acc7d9409f8bee7b1d09ddddf8

SHA256
f748040629897516f490c669b78225abd17cbf13277d8a9f9568d84dea56fd27

SHA512
7a2589ff86d093d7707d632b1a50ca7c81e100a6088499ab7ed7c385bbbcd9ec57f13eadcff88c291ee12c0895c89d76a6ddecef5fa76b142495d9185f028671

Download Submit
C:\Windows\System\qESGhJV.exe

Filesize
1.3MB

MD5
1eca6eee3b65cbb3c274386289cabee7

SHA1
67c67247c7fb4e9671b9e807a29deccd8a76122a

SHA256
4399c2a8fdd3c4b568b12d314b4bda2170db1bbebd85a9b8002aa85ef016ab17

SHA512
a2b6d4d47a9ee083214ba5cb52a91dc711e0127d0d113970cc614af2bde72815707ad17b808c60842cb2254d6dc5fea809eec57ac2bf7a0643a2d234db2e6d46

Download Submit
C:\Windows\System\qiFkPbv.exe

Filesize
1.3MB

MD5
5011bd2b23a0d90b6225bc4df5a45e53

SHA1
5f9db96bdcacaac0568787ca3b327efb673c5b32

SHA256
6ba2bc783266ebf989efdc4a2d78e73a6892060ada986def7e0b172406aeccbb

SHA512
a292556c0452061c8b68933ed2d50481fe2b46ed317a39f980c2ecd98f6d4df693d00c6b9f846257ff1d2839df3b69e28cff9373256d2324beb62820a5107774

Download Submit
C:\Windows\System\rmcukat.exe

Filesize
1.3MB

MD5
5b251496e8cf76b2257a18e722aa469d

SHA1
89fffed34b46ad8ff2eb47ca30850c92fb51e62b

SHA256
825a1d24790d0a8be7cf7f58e5386e1a700a2914f0319a16f6f8d944868b039e

SHA512
dc461ce78f0fe42cf5a15bb1626821760f91efb838d0725b9d4913ff230727b691ab73f358a3d7fafe63199cd8e8b4e9cfe51d12cfb6e1f5ec95863f81e1ad54

Download Submit
C:\Windows\System\sYgGpHV.exe

Filesize
1.3MB

MD5
3cfd0681a926b77229b20658376d3ad1

SHA1
3e948e7b85958bb33f87757f5b153114b0024204

SHA256
976f6d333fe7e74508cc1fb55f4dba64944e7a86d128ce91c21a541ba9f7d1c3

SHA512
82bd18f29af8c38f567fd4901351ca545a7f2cab173bea2e5f3327a92d534bc737dc4a198ff8fc974913351d01e0a29628e7d30d2edd4d6bd4aa4b05b08134ef

Download Submit
C:\Windows\System\sdBYNYt.exe

Filesize
1.3MB

MD5
3557d8064ef59570481404d127e0cfcd

SHA1
a5db9e14bc448ef12ae13f6afb4c7794c493f61a

SHA256
2ebc2e164ce1f41615382befb5b02771bb78c5992a938f9afeb5336e286bc432

SHA512
8ce8aa1ab776e5afd04cf4adddbe04cf4d5142fd2bde4b8fe7b6402a5a90927b59f3155df92f1ca62b84a6f282cfbc6d806121f7edf7a05f24d120183f6104cf

Download Submit
C:\Windows\System\tPuQGtH.exe

Filesize
1.3MB

MD5
369be2b0e7d41116e49910fc07fdf056

SHA1
6e92c9a9456c4658f0e48ba14778f87e6d5e29e9

SHA256
1a7986378f5a4ee5c7098384840127410cdb111e029c4857f2dbdd3738acfecd

SHA512
ae9174bb01b8a5b8942fe81a7843acf9cca0ac565c4c1f04d59867b1a0025b9004f29564b490950b990d1169b3f59c247a8c76e9454354753900d27d06b50238

Download Submit
C:\Windows\System\uKYuSIo.exe

Filesize
1.3MB

MD5
544be648f60d974a03a8b88a796ca1e9

SHA1
bbcd94e0ed2a21bdaac0abf9078c350d76aa05c3

SHA256
5648b4168462bb8e7c9dee4b3b614ccccbd9bf56a3ae5824c126724b1e1a71e6

SHA512
579932e1009583118c0bcc3f50bec02ec214bc4824daa0874777ea8b65994cf86367b34ef46e98a1182ffdecf62ab67d0341554321279123d2726a82537fa580

Download Submit
C:\Windows\System\uZEaNlu.exe

Filesize
8B

MD5
ae15da52589476e2dd9bd862be2400c1

SHA1
314b035d81fc1ca95495168fbe1dc4d1ca8c8039

SHA256
3736f99709064057ca3e16b52b11a9904980ac4822b4922ba84f4574809dc376

SHA512
af3f972dae29d7856a43d074b533b2887f6cd0ca47a0ae60e070fb3955a6785aacd857026c8164be38ff95e8f9b2df4a121ceeb9719825ae89ce0d0b83acecc5

Download Submit
C:\Windows\System\uZmZUMW.exe

Filesize
1.3MB

MD5
b3f386acd09c19cf81d5126c93738954

SHA1
a188f5d2b6ec1df9bb3ee19d4f5fc24669c762e4

SHA256
0f5a2678b5275a94b20cf36601d1cb5b570e42560102513e9cb0718445e332f9

SHA512
bb5b8f91970ad27bce735f8e0c20ddc98b4b5daacf1bad42967d4594332a97ca6493e7f34a9514f09e2f77a45ec8585b2b30f6ab131e03764a27f73a345b24bc

Download Submit
C:\Windows\System\wQYWUjW.exe

Filesize
1.3MB

MD5
44db7c22b01902984de0f3d5e18ea2d2

SHA1
3e614fd13cc8a31afa58fcf4f4f941f479ab9656

SHA256
710810932c8d18e16ef87ed513dbceae93f2fd9fdfbc6f80122a7e67bd5800f9

SHA512
d8965d991e2ad210ba392bda962e46b769939856fb644c90ef824ae2d94747173d62b82d2319fc9328e0b76b545c4451fa01104803ed0f5e1f759acd298f4907

Download Submit
C:\Windows\System\yGEvArK.exe

Filesize
1.3MB

MD5
b21ba844606bbf2812c38da8ecc3a7ad

SHA1
cb7065c0ffb4e5d0a4c132bb7b4a47865c24d98e

SHA256
2096c395df079765f1ba4d56f221b8e344d77cd844f29bd278c8cdbf118c5364

SHA512
8763aab85f75e4c66b73e6a68cbf3ce9c19052828c9507ff09d54a67bce7897d379842e2917831377acad644f7ae487c239611f51fc8a485d302ab7c398d4b7e

Download Submit
C:\Windows\System\yanMULv.exe

Filesize
1.3MB

MD5
d66fc0c9947743e3f6cb68a3539ff0f9

SHA1
cf51813f092a8cefe89d820adac98e46d0eee361

SHA256
fde00cd4a95e4522a2175b6e38e4d0acd7766ff46d369593c48dc8aaac1da459

SHA512
fef1ad8f7ffa616d1eb8ea9bb03d36432b6a96ba1ebed71256e0b3783ecffff7f1692c585d9269484e46ec8e8ab3455183988f823aefa2c51cb6eaa46f25cd41

Download Submit
C:\Windows\System\ypWgIiX.exe

Filesize
1.3MB

MD5
9c18890234980d495af831c4c075e38e

SHA1
246a3a45c6836024a92f7a7808b9218aff91e524

SHA256
4ca20fed152eb5215940859334f5abc00f943fb2537f71fa848496d819d1a43a

SHA512
4863f8c772b82bac74ae117f4a876014f85ed31d59144ee00634723f17ef9d8926e5e1ff23215dd304f72c6e17f5e2ab5bc44957a15532be585da05aa38fadcc

Download Submit
memory/684-52-0x00007FF711290000-0x00007FF711682000-memory.dmp

Filesize
3.9MB

Download
memory/684-2974-0x00007FF711290000-0x00007FF711682000-memory.dmp

Filesize
3.9MB

Download
memory/756-3004-0x00007FF677D10000-0x00007FF678102000-memory.dmp

Filesize
3.9MB

Download
memory/756-773-0x00007FF677D10000-0x00007FF678102000-memory.dmp

Filesize
3.9MB

Download
memory/1088-768-0x00007FF7519F0000-0x00007FF751DE2000-memory.dmp

Filesize
3.9MB

Download
memory/1088-3010-0x00007FF7519F0000-0x00007FF751DE2000-memory.dmp

Filesize
3.9MB

Download
memory/1248-259-0x00007FF735230000-0x00007FF735622000-memory.dmp

Filesize
3.9MB

Download
memory/1248-3019-0x00007FF735230000-0x00007FF735622000-memory.dmp

Filesize
3.9MB

Download
memory/1480-2976-0x00007FF7DCD70000-0x00007FF7DD162000-memory.dmp

Filesize
3.9MB

Download
memory/1480-776-0x00007FF7DCD70000-0x00007FF7DD162000-memory.dmp

Filesize
3.9MB

Download
memory/1612-608-0x00007FF700770000-0x00007FF700B62000-memory.dmp

Filesize
3.9MB

Download
memory/1612-3024-0x00007FF700770000-0x00007FF700B62000-memory.dmp

Filesize
3.9MB

Download
memory/2180-2978-0x00007FF7F6F40000-0x00007FF7F7332000-memory.dmp

Filesize
3.9MB

Download
memory/2180-87-0x00007FF7F6F40000-0x00007FF7F7332000-memory.dmp

Filesize
3.9MB

Download
memory/2232-2990-0x00007FF66A140000-0x00007FF66A532000-memory.dmp

Filesize
3.9MB

Download
memory/2232-599-0x00007FF66A140000-0x00007FF66A532000-memory.dmp

Filesize
3.9MB

Download
memory/2636-323-0x00007FF66DD40000-0x00007FF66E132000-memory.dmp

Filesize
3.9MB

Download
memory/2636-3017-0x00007FF66DD40000-0x00007FF66E132000-memory.dmp

Filesize
3.9MB

Download
memory/2656-766-0x00007FF7C0810000-0x00007FF7C0C02000-memory.dmp

Filesize
3.9MB

Download
memory/2656-2999-0x00007FF7C0810000-0x00007FF7C0C02000-memory.dmp

Filesize
3.9MB

Download
memory/2888-1-0x00000240B6DB0000-0x00000240B6DC0000-memory.dmp

Filesize
64KB

Download
memory/2888-0-0x00007FF66D5F0000-0x00007FF66D9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-2456-0x00007FF66D5F0000-0x00007FF66D9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-2151-0x000001F947040000-0x000001F947062000-memory.dmp

Filesize
136KB

Download
memory/3044-2996-0x00007FF62D030000-0x00007FF62D422000-memory.dmp

Filesize
3.9MB

Download
memory/3044-769-0x00007FF62D030000-0x00007FF62D422000-memory.dmp

Filesize
3.9MB

Download
memory/3048-21-0x00007FF7AF420000-0x00007FF7AF812000-memory.dmp

Filesize
3.9MB

Download
memory/3048-2971-0x00007FF7AF420000-0x00007FF7AF812000-memory.dmp

Filesize
3.9MB

Download
memory/3188-772-0x00007FF651C20000-0x00007FF652012000-memory.dmp

Filesize
3.9MB

Download
memory/3188-3027-0x00007FF651C20000-0x00007FF652012000-memory.dmp

Filesize
3.9MB

Download
memory/3196-767-0x00007FF652170000-0x00007FF652562000-memory.dmp

Filesize
3.9MB

Download
memory/3196-3011-0x00007FF652170000-0x00007FF652562000-memory.dmp

Filesize
3.9MB

Download
memory/3380-2972-0x00007FF7DF880000-0x00007FF7DFC72000-memory.dmp

Filesize
3.9MB

Download
memory/3380-2464-0x00007FF7DF880000-0x00007FF7DFC72000-memory.dmp

Filesize
3.9MB

Download
memory/3380-49-0x00007FF7DF880000-0x00007FF7DFC72000-memory.dmp

Filesize
3.9MB

Download
memory/3408-3015-0x00007FF7AE5D0000-0x00007FF7AE9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3408-770-0x00007FF7AE5D0000-0x00007FF7AE9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3456-771-0x00007FF7A9720000-0x00007FF7A9B12000-memory.dmp

Filesize
3.9MB

Download
memory/3456-3007-0x00007FF7A9720000-0x00007FF7A9B12000-memory.dmp

Filesize
3.9MB

Download
memory/3552-774-0x00007FF613AF0000-0x00007FF613EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3552-3026-0x00007FF613AF0000-0x00007FF613EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3600-134-0x00007FF7174F0000-0x00007FF7178E2000-memory.dmp

Filesize
3.9MB

Download
memory/3600-3006-0x00007FF7174F0000-0x00007FF7178E2000-memory.dmp

Filesize
3.9MB

Download
memory/3988-3013-0x00007FF731AE0000-0x00007FF731ED2000-memory.dmp

Filesize
3.9MB

Download
memory/3988-764-0x00007FF731AE0000-0x00007FF731ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4124-2988-0x00007FF612CC0000-0x00007FF6130B2000-memory.dmp

Filesize
3.9MB

Download
memory/4124-775-0x00007FF612CC0000-0x00007FF6130B2000-memory.dmp

Filesize
3.9MB

Download
memory/4288-2992-0x00007FF7820E0000-0x00007FF7824D2000-memory.dmp

Filesize
3.9MB

Download
memory/4288-208-0x00007FF7820E0000-0x00007FF7824D2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-464-0x00007FF666E30000-0x00007FF667222000-memory.dmp

Filesize
3.9MB

Download
memory/4748-3002-0x00007FF666E30000-0x00007FF667222000-memory.dmp

Filesize
3.9MB

Download
memory/5004-2994-0x00007FF63D1A0000-0x00007FF63D592000-memory.dmp

Filesize
3.9MB

Download
memory/5004-777-0x00007FF63D1A0000-0x00007FF63D592000-memory.dmp

Filesize
3.9MB

Download