xmrig | 73eb3bb3c931277403a294b65ff8ca097b2fada82506dc6f8b9ba9124df58624

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b06f923ec08e6de3dc75e1201e002b00N.exe
Size

1.9MB
MD5

b06f923ec08e6de3dc75e1201e002b00
SHA1

ddabb542cab7bd2ea8190282652138334d727d45
SHA256

73eb3bb3c931277403a294b65ff8ca097b2fada82506dc6f8b9ba9124df58624
SHA512

31987d406f5f65fca394f7f8d19dfa752f88c4291510d7775fe6891e622961c8348d0a0224194083244bd23043fb0def734f1e10c11d8792a083a2fffd8a854d
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4puIfKSj+:NABu

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/1704-464-0x00007FF6BA3F0000-0x00007FF6BA7E2000-memory.dmp	xmrig
behavioral2/memory/1200-510-0x00007FF61A590000-0x00007FF61A982000-memory.dmp	xmrig
behavioral2/memory/3628-562-0x00007FF6FC1E0000-0x00007FF6FC5D2000-memory.dmp	xmrig
behavioral2/memory/3108-571-0x00007FF60B690000-0x00007FF60BA82000-memory.dmp	xmrig
behavioral2/memory/1108-570-0x00007FF7B18E0000-0x00007FF7B1CD2000-memory.dmp	xmrig
behavioral2/memory/1540-569-0x00007FF71D7A0000-0x00007FF71DB92000-memory.dmp	xmrig
behavioral2/memory/1856-568-0x00007FF7C8E60000-0x00007FF7C9252000-memory.dmp	xmrig
behavioral2/memory/3112-572-0x00007FF75D170000-0x00007FF75D562000-memory.dmp	xmrig
behavioral2/memory/3128-2467-0x00007FF67E060000-0x00007FF67E452000-memory.dmp	xmrig
behavioral2/memory/3612-566-0x00007FF7E4820000-0x00007FF7E4C12000-memory.dmp	xmrig
behavioral2/memory/1208-565-0x00007FF778E10000-0x00007FF779202000-memory.dmp	xmrig
behavioral2/memory/2168-564-0x00007FF69D2B0000-0x00007FF69D6A2000-memory.dmp	xmrig
behavioral2/memory/2008-2512-0x00007FF7B7C20000-0x00007FF7B8012000-memory.dmp	xmrig
behavioral2/memory/5000-2479-0x00007FF64A7B0000-0x00007FF64ABA2000-memory.dmp	xmrig
behavioral2/memory/3164-563-0x00007FF660590000-0x00007FF660982000-memory.dmp	xmrig
behavioral2/memory/696-561-0x00007FF706280000-0x00007FF706672000-memory.dmp	xmrig
behavioral2/memory/1304-560-0x00007FF6330D0000-0x00007FF6334C2000-memory.dmp	xmrig
behavioral2/memory/64-363-0x00007FF7DEC10000-0x00007FF7DF002000-memory.dmp	xmrig
behavioral2/memory/1132-311-0x00007FF78E290000-0x00007FF78E682000-memory.dmp	xmrig
behavioral2/memory/4724-310-0x00007FF7512B0000-0x00007FF7516A2000-memory.dmp	xmrig
behavioral2/memory/4852-278-0x00007FF7FEEC0000-0x00007FF7FF2B2000-memory.dmp	xmrig
behavioral2/memory/4360-220-0x00007FF7A1380000-0x00007FF7A1772000-memory.dmp	xmrig
behavioral2/memory/2008-185-0x00007FF7B7C20000-0x00007FF7B8012000-memory.dmp	xmrig
behavioral2/memory/2964-129-0x00007FF631B90000-0x00007FF631F82000-memory.dmp	xmrig
behavioral2/memory/3216-81-0x00007FF665B80000-0x00007FF665F72000-memory.dmp	xmrig
behavioral2/memory/1888-52-0x00007FF68DE60000-0x00007FF68E252000-memory.dmp	xmrig
behavioral2/memory/5000-2992-0x00007FF64A7B0000-0x00007FF64ABA2000-memory.dmp	xmrig
behavioral2/memory/1856-2994-0x00007FF7C8E60000-0x00007FF7C9252000-memory.dmp	xmrig
behavioral2/memory/1888-2996-0x00007FF68DE60000-0x00007FF68E252000-memory.dmp	xmrig
behavioral2/memory/3216-2998-0x00007FF665B80000-0x00007FF665F72000-memory.dmp	xmrig
behavioral2/memory/4852-3000-0x00007FF7FEEC0000-0x00007FF7FF2B2000-memory.dmp	xmrig
behavioral2/memory/2964-3015-0x00007FF631B90000-0x00007FF631F82000-memory.dmp	xmrig
behavioral2/memory/4724-3011-0x00007FF7512B0000-0x00007FF7516A2000-memory.dmp	xmrig
behavioral2/memory/2008-3032-0x00007FF7B7C20000-0x00007FF7B8012000-memory.dmp	xmrig
behavioral2/memory/1108-3034-0x00007FF7B18E0000-0x00007FF7B1CD2000-memory.dmp	xmrig
behavioral2/memory/3108-3039-0x00007FF60B690000-0x00007FF60BA82000-memory.dmp	xmrig
behavioral2/memory/3628-3042-0x00007FF6FC1E0000-0x00007FF6FC5D2000-memory.dmp	xmrig
behavioral2/memory/696-3044-0x00007FF706280000-0x00007FF706672000-memory.dmp	xmrig
behavioral2/memory/1304-3037-0x00007FF6330D0000-0x00007FF6334C2000-memory.dmp	xmrig
behavioral2/memory/1540-3029-0x00007FF71D7A0000-0x00007FF71DB92000-memory.dmp	xmrig
behavioral2/memory/64-3027-0x00007FF7DEC10000-0x00007FF7DF002000-memory.dmp	xmrig
behavioral2/memory/1132-3026-0x00007FF78E290000-0x00007FF78E682000-memory.dmp	xmrig
behavioral2/memory/1200-3021-0x00007FF61A590000-0x00007FF61A982000-memory.dmp	xmrig
behavioral2/memory/3164-3019-0x00007FF660590000-0x00007FF660982000-memory.dmp	xmrig
behavioral2/memory/4360-3017-0x00007FF7A1380000-0x00007FF7A1772000-memory.dmp	xmrig
behavioral2/memory/1704-3023-0x00007FF6BA3F0000-0x00007FF6BA7E2000-memory.dmp	xmrig
behavioral2/memory/3112-3072-0x00007FF75D170000-0x00007FF75D562000-memory.dmp	xmrig
behavioral2/memory/1208-3071-0x00007FF778E10000-0x00007FF779202000-memory.dmp	xmrig
behavioral2/memory/2168-3067-0x00007FF69D2B0000-0x00007FF69D6A2000-memory.dmp	xmrig
behavioral2/memory/3612-3069-0x00007FF7E4820000-0x00007FF7E4C12000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2648	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
5000	uHMbPwB.exe
1856	hpYHVMt.exe
1888	ZMGXsuY.exe
3216	iYvgRsB.exe
2964	oupLlpo.exe
2008	gqCEHJa.exe
4360	YkWSObH.exe
4852	lQUfHkZ.exe
4724	DnglLrb.exe
1132	LkYypGi.exe
64	PdqtlAJ.exe
1704	likZqmQ.exe
1540	MbLTuYY.exe
1200	IFhuqjF.exe
1108	aqINeJz.exe
1304	aWUGpTw.exe
3108	lhhEQTm.exe
696	nClXjzH.exe
3628	zZVDZuw.exe
3164	raDOpog.exe
2168	mjNyrtz.exe
3112	DBOCQNC.exe
1208	kOJtDdm.exe
3612	tsGBqBE.exe
4500	LpLHhUo.exe
1476	SNGYKgE.exe
1984	gkRnHLT.exe
464	tjgxUjq.exe
4496	JdkaVgJ.exe
2316	DEjRwBI.exe
4480	MlJdeWz.exe
1100	roCnKdg.exe
2904	ruSqWqZ.exe
1660	LRaqxpf.exe
3988	OParWZw.exe
3472	dsEfkQs.exe
532	znPSxOM.exe
1552	gxGWgsi.exe
3672	IUSfYpn.exe
2620	jijVqzE.exe
4624	spgjlfw.exe
3372	sqLwvuN.exe
1664	aIFgubw.exe
4788	EJbfCeH.exe
1724	ttdjqcd.exe
4132	aMjfwAR.exe
4976	AGhGWht.exe
3136	cQpnGff.exe
4516	BonxUMx.exe
3572	jmsNIAa.exe
4432	zLjYztM.exe
2680	nccYziT.exe
2332	LkZHkgX.exe
628	mlKWMIJ.exe
4964	GbUVupN.exe
3020	cTAFYTX.exe
4464	lPhzMtp.exe
632	MpHxOdO.exe
4472	XbDZigj.exe
1332	WGmHiaq.exe
732	XvMmoTQ.exe
4384	RzpAwey.exe
4340	gazLgyS.exe
4560	yzTGouT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3128-0-0x00007FF67E060000-0x00007FF67E452000-memory.dmp	upx
behavioral2/files/0x0009000000023447-5.dat	upx
behavioral2/files/0x00070000000234a8-56.dat	upx
behavioral2/files/0x00070000000234a9-76.dat	upx
behavioral2/files/0x00070000000234cb-209.dat	upx
behavioral2/files/0x00070000000234ca-208.dat	upx
behavioral2/files/0x00070000000234b5-199.dat	upx
behavioral2/memory/1704-464-0x00007FF6BA3F0000-0x00007FF6BA7E2000-memory.dmp	upx
behavioral2/memory/1200-510-0x00007FF61A590000-0x00007FF61A982000-memory.dmp	upx
behavioral2/memory/3628-562-0x00007FF6FC1E0000-0x00007FF6FC5D2000-memory.dmp	upx
behavioral2/memory/3108-571-0x00007FF60B690000-0x00007FF60BA82000-memory.dmp	upx
behavioral2/memory/1108-570-0x00007FF7B18E0000-0x00007FF7B1CD2000-memory.dmp	upx
behavioral2/memory/1540-569-0x00007FF71D7A0000-0x00007FF71DB92000-memory.dmp	upx
behavioral2/memory/1856-568-0x00007FF7C8E60000-0x00007FF7C9252000-memory.dmp	upx
behavioral2/memory/3112-572-0x00007FF75D170000-0x00007FF75D562000-memory.dmp	upx
behavioral2/memory/3128-2467-0x00007FF67E060000-0x00007FF67E452000-memory.dmp	upx
behavioral2/memory/3612-566-0x00007FF7E4820000-0x00007FF7E4C12000-memory.dmp	upx
behavioral2/memory/1208-565-0x00007FF778E10000-0x00007FF779202000-memory.dmp	upx
behavioral2/memory/2168-564-0x00007FF69D2B0000-0x00007FF69D6A2000-memory.dmp	upx
behavioral2/memory/2008-2512-0x00007FF7B7C20000-0x00007FF7B8012000-memory.dmp	upx
behavioral2/memory/5000-2479-0x00007FF64A7B0000-0x00007FF64ABA2000-memory.dmp	upx
behavioral2/memory/3164-563-0x00007FF660590000-0x00007FF660982000-memory.dmp	upx
behavioral2/memory/696-561-0x00007FF706280000-0x00007FF706672000-memory.dmp	upx
behavioral2/memory/1304-560-0x00007FF6330D0000-0x00007FF6334C2000-memory.dmp	upx
behavioral2/memory/64-363-0x00007FF7DEC10000-0x00007FF7DF002000-memory.dmp	upx
behavioral2/memory/1132-311-0x00007FF78E290000-0x00007FF78E682000-memory.dmp	upx
behavioral2/memory/4724-310-0x00007FF7512B0000-0x00007FF7516A2000-memory.dmp	upx
behavioral2/memory/4852-278-0x00007FF7FEEC0000-0x00007FF7FF2B2000-memory.dmp	upx
behavioral2/memory/4360-220-0x00007FF7A1380000-0x00007FF7A1772000-memory.dmp	upx
behavioral2/files/0x00070000000234b4-195.dat	upx
behavioral2/files/0x00070000000234c9-191.dat	upx
behavioral2/files/0x00070000000234c7-189.dat	upx
behavioral2/memory/2008-185-0x00007FF7B7C20000-0x00007FF7B8012000-memory.dmp	upx
behavioral2/files/0x00070000000234c4-176.dat	upx
behavioral2/files/0x00070000000234c3-171.dat	upx
behavioral2/files/0x00070000000234c2-170.dat	upx
behavioral2/files/0x00070000000234c0-169.dat	upx
behavioral2/files/0x00070000000234bf-166.dat	upx
behavioral2/files/0x00070000000234bc-162.dat	upx
behavioral2/files/0x00080000000234be-210.dat	upx
behavioral2/files/0x00070000000234b1-157.dat	upx
behavioral2/files/0x00070000000234bb-156.dat	upx
behavioral2/files/0x00070000000234b0-154.dat	upx
behavioral2/files/0x00070000000234af-152.dat	upx
behavioral2/files/0x00070000000234ba-192.dat	upx
behavioral2/files/0x00070000000234b9-149.dat	upx
behavioral2/files/0x00070000000234b8-147.dat	upx
behavioral2/files/0x00070000000234b2-146.dat	upx
behavioral2/files/0x00070000000234ad-140.dat	upx
behavioral2/files/0x00070000000234c6-187.dat	upx
behavioral2/files/0x00070000000234c5-186.dat	upx
behavioral2/files/0x00070000000234b7-182.dat	upx
behavioral2/files/0x00070000000234b6-122.dat	upx
behavioral2/files/0x00070000000234a5-115.dat	upx
behavioral2/files/0x00070000000234b3-151.dat	upx
behavioral2/files/0x00070000000234ae-136.dat	upx
behavioral2/files/0x00070000000234ac-134.dat	upx
behavioral2/memory/2964-129-0x00007FF631B90000-0x00007FF631F82000-memory.dmp	upx
behavioral2/memory/3216-81-0x00007FF665B80000-0x00007FF665F72000-memory.dmp	upx
behavioral2/files/0x00070000000234ab-86.dat	upx
behavioral2/files/0x00070000000234aa-80.dat	upx
behavioral2/files/0x00070000000234a7-62.dat	upx
behavioral2/files/0x00070000000234a6-55.dat	upx
behavioral2/memory/1888-52-0x00007FF68DE60000-0x00007FF68E252000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\juExPLh.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\JdkaVgJ.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\ruSqWqZ.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\TxbCRUk.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\IxVMFWu.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\zLQHcCq.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\xydCHgG.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\fFlGwYs.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\LdTAlUx.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\UNfstOw.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\ilvvlWZ.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\VKpSzmI.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\LpLHhUo.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\rWOnKPN.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\xpTJbVc.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\poelCAu.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\DPyUhtW.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\bAlfyTh.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\HtbCMiz.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\lkMEIZa.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\eZnmauD.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\mbUZPbX.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\sXJaEay.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\UFejUiD.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\qyQBPtM.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\IXjTMUf.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\ktRhBZi.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\HyuyDRC.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\JTZJkqZ.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\jEhkrBy.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\mjwjHiJ.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\zZVDZuw.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\XaDfwCf.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\lZYuwWg.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\PsyvHsG.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\AsNuzkX.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\vzRJcFG.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\miwrFFf.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\VTFTqLP.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\vqnLEFx.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\gOYgttg.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\etyQXIa.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\jWjKJrD.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\ZJbWeJL.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\SVvhxlK.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\izuDscC.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\IRUNuNj.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\aheEmAM.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\zfbBCZm.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\dhKngnH.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\SjWMvgB.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\sggeXsS.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\ejyjjni.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\WGlAgfJ.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\ojtJGfc.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\CbPEqDO.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\PUIPdte.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\RzpAwey.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\KdcZOKZ.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\OvtYYAS.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\zZPAEUa.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\UABhvSE.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\ubWZmGx.exe	b06f923ec08e6de3dc75e1201e002b00N.exe
File created	C:\Windows\System\HFQnyKO.exe	b06f923ec08e6de3dc75e1201e002b00N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2648	powershell.exe
2648	powershell.exe
2648	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeLockMemoryPrivilege	3128	b06f923ec08e6de3dc75e1201e002b00N.exe
Token: SeLockMemoryPrivilege	3128	b06f923ec08e6de3dc75e1201e002b00N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 2648	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	84
PID 3128 wrote to memory of 2648	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	84
PID 3128 wrote to memory of 5000	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	85
PID 3128 wrote to memory of 5000	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	85
PID 3128 wrote to memory of 1856	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	86
PID 3128 wrote to memory of 1856	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	86
PID 3128 wrote to memory of 1888	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	87
PID 3128 wrote to memory of 1888	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	87
PID 3128 wrote to memory of 3216	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	88
PID 3128 wrote to memory of 3216	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	88
PID 3128 wrote to memory of 4360	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	89
PID 3128 wrote to memory of 4360	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	89
PID 3128 wrote to memory of 2964	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	90
PID 3128 wrote to memory of 2964	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	90
PID 3128 wrote to memory of 2008	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	91
PID 3128 wrote to memory of 2008	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	91
PID 3128 wrote to memory of 4852	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	92
PID 3128 wrote to memory of 4852	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	92
PID 3128 wrote to memory of 4724	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	93
PID 3128 wrote to memory of 4724	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	93
PID 3128 wrote to memory of 1132	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	94
PID 3128 wrote to memory of 1132	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	94
PID 3128 wrote to memory of 64	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	95
PID 3128 wrote to memory of 64	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	95
PID 3128 wrote to memory of 1704	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	96
PID 3128 wrote to memory of 1704	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	96
PID 3128 wrote to memory of 1540	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	97
PID 3128 wrote to memory of 1540	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	97
PID 3128 wrote to memory of 1200	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	98
PID 3128 wrote to memory of 1200	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	98
PID 3128 wrote to memory of 1108	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	99
PID 3128 wrote to memory of 1108	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	99
PID 3128 wrote to memory of 1304	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	100
PID 3128 wrote to memory of 1304	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	100
PID 3128 wrote to memory of 3108	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	101
PID 3128 wrote to memory of 3108	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	101
PID 3128 wrote to memory of 3112	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	102
PID 3128 wrote to memory of 3112	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	102
PID 3128 wrote to memory of 1476	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	103
PID 3128 wrote to memory of 1476	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	103
PID 3128 wrote to memory of 696	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	104
PID 3128 wrote to memory of 696	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	104
PID 3128 wrote to memory of 3628	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	105
PID 3128 wrote to memory of 3628	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	105
PID 3128 wrote to memory of 3164	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	106
PID 3128 wrote to memory of 3164	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	106
PID 3128 wrote to memory of 2168	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	107
PID 3128 wrote to memory of 2168	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	107
PID 3128 wrote to memory of 1208	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	108
PID 3128 wrote to memory of 1208	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	108
PID 3128 wrote to memory of 3612	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	109
PID 3128 wrote to memory of 3612	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	109
PID 3128 wrote to memory of 4500	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	110
PID 3128 wrote to memory of 4500	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	110
PID 3128 wrote to memory of 1984	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	111
PID 3128 wrote to memory of 1984	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	111
PID 3128 wrote to memory of 464	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	112
PID 3128 wrote to memory of 464	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	112
PID 3128 wrote to memory of 4496	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	113
PID 3128 wrote to memory of 4496	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	113
PID 3128 wrote to memory of 2316	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	114
PID 3128 wrote to memory of 2316	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	114
PID 3128 wrote to memory of 4624	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	115
PID 3128 wrote to memory of 4624	3128	b06f923ec08e6de3dc75e1201e002b00N.exe	115

C:\Users\Admin\AppData\Local\Temp\b06f923ec08e6de3dc75e1201e002b00N.exe
"C:\Users\Admin\AppData\Local\Temp\b06f923ec08e6de3dc75e1201e002b00N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\System\uHMbPwB.exe
  C:\Windows\System\uHMbPwB.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\hpYHVMt.exe
  C:\Windows\System\hpYHVMt.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\ZMGXsuY.exe
  C:\Windows\System\ZMGXsuY.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\iYvgRsB.exe
  C:\Windows\System\iYvgRsB.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\YkWSObH.exe
  C:\Windows\System\YkWSObH.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\oupLlpo.exe
  C:\Windows\System\oupLlpo.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\gqCEHJa.exe
  C:\Windows\System\gqCEHJa.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\lQUfHkZ.exe
  C:\Windows\System\lQUfHkZ.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\DnglLrb.exe
  C:\Windows\System\DnglLrb.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\LkYypGi.exe
  C:\Windows\System\LkYypGi.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\PdqtlAJ.exe
  C:\Windows\System\PdqtlAJ.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\likZqmQ.exe
  C:\Windows\System\likZqmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\MbLTuYY.exe
  C:\Windows\System\MbLTuYY.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\IFhuqjF.exe
  C:\Windows\System\IFhuqjF.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\aqINeJz.exe
  C:\Windows\System\aqINeJz.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\aWUGpTw.exe
  C:\Windows\System\aWUGpTw.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\lhhEQTm.exe
  C:\Windows\System\lhhEQTm.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\DBOCQNC.exe
  C:\Windows\System\DBOCQNC.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\SNGYKgE.exe
  C:\Windows\System\SNGYKgE.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\nClXjzH.exe
  C:\Windows\System\nClXjzH.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\zZVDZuw.exe
  C:\Windows\System\zZVDZuw.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\raDOpog.exe
  C:\Windows\System\raDOpog.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\mjNyrtz.exe
  C:\Windows\System\mjNyrtz.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\kOJtDdm.exe
  C:\Windows\System\kOJtDdm.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\tsGBqBE.exe
  C:\Windows\System\tsGBqBE.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\LpLHhUo.exe
  C:\Windows\System\LpLHhUo.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\gkRnHLT.exe
  C:\Windows\System\gkRnHLT.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\tjgxUjq.exe
  C:\Windows\System\tjgxUjq.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\JdkaVgJ.exe
  C:\Windows\System\JdkaVgJ.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\DEjRwBI.exe
  C:\Windows\System\DEjRwBI.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\spgjlfw.exe
  C:\Windows\System\spgjlfw.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\MlJdeWz.exe
  C:\Windows\System\MlJdeWz.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\roCnKdg.exe
  C:\Windows\System\roCnKdg.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\ruSqWqZ.exe
  C:\Windows\System\ruSqWqZ.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\LRaqxpf.exe
  C:\Windows\System\LRaqxpf.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\OParWZw.exe
  C:\Windows\System\OParWZw.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\dsEfkQs.exe
  C:\Windows\System\dsEfkQs.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\AGhGWht.exe
  C:\Windows\System\AGhGWht.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\znPSxOM.exe
  C:\Windows\System\znPSxOM.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\gxGWgsi.exe
  C:\Windows\System\gxGWgsi.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\IUSfYpn.exe
  C:\Windows\System\IUSfYpn.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\jijVqzE.exe
  C:\Windows\System\jijVqzE.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\sqLwvuN.exe
  C:\Windows\System\sqLwvuN.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\aIFgubw.exe
  C:\Windows\System\aIFgubw.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\EJbfCeH.exe
  C:\Windows\System\EJbfCeH.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\ttdjqcd.exe
  C:\Windows\System\ttdjqcd.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\aMjfwAR.exe
  C:\Windows\System\aMjfwAR.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\cQpnGff.exe
  C:\Windows\System\cQpnGff.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\BonxUMx.exe
  C:\Windows\System\BonxUMx.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\jmsNIAa.exe
  C:\Windows\System\jmsNIAa.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\zLjYztM.exe
  C:\Windows\System\zLjYztM.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\nccYziT.exe
  C:\Windows\System\nccYziT.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\LkZHkgX.exe
  C:\Windows\System\LkZHkgX.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\mlKWMIJ.exe
  C:\Windows\System\mlKWMIJ.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\GbUVupN.exe
  C:\Windows\System\GbUVupN.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\cTAFYTX.exe
  C:\Windows\System\cTAFYTX.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\lPhzMtp.exe
  C:\Windows\System\lPhzMtp.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\MpHxOdO.exe
  C:\Windows\System\MpHxOdO.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\XbDZigj.exe
  C:\Windows\System\XbDZigj.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\WGmHiaq.exe
  C:\Windows\System\WGmHiaq.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\XvMmoTQ.exe
  C:\Windows\System\XvMmoTQ.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\RzpAwey.exe
  C:\Windows\System\RzpAwey.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\gazLgyS.exe
  C:\Windows\System\gazLgyS.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\yzTGouT.exe
  C:\Windows\System\yzTGouT.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\KbNWlPr.exe
  C:\Windows\System\KbNWlPr.exe
  2⤵
  PID:2748
- C:\Windows\System\VTFTqLP.exe
  C:\Windows\System\VTFTqLP.exe
  2⤵
  PID:1752
- C:\Windows\System\VLjmZDP.exe
  C:\Windows\System\VLjmZDP.exe
  2⤵
  PID:1344
- C:\Windows\System\ggpSLEE.exe
  C:\Windows\System\ggpSLEE.exe
  2⤵
  PID:1248
- C:\Windows\System\ADzjFsu.exe
  C:\Windows\System\ADzjFsu.exe
  2⤵
  PID:924
- C:\Windows\System\qVsAbyW.exe
  C:\Windows\System\qVsAbyW.exe
  2⤵
  PID:3880
- C:\Windows\System\MpoujyH.exe
  C:\Windows\System\MpoujyH.exe
  2⤵
  PID:4524
- C:\Windows\System\YeApAvm.exe
  C:\Windows\System\YeApAvm.exe
  2⤵
  PID:3908
- C:\Windows\System\UtZJNQV.exe
  C:\Windows\System\UtZJNQV.exe
  2⤵
  PID:3940
- C:\Windows\System\HSAvkxk.exe
  C:\Windows\System\HSAvkxk.exe
  2⤵
  PID:1848
- C:\Windows\System\AjnkVBZ.exe
  C:\Windows\System\AjnkVBZ.exe
  2⤵
  PID:4876
- C:\Windows\System\SfSFpMB.exe
  C:\Windows\System\SfSFpMB.exe
  2⤵
  PID:2116
- C:\Windows\System\AbUYvHH.exe
  C:\Windows\System\AbUYvHH.exe
  2⤵
  PID:1896
- C:\Windows\System\vVfrCae.exe
  C:\Windows\System\vVfrCae.exe
  2⤵
  PID:2888
- C:\Windows\System\oIwvHvF.exe
  C:\Windows\System\oIwvHvF.exe
  2⤵
  PID:3528
- C:\Windows\System\YsXXUMM.exe
  C:\Windows\System\YsXXUMM.exe
  2⤵
  PID:5028
- C:\Windows\System\ShIujYu.exe
  C:\Windows\System\ShIujYu.exe
  2⤵
  PID:3092
- C:\Windows\System\QSBMrIu.exe
  C:\Windows\System\QSBMrIu.exe
  2⤵
  PID:3936
- C:\Windows\System\VsLsCEL.exe
  C:\Windows\System\VsLsCEL.exe
  2⤵
  PID:5016
- C:\Windows\System\ALaHkLq.exe
  C:\Windows\System\ALaHkLq.exe
  2⤵
  PID:2188
- C:\Windows\System\fpTacLM.exe
  C:\Windows\System\fpTacLM.exe
  2⤵
  PID:3552
- C:\Windows\System\CxMbEfV.exe
  C:\Windows\System\CxMbEfV.exe
  2⤵
  PID:1608
- C:\Windows\System\qrxtxoQ.exe
  C:\Windows\System\qrxtxoQ.exe
  2⤵
  PID:1672
- C:\Windows\System\MCnKBoK.exe
  C:\Windows\System\MCnKBoK.exe
  2⤵
  PID:4532
- C:\Windows\System\zDuDcut.exe
  C:\Windows\System\zDuDcut.exe
  2⤵
  PID:4272
- C:\Windows\System\EZLrOMc.exe
  C:\Windows\System\EZLrOMc.exe
  2⤵
  PID:5128
- C:\Windows\System\aoaJNxi.exe
  C:\Windows\System\aoaJNxi.exe
  2⤵
  PID:5148
- C:\Windows\System\PwZxlAt.exe
  C:\Windows\System\PwZxlAt.exe
  2⤵
  PID:5200
- C:\Windows\System\qIHxKIX.exe
  C:\Windows\System\qIHxKIX.exe
  2⤵
  PID:5284
- C:\Windows\System\CUXAqHQ.exe
  C:\Windows\System\CUXAqHQ.exe
  2⤵
  PID:5304
- C:\Windows\System\PDdNPDV.exe
  C:\Windows\System\PDdNPDV.exe
  2⤵
  PID:5332
- C:\Windows\System\edBjxRY.exe
  C:\Windows\System\edBjxRY.exe
  2⤵
  PID:5348
- C:\Windows\System\FtNDkew.exe
  C:\Windows\System\FtNDkew.exe
  2⤵
  PID:5368
- C:\Windows\System\Xilxvst.exe
  C:\Windows\System\Xilxvst.exe
  2⤵
  PID:5396
- C:\Windows\System\DGQEyJc.exe
  C:\Windows\System\DGQEyJc.exe
  2⤵
  PID:5412
- C:\Windows\System\SUMHwnB.exe
  C:\Windows\System\SUMHwnB.exe
  2⤵
  PID:5432
- C:\Windows\System\jbNwxvo.exe
  C:\Windows\System\jbNwxvo.exe
  2⤵
  PID:5452
- C:\Windows\System\JLhRrIN.exe
  C:\Windows\System\JLhRrIN.exe
  2⤵
  PID:5472
- C:\Windows\System\yNwMPKh.exe
  C:\Windows\System\yNwMPKh.exe
  2⤵
  PID:5500
- C:\Windows\System\CJwwSSh.exe
  C:\Windows\System\CJwwSSh.exe
  2⤵
  PID:5516
- C:\Windows\System\JZCPWuV.exe
  C:\Windows\System\JZCPWuV.exe
  2⤵
  PID:5536
- C:\Windows\System\rUMibjO.exe
  C:\Windows\System\rUMibjO.exe
  2⤵
  PID:5560
- C:\Windows\System\PfcgxAR.exe
  C:\Windows\System\PfcgxAR.exe
  2⤵
  PID:5576
- C:\Windows\System\kUPLPxt.exe
  C:\Windows\System\kUPLPxt.exe
  2⤵
  PID:5596
- C:\Windows\System\cbaavdd.exe
  C:\Windows\System\cbaavdd.exe
  2⤵
  PID:5616
- C:\Windows\System\wIasAqu.exe
  C:\Windows\System\wIasAqu.exe
  2⤵
  PID:5632
- C:\Windows\System\nITrsst.exe
  C:\Windows\System\nITrsst.exe
  2⤵
  PID:5652
- C:\Windows\System\DCAVDBk.exe
  C:\Windows\System\DCAVDBk.exe
  2⤵
  PID:5672
- C:\Windows\System\UJjleaD.exe
  C:\Windows\System\UJjleaD.exe
  2⤵
  PID:5700
- C:\Windows\System\rZVyLeE.exe
  C:\Windows\System\rZVyLeE.exe
  2⤵
  PID:5720
- C:\Windows\System\BtJSbwS.exe
  C:\Windows\System\BtJSbwS.exe
  2⤵
  PID:5740
- C:\Windows\System\eHeuczg.exe
  C:\Windows\System\eHeuczg.exe
  2⤵
  PID:5764
- C:\Windows\System\EUrmVOM.exe
  C:\Windows\System\EUrmVOM.exe
  2⤵
  PID:5788
- C:\Windows\System\HNwcylc.exe
  C:\Windows\System\HNwcylc.exe
  2⤵
  PID:5804
- C:\Windows\System\jCnkBRY.exe
  C:\Windows\System\jCnkBRY.exe
  2⤵
  PID:5828
- C:\Windows\System\XVowDtN.exe
  C:\Windows\System\XVowDtN.exe
  2⤵
  PID:5848
- C:\Windows\System\kszMkWa.exe
  C:\Windows\System\kszMkWa.exe
  2⤵
  PID:5872
- C:\Windows\System\eSWtNSD.exe
  C:\Windows\System\eSWtNSD.exe
  2⤵
  PID:5892
- C:\Windows\System\akbwSTD.exe
  C:\Windows\System\akbwSTD.exe
  2⤵
  PID:5908
- C:\Windows\System\BqKTovJ.exe
  C:\Windows\System\BqKTovJ.exe
  2⤵
  PID:5932
- C:\Windows\System\bAlfyTh.exe
  C:\Windows\System\bAlfyTh.exe
  2⤵
  PID:5952
- C:\Windows\System\xydCHgG.exe
  C:\Windows\System\xydCHgG.exe
  2⤵
  PID:5972
- C:\Windows\System\sVsWJot.exe
  C:\Windows\System\sVsWJot.exe
  2⤵
  PID:5996
- C:\Windows\System\EqHtlnW.exe
  C:\Windows\System\EqHtlnW.exe
  2⤵
  PID:6016
- C:\Windows\System\vSdIyeB.exe
  C:\Windows\System\vSdIyeB.exe
  2⤵
  PID:6036
- C:\Windows\System\UWaAhAh.exe
  C:\Windows\System\UWaAhAh.exe
  2⤵
  PID:6060
- C:\Windows\System\FbXSDrP.exe
  C:\Windows\System\FbXSDrP.exe
  2⤵
  PID:6080
- C:\Windows\System\EWUjEfr.exe
  C:\Windows\System\EWUjEfr.exe
  2⤵
  PID:4696
- C:\Windows\System\ALsKIoy.exe
  C:\Windows\System\ALsKIoy.exe
  2⤵
  PID:2380
- C:\Windows\System\CXWkELx.exe
  C:\Windows\System\CXWkELx.exe
  2⤵
  PID:1860
- C:\Windows\System\TqvPRGU.exe
  C:\Windows\System\TqvPRGU.exe
  2⤵
  PID:1564
- C:\Windows\System\KjQpOkU.exe
  C:\Windows\System\KjQpOkU.exe
  2⤵
  PID:2988
- C:\Windows\System\uBYVYaf.exe
  C:\Windows\System\uBYVYaf.exe
  2⤵
  PID:5144
- C:\Windows\System\cQFBHmm.exe
  C:\Windows\System\cQFBHmm.exe
  2⤵
  PID:3028
- C:\Windows\System\cghVVsO.exe
  C:\Windows\System\cghVVsO.exe
  2⤵
  PID:3884
- C:\Windows\System\TWTTzmA.exe
  C:\Windows\System\TWTTzmA.exe
  2⤵
  PID:2064
- C:\Windows\System\vYBOIto.exe
  C:\Windows\System\vYBOIto.exe
  2⤵
  PID:4448
- C:\Windows\System\eXnophj.exe
  C:\Windows\System\eXnophj.exe
  2⤵
  PID:5064
- C:\Windows\System\LopYXII.exe
  C:\Windows\System\LopYXII.exe
  2⤵
  PID:404
- C:\Windows\System\oOGRTyW.exe
  C:\Windows\System\oOGRTyW.exe
  2⤵
  PID:1536
- C:\Windows\System\zCJUYQW.exe
  C:\Windows\System\zCJUYQW.exe
  2⤵
  PID:4968
- C:\Windows\System\YTMXmeb.exe
  C:\Windows\System\YTMXmeb.exe
  2⤵
  PID:1212
- C:\Windows\System\vYLYTyo.exe
  C:\Windows\System\vYLYTyo.exe
  2⤵
  PID:3232
- C:\Windows\System\JrVCwTp.exe
  C:\Windows\System\JrVCwTp.exe
  2⤵
  PID:4840
- C:\Windows\System\SdEFTSG.exe
  C:\Windows\System\SdEFTSG.exe
  2⤵
  PID:4276
- C:\Windows\System\pOybRCp.exe
  C:\Windows\System\pOybRCp.exe
  2⤵
  PID:5044
- C:\Windows\System\rgLfZIb.exe
  C:\Windows\System\rgLfZIb.exe
  2⤵
  PID:456
- C:\Windows\System\iiNMxSi.exe
  C:\Windows\System\iiNMxSi.exe
  2⤵
  PID:6156
- C:\Windows\System\eDITCmC.exe
  C:\Windows\System\eDITCmC.exe
  2⤵
  PID:6172
- C:\Windows\System\YayEwLW.exe
  C:\Windows\System\YayEwLW.exe
  2⤵
  PID:6200
- C:\Windows\System\LhedoKr.exe
  C:\Windows\System\LhedoKr.exe
  2⤵
  PID:6224
- C:\Windows\System\ycYwZcw.exe
  C:\Windows\System\ycYwZcw.exe
  2⤵
  PID:6244
- C:\Windows\System\JCWhILe.exe
  C:\Windows\System\JCWhILe.exe
  2⤵
  PID:6268
- C:\Windows\System\ziZSzEA.exe
  C:\Windows\System\ziZSzEA.exe
  2⤵
  PID:6288
- C:\Windows\System\ZmARDGS.exe
  C:\Windows\System\ZmARDGS.exe
  2⤵
  PID:6312
- C:\Windows\System\CMlHAIv.exe
  C:\Windows\System\CMlHAIv.exe
  2⤵
  PID:6328
- C:\Windows\System\sNJHDbk.exe
  C:\Windows\System\sNJHDbk.exe
  2⤵
  PID:6412
- C:\Windows\System\BrrEecz.exe
  C:\Windows\System\BrrEecz.exe
  2⤵
  PID:6432
- C:\Windows\System\FQSfokf.exe
  C:\Windows\System\FQSfokf.exe
  2⤵
  PID:6452
- C:\Windows\System\QfFiRJO.exe
  C:\Windows\System\QfFiRJO.exe
  2⤵
  PID:6468
- C:\Windows\System\rWOnKPN.exe
  C:\Windows\System\rWOnKPN.exe
  2⤵
  PID:6496
- C:\Windows\System\qNLbXft.exe
  C:\Windows\System\qNLbXft.exe
  2⤵
  PID:6528
- C:\Windows\System\DtqwfXK.exe
  C:\Windows\System\DtqwfXK.exe
  2⤵
  PID:6552
- C:\Windows\System\vVqahab.exe
  C:\Windows\System\vVqahab.exe
  2⤵
  PID:6572
- C:\Windows\System\vUoCnsm.exe
  C:\Windows\System\vUoCnsm.exe
  2⤵
  PID:6592
- C:\Windows\System\SewZFRp.exe
  C:\Windows\System\SewZFRp.exe
  2⤵
  PID:6612
- C:\Windows\System\fFlGwYs.exe
  C:\Windows\System\fFlGwYs.exe
  2⤵
  PID:6636
- C:\Windows\System\pqyxmnA.exe
  C:\Windows\System\pqyxmnA.exe
  2⤵
  PID:6656
- C:\Windows\System\SKtjgRp.exe
  C:\Windows\System\SKtjgRp.exe
  2⤵
  PID:6672
- C:\Windows\System\YJFUwhu.exe
  C:\Windows\System\YJFUwhu.exe
  2⤵
  PID:6696
- C:\Windows\System\ApFBbrO.exe
  C:\Windows\System\ApFBbrO.exe
  2⤵
  PID:6716
- C:\Windows\System\ZMbIQQC.exe
  C:\Windows\System\ZMbIQQC.exe
  2⤵
  PID:6736
- C:\Windows\System\boBIrhZ.exe
  C:\Windows\System\boBIrhZ.exe
  2⤵
  PID:6760
- C:\Windows\System\KAOwLbs.exe
  C:\Windows\System\KAOwLbs.exe
  2⤵
  PID:6776
- C:\Windows\System\euvZoFd.exe
  C:\Windows\System\euvZoFd.exe
  2⤵
  PID:6804
- C:\Windows\System\NviDPRA.exe
  C:\Windows\System\NviDPRA.exe
  2⤵
  PID:6832
- C:\Windows\System\kokfuqf.exe
  C:\Windows\System\kokfuqf.exe
  2⤵
  PID:6928
- C:\Windows\System\RDfGyKZ.exe
  C:\Windows\System\RDfGyKZ.exe
  2⤵
  PID:6948
- C:\Windows\System\EGIOuFU.exe
  C:\Windows\System\EGIOuFU.exe
  2⤵
  PID:5948
- C:\Windows\System\FjXZayJ.exe
  C:\Windows\System\FjXZayJ.exe
  2⤵
  PID:6004
- C:\Windows\System\DLXEeza.exe
  C:\Windows\System\DLXEeza.exe
  2⤵
  PID:6056
- C:\Windows\System\HfGnhSS.exe
  C:\Windows\System\HfGnhSS.exe
  2⤵
  PID:3304
- C:\Windows\System\ZsbxrFZ.exe
  C:\Windows\System\ZsbxrFZ.exe
  2⤵
  PID:3984
- C:\Windows\System\DVnSVoI.exe
  C:\Windows\System\DVnSVoI.exe
  2⤵
  PID:4064
- C:\Windows\System\FYuqQor.exe
  C:\Windows\System\FYuqQor.exe
  2⤵
  PID:3680
- C:\Windows\System\mMZLBdG.exe
  C:\Windows\System\mMZLBdG.exe
  2⤵
  PID:5748
- C:\Windows\System\GWIMxNT.exe
  C:\Windows\System\GWIMxNT.exe
  2⤵
  PID:6208
- C:\Windows\System\eBrNquu.exe
  C:\Windows\System\eBrNquu.exe
  2⤵
  PID:6212
- C:\Windows\System\NSSthxX.exe
  C:\Windows\System\NSSthxX.exe
  2⤵
  PID:6308
- C:\Windows\System\dVyybXS.exe
  C:\Windows\System\dVyybXS.exe
  2⤵
  PID:5276
- C:\Windows\System\KmfkVFs.exe
  C:\Windows\System\KmfkVFs.exe
  2⤵
  PID:5312
- C:\Windows\System\zfJYcnd.exe
  C:\Windows\System\zfJYcnd.exe
  2⤵
  PID:5360
- C:\Windows\System\lWoVQpE.exe
  C:\Windows\System\lWoVQpE.exe
  2⤵
  PID:5404
- C:\Windows\System\KCUkPgL.exe
  C:\Windows\System\KCUkPgL.exe
  2⤵
  PID:5440
- C:\Windows\System\QNRYrfA.exe
  C:\Windows\System\QNRYrfA.exe
  2⤵
  PID:5484
- C:\Windows\System\vZTeBXE.exe
  C:\Windows\System\vZTeBXE.exe
  2⤵
  PID:5528
- C:\Windows\System\EnhAaEY.exe
  C:\Windows\System\EnhAaEY.exe
  2⤵
  PID:5568
- C:\Windows\System\xhNwENL.exe
  C:\Windows\System\xhNwENL.exe
  2⤵
  PID:6448
- C:\Windows\System\uepfSFh.exe
  C:\Windows\System\uepfSFh.exe
  2⤵
  PID:6068
- C:\Windows\System\GbRBIoI.exe
  C:\Windows\System\GbRBIoI.exe
  2⤵
  PID:5884
- C:\Windows\System\ktRhBZi.exe
  C:\Windows\System\ktRhBZi.exe
  2⤵
  PID:5824
- C:\Windows\System\ijwcPcQ.exe
  C:\Windows\System\ijwcPcQ.exe
  2⤵
  PID:5796
- C:\Windows\System\irAYtpe.exe
  C:\Windows\System\irAYtpe.exe
  2⤵
  PID:5760
- C:\Windows\System\LwtsWXd.exe
  C:\Windows\System\LwtsWXd.exe
  2⤵
  PID:5692
- C:\Windows\System\QyPVQhy.exe
  C:\Windows\System\QyPVQhy.exe
  2⤵
  PID:3040
- C:\Windows\System\qozIKVi.exe
  C:\Windows\System\qozIKVi.exe
  2⤵
  PID:4752
- C:\Windows\System\TkGakmK.exe
  C:\Windows\System\TkGakmK.exe
  2⤵
  PID:2044
- C:\Windows\System\zEJgDav.exe
  C:\Windows\System\zEJgDav.exe
  2⤵
  PID:5160
- C:\Windows\System\HCeCTXu.exe
  C:\Windows\System\HCeCTXu.exe
  2⤵
  PID:992
- C:\Windows\System\GBOKVJl.exe
  C:\Windows\System\GBOKVJl.exe
  2⤵
  PID:928
- C:\Windows\System\dUnQMbj.exe
  C:\Windows\System\dUnQMbj.exe
  2⤵
  PID:3780
- C:\Windows\System\ryCXoaZ.exe
  C:\Windows\System\ryCXoaZ.exe
  2⤵
  PID:3608
- C:\Windows\System\RyDauTW.exe
  C:\Windows\System\RyDauTW.exe
  2⤵
  PID:2364
- C:\Windows\System\ufNXWPW.exe
  C:\Windows\System\ufNXWPW.exe
  2⤵
  PID:6236
- C:\Windows\System\HyuyDRC.exe
  C:\Windows\System\HyuyDRC.exe
  2⤵
  PID:6324
- C:\Windows\System\ZtEPzRO.exe
  C:\Windows\System\ZtEPzRO.exe
  2⤵
  PID:6384
- C:\Windows\System\DFMWLPX.exe
  C:\Windows\System\DFMWLPX.exe
  2⤵
  PID:6708
- C:\Windows\System\QfZemqw.exe
  C:\Windows\System\QfZemqw.exe
  2⤵
  PID:6876
- C:\Windows\System\lpwdKRq.exe
  C:\Windows\System\lpwdKRq.exe
  2⤵
  PID:6548
- C:\Windows\System\BnhfAsA.exe
  C:\Windows\System\BnhfAsA.exe
  2⤵
  PID:6704
- C:\Windows\System\QaLdCkc.exe
  C:\Windows\System\QaLdCkc.exe
  2⤵
  PID:7312
- C:\Windows\System\SEqxdSe.exe
  C:\Windows\System\SEqxdSe.exe
  2⤵
  PID:7336
- C:\Windows\System\WeEaLNb.exe
  C:\Windows\System\WeEaLNb.exe
  2⤵
  PID:7360
- C:\Windows\System\eAKQQym.exe
  C:\Windows\System\eAKQQym.exe
  2⤵
  PID:7388
- C:\Windows\System\SqGogCI.exe
  C:\Windows\System\SqGogCI.exe
  2⤵
  PID:7408
- C:\Windows\System\xSSEarR.exe
  C:\Windows\System\xSSEarR.exe
  2⤵
  PID:7436
- C:\Windows\System\XfzgFvu.exe
  C:\Windows\System\XfzgFvu.exe
  2⤵
  PID:7464
- C:\Windows\System\rtIlMZh.exe
  C:\Windows\System\rtIlMZh.exe
  2⤵
  PID:7668
- C:\Windows\System\xpTJbVc.exe
  C:\Windows\System\xpTJbVc.exe
  2⤵
  PID:7688
- C:\Windows\System\MXcZTNr.exe
  C:\Windows\System\MXcZTNr.exe
  2⤵
  PID:7712
- C:\Windows\System\rvKcMqI.exe
  C:\Windows\System\rvKcMqI.exe
  2⤵
  PID:7736
- C:\Windows\System\UOjLYdM.exe
  C:\Windows\System\UOjLYdM.exe
  2⤵
  PID:7752
- C:\Windows\System\CVXseFC.exe
  C:\Windows\System\CVXseFC.exe
  2⤵
  PID:7788
- C:\Windows\System\kYJsLQX.exe
  C:\Windows\System\kYJsLQX.exe
  2⤵
  PID:7808
- C:\Windows\System\pZdjxfq.exe
  C:\Windows\System\pZdjxfq.exe
  2⤵
  PID:7848
- C:\Windows\System\WvRDauC.exe
  C:\Windows\System\WvRDauC.exe
  2⤵
  PID:7864
- C:\Windows\System\PtMKqEu.exe
  C:\Windows\System\PtMKqEu.exe
  2⤵
  PID:7884
- C:\Windows\System\fDGLXtu.exe
  C:\Windows\System\fDGLXtu.exe
  2⤵
  PID:7916
- C:\Windows\System\OIYiysK.exe
  C:\Windows\System\OIYiysK.exe
  2⤵
  PID:7948
- C:\Windows\System\aKjjJLQ.exe
  C:\Windows\System\aKjjJLQ.exe
  2⤵
  PID:7964
- C:\Windows\System\bRBYQMP.exe
  C:\Windows\System\bRBYQMP.exe
  2⤵
  PID:7988
- C:\Windows\System\rMkzOPr.exe
  C:\Windows\System\rMkzOPr.exe
  2⤵
  PID:8012
- C:\Windows\System\GlrGaYD.exe
  C:\Windows\System\GlrGaYD.exe
  2⤵
  PID:8044
- C:\Windows\System\yZKezxe.exe
  C:\Windows\System\yZKezxe.exe
  2⤵
  PID:8060
- C:\Windows\System\mxNTkrL.exe
  C:\Windows\System\mxNTkrL.exe
  2⤵
  PID:8076
- C:\Windows\System\fnQaKff.exe
  C:\Windows\System\fnQaKff.exe
  2⤵
  PID:8100
- C:\Windows\System\uJDydVx.exe
  C:\Windows\System\uJDydVx.exe
  2⤵
  PID:8124
- C:\Windows\System\PmuARxu.exe
  C:\Windows\System\PmuARxu.exe
  2⤵
  PID:8148
- C:\Windows\System\fBueXoP.exe
  C:\Windows\System\fBueXoP.exe
  2⤵
  PID:8168
- C:\Windows\System\zgIDFoN.exe
  C:\Windows\System\zgIDFoN.exe
  2⤵
  PID:6600
- C:\Windows\System\rlRRbnx.exe
  C:\Windows\System\rlRRbnx.exe
  2⤵
  PID:6192
- C:\Windows\System\aVvOMQf.exe
  C:\Windows\System\aVvOMQf.exe
  2⤵
  PID:6504
- C:\Windows\System\fNVxjIt.exe
  C:\Windows\System\fNVxjIt.exe
  2⤵
  PID:7000
- C:\Windows\System\aVCxjgc.exe
  C:\Windows\System\aVCxjgc.exe
  2⤵
  PID:6440
- C:\Windows\System\WqKSwEI.exe
  C:\Windows\System\WqKSwEI.exe
  2⤵
  PID:6480
- C:\Windows\System\AdYTbvH.exe
  C:\Windows\System\AdYTbvH.exe
  2⤵
  PID:6564
- C:\Windows\System\SCAiQRE.exe
  C:\Windows\System\SCAiQRE.exe
  2⤵
  PID:6684
- C:\Windows\System\WsNGBqE.exe
  C:\Windows\System\WsNGBqE.exe
  2⤵
  PID:6812
- C:\Windows\System\dmszfkw.exe
  C:\Windows\System\dmszfkw.exe
  2⤵
  PID:7332
- C:\Windows\System\OUncVEy.exe
  C:\Windows\System\OUncVEy.exe
  2⤵
  PID:7108
- C:\Windows\System\rbnGfZh.exe
  C:\Windows\System\rbnGfZh.exe
  2⤵
  PID:8196
- C:\Windows\System\IbNMcux.exe
  C:\Windows\System\IbNMcux.exe
  2⤵
  PID:8224
- C:\Windows\System\nQOqkFO.exe
  C:\Windows\System\nQOqkFO.exe
  2⤵
  PID:8244
- C:\Windows\System\wrkerKz.exe
  C:\Windows\System\wrkerKz.exe
  2⤵
  PID:8272
- C:\Windows\System\kFSlfnz.exe
  C:\Windows\System\kFSlfnz.exe
  2⤵
  PID:8288
- C:\Windows\System\iNPrbLo.exe
  C:\Windows\System\iNPrbLo.exe
  2⤵
  PID:8312
- C:\Windows\System\mIAnmDA.exe
  C:\Windows\System\mIAnmDA.exe
  2⤵
  PID:8336
- C:\Windows\System\VDQdKuK.exe
  C:\Windows\System\VDQdKuK.exe
  2⤵
  PID:8356
- C:\Windows\System\KdcZOKZ.exe
  C:\Windows\System\KdcZOKZ.exe
  2⤵
  PID:8376
- C:\Windows\System\fdURbvO.exe
  C:\Windows\System\fdURbvO.exe
  2⤵
  PID:8396
- C:\Windows\System\iXlhiIu.exe
  C:\Windows\System\iXlhiIu.exe
  2⤵
  PID:8420
- C:\Windows\System\WkXqMqJ.exe
  C:\Windows\System\WkXqMqJ.exe
  2⤵
  PID:8448
- C:\Windows\System\XezkPSH.exe
  C:\Windows\System\XezkPSH.exe
  2⤵
  PID:8468
- C:\Windows\System\KGkggQE.exe
  C:\Windows\System\KGkggQE.exe
  2⤵
  PID:8492
- C:\Windows\System\LhgkSbm.exe
  C:\Windows\System\LhgkSbm.exe
  2⤵
  PID:8516
- C:\Windows\System\HOfTVId.exe
  C:\Windows\System\HOfTVId.exe
  2⤵
  PID:8532
- C:\Windows\System\FurRkQz.exe
  C:\Windows\System\FurRkQz.exe
  2⤵
  PID:8560
- C:\Windows\System\DYEaxiY.exe
  C:\Windows\System\DYEaxiY.exe
  2⤵
  PID:8580
- C:\Windows\System\aDhdjJu.exe
  C:\Windows\System\aDhdjJu.exe
  2⤵
  PID:8604
- C:\Windows\System\FNOwPLo.exe
  C:\Windows\System\FNOwPLo.exe
  2⤵
  PID:8628
- C:\Windows\System\gYSpiSi.exe
  C:\Windows\System\gYSpiSi.exe
  2⤵
  PID:8652
- C:\Windows\System\pqqOQZf.exe
  C:\Windows\System\pqqOQZf.exe
  2⤵
  PID:8672
- C:\Windows\System\hBusopC.exe
  C:\Windows\System\hBusopC.exe
  2⤵
  PID:8696
- C:\Windows\System\OWwdsOD.exe
  C:\Windows\System\OWwdsOD.exe
  2⤵
  PID:8720
- C:\Windows\System\IejzvhH.exe
  C:\Windows\System\IejzvhH.exe
  2⤵
  PID:8740
- C:\Windows\System\BeQzVKL.exe
  C:\Windows\System\BeQzVKL.exe
  2⤵
  PID:8760
- C:\Windows\System\SLJUiTt.exe
  C:\Windows\System\SLJUiTt.exe
  2⤵
  PID:8784
- C:\Windows\System\poelCAu.exe
  C:\Windows\System\poelCAu.exe
  2⤵
  PID:8808
- C:\Windows\System\wlWlvSg.exe
  C:\Windows\System\wlWlvSg.exe
  2⤵
  PID:8824
- C:\Windows\System\DZPwQKo.exe
  C:\Windows\System\DZPwQKo.exe
  2⤵
  PID:8848
- C:\Windows\System\ZjEwjYW.exe
  C:\Windows\System\ZjEwjYW.exe
  2⤵
  PID:8868
- C:\Windows\System\GNoSkFu.exe
  C:\Windows\System\GNoSkFu.exe
  2⤵
  PID:8892
- C:\Windows\System\MwMyNnV.exe
  C:\Windows\System\MwMyNnV.exe
  2⤵
  PID:8916
- C:\Windows\System\ZRUpSnZ.exe
  C:\Windows\System\ZRUpSnZ.exe
  2⤵
  PID:8936
- C:\Windows\System\RxaPUmt.exe
  C:\Windows\System\RxaPUmt.exe
  2⤵
  PID:8956
- C:\Windows\System\DtJjkDv.exe
  C:\Windows\System\DtJjkDv.exe
  2⤵
  PID:8976
- C:\Windows\System\WbNLUyt.exe
  C:\Windows\System\WbNLUyt.exe
  2⤵
  PID:9004
- C:\Windows\System\JZCjUTf.exe
  C:\Windows\System\JZCjUTf.exe
  2⤵
  PID:9024
- C:\Windows\System\QfWztGx.exe
  C:\Windows\System\QfWztGx.exe
  2⤵
  PID:9040
- C:\Windows\System\tRAYkOc.exe
  C:\Windows\System\tRAYkOc.exe
  2⤵
  PID:9060
- C:\Windows\System\rItQAvn.exe
  C:\Windows\System\rItQAvn.exe
  2⤵
  PID:9084
- C:\Windows\System\vueXECt.exe
  C:\Windows\System\vueXECt.exe
  2⤵
  PID:9108
- C:\Windows\System\kyxXtet.exe
  C:\Windows\System\kyxXtet.exe
  2⤵
  PID:9144
- C:\Windows\System\fbaONFs.exe
  C:\Windows\System\fbaONFs.exe
  2⤵
  PID:9164
- C:\Windows\System\kKSfDMh.exe
  C:\Windows\System\kKSfDMh.exe
  2⤵
  PID:9184
- C:\Windows\System\OSrXENQ.exe
  C:\Windows\System\OSrXENQ.exe
  2⤵
  PID:9204
- C:\Windows\System\pGzeNYG.exe
  C:\Windows\System\pGzeNYG.exe
  2⤵
  PID:7156
- C:\Windows\System\JTZJkqZ.exe
  C:\Windows\System\JTZJkqZ.exe
  2⤵
  PID:6032
- C:\Windows\System\qpFZvoS.exe
  C:\Windows\System\qpFZvoS.exe
  2⤵
  PID:5588
- C:\Windows\System\ZUfejzB.exe
  C:\Windows\System\ZUfejzB.exe
  2⤵
  PID:6168
- C:\Windows\System\izmBzDi.exe
  C:\Windows\System\izmBzDi.exe
  2⤵
  PID:6028
- C:\Windows\System\HszdfKM.exe
  C:\Windows\System\HszdfKM.exe
  2⤵
  PID:5252
- C:\Windows\System\eianTpk.exe
  C:\Windows\System\eianTpk.exe
  2⤵
  PID:5356
- C:\Windows\System\VyoPZSs.exe
  C:\Windows\System\VyoPZSs.exe
  2⤵
  PID:5468
- C:\Windows\System\WPIKIwb.exe
  C:\Windows\System\WPIKIwb.exe
  2⤵
  PID:5524
- C:\Windows\System\JIekLrn.exe
  C:\Windows\System\JIekLrn.exe
  2⤵
  PID:6088
- C:\Windows\System\hptEnLK.exe
  C:\Windows\System\hptEnLK.exe
  2⤵
  PID:5844
- C:\Windows\System\sQmqXHI.exe
  C:\Windows\System\sQmqXHI.exe
  2⤵
  PID:5780
- C:\Windows\System\ROFqYSV.exe
  C:\Windows\System\ROFqYSV.exe
  2⤵
  PID:5648
- C:\Windows\System\tJYGEbZ.exe
  C:\Windows\System\tJYGEbZ.exe
  2⤵
  PID:1080
- C:\Windows\System\pBLIRWN.exe
  C:\Windows\System\pBLIRWN.exe
  2⤵
  PID:4884
- C:\Windows\System\UcfYCfR.exe
  C:\Windows\System\UcfYCfR.exe
  2⤵
  PID:1504
- C:\Windows\System\nWQiBNw.exe
  C:\Windows\System\nWQiBNw.exe
  2⤵
  PID:1092
- C:\Windows\System\DmdrNzN.exe
  C:\Windows\System\DmdrNzN.exe
  2⤵
  PID:7424
- C:\Windows\System\WdjnXzO.exe
  C:\Windows\System\WdjnXzO.exe
  2⤵
  PID:7452
- C:\Windows\System\KpQpKJI.exe
  C:\Windows\System\KpQpKJI.exe
  2⤵
  PID:7508
- C:\Windows\System\GeyeeKV.exe
  C:\Windows\System\GeyeeKV.exe
  2⤵
  PID:7204
- C:\Windows\System\MklWVEm.exe
  C:\Windows\System\MklWVEm.exe
  2⤵
  PID:8072
- C:\Windows\System\fOReuwY.exe
  C:\Windows\System\fOReuwY.exe
  2⤵
  PID:8160
- C:\Windows\System\fVryeeU.exe
  C:\Windows\System\fVryeeU.exe
  2⤵
  PID:6352
- C:\Windows\System\HyOpGNt.exe
  C:\Windows\System\HyOpGNt.exe
  2⤵
  PID:6936
- C:\Windows\System\lViCzjR.exe
  C:\Windows\System\lViCzjR.exe
  2⤵
  PID:7120
- C:\Windows\System\NNlAvcU.exe
  C:\Windows\System\NNlAvcU.exe
  2⤵
  PID:8444
- C:\Windows\System\yvOUsfo.exe
  C:\Windows\System\yvOUsfo.exe
  2⤵
  PID:8508
- C:\Windows\System\IPkFZhP.exe
  C:\Windows\System\IPkFZhP.exe
  2⤵
  PID:9248
- C:\Windows\System\xeDCYSK.exe
  C:\Windows\System\xeDCYSK.exe
  2⤵
  PID:9272
- C:\Windows\System\izvnInq.exe
  C:\Windows\System\izvnInq.exe
  2⤵
  PID:9300
- C:\Windows\System\wWgKZYT.exe
  C:\Windows\System\wWgKZYT.exe
  2⤵
  PID:9320
- C:\Windows\System\OZDcGXM.exe
  C:\Windows\System\OZDcGXM.exe
  2⤵
  PID:9348
- C:\Windows\System\SGURmUy.exe
  C:\Windows\System\SGURmUy.exe
  2⤵
  PID:9368
- C:\Windows\System\CNVbtJy.exe
  C:\Windows\System\CNVbtJy.exe
  2⤵
  PID:9396
- C:\Windows\System\KhuPtLL.exe
  C:\Windows\System\KhuPtLL.exe
  2⤵
  PID:9416
- C:\Windows\System\Tcskkwo.exe
  C:\Windows\System\Tcskkwo.exe
  2⤵
  PID:9432
- C:\Windows\System\iDSpbIi.exe
  C:\Windows\System\iDSpbIi.exe
  2⤵
  PID:9448
- C:\Windows\System\DjcUKXy.exe
  C:\Windows\System\DjcUKXy.exe
  2⤵
  PID:9464
- C:\Windows\System\XftNAXG.exe
  C:\Windows\System\XftNAXG.exe
  2⤵
  PID:9484
- C:\Windows\System\SPdughZ.exe
  C:\Windows\System\SPdughZ.exe
  2⤵
  PID:9504
- C:\Windows\System\iGXMNPT.exe
  C:\Windows\System\iGXMNPT.exe
  2⤵
  PID:9524
- C:\Windows\System\NnUsHim.exe
  C:\Windows\System\NnUsHim.exe
  2⤵
  PID:9540
- C:\Windows\System\jnpSpAa.exe
  C:\Windows\System\jnpSpAa.exe
  2⤵
  PID:9556
- C:\Windows\System\QdqGigN.exe
  C:\Windows\System\QdqGigN.exe
  2⤵
  PID:9572
- C:\Windows\System\spXSymd.exe
  C:\Windows\System\spXSymd.exe
  2⤵
  PID:9588
- C:\Windows\System\QdpfyRz.exe
  C:\Windows\System\QdpfyRz.exe
  2⤵
  PID:9604
- C:\Windows\System\TKunDBT.exe
  C:\Windows\System\TKunDBT.exe
  2⤵
  PID:9624
- C:\Windows\System\DKsuSZi.exe
  C:\Windows\System\DKsuSZi.exe
  2⤵
  PID:9656
- C:\Windows\System\PhtosTU.exe
  C:\Windows\System\PhtosTU.exe
  2⤵
  PID:9676
- C:\Windows\System\YRrXSZt.exe
  C:\Windows\System\YRrXSZt.exe
  2⤵
  PID:9700
- C:\Windows\System\EbDzeoa.exe
  C:\Windows\System\EbDzeoa.exe
  2⤵
  PID:9720
- C:\Windows\System\yPGYYVw.exe
  C:\Windows\System\yPGYYVw.exe
  2⤵
  PID:9740
- C:\Windows\System\PlpePlR.exe
  C:\Windows\System\PlpePlR.exe
  2⤵
  PID:9776
- C:\Windows\System\vqnLEFx.exe
  C:\Windows\System\vqnLEFx.exe
  2⤵
  PID:9792
- C:\Windows\System\iNNQwnu.exe
  C:\Windows\System\iNNQwnu.exe
  2⤵
  PID:9812
- C:\Windows\System\fvFTcaI.exe
  C:\Windows\System\fvFTcaI.exe
  2⤵
  PID:9836
- C:\Windows\System\KMFOHkc.exe
  C:\Windows\System\KMFOHkc.exe
  2⤵
  PID:9852
- C:\Windows\System\giQFsHE.exe
  C:\Windows\System\giQFsHE.exe
  2⤵
  PID:9868
- C:\Windows\System\KudgOtW.exe
  C:\Windows\System\KudgOtW.exe
  2⤵
  PID:9892
- C:\Windows\System\RESVcRV.exe
  C:\Windows\System\RESVcRV.exe
  2⤵
  PID:9912
- C:\Windows\System\ACqUEbH.exe
  C:\Windows\System\ACqUEbH.exe
  2⤵
  PID:9932
- C:\Windows\System\YSaenjB.exe
  C:\Windows\System\YSaenjB.exe
  2⤵
  PID:9952
- C:\Windows\System\uGXWxat.exe
  C:\Windows\System\uGXWxat.exe
  2⤵
  PID:9976
- C:\Windows\System\sAlFHMI.exe
  C:\Windows\System\sAlFHMI.exe
  2⤵
  PID:10036
- C:\Windows\System\GSoxVVt.exe
  C:\Windows\System\GSoxVVt.exe
  2⤵
  PID:10052
- C:\Windows\System\rPiOaFy.exe
  C:\Windows\System\rPiOaFy.exe
  2⤵
  PID:10084
- C:\Windows\System\CapstRx.exe
  C:\Windows\System\CapstRx.exe
  2⤵
  PID:10208
- C:\Windows\System\AINROmg.exe
  C:\Windows\System\AINROmg.exe
  2⤵
  PID:10224
- C:\Windows\System\cKNhYMp.exe
  C:\Windows\System\cKNhYMp.exe
  2⤵
  PID:8648
- C:\Windows\System\VDpVPlv.exe
  C:\Windows\System\VDpVPlv.exe
  2⤵
  PID:8816
- C:\Windows\System\QutuaUT.exe
  C:\Windows\System\QutuaUT.exe
  2⤵
  PID:8884
- C:\Windows\System\RCEyYus.exe
  C:\Windows\System\RCEyYus.exe
  2⤵
  PID:8908
- C:\Windows\System\OwEUSZM.exe
  C:\Windows\System\OwEUSZM.exe
  2⤵
  PID:8988
- C:\Windows\System\kcXjOmy.exe
  C:\Windows\System\kcXjOmy.exe
  2⤵
  PID:9012
- C:\Windows\System\CHNAcdJ.exe
  C:\Windows\System\CHNAcdJ.exe
  2⤵
  PID:9048
- C:\Windows\System\XaDfwCf.exe
  C:\Windows\System\XaDfwCf.exe
  2⤵
  PID:7892
- C:\Windows\System\iYOwojS.exe
  C:\Windows\System\iYOwojS.exe
  2⤵
  PID:7560
- C:\Windows\System\ydHLKaU.exe
  C:\Windows\System\ydHLKaU.exe
  2⤵
  PID:1836
- C:\Windows\System\VSuZlVi.exe
  C:\Windows\System\VSuZlVi.exe
  2⤵
  PID:5380
- C:\Windows\System\dzzkeSf.exe
  C:\Windows\System\dzzkeSf.exe
  2⤵
  PID:7636
- C:\Windows\System\ggsbZhS.exe
  C:\Windows\System\ggsbZhS.exe
  2⤵
  PID:8948
- C:\Windows\System\SRoLtBe.exe
  C:\Windows\System\SRoLtBe.exe
  2⤵
  PID:9480
- C:\Windows\System\vUnUgPu.exe
  C:\Windows\System\vUnUgPu.exe
  2⤵
  PID:9496
- C:\Windows\System\ENWbZiV.exe
  C:\Windows\System\ENWbZiV.exe
  2⤵
  PID:9536
- C:\Windows\System\IYYFBeU.exe
  C:\Windows\System\IYYFBeU.exe
  2⤵
  PID:7972
- C:\Windows\System\AnplBCM.exe
  C:\Windows\System\AnplBCM.exe
  2⤵
  PID:8024
- C:\Windows\System\lExzHdX.exe
  C:\Windows\System\lExzHdX.exe
  2⤵
  PID:8188
- C:\Windows\System\QneuIiC.exe
  C:\Windows\System\QneuIiC.exe
  2⤵
  PID:6892
- C:\Windows\System\UEXBRKN.exe
  C:\Windows\System\UEXBRKN.exe
  2⤵
  PID:5424
- C:\Windows\System\EDZaLFP.exe
  C:\Windows\System\EDZaLFP.exe
  2⤵
  PID:6796
- C:\Windows\System\UsXoKRY.exe
  C:\Windows\System\UsXoKRY.exe
  2⤵
  PID:6840
- C:\Windows\System\MDjCobS.exe
  C:\Windows\System\MDjCobS.exe
  2⤵
  PID:5888
- C:\Windows\System\ZGEiaGX.exe
  C:\Windows\System\ZGEiaGX.exe
  2⤵
  PID:9844
- C:\Windows\System\rYnQaLy.exe
  C:\Windows\System\rYnQaLy.exe
  2⤵
  PID:8236
- C:\Windows\System\KnVuJcK.exe
  C:\Windows\System\KnVuJcK.exe
  2⤵
  PID:9940
- C:\Windows\System\yDIWFbv.exe
  C:\Windows\System\yDIWFbv.exe
  2⤵
  PID:9968
- C:\Windows\System\fKQbEGy.exe
  C:\Windows\System\fKQbEGy.exe
  2⤵
  PID:10264
- C:\Windows\System\DmxYhSN.exe
  C:\Windows\System\DmxYhSN.exe
  2⤵
  PID:10300
- C:\Windows\System\kWUZJKP.exe
  C:\Windows\System\kWUZJKP.exe
  2⤵
  PID:10316
- C:\Windows\System\rZvYZBH.exe
  C:\Windows\System\rZvYZBH.exe
  2⤵
  PID:10332
- C:\Windows\System\zPPhRNr.exe
  C:\Windows\System\zPPhRNr.exe
  2⤵
  PID:10348
- C:\Windows\System\ROtNnhg.exe
  C:\Windows\System\ROtNnhg.exe
  2⤵
  PID:10364
- C:\Windows\System\Katsfxs.exe
  C:\Windows\System\Katsfxs.exe
  2⤵
  PID:10380
- C:\Windows\System\TMDETBE.exe
  C:\Windows\System\TMDETBE.exe
  2⤵
  PID:10400
- C:\Windows\System\ciGwDlt.exe
  C:\Windows\System\ciGwDlt.exe
  2⤵
  PID:10424
- C:\Windows\System\Djfgprw.exe
  C:\Windows\System\Djfgprw.exe
  2⤵
  PID:10440
- C:\Windows\System\YUymGhi.exe
  C:\Windows\System\YUymGhi.exe
  2⤵
  PID:10488
- C:\Windows\System\xbalOfC.exe
  C:\Windows\System\xbalOfC.exe
  2⤵
  PID:10508
- C:\Windows\System\IxGhtBk.exe
  C:\Windows\System\IxGhtBk.exe
  2⤵
  PID:10528
- C:\Windows\System\HFQnyKO.exe
  C:\Windows\System\HFQnyKO.exe
  2⤵
  PID:10552
- C:\Windows\System\nVLdihO.exe
  C:\Windows\System\nVLdihO.exe
  2⤵
  PID:10584
- C:\Windows\System\KGpDlCF.exe
  C:\Windows\System\KGpDlCF.exe
  2⤵
  PID:10600
- C:\Windows\System\PGBmJQo.exe
  C:\Windows\System\PGBmJQo.exe
  2⤵
  PID:10624
- C:\Windows\System\AxPWNHB.exe
  C:\Windows\System\AxPWNHB.exe
  2⤵
  PID:10652
- C:\Windows\System\eqWanSI.exe
  C:\Windows\System\eqWanSI.exe
  2⤵
  PID:10676
- C:\Windows\System\FiGSmlp.exe
  C:\Windows\System\FiGSmlp.exe
  2⤵
  PID:10692
- C:\Windows\System\XYvZlwr.exe
  C:\Windows\System\XYvZlwr.exe
  2⤵
  PID:10716
- C:\Windows\System\MRkMzKw.exe
  C:\Windows\System\MRkMzKw.exe
  2⤵
  PID:10740
- C:\Windows\System\cWidvee.exe
  C:\Windows\System\cWidvee.exe
  2⤵
  PID:10764
- C:\Windows\System\SlNqtSP.exe
  C:\Windows\System\SlNqtSP.exe
  2⤵
  PID:10796
- C:\Windows\System\DWPazUh.exe
  C:\Windows\System\DWPazUh.exe
  2⤵
  PID:10816
- C:\Windows\System\udIdnaV.exe
  C:\Windows\System\udIdnaV.exe
  2⤵
  PID:10836
- C:\Windows\System\IBkzASF.exe
  C:\Windows\System\IBkzASF.exe
  2⤵
  PID:10856
- C:\Windows\System\YOmhXHW.exe
  C:\Windows\System\YOmhXHW.exe
  2⤵
  PID:10892
- C:\Windows\System\ybUdaxe.exe
  C:\Windows\System\ybUdaxe.exe
  2⤵
  PID:10916
- C:\Windows\System\ejyjjni.exe
  C:\Windows\System\ejyjjni.exe
  2⤵
  PID:10952
- C:\Windows\System\yxBkgoi.exe
  C:\Windows\System\yxBkgoi.exe
  2⤵
  PID:10972
- C:\Windows\System\ARNvLky.exe
  C:\Windows\System\ARNvLky.exe
  2⤵
  PID:11000
- C:\Windows\System\noWqHej.exe
  C:\Windows\System\noWqHej.exe
  2⤵
  PID:11020
- C:\Windows\System\ZnkzPed.exe
  C:\Windows\System\ZnkzPed.exe
  2⤵
  PID:11044
- C:\Windows\System\ZTrSMxO.exe
  C:\Windows\System\ZTrSMxO.exe
  2⤵
  PID:11060
- C:\Windows\System\CxvaVtg.exe
  C:\Windows\System\CxvaVtg.exe
  2⤵
  PID:11080
- C:\Windows\System\WJJJDpL.exe
  C:\Windows\System\WJJJDpL.exe
  2⤵
  PID:11096
- C:\Windows\System\WYAEILc.exe
  C:\Windows\System\WYAEILc.exe
  2⤵
  PID:11112
- C:\Windows\System\DsVXbbp.exe
  C:\Windows\System\DsVXbbp.exe
  2⤵
  PID:11128
- C:\Windows\System\YwWsawd.exe
  C:\Windows\System\YwWsawd.exe
  2⤵
  PID:11144
- C:\Windows\System\CfPwGoy.exe
  C:\Windows\System\CfPwGoy.exe
  2⤵
  PID:11160
- C:\Windows\System\EZnwcWn.exe
  C:\Windows\System\EZnwcWn.exe
  2⤵
  PID:11176
- C:\Windows\System\OfQyRcU.exe
  C:\Windows\System\OfQyRcU.exe
  2⤵
  PID:11192
- C:\Windows\System\ryGRlYb.exe
  C:\Windows\System\ryGRlYb.exe
  2⤵
  PID:11208
- C:\Windows\System\FxCZubX.exe
  C:\Windows\System\FxCZubX.exe
  2⤵
  PID:11224
- C:\Windows\System\CZRfkIV.exe
  C:\Windows\System\CZRfkIV.exe
  2⤵
  PID:11240
- C:\Windows\System\QmPcjqS.exe
  C:\Windows\System\QmPcjqS.exe
  2⤵
  PID:11256
- C:\Windows\System\IvjoKXW.exe
  C:\Windows\System\IvjoKXW.exe
  2⤵
  PID:8308
- C:\Windows\System\fPiJfxx.exe
  C:\Windows\System\fPiJfxx.exe
  2⤵
  PID:8464
- C:\Windows\System\bobKCTi.exe
  C:\Windows\System\bobKCTi.exe
  2⤵
  PID:8588
- C:\Windows\System\yuqneid.exe
  C:\Windows\System\yuqneid.exe
  2⤵
  PID:8620
- C:\Windows\System\ZblRFPC.exe
  C:\Windows\System\ZblRFPC.exe
  2⤵
  PID:8680
- C:\Windows\System\cZxjIJi.exe
  C:\Windows\System\cZxjIJi.exe
  2⤵
  PID:8736
- C:\Windows\System\cRwkhuh.exe
  C:\Windows\System\cRwkhuh.exe
  2⤵
  PID:9340
- C:\Windows\System\jEhkrBy.exe
  C:\Windows\System\jEhkrBy.exe
  2⤵
  PID:8840
- C:\Windows\System\qSDXhMH.exe
  C:\Windows\System\qSDXhMH.exe
  2⤵
  PID:9404
- C:\Windows\System\mbUZPbX.exe
  C:\Windows\System\mbUZPbX.exe
  2⤵
  PID:8932
- C:\Windows\System\oYGUJyR.exe
  C:\Windows\System\oYGUJyR.exe
  2⤵
  PID:10204
- C:\Windows\System\RKUhUdN.exe
  C:\Windows\System\RKUhUdN.exe
  2⤵
  PID:10232
- C:\Windows\System\OvtYYAS.exe
  C:\Windows\System\OvtYYAS.exe
  2⤵
  PID:8772
- C:\Windows\System\xpHNono.exe
  C:\Windows\System\xpHNono.exe
  2⤵
  PID:7748
- C:\Windows\System\XxflEEY.exe
  C:\Windows\System\XxflEEY.exe
  2⤵
  PID:8032
- C:\Windows\System\cDPCMHQ.exe
  C:\Windows\System\cDPCMHQ.exe
  2⤵
  PID:9612
- C:\Windows\System\WvygmkE.exe
  C:\Windows\System\WvygmkE.exe
  2⤵
  PID:11280
- C:\Windows\System\OLozOqj.exe
  C:\Windows\System\OLozOqj.exe
  2⤵
  PID:11304
- C:\Windows\System\NFrkIPE.exe
  C:\Windows\System\NFrkIPE.exe
  2⤵
  PID:11324
- C:\Windows\System\hXljyrG.exe
  C:\Windows\System\hXljyrG.exe
  2⤵
  PID:11376
- C:\Windows\System\hPRKzUc.exe
  C:\Windows\System\hPRKzUc.exe
  2⤵
  PID:11400
- C:\Windows\System\MuuEujA.exe
  C:\Windows\System\MuuEujA.exe
  2⤵
  PID:11484
- C:\Windows\System\dhKngnH.exe
  C:\Windows\System\dhKngnH.exe
  2⤵
  PID:11508
- C:\Windows\System\efDxNIm.exe
  C:\Windows\System\efDxNIm.exe
  2⤵
  PID:11532
- C:\Windows\System\ROBkllW.exe
  C:\Windows\System\ROBkllW.exe
  2⤵
  PID:11552
- C:\Windows\System\uVkdtyw.exe
  C:\Windows\System\uVkdtyw.exe
  2⤵
  PID:11568
- C:\Windows\System\RZvXGRe.exe
  C:\Windows\System\RZvXGRe.exe
  2⤵
  PID:11588
- C:\Windows\System\rmzwwvA.exe
  C:\Windows\System\rmzwwvA.exe
  2⤵
  PID:11616
- C:\Windows\System\MhGCnZl.exe
  C:\Windows\System\MhGCnZl.exe
  2⤵
  PID:11632
- C:\Windows\System\dzeorPL.exe
  C:\Windows\System\dzeorPL.exe
  2⤵
  PID:11660
- C:\Windows\System\oFbkmlg.exe
  C:\Windows\System\oFbkmlg.exe
  2⤵
  PID:11684
- C:\Windows\System\MWZiHFY.exe
  C:\Windows\System\MWZiHFY.exe
  2⤵
  PID:11704
- C:\Windows\System\ptQQSAI.exe
  C:\Windows\System\ptQQSAI.exe
  2⤵
  PID:11736
- C:\Windows\System\dutKiXp.exe
  C:\Windows\System\dutKiXp.exe
  2⤵
  PID:11784
- C:\Windows\System\ZytFPSZ.exe
  C:\Windows\System\ZytFPSZ.exe
  2⤵
  PID:11804
- C:\Windows\System\qUwzTTk.exe
  C:\Windows\System\qUwzTTk.exe
  2⤵
  PID:11828
- C:\Windows\System\HspREgM.exe
  C:\Windows\System\HspREgM.exe
  2⤵
  PID:11852
- C:\Windows\System\gxePVih.exe
  C:\Windows\System\gxePVih.exe
  2⤵
  PID:11876
- C:\Windows\System\HBZCoOM.exe
  C:\Windows\System\HBZCoOM.exe
  2⤵
  PID:11896
- C:\Windows\System\PapxgeV.exe
  C:\Windows\System\PapxgeV.exe
  2⤵
  PID:11924
- C:\Windows\System\idrYqiq.exe
  C:\Windows\System\idrYqiq.exe
  2⤵
  PID:11940
- C:\Windows\System\lZYuwWg.exe
  C:\Windows\System\lZYuwWg.exe
  2⤵
  PID:11968
- C:\Windows\System\kDOIpuR.exe
  C:\Windows\System\kDOIpuR.exe
  2⤵
  PID:11984
- C:\Windows\System\rpvWzFZ.exe
  C:\Windows\System\rpvWzFZ.exe
  2⤵
  PID:12000
- C:\Windows\System\WEyecGa.exe
  C:\Windows\System\WEyecGa.exe
  2⤵
  PID:12016
- C:\Windows\System\lGklzXJ.exe
  C:\Windows\System\lGklzXJ.exe
  2⤵
  PID:12032
- C:\Windows\System\wIBBTud.exe
  C:\Windows\System\wIBBTud.exe
  2⤵
  PID:12052
- C:\Windows\System\fWUFyWG.exe
  C:\Windows\System\fWUFyWG.exe
  2⤵
  PID:12076
- C:\Windows\System\kdKNCRk.exe
  C:\Windows\System\kdKNCRk.exe
  2⤵
  PID:12108
- C:\Windows\System\CbsBOtz.exe
  C:\Windows\System\CbsBOtz.exe
  2⤵
  PID:12128
- C:\Windows\System\DVdHPww.exe
  C:\Windows\System\DVdHPww.exe
  2⤵
  PID:12156
- C:\Windows\System\vwcdLXB.exe
  C:\Windows\System\vwcdLXB.exe
  2⤵
  PID:12180
- C:\Windows\System\JvFcdda.exe
  C:\Windows\System\JvFcdda.exe
  2⤵
  PID:12208
- C:\Windows\System\gaXfNzr.exe
  C:\Windows\System\gaXfNzr.exe
  2⤵
  PID:12224
- C:\Windows\System\WdHkxPK.exe
  C:\Windows\System\WdHkxPK.exe
  2⤵
  PID:12252
- C:\Windows\System\bUlEKtH.exe
  C:\Windows\System\bUlEKtH.exe
  2⤵
  PID:12272
- C:\Windows\System\BfZOHKN.exe
  C:\Windows\System\BfZOHKN.exe
  2⤵
  PID:6012
- C:\Windows\System\orRunGa.exe
  C:\Windows\System\orRunGa.exe
  2⤵
  PID:5300
- C:\Windows\System\JQMFIdz.exe
  C:\Windows\System\JQMFIdz.exe
  2⤵
  PID:5800
- C:\Windows\System\EWzODOR.exe
  C:\Windows\System\EWzODOR.exe
  2⤵
  PID:5056
- C:\Windows\System\uyTguUl.exe
  C:\Windows\System\uyTguUl.exe
  2⤵
  PID:7356
- C:\Windows\System\IXXlXjH.exe
  C:\Windows\System\IXXlXjH.exe
  2⤵
  PID:8132
- C:\Windows\System\FZYQPYj.exe
  C:\Windows\System\FZYQPYj.exe
  2⤵
  PID:6668
- C:\Windows\System\PsyvHsG.exe
  C:\Windows\System\PsyvHsG.exe
  2⤵
  PID:2276
- C:\Windows\System\wgYoAcl.exe
  C:\Windows\System\wgYoAcl.exe
  2⤵
  PID:7644
- C:\Windows\System\ohnrUaJ.exe
  C:\Windows\System\ohnrUaJ.exe
  2⤵
  PID:8068
- C:\Windows\System\YsUktCS.exe
  C:\Windows\System\YsUktCS.exe
  2⤵
  PID:7216
- C:\Windows\System\nsYoOEB.exe
  C:\Windows\System\nsYoOEB.exe
  2⤵
  PID:7104
- C:\Windows\System\MBMclXd.exe
  C:\Windows\System\MBMclXd.exe
  2⤵
  PID:9220
- C:\Windows\System\RhHMWko.exe
  C:\Windows\System\RhHMWko.exe
  2⤵
  PID:10376
- C:\Windows\System\muylSNs.exe
  C:\Windows\System\muylSNs.exe
  2⤵
  PID:10580
- C:\Windows\System\mHOnSIF.exe
  C:\Windows\System\mHOnSIF.exe
  2⤵
  PID:10712
- C:\Windows\System\gAujcuj.exe
  C:\Windows\System\gAujcuj.exe
  2⤵
  PID:10756
- C:\Windows\System\eSxyCeH.exe
  C:\Windows\System\eSxyCeH.exe
  2⤵
  PID:9440
- C:\Windows\System\tyIUeoD.exe
  C:\Windows\System\tyIUeoD.exe
  2⤵
  PID:9460
- C:\Windows\System\onxTPvs.exe
  C:\Windows\System\onxTPvs.exe
  2⤵
  PID:11040
- C:\Windows\System\MQfPlSN.exe
  C:\Windows\System\MQfPlSN.exe
  2⤵
  PID:10824
- C:\Windows\System\CNLjPnE.exe
  C:\Windows\System\CNLjPnE.exe
  2⤵
  PID:11108
- C:\Windows\System\RCWwToI.exe
  C:\Windows\System\RCWwToI.exe
  2⤵
  PID:8692
- C:\Windows\System\oRTVJzm.exe
  C:\Windows\System\oRTVJzm.exe
  2⤵
  PID:8716
- C:\Windows\System\nVGpWEK.exe
  C:\Windows\System\nVGpWEK.exe
  2⤵
  PID:11232
- C:\Windows\System\RcYoWUF.exe
  C:\Windows\System\RcYoWUF.exe
  2⤵
  PID:8344
- C:\Windows\System\rSOHdwn.exe
  C:\Windows\System\rSOHdwn.exe
  2⤵
  PID:12300
- C:\Windows\System\ERXLDGO.exe
  C:\Windows\System\ERXLDGO.exe
  2⤵
  PID:12316
- C:\Windows\System\eYDdxOr.exe
  C:\Windows\System\eYDdxOr.exe
  2⤵
  PID:12332
- C:\Windows\System\biuuRIt.exe
  C:\Windows\System\biuuRIt.exe
  2⤵
  PID:12348
- C:\Windows\System\IZTBpaU.exe
  C:\Windows\System\IZTBpaU.exe
  2⤵
  PID:12364
- C:\Windows\System\KCLZler.exe
  C:\Windows\System\KCLZler.exe
  2⤵
  PID:12380
- C:\Windows\System\wjWTNZl.exe
  C:\Windows\System\wjWTNZl.exe
  2⤵
  PID:12396
- C:\Windows\System\qVlHkdN.exe
  C:\Windows\System\qVlHkdN.exe
  2⤵
  PID:12412
- C:\Windows\System\AaRaqmE.exe
  C:\Windows\System\AaRaqmE.exe
  2⤵
  PID:12428
- C:\Windows\System\xQTKOAf.exe
  C:\Windows\System\xQTKOAf.exe
  2⤵
  PID:12444
- C:\Windows\System\bYmzJYK.exe
  C:\Windows\System\bYmzJYK.exe
  2⤵
  PID:12464
- C:\Windows\System\CPMBbpx.exe
  C:\Windows\System\CPMBbpx.exe
  2⤵
  PID:12480
- C:\Windows\System\pRVlTqj.exe
  C:\Windows\System\pRVlTqj.exe
  2⤵
  PID:12496
- C:\Windows\System\dhwHDJa.exe
  C:\Windows\System\dhwHDJa.exe
  2⤵
  PID:12512
- C:\Windows\System\dhYXqJC.exe
  C:\Windows\System\dhYXqJC.exe
  2⤵
  PID:12528
- C:\Windows\System\ivxgJYA.exe
  C:\Windows\System\ivxgJYA.exe
  2⤵
  PID:12544
- C:\Windows\System\DCZzUYF.exe
  C:\Windows\System\DCZzUYF.exe
  2⤵
  PID:12560
- C:\Windows\System\BbOYdhx.exe
  C:\Windows\System\BbOYdhx.exe
  2⤵
  PID:12576
- C:\Windows\System\ITwpWRU.exe
  C:\Windows\System\ITwpWRU.exe
  2⤵
  PID:12612
- C:\Windows\System\pfHEYRT.exe
  C:\Windows\System\pfHEYRT.exe
  2⤵
  PID:12632
- C:\Windows\System\NYZlksx.exe
  C:\Windows\System\NYZlksx.exe
  2⤵
  PID:12656
- C:\Windows\System\OEBBspX.exe
  C:\Windows\System\OEBBspX.exe
  2⤵
  PID:12680
- C:\Windows\System\LbLyoqM.exe
  C:\Windows\System\LbLyoqM.exe
  2⤵
  PID:12712
- C:\Windows\System\XwJAtXc.exe
  C:\Windows\System\XwJAtXc.exe
  2⤵
  PID:12728
- C:\Windows\System\vuBmxtA.exe
  C:\Windows\System\vuBmxtA.exe
  2⤵
  PID:12752
- C:\Windows\System\SpBzuKr.exe
  C:\Windows\System\SpBzuKr.exe
  2⤵
  PID:12772
- C:\Windows\System\DSqEEon.exe
  C:\Windows\System\DSqEEon.exe
  2⤵
  PID:12804
- C:\Windows\System\wgFNqCD.exe
  C:\Windows\System\wgFNqCD.exe
  2⤵
  PID:12820
- C:\Windows\System\HJxkget.exe
  C:\Windows\System\HJxkget.exe
  2⤵
  PID:12836
- C:\Windows\System\xUtROol.exe
  C:\Windows\System\xUtROol.exe
  2⤵
  PID:12880
- C:\Windows\System\ZKYxjNp.exe
  C:\Windows\System\ZKYxjNp.exe
  2⤵
  PID:12904
- C:\Windows\System\lTYtGCy.exe
  C:\Windows\System\lTYtGCy.exe
  2⤵
  PID:9748
- C:\Windows\System\jPnHBVV.exe
  C:\Windows\System\jPnHBVV.exe
  2⤵
  PID:11476
- C:\Windows\System\BNqKFjT.exe
  C:\Windows\System\BNqKFjT.exe
  2⤵
  PID:10104
- C:\Windows\System\pMHxtuD.exe
  C:\Windows\System\pMHxtuD.exe
  2⤵
  PID:5012
- C:\Windows\System\yhLdKDR.exe
  C:\Windows\System\yhLdKDR.exe
  2⤵
  PID:10684
- C:\Windows\System\LeWFUIP.exe
  C:\Windows\System\LeWFUIP.exe
  2⤵
  PID:9960
- C:\Windows\System\AwrOcoc.exe
  C:\Windows\System\AwrOcoc.exe
  2⤵
  PID:6524
- C:\Windows\System\nRIjPko.exe
  C:\Windows\System\nRIjPko.exe
  2⤵
  PID:9228
- C:\Windows\System\aSWAIPp.exe
  C:\Windows\System\aSWAIPp.exe
  2⤵
  PID:9284
- C:\Windows\System\SIxHFpL.exe
  C:\Windows\System\SIxHFpL.exe
  2⤵
  PID:10188
- C:\Windows\System\qWYwWKI.exe
  C:\Windows\System\qWYwWKI.exe
  2⤵
  PID:11120
- C:\Windows\System\kIwBlPN.exe
  C:\Windows\System\kIwBlPN.exe
  2⤵
  PID:11172
- C:\Windows\System\Exhzwzw.exe
  C:\Windows\System\Exhzwzw.exe
  2⤵
  PID:8712
- C:\Windows\System\JVUnjKQ.exe
  C:\Windows\System\JVUnjKQ.exe
  2⤵
  PID:8796
- C:\Windows\System\UFejUiD.exe
  C:\Windows\System\UFejUiD.exe
  2⤵
  PID:11124
- C:\Windows\System\ccdpXDc.exe
  C:\Windows\System\ccdpXDc.exe
  2⤵
  PID:8752
- C:\Windows\System\nNAyGrv.exe
  C:\Windows\System\nNAyGrv.exe
  2⤵
  PID:12408
- C:\Windows\System\lQIIzag.exe
  C:\Windows\System\lQIIzag.exe
  2⤵
  PID:12536
- C:\Windows\System\grHukFx.exe
  C:\Windows\System\grHukFx.exe
  2⤵
  PID:9200
- C:\Windows\System\KlAczFo.exe
  C:\Windows\System\KlAczFo.exe
  2⤵
  PID:12604
- C:\Windows\System\mdJBtFy.exe
  C:\Windows\System\mdJBtFy.exe
  2⤵
  PID:12668
- C:\Windows\System\HjjGhHZ.exe
  C:\Windows\System\HjjGhHZ.exe
  2⤵
  PID:9356
- C:\Windows\System\sMCFUBX.exe
  C:\Windows\System\sMCFUBX.exe
  2⤵
  PID:7724
- C:\Windows\System\hKkAtAp.exe
  C:\Windows\System\hKkAtAp.exe
  2⤵
  PID:9512
- C:\Windows\System\gjvAItt.exe
  C:\Windows\System\gjvAItt.exe
  2⤵
  PID:7960
- C:\Windows\System\glLSfxQ.exe
  C:\Windows\System\glLSfxQ.exe
  2⤵
  PID:9176
- C:\Windows\System\JcfYvQK.exe
  C:\Windows\System\JcfYvQK.exe
  2⤵
  PID:12920
- C:\Windows\System\kIXtzjg.exe
  C:\Windows\System\kIXtzjg.exe
  2⤵
  PID:12940
- C:\Windows\System\rCvWvLb.exe
  C:\Windows\System\rCvWvLb.exe
  2⤵
  PID:9828
- C:\Windows\System\tfxoKWf.exe
  C:\Windows\System\tfxoKWf.exe
  2⤵
  PID:11624
- C:\Windows\System\aeymSpe.exe
  C:\Windows\System\aeymSpe.exe
  2⤵
  PID:10260
- C:\Windows\System\UHSdZTU.exe
  C:\Windows\System\UHSdZTU.exe
  2⤵
  PID:13072
- C:\Windows\System\hCgckma.exe
  C:\Windows\System\hCgckma.exe
  2⤵
  PID:10536
- C:\Windows\System\KbNxDWd.exe
  C:\Windows\System\KbNxDWd.exe
  2⤵
  PID:10632
- C:\Windows\System\JRLOOKp.exe
  C:\Windows\System\JRLOOKp.exe
  2⤵
  PID:9888
- C:\Windows\System\oEgbWnW.exe
  C:\Windows\System\oEgbWnW.exe
  2⤵
  PID:8120
- C:\Windows\System\FumlaXm.exe
  C:\Windows\System\FumlaXm.exe
  2⤵
  PID:10784
- C:\Windows\System\yyknItz.exe
  C:\Windows\System\yyknItz.exe
  2⤵
  PID:10980
- C:\Windows\System\aqgLEZl.exe
  C:\Windows\System\aqgLEZl.exe
  2⤵
  PID:10832
- C:\Windows\System\NKNWEmn.exe
  C:\Windows\System\NKNWEmn.exe
  2⤵
  PID:11072
- C:\Windows\System\cylHrSr.exe
  C:\Windows\System\cylHrSr.exe
  2⤵
  PID:9428
- C:\Windows\System\EDRIKkP.exe
  C:\Windows\System\EDRIKkP.exe
  2⤵
  PID:8280
- C:\Windows\System\EKRHEok.exe
  C:\Windows\System\EKRHEok.exe
  2⤵
  PID:12340
- C:\Windows\System\TZhqsgX.exe
  C:\Windows\System\TZhqsgX.exe
  2⤵
  PID:8412
- C:\Windows\System\ojNBtWZ.exe
  C:\Windows\System\ojNBtWZ.exe
  2⤵
  PID:12144
- C:\Windows\System\fGjKaCv.exe
  C:\Windows\System\fGjKaCv.exe
  2⤵
  PID:11872
- C:\Windows\System\dffVzIY.exe
  C:\Windows\System\dffVzIY.exe
  2⤵
  PID:11844
- C:\Windows\System\whaniWA.exe
  C:\Windows\System\whaniWA.exe
  2⤵
  PID:11764
- C:\Windows\System\dOdIshi.exe
  C:\Windows\System\dOdIshi.exe
  2⤵
  PID:11648
- C:\Windows\System\ViFKAUK.exe
  C:\Windows\System\ViFKAUK.exe
  2⤵
  PID:11728
- C:\Windows\System\gOYgttg.exe
  C:\Windows\System\gOYgttg.exe
  2⤵
  PID:11544
- C:\Windows\System\zEJGNil.exe
  C:\Windows\System\zEJGNil.exe
  2⤵
  PID:5024
- C:\Windows\System\JEGkZRq.exe
  C:\Windows\System\JEGkZRq.exe
  2⤵
  PID:11440
- C:\Windows\System\YcuDBDz.exe
  C:\Windows\System\YcuDBDz.exe
  2⤵
  PID:6688
- C:\Windows\System\GlIWzUi.exe
  C:\Windows\System\GlIWzUi.exe
  2⤵
  PID:11288
- C:\Windows\System\PAQNLAQ.exe
  C:\Windows\System\PAQNLAQ.exe
  2⤵
  PID:10200
- C:\Windows\System\zZPAEUa.exe
  C:\Windows\System\zZPAEUa.exe
  2⤵
  PID:8756
- C:\Windows\System\hGUBbET.exe
  C:\Windows\System\hGUBbET.exe
  2⤵
  PID:7744
- C:\Windows\System\QxXPMeT.exe
  C:\Windows\System\QxXPMeT.exe
  2⤵
  PID:9336
- C:\Windows\System\IpkNWCw.exe
  C:\Windows\System\IpkNWCw.exe
  2⤵
  PID:13016
- C:\Windows\System\LvAobYA.exe
  C:\Windows\System\LvAobYA.exe
  2⤵
  PID:13192
- C:\Windows\System\PGrwkOG.exe
  C:\Windows\System\PGrwkOG.exe
  2⤵
  PID:2420
- C:\Windows\System\qMSlnqL.exe
  C:\Windows\System\qMSlnqL.exe
  2⤵
  PID:9648
- C:\Windows\System\SQcECox.exe
  C:\Windows\System\SQcECox.exe
  2⤵
  PID:11384
- C:\Windows\System\rFTSlpU.exe
  C:\Windows\System\rFTSlpU.exe
  2⤵
  PID:9764
- C:\Windows\System\uZcsfyt.exe
  C:\Windows\System\uZcsfyt.exe
  2⤵
  PID:9908
- C:\Windows\System\CPpeUJi.exe
  C:\Windows\System\CPpeUJi.exe
  2⤵
  PID:11612
- C:\Windows\System\ekllRXY.exe
  C:\Windows\System\ekllRXY.exe
  2⤵
  PID:13064
- C:\Windows\System\AChhBvD.exe
  C:\Windows\System\AChhBvD.exe
  2⤵
  PID:11956
- C:\Windows\System\pdkxNGn.exe
  C:\Windows\System\pdkxNGn.exe
  2⤵
  PID:12064
- C:\Windows\System\UABhvSE.exe
  C:\Windows\System\UABhvSE.exe
  2⤵
  PID:6408
- C:\Windows\System\UfmWtEt.exe
  C:\Windows\System\UfmWtEt.exe
  2⤵
  PID:10620
- C:\Windows\System\dBxmkkN.exe
  C:\Windows\System\dBxmkkN.exe
  2⤵
  PID:10132
- C:\Windows\System\VivVOvB.exe
  C:\Windows\System\VivVOvB.exe
  2⤵
  PID:12172
- C:\Windows\System\aNanKHT.exe
  C:\Windows\System\aNanKHT.exe
  2⤵
  PID:12520
- C:\Windows\System\jlurnYL.exe
  C:\Windows\System\jlurnYL.exe
  2⤵
  PID:4760
- C:\Windows\System\HLKrUrP.exe
  C:\Windows\System\HLKrUrP.exe
  2⤵
  PID:9116
- C:\Windows\System\lvZzowQ.exe
  C:\Windows\System\lvZzowQ.exe
  2⤵
  PID:12916
- C:\Windows\System\FzkOaUA.exe
  C:\Windows\System\FzkOaUA.exe
  2⤵
  PID:12192
- C:\Windows\System\llzNMQO.exe
  C:\Windows\System\llzNMQO.exe
  2⤵
  PID:2348
- C:\Windows\System\eNdeqTX.exe
  C:\Windows\System\eNdeqTX.exe
  2⤵
  PID:12932
- C:\Windows\System\XkJHIki.exe
  C:\Windows\System\XkJHIki.exe
  2⤵
  PID:8488
- C:\Windows\System\cRXzoCz.exe
  C:\Windows\System\cRXzoCz.exe
  2⤵
  PID:10168
- C:\Windows\System\wACErOM.exe
  C:\Windows\System\wACErOM.exe
  2⤵
  PID:7380
- C:\Windows\System\OcUVKMo.exe
  C:\Windows\System\OcUVKMo.exe
  2⤵
  PID:11188
- C:\Windows\System\RTfQEqa.exe
  C:\Windows\System\RTfQEqa.exe
  2⤵
  PID:2268
- C:\Windows\System\rZIajaG.exe
  C:\Windows\System\rZIajaG.exe
  2⤵
  PID:11204
- C:\Windows\System\dHxMGXr.exe
  C:\Windows\System\dHxMGXr.exe
  2⤵
  PID:8664
- C:\Windows\System\IxmvQpU.exe
  C:\Windows\System\IxmvQpU.exe
  2⤵
  PID:10392
- C:\Windows\System\oXRWgYJ.exe
  C:\Windows\System\oXRWgYJ.exe
  2⤵
  PID:9388
- C:\Windows\System\AgrYBHa.exe
  C:\Windows\System\AgrYBHa.exe
  2⤵
  PID:7820
- C:\Windows\System\XfDKEWX.exe
  C:\Windows\System\XfDKEWX.exe
  2⤵
  PID:9804
- C:\Windows\System\cBZATZm.exe
  C:\Windows\System\cBZATZm.exe
  2⤵
  PID:12996
- C:\Windows\System\KoFDqKo.exe
  C:\Windows\System\KoFDqKo.exe
  2⤵
  PID:824
- C:\Windows\System\rmmROOO.exe
  C:\Windows\System\rmmROOO.exe
  2⤵
  PID:10776
- C:\Windows\System\HKOJovO.exe
  C:\Windows\System\HKOJovO.exe
  2⤵
  PID:10812
- C:\Windows\System\VETqEoz.exe
  C:\Windows\System\VETqEoz.exe
  2⤵
  PID:11168
- C:\Windows\System\KgDCcxe.exe
  C:\Windows\System\KgDCcxe.exe
  2⤵
  PID:8388
- C:\Windows\System\mkmWFqN.exe
  C:\Windows\System\mkmWFqN.exe
  2⤵
  PID:11964
- C:\Windows\System\bTYRNMW.exe
  C:\Windows\System\bTYRNMW.exe
  2⤵
  PID:11820
- C:\Windows\System\Xltuufi.exe
  C:\Windows\System\Xltuufi.exe
  2⤵
  PID:11668
- C:\Windows\System\WEMxnLP.exe
  C:\Windows\System\WEMxnLP.exe
  2⤵
  PID:11564
- C:\Windows\System\hXSlqpZ.exe
  C:\Windows\System\hXSlqpZ.exe
  2⤵
  PID:4948
- C:\Windows\System\odjAGXk.exe
  C:\Windows\System\odjAGXk.exe
  2⤵
  PID:11272
- C:\Windows\System\cANbGHm.exe
  C:\Windows\System\cANbGHm.exe
  2⤵
  PID:7352
- C:\Windows\System\vzcPRSA.exe
  C:\Windows\System\vzcPRSA.exe
  2⤵
  PID:4420
- C:\Windows\System\BYpXKuW.exe
  C:\Windows\System\BYpXKuW.exe
  2⤵
  PID:1568
- C:\Windows\System\CbPEqDO.exe
  C:\Windows\System\CbPEqDO.exe
  2⤵
  PID:3556
- C:\Windows\System\NFusInl.exe
  C:\Windows\System\NFusInl.exe
  2⤵
  PID:4576
- C:\Windows\System\nGYmsbJ.exe
  C:\Windows\System\nGYmsbJ.exe
  2⤵
  PID:7096
- C:\Windows\System\vvuxfyv.exe
  C:\Windows\System\vvuxfyv.exe
  2⤵
  PID:7092
- C:\Windows\System\mgNImiE.exe
  C:\Windows\System\mgNImiE.exe
  2⤵
  PID:5180
- C:\Windows\System\kjxQZbb.exe
  C:\Windows\System\kjxQZbb.exe
  2⤵
  PID:9312
- C:\Windows\System\yetILoo.exe
  C:\Windows\System\yetILoo.exe
  2⤵
  PID:7068
- C:\Windows\System\jwcZyFH.exe
  C:\Windows\System\jwcZyFH.exe
  2⤵
  PID:13128
- C:\Windows\System\HVuEVzI.exe
  C:\Windows\System\HVuEVzI.exe
  2⤵
  PID:9732
- C:\Windows\System\etyQXIa.exe
  C:\Windows\System\etyQXIa.exe
  2⤵
  PID:1104
- C:\Windows\System\YwkTCai.exe
  C:\Windows\System\YwkTCai.exe
  2⤵
  PID:5324
- C:\Windows\System\PLuiWup.exe
  C:\Windows\System\PLuiWup.exe
  2⤵
  PID:7448
- C:\Windows\System\iNcLDdK.exe
  C:\Windows\System\iNcLDdK.exe
  2⤵
  PID:13648
- C:\Windows\System\hWjAnMY.exe
  C:\Windows\System\hWjAnMY.exe
  2⤵
  PID:13676
- C:\Windows\System\tCDdyeh.exe
  C:\Windows\System\tCDdyeh.exe
  2⤵
  PID:13700
- C:\Windows\System\BYmpJVK.exe
  C:\Windows\System\BYmpJVK.exe
  2⤵
  PID:13720
- C:\Windows\System\rtpikjQ.exe
  C:\Windows\System\rtpikjQ.exe
  2⤵
  PID:13740
- C:\Windows\System\SzmevPa.exe
  C:\Windows\System\SzmevPa.exe
  2⤵
  PID:13760
- C:\Windows\System\rAbOVut.exe
  C:\Windows\System\rAbOVut.exe
  2⤵
  PID:13784
- C:\Windows\System\zeTEYaq.exe
  C:\Windows\System\zeTEYaq.exe
  2⤵
  PID:13812
- C:\Windows\System\TBQZLXJ.exe
  C:\Windows\System\TBQZLXJ.exe
  2⤵
  PID:13836
- C:\Windows\System\DPyUhtW.exe
  C:\Windows\System\DPyUhtW.exe
  2⤵
  PID:13856
- C:\Windows\System\dmIAPni.exe
  C:\Windows\System\dmIAPni.exe
  2⤵
  PID:13876
- C:\Windows\System\bbQSfPj.exe
  C:\Windows\System\bbQSfPj.exe
  2⤵
  PID:13900
- C:\Windows\System\hQLqCNk.exe
  C:\Windows\System\hQLqCNk.exe
  2⤵
  PID:14040
- C:\Windows\System\tqrGoDv.exe
  C:\Windows\System\tqrGoDv.exe
  2⤵
  PID:8528
- C:\Windows\System\zGPaTOP.exe
  C:\Windows\System\zGPaTOP.exe
  2⤵
  PID:9860
- C:\Windows\System\wcrZZtv.exe
  C:\Windows\System\wcrZZtv.exe
  2⤵
  PID:3532
- C:\Windows\System\TSGahhh.exe
  C:\Windows\System\TSGahhh.exe
  2⤵
  PID:10908
- C:\Windows\System\QOjviFi.exe
  C:\Windows\System\QOjviFi.exe
  2⤵
  PID:2440
- C:\Windows\System\EGpGPFX.exe
  C:\Windows\System\EGpGPFX.exe
  2⤵
  PID:13692
- C:\Windows\System\eLGahWg.exe
  C:\Windows\System\eLGahWg.exe
  2⤵
  PID:14196
- C:\Windows\System\fxaKIco.exe
  C:\Windows\System\fxaKIco.exe
  2⤵
  PID:13868
- C:\Windows\System\xZNAveu.exe
  C:\Windows\System\xZNAveu.exe
  2⤵
  PID:13768
- C:\Windows\System\aTrkVxK.exe
  C:\Windows\System\aTrkVxK.exe
  2⤵
  PID:13936
- C:\Windows\System\uregMkn.exe
  C:\Windows\System\uregMkn.exe
  2⤵
  PID:13952
- C:\Windows\System\ilvvlWZ.exe
  C:\Windows\System\ilvvlWZ.exe
  2⤵
  PID:14284
- C:\Windows\System\RBWknOT.exe
  C:\Windows\System\RBWknOT.exe
  2⤵
  PID:14244
- C:\Windows\System\jWjKJrD.exe
  C:\Windows\System\jWjKJrD.exe
  2⤵
  PID:14332
- C:\Windows\System\UWwvrGt.exe
  C:\Windows\System\UWwvrGt.exe
  2⤵
  PID:14084
- C:\Windows\System\REipoYo.exe
  C:\Windows\System\REipoYo.exe
  2⤵
  PID:14108
- C:\Windows\System\HxSjaic.exe
  C:\Windows\System\HxSjaic.exe
  2⤵
  PID:14128
- C:\Windows\System\KuPZlEU.exe
  C:\Windows\System\KuPZlEU.exe
  2⤵
  PID:13344
- C:\Windows\System\XuGQOXk.exe
  C:\Windows\System\XuGQOXk.exe
  2⤵
  PID:12780
- C:\Windows\System\EgwDlxC.exe
  C:\Windows\System\EgwDlxC.exe
  2⤵
  PID:14324
- C:\Windows\System\fOsQjbU.exe
  C:\Windows\System\fOsQjbU.exe
  2⤵
  PID:9668
- C:\Windows\System\xfsmCuO.exe
  C:\Windows\System\xfsmCuO.exe
  2⤵
  PID:12140
- C:\Windows\System\sODRhnu.exe
  C:\Windows\System\sODRhnu.exe
  2⤵
  PID:10500
- C:\Windows\System\MFWETrG.exe
  C:\Windows\System\MFWETrG.exe
  2⤵
  PID:12896
- C:\Windows\System\KQZCrQQ.exe
  C:\Windows\System\KQZCrQQ.exe
  2⤵
  PID:6732
- C:\Windows\System\taZzdSH.exe
  C:\Windows\System\taZzdSH.exe
  2⤵
  PID:2584
- C:\Windows\System\hDvlIoV.exe
  C:\Windows\System\hDvlIoV.exe
  2⤵
  PID:13480
- C:\Windows\System\dDuuYUl.exe
  C:\Windows\System\dDuuYUl.exe
  2⤵
  PID:10548
- C:\Windows\System\UYsmKZZ.exe
  C:\Windows\System\UYsmKZZ.exe
  2⤵
  PID:13380
- C:\Windows\System\GZmiYyR.exe
  C:\Windows\System\GZmiYyR.exe
  2⤵
  PID:13932
- C:\Windows\System\KzquZsq.exe
  C:\Windows\System\KzquZsq.exe
  2⤵
  PID:12232
- C:\Windows\System\MYVaBup.exe
  C:\Windows\System\MYVaBup.exe
  2⤵
  PID:10520
- C:\Windows\System\auAbIAi.exe
  C:\Windows\System\auAbIAi.exe
  2⤵
  PID:12104
- C:\Windows\System\uDUvxgf.exe
  C:\Windows\System\uDUvxgf.exe
  2⤵
  PID:14220
- C:\Windows\System\PeQYuhJ.exe
  C:\Windows\System\PeQYuhJ.exe
  2⤵
  PID:8856
- C:\Windows\System\nKgcpMg.exe
  C:\Windows\System\nKgcpMg.exe
  2⤵
  PID:11936
- C:\Windows\System\VbyLftL.exe
  C:\Windows\System\VbyLftL.exe
  2⤵
  PID:7816
- C:\Windows\System\nOIpEDr.exe
  C:\Windows\System\nOIpEDr.exe
  2⤵
  PID:11496
- C:\Windows\System\AANwxlz.exe
  C:\Windows\System\AANwxlz.exe
  2⤵
  PID:14060
- C:\Windows\System\XucEPjh.exe
  C:\Windows\System\XucEPjh.exe
  2⤵
  PID:11504
- C:\Windows\System\inxrRZf.exe
  C:\Windows\System\inxrRZf.exe
  2⤵
  PID:3220
- C:\Windows\System\WdbvmlL.exe
  C:\Windows\System\WdbvmlL.exe
  2⤵
  PID:13136
- C:\Windows\System\iZXMtwO.exe
  C:\Windows\System\iZXMtwO.exe
  2⤵
  PID:14016
- C:\Windows\System\UGCSZij.exe
  C:\Windows\System\UGCSZij.exe
  2⤵
  PID:13960
- C:\Windows\System\zDpJxKv.exe
  C:\Windows\System\zDpJxKv.exe
  2⤵
  PID:10864
- C:\Windows\System\cZRjSBW.exe
  C:\Windows\System\cZRjSBW.exe
  2⤵
  PID:13600
- C:\Windows\System\WpAyzmH.exe
  C:\Windows\System\WpAyzmH.exe
  2⤵
  PID:7876
- C:\Windows\System\jmknTrh.exe
  C:\Windows\System\jmknTrh.exe
  2⤵
  PID:14268
- C:\Windows\System\IzafXsR.exe
  C:\Windows\System\IzafXsR.exe
  2⤵
  PID:13756
- C:\Windows\System\zlmHReg.exe
  C:\Windows\System\zlmHReg.exe
  2⤵
  PID:13992
- C:\Windows\System\DZwIoMK.exe
  C:\Windows\System\DZwIoMK.exe
  2⤵
  PID:7080
- C:\Windows\System\DKAYWng.exe
  C:\Windows\System\DKAYWng.exe
  2⤵
  PID:13340
- C:\Windows\System\dBDKwsc.exe
  C:\Windows\System\dBDKwsc.exe
  2⤵
  PID:13176
- C:\Windows\System\vgeMpaK.exe
  C:\Windows\System\vgeMpaK.exe
  2⤵
  PID:9948
- C:\Windows\System\uREIQNO.exe
  C:\Windows\System\uREIQNO.exe
  2⤵
  PID:9520
- C:\Windows\System\zNhUBxa.exe
  C:\Windows\System\zNhUBxa.exe
  2⤵
  PID:14116
- C:\Windows\System\cdDuvzv.exe
  C:\Windows\System\cdDuvzv.exe
  2⤵
  PID:13596
- C:\Windows\System\RQvFSWT.exe
  C:\Windows\System\RQvFSWT.exe
  2⤵
  PID:14152
- C:\Windows\System\PWmPxuf.exe
  C:\Windows\System\PWmPxuf.exe
  2⤵
  PID:1072
- C:\Windows\System\svFlHcs.exe
  C:\Windows\System\svFlHcs.exe
  2⤵
  PID:7076
- C:\Windows\System\xMpQLAh.exe
  C:\Windows\System\xMpQLAh.exe
  2⤵
  PID:13752
- C:\Windows\System\wYPjmNa.exe
  C:\Windows\System\wYPjmNa.exe
  2⤵
  PID:11608
- C:\Windows\System\NmPZFwY.exe
  C:\Windows\System\NmPZFwY.exe
  2⤵
  PID:13996
- C:\Windows\System\LSpIBPV.exe
  C:\Windows\System\LSpIBPV.exe
  2⤵
  PID:13908
- C:\Windows\System\rpfvRXt.exe
  C:\Windows\System\rpfvRXt.exe
  2⤵
  PID:3068
- C:\Windows\System\aYaGbPe.exe
  C:\Windows\System\aYaGbPe.exe
  2⤵
  PID:14216
- C:\Windows\System\IvhXBNI.exe
  C:\Windows\System\IvhXBNI.exe
  2⤵
  PID:13464
- C:\Windows\System\WUZZDqA.exe
  C:\Windows\System\WUZZDqA.exe
  2⤵
  PID:13732
- C:\Windows\System\SgRtYQH.exe
  C:\Windows\System\SgRtYQH.exe
  2⤵
  PID:4704
- C:\Windows\System\jANNLXl.exe
  C:\Windows\System\jANNLXl.exe
  2⤵
  PID:5612
- C:\Windows\System\WUKUakY.exe
  C:\Windows\System\WUKUakY.exe
  2⤵
  PID:2788
- C:\Windows\System\TymVgYj.exe
  C:\Windows\System\TymVgYj.exe
  2⤵
  PID:232
- C:\Windows\System\BMlVgMo.exe
  C:\Windows\System\BMlVgMo.exe
  2⤵
  PID:12648
- C:\Windows\System\xmPJyKQ.exe
  C:\Windows\System\xmPJyKQ.exe
  2⤵
  PID:4824
- C:\Windows\System\XhhbUKu.exe
  C:\Windows\System\XhhbUKu.exe
  2⤵
  PID:9092
- C:\Windows\System\hElpIRo.exe
  C:\Windows\System\hElpIRo.exe
  2⤵
  PID:3536
- C:\Windows\System\QVBFHez.exe
  C:\Windows\System\QVBFHez.exe
  2⤵
  PID:13884
- C:\Windows\System\WRUsJcV.exe
  C:\Windows\System\WRUsJcV.exe
  2⤵
  PID:13920
- C:\Windows\System\bOdzrVh.exe
  C:\Windows\System\bOdzrVh.exe
  2⤵
  PID:12116
- C:\Windows\System\PEOwbpF.exe
  C:\Windows\System\PEOwbpF.exe
  2⤵
  PID:9692
- C:\Windows\System\ylANjEP.exe
  C:\Windows\System\ylANjEP.exe
  2⤵
  PID:13320
- C:\Windows\System\AMYiQxs.exe
  C:\Windows\System\AMYiQxs.exe
  2⤵
  PID:8708
- C:\Windows\System\mEtcwrJ.exe
  C:\Windows\System\mEtcwrJ.exe
  2⤵
  PID:8612
- C:\Windows\System\kFMbVsC.exe
  C:\Windows\System\kFMbVsC.exe
  2⤵
  PID:14352
- C:\Windows\System\DcUCRXG.exe
  C:\Windows\System\DcUCRXG.exe
  2⤵
  PID:14368
- C:\Windows\System\OZwRgwe.exe
  C:\Windows\System\OZwRgwe.exe
  2⤵
  PID:14388
- C:\Windows\System\lkMEIZa.exe
  C:\Windows\System\lkMEIZa.exe
  2⤵
  PID:14412
- C:\Windows\System\kEAExxd.exe
  C:\Windows\System\kEAExxd.exe
  2⤵
  PID:14432
- C:\Windows\System\zSMnNdy.exe
  C:\Windows\System\zSMnNdy.exe
  2⤵
  PID:14456
- C:\Windows\System\xJjXgzF.exe
  C:\Windows\System\xJjXgzF.exe
  2⤵
  PID:14476
- C:\Windows\System\SdkPMGt.exe
  C:\Windows\System\SdkPMGt.exe
  2⤵
  PID:14500
- C:\Windows\System\rcPoYuY.exe
  C:\Windows\System\rcPoYuY.exe
  2⤵
  PID:14792
- C:\Windows\System\ZWVLEuo.exe
  C:\Windows\System\ZWVLEuo.exe
  2⤵
  PID:14812
- C:\Windows\System\ONEwkss.exe
  C:\Windows\System\ONEwkss.exe
  2⤵
  PID:14832
- C:\Windows\System\IVVJnsH.exe
  C:\Windows\System\IVVJnsH.exe
  2⤵
  PID:14848
- C:\Windows\System\jqUBGjq.exe
  C:\Windows\System\jqUBGjq.exe
  2⤵
  PID:14872
- C:\Windows\System\ZmTdHae.exe
  C:\Windows\System\ZmTdHae.exe
  2⤵
  PID:14896
- C:\Windows\System\fRVfaTV.exe
  C:\Windows\System\fRVfaTV.exe
  2⤵
  PID:14944
- C:\Windows\System\kJqixIY.exe
  C:\Windows\System\kJqixIY.exe
  2⤵
  PID:15160
- C:\Windows\System\nYIAgpl.exe
  C:\Windows\System\nYIAgpl.exe
  2⤵
  PID:15176
- C:\Windows\System\MWazeja.exe
  C:\Windows\System\MWazeja.exe
  2⤵
  PID:15196
- C:\Windows\System\eXJDQJo.exe
  C:\Windows\System\eXJDQJo.exe
  2⤵
  PID:15228
- C:\Windows\System\khSbBgz.exe
  C:\Windows\System\khSbBgz.exe
  2⤵
  PID:15248
- C:\Windows\System\WjKkLtR.exe
  C:\Windows\System\WjKkLtR.exe
  2⤵
  PID:15264
- C:\Windows\System\NFcUCvO.exe
  C:\Windows\System\NFcUCvO.exe
  2⤵
  PID:15280
- C:\Windows\System\BHnbYYN.exe
  C:\Windows\System\BHnbYYN.exe
  2⤵
  PID:15296
- C:\Windows\System\AosdNVV.exe
  C:\Windows\System\AosdNVV.exe
  2⤵
  PID:4136
- C:\Windows\System\GCPKHdc.exe
  C:\Windows\System\GCPKHdc.exe
  2⤵
  PID:14404
- C:\Windows\System\ePTXDYj.exe
  C:\Windows\System\ePTXDYj.exe
  2⤵
  PID:14104
- C:\Windows\System\eXFuyMo.exe
  C:\Windows\System\eXFuyMo.exe
  2⤵
  PID:14592
- C:\Windows\System\UoGErjK.exe
  C:\Windows\System\UoGErjK.exe
  2⤵
  PID:14732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1qzlt3jl.dhv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DBOCQNC.exe

Filesize
1.9MB

MD5
96735bbcdaf9739584c71b2a088adb65

SHA1
14f49af755cd7b5d4bf5442454a2d47a8cdcf63e

SHA256
36b27b079e302c0fcd1c0dc06a6911a93afddfcf739e406fdf356addd588c400

SHA512
8c97a4656f450e0073818e3d563d14bf27b515be0a115458efdde9b1450e9cbeb0e342df1215021841d5a90fba38730d4be9c240dbd1891221271cf24ff0cf7b

Download Submit
C:\Windows\System\DEjRwBI.exe

Filesize
1.9MB

MD5
56de339777cbd12ebc3494b7042654b6

SHA1
3ab3873a96c6ccea03161bb8babdc91483e825a2

SHA256
8ce883faf9094048c022910e070ccdf89be80e83086726baa6b466e26eadbd4a

SHA512
7f84d3bbe7215528ee8870b12246d9fe7f8eab328db02118a7d0b3296bbd3034afee0b0d48fc245b1a4c9bd67d9a3b2ae6c439574f0c198848eafd0523b78182

Download Submit
C:\Windows\System\DnglLrb.exe

Filesize
1.9MB

MD5
e381fd5904f219b5bb19959c665a4e65

SHA1
46fe61e026dbc82bd9a203edd40dcf2e82c31fbe

SHA256
57bcfdcf13319b988721ac74b9da22ee66cf9698c37f544429767f3eb111911d

SHA512
57a964ee421255fa3c9ccc03fa121f83142a4d52ad230301fafbb424beec829873973d6ff9da2e28b666596037ddd51fb563c3a8358be2581ffd26453636a4dc

Download Submit
C:\Windows\System\IFhuqjF.exe

Filesize
1.9MB

MD5
c8f4e6507311f1e7f823bf6f5019cf9c

SHA1
e8c06ac2182cc72324a4f01a0d92ababcd3ff5d6

SHA256
f7de0814fece5258f2fffd0a339761b25878926e421c3617eba920dc4cdb524a

SHA512
69966ceb78287efe8ac1fa76c14343c724cca83e22d7cbb04356042cfd360052eb6fa1819a9b0352c61fb65e3051d8cc56324873cdda97c58bec30b289c51464

Download Submit
C:\Windows\System\IUSfYpn.exe

Filesize
1.9MB

MD5
fcf8d87e0d5823e6c69a4bc62e747218

SHA1
adbaf6ea9fe5a83961f1f8cc8bf965c0c99041c7

SHA256
1600dbc0f9c87b46f5fcc116423d1e89b5f94c1363e813b60b9205c6b4febc89

SHA512
8929022d1a3b65bcb8492ddbd09d2b6e169dd6389ae590d4509aedd8f3923ee5c7ba2e5d9c6ab3d5f98a6edce60c052c2a1351ec8323a279010d686834c71eea

Download Submit
C:\Windows\System\JdkaVgJ.exe

Filesize
1.9MB

MD5
83fff21987708a4d64c9817bcea8988d

SHA1
4ea624a146e2822d36749be3bd0d38ad8e7b0765

SHA256
7e6d9f86655e49f4f4afe9430708188fdc35d8c8be881036c5ad934300dae9e6

SHA512
bf6184a8a53b54df15e0bf0ec9881e634fc214f2befaf514d2fd0ca4947b1c461eabd511271e2d12f1f939ad0bd47ccc94da6aa747624a1e41c1d7d7716f13e7

Download Submit
C:\Windows\System\LRaqxpf.exe

Filesize
1.9MB

MD5
0c3940f425d05327affa00fa0957eb90

SHA1
bbe7ce24e41823c247e55ffb953db711365e656a

SHA256
7728273f661ca71006159370bd7ed094453aee1709801e6283ab28e3c67043ff

SHA512
c3236ea6c5641fff330515e76c07d9c0a96daeef6ee4d8ff0b0a8981170798e74cbf9bff3b7bd62fb934a37ee449ffe571b5ded7ce12500036170ebbef0021f3

Download Submit
C:\Windows\System\LkYypGi.exe

Filesize
1.9MB

MD5
65ca264ffdce691f7ef1b30464d6728f

SHA1
1ea4df4e9818a4dc80b043370a6439eea422bea9

SHA256
8a5e6e61dc089643070e653ea0198cb5050b1d85fff024adf9ec12a37e15efda

SHA512
d8a03ce65bc3c20d67a74b36d40a15945f6d0cf8c6bddf3225e2ca92902d1972ff5fc5da932b90a28fb79524d516c560e27ae0533882b01a5eb20ca91b88ce51

Download Submit
C:\Windows\System\LpLHhUo.exe

Filesize
1.9MB

MD5
2b9cf274244551f0e005b8ce8809aa28

SHA1
3578c2b60fd42e00409c0db1449c428e17d84a6a

SHA256
e88f58d8e4a826b84bffc56a37af6d4f65d0287971a47af83e8eb790a78b052c

SHA512
552ac0b944aaf6f89b14db3f467a70510cbbe34387648c96b454673428db30d5ef530be72a6b5ee7d7581f193ecf4d7a7e852a90a4fcff898705f68a6b2e381d

Download Submit
C:\Windows\System\MbLTuYY.exe

Filesize
1.9MB

MD5
1f25ea972917f529e2b6c82cda53a776

SHA1
407e7d50aaff920bac1e2b633b2cfe18b886f6c4

SHA256
f3fb79455c66b797087cd4aa4480cab9563309239a395593e0b852e5802c772f

SHA512
645f17330fddae089fc3cf61d3691637325ef24f8e526c5c060c870691cd0f5f612d83c48aa09fe62183c1868c79e818380df59bee019c88836c698fb977e23f

Download Submit
C:\Windows\System\MlJdeWz.exe

Filesize
1.9MB

MD5
6ca07990ab685cf448515201c9538ec6

SHA1
2e0a75865967cb669908a0871f083292fa276048

SHA256
760b05c7928afa1756aa516208bdc9c0474cecea811a12d0e049b975f03d1a56

SHA512
f3537e7d39c4d7701a88c721a13d96affb781a678dd6a808c691682def8875d910670d56c0d05b52f3a53eb0405d0e4417bf971d27336e86ad555cb946cf4d23

Download Submit
C:\Windows\System\OParWZw.exe

Filesize
1.9MB

MD5
0860a013ffcca8a83fce377446ebaa57

SHA1
538431d032ad910be1630f9c0a24a242730147c5

SHA256
fa748abbeace2cced1fd69c122320a604c151c641d89d8a7101533cfdc4a286d

SHA512
0c7dc11d3de7d8c4ab43bbff7ea005d5dddfa3a0f66c7f1bbd628efc9f052737c5d8602104728115e1cf430c55a1358e5c315d6f6f764e292e512cee081b1c7b

Download Submit
C:\Windows\System\PdqtlAJ.exe

Filesize
1.9MB

MD5
d1f1e39507b4c4d1f38d7a0d847b0439

SHA1
ab0944809a738c8baedec08ab565bec5930df395

SHA256
46656b5a2a07a0c8e99b84cd76bbd8d4024f80ff3977c1b9f30421292675fb2b

SHA512
c2194d08aa1f51436c4939843fad5812387c56ccd499e4e6525a35d7fb624c889121e704b7298dd1e92baa2477216d1702baab582b9fad987b81d0ead1a89b13

Download Submit
C:\Windows\System\SNGYKgE.exe

Filesize
1.9MB

MD5
8864305738e6748cbd744b68d5a761a1

SHA1
fcb31e99a34d8fadf54b70e91c8f286afb0d1f00

SHA256
db36f3a73cec287f39885099d5b491dd63b5b6dce55fa7ac81ab55f11b057bdb

SHA512
676ecf704308f954dd517a9a96cc9295ff31cffc4fc38192b7f6dc4568656bba5a5a945fb0158cab3bd066e201c81233251b88fa8c96a2aa70bdde0ab6f51c28

Download Submit
C:\Windows\System\YkWSObH.exe

Filesize
1.9MB

MD5
cff8f4b6f46bca688bfc78e5a95ba44a

SHA1
af17a40fa0543bf7137be1c81a125a297a204353

SHA256
6b04c0dda3e1fa11fc04aaf512bca80e90336d14ffa3d74f8a3e32266a316432

SHA512
1828d85960d8100422ce19ed6bdd18dde85373e3086696eb67a764b4f1e48e9533ffca06298062a65bca0178f45f661b8d1617e4b6ef89e674e383b984790111

Download Submit
C:\Windows\System\ZMGXsuY.exe

Filesize
1.9MB

MD5
1000a6e12056074e5f1836858f5b4d4a

SHA1
a5d1fea7cf540d15fa9eff2cf9dfc5ad6355c20d

SHA256
b161d491aad9a947285834ee803b56c4ffa7da4d35c6a25c4f26a807a77e0234

SHA512
4bc50ab05495e83c6b9a7d87f000d443c0af540ac6d8bc154f403986041254382c535bf6fb1fe2d9270345b0d0fbc1d01f35043d67d29d3edd26273d17b7a892

Download Submit
C:\Windows\System\aWUGpTw.exe

Filesize
1.9MB

MD5
9ce7f933a43fd27a52a387cdde6c9350

SHA1
50d71d39f53da0c7f27cd26bf03be5d22a7f23b3

SHA256
bd3fd3ce8d5b470e696bd28a6cd20af810603d3242d07317aae3554995075d29

SHA512
b824e9e140e56f5b6f25b4513e8883e47406d987d395a6c7e8fe16cd39a3d86b09c425433a0dd2653e9758e9582f3654946bfb8226ac2caf3eef45bbc6180e43

Download Submit
C:\Windows\System\aqINeJz.exe

Filesize
1.9MB

MD5
5309c757dd8f972c8eb47c454d2cb262

SHA1
9c975feba32dd0186da859e6b1b6453fe8b3e0c0

SHA256
679417110551858fbfc09e667726fa4d4487279bd9ad975710f1442feb3e23f1

SHA512
865ea27efd475e293a2bba1dd2b46ce39ce12fa551e8d29ab8064fea65d98a51d3529c918a72436ead05c6783eb480cc0d72c0da384dbed221e758d0ff822dd9

Download Submit
C:\Windows\System\dsEfkQs.exe

Filesize
1.9MB

MD5
e178110168946f836de40db245fd1c69

SHA1
52fefa8e652911b61e0ba94337f2e71d81457911

SHA256
ef61eb45824d1888f2e0d4ac600bd0ea31e75e46e3360b78a397453674c810d5

SHA512
56c6367f08b316cd9602d1bd9621c8bc18121709ee935d20c5360a5bebfe9423c55a915a2668bfc2867d801b9a2a050b0b4f1f7fdb119e20cb85e91bbe0644a7

Download Submit
C:\Windows\System\gkRnHLT.exe

Filesize
1.9MB

MD5
76bf7ed0befc87c793c29c7dd936fadb

SHA1
de14e1ad0b28cf2ad2d04ca20e336cab881de5c9

SHA256
3357589427d6a7d497085e2c7113cc1a4ea443e79a5c405af233e2699b6b38f4

SHA512
fbd611a118bdf31f2d7cc32376f75039ddf388f97eaa05cbd73f5bfde4d6332385dd73b792f1a6ba5f73a6471bad8a46f0b36f5ea8177a28d52cc0b466934ad7

Download Submit
C:\Windows\System\gqCEHJa.exe

Filesize
1.9MB

MD5
61b95e182ded802d2774e697ec6b7b4f

SHA1
c33e3616e189992d2bf11afc0dc7ae75addeabc5

SHA256
f78f51b443635bc96d1a50d3c6275e538dd1529f683afa3a8038bc88e6caf198

SHA512
4ba72566024b187cfc877a8db591084e86427d17bf809708697f8312bd46876cb37eba431f59d4f171cbcfaaf22a485b9e23d057874fd16ace340f9da2fecd91

Download Submit
C:\Windows\System\gxGWgsi.exe

Filesize
1.9MB

MD5
591295128c8564ce088c0c889d044de7

SHA1
78da68dcdefdde62adcdd36070ae1286cbdfe1b7

SHA256
74e484d0b9e11e41acfee34e4869c181a92d3ba358ebc8ecaf4db85225941002

SHA512
15ee552b77cde9fc5e48ab18d52f814c2254bb8310c9a99811197102aa923574bf147cb4fad8cbb07ba1263455281c296f11db25eaf37f421b92287d7b830462

Download Submit
C:\Windows\System\hpYHVMt.exe

Filesize
1.9MB

MD5
80ac2e2c29d43b15b175708cf5e5ab2a

SHA1
576ddcf65b43ac39d3d2df242ae5bf568cb64c17

SHA256
ad2e0644fde191d1fdbe3b01dcdc54a9d0e50414753c8a3095ec1419363dbd44

SHA512
de9dc99db8838574aa1e53a9170f7e8f56c3ef4255418649ca79c49082b0943dad232e92493736f0bec2e54c56f949951f862d20f00e6025ff81208c5e1d9255

Download Submit
C:\Windows\System\iYvgRsB.exe

Filesize
1.9MB

MD5
7b18824fde00c357a12660492b3b4aae

SHA1
cb5b5a2cc6512e5d61a0022bf59af5e7bd013c52

SHA256
2d70d8bdf1461c233350f3d6b35c45dd5bdb3f122a5f72ebc1f98e8490f5e8fa

SHA512
91dde42c4f55d0d3d92d0dbf7426b4b16a33f423cfbee12c32f4197dc0cbf51ba22da115805b35ed1b9ba3f3b87f545eb3f77921d47a41d9d5422a09f1a3d865

Download Submit
C:\Windows\System\jijVqzE.exe

Filesize
1.9MB

MD5
b2a4f1e2c0d410d639d1ca9867376e64

SHA1
95372d4dc428630001cc2f92ded9673a892213fc

SHA256
0c9ac2bac97fe4f8d242f9ec2fefb96fa5b1c01e2480bd3370d257b0351b370e

SHA512
001347707ca5930546b0378fae25bdb557a127c511f88657439192a9aeebd8624945d5c355138aa41eaefbb0d7d6cc96b4a1769b59c397f2ad70c905fdc69f36

Download Submit
C:\Windows\System\kOJtDdm.exe

Filesize
1.9MB

MD5
a19690642ef797338c63b95edd3578c3

SHA1
636d1e0beebe1fe7c32a5474dcf26e699c6058a7

SHA256
e2462026d17df3e17f0c2e2476cf73bc6dbc06250ce82d37b1fee05304137138

SHA512
6141b3b68b5cb1d0b8c2b26dcccdacff11f0dacd1ef5acd0d59d6074a8187bd70ddf7eac35c1364bcb0c2c5cb7c7a4945c27afde92ae2d88cfce5ad56c82853c

Download Submit
C:\Windows\System\lQUfHkZ.exe

Filesize
1.9MB

MD5
9784e658c9083628da37b8cd02fa85a9

SHA1
b57a47486ca10343176f850b61e93cddc257a9fb

SHA256
0916dc668b0ef98534c98a25e627712ae89190f931fb7c4ca488083a91e6b26c

SHA512
2808513233a98c517de70bb16926a29a614e44e803283aa1448cb95bd16965f80a2a2fda01b4d39531933fcb803d546e93f3f9d4d991811262d779787829b89c

Download Submit
C:\Windows\System\lhhEQTm.exe

Filesize
1.9MB

MD5
bffc33b1eb19fc6c8df7bdfc5d5268fc

SHA1
8acb13b8f7765ac7904e7bf7330dbe493b06e183

SHA256
e8ee8cb1e4d6552576a7840dedab3ededc58ff09dd5e3e24f2c45fa58bbd44a9

SHA512
d6ea1012f6320c395e21eab441568c1cc1b4246291546610129117a80c52866c1469ea7a11b6b985f276bd152dbdee9484159041aa616236ddadad1459cb86bc

Download Submit
C:\Windows\System\likZqmQ.exe

Filesize
1.9MB

MD5
cdb47186a6a0d750dcb1ba9bcdb15c3f

SHA1
2a607beae697ae9a1da051299e0c46a292719fc0

SHA256
7ac6daad5c05dce13b527e7a70e5ede0be26dc5ac3da61ac3af35b8d1a145e3b

SHA512
3b4de2178ab5aa1079e872586cc8468881a47e37cb47365e4cb804309b46f15e620aa9c37aefc96a66227e6ebb11a76b51cd7894ca1e845f7820bccdbe038511

Download Submit
C:\Windows\System\mjNyrtz.exe

Filesize
1.9MB

MD5
1f73fb334480a3f8f27c8c505e43f9c9

SHA1
48c61d70c2bcc98c597066208513e07dece7172b

SHA256
5e8854e2c62133f8fc9e9de6b6f68f93a32c2516c54675249008c37214b66c93

SHA512
0d0d99afc448d7440e7a2b24641a9799b78586400ab716cc6681d271a20138ae3df00b79f62f238e93679ae0fd6762d9ca5daeb22fe9fb6ddd3ba8727071ef52

Download Submit
C:\Windows\System\nClXjzH.exe

Filesize
1.9MB

MD5
1d59f3494b1456e411b5428a63f990ec

SHA1
489ad8e4ad24babec6faf7d1be0916ac1efc2ab6

SHA256
aaf3bb1ea02d7d14e924cc15c86d892dd2d89fb12691cfb0ce435a2d35b4f659

SHA512
9b70d8d80a5f8a1760d61373fbe133fb4815875ab2f474c81ee98bedd0118daf46f7d212b643db580ade54314aaa8568a6fa103c82f0ef85e01c30f98ab9bd0f

Download Submit
C:\Windows\System\oupLlpo.exe

Filesize
1.9MB

MD5
a9f3c4cd73da94c56f63363b48584559

SHA1
5b72eca372627ea1732ca89beb61e7d334b7b484

SHA256
9a38fec716e223ff0be2655c1d323999904f2e7d252e9dd014c4fb54c657f3d0

SHA512
9d5a10b4bd25a876647b1d00859a8e5f15a484d89185b222decea1fa72f57ec83f86faffc994e0161a9a3cb55f651ccf25fe10bc058b829b8809e0a2551eca51

Download Submit
C:\Windows\System\raDOpog.exe

Filesize
1.9MB

MD5
31acaedcaceea0931b17adb668e80e4d

SHA1
42e99ce8ad5a53a19ecf70916a05501a00e3beb8

SHA256
9a982c9045cb6cb4d2b981b24305beb663db1f25ac62df16716f4ad93f6c08c4

SHA512
0e08927542f15c08f49bdb78ab4d5d8b7c0625dd37ce018bcfafda7ea9f2f852faf5dff275a81a8553549d08a6cf3ec070406d23719bf8fa21f7a27efd4633df

Download Submit
C:\Windows\System\roCnKdg.exe

Filesize
1.9MB

MD5
f622ace8373cf2f7295528e39899c878

SHA1
d02130078ecdec7d103f2d7b5cfd9df1c09131d6

SHA256
28e3f3c9939387f6370f8664f05828696ebbceb14017c849c2ebf5fa8f8cc527

SHA512
312b31da1735b9782c06a0d5ef9adf46b216ab2e6c0088c5853e136a2ab6211952b881eb6947580d221d20d81771bb0326f4c5990fcd97f0523cf1949280ac37

Download Submit
C:\Windows\System\ruSqWqZ.exe

Filesize
1.9MB

MD5
451e7da6ccf40df2819fcbab59456080

SHA1
c59f8ea05bcbdbf01643d1fabfebbf6adce2d17e

SHA256
7569fc40e4b0ab1868ec9426e61815a4686afc06e92466c2f6f37941e0063bd1

SHA512
6771d50ada72974ac1ee4a98f99cb82d502b9da430bcb50ee6e546dd54989ce3ad8775a47eb1c315b0b85fb00b627ef9a2f5ad63117a868474a2a56e5b0df941

Download Submit
C:\Windows\System\tjgxUjq.exe

Filesize
1.9MB

MD5
ef355adde66528fe8a206051e3bb597e

SHA1
097f6a2d2ce06b92baa5d1ee9a1c03068bad7653

SHA256
0c0a4f7fe9ec8aa7ed82ba8204b5ca51dd398be83a0a5c4227425b2f76f85ad2

SHA512
6218e04fca01daaef13f5c59f9b3fa2ca5ed044229c882e8b1e06e2ac970ea3845fe36f6385fcb734c3071b41514c5f5599b6a0681e56c08266af76ea3c764bc

Download Submit
C:\Windows\System\tsGBqBE.exe

Filesize
1.9MB

MD5
7590ecf90936930909e8ecbf0241a076

SHA1
13f0c2f042d7889d60198e81051eaf7a51d14d36

SHA256
b7d14d5aafce80856376a728fb9af2775877e71f3177e621053b8291d57661f2

SHA512
41593f2278c68954626976b94cce4859e8921dd4e0acefafe32b64f813561918a0f5aa5fcccb8e87c7312b334fef9897a92ec4f8667207d52f603aaf53b8eb57

Download Submit
C:\Windows\System\uHMbPwB.exe

Filesize
1.9MB

MD5
5e11624d89e952907620e7bd9655707b

SHA1
dc06a92e9d9272a8cb2319f546796ccb4c397b17

SHA256
b703f6211f8c95f05287aa2965c74347f1df678fd944bb7136d3faeb4a848c61

SHA512
5b1492e70e37c0f14fa9d1608b7e334bf6a27d513f5ae173bc57aa882319525eca0066e02fa8430708b59d26f36582265eada3e655e3a1d523f68d88947a960d

Download Submit
C:\Windows\System\zZVDZuw.exe

Filesize
1.9MB

MD5
b89b86af7af96783bdc83595ac85556c

SHA1
2ea9ff53a50794dc79d93eb16064bd509cea21e1

SHA256
1ac38ce8916a3f44e23e31bccd91d7391337cfa9866346ba47888555be0f7a82

SHA512
cf22b633087a7ef6d53cae9cbd0653fb650a4b856a8ce7a93150620fb4517fdab14e7e5e4e75c4a98779847e294cf0131ccf600f77c59f830e9c685a3832a2ed

Download Submit
C:\Windows\System\znPSxOM.exe

Filesize
1.9MB

MD5
ad40e83b5900e0ad6d06ed41aceb8ace

SHA1
d8ea03af2409def543b963f234036006fa2b0341

SHA256
d018d3c043d2215c89376d9d1311ba699e842f72a4d01891d890acbf433fddbc

SHA512
7ed0e49f2c72039395d96ce93fd702953b10e5cedeb3905d873921ee86db0b7e63b7d2288fe58f81e6a7a869f0dc0c035b1a111e7f8564f97136bdd6a0e14e8c

Download Submit
memory/64-363-0x00007FF7DEC10000-0x00007FF7DF002000-memory.dmp

Filesize
3.9MB

Download
memory/64-3027-0x00007FF7DEC10000-0x00007FF7DF002000-memory.dmp

Filesize
3.9MB

Download
memory/696-561-0x00007FF706280000-0x00007FF706672000-memory.dmp

Filesize
3.9MB

Download
memory/696-3044-0x00007FF706280000-0x00007FF706672000-memory.dmp

Filesize
3.9MB

Download
memory/1108-3034-0x00007FF7B18E0000-0x00007FF7B1CD2000-memory.dmp

Filesize
3.9MB

Download
memory/1108-570-0x00007FF7B18E0000-0x00007FF7B1CD2000-memory.dmp

Filesize
3.9MB

Download
memory/1132-311-0x00007FF78E290000-0x00007FF78E682000-memory.dmp

Filesize
3.9MB

Download
memory/1132-3026-0x00007FF78E290000-0x00007FF78E682000-memory.dmp

Filesize
3.9MB

Download
memory/1200-510-0x00007FF61A590000-0x00007FF61A982000-memory.dmp

Filesize
3.9MB

Download
memory/1200-3021-0x00007FF61A590000-0x00007FF61A982000-memory.dmp

Filesize
3.9MB

Download
memory/1208-565-0x00007FF778E10000-0x00007FF779202000-memory.dmp

Filesize
3.9MB

Download
memory/1208-3071-0x00007FF778E10000-0x00007FF779202000-memory.dmp

Filesize
3.9MB

Download
memory/1304-560-0x00007FF6330D0000-0x00007FF6334C2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-3037-0x00007FF6330D0000-0x00007FF6334C2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-3029-0x00007FF71D7A0000-0x00007FF71DB92000-memory.dmp

Filesize
3.9MB

Download
memory/1540-569-0x00007FF71D7A0000-0x00007FF71DB92000-memory.dmp

Filesize
3.9MB

Download
memory/1704-3023-0x00007FF6BA3F0000-0x00007FF6BA7E2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-464-0x00007FF6BA3F0000-0x00007FF6BA7E2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-568-0x00007FF7C8E60000-0x00007FF7C9252000-memory.dmp

Filesize
3.9MB

Download
memory/1856-2994-0x00007FF7C8E60000-0x00007FF7C9252000-memory.dmp

Filesize
3.9MB

Download
memory/1888-52-0x00007FF68DE60000-0x00007FF68E252000-memory.dmp

Filesize
3.9MB

Download
memory/1888-2996-0x00007FF68DE60000-0x00007FF68E252000-memory.dmp

Filesize
3.9MB

Download
memory/2008-3032-0x00007FF7B7C20000-0x00007FF7B8012000-memory.dmp

Filesize
3.9MB

Download
memory/2008-185-0x00007FF7B7C20000-0x00007FF7B8012000-memory.dmp

Filesize
3.9MB

Download
memory/2008-2512-0x00007FF7B7C20000-0x00007FF7B8012000-memory.dmp

Filesize
3.9MB

Download
memory/2168-3067-0x00007FF69D2B0000-0x00007FF69D6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-564-0x00007FF69D2B0000-0x00007FF69D6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-2493-0x00007FFA1EDF0000-0x00007FFA1F8B1000-memory.dmp

Filesize
10.8MB

Download
memory/2648-2567-0x00007FFA1EDF0000-0x00007FFA1F8B1000-memory.dmp

Filesize
10.8MB

Download
memory/2648-49-0x00007FFA1EDF0000-0x00007FFA1F8B1000-memory.dmp

Filesize
10.8MB

Download
memory/2648-113-0x000001B9DD530000-0x000001B9DD552000-memory.dmp

Filesize
136KB

Download
memory/2648-567-0x00007FFA1EDF0000-0x00007FFA1F8B1000-memory.dmp

Filesize
10.8MB

Download
memory/2648-6-0x00007FFA1EDF3000-0x00007FFA1EDF5000-memory.dmp

Filesize
8KB

Download
memory/2964-3015-0x00007FF631B90000-0x00007FF631F82000-memory.dmp

Filesize
3.9MB

Download
memory/2964-129-0x00007FF631B90000-0x00007FF631F82000-memory.dmp

Filesize
3.9MB

Download
memory/3108-571-0x00007FF60B690000-0x00007FF60BA82000-memory.dmp

Filesize
3.9MB

Download
memory/3108-3039-0x00007FF60B690000-0x00007FF60BA82000-memory.dmp

Filesize
3.9MB

Download
memory/3112-572-0x00007FF75D170000-0x00007FF75D562000-memory.dmp

Filesize
3.9MB

Download
memory/3112-3072-0x00007FF75D170000-0x00007FF75D562000-memory.dmp

Filesize
3.9MB

Download
memory/3128-1-0x000001C3962D0000-0x000001C3962E0000-memory.dmp

Filesize
64KB

Download
memory/3128-2467-0x00007FF67E060000-0x00007FF67E452000-memory.dmp

Filesize
3.9MB

Download
memory/3128-0-0x00007FF67E060000-0x00007FF67E452000-memory.dmp

Filesize
3.9MB

Download
memory/3164-3019-0x00007FF660590000-0x00007FF660982000-memory.dmp

Filesize
3.9MB

Download
memory/3164-563-0x00007FF660590000-0x00007FF660982000-memory.dmp

Filesize
3.9MB

Download
memory/3216-2998-0x00007FF665B80000-0x00007FF665F72000-memory.dmp

Filesize
3.9MB

Download
memory/3216-81-0x00007FF665B80000-0x00007FF665F72000-memory.dmp

Filesize
3.9MB

Download
memory/3612-3069-0x00007FF7E4820000-0x00007FF7E4C12000-memory.dmp

Filesize
3.9MB

Download
memory/3612-566-0x00007FF7E4820000-0x00007FF7E4C12000-memory.dmp

Filesize
3.9MB

Download
memory/3628-3042-0x00007FF6FC1E0000-0x00007FF6FC5D2000-memory.dmp

Filesize
3.9MB

Download
memory/3628-562-0x00007FF6FC1E0000-0x00007FF6FC5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4360-220-0x00007FF7A1380000-0x00007FF7A1772000-memory.dmp

Filesize
3.9MB

Download
memory/4360-3017-0x00007FF7A1380000-0x00007FF7A1772000-memory.dmp

Filesize
3.9MB

Download
memory/4724-3011-0x00007FF7512B0000-0x00007FF7516A2000-memory.dmp

Filesize
3.9MB

Download
memory/4724-310-0x00007FF7512B0000-0x00007FF7516A2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-278-0x00007FF7FEEC0000-0x00007FF7FF2B2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-3000-0x00007FF7FEEC0000-0x00007FF7FF2B2000-memory.dmp

Filesize
3.9MB

Download
memory/5000-2479-0x00007FF64A7B0000-0x00007FF64ABA2000-memory.dmp

Filesize
3.9MB

Download
memory/5000-2992-0x00007FF64A7B0000-0x00007FF64ABA2000-memory.dmp

Filesize
3.9MB

Download
memory/5000-9-0x00007FF64A7B0000-0x00007FF64ABA2000-memory.dmp

Filesize
3.9MB

Download