xmrig | 3432451df8aad17ba60664446662692f6e7733e95009d73f7af29ed99bc18281

Analysis

max time kernel
112s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f532f79a96c14af4d39c1dd6c7398bd0N.exe
Size

2.0MB
MD5

f532f79a96c14af4d39c1dd6c7398bd0
SHA1

9ce46bb57032cda90d2aa4af18998510e16a2ede
SHA256

3432451df8aad17ba60664446662692f6e7733e95009d73f7af29ed99bc18281
SHA512

9da4668a35f331387fb36df99805d0748911bf6468849a412e85af88e68e8dfc31e7f5e99c730164bdee56134eee0b09ca459a4192b94cc56d6d2d27592941c4
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHqx4EKB6Se:NABO

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3544-284-0x00007FF63CE70000-0x00007FF63D262000-memory.dmp	xmrig
behavioral2/memory/4072-228-0x00007FF6970A0000-0x00007FF697492000-memory.dmp	xmrig
behavioral2/memory/4432-388-0x00007FF6A2CD0000-0x00007FF6A30C2000-memory.dmp	xmrig
behavioral2/memory/4036-472-0x00007FF781DF0000-0x00007FF7821E2000-memory.dmp	xmrig
behavioral2/memory/2956-512-0x00007FF6BADE0000-0x00007FF6BB1D2000-memory.dmp	xmrig
behavioral2/memory/3736-518-0x00007FF7C7D50000-0x00007FF7C8142000-memory.dmp	xmrig
behavioral2/memory/3028-524-0x00007FF6B3380000-0x00007FF6B3772000-memory.dmp	xmrig
behavioral2/memory/4528-2150-0x00007FF6BA930000-0x00007FF6BAD22000-memory.dmp	xmrig
behavioral2/memory/980-2233-0x00007FF7CDE70000-0x00007FF7CE262000-memory.dmp	xmrig
behavioral2/memory/1908-526-0x00007FF6C9670000-0x00007FF6C9A62000-memory.dmp	xmrig
behavioral2/memory/2044-525-0x00007FF7773E0000-0x00007FF7777D2000-memory.dmp	xmrig
behavioral2/memory/224-523-0x00007FF703420000-0x00007FF703812000-memory.dmp	xmrig
behavioral2/memory/2872-522-0x00007FF64BBD0000-0x00007FF64BFC2000-memory.dmp	xmrig
behavioral2/memory/1752-521-0x00007FF6357E0000-0x00007FF635BD2000-memory.dmp	xmrig
behavioral2/memory/4236-520-0x00007FF659B00000-0x00007FF659EF2000-memory.dmp	xmrig
behavioral2/memory/4684-519-0x00007FF62C290000-0x00007FF62C682000-memory.dmp	xmrig
behavioral2/memory/1744-517-0x00007FF77F5B0000-0x00007FF77F9A2000-memory.dmp	xmrig
behavioral2/memory/3184-516-0x00007FF757A60000-0x00007FF757E52000-memory.dmp	xmrig
behavioral2/memory/184-515-0x00007FF797B90000-0x00007FF797F82000-memory.dmp	xmrig
behavioral2/memory/2692-514-0x00007FF75B8D0000-0x00007FF75BCC2000-memory.dmp	xmrig
behavioral2/memory/4772-513-0x00007FF654610000-0x00007FF654A02000-memory.dmp	xmrig
behavioral2/memory/3492-511-0x00007FF6C0FA0000-0x00007FF6C1392000-memory.dmp	xmrig
behavioral2/memory/1028-508-0x00007FF7BE400000-0x00007FF7BE7F2000-memory.dmp	xmrig
behavioral2/memory/4028-387-0x00007FF6B9970000-0x00007FF6B9D62000-memory.dmp	xmrig
behavioral2/memory/4128-327-0x00007FF7DEE30000-0x00007FF7DF222000-memory.dmp	xmrig
behavioral2/memory/980-2846-0x00007FF7CDE70000-0x00007FF7CE262000-memory.dmp	xmrig
behavioral2/memory/4072-2848-0x00007FF6970A0000-0x00007FF697492000-memory.dmp	xmrig
behavioral2/memory/3544-2850-0x00007FF63CE70000-0x00007FF63D262000-memory.dmp	xmrig
behavioral2/memory/4432-2852-0x00007FF6A2CD0000-0x00007FF6A30C2000-memory.dmp	xmrig
behavioral2/memory/4036-2856-0x00007FF781DF0000-0x00007FF7821E2000-memory.dmp	xmrig
behavioral2/memory/4028-2855-0x00007FF6B9970000-0x00007FF6B9D62000-memory.dmp	xmrig
behavioral2/memory/4128-2891-0x00007FF7DEE30000-0x00007FF7DF222000-memory.dmp	xmrig
behavioral2/memory/1908-2895-0x00007FF6C9670000-0x00007FF6C9A62000-memory.dmp	xmrig
behavioral2/memory/4684-2899-0x00007FF62C290000-0x00007FF62C682000-memory.dmp	xmrig
behavioral2/memory/1744-2893-0x00007FF77F5B0000-0x00007FF77F9A2000-memory.dmp	xmrig
behavioral2/memory/2044-2889-0x00007FF7773E0000-0x00007FF7777D2000-memory.dmp	xmrig
behavioral2/memory/3492-2886-0x00007FF6C0FA0000-0x00007FF6C1392000-memory.dmp	xmrig
behavioral2/memory/3736-2885-0x00007FF7C7D50000-0x00007FF7C8142000-memory.dmp	xmrig
behavioral2/memory/184-2881-0x00007FF797B90000-0x00007FF797F82000-memory.dmp	xmrig
behavioral2/memory/1028-2880-0x00007FF7BE400000-0x00007FF7BE7F2000-memory.dmp	xmrig
behavioral2/memory/4772-2873-0x00007FF654610000-0x00007FF654A02000-memory.dmp	xmrig
behavioral2/memory/2956-2883-0x00007FF6BADE0000-0x00007FF6BB1D2000-memory.dmp	xmrig
behavioral2/memory/3028-2909-0x00007FF6B3380000-0x00007FF6B3772000-memory.dmp	xmrig
behavioral2/memory/3184-2917-0x00007FF757A60000-0x00007FF757E52000-memory.dmp	xmrig
behavioral2/memory/1752-2923-0x00007FF6357E0000-0x00007FF635BD2000-memory.dmp	xmrig
behavioral2/memory/2872-2920-0x00007FF64BBD0000-0x00007FF64BFC2000-memory.dmp	xmrig
behavioral2/memory/2692-2911-0x00007FF75B8D0000-0x00007FF75BCC2000-memory.dmp	xmrig
behavioral2/memory/224-2913-0x00007FF703420000-0x00007FF703812000-memory.dmp	xmrig
behavioral2/memory/4236-2904-0x00007FF659B00000-0x00007FF659EF2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2568	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
980	GjFXhuX.exe
4072	MYajkqb.exe
3544	EuxRCmV.exe
2044	fHgCaIA.exe
4128	qHCLOXA.exe
4028	bsOlBNM.exe
4432	cRtWVRd.exe
4036	otUfpSu.exe
1028	SveWdAh.exe
3492	lsQqRKy.exe
2956	fAUamVi.exe
4772	jgUyGde.exe
2692	qKaOzSs.exe
184	AOisHHJ.exe
3184	gQvRskQ.exe
1744	YvnXDJz.exe
1908	jLuDXiA.exe
3736	UkhVBxK.exe
4684	LOrAztR.exe
4236	JkmejFP.exe
1752	DRGFofH.exe
2872	JZHKCeb.exe
224	NemBIrR.exe
3028	kMnjPGt.exe
4060	uOJWztv.exe
440	qZOnnDa.exe
2400	qaMRjZc.exe
4652	WEmmVOi.exe
3020	vKChRpo.exe
1892	ShlbDzi.exe
2424	zXrbzQe.exe
988	ONtLqWq.exe
3768	uSRGYhB.exe
2736	ZbRrGZC.exe
428	AsBRvmv.exe
5072	NKWxsDl.exe
1300	hvnYhEc.exe
4044	YAefmWN.exe
4672	tRQptiO.exe
4812	wqlHFTh.exe
2972	jzmAoBl.exe
3900	rlASVKW.exe
3084	EjQVWQT.exe
2132	WSNzdYW.exe
1944	uPOkwax.exe
3984	mhCmbEr.exe
1756	grAlqdw.exe
3208	GixAzCW.exe
3980	petULoX.exe
1560	nnlHUSg.exe
3928	cCJMVTM.exe
2788	VzYWkRv.exe
1228	hirHLNE.exe
2684	mzJNSzl.exe
816	ZyZmAZc.exe
3272	iAgAdCi.exe
3236	KxJPqbv.exe
3220	sHclXgz.exe
3480	LAxymln.exe
1896	iMIngVq.exe
3440	AzCdioK.exe
4016	CgQROeA.exe
4356	SUvhrCW.exe
4088	xRWYPeW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4528-0-0x00007FF6BA930000-0x00007FF6BAD22000-memory.dmp	upx
behavioral2/files/0x00080000000234de-5.dat	upx
behavioral2/memory/980-12-0x00007FF7CDE70000-0x00007FF7CE262000-memory.dmp	upx
behavioral2/files/0x00070000000234e3-8.dat	upx
behavioral2/files/0x00070000000234e4-19.dat	upx
behavioral2/files/0x00070000000234e2-15.dat	upx
behavioral2/files/0x00070000000234e5-24.dat	upx
behavioral2/files/0x00070000000234ef-76.dat	upx
behavioral2/files/0x00070000000234fd-137.dat	upx
behavioral2/memory/3544-284-0x00007FF63CE70000-0x00007FF63D262000-memory.dmp	upx
behavioral2/memory/4072-228-0x00007FF6970A0000-0x00007FF697492000-memory.dmp	upx
behavioral2/files/0x00070000000234f6-207.dat	upx
behavioral2/files/0x00070000000234f5-196.dat	upx
behavioral2/files/0x0007000000023505-193.dat	upx
behavioral2/files/0x00070000000234fc-190.dat	upx
behavioral2/memory/4432-388-0x00007FF6A2CD0000-0x00007FF6A30C2000-memory.dmp	upx
behavioral2/memory/4036-472-0x00007FF781DF0000-0x00007FF7821E2000-memory.dmp	upx
behavioral2/memory/2956-512-0x00007FF6BADE0000-0x00007FF6BB1D2000-memory.dmp	upx
behavioral2/memory/3736-518-0x00007FF7C7D50000-0x00007FF7C8142000-memory.dmp	upx
behavioral2/memory/3028-524-0x00007FF6B3380000-0x00007FF6B3772000-memory.dmp	upx
behavioral2/memory/4528-2150-0x00007FF6BA930000-0x00007FF6BAD22000-memory.dmp	upx
behavioral2/memory/980-2233-0x00007FF7CDE70000-0x00007FF7CE262000-memory.dmp	upx
behavioral2/memory/1908-526-0x00007FF6C9670000-0x00007FF6C9A62000-memory.dmp	upx
behavioral2/memory/2044-525-0x00007FF7773E0000-0x00007FF7777D2000-memory.dmp	upx
behavioral2/memory/224-523-0x00007FF703420000-0x00007FF703812000-memory.dmp	upx
behavioral2/memory/2872-522-0x00007FF64BBD0000-0x00007FF64BFC2000-memory.dmp	upx
behavioral2/memory/1752-521-0x00007FF6357E0000-0x00007FF635BD2000-memory.dmp	upx
behavioral2/memory/4236-520-0x00007FF659B00000-0x00007FF659EF2000-memory.dmp	upx
behavioral2/memory/4684-519-0x00007FF62C290000-0x00007FF62C682000-memory.dmp	upx
behavioral2/memory/1744-517-0x00007FF77F5B0000-0x00007FF77F9A2000-memory.dmp	upx
behavioral2/memory/3184-516-0x00007FF757A60000-0x00007FF757E52000-memory.dmp	upx
behavioral2/memory/184-515-0x00007FF797B90000-0x00007FF797F82000-memory.dmp	upx
behavioral2/memory/2692-514-0x00007FF75B8D0000-0x00007FF75BCC2000-memory.dmp	upx
behavioral2/memory/4772-513-0x00007FF654610000-0x00007FF654A02000-memory.dmp	upx
behavioral2/memory/3492-511-0x00007FF6C0FA0000-0x00007FF6C1392000-memory.dmp	upx
behavioral2/memory/1028-508-0x00007FF7BE400000-0x00007FF7BE7F2000-memory.dmp	upx
behavioral2/memory/4028-387-0x00007FF6B9970000-0x00007FF6B9D62000-memory.dmp	upx
behavioral2/memory/4128-327-0x00007FF7DEE30000-0x00007FF7DF222000-memory.dmp	upx
behavioral2/files/0x00070000000234f4-171.dat	upx
behavioral2/files/0x0007000000023504-170.dat	upx
behavioral2/files/0x00070000000234fb-167.dat	upx
behavioral2/files/0x00070000000234fa-161.dat	upx
behavioral2/files/0x00070000000234f9-158.dat	upx
behavioral2/files/0x00070000000234f1-154.dat	upx
behavioral2/files/0x0007000000023501-152.dat	upx
behavioral2/files/0x0007000000023500-148.dat	upx
behavioral2/files/0x00070000000234f0-145.dat	upx
behavioral2/files/0x00070000000234ff-142.dat	upx
behavioral2/files/0x00070000000234fe-141.dat	upx
behavioral2/files/0x00080000000234df-198.dat	upx
behavioral2/files/0x00070000000234f3-184.dat	upx
behavioral2/files/0x00070000000234f2-129.dat	upx
behavioral2/files/0x0007000000023503-169.dat	upx
behavioral2/files/0x00070000000234ed-122.dat	upx
behavioral2/files/0x0007000000023502-153.dat	upx
behavioral2/files/0x00070000000234f8-120.dat	upx
behavioral2/files/0x00070000000234f7-112.dat	upx
behavioral2/files/0x00070000000234ec-103.dat	upx
behavioral2/files/0x00070000000234eb-91.dat	upx
behavioral2/files/0x00070000000234e9-88.dat	upx
behavioral2/files/0x00070000000234ee-67.dat	upx
behavioral2/files/0x00070000000234ea-84.dat	upx
behavioral2/files/0x00070000000234e8-48.dat	upx
behavioral2/files/0x00070000000234e7-41.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yNcKmml.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\pjmVwNW.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\mTJqKWg.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\BzNaQKk.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\LxpWcLy.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\APLpejW.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\bHgLrXt.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\tXHKErO.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\YAefmWN.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\hBKqCTD.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\tCXswcb.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\KjHsSHA.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\whcwPAj.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\rXtfNsV.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\feCWjAF.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\ltKdiTx.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\NSBfWME.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\PZByCrE.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\EfJBYNd.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\OyPtgAr.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\qUGdWSa.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\pejrfxl.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\EDUnSuX.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\rOBaTBu.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\KiakPLK.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\UxGwzhq.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\uraPHaF.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\ragKSON.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\fSuWvoE.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\yLjUGeu.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\CNdglGw.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\IcvBBPQ.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\fOqWJFg.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\JOuFBtl.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\MzmyiBQ.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\TrlwdOh.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\SZcWRuU.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\fBftIQk.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\GBwoetZ.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\HjxRtbs.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\znZUKia.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\yPSmKKS.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\qgXBmEa.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\QItaBWt.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\HBhfKek.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\kQhMMCH.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\VcRBkSq.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\GixAzCW.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\nFqxcNx.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\aWlNiXv.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\fscIwNG.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\pHZtaBU.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\BWpyonO.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\RKxIkWr.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\cQeHSNj.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\WJVpeQI.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\BrhwWzd.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\BtvNvsp.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\NUvXJVq.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\kQYSqeg.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\FrdyKWU.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\iAgAdCi.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\CgQROeA.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\lDmjkRB.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeLockMemoryPrivilege	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe
Token: SeLockMemoryPrivilege	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 2568	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	84
PID 4528 wrote to memory of 2568	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	84
PID 4528 wrote to memory of 980	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	85
PID 4528 wrote to memory of 980	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	85
PID 4528 wrote to memory of 4072	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	86
PID 4528 wrote to memory of 4072	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	86
PID 4528 wrote to memory of 3544	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	87
PID 4528 wrote to memory of 3544	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	87
PID 4528 wrote to memory of 2044	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	88
PID 4528 wrote to memory of 2044	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	88
PID 4528 wrote to memory of 4128	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	89
PID 4528 wrote to memory of 4128	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	89
PID 4528 wrote to memory of 4028	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	90
PID 4528 wrote to memory of 4028	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	90
PID 4528 wrote to memory of 4432	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	91
PID 4528 wrote to memory of 4432	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	91
PID 4528 wrote to memory of 4036	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	92
PID 4528 wrote to memory of 4036	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	92
PID 4528 wrote to memory of 1028	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	93
PID 4528 wrote to memory of 1028	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	93
PID 4528 wrote to memory of 3492	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	94
PID 4528 wrote to memory of 3492	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	94
PID 4528 wrote to memory of 4772	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	95
PID 4528 wrote to memory of 4772	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	95
PID 4528 wrote to memory of 2956	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	96
PID 4528 wrote to memory of 2956	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	96
PID 4528 wrote to memory of 2692	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	97
PID 4528 wrote to memory of 2692	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	97
PID 4528 wrote to memory of 184	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	98
PID 4528 wrote to memory of 184	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	98
PID 4528 wrote to memory of 3184	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	99
PID 4528 wrote to memory of 3184	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	99
PID 4528 wrote to memory of 1744	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	100
PID 4528 wrote to memory of 1744	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	100
PID 4528 wrote to memory of 1908	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	101
PID 4528 wrote to memory of 1908	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	101
PID 4528 wrote to memory of 3736	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	102
PID 4528 wrote to memory of 3736	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	102
PID 4528 wrote to memory of 2400	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	103
PID 4528 wrote to memory of 2400	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	103
PID 4528 wrote to memory of 4684	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	104
PID 4528 wrote to memory of 4684	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	104
PID 4528 wrote to memory of 4236	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	105
PID 4528 wrote to memory of 4236	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	105
PID 4528 wrote to memory of 1752	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	106
PID 4528 wrote to memory of 1752	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	106
PID 4528 wrote to memory of 2872	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	107
PID 4528 wrote to memory of 2872	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	107
PID 4528 wrote to memory of 224	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	108
PID 4528 wrote to memory of 224	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	108
PID 4528 wrote to memory of 3028	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	109
PID 4528 wrote to memory of 3028	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	109
PID 4528 wrote to memory of 4060	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	110
PID 4528 wrote to memory of 4060	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	110
PID 4528 wrote to memory of 440	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	111
PID 4528 wrote to memory of 440	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	111
PID 4528 wrote to memory of 4652	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	112
PID 4528 wrote to memory of 4652	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	112
PID 4528 wrote to memory of 3020	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	113
PID 4528 wrote to memory of 3020	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	113
PID 4528 wrote to memory of 1892	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	114
PID 4528 wrote to memory of 1892	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	114
PID 4528 wrote to memory of 2424	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	115
PID 4528 wrote to memory of 2424	4528	f532f79a96c14af4d39c1dd6c7398bd0N.exe	115

C:\Users\Admin\AppData\Local\Temp\f532f79a96c14af4d39c1dd6c7398bd0N.exe
"C:\Users\Admin\AppData\Local\Temp\f532f79a96c14af4d39c1dd6c7398bd0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Windows\System\GjFXhuX.exe
  C:\Windows\System\GjFXhuX.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\MYajkqb.exe
  C:\Windows\System\MYajkqb.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\EuxRCmV.exe
  C:\Windows\System\EuxRCmV.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\fHgCaIA.exe
  C:\Windows\System\fHgCaIA.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\qHCLOXA.exe
  C:\Windows\System\qHCLOXA.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\bsOlBNM.exe
  C:\Windows\System\bsOlBNM.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\cRtWVRd.exe
  C:\Windows\System\cRtWVRd.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\otUfpSu.exe
  C:\Windows\System\otUfpSu.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\SveWdAh.exe
  C:\Windows\System\SveWdAh.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\lsQqRKy.exe
  C:\Windows\System\lsQqRKy.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\jgUyGde.exe
  C:\Windows\System\jgUyGde.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\fAUamVi.exe
  C:\Windows\System\fAUamVi.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\qKaOzSs.exe
  C:\Windows\System\qKaOzSs.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\AOisHHJ.exe
  C:\Windows\System\AOisHHJ.exe
  2⤵
  - Executes dropped EXE
  PID:184
- C:\Windows\System\gQvRskQ.exe
  C:\Windows\System\gQvRskQ.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\YvnXDJz.exe
  C:\Windows\System\YvnXDJz.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\jLuDXiA.exe
  C:\Windows\System\jLuDXiA.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\UkhVBxK.exe
  C:\Windows\System\UkhVBxK.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\qaMRjZc.exe
  C:\Windows\System\qaMRjZc.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\LOrAztR.exe
  C:\Windows\System\LOrAztR.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\JkmejFP.exe
  C:\Windows\System\JkmejFP.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\DRGFofH.exe
  C:\Windows\System\DRGFofH.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\JZHKCeb.exe
  C:\Windows\System\JZHKCeb.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\NemBIrR.exe
  C:\Windows\System\NemBIrR.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\kMnjPGt.exe
  C:\Windows\System\kMnjPGt.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\uOJWztv.exe
  C:\Windows\System\uOJWztv.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\qZOnnDa.exe
  C:\Windows\System\qZOnnDa.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\WEmmVOi.exe
  C:\Windows\System\WEmmVOi.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\vKChRpo.exe
  C:\Windows\System\vKChRpo.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\ShlbDzi.exe
  C:\Windows\System\ShlbDzi.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\zXrbzQe.exe
  C:\Windows\System\zXrbzQe.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\ONtLqWq.exe
  C:\Windows\System\ONtLqWq.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\uSRGYhB.exe
  C:\Windows\System\uSRGYhB.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\ZbRrGZC.exe
  C:\Windows\System\ZbRrGZC.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\AsBRvmv.exe
  C:\Windows\System\AsBRvmv.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\NKWxsDl.exe
  C:\Windows\System\NKWxsDl.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\hvnYhEc.exe
  C:\Windows\System\hvnYhEc.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\YAefmWN.exe
  C:\Windows\System\YAefmWN.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\tRQptiO.exe
  C:\Windows\System\tRQptiO.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\wqlHFTh.exe
  C:\Windows\System\wqlHFTh.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\jzmAoBl.exe
  C:\Windows\System\jzmAoBl.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\rlASVKW.exe
  C:\Windows\System\rlASVKW.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\EjQVWQT.exe
  C:\Windows\System\EjQVWQT.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\WSNzdYW.exe
  C:\Windows\System\WSNzdYW.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\uPOkwax.exe
  C:\Windows\System\uPOkwax.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\mhCmbEr.exe
  C:\Windows\System\mhCmbEr.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\grAlqdw.exe
  C:\Windows\System\grAlqdw.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\GixAzCW.exe
  C:\Windows\System\GixAzCW.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\petULoX.exe
  C:\Windows\System\petULoX.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\nnlHUSg.exe
  C:\Windows\System\nnlHUSg.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\cCJMVTM.exe
  C:\Windows\System\cCJMVTM.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\VzYWkRv.exe
  C:\Windows\System\VzYWkRv.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\hirHLNE.exe
  C:\Windows\System\hirHLNE.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\mzJNSzl.exe
  C:\Windows\System\mzJNSzl.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\ZyZmAZc.exe
  C:\Windows\System\ZyZmAZc.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\iAgAdCi.exe
  C:\Windows\System\iAgAdCi.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\KxJPqbv.exe
  C:\Windows\System\KxJPqbv.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\sHclXgz.exe
  C:\Windows\System\sHclXgz.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\LAxymln.exe
  C:\Windows\System\LAxymln.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\iMIngVq.exe
  C:\Windows\System\iMIngVq.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\AzCdioK.exe
  C:\Windows\System\AzCdioK.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\CgQROeA.exe
  C:\Windows\System\CgQROeA.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\SUvhrCW.exe
  C:\Windows\System\SUvhrCW.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\xRWYPeW.exe
  C:\Windows\System\xRWYPeW.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\QknfPkt.exe
  C:\Windows\System\QknfPkt.exe
  2⤵
  PID:724
- C:\Windows\System\inONTkn.exe
  C:\Windows\System\inONTkn.exe
  2⤵
  PID:4952
- C:\Windows\System\vkfCCDd.exe
  C:\Windows\System\vkfCCDd.exe
  2⤵
  PID:4136
- C:\Windows\System\hBKqCTD.exe
  C:\Windows\System\hBKqCTD.exe
  2⤵
  PID:436
- C:\Windows\System\Ujuzqts.exe
  C:\Windows\System\Ujuzqts.exe
  2⤵
  PID:5076
- C:\Windows\System\PZByCrE.exe
  C:\Windows\System\PZByCrE.exe
  2⤵
  PID:4844
- C:\Windows\System\XFZRbXL.exe
  C:\Windows\System\XFZRbXL.exe
  2⤵
  PID:3592
- C:\Windows\System\RqOHpfz.exe
  C:\Windows\System\RqOHpfz.exe
  2⤵
  PID:2380
- C:\Windows\System\jnrMRUQ.exe
  C:\Windows\System\jnrMRUQ.exe
  2⤵
  PID:3672
- C:\Windows\System\ZcrVSsD.exe
  C:\Windows\System\ZcrVSsD.exe
  2⤵
  PID:3284
- C:\Windows\System\QFZWDvj.exe
  C:\Windows\System\QFZWDvj.exe
  2⤵
  PID:1220
- C:\Windows\System\WbMFfDk.exe
  C:\Windows\System\WbMFfDk.exe
  2⤵
  PID:3704
- C:\Windows\System\xYwdvbv.exe
  C:\Windows\System\xYwdvbv.exe
  2⤵
  PID:3108
- C:\Windows\System\ZJmKBSo.exe
  C:\Windows\System\ZJmKBSo.exe
  2⤵
  PID:2288
- C:\Windows\System\IJnNHlX.exe
  C:\Windows\System\IJnNHlX.exe
  2⤵
  PID:3708
- C:\Windows\System\pCaoWle.exe
  C:\Windows\System\pCaoWle.exe
  2⤵
  PID:4588
- C:\Windows\System\bINFtZC.exe
  C:\Windows\System\bINFtZC.exe
  2⤵
  PID:1012
- C:\Windows\System\PcIpsKg.exe
  C:\Windows\System\PcIpsKg.exe
  2⤵
  PID:5132
- C:\Windows\System\kIHfchY.exe
  C:\Windows\System\kIHfchY.exe
  2⤵
  PID:5156
- C:\Windows\System\lrvQiLh.exe
  C:\Windows\System\lrvQiLh.exe
  2⤵
  PID:5176
- C:\Windows\System\bdvIOMT.exe
  C:\Windows\System\bdvIOMT.exe
  2⤵
  PID:5204
- C:\Windows\System\QuasVDu.exe
  C:\Windows\System\QuasVDu.exe
  2⤵
  PID:5224
- C:\Windows\System\MDQtrTk.exe
  C:\Windows\System\MDQtrTk.exe
  2⤵
  PID:5248
- C:\Windows\System\PezAbeD.exe
  C:\Windows\System\PezAbeD.exe
  2⤵
  PID:5272
- C:\Windows\System\QWxQAUL.exe
  C:\Windows\System\QWxQAUL.exe
  2⤵
  PID:5288
- C:\Windows\System\AdhRtqW.exe
  C:\Windows\System\AdhRtqW.exe
  2⤵
  PID:5308
- C:\Windows\System\VsfzwUZ.exe
  C:\Windows\System\VsfzwUZ.exe
  2⤵
  PID:5332
- C:\Windows\System\VNzZMiY.exe
  C:\Windows\System\VNzZMiY.exe
  2⤵
  PID:5348
- C:\Windows\System\DOiCINQ.exe
  C:\Windows\System\DOiCINQ.exe
  2⤵
  PID:5384
- C:\Windows\System\WCGwjtU.exe
  C:\Windows\System\WCGwjtU.exe
  2⤵
  PID:5408
- C:\Windows\System\GOfwDAQ.exe
  C:\Windows\System\GOfwDAQ.exe
  2⤵
  PID:5440
- C:\Windows\System\LxpWcLy.exe
  C:\Windows\System\LxpWcLy.exe
  2⤵
  PID:5456
- C:\Windows\System\zzqBZkY.exe
  C:\Windows\System\zzqBZkY.exe
  2⤵
  PID:5472
- C:\Windows\System\LrZErlH.exe
  C:\Windows\System\LrZErlH.exe
  2⤵
  PID:5496
- C:\Windows\System\mUjNbIs.exe
  C:\Windows\System\mUjNbIs.exe
  2⤵
  PID:5564
- C:\Windows\System\JNuEPHY.exe
  C:\Windows\System\JNuEPHY.exe
  2⤵
  PID:5596
- C:\Windows\System\hPtKsWL.exe
  C:\Windows\System\hPtKsWL.exe
  2⤵
  PID:5612
- C:\Windows\System\elojaea.exe
  C:\Windows\System\elojaea.exe
  2⤵
  PID:5636
- C:\Windows\System\xAkhxcx.exe
  C:\Windows\System\xAkhxcx.exe
  2⤵
  PID:5660
- C:\Windows\System\wVfDZSn.exe
  C:\Windows\System\wVfDZSn.exe
  2⤵
  PID:5680
- C:\Windows\System\hxPyuIt.exe
  C:\Windows\System\hxPyuIt.exe
  2⤵
  PID:5704
- C:\Windows\System\ZcRAhZt.exe
  C:\Windows\System\ZcRAhZt.exe
  2⤵
  PID:5724
- C:\Windows\System\WjDHlye.exe
  C:\Windows\System\WjDHlye.exe
  2⤵
  PID:5744
- C:\Windows\System\indMcZi.exe
  C:\Windows\System\indMcZi.exe
  2⤵
  PID:5764
- C:\Windows\System\sSfXdSZ.exe
  C:\Windows\System\sSfXdSZ.exe
  2⤵
  PID:5792
- C:\Windows\System\XiPcbmQ.exe
  C:\Windows\System\XiPcbmQ.exe
  2⤵
  PID:5808
- C:\Windows\System\PxDDpEv.exe
  C:\Windows\System\PxDDpEv.exe
  2⤵
  PID:5828
- C:\Windows\System\BIGMJTo.exe
  C:\Windows\System\BIGMJTo.exe
  2⤵
  PID:5856
- C:\Windows\System\gNTBBZR.exe
  C:\Windows\System\gNTBBZR.exe
  2⤵
  PID:5880
- C:\Windows\System\RdIDchi.exe
  C:\Windows\System\RdIDchi.exe
  2⤵
  PID:5920
- C:\Windows\System\BlQVfyZ.exe
  C:\Windows\System\BlQVfyZ.exe
  2⤵
  PID:5944
- C:\Windows\System\RIgmlMz.exe
  C:\Windows\System\RIgmlMz.exe
  2⤵
  PID:5964
- C:\Windows\System\pCaHkYP.exe
  C:\Windows\System\pCaHkYP.exe
  2⤵
  PID:5984
- C:\Windows\System\mooDTlk.exe
  C:\Windows\System\mooDTlk.exe
  2⤵
  PID:6004
- C:\Windows\System\ZmfGSqc.exe
  C:\Windows\System\ZmfGSqc.exe
  2⤵
  PID:6024
- C:\Windows\System\nNNKRDJ.exe
  C:\Windows\System\nNNKRDJ.exe
  2⤵
  PID:6040
- C:\Windows\System\iibJBRv.exe
  C:\Windows\System\iibJBRv.exe
  2⤵
  PID:6064
- C:\Windows\System\kpqeHRx.exe
  C:\Windows\System\kpqeHRx.exe
  2⤵
  PID:6132
- C:\Windows\System\PbYThlt.exe
  C:\Windows\System\PbYThlt.exe
  2⤵
  PID:3500
- C:\Windows\System\efiSkNi.exe
  C:\Windows\System\efiSkNi.exe
  2⤵
  PID:4736
- C:\Windows\System\DoOvqeE.exe
  C:\Windows\System\DoOvqeE.exe
  2⤵
  PID:2484
- C:\Windows\System\fXDXvzt.exe
  C:\Windows\System\fXDXvzt.exe
  2⤵
  PID:5096
- C:\Windows\System\fPXhevc.exe
  C:\Windows\System\fPXhevc.exe
  2⤵
  PID:4104
- C:\Windows\System\DUdtysx.exe
  C:\Windows\System\DUdtysx.exe
  2⤵
  PID:716
- C:\Windows\System\HhEgwsZ.exe
  C:\Windows\System\HhEgwsZ.exe
  2⤵
  PID:3476
- C:\Windows\System\XQyyQAY.exe
  C:\Windows\System\XQyyQAY.exe
  2⤵
  PID:3920
- C:\Windows\System\tRleSXT.exe
  C:\Windows\System\tRleSXT.exe
  2⤵
  PID:2456
- C:\Windows\System\zEaHYMK.exe
  C:\Windows\System\zEaHYMK.exe
  2⤵
  PID:3712
- C:\Windows\System\pWVfnfS.exe
  C:\Windows\System\pWVfnfS.exe
  2⤵
  PID:4296
- C:\Windows\System\DxmdOcd.exe
  C:\Windows\System\DxmdOcd.exe
  2⤵
  PID:5340
- C:\Windows\System\UiHWpAt.exe
  C:\Windows\System\UiHWpAt.exe
  2⤵
  PID:4904
- C:\Windows\System\FvUmGNq.exe
  C:\Windows\System\FvUmGNq.exe
  2⤵
  PID:1060
- C:\Windows\System\NcZHTWi.exe
  C:\Windows\System\NcZHTWi.exe
  2⤵
  PID:5468
- C:\Windows\System\FjfpEfd.exe
  C:\Windows\System\FjfpEfd.exe
  2⤵
  PID:4516
- C:\Windows\System\nFqxcNx.exe
  C:\Windows\System\nFqxcNx.exe
  2⤵
  PID:4524
- C:\Windows\System\PqBGwTm.exe
  C:\Windows\System\PqBGwTm.exe
  2⤵
  PID:4928
- C:\Windows\System\LhRjUOw.exe
  C:\Windows\System\LhRjUOw.exe
  2⤵
  PID:336
- C:\Windows\System\fUwBiUX.exe
  C:\Windows\System\fUwBiUX.exe
  2⤵
  PID:5672
- C:\Windows\System\yjtmBqC.exe
  C:\Windows\System\yjtmBqC.exe
  2⤵
  PID:5712
- C:\Windows\System\ZMJWraD.exe
  C:\Windows\System\ZMJWraD.exe
  2⤵
  PID:3228
- C:\Windows\System\kLCxCok.exe
  C:\Windows\System\kLCxCok.exe
  2⤵
  PID:2420
- C:\Windows\System\NnTVEzX.exe
  C:\Windows\System\NnTVEzX.exe
  2⤵
  PID:612
- C:\Windows\System\pZOsWGO.exe
  C:\Windows\System\pZOsWGO.exe
  2⤵
  PID:5416
- C:\Windows\System\LomiHgt.exe
  C:\Windows\System\LomiHgt.exe
  2⤵
  PID:640
- C:\Windows\System\UFhtFbp.exe
  C:\Windows\System\UFhtFbp.exe
  2⤵
  PID:4964
- C:\Windows\System\fcPxKNq.exe
  C:\Windows\System\fcPxKNq.exe
  2⤵
  PID:2040
- C:\Windows\System\UiHVTSa.exe
  C:\Windows\System\UiHVTSa.exe
  2⤵
  PID:5996
- C:\Windows\System\owoOAmA.exe
  C:\Windows\System\owoOAmA.exe
  2⤵
  PID:3448
- C:\Windows\System\JxxfVJl.exe
  C:\Windows\System\JxxfVJl.exe
  2⤵
  PID:5196
- C:\Windows\System\KWUYXdH.exe
  C:\Windows\System\KWUYXdH.exe
  2⤵
  PID:5296
- C:\Windows\System\ObsPGpG.exe
  C:\Windows\System\ObsPGpG.exe
  2⤵
  PID:6112
- C:\Windows\System\xKmqKqO.exe
  C:\Windows\System\xKmqKqO.exe
  2⤵
  PID:6164
- C:\Windows\System\lFWEhOq.exe
  C:\Windows\System\lFWEhOq.exe
  2⤵
  PID:6180
- C:\Windows\System\wfenuVn.exe
  C:\Windows\System\wfenuVn.exe
  2⤵
  PID:6208
- C:\Windows\System\dJeQpKG.exe
  C:\Windows\System\dJeQpKG.exe
  2⤵
  PID:6228
- C:\Windows\System\fLClmxf.exe
  C:\Windows\System\fLClmxf.exe
  2⤵
  PID:6264
- C:\Windows\System\ooRVGlr.exe
  C:\Windows\System\ooRVGlr.exe
  2⤵
  PID:6288
- C:\Windows\System\wxJFsfy.exe
  C:\Windows\System\wxJFsfy.exe
  2⤵
  PID:6308
- C:\Windows\System\UqxYIPj.exe
  C:\Windows\System\UqxYIPj.exe
  2⤵
  PID:6336
- C:\Windows\System\qfFEJCf.exe
  C:\Windows\System\qfFEJCf.exe
  2⤵
  PID:6356
- C:\Windows\System\MhzMIUs.exe
  C:\Windows\System\MhzMIUs.exe
  2⤵
  PID:6380
- C:\Windows\System\ZqAsSwq.exe
  C:\Windows\System\ZqAsSwq.exe
  2⤵
  PID:6552
- C:\Windows\System\WjzXYsF.exe
  C:\Windows\System\WjzXYsF.exe
  2⤵
  PID:6568
- C:\Windows\System\APRSXuv.exe
  C:\Windows\System\APRSXuv.exe
  2⤵
  PID:6584
- C:\Windows\System\zYzeWBK.exe
  C:\Windows\System\zYzeWBK.exe
  2⤵
  PID:6600
- C:\Windows\System\WyjISAL.exe
  C:\Windows\System\WyjISAL.exe
  2⤵
  PID:6616
- C:\Windows\System\zGKtlcs.exe
  C:\Windows\System\zGKtlcs.exe
  2⤵
  PID:6632
- C:\Windows\System\UscmuZG.exe
  C:\Windows\System\UscmuZG.exe
  2⤵
  PID:6648
- C:\Windows\System\VZlhDrT.exe
  C:\Windows\System\VZlhDrT.exe
  2⤵
  PID:6664
- C:\Windows\System\GnSAmnQ.exe
  C:\Windows\System\GnSAmnQ.exe
  2⤵
  PID:6680
- C:\Windows\System\XEIDGiO.exe
  C:\Windows\System\XEIDGiO.exe
  2⤵
  PID:6696
- C:\Windows\System\SVfWcEE.exe
  C:\Windows\System\SVfWcEE.exe
  2⤵
  PID:6712
- C:\Windows\System\YgroGZT.exe
  C:\Windows\System\YgroGZT.exe
  2⤵
  PID:6728
- C:\Windows\System\fZnDQlv.exe
  C:\Windows\System\fZnDQlv.exe
  2⤵
  PID:6744
- C:\Windows\System\GHrmxNk.exe
  C:\Windows\System\GHrmxNk.exe
  2⤵
  PID:6768
- C:\Windows\System\SyJenHg.exe
  C:\Windows\System\SyJenHg.exe
  2⤵
  PID:6852
- C:\Windows\System\nNKSewB.exe
  C:\Windows\System\nNKSewB.exe
  2⤵
  PID:6964
- C:\Windows\System\DbIiMZI.exe
  C:\Windows\System\DbIiMZI.exe
  2⤵
  PID:6984
- C:\Windows\System\tkEzctA.exe
  C:\Windows\System\tkEzctA.exe
  2⤵
  PID:7000
- C:\Windows\System\IwWIyVL.exe
  C:\Windows\System\IwWIyVL.exe
  2⤵
  PID:7016
- C:\Windows\System\YLYxXBM.exe
  C:\Windows\System\YLYxXBM.exe
  2⤵
  PID:7036
- C:\Windows\System\PunHkoB.exe
  C:\Windows\System\PunHkoB.exe
  2⤵
  PID:7072
- C:\Windows\System\eNjZhbx.exe
  C:\Windows\System\eNjZhbx.exe
  2⤵
  PID:7100
- C:\Windows\System\eDywkYG.exe
  C:\Windows\System\eDywkYG.exe
  2⤵
  PID:7128
- C:\Windows\System\FUjwQhP.exe
  C:\Windows\System\FUjwQhP.exe
  2⤵
  PID:7148
- C:\Windows\System\hqnzUXu.exe
  C:\Windows\System\hqnzUXu.exe
  2⤵
  PID:6124
- C:\Windows\System\NXobhqq.exe
  C:\Windows\System\NXobhqq.exe
  2⤵
  PID:4932
- C:\Windows\System\NNkagqN.exe
  C:\Windows\System\NNkagqN.exe
  2⤵
  PID:5280
- C:\Windows\System\DHarHPI.exe
  C:\Windows\System\DHarHPI.exe
  2⤵
  PID:5420
- C:\Windows\System\oYiGGDN.exe
  C:\Windows\System\oYiGGDN.exe
  2⤵
  PID:5516
- C:\Windows\System\OQAxUNM.exe
  C:\Windows\System\OQAxUNM.exe
  2⤵
  PID:5572
- C:\Windows\System\enMWeoO.exe
  C:\Windows\System\enMWeoO.exe
  2⤵
  PID:5628
- C:\Windows\System\JLdWiiG.exe
  C:\Windows\System\JLdWiiG.exe
  2⤵
  PID:5716
- C:\Windows\System\wfqBOYd.exe
  C:\Windows\System\wfqBOYd.exe
  2⤵
  PID:5772
- C:\Windows\System\ZbHQuEX.exe
  C:\Windows\System\ZbHQuEX.exe
  2⤵
  PID:5872
- C:\Windows\System\teTFhXf.exe
  C:\Windows\System\teTFhXf.exe
  2⤵
  PID:6048
- C:\Windows\System\olaApuc.exe
  C:\Windows\System\olaApuc.exe
  2⤵
  PID:1900
- C:\Windows\System\kcOHPfi.exe
  C:\Windows\System\kcOHPfi.exe
  2⤵
  PID:5240
- C:\Windows\System\GTfJfne.exe
  C:\Windows\System\GTfJfne.exe
  2⤵
  PID:884
- C:\Windows\System\BiRxjag.exe
  C:\Windows\System\BiRxjag.exe
  2⤵
  PID:2324
- C:\Windows\System\cdOJvhT.exe
  C:\Windows\System\cdOJvhT.exe
  2⤵
  PID:5840
- C:\Windows\System\XQkSHIl.exe
  C:\Windows\System\XQkSHIl.exe
  2⤵
  PID:5212
- C:\Windows\System\caRkiNh.exe
  C:\Windows\System\caRkiNh.exe
  2⤵
  PID:6364
- C:\Windows\System\cwoOMIq.exe
  C:\Windows\System\cwoOMIq.exe
  2⤵
  PID:1760
- C:\Windows\System\TiNujYa.exe
  C:\Windows\System\TiNujYa.exe
  2⤵
  PID:4332
- C:\Windows\System\TZjNlFN.exe
  C:\Windows\System\TZjNlFN.exe
  2⤵
  PID:1684
- C:\Windows\System\dEdstbG.exe
  C:\Windows\System\dEdstbG.exe
  2⤵
  PID:5452
- C:\Windows\System\HbGyUUm.exe
  C:\Windows\System\HbGyUUm.exe
  2⤵
  PID:4416
- C:\Windows\System\EbafWfS.exe
  C:\Windows\System\EbafWfS.exe
  2⤵
  PID:5188
- C:\Windows\System\uXPvyHV.exe
  C:\Windows\System\uXPvyHV.exe
  2⤵
  PID:6152
- C:\Windows\System\BeNLxYU.exe
  C:\Windows\System\BeNLxYU.exe
  2⤵
  PID:6220
- C:\Windows\System\kJNMiuW.exe
  C:\Windows\System\kJNMiuW.exe
  2⤵
  PID:6272
- C:\Windows\System\LQXvlcU.exe
  C:\Windows\System\LQXvlcU.exe
  2⤵
  PID:6316
- C:\Windows\System\GiYTfvi.exe
  C:\Windows\System\GiYTfvi.exe
  2⤵
  PID:6368
- C:\Windows\System\asdmVvl.exe
  C:\Windows\System\asdmVvl.exe
  2⤵
  PID:7180
- C:\Windows\System\iMHwDHM.exe
  C:\Windows\System\iMHwDHM.exe
  2⤵
  PID:7196
- C:\Windows\System\TyXonDT.exe
  C:\Windows\System\TyXonDT.exe
  2⤵
  PID:7212
- C:\Windows\System\qtEDdAq.exe
  C:\Windows\System\qtEDdAq.exe
  2⤵
  PID:7232
- C:\Windows\System\qJKArDR.exe
  C:\Windows\System\qJKArDR.exe
  2⤵
  PID:7252
- C:\Windows\System\OMPsqUb.exe
  C:\Windows\System\OMPsqUb.exe
  2⤵
  PID:7268
- C:\Windows\System\DTDXBKS.exe
  C:\Windows\System\DTDXBKS.exe
  2⤵
  PID:7288
- C:\Windows\System\IGJhmZb.exe
  C:\Windows\System\IGJhmZb.exe
  2⤵
  PID:7308
- C:\Windows\System\oXogafp.exe
  C:\Windows\System\oXogafp.exe
  2⤵
  PID:7328
- C:\Windows\System\UDfSTzX.exe
  C:\Windows\System\UDfSTzX.exe
  2⤵
  PID:7348
- C:\Windows\System\xioJVPT.exe
  C:\Windows\System\xioJVPT.exe
  2⤵
  PID:7368
- C:\Windows\System\NcqvRlP.exe
  C:\Windows\System\NcqvRlP.exe
  2⤵
  PID:7388
- C:\Windows\System\lvcqPLZ.exe
  C:\Windows\System\lvcqPLZ.exe
  2⤵
  PID:7404
- C:\Windows\System\vckRqHW.exe
  C:\Windows\System\vckRqHW.exe
  2⤵
  PID:7424
- C:\Windows\System\bwRgKNu.exe
  C:\Windows\System\bwRgKNu.exe
  2⤵
  PID:7448
- C:\Windows\System\OztRIAi.exe
  C:\Windows\System\OztRIAi.exe
  2⤵
  PID:7472
- C:\Windows\System\XgpmqfT.exe
  C:\Windows\System\XgpmqfT.exe
  2⤵
  PID:7636
- C:\Windows\System\irAhfIK.exe
  C:\Windows\System\irAhfIK.exe
  2⤵
  PID:7652
- C:\Windows\System\qyyPCAz.exe
  C:\Windows\System\qyyPCAz.exe
  2⤵
  PID:7672
- C:\Windows\System\mJPGcXp.exe
  C:\Windows\System\mJPGcXp.exe
  2⤵
  PID:7696
- C:\Windows\System\YXnArvR.exe
  C:\Windows\System\YXnArvR.exe
  2⤵
  PID:7716
- C:\Windows\System\TssZjGe.exe
  C:\Windows\System\TssZjGe.exe
  2⤵
  PID:7736
- C:\Windows\System\BrhwWzd.exe
  C:\Windows\System\BrhwWzd.exe
  2⤵
  PID:7756
- C:\Windows\System\YnrmKhB.exe
  C:\Windows\System\YnrmKhB.exe
  2⤵
  PID:7788
- C:\Windows\System\pbvmJtu.exe
  C:\Windows\System\pbvmJtu.exe
  2⤵
  PID:7832
- C:\Windows\System\QplpPMw.exe
  C:\Windows\System\QplpPMw.exe
  2⤵
  PID:7852
- C:\Windows\System\NLmmOsE.exe
  C:\Windows\System\NLmmOsE.exe
  2⤵
  PID:7884
- C:\Windows\System\Bmzkbbv.exe
  C:\Windows\System\Bmzkbbv.exe
  2⤵
  PID:7912
- C:\Windows\System\XqyuAWw.exe
  C:\Windows\System\XqyuAWw.exe
  2⤵
  PID:7952
- C:\Windows\System\oCXuwMO.exe
  C:\Windows\System\oCXuwMO.exe
  2⤵
  PID:7988
- C:\Windows\System\XNsWpPN.exe
  C:\Windows\System\XNsWpPN.exe
  2⤵
  PID:8008
- C:\Windows\System\NBBIqbf.exe
  C:\Windows\System\NBBIqbf.exe
  2⤵
  PID:8028
- C:\Windows\System\QVOmjZT.exe
  C:\Windows\System\QVOmjZT.exe
  2⤵
  PID:8060
- C:\Windows\System\UrAOLpK.exe
  C:\Windows\System\UrAOLpK.exe
  2⤵
  PID:8076
- C:\Windows\System\SvPBaJt.exe
  C:\Windows\System\SvPBaJt.exe
  2⤵
  PID:8096
- C:\Windows\System\ceassVj.exe
  C:\Windows\System\ceassVj.exe
  2⤵
  PID:8116
- C:\Windows\System\gLMXqEJ.exe
  C:\Windows\System\gLMXqEJ.exe
  2⤵
  PID:8140
- C:\Windows\System\tiXSaJA.exe
  C:\Windows\System\tiXSaJA.exe
  2⤵
  PID:8160
- C:\Windows\System\VqvoCVX.exe
  C:\Windows\System\VqvoCVX.exe
  2⤵
  PID:8176
- C:\Windows\System\caLGFIb.exe
  C:\Windows\System\caLGFIb.exe
  2⤵
  PID:6956
- C:\Windows\System\qmCcnmj.exe
  C:\Windows\System\qmCcnmj.exe
  2⤵
  PID:7160
- C:\Windows\System\bHgLrXt.exe
  C:\Windows\System\bHgLrXt.exe
  2⤵
  PID:5524
- C:\Windows\System\gsFZqpM.exe
  C:\Windows\System\gsFZqpM.exe
  2⤵
  PID:896
- C:\Windows\System\nRHWIey.exe
  C:\Windows\System\nRHWIey.exe
  2⤵
  PID:5952
- C:\Windows\System\keZoqSd.exe
  C:\Windows\System\keZoqSd.exe
  2⤵
  PID:3660
- C:\Windows\System\jkZAwCe.exe
  C:\Windows\System\jkZAwCe.exe
  2⤵
  PID:3116
- C:\Windows\System\EDUnSuX.exe
  C:\Windows\System\EDUnSuX.exe
  2⤵
  PID:6020
- C:\Windows\System\aAmSsbw.exe
  C:\Windows\System\aAmSsbw.exe
  2⤵
  PID:7176
- C:\Windows\System\klUoPTI.exe
  C:\Windows\System\klUoPTI.exe
  2⤵
  PID:8248
- C:\Windows\System\IzeBeoe.exe
  C:\Windows\System\IzeBeoe.exe
  2⤵
  PID:8264
- C:\Windows\System\ojsLmNM.exe
  C:\Windows\System\ojsLmNM.exe
  2⤵
  PID:8280
- C:\Windows\System\LoLhybU.exe
  C:\Windows\System\LoLhybU.exe
  2⤵
  PID:8296
- C:\Windows\System\YGPMWrl.exe
  C:\Windows\System\YGPMWrl.exe
  2⤵
  PID:8312
- C:\Windows\System\WXjXGCf.exe
  C:\Windows\System\WXjXGCf.exe
  2⤵
  PID:8328
- C:\Windows\System\CiaVnUh.exe
  C:\Windows\System\CiaVnUh.exe
  2⤵
  PID:8344
- C:\Windows\System\TleMcIA.exe
  C:\Windows\System\TleMcIA.exe
  2⤵
  PID:8364
- C:\Windows\System\zxNgBhs.exe
  C:\Windows\System\zxNgBhs.exe
  2⤵
  PID:8384
- C:\Windows\System\AmhrbGa.exe
  C:\Windows\System\AmhrbGa.exe
  2⤵
  PID:8408
- C:\Windows\System\rQQPUPB.exe
  C:\Windows\System\rQQPUPB.exe
  2⤵
  PID:8432
- C:\Windows\System\byhPeTZ.exe
  C:\Windows\System\byhPeTZ.exe
  2⤵
  PID:8456
- C:\Windows\System\rOBaTBu.exe
  C:\Windows\System\rOBaTBu.exe
  2⤵
  PID:8476
- C:\Windows\System\YoXChDT.exe
  C:\Windows\System\YoXChDT.exe
  2⤵
  PID:8492
- C:\Windows\System\vdfJXSO.exe
  C:\Windows\System\vdfJXSO.exe
  2⤵
  PID:8520
- C:\Windows\System\SloJzvH.exe
  C:\Windows\System\SloJzvH.exe
  2⤵
  PID:8544
- C:\Windows\System\yUutdRu.exe
  C:\Windows\System\yUutdRu.exe
  2⤵
  PID:8564
- C:\Windows\System\ATWPzYf.exe
  C:\Windows\System\ATWPzYf.exe
  2⤵
  PID:8588
- C:\Windows\System\UmYtelS.exe
  C:\Windows\System\UmYtelS.exe
  2⤵
  PID:8620
- C:\Windows\System\WvnRaSd.exe
  C:\Windows\System\WvnRaSd.exe
  2⤵
  PID:8636
- C:\Windows\System\suBrUKf.exe
  C:\Windows\System\suBrUKf.exe
  2⤵
  PID:8652
- C:\Windows\System\IbMKTHB.exe
  C:\Windows\System\IbMKTHB.exe
  2⤵
  PID:8668
- C:\Windows\System\zpnSMVS.exe
  C:\Windows\System\zpnSMVS.exe
  2⤵
  PID:8688
- C:\Windows\System\zOqVWQX.exe
  C:\Windows\System\zOqVWQX.exe
  2⤵
  PID:8712
- C:\Windows\System\QOqLGDt.exe
  C:\Windows\System\QOqLGDt.exe
  2⤵
  PID:8796
- C:\Windows\System\rziyDrK.exe
  C:\Windows\System\rziyDrK.exe
  2⤵
  PID:8820
- C:\Windows\System\OxqGTzU.exe
  C:\Windows\System\OxqGTzU.exe
  2⤵
  PID:8844
- C:\Windows\System\uabrTcj.exe
  C:\Windows\System\uabrTcj.exe
  2⤵
  PID:8868
- C:\Windows\System\oPkjkAN.exe
  C:\Windows\System\oPkjkAN.exe
  2⤵
  PID:8884
- C:\Windows\System\hfGXXAW.exe
  C:\Windows\System\hfGXXAW.exe
  2⤵
  PID:8900
- C:\Windows\System\sQQXEMH.exe
  C:\Windows\System\sQQXEMH.exe
  2⤵
  PID:8916
- C:\Windows\System\CeCJfNo.exe
  C:\Windows\System\CeCJfNo.exe
  2⤵
  PID:8936
- C:\Windows\System\nNszwat.exe
  C:\Windows\System\nNszwat.exe
  2⤵
  PID:8956
- C:\Windows\System\yqDKbVL.exe
  C:\Windows\System\yqDKbVL.exe
  2⤵
  PID:8976
- C:\Windows\System\BJgcWDV.exe
  C:\Windows\System\BJgcWDV.exe
  2⤵
  PID:9000
- C:\Windows\System\ncvKhJS.exe
  C:\Windows\System\ncvKhJS.exe
  2⤵
  PID:9024
- C:\Windows\System\jDAffKQ.exe
  C:\Windows\System\jDAffKQ.exe
  2⤵
  PID:9044
- C:\Windows\System\LbhjcwS.exe
  C:\Windows\System\LbhjcwS.exe
  2⤵
  PID:9064
- C:\Windows\System\HjxRtbs.exe
  C:\Windows\System\HjxRtbs.exe
  2⤵
  PID:9088
- C:\Windows\System\URWRtuK.exe
  C:\Windows\System\URWRtuK.exe
  2⤵
  PID:9112
- C:\Windows\System\wGGmZVJ.exe
  C:\Windows\System\wGGmZVJ.exe
  2⤵
  PID:9136
- C:\Windows\System\PgzZCTt.exe
  C:\Windows\System\PgzZCTt.exe
  2⤵
  PID:9152
- C:\Windows\System\uDiYStG.exe
  C:\Windows\System\uDiYStG.exe
  2⤵
  PID:9176
- C:\Windows\System\FREPqJb.exe
  C:\Windows\System\FREPqJb.exe
  2⤵
  PID:9200
- C:\Windows\System\poPebuk.exe
  C:\Windows\System\poPebuk.exe
  2⤵
  PID:5936
- C:\Windows\System\zzIboLI.exe
  C:\Windows\System\zzIboLI.exe
  2⤵
  PID:6564
- C:\Windows\System\PrVQNtV.exe
  C:\Windows\System\PrVQNtV.exe
  2⤵
  PID:6608
- C:\Windows\System\WbLQWTb.exe
  C:\Windows\System\WbLQWTb.exe
  2⤵
  PID:6656
- C:\Windows\System\tMdTuAH.exe
  C:\Windows\System\tMdTuAH.exe
  2⤵
  PID:6704
- C:\Windows\System\TQJrNQK.exe
  C:\Windows\System\TQJrNQK.exe
  2⤵
  PID:6740
- C:\Windows\System\bYgBJpN.exe
  C:\Windows\System\bYgBJpN.exe
  2⤵
  PID:6924
- C:\Windows\System\sXfTPOE.exe
  C:\Windows\System\sXfTPOE.exe
  2⤵
  PID:6952
- C:\Windows\System\ZgCUXpn.exe
  C:\Windows\System\ZgCUXpn.exe
  2⤵
  PID:7008
- C:\Windows\System\NwOmVBh.exe
  C:\Windows\System\NwOmVBh.exe
  2⤵
  PID:7056
- C:\Windows\System\fJGiMRz.exe
  C:\Windows\System\fJGiMRz.exe
  2⤵
  PID:7116
- C:\Windows\System\jPPGpJv.exe
  C:\Windows\System\jPPGpJv.exe
  2⤵
  PID:1924
- C:\Windows\System\OrJDXxk.exe
  C:\Windows\System\OrJDXxk.exe
  2⤵
  PID:5464
- C:\Windows\System\lfTqjAB.exe
  C:\Windows\System\lfTqjAB.exe
  2⤵
  PID:4624
- C:\Windows\System\rCZvPZA.exe
  C:\Windows\System\rCZvPZA.exe
  2⤵
  PID:6120
- C:\Windows\System\aIuKNrH.exe
  C:\Windows\System\aIuKNrH.exe
  2⤵
  PID:5836
- C:\Windows\System\okNOBnn.exe
  C:\Windows\System\okNOBnn.exe
  2⤵
  PID:5960
- C:\Windows\System\JYbuBps.exe
  C:\Windows\System\JYbuBps.exe
  2⤵
  PID:4788
- C:\Windows\System\tqpjHEu.exe
  C:\Windows\System\tqpjHEu.exe
  2⤵
  PID:5220
- C:\Windows\System\PCeYNMJ.exe
  C:\Windows\System\PCeYNMJ.exe
  2⤵
  PID:6300
- C:\Windows\System\RAtSDLZ.exe
  C:\Windows\System\RAtSDLZ.exe
  2⤵
  PID:7224
- C:\Windows\System\UgCbfxR.exe
  C:\Windows\System\UgCbfxR.exe
  2⤵
  PID:7284
- C:\Windows\System\DgeEDNj.exe
  C:\Windows\System\DgeEDNj.exe
  2⤵
  PID:7340
- C:\Windows\System\hlbttxf.exe
  C:\Windows\System\hlbttxf.exe
  2⤵
  PID:7380
- C:\Windows\System\JCnOVrU.exe
  C:\Windows\System\JCnOVrU.exe
  2⤵
  PID:7396
- C:\Windows\System\cQeHSNj.exe
  C:\Windows\System\cQeHSNj.exe
  2⤵
  PID:8352
- C:\Windows\System\nOSlqGX.exe
  C:\Windows\System\nOSlqGX.exe
  2⤵
  PID:8512
- C:\Windows\System\PfOTPvu.exe
  C:\Windows\System\PfOTPvu.exe
  2⤵
  PID:8596
- C:\Windows\System\KOYwmwM.exe
  C:\Windows\System\KOYwmwM.exe
  2⤵
  PID:9236
- C:\Windows\System\KNOGSXn.exe
  C:\Windows\System\KNOGSXn.exe
  2⤵
  PID:9328
- C:\Windows\System\hIaInBF.exe
  C:\Windows\System\hIaInBF.exe
  2⤵
  PID:9352
- C:\Windows\System\xOABYdJ.exe
  C:\Windows\System\xOABYdJ.exe
  2⤵
  PID:9376
- C:\Windows\System\yfiMMpc.exe
  C:\Windows\System\yfiMMpc.exe
  2⤵
  PID:9392
- C:\Windows\System\CuQzdZG.exe
  C:\Windows\System\CuQzdZG.exe
  2⤵
  PID:9408
- C:\Windows\System\zhpkJfp.exe
  C:\Windows\System\zhpkJfp.exe
  2⤵
  PID:9424
- C:\Windows\System\BmDzFDj.exe
  C:\Windows\System\BmDzFDj.exe
  2⤵
  PID:9456
- C:\Windows\System\hCPfGMW.exe
  C:\Windows\System\hCPfGMW.exe
  2⤵
  PID:9480
- C:\Windows\System\oaYpHPZ.exe
  C:\Windows\System\oaYpHPZ.exe
  2⤵
  PID:9500
- C:\Windows\System\EZEZycj.exe
  C:\Windows\System\EZEZycj.exe
  2⤵
  PID:9524
- C:\Windows\System\jHlBKac.exe
  C:\Windows\System\jHlBKac.exe
  2⤵
  PID:9544
- C:\Windows\System\vHGrtYl.exe
  C:\Windows\System\vHGrtYl.exe
  2⤵
  PID:9568
- C:\Windows\System\xtVIpDl.exe
  C:\Windows\System\xtVIpDl.exe
  2⤵
  PID:9588
- C:\Windows\System\khFDVnV.exe
  C:\Windows\System\khFDVnV.exe
  2⤵
  PID:9608
- C:\Windows\System\eQftLPY.exe
  C:\Windows\System\eQftLPY.exe
  2⤵
  PID:9636
- C:\Windows\System\fYpmWkD.exe
  C:\Windows\System\fYpmWkD.exe
  2⤵
  PID:9660
- C:\Windows\System\nobnrOu.exe
  C:\Windows\System\nobnrOu.exe
  2⤵
  PID:9684
- C:\Windows\System\OjwencU.exe
  C:\Windows\System\OjwencU.exe
  2⤵
  PID:9704
- C:\Windows\System\cFFxQrA.exe
  C:\Windows\System\cFFxQrA.exe
  2⤵
  PID:9732
- C:\Windows\System\YEVKJEp.exe
  C:\Windows\System\YEVKJEp.exe
  2⤵
  PID:9748
- C:\Windows\System\rQwpcVw.exe
  C:\Windows\System\rQwpcVw.exe
  2⤵
  PID:9772
- C:\Windows\System\dxmIChk.exe
  C:\Windows\System\dxmIChk.exe
  2⤵
  PID:9792
- C:\Windows\System\EgAlvCk.exe
  C:\Windows\System\EgAlvCk.exe
  2⤵
  PID:9816
- C:\Windows\System\hYDXEjh.exe
  C:\Windows\System\hYDXEjh.exe
  2⤵
  PID:9840
- C:\Windows\System\etURKsj.exe
  C:\Windows\System\etURKsj.exe
  2⤵
  PID:9860
- C:\Windows\System\ITuBbhW.exe
  C:\Windows\System\ITuBbhW.exe
  2⤵
  PID:9884
- C:\Windows\System\VMALlyr.exe
  C:\Windows\System\VMALlyr.exe
  2⤵
  PID:10036
- C:\Windows\System\KjHsSHA.exe
  C:\Windows\System\KjHsSHA.exe
  2⤵
  PID:10064
- C:\Windows\System\hfWhXDB.exe
  C:\Windows\System\hfWhXDB.exe
  2⤵
  PID:10084
- C:\Windows\System\aEbFoXe.exe
  C:\Windows\System\aEbFoXe.exe
  2⤵
  PID:10108
- C:\Windows\System\nNiQlvl.exe
  C:\Windows\System\nNiQlvl.exe
  2⤵
  PID:10128
- C:\Windows\System\NsWqLKa.exe
  C:\Windows\System\NsWqLKa.exe
  2⤵
  PID:10148
- C:\Windows\System\kQLLEeF.exe
  C:\Windows\System\kQLLEeF.exe
  2⤵
  PID:10176
- C:\Windows\System\SCayMHG.exe
  C:\Windows\System\SCayMHG.exe
  2⤵
  PID:10192
- C:\Windows\System\tlrfYYD.exe
  C:\Windows\System\tlrfYYD.exe
  2⤵
  PID:10208
- C:\Windows\System\hPCIalM.exe
  C:\Windows\System\hPCIalM.exe
  2⤵
  PID:7728
- C:\Windows\System\NaOcgPw.exe
  C:\Windows\System\NaOcgPw.exe
  2⤵
  PID:7752
- C:\Windows\System\cSAdFJy.exe
  C:\Windows\System\cSAdFJy.exe
  2⤵
  PID:7840
- C:\Windows\System\uslwyDq.exe
  C:\Windows\System\uslwyDq.exe
  2⤵
  PID:7908
- C:\Windows\System\FyRTxfO.exe
  C:\Windows\System\FyRTxfO.exe
  2⤵
  PID:3612
- C:\Windows\System\DaDtWfr.exe
  C:\Windows\System\DaDtWfr.exe
  2⤵
  PID:7320
- C:\Windows\System\aMVFOiz.exe
  C:\Windows\System\aMVFOiz.exe
  2⤵
  PID:6920
- C:\Windows\System\dxKPJJB.exe
  C:\Windows\System\dxKPJJB.exe
  2⤵
  PID:9928
- C:\Windows\System\fCqvyUW.exe
  C:\Windows\System\fCqvyUW.exe
  2⤵
  PID:6056
- C:\Windows\System\fOqWJFg.exe
  C:\Windows\System\fOqWJFg.exe
  2⤵
  PID:4560
- C:\Windows\System\ahjxaEy.exe
  C:\Windows\System\ahjxaEy.exe
  2⤵
  PID:6992
- C:\Windows\System\BqUuXTZ.exe
  C:\Windows\System\BqUuXTZ.exe
  2⤵
  PID:8560
- C:\Windows\System\ManescW.exe
  C:\Windows\System\ManescW.exe
  2⤵
  PID:8500
- C:\Windows\System\vALCOkl.exe
  C:\Windows\System\vALCOkl.exe
  2⤵
  PID:8380
- C:\Windows\System\dUJaMeL.exe
  C:\Windows\System\dUJaMeL.exe
  2⤵
  PID:8404
- C:\Windows\System\brETKvk.exe
  C:\Windows\System\brETKvk.exe
  2⤵
  PID:8644
- C:\Windows\System\FwvGQiN.exe
  C:\Windows\System\FwvGQiN.exe
  2⤵
  PID:8704
- C:\Windows\System\OLaIDJP.exe
  C:\Windows\System\OLaIDJP.exe
  2⤵
  PID:9872
- C:\Windows\System\cREomAR.exe
  C:\Windows\System\cREomAR.exe
  2⤵
  PID:9808
- C:\Windows\System\DLWBQOg.exe
  C:\Windows\System\DLWBQOg.exe
  2⤵
  PID:10200
- C:\Windows\System\FfLAxfw.exe
  C:\Windows\System\FfLAxfw.exe
  2⤵
  PID:8756
- C:\Windows\System\peAzIwf.exe
  C:\Windows\System\peAzIwf.exe
  2⤵
  PID:10260
- C:\Windows\System\NwMltCV.exe
  C:\Windows\System\NwMltCV.exe
  2⤵
  PID:10284
- C:\Windows\System\rrevzxm.exe
  C:\Windows\System\rrevzxm.exe
  2⤵
  PID:10412
- C:\Windows\System\zehVQuc.exe
  C:\Windows\System\zehVQuc.exe
  2⤵
  PID:10432
- C:\Windows\System\gQBSTMg.exe
  C:\Windows\System\gQBSTMg.exe
  2⤵
  PID:10464
- C:\Windows\System\tfDocCG.exe
  C:\Windows\System\tfDocCG.exe
  2⤵
  PID:10480
- C:\Windows\System\SBKNjba.exe
  C:\Windows\System\SBKNjba.exe
  2⤵
  PID:10496
- C:\Windows\System\DswHUbD.exe
  C:\Windows\System\DswHUbD.exe
  2⤵
  PID:10516
- C:\Windows\System\xdhvkvY.exe
  C:\Windows\System\xdhvkvY.exe
  2⤵
  PID:10536
- C:\Windows\System\fWkEUTg.exe
  C:\Windows\System\fWkEUTg.exe
  2⤵
  PID:10552
- C:\Windows\System\EHTJlGJ.exe
  C:\Windows\System\EHTJlGJ.exe
  2⤵
  PID:10568
- C:\Windows\System\CBaGUnb.exe
  C:\Windows\System\CBaGUnb.exe
  2⤵
  PID:10584
- C:\Windows\System\EDWkOnb.exe
  C:\Windows\System\EDWkOnb.exe
  2⤵
  PID:10600
- C:\Windows\System\pTCujus.exe
  C:\Windows\System\pTCujus.exe
  2⤵
  PID:10624
- C:\Windows\System\OCfhMEg.exe
  C:\Windows\System\OCfhMEg.exe
  2⤵
  PID:10652
- C:\Windows\System\PDVZYEr.exe
  C:\Windows\System\PDVZYEr.exe
  2⤵
  PID:10672
- C:\Windows\System\wWPopQs.exe
  C:\Windows\System\wWPopQs.exe
  2⤵
  PID:10696
- C:\Windows\System\rixxjTF.exe
  C:\Windows\System\rixxjTF.exe
  2⤵
  PID:10724
- C:\Windows\System\gGNuWBb.exe
  C:\Windows\System\gGNuWBb.exe
  2⤵
  PID:10740
- C:\Windows\System\fVxhwRI.exe
  C:\Windows\System\fVxhwRI.exe
  2⤵
  PID:10764
- C:\Windows\System\VeDdUbf.exe
  C:\Windows\System\VeDdUbf.exe
  2⤵
  PID:10784
- C:\Windows\System\KdBlGPl.exe
  C:\Windows\System\KdBlGPl.exe
  2⤵
  PID:10824
- C:\Windows\System\vRvkxLr.exe
  C:\Windows\System\vRvkxLr.exe
  2⤵
  PID:10848
- C:\Windows\System\pBscoKr.exe
  C:\Windows\System\pBscoKr.exe
  2⤵
  PID:10880
- C:\Windows\System\FdTemnO.exe
  C:\Windows\System\FdTemnO.exe
  2⤵
  PID:10900
- C:\Windows\System\OULOjVF.exe
  C:\Windows\System\OULOjVF.exe
  2⤵
  PID:10932
- C:\Windows\System\rZGNskh.exe
  C:\Windows\System\rZGNskh.exe
  2⤵
  PID:10996
- C:\Windows\System\meoiprK.exe
  C:\Windows\System\meoiprK.exe
  2⤵
  PID:11016
- C:\Windows\System\zFPfOUh.exe
  C:\Windows\System\zFPfOUh.exe
  2⤵
  PID:11040
- C:\Windows\System\Qembjhd.exe
  C:\Windows\System\Qembjhd.exe
  2⤵
  PID:11072
- C:\Windows\System\ShSQcQu.exe
  C:\Windows\System\ShSQcQu.exe
  2⤵
  PID:11108
- C:\Windows\System\jBDnMIr.exe
  C:\Windows\System\jBDnMIr.exe
  2⤵
  PID:11128
- C:\Windows\System\spXBZDY.exe
  C:\Windows\System\spXBZDY.exe
  2⤵
  PID:11148
- C:\Windows\System\KkcqNtE.exe
  C:\Windows\System\KkcqNtE.exe
  2⤵
  PID:11172
- C:\Windows\System\gbIBVdQ.exe
  C:\Windows\System\gbIBVdQ.exe
  2⤵
  PID:11240
- C:\Windows\System\qIxWsAj.exe
  C:\Windows\System\qIxWsAj.exe
  2⤵
  PID:8840
- C:\Windows\System\kPTWOfh.exe
  C:\Windows\System\kPTWOfh.exe
  2⤵
  PID:8928
- C:\Windows\System\jdUitJl.exe
  C:\Windows\System\jdUitJl.exe
  2⤵
  PID:8892
- C:\Windows\System\yPSmKKS.exe
  C:\Windows\System\yPSmKKS.exe
  2⤵
  PID:9032
- C:\Windows\System\OgCFicy.exe
  C:\Windows\System\OgCFicy.exe
  2⤵
  PID:9072
- C:\Windows\System\mhBCiPO.exe
  C:\Windows\System\mhBCiPO.exe
  2⤵
  PID:9108
- C:\Windows\System\xLiMDlw.exe
  C:\Windows\System\xLiMDlw.exe
  2⤵
  PID:9188
- C:\Windows\System\fakhpPj.exe
  C:\Windows\System\fakhpPj.exe
  2⤵
  PID:6544
- C:\Windows\System\SfHTYGs.exe
  C:\Windows\System\SfHTYGs.exe
  2⤵
  PID:6596
- C:\Windows\System\qgXBmEa.exe
  C:\Windows\System\qgXBmEa.exe
  2⤵
  PID:6644
- C:\Windows\System\WiyPbrf.exe
  C:\Windows\System\WiyPbrf.exe
  2⤵
  PID:9832
- C:\Windows\System\WznbQwC.exe
  C:\Windows\System\WznbQwC.exe
  2⤵
  PID:6736
- C:\Windows\System\tSYriTK.exe
  C:\Windows\System\tSYriTK.exe
  2⤵
  PID:6724
- C:\Windows\System\cUElWYb.exe
  C:\Windows\System\cUElWYb.exe
  2⤵
  PID:7080
- C:\Windows\System\dHytUzv.exe
  C:\Windows\System\dHytUzv.exe
  2⤵
  PID:9956
- C:\Windows\System\APLpejW.exe
  C:\Windows\System\APLpejW.exe
  2⤵
  PID:7248
- C:\Windows\System\RQrsRaw.exe
  C:\Windows\System\RQrsRaw.exe
  2⤵
  PID:10028
- C:\Windows\System\pqJZfOx.exe
  C:\Windows\System\pqJZfOx.exe
  2⤵
  PID:7324
- C:\Windows\System\XSWTGGu.exe
  C:\Windows\System\XSWTGGu.exe
  2⤵
  PID:9120
- C:\Windows\System\OhFVJhq.exe
  C:\Windows\System\OhFVJhq.exe
  2⤵
  PID:7048
- C:\Windows\System\Gcuoecs.exe
  C:\Windows\System\Gcuoecs.exe
  2⤵
  PID:7432
- C:\Windows\System\nSeYxDh.exe
  C:\Windows\System\nSeYxDh.exe
  2⤵
  PID:8580
- C:\Windows\System\ScZHYPP.exe
  C:\Windows\System\ScZHYPP.exe
  2⤵
  PID:10120
- C:\Windows\System\lvPtKVx.exe
  C:\Windows\System\lvPtKVx.exe
  2⤵
  PID:9672
- C:\Windows\System\jsYftss.exe
  C:\Windows\System\jsYftss.exe
  2⤵
  PID:7108
- C:\Windows\System\yNcKmml.exe
  C:\Windows\System\yNcKmml.exe
  2⤵
  PID:6088
- C:\Windows\System\XhdsgPA.exe
  C:\Windows\System\XhdsgPA.exe
  2⤵
  PID:7240
- C:\Windows\System\aTSrPAx.exe
  C:\Windows\System\aTSrPAx.exe
  2⤵
  PID:8452
- C:\Windows\System\YMIKJkB.exe
  C:\Windows\System\YMIKJkB.exe
  2⤵
  PID:9276
- C:\Windows\System\fscIwNG.exe
  C:\Windows\System\fscIwNG.exe
  2⤵
  PID:9320
- C:\Windows\System\jauRQEU.exe
  C:\Windows\System\jauRQEU.exe
  2⤵
  PID:11272
- C:\Windows\System\PBSewsu.exe
  C:\Windows\System\PBSewsu.exe
  2⤵
  PID:11288
- C:\Windows\System\yAOWWsX.exe
  C:\Windows\System\yAOWWsX.exe
  2⤵
  PID:11308
- C:\Windows\System\gfxNksE.exe
  C:\Windows\System\gfxNksE.exe
  2⤵
  PID:11352
- C:\Windows\System\ERDjRuk.exe
  C:\Windows\System\ERDjRuk.exe
  2⤵
  PID:11376
- C:\Windows\System\XgGXxno.exe
  C:\Windows\System\XgGXxno.exe
  2⤵
  PID:11412
- C:\Windows\System\fmUCYDj.exe
  C:\Windows\System\fmUCYDj.exe
  2⤵
  PID:11444
- C:\Windows\System\JOuFBtl.exe
  C:\Windows\System\JOuFBtl.exe
  2⤵
  PID:11468
- C:\Windows\System\LXvAtJV.exe
  C:\Windows\System\LXvAtJV.exe
  2⤵
  PID:11508
- C:\Windows\System\gsHhWaV.exe
  C:\Windows\System\gsHhWaV.exe
  2⤵
  PID:11544
- C:\Windows\System\knEzUUp.exe
  C:\Windows\System\knEzUUp.exe
  2⤵
  PID:11636
- C:\Windows\System\UmXckCG.exe
  C:\Windows\System\UmXckCG.exe
  2⤵
  PID:11816
- C:\Windows\System\whcwPAj.exe
  C:\Windows\System\whcwPAj.exe
  2⤵
  PID:11832
- C:\Windows\System\MoUCEJk.exe
  C:\Windows\System\MoUCEJk.exe
  2⤵
  PID:11852
- C:\Windows\System\MberTkr.exe
  C:\Windows\System\MberTkr.exe
  2⤵
  PID:11872
- C:\Windows\System\yjhsrdS.exe
  C:\Windows\System\yjhsrdS.exe
  2⤵
  PID:11896
- C:\Windows\System\ROKIdHX.exe
  C:\Windows\System\ROKIdHX.exe
  2⤵
  PID:11920
- C:\Windows\System\zHkpNaq.exe
  C:\Windows\System\zHkpNaq.exe
  2⤵
  PID:11936
- C:\Windows\System\xDSsuIn.exe
  C:\Windows\System\xDSsuIn.exe
  2⤵
  PID:11960
- C:\Windows\System\oBUuMAH.exe
  C:\Windows\System\oBUuMAH.exe
  2⤵
  PID:11980
- C:\Windows\System\hmfmWul.exe
  C:\Windows\System\hmfmWul.exe
  2⤵
  PID:12004
- C:\Windows\System\wxovcAN.exe
  C:\Windows\System\wxovcAN.exe
  2⤵
  PID:12044
- C:\Windows\System\yguaLMN.exe
  C:\Windows\System\yguaLMN.exe
  2⤵
  PID:12064
- C:\Windows\System\HTMTADa.exe
  C:\Windows\System\HTMTADa.exe
  2⤵
  PID:12080
- C:\Windows\System\QItaBWt.exe
  C:\Windows\System\QItaBWt.exe
  2⤵
  PID:12096
- C:\Windows\System\slAXXDa.exe
  C:\Windows\System\slAXXDa.exe
  2⤵
  PID:12112
- C:\Windows\System\RAWcwwm.exe
  C:\Windows\System\RAWcwwm.exe
  2⤵
  PID:12128
- C:\Windows\System\nUacOPb.exe
  C:\Windows\System\nUacOPb.exe
  2⤵
  PID:12144
- C:\Windows\System\FQovXba.exe
  C:\Windows\System\FQovXba.exe
  2⤵
  PID:12160
- C:\Windows\System\jYYrSSy.exe
  C:\Windows\System\jYYrSSy.exe
  2⤵
  PID:12176
- C:\Windows\System\MyXmCJb.exe
  C:\Windows\System\MyXmCJb.exe
  2⤵
  PID:12192
- C:\Windows\System\vOwrWTp.exe
  C:\Windows\System\vOwrWTp.exe
  2⤵
  PID:12208
- C:\Windows\System\nAaOZBB.exe
  C:\Windows\System\nAaOZBB.exe
  2⤵
  PID:12224
- C:\Windows\System\EMxSHrW.exe
  C:\Windows\System\EMxSHrW.exe
  2⤵
  PID:12240
- C:\Windows\System\oykmZvv.exe
  C:\Windows\System\oykmZvv.exe
  2⤵
  PID:12256
- C:\Windows\System\xtxPuHc.exe
  C:\Windows\System\xtxPuHc.exe
  2⤵
  PID:12272
- C:\Windows\System\sjPAaZQ.exe
  C:\Windows\System\sjPAaZQ.exe
  2⤵
  PID:9552
- C:\Windows\System\PwBoIsh.exe
  C:\Windows\System\PwBoIsh.exe
  2⤵
  PID:9600
- C:\Windows\System\qLqceuv.exe
  C:\Windows\System\qLqceuv.exe
  2⤵
  PID:9744
- C:\Windows\System\QShPrWn.exe
  C:\Windows\System\QShPrWn.exe
  2⤵
  PID:10704
- C:\Windows\System\nvKembM.exe
  C:\Windows\System\nvKembM.exe
  2⤵
  PID:10756
- C:\Windows\System\xwrFFUv.exe
  C:\Windows\System\xwrFFUv.exe
  2⤵
  PID:8156
- C:\Windows\System\wUutNOF.exe
  C:\Windows\System\wUutNOF.exe
  2⤵
  PID:10060
- C:\Windows\System\qtVRVFa.exe
  C:\Windows\System\qtVRVFa.exe
  2⤵
  PID:11036
- C:\Windows\System\SCFaRwc.exe
  C:\Windows\System\SCFaRwc.exe
  2⤵
  PID:11140
- C:\Windows\System\AFZWqWB.exe
  C:\Windows\System\AFZWqWB.exe
  2⤵
  PID:2280
- C:\Windows\System\LZUuYEB.exe
  C:\Windows\System\LZUuYEB.exe
  2⤵
  PID:6296
- C:\Windows\System\KnKWNTM.exe
  C:\Windows\System\KnKWNTM.exe
  2⤵
  PID:6592
- C:\Windows\System\fovUOlB.exe
  C:\Windows\System\fovUOlB.exe
  2⤵
  PID:7400
- C:\Windows\System\vSOBuQr.exe
  C:\Windows\System\vSOBuQr.exe
  2⤵
  PID:9876
- C:\Windows\System\VDcmLPv.exe
  C:\Windows\System\VDcmLPv.exe
  2⤵
  PID:3420
- C:\Windows\System\mgcYCvo.exe
  C:\Windows\System\mgcYCvo.exe
  2⤵
  PID:7648
- C:\Windows\System\FXPWViq.exe
  C:\Windows\System\FXPWViq.exe
  2⤵
  PID:7748
- C:\Windows\System\umiXAQd.exe
  C:\Windows\System\umiXAQd.exe
  2⤵
  PID:7948
- C:\Windows\System\OslOqYr.exe
  C:\Windows\System\OslOqYr.exe
  2⤵
  PID:8968
- C:\Windows\System\cULbiwx.exe
  C:\Windows\System\cULbiwx.exe
  2⤵
  PID:5544
- C:\Windows\System\pjmVwNW.exe
  C:\Windows\System\pjmVwNW.exe
  2⤵
  PID:548
- C:\Windows\System\IzJhpCO.exe
  C:\Windows\System\IzJhpCO.exe
  2⤵
  PID:6204
- C:\Windows\System\bIyBOVK.exe
  C:\Windows\System\bIyBOVK.exe
  2⤵
  PID:8660
- C:\Windows\System\RpzzSrl.exe
  C:\Windows\System\RpzzSrl.exe
  2⤵
  PID:8720
- C:\Windows\System\stYhWVL.exe
  C:\Windows\System\stYhWVL.exe
  2⤵
  PID:10140
- C:\Windows\System\EuCLYzA.exe
  C:\Windows\System\EuCLYzA.exe
  2⤵
  PID:9248
- C:\Windows\System\WDiAZag.exe
  C:\Windows\System\WDiAZag.exe
  2⤵
  PID:10256
- C:\Windows\System\LLTLPxB.exe
  C:\Windows\System\LLTLPxB.exe
  2⤵
  PID:10292
- C:\Windows\System\LzQRoiK.exe
  C:\Windows\System\LzQRoiK.exe
  2⤵
  PID:10316
- C:\Windows\System\ocFgoBJ.exe
  C:\Windows\System\ocFgoBJ.exe
  2⤵
  PID:10332
- C:\Windows\System\aGhpCIv.exe
  C:\Windows\System\aGhpCIv.exe
  2⤵
  PID:10352
- C:\Windows\System\iAkQbAp.exe
  C:\Windows\System\iAkQbAp.exe
  2⤵
  PID:10364
- C:\Windows\System\gPQtVnn.exe
  C:\Windows\System\gPQtVnn.exe
  2⤵
  PID:10400
- C:\Windows\System\gzNckRc.exe
  C:\Windows\System\gzNckRc.exe
  2⤵
  PID:10452
- C:\Windows\System\KeglxMq.exe
  C:\Windows\System\KeglxMq.exe
  2⤵
  PID:10476
- C:\Windows\System\znZUKia.exe
  C:\Windows\System\znZUKia.exe
  2⤵
  PID:10504
- C:\Windows\System\XSVfnIJ.exe
  C:\Windows\System\XSVfnIJ.exe
  2⤵
  PID:10564
- C:\Windows\System\yltUGxJ.exe
  C:\Windows\System\yltUGxJ.exe
  2⤵
  PID:10608
- C:\Windows\System\GWwdSbo.exe
  C:\Windows\System\GWwdSbo.exe
  2⤵
  PID:10644
- C:\Windows\System\oUpovtv.exe
  C:\Windows\System\oUpovtv.exe
  2⤵
  PID:10692
- C:\Windows\System\MrBJyAm.exe
  C:\Windows\System\MrBJyAm.exe
  2⤵
  PID:10872
- C:\Windows\System\wpUnFvl.exe
  C:\Windows\System\wpUnFvl.exe
  2⤵
  PID:10968
- C:\Windows\System\QtMQsFV.exe
  C:\Windows\System\QtMQsFV.exe
  2⤵
  PID:11168
- C:\Windows\System\lEELMQh.exe
  C:\Windows\System\lEELMQh.exe
  2⤵
  PID:11228
- C:\Windows\System\qUXDwXO.exe
  C:\Windows\System\qUXDwXO.exe
  2⤵
  PID:11248
- C:\Windows\System\YYwKKaG.exe
  C:\Windows\System\YYwKKaG.exe
  2⤵
  PID:8860
- C:\Windows\System\fOVxUON.exe
  C:\Windows\System\fOVxUON.exe
  2⤵
  PID:8924
- C:\Windows\System\jPinJaB.exe
  C:\Windows\System\jPinJaB.exe
  2⤵
  PID:9060
- C:\Windows\System\mnXzBrN.exe
  C:\Windows\System\mnXzBrN.exe
  2⤵
  PID:5956
- C:\Windows\System\EfJBYNd.exe
  C:\Windows\System\EfJBYNd.exe
  2⤵
  PID:7364
- C:\Windows\System\SylHriV.exe
  C:\Windows\System\SylHriV.exe
  2⤵
  PID:10092
- C:\Windows\System\bNAVVVu.exe
  C:\Windows\System\bNAVVVu.exe
  2⤵
  PID:9724
- C:\Windows\System\OyPtgAr.exe
  C:\Windows\System\OyPtgAr.exe
  2⤵
  PID:4600
- C:\Windows\System\pqximFn.exe
  C:\Windows\System\pqximFn.exe
  2⤵
  PID:9304
- C:\Windows\System\hTarOQj.exe
  C:\Windows\System\hTarOQj.exe
  2⤵
  PID:11296
- C:\Windows\System\RRNxSuQ.exe
  C:\Windows\System\RRNxSuQ.exe
  2⤵
  PID:11364
- C:\Windows\System\KblliMn.exe
  C:\Windows\System\KblliMn.exe
  2⤵
  PID:11456
- C:\Windows\System\vRLSeRI.exe
  C:\Windows\System\vRLSeRI.exe
  2⤵
  PID:11528
- C:\Windows\System\fAeCxbZ.exe
  C:\Windows\System\fAeCxbZ.exe
  2⤵
  PID:11928
- C:\Windows\System\vIHrnHZ.exe
  C:\Windows\System\vIHrnHZ.exe
  2⤵
  PID:12012
- C:\Windows\System\jKsGxNr.exe
  C:\Windows\System\jKsGxNr.exe
  2⤵
  PID:408
- C:\Windows\System\yZlsRkH.exe
  C:\Windows\System\yZlsRkH.exe
  2⤵
  PID:12292
- C:\Windows\System\foqXhof.exe
  C:\Windows\System\foqXhof.exe
  2⤵
  PID:12316
- C:\Windows\System\xdzEEUJ.exe
  C:\Windows\System\xdzEEUJ.exe
  2⤵
  PID:12336
- C:\Windows\System\fuXNqor.exe
  C:\Windows\System\fuXNqor.exe
  2⤵
  PID:12360
- C:\Windows\System\YEaBsMq.exe
  C:\Windows\System\YEaBsMq.exe
  2⤵
  PID:12384
- C:\Windows\System\xUeqDxT.exe
  C:\Windows\System\xUeqDxT.exe
  2⤵
  PID:12404
- C:\Windows\System\UzvRiEQ.exe
  C:\Windows\System\UzvRiEQ.exe
  2⤵
  PID:12428
- C:\Windows\System\wibnffD.exe
  C:\Windows\System\wibnffD.exe
  2⤵
  PID:12456
- C:\Windows\System\pGozAQr.exe
  C:\Windows\System\pGozAQr.exe
  2⤵
  PID:12476
- C:\Windows\System\zVPMQNt.exe
  C:\Windows\System\zVPMQNt.exe
  2⤵
  PID:12496
- C:\Windows\System\aAbtMed.exe
  C:\Windows\System\aAbtMed.exe
  2⤵
  PID:12520
- C:\Windows\System\JHRushG.exe
  C:\Windows\System\JHRushG.exe
  2⤵
  PID:13276
- C:\Windows\System\tskjpXi.exe
  C:\Windows\System\tskjpXi.exe
  2⤵
  PID:13308
- C:\Windows\System\USSoVKH.exe
  C:\Windows\System\USSoVKH.exe
  2⤵
  PID:4256
- C:\Windows\System\oriZFva.exe
  C:\Windows\System\oriZFva.exe
  2⤵
  PID:9168
- C:\Windows\System\RwUHWbH.exe
  C:\Windows\System\RwUHWbH.exe
  2⤵
  PID:6640
- C:\Windows\System\pkNsCJn.exe
  C:\Windows\System\pkNsCJn.exe
  2⤵
  PID:8136
- C:\Windows\System\aelULKP.exe
  C:\Windows\System\aelULKP.exe
  2⤵
  PID:12020
- C:\Windows\System\mWVmnLL.exe
  C:\Windows\System\mWVmnLL.exe
  2⤵
  PID:10424
- C:\Windows\System\RCbdkzn.exe
  C:\Windows\System\RCbdkzn.exe
  2⤵
  PID:12052
- C:\Windows\System\BqbiOPN.exe
  C:\Windows\System\BqbiOPN.exe
  2⤵
  PID:12088
- C:\Windows\System\avBAlHO.exe
  C:\Windows\System\avBAlHO.exe
  2⤵
  PID:10592
- C:\Windows\System\UEJoKpw.exe
  C:\Windows\System\UEJoKpw.exe
  2⤵
  PID:11212
- C:\Windows\System\rXtfNsV.exe
  C:\Windows\System\rXtfNsV.exe
  2⤵
  PID:11844
- C:\Windows\System\ZSmTwKk.exe
  C:\Windows\System\ZSmTwKk.exe
  2⤵
  PID:12812
- C:\Windows\System\lfwDcEc.exe
  C:\Windows\System\lfwDcEc.exe
  2⤵
  PID:12220
- C:\Windows\System\BQFcMBC.exe
  C:\Windows\System\BQFcMBC.exe
  2⤵
  PID:9468
- C:\Windows\System\BTJCfpH.exe
  C:\Windows\System\BTJCfpH.exe
  2⤵
  PID:12852
- C:\Windows\System\fSRyRmL.exe
  C:\Windows\System\fSRyRmL.exe
  2⤵
  PID:9536
- C:\Windows\System\sMdqILJ.exe
  C:\Windows\System\sMdqILJ.exe
  2⤵
  PID:9580
- C:\Windows\System\TrlwdOh.exe
  C:\Windows\System\TrlwdOh.exe
  2⤵
  PID:11080
- C:\Windows\System\qnSRRpS.exe
  C:\Windows\System\qnSRRpS.exe
  2⤵
  PID:11864
- C:\Windows\System\XjfmNWu.exe
  C:\Windows\System\XjfmNWu.exe
  2⤵
  PID:12468
- C:\Windows\System\TPzuRIF.exe
  C:\Windows\System\TPzuRIF.exe
  2⤵
  PID:12596
- C:\Windows\System\oQogIPH.exe
  C:\Windows\System\oQogIPH.exe
  2⤵
  PID:12412
- C:\Windows\System\gloGhbL.exe
  C:\Windows\System\gloGhbL.exe
  2⤵
  PID:10748
- C:\Windows\System\smXbRVa.exe
  C:\Windows\System\smXbRVa.exe
  2⤵
  PID:11564
- C:\Windows\System\iwVVCmx.exe
  C:\Windows\System\iwVVCmx.exe
  2⤵
  PID:9512
- C:\Windows\System\OuXoRbv.exe
  C:\Windows\System\OuXoRbv.exe
  2⤵
  PID:4568
- C:\Windows\System\SJQiglE.exe
  C:\Windows\System\SJQiglE.exe
  2⤵
  PID:12968
- C:\Windows\System\ahwTnfc.exe
  C:\Windows\System\ahwTnfc.exe
  2⤵
  PID:1492
- C:\Windows\System\Inativp.exe
  C:\Windows\System\Inativp.exe
  2⤵
  PID:4436
- C:\Windows\System\rZAMKYW.exe
  C:\Windows\System\rZAMKYW.exe
  2⤵
  PID:12764
- C:\Windows\System\IDfmAjs.exe
  C:\Windows\System\IDfmAjs.exe
  2⤵
  PID:13252
- C:\Windows\System\qnKTQzC.exe
  C:\Windows\System\qnKTQzC.exe
  2⤵
  PID:11904
- C:\Windows\System\tMPbIep.exe
  C:\Windows\System\tMPbIep.exe
  2⤵
  PID:12980
- C:\Windows\System\kLtXhfu.exe
  C:\Windows\System\kLtXhfu.exe
  2⤵
  PID:11540
- C:\Windows\System\HTyLMgp.exe
  C:\Windows\System\HTyLMgp.exe
  2⤵
  PID:3372
- C:\Windows\System\BzNaQKk.exe
  C:\Windows\System\BzNaQKk.exe
  2⤵
  PID:9616
- C:\Windows\System\UfrqyXs.exe
  C:\Windows\System\UfrqyXs.exe
  2⤵
  PID:10044
- C:\Windows\System\HvHiUhy.exe
  C:\Windows\System\HvHiUhy.exe
  2⤵
  PID:11796
- C:\Windows\System\fcKvprB.exe
  C:\Windows\System\fcKvprB.exe
  2⤵
  PID:12264
- C:\Windows\System\ocCesQM.exe
  C:\Windows\System\ocCesQM.exe
  2⤵
  PID:12748
- C:\Windows\System\lxxbAty.exe
  C:\Windows\System\lxxbAty.exe
  2⤵
  PID:12040
- C:\Windows\System\CuTobMP.exe
  C:\Windows\System\CuTobMP.exe
  2⤵
  PID:12504
- C:\Windows\System\dKmHrDn.exe
  C:\Windows\System\dKmHrDn.exe
  2⤵
  PID:1632
- C:\Windows\System\XWJTpkd.exe
  C:\Windows\System\XWJTpkd.exe
  2⤵
  PID:4900
- C:\Windows\System\uFYzGTz.exe
  C:\Windows\System\uFYzGTz.exe
  2⤵
  PID:8684
- C:\Windows\System\mzRNkyE.exe
  C:\Windows\System\mzRNkyE.exe
  2⤵
  PID:820
- C:\Windows\System\OtCcBCs.exe
  C:\Windows\System\OtCcBCs.exe
  2⤵
  PID:3844
- C:\Windows\System\uHKIZWu.exe
  C:\Windows\System\uHKIZWu.exe
  2⤵
  PID:12580
- C:\Windows\System\zEnvlgP.exe
  C:\Windows\System\zEnvlgP.exe
  2⤵
  PID:13200
- C:\Windows\System\FKrRGOn.exe
  C:\Windows\System\FKrRGOn.exe
  2⤵
  PID:12792
- C:\Windows\System\VUBRslU.exe
  C:\Windows\System\VUBRslU.exe
  2⤵
  PID:12308
- C:\Windows\System\UutqLTz.exe
  C:\Windows\System\UutqLTz.exe
  2⤵
  PID:4248
- C:\Windows\System\OSgYKai.exe
  C:\Windows\System\OSgYKai.exe
  2⤵
  PID:4912
- C:\Windows\System\nchFaEp.exe
  C:\Windows\System\nchFaEp.exe
  2⤵
  PID:9516
- C:\Windows\System\YYKWjEa.exe
  C:\Windows\System\YYKWjEa.exe
  2⤵
  PID:13204
- C:\Windows\System\IflNDyF.exe
  C:\Windows\System\IflNDyF.exe
  2⤵
  PID:13136
- C:\Windows\System\DIyvXha.exe
  C:\Windows\System\DIyvXha.exe
  2⤵
  PID:13044
- C:\Windows\System\NzPprtg.exe
  C:\Windows\System\NzPprtg.exe
  2⤵
  PID:12076
- C:\Windows\System\vbwfErz.exe
  C:\Windows\System\vbwfErz.exe
  2⤵
  PID:13296
- C:\Windows\System\Bokqzvg.exe
  C:\Windows\System\Bokqzvg.exe
  2⤵
  PID:9676
- C:\Windows\System\wAYYqoM.exe
  C:\Windows\System\wAYYqoM.exe
  2⤵
  PID:12588
- C:\Windows\System\qlDiqdn.exe
  C:\Windows\System\qlDiqdn.exe
  2⤵
  PID:11060
- C:\Windows\System\eDXUfUC.exe
  C:\Windows\System\eDXUfUC.exe
  2⤵
  PID:12916
- C:\Windows\System\TrkeWRD.exe
  C:\Windows\System\TrkeWRD.exe
  2⤵
  PID:13184
- C:\Windows\System\MbDZNlp.exe
  C:\Windows\System\MbDZNlp.exe
  2⤵
  PID:10940
- C:\Windows\System\lDmjkRB.exe
  C:\Windows\System\lDmjkRB.exe
  2⤵
  PID:12104
- C:\Windows\System\hMAnQVu.exe
  C:\Windows\System\hMAnQVu.exe
  2⤵
  PID:4948
- C:\Windows\System\FgFwHGr.exe
  C:\Windows\System\FgFwHGr.exe
  2⤵
  PID:1464
- C:\Windows\System\oCYlrIg.exe
  C:\Windows\System\oCYlrIg.exe
  2⤵
  PID:11552
- C:\Windows\System\UCMFnAt.exe
  C:\Windows\System\UCMFnAt.exe
  2⤵
  PID:6520
- C:\Windows\System\vWnxoUF.exe
  C:\Windows\System\vWnxoUF.exe
  2⤵
  PID:6540
- C:\Windows\System\MSWqOZn.exe
  C:\Windows\System\MSWqOZn.exe
  2⤵
  PID:6516
- C:\Windows\System\ZxJXImM.exe
  C:\Windows\System\ZxJXImM.exe
  2⤵
  PID:6492
- C:\Windows\System\eLdeEVb.exe
  C:\Windows\System\eLdeEVb.exe
  2⤵
  PID:1920
- C:\Windows\System\qfCTJLV.exe
  C:\Windows\System\qfCTJLV.exe
  2⤵
  PID:12632
- C:\Windows\System\SitooUf.exe
  C:\Windows\System\SitooUf.exe
  2⤵
  PID:13116
- C:\Windows\System\GLVFmSk.exe
  C:\Windows\System\GLVFmSk.exe
  2⤵
  PID:1496
- C:\Windows\System\nxXefwB.exe
  C:\Windows\System\nxXefwB.exe
  2⤵
  PID:8628
- C:\Windows\System\BcFtXMw.exe
  C:\Windows\System\BcFtXMw.exe
  2⤵
  PID:11124
- C:\Windows\System\pnofZTW.exe
  C:\Windows\System\pnofZTW.exe
  2⤵
  PID:12016
- C:\Windows\System\eNZFRXx.exe
  C:\Windows\System\eNZFRXx.exe
  2⤵
  PID:13048
- C:\Windows\System\rjnOQaK.exe
  C:\Windows\System\rjnOQaK.exe
  2⤵
  PID:9576
- C:\Windows\System\XsFymBK.exe
  C:\Windows\System\XsFymBK.exe
  2⤵
  PID:13140
- C:\Windows\System\HyVgUXX.exe
  C:\Windows\System\HyVgUXX.exe
  2⤵
  PID:11056
- C:\Windows\System\DsmveYC.exe
  C:\Windows\System\DsmveYC.exe
  2⤵
  PID:11304
- C:\Windows\System\ljafCCc.exe
  C:\Windows\System\ljafCCc.exe
  2⤵
  PID:3588
- C:\Windows\System\dojQbvT.exe
  C:\Windows\System\dojQbvT.exe
  2⤵
  PID:12216
- C:\Windows\System\plSKYQU.exe
  C:\Windows\System\plSKYQU.exe
  2⤵
  PID:13472
- C:\Windows\System\fBftIQk.exe
  C:\Windows\System\fBftIQk.exe
  2⤵
  PID:13540
- C:\Windows\System\lAFcpnk.exe
  C:\Windows\System\lAFcpnk.exe
  2⤵
  PID:13568
- C:\Windows\System\RhUbcSf.exe
  C:\Windows\System\RhUbcSf.exe
  2⤵
  PID:13776
- C:\Windows\System\FmPMNmG.exe
  C:\Windows\System\FmPMNmG.exe
  2⤵
  PID:13816
- C:\Windows\System\wfJkVVO.exe
  C:\Windows\System\wfJkVVO.exe
  2⤵
  PID:13852
- C:\Windows\System\TXfTzJu.exe
  C:\Windows\System\TXfTzJu.exe
  2⤵
  PID:13876
- C:\Windows\System\rjhbrpK.exe
  C:\Windows\System\rjhbrpK.exe
  2⤵
  PID:13896
- C:\Windows\System\nYtYUpy.exe
  C:\Windows\System\nYtYUpy.exe
  2⤵
  PID:13920
- C:\Windows\System\qBBuCYT.exe
  C:\Windows\System\qBBuCYT.exe
  2⤵
  PID:13948
- C:\Windows\System\IjoomWK.exe
  C:\Windows\System\IjoomWK.exe
  2⤵
  PID:14028
- C:\Windows\System\UiQhmFT.exe
  C:\Windows\System\UiQhmFT.exe
  2⤵
  PID:14048
- C:\Windows\System\PDrgqJX.exe
  C:\Windows\System\PDrgqJX.exe
  2⤵
  PID:14064
- C:\Windows\System\BXwrquV.exe
  C:\Windows\System\BXwrquV.exe
  2⤵
  PID:14096
- C:\Windows\System\KSCeXBR.exe
  C:\Windows\System\KSCeXBR.exe
  2⤵
  PID:14116
- C:\Windows\System\LEFDzNK.exe
  C:\Windows\System\LEFDzNK.exe
  2⤵
  PID:14132
- C:\Windows\System\yjqOCHP.exe
  C:\Windows\System\yjqOCHP.exe
  2⤵
  PID:14184
- C:\Windows\System\eihGrgb.exe
  C:\Windows\System\eihGrgb.exe
  2⤵
  PID:14212
- C:\Windows\System\sgsucxb.exe
  C:\Windows\System\sgsucxb.exe
  2⤵
  PID:14228
- C:\Windows\System\PRxKPMw.exe
  C:\Windows\System\PRxKPMw.exe
  2⤵
  PID:14252
- C:\Windows\System\tUirqGo.exe
  C:\Windows\System\tUirqGo.exe
  2⤵
  PID:12784
- C:\Windows\System\wZvWeyc.exe
  C:\Windows\System\wZvWeyc.exe
  2⤵
  PID:6532
- C:\Windows\System\kChEqrF.exe
  C:\Windows\System\kChEqrF.exe
  2⤵
  PID:13076
- C:\Windows\System\amPauWb.exe
  C:\Windows\System\amPauWb.exe
  2⤵
  PID:11952
- C:\Windows\System\kQYSqeg.exe
  C:\Windows\System\kQYSqeg.exe
  2⤵
  PID:13316
- C:\Windows\System\HfVrBUy.exe
  C:\Windows\System\HfVrBUy.exe
  2⤵
  PID:6512
- C:\Windows\System\QGpqjpL.exe
  C:\Windows\System\QGpqjpL.exe
  2⤵
  PID:12564
- C:\Windows\System\IvTekjG.exe
  C:\Windows\System\IvTekjG.exe
  2⤵
  PID:7440
- C:\Windows\System\ojoxtpa.exe
  C:\Windows\System\ojoxtpa.exe
  2⤵
  PID:13392
- C:\Windows\System\WMNKTeW.exe
  C:\Windows\System\WMNKTeW.exe
  2⤵
  PID:13588
- C:\Windows\System\FrdyKWU.exe
  C:\Windows\System\FrdyKWU.exe
  2⤵
  PID:13420
- C:\Windows\System\HPRoaob.exe
  C:\Windows\System\HPRoaob.exe
  2⤵
  PID:13612
- C:\Windows\System\ohxILgS.exe
  C:\Windows\System\ohxILgS.exe
  2⤵
  PID:13456
- C:\Windows\System\oHnFoJw.exe
  C:\Windows\System\oHnFoJw.exe
  2⤵
  PID:13752
- C:\Windows\System\gBmlwVf.exe
  C:\Windows\System\gBmlwVf.exe
  2⤵
  PID:13532
- C:\Windows\System\NHsBMFB.exe
  C:\Windows\System\NHsBMFB.exe
  2⤵
  PID:13596
- C:\Windows\System\SazCgvK.exe
  C:\Windows\System\SazCgvK.exe
  2⤵
  PID:13932
- C:\Windows\System\OLjvfxw.exe
  C:\Windows\System\OLjvfxw.exe
  2⤵
  PID:14276
- C:\Windows\System\zxNGiLU.exe
  C:\Windows\System\zxNGiLU.exe
  2⤵
  PID:14156
- C:\Windows\System\QjeCnzd.exe
  C:\Windows\System\QjeCnzd.exe
  2⤵
  PID:14004
- C:\Windows\System\MYNcTQz.exe
  C:\Windows\System\MYNcTQz.exe
  2⤵
  PID:12612
- C:\Windows\System\lnElTxq.exe
  C:\Windows\System\lnElTxq.exe
  2⤵
  PID:14320
- C:\Windows\System\eRfvdHO.exe
  C:\Windows\System\eRfvdHO.exe
  2⤵
  PID:13644
- C:\Windows\System\raLqEqN.exe
  C:\Windows\System\raLqEqN.exe
  2⤵
  PID:14168
- C:\Windows\System\EyGBJer.exe
  C:\Windows\System\EyGBJer.exe
  2⤵
  PID:6500
- C:\Windows\System\VRVvZEf.exe
  C:\Windows\System\VRVvZEf.exe
  2⤵
  PID:14160
- C:\Windows\System\NXHaeHb.exe
  C:\Windows\System\NXHaeHb.exe
  2⤵
  PID:12312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_45la4hno.tg0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AOisHHJ.exe

Filesize
2.0MB

MD5
fef30bc75e62a7a95ad632409df82635

SHA1
a18e7e2c56e1b25c1aee4a50e4ae293f6f93e413

SHA256
4c709d364aa0035c3fd6f45efc0c1c45b0ae994f849504d51a4c39ce61563da9

SHA512
6b39afacbe0a1938a876ab256c7c83a234e00bed9b5c23399cffafc0a92685d45698e2de99628dffe4fcad1e9f4ec31cfb0eaf7814a98ab59bfa612d6b19a77d

Download Submit
C:\Windows\System\AsBRvmv.exe

Filesize
2.0MB

MD5
fbcfbd2b0bd87b578d9c305ffec219e2

SHA1
2364d4312b5c705e4472e370e001c0d02455d65d

SHA256
c8ac9239bda8a50edeea14eaadd651ac3280cdb92e952bb595c5a9333a7332a1

SHA512
7dc4302512b5db91c10d7552ad28f5c14c90dbc3a845d39f939e8a2133c524d3c36d680c14d511f803ecba88c40d7c9363e4f4ea93c81ba51d94cfbdc9862e40

Download Submit
C:\Windows\System\DRGFofH.exe

Filesize
2.0MB

MD5
6da23042b6e46965194be8d9a964bf7c

SHA1
34e8dcee7711236b470f1a2d3561607a8a4a9f19

SHA256
803867a1d23fc54f05c3daceb4de7c96ede023a0990eaf8051eaf28844ee322a

SHA512
c64d785b9c0f7f3bef16b19061a2f340f618ac83913d5d3d49256daab9022645090466abf6daf92239a91d17e0d1d3d31a1e0f4bbcf062689ae7325a547cd59b

Download Submit
C:\Windows\System\EuxRCmV.exe

Filesize
2.0MB

MD5
bdd06fc01a73d023e34a2f1eec79195c

SHA1
ddf3cad01de3841dea20682173aaf0f823ec0685

SHA256
eb4a0d8f8aa44b66a79cf54ff6ab635fba98f7278da0962bffb5ff1362c695de

SHA512
57f7cf64464b942a2744486e7f7799f07a0818201d5b9c34e166ba28049427a84a676c8ef0a493ba3054de8c145e10dd92c09055aa7d2a9f43924ff4662a33db

Download Submit
C:\Windows\System\GjFXhuX.exe

Filesize
2.0MB

MD5
eb3e3a6c1b7ebbce1ae4fa69cafd1c51

SHA1
d8090225c7c2ac8d53081dcf8276008fb6a04c82

SHA256
ca6e32ed311e23f96cf7629a76bce06266cb5fe4966fac2619c77cb0d8a2feb4

SHA512
185f5ffeb9b2458635343aa02d4ae5dfdc7a188e903533e5462a9d1c2c58a54a8962600f120b98f3efe9d34808a1fa482bb47337a5f7ec38f475903b1f2fc289

Download Submit
C:\Windows\System\JZHKCeb.exe

Filesize
2.0MB

MD5
bf9d9d521eabdfe57821bc8bb27de0e7

SHA1
3ca115421b746ed9020d8c8426ba88c992921558

SHA256
5ca08c289d9623cf547edee8b1de31603255f1704526b83e1585a43b2649814a

SHA512
410c28f6a10d6b924eab7abb50c443bea158b038b1dcaa0adb316f7c19b2bd675d8ff2e425555f1c709ee891828ab0dd28f240c72f76201e82daa6489ba3f565

Download Submit
C:\Windows\System\JkmejFP.exe

Filesize
2.0MB

MD5
d642dda0561efcb8d19e05aa8850377b

SHA1
d767c2e92f57b84c07fac25584e1d5328bc6963d

SHA256
3326058df84609ee97132a52a1717b44cf715ae759c275bf1e5f88db8dbb7f2b

SHA512
2e844ed5c3f1cadfcf1638f5a72f7f51e4833c6bbc0be3cf3d54e4bfcb6b12fa8f5d615b9478d7efa1ebf8aa0905c7eb544a9ea29bc96d15d123afec6e385971

Download Submit
C:\Windows\System\LOrAztR.exe

Filesize
2.0MB

MD5
72da7e91905bd1b0b6de15744577c6f9

SHA1
734ceea48f95091080cc830ce70497fbdd8a4633

SHA256
a8d05c1f3805c85e08bbb4a8062fc60119f55eac54c7259f677097535151b2de

SHA512
4c5bff1e93498d1ce37d6c587698b0217a5a57c959acdcc93d49686b80ec02e7f779aec9bd32bba455cc2ee05dc4b65664b484c395c2c8c777fb887bbcc754e8

Download Submit
C:\Windows\System\MYajkqb.exe

Filesize
2.0MB

MD5
e487de17eea2a2b0abd8a39acc30c33d

SHA1
62207adca7f73b861e0fda039d5faf0d96d81a43

SHA256
9ba69e6526ea0314c95cafcb83f654bbb5cd8483c6f07e87eb6b4bbca9a22dc7

SHA512
015861caea39b5528e89cfffe0ce8c9e8a29bffb59c126c94632c97680369650a9dc9529ef900f80bae957fe850260a16aba1e543bb98fc713d262d80af7eea9

Download Submit
C:\Windows\System\NKWxsDl.exe

Filesize
2.0MB

MD5
095752d1e07f2ed0d9506fd07ebb8c83

SHA1
a0d1eb9ec5af4a44d72bfdddc653fbcefd9c9425

SHA256
4b3ff909cb00202952e03e9f118414bf85f4284e0c90544852148a294975bb77

SHA512
6c345c50d9781147949fd0223eb1f4e1e4a7687f1fd37684f1018b35d7703f9d7ff3a9c9452a18de833cff63c50c079974c820d28d4985a86dd4f505167b787e

Download Submit
C:\Windows\System\NemBIrR.exe

Filesize
2.0MB

MD5
d2bc03fae8f2dde7e1d2e20439c46aa5

SHA1
d2e10e7083dd51299b4f71adeec1ad30d0259d98

SHA256
1b87e10e8fd9eb06221c3b7cbcb1e03525b14c007a4f6268e0137d0cb95cf041

SHA512
1219eab1708c0296c7df4943a1a59e4428cfb871048af77cc6bcbadb8896c835ea912df0e706a85bf5f0f741fb246b058023c6d9228c88734f2ab0dc2230cc56

Download Submit
C:\Windows\System\ONtLqWq.exe

Filesize
2.0MB

MD5
051ae80350edb6e9065370dd98af652b

SHA1
41b5dbbc82d8d99712e001944440df31641c572e

SHA256
568dfe852a0ae62c324799df92e12ac0a46c34230870d412f0114ba542873456

SHA512
65021870a3d7d9d92c9f96e77d14f49476a63b6a680442f9a925d18ca2e17c7e281aeadc5e0e1a27019c558f86f21268ce2e134eb1e8dbe7975f687cc539a3fe

Download Submit
C:\Windows\System\ShlbDzi.exe

Filesize
2.0MB

MD5
dea6644a932e8e8fc24d7acf0bd546e9

SHA1
2aee7133a04d8476adbf190923bd43b5d8f1cfea

SHA256
a2bdbfef33e15d72e9ca4488172bd5da5206ba22acf892f79f11a4037c3c01f6

SHA512
a022f2adb70189900dff8ce1f75d1eaa1ee24052b4665c59929de580c3430d7c570e7ff691e602279045afdd958f81b0548c4143bf13a7ba9ee818a58bcd9c0f

Download Submit
C:\Windows\System\SveWdAh.exe

Filesize
2.0MB

MD5
bf1b0d5b3c0bb2fdc378c14a2b7dcd25

SHA1
c8c9be64254751ef714e3d97fb44e39d72eedbcd

SHA256
12c705592f85b5b41a2ff627ce84a03b680a20d8ad0d237878fe9b94546649c1

SHA512
6dfb89596f3312e9cb42d758db59d581945f77ddda939fe66c785bffd3b1168420685fd55171eecf0758881db2c6ae62ef5b310db6d7deefce5cea295dda7d3e

Download Submit
C:\Windows\System\UkhVBxK.exe

Filesize
2.0MB

MD5
40ae3689226f3e714a4ce0f94d8469ae

SHA1
f75c49059f86c479b7608b017abaa65383ad64de

SHA256
0754cfca57eb3ef567201819c642205aaa8b2686b1c8cc27d5626c0579dd8bf1

SHA512
6019cd8a05aca99f7202bc162ba3bd9e51600f73f6f9c783c02a5743f8da2ac585fcb13600b91a833f789c4ca5a94a3dd617d3a5601a35cadbe6ecd7d83b0b62

Download Submit
C:\Windows\System\WEmmVOi.exe

Filesize
2.0MB

MD5
3c8c00764194b7b6ae1003655a9f2306

SHA1
dbf311437977129f27e559439a5858c167b883e4

SHA256
41a753f5ec8ed53b1717163e203c1e098a502390f42ecc8889a391feff40e309

SHA512
1d7cf9dccf52952b2cb27ad948eabd4db384ba289eaaef8378abdd97dc9bf42d7bcd60f995fd9acebf1e221e34cd0554842980a030b58823b33840dfd8f2297a

Download Submit
C:\Windows\System\WxDRWYW.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\YAefmWN.exe

Filesize
2.0MB

MD5
359e04d230a0578b7b97fc92c919c053

SHA1
cfe3901d62aee5237b36339f2b51eb039de3306b

SHA256
2f085514ca29a3198e6ea7b9f9c24c42632108b1f6f53d31ac474049164462be

SHA512
a5e0f5828307bec6373fc3f3815568b521c88f504aeb76bee8df40839b56d253a4e6f0bdc4899a1be574200d98b72e9c4ad7c76a9b22d2da1c4fc80e1047fd82

Download Submit
C:\Windows\System\YvnXDJz.exe

Filesize
2.0MB

MD5
b584b2967bec8183d07d30445da90ed7

SHA1
4a91dfb5075c0fdd6f479f38d14df28464699bdc

SHA256
4bf5029ddc601e0a391860f414352e79bf0e69766733cc90e2246b21cedcb945

SHA512
7b4a1e0b2265e48f777dbb65b1fe4a3db9da86d70b303aa761a9b954e25a46633bcdcbe5d421813a894ae62c619919e53566921b4e3a7ef3e560baa7d3e10793

Download Submit
C:\Windows\System\ZbRrGZC.exe

Filesize
2.0MB

MD5
f1d73f2c509eabae4c2173c13380da3c

SHA1
edb159f3571e112c832479753ca4a76cfdf5dc97

SHA256
7d45f5d322572f4a9574ec1d31c2c5c3b5d9e526829b86ba3d9bdeeaf2f0abb5

SHA512
0e5261eb82f4b5a748583decfb67870cc3e743e7c829171145ac0d012f60376d1f13c67286b91611453fe45b78caab9fca6ece1af7a72ea986bd7ec833d768bd

Download Submit
C:\Windows\System\bsOlBNM.exe

Filesize
2.0MB

MD5
666e828dc7bca51bd95e828e9908a6bd

SHA1
592d3091e22df147ad5237399692fd1154dc9630

SHA256
3941f1dbfeb5d1e895a9ded1a8d4c86d3889d1a5873ae7679eb384f6315a074c

SHA512
25148df8913b5a418d4afb21fb518e00cedd534987e7bbb3f7c6d322c3b1c6a04e6dd341508cd5ebb86bb4bec4afddad2070e6aa4bb59536a0f332fe73957308

Download Submit
C:\Windows\System\cRtWVRd.exe

Filesize
2.0MB

MD5
6677cc4b398b921bc5ace0d625ef1e7d

SHA1
319248ff4e88c79a47c5778b95b10ea5b62e4d87

SHA256
c2c18e1ea66ce196b16f6099cab2cb1ba53e6a8262e9f2a697014be6302cda3b

SHA512
078556d3c22f424576b3743e49c5751b00239534a63ad6036752e930ce2163e59d118f954cbbb6fec60c4999ceea27a333b2338e7498b5c712e2c2162919909a

Download Submit
C:\Windows\System\fAUamVi.exe

Filesize
2.0MB

MD5
1accbcce4d3032786f82a38b475e9e19

SHA1
4cff5f8a8c49a5798f46a0e4640a8c6b2c442341

SHA256
926b916dd847213c1510e16a04d6e207e3bedbf44cc43da29ab318c0ea2fdf28

SHA512
1f57a4b861b7efacdcd44be9579ca2caeeadc295068ce64b546d19158d498513e4046852d57e6dcaff28b3de3671787be5113cbb68ea3083bde3b526960827ca

Download Submit
C:\Windows\System\fHgCaIA.exe

Filesize
2.0MB

MD5
8b785c48ac40c64e2581a2ecad25bfec

SHA1
aaf13878e43a9e639e9f95e04d1cdce13f8eb742

SHA256
5ef48f07ed00e7818c89d5dfa398ce272f53b7bbf51df838535a5c2e83d19a6f

SHA512
710f96a8868048089ec5bc96944c643fdff40591bee0277293d7352361289b320f6447f15ec18f5970b87d4183721c7bc12b66538ec216f34bd9e1b33728dc7a

Download Submit
C:\Windows\System\gQvRskQ.exe

Filesize
2.0MB

MD5
99dadc0ab6825a9548eaac801c4eae1e

SHA1
7ca36622b6b910c3a6dc728c2a021599a4a26330

SHA256
d3abc62a34f23041a4f54a6eac97fb1a39ee732f154dbbf91a1f5cabf90d3570

SHA512
a45e0125ffb6234fecb3fba1d0c75444b1ea72511cdfce4e9037af387be508a93de587aa0429f4f613d350843cc9e5776e455fcf22bd0b5b19c1a4cfee813f81

Download Submit
C:\Windows\System\hvnYhEc.exe

Filesize
2.0MB

MD5
26d53c0e2c18d3f3b575b230df094c9b

SHA1
35f55aa624c8bfa219eb68aef026324c0a33bff0

SHA256
14f2b571b52d88dae041566220448efbab50189c8f16296ce7653570a5ff7437

SHA512
cf5d671a614c681b8976369572df0b83c5fffd9f3d73fca037809b1f4fd888fbee12b4698960d9d68e347e740eaea8379fdbdcbf8f87b864ce42f62bf88c0ece

Download Submit
C:\Windows\System\jLuDXiA.exe

Filesize
2.0MB

MD5
b6c72c1143783e1a5c231f6e3c0acef6

SHA1
edf98a84fba9721e9aa87090d9b09682a6d3eef8

SHA256
46bd4b9e902aefcd48fa9aaf2178d0b6c5d36710c1f7c15a4af2f57e791edcce

SHA512
edd562501c7b51e3f024f9b1417775ea3f27422eea82ebbe29e542e2f7cf24f2b4ac6f75aacb4aefe9987ec84ab3f7cd2ddcd6147d7370110b86efaa4989fb65

Download Submit
C:\Windows\System\jgUyGde.exe

Filesize
2.0MB

MD5
ac609b9fa6f59534bdadcd3dbf5e8213

SHA1
e3d49cb2025cc316b11bd2ebdebefe6ce7529192

SHA256
bc9edc5c38a2d95fb6dc7eba574f2143d2ddae8f25de17975e0115aa05cb8895

SHA512
561d1bf156dd4dc72decc2a435c58e03fceeff8d094ba1ee17739f21096758ce538f20e4809afa12d5e0be9b297cb36d170d30633a29dd92c0b35b5362c11389

Download Submit
C:\Windows\System\kMnjPGt.exe

Filesize
2.0MB

MD5
d8d77f52ebb8fd19bd39b50835658149

SHA1
1af53ed802b640ed3b32445f55998a48b1e2fb7f

SHA256
7e7ce658a03184c975769995670bec23362c20c2ad37182e45cce54b0752a88d

SHA512
2e760386a368f1e7bad3917768126b13a2eee566c4b6bc1b90d5255578ecd2551311663312d403df4611ec6e2dc192c82dfb387b0ad2b1634c2ad6fe5265d94c

Download Submit
C:\Windows\System\lsQqRKy.exe

Filesize
2.0MB

MD5
f3bcf8b7bd50dd7575e27dcdd8bf5b54

SHA1
f1eb04e6905d1b2202466168cc2cd3d4ac1b5325

SHA256
bf9af95a840bf2397d6166b34699169eb55fe56a1c8bd776fb2765140327cdc0

SHA512
0b1214076fa50fbc642ba53794cb804a638c0b045cd3dbb390b7393f7f586eca16ffc7b98740c190417f59548bfab67ee57c717f8f3a0113b35212cc7856c5e0

Download Submit
C:\Windows\System\otUfpSu.exe

Filesize
2.0MB

MD5
6d817ee70e532d802a2472477a5b8cc9

SHA1
3e036cd69da4f1cc2c615b5d2b83d91365ede873

SHA256
e322c6b4fc8a24ac2695550b753e731133d05e928eaa116b9d97832de364bd2b

SHA512
e60c05cde004d66cd5d9d52ee8d9e58e41909ade54db4c7f89b9356c169c222796894a1fd1c4a934198d6b21427cfa2e25bddd627a2b66346b3baaa030bcd26d

Download Submit
C:\Windows\System\qHCLOXA.exe

Filesize
2.0MB

MD5
487fe2243dc868ae25c803bffc213d3f

SHA1
1840416dd21941ad9512dc38e89d6266bc2ff920

SHA256
d435932e5e95618f052004d3cae8f696899fc9c88817d517b56edc20227fcb61

SHA512
828044600a2e9022f41c538faaf6aeff16140ad6ba2d1d6aebb2da0f894688811955afbdb2216d17da63b8bef15029cbe94a5970480225712030afa17a49b499

Download Submit
C:\Windows\System\qKaOzSs.exe

Filesize
2.0MB

MD5
24dde26c57d0e8be5ebad2001290bda9

SHA1
ed6479c7b7d1b0848f87e1d9810ae3dfd46a87d0

SHA256
83dad03c5821954b4997017f4f79b1a76d3bfd6dcb407b6a2f9b02259434ddc6

SHA512
8d3ebb6393421202ba123226a67ae871c3a59ef289231a15f6621e9886beeaee50fa9f7ad6845fafd2e5b6690361f65e0fd828a262d402af1b9800bc30c587a4

Download Submit
C:\Windows\System\qZOnnDa.exe

Filesize
2.0MB

MD5
99e2e79c2b7fb26c805a9388556badc8

SHA1
1c20710414e8b58b6974a0cdb36d1089fef558c8

SHA256
0a47b4e9c0027e2b6d81ea9ed5570f3f87f940a7528b3a3327c4136380552a79

SHA512
b474f4a577b7eda3666c54a22759a66d6f2452476c929a34f4613b68bf8aff240106b8b3c7bb2f7481b7ec48efa7323f07a2910d2c2d79133f8ae1ac9eb12e43

Download Submit
C:\Windows\System\qaMRjZc.exe

Filesize
2.0MB

MD5
9b331277cd98084cddbaeb5d8bc8cba3

SHA1
814b03b654a0fd2bb068b2f4e514d8756ebeaeb3

SHA256
5a5511ac9388875bf4202d1fb93ea1138a584b3227367e16ef26e91ecae0c7e5

SHA512
62a6de74270791a65a59bf31d6800a345b3ae8727eaaef008f5b305737080de45d4a8fb74a550c9c19b768dc9ee63343d9a4725f85c05b7afd927bc6e011b0e1

Download Submit
C:\Windows\System\uOJWztv.exe

Filesize
2.0MB

MD5
d85fdb9a5e8376b89b43f4a4d112c637

SHA1
67ef5645c515d63cc14280fb429f2cf13f98e5a5

SHA256
5c364748cc36864315b954a6099dad7b6e67e559691716a79571267a27b878fd

SHA512
6e6ba952ef85f6d97bda9e165acb9f0e20fb1e91f1af8386acc81bcaddf279c5f74084399a6261197bbc787c00f877935732769dc4b871b593e437bd92b54d3e

Download Submit
C:\Windows\System\uSRGYhB.exe

Filesize
2.0MB

MD5
2de6e844ad7b24c86fe39bd6becca35b

SHA1
115d47805eb31b962ad382f3dac0277c8aedfb10

SHA256
dc9f266b63becc448fa3b23181b8f4a647b461a99052d0ee1dddf336ddc100d3

SHA512
123759753f287b770bcf1ac342ec2f444a77bbed62cf5daa3a7550aa21a15671da678db373c2d0894d893887934a82840d2f0b49a4f8d144c48aa61c8080a923

Download Submit
C:\Windows\System\vKChRpo.exe

Filesize
2.0MB

MD5
a9ae4d0bce43ed08c2d35501f206829b

SHA1
8eb5ef02b2bc4d742f0bd4bad147c65eebf74911

SHA256
a188bad5b37097c0405a7d65802a6ccc434b1d77c969d75f5fb9beaba33e6214

SHA512
87fd644dbfb0550e94f059d874d67ccd572e0a84cc9e4fa4013cf255742b8dc8443508577c6b1ff03c9a4f7ccf4f6f47303d9a102e2ee964ae2f953c7a101afc

Download Submit
C:\Windows\System\zXrbzQe.exe

Filesize
2.0MB

MD5
6c0dd15b3c1dd13955dc16ff7dd97342

SHA1
2a426f9332de9df008d786911e206130a24ae32e

SHA256
a2abcd8dd07d119a25b1fff16bb3e67200ea7aa30630f13129d86358fb7c8fbe

SHA512
2ed27d1a8826afa7e4e671360a1e42349199ede2bced3c240603c8463b38f11a119140c0dd067c62086af01062adbbf55389e9f283b2889e7ac39626c4207145

Download Submit
memory/184-2881-0x00007FF797B90000-0x00007FF797F82000-memory.dmp

Filesize
3.9MB

Download
memory/184-515-0x00007FF797B90000-0x00007FF797F82000-memory.dmp

Filesize
3.9MB

Download
memory/224-2913-0x00007FF703420000-0x00007FF703812000-memory.dmp

Filesize
3.9MB

Download
memory/224-523-0x00007FF703420000-0x00007FF703812000-memory.dmp

Filesize
3.9MB

Download
memory/980-2233-0x00007FF7CDE70000-0x00007FF7CE262000-memory.dmp

Filesize
3.9MB

Download
memory/980-12-0x00007FF7CDE70000-0x00007FF7CE262000-memory.dmp

Filesize
3.9MB

Download
memory/980-2846-0x00007FF7CDE70000-0x00007FF7CE262000-memory.dmp

Filesize
3.9MB

Download
memory/1028-2880-0x00007FF7BE400000-0x00007FF7BE7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1028-508-0x00007FF7BE400000-0x00007FF7BE7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-517-0x00007FF77F5B0000-0x00007FF77F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-2893-0x00007FF77F5B0000-0x00007FF77F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1752-521-0x00007FF6357E0000-0x00007FF635BD2000-memory.dmp

Filesize
3.9MB

Download
memory/1752-2923-0x00007FF6357E0000-0x00007FF635BD2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-526-0x00007FF6C9670000-0x00007FF6C9A62000-memory.dmp

Filesize
3.9MB

Download
memory/1908-2895-0x00007FF6C9670000-0x00007FF6C9A62000-memory.dmp

Filesize
3.9MB

Download
memory/2044-525-0x00007FF7773E0000-0x00007FF7777D2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-2889-0x00007FF7773E0000-0x00007FF7777D2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-2213-0x00007FF8D9620000-0x00007FF8DA0E1000-memory.dmp

Filesize
10.8MB

Download
memory/2568-61-0x00007FF8D9620000-0x00007FF8DA0E1000-memory.dmp

Filesize
10.8MB

Download
memory/2568-125-0x00007FF8D9620000-0x00007FF8DA0E1000-memory.dmp

Filesize
10.8MB

Download
memory/2568-18-0x00007FF8D9623000-0x00007FF8D9625000-memory.dmp

Filesize
8KB

Download
memory/2568-328-0x00000243F8DA0000-0x00000243F8DC2000-memory.dmp

Filesize
136KB

Download
memory/2692-2911-0x00007FF75B8D0000-0x00007FF75BCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-514-0x00007FF75B8D0000-0x00007FF75BCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-522-0x00007FF64BBD0000-0x00007FF64BFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-2920-0x00007FF64BBD0000-0x00007FF64BFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-2883-0x00007FF6BADE0000-0x00007FF6BB1D2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-512-0x00007FF6BADE0000-0x00007FF6BB1D2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-524-0x00007FF6B3380000-0x00007FF6B3772000-memory.dmp

Filesize
3.9MB

Download
memory/3028-2909-0x00007FF6B3380000-0x00007FF6B3772000-memory.dmp

Filesize
3.9MB

Download
memory/3184-516-0x00007FF757A60000-0x00007FF757E52000-memory.dmp

Filesize
3.9MB

Download
memory/3184-2917-0x00007FF757A60000-0x00007FF757E52000-memory.dmp

Filesize
3.9MB

Download
memory/3492-511-0x00007FF6C0FA0000-0x00007FF6C1392000-memory.dmp

Filesize
3.9MB

Download
memory/3492-2886-0x00007FF6C0FA0000-0x00007FF6C1392000-memory.dmp

Filesize
3.9MB

Download
memory/3544-2850-0x00007FF63CE70000-0x00007FF63D262000-memory.dmp

Filesize
3.9MB

Download
memory/3544-284-0x00007FF63CE70000-0x00007FF63D262000-memory.dmp

Filesize
3.9MB

Download
memory/3736-2885-0x00007FF7C7D50000-0x00007FF7C8142000-memory.dmp

Filesize
3.9MB

Download
memory/3736-518-0x00007FF7C7D50000-0x00007FF7C8142000-memory.dmp

Filesize
3.9MB

Download
memory/4028-387-0x00007FF6B9970000-0x00007FF6B9D62000-memory.dmp

Filesize
3.9MB

Download
memory/4028-2855-0x00007FF6B9970000-0x00007FF6B9D62000-memory.dmp

Filesize
3.9MB

Download
memory/4036-2856-0x00007FF781DF0000-0x00007FF7821E2000-memory.dmp

Filesize
3.9MB

Download
memory/4036-472-0x00007FF781DF0000-0x00007FF7821E2000-memory.dmp

Filesize
3.9MB

Download
memory/4072-2848-0x00007FF6970A0000-0x00007FF697492000-memory.dmp

Filesize
3.9MB

Download
memory/4072-228-0x00007FF6970A0000-0x00007FF697492000-memory.dmp

Filesize
3.9MB

Download
memory/4128-327-0x00007FF7DEE30000-0x00007FF7DF222000-memory.dmp

Filesize
3.9MB

Download
memory/4128-2891-0x00007FF7DEE30000-0x00007FF7DF222000-memory.dmp

Filesize
3.9MB

Download
memory/4236-520-0x00007FF659B00000-0x00007FF659EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4236-2904-0x00007FF659B00000-0x00007FF659EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4432-2852-0x00007FF6A2CD0000-0x00007FF6A30C2000-memory.dmp

Filesize
3.9MB

Download
memory/4432-388-0x00007FF6A2CD0000-0x00007FF6A30C2000-memory.dmp

Filesize
3.9MB

Download
memory/4528-1-0x000001F12A1E0000-0x000001F12A1F0000-memory.dmp

Filesize
64KB

Download
memory/4528-2150-0x00007FF6BA930000-0x00007FF6BAD22000-memory.dmp

Filesize
3.9MB

Download
memory/4528-0-0x00007FF6BA930000-0x00007FF6BAD22000-memory.dmp

Filesize
3.9MB

Download
memory/4684-2899-0x00007FF62C290000-0x00007FF62C682000-memory.dmp

Filesize
3.9MB

Download
memory/4684-519-0x00007FF62C290000-0x00007FF62C682000-memory.dmp

Filesize
3.9MB

Download
memory/4772-2873-0x00007FF654610000-0x00007FF654A02000-memory.dmp

Filesize
3.9MB

Download
memory/4772-513-0x00007FF654610000-0x00007FF654A02000-memory.dmp

Filesize
3.9MB

Download