xmrig | bf7a5e06ce25467d4cac9fe090ec15ba9ad28405a95ec5590c6f678af310ca39

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ede98418aaf38b24e9ef828a008b09b0N.exe
Size

1.8MB
MD5

ede98418aaf38b24e9ef828a008b09b0
SHA1

64fdfa9558e009db6724178720ec359e93743ce4
SHA256

bf7a5e06ce25467d4cac9fe090ec15ba9ad28405a95ec5590c6f678af310ca39
SHA512

8e0fb2d504d8a2cd992789d7fe9e6891bd96c9b12926f7c7fc0a511e2afe65fc3cd1965420bc5d107b07d6eda5c4f475bf90ea2b3bddc7126ebbede39282088c
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/p1GgOCWGA9:Lz071uv4BPMkFfdk2auTqao/c/pSCWb

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/616-68-0x00007FF61BDD0000-0x00007FF61C1C2000-memory.dmp	xmrig
behavioral2/memory/2724-422-0x00007FF731EA0000-0x00007FF732292000-memory.dmp	xmrig
behavioral2/memory/872-430-0x00007FF6AB0D0000-0x00007FF6AB4C2000-memory.dmp	xmrig
behavioral2/memory/2368-433-0x00007FF70C510000-0x00007FF70C902000-memory.dmp	xmrig
behavioral2/memory/944-2386-0x00007FF704A20000-0x00007FF704E12000-memory.dmp	xmrig
behavioral2/memory/2180-2384-0x00007FF79F100000-0x00007FF79F4F2000-memory.dmp	xmrig
behavioral2/memory/2800-2357-0x00007FF7AEBD0000-0x00007FF7AEFC2000-memory.dmp	xmrig
behavioral2/memory/2168-2353-0x00007FF74D3D0000-0x00007FF74D7C2000-memory.dmp	xmrig
behavioral2/memory/2328-432-0x00007FF655270000-0x00007FF655662000-memory.dmp	xmrig
behavioral2/memory/4604-431-0x00007FF78A4C0000-0x00007FF78A8B2000-memory.dmp	xmrig
behavioral2/memory/4812-429-0x00007FF7924A0000-0x00007FF792892000-memory.dmp	xmrig
behavioral2/memory/5092-427-0x00007FF7ED300000-0x00007FF7ED6F2000-memory.dmp	xmrig
behavioral2/memory/4116-426-0x00007FF6330B0000-0x00007FF6334A2000-memory.dmp	xmrig
behavioral2/memory/4440-418-0x00007FF7FA800000-0x00007FF7FABF2000-memory.dmp	xmrig
behavioral2/memory/4584-356-0x00007FF6B6040000-0x00007FF6B6432000-memory.dmp	xmrig
behavioral2/memory/4040-302-0x00007FF777C20000-0x00007FF778012000-memory.dmp	xmrig
behavioral2/memory/2708-299-0x00007FF696B00000-0x00007FF696EF2000-memory.dmp	xmrig
behavioral2/memory/4408-265-0x00007FF6A70A0000-0x00007FF6A7492000-memory.dmp	xmrig
behavioral2/memory/4956-228-0x00007FF6E29D0000-0x00007FF6E2DC2000-memory.dmp	xmrig
behavioral2/memory/1992-224-0x00007FF782730000-0x00007FF782B22000-memory.dmp	xmrig
behavioral2/memory/2568-176-0x00007FF7E69C0000-0x00007FF7E6DB2000-memory.dmp	xmrig
behavioral2/memory/3416-172-0x00007FF7402B0000-0x00007FF7406A2000-memory.dmp	xmrig
behavioral2/memory/4592-128-0x00007FF673960000-0x00007FF673D52000-memory.dmp	xmrig
behavioral2/memory/2544-103-0x00007FF7041E0000-0x00007FF7045D2000-memory.dmp	xmrig
behavioral2/memory/2824-100-0x00007FF72B630000-0x00007FF72BA22000-memory.dmp	xmrig
behavioral2/memory/2800-18-0x00007FF7AEBD0000-0x00007FF7AEFC2000-memory.dmp	xmrig
behavioral2/memory/2800-2885-0x00007FF7AEBD0000-0x00007FF7AEFC2000-memory.dmp	xmrig
behavioral2/memory/616-2887-0x00007FF61BDD0000-0x00007FF61C1C2000-memory.dmp	xmrig
behavioral2/memory/2824-2889-0x00007FF72B630000-0x00007FF72BA22000-memory.dmp	xmrig
behavioral2/memory/944-2892-0x00007FF704A20000-0x00007FF704E12000-memory.dmp	xmrig
behavioral2/memory/2180-2895-0x00007FF79F100000-0x00007FF79F4F2000-memory.dmp	xmrig
behavioral2/memory/4812-2894-0x00007FF7924A0000-0x00007FF792892000-memory.dmp	xmrig
behavioral2/memory/4592-2899-0x00007FF673960000-0x00007FF673D52000-memory.dmp	xmrig
behavioral2/memory/2544-2903-0x00007FF7041E0000-0x00007FF7045D2000-memory.dmp	xmrig
behavioral2/memory/1992-2907-0x00007FF782730000-0x00007FF782B22000-memory.dmp	xmrig
behavioral2/memory/872-2902-0x00007FF6AB0D0000-0x00007FF6AB4C2000-memory.dmp	xmrig
behavioral2/memory/2568-2906-0x00007FF7E69C0000-0x00007FF7E6DB2000-memory.dmp	xmrig
behavioral2/memory/3416-2898-0x00007FF7402B0000-0x00007FF7406A2000-memory.dmp	xmrig
behavioral2/memory/5092-2948-0x00007FF7ED300000-0x00007FF7ED6F2000-memory.dmp	xmrig
behavioral2/memory/2368-2943-0x00007FF70C510000-0x00007FF70C902000-memory.dmp	xmrig
behavioral2/memory/2328-2940-0x00007FF655270000-0x00007FF655662000-memory.dmp	xmrig
behavioral2/memory/4408-2936-0x00007FF6A70A0000-0x00007FF6A7492000-memory.dmp	xmrig
behavioral2/memory/4604-2932-0x00007FF78A4C0000-0x00007FF78A8B2000-memory.dmp	xmrig
behavioral2/memory/4116-2931-0x00007FF6330B0000-0x00007FF6334A2000-memory.dmp	xmrig
behavioral2/memory/4440-2927-0x00007FF7FA800000-0x00007FF7FABF2000-memory.dmp	xmrig
behavioral2/memory/4584-2950-0x00007FF6B6040000-0x00007FF6B6432000-memory.dmp	xmrig
behavioral2/memory/4956-2939-0x00007FF6E29D0000-0x00007FF6E2DC2000-memory.dmp	xmrig
behavioral2/memory/2708-2935-0x00007FF696B00000-0x00007FF696EF2000-memory.dmp	xmrig
behavioral2/memory/2724-2929-0x00007FF731EA0000-0x00007FF732292000-memory.dmp	xmrig
behavioral2/memory/4040-2925-0x00007FF777C20000-0x00007FF778012000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2996	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2800	GVqkird.exe
2180	XOPolyX.exe
944	wblEkvH.exe
4812	wQwoPzD.exe
616	DcEglZn.exe
2824	rPtubWU.exe
872	UwXCUsb.exe
2544	RAVdyGL.exe
4592	mGILVgZ.exe
4604	lbhXyUk.exe
3416	EMLXfvc.exe
2568	UtjrOpn.exe
1992	RLsDdwy.exe
4956	TrEKZkh.exe
2328	tREfojO.exe
4408	AJWwxeF.exe
2708	zLCOLWD.exe
4040	WEiKOZt.exe
2368	ifKYsjc.exe
4584	uLUePxj.exe
4440	oKbJxiH.exe
2724	QxPvbFJ.exe
4116	RpLbdzF.exe
5092	zAgZgCf.exe
1876	TUUSAdC.exe
1064	uBnRTIo.exe
892	BQZEVfq.exe
396	uffMGPn.exe
2448	ZvHtLtE.exe
5048	yxeZzSn.exe
1548	hJwirAp.exe
4952	ZcjsVXB.exe
1260	XcLsvFp.exe
1500	ErQZzEJ.exe
3728	XBMGCEB.exe
4460	nRbrmYp.exe
4308	uJBCGfr.exe
3580	GUAccOA.exe
232	dcdaqwo.exe
768	wzSSblP.exe
3196	ccLLvHY.exe
3772	RmFysNn.exe
4904	vLIimGH.exe
3504	ARRGmHL.exe
3060	gbNurYE.exe
2524	XcGiDvi.exe
5064	mrhkzVo.exe
4184	spOLMnm.exe
5020	KrJYNMN.exe
4896	PXAHuSy.exe
620	YNvtUSz.exe
2208	SHcmYsA.exe
216	huMrfGW.exe
940	MnDhjEM.exe
8	mAjQLYM.exe
456	FpAcVYD.exe
4364	hwpgfXd.exe
3124	AqTgpjI.exe
376	raqkOTo.exe
4268	zHnRqYV.exe
4988	aJzUxoZ.exe
3768	tgQeEsu.exe
1428	XNVnNhU.exe
3376	motXcKA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2168-0-0x00007FF74D3D0000-0x00007FF74D7C2000-memory.dmp	upx
behavioral2/files/0x0008000000023430-6.dat	upx
behavioral2/files/0x0007000000023437-23.dat	upx
behavioral2/memory/2180-37-0x00007FF79F100000-0x00007FF79F4F2000-memory.dmp	upx
behavioral2/files/0x0007000000023439-53.dat	upx
behavioral2/files/0x000700000002343d-87.dat	upx
behavioral2/files/0x0007000000023449-114.dat	upx
behavioral2/files/0x000700000002343c-82.dat	upx
behavioral2/files/0x0007000000023446-107.dat	upx
behavioral2/files/0x000700000002343a-71.dat	upx
behavioral2/memory/616-68-0x00007FF61BDD0000-0x00007FF61C1C2000-memory.dmp	upx
behavioral2/files/0x000700000002343e-67.dat	upx
behavioral2/files/0x0007000000023440-65.dat	upx
behavioral2/files/0x000700000002343f-64.dat	upx
behavioral2/files/0x0007000000023444-154.dat	upx
behavioral2/memory/2724-422-0x00007FF731EA0000-0x00007FF732292000-memory.dmp	upx
behavioral2/memory/872-430-0x00007FF6AB0D0000-0x00007FF6AB4C2000-memory.dmp	upx
behavioral2/memory/2368-433-0x00007FF70C510000-0x00007FF70C902000-memory.dmp	upx
behavioral2/memory/944-2386-0x00007FF704A20000-0x00007FF704E12000-memory.dmp	upx
behavioral2/memory/2180-2384-0x00007FF79F100000-0x00007FF79F4F2000-memory.dmp	upx
behavioral2/memory/2800-2357-0x00007FF7AEBD0000-0x00007FF7AEFC2000-memory.dmp	upx
behavioral2/memory/2168-2353-0x00007FF74D3D0000-0x00007FF74D7C2000-memory.dmp	upx
behavioral2/memory/2328-432-0x00007FF655270000-0x00007FF655662000-memory.dmp	upx
behavioral2/memory/4604-431-0x00007FF78A4C0000-0x00007FF78A8B2000-memory.dmp	upx
behavioral2/memory/4812-429-0x00007FF7924A0000-0x00007FF792892000-memory.dmp	upx
behavioral2/memory/5092-427-0x00007FF7ED300000-0x00007FF7ED6F2000-memory.dmp	upx
behavioral2/memory/4116-426-0x00007FF6330B0000-0x00007FF6334A2000-memory.dmp	upx
behavioral2/memory/4440-418-0x00007FF7FA800000-0x00007FF7FABF2000-memory.dmp	upx
behavioral2/memory/4584-356-0x00007FF6B6040000-0x00007FF6B6432000-memory.dmp	upx
behavioral2/memory/4040-302-0x00007FF777C20000-0x00007FF778012000-memory.dmp	upx
behavioral2/memory/2708-299-0x00007FF696B00000-0x00007FF696EF2000-memory.dmp	upx
behavioral2/memory/4408-265-0x00007FF6A70A0000-0x00007FF6A7492000-memory.dmp	upx
behavioral2/memory/4956-228-0x00007FF6E29D0000-0x00007FF6E2DC2000-memory.dmp	upx
behavioral2/files/0x0007000000023458-197.dat	upx
behavioral2/files/0x0007000000023448-183.dat	upx
behavioral2/files/0x0007000000023447-180.dat	upx
behavioral2/files/0x0007000000023457-179.dat	upx
behavioral2/files/0x0007000000023456-178.dat	upx
behavioral2/memory/1992-224-0x00007FF782730000-0x00007FF782B22000-memory.dmp	upx
behavioral2/memory/2568-176-0x00007FF7E69C0000-0x00007FF7E6DB2000-memory.dmp	upx
behavioral2/files/0x000700000002344e-173.dat	upx
behavioral2/memory/3416-172-0x00007FF7402B0000-0x00007FF7406A2000-memory.dmp	upx
behavioral2/files/0x000700000002344c-169.dat	upx
behavioral2/files/0x0007000000023453-168.dat	upx
behavioral2/files/0x000700000002344a-162.dat	upx
behavioral2/files/0x0007000000023441-151.dat	upx
behavioral2/files/0x000700000002345a-207.dat	upx
behavioral2/files/0x0007000000023452-147.dat	upx
behavioral2/files/0x0007000000023459-206.dat	upx
behavioral2/files/0x0007000000023450-143.dat	upx
behavioral2/files/0x000700000002344f-141.dat	upx
behavioral2/files/0x0007000000023443-134.dat	upx
behavioral2/files/0x0007000000023445-131.dat	upx
behavioral2/memory/4592-128-0x00007FF673960000-0x00007FF673D52000-memory.dmp	upx
behavioral2/files/0x0007000000023454-171.dat	upx
behavioral2/files/0x0007000000023451-146.dat	upx
behavioral2/memory/2544-103-0x00007FF7041E0000-0x00007FF7045D2000-memory.dmp	upx
behavioral2/memory/2824-100-0x00007FF72B630000-0x00007FF72BA22000-memory.dmp	upx
behavioral2/files/0x0007000000023442-98.dat	upx
behavioral2/files/0x000700000002344d-126.dat	upx
behavioral2/files/0x000700000002344b-122.dat	upx
behavioral2/files/0x000700000002343b-73.dat	upx
behavioral2/files/0x0007000000023435-61.dat	upx
behavioral2/memory/944-50-0x00007FF704A20000-0x00007FF704E12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OBvvJbX.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\kzTedli.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\bsOLeKP.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\WNjuroM.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\EfgxuFi.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\vlRHFWd.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\ktMPJij.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\tsgZKnK.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\caqpnhz.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\SiSkSih.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\TUUSAdC.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\zWpzFyP.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\TGBKWjZ.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\ogOoKIK.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\HFgvQGn.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\NdNzowz.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\oianoqb.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\oqoGKcp.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\iyBVOKH.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\CmcUkoT.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\EXEuDgv.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\QsRqYyf.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\EolkRPD.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\woEOOCn.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\dBoagWA.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\jGWEgJD.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\RgIdVfh.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\WgQMoKW.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\EmpcUBP.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\ujqWaPI.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\cXIrjVg.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\rPtubWU.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\XsLQiYj.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\NMqPAFm.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\ExvwqBM.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\UdxwMLU.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\RsnyDBB.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\VyOOowN.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\jnwKhqw.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\ztZMzBa.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\uqeXaOU.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\OrbAoug.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\gEOILtY.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\Dhvhheq.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\TWEhwhi.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\MCLQQMR.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\FSDpxgt.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\DFaEgGr.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\XPNTFnM.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\zirTmmH.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\sjwzYgy.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\IjxfmqW.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\kJgDEbz.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\NYquDXx.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\qrWrVnb.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\gZjuTxS.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\vHbdCDc.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\uDCsqDC.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\WaxYxhC.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\uPslyXm.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\EsMqGPL.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\QpowjLN.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\jJYqXDz.exe	ede98418aaf38b24e9ef828a008b09b0N.exe
File created	C:\Windows\System\DtvCJQM.exe	ede98418aaf38b24e9ef828a008b09b0N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeLockMemoryPrivilege	2168	ede98418aaf38b24e9ef828a008b09b0N.exe
Token: SeLockMemoryPrivilege	2168	ede98418aaf38b24e9ef828a008b09b0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2996	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	84
PID 2168 wrote to memory of 2996	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	84
PID 2168 wrote to memory of 2800	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	85
PID 2168 wrote to memory of 2800	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	85
PID 2168 wrote to memory of 2180	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	86
PID 2168 wrote to memory of 2180	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	86
PID 2168 wrote to memory of 944	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	87
PID 2168 wrote to memory of 944	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	87
PID 2168 wrote to memory of 4812	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	88
PID 2168 wrote to memory of 4812	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	88
PID 2168 wrote to memory of 616	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	89
PID 2168 wrote to memory of 616	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	89
PID 2168 wrote to memory of 2824	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	90
PID 2168 wrote to memory of 2824	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	90
PID 2168 wrote to memory of 4604	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	91
PID 2168 wrote to memory of 4604	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	91
PID 2168 wrote to memory of 2568	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	92
PID 2168 wrote to memory of 2568	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	92
PID 2168 wrote to memory of 872	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	93
PID 2168 wrote to memory of 872	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	93
PID 2168 wrote to memory of 2544	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	94
PID 2168 wrote to memory of 2544	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	94
PID 2168 wrote to memory of 4592	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	95
PID 2168 wrote to memory of 4592	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	95
PID 2168 wrote to memory of 3416	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	96
PID 2168 wrote to memory of 3416	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	96
PID 2168 wrote to memory of 1992	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	97
PID 2168 wrote to memory of 1992	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	97
PID 2168 wrote to memory of 4956	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	98
PID 2168 wrote to memory of 4956	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	98
PID 2168 wrote to memory of 4408	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	99
PID 2168 wrote to memory of 4408	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	99
PID 2168 wrote to memory of 4040	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	100
PID 2168 wrote to memory of 4040	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	100
PID 2168 wrote to memory of 2328	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	101
PID 2168 wrote to memory of 2328	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	101
PID 2168 wrote to memory of 2708	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	102
PID 2168 wrote to memory of 2708	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	102
PID 2168 wrote to memory of 2368	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	103
PID 2168 wrote to memory of 2368	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	103
PID 2168 wrote to memory of 4584	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	104
PID 2168 wrote to memory of 4584	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	104
PID 2168 wrote to memory of 4440	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	105
PID 2168 wrote to memory of 4440	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	105
PID 2168 wrote to memory of 2724	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	106
PID 2168 wrote to memory of 2724	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	106
PID 2168 wrote to memory of 4116	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	107
PID 2168 wrote to memory of 4116	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	107
PID 2168 wrote to memory of 4952	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	108
PID 2168 wrote to memory of 4952	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	108
PID 2168 wrote to memory of 5092	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	109
PID 2168 wrote to memory of 5092	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	109
PID 2168 wrote to memory of 1876	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	110
PID 2168 wrote to memory of 1876	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	110
PID 2168 wrote to memory of 1064	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	111
PID 2168 wrote to memory of 1064	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	111
PID 2168 wrote to memory of 892	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	112
PID 2168 wrote to memory of 892	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	112
PID 2168 wrote to memory of 396	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	113
PID 2168 wrote to memory of 396	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	113
PID 2168 wrote to memory of 2448	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	114
PID 2168 wrote to memory of 2448	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	114
PID 2168 wrote to memory of 5048	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	115
PID 2168 wrote to memory of 5048	2168	ede98418aaf38b24e9ef828a008b09b0N.exe	115

C:\Users\Admin\AppData\Local\Temp\ede98418aaf38b24e9ef828a008b09b0N.exe
"C:\Users\Admin\AppData\Local\Temp\ede98418aaf38b24e9ef828a008b09b0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\System\GVqkird.exe
  C:\Windows\System\GVqkird.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\XOPolyX.exe
  C:\Windows\System\XOPolyX.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\wblEkvH.exe
  C:\Windows\System\wblEkvH.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\wQwoPzD.exe
  C:\Windows\System\wQwoPzD.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\DcEglZn.exe
  C:\Windows\System\DcEglZn.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\rPtubWU.exe
  C:\Windows\System\rPtubWU.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\lbhXyUk.exe
  C:\Windows\System\lbhXyUk.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\UtjrOpn.exe
  C:\Windows\System\UtjrOpn.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\UwXCUsb.exe
  C:\Windows\System\UwXCUsb.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\RAVdyGL.exe
  C:\Windows\System\RAVdyGL.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\mGILVgZ.exe
  C:\Windows\System\mGILVgZ.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\EMLXfvc.exe
  C:\Windows\System\EMLXfvc.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\RLsDdwy.exe
  C:\Windows\System\RLsDdwy.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\TrEKZkh.exe
  C:\Windows\System\TrEKZkh.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\AJWwxeF.exe
  C:\Windows\System\AJWwxeF.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\WEiKOZt.exe
  C:\Windows\System\WEiKOZt.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\tREfojO.exe
  C:\Windows\System\tREfojO.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\zLCOLWD.exe
  C:\Windows\System\zLCOLWD.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\ifKYsjc.exe
  C:\Windows\System\ifKYsjc.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\uLUePxj.exe
  C:\Windows\System\uLUePxj.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\oKbJxiH.exe
  C:\Windows\System\oKbJxiH.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\QxPvbFJ.exe
  C:\Windows\System\QxPvbFJ.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\RpLbdzF.exe
  C:\Windows\System\RpLbdzF.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\ZcjsVXB.exe
  C:\Windows\System\ZcjsVXB.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\zAgZgCf.exe
  C:\Windows\System\zAgZgCf.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\TUUSAdC.exe
  C:\Windows\System\TUUSAdC.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\uBnRTIo.exe
  C:\Windows\System\uBnRTIo.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\BQZEVfq.exe
  C:\Windows\System\BQZEVfq.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\uffMGPn.exe
  C:\Windows\System\uffMGPn.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\ZvHtLtE.exe
  C:\Windows\System\ZvHtLtE.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\yxeZzSn.exe
  C:\Windows\System\yxeZzSn.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\hJwirAp.exe
  C:\Windows\System\hJwirAp.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\XcLsvFp.exe
  C:\Windows\System\XcLsvFp.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\ErQZzEJ.exe
  C:\Windows\System\ErQZzEJ.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ARRGmHL.exe
  C:\Windows\System\ARRGmHL.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\XBMGCEB.exe
  C:\Windows\System\XBMGCEB.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\nRbrmYp.exe
  C:\Windows\System\nRbrmYp.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\uJBCGfr.exe
  C:\Windows\System\uJBCGfr.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\GUAccOA.exe
  C:\Windows\System\GUAccOA.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\dcdaqwo.exe
  C:\Windows\System\dcdaqwo.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\wzSSblP.exe
  C:\Windows\System\wzSSblP.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\ccLLvHY.exe
  C:\Windows\System\ccLLvHY.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\RmFysNn.exe
  C:\Windows\System\RmFysNn.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\vLIimGH.exe
  C:\Windows\System\vLIimGH.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\gbNurYE.exe
  C:\Windows\System\gbNurYE.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\XcGiDvi.exe
  C:\Windows\System\XcGiDvi.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\mrhkzVo.exe
  C:\Windows\System\mrhkzVo.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\spOLMnm.exe
  C:\Windows\System\spOLMnm.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\KrJYNMN.exe
  C:\Windows\System\KrJYNMN.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\zHnRqYV.exe
  C:\Windows\System\zHnRqYV.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\aJzUxoZ.exe
  C:\Windows\System\aJzUxoZ.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\PXAHuSy.exe
  C:\Windows\System\PXAHuSy.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\YNvtUSz.exe
  C:\Windows\System\YNvtUSz.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\QJeZoVr.exe
  C:\Windows\System\QJeZoVr.exe
  2⤵
  PID:3112
- C:\Windows\System\SHcmYsA.exe
  C:\Windows\System\SHcmYsA.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\huMrfGW.exe
  C:\Windows\System\huMrfGW.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\MnDhjEM.exe
  C:\Windows\System\MnDhjEM.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\mAjQLYM.exe
  C:\Windows\System\mAjQLYM.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\FpAcVYD.exe
  C:\Windows\System\FpAcVYD.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\hwpgfXd.exe
  C:\Windows\System\hwpgfXd.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\AqTgpjI.exe
  C:\Windows\System\AqTgpjI.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\raqkOTo.exe
  C:\Windows\System\raqkOTo.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\tgQeEsu.exe
  C:\Windows\System\tgQeEsu.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\XNVnNhU.exe
  C:\Windows\System\XNVnNhU.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\motXcKA.exe
  C:\Windows\System\motXcKA.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\EPqiFHk.exe
  C:\Windows\System\EPqiFHk.exe
  2⤵
  PID:1776
- C:\Windows\System\aqefdAg.exe
  C:\Windows\System\aqefdAg.exe
  2⤵
  PID:3480
- C:\Windows\System\oWnkYsM.exe
  C:\Windows\System\oWnkYsM.exe
  2⤵
  PID:1456
- C:\Windows\System\ADWEBMX.exe
  C:\Windows\System\ADWEBMX.exe
  2⤵
  PID:1644
- C:\Windows\System\sDwKnCW.exe
  C:\Windows\System\sDwKnCW.exe
  2⤵
  PID:4692
- C:\Windows\System\pDmJYCE.exe
  C:\Windows\System\pDmJYCE.exe
  2⤵
  PID:1668
- C:\Windows\System\vkJdVil.exe
  C:\Windows\System\vkJdVil.exe
  2⤵
  PID:4596
- C:\Windows\System\fQaHvVZ.exe
  C:\Windows\System\fQaHvVZ.exe
  2⤵
  PID:1356
- C:\Windows\System\DrPpBSo.exe
  C:\Windows\System\DrPpBSo.exe
  2⤵
  PID:2184
- C:\Windows\System\KDhjaba.exe
  C:\Windows\System\KDhjaba.exe
  2⤵
  PID:3288
- C:\Windows\System\kurZmai.exe
  C:\Windows\System\kurZmai.exe
  2⤵
  PID:568
- C:\Windows\System\WaxYxhC.exe
  C:\Windows\System\WaxYxhC.exe
  2⤵
  PID:2024
- C:\Windows\System\Cyhottx.exe
  C:\Windows\System\Cyhottx.exe
  2⤵
  PID:968
- C:\Windows\System\VnBiqsC.exe
  C:\Windows\System\VnBiqsC.exe
  2⤵
  PID:3608
- C:\Windows\System\eSzHEft.exe
  C:\Windows\System\eSzHEft.exe
  2⤵
  PID:3440
- C:\Windows\System\dOcTbxW.exe
  C:\Windows\System\dOcTbxW.exe
  2⤵
  PID:2732
- C:\Windows\System\kbbUvme.exe
  C:\Windows\System\kbbUvme.exe
  2⤵
  PID:3056
- C:\Windows\System\uIuBIXx.exe
  C:\Windows\System\uIuBIXx.exe
  2⤵
  PID:1332
- C:\Windows\System\YdmiWwU.exe
  C:\Windows\System\YdmiWwU.exe
  2⤵
  PID:5124
- C:\Windows\System\ILsABzQ.exe
  C:\Windows\System\ILsABzQ.exe
  2⤵
  PID:5144
- C:\Windows\System\EyDdrJY.exe
  C:\Windows\System\EyDdrJY.exe
  2⤵
  PID:5160
- C:\Windows\System\SrarIVg.exe
  C:\Windows\System\SrarIVg.exe
  2⤵
  PID:5180
- C:\Windows\System\QKGSpSE.exe
  C:\Windows\System\QKGSpSE.exe
  2⤵
  PID:5212
- C:\Windows\System\napkgbk.exe
  C:\Windows\System\napkgbk.exe
  2⤵
  PID:5236
- C:\Windows\System\qzmvcIO.exe
  C:\Windows\System\qzmvcIO.exe
  2⤵
  PID:5252
- C:\Windows\System\nyKiDql.exe
  C:\Windows\System\nyKiDql.exe
  2⤵
  PID:5268
- C:\Windows\System\CsOJpum.exe
  C:\Windows\System\CsOJpum.exe
  2⤵
  PID:5292
- C:\Windows\System\IiZlaGh.exe
  C:\Windows\System\IiZlaGh.exe
  2⤵
  PID:5316
- C:\Windows\System\QsRqYyf.exe
  C:\Windows\System\QsRqYyf.exe
  2⤵
  PID:5332
- C:\Windows\System\bQCQhHu.exe
  C:\Windows\System\bQCQhHu.exe
  2⤵
  PID:5348
- C:\Windows\System\bVJudSi.exe
  C:\Windows\System\bVJudSi.exe
  2⤵
  PID:5404
- C:\Windows\System\cQqbgdE.exe
  C:\Windows\System\cQqbgdE.exe
  2⤵
  PID:5424
- C:\Windows\System\LJoFKsw.exe
  C:\Windows\System\LJoFKsw.exe
  2⤵
  PID:5452
- C:\Windows\System\gumvniR.exe
  C:\Windows\System\gumvniR.exe
  2⤵
  PID:5468
- C:\Windows\System\UXmLlbr.exe
  C:\Windows\System\UXmLlbr.exe
  2⤵
  PID:5504
- C:\Windows\System\LXfDXAp.exe
  C:\Windows\System\LXfDXAp.exe
  2⤵
  PID:5568
- C:\Windows\System\JJLTkQN.exe
  C:\Windows\System\JJLTkQN.exe
  2⤵
  PID:5592
- C:\Windows\System\aFrcjkT.exe
  C:\Windows\System\aFrcjkT.exe
  2⤵
  PID:5608
- C:\Windows\System\GMvxVkA.exe
  C:\Windows\System\GMvxVkA.exe
  2⤵
  PID:5624
- C:\Windows\System\qpuSOsI.exe
  C:\Windows\System\qpuSOsI.exe
  2⤵
  PID:5648
- C:\Windows\System\SxJSnvl.exe
  C:\Windows\System\SxJSnvl.exe
  2⤵
  PID:5668
- C:\Windows\System\KtdOvct.exe
  C:\Windows\System\KtdOvct.exe
  2⤵
  PID:5684
- C:\Windows\System\LjNzdDo.exe
  C:\Windows\System\LjNzdDo.exe
  2⤵
  PID:5708
- C:\Windows\System\IvDFufi.exe
  C:\Windows\System\IvDFufi.exe
  2⤵
  PID:5728
- C:\Windows\System\tNMvLmh.exe
  C:\Windows\System\tNMvLmh.exe
  2⤵
  PID:5744
- C:\Windows\System\wpvOLcD.exe
  C:\Windows\System\wpvOLcD.exe
  2⤵
  PID:5772
- C:\Windows\System\QWmULlL.exe
  C:\Windows\System\QWmULlL.exe
  2⤵
  PID:5788
- C:\Windows\System\wDdcBvC.exe
  C:\Windows\System\wDdcBvC.exe
  2⤵
  PID:5816
- C:\Windows\System\bkIchyS.exe
  C:\Windows\System\bkIchyS.exe
  2⤵
  PID:5836
- C:\Windows\System\crwGIen.exe
  C:\Windows\System\crwGIen.exe
  2⤵
  PID:5852
- C:\Windows\System\SJJnfOb.exe
  C:\Windows\System\SJJnfOb.exe
  2⤵
  PID:5872
- C:\Windows\System\wlPIqun.exe
  C:\Windows\System\wlPIqun.exe
  2⤵
  PID:5888
- C:\Windows\System\eaNfXhT.exe
  C:\Windows\System\eaNfXhT.exe
  2⤵
  PID:5912
- C:\Windows\System\KLBkcud.exe
  C:\Windows\System\KLBkcud.exe
  2⤵
  PID:5936
- C:\Windows\System\ahUrmwv.exe
  C:\Windows\System\ahUrmwv.exe
  2⤵
  PID:5952
- C:\Windows\System\jPlzzQL.exe
  C:\Windows\System\jPlzzQL.exe
  2⤵
  PID:5972
- C:\Windows\System\puPsYME.exe
  C:\Windows\System\puPsYME.exe
  2⤵
  PID:6000
- C:\Windows\System\yBPBRKU.exe
  C:\Windows\System\yBPBRKU.exe
  2⤵
  PID:6088
- C:\Windows\System\OaEXDRU.exe
  C:\Windows\System\OaEXDRU.exe
  2⤵
  PID:6108
- C:\Windows\System\gaieBMo.exe
  C:\Windows\System\gaieBMo.exe
  2⤵
  PID:6124
- C:\Windows\System\eRjjrzF.exe
  C:\Windows\System\eRjjrzF.exe
  2⤵
  PID:4280
- C:\Windows\System\brDGIaG.exe
  C:\Windows\System\brDGIaG.exe
  2⤵
  PID:1696
- C:\Windows\System\acpfPAl.exe
  C:\Windows\System\acpfPAl.exe
  2⤵
  PID:4492
- C:\Windows\System\lQEHjnh.exe
  C:\Windows\System\lQEHjnh.exe
  2⤵
  PID:3960
- C:\Windows\System\VWbfjFJ.exe
  C:\Windows\System\VWbfjFJ.exe
  2⤵
  PID:5300
- C:\Windows\System\ssIOpps.exe
  C:\Windows\System\ssIOpps.exe
  2⤵
  PID:5340
- C:\Windows\System\LgRWlMW.exe
  C:\Windows\System\LgRWlMW.exe
  2⤵
  PID:1612
- C:\Windows\System\dAdscsj.exe
  C:\Windows\System\dAdscsj.exe
  2⤵
  PID:1672
- C:\Windows\System\EHOwEcd.exe
  C:\Windows\System\EHOwEcd.exe
  2⤵
  PID:4984
- C:\Windows\System\ImPHfym.exe
  C:\Windows\System\ImPHfym.exe
  2⤵
  PID:3456
- C:\Windows\System\LoESbsC.exe
  C:\Windows\System\LoESbsC.exe
  2⤵
  PID:536
- C:\Windows\System\UMcNuzd.exe
  C:\Windows\System\UMcNuzd.exe
  2⤵
  PID:3084
- C:\Windows\System\tnvUmOE.exe
  C:\Windows\System\tnvUmOE.exe
  2⤵
  PID:1432
- C:\Windows\System\XZQyjCr.exe
  C:\Windows\System\XZQyjCr.exe
  2⤵
  PID:5176
- C:\Windows\System\XIBkCSx.exe
  C:\Windows\System\XIBkCSx.exe
  2⤵
  PID:5204
- C:\Windows\System\NHIozSm.exe
  C:\Windows\System\NHIozSm.exe
  2⤵
  PID:5228
- C:\Windows\System\MNdvhTf.exe
  C:\Windows\System\MNdvhTf.exe
  2⤵
  PID:5896
- C:\Windows\System\AMaxIQB.exe
  C:\Windows\System\AMaxIQB.exe
  2⤵
  PID:1488
- C:\Windows\System\SZRIkhC.exe
  C:\Windows\System\SZRIkhC.exe
  2⤵
  PID:1520
- C:\Windows\System\njQEBJQ.exe
  C:\Windows\System\njQEBJQ.exe
  2⤵
  PID:4400
- C:\Windows\System\CedZNxB.exe
  C:\Windows\System\CedZNxB.exe
  2⤵
  PID:3840
- C:\Windows\System\frwZesx.exe
  C:\Windows\System\frwZesx.exe
  2⤵
  PID:3520
- C:\Windows\System\hSzSBtK.exe
  C:\Windows\System\hSzSBtK.exe
  2⤵
  PID:5244
- C:\Windows\System\YjcvzgU.exe
  C:\Windows\System\YjcvzgU.exe
  2⤵
  PID:5360
- C:\Windows\System\gbxgQeU.exe
  C:\Windows\System\gbxgQeU.exe
  2⤵
  PID:5416
- C:\Windows\System\iIdLACA.exe
  C:\Windows\System\iIdLACA.exe
  2⤵
  PID:5460
- C:\Windows\System\UvTeHOD.exe
  C:\Windows\System\UvTeHOD.exe
  2⤵
  PID:5516
- C:\Windows\System\VgYFNKS.exe
  C:\Windows\System\VgYFNKS.exe
  2⤵
  PID:5548
- C:\Windows\System\ekAvfHl.exe
  C:\Windows\System\ekAvfHl.exe
  2⤵
  PID:5564
- C:\Windows\System\ZlkeZgl.exe
  C:\Windows\System\ZlkeZgl.exe
  2⤵
  PID:5656
- C:\Windows\System\pJTyCDU.exe
  C:\Windows\System\pJTyCDU.exe
  2⤵
  PID:5980
- C:\Windows\System\GiaZFhL.exe
  C:\Windows\System\GiaZFhL.exe
  2⤵
  PID:6060
- C:\Windows\System\uRnXlqj.exe
  C:\Windows\System\uRnXlqj.exe
  2⤵
  PID:5704
- C:\Windows\System\SWYsqby.exe
  C:\Windows\System\SWYsqby.exe
  2⤵
  PID:5832
- C:\Windows\System\ecshJFY.exe
  C:\Windows\System\ecshJFY.exe
  2⤵
  PID:5880
- C:\Windows\System\pMtIxnx.exe
  C:\Windows\System\pMtIxnx.exe
  2⤵
  PID:5948
- C:\Windows\System\bZqUbbT.exe
  C:\Windows\System\bZqUbbT.exe
  2⤵
  PID:6152
- C:\Windows\System\UoFTmdv.exe
  C:\Windows\System\UoFTmdv.exe
  2⤵
  PID:6172
- C:\Windows\System\NCQNlse.exe
  C:\Windows\System\NCQNlse.exe
  2⤵
  PID:6208
- C:\Windows\System\VrZjssV.exe
  C:\Windows\System\VrZjssV.exe
  2⤵
  PID:6224
- C:\Windows\System\athpnjF.exe
  C:\Windows\System\athpnjF.exe
  2⤵
  PID:6240
- C:\Windows\System\guGGePv.exe
  C:\Windows\System\guGGePv.exe
  2⤵
  PID:6396
- C:\Windows\System\MqIMKHm.exe
  C:\Windows\System\MqIMKHm.exe
  2⤵
  PID:6444
- C:\Windows\System\XUCOutD.exe
  C:\Windows\System\XUCOutD.exe
  2⤵
  PID:6460
- C:\Windows\System\RgIdVfh.exe
  C:\Windows\System\RgIdVfh.exe
  2⤵
  PID:6480
- C:\Windows\System\THjppDm.exe
  C:\Windows\System\THjppDm.exe
  2⤵
  PID:6508
- C:\Windows\System\tARdhLe.exe
  C:\Windows\System\tARdhLe.exe
  2⤵
  PID:6524
- C:\Windows\System\xymOEOP.exe
  C:\Windows\System\xymOEOP.exe
  2⤵
  PID:6544
- C:\Windows\System\qKmJkMG.exe
  C:\Windows\System\qKmJkMG.exe
  2⤵
  PID:6568
- C:\Windows\System\RWkqiYv.exe
  C:\Windows\System\RWkqiYv.exe
  2⤵
  PID:6584
- C:\Windows\System\MAjgRfn.exe
  C:\Windows\System\MAjgRfn.exe
  2⤵
  PID:6608
- C:\Windows\System\wwRCiUg.exe
  C:\Windows\System\wwRCiUg.exe
  2⤵
  PID:6632
- C:\Windows\System\TAnHDbi.exe
  C:\Windows\System\TAnHDbi.exe
  2⤵
  PID:6652
- C:\Windows\System\HzyUORh.exe
  C:\Windows\System\HzyUORh.exe
  2⤵
  PID:6676
- C:\Windows\System\UimQFcq.exe
  C:\Windows\System\UimQFcq.exe
  2⤵
  PID:6696
- C:\Windows\System\cgdWyXQ.exe
  C:\Windows\System\cgdWyXQ.exe
  2⤵
  PID:6812
- C:\Windows\System\vbEXewI.exe
  C:\Windows\System\vbEXewI.exe
  2⤵
  PID:6836
- C:\Windows\System\lipoUeM.exe
  C:\Windows\System\lipoUeM.exe
  2⤵
  PID:6860
- C:\Windows\System\EPKxgpU.exe
  C:\Windows\System\EPKxgpU.exe
  2⤵
  PID:6876
- C:\Windows\System\ggzyQFA.exe
  C:\Windows\System\ggzyQFA.exe
  2⤵
  PID:6896
- C:\Windows\System\Zmtjkzv.exe
  C:\Windows\System\Zmtjkzv.exe
  2⤵
  PID:6912
- C:\Windows\System\QTnYpEM.exe
  C:\Windows\System\QTnYpEM.exe
  2⤵
  PID:6944
- C:\Windows\System\lkCnQdp.exe
  C:\Windows\System\lkCnQdp.exe
  2⤵
  PID:6972
- C:\Windows\System\ZEfsQdI.exe
  C:\Windows\System\ZEfsQdI.exe
  2⤵
  PID:6992
- C:\Windows\System\khPbtpA.exe
  C:\Windows\System\khPbtpA.exe
  2⤵
  PID:7016
- C:\Windows\System\oianoqb.exe
  C:\Windows\System\oianoqb.exe
  2⤵
  PID:7036
- C:\Windows\System\lhOxdza.exe
  C:\Windows\System\lhOxdza.exe
  2⤵
  PID:7060
- C:\Windows\System\HcKceCf.exe
  C:\Windows\System\HcKceCf.exe
  2⤵
  PID:7088
- C:\Windows\System\IPxjnvG.exe
  C:\Windows\System\IPxjnvG.exe
  2⤵
  PID:7116
- C:\Windows\System\rvbznWb.exe
  C:\Windows\System\rvbznWb.exe
  2⤵
  PID:7144
- C:\Windows\System\NHfIfSb.exe
  C:\Windows\System\NHfIfSb.exe
  2⤵
  PID:7164
- C:\Windows\System\HohfSoy.exe
  C:\Windows\System\HohfSoy.exe
  2⤵
  PID:4852
- C:\Windows\System\vfrrtQC.exe
  C:\Windows\System\vfrrtQC.exe
  2⤵
  PID:6100
- C:\Windows\System\qFLfiNB.exe
  C:\Windows\System\qFLfiNB.exe
  2⤵
  PID:2100
- C:\Windows\System\brVnIGK.exe
  C:\Windows\System\brVnIGK.exe
  2⤵
  PID:5764
- C:\Windows\System\YEZluXW.exe
  C:\Windows\System\YEZluXW.exe
  2⤵
  PID:5944
- C:\Windows\System\QqFCCfg.exe
  C:\Windows\System\QqFCCfg.exe
  2⤵
  PID:4732
- C:\Windows\System\sWdNOBE.exe
  C:\Windows\System\sWdNOBE.exe
  2⤵
  PID:6500
- C:\Windows\System\xSUpiVm.exe
  C:\Windows\System\xSUpiVm.exe
  2⤵
  PID:6540
- C:\Windows\System\grVLETJ.exe
  C:\Windows\System\grVLETJ.exe
  2⤵
  PID:6616
- C:\Windows\System\QglTCAi.exe
  C:\Windows\System\QglTCAi.exe
  2⤵
  PID:6692
- C:\Windows\System\PmAtKqi.exe
  C:\Windows\System\PmAtKqi.exe
  2⤵
  PID:5328
- C:\Windows\System\CXVPXDR.exe
  C:\Windows\System\CXVPXDR.exe
  2⤵
  PID:7192
- C:\Windows\System\wAfHhwP.exe
  C:\Windows\System\wAfHhwP.exe
  2⤵
  PID:7208
- C:\Windows\System\EiFxjxT.exe
  C:\Windows\System\EiFxjxT.exe
  2⤵
  PID:7224
- C:\Windows\System\wcbsUJo.exe
  C:\Windows\System\wcbsUJo.exe
  2⤵
  PID:7268
- C:\Windows\System\EcHAJEd.exe
  C:\Windows\System\EcHAJEd.exe
  2⤵
  PID:7296
- C:\Windows\System\JRVZNcV.exe
  C:\Windows\System\JRVZNcV.exe
  2⤵
  PID:7332
- C:\Windows\System\qYQcdKX.exe
  C:\Windows\System\qYQcdKX.exe
  2⤵
  PID:7352
- C:\Windows\System\clrNENS.exe
  C:\Windows\System\clrNENS.exe
  2⤵
  PID:7372
- C:\Windows\System\cdpXQWB.exe
  C:\Windows\System\cdpXQWB.exe
  2⤵
  PID:7396
- C:\Windows\System\CKQXivK.exe
  C:\Windows\System\CKQXivK.exe
  2⤵
  PID:7416
- C:\Windows\System\CjExovw.exe
  C:\Windows\System\CjExovw.exe
  2⤵
  PID:7436
- C:\Windows\System\sOXKeiY.exe
  C:\Windows\System\sOXKeiY.exe
  2⤵
  PID:7460
- C:\Windows\System\kBjJXTs.exe
  C:\Windows\System\kBjJXTs.exe
  2⤵
  PID:7480
- C:\Windows\System\dFnUrQE.exe
  C:\Windows\System\dFnUrQE.exe
  2⤵
  PID:7500
- C:\Windows\System\LTxBDTJ.exe
  C:\Windows\System\LTxBDTJ.exe
  2⤵
  PID:7524
- C:\Windows\System\YJLOBYE.exe
  C:\Windows\System\YJLOBYE.exe
  2⤵
  PID:7540
- C:\Windows\System\CUIDowE.exe
  C:\Windows\System\CUIDowE.exe
  2⤵
  PID:7568
- C:\Windows\System\ngDROXg.exe
  C:\Windows\System\ngDROXg.exe
  2⤵
  PID:7596
- C:\Windows\System\TbZFDft.exe
  C:\Windows\System\TbZFDft.exe
  2⤵
  PID:7616
- C:\Windows\System\JhmGAUE.exe
  C:\Windows\System\JhmGAUE.exe
  2⤵
  PID:7636
- C:\Windows\System\fAhstbH.exe
  C:\Windows\System\fAhstbH.exe
  2⤵
  PID:7656
- C:\Windows\System\XmYVKsw.exe
  C:\Windows\System\XmYVKsw.exe
  2⤵
  PID:7676
- C:\Windows\System\mpKdCob.exe
  C:\Windows\System\mpKdCob.exe
  2⤵
  PID:7700
- C:\Windows\System\RAsctgm.exe
  C:\Windows\System\RAsctgm.exe
  2⤵
  PID:7716
- C:\Windows\System\zJpKKLF.exe
  C:\Windows\System\zJpKKLF.exe
  2⤵
  PID:7740
- C:\Windows\System\OqWlmVn.exe
  C:\Windows\System\OqWlmVn.exe
  2⤵
  PID:7764
- C:\Windows\System\oqoGKcp.exe
  C:\Windows\System\oqoGKcp.exe
  2⤵
  PID:7780
- C:\Windows\System\AKWPdPi.exe
  C:\Windows\System\AKWPdPi.exe
  2⤵
  PID:7800
- C:\Windows\System\aARQZxa.exe
  C:\Windows\System\aARQZxa.exe
  2⤵
  PID:7820
- C:\Windows\System\ayQbchQ.exe
  C:\Windows\System\ayQbchQ.exe
  2⤵
  PID:7840
- C:\Windows\System\JrUvBEU.exe
  C:\Windows\System\JrUvBEU.exe
  2⤵
  PID:7860
- C:\Windows\System\JYqiPnc.exe
  C:\Windows\System\JYqiPnc.exe
  2⤵
  PID:7880
- C:\Windows\System\BRarWNG.exe
  C:\Windows\System\BRarWNG.exe
  2⤵
  PID:7924
- C:\Windows\System\SCAZYwE.exe
  C:\Windows\System\SCAZYwE.exe
  2⤵
  PID:7940
- C:\Windows\System\PqsIMVb.exe
  C:\Windows\System\PqsIMVb.exe
  2⤵
  PID:7960
- C:\Windows\System\mtuAfcq.exe
  C:\Windows\System\mtuAfcq.exe
  2⤵
  PID:7984
- C:\Windows\System\RIGrLtW.exe
  C:\Windows\System\RIGrLtW.exe
  2⤵
  PID:8008
- C:\Windows\System\NdNzowz.exe
  C:\Windows\System\NdNzowz.exe
  2⤵
  PID:8024
- C:\Windows\System\aAqXRZP.exe
  C:\Windows\System\aAqXRZP.exe
  2⤵
  PID:8048
- C:\Windows\System\nOlMRUg.exe
  C:\Windows\System\nOlMRUg.exe
  2⤵
  PID:8076
- C:\Windows\System\naVjdPE.exe
  C:\Windows\System\naVjdPE.exe
  2⤵
  PID:8108
- C:\Windows\System\swkXepr.exe
  C:\Windows\System\swkXepr.exe
  2⤵
  PID:8124
- C:\Windows\System\Noclvfq.exe
  C:\Windows\System\Noclvfq.exe
  2⤵
  PID:8152
- C:\Windows\System\XMZfrar.exe
  C:\Windows\System\XMZfrar.exe
  2⤵
  PID:8168
- C:\Windows\System\abQQucn.exe
  C:\Windows\System\abQQucn.exe
  2⤵
  PID:3980
- C:\Windows\System\nLCMZOT.exe
  C:\Windows\System\nLCMZOT.exe
  2⤵
  PID:5480
- C:\Windows\System\kcOsQGZ.exe
  C:\Windows\System\kcOsQGZ.exe
  2⤵
  PID:5796
- C:\Windows\System\DUwVhhW.exe
  C:\Windows\System\DUwVhhW.exe
  2⤵
  PID:5784
- C:\Windows\System\pkxzJCD.exe
  C:\Windows\System\pkxzJCD.exe
  2⤵
  PID:5996
- C:\Windows\System\HEsXOCG.exe
  C:\Windows\System\HEsXOCG.exe
  2⤵
  PID:6832
- C:\Windows\System\yGdbbMC.exe
  C:\Windows\System\yGdbbMC.exe
  2⤵
  PID:6892
- C:\Windows\System\HxlvsTP.exe
  C:\Windows\System\HxlvsTP.exe
  2⤵
  PID:6428
- C:\Windows\System\liAMOKI.exe
  C:\Windows\System\liAMOKI.exe
  2⤵
  PID:5904
- C:\Windows\System\plzpCwl.exe
  C:\Windows\System\plzpCwl.exe
  2⤵
  PID:5636
- C:\Windows\System\snczfPo.exe
  C:\Windows\System\snczfPo.exe
  2⤵
  PID:5392
- C:\Windows\System\qVzEuJS.exe
  C:\Windows\System\qVzEuJS.exe
  2⤵
  PID:4928
- C:\Windows\System\osgKTbe.exe
  C:\Windows\System\osgKTbe.exe
  2⤵
  PID:5156
- C:\Windows\System\XZHNbCB.exe
  C:\Windows\System\XZHNbCB.exe
  2⤵
  PID:6924
- C:\Windows\System\YOFrUvQ.exe
  C:\Windows\System\YOFrUvQ.exe
  2⤵
  PID:6988
- C:\Windows\System\aZjucgw.exe
  C:\Windows\System\aZjucgw.exe
  2⤵
  PID:6628
- C:\Windows\System\xVaeDyd.exe
  C:\Windows\System\xVaeDyd.exe
  2⤵
  PID:6688
- C:\Windows\System\EwTSAMk.exe
  C:\Windows\System\EwTSAMk.exe
  2⤵
  PID:7132
- C:\Windows\System\LDYlgbH.exe
  C:\Windows\System\LDYlgbH.exe
  2⤵
  PID:2864
- C:\Windows\System\fUViVmo.exe
  C:\Windows\System\fUViVmo.exe
  2⤵
  PID:6232
- C:\Windows\System\brDeBpF.exe
  C:\Windows\System\brDeBpF.exe
  2⤵
  PID:6684
- C:\Windows\System\IJeWhwk.exe
  C:\Windows\System\IJeWhwk.exe
  2⤵
  PID:6248
- C:\Windows\System\DdqACZF.exe
  C:\Windows\System\DdqACZF.exe
  2⤵
  PID:7492
- C:\Windows\System\ZbsqXuv.exe
  C:\Windows\System\ZbsqXuv.exe
  2⤵
  PID:7520
- C:\Windows\System\qiPfmGS.exe
  C:\Windows\System\qiPfmGS.exe
  2⤵
  PID:7632
- C:\Windows\System\OxXecZU.exe
  C:\Windows\System\OxXecZU.exe
  2⤵
  PID:7760
- C:\Windows\System\DJeNzUf.exe
  C:\Windows\System\DJeNzUf.exe
  2⤵
  PID:6476
- C:\Windows\System\VrVQhGN.exe
  C:\Windows\System\VrVQhGN.exe
  2⤵
  PID:7876
- C:\Windows\System\dxFGwJs.exe
  C:\Windows\System\dxFGwJs.exe
  2⤵
  PID:7108
- C:\Windows\System\VtHCIWM.exe
  C:\Windows\System\VtHCIWM.exe
  2⤵
  PID:7140
- C:\Windows\System\OUmDoWL.exe
  C:\Windows\System\OUmDoWL.exe
  2⤵
  PID:8200
- C:\Windows\System\TdIExpw.exe
  C:\Windows\System\TdIExpw.exe
  2⤵
  PID:8224
- C:\Windows\System\FSDpxgt.exe
  C:\Windows\System\FSDpxgt.exe
  2⤵
  PID:8240
- C:\Windows\System\JWnuQXB.exe
  C:\Windows\System\JWnuQXB.exe
  2⤵
  PID:8264
- C:\Windows\System\KYWpemM.exe
  C:\Windows\System\KYWpemM.exe
  2⤵
  PID:8288
- C:\Windows\System\pwdYosg.exe
  C:\Windows\System\pwdYosg.exe
  2⤵
  PID:8304
- C:\Windows\System\iWicJbx.exe
  C:\Windows\System\iWicJbx.exe
  2⤵
  PID:8328
- C:\Windows\System\VURkwBJ.exe
  C:\Windows\System\VURkwBJ.exe
  2⤵
  PID:8344
- C:\Windows\System\ZrqmKjv.exe
  C:\Windows\System\ZrqmKjv.exe
  2⤵
  PID:8440
- C:\Windows\System\bLIAVby.exe
  C:\Windows\System\bLIAVby.exe
  2⤵
  PID:8460
- C:\Windows\System\BrqgaEu.exe
  C:\Windows\System\BrqgaEu.exe
  2⤵
  PID:8476
- C:\Windows\System\JCJfskO.exe
  C:\Windows\System\JCJfskO.exe
  2⤵
  PID:8500
- C:\Windows\System\ARztmci.exe
  C:\Windows\System\ARztmci.exe
  2⤵
  PID:8516
- C:\Windows\System\pJunWYB.exe
  C:\Windows\System\pJunWYB.exe
  2⤵
  PID:8540
- C:\Windows\System\azdfVzH.exe
  C:\Windows\System\azdfVzH.exe
  2⤵
  PID:8564
- C:\Windows\System\wMZQDqx.exe
  C:\Windows\System\wMZQDqx.exe
  2⤵
  PID:8584
- C:\Windows\System\kCPDuJh.exe
  C:\Windows\System\kCPDuJh.exe
  2⤵
  PID:8608
- C:\Windows\System\WgQMoKW.exe
  C:\Windows\System\WgQMoKW.exe
  2⤵
  PID:8624
- C:\Windows\System\attAHJs.exe
  C:\Windows\System\attAHJs.exe
  2⤵
  PID:8648
- C:\Windows\System\UVjPkUJ.exe
  C:\Windows\System\UVjPkUJ.exe
  2⤵
  PID:8672
- C:\Windows\System\HtpfbSE.exe
  C:\Windows\System\HtpfbSE.exe
  2⤵
  PID:8692
- C:\Windows\System\jGWEgJD.exe
  C:\Windows\System\jGWEgJD.exe
  2⤵
  PID:8712
- C:\Windows\System\qkqVJvK.exe
  C:\Windows\System\qkqVJvK.exe
  2⤵
  PID:8736
- C:\Windows\System\DLbhKJu.exe
  C:\Windows\System\DLbhKJu.exe
  2⤵
  PID:8760
- C:\Windows\System\lBaNXXj.exe
  C:\Windows\System\lBaNXXj.exe
  2⤵
  PID:8792
- C:\Windows\System\SlMUGwL.exe
  C:\Windows\System\SlMUGwL.exe
  2⤵
  PID:8812
- C:\Windows\System\sqKWSPg.exe
  C:\Windows\System\sqKWSPg.exe
  2⤵
  PID:8840
- C:\Windows\System\jQzEtpr.exe
  C:\Windows\System\jQzEtpr.exe
  2⤵
  PID:8856
- C:\Windows\System\UpYtpck.exe
  C:\Windows\System\UpYtpck.exe
  2⤵
  PID:8872
- C:\Windows\System\nlRKusj.exe
  C:\Windows\System\nlRKusj.exe
  2⤵
  PID:9084
- C:\Windows\System\OHibohI.exe
  C:\Windows\System\OHibohI.exe
  2⤵
  PID:9104
- C:\Windows\System\XUdggPH.exe
  C:\Windows\System\XUdggPH.exe
  2⤵
  PID:9120
- C:\Windows\System\GdMvwCQ.exe
  C:\Windows\System\GdMvwCQ.exe
  2⤵
  PID:9136
- C:\Windows\System\TWEhwhi.exe
  C:\Windows\System\TWEhwhi.exe
  2⤵
  PID:9152
- C:\Windows\System\LlWfgkT.exe
  C:\Windows\System\LlWfgkT.exe
  2⤵
  PID:9168
- C:\Windows\System\pKKsgbS.exe
  C:\Windows\System\pKKsgbS.exe
  2⤵
  PID:9196
- C:\Windows\System\mzxyXET.exe
  C:\Windows\System\mzxyXET.exe
  2⤵
  PID:9212
- C:\Windows\System\FTisyRy.exe
  C:\Windows\System\FTisyRy.exe
  2⤵
  PID:4276
- C:\Windows\System\WuqQIpz.exe
  C:\Windows\System\WuqQIpz.exe
  2⤵
  PID:8144
- C:\Windows\System\eRuOmSj.exe
  C:\Windows\System\eRuOmSj.exe
  2⤵
  PID:6772
- C:\Windows\System\GfnFwau.exe
  C:\Windows\System\GfnFwau.exe
  2⤵
  PID:6804
- C:\Windows\System\XtIvAkZ.exe
  C:\Windows\System\XtIvAkZ.exe
  2⤵
  PID:7672
- C:\Windows\System\MxdNBAY.exe
  C:\Windows\System\MxdNBAY.exe
  2⤵
  PID:7736
- C:\Windows\System\shbrREL.exe
  C:\Windows\System\shbrREL.exe
  2⤵
  PID:7796
- C:\Windows\System\rPRMRvB.exe
  C:\Windows\System\rPRMRvB.exe
  2⤵
  PID:7772
- C:\Windows\System\BxjefAw.exe
  C:\Windows\System\BxjefAw.exe
  2⤵
  PID:6576
- C:\Windows\System\xTohZBe.exe
  C:\Windows\System\xTohZBe.exe
  2⤵
  PID:7852
- C:\Windows\System\NhQTUeG.exe
  C:\Windows\System\NhQTUeG.exe
  2⤵
  PID:7904
- C:\Windows\System\cxWTNsA.exe
  C:\Windows\System\cxWTNsA.exe
  2⤵
  PID:8208
- C:\Windows\System\hBXHcQs.exe
  C:\Windows\System\hBXHcQs.exe
  2⤵
  PID:8060
- C:\Windows\System\APbxYxh.exe
  C:\Windows\System\APbxYxh.exe
  2⤵
  PID:8088
- C:\Windows\System\cIfnnxv.exe
  C:\Windows\System\cIfnnxv.exe
  2⤵
  PID:7304
- C:\Windows\System\QPLfWgq.exe
  C:\Windows\System\QPLfWgq.exe
  2⤵
  PID:7344
- C:\Windows\System\rSatkks.exe
  C:\Windows\System\rSatkks.exe
  2⤵
  PID:7380
- C:\Windows\System\BNmDyzo.exe
  C:\Windows\System\BNmDyzo.exe
  2⤵
  PID:7428
- C:\Windows\System\riFDxHr.exe
  C:\Windows\System\riFDxHr.exe
  2⤵
  PID:7476
- C:\Windows\System\vaJjpJf.exe
  C:\Windows\System\vaJjpJf.exe
  2⤵
  PID:7584
- C:\Windows\System\AgyXKEO.exe
  C:\Windows\System\AgyXKEO.exe
  2⤵
  PID:4924
- C:\Windows\System\WITXTFF.exe
  C:\Windows\System\WITXTFF.exe
  2⤵
  PID:7056
- C:\Windows\System\sHzyDqY.exe
  C:\Windows\System\sHzyDqY.exe
  2⤵
  PID:7508
- C:\Windows\System\yGwsJos.exe
  C:\Windows\System\yGwsJos.exe
  2⤵
  PID:8936
- C:\Windows\System\NZmdLNi.exe
  C:\Windows\System\NZmdLNi.exe
  2⤵
  PID:8120
- C:\Windows\System\LsPgPNZ.exe
  C:\Windows\System\LsPgPNZ.exe
  2⤵
  PID:8176
- C:\Windows\System\DfKaaPj.exe
  C:\Windows\System\DfKaaPj.exe
  2⤵
  PID:2816
- C:\Windows\System\cXSgfKa.exe
  C:\Windows\System\cXSgfKa.exe
  2⤵
  PID:5560
- C:\Windows\System\zamiLHf.exe
  C:\Windows\System\zamiLHf.exe
  2⤵
  PID:5700
- C:\Windows\System\seCSQQz.exe
  C:\Windows\System\seCSQQz.exe
  2⤵
  PID:6188
- C:\Windows\System\CNULbKd.exe
  C:\Windows\System\CNULbKd.exe
  2⤵
  PID:6408
- C:\Windows\System\UefmBsl.exe
  C:\Windows\System\UefmBsl.exe
  2⤵
  PID:5736
- C:\Windows\System\IzGkTWR.exe
  C:\Windows\System\IzGkTWR.exe
  2⤵
  PID:4348
- C:\Windows\System\HjKNFOl.exe
  C:\Windows\System\HjKNFOl.exe
  2⤵
  PID:7624
- C:\Windows\System\NVfsLVD.exe
  C:\Windows\System\NVfsLVD.exe
  2⤵
  PID:7628
- C:\Windows\System\KGMrjbN.exe
  C:\Windows\System\KGMrjbN.exe
  2⤵
  PID:6252
- C:\Windows\System\WEcdEOS.exe
  C:\Windows\System\WEcdEOS.exe
  2⤵
  PID:7948
- C:\Windows\System\tmfRnPe.exe
  C:\Windows\System\tmfRnPe.exe
  2⤵
  PID:9228
- C:\Windows\System\NBssIwk.exe
  C:\Windows\System\NBssIwk.exe
  2⤵
  PID:9252
- C:\Windows\System\dZonzhb.exe
  C:\Windows\System\dZonzhb.exe
  2⤵
  PID:9272
- C:\Windows\System\bffkqOL.exe
  C:\Windows\System\bffkqOL.exe
  2⤵
  PID:9292
- C:\Windows\System\yAmzmDd.exe
  C:\Windows\System\yAmzmDd.exe
  2⤵
  PID:9316
- C:\Windows\System\ZHfQBOc.exe
  C:\Windows\System\ZHfQBOc.exe
  2⤵
  PID:9340
- C:\Windows\System\MIzXoVc.exe
  C:\Windows\System\MIzXoVc.exe
  2⤵
  PID:9356
- C:\Windows\System\JciAKeu.exe
  C:\Windows\System\JciAKeu.exe
  2⤵
  PID:9380
- C:\Windows\System\MNgNUHP.exe
  C:\Windows\System\MNgNUHP.exe
  2⤵
  PID:9404
- C:\Windows\System\vtfaFMq.exe
  C:\Windows\System\vtfaFMq.exe
  2⤵
  PID:9432
- C:\Windows\System\giyAFqZ.exe
  C:\Windows\System\giyAFqZ.exe
  2⤵
  PID:9448
- C:\Windows\System\gkvvGQk.exe
  C:\Windows\System\gkvvGQk.exe
  2⤵
  PID:9476
- C:\Windows\System\gtoibFQ.exe
  C:\Windows\System\gtoibFQ.exe
  2⤵
  PID:9492
- C:\Windows\System\jwRmpFW.exe
  C:\Windows\System\jwRmpFW.exe
  2⤵
  PID:9516
- C:\Windows\System\SnuldZG.exe
  C:\Windows\System\SnuldZG.exe
  2⤵
  PID:9540
- C:\Windows\System\PkPPrfU.exe
  C:\Windows\System\PkPPrfU.exe
  2⤵
  PID:9564
- C:\Windows\System\KMSHqUo.exe
  C:\Windows\System\KMSHqUo.exe
  2⤵
  PID:9588
- C:\Windows\System\iJCjxyO.exe
  C:\Windows\System\iJCjxyO.exe
  2⤵
  PID:9612
- C:\Windows\System\RyRwqVW.exe
  C:\Windows\System\RyRwqVW.exe
  2⤵
  PID:9636
- C:\Windows\System\WtQtcSq.exe
  C:\Windows\System\WtQtcSq.exe
  2⤵
  PID:9660
- C:\Windows\System\inJzSLo.exe
  C:\Windows\System\inJzSLo.exe
  2⤵
  PID:9680
- C:\Windows\System\UxaDXwF.exe
  C:\Windows\System\UxaDXwF.exe
  2⤵
  PID:9880
- C:\Windows\System\EDHToqD.exe
  C:\Windows\System\EDHToqD.exe
  2⤵
  PID:9896
- C:\Windows\System\vOhCrXh.exe
  C:\Windows\System\vOhCrXh.exe
  2⤵
  PID:9912
- C:\Windows\System\GsnSrHF.exe
  C:\Windows\System\GsnSrHF.exe
  2⤵
  PID:9928
- C:\Windows\System\caUKbgg.exe
  C:\Windows\System\caUKbgg.exe
  2⤵
  PID:9944
- C:\Windows\System\EfgxuFi.exe
  C:\Windows\System\EfgxuFi.exe
  2⤵
  PID:9960
- C:\Windows\System\mazgYks.exe
  C:\Windows\System\mazgYks.exe
  2⤵
  PID:9976
- C:\Windows\System\DKBYdcD.exe
  C:\Windows\System\DKBYdcD.exe
  2⤵
  PID:9992
- C:\Windows\System\TVTivXW.exe
  C:\Windows\System\TVTivXW.exe
  2⤵
  PID:10008
- C:\Windows\System\yXqjBAB.exe
  C:\Windows\System\yXqjBAB.exe
  2⤵
  PID:10024
- C:\Windows\System\QLsmzRg.exe
  C:\Windows\System\QLsmzRg.exe
  2⤵
  PID:10040
- C:\Windows\System\VcJjZgl.exe
  C:\Windows\System\VcJjZgl.exe
  2⤵
  PID:10056
- C:\Windows\System\AWozOcp.exe
  C:\Windows\System\AWozOcp.exe
  2⤵
  PID:10072
- C:\Windows\System\eXqWUmi.exe
  C:\Windows\System\eXqWUmi.exe
  2⤵
  PID:10092
- C:\Windows\System\LcmNkxs.exe
  C:\Windows\System\LcmNkxs.exe
  2⤵
  PID:10116
- C:\Windows\System\fEGaRLu.exe
  C:\Windows\System\fEGaRLu.exe
  2⤵
  PID:10132
- C:\Windows\System\MKwKedU.exe
  C:\Windows\System\MKwKedU.exe
  2⤵
  PID:10148
- C:\Windows\System\RmBaoZX.exe
  C:\Windows\System\RmBaoZX.exe
  2⤵
  PID:10164
- C:\Windows\System\sAlzTHw.exe
  C:\Windows\System\sAlzTHw.exe
  2⤵
  PID:10180
- C:\Windows\System\iyBVOKH.exe
  C:\Windows\System\iyBVOKH.exe
  2⤵
  PID:10204
- C:\Windows\System\RdMzkDB.exe
  C:\Windows\System\RdMzkDB.exe
  2⤵
  PID:10224
- C:\Windows\System\wDKLdbq.exe
  C:\Windows\System\wDKLdbq.exe
  2⤵
  PID:8388
- C:\Windows\System\BMugEce.exe
  C:\Windows\System\BMugEce.exe
  2⤵
  PID:8416
- C:\Windows\System\sBDgdNn.exe
  C:\Windows\System\sBDgdNn.exe
  2⤵
  PID:8456
- C:\Windows\System\QMnErzv.exe
  C:\Windows\System\QMnErzv.exe
  2⤵
  PID:8536
- C:\Windows\System\TBmoadA.exe
  C:\Windows\System\TBmoadA.exe
  2⤵
  PID:8604
- C:\Windows\System\nkmMLFA.exe
  C:\Windows\System\nkmMLFA.exe
  2⤵
  PID:8684
- C:\Windows\System\uOLUdHN.exe
  C:\Windows\System\uOLUdHN.exe
  2⤵
  PID:8756
- C:\Windows\System\LDNtIUP.exe
  C:\Windows\System\LDNtIUP.exe
  2⤵
  PID:8832
- C:\Windows\System\oIhzUSD.exe
  C:\Windows\System\oIhzUSD.exe
  2⤵
  PID:8848
- C:\Windows\System\zefembA.exe
  C:\Windows\System\zefembA.exe
  2⤵
  PID:8680
- C:\Windows\System\JtqdEVX.exe
  C:\Windows\System\JtqdEVX.exe
  2⤵
  PID:8548
- C:\Windows\System\zWpzFyP.exe
  C:\Windows\System\zWpzFyP.exe
  2⤵
  PID:8452
- C:\Windows\System\eNbUwiw.exe
  C:\Windows\System\eNbUwiw.exe
  2⤵
  PID:8252
- C:\Windows\System\PiWWACF.exe
  C:\Windows\System\PiWWACF.exe
  2⤵
  PID:6708
- C:\Windows\System\fjVMLNg.exe
  C:\Windows\System\fjVMLNg.exe
  2⤵
  PID:8904
- C:\Windows\System\DfDbkmV.exe
  C:\Windows\System\DfDbkmV.exe
  2⤵
  PID:8956
- C:\Windows\System\VzkIhrP.exe
  C:\Windows\System\VzkIhrP.exe
  2⤵
  PID:9016
- C:\Windows\System\KaghvpI.exe
  C:\Windows\System\KaghvpI.exe
  2⤵
  PID:9116
- C:\Windows\System\BqLNYek.exe
  C:\Windows\System\BqLNYek.exe
  2⤵
  PID:6136
- C:\Windows\System\sNMNSrq.exe
  C:\Windows\System\sNMNSrq.exe
  2⤵
  PID:7776
- C:\Windows\System\xagWfjC.exe
  C:\Windows\System\xagWfjC.exe
  2⤵
  PID:6856
- C:\Windows\System\pXpNtyC.exe
  C:\Windows\System\pXpNtyC.exe
  2⤵
  PID:6940
- C:\Windows\System\QdbAlME.exe
  C:\Windows\System\QdbAlME.exe
  2⤵
  PID:9224
- C:\Windows\System\VWkADwu.exe
  C:\Windows\System\VWkADwu.exe
  2⤵
  PID:9288
- C:\Windows\System\NWsCopq.exe
  C:\Windows\System\NWsCopq.exe
  2⤵
  PID:9352
- C:\Windows\System\kxkBQmJ.exe
  C:\Windows\System\kxkBQmJ.exe
  2⤵
  PID:9416
- C:\Windows\System\OiZGiTa.exe
  C:\Windows\System\OiZGiTa.exe
  2⤵
  PID:9488
- C:\Windows\System\YamxfAR.exe
  C:\Windows\System\YamxfAR.exe
  2⤵
  PID:9560
- C:\Windows\System\NYwuBSr.exe
  C:\Windows\System\NYwuBSr.exe
  2⤵
  PID:9648
- C:\Windows\System\Nuzkuhy.exe
  C:\Windows\System\Nuzkuhy.exe
  2⤵
  PID:3280
- C:\Windows\System\larULPD.exe
  C:\Windows\System\larULPD.exe
  2⤵
  PID:10144
- C:\Windows\System\uMZQGre.exe
  C:\Windows\System\uMZQGre.exe
  2⤵
  PID:10212
- C:\Windows\System\fkaiwIw.exe
  C:\Windows\System\fkaiwIw.exe
  2⤵
  PID:8496
- C:\Windows\System\TuzPQdK.exe
  C:\Windows\System\TuzPQdK.exe
  2⤵
  PID:8884
- C:\Windows\System\jJYqXDz.exe
  C:\Windows\System\jJYqXDz.exe
  2⤵
  PID:8320
- C:\Windows\System\xezdpTv.exe
  C:\Windows\System\xezdpTv.exe
  2⤵
  PID:6036
- C:\Windows\System\BHYgVHh.exe
  C:\Windows\System\BHYgVHh.exe
  2⤵
  PID:10244
- C:\Windows\System\Eogdguo.exe
  C:\Windows\System\Eogdguo.exe
  2⤵
  PID:10264
- C:\Windows\System\qOZwCft.exe
  C:\Windows\System\qOZwCft.exe
  2⤵
  PID:10280
- C:\Windows\System\NYquDXx.exe
  C:\Windows\System\NYquDXx.exe
  2⤵
  PID:10296
- C:\Windows\System\QQnQIoW.exe
  C:\Windows\System\QQnQIoW.exe
  2⤵
  PID:10316
- C:\Windows\System\wZLhDLk.exe
  C:\Windows\System\wZLhDLk.exe
  2⤵
  PID:10336
- C:\Windows\System\nlZGmFb.exe
  C:\Windows\System\nlZGmFb.exe
  2⤵
  PID:10356
- C:\Windows\System\cmqyaOx.exe
  C:\Windows\System\cmqyaOx.exe
  2⤵
  PID:10376
- C:\Windows\System\GgHLzql.exe
  C:\Windows\System\GgHLzql.exe
  2⤵
  PID:10436
- C:\Windows\System\vdIatCn.exe
  C:\Windows\System\vdIatCn.exe
  2⤵
  PID:10516
- C:\Windows\System\bjgvPzE.exe
  C:\Windows\System\bjgvPzE.exe
  2⤵
  PID:10688
- C:\Windows\System\PMEMAWK.exe
  C:\Windows\System\PMEMAWK.exe
  2⤵
  PID:10704
- C:\Windows\System\cLmZSwo.exe
  C:\Windows\System\cLmZSwo.exe
  2⤵
  PID:10720
- C:\Windows\System\RVEVelM.exe
  C:\Windows\System\RVEVelM.exe
  2⤵
  PID:10736
- C:\Windows\System\lXtDJfi.exe
  C:\Windows\System\lXtDJfi.exe
  2⤵
  PID:10752
- C:\Windows\System\PmwotWn.exe
  C:\Windows\System\PmwotWn.exe
  2⤵
  PID:10772
- C:\Windows\System\DEbAgSE.exe
  C:\Windows\System\DEbAgSE.exe
  2⤵
  PID:10792
- C:\Windows\System\FjHHsze.exe
  C:\Windows\System\FjHHsze.exe
  2⤵
  PID:10812
- C:\Windows\System\RDZyliX.exe
  C:\Windows\System\RDZyliX.exe
  2⤵
  PID:10832
- C:\Windows\System\IKzaaoT.exe
  C:\Windows\System\IKzaaoT.exe
  2⤵
  PID:10852
- C:\Windows\System\bcWlcyS.exe
  C:\Windows\System\bcWlcyS.exe
  2⤵
  PID:10868
- C:\Windows\System\nQZBuQu.exe
  C:\Windows\System\nQZBuQu.exe
  2⤵
  PID:10888
- C:\Windows\System\acSXAtp.exe
  C:\Windows\System\acSXAtp.exe
  2⤵
  PID:10908
- C:\Windows\System\jnwKhqw.exe
  C:\Windows\System\jnwKhqw.exe
  2⤵
  PID:10928
- C:\Windows\System\mZNhXKa.exe
  C:\Windows\System\mZNhXKa.exe
  2⤵
  PID:10948
- C:\Windows\System\EWcWEDX.exe
  C:\Windows\System\EWcWEDX.exe
  2⤵
  PID:10968
- C:\Windows\System\KFlCtav.exe
  C:\Windows\System\KFlCtav.exe
  2⤵
  PID:10988
- C:\Windows\System\qNDbvEf.exe
  C:\Windows\System\qNDbvEf.exe
  2⤵
  PID:11008
- C:\Windows\System\WioHwAQ.exe
  C:\Windows\System\WioHwAQ.exe
  2⤵
  PID:11028
- C:\Windows\System\CyCFZrp.exe
  C:\Windows\System\CyCFZrp.exe
  2⤵
  PID:11048
- C:\Windows\System\zYOsiXF.exe
  C:\Windows\System\zYOsiXF.exe
  2⤵
  PID:11064
- C:\Windows\System\vlRHFWd.exe
  C:\Windows\System\vlRHFWd.exe
  2⤵
  PID:11084
- C:\Windows\System\EqoVGtd.exe
  C:\Windows\System\EqoVGtd.exe
  2⤵
  PID:11104
- C:\Windows\System\eKojOTC.exe
  C:\Windows\System\eKojOTC.exe
  2⤵
  PID:11124
- C:\Windows\System\bQSzoLH.exe
  C:\Windows\System\bQSzoLH.exe
  2⤵
  PID:11144
- C:\Windows\System\aBBvoVd.exe
  C:\Windows\System\aBBvoVd.exe
  2⤵
  PID:11164
- C:\Windows\System\xhucwaE.exe
  C:\Windows\System\xhucwaE.exe
  2⤵
  PID:11184
- C:\Windows\System\YwIBlqg.exe
  C:\Windows\System\YwIBlqg.exe
  2⤵
  PID:11204
- C:\Windows\System\kAPiEBY.exe
  C:\Windows\System\kAPiEBY.exe
  2⤵
  PID:11220
- C:\Windows\System\LBLhRjy.exe
  C:\Windows\System\LBLhRjy.exe
  2⤵
  PID:11240
- C:\Windows\System\QIabgmN.exe
  C:\Windows\System\QIabgmN.exe
  2⤵
  PID:11256
- C:\Windows\System\EAImfkj.exe
  C:\Windows\System\EAImfkj.exe
  2⤵
  PID:9816
- C:\Windows\System\oYYrbpK.exe
  C:\Windows\System\oYYrbpK.exe
  2⤵
  PID:9628
- C:\Windows\System\oeHShBd.exe
  C:\Windows\System\oeHShBd.exe
  2⤵
  PID:9508
- C:\Windows\System\oFwTWxk.exe
  C:\Windows\System\oFwTWxk.exe
  2⤵
  PID:9396
- C:\Windows\System\elQGsTJ.exe
  C:\Windows\System\elQGsTJ.exe
  2⤵
  PID:9284
- C:\Windows\System\DraTVRE.exe
  C:\Windows\System\DraTVRE.exe
  2⤵
  PID:7808
- C:\Windows\System\hixvGok.exe
  C:\Windows\System\hixvGok.exe
  2⤵
  PID:6164
- C:\Windows\System\oResljL.exe
  C:\Windows\System\oResljL.exe
  2⤵
  PID:8340
- C:\Windows\System\ZpMViZe.exe
  C:\Windows\System\ZpMViZe.exe
  2⤵
  PID:3104
- C:\Windows\System\hUHEoLn.exe
  C:\Windows\System\hUHEoLn.exe
  2⤵
  PID:7364
- C:\Windows\System\JsejsMA.exe
  C:\Windows\System\JsejsMA.exe
  2⤵
  PID:9888
- C:\Windows\System\XCAZGeS.exe
  C:\Windows\System\XCAZGeS.exe
  2⤵
  PID:8880
- C:\Windows\System\DrUgSgu.exe
  C:\Windows\System\DrUgSgu.exe
  2⤵
  PID:9008
- C:\Windows\System\DOtFsDP.exe
  C:\Windows\System\DOtFsDP.exe
  2⤵
  PID:11280
- C:\Windows\System\WpQQmHI.exe
  C:\Windows\System\WpQQmHI.exe
  2⤵
  PID:11300
- C:\Windows\System\XePUpze.exe
  C:\Windows\System\XePUpze.exe
  2⤵
  PID:11320
- C:\Windows\System\ZGRmxpJ.exe
  C:\Windows\System\ZGRmxpJ.exe
  2⤵
  PID:11340
- C:\Windows\System\FTyrKea.exe
  C:\Windows\System\FTyrKea.exe
  2⤵
  PID:11360
- C:\Windows\System\CxBJNPJ.exe
  C:\Windows\System\CxBJNPJ.exe
  2⤵
  PID:11376
- C:\Windows\System\VyOOowN.exe
  C:\Windows\System\VyOOowN.exe
  2⤵
  PID:11396
- C:\Windows\System\FMPsjJK.exe
  C:\Windows\System\FMPsjJK.exe
  2⤵
  PID:11416
- C:\Windows\System\WmNCyuh.exe
  C:\Windows\System\WmNCyuh.exe
  2⤵
  PID:11436
- C:\Windows\System\GfdstXq.exe
  C:\Windows\System\GfdstXq.exe
  2⤵
  PID:11456
- C:\Windows\System\QtTmkJg.exe
  C:\Windows\System\QtTmkJg.exe
  2⤵
  PID:11472
- C:\Windows\System\ufKmzCg.exe
  C:\Windows\System\ufKmzCg.exe
  2⤵
  PID:11496
- C:\Windows\System\tkgLrXw.exe
  C:\Windows\System\tkgLrXw.exe
  2⤵
  PID:11512
- C:\Windows\System\MaUMBtD.exe
  C:\Windows\System\MaUMBtD.exe
  2⤵
  PID:11672
- C:\Windows\System\yxTRatI.exe
  C:\Windows\System\yxTRatI.exe
  2⤵
  PID:11692
- C:\Windows\System\olOiuVX.exe
  C:\Windows\System\olOiuVX.exe
  2⤵
  PID:11716
- C:\Windows\System\AdnFRTa.exe
  C:\Windows\System\AdnFRTa.exe
  2⤵
  PID:11736
- C:\Windows\System\TTuPOKW.exe
  C:\Windows\System\TTuPOKW.exe
  2⤵
  PID:11760
- C:\Windows\System\xOoiMOG.exe
  C:\Windows\System\xOoiMOG.exe
  2⤵
  PID:11784
- C:\Windows\System\FCdWRJp.exe
  C:\Windows\System\FCdWRJp.exe
  2⤵
  PID:11808
- C:\Windows\System\TGBlnuN.exe
  C:\Windows\System\TGBlnuN.exe
  2⤵
  PID:11824
- C:\Windows\System\fZBRfwU.exe
  C:\Windows\System\fZBRfwU.exe
  2⤵
  PID:11860
- C:\Windows\System\KTIHfsT.exe
  C:\Windows\System\KTIHfsT.exe
  2⤵
  PID:11880
- C:\Windows\System\mVhcJgq.exe
  C:\Windows\System\mVhcJgq.exe
  2⤵
  PID:11904
- C:\Windows\System\wLXJkHR.exe
  C:\Windows\System\wLXJkHR.exe
  2⤵
  PID:11920
- C:\Windows\System\dydvrId.exe
  C:\Windows\System\dydvrId.exe
  2⤵
  PID:11944
- C:\Windows\System\QQJUeRH.exe
  C:\Windows\System\QQJUeRH.exe
  2⤵
  PID:11968
- C:\Windows\System\vVacDoc.exe
  C:\Windows\System\vVacDoc.exe
  2⤵
  PID:11996
- C:\Windows\System\smhGGzE.exe
  C:\Windows\System\smhGGzE.exe
  2⤵
  PID:12016
- C:\Windows\System\xUQVtEQ.exe
  C:\Windows\System\xUQVtEQ.exe
  2⤵
  PID:12040
- C:\Windows\System\vlpKoFr.exe
  C:\Windows\System\vlpKoFr.exe
  2⤵
  PID:12056
- C:\Windows\System\OILrNhF.exe
  C:\Windows\System\OILrNhF.exe
  2⤵
  PID:12080
- C:\Windows\System\ppfXyHw.exe
  C:\Windows\System\ppfXyHw.exe
  2⤵
  PID:12104
- C:\Windows\System\AoADUpS.exe
  C:\Windows\System\AoADUpS.exe
  2⤵
  PID:12128
- C:\Windows\System\cmnKDro.exe
  C:\Windows\System\cmnKDro.exe
  2⤵
  PID:12152
- C:\Windows\System\oNRMJDi.exe
  C:\Windows\System\oNRMJDi.exe
  2⤵
  PID:12172
- C:\Windows\System\xQGctbQ.exe
  C:\Windows\System\xQGctbQ.exe
  2⤵
  PID:12204
- C:\Windows\System\NfjeWWY.exe
  C:\Windows\System\NfjeWWY.exe
  2⤵
  PID:12224
- C:\Windows\System\squJgwP.exe
  C:\Windows\System\squJgwP.exe
  2⤵
  PID:12248
- C:\Windows\System\hEmKmPK.exe
  C:\Windows\System\hEmKmPK.exe
  2⤵
  PID:12276
- C:\Windows\System\iseHrCb.exe
  C:\Windows\System\iseHrCb.exe
  2⤵
  PID:9904
- C:\Windows\System\yDbzfXM.exe
  C:\Windows\System\yDbzfXM.exe
  2⤵
  PID:9924
- C:\Windows\System\pZUAMdW.exe
  C:\Windows\System\pZUAMdW.exe
  2⤵
  PID:9968
- C:\Windows\System\DtvCJQM.exe
  C:\Windows\System\DtvCJQM.exe
  2⤵
  PID:10004
- C:\Windows\System\oKcKLFz.exe
  C:\Windows\System\oKcKLFz.exe
  2⤵
  PID:10052
- C:\Windows\System\ySOJSyf.exe
  C:\Windows\System\ySOJSyf.exe
  2⤵
  PID:10100
- C:\Windows\System\MTLptJW.exe
  C:\Windows\System\MTLptJW.exe
  2⤵
  PID:3680
- C:\Windows\System\QKkwgwy.exe
  C:\Windows\System\QKkwgwy.exe
  2⤵
  PID:8632
- C:\Windows\System\LByauup.exe
  C:\Windows\System\LByauup.exe
  2⤵
  PID:7652
- C:\Windows\System\ZUkgJnC.exe
  C:\Windows\System\ZUkgJnC.exe
  2⤵
  PID:12300
- C:\Windows\System\USOWCGb.exe
  C:\Windows\System\USOWCGb.exe
  2⤵
  PID:12324
- C:\Windows\System\FbzdRvx.exe
  C:\Windows\System\FbzdRvx.exe
  2⤵
  PID:12344
- C:\Windows\System\XBnjTPB.exe
  C:\Windows\System\XBnjTPB.exe
  2⤵
  PID:12364
- C:\Windows\System\nUpNQph.exe
  C:\Windows\System\nUpNQph.exe
  2⤵
  PID:12384
- C:\Windows\System\qHUnnFF.exe
  C:\Windows\System\qHUnnFF.exe
  2⤵
  PID:12404
- C:\Windows\System\Zcxhqjr.exe
  C:\Windows\System\Zcxhqjr.exe
  2⤵
  PID:12420
- C:\Windows\System\WGrdphD.exe
  C:\Windows\System\WGrdphD.exe
  2⤵
  PID:12436
- C:\Windows\System\pvBGbGH.exe
  C:\Windows\System\pvBGbGH.exe
  2⤵
  PID:12452
- C:\Windows\System\vqZGajX.exe
  C:\Windows\System\vqZGajX.exe
  2⤵
  PID:12468
- C:\Windows\System\NEZLppe.exe
  C:\Windows\System\NEZLppe.exe
  2⤵
  PID:12484
- C:\Windows\System\iwncXJc.exe
  C:\Windows\System\iwncXJc.exe
  2⤵
  PID:12500
- C:\Windows\System\iGhFwxJ.exe
  C:\Windows\System\iGhFwxJ.exe
  2⤵
  PID:12516
- C:\Windows\System\cHTulKk.exe
  C:\Windows\System\cHTulKk.exe
  2⤵
  PID:12536
- C:\Windows\System\ydxoJcE.exe
  C:\Windows\System\ydxoJcE.exe
  2⤵
  PID:12552
- C:\Windows\System\JJPalnk.exe
  C:\Windows\System\JJPalnk.exe
  2⤵
  PID:12576
- C:\Windows\System\iclYSaF.exe
  C:\Windows\System\iclYSaF.exe
  2⤵
  PID:12596
- C:\Windows\System\qmARDso.exe
  C:\Windows\System\qmARDso.exe
  2⤵
  PID:12624
- C:\Windows\System\Gxssjts.exe
  C:\Windows\System\Gxssjts.exe
  2⤵
  PID:12644
- C:\Windows\System\HQAotGe.exe
  C:\Windows\System\HQAotGe.exe
  2⤵
  PID:12664
- C:\Windows\System\ikaFOPp.exe
  C:\Windows\System\ikaFOPp.exe
  2⤵
  PID:12688
- C:\Windows\System\uAOqgnX.exe
  C:\Windows\System\uAOqgnX.exe
  2⤵
  PID:12712
- C:\Windows\System\CvybHmg.exe
  C:\Windows\System\CvybHmg.exe
  2⤵
  PID:12736
- C:\Windows\System\CmcUkoT.exe
  C:\Windows\System\CmcUkoT.exe
  2⤵
  PID:12760
- C:\Windows\System\uxqFadi.exe
  C:\Windows\System\uxqFadi.exe
  2⤵
  PID:12784
- C:\Windows\System\keEUGki.exe
  C:\Windows\System\keEUGki.exe
  2⤵
  PID:12804
- C:\Windows\System\NMGfoGT.exe
  C:\Windows\System\NMGfoGT.exe
  2⤵
  PID:12824
- C:\Windows\System\vDiQuIy.exe
  C:\Windows\System\vDiQuIy.exe
  2⤵
  PID:12956
- C:\Windows\System\LzpBQyQ.exe
  C:\Windows\System\LzpBQyQ.exe
  2⤵
  PID:12976
- C:\Windows\System\KpUEiGK.exe
  C:\Windows\System\KpUEiGK.exe
  2⤵
  PID:12996
- C:\Windows\System\rTmPZaS.exe
  C:\Windows\System\rTmPZaS.exe
  2⤵
  PID:13012
- C:\Windows\System\szYoSGB.exe
  C:\Windows\System\szYoSGB.exe
  2⤵
  PID:13028
- C:\Windows\System\nFrPPhk.exe
  C:\Windows\System\nFrPPhk.exe
  2⤵
  PID:13044
- C:\Windows\System\LlcpHYR.exe
  C:\Windows\System\LlcpHYR.exe
  2⤵
  PID:13060
- C:\Windows\System\qRfcuZa.exe
  C:\Windows\System\qRfcuZa.exe
  2⤵
  PID:13076
- C:\Windows\System\KpcBBsJ.exe
  C:\Windows\System\KpcBBsJ.exe
  2⤵
  PID:13092
- C:\Windows\System\voaZDmx.exe
  C:\Windows\System\voaZDmx.exe
  2⤵
  PID:13108
- C:\Windows\System\lnmhGNf.exe
  C:\Windows\System\lnmhGNf.exe
  2⤵
  PID:13124
- C:\Windows\System\MyMrnaH.exe
  C:\Windows\System\MyMrnaH.exe
  2⤵
  PID:13140
- C:\Windows\System\ktMPJij.exe
  C:\Windows\System\ktMPJij.exe
  2⤵
  PID:13156
- C:\Windows\System\JuRdVvL.exe
  C:\Windows\System\JuRdVvL.exe
  2⤵
  PID:13172
- C:\Windows\System\mrZHFBM.exe
  C:\Windows\System\mrZHFBM.exe
  2⤵
  PID:13188
- C:\Windows\System\mNjURnF.exe
  C:\Windows\System\mNjURnF.exe
  2⤵
  PID:13204
- C:\Windows\System\fkRqoun.exe
  C:\Windows\System\fkRqoun.exe
  2⤵
  PID:13228
- C:\Windows\System\CJcUotw.exe
  C:\Windows\System\CJcUotw.exe
  2⤵
  PID:11844
- C:\Windows\System\OBvvJbX.exe
  C:\Windows\System\OBvvJbX.exe
  2⤵
  PID:12428
- C:\Windows\System\XeDPiLS.exe
  C:\Windows\System\XeDPiLS.exe
  2⤵
  PID:12492
- C:\Windows\System\piZeBOG.exe
  C:\Windows\System\piZeBOG.exe
  2⤵
  PID:10944
- C:\Windows\System\zyNyoVj.exe
  C:\Windows\System\zyNyoVj.exe
  2⤵
  PID:11004
- C:\Windows\System\NrDXbtq.exe
  C:\Windows\System\NrDXbtq.exe
  2⤵
  PID:11056
- C:\Windows\System\oPpnatA.exe
  C:\Windows\System\oPpnatA.exe
  2⤵
  PID:11152
- C:\Windows\System\FAGPfxQ.exe
  C:\Windows\System\FAGPfxQ.exe
  2⤵
  PID:13288
- C:\Windows\System\HhSYgJH.exe
  C:\Windows\System\HhSYgJH.exe
  2⤵
  PID:11432
- C:\Windows\System\YTbWmAx.exe
  C:\Windows\System\YTbWmAx.exe
  2⤵
  PID:10020
- C:\Windows\System\NrgclXV.exe
  C:\Windows\System\NrgclXV.exe
  2⤵
  PID:10820
- C:\Windows\System\EmpcUBP.exe
  C:\Windows\System\EmpcUBP.exe
  2⤵
  PID:10256
- C:\Windows\System\VfGwDbd.exe
  C:\Windows\System\VfGwDbd.exe
  2⤵
  PID:11072
- C:\Windows\System\SUQDoEO.exe
  C:\Windows\System\SUQDoEO.exe
  2⤵
  PID:12604
- C:\Windows\System\tRyXRNO.exe
  C:\Windows\System\tRyXRNO.exe
  2⤵
  PID:11276
- C:\Windows\System\CtydULm.exe
  C:\Windows\System\CtydULm.exe
  2⤵
  PID:13276
- C:\Windows\System\sTQyANp.exe
  C:\Windows\System\sTQyANp.exe
  2⤵
  PID:10324
- C:\Windows\System\vHbdCDc.exe
  C:\Windows\System\vHbdCDc.exe
  2⤵
  PID:11976
- C:\Windows\System\rwZqdRN.exe
  C:\Windows\System\rwZqdRN.exe
  2⤵
  PID:12088
- C:\Windows\System\fQgiTYz.exe
  C:\Windows\System\fQgiTYz.exe
  2⤵
  PID:5104
- C:\Windows\System\nHgpfNo.exe
  C:\Windows\System\nHgpfNo.exe
  2⤵
  PID:10876
- C:\Windows\System\zRAeYnz.exe
  C:\Windows\System\zRAeYnz.exe
  2⤵
  PID:8100
- C:\Windows\System\KXBbXGs.exe
  C:\Windows\System\KXBbXGs.exe
  2⤵
  PID:9532
- C:\Windows\System\XffVuGW.exe
  C:\Windows\System\XffVuGW.exe
  2⤵
  PID:9236
- C:\Windows\System\oozjfZV.exe
  C:\Windows\System\oozjfZV.exe
  2⤵
  PID:4020
- C:\Windows\System\lnFNaSK.exe
  C:\Windows\System\lnFNaSK.exe
  2⤵
  PID:11480
- C:\Windows\System\XhqUYNK.exe
  C:\Windows\System\XhqUYNK.exe
  2⤵
  PID:12876
- C:\Windows\System\hUnpVoT.exe
  C:\Windows\System\hUnpVoT.exe
  2⤵
  PID:2408
- C:\Windows\System\iMThrdk.exe
  C:\Windows\System\iMThrdk.exe
  2⤵
  PID:4044
- C:\Windows\System\jfqwNWd.exe
  C:\Windows\System\jfqwNWd.exe
  2⤵
  PID:10848
- C:\Windows\System\dvdxyFK.exe
  C:\Windows\System\dvdxyFK.exe
  2⤵
  PID:11232
- C:\Windows\System\JKBVnqY.exe
  C:\Windows\System\JKBVnqY.exe
  2⤵
  PID:11096
- C:\Windows\System\ZXgmgrA.exe
  C:\Windows\System\ZXgmgrA.exe
  2⤵
  PID:11632
- C:\Windows\System\hOPKQbc.exe
  C:\Windows\System\hOPKQbc.exe
  2⤵
  PID:13120
- C:\Windows\System\ZfCKRmY.exe
  C:\Windows\System\ZfCKRmY.exe
  2⤵
  PID:11708
- C:\Windows\System\ZYKqLws.exe
  C:\Windows\System\ZYKqLws.exe
  2⤵
  PID:13252
- C:\Windows\System\iTZhgqM.exe
  C:\Windows\System\iTZhgqM.exe
  2⤵
  PID:5884
- C:\Windows\System\iOtIiyf.exe
  C:\Windows\System\iOtIiyf.exe
  2⤵
  PID:11588
- C:\Windows\System\HSTenfy.exe
  C:\Windows\System\HSTenfy.exe
  2⤵
  PID:11608
- C:\Windows\System\FxqzpJr.exe
  C:\Windows\System\FxqzpJr.exe
  2⤵
  PID:13164
- C:\Windows\System\vXPbMcc.exe
  C:\Windows\System\vXPbMcc.exe
  2⤵
  PID:10904
- C:\Windows\System\zWSEknF.exe
  C:\Windows\System\zWSEknF.exe
  2⤵
  PID:12256
- C:\Windows\System\OcrloFW.exe
  C:\Windows\System\OcrloFW.exe
  2⤵
  PID:12896
- C:\Windows\System\ExvwqBM.exe
  C:\Windows\System\ExvwqBM.exe
  2⤵
  PID:4628
- C:\Windows\System\EUCkvUh.exe
  C:\Windows\System\EUCkvUh.exe
  2⤵
  PID:5532
- C:\Windows\System\fzSkoOQ.exe
  C:\Windows\System\fzSkoOQ.exe
  2⤵
  PID:10660
- C:\Windows\System\hlzQVYS.exe
  C:\Windows\System\hlzQVYS.exe
  2⤵
  PID:4880
- C:\Windows\System\LXtJQKM.exe
  C:\Windows\System\LXtJQKM.exe
  2⤵
  PID:11548
- C:\Windows\System\okDJTcw.exe
  C:\Windows\System\okDJTcw.exe
  2⤵
  PID:11616
- C:\Windows\System\XPNTFnM.exe
  C:\Windows\System\XPNTFnM.exe
  2⤵
  PID:11684
- C:\Windows\System\smAexvg.exe
  C:\Windows\System\smAexvg.exe
  2⤵
  PID:11448
- C:\Windows\System\GNPLkwx.exe
  C:\Windows\System\GNPLkwx.exe
  2⤵
  PID:12696
- C:\Windows\System\czdQTAb.exe
  C:\Windows\System\czdQTAb.exe
  2⤵
  PID:11444
- C:\Windows\System\RnzSvqo.exe
  C:\Windows\System\RnzSvqo.exe
  2⤵
  PID:9388
- C:\Windows\System\dVHqqZe.exe
  C:\Windows\System\dVHqqZe.exe
  2⤵
  PID:9952
- C:\Windows\System\bdmpbiq.exe
  C:\Windows\System\bdmpbiq.exe
  2⤵
  PID:8732
- C:\Windows\System\QexKXpQ.exe
  C:\Windows\System\QexKXpQ.exe
  2⤵
  PID:13008
- C:\Windows\System\pORcAnE.exe
  C:\Windows\System\pORcAnE.exe
  2⤵
  PID:13200
- C:\Windows\System\ZXOELyc.exe
  C:\Windows\System\ZXOELyc.exe
  2⤵
  PID:10788
- C:\Windows\System\XuQEtyw.exe
  C:\Windows\System\XuQEtyw.exe
  2⤵
  PID:11200
- C:\Windows\System\ollnakz.exe
  C:\Windows\System\ollnakz.exe
  2⤵
  PID:8668
- C:\Windows\System\uDCsqDC.exe
  C:\Windows\System\uDCsqDC.exe
  2⤵
  PID:10924
- C:\Windows\System\qrVHXCG.exe
  C:\Windows\System\qrVHXCG.exe
  2⤵
  PID:9552
- C:\Windows\System\CVbBWZR.exe
  C:\Windows\System\CVbBWZR.exe
  2⤵
  PID:12232
- C:\Windows\System\nlPOkEB.exe
  C:\Windows\System\nlPOkEB.exe
  2⤵
  PID:3568
- C:\Windows\System\XZYYAxD.exe
  C:\Windows\System\XZYYAxD.exe
  2⤵
  PID:10528
- C:\Windows\System\AufdmDm.exe
  C:\Windows\System\AufdmDm.exe
  2⤵
  PID:2008
- C:\Windows\System\WLsCFwe.exe
  C:\Windows\System\WLsCFwe.exe
  2⤵
  PID:12416
- C:\Windows\System\WpcFPZj.exe
  C:\Windows\System\WpcFPZj.exe
  2⤵
  PID:12756
- C:\Windows\System\uPslyXm.exe
  C:\Windows\System\uPslyXm.exe
  2⤵
  PID:11652
- C:\Windows\System\rnXDStn.exe
  C:\Windows\System\rnXDStn.exe
  2⤵
  PID:11620
- C:\Windows\System\TuazrZZ.exe
  C:\Windows\System\TuazrZZ.exe
  2⤵
  PID:12728
- C:\Windows\System\haDsUvq.exe
  C:\Windows\System\haDsUvq.exe
  2⤵
  PID:13320
- C:\Windows\System\qveaUst.exe
  C:\Windows\System\qveaUst.exe
  2⤵
  PID:13344
- C:\Windows\System\UyOApFM.exe
  C:\Windows\System\UyOApFM.exe
  2⤵
  PID:13388
- C:\Windows\System\gjgfzhq.exe
  C:\Windows\System\gjgfzhq.exe
  2⤵
  PID:13412
- C:\Windows\System\cvBHIWB.exe
  C:\Windows\System\cvBHIWB.exe
  2⤵
  PID:14004
- C:\Windows\System\afCTCih.exe
  C:\Windows\System\afCTCih.exe
  2⤵
  PID:14028
- C:\Windows\System\ZiWFHjn.exe
  C:\Windows\System\ZiWFHjn.exe
  2⤵
  PID:14064
- C:\Windows\System\vZZlDUP.exe
  C:\Windows\System\vZZlDUP.exe
  2⤵
  PID:14116
- C:\Windows\System\kJnNXRV.exe
  C:\Windows\System\kJnNXRV.exe
  2⤵
  PID:14240
- C:\Windows\System\PCOlPME.exe
  C:\Windows\System\PCOlPME.exe
  2⤵
  PID:14324
- C:\Windows\System\ZYZElvm.exe
  C:\Windows\System\ZYZElvm.exe
  2⤵
  PID:11452
- C:\Windows\System\HfxHznh.exe
  C:\Windows\System\HfxHznh.exe
  2⤵
  PID:13040
- C:\Windows\System\ROVcmwu.exe
  C:\Windows\System\ROVcmwu.exe
  2⤵
  PID:4992
- C:\Windows\System\AbptcgM.exe
  C:\Windows\System\AbptcgM.exe
  2⤵
  PID:11892
- C:\Windows\System\lpbsQyl.exe
  C:\Windows\System\lpbsQyl.exe
  2⤵
  PID:13264
- C:\Windows\System\qAtbjiT.exe
  C:\Windows\System\qAtbjiT.exe
  2⤵
  PID:9956
- C:\Windows\System\vgpxWZL.exe
  C:\Windows\System\vgpxWZL.exe
  2⤵
  PID:13104
- C:\Windows\System\Getywzi.exe
  C:\Windows\System\Getywzi.exe
  2⤵
  PID:10804
- C:\Windows\System\SSzBqYX.exe
  C:\Windows\System\SSzBqYX.exe
  2⤵
  PID:3404
- C:\Windows\System\YlVRaSh.exe
  C:\Windows\System\YlVRaSh.exe
  2⤵
  PID:3528
- C:\Windows\System\TdhtTRx.exe
  C:\Windows\System\TdhtTRx.exe
  2⤵
  PID:11796
- C:\Windows\System\NNAxCdA.exe
  C:\Windows\System\NNAxCdA.exe
  2⤵
  PID:13436
- C:\Windows\System\syjufaE.exe
  C:\Windows\System\syjufaE.exe
  2⤵
  PID:10652
- C:\Windows\System\AWieHyE.exe
  C:\Windows\System\AWieHyE.exe
  2⤵
  PID:13528
- C:\Windows\System\YLGpsIN.exe
  C:\Windows\System\YLGpsIN.exe
  2⤵
  PID:3396
- C:\Windows\System\CAHgaqa.exe
  C:\Windows\System\CAHgaqa.exe
  2⤵
  PID:12052
- C:\Windows\System\kuHOglu.exe
  C:\Windows\System\kuHOglu.exe
  2⤵
  PID:13356
- C:\Windows\System\OBAPNCi.exe
  C:\Windows\System\OBAPNCi.exe
  2⤵
  PID:13440
- C:\Windows\System\rQJXLjY.exe
  C:\Windows\System\rQJXLjY.exe
  2⤵
  PID:13520
- C:\Windows\System\eLypYmP.exe
  C:\Windows\System\eLypYmP.exe
  2⤵
  PID:13960
- C:\Windows\System\BOnJFNl.exe
  C:\Windows\System\BOnJFNl.exe
  2⤵
  PID:1912
- C:\Windows\System\HzQPUuQ.exe
  C:\Windows\System\HzQPUuQ.exe
  2⤵
  PID:13720
- C:\Windows\System\uKkSECx.exe
  C:\Windows\System\uKkSECx.exe
  2⤵
  PID:13892
- C:\Windows\System\hncmLsI.exe
  C:\Windows\System\hncmLsI.exe
  2⤵
  PID:13240
- C:\Windows\System\aQtAfyL.exe
  C:\Windows\System\aQtAfyL.exe
  2⤵
  PID:14140
- C:\Windows\System\TFuDCTT.exe
  C:\Windows\System\TFuDCTT.exe
  2⤵
  PID:13964
- C:\Windows\System\ICglDFV.exe
  C:\Windows\System\ICglDFV.exe
  2⤵
  PID:14012
- C:\Windows\System\feejqil.exe
  C:\Windows\System\feejqil.exe
  2⤵
  PID:12612
- C:\Windows\System\ujqWaPI.exe
  C:\Windows\System\ujqWaPI.exe
  2⤵
  PID:13916
- C:\Windows\System\ZcDUzhQ.exe
  C:\Windows\System\ZcDUzhQ.exe
  2⤵
  PID:13920
- C:\Windows\System\QwTCSrg.exe
  C:\Windows\System\QwTCSrg.exe
  2⤵
  PID:13984
- C:\Windows\System\rkRWwjW.exe
  C:\Windows\System\rkRWwjW.exe
  2⤵
  PID:14320
- C:\Windows\System\yVxnUcy.exe
  C:\Windows\System\yVxnUcy.exe
  2⤵
  PID:4888
- C:\Windows\System\IKWFyAF.exe
  C:\Windows\System\IKWFyAF.exe
  2⤵
  PID:5168
- C:\Windows\System\ZFeaeEy.exe
  C:\Windows\System\ZFeaeEy.exe
  2⤵
  PID:13600
- C:\Windows\System\TBQncPA.exe
  C:\Windows\System\TBQncPA.exe
  2⤵
  PID:11580
- C:\Windows\System\yinKfUW.exe
  C:\Windows\System\yinKfUW.exe
  2⤵
  PID:9580
- C:\Windows\System\sXiIVmo.exe
  C:\Windows\System\sXiIVmo.exe
  2⤵
  PID:13084
- C:\Windows\System\rNBDnDN.exe
  C:\Windows\System\rNBDnDN.exe
  2⤵
  PID:11228
- C:\Windows\System\jWROYOm.exe
  C:\Windows\System\jWROYOm.exe
  2⤵
  PID:11308
- C:\Windows\System\axiAZoD.exe
  C:\Windows\System\axiAZoD.exe
  2⤵
  PID:13428
- C:\Windows\System\PqUGsAG.exe
  C:\Windows\System\PqUGsAG.exe
  2⤵
  PID:13464
- C:\Windows\System\BCFAuRu.exe
  C:\Windows\System\BCFAuRu.exe
  2⤵
  PID:11688
- C:\Windows\System\omVsddS.exe
  C:\Windows\System\omVsddS.exe
  2⤵
  PID:13424
- C:\Windows\System\cXAKMKO.exe
  C:\Windows\System\cXAKMKO.exe
  2⤵
  PID:5188
- C:\Windows\System\FTTEiHO.exe
  C:\Windows\System\FTTEiHO.exe
  2⤵
  PID:14056
- C:\Windows\System\nXIHznx.exe
  C:\Windows\System\nXIHznx.exe
  2⤵
  PID:13152
- C:\Windows\System\dmsiqPa.exe
  C:\Windows\System\dmsiqPa.exe
  2⤵
  PID:14088
- C:\Windows\System\MCLQQMR.exe
  C:\Windows\System\MCLQQMR.exe
  2⤵
  PID:14000
- C:\Windows\System\pQLhaxS.exe
  C:\Windows\System\pQLhaxS.exe
  2⤵
  PID:14220
- C:\Windows\System\UOSdOYM.exe
  C:\Windows\System\UOSdOYM.exe
  2⤵
  PID:7548
- C:\Windows\System\oePRiUw.exe
  C:\Windows\System\oePRiUw.exe
  2⤵
  PID:11792
- C:\Windows\System\gsICVgR.exe
  C:\Windows\System\gsICVgR.exe
  2⤵
  PID:13948
- C:\Windows\System\DAlcRlP.exe
  C:\Windows\System\DAlcRlP.exe
  2⤵
  PID:13476
- C:\Windows\System\almoLEa.exe
  C:\Windows\System\almoLEa.exe
  2⤵
  PID:12816
- C:\Windows\System\CkopEAO.exe
  C:\Windows\System\CkopEAO.exe
  2⤵
  PID:10668
- C:\Windows\System\wJDwhkp.exe
  C:\Windows\System\wJDwhkp.exe
  2⤵
  PID:13500
- C:\Windows\System\peluYbs.exe
  C:\Windows\System\peluYbs.exe
  2⤵
  PID:14076
- C:\Windows\System\TeOSeCC.exe
  C:\Windows\System\TeOSeCC.exe
  2⤵
  PID:13460
- C:\Windows\System\YVTcYZb.exe
  C:\Windows\System\YVTcYZb.exe
  2⤵
  PID:12024
- C:\Windows\System\QLhqDJP.exe
  C:\Windows\System\QLhqDJP.exe
  2⤵
  PID:13940
- C:\Windows\System\oOzpJPE.exe
  C:\Windows\System\oOzpJPE.exe
  2⤵
  PID:9724
- C:\Windows\System\QrfBDXM.exe
  C:\Windows\System\QrfBDXM.exe
  2⤵
  PID:13884
- C:\Windows\System\DkYhKWX.exe
  C:\Windows\System\DkYhKWX.exe
  2⤵
  PID:13804
- C:\Windows\System\RvMLJqa.exe
  C:\Windows\System\RvMLJqa.exe
  2⤵
  PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gyypuzgy.j0s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AJWwxeF.exe

Filesize
1.8MB

MD5
60e611e4920d6975175de8e70f0564dc

SHA1
8e05b42d6682d0c9ec66ea1a462e8883d31eb30b

SHA256
fad3e0ef54e2e891d4976c8b6b128eb74132eda113ed86b2d310bcd11248526b

SHA512
88af7aa4b0355f57b6eea2abca6f7468b8233e1dba7fe7615ada4a97b792878f52c6d8480c12e711749c415bea4df741053a05a74d646e599c1329bc1e0393a8

Download Submit
C:\Windows\System\BQZEVfq.exe

Filesize
1.8MB

MD5
404df05df9c9f910504b912abe7adfe9

SHA1
895812c7aa6f996b746f813dcf8c65f143012f7a

SHA256
664a3c1de32790f6103c64d513ef523d760502aa429226e5ced7f491672413a1

SHA512
b3df1ef0168c8c64ceb379f3f5ffa3d1421ea35667ee7366db8d572273f1b25791a3fa223d2288998e280615290ecda098bc37bdb0daf54bd5d1fa4178151550

Download Submit
C:\Windows\System\DcEglZn.exe

Filesize
1.8MB

MD5
f2c4deda08eaf651a0e2bf487f48740f

SHA1
d17764a79a072f1876d3b43d060e2ed102c982d1

SHA256
3c5b32b44c879747a9b142f339f26729d89f955a577e632b4433c4e9a92aedde

SHA512
fb8a1f74944685637b866ed0a62826d19d0139a53d29910cde97c3235f83a10259fa74cc368884837c4a54fd9afbf680e407d8c13f2389010741eaae1f560ff5

Download Submit
C:\Windows\System\EMLXfvc.exe

Filesize
1.8MB

MD5
28d0038a655f16b61456c4b2fbc654cd

SHA1
d7a83c39dd7ba560058b1128e7f201eeaa723372

SHA256
04e033f8609276a4b942bc8bf039b496e1e4965357180b85cf39f3b96a884a9c

SHA512
f5118e0928d50524cc18a7d5ad22ca47afee31f63599ab9ada03217306c69014c6728497c8b21b9bf2486f63c3940519560f577ef3f0241c44cb8c53d6a6c132

Download Submit
C:\Windows\System\ErQZzEJ.exe

Filesize
1.8MB

MD5
67e831009634bbe2e8713bd9fca964b0

SHA1
b5d2e9585c887ae3d60b9d88c82d639c434d53d3

SHA256
f3cc2c42019aa08314572525e7aba04b93b0e579698e34030878b6a7f638baba

SHA512
86d23f61afc2d9847b16c74ddd7e1b9cd6254b28731723a8c45badbfc089d421afc8cc83c288663069076d555b53b61be9b6f4a035940c5c6a2bb988dec3e1e4

Download Submit
C:\Windows\System\GUAccOA.exe

Filesize
1.8MB

MD5
c6fce39ef5b32641ee22bc70061a1122

SHA1
febc8580d98f8d65392d2067fd28b6d2719680d7

SHA256
8c14b2f0d8a7a487c19676b68ae6fb146feaf50e3343ccdcf3dda02850d6f41b

SHA512
2165899c8c54e5a70995c6ea374fd8bac238222f5d68c2443f865ea2c24a6893e634a1fa7d05b1dd6510ac0a1500078918c68a684af3d4a4f3a23972385993b1

Download Submit
C:\Windows\System\GVqkird.exe

Filesize
1.8MB

MD5
baf3c8fa85b82753caa70e803e4cf647

SHA1
5b78818aa3abc33c65d5ac433a404f944befe2e4

SHA256
81b5cf7af4291d6f90ab7c1a17e56968c7a30fd0750fc10bb8f579fc7c1807d7

SHA512
fc321cb5e4d07fc5d438bf678544bd39d719baeaef36b0c7bda1c08408e6b7beee52bae1fdb08908b9eb7a27e6fb97678dfc590539d57c6455be80aa0601e139

Download Submit
C:\Windows\System\QxPvbFJ.exe

Filesize
1.8MB

MD5
8c33bb0bb2d652e7212f89c23320a579

SHA1
f3e2a68ae8aa45383e1c61c52616ddb3b6c8d82e

SHA256
fd262ba7c67fb3bf0f55d4e67e20e501ee7348f9f1802ed2bdb2704c52c9c0ae

SHA512
4c90527d90d5cfd32cfbd8c47271be15ac3a9c71c5de8059195940c3a7a8a64ab665315c2375f6de95cfb1792f26d1023edd67483d8c46c25e6fb0c195c37b4f

Download Submit
C:\Windows\System\RAVdyGL.exe

Filesize
1.8MB

MD5
d436e3f56c81ad0ea6ad698f7600de1e

SHA1
835ab0846b57865e33bc25e3082af268fa03006a

SHA256
c71d0ff3ad7b0fd4aeb7a5fbef2988f72dd4cc69917e627d5a4e8585871cd5de

SHA512
79f55fd936908d1cbc1b75d7a56ee8efeefdff50ab9b495ed963b0364864b0e99207cf86af5af993fceac141b02dc3a8e515d1da0cc4a40da303cf182574d61b

Download Submit
C:\Windows\System\RLsDdwy.exe

Filesize
1.8MB

MD5
37e7d86f30db737214f00fb53b2e3a77

SHA1
e0d9ac0db58a60658b1ce227997d186d8dbb94b4

SHA256
b0e615e8f6a7e90730af5d9fed0b1e52a4d33901ea7ecc0fc0ab8aa711231318

SHA512
f4b2af6ef3065cc965b581feb22007ce382b57ffb4550047d47eadff341a17ecac02e801bfc3c3a1ca9c280a33d551b6f8d6213fbf6c620fb8ad361c481febcf

Download Submit
C:\Windows\System\RpLbdzF.exe

Filesize
1.8MB

MD5
4ab4c83979e81872986364623f2f74c9

SHA1
730426c00f47cf06be9650d0300c3d5dde234818

SHA256
239b242f7c48f5a5c69b6fbeed31f693196e19162ed9ee3610e91f92e6239a49

SHA512
f3d43dcb233c78b3ab84f06691665fb2796187f061229407b343c786f229070c187034a23b14ef80d474200a03d9312923cc7f62c0ab1dbc3f665b6ebb085465

Download Submit
C:\Windows\System\TUUSAdC.exe

Filesize
1.8MB

MD5
264b3b35f538e80e0f8490b25ff595de

SHA1
281023ad32313ebd015e79989630dcef4474f3f5

SHA256
f74e60d9165b42d4e07c0bcd650fc69e7fbb8e6ca92722a77787ef8199f568c3

SHA512
645c21159b1128b31c0b47478c563e0c602c76434b9b4ebe2d2f3c3bd6799f1a7d48748b5bfdf4d9291bc08917ddb93088cbc3ffd23e41689ecbb4f0f9839522

Download Submit
C:\Windows\System\TrEKZkh.exe

Filesize
1.8MB

MD5
b044dd4a9770ebd6f1932fe31e782d29

SHA1
a3e5e0bc1df584ff50ad98d560198b18609654f4

SHA256
2a2c39ba262fb3238fa295d59549ff1b018695186e57471fc9c1e8aeccc8047d

SHA512
86166f682f673efcb57c1e70bc540e5810d29bb06c916ecb22783d3fe1346def42278c92dc0d2a70de4c66fea4870e411627b60b420d922022544f2bf1bd1953

Download Submit
C:\Windows\System\UtjrOpn.exe

Filesize
1.8MB

MD5
1cbd071056020f10350feb8f6c6f4c55

SHA1
1d32ec4fb9eb338be9198cdd19f7e91ec024080c

SHA256
8337ca3b4bbad0efb29b16123ee8e2c5d40e06f64d49546b510b03526646c2f5

SHA512
34f17d1cdd439b200c1f7924ab175000d0d27cdf2e4243ff81b6f0067b554224d2e485a50815d2d075ddf0f754a476a1c1c9b0c67b205e0b272a474bd52bf160

Download Submit
C:\Windows\System\UwXCUsb.exe

Filesize
1.8MB

MD5
624a0601d44ca2f21dd45b74cfedb4a6

SHA1
765b8900720acbd3605af221a76625d9be5f3199

SHA256
b9d078fcf64a5c7ae95886af55f6fb2bbd5c1d0212c8ea592d70d66b9479b429

SHA512
172e4f9f22c32162d3781aec1c4d143eb2b3293d83932af106387e643333e3e49ea99c0e7cc2a89460bcd9cc9e9789a043d5ee01e2f7adadb237ca916d28d478

Download Submit
C:\Windows\System\WEiKOZt.exe

Filesize
1.8MB

MD5
1a0d53911284db13c18f5701dd16ea64

SHA1
aa617941be3b35f1a8be5b2f671af3163d58802c

SHA256
0d48560b539fa9363d05d6dd3bd4db51cc5e3d6aa21721ddaed42f002fb6a851

SHA512
1e7c32f4ad5668256cf792722fa7f3b689a712de9101e98bbec1a26e3cc2a3af0fc514f42cc23530f342fe4b5e1e47b8cd818ab7fd7f0a049fbdbfe1208cb9e3

Download Submit
C:\Windows\System\XBMGCEB.exe

Filesize
1.8MB

MD5
e30fe448cf97320550e6db52302fc780

SHA1
6ddf2af3bea309ac0491a0ef2a149d8614be3921

SHA256
de69d190acccd43ab59082df9bc864998a70de7d84d44e978ef841222601648e

SHA512
16c2ba2d0335a05196bbe476322248557ec1fbde8503cf68d94d0f53044399ffaeade401cd93eff1351ae44bb69140a4f492b22f72982951dddab4aceaacf03a

Download Submit
C:\Windows\System\XOPolyX.exe

Filesize
1.8MB

MD5
69c30dcb7e8b4325fc6677a38a76b2a0

SHA1
aa8d1bed3e3d59608b00f81f19d237a3a7dd5d6c

SHA256
b07005523da8c79175138edcafc6cc8ce6e8a3607b2612d3f72a4ec676bb32d4

SHA512
a3c0b297d78236ae97b9f1adb5d1de925f6904428159e1f296cbe0a07360f62c2d283a94ac5934e3492151b492005665379468c0ce08b5a7896836cc5d075250

Download Submit
C:\Windows\System\XcLsvFp.exe

Filesize
1.8MB

MD5
e6d4419b521ba70d8fc7186329c4a43a

SHA1
e5e36a1da19eb6a41d18a75a79fb15c57ce32e9a

SHA256
5ad35bfe04beb46e3b302e4c77ae38f66fd024425b5b8a1f9bf01ea1e2ca4a87

SHA512
7c967520fe256b9cd842417ed738fcaaefa036a8a0920406fc22e8f17f72ad9c03b5c3dfff1e62cbe88aba12fb1f0248467bba0d7efb5c322b182e7b53b34f14

Download Submit
C:\Windows\System\ZcjsVXB.exe

Filesize
1.8MB

MD5
60007c917587efda6e64668c76c4064b

SHA1
e28be4783a82a6dff5363fddc028ba0045e0adf4

SHA256
46271a09cc9355ae96bb7b9c49a54a8b783f315410bb86c079d4366b2721843a

SHA512
b1fe21bb708c8339d604c200156888b63160f337736fe94ec323d47e01adaeda34b66c5a76b08b2ea213780abe3158656cc9f8e86a4037d704298985b6e45d8a

Download Submit
C:\Windows\System\ZvHtLtE.exe

Filesize
1.8MB

MD5
5e320f62eda31277aee80847b1e2dadc

SHA1
20d934b290c095fecc875e40782ae55264a568a6

SHA256
d0e33eb73b68836fbd348a53bbfbecf0581ea36a0b3e25340055fc512fd8f96e

SHA512
2f037c1d6f627f3b421a463e29f876d50482e1414f16f190ac285d8996acac576e91bf758762a2535c8c03f6dd2ec2ec8139deac4543701bdf3c2788dc00aa40

Download Submit
C:\Windows\System\dcdaqwo.exe

Filesize
1.8MB

MD5
0bd20551aed36d9d466c8aa6156212a1

SHA1
2f7af7553941c6c398a2ba210f0e2e3477c63c20

SHA256
367f8e400bd5524ad9fa6f0aa4425690128baebca1b2e332d29f258abd5e06b5

SHA512
4e6689893ba5467109ec96b458a745a1fce026d9f802ad4715e657135ef942e8b3e835bfb7ed4a761591aef64de5e06150a548519575d66c3f446aced8201840

Download Submit
C:\Windows\System\hJwirAp.exe

Filesize
1.8MB

MD5
ad23a986aa3db216a3b2d17ef292732f

SHA1
c3a29b896f65cade774a8f9a022143eac6c27bfa

SHA256
ce094e7a7d130b0d1c89c1819aae9bfe118aaa14756f72d1050bc29e8479e158

SHA512
cd11de5931d4af5658115e49a11adcc309bac5dd2b899ed3b7cecdc2c7dabd6585a6b9663dc4050d89dcdf96fea13a4cd4de42abee0044cfa2a5ada6dbd61e8b

Download Submit
C:\Windows\System\ifKYsjc.exe

Filesize
1.8MB

MD5
f1732c3d0b0686d9e0094f37c57826cd

SHA1
e76b98aa09060709d9c89b14a2be116cc11f421a

SHA256
ced48911146176ff55119822434d80da6925ad206d035ddedd1fa6b3abf3e023

SHA512
67a3d91ebe50978901eca5efe65f50f4388b3cd22704ea2514088896eabcc3dc05d2262b875139843bf305508aa34413b8181b86dce81e00b1db32468bec6c11

Download Submit
C:\Windows\System\lbhXyUk.exe

Filesize
1.8MB

MD5
dd92f06ee3e886f081ef4ed3879dac4a

SHA1
253d119c1f9d504bc83df8b076f53416dd281a01

SHA256
381a06b70a11ad349ae9965bdb0dd164e2335fb981d5778c443765aa5abb8556

SHA512
b83a78d0a9d6d4db8f6129af507d8658e73a7b8a9eb05aa2837403594c298abfd9d430c803819f80855fefb123076e44497e079c3c4758bc6ac09de95321c8f4

Download Submit
C:\Windows\System\mGILVgZ.exe

Filesize
1.8MB

MD5
34e6d1e3657a905a22f1f7efbb76f295

SHA1
63dc479a58465ede774510f0877e33599a0041e5

SHA256
40c824511c9db81a487007cea62a54dc4d96b6e9f03c5e4d75938b87151d052d

SHA512
98b75ab6d65628d8356fdf8c6974d71a4696654f37270520586a4422fafea12ed9d504878ab7fc2a54fe3dcaaebaa79fc190d418f70a9acd06e05ae0b7c2d628

Download Submit
C:\Windows\System\nRbrmYp.exe

Filesize
1.8MB

MD5
ab72d462bd8300b0b0f57a053f6369b1

SHA1
8e9322a92d53c0b5cfab00233fdc8955059c4058

SHA256
2731872f20196e1df7a291bbeb5d01cd7dff1d21f5dc1130c7089f4ccf2afdda

SHA512
d95077161ceda985efcbe9b56093c62b1237569a9b7f771a2a3b708dfb39cfc95a4d775d43f749cd33b6a03ca7db240cd2a914af79d3f9c73d1cde3a75716020

Download Submit
C:\Windows\System\oKbJxiH.exe

Filesize
1.8MB

MD5
7c287729000f4d00845d886b7f48e55a

SHA1
3ae982770e64eb33dfa7aa7df3172cd7187a92f0

SHA256
294b451042e018529ebd9f2c5d93b63a2d34a2bc627093e57c1e51a5ab139f49

SHA512
9a2a0c9c1f0b736df4b388b62ee4ad0c69f721bbdbb3e2cea7a42126fc99fa48a2960ab8ae7f512d7ca116d176ea534c3c783805395ad62ba3e5c4c902315c18

Download Submit
C:\Windows\System\rPtubWU.exe

Filesize
1.8MB

MD5
f655698b1a4bc6f2ef02da6c00e0cd64

SHA1
5652cd21d9fc53acda4e4924fcdaa2ab91cf4d71

SHA256
815adc91c22ff6617ef80a7a8c78500133df0f84e5f272828f209320e2161c8e

SHA512
a3dd4c407e10f911445618e316280b72c8c887d5b4beeff9bfada00701bb72a2aa26dc6e1bce0bc5751bf4ecc93dcc341c1abae24162cdf845e50f833a5e8ad7

Download Submit
C:\Windows\System\tREfojO.exe

Filesize
1.8MB

MD5
de4af6db0394c80021198e8cbcdcc423

SHA1
82bea52fc5be6036be30850bfcd11fce689403c7

SHA256
1d4620f7d62f0b6bea333a28b0163556512f07c8eef2e224250cb86ab056eeb5

SHA512
be4fa10b6d4bf1ee35ade6fe4b3cf301810fe75022bee7e6e5ffc6b943c8364a5e12be0add1be56ada88fd9eb10a83ec7285c9a1118cb09c415adf4cbb6ef251

Download Submit
C:\Windows\System\uBnRTIo.exe

Filesize
1.8MB

MD5
8ae72e3b4197b070f23f3a492e0d4572

SHA1
f7e78ec501638495d420c7bbeaf11dac6a573670

SHA256
a0e0503c643dc384d6a7ae3ab1f98e4542ce3b2ec1d7ef266a0bd9b14d38eb1c

SHA512
3a4404ec1ab32b6d0e8bd747213acd6511adcb0e423bf7e9369fd0694261d5ea5b86cfe18ffe1ac6ade4bb879d6f8ba89432398813bb7f5754ad4cf17d596ec8

Download Submit
C:\Windows\System\uJBCGfr.exe

Filesize
1.8MB

MD5
e4ca31fcbea349170821c2e366c0cb63

SHA1
08cba21cb3b3c62da07be4bc380fa7f72322189c

SHA256
3d1cb3bd0b342ed985efeb326a57eb393536f998c6b55524385a2adbe308f7ba

SHA512
15f87fa027e172f8843c7e9863d53bcca2aa8de99d17e3886e367f8048d290e45ddf7d6838fe84758cc74f36823bbae2405a70b53595dcde8dba1da0ff3d1d86

Download Submit
C:\Windows\System\uLUePxj.exe

Filesize
1.8MB

MD5
647c181c9451f4d550aef43c457d0141

SHA1
0b428cd60171f8a0251f9ce9da7dd621bdc63485

SHA256
0365cfcc561a0b01897bfcb35d3a846ab024317298ef0c2452ca63fc6e39f4de

SHA512
6b58d44963337622e5faa6e5e8f78d51993d088a43f4b3e16a66af4035af891ee1eac73f6defd83a6a834ccb5d56a216a7dac5f18f6b817b4533b1b8cb499b49

Download Submit
C:\Windows\System\uffMGPn.exe

Filesize
1.8MB

MD5
0ed928d47e349e21e537baf913203ce0

SHA1
ac9884feb4c78b67f7944a2d5d06eb913295095f

SHA256
2ab523aa79679a1ba50e57ce42ed7bf2ad98d8cf621121df1b2cd697c4908df8

SHA512
a29e3581436513d5bf1a9731f4cb32797af4fb87285990dac976c83e5a0ce5e514fa7909c502a7aa0a8ffd0bf25a28f208393d06884716cc944d355e8a750c71

Download Submit
C:\Windows\System\wQwoPzD.exe

Filesize
1.8MB

MD5
d646edaf1d8ecdf34b36c8ccd3728fbb

SHA1
95019d317c41a540077de11c6ac477030d2c27fc

SHA256
6da829dec1be2bf4c3d24b6bdb885ed6622937d675e6df0ba0eaa4fe6078c644

SHA512
c6c6ba1a15d5321377c153895e5b458f453b07ed8ea5e5b6563fc950e84ad3cae629e5d669a864df776a926bc3ad68d2f3f290e0f922aaffeaa8c34388d88708

Download Submit
C:\Windows\System\wblEkvH.exe

Filesize
1.8MB

MD5
816a151c9d97e07226dbba8be7f625f4

SHA1
3c6f6763715b161c506e096221529b283dc6cf31

SHA256
2df7c35385296acd94df7fc3e6cf510006dde67a58398be1d15330b2c68584d9

SHA512
68a6359db5bf07fbfb567b3bf0e003e231c4372eb5f1abb610d6948dc8ca92b6198b81e331eca046dd868c2e6671bb13524a002f56fe89c357f9f9409a3e00fb

Download Submit
C:\Windows\System\yxeZzSn.exe

Filesize
1.8MB

MD5
3cf76b018518e17f5ef9130132eb157c

SHA1
5d8a0b48a5a3a49b44347d96a49838fa9cf88701

SHA256
ef2bd42ba35d1bab2fe00473276602df91749aaaf1f53b153e0b11fe59f866fb

SHA512
df1f10baedb9d70f509969b29e7beca9d34554caf09676265ff1a011b5122e42359f3e8f8817cb8c61e179ba012ba59f80ee7dcd6ed5481272bad889bc287d46

Download Submit
C:\Windows\System\zAgZgCf.exe

Filesize
1.8MB

MD5
c88782ec5f3d421e729fab7e26b9d04b

SHA1
06dcf324d67917e80e38d34fb938509adff034be

SHA256
f8010fcbe042ce2e7911b8514489bfc67ce965a0ec9b7094de704927c782c35b

SHA512
2d57a8496ce06953eb62c15cbf67698596b6c4b686d37f5eaf1f4e4a79d54b3cc075ab0f3d7255a5800ab088ae35759afe733e78c3d4e703ecbc12b2f82190f6

Download Submit
C:\Windows\System\zLCOLWD.exe

Filesize
1.8MB

MD5
569552ae09db3dea871246373bc53eed

SHA1
1bd2f892de2c5c6acd3f04145ba97c976c1f7cf0

SHA256
8fc3e022d23ff94e0d3b61ce80c901ef400d3a8a3b595457dd45324c36419153

SHA512
f878d302fe522b9868cbfe71b878112c33e6fba7060c83918c3613ee7d44e14968a2452474bcf45ef9c5478caf8e438375883505e81b75006668946042e44e78

Download Submit
memory/616-2887-0x00007FF61BDD0000-0x00007FF61C1C2000-memory.dmp

Filesize
3.9MB

Download
memory/616-68-0x00007FF61BDD0000-0x00007FF61C1C2000-memory.dmp

Filesize
3.9MB

Download
memory/872-2902-0x00007FF6AB0D0000-0x00007FF6AB4C2000-memory.dmp

Filesize
3.9MB

Download
memory/872-430-0x00007FF6AB0D0000-0x00007FF6AB4C2000-memory.dmp

Filesize
3.9MB

Download
memory/944-50-0x00007FF704A20000-0x00007FF704E12000-memory.dmp

Filesize
3.9MB

Download
memory/944-2892-0x00007FF704A20000-0x00007FF704E12000-memory.dmp

Filesize
3.9MB

Download
memory/944-2386-0x00007FF704A20000-0x00007FF704E12000-memory.dmp

Filesize
3.9MB

Download
memory/1992-224-0x00007FF782730000-0x00007FF782B22000-memory.dmp

Filesize
3.9MB

Download
memory/1992-2907-0x00007FF782730000-0x00007FF782B22000-memory.dmp

Filesize
3.9MB

Download
memory/2168-2353-0x00007FF74D3D0000-0x00007FF74D7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-1-0x0000017990200000-0x0000017990210000-memory.dmp

Filesize
64KB

Download
memory/2168-0-0x00007FF74D3D0000-0x00007FF74D7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-2895-0x00007FF79F100000-0x00007FF79F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-2384-0x00007FF79F100000-0x00007FF79F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-37-0x00007FF79F100000-0x00007FF79F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-432-0x00007FF655270000-0x00007FF655662000-memory.dmp

Filesize
3.9MB

Download
memory/2328-2940-0x00007FF655270000-0x00007FF655662000-memory.dmp

Filesize
3.9MB

Download
memory/2368-433-0x00007FF70C510000-0x00007FF70C902000-memory.dmp

Filesize
3.9MB

Download
memory/2368-2943-0x00007FF70C510000-0x00007FF70C902000-memory.dmp

Filesize
3.9MB

Download
memory/2544-103-0x00007FF7041E0000-0x00007FF7045D2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-2903-0x00007FF7041E0000-0x00007FF7045D2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-176-0x00007FF7E69C0000-0x00007FF7E6DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-2906-0x00007FF7E69C0000-0x00007FF7E6DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-2935-0x00007FF696B00000-0x00007FF696EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-299-0x00007FF696B00000-0x00007FF696EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-2929-0x00007FF731EA0000-0x00007FF732292000-memory.dmp

Filesize
3.9MB

Download
memory/2724-422-0x00007FF731EA0000-0x00007FF732292000-memory.dmp

Filesize
3.9MB

Download
memory/2800-2357-0x00007FF7AEBD0000-0x00007FF7AEFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-18-0x00007FF7AEBD0000-0x00007FF7AEFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-2885-0x00007FF7AEBD0000-0x00007FF7AEFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-100-0x00007FF72B630000-0x00007FF72BA22000-memory.dmp

Filesize
3.9MB

Download
memory/2824-2889-0x00007FF72B630000-0x00007FF72BA22000-memory.dmp

Filesize
3.9MB

Download
memory/2996-350-0x000001CFD3440000-0x000001CFD3462000-memory.dmp

Filesize
136KB

Download
memory/2996-428-0x00007FFFD6953000-0x00007FFFD6955000-memory.dmp

Filesize
8KB

Download
memory/2996-19-0x000001CFD1180000-0x000001CFD1190000-memory.dmp

Filesize
64KB

Download
memory/3416-172-0x00007FF7402B0000-0x00007FF7406A2000-memory.dmp

Filesize
3.9MB

Download
memory/3416-2898-0x00007FF7402B0000-0x00007FF7406A2000-memory.dmp

Filesize
3.9MB

Download
memory/4040-2925-0x00007FF777C20000-0x00007FF778012000-memory.dmp

Filesize
3.9MB

Download
memory/4040-302-0x00007FF777C20000-0x00007FF778012000-memory.dmp

Filesize
3.9MB

Download
memory/4116-426-0x00007FF6330B0000-0x00007FF6334A2000-memory.dmp

Filesize
3.9MB

Download
memory/4116-2931-0x00007FF6330B0000-0x00007FF6334A2000-memory.dmp

Filesize
3.9MB

Download
memory/4408-2936-0x00007FF6A70A0000-0x00007FF6A7492000-memory.dmp

Filesize
3.9MB

Download
memory/4408-265-0x00007FF6A70A0000-0x00007FF6A7492000-memory.dmp

Filesize
3.9MB

Download
memory/4440-2927-0x00007FF7FA800000-0x00007FF7FABF2000-memory.dmp

Filesize
3.9MB

Download
memory/4440-418-0x00007FF7FA800000-0x00007FF7FABF2000-memory.dmp

Filesize
3.9MB

Download
memory/4584-2950-0x00007FF6B6040000-0x00007FF6B6432000-memory.dmp

Filesize
3.9MB

Download
memory/4584-356-0x00007FF6B6040000-0x00007FF6B6432000-memory.dmp

Filesize
3.9MB

Download
memory/4592-2899-0x00007FF673960000-0x00007FF673D52000-memory.dmp

Filesize
3.9MB

Download
memory/4592-128-0x00007FF673960000-0x00007FF673D52000-memory.dmp

Filesize
3.9MB

Download
memory/4604-2932-0x00007FF78A4C0000-0x00007FF78A8B2000-memory.dmp

Filesize
3.9MB

Download
memory/4604-431-0x00007FF78A4C0000-0x00007FF78A8B2000-memory.dmp

Filesize
3.9MB

Download
memory/4812-2894-0x00007FF7924A0000-0x00007FF792892000-memory.dmp

Filesize
3.9MB

Download
memory/4812-429-0x00007FF7924A0000-0x00007FF792892000-memory.dmp

Filesize
3.9MB

Download
memory/4956-2939-0x00007FF6E29D0000-0x00007FF6E2DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4956-228-0x00007FF6E29D0000-0x00007FF6E2DC2000-memory.dmp

Filesize
3.9MB

Download
memory/5092-2948-0x00007FF7ED300000-0x00007FF7ED6F2000-memory.dmp

Filesize
3.9MB

Download
memory/5092-427-0x00007FF7ED300000-0x00007FF7ED6F2000-memory.dmp

Filesize
3.9MB

Download