xmrig | 28d1635d8a48b685717b9d90a629034295e9d3bb4a1e407db0b4b3c3813b12d3

Analysis

max time kernel
97s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d12be3997ead3a6debf31b5495411ad0N.exe
Size

1.1MB
MD5

d12be3997ead3a6debf31b5495411ad0
SHA1

7ed85fe8b552eea5f6eb042ee7d9a6eec80ac7a7
SHA256

28d1635d8a48b685717b9d90a629034295e9d3bb4a1e407db0b4b3c3813b12d3
SHA512

10ab513f06fc58b80f6b97f413fe125c19b2d7597f24bf4a6b2d00eae57cf051506065c15d656868415a746c80ee7edf8481fd4f6dd7cd6d576d2c2f8d30ef97
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyWjqOW/KRDcb1XziYuD3:Lz071uv4BPMkyWvW/aYk

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/1504-277-0x00007FF780900000-0x00007FF780CF2000-memory.dmp	xmrig
behavioral2/memory/732-473-0x00007FF69DCB0000-0x00007FF69E0A2000-memory.dmp	xmrig
behavioral2/memory/1936-592-0x00007FF791CD0000-0x00007FF7920C2000-memory.dmp	xmrig
behavioral2/memory/2996-596-0x00007FF624470000-0x00007FF624862000-memory.dmp	xmrig
behavioral2/memory/5100-597-0x00007FF6C36B0000-0x00007FF6C3AA2000-memory.dmp	xmrig
behavioral2/memory/620-2242-0x00007FF6993A0000-0x00007FF699792000-memory.dmp	xmrig
behavioral2/memory/804-2241-0x00007FF727810000-0x00007FF727C02000-memory.dmp	xmrig
behavioral2/memory/3252-2411-0x00007FF7E1340000-0x00007FF7E1732000-memory.dmp	xmrig
behavioral2/memory/1684-2378-0x00007FF7E1280000-0x00007FF7E1672000-memory.dmp	xmrig
behavioral2/memory/5052-2375-0x00007FF776440000-0x00007FF776832000-memory.dmp	xmrig
behavioral2/memory/4496-595-0x00007FF60DA80000-0x00007FF60DE72000-memory.dmp	xmrig
behavioral2/memory/3564-593-0x00007FF6AC240000-0x00007FF6AC632000-memory.dmp	xmrig
behavioral2/memory/1388-591-0x00007FF653AF0000-0x00007FF653EE2000-memory.dmp	xmrig
behavioral2/memory/4488-590-0x00007FF6D3B10000-0x00007FF6D3F02000-memory.dmp	xmrig
behavioral2/memory/3104-432-0x00007FF748AD0000-0x00007FF748EC2000-memory.dmp	xmrig
behavioral2/memory/1964-409-0x00007FF7F5670000-0x00007FF7F5A62000-memory.dmp	xmrig
behavioral2/memory/4820-414-0x00007FF6D6F20000-0x00007FF6D7312000-memory.dmp	xmrig
behavioral2/memory/2640-330-0x00007FF6B7F60000-0x00007FF6B8352000-memory.dmp	xmrig
behavioral2/memory/4076-266-0x00007FF6BDD00000-0x00007FF6BE0F2000-memory.dmp	xmrig
behavioral2/memory/4628-226-0x00007FF6F8AE0000-0x00007FF6F8ED2000-memory.dmp	xmrig
behavioral2/memory/2056-213-0x00007FF7ACDE0000-0x00007FF7AD1D2000-memory.dmp	xmrig
behavioral2/memory/2736-168-0x00007FF7C78D0000-0x00007FF7C7CC2000-memory.dmp	xmrig
behavioral2/memory/3684-151-0x00007FF6A4BE0000-0x00007FF6A4FD2000-memory.dmp	xmrig
behavioral2/memory/4296-60-0x00007FF6EDE70000-0x00007FF6EE262000-memory.dmp	xmrig
behavioral2/memory/5052-30-0x00007FF776440000-0x00007FF776832000-memory.dmp	xmrig
behavioral2/memory/5052-3121-0x00007FF776440000-0x00007FF776832000-memory.dmp	xmrig
behavioral2/memory/620-3123-0x00007FF6993A0000-0x00007FF699792000-memory.dmp	xmrig
behavioral2/memory/4296-3125-0x00007FF6EDE70000-0x00007FF6EE262000-memory.dmp	xmrig
behavioral2/memory/3252-3129-0x00007FF7E1340000-0x00007FF7E1732000-memory.dmp	xmrig
behavioral2/memory/3684-3135-0x00007FF6A4BE0000-0x00007FF6A4FD2000-memory.dmp	xmrig
behavioral2/memory/608-3149-0x00007FF62A310000-0x00007FF62A702000-memory.dmp	xmrig
behavioral2/memory/2736-3160-0x00007FF7C78D0000-0x00007FF7C7CC2000-memory.dmp	xmrig
behavioral2/memory/2056-3162-0x00007FF7ACDE0000-0x00007FF7AD1D2000-memory.dmp	xmrig
behavioral2/memory/2640-3168-0x00007FF6B7F60000-0x00007FF6B8352000-memory.dmp	xmrig
behavioral2/memory/4628-3166-0x00007FF6F8AE0000-0x00007FF6F8ED2000-memory.dmp	xmrig
behavioral2/memory/4496-3164-0x00007FF60DA80000-0x00007FF60DE72000-memory.dmp	xmrig
behavioral2/memory/1504-3158-0x00007FF780900000-0x00007FF780CF2000-memory.dmp	xmrig
behavioral2/memory/2996-3157-0x00007FF624470000-0x00007FF624862000-memory.dmp	xmrig
behavioral2/memory/4820-3155-0x00007FF6D6F20000-0x00007FF6D7312000-memory.dmp	xmrig
behavioral2/memory/1684-3132-0x00007FF7E1280000-0x00007FF7E1672000-memory.dmp	xmrig
behavioral2/memory/4076-3127-0x00007FF6BDD00000-0x00007FF6BE0F2000-memory.dmp	xmrig
behavioral2/memory/3564-3133-0x00007FF6AC240000-0x00007FF6AC632000-memory.dmp	xmrig
behavioral2/memory/3104-3190-0x00007FF748AD0000-0x00007FF748EC2000-memory.dmp	xmrig
behavioral2/memory/5100-3234-0x00007FF6C36B0000-0x00007FF6C3AA2000-memory.dmp	xmrig
behavioral2/memory/1964-3197-0x00007FF7F5670000-0x00007FF7F5A62000-memory.dmp	xmrig
behavioral2/memory/4488-3193-0x00007FF6D3B10000-0x00007FF6D3F02000-memory.dmp	xmrig
behavioral2/memory/732-3205-0x00007FF69DCB0000-0x00007FF69E0A2000-memory.dmp	xmrig
behavioral2/memory/1388-3201-0x00007FF653AF0000-0x00007FF653EE2000-memory.dmp	xmrig
behavioral2/memory/1936-3199-0x00007FF791CD0000-0x00007FF7920C2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4872	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
620	AWgOyfj.exe
5052	keqqcPL.exe
3564	hLciKof.exe
1684	SmPxYCZ.exe
4296	XQrbCkp.exe
3252	RBtHvLl.exe
608	cekAkqs.exe
3684	tguJilk.exe
2736	kZUUvkz.exe
2056	kpNqSuK.exe
4496	hRbgTzE.exe
4628	MkkTyXz.exe
4076	HVHkoUf.exe
1504	ubyHaGl.exe
2640	XvaoIVo.exe
1964	sbsyXiH.exe
2996	DSSqvDN.exe
4820	dejjzQS.exe
3104	YCXiRvo.exe
732	WnrMztp.exe
4488	IDauTtT.exe
5100	KgHsfZH.exe
1388	JPPilYa.exe
1936	GmNozrm.exe
2072	zxsjzIR.exe
4640	gZDKymC.exe
4056	NvdQnCh.exe
1956	mijtxpL.exe
1604	GMJAQpG.exe
544	zHrcafg.exe
116	fWiWggy.exe
896	wIoSYtA.exe
4888	iAslwDF.exe
4924	eYXNDuY.exe
1596	YBpqPAY.exe
4956	gNnbeCk.exe
2312	rXRuMOi.exe
808	WjDKnUj.exe
2456	dsoCvhI.exe
4516	WMnzNPt.exe
2060	PLssJoR.exe
5020	jviLKev.exe
404	PAQOZQW.exe
1720	kwFShUs.exe
4284	NbJPxKW.exe
2848	KJGzoGT.exe
4440	GWLUQin.exe
5104	QDbXYDf.exe
812	GVYRKrn.exe
2868	NTiILNy.exe
1856	sgACbXM.exe
1648	gEqshCU.exe
4144	DcaQrGj.exe
4876	qMQXnZC.exe
1144	JkxskOR.exe
668	aUIWFDm.exe
4444	SjTIfHb.exe
3688	tBBWzWi.exe
1324	tJqQIYG.exe
4540	hKZMhvD.exe
1188	WrEwpLF.exe
64	pxVzSwk.exe
4428	hhunBdE.exe
2188	SORMWJg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/804-0-0x00007FF727810000-0x00007FF727C02000-memory.dmp	upx
behavioral2/files/0x000700000002345a-7.dat	upx
behavioral2/files/0x0007000000023465-71.dat	upx
behavioral2/files/0x000700000002346b-111.dat	upx
behavioral2/files/0x0007000000023466-134.dat	upx
behavioral2/memory/1504-277-0x00007FF780900000-0x00007FF780CF2000-memory.dmp	upx
behavioral2/memory/732-473-0x00007FF69DCB0000-0x00007FF69E0A2000-memory.dmp	upx
behavioral2/memory/1936-592-0x00007FF791CD0000-0x00007FF7920C2000-memory.dmp	upx
behavioral2/memory/2996-596-0x00007FF624470000-0x00007FF624862000-memory.dmp	upx
behavioral2/memory/5100-597-0x00007FF6C36B0000-0x00007FF6C3AA2000-memory.dmp	upx
behavioral2/memory/620-2242-0x00007FF6993A0000-0x00007FF699792000-memory.dmp	upx
behavioral2/memory/804-2241-0x00007FF727810000-0x00007FF727C02000-memory.dmp	upx
behavioral2/memory/3252-2411-0x00007FF7E1340000-0x00007FF7E1732000-memory.dmp	upx
behavioral2/memory/1684-2378-0x00007FF7E1280000-0x00007FF7E1672000-memory.dmp	upx
behavioral2/memory/5052-2375-0x00007FF776440000-0x00007FF776832000-memory.dmp	upx
behavioral2/memory/4496-595-0x00007FF60DA80000-0x00007FF60DE72000-memory.dmp	upx
behavioral2/memory/3564-593-0x00007FF6AC240000-0x00007FF6AC632000-memory.dmp	upx
behavioral2/memory/1388-591-0x00007FF653AF0000-0x00007FF653EE2000-memory.dmp	upx
behavioral2/memory/4488-590-0x00007FF6D3B10000-0x00007FF6D3F02000-memory.dmp	upx
behavioral2/memory/3104-432-0x00007FF748AD0000-0x00007FF748EC2000-memory.dmp	upx
behavioral2/memory/1964-409-0x00007FF7F5670000-0x00007FF7F5A62000-memory.dmp	upx
behavioral2/memory/4820-414-0x00007FF6D6F20000-0x00007FF6D7312000-memory.dmp	upx
behavioral2/memory/2640-330-0x00007FF6B7F60000-0x00007FF6B8352000-memory.dmp	upx
behavioral2/memory/4076-266-0x00007FF6BDD00000-0x00007FF6BE0F2000-memory.dmp	upx
behavioral2/memory/4628-226-0x00007FF6F8AE0000-0x00007FF6F8ED2000-memory.dmp	upx
behavioral2/files/0x0007000000023470-183.dat	upx
behavioral2/files/0x000700000002346f-181.dat	upx
behavioral2/memory/2056-213-0x00007FF7ACDE0000-0x00007FF7AD1D2000-memory.dmp	upx
behavioral2/memory/2736-168-0x00007FF7C78D0000-0x00007FF7C7CC2000-memory.dmp	upx
behavioral2/files/0x000700000002347d-167.dat	upx
behavioral2/files/0x000700000002347c-166.dat	upx
behavioral2/files/0x000700000002346d-165.dat	upx
behavioral2/files/0x0007000000023476-164.dat	upx
behavioral2/files/0x000700000002347b-163.dat	upx
behavioral2/files/0x000700000002347a-162.dat	upx
behavioral2/files/0x000700000002346c-161.dat	upx
behavioral2/files/0x0007000000023479-160.dat	upx
behavioral2/files/0x0007000000023467-159.dat	upx
behavioral2/files/0x0007000000023473-158.dat	upx
behavioral2/files/0x0007000000023472-157.dat	upx
behavioral2/files/0x0007000000023478-156.dat	upx
behavioral2/memory/3684-151-0x00007FF6A4BE0000-0x00007FF6A4FD2000-memory.dmp	upx
behavioral2/files/0x0007000000023477-148.dat	upx
behavioral2/files/0x000700000002346e-147.dat	upx
behavioral2/files/0x0007000000023475-141.dat	upx
behavioral2/files/0x0007000000023474-140.dat	upx
behavioral2/files/0x000700000002346a-131.dat	upx
behavioral2/files/0x0007000000023471-130.dat	upx
behavioral2/memory/608-123-0x00007FF62A310000-0x00007FF62A702000-memory.dmp	upx
behavioral2/files/0x0007000000023463-117.dat	upx
behavioral2/files/0x0007000000023462-107.dat	upx
behavioral2/files/0x0007000000023461-104.dat	upx
behavioral2/files/0x0007000000023469-96.dat	upx
behavioral2/files/0x0007000000023468-95.dat	upx
behavioral2/files/0x000700000002345f-87.dat	upx
behavioral2/files/0x000700000002345e-125.dat	upx
behavioral2/files/0x0007000000023464-68.dat	upx
behavioral2/memory/3252-82-0x00007FF7E1340000-0x00007FF7E1732000-memory.dmp	upx
behavioral2/memory/4296-60-0x00007FF6EDE70000-0x00007FF6EE262000-memory.dmp	upx
behavioral2/files/0x000700000002345b-50.dat	upx
behavioral2/files/0x0007000000023460-46.dat	upx
behavioral2/files/0x000700000002345d-42.dat	upx
behavioral2/memory/1684-35-0x00007FF7E1280000-0x00007FF7E1672000-memory.dmp	upx
behavioral2/memory/5052-30-0x00007FF776440000-0x00007FF776832000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jtaRIIG.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\StpiKir.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\YkKkGem.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\mPItixZ.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\KiabIHh.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\KxKshNx.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\NvdQnCh.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\YBpqPAY.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\aBfYQaf.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\UHyuAbE.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\YcZrqcM.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\tsCygoO.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\luIyxAG.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\gocMZGB.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\PIsihDU.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\XvHSZbX.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\wboCgPG.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\oRxjDHC.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\keqqcPL.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\tTZEjiO.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\SswUQuG.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\erFJYHb.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\hhtZaSe.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\WdrNzEg.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\cibvMuw.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\GltJZpE.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\mUrIlry.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\LMDWhFY.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\VwSTWwc.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\gBxiJnX.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\oSzePCe.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\cLoZdWh.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\HgFFsYr.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\BAXXMUI.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\WAjGpId.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\ruvqKBk.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\AlEDWaZ.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\BmQZsrH.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\sAJcQyS.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\jEBiuWS.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\iYlqqte.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\lMLUxjQ.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\bLJfQrj.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\UTxNlSY.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\LrAeKqn.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\rNoYaxB.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\gmMNdtf.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\IAXeOxa.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\CuCDROp.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\IIvZrMU.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\XAuUsJk.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\rIIRGzE.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\dPrZPAE.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\xVBxRGc.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\OuXFYCU.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\VNCpLkZ.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\uCXnMGl.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\oJOeWDt.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\KGjDBTk.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\raveNoq.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\YxguJcy.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\kZUUvkz.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\BHZvKwy.exe	d12be3997ead3a6debf31b5495411ad0N.exe
File created	C:\Windows\System\EORfVFK.exe	d12be3997ead3a6debf31b5495411ad0N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	804	d12be3997ead3a6debf31b5495411ad0N.exe
Token: SeLockMemoryPrivilege	804	d12be3997ead3a6debf31b5495411ad0N.exe
Token: SeDebugPrivilege	4872	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 4872	804	d12be3997ead3a6debf31b5495411ad0N.exe	84
PID 804 wrote to memory of 4872	804	d12be3997ead3a6debf31b5495411ad0N.exe	84
PID 804 wrote to memory of 620	804	d12be3997ead3a6debf31b5495411ad0N.exe	85
PID 804 wrote to memory of 620	804	d12be3997ead3a6debf31b5495411ad0N.exe	85
PID 804 wrote to memory of 5052	804	d12be3997ead3a6debf31b5495411ad0N.exe	86
PID 804 wrote to memory of 5052	804	d12be3997ead3a6debf31b5495411ad0N.exe	86
PID 804 wrote to memory of 3564	804	d12be3997ead3a6debf31b5495411ad0N.exe	87
PID 804 wrote to memory of 3564	804	d12be3997ead3a6debf31b5495411ad0N.exe	87
PID 804 wrote to memory of 1684	804	d12be3997ead3a6debf31b5495411ad0N.exe	88
PID 804 wrote to memory of 1684	804	d12be3997ead3a6debf31b5495411ad0N.exe	88
PID 804 wrote to memory of 4296	804	d12be3997ead3a6debf31b5495411ad0N.exe	89
PID 804 wrote to memory of 4296	804	d12be3997ead3a6debf31b5495411ad0N.exe	89
PID 804 wrote to memory of 3252	804	d12be3997ead3a6debf31b5495411ad0N.exe	90
PID 804 wrote to memory of 3252	804	d12be3997ead3a6debf31b5495411ad0N.exe	90
PID 804 wrote to memory of 4628	804	d12be3997ead3a6debf31b5495411ad0N.exe	91
PID 804 wrote to memory of 4628	804	d12be3997ead3a6debf31b5495411ad0N.exe	91
PID 804 wrote to memory of 608	804	d12be3997ead3a6debf31b5495411ad0N.exe	92
PID 804 wrote to memory of 608	804	d12be3997ead3a6debf31b5495411ad0N.exe	92
PID 804 wrote to memory of 3684	804	d12be3997ead3a6debf31b5495411ad0N.exe	93
PID 804 wrote to memory of 3684	804	d12be3997ead3a6debf31b5495411ad0N.exe	93
PID 804 wrote to memory of 2736	804	d12be3997ead3a6debf31b5495411ad0N.exe	94
PID 804 wrote to memory of 2736	804	d12be3997ead3a6debf31b5495411ad0N.exe	94
PID 804 wrote to memory of 2056	804	d12be3997ead3a6debf31b5495411ad0N.exe	95
PID 804 wrote to memory of 2056	804	d12be3997ead3a6debf31b5495411ad0N.exe	95
PID 804 wrote to memory of 4496	804	d12be3997ead3a6debf31b5495411ad0N.exe	96
PID 804 wrote to memory of 4496	804	d12be3997ead3a6debf31b5495411ad0N.exe	96
PID 804 wrote to memory of 4076	804	d12be3997ead3a6debf31b5495411ad0N.exe	97
PID 804 wrote to memory of 4076	804	d12be3997ead3a6debf31b5495411ad0N.exe	97
PID 804 wrote to memory of 1504	804	d12be3997ead3a6debf31b5495411ad0N.exe	98
PID 804 wrote to memory of 1504	804	d12be3997ead3a6debf31b5495411ad0N.exe	98
PID 804 wrote to memory of 2640	804	d12be3997ead3a6debf31b5495411ad0N.exe	99
PID 804 wrote to memory of 2640	804	d12be3997ead3a6debf31b5495411ad0N.exe	99
PID 804 wrote to memory of 1964	804	d12be3997ead3a6debf31b5495411ad0N.exe	100
PID 804 wrote to memory of 1964	804	d12be3997ead3a6debf31b5495411ad0N.exe	100
PID 804 wrote to memory of 2996	804	d12be3997ead3a6debf31b5495411ad0N.exe	101
PID 804 wrote to memory of 2996	804	d12be3997ead3a6debf31b5495411ad0N.exe	101
PID 804 wrote to memory of 4820	804	d12be3997ead3a6debf31b5495411ad0N.exe	102
PID 804 wrote to memory of 4820	804	d12be3997ead3a6debf31b5495411ad0N.exe	102
PID 804 wrote to memory of 2072	804	d12be3997ead3a6debf31b5495411ad0N.exe	103
PID 804 wrote to memory of 2072	804	d12be3997ead3a6debf31b5495411ad0N.exe	103
PID 804 wrote to memory of 3104	804	d12be3997ead3a6debf31b5495411ad0N.exe	104
PID 804 wrote to memory of 3104	804	d12be3997ead3a6debf31b5495411ad0N.exe	104
PID 804 wrote to memory of 732	804	d12be3997ead3a6debf31b5495411ad0N.exe	105
PID 804 wrote to memory of 732	804	d12be3997ead3a6debf31b5495411ad0N.exe	105
PID 804 wrote to memory of 4488	804	d12be3997ead3a6debf31b5495411ad0N.exe	106
PID 804 wrote to memory of 4488	804	d12be3997ead3a6debf31b5495411ad0N.exe	106
PID 804 wrote to memory of 116	804	d12be3997ead3a6debf31b5495411ad0N.exe	107
PID 804 wrote to memory of 116	804	d12be3997ead3a6debf31b5495411ad0N.exe	107
PID 804 wrote to memory of 5100	804	d12be3997ead3a6debf31b5495411ad0N.exe	108
PID 804 wrote to memory of 5100	804	d12be3997ead3a6debf31b5495411ad0N.exe	108
PID 804 wrote to memory of 1388	804	d12be3997ead3a6debf31b5495411ad0N.exe	109
PID 804 wrote to memory of 1388	804	d12be3997ead3a6debf31b5495411ad0N.exe	109
PID 804 wrote to memory of 1936	804	d12be3997ead3a6debf31b5495411ad0N.exe	110
PID 804 wrote to memory of 1936	804	d12be3997ead3a6debf31b5495411ad0N.exe	110
PID 804 wrote to memory of 4640	804	d12be3997ead3a6debf31b5495411ad0N.exe	111
PID 804 wrote to memory of 4640	804	d12be3997ead3a6debf31b5495411ad0N.exe	111
PID 804 wrote to memory of 4056	804	d12be3997ead3a6debf31b5495411ad0N.exe	112
PID 804 wrote to memory of 4056	804	d12be3997ead3a6debf31b5495411ad0N.exe	112
PID 804 wrote to memory of 1956	804	d12be3997ead3a6debf31b5495411ad0N.exe	113
PID 804 wrote to memory of 1956	804	d12be3997ead3a6debf31b5495411ad0N.exe	113
PID 804 wrote to memory of 1604	804	d12be3997ead3a6debf31b5495411ad0N.exe	114
PID 804 wrote to memory of 1604	804	d12be3997ead3a6debf31b5495411ad0N.exe	114
PID 804 wrote to memory of 544	804	d12be3997ead3a6debf31b5495411ad0N.exe	115
PID 804 wrote to memory of 544	804	d12be3997ead3a6debf31b5495411ad0N.exe	115

C:\Users\Admin\AppData\Local\Temp\d12be3997ead3a6debf31b5495411ad0N.exe
"C:\Users\Admin\AppData\Local\Temp\d12be3997ead3a6debf31b5495411ad0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Windows\System\AWgOyfj.exe
  C:\Windows\System\AWgOyfj.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\keqqcPL.exe
  C:\Windows\System\keqqcPL.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\hLciKof.exe
  C:\Windows\System\hLciKof.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\SmPxYCZ.exe
  C:\Windows\System\SmPxYCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\XQrbCkp.exe
  C:\Windows\System\XQrbCkp.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\RBtHvLl.exe
  C:\Windows\System\RBtHvLl.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\MkkTyXz.exe
  C:\Windows\System\MkkTyXz.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\cekAkqs.exe
  C:\Windows\System\cekAkqs.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\tguJilk.exe
  C:\Windows\System\tguJilk.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\kZUUvkz.exe
  C:\Windows\System\kZUUvkz.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\kpNqSuK.exe
  C:\Windows\System\kpNqSuK.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\hRbgTzE.exe
  C:\Windows\System\hRbgTzE.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\HVHkoUf.exe
  C:\Windows\System\HVHkoUf.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\ubyHaGl.exe
  C:\Windows\System\ubyHaGl.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\XvaoIVo.exe
  C:\Windows\System\XvaoIVo.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\sbsyXiH.exe
  C:\Windows\System\sbsyXiH.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\DSSqvDN.exe
  C:\Windows\System\DSSqvDN.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\dejjzQS.exe
  C:\Windows\System\dejjzQS.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\zxsjzIR.exe
  C:\Windows\System\zxsjzIR.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\YCXiRvo.exe
  C:\Windows\System\YCXiRvo.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\WnrMztp.exe
  C:\Windows\System\WnrMztp.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\IDauTtT.exe
  C:\Windows\System\IDauTtT.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\fWiWggy.exe
  C:\Windows\System\fWiWggy.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\KgHsfZH.exe
  C:\Windows\System\KgHsfZH.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\JPPilYa.exe
  C:\Windows\System\JPPilYa.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\GmNozrm.exe
  C:\Windows\System\GmNozrm.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\gZDKymC.exe
  C:\Windows\System\gZDKymC.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\NvdQnCh.exe
  C:\Windows\System\NvdQnCh.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\mijtxpL.exe
  C:\Windows\System\mijtxpL.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\GMJAQpG.exe
  C:\Windows\System\GMJAQpG.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\zHrcafg.exe
  C:\Windows\System\zHrcafg.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\wIoSYtA.exe
  C:\Windows\System\wIoSYtA.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\iAslwDF.exe
  C:\Windows\System\iAslwDF.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\eYXNDuY.exe
  C:\Windows\System\eYXNDuY.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\YBpqPAY.exe
  C:\Windows\System\YBpqPAY.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\gNnbeCk.exe
  C:\Windows\System\gNnbeCk.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\rXRuMOi.exe
  C:\Windows\System\rXRuMOi.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\WjDKnUj.exe
  C:\Windows\System\WjDKnUj.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\dsoCvhI.exe
  C:\Windows\System\dsoCvhI.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\QDbXYDf.exe
  C:\Windows\System\QDbXYDf.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\GVYRKrn.exe
  C:\Windows\System\GVYRKrn.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\gEqshCU.exe
  C:\Windows\System\gEqshCU.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\WMnzNPt.exe
  C:\Windows\System\WMnzNPt.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\PLssJoR.exe
  C:\Windows\System\PLssJoR.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\jviLKev.exe
  C:\Windows\System\jviLKev.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\PAQOZQW.exe
  C:\Windows\System\PAQOZQW.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\kwFShUs.exe
  C:\Windows\System\kwFShUs.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\NbJPxKW.exe
  C:\Windows\System\NbJPxKW.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\KJGzoGT.exe
  C:\Windows\System\KJGzoGT.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\GWLUQin.exe
  C:\Windows\System\GWLUQin.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\NTiILNy.exe
  C:\Windows\System\NTiILNy.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\sgACbXM.exe
  C:\Windows\System\sgACbXM.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\DcaQrGj.exe
  C:\Windows\System\DcaQrGj.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\uLgyaEU.exe
  C:\Windows\System\uLgyaEU.exe
  2⤵
  PID:4252
- C:\Windows\System\qMQXnZC.exe
  C:\Windows\System\qMQXnZC.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\JkxskOR.exe
  C:\Windows\System\JkxskOR.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\aUIWFDm.exe
  C:\Windows\System\aUIWFDm.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\SjTIfHb.exe
  C:\Windows\System\SjTIfHb.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\tBBWzWi.exe
  C:\Windows\System\tBBWzWi.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\tJqQIYG.exe
  C:\Windows\System\tJqQIYG.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\hKZMhvD.exe
  C:\Windows\System\hKZMhvD.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\WrEwpLF.exe
  C:\Windows\System\WrEwpLF.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\pxVzSwk.exe
  C:\Windows\System\pxVzSwk.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\hhunBdE.exe
  C:\Windows\System\hhunBdE.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\SORMWJg.exe
  C:\Windows\System\SORMWJg.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\EkkIRdC.exe
  C:\Windows\System\EkkIRdC.exe
  2⤵
  PID:4140
- C:\Windows\System\RaShRVB.exe
  C:\Windows\System\RaShRVB.exe
  2⤵
  PID:1516
- C:\Windows\System\Jwsinwg.exe
  C:\Windows\System\Jwsinwg.exe
  2⤵
  PID:2864
- C:\Windows\System\JnOPAPD.exe
  C:\Windows\System\JnOPAPD.exe
  2⤵
  PID:2980
- C:\Windows\System\lVGIBkN.exe
  C:\Windows\System\lVGIBkN.exe
  2⤵
  PID:3096
- C:\Windows\System\OzToSds.exe
  C:\Windows\System\OzToSds.exe
  2⤵
  PID:8
- C:\Windows\System\NVEiOkU.exe
  C:\Windows\System\NVEiOkU.exe
  2⤵
  PID:1340
- C:\Windows\System\ewWCSds.exe
  C:\Windows\System\ewWCSds.exe
  2⤵
  PID:4552
- C:\Windows\System\EDxUMhT.exe
  C:\Windows\System\EDxUMhT.exe
  2⤵
  PID:1312
- C:\Windows\System\iIEiCNJ.exe
  C:\Windows\System\iIEiCNJ.exe
  2⤵
  PID:3536
- C:\Windows\System\AABPpat.exe
  C:\Windows\System\AABPpat.exe
  2⤵
  PID:3872
- C:\Windows\System\aXKEpAg.exe
  C:\Windows\System\aXKEpAg.exe
  2⤵
  PID:3628
- C:\Windows\System\zDxiYXc.exe
  C:\Windows\System\zDxiYXc.exe
  2⤵
  PID:5012
- C:\Windows\System\awSuXnv.exe
  C:\Windows\System\awSuXnv.exe
  2⤵
  PID:412
- C:\Windows\System\iiHUfwO.exe
  C:\Windows\System\iiHUfwO.exe
  2⤵
  PID:4136
- C:\Windows\System\BubevtX.exe
  C:\Windows\System\BubevtX.exe
  2⤵
  PID:2376
- C:\Windows\System\pSqKacc.exe
  C:\Windows\System\pSqKacc.exe
  2⤵
  PID:4028
- C:\Windows\System\EJlrFYq.exe
  C:\Windows\System\EJlrFYq.exe
  2⤵
  PID:3136
- C:\Windows\System\sETiWTn.exe
  C:\Windows\System\sETiWTn.exe
  2⤵
  PID:4228
- C:\Windows\System\PwujEZH.exe
  C:\Windows\System\PwujEZH.exe
  2⤵
  PID:2180
- C:\Windows\System\ogAQCVA.exe
  C:\Windows\System\ogAQCVA.exe
  2⤵
  PID:5136
- C:\Windows\System\BqjxhKS.exe
  C:\Windows\System\BqjxhKS.exe
  2⤵
  PID:5156
- C:\Windows\System\sHQzZlk.exe
  C:\Windows\System\sHQzZlk.exe
  2⤵
  PID:5172
- C:\Windows\System\uIEJOoI.exe
  C:\Windows\System\uIEJOoI.exe
  2⤵
  PID:5192
- C:\Windows\System\ohZhuLI.exe
  C:\Windows\System\ohZhuLI.exe
  2⤵
  PID:5208
- C:\Windows\System\qxkqPHQ.exe
  C:\Windows\System\qxkqPHQ.exe
  2⤵
  PID:5236
- C:\Windows\System\hPtpFCw.exe
  C:\Windows\System\hPtpFCw.exe
  2⤵
  PID:5260
- C:\Windows\System\iQXdzkv.exe
  C:\Windows\System\iQXdzkv.exe
  2⤵
  PID:5276
- C:\Windows\System\YueEQOf.exe
  C:\Windows\System\YueEQOf.exe
  2⤵
  PID:5304
- C:\Windows\System\BAXXMUI.exe
  C:\Windows\System\BAXXMUI.exe
  2⤵
  PID:5328
- C:\Windows\System\NprasJs.exe
  C:\Windows\System\NprasJs.exe
  2⤵
  PID:5344
- C:\Windows\System\tnBIeWO.exe
  C:\Windows\System\tnBIeWO.exe
  2⤵
  PID:5364
- C:\Windows\System\sWhKIKe.exe
  C:\Windows\System\sWhKIKe.exe
  2⤵
  PID:5384
- C:\Windows\System\BdISqqD.exe
  C:\Windows\System\BdISqqD.exe
  2⤵
  PID:5408
- C:\Windows\System\UEMdTZR.exe
  C:\Windows\System\UEMdTZR.exe
  2⤵
  PID:5424
- C:\Windows\System\ZhriTNL.exe
  C:\Windows\System\ZhriTNL.exe
  2⤵
  PID:5444
- C:\Windows\System\zjgHPuc.exe
  C:\Windows\System\zjgHPuc.exe
  2⤵
  PID:5468
- C:\Windows\System\mwIGvGw.exe
  C:\Windows\System\mwIGvGw.exe
  2⤵
  PID:5484
- C:\Windows\System\MzgTtjF.exe
  C:\Windows\System\MzgTtjF.exe
  2⤵
  PID:5504
- C:\Windows\System\tTZEjiO.exe
  C:\Windows\System\tTZEjiO.exe
  2⤵
  PID:5520
- C:\Windows\System\oSuEjaf.exe
  C:\Windows\System\oSuEjaf.exe
  2⤵
  PID:5536
- C:\Windows\System\kLNWlKQ.exe
  C:\Windows\System\kLNWlKQ.exe
  2⤵
  PID:5552
- C:\Windows\System\GTMFvCQ.exe
  C:\Windows\System\GTMFvCQ.exe
  2⤵
  PID:5580
- C:\Windows\System\QKNkzUy.exe
  C:\Windows\System\QKNkzUy.exe
  2⤵
  PID:5596
- C:\Windows\System\bSkfwUj.exe
  C:\Windows\System\bSkfwUj.exe
  2⤵
  PID:5624
- C:\Windows\System\opFgauM.exe
  C:\Windows\System\opFgauM.exe
  2⤵
  PID:5648
- C:\Windows\System\nMDMmQZ.exe
  C:\Windows\System\nMDMmQZ.exe
  2⤵
  PID:5672
- C:\Windows\System\wKTfeAh.exe
  C:\Windows\System\wKTfeAh.exe
  2⤵
  PID:5692
- C:\Windows\System\oADAicj.exe
  C:\Windows\System\oADAicj.exe
  2⤵
  PID:5708
- C:\Windows\System\xUkiwLa.exe
  C:\Windows\System\xUkiwLa.exe
  2⤵
  PID:5732
- C:\Windows\System\RKEXrjc.exe
  C:\Windows\System\RKEXrjc.exe
  2⤵
  PID:5748
- C:\Windows\System\cUMjuqh.exe
  C:\Windows\System\cUMjuqh.exe
  2⤵
  PID:5768
- C:\Windows\System\KcaRnFj.exe
  C:\Windows\System\KcaRnFj.exe
  2⤵
  PID:5808
- C:\Windows\System\oKaoomM.exe
  C:\Windows\System\oKaoomM.exe
  2⤵
  PID:5832
- C:\Windows\System\tQAoWIt.exe
  C:\Windows\System\tQAoWIt.exe
  2⤵
  PID:5852
- C:\Windows\System\jAkTujP.exe
  C:\Windows\System\jAkTujP.exe
  2⤵
  PID:5868
- C:\Windows\System\MVuoTrq.exe
  C:\Windows\System\MVuoTrq.exe
  2⤵
  PID:5896
- C:\Windows\System\gBxiJnX.exe
  C:\Windows\System\gBxiJnX.exe
  2⤵
  PID:5912
- C:\Windows\System\UrYjHHv.exe
  C:\Windows\System\UrYjHHv.exe
  2⤵
  PID:5944
- C:\Windows\System\LmiOukB.exe
  C:\Windows\System\LmiOukB.exe
  2⤵
  PID:5964
- C:\Windows\System\TzOQFbJ.exe
  C:\Windows\System\TzOQFbJ.exe
  2⤵
  PID:5988
- C:\Windows\System\lwibWiF.exe
  C:\Windows\System\lwibWiF.exe
  2⤵
  PID:6008
- C:\Windows\System\TBUfSgM.exe
  C:\Windows\System\TBUfSgM.exe
  2⤵
  PID:6024
- C:\Windows\System\GFRkahF.exe
  C:\Windows\System\GFRkahF.exe
  2⤵
  PID:6044
- C:\Windows\System\Ufzemze.exe
  C:\Windows\System\Ufzemze.exe
  2⤵
  PID:6060
- C:\Windows\System\RDWmixr.exe
  C:\Windows\System\RDWmixr.exe
  2⤵
  PID:6076
- C:\Windows\System\yLIsjkB.exe
  C:\Windows\System\yLIsjkB.exe
  2⤵
  PID:3156
- C:\Windows\System\oEePleI.exe
  C:\Windows\System\oEePleI.exe
  2⤵
  PID:5072
- C:\Windows\System\vJeDsSL.exe
  C:\Windows\System\vJeDsSL.exe
  2⤵
  PID:1224
- C:\Windows\System\jBRmedD.exe
  C:\Windows\System\jBRmedD.exe
  2⤵
  PID:916
- C:\Windows\System\fSeAqOE.exe
  C:\Windows\System\fSeAqOE.exe
  2⤵
  PID:6072
- C:\Windows\System\NrWUvLh.exe
  C:\Windows\System\NrWUvLh.exe
  2⤵
  PID:1352
- C:\Windows\System\VcgzTmO.exe
  C:\Windows\System\VcgzTmO.exe
  2⤵
  PID:3412
- C:\Windows\System\gSRNsTf.exe
  C:\Windows\System\gSRNsTf.exe
  2⤵
  PID:4508
- C:\Windows\System\duOHXfv.exe
  C:\Windows\System\duOHXfv.exe
  2⤵
  PID:3920
- C:\Windows\System\uYigFxq.exe
  C:\Windows\System\uYigFxq.exe
  2⤵
  PID:1664
- C:\Windows\System\rqgRjmc.exe
  C:\Windows\System\rqgRjmc.exe
  2⤵
  PID:5228
- C:\Windows\System\nRlsKOv.exe
  C:\Windows\System\nRlsKOv.exe
  2⤵
  PID:5284
- C:\Windows\System\kawIKad.exe
  C:\Windows\System\kawIKad.exe
  2⤵
  PID:5324
- C:\Windows\System\hbpOroC.exe
  C:\Windows\System\hbpOroC.exe
  2⤵
  PID:4156
- C:\Windows\System\hlTHjMl.exe
  C:\Windows\System\hlTHjMl.exe
  2⤵
  PID:5372
- C:\Windows\System\eYsOVBo.exe
  C:\Windows\System\eYsOVBo.exe
  2⤵
  PID:5480
- C:\Windows\System\fOuLwsX.exe
  C:\Windows\System\fOuLwsX.exe
  2⤵
  PID:6164
- C:\Windows\System\pXrVotl.exe
  C:\Windows\System\pXrVotl.exe
  2⤵
  PID:6180
- C:\Windows\System\KGJLxLM.exe
  C:\Windows\System\KGJLxLM.exe
  2⤵
  PID:6260
- C:\Windows\System\SjjVaiU.exe
  C:\Windows\System\SjjVaiU.exe
  2⤵
  PID:6280
- C:\Windows\System\OMssCBa.exe
  C:\Windows\System\OMssCBa.exe
  2⤵
  PID:6300
- C:\Windows\System\ZSaFoik.exe
  C:\Windows\System\ZSaFoik.exe
  2⤵
  PID:6324
- C:\Windows\System\CDqpvnu.exe
  C:\Windows\System\CDqpvnu.exe
  2⤵
  PID:6344
- C:\Windows\System\aoraPFR.exe
  C:\Windows\System\aoraPFR.exe
  2⤵
  PID:6364
- C:\Windows\System\bosbwnc.exe
  C:\Windows\System\bosbwnc.exe
  2⤵
  PID:6388
- C:\Windows\System\SswUQuG.exe
  C:\Windows\System\SswUQuG.exe
  2⤵
  PID:6408
- C:\Windows\System\knOOgma.exe
  C:\Windows\System\knOOgma.exe
  2⤵
  PID:6432
- C:\Windows\System\ebwPwPm.exe
  C:\Windows\System\ebwPwPm.exe
  2⤵
  PID:6448
- C:\Windows\System\DTRufws.exe
  C:\Windows\System\DTRufws.exe
  2⤵
  PID:6476
- C:\Windows\System\SvlAJzR.exe
  C:\Windows\System\SvlAJzR.exe
  2⤵
  PID:6492
- C:\Windows\System\fzltAmv.exe
  C:\Windows\System\fzltAmv.exe
  2⤵
  PID:6512
- C:\Windows\System\TDoZuRb.exe
  C:\Windows\System\TDoZuRb.exe
  2⤵
  PID:6528
- C:\Windows\System\TzszxGC.exe
  C:\Windows\System\TzszxGC.exe
  2⤵
  PID:6544
- C:\Windows\System\AQGhJgY.exe
  C:\Windows\System\AQGhJgY.exe
  2⤵
  PID:6560
- C:\Windows\System\OMkutdK.exe
  C:\Windows\System\OMkutdK.exe
  2⤵
  PID:6588
- C:\Windows\System\qhEysBm.exe
  C:\Windows\System\qhEysBm.exe
  2⤵
  PID:6604
- C:\Windows\System\oujqVvG.exe
  C:\Windows\System\oujqVvG.exe
  2⤵
  PID:6624
- C:\Windows\System\INTgoDe.exe
  C:\Windows\System\INTgoDe.exe
  2⤵
  PID:6640
- C:\Windows\System\luXrQXK.exe
  C:\Windows\System\luXrQXK.exe
  2⤵
  PID:6664
- C:\Windows\System\eskpJcm.exe
  C:\Windows\System\eskpJcm.exe
  2⤵
  PID:6680
- C:\Windows\System\PETzRuh.exe
  C:\Windows\System\PETzRuh.exe
  2⤵
  PID:6704
- C:\Windows\System\nczSXHe.exe
  C:\Windows\System\nczSXHe.exe
  2⤵
  PID:6720
- C:\Windows\System\vEBhPzm.exe
  C:\Windows\System\vEBhPzm.exe
  2⤵
  PID:6736
- C:\Windows\System\GmQDjGF.exe
  C:\Windows\System\GmQDjGF.exe
  2⤵
  PID:6760
- C:\Windows\System\ejyobyD.exe
  C:\Windows\System\ejyobyD.exe
  2⤵
  PID:6776
- C:\Windows\System\CCksRxh.exe
  C:\Windows\System\CCksRxh.exe
  2⤵
  PID:6800
- C:\Windows\System\jktbqOq.exe
  C:\Windows\System\jktbqOq.exe
  2⤵
  PID:6816
- C:\Windows\System\JEcHrpV.exe
  C:\Windows\System\JEcHrpV.exe
  2⤵
  PID:6836
- C:\Windows\System\asrhLOV.exe
  C:\Windows\System\asrhLOV.exe
  2⤵
  PID:6856
- C:\Windows\System\ySHQXCn.exe
  C:\Windows\System\ySHQXCn.exe
  2⤵
  PID:6872
- C:\Windows\System\WBPNgJn.exe
  C:\Windows\System\WBPNgJn.exe
  2⤵
  PID:6896
- C:\Windows\System\wZIrVWx.exe
  C:\Windows\System\wZIrVWx.exe
  2⤵
  PID:6912
- C:\Windows\System\uWsviOg.exe
  C:\Windows\System\uWsviOg.exe
  2⤵
  PID:6936
- C:\Windows\System\WAjGpId.exe
  C:\Windows\System\WAjGpId.exe
  2⤵
  PID:6952
- C:\Windows\System\OOOYSbT.exe
  C:\Windows\System\OOOYSbT.exe
  2⤵
  PID:6968
- C:\Windows\System\keWFulV.exe
  C:\Windows\System\keWFulV.exe
  2⤵
  PID:6992
- C:\Windows\System\WaVImDq.exe
  C:\Windows\System\WaVImDq.exe
  2⤵
  PID:7008
- C:\Windows\System\BHZvKwy.exe
  C:\Windows\System\BHZvKwy.exe
  2⤵
  PID:7032
- C:\Windows\System\DTVAxSm.exe
  C:\Windows\System\DTVAxSm.exe
  2⤵
  PID:7052
- C:\Windows\System\jWafcaA.exe
  C:\Windows\System\jWafcaA.exe
  2⤵
  PID:7072
- C:\Windows\System\ZjwCyQA.exe
  C:\Windows\System\ZjwCyQA.exe
  2⤵
  PID:5612
- C:\Windows\System\thVUmLB.exe
  C:\Windows\System\thVUmLB.exe
  2⤵
  PID:5644
- C:\Windows\System\YpUXRZl.exe
  C:\Windows\System\YpUXRZl.exe
  2⤵
  PID:5684
- C:\Windows\System\JSTvOWM.exe
  C:\Windows\System\JSTvOWM.exe
  2⤵
  PID:5716
- C:\Windows\System\ejQXnnc.exe
  C:\Windows\System\ejQXnnc.exe
  2⤵
  PID:5740
- C:\Windows\System\fjwBEJR.exe
  C:\Windows\System\fjwBEJR.exe
  2⤵
  PID:5776
- C:\Windows\System\kOamgDi.exe
  C:\Windows\System\kOamgDi.exe
  2⤵
  PID:5804
- C:\Windows\System\ecTSzCA.exe
  C:\Windows\System\ecTSzCA.exe
  2⤵
  PID:5844
- C:\Windows\System\OeClBoj.exe
  C:\Windows\System\OeClBoj.exe
  2⤵
  PID:5876
- C:\Windows\System\CvxHZqw.exe
  C:\Windows\System\CvxHZqw.exe
  2⤵
  PID:5908
- C:\Windows\System\uvcKyrB.exe
  C:\Windows\System\uvcKyrB.exe
  2⤵
  PID:4404
- C:\Windows\System\HjDfgqN.exe
  C:\Windows\System\HjDfgqN.exe
  2⤵
  PID:4580
- C:\Windows\System\pZbQiTa.exe
  C:\Windows\System\pZbQiTa.exe
  2⤵
  PID:2020
- C:\Windows\System\eHYKMRG.exe
  C:\Windows\System\eHYKMRG.exe
  2⤵
  PID:6652
- C:\Windows\System\euyOvDS.exe
  C:\Windows\System\euyOvDS.exe
  2⤵
  PID:6832
- C:\Windows\System\bKkQqzF.exe
  C:\Windows\System\bKkQqzF.exe
  2⤵
  PID:7016
- C:\Windows\System\XAuUsJk.exe
  C:\Windows\System\XAuUsJk.exe
  2⤵
  PID:3964
- C:\Windows\System\vTKQkKP.exe
  C:\Windows\System\vTKQkKP.exe
  2⤵
  PID:4776
- C:\Windows\System\KONEDce.exe
  C:\Windows\System\KONEDce.exe
  2⤵
  PID:3052
- C:\Windows\System\pAZZINd.exe
  C:\Windows\System\pAZZINd.exe
  2⤵
  PID:5064
- C:\Windows\System\VNCpLkZ.exe
  C:\Windows\System\VNCpLkZ.exe
  2⤵
  PID:5272
- C:\Windows\System\TFZTnBG.exe
  C:\Windows\System\TFZTnBG.exe
  2⤵
  PID:5376
- C:\Windows\System\ujaEVXI.exe
  C:\Windows\System\ujaEVXI.exe
  2⤵
  PID:5456
- C:\Windows\System\CwfDcdj.exe
  C:\Windows\System\CwfDcdj.exe
  2⤵
  PID:6176
- C:\Windows\System\Jzhhyhv.exe
  C:\Windows\System\Jzhhyhv.exe
  2⤵
  PID:6272
- C:\Windows\System\EkrCDrO.exe
  C:\Windows\System\EkrCDrO.exe
  2⤵
  PID:6332
- C:\Windows\System\AzFADPg.exe
  C:\Windows\System\AzFADPg.exe
  2⤵
  PID:6360
- C:\Windows\System\mUrIlry.exe
  C:\Windows\System\mUrIlry.exe
  2⤵
  PID:6400
- C:\Windows\System\spXikXe.exe
  C:\Windows\System\spXikXe.exe
  2⤵
  PID:6444
- C:\Windows\System\WugurBQ.exe
  C:\Windows\System\WugurBQ.exe
  2⤵
  PID:6488
- C:\Windows\System\jtaRIIG.exe
  C:\Windows\System\jtaRIIG.exe
  2⤵
  PID:7048
- C:\Windows\System\qpzbHQm.exe
  C:\Windows\System\qpzbHQm.exe
  2⤵
  PID:2692
- C:\Windows\System\NMYEYrn.exe
  C:\Windows\System\NMYEYrn.exe
  2⤵
  PID:7352
- C:\Windows\System\vOhtUiZ.exe
  C:\Windows\System\vOhtUiZ.exe
  2⤵
  PID:7372
- C:\Windows\System\RtnDiys.exe
  C:\Windows\System\RtnDiys.exe
  2⤵
  PID:7388
- C:\Windows\System\KHzImvG.exe
  C:\Windows\System\KHzImvG.exe
  2⤵
  PID:7408
- C:\Windows\System\YSYfQuC.exe
  C:\Windows\System\YSYfQuC.exe
  2⤵
  PID:7424
- C:\Windows\System\kmjfVvl.exe
  C:\Windows\System\kmjfVvl.exe
  2⤵
  PID:7448
- C:\Windows\System\dIESLji.exe
  C:\Windows\System\dIESLji.exe
  2⤵
  PID:7464
- C:\Windows\System\YaUERux.exe
  C:\Windows\System\YaUERux.exe
  2⤵
  PID:7484
- C:\Windows\System\langLUX.exe
  C:\Windows\System\langLUX.exe
  2⤵
  PID:7504
- C:\Windows\System\MPIaeqI.exe
  C:\Windows\System\MPIaeqI.exe
  2⤵
  PID:7520
- C:\Windows\System\ngGVAIl.exe
  C:\Windows\System\ngGVAIl.exe
  2⤵
  PID:7540
- C:\Windows\System\FbhGHTI.exe
  C:\Windows\System\FbhGHTI.exe
  2⤵
  PID:7780
- C:\Windows\System\eBiPklL.exe
  C:\Windows\System\eBiPklL.exe
  2⤵
  PID:7796
- C:\Windows\System\hcFKsps.exe
  C:\Windows\System\hcFKsps.exe
  2⤵
  PID:7860
- C:\Windows\System\RqtsPfb.exe
  C:\Windows\System\RqtsPfb.exe
  2⤵
  PID:7888
- C:\Windows\System\Tojfppk.exe
  C:\Windows\System\Tojfppk.exe
  2⤵
  PID:7908
- C:\Windows\System\xhYcOdW.exe
  C:\Windows\System\xhYcOdW.exe
  2⤵
  PID:7932
- C:\Windows\System\SrZzIsP.exe
  C:\Windows\System\SrZzIsP.exe
  2⤵
  PID:7948
- C:\Windows\System\uiwJpFR.exe
  C:\Windows\System\uiwJpFR.exe
  2⤵
  PID:7964
- C:\Windows\System\Oaxnxcs.exe
  C:\Windows\System\Oaxnxcs.exe
  2⤵
  PID:7984
- C:\Windows\System\lHKwwDQ.exe
  C:\Windows\System\lHKwwDQ.exe
  2⤵
  PID:8000
- C:\Windows\System\NaNlfms.exe
  C:\Windows\System\NaNlfms.exe
  2⤵
  PID:8016
- C:\Windows\System\oXgayis.exe
  C:\Windows\System\oXgayis.exe
  2⤵
  PID:8032
- C:\Windows\System\IAeLszv.exe
  C:\Windows\System\IAeLszv.exe
  2⤵
  PID:8048
- C:\Windows\System\PmWlNJH.exe
  C:\Windows\System\PmWlNJH.exe
  2⤵
  PID:8064
- C:\Windows\System\TfGiAjp.exe
  C:\Windows\System\TfGiAjp.exe
  2⤵
  PID:8152
- C:\Windows\System\ZZjXjvB.exe
  C:\Windows\System\ZZjXjvB.exe
  2⤵
  PID:8172
- C:\Windows\System\EeCotrC.exe
  C:\Windows\System\EeCotrC.exe
  2⤵
  PID:1996
- C:\Windows\System\StpiKir.exe
  C:\Windows\System\StpiKir.exe
  2⤵
  PID:2380
- C:\Windows\System\EORfVFK.exe
  C:\Windows\System\EORfVFK.exe
  2⤵
  PID:4464
- C:\Windows\System\eqfJezx.exe
  C:\Windows\System\eqfJezx.exe
  2⤵
  PID:7456
- C:\Windows\System\HwdIaYk.exe
  C:\Windows\System\HwdIaYk.exe
  2⤵
  PID:7512
- C:\Windows\System\zfuwRDr.exe
  C:\Windows\System\zfuwRDr.exe
  2⤵
  PID:5604
- C:\Windows\System\XYQyIUu.exe
  C:\Windows\System\XYQyIUu.exe
  2⤵
  PID:312
- C:\Windows\System\KYKDHgg.exe
  C:\Windows\System\KYKDHgg.exe
  2⤵
  PID:3380
- C:\Windows\System\CHSndeQ.exe
  C:\Windows\System\CHSndeQ.exe
  2⤵
  PID:5828
- C:\Windows\System\BOwvILA.exe
  C:\Windows\System\BOwvILA.exe
  2⤵
  PID:5904
- C:\Windows\System\nggHdBN.exe
  C:\Windows\System\nggHdBN.exe
  2⤵
  PID:6056
- C:\Windows\System\UyyGgez.exe
  C:\Windows\System\UyyGgez.exe
  2⤵
  PID:4600
- C:\Windows\System\wfcGxTC.exe
  C:\Windows\System\wfcGxTC.exe
  2⤵
  PID:4196
- C:\Windows\System\enbxrOW.exe
  C:\Windows\System\enbxrOW.exe
  2⤵
  PID:5252
- C:\Windows\System\OfQnTQZ.exe
  C:\Windows\System\OfQnTQZ.exe
  2⤵
  PID:7416
- C:\Windows\System\wginOUb.exe
  C:\Windows\System\wginOUb.exe
  2⤵
  PID:7532
- C:\Windows\System\GNfMPtj.exe
  C:\Windows\System\GNfMPtj.exe
  2⤵
  PID:6508
- C:\Windows\System\okTaBoL.exe
  C:\Windows\System\okTaBoL.exe
  2⤵
  PID:3668
- C:\Windows\System\ksHkZmv.exe
  C:\Windows\System\ksHkZmv.exe
  2⤵
  PID:868
- C:\Windows\System\bWMkPCN.exe
  C:\Windows\System\bWMkPCN.exe
  2⤵
  PID:5268
- C:\Windows\System\JrLhOzx.exe
  C:\Windows\System\JrLhOzx.exe
  2⤵
  PID:5420
- C:\Windows\System\fhLLUbq.exe
  C:\Windows\System\fhLLUbq.exe
  2⤵
  PID:3024
- C:\Windows\System\NkCXxmF.exe
  C:\Windows\System\NkCXxmF.exe
  2⤵
  PID:6336
- C:\Windows\System\bqBLdwn.exe
  C:\Windows\System\bqBLdwn.exe
  2⤵
  PID:6540
- C:\Windows\System\IvXzNiR.exe
  C:\Windows\System\IvXzNiR.exe
  2⤵
  PID:6620
- C:\Windows\System\WbsdiWt.exe
  C:\Windows\System\WbsdiWt.exe
  2⤵
  PID:6732
- C:\Windows\System\CYtLYZA.exe
  C:\Windows\System\CYtLYZA.exe
  2⤵
  PID:6812
- C:\Windows\System\eFXiNRH.exe
  C:\Windows\System\eFXiNRH.exe
  2⤵
  PID:6948
- C:\Windows\System\JJudjxQ.exe
  C:\Windows\System\JJudjxQ.exe
  2⤵
  PID:7024
- C:\Windows\System\gIrUAVQ.exe
  C:\Windows\System\gIrUAVQ.exe
  2⤵
  PID:388
- C:\Windows\System\kyEhnRJ.exe
  C:\Windows\System\kyEhnRJ.exe
  2⤵
  PID:7208
- C:\Windows\System\MkxHhTZ.exe
  C:\Windows\System\MkxHhTZ.exe
  2⤵
  PID:7244
- C:\Windows\System\mXOOSBr.exe
  C:\Windows\System\mXOOSBr.exe
  2⤵
  PID:7292
- C:\Windows\System\PeZmJpi.exe
  C:\Windows\System\PeZmJpi.exe
  2⤵
  PID:7324
- C:\Windows\System\gDpcRMn.exe
  C:\Windows\System\gDpcRMn.exe
  2⤵
  PID:7380
- C:\Windows\System\ZnyxKwI.exe
  C:\Windows\System\ZnyxKwI.exe
  2⤵
  PID:8200
- C:\Windows\System\YvzNYXT.exe
  C:\Windows\System\YvzNYXT.exe
  2⤵
  PID:8224
- C:\Windows\System\wboCgPG.exe
  C:\Windows\System\wboCgPG.exe
  2⤵
  PID:8240
- C:\Windows\System\myAjTsr.exe
  C:\Windows\System\myAjTsr.exe
  2⤵
  PID:8264
- C:\Windows\System\xaeVTKU.exe
  C:\Windows\System\xaeVTKU.exe
  2⤵
  PID:8280
- C:\Windows\System\JdOJXGg.exe
  C:\Windows\System\JdOJXGg.exe
  2⤵
  PID:8304
- C:\Windows\System\gRIsXPb.exe
  C:\Windows\System\gRIsXPb.exe
  2⤵
  PID:8324
- C:\Windows\System\MyxAMHB.exe
  C:\Windows\System\MyxAMHB.exe
  2⤵
  PID:8344
- C:\Windows\System\OVkvBrE.exe
  C:\Windows\System\OVkvBrE.exe
  2⤵
  PID:8360
- C:\Windows\System\JHnDThr.exe
  C:\Windows\System\JHnDThr.exe
  2⤵
  PID:8384
- C:\Windows\System\jxtWZIY.exe
  C:\Windows\System\jxtWZIY.exe
  2⤵
  PID:8400
- C:\Windows\System\gRAFoHj.exe
  C:\Windows\System\gRAFoHj.exe
  2⤵
  PID:8424
- C:\Windows\System\KMXaSxf.exe
  C:\Windows\System\KMXaSxf.exe
  2⤵
  PID:8456
- C:\Windows\System\dwkfbqq.exe
  C:\Windows\System\dwkfbqq.exe
  2⤵
  PID:8528
- C:\Windows\System\UiEfANL.exe
  C:\Windows\System\UiEfANL.exe
  2⤵
  PID:8544
- C:\Windows\System\FiGlZwX.exe
  C:\Windows\System\FiGlZwX.exe
  2⤵
  PID:8564
- C:\Windows\System\xDlkDZB.exe
  C:\Windows\System\xDlkDZB.exe
  2⤵
  PID:8580
- C:\Windows\System\bhpokpx.exe
  C:\Windows\System\bhpokpx.exe
  2⤵
  PID:8596
- C:\Windows\System\BcjDbnn.exe
  C:\Windows\System\BcjDbnn.exe
  2⤵
  PID:8612
- C:\Windows\System\kDxuslu.exe
  C:\Windows\System\kDxuslu.exe
  2⤵
  PID:8628
- C:\Windows\System\aGRfvjP.exe
  C:\Windows\System\aGRfvjP.exe
  2⤵
  PID:8648
- C:\Windows\System\bBgfOHG.exe
  C:\Windows\System\bBgfOHG.exe
  2⤵
  PID:8664
- C:\Windows\System\DtsQpyo.exe
  C:\Windows\System\DtsQpyo.exe
  2⤵
  PID:8692
- C:\Windows\System\sBrxqTp.exe
  C:\Windows\System\sBrxqTp.exe
  2⤵
  PID:8708
- C:\Windows\System\MhYABhT.exe
  C:\Windows\System\MhYABhT.exe
  2⤵
  PID:8732
- C:\Windows\System\BvzkfPC.exe
  C:\Windows\System\BvzkfPC.exe
  2⤵
  PID:8752
- C:\Windows\System\BERuDLV.exe
  C:\Windows\System\BERuDLV.exe
  2⤵
  PID:8772
- C:\Windows\System\DHkTLZn.exe
  C:\Windows\System\DHkTLZn.exe
  2⤵
  PID:8788
- C:\Windows\System\BtSRLHe.exe
  C:\Windows\System\BtSRLHe.exe
  2⤵
  PID:8808
- C:\Windows\System\FknlwxS.exe
  C:\Windows\System\FknlwxS.exe
  2⤵
  PID:8832
- C:\Windows\System\kAhgjDB.exe
  C:\Windows\System\kAhgjDB.exe
  2⤵
  PID:8856
- C:\Windows\System\wMvquhW.exe
  C:\Windows\System\wMvquhW.exe
  2⤵
  PID:8876
- C:\Windows\System\LeYgzmi.exe
  C:\Windows\System\LeYgzmi.exe
  2⤵
  PID:8896
- C:\Windows\System\TWRHVwK.exe
  C:\Windows\System\TWRHVwK.exe
  2⤵
  PID:8912
- C:\Windows\System\yxquWTt.exe
  C:\Windows\System\yxquWTt.exe
  2⤵
  PID:8932
- C:\Windows\System\rsgJCKJ.exe
  C:\Windows\System\rsgJCKJ.exe
  2⤵
  PID:8956
- C:\Windows\System\oSzePCe.exe
  C:\Windows\System\oSzePCe.exe
  2⤵
  PID:8976
- C:\Windows\System\QSHaWLJ.exe
  C:\Windows\System\QSHaWLJ.exe
  2⤵
  PID:8996
- C:\Windows\System\uZbsuSS.exe
  C:\Windows\System\uZbsuSS.exe
  2⤵
  PID:9024
- C:\Windows\System\brdIucx.exe
  C:\Windows\System\brdIucx.exe
  2⤵
  PID:9044
- C:\Windows\System\OHVEVLq.exe
  C:\Windows\System\OHVEVLq.exe
  2⤵
  PID:9064
- C:\Windows\System\ciJLXBO.exe
  C:\Windows\System\ciJLXBO.exe
  2⤵
  PID:9080
- C:\Windows\System\pfaEsVc.exe
  C:\Windows\System\pfaEsVc.exe
  2⤵
  PID:9108
- C:\Windows\System\tXacKUv.exe
  C:\Windows\System\tXacKUv.exe
  2⤵
  PID:9124
- C:\Windows\System\XQqgytp.exe
  C:\Windows\System\XQqgytp.exe
  2⤵
  PID:9144
- C:\Windows\System\ihsMFsJ.exe
  C:\Windows\System\ihsMFsJ.exe
  2⤵
  PID:9164
- C:\Windows\System\uTHdZwG.exe
  C:\Windows\System\uTHdZwG.exe
  2⤵
  PID:9188
- C:\Windows\System\NHVdRPn.exe
  C:\Windows\System\NHVdRPn.exe
  2⤵
  PID:9204
- C:\Windows\System\TiyXXUm.exe
  C:\Windows\System\TiyXXUm.exe
  2⤵
  PID:7492
- C:\Windows\System\exBSrJH.exe
  C:\Windows\System\exBSrJH.exe
  2⤵
  PID:2840
- C:\Windows\System\TPsmvmj.exe
  C:\Windows\System\TPsmvmj.exe
  2⤵
  PID:7772
- C:\Windows\System\lhmLboK.exe
  C:\Windows\System\lhmLboK.exe
  2⤵
  PID:7432
- C:\Windows\System\lbPmWZX.exe
  C:\Windows\System\lbPmWZX.exe
  2⤵
  PID:6784
- C:\Windows\System\ckzsFOa.exe
  C:\Windows\System\ckzsFOa.exe
  2⤵
  PID:6160
- C:\Windows\System\NdHROCy.exe
  C:\Windows\System\NdHROCy.exe
  2⤵
  PID:6580
- C:\Windows\System\uCXnMGl.exe
  C:\Windows\System\uCXnMGl.exe
  2⤵
  PID:6988
- C:\Windows\System\sPPRqaz.exe
  C:\Windows\System\sPPRqaz.exe
  2⤵
  PID:7200
- C:\Windows\System\uqhFeYm.exe
  C:\Windows\System\uqhFeYm.exe
  2⤵
  PID:8272
- C:\Windows\System\wLzrZOI.exe
  C:\Windows\System\wLzrZOI.exe
  2⤵
  PID:9224
- C:\Windows\System\okQQmWZ.exe
  C:\Windows\System\okQQmWZ.exe
  2⤵
  PID:9244
- C:\Windows\System\YYnkSfe.exe
  C:\Windows\System\YYnkSfe.exe
  2⤵
  PID:9268
- C:\Windows\System\XAtjqrg.exe
  C:\Windows\System\XAtjqrg.exe
  2⤵
  PID:9288
- C:\Windows\System\BXbgWdP.exe
  C:\Windows\System\BXbgWdP.exe
  2⤵
  PID:9308
- C:\Windows\System\Giblhqp.exe
  C:\Windows\System\Giblhqp.exe
  2⤵
  PID:9328
- C:\Windows\System\iRKGPin.exe
  C:\Windows\System\iRKGPin.exe
  2⤵
  PID:9348
- C:\Windows\System\kSKdBIW.exe
  C:\Windows\System\kSKdBIW.exe
  2⤵
  PID:9368
- C:\Windows\System\nMOLfqh.exe
  C:\Windows\System\nMOLfqh.exe
  2⤵
  PID:9384
- C:\Windows\System\nyXffQj.exe
  C:\Windows\System\nyXffQj.exe
  2⤵
  PID:9408
- C:\Windows\System\htzFLbw.exe
  C:\Windows\System\htzFLbw.exe
  2⤵
  PID:9428
- C:\Windows\System\tmjqwFK.exe
  C:\Windows\System\tmjqwFK.exe
  2⤵
  PID:9444
- C:\Windows\System\rRbRrjG.exe
  C:\Windows\System\rRbRrjG.exe
  2⤵
  PID:9480
- C:\Windows\System\VMJRKah.exe
  C:\Windows\System\VMJRKah.exe
  2⤵
  PID:9504
- C:\Windows\System\ZWXdUJX.exe
  C:\Windows\System\ZWXdUJX.exe
  2⤵
  PID:9520
- C:\Windows\System\BlmHVmV.exe
  C:\Windows\System\BlmHVmV.exe
  2⤵
  PID:9544
- C:\Windows\System\ZRtCoAs.exe
  C:\Windows\System\ZRtCoAs.exe
  2⤵
  PID:9560
- C:\Windows\System\aPJwMSM.exe
  C:\Windows\System\aPJwMSM.exe
  2⤵
  PID:9584
- C:\Windows\System\tXNireF.exe
  C:\Windows\System\tXNireF.exe
  2⤵
  PID:9600
- C:\Windows\System\iMcDmxM.exe
  C:\Windows\System\iMcDmxM.exe
  2⤵
  PID:9636
- C:\Windows\System\xUqlMwR.exe
  C:\Windows\System\xUqlMwR.exe
  2⤵
  PID:9656
- C:\Windows\System\lKEjMTM.exe
  C:\Windows\System\lKEjMTM.exe
  2⤵
  PID:9676
- C:\Windows\System\sOAOkWt.exe
  C:\Windows\System\sOAOkWt.exe
  2⤵
  PID:9692
- C:\Windows\System\lynXrQv.exe
  C:\Windows\System\lynXrQv.exe
  2⤵
  PID:9712
- C:\Windows\System\yCTgMyF.exe
  C:\Windows\System\yCTgMyF.exe
  2⤵
  PID:9736
- C:\Windows\System\tMFjQIH.exe
  C:\Windows\System\tMFjQIH.exe
  2⤵
  PID:9752
- C:\Windows\System\GYLnzBN.exe
  C:\Windows\System\GYLnzBN.exe
  2⤵
  PID:9772
- C:\Windows\System\qbtdxlM.exe
  C:\Windows\System\qbtdxlM.exe
  2⤵
  PID:9792
- C:\Windows\System\Lrbprbu.exe
  C:\Windows\System\Lrbprbu.exe
  2⤵
  PID:9812
- C:\Windows\System\oaUInbu.exe
  C:\Windows\System\oaUInbu.exe
  2⤵
  PID:9832
- C:\Windows\System\oiYPgfo.exe
  C:\Windows\System\oiYPgfo.exe
  2⤵
  PID:9848
- C:\Windows\System\yXMjGNr.exe
  C:\Windows\System\yXMjGNr.exe
  2⤵
  PID:9868
- C:\Windows\System\Lsinjhf.exe
  C:\Windows\System\Lsinjhf.exe
  2⤵
  PID:9884
- C:\Windows\System\KcKRQlP.exe
  C:\Windows\System\KcKRQlP.exe
  2⤵
  PID:9912
- C:\Windows\System\BQPWpjb.exe
  C:\Windows\System\BQPWpjb.exe
  2⤵
  PID:9928
- C:\Windows\System\WUGOgTX.exe
  C:\Windows\System\WUGOgTX.exe
  2⤵
  PID:9944
- C:\Windows\System\qHBsRit.exe
  C:\Windows\System\qHBsRit.exe
  2⤵
  PID:9964
- C:\Windows\System\YkKkGem.exe
  C:\Windows\System\YkKkGem.exe
  2⤵
  PID:9980
- C:\Windows\System\LOaMxjk.exe
  C:\Windows\System\LOaMxjk.exe
  2⤵
  PID:10000
- C:\Windows\System\xBgnoaa.exe
  C:\Windows\System\xBgnoaa.exe
  2⤵
  PID:10020
- C:\Windows\System\KlPmSic.exe
  C:\Windows\System\KlPmSic.exe
  2⤵
  PID:10036
- C:\Windows\System\yEjRAbt.exe
  C:\Windows\System\yEjRAbt.exe
  2⤵
  PID:10052
- C:\Windows\System\eOkMqpQ.exe
  C:\Windows\System\eOkMqpQ.exe
  2⤵
  PID:10068
- C:\Windows\System\icVVyUN.exe
  C:\Windows\System\icVVyUN.exe
  2⤵
  PID:10088
- C:\Windows\System\iBjnsiu.exe
  C:\Windows\System\iBjnsiu.exe
  2⤵
  PID:10108
- C:\Windows\System\gUADVcA.exe
  C:\Windows\System\gUADVcA.exe
  2⤵
  PID:10124
- C:\Windows\System\LkoWria.exe
  C:\Windows\System\LkoWria.exe
  2⤵
  PID:10140
- C:\Windows\System\LWKydFo.exe
  C:\Windows\System\LWKydFo.exe
  2⤵
  PID:10156
- C:\Windows\System\agayXvu.exe
  C:\Windows\System\agayXvu.exe
  2⤵
  PID:10172
- C:\Windows\System\LfoyBzD.exe
  C:\Windows\System\LfoyBzD.exe
  2⤵
  PID:10188
- C:\Windows\System\aBfYQaf.exe
  C:\Windows\System\aBfYQaf.exe
  2⤵
  PID:10208
- C:\Windows\System\bwrvGrG.exe
  C:\Windows\System\bwrvGrG.exe
  2⤵
  PID:10224
- C:\Windows\System\qfTlVpj.exe
  C:\Windows\System\qfTlVpj.exe
  2⤵
  PID:8440
- C:\Windows\System\gMbhHMD.exe
  C:\Windows\System\gMbhHMD.exe
  2⤵
  PID:2988
- C:\Windows\System\NibjxfN.exe
  C:\Windows\System\NibjxfN.exe
  2⤵
  PID:7844
- C:\Windows\System\qmvZgUy.exe
  C:\Windows\System\qmvZgUy.exe
  2⤵
  PID:2260
- C:\Windows\System\UAwXtUM.exe
  C:\Windows\System\UAwXtUM.exe
  2⤵
  PID:7868
- C:\Windows\System\zGiFiZD.exe
  C:\Windows\System\zGiFiZD.exe
  2⤵
  PID:7904
- C:\Windows\System\UieQWFH.exe
  C:\Windows\System\UieQWFH.exe
  2⤵
  PID:7940
- C:\Windows\System\ErFMPLt.exe
  C:\Windows\System\ErFMPLt.exe
  2⤵
  PID:7980
- C:\Windows\System\iosHKwN.exe
  C:\Windows\System\iosHKwN.exe
  2⤵
  PID:8572
- C:\Windows\System\aNyJfHp.exe
  C:\Windows\System\aNyJfHp.exe
  2⤵
  PID:8684
- C:\Windows\System\oMDRQoc.exe
  C:\Windows\System\oMDRQoc.exe
  2⤵
  PID:8728
- C:\Windows\System\GMHyCpm.exe
  C:\Windows\System\GMHyCpm.exe
  2⤵
  PID:8392
- C:\Windows\System\NwlBpmg.exe
  C:\Windows\System\NwlBpmg.exe
  2⤵
  PID:5888
- C:\Windows\System\yaQVrdr.exe
  C:\Windows\System\yaQVrdr.exe
  2⤵
  PID:5680
- C:\Windows\System\oCHJCXv.exe
  C:\Windows\System\oCHJCXv.exe
  2⤵
  PID:7528
- C:\Windows\System\pnbfUlw.exe
  C:\Windows\System\pnbfUlw.exe
  2⤵
  PID:3852
- C:\Windows\System\CZZiAPC.exe
  C:\Windows\System\CZZiAPC.exe
  2⤵
  PID:8188
- C:\Windows\System\cywkBxr.exe
  C:\Windows\System\cywkBxr.exe
  2⤵
  PID:1632
- C:\Windows\System\hvNluSY.exe
  C:\Windows\System\hvNluSY.exe
  2⤵
  PID:8136
- C:\Windows\System\AEZxLTG.exe
  C:\Windows\System\AEZxLTG.exe
  2⤵
  PID:9688
- C:\Windows\System\HTObQqX.exe
  C:\Windows\System\HTObQqX.exe
  2⤵
  PID:8780
- C:\Windows\System\PeaLsVs.exe
  C:\Windows\System\PeaLsVs.exe
  2⤵
  PID:6296
- C:\Windows\System\iqilxHQ.exe
  C:\Windows\System\iqilxHQ.exe
  2⤵
  PID:8888
- C:\Windows\System\yAWqPIQ.exe
  C:\Windows\System\yAWqPIQ.exe
  2⤵
  PID:8944
- C:\Windows\System\wQOcUUq.exe
  C:\Windows\System\wQOcUUq.exe
  2⤵
  PID:9960
- C:\Windows\System\qJfMCuE.exe
  C:\Windows\System\qJfMCuE.exe
  2⤵
  PID:10048
- C:\Windows\System\buqAUxg.exe
  C:\Windows\System\buqAUxg.exe
  2⤵
  PID:7340
- C:\Windows\System\XuAksly.exe
  C:\Windows\System\XuAksly.exe
  2⤵
  PID:8340
- C:\Windows\System\Egaqvdg.exe
  C:\Windows\System\Egaqvdg.exe
  2⤵
  PID:7956
- C:\Windows\System\XlANLrX.exe
  C:\Windows\System\XlANLrX.exe
  2⤵
  PID:8744
- C:\Windows\System\orGJWoq.exe
  C:\Windows\System\orGJWoq.exe
  2⤵
  PID:8768
- C:\Windows\System\TBCGkcZ.exe
  C:\Windows\System\TBCGkcZ.exe
  2⤵
  PID:8368
- C:\Windows\System\UhnEJso.exe
  C:\Windows\System\UhnEJso.exe
  2⤵
  PID:8492
- C:\Windows\System\SRLVyii.exe
  C:\Windows\System\SRLVyii.exe
  2⤵
  PID:1564
- C:\Windows\System\WAnhSNC.exe
  C:\Windows\System\WAnhSNC.exe
  2⤵
  PID:10264
- C:\Windows\System\iYBefRj.exe
  C:\Windows\System\iYBefRj.exe
  2⤵
  PID:10292
- C:\Windows\System\jVKZTNe.exe
  C:\Windows\System\jVKZTNe.exe
  2⤵
  PID:10308
- C:\Windows\System\ZlxNNCG.exe
  C:\Windows\System\ZlxNNCG.exe
  2⤵
  PID:10324
- C:\Windows\System\rNLKugH.exe
  C:\Windows\System\rNLKugH.exe
  2⤵
  PID:10340
- C:\Windows\System\MPDjjga.exe
  C:\Windows\System\MPDjjga.exe
  2⤵
  PID:10356
- C:\Windows\System\aCgLiSq.exe
  C:\Windows\System\aCgLiSq.exe
  2⤵
  PID:10372
- C:\Windows\System\FNyOrcC.exe
  C:\Windows\System\FNyOrcC.exe
  2⤵
  PID:10388
- C:\Windows\System\BQQwcDP.exe
  C:\Windows\System\BQQwcDP.exe
  2⤵
  PID:10216
- C:\Windows\System\dikaSYu.exe
  C:\Windows\System\dikaSYu.exe
  2⤵
  PID:10116
- C:\Windows\System\WeVaekR.exe
  C:\Windows\System\WeVaekR.exe
  2⤵
  PID:10044
- C:\Windows\System\YowElyw.exe
  C:\Windows\System\YowElyw.exe
  2⤵
  PID:3444
- C:\Windows\System\KNOqGYL.exe
  C:\Windows\System\KNOqGYL.exe
  2⤵
  PID:9904
- C:\Windows\System\EOyVItW.exe
  C:\Windows\System\EOyVItW.exe
  2⤵
  PID:10180
- C:\Windows\System\ODVivYT.exe
  C:\Windows\System\ODVivYT.exe
  2⤵
  PID:9400
- C:\Windows\System\BejlFDO.exe
  C:\Windows\System\BejlFDO.exe
  2⤵
  PID:9476
- C:\Windows\System\dnaVQuo.exe
  C:\Windows\System\dnaVQuo.exe
  2⤵
  PID:9528
- C:\Windows\System\ZfmHcTX.exe
  C:\Windows\System\ZfmHcTX.exe
  2⤵
  PID:1696
- C:\Windows\System\qnRqlOm.exe
  C:\Windows\System\qnRqlOm.exe
  2⤵
  PID:4004
- C:\Windows\System\XUpmIOb.exe
  C:\Windows\System\XUpmIOb.exe
  2⤵
  PID:2844
- C:\Windows\System\BcgpUfN.exe
  C:\Windows\System\BcgpUfN.exe
  2⤵
  PID:10260
- C:\Windows\System\RbYuopo.exe
  C:\Windows\System\RbYuopo.exe
  2⤵
  PID:8164
- C:\Windows\System\lQhuHxX.exe
  C:\Windows\System\lQhuHxX.exe
  2⤵
  PID:8904
- C:\Windows\System\GLhGWQM.exe
  C:\Windows\System\GLhGWQM.exe
  2⤵
  PID:8716
- C:\Windows\System\jVbipHU.exe
  C:\Windows\System\jVbipHU.exe
  2⤵
  PID:10272
- C:\Windows\System\RNuyJvf.exe
  C:\Windows\System\RNuyJvf.exe
  2⤵
  PID:10364
- C:\Windows\System\XUMjIWw.exe
  C:\Windows\System\XUMjIWw.exe
  2⤵
  PID:9844
- C:\Windows\System\rPmCdXI.exe
  C:\Windows\System\rPmCdXI.exe
  2⤵
  PID:6852
- C:\Windows\System\uRmTZkg.exe
  C:\Windows\System\uRmTZkg.exe
  2⤵
  PID:10668
- C:\Windows\System\goQyNCb.exe
  C:\Windows\System\goQyNCb.exe
  2⤵
  PID:10184
- C:\Windows\System\duiajBV.exe
  C:\Windows\System\duiajBV.exe
  2⤵
  PID:10832
- C:\Windows\System\PMAwdVK.exe
  C:\Windows\System\PMAwdVK.exe
  2⤵
  PID:10872
- C:\Windows\System\mmAALBh.exe
  C:\Windows\System\mmAALBh.exe
  2⤵
  PID:9744
- C:\Windows\System\kcYiPCy.exe
  C:\Windows\System\kcYiPCy.exe
  2⤵
  PID:9824
- C:\Windows\System\STJPVbt.exe
  C:\Windows\System\STJPVbt.exe
  2⤵
  PID:9496
- C:\Windows\System\EzxHCvb.exe
  C:\Windows\System\EzxHCvb.exe
  2⤵
  PID:9416
- C:\Windows\System\XMDBYau.exe
  C:\Windows\System\XMDBYau.exe
  2⤵
  PID:9316
- C:\Windows\System\aQMzoIV.exe
  C:\Windows\System\aQMzoIV.exe
  2⤵
  PID:9252
- C:\Windows\System\DOeqTxB.exe
  C:\Windows\System\DOeqTxB.exe
  2⤵
  PID:4072
- C:\Windows\System\fXrzIEx.exe
  C:\Windows\System\fXrzIEx.exe
  2⤵
  PID:10352
- C:\Windows\System\ruvqKBk.exe
  C:\Windows\System\ruvqKBk.exe
  2⤵
  PID:4132
- C:\Windows\System\kBlEvIg.exe
  C:\Windows\System\kBlEvIg.exe
  2⤵
  PID:9016
- C:\Windows\System\TXxaznf.exe
  C:\Windows\System\TXxaznf.exe
  2⤵
  PID:10536
- C:\Windows\System\ngvnAGT.exe
  C:\Windows\System\ngvnAGT.exe
  2⤵
  PID:10648
- C:\Windows\System\xOQsVAb.exe
  C:\Windows\System\xOQsVAb.exe
  2⤵
  PID:10688
- C:\Windows\System\MMabtnz.exe
  C:\Windows\System\MMabtnz.exe
  2⤵
  PID:11288
- C:\Windows\System\FSaGWYS.exe
  C:\Windows\System\FSaGWYS.exe
  2⤵
  PID:11304
- C:\Windows\System\ntaXKYI.exe
  C:\Windows\System\ntaXKYI.exe
  2⤵
  PID:11332
- C:\Windows\System\HtLoxsr.exe
  C:\Windows\System\HtLoxsr.exe
  2⤵
  PID:11356
- C:\Windows\System\mjHWBRE.exe
  C:\Windows\System\mjHWBRE.exe
  2⤵
  PID:11372
- C:\Windows\System\AZcyEKs.exe
  C:\Windows\System\AZcyEKs.exe
  2⤵
  PID:11396
- C:\Windows\System\CqclaZX.exe
  C:\Windows\System\CqclaZX.exe
  2⤵
  PID:11412
- C:\Windows\System\UpCMawY.exe
  C:\Windows\System\UpCMawY.exe
  2⤵
  PID:11432
- C:\Windows\System\TtbRFLp.exe
  C:\Windows\System\TtbRFLp.exe
  2⤵
  PID:11452
- C:\Windows\System\MMgZZgI.exe
  C:\Windows\System\MMgZZgI.exe
  2⤵
  PID:11472
- C:\Windows\System\IbKjFSb.exe
  C:\Windows\System\IbKjFSb.exe
  2⤵
  PID:11496
- C:\Windows\System\ILURgvP.exe
  C:\Windows\System\ILURgvP.exe
  2⤵
  PID:11512
- C:\Windows\System\UHyuAbE.exe
  C:\Windows\System\UHyuAbE.exe
  2⤵
  PID:11528
- C:\Windows\System\ExlNTVL.exe
  C:\Windows\System\ExlNTVL.exe
  2⤵
  PID:11544
- C:\Windows\System\yTUzUXP.exe
  C:\Windows\System\yTUzUXP.exe
  2⤵
  PID:11564
- C:\Windows\System\purEYlT.exe
  C:\Windows\System\purEYlT.exe
  2⤵
  PID:11584
- C:\Windows\System\UNtcAIp.exe
  C:\Windows\System\UNtcAIp.exe
  2⤵
  PID:11604
- C:\Windows\System\uSkAfXB.exe
  C:\Windows\System\uSkAfXB.exe
  2⤵
  PID:11620
- C:\Windows\System\bRVaTJL.exe
  C:\Windows\System\bRVaTJL.exe
  2⤵
  PID:11640
- C:\Windows\System\uOVooBu.exe
  C:\Windows\System\uOVooBu.exe
  2⤵
  PID:11656
- C:\Windows\System\aSCzXgs.exe
  C:\Windows\System\aSCzXgs.exe
  2⤵
  PID:11672
- C:\Windows\System\xzhxoIj.exe
  C:\Windows\System\xzhxoIj.exe
  2⤵
  PID:11688
- C:\Windows\System\wycMbpO.exe
  C:\Windows\System\wycMbpO.exe
  2⤵
  PID:11704
- C:\Windows\System\NfJdYLg.exe
  C:\Windows\System\NfJdYLg.exe
  2⤵
  PID:11728
- C:\Windows\System\cGLHQDH.exe
  C:\Windows\System\cGLHQDH.exe
  2⤵
  PID:11756
- C:\Windows\System\ExSOKsb.exe
  C:\Windows\System\ExSOKsb.exe
  2⤵
  PID:11776
- C:\Windows\System\WdGAatK.exe
  C:\Windows\System\WdGAatK.exe
  2⤵
  PID:11800
- C:\Windows\System\qePCRML.exe
  C:\Windows\System\qePCRML.exe
  2⤵
  PID:11816
- C:\Windows\System\DloTfrT.exe
  C:\Windows\System\DloTfrT.exe
  2⤵
  PID:11840
- C:\Windows\System\erFJYHb.exe
  C:\Windows\System\erFJYHb.exe
  2⤵
  PID:11856
- C:\Windows\System\ggWcSGG.exe
  C:\Windows\System\ggWcSGG.exe
  2⤵
  PID:11880
- C:\Windows\System\TYyVCcP.exe
  C:\Windows\System\TYyVCcP.exe
  2⤵
  PID:11896
- C:\Windows\System\XOMMGTG.exe
  C:\Windows\System\XOMMGTG.exe
  2⤵
  PID:11920
- C:\Windows\System\lygYSLu.exe
  C:\Windows\System\lygYSLu.exe
  2⤵
  PID:11936
- C:\Windows\System\HxOeKwR.exe
  C:\Windows\System\HxOeKwR.exe
  2⤵
  PID:11956
- C:\Windows\System\CLzHcbN.exe
  C:\Windows\System\CLzHcbN.exe
  2⤵
  PID:11992
- C:\Windows\System\ZukJxlu.exe
  C:\Windows\System\ZukJxlu.exe
  2⤵
  PID:12008
- C:\Windows\System\LoJRaKP.exe
  C:\Windows\System\LoJRaKP.exe
  2⤵
  PID:12032
- C:\Windows\System\soPczHn.exe
  C:\Windows\System\soPczHn.exe
  2⤵
  PID:12052
- C:\Windows\System\BwddkOr.exe
  C:\Windows\System\BwddkOr.exe
  2⤵
  PID:12080
- C:\Windows\System\lRCahWf.exe
  C:\Windows\System\lRCahWf.exe
  2⤵
  PID:12104
- C:\Windows\System\ewXfGKx.exe
  C:\Windows\System\ewXfGKx.exe
  2⤵
  PID:12120
- C:\Windows\System\RhXRzAq.exe
  C:\Windows\System\RhXRzAq.exe
  2⤵
  PID:12140
- C:\Windows\System\BqFTXyT.exe
  C:\Windows\System\BqFTXyT.exe
  2⤵
  PID:12160
- C:\Windows\System\hZeGBIk.exe
  C:\Windows\System\hZeGBIk.exe
  2⤵
  PID:12184
- C:\Windows\System\pGkEIcx.exe
  C:\Windows\System\pGkEIcx.exe
  2⤵
  PID:12208
- C:\Windows\System\lUTCSej.exe
  C:\Windows\System\lUTCSej.exe
  2⤵
  PID:12224
- C:\Windows\System\bCaVgFR.exe
  C:\Windows\System\bCaVgFR.exe
  2⤵
  PID:12248
- C:\Windows\System\ebiPPRn.exe
  C:\Windows\System\ebiPPRn.exe
  2⤵
  PID:12276
- C:\Windows\System\euRRVHk.exe
  C:\Windows\System\euRRVHk.exe
  2⤵
  PID:10728
- C:\Windows\System\TJmqACB.exe
  C:\Windows\System\TJmqACB.exe
  2⤵
  PID:400
- C:\Windows\System\ifYKZpv.exe
  C:\Windows\System\ifYKZpv.exe
  2⤵
  PID:10136
- C:\Windows\System\BKtPpCJ.exe
  C:\Windows\System\BKtPpCJ.exe
  2⤵
  PID:4068
- C:\Windows\System\oUXroWW.exe
  C:\Windows\System\oUXroWW.exe
  2⤵
  PID:8160
- C:\Windows\System\YIgyqDc.exe
  C:\Windows\System\YIgyqDc.exe
  2⤵
  PID:8144
- C:\Windows\System\TkxSBrt.exe
  C:\Windows\System\TkxSBrt.exe
  2⤵
  PID:10972
- C:\Windows\System\nLFRIdw.exe
  C:\Windows\System\nLFRIdw.exe
  2⤵
  PID:11000
- C:\Windows\System\xJvudrc.exe
  C:\Windows\System\xJvudrc.exe
  2⤵
  PID:8680
- C:\Windows\System\dfWccIp.exe
  C:\Windows\System\dfWccIp.exe
  2⤵
  PID:11020
- C:\Windows\System\xRiENkw.exe
  C:\Windows\System\xRiENkw.exe
  2⤵
  PID:4832
- C:\Windows\System\NDrbQBj.exe
  C:\Windows\System\NDrbQBj.exe
  2⤵
  PID:10244
- C:\Windows\System\JNeucET.exe
  C:\Windows\System\JNeucET.exe
  2⤵
  PID:10080
- C:\Windows\System\eLTiGVh.exe
  C:\Windows\System\eLTiGVh.exe
  2⤵
  PID:11092
- C:\Windows\System\nsXPppz.exe
  C:\Windows\System\nsXPppz.exe
  2⤵
  PID:10120
- C:\Windows\System\jnLNMuP.exe
  C:\Windows\System\jnLNMuP.exe
  2⤵
  PID:10368
- C:\Windows\System\XIPbRWU.exe
  C:\Windows\System\XIPbRWU.exe
  2⤵
  PID:10436
- C:\Windows\System\PqdFLUN.exe
  C:\Windows\System\PqdFLUN.exe
  2⤵
  PID:9648
- C:\Windows\System\XQKxdgb.exe
  C:\Windows\System\XQKxdgb.exe
  2⤵
  PID:10220
- C:\Windows\System\iWBZccE.exe
  C:\Windows\System\iWBZccE.exe
  2⤵
  PID:11252
- C:\Windows\System\RUzBeSq.exe
  C:\Windows\System\RUzBeSq.exe
  2⤵
  PID:9780
- C:\Windows\System\gqSMEnn.exe
  C:\Windows\System\gqSMEnn.exe
  2⤵
  PID:9376
- C:\Windows\System\muciSBD.exe
  C:\Windows\System\muciSBD.exe
  2⤵
  PID:12304
- C:\Windows\System\hIlnuSG.exe
  C:\Windows\System\hIlnuSG.exe
  2⤵
  PID:12324
- C:\Windows\System\TgaWjWn.exe
  C:\Windows\System\TgaWjWn.exe
  2⤵
  PID:12340
- C:\Windows\System\bEzsvyW.exe
  C:\Windows\System\bEzsvyW.exe
  2⤵
  PID:12360
- C:\Windows\System\EtSyZMz.exe
  C:\Windows\System\EtSyZMz.exe
  2⤵
  PID:12376
- C:\Windows\System\kNcuEfs.exe
  C:\Windows\System\kNcuEfs.exe
  2⤵
  PID:12404
- C:\Windows\System\YgWbnCO.exe
  C:\Windows\System\YgWbnCO.exe
  2⤵
  PID:12424
- C:\Windows\System\UaPLpEl.exe
  C:\Windows\System\UaPLpEl.exe
  2⤵
  PID:12440
- C:\Windows\System\VbStpfM.exe
  C:\Windows\System\VbStpfM.exe
  2⤵
  PID:12460
- C:\Windows\System\GPvtffF.exe
  C:\Windows\System\GPvtffF.exe
  2⤵
  PID:12476
- C:\Windows\System\DkRptkn.exe
  C:\Windows\System\DkRptkn.exe
  2⤵
  PID:12496
- C:\Windows\System\lwghaQE.exe
  C:\Windows\System\lwghaQE.exe
  2⤵
  PID:12512
- C:\Windows\System\RIcdrsC.exe
  C:\Windows\System\RIcdrsC.exe
  2⤵
  PID:12528
- C:\Windows\System\QEHdZxw.exe
  C:\Windows\System\QEHdZxw.exe
  2⤵
  PID:12548
- C:\Windows\System\nnPocPX.exe
  C:\Windows\System\nnPocPX.exe
  2⤵
  PID:12564
- C:\Windows\System\lMLUxjQ.exe
  C:\Windows\System\lMLUxjQ.exe
  2⤵
  PID:12580
- C:\Windows\System\jAkzEKt.exe
  C:\Windows\System\jAkzEKt.exe
  2⤵
  PID:12600
- C:\Windows\System\UelLTHY.exe
  C:\Windows\System\UelLTHY.exe
  2⤵
  PID:12624
- C:\Windows\System\AEDbSPy.exe
  C:\Windows\System\AEDbSPy.exe
  2⤵
  PID:12640
- C:\Windows\System\wYbEniB.exe
  C:\Windows\System\wYbEniB.exe
  2⤵
  PID:12656
- C:\Windows\System\htyMWoQ.exe
  C:\Windows\System\htyMWoQ.exe
  2⤵
  PID:12672
- C:\Windows\System\XRkcZbt.exe
  C:\Windows\System\XRkcZbt.exe
  2⤵
  PID:12692
- C:\Windows\System\ihLrUus.exe
  C:\Windows\System\ihLrUus.exe
  2⤵
  PID:12716
- C:\Windows\System\GhniIwD.exe
  C:\Windows\System\GhniIwD.exe
  2⤵
  PID:12732
- C:\Windows\System\FCHbghj.exe
  C:\Windows\System\FCHbghj.exe
  2⤵
  PID:12752
- C:\Windows\System\LwnajOB.exe
  C:\Windows\System\LwnajOB.exe
  2⤵
  PID:12768
- C:\Windows\System\aKLXBhv.exe
  C:\Windows\System\aKLXBhv.exe
  2⤵
  PID:12784
- C:\Windows\System\twKdJuU.exe
  C:\Windows\System\twKdJuU.exe
  2⤵
  PID:12800
- C:\Windows\System\iffWQrl.exe
  C:\Windows\System\iffWQrl.exe
  2⤵
  PID:12816
- C:\Windows\System\adKYeaL.exe
  C:\Windows\System\adKYeaL.exe
  2⤵
  PID:12832
- C:\Windows\System\BGvnyWU.exe
  C:\Windows\System\BGvnyWU.exe
  2⤵
  PID:12848
- C:\Windows\System\qIFDEus.exe
  C:\Windows\System\qIFDEus.exe
  2⤵
  PID:12864
- C:\Windows\System\hKfhXBz.exe
  C:\Windows\System\hKfhXBz.exe
  2⤵
  PID:12884
- C:\Windows\System\tlFqBfy.exe
  C:\Windows\System\tlFqBfy.exe
  2⤵
  PID:12904
- C:\Windows\System\OkZdjdu.exe
  C:\Windows\System\OkZdjdu.exe
  2⤵
  PID:12928
- C:\Windows\System\DUnmVoR.exe
  C:\Windows\System\DUnmVoR.exe
  2⤵
  PID:12944
- C:\Windows\System\dPrZPAE.exe
  C:\Windows\System\dPrZPAE.exe
  2⤵
  PID:12964
- C:\Windows\System\UUNQhvb.exe
  C:\Windows\System\UUNQhvb.exe
  2⤵
  PID:12984
- C:\Windows\System\MCRvfXC.exe
  C:\Windows\System\MCRvfXC.exe
  2⤵
  PID:13000
- C:\Windows\System\LwwcrWg.exe
  C:\Windows\System\LwwcrWg.exe
  2⤵
  PID:13020
- C:\Windows\System\kaYOeLF.exe
  C:\Windows\System\kaYOeLF.exe
  2⤵
  PID:13036
- C:\Windows\System\lYikrNb.exe
  C:\Windows\System\lYikrNb.exe
  2⤵
  PID:13052
- C:\Windows\System\rLuqfvg.exe
  C:\Windows\System\rLuqfvg.exe
  2⤵
  PID:10824
- C:\Windows\System\QWtISRU.exe
  C:\Windows\System\QWtISRU.exe
  2⤵
  PID:12556
- C:\Windows\System\IcCLIHT.exe
  C:\Windows\System\IcCLIHT.exe
  2⤵
  PID:11444
- C:\Windows\System\oqZhauh.exe
  C:\Windows\System\oqZhauh.exe
  2⤵
  PID:11160
- C:\Windows\System\fTvzICb.exe
  C:\Windows\System\fTvzICb.exe
  2⤵
  PID:12760
- C:\Windows\System\ZfpIThD.exe
  C:\Windows\System\ZfpIThD.exe
  2⤵
  PID:12116
- C:\Windows\System\dNPFOre.exe
  C:\Windows\System\dNPFOre.exe
  2⤵
  PID:10760
- C:\Windows\System\gRLFVzo.exe
  C:\Windows\System\gRLFVzo.exe
  2⤵
  PID:3588
- C:\Windows\System\ksmqtHD.exe
  C:\Windows\System\ksmqtHD.exe
  2⤵
  PID:13204
- C:\Windows\System\ufSiIhZ.exe
  C:\Windows\System\ufSiIhZ.exe
  2⤵
  PID:11524
- C:\Windows\System\JWIxoUC.exe
  C:\Windows\System\JWIxoUC.exe
  2⤵
  PID:9392
- C:\Windows\System\PrTlgar.exe
  C:\Windows\System\PrTlgar.exe
  2⤵
  PID:13268
- C:\Windows\System\TcaBtoz.exe
  C:\Windows\System\TcaBtoz.exe
  2⤵
  PID:12004
- C:\Windows\System\TFUZqtK.exe
  C:\Windows\System\TFUZqtK.exe
  2⤵
  PID:11028
- C:\Windows\System\sfrECwE.exe
  C:\Windows\System\sfrECwE.exe
  2⤵
  PID:10944
- C:\Windows\System\OrlffWD.exe
  C:\Windows\System\OrlffWD.exe
  2⤵
  PID:12156
- C:\Windows\System\QDvCtqe.exe
  C:\Windows\System\QDvCtqe.exe
  2⤵
  PID:12216
- C:\Windows\System\YPDsyVh.exe
  C:\Windows\System\YPDsyVh.exe
  2⤵
  PID:11012
- C:\Windows\System\tunFYXq.exe
  C:\Windows\System\tunFYXq.exe
  2⤵
  PID:11768
- C:\Windows\System\UTxNlSY.exe
  C:\Windows\System\UTxNlSY.exe
  2⤵
  PID:11404
- C:\Windows\System\xKoozia.exe
  C:\Windows\System\xKoozia.exe
  2⤵
  PID:11560
- C:\Windows\System\JGuPENQ.exe
  C:\Windows\System\JGuPENQ.exe
  2⤵
  PID:12764
- C:\Windows\System\LmOVWeT.exe
  C:\Windows\System\LmOVWeT.exe
  2⤵
  PID:10920
- C:\Windows\System\wcBUOvK.exe
  C:\Windows\System\wcBUOvK.exe
  2⤵
  PID:2796
- C:\Windows\System\DlzFCuo.exe
  C:\Windows\System\DlzFCuo.exe
  2⤵
  PID:13088
- C:\Windows\System\LpAPdhj.exe
  C:\Windows\System\LpAPdhj.exe
  2⤵
  PID:13148
- C:\Windows\System\BZFVwWS.exe
  C:\Windows\System\BZFVwWS.exe
  2⤵
  PID:7900
- C:\Windows\System\LrAeKqn.exe
  C:\Windows\System\LrAeKqn.exe
  2⤵
  PID:13244
- C:\Windows\System\mqttcnx.exe
  C:\Windows\System\mqttcnx.exe
  2⤵
  PID:10964
- C:\Windows\System\ofHxNbK.exe
  C:\Windows\System\ofHxNbK.exe
  2⤵
  PID:12684
- C:\Windows\System\LFvWdUM.exe
  C:\Windows\System\LFvWdUM.exe
  2⤵
  PID:11912
- C:\Windows\System\OjzGYNs.exe
  C:\Windows\System\OjzGYNs.exe
  2⤵
  PID:12040
- C:\Windows\System\zgXExLz.exe
  C:\Windows\System\zgXExLz.exe
  2⤵
  PID:12996
- C:\Windows\System\SCMeEZC.exe
  C:\Windows\System\SCMeEZC.exe
  2⤵
  PID:8056
- C:\Windows\System\JopaQQx.exe
  C:\Windows\System\JopaQQx.exe
  2⤵
  PID:13176
- C:\Windows\System\wHNFxCj.exe
  C:\Windows\System\wHNFxCj.exe
  2⤵
  PID:12620
- C:\Windows\System\JioAwCj.exe
  C:\Windows\System\JioAwCj.exe
  2⤵
  PID:12540
- C:\Windows\System\bHEXsTX.exe
  C:\Windows\System\bHEXsTX.exe
  2⤵
  PID:11440
- C:\Windows\System\yoUfelK.exe
  C:\Windows\System\yoUfelK.exe
  2⤵
  PID:9260
- C:\Windows\System\oZdkyPt.exe
  C:\Windows\System\oZdkyPt.exe
  2⤵
  PID:12076
- C:\Windows\System\gLLGyWD.exe
  C:\Windows\System\gLLGyWD.exe
  2⤵
  PID:10060
- C:\Windows\System\TkzkoYc.exe
  C:\Windows\System\TkzkoYc.exe
  2⤵
  PID:12680
- C:\Windows\System\lkjytCd.exe
  C:\Windows\System\lkjytCd.exe
  2⤵
  PID:12240
- C:\Windows\System\ZYkKOcC.exe
  C:\Windows\System\ZYkKOcC.exe
  2⤵
  PID:11808
- C:\Windows\System\hKGUCaL.exe
  C:\Windows\System\hKGUCaL.exe
  2⤵
  PID:11648
- C:\Windows\System\ZxQIFVX.exe
  C:\Windows\System\ZxQIFVX.exe
  2⤵
  PID:1560
- C:\Windows\System\yLwyBvj.exe
  C:\Windows\System\yLwyBvj.exe
  2⤵
  PID:10696
- C:\Windows\System\KrBoPpJ.exe
  C:\Windows\System\KrBoPpJ.exe
  2⤵
  PID:11348
- C:\Windows\System\zWdBWXW.exe
  C:\Windows\System\zWdBWXW.exe
  2⤵
  PID:7400
- C:\Windows\System\aqYpJXB.exe
  C:\Windows\System\aqYpJXB.exe
  2⤵
  PID:13220
- C:\Windows\System\WQFoseN.exe
  C:\Windows\System\WQFoseN.exe
  2⤵
  PID:11272
- C:\Windows\System\JqMTLEK.exe
  C:\Windows\System\JqMTLEK.exe
  2⤵
  PID:11968
- C:\Windows\System\sukWCAg.exe
  C:\Windows\System\sukWCAg.exe
  2⤵
  PID:3396
- C:\Windows\System\jDJaQGR.exe
  C:\Windows\System\jDJaQGR.exe
  2⤵
  PID:7344
- C:\Windows\System\zoYFzgv.exe
  C:\Windows\System\zoYFzgv.exe
  2⤵
  PID:11320
- C:\Windows\System\fUfeusq.exe
  C:\Windows\System\fUfeusq.exe
  2⤵
  PID:12572
- C:\Windows\System\Ejadapj.exe
  C:\Windows\System\Ejadapj.exe
  2⤵
  PID:13604
- C:\Windows\System\tuZQOKN.exe
  C:\Windows\System\tuZQOKN.exe
  2⤵
  PID:13620
- C:\Windows\System\NwycQBW.exe
  C:\Windows\System\NwycQBW.exe
  2⤵
  PID:13648
- C:\Windows\System\WepiNTs.exe
  C:\Windows\System\WepiNTs.exe
  2⤵
  PID:13672
- C:\Windows\System\wOOGfYb.exe
  C:\Windows\System\wOOGfYb.exe
  2⤵
  PID:13892
- C:\Windows\System\ENsVgMR.exe
  C:\Windows\System\ENsVgMR.exe
  2⤵
  PID:13988
- C:\Windows\System\akNQjsb.exe
  C:\Windows\System\akNQjsb.exe
  2⤵
  PID:14092
- C:\Windows\System\vSuFxBD.exe
  C:\Windows\System\vSuFxBD.exe
  2⤵
  PID:14264
- C:\Windows\System\rEmNcNY.exe
  C:\Windows\System\rEmNcNY.exe
  2⤵
  PID:8416
- C:\Windows\System\OSHhsWq.exe
  C:\Windows\System\OSHhsWq.exe
  2⤵
  PID:2592
- C:\Windows\System\MmmjlHg.exe
  C:\Windows\System\MmmjlHg.exe
  2⤵
  PID:12924
- C:\Windows\System\YUsCZRM.exe
  C:\Windows\System\YUsCZRM.exe
  2⤵
  PID:9936
- C:\Windows\System\KiAWjMc.exe
  C:\Windows\System\KiAWjMc.exe
  2⤵
  PID:13092
- C:\Windows\System\nCEpJcu.exe
  C:\Windows\System\nCEpJcu.exe
  2⤵
  PID:13108
- C:\Windows\System\FJrniVR.exe
  C:\Windows\System\FJrniVR.exe
  2⤵
  PID:12956
- C:\Windows\System\AZWzJiE.exe
  C:\Windows\System\AZWzJiE.exe
  2⤵
  PID:13340
- C:\Windows\System\ysBEYAd.exe
  C:\Windows\System\ysBEYAd.exe
  2⤵
  PID:7924
- C:\Windows\System\JeBPhYy.exe
  C:\Windows\System\JeBPhYy.exe
  2⤵
  PID:12264
- C:\Windows\System\QhBYwPw.exe
  C:\Windows\System\QhBYwPw.exe
  2⤵
  PID:11084
- C:\Windows\System\PLrlZee.exe
  C:\Windows\System\PLrlZee.exe
  2⤵
  PID:11716
- C:\Windows\System\ccFvztY.exe
  C:\Windows\System\ccFvztY.exe
  2⤵
  PID:13232
- C:\Windows\System\kDVHlCV.exe
  C:\Windows\System\kDVHlCV.exe
  2⤵
  PID:11892
- C:\Windows\System\dCTMRZu.exe
  C:\Windows\System\dCTMRZu.exe
  2⤵
  PID:884
- C:\Windows\System\NQNxLkQ.exe
  C:\Windows\System\NQNxLkQ.exe
  2⤵
  PID:9748
- C:\Windows\System\AkdHLLd.exe
  C:\Windows\System\AkdHLLd.exe
  2⤵
  PID:13504
- C:\Windows\System\BwxsIIC.exe
  C:\Windows\System\BwxsIIC.exe
  2⤵
  PID:13468
- C:\Windows\System\xPSOwAS.exe
  C:\Windows\System\xPSOwAS.exe
  2⤵
  PID:13444
- C:\Windows\System\hwskMas.exe
  C:\Windows\System\hwskMas.exe
  2⤵
  PID:13416
- C:\Windows\System\yuuYTvt.exe
  C:\Windows\System\yuuYTvt.exe
  2⤵
  PID:13384
- C:\Windows\System\FeQjxOZ.exe
  C:\Windows\System\FeQjxOZ.exe
  2⤵
  PID:13568
- C:\Windows\System\IRYImIl.exe
  C:\Windows\System\IRYImIl.exe
  2⤵
  PID:13524
- C:\Windows\System\HbOutLN.exe
  C:\Windows\System\HbOutLN.exe
  2⤵
  PID:13692
- C:\Windows\System\VwSTWwc.exe
  C:\Windows\System\VwSTWwc.exe
  2⤵
  PID:13736
- C:\Windows\System\mHHwXMK.exe
  C:\Windows\System\mHHwXMK.exe
  2⤵
  PID:13464
- C:\Windows\System\CfGBLjL.exe
  C:\Windows\System\CfGBLjL.exe
  2⤵
  PID:13908
- C:\Windows\System\ymkHJut.exe
  C:\Windows\System\ymkHJut.exe
  2⤵
  PID:13924
- C:\Windows\System\VkfQGxV.exe
  C:\Windows\System\VkfQGxV.exe
  2⤵
  PID:9580
- C:\Windows\System\EefaPhp.exe
  C:\Windows\System\EefaPhp.exe
  2⤵
  PID:13512
- C:\Windows\System\vKTQhak.exe
  C:\Windows\System\vKTQhak.exe
  2⤵
  PID:13616
- C:\Windows\System\KvUwXhZ.exe
  C:\Windows\System\KvUwXhZ.exe
  2⤵
  PID:13544
- C:\Windows\System\OVgWjOr.exe
  C:\Windows\System\OVgWjOr.exe
  2⤵
  PID:14064
- C:\Windows\System\hvgcyDz.exe
  C:\Windows\System\hvgcyDz.exe
  2⤵
  PID:10784
- C:\Windows\System\HRDBcUZ.exe
  C:\Windows\System\HRDBcUZ.exe
  2⤵
  PID:14108
- C:\Windows\System\tNATMob.exe
  C:\Windows\System\tNATMob.exe
  2⤵
  PID:14128
- C:\Windows\System\CqtJJhm.exe
  C:\Windows\System\CqtJJhm.exe
  2⤵
  PID:14140
- C:\Windows\System\VIhAClO.exe
  C:\Windows\System\VIhAClO.exe
  2⤵
  PID:14164
- C:\Windows\System\bgGiQrG.exe
  C:\Windows\System\bgGiQrG.exe
  2⤵
  PID:448
- C:\Windows\System\GYAbXDO.exe
  C:\Windows\System\GYAbXDO.exe
  2⤵
  PID:4360
- C:\Windows\System\fTjVVmy.exe
  C:\Windows\System\fTjVVmy.exe
  2⤵
  PID:11740
- C:\Windows\System\SSvOvLc.exe
  C:\Windows\System\SSvOvLc.exe
  2⤵
  PID:13420
- C:\Windows\System\wvOdhJS.exe
  C:\Windows\System\wvOdhJS.exe
  2⤵
  PID:14052
- C:\Windows\System\HZOGkmh.exe
  C:\Windows\System\HZOGkmh.exe
  2⤵
  PID:13788
- C:\Windows\System\iSxmhlN.exe
  C:\Windows\System\iSxmhlN.exe
  2⤵
  PID:14028
- C:\Windows\System\QhQPAbk.exe
  C:\Windows\System\QhQPAbk.exe
  2⤵
  PID:14332
- C:\Windows\System\bUSrtgo.exe
  C:\Windows\System\bUSrtgo.exe
  2⤵
  PID:9424
- C:\Windows\System\ZUaLeGR.exe
  C:\Windows\System\ZUaLeGR.exe
  2⤵
  PID:13752
- C:\Windows\System\kQJLCKz.exe
  C:\Windows\System\kQJLCKz.exe
  2⤵
  PID:11296
- C:\Windows\System\ijNiZci.exe
  C:\Windows\System\ijNiZci.exe
  2⤵
  PID:10724
- C:\Windows\System\FMHWVZI.exe
  C:\Windows\System\FMHWVZI.exe
  2⤵
  PID:14100
- C:\Windows\System\wBSOzrU.exe
  C:\Windows\System\wBSOzrU.exe
  2⤵
  PID:12388
- C:\Windows\System\aHHPDmb.exe
  C:\Windows\System\aHHPDmb.exe
  2⤵
  PID:7612
- C:\Windows\System\cgMUndI.exe
  C:\Windows\System\cgMUndI.exe
  2⤵
  PID:13880
- C:\Windows\System\IfgYIvJ.exe
  C:\Windows\System\IfgYIvJ.exe
  2⤵
  PID:12432
- C:\Windows\System\uiDGNsA.exe
  C:\Windows\System\uiDGNsA.exe
  2⤵
  PID:2444
- C:\Windows\System\JFcCEbK.exe
  C:\Windows\System\JFcCEbK.exe
  2⤵
  PID:3132
- C:\Windows\System\RxIOmPz.exe
  C:\Windows\System\RxIOmPz.exe
  2⤵
  PID:10320
- C:\Windows\System\qeCnEvk.exe
  C:\Windows\System\qeCnEvk.exe
  2⤵
  PID:13224
- C:\Windows\System\PmRvJDu.exe
  C:\Windows\System\PmRvJDu.exe
  2⤵
  PID:1952
- C:\Windows\System\sAeuOOC.exe
  C:\Windows\System\sAeuOOC.exe
  2⤵
  PID:13532
- C:\Windows\System\BIGEoAa.exe
  C:\Windows\System\BIGEoAa.exe
  2⤵
  PID:13904
- C:\Windows\System\ZSaGlzj.exe
  C:\Windows\System\ZSaGlzj.exe
  2⤵
  PID:7088
- C:\Windows\System\qdJELcS.exe
  C:\Windows\System\qdJELcS.exe
  2⤵
  PID:14180
- C:\Windows\System\eCqIlyu.exe
  C:\Windows\System\eCqIlyu.exe
  2⤵
  PID:14280
- C:\Windows\System\FYUfZFx.exe
  C:\Windows\System\FYUfZFx.exe
  2⤵
  PID:12456
- C:\Windows\System\VHhoeWx.exe
  C:\Windows\System\VHhoeWx.exe
  2⤵
  PID:1900
- C:\Windows\System\HTTryFT.exe
  C:\Windows\System\HTTryFT.exe
  2⤵
  PID:14220
- C:\Windows\System\mwxrylH.exe
  C:\Windows\System\mwxrylH.exe
  2⤵
  PID:12260
- C:\Windows\System\ZwpsMdT.exe
  C:\Windows\System\ZwpsMdT.exe
  2⤵
  PID:12488
- C:\Windows\System\kwGVqiz.exe
  C:\Windows\System\kwGVqiz.exe
  2⤵
  PID:13264
- C:\Windows\System\DpmcVsK.exe
  C:\Windows\System\DpmcVsK.exe
  2⤵
  PID:9264
- C:\Windows\System\LglYIRO.exe
  C:\Windows\System\LglYIRO.exe
  2⤵
  PID:5300
- C:\Windows\System\PpXcSKb.exe
  C:\Windows\System\PpXcSKb.exe
  2⤵
  PID:13432
- C:\Windows\System\uFRlzbX.exe
  C:\Windows\System\uFRlzbX.exe
  2⤵
  PID:5560
- C:\Windows\System\roSNPoW.exe
  C:\Windows\System\roSNPoW.exe
  2⤵
  PID:13668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zzmqqpoq.if3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AWgOyfj.exe

Filesize
1.1MB

MD5
81b1d81c9dd52aaf7d4a23817205a52f

SHA1
a139dda2ee996565a0c4c0bab6a3f3710197b2ff

SHA256
3ef6166df15d717d77542bc06cc1bb6ba58c3e9228f6ad44adebcc3de2d36a9e

SHA512
9702ced74eaad5aa4a15e46822a39ae76c112f6efa5ad9f7dfb06a0fe002ffa1ddbdb0971927d0e190dd9cd6341cd81a78788adc76dfea51273fb20ab29d1635

Download Submit
C:\Windows\System\DSSqvDN.exe

Filesize
1.1MB

MD5
1d8b937bc33573ee5375a2045428bf76

SHA1
6e14190c1140cf46c9ba7c40adac2d79d0235742

SHA256
c1f8fe75117720bf7bdc0e51915a79aa2bb67e36f7441d1e84a750332b472647

SHA512
7bc89f44fd64e2ad3c8a312b6e47d8ae2653611639bd2553132cb3c0fd5b4708847ca8282264bfb34bfcac895ea112dcfc8456444edccd3e6504599e93e110b5

Download Submit
C:\Windows\System\GMJAQpG.exe

Filesize
1.1MB

MD5
28e4cf027dd84f43e2c39ae92382b4ab

SHA1
f4e6d27db9d3e40c368faf092e621c03f0293f86

SHA256
42d8cd0844f3ce70fb220f955b63cba6c07e54c5f9ed827b87f27bbe0a76073f

SHA512
3050e8921a8e21195f2edcff2970ab4e166075d6007eb71053e6321bdd176548e32c88e37cff34c853372c0e6a905320abc23294258c1e087ff8fd1e2dbda22b

Download Submit
C:\Windows\System\GmNozrm.exe

Filesize
1.1MB

MD5
f81dc4a3af549b7ec13248c4ce2db195

SHA1
4a352e76aa0d8e33d5df2413cb05576454d7f7f2

SHA256
44d44ee3c18118c0ca1712660b4e3450bde41b7e89a62dd00f3c19abef8393d6

SHA512
c88e42ea6433e13dbe1b5a36962f379ee1d525c38c58ccfe90e179d518f6cb28af600300ed9324392079cc9b5a3866d9c6ced1dc969a7b3cb8fb9deb217134b7

Download Submit
C:\Windows\System\HVHkoUf.exe

Filesize
1.1MB

MD5
d7eb333da0114604c9be40acee7ffdcc

SHA1
777f4dc3355af9692b69fef0e6e5d84a047936bf

SHA256
a6963b893229d52c661c6802b2168302d1fa8f634adbbd436edc491ccfb12d92

SHA512
1d0a569601b1b6ee4d2877d92ddf8fa042fb8c13e9a42ce90001bdf9e0095d2b210bd29198aa28f1260006bba512ec72de593adf46adae7778310aa8ba8b7de9

Download Submit
C:\Windows\System\IDauTtT.exe

Filesize
1.1MB

MD5
d1bd1f8d31d8e2caae3c44ed72c257be

SHA1
7dc8d345a3614d1c428fb845545681501c327fc6

SHA256
3763c1e1b00b251648b80394d6193aed97872bc438726dcc2c3d2b3908fd245c

SHA512
1850e21087c5784853e351352c8150a2c5c0a8d40efeb112bd08880b18ade432f265190401668b23da11d5e77cc24d792c7db8cdf1d4eea23a261cc46ed4ef93

Download Submit
C:\Windows\System\JPPilYa.exe

Filesize
1.1MB

MD5
f07256de9bb8020f0bc0b62b46845c26

SHA1
4303a8735037f3beff145f480d8f190eb10bd23a

SHA256
4dbd98ca734d028f98e23c1a7cfe903bada4229f0e67faccfc0e309712f8fa80

SHA512
3c0266b10ca2fc37e499ba3f758bf386601cd18033c343e24578b3d671748991776e549c8c7d124bb0038de1fc17b53f980f96b4130d76be3df881c32bffb893

Download Submit
C:\Windows\System\KgHsfZH.exe

Filesize
1.1MB

MD5
225875acbe1bb84812d55e6370759671

SHA1
ed203c77bf1afbb1c3233e14881f7d50971a3bcf

SHA256
195801291bdfb5e9d66ce1a5e3ff9417ba7702658c88c13b4c41524bcdf3207a

SHA512
4f1b95f4e63f5243ddfbd5f6834d7468f42314b93edfeeb931d60d53080ee9f4ef9af0602d48bff97a0fe1d8e31bae6a0e6c56e8bebec295ec3a007df8bac0f0

Download Submit
C:\Windows\System\MkkTyXz.exe

Filesize
1.1MB

MD5
a08038197e77bdfce7ef54ed9922a665

SHA1
7afeaefdae07205f6f9750856c4a442724cfd4cc

SHA256
302e6725fbd24399c63925ecdf232c7ec347029c5a218ab44e71793e96d3b314

SHA512
17f05d7f604cd577825deec54efd09dba11a91c9a9317ce514b387e5d1ab36b2f9fa65d2b78ac24341b8ab4229fe6b2051a1a4f12fd801a9ee0fd4c020de8b38

Download Submit
C:\Windows\System\NvdQnCh.exe

Filesize
1.1MB

MD5
bbdb5b31783d25ae1d2b121a4fa6e4c8

SHA1
c5c801e5d43132dccdac00f4b562523584f35e0e

SHA256
a3f8e7d3c9f5eac6157d363f6cddf0b27d14b7c0d74c5a5a7d32c6d9df461aed

SHA512
66df95525f49f5f7c106386a511c57e04e4e93502cf711633bf41c62ad8c604803beae8ef0a887c50c8c84815c1694189680e8d8464975509647acb757343a3a

Download Submit
C:\Windows\System\RBtHvLl.exe

Filesize
1.1MB

MD5
f67d9244059b31a8b487da54983a7d45

SHA1
ff7ddcf6964694f7629218eae9e73b093161ddb6

SHA256
6ed4ed4eb1511b0acd4009135de306f8e78463de3dda34019b29ec48108aadae

SHA512
9768a6cbc7a5d88f6c8a96c0345f3e6b8d9f821f80d35dbbea3d669370153c4cf86a69a9be1afe04b1cc8c90edd5e85358eecf4a69a524654757de011029ffee

Download Submit
C:\Windows\System\SmPxYCZ.exe

Filesize
1.1MB

MD5
cc1dc4d3957dcaa46a5a42d361f682dc

SHA1
794170bfd03658628d7db1dd15264af656cdef99

SHA256
08a22b2f214521dda73f87d95b6c39322593737e37cfb1a139bf158c20376e90

SHA512
fd64557edf3a646c77de4492b2d985b8b348f8c1db3d7f2d6b5760e06f872755cb2366f60e911eaecbd0a32c47ca08993c1095798be309aed4a9188f25089a03

Download Submit
C:\Windows\System\WjDKnUj.exe

Filesize
1.1MB

MD5
aad0db06ee02bc641eccb91ef2001b09

SHA1
3459803310a8044968cdab3bda49887c3883b781

SHA256
fc6fc5140ddcb99608fee267cd07eee4030aa887fbc5646cf7dd2a3c57cb1ed9

SHA512
66c17d06e9e79c0d66a0d858d2421e2dd7ea9681006e580c42dd36659f64f4d4568833fcaf1ad65c4911688d55d80a9b6f71024eb8afb903ab73893e491b6d6f

Download Submit
C:\Windows\System\WnrMztp.exe

Filesize
1.1MB

MD5
2b955415cc8b90ec495e760020907f21

SHA1
ca7c0f69787bf1f5950699c40d5f8ff044fda72d

SHA256
8c3041ddc6b8c8b16136e383390a840d8da1368efd444eed8dbabdf0ab1bdabc

SHA512
32254042abbe9947694febece7ca05cc5fbd7fd3e6373f736c65c0e882a78510c7e2854fd8f37c26710425f9551d82cef625f697a520b24507bd666fae2255a4

Download Submit
C:\Windows\System\XQrbCkp.exe

Filesize
1.1MB

MD5
1e82f018b2c2c3588799f22b91123022

SHA1
46a17dc1a0419d037d693fac980c66832e04bcfa

SHA256
4147ee6e2e7aef2f3d83fb99183d5dd3a5f09313d6da39574b168cbec323cca4

SHA512
449cdf8ed41554874a424f6fd8c26b03ffb570848b2075f52604c539e74691f279cf46b72333088806ca1dbcd928a3121dd12acf187b9116a70483275676d1ee

Download Submit
C:\Windows\System\XvaoIVo.exe

Filesize
1.1MB

MD5
d96408f68772635511dcf854d78fd0ae

SHA1
5c99373582484e2a0a6fe359e059b8dfdc409009

SHA256
14f44f1f5e9782afd8452e620e25880663d5defbdb0d6429c350685c261ba537

SHA512
c7d30ddda76c783a431f5b762463a4deeb01209c8c188597ecaa6d8f9530784fe119cac3f388ded02ddbd8bf7e38f573159351b043e5342a6495193c8e4839cd

Download Submit
C:\Windows\System\YBpqPAY.exe

Filesize
1.1MB

MD5
b935f3a3ec025ae4c5a59ef4d3d8cb2a

SHA1
e28d3f62a6431d5ac4d2213fed6d7975196f91e5

SHA256
bba3406fc2580a0db7b7f2e873eaba7d4dba710afaf505faf23732348efd5313

SHA512
cf974273326c637ed25843d9221ce8f533800099680073590698873213f55f513d4a256522fa15a580695f336329a634acf28ed270045eeb6706c6540f52dc45

Download Submit
C:\Windows\System\YCXiRvo.exe

Filesize
1.1MB

MD5
828c2bbcfbe2e14ab80f543ce1cb67d9

SHA1
506c0cbff48d3b0e8c43b9daf8698eb91700318e

SHA256
689d3b72f922183627bc671a092cd7360e3fafcbc84c4aad55afd8719782a170

SHA512
4abd298845c1b64cc37e8ecbaa7d9963babee634b90c0196d89ce5efafe5c1509e3191b7bfd27bd26aba4ada0b429154be1dafa37bc6f5868737ad90da1f1e36

Download Submit
C:\Windows\System\cekAkqs.exe

Filesize
1.1MB

MD5
83b0cfeed67de78bbac03c49ffacc055

SHA1
eca2adc4dc1a72da2f407b5e023c68b45f322c74

SHA256
be22a437a5966f7911df8238a91433bacaa5c179c65cf448e8cdd6ce4423245a

SHA512
5d56cf218581b52df6855dc4cb2a92143a8684393891d4e7fcaedd17e7705249f5c26419796a6ab9381b033f0fb8817ae588b21a94843e5ba966aeebd6276d75

Download Submit
C:\Windows\System\dejjzQS.exe

Filesize
1.1MB

MD5
2394988753d420caa75f22100d0525ac

SHA1
69bbbdf3dbb9a81df5ef78fc66699fa181fc95cd

SHA256
e97745e69beba46c90221abac668d51febb235226a6418e4d868bc2f940b2108

SHA512
0ed35812527ace495bf13c0d378eb544ab30d117137251b4e75f7b5cc0bf3b22ab0c149d3b30706bd8e3d0172640a72fdbeb4cd877f6a9a5af8e8b7c21b32c01

Download Submit
C:\Windows\System\eYXNDuY.exe

Filesize
1.1MB

MD5
c23a79f5fae753e00335097c96d39283

SHA1
d930a2ab9226b4cacbcc522156da6a2f1382bfde

SHA256
f80ee1dc2751816e9906fa48540dfc017cc975f4b784b0fb8704f52d975eddc7

SHA512
54013c0d721a607c2d4ce00f314914d13f47817882e2a515f3e3243ae26c089961952e894c17bf4340d3b73aedd1f737388f9e34b342ddb3064946daf6ef0a7d

Download Submit
C:\Windows\System\fWiWggy.exe

Filesize
1.1MB

MD5
6abcb1b307cd3f55e7bcf700c1e42345

SHA1
cb8f48d701bb0772fbcdba414c88f8d383a0d698

SHA256
4999a3e744a0c2419a018e06ec150fdc402819e8e39545316c37356bf3270244

SHA512
d7dcdbcc7023dd52cd107f4ab83d725e3d08ec57ca229321c657a3e89fd5428f4c71132c58234c1ae703826d4e064ed8acb1be8d30c81af81e4df749fd31635f

Download Submit
C:\Windows\System\gNnbeCk.exe

Filesize
1.1MB

MD5
f1fb82110813c5465b5d19f21034024d

SHA1
f5cc19a7c1cacd597a6c8489f669d38f345353e5

SHA256
8e65e32d60f1dc80ef016b942893fcdde1b7da419cb91d4d8374d8a532a38e6b

SHA512
ada54a11288a8b64f01739647a060654a1ebc9d56fc8129eed763c9b8492a93bb0c09f714715a6a178197d226172dccd7b43e123ab55104a97af76455e6ea5eb

Download Submit
C:\Windows\System\gZDKymC.exe

Filesize
1.1MB

MD5
4c45e901e14929b09d748883bffb0a91

SHA1
51065367a4d022db32a6da9d8e3ffe0ea327c3ab

SHA256
cc84c6b3206ad2658865f01d7b11ba6daada02398e4d07c324bee631f813229d

SHA512
3c414848dd856f42b62c77742a259e58db33585a0c35f75147a62811708d650ede5980ffae0106572b263c67bed092eb8c42f89b6eaf852f6f8b611a82916643

Download Submit
C:\Windows\System\gtTjyJJ.exe

Filesize
8B

MD5
2eef2e285d0fa10ec68fc824cc656e38

SHA1
9c42742498220004e06350809e5db8f24f735490

SHA256
3f71d1e26cef42301333e211fafa5452a1f0e686c9531b59bdac33efce4abf6d

SHA512
bc37d4d1b5afb9e9d1ac82969a2c9f344a9fec208a0a02a74c753501e7b904769863942204764e098bb553aa0a13e219008eaf0e8e4a52c86cba63cab5ceef15

Download Submit
C:\Windows\System\hLciKof.exe

Filesize
1.1MB

MD5
64598b28b448bb05970ce68f18c2fd1c

SHA1
d231e20d77563066d600159877862ce7455aeb09

SHA256
81982a1ea8a42d69798c17b70155dad1e2af879530ec6b9fbb2d85c8683be151

SHA512
7ecec1267865efcd5d96dc45edf1f4109610573fb03e4822ab4a81c42950290d8f1bb4e5308ddbb838a4342a592483768536b3f0abf8243494edd502ae6d6c96

Download Submit
C:\Windows\System\hRbgTzE.exe

Filesize
1.1MB

MD5
77e2bbc39d863877b26b2130a4be06e1

SHA1
125307f7a2db69a9ce0cfed6c410425d9be771ad

SHA256
dab06e1d4e9d91f0fc6a33135d67a74e5154cc4adaadf2c7accf93acb00bada8

SHA512
0d2370668566ab59e091f53db884a114e9de84527e6b4cadd074a61c0c60c683a289db64fb541f59c72887d54e3546e78408e12e0a787279e240ac373ac9f282

Download Submit
C:\Windows\System\iAslwDF.exe

Filesize
1.1MB

MD5
8667f1876061d21b927f6bfcbf88a789

SHA1
761be353537731b38a21d5235bbc519e263a473f

SHA256
156d1eb3f808a73c5e9bbdab3bec4162e4bceb104910552da3a910bdd0a1f12a

SHA512
bdaeeaed955215639763fa7073dddecc39cbc1129742a8821d1351c2fcff72653fee69fe242df73c90a245962b5d57b20855bb073d09935ff154aff006631973

Download Submit
C:\Windows\System\kZUUvkz.exe

Filesize
1.1MB

MD5
7150229a205647ecd4c70c83d209e502

SHA1
defa729c12169ebea2681b2d28f93edf443b278e

SHA256
74f13d162ab97d47df6ea691236fee1b83dfc1f5931d1c3b2e22a86a53e248de

SHA512
821524bead834178395d164a9ab553c877a27543cdef2c98c46b76bc22d68382423b5c7a58cf134add6b77e3bbad36d409194d6bc282f3a237bde56c572c8966

Download Submit
C:\Windows\System\keqqcPL.exe

Filesize
1.1MB

MD5
f69af6749015e45edfb499e9b259e8b3

SHA1
47dc5fbf389f44bf017377780ec4955456c32ec2

SHA256
e8692c3c72cb33743f314e48edd8a8d0b9de52e70f9220848a81f307d32f8066

SHA512
392c9abcea60928dcc6205c85f00e11aa865672ac01623eafe23ed03b7decb39bf180302f0866507eef737e6a41e13d8ac7710c7c55c8be9230dac30a67d64d7

Download Submit
C:\Windows\System\kpNqSuK.exe

Filesize
1.1MB

MD5
ba86c63f329c4b30e5acf589c5e8c1a7

SHA1
79541f536fbac4ed99fd1379ff8f0544af5df6ee

SHA256
7f86843e9c6aa3abe1ab214275365c3d7f187b7d235bbc18ebc4e64d07c522c6

SHA512
6ce4fbd90c895c61b35e8ab0014284b3c4603dfe77d00383e36e99c0e6c8fb32afd87e9505554c6a329476f86d6b7c82539a5e8ff1505b88e7dfa3376b417176

Download Submit
C:\Windows\System\mijtxpL.exe

Filesize
1.1MB

MD5
4511f11f469185269f09366eb5550658

SHA1
4d8c9bb7d92e5effc244fa7e4ba80a8cbfdaaac1

SHA256
04540570dd8ba8ed3f63d6f0fb54fd0fcf30ea8f9deac369f8326e288b42524b

SHA512
948677e9100dda72083feb0f94549f98f2b9aab209f0d3f68811ef42349bcfd3d9f76d0f451db0e101db53ebd1dc3caab0bd31ab7187da041bb690d747cfa7c3

Download Submit
C:\Windows\System\rXRuMOi.exe

Filesize
1.1MB

MD5
81d9f1531f62234d0d6e45ec7dd0a084

SHA1
941ea2007a47dd480ee7684ec71d8a4264737cde

SHA256
c8340b2f67a39c732d90cb8df4224860023ad95708b716410ba73afcb0397c4d

SHA512
c464c60eb1e7319732d2b9c8bb35174a5fdabb6ca4a5e30a6c96ea43f68ce019a6101f66f99fa5ca48ea52ff8efb888ba9382c62cd83071d72082bb63c162e67

Download Submit
C:\Windows\System\sbsyXiH.exe

Filesize
1.1MB

MD5
50f5952beda69eb86ea3ad5f61e92aab

SHA1
fe3c606a8979491c8092319bce4598c7e0178a53

SHA256
f89c8c7e42cccfb75ea5c7c5745f6155c75557ef841c6e60a87e1df1a2f62d51

SHA512
febd7b57f0061be1f84d07438068ed694b00408cf6a24e76afd25d376cd7a1133bbe66c2b7892e65cfcf7e9e78929101ee4444d1b29c072f132a38144e4ebd90

Download Submit
C:\Windows\System\tguJilk.exe

Filesize
1.1MB

MD5
a88f2056caba69957c3da86e922edda5

SHA1
f6cdbd77d18a14e2d4e6d573cbcdd1694aead7b4

SHA256
46ebffda99ccd118134badc87b8fdffa089b79d8e7c2775c7547b3e42cf8dff9

SHA512
be2c1399f52d0af285db6cba39846455f60bda26b2adeca62dc66bbd1e342cafc6bdd93736a0ee93d6336a779b5b0f9186eee984ad95b109b4dedd25ba7bf7ed

Download Submit
C:\Windows\System\ubyHaGl.exe

Filesize
1.1MB

MD5
df6e421a100d82b283b0915604810e8d

SHA1
78018f0a31eeaf2395cb166b2141326cd71ad111

SHA256
f44be58214bb4353c401dc3551ec2ec57cf2398a18f1d63146b926aa83873289

SHA512
36916b97a6ec08c554fabf0a48edea04e13ddc506bbc9b130fe7f77e6beca27fbf757264bed83439ebcbbc68371d1779e318a859009938669e7f266ff73a8258

Download Submit
C:\Windows\System\wIoSYtA.exe

Filesize
1.1MB

MD5
47f70a3cfb1dd27912a92b6f39fd5bf8

SHA1
4dd33f5a5ec52c512d4b93f39ae5d7c85967bee7

SHA256
c774a37d58f6c131212aa6b109487179c10db1a94d8ca4dfa81c225e4d9c0086

SHA512
be1574aefeb28f4e0514a2dea0c274bbdf988c0456750e65c4c0d8ed41491ef34e6854679a7fc4578faf8ef05535f16b52a941c036ab5bbd724702930fe7d282

Download Submit
C:\Windows\System\zHrcafg.exe

Filesize
1.1MB

MD5
370ad709922eb4ea5f8a6c9a58a3681a

SHA1
a1cdcb0fde147e58ba98ef0d4456959700c829f6

SHA256
35d08f6e2f9de2d687f98770b9dbe00172e2ec4e84ecb7406c8b99078b075088

SHA512
886239060f526f11c0ae03a106ba349220b76cc1c29e669ea5573b08e2fee8f465fe24039f3b689358f6d7ae08ab987c614ad586fd3a34ff7f41cb19671d3440

Download Submit
C:\Windows\System\zxsjzIR.exe

Filesize
1.1MB

MD5
f30702eb6fac287abd45608c483a2d0e

SHA1
44883cebda97e3de1bcb3f847d555726bd58c13d

SHA256
5c42841161dd6593c5a9d4220274f4c4bf0cb6658cb7a21cd45b5e0ad188144a

SHA512
5992cbf0dcfa88f46c86a84a21f02419a66db9c79d97d5df391fa1fbd9f4e06b7464124647d7c44141376bec9a41c498ea83fd4665f03029a9ba58f0730291db

Download Submit
memory/608-3149-0x00007FF62A310000-0x00007FF62A702000-memory.dmp

Filesize
3.9MB

Download
memory/608-123-0x00007FF62A310000-0x00007FF62A702000-memory.dmp

Filesize
3.9MB

Download
memory/620-14-0x00007FF6993A0000-0x00007FF699792000-memory.dmp

Filesize
3.9MB

Download
memory/620-2242-0x00007FF6993A0000-0x00007FF699792000-memory.dmp

Filesize
3.9MB

Download
memory/620-3123-0x00007FF6993A0000-0x00007FF699792000-memory.dmp

Filesize
3.9MB

Download
memory/732-3205-0x00007FF69DCB0000-0x00007FF69E0A2000-memory.dmp

Filesize
3.9MB

Download
memory/732-473-0x00007FF69DCB0000-0x00007FF69E0A2000-memory.dmp

Filesize
3.9MB

Download
memory/804-1-0x0000029E99F20000-0x0000029E99F30000-memory.dmp

Filesize
64KB

Download
memory/804-2241-0x00007FF727810000-0x00007FF727C02000-memory.dmp

Filesize
3.9MB

Download
memory/804-0-0x00007FF727810000-0x00007FF727C02000-memory.dmp

Filesize
3.9MB

Download
memory/1388-591-0x00007FF653AF0000-0x00007FF653EE2000-memory.dmp

Filesize
3.9MB

Download
memory/1388-3201-0x00007FF653AF0000-0x00007FF653EE2000-memory.dmp

Filesize
3.9MB

Download
memory/1504-277-0x00007FF780900000-0x00007FF780CF2000-memory.dmp

Filesize
3.9MB

Download
memory/1504-3158-0x00007FF780900000-0x00007FF780CF2000-memory.dmp

Filesize
3.9MB

Download
memory/1684-2378-0x00007FF7E1280000-0x00007FF7E1672000-memory.dmp

Filesize
3.9MB

Download
memory/1684-3132-0x00007FF7E1280000-0x00007FF7E1672000-memory.dmp

Filesize
3.9MB

Download
memory/1684-35-0x00007FF7E1280000-0x00007FF7E1672000-memory.dmp

Filesize
3.9MB

Download
memory/1936-3199-0x00007FF791CD0000-0x00007FF7920C2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-592-0x00007FF791CD0000-0x00007FF7920C2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-409-0x00007FF7F5670000-0x00007FF7F5A62000-memory.dmp

Filesize
3.9MB

Download
memory/1964-3197-0x00007FF7F5670000-0x00007FF7F5A62000-memory.dmp

Filesize
3.9MB

Download
memory/2056-213-0x00007FF7ACDE0000-0x00007FF7AD1D2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-3162-0x00007FF7ACDE0000-0x00007FF7AD1D2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-3168-0x00007FF6B7F60000-0x00007FF6B8352000-memory.dmp

Filesize
3.9MB

Download
memory/2640-330-0x00007FF6B7F60000-0x00007FF6B8352000-memory.dmp

Filesize
3.9MB

Download
memory/2736-168-0x00007FF7C78D0000-0x00007FF7C7CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-3160-0x00007FF7C78D0000-0x00007FF7C7CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-3157-0x00007FF624470000-0x00007FF624862000-memory.dmp

Filesize
3.9MB

Download
memory/2996-596-0x00007FF624470000-0x00007FF624862000-memory.dmp

Filesize
3.9MB

Download
memory/3104-432-0x00007FF748AD0000-0x00007FF748EC2000-memory.dmp

Filesize
3.9MB

Download
memory/3104-3190-0x00007FF748AD0000-0x00007FF748EC2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-82-0x00007FF7E1340000-0x00007FF7E1732000-memory.dmp

Filesize
3.9MB

Download
memory/3252-3129-0x00007FF7E1340000-0x00007FF7E1732000-memory.dmp

Filesize
3.9MB

Download
memory/3252-2411-0x00007FF7E1340000-0x00007FF7E1732000-memory.dmp

Filesize
3.9MB

Download
memory/3564-593-0x00007FF6AC240000-0x00007FF6AC632000-memory.dmp

Filesize
3.9MB

Download
memory/3564-3133-0x00007FF6AC240000-0x00007FF6AC632000-memory.dmp

Filesize
3.9MB

Download
memory/3684-151-0x00007FF6A4BE0000-0x00007FF6A4FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3684-3135-0x00007FF6A4BE0000-0x00007FF6A4FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4076-3127-0x00007FF6BDD00000-0x00007FF6BE0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4076-266-0x00007FF6BDD00000-0x00007FF6BE0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4296-60-0x00007FF6EDE70000-0x00007FF6EE262000-memory.dmp

Filesize
3.9MB

Download
memory/4296-3125-0x00007FF6EDE70000-0x00007FF6EE262000-memory.dmp

Filesize
3.9MB

Download
memory/4488-3193-0x00007FF6D3B10000-0x00007FF6D3F02000-memory.dmp

Filesize
3.9MB

Download
memory/4488-590-0x00007FF6D3B10000-0x00007FF6D3F02000-memory.dmp

Filesize
3.9MB

Download
memory/4496-595-0x00007FF60DA80000-0x00007FF60DE72000-memory.dmp

Filesize
3.9MB

Download
memory/4496-3164-0x00007FF60DA80000-0x00007FF60DE72000-memory.dmp

Filesize
3.9MB

Download
memory/4628-3166-0x00007FF6F8AE0000-0x00007FF6F8ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4628-226-0x00007FF6F8AE0000-0x00007FF6F8ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4820-3155-0x00007FF6D6F20000-0x00007FF6D7312000-memory.dmp

Filesize
3.9MB

Download
memory/4820-414-0x00007FF6D6F20000-0x00007FF6D7312000-memory.dmp

Filesize
3.9MB

Download
memory/4872-594-0x00007FFC5D173000-0x00007FFC5D175000-memory.dmp

Filesize
8KB

Download
memory/4872-84-0x000001616B940000-0x000001616B950000-memory.dmp

Filesize
64KB

Download
memory/4872-324-0x000001616B910000-0x000001616B932000-memory.dmp

Filesize
136KB

Download
memory/4872-85-0x000001616B940000-0x000001616B950000-memory.dmp

Filesize
64KB

Download
memory/5052-3121-0x00007FF776440000-0x00007FF776832000-memory.dmp

Filesize
3.9MB

Download
memory/5052-30-0x00007FF776440000-0x00007FF776832000-memory.dmp

Filesize
3.9MB

Download
memory/5052-2375-0x00007FF776440000-0x00007FF776832000-memory.dmp

Filesize
3.9MB

Download
memory/5100-3234-0x00007FF6C36B0000-0x00007FF6C3AA2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-597-0x00007FF6C36B0000-0x00007FF6C3AA2000-memory.dmp

Filesize
3.9MB

Download