xmrig | 58088faae78f82ad526994ee502f9f9612dd3e836b2907bdd1247a96ab33fb24

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3222ed5542a2542db0daaa2cf4b339c0N.exe
Size

2.0MB
MD5

3222ed5542a2542db0daaa2cf4b339c0
SHA1

5e71a6ba51071c340a14f6eeb53466ec9efd4b9b
SHA256

58088faae78f82ad526994ee502f9f9612dd3e836b2907bdd1247a96ab33fb24
SHA512

af88b287ab9e0a163dee4b7c22ec6e9e37f83e486ee999eb6445720c4926e44ed2755add66a4ec6d43a0c0bbffca078a2760d09f040ac42f7c5e19632fab9333
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXQo6+T:NABP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/4840-147-0x00007FF7F5FF0000-0x00007FF7F63E2000-memory.dmp	xmrig
behavioral2/memory/4780-145-0x00007FF6FD360000-0x00007FF6FD752000-memory.dmp	xmrig
behavioral2/memory/1620-200-0x00007FF761000000-0x00007FF7613F2000-memory.dmp	xmrig
behavioral2/memory/2584-380-0x00007FF72B6E0000-0x00007FF72BAD2000-memory.dmp	xmrig
behavioral2/memory/1504-425-0x00007FF731FC0000-0x00007FF7323B2000-memory.dmp	xmrig
behavioral2/memory/4268-486-0x00007FF67A100000-0x00007FF67A4F2000-memory.dmp	xmrig
behavioral2/memory/832-495-0x00007FF6871A0000-0x00007FF687592000-memory.dmp	xmrig
behavioral2/memory/4176-497-0x00007FF797B80000-0x00007FF797F72000-memory.dmp	xmrig
behavioral2/memory/556-501-0x00007FF728470000-0x00007FF728862000-memory.dmp	xmrig
behavioral2/memory/1128-2111-0x00007FF7A7A00000-0x00007FF7A7DF2000-memory.dmp	xmrig
behavioral2/memory/4212-502-0x00007FF786380000-0x00007FF786772000-memory.dmp	xmrig
behavioral2/memory/1436-500-0x00007FF7807B0000-0x00007FF780BA2000-memory.dmp	xmrig
behavioral2/memory/4900-499-0x00007FF7F4B80000-0x00007FF7F4F72000-memory.dmp	xmrig
behavioral2/memory/836-498-0x00007FF77AA60000-0x00007FF77AE52000-memory.dmp	xmrig
behavioral2/memory/3168-494-0x00007FF694470000-0x00007FF694862000-memory.dmp	xmrig
behavioral2/memory/5036-493-0x00007FF740160000-0x00007FF740552000-memory.dmp	xmrig
behavioral2/memory/4768-330-0x00007FF6D4150000-0x00007FF6D4542000-memory.dmp	xmrig
behavioral2/memory/4972-327-0x00007FF6C9920000-0x00007FF6C9D12000-memory.dmp	xmrig
behavioral2/memory/2508-274-0x00007FF7809B0000-0x00007FF780DA2000-memory.dmp	xmrig
behavioral2/memory/968-259-0x00007FF7294A0000-0x00007FF729892000-memory.dmp	xmrig
behavioral2/memory/1224-229-0x00007FF7C5020000-0x00007FF7C5412000-memory.dmp	xmrig
behavioral2/memory/2228-177-0x00007FF6C69F0000-0x00007FF6C6DE2000-memory.dmp	xmrig
behavioral2/memory/5008-101-0x00007FF78A970000-0x00007FF78AD62000-memory.dmp	xmrig
behavioral2/memory/660-84-0x00007FF6AC1D0000-0x00007FF6AC5C2000-memory.dmp	xmrig
behavioral2/memory/2404-71-0x00007FF727D10000-0x00007FF728102000-memory.dmp	xmrig
behavioral2/memory/2404-3683-0x00007FF727D10000-0x00007FF728102000-memory.dmp	xmrig
behavioral2/memory/5008-3696-0x00007FF78A970000-0x00007FF78AD62000-memory.dmp	xmrig
behavioral2/memory/4176-3712-0x00007FF797B80000-0x00007FF797F72000-memory.dmp	xmrig
behavioral2/memory/4840-3718-0x00007FF7F5FF0000-0x00007FF7F63E2000-memory.dmp	xmrig
behavioral2/memory/2228-3720-0x00007FF6C69F0000-0x00007FF6C6DE2000-memory.dmp	xmrig
behavioral2/memory/4780-3716-0x00007FF6FD360000-0x00007FF6FD752000-memory.dmp	xmrig
behavioral2/memory/660-3714-0x00007FF6AC1D0000-0x00007FF6AC5C2000-memory.dmp	xmrig
behavioral2/memory/4768-3734-0x00007FF6D4150000-0x00007FF6D4542000-memory.dmp	xmrig
behavioral2/memory/4900-3741-0x00007FF7F4B80000-0x00007FF7F4F72000-memory.dmp	xmrig
behavioral2/memory/4268-3747-0x00007FF67A100000-0x00007FF67A4F2000-memory.dmp	xmrig
behavioral2/memory/832-3751-0x00007FF6871A0000-0x00007FF687592000-memory.dmp	xmrig
behavioral2/memory/3168-3753-0x00007FF694470000-0x00007FF694862000-memory.dmp	xmrig
behavioral2/memory/5036-3779-0x00007FF740160000-0x00007FF740552000-memory.dmp	xmrig
behavioral2/memory/1620-3745-0x00007FF761000000-0x00007FF7613F2000-memory.dmp	xmrig
behavioral2/memory/1224-3744-0x00007FF7C5020000-0x00007FF7C5412000-memory.dmp	xmrig
behavioral2/memory/1436-3740-0x00007FF7807B0000-0x00007FF780BA2000-memory.dmp	xmrig
behavioral2/memory/2508-3738-0x00007FF7809B0000-0x00007FF780DA2000-memory.dmp	xmrig
behavioral2/memory/4972-3736-0x00007FF6C9920000-0x00007FF6C9D12000-memory.dmp	xmrig
behavioral2/memory/1504-3732-0x00007FF731FC0000-0x00007FF7323B2000-memory.dmp	xmrig
behavioral2/memory/2584-3730-0x00007FF72B6E0000-0x00007FF72BAD2000-memory.dmp	xmrig
behavioral2/memory/556-3724-0x00007FF728470000-0x00007FF728862000-memory.dmp	xmrig
behavioral2/memory/968-3723-0x00007FF7294A0000-0x00007FF729892000-memory.dmp	xmrig
behavioral2/memory/836-3728-0x00007FF77AA60000-0x00007FF77AE52000-memory.dmp	xmrig
behavioral2/memory/4212-3849-0x00007FF786380000-0x00007FF786772000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3648	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4176	FAqkeEm.exe
2404	uFFNOzH.exe
660	VpmWTVx.exe
5008	cOuipSC.exe
4780	aYmaysF.exe
4840	rcPtOOk.exe
2228	qdFqmjf.exe
836	BefSlAP.exe
1620	mjOQYXV.exe
1224	GejSFmR.exe
968	NUTAkGj.exe
4900	yUKIADM.exe
2508	bvqVOKt.exe
4972	PufKAUd.exe
4768	jjpTRjK.exe
2584	rwuAlCK.exe
1504	ELVNEJT.exe
1436	slCklwb.exe
4268	jMRmunv.exe
556	LdSTyqN.exe
5036	nZXXOUf.exe
3168	eGpscad.exe
832	qCbPqsi.exe
4212	OesMqXS.exe
4772	NorPuTE.exe
3896	PdCQPyZ.exe
1020	Rbtxyrw.exe
776	URiEsnV.exe
3944	TrgCXxi.exe
1520	oNSprJU.exe
436	zrBZcYI.exe
1816	JpaYuNx.exe
3960	exovVZF.exe
2420	zGINbWf.exe
4156	GRdrEIy.exe
4548	dolkQDd.exe
4420	iZjpBkP.exe
5076	FXTNIQO.exe
4600	QGlraLV.exe
3500	IOVhKmp.exe
3704	bRfYYDJ.exe
796	dKQbMnp.exe
1468	uQnrfRM.exe
3536	gageTud.exe
4884	xLFhtcQ.exe
2524	tdIlmRG.exe
1112	CxFeKrm.exe
4732	wOFOnst.exe
3056	IdUBaLe.exe
3100	NIhFowa.exe
4072	oqucjeU.exe
3656	DqGmYXl.exe
3508	EfeAIMI.exe
4336	rGrxXtL.exe
4320	eUdApBQ.exe
4988	wMnDzsW.exe
1692	gGIoYRr.exe
1308	MbEmfSk.exe
4568	ZLOBODA.exe
4852	QmGnpGv.exe
2928	tikqfIh.exe
1312	ndIVpvL.exe
2660	FyIMAtv.exe
5084	jitKiQT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1128-0-0x00007FF7A7A00000-0x00007FF7A7DF2000-memory.dmp	upx
behavioral2/files/0x000700000002347c-16.dat	upx
behavioral2/files/0x000700000002347d-15.dat	upx
behavioral2/files/0x0009000000023427-19.dat	upx
behavioral2/files/0x000700000002347e-14.dat	upx
behavioral2/files/0x0007000000023480-47.dat	upx
behavioral2/files/0x0007000000023487-78.dat	upx
behavioral2/files/0x0007000000023484-94.dat	upx
behavioral2/files/0x0007000000023495-151.dat	upx
behavioral2/files/0x0007000000023494-150.dat	upx
behavioral2/files/0x0007000000023493-148.dat	upx
behavioral2/memory/4840-147-0x00007FF7F5FF0000-0x00007FF7F63E2000-memory.dmp	upx
behavioral2/memory/4780-145-0x00007FF6FD360000-0x00007FF6FD752000-memory.dmp	upx
behavioral2/files/0x0007000000023492-144.dat	upx
behavioral2/files/0x0008000000023479-184.dat	upx
behavioral2/memory/1620-200-0x00007FF761000000-0x00007FF7613F2000-memory.dmp	upx
behavioral2/files/0x00070000000234a0-191.dat	upx
behavioral2/memory/2584-380-0x00007FF72B6E0000-0x00007FF72BAD2000-memory.dmp	upx
behavioral2/memory/1504-425-0x00007FF731FC0000-0x00007FF7323B2000-memory.dmp	upx
behavioral2/memory/4268-486-0x00007FF67A100000-0x00007FF67A4F2000-memory.dmp	upx
behavioral2/memory/832-495-0x00007FF6871A0000-0x00007FF687592000-memory.dmp	upx
behavioral2/memory/4176-497-0x00007FF797B80000-0x00007FF797F72000-memory.dmp	upx
behavioral2/memory/556-501-0x00007FF728470000-0x00007FF728862000-memory.dmp	upx
behavioral2/memory/1128-2111-0x00007FF7A7A00000-0x00007FF7A7DF2000-memory.dmp	upx
behavioral2/memory/4212-502-0x00007FF786380000-0x00007FF786772000-memory.dmp	upx
behavioral2/memory/1436-500-0x00007FF7807B0000-0x00007FF780BA2000-memory.dmp	upx
behavioral2/memory/4900-499-0x00007FF7F4B80000-0x00007FF7F4F72000-memory.dmp	upx
behavioral2/memory/836-498-0x00007FF77AA60000-0x00007FF77AE52000-memory.dmp	upx
behavioral2/memory/3168-494-0x00007FF694470000-0x00007FF694862000-memory.dmp	upx
behavioral2/memory/5036-493-0x00007FF740160000-0x00007FF740552000-memory.dmp	upx
behavioral2/memory/4768-330-0x00007FF6D4150000-0x00007FF6D4542000-memory.dmp	upx
behavioral2/memory/4972-327-0x00007FF6C9920000-0x00007FF6C9D12000-memory.dmp	upx
behavioral2/memory/2508-274-0x00007FF7809B0000-0x00007FF780DA2000-memory.dmp	upx
behavioral2/memory/968-259-0x00007FF7294A0000-0x00007FF729892000-memory.dmp	upx
behavioral2/memory/1224-229-0x00007FF7C5020000-0x00007FF7C5412000-memory.dmp	upx
behavioral2/files/0x000700000002349c-187.dat	upx
behavioral2/files/0x000700000002349f-186.dat	upx
behavioral2/files/0x000700000002349e-183.dat	upx
behavioral2/files/0x000700000002348f-178.dat	upx
behavioral2/memory/2228-177-0x00007FF6C69F0000-0x00007FF6C6DE2000-memory.dmp	upx
behavioral2/files/0x000700000002349b-167.dat	upx
behavioral2/files/0x0007000000023490-166.dat	upx
behavioral2/files/0x000700000002349a-162.dat	upx
behavioral2/files/0x0007000000023499-160.dat	upx
behavioral2/files/0x0007000000023498-159.dat	upx
behavioral2/files/0x0007000000023491-158.dat	upx
behavioral2/files/0x0007000000023497-155.dat	upx
behavioral2/files/0x0007000000023496-154.dat	upx
behavioral2/files/0x000700000002349d-176.dat	upx
behavioral2/files/0x000700000002348e-139.dat	upx
behavioral2/files/0x000700000002348d-135.dat	upx
behavioral2/files/0x000700000002348a-132.dat	upx
behavioral2/files/0x0007000000023489-127.dat	upx
behavioral2/files/0x0007000000023488-124.dat	upx
behavioral2/files/0x0007000000023486-118.dat	upx
behavioral2/files/0x000800000002348c-105.dat	upx
behavioral2/memory/5008-101-0x00007FF78A970000-0x00007FF78AD62000-memory.dmp	upx
behavioral2/files/0x0007000000023483-93.dat	upx
behavioral2/files/0x0007000000023482-86.dat	upx
behavioral2/memory/660-84-0x00007FF6AC1D0000-0x00007FF6AC5C2000-memory.dmp	upx
behavioral2/files/0x0007000000023485-97.dat	upx
behavioral2/files/0x0007000000023481-75.dat	upx
behavioral2/memory/2404-71-0x00007FF727D10000-0x00007FF728102000-memory.dmp	upx
behavioral2/files/0x000700000002347f-45.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PdCQPyZ.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\ndPNYNF.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\SaIrmhq.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\HyOkFvT.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\MAvuBXf.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\JuisJBH.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\iEkEVzE.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\rVEdScW.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\UkMmJfG.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\gCttJgo.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\lGPraGK.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\LplcLuT.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\ruSYgSk.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\mlxZFfR.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\WttNdoh.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\HQXBqUK.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\yWSjtwE.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\BvufsHL.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\IqeLIGF.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\iYJXowV.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\QqpeCjz.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\MWqbupM.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\zYNCciy.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\OzCrzcC.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\OBnsbEQ.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\lLmtCYI.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\Wxodtgp.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\oPKROWf.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\EVgTwgY.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\nBzWshx.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\XocJZoL.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\nCdnhSL.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\ELGhQiT.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\lebyjmo.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\tRcgTDT.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\USOgSTZ.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\wFXFgDf.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\xkiclOW.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\WpnfvcX.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\SqOTuiw.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\AKkjzAJ.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\LFAPIjR.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\oIfmMke.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\oUZyYoZ.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\utdhqmI.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\XxVbsmN.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\fUCaZwL.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\grBLAum.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\BWAYFJU.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\QXERpmv.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\vqfiqUW.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\kweOQgS.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\qWtRFbW.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\VeVEdFw.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\dxErrnK.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\viBVnzt.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\wsmJTnA.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\jpCzpZx.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\ZqWbdWl.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\wTAFiIO.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\uouadHV.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\nRBWMIO.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\DdsWlOU.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe
File created	C:\Windows\System\preaGRw.exe	3222ed5542a2542db0daaa2cf4b339c0N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3648	powershell.exe
3648	powershell.exe
3648	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeLockMemoryPrivilege	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe
Token: SeLockMemoryPrivilege	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 3648	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	85
PID 1128 wrote to memory of 3648	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	85
PID 1128 wrote to memory of 2404	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	86
PID 1128 wrote to memory of 2404	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	86
PID 1128 wrote to memory of 4176	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	87
PID 1128 wrote to memory of 4176	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	87
PID 1128 wrote to memory of 5008	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	88
PID 1128 wrote to memory of 5008	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	88
PID 1128 wrote to memory of 660	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	89
PID 1128 wrote to memory of 660	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	89
PID 1128 wrote to memory of 4780	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	90
PID 1128 wrote to memory of 4780	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	90
PID 1128 wrote to memory of 4840	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	91
PID 1128 wrote to memory of 4840	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	91
PID 1128 wrote to memory of 2228	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	92
PID 1128 wrote to memory of 2228	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	92
PID 1128 wrote to memory of 836	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	93
PID 1128 wrote to memory of 836	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	93
PID 1128 wrote to memory of 1620	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	94
PID 1128 wrote to memory of 1620	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	94
PID 1128 wrote to memory of 1224	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	95
PID 1128 wrote to memory of 1224	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	95
PID 1128 wrote to memory of 968	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	96
PID 1128 wrote to memory of 968	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	96
PID 1128 wrote to memory of 1436	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	97
PID 1128 wrote to memory of 1436	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	97
PID 1128 wrote to memory of 4900	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	98
PID 1128 wrote to memory of 4900	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	98
PID 1128 wrote to memory of 2508	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	99
PID 1128 wrote to memory of 2508	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	99
PID 1128 wrote to memory of 4972	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	100
PID 1128 wrote to memory of 4972	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	100
PID 1128 wrote to memory of 4768	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	101
PID 1128 wrote to memory of 4768	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	101
PID 1128 wrote to memory of 2584	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	102
PID 1128 wrote to memory of 2584	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	102
PID 1128 wrote to memory of 1504	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	103
PID 1128 wrote to memory of 1504	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	103
PID 1128 wrote to memory of 5036	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	104
PID 1128 wrote to memory of 5036	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	104
PID 1128 wrote to memory of 4268	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	105
PID 1128 wrote to memory of 4268	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	105
PID 1128 wrote to memory of 556	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	106
PID 1128 wrote to memory of 556	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	106
PID 1128 wrote to memory of 3168	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	107
PID 1128 wrote to memory of 3168	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	107
PID 1128 wrote to memory of 832	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	108
PID 1128 wrote to memory of 832	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	108
PID 1128 wrote to memory of 4212	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	109
PID 1128 wrote to memory of 4212	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	109
PID 1128 wrote to memory of 4772	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	110
PID 1128 wrote to memory of 4772	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	110
PID 1128 wrote to memory of 3896	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	111
PID 1128 wrote to memory of 3896	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	111
PID 1128 wrote to memory of 1020	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	112
PID 1128 wrote to memory of 1020	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	112
PID 1128 wrote to memory of 776	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	113
PID 1128 wrote to memory of 776	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	113
PID 1128 wrote to memory of 3944	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	114
PID 1128 wrote to memory of 3944	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	114
PID 1128 wrote to memory of 1520	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	115
PID 1128 wrote to memory of 1520	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	115
PID 1128 wrote to memory of 436	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	116
PID 1128 wrote to memory of 436	1128	3222ed5542a2542db0daaa2cf4b339c0N.exe	116

C:\Users\Admin\AppData\Local\Temp\3222ed5542a2542db0daaa2cf4b339c0N.exe
"C:\Users\Admin\AppData\Local\Temp\3222ed5542a2542db0daaa2cf4b339c0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3648
- C:\Windows\System\uFFNOzH.exe
  C:\Windows\System\uFFNOzH.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\FAqkeEm.exe
  C:\Windows\System\FAqkeEm.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\cOuipSC.exe
  C:\Windows\System\cOuipSC.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\VpmWTVx.exe
  C:\Windows\System\VpmWTVx.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\aYmaysF.exe
  C:\Windows\System\aYmaysF.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\rcPtOOk.exe
  C:\Windows\System\rcPtOOk.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\qdFqmjf.exe
  C:\Windows\System\qdFqmjf.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\BefSlAP.exe
  C:\Windows\System\BefSlAP.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\mjOQYXV.exe
  C:\Windows\System\mjOQYXV.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\GejSFmR.exe
  C:\Windows\System\GejSFmR.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\NUTAkGj.exe
  C:\Windows\System\NUTAkGj.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\slCklwb.exe
  C:\Windows\System\slCklwb.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\yUKIADM.exe
  C:\Windows\System\yUKIADM.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\bvqVOKt.exe
  C:\Windows\System\bvqVOKt.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\PufKAUd.exe
  C:\Windows\System\PufKAUd.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\jjpTRjK.exe
  C:\Windows\System\jjpTRjK.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\rwuAlCK.exe
  C:\Windows\System\rwuAlCK.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\ELVNEJT.exe
  C:\Windows\System\ELVNEJT.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\nZXXOUf.exe
  C:\Windows\System\nZXXOUf.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\jMRmunv.exe
  C:\Windows\System\jMRmunv.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\LdSTyqN.exe
  C:\Windows\System\LdSTyqN.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\eGpscad.exe
  C:\Windows\System\eGpscad.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\qCbPqsi.exe
  C:\Windows\System\qCbPqsi.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\OesMqXS.exe
  C:\Windows\System\OesMqXS.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\NorPuTE.exe
  C:\Windows\System\NorPuTE.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\PdCQPyZ.exe
  C:\Windows\System\PdCQPyZ.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\Rbtxyrw.exe
  C:\Windows\System\Rbtxyrw.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\URiEsnV.exe
  C:\Windows\System\URiEsnV.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\TrgCXxi.exe
  C:\Windows\System\TrgCXxi.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\oNSprJU.exe
  C:\Windows\System\oNSprJU.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\zrBZcYI.exe
  C:\Windows\System\zrBZcYI.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\JpaYuNx.exe
  C:\Windows\System\JpaYuNx.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\exovVZF.exe
  C:\Windows\System\exovVZF.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\zGINbWf.exe
  C:\Windows\System\zGINbWf.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\GRdrEIy.exe
  C:\Windows\System\GRdrEIy.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\dolkQDd.exe
  C:\Windows\System\dolkQDd.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\iZjpBkP.exe
  C:\Windows\System\iZjpBkP.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\FXTNIQO.exe
  C:\Windows\System\FXTNIQO.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\QGlraLV.exe
  C:\Windows\System\QGlraLV.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\uQnrfRM.exe
  C:\Windows\System\uQnrfRM.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\IOVhKmp.exe
  C:\Windows\System\IOVhKmp.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\bRfYYDJ.exe
  C:\Windows\System\bRfYYDJ.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\dKQbMnp.exe
  C:\Windows\System\dKQbMnp.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\gageTud.exe
  C:\Windows\System\gageTud.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\xLFhtcQ.exe
  C:\Windows\System\xLFhtcQ.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\tdIlmRG.exe
  C:\Windows\System\tdIlmRG.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\CxFeKrm.exe
  C:\Windows\System\CxFeKrm.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\fpnDUri.exe
  C:\Windows\System\fpnDUri.exe
  2⤵
  PID:3588
- C:\Windows\System\wOFOnst.exe
  C:\Windows\System\wOFOnst.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\IdUBaLe.exe
  C:\Windows\System\IdUBaLe.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\NIhFowa.exe
  C:\Windows\System\NIhFowa.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\oqucjeU.exe
  C:\Windows\System\oqucjeU.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\DqGmYXl.exe
  C:\Windows\System\DqGmYXl.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\EfeAIMI.exe
  C:\Windows\System\EfeAIMI.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\rGrxXtL.exe
  C:\Windows\System\rGrxXtL.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\eUdApBQ.exe
  C:\Windows\System\eUdApBQ.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\wMnDzsW.exe
  C:\Windows\System\wMnDzsW.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\gGIoYRr.exe
  C:\Windows\System\gGIoYRr.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\MbEmfSk.exe
  C:\Windows\System\MbEmfSk.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\ZLOBODA.exe
  C:\Windows\System\ZLOBODA.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\QmGnpGv.exe
  C:\Windows\System\QmGnpGv.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\tikqfIh.exe
  C:\Windows\System\tikqfIh.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\ndIVpvL.exe
  C:\Windows\System\ndIVpvL.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\FyIMAtv.exe
  C:\Windows\System\FyIMAtv.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\jitKiQT.exe
  C:\Windows\System\jitKiQT.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\bYGSLpN.exe
  C:\Windows\System\bYGSLpN.exe
  2⤵
  PID:1900
- C:\Windows\System\aYwUmBH.exe
  C:\Windows\System\aYwUmBH.exe
  2⤵
  PID:4216
- C:\Windows\System\KcGLkGU.exe
  C:\Windows\System\KcGLkGU.exe
  2⤵
  PID:2368
- C:\Windows\System\QNYpbFQ.exe
  C:\Windows\System\QNYpbFQ.exe
  2⤵
  PID:4836
- C:\Windows\System\QznnwnD.exe
  C:\Windows\System\QznnwnD.exe
  2⤵
  PID:3744
- C:\Windows\System\YzAiMjV.exe
  C:\Windows\System\YzAiMjV.exe
  2⤵
  PID:760
- C:\Windows\System\EEgWiiS.exe
  C:\Windows\System\EEgWiiS.exe
  2⤵
  PID:1216
- C:\Windows\System\NdPCsfW.exe
  C:\Windows\System\NdPCsfW.exe
  2⤵
  PID:1072
- C:\Windows\System\kFEUUXZ.exe
  C:\Windows\System\kFEUUXZ.exe
  2⤵
  PID:2360
- C:\Windows\System\irIFasb.exe
  C:\Windows\System\irIFasb.exe
  2⤵
  PID:2780
- C:\Windows\System\RklMEWZ.exe
  C:\Windows\System\RklMEWZ.exe
  2⤵
  PID:4712
- C:\Windows\System\OqROkPI.exe
  C:\Windows\System\OqROkPI.exe
  2⤵
  PID:3172
- C:\Windows\System\ySuLMsc.exe
  C:\Windows\System\ySuLMsc.exe
  2⤵
  PID:1976
- C:\Windows\System\NMlaAAS.exe
  C:\Windows\System\NMlaAAS.exe
  2⤵
  PID:4364
- C:\Windows\System\eFnhAaa.exe
  C:\Windows\System\eFnhAaa.exe
  2⤵
  PID:4324
- C:\Windows\System\wQCYtES.exe
  C:\Windows\System\wQCYtES.exe
  2⤵
  PID:2064
- C:\Windows\System\WJRURWv.exe
  C:\Windows\System\WJRURWv.exe
  2⤵
  PID:2504
- C:\Windows\System\ntkseEP.exe
  C:\Windows\System\ntkseEP.exe
  2⤵
  PID:2612
- C:\Windows\System\xoATQbo.exe
  C:\Windows\System\xoATQbo.exe
  2⤵
  PID:5128
- C:\Windows\System\UPgnmiH.exe
  C:\Windows\System\UPgnmiH.exe
  2⤵
  PID:5148
- C:\Windows\System\iDhJVUg.exe
  C:\Windows\System\iDhJVUg.exe
  2⤵
  PID:5184
- C:\Windows\System\gYjnUym.exe
  C:\Windows\System\gYjnUym.exe
  2⤵
  PID:5200
- C:\Windows\System\kWqNaNO.exe
  C:\Windows\System\kWqNaNO.exe
  2⤵
  PID:5220
- C:\Windows\System\BFBlXcf.exe
  C:\Windows\System\BFBlXcf.exe
  2⤵
  PID:5252
- C:\Windows\System\buxcHnv.exe
  C:\Windows\System\buxcHnv.exe
  2⤵
  PID:5276
- C:\Windows\System\fIMwxde.exe
  C:\Windows\System\fIMwxde.exe
  2⤵
  PID:5292
- C:\Windows\System\WgiosAQ.exe
  C:\Windows\System\WgiosAQ.exe
  2⤵
  PID:5308
- C:\Windows\System\SGhpssz.exe
  C:\Windows\System\SGhpssz.exe
  2⤵
  PID:5328
- C:\Windows\System\zrwrlRV.exe
  C:\Windows\System\zrwrlRV.exe
  2⤵
  PID:5356
- C:\Windows\System\BvDfMGn.exe
  C:\Windows\System\BvDfMGn.exe
  2⤵
  PID:5376
- C:\Windows\System\OfgjIbZ.exe
  C:\Windows\System\OfgjIbZ.exe
  2⤵
  PID:5400
- C:\Windows\System\DlajKak.exe
  C:\Windows\System\DlajKak.exe
  2⤵
  PID:5424
- C:\Windows\System\iLbfSMn.exe
  C:\Windows\System\iLbfSMn.exe
  2⤵
  PID:5440
- C:\Windows\System\lDXpQhc.exe
  C:\Windows\System\lDXpQhc.exe
  2⤵
  PID:5460
- C:\Windows\System\uWLnWcr.exe
  C:\Windows\System\uWLnWcr.exe
  2⤵
  PID:5476
- C:\Windows\System\MpjXOEE.exe
  C:\Windows\System\MpjXOEE.exe
  2⤵
  PID:5492
- C:\Windows\System\WBaToBs.exe
  C:\Windows\System\WBaToBs.exe
  2⤵
  PID:5512
- C:\Windows\System\MRBFXtF.exe
  C:\Windows\System\MRBFXtF.exe
  2⤵
  PID:5540
- C:\Windows\System\CLoYGET.exe
  C:\Windows\System\CLoYGET.exe
  2⤵
  PID:5564
- C:\Windows\System\mJCZmIz.exe
  C:\Windows\System\mJCZmIz.exe
  2⤵
  PID:5584
- C:\Windows\System\FGmpEKn.exe
  C:\Windows\System\FGmpEKn.exe
  2⤵
  PID:5616
- C:\Windows\System\obXfmow.exe
  C:\Windows\System\obXfmow.exe
  2⤵
  PID:5640
- C:\Windows\System\UjDYZiz.exe
  C:\Windows\System\UjDYZiz.exe
  2⤵
  PID:5660
- C:\Windows\System\lVtrzUZ.exe
  C:\Windows\System\lVtrzUZ.exe
  2⤵
  PID:5680
- C:\Windows\System\eBVlfFm.exe
  C:\Windows\System\eBVlfFm.exe
  2⤵
  PID:5708
- C:\Windows\System\xOCxXIk.exe
  C:\Windows\System\xOCxXIk.exe
  2⤵
  PID:5728
- C:\Windows\System\tafYrlQ.exe
  C:\Windows\System\tafYrlQ.exe
  2⤵
  PID:5788
- C:\Windows\System\ApMZUaJ.exe
  C:\Windows\System\ApMZUaJ.exe
  2⤵
  PID:5804
- C:\Windows\System\jfolBVT.exe
  C:\Windows\System\jfolBVT.exe
  2⤵
  PID:5828
- C:\Windows\System\mIWaihL.exe
  C:\Windows\System\mIWaihL.exe
  2⤵
  PID:5852
- C:\Windows\System\nhndCOZ.exe
  C:\Windows\System\nhndCOZ.exe
  2⤵
  PID:5876
- C:\Windows\System\ohWgsGb.exe
  C:\Windows\System\ohWgsGb.exe
  2⤵
  PID:5896
- C:\Windows\System\xXqNfeL.exe
  C:\Windows\System\xXqNfeL.exe
  2⤵
  PID:5916
- C:\Windows\System\URsrNly.exe
  C:\Windows\System\URsrNly.exe
  2⤵
  PID:5948
- C:\Windows\System\KIDDngt.exe
  C:\Windows\System\KIDDngt.exe
  2⤵
  PID:5964
- C:\Windows\System\vHmzIXO.exe
  C:\Windows\System\vHmzIXO.exe
  2⤵
  PID:5988
- C:\Windows\System\jKYLpOk.exe
  C:\Windows\System\jKYLpOk.exe
  2⤵
  PID:6008
- C:\Windows\System\ZGMwzYB.exe
  C:\Windows\System\ZGMwzYB.exe
  2⤵
  PID:6024
- C:\Windows\System\ZgazpeN.exe
  C:\Windows\System\ZgazpeN.exe
  2⤵
  PID:6048
- C:\Windows\System\ERSTAeG.exe
  C:\Windows\System\ERSTAeG.exe
  2⤵
  PID:6068
- C:\Windows\System\StOWZSU.exe
  C:\Windows\System\StOWZSU.exe
  2⤵
  PID:6096
- C:\Windows\System\FABrisW.exe
  C:\Windows\System\FABrisW.exe
  2⤵
  PID:6112
- C:\Windows\System\FrzhiWi.exe
  C:\Windows\System\FrzhiWi.exe
  2⤵
  PID:468
- C:\Windows\System\FJracRG.exe
  C:\Windows\System\FJracRG.exe
  2⤵
  PID:3188
- C:\Windows\System\YVlpJdN.exe
  C:\Windows\System\YVlpJdN.exe
  2⤵
  PID:4820
- C:\Windows\System\DFiTdyd.exe
  C:\Windows\System\DFiTdyd.exe
  2⤵
  PID:3288
- C:\Windows\System\UhwCjLm.exe
  C:\Windows\System\UhwCjLm.exe
  2⤵
  PID:4616
- C:\Windows\System\xDZtAxk.exe
  C:\Windows\System\xDZtAxk.exe
  2⤵
  PID:4948
- C:\Windows\System\vtRRZMd.exe
  C:\Windows\System\vtRRZMd.exe
  2⤵
  PID:180
- C:\Windows\System\WwcVsfI.exe
  C:\Windows\System\WwcVsfI.exe
  2⤵
  PID:3732
- C:\Windows\System\avBfbuf.exe
  C:\Windows\System\avBfbuf.exe
  2⤵
  PID:3384
- C:\Windows\System\JxWLXGS.exe
  C:\Windows\System\JxWLXGS.exe
  2⤵
  PID:1712
- C:\Windows\System\qwIrARn.exe
  C:\Windows\System\qwIrARn.exe
  2⤵
  PID:3888
- C:\Windows\System\VeVEdFw.exe
  C:\Windows\System\VeVEdFw.exe
  2⤵
  PID:5532
- C:\Windows\System\LygUhVd.exe
  C:\Windows\System\LygUhVd.exe
  2⤵
  PID:4008
- C:\Windows\System\kwsRpka.exe
  C:\Windows\System\kwsRpka.exe
  2⤵
  PID:500
- C:\Windows\System\tvwNVbe.exe
  C:\Windows\System\tvwNVbe.exe
  2⤵
  PID:5700
- C:\Windows\System\YfANDtM.exe
  C:\Windows\System\YfANDtM.exe
  2⤵
  PID:5736
- C:\Windows\System\kYgAPrU.exe
  C:\Windows\System\kYgAPrU.exe
  2⤵
  PID:3476
- C:\Windows\System\dxErrnK.exe
  C:\Windows\System\dxErrnK.exe
  2⤵
  PID:2724
- C:\Windows\System\OTRInch.exe
  C:\Windows\System\OTRInch.exe
  2⤵
  PID:1448
- C:\Windows\System\mqtOXHl.exe
  C:\Windows\System\mqtOXHl.exe
  2⤵
  PID:5816
- C:\Windows\System\leDrJHF.exe
  C:\Windows\System\leDrJHF.exe
  2⤵
  PID:1908
- C:\Windows\System\HllLfAk.exe
  C:\Windows\System\HllLfAk.exe
  2⤵
  PID:5996
- C:\Windows\System\ELAdeew.exe
  C:\Windows\System\ELAdeew.exe
  2⤵
  PID:5676
- C:\Windows\System\fsJGRkO.exe
  C:\Windows\System\fsJGRkO.exe
  2⤵
  PID:5168
- C:\Windows\System\eiAoUVY.exe
  C:\Windows\System\eiAoUVY.exe
  2⤵
  PID:6164
- C:\Windows\System\lJJKaBh.exe
  C:\Windows\System\lJJKaBh.exe
  2⤵
  PID:6284
- C:\Windows\System\FAzpBSA.exe
  C:\Windows\System\FAzpBSA.exe
  2⤵
  PID:6352
- C:\Windows\System\aSOdhCa.exe
  C:\Windows\System\aSOdhCa.exe
  2⤵
  PID:6372
- C:\Windows\System\MirwOZy.exe
  C:\Windows\System\MirwOZy.exe
  2⤵
  PID:6388
- C:\Windows\System\LuNSJVj.exe
  C:\Windows\System\LuNSJVj.exe
  2⤵
  PID:6404
- C:\Windows\System\bkDpGKG.exe
  C:\Windows\System\bkDpGKG.exe
  2⤵
  PID:6420
- C:\Windows\System\rWrIKvF.exe
  C:\Windows\System\rWrIKvF.exe
  2⤵
  PID:6436
- C:\Windows\System\SSFfCvn.exe
  C:\Windows\System\SSFfCvn.exe
  2⤵
  PID:6456
- C:\Windows\System\NbjfSEH.exe
  C:\Windows\System\NbjfSEH.exe
  2⤵
  PID:6472
- C:\Windows\System\IQaaeAg.exe
  C:\Windows\System\IQaaeAg.exe
  2⤵
  PID:6500
- C:\Windows\System\wYxABnj.exe
  C:\Windows\System\wYxABnj.exe
  2⤵
  PID:6632
- C:\Windows\System\hmPOXGQ.exe
  C:\Windows\System\hmPOXGQ.exe
  2⤵
  PID:6700
- C:\Windows\System\ABKysTP.exe
  C:\Windows\System\ABKysTP.exe
  2⤵
  PID:6720
- C:\Windows\System\lZPkmCu.exe
  C:\Windows\System\lZPkmCu.exe
  2⤵
  PID:6736
- C:\Windows\System\lneiDTd.exe
  C:\Windows\System\lneiDTd.exe
  2⤵
  PID:6752
- C:\Windows\System\dmQypZY.exe
  C:\Windows\System\dmQypZY.exe
  2⤵
  PID:6776
- C:\Windows\System\wfdkohZ.exe
  C:\Windows\System\wfdkohZ.exe
  2⤵
  PID:6800
- C:\Windows\System\CcYOxQs.exe
  C:\Windows\System\CcYOxQs.exe
  2⤵
  PID:6816
- C:\Windows\System\bACoBfI.exe
  C:\Windows\System\bACoBfI.exe
  2⤵
  PID:6844
- C:\Windows\System\MWgSCrC.exe
  C:\Windows\System\MWgSCrC.exe
  2⤵
  PID:6868
- C:\Windows\System\NYAffHI.exe
  C:\Windows\System\NYAffHI.exe
  2⤵
  PID:6904
- C:\Windows\System\IrQUuZv.exe
  C:\Windows\System\IrQUuZv.exe
  2⤵
  PID:6928
- C:\Windows\System\UwkTPcx.exe
  C:\Windows\System\UwkTPcx.exe
  2⤵
  PID:6960
- C:\Windows\System\yLCinFQ.exe
  C:\Windows\System\yLCinFQ.exe
  2⤵
  PID:6988
- C:\Windows\System\CldsjBo.exe
  C:\Windows\System\CldsjBo.exe
  2⤵
  PID:7012
- C:\Windows\System\xBjdRsF.exe
  C:\Windows\System\xBjdRsF.exe
  2⤵
  PID:7036
- C:\Windows\System\qRzhdle.exe
  C:\Windows\System\qRzhdle.exe
  2⤵
  PID:7060
- C:\Windows\System\SiRIhWa.exe
  C:\Windows\System\SiRIhWa.exe
  2⤵
  PID:7080
- C:\Windows\System\PFRMtvm.exe
  C:\Windows\System\PFRMtvm.exe
  2⤵
  PID:7104
- C:\Windows\System\LujtxQK.exe
  C:\Windows\System\LujtxQK.exe
  2⤵
  PID:7132
- C:\Windows\System\JaXcNNU.exe
  C:\Windows\System\JaXcNNU.exe
  2⤵
  PID:7160
- C:\Windows\System\UoZuHVL.exe
  C:\Windows\System\UoZuHVL.exe
  2⤵
  PID:5236
- C:\Windows\System\tXmZHrS.exe
  C:\Windows\System\tXmZHrS.exe
  2⤵
  PID:5284
- C:\Windows\System\ctQfXIz.exe
  C:\Windows\System\ctQfXIz.exe
  2⤵
  PID:5320
- C:\Windows\System\gqdQzYk.exe
  C:\Windows\System\gqdQzYk.exe
  2⤵
  PID:5416
- C:\Windows\System\xuUMrdB.exe
  C:\Windows\System\xuUMrdB.exe
  2⤵
  PID:5456
- C:\Windows\System\TBekfoi.exe
  C:\Windows\System\TBekfoi.exe
  2⤵
  PID:5520
- C:\Windows\System\cDmVJIq.exe
  C:\Windows\System\cDmVJIq.exe
  2⤵
  PID:5624
- C:\Windows\System\DdoYhuk.exe
  C:\Windows\System\DdoYhuk.exe
  2⤵
  PID:5636
- C:\Windows\System\tMeHZdH.exe
  C:\Windows\System\tMeHZdH.exe
  2⤵
  PID:5800
- C:\Windows\System\YaSdRqI.exe
  C:\Windows\System\YaSdRqI.exe
  2⤵
  PID:5888
- C:\Windows\System\DOPkzur.exe
  C:\Windows\System\DOPkzur.exe
  2⤵
  PID:5904
- C:\Windows\System\fjIucmC.exe
  C:\Windows\System\fjIucmC.exe
  2⤵
  PID:2980
- C:\Windows\System\PdvEJID.exe
  C:\Windows\System\PdvEJID.exe
  2⤵
  PID:6152
- C:\Windows\System\AhmSfOl.exe
  C:\Windows\System\AhmSfOl.exe
  2⤵
  PID:6276
- C:\Windows\System\ZspSNZD.exe
  C:\Windows\System\ZspSNZD.exe
  2⤵
  PID:5112
- C:\Windows\System\FvuoPPp.exe
  C:\Windows\System\FvuoPPp.exe
  2⤵
  PID:3468
- C:\Windows\System\muRuxRt.exe
  C:\Windows\System\muRuxRt.exe
  2⤵
  PID:1496
- C:\Windows\System\SvqnVSy.exe
  C:\Windows\System\SvqnVSy.exe
  2⤵
  PID:5500
- C:\Windows\System\ykQzRKy.exe
  C:\Windows\System\ykQzRKy.exe
  2⤵
  PID:3216
- C:\Windows\System\CFdMUDP.exe
  C:\Windows\System\CFdMUDP.exe
  2⤵
  PID:4620
- C:\Windows\System\SGKoJNh.exe
  C:\Windows\System\SGKoJNh.exe
  2⤵
  PID:3680
- C:\Windows\System\ITDODMG.exe
  C:\Windows\System\ITDODMG.exe
  2⤵
  PID:3752
- C:\Windows\System\RGImEhA.exe
  C:\Windows\System\RGImEhA.exe
  2⤵
  PID:6176
- C:\Windows\System\AhBGcBp.exe
  C:\Windows\System\AhBGcBp.exe
  2⤵
  PID:6344
- C:\Windows\System\AfZFDne.exe
  C:\Windows\System\AfZFDne.exe
  2⤵
  PID:6428
- C:\Windows\System\mVIlEpJ.exe
  C:\Windows\System\mVIlEpJ.exe
  2⤵
  PID:6660
- C:\Windows\System\NlQJNhQ.exe
  C:\Windows\System\NlQJNhQ.exe
  2⤵
  PID:7172
- C:\Windows\System\jyiBgkV.exe
  C:\Windows\System\jyiBgkV.exe
  2⤵
  PID:7192
- C:\Windows\System\AGlyhXR.exe
  C:\Windows\System\AGlyhXR.exe
  2⤵
  PID:7212
- C:\Windows\System\CnuNoJa.exe
  C:\Windows\System\CnuNoJa.exe
  2⤵
  PID:7232
- C:\Windows\System\eZoxdYb.exe
  C:\Windows\System\eZoxdYb.exe
  2⤵
  PID:7256
- C:\Windows\System\KXRcsPG.exe
  C:\Windows\System\KXRcsPG.exe
  2⤵
  PID:7300
- C:\Windows\System\VKRcZzj.exe
  C:\Windows\System\VKRcZzj.exe
  2⤵
  PID:7348
- C:\Windows\System\yqyqdXa.exe
  C:\Windows\System\yqyqdXa.exe
  2⤵
  PID:7376
- C:\Windows\System\lhVwzrF.exe
  C:\Windows\System\lhVwzrF.exe
  2⤵
  PID:7400
- C:\Windows\System\NzobWxE.exe
  C:\Windows\System\NzobWxE.exe
  2⤵
  PID:7428
- C:\Windows\System\exWPbeh.exe
  C:\Windows\System\exWPbeh.exe
  2⤵
  PID:7444
- C:\Windows\System\AFQAjUQ.exe
  C:\Windows\System\AFQAjUQ.exe
  2⤵
  PID:7460
- C:\Windows\System\nbYRGmi.exe
  C:\Windows\System\nbYRGmi.exe
  2⤵
  PID:7512
- C:\Windows\System\qqsVbAD.exe
  C:\Windows\System\qqsVbAD.exe
  2⤵
  PID:7528
- C:\Windows\System\htKzBJC.exe
  C:\Windows\System\htKzBJC.exe
  2⤵
  PID:7544
- C:\Windows\System\wvROQxp.exe
  C:\Windows\System\wvROQxp.exe
  2⤵
  PID:7560
- C:\Windows\System\tVwzDuq.exe
  C:\Windows\System\tVwzDuq.exe
  2⤵
  PID:7580
- C:\Windows\System\tWelSvY.exe
  C:\Windows\System\tWelSvY.exe
  2⤵
  PID:7600
- C:\Windows\System\klxIWTu.exe
  C:\Windows\System\klxIWTu.exe
  2⤵
  PID:7620
- C:\Windows\System\zIVWror.exe
  C:\Windows\System\zIVWror.exe
  2⤵
  PID:7640
- C:\Windows\System\oEBVSwU.exe
  C:\Windows\System\oEBVSwU.exe
  2⤵
  PID:7660
- C:\Windows\System\fTVCxWt.exe
  C:\Windows\System\fTVCxWt.exe
  2⤵
  PID:7688
- C:\Windows\System\zdwVxZz.exe
  C:\Windows\System\zdwVxZz.exe
  2⤵
  PID:7712
- C:\Windows\System\LCethTv.exe
  C:\Windows\System\LCethTv.exe
  2⤵
  PID:7736
- C:\Windows\System\NtVpCEm.exe
  C:\Windows\System\NtVpCEm.exe
  2⤵
  PID:7776
- C:\Windows\System\gGECdta.exe
  C:\Windows\System\gGECdta.exe
  2⤵
  PID:7792
- C:\Windows\System\preaGRw.exe
  C:\Windows\System\preaGRw.exe
  2⤵
  PID:7808
- C:\Windows\System\byOUzDU.exe
  C:\Windows\System\byOUzDU.exe
  2⤵
  PID:7824
- C:\Windows\System\yIgOZGz.exe
  C:\Windows\System\yIgOZGz.exe
  2⤵
  PID:7840
- C:\Windows\System\klcZuBy.exe
  C:\Windows\System\klcZuBy.exe
  2⤵
  PID:7856
- C:\Windows\System\dsVtPwm.exe
  C:\Windows\System\dsVtPwm.exe
  2⤵
  PID:7872
- C:\Windows\System\XQPlJvw.exe
  C:\Windows\System\XQPlJvw.exe
  2⤵
  PID:7888
- C:\Windows\System\uzjrKGZ.exe
  C:\Windows\System\uzjrKGZ.exe
  2⤵
  PID:7908
- C:\Windows\System\tyXMwfS.exe
  C:\Windows\System\tyXMwfS.exe
  2⤵
  PID:7932
- C:\Windows\System\jBCHija.exe
  C:\Windows\System\jBCHija.exe
  2⤵
  PID:7948
- C:\Windows\System\IlQIDWH.exe
  C:\Windows\System\IlQIDWH.exe
  2⤵
  PID:7972
- C:\Windows\System\JzKkKeB.exe
  C:\Windows\System\JzKkKeB.exe
  2⤵
  PID:7996
- C:\Windows\System\HSDcbld.exe
  C:\Windows\System\HSDcbld.exe
  2⤵
  PID:8016
- C:\Windows\System\ZIeGLMU.exe
  C:\Windows\System\ZIeGLMU.exe
  2⤵
  PID:8040
- C:\Windows\System\cyNjMGh.exe
  C:\Windows\System\cyNjMGh.exe
  2⤵
  PID:8056
- C:\Windows\System\gMQQVIT.exe
  C:\Windows\System\gMQQVIT.exe
  2⤵
  PID:8080
- C:\Windows\System\pZZoEGd.exe
  C:\Windows\System\pZZoEGd.exe
  2⤵
  PID:8104
- C:\Windows\System\mDglDMx.exe
  C:\Windows\System\mDglDMx.exe
  2⤵
  PID:8128
- C:\Windows\System\FYpOjMc.exe
  C:\Windows\System\FYpOjMc.exe
  2⤵
  PID:8148
- C:\Windows\System\zTYfcPs.exe
  C:\Windows\System\zTYfcPs.exe
  2⤵
  PID:8172
- C:\Windows\System\ONkMgfC.exe
  C:\Windows\System\ONkMgfC.exe
  2⤵
  PID:6692
- C:\Windows\System\XxVbsmN.exe
  C:\Windows\System\XxVbsmN.exe
  2⤵
  PID:6732
- C:\Windows\System\ztLoVsy.exe
  C:\Windows\System\ztLoVsy.exe
  2⤵
  PID:7004
- C:\Windows\System\qnBBuZW.exe
  C:\Windows\System\qnBBuZW.exe
  2⤵
  PID:5368
- C:\Windows\System\JhNzUPM.exe
  C:\Windows\System\JhNzUPM.exe
  2⤵
  PID:5600
- C:\Windows\System\qaDSiuI.exe
  C:\Windows\System\qaDSiuI.exe
  2⤵
  PID:5772
- C:\Windows\System\LnvhNKp.exe
  C:\Windows\System\LnvhNKp.exe
  2⤵
  PID:5908
- C:\Windows\System\pBSlTiN.exe
  C:\Windows\System\pBSlTiN.exe
  2⤵
  PID:6768
- C:\Windows\System\FkCmUPb.exe
  C:\Windows\System\FkCmUPb.exe
  2⤵
  PID:6348
- C:\Windows\System\UONmnik.exe
  C:\Windows\System\UONmnik.exe
  2⤵
  PID:6468
- C:\Windows\System\YvLHdpd.exe
  C:\Windows\System\YvLHdpd.exe
  2⤵
  PID:6656
- C:\Windows\System\xjjlHND.exe
  C:\Windows\System\xjjlHND.exe
  2⤵
  PID:6688
- C:\Windows\System\PRREUgw.exe
  C:\Windows\System\PRREUgw.exe
  2⤵
  PID:6856
- C:\Windows\System\dQtawUR.exe
  C:\Windows\System\dQtawUR.exe
  2⤵
  PID:6916
- C:\Windows\System\PWlvpWH.exe
  C:\Windows\System\PWlvpWH.exe
  2⤵
  PID:6956
- C:\Windows\System\mMBKhMO.exe
  C:\Windows\System\mMBKhMO.exe
  2⤵
  PID:7100
- C:\Windows\System\khAzwOt.exe
  C:\Windows\System\khAzwOt.exe
  2⤵
  PID:7152
- C:\Windows\System\vCmeMJT.exe
  C:\Windows\System\vCmeMJT.exe
  2⤵
  PID:5300
- C:\Windows\System\NjJeDTQ.exe
  C:\Windows\System\NjJeDTQ.exe
  2⤵
  PID:7508
- C:\Windows\System\TnfzwEZ.exe
  C:\Windows\System\TnfzwEZ.exe
  2⤵
  PID:7596
- C:\Windows\System\nnqymTa.exe
  C:\Windows\System\nnqymTa.exe
  2⤵
  PID:8204
- C:\Windows\System\dEIorMt.exe
  C:\Windows\System\dEIorMt.exe
  2⤵
  PID:8220
- C:\Windows\System\ORiwmnR.exe
  C:\Windows\System\ORiwmnR.exe
  2⤵
  PID:8244
- C:\Windows\System\IRlbbOh.exe
  C:\Windows\System\IRlbbOh.exe
  2⤵
  PID:8268
- C:\Windows\System\ajmauRd.exe
  C:\Windows\System\ajmauRd.exe
  2⤵
  PID:8296
- C:\Windows\System\YzSVADs.exe
  C:\Windows\System\YzSVADs.exe
  2⤵
  PID:8316
- C:\Windows\System\sGRZSZg.exe
  C:\Windows\System\sGRZSZg.exe
  2⤵
  PID:8336
- C:\Windows\System\xSqjGHl.exe
  C:\Windows\System\xSqjGHl.exe
  2⤵
  PID:8364
- C:\Windows\System\GheebOX.exe
  C:\Windows\System\GheebOX.exe
  2⤵
  PID:8384
- C:\Windows\System\eHvxWDe.exe
  C:\Windows\System\eHvxWDe.exe
  2⤵
  PID:8408
- C:\Windows\System\DhIyhhO.exe
  C:\Windows\System\DhIyhhO.exe
  2⤵
  PID:8432
- C:\Windows\System\QEDpEvR.exe
  C:\Windows\System\QEDpEvR.exe
  2⤵
  PID:8512
- C:\Windows\System\FZTgbiY.exe
  C:\Windows\System\FZTgbiY.exe
  2⤵
  PID:8552
- C:\Windows\System\TUXFxZP.exe
  C:\Windows\System\TUXFxZP.exe
  2⤵
  PID:8576
- C:\Windows\System\QZMPlzn.exe
  C:\Windows\System\QZMPlzn.exe
  2⤵
  PID:8596
- C:\Windows\System\tiekkfL.exe
  C:\Windows\System\tiekkfL.exe
  2⤵
  PID:8620
- C:\Windows\System\cgzaIeP.exe
  C:\Windows\System\cgzaIeP.exe
  2⤵
  PID:8656
- C:\Windows\System\zGJKotL.exe
  C:\Windows\System\zGJKotL.exe
  2⤵
  PID:8692
- C:\Windows\System\sEDjaCF.exe
  C:\Windows\System\sEDjaCF.exe
  2⤵
  PID:8708
- C:\Windows\System\IkWYmFu.exe
  C:\Windows\System\IkWYmFu.exe
  2⤵
  PID:8724
- C:\Windows\System\pNhmxEo.exe
  C:\Windows\System\pNhmxEo.exe
  2⤵
  PID:8740
- C:\Windows\System\LEoxePA.exe
  C:\Windows\System\LEoxePA.exe
  2⤵
  PID:8756
- C:\Windows\System\zfpiphU.exe
  C:\Windows\System\zfpiphU.exe
  2⤵
  PID:8776
- C:\Windows\System\HuyBUqi.exe
  C:\Windows\System\HuyBUqi.exe
  2⤵
  PID:8796
- C:\Windows\System\nDZihoe.exe
  C:\Windows\System\nDZihoe.exe
  2⤵
  PID:8816
- C:\Windows\System\eauGEiW.exe
  C:\Windows\System\eauGEiW.exe
  2⤵
  PID:8832
- C:\Windows\System\nVQeHae.exe
  C:\Windows\System\nVQeHae.exe
  2⤵
  PID:8852
- C:\Windows\System\tqyEWSK.exe
  C:\Windows\System\tqyEWSK.exe
  2⤵
  PID:8872
- C:\Windows\System\MItJrpX.exe
  C:\Windows\System\MItJrpX.exe
  2⤵
  PID:8892
- C:\Windows\System\ndPNYNF.exe
  C:\Windows\System\ndPNYNF.exe
  2⤵
  PID:8912
- C:\Windows\System\uxbSmiK.exe
  C:\Windows\System\uxbSmiK.exe
  2⤵
  PID:8932
- C:\Windows\System\tFSiTeX.exe
  C:\Windows\System\tFSiTeX.exe
  2⤵
  PID:8952
- C:\Windows\System\iODNUvU.exe
  C:\Windows\System\iODNUvU.exe
  2⤵
  PID:8968
- C:\Windows\System\baDVaLa.exe
  C:\Windows\System\baDVaLa.exe
  2⤵
  PID:8988
- C:\Windows\System\AZONyrZ.exe
  C:\Windows\System\AZONyrZ.exe
  2⤵
  PID:9008
- C:\Windows\System\MWKCFFD.exe
  C:\Windows\System\MWKCFFD.exe
  2⤵
  PID:9028
- C:\Windows\System\hLJXpOW.exe
  C:\Windows\System\hLJXpOW.exe
  2⤵
  PID:9048
- C:\Windows\System\JNKIYVC.exe
  C:\Windows\System\JNKIYVC.exe
  2⤵
  PID:9068
- C:\Windows\System\MvoYtyN.exe
  C:\Windows\System\MvoYtyN.exe
  2⤵
  PID:9084
- C:\Windows\System\fsXGcfx.exe
  C:\Windows\System\fsXGcfx.exe
  2⤵
  PID:9108
- C:\Windows\System\KJwGVav.exe
  C:\Windows\System\KJwGVav.exe
  2⤵
  PID:9124
- C:\Windows\System\IKNIaft.exe
  C:\Windows\System\IKNIaft.exe
  2⤵
  PID:9160
- C:\Windows\System\NsYtUnT.exe
  C:\Windows\System\NsYtUnT.exe
  2⤵
  PID:9176
- C:\Windows\System\mZkIqhC.exe
  C:\Windows\System\mZkIqhC.exe
  2⤵
  PID:9196
- C:\Windows\System\eOFLJJz.exe
  C:\Windows\System\eOFLJJz.exe
  2⤵
  PID:6108
- C:\Windows\System\YGvnENp.exe
  C:\Windows\System\YGvnENp.exe
  2⤵
  PID:5040
- C:\Windows\System\uHtpfdw.exe
  C:\Windows\System\uHtpfdw.exe
  2⤵
  PID:5696
- C:\Windows\System\qEPnNrH.exe
  C:\Windows\System\qEPnNrH.exe
  2⤵
  PID:1256
- C:\Windows\System\mLKKUrb.exe
  C:\Windows\System\mLKKUrb.exe
  2⤵
  PID:6172
- C:\Windows\System\aqpTlbB.exe
  C:\Windows\System\aqpTlbB.exe
  2⤵
  PID:6556
- C:\Windows\System\fBjtpQd.exe
  C:\Windows\System\fBjtpQd.exe
  2⤵
  PID:7204
- C:\Windows\System\NlpQbIa.exe
  C:\Windows\System\NlpQbIa.exe
  2⤵
  PID:7244
- C:\Windows\System\izrPkEQ.exe
  C:\Windows\System\izrPkEQ.exe
  2⤵
  PID:7324
- C:\Windows\System\mNpzSAV.exe
  C:\Windows\System\mNpzSAV.exe
  2⤵
  PID:7392
- C:\Windows\System\qKPpARk.exe
  C:\Windows\System\qKPpARk.exe
  2⤵
  PID:7416
- C:\Windows\System\yzCnRmW.exe
  C:\Windows\System\yzCnRmW.exe
  2⤵
  PID:7456
- C:\Windows\System\yhBepSL.exe
  C:\Windows\System\yhBepSL.exe
  2⤵
  PID:8168
- C:\Windows\System\ZtqnVDN.exe
  C:\Windows\System\ZtqnVDN.exe
  2⤵
  PID:5648
- C:\Windows\System\FVnRcRK.exe
  C:\Windows\System\FVnRcRK.exe
  2⤵
  PID:7636
- C:\Windows\System\jbQheac.exe
  C:\Windows\System\jbQheac.exe
  2⤵
  PID:6836
- C:\Windows\System\ZPYrvni.exe
  C:\Windows\System\ZPYrvni.exe
  2⤵
  PID:9244
- C:\Windows\System\YtSNNkN.exe
  C:\Windows\System\YtSNNkN.exe
  2⤵
  PID:9264
- C:\Windows\System\AHwetWH.exe
  C:\Windows\System\AHwetWH.exe
  2⤵
  PID:9280
- C:\Windows\System\ftGiDtH.exe
  C:\Windows\System\ftGiDtH.exe
  2⤵
  PID:9304
- C:\Windows\System\iYJXowV.exe
  C:\Windows\System\iYJXowV.exe
  2⤵
  PID:9328
- C:\Windows\System\CoIycJZ.exe
  C:\Windows\System\CoIycJZ.exe
  2⤵
  PID:9348
- C:\Windows\System\KDLURvW.exe
  C:\Windows\System\KDLURvW.exe
  2⤵
  PID:9364
- C:\Windows\System\XfptrBT.exe
  C:\Windows\System\XfptrBT.exe
  2⤵
  PID:9380
- C:\Windows\System\jWsuTHQ.exe
  C:\Windows\System\jWsuTHQ.exe
  2⤵
  PID:9396
- C:\Windows\System\tnmHnWD.exe
  C:\Windows\System\tnmHnWD.exe
  2⤵
  PID:9420
- C:\Windows\System\mMeXNHA.exe
  C:\Windows\System\mMeXNHA.exe
  2⤵
  PID:9440
- C:\Windows\System\PcHkJEK.exe
  C:\Windows\System\PcHkJEK.exe
  2⤵
  PID:9456
- C:\Windows\System\FyzvQRU.exe
  C:\Windows\System\FyzvQRU.exe
  2⤵
  PID:9480
- C:\Windows\System\uXpCQIM.exe
  C:\Windows\System\uXpCQIM.exe
  2⤵
  PID:9500
- C:\Windows\System\ARLOUhO.exe
  C:\Windows\System\ARLOUhO.exe
  2⤵
  PID:9520
- C:\Windows\System\VrLgZfR.exe
  C:\Windows\System\VrLgZfR.exe
  2⤵
  PID:9544
- C:\Windows\System\hJvzFwe.exe
  C:\Windows\System\hJvzFwe.exe
  2⤵
  PID:9564
- C:\Windows\System\bfrMKPm.exe
  C:\Windows\System\bfrMKPm.exe
  2⤵
  PID:9584
- C:\Windows\System\waNkhYJ.exe
  C:\Windows\System\waNkhYJ.exe
  2⤵
  PID:9604
- C:\Windows\System\bPIflBV.exe
  C:\Windows\System\bPIflBV.exe
  2⤵
  PID:9628
- C:\Windows\System\ySEdPDg.exe
  C:\Windows\System\ySEdPDg.exe
  2⤵
  PID:9652
- C:\Windows\System\vQuOZCw.exe
  C:\Windows\System\vQuOZCw.exe
  2⤵
  PID:9672
- C:\Windows\System\ERNZuzF.exe
  C:\Windows\System\ERNZuzF.exe
  2⤵
  PID:9688
- C:\Windows\System\ULPikun.exe
  C:\Windows\System\ULPikun.exe
  2⤵
  PID:9704
- C:\Windows\System\AZrsdqb.exe
  C:\Windows\System\AZrsdqb.exe
  2⤵
  PID:9728
- C:\Windows\System\eMHbPqm.exe
  C:\Windows\System\eMHbPqm.exe
  2⤵
  PID:9744
- C:\Windows\System\XjdTrXt.exe
  C:\Windows\System\XjdTrXt.exe
  2⤵
  PID:9764
- C:\Windows\System\YAnWqOP.exe
  C:\Windows\System\YAnWqOP.exe
  2⤵
  PID:9784
- C:\Windows\System\aNruWeT.exe
  C:\Windows\System\aNruWeT.exe
  2⤵
  PID:9804
- C:\Windows\System\AMQRpnb.exe
  C:\Windows\System\AMQRpnb.exe
  2⤵
  PID:9820
- C:\Windows\System\WoaRYXW.exe
  C:\Windows\System\WoaRYXW.exe
  2⤵
  PID:9844
- C:\Windows\System\FvGxNHi.exe
  C:\Windows\System\FvGxNHi.exe
  2⤵
  PID:9868
- C:\Windows\System\aqsBPqj.exe
  C:\Windows\System\aqsBPqj.exe
  2⤵
  PID:9892
- C:\Windows\System\QqpeCjz.exe
  C:\Windows\System\QqpeCjz.exe
  2⤵
  PID:9920
- C:\Windows\System\tcVGZgx.exe
  C:\Windows\System\tcVGZgx.exe
  2⤵
  PID:9940
- C:\Windows\System\rHoJhcq.exe
  C:\Windows\System\rHoJhcq.exe
  2⤵
  PID:9960
- C:\Windows\System\GTqDFuY.exe
  C:\Windows\System\GTqDFuY.exe
  2⤵
  PID:9980
- C:\Windows\System\pyveQEC.exe
  C:\Windows\System\pyveQEC.exe
  2⤵
  PID:10004
- C:\Windows\System\PxQABXR.exe
  C:\Windows\System\PxQABXR.exe
  2⤵
  PID:10024
- C:\Windows\System\bnUzKvF.exe
  C:\Windows\System\bnUzKvF.exe
  2⤵
  PID:10044
- C:\Windows\System\QXERpmv.exe
  C:\Windows\System\QXERpmv.exe
  2⤵
  PID:10068
- C:\Windows\System\jpCzpZx.exe
  C:\Windows\System\jpCzpZx.exe
  2⤵
  PID:10180
- C:\Windows\System\VuWwDan.exe
  C:\Windows\System\VuWwDan.exe
  2⤵
  PID:10200
- C:\Windows\System\sTStkLN.exe
  C:\Windows\System\sTStkLN.exe
  2⤵
  PID:5836
- C:\Windows\System\odERIQO.exe
  C:\Windows\System\odERIQO.exe
  2⤵
  PID:8980
- C:\Windows\System\yHwDXXY.exe
  C:\Windows\System\yHwDXXY.exe
  2⤵
  PID:9148
- C:\Windows\System\Ucjldro.exe
  C:\Windows\System\Ucjldro.exe
  2⤵
  PID:7612
- C:\Windows\System\SRRByUH.exe
  C:\Windows\System\SRRByUH.exe
  2⤵
  PID:6664
- C:\Windows\System\OOBpkPw.exe
  C:\Windows\System\OOBpkPw.exe
  2⤵
  PID:7868
- C:\Windows\System\oLRRJHO.exe
  C:\Windows\System\oLRRJHO.exe
  2⤵
  PID:9296
- C:\Windows\System\DKlecDq.exe
  C:\Windows\System\DKlecDq.exe
  2⤵
  PID:8840
- C:\Windows\System\yOFfJaq.exe
  C:\Windows\System\yOFfJaq.exe
  2⤵
  PID:8996
- C:\Windows\System\JpaFxNg.exe
  C:\Windows\System\JpaFxNg.exe
  2⤵
  PID:9040
- C:\Windows\System\fctrXtS.exe
  C:\Windows\System\fctrXtS.exe
  2⤵
  PID:9092
- C:\Windows\System\bTbdpUw.exe
  C:\Windows\System\bTbdpUw.exe
  2⤵
  PID:6808
- C:\Windows\System\VmtqLtb.exe
  C:\Windows\System\VmtqLtb.exe
  2⤵
  PID:9168
- C:\Windows\System\DQGanot.exe
  C:\Windows\System\DQGanot.exe
  2⤵
  PID:6952
- C:\Windows\System\qMkphxY.exe
  C:\Windows\System\qMkphxY.exe
  2⤵
  PID:7116
- C:\Windows\System\IeADRBW.exe
  C:\Windows\System\IeADRBW.exe
  2⤵
  PID:5488
- C:\Windows\System\yyNncha.exe
  C:\Windows\System\yyNncha.exe
  2⤵
  PID:8216
- C:\Windows\System\PMkBqXX.exe
  C:\Windows\System\PMkBqXX.exe
  2⤵
  PID:8252
- C:\Windows\System\lfEchGE.exe
  C:\Windows\System\lfEchGE.exe
  2⤵
  PID:8416
- C:\Windows\System\aglFUDC.exe
  C:\Windows\System\aglFUDC.exe
  2⤵
  PID:1328
- C:\Windows\System\dtoLoNp.exe
  C:\Windows\System\dtoLoNp.exe
  2⤵
  PID:10076
- C:\Windows\System\uUSWIUG.exe
  C:\Windows\System\uUSWIUG.exe
  2⤵
  PID:8548
- C:\Windows\System\koSJrOd.exe
  C:\Windows\System\koSJrOd.exe
  2⤵
  PID:8588
- C:\Windows\System\LpEBJhV.exe
  C:\Windows\System\LpEBJhV.exe
  2⤵
  PID:8652
- C:\Windows\System\PTczgYj.exe
  C:\Windows\System\PTczgYj.exe
  2⤵
  PID:10244
- C:\Windows\System\jlpxToW.exe
  C:\Windows\System\jlpxToW.exe
  2⤵
  PID:10264
- C:\Windows\System\gfvCIBZ.exe
  C:\Windows\System\gfvCIBZ.exe
  2⤵
  PID:10284
- C:\Windows\System\oVqNwiR.exe
  C:\Windows\System\oVqNwiR.exe
  2⤵
  PID:10308
- C:\Windows\System\PDmqijh.exe
  C:\Windows\System\PDmqijh.exe
  2⤵
  PID:10332
- C:\Windows\System\YvkGeiT.exe
  C:\Windows\System\YvkGeiT.exe
  2⤵
  PID:10352
- C:\Windows\System\pHierqH.exe
  C:\Windows\System\pHierqH.exe
  2⤵
  PID:10372
- C:\Windows\System\JYURjpB.exe
  C:\Windows\System\JYURjpB.exe
  2⤵
  PID:10396
- C:\Windows\System\HRjapcs.exe
  C:\Windows\System\HRjapcs.exe
  2⤵
  PID:10420
- C:\Windows\System\TQtYvvC.exe
  C:\Windows\System\TQtYvvC.exe
  2⤵
  PID:10436
- C:\Windows\System\KJYaZSF.exe
  C:\Windows\System\KJYaZSF.exe
  2⤵
  PID:10460
- C:\Windows\System\AttjAKQ.exe
  C:\Windows\System\AttjAKQ.exe
  2⤵
  PID:10484
- C:\Windows\System\vItelko.exe
  C:\Windows\System\vItelko.exe
  2⤵
  PID:10500
- C:\Windows\System\VcONWyu.exe
  C:\Windows\System\VcONWyu.exe
  2⤵
  PID:10524
- C:\Windows\System\iWagTgC.exe
  C:\Windows\System\iWagTgC.exe
  2⤵
  PID:10556
- C:\Windows\System\oMYwvGe.exe
  C:\Windows\System\oMYwvGe.exe
  2⤵
  PID:10588
- C:\Windows\System\XFNzUig.exe
  C:\Windows\System\XFNzUig.exe
  2⤵
  PID:10612
- C:\Windows\System\rwYNeNy.exe
  C:\Windows\System\rwYNeNy.exe
  2⤵
  PID:10640
- C:\Windows\System\YFcBkIA.exe
  C:\Windows\System\YFcBkIA.exe
  2⤵
  PID:10660
- C:\Windows\System\zdblmCq.exe
  C:\Windows\System\zdblmCq.exe
  2⤵
  PID:10684
- C:\Windows\System\lISEIsb.exe
  C:\Windows\System\lISEIsb.exe
  2⤵
  PID:10712
- C:\Windows\System\zEraPJd.exe
  C:\Windows\System\zEraPJd.exe
  2⤵
  PID:10732
- C:\Windows\System\nTaFlkJ.exe
  C:\Windows\System\nTaFlkJ.exe
  2⤵
  PID:10748
- C:\Windows\System\YsTWApF.exe
  C:\Windows\System\YsTWApF.exe
  2⤵
  PID:10764
- C:\Windows\System\rlAIucu.exe
  C:\Windows\System\rlAIucu.exe
  2⤵
  PID:10780
- C:\Windows\System\KLIEEGS.exe
  C:\Windows\System\KLIEEGS.exe
  2⤵
  PID:10796
- C:\Windows\System\LPrzUBg.exe
  C:\Windows\System\LPrzUBg.exe
  2⤵
  PID:10812
- C:\Windows\System\cTUteuv.exe
  C:\Windows\System\cTUteuv.exe
  2⤵
  PID:10828
- C:\Windows\System\JKjIXoV.exe
  C:\Windows\System\JKjIXoV.exe
  2⤵
  PID:10844
- C:\Windows\System\LNhrmna.exe
  C:\Windows\System\LNhrmna.exe
  2⤵
  PID:10860
- C:\Windows\System\EnHBgkp.exe
  C:\Windows\System\EnHBgkp.exe
  2⤵
  PID:10876
- C:\Windows\System\ZJgELzb.exe
  C:\Windows\System\ZJgELzb.exe
  2⤵
  PID:10896
- C:\Windows\System\rSmLPYL.exe
  C:\Windows\System\rSmLPYL.exe
  2⤵
  PID:10912
- C:\Windows\System\INhaKmO.exe
  C:\Windows\System\INhaKmO.exe
  2⤵
  PID:10928
- C:\Windows\System\LXMONZR.exe
  C:\Windows\System\LXMONZR.exe
  2⤵
  PID:10944
- C:\Windows\System\EiyXEMb.exe
  C:\Windows\System\EiyXEMb.exe
  2⤵
  PID:10968
- C:\Windows\System\HuYgHSv.exe
  C:\Windows\System\HuYgHSv.exe
  2⤵
  PID:11020
- C:\Windows\System\bBxmLDX.exe
  C:\Windows\System\bBxmLDX.exe
  2⤵
  PID:11040
- C:\Windows\System\YGmqPOu.exe
  C:\Windows\System\YGmqPOu.exe
  2⤵
  PID:11056
- C:\Windows\System\yrZbtKS.exe
  C:\Windows\System\yrZbtKS.exe
  2⤵
  PID:11084
- C:\Windows\System\gHUOcOC.exe
  C:\Windows\System\gHUOcOC.exe
  2⤵
  PID:11104
- C:\Windows\System\OMqhWNA.exe
  C:\Windows\System\OMqhWNA.exe
  2⤵
  PID:11124
- C:\Windows\System\VRZtzWL.exe
  C:\Windows\System\VRZtzWL.exe
  2⤵
  PID:11148
- C:\Windows\System\xcRXzGH.exe
  C:\Windows\System\xcRXzGH.exe
  2⤵
  PID:11168
- C:\Windows\System\OMfEZTU.exe
  C:\Windows\System\OMfEZTU.exe
  2⤵
  PID:11192
- C:\Windows\System\nMmzatN.exe
  C:\Windows\System\nMmzatN.exe
  2⤵
  PID:11216
- C:\Windows\System\mULDaiV.exe
  C:\Windows\System\mULDaiV.exe
  2⤵
  PID:11244
- C:\Windows\System\QgrRkJL.exe
  C:\Windows\System\QgrRkJL.exe
  2⤵
  PID:9320
- C:\Windows\System\MnandoT.exe
  C:\Windows\System\MnandoT.exe
  2⤵
  PID:8880
- C:\Windows\System\ILqBuZX.exe
  C:\Windows\System\ILqBuZX.exe
  2⤵
  PID:9452
- C:\Windows\System\UUXWEfe.exe
  C:\Windows\System\UUXWEfe.exe
  2⤵
  PID:10208
- C:\Windows\System\xxuXyuQ.exe
  C:\Windows\System\xxuXyuQ.exe
  2⤵
  PID:9184
- C:\Windows\System\XKDUhHc.exe
  C:\Windows\System\XKDUhHc.exe
  2⤵
  PID:7732
- C:\Windows\System\MfWKoxt.exe
  C:\Windows\System\MfWKoxt.exe
  2⤵
  PID:3724
- C:\Windows\System\xAncZgx.exe
  C:\Windows\System\xAncZgx.exe
  2⤵
  PID:2104
- C:\Windows\System\QBeEGlF.exe
  C:\Windows\System\QBeEGlF.exe
  2⤵
  PID:3532
- C:\Windows\System\daTTbOk.exe
  C:\Windows\System\daTTbOk.exe
  2⤵
  PID:6464
- C:\Windows\System\rQiGUGN.exe
  C:\Windows\System\rQiGUGN.exe
  2⤵
  PID:11276
- C:\Windows\System\isYrwqv.exe
  C:\Windows\System\isYrwqv.exe
  2⤵
  PID:11296
- C:\Windows\System\VvOqgUE.exe
  C:\Windows\System\VvOqgUE.exe
  2⤵
  PID:11316
- C:\Windows\System\sZmcGIt.exe
  C:\Windows\System\sZmcGIt.exe
  2⤵
  PID:11372
- C:\Windows\System\kKlkMVx.exe
  C:\Windows\System\kKlkMVx.exe
  2⤵
  PID:11396
- C:\Windows\System\fbRqBKP.exe
  C:\Windows\System\fbRqBKP.exe
  2⤵
  PID:11424
- C:\Windows\System\fVKDVgH.exe
  C:\Windows\System\fVKDVgH.exe
  2⤵
  PID:11448
- C:\Windows\System\EWqQsJF.exe
  C:\Windows\System\EWqQsJF.exe
  2⤵
  PID:11480
- C:\Windows\System\DOYZTVI.exe
  C:\Windows\System\DOYZTVI.exe
  2⤵
  PID:11564
- C:\Windows\System\CjneCCs.exe
  C:\Windows\System\CjneCCs.exe
  2⤵
  PID:11588
- C:\Windows\System\xrOjQPC.exe
  C:\Windows\System\xrOjQPC.exe
  2⤵
  PID:11608
- C:\Windows\System\zZAyoKK.exe
  C:\Windows\System\zZAyoKK.exe
  2⤵
  PID:11632
- C:\Windows\System\utmdoFF.exe
  C:\Windows\System\utmdoFF.exe
  2⤵
  PID:11652
- C:\Windows\System\HoWLbJx.exe
  C:\Windows\System\HoWLbJx.exe
  2⤵
  PID:11672
- C:\Windows\System\gqAlofR.exe
  C:\Windows\System\gqAlofR.exe
  2⤵
  PID:11696
- C:\Windows\System\XvMRWpQ.exe
  C:\Windows\System\XvMRWpQ.exe
  2⤵
  PID:11716
- C:\Windows\System\YGJuCCv.exe
  C:\Windows\System\YGJuCCv.exe
  2⤵
  PID:11732
- C:\Windows\System\HlWSIkK.exe
  C:\Windows\System\HlWSIkK.exe
  2⤵
  PID:11756
- C:\Windows\System\fhLJMCk.exe
  C:\Windows\System\fhLJMCk.exe
  2⤵
  PID:11772
- C:\Windows\System\CPEvvdK.exe
  C:\Windows\System\CPEvvdK.exe
  2⤵
  PID:11804
- C:\Windows\System\LFZSyIj.exe
  C:\Windows\System\LFZSyIj.exe
  2⤵
  PID:11824
- C:\Windows\System\jGOyQew.exe
  C:\Windows\System\jGOyQew.exe
  2⤵
  PID:11844
- C:\Windows\System\BppkEMD.exe
  C:\Windows\System\BppkEMD.exe
  2⤵
  PID:11868
- C:\Windows\System\neOkXBJ.exe
  C:\Windows\System\neOkXBJ.exe
  2⤵
  PID:11892
- C:\Windows\System\rmwSWeR.exe
  C:\Windows\System\rmwSWeR.exe
  2⤵
  PID:11916
- C:\Windows\System\ykJgCaI.exe
  C:\Windows\System\ykJgCaI.exe
  2⤵
  PID:11936
- C:\Windows\System\EtlZsst.exe
  C:\Windows\System\EtlZsst.exe
  2⤵
  PID:11964
- C:\Windows\System\aWzNkCI.exe
  C:\Windows\System\aWzNkCI.exe
  2⤵
  PID:11984
- C:\Windows\System\HUIuPUj.exe
  C:\Windows\System\HUIuPUj.exe
  2⤵
  PID:12004
- C:\Windows\System\bPNRjcL.exe
  C:\Windows\System\bPNRjcL.exe
  2⤵
  PID:12028
- C:\Windows\System\acKszTN.exe
  C:\Windows\System\acKszTN.exe
  2⤵
  PID:12052
- C:\Windows\System\RnAnFsH.exe
  C:\Windows\System\RnAnFsH.exe
  2⤵
  PID:12072
- C:\Windows\System\GNsXWcv.exe
  C:\Windows\System\GNsXWcv.exe
  2⤵
  PID:12088
- C:\Windows\System\iRsESuZ.exe
  C:\Windows\System\iRsESuZ.exe
  2⤵
  PID:12104
- C:\Windows\System\hKFLgki.exe
  C:\Windows\System\hKFLgki.exe
  2⤵
  PID:12132
- C:\Windows\System\uCqrkNL.exe
  C:\Windows\System\uCqrkNL.exe
  2⤵
  PID:12156
- C:\Windows\System\eSDhbQa.exe
  C:\Windows\System\eSDhbQa.exe
  2⤵
  PID:12172
- C:\Windows\System\WVQAvvt.exe
  C:\Windows\System\WVQAvvt.exe
  2⤵
  PID:12192
- C:\Windows\System\tYFSril.exe
  C:\Windows\System\tYFSril.exe
  2⤵
  PID:12220
- C:\Windows\System\aMshyzK.exe
  C:\Windows\System\aMshyzK.exe
  2⤵
  PID:12236
- C:\Windows\System\NeMmAhx.exe
  C:\Windows\System\NeMmAhx.exe
  2⤵
  PID:12256
- C:\Windows\System\NLPqEyc.exe
  C:\Windows\System\NLPqEyc.exe
  2⤵
  PID:12272
- C:\Windows\System\hqDEsMC.exe
  C:\Windows\System\hqDEsMC.exe
  2⤵
  PID:7180
- C:\Windows\System\EsqPNEU.exe
  C:\Windows\System\EsqPNEU.exe
  2⤵
  PID:7228
- C:\Windows\System\YZoblsA.exe
  C:\Windows\System\YZoblsA.exe
  2⤵
  PID:7412
- C:\Windows\System\MimjGax.exe
  C:\Windows\System\MimjGax.exe
  2⤵
  PID:7608
- C:\Windows\System\YuyJVWU.exe
  C:\Windows\System\YuyJVWU.exe
  2⤵
  PID:6900
- C:\Windows\System\PXKDZHe.exe
  C:\Windows\System\PXKDZHe.exe
  2⤵
  PID:8392
- C:\Windows\System\iktiGfH.exe
  C:\Windows\System\iktiGfH.exe
  2⤵
  PID:6788
- C:\Windows\System\lrHmmad.exe
  C:\Windows\System\lrHmmad.exe
  2⤵
  PID:6852
- C:\Windows\System\ewHGWTz.exe
  C:\Windows\System\ewHGWTz.exe
  2⤵
  PID:8236
- C:\Windows\System\LsHDTiU.exe
  C:\Windows\System\LsHDTiU.exe
  2⤵
  PID:9272
- C:\Windows\System\BUFDHvB.exe
  C:\Windows\System\BUFDHvB.exe
  2⤵
  PID:8572
- C:\Windows\System\qiUHksS.exe
  C:\Windows\System\qiUHksS.exe
  2⤵
  PID:10344
- C:\Windows\System\VASsOrj.exe
  C:\Windows\System\VASsOrj.exe
  2⤵
  PID:9372
- C:\Windows\System\QJaUTsR.exe
  C:\Windows\System\QJaUTsR.exe
  2⤵
  PID:10452
- C:\Windows\System\MZiKoDc.exe
  C:\Windows\System\MZiKoDc.exe
  2⤵
  PID:10568
- C:\Windows\System\KWKUfRC.exe
  C:\Windows\System\KWKUfRC.exe
  2⤵
  PID:10652
- C:\Windows\System\GECmjPa.exe
  C:\Windows\System\GECmjPa.exe
  2⤵
  PID:10760
- C:\Windows\System\ccropZg.exe
  C:\Windows\System\ccropZg.exe
  2⤵
  PID:10792
- C:\Windows\System\LtZsQKt.exe
  C:\Windows\System\LtZsQKt.exe
  2⤵
  PID:10820
- C:\Windows\System\qgRUWFv.exe
  C:\Windows\System\qgRUWFv.exe
  2⤵
  PID:8848
- C:\Windows\System\wZizAST.exe
  C:\Windows\System\wZizAST.exe
  2⤵
  PID:8960
- C:\Windows\System\KehtfyP.exe
  C:\Windows\System\KehtfyP.exe
  2⤵
  PID:10920
- C:\Windows\System\iQtfOvo.exe
  C:\Windows\System\iQtfOvo.exe
  2⤵
  PID:6432
- C:\Windows\System\sqGSByR.exe
  C:\Windows\System\sqGSByR.exe
  2⤵
  PID:11188
- C:\Windows\System\rWvkEKA.exe
  C:\Windows\System\rWvkEKA.exe
  2⤵
  PID:11260
- C:\Windows\System\PzSBqDq.exe
  C:\Windows\System\PzSBqDq.exe
  2⤵
  PID:9624
- C:\Windows\System\HmSuqak.exe
  C:\Windows\System\HmSuqak.exe
  2⤵
  PID:2932
- C:\Windows\System\obMMgMK.exe
  C:\Windows\System\obMMgMK.exe
  2⤵
  PID:3840
- C:\Windows\System\QrudznB.exe
  C:\Windows\System\QrudznB.exe
  2⤵
  PID:12296
- C:\Windows\System\cFQTOFQ.exe
  C:\Windows\System\cFQTOFQ.exe
  2⤵
  PID:12316
- C:\Windows\System\pbCOvJo.exe
  C:\Windows\System\pbCOvJo.exe
  2⤵
  PID:12340
- C:\Windows\System\VGoxvjK.exe
  C:\Windows\System\VGoxvjK.exe
  2⤵
  PID:12368
- C:\Windows\System\YiZGJZs.exe
  C:\Windows\System\YiZGJZs.exe
  2⤵
  PID:12388
- C:\Windows\System\wmExIBb.exe
  C:\Windows\System\wmExIBb.exe
  2⤵
  PID:12408
- C:\Windows\System\UKiThYL.exe
  C:\Windows\System\UKiThYL.exe
  2⤵
  PID:12428
- C:\Windows\System\UpGMspx.exe
  C:\Windows\System\UpGMspx.exe
  2⤵
  PID:12452
- C:\Windows\System\MmuVkRB.exe
  C:\Windows\System\MmuVkRB.exe
  2⤵
  PID:12476
- C:\Windows\System\ltfpjZu.exe
  C:\Windows\System\ltfpjZu.exe
  2⤵
  PID:12500
- C:\Windows\System\MQRixIg.exe
  C:\Windows\System\MQRixIg.exe
  2⤵
  PID:12524
- C:\Windows\System\BnhAWZi.exe
  C:\Windows\System\BnhAWZi.exe
  2⤵
  PID:12548
- C:\Windows\System\lRVENQB.exe
  C:\Windows\System\lRVENQB.exe
  2⤵
  PID:12620
- C:\Windows\System\hdhXIGp.exe
  C:\Windows\System\hdhXIGp.exe
  2⤵
  PID:12636
- C:\Windows\System\lwbismz.exe
  C:\Windows\System\lwbismz.exe
  2⤵
  PID:12716
- C:\Windows\System\DlBYXDk.exe
  C:\Windows\System\DlBYXDk.exe
  2⤵
  PID:12732
- C:\Windows\System\PIvGfuv.exe
  C:\Windows\System\PIvGfuv.exe
  2⤵
  PID:12760
- C:\Windows\System\twbaqZI.exe
  C:\Windows\System\twbaqZI.exe
  2⤵
  PID:12776
- C:\Windows\System\ZAXISeG.exe
  C:\Windows\System\ZAXISeG.exe
  2⤵
  PID:12792
- C:\Windows\System\cWrZesP.exe
  C:\Windows\System\cWrZesP.exe
  2⤵
  PID:12812
- C:\Windows\System\IiqTtrK.exe
  C:\Windows\System\IiqTtrK.exe
  2⤵
  PID:12832
- C:\Windows\System\lLmtCYI.exe
  C:\Windows\System\lLmtCYI.exe
  2⤵
  PID:12848
- C:\Windows\System\wSTeiDJ.exe
  C:\Windows\System\wSTeiDJ.exe
  2⤵
  PID:12864
- C:\Windows\System\ZvnuGrW.exe
  C:\Windows\System\ZvnuGrW.exe
  2⤵
  PID:12880
- C:\Windows\System\smPihBt.exe
  C:\Windows\System\smPihBt.exe
  2⤵
  PID:12896
- C:\Windows\System\OlbACDZ.exe
  C:\Windows\System\OlbACDZ.exe
  2⤵
  PID:12912
- C:\Windows\System\YzMnRgR.exe
  C:\Windows\System\YzMnRgR.exe
  2⤵
  PID:12928
- C:\Windows\System\qIOJmgV.exe
  C:\Windows\System\qIOJmgV.exe
  2⤵
  PID:12944
- C:\Windows\System\AGpFAbW.exe
  C:\Windows\System\AGpFAbW.exe
  2⤵
  PID:12960
- C:\Windows\System\vJyBASt.exe
  C:\Windows\System\vJyBASt.exe
  2⤵
  PID:12976
- C:\Windows\System\ZizCPNZ.exe
  C:\Windows\System\ZizCPNZ.exe
  2⤵
  PID:12996
- C:\Windows\System\qCJNWpP.exe
  C:\Windows\System\qCJNWpP.exe
  2⤵
  PID:13020
- C:\Windows\System\SaIrmhq.exe
  C:\Windows\System\SaIrmhq.exe
  2⤵
  PID:13044
- C:\Windows\System\gHeAifC.exe
  C:\Windows\System\gHeAifC.exe
  2⤵
  PID:13064
- C:\Windows\System\BHTEDdt.exe
  C:\Windows\System\BHTEDdt.exe
  2⤵
  PID:13088
- C:\Windows\System\RtbgCfS.exe
  C:\Windows\System\RtbgCfS.exe
  2⤵
  PID:13116
- C:\Windows\System\viEqhOb.exe
  C:\Windows\System\viEqhOb.exe
  2⤵
  PID:13136
- C:\Windows\System\FPoCnbJ.exe
  C:\Windows\System\FPoCnbJ.exe
  2⤵
  PID:13156
- C:\Windows\System\npFqfDN.exe
  C:\Windows\System\npFqfDN.exe
  2⤵
  PID:10992
- C:\Windows\System\LVvXHRe.exe
  C:\Windows\System\LVvXHRe.exe
  2⤵
  PID:11160
- C:\Windows\System\IUWfJEU.exe
  C:\Windows\System\IUWfJEU.exe
  2⤵
  PID:9496
- C:\Windows\System\EhwHzUB.exe
  C:\Windows\System\EhwHzUB.exe
  2⤵
  PID:8864
- C:\Windows\System\pQlQgHU.exe
  C:\Windows\System\pQlQgHU.exe
  2⤵
  PID:11360
- C:\Windows\System\hqlbONh.exe
  C:\Windows\System\hqlbONh.exe
  2⤵
  PID:11432
- C:\Windows\System\zZujWDL.exe
  C:\Windows\System\zZujWDL.exe
  2⤵
  PID:11532
- C:\Windows\System\gLVeDxf.exe
  C:\Windows\System\gLVeDxf.exe
  2⤵
  PID:11576
- C:\Windows\System\pNqbnPr.exe
  C:\Windows\System\pNqbnPr.exe
  2⤵
  PID:11648
- C:\Windows\System\DwYLWmc.exe
  C:\Windows\System\DwYLWmc.exe
  2⤵
  PID:11704
- C:\Windows\System\PTSSEEL.exe
  C:\Windows\System\PTSSEEL.exe
  2⤵
  PID:11860
- C:\Windows\System\mDkgsVI.exe
  C:\Windows\System\mDkgsVI.exe
  2⤵
  PID:11932
- C:\Windows\System\ZqWbdWl.exe
  C:\Windows\System\ZqWbdWl.exe
  2⤵
  PID:13100
- C:\Windows\System\EiygrzG.exe
  C:\Windows\System\EiygrzG.exe
  2⤵
  PID:10392
- C:\Windows\System\CcLbyAs.exe
  C:\Windows\System\CcLbyAs.exe
  2⤵
  PID:12576
- C:\Windows\System\ZcLRMTm.exe
  C:\Windows\System\ZcLRMTm.exe
  2⤵
  PID:8200
- C:\Windows\System\Jqgpxlp.exe
  C:\Windows\System\Jqgpxlp.exe
  2⤵
  PID:12436
- C:\Windows\System\oBykyez.exe
  C:\Windows\System\oBykyez.exe
  2⤵
  PID:10872
- C:\Windows\System\ZHIffvh.exe
  C:\Windows\System\ZHIffvh.exe
  2⤵
  PID:10532
- C:\Windows\System\NjlLWbH.exe
  C:\Windows\System\NjlLWbH.exe
  2⤵
  PID:3260
- C:\Windows\System\imYhALI.exe
  C:\Windows\System\imYhALI.exe
  2⤵
  PID:8860
- C:\Windows\System\WCMZfjY.exe
  C:\Windows\System\WCMZfjY.exe
  2⤵
  PID:9828
- C:\Windows\System\RZpBgQg.exe
  C:\Windows\System\RZpBgQg.exe
  2⤵
  PID:10836
- C:\Windows\System\KQNCxYw.exe
  C:\Windows\System\KQNCxYw.exe
  2⤵
  PID:12560
- C:\Windows\System\ZhvTxPo.exe
  C:\Windows\System\ZhvTxPo.exe
  2⤵
  PID:7144
- C:\Windows\System\pRuwvWT.exe
  C:\Windows\System\pRuwvWT.exe
  2⤵
  PID:11272
- C:\Windows\System\dHWZgux.exe
  C:\Windows\System\dHWZgux.exe
  2⤵
  PID:12468
- C:\Windows\System\PLwkzZn.exe
  C:\Windows\System\PLwkzZn.exe
  2⤵
  PID:11412
- C:\Windows\System\xABIPdw.exe
  C:\Windows\System\xABIPdw.exe
  2⤵
  PID:11680
- C:\Windows\System\KDIiZmq.exe
  C:\Windows\System\KDIiZmq.exe
  2⤵
  PID:11908
- C:\Windows\System\jBmHOZi.exe
  C:\Windows\System\jBmHOZi.exe
  2⤵
  PID:12044
- C:\Windows\System\iSrKYbk.exe
  C:\Windows\System\iSrKYbk.exe
  2⤵
  PID:12180
- C:\Windows\System\EVaJnzY.exe
  C:\Windows\System\EVaJnzY.exe
  2⤵
  PID:9864
- C:\Windows\System\rrbEVhQ.exe
  C:\Windows\System\rrbEVhQ.exe
  2⤵
  PID:12748
- C:\Windows\System\BHgtnRR.exe
  C:\Windows\System\BHgtnRR.exe
  2⤵
  PID:12800
- C:\Windows\System\ZDZwfRD.exe
  C:\Windows\System\ZDZwfRD.exe
  2⤵
  PID:7884
- C:\Windows\System\CaBtKst.exe
  C:\Windows\System\CaBtKst.exe
  2⤵
  PID:11120
- C:\Windows\System\nEksvdM.exe
  C:\Windows\System\nEksvdM.exe
  2⤵
  PID:3320
- C:\Windows\System\AgALejn.exe
  C:\Windows\System\AgALejn.exe
  2⤵
  PID:9776
- C:\Windows\System\rpnpmpT.exe
  C:\Windows\System\rpnpmpT.exe
  2⤵
  PID:10052
- C:\Windows\System\YMKMvuS.exe
  C:\Windows\System\YMKMvuS.exe
  2⤵
  PID:12496
- C:\Windows\System\omUCbSS.exe
  C:\Windows\System\omUCbSS.exe
  2⤵
  PID:1432
- C:\Windows\System\chEXMeb.exe
  C:\Windows\System\chEXMeb.exe
  2⤵
  PID:9404
- C:\Windows\System\LOcYbVL.exe
  C:\Windows\System\LOcYbVL.exe
  2⤵
  PID:1204
- C:\Windows\System\TOolkhf.exe
  C:\Windows\System\TOolkhf.exe
  2⤵
  PID:12200
- C:\Windows\System\rtZONbf.exe
  C:\Windows\System\rtZONbf.exe
  2⤵
  PID:11000
- C:\Windows\System\jxAqITU.exe
  C:\Windows\System\jxAqITU.exe
  2⤵
  PID:8428
- C:\Windows\System\HBxKGQq.exe
  C:\Windows\System\HBxKGQq.exe
  2⤵
  PID:3488
- C:\Windows\System\ReogWQO.exe
  C:\Windows\System\ReogWQO.exe
  2⤵
  PID:12460
- C:\Windows\System\sWoEaPh.exe
  C:\Windows\System\sWoEaPh.exe
  2⤵
  PID:13308
- C:\Windows\System\geYnnnW.exe
  C:\Windows\System\geYnnnW.exe
  2⤵
  PID:12804
- C:\Windows\System\JbZWejj.exe
  C:\Windows\System\JbZWejj.exe
  2⤵
  PID:1784
- C:\Windows\System\JRPYezl.exe
  C:\Windows\System\JRPYezl.exe
  2⤵
  PID:6924
- C:\Windows\System\BOnOcHZ.exe
  C:\Windows\System\BOnOcHZ.exe
  2⤵
  PID:11600
- C:\Windows\System\PfHOwtY.exe
  C:\Windows\System\PfHOwtY.exe
  2⤵
  PID:12492
- C:\Windows\System\NEIonto.exe
  C:\Windows\System\NEIonto.exe
  2⤵
  PID:3180
- C:\Windows\System\iZZxWMe.exe
  C:\Windows\System\iZZxWMe.exe
  2⤵
  PID:1828
- C:\Windows\System\ulIsVpA.exe
  C:\Windows\System\ulIsVpA.exe
  2⤵
  PID:11928
- C:\Windows\System\SDdnmMg.exe
  C:\Windows\System\SDdnmMg.exe
  2⤵
  PID:9736
- C:\Windows\System\XGllrsQ.exe
  C:\Windows\System\XGllrsQ.exe
  2⤵
  PID:5056
- C:\Windows\System\AeeDSJo.exe
  C:\Windows\System\AeeDSJo.exe
  2⤵
  PID:2784
- C:\Windows\System\IEeodQp.exe
  C:\Windows\System\IEeodQp.exe
  2⤵
  PID:10132
- C:\Windows\System\yqsRfRR.exe
  C:\Windows\System\yqsRfRR.exe
  2⤵
  PID:11644
- C:\Windows\System\VmEAFKb.exe
  C:\Windows\System\VmEAFKb.exe
  2⤵
  PID:9740
- C:\Windows\System\GuTMTDj.exe
  C:\Windows\System\GuTMTDj.exe
  2⤵
  PID:13292
- C:\Windows\System\QTrYQyd.exe
  C:\Windows\System\QTrYQyd.exe
  2⤵
  PID:9336
- C:\Windows\System\wbzsjpC.exe
  C:\Windows\System\wbzsjpC.exe
  2⤵
  PID:4672
- C:\Windows\System\cduxTcP.exe
  C:\Windows\System\cduxTcP.exe
  2⤵
  PID:2760
- C:\Windows\System\aRNYUKI.exe
  C:\Windows\System\aRNYUKI.exe
  2⤵
  PID:10756
- C:\Windows\System\cOtWutv.exe
  C:\Windows\System\cOtWutv.exe
  2⤵
  PID:12728
- C:\Windows\System\mHxUZUi.exe
  C:\Windows\System\mHxUZUi.exe
  2⤵
  PID:11604
- C:\Windows\System\sQEnAOt.exe
  C:\Windows\System\sQEnAOt.exe
  2⤵
  PID:12332
- C:\Windows\System\LMbInJh.exe
  C:\Windows\System\LMbInJh.exe
  2⤵
  PID:12956
- C:\Windows\System\WKObDED.exe
  C:\Windows\System\WKObDED.exe
  2⤵
  PID:5552
- C:\Windows\System\QZyMtXk.exe
  C:\Windows\System\QZyMtXk.exe
  2⤵
  PID:11392
- C:\Windows\System\eOftyKd.exe
  C:\Windows\System\eOftyKd.exe
  2⤵
  PID:13268
- C:\Windows\System\INJJHao.exe
  C:\Windows\System\INJJHao.exe
  2⤵
  PID:1584
- C:\Windows\System\BTqFggg.exe
  C:\Windows\System\BTqFggg.exe
  2⤵
  PID:10408
- C:\Windows\System\UnzvIdn.exe
  C:\Windows\System\UnzvIdn.exe
  2⤵
  PID:12208
- C:\Windows\System\MNhmbyt.exe
  C:\Windows\System\MNhmbyt.exe
  2⤵
  PID:3756
- C:\Windows\System\zxMXQuJ.exe
  C:\Windows\System\zxMXQuJ.exe
  2⤵
  PID:11344
- C:\Windows\System\MiRKOtJ.exe
  C:\Windows\System\MiRKOtJ.exe
  2⤵
  PID:9860
- C:\Windows\System\YUlSTQJ.exe
  C:\Windows\System\YUlSTQJ.exe
  2⤵
  PID:9596
- C:\Windows\System\XNozVjI.exe
  C:\Windows\System\XNozVjI.exe
  2⤵
  PID:6512
- C:\Windows\System\wRbrmfF.exe
  C:\Windows\System\wRbrmfF.exe
  2⤵
  PID:5264
- C:\Windows\System\aVachLB.exe
  C:\Windows\System\aVachLB.exe
  2⤵
  PID:7328
- C:\Windows\System\lUmMefq.exe
  C:\Windows\System\lUmMefq.exe
  2⤵
  PID:9932
- C:\Windows\System\GcGhSOj.exe
  C:\Windows\System\GcGhSOj.exe
  2⤵
  PID:8036
- C:\Windows\System\oBsBUkp.exe
  C:\Windows\System\oBsBUkp.exe
  2⤵
  PID:3264
- C:\Windows\System\TfzJqHa.exe
  C:\Windows\System\TfzJqHa.exe
  2⤵
  PID:348
- C:\Windows\System\AcUZggN.exe
  C:\Windows\System\AcUZggN.exe
  2⤵
  PID:13260
- C:\Windows\System\rKOPTdq.exe
  C:\Windows\System\rKOPTdq.exe
  2⤵
  PID:11792
- C:\Windows\System\xIBxYan.exe
  C:\Windows\System\xIBxYan.exe
  2⤵
  PID:12036
- C:\Windows\System\oGyTAlg.exe
  C:\Windows\System\oGyTAlg.exe
  2⤵
  PID:11012
- C:\Windows\System\XhGvLBJ.exe
  C:\Windows\System\XhGvLBJ.exe
  2⤵
  PID:9316
- C:\Windows\System\UKvWMSz.exe
  C:\Windows\System\UKvWMSz.exe
  2⤵
  PID:11996
- C:\Windows\System\afFtWyB.exe
  C:\Windows\System\afFtWyB.exe
  2⤵
  PID:5724
- C:\Windows\System\xBxJSlv.exe
  C:\Windows\System\xBxJSlv.exe
  2⤵
  PID:5072
- C:\Windows\System\vOXnLHX.exe
  C:\Windows\System\vOXnLHX.exe
  2⤵
  PID:6328
- C:\Windows\System\JNtaSsA.exe
  C:\Windows\System\JNtaSsA.exe
  2⤵
  PID:6336
- C:\Windows\System\ouNLzUO.exe
  C:\Windows\System\ouNLzUO.exe
  2⤵
  PID:6332
- C:\Windows\System\CBMdKMh.exe
  C:\Windows\System\CBMdKMh.exe
  2⤵
  PID:12604
- C:\Windows\System\bYRRxDc.exe
  C:\Windows\System\bYRRxDc.exe
  2⤵
  PID:12420
- C:\Windows\System\QaTkcfO.exe
  C:\Windows\System\QaTkcfO.exe
  2⤵
  PID:13316
- C:\Windows\System\qHdLOmP.exe
  C:\Windows\System\qHdLOmP.exe
  2⤵
  PID:13336
- C:\Windows\System\HsMgIoD.exe
  C:\Windows\System\HsMgIoD.exe
  2⤵
  PID:13352
- C:\Windows\System\WXARCej.exe
  C:\Windows\System\WXARCej.exe
  2⤵
  PID:13376
- C:\Windows\System\iZOBTXs.exe
  C:\Windows\System\iZOBTXs.exe
  2⤵
  PID:13404
- C:\Windows\System\lMKddaO.exe
  C:\Windows\System\lMKddaO.exe
  2⤵
  PID:13420
- C:\Windows\System\tAZlSiQ.exe
  C:\Windows\System\tAZlSiQ.exe
  2⤵
  PID:13440
- C:\Windows\System\iGmVihc.exe
  C:\Windows\System\iGmVihc.exe
  2⤵
  PID:13468
- C:\Windows\System\IwlvdFS.exe
  C:\Windows\System\IwlvdFS.exe
  2⤵
  PID:13488
- C:\Windows\System\IsKbpCe.exe
  C:\Windows\System\IsKbpCe.exe
  2⤵
  PID:13512
- C:\Windows\System\FtEAWfJ.exe
  C:\Windows\System\FtEAWfJ.exe
  2⤵
  PID:13528
- C:\Windows\System\oIkHQil.exe
  C:\Windows\System\oIkHQil.exe
  2⤵
  PID:13552
- C:\Windows\System\LZPnkZg.exe
  C:\Windows\System\LZPnkZg.exe
  2⤵
  PID:13576
- C:\Windows\System\wLZyLBy.exe
  C:\Windows\System\wLZyLBy.exe
  2⤵
  PID:13596
- C:\Windows\System\wTIIoOE.exe
  C:\Windows\System\wTIIoOE.exe
  2⤵
  PID:13620
- C:\Windows\System\ZmgvTts.exe
  C:\Windows\System\ZmgvTts.exe
  2⤵
  PID:13644
- C:\Windows\System\RQwtkPO.exe
  C:\Windows\System\RQwtkPO.exe
  2⤵
  PID:13664
- C:\Windows\System\aORHwWX.exe
  C:\Windows\System\aORHwWX.exe
  2⤵
  PID:13692
- C:\Windows\System\EqfxJIn.exe
  C:\Windows\System\EqfxJIn.exe
  2⤵
  PID:13712
- C:\Windows\System\roNsGMm.exe
  C:\Windows\System\roNsGMm.exe
  2⤵
  PID:13736
- C:\Windows\System\vFVtTsM.exe
  C:\Windows\System\vFVtTsM.exe
  2⤵
  PID:13760
- C:\Windows\System\xnAdooG.exe
  C:\Windows\System\xnAdooG.exe
  2⤵
  PID:13784
- C:\Windows\System\DGQHwGW.exe
  C:\Windows\System\DGQHwGW.exe
  2⤵
  PID:13808
- C:\Windows\System\afuoLtZ.exe
  C:\Windows\System\afuoLtZ.exe
  2⤵
  PID:13836
- C:\Windows\System\rlcVHRl.exe
  C:\Windows\System\rlcVHRl.exe
  2⤵
  PID:13860
- C:\Windows\System\hnjBXlp.exe
  C:\Windows\System\hnjBXlp.exe
  2⤵
  PID:13880
- C:\Windows\System\DHxfysX.exe
  C:\Windows\System\DHxfysX.exe
  2⤵
  PID:13900
- C:\Windows\System\JrwjQJW.exe
  C:\Windows\System\JrwjQJW.exe
  2⤵
  PID:14236
- C:\Windows\System\aMoTozX.exe
  C:\Windows\System\aMoTozX.exe
  2⤵
  PID:14256
- C:\Windows\System\hllaZOZ.exe
  C:\Windows\System\hllaZOZ.exe
  2⤵
  PID:14276
- C:\Windows\System\vvQVRvM.exe
  C:\Windows\System\vvQVRvM.exe
  2⤵
  PID:14296
- C:\Windows\System\LoSlTps.exe
  C:\Windows\System\LoSlTps.exe
  2⤵
  PID:14324
- C:\Windows\System\MLpfPMJ.exe
  C:\Windows\System\MLpfPMJ.exe
  2⤵
  PID:2008
- C:\Windows\System\msvhvbv.exe
  C:\Windows\System\msvhvbv.exe
  2⤵
  PID:13252
- C:\Windows\System\EyLGexH.exe
  C:\Windows\System\EyLGexH.exe
  2⤵
  PID:13348
- C:\Windows\System\XFXpbyB.exe
  C:\Windows\System\XFXpbyB.exe
  2⤵
  PID:13392
- C:\Windows\System\DuJCHlY.exe
  C:\Windows\System\DuJCHlY.exe
  2⤵
  PID:13324
- C:\Windows\System\scXFMfB.exe
  C:\Windows\System\scXFMfB.exe
  2⤵
  PID:13436
- C:\Windows\System\pglmMey.exe
  C:\Windows\System\pglmMey.exe
  2⤵
  PID:13460
- C:\Windows\System\nLSffQj.exe
  C:\Windows\System\nLSffQj.exe
  2⤵
  PID:13484
- C:\Windows\System\ZQvbxww.exe
  C:\Windows\System\ZQvbxww.exe
  2⤵
  PID:13344
- C:\Windows\System\lhpUPof.exe
  C:\Windows\System\lhpUPof.exe
  2⤵
  PID:13364
- C:\Windows\System\PvgoPWQ.exe
  C:\Windows\System\PvgoPWQ.exe
  2⤵
  PID:13608
- C:\Windows\System\fZJFjoZ.exe
  C:\Windows\System\fZJFjoZ.exe
  2⤵
  PID:14020
- C:\Windows\System\PRWmojH.exe
  C:\Windows\System\PRWmojH.exe
  2⤵
  PID:14048
- C:\Windows\System\GsXnYLP.exe
  C:\Windows\System\GsXnYLP.exe
  2⤵
  PID:13988
- C:\Windows\System\uCMCiAI.exe
  C:\Windows\System\uCMCiAI.exe
  2⤵
  PID:14080
- C:\Windows\System\fFkPSTE.exe
  C:\Windows\System\fFkPSTE.exe
  2⤵
  PID:14088
- C:\Windows\System\ETRmshN.exe
  C:\Windows\System\ETRmshN.exe
  2⤵
  PID:14140
- C:\Windows\System\mYwXAbS.exe
  C:\Windows\System\mYwXAbS.exe
  2⤵
  PID:14172
- C:\Windows\System\jseJjjM.exe
  C:\Windows\System\jseJjjM.exe
  2⤵
  PID:14176
- C:\Windows\System\CZzyChG.exe
  C:\Windows\System\CZzyChG.exe
  2⤵
  PID:14156
- C:\Windows\System\qRUgXqB.exe
  C:\Windows\System\qRUgXqB.exe
  2⤵
  PID:14284
- C:\Windows\System\MeEtWif.exe
  C:\Windows\System\MeEtWif.exe
  2⤵
  PID:13500
- C:\Windows\System\PAEBbhR.exe
  C:\Windows\System\PAEBbhR.exe
  2⤵
  PID:13480
- C:\Windows\System\EajIpAV.exe
  C:\Windows\System\EajIpAV.exe
  2⤵
  PID:13796

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 12296 -ip 12296
1⤵
PID:11996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lynsemy0.yzf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BefSlAP.exe

Filesize
2.0MB

MD5
0905e5289a3ff06dd11996277e5f9005

SHA1
f2cc6b03c87473896da64e370e38aec1b4d3d7e1

SHA256
3acdccefd59b3fc6330bbc8c261128153aabc18891a48354b1822bb06168caf3

SHA512
2e3cf8c8e7b25ef6a5d6047d3fff2fadb618df77bc2a117fecffd68820a3fb0813523bd8500b474964de8a336a989da96d0192bff0ab5ecc58e7459267883b12

Download Submit
C:\Windows\System\ELVNEJT.exe

Filesize
2.0MB

MD5
a61174a87649f600868546f196a5e23f

SHA1
63732e8b25f3c4dfbcaaa2caeb05aa120bdf4aec

SHA256
4ff12cbe12e0bfbe33b33f702dd9332ee21b7978e5b58d592227ff3da151c319

SHA512
33b86ccb8fa658348640aeccf40f21187cca0132ab049f3d0d9174182de195abfa62b0c527fb47766378fed88f16a397b2204a0a8fea88c387ec0ea6f0f4e2c5

Download Submit
C:\Windows\System\FAqkeEm.exe

Filesize
2.0MB

MD5
142d2320f742085a3e8fde325b7a4d86

SHA1
cef783c69f5b56cfe2239f4597776cd17c182885

SHA256
f90512afa4afeeb27417e1bf0776db82c6492360532fc25f40ccc270fe1d4170

SHA512
c00090ce9bd55c9901c23337104ee6bf2398585068cabf7a28a467b3fe7ab1e3063331b7f500ad2e9c4cdb8b7e3d70ba2369bc0b76d10afc7c377b9450e2ff95

Download Submit
C:\Windows\System\FXTNIQO.exe

Filesize
2.0MB

MD5
c104b01cc44af372a1add7b8bd407605

SHA1
4e1f28bdee2956ba8e2336ced5a15ff1c061a65f

SHA256
93913de24536d38021e05a95fc1b1848e4e5106568ef739b86786e864767677a

SHA512
c9049c9f79bb31eeba7e708c49ad5711f08516d10208464610f42ef0db4973c6d39b7267de11f7d9526055c730014d44c4eca8045ba948b01906baa8422ba968

Download Submit
C:\Windows\System\GRdrEIy.exe

Filesize
2.0MB

MD5
1f091dc128753ef42d94e3d345423467

SHA1
39d5e5fe11f20beb7caf09be2704273cb50df845

SHA256
6e003bef9af399f870830bdc9f478ca436074f74b59e13d484630d0b9989f96a

SHA512
e36b4f5fff383df50034a974890a4f320d3af2432920cfbeb0e9e470d7c1a53701be89356deb2caaece5b1cda35d8d82f5b937e9c66f4cb5ef71561891a700de

Download Submit
C:\Windows\System\GejSFmR.exe

Filesize
2.0MB

MD5
bf490e9ea8b437599143a8d6705b9081

SHA1
fdf595e1ef1f005d9f59557f78f05141a9baaca1

SHA256
a40a1f944445993f45762e3d81187f6e6e5bb613d909c5ff8522c331f97b730e

SHA512
64e28a54aac54f26eeabd7181579af74becd7c76760001d098a39340a626e661c248bb84043b2691a3d71a480d00ec2474fe04daad03ef5ab4d7882031622a32

Download Submit
C:\Windows\System\JpaYuNx.exe

Filesize
2.0MB

MD5
933b40472422ac7f3553d852cc39df1f

SHA1
162b6aca2ad9957e58f6bc6a1c5e4187c525cebe

SHA256
e44e32f0b64cb4d568c3012506521731166765e429c8fdbe130b20df2f213be5

SHA512
87682c3ef0dab77245e1aabea4a9dde562d34005128cec534e264574e28a0d2f6e807a3c725a1b65da4ae6eddc9c4d51cfb91c03f71a76f789f2f45cebdde982

Download Submit
C:\Windows\System\LdSTyqN.exe

Filesize
2.0MB

MD5
426abe3b7ef8a090e741aaa9a150cb7b

SHA1
a5e83af3a0d06c9eadeaca15aff881caeedf0313

SHA256
87674dd42aff23e1b25b1a59eae742aaf08aa32ba0437dcb9867f662c45c2ad4

SHA512
67df82e3fca222beaafe6231433a39be4c670666fbf8e45f40fef16269aac36cadcb8d167da6f1bc37fd63b4d1e8a0b255d6a3564463e70af61d5cdecbacf848

Download Submit
C:\Windows\System\NUTAkGj.exe

Filesize
2.0MB

MD5
5af8183d405d86c40fb5ee281fbe3a60

SHA1
185d76890b332f9a53b1e2cf70c98f089a06623a

SHA256
27320b2071e74cb182ee78ff9b41927ec156c97252333c312d7c16dc04c5b463

SHA512
7269e740b334e8a98f0266d843a5ebe501b8fb1b519b4247349506af6ff86dbcc8cb99b0ed55150e05e39241534a3edf08a8092cf90c49a4b27f3b79ccb1b807

Download Submit
C:\Windows\System\NorPuTE.exe

Filesize
2.0MB

MD5
ee87730e5a2dd8f50b906c232bf4ac0e

SHA1
152a8498b1719ee8ef81265464de66194ef32459

SHA256
9a5049ec95bce756bceef9a7ed1710e1778cc3635b3a577b9bf7fc58fe82edda

SHA512
a394e3e78390b31c4d37d8fe13d16c172631ab7d6dd0d16973de33c63efda08c1efe335c73c1e716639b25adfa80e21ab7077d716389202e322a4c119e23857d

Download Submit
C:\Windows\System\OesMqXS.exe

Filesize
2.0MB

MD5
46ee1ccd45fde3393e14f1e563c826e2

SHA1
788f2ed4c537ba03a6fb4ae625428bffaa735b9f

SHA256
a974e940a05d23ecfccee3c4464392390e93f187e82e537ede17eb6c876dcc60

SHA512
7c87f7c5e5347225e98adf0adeb6e3891ecd7246d748a279bf03188de7c64be7cfbc7896f0c3805dfb03811d713890baab67b473469c9e1a34720a78af8ea58d

Download Submit
C:\Windows\System\PdCQPyZ.exe

Filesize
2.0MB

MD5
559815499fde28b9ce40dcf4218d2ff0

SHA1
0df9166cbcbc0b4169a47b79f876eb1fa19e4e9b

SHA256
a2b44aa2c6856004da4613291d3dd58cc909124b95e24cf4196f404f2f6ce9b2

SHA512
e695fc673d64b1d8f53ef094d3cc6855d969eb7e86f6a332e0bfce471e81d7af3c9e0a0c135c4414a2e87b38f1a5167dd9586226c90d61d544013f4c972017a1

Download Submit
C:\Windows\System\PufKAUd.exe

Filesize
2.0MB

MD5
37e71af9b868d7d4be8c54a9553d7040

SHA1
10f76d092eb0789fd252055afb90bcf74d560a35

SHA256
74835d1028bf1950d6afdd47ed63b2f19a77a7c53c4a4945c8b0ec994012f649

SHA512
c0f1626f6f0147dabeb7818c9cc3f140db71a8a9da2dff2c57a4da9af7c6826fe4c9f8bade1466669636eda0e37c59e60ae06f264272ee6c0d007303e1bb951e

Download Submit
C:\Windows\System\Rbtxyrw.exe

Filesize
2.0MB

MD5
9f2d65145f20c7f52432217ebc4d7cf4

SHA1
ca3acd8eed6641ab4f1f840b128ce77d19df1769

SHA256
5e767c7e32d81087b958c943b3f8a4df48320ba81d0ac4e3344d39cd87d0250c

SHA512
ba42f5bca68b14bf708dc4eb1595c73ffb8828cdeffe4bbc9462c75fbdda204fb929907e49a5dd03f706335aa464c9261ad620e4bf0e55558d0b42fd0fe8ff6c

Download Submit
C:\Windows\System\TrgCXxi.exe

Filesize
2.0MB

MD5
a2bfbb49ad34e6ae6a47ed0358ef3c1c

SHA1
ecb6a6c33bdaf4f6ac9120c75756445cd9353800

SHA256
3313644b5d256f830fafcaefd14a9b12f00b217abe07857b394a7da13b976fb1

SHA512
2c537753096302d4e6fce07e9cf6623d28e553cb2e79cfb360fa84acbbc3cb78805e2f5abceb325acdb4a1a23610bef8cf2236d0f1e0e4d42a77dc59c4f36e40

Download Submit
C:\Windows\System\URiEsnV.exe

Filesize
2.0MB

MD5
394689f4fd1ad8a13695dfab3357c0c8

SHA1
da839a9cccf09d76abbe54eabda0a6d0561080e3

SHA256
3071474d9c18e1e446e0609daa6af599f18a58e00932f77f5633e363ac13a64b

SHA512
031f02a62855db667c497878495605183cabcbaaabd7cf8f14b8d00e693f9165508e65b68bf45e42c4efd2d37b2e08a00d2e7a977715ff4685236359e913293d

Download Submit
C:\Windows\System\VpmWTVx.exe

Filesize
2.0MB

MD5
43f29babe37e9ab777230eb054dd4345

SHA1
f4f8ce4d5ab5aca81966fbfd9c1b4244588a5e8b

SHA256
d761deb7284f633347e64b82e06a4096ca177488325ceb7ca4ec4309487f7f69

SHA512
d3ee88686182034f30917bc8904cf49b04cb4b6c95734baa015a112437cec72baf8057b01fe2eaae03d97dcb46581944bca2204adb170dddcf1ac6637a1a411d

Download Submit
C:\Windows\System\aYmaysF.exe

Filesize
2.0MB

MD5
fb3f0220319177bbd5f7a6b393abffb5

SHA1
d04d4339c83335462b2ca50cf99fca3ebe17e48a

SHA256
b1a52ef722b4963d5385d6decce78ab7dcc738390d3d3b5e9ef048959a7e96c9

SHA512
1426d99cc8164ed7cfec8b04512658e76f1b86b276da2f0cd19423424db1585894623b373eed6a80e0d36f2b257fa4e54da48756d393ff6d5dff82f2630c3eb8

Download Submit
C:\Windows\System\bvqVOKt.exe

Filesize
2.0MB

MD5
4d97b3d5dfd1de3fd23c92b5c8f1b394

SHA1
bace2b9dfa0fda4a1a2fa8d049e390cf1089a872

SHA256
50cb7b4d6e3c1ffc252e0867a451b6a3c7a4ca7c797ad51d9ffa9be42038d8e9

SHA512
9c056543e228bba0cb142db016244a8556778af4142f0d8e93edab8f4658ab9fa3eca1345bb8d766bfbdeb20086915a375dad79c96415c5d97f603a1211a2caa

Download Submit
C:\Windows\System\cOuipSC.exe

Filesize
2.0MB

MD5
197a0edd7113993320dfae96dc300875

SHA1
da50966c5ff1926f556f8a176577a52e788c5b0a

SHA256
2fd07dff743dbe3d36611327c194deb3603d7773c2dad463d1872e88e3599881

SHA512
67369139459aa0010b2c16f7561b0e3b57f4895454466dd4aa01643b0e161d772031bac5143c51e98dfda0d987c55b2c371444f3954c1c0e7a92a83022e5b8b4

Download Submit
C:\Windows\System\dolkQDd.exe

Filesize
2.0MB

MD5
99f5da0581b2116792adf877d9420516

SHA1
59a2a8a7b65d354d315668517c4e458e1c7e2d5e

SHA256
eccc43393f1f77cf322c98d6cc2f8bf30cdfdb882dcbbfcbe281b68b0f603ffb

SHA512
98d7e06bb045636b5c7f027d4474a0d30e65553ba67fb23f9ea25d262b525edf8a2d679b22a8d66486eda53df25ed36a135452e283f07991a0b20a37a68471fc

Download Submit
C:\Windows\System\eGpscad.exe

Filesize
2.0MB

MD5
6463ee96930ffa277fd4f44dbd771f6a

SHA1
981698339fcae6f65609a1cd02cd4fec974ba153

SHA256
f149f60a9eaea5fe1c455c83b203f01ec44bfd6df81632758e780cae1b959b75

SHA512
546471d7a195f444d0f84728ec6fd1b1317746678a4396947c26fa1a77a1c1cadb51338d771fc9331c2973f63bc5cfb58deb150998f8fecf9ba0f7a92d1e0bf8

Download Submit
C:\Windows\System\exovVZF.exe

Filesize
2.0MB

MD5
d4a4271002588bef314b7b86a949290c

SHA1
e3d91b611738dcb03866ae4ad4a722076b04c950

SHA256
b7ed6210f7ce5a97c84eb45ace527bc78a6d204a5b8e67ef71825e7f2c7c1814

SHA512
309320c4457af82e3150d15c9b40591a5aff177c1f739bad14e9641e6480fb1aee3ffd31049d6da8990f8d9a7963d9af73daff39ba8af50a33045e1b18217f12

Download Submit
C:\Windows\System\iZjpBkP.exe

Filesize
2.0MB

MD5
e7076a9a35c15b62552b68dad6dcb8f8

SHA1
af3a0a610b8ae2ad713c450251300849edc4393f

SHA256
1b9f517e66489a982b20ac569cc77adbcb59923556e27246fe0d26dfc4aa7765

SHA512
4a22483c188b6770a080c30c71eb8e9a2ee93e8cd0f2d23b26898f197796846f9d3671f050a7f60dec38a54ed97e8b32e3890988f48ac532c384e288a7934de4

Download Submit
C:\Windows\System\jMRmunv.exe

Filesize
2.0MB

MD5
7e6730b8ac780dc2d725e02d47ee99dc

SHA1
1bea9314cc2771770001e63898c42905a5b1f7f1

SHA256
ea7d8b06b0e745052fe803f273ff406de40350a2bbc4b05d923f3d28eef076af

SHA512
9e530e6a49e17a153845dd5d7192d7ed475989662bd460c1f2827109a59ac80fd464e7ae0392273493c5764e277dec2225c03d06cb3ef1a881ecce3f6806779e

Download Submit
C:\Windows\System\jjpTRjK.exe

Filesize
2.0MB

MD5
e2f4c5c94aceabefebbe1300efb1e8dc

SHA1
9cb3dc5b28d80ad8bf4b067b977c9d9cced20c4c

SHA256
51e6eb93a5d3ce9c9caa19f8b0ce5ee8c0b3c85b8da5794a0dc47991608e538f

SHA512
d2f535d59bdeeafff8220ed19e0ec9295a14f22393c623a71325f8d49faec07d73dbbd807aa445c435c502bc293e39c6d13c7bbbd3d8f6813402811d37f1ecea

Download Submit
C:\Windows\System\mjOQYXV.exe

Filesize
2.0MB

MD5
a5d23c46e4bef58c1da1b29f25f8c233

SHA1
fd16c5941fa823110da60601d8b29014f9f32fdf

SHA256
2dba5b7a630fef215edc5b31edbcf6a5a28c27c23cf8e63d540748f34fb43cc0

SHA512
02422541ef4db7db1e163fc8e004755a57431e99bca34ac1e123ae989cfcc5193a0f846c92ae526ea5eeb89bf3d4061ed5f5234ca279f08bd150dd7aa962c39f

Download Submit
C:\Windows\System\nZXXOUf.exe

Filesize
2.0MB

MD5
1116a6bdc4c80b80770ee12700a1fbd5

SHA1
fefed475daf975e24ad77e9cdd2b6ce90455c1de

SHA256
de94468ffc254de5c884fa9623426fb886cbe4a7886640c6257b9ba6ef05ef35

SHA512
b04ce2f07155724170c2f38471e14cb33b1518fd71dde7a69e24aa9957d5ecc5c7ed9bb7df80736619533c75e7d888f4694572260685c20f57e1e3ea01fd601f

Download Submit
C:\Windows\System\nekWVWs.exe

Filesize
8B

MD5
7e1e9fcc71af27d4f3a70b3e20ac77b9

SHA1
09ec64762a6dbe9e03ecdb61ea5de2d274d170f0

SHA256
2f18658787aeca4d305f9fde7c9bc7343e5969bd51ec0e2c8583a2e506b9b404

SHA512
3beada4b1cd8ead153972e6e1293d504f7cea2d7323223a87897681d13a0872baba6942b9d88c8943892c0ad02e1f51ed3730edd702cc7d53ab31d006770ca91

Download Submit
C:\Windows\System\oNSprJU.exe

Filesize
2.0MB

MD5
9f00795b04f6d129af3cf7a5cb952ae4

SHA1
18b500689943080a6b4032fc0073b21c038e2cfa

SHA256
5d4737fa2e055062d0ed8dd344405e1462a6ef68b2e8c1400f312a2959284dba

SHA512
2148c88cdcbd97c25541229b7d73576e637df704d431be2bdf3e4831de450f3fe54952f5558d52ddaede3eb9946ec551d20cfdca2789ed84638b30b913cbe38c

Download Submit
C:\Windows\System\qCbPqsi.exe

Filesize
2.0MB

MD5
2afff812014751911e9cabf8293fdf53

SHA1
79bebc4e7a98c5bb52eefbebc824e7659c9bcb87

SHA256
3d0a089d725cf9e4c7104a5726ec760cfa135d7b63c15f8bd71519eea502eb8a

SHA512
ef799d075bab6c51e33010e545fcd1d39934729934e05ff20123d00c5c34961f47de037b09a7c644b8306736b9cc6a4b6f4e74a1ee868459a54698a4cfeeddb9

Download Submit
C:\Windows\System\qdFqmjf.exe

Filesize
2.0MB

MD5
e742a4043657a002d582dba5609e4959

SHA1
776e406352a2ec4033fba99a1148cc978fb19931

SHA256
f9cbcfebf6ebcdd221464ded04d7375b922a719e851a2f3b25ae6241fff76618

SHA512
a792c96f2ce28cfef3a6a6e9b9d3939b923eeb157bd41d12c19f965c54b42692272ade69b95e906fe72e714a60e51df07c86464a74e10e9331b53d7adfc23e54

Download Submit
C:\Windows\System\rcPtOOk.exe

Filesize
2.0MB

MD5
a23de2616fa180322368503539e62263

SHA1
72c2e6ef402f78b7a93000f3a6828029d7991d3b

SHA256
5a72d0fbf682bc4cf71108e5a2dcc62d99e291a935ca12d99141e5fb5a970095

SHA512
d76c15ac5076d8caf3f8a5c16a7cc4b1cee5755d8ca0355aaf97d535e137401de89ffedd4720f2d9806a2e1260bd5a5e27ef5a8fbcac2753482de7048637c5f2

Download Submit
C:\Windows\System\rwuAlCK.exe

Filesize
2.0MB

MD5
868478ece634fefc625465b6785bfb04

SHA1
f78a55456da78e0fd1ea7773a3feb6ff2ed39c9b

SHA256
769f73fb4c7c30abff7620f2837ffab5546c00c3eca3c650ee25c8a5dd4c55db

SHA512
4ff634510cf3202ef74c13f6ff495b5f1d389818543e442aa5f50c03b3724d270e50b44c6443435edd1b1b4126525d177412a539a5d5759af60cb931dcff0bc2

Download Submit
C:\Windows\System\slCklwb.exe

Filesize
2.0MB

MD5
970c83e37b3e2868066e83fc559cbbb4

SHA1
7f6297fbe35aec3ccd0ca0ae2d5d3221a5dec2fc

SHA256
baf8f1d82448dda33c2ce1ed6dce48d533eb5642d13914c6a7d0614a297d1411

SHA512
18772fb7c510be802f39fd40756a5f749ba2bfeeba634140886ecdf7f1f02370b029e27e3aa7d258ba49b32ea8b238205d32e038a51e6ee8bcdf6f749dd0caef

Download Submit
C:\Windows\System\uFFNOzH.exe

Filesize
2.0MB

MD5
87d716bec5f0745c951c747003a9e746

SHA1
6c308f383f1acb9375c0a4371cf790ea42d24790

SHA256
b90786ad34bcfa892a9b767556deb6638748cc40bce1f6e7297eb44f3a5a0975

SHA512
41a7745b4fc9d6d3bc7d0c209bd922197a2396bef4e99d650aa21abc58ab8503e7f4fd46d4c570d38fb73a8dd71d0002a8682683c70e58ac8ddf1d66d8e672e4

Download Submit
C:\Windows\System\yUKIADM.exe

Filesize
2.0MB

MD5
998c877307415714b8dda5566df2c928

SHA1
f80dee5de9ad8eaf8076a5c5bc533eb4f6f6ae85

SHA256
cad2ab9b7b17f22fec25dc4106337da75e8a37ec0f91c8ca0341b3b62aace545

SHA512
24bc51507014f44f24f6f55bffd97f7772b82e3e34aca468eb350f74a76a8879df74931b5d99ed012af9938022349620e21ecb884ec31fc1c1d3aca999a1c9e8

Download Submit
C:\Windows\System\zGINbWf.exe

Filesize
2.0MB

MD5
b6c0fb4a93486aebc6c62db2282c1925

SHA1
d65984c435bde59f8229fe034261e38a72def6cd

SHA256
38c0d34212654429ac7209bc0f536b9933ca55dddad291ef061e80507078968c

SHA512
8f6dcd9d3c3e2bdef0cb9a562a8d9f82b1290d9037f2a136f67009c808693135b33ec5cbbbcf8443b7da82a6e46f6c9956014852bfc2a107cadd5bb701f62993

Download Submit
C:\Windows\System\zrBZcYI.exe

Filesize
2.0MB

MD5
4594de1c2be8cb081ddc15eea23b3ebf

SHA1
fbb170d062ecef8fff7bf0511336551a01042baf

SHA256
7999dbd7162ff1b57beff4c1c0a4ebe1246cd5190fedc7f037a3fee44bc865ea

SHA512
5d17a63dd03b6c676f2678d26e4eedf9bd26c335139e4923513163926e5d81050e545276902389ed9c9e4ed09281782cd522f652079f596f12288dadf7e25694

Download Submit
memory/556-501-0x00007FF728470000-0x00007FF728862000-memory.dmp

Filesize
3.9MB

Download
memory/556-3724-0x00007FF728470000-0x00007FF728862000-memory.dmp

Filesize
3.9MB

Download
memory/660-84-0x00007FF6AC1D0000-0x00007FF6AC5C2000-memory.dmp

Filesize
3.9MB

Download
memory/660-3714-0x00007FF6AC1D0000-0x00007FF6AC5C2000-memory.dmp

Filesize
3.9MB

Download
memory/832-495-0x00007FF6871A0000-0x00007FF687592000-memory.dmp

Filesize
3.9MB

Download
memory/832-3751-0x00007FF6871A0000-0x00007FF687592000-memory.dmp

Filesize
3.9MB

Download
memory/836-3728-0x00007FF77AA60000-0x00007FF77AE52000-memory.dmp

Filesize
3.9MB

Download
memory/836-498-0x00007FF77AA60000-0x00007FF77AE52000-memory.dmp

Filesize
3.9MB

Download
memory/968-259-0x00007FF7294A0000-0x00007FF729892000-memory.dmp

Filesize
3.9MB

Download
memory/968-3723-0x00007FF7294A0000-0x00007FF729892000-memory.dmp

Filesize
3.9MB

Download
memory/1128-2111-0x00007FF7A7A00000-0x00007FF7A7DF2000-memory.dmp

Filesize
3.9MB

Download
memory/1128-1-0x000001A1A01D0000-0x000001A1A01E0000-memory.dmp

Filesize
64KB

Download
memory/1128-0-0x00007FF7A7A00000-0x00007FF7A7DF2000-memory.dmp

Filesize
3.9MB

Download
memory/1224-229-0x00007FF7C5020000-0x00007FF7C5412000-memory.dmp

Filesize
3.9MB

Download
memory/1224-3744-0x00007FF7C5020000-0x00007FF7C5412000-memory.dmp

Filesize
3.9MB

Download
memory/1436-3740-0x00007FF7807B0000-0x00007FF780BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1436-500-0x00007FF7807B0000-0x00007FF780BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1504-425-0x00007FF731FC0000-0x00007FF7323B2000-memory.dmp

Filesize
3.9MB

Download
memory/1504-3732-0x00007FF731FC0000-0x00007FF7323B2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-200-0x00007FF761000000-0x00007FF7613F2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-3745-0x00007FF761000000-0x00007FF7613F2000-memory.dmp

Filesize
3.9MB

Download
memory/2228-177-0x00007FF6C69F0000-0x00007FF6C6DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2228-3720-0x00007FF6C69F0000-0x00007FF6C6DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-71-0x00007FF727D10000-0x00007FF728102000-memory.dmp

Filesize
3.9MB

Download
memory/2404-3683-0x00007FF727D10000-0x00007FF728102000-memory.dmp

Filesize
3.9MB

Download
memory/2508-3738-0x00007FF7809B0000-0x00007FF780DA2000-memory.dmp

Filesize
3.9MB

Download
memory/2508-274-0x00007FF7809B0000-0x00007FF780DA2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-3730-0x00007FF72B6E0000-0x00007FF72BAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-380-0x00007FF72B6E0000-0x00007FF72BAD2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-3753-0x00007FF694470000-0x00007FF694862000-memory.dmp

Filesize
3.9MB

Download
memory/3168-494-0x00007FF694470000-0x00007FF694862000-memory.dmp

Filesize
3.9MB

Download
memory/3648-496-0x00007FFE7A260000-0x00007FFE7AD21000-memory.dmp

Filesize
10.8MB

Download
memory/3648-74-0x000001B7DFDC0000-0x000001B7DFDE2000-memory.dmp

Filesize
136KB

Download
memory/3648-39-0x00007FFE7A260000-0x00007FFE7AD21000-memory.dmp

Filesize
10.8MB

Download
memory/3648-7-0x00007FFE7A263000-0x00007FFE7A265000-memory.dmp

Filesize
8KB

Download
memory/4176-3712-0x00007FF797B80000-0x00007FF797F72000-memory.dmp

Filesize
3.9MB

Download
memory/4176-497-0x00007FF797B80000-0x00007FF797F72000-memory.dmp

Filesize
3.9MB

Download
memory/4212-3849-0x00007FF786380000-0x00007FF786772000-memory.dmp

Filesize
3.9MB

Download
memory/4212-502-0x00007FF786380000-0x00007FF786772000-memory.dmp

Filesize
3.9MB

Download
memory/4268-3747-0x00007FF67A100000-0x00007FF67A4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4268-486-0x00007FF67A100000-0x00007FF67A4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4768-330-0x00007FF6D4150000-0x00007FF6D4542000-memory.dmp

Filesize
3.9MB

Download
memory/4768-3734-0x00007FF6D4150000-0x00007FF6D4542000-memory.dmp

Filesize
3.9MB

Download
memory/4780-3716-0x00007FF6FD360000-0x00007FF6FD752000-memory.dmp

Filesize
3.9MB

Download
memory/4780-145-0x00007FF6FD360000-0x00007FF6FD752000-memory.dmp

Filesize
3.9MB

Download
memory/4840-147-0x00007FF7F5FF0000-0x00007FF7F63E2000-memory.dmp

Filesize
3.9MB

Download
memory/4840-3718-0x00007FF7F5FF0000-0x00007FF7F63E2000-memory.dmp

Filesize
3.9MB

Download
memory/4900-499-0x00007FF7F4B80000-0x00007FF7F4F72000-memory.dmp

Filesize
3.9MB

Download
memory/4900-3741-0x00007FF7F4B80000-0x00007FF7F4F72000-memory.dmp

Filesize
3.9MB

Download
memory/4972-3736-0x00007FF6C9920000-0x00007FF6C9D12000-memory.dmp

Filesize
3.9MB

Download
memory/4972-327-0x00007FF6C9920000-0x00007FF6C9D12000-memory.dmp

Filesize
3.9MB

Download
memory/5008-101-0x00007FF78A970000-0x00007FF78AD62000-memory.dmp

Filesize
3.9MB

Download
memory/5008-3696-0x00007FF78A970000-0x00007FF78AD62000-memory.dmp

Filesize
3.9MB

Download
memory/5036-3779-0x00007FF740160000-0x00007FF740552000-memory.dmp

Filesize
3.9MB

Download
memory/5036-493-0x00007FF740160000-0x00007FF740552000-memory.dmp

Filesize
3.9MB

Download