xmrig | 2c0238b02cbcb42bff6f9fa5795f77530d1bf306724301062da22feacdeeac19

Analysis

max time kernel
95s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b052297c9eec871d1c7606ee1aebd600N.exe
Size

1.7MB
MD5

b052297c9eec871d1c7606ee1aebd600
SHA1

77be232776eefefe219fc1d9edb68b7e2756aa77
SHA256

2c0238b02cbcb42bff6f9fa5795f77530d1bf306724301062da22feacdeeac19
SHA512

4b16698797a7e209606940c4a3b268a24d7b8623a5259ef837926beb57211927dc772fe3ec3436fae4c7776cb246377d49c36ac3fa468e3efab003d67abab4de
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9zF:Lz071uv4BPMkibTIA5lCx7kvRWa4pfYF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3960-210-0x00007FF71AE00000-0x00007FF71B1F2000-memory.dmp	xmrig
behavioral2/memory/4896-234-0x00007FF6A8C90000-0x00007FF6A9082000-memory.dmp	xmrig
behavioral2/memory/1120-251-0x00007FF62E3A0000-0x00007FF62E792000-memory.dmp	xmrig
behavioral2/memory/1400-263-0x00007FF672200000-0x00007FF6725F2000-memory.dmp	xmrig
behavioral2/memory/1652-266-0x00007FF60AA10000-0x00007FF60AE02000-memory.dmp	xmrig
behavioral2/memory/1680-270-0x00007FF654580000-0x00007FF654972000-memory.dmp	xmrig
behavioral2/memory/2308-1983-0x00007FF64B500000-0x00007FF64B8F2000-memory.dmp	xmrig
behavioral2/memory/4876-2349-0x00007FF723CE0000-0x00007FF7240D2000-memory.dmp	xmrig
behavioral2/memory/5036-269-0x00007FF6721D0000-0x00007FF6725C2000-memory.dmp	xmrig
behavioral2/memory/208-268-0x00007FF77F260000-0x00007FF77F652000-memory.dmp	xmrig
behavioral2/memory/1984-265-0x00007FF62DE20000-0x00007FF62E212000-memory.dmp	xmrig
behavioral2/memory/3648-264-0x00007FF73F1A0000-0x00007FF73F592000-memory.dmp	xmrig
behavioral2/memory/5056-262-0x00007FF7E82A0000-0x00007FF7E8692000-memory.dmp	xmrig
behavioral2/memory/2484-261-0x00007FF73CFB0000-0x00007FF73D3A2000-memory.dmp	xmrig
behavioral2/memory/4636-260-0x00007FF6F49F0000-0x00007FF6F4DE2000-memory.dmp	xmrig
behavioral2/memory/4336-259-0x00007FF607830000-0x00007FF607C22000-memory.dmp	xmrig
behavioral2/memory/3708-258-0x00007FF692790000-0x00007FF692B82000-memory.dmp	xmrig
behavioral2/memory/4248-257-0x00007FF76B9F0000-0x00007FF76BDE2000-memory.dmp	xmrig
behavioral2/memory/232-256-0x00007FF7270C0000-0x00007FF7274B2000-memory.dmp	xmrig
behavioral2/memory/3716-250-0x00007FF6534A0000-0x00007FF653892000-memory.dmp	xmrig
behavioral2/memory/3588-204-0x00007FF766840000-0x00007FF766C32000-memory.dmp	xmrig
behavioral2/memory/3636-162-0x00007FF623AA0000-0x00007FF623E92000-memory.dmp	xmrig
behavioral2/memory/3540-124-0x00007FF6907E0000-0x00007FF690BD2000-memory.dmp	xmrig
behavioral2/memory/4112-85-0x00007FF7446C0000-0x00007FF744AB2000-memory.dmp	xmrig
behavioral2/memory/4824-57-0x00007FF7DD760000-0x00007FF7DDB52000-memory.dmp	xmrig
behavioral2/memory/4876-2959-0x00007FF723CE0000-0x00007FF7240D2000-memory.dmp	xmrig
behavioral2/memory/4824-2961-0x00007FF7DD760000-0x00007FF7DDB52000-memory.dmp	xmrig
behavioral2/memory/4112-2963-0x00007FF7446C0000-0x00007FF744AB2000-memory.dmp	xmrig
behavioral2/memory/3540-2965-0x00007FF6907E0000-0x00007FF690BD2000-memory.dmp	xmrig
behavioral2/memory/3588-2967-0x00007FF766840000-0x00007FF766C32000-memory.dmp	xmrig
behavioral2/memory/3636-2969-0x00007FF623AA0000-0x00007FF623E92000-memory.dmp	xmrig
behavioral2/memory/3960-2971-0x00007FF71AE00000-0x00007FF71B1F2000-memory.dmp	xmrig
behavioral2/memory/4896-2973-0x00007FF6A8C90000-0x00007FF6A9082000-memory.dmp	xmrig
behavioral2/memory/3716-2975-0x00007FF6534A0000-0x00007FF653892000-memory.dmp	xmrig
behavioral2/memory/4336-2977-0x00007FF607830000-0x00007FF607C22000-memory.dmp	xmrig
behavioral2/memory/4636-2981-0x00007FF6F49F0000-0x00007FF6F4DE2000-memory.dmp	xmrig
behavioral2/memory/1120-2980-0x00007FF62E3A0000-0x00007FF62E792000-memory.dmp	xmrig
behavioral2/memory/4248-2989-0x00007FF76B9F0000-0x00007FF76BDE2000-memory.dmp	xmrig
behavioral2/memory/208-2988-0x00007FF77F260000-0x00007FF77F652000-memory.dmp	xmrig
behavioral2/memory/1984-2985-0x00007FF62DE20000-0x00007FF62E212000-memory.dmp	xmrig
behavioral2/memory/232-2983-0x00007FF7270C0000-0x00007FF7274B2000-memory.dmp	xmrig
behavioral2/memory/5036-3005-0x00007FF6721D0000-0x00007FF6725C2000-memory.dmp	xmrig
behavioral2/memory/5056-3016-0x00007FF7E82A0000-0x00007FF7E8692000-memory.dmp	xmrig
behavioral2/memory/1680-3018-0x00007FF654580000-0x00007FF654972000-memory.dmp	xmrig
behavioral2/memory/2484-3025-0x00007FF73CFB0000-0x00007FF73D3A2000-memory.dmp	xmrig
behavioral2/memory/1652-3022-0x00007FF60AA10000-0x00007FF60AE02000-memory.dmp	xmrig
behavioral2/memory/1400-3011-0x00007FF672200000-0x00007FF6725F2000-memory.dmp	xmrig
behavioral2/memory/3648-3014-0x00007FF73F1A0000-0x00007FF73F592000-memory.dmp	xmrig
behavioral2/memory/3708-2995-0x00007FF692790000-0x00007FF692B82000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3248	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4876	pKTlplK.exe
4824	NzNfcge.exe
4112	byMBZAi.exe
3540	FoWaqXR.exe
3636	yEpxISI.exe
3588	jTKLgao.exe
3960	TkkBoaU.exe
4896	KgdUnUX.exe
3716	iaWtUhb.exe
1120	mLANDGo.exe
232	tZkNTLm.exe
208	dSaqQpi.exe
4248	aCpehff.exe
3708	jJwGYej.exe
4336	gdQSRRd.exe
4636	ekojUzW.exe
5036	XyvmGRJ.exe
2484	beJjhUv.exe
5056	SxtMBtq.exe
1400	XyWmcIQ.exe
3648	ilsYTjt.exe
1680	FfvKoRE.exe
1984	iPuXyXh.exe
1652	UQrlvpG.exe
2512	IoTPueM.exe
2444	TZlOTNg.exe
4984	ttDNmGN.exe
4304	ePhbCRd.exe
3220	hLskEVb.exe
1536	lOdSQaQ.exe
2776	saToYkG.exe
2672	FCdPQJW.exe
740	sUIjFqX.exe
2056	faVYNHp.exe
4424	KeLELFn.exe
4612	vNtPnee.exe
4748	yyNaZew.exe
4292	JIXtPHk.exe
3472	akSYaql.exe
4520	qDyiQvo.exe
3396	pdtxxFB.exe
1784	RpgsqmN.exe
1228	oGzxcpZ.exe
2636	yWdoSrp.exe
2864	zRXqZpc.exe
4820	cAnLyiN.exe
1708	pVzrvNJ.exe
3880	olHQSbl.exe
4804	PAeXOje.exe
1644	qmvtHnV.exe
3060	CNcEqPV.exe
2668	tDwKRbL.exe
2552	dneDbAw.exe
5044	AsORHji.exe
2468	cpEOKkb.exe
2728	IqyeyjT.exe
4836	qXTwGUL.exe
4904	gdqVGjd.exe
2688	BGShfWK.exe
4244	IDPUKEZ.exe
4488	qdrNwxq.exe
4536	mUrUoti.exe
2204	ZddcEAG.exe
2104	TbrUWaa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2308-0-0x00007FF64B500000-0x00007FF64B8F2000-memory.dmp	upx
behavioral2/files/0x00070000000234c8-10.dat	upx
behavioral2/memory/4876-11-0x00007FF723CE0000-0x00007FF7240D2000-memory.dmp	upx
behavioral2/files/0x00070000000234c9-21.dat	upx
behavioral2/files/0x00070000000234cc-42.dat	upx
behavioral2/files/0x00070000000234da-178.dat	upx
behavioral2/memory/3960-210-0x00007FF71AE00000-0x00007FF71B1F2000-memory.dmp	upx
behavioral2/memory/4896-234-0x00007FF6A8C90000-0x00007FF6A9082000-memory.dmp	upx
behavioral2/memory/1120-251-0x00007FF62E3A0000-0x00007FF62E792000-memory.dmp	upx
behavioral2/memory/1400-263-0x00007FF672200000-0x00007FF6725F2000-memory.dmp	upx
behavioral2/memory/1652-266-0x00007FF60AA10000-0x00007FF60AE02000-memory.dmp	upx
behavioral2/memory/1680-270-0x00007FF654580000-0x00007FF654972000-memory.dmp	upx
behavioral2/memory/2308-1983-0x00007FF64B500000-0x00007FF64B8F2000-memory.dmp	upx
behavioral2/memory/4876-2349-0x00007FF723CE0000-0x00007FF7240D2000-memory.dmp	upx
behavioral2/memory/5036-269-0x00007FF6721D0000-0x00007FF6725C2000-memory.dmp	upx
behavioral2/memory/208-268-0x00007FF77F260000-0x00007FF77F652000-memory.dmp	upx
behavioral2/memory/1984-265-0x00007FF62DE20000-0x00007FF62E212000-memory.dmp	upx
behavioral2/memory/3648-264-0x00007FF73F1A0000-0x00007FF73F592000-memory.dmp	upx
behavioral2/memory/5056-262-0x00007FF7E82A0000-0x00007FF7E8692000-memory.dmp	upx
behavioral2/memory/2484-261-0x00007FF73CFB0000-0x00007FF73D3A2000-memory.dmp	upx
behavioral2/memory/4636-260-0x00007FF6F49F0000-0x00007FF6F4DE2000-memory.dmp	upx
behavioral2/memory/4336-259-0x00007FF607830000-0x00007FF607C22000-memory.dmp	upx
behavioral2/memory/3708-258-0x00007FF692790000-0x00007FF692B82000-memory.dmp	upx
behavioral2/memory/4248-257-0x00007FF76B9F0000-0x00007FF76BDE2000-memory.dmp	upx
behavioral2/memory/232-256-0x00007FF7270C0000-0x00007FF7274B2000-memory.dmp	upx
behavioral2/memory/3716-250-0x00007FF6534A0000-0x00007FF653892000-memory.dmp	upx
behavioral2/memory/3588-204-0x00007FF766840000-0x00007FF766C32000-memory.dmp	upx
behavioral2/files/0x00070000000234ee-202.dat	upx
behavioral2/files/0x00070000000234ed-201.dat	upx
behavioral2/files/0x00070000000234ec-200.dat	upx
behavioral2/files/0x00070000000234eb-199.dat	upx
behavioral2/files/0x00070000000234dd-197.dat	upx
behavioral2/files/0x00080000000234e4-196.dat	upx
behavioral2/files/0x00070000000234df-183.dat	upx
behavioral2/files/0x00070000000234d9-182.dat	upx
behavioral2/files/0x00070000000234e9-175.dat	upx
behavioral2/files/0x00070000000234e8-173.dat	upx
behavioral2/files/0x00070000000234d8-168.dat	upx
behavioral2/memory/3636-162-0x00007FF623AA0000-0x00007FF623E92000-memory.dmp	upx
behavioral2/files/0x00070000000234e2-158.dat	upx
behavioral2/files/0x00070000000234e6-157.dat	upx
behavioral2/files/0x00070000000234e5-151.dat	upx
behavioral2/files/0x00070000000234e1-142.dat	upx
behavioral2/files/0x00070000000234ea-187.dat	upx
behavioral2/files/0x00070000000234e0-139.dat	upx
behavioral2/files/0x00070000000234db-184.dat	upx
behavioral2/files/0x00070000000234d7-133.dat	upx
behavioral2/files/0x00070000000234de-132.dat	upx
behavioral2/files/0x00070000000234d6-129.dat	upx
behavioral2/files/0x00070000000234e7-167.dat	upx
behavioral2/memory/3540-124-0x00007FF6907E0000-0x00007FF690BD2000-memory.dmp	upx
behavioral2/files/0x00070000000234d0-120.dat	upx
behavioral2/files/0x00070000000234d3-109.dat	upx
behavioral2/files/0x00070000000234d2-106.dat	upx
behavioral2/files/0x00070000000234d5-99.dat	upx
behavioral2/files/0x00070000000234dc-140.dat	upx
behavioral2/files/0x00070000000234d4-97.dat	upx
behavioral2/files/0x00070000000234cf-88.dat	upx
behavioral2/memory/4112-85-0x00007FF7446C0000-0x00007FF744AB2000-memory.dmp	upx
behavioral2/files/0x00070000000234ce-74.dat	upx
behavioral2/files/0x00070000000234cd-68.dat	upx
behavioral2/files/0x00070000000234d1-91.dat	upx
behavioral2/files/0x00070000000234ca-62.dat	upx
behavioral2/memory/4824-57-0x00007FF7DD760000-0x00007FF7DDB52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hEJyjJQ.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\ceYECKc.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\yWdoSrp.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\lhCmqLz.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\bVYtKpi.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\QlWROYu.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\HrPtPrF.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\JyvSstu.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\uQCxImu.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\zZHlHqi.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\AOPUkNI.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\PkcebYm.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\qKkjJDs.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\pVzrvNJ.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\IqyeyjT.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\MCOtZkd.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\wzunXFY.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\fjRGSOj.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\cbGJvVv.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\bondnms.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\oxbACNr.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\IvTlrDW.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\WiqcjJn.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\RcVzdjx.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\YdmTuiY.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\QDJqUEc.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\QMGmJmc.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\VhRZwmg.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\cGWEIzn.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\tGHFwPU.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\CRiwgwz.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\zEPJEHr.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\OmhujrA.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\WbUnmWC.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\fOqzwum.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\vNugIab.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\avcfAIi.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\sgPqzUv.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\NhAOGWn.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\akSYaql.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\pMoNfHJ.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\TGpcZpG.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\wedpnPw.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\THVrkfV.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\wrTSArD.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\CXmPADA.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\BIvdQJB.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\tlNizMb.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\pxfrlpi.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\TefDspG.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\mdavbdh.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\uRwhQeN.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\WHXoXDY.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\amxwRwf.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\FoWaqXR.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\pBZxnfm.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\QGcmAOM.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\tPvPPxc.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\HCPPzqJ.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\yXVhqui.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\sPXsKDP.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\rnyebYj.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\wOzKKLQ.exe	b052297c9eec871d1c7606ee1aebd600N.exe
File created	C:\Windows\System\DlGJgPo.exe	b052297c9eec871d1c7606ee1aebd600N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3248	powershell.exe
3248	powershell.exe
3248	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2308	b052297c9eec871d1c7606ee1aebd600N.exe
Token: SeLockMemoryPrivilege	2308	b052297c9eec871d1c7606ee1aebd600N.exe
Token: SeDebugPrivilege	3248	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 3248	2308	b052297c9eec871d1c7606ee1aebd600N.exe	84
PID 2308 wrote to memory of 3248	2308	b052297c9eec871d1c7606ee1aebd600N.exe	84
PID 2308 wrote to memory of 4876	2308	b052297c9eec871d1c7606ee1aebd600N.exe	85
PID 2308 wrote to memory of 4876	2308	b052297c9eec871d1c7606ee1aebd600N.exe	85
PID 2308 wrote to memory of 4824	2308	b052297c9eec871d1c7606ee1aebd600N.exe	86
PID 2308 wrote to memory of 4824	2308	b052297c9eec871d1c7606ee1aebd600N.exe	86
PID 2308 wrote to memory of 4112	2308	b052297c9eec871d1c7606ee1aebd600N.exe	87
PID 2308 wrote to memory of 4112	2308	b052297c9eec871d1c7606ee1aebd600N.exe	87
PID 2308 wrote to memory of 3540	2308	b052297c9eec871d1c7606ee1aebd600N.exe	88
PID 2308 wrote to memory of 3540	2308	b052297c9eec871d1c7606ee1aebd600N.exe	88
PID 2308 wrote to memory of 3636	2308	b052297c9eec871d1c7606ee1aebd600N.exe	89
PID 2308 wrote to memory of 3636	2308	b052297c9eec871d1c7606ee1aebd600N.exe	89
PID 2308 wrote to memory of 3588	2308	b052297c9eec871d1c7606ee1aebd600N.exe	90
PID 2308 wrote to memory of 3588	2308	b052297c9eec871d1c7606ee1aebd600N.exe	90
PID 2308 wrote to memory of 3960	2308	b052297c9eec871d1c7606ee1aebd600N.exe	91
PID 2308 wrote to memory of 3960	2308	b052297c9eec871d1c7606ee1aebd600N.exe	91
PID 2308 wrote to memory of 4896	2308	b052297c9eec871d1c7606ee1aebd600N.exe	92
PID 2308 wrote to memory of 4896	2308	b052297c9eec871d1c7606ee1aebd600N.exe	92
PID 2308 wrote to memory of 3716	2308	b052297c9eec871d1c7606ee1aebd600N.exe	93
PID 2308 wrote to memory of 3716	2308	b052297c9eec871d1c7606ee1aebd600N.exe	93
PID 2308 wrote to memory of 1120	2308	b052297c9eec871d1c7606ee1aebd600N.exe	94
PID 2308 wrote to memory of 1120	2308	b052297c9eec871d1c7606ee1aebd600N.exe	94
PID 2308 wrote to memory of 3708	2308	b052297c9eec871d1c7606ee1aebd600N.exe	95
PID 2308 wrote to memory of 3708	2308	b052297c9eec871d1c7606ee1aebd600N.exe	95
PID 2308 wrote to memory of 232	2308	b052297c9eec871d1c7606ee1aebd600N.exe	96
PID 2308 wrote to memory of 232	2308	b052297c9eec871d1c7606ee1aebd600N.exe	96
PID 2308 wrote to memory of 208	2308	b052297c9eec871d1c7606ee1aebd600N.exe	97
PID 2308 wrote to memory of 208	2308	b052297c9eec871d1c7606ee1aebd600N.exe	97
PID 2308 wrote to memory of 4248	2308	b052297c9eec871d1c7606ee1aebd600N.exe	98
PID 2308 wrote to memory of 4248	2308	b052297c9eec871d1c7606ee1aebd600N.exe	98
PID 2308 wrote to memory of 4336	2308	b052297c9eec871d1c7606ee1aebd600N.exe	99
PID 2308 wrote to memory of 4336	2308	b052297c9eec871d1c7606ee1aebd600N.exe	99
PID 2308 wrote to memory of 4636	2308	b052297c9eec871d1c7606ee1aebd600N.exe	100
PID 2308 wrote to memory of 4636	2308	b052297c9eec871d1c7606ee1aebd600N.exe	100
PID 2308 wrote to memory of 1680	2308	b052297c9eec871d1c7606ee1aebd600N.exe	101
PID 2308 wrote to memory of 1680	2308	b052297c9eec871d1c7606ee1aebd600N.exe	101
PID 2308 wrote to memory of 1984	2308	b052297c9eec871d1c7606ee1aebd600N.exe	102
PID 2308 wrote to memory of 1984	2308	b052297c9eec871d1c7606ee1aebd600N.exe	102
PID 2308 wrote to memory of 5036	2308	b052297c9eec871d1c7606ee1aebd600N.exe	103
PID 2308 wrote to memory of 5036	2308	b052297c9eec871d1c7606ee1aebd600N.exe	103
PID 2308 wrote to memory of 2484	2308	b052297c9eec871d1c7606ee1aebd600N.exe	104
PID 2308 wrote to memory of 2484	2308	b052297c9eec871d1c7606ee1aebd600N.exe	104
PID 2308 wrote to memory of 5056	2308	b052297c9eec871d1c7606ee1aebd600N.exe	105
PID 2308 wrote to memory of 5056	2308	b052297c9eec871d1c7606ee1aebd600N.exe	105
PID 2308 wrote to memory of 1400	2308	b052297c9eec871d1c7606ee1aebd600N.exe	106
PID 2308 wrote to memory of 1400	2308	b052297c9eec871d1c7606ee1aebd600N.exe	106
PID 2308 wrote to memory of 4984	2308	b052297c9eec871d1c7606ee1aebd600N.exe	107
PID 2308 wrote to memory of 4984	2308	b052297c9eec871d1c7606ee1aebd600N.exe	107
PID 2308 wrote to memory of 3648	2308	b052297c9eec871d1c7606ee1aebd600N.exe	108
PID 2308 wrote to memory of 3648	2308	b052297c9eec871d1c7606ee1aebd600N.exe	108
PID 2308 wrote to memory of 1652	2308	b052297c9eec871d1c7606ee1aebd600N.exe	109
PID 2308 wrote to memory of 1652	2308	b052297c9eec871d1c7606ee1aebd600N.exe	109
PID 2308 wrote to memory of 2512	2308	b052297c9eec871d1c7606ee1aebd600N.exe	110
PID 2308 wrote to memory of 2512	2308	b052297c9eec871d1c7606ee1aebd600N.exe	110
PID 2308 wrote to memory of 2444	2308	b052297c9eec871d1c7606ee1aebd600N.exe	111
PID 2308 wrote to memory of 2444	2308	b052297c9eec871d1c7606ee1aebd600N.exe	111
PID 2308 wrote to memory of 4304	2308	b052297c9eec871d1c7606ee1aebd600N.exe	112
PID 2308 wrote to memory of 4304	2308	b052297c9eec871d1c7606ee1aebd600N.exe	112
PID 2308 wrote to memory of 3220	2308	b052297c9eec871d1c7606ee1aebd600N.exe	113
PID 2308 wrote to memory of 3220	2308	b052297c9eec871d1c7606ee1aebd600N.exe	113
PID 2308 wrote to memory of 1536	2308	b052297c9eec871d1c7606ee1aebd600N.exe	114
PID 2308 wrote to memory of 1536	2308	b052297c9eec871d1c7606ee1aebd600N.exe	114
PID 2308 wrote to memory of 2776	2308	b052297c9eec871d1c7606ee1aebd600N.exe	115
PID 2308 wrote to memory of 2776	2308	b052297c9eec871d1c7606ee1aebd600N.exe	115

C:\Users\Admin\AppData\Local\Temp\b052297c9eec871d1c7606ee1aebd600N.exe
"C:\Users\Admin\AppData\Local\Temp\b052297c9eec871d1c7606ee1aebd600N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3248
- C:\Windows\System\pKTlplK.exe
  C:\Windows\System\pKTlplK.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\NzNfcge.exe
  C:\Windows\System\NzNfcge.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\byMBZAi.exe
  C:\Windows\System\byMBZAi.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\FoWaqXR.exe
  C:\Windows\System\FoWaqXR.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\yEpxISI.exe
  C:\Windows\System\yEpxISI.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\jTKLgao.exe
  C:\Windows\System\jTKLgao.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\TkkBoaU.exe
  C:\Windows\System\TkkBoaU.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\KgdUnUX.exe
  C:\Windows\System\KgdUnUX.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\iaWtUhb.exe
  C:\Windows\System\iaWtUhb.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\mLANDGo.exe
  C:\Windows\System\mLANDGo.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\jJwGYej.exe
  C:\Windows\System\jJwGYej.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\tZkNTLm.exe
  C:\Windows\System\tZkNTLm.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\dSaqQpi.exe
  C:\Windows\System\dSaqQpi.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\aCpehff.exe
  C:\Windows\System\aCpehff.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\gdQSRRd.exe
  C:\Windows\System\gdQSRRd.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\ekojUzW.exe
  C:\Windows\System\ekojUzW.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\FfvKoRE.exe
  C:\Windows\System\FfvKoRE.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\iPuXyXh.exe
  C:\Windows\System\iPuXyXh.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\XyvmGRJ.exe
  C:\Windows\System\XyvmGRJ.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\beJjhUv.exe
  C:\Windows\System\beJjhUv.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\SxtMBtq.exe
  C:\Windows\System\SxtMBtq.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\XyWmcIQ.exe
  C:\Windows\System\XyWmcIQ.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\ttDNmGN.exe
  C:\Windows\System\ttDNmGN.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\ilsYTjt.exe
  C:\Windows\System\ilsYTjt.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\UQrlvpG.exe
  C:\Windows\System\UQrlvpG.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\IoTPueM.exe
  C:\Windows\System\IoTPueM.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\TZlOTNg.exe
  C:\Windows\System\TZlOTNg.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\ePhbCRd.exe
  C:\Windows\System\ePhbCRd.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\hLskEVb.exe
  C:\Windows\System\hLskEVb.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\lOdSQaQ.exe
  C:\Windows\System\lOdSQaQ.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\saToYkG.exe
  C:\Windows\System\saToYkG.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\FCdPQJW.exe
  C:\Windows\System\FCdPQJW.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\sUIjFqX.exe
  C:\Windows\System\sUIjFqX.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\faVYNHp.exe
  C:\Windows\System\faVYNHp.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\KeLELFn.exe
  C:\Windows\System\KeLELFn.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\vNtPnee.exe
  C:\Windows\System\vNtPnee.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\yyNaZew.exe
  C:\Windows\System\yyNaZew.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\JIXtPHk.exe
  C:\Windows\System\JIXtPHk.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\akSYaql.exe
  C:\Windows\System\akSYaql.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\qDyiQvo.exe
  C:\Windows\System\qDyiQvo.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\pdtxxFB.exe
  C:\Windows\System\pdtxxFB.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\RpgsqmN.exe
  C:\Windows\System\RpgsqmN.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\oGzxcpZ.exe
  C:\Windows\System\oGzxcpZ.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\cpEOKkb.exe
  C:\Windows\System\cpEOKkb.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\yWdoSrp.exe
  C:\Windows\System\yWdoSrp.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\zRXqZpc.exe
  C:\Windows\System\zRXqZpc.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\cAnLyiN.exe
  C:\Windows\System\cAnLyiN.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\pVzrvNJ.exe
  C:\Windows\System\pVzrvNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\olHQSbl.exe
  C:\Windows\System\olHQSbl.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\PAeXOje.exe
  C:\Windows\System\PAeXOje.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\qmvtHnV.exe
  C:\Windows\System\qmvtHnV.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\CNcEqPV.exe
  C:\Windows\System\CNcEqPV.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\tDwKRbL.exe
  C:\Windows\System\tDwKRbL.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\dneDbAw.exe
  C:\Windows\System\dneDbAw.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\AsORHji.exe
  C:\Windows\System\AsORHji.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\IqyeyjT.exe
  C:\Windows\System\IqyeyjT.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\qXTwGUL.exe
  C:\Windows\System\qXTwGUL.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\gdqVGjd.exe
  C:\Windows\System\gdqVGjd.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\BGShfWK.exe
  C:\Windows\System\BGShfWK.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\IDPUKEZ.exe
  C:\Windows\System\IDPUKEZ.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\qdrNwxq.exe
  C:\Windows\System\qdrNwxq.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\mUrUoti.exe
  C:\Windows\System\mUrUoti.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\ZddcEAG.exe
  C:\Windows\System\ZddcEAG.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\TbrUWaa.exe
  C:\Windows\System\TbrUWaa.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\EbQNoMi.exe
  C:\Windows\System\EbQNoMi.exe
  2⤵
  PID:3464
- C:\Windows\System\fKeNAIR.exe
  C:\Windows\System\fKeNAIR.exe
  2⤵
  PID:2160
- C:\Windows\System\clfvSdd.exe
  C:\Windows\System\clfvSdd.exe
  2⤵
  PID:4644
- C:\Windows\System\HrvjLnB.exe
  C:\Windows\System\HrvjLnB.exe
  2⤵
  PID:4516
- C:\Windows\System\pBZxnfm.exe
  C:\Windows\System\pBZxnfm.exe
  2⤵
  PID:1660
- C:\Windows\System\wjfSmCy.exe
  C:\Windows\System\wjfSmCy.exe
  2⤵
  PID:4600
- C:\Windows\System\VhzFyLW.exe
  C:\Windows\System\VhzFyLW.exe
  2⤵
  PID:4492
- C:\Windows\System\SiDOlOM.exe
  C:\Windows\System\SiDOlOM.exe
  2⤵
  PID:916
- C:\Windows\System\WilIHwq.exe
  C:\Windows\System\WilIHwq.exe
  2⤵
  PID:5016
- C:\Windows\System\EaomzNU.exe
  C:\Windows\System\EaomzNU.exe
  2⤵
  PID:4768
- C:\Windows\System\fOqzwum.exe
  C:\Windows\System\fOqzwum.exe
  2⤵
  PID:1956
- C:\Windows\System\zEWWTZg.exe
  C:\Windows\System\zEWWTZg.exe
  2⤵
  PID:896
- C:\Windows\System\KsBypVP.exe
  C:\Windows\System\KsBypVP.exe
  2⤵
  PID:3696
- C:\Windows\System\afazGTD.exe
  C:\Windows\System\afazGTD.exe
  2⤵
  PID:1156
- C:\Windows\System\sTDyMsg.exe
  C:\Windows\System\sTDyMsg.exe
  2⤵
  PID:4532
- C:\Windows\System\MWTsFXB.exe
  C:\Windows\System\MWTsFXB.exe
  2⤵
  PID:1924
- C:\Windows\System\iKcuaGK.exe
  C:\Windows\System\iKcuaGK.exe
  2⤵
  PID:3620
- C:\Windows\System\JeKNdfJ.exe
  C:\Windows\System\JeKNdfJ.exe
  2⤵
  PID:5032
- C:\Windows\System\PKrOQXj.exe
  C:\Windows\System\PKrOQXj.exe
  2⤵
  PID:1280
- C:\Windows\System\EWJFcxf.exe
  C:\Windows\System\EWJFcxf.exe
  2⤵
  PID:724
- C:\Windows\System\AcnYuQQ.exe
  C:\Windows\System\AcnYuQQ.exe
  2⤵
  PID:5124
- C:\Windows\System\BYTRKMs.exe
  C:\Windows\System\BYTRKMs.exe
  2⤵
  PID:5144
- C:\Windows\System\NKUuNYq.exe
  C:\Windows\System\NKUuNYq.exe
  2⤵
  PID:5168
- C:\Windows\System\aKVPuhu.exe
  C:\Windows\System\aKVPuhu.exe
  2⤵
  PID:5184
- C:\Windows\System\rnKtTkB.exe
  C:\Windows\System\rnKtTkB.exe
  2⤵
  PID:5208
- C:\Windows\System\XcWCWiN.exe
  C:\Windows\System\XcWCWiN.exe
  2⤵
  PID:5232
- C:\Windows\System\sKixeeF.exe
  C:\Windows\System\sKixeeF.exe
  2⤵
  PID:5248
- C:\Windows\System\vOdxHnn.exe
  C:\Windows\System\vOdxHnn.exe
  2⤵
  PID:5272
- C:\Windows\System\fUlksds.exe
  C:\Windows\System\fUlksds.exe
  2⤵
  PID:5296
- C:\Windows\System\oyPkCCY.exe
  C:\Windows\System\oyPkCCY.exe
  2⤵
  PID:5328
- C:\Windows\System\GWesYmn.exe
  C:\Windows\System\GWesYmn.exe
  2⤵
  PID:5344
- C:\Windows\System\yJdTgkk.exe
  C:\Windows\System\yJdTgkk.exe
  2⤵
  PID:5372
- C:\Windows\System\Zorqyle.exe
  C:\Windows\System\Zorqyle.exe
  2⤵
  PID:5392
- C:\Windows\System\rNRSNVs.exe
  C:\Windows\System\rNRSNVs.exe
  2⤵
  PID:5412
- C:\Windows\System\GqpMXfy.exe
  C:\Windows\System\GqpMXfy.exe
  2⤵
  PID:5428
- C:\Windows\System\rzEyGeh.exe
  C:\Windows\System\rzEyGeh.exe
  2⤵
  PID:5452
- C:\Windows\System\WhjHyCk.exe
  C:\Windows\System\WhjHyCk.exe
  2⤵
  PID:5480
- C:\Windows\System\wbaqnQu.exe
  C:\Windows\System\wbaqnQu.exe
  2⤵
  PID:5504
- C:\Windows\System\nferxVT.exe
  C:\Windows\System\nferxVT.exe
  2⤵
  PID:5528
- C:\Windows\System\QJQjBPZ.exe
  C:\Windows\System\QJQjBPZ.exe
  2⤵
  PID:5548
- C:\Windows\System\gxEIwPh.exe
  C:\Windows\System\gxEIwPh.exe
  2⤵
  PID:5564
- C:\Windows\System\rnyebYj.exe
  C:\Windows\System\rnyebYj.exe
  2⤵
  PID:5580
- C:\Windows\System\VyRoFdO.exe
  C:\Windows\System\VyRoFdO.exe
  2⤵
  PID:5600
- C:\Windows\System\SlvzeQO.exe
  C:\Windows\System\SlvzeQO.exe
  2⤵
  PID:5696
- C:\Windows\System\CoOHKlZ.exe
  C:\Windows\System\CoOHKlZ.exe
  2⤵
  PID:5716
- C:\Windows\System\XXBLjLt.exe
  C:\Windows\System\XXBLjLt.exe
  2⤵
  PID:5740
- C:\Windows\System\GVQRwWS.exe
  C:\Windows\System\GVQRwWS.exe
  2⤵
  PID:5792
- C:\Windows\System\LVPFmNF.exe
  C:\Windows\System\LVPFmNF.exe
  2⤵
  PID:5808
- C:\Windows\System\KkSqsSD.exe
  C:\Windows\System\KkSqsSD.exe
  2⤵
  PID:5828
- C:\Windows\System\sjpRFgK.exe
  C:\Windows\System\sjpRFgK.exe
  2⤵
  PID:5844
- C:\Windows\System\cGWEIzn.exe
  C:\Windows\System\cGWEIzn.exe
  2⤵
  PID:5868
- C:\Windows\System\GIyIYAd.exe
  C:\Windows\System\GIyIYAd.exe
  2⤵
  PID:5884
- C:\Windows\System\olsXTNv.exe
  C:\Windows\System\olsXTNv.exe
  2⤵
  PID:5900
- C:\Windows\System\lFZUjgQ.exe
  C:\Windows\System\lFZUjgQ.exe
  2⤵
  PID:5932
- C:\Windows\System\YvyKHTI.exe
  C:\Windows\System\YvyKHTI.exe
  2⤵
  PID:5948
- C:\Windows\System\frqvJGx.exe
  C:\Windows\System\frqvJGx.exe
  2⤵
  PID:5964
- C:\Windows\System\MXfAiWH.exe
  C:\Windows\System\MXfAiWH.exe
  2⤵
  PID:5980
- C:\Windows\System\wjDByug.exe
  C:\Windows\System\wjDByug.exe
  2⤵
  PID:5996
- C:\Windows\System\gaAFjqd.exe
  C:\Windows\System\gaAFjqd.exe
  2⤵
  PID:6012
- C:\Windows\System\YjHOgZI.exe
  C:\Windows\System\YjHOgZI.exe
  2⤵
  PID:6032
- C:\Windows\System\yXPkjtk.exe
  C:\Windows\System\yXPkjtk.exe
  2⤵
  PID:4692
- C:\Windows\System\lhCmqLz.exe
  C:\Windows\System\lhCmqLz.exe
  2⤵
  PID:5004
- C:\Windows\System\JhvaDLO.exe
  C:\Windows\System\JhvaDLO.exe
  2⤵
  PID:4660
- C:\Windows\System\AdcVjgy.exe
  C:\Windows\System\AdcVjgy.exe
  2⤵
  PID:3436
- C:\Windows\System\fXJJgMY.exe
  C:\Windows\System\fXJJgMY.exe
  2⤵
  PID:1736
- C:\Windows\System\fCRJAjg.exe
  C:\Windows\System\fCRJAjg.exe
  2⤵
  PID:2756
- C:\Windows\System\adBlewg.exe
  C:\Windows\System\adBlewg.exe
  2⤵
  PID:964
- C:\Windows\System\sVNPkYD.exe
  C:\Windows\System\sVNPkYD.exe
  2⤵
  PID:2164
- C:\Windows\System\tHErpvU.exe
  C:\Windows\System\tHErpvU.exe
  2⤵
  PID:2480
- C:\Windows\System\glsBIDy.exe
  C:\Windows\System\glsBIDy.exe
  2⤵
  PID:1568
- C:\Windows\System\WKLAJUh.exe
  C:\Windows\System\WKLAJUh.exe
  2⤵
  PID:1948
- C:\Windows\System\TcUKhbU.exe
  C:\Windows\System\TcUKhbU.exe
  2⤵
  PID:5464
- C:\Windows\System\tkTvWIT.exe
  C:\Windows\System\tkTvWIT.exe
  2⤵
  PID:3288
- C:\Windows\System\zPWRBDf.exe
  C:\Windows\System\zPWRBDf.exe
  2⤵
  PID:5608
- C:\Windows\System\dbJrmpR.exe
  C:\Windows\System\dbJrmpR.exe
  2⤵
  PID:6156
- C:\Windows\System\dWdrAbF.exe
  C:\Windows\System\dWdrAbF.exe
  2⤵
  PID:6172
- C:\Windows\System\JTdYlrY.exe
  C:\Windows\System\JTdYlrY.exe
  2⤵
  PID:6228
- C:\Windows\System\BioTcvG.exe
  C:\Windows\System\BioTcvG.exe
  2⤵
  PID:6244
- C:\Windows\System\TfLeBcc.exe
  C:\Windows\System\TfLeBcc.exe
  2⤵
  PID:6264
- C:\Windows\System\yAMiGCb.exe
  C:\Windows\System\yAMiGCb.exe
  2⤵
  PID:6448
- C:\Windows\System\CxRPuBf.exe
  C:\Windows\System\CxRPuBf.exe
  2⤵
  PID:6476
- C:\Windows\System\Qdnakpd.exe
  C:\Windows\System\Qdnakpd.exe
  2⤵
  PID:6496
- C:\Windows\System\THVrkfV.exe
  C:\Windows\System\THVrkfV.exe
  2⤵
  PID:6512
- C:\Windows\System\JlAoUTK.exe
  C:\Windows\System\JlAoUTK.exe
  2⤵
  PID:6532
- C:\Windows\System\YIbePOi.exe
  C:\Windows\System\YIbePOi.exe
  2⤵
  PID:6552
- C:\Windows\System\HNQslMD.exe
  C:\Windows\System\HNQslMD.exe
  2⤵
  PID:6572
- C:\Windows\System\liJChZd.exe
  C:\Windows\System\liJChZd.exe
  2⤵
  PID:6588
- C:\Windows\System\vvwfZyo.exe
  C:\Windows\System\vvwfZyo.exe
  2⤵
  PID:6608
- C:\Windows\System\otmBQQq.exe
  C:\Windows\System\otmBQQq.exe
  2⤵
  PID:6628
- C:\Windows\System\zAkyMkH.exe
  C:\Windows\System\zAkyMkH.exe
  2⤵
  PID:6644
- C:\Windows\System\rIdSQSm.exe
  C:\Windows\System\rIdSQSm.exe
  2⤵
  PID:6664
- C:\Windows\System\vLNfVpX.exe
  C:\Windows\System\vLNfVpX.exe
  2⤵
  PID:6684
- C:\Windows\System\megmbby.exe
  C:\Windows\System\megmbby.exe
  2⤵
  PID:6704
- C:\Windows\System\OZmpxOG.exe
  C:\Windows\System\OZmpxOG.exe
  2⤵
  PID:6720
- C:\Windows\System\YdmwxGC.exe
  C:\Windows\System\YdmwxGC.exe
  2⤵
  PID:6808
- C:\Windows\System\cGIZqWr.exe
  C:\Windows\System\cGIZqWr.exe
  2⤵
  PID:6824
- C:\Windows\System\VISIowc.exe
  C:\Windows\System\VISIowc.exe
  2⤵
  PID:6884
- C:\Windows\System\tyrEkBb.exe
  C:\Windows\System\tyrEkBb.exe
  2⤵
  PID:6904
- C:\Windows\System\jmxWKrS.exe
  C:\Windows\System\jmxWKrS.exe
  2⤵
  PID:6928
- C:\Windows\System\etcgOjy.exe
  C:\Windows\System\etcgOjy.exe
  2⤵
  PID:6948
- C:\Windows\System\LamuyVk.exe
  C:\Windows\System\LamuyVk.exe
  2⤵
  PID:6964
- C:\Windows\System\VRprhpV.exe
  C:\Windows\System\VRprhpV.exe
  2⤵
  PID:6988
- C:\Windows\System\olCSkRw.exe
  C:\Windows\System\olCSkRw.exe
  2⤵
  PID:7008
- C:\Windows\System\kUwaohu.exe
  C:\Windows\System\kUwaohu.exe
  2⤵
  PID:7024
- C:\Windows\System\bRDHARs.exe
  C:\Windows\System\bRDHARs.exe
  2⤵
  PID:7044
- C:\Windows\System\vSxRjVQ.exe
  C:\Windows\System\vSxRjVQ.exe
  2⤵
  PID:7064
- C:\Windows\System\nauMJLr.exe
  C:\Windows\System\nauMJLr.exe
  2⤵
  PID:7080
- C:\Windows\System\vkmcEkw.exe
  C:\Windows\System\vkmcEkw.exe
  2⤵
  PID:7100
- C:\Windows\System\LLJzilm.exe
  C:\Windows\System\LLJzilm.exe
  2⤵
  PID:7120
- C:\Windows\System\CPLQxCt.exe
  C:\Windows\System\CPLQxCt.exe
  2⤵
  PID:7140
- C:\Windows\System\bpePXCC.exe
  C:\Windows\System\bpePXCC.exe
  2⤵
  PID:7156
- C:\Windows\System\GCNgdjO.exe
  C:\Windows\System\GCNgdjO.exe
  2⤵
  PID:4276
- C:\Windows\System\QSFoOlD.exe
  C:\Windows\System\QSFoOlD.exe
  2⤵
  PID:1060
- C:\Windows\System\mDBEngC.exe
  C:\Windows\System\mDBEngC.exe
  2⤵
  PID:5136
- C:\Windows\System\ozTUENN.exe
  C:\Windows\System\ozTUENN.exe
  2⤵
  PID:5176
- C:\Windows\System\sGQhiiW.exe
  C:\Windows\System\sGQhiiW.exe
  2⤵
  PID:5268
- C:\Windows\System\MrtpZLz.exe
  C:\Windows\System\MrtpZLz.exe
  2⤵
  PID:5404
- C:\Windows\System\gZIddki.exe
  C:\Windows\System\gZIddki.exe
  2⤵
  PID:5448
- C:\Windows\System\DwLeYPk.exe
  C:\Windows\System\DwLeYPk.exe
  2⤵
  PID:5576
- C:\Windows\System\TRIKYcH.exe
  C:\Windows\System\TRIKYcH.exe
  2⤵
  PID:5648
- C:\Windows\System\haWIMEV.exe
  C:\Windows\System\haWIMEV.exe
  2⤵
  PID:5724
- C:\Windows\System\pqOeLLA.exe
  C:\Windows\System\pqOeLLA.exe
  2⤵
  PID:5800
- C:\Windows\System\HyYrvuI.exe
  C:\Windows\System\HyYrvuI.exe
  2⤵
  PID:5840
- C:\Windows\System\QefwbRJ.exe
  C:\Windows\System\QefwbRJ.exe
  2⤵
  PID:5896
- C:\Windows\System\bVYtKpi.exe
  C:\Windows\System\bVYtKpi.exe
  2⤵
  PID:5944
- C:\Windows\System\LKYbCmS.exe
  C:\Windows\System\LKYbCmS.exe
  2⤵
  PID:5992
- C:\Windows\System\LTsAWyA.exe
  C:\Windows\System\LTsAWyA.exe
  2⤵
  PID:6048
- C:\Windows\System\eHAvjdy.exe
  C:\Windows\System\eHAvjdy.exe
  2⤵
  PID:6504
- C:\Windows\System\MCOtZkd.exe
  C:\Windows\System\MCOtZkd.exe
  2⤵
  PID:6600
- C:\Windows\System\DrrzfZH.exe
  C:\Windows\System\DrrzfZH.exe
  2⤵
  PID:6788
- C:\Windows\System\CVUSFZk.exe
  C:\Windows\System\CVUSFZk.exe
  2⤵
  PID:7176
- C:\Windows\System\saLHjhP.exe
  C:\Windows\System\saLHjhP.exe
  2⤵
  PID:7200
- C:\Windows\System\ettPDhu.exe
  C:\Windows\System\ettPDhu.exe
  2⤵
  PID:7216
- C:\Windows\System\rSxIExR.exe
  C:\Windows\System\rSxIExR.exe
  2⤵
  PID:7240
- C:\Windows\System\GUvflPn.exe
  C:\Windows\System\GUvflPn.exe
  2⤵
  PID:7256
- C:\Windows\System\GDTLYHh.exe
  C:\Windows\System\GDTLYHh.exe
  2⤵
  PID:7280
- C:\Windows\System\nwuynkL.exe
  C:\Windows\System\nwuynkL.exe
  2⤵
  PID:7300
- C:\Windows\System\zYOubnq.exe
  C:\Windows\System\zYOubnq.exe
  2⤵
  PID:7352
- C:\Windows\System\IlrokHQ.exe
  C:\Windows\System\IlrokHQ.exe
  2⤵
  PID:7368
- C:\Windows\System\NCEbaaf.exe
  C:\Windows\System\NCEbaaf.exe
  2⤵
  PID:7396
- C:\Windows\System\heDbspR.exe
  C:\Windows\System\heDbspR.exe
  2⤵
  PID:7412
- C:\Windows\System\cQWgyoO.exe
  C:\Windows\System\cQWgyoO.exe
  2⤵
  PID:7440
- C:\Windows\System\aWyhPtX.exe
  C:\Windows\System\aWyhPtX.exe
  2⤵
  PID:7460
- C:\Windows\System\uvQSSQi.exe
  C:\Windows\System\uvQSSQi.exe
  2⤵
  PID:7484
- C:\Windows\System\ZKNSgIG.exe
  C:\Windows\System\ZKNSgIG.exe
  2⤵
  PID:7512
- C:\Windows\System\pZTcpTR.exe
  C:\Windows\System\pZTcpTR.exe
  2⤵
  PID:7528
- C:\Windows\System\ZMwKcHA.exe
  C:\Windows\System\ZMwKcHA.exe
  2⤵
  PID:7604
- C:\Windows\System\SSwOZBz.exe
  C:\Windows\System\SSwOZBz.exe
  2⤵
  PID:7632
- C:\Windows\System\MViBODo.exe
  C:\Windows\System\MViBODo.exe
  2⤵
  PID:7676
- C:\Windows\System\EMxTuBc.exe
  C:\Windows\System\EMxTuBc.exe
  2⤵
  PID:7692
- C:\Windows\System\QlWROYu.exe
  C:\Windows\System\QlWROYu.exe
  2⤵
  PID:7716
- C:\Windows\System\uRFpPNe.exe
  C:\Windows\System\uRFpPNe.exe
  2⤵
  PID:7736
- C:\Windows\System\xpxYGFl.exe
  C:\Windows\System\xpxYGFl.exe
  2⤵
  PID:7760
- C:\Windows\System\JBMcqFc.exe
  C:\Windows\System\JBMcqFc.exe
  2⤵
  PID:7776
- C:\Windows\System\LaeUtJb.exe
  C:\Windows\System\LaeUtJb.exe
  2⤵
  PID:7800
- C:\Windows\System\qDpQBse.exe
  C:\Windows\System\qDpQBse.exe
  2⤵
  PID:7816
- C:\Windows\System\akRBdwc.exe
  C:\Windows\System\akRBdwc.exe
  2⤵
  PID:7840
- C:\Windows\System\THJWdbK.exe
  C:\Windows\System\THJWdbK.exe
  2⤵
  PID:7856
- C:\Windows\System\wzunXFY.exe
  C:\Windows\System\wzunXFY.exe
  2⤵
  PID:7880
- C:\Windows\System\jrlQkOh.exe
  C:\Windows\System\jrlQkOh.exe
  2⤵
  PID:7904
- C:\Windows\System\wqhKMFv.exe
  C:\Windows\System\wqhKMFv.exe
  2⤵
  PID:7924
- C:\Windows\System\IvTlrDW.exe
  C:\Windows\System\IvTlrDW.exe
  2⤵
  PID:7952
- C:\Windows\System\gHgtpOh.exe
  C:\Windows\System\gHgtpOh.exe
  2⤵
  PID:7968
- C:\Windows\System\kxAqwYx.exe
  C:\Windows\System\kxAqwYx.exe
  2⤵
  PID:7996
- C:\Windows\System\IKYmpWY.exe
  C:\Windows\System\IKYmpWY.exe
  2⤵
  PID:8024
- C:\Windows\System\xRoTDbK.exe
  C:\Windows\System\xRoTDbK.exe
  2⤵
  PID:8052
- C:\Windows\System\LFyhZGj.exe
  C:\Windows\System\LFyhZGj.exe
  2⤵
  PID:8092
- C:\Windows\System\JjxWTui.exe
  C:\Windows\System\JjxWTui.exe
  2⤵
  PID:8152
- C:\Windows\System\EPplWTM.exe
  C:\Windows\System\EPplWTM.exe
  2⤵
  PID:8176
- C:\Windows\System\HVyPaoe.exe
  C:\Windows\System\HVyPaoe.exe
  2⤵
  PID:4916
- C:\Windows\System\GmxyAwR.exe
  C:\Windows\System\GmxyAwR.exe
  2⤵
  PID:5460
- C:\Windows\System\vNxAjho.exe
  C:\Windows\System\vNxAjho.exe
  2⤵
  PID:3724
- C:\Windows\System\BrPpFHz.exe
  C:\Windows\System\BrPpFHz.exe
  2⤵
  PID:2656
- C:\Windows\System\MjlkgNi.exe
  C:\Windows\System\MjlkgNi.exe
  2⤵
  PID:2348
- C:\Windows\System\jfkUQbE.exe
  C:\Windows\System\jfkUQbE.exe
  2⤵
  PID:3656
- C:\Windows\System\SvpZSgG.exe
  C:\Windows\System\SvpZSgG.exe
  2⤵
  PID:5596
- C:\Windows\System\pebOKwd.exe
  C:\Windows\System\pebOKwd.exe
  2⤵
  PID:7076
- C:\Windows\System\NbcBkWv.exe
  C:\Windows\System\NbcBkWv.exe
  2⤵
  PID:7112
- C:\Windows\System\QpCOjxo.exe
  C:\Windows\System\QpCOjxo.exe
  2⤵
  PID:7152
- C:\Windows\System\mWGtmoW.exe
  C:\Windows\System\mWGtmoW.exe
  2⤵
  PID:6184
- C:\Windows\System\ViZlebP.exe
  C:\Windows\System\ViZlebP.exe
  2⤵
  PID:6832
- C:\Windows\System\GPnxEhe.exe
  C:\Windows\System\GPnxEhe.exe
  2⤵
  PID:6432
- C:\Windows\System\uMUJmQm.exe
  C:\Windows\System\uMUJmQm.exe
  2⤵
  PID:6636
- C:\Windows\System\kHgvdht.exe
  C:\Windows\System\kHgvdht.exe
  2⤵
  PID:7184
- C:\Windows\System\twGTqvd.exe
  C:\Windows\System\twGTqvd.exe
  2⤵
  PID:7232
- C:\Windows\System\PGuBmLL.exe
  C:\Windows\System\PGuBmLL.exe
  2⤵
  PID:6388
- C:\Windows\System\wOzKKLQ.exe
  C:\Windows\System\wOzKKLQ.exe
  2⤵
  PID:6492
- C:\Windows\System\HrPtPrF.exe
  C:\Windows\System\HrPtPrF.exe
  2⤵
  PID:6444
- C:\Windows\System\aENTvDc.exe
  C:\Windows\System\aENTvDc.exe
  2⤵
  PID:7452
- C:\Windows\System\MsfQaKP.exe
  C:\Windows\System\MsfQaKP.exe
  2⤵
  PID:5152
- C:\Windows\System\hQWhHOI.exe
  C:\Windows\System\hQWhHOI.exe
  2⤵
  PID:7560
- C:\Windows\System\lDmPKhX.exe
  C:\Windows\System\lDmPKhX.exe
  2⤵
  PID:6896
- C:\Windows\System\wPrFvcn.exe
  C:\Windows\System\wPrFvcn.exe
  2⤵
  PID:6920
- C:\Windows\System\wRyaUNe.exe
  C:\Windows\System\wRyaUNe.exe
  2⤵
  PID:6944
- C:\Windows\System\aShULiP.exe
  C:\Windows\System\aShULiP.exe
  2⤵
  PID:6980
- C:\Windows\System\gNsTzSJ.exe
  C:\Windows\System\gNsTzSJ.exe
  2⤵
  PID:7016
- C:\Windows\System\xdkIjOd.exe
  C:\Windows\System\xdkIjOd.exe
  2⤵
  PID:7040
- C:\Windows\System\NhyuxPq.exe
  C:\Windows\System\NhyuxPq.exe
  2⤵
  PID:7768
- C:\Windows\System\JCjdSWj.exe
  C:\Windows\System\JCjdSWj.exe
  2⤵
  PID:7824
- C:\Windows\System\JjcmeZq.exe
  C:\Windows\System\JjcmeZq.exe
  2⤵
  PID:7892
- C:\Windows\System\MzxkFxU.exe
  C:\Windows\System\MzxkFxU.exe
  2⤵
  PID:7360
- C:\Windows\System\MahIAFO.exe
  C:\Windows\System\MahIAFO.exe
  2⤵
  PID:2192
- C:\Windows\System\vgfaYnk.exe
  C:\Windows\System\vgfaYnk.exe
  2⤵
  PID:5312
- C:\Windows\System\hhDvFeE.exe
  C:\Windows\System\hhDvFeE.exe
  2⤵
  PID:5512
- C:\Windows\System\ieYbvYK.exe
  C:\Windows\System\ieYbvYK.exe
  2⤵
  PID:5708
- C:\Windows\System\SsIEiOR.exe
  C:\Windows\System\SsIEiOR.exe
  2⤵
  PID:5880
- C:\Windows\System\TwqYquo.exe
  C:\Windows\System\TwqYquo.exe
  2⤵
  PID:5956
- C:\Windows\System\GqRAZkM.exe
  C:\Windows\System\GqRAZkM.exe
  2⤵
  PID:7264
- C:\Windows\System\Payymsr.exe
  C:\Windows\System\Payymsr.exe
  2⤵
  PID:7316
- C:\Windows\System\aOVDKGa.exe
  C:\Windows\System\aOVDKGa.exe
  2⤵
  PID:7348
- C:\Windows\System\UyKSPRK.exe
  C:\Windows\System\UyKSPRK.exe
  2⤵
  PID:7732
- C:\Windows\System\VmwYjYV.exe
  C:\Windows\System\VmwYjYV.exe
  2⤵
  PID:7132
- C:\Windows\System\OyeNAjr.exe
  C:\Windows\System\OyeNAjr.exe
  2⤵
  PID:5836
- C:\Windows\System\nOKxvSX.exe
  C:\Windows\System\nOKxvSX.exe
  2⤵
  PID:456
- C:\Windows\System\dCLlBHd.exe
  C:\Windows\System\dCLlBHd.exe
  2⤵
  PID:6092
- C:\Windows\System\RsRMlHk.exe
  C:\Windows\System\RsRMlHk.exe
  2⤵
  PID:6520
- C:\Windows\System\JsxnlqO.exe
  C:\Windows\System\JsxnlqO.exe
  2⤵
  PID:7964
- C:\Windows\System\DjmYaMa.exe
  C:\Windows\System\DjmYaMa.exe
  2⤵
  PID:8072
- C:\Windows\System\tpSUWSV.exe
  C:\Windows\System\tpSUWSV.exe
  2⤵
  PID:7500
- C:\Windows\System\NtphNAy.exe
  C:\Windows\System\NtphNAy.exe
  2⤵
  PID:2236
- C:\Windows\System\HLoHSDO.exe
  C:\Windows\System\HLoHSDO.exe
  2⤵
  PID:7664
- C:\Windows\System\EngDSto.exe
  C:\Windows\System\EngDSto.exe
  2⤵
  PID:7888
- C:\Windows\System\fjRGSOj.exe
  C:\Windows\System\fjRGSOj.exe
  2⤵
  PID:6240
- C:\Windows\System\HsYtVNI.exe
  C:\Windows\System\HsYtVNI.exe
  2⤵
  PID:8216
- C:\Windows\System\OiEzQOp.exe
  C:\Windows\System\OiEzQOp.exe
  2⤵
  PID:8236
- C:\Windows\System\kdCfoZq.exe
  C:\Windows\System\kdCfoZq.exe
  2⤵
  PID:8272
- C:\Windows\System\gEseTMx.exe
  C:\Windows\System\gEseTMx.exe
  2⤵
  PID:8304
- C:\Windows\System\lnIgeaX.exe
  C:\Windows\System\lnIgeaX.exe
  2⤵
  PID:8332
- C:\Windows\System\PwdkzGc.exe
  C:\Windows\System\PwdkzGc.exe
  2⤵
  PID:8352
- C:\Windows\System\hfPnram.exe
  C:\Windows\System\hfPnram.exe
  2⤵
  PID:8376
- C:\Windows\System\OYafzvI.exe
  C:\Windows\System\OYafzvI.exe
  2⤵
  PID:8392
- C:\Windows\System\uTJwxJj.exe
  C:\Windows\System\uTJwxJj.exe
  2⤵
  PID:8416
- C:\Windows\System\ZnczwjT.exe
  C:\Windows\System\ZnczwjT.exe
  2⤵
  PID:8436
- C:\Windows\System\lJeiJCr.exe
  C:\Windows\System\lJeiJCr.exe
  2⤵
  PID:8456
- C:\Windows\System\vTGpSUC.exe
  C:\Windows\System\vTGpSUC.exe
  2⤵
  PID:8484
- C:\Windows\System\eFYQqjZ.exe
  C:\Windows\System\eFYQqjZ.exe
  2⤵
  PID:8500
- C:\Windows\System\xjPJaIU.exe
  C:\Windows\System\xjPJaIU.exe
  2⤵
  PID:8524
- C:\Windows\System\pxfrlpi.exe
  C:\Windows\System\pxfrlpi.exe
  2⤵
  PID:8548
- C:\Windows\System\GcdpmZf.exe
  C:\Windows\System\GcdpmZf.exe
  2⤵
  PID:8564
- C:\Windows\System\LgjLbUn.exe
  C:\Windows\System\LgjLbUn.exe
  2⤵
  PID:8592
- C:\Windows\System\YRLXjQl.exe
  C:\Windows\System\YRLXjQl.exe
  2⤵
  PID:8608
- C:\Windows\System\NUtjgPH.exe
  C:\Windows\System\NUtjgPH.exe
  2⤵
  PID:8632
- C:\Windows\System\NsbhWJf.exe
  C:\Windows\System\NsbhWJf.exe
  2⤵
  PID:8656
- C:\Windows\System\TesYacc.exe
  C:\Windows\System\TesYacc.exe
  2⤵
  PID:8680
- C:\Windows\System\TyyqCuL.exe
  C:\Windows\System\TyyqCuL.exe
  2⤵
  PID:8704
- C:\Windows\System\DlGJgPo.exe
  C:\Windows\System\DlGJgPo.exe
  2⤵
  PID:8720
- C:\Windows\System\nmVAtZT.exe
  C:\Windows\System\nmVAtZT.exe
  2⤵
  PID:8740
- C:\Windows\System\uijZKYL.exe
  C:\Windows\System\uijZKYL.exe
  2⤵
  PID:8768
- C:\Windows\System\YYyCWuX.exe
  C:\Windows\System\YYyCWuX.exe
  2⤵
  PID:8784
- C:\Windows\System\KSNJkGn.exe
  C:\Windows\System\KSNJkGn.exe
  2⤵
  PID:8808
- C:\Windows\System\yMbjQAv.exe
  C:\Windows\System\yMbjQAv.exe
  2⤵
  PID:8832
- C:\Windows\System\JyvSstu.exe
  C:\Windows\System\JyvSstu.exe
  2⤵
  PID:8848
- C:\Windows\System\aXPrsgm.exe
  C:\Windows\System\aXPrsgm.exe
  2⤵
  PID:8864
- C:\Windows\System\EWqogya.exe
  C:\Windows\System\EWqogya.exe
  2⤵
  PID:8888
- C:\Windows\System\ufUKRvX.exe
  C:\Windows\System\ufUKRvX.exe
  2⤵
  PID:8908
- C:\Windows\System\KnqJZbA.exe
  C:\Windows\System\KnqJZbA.exe
  2⤵
  PID:8924
- C:\Windows\System\QvkAmtk.exe
  C:\Windows\System\QvkAmtk.exe
  2⤵
  PID:8984
- C:\Windows\System\HbsblHW.exe
  C:\Windows\System\HbsblHW.exe
  2⤵
  PID:9008
- C:\Windows\System\IQhMQhD.exe
  C:\Windows\System\IQhMQhD.exe
  2⤵
  PID:9032
- C:\Windows\System\uPSTIBN.exe
  C:\Windows\System\uPSTIBN.exe
  2⤵
  PID:9052
- C:\Windows\System\kUNLHZH.exe
  C:\Windows\System\kUNLHZH.exe
  2⤵
  PID:9072
- C:\Windows\System\CXbrkKc.exe
  C:\Windows\System\CXbrkKc.exe
  2⤵
  PID:9096
- C:\Windows\System\vKjnJNl.exe
  C:\Windows\System\vKjnJNl.exe
  2⤵
  PID:9116
- C:\Windows\System\FXGvYSP.exe
  C:\Windows\System\FXGvYSP.exe
  2⤵
  PID:9140
- C:\Windows\System\oVHmgLg.exe
  C:\Windows\System\oVHmgLg.exe
  2⤵
  PID:9160
- C:\Windows\System\ukNAcui.exe
  C:\Windows\System\ukNAcui.exe
  2⤵
  PID:9180
- C:\Windows\System\EIRvgyv.exe
  C:\Windows\System\EIRvgyv.exe
  2⤵
  PID:9204
- C:\Windows\System\vCbruiT.exe
  C:\Windows\System\vCbruiT.exe
  2⤵
  PID:6580
- C:\Windows\System\wrTSArD.exe
  C:\Windows\System\wrTSArD.exe
  2⤵
  PID:5540
- C:\Windows\System\iLuProW.exe
  C:\Windows\System\iLuProW.exe
  2⤵
  PID:5040
- C:\Windows\System\gMeTGob.exe
  C:\Windows\System\gMeTGob.exe
  2⤵
  PID:8108
- C:\Windows\System\oiEnzjH.exe
  C:\Windows\System\oiEnzjH.exe
  2⤵
  PID:8136
- C:\Windows\System\dBQBZce.exe
  C:\Windows\System\dBQBZce.exe
  2⤵
  PID:8184
- C:\Windows\System\FbdRGxa.exe
  C:\Windows\System\FbdRGxa.exe
  2⤵
  PID:408
- C:\Windows\System\whPxFht.exe
  C:\Windows\System\whPxFht.exe
  2⤵
  PID:2680
- C:\Windows\System\XdwBPHK.exe
  C:\Windows\System\XdwBPHK.exe
  2⤵
  PID:5572
- C:\Windows\System\FEZcOJd.exe
  C:\Windows\System\FEZcOJd.exe
  2⤵
  PID:7628
- C:\Windows\System\ObbKKYZ.exe
  C:\Windows\System\ObbKKYZ.exe
  2⤵
  PID:9224
- C:\Windows\System\KWsYRfn.exe
  C:\Windows\System\KWsYRfn.exe
  2⤵
  PID:9244
- C:\Windows\System\qLqxtHu.exe
  C:\Windows\System\qLqxtHu.exe
  2⤵
  PID:9268
- C:\Windows\System\YhNqJcN.exe
  C:\Windows\System\YhNqJcN.exe
  2⤵
  PID:9288
- C:\Windows\System\bqmtWSX.exe
  C:\Windows\System\bqmtWSX.exe
  2⤵
  PID:9308
- C:\Windows\System\PtDGtJW.exe
  C:\Windows\System\PtDGtJW.exe
  2⤵
  PID:9332
- C:\Windows\System\OaBCHEN.exe
  C:\Windows\System\OaBCHEN.exe
  2⤵
  PID:9352
- C:\Windows\System\hjdtuRk.exe
  C:\Windows\System\hjdtuRk.exe
  2⤵
  PID:9372
- C:\Windows\System\zKHYxIc.exe
  C:\Windows\System\zKHYxIc.exe
  2⤵
  PID:9396
- C:\Windows\System\iGpxbnw.exe
  C:\Windows\System\iGpxbnw.exe
  2⤵
  PID:9420
- C:\Windows\System\gOxXdnf.exe
  C:\Windows\System\gOxXdnf.exe
  2⤵
  PID:9436
- C:\Windows\System\XFPgWTZ.exe
  C:\Windows\System\XFPgWTZ.exe
  2⤵
  PID:9456
- C:\Windows\System\dLLnVBJ.exe
  C:\Windows\System\dLLnVBJ.exe
  2⤵
  PID:9480
- C:\Windows\System\QKbZHsx.exe
  C:\Windows\System\QKbZHsx.exe
  2⤵
  PID:9500
- C:\Windows\System\BAgtiZS.exe
  C:\Windows\System\BAgtiZS.exe
  2⤵
  PID:9520
- C:\Windows\System\QOzcURR.exe
  C:\Windows\System\QOzcURR.exe
  2⤵
  PID:9536
- C:\Windows\System\UheXIRk.exe
  C:\Windows\System\UheXIRk.exe
  2⤵
  PID:9552
- C:\Windows\System\LlidpZP.exe
  C:\Windows\System\LlidpZP.exe
  2⤵
  PID:9568
- C:\Windows\System\pTnTGvI.exe
  C:\Windows\System\pTnTGvI.exe
  2⤵
  PID:9592
- C:\Windows\System\tGHFwPU.exe
  C:\Windows\System\tGHFwPU.exe
  2⤵
  PID:9620
- C:\Windows\System\QKnebHF.exe
  C:\Windows\System\QKnebHF.exe
  2⤵
  PID:9640
- C:\Windows\System\kFhaTmP.exe
  C:\Windows\System\kFhaTmP.exe
  2⤵
  PID:9664
- C:\Windows\System\YULQTyV.exe
  C:\Windows\System\YULQTyV.exe
  2⤵
  PID:9684
- C:\Windows\System\JgAKbAh.exe
  C:\Windows\System\JgAKbAh.exe
  2⤵
  PID:9704
- C:\Windows\System\xlhLOCw.exe
  C:\Windows\System\xlhLOCw.exe
  2⤵
  PID:9728
- C:\Windows\System\dErywPB.exe
  C:\Windows\System\dErywPB.exe
  2⤵
  PID:9744
- C:\Windows\System\ODkHDyY.exe
  C:\Windows\System\ODkHDyY.exe
  2⤵
  PID:9764
- C:\Windows\System\vjGIZxL.exe
  C:\Windows\System\vjGIZxL.exe
  2⤵
  PID:9784
- C:\Windows\System\alkbXrX.exe
  C:\Windows\System\alkbXrX.exe
  2⤵
  PID:9816
- C:\Windows\System\MXuyjHC.exe
  C:\Windows\System\MXuyjHC.exe
  2⤵
  PID:9840
- C:\Windows\System\CXmPADA.exe
  C:\Windows\System\CXmPADA.exe
  2⤵
  PID:9856
- C:\Windows\System\XWihBvA.exe
  C:\Windows\System\XWihBvA.exe
  2⤵
  PID:9880
- C:\Windows\System\oZSBtlR.exe
  C:\Windows\System\oZSBtlR.exe
  2⤵
  PID:9904
- C:\Windows\System\bYXPdbh.exe
  C:\Windows\System\bYXPdbh.exe
  2⤵
  PID:9924
- C:\Windows\System\BKPJqCN.exe
  C:\Windows\System\BKPJqCN.exe
  2⤵
  PID:9944
- C:\Windows\System\XvCwLSY.exe
  C:\Windows\System\XvCwLSY.exe
  2⤵
  PID:9972
- C:\Windows\System\KjvzpHv.exe
  C:\Windows\System\KjvzpHv.exe
  2⤵
  PID:9988
- C:\Windows\System\QeOpNrL.exe
  C:\Windows\System\QeOpNrL.exe
  2⤵
  PID:10004
- C:\Windows\System\CtMaODq.exe
  C:\Windows\System\CtMaODq.exe
  2⤵
  PID:10020
- C:\Windows\System\CLPRffo.exe
  C:\Windows\System\CLPRffo.exe
  2⤵
  PID:10040
- C:\Windows\System\buBRLjf.exe
  C:\Windows\System\buBRLjf.exe
  2⤵
  PID:10060
- C:\Windows\System\SaSWskn.exe
  C:\Windows\System\SaSWskn.exe
  2⤵
  PID:10084
- C:\Windows\System\gfgAygF.exe
  C:\Windows\System\gfgAygF.exe
  2⤵
  PID:10104
- C:\Windows\System\rZhHKLv.exe
  C:\Windows\System\rZhHKLv.exe
  2⤵
  PID:10132
- C:\Windows\System\KtrWpBV.exe
  C:\Windows\System\KtrWpBV.exe
  2⤵
  PID:10152
- C:\Windows\System\PmvJgiX.exe
  C:\Windows\System\PmvJgiX.exe
  2⤵
  PID:10172
- C:\Windows\System\sjxCOgk.exe
  C:\Windows\System\sjxCOgk.exe
  2⤵
  PID:10188
- C:\Windows\System\dJlwyjp.exe
  C:\Windows\System\dJlwyjp.exe
  2⤵
  PID:10208
- C:\Windows\System\aMYJjyF.exe
  C:\Windows\System\aMYJjyF.exe
  2⤵
  PID:10224
- C:\Windows\System\wJXVsRV.exe
  C:\Windows\System\wJXVsRV.exe
  2⤵
  PID:3976
- C:\Windows\System\DgUlRuY.exe
  C:\Windows\System\DgUlRuY.exe
  2⤵
  PID:7864
- C:\Windows\System\TefDspG.exe
  C:\Windows\System\TefDspG.exe
  2⤵
  PID:5544
- C:\Windows\System\CTMlomF.exe
  C:\Windows\System\CTMlomF.exe
  2⤵
  PID:5988
- C:\Windows\System\HgJQvAv.exe
  C:\Windows\System\HgJQvAv.exe
  2⤵
  PID:7312
- C:\Windows\System\JmCOvTU.exe
  C:\Windows\System\JmCOvTU.exe
  2⤵
  PID:7728
- C:\Windows\System\TIUGkcw.exe
  C:\Windows\System\TIUGkcw.exe
  2⤵
  PID:8736
- C:\Windows\System\mVYaqXF.exe
  C:\Windows\System\mVYaqXF.exe
  2⤵
  PID:8780
- C:\Windows\System\IHqSgOo.exe
  C:\Windows\System\IHqSgOo.exe
  2⤵
  PID:6616
- C:\Windows\System\bDKfdQm.exe
  C:\Windows\System\bDKfdQm.exe
  2⤵
  PID:4232
- C:\Windows\System\VSlsihY.exe
  C:\Windows\System\VSlsihY.exe
  2⤵
  PID:6816
- C:\Windows\System\FszkQaH.exe
  C:\Windows\System\FszkQaH.exe
  2⤵
  PID:6916
- C:\Windows\System\JdtYCpU.exe
  C:\Windows\System\JdtYCpU.exe
  2⤵
  PID:7000
- C:\Windows\System\BygWrUF.exe
  C:\Windows\System\BygWrUF.exe
  2⤵
  PID:9136
- C:\Windows\System\JbqwKBI.exe
  C:\Windows\System\JbqwKBI.exe
  2⤵
  PID:9188
- C:\Windows\System\IixElrE.exe
  C:\Windows\System\IixElrE.exe
  2⤵
  PID:6540
- C:\Windows\System\awRSZzq.exe
  C:\Windows\System\awRSZzq.exe
  2⤵
  PID:10248
- C:\Windows\System\EnyUkLM.exe
  C:\Windows\System\EnyUkLM.exe
  2⤵
  PID:10272
- C:\Windows\System\KlRNPiv.exe
  C:\Windows\System\KlRNPiv.exe
  2⤵
  PID:10300
- C:\Windows\System\cJsIlit.exe
  C:\Windows\System\cJsIlit.exe
  2⤵
  PID:10320
- C:\Windows\System\OFrVIIs.exe
  C:\Windows\System\OFrVIIs.exe
  2⤵
  PID:10340
- C:\Windows\System\Tyqaidx.exe
  C:\Windows\System\Tyqaidx.exe
  2⤵
  PID:10364
- C:\Windows\System\xXQuVaD.exe
  C:\Windows\System\xXQuVaD.exe
  2⤵
  PID:10384
- C:\Windows\System\KrKgcPD.exe
  C:\Windows\System\KrKgcPD.exe
  2⤵
  PID:10412
- C:\Windows\System\vHZbNgs.exe
  C:\Windows\System\vHZbNgs.exe
  2⤵
  PID:10440
- C:\Windows\System\uNEAQji.exe
  C:\Windows\System\uNEAQji.exe
  2⤵
  PID:10464
- C:\Windows\System\jTSFxen.exe
  C:\Windows\System\jTSFxen.exe
  2⤵
  PID:10496
- C:\Windows\System\juNMoXV.exe
  C:\Windows\System\juNMoXV.exe
  2⤵
  PID:10516
- C:\Windows\System\pMoNfHJ.exe
  C:\Windows\System\pMoNfHJ.exe
  2⤵
  PID:10536
- C:\Windows\System\sAwOScU.exe
  C:\Windows\System\sAwOScU.exe
  2⤵
  PID:10556
- C:\Windows\System\JRPKEqB.exe
  C:\Windows\System\JRPKEqB.exe
  2⤵
  PID:10580
- C:\Windows\System\BZGeOdg.exe
  C:\Windows\System\BZGeOdg.exe
  2⤵
  PID:10600
- C:\Windows\System\sVaHVrU.exe
  C:\Windows\System\sVaHVrU.exe
  2⤵
  PID:10624
- C:\Windows\System\eYrAnAi.exe
  C:\Windows\System\eYrAnAi.exe
  2⤵
  PID:10644
- C:\Windows\System\cMSusnj.exe
  C:\Windows\System\cMSusnj.exe
  2⤵
  PID:10664
- C:\Windows\System\sTjJvir.exe
  C:\Windows\System\sTjJvir.exe
  2⤵
  PID:10688
- C:\Windows\System\zQCZQLZ.exe
  C:\Windows\System\zQCZQLZ.exe
  2⤵
  PID:10708
- C:\Windows\System\StbLSZo.exe
  C:\Windows\System\StbLSZo.exe
  2⤵
  PID:10736
- C:\Windows\System\vKsNHWn.exe
  C:\Windows\System\vKsNHWn.exe
  2⤵
  PID:10756
- C:\Windows\System\FUjGVvY.exe
  C:\Windows\System\FUjGVvY.exe
  2⤵
  PID:11200
- C:\Windows\System\WeieEOV.exe
  C:\Windows\System\WeieEOV.exe
  2⤵
  PID:11216
- C:\Windows\System\hOPUCPt.exe
  C:\Windows\System\hOPUCPt.exe
  2⤵
  PID:11240
- C:\Windows\System\ZQRIsCE.exe
  C:\Windows\System\ZQRIsCE.exe
  2⤵
  PID:7688
- C:\Windows\System\xAaZhhc.exe
  C:\Windows\System\xAaZhhc.exe
  2⤵
  PID:8148
- C:\Windows\System\TnHIkvQ.exe
  C:\Windows\System\TnHIkvQ.exe
  2⤵
  PID:7704
- C:\Windows\System\FIMuvAy.exe
  C:\Windows\System\FIMuvAy.exe
  2⤵
  PID:6152
- C:\Windows\System\LXseDDB.exe
  C:\Windows\System\LXseDDB.exe
  2⤵
  PID:9280
- C:\Windows\System\AolMroz.exe
  C:\Windows\System\AolMroz.exe
  2⤵
  PID:9392
- C:\Windows\System\jHsVSue.exe
  C:\Windows\System\jHsVSue.exe
  2⤵
  PID:9448
- C:\Windows\System\Wuyixav.exe
  C:\Windows\System\Wuyixav.exe
  2⤵
  PID:8316
- C:\Windows\System\JgSLlDW.exe
  C:\Windows\System\JgSLlDW.exe
  2⤵
  PID:9612
- C:\Windows\System\cUuzGDf.exe
  C:\Windows\System\cUuzGDf.exe
  2⤵
  PID:9584
- C:\Windows\System\QYzlycC.exe
  C:\Windows\System\QYzlycC.exe
  2⤵
  PID:8412
- C:\Windows\System\SaQCazj.exe
  C:\Windows\System\SaQCazj.exe
  2⤵
  PID:7252
- C:\Windows\System\YspceVL.exe
  C:\Windows\System\YspceVL.exe
  2⤵
  PID:8648
- C:\Windows\System\pVVAfcX.exe
  C:\Windows\System\pVVAfcX.exe
  2⤵
  PID:9920
- C:\Windows\System\pyIrQOy.exe
  C:\Windows\System\pyIrQOy.exe
  2⤵
  PID:10144
- C:\Windows\System\mswlfLK.exe
  C:\Windows\System\mswlfLK.exe
  2⤵
  PID:7960
- C:\Windows\System\wqaFrOA.exe
  C:\Windows\System\wqaFrOA.exe
  2⤵
  PID:7916
- C:\Windows\System\rEpiVFh.exe
  C:\Windows\System\rEpiVFh.exe
  2⤵
  PID:9196
- C:\Windows\System\vNugIab.exe
  C:\Windows\System\vNugIab.exe
  2⤵
  PID:10256
- C:\Windows\System\piXluPt.exe
  C:\Windows\System\piXluPt.exe
  2⤵
  PID:10292
- C:\Windows\System\PCOiwQk.exe
  C:\Windows\System\PCOiwQk.exe
  2⤵
  PID:3680
- C:\Windows\System\drCuXiM.exe
  C:\Windows\System\drCuXiM.exe
  2⤵
  PID:10492
- C:\Windows\System\QCwCFyr.exe
  C:\Windows\System\QCwCFyr.exe
  2⤵
  PID:9344
- C:\Windows\System\eRjpIwl.exe
  C:\Windows\System\eRjpIwl.exe
  2⤵
  PID:9488
- C:\Windows\System\KReNpYG.exe
  C:\Windows\System\KReNpYG.exe
  2⤵
  PID:9676
- C:\Windows\System\PqNkaFN.exe
  C:\Windows\System\PqNkaFN.exe
  2⤵
  PID:8492
- C:\Windows\System\mgEgZkn.exe
  C:\Windows\System\mgEgZkn.exe
  2⤵
  PID:8516
- C:\Windows\System\qZSJGcz.exe
  C:\Windows\System\qZSJGcz.exe
  2⤵
  PID:8560
- C:\Windows\System\biGfIQh.exe
  C:\Windows\System\biGfIQh.exe
  2⤵
  PID:8616
- C:\Windows\System\VSuNdKO.exe
  C:\Windows\System\VSuNdKO.exe
  2⤵
  PID:9852
- C:\Windows\System\bYqceWH.exe
  C:\Windows\System\bYqceWH.exe
  2⤵
  PID:8652
- C:\Windows\System\HsGCZtN.exe
  C:\Windows\System\HsGCZtN.exe
  2⤵
  PID:3836
- C:\Windows\System\RNmyHTr.exe
  C:\Windows\System\RNmyHTr.exe
  2⤵
  PID:10860
- C:\Windows\System\unIEqZn.exe
  C:\Windows\System\unIEqZn.exe
  2⤵
  PID:8776
- C:\Windows\System\DdZWmCv.exe
  C:\Windows\System\DdZWmCv.exe
  2⤵
  PID:4944
- C:\Windows\System\JNhrJET.exe
  C:\Windows\System\JNhrJET.exe
  2⤵
  PID:10916
- C:\Windows\System\uGVVGce.exe
  C:\Windows\System\uGVVGce.exe
  2⤵
  PID:8896
- C:\Windows\System\OsKBaqu.exe
  C:\Windows\System\OsKBaqu.exe
  2⤵
  PID:4400
- C:\Windows\System\yBnVnUk.exe
  C:\Windows\System\yBnVnUk.exe
  2⤵
  PID:11268
- C:\Windows\System\TIsIvwa.exe
  C:\Windows\System\TIsIvwa.exe
  2⤵
  PID:11284
- C:\Windows\System\vQlnpRy.exe
  C:\Windows\System\vQlnpRy.exe
  2⤵
  PID:11300
- C:\Windows\System\mRcQLyz.exe
  C:\Windows\System\mRcQLyz.exe
  2⤵
  PID:11316
- C:\Windows\System\HChuyxa.exe
  C:\Windows\System\HChuyxa.exe
  2⤵
  PID:11332
- C:\Windows\System\PMueifc.exe
  C:\Windows\System\PMueifc.exe
  2⤵
  PID:11356
- C:\Windows\System\BAagfBt.exe
  C:\Windows\System\BAagfBt.exe
  2⤵
  PID:11424
- C:\Windows\System\obxrNGD.exe
  C:\Windows\System\obxrNGD.exe
  2⤵
  PID:11440
- C:\Windows\System\sLCZPLO.exe
  C:\Windows\System\sLCZPLO.exe
  2⤵
  PID:11464
- C:\Windows\System\JYhVqKl.exe
  C:\Windows\System\JYhVqKl.exe
  2⤵
  PID:11488
- C:\Windows\System\SXOFNUf.exe
  C:\Windows\System\SXOFNUf.exe
  2⤵
  PID:11512
- C:\Windows\System\mdavbdh.exe
  C:\Windows\System\mdavbdh.exe
  2⤵
  PID:11528
- C:\Windows\System\bsDjCNF.exe
  C:\Windows\System\bsDjCNF.exe
  2⤵
  PID:11552
- C:\Windows\System\eKVuMsP.exe
  C:\Windows\System\eKVuMsP.exe
  2⤵
  PID:11572
- C:\Windows\System\zAKBMuu.exe
  C:\Windows\System\zAKBMuu.exe
  2⤵
  PID:11592
- C:\Windows\System\eIJRRhy.exe
  C:\Windows\System\eIJRRhy.exe
  2⤵
  PID:11620
- C:\Windows\System\UArYLuX.exe
  C:\Windows\System\UArYLuX.exe
  2⤵
  PID:11640
- C:\Windows\System\rimjWwL.exe
  C:\Windows\System\rimjWwL.exe
  2⤵
  PID:11668
- C:\Windows\System\KFdPaEU.exe
  C:\Windows\System\KFdPaEU.exe
  2⤵
  PID:11696
- C:\Windows\System\hFVxbwZ.exe
  C:\Windows\System\hFVxbwZ.exe
  2⤵
  PID:11712
- C:\Windows\System\HTCBErr.exe
  C:\Windows\System\HTCBErr.exe
  2⤵
  PID:11736
- C:\Windows\System\WZeyVBk.exe
  C:\Windows\System\WZeyVBk.exe
  2⤵
  PID:11764
- C:\Windows\System\KQKBzXk.exe
  C:\Windows\System\KQKBzXk.exe
  2⤵
  PID:11784
- C:\Windows\System\TGpcZpG.exe
  C:\Windows\System\TGpcZpG.exe
  2⤵
  PID:11808
- C:\Windows\System\DLUqRpE.exe
  C:\Windows\System\DLUqRpE.exe
  2⤵
  PID:11832
- C:\Windows\System\mlvfIGO.exe
  C:\Windows\System\mlvfIGO.exe
  2⤵
  PID:11856
- C:\Windows\System\nbVEcIS.exe
  C:\Windows\System\nbVEcIS.exe
  2⤵
  PID:11872
- C:\Windows\System\xitkLSB.exe
  C:\Windows\System\xitkLSB.exe
  2⤵
  PID:11896
- C:\Windows\System\onHxgOj.exe
  C:\Windows\System\onHxgOj.exe
  2⤵
  PID:11912
- C:\Windows\System\cbGJvVv.exe
  C:\Windows\System\cbGJvVv.exe
  2⤵
  PID:11928
- C:\Windows\System\dgMZIuZ.exe
  C:\Windows\System\dgMZIuZ.exe
  2⤵
  PID:11944
- C:\Windows\System\qBNOywY.exe
  C:\Windows\System\qBNOywY.exe
  2⤵
  PID:11960
- C:\Windows\System\yamndFl.exe
  C:\Windows\System\yamndFl.exe
  2⤵
  PID:11976
- C:\Windows\System\jzbpnhZ.exe
  C:\Windows\System\jzbpnhZ.exe
  2⤵
  PID:11992
- C:\Windows\System\CRiwgwz.exe
  C:\Windows\System\CRiwgwz.exe
  2⤵
  PID:12008
- C:\Windows\System\yaLoqGT.exe
  C:\Windows\System\yaLoqGT.exe
  2⤵
  PID:12024
- C:\Windows\System\GTObRQy.exe
  C:\Windows\System\GTObRQy.exe
  2⤵
  PID:12040
- C:\Windows\System\dhxCWHX.exe
  C:\Windows\System\dhxCWHX.exe
  2⤵
  PID:12056
- C:\Windows\System\zxCREGx.exe
  C:\Windows\System\zxCREGx.exe
  2⤵
  PID:12072
- C:\Windows\System\WqgEcus.exe
  C:\Windows\System\WqgEcus.exe
  2⤵
  PID:12088
- C:\Windows\System\UOCiStD.exe
  C:\Windows\System\UOCiStD.exe
  2⤵
  PID:12104
- C:\Windows\System\WiqcjJn.exe
  C:\Windows\System\WiqcjJn.exe
  2⤵
  PID:12120
- C:\Windows\System\xqobuZD.exe
  C:\Windows\System\xqobuZD.exe
  2⤵
  PID:12140
- C:\Windows\System\hQJfjLZ.exe
  C:\Windows\System\hQJfjLZ.exe
  2⤵
  PID:12192
- C:\Windows\System\EYMduNj.exe
  C:\Windows\System\EYMduNj.exe
  2⤵
  PID:12208
- C:\Windows\System\dwZDusg.exe
  C:\Windows\System\dwZDusg.exe
  2⤵
  PID:12228
- C:\Windows\System\WTaqFTz.exe
  C:\Windows\System\WTaqFTz.exe
  2⤵
  PID:12248
- C:\Windows\System\YdHGBzN.exe
  C:\Windows\System\YdHGBzN.exe
  2⤵
  PID:12268
- C:\Windows\System\QaMvLUP.exe
  C:\Windows\System\QaMvLUP.exe
  2⤵
  PID:8916
- C:\Windows\System\ZXoSDMz.exe
  C:\Windows\System\ZXoSDMz.exe
  2⤵
  PID:8960
- C:\Windows\System\DHJBzQU.exe
  C:\Windows\System\DHJBzQU.exe
  2⤵
  PID:9016
- C:\Windows\System\gnINrWB.exe
  C:\Windows\System\gnINrWB.exe
  2⤵
  PID:9060
- C:\Windows\System\OaElmfO.exe
  C:\Windows\System\OaElmfO.exe
  2⤵
  PID:9084
- C:\Windows\System\WitIyCR.exe
  C:\Windows\System\WitIyCR.exe
  2⤵
  PID:9172
- C:\Windows\System\koofPmn.exe
  C:\Windows\System\koofPmn.exe
  2⤵
  PID:9212
- C:\Windows\System\bdoPJuV.exe
  C:\Windows\System\bdoPJuV.exe
  2⤵
  PID:9156
- C:\Windows\System\dAChahg.exe
  C:\Windows\System\dAChahg.exe
  2⤵
  PID:8088
- C:\Windows\System\ROQGJPE.exe
  C:\Windows\System\ROQGJPE.exe
  2⤵
  PID:10356
- C:\Windows\System\fAcomdJ.exe
  C:\Windows\System\fAcomdJ.exe
  2⤵
  PID:1724
- C:\Windows\System\wyqmPXg.exe
  C:\Windows\System\wyqmPXg.exe
  2⤵
  PID:10456
- C:\Windows\System\eZgJZHK.exe
  C:\Windows\System\eZgJZHK.exe
  2⤵
  PID:9320
- C:\Windows\System\JUhfzSW.exe
  C:\Windows\System\JUhfzSW.exe
  2⤵
  PID:10588
- C:\Windows\System\UGWQtiR.exe
  C:\Windows\System\UGWQtiR.exe
  2⤵
  PID:12292
- C:\Windows\System\uRwhQeN.exe
  C:\Windows\System\uRwhQeN.exe
  2⤵
  PID:12316
- C:\Windows\System\ghkCSpk.exe
  C:\Windows\System\ghkCSpk.exe
  2⤵
  PID:12336
- C:\Windows\System\PRTSdtJ.exe
  C:\Windows\System\PRTSdtJ.exe
  2⤵
  PID:12356
- C:\Windows\System\IWlURdU.exe
  C:\Windows\System\IWlURdU.exe
  2⤵
  PID:12380
- C:\Windows\System\dBnWtzR.exe
  C:\Windows\System\dBnWtzR.exe
  2⤵
  PID:12400
- C:\Windows\System\UwhNjsj.exe
  C:\Windows\System\UwhNjsj.exe
  2⤵
  PID:12420
- C:\Windows\System\JdrtjNF.exe
  C:\Windows\System\JdrtjNF.exe
  2⤵
  PID:12440
- C:\Windows\System\TKWHVXE.exe
  C:\Windows\System\TKWHVXE.exe
  2⤵
  PID:12460
- C:\Windows\System\dShOKPm.exe
  C:\Windows\System\dShOKPm.exe
  2⤵
  PID:12480
- C:\Windows\System\cmGzfOV.exe
  C:\Windows\System\cmGzfOV.exe
  2⤵
  PID:12504
- C:\Windows\System\qAkNorA.exe
  C:\Windows\System\qAkNorA.exe
  2⤵
  PID:12524
- C:\Windows\System\tyVdeop.exe
  C:\Windows\System\tyVdeop.exe
  2⤵
  PID:12548
- C:\Windows\System\PFNTJZo.exe
  C:\Windows\System\PFNTJZo.exe
  2⤵
  PID:12568
- C:\Windows\System\TzAGkdR.exe
  C:\Windows\System\TzAGkdR.exe
  2⤵
  PID:12588
- C:\Windows\System\sbNvDhh.exe
  C:\Windows\System\sbNvDhh.exe
  2⤵
  PID:12612
- C:\Windows\System\fgCtXNr.exe
  C:\Windows\System\fgCtXNr.exe
  2⤵
  PID:12632
- C:\Windows\System\SdtTRGW.exe
  C:\Windows\System\SdtTRGW.exe
  2⤵
  PID:12652
- C:\Windows\System\btQsNCM.exe
  C:\Windows\System\btQsNCM.exe
  2⤵
  PID:12676
- C:\Windows\System\NIybVCw.exe
  C:\Windows\System\NIybVCw.exe
  2⤵
  PID:12696
- C:\Windows\System\zIlERmP.exe
  C:\Windows\System\zIlERmP.exe
  2⤵
  PID:12716
- C:\Windows\System\MPtqSEP.exe
  C:\Windows\System\MPtqSEP.exe
  2⤵
  PID:12736
- C:\Windows\System\wivbqZB.exe
  C:\Windows\System\wivbqZB.exe
  2⤵
  PID:12756
- C:\Windows\System\igWcVZO.exe
  C:\Windows\System\igWcVZO.exe
  2⤵
  PID:12776
- C:\Windows\System\CPWzVfm.exe
  C:\Windows\System\CPWzVfm.exe
  2⤵
  PID:12796
- C:\Windows\System\xGwqarq.exe
  C:\Windows\System\xGwqarq.exe
  2⤵
  PID:12812
- C:\Windows\System\qMLBhcu.exe
  C:\Windows\System\qMLBhcu.exe
  2⤵
  PID:9760
- C:\Windows\System\dzspNHX.exe
  C:\Windows\System\dzspNHX.exe
  2⤵
  PID:11168
- C:\Windows\System\LrGYcZL.exe
  C:\Windows\System\LrGYcZL.exe
  2⤵
  PID:11132
- C:\Windows\System\AnuyUsP.exe
  C:\Windows\System\AnuyUsP.exe
  2⤵
  PID:11720
- C:\Windows\System\YFKDkvM.exe
  C:\Windows\System\YFKDkvM.exe
  2⤵
  PID:11760
- C:\Windows\System\bzhFyCw.exe
  C:\Windows\System\bzhFyCw.exe
  2⤵
  PID:11816
- C:\Windows\System\bejbgSx.exe
  C:\Windows\System\bejbgSx.exe
  2⤵
  PID:11852
- C:\Windows\System\dqreGHd.exe
  C:\Windows\System\dqreGHd.exe
  2⤵
  PID:11904
- C:\Windows\System\BIvdQJB.exe
  C:\Windows\System\BIvdQJB.exe
  2⤵
  PID:11952
- C:\Windows\System\DhmnvVp.exe
  C:\Windows\System\DhmnvVp.exe
  2⤵
  PID:12164
- C:\Windows\System\ohMCJLq.exe
  C:\Windows\System\ohMCJLq.exe
  2⤵
  PID:12204
- C:\Windows\System\rYxhMkN.exe
  C:\Windows\System\rYxhMkN.exe
  2⤵
  PID:12244
- C:\Windows\System\FbGrOXT.exe
  C:\Windows\System\FbGrOXT.exe
  2⤵
  PID:12276
- C:\Windows\System\wiEyXCm.exe
  C:\Windows\System\wiEyXCm.exe
  2⤵
  PID:9068
- C:\Windows\System\KztMCuA.exe
  C:\Windows\System\KztMCuA.exe
  2⤵
  PID:8752
- C:\Windows\System\CfMmIIe.exe
  C:\Windows\System\CfMmIIe.exe
  2⤵
  PID:10288
- C:\Windows\System\uMaKmNN.exe
  C:\Windows\System\uMaKmNN.exe
  2⤵
  PID:10400
- C:\Windows\System\mOFYoSy.exe
  C:\Windows\System\mOFYoSy.exe
  2⤵
  PID:10524
- C:\Windows\System\ewjhrTV.exe
  C:\Windows\System\ewjhrTV.exe
  2⤵
  PID:9296
- C:\Windows\System\ZWyJyjV.exe
  C:\Windows\System\ZWyJyjV.exe
  2⤵
  PID:12180
- C:\Windows\System\xIurWth.exe
  C:\Windows\System\xIurWth.exe
  2⤵
  PID:12372
- C:\Windows\System\FTRxiTr.exe
  C:\Windows\System\FTRxiTr.exe
  2⤵
  PID:12428
- C:\Windows\System\LJtyfBL.exe
  C:\Windows\System\LJtyfBL.exe
  2⤵
  PID:12472
- C:\Windows\System\xuNPcfI.exe
  C:\Windows\System\xuNPcfI.exe
  2⤵
  PID:13264
- C:\Windows\System\YdmTuiY.exe
  C:\Windows\System\YdmTuiY.exe
  2⤵
  PID:13296
- C:\Windows\System\mPCifQX.exe
  C:\Windows\System\mPCifQX.exe
  2⤵
  PID:10752
- C:\Windows\System\GXFMnFd.exe
  C:\Windows\System\GXFMnFd.exe
  2⤵
  PID:12584
- C:\Windows\System\VupEzkh.exe
  C:\Windows\System\VupEzkh.exe
  2⤵
  PID:12644
- C:\Windows\System\gJMzbLi.exe
  C:\Windows\System\gJMzbLi.exe
  2⤵
  PID:12784
- C:\Windows\System\NEKVNpR.exe
  C:\Windows\System\NEKVNpR.exe
  2⤵
  PID:12880
- C:\Windows\System\vkGeZjB.exe
  C:\Windows\System\vkGeZjB.exe
  2⤵
  PID:13236
- C:\Windows\System\MBNeonc.exe
  C:\Windows\System\MBNeonc.exe
  2⤵
  PID:10640
- C:\Windows\System\NipNpQQ.exe
  C:\Windows\System\NipNpQQ.exe
  2⤵
  PID:9916
- C:\Windows\System\MHyeZpJ.exe
  C:\Windows\System\MHyeZpJ.exe
  2⤵
  PID:1524
- C:\Windows\System\cbvQQQI.exe
  C:\Windows\System\cbvQQQI.exe
  2⤵
  PID:348
- C:\Windows\System\KEDnbwK.exe
  C:\Windows\System\KEDnbwK.exe
  2⤵
  PID:1780
- C:\Windows\System\iOqtXXr.exe
  C:\Windows\System\iOqtXXr.exe
  2⤵
  PID:13156
- C:\Windows\System\lGnaKYT.exe
  C:\Windows\System\lGnaKYT.exe
  2⤵
  PID:6976
- C:\Windows\System\hEIowHx.exe
  C:\Windows\System\hEIowHx.exe
  2⤵
  PID:12396
- C:\Windows\System\NUzTiAz.exe
  C:\Windows\System\NUzTiAz.exe
  2⤵
  PID:1928
- C:\Windows\System\sIzMeln.exe
  C:\Windows\System\sIzMeln.exe
  2⤵
  PID:8260
- C:\Windows\System\KgyDxsA.exe
  C:\Windows\System\KgyDxsA.exe
  2⤵
  PID:2548
- C:\Windows\System\JwKltEk.exe
  C:\Windows\System\JwKltEk.exe
  2⤵
  PID:11324
- C:\Windows\System\gZXzfmz.exe
  C:\Windows\System\gZXzfmz.exe
  2⤵
  PID:8884
- C:\Windows\System\VVDruGg.exe
  C:\Windows\System\VVDruGg.exe
  2⤵
  PID:4948
- C:\Windows\System\lWfdwfu.exe
  C:\Windows\System\lWfdwfu.exe
  2⤵
  PID:10048
- C:\Windows\System\WHXoXDY.exe
  C:\Windows\System\WHXoXDY.exe
  2⤵
  PID:10076
- C:\Windows\System\olPEKdz.exe
  C:\Windows\System\olPEKdz.exe
  2⤵
  PID:6912
- C:\Windows\System\XdEfaMu.exe
  C:\Windows\System\XdEfaMu.exe
  2⤵
  PID:6440
- C:\Windows\System\BnsRyMM.exe
  C:\Windows\System\BnsRyMM.exe
  2⤵
  PID:10964
- C:\Windows\System\xASaCcf.exe
  C:\Windows\System\xASaCcf.exe
  2⤵
  PID:7296
- C:\Windows\System\srvKVER.exe
  C:\Windows\System\srvKVER.exe
  2⤵
  PID:10976
- C:\Windows\System\kSYUDNK.exe
  C:\Windows\System\kSYUDNK.exe
  2⤵
  PID:12476
- C:\Windows\System\cuzbnZj.exe
  C:\Windows\System\cuzbnZj.exe
  2⤵
  PID:12688
- C:\Windows\System\jESPmFk.exe
  C:\Windows\System\jESPmFk.exe
  2⤵
  PID:12704
- C:\Windows\System\VCaTthU.exe
  C:\Windows\System\VCaTthU.exe
  2⤵
  PID:12744
- C:\Windows\System\UyNCKPr.exe
  C:\Windows\System\UyNCKPr.exe
  2⤵
  PID:2908
- C:\Windows\System\VsLDoOu.exe
  C:\Windows\System\VsLDoOu.exe
  2⤵
  PID:5200
- C:\Windows\System\kxFhaKC.exe
  C:\Windows\System\kxFhaKC.exe
  2⤵
  PID:12900
- C:\Windows\System\OewUTXr.exe
  C:\Windows\System\OewUTXr.exe
  2⤵
  PID:11104
- C:\Windows\System\CFIJqwt.exe
  C:\Windows\System\CFIJqwt.exe
  2⤵
  PID:1380
- C:\Windows\System\AwOlZKR.exe
  C:\Windows\System\AwOlZKR.exe
  2⤵
  PID:12768
- C:\Windows\System\gaFzsqJ.exe
  C:\Windows\System\gaFzsqJ.exe
  2⤵
  PID:9348
- C:\Windows\System\UscSqSk.exe
  C:\Windows\System\UscSqSk.exe
  2⤵
  PID:9936
- C:\Windows\System\xFZKqeW.exe
  C:\Windows\System\xFZKqeW.exe
  2⤵
  PID:9836
- C:\Windows\System\lrwBCVZ.exe
  C:\Windows\System\lrwBCVZ.exe
  2⤵
  PID:9304
- C:\Windows\System\FuixmcS.exe
  C:\Windows\System\FuixmcS.exe
  2⤵
  PID:12560
- C:\Windows\System\lqclAan.exe
  C:\Windows\System\lqclAan.exe
  2⤵
  PID:7872
- C:\Windows\System\bbVBTCF.exe
  C:\Windows\System\bbVBTCF.exe
  2⤵
  PID:11076
- C:\Windows\System\vXWiWwT.exe
  C:\Windows\System\vXWiWwT.exe
  2⤵
  PID:9692
- C:\Windows\System\gMUagMS.exe
  C:\Windows\System\gMUagMS.exe
  2⤵
  PID:1460
- C:\Windows\System\mKrSFsC.exe
  C:\Windows\System\mKrSFsC.exe
  2⤵
  PID:12036
- C:\Windows\System\QDJqUEc.exe
  C:\Windows\System\QDJqUEc.exe
  2⤵
  PID:12128
- C:\Windows\System\UCDVeLK.exe
  C:\Windows\System\UCDVeLK.exe
  2⤵
  PID:11092
- C:\Windows\System\RzTdIOZ.exe
  C:\Windows\System\RzTdIOZ.exe
  2⤵
  PID:2028
- C:\Windows\System\zxjeWlC.exe
  C:\Windows\System\zxjeWlC.exe
  2⤵
  PID:11412
- C:\Windows\System\hhEpEJT.exe
  C:\Windows\System\hhEpEJT.exe
  2⤵
  PID:11608
- C:\Windows\System\OEPNXje.exe
  C:\Windows\System\OEPNXje.exe
  2⤵
  PID:11636
- C:\Windows\System\yXZjCIF.exe
  C:\Windows\System\yXZjCIF.exe
  2⤵
  PID:12520
- C:\Windows\System\UTMcRLQ.exe
  C:\Windows\System\UTMcRLQ.exe
  2⤵
  PID:11708
- C:\Windows\System\pplHKnn.exe
  C:\Windows\System\pplHKnn.exe
  2⤵
  PID:11744
- C:\Windows\System\AXgQhlr.exe
  C:\Windows\System\AXgQhlr.exe
  2⤵
  PID:11844
- C:\Windows\System\IXKVooM.exe
  C:\Windows\System\IXKVooM.exe
  2⤵
  PID:11868
- C:\Windows\System\lqGSBnv.exe
  C:\Windows\System\lqGSBnv.exe
  2⤵
  PID:452
- C:\Windows\System\uyTiFOL.exe
  C:\Windows\System\uyTiFOL.exe
  2⤵
  PID:13132
- C:\Windows\System\MDNVFST.exe
  C:\Windows\System\MDNVFST.exe
  2⤵
  PID:12096
- C:\Windows\System\UFRnkfZ.exe
  C:\Windows\System\UFRnkfZ.exe
  2⤵
  PID:8300
- C:\Windows\System\cXtubZz.exe
  C:\Windows\System\cXtubZz.exe
  2⤵
  PID:11776
- C:\Windows\System\wczKgWj.exe
  C:\Windows\System\wczKgWj.exe
  2⤵
  PID:12516
- C:\Windows\System\hWGumBq.exe
  C:\Windows\System\hWGumBq.exe
  2⤵
  PID:10728
- C:\Windows\System\QLoGJcy.exe
  C:\Windows\System\QLoGJcy.exe
  2⤵
  PID:12748
- C:\Windows\System\VRCjVoB.exe
  C:\Windows\System\VRCjVoB.exe
  2⤵
  PID:9700
- C:\Windows\System\ikYDjgd.exe
  C:\Windows\System\ikYDjgd.exe
  2⤵
  PID:10700
- C:\Windows\System\fNTPCmd.exe
  C:\Windows\System\fNTPCmd.exe
  2⤵
  PID:8120
- C:\Windows\System\OfDCCgr.exe
  C:\Windows\System\OfDCCgr.exe
  2⤵
  PID:10196
- C:\Windows\System\nMyjxMo.exe
  C:\Windows\System\nMyjxMo.exe
  2⤵
  PID:13316
- C:\Windows\System\ihFAtvM.exe
  C:\Windows\System\ihFAtvM.exe
  2⤵
  PID:13332
- C:\Windows\System\sgPqzUv.exe
  C:\Windows\System\sgPqzUv.exe
  2⤵
  PID:13372
- C:\Windows\System\tDphjcE.exe
  C:\Windows\System\tDphjcE.exe
  2⤵
  PID:13428
- C:\Windows\System\yXVhqui.exe
  C:\Windows\System\yXVhqui.exe
  2⤵
  PID:13448
- C:\Windows\System\BKBcWNF.exe
  C:\Windows\System\BKBcWNF.exe
  2⤵
  PID:13468
- C:\Windows\System\xFyFaJn.exe
  C:\Windows\System\xFyFaJn.exe
  2⤵
  PID:13512
- C:\Windows\System\jOtTEQW.exe
  C:\Windows\System\jOtTEQW.exe
  2⤵
  PID:13556
- C:\Windows\System\WEyqKnw.exe
  C:\Windows\System\WEyqKnw.exe
  2⤵
  PID:13580
- C:\Windows\System\uZJQaBy.exe
  C:\Windows\System\uZJQaBy.exe
  2⤵
  PID:13600
- C:\Windows\System\ZAGzyfh.exe
  C:\Windows\System\ZAGzyfh.exe
  2⤵
  PID:13620
- C:\Windows\System\GPdpuQC.exe
  C:\Windows\System\GPdpuQC.exe
  2⤵
  PID:13636
- C:\Windows\System\mFqOTUY.exe
  C:\Windows\System\mFqOTUY.exe
  2⤵
  PID:13656
- C:\Windows\System\JFZDHlF.exe
  C:\Windows\System\JFZDHlF.exe
  2⤵
  PID:13852
- C:\Windows\System\KEPPTMW.exe
  C:\Windows\System\KEPPTMW.exe
  2⤵
  PID:13872
- C:\Windows\System\EaHCkUC.exe
  C:\Windows\System\EaHCkUC.exe
  2⤵
  PID:13896
- C:\Windows\System\kkrHhbV.exe
  C:\Windows\System\kkrHhbV.exe
  2⤵
  PID:13912
- C:\Windows\System\buvIaRt.exe
  C:\Windows\System\buvIaRt.exe
  2⤵
  PID:13928
- C:\Windows\System\HQvWuhI.exe
  C:\Windows\System\HQvWuhI.exe
  2⤵
  PID:13988
- C:\Windows\System\TCLZKNk.exe
  C:\Windows\System\TCLZKNk.exe
  2⤵
  PID:14004
- C:\Windows\System\vRpIHvG.exe
  C:\Windows\System\vRpIHvG.exe
  2⤵
  PID:14020
- C:\Windows\System\WKVhvRm.exe
  C:\Windows\System\WKVhvRm.exe
  2⤵
  PID:14036
- C:\Windows\System\zEPJEHr.exe
  C:\Windows\System\zEPJEHr.exe
  2⤵
  PID:14052
- C:\Windows\System\ALuAMtb.exe
  C:\Windows\System\ALuAMtb.exe
  2⤵
  PID:14068
- C:\Windows\System\lIyqrnf.exe
  C:\Windows\System\lIyqrnf.exe
  2⤵
  PID:14084
- C:\Windows\System\wcdwkPr.exe
  C:\Windows\System\wcdwkPr.exe
  2⤵
  PID:14104
- C:\Windows\System\JQiMsxB.exe
  C:\Windows\System\JQiMsxB.exe
  2⤵
  PID:14120
- C:\Windows\System\KWfVsNC.exe
  C:\Windows\System\KWfVsNC.exe
  2⤵
  PID:14136
- C:\Windows\System\lrsWXkW.exe
  C:\Windows\System\lrsWXkW.exe
  2⤵
  PID:14228
- C:\Windows\System\FLYKALT.exe
  C:\Windows\System\FLYKALT.exe
  2⤵
  PID:14292
- C:\Windows\System\QrMdugt.exe
  C:\Windows\System\QrMdugt.exe
  2⤵
  PID:14312
- C:\Windows\System\YsWnXGU.exe
  C:\Windows\System\YsWnXGU.exe
  2⤵
  PID:7744
- C:\Windows\System\KBFsmxg.exe
  C:\Windows\System\KBFsmxg.exe
  2⤵
  PID:12640
- C:\Windows\System\sktaVjo.exe
  C:\Windows\System\sktaVjo.exe
  2⤵
  PID:12500
- C:\Windows\System\xOYNrZt.exe
  C:\Windows\System\xOYNrZt.exe
  2⤵
  PID:11588
- C:\Windows\System\AGZqzaH.exe
  C:\Windows\System\AGZqzaH.exe
  2⤵
  PID:9736
- C:\Windows\System\zZHlHqi.exe
  C:\Windows\System\zZHlHqi.exe
  2⤵
  PID:3644
- C:\Windows\System\mtqVcRz.exe
  C:\Windows\System\mtqVcRz.exe
  2⤵
  PID:8668
- C:\Windows\System\iHOUbBH.exe
  C:\Windows\System\iHOUbBH.exe
  2⤵
  PID:13240
- C:\Windows\System\lQOJbpE.exe
  C:\Windows\System\lQOJbpE.exe
  2⤵
  PID:13664
- C:\Windows\System\tPvPPxc.exe
  C:\Windows\System\tPvPPxc.exe
  2⤵
  PID:13704
- C:\Windows\System\cBlBlGY.exe
  C:\Windows\System\cBlBlGY.exe
  2⤵
  PID:13788
- C:\Windows\System\JXvQtfQ.exe
  C:\Windows\System\JXvQtfQ.exe
  2⤵
  PID:10432
- C:\Windows\System\DsTgiGq.exe
  C:\Windows\System\DsTgiGq.exe
  2⤵
  PID:8296
- C:\Windows\System\SewYemT.exe
  C:\Windows\System\SewYemT.exe
  2⤵
  PID:13944
- C:\Windows\System\vFSGBio.exe
  C:\Windows\System\vFSGBio.exe
  2⤵
  PID:14000
- C:\Windows\System\fykwCPk.exe
  C:\Windows\System\fykwCPk.exe
  2⤵
  PID:14244
- C:\Windows\System\EKnpuKW.exe
  C:\Windows\System\EKnpuKW.exe
  2⤵
  PID:14168
- C:\Windows\System\hDamNrq.exe
  C:\Windows\System\hDamNrq.exe
  2⤵
  PID:14300
- C:\Windows\System\HCPPzqJ.exe
  C:\Windows\System\HCPPzqJ.exe
  2⤵
  PID:11676
- C:\Windows\System\nNuZSlQ.exe
  C:\Windows\System\nNuZSlQ.exe
  2⤵
  PID:14116
- C:\Windows\System\ssxDwLf.exe
  C:\Windows\System\ssxDwLf.exe
  2⤵
  PID:11484
- C:\Windows\System\VSxfpfM.exe
  C:\Windows\System\VSxfpfM.exe
  2⤵
  PID:13460
- C:\Windows\System\LMGPKXA.exe
  C:\Windows\System\LMGPKXA.exe
  2⤵
  PID:13612
- C:\Windows\System\BytSGri.exe
  C:\Windows\System\BytSGri.exe
  2⤵
  PID:13960
- C:\Windows\System\rWayBnr.exe
  C:\Windows\System\rWayBnr.exe
  2⤵
  PID:13980
- C:\Windows\System\jqOlmiD.exe
  C:\Windows\System\jqOlmiD.exe
  2⤵
  PID:14160
- C:\Windows\System\WhtYAsA.exe
  C:\Windows\System\WhtYAsA.exe
  2⤵
  PID:14240
- C:\Windows\System\uxQmuAa.exe
  C:\Windows\System\uxQmuAa.exe
  2⤵
  PID:14284
- C:\Windows\System\GaDFhcE.exe
  C:\Windows\System\GaDFhcE.exe
  2⤵
  PID:10068
- C:\Windows\System\WRVrRuj.exe
  C:\Windows\System\WRVrRuj.exe
  2⤵
  PID:2820
- C:\Windows\System\EtTlMNa.exe
  C:\Windows\System\EtTlMNa.exe
  2⤵
  PID:1548
- C:\Windows\System\AvQYkCs.exe
  C:\Windows\System\AvQYkCs.exe
  2⤵
  PID:5088
- C:\Windows\System\NedXrGj.exe
  C:\Windows\System\NedXrGj.exe
  2⤵
  PID:9408
- C:\Windows\System\VDLErjb.exe
  C:\Windows\System\VDLErjb.exe
  2⤵
  PID:10620
- C:\Windows\System\OmhujrA.exe
  C:\Windows\System\OmhujrA.exe
  2⤵
  PID:14280
- C:\Windows\System\MjgyuMW.exe
  C:\Windows\System\MjgyuMW.exe
  2⤵
  PID:11108
- C:\Windows\System\jWCEuyz.exe
  C:\Windows\System\jWCEuyz.exe
  2⤵
  PID:8408
- C:\Windows\System\wvcUxAh.exe
  C:\Windows\System\wvcUxAh.exe
  2⤵
  PID:5692
- C:\Windows\System\FxLlERf.exe
  C:\Windows\System\FxLlERf.exe
  2⤵
  PID:9432
- C:\Windows\System\hhKxnjL.exe
  C:\Windows\System\hhKxnjL.exe
  2⤵
  PID:13764
- C:\Windows\System\ELBYdNB.exe
  C:\Windows\System\ELBYdNB.exe
  2⤵
  PID:13440
- C:\Windows\System\OSXNTIt.exe
  C:\Windows\System\OSXNTIt.exe
  2⤵
  PID:13628
- C:\Windows\System\jUfpQwJ.exe
  C:\Windows\System\jUfpQwJ.exe
  2⤵
  PID:13524
- C:\Windows\System\qRleZMB.exe
  C:\Windows\System\qRleZMB.exe
  2⤵
  PID:12016
- C:\Windows\System\LnogSkr.exe
  C:\Windows\System\LnogSkr.exe
  2⤵
  PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fch50fs4.pah.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\FCdPQJW.exe

Filesize
1.7MB

MD5
320f486cb4f968a11b267852599ab22f

SHA1
a3b87c8f36e4efeb6a3c8a9841bf3f65e8757cea

SHA256
4929887fd0658d8932c41e4babc0ebc141b025fcb55f85c55819bd9030973ef8

SHA512
2ba053af16447b0b8e0062e4bcd069a7b73fee70a8d8a76017b3d5cf73d3e6d064f992fa09e413e5bf0fd91a28a4d7eba2674e1d3106c12e1a8b1fd7496eaed1

Download Submit
C:\Windows\System\FfvKoRE.exe

Filesize
1.7MB

MD5
9556e53b2ae8bf2c9ca580f6f8fc1b1e

SHA1
9765c0950187b8fb65fc56be8de3ba6e3f0a53ac

SHA256
2ae38cb7dc2ca145c58b5b19f8a578770ebfc0d564d7113dd2033747ec29b8ed

SHA512
108cc4312715a0e59581dc7912846ee6c9411e9ad76eb3a534adcbbb8e20596606bf2263b4dadee85407f8a505cfca2d99a2a0339e16716d1f473dc089d2010b

Download Submit
C:\Windows\System\FoWaqXR.exe

Filesize
1.7MB

MD5
dfd813e7bb52c8c3894d5dc8ff1f2471

SHA1
5616a5864903697b1e00070172515ade278deabc

SHA256
954eb89b75d31c18197c8105b6be950843d06db03f3c710c53f79a25f77b4a50

SHA512
e9df631e44b33fe3deffe88d22cd096f1f897fdce31f8da7e83fe2558c446e7478252aabf17b03cdce867574c4a9ebbd2ca5696f82d58b5ad386ccfe803d3c7e

Download Submit
C:\Windows\System\IoTPueM.exe

Filesize
1.7MB

MD5
fc9e209a8ec77f5055d13baac0c5c64b

SHA1
bd73ef3a38d4cf20082d91fc6aae4bb4b7beb89b

SHA256
e720067cdaa112b433f596071f762b2bc33e1a15199500a8d2da4b2df46cb0ed

SHA512
2c302fcbbd83354964ea5040878fef3221e6e3a922a64947488b3b2842100820228df278472f9c6e15945f9243935adef39c99e44484e42c55b32252e14bb5cf

Download Submit
C:\Windows\System\JIXtPHk.exe

Filesize
1.7MB

MD5
c147983e867bcad800b7606912347262

SHA1
9168073f657c09a7fa1d1e8e0c2e9c411c7a9879

SHA256
649ad8cca9c9b62d2e18956ba4be2819b0edba8aaaa84a97d6fa825cd714c638

SHA512
2462c92d6fe464883a53f91c5ef15a4d221776aced84b4e18a37f3d6f6e90e7b0d5eb2c99efc7ee0097685165603b3b1a3ff01db4aa6bb8bf694414ed3e50764

Download Submit
C:\Windows\System\KdQUDpD.exe

Filesize
8B

MD5
f2b11a4f1fcbad6fc157ed82f7f152ac

SHA1
efd8b13fa95cf7a990978754c7431419030beea2

SHA256
c66c195439731503f84c2b4f6c9e40bc2d1f58a7ceadcee90edb295c024bedca

SHA512
8356a3a53ced9e99c13fb82daf6e13a9457c73bcf69ce83b0f0d7a8124059e77c8bc13a33625a791446918ce6d26ec52b29a4b64baea3c5dd240bd295f547ada

Download Submit
C:\Windows\System\KeLELFn.exe

Filesize
1.7MB

MD5
10e31971a070ccbdb816465a21c1f97f

SHA1
e886d5bbab6d81970aaf665ff0aa985d3889d975

SHA256
fb1239f754b78a817a33c01ad0a709e7e95e15844b32bf88ffd7f9dcc1f749d4

SHA512
daf96ab9f380a64feb09b54d9a21bd8ec59cba1a06e4e222e6931f76a1e90d22250536da48a65d89656cadb089a499774763af8c7a69d26712483f921e26d9af

Download Submit
C:\Windows\System\KgdUnUX.exe

Filesize
1.7MB

MD5
46370f1fc4e9baa35cd4c21504d4376c

SHA1
e54ed36b7236be44efaadfba3825b80f1ab73269

SHA256
7e09425955738c129e58368c4060c798fb7b2cd13f93291e015299e04de35c6d

SHA512
06d9c0d1cf9c3351f102a640d7e0e2be6920bed8130228f55cbe6d00d54c4241941ab162ad2690f2a4532bb9f17d36f34dcd3e025fd1b5be005e95c451dd73f8

Download Submit
C:\Windows\System\NzNfcge.exe

Filesize
1.7MB

MD5
cc0e9d1d48c23a87ffbeabaf6673d318

SHA1
bace9bcf8889a51414618caee2e0423cbc600f80

SHA256
050e61fd233c8b143f14cf18d5400030e2cbc5654fa0c5a73f091b461b1841e7

SHA512
7cbcad0de74b1caa75fbdf6b7b93422455cd2099dd4b4f54fae9f924a38e5a1a1e89d715b29c620254883c696e8010ac52be82c230f088d991d130c3c87b1e89

Download Submit
C:\Windows\System\SxtMBtq.exe

Filesize
1.7MB

MD5
3a0a01a4fd48549fa1da8663825c3030

SHA1
a55d4f933416256e22199d4ec1f1015f4faac0b1

SHA256
bbf8c0a37414fc6bb2054116af7971bc468112e7cc1afc47c3445f62d1616cd8

SHA512
ab17f3cc0d659abdbe26834c8a8c33a1a7481a2e4582a900414914221416b1cc41268a513594fb06a1a3658944788e034e1c3be74a75af196aa4c61bff4cc652

Download Submit
C:\Windows\System\TZlOTNg.exe

Filesize
1.7MB

MD5
78c36a005c3ec6eb1df3329076effaef

SHA1
d476a72fdedab33f804caa33dbfed02b2c81eef9

SHA256
7e1f53b8c3d40c8de6e6c059bb0b6a370ecf67a48e9ba460ba5f9ead31ebfcc8

SHA512
9485b355c624ee66c614c2f6bc8f8cb099340a103626907b9737b536331d0f45f66d71cab636a02fcda8582817db849b18e70525ced722fe9637fbb962bf27f1

Download Submit
C:\Windows\System\TkkBoaU.exe

Filesize
1.7MB

MD5
4aff2be6bcd67eb32d1eacd0ff7b9b7a

SHA1
cd877600269ef271762d2620f1c6412ae4ed3d1c

SHA256
814e4ee7a540a0ac433eb52f773eb73e485fca60ab340c689c1e79f39e71f5ed

SHA512
e7cd0f09787f21c975050eecb4b7171daab2559940d061667ef1fe2e3cad33f4313893e16db1c587ff784ea841dd77a57e3da6be9e477603352e230733bc3848

Download Submit
C:\Windows\System\UQrlvpG.exe

Filesize
1.7MB

MD5
fa59ba4e3c6f285b9f6749549d182a85

SHA1
71172542b8ff6a26d5f2f484846b08e90cad5e38

SHA256
6a9191989b4188443c4d3f2b885447ec3a70677f76e1a1c897fb83c2df2ddceb

SHA512
373f7a75830960cdfc36f94f18de1cb498816cafc710aa96d0b4ad597484a4b36eae3c5f3ba12dc1c9caa74a5847bfacf1aeec5e4c6f75c8798994da8cf5c53a

Download Submit
C:\Windows\System\XyWmcIQ.exe

Filesize
1.7MB

MD5
ec6a5280cbe0f975f1c73542d156a26d

SHA1
e0145f540aafad5f8c1b1bee2b17fe042ddedb41

SHA256
5614cda714386225e37f346121c11cd1ed6ba4838f9e3901aac6f889284c49c4

SHA512
77c6a9e875af643314b83a9fd920ecbc40eb48b90edaa88e0e71a8b96820e3e9902dbf9782c4eed3251f98afcda0c453fe9a409bf766b56e7ed20997ecdb471e

Download Submit
C:\Windows\System\XyvmGRJ.exe

Filesize
1.7MB

MD5
4cabcb57e8288705c770594e0e710a86

SHA1
7a6e6d3059a94e1bcc88d7159afe506cd275d644

SHA256
d9fa29f5cf4ebd4a7bb9a9fe64f490b326e7271352b68c14277d1a606561851c

SHA512
dceee8f7ad24f808637ae1d53fd56b2fd298c1bb659e6846a2291a3a67f3a70d054b72b9c337c55c566f902e8e13993159e5761975d034325a04630530a4fa5e

Download Submit
C:\Windows\System\aCpehff.exe

Filesize
1.7MB

MD5
052fc3996eda6962dc9d2b0749af61bd

SHA1
c1f73e2a09c919cfd35eb12fdb55b2eebbe4badd

SHA256
2389ba03a12b3066aa3152b6ff4cce788579386992a4ddbdbdb888a77583d91f

SHA512
89eb41a9c8b1f4cae8b036eb6a80f644e9aa609965217ee17a0f182eb31d7ecba99d71745fef8ff4589a9041daa6c8e3be559248ac522836a6be1f3cd66e753b

Download Submit
C:\Windows\System\akSYaql.exe

Filesize
1.7MB

MD5
68ad9363c6b68249eba3022b2e722be5

SHA1
e336396a39f5489964844dbdd4027d029ca424cd

SHA256
4f597c42cf6e703a18f121069cf774440312f76b433465654a73dd7a4ff6eada

SHA512
ce13c5921e5f219b0e59c4df308a1b0598c333fe96e7da44197d34db7298fd4b8d8b6a1c011707642ee2523a4f69f92628472494d4e1ac683da10e3522c2fa43

Download Submit
C:\Windows\System\beJjhUv.exe

Filesize
1.7MB

MD5
5b8c2c4d5dfa1ec3d5eed4d7160cd746

SHA1
1ce594c432ad96e2d029b7eab2098bf3c0b3c983

SHA256
e787e54b3a8b59768bee3141ad54b09845c04caeac4501b436b821bc1cecef6f

SHA512
23751c9a4a98b1bb812cf65b01ece638ce1c270daa4d6128d981e9fabd784f652dcb91902647ae3a2e220d1069656d86e616a2f23e90fa6d93c0d339625dcd21

Download Submit
C:\Windows\System\byMBZAi.exe

Filesize
1.7MB

MD5
778c77cfc01bcbcffff551249a53137f

SHA1
d81d39ce26913e05bfb3831c3e48ac0575129fba

SHA256
6926278ba22e6572a52cd9a840b7c000c7bd5ea4312a1d93884a4f4be977e985

SHA512
73f9fb878c10a44404ee7904ab5761b989ebd55ca8c0cb71617ab133979692d1ec544b98b5cd38ac8a99c12f2c4fb714877aa5c7080275af8d32b693c23371e7

Download Submit
C:\Windows\System\dSaqQpi.exe

Filesize
1.7MB

MD5
f0fe55b614ad4554c9b78439899daf29

SHA1
234a32924babfa1406c20b81f72ae974309008b5

SHA256
5bc8a4bc39936522152cd641d9c2a28613555888336c5c121d046d01bc2bc8be

SHA512
95046b85f5107e803cc34eef93de261c6f3a0b8aad46bddeadcc6d1a43405ac2898f2eccb1c758e8ccb92402f98604c57198e31b5aa1b9fc19d4bfacc4e9fbcc

Download Submit
C:\Windows\System\ePhbCRd.exe

Filesize
1.7MB

MD5
7006b798a5d59dd7401ee0ecbb7846e1

SHA1
3f65022afd5a487e60073dff320a3607ed5c84ba

SHA256
f043018821a0fabf93a6b7c26449d84feb6a9586ede481f0d949752cb1e16a0d

SHA512
8aebc2ab837d63d9f6c27db20b622636ae55d2465c764d77fb7cb6841e7e7bc8e84ea1ba5165e2288a49797c00193e2b0d3d015f8d008ca43de997ae672cf344

Download Submit
C:\Windows\System\ekojUzW.exe

Filesize
1.7MB

MD5
af1907a073795e4bd99df64b7f0b0ddf

SHA1
d7ead5129841092f094747f1d15e001479204a81

SHA256
6c05ef04ac95e1b9a513c1896d5058620ec774228c3e06fe0908ec1d2938de1d

SHA512
f5317b40b7323a22fd8e011da0cbba0cac204ca562fee8e432ca3e896dccc26377381a72059486b5a995f498f00c3ab10abb2f2b7c86229fc602a162eba40ea3

Download Submit
C:\Windows\System\faVYNHp.exe

Filesize
1.7MB

MD5
fcf1ca3f8e06970ce1369f972980f359

SHA1
fbf902c9b24515227247bfd47e5f1e3891babe44

SHA256
e1687c6975f501758f7e1799deb453580547f47b43f45782f216fcc1ef160b26

SHA512
841fd645427dad5c6b1aade28a8183c98c6187e3ea53d922b3641b0ff1f34862b08a688cd5880691555f428dfcd329a13850d77bfbdf78677dfb824aac2b140a

Download Submit
C:\Windows\System\gdQSRRd.exe

Filesize
1.7MB

MD5
f26296676d729b2ea2dd14130a6e7cc9

SHA1
61d9f3fd8630dcfaaa47363ecb1ce932d323e40f

SHA256
2ac25f136f08832af9b3d7c63b581e5f9c5baaa91120eeec34ae290c0bffc45b

SHA512
a62a7f8ea1fa8beda5d9d95b547c59c0e60fd2d7c326a6fb5d49d91a8b6d7f14cbb8bb67bdb0e5ecb9c14c34a5ac48bd60201a2ef4ebe8d09c4557a52a64570e

Download Submit
C:\Windows\System\hLskEVb.exe

Filesize
1.7MB

MD5
23656c71b1b777d13e561ab98a32c007

SHA1
af4dfa5ca5a45853069b3d31467a20187a45f675

SHA256
70175ad3fa65a95ccee456170026cc4b35c1ddaa515dc26c9b71e00987b1d3dd

SHA512
0d31cff372d44121d63d04729b35a815f29f85c40dfa1fc54cf05ae6823d428679f62c0583cff8bc3900b1111c5aaf3e455722278ae49eabd087d3970fe2a7e1

Download Submit
C:\Windows\System\iPuXyXh.exe

Filesize
1.7MB

MD5
cd8f475efdad60bd1360b746981884c9

SHA1
cfe46cc31cf65390e6c395f6b9a8ef8c66408514

SHA256
5d7a6d10c496873a1b3b47d5851a96d53227547e5e146778ecab3d60686f6ada

SHA512
06953f65bdc14da38087a36fc7b9373d0e90e06e8de9f7ff08f1f33f8946cdf590d765f57045271dbd81b9e6ff5a1e53432dae468d99e9cf636f2ad22d16f01a

Download Submit
C:\Windows\System\iaWtUhb.exe

Filesize
1.7MB

MD5
21e1c82874e55276eac723513ec2bafc

SHA1
16e3fbd0e0fdfe87fff44fe57daa16dedeac45fe

SHA256
204cf75b8e1e978ff2bec789d2b74e44a54effed489e00df54a3b82fc05e7da8

SHA512
bdbcfdd3ae42545f3307a0e9e3c8433c1a88caa9175ce9030cb853e54be08ab347df6bd83f92ac90b7941bd7168e1601413f097d55113eee4aff19613b182ccd

Download Submit
C:\Windows\System\ilsYTjt.exe

Filesize
1.7MB

MD5
b3ddc6747edf7794dd613ac3e056cff4

SHA1
c420c1fab3c1a63de11a3e8673596acccd496501

SHA256
8f5f2c6730726648055fb80f39ca8b0c52cf7093af4a7420f769a43ab63e023c

SHA512
4394565ff2869ccbbf562674e90fb4461ce935a44e513a1ae4dcadac1038fd311f2d009858c82b2c7b8c5007b25f534ed30e0f367cd257fce1aad53b7ea6c937

Download Submit
C:\Windows\System\jJwGYej.exe

Filesize
1.7MB

MD5
4aa3db056f822292ddadfd8e585ba752

SHA1
0fc3f14222a646e17137ab0f1e3129fd00222093

SHA256
d16ea48001b70116207cef10c42512c6e97c12742eb7e3ac21ba0f0e6272eea2

SHA512
3525515cabff53c0b48df5f417d2bfb6f936379ff538904c4d5389daaa17918a2782d22428e113feda77d233f46bb67d3863ac53aa943f9f5bbffc62e926288c

Download Submit
C:\Windows\System\jTKLgao.exe

Filesize
1.7MB

MD5
befe84ea96410e9834892cfe3c6bcbd5

SHA1
610c2975917849d57639a5492609642c45794fe4

SHA256
45f7438504d23e3a0238658a7244c16f65e95dfdb8915843fc7407a8f358ba13

SHA512
335d65314ff63d3557eb91080a344c3bb529d992cf14a9a81d5a97d919863f62c86afd028c1c29edd2779421f6cb8509573e3b4bf3f6247100a0eb3745597070

Download Submit
C:\Windows\System\lOdSQaQ.exe

Filesize
1.7MB

MD5
e9ba0328c0722f0b317c146ee32e5282

SHA1
c30c5589c4bdf7a71d47ed1e5ae3a2792c7185ba

SHA256
a8e326fe28cf50b3d56f5d365a4de3b9f8e401d447eecc4af5e7417d98c00c5a

SHA512
345824205026ada2ab4f35bc439599905b042fbc25dc642728fe950721ab9f2fd815a69e34714220e065c694a9c080e9ad359d9c08ba98db98cd17b5ae472cdd

Download Submit
C:\Windows\System\mLANDGo.exe

Filesize
1.7MB

MD5
639b2a208c8740867538c0c2d7145d41

SHA1
7eb4166428190a2208c880b5e5dffcfb714c2876

SHA256
b3e86212efc68941b129b43fa42bf33cd6f095cdf043f189582925ad4b817634

SHA512
f3e0fd314a831b0132d41817f171f55e89ad8f6a1115beba390bcc6164686b66e1c7f61f561f7473cf2ac7cafe3d556994b78724fb7a0dd3f4cc2c7e836cb853

Download Submit
C:\Windows\System\pKTlplK.exe

Filesize
1.7MB

MD5
d061fcca3bef407ac28b70c3c289fbc9

SHA1
7b28fd919e0323ae3ede608c8f2025c6b0d6482b

SHA256
eea952f3ac0e0f2bd5e9253cfcce564f549416852e675311c0aed5fe2ea06dc0

SHA512
5f6797e80d5cee80021a9c3fbd4f987667a98047d9bb914d318e835a014987071214985f8b8aa2ee052d3a6c32c9d3627598038869b099df331b7c281b33b5d4

Download Submit
C:\Windows\System\qDyiQvo.exe

Filesize
1.7MB

MD5
bb26e0e521e47ff5f77df3ac9d9e042f

SHA1
74766e86ce862618e844d3a029aa9ea5855029d0

SHA256
6690885c93873fb6696ec169df7c55cd027c44314439835500bb951ebfbd0e21

SHA512
05061cc8ff3e80e8692b659df19a0564748a5899e78eba9337f815b219cb87fa3e56c3faf6a7b7818e961c9015950b85f520d680358b32576b9ef2c0fe883b01

Download Submit
C:\Windows\System\sUIjFqX.exe

Filesize
1.7MB

MD5
efa6310ddd3c4bc94be93b55331b83b4

SHA1
3844e861c60782df8d286e3ba4ab3075ad1b376d

SHA256
fd8a5aad13b72abf7a0296bcb67488b573121adc3e0cbe4acb2e94490a0960d1

SHA512
ae1d987c56050e60c6669953cc3b030d6a94694eec1a2e5588e2e8a3a407e628dd99f9a10acedc1ac546040a3d4c345578fc7119db7d7bbce9eba8dc6f5e2485

Download Submit
C:\Windows\System\saToYkG.exe

Filesize
1.7MB

MD5
292a898063e507c109affab81315d9a7

SHA1
bb5ef9d78bb005d7b31d29bdcdaee5dd3de960bc

SHA256
e9b738e537c3c1b61a7348e45228d6ea79f0f636e937d3bc209778eb4c440821

SHA512
385bddcd7b03726b625d0243d6e857e61289f90a229e82a3016f6b8948a940299ead11d97e9b2dac3b77f6baa107f37e2fbc50d34457f00291f97e1f71865b2b

Download Submit
C:\Windows\System\tZkNTLm.exe

Filesize
1.7MB

MD5
ec616e064d94d689e2ca851cdf0984e0

SHA1
5974a89a16fdd51e189b6b42af2b5fb29dba6bf1

SHA256
ff41eba2151a350a99bada4fc88fe92374941711d351298710116e5003da87c1

SHA512
20822a983ddcc0c7ede16c3fc7be5cf99e2863b72a557b71b6495d85e4d41f9d3ee07e228c330f06db582e15ea3c6a8f855718f995962f82fb525db97b5b9a14

Download Submit
C:\Windows\System\ttDNmGN.exe

Filesize
1.7MB

MD5
e312632352d5f01f8221c9b07883cd8e

SHA1
c39231b9c1e82b7993881c3454d113eb2adb6393

SHA256
19798e342a264412598d16d417e19491212dbd30c847c758fa19d40d605f90fa

SHA512
4f63882c4f05dcaf7b21aa5408a569bac6cb3a27210def5b6cf175bba38518642c1a5303b95f921716074d26d73c7df306bbc97a1b6a684fff335c18ac4e28a3

Download Submit
C:\Windows\System\vNtPnee.exe

Filesize
1.7MB

MD5
8f7ab05f9d4b54369806d74fd3895785

SHA1
6d59d3d0210da481d76bfdbe5b5b5d7c3bd0ea0f

SHA256
a00558d669e13c7ebbf0526601c761956315dd2bfb6a30cf78cfe7f0133b987b

SHA512
f754098e00abfb3731a45635dfa1464688dc6befa95d1fffe3dcc4b029844d0dd5e05c5743af439bcdcc70b65c4282918f33f3f2836e5954cd035d9f4cff820f

Download Submit
C:\Windows\System\yEpxISI.exe

Filesize
1.7MB

MD5
bf022c86bdd89f36824e938108c920b4

SHA1
52b1d5b0451854a5643d30ee41cd3036b4d9aaeb

SHA256
4b0ed15506c0eb466d73bf2da5095cc1ba8b26424b6ea622c33ce6ac5526fc90

SHA512
eb0c0fffc89f4d28cd3de96a8468dbfecbc58e084c6fd5f68648accdf02fe1226414feeb0e728b42a21ef06f8e37ba3dc7c2f62b344a7a3d2824434dcf69415c

Download Submit
C:\Windows\System\yyNaZew.exe

Filesize
1.7MB

MD5
96fbe7b39b551179dc96e59b3510abed

SHA1
9f1b3741ebf25a4f47457ec2570f906c1ccdec55

SHA256
bc0de74eae2c9884b879fc495e324a2b54f3b9703f35ad8e7a0d370ec9268c3c

SHA512
bf738df1d878ab9bdc5a6d34a009acd397643f5e418f5a8cb84d8a075d6fa4bec6928995c68ffbf26f84ce3af442b79f60b2b6d2787a88e78af6f150bca3bcc9

Download Submit
memory/208-268-0x00007FF77F260000-0x00007FF77F652000-memory.dmp

Filesize
3.9MB

Download
memory/208-2988-0x00007FF77F260000-0x00007FF77F652000-memory.dmp

Filesize
3.9MB

Download
memory/232-256-0x00007FF7270C0000-0x00007FF7274B2000-memory.dmp

Filesize
3.9MB

Download
memory/232-2983-0x00007FF7270C0000-0x00007FF7274B2000-memory.dmp

Filesize
3.9MB

Download
memory/1120-251-0x00007FF62E3A0000-0x00007FF62E792000-memory.dmp

Filesize
3.9MB

Download
memory/1120-2980-0x00007FF62E3A0000-0x00007FF62E792000-memory.dmp

Filesize
3.9MB

Download
memory/1400-263-0x00007FF672200000-0x00007FF6725F2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-3011-0x00007FF672200000-0x00007FF6725F2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-266-0x00007FF60AA10000-0x00007FF60AE02000-memory.dmp

Filesize
3.9MB

Download
memory/1652-3022-0x00007FF60AA10000-0x00007FF60AE02000-memory.dmp

Filesize
3.9MB

Download
memory/1680-270-0x00007FF654580000-0x00007FF654972000-memory.dmp

Filesize
3.9MB

Download
memory/1680-3018-0x00007FF654580000-0x00007FF654972000-memory.dmp

Filesize
3.9MB

Download
memory/1984-2985-0x00007FF62DE20000-0x00007FF62E212000-memory.dmp

Filesize
3.9MB

Download
memory/1984-265-0x00007FF62DE20000-0x00007FF62E212000-memory.dmp

Filesize
3.9MB

Download
memory/2308-1983-0x00007FF64B500000-0x00007FF64B8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-0-0x00007FF64B500000-0x00007FF64B8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-1-0x0000021C6CCF0000-0x0000021C6CD00000-memory.dmp

Filesize
64KB

Download
memory/2484-3025-0x00007FF73CFB0000-0x00007FF73D3A2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-261-0x00007FF73CFB0000-0x00007FF73D3A2000-memory.dmp

Filesize
3.9MB

Download
memory/3248-2676-0x00007FFFE82A0000-0x00007FFFE8D61000-memory.dmp

Filesize
10.8MB

Download
memory/3248-117-0x000002311C3E0000-0x000002311C402000-memory.dmp

Filesize
136KB

Download
memory/3248-54-0x00007FFFE82A0000-0x00007FFFE8D61000-memory.dmp

Filesize
10.8MB

Download
memory/3248-267-0x00007FFFE82A0000-0x00007FFFE8D61000-memory.dmp

Filesize
10.8MB

Download
memory/3248-2203-0x00007FFFE82A3000-0x00007FFFE82A5000-memory.dmp

Filesize
8KB

Download
memory/3248-5-0x00007FFFE82A3000-0x00007FFFE82A5000-memory.dmp

Filesize
8KB

Download
memory/3540-124-0x00007FF6907E0000-0x00007FF690BD2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-2965-0x00007FF6907E0000-0x00007FF690BD2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-204-0x00007FF766840000-0x00007FF766C32000-memory.dmp

Filesize
3.9MB

Download
memory/3588-2967-0x00007FF766840000-0x00007FF766C32000-memory.dmp

Filesize
3.9MB

Download
memory/3636-162-0x00007FF623AA0000-0x00007FF623E92000-memory.dmp

Filesize
3.9MB

Download
memory/3636-2969-0x00007FF623AA0000-0x00007FF623E92000-memory.dmp

Filesize
3.9MB

Download
memory/3648-3014-0x00007FF73F1A0000-0x00007FF73F592000-memory.dmp

Filesize
3.9MB

Download
memory/3648-264-0x00007FF73F1A0000-0x00007FF73F592000-memory.dmp

Filesize
3.9MB

Download
memory/3708-258-0x00007FF692790000-0x00007FF692B82000-memory.dmp

Filesize
3.9MB

Download
memory/3708-2995-0x00007FF692790000-0x00007FF692B82000-memory.dmp

Filesize
3.9MB

Download
memory/3716-2975-0x00007FF6534A0000-0x00007FF653892000-memory.dmp

Filesize
3.9MB

Download
memory/3716-250-0x00007FF6534A0000-0x00007FF653892000-memory.dmp

Filesize
3.9MB

Download
memory/3960-210-0x00007FF71AE00000-0x00007FF71B1F2000-memory.dmp

Filesize
3.9MB

Download
memory/3960-2971-0x00007FF71AE00000-0x00007FF71B1F2000-memory.dmp

Filesize
3.9MB

Download
memory/4112-2963-0x00007FF7446C0000-0x00007FF744AB2000-memory.dmp

Filesize
3.9MB

Download
memory/4112-85-0x00007FF7446C0000-0x00007FF744AB2000-memory.dmp

Filesize
3.9MB

Download
memory/4248-2989-0x00007FF76B9F0000-0x00007FF76BDE2000-memory.dmp

Filesize
3.9MB

Download
memory/4248-257-0x00007FF76B9F0000-0x00007FF76BDE2000-memory.dmp

Filesize
3.9MB

Download
memory/4336-2977-0x00007FF607830000-0x00007FF607C22000-memory.dmp

Filesize
3.9MB

Download
memory/4336-259-0x00007FF607830000-0x00007FF607C22000-memory.dmp

Filesize
3.9MB

Download
memory/4636-2981-0x00007FF6F49F0000-0x00007FF6F4DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4636-260-0x00007FF6F49F0000-0x00007FF6F4DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4824-57-0x00007FF7DD760000-0x00007FF7DDB52000-memory.dmp

Filesize
3.9MB

Download
memory/4824-2961-0x00007FF7DD760000-0x00007FF7DDB52000-memory.dmp

Filesize
3.9MB

Download
memory/4876-11-0x00007FF723CE0000-0x00007FF7240D2000-memory.dmp

Filesize
3.9MB

Download
memory/4876-2349-0x00007FF723CE0000-0x00007FF7240D2000-memory.dmp

Filesize
3.9MB

Download
memory/4876-2959-0x00007FF723CE0000-0x00007FF7240D2000-memory.dmp

Filesize
3.9MB

Download
memory/4896-234-0x00007FF6A8C90000-0x00007FF6A9082000-memory.dmp

Filesize
3.9MB

Download
memory/4896-2973-0x00007FF6A8C90000-0x00007FF6A9082000-memory.dmp

Filesize
3.9MB

Download
memory/5036-3005-0x00007FF6721D0000-0x00007FF6725C2000-memory.dmp

Filesize
3.9MB

Download
memory/5036-269-0x00007FF6721D0000-0x00007FF6725C2000-memory.dmp

Filesize
3.9MB

Download
memory/5056-3016-0x00007FF7E82A0000-0x00007FF7E8692000-memory.dmp

Filesize
3.9MB

Download
memory/5056-262-0x00007FF7E82A0000-0x00007FF7E8692000-memory.dmp

Filesize
3.9MB

Download