xmrig | 44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
Size

1.6MB
MD5

bec3396da0969931b4c557015c392450
SHA1

7251583c2ccacccf6d724e81c12e37cefd17432e
SHA256

44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522
SHA512

c0a1073c8710bc0dfd013c30904fe5a169b0a6cb7ee4641f28574e198b6cc8fef86bc5de9effc4c42e6179fec5e17032c9ad898a0c21b2030d87253507160144
SSDEEP

49152:Lz071uv4BPMkyW10/wKV7hjSe5CtAlM22Cwj:NABl

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/4460-690-0x00007FF6B30D0000-0x00007FF6B34C2000-memory.dmp	xmrig
behavioral2/memory/4228-712-0x00007FF76D930000-0x00007FF76DD22000-memory.dmp	xmrig
behavioral2/memory/264-716-0x00007FF683D70000-0x00007FF684162000-memory.dmp	xmrig
behavioral2/memory/3300-2606-0x00007FF7B5BF0000-0x00007FF7B5FE2000-memory.dmp	xmrig
behavioral2/memory/5076-718-0x00007FF6AB250000-0x00007FF6AB642000-memory.dmp	xmrig
behavioral2/memory/1632-715-0x00007FF65AD40000-0x00007FF65B132000-memory.dmp	xmrig
behavioral2/memory/4540-714-0x00007FF6677D0000-0x00007FF667BC2000-memory.dmp	xmrig
behavioral2/memory/4352-713-0x00007FF797700000-0x00007FF797AF2000-memory.dmp	xmrig
behavioral2/memory/4772-711-0x00007FF7EBB90000-0x00007FF7EBF82000-memory.dmp	xmrig
behavioral2/memory/4380-710-0x00007FF790620000-0x00007FF790A12000-memory.dmp	xmrig
behavioral2/memory/4764-709-0x00007FF775630000-0x00007FF775A22000-memory.dmp	xmrig
behavioral2/memory/3664-708-0x00007FF758250000-0x00007FF758642000-memory.dmp	xmrig
behavioral2/memory/4724-707-0x00007FF764CC0000-0x00007FF7650B2000-memory.dmp	xmrig
behavioral2/memory/3588-687-0x00007FF624BB0000-0x00007FF624FA2000-memory.dmp	xmrig
behavioral2/memory/2128-501-0x00007FF64A730000-0x00007FF64AB22000-memory.dmp	xmrig
behavioral2/memory/3924-440-0x00007FF66D720000-0x00007FF66DB12000-memory.dmp	xmrig
behavioral2/memory/3712-431-0x00007FF622D90000-0x00007FF623182000-memory.dmp	xmrig
behavioral2/memory/1192-363-0x00007FF628680000-0x00007FF628A72000-memory.dmp	xmrig
behavioral2/memory/4936-284-0x00007FF6275B0000-0x00007FF6279A2000-memory.dmp	xmrig
behavioral2/memory/1132-234-0x00007FF7BB780000-0x00007FF7BBB72000-memory.dmp	xmrig
behavioral2/memory/4712-233-0x00007FF62A900000-0x00007FF62ACF2000-memory.dmp	xmrig
behavioral2/memory/4632-190-0x00007FF7BB720000-0x00007FF7BBB12000-memory.dmp	xmrig
behavioral2/memory/864-189-0x00007FF7CD820000-0x00007FF7CDC12000-memory.dmp	xmrig
behavioral2/memory/4848-154-0x00007FF7348B0000-0x00007FF734CA2000-memory.dmp	xmrig
behavioral2/memory/5072-121-0x00007FF686310000-0x00007FF686702000-memory.dmp	xmrig
behavioral2/memory/264-3658-0x00007FF683D70000-0x00007FF684162000-memory.dmp	xmrig
behavioral2/memory/5072-3660-0x00007FF686310000-0x00007FF686702000-memory.dmp	xmrig
behavioral2/memory/4848-3662-0x00007FF7348B0000-0x00007FF734CA2000-memory.dmp	xmrig
behavioral2/memory/4632-3681-0x00007FF7BB720000-0x00007FF7BBB12000-memory.dmp	xmrig
behavioral2/memory/3924-3682-0x00007FF66D720000-0x00007FF66DB12000-memory.dmp	xmrig
behavioral2/memory/4712-3688-0x00007FF62A900000-0x00007FF62ACF2000-memory.dmp	xmrig
behavioral2/memory/3588-3686-0x00007FF624BB0000-0x00007FF624FA2000-memory.dmp	xmrig
behavioral2/memory/864-3684-0x00007FF7CD820000-0x00007FF7CDC12000-memory.dmp	xmrig
behavioral2/memory/3712-3679-0x00007FF622D90000-0x00007FF623182000-memory.dmp	xmrig
behavioral2/memory/4724-3697-0x00007FF764CC0000-0x00007FF7650B2000-memory.dmp	xmrig
behavioral2/memory/1132-3701-0x00007FF7BB780000-0x00007FF7BBB72000-memory.dmp	xmrig
behavioral2/memory/1632-3707-0x00007FF65AD40000-0x00007FF65B132000-memory.dmp	xmrig
behavioral2/memory/4352-3711-0x00007FF797700000-0x00007FF797AF2000-memory.dmp	xmrig
behavioral2/memory/4764-3709-0x00007FF775630000-0x00007FF775A22000-memory.dmp	xmrig
behavioral2/memory/5076-3705-0x00007FF6AB250000-0x00007FF6AB642000-memory.dmp	xmrig
behavioral2/memory/3664-3704-0x00007FF758250000-0x00007FF758642000-memory.dmp	xmrig
behavioral2/memory/4936-3700-0x00007FF6275B0000-0x00007FF6279A2000-memory.dmp	xmrig
behavioral2/memory/1192-3694-0x00007FF628680000-0x00007FF628A72000-memory.dmp	xmrig
behavioral2/memory/4540-3690-0x00007FF6677D0000-0x00007FF667BC2000-memory.dmp	xmrig
behavioral2/memory/4460-3692-0x00007FF6B30D0000-0x00007FF6B34C2000-memory.dmp	xmrig
behavioral2/memory/4772-3750-0x00007FF7EBB90000-0x00007FF7EBF82000-memory.dmp	xmrig
behavioral2/memory/4228-3747-0x00007FF76D930000-0x00007FF76DD22000-memory.dmp	xmrig
behavioral2/memory/2128-3743-0x00007FF64A730000-0x00007FF64AB22000-memory.dmp	xmrig
behavioral2/memory/4380-3745-0x00007FF790620000-0x00007FF790A12000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3076	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
264	quVsLbc.exe
5072	nVzItgh.exe
4848	yqjodXM.exe
864	nUnmFJX.exe
4632	jkyudpI.exe
4712	rfbbyvc.exe
1132	iMHLyiH.exe
4936	BZDYJln.exe
1192	gwCKwFz.exe
3712	gvzLEvh.exe
3924	JJWTMqn.exe
2128	OUcSWvy.exe
3588	ZonscHv.exe
4460	GHiXINR.exe
4724	zIRTYAQ.exe
3664	IpVptrK.exe
4764	CweSkTL.exe
4380	KnOXsoA.exe
4772	grrIyeU.exe
4228	SyLBCZg.exe
4352	EUsXgRP.exe
4540	ziKbLsm.exe
5076	iVLcTFt.exe
1632	TZVXeZr.exe
1368	sPdfmcP.exe
4608	uLIBNYN.exe
4120	heNZsaN.exe
1804	WiTYZpL.exe
2672	EZCeIah.exe
956	ctEPkBU.exe
1760	hurYHPU.exe
2980	UxJzVMG.exe
1204	HNkCzkz.exe
4048	OuyvjYS.exe
4564	XYrLgse.exe
2344	bEzISYp.exe
4780	BRrkOXS.exe
944	fIvGpmg.exe
3756	vguhode.exe
2052	MSSGFxo.exe
5088	iuWHWoK.exe
692	FYjdWHj.exe
4636	NtYYJRj.exe
1988	ogenFfJ.exe
2928	kzcqWLU.exe
1572	umXFjdC.exe
3860	xLUGvUb.exe
2904	orPxObv.exe
4944	eqvcwnC.exe
2528	IzKTCCJ.exe
1636	Rsxlqlb.exe
2404	pUWXJyj.exe
3476	lcShKJv.exe
1244	rqoITZS.exe
1972	XWyZTVq.exe
4828	yXZrNnz.exe
2124	nvwZxVh.exe
4220	qsCbyEQ.exe
2488	WINuzFj.exe
1448	uoVJFYS.exe
1652	OTFrgkK.exe
4336	FHKNpPk.exe
4708	ShQTyGT.exe
2248	yvdFMoU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3300-0-0x00007FF7B5BF0000-0x00007FF7B5FE2000-memory.dmp	upx
behavioral2/files/0x00070000000233a7-9.dat	upx
behavioral2/files/0x00080000000233a2-7.dat	upx
behavioral2/files/0x00070000000233a6-10.dat	upx
behavioral2/files/0x00070000000233ad-42.dat	upx
behavioral2/files/0x00070000000233a8-40.dat	upx
behavioral2/files/0x00070000000233aa-29.dat	upx
behavioral2/files/0x00070000000233c2-127.dat	upx
behavioral2/files/0x00070000000233b2-159.dat	upx
behavioral2/files/0x00070000000233c9-194.dat	upx
behavioral2/memory/4460-690-0x00007FF6B30D0000-0x00007FF6B34C2000-memory.dmp	upx
behavioral2/memory/4228-712-0x00007FF76D930000-0x00007FF76DD22000-memory.dmp	upx
behavioral2/memory/264-716-0x00007FF683D70000-0x00007FF684162000-memory.dmp	upx
behavioral2/memory/3300-2606-0x00007FF7B5BF0000-0x00007FF7B5FE2000-memory.dmp	upx
behavioral2/memory/5076-718-0x00007FF6AB250000-0x00007FF6AB642000-memory.dmp	upx
behavioral2/memory/1632-715-0x00007FF65AD40000-0x00007FF65B132000-memory.dmp	upx
behavioral2/memory/4540-714-0x00007FF6677D0000-0x00007FF667BC2000-memory.dmp	upx
behavioral2/memory/4352-713-0x00007FF797700000-0x00007FF797AF2000-memory.dmp	upx
behavioral2/memory/4772-711-0x00007FF7EBB90000-0x00007FF7EBF82000-memory.dmp	upx
behavioral2/memory/4380-710-0x00007FF790620000-0x00007FF790A12000-memory.dmp	upx
behavioral2/memory/4764-709-0x00007FF775630000-0x00007FF775A22000-memory.dmp	upx
behavioral2/memory/3664-708-0x00007FF758250000-0x00007FF758642000-memory.dmp	upx
behavioral2/memory/4724-707-0x00007FF764CC0000-0x00007FF7650B2000-memory.dmp	upx
behavioral2/memory/3588-687-0x00007FF624BB0000-0x00007FF624FA2000-memory.dmp	upx
behavioral2/memory/2128-501-0x00007FF64A730000-0x00007FF64AB22000-memory.dmp	upx
behavioral2/memory/3924-440-0x00007FF66D720000-0x00007FF66DB12000-memory.dmp	upx
behavioral2/memory/3712-431-0x00007FF622D90000-0x00007FF623182000-memory.dmp	upx
behavioral2/memory/1192-363-0x00007FF628680000-0x00007FF628A72000-memory.dmp	upx
behavioral2/memory/4936-284-0x00007FF6275B0000-0x00007FF6279A2000-memory.dmp	upx
behavioral2/memory/1132-234-0x00007FF7BB780000-0x00007FF7BBB72000-memory.dmp	upx
behavioral2/memory/4712-233-0x00007FF62A900000-0x00007FF62ACF2000-memory.dmp	upx
behavioral2/files/0x00070000000233c3-196.dat	upx
behavioral2/files/0x00070000000233d0-195.dat	upx
behavioral2/files/0x00070000000233c7-193.dat	upx
behavioral2/files/0x00070000000233cf-192.dat	upx
behavioral2/files/0x00070000000233ce-191.dat	upx
behavioral2/memory/4632-190-0x00007FF7BB720000-0x00007FF7BBB12000-memory.dmp	upx
behavioral2/memory/864-189-0x00007FF7CD820000-0x00007FF7CDC12000-memory.dmp	upx
behavioral2/files/0x00070000000233c0-187.dat	upx
behavioral2/files/0x00070000000233ba-175.dat	upx
behavioral2/files/0x00070000000233cc-173.dat	upx
behavioral2/files/0x00070000000233cb-170.dat	upx
behavioral2/files/0x00070000000233c8-165.dat	upx
behavioral2/files/0x00070000000233c6-158.dat	upx
behavioral2/files/0x00070000000233c1-157.dat	upx
behavioral2/memory/4848-154-0x00007FF7348B0000-0x00007FF734CA2000-memory.dmp	upx
behavioral2/files/0x00070000000233c5-153.dat	upx
behavioral2/files/0x00080000000233be-152.dat	upx
behavioral2/files/0x00070000000233c4-151.dat	upx
behavioral2/files/0x00070000000233bf-182.dat	upx
behavioral2/files/0x00070000000233b4-174.dat	upx
behavioral2/files/0x00070000000233ae-144.dat	upx
behavioral2/files/0x00070000000233b3-140.dat	upx
behavioral2/memory/5072-121-0x00007FF686310000-0x00007FF686702000-memory.dmp	upx
behavioral2/files/0x00070000000233b9-106.dat	upx
behavioral2/files/0x00070000000233b8-105.dat	upx
behavioral2/files/0x00070000000233b7-104.dat	upx
behavioral2/files/0x00070000000233b6-103.dat	upx
behavioral2/files/0x00070000000233bc-150.dat	upx
behavioral2/files/0x00070000000233bb-149.dat	upx
behavioral2/files/0x00070000000233b5-102.dat	upx
behavioral2/files/0x00070000000233a9-136.dat	upx
behavioral2/files/0x00070000000233ac-85.dat	upx
behavioral2/files/0x00070000000233ab-69.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fSRIATl.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\ekFSEBS.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\WmsfmxR.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\nUnmFJX.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\baoGuQW.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\xIUbUWo.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\InVeoyH.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\YJNegdK.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\AIiRile.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\UufkjQl.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\UpqZHmG.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\ssDtSlH.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\wGxGdCn.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\uoBchnz.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\esvIbCm.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\lNWsxUK.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\elhFxCl.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\effjBzn.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\vgIYMDQ.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\tQoBLeg.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\qkSDhSo.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\DlpvQYk.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\WdNFHfS.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\nlklAbJ.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\xXkhQSv.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\grpJnDD.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\SRiOFIa.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\gHxfkLm.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\RPaLciJ.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\qMTkKru.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\MyyhbQU.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\SGgfzxi.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\zjfqbJt.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\NeIHEeL.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\ZZlyGdw.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\hVWoMVn.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\podhPXw.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\OCIQNbi.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\jfXNcml.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\KGKNPZu.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\FGvayNe.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\mkoEVnA.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\PSLNMIU.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\PPEbJTz.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\aKvlWZA.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\ygsmDgb.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\lbqEMsd.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\fQxUtuR.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\aUQIkVe.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\jbLKiag.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\DDGWLcI.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\paTYuyO.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\sJbnIJk.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\EKorHsp.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\JcXXqLQ.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\reKogZg.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\xYUYSBJ.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\QtuGWMc.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\TqsTOVx.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\knNKEYf.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\CRhGGwm.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\wdcsdtF.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\xXpoIdR.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
File created	C:\Windows\System\oNHcCZJ.exe	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3076	powershell.exe
3076	powershell.exe
3076	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeLockMemoryPrivilege	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3076	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	83
PID 3300 wrote to memory of 3076	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	83
PID 3300 wrote to memory of 264	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	84
PID 3300 wrote to memory of 264	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	84
PID 3300 wrote to memory of 5072	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	85
PID 3300 wrote to memory of 5072	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	85
PID 3300 wrote to memory of 4848	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	86
PID 3300 wrote to memory of 4848	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	86
PID 3300 wrote to memory of 4712	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	87
PID 3300 wrote to memory of 4712	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	87
PID 3300 wrote to memory of 4936	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	88
PID 3300 wrote to memory of 4936	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	88
PID 3300 wrote to memory of 864	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	89
PID 3300 wrote to memory of 864	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	89
PID 3300 wrote to memory of 4632	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	90
PID 3300 wrote to memory of 4632	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	90
PID 3300 wrote to memory of 3588	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	91
PID 3300 wrote to memory of 3588	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	91
PID 3300 wrote to memory of 1132	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	92
PID 3300 wrote to memory of 1132	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	92
PID 3300 wrote to memory of 1192	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	93
PID 3300 wrote to memory of 1192	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	93
PID 3300 wrote to memory of 3712	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	94
PID 3300 wrote to memory of 3712	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	94
PID 3300 wrote to memory of 3924	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	95
PID 3300 wrote to memory of 3924	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	95
PID 3300 wrote to memory of 2128	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	96
PID 3300 wrote to memory of 2128	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	96
PID 3300 wrote to memory of 4460	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	97
PID 3300 wrote to memory of 4460	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	97
PID 3300 wrote to memory of 4724	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	98
PID 3300 wrote to memory of 4724	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	98
PID 3300 wrote to memory of 3664	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	99
PID 3300 wrote to memory of 3664	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	99
PID 3300 wrote to memory of 4764	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	100
PID 3300 wrote to memory of 4764	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	100
PID 3300 wrote to memory of 4380	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	101
PID 3300 wrote to memory of 4380	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	101
PID 3300 wrote to memory of 4772	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	102
PID 3300 wrote to memory of 4772	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	102
PID 3300 wrote to memory of 4228	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	103
PID 3300 wrote to memory of 4228	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	103
PID 3300 wrote to memory of 4352	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	104
PID 3300 wrote to memory of 4352	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	104
PID 3300 wrote to memory of 4540	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	105
PID 3300 wrote to memory of 4540	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	105
PID 3300 wrote to memory of 1804	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	106
PID 3300 wrote to memory of 1804	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	106
PID 3300 wrote to memory of 2672	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	107
PID 3300 wrote to memory of 2672	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	107
PID 3300 wrote to memory of 5076	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	108
PID 3300 wrote to memory of 5076	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	108
PID 3300 wrote to memory of 1632	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	109
PID 3300 wrote to memory of 1632	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	109
PID 3300 wrote to memory of 1368	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	110
PID 3300 wrote to memory of 1368	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	110
PID 3300 wrote to memory of 4608	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	111
PID 3300 wrote to memory of 4608	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	111
PID 3300 wrote to memory of 4120	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	112
PID 3300 wrote to memory of 4120	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	112
PID 3300 wrote to memory of 956	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	113
PID 3300 wrote to memory of 956	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	113
PID 3300 wrote to memory of 1760	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	114
PID 3300 wrote to memory of 1760	3300	44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe	114

C:\Users\Admin\AppData\Local\Temp\44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe
"C:\Users\Admin\AppData\Local\Temp\44c1e33d067236dfc4ddc640fbf812faab3f2c7222c4083050f7b8c29ae38522N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Windows\System\quVsLbc.exe
  C:\Windows\System\quVsLbc.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\nVzItgh.exe
  C:\Windows\System\nVzItgh.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\yqjodXM.exe
  C:\Windows\System\yqjodXM.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\rfbbyvc.exe
  C:\Windows\System\rfbbyvc.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\BZDYJln.exe
  C:\Windows\System\BZDYJln.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\nUnmFJX.exe
  C:\Windows\System\nUnmFJX.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\jkyudpI.exe
  C:\Windows\System\jkyudpI.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\ZonscHv.exe
  C:\Windows\System\ZonscHv.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\iMHLyiH.exe
  C:\Windows\System\iMHLyiH.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\gwCKwFz.exe
  C:\Windows\System\gwCKwFz.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\gvzLEvh.exe
  C:\Windows\System\gvzLEvh.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\JJWTMqn.exe
  C:\Windows\System\JJWTMqn.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\OUcSWvy.exe
  C:\Windows\System\OUcSWvy.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\GHiXINR.exe
  C:\Windows\System\GHiXINR.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\zIRTYAQ.exe
  C:\Windows\System\zIRTYAQ.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\IpVptrK.exe
  C:\Windows\System\IpVptrK.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\CweSkTL.exe
  C:\Windows\System\CweSkTL.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\KnOXsoA.exe
  C:\Windows\System\KnOXsoA.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\grrIyeU.exe
  C:\Windows\System\grrIyeU.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\SyLBCZg.exe
  C:\Windows\System\SyLBCZg.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\EUsXgRP.exe
  C:\Windows\System\EUsXgRP.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\ziKbLsm.exe
  C:\Windows\System\ziKbLsm.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\WiTYZpL.exe
  C:\Windows\System\WiTYZpL.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\EZCeIah.exe
  C:\Windows\System\EZCeIah.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\iVLcTFt.exe
  C:\Windows\System\iVLcTFt.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\TZVXeZr.exe
  C:\Windows\System\TZVXeZr.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\sPdfmcP.exe
  C:\Windows\System\sPdfmcP.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\uLIBNYN.exe
  C:\Windows\System\uLIBNYN.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\heNZsaN.exe
  C:\Windows\System\heNZsaN.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\ctEPkBU.exe
  C:\Windows\System\ctEPkBU.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\hurYHPU.exe
  C:\Windows\System\hurYHPU.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\UxJzVMG.exe
  C:\Windows\System\UxJzVMG.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\HNkCzkz.exe
  C:\Windows\System\HNkCzkz.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\OuyvjYS.exe
  C:\Windows\System\OuyvjYS.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\XYrLgse.exe
  C:\Windows\System\XYrLgse.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\bEzISYp.exe
  C:\Windows\System\bEzISYp.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\FYjdWHj.exe
  C:\Windows\System\FYjdWHj.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\BRrkOXS.exe
  C:\Windows\System\BRrkOXS.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\fIvGpmg.exe
  C:\Windows\System\fIvGpmg.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\ogenFfJ.exe
  C:\Windows\System\ogenFfJ.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\vguhode.exe
  C:\Windows\System\vguhode.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\MSSGFxo.exe
  C:\Windows\System\MSSGFxo.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\iuWHWoK.exe
  C:\Windows\System\iuWHWoK.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\NtYYJRj.exe
  C:\Windows\System\NtYYJRj.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\kzcqWLU.exe
  C:\Windows\System\kzcqWLU.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\umXFjdC.exe
  C:\Windows\System\umXFjdC.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\xLUGvUb.exe
  C:\Windows\System\xLUGvUb.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\orPxObv.exe
  C:\Windows\System\orPxObv.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\eqvcwnC.exe
  C:\Windows\System\eqvcwnC.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\IzKTCCJ.exe
  C:\Windows\System\IzKTCCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\Rsxlqlb.exe
  C:\Windows\System\Rsxlqlb.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\pUWXJyj.exe
  C:\Windows\System\pUWXJyj.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\lcShKJv.exe
  C:\Windows\System\lcShKJv.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\rqoITZS.exe
  C:\Windows\System\rqoITZS.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\XWyZTVq.exe
  C:\Windows\System\XWyZTVq.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\yXZrNnz.exe
  C:\Windows\System\yXZrNnz.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\nvwZxVh.exe
  C:\Windows\System\nvwZxVh.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\qsCbyEQ.exe
  C:\Windows\System\qsCbyEQ.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\WINuzFj.exe
  C:\Windows\System\WINuzFj.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\uoVJFYS.exe
  C:\Windows\System\uoVJFYS.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\OTFrgkK.exe
  C:\Windows\System\OTFrgkK.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\FHKNpPk.exe
  C:\Windows\System\FHKNpPk.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\ShQTyGT.exe
  C:\Windows\System\ShQTyGT.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\JFdZHRD.exe
  C:\Windows\System\JFdZHRD.exe
  2⤵
  PID:4504
- C:\Windows\System\yvdFMoU.exe
  C:\Windows\System\yvdFMoU.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\kZYREJH.exe
  C:\Windows\System\kZYREJH.exe
  2⤵
  PID:684
- C:\Windows\System\wvmmvxY.exe
  C:\Windows\System\wvmmvxY.exe
  2⤵
  PID:4456
- C:\Windows\System\xhGLRfN.exe
  C:\Windows\System\xhGLRfN.exe
  2⤵
  PID:1200
- C:\Windows\System\drdWJdh.exe
  C:\Windows\System\drdWJdh.exe
  2⤵
  PID:2912
- C:\Windows\System\tyUqeov.exe
  C:\Windows\System\tyUqeov.exe
  2⤵
  PID:540
- C:\Windows\System\QaeyAjx.exe
  C:\Windows\System\QaeyAjx.exe
  2⤵
  PID:2724
- C:\Windows\System\gvAEhxB.exe
  C:\Windows\System\gvAEhxB.exe
  2⤵
  PID:2264
- C:\Windows\System\sZEyCSF.exe
  C:\Windows\System\sZEyCSF.exe
  2⤵
  PID:1720
- C:\Windows\System\QvufDBO.exe
  C:\Windows\System\QvufDBO.exe
  2⤵
  PID:1536
- C:\Windows\System\njPZjDI.exe
  C:\Windows\System\njPZjDI.exe
  2⤵
  PID:3596
- C:\Windows\System\HPyifZZ.exe
  C:\Windows\System\HPyifZZ.exe
  2⤵
  PID:2900
- C:\Windows\System\FbKnKol.exe
  C:\Windows\System\FbKnKol.exe
  2⤵
  PID:4476
- C:\Windows\System\WAPBzyz.exe
  C:\Windows\System\WAPBzyz.exe
  2⤵
  PID:3820
- C:\Windows\System\MgzgcHq.exe
  C:\Windows\System\MgzgcHq.exe
  2⤵
  PID:1576
- C:\Windows\System\NIkzIAw.exe
  C:\Windows\System\NIkzIAw.exe
  2⤵
  PID:2312
- C:\Windows\System\ehBBpTS.exe
  C:\Windows\System\ehBBpTS.exe
  2⤵
  PID:2712
- C:\Windows\System\nKmpByT.exe
  C:\Windows\System\nKmpByT.exe
  2⤵
  PID:2512
- C:\Windows\System\xNMQDnj.exe
  C:\Windows\System\xNMQDnj.exe
  2⤵
  PID:1364
- C:\Windows\System\xHyhCin.exe
  C:\Windows\System\xHyhCin.exe
  2⤵
  PID:1436
- C:\Windows\System\brVREyI.exe
  C:\Windows\System\brVREyI.exe
  2⤵
  PID:1640
- C:\Windows\System\ZXLRxWj.exe
  C:\Windows\System\ZXLRxWj.exe
  2⤵
  PID:784
- C:\Windows\System\PGwzOHs.exe
  C:\Windows\System\PGwzOHs.exe
  2⤵
  PID:2924
- C:\Windows\System\vHbDdtP.exe
  C:\Windows\System\vHbDdtP.exe
  2⤵
  PID:1064
- C:\Windows\System\OjfTJpL.exe
  C:\Windows\System\OjfTJpL.exe
  2⤵
  PID:3964
- C:\Windows\System\QQZeavo.exe
  C:\Windows\System\QQZeavo.exe
  2⤵
  PID:5136
- C:\Windows\System\UntSWXX.exe
  C:\Windows\System\UntSWXX.exe
  2⤵
  PID:5156
- C:\Windows\System\NGBjVbX.exe
  C:\Windows\System\NGBjVbX.exe
  2⤵
  PID:5176
- C:\Windows\System\oASnJtt.exe
  C:\Windows\System\oASnJtt.exe
  2⤵
  PID:5196
- C:\Windows\System\sbNQRyD.exe
  C:\Windows\System\sbNQRyD.exe
  2⤵
  PID:5224
- C:\Windows\System\qyQnwVR.exe
  C:\Windows\System\qyQnwVR.exe
  2⤵
  PID:5244
- C:\Windows\System\gebhkZD.exe
  C:\Windows\System\gebhkZD.exe
  2⤵
  PID:5260
- C:\Windows\System\hUFFbdc.exe
  C:\Windows\System\hUFFbdc.exe
  2⤵
  PID:5284
- C:\Windows\System\uWUzeeD.exe
  C:\Windows\System\uWUzeeD.exe
  2⤵
  PID:5312
- C:\Windows\System\shokKad.exe
  C:\Windows\System\shokKad.exe
  2⤵
  PID:5336
- C:\Windows\System\eFGzTkH.exe
  C:\Windows\System\eFGzTkH.exe
  2⤵
  PID:5360
- C:\Windows\System\mXNhvSx.exe
  C:\Windows\System\mXNhvSx.exe
  2⤵
  PID:5380
- C:\Windows\System\BtMPaeU.exe
  C:\Windows\System\BtMPaeU.exe
  2⤵
  PID:5400
- C:\Windows\System\TGiHudo.exe
  C:\Windows\System\TGiHudo.exe
  2⤵
  PID:5416
- C:\Windows\System\CisbWxl.exe
  C:\Windows\System\CisbWxl.exe
  2⤵
  PID:5432
- C:\Windows\System\hqxWUXP.exe
  C:\Windows\System\hqxWUXP.exe
  2⤵
  PID:5452
- C:\Windows\System\ZDVhyqc.exe
  C:\Windows\System\ZDVhyqc.exe
  2⤵
  PID:5468
- C:\Windows\System\ekySXaU.exe
  C:\Windows\System\ekySXaU.exe
  2⤵
  PID:5492
- C:\Windows\System\enSkkdA.exe
  C:\Windows\System\enSkkdA.exe
  2⤵
  PID:5508
- C:\Windows\System\qFWfCtd.exe
  C:\Windows\System\qFWfCtd.exe
  2⤵
  PID:5532
- C:\Windows\System\xqGUQfo.exe
  C:\Windows\System\xqGUQfo.exe
  2⤵
  PID:5548
- C:\Windows\System\giLSKOd.exe
  C:\Windows\System\giLSKOd.exe
  2⤵
  PID:5576
- C:\Windows\System\OUdhjvO.exe
  C:\Windows\System\OUdhjvO.exe
  2⤵
  PID:5596
- C:\Windows\System\MhjSMyX.exe
  C:\Windows\System\MhjSMyX.exe
  2⤵
  PID:5616
- C:\Windows\System\oVAJSNi.exe
  C:\Windows\System\oVAJSNi.exe
  2⤵
  PID:5632
- C:\Windows\System\FywKSjY.exe
  C:\Windows\System\FywKSjY.exe
  2⤵
  PID:5656
- C:\Windows\System\effjBzn.exe
  C:\Windows\System\effjBzn.exe
  2⤵
  PID:5676
- C:\Windows\System\lJeyoQw.exe
  C:\Windows\System\lJeyoQw.exe
  2⤵
  PID:5692
- C:\Windows\System\DGRiUWI.exe
  C:\Windows\System\DGRiUWI.exe
  2⤵
  PID:5708
- C:\Windows\System\MyJtZkH.exe
  C:\Windows\System\MyJtZkH.exe
  2⤵
  PID:5728
- C:\Windows\System\YYTMuuT.exe
  C:\Windows\System\YYTMuuT.exe
  2⤵
  PID:5796
- C:\Windows\System\SlTJjab.exe
  C:\Windows\System\SlTJjab.exe
  2⤵
  PID:5812
- C:\Windows\System\NJFABlZ.exe
  C:\Windows\System\NJFABlZ.exe
  2⤵
  PID:5836
- C:\Windows\System\PhBfmSf.exe
  C:\Windows\System\PhBfmSf.exe
  2⤵
  PID:5860
- C:\Windows\System\cfcTaAv.exe
  C:\Windows\System\cfcTaAv.exe
  2⤵
  PID:5884
- C:\Windows\System\gtnREbA.exe
  C:\Windows\System\gtnREbA.exe
  2⤵
  PID:5904
- C:\Windows\System\BxRsbNH.exe
  C:\Windows\System\BxRsbNH.exe
  2⤵
  PID:5920
- C:\Windows\System\dLDhGLO.exe
  C:\Windows\System\dLDhGLO.exe
  2⤵
  PID:5952
- C:\Windows\System\mUGRsJV.exe
  C:\Windows\System\mUGRsJV.exe
  2⤵
  PID:5976
- C:\Windows\System\yVizGEq.exe
  C:\Windows\System\yVizGEq.exe
  2⤵
  PID:5992
- C:\Windows\System\PhHybPS.exe
  C:\Windows\System\PhHybPS.exe
  2⤵
  PID:6016
- C:\Windows\System\UvdvBYV.exe
  C:\Windows\System\UvdvBYV.exe
  2⤵
  PID:6032
- C:\Windows\System\zFBUVyB.exe
  C:\Windows\System\zFBUVyB.exe
  2⤵
  PID:6056
- C:\Windows\System\enawJuv.exe
  C:\Windows\System\enawJuv.exe
  2⤵
  PID:6084
- C:\Windows\System\bAidlSn.exe
  C:\Windows\System\bAidlSn.exe
  2⤵
  PID:6100
- C:\Windows\System\RVfMmcQ.exe
  C:\Windows\System\RVfMmcQ.exe
  2⤵
  PID:6116
- C:\Windows\System\FdQYlTb.exe
  C:\Windows\System\FdQYlTb.exe
  2⤵
  PID:3676
- C:\Windows\System\rLZMMCS.exe
  C:\Windows\System\rLZMMCS.exe
  2⤵
  PID:2020
- C:\Windows\System\imUwFJG.exe
  C:\Windows\System\imUwFJG.exe
  2⤵
  PID:2068
- C:\Windows\System\QFOCVpL.exe
  C:\Windows\System\QFOCVpL.exe
  2⤵
  PID:3120
- C:\Windows\System\cGUiEng.exe
  C:\Windows\System\cGUiEng.exe
  2⤵
  PID:4224
- C:\Windows\System\WVJwlKZ.exe
  C:\Windows\System\WVJwlKZ.exe
  2⤵
  PID:1688
- C:\Windows\System\FpQigng.exe
  C:\Windows\System\FpQigng.exe
  2⤵
  PID:1848
- C:\Windows\System\ZBPryRG.exe
  C:\Windows\System\ZBPryRG.exe
  2⤵
  PID:548
- C:\Windows\System\wTahjyj.exe
  C:\Windows\System\wTahjyj.exe
  2⤵
  PID:2784
- C:\Windows\System\KPFqxqE.exe
  C:\Windows\System\KPFqxqE.exe
  2⤵
  PID:5328
- C:\Windows\System\KcGfFtm.exe
  C:\Windows\System\KcGfFtm.exe
  2⤵
  PID:1256
- C:\Windows\System\vusxARi.exe
  C:\Windows\System\vusxARi.exe
  2⤵
  PID:5644
- C:\Windows\System\gBPgdaM.exe
  C:\Windows\System\gBPgdaM.exe
  2⤵
  PID:5700
- C:\Windows\System\YdMXIfJ.exe
  C:\Windows\System\YdMXIfJ.exe
  2⤵
  PID:1724
- C:\Windows\System\muIWgfS.exe
  C:\Windows\System\muIWgfS.exe
  2⤵
  PID:64
- C:\Windows\System\VmxhUUI.exe
  C:\Windows\System\VmxhUUI.exe
  2⤵
  PID:2576
- C:\Windows\System\kXSFbQW.exe
  C:\Windows\System\kXSFbQW.exe
  2⤵
  PID:6152
- C:\Windows\System\FCIggkV.exe
  C:\Windows\System\FCIggkV.exe
  2⤵
  PID:6184
- C:\Windows\System\XWAlGKF.exe
  C:\Windows\System\XWAlGKF.exe
  2⤵
  PID:6212
- C:\Windows\System\aJwlDiP.exe
  C:\Windows\System\aJwlDiP.exe
  2⤵
  PID:6240
- C:\Windows\System\neazvFT.exe
  C:\Windows\System\neazvFT.exe
  2⤵
  PID:6268
- C:\Windows\System\aNhhqUt.exe
  C:\Windows\System\aNhhqUt.exe
  2⤵
  PID:6292
- C:\Windows\System\AiWEkmR.exe
  C:\Windows\System\AiWEkmR.exe
  2⤵
  PID:6312
- C:\Windows\System\PAnsjSB.exe
  C:\Windows\System\PAnsjSB.exe
  2⤵
  PID:6332
- C:\Windows\System\rnnTDMk.exe
  C:\Windows\System\rnnTDMk.exe
  2⤵
  PID:6352
- C:\Windows\System\ahyzVcz.exe
  C:\Windows\System\ahyzVcz.exe
  2⤵
  PID:6368
- C:\Windows\System\AhhINkt.exe
  C:\Windows\System\AhhINkt.exe
  2⤵
  PID:6392
- C:\Windows\System\PYsuUaU.exe
  C:\Windows\System\PYsuUaU.exe
  2⤵
  PID:6408
- C:\Windows\System\mzWIerg.exe
  C:\Windows\System\mzWIerg.exe
  2⤵
  PID:6428
- C:\Windows\System\gpJqVSs.exe
  C:\Windows\System\gpJqVSs.exe
  2⤵
  PID:6448
- C:\Windows\System\gKaQsnx.exe
  C:\Windows\System\gKaQsnx.exe
  2⤵
  PID:6468
- C:\Windows\System\QGNZAIy.exe
  C:\Windows\System\QGNZAIy.exe
  2⤵
  PID:6484
- C:\Windows\System\lgdLuMq.exe
  C:\Windows\System\lgdLuMq.exe
  2⤵
  PID:6508
- C:\Windows\System\QMwsLjI.exe
  C:\Windows\System\QMwsLjI.exe
  2⤵
  PID:6524
- C:\Windows\System\jnLEiqA.exe
  C:\Windows\System\jnLEiqA.exe
  2⤵
  PID:6544
- C:\Windows\System\wwLVPGY.exe
  C:\Windows\System\wwLVPGY.exe
  2⤵
  PID:6564
- C:\Windows\System\EHGpmtv.exe
  C:\Windows\System\EHGpmtv.exe
  2⤵
  PID:6580
- C:\Windows\System\xjTsNQo.exe
  C:\Windows\System\xjTsNQo.exe
  2⤵
  PID:6600
- C:\Windows\System\YUJRqxg.exe
  C:\Windows\System\YUJRqxg.exe
  2⤵
  PID:6620
- C:\Windows\System\nRzkXQX.exe
  C:\Windows\System\nRzkXQX.exe
  2⤵
  PID:6644
- C:\Windows\System\OwGmUjY.exe
  C:\Windows\System\OwGmUjY.exe
  2⤵
  PID:6660
- C:\Windows\System\FGvayNe.exe
  C:\Windows\System\FGvayNe.exe
  2⤵
  PID:6680
- C:\Windows\System\inwTOtE.exe
  C:\Windows\System\inwTOtE.exe
  2⤵
  PID:6700
- C:\Windows\System\KWtaTCF.exe
  C:\Windows\System\KWtaTCF.exe
  2⤵
  PID:6732
- C:\Windows\System\voHcyei.exe
  C:\Windows\System\voHcyei.exe
  2⤵
  PID:6748
- C:\Windows\System\bZhepQK.exe
  C:\Windows\System\bZhepQK.exe
  2⤵
  PID:6772
- C:\Windows\System\aYuNejI.exe
  C:\Windows\System\aYuNejI.exe
  2⤵
  PID:6796
- C:\Windows\System\tfArgiS.exe
  C:\Windows\System\tfArgiS.exe
  2⤵
  PID:6816
- C:\Windows\System\koAWXXb.exe
  C:\Windows\System\koAWXXb.exe
  2⤵
  PID:6840
- C:\Windows\System\pdGAfHg.exe
  C:\Windows\System\pdGAfHg.exe
  2⤵
  PID:6856
- C:\Windows\System\JEgJXSf.exe
  C:\Windows\System\JEgJXSf.exe
  2⤵
  PID:6880
- C:\Windows\System\WJbpcUv.exe
  C:\Windows\System\WJbpcUv.exe
  2⤵
  PID:6900
- C:\Windows\System\TggcVID.exe
  C:\Windows\System\TggcVID.exe
  2⤵
  PID:6920
- C:\Windows\System\MVQPNvm.exe
  C:\Windows\System\MVQPNvm.exe
  2⤵
  PID:6956
- C:\Windows\System\BwZFzbE.exe
  C:\Windows\System\BwZFzbE.exe
  2⤵
  PID:6972
- C:\Windows\System\EHdFPbD.exe
  C:\Windows\System\EHdFPbD.exe
  2⤵
  PID:6988
- C:\Windows\System\KiiNxKP.exe
  C:\Windows\System\KiiNxKP.exe
  2⤵
  PID:7008
- C:\Windows\System\NIvUvzr.exe
  C:\Windows\System\NIvUvzr.exe
  2⤵
  PID:7036
- C:\Windows\System\LHxjSKG.exe
  C:\Windows\System\LHxjSKG.exe
  2⤵
  PID:7052
- C:\Windows\System\yHepaNG.exe
  C:\Windows\System\yHepaNG.exe
  2⤵
  PID:7076
- C:\Windows\System\odpAvBT.exe
  C:\Windows\System\odpAvBT.exe
  2⤵
  PID:7104
- C:\Windows\System\lXtiEpW.exe
  C:\Windows\System\lXtiEpW.exe
  2⤵
  PID:7124
- C:\Windows\System\UQtNOXJ.exe
  C:\Windows\System\UQtNOXJ.exe
  2⤵
  PID:7144
- C:\Windows\System\pptIIAy.exe
  C:\Windows\System\pptIIAy.exe
  2⤵
  PID:5852
- C:\Windows\System\neeZRru.exe
  C:\Windows\System\neeZRru.exe
  2⤵
  PID:5900
- C:\Windows\System\YqaTHAh.exe
  C:\Windows\System\YqaTHAh.exe
  2⤵
  PID:5484
- C:\Windows\System\NDdRnDL.exe
  C:\Windows\System\NDdRnDL.exe
  2⤵
  PID:5500
- C:\Windows\System\qnjLYbn.exe
  C:\Windows\System\qnjLYbn.exe
  2⤵
  PID:6012
- C:\Windows\System\JqNIyUb.exe
  C:\Windows\System\JqNIyUb.exe
  2⤵
  PID:6068
- C:\Windows\System\MXINJKt.exe
  C:\Windows\System\MXINJKt.exe
  2⤵
  PID:6096
- C:\Windows\System\oUBwjuc.exe
  C:\Windows\System\oUBwjuc.exe
  2⤵
  PID:5092
- C:\Windows\System\eDXAWaU.exe
  C:\Windows\System\eDXAWaU.exe
  2⤵
  PID:3492
- C:\Windows\System\JNGrqmm.exe
  C:\Windows\System\JNGrqmm.exe
  2⤵
  PID:4976
- C:\Windows\System\pbdhVkh.exe
  C:\Windows\System\pbdhVkh.exe
  2⤵
  PID:5724
- C:\Windows\System\TaXRxqy.exe
  C:\Windows\System\TaXRxqy.exe
  2⤵
  PID:4876
- C:\Windows\System\buLWIVJ.exe
  C:\Windows\System\buLWIVJ.exe
  2⤵
  PID:3884
- C:\Windows\System\DsoIxSY.exe
  C:\Windows\System\DsoIxSY.exe
  2⤵
  PID:5132
- C:\Windows\System\qLuSvCA.exe
  C:\Windows\System\qLuSvCA.exe
  2⤵
  PID:5164
- C:\Windows\System\vqhJlDs.exe
  C:\Windows\System\vqhJlDs.exe
  2⤵
  PID:5220
- C:\Windows\System\mACAoMH.exe
  C:\Windows\System\mACAoMH.exe
  2⤵
  PID:5252
- C:\Windows\System\frUGoBV.exe
  C:\Windows\System\frUGoBV.exe
  2⤵
  PID:4964
- C:\Windows\System\MqGIBmh.exe
  C:\Windows\System\MqGIBmh.exe
  2⤵
  PID:5376
- C:\Windows\System\YwlYmtj.exe
  C:\Windows\System\YwlYmtj.exe
  2⤵
  PID:4700
- C:\Windows\System\KHWNfDg.exe
  C:\Windows\System\KHWNfDg.exe
  2⤵
  PID:5940
- C:\Windows\System\SboxDFi.exe
  C:\Windows\System\SboxDFi.exe
  2⤵
  PID:7188
- C:\Windows\System\UtrTdRZ.exe
  C:\Windows\System\UtrTdRZ.exe
  2⤵
  PID:7212
- C:\Windows\System\sRkmsZZ.exe
  C:\Windows\System\sRkmsZZ.exe
  2⤵
  PID:7232
- C:\Windows\System\EWKILuH.exe
  C:\Windows\System\EWKILuH.exe
  2⤵
  PID:7256
- C:\Windows\System\vWfimQr.exe
  C:\Windows\System\vWfimQr.exe
  2⤵
  PID:7280
- C:\Windows\System\rWrnwrd.exe
  C:\Windows\System\rWrnwrd.exe
  2⤵
  PID:7308
- C:\Windows\System\HbBpHkv.exe
  C:\Windows\System\HbBpHkv.exe
  2⤵
  PID:7324
- C:\Windows\System\wTmQpbH.exe
  C:\Windows\System\wTmQpbH.exe
  2⤵
  PID:7340
- C:\Windows\System\cKeTjNc.exe
  C:\Windows\System\cKeTjNc.exe
  2⤵
  PID:7368
- C:\Windows\System\cmgiKzH.exe
  C:\Windows\System\cmgiKzH.exe
  2⤵
  PID:7384
- C:\Windows\System\DlpvQYk.exe
  C:\Windows\System\DlpvQYk.exe
  2⤵
  PID:7408
- C:\Windows\System\MXlOfeY.exe
  C:\Windows\System\MXlOfeY.exe
  2⤵
  PID:7432
- C:\Windows\System\KQVYSwT.exe
  C:\Windows\System\KQVYSwT.exe
  2⤵
  PID:7476
- C:\Windows\System\RTEZXDu.exe
  C:\Windows\System\RTEZXDu.exe
  2⤵
  PID:7500
- C:\Windows\System\wefvmWF.exe
  C:\Windows\System\wefvmWF.exe
  2⤵
  PID:7516
- C:\Windows\System\rfAVTfw.exe
  C:\Windows\System\rfAVTfw.exe
  2⤵
  PID:7540
- C:\Windows\System\lbmgpkc.exe
  C:\Windows\System\lbmgpkc.exe
  2⤵
  PID:7560
- C:\Windows\System\asnpkoG.exe
  C:\Windows\System\asnpkoG.exe
  2⤵
  PID:7588
- C:\Windows\System\HklJFmX.exe
  C:\Windows\System\HklJFmX.exe
  2⤵
  PID:7604
- C:\Windows\System\uyXsOhX.exe
  C:\Windows\System\uyXsOhX.exe
  2⤵
  PID:7620
- C:\Windows\System\DcGClJQ.exe
  C:\Windows\System\DcGClJQ.exe
  2⤵
  PID:7640
- C:\Windows\System\SksYGGE.exe
  C:\Windows\System\SksYGGE.exe
  2⤵
  PID:7660
- C:\Windows\System\hMHhdSG.exe
  C:\Windows\System\hMHhdSG.exe
  2⤵
  PID:7676
- C:\Windows\System\txpXLCH.exe
  C:\Windows\System\txpXLCH.exe
  2⤵
  PID:7696
- C:\Windows\System\MpdTxBr.exe
  C:\Windows\System\MpdTxBr.exe
  2⤵
  PID:7712
- C:\Windows\System\iQXyOdV.exe
  C:\Windows\System\iQXyOdV.exe
  2⤵
  PID:7740
- C:\Windows\System\RaYLSiD.exe
  C:\Windows\System\RaYLSiD.exe
  2⤵
  PID:7780
- C:\Windows\System\WBcgVAc.exe
  C:\Windows\System\WBcgVAc.exe
  2⤵
  PID:7796
- C:\Windows\System\RwbbQEN.exe
  C:\Windows\System\RwbbQEN.exe
  2⤵
  PID:8020
- C:\Windows\System\AizcZbg.exe
  C:\Windows\System\AizcZbg.exe
  2⤵
  PID:8036
- C:\Windows\System\efsrFgd.exe
  C:\Windows\System\efsrFgd.exe
  2⤵
  PID:8052
- C:\Windows\System\ewQqqfQ.exe
  C:\Windows\System\ewQqqfQ.exe
  2⤵
  PID:8068
- C:\Windows\System\EOAzViV.exe
  C:\Windows\System\EOAzViV.exe
  2⤵
  PID:8084
- C:\Windows\System\KtvxoJZ.exe
  C:\Windows\System\KtvxoJZ.exe
  2⤵
  PID:8100
- C:\Windows\System\tNRvcrE.exe
  C:\Windows\System\tNRvcrE.exe
  2⤵
  PID:8116
- C:\Windows\System\nchkGLm.exe
  C:\Windows\System\nchkGLm.exe
  2⤵
  PID:8132
- C:\Windows\System\WnVxukp.exe
  C:\Windows\System\WnVxukp.exe
  2⤵
  PID:8148
- C:\Windows\System\cEJvVdv.exe
  C:\Windows\System\cEJvVdv.exe
  2⤵
  PID:8164
- C:\Windows\System\VdyMhTf.exe
  C:\Windows\System\VdyMhTf.exe
  2⤵
  PID:2848
- C:\Windows\System\ZRVHfGI.exe
  C:\Windows\System\ZRVHfGI.exe
  2⤵
  PID:5280
- C:\Windows\System\UzlWSSs.exe
  C:\Windows\System\UzlWSSs.exe
  2⤵
  PID:5488
- C:\Windows\System\BaTJzcm.exe
  C:\Windows\System\BaTJzcm.exe
  2⤵
  PID:5008
- C:\Windows\System\Jdkntvi.exe
  C:\Windows\System\Jdkntvi.exe
  2⤵
  PID:3324
- C:\Windows\System\QLHmhQb.exe
  C:\Windows\System\QLHmhQb.exe
  2⤵
  PID:6260
- C:\Windows\System\LGftZzd.exe
  C:\Windows\System\LGftZzd.exe
  2⤵
  PID:6300
- C:\Windows\System\OKxdodD.exe
  C:\Windows\System\OKxdodD.exe
  2⤵
  PID:6364
- C:\Windows\System\ycUPFec.exe
  C:\Windows\System\ycUPFec.exe
  2⤵
  PID:6400
- C:\Windows\System\WcuVNqT.exe
  C:\Windows\System\WcuVNqT.exe
  2⤵
  PID:6516
- C:\Windows\System\urAhOkY.exe
  C:\Windows\System\urAhOkY.exe
  2⤵
  PID:6572
- C:\Windows\System\sblyzKC.exe
  C:\Windows\System\sblyzKC.exe
  2⤵
  PID:6612
- C:\Windows\System\Coskfcq.exe
  C:\Windows\System\Coskfcq.exe
  2⤵
  PID:6632
- C:\Windows\System\mmnbfnO.exe
  C:\Windows\System\mmnbfnO.exe
  2⤵
  PID:6668
- C:\Windows\System\PVdKMSC.exe
  C:\Windows\System\PVdKMSC.exe
  2⤵
  PID:6864
- C:\Windows\System\zPyrUZM.exe
  C:\Windows\System\zPyrUZM.exe
  2⤵
  PID:7016
- C:\Windows\System\RqsDgIP.exe
  C:\Windows\System\RqsDgIP.exe
  2⤵
  PID:6108
- C:\Windows\System\dhkuMqp.exe
  C:\Windows\System\dhkuMqp.exe
  2⤵
  PID:5356
- C:\Windows\System\ukBrbQr.exe
  C:\Windows\System\ukBrbQr.exe
  2⤵
  PID:7268
- C:\Windows\System\ObHkWeu.exe
  C:\Windows\System\ObHkWeu.exe
  2⤵
  PID:7468
- C:\Windows\System\kDTpQig.exe
  C:\Windows\System\kDTpQig.exe
  2⤵
  PID:7568
- C:\Windows\System\qqpqKLU.exe
  C:\Windows\System\qqpqKLU.exe
  2⤵
  PID:4548
- C:\Windows\System\TOBQQbs.exe
  C:\Windows\System\TOBQQbs.exe
  2⤵
  PID:6688
- C:\Windows\System\OIIdvkY.exe
  C:\Windows\System\OIIdvkY.exe
  2⤵
  PID:6780
- C:\Windows\System\icpgOmt.exe
  C:\Windows\System\icpgOmt.exe
  2⤵
  PID:6848
- C:\Windows\System\bUuZycJ.exe
  C:\Windows\System\bUuZycJ.exe
  2⤵
  PID:6912
- C:\Windows\System\PhXJUhM.exe
  C:\Windows\System\PhXJUhM.exe
  2⤵
  PID:6984
- C:\Windows\System\hBsGRbu.exe
  C:\Windows\System\hBsGRbu.exe
  2⤵
  PID:7028
- C:\Windows\System\wiTyCPw.exe
  C:\Windows\System\wiTyCPw.exe
  2⤵
  PID:7096
- C:\Windows\System\AmdexOA.exe
  C:\Windows\System\AmdexOA.exe
  2⤵
  PID:7164
- C:\Windows\System\odMcURW.exe
  C:\Windows\System\odMcURW.exe
  2⤵
  PID:6000
- C:\Windows\System\LtlsBla.exe
  C:\Windows\System\LtlsBla.exe
  2⤵
  PID:6092
- C:\Windows\System\gYLKGxJ.exe
  C:\Windows\System\gYLKGxJ.exe
  2⤵
  PID:2216
- C:\Windows\System\iNjOOZU.exe
  C:\Windows\System\iNjOOZU.exe
  2⤵
  PID:3556
- C:\Windows\System\vTLsVCi.exe
  C:\Windows\System\vTLsVCi.exe
  2⤵
  PID:5148
- C:\Windows\System\lfZzftz.exe
  C:\Windows\System\lfZzftz.exe
  2⤵
  PID:5292
- C:\Windows\System\KEsZVwW.exe
  C:\Windows\System\KEsZVwW.exe
  2⤵
  PID:6148
- C:\Windows\System\jRWFlCE.exe
  C:\Windows\System\jRWFlCE.exe
  2⤵
  PID:7224
- C:\Windows\System\JsfBFVx.exe
  C:\Windows\System\JsfBFVx.exe
  2⤵
  PID:7276
- C:\Windows\System\uEMwlmw.exe
  C:\Windows\System\uEMwlmw.exe
  2⤵
  PID:7356
- C:\Windows\System\ZwdXZvX.exe
  C:\Windows\System\ZwdXZvX.exe
  2⤵
  PID:7396
- C:\Windows\System\veSUaZY.exe
  C:\Windows\System\veSUaZY.exe
  2⤵
  PID:7488
- C:\Windows\System\BtiaBRl.exe
  C:\Windows\System\BtiaBRl.exe
  2⤵
  PID:7536
- C:\Windows\System\JcxjiFi.exe
  C:\Windows\System\JcxjiFi.exe
  2⤵
  PID:7600
- C:\Windows\System\aoOKiOt.exe
  C:\Windows\System\aoOKiOt.exe
  2⤵
  PID:7668
- C:\Windows\System\EsAuWVp.exe
  C:\Windows\System\EsAuWVp.exe
  2⤵
  PID:7704
- C:\Windows\System\HaEGdhg.exe
  C:\Windows\System\HaEGdhg.exe
  2⤵
  PID:7792
- C:\Windows\System\CbthbjM.exe
  C:\Windows\System\CbthbjM.exe
  2⤵
  PID:8216
- C:\Windows\System\DYhfIAJ.exe
  C:\Windows\System\DYhfIAJ.exe
  2⤵
  PID:8236
- C:\Windows\System\WwIMbYN.exe
  C:\Windows\System\WwIMbYN.exe
  2⤵
  PID:8260
- C:\Windows\System\EnnVWLv.exe
  C:\Windows\System\EnnVWLv.exe
  2⤵
  PID:8284
- C:\Windows\System\ryWnjcQ.exe
  C:\Windows\System\ryWnjcQ.exe
  2⤵
  PID:8312
- C:\Windows\System\UuPXcpZ.exe
  C:\Windows\System\UuPXcpZ.exe
  2⤵
  PID:8336
- C:\Windows\System\KMhqYct.exe
  C:\Windows\System\KMhqYct.exe
  2⤵
  PID:8356
- C:\Windows\System\oqVtIWz.exe
  C:\Windows\System\oqVtIWz.exe
  2⤵
  PID:8384
- C:\Windows\System\OwbmwGC.exe
  C:\Windows\System\OwbmwGC.exe
  2⤵
  PID:8404
- C:\Windows\System\NxIAWQz.exe
  C:\Windows\System\NxIAWQz.exe
  2⤵
  PID:8424
- C:\Windows\System\YeYczvS.exe
  C:\Windows\System\YeYczvS.exe
  2⤵
  PID:8464
- C:\Windows\System\WdNFHfS.exe
  C:\Windows\System\WdNFHfS.exe
  2⤵
  PID:8484
- C:\Windows\System\RklYIjx.exe
  C:\Windows\System\RklYIjx.exe
  2⤵
  PID:8512
- C:\Windows\System\ASKgqPK.exe
  C:\Windows\System\ASKgqPK.exe
  2⤵
  PID:8532
- C:\Windows\System\dLNJTuN.exe
  C:\Windows\System\dLNJTuN.exe
  2⤵
  PID:8552
- C:\Windows\System\VzOWmoA.exe
  C:\Windows\System\VzOWmoA.exe
  2⤵
  PID:8580
- C:\Windows\System\CqgcdDh.exe
  C:\Windows\System\CqgcdDh.exe
  2⤵
  PID:8604
- C:\Windows\System\dFyBbEw.exe
  C:\Windows\System\dFyBbEw.exe
  2⤵
  PID:8648
- C:\Windows\System\OODZQxX.exe
  C:\Windows\System\OODZQxX.exe
  2⤵
  PID:8672
- C:\Windows\System\QSOHTbP.exe
  C:\Windows\System\QSOHTbP.exe
  2⤵
  PID:8692
- C:\Windows\System\oogAuNm.exe
  C:\Windows\System\oogAuNm.exe
  2⤵
  PID:8716
- C:\Windows\System\GnHIFDV.exe
  C:\Windows\System\GnHIFDV.exe
  2⤵
  PID:8740
- C:\Windows\System\cFxCHGK.exe
  C:\Windows\System\cFxCHGK.exe
  2⤵
  PID:8760
- C:\Windows\System\UmnOghF.exe
  C:\Windows\System\UmnOghF.exe
  2⤵
  PID:8784
- C:\Windows\System\nfrVDus.exe
  C:\Windows\System\nfrVDus.exe
  2⤵
  PID:8812
- C:\Windows\System\NIeciyi.exe
  C:\Windows\System\NIeciyi.exe
  2⤵
  PID:8836
- C:\Windows\System\bEczbLc.exe
  C:\Windows\System\bEczbLc.exe
  2⤵
  PID:8856
- C:\Windows\System\DBOkLHT.exe
  C:\Windows\System\DBOkLHT.exe
  2⤵
  PID:9600
- C:\Windows\System\KvFHpwM.exe
  C:\Windows\System\KvFHpwM.exe
  2⤵
  PID:9624
- C:\Windows\System\dsLvtSP.exe
  C:\Windows\System\dsLvtSP.exe
  2⤵
  PID:9652
- C:\Windows\System\CLAYCWG.exe
  C:\Windows\System\CLAYCWG.exe
  2⤵
  PID:9668
- C:\Windows\System\Tlngyka.exe
  C:\Windows\System\Tlngyka.exe
  2⤵
  PID:9696
- C:\Windows\System\yxsyEJC.exe
  C:\Windows\System\yxsyEJC.exe
  2⤵
  PID:9720
- C:\Windows\System\NNDRbqc.exe
  C:\Windows\System\NNDRbqc.exe
  2⤵
  PID:9736
- C:\Windows\System\kTMjHES.exe
  C:\Windows\System\kTMjHES.exe
  2⤵
  PID:9760
- C:\Windows\System\kRQTWVg.exe
  C:\Windows\System\kRQTWVg.exe
  2⤵
  PID:9776
- C:\Windows\System\IbOnkbe.exe
  C:\Windows\System\IbOnkbe.exe
  2⤵
  PID:9796
- C:\Windows\System\wVyolsP.exe
  C:\Windows\System\wVyolsP.exe
  2⤵
  PID:9816
- C:\Windows\System\SOQxWhQ.exe
  C:\Windows\System\SOQxWhQ.exe
  2⤵
  PID:9936
- C:\Windows\System\xIkaASY.exe
  C:\Windows\System\xIkaASY.exe
  2⤵
  PID:9956
- C:\Windows\System\UufkjQl.exe
  C:\Windows\System\UufkjQl.exe
  2⤵
  PID:9976
- C:\Windows\System\WAcbtpk.exe
  C:\Windows\System\WAcbtpk.exe
  2⤵
  PID:10000
- C:\Windows\System\aLVcBvX.exe
  C:\Windows\System\aLVcBvX.exe
  2⤵
  PID:10020
- C:\Windows\System\JdyLHgg.exe
  C:\Windows\System\JdyLHgg.exe
  2⤵
  PID:10036
- C:\Windows\System\XvPoklw.exe
  C:\Windows\System\XvPoklw.exe
  2⤵
  PID:10064
- C:\Windows\System\nZKsJcy.exe
  C:\Windows\System\nZKsJcy.exe
  2⤵
  PID:10084
- C:\Windows\System\grqNUAA.exe
  C:\Windows\System\grqNUAA.exe
  2⤵
  PID:10108
- C:\Windows\System\kOJbajB.exe
  C:\Windows\System\kOJbajB.exe
  2⤵
  PID:10128
- C:\Windows\System\MFwMYKy.exe
  C:\Windows\System\MFwMYKy.exe
  2⤵
  PID:10148
- C:\Windows\System\KUDHPLt.exe
  C:\Windows\System\KUDHPLt.exe
  2⤵
  PID:10172
- C:\Windows\System\aevEWkt.exe
  C:\Windows\System\aevEWkt.exe
  2⤵
  PID:10192
- C:\Windows\System\lwoXNGD.exe
  C:\Windows\System\lwoXNGD.exe
  2⤵
  PID:10212
- C:\Windows\System\sedvbUw.exe
  C:\Windows\System\sedvbUw.exe
  2⤵
  PID:10232
- C:\Windows\System\wRMgkbH.exe
  C:\Windows\System\wRMgkbH.exe
  2⤵
  PID:6952
- C:\Windows\System\aALrfOe.exe
  C:\Windows\System\aALrfOe.exe
  2⤵
  PID:4444
- C:\Windows\System\hDYJgrv.exe
  C:\Windows\System\hDYJgrv.exe
  2⤵
  PID:7196
- C:\Windows\System\TamVBko.exe
  C:\Windows\System\TamVBko.exe
  2⤵
  PID:8936
- C:\Windows\System\RWjuAtR.exe
  C:\Windows\System\RWjuAtR.exe
  2⤵
  PID:6552
- C:\Windows\System\mnMMGci.exe
  C:\Windows\System\mnMMGci.exe
  2⤵
  PID:5516
- C:\Windows\System\OUAyXOX.exe
  C:\Windows\System\OUAyXOX.exe
  2⤵
  PID:5396
- C:\Windows\System\qXqcUby.exe
  C:\Windows\System\qXqcUby.exe
  2⤵
  PID:8456
- C:\Windows\System\EhvehRx.exe
  C:\Windows\System\EhvehRx.exe
  2⤵
  PID:8572
- C:\Windows\System\mXVOMMS.exe
  C:\Windows\System\mXVOMMS.exe
  2⤵
  PID:8664
- C:\Windows\System\bwZbJZp.exe
  C:\Windows\System\bwZbJZp.exe
  2⤵
  PID:9612
- C:\Windows\System\qfzPyrI.exe
  C:\Windows\System\qfzPyrI.exe
  2⤵
  PID:8916
- C:\Windows\System\FfGVbTg.exe
  C:\Windows\System\FfGVbTg.exe
  2⤵
  PID:9692
- C:\Windows\System\wGFVSes.exe
  C:\Windows\System\wGFVSes.exe
  2⤵
  PID:9728
- C:\Windows\System\cnFhwUG.exe
  C:\Windows\System\cnFhwUG.exe
  2⤵
  PID:9788
- C:\Windows\System\ZrpMDPM.exe
  C:\Windows\System\ZrpMDPM.exe
  2⤵
  PID:10244
- C:\Windows\System\SLKxbXq.exe
  C:\Windows\System\SLKxbXq.exe
  2⤵
  PID:10272
- C:\Windows\System\ylCzcgM.exe
  C:\Windows\System\ylCzcgM.exe
  2⤵
  PID:10296
- C:\Windows\System\ZsmHYuN.exe
  C:\Windows\System\ZsmHYuN.exe
  2⤵
  PID:10320
- C:\Windows\System\QPZnpbC.exe
  C:\Windows\System\QPZnpbC.exe
  2⤵
  PID:10336
- C:\Windows\System\CfierxL.exe
  C:\Windows\System\CfierxL.exe
  2⤵
  PID:10360
- C:\Windows\System\EwSOQRU.exe
  C:\Windows\System\EwSOQRU.exe
  2⤵
  PID:10384
- C:\Windows\System\vpKkPwe.exe
  C:\Windows\System\vpKkPwe.exe
  2⤵
  PID:10404
- C:\Windows\System\imiWrmZ.exe
  C:\Windows\System\imiWrmZ.exe
  2⤵
  PID:10428
- C:\Windows\System\fJnECWH.exe
  C:\Windows\System\fJnECWH.exe
  2⤵
  PID:10444
- C:\Windows\System\vKBLJsV.exe
  C:\Windows\System\vKBLJsV.exe
  2⤵
  PID:10464
- C:\Windows\System\FWVvlME.exe
  C:\Windows\System\FWVvlME.exe
  2⤵
  PID:10480
- C:\Windows\System\MgbfiLF.exe
  C:\Windows\System\MgbfiLF.exe
  2⤵
  PID:10496
- C:\Windows\System\yxAmoXx.exe
  C:\Windows\System\yxAmoXx.exe
  2⤵
  PID:10512
- C:\Windows\System\lzkLshC.exe
  C:\Windows\System\lzkLshC.exe
  2⤵
  PID:10528
- C:\Windows\System\ceUhyrt.exe
  C:\Windows\System\ceUhyrt.exe
  2⤵
  PID:10544
- C:\Windows\System\DtvaYnf.exe
  C:\Windows\System\DtvaYnf.exe
  2⤵
  PID:10560
- C:\Windows\System\OuYCWRn.exe
  C:\Windows\System\OuYCWRn.exe
  2⤵
  PID:10584
- C:\Windows\System\DppsyHI.exe
  C:\Windows\System\DppsyHI.exe
  2⤵
  PID:10672
- C:\Windows\System\TsdzbYe.exe
  C:\Windows\System\TsdzbYe.exe
  2⤵
  PID:10696
- C:\Windows\System\AhPnvOr.exe
  C:\Windows\System\AhPnvOr.exe
  2⤵
  PID:10712
- C:\Windows\System\xXrCTLw.exe
  C:\Windows\System\xXrCTLw.exe
  2⤵
  PID:10740
- C:\Windows\System\GDNpjsl.exe
  C:\Windows\System\GDNpjsl.exe
  2⤵
  PID:10768
- C:\Windows\System\PkOROCZ.exe
  C:\Windows\System\PkOROCZ.exe
  2⤵
  PID:10784
- C:\Windows\System\ZBjdriK.exe
  C:\Windows\System\ZBjdriK.exe
  2⤵
  PID:10804
- C:\Windows\System\fOCXxav.exe
  C:\Windows\System\fOCXxav.exe
  2⤵
  PID:10828
- C:\Windows\System\uVajzVs.exe
  C:\Windows\System\uVajzVs.exe
  2⤵
  PID:10844
- C:\Windows\System\QYPXoDz.exe
  C:\Windows\System\QYPXoDz.exe
  2⤵
  PID:10868
- C:\Windows\System\wHSwOom.exe
  C:\Windows\System\wHSwOom.exe
  2⤵
  PID:10892
- C:\Windows\System\XMtzdyq.exe
  C:\Windows\System\XMtzdyq.exe
  2⤵
  PID:10908
- C:\Windows\System\eFKdfPL.exe
  C:\Windows\System\eFKdfPL.exe
  2⤵
  PID:10932
- C:\Windows\System\KrzSDaI.exe
  C:\Windows\System\KrzSDaI.exe
  2⤵
  PID:10952
- C:\Windows\System\fysuvBG.exe
  C:\Windows\System\fysuvBG.exe
  2⤵
  PID:10972
- C:\Windows\System\hhiyTNt.exe
  C:\Windows\System\hhiyTNt.exe
  2⤵
  PID:10996
- C:\Windows\System\mDjLnyb.exe
  C:\Windows\System\mDjLnyb.exe
  2⤵
  PID:11020
- C:\Windows\System\cRecIux.exe
  C:\Windows\System\cRecIux.exe
  2⤵
  PID:11040
- C:\Windows\System\yufChEB.exe
  C:\Windows\System\yufChEB.exe
  2⤵
  PID:11060
- C:\Windows\System\MiFLQkU.exe
  C:\Windows\System\MiFLQkU.exe
  2⤵
  PID:11084
- C:\Windows\System\uSTwUje.exe
  C:\Windows\System\uSTwUje.exe
  2⤵
  PID:11116
- C:\Windows\System\Khdrnjr.exe
  C:\Windows\System\Khdrnjr.exe
  2⤵
  PID:11136
- C:\Windows\System\vUBjPZj.exe
  C:\Windows\System\vUBjPZj.exe
  2⤵
  PID:11156
- C:\Windows\System\eoKsuha.exe
  C:\Windows\System\eoKsuha.exe
  2⤵
  PID:11176
- C:\Windows\System\ooLfFxG.exe
  C:\Windows\System\ooLfFxG.exe
  2⤵
  PID:11204
- C:\Windows\System\hDDBMqe.exe
  C:\Windows\System\hDDBMqe.exe
  2⤵
  PID:11224
- C:\Windows\System\LuwDMGE.exe
  C:\Windows\System\LuwDMGE.exe
  2⤵
  PID:11252
- C:\Windows\System\CAXFNSR.exe
  C:\Windows\System\CAXFNSR.exe
  2⤵
  PID:8032
- C:\Windows\System\LuRiali.exe
  C:\Windows\System\LuRiali.exe
  2⤵
  PID:8076
- C:\Windows\System\nSSwCNO.exe
  C:\Windows\System\nSSwCNO.exe
  2⤵
  PID:8124
- C:\Windows\System\xtToDJt.exe
  C:\Windows\System\xtToDJt.exe
  2⤵
  PID:8156
- C:\Windows\System\iutycFG.exe
  C:\Windows\System\iutycFG.exe
  2⤵
  PID:6480
- C:\Windows\System\xIAyAdk.exe
  C:\Windows\System\xIAyAdk.exe
  2⤵
  PID:5776
- C:\Windows\System\DdHOzfK.exe
  C:\Windows\System\DdHOzfK.exe
  2⤵
  PID:4892
- C:\Windows\System\MJzMmyG.exe
  C:\Windows\System\MJzMmyG.exe
  2⤵
  PID:6492
- C:\Windows\System\eSfKPBc.exe
  C:\Windows\System\eSfKPBc.exe
  2⤵
  PID:6236
- C:\Windows\System\CwwoAEb.exe
  C:\Windows\System\CwwoAEb.exe
  2⤵
  PID:6276
- C:\Windows\System\ljyQPqB.exe
  C:\Windows\System\ljyQPqB.exe
  2⤵
  PID:6456
- C:\Windows\System\ApSCGmq.exe
  C:\Windows\System\ApSCGmq.exe
  2⤵
  PID:7392
- C:\Windows\System\xQtTaXY.exe
  C:\Windows\System\xQtTaXY.exe
  2⤵
  PID:7572
- C:\Windows\System\fbvAzKC.exe
  C:\Windows\System\fbvAzKC.exe
  2⤵
  PID:6728
- C:\Windows\System\hgpwMie.exe
  C:\Windows\System\hgpwMie.exe
  2⤵
  PID:3104
- C:\Windows\System\qpKADaJ.exe
  C:\Windows\System\qpKADaJ.exe
  2⤵
  PID:5876
- C:\Windows\System\GBFXVUs.exe
  C:\Windows\System\GBFXVUs.exe
  2⤵
  PID:4148
- C:\Windows\System\cDhytyg.exe
  C:\Windows\System\cDhytyg.exe
  2⤵
  PID:4568
- C:\Windows\System\EMIHcAP.exe
  C:\Windows\System\EMIHcAP.exe
  2⤵
  PID:10048
- C:\Windows\System\FEedrII.exe
  C:\Windows\System\FEedrII.exe
  2⤵
  PID:7420
- C:\Windows\System\oUyVkfI.exe
  C:\Windows\System\oUyVkfI.exe
  2⤵
  PID:7512
- C:\Windows\System\CKQayzq.exe
  C:\Windows\System\CKQayzq.exe
  2⤵
  PID:7616
- C:\Windows\System\nhNRUvJ.exe
  C:\Windows\System\nhNRUvJ.exe
  2⤵
  PID:7692
- C:\Windows\System\RbKaHVW.exe
  C:\Windows\System\RbKaHVW.exe
  2⤵
  PID:8296
- C:\Windows\System\kjSDXDr.exe
  C:\Windows\System\kjSDXDr.exe
  2⤵
  PID:8320
- C:\Windows\System\pELgxjr.exe
  C:\Windows\System\pELgxjr.exe
  2⤵
  PID:8364
- C:\Windows\System\IaIBwEw.exe
  C:\Windows\System\IaIBwEw.exe
  2⤵
  PID:8392
- C:\Windows\System\xXJRtHC.exe
  C:\Windows\System\xXJRtHC.exe
  2⤵
  PID:8440
- C:\Windows\System\GpJJkoK.exe
  C:\Windows\System\GpJJkoK.exe
  2⤵
  PID:1468
- C:\Windows\System\YCawJhd.exe
  C:\Windows\System\YCawJhd.exe
  2⤵
  PID:3084
- C:\Windows\System\DdTntKV.exe
  C:\Windows\System\DdTntKV.exe
  2⤵
  PID:2544
- C:\Windows\System\yIrgVHl.exe
  C:\Windows\System\yIrgVHl.exe
  2⤵
  PID:8528
- C:\Windows\System\JEUkFaT.exe
  C:\Windows\System\JEUkFaT.exe
  2⤵
  PID:9488
- C:\Windows\System\xrQhwhu.exe
  C:\Windows\System\xrQhwhu.exe
  2⤵
  PID:8732
- C:\Windows\System\ITOpSqa.exe
  C:\Windows\System\ITOpSqa.exe
  2⤵
  PID:8768
- C:\Windows\System\pJxhKqt.exe
  C:\Windows\System\pJxhKqt.exe
  2⤵
  PID:8828
- C:\Windows\System\CuoPKrY.exe
  C:\Windows\System\CuoPKrY.exe
  2⤵
  PID:8872
- C:\Windows\System\BKtRsAp.exe
  C:\Windows\System\BKtRsAp.exe
  2⤵
  PID:7332
- C:\Windows\System\AWiYVMQ.exe
  C:\Windows\System\AWiYVMQ.exe
  2⤵
  PID:9608
- C:\Windows\System\QNXTJVB.exe
  C:\Windows\System\QNXTJVB.exe
  2⤵
  PID:9660
- C:\Windows\System\LBaXXlf.exe
  C:\Windows\System\LBaXXlf.exe
  2⤵
  PID:9704
- C:\Windows\System\HexHIDE.exe
  C:\Windows\System\HexHIDE.exe
  2⤵
  PID:8952
- C:\Windows\System\eVOHPTS.exe
  C:\Windows\System\eVOHPTS.exe
  2⤵
  PID:8968
- C:\Windows\System\WHoHxqF.exe
  C:\Windows\System\WHoHxqF.exe
  2⤵
  PID:8996
- C:\Windows\System\QdjCqOZ.exe
  C:\Windows\System\QdjCqOZ.exe
  2⤵
  PID:10328
- C:\Windows\System\BDsBpzV.exe
  C:\Windows\System\BDsBpzV.exe
  2⤵
  PID:10368
- C:\Windows\System\jLCyxPt.exe
  C:\Windows\System\jLCyxPt.exe
  2⤵
  PID:10472
- C:\Windows\System\hvxPxzN.exe
  C:\Windows\System\hvxPxzN.exe
  2⤵
  PID:1960
- C:\Windows\System\uGtuHHY.exe
  C:\Windows\System\uGtuHHY.exe
  2⤵
  PID:4180
- C:\Windows\System\UhbeRPp.exe
  C:\Windows\System\UhbeRPp.exe
  2⤵
  PID:10552
- C:\Windows\System\XquLKOC.exe
  C:\Windows\System\XquLKOC.exe
  2⤵
  PID:9192
- C:\Windows\System\UkgRQMz.exe
  C:\Windows\System\UkgRQMz.exe
  2⤵
  PID:5116
- C:\Windows\System\IxmdmFF.exe
  C:\Windows\System\IxmdmFF.exe
  2⤵
  PID:5056
- C:\Windows\System\SRDXZzU.exe
  C:\Windows\System\SRDXZzU.exe
  2⤵
  PID:10732
- C:\Windows\System\BmCWbcf.exe
  C:\Windows\System\BmCWbcf.exe
  2⤵
  PID:10060
- C:\Windows\System\niTygWs.exe
  C:\Windows\System\niTygWs.exe
  2⤵
  PID:10852
- C:\Windows\System\zIRbOUI.exe
  C:\Windows\System\zIRbOUI.exe
  2⤵
  PID:10888
- C:\Windows\System\VdjMvUt.exe
  C:\Windows\System\VdjMvUt.exe
  2⤵
  PID:10948
- C:\Windows\System\aTyWpMt.exe
  C:\Windows\System\aTyWpMt.exe
  2⤵
  PID:3672
- C:\Windows\System\stOpSXO.exe
  C:\Windows\System\stOpSXO.exe
  2⤵
  PID:11276
- C:\Windows\System\gsyaxkd.exe
  C:\Windows\System\gsyaxkd.exe
  2⤵
  PID:11296
- C:\Windows\System\rfsrAef.exe
  C:\Windows\System\rfsrAef.exe
  2⤵
  PID:11316
- C:\Windows\System\fXRcpGK.exe
  C:\Windows\System\fXRcpGK.exe
  2⤵
  PID:11340
- C:\Windows\System\jcEDtag.exe
  C:\Windows\System\jcEDtag.exe
  2⤵
  PID:11360
- C:\Windows\System\wGteyvl.exe
  C:\Windows\System\wGteyvl.exe
  2⤵
  PID:11380
- C:\Windows\System\bFtMymc.exe
  C:\Windows\System\bFtMymc.exe
  2⤵
  PID:11400
- C:\Windows\System\AihslMQ.exe
  C:\Windows\System\AihslMQ.exe
  2⤵
  PID:11420
- C:\Windows\System\PDZtDOr.exe
  C:\Windows\System\PDZtDOr.exe
  2⤵
  PID:11444
- C:\Windows\System\QlymKio.exe
  C:\Windows\System\QlymKio.exe
  2⤵
  PID:11460
- C:\Windows\System\TyjQuMA.exe
  C:\Windows\System\TyjQuMA.exe
  2⤵
  PID:11484
- C:\Windows\System\CulnVLa.exe
  C:\Windows\System\CulnVLa.exe
  2⤵
  PID:11500
- C:\Windows\System\oxORQig.exe
  C:\Windows\System\oxORQig.exe
  2⤵
  PID:11520
- C:\Windows\System\AGdaVev.exe
  C:\Windows\System\AGdaVev.exe
  2⤵
  PID:11544
- C:\Windows\System\vgLgrpi.exe
  C:\Windows\System\vgLgrpi.exe
  2⤵
  PID:11560
- C:\Windows\System\FAEQRxV.exe
  C:\Windows\System\FAEQRxV.exe
  2⤵
  PID:11580
- C:\Windows\System\TrgLkbE.exe
  C:\Windows\System\TrgLkbE.exe
  2⤵
  PID:11604
- C:\Windows\System\TTwTMAK.exe
  C:\Windows\System\TTwTMAK.exe
  2⤵
  PID:11632
- C:\Windows\System\wZqRsjt.exe
  C:\Windows\System\wZqRsjt.exe
  2⤵
  PID:11652
- C:\Windows\System\JkTdvRA.exe
  C:\Windows\System\JkTdvRA.exe
  2⤵
  PID:11676
- C:\Windows\System\VvdXRQK.exe
  C:\Windows\System\VvdXRQK.exe
  2⤵
  PID:11696
- C:\Windows\System\IiWqjJp.exe
  C:\Windows\System\IiWqjJp.exe
  2⤵
  PID:11720
- C:\Windows\System\KffLQTg.exe
  C:\Windows\System\KffLQTg.exe
  2⤵
  PID:11740
- C:\Windows\System\TGMntHG.exe
  C:\Windows\System\TGMntHG.exe
  2⤵
  PID:11764
- C:\Windows\System\nDWCTuB.exe
  C:\Windows\System\nDWCTuB.exe
  2⤵
  PID:11784
- C:\Windows\System\ZzWgOfq.exe
  C:\Windows\System\ZzWgOfq.exe
  2⤵
  PID:11808
- C:\Windows\System\lxuzBlK.exe
  C:\Windows\System\lxuzBlK.exe
  2⤵
  PID:11828
- C:\Windows\System\jNPzPds.exe
  C:\Windows\System\jNPzPds.exe
  2⤵
  PID:11852
- C:\Windows\System\iMtiXJv.exe
  C:\Windows\System\iMtiXJv.exe
  2⤵
  PID:11868
- C:\Windows\System\oeOxbFr.exe
  C:\Windows\System\oeOxbFr.exe
  2⤵
  PID:11888
- C:\Windows\System\oEzaxnv.exe
  C:\Windows\System\oEzaxnv.exe
  2⤵
  PID:12048
- C:\Windows\System\QkDhbjt.exe
  C:\Windows\System\QkDhbjt.exe
  2⤵
  PID:12064
- C:\Windows\System\xLXQkJf.exe
  C:\Windows\System\xLXQkJf.exe
  2⤵
  PID:12080
- C:\Windows\System\kuccUpp.exe
  C:\Windows\System\kuccUpp.exe
  2⤵
  PID:12096
- C:\Windows\System\ZYQLKZb.exe
  C:\Windows\System\ZYQLKZb.exe
  2⤵
  PID:12112
- C:\Windows\System\uOokABC.exe
  C:\Windows\System\uOokABC.exe
  2⤵
  PID:12176
- C:\Windows\System\XcnvlWX.exe
  C:\Windows\System\XcnvlWX.exe
  2⤵
  PID:12244
- C:\Windows\System\aewBOHe.exe
  C:\Windows\System\aewBOHe.exe
  2⤵
  PID:12260
- C:\Windows\System\LOuDQbu.exe
  C:\Windows\System\LOuDQbu.exe
  2⤵
  PID:12276
- C:\Windows\System\vRZAgIG.exe
  C:\Windows\System\vRZAgIG.exe
  2⤵
  PID:10104
- C:\Windows\System\cBaozGX.exe
  C:\Windows\System\cBaozGX.exe
  2⤵
  PID:10144
- C:\Windows\System\JjCGrvj.exe
  C:\Windows\System\JjCGrvj.exe
  2⤵
  PID:1372
- C:\Windows\System\vkSjXAo.exe
  C:\Windows\System\vkSjXAo.exe
  2⤵
  PID:6936
- C:\Windows\System\GWedjBy.exe
  C:\Windows\System\GWedjBy.exe
  2⤵
  PID:7048
- C:\Windows\System\ktQycPC.exe
  C:\Windows\System\ktQycPC.exe
  2⤵
  PID:8876
- C:\Windows\System\WaApMkL.exe
  C:\Windows\System\WaApMkL.exe
  2⤵
  PID:8144
- C:\Windows\System\VDnREnm.exe
  C:\Windows\System\VDnREnm.exe
  2⤵
  PID:8444
- C:\Windows\System\SyLtxQq.exe
  C:\Windows\System\SyLtxQq.exe
  2⤵
  PID:5788
- C:\Windows\System\sEDgibZ.exe
  C:\Windows\System\sEDgibZ.exe
  2⤵
  PID:5588
- C:\Windows\System\tWkDpRi.exe
  C:\Windows\System\tWkDpRi.exe
  2⤵
  PID:9768
- C:\Windows\System\UnnUloF.exe
  C:\Windows\System\UnnUloF.exe
  2⤵
  PID:9804
- C:\Windows\System\YEEgKkD.exe
  C:\Windows\System\YEEgKkD.exe
  2⤵
  PID:10268
- C:\Windows\System\GEVpaYT.exe
  C:\Windows\System\GEVpaYT.exe
  2⤵
  PID:10260
- C:\Windows\System\nLcwVNP.exe
  C:\Windows\System\nLcwVNP.exe
  2⤵
  PID:2032
- C:\Windows\System\pxrXooQ.exe
  C:\Windows\System\pxrXooQ.exe
  2⤵
  PID:7584
- C:\Windows\System\wDSKqVj.exe
  C:\Windows\System\wDSKqVj.exe
  2⤵
  PID:10488
- C:\Windows\System\mJMIulk.exe
  C:\Windows\System\mJMIulk.exe
  2⤵
  PID:9896
- C:\Windows\System\DDOSkhU.exe
  C:\Windows\System\DDOSkhU.exe
  2⤵
  PID:1820
- C:\Windows\System\NNclGCE.exe
  C:\Windows\System\NNclGCE.exe
  2⤵
  PID:4760
- C:\Windows\System\UBCcKCl.exe
  C:\Windows\System\UBCcKCl.exe
  2⤵
  PID:9948
- C:\Windows\System\oMAgBkd.exe
  C:\Windows\System\oMAgBkd.exe
  2⤵
  PID:10760
- C:\Windows\System\kpECMCN.exe
  C:\Windows\System\kpECMCN.exe
  2⤵
  PID:10780
- C:\Windows\System\YOWkdiZ.exe
  C:\Windows\System\YOWkdiZ.exe
  2⤵
  PID:10556
- C:\Windows\System\GirGhEJ.exe
  C:\Windows\System\GirGhEJ.exe
  2⤵
  PID:10916
- C:\Windows\System\XlhoUxC.exe
  C:\Windows\System\XlhoUxC.exe
  2⤵
  PID:10964
- C:\Windows\System\qqTLpDC.exe
  C:\Windows\System\qqTLpDC.exe
  2⤵
  PID:9988
- C:\Windows\System\uIWxQaW.exe
  C:\Windows\System\uIWxQaW.exe
  2⤵
  PID:11068
- C:\Windows\System\LCVTVXo.exe
  C:\Windows\System\LCVTVXo.exe
  2⤵
  PID:10860
- C:\Windows\System\mEgFBcU.exe
  C:\Windows\System\mEgFBcU.exe
  2⤵
  PID:11268
- C:\Windows\System\jUlQjoH.exe
  C:\Windows\System\jUlQjoH.exe
  2⤵
  PID:11312
- C:\Windows\System\rkZbtNP.exe
  C:\Windows\System\rkZbtNP.exe
  2⤵
  PID:11356
- C:\Windows\System\drIpmZB.exe
  C:\Windows\System\drIpmZB.exe
  2⤵
  PID:10208
- C:\Windows\System\bHYCKtp.exe
  C:\Windows\System\bHYCKtp.exe
  2⤵
  PID:11428
- C:\Windows\System\xJAAmyl.exe
  C:\Windows\System\xJAAmyl.exe
  2⤵
  PID:11236
- C:\Windows\System\BsijGJm.exe
  C:\Windows\System\BsijGJm.exe
  2⤵
  PID:7184
- C:\Windows\System\HiqZnFa.exe
  C:\Windows\System\HiqZnFa.exe
  2⤵
  PID:4832
- C:\Windows\System\UShBFaj.exe
  C:\Windows\System\UShBFaj.exe
  2⤵
  PID:11540
- C:\Windows\System\IpHaDID.exe
  C:\Windows\System\IpHaDID.exe
  2⤵
  PID:11616
- C:\Windows\System\yLdUdYh.exe
  C:\Windows\System\yLdUdYh.exe
  2⤵
  PID:6416
- C:\Windows\System\QbTOUcg.exe
  C:\Windows\System\QbTOUcg.exe
  2⤵
  PID:11712
- C:\Windows\System\RHxVFcZ.exe
  C:\Windows\System\RHxVFcZ.exe
  2⤵
  PID:8960
- C:\Windows\System\LgHVzJO.exe
  C:\Windows\System\LgHVzJO.exe
  2⤵
  PID:11780
- C:\Windows\System\ZdBWgJZ.exe
  C:\Windows\System\ZdBWgJZ.exe
  2⤵
  PID:4156
- C:\Windows\System\lKNFtQq.exe
  C:\Windows\System\lKNFtQq.exe
  2⤵
  PID:10492
- C:\Windows\System\XWpTuXo.exe
  C:\Windows\System\XWpTuXo.exe
  2⤵
  PID:10604
- C:\Windows\System\GHmnwkW.exe
  C:\Windows\System\GHmnwkW.exe
  2⤵
  PID:10536
- C:\Windows\System\UhBqWfH.exe
  C:\Windows\System\UhBqWfH.exe
  2⤵
  PID:10680
- C:\Windows\System\xEIhukL.exe
  C:\Windows\System\xEIhukL.exe
  2⤵
  PID:10748
- C:\Windows\System\DPDBxSH.exe
  C:\Windows\System\DPDBxSH.exe
  2⤵
  PID:1264
- C:\Windows\System\wiKGEli.exe
  C:\Windows\System\wiKGEli.exe
  2⤵
  PID:12092
- C:\Windows\System\qMkSuZi.exe
  C:\Windows\System\qMkSuZi.exe
  2⤵
  PID:4552
- C:\Windows\System\HFnROzg.exe
  C:\Windows\System\HFnROzg.exe
  2⤵
  PID:12132
- C:\Windows\System\XaAPvin.exe
  C:\Windows\System\XaAPvin.exe
  2⤵
  PID:12220
- C:\Windows\System\WJLHBZV.exe
  C:\Windows\System\WJLHBZV.exe
  2⤵
  PID:12304
- C:\Windows\System\RoQbEQr.exe
  C:\Windows\System\RoQbEQr.exe
  2⤵
  PID:12320
- C:\Windows\System\xzeterb.exe
  C:\Windows\System\xzeterb.exe
  2⤵
  PID:13192
- C:\Windows\System\PTTJCbC.exe
  C:\Windows\System\PTTJCbC.exe
  2⤵
  PID:10100
- C:\Windows\System\mxlPLfk.exe
  C:\Windows\System\mxlPLfk.exe
  2⤵
  PID:10204
- C:\Windows\System\tPmZQRY.exe
  C:\Windows\System\tPmZQRY.exe
  2⤵
  PID:8600
- C:\Windows\System\HxROHsT.exe
  C:\Windows\System\HxROHsT.exe
  2⤵
  PID:4340
- C:\Windows\System\RPAWBpQ.exe
  C:\Windows\System\RPAWBpQ.exe
  2⤵
  PID:10376
- C:\Windows\System\ForqreJ.exe
  C:\Windows\System\ForqreJ.exe
  2⤵
  PID:10900
- C:\Windows\System\lPcWAcn.exe
  C:\Windows\System\lPcWAcn.exe
  2⤵
  PID:9312
- C:\Windows\System\rWrRETC.exe
  C:\Windows\System\rWrRETC.exe
  2⤵
  PID:8
- C:\Windows\System\qjomDIt.exe
  C:\Windows\System\qjomDIt.exe
  2⤵
  PID:11352
- C:\Windows\System\VplWocV.exe
  C:\Windows\System\VplWocV.exe
  2⤵
  PID:11220
- C:\Windows\System\yGwVKaQ.exe
  C:\Windows\System\yGwVKaQ.exe
  2⤵
  PID:11648
- C:\Windows\System\NgdupIw.exe
  C:\Windows\System\NgdupIw.exe
  2⤵
  PID:3880
- C:\Windows\System\gpWUaOD.exe
  C:\Windows\System\gpWUaOD.exe
  2⤵
  PID:11804
- C:\Windows\System\fcerdrx.exe
  C:\Windows\System\fcerdrx.exe
  2⤵
  PID:7532
- C:\Windows\System\kHPDHYe.exe
  C:\Windows\System\kHPDHYe.exe
  2⤵
  PID:10028
- C:\Windows\System\nUoOqzD.exe
  C:\Windows\System\nUoOqzD.exe
  2⤵
  PID:8348
- C:\Windows\System\idTbMMc.exe
  C:\Windows\System\idTbMMc.exe
  2⤵
  PID:8500
- C:\Windows\System\jlbzwsg.exe
  C:\Windows\System\jlbzwsg.exe
  2⤵
  PID:8796
- C:\Windows\System\atlzYTj.exe
  C:\Windows\System\atlzYTj.exe
  2⤵
  PID:8276
- C:\Windows\System\wUXSDiY.exe
  C:\Windows\System\wUXSDiY.exe
  2⤵
  PID:8432
- C:\Windows\System\qlvWAhM.exe
  C:\Windows\System\qlvWAhM.exe
  2⤵
  PID:9512
- C:\Windows\System\ZMNIXvw.exe
  C:\Windows\System\ZMNIXvw.exe
  2⤵
  PID:8780
- C:\Windows\System\twrRFxI.exe
  C:\Windows\System\twrRFxI.exe
  2⤵
  PID:8560
- C:\Windows\System\skUrnEz.exe
  C:\Windows\System\skUrnEz.exe
  2⤵
  PID:9708
- C:\Windows\System\oWwWWwq.exe
  C:\Windows\System\oWwWWwq.exe
  2⤵
  PID:12040
- C:\Windows\System\zlrpTEi.exe
  C:\Windows\System\zlrpTEi.exe
  2⤵
  PID:12140
- C:\Windows\System\RKWAlXd.exe
  C:\Windows\System\RKWAlXd.exe
  2⤵
  PID:4728
- C:\Windows\System\tiXOMaN.exe
  C:\Windows\System\tiXOMaN.exe
  2⤵
  PID:10664
- C:\Windows\System\dRKhgtC.exe
  C:\Windows\System\dRKhgtC.exe
  2⤵
  PID:12208
- C:\Windows\System\dHFGaUi.exe
  C:\Windows\System\dHFGaUi.exe
  2⤵
  PID:12160
- C:\Windows\System\zzharLn.exe
  C:\Windows\System\zzharLn.exe
  2⤵
  PID:12316
- C:\Windows\System\QiKPBre.exe
  C:\Windows\System\QiKPBre.exe
  2⤵
  PID:3680
- C:\Windows\System\SwDoRGI.exe
  C:\Windows\System\SwDoRGI.exe
  2⤵
  PID:12392
- C:\Windows\System\irhfnug.exe
  C:\Windows\System\irhfnug.exe
  2⤵
  PID:7000
- C:\Windows\System\IwWmirW.exe
  C:\Windows\System\IwWmirW.exe
  2⤵
  PID:8956
- C:\Windows\System\OzAeLQX.exe
  C:\Windows\System\OzAeLQX.exe
  2⤵
  PID:2716
- C:\Windows\System\GZJHHBv.exe
  C:\Windows\System\GZJHHBv.exe
  2⤵
  PID:12468
- C:\Windows\System\vbBGVDk.exe
  C:\Windows\System\vbBGVDk.exe
  2⤵
  PID:7508
- C:\Windows\System\tZjaZUN.exe
  C:\Windows\System\tZjaZUN.exe
  2⤵
  PID:9196
- C:\Windows\System\SJrEAGy.exe
  C:\Windows\System\SJrEAGy.exe
  2⤵
  PID:12060
- C:\Windows\System\XNlvEiE.exe
  C:\Windows\System\XNlvEiE.exe
  2⤵
  PID:12148
- C:\Windows\System\EulaLPM.exe
  C:\Windows\System\EulaLPM.exe
  2⤵
  PID:12168
- C:\Windows\System\xrigvMg.exe
  C:\Windows\System\xrigvMg.exe
  2⤵
  PID:12196
- C:\Windows\System\hSNaono.exe
  C:\Windows\System\hSNaono.exe
  2⤵
  PID:12232
- C:\Windows\System\ceFLoee.exe
  C:\Windows\System\ceFLoee.exe
  2⤵
  PID:12252
- C:\Windows\System\aUmYjfq.exe
  C:\Windows\System\aUmYjfq.exe
  2⤵
  PID:8140
- C:\Windows\System\orynwwf.exe
  C:\Windows\System\orynwwf.exe
  2⤵
  PID:9880
- C:\Windows\System\wIrXeld.exe
  C:\Windows\System\wIrXeld.exe
  2⤵
  PID:11392
- C:\Windows\System\gHkvdFr.exe
  C:\Windows\System\gHkvdFr.exe
  2⤵
  PID:5784
- C:\Windows\System\VHfxNZc.exe
  C:\Windows\System\VHfxNZc.exe
  2⤵
  PID:3972
- C:\Windows\System\lnAfdwE.exe
  C:\Windows\System\lnAfdwE.exe
  2⤵
  PID:10292
- C:\Windows\System\WWDONSd.exe
  C:\Windows\System\WWDONSd.exe
  2⤵
  PID:3472
- C:\Windows\System\cVtTxkQ.exe
  C:\Windows\System\cVtTxkQ.exe
  2⤵
  PID:10344
- C:\Windows\System\IbHIzAX.exe
  C:\Windows\System\IbHIzAX.exe
  2⤵
  PID:9208
- C:\Windows\System\KgEeRBQ.exe
  C:\Windows\System\KgEeRBQ.exe
  2⤵
  PID:11100
- C:\Windows\System\XJskpcq.exe
  C:\Windows\System\XJskpcq.exe
  2⤵
  PID:10436
- C:\Windows\System\hNPwipx.exe
  C:\Windows\System\hNPwipx.exe
  2⤵
  PID:12352
- C:\Windows\System\HXsdzBn.exe
  C:\Windows\System\HXsdzBn.exe
  2⤵
  PID:12376
- C:\Windows\System\IYNHinP.exe
  C:\Windows\System\IYNHinP.exe
  2⤵
  PID:12488
- C:\Windows\System\cbUmNJv.exe
  C:\Windows\System\cbUmNJv.exe
  2⤵
  PID:12560
- C:\Windows\System\FYzUayN.exe
  C:\Windows\System\FYzUayN.exe
  2⤵
  PID:872
- C:\Windows\System\bSmpYYz.exe
  C:\Windows\System\bSmpYYz.exe
  2⤵
  PID:3148
- C:\Windows\System\lNWsxUK.exe
  C:\Windows\System\lNWsxUK.exe
  2⤵
  PID:7952
- C:\Windows\System\cGFHEMB.exe
  C:\Windows\System\cGFHEMB.exe
  2⤵
  PID:7988
- C:\Windows\System\HyFigbZ.exe
  C:\Windows\System\HyFigbZ.exe
  2⤵
  PID:7996
- C:\Windows\System\Scnjgvh.exe
  C:\Windows\System\Scnjgvh.exe
  2⤵
  PID:3660
- C:\Windows\System\LoCwsiT.exe
  C:\Windows\System\LoCwsiT.exe
  2⤵
  PID:7764
- C:\Windows\System\OsOtLWQ.exe
  C:\Windows\System\OsOtLWQ.exe
  2⤵
  PID:9756
- C:\Windows\System\uwBuVmh.exe
  C:\Windows\System\uwBuVmh.exe
  2⤵
  PID:10656
- C:\Windows\System\vrHdVdL.exe
  C:\Windows\System\vrHdVdL.exe
  2⤵
  PID:12300
- C:\Windows\System\ihoyYxs.exe
  C:\Windows\System\ihoyYxs.exe
  2⤵
  PID:10720
- C:\Windows\System\LrboMCS.exe
  C:\Windows\System\LrboMCS.exe
  2⤵
  PID:12924
- C:\Windows\System\VeySlcV.exe
  C:\Windows\System\VeySlcV.exe
  2⤵
  PID:12192
- C:\Windows\System\ZOtQzUi.exe
  C:\Windows\System\ZOtQzUi.exe
  2⤵
  PID:12344
- C:\Windows\System\ZAfXRpc.exe
  C:\Windows\System\ZAfXRpc.exe
  2⤵
  PID:9824
- C:\Windows\System\sSyFYwZ.exe
  C:\Windows\System\sSyFYwZ.exe
  2⤵
  PID:10032
- C:\Windows\System\jgyMoTG.exe
  C:\Windows\System\jgyMoTG.exe
  2⤵
  PID:11596
- C:\Windows\System\aRqOMbg.exe
  C:\Windows\System\aRqOMbg.exe
  2⤵
  PID:9648
- C:\Windows\System\vioIUaE.exe
  C:\Windows\System\vioIUaE.exe
  2⤵
  PID:10824
- C:\Windows\System\CgnnGji.exe
  C:\Windows\System\CgnnGji.exe
  2⤵
  PID:11816
- C:\Windows\System\jYKpkyd.exe
  C:\Windows\System\jYKpkyd.exe
  2⤵
  PID:11732
- C:\Windows\System\IJMiVxB.exe
  C:\Windows\System\IJMiVxB.exe
  2⤵
  PID:2516
- C:\Windows\System\KjLkaoH.exe
  C:\Windows\System\KjLkaoH.exe
  2⤵
  PID:8324
- C:\Windows\System\QZSGVwP.exe
  C:\Windows\System\QZSGVwP.exe
  2⤵
  PID:8728
- C:\Windows\System\OtggBpW.exe
  C:\Windows\System\OtggBpW.exe
  2⤵
  PID:11864
- C:\Windows\System\LbbuBbM.exe
  C:\Windows\System\LbbuBbM.exe
  2⤵
  PID:9644
- C:\Windows\System\qbuZuPU.exe
  C:\Windows\System\qbuZuPU.exe
  2⤵
  PID:972
- C:\Windows\System\bARaNtb.exe
  C:\Windows\System\bARaNtb.exe
  2⤵
  PID:12864
- C:\Windows\System\tZsxAQA.exe
  C:\Windows\System\tZsxAQA.exe
  2⤵
  PID:12360
- C:\Windows\System\jaTBDRC.exe
  C:\Windows\System\jaTBDRC.exe
  2⤵
  PID:4112
- C:\Windows\System\ylchfMj.exe
  C:\Windows\System\ylchfMj.exe
  2⤵
  PID:11032
- C:\Windows\System\gCaaFEt.exe
  C:\Windows\System\gCaaFEt.exe
  2⤵
  PID:13240
- C:\Windows\System\WYPJyKa.exe
  C:\Windows\System\WYPJyKa.exe
  2⤵
  PID:13236
- C:\Windows\System\QNKfoln.exe
  C:\Windows\System\QNKfoln.exe
  2⤵
  PID:2896
- C:\Windows\System\IWblwhO.exe
  C:\Windows\System\IWblwhO.exe
  2⤵
  PID:12372
- C:\Windows\System\iSKvPze.exe
  C:\Windows\System\iSKvPze.exe
  2⤵
  PID:3780
- C:\Windows\System\imdFWbQ.exe
  C:\Windows\System\imdFWbQ.exe
  2⤵
  PID:10288
- C:\Windows\System\gHxfkLm.exe
  C:\Windows\System\gHxfkLm.exe
  2⤵
  PID:13764
- C:\Windows\System\tvgUsnB.exe
  C:\Windows\System\tvgUsnB.exe
  2⤵
  PID:13876
- C:\Windows\System\xKmnznH.exe
  C:\Windows\System\xKmnznH.exe
  2⤵
  PID:6876
- C:\Windows\System\quXrczE.exe
  C:\Windows\System\quXrczE.exe
  2⤵
  PID:12736
- C:\Windows\System\HImvZsY.exe
  C:\Windows\System\HImvZsY.exe
  2⤵
  PID:12704
- C:\Windows\System\dwdmgvl.exe
  C:\Windows\System\dwdmgvl.exe
  2⤵
  PID:4532
- C:\Windows\System\RyHIEuq.exe
  C:\Windows\System\RyHIEuq.exe
  2⤵
  PID:7648
- C:\Windows\System\gQHrNgk.exe
  C:\Windows\System\gQHrNgk.exe
  2⤵
  PID:13336
- C:\Windows\System\hVWoMVn.exe
  C:\Windows\System\hVWoMVn.exe
  2⤵
  PID:10568
- C:\Windows\System\UpUNyMH.exe
  C:\Windows\System\UpUNyMH.exe
  2⤵
  PID:12256
- C:\Windows\System\OVvJrTh.exe
  C:\Windows\System\OVvJrTh.exe
  2⤵
  PID:13368
- C:\Windows\System\kasUzVf.exe
  C:\Windows\System\kasUzVf.exe
  2⤵
  PID:13388
- C:\Windows\System\iNZpHxR.exe
  C:\Windows\System\iNZpHxR.exe
  2⤵
  PID:7348
- C:\Windows\System\GYuaaTB.exe
  C:\Windows\System\GYuaaTB.exe
  2⤵
  PID:8504
- C:\Windows\System\VDgMyEc.exe
  C:\Windows\System\VDgMyEc.exe
  2⤵
  PID:13420
- C:\Windows\System\RVXDZoh.exe
  C:\Windows\System\RVXDZoh.exe
  2⤵
  PID:8108
- C:\Windows\System\pDfLuQJ.exe
  C:\Windows\System\pDfLuQJ.exe
  2⤵
  PID:11412
- C:\Windows\System\eHwUXEW.exe
  C:\Windows\System\eHwUXEW.exe
  2⤵
  PID:12212
- C:\Windows\System\gxBMKOC.exe
  C:\Windows\System\gxBMKOC.exe
  2⤵
  PID:2324
- C:\Windows\System\JwzaUgD.exe
  C:\Windows\System\JwzaUgD.exe
  2⤵
  PID:11192
- C:\Windows\System\IPBSLrs.exe
  C:\Windows\System\IPBSLrs.exe
  2⤵
  PID:13912
- C:\Windows\System\wNTPiBG.exe
  C:\Windows\System\wNTPiBG.exe
  2⤵
  PID:4464
- C:\Windows\System\pnbgfbA.exe
  C:\Windows\System\pnbgfbA.exe
  2⤵
  PID:14148
- C:\Windows\System\AaVgfXd.exe
  C:\Windows\System\AaVgfXd.exe
  2⤵
  PID:13904
- C:\Windows\System\gkHKryy.exe
  C:\Windows\System\gkHKryy.exe
  2⤵
  PID:14240
- C:\Windows\System\PUVOjLY.exe
  C:\Windows\System\PUVOjLY.exe
  2⤵
  PID:14284
- C:\Windows\System\HsOQJxz.exe
  C:\Windows\System\HsOQJxz.exe
  2⤵
  PID:10884
- C:\Windows\System\MyVFGly.exe
  C:\Windows\System\MyVFGly.exe
  2⤵
  PID:6928
- C:\Windows\System\DSyObno.exe
  C:\Windows\System\DSyObno.exe
  2⤵
  PID:12636
- C:\Windows\System\GRrKZGW.exe
  C:\Windows\System\GRrKZGW.exe
  2⤵
  PID:8688
- C:\Windows\System\qmrGxPv.exe
  C:\Windows\System\qmrGxPv.exe
  2⤵
  PID:12204
- C:\Windows\System\oLynndx.exe
  C:\Windows\System\oLynndx.exe
  2⤵
  PID:13660
- C:\Windows\System\cioXtIT.exe
  C:\Windows\System\cioXtIT.exe
  2⤵
  PID:14300
- C:\Windows\System\HZJTmQB.exe
  C:\Windows\System\HZJTmQB.exe
  2⤵
  PID:13452
- C:\Windows\System\fXepoGQ.exe
  C:\Windows\System\fXepoGQ.exe
  2⤵
  PID:7992
- C:\Windows\System\xHsJrKg.exe
  C:\Windows\System\xHsJrKg.exe
  2⤵
  PID:14172
- C:\Windows\System\QCRGUZp.exe
  C:\Windows\System\QCRGUZp.exe
  2⤵
  PID:13520
- C:\Windows\System\xPvwapK.exe
  C:\Windows\System\xPvwapK.exe
  2⤵
  PID:13624
- C:\Windows\System\sssiQPr.exe
  C:\Windows\System\sssiQPr.exe
  2⤵
  PID:12612
- C:\Windows\System\ELSoiFa.exe
  C:\Windows\System\ELSoiFa.exe
  2⤵
  PID:8352
- C:\Windows\System\IBGxFKu.exe
  C:\Windows\System\IBGxFKu.exe
  2⤵
  PID:11148
- C:\Windows\System\NAZeBjm.exe
  C:\Windows\System\NAZeBjm.exe
  2⤵
  PID:13896
- C:\Windows\System\VOiUbLR.exe
  C:\Windows\System\VOiUbLR.exe
  2⤵
  PID:9992
- C:\Windows\System\TjPqPAR.exe
  C:\Windows\System\TjPqPAR.exe
  2⤵
  PID:8004
- C:\Windows\System\HDmXYRg.exe
  C:\Windows\System\HDmXYRg.exe
  2⤵
  PID:13748
- C:\Windows\System\DdLTBcP.exe
  C:\Windows\System\DdLTBcP.exe
  2⤵
  PID:14176
- C:\Windows\System\HoKynoz.exe
  C:\Windows\System\HoKynoz.exe
  2⤵
  PID:14248
- C:\Windows\System\KjWqiVS.exe
  C:\Windows\System\KjWqiVS.exe
  2⤵
  PID:10928
- C:\Windows\System\qaJIbcF.exe
  C:\Windows\System\qaJIbcF.exe
  2⤵
  PID:13712
- C:\Windows\System\UoELgqr.exe
  C:\Windows\System\UoELgqr.exe
  2⤵
  PID:14144
- C:\Windows\System\poaMYAv.exe
  C:\Windows\System\poaMYAv.exe
  2⤵
  PID:14136
- C:\Windows\System\vgIYMDQ.exe
  C:\Windows\System\vgIYMDQ.exe
  2⤵
  PID:13576
- C:\Windows\System\JYHThGN.exe
  C:\Windows\System\JYHThGN.exe
  2⤵
  PID:14024
- C:\Windows\System\bMoHujc.exe
  C:\Windows\System\bMoHujc.exe
  2⤵
  PID:3056
- C:\Windows\System\vZDgCNx.exe
  C:\Windows\System\vZDgCNx.exe
  2⤵
  PID:13980
- C:\Windows\System\NTomttX.exe
  C:\Windows\System\NTomttX.exe
  2⤵
  PID:14252
- C:\Windows\System\crGlwzd.exe
  C:\Windows\System\crGlwzd.exe
  2⤵
  PID:10188
- C:\Windows\System\JIBLqDp.exe
  C:\Windows\System\JIBLqDp.exe
  2⤵
  PID:14316
- C:\Windows\System\CQiioYX.exe
  C:\Windows\System\CQiioYX.exe
  2⤵
  PID:13300
- C:\Windows\System\QdzaYMk.exe
  C:\Windows\System\QdzaYMk.exe
  2⤵
  PID:1952
- C:\Windows\System\NRrnhTC.exe
  C:\Windows\System\NRrnhTC.exe
  2⤵
  PID:8524
- C:\Windows\System\mSmTvgr.exe
  C:\Windows\System\mSmTvgr.exe
  2⤵
  PID:13188
- C:\Windows\System\tmhdIpX.exe
  C:\Windows\System\tmhdIpX.exe
  2⤵
  PID:11516
- C:\Windows\System\DKUEWco.exe
  C:\Windows\System\DKUEWco.exe
  2⤵
  PID:9864
- C:\Windows\System\emYjumm.exe
  C:\Windows\System\emYjumm.exe
  2⤵
  PID:348
- C:\Windows\System\baoGuQW.exe
  C:\Windows\System\baoGuQW.exe
  2⤵
  PID:13224
- C:\Windows\System\hYYrKic.exe
  C:\Windows\System\hYYrKic.exe
  2⤵
  PID:2268
- C:\Windows\System\JdSTeZc.exe
  C:\Windows\System\JdSTeZc.exe
  2⤵
  PID:13648
- C:\Windows\System\KCmnUUA.exe
  C:\Windows\System\KCmnUUA.exe
  2⤵
  PID:412
- C:\Windows\System\HVcScbq.exe
  C:\Windows\System\HVcScbq.exe
  2⤵
  PID:11416
- C:\Windows\System\LLjBRjm.exe
  C:\Windows\System\LLjBRjm.exe
  2⤵
  PID:13732
- C:\Windows\System\YFLWKHH.exe
  C:\Windows\System\YFLWKHH.exe
  2⤵
  PID:11432
- C:\Windows\System\QTcoDCB.exe
  C:\Windows\System\QTcoDCB.exe
  2⤵
  PID:4312
- C:\Windows\System\iDlwrAa.exe
  C:\Windows\System\iDlwrAa.exe
  2⤵
  PID:4236
- C:\Windows\System\RPaLciJ.exe
  C:\Windows\System\RPaLciJ.exe
  2⤵
  PID:14004
- C:\Windows\System\LsEoGPE.exe
  C:\Windows\System\LsEoGPE.exe
  2⤵
  PID:13724
- C:\Windows\System\raiqGjC.exe
  C:\Windows\System\raiqGjC.exe
  2⤵
  PID:13212
- C:\Windows\System\HEoKdpO.exe
  C:\Windows\System\HEoKdpO.exe
  2⤵
  PID:13316
- C:\Windows\System\eRnzrUU.exe
  C:\Windows\System\eRnzrUU.exe
  2⤵
  PID:14036
- C:\Windows\System\kuLlXNg.exe
  C:\Windows\System\kuLlXNg.exe
  2⤵
  PID:12660
- C:\Windows\System\wvXnUdd.exe
  C:\Windows\System\wvXnUdd.exe
  2⤵
  PID:13804
- C:\Windows\System\LlPnhgg.exe
  C:\Windows\System\LlPnhgg.exe
  2⤵
  PID:14072
- C:\Windows\System\RqzaNdS.exe
  C:\Windows\System\RqzaNdS.exe
  2⤵
  PID:12584
- C:\Windows\System\slBDNOf.exe
  C:\Windows\System\slBDNOf.exe
  2⤵
  PID:14328
- C:\Windows\System\rnvvUpn.exe
  C:\Windows\System\rnvvUpn.exe
  2⤵
  PID:9828
- C:\Windows\System\hrndwCm.exe
  C:\Windows\System\hrndwCm.exe
  2⤵
  PID:4528
- C:\Windows\System\nHfJlow.exe
  C:\Windows\System\nHfJlow.exe
  2⤵
  PID:14180
- C:\Windows\System\AucmTnt.exe
  C:\Windows\System\AucmTnt.exe
  2⤵
  PID:9176
- C:\Windows\System\FuFyCMA.exe
  C:\Windows\System\FuFyCMA.exe
  2⤵
  PID:13664
- C:\Windows\System\QoEqNbu.exe
  C:\Windows\System\QoEqNbu.exe
  2⤵
  PID:4744
- C:\Windows\System\nmsRfAc.exe
  C:\Windows\System\nmsRfAc.exe
  2⤵
  PID:14048
- C:\Windows\System\pbBNOVr.exe
  C:\Windows\System\pbBNOVr.exe
  2⤵
  PID:11308
- C:\Windows\System\AmGfJRx.exe
  C:\Windows\System\AmGfJRx.exe
  2⤵
  PID:13600
- C:\Windows\System\PlALfIh.exe
  C:\Windows\System\PlALfIh.exe
  2⤵
  PID:8048
- C:\Windows\System\jfXNcml.exe
  C:\Windows\System\jfXNcml.exe
  2⤵
  PID:4904
- C:\Windows\System\kMZYNDI.exe
  C:\Windows\System\kMZYNDI.exe
  2⤵
  PID:12420
- C:\Windows\System\KBQNpKF.exe
  C:\Windows\System\KBQNpKF.exe
  2⤵
  PID:12692
- C:\Windows\System\EnpPriz.exe
  C:\Windows\System\EnpPriz.exe
  2⤵
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c30m0tru.mmu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BRrkOXS.exe

Filesize
1.6MB

MD5
2d04a25c881662b0470a0e698c3e3766

SHA1
b24c8165a04ce5787da46db4e7b770fd4db55159

SHA256
f0e814d2bfbb223f9d39342332a7c041df3474da6488542e9c2fe1cd253b4830

SHA512
71840d7855d10568d69551de1a4f1b41cc71092fbc0290a18396d596556dd2960ceaf93b4760a166db6c4d723422bfb176de5a980b527d243b642de944f3347a

Download Submit
C:\Windows\System\BZDYJln.exe

Filesize
1.6MB

MD5
7a9d15b2a0d57309d2b4c6205fe43a81

SHA1
2a31e2098a27fbc59e9fe7a200ad54ef0e253442

SHA256
ce41054aef5db4ce9df5514066ae47f9e1db16c52b0f896c4af03bd54e35143a

SHA512
aea02fc5fbc13a970fce2600a9e302560e4ebfa4eaedadc31403cb763ce6ed5ed0a884aaca25243f8a0a3fd1d013946fcc753c8929d8afbe7e556b7d03c773a7

Download Submit
C:\Windows\System\CweSkTL.exe

Filesize
1.6MB

MD5
9340502446d566dbfb5aae5df8990c05

SHA1
b5527a31b3f7191c7f2ba6d3ad2f84d368a76326

SHA256
c36ce83b0f9598d3d6d831867c759e083a7811832931d00b3f195ac79b563b91

SHA512
77da02009dea5b44ac0d226da62bb1b9165e91c3f37a42173ea3110fa7f6fa4d7e35f279695fe7118103c1561834ca406518e73ea0a169c2e135eaa3c1e9ae0f

Download Submit
C:\Windows\System\EUsXgRP.exe

Filesize
1.6MB

MD5
30c0b1191416df4348a0e2637d9f7f0f

SHA1
1eedda6cf364eceaefa40d918be7273a2ffd2c48

SHA256
71f7f95c4f660aed11f466a1abe7314eb68df298e86eb0285dbdf82555e438a7

SHA512
6bb2efc1d703c49fc8de6afa8d94c3a6d11e6c94ff80d35f919bd037c285c3799b54ee86259706ca4d9921b981fda89d8b2f6f12b5d3bef712c1441d7a8ef6d8

Download Submit
C:\Windows\System\EZCeIah.exe

Filesize
1.6MB

MD5
eb3818543eccdb052b0ac92cd3630ad8

SHA1
6fc8b72cf623e63901600f90048a4772828b4c8e

SHA256
1837e803240f9a13a66bbeb1ecc1783f34c2a86f7fb1c362b2f427f34cdbf27b

SHA512
96e80ebc67905e8886e5d7ff3524fd61af1d0347ecc961202b35565ef2a99ba04c862392ac41ea01b2a2ee0060f2ec5f55c3bc89d7c7f847d6b7e3ca5da044e9

Download Submit
C:\Windows\System\EuOCNjH.exe

Filesize
8B

MD5
99de9fff1c384289fd83d6dc064e3eb0

SHA1
fa84ee172bcad31d12f63f68f75302eced3eb04f

SHA256
537073a623a98b420b130d9402dd47b4473cacc54bdf99b0af6e70cdc060b0c4

SHA512
32b02fb241ee8ccb51a930c94c4606bc8e22fc37808a558b3fe991d8b07928c47bc9164b507cba81eba02f3d4eb5f05322ac8cae374b09a2de26d954326f3d48

Download Submit
C:\Windows\System\GHiXINR.exe

Filesize
1.6MB

MD5
04c200113be61319ec5af997d930bdb9

SHA1
6f84089940c7039d6f72bd1d6c0a0c5079ff3ce7

SHA256
1a954e0fd97a18bdca8cbd1e063d6255da3fd6537d1d7635fb6c37ac3ead9eb4

SHA512
0769be980c9668bbb72f6eab00be8ffa94a2c585be4828d54dbfaff1a83d615155fbde73d0c058395e917241fc819cf04f5b201629fe0c2b224406f0ee738e7e

Download Submit
C:\Windows\System\HNkCzkz.exe

Filesize
1.6MB

MD5
700d25fa34eb667485105b62cd1e37f8

SHA1
ca4e02e37dc754d93311de347ba169df4cef88ab

SHA256
06482cb044585d7d105acf575c62e934fa11a92ba2c25678ad39dfa92b16ef9a

SHA512
210b4c0c37563c55a162089221a005877904f28b05664127c01536299cce276c33969722b1929b9a72e249762f32de3d977e63077545b730117d6335828e0520

Download Submit
C:\Windows\System\IpVptrK.exe

Filesize
1.6MB

MD5
dc15cc4584c5f1b2e78e2a29ad55044c

SHA1
abf6fe43944d2f02715a0ebfdc606e19b3b7e144

SHA256
0164998a3a52fe8e2bd09988bcecd7541311496dfcecf2a09026376f72e35890

SHA512
bef559f2c203963a83e12810562c42ca673ac0907e1d3d0aadd54b01f0f44367818ee1701b144d04ed7b85294cbe9be6038b22b3890037562296f0ddc4db4002

Download Submit
C:\Windows\System\JJWTMqn.exe

Filesize
1.6MB

MD5
9a352ed9d7886501222800d8e8cccf4d

SHA1
8fb4eb75a353e23996a31c7d1da60f704fb12cc0

SHA256
d0e01be4a7c78b20fbaf9df547a24df69b878881a065787df9d08812337cf87d

SHA512
196d3113ca47f363e0749d883c2b08b38e7b8c394b145eac6bee2749082d46ecf40698574e2d9cc9d3e540f7318f9b65c50d2350ea12dc04fe4b06b331882036

Download Submit
C:\Windows\System\KnOXsoA.exe

Filesize
1.6MB

MD5
7a0e4d81a5b50e28b447f4ec678e4e7b

SHA1
e99c5044ea8e64aadd15e7878a2ae257f1c56fd8

SHA256
da3c8f9aed2d4e208614263a10885acc183a9971a5530bfbc8b54c80787a3e19

SHA512
639e63f413b0eff236d9ed8126fae40e609b2c4cba4dd19bee1af326e5d401352dbb07fe4455340fa94a91269cc8ddb5f50608d07642199455046bd5db3a990d

Download Submit
C:\Windows\System\MSSGFxo.exe

Filesize
1.6MB

MD5
2b0a5107d6a35f07a6a4232f5b686321

SHA1
6c768d26ee30e83818668e4ccc1fd9962f6a7b9e

SHA256
68d53d7b66f3ffc28e19093d765d570ca6aedae1876378df7ae0f167124d660e

SHA512
9d9a18fd97f1f4f39f129e2e134d52c75acbe3e21606bb19aadbfd5607bce3a0a6a3694fbd1d48affc8c6c651d3565124f25cb39d6ba0af9195ead535c1c3adb

Download Submit
C:\Windows\System\OUcSWvy.exe

Filesize
1.6MB

MD5
60915d33b956578f878c4b28c4b3ff2e

SHA1
edb7d19d17fff528bec53d1afd897dcf7881e668

SHA256
a08bc4fb90aac40dbfc6f15c946319a5a541fd40f8ff6fdc7dd1b22a3c0a99c5

SHA512
6e8c8cf5ee0b6d9f62ee60e9e3a9ecb0eca1d4da81cfc09d17108689d3a77acc5cac34ed8c06ef6bb66030430f745e7ca28b0947ec74b7af7cb1de1594a5a44e

Download Submit
C:\Windows\System\OuyvjYS.exe

Filesize
1.6MB

MD5
a734a5bef1d15f4fadd5392f3b5d1fe7

SHA1
61951309ac01a59acad107685f28128697c5b49c

SHA256
e9f0af30d3d62bfbe9125c680ad90a044ac3e8b26cbdb51ea49125f3aab444ff

SHA512
bedf7c3b3c656f1ed7bbbb39f66c34a9423a3ace9e4cd0157edd6d1dd58393c54125a914a762489cf7ff31a088a0b285774acd1c13cda3d6c980fd79317718b3

Download Submit
C:\Windows\System\SyLBCZg.exe

Filesize
1.6MB

MD5
a48b99dd990c15292ad0c28c6789a7b6

SHA1
cbe6b850dbf86d7e9b01d5ab71d893e8556d9faf

SHA256
87d72be08b3ae222ecefcae83ffc66ad6320f456f3c32ac31f42ee3ed800b8da

SHA512
975c62549757ca371fa5bfe70afaad27f68748afb7aafdd15c4b8a93aaf1b7857d39cae48b5c074207c996b686b3967ea35102532439ba4ec93b21fd2017c8d2

Download Submit
C:\Windows\System\TZVXeZr.exe

Filesize
1.6MB

MD5
666deb6298e7d2412409451a62298061

SHA1
db78bca936e2e3183df6d21506506d62abaa37e1

SHA256
13c2ec4692fb96df883c5c5cfb88243eff5cc10a0db3e53d9366667e6a125330

SHA512
360ae9b4b1aceaaf5d9fb938e31e770565b6fb96a00a2f3e2ba451b84ecba524f0151f66d92ad3ab166b864bf5f42844884e551c2a7d0f9a917985051658d66c

Download Submit
C:\Windows\System\UxJzVMG.exe

Filesize
1.6MB

MD5
fac03278f1632144cdbd1ac9b31e5f46

SHA1
33a32cbfa32baec8b7da954d898ee5135ea131d7

SHA256
cf6487ae920926d0510636750ffc7f6c0333745be478f310d1c3a70943facc7a

SHA512
94634913e2e842fb4f363716f3c724024792e613b816b098a85fdf3e75dff3993713cdc8fb5f0853a3d9dee4c29b0205030af854e3dac12c1168a613145a1a4c

Download Submit
C:\Windows\System\WiTYZpL.exe

Filesize
1.6MB

MD5
38ef438c5ef6c986127066e51d344631

SHA1
440feb47a24036210c60e9df0fded9c049fa3b38

SHA256
a7c3c0d25baebbc66a4a6f325f2fd6ce5d80bff066e95b18ae82fd0002a8ca41

SHA512
d0dea4a8bc386984c23ae88c1cdfe7f290cf37109518d0e5cb12fe03d1e0488eeb663c27280c41abe4e5333cb85b2fd91aae846a83bee35b82c8875e73783577

Download Submit
C:\Windows\System\XYrLgse.exe

Filesize
1.6MB

MD5
14cf11504108f3c581f79f9ccdb77a82

SHA1
4d8067878fff0a9f6daa17a1222563d2db47a400

SHA256
99cb95fb87fc1434a821d2406df3b70db36758e1d4e527e9d545545c8a2e9316

SHA512
7add19ebe19055a9eff9b5ce200031d6584c43de4ff8916e74e8015bb225354d0bc2b0f986b93b519a55b28a6eca071af60f72d1c14af10fe58369743287b55b

Download Submit
C:\Windows\System\ZonscHv.exe

Filesize
1.6MB

MD5
d2efb1bc5bf9a32690e8cee63aaf0157

SHA1
2baac2af63f43b1711d1d86ef203280d914ac5ce

SHA256
eb799332d0cd5adb1e0c99a332218af800f0382cd76ade6a0052e51d455e3056

SHA512
11b7725b132ab3cd1f183a0d8c2dc2bbbef70ff3f7400366f5b1440bab6224c462b74594f9154e291f48ea587c20030a826670ad734f700749267cd23e543963

Download Submit
C:\Windows\System\bEzISYp.exe

Filesize
1.6MB

MD5
fe01a380e6a8de1b0746184e42c027fe

SHA1
67088e51ea4f02dff6666262157a5f2219c7f0ba

SHA256
987dfbc8c105af0ee73a1a224f2691dda971b81d9f3d1c076ab25f21ca192d7d

SHA512
2858116a95b374cdf59a2f41ee51dc93f1ed8c6065e6e596f993b19f101d2e317f018cee8eb31c423100039e9a247e4acce273a0c4569724604e1d5dc3e09753

Download Submit
C:\Windows\System\ctEPkBU.exe

Filesize
1.6MB

MD5
f5510f84331179e42a2b1d3e31b388ae

SHA1
1a6218a590845a2378c511c46eab24f9e2072d7a

SHA256
c3f491861408d4376cd986841006438249d5853bba449ee1592be8a563614c75

SHA512
0b6dffede970a47f5489e561b242c9da3247dfcec4a31e5f2ff2f6c9a30b24703f3acf8a4f61903973e68e7fb5972b3bddda23e00600082f98df909be625790e

Download Submit
C:\Windows\System\fIvGpmg.exe

Filesize
1.6MB

MD5
05ec21f83cdd39462aecd110d189c3fa

SHA1
56d568094f794e1a8f7784fc891e91f54ed11743

SHA256
b602eb7369372bf8700be3483f4b44e42939418a6672e270729251f577135f72

SHA512
8f846be75e85090d250e9d643cfaa46a5f49dc041cc1bf6b3ae7b076396d1bf79580039be7329c5626fd718c607eaa2537e152ee9485a80772410593f00a1612

Download Submit
C:\Windows\System\grrIyeU.exe

Filesize
1.6MB

MD5
b221f7c4484b7e44cb09320083211dd2

SHA1
dbeafff785eb37a9b85844d60d77c33c0e7bc255

SHA256
4d5643fd197a9f79d9e4c088441018ff31c5c69cbce96fa96d4c9f6cf3576c56

SHA512
a0bf8fcfc39a61964c0c0496f8d1f88a833efe24bce14496a8ff316cb23a4e7c5d34f3e7780d40b4fa2a156bda529f36118822481291b73b08e31f1aef65c223

Download Submit
C:\Windows\System\gvzLEvh.exe

Filesize
1.6MB

MD5
840f0b0baec81a87de3b37a6f290cb87

SHA1
fcf41a12daef81202c80271a3ea80321036ea0e7

SHA256
9df154bd64959f007870cd69268074cf6595949ab16047161c0a5828e40f7fec

SHA512
0eae76175846ea58df71e66f535081bf7efcd520d8452dae43b1b564b71ca405b64aa6dfc9a994f2cb4269ce6bf4e3603f1a6b1ed8a4b756b99edb647e44565d

Download Submit
C:\Windows\System\gwCKwFz.exe

Filesize
1.6MB

MD5
e0a65066610982dea125e72fcbece2a5

SHA1
72fd51c4da707be9ce1a45657d2c30054397b831

SHA256
d027a1b7c13783d5f528bdd1d2521bca59ada29fe548a035139ee239f9c94c9e

SHA512
852cf4f5f0bef5f14a0911fad7c96a46b2cbc74076ab13b373396db05188f6ba684b4803656a45ad5ba9187c262565606674becfefff34ca39a35204a0e7948f

Download Submit
C:\Windows\System\heNZsaN.exe

Filesize
1.6MB

MD5
591e84e73b03a0b168846eed101cd3a6

SHA1
2935d078704d915273b58ff553d8bcd9d90cc5c5

SHA256
1c3ea35f654d4f50631d334b0c2d5f9552b70558da9184853dbf4d537d12b914

SHA512
06c595342837005b9d14fbc7c6fcb01a23658e7d7ca3702f478ad29a00f5e3fcd798fc2912cf675aec3455b0620a82566c05b4d0ccd83244446ed2a79216464e

Download Submit
C:\Windows\System\hurYHPU.exe

Filesize
1.6MB

MD5
f253301c881330f39948d2fc95d7d938

SHA1
f1f7e9a2ea7b934a52987c1a6bf2f724bffdecb4

SHA256
e9f7300d31d611a49f8e14d53f560a8321264b6f24b8a8aa7b54d2ad6dcddf27

SHA512
043f6505292009f8c7bdc1b2e1bc52fce8c08158fcf09b21e5e91d9467f220aee00aa955fa7464447f8f886803795e594b39537cccbe179e743df67b88a69284

Download Submit
C:\Windows\System\iMHLyiH.exe

Filesize
1.6MB

MD5
f2ac110599a605257f80e4a8ddddf6fb

SHA1
eef52e0434b95d8ae1175f9fcd3331836db587ef

SHA256
2700cfa5375611c87594cb0ccd804d78f73a5811b8d3dc557d93edcf9433fb77

SHA512
aa6c9e88d74e8d84cc71548f3452f734bc99d9892d57cba4a920b5c713f80621988060478656f7ef6bd30e1a8d99320d517143ee658944d0f79f0467e69ba647

Download Submit
C:\Windows\System\iVLcTFt.exe

Filesize
1.6MB

MD5
1564c28103ae3f6b1563bf70a775b234

SHA1
034fd66e71020a7fc44f57d00c22056f5425b2ca

SHA256
e9219d3bc0975d0abd40fc4971f2036adc7a09f90866db927cbed13971be447c

SHA512
9e17828f49d66fcb0604b8631560fc1aa7621d2f031f0e0bf57538dedcbb6d2a60fb683b873eea0bf50c1018ea0dd1b9cfcc0cf1813c16e3a4690beef71c85ad

Download Submit
C:\Windows\System\iuWHWoK.exe

Filesize
1.6MB

MD5
750df334fa496c1d84eca4a4176c57a7

SHA1
97b1d402a63963f2bf5bc5e44a31c5129c663f4a

SHA256
5f68483c16d64e3714a1f5e201129ba7cf80406af5dc9bc7bd3d908fbbe30151

SHA512
892fcd1b5b16352c2e17b9096f59230b02a84a469ae70ae64a25280e97b3410924c8f59969c662496328db92ed3ad7ad53efa2faa775c9d12f3c9fbf343f5b3b

Download Submit
C:\Windows\System\jkyudpI.exe

Filesize
1.6MB

MD5
ecf7aaad6912213162cedbe74358af59

SHA1
7f2c9084fbf06b0897eb4c0bbd349e4766ac010e

SHA256
9661a0e7bb0fda74f65cfb7e3870b239f3eafd67afd9b6b2153f901292d5d58e

SHA512
df037e218e31ae46c0f92f4b8810b2d503b0308dbf37eb008daf7c9f676cb99a8915cf0c03a9697a22f1098d8f1458bea5e78925f6e031283981f3b05ee993f3

Download Submit
C:\Windows\System\nUnmFJX.exe

Filesize
1.6MB

MD5
0a8661340045a9da44d2fdb812c20d24

SHA1
e20573668f3682bc77ceafecba4d9e24a85d69cc

SHA256
5d0c0a69ee42bf8956ab1bcce90284346eb610898964ab9e4c921284c706b9a2

SHA512
8f389ac074f32d1eb75963706637e4e7c677efcf0ba3c90ace3a759aacf21a69f93562ecdec00b288d408c5e4db6e1c1a059ca45da48be4303ee4169cbd31d6b

Download Submit
C:\Windows\System\nVzItgh.exe

Filesize
1.6MB

MD5
ee94f6d9efd376c4f777544c5451be3a

SHA1
6554fb4cb7da9aa9d2b1db017b00b5d59d6a5921

SHA256
f29e228efed2f01ea8036b331eec738d5a006bcd26153bbae8e502a1672fbbcc

SHA512
1b591a05f97120fd141deab43370c7fd6c97fc643a9de08fdfa3a1dcb69957540b61beeb8995f3ddd3d6d553221cabd10fb993bae34648277b2588c21111fa76

Download Submit
C:\Windows\System\quVsLbc.exe

Filesize
1.6MB

MD5
3a06c9974ddfb67d901b9381b1be5a6c

SHA1
52c7d081ea35ef0071c600cdfdb8dd80c664bbf3

SHA256
bc9f05be5a6de06538d9bddf4ca510368549195b8ac937a0d61497de9b3b876b

SHA512
234abf7cc65d4d4c6e763a4bd5ad59d8436e5d469980a72e3239430d39eadca18b683ce7073d4834498569a964d332293833e78000f56d3aeb6b5bb4fd23088a

Download Submit
C:\Windows\System\rfbbyvc.exe

Filesize
1.6MB

MD5
5872c6936363fc9ce844f33081110a4b

SHA1
f50b4feca5f4c1c8b5d447c835955911b0328d3d

SHA256
c126c15d60dbebd2dd4355779b083bb6bab69642671a4d3b94ecac8565a3e3dc

SHA512
4dc9dcab2637d1abf09ac6e4135e6c846ae8590c09ddf65a7db9705b5d152b3624821e4f09be061667439e3dc4d601894116ed203ba66209eaf4403fe28cf3b9

Download Submit
C:\Windows\System\sPdfmcP.exe

Filesize
1.6MB

MD5
f4fd6b180bb8d41495f1e0a3e0ddd716

SHA1
0ab0c3a82c951faa075adcb8ee2f23c27c242712

SHA256
8942862dd35850af92a9fcffabbe46136ecfa038c5a091808222ecc5b92c3ea2

SHA512
379c4c2c04ce0dbccd89bc7f45d7d5084e54899126cb944de6cc2e71aeecd1ce435cfae7328cdd8da71312f63cbb2fd139712b3d7c04f50e0b359da80f4f5bd6

Download Submit
C:\Windows\System\uLIBNYN.exe

Filesize
1.6MB

MD5
abd0cb66c4e4427356d541900562cf68

SHA1
9fcf188be8aefa30586dd8edade6ffe265906656

SHA256
5ceecc307be619574850535ee59d5f95dc5f4786245746e169ecb252c6e5f9ba

SHA512
f454850991686b7287e5c5e255664779a6bc2ec7a7e66b72a68053d5330617d4c0b9bb37ece87f1c82e57c1434e35e1fd80b5d474d02490500600f6f76191f81

Download Submit
C:\Windows\System\vguhode.exe

Filesize
1.6MB

MD5
c379fc0cd8db0bdcc3f95b4e3f486740

SHA1
97419e2dfb643d348e7a0a90b84c822a1363e678

SHA256
8ea909cdf0bec1084c0ac72ff1027ace5659f3e602c7df9d278a71da3a28ade0

SHA512
a87cdbb040950b325537a4a059698049f139f6e518daaa04eeda98896b94d37f540646faf9964600fa25b775da6ce8cb17fbc5b0d7468ef829d264806196778e

Download Submit
C:\Windows\System\yqjodXM.exe

Filesize
1.6MB

MD5
98f224749a8d8936a53c12e804853df3

SHA1
7ca9d554c81e46cc226e1d0a9009d4a99326b8d1

SHA256
f45b1d0515a4c0435ab40881fe9aa99fed933abf020600b3f9d136449e4e3cca

SHA512
ac9f1c7cdeae60fdfd2d9e882a5aa560d34ae2108cdfffb4ea71c9b7d7599770c56c901d9289ab1b952bb79785f07f0263416df8322f78c73b980997460471b7

Download Submit
C:\Windows\System\zIRTYAQ.exe

Filesize
1.6MB

MD5
0a883ea852051addfe193d8ca16a24d4

SHA1
e0cc09ff33a350ef4bc7e15462f0c986261d9fad

SHA256
be5be3d40a040ac4411a3f942ba41ed2599de687cbfa64278489d7030240855c

SHA512
bc6c07807cc3d3cdf35bc67ca38b498aa6e16eb200f61bc5e67c0155a3cd03804554939298945a737d614798bc4f7bbed7d8e78ff27f53e1d396cd426ddba789

Download Submit
C:\Windows\System\ziKbLsm.exe

Filesize
1.6MB

MD5
6ee44c5fdf7988a129b63b99c13c23e7

SHA1
9e8e044e1f703a27bfa21f1516a8053d7929135d

SHA256
6a88cc949c5a8ba6c8c2a07962c3429786d5ff35472e4ab748a9b938487dfd3d

SHA512
63be06553943b951abda0c87c04101bec5fa6bbf4601d7a8bfcf4afdc0cf19bb972a4dd355f341c4e481a2a629d838d2b09a7c7ce2b6844091c91dc846fe8c3f

Download Submit
memory/264-716-0x00007FF683D70000-0x00007FF684162000-memory.dmp

Filesize
3.9MB

Download
memory/264-3658-0x00007FF683D70000-0x00007FF684162000-memory.dmp

Filesize
3.9MB

Download
memory/864-189-0x00007FF7CD820000-0x00007FF7CDC12000-memory.dmp

Filesize
3.9MB

Download
memory/864-3684-0x00007FF7CD820000-0x00007FF7CDC12000-memory.dmp

Filesize
3.9MB

Download
memory/1132-3701-0x00007FF7BB780000-0x00007FF7BBB72000-memory.dmp

Filesize
3.9MB

Download
memory/1132-234-0x00007FF7BB780000-0x00007FF7BBB72000-memory.dmp

Filesize
3.9MB

Download
memory/1192-3694-0x00007FF628680000-0x00007FF628A72000-memory.dmp

Filesize
3.9MB

Download
memory/1192-363-0x00007FF628680000-0x00007FF628A72000-memory.dmp

Filesize
3.9MB

Download
memory/1632-715-0x00007FF65AD40000-0x00007FF65B132000-memory.dmp

Filesize
3.9MB

Download
memory/1632-3707-0x00007FF65AD40000-0x00007FF65B132000-memory.dmp

Filesize
3.9MB

Download
memory/2128-501-0x00007FF64A730000-0x00007FF64AB22000-memory.dmp

Filesize
3.9MB

Download
memory/2128-3743-0x00007FF64A730000-0x00007FF64AB22000-memory.dmp

Filesize
3.9MB

Download
memory/3076-717-0x00007FF8E9270000-0x00007FF8E9D31000-memory.dmp

Filesize
10.8MB

Download
memory/3076-80-0x00007FF8E9270000-0x00007FF8E9D31000-memory.dmp

Filesize
10.8MB

Download
memory/3076-117-0x0000013E4F790000-0x0000013E4F7B2000-memory.dmp

Filesize
136KB

Download
memory/3076-6-0x00007FF8E9273000-0x00007FF8E9275000-memory.dmp

Filesize
8KB

Download
memory/3076-2538-0x00007FF8E9270000-0x00007FF8E9D31000-memory.dmp

Filesize
10.8MB

Download
memory/3300-2606-0x00007FF7B5BF0000-0x00007FF7B5FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3300-0-0x00007FF7B5BF0000-0x00007FF7B5FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3300-1-0x000001E6FE040000-0x000001E6FE050000-memory.dmp

Filesize
64KB

Download
memory/3588-687-0x00007FF624BB0000-0x00007FF624FA2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-3686-0x00007FF624BB0000-0x00007FF624FA2000-memory.dmp

Filesize
3.9MB

Download
memory/3664-708-0x00007FF758250000-0x00007FF758642000-memory.dmp

Filesize
3.9MB

Download
memory/3664-3704-0x00007FF758250000-0x00007FF758642000-memory.dmp

Filesize
3.9MB

Download
memory/3712-3679-0x00007FF622D90000-0x00007FF623182000-memory.dmp

Filesize
3.9MB

Download
memory/3712-431-0x00007FF622D90000-0x00007FF623182000-memory.dmp

Filesize
3.9MB

Download
memory/3924-440-0x00007FF66D720000-0x00007FF66DB12000-memory.dmp

Filesize
3.9MB

Download
memory/3924-3682-0x00007FF66D720000-0x00007FF66DB12000-memory.dmp

Filesize
3.9MB

Download
memory/4228-712-0x00007FF76D930000-0x00007FF76DD22000-memory.dmp

Filesize
3.9MB

Download
memory/4228-3747-0x00007FF76D930000-0x00007FF76DD22000-memory.dmp

Filesize
3.9MB

Download
memory/4352-3711-0x00007FF797700000-0x00007FF797AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4352-713-0x00007FF797700000-0x00007FF797AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4380-3745-0x00007FF790620000-0x00007FF790A12000-memory.dmp

Filesize
3.9MB

Download
memory/4380-710-0x00007FF790620000-0x00007FF790A12000-memory.dmp

Filesize
3.9MB

Download
memory/4460-3692-0x00007FF6B30D0000-0x00007FF6B34C2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-690-0x00007FF6B30D0000-0x00007FF6B34C2000-memory.dmp

Filesize
3.9MB

Download
memory/4540-3690-0x00007FF6677D0000-0x00007FF667BC2000-memory.dmp

Filesize
3.9MB

Download
memory/4540-714-0x00007FF6677D0000-0x00007FF667BC2000-memory.dmp

Filesize
3.9MB

Download
memory/4632-190-0x00007FF7BB720000-0x00007FF7BBB12000-memory.dmp

Filesize
3.9MB

Download
memory/4632-3681-0x00007FF7BB720000-0x00007FF7BBB12000-memory.dmp

Filesize
3.9MB

Download
memory/4712-233-0x00007FF62A900000-0x00007FF62ACF2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-3688-0x00007FF62A900000-0x00007FF62ACF2000-memory.dmp

Filesize
3.9MB

Download
memory/4724-707-0x00007FF764CC0000-0x00007FF7650B2000-memory.dmp

Filesize
3.9MB

Download
memory/4724-3697-0x00007FF764CC0000-0x00007FF7650B2000-memory.dmp

Filesize
3.9MB

Download
memory/4764-709-0x00007FF775630000-0x00007FF775A22000-memory.dmp

Filesize
3.9MB

Download
memory/4764-3709-0x00007FF775630000-0x00007FF775A22000-memory.dmp

Filesize
3.9MB

Download
memory/4772-3750-0x00007FF7EBB90000-0x00007FF7EBF82000-memory.dmp

Filesize
3.9MB

Download
memory/4772-711-0x00007FF7EBB90000-0x00007FF7EBF82000-memory.dmp

Filesize
3.9MB

Download
memory/4848-3662-0x00007FF7348B0000-0x00007FF734CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-154-0x00007FF7348B0000-0x00007FF734CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4936-284-0x00007FF6275B0000-0x00007FF6279A2000-memory.dmp

Filesize
3.9MB

Download
memory/4936-3700-0x00007FF6275B0000-0x00007FF6279A2000-memory.dmp

Filesize
3.9MB

Download
memory/5072-3660-0x00007FF686310000-0x00007FF686702000-memory.dmp

Filesize
3.9MB

Download
memory/5072-121-0x00007FF686310000-0x00007FF686702000-memory.dmp

Filesize
3.9MB

Download
memory/5076-718-0x00007FF6AB250000-0x00007FF6AB642000-memory.dmp

Filesize
3.9MB

Download
memory/5076-3705-0x00007FF6AB250000-0x00007FF6AB642000-memory.dmp

Filesize
3.9MB

Download