xmrig | 81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
Size

1.9MB
MD5

da8355c054d357854ee225fb3b9b496f
SHA1

485c8a0fc67439f30bd564f4d3cfd1557d50f760
SHA256

81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61
SHA512

205c0bf876ca199948024360f8d3fd10ad6bc15a7de10cd5de5d82591026219f74083b6d599c039b14663fcf20301e0f6af763b142061e9b237595902a19e31b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjFkTVnfuDPFFWqreoYtgWqabE1y14dMPp:Lz071uv4BPMkHC0IEFTo/abRcNdxWT

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/5060-279-0x00007FF65F950000-0x00007FF65FD42000-memory.dmp	xmrig
behavioral2/memory/4012-336-0x00007FF6E4FF0000-0x00007FF6E53E2000-memory.dmp	xmrig
behavioral2/memory/2888-372-0x00007FF6BA020000-0x00007FF6BA412000-memory.dmp	xmrig
behavioral2/memory/3460-484-0x00007FF70F580000-0x00007FF70F972000-memory.dmp	xmrig
behavioral2/memory/2924-815-0x00007FF711800000-0x00007FF711BF2000-memory.dmp	xmrig
behavioral2/memory/2752-730-0x00007FF73DF90000-0x00007FF73E382000-memory.dmp	xmrig
behavioral2/memory/2468-882-0x00007FF6505A0000-0x00007FF650992000-memory.dmp	xmrig
behavioral2/memory/396-458-0x00007FF77EBD0000-0x00007FF77EFC2000-memory.dmp	xmrig
behavioral2/memory/3116-391-0x00007FF723140000-0x00007FF723532000-memory.dmp	xmrig
behavioral2/memory/2256-375-0x00007FF72F460000-0x00007FF72F852000-memory.dmp	xmrig
behavioral2/memory/3400-306-0x00007FF669E70000-0x00007FF66A262000-memory.dmp	xmrig
behavioral2/memory/2152-280-0x00007FF6F0A30000-0x00007FF6F0E22000-memory.dmp	xmrig
behavioral2/memory/388-268-0x00007FF6F8080000-0x00007FF6F8472000-memory.dmp	xmrig
behavioral2/memory/2768-258-0x00007FF6D39D0000-0x00007FF6D3DC2000-memory.dmp	xmrig
behavioral2/memory/364-223-0x00007FF782EA0000-0x00007FF783292000-memory.dmp	xmrig
behavioral2/memory/4876-213-0x00007FF7EC440000-0x00007FF7EC832000-memory.dmp	xmrig
behavioral2/memory/2328-145-0x00007FF708590000-0x00007FF708982000-memory.dmp	xmrig
behavioral2/memory/2640-123-0x00007FF632580000-0x00007FF632972000-memory.dmp	xmrig
behavioral2/memory/5016-100-0x00007FF613450000-0x00007FF613842000-memory.dmp	xmrig
behavioral2/memory/3616-76-0x00007FF7F6830000-0x00007FF7F6C22000-memory.dmp	xmrig
behavioral2/memory/1944-74-0x00007FF700E30000-0x00007FF701222000-memory.dmp	xmrig
behavioral2/memory/1904-45-0x00007FF6637D0000-0x00007FF663BC2000-memory.dmp	xmrig
behavioral2/memory/1944-4030-0x00007FF700E30000-0x00007FF701222000-memory.dmp	xmrig
behavioral2/memory/3616-4046-0x00007FF7F6830000-0x00007FF7F6C22000-memory.dmp	xmrig
behavioral2/memory/1836-4040-0x00007FF67FAB0000-0x00007FF67FEA2000-memory.dmp	xmrig
behavioral2/memory/3460-4264-0x00007FF70F580000-0x00007FF70F972000-memory.dmp	xmrig
behavioral2/memory/396-4247-0x00007FF77EBD0000-0x00007FF77EFC2000-memory.dmp	xmrig
behavioral2/memory/2468-4243-0x00007FF6505A0000-0x00007FF650992000-memory.dmp	xmrig
behavioral2/memory/3116-4240-0x00007FF723140000-0x00007FF723532000-memory.dmp	xmrig
behavioral2/memory/2924-4238-0x00007FF711800000-0x00007FF711BF2000-memory.dmp	xmrig
behavioral2/memory/2888-4235-0x00007FF6BA020000-0x00007FF6BA412000-memory.dmp	xmrig
behavioral2/memory/2256-4233-0x00007FF72F460000-0x00007FF72F852000-memory.dmp	xmrig
behavioral2/memory/4012-4226-0x00007FF6E4FF0000-0x00007FF6E53E2000-memory.dmp	xmrig
behavioral2/memory/3400-4188-0x00007FF669E70000-0x00007FF66A262000-memory.dmp	xmrig
behavioral2/memory/2752-4184-0x00007FF73DF90000-0x00007FF73E382000-memory.dmp	xmrig
behavioral2/memory/2152-4140-0x00007FF6F0A30000-0x00007FF6F0E22000-memory.dmp	xmrig
behavioral2/memory/5060-4135-0x00007FF65F950000-0x00007FF65FD42000-memory.dmp	xmrig
behavioral2/memory/4876-4103-0x00007FF7EC440000-0x00007FF7EC832000-memory.dmp	xmrig
behavioral2/memory/364-4101-0x00007FF782EA0000-0x00007FF783292000-memory.dmp	xmrig
behavioral2/memory/2328-4108-0x00007FF708590000-0x00007FF708982000-memory.dmp	xmrig
behavioral2/memory/2768-4056-0x00007FF6D39D0000-0x00007FF6D3DC2000-memory.dmp	xmrig
behavioral2/memory/5016-4053-0x00007FF613450000-0x00007FF613842000-memory.dmp	xmrig
behavioral2/memory/2640-4052-0x00007FF632580000-0x00007FF632972000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

3 3144 powershell.exe
6 3144 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3144 powershell.exe

flow	pid	process
3	3144	powershell.exe
6	3144	powershell.exe

pid	process
3144	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

cwkXmCA.exeBUdKamq.exeVDbjnnG.exeiEsgMlP.exeheezOJk.exeqxQKofI.exeZnvEBQl.exeMKdYdTR.exeFHgpzEX.exelaquIqB.exeOfzLsPl.exesGGBZaQ.exeImJUklQ.exeAzgTBaI.exerRxxQEI.exevadwBQv.exeOmWxFoB.exePIVAyJb.exeVqSVbOK.exerOaEJzM.exewuivwKI.exeYCvxqpt.exesCQCFjj.exeOpmfJUq.exepxIBnJM.exeyDzmgxt.exeiSttpDt.exeUyRqJWD.exeFhpyhPB.exeasOeOrN.exeHWdnxbv.exekOZcBvU.exeiJtYuKD.exesQJxePd.exeWFAOwkO.exezKlXkvZ.exeoLTptYe.exepbmEsrU.exeJevmQez.exeDyKnitO.exeConbGak.exeXpcZUZi.exeGuNwjiN.exeGEiLOoj.exeedDkrrb.exeSUfHaAa.exeUEGaPTP.exeeEuCLpV.exejbQMvkH.exehamlCZN.exexsWKHOg.exeqawvAkc.exevCesWsA.exeuiDiVkh.exekvWvTMs.exeADtuThL.exeiNtNcQs.exesEtgnEM.exeUjcTuFi.exerbLOjMr.execitVRhB.exeWRVmHow.exesfGGRrm.exevJYbUpm.exe

pid	process
1896	cwkXmCA.exe
1836	BUdKamq.exe
1904	VDbjnnG.exe
1944	iEsgMlP.exe
3616	heezOJk.exe
5016	qxQKofI.exe
2640	ZnvEBQl.exe
2328	MKdYdTR.exe
2752	FHgpzEX.exe
4876	laquIqB.exe
364	OfzLsPl.exe
2768	sGGBZaQ.exe
388	ImJUklQ.exe
5060	AzgTBaI.exe
2152	rRxxQEI.exe
2924	vadwBQv.exe
3400	OmWxFoB.exe
2468	PIVAyJb.exe
4012	VqSVbOK.exe
2888	rOaEJzM.exe
2256	wuivwKI.exe
3116	YCvxqpt.exe
396	sCQCFjj.exe
3460	OpmfJUq.exe
3152	pxIBnJM.exe
4572	yDzmgxt.exe
920	iSttpDt.exe
4856	UyRqJWD.exe
3540	FhpyhPB.exe
3164	asOeOrN.exe
876	HWdnxbv.exe
3748	kOZcBvU.exe
3572	iJtYuKD.exe
4008	sQJxePd.exe
1116	WFAOwkO.exe
3356	zKlXkvZ.exe
4228	oLTptYe.exe
3284	pbmEsrU.exe
1508	JevmQez.exe
4560	DyKnitO.exe
1364	ConbGak.exe
3028	XpcZUZi.exe
432	GuNwjiN.exe
1560	GEiLOoj.exe
2188	edDkrrb.exe
4580	SUfHaAa.exe
2272	UEGaPTP.exe
860	eEuCLpV.exe
2608	jbQMvkH.exe
3544	hamlCZN.exe
2720	xsWKHOg.exe
4468	qawvAkc.exe
4736	vCesWsA.exe
3088	uiDiVkh.exe
4760	kvWvTMs.exe
1204	ADtuThL.exe
2136	iNtNcQs.exe
4800	sEtgnEM.exe
1932	UjcTuFi.exe
4696	rbLOjMr.exe
1696	citVRhB.exe
2852	WRVmHow.exe
1628	sfGGRrm.exe
1428	vJYbUpm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4720-0-0x00007FF6D2E20000-0x00007FF6D3212000-memory.dmp	upx
C:\Windows\System\VDbjnnG.exe	upx
C:\Windows\System\cwkXmCA.exe	upx
C:\Windows\System\BUdKamq.exe	upx
behavioral2/memory/1836-26-0x00007FF67FAB0000-0x00007FF67FEA2000-memory.dmp	upx
C:\Windows\System\qxQKofI.exe	upx
C:\Windows\System\AzgTBaI.exe	upx
C:\Windows\System\wuivwKI.exe	upx
C:\Windows\System\zKlXkvZ.exe	upx
behavioral2/memory/5060-279-0x00007FF65F950000-0x00007FF65FD42000-memory.dmp	upx
behavioral2/memory/4012-336-0x00007FF6E4FF0000-0x00007FF6E53E2000-memory.dmp	upx
behavioral2/memory/2888-372-0x00007FF6BA020000-0x00007FF6BA412000-memory.dmp	upx
behavioral2/memory/3460-484-0x00007FF70F580000-0x00007FF70F972000-memory.dmp	upx
behavioral2/memory/2924-815-0x00007FF711800000-0x00007FF711BF2000-memory.dmp	upx
behavioral2/memory/2752-730-0x00007FF73DF90000-0x00007FF73E382000-memory.dmp	upx
behavioral2/memory/2468-882-0x00007FF6505A0000-0x00007FF650992000-memory.dmp	upx
behavioral2/memory/396-458-0x00007FF77EBD0000-0x00007FF77EFC2000-memory.dmp	upx
behavioral2/memory/3116-391-0x00007FF723140000-0x00007FF723532000-memory.dmp	upx
behavioral2/memory/2256-375-0x00007FF72F460000-0x00007FF72F852000-memory.dmp	upx
behavioral2/memory/3400-306-0x00007FF669E70000-0x00007FF66A262000-memory.dmp	upx
behavioral2/memory/2152-280-0x00007FF6F0A30000-0x00007FF6F0E22000-memory.dmp	upx
behavioral2/memory/388-268-0x00007FF6F8080000-0x00007FF6F8472000-memory.dmp	upx
behavioral2/memory/2768-258-0x00007FF6D39D0000-0x00007FF6D3DC2000-memory.dmp	upx
behavioral2/memory/364-223-0x00007FF782EA0000-0x00007FF783292000-memory.dmp	upx
behavioral2/memory/4876-213-0x00007FF7EC440000-0x00007FF7EC832000-memory.dmp	upx
C:\Windows\System\sQJxePd.exe	upx
C:\Windows\System\HWdnxbv.exe	upx
C:\Windows\System\WFAOwkO.exe	upx
C:\Windows\System\PIVAyJb.exe	upx
C:\Windows\System\OpmfJUq.exe	upx
C:\Windows\System\sCQCFjj.exe	upx
C:\Windows\System\YCvxqpt.exe	upx
C:\Windows\System\iJtYuKD.exe	upx
C:\Windows\System\kOZcBvU.exe	upx
C:\Windows\System\asOeOrN.exe	upx
C:\Windows\System\vadwBQv.exe	upx
C:\Windows\System\pxIBnJM.exe	upx
C:\Windows\System\FhpyhPB.exe	upx
behavioral2/memory/2328-145-0x00007FF708590000-0x00007FF708982000-memory.dmp	upx
C:\Windows\System\UyRqJWD.exe	upx
C:\Windows\System\iSttpDt.exe	upx
C:\Windows\System\yDzmgxt.exe	upx
C:\Windows\System\rOaEJzM.exe	upx
C:\Windows\System\VqSVbOK.exe	upx
C:\Windows\System\FHgpzEX.exe	upx
behavioral2/memory/2640-123-0x00007FF632580000-0x00007FF632972000-memory.dmp	upx
C:\Windows\System\OmWxFoB.exe	upx
C:\Windows\System\rRxxQEI.exe	upx
behavioral2/memory/5016-100-0x00007FF613450000-0x00007FF613842000-memory.dmp	upx
C:\Windows\System\MKdYdTR.exe	upx
C:\Windows\System\ImJUklQ.exe	upx
C:\Windows\System\OfzLsPl.exe	upx
C:\Windows\System\laquIqB.exe	upx
behavioral2/memory/3616-76-0x00007FF7F6830000-0x00007FF7F6C22000-memory.dmp	upx
behavioral2/memory/1944-74-0x00007FF700E30000-0x00007FF701222000-memory.dmp	upx
C:\Windows\System\ZnvEBQl.exe	upx
C:\Windows\System\sGGBZaQ.exe	upx
C:\Windows\System\heezOJk.exe	upx
behavioral2/memory/1904-45-0x00007FF6637D0000-0x00007FF663BC2000-memory.dmp	upx
C:\Windows\System\iEsgMlP.exe	upx
behavioral2/memory/1896-12-0x00007FF613430000-0x00007FF613822000-memory.dmp	upx
behavioral2/memory/1944-4030-0x00007FF700E30000-0x00007FF701222000-memory.dmp	upx
behavioral2/memory/3616-4046-0x00007FF7F6830000-0x00007FF7F6C22000-memory.dmp	upx
behavioral2/memory/1836-4040-0x00007FF67FAB0000-0x00007FF67FEA2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

2 raw.githubusercontent.com
3 raw.githubusercontent.com

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

Processes:

81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe

description	ioc	process
File created	C:\Windows\System\gYGiStH.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\OEZEmjt.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\MbxWakU.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\aRnhfPB.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\rNxhMuW.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\toJaanI.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\UZQgHnY.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\PCNqtNf.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\CzKEWMD.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\oZWvDAX.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\jNtaGfO.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\rKtDXRN.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\CMXRiDJ.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\TqCJMhT.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\jiSRxKe.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\bUdggSq.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\nyjyfPY.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\SxbGBAx.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\OGJhBOB.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\AeRYanE.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\zWWsPBa.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\OqAjPZG.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\SuDiBLa.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\Lciimbq.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\GVlgxDL.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\gfmkAQG.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\ThoVylv.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\dceDFfI.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\dYmleSZ.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\rXofdpk.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\XRbZLIH.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\YaMqRcJ.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\axSbgSX.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\ujXTAdK.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\VOxukEn.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\BOJDHXf.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\DLLWniX.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\BkwmTDG.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\TNkqdje.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\aWGoaWB.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\YnnMVXt.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\ITkrDcQ.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\sVUncGD.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\ZpkazWV.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\gLkIreY.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\HgtkvvQ.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\yIgtzcW.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\zWhCtnr.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\qcecefM.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\XQhxtyk.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\fykARbB.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\KTUqGAv.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\cNLdmSZ.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\GKdssBn.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\FkGEYys.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\pVOpTnL.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\FvrJJON.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\aHuzGUH.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\WJWmlSr.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\NyKbXPy.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\Mfrrrtd.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\XpcZUZi.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\fwreKiY.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
File created	C:\Windows\System\yljaOFn.exe	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wermgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

wermgr.exe

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe

pid process

3144 powershell.exe
3144 powershell.exe
3144 powershell.exe
3144 powershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

pid	process
3144	powershell.exe
3144	powershell.exe
3144	powershell.exe
3144	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
Token: SeLockMemoryPrivilege	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
Token: SeDebugPrivilege	3144	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe

description	pid	process	target process
PID 4720 wrote to memory of 3144	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	powershell.exe
PID 4720 wrote to memory of 3144	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	powershell.exe
PID 4720 wrote to memory of 1896	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	cwkXmCA.exe
PID 4720 wrote to memory of 1896	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	cwkXmCA.exe
PID 4720 wrote to memory of 1836	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	BUdKamq.exe
PID 4720 wrote to memory of 1836	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	BUdKamq.exe
PID 4720 wrote to memory of 1904	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	VDbjnnG.exe
PID 4720 wrote to memory of 1904	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	VDbjnnG.exe
PID 4720 wrote to memory of 1944	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	iEsgMlP.exe
PID 4720 wrote to memory of 1944	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	iEsgMlP.exe
PID 4720 wrote to memory of 5016	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	qxQKofI.exe
PID 4720 wrote to memory of 5016	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	qxQKofI.exe
PID 4720 wrote to memory of 3616	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	heezOJk.exe
PID 4720 wrote to memory of 3616	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	heezOJk.exe
PID 4720 wrote to memory of 2640	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	ZnvEBQl.exe
PID 4720 wrote to memory of 2640	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	ZnvEBQl.exe
PID 4720 wrote to memory of 2328	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	MKdYdTR.exe
PID 4720 wrote to memory of 2328	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	MKdYdTR.exe
PID 4720 wrote to memory of 2768	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	sGGBZaQ.exe
PID 4720 wrote to memory of 2768	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	sGGBZaQ.exe
PID 4720 wrote to memory of 2752	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	FHgpzEX.exe
PID 4720 wrote to memory of 2752	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	FHgpzEX.exe
PID 4720 wrote to memory of 4876	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	laquIqB.exe
PID 4720 wrote to memory of 4876	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	laquIqB.exe
PID 4720 wrote to memory of 388	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	ImJUklQ.exe
PID 4720 wrote to memory of 388	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	ImJUklQ.exe
PID 4720 wrote to memory of 364	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	OfzLsPl.exe
PID 4720 wrote to memory of 364	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	OfzLsPl.exe
PID 4720 wrote to memory of 5060	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	AzgTBaI.exe
PID 4720 wrote to memory of 5060	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	AzgTBaI.exe
PID 4720 wrote to memory of 2152	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	rRxxQEI.exe
PID 4720 wrote to memory of 2152	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	rRxxQEI.exe
PID 4720 wrote to memory of 2924	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	vadwBQv.exe
PID 4720 wrote to memory of 2924	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	vadwBQv.exe
PID 4720 wrote to memory of 2468	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	PIVAyJb.exe
PID 4720 wrote to memory of 2468	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	PIVAyJb.exe
PID 4720 wrote to memory of 4012	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	VqSVbOK.exe
PID 4720 wrote to memory of 4012	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	VqSVbOK.exe
PID 4720 wrote to memory of 3400	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	OmWxFoB.exe
PID 4720 wrote to memory of 3400	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	OmWxFoB.exe
PID 4720 wrote to memory of 2888	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	rOaEJzM.exe
PID 4720 wrote to memory of 2888	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	rOaEJzM.exe
PID 4720 wrote to memory of 2256	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	wuivwKI.exe
PID 4720 wrote to memory of 2256	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	wuivwKI.exe
PID 4720 wrote to memory of 3116	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	YCvxqpt.exe
PID 4720 wrote to memory of 3116	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	YCvxqpt.exe
PID 4720 wrote to memory of 4572	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	yDzmgxt.exe
PID 4720 wrote to memory of 4572	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	yDzmgxt.exe
PID 4720 wrote to memory of 396	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	sCQCFjj.exe
PID 4720 wrote to memory of 396	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	sCQCFjj.exe
PID 4720 wrote to memory of 3460	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	OpmfJUq.exe
PID 4720 wrote to memory of 3460	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	OpmfJUq.exe
PID 4720 wrote to memory of 3152	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	pxIBnJM.exe
PID 4720 wrote to memory of 3152	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	pxIBnJM.exe
PID 4720 wrote to memory of 3572	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	iJtYuKD.exe
PID 4720 wrote to memory of 3572	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	iJtYuKD.exe
PID 4720 wrote to memory of 920	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	iSttpDt.exe
PID 4720 wrote to memory of 920	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	iSttpDt.exe
PID 4720 wrote to memory of 4856	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	UyRqJWD.exe
PID 4720 wrote to memory of 4856	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	UyRqJWD.exe
PID 4720 wrote to memory of 3540	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	FhpyhPB.exe
PID 4720 wrote to memory of 3540	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	FhpyhPB.exe
PID 4720 wrote to memory of 3164	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	asOeOrN.exe
PID 4720 wrote to memory of 3164	4720	81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe	asOeOrN.exe

C:\Users\Admin\AppData\Local\Temp\81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe
"C:\Users\Admin\AppData\Local\Temp\81e8b0d967d628a6079f5efefef87cd271f59e13d1d0e31e17200e0b04b98d61.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3144" "2976" "2912" "2980" "0" "0" "2984" "0" "0" "0" "0" "0"
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:10268

C:\Windows\System\cwkXmCA.exe
C:\Windows\System\cwkXmCA.exe
2⤵
- Executes dropped EXE
PID:1896

C:\Windows\System\BUdKamq.exe
C:\Windows\System\BUdKamq.exe
2⤵
- Executes dropped EXE
PID:1836

C:\Windows\System\VDbjnnG.exe
C:\Windows\System\VDbjnnG.exe
2⤵
- Executes dropped EXE
PID:1904

C:\Windows\System\iEsgMlP.exe
C:\Windows\System\iEsgMlP.exe
2⤵
- Executes dropped EXE
PID:1944

C:\Windows\System\qxQKofI.exe
C:\Windows\System\qxQKofI.exe
2⤵
- Executes dropped EXE
PID:5016

C:\Windows\System\heezOJk.exe
C:\Windows\System\heezOJk.exe
2⤵
- Executes dropped EXE
PID:3616

C:\Windows\System\ZnvEBQl.exe
C:\Windows\System\ZnvEBQl.exe
2⤵
- Executes dropped EXE
PID:2640

C:\Windows\System\MKdYdTR.exe
C:\Windows\System\MKdYdTR.exe
2⤵
- Executes dropped EXE
PID:2328

C:\Windows\System\sGGBZaQ.exe
C:\Windows\System\sGGBZaQ.exe
2⤵
- Executes dropped EXE
PID:2768

C:\Windows\System\FHgpzEX.exe
C:\Windows\System\FHgpzEX.exe
2⤵
- Executes dropped EXE
PID:2752

C:\Windows\System\laquIqB.exe
C:\Windows\System\laquIqB.exe
2⤵
- Executes dropped EXE
PID:4876

C:\Windows\System\ImJUklQ.exe
C:\Windows\System\ImJUklQ.exe
2⤵
- Executes dropped EXE
PID:388

C:\Windows\System\OfzLsPl.exe
C:\Windows\System\OfzLsPl.exe
2⤵
- Executes dropped EXE
PID:364

C:\Windows\System\AzgTBaI.exe
C:\Windows\System\AzgTBaI.exe
2⤵
- Executes dropped EXE
PID:5060

C:\Windows\System\rRxxQEI.exe
C:\Windows\System\rRxxQEI.exe
2⤵
- Executes dropped EXE
PID:2152

C:\Windows\System\vadwBQv.exe
C:\Windows\System\vadwBQv.exe
2⤵
- Executes dropped EXE
PID:2924

C:\Windows\System\PIVAyJb.exe
C:\Windows\System\PIVAyJb.exe
2⤵
- Executes dropped EXE
PID:2468

C:\Windows\System\VqSVbOK.exe
C:\Windows\System\VqSVbOK.exe
2⤵
- Executes dropped EXE
PID:4012

C:\Windows\System\OmWxFoB.exe
C:\Windows\System\OmWxFoB.exe
2⤵
- Executes dropped EXE
PID:3400

C:\Windows\System\rOaEJzM.exe
C:\Windows\System\rOaEJzM.exe
2⤵
- Executes dropped EXE
PID:2888

C:\Windows\System\wuivwKI.exe
C:\Windows\System\wuivwKI.exe
2⤵
- Executes dropped EXE
PID:2256

C:\Windows\System\YCvxqpt.exe
C:\Windows\System\YCvxqpt.exe
2⤵
- Executes dropped EXE
PID:3116

C:\Windows\System\yDzmgxt.exe
C:\Windows\System\yDzmgxt.exe
2⤵
- Executes dropped EXE
PID:4572

C:\Windows\System\sCQCFjj.exe
C:\Windows\System\sCQCFjj.exe
2⤵
- Executes dropped EXE
PID:396

C:\Windows\System\OpmfJUq.exe
C:\Windows\System\OpmfJUq.exe
2⤵
- Executes dropped EXE
PID:3460

C:\Windows\System\pxIBnJM.exe
C:\Windows\System\pxIBnJM.exe
2⤵
- Executes dropped EXE
PID:3152

C:\Windows\System\iJtYuKD.exe
C:\Windows\System\iJtYuKD.exe
2⤵
- Executes dropped EXE
PID:3572

C:\Windows\System\iSttpDt.exe
C:\Windows\System\iSttpDt.exe
2⤵
- Executes dropped EXE
PID:920

C:\Windows\System\UyRqJWD.exe
C:\Windows\System\UyRqJWD.exe
2⤵
- Executes dropped EXE
PID:4856

C:\Windows\System\FhpyhPB.exe
C:\Windows\System\FhpyhPB.exe
2⤵
- Executes dropped EXE
PID:3540

C:\Windows\System\asOeOrN.exe
C:\Windows\System\asOeOrN.exe
2⤵
- Executes dropped EXE
PID:3164

C:\Windows\System\HWdnxbv.exe
C:\Windows\System\HWdnxbv.exe
2⤵
- Executes dropped EXE
PID:876

C:\Windows\System\kOZcBvU.exe
C:\Windows\System\kOZcBvU.exe
2⤵
- Executes dropped EXE
PID:3748

C:\Windows\System\sQJxePd.exe
C:\Windows\System\sQJxePd.exe
2⤵
- Executes dropped EXE
PID:4008

C:\Windows\System\pbmEsrU.exe
C:\Windows\System\pbmEsrU.exe
2⤵
- Executes dropped EXE
PID:3284

C:\Windows\System\WFAOwkO.exe
C:\Windows\System\WFAOwkO.exe
2⤵
- Executes dropped EXE
PID:1116

C:\Windows\System\zKlXkvZ.exe
C:\Windows\System\zKlXkvZ.exe
2⤵
- Executes dropped EXE
PID:3356

C:\Windows\System\oLTptYe.exe
C:\Windows\System\oLTptYe.exe
2⤵
- Executes dropped EXE
PID:4228

C:\Windows\System\jbQMvkH.exe
C:\Windows\System\jbQMvkH.exe
2⤵
- Executes dropped EXE
PID:2608

C:\Windows\System\JevmQez.exe
C:\Windows\System\JevmQez.exe
2⤵
- Executes dropped EXE
PID:1508

C:\Windows\System\DyKnitO.exe
C:\Windows\System\DyKnitO.exe
2⤵
- Executes dropped EXE
PID:4560

C:\Windows\System\hamlCZN.exe
C:\Windows\System\hamlCZN.exe
2⤵
- Executes dropped EXE
PID:3544

C:\Windows\System\ConbGak.exe
C:\Windows\System\ConbGak.exe
2⤵
- Executes dropped EXE
PID:1364

C:\Windows\System\XpcZUZi.exe
C:\Windows\System\XpcZUZi.exe
2⤵
- Executes dropped EXE
PID:3028

C:\Windows\System\GuNwjiN.exe
C:\Windows\System\GuNwjiN.exe
2⤵
- Executes dropped EXE
PID:432

C:\Windows\System\GEiLOoj.exe
C:\Windows\System\GEiLOoj.exe
2⤵
- Executes dropped EXE
PID:1560

C:\Windows\System\edDkrrb.exe
C:\Windows\System\edDkrrb.exe
2⤵
- Executes dropped EXE
PID:2188

C:\Windows\System\SUfHaAa.exe
C:\Windows\System\SUfHaAa.exe
2⤵
- Executes dropped EXE
PID:4580

C:\Windows\System\UEGaPTP.exe
C:\Windows\System\UEGaPTP.exe
2⤵
- Executes dropped EXE
PID:2272

C:\Windows\System\eEuCLpV.exe
C:\Windows\System\eEuCLpV.exe
2⤵
- Executes dropped EXE
PID:860

C:\Windows\System\xsWKHOg.exe
C:\Windows\System\xsWKHOg.exe
2⤵
- Executes dropped EXE
PID:2720

C:\Windows\System\qawvAkc.exe
C:\Windows\System\qawvAkc.exe
2⤵
- Executes dropped EXE
PID:4468

C:\Windows\System\vCesWsA.exe
C:\Windows\System\vCesWsA.exe
2⤵
- Executes dropped EXE
PID:4736

C:\Windows\System\vJYbUpm.exe
C:\Windows\System\vJYbUpm.exe
2⤵
- Executes dropped EXE
PID:1428

C:\Windows\System\uiDiVkh.exe
C:\Windows\System\uiDiVkh.exe
2⤵
- Executes dropped EXE
PID:3088

C:\Windows\System\kvWvTMs.exe
C:\Windows\System\kvWvTMs.exe
2⤵
- Executes dropped EXE
PID:4760

C:\Windows\System\ADtuThL.exe
C:\Windows\System\ADtuThL.exe
2⤵
- Executes dropped EXE
PID:1204

C:\Windows\System\iNtNcQs.exe
C:\Windows\System\iNtNcQs.exe
2⤵
- Executes dropped EXE
PID:2136

C:\Windows\System\sEtgnEM.exe
C:\Windows\System\sEtgnEM.exe
2⤵
- Executes dropped EXE
PID:4800

C:\Windows\System\UjcTuFi.exe
C:\Windows\System\UjcTuFi.exe
2⤵
- Executes dropped EXE
PID:1932

C:\Windows\System\rbLOjMr.exe
C:\Windows\System\rbLOjMr.exe
2⤵
- Executes dropped EXE
PID:4696

C:\Windows\System\citVRhB.exe
C:\Windows\System\citVRhB.exe
2⤵
- Executes dropped EXE
PID:1696

C:\Windows\System\WRVmHow.exe
C:\Windows\System\WRVmHow.exe
2⤵
- Executes dropped EXE
PID:2852

C:\Windows\System\sfGGRrm.exe
C:\Windows\System\sfGGRrm.exe
2⤵
- Executes dropped EXE
PID:1628

C:\Windows\System\vwdzdgC.exe
C:\Windows\System\vwdzdgC.exe
2⤵
PID:972

C:\Windows\System\cQfmGME.exe
C:\Windows\System\cQfmGME.exe
2⤵
PID:1200

C:\Windows\System\GGGUFLT.exe
C:\Windows\System\GGGUFLT.exe
2⤵
PID:2792

C:\Windows\System\emruhqC.exe
C:\Windows\System\emruhqC.exe
2⤵
PID:896

C:\Windows\System\lBDqiOW.exe
C:\Windows\System\lBDqiOW.exe
2⤵
PID:3348

C:\Windows\System\dYmleSZ.exe
C:\Windows\System\dYmleSZ.exe
2⤵
PID:3596

C:\Windows\System\TNMuSSb.exe
C:\Windows\System\TNMuSSb.exe
2⤵
PID:1480

C:\Windows\System\OClBQzb.exe
C:\Windows\System\OClBQzb.exe
2⤵
PID:3600

C:\Windows\System\ySZsVpi.exe
C:\Windows\System\ySZsVpi.exe
2⤵
PID:3608

C:\Windows\System\FNHhdbp.exe
C:\Windows\System\FNHhdbp.exe
2⤵
PID:4000

C:\Windows\System\TUqFMxH.exe
C:\Windows\System\TUqFMxH.exe
2⤵
PID:548

C:\Windows\System\fdJaxcI.exe
C:\Windows\System\fdJaxcI.exe
2⤵
PID:1392

C:\Windows\System\UpFcjCZ.exe
C:\Windows\System\UpFcjCZ.exe
2⤵
PID:2592

C:\Windows\System\TBJWNbN.exe
C:\Windows\System\TBJWNbN.exe
2⤵
PID:1516

C:\Windows\System\HOuXRhC.exe
C:\Windows\System\HOuXRhC.exe
2⤵
PID:5164

C:\Windows\System\waUmgyf.exe
C:\Windows\System\waUmgyf.exe
2⤵
PID:5188

C:\Windows\System\poyQrTz.exe
C:\Windows\System\poyQrTz.exe
2⤵
PID:5208

C:\Windows\System\yjbgolF.exe
C:\Windows\System\yjbgolF.exe
2⤵
PID:5228

C:\Windows\System\MDyUjCm.exe
C:\Windows\System\MDyUjCm.exe
2⤵
PID:5256

C:\Windows\System\lyfXrfE.exe
C:\Windows\System\lyfXrfE.exe
2⤵
PID:5272

C:\Windows\System\syalhoS.exe
C:\Windows\System\syalhoS.exe
2⤵
PID:5300

C:\Windows\System\ItjJNrg.exe
C:\Windows\System\ItjJNrg.exe
2⤵
PID:5316

C:\Windows\System\ZqalpQj.exe
C:\Windows\System\ZqalpQj.exe
2⤵
PID:5332

C:\Windows\System\ADfDxNe.exe
C:\Windows\System\ADfDxNe.exe
2⤵
PID:5352

C:\Windows\System\tvOmRJR.exe
C:\Windows\System\tvOmRJR.exe
2⤵
PID:5368

C:\Windows\System\QvDeTms.exe
C:\Windows\System\QvDeTms.exe
2⤵
PID:5392

C:\Windows\System\QwIXUyf.exe
C:\Windows\System\QwIXUyf.exe
2⤵
PID:5480

C:\Windows\System\fPezuod.exe
C:\Windows\System\fPezuod.exe
2⤵
PID:5516

C:\Windows\System\xJeiQLa.exe
C:\Windows\System\xJeiQLa.exe
2⤵
PID:5532

C:\Windows\System\ZAYtlBO.exe
C:\Windows\System\ZAYtlBO.exe
2⤵
PID:5548

C:\Windows\System\StDcRkh.exe
C:\Windows\System\StDcRkh.exe
2⤵
PID:5564

C:\Windows\System\FWZTkFb.exe
C:\Windows\System\FWZTkFb.exe
2⤵
PID:5584

C:\Windows\System\QQwJSoN.exe
C:\Windows\System\QQwJSoN.exe
2⤵
PID:5604

C:\Windows\System\yrGOicz.exe
C:\Windows\System\yrGOicz.exe
2⤵
PID:5628

C:\Windows\System\dJZWHuq.exe
C:\Windows\System\dJZWHuq.exe
2⤵
PID:5644

C:\Windows\System\kdxoEYN.exe
C:\Windows\System\kdxoEYN.exe
2⤵
PID:5664

C:\Windows\System\jTRqHLe.exe
C:\Windows\System\jTRqHLe.exe
2⤵
PID:5684

C:\Windows\System\pExGsQK.exe
C:\Windows\System\pExGsQK.exe
2⤵
PID:5852

C:\Windows\System\CNilqvr.exe
C:\Windows\System\CNilqvr.exe
2⤵
PID:5868

C:\Windows\System\GoWhLrp.exe
C:\Windows\System\GoWhLrp.exe
2⤵
PID:5884

C:\Windows\System\tTJsLGu.exe
C:\Windows\System\tTJsLGu.exe
2⤵
PID:5900

C:\Windows\System\OIrFaSC.exe
C:\Windows\System\OIrFaSC.exe
2⤵
PID:5916

C:\Windows\System\NCZlMuM.exe
C:\Windows\System\NCZlMuM.exe
2⤵
PID:5932

C:\Windows\System\ywMFDeD.exe
C:\Windows\System\ywMFDeD.exe
2⤵
PID:5952

C:\Windows\System\oHHuyGq.exe
C:\Windows\System\oHHuyGq.exe
2⤵
PID:5972

C:\Windows\System\YukHbSJ.exe
C:\Windows\System\YukHbSJ.exe
2⤵
PID:5992

C:\Windows\System\lUXTqXs.exe
C:\Windows\System\lUXTqXs.exe
2⤵
PID:6012

C:\Windows\System\jRjovAc.exe
C:\Windows\System\jRjovAc.exe
2⤵
PID:6036

C:\Windows\System\geeuvRv.exe
C:\Windows\System\geeuvRv.exe
2⤵
PID:6052

C:\Windows\System\vcjDwQY.exe
C:\Windows\System\vcjDwQY.exe
2⤵
PID:6076

C:\Windows\System\qgKGMcZ.exe
C:\Windows\System\qgKGMcZ.exe
2⤵
PID:6104

C:\Windows\System\ePDDFjk.exe
C:\Windows\System\ePDDFjk.exe
2⤵
PID:6120

C:\Windows\System\ErkGWUl.exe
C:\Windows\System\ErkGWUl.exe
2⤵
PID:2948

C:\Windows\System\RpDwCmV.exe
C:\Windows\System\RpDwCmV.exe
2⤵
PID:3048

C:\Windows\System\ReKTvlQ.exe
C:\Windows\System\ReKTvlQ.exe
2⤵
PID:4880

C:\Windows\System\zutGjFj.exe
C:\Windows\System\zutGjFj.exe
2⤵
PID:2932

C:\Windows\System\PoxvvHn.exe
C:\Windows\System\PoxvvHn.exe
2⤵
PID:4336

C:\Windows\System\HIeVSjf.exe
C:\Windows\System\HIeVSjf.exe
2⤵
PID:2176

C:\Windows\System\eIOrTWz.exe
C:\Windows\System\eIOrTWz.exe
2⤵
PID:4896

C:\Windows\System\RjxLVnH.exe
C:\Windows\System\RjxLVnH.exe
2⤵
PID:4184

C:\Windows\System\bwsfbQa.exe
C:\Windows\System\bwsfbQa.exe
2⤵
PID:4624

C:\Windows\System\koUeOgv.exe
C:\Windows\System\koUeOgv.exe
2⤵
PID:2632

C:\Windows\System\FkpAhIo.exe
C:\Windows\System\FkpAhIo.exe
2⤵
PID:4976

C:\Windows\System\rPECmKc.exe
C:\Windows\System\rPECmKc.exe
2⤵
PID:5128

C:\Windows\System\tzzlycy.exe
C:\Windows\System\tzzlycy.exe
2⤵
PID:5184

C:\Windows\System\BispChO.exe
C:\Windows\System\BispChO.exe
2⤵
PID:5236

C:\Windows\System\CvdvsCi.exe
C:\Windows\System\CvdvsCi.exe
2⤵
PID:5280

C:\Windows\System\qHCQpdp.exe
C:\Windows\System\qHCQpdp.exe
2⤵
PID:5312

C:\Windows\System\iQwYXHF.exe
C:\Windows\System\iQwYXHF.exe
2⤵
PID:5444

C:\Windows\System\leEiAxl.exe
C:\Windows\System\leEiAxl.exe
2⤵
PID:5560

C:\Windows\System\iPyhKic.exe
C:\Windows\System\iPyhKic.exe
2⤵
PID:5592

C:\Windows\System\SEodTQC.exe
C:\Windows\System\SEodTQC.exe
2⤵
PID:5692

C:\Windows\System\kzVTXeE.exe
C:\Windows\System\kzVTXeE.exe
2⤵
PID:5732

C:\Windows\System\TAphfaQ.exe
C:\Windows\System\TAphfaQ.exe
2⤵
PID:1252

C:\Windows\System\jbBWcXB.exe
C:\Windows\System\jbBWcXB.exe
2⤵
PID:4316

C:\Windows\System\jFGxBGv.exe
C:\Windows\System\jFGxBGv.exe
2⤵
PID:224

C:\Windows\System\BNindew.exe
C:\Windows\System\BNindew.exe
2⤵
PID:3136

C:\Windows\System\WjfJzJh.exe
C:\Windows\System\WjfJzJh.exe
2⤵
PID:4224

C:\Windows\System\wTAHfTm.exe
C:\Windows\System\wTAHfTm.exe
2⤵
PID:3752

C:\Windows\System\KMSWnXH.exe
C:\Windows\System\KMSWnXH.exe
2⤵
PID:5180

C:\Windows\System\IEUUjMD.exe
C:\Windows\System\IEUUjMD.exe
2⤵
PID:5636

C:\Windows\System\GaaCJIG.exe
C:\Windows\System\GaaCJIG.exe
2⤵
PID:2524

C:\Windows\System\AKhBYIT.exe
C:\Windows\System\AKhBYIT.exe
2⤵
PID:5728

C:\Windows\System\rpRjvEL.exe
C:\Windows\System\rpRjvEL.exe
2⤵
PID:5980

C:\Windows\System\LYpSjJR.exe
C:\Windows\System\LYpSjJR.exe
2⤵
PID:6008

C:\Windows\System\fLdeWey.exe
C:\Windows\System\fLdeWey.exe
2⤵
PID:6072

C:\Windows\System\BJqkQRA.exe
C:\Windows\System\BJqkQRA.exe
2⤵
PID:6116

C:\Windows\System\zNpLdKR.exe
C:\Windows\System\zNpLdKR.exe
2⤵
PID:5200

C:\Windows\System\MgTuybO.exe
C:\Windows\System\MgTuybO.exe
2⤵
PID:1248

C:\Windows\System\WMleDjZ.exe
C:\Windows\System\WMleDjZ.exe
2⤵
PID:6160

C:\Windows\System\fwreKiY.exe
C:\Windows\System\fwreKiY.exe
2⤵
PID:6176

C:\Windows\System\PbBmOno.exe
C:\Windows\System\PbBmOno.exe
2⤵
PID:6200

C:\Windows\System\VpZNLHF.exe
C:\Windows\System\VpZNLHF.exe
2⤵
PID:6240

C:\Windows\System\wbTELJB.exe
C:\Windows\System\wbTELJB.exe
2⤵
PID:6260

C:\Windows\System\bxuKakw.exe
C:\Windows\System\bxuKakw.exe
2⤵
PID:6284

C:\Windows\System\xfxizuQ.exe
C:\Windows\System\xfxizuQ.exe
2⤵
PID:6312

C:\Windows\System\dptfiXO.exe
C:\Windows\System\dptfiXO.exe
2⤵
PID:6336

C:\Windows\System\GgLquGG.exe
C:\Windows\System\GgLquGG.exe
2⤵
PID:6360

C:\Windows\System\AMDDttO.exe
C:\Windows\System\AMDDttO.exe
2⤵
PID:6392

C:\Windows\System\WMzLHSH.exe
C:\Windows\System\WMzLHSH.exe
2⤵
PID:6412

C:\Windows\System\avcorPc.exe
C:\Windows\System\avcorPc.exe
2⤵
PID:6448

C:\Windows\System\nQJUqlJ.exe
C:\Windows\System\nQJUqlJ.exe
2⤵
PID:6468

C:\Windows\System\lzVKirm.exe
C:\Windows\System\lzVKirm.exe
2⤵
PID:6492

C:\Windows\System\toJaanI.exe
C:\Windows\System\toJaanI.exe
2⤵
PID:6512

C:\Windows\System\bDBGaji.exe
C:\Windows\System\bDBGaji.exe
2⤵
PID:6536

C:\Windows\System\qcecefM.exe
C:\Windows\System\qcecefM.exe
2⤵
PID:6552

C:\Windows\System\yqZWGeZ.exe
C:\Windows\System\yqZWGeZ.exe
2⤵
PID:6576

C:\Windows\System\tcmKAIY.exe
C:\Windows\System\tcmKAIY.exe
2⤵
PID:6596

C:\Windows\System\oyDrspt.exe
C:\Windows\System\oyDrspt.exe
2⤵
PID:6616

C:\Windows\System\zADBeVj.exe
C:\Windows\System\zADBeVj.exe
2⤵
PID:6636

C:\Windows\System\QHYDQhU.exe
C:\Windows\System\QHYDQhU.exe
2⤵
PID:6652

C:\Windows\System\LbbokSL.exe
C:\Windows\System\LbbokSL.exe
2⤵
PID:6736

C:\Windows\System\kDDGGIb.exe
C:\Windows\System\kDDGGIb.exe
2⤵
PID:6752

C:\Windows\System\pZOeNyR.exe
C:\Windows\System\pZOeNyR.exe
2⤵
PID:6772

C:\Windows\System\JuwomGc.exe
C:\Windows\System\JuwomGc.exe
2⤵
PID:6800

C:\Windows\System\eIobcPX.exe
C:\Windows\System\eIobcPX.exe
2⤵
PID:6816

C:\Windows\System\clZmlHn.exe
C:\Windows\System\clZmlHn.exe
2⤵
PID:6840

C:\Windows\System\fpzJKzD.exe
C:\Windows\System\fpzJKzD.exe
2⤵
PID:6856

C:\Windows\System\JcGkLXb.exe
C:\Windows\System\JcGkLXb.exe
2⤵
PID:6880

C:\Windows\System\FTCHrWg.exe
C:\Windows\System\FTCHrWg.exe
2⤵
PID:6908

C:\Windows\System\rhfFOqv.exe
C:\Windows\System\rhfFOqv.exe
2⤵
PID:6924

C:\Windows\System\yilkUtf.exe
C:\Windows\System\yilkUtf.exe
2⤵
PID:7000

C:\Windows\System\qdnATUy.exe
C:\Windows\System\qdnATUy.exe
2⤵
PID:7020

C:\Windows\System\tLoYRvz.exe
C:\Windows\System\tLoYRvz.exe
2⤵
PID:7048

C:\Windows\System\KXzwqMa.exe
C:\Windows\System\KXzwqMa.exe
2⤵
PID:7068

C:\Windows\System\rXofdpk.exe
C:\Windows\System\rXofdpk.exe
2⤵
PID:7092

C:\Windows\System\YeObtSL.exe
C:\Windows\System\YeObtSL.exe
2⤵
PID:7124

C:\Windows\System\cdaELsj.exe
C:\Windows\System\cdaELsj.exe
2⤵
PID:7144

C:\Windows\System\nOirVhi.exe
C:\Windows\System\nOirVhi.exe
2⤵
PID:5720

C:\Windows\System\YGMGSOO.exe
C:\Windows\System\YGMGSOO.exe
2⤵
PID:5640

C:\Windows\System\DhutilG.exe
C:\Windows\System\DhutilG.exe
2⤵
PID:3940

C:\Windows\System\GQLoyym.exe
C:\Windows\System\GQLoyym.exe
2⤵
PID:5540

C:\Windows\System\uQhxVpd.exe
C:\Windows\System\uQhxVpd.exe
2⤵
PID:4740

C:\Windows\System\VciNJZv.exe
C:\Windows\System\VciNJZv.exe
2⤵
PID:6028

C:\Windows\System\xJqVYnB.exe
C:\Windows\System\xJqVYnB.exe
2⤵
PID:4680

C:\Windows\System\MbeMzMN.exe
C:\Windows\System\MbeMzMN.exe
2⤵
PID:1080

C:\Windows\System\ifJnnJq.exe
C:\Windows\System\ifJnnJq.exe
2⤵
PID:4912

C:\Windows\System\XIumCkw.exe
C:\Windows\System\XIumCkw.exe
2⤵
PID:5796

C:\Windows\System\lgLPMgN.exe
C:\Windows\System\lgLPMgN.exe
2⤵
PID:6484

C:\Windows\System\qUAgcZl.exe
C:\Windows\System\qUAgcZl.exe
2⤵
PID:6112

C:\Windows\System\ICKNfpj.exe
C:\Windows\System\ICKNfpj.exe
2⤵
PID:6568

C:\Windows\System\oYWcUJA.exe
C:\Windows\System\oYWcUJA.exe
2⤵
PID:6648

C:\Windows\System\QLIfYkK.exe
C:\Windows\System\QLIfYkK.exe
2⤵
PID:2588

C:\Windows\System\vvntSTR.exe
C:\Windows\System\vvntSTR.exe
2⤵
PID:5340

C:\Windows\System\CrvBYSy.exe
C:\Windows\System\CrvBYSy.exe
2⤵
PID:628

C:\Windows\System\gOpfOer.exe
C:\Windows\System\gOpfOer.exe
2⤵
PID:6892

C:\Windows\System\CHAkeSi.exe
C:\Windows\System\CHAkeSi.exe
2⤵
PID:6168

C:\Windows\System\ewQvtzK.exe
C:\Windows\System\ewQvtzK.exe
2⤵
PID:6208

C:\Windows\System\kLTqdfe.exe
C:\Windows\System\kLTqdfe.exe
2⤵
PID:6268

C:\Windows\System\PsDAlmQ.exe
C:\Windows\System\PsDAlmQ.exe
2⤵
PID:6320

C:\Windows\System\JbjMZAc.exe
C:\Windows\System\JbjMZAc.exe
2⤵
PID:6348

C:\Windows\System\cAmVNzO.exe
C:\Windows\System\cAmVNzO.exe
2⤵
PID:6420

C:\Windows\System\vJFyCvb.exe
C:\Windows\System\vJFyCvb.exe
2⤵
PID:6744

C:\Windows\System\SWiYErY.exe
C:\Windows\System\SWiYErY.exe
2⤵
PID:7028

C:\Windows\System\ArZSpum.exe
C:\Windows\System\ArZSpum.exe
2⤵
PID:7076

C:\Windows\System\PXotPXG.exe
C:\Windows\System\PXotPXG.exe
2⤵
PID:7104

C:\Windows\System\GDILLbp.exe
C:\Windows\System\GDILLbp.exe
2⤵
PID:7188

C:\Windows\System\UZQgHnY.exe
C:\Windows\System\UZQgHnY.exe
2⤵
PID:7208

C:\Windows\System\ASuJiUL.exe
C:\Windows\System\ASuJiUL.exe
2⤵
PID:7232

C:\Windows\System\QibjSae.exe
C:\Windows\System\QibjSae.exe
2⤵
PID:7248

C:\Windows\System\tiyBwfh.exe
C:\Windows\System\tiyBwfh.exe
2⤵
PID:7264

C:\Windows\System\YDTcWfn.exe
C:\Windows\System\YDTcWfn.exe
2⤵
PID:7280

C:\Windows\System\QRUiAsa.exe
C:\Windows\System\QRUiAsa.exe
2⤵
PID:7296

C:\Windows\System\tfyDnZM.exe
C:\Windows\System\tfyDnZM.exe
2⤵
PID:7316

C:\Windows\System\KXegKuv.exe
C:\Windows\System\KXegKuv.exe
2⤵
PID:7336

C:\Windows\System\dbObdsz.exe
C:\Windows\System\dbObdsz.exe
2⤵
PID:7356

C:\Windows\System\AohwdlU.exe
C:\Windows\System\AohwdlU.exe
2⤵
PID:7380

C:\Windows\System\yKfOFPJ.exe
C:\Windows\System\yKfOFPJ.exe
2⤵
PID:7400

C:\Windows\System\Kaiojqg.exe
C:\Windows\System\Kaiojqg.exe
2⤵
PID:7428

C:\Windows\System\zBZtjfG.exe
C:\Windows\System\zBZtjfG.exe
2⤵
PID:7452

C:\Windows\System\hEZdxqk.exe
C:\Windows\System\hEZdxqk.exe
2⤵
PID:7480

C:\Windows\System\RnYLjws.exe
C:\Windows\System\RnYLjws.exe
2⤵
PID:7496

C:\Windows\System\mKvCfYh.exe
C:\Windows\System\mKvCfYh.exe
2⤵
PID:7520

C:\Windows\System\ylajcKz.exe
C:\Windows\System\ylajcKz.exe
2⤵
PID:7540

C:\Windows\System\OlGnIcz.exe
C:\Windows\System\OlGnIcz.exe
2⤵
PID:7560

C:\Windows\System\NUJalpQ.exe
C:\Windows\System\NUJalpQ.exe
2⤵
PID:7580

C:\Windows\System\FwgkWBF.exe
C:\Windows\System\FwgkWBF.exe
2⤵
PID:7608

C:\Windows\System\ugIQqgT.exe
C:\Windows\System\ugIQqgT.exe
2⤵
PID:7628

C:\Windows\System\yBmxvAT.exe
C:\Windows\System\yBmxvAT.exe
2⤵
PID:7652

C:\Windows\System\qlRMBxc.exe
C:\Windows\System\qlRMBxc.exe
2⤵
PID:7688

C:\Windows\System\bJAdhvS.exe
C:\Windows\System\bJAdhvS.exe
2⤵
PID:7708

C:\Windows\System\xExvMLQ.exe
C:\Windows\System\xExvMLQ.exe
2⤵
PID:7728

C:\Windows\System\Bnsylup.exe
C:\Windows\System\Bnsylup.exe
2⤵
PID:7752

C:\Windows\System\AFzrYHp.exe
C:\Windows\System\AFzrYHp.exe
2⤵
PID:7776

C:\Windows\System\aWGoaWB.exe
C:\Windows\System\aWGoaWB.exe
2⤵
PID:7796

C:\Windows\System\PNoWLfc.exe
C:\Windows\System\PNoWLfc.exe
2⤵
PID:7820

C:\Windows\System\NUasjZG.exe
C:\Windows\System\NUasjZG.exe
2⤵
PID:7864

C:\Windows\System\GLMKEYb.exe
C:\Windows\System\GLMKEYb.exe
2⤵
PID:7884

C:\Windows\System\WMRPugz.exe
C:\Windows\System\WMRPugz.exe
2⤵
PID:7900

C:\Windows\System\DttiqbI.exe
C:\Windows\System\DttiqbI.exe
2⤵
PID:7920

C:\Windows\System\OcROwCd.exe
C:\Windows\System\OcROwCd.exe
2⤵
PID:7936

C:\Windows\System\YNCJwjg.exe
C:\Windows\System\YNCJwjg.exe
2⤵
PID:7956

C:\Windows\System\KZGtWQW.exe
C:\Windows\System\KZGtWQW.exe
2⤵
PID:7972

C:\Windows\System\iPTimnn.exe
C:\Windows\System\iPTimnn.exe
2⤵
PID:7992

C:\Windows\System\fJXulvO.exe
C:\Windows\System\fJXulvO.exe
2⤵
PID:8008

C:\Windows\System\mgRkqkX.exe
C:\Windows\System\mgRkqkX.exe
2⤵
PID:8024

C:\Windows\System\jlgdDaT.exe
C:\Windows\System\jlgdDaT.exe
2⤵
PID:8040

C:\Windows\System\hJugHTR.exe
C:\Windows\System\hJugHTR.exe
2⤵
PID:8068

C:\Windows\System\MuvBzCY.exe
C:\Windows\System\MuvBzCY.exe
2⤵
PID:8100

C:\Windows\System\sLDlmHa.exe
C:\Windows\System\sLDlmHa.exe
2⤵
PID:8116

C:\Windows\System\xSTgxFm.exe
C:\Windows\System\xSTgxFm.exe
2⤵
PID:8136

C:\Windows\System\pHjTonq.exe
C:\Windows\System\pHjTonq.exe
2⤵
PID:8160

C:\Windows\System\ZOctgeu.exe
C:\Windows\System\ZOctgeu.exe
2⤵
PID:8176

C:\Windows\System\OPvLcSP.exe
C:\Windows\System\OPvLcSP.exe
2⤵
PID:5388

C:\Windows\System\SNuOugD.exe
C:\Windows\System\SNuOugD.exe
2⤵
PID:6624

C:\Windows\System\fqbtHXK.exe
C:\Windows\System\fqbtHXK.exe
2⤵
PID:6708

C:\Windows\System\RnhDXRo.exe
C:\Windows\System\RnhDXRo.exe
2⤵
PID:6792

C:\Windows\System\BNjrZjw.exe
C:\Windows\System\BNjrZjw.exe
2⤵
PID:6832

C:\Windows\System\xafPAFY.exe
C:\Windows\System\xafPAFY.exe
2⤵
PID:6732

C:\Windows\System\UwvKwYl.exe
C:\Windows\System\UwvKwYl.exe
2⤵
PID:7044

C:\Windows\System\WxhrDMP.exe
C:\Windows\System\WxhrDMP.exe
2⤵
PID:7344

C:\Windows\System\EekcpML.exe
C:\Windows\System\EekcpML.exe
2⤵
PID:7392

C:\Windows\System\LsIgSsw.exe
C:\Windows\System\LsIgSsw.exe
2⤵
PID:3576

C:\Windows\System\DmLeClR.exe
C:\Windows\System\DmLeClR.exe
2⤵
PID:7556

C:\Windows\System\diBMgRY.exe
C:\Windows\System\diBMgRY.exe
2⤵
PID:6984

C:\Windows\System\WJmOabF.exe
C:\Windows\System\WJmOabF.exe
2⤵
PID:6368

C:\Windows\System\jdwjncf.exe
C:\Windows\System\jdwjncf.exe
2⤵
PID:7152

C:\Windows\System\IaeNMPA.exe
C:\Windows\System\IaeNMPA.exe
2⤵
PID:7880

C:\Windows\System\YiWqTtl.exe
C:\Windows\System\YiWqTtl.exe
2⤵
PID:5896

C:\Windows\System\wTIljun.exe
C:\Windows\System\wTIljun.exe
2⤵
PID:1440

C:\Windows\System\GueTmHH.exe
C:\Windows\System\GueTmHH.exe
2⤵
PID:7308

C:\Windows\System\gLZMBeK.exe
C:\Windows\System\gLZMBeK.exe
2⤵
PID:8196

C:\Windows\System\YNzRjnI.exe
C:\Windows\System\YNzRjnI.exe
2⤵
PID:8868

C:\Windows\System\wCBfdSF.exe
C:\Windows\System\wCBfdSF.exe
2⤵
PID:8916

C:\Windows\System\iDZHFJA.exe
C:\Windows\System\iDZHFJA.exe
2⤵
PID:8936

C:\Windows\System\xzltaLA.exe
C:\Windows\System\xzltaLA.exe
2⤵
PID:8956

C:\Windows\System\DkYECzb.exe
C:\Windows\System\DkYECzb.exe
2⤵
PID:8980

C:\Windows\System\jpvfyqA.exe
C:\Windows\System\jpvfyqA.exe
2⤵
PID:9008

C:\Windows\System\dCXbWVO.exe
C:\Windows\System\dCXbWVO.exe
2⤵
PID:9028

C:\Windows\System\regCTZV.exe
C:\Windows\System\regCTZV.exe
2⤵
PID:9044

C:\Windows\System\XdXbWNJ.exe
C:\Windows\System\XdXbWNJ.exe
2⤵
PID:9068

C:\Windows\System\NOoNFyC.exe
C:\Windows\System\NOoNFyC.exe
2⤵
PID:9096

C:\Windows\System\YOJLGbu.exe
C:\Windows\System\YOJLGbu.exe
2⤵
PID:9116

C:\Windows\System\KRzYrTe.exe
C:\Windows\System\KRzYrTe.exe
2⤵
PID:9140

C:\Windows\System\SLUbPRn.exe
C:\Windows\System\SLUbPRn.exe
2⤵
PID:9160

C:\Windows\System\hdopFSn.exe
C:\Windows\System\hdopFSn.exe
2⤵
PID:9180

C:\Windows\System\GYeMxjq.exe
C:\Windows\System\GYeMxjq.exe
2⤵
PID:9204

C:\Windows\System\cSPdUFX.exe
C:\Windows\System\cSPdUFX.exe
2⤵
PID:8020

C:\Windows\System\NflcutO.exe
C:\Windows\System\NflcutO.exe
2⤵
PID:8076

C:\Windows\System\pCXfyfR.exe
C:\Windows\System\pCXfyfR.exe
2⤵
PID:8144

C:\Windows\System\ecDOtPi.exe
C:\Windows\System\ecDOtPi.exe
2⤵
PID:7460

C:\Windows\System\lpexjRa.exe
C:\Windows\System\lpexjRa.exe
2⤵
PID:1664

C:\Windows\System\FrDNxhA.exe
C:\Windows\System\FrDNxhA.exe
2⤵
PID:740

C:\Windows\System\vhwVAMC.exe
C:\Windows\System\vhwVAMC.exe
2⤵
PID:6920

C:\Windows\System\LjfzZBi.exe
C:\Windows\System\LjfzZBi.exe
2⤵
PID:6296

C:\Windows\System\bQvNQcx.exe
C:\Windows\System\bQvNQcx.exe
2⤵
PID:5576

C:\Windows\System\KtaNKve.exe
C:\Windows\System\KtaNKve.exe
2⤵
PID:5072

C:\Windows\System\WJmdkHA.exe
C:\Windows\System\WJmdkHA.exe
2⤵
PID:7224

C:\Windows\System\hOBjhJb.exe
C:\Windows\System\hOBjhJb.exe
2⤵
PID:7256

C:\Windows\System\ettehtq.exe
C:\Windows\System\ettehtq.exe
2⤵
PID:7276

C:\Windows\System\JJZvUag.exe
C:\Windows\System\JJZvUag.exe
2⤵
PID:7368

C:\Windows\System\urBcFLC.exe
C:\Windows\System\urBcFLC.exe
2⤵
PID:8232

C:\Windows\System\dubQBEJ.exe
C:\Windows\System\dubQBEJ.exe
2⤵
PID:8260

C:\Windows\System\bfIMJzo.exe
C:\Windows\System\bfIMJzo.exe
2⤵
PID:7440

C:\Windows\System\BSAikLe.exe
C:\Windows\System\BSAikLe.exe
2⤵
PID:7720

C:\Windows\System\ZGZIdxV.exe
C:\Windows\System\ZGZIdxV.exe
2⤵
PID:7764

C:\Windows\System\BUvcZRw.exe
C:\Windows\System\BUvcZRw.exe
2⤵
PID:7804

C:\Windows\System\RXxAboS.exe
C:\Windows\System\RXxAboS.exe
2⤵
PID:8476

C:\Windows\System\gGTdgqE.exe
C:\Windows\System\gGTdgqE.exe
2⤵
PID:8000

C:\Windows\System\XsEsAkH.exe
C:\Windows\System\XsEsAkH.exe
2⤵
PID:8048

C:\Windows\System\rtnrRWd.exe
C:\Windows\System\rtnrRWd.exe
2⤵
PID:8096

C:\Windows\System\pyGjIyO.exe
C:\Windows\System\pyGjIyO.exe
2⤵
PID:8128

C:\Windows\System\DHdehLX.exe
C:\Windows\System\DHdehLX.exe
2⤵
PID:8172

C:\Windows\System\aCgVlWc.exe
C:\Windows\System\aCgVlWc.exe
2⤵
PID:1936

C:\Windows\System\rpydlOp.exe
C:\Windows\System\rpydlOp.exe
2⤵
PID:6812

C:\Windows\System\mTCKbIY.exe
C:\Windows\System\mTCKbIY.exe
2⤵
PID:6592

C:\Windows\System\HukPZqT.exe
C:\Windows\System\HukPZqT.exe
2⤵
PID:4464

C:\Windows\System\JhTgicP.exe
C:\Windows\System\JhTgicP.exe
2⤵
PID:8876

C:\Windows\System\xeENRuQ.exe
C:\Windows\System\xeENRuQ.exe
2⤵
PID:6408

C:\Windows\System\uCYCzbj.exe
C:\Windows\System\uCYCzbj.exe
2⤵
PID:5620

C:\Windows\System\CPmIoFK.exe
C:\Windows\System\CPmIoFK.exe
2⤵
PID:6092

C:\Windows\System\mTyfMnL.exe
C:\Windows\System\mTyfMnL.exe
2⤵
PID:8616

C:\Windows\System\Towlpuh.exe
C:\Windows\System\Towlpuh.exe
2⤵
PID:8312

C:\Windows\System\OrEIFRB.exe
C:\Windows\System\OrEIFRB.exe
2⤵
PID:7064

C:\Windows\System\chtwpdk.exe
C:\Windows\System\chtwpdk.exe
2⤵
PID:8352

C:\Windows\System\nFpybGc.exe
C:\Windows\System\nFpybGc.exe
2⤵
PID:8664

C:\Windows\System\JrttYci.exe
C:\Windows\System\JrttYci.exe
2⤵
PID:8112

C:\Windows\System\sGAdltI.exe
C:\Windows\System\sGAdltI.exe
2⤵
PID:8404

C:\Windows\System\CXMFyXu.exe
C:\Windows\System\CXMFyXu.exe
2⤵
PID:8468

C:\Windows\System\PMRiWDo.exe
C:\Windows\System\PMRiWDo.exe
2⤵
PID:8528

C:\Windows\System\exxtnbv.exe
C:\Windows\System\exxtnbv.exe
2⤵
PID:7736

C:\Windows\System\UryxleR.exe
C:\Windows\System\UryxleR.exe
2⤵
PID:9124

C:\Windows\System\KomQugF.exe
C:\Windows\System\KomQugF.exe
2⤵
PID:9152

C:\Windows\System\lOiSZNj.exe
C:\Windows\System\lOiSZNj.exe
2⤵
PID:8600

C:\Windows\System\YQsyyKu.exe
C:\Windows\System\YQsyyKu.exe
2⤵
PID:6480

C:\Windows\System\QtIxRDX.exe
C:\Windows\System\QtIxRDX.exe
2⤵
PID:7836

C:\Windows\System\JRNFDbR.exe
C:\Windows\System\JRNFDbR.exe
2⤵
PID:9228

C:\Windows\System\GNuGUad.exe
C:\Windows\System\GNuGUad.exe
2⤵
PID:9244

C:\Windows\System\njwHHpG.exe
C:\Windows\System\njwHHpG.exe
2⤵
PID:9260

C:\Windows\System\XRbZLIH.exe
C:\Windows\System\XRbZLIH.exe
2⤵
PID:9276

C:\Windows\System\DYzVVtK.exe
C:\Windows\System\DYzVVtK.exe
2⤵
PID:9296

C:\Windows\System\GLIwHNg.exe
C:\Windows\System\GLIwHNg.exe
2⤵
PID:9352

C:\Windows\System\uGElqLg.exe
C:\Windows\System\uGElqLg.exe
2⤵
PID:9384

C:\Windows\System\mpDWrnq.exe
C:\Windows\System\mpDWrnq.exe
2⤵
PID:9404

C:\Windows\System\OyZKljF.exe
C:\Windows\System\OyZKljF.exe
2⤵
PID:9420

C:\Windows\System\PDkGwhV.exe
C:\Windows\System\PDkGwhV.exe
2⤵
PID:9444

C:\Windows\System\vlAfriT.exe
C:\Windows\System\vlAfriT.exe
2⤵
PID:9468

C:\Windows\System\QhgCoiA.exe
C:\Windows\System\QhgCoiA.exe
2⤵
PID:9500

C:\Windows\System\ZoaUyTb.exe
C:\Windows\System\ZoaUyTb.exe
2⤵
PID:9520

C:\Windows\System\oLFAkdt.exe
C:\Windows\System\oLFAkdt.exe
2⤵
PID:9536

C:\Windows\System\dbYZkNA.exe
C:\Windows\System\dbYZkNA.exe
2⤵
PID:9564

C:\Windows\System\rCqNxRi.exe
C:\Windows\System\rCqNxRi.exe
2⤵
PID:9580

C:\Windows\System\EEtxGPP.exe
C:\Windows\System\EEtxGPP.exe
2⤵
PID:9604

C:\Windows\System\rRbCXFn.exe
C:\Windows\System\rRbCXFn.exe
2⤵
PID:9628

C:\Windows\System\OEXMann.exe
C:\Windows\System\OEXMann.exe
2⤵
PID:9652

C:\Windows\System\iTXAFGC.exe
C:\Windows\System\iTXAFGC.exe
2⤵
PID:9676

C:\Windows\System\ORnrvmG.exe
C:\Windows\System\ORnrvmG.exe
2⤵
PID:9700

C:\Windows\System\TZsXutS.exe
C:\Windows\System\TZsXutS.exe
2⤵
PID:9724

C:\Windows\System\dPhPVEg.exe
C:\Windows\System\dPhPVEg.exe
2⤵
PID:9764

C:\Windows\System\ZubkmXQ.exe
C:\Windows\System\ZubkmXQ.exe
2⤵
PID:10048

C:\Windows\System\mmmcYaS.exe
C:\Windows\System\mmmcYaS.exe
2⤵
PID:10068

C:\Windows\System\eyBqlzo.exe
C:\Windows\System\eyBqlzo.exe
2⤵
PID:10088

C:\Windows\System\tmuvWcD.exe
C:\Windows\System\tmuvWcD.exe
2⤵
PID:10164

C:\Windows\System\fEOtADu.exe
C:\Windows\System\fEOtADu.exe
2⤵
PID:10200

C:\Windows\System\EjqsBrb.exe
C:\Windows\System\EjqsBrb.exe
2⤵
PID:10220

C:\Windows\System\zmDjwIU.exe
C:\Windows\System\zmDjwIU.exe
2⤵
PID:10236

C:\Windows\System\SSgtlPw.exe
C:\Windows\System\SSgtlPw.exe
2⤵
PID:7644

C:\Windows\System\ncvUuVC.exe
C:\Windows\System\ncvUuVC.exe
2⤵
PID:8756

C:\Windows\System\UndTTOK.exe
C:\Windows\System\UndTTOK.exe
2⤵
PID:8812

C:\Windows\System\opMWGGU.exe
C:\Windows\System\opMWGGU.exe
2⤵
PID:4792

C:\Windows\System\jOxAyjt.exe
C:\Windows\System\jOxAyjt.exe
2⤵
PID:8912

C:\Windows\System\nzLZrEB.exe
C:\Windows\System\nzLZrEB.exe
2⤵
PID:8952

C:\Windows\System\AKeDXnb.exe
C:\Windows\System\AKeDXnb.exe
2⤵
PID:9000

C:\Windows\System\PsIZQFu.exe
C:\Windows\System\PsIZQFu.exe
2⤵
PID:9052

C:\Windows\System\pJBkXTt.exe
C:\Windows\System\pJBkXTt.exe
2⤵
PID:9088

C:\Windows\System\ZnkYTbD.exe
C:\Windows\System\ZnkYTbD.exe
2⤵
PID:8036

C:\Windows\System\vncfJZF.exe
C:\Windows\System\vncfJZF.exe
2⤵
PID:8148

C:\Windows\System\zmzQVNT.exe
C:\Windows\System\zmzQVNT.exe
2⤵
PID:5436

C:\Windows\System\OcTrsSE.exe
C:\Windows\System\OcTrsSE.exe
2⤵
PID:6672

C:\Windows\System\QEJXyFA.exe
C:\Windows\System\QEJXyFA.exe
2⤵
PID:3432

C:\Windows\System\XwwWmPe.exe
C:\Windows\System\XwwWmPe.exe
2⤵
PID:7744

C:\Windows\System\pDpNbkz.exe
C:\Windows\System\pDpNbkz.exe
2⤵
PID:7964

C:\Windows\System\SsinMYn.exe
C:\Windows\System\SsinMYn.exe
2⤵
PID:6588

C:\Windows\System\FynDOQb.exe
C:\Windows\System\FynDOQb.exe
2⤵
PID:8336

C:\Windows\System\vGdqvWn.exe
C:\Windows\System\vGdqvWn.exe
2⤵
PID:8424

C:\Windows\System\tYMJDHA.exe
C:\Windows\System\tYMJDHA.exe
2⤵
PID:9692

C:\Windows\System\auHAhtp.exe
C:\Windows\System\auHAhtp.exe
2⤵
PID:7444

C:\Windows\System\igxFXaF.exe
C:\Windows\System\igxFXaF.exe
2⤵
PID:7572

C:\Windows\System\EzFTXSK.exe
C:\Windows\System\EzFTXSK.exe
2⤵
PID:9528

C:\Windows\System\VeockKT.exe
C:\Windows\System\VeockKT.exe
2⤵
PID:3828

C:\Windows\System\IbxkzQa.exe
C:\Windows\System\IbxkzQa.exe
2⤵
PID:9572

C:\Windows\System\UjKEXOP.exe
C:\Windows\System\UjKEXOP.exe
2⤵
PID:9412

C:\Windows\System\SdgPOmw.exe
C:\Windows\System\SdgPOmw.exe
2⤵
PID:392

C:\Windows\System\eYjETPk.exe
C:\Windows\System\eYjETPk.exe
2⤵
PID:9464

C:\Windows\System\ONejFsh.exe
C:\Windows\System\ONejFsh.exe
2⤵
PID:8416

C:\Windows\System\KOwLySW.exe
C:\Windows\System\KOwLySW.exe
2⤵
PID:9600

C:\Windows\System\BThMQuG.exe
C:\Windows\System\BThMQuG.exe
2⤵
PID:9736

C:\Windows\System\yVdPdTD.exe
C:\Windows\System\yVdPdTD.exe
2⤵
PID:9272

C:\Windows\System\kGggSFG.exe
C:\Windows\System\kGggSFG.exe
2⤵
PID:9252

C:\Windows\System\AeILcBP.exe
C:\Windows\System\AeILcBP.exe
2⤵
PID:1572

C:\Windows\System\PoUuYYt.exe
C:\Windows\System\PoUuYYt.exe
2⤵
PID:9868

C:\Windows\System\LQugoqm.exe
C:\Windows\System\LQugoqm.exe
2⤵
PID:9512

C:\Windows\System\bXVPryD.exe
C:\Windows\System\bXVPryD.exe
2⤵
PID:8784

C:\Windows\System\UhAnLYD.exe
C:\Windows\System\UhAnLYD.exe
2⤵
PID:8904

C:\Windows\System\imuAcKV.exe
C:\Windows\System\imuAcKV.exe
2⤵
PID:9624

C:\Windows\System\kgfVGZK.exe
C:\Windows\System\kgfVGZK.exe
2⤵
PID:10244

C:\Windows\System\xIzhLRC.exe
C:\Windows\System\xIzhLRC.exe
2⤵
PID:10260

C:\Windows\System\YrEvwjV.exe
C:\Windows\System\YrEvwjV.exe
2⤵
PID:10276

C:\Windows\System\xCZGqCh.exe
C:\Windows\System\xCZGqCh.exe
2⤵
PID:10296

C:\Windows\System\eGfWMfg.exe
C:\Windows\System\eGfWMfg.exe
2⤵
PID:10312

C:\Windows\System\NHpLnOr.exe
C:\Windows\System\NHpLnOr.exe
2⤵
PID:10336

C:\Windows\System\QMAjhRq.exe
C:\Windows\System\QMAjhRq.exe
2⤵
PID:10356

C:\Windows\System\mibvRyd.exe
C:\Windows\System\mibvRyd.exe
2⤵
PID:10384

C:\Windows\System\wRXbCVW.exe
C:\Windows\System\wRXbCVW.exe
2⤵
PID:10408

C:\Windows\System\BZRMXDL.exe
C:\Windows\System\BZRMXDL.exe
2⤵
PID:10432

C:\Windows\System\XqtJRjU.exe
C:\Windows\System\XqtJRjU.exe
2⤵
PID:10452

C:\Windows\System\rZzfIbz.exe
C:\Windows\System\rZzfIbz.exe
2⤵
PID:10468

C:\Windows\System\LLnMlKz.exe
C:\Windows\System\LLnMlKz.exe
2⤵
PID:10492

C:\Windows\System\bUMnZcD.exe
C:\Windows\System\bUMnZcD.exe
2⤵
PID:10520

C:\Windows\System\tvuKufr.exe
C:\Windows\System\tvuKufr.exe
2⤵
PID:10540

C:\Windows\System\aKDItnB.exe
C:\Windows\System\aKDItnB.exe
2⤵
PID:10560

C:\Windows\System\ksFaqUR.exe
C:\Windows\System\ksFaqUR.exe
2⤵
PID:10580

C:\Windows\System\iMrqNSC.exe
C:\Windows\System\iMrqNSC.exe
2⤵
PID:10608

C:\Windows\System\oITwXvH.exe
C:\Windows\System\oITwXvH.exe
2⤵
PID:10628

C:\Windows\System\eDngFLt.exe
C:\Windows\System\eDngFLt.exe
2⤵
PID:10652

C:\Windows\System\IKXlpLB.exe
C:\Windows\System\IKXlpLB.exe
2⤵
PID:10676

C:\Windows\System\tOcklaf.exe
C:\Windows\System\tOcklaf.exe
2⤵
PID:10696

C:\Windows\System\eHuPvzm.exe
C:\Windows\System\eHuPvzm.exe
2⤵
PID:10716

C:\Windows\System\dXDwVDC.exe
C:\Windows\System\dXDwVDC.exe
2⤵
PID:10736

C:\Windows\System\MkvCdiU.exe
C:\Windows\System\MkvCdiU.exe
2⤵
PID:10760

C:\Windows\System\hcwQxqB.exe
C:\Windows\System\hcwQxqB.exe
2⤵
PID:10776

C:\Windows\System\rxTQKYU.exe
C:\Windows\System\rxTQKYU.exe
2⤵
PID:10800

C:\Windows\System\YsrYPmh.exe
C:\Windows\System\YsrYPmh.exe
2⤵
PID:10820

C:\Windows\System\aSlnIQo.exe
C:\Windows\System\aSlnIQo.exe
2⤵
PID:10836

C:\Windows\System\ecpICnq.exe
C:\Windows\System\ecpICnq.exe
2⤵
PID:10860

C:\Windows\System\XtgloLZ.exe
C:\Windows\System\XtgloLZ.exe
2⤵
PID:10880

C:\Windows\System\aqssGxg.exe
C:\Windows\System\aqssGxg.exe
2⤵
PID:10896

C:\Windows\System\YYxzyow.exe
C:\Windows\System\YYxzyow.exe
2⤵
PID:10912

C:\Windows\System\BgifZje.exe
C:\Windows\System\BgifZje.exe
2⤵
PID:10928

C:\Windows\System\mTncQGO.exe
C:\Windows\System\mTncQGO.exe
2⤵
PID:10952

C:\Windows\System\CXwtwpS.exe
C:\Windows\System\CXwtwpS.exe
2⤵
PID:10980

C:\Windows\System\eLedVMo.exe
C:\Windows\System\eLedVMo.exe
2⤵
PID:11000

C:\Windows\System\VuUqMzC.exe
C:\Windows\System\VuUqMzC.exe
2⤵
PID:11024

C:\Windows\System\hgnbdyV.exe
C:\Windows\System\hgnbdyV.exe
2⤵
PID:11044

C:\Windows\System\uXLNube.exe
C:\Windows\System\uXLNube.exe
2⤵
PID:11068

C:\Windows\System\pJwuNFC.exe
C:\Windows\System\pJwuNFC.exe
2⤵
PID:11084

C:\Windows\System\qcqzbiX.exe
C:\Windows\System\qcqzbiX.exe
2⤵
PID:11104

C:\Windows\System\sqflrmb.exe
C:\Windows\System\sqflrmb.exe
2⤵
PID:11120

C:\Windows\System\xVZJcFf.exe
C:\Windows\System\xVZJcFf.exe
2⤵
PID:11148

C:\Windows\System\zeJjnGz.exe
C:\Windows\System\zeJjnGz.exe
2⤵
PID:11168

C:\Windows\System\dATXfBA.exe
C:\Windows\System\dATXfBA.exe
2⤵
PID:11192

C:\Windows\System\AbAQsCz.exe
C:\Windows\System\AbAQsCz.exe
2⤵
PID:11232

C:\Windows\System\LqcVhaC.exe
C:\Windows\System\LqcVhaC.exe
2⤵
PID:11248

C:\Windows\System\AYXfPci.exe
C:\Windows\System\AYXfPci.exe
2⤵
PID:4712

C:\Windows\System\GRoyZsf.exe
C:\Windows\System\GRoyZsf.exe
2⤵
PID:7100

C:\Windows\System\UjtMqta.exe
C:\Windows\System\UjtMqta.exe
2⤵
PID:8368

C:\Windows\System\zmuBjvR.exe
C:\Windows\System\zmuBjvR.exe
2⤵
PID:9716

C:\Windows\System\YytBQKm.exe
C:\Windows\System\YytBQKm.exe
2⤵
PID:6780

C:\Windows\System\hwJmxKC.exe
C:\Windows\System\hwJmxKC.exe
2⤵
PID:10012

C:\Windows\System\uftwfwC.exe
C:\Windows\System\uftwfwC.exe
2⤵
PID:10528

C:\Windows\System\jAQzjsU.exe
C:\Windows\System\jAQzjsU.exe
2⤵
PID:2236

C:\Windows\System\fcdNTCl.exe
C:\Windows\System\fcdNTCl.exe
2⤵
PID:10832

C:\Windows\System\CzjQeAO.exe
C:\Windows\System\CzjQeAO.exe
2⤵
PID:9452

C:\Windows\System\YThWImu.exe
C:\Windows\System\YThWImu.exe
2⤵
PID:9544

C:\Windows\System\gvEAQvc.exe
C:\Windows\System\gvEAQvc.exe
2⤵
PID:10320

C:\Windows\System\aqBMHdt.exe
C:\Windows\System\aqBMHdt.exe
2⤵
PID:10304

C:\Windows\System\cbrTmFr.exe
C:\Windows\System\cbrTmFr.exe
2⤵
PID:10416

C:\Windows\System\XaBMcHE.exe
C:\Windows\System\XaBMcHE.exe
2⤵
PID:8620

C:\Windows\System\nSPGffK.exe
C:\Windows\System\nSPGffK.exe
2⤵
PID:10592

C:\Windows\System\DSXnrvg.exe
C:\Windows\System\DSXnrvg.exe
2⤵
PID:8508

C:\Windows\System\mbOgfTp.exe
C:\Windows\System\mbOgfTp.exe
2⤵
PID:8700

C:\Windows\System\ilpwoVU.exe
C:\Windows\System\ilpwoVU.exe
2⤵
PID:2464

C:\Windows\System\RyBKqmT.exe
C:\Windows\System\RyBKqmT.exe
2⤵
PID:9924

C:\Windows\System\MmBJoSB.exe
C:\Windows\System\MmBJoSB.exe
2⤵
PID:11272

C:\Windows\System\gWrsksn.exe
C:\Windows\System\gWrsksn.exe
2⤵
PID:11296

C:\Windows\System\pAgftIJ.exe
C:\Windows\System\pAgftIJ.exe
2⤵
PID:11316

C:\Windows\System\GebtDQv.exe
C:\Windows\System\GebtDQv.exe
2⤵
PID:11332

C:\Windows\System\gDyDecy.exe
C:\Windows\System\gDyDecy.exe
2⤵
PID:11368

C:\Windows\System\srVaaAX.exe
C:\Windows\System\srVaaAX.exe
2⤵
PID:11404

C:\Windows\System\aixNbKR.exe
C:\Windows\System\aixNbKR.exe
2⤵
PID:11428

C:\Windows\System\PGNKUxb.exe
C:\Windows\System\PGNKUxb.exe
2⤵
PID:11452

C:\Windows\System\RduFOPQ.exe
C:\Windows\System\RduFOPQ.exe
2⤵
PID:11468

C:\Windows\System\QkuHWEO.exe
C:\Windows\System\QkuHWEO.exe
2⤵
PID:11484

C:\Windows\System\rgZXEgh.exe
C:\Windows\System\rgZXEgh.exe
2⤵
PID:11500

C:\Windows\System\vQlTTvJ.exe
C:\Windows\System\vQlTTvJ.exe
2⤵
PID:11520

C:\Windows\System\NoTdrUz.exe
C:\Windows\System\NoTdrUz.exe
2⤵
PID:11536

C:\Windows\System\ESLvBHm.exe
C:\Windows\System\ESLvBHm.exe
2⤵
PID:11552

C:\Windows\System\GetUZpM.exe
C:\Windows\System\GetUZpM.exe
2⤵
PID:11568

C:\Windows\System\DMxZsdr.exe
C:\Windows\System\DMxZsdr.exe
2⤵
PID:11588

C:\Windows\System\NykUiWr.exe
C:\Windows\System\NykUiWr.exe
2⤵
PID:11604

C:\Windows\System\URDBqZa.exe
C:\Windows\System\URDBqZa.exe
2⤵
PID:11620

C:\Windows\System\DRlbWgo.exe
C:\Windows\System\DRlbWgo.exe
2⤵
PID:11636

C:\Windows\System\shHTuHL.exe
C:\Windows\System\shHTuHL.exe
2⤵
PID:11652

C:\Windows\System\FDHuMSF.exe
C:\Windows\System\FDHuMSF.exe
2⤵
PID:11668

C:\Windows\System\mXjNdwO.exe
C:\Windows\System\mXjNdwO.exe
2⤵
PID:11688

C:\Windows\System\LOpkvVx.exe
C:\Windows\System\LOpkvVx.exe
2⤵
PID:11712

C:\Windows\System\bFpiOQw.exe
C:\Windows\System\bFpiOQw.exe
2⤵
PID:11740

C:\Windows\System\yoSWRAN.exe
C:\Windows\System\yoSWRAN.exe
2⤵
PID:11768

C:\Windows\System\JdBxfhV.exe
C:\Windows\System\JdBxfhV.exe
2⤵
PID:11792

C:\Windows\System\UVHzUTj.exe
C:\Windows\System\UVHzUTj.exe
2⤵
PID:11820

C:\Windows\System\mVBvhWF.exe
C:\Windows\System\mVBvhWF.exe
2⤵
PID:11840

C:\Windows\System\BXARWZB.exe
C:\Windows\System\BXARWZB.exe
2⤵
PID:11864

C:\Windows\System\jcyNDeU.exe
C:\Windows\System\jcyNDeU.exe
2⤵
PID:11892

C:\Windows\System\ujTyDjQ.exe
C:\Windows\System\ujTyDjQ.exe
2⤵
PID:11912

C:\Windows\System\CnVYUSq.exe
C:\Windows\System\CnVYUSq.exe
2⤵
PID:11932

C:\Windows\System\WWUNAid.exe
C:\Windows\System\WWUNAid.exe
2⤵
PID:11960

C:\Windows\System\zNyRjFW.exe
C:\Windows\System\zNyRjFW.exe
2⤵
PID:11992

C:\Windows\System\cljSovj.exe
C:\Windows\System\cljSovj.exe
2⤵
PID:12012

C:\Windows\System\GgcSjHs.exe
C:\Windows\System\GgcSjHs.exe
2⤵
PID:12052

C:\Windows\System\xazRiJk.exe
C:\Windows\System\xazRiJk.exe
2⤵
PID:12076

C:\Windows\System\TWOfaDD.exe
C:\Windows\System\TWOfaDD.exe
2⤵
PID:12104

C:\Windows\System\ASMcenR.exe
C:\Windows\System\ASMcenR.exe
2⤵
PID:12132

C:\Windows\System\aXCIwVr.exe
C:\Windows\System\aXCIwVr.exe
2⤵
PID:12152

C:\Windows\System\uhWTuBC.exe
C:\Windows\System\uhWTuBC.exe
2⤵
PID:12168

C:\Windows\System\sNTjIXP.exe
C:\Windows\System\sNTjIXP.exe
2⤵
PID:12192

C:\Windows\System\xzzGmXa.exe
C:\Windows\System\xzzGmXa.exe
2⤵
PID:12220

C:\Windows\System\TXKyHmG.exe
C:\Windows\System\TXKyHmG.exe
2⤵
PID:12248

C:\Windows\System\TZsnfXQ.exe
C:\Windows\System\TZsnfXQ.exe
2⤵
PID:12264

C:\Windows\System\pUpfDUC.exe
C:\Windows\System\pUpfDUC.exe
2⤵
PID:10848

C:\Windows\System\NPOBYuz.exe
C:\Windows\System\NPOBYuz.exe
2⤵
PID:8932

C:\Windows\System\DOEgnio.exe
C:\Windows\System\DOEgnio.exe
2⤵
PID:10256

C:\Windows\System\TGuZwxo.exe
C:\Windows\System\TGuZwxo.exe
2⤵
PID:10968

C:\Windows\System\tzQFbiL.exe
C:\Windows\System\tzQFbiL.exe
2⤵
PID:9980

C:\Windows\System\VZenIrS.exe
C:\Windows\System\VZenIrS.exe
2⤵
PID:10500

C:\Windows\System\vmNpGyY.exe
C:\Windows\System\vmNpGyY.exe
2⤵
PID:10552

C:\Windows\System\gayTXyL.exe
C:\Windows\System\gayTXyL.exe
2⤵
PID:10616

C:\Windows\System\OhWPiCR.exe
C:\Windows\System\OhWPiCR.exe
2⤵
PID:10664

C:\Windows\System\VvDIrbE.exe
C:\Windows\System\VvDIrbE.exe
2⤵
PID:8304

C:\Windows\System\NZqaCIO.exe
C:\Windows\System\NZqaCIO.exe
2⤵
PID:10156

C:\Windows\System\yNvyHLk.exe
C:\Windows\System\yNvyHLk.exe
2⤵
PID:10732

C:\Windows\System\ueWpPhS.exe
C:\Windows\System\ueWpPhS.exe
2⤵
PID:10752

C:\Windows\System\MgcAhye.exe
C:\Windows\System\MgcAhye.exe
2⤵
PID:10812

C:\Windows\System\ODoiigc.exe
C:\Windows\System\ODoiigc.exe
2⤵
PID:9808

C:\Windows\System\evMyHPs.exe
C:\Windows\System\evMyHPs.exe
2⤵
PID:12296

C:\Windows\System\VgHBrge.exe
C:\Windows\System\VgHBrge.exe
2⤵
PID:12316

C:\Windows\System\pHgWOou.exe
C:\Windows\System\pHgWOou.exe
2⤵
PID:12332

C:\Windows\System\RafPzdd.exe
C:\Windows\System\RafPzdd.exe
2⤵
PID:12348

C:\Windows\System\gUviboj.exe
C:\Windows\System\gUviboj.exe
2⤵
PID:12364

C:\Windows\System\XnmWYDt.exe
C:\Windows\System\XnmWYDt.exe
2⤵
PID:12380

C:\Windows\System\VKGtHiS.exe
C:\Windows\System\VKGtHiS.exe
2⤵
PID:12396

C:\Windows\System\TsqBCFf.exe
C:\Windows\System\TsqBCFf.exe
2⤵
PID:12412

C:\Windows\System\AYbvbEm.exe
C:\Windows\System\AYbvbEm.exe
2⤵
PID:12428

C:\Windows\System\IgJKZdc.exe
C:\Windows\System\IgJKZdc.exe
2⤵
PID:12452

C:\Windows\System\dObijbt.exe
C:\Windows\System\dObijbt.exe
2⤵
PID:12472

C:\Windows\System\WqttvwW.exe
C:\Windows\System\WqttvwW.exe
2⤵
PID:12492

C:\Windows\System\BaMwkvh.exe
C:\Windows\System\BaMwkvh.exe
2⤵
PID:12520

C:\Windows\System\pXCIJNY.exe
C:\Windows\System\pXCIJNY.exe
2⤵
PID:12544

C:\Windows\System\GwIyOgw.exe
C:\Windows\System\GwIyOgw.exe
2⤵
PID:12568

C:\Windows\System\HbmRVLG.exe
C:\Windows\System\HbmRVLG.exe
2⤵
PID:12588

C:\Windows\System\KWqdzuB.exe
C:\Windows\System\KWqdzuB.exe
2⤵
PID:12608

C:\Windows\System\ETuINCe.exe
C:\Windows\System\ETuINCe.exe
2⤵
PID:13136

C:\Windows\System\ExZFsnP.exe
C:\Windows\System\ExZFsnP.exe
2⤵
PID:13156

C:\Windows\System\yFTlosy.exe
C:\Windows\System\yFTlosy.exe
2⤵
PID:13172

C:\Windows\System\natmyNf.exe
C:\Windows\System\natmyNf.exe
2⤵
PID:13188

C:\Windows\System\vKQsEEW.exe
C:\Windows\System\vKQsEEW.exe
2⤵
PID:13204

C:\Windows\System\hmkzqxl.exe
C:\Windows\System\hmkzqxl.exe
2⤵
PID:13224

C:\Windows\System\tLxAkLL.exe
C:\Windows\System\tLxAkLL.exe
2⤵
PID:13268

C:\Windows\System\eaiBEZe.exe
C:\Windows\System\eaiBEZe.exe
2⤵
PID:13284

C:\Windows\System\tTHIrrm.exe
C:\Windows\System\tTHIrrm.exe
2⤵
PID:13308

C:\Windows\System\tKJacSa.exe
C:\Windows\System\tKJacSa.exe
2⤵
PID:11312

C:\Windows\System\xzoDNGB.exe
C:\Windows\System\xzoDNGB.exe
2⤵
PID:11376

C:\Windows\System\zVhURwl.exe
C:\Windows\System\zVhURwl.exe
2⤵
PID:11444

C:\Windows\System\PRqIzpH.exe
C:\Windows\System\PRqIzpH.exe
2⤵
PID:11496

C:\Windows\System\LNVfhbZ.exe
C:\Windows\System\LNVfhbZ.exe
2⤵
PID:11776

C:\Windows\System\zTJNqfe.exe
C:\Windows\System\zTJNqfe.exe
2⤵
PID:11040

C:\Windows\System\AeRYanE.exe
C:\Windows\System\AeRYanE.exe
2⤵
PID:11076

C:\Windows\System\LFIbgPu.exe
C:\Windows\System\LFIbgPu.exe
2⤵
PID:11128

C:\Windows\System\SVvFCio.exe
C:\Windows\System\SVvFCio.exe
2⤵
PID:11220

C:\Windows\System\yZafCoG.exe
C:\Windows\System\yZafCoG.exe
2⤵
PID:3052

C:\Windows\System\reGLSvp.exe
C:\Windows\System\reGLSvp.exe
2⤵
PID:10588

C:\Windows\System\eiLuDwX.exe
C:\Windows\System\eiLuDwX.exe
2⤵
PID:10712

C:\Windows\System\FZhYmOY.exe
C:\Windows\System\FZhYmOY.exe
2⤵
PID:11952

C:\Windows\System\MrAdLzD.exe
C:\Windows\System\MrAdLzD.exe
2⤵
PID:7272

C:\Windows\System\DsQsRcR.exe
C:\Windows\System\DsQsRcR.exe
2⤵
PID:9368

C:\Windows\System\TMJwvoo.exe
C:\Windows\System\TMJwvoo.exe
2⤵
PID:11516

C:\Windows\System\QcqMRsI.exe
C:\Windows\System\QcqMRsI.exe
2⤵
PID:5032

C:\Windows\System\sSYXLcT.exe
C:\Windows\System\sSYXLcT.exe
2⤵
PID:12848

C:\Windows\System\hQngCrn.exe
C:\Windows\System\hQngCrn.exe
2⤵
PID:13016

C:\Windows\System\GscslXm.exe
C:\Windows\System\GscslXm.exe
2⤵
PID:12324

C:\Windows\System\pZrAkAX.exe
C:\Windows\System\pZrAkAX.exe
2⤵
PID:13212

C:\Windows\System\FrYGcwj.exe
C:\Windows\System\FrYGcwj.exe
2⤵
PID:12672

C:\Windows\System\MIfJPCI.exe
C:\Windows\System\MIfJPCI.exe
2⤵
PID:12920

C:\Windows\System\DoIppDJ.exe
C:\Windows\System\DoIppDJ.exe
2⤵
PID:11184

C:\Windows\System\vqmPNHf.exe
C:\Windows\System\vqmPNHf.exe
2⤵
PID:13076

C:\Windows\System\cpzbJcg.exe
C:\Windows\System\cpzbJcg.exe
2⤵
PID:11384

C:\Windows\System\ehHDMxj.exe
C:\Windows\System\ehHDMxj.exe
2⤵
PID:12704

C:\Windows\System\orytxWX.exe
C:\Windows\System\orytxWX.exe
2⤵
PID:11480

C:\Windows\System\fSqkqkJ.exe
C:\Windows\System\fSqkqkJ.exe
2⤵
PID:10944

C:\Windows\System\WWfuhuQ.exe
C:\Windows\System\WWfuhuQ.exe
2⤵
PID:10624

C:\Windows\System\dYWoIuz.exe
C:\Windows\System\dYWoIuz.exe
2⤵
PID:12484

C:\Windows\System\UYEEwkI.exe
C:\Windows\System\UYEEwkI.exe
2⤵
PID:10364

C:\Windows\System\uaukrZN.exe
C:\Windows\System\uaukrZN.exe
2⤵
PID:12752

C:\Windows\System\OqCmEgJ.exe
C:\Windows\System\OqCmEgJ.exe
2⤵
PID:4776

C:\Windows\System\KnUyhkp.exe
C:\Windows\System\KnUyhkp.exe
2⤵
PID:11684

C:\Windows\System\taUzlEH.exe
C:\Windows\System\taUzlEH.exe
2⤵
PID:12204

C:\Windows\System\dCrkgUD.exe
C:\Windows\System\dCrkgUD.exe
2⤵
PID:12068

C:\Windows\System\SMlWPzg.exe
C:\Windows\System\SMlWPzg.exe
2⤵
PID:13040

C:\Windows\System\GHsRcAy.exe
C:\Windows\System\GHsRcAy.exe
2⤵
PID:11348

C:\Windows\System\EWcfLcL.exe
C:\Windows\System\EWcfLcL.exe
2⤵
PID:10440

C:\Windows\System\JkOaeho.exe
C:\Windows\System\JkOaeho.exe
2⤵
PID:12340

C:\Windows\System\YQUseNp.exe
C:\Windows\System\YQUseNp.exe
2⤵
PID:11424

C:\Windows\System\RHEJbXk.exe
C:\Windows\System\RHEJbXk.exe
2⤵
PID:1624

C:\Windows\System\DwypgcZ.exe
C:\Windows\System\DwypgcZ.exe
2⤵
PID:9672

C:\Windows\System\uyegieG.exe
C:\Windows\System\uyegieG.exe
2⤵
PID:12440

C:\Windows\System\eKbNSoF.exe
C:\Windows\System\eKbNSoF.exe
2⤵
PID:11628

C:\Windows\System\wCZOMbW.exe
C:\Windows\System\wCZOMbW.exe
2⤵
PID:11260

C:\Windows\System\idFUrVI.exe
C:\Windows\System\idFUrVI.exe
2⤵
PID:4916

C:\Windows\System\HYDiqMB.exe
C:\Windows\System\HYDiqMB.exe
2⤵
PID:12500

C:\Windows\System\xPcrsNA.exe
C:\Windows\System\xPcrsNA.exe
2⤵
PID:13180

C:\Windows\System\IKWYDjX.exe
C:\Windows\System\IKWYDjX.exe
2⤵
PID:8716

C:\Windows\System\SUXHAIv.exe
C:\Windows\System\SUXHAIv.exe
2⤵
PID:12536

C:\Windows\System\UOfNMHX.exe
C:\Windows\System\UOfNMHX.exe
2⤵
PID:11268

C:\Windows\System\igJVwKr.exe
C:\Windows\System\igJVwKr.exe
2⤵
PID:11660

C:\Windows\System\KgFPOlo.exe
C:\Windows\System\KgFPOlo.exe
2⤵
PID:11748

C:\Windows\System\fhXucjU.exe
C:\Windows\System\fhXucjU.exe
2⤵
PID:12836

C:\Windows\System\LZfmigT.exe
C:\Windows\System\LZfmigT.exe
2⤵
PID:1760

C:\Windows\System\MsJSdwo.exe
C:\Windows\System\MsJSdwo.exe
2⤵
PID:12632

C:\Windows\System\JkWvrfg.exe
C:\Windows\System\JkWvrfg.exe
2⤵
PID:4872

C:\Windows\System\qhtKrZy.exe
C:\Windows\System\qhtKrZy.exe
2⤵
PID:12700

C:\Windows\System\sLTpXEl.exe
C:\Windows\System\sLTpXEl.exe
2⤵
PID:10036

C:\Windows\System\FskjwcL.exe
C:\Windows\System\FskjwcL.exe
2⤵
PID:3696

C:\Windows\System\iIxVBtT.exe
C:\Windows\System\iIxVBtT.exe
2⤵
PID:10888

C:\Windows\System\hXlJeJZ.exe
C:\Windows\System\hXlJeJZ.exe
2⤵
PID:3192

C:\Windows\System\oJPUrDn.exe
C:\Windows\System\oJPUrDn.exe
2⤵
PID:3204

C:\Windows\System\YLhCAxD.exe
C:\Windows\System\YLhCAxD.exe
2⤵
PID:11460

C:\Windows\System\WwUcsap.exe
C:\Windows\System\WwUcsap.exe
2⤵
PID:4732

C:\Windows\System\EIxlIqf.exe
C:\Windows\System\EIxlIqf.exe
2⤵
PID:8724

C:\Windows\System\xxAjtnS.exe
C:\Windows\System\xxAjtnS.exe
2⤵
PID:12896

C:\Windows\System\SZIpWIY.exe
C:\Windows\System\SZIpWIY.exe
2⤵
PID:12604

C:\Windows\System\DfAMPsg.exe
C:\Windows\System\DfAMPsg.exe
2⤵
PID:4176

C:\Windows\System\SwaZFGe.exe
C:\Windows\System\SwaZFGe.exe
2⤵
PID:3236

C:\Windows\System\XaLZDFd.exe
C:\Windows\System\XaLZDFd.exe
2⤵
PID:12788

C:\Windows\System\KUTuFkf.exe
C:\Windows\System\KUTuFkf.exe
2⤵
PID:32

C:\Windows\System\RxGHekB.exe
C:\Windows\System\RxGHekB.exe
2⤵
PID:856

C:\Windows\System\NDdTXdM.exe
C:\Windows\System\NDdTXdM.exe
2⤵
PID:3180

C:\Windows\System\HKRHrcw.exe
C:\Windows\System\HKRHrcw.exe
2⤵
PID:3672

C:\Windows\System\AdnTTaF.exe
C:\Windows\System\AdnTTaF.exe
2⤵
PID:4704

C:\Windows\System\YQGfcsL.exe
C:\Windows\System\YQGfcsL.exe
2⤵
PID:12404

C:\Windows\System\oytBIuJ.exe
C:\Windows\System\oytBIuJ.exe
2⤵
PID:11324

C:\Windows\System\RIWhZcu.exe
C:\Windows\System\RIWhZcu.exe
2⤵
PID:3788

C:\Windows\System\pZdetkB.exe
C:\Windows\System\pZdetkB.exe
2⤵
PID:3972

C:\Windows\System\uxZwxZp.exe
C:\Windows\System\uxZwxZp.exe
2⤵
PID:1096

C:\Windows\System\bwdendd.exe
C:\Windows\System\bwdendd.exe
2⤵
PID:4648

C:\Windows\System\vGGthpF.exe
C:\Windows\System\vGGthpF.exe
2⤵
PID:3448

C:\Windows\System\yGmlMit.exe
C:\Windows\System\yGmlMit.exe
2⤵
PID:3188

C:\Windows\System\sktlDCB.exe
C:\Windows\System\sktlDCB.exe
2⤵
PID:4480

C:\Windows\System\GQPWmnA.exe
C:\Windows\System\GQPWmnA.exe
2⤵
PID:3304

C:\Windows\System\OwKGPxo.exe
C:\Windows\System\OwKGPxo.exe
2⤵
PID:10444

C:\Windows\System\ZquoaXi.exe
C:\Windows\System\ZquoaXi.exe
2⤵
PID:744

C:\Windows\System\wvPOLgC.exe
C:\Windows\System\wvPOLgC.exe
2⤵
PID:11100

C:\Windows\System\FkUaHRm.exe
C:\Windows\System\FkUaHRm.exe
2⤵
PID:12784

C:\Windows\System\UttJXRi.exe
C:\Windows\System\UttJXRi.exe
2⤵
PID:1960

C:\Windows\System\ClqFjKN.exe
C:\Windows\System\ClqFjKN.exe
2⤵
PID:11060

C:\Windows\System\hwhCKMy.exe
C:\Windows\System\hwhCKMy.exe
2⤵
PID:12916

C:\Windows\System\TEyyyti.exe
C:\Windows\System\TEyyyti.exe
2⤵
PID:1284

C:\Windows\System\DiCpWto.exe
C:\Windows\System\DiCpWto.exe
2⤵
PID:9416

C:\Windows\System\HseWpGH.exe
C:\Windows\System\HseWpGH.exe
2⤵
PID:13236

C:\Windows\System\wBTQQvj.exe
C:\Windows\System\wBTQQvj.exe
2⤵
PID:2744

C:\Windows\System\EupTAEn.exe
C:\Windows\System\EupTAEn.exe
2⤵
PID:3444

C:\Windows\System\ZrXCnYE.exe
C:\Windows\System\ZrXCnYE.exe
2⤵
PID:4356

C:\Windows\System\szZgIFY.exe
C:\Windows\System\szZgIFY.exe
2⤵
PID:12956

C:\Windows\System\PnnKnDR.exe
C:\Windows\System\PnnKnDR.exe
2⤵
PID:4672

C:\Windows\System\iNyXCmx.exe
C:\Windows\System\iNyXCmx.exe
2⤵
PID:1040

C:\Windows\System\oHkWTZP.exe
C:\Windows\System\oHkWTZP.exe
2⤵
PID:4156

C:\Windows\System\ZpZupIm.exe
C:\Windows\System\ZpZupIm.exe
2⤵
PID:11564

C:\Windows\System\XiVbwWq.exe
C:\Windows\System\XiVbwWq.exe
2⤵
PID:11760

C:\Windows\System\dKVtwIg.exe
C:\Windows\System\dKVtwIg.exe
2⤵
PID:2040

C:\Windows\System\NfeKKhk.exe
C:\Windows\System\NfeKKhk.exe
2⤵
PID:60

C:\Windows\System\VdJUdKX.exe
C:\Windows\System\VdJUdKX.exe
2⤵
PID:4128

C:\Windows\System\bZyATOx.exe
C:\Windows\System\bZyATOx.exe
2⤵
PID:3840

C:\Windows\System\TLkGZEl.exe
C:\Windows\System\TLkGZEl.exe
2⤵
PID:11736

C:\Windows\System\TyMMUcX.exe
C:\Windows\System\TyMMUcX.exe
2⤵
PID:4616

C:\Windows\System\yrXgdTn.exe
C:\Windows\System\yrXgdTn.exe
2⤵
PID:1860

C:\Windows\System\gVsxLmB.exe
C:\Windows\System\gVsxLmB.exe
2⤵
PID:6500

C:\Windows\System\tYEKfxk.exe
C:\Windows\System\tYEKfxk.exe
2⤵
PID:12924

C:\Windows\System\jciSCoc.exe
C:\Windows\System\jciSCoc.exe
2⤵
PID:2856

C:\Windows\System\oMXUVzX.exe
C:\Windows\System\oMXUVzX.exe
2⤵
PID:5004

C:\Windows\System\KGSeLuq.exe
C:\Windows\System\KGSeLuq.exe
2⤵
PID:4864

C:\Windows\System\WevImfz.exe
C:\Windows\System\WevImfz.exe
2⤵
PID:4636

C:\Windows\System\HLKQFGO.exe
C:\Windows\System\HLKQFGO.exe
2⤵
PID:2000

C:\Windows\System\nbUpVbJ.exe
C:\Windows\System\nbUpVbJ.exe
2⤵
PID:984

C:\Windows\System\zBNuePR.exe
C:\Windows\System\zBNuePR.exe
2⤵
PID:11616

C:\Windows\System\SxOTepn.exe
C:\Windows\System\SxOTepn.exe
2⤵
PID:12512

C:\Windows\System\gZRRPXP.exe
C:\Windows\System\gZRRPXP.exe
2⤵
PID:2428

C:\Windows\System\YxHduiB.exe
C:\Windows\System\YxHduiB.exe
2⤵
PID:4296

C:\Windows\System\OWNXTyA.exe
C:\Windows\System\OWNXTyA.exe
2⤵
PID:5136

C:\Windows\System\MyIhJPL.exe
C:\Windows\System\MyIhJPL.exe
2⤵
PID:3908

C:\Windows\System\bpGRKIP.exe
C:\Windows\System\bpGRKIP.exe
2⤵
PID:5252

C:\Windows\System\fevZOcS.exe
C:\Windows\System\fevZOcS.exe
2⤵
PID:5284

C:\Windows\System\LhOGQFl.exe
C:\Windows\System\LhOGQFl.exe
2⤵
PID:5144

C:\Windows\System\qhpFswJ.exe
C:\Windows\System\qhpFswJ.exe
2⤵
PID:712

C:\Windows\System\hpFzlZI.exe
C:\Windows\System\hpFzlZI.exe
2⤵
PID:4956

C:\Windows\System\FflorZM.exe
C:\Windows\System\FflorZM.exe
2⤵
PID:1688

C:\Windows\System\OTDtJcP.exe
C:\Windows\System\OTDtJcP.exe
2⤵
PID:5068

C:\Windows\System\LCJhYFW.exe
C:\Windows\System\LCJhYFW.exe
2⤵
PID:2912

C:\Windows\System\xNjQATm.exe
C:\Windows\System\xNjQATm.exe
2⤵
PID:3816

C:\Windows\System\avAMfof.exe
C:\Windows\System\avAMfof.exe
2⤵
PID:64

C:\Windows\System\QwQMUBX.exe
C:\Windows\System\QwQMUBX.exe
2⤵
PID:5412

C:\Windows\System\iTiUMcT.exe
C:\Windows\System\iTiUMcT.exe
2⤵
PID:5176

C:\Windows\System\NffUxrO.exe
C:\Windows\System\NffUxrO.exe
2⤵
PID:1940

C:\Windows\System\vnYwZlp.exe
C:\Windows\System\vnYwZlp.exe
2⤵
PID:5428

C:\Windows\System\WRtICEe.exe
C:\Windows\System\WRtICEe.exe
2⤵
PID:1100

C:\Windows\System\TxUVbwR.exe
C:\Windows\System\TxUVbwR.exe
2⤵
PID:11560

C:\Windows\System\oPjvYWV.exe
C:\Windows\System\oPjvYWV.exe
2⤵
PID:4784

C:\Windows\System\YAEYmNo.exe
C:\Windows\System\YAEYmNo.exe
2⤵
PID:4016

C:\Windows\System\cLXcDFU.exe
C:\Windows\System\cLXcDFU.exe
2⤵
PID:1028

C:\Windows\System\KCtaGeP.exe
C:\Windows\System\KCtaGeP.exe
2⤵
PID:10404

C:\Windows\System\wYTQcNJ.exe
C:\Windows\System\wYTQcNJ.exe
2⤵
PID:9396

C:\Windows\System\BtMJXuE.exe
C:\Windows\System\BtMJXuE.exe
2⤵
PID:4904

C:\Windows\System\TptIuIT.exe
C:\Windows\System\TptIuIT.exe
2⤵
PID:10344

C:\Windows\System\mTchCli.exe
C:\Windows\System\mTchCli.exe
2⤵
PID:3872

C:\Windows\System\CRMjbXR.exe
C:\Windows\System\CRMjbXR.exe
2⤵
PID:13096

C:\Windows\System\JJoLBBo.exe
C:\Windows\System\JJoLBBo.exe
2⤵
PID:5820

C:\Windows\System\sTcGsNH.exe
C:\Windows\System\sTcGsNH.exe
2⤵
PID:5744

C:\Windows\System\murbrDD.exe
C:\Windows\System\murbrDD.exe
2⤵
PID:3068

C:\Windows\System\nEoBYch.exe
C:\Windows\System\nEoBYch.exe
2⤵
PID:5704

C:\Windows\System\rtdwbUc.exe
C:\Windows\System\rtdwbUc.exe
2⤵
PID:5760

C:\Windows\System\wRpKzJz.exe
C:\Windows\System\wRpKzJz.exe
2⤵
PID:5452

C:\Windows\System\LojgCJU.exe
C:\Windows\System\LojgCJU.exe
2⤵
PID:3112

C:\Windows\System\JJnPwou.exe
C:\Windows\System\JJnPwou.exe
2⤵
PID:1296

C:\Windows\System\QGiPRnj.exe
C:\Windows\System\QGiPRnj.exe
2⤵
PID:3896

C:\Windows\System\yArOWoM.exe
C:\Windows\System\yArOWoM.exe
2⤵
PID:13200

C:\Windows\System\dYNDkVY.exe
C:\Windows\System\dYNDkVY.exe
2⤵
PID:8216

C:\Windows\System\AxOjvwz.exe
C:\Windows\System\AxOjvwz.exe
2⤵
PID:5440

C:\Windows\System\mNEkGxd.exe
C:\Windows\System\mNEkGxd.exe
2⤵
PID:11700

C:\Windows\System\vYYClrn.exe
C:\Windows\System\vYYClrn.exe
2⤵
PID:12392

C:\Windows\System\oomlAFT.exe
C:\Windows\System\oomlAFT.exe
2⤵
PID:1496

C:\Windows\System\OFQGYYh.exe
C:\Windows\System\OFQGYYh.exe
2⤵
PID:2920

C:\Windows\System\YTzmCrC.exe
C:\Windows\System\YTzmCrC.exe
2⤵
PID:4964

C:\Windows\System\ghNqsFE.exe
C:\Windows\System\ghNqsFE.exe
2⤵
PID:5988

C:\Windows\System\oYKAhTD.exe
C:\Windows\System\oYKAhTD.exe
2⤵
PID:6088

C:\Windows\System\vbRKtuw.exe
C:\Windows\System\vbRKtuw.exe
2⤵
PID:3984

C:\Windows\System\aJqSpJe.exe
C:\Windows\System\aJqSpJe.exe
2⤵
PID:4632

C:\Windows\System\SqBScbt.exe
C:\Windows\System\SqBScbt.exe
2⤵
PID:4004

C:\Windows\System\VDMeCbl.exe
C:\Windows\System\VDMeCbl.exe
2⤵
PID:5404

C:\Windows\System\xMPOHwM.exe
C:\Windows\System\xMPOHwM.exe
2⤵
PID:10348

C:\Windows\System\tlTtxPd.exe
C:\Windows\System\tlTtxPd.exe
2⤵
PID:5420

C:\Windows\System\yghkCbG.exe
C:\Windows\System\yghkCbG.exe
2⤵
PID:6140

C:\Windows\System\DNoGeti.exe
C:\Windows\System\DNoGeti.exe
2⤵
PID:4320

C:\Windows\System\RlWAMYS.exe
C:\Windows\System\RlWAMYS.exe
2⤵
PID:2116

C:\Windows\System\ozGpLHl.exe
C:\Windows\System\ozGpLHl.exe
2⤵
PID:5000

C:\Windows\System\gXTjNed.exe
C:\Windows\System\gXTjNed.exe
2⤵
PID:3184

C:\Windows\System\rkIeOCw.exe
C:\Windows\System\rkIeOCw.exe
2⤵
PID:3300

C:\Windows\System\CASgBpm.exe
C:\Windows\System\CASgBpm.exe
2⤵
PID:5544

C:\Windows\System\cQDTfJU.exe
C:\Windows\System\cQDTfJU.exe
2⤵
PID:10368

C:\Windows\System\ivRtOpN.exe
C:\Windows\System\ivRtOpN.exe
2⤵
PID:10516

C:\Windows\System\QNgZRuN.exe
C:\Windows\System\QNgZRuN.exe
2⤵
PID:10448

C:\Windows\System\SiybQKU.exe
C:\Windows\System\SiybQKU.exe
2⤵
PID:5360

C:\Windows\System\mWMieiH.exe
C:\Windows\System\mWMieiH.exe
2⤵
PID:640

C:\Windows\System\ZVPJKjK.exe
C:\Windows\System\ZVPJKjK.exe
2⤵
PID:5504

C:\Windows\System\LEIlrBV.exe
C:\Windows\System\LEIlrBV.exe
2⤵
PID:5756

C:\Windows\System\RvRMlNj.exe
C:\Windows\System\RvRMlNj.exe
2⤵
PID:5384

C:\Windows\System\NUVQYRl.exe
C:\Windows\System\NUVQYRl.exe
2⤵
PID:5708

C:\Windows\System\BlyUetH.exe
C:\Windows\System\BlyUetH.exe
2⤵
PID:4612

C:\Windows\System\Zstrguh.exe
C:\Windows\System\Zstrguh.exe
2⤵
PID:3096

C:\Windows\System\EQwMWXE.exe
C:\Windows\System\EQwMWXE.exe
2⤵
PID:2820

C:\Windows\System\cUuYzAf.exe
C:\Windows\System\cUuYzAf.exe
2⤵
PID:2896

C:\Windows\System\jONpFjq.exe
C:\Windows\System\jONpFjq.exe
2⤵
PID:3044

C:\Windows\System\FaBjTLJ.exe
C:\Windows\System\FaBjTLJ.exe
2⤵
PID:4960

C:\Windows\System\ewDvdMU.exe
C:\Windows\System\ewDvdMU.exe
2⤵
PID:872

C:\Windows\System\chrhtNn.exe
C:\Windows\System\chrhtNn.exe
2⤵
PID:932

C:\Windows\System\nWOdyBQ.exe
C:\Windows\System\nWOdyBQ.exe
2⤵
PID:6224

C:\Windows\System\BAgjWCQ.exe
C:\Windows\System\BAgjWCQ.exe
2⤵
PID:13168

C:\Windows\System\crEWaFV.exe
C:\Windows\System\crEWaFV.exe
2⤵
PID:6388

C:\Windows\System\unUKwtF.exe
C:\Windows\System\unUKwtF.exe
2⤵
PID:2336

C:\Windows\System\AyDsWmf.exe
C:\Windows\System\AyDsWmf.exe
2⤵
PID:5908

C:\Windows\System\OkGjHvE.exe
C:\Windows\System\OkGjHvE.exe
2⤵
PID:5968

C:\Windows\System\WbrllSs.exe
C:\Windows\System\WbrllSs.exe
2⤵
PID:4492

C:\Windows\System\kRCblWp.exe
C:\Windows\System\kRCblWp.exe
2⤵
PID:6504

C:\Windows\System\NXELWpW.exe
C:\Windows\System\NXELWpW.exe
2⤵
PID:2332

C:\Windows\System\qfLRlAU.exe
C:\Windows\System\qfLRlAU.exe
2⤵
PID:5808

C:\Windows\System\hLbaKgV.exe
C:\Windows\System\hLbaKgV.exe
2⤵
PID:11244

C:\Windows\System\puQvLCd.exe
C:\Windows\System\puQvLCd.exe
2⤵
PID:4052

C:\Windows\System\xVLKasN.exe
C:\Windows\System\xVLKasN.exe
2⤵
PID:6248

C:\Windows\System\qLZoCTA.exe
C:\Windows\System\qLZoCTA.exe
2⤵
PID:4608

C:\Windows\System\bHbGqbE.exe
C:\Windows\System\bHbGqbE.exe
2⤵
PID:632

C:\Windows\System\CcsJIjd.exe
C:\Windows\System\CcsJIjd.exe
2⤵
PID:5308

C:\Windows\System\EsWiGIa.exe
C:\Windows\System\EsWiGIa.exe
2⤵
PID:6328

C:\Windows\System\AtbyXgz.exe
C:\Windows\System\AtbyXgz.exe
2⤵
PID:6352

C:\Windows\System\WNfRUWF.exe
C:\Windows\System\WNfRUWF.exe
2⤵
PID:5848

C:\Windows\System\RWdkXyj.exe
C:\Windows\System\RWdkXyj.exe
2⤵
PID:13256

C:\Windows\System\GZCPCbt.exe
C:\Windows\System\GZCPCbt.exe
2⤵
PID:6724

C:\Windows\System\kKtRaDh.exe
C:\Windows\System\kKtRaDh.exe
2⤵
PID:12780

C:\Windows\System\EGfLItf.exe
C:\Windows\System\EGfLItf.exe
2⤵
PID:13232

C:\Windows\System\ATiUvds.exe
C:\Windows\System\ATiUvds.exe
2⤵
PID:2952

C:\Windows\System\IyXENmv.exe
C:\Windows\System\IyXENmv.exe
2⤵
PID:5696

C:\Windows\System\nrEoTlt.exe
C:\Windows\System\nrEoTlt.exe
2⤵
PID:13292

C:\Windows\System\StJIFaE.exe
C:\Windows\System\StJIFaE.exe
2⤵
PID:5156

C:\Windows\System\JJisHfx.exe
C:\Windows\System\JJisHfx.exe
2⤵
PID:4388

C:\Windows\System\lJTzOxE.exe
C:\Windows\System\lJTzOxE.exe
2⤵
PID:6220

C:\Windows\System\eZamDtz.exe
C:\Windows\System\eZamDtz.exe
2⤵
PID:5400

C:\Windows\System\eorrIWs.exe
C:\Windows\System\eorrIWs.exe
2⤵
PID:5160

C:\Windows\System\WHGfoSX.exe
C:\Windows\System\WHGfoSX.exe
2⤵
PID:3936

C:\Windows\System\UvhJNxU.exe
C:\Windows\System\UvhJNxU.exe
2⤵
PID:4656

C:\Windows\System\bnNnZlh.exe
C:\Windows\System\bnNnZlh.exe
2⤵
PID:3780

C:\Windows\System\EmcadEG.exe
C:\Windows\System\EmcadEG.exe
2⤵
PID:6996

C:\Windows\System\AdRzbGe.exe
C:\Windows\System\AdRzbGe.exe
2⤵
PID:3404

C:\Windows\System\bzOFvXC.exe
C:\Windows\System\bzOFvXC.exe
2⤵
PID:4432

C:\Windows\System\adVVMCT.exe
C:\Windows\System\adVVMCT.exe
2⤵
PID:5380

C:\Windows\System\fKotNEW.exe
C:\Windows\System\fKotNEW.exe
2⤵
PID:6760

C:\Windows\System\mAriHwp.exe
C:\Windows\System\mAriHwp.exe
2⤵
PID:6944

C:\Windows\System\ypqqztM.exe
C:\Windows\System\ypqqztM.exe
2⤵
PID:6380

C:\Windows\System\RrdEdpb.exe
C:\Windows\System\RrdEdpb.exe
2⤵
PID:6952

C:\Windows\System\KpCSnCf.exe
C:\Windows\System\KpCSnCf.exe
2⤵
PID:6728

C:\Windows\System\hSvHTWg.exe
C:\Windows\System\hSvHTWg.exe
2⤵
PID:3568

C:\Windows\System\CJiFGxF.exe
C:\Windows\System\CJiFGxF.exe
2⤵
PID:1900

C:\Windows\System\nxtVSLX.exe
C:\Windows\System\nxtVSLX.exe
2⤵
PID:5748

C:\Windows\System\aDXyMKl.exe
C:\Windows\System\aDXyMKl.exe
2⤵
PID:5468

C:\Windows\System\BAnIrla.exe
C:\Windows\System\BAnIrla.exe
2⤵
PID:6784

C:\Windows\System\cbRLPFs.exe
C:\Windows\System\cbRLPFs.exe
2⤵
PID:5780

C:\Windows\System\fGFUuHA.exe
C:\Windows\System\fGFUuHA.exe
2⤵
PID:4892

C:\Windows\System\fJcBWtT.exe
C:\Windows\System\fJcBWtT.exe
2⤵
PID:6400

C:\Windows\System\bjQVudi.exe
C:\Windows\System\bjQVudi.exe
2⤵
PID:6376

C:\Windows\System\iKbwQGb.exe
C:\Windows\System\iKbwQGb.exe
2⤵
PID:7056

C:\Windows\System\KVJoljK.exe
C:\Windows\System\KVJoljK.exe
2⤵
PID:4584

C:\Windows\System\NydNbuv.exe
C:\Windows\System\NydNbuv.exe
2⤵
PID:7176

C:\Windows\System\nAjTYwO.exe
C:\Windows\System\nAjTYwO.exe
2⤵
PID:6664

C:\Windows\System\KPzWKxn.exe
C:\Windows\System\KPzWKxn.exe
2⤵
PID:5488

C:\Windows\System\WXrLOzO.exe
C:\Windows\System\WXrLOzO.exe
2⤵
PID:1464

C:\Windows\System\xtfdkPS.exe
C:\Windows\System\xtfdkPS.exe
2⤵
PID:12516

C:\Windows\System\ENBJRqZ.exe
C:\Windows\System\ENBJRqZ.exe
2⤵
PID:2548

C:\Windows\System\xCqPQFq.exe
C:\Windows\System\xCqPQFq.exe
2⤵
PID:4144

C:\Windows\System\aQxoyxJ.exe
C:\Windows\System\aQxoyxJ.exe
2⤵
PID:5812

C:\Windows\System\lXJPtPT.exe
C:\Windows\System\lXJPtPT.exe
2⤵
PID:436

C:\Windows\System\BfSFzfO.exe
C:\Windows\System\BfSFzfO.exe
2⤵
PID:7408

C:\Windows\System\kbYdNmr.exe
C:\Windows\System\kbYdNmr.exe
2⤵
PID:4028

C:\Windows\System\lNYAHPk.exe
C:\Windows\System\lNYAHPk.exe
2⤵
PID:5924

C:\Windows\System\bheYRvX.exe
C:\Windows\System\bheYRvX.exe
2⤵
PID:2832

C:\Windows\System\aXKJmkk.exe
C:\Windows\System\aXKJmkk.exe
2⤵
PID:2284

C:\Windows\System\jLoyZAQ.exe
C:\Windows\System\jLoyZAQ.exe
2⤵
PID:7036

C:\Windows\System\haVQrah.exe
C:\Windows\System\haVQrah.exe
2⤵
PID:7832

C:\Windows\System\FwtVFNo.exe
C:\Windows\System\FwtVFNo.exe
2⤵
PID:6444

C:\Windows\System\cwRaVzc.exe
C:\Windows\System\cwRaVzc.exe
2⤵
PID:7112

C:\Windows\System\ZdJqzth.exe
C:\Windows\System\ZdJqzth.exe
2⤵
PID:6968

C:\Windows\System\LysKGEu.exe
C:\Windows\System\LysKGEu.exe
2⤵
PID:6948

C:\Windows\System\CAksCEi.exe
C:\Windows\System\CAksCEi.exe
2⤵
PID:6956

C:\Windows\System\OMvmhwm.exe
C:\Windows\System\OMvmhwm.exe
2⤵
PID:5268

C:\Windows\System\gNXJtSu.exe
C:\Windows\System\gNXJtSu.exe
2⤵
PID:7412

C:\Windows\System\ClmmnZV.exe
C:\Windows\System\ClmmnZV.exe
2⤵
PID:5828

C:\Windows\System\KGojFCo.exe
C:\Windows\System\KGojFCo.exe
2⤵
PID:6904

C:\Windows\System\DFRycsH.exe
C:\Windows\System\DFRycsH.exe
2⤵
PID:6684

C:\Windows\System\AnoLScc.exe
C:\Windows\System\AnoLScc.exe
2⤵
PID:7568

C:\Windows\System\YsMiWXU.exe
C:\Windows\System\YsMiWXU.exe
2⤵
PID:380

C:\Windows\System\dsLBBiX.exe
C:\Windows\System\dsLBBiX.exe
2⤵
PID:7604

C:\Windows\System\EjIlmWx.exe
C:\Windows\System\EjIlmWx.exe
2⤵
PID:7596

C:\Windows\System\tRBVcYe.exe
C:\Windows\System\tRBVcYe.exe
2⤵
PID:6152

C:\Windows\System\VKkafFM.exe
C:\Windows\System\VKkafFM.exe
2⤵
PID:6848

C:\Windows\System\BXkNwsx.exe
C:\Windows\System\BXkNwsx.exe
2⤵
PID:7716

C:\Windows\System\jTXENUY.exe
C:\Windows\System\jTXENUY.exe
2⤵
PID:3512

C:\Windows\System\BucuZdU.exe
C:\Windows\System\BucuZdU.exe
2⤵
PID:5432

C:\Windows\System\KvRcBTe.exe
C:\Windows\System\KvRcBTe.exe
2⤵
PID:7848

C:\Windows\System\TgBFcHH.exe
C:\Windows\System\TgBFcHH.exe
2⤵
PID:7548

C:\Windows\System\utuLzoS.exe
C:\Windows\System\utuLzoS.exe
2⤵
PID:5416

C:\Windows\System\vgcxTem.exe
C:\Windows\System\vgcxTem.exe
2⤵
PID:5456

C:\Windows\System\WtqgkSJ.exe
C:\Windows\System\WtqgkSJ.exe
2⤵
PID:5824

C:\Windows\System\fAhGbXC.exe
C:\Windows\System\fAhGbXC.exe
2⤵
PID:1908

C:\Windows\System\HqGznGX.exe
C:\Windows\System\HqGznGX.exe
2⤵
PID:1280

C:\Windows\System\EjBrnme.exe
C:\Windows\System\EjBrnme.exe
2⤵
PID:7648

C:\Windows\System\ouelQxY.exe
C:\Windows\System\ouelQxY.exe
2⤵
PID:5408

C:\Windows\System\logCCnr.exe
C:\Windows\System\logCCnr.exe
2⤵
PID:6308

C:\Windows\System\mWnxVqt.exe
C:\Windows\System\mWnxVqt.exe
2⤵
PID:6876

C:\Windows\System\okZNaFv.exe
C:\Windows\System\okZNaFv.exe
2⤵
PID:2800

C:\Windows\System\eyKQAmH.exe
C:\Windows\System\eyKQAmH.exe
2⤵
PID:4888

C:\Windows\System\PxTmnyE.exe
C:\Windows\System\PxTmnyE.exe
2⤵
PID:6976

C:\Windows\System\EDImNKr.exe
C:\Windows\System\EDImNKr.exe
2⤵
PID:6676

C:\Windows\System\qoQpsUB.exe
C:\Windows\System\qoQpsUB.exe
2⤵
PID:8532

C:\Windows\System\pGoXWaJ.exe
C:\Windows\System\pGoXWaJ.exe
2⤵
PID:8540

C:\Windows\System\tMTDjfu.exe
C:\Windows\System\tMTDjfu.exe
2⤵
PID:4764

C:\Windows\System\mKSDnEH.exe
C:\Windows\System\mKSDnEH.exe
2⤵
PID:6704

C:\Windows\System\OcWJqTJ.exe
C:\Windows\System\OcWJqTJ.exe
2⤵
PID:1700

C:\Windows\System\ToDLwbh.exe
C:\Windows\System\ToDLwbh.exe
2⤵
PID:8592

C:\Windows\System\bKzyWHB.exe
C:\Windows\System\bKzyWHB.exe
2⤵
PID:6372

C:\Windows\System\IywlHZt.exe
C:\Windows\System\IywlHZt.exe
2⤵
PID:7116

C:\Windows\System\FapVxRF.exe
C:\Windows\System\FapVxRF.exe
2⤵
PID:8328

C:\Windows\System\DzcZLWy.exe
C:\Windows\System\DzcZLWy.exe
2⤵
PID:7132

C:\Windows\System\Xgxzqts.exe
C:\Windows\System\Xgxzqts.exe
2⤵
PID:5512

C:\Windows\System\gByxYjB.exe
C:\Windows\System\gByxYjB.exe
2⤵
PID:7228

C:\Windows\System\QjEZKhB.exe
C:\Windows\System\QjEZKhB.exe
2⤵
PID:8372

C:\Windows\System\IUyTkyI.exe
C:\Windows\System\IUyTkyI.exe
2⤵
PID:312

C:\Windows\System\WNIbpAL.exe
C:\Windows\System\WNIbpAL.exe
2⤵
PID:5052

C:\Windows\System\obuBJKR.exe
C:\Windows\System\obuBJKR.exe
2⤵
PID:5044

C:\Windows\System\PpzPCet.exe
C:\Windows\System\PpzPCet.exe
2⤵
PID:7916

C:\Windows\System\cnrhYTr.exe
C:\Windows\System\cnrhYTr.exe
2⤵
PID:7988

C:\Windows\System\yGKFUbS.exe
C:\Windows\System\yGKFUbS.exe
2⤵
PID:5912

C:\Windows\System\FzJZPmU.exe
C:\Windows\System\FzJZPmU.exe
2⤵
PID:8792

C:\Windows\System\QrIeiFZ.exe
C:\Windows\System\QrIeiFZ.exe
2⤵
PID:8480

C:\Windows\System\axmdbAI.exe
C:\Windows\System\axmdbAI.exe
2⤵
PID:8472

C:\Windows\System\QbhlzlG.exe
C:\Windows\System\QbhlzlG.exe
2⤵
PID:12532

C:\Windows\System\erpFXZn.exe
C:\Windows\System\erpFXZn.exe
2⤵
PID:9080

C:\Windows\System\VDqZmPM.exe
C:\Windows\System\VDqZmPM.exe
2⤵
PID:9372

C:\Windows\System\HnLmEHF.exe
C:\Windows\System\HnLmEHF.exe
2⤵
PID:5860

C:\Windows\System\ByDZRGH.exe
C:\Windows\System\ByDZRGH.exe
2⤵
PID:7552

C:\Windows\System\csCyMVQ.exe
C:\Windows\System\csCyMVQ.exe
2⤵
PID:9188

C:\Windows\System\rFuuLkN.exe
C:\Windows\System\rFuuLkN.exe
2⤵
PID:8692

C:\Windows\System\ziswdyI.exe
C:\Windows\System\ziswdyI.exe
2⤵
PID:2384

C:\Windows\System\JmJTkzg.exe
C:\Windows\System\JmJTkzg.exe
2⤵
PID:7472

C:\Windows\System\GtjAWNi.exe
C:\Windows\System\GtjAWNi.exe
2⤵
PID:8728

C:\Windows\System\cerUxyP.exe
C:\Windows\System\cerUxyP.exe
2⤵
PID:8744

C:\Windows\System\tRWEfPQ.exe
C:\Windows\System\tRWEfPQ.exe
2⤵
PID:7620

C:\Windows\System\VgUVLIC.exe
C:\Windows\System\VgUVLIC.exe
2⤵
PID:8768

C:\Windows\System\dqvvnxX.exe
C:\Windows\System\dqvvnxX.exe
2⤵
PID:8648

C:\Windows\System\dyRKnbw.exe
C:\Windows\System\dyRKnbw.exe
2⤵
PID:8644

C:\Windows\System\xyTctwD.exe
C:\Windows\System\xyTctwD.exe
2⤵
PID:8652

C:\Windows\System\dxaJikI.exe
C:\Windows\System\dxaJikI.exe
2⤵
PID:8852

C:\Windows\System\uEhvZrc.exe
C:\Windows\System\uEhvZrc.exe
2⤵
PID:8564

C:\Windows\System\HhWbjwv.exe
C:\Windows\System\HhWbjwv.exe
2⤵
PID:8536

C:\Windows\System\kccHVtA.exe
C:\Windows\System\kccHVtA.exe
2⤵
PID:8900

C:\Windows\System\iZXMbGj.exe
C:\Windows\System\iZXMbGj.exe
2⤵
PID:7948

C:\Windows\System\jhNkEBM.exe
C:\Windows\System\jhNkEBM.exe
2⤵
PID:6748

C:\Windows\System\SGSJxEo.exe
C:\Windows\System\SGSJxEo.exe
2⤵
PID:6304

C:\Windows\System\MhTOlZZ.exe
C:\Windows\System\MhTOlZZ.exe
2⤵
PID:9004

C:\Windows\System\GcoceOv.exe
C:\Windows\System\GcoceOv.exe
2⤵
PID:7876

C:\Windows\System\xhvIYji.exe
C:\Windows\System\xhvIYji.exe
2⤵
PID:9104

C:\Windows\System\FUAbewX.exe
C:\Windows\System\FUAbewX.exe
2⤵
PID:8440

C:\Windows\System\jrkofgr.exe
C:\Windows\System\jrkofgr.exe
2⤵
PID:6292

C:\Windows\System\DaslIyA.exe
C:\Windows\System\DaslIyA.exe
2⤵
PID:7288

C:\Windows\System\URnvafb.exe
C:\Windows\System\URnvafb.exe
2⤵
PID:1632

C:\Windows\System\nPMymuo.exe
C:\Windows\System\nPMymuo.exe
2⤵
PID:1976

C:\Windows\System\eDXEZHh.exe
C:\Windows\System\eDXEZHh.exe
2⤵
PID:6004

C:\Windows\System\BNwHNWV.exe
C:\Windows\System\BNwHNWV.exe
2⤵
PID:5840

C:\Windows\System\rrtXTHV.exe
C:\Windows\System\rrtXTHV.exe
2⤵
PID:8504

C:\Windows\System\GyFtqHm.exe
C:\Windows\System\GyFtqHm.exe
2⤵
PID:8720

C:\Windows\System\COaUDob.exe
C:\Windows\System\COaUDob.exe
2⤵
PID:3948

C:\Windows\System\UQIWxmS.exe
C:\Windows\System\UQIWxmS.exe
2⤵
PID:8660

C:\Windows\System\XnSsyVN.exe
C:\Windows\System\XnSsyVN.exe
2⤵
PID:8356

C:\Windows\System\PjfPAeM.exe
C:\Windows\System\PjfPAeM.exe
2⤵
PID:8628

C:\Windows\System\eqjSEHN.exe
C:\Windows\System\eqjSEHN.exe
2⤵
PID:6604

C:\Windows\System\IZZFTfO.exe
C:\Windows\System\IZZFTfO.exe
2⤵
PID:6560

C:\Windows\System\YMQWNws.exe
C:\Windows\System\YMQWNws.exe
2⤵
PID:7600

C:\Windows\System\hzJPqXQ.exe
C:\Windows\System\hzJPqXQ.exe
2⤵
PID:7576

C:\Windows\System\FJeYmjr.exe
C:\Windows\System\FJeYmjr.exe
2⤵
PID:8292

C:\Windows\System\cFfEEGn.exe
C:\Windows\System\cFfEEGn.exe
2⤵
PID:8288

C:\Windows\System\tbYMrYO.exe
C:\Windows\System\tbYMrYO.exe
2⤵
PID:7668

C:\Windows\System\PTFnCrs.exe
C:\Windows\System\PTFnCrs.exe
2⤵
PID:8212

C:\Windows\System\BWgkHpI.exe
C:\Windows\System\BWgkHpI.exe
2⤵
PID:9320

C:\Windows\System\thNrLBM.exe
C:\Windows\System\thNrLBM.exe
2⤵
PID:7016

C:\Windows\System\THAeFKr.exe
C:\Windows\System\THAeFKr.exe
2⤵
PID:8380

C:\Windows\System\xrmLUFL.exe
C:\Windows\System\xrmLUFL.exe
2⤵
PID:5328

C:\Windows\System\URZAPfV.exe
C:\Windows\System\URZAPfV.exe
2⤵
PID:7928

C:\Windows\System\aprYndU.exe
C:\Windows\System\aprYndU.exe
2⤵
PID:8804

C:\Windows\System\OwOLeXj.exe
C:\Windows\System\OwOLeXj.exe
2⤵
PID:8688

C:\Windows\System\TMwAqtM.exe
C:\Windows\System\TMwAqtM.exe
2⤵
PID:8220

C:\Windows\System\prDNdCk.exe
C:\Windows\System\prDNdCk.exe
2⤵
PID:6584

C:\Windows\System\JFhTVOL.exe
C:\Windows\System\JFhTVOL.exe
2⤵
PID:7084

C:\Windows\System\QFsDHae.exe
C:\Windows\System\QFsDHae.exe
2⤵
PID:8844

C:\Windows\System\GpDgcDS.exe
C:\Windows\System\GpDgcDS.exe
2⤵
PID:8992

C:\Windows\System\zDtZWtE.exe
C:\Windows\System\zDtZWtE.exe
2⤵
PID:6188

C:\Windows\System\yRKxhsd.exe
C:\Windows\System\yRKxhsd.exe
2⤵
PID:9492

C:\Windows\System\zqQqYhn.exe
C:\Windows\System\zqQqYhn.exe
2⤵
PID:7196

C:\Windows\System\NcYzjAl.exe
C:\Windows\System\NcYzjAl.exe
2⤵
PID:7624

C:\Windows\System\KtiRlDN.exe
C:\Windows\System\KtiRlDN.exe
2⤵
PID:9136

C:\Windows\System\pQYVVmQ.exe
C:\Windows\System\pQYVVmQ.exe
2⤵
PID:9748

C:\Windows\System\BKZEUcy.exe
C:\Windows\System\BKZEUcy.exe
2⤵
PID:9752

C:\Windows\System\uhZFXwQ.exe
C:\Windows\System\uhZFXwQ.exe
2⤵
PID:5036

C:\Windows\System\FpzmMVu.exe
C:\Windows\System\FpzmMVu.exe
2⤵
PID:9284

C:\Windows\System\mmhXyeR.exe
C:\Windows\System\mmhXyeR.exe
2⤵
PID:9332

C:\Windows\System\GSVsglY.exe
C:\Windows\System\GSVsglY.exe
2⤵
PID:9348

C:\Windows\System\EsjnAye.exe
C:\Windows\System\EsjnAye.exe
2⤵
PID:8580

C:\Windows\System\PFbMwHN.exe
C:\Windows\System\PFbMwHN.exe
2⤵
PID:5964

C:\Windows\System\HAHfqDE.exe
C:\Windows\System\HAHfqDE.exe
2⤵
PID:7672

C:\Windows\System\IKmStYO.exe
C:\Windows\System\IKmStYO.exe
2⤵
PID:7816

C:\Windows\System\DqIecDj.exe
C:\Windows\System\DqIecDj.exe
2⤵
PID:9912

C:\Windows\System\tknwPtm.exe
C:\Windows\System\tknwPtm.exe
2⤵
PID:8752

C:\Windows\System\oPxOdJc.exe
C:\Windows\System\oPxOdJc.exe
2⤵
PID:8388

C:\Windows\System\wlldLQs.exe
C:\Windows\System\wlldLQs.exe
2⤵
PID:8412

C:\Windows\System\mzJEzuu.exe
C:\Windows\System\mzJEzuu.exe
2⤵
PID:6096

C:\Windows\System\TBllgUQ.exe
C:\Windows\System\TBllgUQ.exe
2⤵
PID:8576

C:\Windows\System\qdjxPkj.exe
C:\Windows\System\qdjxPkj.exe
2⤵
PID:8860

C:\Windows\System\UbhnfCq.exe
C:\Windows\System\UbhnfCq.exe
2⤵
PID:10104

C:\Windows\System\RagClZt.exe
C:\Windows\System\RagClZt.exe
2⤵
PID:8272

C:\Windows\System\ucGjeet.exe
C:\Windows\System\ucGjeet.exe
2⤵
PID:8680

C:\Windows\System\XFCPKjm.exe
C:\Windows\System\XFCPKjm.exe
2⤵
PID:10120

C:\Windows\System\soMxOPD.exe
C:\Windows\System\soMxOPD.exe
2⤵
PID:9196

C:\Windows\System\TwhypOr.exe
C:\Windows\System\TwhypOr.exe
2⤵
PID:9644

C:\Windows\System\jKSaERJ.exe
C:\Windows\System\jKSaERJ.exe
2⤵
PID:12228

C:\Windows\System\hKydonZ.exe
C:\Windows\System\hKydonZ.exe
2⤵
PID:6628

C:\Windows\System\DqUcFzq.exe
C:\Windows\System\DqUcFzq.exe
2⤵
PID:3744

C:\Windows\System\UiFHkYl.exe
C:\Windows\System\UiFHkYl.exe
2⤵
PID:9616

C:\Windows\System\kYpyMvM.exe
C:\Windows\System\kYpyMvM.exe
2⤵
PID:9668

C:\Windows\System\GewVRBQ.exe
C:\Windows\System\GewVRBQ.exe
2⤵
PID:9428

C:\Windows\System\WWndNhE.exe
C:\Windows\System\WWndNhE.exe
2⤵
PID:8156

C:\Windows\System\EnVQNAS.exe
C:\Windows\System\EnVQNAS.exe
2⤵
PID:8484

C:\Windows\System\xIXBYRf.exe
C:\Windows\System\xIXBYRf.exe
2⤵
PID:9256

C:\Windows\System\QyxZPEw.exe
C:\Windows\System\QyxZPEw.exe
2⤵
PID:6184

C:\Windows\System\CPUaJYl.exe
C:\Windows\System\CPUaJYl.exe
2⤵
PID:9148

C:\Windows\System\gjhCqqJ.exe
C:\Windows\System\gjhCqqJ.exe
2⤵
PID:5048

C:\Windows\System\hTjNEWe.exe
C:\Windows\System\hTjNEWe.exe
2⤵
PID:4668

C:\Windows\System\frcRAKf.exe
C:\Windows\System\frcRAKf.exe
2⤵
PID:556

C:\Windows\System\cNLdmSZ.exe
C:\Windows\System\cNLdmSZ.exe
2⤵
PID:9776

C:\Windows\System\PWGDZyN.exe
C:\Windows\System\PWGDZyN.exe
2⤵
PID:8316

C:\Windows\System\oUcAFUt.exe
C:\Windows\System\oUcAFUt.exe
2⤵
PID:9816

C:\Windows\System\qRYVjvo.exe
C:\Windows\System\qRYVjvo.exe
2⤵
PID:3240

C:\Windows\System\XrdKCDj.exe
C:\Windows\System\XrdKCDj.exe
2⤵
PID:8252

C:\Windows\System\CMXRiDJ.exe
C:\Windows\System\CMXRiDJ.exe
2⤵
PID:9640

C:\Windows\System\DdFzOed.exe
C:\Windows\System\DdFzOed.exe
2⤵
PID:10188

C:\Windows\System\jpYtDpR.exe
C:\Windows\System\jpYtDpR.exe
2⤵
PID:8308

C:\Windows\System\JQzYJrZ.exe
C:\Windows\System\JQzYJrZ.exe
2⤵
PID:8228

C:\Windows\System\iviyMmk.exe
C:\Windows\System\iviyMmk.exe
2⤵
PID:2796

C:\Windows\System\PPpOWvi.exe
C:\Windows\System\PPpOWvi.exe
2⤵
PID:9944

C:\Windows\System\lJVFznA.exe
C:\Windows\System\lJVFznA.exe
2⤵
PID:6768

C:\Windows\System\xncGUXS.exe
C:\Windows\System\xncGUXS.exe
2⤵
PID:7328

C:\Windows\System\RPWodWQ.exe
C:\Windows\System\RPWodWQ.exe
2⤵
PID:9780

C:\Windows\System\mUQYCbk.exe
C:\Windows\System\mUQYCbk.exe
2⤵
PID:2356

C:\Windows\System\VINFVyF.exe
C:\Windows\System\VINFVyF.exe
2⤵
PID:11164

C:\Windows\System\OjYDjKK.exe
C:\Windows\System\OjYDjKK.exe
2⤵
PID:8280

C:\Windows\System\HqGUWtm.exe
C:\Windows\System\HqGUWtm.exe
2⤵
PID:10024

C:\Windows\System\avEnziH.exe
C:\Windows\System\avEnziH.exe
2⤵
PID:12652

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lolzqo0w.ngz.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AzgTBaI.exe
Filesize
1.9MB

MD5
51066d7b49c5a130290cee87883549a6

SHA1
fdedc385b0dad4bd076c3589e8037880a0291133

SHA256
b27326e583bae5e2d8571f5b089d44dd531f60adc8ad59a243c6a57778f7087e

SHA512
e21c08af7f56a82d36ea8a5420d7eeef3935f1df65a4a919c7c7661007da39a83bc075e8f6afdda76fdb4b24e76bac05b5e7a0de2b57e106c30aa6737bcd7e91

Download Submit
C:\Windows\System\BUdKamq.exe
Filesize
1.9MB

MD5
2813fbc1e92655a7da3187af60cd38be

SHA1
07d4af587c649ccb97737928025a1a4238947847

SHA256
f45b33b94d64b5a461185e2ea029ed28ae38ce52a1a07138a5a40c17ec25a87d

SHA512
c5c80b4f81e52127e903d061f2aa423db40a18903056f8f46ecaf12b3e6092de012e9534e33297c8593f9d1403ae88a27bf9dec5d0fbe3cdd4b7f2995901a116

Download Submit
C:\Windows\System\FHgpzEX.exe
Filesize
1.9MB

MD5
7b784e55f4d3d68fb1f124787907ef0e

SHA1
9464e7c3ecb64b4515e0e589c42151aa9f141675

SHA256
d946b2b1146d0fab8434d3b0b93725bbb2803f1acbd2158a65182f86dd4ac04a

SHA512
788411b39d3268c99ff66806e65648538292027b5247cc863267e786b1d3eae2ab780bda0dc853fb96548b15c78b4b19fa95d7a6b4db86ff70343844ee37eaec

Download Submit
C:\Windows\System\FhpyhPB.exe
Filesize
1.9MB

MD5
3a99452b9c4c58b53ec100a7141e408d

SHA1
87e16e866cc8d40a8f06765d0d81810010c8297f

SHA256
75d3ab4dad08fa03340fe05e61d468cfaecbf19f5895c766c9933fdd63006896

SHA512
5683665702575f04841a75116a6dff5708c4dbe8f1ad565ceee7b619cf2252384fe4dc0d171ff93e7132913bb363a8130b060492b424783c0981f2e8e5bac67d

Download Submit
C:\Windows\System\HWdnxbv.exe
Filesize
1.9MB

MD5
8f5964ef4d3d7d2b521cc827ffe8153b

SHA1
f65a2be8baa819b9fae4a5ad6e0dc350967047e3

SHA256
6ea83879b951ebdc4e8770637307fbe0642659f23cdbb20fdc809ccaa63fd828

SHA512
0a1bf14257028c717c6a93795b4be1567be3e4160ab1a3939523330306155541a59e8cb976922544f2a42c85b24ea5e5e330208429a03cbd6ce7a439eb08dd89

Download Submit
C:\Windows\System\ImJUklQ.exe
Filesize
1.9MB

MD5
93ba05ef7ed7cd467250ef2aa9f4fc71

SHA1
b22b728600e5f9fab7627828ca9dfd47f9de6c70

SHA256
9e8c247fe4f69d0edffdcc182416232752cdf03c35c68eef063e54b08ab8c4ca

SHA512
6aa9f2aa2e93ffa5de02096111db4debd98c5c0fe3dba846069e2a4ee9157dab4f88d5650c02632f1bb74e3c87d204366a4d9acfceb44d60e978d09015767f1d

Download Submit
C:\Windows\System\MKdYdTR.exe
Filesize
1.9MB

MD5
22bc7936a9d3e92f3047322114d7dbf9

SHA1
34bf10a2b6a2499727c4cbc64bc885e537513279

SHA256
5c40c54175acd754d8305e635fe22f3131ed72baca5eed345b6206bdc2895555

SHA512
b48a05e92079f92889f381f53ed01ede15bd529298d6dcc5063853d92b0ddb6175541b85e506c0795277ab33c22b1e15d2a2413bcc1f04a8d6254b04d747eb55

Download Submit
C:\Windows\System\OfzLsPl.exe
Filesize
1.9MB

MD5
e1c750ccf05fb66319b37c03dcc14f48

SHA1
709c444c36ee4780afd41f9b9e3dc5445c8bd62b

SHA256
3e50f6d9760436d8909f14c0b5454044f84cabd4cfeed9b047900c3d93447765

SHA512
24907830351771fd155acb1e4ae3bf26725045641de4034b758a6a10b21a3e6f7a6fff35705b80a3775ea77f9f79823199bce82252b856f9534b25f95bfdbc3c

Download Submit
C:\Windows\System\OmWxFoB.exe
Filesize
1.9MB

MD5
d8f8e0d6c7c363db05a6809e7f7a1a61

SHA1
1d016438afa3f372a730bab7a7db8d29e835e165

SHA256
2d5510cb60d691686072a0f02280c014720d69441eb66d8aa41af96cc68600e3

SHA512
42463e801d4cc6b1a45b7f01581393b8119ff8dfa1c1c5870a7071a6880e3291adb540933fc38a6c4c9ff5a0a087452848624cdaad16d03279175597838811e9

Download Submit
C:\Windows\System\OpmfJUq.exe
Filesize
1.9MB

MD5
cba0d3c698af6ba56fd1926351659be8

SHA1
b5cf1df4e3e40c242502341c6b2669ef06eb2e20

SHA256
03478fa48fcde99847077e2ec9e9cd2295fdee6d4eb91f75ccc7a4ca3f539bf4

SHA512
b663431c428eec078cd8bbd1c94bd79369d6a14ae230f46a64388df76103e72dd668249a03fc52e5eb0fdae6df8e330b9efeff5089e26151934a855809805456

Download Submit
C:\Windows\System\PIVAyJb.exe
Filesize
1.9MB

MD5
758c3fa0629bf113893c1dc59c9fd6f6

SHA1
141070d355eaae31f3da8bd027280f3286e00344

SHA256
8118072e70fc6b06b442aa1a04adc908d7627fee6a10e5fda3caff337fc31536

SHA512
fd4bb4f91f072d2d1888ed59220c708cfb742b3465e86ec6e1ddb0ac7963ed673547642706e1a57b3829cac73085becd46601123a0462ddf7d9d519876e9567d

Download Submit
C:\Windows\System\UyRqJWD.exe
Filesize
1.9MB

MD5
5d52792e87f837995793672387ab7848

SHA1
1ddee3288dc342a7ca9d6838e0b2b1ee3bf0d81f

SHA256
2e094ca093ce237579df6c4f91e43bcdf0047e9a2696588661eb5a2bfc29907c

SHA512
8c75d916c7b497249ee5ffb11a7116f959e1c6c28db4d4aafd2a97ffd398dc14e8db21cd07885665a5a4b88d3b811713668bf3887fd7421b8fc076026001168c

Download Submit
C:\Windows\System\VDbjnnG.exe
Filesize
1.9MB

MD5
d99a3600d048bdee5147e7c3a70e1403

SHA1
b1933e60eedde96759a4def4e4c9f297f567369a

SHA256
4701304dd253cf785bf28cf193ef09e56db1aaa51194a930af5216dce3181c55

SHA512
2fa596873f793dd1f3165f530513f2cfc1e64e90a1f8848697b2393979df8e35baad40d6c00e421881729782b81f17669600dbba1be155eede668e38a72e3e28

Download Submit
C:\Windows\System\VqSVbOK.exe
Filesize
1.9MB

MD5
05de85aa02e21bab9c40dc4ba04b8992

SHA1
8745b82c988783347efefe630b5b13163db273c5

SHA256
6959e833d66d35c62697bac1e61d0119e473ec916982513dcd6614f3c55ef559

SHA512
cd50fb727810e0275239576b3e595574d681e8275a7045a6a31cdbafa85d6339dde822b9c80096a061a560cd79f29902c52c4d63287160cb7442327b644436b4

Download Submit
C:\Windows\System\WFAOwkO.exe
Filesize
1.9MB

MD5
d4f8fbffde858fbe45202af89a860ecf

SHA1
83f70f0e81ad6e92067f1c4cb168e3fbbe10a352

SHA256
2b99efee87b850d9fe80aa043dddf5e46f6e7ce8b4f88f885846ed810ae67fae

SHA512
6943a344d4cdb456e270eddee7eb5bd6f2ff7394bf35f22cc4e82875b763833c8b96c5f09f2ee511c83430822b6faa43ed6b478ba97057baf01d4fb7c2e487c9

Download Submit
C:\Windows\System\YCvxqpt.exe
Filesize
1.9MB

MD5
0047075a4d3a93897c34cc1e44dccc5d

SHA1
490bc1f71509efe772f2927a75e15163e3ab473d

SHA256
71619efdfd78937bd8b6bacd7d35fe774c2c7f0b2bb5e670470ffb5da113bdbd

SHA512
1295235647d606200ddc9ef030a05dfddf456d571af2f42b736b1474783b5f88f5cd0779d0b89feb219190c7f3fb2c6f23723e3cf19745513fb632fce76ee0b0

Download Submit
C:\Windows\System\ZnvEBQl.exe
Filesize
1.9MB

MD5
2815fc2c2351c5f2451d13e558eca6b4

SHA1
78d20e712563a24207aa0ec5f59b126b9a5b889a

SHA256
4f422b88d68d80aafd9c94a6516f8e9c1eda8fd3ceee1614fe27606bf15db1df

SHA512
8bcef79aea8e8a6143daebbf600adba764fdbbd5b192c0add1c7d7785ea7507ead1f9bc3ebaf4745e4dc0805ac8c0e8bed30418e99b771c5b9f12f8a06fd06a7

Download Submit
C:\Windows\System\asOeOrN.exe
Filesize
1.9MB

MD5
16ba8a5e57dc70d727476547a1b5511c

SHA1
a62db6baacff46216daf76074d11bb2a06039d40

SHA256
f575e61aa03305aaca76d1d9697618aeb33ca40a1e84354296a16ea80535ed59

SHA512
0546213af4e6f4813651705fd5df8603197e6047fb67bd2ab77b841d816188d9b94611ea4f6e3467b3644ae65de6a0bee5cde1fd045322e0fe473b8fe62a888e

Download Submit
C:\Windows\System\cwkXmCA.exe
Filesize
1.9MB

MD5
ed16d4d0c7c498d00679e818761a7c93

SHA1
e93d79871116b07d4c2b4ac489c1e3b697c953d8

SHA256
433e855e8f028468ecc1b203d58d8b7d25dfb85060455b004be42411f3443d1d

SHA512
8c5288442a7f49b8e1f1d536b190e091d078ed1915e3db9d9fc5b952be1e15ad81081f032ad57e0719d82fde74e397b556bbe26335d18e14d5cdaf0429be62ac

Download Submit
C:\Windows\System\heezOJk.exe
Filesize
1.9MB

MD5
b22c6221d75c33b79c735a8605ab33d8

SHA1
88c56790518a5d6206224110d736762436f9f12a

SHA256
ff7b754f1f8d983f1e328fd438f3bdcd7cad88b5e89420bccbbdb0d76f1e829d

SHA512
50ae32f23cf39a19fdf3e1d7e0de4ebd905d6e308d561da2b430aeb6abc93d38fb79a8136c7c24d20c895d175f87976ad090122c4e32a33af7a55501dc51c713

Download Submit
C:\Windows\System\iEsgMlP.exe
Filesize
1.9MB

MD5
580455105aa9d03b85b8ac8557b8868a

SHA1
6f46e7a6d1b97cf0904354f64c5afb37042c60f5

SHA256
d9369faf11ede943b68116402de2c28514aefa0bfde5e4b4dd72efcda6dac12d

SHA512
0313c37bac9b5c5c97af6da6252d608d8e91a1899b9836188655e74fac541b093574e93b052b5a4cc49ebf14d61b71f9096afdbd7611c9a76a6375d1fcb6d3fc

Download Submit
C:\Windows\System\iJtYuKD.exe
Filesize
1.9MB

MD5
4e5db2d6bd6ce260b66067c0fc5d1c12

SHA1
6cea11708ae3710f8458f4f01e0c72fc8f8de3de

SHA256
2d514edc509184a51b7f7052902d55c2dd7de49a427e0654b6754367fb36d50c

SHA512
f403ba0f19348bfc67beed17763550db38bb7503121a1179054013c02ee3a673e11e5d8a16e5e870140c7dbb153a41d22b580949ae5efcd5cfc9b3c2feb08ab9

Download Submit
C:\Windows\System\iSttpDt.exe
Filesize
1.9MB

MD5
88780b5dbe6789c4ce9f2e2b09056150

SHA1
b466242df3e2cb262f1048013f1535b46f4dba9b

SHA256
ec3f4e29109e9b9eacfc9cc2a50451518afd8b809603d30d91def4f838fbeaa4

SHA512
453fd5d0a0e26e3f530ec4c1e59206477418cd3188f3e67e3e2e5475ffce780f7df6ec3b7c884365be2dfa046b41379aaddc41cc77118f00e25c601f32282df4

Download Submit
C:\Windows\System\jDhcoiZ.exe
Filesize
8B

MD5
89b49edfc15b320118dccc63dce276c0

SHA1
d6a182f9e8a009d8ebfef26a1c685fcf2b4f152a

SHA256
b80b4d5110187afa9e6d1cf3e2b0f3429a153e9d0c88c32cabdb6359e19204f1

SHA512
7177d9a15db58801e4f8b1c7970b405645f764452ade86d38cac06f6967fac62b12ef486104093e1892a28c57d2dd25b2fe393363d54d8f0cf2bd6688982c9c6

Download Submit
C:\Windows\System\kOZcBvU.exe
Filesize
1.9MB

MD5
b546443d9d2a90c981236da83688d7f9

SHA1
e6904be12516b78301ab4ebdafa1304414b22694

SHA256
80e2f7387cc2d3f529614b1057dd1b7f355a20b66c6c3279958fc424568049ee

SHA512
bb3eba43b37da719c911314e33f4158bdb339735b0380d61158cba7db188540b126617b662124e2501620bcee6f71fcaf2268611df3cda7def0e1887d91672e0

Download Submit
C:\Windows\System\laquIqB.exe
Filesize
1.9MB

MD5
46e178289588648b1750143dba0a7165

SHA1
bdaf1f788a7e614424665fa373d379c513fa547a

SHA256
c1c17faf0e78769bda08f568639c6f465132731a4cd6546cad2f2a5c5b5d05eb

SHA512
c3b6ab38fc4f1f59c5f07d3f40c41005b95e7400bffa4c7ab1b87f1c58db6f37109a5aa7eec5f35f93027ae2d9783ea2ba87cd0d4e26a7220892bcad49189f3d

Download Submit
C:\Windows\System\pxIBnJM.exe
Filesize
1.9MB

MD5
fc204490c1bd3cbcc2b0b9b0d90f3e45

SHA1
61d938dd7f306e8655ed936562a3ac2db933029b

SHA256
35dd1efa75606f447a520a98fa766c74fe57b027a89043da316b6840e21478bb

SHA512
19599e4d939bad4495be6bb8cfecd7fd0316d43f4322f41c122d6f0bf60494cc9861554b9c659ff6592a0b897eeec5ca5c74d81d030501a2ee217dc11f84cd8e

Download Submit
C:\Windows\System\qxQKofI.exe
Filesize
1.9MB

MD5
5890d24388adbf811e66f0d6e81683ba

SHA1
ad1e88aadd9b01ee89baef05c04960a42323af40

SHA256
36fe16fda49779ad87ac7c8e8395502505340182574097118fa97404ec575269

SHA512
c275c35c2294de6440322c0494f0bd28b8af8b808bded2b3a9d75dc72905efca63a4d10245862b10b7b247e27ec910f1c6df70c4279979f7859d2f3b7a2b7161

Download Submit
C:\Windows\System\rOaEJzM.exe
Filesize
1.9MB

MD5
3ef0ecf27203f6ebf4518a706a6050e6

SHA1
0483bdc623e31c80d1811092ca12b8e20c2ff23d

SHA256
14a1fbc87c71d9065e2dfd2710ab7b18f66acf7dc8035d0d0d603abaa8a27c86

SHA512
867ffe660f3ba6872fb147277fa1041dc8e03c7f70cad6ddd062c6670d83759951c0acf3a1ee9120f008da19f37dce6a750c2c39eff299c6c90499ce23a58a0a

Download Submit
C:\Windows\System\rRxxQEI.exe
Filesize
1.9MB

MD5
dc2e49e0b604026f856987ca64477a35

SHA1
4ad68faf80eaa824b5ba5419090367e100431ff8

SHA256
6bd99c323631b431ba04a7b8e4fe7f55eb8f9646282034ad6e26c6fd9aa1bf2c

SHA512
3cebdeffd56a59e4da48b4724688f413440b9e83b19d4f87fab6bfb5d9d7df2d44575ccc09c1b5b09f725dd32378f5e48374e139f626290d0d0c988436c0f389

Download Submit
C:\Windows\System\sCQCFjj.exe
Filesize
1.9MB

MD5
54ab3efb55aaffb41678d3abadec4e33

SHA1
0db2138ac5087731340fff3824d096e98180ecae

SHA256
109942ca82ef0f191f48ac6d4016f82053a225641789acb97de338d858583fd1

SHA512
df1a2a0f2e173afb556937828f9c74727cd40b74fc9e47512945d5c94cbba97b4d16eaed9b6dadb8622ef1c7ec6f19ade4e819f6601e3ac7baeeede81fda9e89

Download Submit
C:\Windows\System\sGGBZaQ.exe
Filesize
1.9MB

MD5
a1f992121107dbc5fdec9fd769c891c2

SHA1
e82a93c9974f0e490563e68710ba4893da76c78a

SHA256
915a892d44d9f91fd806792d236afe5534f888c202c2055b69c64451fdff48a8

SHA512
af91cb04a8a1636a435f2c58f553517f76ba71f8843c58f0c3af0101da2e2fed071221bf3b752f3a546ddcfce665465fc0f0a59eddde64fee6a9cab86a45d4da

Download Submit
C:\Windows\System\sQJxePd.exe
Filesize
1.9MB

MD5
57b8e760f82cd34182a0002d6d769603

SHA1
4befe7a51a74604e116725f1cab95166e02e27fc

SHA256
273e36dca6fb6f1922370241067a9c7d93816a24cbe6c5fb2651fd9c733e2d28

SHA512
26c1448a2828ad528df75731994e60a1232e5ebef7670fd756deaa5d6e680e699c6cd43fb4141bf7a2731d5282b0360ed8f4bcd7ef4d96577dcda225c5da184a

Download Submit
C:\Windows\System\vadwBQv.exe
Filesize
1.9MB

MD5
28c889f7e120f98c35b634796a5b7928

SHA1
0d47e567089a94b2051d75ab0b7420296a2aaa48

SHA256
8b4257d3e6608849f341e828c935c2dc17d2a549bfd6bbd12fc9e44e1c8e08b3

SHA512
7c3478b8783fab2434d77cf32c348efc6092f05e8ef058ec2b513f5ecb718ec98601098ceb3261bdb61a5338ef3e0f32bdb92a590c4118daa2bd2852928ba3f4

Download Submit
C:\Windows\System\wuivwKI.exe
Filesize
1.9MB

MD5
c10dd2c17475c5c40ac4b01759d62fd0

SHA1
60a28088937e48aa1ca839b608777672eb4170a0

SHA256
eaedb102412ae670c12a58b53595f1bb6420504fedfe77008bb897a623a7e713

SHA512
7849ae860038e016364897d6db285aa2dc336a5d11b49b3ef1acca726a36a6cb25768be930b792b2d7183cfb3c5e23e08065532e8551ec496297111dd4207894

Download Submit
C:\Windows\System\yDzmgxt.exe
Filesize
1.9MB

MD5
509d128b91b7a4fd480d3f91b3e66424

SHA1
496ff0eed7f3cfa2681ca9f70257e8c81f6fc5cd

SHA256
ba30efc7757dfd2fd5af100517f51405ede0a4c9b24be178008cb772b527edee

SHA512
8a4dd614df1e0bd8d82c1e61f8e637f4a67812836a5de2139089455a35dc12f3b842d2b2e369f0fa22273b7a161f6e7eba84a69197b9ab4230fc7218c5d9f672

Download Submit
C:\Windows\System\zKlXkvZ.exe
Filesize
1.9MB

MD5
49549720f83b26a5d1d5b3993c54cd0a

SHA1
fdae8c30d9610b2f606723686a4242ec796a6680

SHA256
4bd9dbb659a39242d4d93bd7d6ab5d8a1998176c27e7e7745211bc835302f700

SHA512
8a74d0759e35904dcb34e331304fa933d012f421ecdd20d47ffcd62db6ffd89656442eeded37b261f4be5d358189c7073b53c065e4d7b741f13de9e8c5441783

Download Submit
memory/364-223-0x00007FF782EA0000-0x00007FF783292000-memory.dmp

Filesize
3.9MB

Download
memory/364-4101-0x00007FF782EA0000-0x00007FF783292000-memory.dmp

Filesize
3.9MB

Download
memory/388-268-0x00007FF6F8080000-0x00007FF6F8472000-memory.dmp

Filesize
3.9MB

Download
memory/396-458-0x00007FF77EBD0000-0x00007FF77EFC2000-memory.dmp

Filesize
3.9MB

Download
memory/396-4247-0x00007FF77EBD0000-0x00007FF77EFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-26-0x00007FF67FAB0000-0x00007FF67FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-4040-0x00007FF67FAB0000-0x00007FF67FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1896-12-0x00007FF613430000-0x00007FF613822000-memory.dmp

Filesize
3.9MB

Download
memory/1904-45-0x00007FF6637D0000-0x00007FF663BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1944-4030-0x00007FF700E30000-0x00007FF701222000-memory.dmp

Filesize
3.9MB

Download
memory/1944-74-0x00007FF700E30000-0x00007FF701222000-memory.dmp

Filesize
3.9MB

Download
memory/2152-4140-0x00007FF6F0A30000-0x00007FF6F0E22000-memory.dmp

Filesize
3.9MB

Download
memory/2152-280-0x00007FF6F0A30000-0x00007FF6F0E22000-memory.dmp

Filesize
3.9MB

Download
memory/2256-4233-0x00007FF72F460000-0x00007FF72F852000-memory.dmp

Filesize
3.9MB

Download
memory/2256-375-0x00007FF72F460000-0x00007FF72F852000-memory.dmp

Filesize
3.9MB

Download
memory/2328-4108-0x00007FF708590000-0x00007FF708982000-memory.dmp

Filesize
3.9MB

Download
memory/2328-145-0x00007FF708590000-0x00007FF708982000-memory.dmp

Filesize
3.9MB

Download
memory/2468-882-0x00007FF6505A0000-0x00007FF650992000-memory.dmp

Filesize
3.9MB

Download
memory/2468-4243-0x00007FF6505A0000-0x00007FF650992000-memory.dmp

Filesize
3.9MB

Download
memory/2640-123-0x00007FF632580000-0x00007FF632972000-memory.dmp

Filesize
3.9MB

Download
memory/2640-4052-0x00007FF632580000-0x00007FF632972000-memory.dmp

Filesize
3.9MB

Download
memory/2752-4184-0x00007FF73DF90000-0x00007FF73E382000-memory.dmp

Filesize
3.9MB

Download
memory/2752-730-0x00007FF73DF90000-0x00007FF73E382000-memory.dmp

Filesize
3.9MB

Download
memory/2768-258-0x00007FF6D39D0000-0x00007FF6D3DC2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-4056-0x00007FF6D39D0000-0x00007FF6D3DC2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-4235-0x00007FF6BA020000-0x00007FF6BA412000-memory.dmp

Filesize
3.9MB

Download
memory/2888-372-0x00007FF6BA020000-0x00007FF6BA412000-memory.dmp

Filesize
3.9MB

Download
memory/2924-815-0x00007FF711800000-0x00007FF711BF2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-4238-0x00007FF711800000-0x00007FF711BF2000-memory.dmp

Filesize
3.9MB

Download
memory/3116-391-0x00007FF723140000-0x00007FF723532000-memory.dmp

Filesize
3.9MB

Download
memory/3116-4240-0x00007FF723140000-0x00007FF723532000-memory.dmp

Filesize
3.9MB

Download
memory/3144-654-0x00007FFCEB360000-0x00007FFCEBE21000-memory.dmp

Filesize
10.8MB

Download
memory/3144-4599-0x00007FFCEB360000-0x00007FFCEBE21000-memory.dmp

Filesize
10.8MB

Download
memory/3144-175-0x0000019DBE740000-0x0000019DBE762000-memory.dmp

Filesize
136KB

Download
memory/3144-6-0x00007FFCEB363000-0x00007FFCEB365000-memory.dmp

Filesize
8KB

Download
memory/3144-588-0x00007FFCEB360000-0x00007FFCEBE21000-memory.dmp

Filesize
10.8MB

Download
memory/3144-4150-0x00007FFCEB363000-0x00007FFCEB365000-memory.dmp

Filesize
8KB

Download
memory/3400-4188-0x00007FF669E70000-0x00007FF66A262000-memory.dmp

Filesize
3.9MB

Download
memory/3400-306-0x00007FF669E70000-0x00007FF66A262000-memory.dmp

Filesize
3.9MB

Download
memory/3460-484-0x00007FF70F580000-0x00007FF70F972000-memory.dmp

Filesize
3.9MB

Download
memory/3460-4264-0x00007FF70F580000-0x00007FF70F972000-memory.dmp

Filesize
3.9MB

Download
memory/3616-76-0x00007FF7F6830000-0x00007FF7F6C22000-memory.dmp

Filesize
3.9MB

Download
memory/3616-4046-0x00007FF7F6830000-0x00007FF7F6C22000-memory.dmp

Filesize
3.9MB

Download
memory/4012-4226-0x00007FF6E4FF0000-0x00007FF6E53E2000-memory.dmp

Filesize
3.9MB

Download
memory/4012-336-0x00007FF6E4FF0000-0x00007FF6E53E2000-memory.dmp

Filesize
3.9MB

Download
memory/4720-0-0x00007FF6D2E20000-0x00007FF6D3212000-memory.dmp

Filesize
3.9MB

Download
memory/4720-1-0x000001D2E3720000-0x000001D2E3730000-memory.dmp

Filesize
64KB

Download
memory/4876-4103-0x00007FF7EC440000-0x00007FF7EC832000-memory.dmp

Filesize
3.9MB

Download
memory/4876-213-0x00007FF7EC440000-0x00007FF7EC832000-memory.dmp

Filesize
3.9MB

Download
memory/5016-4053-0x00007FF613450000-0x00007FF613842000-memory.dmp

Filesize
3.9MB

Download
memory/5016-100-0x00007FF613450000-0x00007FF613842000-memory.dmp

Filesize
3.9MB

Download
memory/5060-4135-0x00007FF65F950000-0x00007FF65FD42000-memory.dmp

Filesize
3.9MB

Download
memory/5060-279-0x00007FF65F950000-0x00007FF65FD42000-memory.dmp

Filesize
3.9MB

Download