xmrig | 81f924925a5327a169701722ec0816a243a3e93d9fdacc4d32f3cb0d94bf08dc

Analysis

max time kernel
103s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
Size

1.9MB
MD5

1f9a1ef5c1cc15c14c4eaef1ac92bdd0
SHA1

86e14787d75590e1aad94f40c61ed1772c34a7b4
SHA256

81f924925a5327a169701722ec0816a243a3e93d9fdacc4d32f3cb0d94bf08dc
SHA512

f7ad48ca95f5d83f528e5e266350ae2658f81f2bfc9d71d05fa4034988776af8f48feb423d4da7589543cf301e768c3af9cf7189fad64097bed000ed67d2ef55
SSDEEP

49152:Lz071uv4BPMkyW10/w16BvZX71Fq86z71pg:NABI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/4252-179-0x00007FF794C30000-0x00007FF795022000-memory.dmp	xmrig
behavioral2/memory/4852-182-0x00007FF788940000-0x00007FF788D32000-memory.dmp	xmrig
behavioral2/memory/2736-216-0x00007FF6808D0000-0x00007FF680CC2000-memory.dmp	xmrig
behavioral2/memory/4508-287-0x00007FF7B4B80000-0x00007FF7B4F72000-memory.dmp	xmrig
behavioral2/memory/3332-293-0x00007FF622830000-0x00007FF622C22000-memory.dmp	xmrig
behavioral2/memory/644-299-0x00007FF641040000-0x00007FF641432000-memory.dmp	xmrig
behavioral2/memory/1104-303-0x00007FF798590000-0x00007FF798982000-memory.dmp	xmrig
behavioral2/memory/2012-302-0x00007FF69C3A0000-0x00007FF69C792000-memory.dmp	xmrig
behavioral2/memory/3888-301-0x00007FF711F10000-0x00007FF712302000-memory.dmp	xmrig
behavioral2/memory/2592-300-0x00007FF6914F0000-0x00007FF6918E2000-memory.dmp	xmrig
behavioral2/memory/3748-298-0x00007FF73AD70000-0x00007FF73B162000-memory.dmp	xmrig
behavioral2/memory/2308-297-0x00007FF758B30000-0x00007FF758F22000-memory.dmp	xmrig
behavioral2/memory/1040-296-0x00007FF7FC980000-0x00007FF7FCD72000-memory.dmp	xmrig
behavioral2/memory/1320-295-0x00007FF70B750000-0x00007FF70BB42000-memory.dmp	xmrig
behavioral2/memory/3416-294-0x00007FF712C60000-0x00007FF713052000-memory.dmp	xmrig
behavioral2/memory/3552-265-0x00007FF6FE500000-0x00007FF6FE8F2000-memory.dmp	xmrig
behavioral2/memory/3824-192-0x00007FF67CE70000-0x00007FF67D262000-memory.dmp	xmrig
behavioral2/memory/3028-183-0x00007FF64E830000-0x00007FF64EC22000-memory.dmp	xmrig
behavioral2/memory/4636-144-0x00007FF733BF0000-0x00007FF733FE2000-memory.dmp	xmrig
behavioral2/memory/2852-1960-0x00007FF72DF40000-0x00007FF72E332000-memory.dmp	xmrig
behavioral2/memory/1912-2187-0x00007FF786DA0000-0x00007FF787192000-memory.dmp	xmrig
behavioral2/memory/704-2188-0x00007FF73A9C0000-0x00007FF73ADB2000-memory.dmp	xmrig
behavioral2/memory/1912-2190-0x00007FF786DA0000-0x00007FF787192000-memory.dmp	xmrig
behavioral2/memory/3888-2192-0x00007FF711F10000-0x00007FF712302000-memory.dmp	xmrig
behavioral2/memory/4092-2194-0x00007FF709B80000-0x00007FF709F72000-memory.dmp	xmrig
behavioral2/memory/4252-2196-0x00007FF794C30000-0x00007FF795022000-memory.dmp	xmrig
behavioral2/memory/4636-2198-0x00007FF733BF0000-0x00007FF733FE2000-memory.dmp	xmrig
behavioral2/memory/2924-2200-0x00007FF7D1800000-0x00007FF7D1BF2000-memory.dmp	xmrig
behavioral2/memory/5036-2207-0x00007FF7F6C20000-0x00007FF7F7012000-memory.dmp	xmrig
behavioral2/memory/2592-2210-0x00007FF6914F0000-0x00007FF6918E2000-memory.dmp	xmrig
behavioral2/memory/3332-2214-0x00007FF622830000-0x00007FF622C22000-memory.dmp	xmrig
behavioral2/memory/2736-2213-0x00007FF6808D0000-0x00007FF680CC2000-memory.dmp	xmrig
behavioral2/memory/1320-2216-0x00007FF70B750000-0x00007FF70BB42000-memory.dmp	xmrig
behavioral2/memory/704-2209-0x00007FF73A9C0000-0x00007FF73ADB2000-memory.dmp	xmrig
behavioral2/memory/4852-2205-0x00007FF788940000-0x00007FF788D32000-memory.dmp	xmrig
behavioral2/memory/3028-2203-0x00007FF64E830000-0x00007FF64EC22000-memory.dmp	xmrig
behavioral2/memory/3416-2245-0x00007FF712C60000-0x00007FF713052000-memory.dmp	xmrig
behavioral2/memory/2308-2242-0x00007FF758B30000-0x00007FF758F22000-memory.dmp	xmrig
behavioral2/memory/3824-2239-0x00007FF67CE70000-0x00007FF67D262000-memory.dmp	xmrig
behavioral2/memory/1104-2294-0x00007FF798590000-0x00007FF798982000-memory.dmp	xmrig
behavioral2/memory/4508-2370-0x00007FF7B4B80000-0x00007FF7B4F72000-memory.dmp	xmrig
behavioral2/memory/644-2315-0x00007FF641040000-0x00007FF641432000-memory.dmp	xmrig
behavioral2/memory/3552-2313-0x00007FF6FE500000-0x00007FF6FE8F2000-memory.dmp	xmrig
behavioral2/memory/3748-2293-0x00007FF73AD70000-0x00007FF73B162000-memory.dmp	xmrig
behavioral2/memory/2012-2236-0x00007FF69C3A0000-0x00007FF69C792000-memory.dmp	xmrig
behavioral2/memory/1040-2243-0x00007FF7FC980000-0x00007FF7FCD72000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
10	3228	powershell.exe
12	3228	powershell.exe
14	3228	powershell.exe
15	3228	powershell.exe
17	3228	powershell.exe
21	3228	powershell.exe
22	3228	powershell.exe
27	3228	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3228	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1912	uTUxxfd.exe
4092	bPmzZnQ.exe
704	ckvFYDG.exe
2924	arCSzeA.exe
2592	alzxUGF.exe
5036	aPaHQBn.exe
4636	oJqnfDg.exe
4252	nnMwumf.exe
3888	eGmzHlV.exe
4852	NaPTdLb.exe
3028	MWePBBs.exe
3824	AwJPUnO.exe
2012	FVlrOMy.exe
2736	rYEhyOT.exe
3552	pgeZKGz.exe
4508	bgEfyoj.exe
3332	kHwfoKz.exe
3416	WdQZwPA.exe
1320	UDtfhmv.exe
1040	MUVdXrB.exe
2308	LQTjRAC.exe
1104	SoVIXvF.exe
3748	QIfSoea.exe
644	NNhqfPD.exe
2768	YqwuHKa.exe
5028	IDdpCHf.exe
4232	DrTETOc.exe
5092	GCBvWSd.exe
3600	lhFavNs.exe
3744	HbNlZSN.exe
2580	CsALFIq.exe
3724	JdhBIaS.exe
3012	WDqwymv.exe
3524	zAyxqGQ.exe
3568	TQfJzhv.exe
1400	ffWjFGK.exe
2692	yDyWExC.exe
876	zXfMzVD.exe
1372	HZDuAMO.exe
968	bMcfZmU.exe
3840	pXkiHEJ.exe
4472	anVgGDr.exe
536	ETSVZbP.exe
1204	YvHDxAO.exe
3264	XhgBxaj.exe
2464	PFpeOcR.exe
4384	vsoZRTl.exe
4172	IlvyUDE.exe
4260	fvxqMLa.exe
940	RxqqIjd.exe
2520	zQGZfGJ.exe
3820	jWJDOJO.exe
4400	LzSLmQW.exe
4324	zlzFckz.exe
860	rdTJduL.exe
1632	dBGoshv.exe
5012	AYKcoPH.exe
3676	xldOXBG.exe
116	bnJOjQi.exe
4904	jBdrRGN.exe
3704	fhnDJlS.exe
1232	cTyZjdM.exe
2328	HoFVfKY.exe
3880	tmDEhnv.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2852-0-0x00007FF72DF40000-0x00007FF72E332000-memory.dmp	upx
behavioral2/files/0x00080000000234ca-5.dat	upx
behavioral2/files/0x00070000000234cf-7.dat	upx
behavioral2/files/0x00070000000234d2-25.dat	upx
behavioral2/files/0x00070000000234ce-19.dat	upx
behavioral2/memory/704-23-0x00007FF73A9C0000-0x00007FF73ADB2000-memory.dmp	upx
behavioral2/memory/1912-14-0x00007FF786DA0000-0x00007FF787192000-memory.dmp	upx
behavioral2/files/0x00070000000234d0-18.dat	upx
behavioral2/files/0x00070000000234d5-41.dat	upx
behavioral2/memory/4092-38-0x00007FF709B80000-0x00007FF709F72000-memory.dmp	upx
behavioral2/files/0x00070000000234d6-56.dat	upx
behavioral2/files/0x00070000000234d4-34.dat	upx
behavioral2/files/0x00070000000234d3-33.dat	upx
behavioral2/memory/2924-72-0x00007FF7D1800000-0x00007FF7D1BF2000-memory.dmp	upx
behavioral2/files/0x00070000000234d8-69.dat	upx
behavioral2/files/0x00070000000234de-102.dat	upx
behavioral2/files/0x00070000000234d7-59.dat	upx
behavioral2/files/0x00070000000234db-85.dat	upx
behavioral2/files/0x00070000000234d1-30.dat	upx
behavioral2/memory/5036-112-0x00007FF7F6C20000-0x00007FF7F7012000-memory.dmp	upx
behavioral2/files/0x00070000000234eb-137.dat	upx
behavioral2/memory/4252-179-0x00007FF794C30000-0x00007FF795022000-memory.dmp	upx
behavioral2/files/0x00070000000234ef-175.dat	upx
behavioral2/files/0x00070000000234ea-171.dat	upx
behavioral2/memory/4852-182-0x00007FF788940000-0x00007FF788D32000-memory.dmp	upx
behavioral2/files/0x00070000000234f2-187.dat	upx
behavioral2/memory/2736-216-0x00007FF6808D0000-0x00007FF680CC2000-memory.dmp	upx
behavioral2/memory/4508-287-0x00007FF7B4B80000-0x00007FF7B4F72000-memory.dmp	upx
behavioral2/memory/3332-293-0x00007FF622830000-0x00007FF622C22000-memory.dmp	upx
behavioral2/memory/644-299-0x00007FF641040000-0x00007FF641432000-memory.dmp	upx
behavioral2/memory/1104-303-0x00007FF798590000-0x00007FF798982000-memory.dmp	upx
behavioral2/memory/2012-302-0x00007FF69C3A0000-0x00007FF69C792000-memory.dmp	upx
behavioral2/memory/3888-301-0x00007FF711F10000-0x00007FF712302000-memory.dmp	upx
behavioral2/memory/2592-300-0x00007FF6914F0000-0x00007FF6918E2000-memory.dmp	upx
behavioral2/memory/3748-298-0x00007FF73AD70000-0x00007FF73B162000-memory.dmp	upx
behavioral2/memory/2308-297-0x00007FF758B30000-0x00007FF758F22000-memory.dmp	upx
behavioral2/memory/1040-296-0x00007FF7FC980000-0x00007FF7FCD72000-memory.dmp	upx
behavioral2/memory/1320-295-0x00007FF70B750000-0x00007FF70BB42000-memory.dmp	upx
behavioral2/memory/3416-294-0x00007FF712C60000-0x00007FF713052000-memory.dmp	upx
behavioral2/memory/3552-265-0x00007FF6FE500000-0x00007FF6FE8F2000-memory.dmp	upx
behavioral2/memory/3824-192-0x00007FF67CE70000-0x00007FF67D262000-memory.dmp	upx
behavioral2/files/0x00070000000234e3-185.dat	upx
behavioral2/files/0x00070000000234f0-184.dat	upx
behavioral2/memory/3028-183-0x00007FF64E830000-0x00007FF64EC22000-memory.dmp	upx
behavioral2/files/0x00070000000234e1-166.dat	upx
behavioral2/files/0x00080000000234cb-162.dat	upx
behavioral2/files/0x00070000000234e0-161.dat	upx
behavioral2/files/0x00070000000234ee-160.dat	upx
behavioral2/files/0x00070000000234e8-153.dat	upx
behavioral2/files/0x00070000000234ed-152.dat	upx
behavioral2/files/0x00070000000234dc-151.dat	upx
behavioral2/files/0x00070000000234e4-150.dat	upx
behavioral2/files/0x00070000000234ec-147.dat	upx
behavioral2/files/0x00070000000234d9-141.dat	upx
behavioral2/files/0x00070000000234e2-140.dat	upx
behavioral2/files/0x00070000000234e9-132.dat	upx
behavioral2/files/0x00070000000234dd-124.dat	upx
behavioral2/files/0x00070000000234e7-123.dat	upx
behavioral2/files/0x00070000000234e6-122.dat	upx
behavioral2/files/0x00070000000234e5-121.dat	upx
behavioral2/memory/4636-144-0x00007FF733BF0000-0x00007FF733FE2000-memory.dmp	upx
behavioral2/files/0x00070000000234df-104.dat	upx
behavioral2/files/0x00070000000234da-81.dat	upx
behavioral2/memory/2852-1960-0x00007FF72DF40000-0x00007FF72E332000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PFpeOcR.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\ZzzWmdN.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\nTQeCuw.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\lhEQFoJ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\CdYNIAA.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\ZbeELMh.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\uTUxxfd.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\lhFavNs.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\XhgBxaj.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\FEvWpfS.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\tbICcJJ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\fYqSvKa.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\zVUBCID.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\NXIxByS.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\RGPXVHq.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\XtlIXBi.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\TGKKhHX.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\hrBjYjm.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\yZTDyFf.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\bxdplgU.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\fRatLCu.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\KAEzwUH.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\zQGZfGJ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\WQmleok.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\ADoKmbV.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\pWEhXyZ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\KPOOipf.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\EuWmHGQ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\WDqwymv.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\iVmLhXq.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\CqUAWxi.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\DjpnAOj.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\VgSWeoO.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\kuCihyS.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\HbNlZSN.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\spsGgZc.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\WufBxdb.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\QFtZtGY.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\mVGFcGb.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\KXZnydP.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\MKsDoYX.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\crTDUAF.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\nnMwumf.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\McbUPTX.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\HMwmvJs.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\ewiVPhI.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\XUaUZDW.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\bMCSeue.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\YvHDxAO.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\jBdrRGN.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\vTqbKbr.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\rriARai.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\iFJwLPe.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\tlykkYm.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\RnkFaOl.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\gHhcznk.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\JRbAwnH.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\YqRCLKZ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\PBUzYFj.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\vsCVUle.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\AHBElKS.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\dkPjkhF.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\eHlCnjZ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\khOCwZp.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3228	powershell.exe
3228	powershell.exe
3228	powershell.exe
3228	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
Token: SeLockMemoryPrivilege	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
Token: SeDebugPrivilege	3228	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3228	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	85
PID 2852 wrote to memory of 3228	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	85
PID 2852 wrote to memory of 1912	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	86
PID 2852 wrote to memory of 1912	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	86
PID 2852 wrote to memory of 704	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	87
PID 2852 wrote to memory of 704	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	87
PID 2852 wrote to memory of 2592	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	88
PID 2852 wrote to memory of 2592	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	88
PID 2852 wrote to memory of 4092	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	89
PID 2852 wrote to memory of 4092	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	89
PID 2852 wrote to memory of 5036	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	90
PID 2852 wrote to memory of 5036	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	90
PID 2852 wrote to memory of 2924	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	91
PID 2852 wrote to memory of 2924	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	91
PID 2852 wrote to memory of 4636	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	92
PID 2852 wrote to memory of 4636	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	92
PID 2852 wrote to memory of 4252	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	93
PID 2852 wrote to memory of 4252	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	93
PID 2852 wrote to memory of 3888	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	94
PID 2852 wrote to memory of 3888	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	94
PID 2852 wrote to memory of 4852	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	95
PID 2852 wrote to memory of 4852	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	95
PID 2852 wrote to memory of 3028	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	96
PID 2852 wrote to memory of 3028	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	96
PID 2852 wrote to memory of 3824	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	97
PID 2852 wrote to memory of 3824	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	97
PID 2852 wrote to memory of 2012	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	98
PID 2852 wrote to memory of 2012	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	98
PID 2852 wrote to memory of 2736	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	99
PID 2852 wrote to memory of 2736	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	99
PID 2852 wrote to memory of 3552	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	100
PID 2852 wrote to memory of 3552	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	100
PID 2852 wrote to memory of 4508	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	101
PID 2852 wrote to memory of 4508	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	101
PID 2852 wrote to memory of 3332	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	102
PID 2852 wrote to memory of 3332	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	102
PID 2852 wrote to memory of 3416	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	103
PID 2852 wrote to memory of 3416	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	103
PID 2852 wrote to memory of 1320	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	104
PID 2852 wrote to memory of 1320	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	104
PID 2852 wrote to memory of 1040	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	105
PID 2852 wrote to memory of 1040	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	105
PID 2852 wrote to memory of 2308	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	106
PID 2852 wrote to memory of 2308	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	106
PID 2852 wrote to memory of 2580	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	107
PID 2852 wrote to memory of 2580	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	107
PID 2852 wrote to memory of 1104	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	108
PID 2852 wrote to memory of 1104	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	108
PID 2852 wrote to memory of 3748	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	109
PID 2852 wrote to memory of 3748	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	109
PID 2852 wrote to memory of 644	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	110
PID 2852 wrote to memory of 644	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	110
PID 2852 wrote to memory of 2768	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	111
PID 2852 wrote to memory of 2768	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	111
PID 2852 wrote to memory of 5028	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	112
PID 2852 wrote to memory of 5028	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	112
PID 2852 wrote to memory of 4232	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	113
PID 2852 wrote to memory of 4232	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	113
PID 2852 wrote to memory of 5092	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	114
PID 2852 wrote to memory of 5092	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	114
PID 2852 wrote to memory of 3600	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	115
PID 2852 wrote to memory of 3600	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	115
PID 2852 wrote to memory of 3744	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	116
PID 2852 wrote to memory of 3744	2852	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	116

C:\Users\Admin\AppData\Local\Temp\1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
"C:\Users\Admin\AppData\Local\Temp\1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3228
- C:\Windows\System\uTUxxfd.exe
  C:\Windows\System\uTUxxfd.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\ckvFYDG.exe
  C:\Windows\System\ckvFYDG.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\alzxUGF.exe
  C:\Windows\System\alzxUGF.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\bPmzZnQ.exe
  C:\Windows\System\bPmzZnQ.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\aPaHQBn.exe
  C:\Windows\System\aPaHQBn.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\arCSzeA.exe
  C:\Windows\System\arCSzeA.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\oJqnfDg.exe
  C:\Windows\System\oJqnfDg.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\nnMwumf.exe
  C:\Windows\System\nnMwumf.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\eGmzHlV.exe
  C:\Windows\System\eGmzHlV.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\NaPTdLb.exe
  C:\Windows\System\NaPTdLb.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\MWePBBs.exe
  C:\Windows\System\MWePBBs.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\AwJPUnO.exe
  C:\Windows\System\AwJPUnO.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\FVlrOMy.exe
  C:\Windows\System\FVlrOMy.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\rYEhyOT.exe
  C:\Windows\System\rYEhyOT.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\pgeZKGz.exe
  C:\Windows\System\pgeZKGz.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\bgEfyoj.exe
  C:\Windows\System\bgEfyoj.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\kHwfoKz.exe
  C:\Windows\System\kHwfoKz.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\WdQZwPA.exe
  C:\Windows\System\WdQZwPA.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\UDtfhmv.exe
  C:\Windows\System\UDtfhmv.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\MUVdXrB.exe
  C:\Windows\System\MUVdXrB.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\LQTjRAC.exe
  C:\Windows\System\LQTjRAC.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\CsALFIq.exe
  C:\Windows\System\CsALFIq.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\SoVIXvF.exe
  C:\Windows\System\SoVIXvF.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\QIfSoea.exe
  C:\Windows\System\QIfSoea.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\NNhqfPD.exe
  C:\Windows\System\NNhqfPD.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\YqwuHKa.exe
  C:\Windows\System\YqwuHKa.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\IDdpCHf.exe
  C:\Windows\System\IDdpCHf.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\DrTETOc.exe
  C:\Windows\System\DrTETOc.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\GCBvWSd.exe
  C:\Windows\System\GCBvWSd.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\lhFavNs.exe
  C:\Windows\System\lhFavNs.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\HbNlZSN.exe
  C:\Windows\System\HbNlZSN.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\JdhBIaS.exe
  C:\Windows\System\JdhBIaS.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\WDqwymv.exe
  C:\Windows\System\WDqwymv.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\zAyxqGQ.exe
  C:\Windows\System\zAyxqGQ.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\TQfJzhv.exe
  C:\Windows\System\TQfJzhv.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\ffWjFGK.exe
  C:\Windows\System\ffWjFGK.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\yDyWExC.exe
  C:\Windows\System\yDyWExC.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\ETSVZbP.exe
  C:\Windows\System\ETSVZbP.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\zXfMzVD.exe
  C:\Windows\System\zXfMzVD.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\HZDuAMO.exe
  C:\Windows\System\HZDuAMO.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\bMcfZmU.exe
  C:\Windows\System\bMcfZmU.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\pXkiHEJ.exe
  C:\Windows\System\pXkiHEJ.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\anVgGDr.exe
  C:\Windows\System\anVgGDr.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\YvHDxAO.exe
  C:\Windows\System\YvHDxAO.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\XhgBxaj.exe
  C:\Windows\System\XhgBxaj.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\PFpeOcR.exe
  C:\Windows\System\PFpeOcR.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\vsoZRTl.exe
  C:\Windows\System\vsoZRTl.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\IlvyUDE.exe
  C:\Windows\System\IlvyUDE.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\fvxqMLa.exe
  C:\Windows\System\fvxqMLa.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\dLAXJPB.exe
  C:\Windows\System\dLAXJPB.exe
  2⤵
  PID:880
- C:\Windows\System\RxqqIjd.exe
  C:\Windows\System\RxqqIjd.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\zQGZfGJ.exe
  C:\Windows\System\zQGZfGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\jWJDOJO.exe
  C:\Windows\System\jWJDOJO.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\LzSLmQW.exe
  C:\Windows\System\LzSLmQW.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\zlzFckz.exe
  C:\Windows\System\zlzFckz.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\rdTJduL.exe
  C:\Windows\System\rdTJduL.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\dBGoshv.exe
  C:\Windows\System\dBGoshv.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\AYKcoPH.exe
  C:\Windows\System\AYKcoPH.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\xldOXBG.exe
  C:\Windows\System\xldOXBG.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\bnJOjQi.exe
  C:\Windows\System\bnJOjQi.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\jBdrRGN.exe
  C:\Windows\System\jBdrRGN.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\fhnDJlS.exe
  C:\Windows\System\fhnDJlS.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\cTyZjdM.exe
  C:\Windows\System\cTyZjdM.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\HoFVfKY.exe
  C:\Windows\System\HoFVfKY.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\tmDEhnv.exe
  C:\Windows\System\tmDEhnv.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\udNuMlZ.exe
  C:\Windows\System\udNuMlZ.exe
  2⤵
  PID:3756
- C:\Windows\System\bxdplgU.exe
  C:\Windows\System\bxdplgU.exe
  2⤵
  PID:2168
- C:\Windows\System\ufFAhQu.exe
  C:\Windows\System\ufFAhQu.exe
  2⤵
  PID:840
- C:\Windows\System\MEjgvMY.exe
  C:\Windows\System\MEjgvMY.exe
  2⤵
  PID:952
- C:\Windows\System\FmIXGOW.exe
  C:\Windows\System\FmIXGOW.exe
  2⤵
  PID:4864
- C:\Windows\System\suliCzQ.exe
  C:\Windows\System\suliCzQ.exe
  2⤵
  PID:4380
- C:\Windows\System\rPXyggq.exe
  C:\Windows\System\rPXyggq.exe
  2⤵
  PID:3940
- C:\Windows\System\UWxmCBW.exe
  C:\Windows\System\UWxmCBW.exe
  2⤵
  PID:4936
- C:\Windows\System\eeYdRzD.exe
  C:\Windows\System\eeYdRzD.exe
  2⤵
  PID:1008
- C:\Windows\System\axdXnId.exe
  C:\Windows\System\axdXnId.exe
  2⤵
  PID:1416
- C:\Windows\System\nDCDkqw.exe
  C:\Windows\System\nDCDkqw.exe
  2⤵
  PID:60
- C:\Windows\System\jbVXFMw.exe
  C:\Windows\System\jbVXFMw.exe
  2⤵
  PID:4372
- C:\Windows\System\kFSQDMn.exe
  C:\Windows\System\kFSQDMn.exe
  2⤵
  PID:5176
- C:\Windows\System\uTLpRUc.exe
  C:\Windows\System\uTLpRUc.exe
  2⤵
  PID:5204
- C:\Windows\System\NAEGieW.exe
  C:\Windows\System\NAEGieW.exe
  2⤵
  PID:5728
- C:\Windows\System\jTOBtAJ.exe
  C:\Windows\System\jTOBtAJ.exe
  2⤵
  PID:5976
- C:\Windows\System\tVJctuI.exe
  C:\Windows\System\tVJctuI.exe
  2⤵
  PID:6012
- C:\Windows\System\ALVOtux.exe
  C:\Windows\System\ALVOtux.exe
  2⤵
  PID:6028
- C:\Windows\System\YqyKYRh.exe
  C:\Windows\System\YqyKYRh.exe
  2⤵
  PID:6044
- C:\Windows\System\JGuUYYm.exe
  C:\Windows\System\JGuUYYm.exe
  2⤵
  PID:6064
- C:\Windows\System\dDpzsbH.exe
  C:\Windows\System\dDpzsbH.exe
  2⤵
  PID:6128
- C:\Windows\System\vXIWHMt.exe
  C:\Windows\System\vXIWHMt.exe
  2⤵
  PID:2784
- C:\Windows\System\wjNwmlk.exe
  C:\Windows\System\wjNwmlk.exe
  2⤵
  PID:2572
- C:\Windows\System\juckPSs.exe
  C:\Windows\System\juckPSs.exe
  2⤵
  PID:2100
- C:\Windows\System\qrdxcoX.exe
  C:\Windows\System\qrdxcoX.exe
  2⤵
  PID:1036
- C:\Windows\System\biNwSwt.exe
  C:\Windows\System\biNwSwt.exe
  2⤵
  PID:4344
- C:\Windows\System\DjpnAOj.exe
  C:\Windows\System\DjpnAOj.exe
  2⤵
  PID:4368
- C:\Windows\System\NzxUpET.exe
  C:\Windows\System\NzxUpET.exe
  2⤵
  PID:348
- C:\Windows\System\LoaMFKB.exe
  C:\Windows\System\LoaMFKB.exe
  2⤵
  PID:4084
- C:\Windows\System\QWaHRDh.exe
  C:\Windows\System\QWaHRDh.exe
  2⤵
  PID:996
- C:\Windows\System\znoElpg.exe
  C:\Windows\System\znoElpg.exe
  2⤵
  PID:1284
- C:\Windows\System\HNiqFVj.exe
  C:\Windows\System\HNiqFVj.exe
  2⤵
  PID:3484
- C:\Windows\System\wwyvCJC.exe
  C:\Windows\System\wwyvCJC.exe
  2⤵
  PID:548
- C:\Windows\System\zYrdULQ.exe
  C:\Windows\System\zYrdULQ.exe
  2⤵
  PID:4536
- C:\Windows\System\UhazDvJ.exe
  C:\Windows\System\UhazDvJ.exe
  2⤵
  PID:4180
- C:\Windows\System\ZxapduD.exe
  C:\Windows\System\ZxapduD.exe
  2⤵
  PID:5124
- C:\Windows\System\BsFtSev.exe
  C:\Windows\System\BsFtSev.exe
  2⤵
  PID:5196
- C:\Windows\System\XocwzrS.exe
  C:\Windows\System\XocwzrS.exe
  2⤵
  PID:5288
- C:\Windows\System\xUbDNDn.exe
  C:\Windows\System\xUbDNDn.exe
  2⤵
  PID:5508
- C:\Windows\System\hQSnFGE.exe
  C:\Windows\System\hQSnFGE.exe
  2⤵
  PID:1640
- C:\Windows\System\zRASgzu.exe
  C:\Windows\System\zRASgzu.exe
  2⤵
  PID:5688
- C:\Windows\System\ZzzWmdN.exe
  C:\Windows\System\ZzzWmdN.exe
  2⤵
  PID:5696
- C:\Windows\System\HOrPKRw.exe
  C:\Windows\System\HOrPKRw.exe
  2⤵
  PID:5800
- C:\Windows\System\QXJJILg.exe
  C:\Windows\System\QXJJILg.exe
  2⤵
  PID:5760
- C:\Windows\System\krVKIDc.exe
  C:\Windows\System\krVKIDc.exe
  2⤵
  PID:5780
- C:\Windows\System\ZqKEPsL.exe
  C:\Windows\System\ZqKEPsL.exe
  2⤵
  PID:2336
- C:\Windows\System\vTqbKbr.exe
  C:\Windows\System\vTqbKbr.exe
  2⤵
  PID:2684
- C:\Windows\System\cVIvLZG.exe
  C:\Windows\System\cVIvLZG.exe
  2⤵
  PID:1728
- C:\Windows\System\WXbabTD.exe
  C:\Windows\System\WXbabTD.exe
  2⤵
  PID:4668
- C:\Windows\System\oCEZvEJ.exe
  C:\Windows\System\oCEZvEJ.exe
  2⤵
  PID:4968
- C:\Windows\System\OxfOzju.exe
  C:\Windows\System\OxfOzju.exe
  2⤵
  PID:1880
- C:\Windows\System\SigeaXj.exe
  C:\Windows\System\SigeaXj.exe
  2⤵
  PID:1664
- C:\Windows\System\cwIGUSt.exe
  C:\Windows\System\cwIGUSt.exe
  2⤵
  PID:2588
- C:\Windows\System\DQlRJuT.exe
  C:\Windows\System\DQlRJuT.exe
  2⤵
  PID:1064
- C:\Windows\System\OzCkYuc.exe
  C:\Windows\System\OzCkYuc.exe
  2⤵
  PID:1424
- C:\Windows\System\LikUNhY.exe
  C:\Windows\System\LikUNhY.exe
  2⤵
  PID:4952
- C:\Windows\System\naSqfAR.exe
  C:\Windows\System\naSqfAR.exe
  2⤵
  PID:4360
- C:\Windows\System\pVomhRl.exe
  C:\Windows\System\pVomhRl.exe
  2⤵
  PID:64
- C:\Windows\System\nTQeCuw.exe
  C:\Windows\System\nTQeCuw.exe
  2⤵
  PID:3548
- C:\Windows\System\oZGIIkG.exe
  C:\Windows\System\oZGIIkG.exe
  2⤵
  PID:5340
- C:\Windows\System\McvCTFh.exe
  C:\Windows\System\McvCTFh.exe
  2⤵
  PID:5316
- C:\Windows\System\KkfCmqB.exe
  C:\Windows\System\KkfCmqB.exe
  2⤵
  PID:5932
- C:\Windows\System\FEvWpfS.exe
  C:\Windows\System\FEvWpfS.exe
  2⤵
  PID:5948
- C:\Windows\System\cvmiHmJ.exe
  C:\Windows\System\cvmiHmJ.exe
  2⤵
  PID:6000
- C:\Windows\System\qxxUclq.exe
  C:\Windows\System\qxxUclq.exe
  2⤵
  PID:1476
- C:\Windows\System\HkTyWCo.exe
  C:\Windows\System\HkTyWCo.exe
  2⤵
  PID:4908
- C:\Windows\System\IflneAz.exe
  C:\Windows\System\IflneAz.exe
  2⤵
  PID:6096
- C:\Windows\System\FXrVJEh.exe
  C:\Windows\System\FXrVJEh.exe
  2⤵
  PID:2124
- C:\Windows\System\MFjyydC.exe
  C:\Windows\System\MFjyydC.exe
  2⤵
  PID:3556
- C:\Windows\System\kchKavO.exe
  C:\Windows\System\kchKavO.exe
  2⤵
  PID:2908
- C:\Windows\System\NBvHtIt.exe
  C:\Windows\System\NBvHtIt.exe
  2⤵
  PID:5032
- C:\Windows\System\VGRafLi.exe
  C:\Windows\System\VGRafLi.exe
  2⤵
  PID:2300
- C:\Windows\System\FmLjoVY.exe
  C:\Windows\System\FmLjoVY.exe
  2⤵
  PID:208
- C:\Windows\System\yOucYJn.exe
  C:\Windows\System\yOucYJn.exe
  2⤵
  PID:5072
- C:\Windows\System\hvwkeht.exe
  C:\Windows\System\hvwkeht.exe
  2⤵
  PID:2500
- C:\Windows\System\rkgLref.exe
  C:\Windows\System\rkgLref.exe
  2⤵
  PID:4808
- C:\Windows\System\UYcdRht.exe
  C:\Windows\System\UYcdRht.exe
  2⤵
  PID:5684
- C:\Windows\System\KXZnydP.exe
  C:\Windows\System\KXZnydP.exe
  2⤵
  PID:5708
- C:\Windows\System\VITFamZ.exe
  C:\Windows\System\VITFamZ.exe
  2⤵
  PID:5736
- C:\Windows\System\ZEFVHia.exe
  C:\Windows\System\ZEFVHia.exe
  2⤵
  PID:3348
- C:\Windows\System\BsSCyCo.exe
  C:\Windows\System\BsSCyCo.exe
  2⤵
  PID:4044
- C:\Windows\System\NzUeQYP.exe
  C:\Windows\System\NzUeQYP.exe
  2⤵
  PID:4304
- C:\Windows\System\tRMJICr.exe
  C:\Windows\System\tRMJICr.exe
  2⤵
  PID:5724
- C:\Windows\System\AYhtGQX.exe
  C:\Windows\System\AYhtGQX.exe
  2⤵
  PID:5004
- C:\Windows\System\vGTkdJX.exe
  C:\Windows\System\vGTkdJX.exe
  2⤵
  PID:4792
- C:\Windows\System\HKESIcM.exe
  C:\Windows\System\HKESIcM.exe
  2⤵
  PID:628
- C:\Windows\System\eReXVCE.exe
  C:\Windows\System\eReXVCE.exe
  2⤵
  PID:6156
- C:\Windows\System\lhEQFoJ.exe
  C:\Windows\System\lhEQFoJ.exe
  2⤵
  PID:6188
- C:\Windows\System\Gyhqakt.exe
  C:\Windows\System\Gyhqakt.exe
  2⤵
  PID:6208
- C:\Windows\System\AXnSRXJ.exe
  C:\Windows\System\AXnSRXJ.exe
  2⤵
  PID:6232
- C:\Windows\System\rkbQbkA.exe
  C:\Windows\System\rkbQbkA.exe
  2⤵
  PID:6248
- C:\Windows\System\NXIxByS.exe
  C:\Windows\System\NXIxByS.exe
  2⤵
  PID:6276
- C:\Windows\System\MTVBojf.exe
  C:\Windows\System\MTVBojf.exe
  2⤵
  PID:6296
- C:\Windows\System\ounXLLE.exe
  C:\Windows\System\ounXLLE.exe
  2⤵
  PID:6316
- C:\Windows\System\SZZjttr.exe
  C:\Windows\System\SZZjttr.exe
  2⤵
  PID:6344
- C:\Windows\System\DtCPxkh.exe
  C:\Windows\System\DtCPxkh.exe
  2⤵
  PID:6372
- C:\Windows\System\nIDtKJU.exe
  C:\Windows\System\nIDtKJU.exe
  2⤵
  PID:6396
- C:\Windows\System\dmZukBq.exe
  C:\Windows\System\dmZukBq.exe
  2⤵
  PID:6428
- C:\Windows\System\McbUPTX.exe
  C:\Windows\System\McbUPTX.exe
  2⤵
  PID:6444
- C:\Windows\System\CCNAtNp.exe
  C:\Windows\System\CCNAtNp.exe
  2⤵
  PID:6472
- C:\Windows\System\WOwsdJB.exe
  C:\Windows\System\WOwsdJB.exe
  2⤵
  PID:6492
- C:\Windows\System\WrjOnJk.exe
  C:\Windows\System\WrjOnJk.exe
  2⤵
  PID:6520
- C:\Windows\System\KnhRCjM.exe
  C:\Windows\System\KnhRCjM.exe
  2⤵
  PID:6552
- C:\Windows\System\ydYweGj.exe
  C:\Windows\System\ydYweGj.exe
  2⤵
  PID:6572
- C:\Windows\System\aOqqlLX.exe
  C:\Windows\System\aOqqlLX.exe
  2⤵
  PID:6596
- C:\Windows\System\ZazBJEX.exe
  C:\Windows\System\ZazBJEX.exe
  2⤵
  PID:6780
- C:\Windows\System\JGrtkes.exe
  C:\Windows\System\JGrtkes.exe
  2⤵
  PID:6800
- C:\Windows\System\OQyJWZx.exe
  C:\Windows\System\OQyJWZx.exe
  2⤵
  PID:6824
- C:\Windows\System\AyyAnyp.exe
  C:\Windows\System\AyyAnyp.exe
  2⤵
  PID:6844
- C:\Windows\System\XNVhLBf.exe
  C:\Windows\System\XNVhLBf.exe
  2⤵
  PID:6864
- C:\Windows\System\cooIMZf.exe
  C:\Windows\System\cooIMZf.exe
  2⤵
  PID:6888
- C:\Windows\System\oFrDgbA.exe
  C:\Windows\System\oFrDgbA.exe
  2⤵
  PID:6904
- C:\Windows\System\lGVxrca.exe
  C:\Windows\System\lGVxrca.exe
  2⤵
  PID:6932
- C:\Windows\System\ktUBbmp.exe
  C:\Windows\System\ktUBbmp.exe
  2⤵
  PID:6972
- C:\Windows\System\ImZcaUZ.exe
  C:\Windows\System\ImZcaUZ.exe
  2⤵
  PID:7008
- C:\Windows\System\bhRxzyH.exe
  C:\Windows\System\bhRxzyH.exe
  2⤵
  PID:7036
- C:\Windows\System\AyGyDLm.exe
  C:\Windows\System\AyGyDLm.exe
  2⤵
  PID:7056
- C:\Windows\System\fwfyTAN.exe
  C:\Windows\System\fwfyTAN.exe
  2⤵
  PID:7076
- C:\Windows\System\iYgSWDC.exe
  C:\Windows\System\iYgSWDC.exe
  2⤵
  PID:7100
- C:\Windows\System\xJKdYRM.exe
  C:\Windows\System\xJKdYRM.exe
  2⤵
  PID:7128
- C:\Windows\System\gHhcznk.exe
  C:\Windows\System\gHhcznk.exe
  2⤵
  PID:7144
- C:\Windows\System\fMZTqqt.exe
  C:\Windows\System\fMZTqqt.exe
  2⤵
  PID:3032
- C:\Windows\System\WFpMFyU.exe
  C:\Windows\System\WFpMFyU.exe
  2⤵
  PID:4216
- C:\Windows\System\HdiVvjj.exe
  C:\Windows\System\HdiVvjj.exe
  2⤵
  PID:3788
- C:\Windows\System\JRbAwnH.exe
  C:\Windows\System\JRbAwnH.exe
  2⤵
  PID:3480
- C:\Windows\System\IjxeDJJ.exe
  C:\Windows\System\IjxeDJJ.exe
  2⤵
  PID:6076
- C:\Windows\System\djUHLZd.exe
  C:\Windows\System\djUHLZd.exe
  2⤵
  PID:4352
- C:\Windows\System\apbpvoQ.exe
  C:\Windows\System\apbpvoQ.exe
  2⤵
  PID:6172
- C:\Windows\System\XRMCkNS.exe
  C:\Windows\System\XRMCkNS.exe
  2⤵
  PID:5504
- C:\Windows\System\LGjuqRg.exe
  C:\Windows\System\LGjuqRg.exe
  2⤵
  PID:1152
- C:\Windows\System\CFWcQIy.exe
  C:\Windows\System\CFWcQIy.exe
  2⤵
  PID:6380
- C:\Windows\System\jeVDUyz.exe
  C:\Windows\System\jeVDUyz.exe
  2⤵
  PID:5776
- C:\Windows\System\WSSjIrt.exe
  C:\Windows\System\WSSjIrt.exe
  2⤵
  PID:516
- C:\Windows\System\TcNtQfT.exe
  C:\Windows\System\TcNtQfT.exe
  2⤵
  PID:5500
- C:\Windows\System\AcnUuMV.exe
  C:\Windows\System\AcnUuMV.exe
  2⤵
  PID:6108
- C:\Windows\System\WQmleok.exe
  C:\Windows\System\WQmleok.exe
  2⤵
  PID:6136
- C:\Windows\System\VZVVvnG.exe
  C:\Windows\System\VZVVvnG.exe
  2⤵
  PID:2244
- C:\Windows\System\rriARai.exe
  C:\Windows\System\rriARai.exe
  2⤵
  PID:6564
- C:\Windows\System\HQvfprM.exe
  C:\Windows\System\HQvfprM.exe
  2⤵
  PID:4412
- C:\Windows\System\VxGTxMW.exe
  C:\Windows\System\VxGTxMW.exe
  2⤵
  PID:3220
- C:\Windows\System\cUztlRt.exe
  C:\Windows\System\cUztlRt.exe
  2⤵
  PID:6228
- C:\Windows\System\ycgjhFU.exe
  C:\Windows\System\ycgjhFU.exe
  2⤵
  PID:6264
- C:\Windows\System\jDVJuCV.exe
  C:\Windows\System\jDVJuCV.exe
  2⤵
  PID:6352
- C:\Windows\System\LXgrDfm.exe
  C:\Windows\System\LXgrDfm.exe
  2⤵
  PID:6532
- C:\Windows\System\LPtpbEl.exe
  C:\Windows\System\LPtpbEl.exe
  2⤵
  PID:6608
- C:\Windows\System\YqRCLKZ.exe
  C:\Windows\System\YqRCLKZ.exe
  2⤵
  PID:6820
- C:\Windows\System\gsifdWs.exe
  C:\Windows\System\gsifdWs.exe
  2⤵
  PID:6860
- C:\Windows\System\GoyHEaw.exe
  C:\Windows\System\GoyHEaw.exe
  2⤵
  PID:6896
- C:\Windows\System\pDhMziG.exe
  C:\Windows\System\pDhMziG.exe
  2⤵
  PID:6952
- C:\Windows\System\vThVrbu.exe
  C:\Windows\System\vThVrbu.exe
  2⤵
  PID:6988
- C:\Windows\System\maNBzUk.exe
  C:\Windows\System\maNBzUk.exe
  2⤵
  PID:7072
- C:\Windows\System\XYZqZRU.exe
  C:\Windows\System\XYZqZRU.exe
  2⤵
  PID:7112
- C:\Windows\System\wofuORg.exe
  C:\Windows\System\wofuORg.exe
  2⤵
  PID:1340
- C:\Windows\System\fkQhASw.exe
  C:\Windows\System\fkQhASw.exe
  2⤵
  PID:7176
- C:\Windows\System\qWWDUqg.exe
  C:\Windows\System\qWWDUqg.exe
  2⤵
  PID:7196
- C:\Windows\System\XqZLoyW.exe
  C:\Windows\System\XqZLoyW.exe
  2⤵
  PID:7216
- C:\Windows\System\JMrQuXp.exe
  C:\Windows\System\JMrQuXp.exe
  2⤵
  PID:7232
- C:\Windows\System\TENuqWF.exe
  C:\Windows\System\TENuqWF.exe
  2⤵
  PID:7256
- C:\Windows\System\LthmYdO.exe
  C:\Windows\System\LthmYdO.exe
  2⤵
  PID:7272
- C:\Windows\System\fRatLCu.exe
  C:\Windows\System\fRatLCu.exe
  2⤵
  PID:7296
- C:\Windows\System\brQjKpT.exe
  C:\Windows\System\brQjKpT.exe
  2⤵
  PID:7324
- C:\Windows\System\dkPjkhF.exe
  C:\Windows\System\dkPjkhF.exe
  2⤵
  PID:7356
- C:\Windows\System\gUYoReg.exe
  C:\Windows\System\gUYoReg.exe
  2⤵
  PID:7380
- C:\Windows\System\NCLsRVH.exe
  C:\Windows\System\NCLsRVH.exe
  2⤵
  PID:7396
- C:\Windows\System\iRjQyvh.exe
  C:\Windows\System\iRjQyvh.exe
  2⤵
  PID:7428
- C:\Windows\System\hLNZaRB.exe
  C:\Windows\System\hLNZaRB.exe
  2⤵
  PID:7448
- C:\Windows\System\cUFOLcj.exe
  C:\Windows\System\cUFOLcj.exe
  2⤵
  PID:7484
- C:\Windows\System\GQPsRJx.exe
  C:\Windows\System\GQPsRJx.exe
  2⤵
  PID:7508
- C:\Windows\System\weHSOgZ.exe
  C:\Windows\System\weHSOgZ.exe
  2⤵
  PID:7524
- C:\Windows\System\jhTzUnG.exe
  C:\Windows\System\jhTzUnG.exe
  2⤵
  PID:7556
- C:\Windows\System\ncYqkaa.exe
  C:\Windows\System\ncYqkaa.exe
  2⤵
  PID:7576
- C:\Windows\System\uMgFMcz.exe
  C:\Windows\System\uMgFMcz.exe
  2⤵
  PID:7600
- C:\Windows\System\oWTErMp.exe
  C:\Windows\System\oWTErMp.exe
  2⤵
  PID:7620
- C:\Windows\System\JIQAABa.exe
  C:\Windows\System\JIQAABa.exe
  2⤵
  PID:7648
- C:\Windows\System\iYxmhcA.exe
  C:\Windows\System\iYxmhcA.exe
  2⤵
  PID:7668
- C:\Windows\System\AyCIfbR.exe
  C:\Windows\System\AyCIfbR.exe
  2⤵
  PID:7692
- C:\Windows\System\OXpwoeB.exe
  C:\Windows\System\OXpwoeB.exe
  2⤵
  PID:7712
- C:\Windows\System\afLZatW.exe
  C:\Windows\System\afLZatW.exe
  2⤵
  PID:7732
- C:\Windows\System\qoTpSgf.exe
  C:\Windows\System\qoTpSgf.exe
  2⤵
  PID:7752
- C:\Windows\System\lDmxrzd.exe
  C:\Windows\System\lDmxrzd.exe
  2⤵
  PID:7780
- C:\Windows\System\gWxJocm.exe
  C:\Windows\System\gWxJocm.exe
  2⤵
  PID:7800
- C:\Windows\System\LFminUC.exe
  C:\Windows\System\LFminUC.exe
  2⤵
  PID:7824
- C:\Windows\System\NNkRHNp.exe
  C:\Windows\System\NNkRHNp.exe
  2⤵
  PID:7844
- C:\Windows\System\zhFgVnW.exe
  C:\Windows\System\zhFgVnW.exe
  2⤵
  PID:7872
- C:\Windows\System\mSbaNmr.exe
  C:\Windows\System\mSbaNmr.exe
  2⤵
  PID:7892
- C:\Windows\System\PSFbLkN.exe
  C:\Windows\System\PSFbLkN.exe
  2⤵
  PID:7908
- C:\Windows\System\RMGsPZA.exe
  C:\Windows\System\RMGsPZA.exe
  2⤵
  PID:7928
- C:\Windows\System\ADoKmbV.exe
  C:\Windows\System\ADoKmbV.exe
  2⤵
  PID:7948
- C:\Windows\System\SOJAKhk.exe
  C:\Windows\System\SOJAKhk.exe
  2⤵
  PID:7972
- C:\Windows\System\OXwXMUU.exe
  C:\Windows\System\OXwXMUU.exe
  2⤵
  PID:7992
- C:\Windows\System\XxwVYZh.exe
  C:\Windows\System\XxwVYZh.exe
  2⤵
  PID:8012
- C:\Windows\System\PBUzYFj.exe
  C:\Windows\System\PBUzYFj.exe
  2⤵
  PID:8036
- C:\Windows\System\WLuofyI.exe
  C:\Windows\System\WLuofyI.exe
  2⤵
  PID:8052
- C:\Windows\System\KIprGqJ.exe
  C:\Windows\System\KIprGqJ.exe
  2⤵
  PID:8076
- C:\Windows\System\obELxuE.exe
  C:\Windows\System\obELxuE.exe
  2⤵
  PID:8112
- C:\Windows\System\CMqMeAS.exe
  C:\Windows\System\CMqMeAS.exe
  2⤵
  PID:8136
- C:\Windows\System\UkeynEv.exe
  C:\Windows\System\UkeynEv.exe
  2⤵
  PID:8160
- C:\Windows\System\ZUbanND.exe
  C:\Windows\System\ZUbanND.exe
  2⤵
  PID:8176
- C:\Windows\System\tVVKzut.exe
  C:\Windows\System\tVVKzut.exe
  2⤵
  PID:2212
- C:\Windows\System\vULSqBZ.exe
  C:\Windows\System\vULSqBZ.exe
  2⤵
  PID:6816
- C:\Windows\System\bOtUaHA.exe
  C:\Windows\System\bOtUaHA.exe
  2⤵
  PID:5964
- C:\Windows\System\erpFysV.exe
  C:\Windows\System\erpFysV.exe
  2⤵
  PID:6984
- C:\Windows\System\FuShuta.exe
  C:\Windows\System\FuShuta.exe
  2⤵
  PID:7020
- C:\Windows\System\IcSInre.exe
  C:\Windows\System\IcSInre.exe
  2⤵
  PID:6712
- C:\Windows\System\gIKCihJ.exe
  C:\Windows\System\gIKCihJ.exe
  2⤵
  PID:7068
- C:\Windows\System\lawxRMJ.exe
  C:\Windows\System\lawxRMJ.exe
  2⤵
  PID:6836
- C:\Windows\System\aQtMRYu.exe
  C:\Windows\System\aQtMRYu.exe
  2⤵
  PID:6668
- C:\Windows\System\hmwYYrc.exe
  C:\Windows\System\hmwYYrc.exe
  2⤵
  PID:7188
- C:\Windows\System\awakzSa.exe
  C:\Windows\System\awakzSa.exe
  2⤵
  PID:7244
- C:\Windows\System\FwiieOc.exe
  C:\Windows\System\FwiieOc.exe
  2⤵
  PID:7308
- C:\Windows\System\spsGgZc.exe
  C:\Windows\System\spsGgZc.exe
  2⤵
  PID:7364
- C:\Windows\System\BkpMCti.exe
  C:\Windows\System\BkpMCti.exe
  2⤵
  PID:7388
- C:\Windows\System\TmRavqA.exe
  C:\Windows\System\TmRavqA.exe
  2⤵
  PID:5968
- C:\Windows\System\vsCVUle.exe
  C:\Windows\System\vsCVUle.exe
  2⤵
  PID:7472
- C:\Windows\System\jaqAAHQ.exe
  C:\Windows\System\jaqAAHQ.exe
  2⤵
  PID:6332
- C:\Windows\System\YcWqPyu.exe
  C:\Windows\System\YcWqPyu.exe
  2⤵
  PID:7572
- C:\Windows\System\beoGHXE.exe
  C:\Windows\System\beoGHXE.exe
  2⤵
  PID:7612
- C:\Windows\System\jXXXfvp.exe
  C:\Windows\System\jXXXfvp.exe
  2⤵
  PID:7664
- C:\Windows\System\oqFQGbP.exe
  C:\Windows\System\oqFQGbP.exe
  2⤵
  PID:7192
- C:\Windows\System\OMtwuvm.exe
  C:\Windows\System\OMtwuvm.exe
  2⤵
  PID:7772
- C:\Windows\System\tmHZgXF.exe
  C:\Windows\System\tmHZgXF.exe
  2⤵
  PID:7832
- C:\Windows\System\zWYSrEB.exe
  C:\Windows\System\zWYSrEB.exe
  2⤵
  PID:7904
- C:\Windows\System\itYCvbW.exe
  C:\Windows\System\itYCvbW.exe
  2⤵
  PID:8200
- C:\Windows\System\nnveXXq.exe
  C:\Windows\System\nnveXXq.exe
  2⤵
  PID:8224
- C:\Windows\System\kBrZdXP.exe
  C:\Windows\System\kBrZdXP.exe
  2⤵
  PID:8248
- C:\Windows\System\uVOEEyw.exe
  C:\Windows\System\uVOEEyw.exe
  2⤵
  PID:8268
- C:\Windows\System\TaqbUgH.exe
  C:\Windows\System\TaqbUgH.exe
  2⤵
  PID:8288
- C:\Windows\System\RGPXVHq.exe
  C:\Windows\System\RGPXVHq.exe
  2⤵
  PID:8312
- C:\Windows\System\WWIiEzc.exe
  C:\Windows\System\WWIiEzc.exe
  2⤵
  PID:8332
- C:\Windows\System\DsdMSdQ.exe
  C:\Windows\System\DsdMSdQ.exe
  2⤵
  PID:8352
- C:\Windows\System\TVIkwCl.exe
  C:\Windows\System\TVIkwCl.exe
  2⤵
  PID:8380
- C:\Windows\System\HciyiXN.exe
  C:\Windows\System\HciyiXN.exe
  2⤵
  PID:8404
- C:\Windows\System\KJjOHHn.exe
  C:\Windows\System\KJjOHHn.exe
  2⤵
  PID:8440
- C:\Windows\System\bKJuzIy.exe
  C:\Windows\System\bKJuzIy.exe
  2⤵
  PID:8472
- C:\Windows\System\duuFacU.exe
  C:\Windows\System\duuFacU.exe
  2⤵
  PID:8496
- C:\Windows\System\kPGCBUl.exe
  C:\Windows\System\kPGCBUl.exe
  2⤵
  PID:8516
- C:\Windows\System\jnYvdZA.exe
  C:\Windows\System\jnYvdZA.exe
  2⤵
  PID:8540
- C:\Windows\System\CdYNIAA.exe
  C:\Windows\System\CdYNIAA.exe
  2⤵
  PID:8560
- C:\Windows\System\ufsfiEB.exe
  C:\Windows\System\ufsfiEB.exe
  2⤵
  PID:8580
- C:\Windows\System\nYbPzvk.exe
  C:\Windows\System\nYbPzvk.exe
  2⤵
  PID:8604
- C:\Windows\System\UMsXcZJ.exe
  C:\Windows\System\UMsXcZJ.exe
  2⤵
  PID:8624
- C:\Windows\System\KRdxJWf.exe
  C:\Windows\System\KRdxJWf.exe
  2⤵
  PID:8648
- C:\Windows\System\DICDjOI.exe
  C:\Windows\System\DICDjOI.exe
  2⤵
  PID:8672
- C:\Windows\System\hUNAbEj.exe
  C:\Windows\System\hUNAbEj.exe
  2⤵
  PID:8700
- C:\Windows\System\MPIavTZ.exe
  C:\Windows\System\MPIavTZ.exe
  2⤵
  PID:8720
- C:\Windows\System\jAyPNMm.exe
  C:\Windows\System\jAyPNMm.exe
  2⤵
  PID:8744
- C:\Windows\System\JUHXRxv.exe
  C:\Windows\System\JUHXRxv.exe
  2⤵
  PID:8760
- C:\Windows\System\YGZxTVv.exe
  C:\Windows\System\YGZxTVv.exe
  2⤵
  PID:8784
- C:\Windows\System\fePhLPK.exe
  C:\Windows\System\fePhLPK.exe
  2⤵
  PID:8808
- C:\Windows\System\wXsEXDF.exe
  C:\Windows\System\wXsEXDF.exe
  2⤵
  PID:8828
- C:\Windows\System\QwkKmky.exe
  C:\Windows\System\QwkKmky.exe
  2⤵
  PID:8852
- C:\Windows\System\KhCQYRg.exe
  C:\Windows\System\KhCQYRg.exe
  2⤵
  PID:8868
- C:\Windows\System\Kteaxhv.exe
  C:\Windows\System\Kteaxhv.exe
  2⤵
  PID:8908
- C:\Windows\System\LparwCl.exe
  C:\Windows\System\LparwCl.exe
  2⤵
  PID:8928
- C:\Windows\System\rSOCZJR.exe
  C:\Windows\System\rSOCZJR.exe
  2⤵
  PID:8948
- C:\Windows\System\JRJLmyA.exe
  C:\Windows\System\JRJLmyA.exe
  2⤵
  PID:8968
- C:\Windows\System\OlrGeBS.exe
  C:\Windows\System\OlrGeBS.exe
  2⤵
  PID:8992
- C:\Windows\System\akKkarb.exe
  C:\Windows\System\akKkarb.exe
  2⤵
  PID:9012
- C:\Windows\System\ZbeELMh.exe
  C:\Windows\System\ZbeELMh.exe
  2⤵
  PID:9040
- C:\Windows\System\fFiSXIJ.exe
  C:\Windows\System\fFiSXIJ.exe
  2⤵
  PID:9060
- C:\Windows\System\KPbMEYc.exe
  C:\Windows\System\KPbMEYc.exe
  2⤵
  PID:9088
- C:\Windows\System\sWgZAWm.exe
  C:\Windows\System\sWgZAWm.exe
  2⤵
  PID:9108
- C:\Windows\System\XtlIXBi.exe
  C:\Windows\System\XtlIXBi.exe
  2⤵
  PID:9132
- C:\Windows\System\bEVBbMV.exe
  C:\Windows\System\bEVBbMV.exe
  2⤵
  PID:9172
- C:\Windows\System\CPgSUgb.exe
  C:\Windows\System\CPgSUgb.exe
  2⤵
  PID:9192
- C:\Windows\System\XWCSuYp.exe
  C:\Windows\System\XWCSuYp.exe
  2⤵
  PID:6360
- C:\Windows\System\nhqBMJX.exe
  C:\Windows\System\nhqBMJX.exe
  2⤵
  PID:7964
- C:\Windows\System\kLsYIwH.exe
  C:\Windows\System\kLsYIwH.exe
  2⤵
  PID:7340
- C:\Windows\System\TGKKhHX.exe
  C:\Windows\System\TGKKhHX.exe
  2⤵
  PID:8104
- C:\Windows\System\kiQRPbY.exe
  C:\Windows\System\kiQRPbY.exe
  2⤵
  PID:8132
- C:\Windows\System\rprwQqb.exe
  C:\Windows\System\rprwQqb.exe
  2⤵
  PID:4440
- C:\Windows\System\eHlCnjZ.exe
  C:\Windows\System\eHlCnjZ.exe
  2⤵
  PID:6204
- C:\Windows\System\fESQTid.exe
  C:\Windows\System\fESQTid.exe
  2⤵
  PID:6588
- C:\Windows\System\AeVmJDA.exe
  C:\Windows\System\AeVmJDA.exe
  2⤵
  PID:7516
- C:\Windows\System\rDEcAMm.exe
  C:\Windows\System\rDEcAMm.exe
  2⤵
  PID:1544
- C:\Windows\System\tbICcJJ.exe
  C:\Windows\System\tbICcJJ.exe
  2⤵
  PID:5804
- C:\Windows\System\RtkGoFQ.exe
  C:\Windows\System\RtkGoFQ.exe
  2⤵
  PID:7084
- C:\Windows\System\ivwIPWt.exe
  C:\Windows\System\ivwIPWt.exe
  2⤵
  PID:7280
- C:\Windows\System\iVmLhXq.exe
  C:\Windows\System\iVmLhXq.exe
  2⤵
  PID:7708
- C:\Windows\System\xCMtONi.exe
  C:\Windows\System\xCMtONi.exe
  2⤵
  PID:9008
- C:\Windows\System\gaQDnKw.exe
  C:\Windows\System\gaQDnKw.exe
  2⤵
  PID:8256
- C:\Windows\System\xudihVS.exe
  C:\Windows\System\xudihVS.exe
  2⤵
  PID:8280
- C:\Windows\System\zKSLyfc.exe
  C:\Windows\System\zKSLyfc.exe
  2⤵
  PID:8396
- C:\Windows\System\bGDlttH.exe
  C:\Windows\System\bGDlttH.exe
  2⤵
  PID:6676
- C:\Windows\System\dVToxlb.exe
  C:\Windows\System\dVToxlb.exe
  2⤵
  PID:5476
- C:\Windows\System\WufBxdb.exe
  C:\Windows\System\WufBxdb.exe
  2⤵
  PID:8728
- C:\Windows\System\mYNJaOb.exe
  C:\Windows\System\mYNJaOb.exe
  2⤵
  PID:8860
- C:\Windows\System\iWlhFDd.exe
  C:\Windows\System\iWlhFDd.exe
  2⤵
  PID:9028
- C:\Windows\System\UjRvguA.exe
  C:\Windows\System\UjRvguA.exe
  2⤵
  PID:7292
- C:\Windows\System\VtllXRs.exe
  C:\Windows\System\VtllXRs.exe
  2⤵
  PID:7152
- C:\Windows\System\eQIPpdN.exe
  C:\Windows\System\eQIPpdN.exe
  2⤵
  PID:8536
- C:\Windows\System\zQOfsxi.exe
  C:\Windows\System\zQOfsxi.exe
  2⤵
  PID:9236
- C:\Windows\System\hrBjYjm.exe
  C:\Windows\System\hrBjYjm.exe
  2⤵
  PID:9272
- C:\Windows\System\GOdQgsJ.exe
  C:\Windows\System\GOdQgsJ.exe
  2⤵
  PID:9292
- C:\Windows\System\khOCwZp.exe
  C:\Windows\System\khOCwZp.exe
  2⤵
  PID:9312
- C:\Windows\System\TMuidMI.exe
  C:\Windows\System\TMuidMI.exe
  2⤵
  PID:9332
- C:\Windows\System\XQFjrSn.exe
  C:\Windows\System\XQFjrSn.exe
  2⤵
  PID:9356
- C:\Windows\System\AHBElKS.exe
  C:\Windows\System\AHBElKS.exe
  2⤵
  PID:9376
- C:\Windows\System\iOIVNub.exe
  C:\Windows\System\iOIVNub.exe
  2⤵
  PID:9400
- C:\Windows\System\kJmKvxo.exe
  C:\Windows\System\kJmKvxo.exe
  2⤵
  PID:9420
- C:\Windows\System\GhDXdZp.exe
  C:\Windows\System\GhDXdZp.exe
  2⤵
  PID:9448
- C:\Windows\System\HvYswmw.exe
  C:\Windows\System\HvYswmw.exe
  2⤵
  PID:9468
- C:\Windows\System\sOypLGu.exe
  C:\Windows\System\sOypLGu.exe
  2⤵
  PID:9488
- C:\Windows\System\afEFlWC.exe
  C:\Windows\System\afEFlWC.exe
  2⤵
  PID:9512
- C:\Windows\System\YYxWQyJ.exe
  C:\Windows\System\YYxWQyJ.exe
  2⤵
  PID:9548
- C:\Windows\System\HitFvTm.exe
  C:\Windows\System\HitFvTm.exe
  2⤵
  PID:9568
- C:\Windows\System\kgtcSQE.exe
  C:\Windows\System\kgtcSQE.exe
  2⤵
  PID:9588
- C:\Windows\System\eAeYyTy.exe
  C:\Windows\System\eAeYyTy.exe
  2⤵
  PID:9612
- C:\Windows\System\rYRFzeT.exe
  C:\Windows\System\rYRFzeT.exe
  2⤵
  PID:9636
- C:\Windows\System\WvCPQjU.exe
  C:\Windows\System\WvCPQjU.exe
  2⤵
  PID:9656
- C:\Windows\System\OXRmOhH.exe
  C:\Windows\System\OXRmOhH.exe
  2⤵
  PID:9672
- C:\Windows\System\FkddTKz.exe
  C:\Windows\System\FkddTKz.exe
  2⤵
  PID:9712
- C:\Windows\System\YEynFNn.exe
  C:\Windows\System\YEynFNn.exe
  2⤵
  PID:9732
- C:\Windows\System\HQNRnwH.exe
  C:\Windows\System\HQNRnwH.exe
  2⤵
  PID:9752
- C:\Windows\System\mJanGJy.exe
  C:\Windows\System\mJanGJy.exe
  2⤵
  PID:9776
- C:\Windows\System\mqpBKTT.exe
  C:\Windows\System\mqpBKTT.exe
  2⤵
  PID:9804
- C:\Windows\System\uAJCHRp.exe
  C:\Windows\System\uAJCHRp.exe
  2⤵
  PID:9824
- C:\Windows\System\knKtNnB.exe
  C:\Windows\System\knKtNnB.exe
  2⤵
  PID:9844
- C:\Windows\System\MOeYimq.exe
  C:\Windows\System\MOeYimq.exe
  2⤵
  PID:9868
- C:\Windows\System\eKjxDFU.exe
  C:\Windows\System\eKjxDFU.exe
  2⤵
  PID:9888
- C:\Windows\System\pGyZVog.exe
  C:\Windows\System\pGyZVog.exe
  2⤵
  PID:9908
- C:\Windows\System\jYuRBqt.exe
  C:\Windows\System\jYuRBqt.exe
  2⤵
  PID:9928
- C:\Windows\System\acVjOJY.exe
  C:\Windows\System\acVjOJY.exe
  2⤵
  PID:9948
- C:\Windows\System\KxUnBVx.exe
  C:\Windows\System\KxUnBVx.exe
  2⤵
  PID:9968
- C:\Windows\System\bXUnnov.exe
  C:\Windows\System\bXUnnov.exe
  2⤵
  PID:9988
- C:\Windows\System\mMTXDza.exe
  C:\Windows\System\mMTXDza.exe
  2⤵
  PID:10012
- C:\Windows\System\HMwmvJs.exe
  C:\Windows\System\HMwmvJs.exe
  2⤵
  PID:10036
- C:\Windows\System\SRzuSXP.exe
  C:\Windows\System\SRzuSXP.exe
  2⤵
  PID:10060
- C:\Windows\System\TLCVCKS.exe
  C:\Windows\System\TLCVCKS.exe
  2⤵
  PID:10080
- C:\Windows\System\VgSWeoO.exe
  C:\Windows\System\VgSWeoO.exe
  2⤵
  PID:10108
- C:\Windows\System\AVXHYwW.exe
  C:\Windows\System\AVXHYwW.exe
  2⤵
  PID:10128
- C:\Windows\System\XwmMFqI.exe
  C:\Windows\System\XwmMFqI.exe
  2⤵
  PID:10152
- C:\Windows\System\yZTDyFf.exe
  C:\Windows\System\yZTDyFf.exe
  2⤵
  PID:10176
- C:\Windows\System\zmpPvpd.exe
  C:\Windows\System\zmpPvpd.exe
  2⤵
  PID:10200
- C:\Windows\System\lxxjreC.exe
  C:\Windows\System\lxxjreC.exe
  2⤵
  PID:10216
- C:\Windows\System\XhGXcxs.exe
  C:\Windows\System\XhGXcxs.exe
  2⤵
  PID:8620
- C:\Windows\System\OYBXyPD.exe
  C:\Windows\System\OYBXyPD.exe
  2⤵
  PID:7420
- C:\Windows\System\ouqCjRM.exe
  C:\Windows\System\ouqCjRM.exe
  2⤵
  PID:9036
- C:\Windows\System\WXjMOZC.exe
  C:\Windows\System\WXjMOZC.exe
  2⤵
  PID:9104
- C:\Windows\System\AslglGc.exe
  C:\Windows\System\AslglGc.exe
  2⤵
  PID:9156
- C:\Windows\System\iFJwLPe.exe
  C:\Windows\System\iFJwLPe.exe
  2⤵
  PID:8340
- C:\Windows\System\dLTdryD.exe
  C:\Windows\System\dLTdryD.exe
  2⤵
  PID:8368
- C:\Windows\System\mLJaKwU.exe
  C:\Windows\System\mLJaKwU.exe
  2⤵
  PID:6148
- C:\Windows\System\OYTWKsJ.exe
  C:\Windows\System\OYTWKsJ.exe
  2⤵
  PID:6748
- C:\Windows\System\DiSDDyk.exe
  C:\Windows\System\DiSDDyk.exe
  2⤵
  PID:7920
- C:\Windows\System\IcllDsw.exe
  C:\Windows\System\IcllDsw.exe
  2⤵
  PID:8920
- C:\Windows\System\hMKxDyU.exe
  C:\Windows\System\hMKxDyU.exe
  2⤵
  PID:10252
- C:\Windows\System\uOoveMs.exe
  C:\Windows\System\uOoveMs.exe
  2⤵
  PID:10292
- C:\Windows\System\pWEhXyZ.exe
  C:\Windows\System\pWEhXyZ.exe
  2⤵
  PID:10336
- C:\Windows\System\EjzWFCR.exe
  C:\Windows\System\EjzWFCR.exe
  2⤵
  PID:10360
- C:\Windows\System\QFtZtGY.exe
  C:\Windows\System\QFtZtGY.exe
  2⤵
  PID:10380
- C:\Windows\System\VqUCQmG.exe
  C:\Windows\System\VqUCQmG.exe
  2⤵
  PID:10396
- C:\Windows\System\NnZemPJ.exe
  C:\Windows\System\NnZemPJ.exe
  2⤵
  PID:10420
- C:\Windows\System\BwqKTcZ.exe
  C:\Windows\System\BwqKTcZ.exe
  2⤵
  PID:10440
- C:\Windows\System\tHntDKZ.exe
  C:\Windows\System\tHntDKZ.exe
  2⤵
  PID:10464
- C:\Windows\System\LiAXwQW.exe
  C:\Windows\System\LiAXwQW.exe
  2⤵
  PID:10488
- C:\Windows\System\kuCihyS.exe
  C:\Windows\System\kuCihyS.exe
  2⤵
  PID:10508
- C:\Windows\System\HtCOICR.exe
  C:\Windows\System\HtCOICR.exe
  2⤵
  PID:10532
- C:\Windows\System\PkPgHqZ.exe
  C:\Windows\System\PkPgHqZ.exe
  2⤵
  PID:10556
- C:\Windows\System\WyXEdcS.exe
  C:\Windows\System\WyXEdcS.exe
  2⤵
  PID:10580
- C:\Windows\System\hpGvKzu.exe
  C:\Windows\System\hpGvKzu.exe
  2⤵
  PID:10600
- C:\Windows\System\XDkvXKj.exe
  C:\Windows\System\XDkvXKj.exe
  2⤵
  PID:10628
- C:\Windows\System\LPbECrK.exe
  C:\Windows\System\LPbECrK.exe
  2⤵
  PID:10656
- C:\Windows\System\JyILLTw.exe
  C:\Windows\System\JyILLTw.exe
  2⤵
  PID:10676
- C:\Windows\System\RFiqzQh.exe
  C:\Windows\System\RFiqzQh.exe
  2⤵
  PID:10700
- C:\Windows\System\bPVizPT.exe
  C:\Windows\System\bPVizPT.exe
  2⤵
  PID:10720
- C:\Windows\System\LYfbHAN.exe
  C:\Windows\System\LYfbHAN.exe
  2⤵
  PID:10748
- C:\Windows\System\VLtYxAn.exe
  C:\Windows\System\VLtYxAn.exe
  2⤵
  PID:10772
- C:\Windows\System\ZbFaHvW.exe
  C:\Windows\System\ZbFaHvW.exe
  2⤵
  PID:10792
- C:\Windows\System\SesplOg.exe
  C:\Windows\System\SesplOg.exe
  2⤵
  PID:10816
- C:\Windows\System\JOWXHaC.exe
  C:\Windows\System\JOWXHaC.exe
  2⤵
  PID:10840
- C:\Windows\System\JMPYlqO.exe
  C:\Windows\System\JMPYlqO.exe
  2⤵
  PID:10860
- C:\Windows\System\qvZiVsj.exe
  C:\Windows\System\qvZiVsj.exe
  2⤵
  PID:10884
- C:\Windows\System\oobJVQB.exe
  C:\Windows\System\oobJVQB.exe
  2⤵
  PID:10908
- C:\Windows\System\CdBJWbb.exe
  C:\Windows\System\CdBJWbb.exe
  2⤵
  PID:10932
- C:\Windows\System\FrCTYOx.exe
  C:\Windows\System\FrCTYOx.exe
  2⤵
  PID:10956
- C:\Windows\System\kJkmDzY.exe
  C:\Windows\System\kJkmDzY.exe
  2⤵
  PID:10980
- C:\Windows\System\HLVuPxV.exe
  C:\Windows\System\HLVuPxV.exe
  2⤵
  PID:11004
- C:\Windows\System\UzBNlel.exe
  C:\Windows\System\UzBNlel.exe
  2⤵
  PID:11032
- C:\Windows\System\TSbrcnf.exe
  C:\Windows\System\TSbrcnf.exe
  2⤵
  PID:11060
- C:\Windows\System\upEkZca.exe
  C:\Windows\System\upEkZca.exe
  2⤵
  PID:11076
- C:\Windows\System\ECigsnf.exe
  C:\Windows\System\ECigsnf.exe
  2⤵
  PID:11100
- C:\Windows\System\qtdJipo.exe
  C:\Windows\System\qtdJipo.exe
  2⤵
  PID:11128
- C:\Windows\System\bFiVNYK.exe
  C:\Windows\System\bFiVNYK.exe
  2⤵
  PID:11148
- C:\Windows\System\JWvHfls.exe
  C:\Windows\System\JWvHfls.exe
  2⤵
  PID:11176
- C:\Windows\System\vqlucms.exe
  C:\Windows\System\vqlucms.exe
  2⤵
  PID:11196
- C:\Windows\System\neEBTVi.exe
  C:\Windows\System\neEBTVi.exe
  2⤵
  PID:11224
- C:\Windows\System\rAllljK.exe
  C:\Windows\System\rAllljK.exe
  2⤵
  PID:11248
- C:\Windows\System\AgKlvnw.exe
  C:\Windows\System\AgKlvnw.exe
  2⤵
  PID:8088
- C:\Windows\System\fYqSvKa.exe
  C:\Windows\System\fYqSvKa.exe
  2⤵
  PID:7140
- C:\Windows\System\ZnaEuyn.exe
  C:\Windows\System\ZnaEuyn.exe
  2⤵
  PID:8644
- C:\Windows\System\ewiVPhI.exe
  C:\Windows\System\ewiVPhI.exe
  2⤵
  PID:8208
- C:\Windows\System\yaiDHdf.exe
  C:\Windows\System\yaiDHdf.exe
  2⤵
  PID:8816
- C:\Windows\System\USRjeqr.exe
  C:\Windows\System\USRjeqr.exe
  2⤵
  PID:9340
- C:\Windows\System\kLkDOPs.exe
  C:\Windows\System\kLkDOPs.exe
  2⤵
  PID:9368
- C:\Windows\System\mVWdVBa.exe
  C:\Windows\System\mVWdVBa.exe
  2⤵
  PID:9392
- C:\Windows\System\kZkbomb.exe
  C:\Windows\System\kZkbomb.exe
  2⤵
  PID:9508
- C:\Windows\System\ZsOMkJB.exe
  C:\Windows\System\ZsOMkJB.exe
  2⤵
  PID:9560
- C:\Windows\System\lBtrxfE.exe
  C:\Windows\System\lBtrxfE.exe
  2⤵
  PID:9580
- C:\Windows\System\sDoWGSG.exe
  C:\Windows\System\sDoWGSG.exe
  2⤵
  PID:9608
- C:\Windows\System\KPOOipf.exe
  C:\Windows\System\KPOOipf.exe
  2⤵
  PID:9708
- C:\Windows\System\pdqqtUh.exe
  C:\Windows\System\pdqqtUh.exe
  2⤵
  PID:9728
- C:\Windows\System\kbkqKGy.exe
  C:\Windows\System\kbkqKGy.exe
  2⤵
  PID:9784
- C:\Windows\System\zVUBCID.exe
  C:\Windows\System\zVUBCID.exe
  2⤵
  PID:8488
- C:\Windows\System\erKIMRo.exe
  C:\Windows\System\erKIMRo.exe
  2⤵
  PID:9860
- C:\Windows\System\PgKQgWj.exe
  C:\Windows\System\PgKQgWj.exe
  2⤵
  PID:8120
- C:\Windows\System\osTdOXi.exe
  C:\Windows\System\osTdOXi.exe
  2⤵
  PID:6440
- C:\Windows\System\KkeIxBD.exe
  C:\Windows\System\KkeIxBD.exe
  2⤵
  PID:10076
- C:\Windows\System\LpvgmAh.exe
  C:\Windows\System\LpvgmAh.exe
  2⤵
  PID:10224
- C:\Windows\System\KRIkMYi.exe
  C:\Windows\System\KRIkMYi.exe
  2⤵
  PID:7680
- C:\Windows\System\CqUAWxi.exe
  C:\Windows\System\CqUAWxi.exe
  2⤵
  PID:8504
- C:\Windows\System\miUhIYC.exe
  C:\Windows\System\miUhIYC.exe
  2⤵
  PID:10248
- C:\Windows\System\YDJguLo.exe
  C:\Windows\System\YDJguLo.exe
  2⤵
  PID:10308
- C:\Windows\System\SZcZrhw.exe
  C:\Windows\System\SZcZrhw.exe
  2⤵
  PID:8048
- C:\Windows\System\jaUdvPm.exe
  C:\Windows\System\jaUdvPm.exe
  2⤵
  PID:8556
- C:\Windows\System\fTHeZIV.exe
  C:\Windows\System\fTHeZIV.exe
  2⤵
  PID:7888
- C:\Windows\System\cqAIEsa.exe
  C:\Windows\System\cqAIEsa.exe
  2⤵
  PID:10456
- C:\Windows\System\PaSvxUm.exe
  C:\Windows\System\PaSvxUm.exe
  2⤵
  PID:9304
- C:\Windows\System\DQryXNc.exe
  C:\Windows\System\DQryXNc.exe
  2⤵
  PID:10544
- C:\Windows\System\QTkzGJX.exe
  C:\Windows\System\QTkzGJX.exe
  2⤵
  PID:11288
- C:\Windows\System\qipyktF.exe
  C:\Windows\System\qipyktF.exe
  2⤵
  PID:11316
- C:\Windows\System\lyrvxnU.exe
  C:\Windows\System\lyrvxnU.exe
  2⤵
  PID:11336
- C:\Windows\System\oWeerAp.exe
  C:\Windows\System\oWeerAp.exe
  2⤵
  PID:11352
- C:\Windows\System\hlVRGMO.exe
  C:\Windows\System\hlVRGMO.exe
  2⤵
  PID:11372
- C:\Windows\System\kSGkKcb.exe
  C:\Windows\System\kSGkKcb.exe
  2⤵
  PID:11396
- C:\Windows\System\MiiaMSs.exe
  C:\Windows\System\MiiaMSs.exe
  2⤵
  PID:11420
- C:\Windows\System\DBitgTb.exe
  C:\Windows\System\DBitgTb.exe
  2⤵
  PID:11444
- C:\Windows\System\LKizkHk.exe
  C:\Windows\System\LKizkHk.exe
  2⤵
  PID:11464
- C:\Windows\System\TmlnGqY.exe
  C:\Windows\System\TmlnGqY.exe
  2⤵
  PID:11480
- C:\Windows\System\IfvBXvA.exe
  C:\Windows\System\IfvBXvA.exe
  2⤵
  PID:11500
- C:\Windows\System\koeIXYU.exe
  C:\Windows\System\koeIXYU.exe
  2⤵
  PID:11528
- C:\Windows\System\jBcuqVi.exe
  C:\Windows\System\jBcuqVi.exe
  2⤵
  PID:11548
- C:\Windows\System\kSkRuaA.exe
  C:\Windows\System\kSkRuaA.exe
  2⤵
  PID:11568
- C:\Windows\System\WZhRrJM.exe
  C:\Windows\System\WZhRrJM.exe
  2⤵
  PID:11596
- C:\Windows\System\ZVyQqmv.exe
  C:\Windows\System\ZVyQqmv.exe
  2⤵
  PID:11620
- C:\Windows\System\SGpYPja.exe
  C:\Windows\System\SGpYPja.exe
  2⤵
  PID:11644
- C:\Windows\System\szTyURZ.exe
  C:\Windows\System\szTyURZ.exe
  2⤵
  PID:11664
- C:\Windows\System\LhsNkdF.exe
  C:\Windows\System\LhsNkdF.exe
  2⤵
  PID:11688
- C:\Windows\System\iOTQeGM.exe
  C:\Windows\System\iOTQeGM.exe
  2⤵
  PID:11712
- C:\Windows\System\hPEKPVm.exe
  C:\Windows\System\hPEKPVm.exe
  2⤵
  PID:11728
- C:\Windows\System\xFIlYrh.exe
  C:\Windows\System\xFIlYrh.exe
  2⤵
  PID:11752
- C:\Windows\System\FuEjyEP.exe
  C:\Windows\System\FuEjyEP.exe
  2⤵
  PID:11784
- C:\Windows\System\VCtmwiz.exe
  C:\Windows\System\VCtmwiz.exe
  2⤵
  PID:11804
- C:\Windows\System\vZMAtfX.exe
  C:\Windows\System\vZMAtfX.exe
  2⤵
  PID:11820
- C:\Windows\System\RnkFaOl.exe
  C:\Windows\System\RnkFaOl.exe
  2⤵
  PID:11848
- C:\Windows\System\wLTmlWI.exe
  C:\Windows\System\wLTmlWI.exe
  2⤵
  PID:11872
- C:\Windows\System\vErPiRy.exe
  C:\Windows\System\vErPiRy.exe
  2⤵
  PID:11896
- C:\Windows\System\DBJMMiP.exe
  C:\Windows\System\DBJMMiP.exe
  2⤵
  PID:11912
- C:\Windows\System\ulIeFPc.exe
  C:\Windows\System\ulIeFPc.exe
  2⤵
  PID:11936
- C:\Windows\System\EcqciXT.exe
  C:\Windows\System\EcqciXT.exe
  2⤵
  PID:11960
- C:\Windows\System\HxQIOgG.exe
  C:\Windows\System\HxQIOgG.exe
  2⤵
  PID:11984
- C:\Windows\System\VmNPKij.exe
  C:\Windows\System\VmNPKij.exe
  2⤵
  PID:12012
- C:\Windows\System\AuBJBEg.exe
  C:\Windows\System\AuBJBEg.exe
  2⤵
  PID:12032
- C:\Windows\System\ghNoFts.exe
  C:\Windows\System\ghNoFts.exe
  2⤵
  PID:12052
- C:\Windows\System\YVPSZgJ.exe
  C:\Windows\System\YVPSZgJ.exe
  2⤵
  PID:12076
- C:\Windows\System\RPWymag.exe
  C:\Windows\System\RPWymag.exe
  2⤵
  PID:12096
- C:\Windows\System\DgtCthn.exe
  C:\Windows\System\DgtCthn.exe
  2⤵
  PID:12124
- C:\Windows\System\WKGltpo.exe
  C:\Windows\System\WKGltpo.exe
  2⤵
  PID:12140
- C:\Windows\System\NlSJRNk.exe
  C:\Windows\System\NlSJRNk.exe
  2⤵
  PID:12164
- C:\Windows\System\wJYmydt.exe
  C:\Windows\System\wJYmydt.exe
  2⤵
  PID:12180
- C:\Windows\System\mqGpMug.exe
  C:\Windows\System\mqGpMug.exe
  2⤵
  PID:12196
- C:\Windows\System\HLQCXJs.exe
  C:\Windows\System\HLQCXJs.exe
  2⤵
  PID:12212
- C:\Windows\System\rPHznJY.exe
  C:\Windows\System\rPHznJY.exe
  2⤵
  PID:12232
- C:\Windows\System\EzHKefT.exe
  C:\Windows\System\EzHKefT.exe
  2⤵
  PID:12252
- C:\Windows\System\ssOOUMn.exe
  C:\Windows\System\ssOOUMn.exe
  2⤵
  PID:12272
- C:\Windows\System\NcJeypX.exe
  C:\Windows\System\NcJeypX.exe
  2⤵
  PID:10576
- C:\Windows\System\GEFSnis.exe
  C:\Windows\System\GEFSnis.exe
  2⤵
  PID:9464
- C:\Windows\System\VySbezo.exe
  C:\Windows\System\VySbezo.exe
  2⤵
  PID:10620
- C:\Windows\System\rdkXOtb.exe
  C:\Windows\System\rdkXOtb.exe
  2⤵
  PID:9632
- C:\Windows\System\qfaZsAu.exe
  C:\Windows\System\qfaZsAu.exe
  2⤵
  PID:10684
- C:\Windows\System\wtTUOeF.exe
  C:\Windows\System\wtTUOeF.exe
  2⤵
  PID:10760
- C:\Windows\System\mVGFcGb.exe
  C:\Windows\System\mVGFcGb.exe
  2⤵
  PID:9816
- C:\Windows\System\xvrBVGz.exe
  C:\Windows\System\xvrBVGz.exe
  2⤵
  PID:9876
- C:\Windows\System\Yuibhtd.exe
  C:\Windows\System\Yuibhtd.exe
  2⤵
  PID:9944
- C:\Windows\System\EuWmHGQ.exe
  C:\Windows\System\EuWmHGQ.exe
  2⤵
  PID:11016
- C:\Windows\System\UNSKxFl.exe
  C:\Windows\System\UNSKxFl.exe
  2⤵
  PID:10004
- C:\Windows\System\rOTGwDD.exe
  C:\Windows\System\rOTGwDD.exe
  2⤵
  PID:11072
- C:\Windows\System\wQFaCIv.exe
  C:\Windows\System\wQFaCIv.exe
  2⤵
  PID:11136
- C:\Windows\System\QOlVlyk.exe
  C:\Windows\System\QOlVlyk.exe
  2⤵
  PID:11164
- C:\Windows\System\xOKDTJE.exe
  C:\Windows\System\xOKDTJE.exe
  2⤵
  PID:10172
- C:\Windows\System\ghGvmac.exe
  C:\Windows\System\ghGvmac.exe
  2⤵
  PID:7404
- C:\Windows\System\rEEUYiU.exe
  C:\Windows\System\rEEUYiU.exe
  2⤵
  PID:9288
- C:\Windows\System\liLAVMu.exe
  C:\Windows\System\liLAVMu.exe
  2⤵
  PID:9020
- C:\Windows\System\LrHbYyV.exe
  C:\Windows\System\LrHbYyV.exe
  2⤵
  PID:7496
- C:\Windows\System\hCLtBGH.exe
  C:\Windows\System\hCLtBGH.exe
  2⤵
  PID:9792
- C:\Windows\System\erdBTwu.exe
  C:\Windows\System\erdBTwu.exe
  2⤵
  PID:8980
- C:\Windows\System\KzgEqGP.exe
  C:\Windows\System\KzgEqGP.exe
  2⤵
  PID:6924
- C:\Windows\System\UtHTWGl.exe
  C:\Windows\System\UtHTWGl.exe
  2⤵
  PID:12320
- C:\Windows\System\SmQtgbg.exe
  C:\Windows\System\SmQtgbg.exe
  2⤵
  PID:12336
- C:\Windows\System\qATqpDP.exe
  C:\Windows\System\qATqpDP.exe
  2⤵
  PID:12356
- C:\Windows\System\YwWEsbb.exe
  C:\Windows\System\YwWEsbb.exe
  2⤵
  PID:12376
- C:\Windows\System\oSaIYvZ.exe
  C:\Windows\System\oSaIYvZ.exe
  2⤵
  PID:12404
- C:\Windows\System\ZXZOiAd.exe
  C:\Windows\System\ZXZOiAd.exe
  2⤵
  PID:12808
- C:\Windows\System\fstnJXg.exe
  C:\Windows\System\fstnJXg.exe
  2⤵
  PID:12828
- C:\Windows\System\GEUyfcj.exe
  C:\Windows\System\GEUyfcj.exe
  2⤵
  PID:12844
- C:\Windows\System\NrOGFVo.exe
  C:\Windows\System\NrOGFVo.exe
  2⤵
  PID:12864
- C:\Windows\System\xDFZRdz.exe
  C:\Windows\System\xDFZRdz.exe
  2⤵
  PID:12880
- C:\Windows\System\UzxawGv.exe
  C:\Windows\System\UzxawGv.exe
  2⤵
  PID:12904
- C:\Windows\System\lpsvCJO.exe
  C:\Windows\System\lpsvCJO.exe
  2⤵
  PID:12920
- C:\Windows\System\YkHAehG.exe
  C:\Windows\System\YkHAehG.exe
  2⤵
  PID:12936
- C:\Windows\System\SkVPCxy.exe
  C:\Windows\System\SkVPCxy.exe
  2⤵
  PID:12952
- C:\Windows\System\kEOjgiP.exe
  C:\Windows\System\kEOjgiP.exe
  2⤵
  PID:12972
- C:\Windows\System\NehjWGO.exe
  C:\Windows\System\NehjWGO.exe
  2⤵
  PID:12988
- C:\Windows\System\tlykkYm.exe
  C:\Windows\System\tlykkYm.exe
  2⤵
  PID:13004
- C:\Windows\System\jhbYBxg.exe
  C:\Windows\System\jhbYBxg.exe
  2⤵
  PID:13020
- C:\Windows\System\oURMpgn.exe
  C:\Windows\System\oURMpgn.exe
  2⤵
  PID:13036
- C:\Windows\System\CvNoadU.exe
  C:\Windows\System\CvNoadU.exe
  2⤵
  PID:13052
- C:\Windows\System\bUIWCVY.exe
  C:\Windows\System\bUIWCVY.exe
  2⤵
  PID:13068
- C:\Windows\System\MKsDoYX.exe
  C:\Windows\System\MKsDoYX.exe
  2⤵
  PID:13084
- C:\Windows\System\fltTzoA.exe
  C:\Windows\System\fltTzoA.exe
  2⤵
  PID:13100
- C:\Windows\System\xusRGql.exe
  C:\Windows\System\xusRGql.exe
  2⤵
  PID:13124
- C:\Windows\System\zWyQhfr.exe
  C:\Windows\System\zWyQhfr.exe
  2⤵
  PID:13144
- C:\Windows\System\tXzkHuM.exe
  C:\Windows\System\tXzkHuM.exe
  2⤵
  PID:13168
- C:\Windows\System\ShlJNJD.exe
  C:\Windows\System\ShlJNJD.exe
  2⤵
  PID:13196
- C:\Windows\System\SixGXSN.exe
  C:\Windows\System\SixGXSN.exe
  2⤵
  PID:13224
- C:\Windows\System\UUfNqqt.exe
  C:\Windows\System\UUfNqqt.exe
  2⤵
  PID:13248
- C:\Windows\System\IiUnxJn.exe
  C:\Windows\System\IiUnxJn.exe
  2⤵
  PID:13268

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:8208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ft30mf45.ido.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AwJPUnO.exe

Filesize
1.9MB

MD5
455e8651f14528f929322777fb02f552

SHA1
6c7b59457cbfb81d1027a2c81e6388ccfe1b74d1

SHA256
8c22711a82a878dcad21c5582e2ed0dec73ff5edde72977557a1e30c020c7117

SHA512
f3e2283cf4954769eaf0b101afbaf3d5e51e4d8249b825607388c2a643cef4b1e0352e280488c30e14a3879e06d01be70ffdd153b6928a0727c909a8472f45f3

Download Submit
C:\Windows\System\CsALFIq.exe

Filesize
1.9MB

MD5
7e696422751355a38e1e8eb46bb9dbd2

SHA1
cbb4b2016de21657cdb6e30113eebcd640924887

SHA256
b26bbe7d523c2066f781c6a55e6dc96ef67be54de4e7cac49fb326d789f7105d

SHA512
e46459a046b5313d5ea85f657e9c9067e5828925e326869a804fb011d40d4d699085cb62f043627bb8092e0a7a874fef3819c7dc0126d41cb86bd8657eb575a6

Download Submit
C:\Windows\System\DrTETOc.exe

Filesize
1.9MB

MD5
8df855c5ce5a7155b53909defc448c9a

SHA1
91154850a7b2b6665084547c2fd27c284051e672

SHA256
91039dcbd265b96c14d07884b2e53583f124f0cef4e259721fc8be702f1f4a27

SHA512
ede188fd3e429b87b0ffdfac0441b0fb23a9939be58d376e36915739c70019a1bd795ad60506463cc130c621370820498f2144062c1916a7984091f4eedf93f0

Download Submit
C:\Windows\System\FVlrOMy.exe

Filesize
1.9MB

MD5
a9500be5c1e277cd4b7b868893cad869

SHA1
503979a6b180616cf6348d08b666bb8e019ef322

SHA256
1d2f08fd7b30401b61cde6ff5bc16e5cb0eaf6195faadf0f4b5f9e69b9c835f1

SHA512
3192273c390046f3c5783aca89f8ead0347eb4dad0eb526930b9b64982a94060530c4b37b74ccd92313a6124a741d1ccdb7df86513d9e1c4af4aa7f2050d9f21

Download Submit
C:\Windows\System\GCBvWSd.exe

Filesize
1.9MB

MD5
aaddbddc6bea11bc5a2a8d844323d84f

SHA1
67da554dc8cd44ff99a4aca0172f0641d6487995

SHA256
a4b47494ad5a8c3dcd0f2b0bca1ff0313b13fa95d43b752d5910770d0e28c581

SHA512
4d4f21afaf5132e924242d616aa2f6781398fef2c348f17e4d78b1155289bbc89b6776c9ce7ab42ea7fb0fa13e64c201faa97a5f10c24fcb18af639f5e1ff081

Download Submit
C:\Windows\System\HbNlZSN.exe

Filesize
1.9MB

MD5
2f681594b2f31c76daa7558beceffe12

SHA1
5fd707211e8e1576f052193c63be62aae83f32a4

SHA256
c4fd581bb01c450199338932c367efabcebd3c9688fc1eb6ab0eda70847b1381

SHA512
c6049817023523de5dd799344e281649f501763d2f0908a5f04ea62ec8ba4dfc644891c5257ced6c9c9d6aff34a76ffb95fece35851abba1c637d895d4baf8e8

Download Submit
C:\Windows\System\IDdpCHf.exe

Filesize
1.9MB

MD5
80ee9848cd4b61ec84766e7e1d739ff0

SHA1
0e212ed41d9b3f41d6a4342283f3957754bbcdde

SHA256
d2389341cb8afd4eae5d478f6fa315887c8aea142ffe0a3199207290c2773e8a

SHA512
5512b9a9df94c718edd6b7623a868da3357141268aa8c90cfbee481d43d32d94490dc101b22696fb72b21b04ef5e678ab26f453cb5922c158d99b525ae46c7b8

Download Submit
C:\Windows\System\JdhBIaS.exe

Filesize
1.9MB

MD5
8f21a4717a82e7ea36fb0073567f1bd8

SHA1
e64b3ce6bb270692dc27b537e2584ad24ac72d6a

SHA256
109015ba3f3374b011c2f97013d1fb4c564dbd6bc140563e96fa2a26f61e4fe2

SHA512
832dc62864772456fcbc66dbca394d8ea82ce6ec77a8df734d80ed4e9610ca6433d7ac5fcbd1d1496a2fc7ae60dfe82c5cf1c95defced9fbb92ebbb14d6ed9ce

Download Submit
C:\Windows\System\LQTjRAC.exe

Filesize
1.9MB

MD5
044b75fc8bf0e4128d74f3e4c5666a8c

SHA1
01b07f50204e200cb6d8144c12e64561725a18ee

SHA256
f1cb9dd83954015992c68680633a34d0f76a36449f3700eca8cc8a9541e2570d

SHA512
769e2a54d2b247be397f2b126e69a574b2e084a172a227909a9ba9620762a1a1d32bbfa56f7d2ace48c16307624934d88679ff37867a69a491376b0e220fc825

Download Submit
C:\Windows\System\MUVdXrB.exe

Filesize
1.9MB

MD5
aaac387ea0921a6d3427a475cb192928

SHA1
6aaf868b475b842ac7244d1a85b1825bc05bd4a3

SHA256
12a777b85702c62f698eb67e80f4533b81e0a63672fcb396e20128228ae4489b

SHA512
66619b58756139c5159de697dd2112830c9194ab9d6938bb34a1c775ccaac34584650dc172dfe18bed31784363e5e0ca01168093357676fe8f8216b16d72450a

Download Submit
C:\Windows\System\MWePBBs.exe

Filesize
1.9MB

MD5
4e6d01b8774b14a10eb1c74470d80528

SHA1
bbfd0396e39ec6436d7d3d0022c1126e95f8f343

SHA256
92efb73d95f7d2ffd795bd26cc6b44b9381908c04fe14d327580c0007bbe47e8

SHA512
c961d0244d6c87057bbb9cd1315875915925cd70a4fd5349f5987a2d012a4729fbff7409afb8203365d09c95a2b1204af3e46e4cc6ff2801d4bd4994be4a8360

Download Submit
C:\Windows\System\MeJbBCF.exe

Filesize
8B

MD5
03f6c06cbca2116586dcb830cb1e7df2

SHA1
21959527eb4bdd4f1722864fa3a0565158da0f4e

SHA256
7c68cc08ed1401c0caafd3e73d5d856fc875748ed5e62a3ad679b5b0fee4938f

SHA512
39de7a17d12a7e9cc23a1b27c4c49944527213fbd572a6002483088201aba931dcd3d50b2479479e5c47888eeed5c23ce039cc4e68daaf253fbac40894ca1f2b

Download Submit
C:\Windows\System\NNhqfPD.exe

Filesize
1.9MB

MD5
6356b18ed1418205434f6c375fa01d3e

SHA1
351f081a83966bd613a164c5bf9686eea90df3f2

SHA256
f313f439db23aeddbb391b88e5c58c739887ef33a293827cb591e2d841961204

SHA512
fdc8d6cc345853d996990fba64d67f0ab670b1095d2197f24da84d54285e76d641551edac2bb93c1615e0cb01c5b7899ef4350b48ffc2e712e1bb4312f56e7e2

Download Submit
C:\Windows\System\NaPTdLb.exe

Filesize
1.9MB

MD5
cfe17c77d3648ad84be34fa1a4edc1aa

SHA1
bb318854c64c1d5d56b76981b28ed0203c8fea4d

SHA256
5769f2d50b9a6bd6ddc9386750c43d22ff57bb13ba6d7935e1d075dc6668e37f

SHA512
c5d15ba0c9cc64df9f5fdc22a8777aad26e000c7fbe481263a04d26157d856dee1567064e8b590d996f6d93dd2a7d44f7ef1c38bf54268f916f0583081d9aba5

Download Submit
C:\Windows\System\QIfSoea.exe

Filesize
1.9MB

MD5
3c7293351c0b9625ba7f7b8de967b036

SHA1
8a35f2d0ca781d4454cd844852b7efb54db9a345

SHA256
f120e9cdff04fec007c45c302afe33e046677b7afba7200997ce2846d78f38fa

SHA512
4a90decb47fae723530e3348ddd9ae7be9dd5decd57be39f1d15f2f55f237eedefd6b531cea8ddd373ea506924d063a2dbcb1f9ebdcb5fab43c6b97f4d7fade2

Download Submit
C:\Windows\System\SoVIXvF.exe

Filesize
1.9MB

MD5
c6b40d56068f46fc02a91d00e3b6f032

SHA1
1fa7ec9a029f2e718d48add0daaed3f2234e825e

SHA256
dcc3c7265de8917bb3364d5d43c63806447a67b7bd1a0e7b78ebfd0ad40cf0af

SHA512
218fa7dc972a8958301b6bf2a0f5ef804a9d2d76612a6c691a6827f045adc41f7c84916f1291c0520a40c62a3884f0ab8864a0166e62b18183d55f5e7c4a19e7

Download Submit
C:\Windows\System\TQfJzhv.exe

Filesize
1.9MB

MD5
a93145dcfd3a4211cd545bb3d8737139

SHA1
6ce7e76f812548b4b2c2c3e1276f0110047bfab9

SHA256
a4c0927854653c5189ab658695b32d256e968bba4fd9b3208ca959753c4c8102

SHA512
7db1c028154a5a07a191df4b153cdc774834d4acb1a84fc72d6c0592671557e463781a249f324dc0ebc541be79689bba4278d2042fa0bb05724a43d647f5bfc1

Download Submit
C:\Windows\System\UDtfhmv.exe

Filesize
1.9MB

MD5
5fff0ae75c73c6e5f259e5e24d621d73

SHA1
8ebc65974c0fd03816bc0bf330764ff09c8afd42

SHA256
41d3e74b3637f1160ce8426146097bf24a191fab85452b0ad9bb895f247bb72b

SHA512
6563167efc7dc7756cff583d7260bd90a90156bcc32e51b1963b68b6123a5dd32abd35edf15c718c0c5dbf29f683c8ef1a507e5b8eb583ddb51311b790c3827f

Download Submit
C:\Windows\System\WDqwymv.exe

Filesize
1.9MB

MD5
d41a6cd37e4168d85c99c35acb0d37ac

SHA1
2a698bea905d9ed470e78b9f02941e75338ee55f

SHA256
93f101ea6009964e00dc7b96da2e6c6d8fba8e2ba47dfa0fcd9840100f718604

SHA512
49b8901aa497c49f984b33e0c63e27e40cfed898768d47197bbb540770c975672f8f01e92edcba29ce55d67f25c5c5e1294e0a99c05149cdb6fc4a3cfd1a20bd

Download Submit
C:\Windows\System\WdQZwPA.exe

Filesize
1.9MB

MD5
b97a296c194d3ce26afaaf86010901c7

SHA1
e6e6fb33edd0bfdd1ccff800950a9c0be272a928

SHA256
25b5286ec2c9a57764709b78cc7fc282cadaf94cf2f3edc51267bbbbdf267c32

SHA512
4305a90a7d3863ad1a144fee047803494424c8156e79e74ea7107ed8278a08f4a623ef96b0f85fdcec73e9792988f9a0836db14181787295fab78817fc182211

Download Submit
C:\Windows\System\YqwuHKa.exe

Filesize
1.9MB

MD5
b37d86c76eff358927b62d53b4081edf

SHA1
d43242685a8587c5724284d24765a344ac31bc42

SHA256
e39e4e71475e660dd10a3ad94d28a5b79db040a89988f925923510c4a9720dee

SHA512
bf81b61e60019937303abf7e6d981c7a789fb669a7320bb839dc253383016658ff586e18f08f1d62e072645b7b81b005629de4d4cbed50345c4bae5d9d34167b

Download Submit
C:\Windows\System\aPaHQBn.exe

Filesize
1.9MB

MD5
9458d20cad4f7d4072816416c646a09b

SHA1
b146cb6a42006a36d44a7e72cb0a29e19564281f

SHA256
a3e6d0dcceba91081f67383b280e022202c1a3503fd57c4f043badb6c3a1d013

SHA512
71c609b4701c47cfce0eeab0759521b8d0a8cc09a6cb60b916a6d31e163e21fac2413690f7067498b50b0dc7b6acaabbaa379966c45d4bcec23316b468399c7e

Download Submit
C:\Windows\System\alzxUGF.exe

Filesize
1.9MB

MD5
38ee4028c056f8b868a4b781fa167d6d

SHA1
a5546b3ae4eee0b7cabb2442c48d1f70168e6bfb

SHA256
9e31a8ac42d812dd6a19a228d0dc08d04c72904e4e39bde61dba31328e4c0731

SHA512
f7edcbbe6810735aacc71b2eee503cabf08ab84c305a9bcbd634776b29ab4bd93d3e7913e9d72427bfd16fa1ec7f1ad7b8ea3735d1e465e8d45deea0ab4e8b46

Download Submit
C:\Windows\System\arCSzeA.exe

Filesize
1.9MB

MD5
20e6a3688733598210ea786100d223f7

SHA1
f4444722389f0a023f6844a9daaaf1c38038dc1f

SHA256
915dccad5c3a6074b929617e520f839cfe6ef204b45030b3116c95a0b8086a33

SHA512
9cd1ca4ba860aba03e835672473c48a1179d16faff76b4928c7c774ef774a8cb884fbee420a1c5cc059cc64442da6258786a3b79b7f8a8c3e4c7732010e7d788

Download Submit
C:\Windows\System\bPmzZnQ.exe

Filesize
1.9MB

MD5
8193d75329ecd19cd7b0488db2578646

SHA1
3f52a735b4b669bebc9f8dd500422f09737c4281

SHA256
258eb29ac929bbc5156c1324e29b195956418189721ffb003faa896e7ebf94f4

SHA512
e150453fb9e5521889cd2d202990e4dfa77bf346b08214992822d3a1e60343f6f73d236e9d61bf7e783392e4e8b04d438373cda866641807b9de94e67c17a94e

Download Submit
C:\Windows\System\bgEfyoj.exe

Filesize
1.9MB

MD5
8c43975216a633ce6e7326de903c8f5c

SHA1
9ea2e18937a538273611308945e409f690ea377b

SHA256
52ff666a1707ae523f06f171aeba550a52431b3e7a7b381b7b2694b0a5cc0c7b

SHA512
b07e21ecb6d4c589f9253328c2c938aae011cc66aef392c435bc80497476929577badb2558a6af0294929d32186594d28d3345edc64c2125d627a75b464dc802

Download Submit
C:\Windows\System\ckvFYDG.exe

Filesize
1.9MB

MD5
b49e8040f001e600f2070fce6a005893

SHA1
8c99bf0af3c02926c7ca17596ec99b91fe318c08

SHA256
19a6f8830d8e2ec1cd31ce4510d4779381b26e7919c93ec9092e8390d2dd4ea5

SHA512
58953acc67af72f99336dccca905835e1cc7c1dcc9bd90311a8c428fab7d82cda3152dc11b588d81dbe156c935106f8302a499722ae1d0df0c05d1f9a1ae2fba

Download Submit
C:\Windows\System\eGmzHlV.exe

Filesize
1.9MB

MD5
42b7fd2c4268ffe1911fa5fbbb759e9d

SHA1
b2cad13d8d7c7c3f9766e2c2fccc30b20d033026

SHA256
77d434a1201f41a77f8281b217f68a7ac76226f270203ceced8e3fa127ee7e69

SHA512
7be1c92d93616f5fdf06fe36988e751cdc9022c117f48d541a262aa2ed1180daa4455065bfdc382b541adfcf06639f735bd4918d364358017fa66da565c90080

Download Submit
C:\Windows\System\ffWjFGK.exe

Filesize
1.9MB

MD5
3537ced7c3d0b8f8bdbba786979fec2c

SHA1
be406a6320b868853c429165378acecd965d98db

SHA256
926db4be0823b3f185297bb53dfd212cea09689ab4a0befdc7c224eff9b6512b

SHA512
a6841a25b84c1aa7894d6f69a52f7dfcb2ec8a1c0238423edcf7539c8ca4e96c739c7d3f8a7b8f8b9e604fcaa95ec2d5ba087ccc5625aad3f87df5bf5c57e476

Download Submit
C:\Windows\System\kHwfoKz.exe

Filesize
1.9MB

MD5
7450a236e917df2ee067efdfa1cf9f49

SHA1
43fb50ab187832381388448d05d1c8505425f219

SHA256
494f08d04ee3eacb7cfe4e3288223427703f955f75ebfb690f2060c4a46a22f5

SHA512
df3dfb8b661a96d6044e617fd9c1334abdf1407adc5d403d6e0930652cd0a7fc0bd59cce303a060d70deba906970ee3e34e62719636d120290adedae15367444

Download Submit
C:\Windows\System\lhFavNs.exe

Filesize
1.9MB

MD5
1be5143b39cd3755fdc38804bf4717f1

SHA1
05f458a30a2bb5c0638afe25e26fcfd066d87594

SHA256
8b36e56a9317bc7866785de7a79531796460f6b8fabc82db51f43e01941eab27

SHA512
56301d4fa4ffc41debeb98a99ffc559692575da910931a4ad79085ca310b8d2b459449b929c31a89c4f74a1c369792b09c25d9a6579d2bac7afcda2ddc444b3c

Download Submit
C:\Windows\System\nnMwumf.exe

Filesize
1.9MB

MD5
10a5d301dd6a3a8915cd41e6423c7c30

SHA1
b59758a6573e0e2c957cac62a5b4b45fda1a5e5c

SHA256
619ff5868685f14d7dd33696bf691c84d7be052e80eb7fd55a4deeab5cfa2d8f

SHA512
0ed641977b35001e1df6c22488808ba8051af373b5c6cb469bfb2f92906cd7e0b9368317a27a72917641a2930f0b57fa97da8c326faf76b6a80f44fbc07ae6b5

Download Submit
C:\Windows\System\oJqnfDg.exe

Filesize
1.9MB

MD5
622207d88f57ec3266810725c793d16b

SHA1
98ff9d2686752d03816dd8cf624623125090ad16

SHA256
0120de818ebec775c1e20be940e80d8aea8257ffd6f6c82f34e23f3b08584ecf

SHA512
8667a2991f814395b8692ce8806cc7d1cd8102e7ba46c4b55ba5b4fd058f10b548f514742db1d1b4b9f2942a3fdfbc215b2518b13912eeb20516e7482f673034

Download Submit
C:\Windows\System\pgeZKGz.exe

Filesize
1.9MB

MD5
b15381d16d7193813c4c5f9d7c4f79f3

SHA1
6d6e30df671e5f18e22275173569485ca10f43df

SHA256
08fcc5b5493db43b31ae289b1ee424fa88fbcc578b42391b9a68a86a9301f93e

SHA512
6b97c7ee566f6770c46d196ca839ab0ccf5bc5b2d095ac4eec58be26a6f3d9e87af4ca0df8f5804589fa99e3d750a1a75e94a430b1dd182d6096e38ea8344aaf

Download Submit
C:\Windows\System\rYEhyOT.exe

Filesize
1.9MB

MD5
c1dfe01422840f9c81b3ead81dc8b9ec

SHA1
c230c486165e09bb8bd0816ba04a0f4685c49b67

SHA256
043162dfa9e5e4192a78f5cc207bdf1282b833bc6f81964feccfd933a0eb076c

SHA512
b3061f4c29be80aba5c471d65bcd89b8c08a7969ca2a95650a59399d1cce98f4c9114ae85663b7e9352385edc789c6e5505c5a8f37056df735dfdb6583c06d87

Download Submit
C:\Windows\System\uTUxxfd.exe

Filesize
1.9MB

MD5
78c304114c7fb37928fb9010d947adbe

SHA1
e0eed6fc02ffefd294df9a24ce46778df4bd9a00

SHA256
0195473b833b61948173b9d8987f252f497c8216332b4f2a6f984ca8b9080850

SHA512
694bc1ebe95557e234b6305fc014608a6016202698d7002262a35a94fe58eefbc245418bc4c140eed2ba66e9fee63ed8176eaa1322be7e8fb85bf058942d6108

Download Submit
C:\Windows\System\yDyWExC.exe

Filesize
1.9MB

MD5
8bdd9d39eabca2a332a2b1e5839aa9bc

SHA1
e6cbddf678a78934444c0a1094f8c87839641237

SHA256
fbeb0da69ea38f4d867bdcb087e86eed06849350a2e08e5feb8b5b0273d71fee

SHA512
b2c720694d99a9a552f3ef4e4376ad59c5d86c87b4d8cc3ef61169effeae8378e0be353b149b3af7e49897c20d48797b2bedc67d5c548ad75e28fe33e12ca4d8

Download Submit
C:\Windows\System\zAyxqGQ.exe

Filesize
1.9MB

MD5
b3221570d657d51c10c6cd320fce9aa8

SHA1
35f517576aa344a8a68fafdd212ec3849f0b69db

SHA256
182c301dbd987691b6e48e930ce3bf1e723b4ada5ebdaf1f0806a9e7f233f17a

SHA512
01c4ad14935be710dda2a9f2923366f7750f1eb2d8e1d986f41baeea4176992283e9d945259bcd9b1bb25433249e08d2db37abdc42c8b0ebf3da37ebf37c252e

Download Submit
C:\Windows\System\zXfMzVD.exe

Filesize
1.9MB

MD5
154016b6e1704892e2907f260791025c

SHA1
3714e12f140f1cb253ac19a0fe96ab92b6cbf290

SHA256
6eabc488be39fafe5738a7cc5379a0ad20bd67dd89cfd1009001b87bbe685bf0

SHA512
e7eefbafc387c2514d765e0fb92b14e8464949022855e42c498fddfeff7707dd65eae80fa040b4aa1fc9ee22af0b657aaf9ab2da33318dea3f2a5312b243fdd3

Download Submit
memory/644-2315-0x00007FF641040000-0x00007FF641432000-memory.dmp

Filesize
3.9MB

Download
memory/644-299-0x00007FF641040000-0x00007FF641432000-memory.dmp

Filesize
3.9MB

Download
memory/704-2209-0x00007FF73A9C0000-0x00007FF73ADB2000-memory.dmp

Filesize
3.9MB

Download
memory/704-2188-0x00007FF73A9C0000-0x00007FF73ADB2000-memory.dmp

Filesize
3.9MB

Download
memory/704-23-0x00007FF73A9C0000-0x00007FF73ADB2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-2243-0x00007FF7FC980000-0x00007FF7FCD72000-memory.dmp

Filesize
3.9MB

Download
memory/1040-296-0x00007FF7FC980000-0x00007FF7FCD72000-memory.dmp

Filesize
3.9MB

Download
memory/1104-2294-0x00007FF798590000-0x00007FF798982000-memory.dmp

Filesize
3.9MB

Download
memory/1104-303-0x00007FF798590000-0x00007FF798982000-memory.dmp

Filesize
3.9MB

Download
memory/1320-2216-0x00007FF70B750000-0x00007FF70BB42000-memory.dmp

Filesize
3.9MB

Download
memory/1320-295-0x00007FF70B750000-0x00007FF70BB42000-memory.dmp

Filesize
3.9MB

Download
memory/1912-2190-0x00007FF786DA0000-0x00007FF787192000-memory.dmp

Filesize
3.9MB

Download
memory/1912-2187-0x00007FF786DA0000-0x00007FF787192000-memory.dmp

Filesize
3.9MB

Download
memory/1912-14-0x00007FF786DA0000-0x00007FF787192000-memory.dmp

Filesize
3.9MB

Download
memory/2012-2236-0x00007FF69C3A0000-0x00007FF69C792000-memory.dmp

Filesize
3.9MB

Download
memory/2012-302-0x00007FF69C3A0000-0x00007FF69C792000-memory.dmp

Filesize
3.9MB

Download
memory/2308-297-0x00007FF758B30000-0x00007FF758F22000-memory.dmp

Filesize
3.9MB

Download
memory/2308-2242-0x00007FF758B30000-0x00007FF758F22000-memory.dmp

Filesize
3.9MB

Download
memory/2592-300-0x00007FF6914F0000-0x00007FF6918E2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-2210-0x00007FF6914F0000-0x00007FF6918E2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-2213-0x00007FF6808D0000-0x00007FF680CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-216-0x00007FF6808D0000-0x00007FF680CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-1-0x0000013375C90000-0x0000013375CA0000-memory.dmp

Filesize
64KB

Download
memory/2852-0-0x00007FF72DF40000-0x00007FF72E332000-memory.dmp

Filesize
3.9MB

Download
memory/2852-1960-0x00007FF72DF40000-0x00007FF72E332000-memory.dmp

Filesize
3.9MB

Download
memory/2924-2200-0x00007FF7D1800000-0x00007FF7D1BF2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-72-0x00007FF7D1800000-0x00007FF7D1BF2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-183-0x00007FF64E830000-0x00007FF64EC22000-memory.dmp

Filesize
3.9MB

Download
memory/3028-2203-0x00007FF64E830000-0x00007FF64EC22000-memory.dmp

Filesize
3.9MB

Download
memory/3228-2481-0x00007FF8ED4A0000-0x00007FF8EDF61000-memory.dmp

Filesize
10.8MB

Download
memory/3228-2449-0x00007FF8ED4A3000-0x00007FF8ED4A5000-memory.dmp

Filesize
8KB

Download
memory/3228-340-0x000001C63EFD0000-0x000001C63F776000-memory.dmp

Filesize
7.6MB

Download
memory/3228-313-0x000001C63E180000-0x000001C63E1A2000-memory.dmp

Filesize
136KB

Download
memory/3228-181-0x00007FF8ED4A0000-0x00007FF8EDF61000-memory.dmp

Filesize
10.8MB

Download
memory/3228-26-0x00007FF8ED4A3000-0x00007FF8ED4A5000-memory.dmp

Filesize
8KB

Download
memory/3332-2214-0x00007FF622830000-0x00007FF622C22000-memory.dmp

Filesize
3.9MB

Download
memory/3332-293-0x00007FF622830000-0x00007FF622C22000-memory.dmp

Filesize
3.9MB

Download
memory/3416-2245-0x00007FF712C60000-0x00007FF713052000-memory.dmp

Filesize
3.9MB

Download
memory/3416-294-0x00007FF712C60000-0x00007FF713052000-memory.dmp

Filesize
3.9MB

Download
memory/3552-2313-0x00007FF6FE500000-0x00007FF6FE8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3552-265-0x00007FF6FE500000-0x00007FF6FE8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3748-2293-0x00007FF73AD70000-0x00007FF73B162000-memory.dmp

Filesize
3.9MB

Download
memory/3748-298-0x00007FF73AD70000-0x00007FF73B162000-memory.dmp

Filesize
3.9MB

Download
memory/3824-2239-0x00007FF67CE70000-0x00007FF67D262000-memory.dmp

Filesize
3.9MB

Download
memory/3824-192-0x00007FF67CE70000-0x00007FF67D262000-memory.dmp

Filesize
3.9MB

Download
memory/3888-2192-0x00007FF711F10000-0x00007FF712302000-memory.dmp

Filesize
3.9MB

Download
memory/3888-301-0x00007FF711F10000-0x00007FF712302000-memory.dmp

Filesize
3.9MB

Download
memory/4092-2194-0x00007FF709B80000-0x00007FF709F72000-memory.dmp

Filesize
3.9MB

Download
memory/4092-38-0x00007FF709B80000-0x00007FF709F72000-memory.dmp

Filesize
3.9MB

Download
memory/4252-179-0x00007FF794C30000-0x00007FF795022000-memory.dmp

Filesize
3.9MB

Download
memory/4252-2196-0x00007FF794C30000-0x00007FF795022000-memory.dmp

Filesize
3.9MB

Download
memory/4508-2370-0x00007FF7B4B80000-0x00007FF7B4F72000-memory.dmp

Filesize
3.9MB

Download
memory/4508-287-0x00007FF7B4B80000-0x00007FF7B4F72000-memory.dmp

Filesize
3.9MB

Download
memory/4636-144-0x00007FF733BF0000-0x00007FF733FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4636-2198-0x00007FF733BF0000-0x00007FF733FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-2205-0x00007FF788940000-0x00007FF788D32000-memory.dmp

Filesize
3.9MB

Download
memory/4852-182-0x00007FF788940000-0x00007FF788D32000-memory.dmp

Filesize
3.9MB

Download
memory/5036-112-0x00007FF7F6C20000-0x00007FF7F7012000-memory.dmp

Filesize
3.9MB

Download
memory/5036-2207-0x00007FF7F6C20000-0x00007FF7F7012000-memory.dmp

Filesize
3.9MB

Download