xmrig | a8be0cc3e155b69c5cda0ac3cb1cbef015235124be5d294adce9aba35e5525ca

Analysis

max time kernel
84s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb474968632e36ba8ca1e0f2f3692440N.exe
Size

2.4MB
MD5

bb474968632e36ba8ca1e0f2f3692440
SHA1

6d7119490c1a122dc937901ea53cc38ab216fa7c
SHA256

a8be0cc3e155b69c5cda0ac3cb1cbef015235124be5d294adce9aba35e5525ca
SHA512

a390f9ca92600c2347adf504890cea5d15af2be537dccf2bd4c08491a76677e9fdd151a75d06c9a683b4a893ae40434ec975cb9508343e3dba32aa13d1fb182e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLbst:NABf

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/3556-15-0x00007FF627150000-0x00007FF627542000-memory.dmp	xmrig
behavioral2/memory/1640-230-0x00007FF610490000-0x00007FF610882000-memory.dmp	xmrig
behavioral2/memory/432-287-0x00007FF7781B0000-0x00007FF7785A2000-memory.dmp	xmrig
behavioral2/memory/4464-317-0x00007FF6B0AE0000-0x00007FF6B0ED2000-memory.dmp	xmrig
behavioral2/memory/5096-333-0x00007FF70C8A0000-0x00007FF70CC92000-memory.dmp	xmrig
behavioral2/memory/1856-339-0x00007FF730C20000-0x00007FF731012000-memory.dmp	xmrig
behavioral2/memory/3768-338-0x00007FF674450000-0x00007FF674842000-memory.dmp	xmrig
behavioral2/memory/2120-337-0x00007FF618150000-0x00007FF618542000-memory.dmp	xmrig
behavioral2/memory/1532-315-0x00007FF744DC0000-0x00007FF7451B2000-memory.dmp	xmrig
behavioral2/memory/1544-314-0x00007FF7CBC50000-0x00007FF7CC042000-memory.dmp	xmrig
behavioral2/memory/3624-307-0x00007FF7C5940000-0x00007FF7C5D32000-memory.dmp	xmrig
behavioral2/memory/1600-269-0x00007FF6BD270000-0x00007FF6BD662000-memory.dmp	xmrig
behavioral2/memory/876-266-0x00007FF626220000-0x00007FF626612000-memory.dmp	xmrig
behavioral2/memory/804-268-0x00007FF78B9C0000-0x00007FF78BDB2000-memory.dmp	xmrig
behavioral2/memory/1416-240-0x00007FF6092D0000-0x00007FF6096C2000-memory.dmp	xmrig
behavioral2/memory/5072-239-0x00007FF666350000-0x00007FF666742000-memory.dmp	xmrig
behavioral2/memory/1048-205-0x00007FF75A000000-0x00007FF75A3F2000-memory.dmp	xmrig
behavioral2/memory/3192-161-0x00007FF6FD490000-0x00007FF6FD882000-memory.dmp	xmrig
behavioral2/memory/3556-4897-0x00007FF627150000-0x00007FF627542000-memory.dmp	xmrig
behavioral2/memory/1992-4899-0x00007FF654060000-0x00007FF654452000-memory.dmp	xmrig
behavioral2/memory/4464-4901-0x00007FF6B0AE0000-0x00007FF6B0ED2000-memory.dmp	xmrig
behavioral2/memory/5096-4903-0x00007FF70C8A0000-0x00007FF70CC92000-memory.dmp	xmrig
behavioral2/memory/1268-4907-0x00007FF7081D0000-0x00007FF7085C2000-memory.dmp	xmrig
behavioral2/memory/4680-4906-0x00007FF6DE6D0000-0x00007FF6DEAC2000-memory.dmp	xmrig
behavioral2/memory/3192-4910-0x00007FF6FD490000-0x00007FF6FD882000-memory.dmp	xmrig
behavioral2/memory/1048-4911-0x00007FF75A000000-0x00007FF75A3F2000-memory.dmp	xmrig
behavioral2/memory/384-4913-0x00007FF6DA2D0000-0x00007FF6DA6C2000-memory.dmp	xmrig
behavioral2/memory/2120-4917-0x00007FF618150000-0x00007FF618542000-memory.dmp	xmrig
behavioral2/memory/1920-4916-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp	xmrig
behavioral2/memory/2200-4919-0x00007FF710050000-0x00007FF710442000-memory.dmp	xmrig
behavioral2/memory/1600-4997-0x00007FF6BD270000-0x00007FF6BD662000-memory.dmp	xmrig
behavioral2/memory/5072-5031-0x00007FF666350000-0x00007FF666742000-memory.dmp	xmrig
behavioral2/memory/1532-5042-0x00007FF744DC0000-0x00007FF7451B2000-memory.dmp	xmrig
behavioral2/memory/432-5050-0x00007FF7781B0000-0x00007FF7785A2000-memory.dmp	xmrig
behavioral2/memory/1856-5022-0x00007FF730C20000-0x00007FF731012000-memory.dmp	xmrig
behavioral2/memory/3624-5019-0x00007FF7C5940000-0x00007FF7C5D32000-memory.dmp	xmrig
behavioral2/memory/1544-5009-0x00007FF7CBC50000-0x00007FF7CC042000-memory.dmp	xmrig
behavioral2/memory/1640-4995-0x00007FF610490000-0x00007FF610882000-memory.dmp	xmrig
behavioral2/memory/1416-4994-0x00007FF6092D0000-0x00007FF6096C2000-memory.dmp	xmrig
behavioral2/memory/804-4981-0x00007FF78B9C0000-0x00007FF78BDB2000-memory.dmp	xmrig
behavioral2/memory/876-4967-0x00007FF626220000-0x00007FF626612000-memory.dmp	xmrig
behavioral2/memory/3768-4966-0x00007FF674450000-0x00007FF674842000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	392	powershell.exe
13	392	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
392	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3556	CFvALyE.exe
1992	dsuuZbm.exe
4464	fDPPVSL.exe
4680	jnFdqJX.exe
1268	ZXwoxdX.exe
384	WelIths.exe
5096	HNqCgrE.exe
2200	oBHWHzz.exe
1920	gboEJLf.exe
3192	APbzmes.exe
1048	hdBhbBb.exe
2120	JdkmRni.exe
1640	OquuGHc.exe
3768	pAfyXUP.exe
5072	jmtnEDq.exe
1416	vFQoDwh.exe
876	rqyochZ.exe
804	YcRWvbz.exe
1856	kVpOQGA.exe
1600	MBIWCgm.exe
432	bEUwNZp.exe
3624	nnTuCNR.exe
1544	jNqtLqT.exe
1532	uWCcYYv.exe
1844	OdulXnf.exe
2068	vVrVAHI.exe
3964	iajlyos.exe
2492	GPhTcTa.exe
1684	yQaxHJK.exe
3600	BdCYdIp.exe
3996	nTVIJFG.exe
2000	zXfvzEh.exe
5036	NRGigOA.exe
4052	UWASsrL.exe
4416	XpOumcF.exe
4940	RjCbfvU.exe
1988	WnUCZdk.exe
3960	iHNgCgt.exe
1140	gDtbVch.exe
5068	wrNFqwA.exe
2224	MvrmNyx.exe
4968	UxDBEui.exe
4004	kmgIIRW.exe
2572	ArDThyf.exe
2292	hFzMuAN.exe
2148	MpMdOHY.exe
3036	rywabgR.exe
3068	qUZrpnU.exe
4576	UTEItTc.exe
1536	VFWlhSi.exe
4116	IimaEOg.exe
2464	PwusqHh.exe
4500	bDHTXCX.exe
4508	rcUNYJH.exe
3936	LBTyXuy.exe
4916	ozNVKVh.exe
3732	gFuwIAP.exe
1316	SXfeaXV.exe
1320	nOyAPfu.exe
1464	ovPrWjG.exe
4476	XmQwHME.exe
912	xvODMSZ.exe
1608	zyDQmtQ.exe
3416	CQwymnj.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1756-0-0x00007FF79FEF0000-0x00007FF7A02E2000-memory.dmp	upx
behavioral2/files/0x000a000000023412-5.dat	upx
behavioral2/memory/3556-15-0x00007FF627150000-0x00007FF627542000-memory.dmp	upx
behavioral2/memory/384-52-0x00007FF6DA2D0000-0x00007FF6DA6C2000-memory.dmp	upx
behavioral2/memory/1268-49-0x00007FF7081D0000-0x00007FF7085C2000-memory.dmp	upx
behavioral2/files/0x0007000000023431-48.dat	upx
behavioral2/files/0x0007000000023433-62.dat	upx
behavioral2/files/0x0007000000023430-45.dat	upx
behavioral2/files/0x000700000002342f-44.dat	upx
behavioral2/files/0x000700000002342e-43.dat	upx
behavioral2/files/0x000700000002342a-53.dat	upx
behavioral2/files/0x000700000002342d-42.dat	upx
behavioral2/memory/4680-35-0x00007FF6DE6D0000-0x00007FF6DEAC2000-memory.dmp	upx
behavioral2/files/0x0007000000023429-31.dat	upx
behavioral2/files/0x0008000000023428-28.dat	upx
behavioral2/files/0x000700000002342c-27.dat	upx
behavioral2/memory/1992-21-0x00007FF654060000-0x00007FF654452000-memory.dmp	upx
behavioral2/files/0x000700000002342b-20.dat	upx
behavioral2/files/0x0007000000023434-71.dat	upx
behavioral2/files/0x0007000000023443-129.dat	upx
behavioral2/files/0x0007000000023447-153.dat	upx
behavioral2/memory/1640-230-0x00007FF610490000-0x00007FF610882000-memory.dmp	upx
behavioral2/memory/432-287-0x00007FF7781B0000-0x00007FF7785A2000-memory.dmp	upx
behavioral2/memory/4464-317-0x00007FF6B0AE0000-0x00007FF6B0ED2000-memory.dmp	upx
behavioral2/memory/5096-333-0x00007FF70C8A0000-0x00007FF70CC92000-memory.dmp	upx
behavioral2/memory/1856-339-0x00007FF730C20000-0x00007FF731012000-memory.dmp	upx
behavioral2/memory/3768-338-0x00007FF674450000-0x00007FF674842000-memory.dmp	upx
behavioral2/memory/2120-337-0x00007FF618150000-0x00007FF618542000-memory.dmp	upx
behavioral2/memory/1532-315-0x00007FF744DC0000-0x00007FF7451B2000-memory.dmp	upx
behavioral2/memory/1544-314-0x00007FF7CBC50000-0x00007FF7CC042000-memory.dmp	upx
behavioral2/memory/3624-307-0x00007FF7C5940000-0x00007FF7C5D32000-memory.dmp	upx
behavioral2/memory/1600-269-0x00007FF6BD270000-0x00007FF6BD662000-memory.dmp	upx
behavioral2/memory/876-266-0x00007FF626220000-0x00007FF626612000-memory.dmp	upx
behavioral2/memory/804-268-0x00007FF78B9C0000-0x00007FF78BDB2000-memory.dmp	upx
behavioral2/memory/1416-240-0x00007FF6092D0000-0x00007FF6096C2000-memory.dmp	upx
behavioral2/memory/5072-239-0x00007FF666350000-0x00007FF666742000-memory.dmp	upx
behavioral2/files/0x0007000000023435-200.dat	upx
behavioral2/files/0x000700000002344c-199.dat	upx
behavioral2/files/0x000700000002344b-198.dat	upx
behavioral2/files/0x0007000000023446-196.dat	upx
behavioral2/files/0x000700000002344a-193.dat	upx
behavioral2/files/0x0007000000023439-191.dat	upx
behavioral2/files/0x0007000000023441-187.dat	upx
behavioral2/files/0x000700000002343e-183.dat	upx
behavioral2/files/0x0007000000023449-180.dat	upx
behavioral2/files/0x000700000002343d-175.dat	upx
behavioral2/memory/1048-205-0x00007FF75A000000-0x00007FF75A3F2000-memory.dmp	upx
behavioral2/files/0x000700000002343a-156.dat	upx
behavioral2/files/0x0007000000023438-148.dat	upx
behavioral2/files/0x0007000000023445-145.dat	upx
behavioral2/files/0x000700000002343f-144.dat	upx
behavioral2/files/0x000700000002343c-139.dat	upx
behavioral2/files/0x0007000000023444-138.dat	upx
behavioral2/memory/3192-161-0x00007FF6FD490000-0x00007FF6FD882000-memory.dmp	upx
behavioral2/files/0x0008000000023426-152.dat	upx
behavioral2/files/0x0007000000023442-124.dat	upx
behavioral2/files/0x0007000000023432-118.dat	upx
behavioral2/files/0x0007000000023440-117.dat	upx
behavioral2/files/0x0007000000023437-146.dat	upx
behavioral2/files/0x0007000000023436-140.dat	upx
behavioral2/memory/1920-125-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp	upx
behavioral2/memory/2200-98-0x00007FF710050000-0x00007FF710442000-memory.dmp	upx
behavioral2/files/0x000700000002343b-109.dat	upx
behavioral2/memory/3556-4897-0x00007FF627150000-0x00007FF627542000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PTCFenC.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\oeJAiXl.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\NUNqsfD.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\kxRDtLC.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\EzLAFnc.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\hVzCxXf.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\hCyPxHs.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\dZwoxOF.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\EkITypV.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\IXeZKfs.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\fTYpqGB.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\ZUbLsWU.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\MAqWocB.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\pPARjFq.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\XqzQEZD.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\JwVFjRI.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\xBlKeMf.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\UqQOINJ.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\kOIBIbH.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\VjgamoA.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\EWPeMok.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\vkxvgar.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\ojnlnPg.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\bNABCYP.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\HRbSrrt.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\bycmBYV.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\MsQgZWz.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\WYJXjQq.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\GLOvTPM.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\inXAdXK.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\RNEJdFB.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\qRFXxmM.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\fepZsFP.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\HJtiDHk.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\SRKmNDv.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\CTLwdkS.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\EwVsbhq.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\aVqhalf.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\TDTGWFJ.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\SzSiEHm.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\nGqsPfi.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\VThqxuY.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\ehEuVHC.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\hHcGfBL.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\SfDaEVv.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\kZEcnrJ.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\dUmEYRZ.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\NiGXHtM.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\UUKGPap.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\gwJoYGz.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\QZiKrvK.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\qmlGxVo.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\chFtSRL.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\oeyqMJY.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\JfjaHXo.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\LTWhJVC.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\vFuBURy.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\pbhqYTo.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\ICemcQL.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\YSlkZYe.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\hWWPSDh.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\zOkgpgM.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\HmgMQoM.exe	bb474968632e36ba8ca1e0f2f3692440N.exe
File created	C:\Windows\System\khHxhgh.exe	bb474968632e36ba8ca1e0f2f3692440N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
392	powershell.exe
392	powershell.exe
392	powershell.exe
392	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	392	powershell.exe
Token: SeLockMemoryPrivilege	1756	bb474968632e36ba8ca1e0f2f3692440N.exe
Token: SeLockMemoryPrivilege	1756	bb474968632e36ba8ca1e0f2f3692440N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 392	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	85
PID 1756 wrote to memory of 392	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	85
PID 1756 wrote to memory of 3556	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	86
PID 1756 wrote to memory of 3556	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	86
PID 1756 wrote to memory of 1992	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	87
PID 1756 wrote to memory of 1992	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	87
PID 1756 wrote to memory of 4464	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	88
PID 1756 wrote to memory of 4464	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	88
PID 1756 wrote to memory of 4680	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	89
PID 1756 wrote to memory of 4680	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	89
PID 1756 wrote to memory of 1268	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	90
PID 1756 wrote to memory of 1268	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	90
PID 1756 wrote to memory of 384	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	91
PID 1756 wrote to memory of 384	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	91
PID 1756 wrote to memory of 5096	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	92
PID 1756 wrote to memory of 5096	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	92
PID 1756 wrote to memory of 2200	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	93
PID 1756 wrote to memory of 2200	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	93
PID 1756 wrote to memory of 1920	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	94
PID 1756 wrote to memory of 1920	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	94
PID 1756 wrote to memory of 3192	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	95
PID 1756 wrote to memory of 3192	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	95
PID 1756 wrote to memory of 1048	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	96
PID 1756 wrote to memory of 1048	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	96
PID 1756 wrote to memory of 2120	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	97
PID 1756 wrote to memory of 2120	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	97
PID 1756 wrote to memory of 1640	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	98
PID 1756 wrote to memory of 1640	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	98
PID 1756 wrote to memory of 3768	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	99
PID 1756 wrote to memory of 3768	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	99
PID 1756 wrote to memory of 5072	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	100
PID 1756 wrote to memory of 5072	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	100
PID 1756 wrote to memory of 1416	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	101
PID 1756 wrote to memory of 1416	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	101
PID 1756 wrote to memory of 876	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	102
PID 1756 wrote to memory of 876	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	102
PID 1756 wrote to memory of 804	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	103
PID 1756 wrote to memory of 804	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	103
PID 1756 wrote to memory of 1856	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	104
PID 1756 wrote to memory of 1856	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	104
PID 1756 wrote to memory of 1600	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	105
PID 1756 wrote to memory of 1600	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	105
PID 1756 wrote to memory of 432	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	106
PID 1756 wrote to memory of 432	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	106
PID 1756 wrote to memory of 3624	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	107
PID 1756 wrote to memory of 3624	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	107
PID 1756 wrote to memory of 1544	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	108
PID 1756 wrote to memory of 1544	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	108
PID 1756 wrote to memory of 1532	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	109
PID 1756 wrote to memory of 1532	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	109
PID 1756 wrote to memory of 3600	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	110
PID 1756 wrote to memory of 3600	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	110
PID 1756 wrote to memory of 1844	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	111
PID 1756 wrote to memory of 1844	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	111
PID 1756 wrote to memory of 2068	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	112
PID 1756 wrote to memory of 2068	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	112
PID 1756 wrote to memory of 3964	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	113
PID 1756 wrote to memory of 3964	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	113
PID 1756 wrote to memory of 2492	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	114
PID 1756 wrote to memory of 2492	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	114
PID 1756 wrote to memory of 1684	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	115
PID 1756 wrote to memory of 1684	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	115
PID 1756 wrote to memory of 3996	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	116
PID 1756 wrote to memory of 3996	1756	bb474968632e36ba8ca1e0f2f3692440N.exe	116

C:\Users\Admin\AppData\Local\Temp\bb474968632e36ba8ca1e0f2f3692440N.exe
"C:\Users\Admin\AppData\Local\Temp\bb474968632e36ba8ca1e0f2f3692440N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:392
- C:\Windows\System\CFvALyE.exe
  C:\Windows\System\CFvALyE.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\dsuuZbm.exe
  C:\Windows\System\dsuuZbm.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\fDPPVSL.exe
  C:\Windows\System\fDPPVSL.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\jnFdqJX.exe
  C:\Windows\System\jnFdqJX.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\ZXwoxdX.exe
  C:\Windows\System\ZXwoxdX.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\WelIths.exe
  C:\Windows\System\WelIths.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\HNqCgrE.exe
  C:\Windows\System\HNqCgrE.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\oBHWHzz.exe
  C:\Windows\System\oBHWHzz.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\gboEJLf.exe
  C:\Windows\System\gboEJLf.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\APbzmes.exe
  C:\Windows\System\APbzmes.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\hdBhbBb.exe
  C:\Windows\System\hdBhbBb.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\JdkmRni.exe
  C:\Windows\System\JdkmRni.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\OquuGHc.exe
  C:\Windows\System\OquuGHc.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\pAfyXUP.exe
  C:\Windows\System\pAfyXUP.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\jmtnEDq.exe
  C:\Windows\System\jmtnEDq.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\vFQoDwh.exe
  C:\Windows\System\vFQoDwh.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\rqyochZ.exe
  C:\Windows\System\rqyochZ.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\YcRWvbz.exe
  C:\Windows\System\YcRWvbz.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\kVpOQGA.exe
  C:\Windows\System\kVpOQGA.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\MBIWCgm.exe
  C:\Windows\System\MBIWCgm.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\bEUwNZp.exe
  C:\Windows\System\bEUwNZp.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\nnTuCNR.exe
  C:\Windows\System\nnTuCNR.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\jNqtLqT.exe
  C:\Windows\System\jNqtLqT.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\uWCcYYv.exe
  C:\Windows\System\uWCcYYv.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\BdCYdIp.exe
  C:\Windows\System\BdCYdIp.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\OdulXnf.exe
  C:\Windows\System\OdulXnf.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\vVrVAHI.exe
  C:\Windows\System\vVrVAHI.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\iajlyos.exe
  C:\Windows\System\iajlyos.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\GPhTcTa.exe
  C:\Windows\System\GPhTcTa.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\yQaxHJK.exe
  C:\Windows\System\yQaxHJK.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\nTVIJFG.exe
  C:\Windows\System\nTVIJFG.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\RjCbfvU.exe
  C:\Windows\System\RjCbfvU.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\zXfvzEh.exe
  C:\Windows\System\zXfvzEh.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\NRGigOA.exe
  C:\Windows\System\NRGigOA.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\gDtbVch.exe
  C:\Windows\System\gDtbVch.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\UWASsrL.exe
  C:\Windows\System\UWASsrL.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\XpOumcF.exe
  C:\Windows\System\XpOumcF.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\WnUCZdk.exe
  C:\Windows\System\WnUCZdk.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\iHNgCgt.exe
  C:\Windows\System\iHNgCgt.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\wrNFqwA.exe
  C:\Windows\System\wrNFqwA.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\MvrmNyx.exe
  C:\Windows\System\MvrmNyx.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\UxDBEui.exe
  C:\Windows\System\UxDBEui.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\kmgIIRW.exe
  C:\Windows\System\kmgIIRW.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\ArDThyf.exe
  C:\Windows\System\ArDThyf.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\hFzMuAN.exe
  C:\Windows\System\hFzMuAN.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\MpMdOHY.exe
  C:\Windows\System\MpMdOHY.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\rywabgR.exe
  C:\Windows\System\rywabgR.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\qUZrpnU.exe
  C:\Windows\System\qUZrpnU.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\UTEItTc.exe
  C:\Windows\System\UTEItTc.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\VFWlhSi.exe
  C:\Windows\System\VFWlhSi.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\IimaEOg.exe
  C:\Windows\System\IimaEOg.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\PwusqHh.exe
  C:\Windows\System\PwusqHh.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\bDHTXCX.exe
  C:\Windows\System\bDHTXCX.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\rcUNYJH.exe
  C:\Windows\System\rcUNYJH.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\LBTyXuy.exe
  C:\Windows\System\LBTyXuy.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\ozNVKVh.exe
  C:\Windows\System\ozNVKVh.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\gFuwIAP.exe
  C:\Windows\System\gFuwIAP.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\SXfeaXV.exe
  C:\Windows\System\SXfeaXV.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\nOyAPfu.exe
  C:\Windows\System\nOyAPfu.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\ovPrWjG.exe
  C:\Windows\System\ovPrWjG.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\XmQwHME.exe
  C:\Windows\System\XmQwHME.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\xvODMSZ.exe
  C:\Windows\System\xvODMSZ.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\zyDQmtQ.exe
  C:\Windows\System\zyDQmtQ.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\CQwymnj.exe
  C:\Windows\System\CQwymnj.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\uIhGeHa.exe
  C:\Windows\System\uIhGeHa.exe
  2⤵
  PID:3124
- C:\Windows\System\diSGuBd.exe
  C:\Windows\System\diSGuBd.exe
  2⤵
  PID:932
- C:\Windows\System\RPDLAQd.exe
  C:\Windows\System\RPDLAQd.exe
  2⤵
  PID:4036
- C:\Windows\System\rBVotqg.exe
  C:\Windows\System\rBVotqg.exe
  2⤵
  PID:1892
- C:\Windows\System\tqDiEHo.exe
  C:\Windows\System\tqDiEHo.exe
  2⤵
  PID:4524
- C:\Windows\System\MEgURCd.exe
  C:\Windows\System\MEgURCd.exe
  2⤵
  PID:2300
- C:\Windows\System\tYgQvxx.exe
  C:\Windows\System\tYgQvxx.exe
  2⤵
  PID:4472
- C:\Windows\System\mClEKDm.exe
  C:\Windows\System\mClEKDm.exe
  2⤵
  PID:1392
- C:\Windows\System\zQUklTQ.exe
  C:\Windows\System\zQUklTQ.exe
  2⤵
  PID:4784
- C:\Windows\System\ZIVLpsw.exe
  C:\Windows\System\ZIVLpsw.exe
  2⤵
  PID:3828
- C:\Windows\System\fKXmjQz.exe
  C:\Windows\System\fKXmjQz.exe
  2⤵
  PID:4740
- C:\Windows\System\rzSlIAQ.exe
  C:\Windows\System\rzSlIAQ.exe
  2⤵
  PID:4568
- C:\Windows\System\phqxpFB.exe
  C:\Windows\System\phqxpFB.exe
  2⤵
  PID:1652
- C:\Windows\System\RfALSPJ.exe
  C:\Windows\System\RfALSPJ.exe
  2⤵
  PID:3776
- C:\Windows\System\mLTFBfj.exe
  C:\Windows\System\mLTFBfj.exe
  2⤵
  PID:1100
- C:\Windows\System\zRbixHH.exe
  C:\Windows\System\zRbixHH.exe
  2⤵
  PID:4264
- C:\Windows\System\GBWVQSQ.exe
  C:\Windows\System\GBWVQSQ.exe
  2⤵
  PID:3696
- C:\Windows\System\xfdOISB.exe
  C:\Windows\System\xfdOISB.exe
  2⤵
  PID:3420
- C:\Windows\System\KwoHFAs.exe
  C:\Windows\System\KwoHFAs.exe
  2⤵
  PID:4360
- C:\Windows\System\BdoDkwf.exe
  C:\Windows\System\BdoDkwf.exe
  2⤵
  PID:5132
- C:\Windows\System\jTXtuEh.exe
  C:\Windows\System\jTXtuEh.exe
  2⤵
  PID:5148
- C:\Windows\System\TxFFDHv.exe
  C:\Windows\System\TxFFDHv.exe
  2⤵
  PID:5164
- C:\Windows\System\RqQrsuT.exe
  C:\Windows\System\RqQrsuT.exe
  2⤵
  PID:5180
- C:\Windows\System\ZICtaOZ.exe
  C:\Windows\System\ZICtaOZ.exe
  2⤵
  PID:5196
- C:\Windows\System\IPqFvKA.exe
  C:\Windows\System\IPqFvKA.exe
  2⤵
  PID:5212
- C:\Windows\System\xAKSqGQ.exe
  C:\Windows\System\xAKSqGQ.exe
  2⤵
  PID:5228
- C:\Windows\System\zsDwFdA.exe
  C:\Windows\System\zsDwFdA.exe
  2⤵
  PID:5244
- C:\Windows\System\hhFBfXR.exe
  C:\Windows\System\hhFBfXR.exe
  2⤵
  PID:5260
- C:\Windows\System\iWGeGra.exe
  C:\Windows\System\iWGeGra.exe
  2⤵
  PID:5276
- C:\Windows\System\RNDvMOr.exe
  C:\Windows\System\RNDvMOr.exe
  2⤵
  PID:5296
- C:\Windows\System\ZEHGjZN.exe
  C:\Windows\System\ZEHGjZN.exe
  2⤵
  PID:5312
- C:\Windows\System\WXlAvXQ.exe
  C:\Windows\System\WXlAvXQ.exe
  2⤵
  PID:5328
- C:\Windows\System\fYQSWFc.exe
  C:\Windows\System\fYQSWFc.exe
  2⤵
  PID:5344
- C:\Windows\System\BKOweAo.exe
  C:\Windows\System\BKOweAo.exe
  2⤵
  PID:5360
- C:\Windows\System\ifFZxrN.exe
  C:\Windows\System\ifFZxrN.exe
  2⤵
  PID:5376
- C:\Windows\System\bSLGrwl.exe
  C:\Windows\System\bSLGrwl.exe
  2⤵
  PID:5392
- C:\Windows\System\RWwoMCs.exe
  C:\Windows\System\RWwoMCs.exe
  2⤵
  PID:5408
- C:\Windows\System\jAWvdiS.exe
  C:\Windows\System\jAWvdiS.exe
  2⤵
  PID:5424
- C:\Windows\System\JAkdTpI.exe
  C:\Windows\System\JAkdTpI.exe
  2⤵
  PID:5440
- C:\Windows\System\HEAMiZk.exe
  C:\Windows\System\HEAMiZk.exe
  2⤵
  PID:5456
- C:\Windows\System\IRJyqwY.exe
  C:\Windows\System\IRJyqwY.exe
  2⤵
  PID:5480
- C:\Windows\System\WjUGeae.exe
  C:\Windows\System\WjUGeae.exe
  2⤵
  PID:5508
- C:\Windows\System\gtRyjHp.exe
  C:\Windows\System\gtRyjHp.exe
  2⤵
  PID:5540
- C:\Windows\System\faHRCNw.exe
  C:\Windows\System\faHRCNw.exe
  2⤵
  PID:5568
- C:\Windows\System\sEcmiPT.exe
  C:\Windows\System\sEcmiPT.exe
  2⤵
  PID:5596
- C:\Windows\System\oJviUoF.exe
  C:\Windows\System\oJviUoF.exe
  2⤵
  PID:5620
- C:\Windows\System\ppCSYkT.exe
  C:\Windows\System\ppCSYkT.exe
  2⤵
  PID:5640
- C:\Windows\System\pzmhCdt.exe
  C:\Windows\System\pzmhCdt.exe
  2⤵
  PID:5664
- C:\Windows\System\aUQDNcM.exe
  C:\Windows\System\aUQDNcM.exe
  2⤵
  PID:5688
- C:\Windows\System\mnTzbZS.exe
  C:\Windows\System\mnTzbZS.exe
  2⤵
  PID:5708
- C:\Windows\System\pdhyaEK.exe
  C:\Windows\System\pdhyaEK.exe
  2⤵
  PID:5732
- C:\Windows\System\iDaCIru.exe
  C:\Windows\System\iDaCIru.exe
  2⤵
  PID:5752
- C:\Windows\System\lMwAcAi.exe
  C:\Windows\System\lMwAcAi.exe
  2⤵
  PID:5816
- C:\Windows\System\WsKidra.exe
  C:\Windows\System\WsKidra.exe
  2⤵
  PID:5844
- C:\Windows\System\SjCAmYc.exe
  C:\Windows\System\SjCAmYc.exe
  2⤵
  PID:5868
- C:\Windows\System\vlKpKrV.exe
  C:\Windows\System\vlKpKrV.exe
  2⤵
  PID:5888
- C:\Windows\System\AUYkYLt.exe
  C:\Windows\System\AUYkYLt.exe
  2⤵
  PID:5904
- C:\Windows\System\mghcIxR.exe
  C:\Windows\System\mghcIxR.exe
  2⤵
  PID:5920
- C:\Windows\System\lLZHaHq.exe
  C:\Windows\System\lLZHaHq.exe
  2⤵
  PID:5936
- C:\Windows\System\HrSykAe.exe
  C:\Windows\System\HrSykAe.exe
  2⤵
  PID:5960
- C:\Windows\System\WleyOBq.exe
  C:\Windows\System\WleyOBq.exe
  2⤵
  PID:5980
- C:\Windows\System\FJxQDdY.exe
  C:\Windows\System\FJxQDdY.exe
  2⤵
  PID:6000
- C:\Windows\System\EacvgNv.exe
  C:\Windows\System\EacvgNv.exe
  2⤵
  PID:6024
- C:\Windows\System\BmqEWen.exe
  C:\Windows\System\BmqEWen.exe
  2⤵
  PID:6048
- C:\Windows\System\MwmmOLN.exe
  C:\Windows\System\MwmmOLN.exe
  2⤵
  PID:6072
- C:\Windows\System\tTKeRgS.exe
  C:\Windows\System\tTKeRgS.exe
  2⤵
  PID:6096
- C:\Windows\System\LbMWNDP.exe
  C:\Windows\System\LbMWNDP.exe
  2⤵
  PID:6120
- C:\Windows\System\lwoKoGO.exe
  C:\Windows\System\lwoKoGO.exe
  2⤵
  PID:6140
- C:\Windows\System\cZndZIL.exe
  C:\Windows\System\cZndZIL.exe
  2⤵
  PID:4648
- C:\Windows\System\TriaZWz.exe
  C:\Windows\System\TriaZWz.exe
  2⤵
  PID:960
- C:\Windows\System\VWpIezL.exe
  C:\Windows\System\VWpIezL.exe
  2⤵
  PID:5172
- C:\Windows\System\BjZqnpM.exe
  C:\Windows\System\BjZqnpM.exe
  2⤵
  PID:5220
- C:\Windows\System\ITkTZea.exe
  C:\Windows\System\ITkTZea.exe
  2⤵
  PID:5252
- C:\Windows\System\BwEcOCj.exe
  C:\Windows\System\BwEcOCj.exe
  2⤵
  PID:5740
- C:\Windows\System\RXiQJdy.exe
  C:\Windows\System\RXiQJdy.exe
  2⤵
  PID:5304
- C:\Windows\System\kiAHrhI.exe
  C:\Windows\System\kiAHrhI.exe
  2⤵
  PID:5340
- C:\Windows\System\XTiRpKc.exe
  C:\Windows\System\XTiRpKc.exe
  2⤵
  PID:5368
- C:\Windows\System\WUBfGiV.exe
  C:\Windows\System\WUBfGiV.exe
  2⤵
  PID:5416
- C:\Windows\System\gJBmyOO.exe
  C:\Windows\System\gJBmyOO.exe
  2⤵
  PID:6160
- C:\Windows\System\HpyEykw.exe
  C:\Windows\System\HpyEykw.exe
  2⤵
  PID:6184
- C:\Windows\System\uFqhYwp.exe
  C:\Windows\System\uFqhYwp.exe
  2⤵
  PID:6204
- C:\Windows\System\GVHmjHX.exe
  C:\Windows\System\GVHmjHX.exe
  2⤵
  PID:6244
- C:\Windows\System\jTFdXrM.exe
  C:\Windows\System\jTFdXrM.exe
  2⤵
  PID:6268
- C:\Windows\System\ziIGqfI.exe
  C:\Windows\System\ziIGqfI.exe
  2⤵
  PID:6296
- C:\Windows\System\XqXfNNj.exe
  C:\Windows\System\XqXfNNj.exe
  2⤵
  PID:6320
- C:\Windows\System\dFeLpYz.exe
  C:\Windows\System\dFeLpYz.exe
  2⤵
  PID:6352
- C:\Windows\System\tkQxVmz.exe
  C:\Windows\System\tkQxVmz.exe
  2⤵
  PID:6368
- C:\Windows\System\FefzbFf.exe
  C:\Windows\System\FefzbFf.exe
  2⤵
  PID:6392
- C:\Windows\System\BgCJAfh.exe
  C:\Windows\System\BgCJAfh.exe
  2⤵
  PID:6416
- C:\Windows\System\nKPgwQU.exe
  C:\Windows\System\nKPgwQU.exe
  2⤵
  PID:6432
- C:\Windows\System\zWILDQs.exe
  C:\Windows\System\zWILDQs.exe
  2⤵
  PID:6456
- C:\Windows\System\dKuDneL.exe
  C:\Windows\System\dKuDneL.exe
  2⤵
  PID:6476
- C:\Windows\System\JaEmGte.exe
  C:\Windows\System\JaEmGte.exe
  2⤵
  PID:6496
- C:\Windows\System\qvYrKHN.exe
  C:\Windows\System\qvYrKHN.exe
  2⤵
  PID:6572
- C:\Windows\System\xbvzViR.exe
  C:\Windows\System\xbvzViR.exe
  2⤵
  PID:6592
- C:\Windows\System\GfZGWEc.exe
  C:\Windows\System\GfZGWEc.exe
  2⤵
  PID:6608
- C:\Windows\System\YjNYmNs.exe
  C:\Windows\System\YjNYmNs.exe
  2⤵
  PID:6628
- C:\Windows\System\RjTyTIL.exe
  C:\Windows\System\RjTyTIL.exe
  2⤵
  PID:6652
- C:\Windows\System\czHTrwU.exe
  C:\Windows\System\czHTrwU.exe
  2⤵
  PID:6680
- C:\Windows\System\BcyRSwX.exe
  C:\Windows\System\BcyRSwX.exe
  2⤵
  PID:6708
- C:\Windows\System\fXGjfBf.exe
  C:\Windows\System\fXGjfBf.exe
  2⤵
  PID:6748
- C:\Windows\System\tuUnyug.exe
  C:\Windows\System\tuUnyug.exe
  2⤵
  PID:6764
- C:\Windows\System\iOWhwNV.exe
  C:\Windows\System\iOWhwNV.exe
  2⤵
  PID:6784
- C:\Windows\System\lhUBskc.exe
  C:\Windows\System\lhUBskc.exe
  2⤵
  PID:6804
- C:\Windows\System\SxiwoZp.exe
  C:\Windows\System\SxiwoZp.exe
  2⤵
  PID:6828
- C:\Windows\System\BNFPmQp.exe
  C:\Windows\System\BNFPmQp.exe
  2⤵
  PID:6856
- C:\Windows\System\MXSVMWI.exe
  C:\Windows\System\MXSVMWI.exe
  2⤵
  PID:6880
- C:\Windows\System\xOuCeMn.exe
  C:\Windows\System\xOuCeMn.exe
  2⤵
  PID:6904
- C:\Windows\System\XupIkUU.exe
  C:\Windows\System\XupIkUU.exe
  2⤵
  PID:6924
- C:\Windows\System\LvxFRwf.exe
  C:\Windows\System\LvxFRwf.exe
  2⤵
  PID:6948
- C:\Windows\System\uOAkNfW.exe
  C:\Windows\System\uOAkNfW.exe
  2⤵
  PID:6972
- C:\Windows\System\DwcwNFu.exe
  C:\Windows\System\DwcwNFu.exe
  2⤵
  PID:6988
- C:\Windows\System\qLPcyVN.exe
  C:\Windows\System\qLPcyVN.exe
  2⤵
  PID:7008
- C:\Windows\System\fkiqnXt.exe
  C:\Windows\System\fkiqnXt.exe
  2⤵
  PID:7032
- C:\Windows\System\KPqGxUz.exe
  C:\Windows\System\KPqGxUz.exe
  2⤵
  PID:7064
- C:\Windows\System\gjBPKGw.exe
  C:\Windows\System\gjBPKGw.exe
  2⤵
  PID:7088
- C:\Windows\System\XALmGAv.exe
  C:\Windows\System\XALmGAv.exe
  2⤵
  PID:7112
- C:\Windows\System\XyrROAe.exe
  C:\Windows\System\XyrROAe.exe
  2⤵
  PID:7128
- C:\Windows\System\PWQZxWz.exe
  C:\Windows\System\PWQZxWz.exe
  2⤵
  PID:5720
- C:\Windows\System\fDQZDwQ.exe
  C:\Windows\System\fDQZDwQ.exe
  2⤵
  PID:5652
- C:\Windows\System\uSlPgac.exe
  C:\Windows\System\uSlPgac.exe
  2⤵
  PID:5584
- C:\Windows\System\vDxqhtN.exe
  C:\Windows\System\vDxqhtN.exe
  2⤵
  PID:5536
- C:\Windows\System\TvkvAxB.exe
  C:\Windows\System\TvkvAxB.exe
  2⤵
  PID:5604
- C:\Windows\System\thFsPVy.exe
  C:\Windows\System\thFsPVy.exe
  2⤵
  PID:5560
- C:\Windows\System\ygEMzQS.exe
  C:\Windows\System\ygEMzQS.exe
  2⤵
  PID:5488
- C:\Windows\System\zEnUfHZ.exe
  C:\Windows\System\zEnUfHZ.exe
  2⤵
  PID:3704
- C:\Windows\System\nLEhSBL.exe
  C:\Windows\System\nLEhSBL.exe
  2⤵
  PID:6108
- C:\Windows\System\DUgmoGS.exe
  C:\Windows\System\DUgmoGS.exe
  2⤵
  PID:5876
- C:\Windows\System\hFFlFHW.exe
  C:\Windows\System\hFFlFHW.exe
  2⤵
  PID:6288
- C:\Windows\System\hHcGfBL.exe
  C:\Windows\System\hHcGfBL.exe
  2⤵
  PID:6408
- C:\Windows\System\RiuzgcA.exe
  C:\Windows\System\RiuzgcA.exe
  2⤵
  PID:6468
- C:\Windows\System\VgpiHCJ.exe
  C:\Windows\System\VgpiHCJ.exe
  2⤵
  PID:5932
- C:\Windows\System\QnosUuZ.exe
  C:\Windows\System\QnosUuZ.exe
  2⤵
  PID:2876
- C:\Windows\System\lAoXWuC.exe
  C:\Windows\System\lAoXWuC.exe
  2⤵
  PID:6616
- C:\Windows\System\kdUfBtG.exe
  C:\Windows\System\kdUfBtG.exe
  2⤵
  PID:4948
- C:\Windows\System\AUylyZs.exe
  C:\Windows\System\AUylyZs.exe
  2⤵
  PID:5140
- C:\Windows\System\fsbMkFx.exe
  C:\Windows\System\fsbMkFx.exe
  2⤵
  PID:5240
- C:\Windows\System\CIUSJDq.exe
  C:\Windows\System\CIUSJDq.exe
  2⤵
  PID:5852
- C:\Windows\System\DXOXBHo.exe
  C:\Windows\System\DXOXBHo.exe
  2⤵
  PID:5324
- C:\Windows\System\XcsXRCR.exe
  C:\Windows\System\XcsXRCR.exe
  2⤵
  PID:5404
- C:\Windows\System\CtkCAQD.exe
  C:\Windows\System\CtkCAQD.exe
  2⤵
  PID:6192
- C:\Windows\System\OrIyaIe.exe
  C:\Windows\System\OrIyaIe.exe
  2⤵
  PID:6228
- C:\Windows\System\nxaOjRR.exe
  C:\Windows\System\nxaOjRR.exe
  2⤵
  PID:6940
- C:\Windows\System\MJrTAPD.exe
  C:\Windows\System\MJrTAPD.exe
  2⤵
  PID:7028
- C:\Windows\System\hvMwJNf.exe
  C:\Windows\System\hvMwJNf.exe
  2⤵
  PID:6488
- C:\Windows\System\PSWLoxD.exe
  C:\Windows\System\PSWLoxD.exe
  2⤵
  PID:7056
- C:\Windows\System\AdyAYjz.exe
  C:\Windows\System\AdyAYjz.exe
  2⤵
  PID:5452
- C:\Windows\System\UtugQbe.exe
  C:\Windows\System\UtugQbe.exe
  2⤵
  PID:7172
- C:\Windows\System\vIAtGkk.exe
  C:\Windows\System\vIAtGkk.exe
  2⤵
  PID:7192
- C:\Windows\System\tSnsmdr.exe
  C:\Windows\System\tSnsmdr.exe
  2⤵
  PID:7216
- C:\Windows\System\LRrYqyw.exe
  C:\Windows\System\LRrYqyw.exe
  2⤵
  PID:7232
- C:\Windows\System\pUhumCb.exe
  C:\Windows\System\pUhumCb.exe
  2⤵
  PID:7260
- C:\Windows\System\AKBPmkW.exe
  C:\Windows\System\AKBPmkW.exe
  2⤵
  PID:7276
- C:\Windows\System\CsODDyP.exe
  C:\Windows\System\CsODDyP.exe
  2⤵
  PID:7304
- C:\Windows\System\nxmLEQn.exe
  C:\Windows\System\nxmLEQn.exe
  2⤵
  PID:7332
- C:\Windows\System\fUnowpK.exe
  C:\Windows\System\fUnowpK.exe
  2⤵
  PID:7356
- C:\Windows\System\BtzXBpM.exe
  C:\Windows\System\BtzXBpM.exe
  2⤵
  PID:7376
- C:\Windows\System\xnbvjXk.exe
  C:\Windows\System\xnbvjXk.exe
  2⤵
  PID:7396
- C:\Windows\System\PzHeDtq.exe
  C:\Windows\System\PzHeDtq.exe
  2⤵
  PID:7424
- C:\Windows\System\rHSEvDT.exe
  C:\Windows\System\rHSEvDT.exe
  2⤵
  PID:7440
- C:\Windows\System\jXMsdNB.exe
  C:\Windows\System\jXMsdNB.exe
  2⤵
  PID:7464
- C:\Windows\System\VghRBGO.exe
  C:\Windows\System\VghRBGO.exe
  2⤵
  PID:7488
- C:\Windows\System\XWxmjWy.exe
  C:\Windows\System\XWxmjWy.exe
  2⤵
  PID:7508
- C:\Windows\System\gILmpUT.exe
  C:\Windows\System\gILmpUT.exe
  2⤵
  PID:7532
- C:\Windows\System\dDWvNql.exe
  C:\Windows\System\dDWvNql.exe
  2⤵
  PID:7556
- C:\Windows\System\epFpuKY.exe
  C:\Windows\System\epFpuKY.exe
  2⤵
  PID:7592
- C:\Windows\System\yCHbxcn.exe
  C:\Windows\System\yCHbxcn.exe
  2⤵
  PID:7616
- C:\Windows\System\EqaaRoq.exe
  C:\Windows\System\EqaaRoq.exe
  2⤵
  PID:7656
- C:\Windows\System\LKzhKmO.exe
  C:\Windows\System\LKzhKmO.exe
  2⤵
  PID:7676
- C:\Windows\System\HXQlgDv.exe
  C:\Windows\System\HXQlgDv.exe
  2⤵
  PID:7700
- C:\Windows\System\wJBoMvV.exe
  C:\Windows\System\wJBoMvV.exe
  2⤵
  PID:7724
- C:\Windows\System\RkMFrry.exe
  C:\Windows\System\RkMFrry.exe
  2⤵
  PID:7740
- C:\Windows\System\SMULwfk.exe
  C:\Windows\System\SMULwfk.exe
  2⤵
  PID:7768
- C:\Windows\System\PzmjXUO.exe
  C:\Windows\System\PzmjXUO.exe
  2⤵
  PID:7792
- C:\Windows\System\URERXOe.exe
  C:\Windows\System\URERXOe.exe
  2⤵
  PID:7816
- C:\Windows\System\qKPvamJ.exe
  C:\Windows\System\qKPvamJ.exe
  2⤵
  PID:7836
- C:\Windows\System\gchImiH.exe
  C:\Windows\System\gchImiH.exe
  2⤵
  PID:7856
- C:\Windows\System\NGdxFKX.exe
  C:\Windows\System\NGdxFKX.exe
  2⤵
  PID:7884
- C:\Windows\System\gtMXTFj.exe
  C:\Windows\System\gtMXTFj.exe
  2⤵
  PID:7908
- C:\Windows\System\wJzaIhD.exe
  C:\Windows\System\wJzaIhD.exe
  2⤵
  PID:7928
- C:\Windows\System\lMvhOtA.exe
  C:\Windows\System\lMvhOtA.exe
  2⤵
  PID:7948
- C:\Windows\System\qGXLURj.exe
  C:\Windows\System\qGXLURj.exe
  2⤵
  PID:7972
- C:\Windows\System\WTtMsXX.exe
  C:\Windows\System\WTtMsXX.exe
  2⤵
  PID:7996
- C:\Windows\System\ftuDbVy.exe
  C:\Windows\System\ftuDbVy.exe
  2⤵
  PID:8020
- C:\Windows\System\qcpZsBj.exe
  C:\Windows\System\qcpZsBj.exe
  2⤵
  PID:8040
- C:\Windows\System\zvGVrjU.exe
  C:\Windows\System\zvGVrjU.exe
  2⤵
  PID:8060
- C:\Windows\System\BLhPIdU.exe
  C:\Windows\System\BLhPIdU.exe
  2⤵
  PID:8092
- C:\Windows\System\AsDkCuU.exe
  C:\Windows\System\AsDkCuU.exe
  2⤵
  PID:8108
- C:\Windows\System\SrAvbIe.exe
  C:\Windows\System\SrAvbIe.exe
  2⤵
  PID:8140
- C:\Windows\System\DxATjlG.exe
  C:\Windows\System\DxATjlG.exe
  2⤵
  PID:8164
- C:\Windows\System\USHGcht.exe
  C:\Windows\System\USHGcht.exe
  2⤵
  PID:8180
- C:\Windows\System\iJAowoZ.exe
  C:\Windows\System\iJAowoZ.exe
  2⤵
  PID:6984
- C:\Windows\System\TwcXlbQ.exe
  C:\Windows\System\TwcXlbQ.exe
  2⤵
  PID:5968
- C:\Windows\System\aYLYvcD.exe
  C:\Windows\System\aYLYvcD.exe
  2⤵
  PID:6132
- C:\Windows\System\ENxcBfA.exe
  C:\Windows\System\ENxcBfA.exe
  2⤵
  PID:6224
- C:\Windows\System\wGGByup.exe
  C:\Windows\System\wGGByup.exe
  2⤵
  PID:6692
- C:\Windows\System\ddjgIhD.exe
  C:\Windows\System\ddjgIhD.exe
  2⤵
  PID:5468
- C:\Windows\System\ouRTeaz.exe
  C:\Windows\System\ouRTeaz.exe
  2⤵
  PID:6792
- C:\Windows\System\JFPlYaL.exe
  C:\Windows\System\JFPlYaL.exe
  2⤵
  PID:6824
- C:\Windows\System\vZgckeE.exe
  C:\Windows\System\vZgckeE.exe
  2⤵
  PID:6892
- C:\Windows\System\tqlpIMF.exe
  C:\Windows\System\tqlpIMF.exe
  2⤵
  PID:2100
- C:\Windows\System\iPxsixT.exe
  C:\Windows\System\iPxsixT.exe
  2⤵
  PID:7000
- C:\Windows\System\JnnTsCp.exe
  C:\Windows\System\JnnTsCp.exe
  2⤵
  PID:7388
- C:\Windows\System\cCsmEjb.exe
  C:\Windows\System\cCsmEjb.exe
  2⤵
  PID:6176
- C:\Windows\System\JrDXhrV.exe
  C:\Windows\System\JrDXhrV.exe
  2⤵
  PID:7152
- C:\Windows\System\vfzniaT.exe
  C:\Windows\System\vfzniaT.exe
  2⤵
  PID:5616
- C:\Windows\System\RqKhgcO.exe
  C:\Windows\System\RqKhgcO.exe
  2⤵
  PID:5576
- C:\Windows\System\BwxLsfv.exe
  C:\Windows\System\BwxLsfv.exe
  2⤵
  PID:5496
- C:\Windows\System\CqGRqpi.exe
  C:\Windows\System\CqGRqpi.exe
  2⤵
  PID:7496
- C:\Windows\System\pvigDRb.exe
  C:\Windows\System\pvigDRb.exe
  2⤵
  PID:6104
- C:\Windows\System\GzsXKmE.exe
  C:\Windows\System\GzsXKmE.exe
  2⤵
  PID:7684
- C:\Windows\System\rWoUWtB.exe
  C:\Windows\System\rWoUWtB.exe
  2⤵
  PID:7736
- C:\Windows\System\HCTMOck.exe
  C:\Windows\System\HCTMOck.exe
  2⤵
  PID:7776
- C:\Windows\System\fsyjIuV.exe
  C:\Windows\System\fsyjIuV.exe
  2⤵
  PID:7848
- C:\Windows\System\jnCjThf.exe
  C:\Windows\System\jnCjThf.exe
  2⤵
  PID:5236
- C:\Windows\System\BtkafpT.exe
  C:\Windows\System\BtkafpT.exe
  2⤵
  PID:7920
- C:\Windows\System\NVLUsRk.exe
  C:\Windows\System\NVLUsRk.exe
  2⤵
  PID:8204
- C:\Windows\System\ElFmdvK.exe
  C:\Windows\System\ElFmdvK.exe
  2⤵
  PID:8224
- C:\Windows\System\YeJILmA.exe
  C:\Windows\System\YeJILmA.exe
  2⤵
  PID:8260
- C:\Windows\System\QECsRTP.exe
  C:\Windows\System\QECsRTP.exe
  2⤵
  PID:8292
- C:\Windows\System\JoUUduy.exe
  C:\Windows\System\JoUUduy.exe
  2⤵
  PID:8320
- C:\Windows\System\GlulVek.exe
  C:\Windows\System\GlulVek.exe
  2⤵
  PID:8340
- C:\Windows\System\npSABpY.exe
  C:\Windows\System\npSABpY.exe
  2⤵
  PID:8360
- C:\Windows\System\waVbCvI.exe
  C:\Windows\System\waVbCvI.exe
  2⤵
  PID:8384
- C:\Windows\System\xViXRgz.exe
  C:\Windows\System\xViXRgz.exe
  2⤵
  PID:8400
- C:\Windows\System\OMAdyVD.exe
  C:\Windows\System\OMAdyVD.exe
  2⤵
  PID:8416
- C:\Windows\System\FFxdWlk.exe
  C:\Windows\System\FFxdWlk.exe
  2⤵
  PID:8440
- C:\Windows\System\ldLeQsw.exe
  C:\Windows\System\ldLeQsw.exe
  2⤵
  PID:8468
- C:\Windows\System\DXrHFAm.exe
  C:\Windows\System\DXrHFAm.exe
  2⤵
  PID:8492
- C:\Windows\System\tiaSnad.exe
  C:\Windows\System\tiaSnad.exe
  2⤵
  PID:8520
- C:\Windows\System\IfccKrq.exe
  C:\Windows\System\IfccKrq.exe
  2⤵
  PID:8544
- C:\Windows\System\PSAHrWz.exe
  C:\Windows\System\PSAHrWz.exe
  2⤵
  PID:8572
- C:\Windows\System\VVOAMbh.exe
  C:\Windows\System\VVOAMbh.exe
  2⤵
  PID:8588
- C:\Windows\System\qMfjgsY.exe
  C:\Windows\System\qMfjgsY.exe
  2⤵
  PID:8616
- C:\Windows\System\ljYEZRm.exe
  C:\Windows\System\ljYEZRm.exe
  2⤵
  PID:8636
- C:\Windows\System\jzNfEZL.exe
  C:\Windows\System\jzNfEZL.exe
  2⤵
  PID:8664
- C:\Windows\System\JGHyiUY.exe
  C:\Windows\System\JGHyiUY.exe
  2⤵
  PID:8688
- C:\Windows\System\ukXrlgW.exe
  C:\Windows\System\ukXrlgW.exe
  2⤵
  PID:8712
- C:\Windows\System\BBEpwgU.exe
  C:\Windows\System\BBEpwgU.exe
  2⤵
  PID:8732
- C:\Windows\System\RHUvOFA.exe
  C:\Windows\System\RHUvOFA.exe
  2⤵
  PID:8760
- C:\Windows\System\AeGTXCr.exe
  C:\Windows\System\AeGTXCr.exe
  2⤵
  PID:8784
- C:\Windows\System\iXypJHk.exe
  C:\Windows\System\iXypJHk.exe
  2⤵
  PID:8800
- C:\Windows\System\lDzEfgi.exe
  C:\Windows\System\lDzEfgi.exe
  2⤵
  PID:8820
- C:\Windows\System\WQEMvLH.exe
  C:\Windows\System\WQEMvLH.exe
  2⤵
  PID:8848
- C:\Windows\System\bwIAJos.exe
  C:\Windows\System\bwIAJos.exe
  2⤵
  PID:8884
- C:\Windows\System\rUyQmFJ.exe
  C:\Windows\System\rUyQmFJ.exe
  2⤵
  PID:8908
- C:\Windows\System\zmimXcI.exe
  C:\Windows\System\zmimXcI.exe
  2⤵
  PID:8932
- C:\Windows\System\TWCENpn.exe
  C:\Windows\System\TWCENpn.exe
  2⤵
  PID:8956
- C:\Windows\System\cJBRQQs.exe
  C:\Windows\System\cJBRQQs.exe
  2⤵
  PID:8980
- C:\Windows\System\wOQhgWa.exe
  C:\Windows\System\wOQhgWa.exe
  2⤵
  PID:9000
- C:\Windows\System\jKjQxGp.exe
  C:\Windows\System\jKjQxGp.exe
  2⤵
  PID:9024
- C:\Windows\System\GNoLteP.exe
  C:\Windows\System\GNoLteP.exe
  2⤵
  PID:9044
- C:\Windows\System\eKFjkWV.exe
  C:\Windows\System\eKFjkWV.exe
  2⤵
  PID:9072
- C:\Windows\System\KbQkjfl.exe
  C:\Windows\System\KbQkjfl.exe
  2⤵
  PID:9092
- C:\Windows\System\EradKcn.exe
  C:\Windows\System\EradKcn.exe
  2⤵
  PID:9112
- C:\Windows\System\pqhnCLe.exe
  C:\Windows\System\pqhnCLe.exe
  2⤵
  PID:9168
- C:\Windows\System\cdibRCj.exe
  C:\Windows\System\cdibRCj.exe
  2⤵
  PID:9192
- C:\Windows\System\ujCqokm.exe
  C:\Windows\System\ujCqokm.exe
  2⤵
  PID:9212
- C:\Windows\System\GEViNQH.exe
  C:\Windows\System\GEViNQH.exe
  2⤵
  PID:6980
- C:\Windows\System\QiSCuiC.exe
  C:\Windows\System\QiSCuiC.exe
  2⤵
  PID:6284
- C:\Windows\System\JrCIobQ.exe
  C:\Windows\System\JrCIobQ.exe
  2⤵
  PID:7004
- C:\Windows\System\CiAtTBQ.exe
  C:\Windows\System\CiAtTBQ.exe
  2⤵
  PID:6664
- C:\Windows\System\bTZSTbY.exe
  C:\Windows\System\bTZSTbY.exe
  2⤵
  PID:6504
- C:\Windows\System\aBrgPJz.exe
  C:\Windows\System\aBrgPJz.exe
  2⤵
  PID:7184
- C:\Windows\System\cRGwEre.exe
  C:\Windows\System\cRGwEre.exe
  2⤵
  PID:7760
- C:\Windows\System\nODyiUA.exe
  C:\Windows\System\nODyiUA.exe
  2⤵
  PID:5556
- C:\Windows\System\jKpzkcF.exe
  C:\Windows\System\jKpzkcF.exe
  2⤵
  PID:7504
- C:\Windows\System\bmuLozO.exe
  C:\Windows\System\bmuLozO.exe
  2⤵
  PID:7696
- C:\Windows\System\gcAZMoJ.exe
  C:\Windows\System\gcAZMoJ.exe
  2⤵
  PID:5192
- C:\Windows\System\HtpbOva.exe
  C:\Windows\System\HtpbOva.exe
  2⤵
  PID:7980
- C:\Windows\System\daFyaqg.exe
  C:\Windows\System\daFyaqg.exe
  2⤵
  PID:8232
- C:\Windows\System\CTQzrFJ.exe
  C:\Windows\System\CTQzrFJ.exe
  2⤵
  PID:7432
- C:\Windows\System\VoHFaxC.exe
  C:\Windows\System\VoHFaxC.exe
  2⤵
  PID:7564
- C:\Windows\System\aQHCwvW.exe
  C:\Windows\System\aQHCwvW.exe
  2⤵
  PID:7624
- C:\Windows\System\XlwTTBZ.exe
  C:\Windows\System\XlwTTBZ.exe
  2⤵
  PID:7652
- C:\Windows\System\EwNDxQa.exe
  C:\Windows\System\EwNDxQa.exe
  2⤵
  PID:8512
- C:\Windows\System\MsrwAVI.exe
  C:\Windows\System\MsrwAVI.exe
  2⤵
  PID:6876
- C:\Windows\System\vpNJqmw.exe
  C:\Windows\System\vpNJqmw.exe
  2⤵
  PID:7268
- C:\Windows\System\yKkcEEP.exe
  C:\Windows\System\yKkcEEP.exe
  2⤵
  PID:7832
- C:\Windows\System\NidGCRG.exe
  C:\Windows\System\NidGCRG.exe
  2⤵
  PID:6156
- C:\Windows\System\ImYPudw.exe
  C:\Windows\System\ImYPudw.exe
  2⤵
  PID:7480
- C:\Windows\System\rCimRpH.exe
  C:\Windows\System\rCimRpH.exe
  2⤵
  PID:8700
- C:\Windows\System\kAexMuZ.exe
  C:\Windows\System\kAexMuZ.exe
  2⤵
  PID:7944
- C:\Windows\System\iyQOOls.exe
  C:\Windows\System\iyQOOls.exe
  2⤵
  PID:8752
- C:\Windows\System\pSVqoEG.exe
  C:\Windows\System\pSVqoEG.exe
  2⤵
  PID:8056
- C:\Windows\System\ioHNPGF.exe
  C:\Windows\System\ioHNPGF.exe
  2⤵
  PID:8840
- C:\Windows\System\xgsxwcj.exe
  C:\Windows\System\xgsxwcj.exe
  2⤵
  PID:9236
- C:\Windows\System\ZBoOHip.exe
  C:\Windows\System\ZBoOHip.exe
  2⤵
  PID:9256
- C:\Windows\System\sBUhdTK.exe
  C:\Windows\System\sBUhdTK.exe
  2⤵
  PID:9280
- C:\Windows\System\fbZBByg.exe
  C:\Windows\System\fbZBByg.exe
  2⤵
  PID:9704
- C:\Windows\System\YDuVOrN.exe
  C:\Windows\System\YDuVOrN.exe
  2⤵
  PID:9724
- C:\Windows\System\hrbdQXd.exe
  C:\Windows\System\hrbdQXd.exe
  2⤵
  PID:9740
- C:\Windows\System\NuNQTsv.exe
  C:\Windows\System\NuNQTsv.exe
  2⤵
  PID:9764
- C:\Windows\System\tdRqkdX.exe
  C:\Windows\System\tdRqkdX.exe
  2⤵
  PID:9788
- C:\Windows\System\ruvErSG.exe
  C:\Windows\System\ruvErSG.exe
  2⤵
  PID:9808
- C:\Windows\System\PKciAyw.exe
  C:\Windows\System\PKciAyw.exe
  2⤵
  PID:9836
- C:\Windows\System\uypGabx.exe
  C:\Windows\System\uypGabx.exe
  2⤵
  PID:9860
- C:\Windows\System\ZNsKvGs.exe
  C:\Windows\System\ZNsKvGs.exe
  2⤵
  PID:9888
- C:\Windows\System\VgFYAGq.exe
  C:\Windows\System\VgFYAGq.exe
  2⤵
  PID:9908
- C:\Windows\System\zQlMCDF.exe
  C:\Windows\System\zQlMCDF.exe
  2⤵
  PID:9944
- C:\Windows\System\UHcLSqm.exe
  C:\Windows\System\UHcLSqm.exe
  2⤵
  PID:9960
- C:\Windows\System\buSKTvI.exe
  C:\Windows\System\buSKTvI.exe
  2⤵
  PID:9984
- C:\Windows\System\sfLjJOS.exe
  C:\Windows\System\sfLjJOS.exe
  2⤵
  PID:10040
- C:\Windows\System\ofCoASx.exe
  C:\Windows\System\ofCoASx.exe
  2⤵
  PID:10060
- C:\Windows\System\aqLQkuU.exe
  C:\Windows\System\aqLQkuU.exe
  2⤵
  PID:10076
- C:\Windows\System\cbfpcxo.exe
  C:\Windows\System\cbfpcxo.exe
  2⤵
  PID:10100
- C:\Windows\System\blrDJVd.exe
  C:\Windows\System\blrDJVd.exe
  2⤵
  PID:10128
- C:\Windows\System\eNtAZOQ.exe
  C:\Windows\System\eNtAZOQ.exe
  2⤵
  PID:10156
- C:\Windows\System\lceseQf.exe
  C:\Windows\System\lceseQf.exe
  2⤵
  PID:10188
- C:\Windows\System\DrQjUZR.exe
  C:\Windows\System\DrQjUZR.exe
  2⤵
  PID:10212
- C:\Windows\System\znNiGxL.exe
  C:\Windows\System\znNiGxL.exe
  2⤵
  PID:8076
- C:\Windows\System\bjffFWH.exe
  C:\Windows\System\bjffFWH.exe
  2⤵
  PID:8156
- C:\Windows\System\oHjrMOW.exe
  C:\Windows\System\oHjrMOW.exe
  2⤵
  PID:8116
- C:\Windows\System\hxnRzHf.exe
  C:\Windows\System\hxnRzHf.exe
  2⤵
  PID:9040
- C:\Windows\System\OWWqtsu.exe
  C:\Windows\System\OWWqtsu.exe
  2⤵
  PID:9080
- C:\Windows\System\hHgkRWP.exe
  C:\Windows\System\hHgkRWP.exe
  2⤵
  PID:7124
- C:\Windows\System\isDPYFs.exe
  C:\Windows\System\isDPYFs.exe
  2⤵
  PID:8484
- C:\Windows\System\WIfgnMZ.exe
  C:\Windows\System\WIfgnMZ.exe
  2⤵
  PID:6600
- C:\Windows\System\FlbXdnX.exe
  C:\Windows\System\FlbXdnX.exe
  2⤵
  PID:7320
- C:\Windows\System\gqrzqYa.exe
  C:\Windows\System\gqrzqYa.exe
  2⤵
  PID:752
- C:\Windows\System\OIEONpz.exe
  C:\Windows\System\OIEONpz.exe
  2⤵
  PID:8628
- C:\Windows\System\bPbcEZY.exe
  C:\Windows\System\bPbcEZY.exe
  2⤵
  PID:7824
- C:\Windows\System\pbrIquR.exe
  C:\Windows\System\pbrIquR.exe
  2⤵
  PID:5832
- C:\Windows\System\XcxKdVF.exe
  C:\Windows\System\XcxKdVF.exe
  2⤵
  PID:8300
- C:\Windows\System\xUOJFWU.exe
  C:\Windows\System\xUOJFWU.exe
  2⤵
  PID:8900
- C:\Windows\System\aHzaIwD.exe
  C:\Windows\System\aHzaIwD.exe
  2⤵
  PID:9008
- C:\Windows\System\AzWFWUL.exe
  C:\Windows\System\AzWFWUL.exe
  2⤵
  PID:8448
- C:\Windows\System\lFfRpRm.exe
  C:\Windows\System\lFfRpRm.exe
  2⤵
  PID:8396
- C:\Windows\System\eXHBoNd.exe
  C:\Windows\System\eXHBoNd.exe
  2⤵
  PID:7544
- C:\Windows\System\MVmyDZk.exe
  C:\Windows\System\MVmyDZk.exe
  2⤵
  PID:8580
- C:\Windows\System\CtYLqPA.exe
  C:\Windows\System\CtYLqPA.exe
  2⤵
  PID:9484
- C:\Windows\System\cAonPLG.exe
  C:\Windows\System\cAonPLG.exe
  2⤵
  PID:7284
- C:\Windows\System\byRXKPp.exe
  C:\Windows\System\byRXKPp.exe
  2⤵
  PID:7608
- C:\Windows\System\xYKlyoy.exe
  C:\Windows\System\xYKlyoy.exe
  2⤵
  PID:8536
- C:\Windows\System\KGcZboL.exe
  C:\Windows\System\KGcZboL.exe
  2⤵
  PID:7136
- C:\Windows\System\LdAAccm.exe
  C:\Windows\System\LdAAccm.exe
  2⤵
  PID:7224
- C:\Windows\System\GvjwLpj.exe
  C:\Windows\System\GvjwLpj.exe
  2⤵
  PID:8792
- C:\Windows\System\IVWVwKQ.exe
  C:\Windows\System\IVWVwKQ.exe
  2⤵
  PID:8856
- C:\Windows\System\lKVfOXR.exe
  C:\Windows\System\lKVfOXR.exe
  2⤵
  PID:9264
- C:\Windows\System\gMhlvxA.exe
  C:\Windows\System\gMhlvxA.exe
  2⤵
  PID:10252
- C:\Windows\System\wFfUvxe.exe
  C:\Windows\System\wFfUvxe.exe
  2⤵
  PID:10276
- C:\Windows\System\CzmeTWo.exe
  C:\Windows\System\CzmeTWo.exe
  2⤵
  PID:10296
- C:\Windows\System\yflQBLQ.exe
  C:\Windows\System\yflQBLQ.exe
  2⤵
  PID:10312
- C:\Windows\System\GLOvTPM.exe
  C:\Windows\System\GLOvTPM.exe
  2⤵
  PID:10332
- C:\Windows\System\VREdQRU.exe
  C:\Windows\System\VREdQRU.exe
  2⤵
  PID:10352
- C:\Windows\System\aHryfgM.exe
  C:\Windows\System\aHryfgM.exe
  2⤵
  PID:10372
- C:\Windows\System\MFTbjoO.exe
  C:\Windows\System\MFTbjoO.exe
  2⤵
  PID:10396
- C:\Windows\System\nxiKkXf.exe
  C:\Windows\System\nxiKkXf.exe
  2⤵
  PID:10420
- C:\Windows\System\lwIZNgC.exe
  C:\Windows\System\lwIZNgC.exe
  2⤵
  PID:10440
- C:\Windows\System\jdUsaFw.exe
  C:\Windows\System\jdUsaFw.exe
  2⤵
  PID:10460
- C:\Windows\System\CSFIeHH.exe
  C:\Windows\System\CSFIeHH.exe
  2⤵
  PID:10484
- C:\Windows\System\WvUuudh.exe
  C:\Windows\System\WvUuudh.exe
  2⤵
  PID:10508
- C:\Windows\System\qihVJiz.exe
  C:\Windows\System\qihVJiz.exe
  2⤵
  PID:10532
- C:\Windows\System\rHuOCZc.exe
  C:\Windows\System\rHuOCZc.exe
  2⤵
  PID:10552
- C:\Windows\System\mSMapyw.exe
  C:\Windows\System\mSMapyw.exe
  2⤵
  PID:10572
- C:\Windows\System\nHianSo.exe
  C:\Windows\System\nHianSo.exe
  2⤵
  PID:10588
- C:\Windows\System\cBslsmm.exe
  C:\Windows\System\cBslsmm.exe
  2⤵
  PID:10604
- C:\Windows\System\ZVzAkrP.exe
  C:\Windows\System\ZVzAkrP.exe
  2⤵
  PID:10632
- C:\Windows\System\dTuHUxn.exe
  C:\Windows\System\dTuHUxn.exe
  2⤵
  PID:10648
- C:\Windows\System\qJFVObw.exe
  C:\Windows\System\qJFVObw.exe
  2⤵
  PID:10668
- C:\Windows\System\RgTLkjm.exe
  C:\Windows\System\RgTLkjm.exe
  2⤵
  PID:10692
- C:\Windows\System\wBmGnyj.exe
  C:\Windows\System\wBmGnyj.exe
  2⤵
  PID:10712
- C:\Windows\System\qRbZeUl.exe
  C:\Windows\System\qRbZeUl.exe
  2⤵
  PID:10736
- C:\Windows\System\ubUsrZM.exe
  C:\Windows\System\ubUsrZM.exe
  2⤵
  PID:10756
- C:\Windows\System\PUqfANk.exe
  C:\Windows\System\PUqfANk.exe
  2⤵
  PID:10776
- C:\Windows\System\qHFoBWq.exe
  C:\Windows\System\qHFoBWq.exe
  2⤵
  PID:10804
- C:\Windows\System\BbsMDsy.exe
  C:\Windows\System\BbsMDsy.exe
  2⤵
  PID:10824
- C:\Windows\System\HoQlzcG.exe
  C:\Windows\System\HoQlzcG.exe
  2⤵
  PID:10840
- C:\Windows\System\CEKElKe.exe
  C:\Windows\System\CEKElKe.exe
  2⤵
  PID:10856
- C:\Windows\System\qsyKktw.exe
  C:\Windows\System\qsyKktw.exe
  2⤵
  PID:10884
- C:\Windows\System\heoJdri.exe
  C:\Windows\System\heoJdri.exe
  2⤵
  PID:10900
- C:\Windows\System\okMzojO.exe
  C:\Windows\System\okMzojO.exe
  2⤵
  PID:10924
- C:\Windows\System\IjeVomJ.exe
  C:\Windows\System\IjeVomJ.exe
  2⤵
  PID:10948
- C:\Windows\System\cEtBxZh.exe
  C:\Windows\System\cEtBxZh.exe
  2⤵
  PID:10972
- C:\Windows\System\MBoJxRG.exe
  C:\Windows\System\MBoJxRG.exe
  2⤵
  PID:10996
- C:\Windows\System\MTRWQBT.exe
  C:\Windows\System\MTRWQBT.exe
  2⤵
  PID:11016
- C:\Windows\System\iShtQwi.exe
  C:\Windows\System\iShtQwi.exe
  2⤵
  PID:11032
- C:\Windows\System\SfDaEVv.exe
  C:\Windows\System\SfDaEVv.exe
  2⤵
  PID:11080
- C:\Windows\System\AguoLgR.exe
  C:\Windows\System\AguoLgR.exe
  2⤵
  PID:11096
- C:\Windows\System\XDbgABs.exe
  C:\Windows\System\XDbgABs.exe
  2⤵
  PID:11116
- C:\Windows\System\eGbMKqR.exe
  C:\Windows\System\eGbMKqR.exe
  2⤵
  PID:11136
- C:\Windows\System\dxGyLhy.exe
  C:\Windows\System\dxGyLhy.exe
  2⤵
  PID:11156
- C:\Windows\System\IhokEeo.exe
  C:\Windows\System\IhokEeo.exe
  2⤵
  PID:11184
- C:\Windows\System\HiyvMWW.exe
  C:\Windows\System\HiyvMWW.exe
  2⤵
  PID:11204
- C:\Windows\System\boondjc.exe
  C:\Windows\System\boondjc.exe
  2⤵
  PID:11228
- C:\Windows\System\gaODGBK.exe
  C:\Windows\System\gaODGBK.exe
  2⤵
  PID:11256
- C:\Windows\System\cBxHeOu.exe
  C:\Windows\System\cBxHeOu.exe
  2⤵
  PID:9408
- C:\Windows\System\wnEthnU.exe
  C:\Windows\System\wnEthnU.exe
  2⤵
  PID:10232
- C:\Windows\System\ipsvEKj.exe
  C:\Windows\System\ipsvEKj.exe
  2⤵
  PID:8124
- C:\Windows\System\kTllVHb.exe
  C:\Windows\System\kTllVHb.exe
  2⤵
  PID:9088
- C:\Windows\System\DdviCcK.exe
  C:\Windows\System\DdviCcK.exe
  2⤵
  PID:2396
- C:\Windows\System\hUJOVvL.exe
  C:\Windows\System\hUJOVvL.exe
  2⤵
  PID:6836
- C:\Windows\System\WaOZZyA.exe
  C:\Windows\System\WaOZZyA.exe
  2⤵
  PID:8676
- C:\Windows\System\BnfWfQT.exe
  C:\Windows\System\BnfWfQT.exe
  2⤵
  PID:9288
- C:\Windows\System\sowlLML.exe
  C:\Windows\System\sowlLML.exe
  2⤵
  PID:8316
- C:\Windows\System\rsxSSWo.exe
  C:\Windows\System\rsxSSWo.exe
  2⤵
  PID:8460
- C:\Windows\System\TysCVkt.exe
  C:\Windows\System\TysCVkt.exe
  2⤵
  PID:8408
- C:\Windows\System\txyfCJU.exe
  C:\Windows\System\txyfCJU.exe
  2⤵
  PID:9428
- C:\Windows\System\OVNgtBj.exe
  C:\Windows\System\OVNgtBj.exe
  2⤵
  PID:6588
- C:\Windows\System\QvSWPBS.exe
  C:\Windows\System\QvSWPBS.exe
  2⤵
  PID:9504
- C:\Windows\System\KvyhwwK.exe
  C:\Windows\System\KvyhwwK.exe
  2⤵
  PID:3748
- C:\Windows\System\ydlIlLN.exe
  C:\Windows\System\ydlIlLN.exe
  2⤵
  PID:9716
- C:\Windows\System\Pbutvmg.exe
  C:\Windows\System\Pbutvmg.exe
  2⤵
  PID:10728
- C:\Windows\System\JNMViLL.exe
  C:\Windows\System\JNMViLL.exe
  2⤵
  PID:11224
- C:\Windows\System\kytpBSY.exe
  C:\Windows\System\kytpBSY.exe
  2⤵
  PID:672
- C:\Windows\System\vWvRVix.exe
  C:\Windows\System\vWvRVix.exe
  2⤵
  PID:2552
- C:\Windows\System\JuhabBW.exe
  C:\Windows\System\JuhabBW.exe
  2⤵
  PID:11272
- C:\Windows\System\WDRoLHl.exe
  C:\Windows\System\WDRoLHl.exe
  2⤵
  PID:11340
- C:\Windows\System\MWvibRW.exe
  C:\Windows\System\MWvibRW.exe
  2⤵
  PID:11368
- C:\Windows\System\hTyMnGY.exe
  C:\Windows\System\hTyMnGY.exe
  2⤵
  PID:11388
- C:\Windows\System\hBGZUrF.exe
  C:\Windows\System\hBGZUrF.exe
  2⤵
  PID:11408
- C:\Windows\System\WSHWdAv.exe
  C:\Windows\System\WSHWdAv.exe
  2⤵
  PID:11440
- C:\Windows\System\iyoMsSp.exe
  C:\Windows\System\iyoMsSp.exe
  2⤵
  PID:11460
- C:\Windows\System\PEQCkoD.exe
  C:\Windows\System\PEQCkoD.exe
  2⤵
  PID:11480
- C:\Windows\System\MwlKNtc.exe
  C:\Windows\System\MwlKNtc.exe
  2⤵
  PID:11504
- C:\Windows\System\bdqzQPd.exe
  C:\Windows\System\bdqzQPd.exe
  2⤵
  PID:11548
- C:\Windows\System\WFhgdkh.exe
  C:\Windows\System\WFhgdkh.exe
  2⤵
  PID:11584
- C:\Windows\System\wmBMhde.exe
  C:\Windows\System\wmBMhde.exe
  2⤵
  PID:11616
- C:\Windows\System\xrLTFyD.exe
  C:\Windows\System\xrLTFyD.exe
  2⤵
  PID:11636
- C:\Windows\System\LtkCXYs.exe
  C:\Windows\System\LtkCXYs.exe
  2⤵
  PID:11660
- C:\Windows\System\uEwTGRl.exe
  C:\Windows\System\uEwTGRl.exe
  2⤵
  PID:11688
- C:\Windows\System\ezBJtGj.exe
  C:\Windows\System\ezBJtGj.exe
  2⤵
  PID:11720
- C:\Windows\System\mJUEqjB.exe
  C:\Windows\System\mJUEqjB.exe
  2⤵
  PID:11744
- C:\Windows\System\plrkHSb.exe
  C:\Windows\System\plrkHSb.exe
  2⤵
  PID:11772
- C:\Windows\System\akMPWGw.exe
  C:\Windows\System\akMPWGw.exe
  2⤵
  PID:11792
- C:\Windows\System\LClGiUq.exe
  C:\Windows\System\LClGiUq.exe
  2⤵
  PID:11808
- C:\Windows\System\iKuzybn.exe
  C:\Windows\System\iKuzybn.exe
  2⤵
  PID:11824
- C:\Windows\System\urnmkin.exe
  C:\Windows\System\urnmkin.exe
  2⤵
  PID:11840
- C:\Windows\System\SoFloPw.exe
  C:\Windows\System\SoFloPw.exe
  2⤵
  PID:11856
- C:\Windows\System\vFuBURy.exe
  C:\Windows\System\vFuBURy.exe
  2⤵
  PID:11872
- C:\Windows\System\ckBEpFq.exe
  C:\Windows\System\ckBEpFq.exe
  2⤵
  PID:11888
- C:\Windows\System\yvIbdwi.exe
  C:\Windows\System\yvIbdwi.exe
  2⤵
  PID:11912
- C:\Windows\System\JfdvqlI.exe
  C:\Windows\System\JfdvqlI.exe
  2⤵
  PID:11936
- C:\Windows\System\EnCQzPD.exe
  C:\Windows\System\EnCQzPD.exe
  2⤵
  PID:11952
- C:\Windows\System\rDLRDDD.exe
  C:\Windows\System\rDLRDDD.exe
  2⤵
  PID:11968
- C:\Windows\System\hcngCJt.exe
  C:\Windows\System\hcngCJt.exe
  2⤵
  PID:11988
- C:\Windows\System\KlmGpOP.exe
  C:\Windows\System\KlmGpOP.exe
  2⤵
  PID:12008
- C:\Windows\System\wCRGoMf.exe
  C:\Windows\System\wCRGoMf.exe
  2⤵
  PID:12032
- C:\Windows\System\sgBzFFv.exe
  C:\Windows\System\sgBzFFv.exe
  2⤵
  PID:12072
- C:\Windows\System\gDNSUNW.exe
  C:\Windows\System\gDNSUNW.exe
  2⤵
  PID:12088
- C:\Windows\System\vrelYNe.exe
  C:\Windows\System\vrelYNe.exe
  2⤵
  PID:12136
- C:\Windows\System\DBUrzNa.exe
  C:\Windows\System\DBUrzNa.exe
  2⤵
  PID:12164
- C:\Windows\System\PTfnMqk.exe
  C:\Windows\System\PTfnMqk.exe
  2⤵
  PID:12180
- C:\Windows\System\bFdnzEO.exe
  C:\Windows\System\bFdnzEO.exe
  2⤵
  PID:12196
- C:\Windows\System\nvrtyJd.exe
  C:\Windows\System\nvrtyJd.exe
  2⤵
  PID:12216
- C:\Windows\System\dxjrIFk.exe
  C:\Windows\System\dxjrIFk.exe
  2⤵
  PID:12236
- C:\Windows\System\ibMPuse.exe
  C:\Windows\System\ibMPuse.exe
  2⤵
  PID:12256
- C:\Windows\System\CyKhJfB.exe
  C:\Windows\System\CyKhJfB.exe
  2⤵
  PID:12280
- C:\Windows\System\yBLLVNa.exe
  C:\Windows\System\yBLLVNa.exe
  2⤵
  PID:7392
- C:\Windows\System\JhhXqem.exe
  C:\Windows\System\JhhXqem.exe
  2⤵
  PID:11104
- C:\Windows\System\PqNzjjr.exe
  C:\Windows\System\PqNzjjr.exe
  2⤵
  PID:11008
- C:\Windows\System\PjBWJlx.exe
  C:\Windows\System\PjBWJlx.exe
  2⤵
  PID:9848
- C:\Windows\System\earaKsJ.exe
  C:\Windows\System\earaKsJ.exe
  2⤵
  PID:8680
- C:\Windows\System\FrOLyhX.exe
  C:\Windows\System\FrOLyhX.exe
  2⤵
  PID:6560
- C:\Windows\System\sEGbZYT.exe
  C:\Windows\System\sEGbZYT.exe
  2⤵
  PID:1184
- C:\Windows\System\kDLESvP.exe
  C:\Windows\System\kDLESvP.exe
  2⤵
  PID:10048
- C:\Windows\System\AepYBAV.exe
  C:\Windows\System\AepYBAV.exe
  2⤵
  PID:10364
- C:\Windows\System\iBVOopF.exe
  C:\Windows\System\iBVOopF.exe
  2⤵
  PID:11652
- C:\Windows\System\TSSLmuo.exe
  C:\Windows\System\TSSLmuo.exe
  2⤵
  PID:6700
- C:\Windows\System\VVJXehO.exe
  C:\Windows\System\VVJXehO.exe
  2⤵
  PID:11220
- C:\Windows\System\OqDCGCX.exe
  C:\Windows\System\OqDCGCX.exe
  2⤵
  PID:11836
- C:\Windows\System\kIRySSa.exe
  C:\Windows\System\kIRySSa.exe
  2⤵
  PID:1896
- C:\Windows\System\JtKcruo.exe
  C:\Windows\System\JtKcruo.exe
  2⤵
  PID:8012
- C:\Windows\System\NxEIDEW.exe
  C:\Windows\System\NxEIDEW.exe
  2⤵
  PID:11012
- C:\Windows\System\jVUBGvh.exe
  C:\Windows\System\jVUBGvh.exe
  2⤵
  PID:10272
- C:\Windows\System\MIawpZl.exe
  C:\Windows\System\MIawpZl.exe
  2⤵
  PID:9228
- C:\Windows\System\JcdGbXO.exe
  C:\Windows\System\JcdGbXO.exe
  2⤵
  PID:11488
- C:\Windows\System\QECsNsq.exe
  C:\Windows\System\QECsNsq.exe
  2⤵
  PID:12212
- C:\Windows\System\JWMDpQt.exe
  C:\Windows\System\JWMDpQt.exe
  2⤵
  PID:11600
- C:\Windows\System\ZbzTUdv.exe
  C:\Windows\System\ZbzTUdv.exe
  2⤵
  PID:4580
- C:\Windows\System\FjAvsHt.exe
  C:\Windows\System\FjAvsHt.exe
  2⤵
  PID:9816
- C:\Windows\System\jvpScMB.exe
  C:\Windows\System\jvpScMB.exe
  2⤵
  PID:11944
- C:\Windows\System\Cwythwl.exe
  C:\Windows\System\Cwythwl.exe
  2⤵
  PID:9748
- C:\Windows\System\MnKNpNS.exe
  C:\Windows\System\MnKNpNS.exe
  2⤵
  PID:1680
- C:\Windows\System\WtSgjHj.exe
  C:\Windows\System\WtSgjHj.exe
  2⤵
  PID:11380
- C:\Windows\System\XlqAjxr.exe
  C:\Windows\System\XlqAjxr.exe
  2⤵
  PID:12224
- C:\Windows\System\WbIQlyT.exe
  C:\Windows\System\WbIQlyT.exe
  2⤵
  PID:11920
- C:\Windows\System\NYnGqKQ.exe
  C:\Windows\System\NYnGqKQ.exe
  2⤵
  PID:12296
- C:\Windows\System\hpwTsPL.exe
  C:\Windows\System\hpwTsPL.exe
  2⤵
  PID:12316
- C:\Windows\System\krxsnCz.exe
  C:\Windows\System\krxsnCz.exe
  2⤵
  PID:12344
- C:\Windows\System\opoBZGH.exe
  C:\Windows\System\opoBZGH.exe
  2⤵
  PID:12376
- C:\Windows\System\xEJymXQ.exe
  C:\Windows\System\xEJymXQ.exe
  2⤵
  PID:12392
- C:\Windows\System\oxvNcwJ.exe
  C:\Windows\System\oxvNcwJ.exe
  2⤵
  PID:12416
- C:\Windows\System\xNdZLmq.exe
  C:\Windows\System\xNdZLmq.exe
  2⤵
  PID:12436
- C:\Windows\System\dPZKrqa.exe
  C:\Windows\System\dPZKrqa.exe
  2⤵
  PID:12460
- C:\Windows\System\hvekrUc.exe
  C:\Windows\System\hvekrUc.exe
  2⤵
  PID:12488
- C:\Windows\System\EhxXMwx.exe
  C:\Windows\System\EhxXMwx.exe
  2⤵
  PID:12512
- C:\Windows\System\tLOUmSB.exe
  C:\Windows\System\tLOUmSB.exe
  2⤵
  PID:12532
- C:\Windows\System\pdgZNuf.exe
  C:\Windows\System\pdgZNuf.exe
  2⤵
  PID:12560
- C:\Windows\System\CZFDiPn.exe
  C:\Windows\System\CZFDiPn.exe
  2⤵
  PID:12576
- C:\Windows\System\LKmZbco.exe
  C:\Windows\System\LKmZbco.exe
  2⤵
  PID:12612
- C:\Windows\System\glMiaPJ.exe
  C:\Windows\System\glMiaPJ.exe
  2⤵
  PID:12632
- C:\Windows\System\WApzrBI.exe
  C:\Windows\System\WApzrBI.exe
  2⤵
  PID:12652
- C:\Windows\System\LYPoGfn.exe
  C:\Windows\System\LYPoGfn.exe
  2⤵
  PID:12680
- C:\Windows\System\bUxOoqt.exe
  C:\Windows\System\bUxOoqt.exe
  2⤵
  PID:13168
- C:\Windows\System\jBRicez.exe
  C:\Windows\System\jBRicez.exe
  2⤵
  PID:13188
- C:\Windows\System\mxKAufY.exe
  C:\Windows\System\mxKAufY.exe
  2⤵
  PID:13216
- C:\Windows\System\uCFePbq.exe
  C:\Windows\System\uCFePbq.exe
  2⤵
  PID:13236
- C:\Windows\System\hLmVLlg.exe
  C:\Windows\System\hLmVLlg.exe
  2⤵
  PID:13264
- C:\Windows\System\lAYqxrA.exe
  C:\Windows\System\lAYqxrA.exe
  2⤵
  PID:13284
- C:\Windows\System\XqzQEZD.exe
  C:\Windows\System\XqzQEZD.exe
  2⤵
  PID:13300
- C:\Windows\System\jNzzDvt.exe
  C:\Windows\System\jNzzDvt.exe
  2⤵
  PID:8284
- C:\Windows\System\OjsDLgS.exe
  C:\Windows\System\OjsDLgS.exe
  2⤵
  PID:9904
- C:\Windows\System\xjDunKq.exe
  C:\Windows\System\xjDunKq.exe
  2⤵
  PID:11360
- C:\Windows\System\tiXjiBS.exe
  C:\Windows\System\tiXjiBS.exe
  2⤵
  PID:10308
- C:\Windows\System\XyLEDgu.exe
  C:\Windows\System\XyLEDgu.exe
  2⤵
  PID:11560
- C:\Windows\System\ZGiPYvm.exe
  C:\Windows\System\ZGiPYvm.exe
  2⤵
  PID:9184
- C:\Windows\System\SYucyub.exe
  C:\Windows\System\SYucyub.exe
  2⤵
  PID:9384
- C:\Windows\System\yGGJyVL.exe
  C:\Windows\System\yGGJyVL.exe
  2⤵
  PID:11832
- C:\Windows\System\QpKBVvx.exe
  C:\Windows\System\QpKBVvx.exe
  2⤵
  PID:12232
- C:\Windows\System\WyTkTYN.exe
  C:\Windows\System\WyTkTYN.exe
  2⤵
  PID:12428
- C:\Windows\System\iXXJBZb.exe
  C:\Windows\System\iXXJBZb.exe
  2⤵
  PID:12336
- C:\Windows\System\tjrpKES.exe
  C:\Windows\System\tjrpKES.exe
  2⤵
  PID:12388
- C:\Windows\System\aDFdvKb.exe
  C:\Windows\System\aDFdvKb.exe
  2⤵
  PID:12468
- C:\Windows\System\kJfCCwT.exe
  C:\Windows\System\kJfCCwT.exe
  2⤵
  PID:13020
- C:\Windows\System\AucAaDK.exe
  C:\Windows\System\AucAaDK.exe
  2⤵
  PID:12752
- C:\Windows\System\XPnThMI.exe
  C:\Windows\System\XPnThMI.exe
  2⤵
  PID:12732
- C:\Windows\System\covToJH.exe
  C:\Windows\System\covToJH.exe
  2⤵
  PID:13004
- C:\Windows\System\eBEmAwt.exe
  C:\Windows\System\eBEmAwt.exe
  2⤵
  PID:12972
- C:\Windows\System\svLajkn.exe
  C:\Windows\System\svLajkn.exe
  2⤵
  PID:12524
- C:\Windows\System\eibuoxO.exe
  C:\Windows\System\eibuoxO.exe
  2⤵
  PID:11128
- C:\Windows\System\xGHZhfA.exe
  C:\Windows\System\xGHZhfA.exe
  2⤵
  PID:13224
- C:\Windows\System\oyGAjSO.exe
  C:\Windows\System\oyGAjSO.exe
  2⤵
  PID:12364
- C:\Windows\System\bBvkhWI.exe
  C:\Windows\System\bBvkhWI.exe
  2⤵
  PID:4056
- C:\Windows\System\gwonEpF.exe
  C:\Windows\System\gwonEpF.exe
  2⤵
  PID:9920
- C:\Windows\System\jlBCWGF.exe
  C:\Windows\System\jlBCWGF.exe
  2⤵
  PID:2632
- C:\Windows\System\PXrxxyH.exe
  C:\Windows\System\PXrxxyH.exe
  2⤵
  PID:9272
- C:\Windows\System\fmPTzZq.exe
  C:\Windows\System\fmPTzZq.exe
  2⤵
  PID:12312
- C:\Windows\System\VZoHDFi.exe
  C:\Windows\System\VZoHDFi.exe
  2⤵
  PID:2428
- C:\Windows\System\HGlzAOz.exe
  C:\Windows\System\HGlzAOz.exe
  2⤵
  PID:11496
- C:\Windows\System\dJpmqic.exe
  C:\Windows\System\dJpmqic.exe
  2⤵
  PID:8216
- C:\Windows\System\ZOaiEqR.exe
  C:\Windows\System\ZOaiEqR.exe
  2⤵
  PID:12712
- C:\Windows\System\fiGGXyj.exe
  C:\Windows\System\fiGGXyj.exe
  2⤵
  PID:12816
- C:\Windows\System\VEFXHNk.exe
  C:\Windows\System\VEFXHNk.exe
  2⤵
  PID:4552
- C:\Windows\System\ZuirAEs.exe
  C:\Windows\System\ZuirAEs.exe
  2⤵
  PID:12912
- C:\Windows\System\SWJRQRz.exe
  C:\Windows\System\SWJRQRz.exe
  2⤵
  PID:12956
- C:\Windows\System\EbjJfYY.exe
  C:\Windows\System\EbjJfYY.exe
  2⤵
  PID:13096
- C:\Windows\System\PMqRIFk.exe
  C:\Windows\System\PMqRIFk.exe
  2⤵
  PID:12760
- C:\Windows\System\VoftGvz.exe
  C:\Windows\System\VoftGvz.exe
  2⤵
  PID:12880
- C:\Windows\System\NPpAsMk.exe
  C:\Windows\System\NPpAsMk.exe
  2⤵
  PID:2452
- C:\Windows\System\PkypiYU.exe
  C:\Windows\System\PkypiYU.exe
  2⤵
  PID:12988
- C:\Windows\System\XOoidmF.exe
  C:\Windows\System\XOoidmF.exe
  2⤵
  PID:13076
- C:\Windows\System\rDRVvAM.exe
  C:\Windows\System\rDRVvAM.exe
  2⤵
  PID:12768
- C:\Windows\System\PSkpOAm.exe
  C:\Windows\System\PSkpOAm.exe
  2⤵
  PID:13260
- C:\Windows\System\yJAEnhv.exe
  C:\Windows\System\yJAEnhv.exe
  2⤵
  PID:1560
- C:\Windows\System\ZyhsaYy.exe
  C:\Windows\System\ZyhsaYy.exe
  2⤵
  PID:11356
- C:\Windows\System\AhFVbuH.exe
  C:\Windows\System\AhFVbuH.exe
  2⤵
  PID:13280
- C:\Windows\System\qUwaROA.exe
  C:\Windows\System\qUwaROA.exe
  2⤵
  PID:3632
- C:\Windows\System\isMZnEg.exe
  C:\Windows\System\isMZnEg.exe
  2⤵
  PID:12688
- C:\Windows\System\tECXGNL.exe
  C:\Windows\System\tECXGNL.exe
  2⤵
  PID:4008
- C:\Windows\System\uioKVpr.exe
  C:\Windows\System\uioKVpr.exe
  2⤵
  PID:6008
- C:\Windows\System\ZxqlxoB.exe
  C:\Windows\System\ZxqlxoB.exe
  2⤵
  PID:12404
- C:\Windows\System\hTwCzBP.exe
  C:\Windows\System\hTwCzBP.exe
  2⤵
  PID:12796
- C:\Windows\System\hccQXnq.exe
  C:\Windows\System\hccQXnq.exe
  2⤵
  PID:12672
- C:\Windows\System\eQoxzqi.exe
  C:\Windows\System\eQoxzqi.exe
  2⤵
  PID:13092
- C:\Windows\System\RLOFkBq.exe
  C:\Windows\System\RLOFkBq.exe
  2⤵
  PID:13112
- C:\Windows\System\oamyprh.exe
  C:\Windows\System\oamyprh.exe
  2⤵
  PID:13016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nfpxfket.skq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\APbzmes.exe

Filesize
2.4MB

MD5
5dd72f8f7cb539994b65fe763f3e94d7

SHA1
97f2b259c598a82f96d377d6fd30a8e35ca8655f

SHA256
94f06e27e9f51ceab3200a3944d71a8bc357132d0a819997ce20b9c6bca0d7b4

SHA512
8bc4be19510420a9bf40c57107b1609d9027c23d8546e0cc03c690424412ae29ad0ee5f579a6d8d4a0e05ceffaf8edb96888c6087b848706c15b97abcfa44ba8

Download Submit
C:\Windows\System\BdCYdIp.exe

Filesize
2.4MB

MD5
d7645bdb1984a6277d2a8da58f26a324

SHA1
164e00756cdbc68d9586b6b67528e8d13d2b960e

SHA256
cf3e45fca9ea2328b044d289bf2a534f812adee492b8f117e8a46e8ff9deb0af

SHA512
23f86f791419789812852734c81254a1501cdaffdf90132d997f85f9614a75a47376f19ed065e78b030510c51447581946bc8dfb48813bb7e376139238ee74d2

Download Submit
C:\Windows\System\CFvALyE.exe

Filesize
2.4MB

MD5
eea2bb1099a8d15ffad93a4a4108e07e

SHA1
b61e22a66aace73d6141324eaf6c8c0ca64f309f

SHA256
6f41f5aef9394e723985520aa3f9999c49d57767b7ebeca3b654d8625296b1fd

SHA512
5a43325071a54e640df23132d005d8bff55ed961709aa9a1a42f25e455074771a944bfe377167b40c851325fa990e6e7581ef5653a7704e6257f426e3bd7b410

Download Submit
C:\Windows\System\DWRCEMf.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\GPhTcTa.exe

Filesize
2.4MB

MD5
49ea86888546b44d4b6e471870f718b9

SHA1
6da1267eaeefdbf86b54fdbc784d2c6625059f14

SHA256
7ba3a2db405d5f1699945c93adc35fbfdb1dcf5d9e4a274ad0223b358925437c

SHA512
1e53f443e7d692ae85e0539aa21c6ac7761c16f2872a253f5df9816c241923717fd570c2fa1b3cc4b16159a0b8cedbfe444b95088b9c0e46dc6e600d15bcd0b4

Download Submit
C:\Windows\System\HNqCgrE.exe

Filesize
2.4MB

MD5
d10e6c80968e54babed122e41528858f

SHA1
fc574bec8c971fb8bb28b24288896bee40a4ea95

SHA256
d6e092eedd59359e5a8196e52bd3d65fb11c6c13e4045a79efd1722934cd3093

SHA512
3ff5128fa54501a4658e373815046e8687b433dc1256fa80908e44ee842df1b49593e7155862f13cc4af6c9bf0d2cc1bd35e4c128ce1718222000ad0a9fabb4d

Download Submit
C:\Windows\System\JdkmRni.exe

Filesize
2.4MB

MD5
89e61d9026d53cabbf7fa9f13e0a8e5a

SHA1
dd4c9f757b01d429b7c89aa2b15fc1a9fae8e3fb

SHA256
c0b990dc48ff4dd1f05c41c6cded0f935fb0a96a7760f9cf5e3653fc38b3c857

SHA512
6216cd46c4b42379f491e21d2b4fbbfaf7d4ac805a18691d133477fbaf60f2ab9b0da24ec3e2fb9d155a8d189de57fc6a06980244bb0b00389f486d105344bd7

Download Submit
C:\Windows\System\MBIWCgm.exe

Filesize
2.4MB

MD5
46fd31cb3cd03ae68fa93ee88b33d9eb

SHA1
b3ddbbc580250abd6b184cb859ba7015b60e4b1e

SHA256
389a05162a365132a7aaf1f37869d04a0280c6ea7446b05757ffcce322ab0f13

SHA512
40dd79a33ceac9520cf80647df0d67e9470315d12353bccfe20a465ad8c0f0057ed7f2905f97482739c823619c8b36e48d4ccc04140905f9a0b40f7b7f44418f

Download Submit
C:\Windows\System\NRGigOA.exe

Filesize
2.4MB

MD5
df50a90db830e61dad5edbeb9b480237

SHA1
e6bc3324fec65b523d359504b4e9478954148c50

SHA256
98f20fcc4e89ac64d580b942232792948944aeb14b554c493d4a2dfe897927bd

SHA512
156ec8ac8596bb934f4c5b56d216e4e25c7c4df2478d042757ed1bf427dfbcdef55d66dc33bb667aace334d1a776f3f05858ee4da115c984af52386180203e1c

Download Submit
C:\Windows\System\OdulXnf.exe

Filesize
2.4MB

MD5
5adc3ac1882b1b88761a8e8479ae4db4

SHA1
7bae3d7855f9082449d21fb38801919d4b4a423f

SHA256
6dbba4c01cc1499c23625202f903d1231912160325a36e57a8424abb1d7b8ae5

SHA512
b7d9372827ebd48be26a7ce0081be8972df8490d1482139d352a7933b691cb18315e7211d1ded50cbc2467638423089e4135425554e41adea075da21a720fd88

Download Submit
C:\Windows\System\OquuGHc.exe

Filesize
2.4MB

MD5
96436aa52074b357cff54397bc9426e1

SHA1
9a4fe7822511658763699852db395aad9b791ac8

SHA256
45fefa88b268caee2f8910d43982c51f132355fd685efd20b757e993beb7594d

SHA512
e06425712819690ed4530bbf60aa539b1ec47e4cb20a0e77ee7604665846abba3ac3caf6f774ac102338a6d36c5ec0052e226d0f25a5661bf38f1e248ec1e494

Download Submit
C:\Windows\System\RjCbfvU.exe

Filesize
2.4MB

MD5
aff0d7c7da0a21ad5f423f0930238ad7

SHA1
3eafb1c15056f45d148fdeafa7b736c1fd8f74ab

SHA256
b9c5f794b3341f7dd2553bf3b3bac3fe85823fe437ff45a83fc3d80fc402d58f

SHA512
f026e4f85ef022e47103410664e68db3a9e08bfa2c8f3a083aecd631228c4bd8e3a6e197dc243789244aec5eaa6371d71b6230ca29ef50559475e369cc56bf83

Download Submit
C:\Windows\System\UWASsrL.exe

Filesize
2.4MB

MD5
a2af1f9bbcdfdf47ffc3a29c632a4e02

SHA1
7ab6ce2af1b89828170de96d37fd427322aca548

SHA256
cb58afdf975baf51d0fc5f05ff7f33047b4007e7d6bb0dc3d203f486cdf515b2

SHA512
7f28cfb250262e59f3442d4faf39a07fa53d1336eb72f8b35f83eaafabba72bf0a567af8a6fa1f6a0ce36284a4e802970b7ce9979ddb8ba2f7311403a39bc462

Download Submit
C:\Windows\System\WelIths.exe

Filesize
2.4MB

MD5
5184613498406ae5ba544de9c1d20800

SHA1
aa755f94c262c3448717660b2e0399a1a5130fd3

SHA256
92e4242f69494bbec68cb636f5fa731c173adc3f15b9d40b638f63c4bec7588a

SHA512
ec3b85a6dc60ec158c441da70b2d24023563d0decb52a0764cb5bf84949d9ae65e7ff03c3d346790b366ac970f50c55f2505dd0ee0a7607a8f7780cb9389fd24

Download Submit
C:\Windows\System\WnUCZdk.exe

Filesize
2.4MB

MD5
76ce97d644eccb1188545b86d0a374ed

SHA1
2cb1b53655a7a33bdfb7fb669533da4ab64fb3b4

SHA256
6989ee2c7c98b905f2a4db5e0a301655e8ff4ef776bf4d65cbedadf58d6e8783

SHA512
c62c0e864412dcb2a2fe34f159c72b036e49c3380c4406217cdf3dd0ac3a3d6ee9c20787df68abedf70903ec731c80a5e1e743b4b103b92074b77364e56a7121

Download Submit
C:\Windows\System\XpOumcF.exe

Filesize
2.4MB

MD5
46300a061a0c8bcc8e430d5a5f42fb53

SHA1
e4c471e0884f34a174441ce1ee8739d9494c18ea

SHA256
36122c6de9099b75b6587150cc45a8c9c1293bfcb7f15c52f903c4c92a8fbdb0

SHA512
aa3b7321db5adfcbc3d47185353ae12effcf9b8c7260514f5bdef8ff9004a805633f92435eeeef825f61ed56813ca170e2773d2b5855be2d10bd03cc5cf84320

Download Submit
C:\Windows\System\YcRWvbz.exe

Filesize
2.4MB

MD5
cecba025f8aecb9a0f4578153c34ebfb

SHA1
d41ed4e876fd519e50f0b9901daf7809f2533a68

SHA256
1ad382d6ac67c71607a359143b3b4943220122e79a452ecd4a762d1b3ee9265f

SHA512
35d537c6e66f5686f479ef951fbcf2b38fcef973af958f93bdc27c225ae90b32982115373d6c5359d1e517565af68a6df31f389d0f60a8b546f14ba0b9db9aea

Download Submit
C:\Windows\System\ZXwoxdX.exe

Filesize
2.4MB

MD5
f3290d35a87e67a6c4f77bab65dc7efc

SHA1
bf8841e262414fd79d4aeef8a8443c87bed3453c

SHA256
676434d698e96fcc8851daab2cec003713c8f9f667ac43701e465ee4621debc9

SHA512
933dac34e3b8ace9b9605866be1e8e182d1f4db9a011645c2f25fbb6a1470ee6ca4a2030c601cd604e0eed6d3425d09997aeaa5b3baa338e2e8e86e9d028ba1e

Download Submit
C:\Windows\System\bEUwNZp.exe

Filesize
2.4MB

MD5
4b856f4e6abcc2ea7afd50c3970c397b

SHA1
f3461f4a5ae84278d557309fd962acfd931313d9

SHA256
50c656390d5a9f234f008bd5c1967d4040c41f4f8ad4570479ed8be20dad9db3

SHA512
5bdd3df0d4a1bbaa7b57ea09e1e879e789426a71a86caba1b9c83dc49570d4893cd0ed81953bbd778c745d817e491152bcdbb5da254a36dffc0442df227e215e

Download Submit
C:\Windows\System\dsuuZbm.exe

Filesize
2.4MB

MD5
7d027c99b3bfe2dd8cf549d73a35f444

SHA1
56aac0826f5ba3cd389ce734075ee62dc4e1b8ed

SHA256
7b65e0bc6dbf84bbafa09addfb6d0e5f77e0e0fa2fa2ceefe3fb4756dc3cd5a7

SHA512
59a2124a849f5c991be7c0ffd745002c8dd8fe250f4d0bb4015818ad670e94190cf205633e495ecafdce9ad0a8a35a038f015a1e0aa838b6eca790d93d1a2c4f

Download Submit
C:\Windows\System\fDPPVSL.exe

Filesize
2.4MB

MD5
4d7be4d279272eba591b9f461055e7a8

SHA1
25d7b993a312599051fc4f363d40df5b4aa4d0e2

SHA256
cb2bf67259d22f8e111956268cce0d88651b26bc1f646f0d19c121fa1d9350d4

SHA512
317b651173cd1176f5ff8608263b76d14fde7024a1907f2e2ec29c2b1484d247bc4ef770b6b0acef0dc835e37589b822a86ccf39f2d7c32e800ac7949082e4a8

Download Submit
C:\Windows\System\gboEJLf.exe

Filesize
2.4MB

MD5
37c9e36b33c12feac7cc8c7f13e6aba2

SHA1
fc02071eac0551efb154ffc96cd78319e08729d9

SHA256
30944041776533a542d72a2af5937695ec76d8f0fdd54dcc81fca476cce6ac1e

SHA512
df822682d5e1aa882c114504c5de45f307c15b574b4e546e128a0a623a3d9079778013c687eb357fcfef6e0dbc9ac9a73b18d7301abf8f1a41d11ca07a2d8b0f

Download Submit
C:\Windows\System\hdBhbBb.exe

Filesize
2.4MB

MD5
2448f5613d7a511e2f395894ee14238c

SHA1
bf923f71cdaf62a226b9ccdf35144049c5c9443e

SHA256
379cbb3142c1cea7443e8bdb5f25d7ff033fb60fe020d2183b0708cf387b8beb

SHA512
0f61daa43b70e51982ffc682c15ee5124bd9b380b8d39a98389bade383e4075e98afc05d4a449c70167f5da86259e0f1e651e09aaa837c05764ab1e9ffef4caf

Download Submit
C:\Windows\System\iHNgCgt.exe

Filesize
2.4MB

MD5
0a8efa1d5b6362991dbb0b40ee3ec990

SHA1
a15b8591a82c665312d1b9459b76cd0877eee033

SHA256
a6bf272c4eb7098feb1f8e4c9fa489beaf1497b2f26eefc85a95e5c6acd81ddb

SHA512
e1f149a992295486248be219df9af064f8faea860ffa77dc9482b337972cf29d267e184cd65c025a93e43302e1edbdf13c2af0a71759544f9217144daec60089

Download Submit
C:\Windows\System\iajlyos.exe

Filesize
2.4MB

MD5
62a0c3c9f4b329162f7d8bad2bfd17d0

SHA1
5f2c54748c45359bd198482626d033be1af0033f

SHA256
6abc6aa0fc3a5b65c3bd4237f33450380a29974cce04cf87030ec8643b5dd0e8

SHA512
9fe5838a0bc337f8110a9cf42adf47a02dad150a93f9bdb1d6632b350b2c792e0d3f6a5e805badf5e8e0c182c83088b72f9cab0cc4af066a5b68d886567ec930

Download Submit
C:\Windows\System\jNqtLqT.exe

Filesize
2.4MB

MD5
a736b502ac4f808d0783dceda9493baa

SHA1
4e54a584f496aae242c23151a3ac8f7778fda7ca

SHA256
21ea16f7d25ca51cbe6b27f5cee6418e2d244ae15675152b5f14861980c67c66

SHA512
381272dbdce0d29a3124a27037c0aa0eb336f7e4f5151f275162f62216c9b0562471cb7dc0e0d2a0e52e7d03f8b69e8d238a9a9b9e44f500149432330467a663

Download Submit
C:\Windows\System\jmtnEDq.exe

Filesize
2.4MB

MD5
715264c5f086ce89b27d47a4dc265218

SHA1
97b2e0149ff2934efa1c9ca04bd2c32ddd934f9b

SHA256
cca6691219d7916705ab419753714010daa2752d56315881fa06d6280c702ecd

SHA512
51d46a7fa1ccfd09990ed603cb3b8a9dc235f301e7c3e3cfb0b7445ce901d56caa3e0fc87cbdc1fce74191b0695f61a9cee8beda325d3aa51e41fc5e6d54eed1

Download Submit
C:\Windows\System\jnFdqJX.exe

Filesize
2.4MB

MD5
8fe182438edfeb27d23dc31e6b23146e

SHA1
200292ee377c5fee236840367c8bbbf02bf0f2b2

SHA256
c1ee9ec5d83f883a570ff88da3cd55609680796e13a2da9ac4813197a64b32e0

SHA512
2f9493c5c6b27f62d1d12eb5bae9fe58d0508c28bf108240d0e25e80808877089b119b517e1de08eea5b608a8e2afac9395be23a3f48d8609faa1672b9dbe3fe

Download Submit
C:\Windows\System\kVpOQGA.exe

Filesize
2.4MB

MD5
5d750dfd96661be90c603ba4bf2e8b47

SHA1
c9106d83481de71ca0ca55d5916c38dacae2c71a

SHA256
55d6f89713eef0132d77d980ed37f4875fd9779787506cbdc0ef7fc6dae0151e

SHA512
fdd9abd3c25ed23d4f73adf84782bd65f496541301d134e17e66974e8e285eeb91d61adb3293b6f6cc3d1fbe9da33a3bd6ef0420ce849d0da24af051423cc664

Download Submit
C:\Windows\System\nTVIJFG.exe

Filesize
2.4MB

MD5
265eddbb2f32d3f5d8a01805376f8f7c

SHA1
48d56ca9e08a07277e01883330b0b6b2f71a5403

SHA256
c430bd72750370f3fcefd3fd094b23e080b1c1cea1f6453733074d1f07751cd1

SHA512
b0819868764c695b67be56da3aa9e67203f0af997b99e74e1c7ad7336e39fa4b742a3287b90798e83cb394c489351c0fb9ab43389337b41aced9598a047d901c

Download Submit
C:\Windows\System\nnTuCNR.exe

Filesize
2.4MB

MD5
d54afa51b4f4ea6d211c80c509d1e7a7

SHA1
d5888df2613daa624e7c66e54d9787ea442a86fd

SHA256
26e50dc4930f0c2435401475fe3af86e2eb9e1c8b495582e1a7d2e4af23cff02

SHA512
c7c8c467ef11605a72bca8a98f4f81cfd4b80e130c41b5a18d671ea6a00609850b76917d2f58492aeb9d4f20d41ee7adbbb29236ccfb7e55383654bffc67bb8c

Download Submit
C:\Windows\System\oBHWHzz.exe

Filesize
2.4MB

MD5
7c198e1c99ac66d1a38be027e3d36e9f

SHA1
6a2ad4de0717eb6486189d1d99f0d213dea88290

SHA256
30b735c3ea0dd4c57e6fc9375e7e3d50af9211b4efaad75d22c53f19fc7f032c

SHA512
7cce3b357c14edfaccedd7f56956597038eddbcc945c21de67241ed06fd9fd610615996a7565d48d26a127edb2bf6e051e78ddff74009075adcd23953987dd38

Download Submit
C:\Windows\System\pAfyXUP.exe

Filesize
2.4MB

MD5
1e784ff6005121c29d5b03d0e7384d71

SHA1
7326f5a1b9c2b6a05181a503e6747076c0640335

SHA256
9ee4271ddeb55f619a4d1e89918365ba14f2a185d1ec4e476a1fcb5efc68bd25

SHA512
7f7346fae50b1824158a3ddf938d1d5ce643368b14cd00f5e906aa04bb4cc78a7c876455c74e00d6f4df6ac0f78c385b286f3c7e9ab13af5dd5c8b883d14e4de

Download Submit
C:\Windows\System\rqyochZ.exe

Filesize
2.4MB

MD5
06cb6227fa64b026087797d3afaf8359

SHA1
ef5a5017f4f2e25f972282e3848e367840d478d8

SHA256
82c13ff79a5874241478a41d466468cc4d5b6ff4a029ebd137212db69c1e94b0

SHA512
da79030297b30be421514918a815f8827f0ddb751a1940869e929d73b8f33b6c9bd81cc6d3950265c49ccee98a8b47542f76e82fc29611006d59c1aff70913f1

Download Submit
C:\Windows\System\uWCcYYv.exe

Filesize
2.4MB

MD5
84f95b4874333506ebf55e685e582bfc

SHA1
417a4a00c29ac6c931682ca1c3cf1dd0b64c0eab

SHA256
c98283a6297e69c19b1e2517e9cf080aa6a16d5ca1bce144639b734c962a411d

SHA512
ae1ae989dea78db99e4c97622c8c78867993cd15360f7a941c6ca36fce1247adf51393f8ee419f19169d02e4fc38ba8fbb4cbb077ea585647a4e940c5c0ad448

Download Submit
C:\Windows\System\vFQoDwh.exe

Filesize
2.4MB

MD5
ba8eb1cc866fd7b26264489ee25c9e9e

SHA1
10e1b2acfe4385b45159a164e99ac596645e0f4e

SHA256
49cc14b3cd752db7d77cb46c2909d39a6c90942a12327f5ed59a2b2b85597243

SHA512
7e8e4f522626b04051b8a08464e1fe1c16be73c57711ea3244c968b11f14e82602a0989561eebd5adab96ab482d8855ec523980a33f7dd6a4cd6f0d6a3ad7ca9

Download Submit
C:\Windows\System\vVrVAHI.exe

Filesize
2.4MB

MD5
1cec2c88ff31e5d5142a5ef3f1c26ea0

SHA1
60a513167fe968ab55408a20442ef11b6e786da3

SHA256
9f2f10a005873e66fc8dc55716b7a436ef490300c563375951836b723b442f74

SHA512
cda542fdf5cf4e95f73f71a0c9860f13b3847f18a5b7565c630b0acb58542f51700a300c77f30d0aff320a3f57323ac7b6aed0689c3eb01db15b1fb49d20a974

Download Submit
C:\Windows\System\yQaxHJK.exe

Filesize
2.4MB

MD5
147e2a0ac87152b00a3bb753cb89cd35

SHA1
fc8fd07c6e22d7c4e8d9400d7730f2740ec4c082

SHA256
d9e5c227ddb325d0131222367ed88218880bbcc0bdcdc39340c2536d05ebeaa5

SHA512
f77e3e0355d8c802f5d9b797b9003a5705d0116f26b0530faf58ab14cdbd1ffbe55737ea16d2df30aa1ffcf6c5acaa80bfd1d35d542b0b5d400efea3288b6b74

Download Submit
C:\Windows\System\zXfvzEh.exe

Filesize
2.4MB

MD5
07f34f57de07705eb15f546eaa1e4959

SHA1
9193ea2d5127f131a46c9a9175b71c52c7dfd315

SHA256
939c8073d84e2fc8647e9128290baf930d4697c0c123942f293fae95330a5082

SHA512
fc02de9204a16eb654804a1e78f2b7e5246da07104ebafbd7f0f67c7c242fd75b47b3e5f9be48d3619a5a2afa07db6e35c46d6cb4e0606c81b361e20a8fcb266

Download Submit
memory/384-52-0x00007FF6DA2D0000-0x00007FF6DA6C2000-memory.dmp

Filesize
3.9MB

Download
memory/384-4913-0x00007FF6DA2D0000-0x00007FF6DA6C2000-memory.dmp

Filesize
3.9MB

Download
memory/392-22-0x0000023D3A7D0000-0x0000023D3A7E0000-memory.dmp

Filesize
64KB

Download
memory/392-2024-0x00007FFF0A920000-0x00007FFF0B3E1000-memory.dmp

Filesize
10.8MB

Download
memory/392-332-0x00007FFF0A920000-0x00007FFF0B3E1000-memory.dmp

Filesize
10.8MB

Download
memory/392-173-0x0000023D22060000-0x0000023D22082000-memory.dmp

Filesize
136KB

Download
memory/392-316-0x00007FFF0A923000-0x00007FFF0A925000-memory.dmp

Filesize
8KB

Download
memory/432-5050-0x00007FF7781B0000-0x00007FF7785A2000-memory.dmp

Filesize
3.9MB

Download
memory/432-287-0x00007FF7781B0000-0x00007FF7785A2000-memory.dmp

Filesize
3.9MB

Download
memory/804-4981-0x00007FF78B9C0000-0x00007FF78BDB2000-memory.dmp

Filesize
3.9MB

Download
memory/804-268-0x00007FF78B9C0000-0x00007FF78BDB2000-memory.dmp

Filesize
3.9MB

Download
memory/876-266-0x00007FF626220000-0x00007FF626612000-memory.dmp

Filesize
3.9MB

Download
memory/876-4967-0x00007FF626220000-0x00007FF626612000-memory.dmp

Filesize
3.9MB

Download
memory/1048-4911-0x00007FF75A000000-0x00007FF75A3F2000-memory.dmp

Filesize
3.9MB

Download
memory/1048-205-0x00007FF75A000000-0x00007FF75A3F2000-memory.dmp

Filesize
3.9MB

Download
memory/1268-49-0x00007FF7081D0000-0x00007FF7085C2000-memory.dmp

Filesize
3.9MB

Download
memory/1268-4907-0x00007FF7081D0000-0x00007FF7085C2000-memory.dmp

Filesize
3.9MB

Download
memory/1416-240-0x00007FF6092D0000-0x00007FF6096C2000-memory.dmp

Filesize
3.9MB

Download
memory/1416-4994-0x00007FF6092D0000-0x00007FF6096C2000-memory.dmp

Filesize
3.9MB

Download
memory/1532-5042-0x00007FF744DC0000-0x00007FF7451B2000-memory.dmp

Filesize
3.9MB

Download
memory/1532-315-0x00007FF744DC0000-0x00007FF7451B2000-memory.dmp

Filesize
3.9MB

Download
memory/1544-5009-0x00007FF7CBC50000-0x00007FF7CC042000-memory.dmp

Filesize
3.9MB

Download
memory/1544-314-0x00007FF7CBC50000-0x00007FF7CC042000-memory.dmp

Filesize
3.9MB

Download
memory/1600-269-0x00007FF6BD270000-0x00007FF6BD662000-memory.dmp

Filesize
3.9MB

Download
memory/1600-4997-0x00007FF6BD270000-0x00007FF6BD662000-memory.dmp

Filesize
3.9MB

Download
memory/1640-4995-0x00007FF610490000-0x00007FF610882000-memory.dmp

Filesize
3.9MB

Download
memory/1640-230-0x00007FF610490000-0x00007FF610882000-memory.dmp

Filesize
3.9MB

Download
memory/1756-1-0x000001C22A400000-0x000001C22A410000-memory.dmp

Filesize
64KB

Download
memory/1756-0-0x00007FF79FEF0000-0x00007FF7A02E2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-339-0x00007FF730C20000-0x00007FF731012000-memory.dmp

Filesize
3.9MB

Download
memory/1856-5022-0x00007FF730C20000-0x00007FF731012000-memory.dmp

Filesize
3.9MB

Download
memory/1920-4916-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp

Filesize
3.9MB

Download
memory/1920-125-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-21-0x00007FF654060000-0x00007FF654452000-memory.dmp

Filesize
3.9MB

Download
memory/1992-4899-0x00007FF654060000-0x00007FF654452000-memory.dmp

Filesize
3.9MB

Download
memory/2120-4917-0x00007FF618150000-0x00007FF618542000-memory.dmp

Filesize
3.9MB

Download
memory/2120-337-0x00007FF618150000-0x00007FF618542000-memory.dmp

Filesize
3.9MB

Download
memory/2200-4919-0x00007FF710050000-0x00007FF710442000-memory.dmp

Filesize
3.9MB

Download
memory/2200-98-0x00007FF710050000-0x00007FF710442000-memory.dmp

Filesize
3.9MB

Download
memory/3192-161-0x00007FF6FD490000-0x00007FF6FD882000-memory.dmp

Filesize
3.9MB

Download
memory/3192-4910-0x00007FF6FD490000-0x00007FF6FD882000-memory.dmp

Filesize
3.9MB

Download
memory/3556-15-0x00007FF627150000-0x00007FF627542000-memory.dmp

Filesize
3.9MB

Download
memory/3556-4897-0x00007FF627150000-0x00007FF627542000-memory.dmp

Filesize
3.9MB

Download
memory/3624-307-0x00007FF7C5940000-0x00007FF7C5D32000-memory.dmp

Filesize
3.9MB

Download
memory/3624-5019-0x00007FF7C5940000-0x00007FF7C5D32000-memory.dmp

Filesize
3.9MB

Download
memory/3768-338-0x00007FF674450000-0x00007FF674842000-memory.dmp

Filesize
3.9MB

Download
memory/3768-4966-0x00007FF674450000-0x00007FF674842000-memory.dmp

Filesize
3.9MB

Download
memory/4464-4901-0x00007FF6B0AE0000-0x00007FF6B0ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4464-317-0x00007FF6B0AE0000-0x00007FF6B0ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-4906-0x00007FF6DE6D0000-0x00007FF6DEAC2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-35-0x00007FF6DE6D0000-0x00007FF6DEAC2000-memory.dmp

Filesize
3.9MB

Download
memory/5072-5031-0x00007FF666350000-0x00007FF666742000-memory.dmp

Filesize
3.9MB

Download
memory/5072-239-0x00007FF666350000-0x00007FF666742000-memory.dmp

Filesize
3.9MB

Download
memory/5096-4903-0x00007FF70C8A0000-0x00007FF70CC92000-memory.dmp

Filesize
3.9MB

Download
memory/5096-333-0x00007FF70C8A0000-0x00007FF70CC92000-memory.dmp

Filesize
3.9MB

Download