xmrig | 01c75e3cd829d74929bed9abed06be84bdf96528172fc31bfa99919ba650e23b

Analysis

max time kernel
1s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d90f9cd97d14d10cd918aadb886bf020N.exe
Size

1.6MB
MD5

d90f9cd97d14d10cd918aadb886bf020
SHA1

e57c1f9e16b8f5f02e47452d61fc9eae14128601
SHA256

01c75e3cd829d74929bed9abed06be84bdf96528172fc31bfa99919ba650e23b
SHA512

ffb1ca3ee082edab50c8d858267ac4fe1fafcb99edf9ecc2c3eab4bc4789034729e797aef049f0c72f726732bb42ab751db36e3b847dba5f086811fc0f781f06
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZ204oVTUG7AgwMxqLt0e:Lz071uv4BPMkibTIA5JnJ16V

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/1836-16-0x00007FF614CE0000-0x00007FF6150D2000-memory.dmp	xmrig
behavioral2/memory/1520-114-0x00007FF788F00000-0x00007FF7892F2000-memory.dmp	xmrig
behavioral2/memory/3228-450-0x00007FF6A9540000-0x00007FF6A9932000-memory.dmp	xmrig
behavioral2/memory/3404-1042-0x00007FF64C540000-0x00007FF64C932000-memory.dmp	xmrig
behavioral2/memory/2612-1760-0x00007FF6FC250000-0x00007FF6FC642000-memory.dmp	xmrig
behavioral2/memory/2036-759-0x00007FF7B5AC0000-0x00007FF7B5EB2000-memory.dmp	xmrig
behavioral2/memory/1504-2737-0x00007FF700C60000-0x00007FF701052000-memory.dmp	xmrig
behavioral2/memory/4768-2739-0x00007FF668C40000-0x00007FF669032000-memory.dmp	xmrig
behavioral2/memory/4796-2738-0x00007FF73DC90000-0x00007FF73E082000-memory.dmp	xmrig
behavioral2/memory/3456-612-0x00007FF784600000-0x00007FF7849F2000-memory.dmp	xmrig
behavioral2/memory/1836-2741-0x00007FF614CE0000-0x00007FF6150D2000-memory.dmp	xmrig
behavioral2/memory/2612-2743-0x00007FF6FC250000-0x00007FF6FC642000-memory.dmp	xmrig
behavioral2/memory/4796-2749-0x00007FF73DC90000-0x00007FF73E082000-memory.dmp	xmrig
behavioral2/memory/3812-2751-0x00007FF6878B0000-0x00007FF687CA2000-memory.dmp	xmrig
behavioral2/memory/1520-2753-0x00007FF788F00000-0x00007FF7892F2000-memory.dmp	xmrig
behavioral2/memory/1044-2756-0x00007FF6BB4D0000-0x00007FF6BB8C2000-memory.dmp	xmrig
behavioral2/memory/4768-2760-0x00007FF668C40000-0x00007FF669032000-memory.dmp	xmrig
behavioral2/memory/4944-2762-0x00007FF68CA80000-0x00007FF68CE72000-memory.dmp	xmrig
behavioral2/memory/404-2764-0x00007FF6EDC50000-0x00007FF6EE042000-memory.dmp	xmrig
behavioral2/memory/3404-2767-0x00007FF64C540000-0x00007FF64C932000-memory.dmp	xmrig
behavioral2/memory/3456-2798-0x00007FF784600000-0x00007FF7849F2000-memory.dmp	xmrig
behavioral2/memory/1304-2793-0x00007FF78AE60000-0x00007FF78B252000-memory.dmp	xmrig
behavioral2/memory/4312-2870-0x00007FF743B90000-0x00007FF743F82000-memory.dmp	xmrig
behavioral2/memory/3228-2856-0x00007FF6A9540000-0x00007FF6A9932000-memory.dmp	xmrig
behavioral2/memory/2036-2816-0x00007FF7B5AC0000-0x00007FF7B5EB2000-memory.dmp	xmrig
behavioral2/memory/3080-2758-0x00007FF752BB0000-0x00007FF752FA2000-memory.dmp	xmrig
behavioral2/memory/1504-2746-0x00007FF700C60000-0x00007FF701052000-memory.dmp	xmrig
behavioral2/memory/1304-541-0x00007FF78AE60000-0x00007FF78B252000-memory.dmp	xmrig
behavioral2/memory/4312-377-0x00007FF743B90000-0x00007FF743F82000-memory.dmp	xmrig
behavioral2/memory/4944-339-0x00007FF68CA80000-0x00007FF68CE72000-memory.dmp	xmrig
behavioral2/memory/1044-281-0x00007FF6BB4D0000-0x00007FF6BB8C2000-memory.dmp	xmrig
behavioral2/memory/3080-228-0x00007FF752BB0000-0x00007FF752FA2000-memory.dmp	xmrig
behavioral2/memory/404-147-0x00007FF6EDC50000-0x00007FF6EE042000-memory.dmp	xmrig
behavioral2/memory/3812-83-0x00007FF6878B0000-0x00007FF687CA2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4580	powershell.exe

Executes dropped EXE 25 IoCs

pid	Process
1836	KyrZPbN.exe
2612	oqWwiBO.exe
1504	iYYXeoL.exe
688	GoRjtdN.exe
4796	QzDWQov.exe
4768	SSBTmky.exe
3812	RPanvaY.exe
3972	TpImNcR.exe
1520	qamSQPg.exe
760	OoYGuOb.exe
404	vQlMzRa.exe
3080	uMAZuAY.exe
1044	RZYcGOI.exe
4944	brnzwbm.exe
2412	tuzRsHn.exe
4312	sqkZLeg.exe
3228	sXHcteK.exe
1304	qUTLPak.exe
3456	oZTxoex.exe
2036	PREPVKe.exe
3404	Yfixvjr.exe
3692	UAJXLci.exe
1228	ZfmtHar.exe
3048	YJtGvHC.exe
3356	FKKCmZH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3548-0-0x00007FF73A0D0000-0x00007FF73A4C2000-memory.dmp	upx
behavioral2/memory/1836-16-0x00007FF614CE0000-0x00007FF6150D2000-memory.dmp	upx
behavioral2/files/0x000d0000000233a0-53.dat	upx
behavioral2/files/0x00090000000233ab-73.dat	upx
behavioral2/memory/1520-114-0x00007FF788F00000-0x00007FF7892F2000-memory.dmp	upx
behavioral2/files/0x0007000000023453-151.dat	upx
behavioral2/memory/3228-450-0x00007FF6A9540000-0x00007FF6A9932000-memory.dmp	upx
behavioral2/memory/3404-1042-0x00007FF64C540000-0x00007FF64C932000-memory.dmp	upx
behavioral2/memory/2612-1760-0x00007FF6FC250000-0x00007FF6FC642000-memory.dmp	upx
behavioral2/memory/2036-759-0x00007FF7B5AC0000-0x00007FF7B5EB2000-memory.dmp	upx
behavioral2/memory/1504-2737-0x00007FF700C60000-0x00007FF701052000-memory.dmp	upx
behavioral2/memory/4768-2739-0x00007FF668C40000-0x00007FF669032000-memory.dmp	upx
behavioral2/memory/4796-2738-0x00007FF73DC90000-0x00007FF73E082000-memory.dmp	upx
behavioral2/memory/3456-612-0x00007FF784600000-0x00007FF7849F2000-memory.dmp	upx
behavioral2/memory/1836-2741-0x00007FF614CE0000-0x00007FF6150D2000-memory.dmp	upx
behavioral2/memory/2612-2743-0x00007FF6FC250000-0x00007FF6FC642000-memory.dmp	upx
behavioral2/memory/4796-2749-0x00007FF73DC90000-0x00007FF73E082000-memory.dmp	upx
behavioral2/memory/3812-2751-0x00007FF6878B0000-0x00007FF687CA2000-memory.dmp	upx
behavioral2/memory/1520-2753-0x00007FF788F00000-0x00007FF7892F2000-memory.dmp	upx
behavioral2/memory/1044-2756-0x00007FF6BB4D0000-0x00007FF6BB8C2000-memory.dmp	upx
behavioral2/memory/4768-2760-0x00007FF668C40000-0x00007FF669032000-memory.dmp	upx
behavioral2/memory/4944-2762-0x00007FF68CA80000-0x00007FF68CE72000-memory.dmp	upx
behavioral2/memory/404-2764-0x00007FF6EDC50000-0x00007FF6EE042000-memory.dmp	upx
behavioral2/memory/3404-2767-0x00007FF64C540000-0x00007FF64C932000-memory.dmp	upx
behavioral2/memory/3456-2798-0x00007FF784600000-0x00007FF7849F2000-memory.dmp	upx
behavioral2/memory/1304-2793-0x00007FF78AE60000-0x00007FF78B252000-memory.dmp	upx
behavioral2/memory/4312-2870-0x00007FF743B90000-0x00007FF743F82000-memory.dmp	upx
behavioral2/memory/3228-2856-0x00007FF6A9540000-0x00007FF6A9932000-memory.dmp	upx
behavioral2/memory/2036-2816-0x00007FF7B5AC0000-0x00007FF7B5EB2000-memory.dmp	upx
behavioral2/memory/3080-2758-0x00007FF752BB0000-0x00007FF752FA2000-memory.dmp	upx
behavioral2/memory/1504-2746-0x00007FF700C60000-0x00007FF701052000-memory.dmp	upx
behavioral2/memory/1304-541-0x00007FF78AE60000-0x00007FF78B252000-memory.dmp	upx
behavioral2/memory/4312-377-0x00007FF743B90000-0x00007FF743F82000-memory.dmp	upx
behavioral2/memory/4944-339-0x00007FF68CA80000-0x00007FF68CE72000-memory.dmp	upx
behavioral2/memory/1044-281-0x00007FF6BB4D0000-0x00007FF6BB8C2000-memory.dmp	upx
behavioral2/memory/3080-228-0x00007FF752BB0000-0x00007FF752FA2000-memory.dmp	upx
behavioral2/files/0x0007000000023445-188.dat	upx
behavioral2/files/0x000700000002345a-184.dat	upx
behavioral2/files/0x0007000000023459-183.dat	upx
behavioral2/files/0x0007000000023450-178.dat	upx
behavioral2/files/0x0007000000023456-174.dat	upx
behavioral2/files/0x0007000000023455-169.dat	upx
behavioral2/files/0x0007000000023447-167.dat	upx
behavioral2/files/0x000700000002344c-159.dat	upx
behavioral2/files/0x0007000000023446-155.dat	upx
behavioral2/files/0x000700000002344a-189.dat	upx
behavioral2/files/0x0007000000023444-187.dat	upx
behavioral2/files/0x0007000000023448-149.dat	upx
behavioral2/memory/404-147-0x00007FF6EDC50000-0x00007FF6EE042000-memory.dmp	upx
behavioral2/files/0x0007000000023452-141.dat	upx
behavioral2/files/0x0007000000023451-136.dat	upx
behavioral2/files/0x000900000002338d-180.dat	upx
behavioral2/files/0x0007000000023458-179.dat	upx
behavioral2/files/0x0007000000023449-133.dat	upx
behavioral2/files/0x000700000002344f-131.dat	upx
behavioral2/files/0x0007000000023443-127.dat	upx
behavioral2/files/0x000700000002344e-165.dat	upx
behavioral2/files/0x0007000000023454-162.dat	upx
behavioral2/files/0x000700000002344d-124.dat	upx
behavioral2/files/0x000700000002344b-121.dat	upx
behavioral2/files/0x0007000000023442-88.dat	upx
behavioral2/files/0x00080000000233a9-87.dat	upx
behavioral2/files/0x0007000000023444-84.dat	upx
behavioral2/memory/3812-83-0x00007FF6878B0000-0x00007FF687CA2000-memory.dmp	upx

Drops file in Windows directory 34 IoCs

description	ioc	Process
File created	C:\Windows\System\TOVVMqG.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\iYYXeoL.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\sXHcteK.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\PREPVKe.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\zasyYwf.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\VpzVgRh.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\GoRjtdN.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\tuzRsHn.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\YJtGvHC.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\tVHcZNu.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\OoYGuOb.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\oZTxoex.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\KyrZPbN.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\SSBTmky.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\vQlMzRa.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\tAMXYkJ.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\brnzwbm.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\RZYcGOI.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\qUTLPak.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\Yfixvjr.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\UAJXLci.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\EOfxuvT.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\oqWwiBO.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\uMAZuAY.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\LUwjEPS.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\ZfmtHar.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\FKKCmZH.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\CFyFBuQ.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\TpImNcR.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\sqkZLeg.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\qamSQPg.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\wRIpPnt.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\QzDWQov.exe	d90f9cd97d14d10cd918aadb886bf020N.exe
File created	C:\Windows\System\RPanvaY.exe	d90f9cd97d14d10cd918aadb886bf020N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3548	d90f9cd97d14d10cd918aadb886bf020N.exe
Token: SeLockMemoryPrivilege	3548	d90f9cd97d14d10cd918aadb886bf020N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 4580	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	87
PID 3548 wrote to memory of 4580	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	87
PID 3548 wrote to memory of 1836	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	88
PID 3548 wrote to memory of 1836	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	88
PID 3548 wrote to memory of 2612	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	89
PID 3548 wrote to memory of 2612	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	89
PID 3548 wrote to memory of 1504	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	90
PID 3548 wrote to memory of 1504	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	90
PID 3548 wrote to memory of 688	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	91
PID 3548 wrote to memory of 688	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	91
PID 3548 wrote to memory of 4796	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	92
PID 3548 wrote to memory of 4796	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	92
PID 3548 wrote to memory of 4768	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	93
PID 3548 wrote to memory of 4768	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	93
PID 3548 wrote to memory of 3812	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	94
PID 3548 wrote to memory of 3812	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	94
PID 3548 wrote to memory of 3972	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	95
PID 3548 wrote to memory of 3972	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	95
PID 3548 wrote to memory of 1520	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	96
PID 3548 wrote to memory of 1520	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	96
PID 3548 wrote to memory of 404	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	97
PID 3548 wrote to memory of 404	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	97
PID 3548 wrote to memory of 3080	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	98
PID 3548 wrote to memory of 3080	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	98
PID 3548 wrote to memory of 4944	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	99
PID 3548 wrote to memory of 4944	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	99
PID 3548 wrote to memory of 760	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	100
PID 3548 wrote to memory of 760	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	100
PID 3548 wrote to memory of 1044	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	101
PID 3548 wrote to memory of 1044	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	101
PID 3548 wrote to memory of 2412	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	102
PID 3548 wrote to memory of 2412	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	102
PID 3548 wrote to memory of 4312	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	103
PID 3548 wrote to memory of 4312	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	103
PID 3548 wrote to memory of 3228	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	104
PID 3548 wrote to memory of 3228	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	104
PID 3548 wrote to memory of 3456	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	105
PID 3548 wrote to memory of 3456	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	105
PID 3548 wrote to memory of 2036	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	106
PID 3548 wrote to memory of 2036	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	106
PID 3548 wrote to memory of 1304	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	107
PID 3548 wrote to memory of 1304	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	107
PID 3548 wrote to memory of 3404	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	108
PID 3548 wrote to memory of 3404	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	108
PID 3548 wrote to memory of 3692	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	109
PID 3548 wrote to memory of 3692	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	109
PID 3548 wrote to memory of 1228	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	110
PID 3548 wrote to memory of 1228	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	110
PID 3548 wrote to memory of 3048	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	111
PID 3548 wrote to memory of 3048	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	111
PID 3548 wrote to memory of 3356	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	112
PID 3548 wrote to memory of 3356	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	112
PID 3548 wrote to memory of 3732	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	113
PID 3548 wrote to memory of 3732	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	113
PID 3548 wrote to memory of 2988	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	114
PID 3548 wrote to memory of 2988	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	114
PID 3548 wrote to memory of 2768	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	115
PID 3548 wrote to memory of 2768	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	115
PID 3548 wrote to memory of 2980	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	116
PID 3548 wrote to memory of 2980	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	116
PID 3548 wrote to memory of 1636	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	117
PID 3548 wrote to memory of 1636	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	117
PID 3548 wrote to memory of 3888	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	118
PID 3548 wrote to memory of 3888	3548	d90f9cd97d14d10cd918aadb886bf020N.exe	118

C:\Users\Admin\AppData\Local\Temp\d90f9cd97d14d10cd918aadb886bf020N.exe
"C:\Users\Admin\AppData\Local\Temp\d90f9cd97d14d10cd918aadb886bf020N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4580
- C:\Windows\System\KyrZPbN.exe
  C:\Windows\System\KyrZPbN.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\oqWwiBO.exe
  C:\Windows\System\oqWwiBO.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\iYYXeoL.exe
  C:\Windows\System\iYYXeoL.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\GoRjtdN.exe
  C:\Windows\System\GoRjtdN.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\QzDWQov.exe
  C:\Windows\System\QzDWQov.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\SSBTmky.exe
  C:\Windows\System\SSBTmky.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\RPanvaY.exe
  C:\Windows\System\RPanvaY.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\TpImNcR.exe
  C:\Windows\System\TpImNcR.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\qamSQPg.exe
  C:\Windows\System\qamSQPg.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\vQlMzRa.exe
  C:\Windows\System\vQlMzRa.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\uMAZuAY.exe
  C:\Windows\System\uMAZuAY.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\brnzwbm.exe
  C:\Windows\System\brnzwbm.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\OoYGuOb.exe
  C:\Windows\System\OoYGuOb.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\RZYcGOI.exe
  C:\Windows\System\RZYcGOI.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\tuzRsHn.exe
  C:\Windows\System\tuzRsHn.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\sqkZLeg.exe
  C:\Windows\System\sqkZLeg.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\sXHcteK.exe
  C:\Windows\System\sXHcteK.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\oZTxoex.exe
  C:\Windows\System\oZTxoex.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\PREPVKe.exe
  C:\Windows\System\PREPVKe.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\qUTLPak.exe
  C:\Windows\System\qUTLPak.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\Yfixvjr.exe
  C:\Windows\System\Yfixvjr.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\UAJXLci.exe
  C:\Windows\System\UAJXLci.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\ZfmtHar.exe
  C:\Windows\System\ZfmtHar.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\YJtGvHC.exe
  C:\Windows\System\YJtGvHC.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\FKKCmZH.exe
  C:\Windows\System\FKKCmZH.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\zasyYwf.exe
  C:\Windows\System\zasyYwf.exe
  2⤵
  PID:3732
- C:\Windows\System\wRIpPnt.exe
  C:\Windows\System\wRIpPnt.exe
  2⤵
  PID:2988
- C:\Windows\System\tAMXYkJ.exe
  C:\Windows\System\tAMXYkJ.exe
  2⤵
  PID:2768
- C:\Windows\System\CFyFBuQ.exe
  C:\Windows\System\CFyFBuQ.exe
  2⤵
  PID:2980
- C:\Windows\System\EOfxuvT.exe
  C:\Windows\System\EOfxuvT.exe
  2⤵
  PID:1636
- C:\Windows\System\LUwjEPS.exe
  C:\Windows\System\LUwjEPS.exe
  2⤵
  PID:3888
- C:\Windows\System\TOVVMqG.exe
  C:\Windows\System\TOVVMqG.exe
  2⤵
  PID:2392
- C:\Windows\System\tVHcZNu.exe
  C:\Windows\System\tVHcZNu.exe
  2⤵
  PID:408
- C:\Windows\System\VpzVgRh.exe
  C:\Windows\System\VpzVgRh.exe
  2⤵
  PID:512
- C:\Windows\System\pbeaEBo.exe
  C:\Windows\System\pbeaEBo.exe
  2⤵
  PID:4472
- C:\Windows\System\mDLqKxW.exe
  C:\Windows\System\mDLqKxW.exe
  2⤵
  PID:4272
- C:\Windows\System\aVyHHkF.exe
  C:\Windows\System\aVyHHkF.exe
  2⤵
  PID:3856
- C:\Windows\System\ueXTGWc.exe
  C:\Windows\System\ueXTGWc.exe
  2⤵
  PID:4500
- C:\Windows\System\ITvBMQJ.exe
  C:\Windows\System\ITvBMQJ.exe
  2⤵
  PID:2016
- C:\Windows\System\jUkoLVt.exe
  C:\Windows\System\jUkoLVt.exe
  2⤵
  PID:3424
- C:\Windows\System\lokgrPU.exe
  C:\Windows\System\lokgrPU.exe
  2⤵
  PID:2232
- C:\Windows\System\JZAVMkK.exe
  C:\Windows\System\JZAVMkK.exe
  2⤵
  PID:5004
- C:\Windows\System\RBaDjdY.exe
  C:\Windows\System\RBaDjdY.exe
  2⤵
  PID:2072
- C:\Windows\System\Aeocixz.exe
  C:\Windows\System\Aeocixz.exe
  2⤵
  PID:720
- C:\Windows\System\hIMgwdi.exe
  C:\Windows\System\hIMgwdi.exe
  2⤵
  PID:4404
- C:\Windows\System\TrQfEdG.exe
  C:\Windows\System\TrQfEdG.exe
  2⤵
  PID:5040
- C:\Windows\System\TeHJIEl.exe
  C:\Windows\System\TeHJIEl.exe
  2⤵
  PID:4992
- C:\Windows\System\yZmTFAc.exe
  C:\Windows\System\yZmTFAc.exe
  2⤵
  PID:3300
- C:\Windows\System\dUBomzg.exe
  C:\Windows\System\dUBomzg.exe
  2⤵
  PID:5028
- C:\Windows\System\bYRFptL.exe
  C:\Windows\System\bYRFptL.exe
  2⤵
  PID:2700
- C:\Windows\System\BgvynHC.exe
  C:\Windows\System\BgvynHC.exe
  2⤵
  PID:1968
- C:\Windows\System\idMlUrH.exe
  C:\Windows\System\idMlUrH.exe
  2⤵
  PID:1336
- C:\Windows\System\OFrFqSC.exe
  C:\Windows\System\OFrFqSC.exe
  2⤵
  PID:4736
- C:\Windows\System\jWYpCmo.exe
  C:\Windows\System\jWYpCmo.exe
  2⤵
  PID:1456
- C:\Windows\System\FsvBZEz.exe
  C:\Windows\System\FsvBZEz.exe
  2⤵
  PID:5096
- C:\Windows\System\bPhzwsU.exe
  C:\Windows\System\bPhzwsU.exe
  2⤵
  PID:2384
- C:\Windows\System\MTmpILc.exe
  C:\Windows\System\MTmpILc.exe
  2⤵
  PID:3876
- C:\Windows\System\sOYhsJf.exe
  C:\Windows\System\sOYhsJf.exe
  2⤵
  PID:2252
- C:\Windows\System\CQDoDZQ.exe
  C:\Windows\System\CQDoDZQ.exe
  2⤵
  PID:4232
- C:\Windows\System\MVExFRw.exe
  C:\Windows\System\MVExFRw.exe
  2⤵
  PID:3224
- C:\Windows\System\zViiOgF.exe
  C:\Windows\System\zViiOgF.exe
  2⤵
  PID:2008
- C:\Windows\System\whvniXs.exe
  C:\Windows\System\whvniXs.exe
  2⤵
  PID:5140
- C:\Windows\System\DRORCcg.exe
  C:\Windows\System\DRORCcg.exe
  2⤵
  PID:5160
- C:\Windows\System\FEpJOPD.exe
  C:\Windows\System\FEpJOPD.exe
  2⤵
  PID:5184
- C:\Windows\System\SzsqysZ.exe
  C:\Windows\System\SzsqysZ.exe
  2⤵
  PID:5208
- C:\Windows\System\MFSFRga.exe
  C:\Windows\System\MFSFRga.exe
  2⤵
  PID:5228
- C:\Windows\System\WiRwBwS.exe
  C:\Windows\System\WiRwBwS.exe
  2⤵
  PID:5248
- C:\Windows\System\slXSGFp.exe
  C:\Windows\System\slXSGFp.exe
  2⤵
  PID:5272
- C:\Windows\System\REqKDWl.exe
  C:\Windows\System\REqKDWl.exe
  2⤵
  PID:5288
- C:\Windows\System\AZJcgAs.exe
  C:\Windows\System\AZJcgAs.exe
  2⤵
  PID:5312
- C:\Windows\System\YUQfhho.exe
  C:\Windows\System\YUQfhho.exe
  2⤵
  PID:5328
- C:\Windows\System\QpYOOQe.exe
  C:\Windows\System\QpYOOQe.exe
  2⤵
  PID:5348
- C:\Windows\System\zKvEdZP.exe
  C:\Windows\System\zKvEdZP.exe
  2⤵
  PID:5372
- C:\Windows\System\esOKogC.exe
  C:\Windows\System\esOKogC.exe
  2⤵
  PID:5400
- C:\Windows\System\BqlnlUF.exe
  C:\Windows\System\BqlnlUF.exe
  2⤵
  PID:5420
- C:\Windows\System\RBxSlnx.exe
  C:\Windows\System\RBxSlnx.exe
  2⤵
  PID:5444
- C:\Windows\System\CVimJXX.exe
  C:\Windows\System\CVimJXX.exe
  2⤵
  PID:5464
- C:\Windows\System\JIOoyWb.exe
  C:\Windows\System\JIOoyWb.exe
  2⤵
  PID:5480
- C:\Windows\System\RbagTEj.exe
  C:\Windows\System\RbagTEj.exe
  2⤵
  PID:5504
- C:\Windows\System\DZqMSvU.exe
  C:\Windows\System\DZqMSvU.exe
  2⤵
  PID:5532
- C:\Windows\System\GNnXTcN.exe
  C:\Windows\System\GNnXTcN.exe
  2⤵
  PID:5556
- C:\Windows\System\DqZmviA.exe
  C:\Windows\System\DqZmviA.exe
  2⤵
  PID:5584
- C:\Windows\System\MjSmCEO.exe
  C:\Windows\System\MjSmCEO.exe
  2⤵
  PID:5636
- C:\Windows\System\FiBNiDJ.exe
  C:\Windows\System\FiBNiDJ.exe
  2⤵
  PID:5652
- C:\Windows\System\oRzAldk.exe
  C:\Windows\System\oRzAldk.exe
  2⤵
  PID:5672
- C:\Windows\System\anWhpSS.exe
  C:\Windows\System\anWhpSS.exe
  2⤵
  PID:5692
- C:\Windows\System\oBfPivy.exe
  C:\Windows\System\oBfPivy.exe
  2⤵
  PID:5712
- C:\Windows\System\pLnnswR.exe
  C:\Windows\System\pLnnswR.exe
  2⤵
  PID:5728
- C:\Windows\System\HVeDcRi.exe
  C:\Windows\System\HVeDcRi.exe
  2⤵
  PID:5752
- C:\Windows\System\iZduflz.exe
  C:\Windows\System\iZduflz.exe
  2⤵
  PID:5772
- C:\Windows\System\YSxsfYK.exe
  C:\Windows\System\YSxsfYK.exe
  2⤵
  PID:5792
- C:\Windows\System\fiedloF.exe
  C:\Windows\System\fiedloF.exe
  2⤵
  PID:5820
- C:\Windows\System\pjaZUcP.exe
  C:\Windows\System\pjaZUcP.exe
  2⤵
  PID:5836
- C:\Windows\System\UKQwPux.exe
  C:\Windows\System\UKQwPux.exe
  2⤵
  PID:5864
- C:\Windows\System\SomjmSA.exe
  C:\Windows\System\SomjmSA.exe
  2⤵
  PID:5884
- C:\Windows\System\kWcXuTt.exe
  C:\Windows\System\kWcXuTt.exe
  2⤵
  PID:5900
- C:\Windows\System\xETCUom.exe
  C:\Windows\System\xETCUom.exe
  2⤵
  PID:5920
- C:\Windows\System\aOSsJrQ.exe
  C:\Windows\System\aOSsJrQ.exe
  2⤵
  PID:5936
- C:\Windows\System\JyCldHb.exe
  C:\Windows\System\JyCldHb.exe
  2⤵
  PID:5960
- C:\Windows\System\UljSYHV.exe
  C:\Windows\System\UljSYHV.exe
  2⤵
  PID:5984
- C:\Windows\System\qCODuDK.exe
  C:\Windows\System\qCODuDK.exe
  2⤵
  PID:6012
- C:\Windows\System\JeUhNLV.exe
  C:\Windows\System\JeUhNLV.exe
  2⤵
  PID:6032
- C:\Windows\System\ZXtcZpe.exe
  C:\Windows\System\ZXtcZpe.exe
  2⤵
  PID:6056
- C:\Windows\System\pSjCiYi.exe
  C:\Windows\System\pSjCiYi.exe
  2⤵
  PID:6072
- C:\Windows\System\heNJfYE.exe
  C:\Windows\System\heNJfYE.exe
  2⤵
  PID:6092
- C:\Windows\System\aRjctcM.exe
  C:\Windows\System\aRjctcM.exe
  2⤵
  PID:6116
- C:\Windows\System\rnwaqJk.exe
  C:\Windows\System\rnwaqJk.exe
  2⤵
  PID:4896
- C:\Windows\System\rqbySZM.exe
  C:\Windows\System\rqbySZM.exe
  2⤵
  PID:2220
- C:\Windows\System\OKViQhF.exe
  C:\Windows\System\OKViQhF.exe
  2⤵
  PID:2808
- C:\Windows\System\JpKzrBe.exe
  C:\Windows\System\JpKzrBe.exe
  2⤵
  PID:3596
- C:\Windows\System\OssBbXU.exe
  C:\Windows\System\OssBbXU.exe
  2⤵
  PID:4012
- C:\Windows\System\QvcuEPb.exe
  C:\Windows\System\QvcuEPb.exe
  2⤵
  PID:3136
- C:\Windows\System\nmTEBTK.exe
  C:\Windows\System\nmTEBTK.exe
  2⤵
  PID:5456
- C:\Windows\System\TfiwFnd.exe
  C:\Windows\System\TfiwFnd.exe
  2⤵
  PID:5552
- C:\Windows\System\PncPJPH.exe
  C:\Windows\System\PncPJPH.exe
  2⤵
  PID:4448
- C:\Windows\System\NsccLtn.exe
  C:\Windows\System\NsccLtn.exe
  2⤵
  PID:5148
- C:\Windows\System\gaxwgAN.exe
  C:\Windows\System\gaxwgAN.exe
  2⤵
  PID:5176
- C:\Windows\System\hFAZlVs.exe
  C:\Windows\System\hFAZlVs.exe
  2⤵
  PID:2400
- C:\Windows\System\vxUrKsA.exe
  C:\Windows\System\vxUrKsA.exe
  2⤵
  PID:4576
- C:\Windows\System\prnhrPM.exe
  C:\Windows\System\prnhrPM.exe
  2⤵
  PID:3636
- C:\Windows\System\vhqYtKk.exe
  C:\Windows\System\vhqYtKk.exe
  2⤵
  PID:5912
- C:\Windows\System\VAblPTt.exe
  C:\Windows\System\VAblPTt.exe
  2⤵
  PID:5952
- C:\Windows\System\dlVYHqf.exe
  C:\Windows\System\dlVYHqf.exe
  2⤵
  PID:5592
- C:\Windows\System\MKyidwd.exe
  C:\Windows\System\MKyidwd.exe
  2⤵
  PID:5192
- C:\Windows\System\zYOZeoY.exe
  C:\Windows\System\zYOZeoY.exe
  2⤵
  PID:5220
- C:\Windows\System\dohBZBj.exe
  C:\Windows\System\dohBZBj.exe
  2⤵
  PID:3500
- C:\Windows\System\immeZQy.exe
  C:\Windows\System\immeZQy.exe
  2⤵
  PID:5304
- C:\Windows\System\xvJHoJs.exe
  C:\Windows\System\xvJHoJs.exe
  2⤵
  PID:5340
- C:\Windows\System\pOyeecI.exe
  C:\Windows\System\pOyeecI.exe
  2⤵
  PID:6152
- C:\Windows\System\KAASrZq.exe
  C:\Windows\System\KAASrZq.exe
  2⤵
  PID:6176
- C:\Windows\System\zTBFYlq.exe
  C:\Windows\System\zTBFYlq.exe
  2⤵
  PID:6212
- C:\Windows\System\GfVfJVg.exe
  C:\Windows\System\GfVfJVg.exe
  2⤵
  PID:6228
- C:\Windows\System\YQPGWaM.exe
  C:\Windows\System\YQPGWaM.exe
  2⤵
  PID:6248
- C:\Windows\System\DyhDFXo.exe
  C:\Windows\System\DyhDFXo.exe
  2⤵
  PID:6268
- C:\Windows\System\DDOlBOe.exe
  C:\Windows\System\DDOlBOe.exe
  2⤵
  PID:6292
- C:\Windows\System\rFaifBv.exe
  C:\Windows\System\rFaifBv.exe
  2⤵
  PID:6308
- C:\Windows\System\pqpYwVw.exe
  C:\Windows\System\pqpYwVw.exe
  2⤵
  PID:6332
- C:\Windows\System\aPjJmRm.exe
  C:\Windows\System\aPjJmRm.exe
  2⤵
  PID:6376
- C:\Windows\System\ejgKswf.exe
  C:\Windows\System\ejgKswf.exe
  2⤵
  PID:6392
- C:\Windows\System\OxVKQPI.exe
  C:\Windows\System\OxVKQPI.exe
  2⤵
  PID:6416
- C:\Windows\System\okGyPpG.exe
  C:\Windows\System\okGyPpG.exe
  2⤵
  PID:6440
- C:\Windows\System\Itpfglk.exe
  C:\Windows\System\Itpfglk.exe
  2⤵
  PID:6456
- C:\Windows\System\cpKQrQB.exe
  C:\Windows\System\cpKQrQB.exe
  2⤵
  PID:6488
- C:\Windows\System\UfesBSV.exe
  C:\Windows\System\UfesBSV.exe
  2⤵
  PID:6508
- C:\Windows\System\sPuIjuz.exe
  C:\Windows\System\sPuIjuz.exe
  2⤵
  PID:6524
- C:\Windows\System\kOKTZKT.exe
  C:\Windows\System\kOKTZKT.exe
  2⤵
  PID:6540
- C:\Windows\System\mziKCLL.exe
  C:\Windows\System\mziKCLL.exe
  2⤵
  PID:6560
- C:\Windows\System\suHCaiB.exe
  C:\Windows\System\suHCaiB.exe
  2⤵
  PID:6576
- C:\Windows\System\FCGfLAp.exe
  C:\Windows\System\FCGfLAp.exe
  2⤵
  PID:6592
- C:\Windows\System\TTpexXJ.exe
  C:\Windows\System\TTpexXJ.exe
  2⤵
  PID:6612
- C:\Windows\System\AMEoGLs.exe
  C:\Windows\System\AMEoGLs.exe
  2⤵
  PID:6636
- C:\Windows\System\ncozVZq.exe
  C:\Windows\System\ncozVZq.exe
  2⤵
  PID:6656
- C:\Windows\System\YWLBrEq.exe
  C:\Windows\System\YWLBrEq.exe
  2⤵
  PID:6676
- C:\Windows\System\qbtuIfj.exe
  C:\Windows\System\qbtuIfj.exe
  2⤵
  PID:6696
- C:\Windows\System\ploAnZk.exe
  C:\Windows\System\ploAnZk.exe
  2⤵
  PID:6716
- C:\Windows\System\EGNQomP.exe
  C:\Windows\System\EGNQomP.exe
  2⤵
  PID:6740
- C:\Windows\System\SwlBaCC.exe
  C:\Windows\System\SwlBaCC.exe
  2⤵
  PID:6772
- C:\Windows\System\XHmFwvy.exe
  C:\Windows\System\XHmFwvy.exe
  2⤵
  PID:6788
- C:\Windows\System\kKAhCUh.exe
  C:\Windows\System\kKAhCUh.exe
  2⤵
  PID:6816
- C:\Windows\System\nIqWfBM.exe
  C:\Windows\System\nIqWfBM.exe
  2⤵
  PID:6832
- C:\Windows\System\ovjCVZE.exe
  C:\Windows\System\ovjCVZE.exe
  2⤵
  PID:6856
- C:\Windows\System\kOwzBax.exe
  C:\Windows\System\kOwzBax.exe
  2⤵
  PID:6872
- C:\Windows\System\DYxkWab.exe
  C:\Windows\System\DYxkWab.exe
  2⤵
  PID:6896
- C:\Windows\System\dMIIkQY.exe
  C:\Windows\System\dMIIkQY.exe
  2⤵
  PID:6924
- C:\Windows\System\nyRfpoD.exe
  C:\Windows\System\nyRfpoD.exe
  2⤵
  PID:6948
- C:\Windows\System\PPDtuIE.exe
  C:\Windows\System\PPDtuIE.exe
  2⤵
  PID:6964
- C:\Windows\System\KYXmrCi.exe
  C:\Windows\System\KYXmrCi.exe
  2⤵
  PID:6996
- C:\Windows\System\ZPpYkgk.exe
  C:\Windows\System\ZPpYkgk.exe
  2⤵
  PID:7020
- C:\Windows\System\cFHMsUK.exe
  C:\Windows\System\cFHMsUK.exe
  2⤵
  PID:7040
- C:\Windows\System\VMRPCxP.exe
  C:\Windows\System\VMRPCxP.exe
  2⤵
  PID:7068
- C:\Windows\System\fvxAIBY.exe
  C:\Windows\System\fvxAIBY.exe
  2⤵
  PID:7092
- C:\Windows\System\ScXeDlo.exe
  C:\Windows\System\ScXeDlo.exe
  2⤵
  PID:7112
- C:\Windows\System\ojEBoRC.exe
  C:\Windows\System\ojEBoRC.exe
  2⤵
  PID:7136
- C:\Windows\System\PMSdQnt.exe
  C:\Windows\System\PMSdQnt.exe
  2⤵
  PID:7156
- C:\Windows\System\yiXzkgO.exe
  C:\Windows\System\yiXzkgO.exe
  2⤵
  PID:5380
- C:\Windows\System\PgyiqSe.exe
  C:\Windows\System\PgyiqSe.exe
  2⤵
  PID:5392
- C:\Windows\System\lMJiZfH.exe
  C:\Windows\System\lMJiZfH.exe
  2⤵
  PID:5476
- C:\Windows\System\ZQWXOfh.exe
  C:\Windows\System\ZQWXOfh.exe
  2⤵
  PID:6028
- C:\Windows\System\WWUVgJU.exe
  C:\Windows\System\WWUVgJU.exe
  2⤵
  PID:3208
- C:\Windows\System\DExCsSa.exe
  C:\Windows\System\DExCsSa.exe
  2⤵
  PID:4240
- C:\Windows\System\APynhsw.exe
  C:\Windows\System\APynhsw.exe
  2⤵
  PID:5620
- C:\Windows\System\yNIKpYu.exe
  C:\Windows\System\yNIKpYu.exe
  2⤵
  PID:5668
- C:\Windows\System\Pyertor.exe
  C:\Windows\System\Pyertor.exe
  2⤵
  PID:5700
- C:\Windows\System\TKrAJHl.exe
  C:\Windows\System\TKrAJHl.exe
  2⤵
  PID:5740
- C:\Windows\System\iozOuJW.exe
  C:\Windows\System\iozOuJW.exe
  2⤵
  PID:988
- C:\Windows\System\pucpwdz.exe
  C:\Windows\System\pucpwdz.exe
  2⤵
  PID:5072
- C:\Windows\System\tUdQmIE.exe
  C:\Windows\System\tUdQmIE.exe
  2⤵
  PID:5892
- C:\Windows\System\XAtQzCw.exe
  C:\Windows\System\XAtQzCw.exe
  2⤵
  PID:6324
- C:\Windows\System\djEnKBf.exe
  C:\Windows\System\djEnKBf.exe
  2⤵
  PID:5968
- C:\Windows\System\WIotWOR.exe
  C:\Windows\System\WIotWOR.exe
  2⤵
  PID:996
- C:\Windows\System\oQaJRsy.exe
  C:\Windows\System\oQaJRsy.exe
  2⤵
  PID:1524
- C:\Windows\System\jNkWdjN.exe
  C:\Windows\System\jNkWdjN.exe
  2⤵
  PID:6100
- C:\Windows\System\wmEbYvu.exe
  C:\Windows\System\wmEbYvu.exe
  2⤵
  PID:6608
- C:\Windows\System\ptFbViK.exe
  C:\Windows\System\ptFbViK.exe
  2⤵
  PID:7172
- C:\Windows\System\iTDnqDX.exe
  C:\Windows\System\iTDnqDX.exe
  2⤵
  PID:7212
- C:\Windows\System\LLoeBTJ.exe
  C:\Windows\System\LLoeBTJ.exe
  2⤵
  PID:7232
- C:\Windows\System\okgaBvo.exe
  C:\Windows\System\okgaBvo.exe
  2⤵
  PID:7276
- C:\Windows\System\hPGIWpX.exe
  C:\Windows\System\hPGIWpX.exe
  2⤵
  PID:7292
- C:\Windows\System\mrgGymv.exe
  C:\Windows\System\mrgGymv.exe
  2⤵
  PID:7324
- C:\Windows\System\Dkvbjsl.exe
  C:\Windows\System\Dkvbjsl.exe
  2⤵
  PID:7344
- C:\Windows\System\iLbqEFD.exe
  C:\Windows\System\iLbqEFD.exe
  2⤵
  PID:7364
- C:\Windows\System\cOFYKun.exe
  C:\Windows\System\cOFYKun.exe
  2⤵
  PID:7396
- C:\Windows\System\VDiZjdJ.exe
  C:\Windows\System\VDiZjdJ.exe
  2⤵
  PID:7416
- C:\Windows\System\ThhSgGR.exe
  C:\Windows\System\ThhSgGR.exe
  2⤵
  PID:7752
- C:\Windows\System\rHZWEtj.exe
  C:\Windows\System\rHZWEtj.exe
  2⤵
  PID:7780
- C:\Windows\System\sTZsrrY.exe
  C:\Windows\System\sTZsrrY.exe
  2⤵
  PID:7820
- C:\Windows\System\bsOnZfm.exe
  C:\Windows\System\bsOnZfm.exe
  2⤵
  PID:7836
- C:\Windows\System\GoIUAuX.exe
  C:\Windows\System\GoIUAuX.exe
  2⤵
  PID:7864
- C:\Windows\System\eOfPYCP.exe
  C:\Windows\System\eOfPYCP.exe
  2⤵
  PID:7880
- C:\Windows\System\LBmErYL.exe
  C:\Windows\System\LBmErYL.exe
  2⤵
  PID:7904
- C:\Windows\System\XPtluQZ.exe
  C:\Windows\System\XPtluQZ.exe
  2⤵
  PID:7928
- C:\Windows\System\GDyMjon.exe
  C:\Windows\System\GDyMjon.exe
  2⤵
  PID:7944
- C:\Windows\System\bWwGEcz.exe
  C:\Windows\System\bWwGEcz.exe
  2⤵
  PID:7972
- C:\Windows\System\cEIhmbm.exe
  C:\Windows\System\cEIhmbm.exe
  2⤵
  PID:7988
- C:\Windows\System\mwWDPrl.exe
  C:\Windows\System\mwWDPrl.exe
  2⤵
  PID:8012
- C:\Windows\System\WREvhAL.exe
  C:\Windows\System\WREvhAL.exe
  2⤵
  PID:8032
- C:\Windows\System\FEsinqC.exe
  C:\Windows\System\FEsinqC.exe
  2⤵
  PID:8052
- C:\Windows\System\sIkiGhh.exe
  C:\Windows\System\sIkiGhh.exe
  2⤵
  PID:8076
- C:\Windows\System\QYFfCEq.exe
  C:\Windows\System\QYFfCEq.exe
  2⤵
  PID:8092
- C:\Windows\System\dWUSRQA.exe
  C:\Windows\System\dWUSRQA.exe
  2⤵
  PID:8116
- C:\Windows\System\BNDpXWR.exe
  C:\Windows\System\BNDpXWR.exe
  2⤵
  PID:8132
- C:\Windows\System\iBVgkEl.exe
  C:\Windows\System\iBVgkEl.exe
  2⤵
  PID:8160
- C:\Windows\System\aYCKHFp.exe
  C:\Windows\System\aYCKHFp.exe
  2⤵
  PID:8176
- C:\Windows\System\sKqQdws.exe
  C:\Windows\System\sKqQdws.exe
  2⤵
  PID:2160
- C:\Windows\System\isPVspp.exe
  C:\Windows\System\isPVspp.exe
  2⤵
  PID:1568
- C:\Windows\System\kVoSRKi.exe
  C:\Windows\System\kVoSRKi.exe
  2⤵
  PID:5496
- C:\Windows\System\fSngCrI.exe
  C:\Windows\System\fSngCrI.exe
  2⤵
  PID:3040
- C:\Windows\System\SMxoFoU.exe
  C:\Windows\System\SMxoFoU.exe
  2⤵
  PID:4316
- C:\Windows\System\nBLPTtZ.exe
  C:\Windows\System\nBLPTtZ.exe
  2⤵
  PID:4692
- C:\Windows\System\dFiHVUe.exe
  C:\Windows\System\dFiHVUe.exe
  2⤵
  PID:6184
- C:\Windows\System\XLSZjCg.exe
  C:\Windows\System\XLSZjCg.exe
  2⤵
  PID:5180
- C:\Windows\System\ijlbydK.exe
  C:\Windows\System\ijlbydK.exe
  2⤵
  PID:6260
- C:\Windows\System\nFRtHLL.exe
  C:\Windows\System\nFRtHLL.exe
  2⤵
  PID:7036
- C:\Windows\System\ulRyqTe.exe
  C:\Windows\System\ulRyqTe.exe
  2⤵
  PID:7108
- C:\Windows\System\pvQPDnU.exe
  C:\Windows\System\pvQPDnU.exe
  2⤵
  PID:1388
- C:\Windows\System\xfHMKne.exe
  C:\Windows\System\xfHMKne.exe
  2⤵
  PID:6620
- C:\Windows\System\YTSfonC.exe
  C:\Windows\System\YTSfonC.exe
  2⤵
  PID:5812
- C:\Windows\System\QRSpGwW.exe
  C:\Windows\System\QRSpGwW.exe
  2⤵
  PID:6008
- C:\Windows\System\VqpvqRm.exe
  C:\Windows\System\VqpvqRm.exe
  2⤵
  PID:6712
- C:\Windows\System\sxOhJiy.exe
  C:\Windows\System\sxOhJiy.exe
  2⤵
  PID:5076
- C:\Windows\System\PQgijtX.exe
  C:\Windows\System\PQgijtX.exe
  2⤵
  PID:7460
- C:\Windows\System\hRhGJLJ.exe
  C:\Windows\System\hRhGJLJ.exe
  2⤵
  PID:5240
- C:\Windows\System\fXuWGMu.exe
  C:\Windows\System\fXuWGMu.exe
  2⤵
  PID:5300
- C:\Windows\System\NeGFHiP.exe
  C:\Windows\System\NeGFHiP.exe
  2⤵
  PID:6984
- C:\Windows\System\aTxKblk.exe
  C:\Windows\System\aTxKblk.exe
  2⤵
  PID:6344
- C:\Windows\System\aHOCXxb.exe
  C:\Windows\System\aHOCXxb.exe
  2⤵
  PID:6384
- C:\Windows\System\sdslFTV.exe
  C:\Windows\System\sdslFTV.exe
  2⤵
  PID:1764
- C:\Windows\System\oQGyTdO.exe
  C:\Windows\System\oQGyTdO.exe
  2⤵
  PID:5500
- C:\Windows\System\BchpKbm.exe
  C:\Windows\System\BchpKbm.exe
  2⤵
  PID:6572
- C:\Windows\System\GaYdGcP.exe
  C:\Windows\System\GaYdGcP.exe
  2⤵
  PID:1560
- C:\Windows\System\rjkruIM.exe
  C:\Windows\System\rjkruIM.exe
  2⤵
  PID:6604
- C:\Windows\System\qcttajm.exe
  C:\Windows\System\qcttajm.exe
  2⤵
  PID:8208
- C:\Windows\System\NlBtuYj.exe
  C:\Windows\System\NlBtuYj.exe
  2⤵
  PID:8228
- C:\Windows\System\PYfbomK.exe
  C:\Windows\System\PYfbomK.exe
  2⤵
  PID:8248
- C:\Windows\System\SbffrWp.exe
  C:\Windows\System\SbffrWp.exe
  2⤵
  PID:8264
- C:\Windows\System\WSRpmnr.exe
  C:\Windows\System\WSRpmnr.exe
  2⤵
  PID:8288
- C:\Windows\System\qInvfVC.exe
  C:\Windows\System\qInvfVC.exe
  2⤵
  PID:8304
- C:\Windows\System\GSgdrxT.exe
  C:\Windows\System\GSgdrxT.exe
  2⤵
  PID:8332
- C:\Windows\System\qyAMEqQ.exe
  C:\Windows\System\qyAMEqQ.exe
  2⤵
  PID:8364
- C:\Windows\System\IAHLfdF.exe
  C:\Windows\System\IAHLfdF.exe
  2⤵
  PID:8380
- C:\Windows\System\yeKqXts.exe
  C:\Windows\System\yeKqXts.exe
  2⤵
  PID:8412
- C:\Windows\System\uSDPGHQ.exe
  C:\Windows\System\uSDPGHQ.exe
  2⤵
  PID:8436
- C:\Windows\System\VkcYJKj.exe
  C:\Windows\System\VkcYJKj.exe
  2⤵
  PID:8452
- C:\Windows\System\RCbznsn.exe
  C:\Windows\System\RCbznsn.exe
  2⤵
  PID:8480
- C:\Windows\System\myaKSjK.exe
  C:\Windows\System\myaKSjK.exe
  2⤵
  PID:8496
- C:\Windows\System\zLzTyRN.exe
  C:\Windows\System\zLzTyRN.exe
  2⤵
  PID:8556
- C:\Windows\System\pXXYlgU.exe
  C:\Windows\System\pXXYlgU.exe
  2⤵
  PID:8584
- C:\Windows\System\kniDiEQ.exe
  C:\Windows\System\kniDiEQ.exe
  2⤵
  PID:8604
- C:\Windows\System\gNWnKVc.exe
  C:\Windows\System\gNWnKVc.exe
  2⤵
  PID:8620
- C:\Windows\System\umxPUoi.exe
  C:\Windows\System\umxPUoi.exe
  2⤵
  PID:8648
- C:\Windows\System\yRwYUWK.exe
  C:\Windows\System\yRwYUWK.exe
  2⤵
  PID:8668
- C:\Windows\System\KcODazp.exe
  C:\Windows\System\KcODazp.exe
  2⤵
  PID:8692
- C:\Windows\System\UXskzKe.exe
  C:\Windows\System\UXskzKe.exe
  2⤵
  PID:8712
- C:\Windows\System\fskmsDH.exe
  C:\Windows\System\fskmsDH.exe
  2⤵
  PID:8736
- C:\Windows\System\lGLlWFj.exe
  C:\Windows\System\lGLlWFj.exe
  2⤵
  PID:8760
- C:\Windows\System\sRitfOE.exe
  C:\Windows\System\sRitfOE.exe
  2⤵
  PID:8776
- C:\Windows\System\IhAFJKh.exe
  C:\Windows\System\IhAFJKh.exe
  2⤵
  PID:8804
- C:\Windows\System\dODmduG.exe
  C:\Windows\System\dODmduG.exe
  2⤵
  PID:8824
- C:\Windows\System\hNQgrtk.exe
  C:\Windows\System\hNQgrtk.exe
  2⤵
  PID:8848
- C:\Windows\System\UViINAc.exe
  C:\Windows\System\UViINAc.exe
  2⤵
  PID:8872
- C:\Windows\System\mCWBuMI.exe
  C:\Windows\System\mCWBuMI.exe
  2⤵
  PID:8892
- C:\Windows\System\ooZKXBu.exe
  C:\Windows\System\ooZKXBu.exe
  2⤵
  PID:8912
- C:\Windows\System\JiqLlcl.exe
  C:\Windows\System\JiqLlcl.exe
  2⤵
  PID:8936
- C:\Windows\System\SwsSzsD.exe
  C:\Windows\System\SwsSzsD.exe
  2⤵
  PID:8956
- C:\Windows\System\dYLeBHt.exe
  C:\Windows\System\dYLeBHt.exe
  2⤵
  PID:8976
- C:\Windows\System\thMqtUH.exe
  C:\Windows\System\thMqtUH.exe
  2⤵
  PID:9000
- C:\Windows\System\IoWYuRD.exe
  C:\Windows\System\IoWYuRD.exe
  2⤵
  PID:9024
- C:\Windows\System\OHdHmgs.exe
  C:\Windows\System\OHdHmgs.exe
  2⤵
  PID:9044
- C:\Windows\System\hiwKUFJ.exe
  C:\Windows\System\hiwKUFJ.exe
  2⤵
  PID:9064
- C:\Windows\System\ygiSsXH.exe
  C:\Windows\System\ygiSsXH.exe
  2⤵
  PID:9088
- C:\Windows\System\MfDwlty.exe
  C:\Windows\System\MfDwlty.exe
  2⤵
  PID:9120
- C:\Windows\System\TJTjYbE.exe
  C:\Windows\System\TJTjYbE.exe
  2⤵
  PID:9140
- C:\Windows\System\XbvLhEo.exe
  C:\Windows\System\XbvLhEo.exe
  2⤵
  PID:9160
- C:\Windows\System\qJCgBDr.exe
  C:\Windows\System\qJCgBDr.exe
  2⤵
  PID:9184
- C:\Windows\System\XvSzFWN.exe
  C:\Windows\System\XvSzFWN.exe
  2⤵
  PID:9204
- C:\Windows\System\IngZsnR.exe
  C:\Windows\System\IngZsnR.exe
  2⤵
  PID:6672
- C:\Windows\System\xuARQhX.exe
  C:\Windows\System\xuARQhX.exe
  2⤵
  PID:6476
- C:\Windows\System\AuYJSSu.exe
  C:\Windows\System\AuYJSSu.exe
  2⤵
  PID:7268
- C:\Windows\System\QOqakSp.exe
  C:\Windows\System\QOqakSp.exe
  2⤵
  PID:7300
- C:\Windows\System\kUAxbZP.exe
  C:\Windows\System\kUAxbZP.exe
  2⤵
  PID:6748
- C:\Windows\System\GHjVDmg.exe
  C:\Windows\System\GHjVDmg.exe
  2⤵
  PID:6768
- C:\Windows\System\kDebBlK.exe
  C:\Windows\System\kDebBlK.exe
  2⤵
  PID:6804
- C:\Windows\System\HvRRvVp.exe
  C:\Windows\System\HvRRvVp.exe
  2⤵
  PID:6848
- C:\Windows\System\fZktPIv.exe
  C:\Windows\System\fZktPIv.exe
  2⤵
  PID:7844
- C:\Windows\System\YJjRbed.exe
  C:\Windows\System\YJjRbed.exe
  2⤵
  PID:6936
- C:\Windows\System\aNqmMtK.exe
  C:\Windows\System\aNqmMtK.exe
  2⤵
  PID:7940
- C:\Windows\System\mErIzQd.exe
  C:\Windows\System\mErIzQd.exe
  2⤵
  PID:8024
- C:\Windows\System\DAEXzdD.exe
  C:\Windows\System\DAEXzdD.exe
  2⤵
  PID:8128
- C:\Windows\System\ZmaNfLl.exe
  C:\Windows\System\ZmaNfLl.exe
  2⤵
  PID:7012
- C:\Windows\System\jNcorOO.exe
  C:\Windows\System\jNcorOO.exe
  2⤵
  PID:3624
- C:\Windows\System\ENTtUFO.exe
  C:\Windows\System\ENTtUFO.exe
  2⤵
  PID:7088
- C:\Windows\System\eCwJVHg.exe
  C:\Windows\System\eCwJVHg.exe
  2⤵
  PID:6280
- C:\Windows\System\DmTzDYi.exe
  C:\Windows\System\DmTzDYi.exe
  2⤵
  PID:4048
- C:\Windows\System\sWmRDZX.exe
  C:\Windows\System\sWmRDZX.exe
  2⤵
  PID:7548
- C:\Windows\System\DkynsUu.exe
  C:\Windows\System\DkynsUu.exe
  2⤵
  PID:5516
- C:\Windows\System\gYJwjor.exe
  C:\Windows\System\gYJwjor.exe
  2⤵
  PID:6388
- C:\Windows\System\CKkQBLU.exe
  C:\Windows\System\CKkQBLU.exe
  2⤵
  PID:5708
- C:\Windows\System\YKCgcGl.exe
  C:\Windows\System\YKCgcGl.exe
  2⤵
  PID:6520
- C:\Windows\System\DbhTnYv.exe
  C:\Windows\System\DbhTnYv.exe
  2⤵
  PID:6688
- C:\Windows\System\zTGHrwK.exe
  C:\Windows\System\zTGHrwK.exe
  2⤵
  PID:7220
- C:\Windows\System\FGHBMCt.exe
  C:\Windows\System\FGHBMCt.exe
  2⤵
  PID:8360
- C:\Windows\System\BmOuQZR.exe
  C:\Windows\System\BmOuQZR.exe
  2⤵
  PID:8408
- C:\Windows\System\gcUWtqG.exe
  C:\Windows\System\gcUWtqG.exe
  2⤵
  PID:9224
- C:\Windows\System\ANzaueo.exe
  C:\Windows\System\ANzaueo.exe
  2⤵
  PID:9248
- C:\Windows\System\KAESxtV.exe
  C:\Windows\System\KAESxtV.exe
  2⤵
  PID:9276
- C:\Windows\System\cWlhPHg.exe
  C:\Windows\System\cWlhPHg.exe
  2⤵
  PID:9356
- C:\Windows\System\byEtOdd.exe
  C:\Windows\System\byEtOdd.exe
  2⤵
  PID:9376
- C:\Windows\System\kzdcuAm.exe
  C:\Windows\System\kzdcuAm.exe
  2⤵
  PID:9396
- C:\Windows\System\nmhhKdD.exe
  C:\Windows\System\nmhhKdD.exe
  2⤵
  PID:9420
- C:\Windows\System\crLquAv.exe
  C:\Windows\System\crLquAv.exe
  2⤵
  PID:9440
- C:\Windows\System\XhenCfI.exe
  C:\Windows\System\XhenCfI.exe
  2⤵
  PID:9460
- C:\Windows\System\cefGZJv.exe
  C:\Windows\System\cefGZJv.exe
  2⤵
  PID:9476
- C:\Windows\System\yBSLbTu.exe
  C:\Windows\System\yBSLbTu.exe
  2⤵
  PID:9500
- C:\Windows\System\JKKkWQn.exe
  C:\Windows\System\JKKkWQn.exe
  2⤵
  PID:9524
- C:\Windows\System\cWBcRHI.exe
  C:\Windows\System\cWBcRHI.exe
  2⤵
  PID:9540
- C:\Windows\System\zLpTvJI.exe
  C:\Windows\System\zLpTvJI.exe
  2⤵
  PID:9560
- C:\Windows\System\VAOrzhE.exe
  C:\Windows\System\VAOrzhE.exe
  2⤵
  PID:9580
- C:\Windows\System\VKAztkQ.exe
  C:\Windows\System\VKAztkQ.exe
  2⤵
  PID:9600
- C:\Windows\System\sUTIFUC.exe
  C:\Windows\System\sUTIFUC.exe
  2⤵
  PID:9616
- C:\Windows\System\lkaQszP.exe
  C:\Windows\System\lkaQszP.exe
  2⤵
  PID:9656
- C:\Windows\System\iErhyIU.exe
  C:\Windows\System\iErhyIU.exe
  2⤵
  PID:9672
- C:\Windows\System\ppPRZZJ.exe
  C:\Windows\System\ppPRZZJ.exe
  2⤵
  PID:9692
- C:\Windows\System\PcjXYjm.exe
  C:\Windows\System\PcjXYjm.exe
  2⤵
  PID:9724
- C:\Windows\System\XoPhwpK.exe
  C:\Windows\System\XoPhwpK.exe
  2⤵
  PID:9740
- C:\Windows\System\qmhZyUg.exe
  C:\Windows\System\qmhZyUg.exe
  2⤵
  PID:9764
- C:\Windows\System\GjAGwWV.exe
  C:\Windows\System\GjAGwWV.exe
  2⤵
  PID:9784
- C:\Windows\System\YEIrnAt.exe
  C:\Windows\System\YEIrnAt.exe
  2⤵
  PID:9800
- C:\Windows\System\GLELLgZ.exe
  C:\Windows\System\GLELLgZ.exe
  2⤵
  PID:9820
- C:\Windows\System\vrFWuBK.exe
  C:\Windows\System\vrFWuBK.exe
  2⤵
  PID:9836
- C:\Windows\System\XpgtQro.exe
  C:\Windows\System\XpgtQro.exe
  2⤵
  PID:9860
- C:\Windows\System\ltOlWEU.exe
  C:\Windows\System\ltOlWEU.exe
  2⤵
  PID:9880
- C:\Windows\System\yjPefOZ.exe
  C:\Windows\System\yjPefOZ.exe
  2⤵
  PID:9900
- C:\Windows\System\WompqYH.exe
  C:\Windows\System\WompqYH.exe
  2⤵
  PID:9920
- C:\Windows\System\CNMNXuN.exe
  C:\Windows\System\CNMNXuN.exe
  2⤵
  PID:9940
- C:\Windows\System\jXKjAvI.exe
  C:\Windows\System\jXKjAvI.exe
  2⤵
  PID:9960
- C:\Windows\System\YURLgOq.exe
  C:\Windows\System\YURLgOq.exe
  2⤵
  PID:9984
- C:\Windows\System\SIynDYP.exe
  C:\Windows\System\SIynDYP.exe
  2⤵
  PID:10000
- C:\Windows\System\LxqqrFa.exe
  C:\Windows\System\LxqqrFa.exe
  2⤵
  PID:10020
- C:\Windows\System\vLiCAMZ.exe
  C:\Windows\System\vLiCAMZ.exe
  2⤵
  PID:10044
- C:\Windows\System\saiUevw.exe
  C:\Windows\System\saiUevw.exe
  2⤵
  PID:10064
- C:\Windows\System\bFYKqTx.exe
  C:\Windows\System\bFYKqTx.exe
  2⤵
  PID:10092
- C:\Windows\System\guFsmHP.exe
  C:\Windows\System\guFsmHP.exe
  2⤵
  PID:10112
- C:\Windows\System\tQvNmnb.exe
  C:\Windows\System\tQvNmnb.exe
  2⤵
  PID:10128
- C:\Windows\System\WlmTBdL.exe
  C:\Windows\System\WlmTBdL.exe
  2⤵
  PID:10156
- C:\Windows\System\hdCEeLG.exe
  C:\Windows\System\hdCEeLG.exe
  2⤵
  PID:10176
- C:\Windows\System\MtLrTlA.exe
  C:\Windows\System\MtLrTlA.exe
  2⤵
  PID:10196
- C:\Windows\System\lBRtxQT.exe
  C:\Windows\System\lBRtxQT.exe
  2⤵
  PID:10220
- C:\Windows\System\TLBtMrc.exe
  C:\Windows\System\TLBtMrc.exe
  2⤵
  PID:7356
- C:\Windows\System\BnPRQrW.exe
  C:\Windows\System\BnPRQrW.exe
  2⤵
  PID:7376
- C:\Windows\System\BMyZDIP.exe
  C:\Windows\System\BMyZDIP.exe
  2⤵
  PID:7436
- C:\Windows\System\inLSAJs.exe
  C:\Windows\System\inLSAJs.exe
  2⤵
  PID:8044
- C:\Windows\System\UMfbtrC.exe
  C:\Windows\System\UMfbtrC.exe
  2⤵
  PID:8856
- C:\Windows\System\iAjMYuK.exe
  C:\Windows\System\iAjMYuK.exe
  2⤵
  PID:8172
- C:\Windows\System\bpiMMWo.exe
  C:\Windows\System\bpiMMWo.exe
  2⤵
  PID:8952
- C:\Windows\System\ceaXfOl.exe
  C:\Windows\System\ceaXfOl.exe
  2⤵
  PID:6168
- C:\Windows\System\mGwLGXj.exe
  C:\Windows\System\mGwLGXj.exe
  2⤵
  PID:7544
- C:\Windows\System\dgiPCUY.exe
  C:\Windows\System\dgiPCUY.exe
  2⤵
  PID:2876
- C:\Windows\System\sBjlLeg.exe
  C:\Windows\System\sBjlLeg.exe
  2⤵
  PID:6436
- C:\Windows\System\MlCTLVc.exe
  C:\Windows\System\MlCTLVc.exe
  2⤵
  PID:4140
- C:\Windows\System\GCaFWja.exe
  C:\Windows\System\GCaFWja.exe
  2⤵
  PID:6828
- C:\Windows\System\xiiOHbZ.exe
  C:\Windows\System\xiiOHbZ.exe
  2⤵
  PID:6852
- C:\Windows\System\kpPWesz.exe
  C:\Windows\System\kpPWesz.exe
  2⤵
  PID:7968
- C:\Windows\System\cFPcIJP.exe
  C:\Windows\System\cFPcIJP.exe
  2⤵
  PID:5408
- C:\Windows\System\OKxOMyh.exe
  C:\Windows\System\OKxOMyh.exe
  2⤵
  PID:7624
- C:\Windows\System\WVTFPyT.exe
  C:\Windows\System\WVTFPyT.exe
  2⤵
  PID:4460
- C:\Windows\System\dNfMBio.exe
  C:\Windows\System\dNfMBio.exe
  2⤵
  PID:5916
- C:\Windows\System\AuWQKAo.exe
  C:\Windows\System\AuWQKAo.exe
  2⤵
  PID:6652
- C:\Windows\System\VgkEESd.exe
  C:\Windows\System\VgkEESd.exe
  2⤵
  PID:8404
- C:\Windows\System\flYOKNW.exe
  C:\Windows\System\flYOKNW.exe
  2⤵
  PID:10244
- C:\Windows\System\crcVpji.exe
  C:\Windows\System\crcVpji.exe
  2⤵
  PID:10260
- C:\Windows\System\dOEXgva.exe
  C:\Windows\System\dOEXgva.exe
  2⤵
  PID:10280
- C:\Windows\System\NrqJGOa.exe
  C:\Windows\System\NrqJGOa.exe
  2⤵
  PID:10308
- C:\Windows\System\PnFtjme.exe
  C:\Windows\System\PnFtjme.exe
  2⤵
  PID:10324
- C:\Windows\System\TDeuydm.exe
  C:\Windows\System\TDeuydm.exe
  2⤵
  PID:10348
- C:\Windows\System\TnMyLYk.exe
  C:\Windows\System\TnMyLYk.exe
  2⤵
  PID:10364
- C:\Windows\System\otdESxA.exe
  C:\Windows\System\otdESxA.exe
  2⤵
  PID:10424
- C:\Windows\System\bttAPSo.exe
  C:\Windows\System\bttAPSo.exe
  2⤵
  PID:10448
- C:\Windows\System\ngzvmvz.exe
  C:\Windows\System\ngzvmvz.exe
  2⤵
  PID:10468
- C:\Windows\System\yVgNUIB.exe
  C:\Windows\System\yVgNUIB.exe
  2⤵
  PID:10492
- C:\Windows\System\utcTNpI.exe
  C:\Windows\System\utcTNpI.exe
  2⤵
  PID:10516
- C:\Windows\System\JnohRDE.exe
  C:\Windows\System\JnohRDE.exe
  2⤵
  PID:10540
- C:\Windows\System\huARatu.exe
  C:\Windows\System\huARatu.exe
  2⤵
  PID:10564
- C:\Windows\System\NNWwQbu.exe
  C:\Windows\System\NNWwQbu.exe
  2⤵
  PID:10584
- C:\Windows\System\fkHFWut.exe
  C:\Windows\System\fkHFWut.exe
  2⤵
  PID:10604
- C:\Windows\System\ulxouQc.exe
  C:\Windows\System\ulxouQc.exe
  2⤵
  PID:10628
- C:\Windows\System\ZhEqXCG.exe
  C:\Windows\System\ZhEqXCG.exe
  2⤵
  PID:10644
- C:\Windows\System\Ibnhajq.exe
  C:\Windows\System\Ibnhajq.exe
  2⤵
  PID:10668
- C:\Windows\System\vinxHHx.exe
  C:\Windows\System\vinxHHx.exe
  2⤵
  PID:10688
- C:\Windows\System\ycAsfcw.exe
  C:\Windows\System\ycAsfcw.exe
  2⤵
  PID:10704
- C:\Windows\System\lmXuMFo.exe
  C:\Windows\System\lmXuMFo.exe
  2⤵
  PID:8104
- C:\Windows\System\Qkuvyvy.exe
  C:\Windows\System\Qkuvyvy.exe
  2⤵
  PID:1792
- C:\Windows\System\WnKDcrB.exe
  C:\Windows\System\WnKDcrB.exe
  2⤵
  PID:9372
- C:\Windows\System\PJDrmUg.exe
  C:\Windows\System\PJDrmUg.exe
  2⤵
  PID:9436
- C:\Windows\System\xLBXBlb.exe
  C:\Windows\System\xLBXBlb.exe
  2⤵
  PID:8944
- C:\Windows\System\GbikYWE.exe
  C:\Windows\System\GbikYWE.exe
  2⤵
  PID:6880
- C:\Windows\System\zGDRboj.exe
  C:\Windows\System\zGDRboj.exe
  2⤵
  PID:7052
- C:\Windows\System\sARqeig.exe
  C:\Windows\System\sARqeig.exe
  2⤵
  PID:6664
- C:\Windows\System\Ldwdmhc.exe
  C:\Windows\System\Ldwdmhc.exe
  2⤵
  PID:6192
- C:\Windows\System\TSQHnbz.exe
  C:\Windows\System\TSQHnbz.exe
  2⤵
  PID:6428
- C:\Windows\System\sHMVOzS.exe
  C:\Windows\System\sHMVOzS.exe
  2⤵
  PID:10028
- C:\Windows\System\mFfsccH.exe
  C:\Windows\System\mFfsccH.exe
  2⤵
  PID:10060
- C:\Windows\System\ILzzueU.exe
  C:\Windows\System\ILzzueU.exe
  2⤵
  PID:10080
- C:\Windows\System\TlnYZdX.exe
  C:\Windows\System\TlnYZdX.exe
  2⤵
  PID:8204
- C:\Windows\System\SbKTPzE.exe
  C:\Windows\System\SbKTPzE.exe
  2⤵
  PID:6588
- C:\Windows\System\xIweqvi.exe
  C:\Windows\System\xIweqvi.exe
  2⤵
  PID:8244
- C:\Windows\System\pdtTqAM.exe
  C:\Windows\System\pdtTqAM.exe
  2⤵
  PID:8260
- C:\Windows\System\LBmYvsu.exe
  C:\Windows\System\LBmYvsu.exe
  2⤵
  PID:8320
- C:\Windows\System\sjBcNtt.exe
  C:\Windows\System\sjBcNtt.exe
  2⤵
  PID:7480
- C:\Windows\System\maknskx.exe
  C:\Windows\System\maknskx.exe
  2⤵
  PID:8372
- C:\Windows\System\EBhZVIF.exe
  C:\Windows\System\EBhZVIF.exe
  2⤵
  PID:8432
- C:\Windows\System\rBSjYiH.exe
  C:\Windows\System\rBSjYiH.exe
  2⤵
  PID:8508
- C:\Windows\System\lhVZpPW.exe
  C:\Windows\System\lhVZpPW.exe
  2⤵
  PID:8536
- C:\Windows\System\FHcXvSx.exe
  C:\Windows\System\FHcXvSx.exe
  2⤵
  PID:8616
- C:\Windows\System\NrJxuDJ.exe
  C:\Windows\System\NrJxuDJ.exe
  2⤵
  PID:8704
- C:\Windows\System\AiRkJfk.exe
  C:\Windows\System\AiRkJfk.exe
  2⤵
  PID:8752
- C:\Windows\System\xFOlQdL.exe
  C:\Windows\System\xFOlQdL.exe
  2⤵
  PID:8792
- C:\Windows\System\QlqIgCw.exe
  C:\Windows\System\QlqIgCw.exe
  2⤵
  PID:8816
- C:\Windows\System\eCtqTVM.exe
  C:\Windows\System\eCtqTVM.exe
  2⤵
  PID:9488
- C:\Windows\System\gUGYpqP.exe
  C:\Windows\System\gUGYpqP.exe
  2⤵
  PID:8988
- C:\Windows\System\vGTuPEu.exe
  C:\Windows\System\vGTuPEu.exe
  2⤵
  PID:9552
- C:\Windows\System\TcWRuMU.exe
  C:\Windows\System\TcWRuMU.exe
  2⤵
  PID:9012
- C:\Windows\System\WnvZchJ.exe
  C:\Windows\System\WnvZchJ.exe
  2⤵
  PID:9036
- C:\Windows\System\bhxIVAr.exe
  C:\Windows\System\bhxIVAr.exe
  2⤵
  PID:9072
- C:\Windows\System\UojcKZk.exe
  C:\Windows\System\UojcKZk.exe
  2⤵
  PID:4480
- C:\Windows\System\dGzFexX.exe
  C:\Windows\System\dGzFexX.exe
  2⤵
  PID:9968
- C:\Windows\System\AiwLdeI.exe
  C:\Windows\System\AiwLdeI.exe
  2⤵
  PID:9996
- C:\Windows\System\BXKgbUW.exe
  C:\Windows\System\BXKgbUW.exe
  2⤵
  PID:4620
- C:\Windows\System\itWqcNd.exe
  C:\Windows\System\itWqcNd.exe
  2⤵
  PID:10124
- C:\Windows\System\ESErXur.exe
  C:\Windows\System\ESErXur.exe
  2⤵
  PID:5908
- C:\Windows\System\XryptMD.exe
  C:\Windows\System\XryptMD.exe
  2⤵
  PID:7288
- C:\Windows\System\xeTSbab.exe
  C:\Windows\System\xeTSbab.exe
  2⤵
  PID:5256
- C:\Windows\System\IEZfCZJ.exe
  C:\Windows\System\IEZfCZJ.exe
  2⤵
  PID:11028
- C:\Windows\System\ydHfLCp.exe
  C:\Windows\System\ydHfLCp.exe
  2⤵
  PID:4524
- C:\Windows\System\hpPKpKU.exe
  C:\Windows\System\hpPKpKU.exe
  2⤵
  PID:11268
- C:\Windows\System\qqREkYl.exe
  C:\Windows\System\qqREkYl.exe
  2⤵
  PID:11284
- C:\Windows\System\UyxuESa.exe
  C:\Windows\System\UyxuESa.exe
  2⤵
  PID:11308
- C:\Windows\System\ideoueR.exe
  C:\Windows\System\ideoueR.exe
  2⤵
  PID:11336
- C:\Windows\System\jSHFlPN.exe
  C:\Windows\System\jSHFlPN.exe
  2⤵
  PID:11352
- C:\Windows\System\wbARkix.exe
  C:\Windows\System\wbARkix.exe
  2⤵
  PID:11376
- C:\Windows\System\wiYrxEb.exe
  C:\Windows\System\wiYrxEb.exe
  2⤵
  PID:11404
- C:\Windows\System\coiNMNz.exe
  C:\Windows\System\coiNMNz.exe
  2⤵
  PID:11420
- C:\Windows\System\JylIYOx.exe
  C:\Windows\System\JylIYOx.exe
  2⤵
  PID:11532
- C:\Windows\System\QxPgIXp.exe
  C:\Windows\System\QxPgIXp.exe
  2⤵
  PID:11556
- C:\Windows\System\vjJLitc.exe
  C:\Windows\System\vjJLitc.exe
  2⤵
  PID:11576
- C:\Windows\System\xnPsdgv.exe
  C:\Windows\System\xnPsdgv.exe
  2⤵
  PID:11628
- C:\Windows\System\uKyivDs.exe
  C:\Windows\System\uKyivDs.exe
  2⤵
  PID:11668
- C:\Windows\System\EWXoTwy.exe
  C:\Windows\System\EWXoTwy.exe
  2⤵
  PID:11692
- C:\Windows\System\nCYgult.exe
  C:\Windows\System\nCYgult.exe
  2⤵
  PID:11712
- C:\Windows\System\HiVgCcQ.exe
  C:\Windows\System\HiVgCcQ.exe
  2⤵
  PID:11736
- C:\Windows\System\AelVbza.exe
  C:\Windows\System\AelVbza.exe
  2⤵
  PID:11764
- C:\Windows\System\WYYgHPe.exe
  C:\Windows\System\WYYgHPe.exe
  2⤵
  PID:11792
- C:\Windows\System\dLlGaLx.exe
  C:\Windows\System\dLlGaLx.exe
  2⤵
  PID:11812
- C:\Windows\System\VqsZTfO.exe
  C:\Windows\System\VqsZTfO.exe
  2⤵
  PID:11832
- C:\Windows\System\ZPMvtYn.exe
  C:\Windows\System\ZPMvtYn.exe
  2⤵
  PID:11856
- C:\Windows\System\REiwHqz.exe
  C:\Windows\System\REiwHqz.exe
  2⤵
  PID:11872
- C:\Windows\System\dtDSnVR.exe
  C:\Windows\System\dtDSnVR.exe
  2⤵
  PID:11896
- C:\Windows\System\cxKcugO.exe
  C:\Windows\System\cxKcugO.exe
  2⤵
  PID:11920
- C:\Windows\System\fCqrbyh.exe
  C:\Windows\System\fCqrbyh.exe
  2⤵
  PID:11940
- C:\Windows\System\eOfdkAK.exe
  C:\Windows\System\eOfdkAK.exe
  2⤵
  PID:11960
- C:\Windows\System\usuwXQl.exe
  C:\Windows\System\usuwXQl.exe
  2⤵
  PID:11984
- C:\Windows\System\daQpLnz.exe
  C:\Windows\System\daQpLnz.exe
  2⤵
  PID:12008
- C:\Windows\System\dJCtEOU.exe
  C:\Windows\System\dJCtEOU.exe
  2⤵
  PID:12024
- C:\Windows\System\dQcrCgK.exe
  C:\Windows\System\dQcrCgK.exe
  2⤵
  PID:12048
- C:\Windows\System\PYgitMa.exe
  C:\Windows\System\PYgitMa.exe
  2⤵
  PID:12072
- C:\Windows\System\jkHcByX.exe
  C:\Windows\System\jkHcByX.exe
  2⤵
  PID:12092
- C:\Windows\System\QBkOrCl.exe
  C:\Windows\System\QBkOrCl.exe
  2⤵
  PID:12112
- C:\Windows\System\esksQOM.exe
  C:\Windows\System\esksQOM.exe
  2⤵
  PID:12136
- C:\Windows\System\yAlWHVV.exe
  C:\Windows\System\yAlWHVV.exe
  2⤵
  PID:12160
- C:\Windows\System\uMZvAze.exe
  C:\Windows\System\uMZvAze.exe
  2⤵
  PID:12180
- C:\Windows\System\oIkfJra.exe
  C:\Windows\System\oIkfJra.exe
  2⤵
  PID:12208
- C:\Windows\System\DhfkUqd.exe
  C:\Windows\System\DhfkUqd.exe
  2⤵
  PID:12224
- C:\Windows\System\tjHSyYS.exe
  C:\Windows\System\tjHSyYS.exe
  2⤵
  PID:12240
- C:\Windows\System\NPVVeqw.exe
  C:\Windows\System\NPVVeqw.exe
  2⤵
  PID:12256
- C:\Windows\System\cmjRaWA.exe
  C:\Windows\System\cmjRaWA.exe
  2⤵
  PID:12272
- C:\Windows\System\kdTARjK.exe
  C:\Windows\System\kdTARjK.exe
  2⤵
  PID:9284
- C:\Windows\System\oOEGaUo.exe
  C:\Windows\System\oOEGaUo.exe
  2⤵
  PID:10336
- C:\Windows\System\tLpcEFs.exe
  C:\Windows\System\tLpcEFs.exe
  2⤵
  PID:10360
- C:\Windows\System\royFAAA.exe
  C:\Windows\System\royFAAA.exe
  2⤵
  PID:9392
- C:\Windows\System\QkSmNWU.exe
  C:\Windows\System\QkSmNWU.exe
  2⤵
  PID:9636
- C:\Windows\System\dHaZlBn.exe
  C:\Windows\System\dHaZlBn.exe
  2⤵
  PID:9684
- C:\Windows\System\pJUrcDT.exe
  C:\Windows\System\pJUrcDT.exe
  2⤵
  PID:9732
- C:\Windows\System\xglPLHA.exe
  C:\Windows\System\xglPLHA.exe
  2⤵
  PID:9796
- C:\Windows\System\THPOUyz.exe
  C:\Windows\System\THPOUyz.exe
  2⤵
  PID:9844
- C:\Windows\System\ygsJcdO.exe
  C:\Windows\System\ygsJcdO.exe
  2⤵
  PID:9776
- C:\Windows\System\chKVUuM.exe
  C:\Windows\System\chKVUuM.exe
  2⤵
  PID:9928
- C:\Windows\System\GYdSzxz.exe
  C:\Windows\System\GYdSzxz.exe
  2⤵
  PID:6632
- C:\Windows\System\XQSIawq.exe
  C:\Windows\System\XQSIawq.exe
  2⤵
  PID:10120
- C:\Windows\System\loStUPI.exe
  C:\Windows\System\loStUPI.exe
  2⤵
  PID:8640
- C:\Windows\System\rwOcgkx.exe
  C:\Windows\System\rwOcgkx.exe
  2⤵
  PID:8784
- C:\Windows\System\rzFeSCP.exe
  C:\Windows\System\rzFeSCP.exe
  2⤵
  PID:2892
- C:\Windows\System\FHmOfXc.exe
  C:\Windows\System\FHmOfXc.exe
  2⤵
  PID:9060
- C:\Windows\System\ArGJwVm.exe
  C:\Windows\System\ArGJwVm.exe
  2⤵
  PID:12308
- C:\Windows\System\YMRPNwu.exe
  C:\Windows\System\YMRPNwu.exe
  2⤵
  PID:12336
- C:\Windows\System\Goovtbf.exe
  C:\Windows\System\Goovtbf.exe
  2⤵
  PID:12356
- C:\Windows\System\UCOgDKP.exe
  C:\Windows\System\UCOgDKP.exe
  2⤵
  PID:12372
- C:\Windows\System\sqLdPwE.exe
  C:\Windows\System\sqLdPwE.exe
  2⤵
  PID:12396
- C:\Windows\System\aIEPQJT.exe
  C:\Windows\System\aIEPQJT.exe
  2⤵
  PID:12412
- C:\Windows\System\JcHSjIn.exe
  C:\Windows\System\JcHSjIn.exe
  2⤵
  PID:12448
- C:\Windows\System\PATrVcj.exe
  C:\Windows\System\PATrVcj.exe
  2⤵
  PID:12476
- C:\Windows\System\MdkTfqD.exe
  C:\Windows\System\MdkTfqD.exe
  2⤵
  PID:12508
- C:\Windows\System\VMrwyRy.exe
  C:\Windows\System\VMrwyRy.exe
  2⤵
  PID:12532
- C:\Windows\System\pUbhQnB.exe
  C:\Windows\System\pUbhQnB.exe
  2⤵
  PID:12552
- C:\Windows\System\zrnUBli.exe
  C:\Windows\System\zrnUBli.exe
  2⤵
  PID:12580
- C:\Windows\System\PMzpFzh.exe
  C:\Windows\System\PMzpFzh.exe
  2⤵
  PID:12600
- C:\Windows\System\IbOxHOj.exe
  C:\Windows\System\IbOxHOj.exe
  2⤵
  PID:12624
- C:\Windows\System\SKAEffm.exe
  C:\Windows\System\SKAEffm.exe
  2⤵
  PID:12640
- C:\Windows\System\NSneOSz.exe
  C:\Windows\System\NSneOSz.exe
  2⤵
  PID:12664
- C:\Windows\System\ZThkvnk.exe
  C:\Windows\System\ZThkvnk.exe
  2⤵
  PID:12684
- C:\Windows\System\BwzGGBI.exe
  C:\Windows\System\BwzGGBI.exe
  2⤵
  PID:12700
- C:\Windows\System\RlawLfL.exe
  C:\Windows\System\RlawLfL.exe
  2⤵
  PID:12720
- C:\Windows\System\MxkoZCn.exe
  C:\Windows\System\MxkoZCn.exe
  2⤵
  PID:12744
- C:\Windows\System\kUKFAsl.exe
  C:\Windows\System\kUKFAsl.exe
  2⤵
  PID:12760
- C:\Windows\System\SmcDFep.exe
  C:\Windows\System\SmcDFep.exe
  2⤵
  PID:12784
- C:\Windows\System\zVffIOF.exe
  C:\Windows\System\zVffIOF.exe
  2⤵
  PID:12808
- C:\Windows\System\Tuteomj.exe
  C:\Windows\System\Tuteomj.exe
  2⤵
  PID:12832
- C:\Windows\System\RTWvMvl.exe
  C:\Windows\System\RTWvMvl.exe
  2⤵
  PID:12852
- C:\Windows\System\MpotHRu.exe
  C:\Windows\System\MpotHRu.exe
  2⤵
  PID:12868
- C:\Windows\System\QATjAMr.exe
  C:\Windows\System\QATjAMr.exe
  2⤵
  PID:12884
- C:\Windows\System\VqRMxmo.exe
  C:\Windows\System\VqRMxmo.exe
  2⤵
  PID:12904
- C:\Windows\System\cTWWYPf.exe
  C:\Windows\System\cTWWYPf.exe
  2⤵
  PID:12928
- C:\Windows\System\zBZtGtl.exe
  C:\Windows\System\zBZtGtl.exe
  2⤵
  PID:12944
- C:\Windows\System\QuINjym.exe
  C:\Windows\System\QuINjym.exe
  2⤵
  PID:12960
- C:\Windows\System\WiBkhQP.exe
  C:\Windows\System\WiBkhQP.exe
  2⤵
  PID:12976
- C:\Windows\System\rlHwShA.exe
  C:\Windows\System\rlHwShA.exe
  2⤵
  PID:12992
- C:\Windows\System\ycECGTN.exe
  C:\Windows\System\ycECGTN.exe
  2⤵
  PID:13008
- C:\Windows\System\NEDcqkQ.exe
  C:\Windows\System\NEDcqkQ.exe
  2⤵
  PID:13024
- C:\Windows\System\llvDsru.exe
  C:\Windows\System\llvDsru.exe
  2⤵
  PID:13052
- C:\Windows\System\aighvcw.exe
  C:\Windows\System\aighvcw.exe
  2⤵
  PID:13068
- C:\Windows\System\XzFpBGE.exe
  C:\Windows\System\XzFpBGE.exe
  2⤵
  PID:13088
- C:\Windows\System\UxjjWKM.exe
  C:\Windows\System\UxjjWKM.exe
  2⤵
  PID:13108
- C:\Windows\System\FMiuwSj.exe
  C:\Windows\System\FMiuwSj.exe
  2⤵
  PID:13140
- C:\Windows\System\LMaFnIW.exe
  C:\Windows\System\LMaFnIW.exe
  2⤵
  PID:13160
- C:\Windows\System\DarzHiU.exe
  C:\Windows\System\DarzHiU.exe
  2⤵
  PID:13180
- C:\Windows\System\JhBiTjU.exe
  C:\Windows\System\JhBiTjU.exe
  2⤵
  PID:13204
- C:\Windows\System\thcPEmV.exe
  C:\Windows\System\thcPEmV.exe
  2⤵
  PID:13228
- C:\Windows\System\qfDHaKh.exe
  C:\Windows\System\qfDHaKh.exe
  2⤵
  PID:13248
- C:\Windows\System\RHsEEyM.exe
  C:\Windows\System\RHsEEyM.exe
  2⤵
  PID:13268
- C:\Windows\System\flOggLT.exe
  C:\Windows\System\flOggLT.exe
  2⤵
  PID:13292
- C:\Windows\System\dzhuwwo.exe
  C:\Windows\System\dzhuwwo.exe
  2⤵
  PID:13308
- C:\Windows\System\JWNOLew.exe
  C:\Windows\System\JWNOLew.exe
  2⤵
  PID:10192
- C:\Windows\System\FpvvWjw.exe
  C:\Windows\System\FpvvWjw.exe
  2⤵
  PID:7372
- C:\Windows\System\HdeFaff.exe
  C:\Windows\System\HdeFaff.exe
  2⤵
  PID:8932
- C:\Windows\System\BpNghfV.exe
  C:\Windows\System\BpNghfV.exe
  2⤵
  PID:7540
- C:\Windows\System\CuqoUBy.exe
  C:\Windows\System\CuqoUBy.exe
  2⤵
  PID:7240
- C:\Windows\System\GpcPrGm.exe
  C:\Windows\System\GpcPrGm.exe
  2⤵
  PID:1096
- C:\Windows\System\MvppJMF.exe
  C:\Windows\System\MvppJMF.exe
  2⤵
  PID:7656
- C:\Windows\System\BgsTNcC.exe
  C:\Windows\System\BgsTNcC.exe
  2⤵
  PID:11280
- C:\Windows\System\uCNkEEu.exe
  C:\Windows\System\uCNkEEu.exe
  2⤵
  PID:10268
- C:\Windows\System\tLiAwIx.exe
  C:\Windows\System\tLiAwIx.exe
  2⤵
  PID:10380
- C:\Windows\System\DkirLuF.exe
  C:\Windows\System\DkirLuF.exe
  2⤵
  PID:10444
- C:\Windows\System\JeqYjdG.exe
  C:\Windows\System\JeqYjdG.exe
  2⤵
  PID:10504
- C:\Windows\System\iNMwUsf.exe
  C:\Windows\System\iNMwUsf.exe
  2⤵
  PID:10548
- C:\Windows\System\HOUntzM.exe
  C:\Windows\System\HOUntzM.exe
  2⤵
  PID:10600
- C:\Windows\System\KZzzQyx.exe
  C:\Windows\System\KZzzQyx.exe
  2⤵
  PID:10676
- C:\Windows\System\lACuCqM.exe
  C:\Windows\System\lACuCqM.exe
  2⤵
  PID:10700
- C:\Windows\System\Qodkfbf.exe
  C:\Windows\System\Qodkfbf.exe
  2⤵
  PID:10784
- C:\Windows\System\pKjJZaX.exe
  C:\Windows\System\pKjJZaX.exe
  2⤵
  PID:8844
- C:\Windows\System\zgMBFwv.exe
  C:\Windows\System\zgMBFwv.exe
  2⤵
  PID:10848
- C:\Windows\System\lRwCXzr.exe
  C:\Windows\System\lRwCXzr.exe
  2⤵
  PID:11824
- C:\Windows\System\vYKZhpl.exe
  C:\Windows\System\vYKZhpl.exe
  2⤵
  PID:11992
- C:\Windows\System\hKkwEhj.exe
  C:\Windows\System\hKkwEhj.exe
  2⤵
  PID:12064
- C:\Windows\System\twrEXxm.exe
  C:\Windows\System\twrEXxm.exe
  2⤵
  PID:12156
- C:\Windows\System\QiqJVzw.exe
  C:\Windows\System\QiqJVzw.exe
  2⤵
  PID:9244
- C:\Windows\System\yigYVLl.exe
  C:\Windows\System\yigYVLl.exe
  2⤵
  PID:7832
- C:\Windows\System\osZnYcx.exe
  C:\Windows\System\osZnYcx.exe
  2⤵
  PID:9340
- C:\Windows\System\QNKgibe.exe
  C:\Windows\System\QNKgibe.exe
  2⤵
  PID:8568
- C:\Windows\System\YupAhBo.exe
  C:\Windows\System\YupAhBo.exe
  2⤵
  PID:13332
- C:\Windows\System\uYjNfBC.exe
  C:\Windows\System\uYjNfBC.exe
  2⤵
  PID:13356
- C:\Windows\System\BwQGjsL.exe
  C:\Windows\System\BwQGjsL.exe
  2⤵
  PID:13380
- C:\Windows\System\bfDhQES.exe
  C:\Windows\System\bfDhQES.exe
  2⤵
  PID:13396
- C:\Windows\System\ewfdCQY.exe
  C:\Windows\System\ewfdCQY.exe
  2⤵
  PID:13412
- C:\Windows\System\NHrEnRu.exe
  C:\Windows\System\NHrEnRu.exe
  2⤵
  PID:13428
- C:\Windows\System\NmTeZow.exe
  C:\Windows\System\NmTeZow.exe
  2⤵
  PID:13448
- C:\Windows\System\dPpaWbj.exe
  C:\Windows\System\dPpaWbj.exe
  2⤵
  PID:13468
- C:\Windows\System\mAuBblM.exe
  C:\Windows\System\mAuBblM.exe
  2⤵
  PID:13488
- C:\Windows\System\wAtZwpv.exe
  C:\Windows\System\wAtZwpv.exe
  2⤵
  PID:13512
- C:\Windows\System\WtCnhJH.exe
  C:\Windows\System\WtCnhJH.exe
  2⤵
  PID:13536
- C:\Windows\System\ihmCPpW.exe
  C:\Windows\System\ihmCPpW.exe
  2⤵
  PID:13556
- C:\Windows\System\rpOlQAo.exe
  C:\Windows\System\rpOlQAo.exe
  2⤵
  PID:13576
- C:\Windows\System\WiZRWhB.exe
  C:\Windows\System\WiZRWhB.exe
  2⤵
  PID:13600
- C:\Windows\System\nOdCWap.exe
  C:\Windows\System\nOdCWap.exe
  2⤵
  PID:13620
- C:\Windows\System\okCEIqQ.exe
  C:\Windows\System\okCEIqQ.exe
  2⤵
  PID:13640
- C:\Windows\System\OMOVuLC.exe
  C:\Windows\System\OMOVuLC.exe
  2⤵
  PID:13688
- C:\Windows\System\TZMkjmG.exe
  C:\Windows\System\TZMkjmG.exe
  2⤵
  PID:11724
- C:\Windows\System\QzNQRxA.exe
  C:\Windows\System\QzNQRxA.exe
  2⤵
  PID:11788
- C:\Windows\System\uDeqSYY.exe
  C:\Windows\System\uDeqSYY.exe
  2⤵
  PID:11848
- C:\Windows\System\FddbqHg.exe
  C:\Windows\System\FddbqHg.exe
  2⤵
  PID:11908
- C:\Windows\System\Ymgxgoj.exe
  C:\Windows\System\Ymgxgoj.exe
  2⤵
  PID:11928
- C:\Windows\System\FIDghne.exe
  C:\Windows\System\FIDghne.exe
  2⤵
  PID:12128
- C:\Windows\System\bgLzHBK.exe
  C:\Windows\System\bgLzHBK.exe
  2⤵
  PID:12216
- C:\Windows\System\qRSrBNw.exe
  C:\Windows\System\qRSrBNw.exe
  2⤵
  PID:8732
- C:\Windows\System\QKQegvy.exe
  C:\Windows\System\QKQegvy.exe
  2⤵
  PID:6760
- C:\Windows\System\gcoZxSF.exe
  C:\Windows\System\gcoZxSF.exe
  2⤵
  PID:8664
- C:\Windows\System\QrJpvqe.exe
  C:\Windows\System\QrJpvqe.exe
  2⤵
  PID:12612
- C:\Windows\System\aheYDxQ.exe
  C:\Windows\System\aheYDxQ.exe
  2⤵
  PID:12728
- C:\Windows\System\IRJryQB.exe
  C:\Windows\System\IRJryQB.exe
  2⤵
  PID:12756
- C:\Windows\System\aIHgUGN.exe
  C:\Windows\System\aIHgUGN.exe
  2⤵
  PID:13880
- C:\Windows\System\KqJVNZP.exe
  C:\Windows\System\KqJVNZP.exe
  2⤵
  PID:12860
- C:\Windows\System\yoBUAcn.exe
  C:\Windows\System\yoBUAcn.exe
  2⤵
  PID:12896
- C:\Windows\System\xYqBMVK.exe
  C:\Windows\System\xYqBMVK.exe
  2⤵
  PID:12940
- C:\Windows\System\TEjxcXh.exe
  C:\Windows\System\TEjxcXh.exe
  2⤵
  PID:12972
- C:\Windows\System\YnrWpXr.exe
  C:\Windows\System\YnrWpXr.exe
  2⤵
  PID:13004
- C:\Windows\System\arkHlee.exe
  C:\Windows\System\arkHlee.exe
  2⤵
  PID:13048
- C:\Windows\System\nXUTbAu.exe
  C:\Windows\System\nXUTbAu.exe
  2⤵
  PID:13084
- C:\Windows\System\nMqubhH.exe
  C:\Windows\System\nMqubhH.exe
  2⤵
  PID:13116
- C:\Windows\System\YGVLMLP.exe
  C:\Windows\System\YGVLMLP.exe
  2⤵
  PID:13152
- C:\Windows\System\NGgdaXd.exe
  C:\Windows\System\NGgdaXd.exe
  2⤵
  PID:10416
- C:\Windows\System\ZgaRwyj.exe
  C:\Windows\System\ZgaRwyj.exe
  2⤵
  PID:10728
- C:\Windows\System\MfRSwIE.exe
  C:\Windows\System\MfRSwIE.exe
  2⤵
  PID:8272
- C:\Windows\System\VJxFkyG.exe
  C:\Windows\System\VJxFkyG.exe
  2⤵
  PID:13952
- C:\Windows\System\qemQYez.exe
  C:\Windows\System\qemQYez.exe
  2⤵
  PID:13972
- C:\Windows\System\VuMuJpX.exe
  C:\Windows\System\VuMuJpX.exe
  2⤵
  PID:13456
- C:\Windows\System\GlmunCh.exe
  C:\Windows\System\GlmunCh.exe
  2⤵
  PID:13520
- C:\Windows\System\AbcCYVT.exe
  C:\Windows\System\AbcCYVT.exe
  2⤵
  PID:13568
- C:\Windows\System\DSINywl.exe
  C:\Windows\System\DSINywl.exe
  2⤵
  PID:13696
- C:\Windows\System\OszhAgP.exe
  C:\Windows\System\OszhAgP.exe
  2⤵
  PID:14272
- C:\Windows\System\iVHWFKM.exe
  C:\Windows\System\iVHWFKM.exe
  2⤵
  PID:14300
- C:\Windows\System\azjWjrG.exe
  C:\Windows\System\azjWjrG.exe
  2⤵
  PID:13812
- C:\Windows\System\jxmwtxY.exe
  C:\Windows\System\jxmwtxY.exe
  2⤵
  PID:9668
- C:\Windows\System\xzMGAwe.exe
  C:\Windows\System\xzMGAwe.exe
  2⤵
  PID:12632
- C:\Windows\System\rKjJrsx.exe
  C:\Windows\System\rKjJrsx.exe
  2⤵
  PID:12660
- C:\Windows\System\vFDcLlL.exe
  C:\Windows\System\vFDcLlL.exe
  2⤵
  PID:11772
- C:\Windows\System\IZibdHI.exe
  C:\Windows\System\IZibdHI.exe
  2⤵
  PID:10664
- C:\Windows\System\awcrwIq.exe
  C:\Windows\System\awcrwIq.exe
  2⤵
  PID:11904
- C:\Windows\System\PfzLfaE.exe
  C:\Windows\System\PfzLfaE.exe
  2⤵
  PID:9932
- C:\Windows\System\IppTSKS.exe
  C:\Windows\System\IppTSKS.exe
  2⤵
  PID:13260
- C:\Windows\System\PcrwPjx.exe
  C:\Windows\System\PcrwPjx.exe
  2⤵
  PID:10212
- C:\Windows\System\IBoCXCx.exe
  C:\Windows\System\IBoCXCx.exe
  2⤵
  PID:11548
- C:\Windows\System\YXofpEW.exe
  C:\Windows\System\YXofpEW.exe
  2⤵
  PID:11620
- C:\Windows\System\EELixbS.exe
  C:\Windows\System\EELixbS.exe
  2⤵
  PID:13044
- C:\Windows\System\PQRZuiw.exe
  C:\Windows\System\PQRZuiw.exe
  2⤵
  PID:13804
- C:\Windows\System\vJQykpD.exe
  C:\Windows\System\vJQykpD.exe
  2⤵
  PID:12304
- C:\Windows\System\pHiUkSi.exe
  C:\Windows\System\pHiUkSi.exe
  2⤵
  PID:11868
- C:\Windows\System\ylHZTbp.exe
  C:\Windows\System\ylHZTbp.exe
  2⤵
  PID:12936
- C:\Windows\System\Hmzogbh.exe
  C:\Windows\System\Hmzogbh.exe
  2⤵
  PID:468
- C:\Windows\System\wHWDznF.exe
  C:\Windows\System\wHWDznF.exe
  2⤵
  PID:4308
- C:\Windows\System\WebAERu.exe
  C:\Windows\System\WebAERu.exe
  2⤵
  PID:4284
- C:\Windows\System\bdoknED.exe
  C:\Windows\System\bdoknED.exe
  2⤵
  PID:10488
- C:\Windows\System\addjDYU.exe
  C:\Windows\System\addjDYU.exe
  2⤵
  PID:4800
- C:\Windows\System\crhRxTY.exe
  C:\Windows\System\crhRxTY.exe
  2⤵
  PID:13420
- C:\Windows\System\ZkKPAgz.exe
  C:\Windows\System\ZkKPAgz.exe
  2⤵
  PID:14120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_scr2pgwg.vmn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CFyFBuQ.exe

Filesize
1.6MB

MD5
2dae4e77904255b5c9106e19682eede8

SHA1
68882420ec57bdfb8b3921ac8e0c0eda679764df

SHA256
9025a544a31552626726893bba0c31363e4f04a8efaa0e3efa4d095652cbe404

SHA512
39196910777a9948acd269c0e09b8d26a3bbe070f4ada3b625d5525c7d7579e4694a95e587f6b802241afb0bf69e50aa7df089456d31e3a5f5315550368add60

Download Submit
C:\Windows\System\EOfxuvT.exe

Filesize
1.6MB

MD5
d3094ba80ce97e4fd18b5689cadc8679

SHA1
b7c8632066e92509d6c207b59cfaf66a04ffd89e

SHA256
61333694d4a512bc08525dc845e7fd66738c22c722350f1c9f1fc705cd2e3311

SHA512
8f01299fdf0d596aad71dc93ef4e992754ec33be5bc8aaa5d4d803a9ca32e80a4cac2bc2c771e7ee5ce289eb1ba57818df4d192e33b7621d92dfabb4c20eb78b

Download Submit
C:\Windows\System\FKKCmZH.exe

Filesize
1.6MB

MD5
e94f5d87363de2f3a9131b386378a7be

SHA1
4b5f629395063db9c93e1a949f0994ac8a71c3e8

SHA256
82bd35d261fe75470eacb723bb9612193acaa8bc1e1b9acd615c1091541dc7af

SHA512
82ab4b164e456508e4b02ba1e3e72436ceb6f03c9635903a722d11d71fe3e0e418f8aa987872007c1e116da07cd88b947d303f60f95e717fb82c6495a9ae42a2

Download Submit
C:\Windows\System\GoRjtdN.exe

Filesize
1.6MB

MD5
beac9483ea8ccc0a9f2ce646489b33a8

SHA1
08918b9d40ffe4e39db16ede8cf128b2457a2297

SHA256
3f481dec698c2390ad9550c48912a767b8d0f42b96262434f31c587b97d68cd5

SHA512
1418865ea640c823024787a686405b253350e14192c204bb9eb05174475c79fb17e2318b170a03063ff1a612745ab39ea73061de3421a4681044d59de674ab99

Download Submit
C:\Windows\System\GqMKVPS.exe

Filesize
8B

MD5
73d2a6f98ec11a363ba40d9285f31146

SHA1
f412571986c937c29e7d1df48abd9ea9b810fb79

SHA256
9599521a11e3ac1412a598ac34375377cf195a57228d724684ce7cd2fc0f8bb0

SHA512
85230fa9f6b5cc93b67c122ee0f2a6b41f611e7c892a179490ce36def0b7cf39dd4e008408c7b0ba49dd6453338ebd04122a1a20b23e1ea00da2f3cdeed0b74f

Download Submit
C:\Windows\System\ITvBMQJ.exe

Filesize
1.6MB

MD5
4d08020a597bdadbe1aa6c80d5433f5b

SHA1
3f2e8c00d683f4ef6184f731901f99824632e2aa

SHA256
c639fb0a02813a09d6c07d413d53da7e0eba289c8dac71424a924d56b39b8c38

SHA512
f3147adbe18850eb5ead8571042652868ba343ae78afee2f821bad193ec692218551ab8b981e1077d5ab7c94ca4fdbb648437ca4239c36f6c97d53e6c2486afe

Download Submit
C:\Windows\System\KyrZPbN.exe

Filesize
1.6MB

MD5
2e131f805a623942474ab7c3c4d00c7d

SHA1
1ed399a044b8d493506679b075dcac5be11cccd4

SHA256
49957991224d2d4b441d59d02bc71186005e1bdae7e4438d4bc09e03b3bd85af

SHA512
0b4a9b790d34b9390c0f812b09b926780e79a896e4d169e5fbff96ab26667ae528ec4a94560c0875fe007978027f35b6c239a5af3be5c78da3bc0c8530c87d93

Download Submit
C:\Windows\System\LUwjEPS.exe

Filesize
1.6MB

MD5
7c3f349f31c0085fd716b0c73438b757

SHA1
7ea961b3c6323c8ffd15e015eb94562bac4fbb07

SHA256
23cd5e95a4c4b2212045ad2717233c264ec1e7f1a08b8e76cbd121661576e588

SHA512
ec9810403f47f207bae559b15e3069ffb56e5ebd4a3b921ecb86c63ce036a7460539ec64ed7d38b7dc03aa6b9e91640c0ee01ae5fb9c1d6021e2ffc75d2bba7e

Download Submit
C:\Windows\System\OoYGuOb.exe

Filesize
1.6MB

MD5
73673d5af569e81925447eb945354bca

SHA1
1b6855def631a4ce8ffba5c83c0f52240e3fed4d

SHA256
92730d9a72830a4026ec995e45be0c91657fa75d259dfa6273a63fab910db8d9

SHA512
1d7fad73554099d16fa01d07876dbb27d85e74ae671d88cf6544e1d7d8b816d06581430169c0d61a885a825d52adccf3502662f5108291d1c0de446b04db3b33

Download Submit
C:\Windows\System\PREPVKe.exe

Filesize
1.6MB

MD5
8a74270bbfb6c87633bf7ce76cf03bae

SHA1
6a25bc82c66705fa8c83e239a49c96b6ce9d2e42

SHA256
d2a0c53a6bcb8841733f8a755072ad165dc73a290d6fdd54af03d9e6545b1647

SHA512
9d34ec430ae1d777f4c264e91073528b72062cf880439a041810345611617ad124ab8bb84b564032bbe39db7d4e898fe2ad88265654e3beab4012828a698d42a

Download Submit
C:\Windows\System\QzDWQov.exe

Filesize
1.6MB

MD5
b7a3b6cb364954ced31f2927afa4510e

SHA1
c21b49cba248655f626629bd2d113e61bd6a9c41

SHA256
43ca58454c4b4dd3bf175de12d864bacec80ae36739cd9a130c67e19b45364b0

SHA512
9eb263bc00852e2dc85def8b009a32a1c9d42b8f7da35da2db76c2f7b1cf5bc1d7934e3ce6f51812d0d9e0e1fbe07cd9429d0e8c896e7c88a6fcdb0c7ab2534b

Download Submit
C:\Windows\System\RPanvaY.exe

Filesize
1.6MB

MD5
06389f74ce94da4c98c6a7a5dd8b8760

SHA1
67f90a8ad91b197e727bbb6121f1a7cb68e363a5

SHA256
c5efaf68b331bc30439c4ce7e770e2d4a2c22cf2b5274dec2e6931103a2e0a78

SHA512
1d5c24ee8c6d7cbc90525817691f00ad6dd90bf575957cccf44234bf258960109e5813bbb8ca01ce62af82d3d8b2aaabfd7faeb4d8f7facd9c8a340934b0c8f3

Download Submit
C:\Windows\System\RZYcGOI.exe

Filesize
1.6MB

MD5
40f00ebb3b604f6b2c0ca3ee691f1abb

SHA1
33579ff3b4ace823fe850127e2da15041dcef4e4

SHA256
09df4b2d1dd5e14b856e866780d90ab98f250e219644986f9a93375a0cc9cd58

SHA512
cc0cc28ba85fe97e5d6968628d6a96b89674e03afaa87742b4b368c0bc1a47fceb1fd860ceba58bd1ff1a7698d55380a2c602870375f382bd07c9b5c26b8d394

Download Submit
C:\Windows\System\SSBTmky.exe

Filesize
1.6MB

MD5
f5a228be08fed28964a8b027fccc51f3

SHA1
1358a138eb0ee3280ad5d1f93b43d82b17d6f09b

SHA256
060defb242232c15a5b5f78b02c7667bd19609d64eeb90b9585c39c791480249

SHA512
781de39203ecd0c1f83b5a17dbb64257d498d9e75b4ca63bf3eda03142f7f7231dbd6a0cc2105f96dc518e9c880f6516c35ee0b5193608bbcf77b1496f15fae4

Download Submit
C:\Windows\System\TOVVMqG.exe

Filesize
1.6MB

MD5
2f6202a0ae07e760d5ef774f593cca67

SHA1
25a880702da24a5de665a5c7f2347342dd41a3b8

SHA256
59f4034e9ed668ed8a5fc8ed1dc11db6338b57d4cf752af4e4fd883dee667239

SHA512
f166bfb57c8b7cd257c88f8c1da3c1b57e3b78dd6bab103c97bf37ba8359ecfd2338cb43b46560e911537d7d9c4bb9572b8c656478b218a35c2bb8978cc63150

Download Submit
C:\Windows\System\TpImNcR.exe

Filesize
1.6MB

MD5
fe55fe073c7f369dfdb9f5f67d958dc9

SHA1
f78e7c554923e52f3f7f8e12730be5fe82691bc2

SHA256
18c3349eac6349c30a0194604ede171a5ece0e53d3b37666cb655cbd8674b039

SHA512
26008aded64298a8815c6aad9ee59935dfd012943d73b7c9beecd686d3b4b71ee60d339b4044ef102bbed6b56b0e5365d1a6842da5cc28a0882e8c6af217bb40

Download Submit
C:\Windows\System\UAJXLci.exe

Filesize
1.6MB

MD5
dd1fbbf29844bbc438916309a5c85db0

SHA1
3bb0c9c55952605e34add6787321d8a0ffaa05ea

SHA256
0ff5ec44211c52fc49aca57ff996365c81657787f54a82f3dd66e51380932226

SHA512
911ee92cdcac7b8f718d47ed3b128909bd844f15d613347ecca633ace3f1a39f68a953138d52c55548b4881c2eabb7f113138ec7b939b017073557a170bfa49e

Download Submit
C:\Windows\System\VpzVgRh.exe

Filesize
1.6MB

MD5
2a730961b365ac2d0484b6f03f1e5e4b

SHA1
b0acda89c130d68d29ed10c2505ef510f1b1d9d3

SHA256
451803438d6b5f9efca6556cf2b14d10f29a00604332a954ed28a78426af1d73

SHA512
17a6b36a529ee40b5c732c6e50482ffef9831f494ba17b79d056e2f825bb9eee0da61bc7727952c2865bc18a0c1ffc6973d7a93ddfd041ed131db0c63b8b41a5

Download Submit
C:\Windows\System\YJtGvHC.exe

Filesize
1.6MB

MD5
ac2182b98ffd4b5c5607cbcbb0f3f189

SHA1
dbf6ce7e29e3a9d57dfde9efa0e9be9b7490c050

SHA256
db6bdf835d944e7948c02ebd325c1d667c80522cdbbf83450c363824e83f3ebf

SHA512
ac7972ac7500391028d5eb2b6cc85b4547df39703545fd0706e70404672e3ed691f1d38c71e5eb9a705e96aa294c61787896599b713b24974d093755bec52e28

Download Submit
C:\Windows\System\Yfixvjr.exe

Filesize
1.6MB

MD5
f006a0112b9c970f94afb1e5414c5411

SHA1
9a5b18eb31fe6d663d3b6febbc37dd24c5658d6c

SHA256
e345d3fba806a70f78728956a9bbc0cbd73cff239f7ec473bb28f36ce6f0f2be

SHA512
3721d70357b3e81af25b16e877c3ce7ee354a775c2ff76135aee23e030f2f6c14f4e5976a03f15dbe41b79253d93155d730c313ebafbf501ad22d65b453c1bf8

Download Submit
C:\Windows\System\ZfmtHar.exe

Filesize
1.6MB

MD5
160461357d24a6472112d0dee34f6468

SHA1
2e8a253bb28e81e6642997c1602d12b75e41c593

SHA256
54212d4a583b74df040b6753ea66523343c56cc4803e027c143c326aea7c39da

SHA512
46c33eb1628429a617b2148e52bd47a39efdbe1b7595dc3995b88ed1c712b57fe2541ddc8003a4044ed43f8f1a8decbe435b0086d2b32b26c472aa3b34e922ee

Download Submit
C:\Windows\System\aVyHHkF.exe

Filesize
1.6MB

MD5
859e0243a08dd3f32eeac8e9c075666e

SHA1
d0f5c87969af50c6c62c4adc39e5a33f1dffbdb5

SHA256
338042835edaf1052824d3eed84e0e5b96b9ea553c81ab18daf998a056278be7

SHA512
09b562aa7aa282d83a945956a00316564a0b9749ba37d01f5b45c5864528c07baad9bd920b51659c4f114a628335704afddae84a359d74933160b4fdcfcfd31c

Download Submit
C:\Windows\System\brnzwbm.exe

Filesize
1.6MB

MD5
8a5cf53643c8660764b0916185df03d7

SHA1
13cf1fe626343223b0dfc0ca39166e81fea99ce1

SHA256
b92427b19b64860de5c9fda47e8e2d153ada45ce26c5cf0e7a1ae5aa74d400f9

SHA512
0daebfd303b21e5c6076b422b0f6ad1352bec4a91acba735b5740bade6592e0a598c25389ed83229c6d6d8fddc3152e0b745bd1c5c6e4a97c4b0dad89d69ab24

Download Submit
C:\Windows\System\iYYXeoL.exe

Filesize
1.6MB

MD5
0574e70ccae42d2400d342301c8554dd

SHA1
36fe1163e0cb6a64b92d50b8ddec98a708eb6195

SHA256
c0e82d4618ff1aeb3adc68d5b685431b0d939fe1e316fa4e42bfb75df6837c2c

SHA512
823de795e562474e878301b2de25325f6df46a98fe24a2dd5d45b95100ec20fbbf30959ff57a8674b3b3a86c8af13dbd4b36da7261a6d17d73617ad81e64b7cc

Download Submit
C:\Windows\System\mDLqKxW.exe

Filesize
1.6MB

MD5
fa30523bbd80bc2b98516423c3c3d9c7

SHA1
a7a07ecc5924d2dbb6b0df2b23c51bbb5202113c

SHA256
b82fc23c28a228057ccfb779bc42a8552a76937fa674e7f5eb5af54daab6314b

SHA512
e9002d8c51308ac9b6b66681443a4a827da34a4980bb5b02b4dbbb2d7f669ab41ef5a07020763f0a6667ba137bc1ae1c3263686a0b642cb25e8a6ff2b2f3603e

Download Submit
C:\Windows\System\oZTxoex.exe

Filesize
1.6MB

MD5
332a57067fdfae24239dec04899184d2

SHA1
153fcc8fb57f1dd5f4b6c1ee7cf8002fa514393c

SHA256
996ffc16b4818ac486e06e39231b21249bb8fcc3b80c6d6bba18e78c393e64be

SHA512
766e7bcf554e084e5b923c8a67d0be3794c9fbd82cbf2e5a301351d49840b2f4da1d51ada82ab3df0aec022f872e1d42c3a13d325f4d507858067e14e00533c5

Download Submit
C:\Windows\System\oqWwiBO.exe

Filesize
1.6MB

MD5
5c702c334d8e7ff57ff72ad79f8fa126

SHA1
6d650b17ffb896163f806c386df206d225d44f22

SHA256
050e423b3d5e553ad0bd7269f3614eab15c6dc887a039d38ce7d870e2906a329

SHA512
96deb0d3a1b2b21c14e87a754e619ed0ac9f516c5c2a8c909ec62cd9987312a6d837180ab9fff58db3bb977c95642730c6429ceb7f2251c254f8de1a311f13da

Download Submit
C:\Windows\System\qUTLPak.exe

Filesize
1.6MB

MD5
efce5db8d30ec0eac754520c85b988d6

SHA1
ad75c280c52c53ec690f8383e64271afeda315d7

SHA256
116665dfd3413b602c2d80c12a9515c4eeb4de86b23e97fba7c25b064423fbc0

SHA512
eb6f852e176c79e1f268d97c3e210bd96ec20117d255dc689079c282b498990fa8da97dbe3f47e8263f1c6fec6873a04903fb09d298a851711d913d56b930531

Download Submit
C:\Windows\System\qamSQPg.exe

Filesize
1.6MB

MD5
49dd9573222728c966813504ebb1c5dc

SHA1
7b90b5a10396d40ae9421e0de292022a42148903

SHA256
47329f45a614c8469025dee313392bc242c32e1eadabecc1b4d6fc2d259e366a

SHA512
7b6bd42ab244bc9119921d7999b6e6a7b268a2f8a536f34455a6b58b5ada393a24df7fab5d521e4d2f45d9c4474b05331859b81817970fb533d36aa573605471

Download Submit
C:\Windows\System\sXHcteK.exe

Filesize
1.6MB

MD5
6e41b947052d4110f0c5824c26173174

SHA1
0986d6af1cb0b841848672d1b9afe1aa4eff2b18

SHA256
8129bb067ccd3884c163e1d3a0ba039987f28df903df4d6e4b9ac2f30d2540ca

SHA512
fd620454e1af6c7dedfd5b57045a0220c34d1285a39fb8d95a367be2bb7c8db21286f2d475c65c9cfa9ca49a4a0ae0cd3368c80e8deff9842a8e1f358d2007ae

Download Submit
C:\Windows\System\sqkZLeg.exe

Filesize
1.6MB

MD5
d16ed1838f819607365b3ab1298336e4

SHA1
b4cb564a347346190f400d56820d4b2ffd403a4a

SHA256
2767ede9f95924d415af4f1c3920cf29d3e2b26a9305c7fe552269f266439346

SHA512
13ed422027ce46991a66f48d0a216064ff4eb874e26f4693f13317696eab88a4ff5639b9bcf29efec0de174e03d17bfda8e3d82ae0114ef4b4aeee5c013e1569

Download Submit
C:\Windows\System\sqkZLeg.exe

Filesize
960KB

MD5
39cd84f6ada540f952f596cb3724bd79

SHA1
631f77b1ae83aa76b608178ab3929f2882550f4b

SHA256
127865bc6228df36019d2bbaeaf036d7374aec682c0699828a5a804c8135dc4b

SHA512
d139f3c579c92c2dd07dd141b7267f324ad60fd443fcac5b1293b0087a273af416b4ce035a00de2c9cc9980ad4b6ecab7de8813c30273253b42b2bfad63b95ba

Download Submit
C:\Windows\System\tAMXYkJ.exe

Filesize
1.6MB

MD5
2e2192e980138423e4480caa9393ac4e

SHA1
a72bb8ed505617070d1b6c745335552a65513c9b

SHA256
c093d82da43359ddad98efb064e7a8ecba899cce20f5455d49603d88004ec23c

SHA512
8410d0679d83dbd4fe6833a19e5b309c9f199d057b661f7d95abd36df824a27fd69df3d40a4006604df3934b9e04b7cf54e3b3a6a048b0d23e8ff98209d4ac90

Download Submit
C:\Windows\System\tVHcZNu.exe

Filesize
1.6MB

MD5
8fac15113c95c75f7e2428d2cd9a1ac2

SHA1
3941d9236a9d6b5e30340f0870b8c96f3c3655a0

SHA256
ecd91792a8ffc3721d09f20067c5927fedbc54b0b86940ad5e536311b58dc6a0

SHA512
4a0e21d57a7a48d8210e98f95cd6a7bde417cab7951ad19ff7575c621bab29c11a116cc1784c9b81608182f70bf7e08f504a22f633c41d0ee1d75ce2020910d7

Download Submit
C:\Windows\System\tuzRsHn.exe

Filesize
1.6MB

MD5
abaa705f66e25f2d20c3517d11431ceb

SHA1
41439b31df43da4adc9c5dd6693aea46f6c62361

SHA256
a0f0d702f7c6da867f0a4cfea934edabb72b69da4cd8fd8a289408dd36ee8a0c

SHA512
d765e4ada697bed18538e2213bb9b6e7d0f7de10f4e36c37627611ad4a60f751cf6c35e7ac0c22844becea7a6e174d7aa36ff5db1fc8f8f0815c63b0a03a3a41

Download Submit
C:\Windows\System\uMAZuAY.exe

Filesize
1.6MB

MD5
cd7534017c76eb1590638cc70830b638

SHA1
178e4116a67a9f33cf8d6aa5bdf0c7f38864771f

SHA256
966e255f930c4f4da950d85665cd291224a971b465d439dc366ca40c799d74fd

SHA512
e4ab05006cbdc5aeca45495d6b724fd024097673e65a4e233c6a4a7f9a0e82f1fe78d2a059e226edc9dc2e88ae2c1f86253af2ec0e2bf2008c24cd8308f97f18

Download Submit
C:\Windows\System\ueXTGWc.exe

Filesize
1.6MB

MD5
113da1a0babc3494a31ffb928e3662a4

SHA1
bfbcbabeb8023772dc79236cbb256f8e563da31d

SHA256
dc14d8c340606abd502d3702690df76524a1e784aca4f8562f657c95c3aa1a21

SHA512
15b13dde82b27b9a1d94a9f6cfa319ca1558884fa6af0c8d315c22efbd5e1054af393d8cb7e600ed61addf355ccc0e4ef65776fa1f78f35f9cf9422001f2f5dc

Download Submit
C:\Windows\System\vQlMzRa.exe

Filesize
1.6MB

MD5
9df1f77bcedb774ec604e2c88608cfa0

SHA1
411822031775e424d878561deb0674df133bed45

SHA256
2cc6769ec0c63fb910a6a9a7b0af01ea31237cce4511d6ae1701945545f3490d

SHA512
899c2027fbc48282dae2a6adc3de829abd65fb919f084be4b5a7de53c27ebf521a42ae8dd5b9718a19732428e146a047483957cafef7e8ef4f5f6a567ce004a7

Download Submit
C:\Windows\System\wRIpPnt.exe

Filesize
1.6MB

MD5
3ca12e2170338d0da046e3ec12855097

SHA1
e339e3fb4060fba0acca2e86cfe01139bc9cac39

SHA256
4f3b45e034121bad1c4ceb06bea37c4db14c6d8c5a9c82a4054c36485519d5b5

SHA512
2601b550e44fe68f36d1304a154acd752ba30fa7fcc6f920b9228d06518012e5b09900b1c9db8539fb7286d69ccdf5d2bf5b2ad0c1ae19e1230925a27214163a

Download Submit
C:\Windows\System\zasyYwf.exe

Filesize
1.6MB

MD5
a6e7e61b58735219c6458c0b6033e943

SHA1
1d6530c0292f0b5df7645c2c215d9dd9a49b654f

SHA256
61877f513e53626af4691730655cb9dbae34be4ad060d844128f5f62a1ee66fa

SHA512
d1dc346309650dd2df766aaafc75d31574ec83f24c18326445c5297e9fa5017b91f9ddf4827c60aafe982f16fd1eba8918aa3efb8337158d51df47a5cd1c4bd7

Download Submit
memory/404-2764-0x00007FF6EDC50000-0x00007FF6EE042000-memory.dmp

Filesize
3.9MB

Download
memory/404-147-0x00007FF6EDC50000-0x00007FF6EE042000-memory.dmp

Filesize
3.9MB

Download
memory/1044-281-0x00007FF6BB4D0000-0x00007FF6BB8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1044-2756-0x00007FF6BB4D0000-0x00007FF6BB8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-541-0x00007FF78AE60000-0x00007FF78B252000-memory.dmp

Filesize
3.9MB

Download
memory/1304-2793-0x00007FF78AE60000-0x00007FF78B252000-memory.dmp

Filesize
3.9MB

Download
memory/1504-29-0x00007FF700C60000-0x00007FF701052000-memory.dmp

Filesize
3.9MB

Download
memory/1504-2737-0x00007FF700C60000-0x00007FF701052000-memory.dmp

Filesize
3.9MB

Download
memory/1504-2746-0x00007FF700C60000-0x00007FF701052000-memory.dmp

Filesize
3.9MB

Download
memory/1520-114-0x00007FF788F00000-0x00007FF7892F2000-memory.dmp

Filesize
3.9MB

Download
memory/1520-2753-0x00007FF788F00000-0x00007FF7892F2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-2741-0x00007FF614CE0000-0x00007FF6150D2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-16-0x00007FF614CE0000-0x00007FF6150D2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-2816-0x00007FF7B5AC0000-0x00007FF7B5EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-759-0x00007FF7B5AC0000-0x00007FF7B5EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-1760-0x00007FF6FC250000-0x00007FF6FC642000-memory.dmp

Filesize
3.9MB

Download
memory/2612-2743-0x00007FF6FC250000-0x00007FF6FC642000-memory.dmp

Filesize
3.9MB

Download
memory/3080-228-0x00007FF752BB0000-0x00007FF752FA2000-memory.dmp

Filesize
3.9MB

Download
memory/3080-2758-0x00007FF752BB0000-0x00007FF752FA2000-memory.dmp

Filesize
3.9MB

Download
memory/3228-2856-0x00007FF6A9540000-0x00007FF6A9932000-memory.dmp

Filesize
3.9MB

Download
memory/3228-450-0x00007FF6A9540000-0x00007FF6A9932000-memory.dmp

Filesize
3.9MB

Download
memory/3404-1042-0x00007FF64C540000-0x00007FF64C932000-memory.dmp

Filesize
3.9MB

Download
memory/3404-2767-0x00007FF64C540000-0x00007FF64C932000-memory.dmp

Filesize
3.9MB

Download
memory/3456-612-0x00007FF784600000-0x00007FF7849F2000-memory.dmp

Filesize
3.9MB

Download
memory/3456-2798-0x00007FF784600000-0x00007FF7849F2000-memory.dmp

Filesize
3.9MB

Download
memory/3548-1-0x000002B04E910000-0x000002B04E920000-memory.dmp

Filesize
64KB

Download
memory/3548-0-0x00007FF73A0D0000-0x00007FF73A4C2000-memory.dmp

Filesize
3.9MB

Download
memory/3812-2751-0x00007FF6878B0000-0x00007FF687CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3812-83-0x00007FF6878B0000-0x00007FF687CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4312-2870-0x00007FF743B90000-0x00007FF743F82000-memory.dmp

Filesize
3.9MB

Download
memory/4312-377-0x00007FF743B90000-0x00007FF743F82000-memory.dmp

Filesize
3.9MB

Download
memory/4580-1064-0x0000018B779C0000-0x0000018B779E2000-memory.dmp

Filesize
136KB

Download
memory/4768-62-0x00007FF668C40000-0x00007FF669032000-memory.dmp

Filesize
3.9MB

Download
memory/4768-2739-0x00007FF668C40000-0x00007FF669032000-memory.dmp

Filesize
3.9MB

Download
memory/4768-2760-0x00007FF668C40000-0x00007FF669032000-memory.dmp

Filesize
3.9MB

Download
memory/4796-54-0x00007FF73DC90000-0x00007FF73E082000-memory.dmp

Filesize
3.9MB

Download
memory/4796-2738-0x00007FF73DC90000-0x00007FF73E082000-memory.dmp

Filesize
3.9MB

Download
memory/4796-2749-0x00007FF73DC90000-0x00007FF73E082000-memory.dmp

Filesize
3.9MB

Download
memory/4944-2762-0x00007FF68CA80000-0x00007FF68CE72000-memory.dmp

Filesize
3.9MB

Download
memory/4944-339-0x00007FF68CA80000-0x00007FF68CE72000-memory.dmp

Filesize
3.9MB

Download